fix(consent): tiktok hold defaultConsent + mixpanel stub opt-in/out

- TikTok defaultConsent accepts 'hold' so users can defer consent without the composable (addresses CodeRabbit #712).
- Mixpanel stub methods now include opt_in_tracking/opt_out_tracking so pre-load calls queue correctly.

Author: harlan-zw

packages/script/src/runtime/registry/mixpanel-analytics.ts

@@ -29,7 +29,7 @@ declare global {
   }
 }
 
-const methods = ['track', 'identify', 'reset', 'register'] as const
+const methods = ['track', 'identify', 'reset', 'register', 'opt_in_tracking', 'opt_out_tracking'] as const
 const peopleMethods = ['set'] as const
 
 export function useScriptMixpanelAnalytics<T extends MixpanelAnalyticsApi>(_options?: MixpanelAnalyticsInput) {
@@ -78,8 +78,9 @@ export function useScriptMixpanelAnalytics<T extends MixpanelAnalyticsApi>(_opti
               const optOutByDefault = options?.defaultConsent === 'opt-out'
               mp.init(options.token, optOutByDefault ? { opt_out_tracking_by_default: true } : undefined)
               if (options?.defaultConsent === 'opt-in') {
-                // opt_in_tracking isn't part of the stub; push so the real SDK runs it on load.
-                mp.push(['opt_in_tracking'])
+                // After init, opt_in_tracking is wired on the stub (see methods array)
+                // so the real SDK drains it on load.
+                mp.opt_in_tracking?.()
               }
             }
           },

packages/script/src/runtime/registry/schemas.ts

@@ -923,11 +923,13 @@ export const TikTokPixelOptions = object({
    */
   trackPageView: optional(boolean()),
   /**
-   * Default consent state. `'granted'` fires `ttq.grantConsent()`,
-   * `'denied'` fires `ttq.revokeConsent()`, both called before `ttq('init', id)`.
+   * Default consent state, applied before `ttq('init', id)`.
+   * - `'granted'` fires `ttq.grantConsent()`
+   * - `'denied'` fires `ttq.revokeConsent()`
+   * - `'hold'` fires `ttq.holdConsent()` to defer until an explicit update
    * @see https://business-api.tiktok.com/portal/docs?id=1739585600931842
    */
-  defaultConsent: optional(union([literal('granted'), literal('denied')])),
+  defaultConsent: optional(union([literal('granted'), literal('denied'), literal('hold')])),
 })
 
 export const UmamiAnalyticsOptions = object({

packages/script/src/runtime/registry/tiktok-pixel.ts

@@ -111,9 +111,8 @@ export function useScriptTikTokPixel<T extends TikTokPixelApi>(_options?: TikTok
             ttq.grantConsent()
           else if (options?.defaultConsent === 'denied')
             ttq.revokeConsent()
-          // When neither is set, tracking runs as before. Users wanting hold mode
-          // pass `scriptOptions: { consent }` -- the adapter's applyDefault fires
-          // `holdConsent()` when `ad_storage` is undecided.
+          else if (options?.defaultConsent === 'hold')
+            ttq.holdConsent()
           if (options?.id) {
             ttq('init', options.id)
             if (options?.trackPageView !== false) {