export interface FirewallResult {
  action: 'send' | 'block' | 'modified';
  sanitized_event: NormalizedEvent;
  log_entry: FirewallLogEntry;
}

export function applyFirewall(
  event: NormalizedEvent,
  platform: PlatformId,
  policies: ConsentPolicy[],
  consent_state: ConsentState,
): FirewallResult {
  const rules = compilePolicies(policies);
  for (const rule of rules) {
    if (rule.matches(event, platform, consent_state)) {
      if (rule.action === 'block') {
        return blockResult(event, platform, rule);
      }
      if (rule.action === 'modify') {
        event = rule.apply(event);
      }
    }
  }
  return sendResult(event, platform);
}

// Sample evaluation
const r = applyFirewall(
  { event_name: 'Purchase', user_data: { em: 'a@b.co' }, geo: { country: 'DE' } },
  'meta',
  defaultPolicies,
  { ad_storage: 'denied', ad_user_data: 'denied' },
);
// → { action: 'block',
//     log_entry: { rule_matched: 'region=EU and consent.ad_storage=denied' } }

Safe defaults, zero config.

Auto-applied to every merchant on Starter and above. Three rules cover ~90% of GDPR/CCPA exposure for a typical DTC store. You don't see the editor; you see firewall_logs proving it's working.

• ▸Redact PII (em, ph, ln, fn, zp) when consent.ad_storage = denied
• ▸Hash all user_data fields with SHA-256 before any platform send
• ▸Block sensitive event_names matching ^health_, ^pregnancy_, ^fertility_

Write rules per-region, per-platform, per-event.

Full grammar: when ⟨condition⟩ then ⟨action⟩. Conditions on consent state, region, platform, event name (regex), and user_data fields. Actions: block, redact(...), hash(...).

• ▸Per-region overrides (EU / UK / US-CA / US / APAC)
• ▸Platform-scoped hashing (e.g. always hash phone for Meta only)
• ▸Regex event-name blocking for sensitive verticals
• ▸Live syntax check + dry-run against last 1k events

Returns up to 90 days per call (firewall_logs retention). API-key authed; rate-limited at 4 calls/min so a junior engineer can't accidentally DoS your own audit. Streams a gzipped CSV for batches over 100k rows. Same payload is reachable from the dashboard download button.

EU DTC store passing GDPR audit

Berlin-based skincare brand, €4M ARR. CNIL-style audit triggered by a customer complaint. Exported 90 days of firewall_logs as CSV in 30 seconds, handed to legal counsel. Showed every consent-denied event was blocked from Meta CAPI. Audit closed in 11 days with zero remediation.

Agency managing 12 stores, 6 jurisdictions

Stockholm performance agency with merchants in DE, FR, ES, UK, US, AU. One policy template, six per-region overrides. The agency rolled out the same DSL to all 12 stores in a morning — UK gets ICO-style strict consent, US gets CCPA do-not-sell, AU gets the lighter Privacy Act profile. One audit log per merchant, isolated.

SaaS pre-empting CCPA enforcement

LA-based subscription brand reading the new CPPA enforcement memo. Added one rule: when region=US-CA and consent.ad_personalization=denied then block. Took two minutes. Caught 8% of California events that the previous tag-manager setup was leaking. Three months of clean logs before the first regulatory advisory in the vertical.