@c15t/astro 3.0.0-alpha.0 → 3.0.0-alpha.2

package/AGENTS.md

@@ -45,14 +45,17 @@ These docs describe v3. Start with Inth hosted setup, identify the framework, ro
 - [Ahrefs Analytics](./docs/integrations/ahrefs-analytics.md): Configure Ahrefs Analytics with c15t v3, understand measurement permission and verify loading and revocation.
 - [Amplitude](./docs/integrations/amplitude.md): Configure Amplitude with c15t v3, understand measurement permission and verify loading and revocation.
 - [Custom integrations](./docs/integrations/building-integrations.md): Define loading, initialization and consent-change behavior for a vendor without a helper.
+- [Clear on revocation](./docs/integrations/clear-on-revocation.md): Remove configured first-party cookies and Web Storage keys when their consent category is denied.
 - [Clearbit](./docs/integrations/clearbit.md): Configure Clearbit with c15t v3, understand marketing permission and verify loading and revocation.
 - [Cloudflare Web Analytics](./docs/integrations/cloudflare-web-analytics.md): Configure Cloudflare Web Analytics with c15t v3, understand measurement permission and verify loading and revocation.
+- [Cloudflare Zaraz](./docs/integrations/cloudflare-zaraz.md): Synchronize c15t permissions with Zaraz purposes while Cloudflare manages your tools.
 - [Crisp](./docs/integrations/crisp.md): Configure Crisp with c15t v3, understand functionality permission and verify loading and revocation.
 - [Databuddy](./docs/integrations/databuddy.md): Configure Databuddy's initial and updated consent state with c15t v3.
 - [Fathom Analytics](./docs/integrations/fathom-analytics.md): Configure Fathom Analytics with c15t v3, understand measurement permission and verify loading and revocation.
 - [Google Maps](./docs/integrations/google-maps.md): Prevent a map iframe from mounting before the required permission.
 - [Google Tag](./docs/integrations/google-tag.md): Configure gtag with c15t Consent Mode signals and understand its loading behavior.
 - [Google Tag Manager](./docs/integrations/google-tag-manager.md): Load GTM with c15t consent signals and verify the tags inside your container.
+- [Granular consent](./docs/integrations/granular-consent.md): Let visitors grant a category and still turn one vendor off, without adopting IAB TCF.
 - [Heap](./docs/integrations/heap.md): Configure Heap with c15t v3, understand measurement permission and verify loading and revocation.
 - [Hightouch](./docs/integrations/hightouch.md): Configure Hightouch with c15t v3, understand measurement permission and verify loading and revocation.
 - [Hotjar](./docs/integrations/hotjar.md): Configure Hotjar with c15t v3, understand measurement permission and verify loading and revocation.

package/dist/api/handlers.js

@@ -1,7 +1,7 @@
 import { serveGvlReference } from "@c15t/core";
 import { MANIFEST_PASSTHROUGH_HEADERS, fetchCachedGvl, fetchCachedManifest, getManifestAge } from "@c15t/core/server";
 import { extractConsentRequestInputs } from "@c15t/schema/types";
-import { loadConsentManifest, resolveManifestInit, resolveManifestSourceFrom } from "./manifest-init.js";
+import { loadConsentManifest, resolveManifestInit, resolveManifestSourceFrom, resolveSessionReportURL } from "./manifest-init.js";
 const INIT_CACHE_CONTROL = 'private, no-store';
 const MANIFEST_ROUTE_SUFFIX = '/manifest';
 const handlers_waitUntilFromLocals = function(revalidation, locals) {
@@ -42,7 +42,14 @@ const handlers_createConsentRouteHandlers = function(handlerOptions) {
             inputs: extractConsentRequestInputs(request.headers, {
                 language: handlerOptions.options.i18n?.locale
             }),
-            manifest
+            manifest,
+            report: {
+                backendURL: resolveSessionReportURL(handlerOptions.options),
+                headers: request.headers,
+                method: request.method,
+                source: 'route',
+                waitUntil: handlers_bindBackgroundRevalidate(handlerOptions, lifetime)
+            }
         });
         return Response.json(payload, {
             headers: {

package/dist/api/index.js

@@ -1,3 +1,3 @@
 export { createConsentRouteHandlers, resolveManifestSourceURL, waitUntilFromLocals } from "./handlers.js";
-export { loadConsentManifest, resolveManifestInit, resolveManifestSourceFrom } from "./manifest-init.js";
+export { loadConsentManifest, resolveManifestInit, resolveManifestSourceFrom, resolveSessionReportURL } from "./manifest-init.js";
 export { MANIFEST_DEDUPE_TTL_SECONDS, MANIFEST_PASSTHROUGH_HEADERS, clearManifestCache, createManifestRequestURL, fetchCachedManifest, getManifestSMaxAge, getManifestStaleWhileRevalidate } from "@c15t/core/server";

package/dist/api/manifest-init.js

@@ -1,5 +1,5 @@
 import { deferInitGvlToRoute } from "@c15t/core";
-import { fetchCachedManifest } from "@c15t/core/server";
+import { fetchCachedManifest, reportConsentSession, resolveSessionReportBackendURL } from "@c15t/core/server";
 import { consentInputsToOverrides, resolveBackendURL, resolveInitFromManifest } from "@c15t/schema/types";
 import { baseTranslations } from "@c15t/translations/all";
 const MANIFEST_ROUTE_SUFFIX = '/manifest';
@@ -67,6 +67,13 @@ const manifest_init_defaultFetchGvl = async function(input) {
     if (!response.ok) throw new Error(`@c15t/astro: GVL responded ${response.status} ${response.statusText}`);
     return await response.json();
 };
+const manifest_init_resolveSessionReportURL = function(options) {
+    const { mode } = options;
+    if ('manifest' !== mode.type || false === mode.reportSessions) return;
+    return resolveSessionReportBackendURL({
+        backendURL: mode.backendURL ?? manifest_init_getEnv('C15T_BACKEND_URL') ?? manifest_init_getEnv('PUBLIC_C15T_BACKEND_URL')
+    });
+};
 const manifest_init_resolveManifestInit = async function(input) {
     const { inputs, manifest } = input;
     const payload = resolveInitFromManifest(manifest, {
@@ -90,6 +97,18 @@ const manifest_init_resolveManifestInit = async function(input) {
             payload.gvl = null;
         }
     }
+    if (input.report?.backendURL) reportConsentSession({
+        adapter: '@c15t/astro',
+        backendURL: input.report.backendURL,
+        fetch: input.fetch,
+        headers: input.report.headers,
+        init: payload,
+        inputs,
+        manifest,
+        method: input.report.method,
+        source: input.report.source,
+        waitUntil: input.report.waitUntil
+    });
     payload.resolvedOverrides = consentInputsToOverrides({
         country: inputs.country,
         language: inputs.language,
@@ -100,4 +119,4 @@ const manifest_init_resolveManifestInit = async function(input) {
     };
     return !input.gvlRoute || input.fetch || input.fetchGvl ? payload : deferInitGvlToRoute(payload, input.gvlRoute);
 };
-export { manifest_init_defaultFetchGvl as defaultFetchGvl, manifest_init_loadConsentManifest as loadConsentManifest, manifest_init_resolveManifestInit as resolveManifestInit, manifest_init_resolveManifestSourceFrom as resolveManifestSourceFrom };
+export { manifest_init_defaultFetchGvl as defaultFetchGvl, manifest_init_loadConsentManifest as loadConsentManifest, manifest_init_resolveManifestInit as resolveManifestInit, manifest_init_resolveManifestSourceFrom as resolveManifestSourceFrom, manifest_init_resolveSessionReportURL as resolveSessionReportURL };

package/dist/client.js

@@ -96,6 +96,7 @@ const client_createClient = function(options, extension = {}) {
         ...extension.scripts ?? []
     ];
     const runtime = createConsentRuntime({
+        clearOnRevocation: extension.clearOnRevocation ?? options.clearOnRevocation,
         consentCategories: options.consentCategories,
         createIAB: lazyCreateIAB,
         i18n: options.i18n,

package/dist/server.js

@@ -5,7 +5,7 @@ import { fetchCachedGvl } from "@c15t/core/server";
 import { readProducerPolicyContract } from "@c15t/core/transports";
 import { CONSENT_REQUEST_HEADER_NAMES, consentInputsToOverrides, extractConsentRequestInputs, resolveBackendURL } from "@c15t/schema/types";
 import { baseTranslations } from "@c15t/translations/all";
-import { loadConsentManifest, resolveManifestInit } from "./api/manifest-init.js";
+import { loadConsentManifest, resolveManifestInit, resolveSessionReportURL } from "./api/manifest-init.js";
 import { filterCookieHeader } from "./libs/cookies.js";
 const server_resolveTranslations = function(options, inputs) {
     const detect = options.i18n?.detectLanguage !== false;
@@ -164,7 +164,13 @@ const server_prefetchManifest = async function(input, mode) {
                     url: reference.url
                 }),
             inputs: input.inputs,
-            manifest
+            manifest,
+            report: {
+                backendURL: resolveSessionReportURL(input.options),
+                headers: input.headers,
+                source: 'render',
+                waitUntil: input.onBackgroundRevalidate
+            }
         });
         return mergeInitOutputIntoKernelConfig(input.base, !input.fetch && manifest.iab?.gvl ? deferInitGvlToRoute(payload, input.options.endpoints.initPath) : payload, server_forwardHeaders(input.headers, input.base.initialOverrides ?? {}, {
             allowCookie: absoluteTarget ? server_mayForwardCookie(absoluteTarget, input.url) : false,

package/dist-types/api/handlers.d.ts

@@ -15,8 +15,8 @@
  *   `private, no-store`.
  */
 import type { ManifestFetch } from '@c15t/core/server';
-import type { C15tResolvedOptions } from '../types';
-import type { FetchGvl } from './manifest-init';
+import type { C15tResolvedOptions } from '../types.js';
+import type { FetchGvl } from './manifest-init.js';
 /**
  * The per-request context a route or the middleware can pass so a
  * background refresh is registered with the platform. Astro adapters that

package/dist-types/api/index.d.ts

@@ -5,9 +5,9 @@
  * Next.js, Nuxt and SvelteKit layers so no two hosts can disagree about
  * cache lifetimes or revalidation.
  */
-export { createConsentRouteHandlers, resolveManifestSourceURL, waitUntilFromLocals, } from './handlers';
-export type { ConsentRouteHandlerOptions, RequestLifetime } from './handlers';
-export { loadConsentManifest, resolveManifestInit, resolveManifestSourceFrom, } from './manifest-init';
-export type { FetchGvl, RequestSource, ResolvedInitOutput, } from './manifest-init';
+export { createConsentRouteHandlers, resolveManifestSourceURL, waitUntilFromLocals, } from './handlers.js';
+export type { ConsentRouteHandlerOptions, RequestLifetime } from './handlers.js';
+export { loadConsentManifest, resolveManifestInit, resolveManifestSourceFrom, resolveSessionReportURL, } from './manifest-init.js';
+export type { FetchGvl, RequestSource, ResolvedInitOutput, SessionReportTarget, } from './manifest-init.js';
 export { clearManifestCache, createManifestRequestURL, fetchCachedManifest, getManifestSMaxAge, getManifestStaleWhileRevalidate, MANIFEST_DEDUPE_TTL_SECONDS, MANIFEST_PASSTHROUGH_HEADERS, } from '@c15t/core/server';
 export type { CachedManifestResponse, FetchCachedManifestOptions, ManifestFetch, ManifestSourceConfig, } from '@c15t/core/server';

package/dist-types/api/manifest-init.d.ts

@@ -1,6 +1,6 @@
 import type { ManifestFetch } from '@c15t/core/server';
-import type { ConsentManifest, ConsentManifestGVLReference, ConsentRequestHeaderInputs, GlobalVendorList, InitOutput } from '@c15t/schema/types';
-import type { C15tResolvedOptions } from '../types';
+import type { ConsentManifest, ConsentManifestGVLReference, ConsentRequestHeaderInputs, ConsentSessionSource, GlobalVendorList, InitOutput } from '@c15t/schema/types';
+import type { C15tResolvedOptions } from '../types.js';
 /** Fetches the Global Vendor List when the resolved policy is IAB. */
 export type FetchGvl = (input: {
     reference: ConsentManifestGVLReference;
@@ -56,6 +56,30 @@ export declare const defaultFetchGvl: FetchGvl;
 export type ResolvedInitOutput = InitOutput & {
     resolvedOverrides?: Record<string, unknown>;
 };
+/** How a resolution reports itself to the backend's `POST /sessions`. */
+export interface SessionReportTarget {
+    /** Where the resolution happened. */
+    source: ConsentSessionSource;
+    /** The visitor's request headers; only IP chain and user agent travel. */
+    headers: Headers;
+    /** Absolute backend URL, or `undefined` to send no report. */
+    backendURL: string | undefined;
+    /** The request's method, when there is one; only a `GET` is reported. */
+    method?: string;
+    /** Keeps the detached report alive on runtimes that need it. */
+    waitUntil?: (task: Promise<void>) => void;
+}
+/**
+ * Where a resolution reports sessions, when it can: an absolute backend,
+ * read as configured rather than resolved against the request. A relative
+ * backend resolved to this site's origin is its own injected route, not a
+ * backend, and means no report; nothing is inferred from a manifest URL.
+ * `undefined` when reporting is off or nothing absolute is set.
+ *
+ * @param options - The resolved integration options.
+ * @returns The backend base URL, or `undefined`.
+ */
+export declare const resolveSessionReportURL: (options: C15tResolvedOptions) => string | undefined;
 /**
  * Resolve one request's `/init` payload from an already-loaded manifest.
  *
@@ -70,4 +94,6 @@ export declare const resolveManifestInit: (input: {
     /** Same-origin init route that serves versioned public lists. */
     gvlRoute?: string;
     fetchGvl?: FetchGvl;
+    /** Session report to send once resolved. Absent means none. */
+    report?: SessionReportTarget;
 }) => Promise<ResolvedInitOutput>;

package/dist-types/client.d.ts

@@ -20,8 +20,8 @@
  */
 import type { ConsentSnapshot, ConsentState, KernelUser, Unsubscribe } from '@c15t/core';
 import type { ConsentRuntime } from '@c15t/core/runtime';
-import type { C15tClientOptionsExtension, C15tResolvedOptions } from './types';
-import type { ConsentDialogKind } from './ui/adapter';
+import type { C15tClientOptionsExtension, C15tResolvedOptions } from './types.js';
+import type { ConsentDialogKind } from './ui/adapter.js';
 /** Attribute the server-rendered banner puts on its action buttons. */
 export declare const ACTION_ATTRIBUTE = "data-c15t-action";
 /** Attribute selecting which dialog a `customize` action opens. */
@@ -145,8 +145,8 @@ export declare const openDialog: (kind?: ConsentDialogKind, tab?: "purposes" | "
  * open the preference centre.
  */
 export declare const preloadDialog: () => Promise<void>;
-export { activateGatedScripts } from './browser/inline-scripts';
+export { activateGatedScripts } from './browser/inline-scripts.js';
 export type { ConsentRuntime } from '@c15t/core/runtime';
-export type { ConsentDialogKind } from './ui/adapter';
-export { registerDialogAdapter, registerDialogSurface } from './ui/adapter';
-export type { ConsentDialogAdapter, ConsentDialogContext, ConsentDialogHandle, ConsentDialogSurfaceLoader, } from './ui/adapter';
+export type { ConsentDialogKind } from './ui/adapter.js';
+export { registerDialogAdapter, registerDialogSurface } from './ui/adapter.js';
+export type { ConsentDialogAdapter, ConsentDialogContext, ConsentDialogHandle, ConsentDialogSurfaceLoader, } from './ui/adapter.js';

package/dist-types/index.d.ts

@@ -19,14 +19,14 @@
  * });
  * ```
  */
-export { c15t, c15t as default, resolveOptions } from './integration';
-export { createConsentMiddleware } from './middleware-handler';
-export type { ConsentMiddlewareOptions } from './middleware-handler';
-export { hostedMode as hosted, manifestMode as manifest, offlineMode as offline, resolveTransportFactory, custom, } from './mode';
-export type { ManifestClientEndpoints } from './mode';
-export type { C15tAstroOptions, C15tClientOptionsExtension, C15tColorScheme, C15tEndpointOptions, C15tHostedDescriptor, C15tI18nOptions, C15tIABOptions, C15tLocals, C15tManifestDescriptor, C15tMiddlewareOptions, C15tModeDescriptor, C15tOfflineDescriptor, C15tResolvedOptions, C15tUIAdapterName, } from './types';
-export type { ConsentDialogAdapter, ConsentDialogContext, ConsentDialogHandle, ConsentDialogKind, ConsentDialogSurfaceLoader, } from './ui/adapter';
-export { registerDialogAdapter, registerDialogSurface } from './ui/adapter';
+export { c15t, c15t as default, resolveOptions } from './integration.js';
+export { createConsentMiddleware } from './middleware-handler.js';
+export type { ConsentMiddlewareOptions } from './middleware-handler.js';
+export { hostedMode as hosted, manifestMode as manifest, offlineMode as offline, resolveTransportFactory, custom, } from './mode.js';
+export type { ManifestClientEndpoints } from './mode.js';
+export type { C15tAstroOptions, C15tClientOptionsExtension, C15tColorScheme, C15tEndpointOptions, C15tHostedDescriptor, C15tI18nOptions, C15tIABOptions, C15tLocals, C15tManifestDescriptor, C15tMiddlewareOptions, C15tModeDescriptor, C15tOfflineDescriptor, C15tResolvedOptions, C15tUIAdapterName, } from './types.js';
+export type { ConsentDialogAdapter, ConsentDialogContext, ConsentDialogHandle, ConsentDialogKind, ConsentDialogSurfaceLoader, } from './ui/adapter.js';
+export { registerDialogAdapter, registerDialogSurface } from './ui/adapter.js';
 export type { ConsentRuntime, ConsentRuntimeOptions } from '@c15t/core/runtime';
 export type { AllConsentNames, ConsentSnapshot, ConsentState, KernelConfig, LegalLinks, PolicyRule, Script, StorageConfig, } from '@c15t/core';
 export { policyRulePresets } from '@c15t/core';

package/dist-types/integration.d.ts

@@ -14,7 +14,7 @@
  *    options to all of the above.
  */
 import type { AstroIntegration } from 'astro';
-import type { C15tAstroOptions, C15tResolvedOptions } from './types';
+import type { C15tAstroOptions, C15tResolvedOptions } from './types.js';
 /**
  * Normalize user options into the serializable shape every consumer reads.
  *

package/dist-types/middleware-handler.d.ts

@@ -6,7 +6,7 @@
  * tests and advanced setups bind it to their own.
  */
 import type { MiddlewareHandler } from 'astro';
-import type { C15tResolvedOptions } from './types';
+import type { C15tResolvedOptions } from './types.js';
 /** Options for {@link createConsentMiddleware}. */
 export interface ConsentMiddlewareOptions {
     /** Override fetch, mainly for tests. */

package/dist-types/middleware.d.ts

@@ -5,7 +5,7 @@
  * endpoints and server islands alike — sees `Astro.locals.c15t` already
  * populated. See {@link createConsentMiddleware} for what it does.
  */
-import type { C15tLocals } from './types';
+import type { C15tLocals } from './types.js';
 declare global {
     namespace App {
         interface Locals {
@@ -16,5 +16,5 @@ declare global {
 }
 export declare const onRequest: import("astro").MiddlewareHandler;
 export default onRequest;
-export { createConsentMiddleware } from './middleware-handler';
-export type { ConsentMiddlewareOptions } from './middleware-handler';
+export { createConsentMiddleware } from './middleware-handler.js';
+export type { ConsentMiddlewareOptions } from './middleware-handler.js';

package/dist-types/mode.d.ts

@@ -8,7 +8,7 @@
  */
 import { custom } from '@c15t/core';
 import type { ProviderTransportFactory } from '@c15t/core';
-import type { C15tHostedDescriptor, C15tManifestDescriptor, C15tModeDescriptor, C15tOfflineDescriptor } from './types';
+import type { C15tHostedDescriptor, C15tManifestDescriptor, C15tModeDescriptor, C15tOfflineDescriptor } from './types.js';
 /**
  * Talk to a c15t backend over HTTP.
  *

package/dist-types/server.d.ts

@@ -1,6 +1,6 @@
 import type { ConsentSnapshot, KernelConfig, KernelTranslations } from '@c15t/core';
 import type { ConsentRequestHeaderInputs } from '@c15t/schema/types';
-import type { C15tColorScheme, C15tLocals, C15tResolvedOptions } from './types';
+import type { C15tColorScheme, C15tLocals, C15tResolvedOptions } from './types.js';
 /** Input for {@link resolveConsentContext}. */
 export interface ResolveConsentContextOptions {
     /** The incoming request headers. */

package/dist-types/types.d.ts

@@ -7,7 +7,7 @@
  * all import. Callbacks and other live values belong in the module named
  * by {@link C15tAstroOptions.clientEntrypoint}.
  */
-import type { AllConsentNames, ConsentSnapshot, ConsentPresentation, KernelConfig, LegalLinks, Script, StorageConfig } from '@c15t/core';
+import type { AllConsentNames, ClearOnRevocationConfig, ConsentSnapshot, ConsentPresentation, KernelConfig, LegalLinks, Script, StorageConfig } from '@c15t/core';
 import type { PolicyRule, PolicyResolution, ConsentManifest, GlobalVendorList } from '@c15t/schema/types';
 import type { Theme } from '@c15t/ui/theme';
 /** Transport selection, in a form that survives serialization. */
@@ -42,6 +42,15 @@ export interface C15tManifestDescriptor {
     backendURL?: string;
     /** Inline manifest. Takes precedence over `manifestURL`. */
     manifest?: ConsentManifest;
+    /**
+     * Report each init the server resolves, in the middleware and the init
+     * route, to the backend's `POST /sessions`, server-to-server and
+     * detached from the response, so the backend still counts visitors it
+     * never served `/init` to. Set `false` to send none.
+     *
+     * @default true
+     */
+    reportSessions?: boolean;
 }
 /**
  * Which framework renders the on-demand dialog islands.
@@ -113,6 +122,8 @@ export interface C15tAstroOptions {
     consentCategories?: AllConsentNames[];
     /** Consent-gated scripts handed to the core script loader. */
     scripts?: Script[];
+    /** Browser data to remove when its consent permission is revoked. */
+    clearOnRevocation?: ClearOnRevocationConfig;
     /**
      * IAB TCF configuration. `false` disables it.
      *
@@ -243,6 +254,8 @@ export interface C15tI18nOptions {
  */
 export interface C15tClientOptionsExtension {
     scripts?: Script[];
+    /** Overrides cleanup targets from the integration options. */
+    clearOnRevocation?: ClearOnRevocationConfig;
     callbacks?: Record<string, unknown>;
     /** Merged over the serialized theme. */
     theme?: Theme;

package/dist-types/ui/adapter.d.ts

@@ -15,7 +15,7 @@
  * that is the only place a framework specifier appears.
  */
 import type { ConsentRuntime } from '@c15t/core/runtime';
-import type { C15tResolvedOptions, C15tUIAdapterName } from '../types';
+import type { C15tResolvedOptions, C15tUIAdapterName } from '../types.js';
 /** Which dialog a caller asked for. */
 export type ConsentDialogKind = 'preferences' | 'iab';
 /** Context handed to an adapter when a dialog opens. */

package/dist-types/ui/provider-props.d.ts

@@ -7,7 +7,7 @@
  * and theme tokens the banner and dialog both read.
  */
 import type { ConsentRuntime } from '@c15t/core/runtime';
-import type { C15tResolvedOptions } from '../types';
+import type { C15tResolvedOptions } from '../types.js';
 /**
  * The slice of the integration options a dialog island renders with.
  *

package/dist-types/ui/react.d.ts

@@ -14,6 +14,6 @@
  * here: a `.tsx` file can only be compiled by the consuming app's build,
  * and only that build knows whether `@astrojs/react` is present.
  */
-import type { ConsentDialogAdapter } from './adapter';
+import type { ConsentDialogAdapter } from './adapter.js';
 /** The React 18/19 dialog surface implementation. */
 export declare const reactDialogAdapter: ConsentDialogAdapter;

package/dist-types/ui/svelte.d.ts

@@ -16,6 +16,6 @@
  * its `runtime` prop, so there is one kernel per page no matter how many
  * islands, scripts or frameworks read it.
  */
-import type { ConsentDialogAdapter } from './adapter';
+import type { ConsentDialogAdapter } from './adapter.js';
 /** The Svelte 5 dialog surface implementation. */
 export declare const svelteDialogAdapter: ConsentDialogAdapter;

package/dist-types/ui/vue.d.ts

@@ -14,6 +14,6 @@
  * here: a `.vue` file can only be compiled by the consuming app's build,
  * and only that build knows whether `@astrojs/vue` is present.
  */
-import type { ConsentDialogAdapter } from './adapter';
+import type { ConsentDialogAdapter } from './adapter.js';
 /** The Vue 3 dialog surface implementation. */
 export declare const vueDialogAdapter: ConsentDialogAdapter;

package/docs/README.md

@@ -45,14 +45,17 @@ These docs describe v3. Start with Inth hosted setup, identify the framework, ro
 - [Ahrefs Analytics](./integrations/ahrefs-analytics.md): Configure Ahrefs Analytics with c15t v3, understand measurement permission and verify loading and revocation.
 - [Amplitude](./integrations/amplitude.md): Configure Amplitude with c15t v3, understand measurement permission and verify loading and revocation.
 - [Custom integrations](./integrations/building-integrations.md): Define loading, initialization and consent-change behavior for a vendor without a helper.
+- [Clear on revocation](./integrations/clear-on-revocation.md): Remove configured first-party cookies and Web Storage keys when their consent category is denied.
 - [Clearbit](./integrations/clearbit.md): Configure Clearbit with c15t v3, understand marketing permission and verify loading and revocation.
 - [Cloudflare Web Analytics](./integrations/cloudflare-web-analytics.md): Configure Cloudflare Web Analytics with c15t v3, understand measurement permission and verify loading and revocation.
+- [Cloudflare Zaraz](./integrations/cloudflare-zaraz.md): Synchronize c15t permissions with Zaraz purposes while Cloudflare manages your tools.
 - [Crisp](./integrations/crisp.md): Configure Crisp with c15t v3, understand functionality permission and verify loading and revocation.
 - [Databuddy](./integrations/databuddy.md): Configure Databuddy's initial and updated consent state with c15t v3.
 - [Fathom Analytics](./integrations/fathom-analytics.md): Configure Fathom Analytics with c15t v3, understand measurement permission and verify loading and revocation.
 - [Google Maps](./integrations/google-maps.md): Prevent a map iframe from mounting before the required permission.
 - [Google Tag](./integrations/google-tag.md): Configure gtag with c15t Consent Mode signals and understand its loading behavior.
 - [Google Tag Manager](./integrations/google-tag-manager.md): Load GTM with c15t consent signals and verify the tags inside your container.
+- [Granular consent](./integrations/granular-consent.md): Let visitors grant a category and still turn one vendor off, without adopting IAB TCF.
 - [Heap](./integrations/heap.md): Configure Heap with c15t v3, understand measurement permission and verify loading and revocation.
 - [Hightouch](./integrations/hightouch.md): Configure Hightouch with c15t v3, understand measurement permission and verify loading and revocation.
 - [Hotjar](./integrations/hotjar.md): Configure Hotjar with c15t v3, understand measurement permission and verify loading and revocation.

package/docs/frameworks/astro/quickstart.md

@@ -119,7 +119,11 @@ stale and refresh it in the background. On adapters that expose
 `locals.runtime.ctx.waitUntil` (Cloudflare) the refresh is handed to it so it
 is not cut short when the response is sent; nothing is needed from you. For
 another lifetime API, pass `onBackgroundRevalidate` to
-`createConsentRouteHandlers` or `resolveConsentContext`.
+`createConsentRouteHandlers` or `resolveConsentContext`. Session reports go
+through the same hook: after each resolution, in the middleware and the init
+route, the server posts a small report to the backend's `POST /sessions` so
+the backend still counts visitors it never served `/init` to. Set
+`reportSessions: false` on `manifest()` to send none.
 
 The framework integration must appear before `c15t()`. For React or Vue, install
 that framework's Astro integration and c15t adapter, register the matching

package/docs/guides/deployment-modes.md

@@ -30,6 +30,18 @@ in your application while consent writes still go to Inth. Regular backend
 browser setup. See [data fetching and transports](./data-fetching.md) for
 the comparison, including custom transports and offline mode.
 
+Manifest resolution removes the per-visitor `/init` request, and with it the
+backend's only count of visitors. The server adapters replace it with a session
+report: after each resolution, on a server-rendered page or the same-origin
+init route, the host posts a small report to the backend's `POST /sessions`,
+server-to-server and detached from the response. The browser makes no request
+and the report stores no identity; the visitor's IP and user agent travel as
+forwarded headers under the backend's usual IP handling. Each report is one
+resolution; a page view can produce a `render` and a `route` report, and the
+consuming side groups them into sessions by address and user agent within a
+window. Static output resolves in the browser and sends none. Set `reportSessions: false` on an adapter to turn
+it off.
+
 ## Match initialization to your application output
 
 | Application output | Initial state             | Required setup                                              |

package/docs/integrations/building-integrations.md

@@ -31,6 +31,11 @@ Replace the example URL and implement the vendor's initialization. This is a
 loader template, not a functioning analytics SDK. The script stays blocked
 while measurement permission is denied.
 
+Add `vendor: 'example-analytics'` and declare the vendor in the runtime's
+`vendors` option or in the backend manifest when visitors should be able to
+turn this vendor off inside a granted category. See
+[granular consent](./granular-consent.md).
+
 ## Define revocation deliberately
 
 `onConsentChange` receives current permission information. Use it to update the

package/docs/integrations/clear-on-revocation.md

@@ -0,0 +1,167 @@
+---
+title: Clear on revocation
+description: Remove configured first-party cookies and Web Storage keys when
+  their consent category is denied.
+group: integrations
+---
+
+## Configure cleanup
+
+Add `clearOnRevocation` to your provider or runtime options. Declare only the
+data owned by each optional category:
+
+```ts
+import { hosted, type ClearOnRevocationConfig } from 'c15t';
+import { createConsentRuntime } from 'c15t/runtime';
+
+const clearOnRevocation = {
+	measurement: {
+		cookies: ['_ga', '_ga_*'],
+		localStorage: ['analytics:*'],
+	},
+	marketing: {
+		cookies: ['_fbp'],
+		sessionStorage: ['campaign-id'],
+	},
+} satisfies ClearOnRevocationConfig;
+
+const runtime = createConsentRuntime({
+	mode: hosted({ url: '/api/c15t' }),
+	clearOnRevocation,
+});
+
+// Start in the browser after mount. The endpoint must serve your c15t backend.
+runtime.start();
+
+// Call runtime.dispose() when the app no longer needs consent management.
+```
+
+For React, pass the same configuration through `ConsentProvider.options`:
+
+```tsx
+import type { ReactNode } from 'react';
+import { ConsentProvider, hosted } from 'c15t/react';
+
+const mode = hosted({ url: '/api/c15t' });
+
+export function Consent({ children }: { children: ReactNode }) {
+	return (
+		<ConsentProvider
+			options={{
+				mode,
+				clearOnRevocation: {
+					measurement: { cookies: ['_ga', '_ga_*'] },
+				},
+			}}
+		>
+			{children}
+		</ConsentProvider>
+	);
+}
+```
+
+The same option is available in Next.js and TanStack Start `ConsentRoot` props, Vue and
+Nuxt configuration, Svelte providers, and Astro integration options. Solid and
+other headless integrations can use `createConsentRuntime` as shown above.
+Every adapter uses the same cleanup module.
+
+Omitting `clearOnRevocation` leaves cleanup disabled. The provider option is
+initial-only. Remount the provider to replace its cleanup configuration. For
+a shared runtime, configure the runtime owner rather than a borrowing provider.
+
+## Matching names and cookie scopes
+
+Use an exact string or a nonempty prefix followed by `*`. `_ga_*` matches
+`_ga_ABC123`; it does not match `_ga`. Regular expressions, wildcards in other
+positions, and a bare `*` are unsupported. Web Storage keys may contain spaces,
+Unicode, and punctuation. Cookie names use their raw spelling, without URL
+decoding.
+
+Cookies can share a name while having different domains or paths. Cleanup
+tries the current host and its parent domains, and the current path and its
+ancestors. To target a specific scope, use an object:
+
+```ts
+const clearOnRevocation = {
+	measurement: {
+		cookies: [
+			{ name: 'analytics-id', domain: 'example.com', path: '/' },
+			{ name: 'checkout-metrics', domain: '', path: '/checkout' },
+			{ name: 'partitioned-metrics', partitioned: true },
+		],
+	},
+};
+```
+
+An empty `domain` means host-only. Explicit domains and paths replace the
+automatic attempts for that field. Exact names can be deleted at a configured
+path even when the current page cannot read that cookie. Prefix matching can
+only discover cookie names visible to the current page, so use an exact name
+for a cookie on another path.
+
+Partitioned cookies require `partitioned: true`; ordinary targets remove
+unpartitioned cookies. Cookie deletion preserves the browser's `__Secure-`
+and `__Host-` prefix requirements. c15t protects its own consent, notice,
+privacy, pending-save, and IAB consent records in cookies and localStorage,
+including configured custom storage keys, even if your patterns match them.
+c15t does not store consent in sessionStorage, so targeted entries there are
+removed even when their names match consent storage keys.
+
+## When cleanup runs
+
+The runtime attaches cleanup after persistence and the script loader. Cleanup
+waits while the policy is pending. On the first settled snapshot, it removes
+configured data for every denied category. This includes a new opt-in visitor
+who has not made a choice and a returning visitor whose permission expired.
+
+After that first pass, cleanup runs when a category changes from allowed to
+denied. Saving a refusal, expiry, a policy change, Global Privacy Control,
+or synchronized records can cause that transition. Under an opt-out policy,
+an expired grant that remains effectively allowed does not trigger deletion.
+The `necessary` category cannot be configured for cleanup.
+
+Cleanup keeps waiting if a failed initial request leaves the policy pending.
+If a previously settled policy falls back to denial after an initialization
+failure, cleanup removes its configured data. A later successful retry cannot
+restore deleted data.
+
+Runtime construction, server rendering, draft checkbox edits, opening the
+dialog, and disposal do not clear data. Cleanup does not poll storage or repeat
+on unrelated UI updates.
+
+## Use an existing kernel
+
+For a manually assembled integration, attach the module in the browser after
+persistence hydration and script-loader setup:
+
+```ts
+import { createClearOnRevocation } from 'c15t/modules/clear-on-revocation';
+
+const cleanup = createClearOnRevocation({
+	kernel,
+	config: { measurement: { cookies: ['_ga', '_ga_*'] } },
+	storageConfig,
+});
+
+// Stop observing consent when this integration is torn down.
+cleanup.dispose();
+```
+
+Here `kernel` is your existing consent kernel. Pass the same `storageConfig`
+used by persistence so cleanup protects custom record keys. Attaching the
+module can immediately clear denied categories if the policy is already
+settled. Do not also attach it when your provider or runtime owns cleanup.
+
+## Browser limits
+
+Cleanup can remove JavaScript-accessible first-party cookies and keys in the
+current origin's `localStorage` and `sessionStorage`. It cannot remove
+`HttpOnly` cookies or another origin's data. Keep `HttpOnly` protections and
+use your server to expire cookies that require server access. Cookie deletion
+must match the cookie's scope. See the
+[browser cookie documentation](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Cookies).
+
+Browser restrictions can prevent reads or deletions. Cleanup failures do not
+block consent updates. A running SDK may write data again after a sweep, so
+keep script gating and the integration's consent-change or teardown behavior
+configured. Deleting a script element cannot undo JavaScript it already ran.