@aglyn/aglyn 1.0.0-beta.143

package/src/lib/app-utils/consent-banner-ui.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/consent-banner-ui.tsx"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n// Deliberately NO 'use client' directive: inside @aglyn/aglyn the directive\n// splits the bundler into a duplicate module graph, and the second\n// canvas/emitter singleton renders the tenant site blank (AGL-52 — the\n// lint rule that enforces this). It is also unnecessary: every importer\n// (the tenant catch-all, the console preview simulator) is itself a\n// 'use client' module, so this file is already inside the client graph. A\n// future import from a SERVER component fails loudly at build time\n// (\"useState only works in a client component\"), not silently.\n\nimport { Box, Button, Paper, Stack, Typography } from '@mui/material'\nimport {\n  type ReactElement,\n  type ReactNode,\n  useEffect,\n  useRef,\n  useState,\n} from 'react'\nimport type { ConsentPreferencesDialog } from './consent-preferences-dialog'\nimport {\n  readStoredVisitorConsent,\n  refusalStatusFor,\n  type StoredVisitorConsent,\n  storeVisitorConsent,\n  VISITOR_CONSENT_OPEN_EVENT,\n  type VisitorConsentPosture,\n  type VisitorConsentStatus,\n} from './visitor-consent'\n\n/**\n * The visitor consent surfaces (AGL-1498) — UI over the enforcement layer,\n * never the enforcement itself: the GA script stays unloaded until a\n * granting state is recorded, whether or not this component ever rendered.\n *\n * Three surfaces in one component, driven by the resolved state:\n *\n * - **The prior-consent banner** (opt-in posture, undecided visitor):\n *   symmetric Allow / Decline plus Preferences — the peer benchmark's\n *   credible shape; Decline is never buried.\n * - **The \"Your Privacy Choices\" pill**: a small, persistent, fixed control on\n *   EVERY page whenever the consent machinery is active. In the implied\n *   posture no banner and no notice ever renders (the Squarespace shape),\n *   which makes this pill the ONE discoverable opt-out surface — that is\n *   why it is platform-mounted rather than a per-template footer link a\n *   theme could drop. Sites can additionally link any element to\n *   `#aglyn-consent`; both open the same panel.\n * - **The preferences panel**: change the state in EITHER direction at any\n *   time — accept after declining, opt out after being defaulted in.\n *\n * ## EVERY surface renders this component\n *\n * Published customer sites, the console — signed in and signed out — and the\n * console preview's region simulator. There were two implementations of these\n * three surfaces and they had already drifted into two different designs: a\n * plain card with bare checkboxes on one side, a MUI dialog with switches and\n * descriptions on the other. The dialog is the design that survived, and the\n * differences that were real turned out to be STRINGS — \"this site\" against\n * \"this console\", carts against signing in — which is what {@link ConsentCopy}\n * is for. A string is not a reason for a second component.\n *\n * MUI is available on both: the tenant runtime renders it through\n * `HostThemeProvider`, under the same `AppRouterCacheProvider` emotion cache\n * the console uses, and `membership-page.tsx` already draws MUI components a\n * folder away from the call site here. The unlayered-cache hazard is the\n * BESIGNER canvas, which no published page and no consent surface goes\n * through.\n *\n * Palette and type come from whichever theme is in scope, which on a customer\n * site is the site's own — the control belongs to the page it is asked on. The\n * two things that must NOT follow a theme are the §7015 mark, which is\n * transcribed artwork, and {@link CONSENT_OVERLAY_Z_INDEX}, which has to\n * outrank a popup backdrop no theme knows about.\n */\n\n/**\n * The title of the persistent opt-out control — **fixed by regulation, not a\n * copy choice**.\n *\n * Once a business \"shares\" personal information for cross-context behavioral\n * advertising, CCPA §1798.135(b) requires a clear and conspicuous opt-out\n * link, and CCPA regs §7015 permit a SINGLE combined link only when it is\n * titled with these exact words. Aglyn crossed that line when advertising\n * technology went onto aglyn.com, so the pill's previous label — \"Privacy\n * choices\" — stopped being compliant the moment the tag shipped.\n *\n * Capitalisation is part of the specified title. Do not sentence-case it to\n * match the rest of the overlay copy, do not shorten it to fit a narrow\n * viewport, and do not translate it away on a US-facing site: it is pinned by\n * `consent-opt-out-title.spec.tsx`, which renders the real control and reads\n * the text back.\n */\nexport const CONSENT_OPT_OUT_TITLE = 'Your Privacy Choices'\n\n/**\n * The official CCPA **opt-out icon** — the other half of §7015, and the half\n * AGL-2011's title commit deliberately left undone.\n *\n * §7015(a) requires the icon *\"in approximately the same size as any other\n * icons\"* and §7015(c) requires it to *\"be approximately the same size as\n * other icons on the business's webpage\"* and to appear immediately to the\n * left of the \"Your Privacy Choices\" text. §7015(f) is the reason the shapes\n * below are transcribed rather than drawn: the regulation points at\n * *published artwork*, not at a description of a toggle, so an approximation\n * that reads as \"close enough\" is not the mark the regulation names.\n *\n * ## Provenance — read this before touching a single coordinate\n *\n * Downloaded from the California Attorney General's own icon page,\n * `oag.ca.gov/privacy/ccpa/icons-download`, by two independent routes that\n * agree byte for byte: the `ccpa-icons.zip` bundle that page offers, and the\n * standalone `privacyoptions.svg` that page displays inline. Both are\n * sha256 `86f2eb97cc1f3909c12e4512de9e267215d94ac5aaee9393d0f007f18c34e8ba`.\n * The unmodified file is committed at\n * `apps/tenant/public/_static/images/legal/ccpa-opt-out-icon.svg` — diff it\n * against the AG's copy to re-verify at any time.\n *\n * ## Why the paths are inlined here and not `<img src>`-ed\n *\n * The AGL-1810 duplicate-with-pointer pattern, for the same reason the admin\n * bar uses it: this component renders on **every published customer site**\n * and inside the console's preview simulator, and neither an extra fetch nor\n * a broken-image glyph is acceptable where a regulator's mark is supposed to\n * be. A self-hosted deployment gets the mark with no asset pipeline at all.\n * If the AG ever republishes the artwork, change the committed file AND\n * these four constants.\n *\n * ## What was changed in transcription, and what was not\n *\n * The coordinates and the two colours are verbatim. The only change is that\n * the AG file carries its fills in a `<style>` block of `.st0`–`.st3`\n * classes, and an inline `<style>` inside a shared overlay is **document-\n * global CSS**: shipping it would define `.st0`/`.st1` on every customer's\n * page and restyle any element of theirs that happens to use those names. So\n * each class is expanded to the presentation attributes it stood for —\n * `.st0`/`.st1` are `fill-rule:evenodd; clip-rule:evenodd` plus the fill,\n * `.st2`/`.st3` are the fill alone. Paint order is the file's own; the white\n * left-hand fill is painted before the blue shell that rings it.\n */\n/** `.st0` — the white field behind the check, inside the shell's cut-out. */\nconst OPT_OUT_ICON_LEFT_FIELD_PATH =\n  'M7.4,12.8h6.8l3.1-11.6H7.4C4.2,1.2,1.6,3.8,1.6,7S4.2,12.8,7.4,12.8z'\n/** `.st1` — the blue toggle shell, evenodd so the left half reads through. */\nconst OPT_OUT_ICON_SHELL_PATH =\n  'M22.6,0H7.4c-3.9,0-7,3.1-7,7s3.1,7,7,7h15.2c3.9,0,7-3.1,7-7S26.4,0,22.6,0z M1.6,7c0-3.2,2.6-5.8,5.8-5.8' +\n  ' h9.9l-3.1,11.6H7.4C4.2,12.8,1.6,10.2,1.6,7z'\n/** `.st2` (`id=\"x\"`) — the white cross on the blue half. */\nconst OPT_OUT_ICON_CROSS_PATH =\n  'M24.6,4c0.2,0.2,0.2,0.6,0,0.8l0,0L22.5,7l2.2,2.2c0.2,0.2,0.2,0.6,0,0.8c-0.2,0.2-0.6,0.2-0.8,0' +\n  ' l0,0l-2.2-2.2L19.5,10c-0.2,0.2-0.6,0.2-0.8,0c-0.2-0.2-0.2-0.6,0-0.8l0,0L20.8,7l-2.2-2.2c-0.2-0.2-0.2-0.6,0-0.8' +\n  ' c0.2-0.2,0.6-0.2,0.8,0l0,0l2.2,2.2L23.8,4C24,3.8,24.4,3.8,24.6,4z'\n/** `.st3` (`id=\"y\"`) — the blue check on the white half. */\nconst OPT_OUT_ICON_CHECK_PATH =\n  'M12.7,4.1c0.2,0.2,0.3,0.6,0.1,0.8l0,0L8.6,9.8C8.5,9.9,8.4,10,8.3,10c-0.2,0.1-0.5,0.1-0.7-0.1l0,0' +\n  ' L5.4,7.7c-0.2-0.2-0.2-0.6,0-0.8c0.2-0.2,0.6-0.2,0.8,0l0,0L8,8.6l3.8-4.5C12,3.9,12.4,3.9,12.7,4.1z'\n\n/** The mark's own colours. Not themeable — see {@link CcpaOptOutIcon}. */\nconst OPT_OUT_ICON_BLUE = '#0066FF'\nconst OPT_OUT_ICON_WHITE = '#FFFFFF'\n\n/**\n * The opt-out icon, sized for the pill.\n *\n * `aria-hidden`, because it sits beside the words it stands for: the pill\n * already announces \"Your Privacy Choices\" as its accessible name, and a\n * labelled icon next to identical visible text makes a screen reader say the\n * title twice. Same treatment as the admin bar's mark.\n *\n * 26 × 12 against the file's own `0 0 30 14` viewBox, so the default\n * `preserveAspectRatio` scales the drawing to the 12px height — one line of\n * the pill's 12px/1.4 text — and centres it. That is what §7015's \"the same\n * size as other icons\" asks for here: the pill has no other icons, so the\n * text is the scale to match.\n *\n * **The colours are the regulation's, not the theme's.** The pill's own\n * background is a fixed near-white that no tenant palette reaches, which is\n * exactly the surface this artwork was published against — so it needs no\n * light/dark variant and must not be given one.\n */\n/**\n * Exported so a surface that renders its own opt-out control gets the\n * REGULATOR'S artwork rather than an approximation of it. §7015(f) points at\n * published artwork, and the console's unauthenticated pages need the same\n * mark this overlay draws — a second, hand-drawn toggle would be a different\n * mark wearing the same name.\n */\nexport function CcpaOptOutIcon(): ReactElement {\n  return (\n    <svg\n      xmlns=\"http://www.w3.org/2000/svg\"\n      viewBox=\"0 0 30 14\"\n      width={26}\n      height={12}\n      aria-hidden=\"true\"\n      focusable=\"false\"\n      style={{ flexShrink: 0, display: 'block' }}\n      data-aglyn-consent-optout-icon=\"\"\n    >\n      <path\n        d={OPT_OUT_ICON_LEFT_FIELD_PATH}\n        fill={OPT_OUT_ICON_WHITE}\n        fillRule=\"evenodd\"\n        clipRule=\"evenodd\"\n      />\n      <path\n        d={OPT_OUT_ICON_SHELL_PATH}\n        fill={OPT_OUT_ICON_BLUE}\n        fillRule=\"evenodd\"\n        clipRule=\"evenodd\"\n      />\n      <path d={OPT_OUT_ICON_CROSS_PATH} fill={OPT_OUT_ICON_WHITE} />\n      <path d={OPT_OUT_ICON_CHECK_PATH} fill={OPT_OUT_ICON_BLUE} />\n    </svg>\n  )\n}\n/**\n * The stacking context the consent surfaces must win, and why it is a number\n * rather than a theme token.\n *\n * `theme.zIndex.modal` is 1300, and on a published site the consent card has\n * to sit above the popup backdrop at 2147483200 — the consent question\n * outranks a promotional popup, and the popup's own GA mirrors are waiting on\n * the answer. Exported so the console preview's own panel can be raised\n * against the real value instead of a copy of it.\n */\nexport const CONSENT_OVERLAY_Z_INDEX = 2147483400\n\n/** The persistent control sits just below the card it can be replaced by. */\nexport const CONSENT_PILL_Z_INDEX = 2147483390\n\n/** The card both the banner and the preferences panel are drawn on. */\nconst CARD_WIDTH = 'min(680px, calc(100vw - 24px))'\n\n/** Breathing room kept between the pill and the last row it must not cover. */\nconst PILL_CLEARANCE = 8\n\n/**\n * Selector for \"the end of the page\" — the footer landmark, however the\n * template spells it. A besigner-authored footer renders as `<footer>`;\n * `[role=contentinfo]` catches a hand-rolled one. `body` is the fallback so\n * a site with no footer at all still reserves the room.\n */\nconst FOOTER_SELECTOR = 'footer, [role=\"contentinfo\"]'\n\n/**\n * Bottom padding the end of the page needs so the fixed pill cannot land on\n * top of it (AGL-2205).\n *\n * Derived from the pill's MEASURED box rather than from `PILL_STYLE`: the\n * label wraps to two lines in a narrow viewport and in a translated locale,\n * and a clearance computed from the constants would be exactly one line\n * short in precisely the case where the copyright row is already tightest.\n *\n * Pure, and exported, because the geometry is the whole fix: a spec can pin\n * \"51px of room for a 30.8px pill sitting 12px off the bottom\" without a\n * layout engine, which is the half a jsdom render cannot check.\n */\nexport function consentPillClearance(\n  viewportHeight: number,\n  pillTop: number,\n): number {\n  if (!Number.isFinite(viewportHeight) || !Number.isFinite(pillTop)) return 0\n  return Math.max(0, Math.ceil(viewportHeight - pillTop) + PILL_CLEARANCE)\n}\n\n/**\n * Reserves that room at the foot of the document while the pill is up.\n *\n * The pill is `position: fixed`, so scrolling to the end of the page parks\n * it directly on the footer's bottom row — which on every Aglyn marketing\n * page is the \"© 2026 Aglyn LLC\" line, the one piece of footer content that\n * is there for legal reasons. Measured on aglyn.com/pricing before this: the\n * pill occupied 12–126 × 680–711 and the copyright row 24–258 × 669–689, a\n * 102 × 9 px overlap at 1440 and the same again at 375.\n *\n * AGL-2205 proposed docking the pill above the footer instead. Measuring the\n * real footer ruled that out: it is 490px tall at 1440 and 1375px at 375,\n * against an 812px viewport — docking above it puts the pill in the middle\n * of the screen on desktop and clean off it on mobile, and the pill is the\n * ONLY opt-out surface a visitor in the implied posture ever sees, so it may\n * not scroll away. Reserving the pill's own footprint keeps it where people\n * expect it, costs nothing to anyone who never scrolls that far, and the\n * room appears INSIDE the footer's own background band rather than as a\n * strip of body colour underneath it.\n *\n * Only the DEFICIT is added: a template that already leaves enough room is\n * left exactly as it was, which is why the site's own padding is re-read\n * (with ours removed) on every pass instead of being captured once — it is\n * responsive, and a value cached at mount is wrong after the first resize.\n */\nfunction useConsentPillClearance(\n  pillRef: { current: HTMLElement | null },\n  active: boolean,\n): void {\n  useEffect(() => {\n    const pill = pillRef.current\n    if (!active || !pill) return\n    const doc = pill.ownerDocument\n    const view = doc?.defaultView\n    // `ownerDocument`, never the global `document`: the console preview\n    // mounts this same component, and reserving room in the CONSOLE's\n    // chrome because the preview happens to share its document would be a\n    // fix applied to the wrong page.\n    if (!doc || !view) return\n    const target: HTMLElement | null =\n      doc.querySelector<HTMLElement>(FOOTER_SELECTOR) ?? doc.body\n    if (!target) return\n\n    const previous = target.style.getPropertyValue('padding-bottom')\n    const previousPriority = target.style.getPropertyPriority('padding-bottom')\n    const restore = () => {\n      if (previous) {\n        target.style.setProperty('padding-bottom', previous, previousPriority)\n      } else {\n        target.style.removeProperty('padding-bottom')\n      }\n    }\n\n    const apply = () => {\n      // Ours off first: `getComputedStyle` would otherwise read back the\n      // value this effect wrote on the previous pass and ratchet it upward.\n      // Safe to do mid-measurement — the pill is fixed, so the reflow this\n      // causes cannot move it.\n      restore()\n      const natural =\n        Number.parseFloat(view.getComputedStyle(target).paddingBottom) || 0\n      const needed = consentPillClearance(\n        view.innerHeight,\n        pill.getBoundingClientRect().top,\n      )\n      if (needed > natural) {\n        target.style.setProperty('padding-bottom', `${needed}px`)\n      }\n    }\n\n    apply()\n    view.addEventListener('resize', apply)\n    // The pill's own box changes without the viewport changing — a font\n    // finishing loading re-wraps the label.\n    const observer =\n      typeof view.ResizeObserver === 'function'\n        ? new view.ResizeObserver(apply)\n        : undefined\n    observer?.observe(pill)\n    return () => {\n      view.removeEventListener('resize', apply)\n      observer?.disconnect()\n      restore()\n    }\n  }, [pillRef, active])\n}\n\n/**\n * The words each surface uses, so one component serves them all.\n *\n * A console says \"this console\" and a published site says \"this site\"; the\n * strictly-necessary sentence names shopping carts on a customer site and\n * signing in on the console. Those are STRINGS, and a string is not a reason\n * for a second component — which is what the two implementations this replaces\n * had become. Every field defaults to the published-site wording, so a caller\n * that has nothing to say differently passes nothing.\n */\nexport interface ConsentCopy {\n  /** Opens the preferences panel. */\n  panelIntro?: string\n  /** Names what runs regardless, and why it is not being asked about. */\n  strictlyNecessary?: string\n  /** The ask, on a site that runs analytics only. */\n  bannerAnalyticsOnly?: string\n  /** The ask, on a site that also asks about advertising. */\n  bannerWithAdvertising?: string\n  /** The analytics control's label and the line under it. */\n  analyticsLabel?: string\n  analyticsDetail?: string\n  /** The advertising control's, where the surface asks about it. */\n  advertisingLabel?: string\n  advertisingDetail?: string\n}\n\nconst DEFAULT_COPY: Required<ConsentCopy> = {\n  panelIntro: 'Choose what this site may use.',\n  strictlyNecessary:\n    'Strictly necessary features — like shopping carts, sign-in, and ' +\n    'remembering this choice — are always on because the site cannot work ' +\n    'without them.',\n  bannerAnalyticsOnly:\n    'This site would like to use analytics (Google Analytics) to understand ' +\n    'how it is used. Analytics only runs if you allow it — everything else ' +\n    'works either way.',\n  bannerWithAdvertising:\n    'This site would like to use analytics (Google Analytics) to understand ' +\n    'how it is used, and advertising cookies to personalize ads and measure ' +\n    'how they perform. Neither runs unless you allow it — everything else ' +\n    'works either way. Use Preferences to choose them separately.',\n  analyticsLabel: 'Analytics',\n  analyticsDetail: 'Google Analytics — how the site is used.',\n  advertisingLabel: 'Advertising',\n  advertisingDetail: 'Personalized ads and measuring how they perform.',\n}\n\nexport interface ConsentBannerUiProps {\n  hostId: string\n  /** The visitor's recorded state; null means undecided. */\n  stored: StoredVisitorConsent | null\n  /** The resolved posture; only consulted while undecided. */\n  posture: VisitorConsentPosture | null\n  /** Region at decision time, recorded onto explicit choices. */\n  country?: string | null\n  /**\n   * Whether this surface asks about advertising storage. Resolved by the\n   * caller — from the host document on a published site, from the platform's\n   * own consent declaration on the console.\n   */\n  advertising?: boolean\n  /** Per-surface wording; see {@link ConsentCopy}. */\n  copy?: ConsentCopy\n  /**\n   * Links to the policies behind the choice, rendered under the copy on both\n   * the banner and the panel.\n   *\n   * A node rather than a pair of URLs: the console links its own published\n   * Privacy and Cookie policies through its route constants, and a published\n   * site links whatever its owner has. A choice offered with no way to read\n   * what is being chosen is not an informed one, but neither surface's links\n   * are this component's to know.\n   */\n  policyLinks?: ReactNode\n  /**\n   * Whether the persistent \"Your Privacy Choices\" control may render here.\n   *\n   * `true` — the default, and every published site — draws the pill whenever\n   * no other surface is up. It is the ONLY opt-out surface a visitor in the\n   * implied posture ever sees, so it is platform-mounted rather than left to\n   * a template that could drop it.\n   *\n   * `false` for a page that already carries the control somewhere better. The\n   * console's signed-in pages put it in the account menu, where a person looks\n   * for their own settings; floating a second copy over the page would be the\n   * same control drawn twice.\n   */\n  showPill?: boolean\n  /**\n   * The caller owns what a decision DOES.\n   *\n   * Unset — a published site — persists through `storeVisitorConsent`, which\n   * is where the withdrawal behaviour lives: it re-derives both grants from\n   * the status, silences any resident tag, sweeps the analytics and\n   * advertising cookies and dispatches the change event.\n   *\n   * Set, and the caller writes instead. The console writes through\n   * `storePlatformConsent` so the record also mirrors across its hostnames;\n   * the console's region simulator writes nothing at all, which is what keeps\n   * previewing as-if-from-the-EU from recording a real consent record.\n   */\n  onDecision?: (status: VisitorConsentStatus, advertising?: boolean) => void\n}\n\n/** The card both overlays are drawn on — fixed, centred, above everything. */\nconst overlayCardSx = {\n  position: 'fixed',\n  left: '50%',\n  bottom: 16,\n  transform: 'translateX(-50%)',\n  zIndex: CONSENT_OVERLAY_Z_INDEX,\n  width: CARD_WIDTH,\n  p: 2,\n  borderRadius: 3,\n  textAlign: 'left',\n} as const\n\n/**\n * The preferences panel, once its module has arrived.\n *\n * The panel is the one consent surface a visit has to ask for, and its MUI\n * dialog, modal, focus trap, transitions and switches weigh more than the\n * banner and the pill together. So it is a module of its own, fetched when\n * the panel is asked for — or when the pointer or focus reaches a control\n * that opens it — rather than with the banner every first-time visitor sees.\n *\n * Module scope, not a `React.lazy`: once loaded, every later render draws it\n * synchronously, with no Suspense boundary and no fallback frame.\n */\nlet loadedPreferencesDialog: typeof ConsentPreferencesDialog | undefined\nlet preferencesDialogLoad: Promise<void> | undefined\n\n/**\n * Fetches the preferences panel's module, once. A failed fetch is forgotten\n * so the next attempt can retry it.\n *\n * Exported for callers that know the panel is about to be needed, and for\n * specs that open it and read it back in the same tick.\n */\nexport function preloadConsentPreferences(): Promise<void> {\n  preferencesDialogLoad ??= import('./consent-preferences-dialog')\n    .then((module) => {\n      loadedPreferencesDialog = module.ConsentPreferencesDialog\n    })\n    .catch((error: unknown) => {\n      preferencesDialogLoad = undefined\n      throw error\n    })\n  return preferencesDialogLoad\n}\n\n/** Starts the panel's fetch on a sign of intent; a failure surfaces on open. */\nfunction warmPreferences(): void {\n  preloadConsentPreferences().catch((): void => undefined)\n}\n\nexport function ConsentBannerUi(props: ConsentBannerUiProps): ReactElement | null {\n  const {\n    hostId,\n    stored,\n    posture,\n    country,\n    advertising,\n    copy,\n    policyLinks,\n    showPill = true,\n    onDecision,\n  } = props\n  const words = { ...DEFAULT_COPY, ...copy }\n  const [preferencesOpen, setPreferencesOpen] = useState(false)\n  const [analyticsChecked, setAnalyticsChecked] = useState(\n    stored?.analytics === true,\n  )\n  // Starts UNTICKED unless the visitor previously said yes to this exact\n  // category (AGL-1649). A pre-ticked advertising box is consent by\n  // inattention, which is the thing a banner is supposed to replace.\n  const [adsChecked, setAdsChecked] = useState(stored?.advertising === true)\n\n  // The change-your-mind paths: the window event, and a `#aglyn-consent`\n  // link click anywhere in the page (capture, so canvas link handling that\n  // stops propagation cannot swallow it).\n  useEffect(() => {\n    const open = () => {\n      const current = readStoredVisitorConsent(hostId)\n      setAnalyticsChecked(current?.analytics === true)\n      setAdsChecked(current?.advertising === true)\n      setPreferencesOpen(true)\n    }\n    const onClick = (event: MouseEvent) => {\n      const target = event.target as Element | null\n      const anchor = target?.closest?.('a[href]')\n      if (\n        anchor &&\n        (anchor.getAttribute('href') ?? '').endsWith('#aglyn-consent')\n      ) {\n        event.preventDefault()\n        open()\n      }\n    }\n    window.addEventListener(VISITOR_CONSENT_OPEN_EVENT, open)\n    document.addEventListener('click', onClick, true)\n    return () => {\n      window.removeEventListener(VISITOR_CONSENT_OPEN_EVENT, open)\n      document.removeEventListener('click', onClick, true)\n    }\n  }, [hostId])\n\n  // `ads` is only ever passed through; `storeVisitorConsent` re-derives it\n  // against the status, so a refusal cannot carry a grant however this is\n  // called.\n  const decide = (status: VisitorConsentStatus, ads = false) => {\n    const granted = advertising === true && ads\n    if (onDecision) {\n      onDecision(status, granted)\n    } else {\n      storeVisitorConsent(hostId, { status, country, advertising: granted })\n    }\n    setPreferencesOpen(false)\n  }\n\n  // Same gate either way, distinct record — see `refusalStatusFor`.\n  const refusalStatus = refusalStatusFor(stored, posture)\n\n  // The panel is drawn only once its module is here. Until then the surface\n  // that asked for it stays up, so a slow fetch never blanks the banner or\n  // the pill; a fetch that fails puts the request down, and the next click\n  // retries it.\n  const [, setPreferencesArrived] = useState(false)\n  useEffect(() => {\n    if (!preferencesOpen || loadedPreferencesDialog) return undefined\n    let active = true\n    preloadConsentPreferences().then(\n      () => {\n        if (active) setPreferencesArrived(true)\n      },\n      () => {\n        if (active) setPreferencesOpen(false)\n      },\n    )\n    return () => {\n      active = false\n    }\n  }, [preferencesOpen])\n  const PreferencesDialog = preferencesOpen ? loadedPreferencesDialog : undefined\n\n  const askBanner = !stored && posture === 'opt-in' && !PreferencesDialog\n\n  // Before the early returns below, so the hook order never depends on which\n  // of the three surfaces is up. The banner and the panel are centred cards\n  // that reserve nothing — only the pill parks itself on the footer.\n  const pillRef = useRef<HTMLButtonElement | null>(null)\n  useConsentPillClearance(pillRef, showPill && !PreferencesDialog && !askBanner)\n\n  if (PreferencesDialog) {\n    return (\n      <PreferencesDialog\n        title={CONSENT_OPT_OUT_TITLE}\n        zIndex={CONSENT_OVERLAY_Z_INDEX}\n        words={words}\n        advertising={advertising}\n        policyLinks={policyLinks}\n        analyticsChecked={analyticsChecked}\n        onAnalyticsChange={setAnalyticsChecked}\n        adsChecked={adsChecked}\n        onAdsChange={setAdsChecked}\n        onClose={() => setPreferencesOpen(false)}\n        onDeclineAll={() => decide(refusalStatus)}\n        onSave={() =>\n          decide(\n            analyticsChecked ? 'accepted' : refusalStatus,\n            // Advertising cannot outlive analytics: unticking analytics and\n            // leaving advertising ticked is a refusal of both, which\n            // `consentModeSignals` also clamps independently.\n            analyticsChecked && adsChecked,\n          )\n        }\n      />\n    )\n  }\n\n  if (askBanner) {\n    return (\n      <Paper\n        elevation={8}\n        role=\"region\"\n        aria-label=\"Privacy choices\"\n        data-aglyn-consent-banner=\"\"\n        sx={overlayCardSx}\n      >\n        <Stack\n          direction={{ xs: 'column', sm: 'row' }}\n          spacing={1.5}\n          sx={{ alignItems: { xs: 'stretch', sm: 'center' } }}\n        >\n          <Box sx={{ flex: 1, minWidth: 0 }}>\n            <Typography variant=\"body2\">\n              {advertising\n                ? words.bannerWithAdvertising\n                : words.bannerAnalyticsOnly}\n            </Typography>\n            {policyLinks ? <Box sx={{ mt: 0.5 }}>{policyLinks}</Box> : null}\n          </Box>\n          <Stack\n            direction=\"row\"\n            spacing={1}\n            sx={{ flexShrink: 0, flexWrap: 'wrap' }}\n          >\n            <Button\n              size=\"small\"\n              onPointerEnter={warmPreferences}\n              onFocus={warmPreferences}\n              onClick={() => {\n                setAnalyticsChecked(stored != null && stored.analytics)\n                setAdsChecked(stored != null && stored.advertising === true)\n                setPreferencesOpen(true)\n              }}\n            >\n              {'Preferences'}\n            </Button>\n            <Button\n              size=\"small\"\n              variant=\"outlined\"\n              onClick={() => decide('declined')}\n            >\n              {'Decline'}\n            </Button>\n            <Button\n              size=\"small\"\n              variant=\"contained\"\n              onClick={() => decide('accepted', advertising === true)}\n            >\n              {advertising ? 'Allow all' : 'Allow'}\n            </Button>\n          </Stack>\n        </Stack>\n      </Paper>\n    )\n  }\n\n  if (!showPill) return null\n\n  // The pill renders whenever no other surface is up — INCLUDING the\n  // implied posture, where it is the only opt-out surface there is.\n  return (\n    <Button\n      ref={pillRef}\n      type=\"button\"\n      // No ripple, and it is not cosmetic: `consent-opt-out-title.spec.tsx`\n      // reads the control's LAST child to prove the §7015 title is the text\n      // immediately right of the §7015 mark, and a ripple span would be the\n      // last child instead.\n      disableRipple\n      data-aglyn-consent-pill=\"\"\n      aria-label={CONSENT_OPT_OUT_TITLE}\n      variant=\"outlined\"\n      size=\"small\"\n      onPointerEnter={warmPreferences}\n      onFocus={warmPreferences}\n      onClick={() => {\n        const current = onDecision ? stored : readStoredVisitorConsent(hostId)\n        setAnalyticsChecked(current?.analytics === true)\n        setAdsChecked(current?.advertising === true)\n        setPreferencesOpen(true)\n      }}\n      sx={{\n        position: 'fixed',\n        left: 12,\n        bottom: 12,\n        zIndex: CONSENT_PILL_Z_INDEX,\n        gap: 0.75,\n        flexWrap: 'wrap',\n        maxWidth: 'calc(100vw - 24px)',\n        borderRadius: 999,\n        textTransform: 'none',\n        color: 'text.secondary',\n        borderColor: 'divider',\n        backgroundColor: 'background.paper',\n      }}\n    >\n      {/*\n        Icon FIRST: §7015 places the opt-out icon immediately to the left of\n        the title, and this is the control the regulation is about. The\n        prior-consent banner deliberately gets neither the title nor the icon\n        — it is a consent solicitation that disappears once answered, so\n        dressing it in the regulation's mark would advertise it as the\n        persistent opt-out link it cannot be.\n      */}\n      <CcpaOptOutIcon />\n      {CONSENT_OPT_OUT_TITLE}\n    </Button>\n  )\n}\n\nexport default ConsentBannerUi\n"],"names":["Box","Button","Paper","Stack","Typography","useEffect","useRef","useState","readStoredVisitorConsent","refusalStatusFor","storeVisitorConsent","VISITOR_CONSENT_OPEN_EVENT","CONSENT_OPT_OUT_TITLE","OPT_OUT_ICON_LEFT_FIELD_PATH","OPT_OUT_ICON_SHELL_PATH","OPT_OUT_ICON_CROSS_PATH","OPT_OUT_ICON_CHECK_PATH","OPT_OUT_ICON_BLUE","OPT_OUT_ICON_WHITE","CcpaOptOutIcon","svg","xmlns","viewBox","width","height","aria-hidden","focusable","style","flexShrink","display","data-aglyn-consent-optout-icon","path","d","fill","fillRule","clipRule","CONSENT_OVERLAY_Z_INDEX","CONSENT_PILL_Z_INDEX","CARD_WIDTH","PILL_CLEARANCE","FOOTER_SELECTOR","consentPillClearance","viewportHeight","pillTop","Number","isFinite","Math","max","ceil","useConsentPillClearance","pillRef","active","doc","pill","current","ownerDocument","view","defaultView","target","querySelector","body","previous","getPropertyValue","previousPriority","getPropertyPriority","restore","setProperty","removeProperty","apply","natural","parseFloat","getComputedStyle","paddingBottom","needed","innerHeight","getBoundingClientRect","top","addEventListener","observer","ResizeObserver","undefined","observe","removeEventListener","disconnect","DEFAULT_COPY","panelIntro","strictlyNecessary","bannerAnalyticsOnly","bannerWithAdvertising","analyticsLabel","analyticsDetail","advertisingLabel","advertisingDetail","overlayCardSx","position","left","bottom","transform","zIndex","p","borderRadius","textAlign","loadedPreferencesDialog","preferencesDialogLoad","preloadConsentPreferences","then","module","ConsentPreferencesDialog","catch","error","warmPreferences","ConsentBannerUi","props","hostId","stored","posture","country","advertising","copy","policyLinks","showPill","onDecision","words","preferencesOpen","setPreferencesOpen","analyticsChecked","setAnalyticsChecked","analytics","adsChecked","setAdsChecked","open","onClick","event","anchor","closest","getAttribute","endsWith","preventDefault","window","document","decide","status","ads","granted","refusalStatus","setPreferencesArrived","PreferencesDialog","askBanner","title","onAnalyticsChange","onAdsChange","onClose","onDeclineAll","onSave","elevation","role","aria-label","data-aglyn-consent-banner","sx","direction","xs","sm","spacing","alignItems","flex","minWidth","variant","mt","flexWrap","size","onPointerEnter","onFocus","ref","type","disableRipple","data-aglyn-consent-pill","gap","maxWidth","textTransform","color","borderColor","backgroundColor"],"mappings":";;AAAA;;;;;;;;;;;;;;;CAeC,GAED,4EAA4E;AAC5E,mEAAmE;AACnE,uEAAuE;AACvE,wEAAwE;AACxE,oEAAoE;AACpE,0EAA0E;AAC1E,mEAAmE;AACnE,+DAA+D;AAE/D,SAASA,GAAG,EAAEC,MAAM,EAAEC,KAAK,EAAEC,KAAK,EAAEC,UAAU,QAAQ,gBAAe;AACrE,SAGEC,SAAS,EACTC,MAAM,EACNC,QAAQ,QACH,QAAO;AAEd,SACEC,wBAAwB,EACxBC,gBAAgB,EAEhBC,mBAAmB,EACnBC,0BAA0B,QAGrB,uBAAmB;AAE1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2CC,GAED;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,MAAMC,wBAAwB,uBAAsB;AAE3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4CC,GACD,2EAA2E,GAC3E,MAAMC,+BACJ;AACF,4EAA4E,GAC5E,MAAMC,0BACJ,4GACA;AACF,0DAA0D,GAC1D,MAAMC,0BACJ,kGACA,oHACA;AACF,0DAA0D,GAC1D,MAAMC,0BACJ,qGACA;AAEF,wEAAwE,GACxE,MAAMC,oBAAoB;AAC1B,MAAMC,qBAAqB;AAE3B;;;;;;;;;;;;;;;;;;CAkBC,GACD;;;;;;CAMC,GACD,OAAO,SAASC;IACd,qBACE,MAACC;QACCC,OAAM;QACNC,SAAQ;QACRC,OAAO;QACPC,QAAQ;QACRC,eAAY;QACZC,WAAU;QACVC,OAAO;YAAEC,YAAY;YAAGC,SAAS;QAAQ;QACzCC,kCAA+B;;0BAE/B,KAACC;gBACCC,GAAGnB;gBACHoB,MAAMf;gBACNgB,UAAS;gBACTC,UAAS;;0BAEX,KAACJ;gBACCC,GAAGlB;gBACHmB,MAAMhB;gBACNiB,UAAS;gBACTC,UAAS;;0BAEX,KAACJ;gBAAKC,GAAGjB;gBAAyBkB,MAAMf;;0BACxC,KAACa;gBAAKC,GAAGhB;gBAAyBiB,MAAMhB;;;;AAG9C;AACA;;;;;;;;;CASC,GACD,OAAO,MAAMmB,0BAA0B,WAAU;AAEjD,2EAA2E,GAC3E,OAAO,MAAMC,uBAAuB,WAAU;AAE9C,qEAAqE,GACrE,MAAMC,aAAa;AAEnB,6EAA6E,GAC7E,MAAMC,iBAAiB;AAEvB;;;;;CAKC,GACD,MAAMC,kBAAkB;AAExB;;;;;;;;;;;;CAYC,GACD,OAAO,SAASC,qBACdC,cAAsB,EACtBC,OAAe;IAEf,IAAI,CAACC,OAAOC,QAAQ,CAACH,mBAAmB,CAACE,OAAOC,QAAQ,CAACF,UAAU,OAAO;IAC1E,OAAOG,KAAKC,GAAG,CAAC,GAAGD,KAAKE,IAAI,CAACN,iBAAiBC,WAAWJ;AAC3D;AAEA;;;;;;;;;;;;;;;;;;;;;;;;CAwBC,GACD,SAASU,wBACPC,OAAwC,EACxCC,MAAe;IAEf9C,UAAU;YAWN+C;QAVF,MAAMC,OAAOH,QAAQI,OAAO;QAC5B,IAAI,CAACH,UAAU,CAACE,MAAM;QACtB,MAAMD,MAAMC,KAAKE,aAAa;QAC9B,MAAMC,OAAOJ,uBAAAA,IAAKK,WAAW;QAC7B,oEAAoE;QACpE,kEAAkE;QAClE,sEAAsE;QACtE,iCAAiC;QACjC,IAAI,CAACL,OAAO,CAACI,MAAM;QACnB,MAAME,UACJN,qBAAAA,IAAIO,aAAa,CAAcnB,4BAA/BY,qBAAmDA,IAAIQ,IAAI;QAC7D,IAAI,CAACF,QAAQ;QAEb,MAAMG,WAAWH,OAAO/B,KAAK,CAACmC,gBAAgB,CAAC;QAC/C,MAAMC,mBAAmBL,OAAO/B,KAAK,CAACqC,mBAAmB,CAAC;QAC1D,MAAMC,UAAU;YACd,IAAIJ,UAAU;gBACZH,OAAO/B,KAAK,CAACuC,WAAW,CAAC,kBAAkBL,UAAUE;YACvD,OAAO;gBACLL,OAAO/B,KAAK,CAACwC,cAAc,CAAC;YAC9B;QACF;QAEA,MAAMC,QAAQ;YACZ,mEAAmE;YACnE,sEAAsE;YACtE,qEAAqE;YACrE,yBAAyB;YACzBH;YACA,MAAMI,UACJzB,OAAO0B,UAAU,CAACd,KAAKe,gBAAgB,CAACb,QAAQc,aAAa,KAAK;YACpE,MAAMC,SAAShC,qBACbe,KAAKkB,WAAW,EAChBrB,KAAKsB,qBAAqB,GAAGC,GAAG;YAElC,IAAIH,SAASJ,SAAS;gBACpBX,OAAO/B,KAAK,CAACuC,WAAW,CAAC,kBAAkB,GAAGO,OAAO,EAAE,CAAC;YAC1D;QACF;QAEAL;QACAZ,KAAKqB,gBAAgB,CAAC,UAAUT;QAChC,oEAAoE;QACpE,wCAAwC;QACxC,MAAMU,WACJ,OAAOtB,KAAKuB,cAAc,KAAK,aAC3B,IAAIvB,KAAKuB,cAAc,CAACX,SACxBY;QACNF,4BAAAA,SAAUG,OAAO,CAAC5B;QAClB,OAAO;YACLG,KAAK0B,mBAAmB,CAAC,UAAUd;YACnCU,4BAAAA,SAAUK,UAAU;YACpBlB;QACF;IACF,GAAG;QAACf;QAASC;KAAO;AACtB;AA6BA,MAAMiC,eAAsC;IAC1CC,YAAY;IACZC,mBACE,qEACA,0EACA;IACFC,qBACE,4EACA,2EACA;IACFC,uBACE,4EACA,4EACA,0EACA;IACFC,gBAAgB;IAChBC,iBAAiB;IACjBC,kBAAkB;IAClBC,mBAAmB;AACrB;AA2DA,4EAA4E,GAC5E,MAAMC,gBAAgB;IACpBC,UAAU;IACVC,MAAM;IACNC,QAAQ;IACRC,WAAW;IACXC,QAAQ9D;IACRb,OAAOe;IACP6D,GAAG;IACHC,cAAc;IACdC,WAAW;AACb;AAEA;;;;;;;;;;;CAWC,GACD,IAAIC;AACJ,IAAIC;AAEJ;;;;;;CAMC,GACD,OAAO,SAASC;IACdD,gCAAAA,wBAAAA,wBAA0B,MAAM,CAAC,mCAC9BE,IAAI,CAAC,CAACC;QACLJ,0BAA0BI,OAAOC,wBAAwB;IAC3D,GACCC,KAAK,CAAC,CAACC;QACNN,wBAAwBvB;QACxB,MAAM6B;IACR;IACF,OAAON;AACT;AAEA,8EAA8E,GAC9E,SAASO;IACPN,4BAA4BI,KAAK,CAAC,IAAY5B;AAChD;AAEA,OAAO,SAAS+B,gBAAgBC,KAA2B;IACzD,MAAM,EACJC,MAAM,EACNC,MAAM,EACNC,OAAO,EACPC,OAAO,EACPC,WAAW,EACXC,IAAI,EACJC,WAAW,EACXC,WAAW,IAAI,EACfC,UAAU,EACX,GAAGT;IACJ,MAAMU,QAAQ,aAAKtC,cAAiBkC;IACpC,MAAM,CAACK,iBAAiBC,mBAAmB,GAAGrH,SAAS;IACvD,MAAM,CAACsH,kBAAkBC,oBAAoB,GAAGvH,SAC9C2G,CAAAA,0BAAAA,OAAQa,SAAS,MAAK;IAExB,uEAAuE;IACvE,kEAAkE;IAClE,mEAAmE;IACnE,MAAM,CAACC,YAAYC,cAAc,GAAG1H,SAAS2G,CAAAA,0BAAAA,OAAQG,WAAW,MAAK;IAErE,uEAAuE;IACvE,yEAAyE;IACzE,wCAAwC;IACxChH,UAAU;QACR,MAAM6H,OAAO;YACX,MAAM5E,UAAU9C,yBAAyByG;YACzCa,oBAAoBxE,CAAAA,2BAAAA,QAASyE,SAAS,MAAK;YAC3CE,cAAc3E,CAAAA,2BAAAA,QAAS+D,WAAW,MAAK;YACvCO,mBAAmB;QACrB;QACA,MAAMO,UAAU,CAACC;gBAKZC;gBAHY3E;YADf,MAAMA,SAAS0E,MAAM1E,MAAM;YAC3B,MAAM2E,SAAS3E,2BAAAA,kBAAAA,OAAQ4E,OAAO,qBAAf5E,qBAAAA,QAAkB;YACjC,IACE2E,UACA,EAACA,uBAAAA,OAAOE,YAAY,CAAC,mBAApBF,uBAA+B,IAAIG,QAAQ,CAAC,mBAC7C;gBACAJ,MAAMK,cAAc;gBACpBP;YACF;QACF;QACAQ,OAAO7D,gBAAgB,CAAClE,4BAA4BuH;QACpDS,SAAS9D,gBAAgB,CAAC,SAASsD,SAAS;QAC5C,OAAO;YACLO,OAAOxD,mBAAmB,CAACvE,4BAA4BuH;YACvDS,SAASzD,mBAAmB,CAAC,SAASiD,SAAS;QACjD;IACF,GAAG;QAAClB;KAAO;IAEX,yEAAyE;IACzE,wEAAwE;IACxE,UAAU;IACV,MAAM2B,SAAS,CAACC,QAA8BC,MAAM,KAAK;QACvD,MAAMC,UAAU1B,gBAAgB,QAAQyB;QACxC,IAAIrB,YAAY;YACdA,WAAWoB,QAAQE;QACrB,OAAO;YACLrI,oBAAoBuG,QAAQ;gBAAE4B;gBAAQzB;gBAASC,aAAa0B;YAAQ;QACtE;QACAnB,mBAAmB;IACrB;IAEA,kEAAkE;IAClE,MAAMoB,gBAAgBvI,iBAAiByG,QAAQC;IAE/C,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,cAAc;IACd,MAAM,GAAG8B,sBAAsB,GAAG1I,SAAS;IAC3CF,UAAU;QACR,IAAI,CAACsH,mBAAmBrB,yBAAyB,OAAOtB;QACxD,IAAI7B,SAAS;QACbqD,4BAA4BC,IAAI,CAC9B;YACE,IAAItD,QAAQ8F,sBAAsB;QACpC,GACA;YACE,IAAI9F,QAAQyE,mBAAmB;QACjC;QAEF,OAAO;YACLzE,SAAS;QACX;IACF,GAAG;QAACwE;KAAgB;IACpB,MAAMuB,oBAAoBvB,kBAAkBrB,0BAA0BtB;IAEtE,MAAMmE,YAAY,CAACjC,UAAUC,YAAY,YAAY,CAAC+B;IAEtD,2EAA2E;IAC3E,0EAA0E;IAC1E,mEAAmE;IACnE,MAAMhG,UAAU5C,OAAiC;IACjD2C,wBAAwBC,SAASsE,YAAY,CAAC0B,qBAAqB,CAACC;IAEpE,IAAID,mBAAmB;QACrB,qBACE,KAACA;YACCE,OAAOxI;YACPsF,QAAQ9D;YACRsF,OAAOA;YACPL,aAAaA;YACbE,aAAaA;YACbM,kBAAkBA;YAClBwB,mBAAmBvB;YACnBE,YAAYA;YACZsB,aAAarB;YACbsB,SAAS,IAAM3B,mBAAmB;YAClC4B,cAAc,IAAMZ,OAAOI;YAC3BS,QAAQ,IACNb,OACEf,mBAAmB,aAAamB,eAChC,gEAAgE;gBAChE,yDAAyD;gBACzD,kDAAkD;gBAClDnB,oBAAoBG;;IAK9B;IAEA,IAAImB,WAAW;QACb,qBACE,KAACjJ;YACCwJ,WAAW;YACXC,MAAK;YACLC,cAAW;YACXC,6BAA0B;YAC1BC,IAAIjE;sBAEJ,cAAA,MAAC1F;gBACC4J,WAAW;oBAAEC,IAAI;oBAAUC,IAAI;gBAAM;gBACrCC,SAAS;gBACTJ,IAAI;oBAAEK,YAAY;wBAAEH,IAAI;wBAAWC,IAAI;oBAAS;gBAAE;;kCAElD,MAACjK;wBAAI8J,IAAI;4BAAEM,MAAM;4BAAGC,UAAU;wBAAE;;0CAC9B,KAACjK;gCAAWkK,SAAQ;0CACjBjD,cACGK,MAAMlC,qBAAqB,GAC3BkC,MAAMnC,mBAAmB;;4BAE9BgC,4BAAc,KAACvH;gCAAI8J,IAAI;oCAAES,IAAI;gCAAI;0CAAIhD;iCAAqB;;;kCAE7D,MAACpH;wBACC4J,WAAU;wBACVG,SAAS;wBACTJ,IAAI;4BAAElI,YAAY;4BAAG4I,UAAU;wBAAO;;0CAEtC,KAACvK;gCACCwK,MAAK;gCACLC,gBAAgB5D;gCAChB6D,SAAS7D;gCACTqB,SAAS;oCACPL,oBAAoBZ,UAAU,QAAQA,OAAOa,SAAS;oCACtDE,cAAcf,UAAU,QAAQA,OAAOG,WAAW,KAAK;oCACvDO,mBAAmB;gCACrB;0CAEC;;0CAEH,KAAC3H;gCACCwK,MAAK;gCACLH,SAAQ;gCACRnC,SAAS,IAAMS,OAAO;0CAErB;;0CAEH,KAAC3I;gCACCwK,MAAK;gCACLH,SAAQ;gCACRnC,SAAS,IAAMS,OAAO,YAAYvB,gBAAgB;0CAEjDA,cAAc,cAAc;;;;;;;IAMzC;IAEA,IAAI,CAACG,UAAU,OAAO;IAEtB,mEAAmE;IACnE,kEAAkE;IAClE,qBACE,MAACvH;QACC2K,KAAK1H;QACL2H,MAAK;QACL,sEAAsE;QACtE,sEAAsE;QACtE,sEAAsE;QACtE,sBAAsB;QACtBC,aAAa;QACbC,2BAAwB;QACxBnB,cAAYhJ;QACZ0J,SAAQ;QACRG,MAAK;QACLC,gBAAgB5D;QAChB6D,SAAS7D;QACTqB,SAAS;YACP,MAAM7E,UAAUmE,aAAaP,SAAS1G,yBAAyByG;YAC/Da,oBAAoBxE,CAAAA,2BAAAA,QAASyE,SAAS,MAAK;YAC3CE,cAAc3E,CAAAA,2BAAAA,QAAS+D,WAAW,MAAK;YACvCO,mBAAmB;QACrB;QACAkC,IAAI;YACFhE,UAAU;YACVC,MAAM;YACNC,QAAQ;YACRE,QAAQ7D;YACR2I,KAAK;YACLR,UAAU;YACVS,UAAU;YACV7E,cAAc;YACd8E,eAAe;YACfC,OAAO;YACPC,aAAa;YACbC,iBAAiB;QACnB;;0BAUA,KAAClK;YACAP;;;AAGP;AAEA,eAAemG,gBAAe"}

package/src/lib/app-utils/consent-groups.d.ts

@@ -0,0 +1,189 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * CONSENT GROUPS — the declared unit a marketing basis is given to.
+ *
+ * ## The two organizations this exists to serve at once
+ *
+ * An AGENCY runs twelve unrelated client brands out of one account. A person
+ * who ticked a box on one client's form has agreed to hear from that client
+ * and from nobody else, and mailing them on behalf of the other eleven is a
+ * consent violation whatever the account structure says.
+ *
+ * A SINGLE BUSINESS runs three sites — a shop, a booking page, a blog — under
+ * one name. It collects addresses on all three and mails them from any of
+ * them, because there is one controller and one brand and the visitor knows
+ * it. Refusing that is not caution, it is a product that cannot serve a
+ * perfectly ordinary customer.
+ *
+ * The org boundary cannot tell them apart, and neither can anything else the
+ * database already holds. So the difference is DECLARED: a group names the
+ * sites that are one sender. Undeclared, every site is its own group of one,
+ * which is the agency's answer and costs the agency nothing to get right.
+ *
+ * ## ⛔ NOTHING HERE IS INFERRED
+ *
+ * Not from shared ownership, not from a shared org, not from a shared sending
+ * domain, not from a shared theme. Sharing an account is a billing fact.
+ * There is exactly one input — {@link CONSENT_GROUPS_FIELD} on the org — and
+ * a site that is not named in it is alone.
+ *
+ * ## A group must be DISCLOSABLE, so it must have a NAME
+ *
+ * Pooling is only legitimate if the person was told about it: the checkbox
+ * has to say who they will hear from. A group with no display name cannot be
+ * rendered on a capture surface, so it cannot be disclosed, so it does not
+ * pool — {@link consentGroupForHost} returns the group of one for every site
+ * in a nameless group rather than pooling silently. That refusal is the whole
+ * mechanism by which "declared" is stronger than "configured".
+ *
+ * ## Pooling applies FORWARD only
+ *
+ * A grant records the group AS DISCLOSED at the moment it was given, in the
+ * entry itself, and every covered site gets its own entry. Adding a site to a
+ * group therefore reaches captures made after the change and none made
+ * before. An org-level switch that widened existing grants would be the leak
+ * wearing a different hat: the people already on the list were told a
+ * different thing.
+ *
+ * OPT-OUT runs the other way — read against the CURRENT group, so a site
+ * joining a group inherits every refusal already standing against it. The
+ * asymmetry is the same one the rest of this area keeps: a permissive fact is
+ * written narrowly and read exactly, a restrictive fact is read as broadly as
+ * it could possibly apply.
+ *
+ * ## VISIBILITY IS A SEPARATE AXIS
+ *
+ * Seeing a contact is not permission to mail them. A group decides consent
+ * and opt-out; `visibleTo` decides who can read the row, and an org may
+ * widen that for reporting while consent stays where it was given. The two
+ * are resolved by different functions on purpose, and neither reads the
+ * other.
+ */
+import { type ScopeToken } from './scope-tokens';
+/**
+ * The org field holding the declarations:
+ * `{ [groupId]: { name, hostIds } }`.
+ *
+ * On the org rather than on each host, because a group is a statement ABOUT
+ * a set and a set stored as N per-host pointers can disagree with itself —
+ * site A naming a group that site B has left is a half-declared controller,
+ * and there is no reading of that which is safe to pool on.
+ */
+export declare const CONSENT_GROUPS_FIELD = "consentGroups";
+/**
+ * The most sites one group may name.
+ *
+ * The same ceiling `visibleTo` carries, and for a related reason: the send
+ * path reads a group's opt-out lists in one `getAll`, so the group multiplies
+ * that round trip's size. It is also a sanity bound on a disclosure — a
+ * checkbox that has to name forty brands has not disclosed anything.
+ */
+export declare const MAX_CONSENT_GROUP_HOSTS = 30;
+/** One declared group, as stored. */
+export interface StoredConsentGroup {
+    /** Shown on the capture surface. Without it the group cannot pool. */
+    name: string;
+    /** The sites that are one sender. */
+    hostIds: string[];
+}
+/**
+ * The group a host belongs to, resolved FOR that host.
+ *
+ * It carries the asking site as well as the set, which is what lets one value
+ * be passed where both are needed. Every consent read needs both — the grant
+ * is looked up under the asking site, while a refusal is honored across the
+ * whole group — and two arguments that must agree is two arguments that can
+ * disagree.
+ */
+export interface ConsentGroup {
+    /** The site this was resolved for. Always a member of {@link hostIds}. */
+    hostId: string;
+    /**
+     * The group's id, or the host's own id for an undeclared site.
+     *
+     * Recorded on every grant so a stored basis says which controller it was
+     * given to even after the declaration changes.
+     */
+    groupId: string;
+    /**
+     * What the capture surface must display. `null` for a group of one, where
+     * the site's own name is what a form already shows and inventing a second
+     * one would put a name in front of a person that nothing else uses.
+     */
+    name: string | null;
+    /** Every site covered, sorted, always including the host asked about. */
+    hostIds: string[];
+    /** False for the implicit group of one. */
+    declared: boolean;
+}
+/**
+ * The group of one — a site that has declared no pooling.
+ *
+ * Exported because it is a value callers state deliberately: a writer that
+ * means "this site only" says so, rather than passing a host id and letting
+ * a helper decide what it covers.
+ */
+export declare function soloConsentGroup(hostId: string): ConsentGroup;
+/**
+ * Reads the declared groups off an org document, dropping every entry that
+ * cannot be honored.
+ *
+ * A malformed declaration reads as ABSENT, never as a wider group: the whole
+ * value of this field is that pooling is deliberate, and a corrupt value must
+ * not be a way to reach an audience nobody declared.
+ *
+ * The four refusals, each of which would otherwise pool without a disclosure:
+ *
+ *  - **no usable name** — cannot be shown on a form, so cannot be disclosed;
+ *  - **fewer than two sites** — not a pooling declaration, and a group of one
+ *    is what an undeclared site already gets;
+ *  - **over {@link MAX_CONSENT_GROUP_HOSTS}** — see that constant;
+ *  - **a site claimed by two groups** — two controllers claiming one site is
+ *    a contradiction, not a wider group, so BOTH claims are dropped and the
+ *    site falls back to being alone.
+ */
+export declare function readConsentGroups(org: Record<string, unknown> | null | undefined): Record<string, StoredConsentGroup>;
+/**
+ * The group `hostId` belongs to — the declared one, or the group of one.
+ *
+ * The ONLY way any caller learns what a site's consent covers. A caller that
+ * built its own set from `org.hosts`, or from a sending domain, or from a
+ * theme, would be inferring a controller, which is the thing this module
+ * exists to make impossible.
+ */
+export declare function consentGroupForHost(org: Record<string, unknown> | null | undefined, hostId: string): ConsentGroup;
+/**
+ * The `visibleTo` a resource captured by this group starts with.
+ *
+ * A separate function from anything above, called by the capture doors and
+ * by nothing that decides mailability, because visibility and consent are
+ * different questions with different answers. A group of one produces
+ * `['host:{id}']` — the isolation an agency needs, arrived at without the
+ * agency configuring anything.
+ */
+export declare function consentGroupScope(group: ConsentGroup): ScopeToken[];
+/**
+ * The sentence a capture surface must show beside the checkbox, or `null`
+ * when the site's own name already says it.
+ *
+ * Returned as text rather than a boolean so that the disclosure and the
+ * grant come from ONE resolved group: a form that rendered its own wording
+ * from a separate lookup could show one set of brands and record another,
+ * and the recorded set is the one that decides who mails this person.
+ */
+export declare function consentGroupDisclosure(group: ConsentGroup): string | null;

package/src/lib/app-utils/consent-groups.js

@@ -0,0 +1,219 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * CONSENT GROUPS — the declared unit a marketing basis is given to.
+ *
+ * ## The two organizations this exists to serve at once
+ *
+ * An AGENCY runs twelve unrelated client brands out of one account. A person
+ * who ticked a box on one client's form has agreed to hear from that client
+ * and from nobody else, and mailing them on behalf of the other eleven is a
+ * consent violation whatever the account structure says.
+ *
+ * A SINGLE BUSINESS runs three sites — a shop, a booking page, a blog — under
+ * one name. It collects addresses on all three and mails them from any of
+ * them, because there is one controller and one brand and the visitor knows
+ * it. Refusing that is not caution, it is a product that cannot serve a
+ * perfectly ordinary customer.
+ *
+ * The org boundary cannot tell them apart, and neither can anything else the
+ * database already holds. So the difference is DECLARED: a group names the
+ * sites that are one sender. Undeclared, every site is its own group of one,
+ * which is the agency's answer and costs the agency nothing to get right.
+ *
+ * ## ⛔ NOTHING HERE IS INFERRED
+ *
+ * Not from shared ownership, not from a shared org, not from a shared sending
+ * domain, not from a shared theme. Sharing an account is a billing fact.
+ * There is exactly one input — {@link CONSENT_GROUPS_FIELD} on the org — and
+ * a site that is not named in it is alone.
+ *
+ * ## A group must be DISCLOSABLE, so it must have a NAME
+ *
+ * Pooling is only legitimate if the person was told about it: the checkbox
+ * has to say who they will hear from. A group with no display name cannot be
+ * rendered on a capture surface, so it cannot be disclosed, so it does not
+ * pool — {@link consentGroupForHost} returns the group of one for every site
+ * in a nameless group rather than pooling silently. That refusal is the whole
+ * mechanism by which "declared" is stronger than "configured".
+ *
+ * ## Pooling applies FORWARD only
+ *
+ * A grant records the group AS DISCLOSED at the moment it was given, in the
+ * entry itself, and every covered site gets its own entry. Adding a site to a
+ * group therefore reaches captures made after the change and none made
+ * before. An org-level switch that widened existing grants would be the leak
+ * wearing a different hat: the people already on the list were told a
+ * different thing.
+ *
+ * OPT-OUT runs the other way — read against the CURRENT group, so a site
+ * joining a group inherits every refusal already standing against it. The
+ * asymmetry is the same one the rest of this area keeps: a permissive fact is
+ * written narrowly and read exactly, a restrictive fact is read as broadly as
+ * it could possibly apply.
+ *
+ * ## VISIBILITY IS A SEPARATE AXIS
+ *
+ * Seeing a contact is not permission to mail them. A group decides consent
+ * and opt-out; `visibleTo` decides who can read the row, and an org may
+ * widen that for reporting while consent stays where it was given. The two
+ * are resolved by different functions on purpose, and neither reads the
+ * other.
+ */ import { hostScopeToken, MAX_SCOPE_HOSTS } from "./scope-tokens.js";
+/**
+ * The org field holding the declarations:
+ * `{ [groupId]: { name, hostIds } }`.
+ *
+ * On the org rather than on each host, because a group is a statement ABOUT
+ * a set and a set stored as N per-host pointers can disagree with itself —
+ * site A naming a group that site B has left is a half-declared controller,
+ * and there is no reading of that which is safe to pool on.
+ */ export const CONSENT_GROUPS_FIELD = 'consentGroups';
+/**
+ * The most sites one group may name.
+ *
+ * The same ceiling `visibleTo` carries, and for a related reason: the send
+ * path reads a group's opt-out lists in one `getAll`, so the group multiplies
+ * that round trip's size. It is also a sanity bound on a disclosure — a
+ * checkbox that has to name forty brands has not disclosed anything.
+ */ export const MAX_CONSENT_GROUP_HOSTS = MAX_SCOPE_HOSTS;
+/**
+ * The group of one — a site that has declared no pooling.
+ *
+ * Exported because it is a value callers state deliberately: a writer that
+ * means "this site only" says so, rather than passing a host id and letting
+ * a helper decide what it covers.
+ */ export function soloConsentGroup(hostId) {
+    if (!hostId) {
+        throw new Error('[consent-groups] a consent group must name a site');
+    }
+    return {
+        hostId,
+        groupId: hostId,
+        name: null,
+        hostIds: [
+            hostId
+        ],
+        declared: false
+    };
+}
+/**
+ * Reads the declared groups off an org document, dropping every entry that
+ * cannot be honored.
+ *
+ * A malformed declaration reads as ABSENT, never as a wider group: the whole
+ * value of this field is that pooling is deliberate, and a corrupt value must
+ * not be a way to reach an audience nobody declared.
+ *
+ * The four refusals, each of which would otherwise pool without a disclosure:
+ *
+ *  - **no usable name** — cannot be shown on a form, so cannot be disclosed;
+ *  - **fewer than two sites** — not a pooling declaration, and a group of one
+ *    is what an undeclared site already gets;
+ *  - **over {@link MAX_CONSENT_GROUP_HOSTS}** — see that constant;
+ *  - **a site claimed by two groups** — two controllers claiming one site is
+ *    a contradiction, not a wider group, so BOTH claims are dropped and the
+ *    site falls back to being alone.
+ */ export function readConsentGroups(org) {
+    const raw = (org != null ? org : {})[CONSENT_GROUPS_FIELD];
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return {};
+    const usable = {};
+    for (const [groupId, value] of Object.entries(raw)){
+        if (!groupId || !value || typeof value !== 'object') continue;
+        const group = value;
+        const name = typeof group['name'] === 'string' ? group['name'].trim() : '';
+        if (!name) continue;
+        const hostIds = Array.isArray(group['hostIds']) ? [
+            ...new Set(group['hostIds'].map((id)=>String(id != null ? id : '').trim()).filter(Boolean))
+        ].sort() : [];
+        if (hostIds.length < 2 || hostIds.length > MAX_CONSENT_GROUP_HOSTS) continue;
+        usable[groupId] = {
+            name,
+            hostIds
+        };
+    }
+    /*
+   * The overlap pass, second because it needs every survivor of the first.
+   * A site named by two groups is dropped from BOTH — the alternative is
+   * picking one, and a coin flip is not a declaration.
+   */ const claims = new Map();
+    for (const group of Object.values(usable)){
+        for (const hostId of group.hostIds){
+            var _claims_get;
+            claims.set(hostId, ((_claims_get = claims.get(hostId)) != null ? _claims_get : 0) + 1);
+        }
+    }
+    const contested = new Set([
+        ...claims.entries()
+    ].filter(([, count])=>count > 1).map(([id])=>id));
+    if (!contested.size) return usable;
+    const settled = {};
+    for (const [groupId, group] of Object.entries(usable)){
+        if (group.hostIds.some((hostId)=>contested.has(hostId))) continue;
+        settled[groupId] = group;
+    }
+    return settled;
+}
+/**
+ * The group `hostId` belongs to — the declared one, or the group of one.
+ *
+ * The ONLY way any caller learns what a site's consent covers. A caller that
+ * built its own set from `org.hosts`, or from a sending domain, or from a
+ * theme, would be inferring a controller, which is the thing this module
+ * exists to make impossible.
+ */ export function consentGroupForHost(org, hostId) {
+    if (!hostId) {
+        throw new Error('[consent-groups] a consent group must name a site');
+    }
+    for (const [groupId, group] of Object.entries(readConsentGroups(org))){
+        if (!group.hostIds.includes(hostId)) continue;
+        return {
+            hostId,
+            groupId,
+            name: group.name,
+            hostIds: [
+                ...group.hostIds
+            ],
+            declared: true
+        };
+    }
+    return soloConsentGroup(hostId);
+}
+/**
+ * The `visibleTo` a resource captured by this group starts with.
+ *
+ * A separate function from anything above, called by the capture doors and
+ * by nothing that decides mailability, because visibility and consent are
+ * different questions with different answers. A group of one produces
+ * `['host:{id}']` — the isolation an agency needs, arrived at without the
+ * agency configuring anything.
+ */ export function consentGroupScope(group) {
+    return group.hostIds.map(hostScopeToken);
+}
+/**
+ * The sentence a capture surface must show beside the checkbox, or `null`
+ * when the site's own name already says it.
+ *
+ * Returned as text rather than a boolean so that the disclosure and the
+ * grant come from ONE resolved group: a form that rendered its own wording
+ * from a separate lookup could show one set of brands and record another,
+ * and the recorded set is the one that decides who mails this person.
+ */ export function consentGroupDisclosure(group) {
+    if (!group.declared || !group.name) return null;
+    return `You'll receive marketing email from ${group.name}, which covers ${group.hostIds.length} sites.`;
+}
+
+//# sourceMappingURL=consent-groups.js.map

package/src/lib/app-utils/consent-groups.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/consent-groups.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * CONSENT GROUPS — the declared unit a marketing basis is given to.\n *\n * ## The two organizations this exists to serve at once\n *\n * An AGENCY runs twelve unrelated client brands out of one account. A person\n * who ticked a box on one client's form has agreed to hear from that client\n * and from nobody else, and mailing them on behalf of the other eleven is a\n * consent violation whatever the account structure says.\n *\n * A SINGLE BUSINESS runs three sites — a shop, a booking page, a blog — under\n * one name. It collects addresses on all three and mails them from any of\n * them, because there is one controller and one brand and the visitor knows\n * it. Refusing that is not caution, it is a product that cannot serve a\n * perfectly ordinary customer.\n *\n * The org boundary cannot tell them apart, and neither can anything else the\n * database already holds. So the difference is DECLARED: a group names the\n * sites that are one sender. Undeclared, every site is its own group of one,\n * which is the agency's answer and costs the agency nothing to get right.\n *\n * ## ⛔ NOTHING HERE IS INFERRED\n *\n * Not from shared ownership, not from a shared org, not from a shared sending\n * domain, not from a shared theme. Sharing an account is a billing fact.\n * There is exactly one input — {@link CONSENT_GROUPS_FIELD} on the org — and\n * a site that is not named in it is alone.\n *\n * ## A group must be DISCLOSABLE, so it must have a NAME\n *\n * Pooling is only legitimate if the person was told about it: the checkbox\n * has to say who they will hear from. A group with no display name cannot be\n * rendered on a capture surface, so it cannot be disclosed, so it does not\n * pool — {@link consentGroupForHost} returns the group of one for every site\n * in a nameless group rather than pooling silently. That refusal is the whole\n * mechanism by which \"declared\" is stronger than \"configured\".\n *\n * ## Pooling applies FORWARD only\n *\n * A grant records the group AS DISCLOSED at the moment it was given, in the\n * entry itself, and every covered site gets its own entry. Adding a site to a\n * group therefore reaches captures made after the change and none made\n * before. An org-level switch that widened existing grants would be the leak\n * wearing a different hat: the people already on the list were told a\n * different thing.\n *\n * OPT-OUT runs the other way — read against the CURRENT group, so a site\n * joining a group inherits every refusal already standing against it. The\n * asymmetry is the same one the rest of this area keeps: a permissive fact is\n * written narrowly and read exactly, a restrictive fact is read as broadly as\n * it could possibly apply.\n *\n * ## VISIBILITY IS A SEPARATE AXIS\n *\n * Seeing a contact is not permission to mail them. A group decides consent\n * and opt-out; `visibleTo` decides who can read the row, and an org may\n * widen that for reporting while consent stays where it was given. The two\n * are resolved by different functions on purpose, and neither reads the\n * other.\n */\n\nimport { hostScopeToken, MAX_SCOPE_HOSTS, type ScopeToken } from './scope-tokens'\n\n/**\n * The org field holding the declarations:\n * `{ [groupId]: { name, hostIds } }`.\n *\n * On the org rather than on each host, because a group is a statement ABOUT\n * a set and a set stored as N per-host pointers can disagree with itself —\n * site A naming a group that site B has left is a half-declared controller,\n * and there is no reading of that which is safe to pool on.\n */\nexport const CONSENT_GROUPS_FIELD = 'consentGroups'\n\n/**\n * The most sites one group may name.\n *\n * The same ceiling `visibleTo` carries, and for a related reason: the send\n * path reads a group's opt-out lists in one `getAll`, so the group multiplies\n * that round trip's size. It is also a sanity bound on a disclosure — a\n * checkbox that has to name forty brands has not disclosed anything.\n */\nexport const MAX_CONSENT_GROUP_HOSTS = MAX_SCOPE_HOSTS\n\n/** One declared group, as stored. */\nexport interface StoredConsentGroup {\n  /** Shown on the capture surface. Without it the group cannot pool. */\n  name: string\n  /** The sites that are one sender. */\n  hostIds: string[]\n}\n\n/**\n * The group a host belongs to, resolved FOR that host.\n *\n * It carries the asking site as well as the set, which is what lets one value\n * be passed where both are needed. Every consent read needs both — the grant\n * is looked up under the asking site, while a refusal is honored across the\n * whole group — and two arguments that must agree is two arguments that can\n * disagree.\n */\nexport interface ConsentGroup {\n  /** The site this was resolved for. Always a member of {@link hostIds}. */\n  hostId: string\n  /**\n   * The group's id, or the host's own id for an undeclared site.\n   *\n   * Recorded on every grant so a stored basis says which controller it was\n   * given to even after the declaration changes.\n   */\n  groupId: string\n  /**\n   * What the capture surface must display. `null` for a group of one, where\n   * the site's own name is what a form already shows and inventing a second\n   * one would put a name in front of a person that nothing else uses.\n   */\n  name: string | null\n  /** Every site covered, sorted, always including the host asked about. */\n  hostIds: string[]\n  /** False for the implicit group of one. */\n  declared: boolean\n}\n\n/**\n * The group of one — a site that has declared no pooling.\n *\n * Exported because it is a value callers state deliberately: a writer that\n * means \"this site only\" says so, rather than passing a host id and letting\n * a helper decide what it covers.\n */\nexport function soloConsentGroup(hostId: string): ConsentGroup {\n  if (!hostId) {\n    throw new Error('[consent-groups] a consent group must name a site')\n  }\n  return {\n    hostId,\n    groupId: hostId,\n    name: null,\n    hostIds: [hostId],\n    declared: false,\n  }\n}\n\n/**\n * Reads the declared groups off an org document, dropping every entry that\n * cannot be honored.\n *\n * A malformed declaration reads as ABSENT, never as a wider group: the whole\n * value of this field is that pooling is deliberate, and a corrupt value must\n * not be a way to reach an audience nobody declared.\n *\n * The four refusals, each of which would otherwise pool without a disclosure:\n *\n *  - **no usable name** — cannot be shown on a form, so cannot be disclosed;\n *  - **fewer than two sites** — not a pooling declaration, and a group of one\n *    is what an undeclared site already gets;\n *  - **over {@link MAX_CONSENT_GROUP_HOSTS}** — see that constant;\n *  - **a site claimed by two groups** — two controllers claiming one site is\n *    a contradiction, not a wider group, so BOTH claims are dropped and the\n *    site falls back to being alone.\n */\nexport function readConsentGroups(\n  org: Record<string, unknown> | null | undefined,\n): Record<string, StoredConsentGroup> {\n  const raw = (org ?? {})[CONSENT_GROUPS_FIELD]\n  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return {}\n  const usable: Record<string, StoredConsentGroup> = {}\n  for (const [groupId, value] of Object.entries(raw as Record<string, unknown>)) {\n    if (!groupId || !value || typeof value !== 'object') continue\n    const group = value as Record<string, unknown>\n    const name = typeof group['name'] === 'string' ? group['name'].trim() : ''\n    if (!name) continue\n    const hostIds = Array.isArray(group['hostIds'])\n      ? [\n          ...new Set(\n            (group['hostIds'] as unknown[])\n              .map((id) => String(id ?? '').trim())\n              .filter(Boolean),\n          ),\n        ].sort()\n      : []\n    if (hostIds.length < 2 || hostIds.length > MAX_CONSENT_GROUP_HOSTS) continue\n    usable[groupId] = { name, hostIds }\n  }\n  /*\n   * The overlap pass, second because it needs every survivor of the first.\n   * A site named by two groups is dropped from BOTH — the alternative is\n   * picking one, and a coin flip is not a declaration.\n   */\n  const claims = new Map<string, number>()\n  for (const group of Object.values(usable)) {\n    for (const hostId of group.hostIds) {\n      claims.set(hostId, (claims.get(hostId) ?? 0) + 1)\n    }\n  }\n  const contested = new Set(\n    [...claims.entries()].filter(([, count]) => count > 1).map(([id]) => id),\n  )\n  if (!contested.size) return usable\n  const settled: Record<string, StoredConsentGroup> = {}\n  for (const [groupId, group] of Object.entries(usable)) {\n    if (group.hostIds.some((hostId) => contested.has(hostId))) continue\n    settled[groupId] = group\n  }\n  return settled\n}\n\n/**\n * The group `hostId` belongs to — the declared one, or the group of one.\n *\n * The ONLY way any caller learns what a site's consent covers. A caller that\n * built its own set from `org.hosts`, or from a sending domain, or from a\n * theme, would be inferring a controller, which is the thing this module\n * exists to make impossible.\n */\nexport function consentGroupForHost(\n  org: Record<string, unknown> | null | undefined,\n  hostId: string,\n): ConsentGroup {\n  if (!hostId) {\n    throw new Error('[consent-groups] a consent group must name a site')\n  }\n  for (const [groupId, group] of Object.entries(readConsentGroups(org))) {\n    if (!group.hostIds.includes(hostId)) continue\n    return {\n      hostId,\n      groupId,\n      name: group.name,\n      hostIds: [...group.hostIds],\n      declared: true,\n    }\n  }\n  return soloConsentGroup(hostId)\n}\n\n/**\n * The `visibleTo` a resource captured by this group starts with.\n *\n * A separate function from anything above, called by the capture doors and\n * by nothing that decides mailability, because visibility and consent are\n * different questions with different answers. A group of one produces\n * `['host:{id}']` — the isolation an agency needs, arrived at without the\n * agency configuring anything.\n */\nexport function consentGroupScope(group: ConsentGroup): ScopeToken[] {\n  return group.hostIds.map(hostScopeToken)\n}\n\n/**\n * The sentence a capture surface must show beside the checkbox, or `null`\n * when the site's own name already says it.\n *\n * Returned as text rather than a boolean so that the disclosure and the\n * grant come from ONE resolved group: a form that rendered its own wording\n * from a separate lookup could show one set of brands and record another,\n * and the recorded set is the one that decides who mails this person.\n */\nexport function consentGroupDisclosure(group: ConsentGroup): string | null {\n  if (!group.declared || !group.name) return null\n  return `You'll receive marketing email from ${group.name}, which covers ${group.hostIds.length} sites.`\n}\n"],"names":["hostScopeToken","MAX_SCOPE_HOSTS","CONSENT_GROUPS_FIELD","MAX_CONSENT_GROUP_HOSTS","soloConsentGroup","hostId","Error","groupId","name","hostIds","declared","readConsentGroups","org","raw","Array","isArray","usable","value","Object","entries","group","trim","Set","map","id","String","filter","Boolean","sort","length","claims","Map","values","set","get","contested","count","size","settled","some","has","consentGroupForHost","includes","consentGroupScope","consentGroupDisclosure"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2DC,GAED,SAASA,cAAc,EAAEC,eAAe,QAAyB,oBAAgB;AAEjF;;;;;;;;CAQC,GACD,OAAO,MAAMC,uBAAuB,gBAAe;AAEnD;;;;;;;CAOC,GACD,OAAO,MAAMC,0BAA0BF,gBAAe;AAyCtD;;;;;;CAMC,GACD,OAAO,SAASG,iBAAiBC,MAAc;IAC7C,IAAI,CAACA,QAAQ;QACX,MAAM,IAAIC,MAAM;IAClB;IACA,OAAO;QACLD;QACAE,SAASF;QACTG,MAAM;QACNC,SAAS;YAACJ;SAAO;QACjBK,UAAU;IACZ;AACF;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,SAASC,kBACdC,GAA+C;IAE/C,MAAMC,MAAM,CAACD,cAAAA,MAAO,CAAC,EAAE,CAACV,qBAAqB;IAC7C,IAAI,CAACW,OAAO,OAAOA,QAAQ,YAAYC,MAAMC,OAAO,CAACF,MAAM,OAAO,CAAC;IACnE,MAAMG,SAA6C,CAAC;IACpD,KAAK,MAAM,CAACT,SAASU,MAAM,IAAIC,OAAOC,OAAO,CAACN,KAAiC;QAC7E,IAAI,CAACN,WAAW,CAACU,SAAS,OAAOA,UAAU,UAAU;QACrD,MAAMG,QAAQH;QACd,MAAMT,OAAO,OAAOY,KAAK,CAAC,OAAO,KAAK,WAAWA,KAAK,CAAC,OAAO,CAACC,IAAI,KAAK;QACxE,IAAI,CAACb,MAAM;QACX,MAAMC,UAAUK,MAAMC,OAAO,CAACK,KAAK,CAAC,UAAU,IAC1C;eACK,IAAIE,IACL,AAACF,KAAK,CAAC,UAAU,CACdG,GAAG,CAAC,CAACC,KAAOC,OAAOD,aAAAA,KAAM,IAAIH,IAAI,IACjCK,MAAM,CAACC;SAEb,CAACC,IAAI,KACN,EAAE;QACN,IAAInB,QAAQoB,MAAM,GAAG,KAAKpB,QAAQoB,MAAM,GAAG1B,yBAAyB;QACpEa,MAAM,CAACT,QAAQ,GAAG;YAAEC;YAAMC;QAAQ;IACpC;IACA;;;;GAIC,GACD,MAAMqB,SAAS,IAAIC;IACnB,KAAK,MAAMX,SAASF,OAAOc,MAAM,CAAChB,QAAS;QACzC,KAAK,MAAMX,UAAUe,MAAMX,OAAO,CAAE;gBACdqB;YAApBA,OAAOG,GAAG,CAAC5B,QAAQ,EAACyB,cAAAA,OAAOI,GAAG,CAAC7B,mBAAXyB,cAAsB,KAAK;QACjD;IACF;IACA,MAAMK,YAAY,IAAIb,IACpB;WAAIQ,OAAOX,OAAO;KAAG,CAACO,MAAM,CAAC,CAAC,GAAGU,MAAM,GAAKA,QAAQ,GAAGb,GAAG,CAAC,CAAC,CAACC,GAAG,GAAKA;IAEvE,IAAI,CAACW,UAAUE,IAAI,EAAE,OAAOrB;IAC5B,MAAMsB,UAA8C,CAAC;IACrD,KAAK,MAAM,CAAC/B,SAASa,MAAM,IAAIF,OAAOC,OAAO,CAACH,QAAS;QACrD,IAAII,MAAMX,OAAO,CAAC8B,IAAI,CAAC,CAAClC,SAAW8B,UAAUK,GAAG,CAACnC,UAAU;QAC3DiC,OAAO,CAAC/B,QAAQ,GAAGa;IACrB;IACA,OAAOkB;AACT;AAEA;;;;;;;CAOC,GACD,OAAO,SAASG,oBACd7B,GAA+C,EAC/CP,MAAc;IAEd,IAAI,CAACA,QAAQ;QACX,MAAM,IAAIC,MAAM;IAClB;IACA,KAAK,MAAM,CAACC,SAASa,MAAM,IAAIF,OAAOC,OAAO,CAACR,kBAAkBC,MAAO;QACrE,IAAI,CAACQ,MAAMX,OAAO,CAACiC,QAAQ,CAACrC,SAAS;QACrC,OAAO;YACLA;YACAE;YACAC,MAAMY,MAAMZ,IAAI;YAChBC,SAAS;mBAAIW,MAAMX,OAAO;aAAC;YAC3BC,UAAU;QACZ;IACF;IACA,OAAON,iBAAiBC;AAC1B;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASsC,kBAAkBvB,KAAmB;IACnD,OAAOA,MAAMX,OAAO,CAACc,GAAG,CAACvB;AAC3B;AAEA;;;;;;;;CAQC,GACD,OAAO,SAAS4C,uBAAuBxB,KAAmB;IACxD,IAAI,CAACA,MAAMV,QAAQ,IAAI,CAACU,MAAMZ,IAAI,EAAE,OAAO;IAC3C,OAAO,CAAC,oCAAoC,EAAEY,MAAMZ,IAAI,CAAC,eAAe,EAAEY,MAAMX,OAAO,CAACoB,MAAM,CAAC,OAAO,CAAC;AACzG"}

package/src/lib/app-utils/consent-preferences-dialog.d.ts

@@ -0,0 +1,58 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { ReactElement, ReactNode } from 'react';
+/**
+ * The visitor consent preferences panel: one switch per category, and refuse
+ * and save as the same control at the same level.
+ *
+ * Its own module because it is the one consent surface a visit has to ASK
+ * for. The banner and the pill are drawn without a click; this panel opens
+ * only from Preferences, the pill or a `#aglyn-consent` link, and MUI's
+ * `Dialog`, `Modal`, focus trap, transitions and `Switch` are the larger half
+ * of what the consent surfaces weigh. `consent-banner-ui.tsx` loads this file
+ * when the panel is asked for (or looks about to be) and draws it from there;
+ * it holds the state, and this file only draws it.
+ */
+/** The words the panel shows — the `ConsentCopy` fields it reads, resolved. */
+export interface ConsentPreferencesWords {
+    panelIntro: string;
+    strictlyNecessary: string;
+    analyticsLabel: string;
+    analyticsDetail: string;
+    advertisingLabel: string;
+    advertisingDetail: string;
+}
+export interface ConsentPreferencesDialogProps {
+    /** The panel's title, fixed by regulation (`CONSENT_OPT_OUT_TITLE`). */
+    title: string;
+    /** Stacking order; it has to outrank any popup backdrop on the page. */
+    zIndex: number;
+    words: ConsentPreferencesWords;
+    /** Whether the surface asks about advertising storage at all. */
+    advertising?: boolean;
+    /** Links to the policies behind the choice, under the copy. */
+    policyLinks?: ReactNode;
+    analyticsChecked: boolean;
+    onAnalyticsChange: (checked: boolean) => void;
+    adsChecked: boolean;
+    onAdsChange: (checked: boolean) => void;
+    onClose: () => void;
+    onDeclineAll: () => void;
+    onSave: () => void;
+}
+export declare function ConsentPreferencesDialog(props: ConsentPreferencesDialogProps): ReactElement;
+export default ConsentPreferencesDialog;