# Vendor parameters and properties that are never "unplanned" (rule D09).
# A starter list checked 2026-11-02. Confirm the GA4 names against one
# DebugView capture from a test device, or against the distinct event_params
# keys (keys only, never values) of page_view rows in the BigQuery export, for
# the property you audit. Copy this file to the scratch folder, edit the copy
# and pass it with --vendor-params. Personal-data checks (D13) still run on
# every parameter here, so a URL carrying an email still fails.
#
# Format read by scripts/audit_plan.py:
#   "@tool" starts a section (all, ga4, mixpanel, amplitude, posthog, segment, rudderstack);
#   "@ga4-reserved" is not a vendor list: rule Q09 reads it
#   "prefix:<text>" matches every name that starts with <text>
#   any other line is one exact name

@ga4
prefix:ga_
prefix:firebase_
prefix:google_
prefix:gtag.
prefix:_
page_location
page_referrer
page_title
engagement_time_msec
session_engaged
engaged_session_event
batch_page_id
batch_ordering_id
entrances
ignore_referrer
# Seen on some properties; confirm before uncommenting:
# debug_mode
# source
# medium
# campaign
# term
# content
# gclid

@mixpanel
prefix:$
prefix:mp_
time
distinct_id
token
# The JavaScript SDK adds UTM parameters and advertising click IDs to events
prefix:utm_
dclid
fbclid
gclid
ko_click_id
li_fat_id
msclkid
sccid
ttclid
twclid
wbraid

@posthog
prefix:$
distinct_id
token
# posthog-js records UTM parameters as plain event properties
prefix:utm_
# Advertising click IDs; confirm in the PostHog docs for your SDK before uncommenting:
# gclid
# fbclid
# msclkid

@amplitude
prefix:[Amplitude]
prefix:$

@ga4-reserved
# Prefixes a plan must not give its own GA4 parameters. Google's "Event naming
# rules" help page says parameter names can't begin with them (checked
# 2026-11-06). Only prefixes belong here. The exact names on that page (currency,
# user_id, session_id, gclid and others) can't become custom definitions but stay
# valid event parameters, so a check on them would fail correct plans; look them
# up before proposing a registration (D15).
prefix:_
prefix:firebase_
prefix:ga_
prefix:google_
prefix:gtag.