@c15t/astro 3.0.0-alpha.0

package/dist/ui/svelte.js

@@ -0,0 +1,36 @@
+import { requireDialogSurface } from "./adapter.js";
+import { buildProviderProps } from "./provider-props.js";
+const svelteDialogAdapter = {
+    async mount (context) {
+        const [{ mount, unmount }, surface] = await Promise.all([
+            import("svelte"),
+            requireDialogSurface('svelte')()
+        ]);
+        const component = mount(surface.default, {
+            props: {
+                ...buildProviderProps(context.runtime, context.options),
+                kind: context.kind,
+                tab: context.tab
+            },
+            target: context.target
+        });
+        return {
+            close () {
+                context.runtime.kernel.set.activeUI('none');
+            },
+            async destroy () {
+                await unmount(component, {
+                    outro: true
+                });
+            }
+        };
+    },
+    name: 'svelte',
+    async preload () {
+        await Promise.all([
+            import("svelte"),
+            requireDialogSurface('svelte')()
+        ]);
+    }
+};
+export { svelteDialogAdapter };

package/dist/ui/vue.js

@@ -0,0 +1,38 @@
+import { requireDialogSurface } from "./adapter.js";
+import { buildProviderProps } from "./provider-props.js";
+const vueDialogAdapter = {
+    async mount (context) {
+        const [{ createApp }, { c15tVue }, surface] = await Promise.all([
+            import("vue"),
+            import("@c15t/vue/vue-plugin"),
+            requireDialogSurface('vue')()
+        ]);
+        const { options, runtime } = buildProviderProps(context.runtime, context.options);
+        const app = createApp(surface.default, {
+            kind: context.kind,
+            tab: context.tab
+        });
+        app.use(c15tVue, {
+            ...options,
+            runtime
+        });
+        app.mount(context.target);
+        return {
+            close () {
+                context.runtime.kernel.set.activeUI('none');
+            },
+            destroy () {
+                app.unmount();
+            }
+        };
+    },
+    name: 'vue',
+    async preload () {
+        await Promise.all([
+            import("vue"),
+            import("@c15t/vue/vue-plugin"),
+            requireDialogSurface('vue')()
+        ]);
+    }
+};
+export { vueDialogAdapter };

package/dist-types/api/handlers.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Route handlers for `/api/c15t/init` and `/api/c15t/manifest`.
+ *
+ * Manifest mode moves policy resolution off the browser's critical path:
+ * the host fetches one geo-independent, CDN-cacheable manifest and resolves
+ * `/init` locally per request. These are the Astro handlers for that — the
+ * same contract `createSvelteKitConsentRouteHandlers` and
+ * `createNextConsentRouteHandlers` implement.
+ *
+ * Cache discipline:
+ * - The manifest route forwards the backend's `Cache-Control`/`ETag`
+ *   verbatim and answers `If-None-Match` with `304`. The edge caches it;
+ *   this process only dedupes bursts (see `@c15t/core/server`).
+ * - The init route is per-request (geo, language, GPC) and therefore
+ *   `private, no-store`.
+ */
+import type { ManifestFetch } from '@c15t/core/server';
+import type { C15tResolvedOptions } from '../types';
+import type { FetchGvl } from './manifest-init';
+/**
+ * The per-request context a route or the middleware can pass so a
+ * background refresh is registered with the platform. Astro adapters that
+ * cancel detached work after the response expose `waitUntil` on
+ * `locals.runtime.ctx` (Cloudflare); anything else is left alone.
+ */
+export interface RequestLifetime {
+    locals?: unknown;
+}
+/**
+ * Hands a promise to the `waitUntil` an Astro adapter exposes on
+ * `locals.runtime.ctx` (Cloudflare), so a background refresh outlives the
+ * response on runtimes that would cancel it. A no-op where there is none.
+ */
+export declare const waitUntilFromLocals: (revalidation: Promise<void>, locals: unknown) => void;
+/** Options accepted by the route handler factory. */
+export interface ConsentRouteHandlerOptions {
+    /** The resolved integration options. */
+    options: C15tResolvedOptions;
+    /** Override fetch, mainly for tests. */
+    fetch?: ManifestFetch;
+    /**
+     * Fetches the Global Vendor List when the resolved policy is IAB.
+     * Defaults to a plain `GET` of the manifest's GVL reference.
+     */
+    fetchGvl?: FetchGvl;
+    /**
+     * Receives the promise of a background manifest revalidation started by
+     * this request, so the host can keep it alive past the response on
+     * runtimes that stop detached work once a response is sent (a platform
+     * `waitUntil`, for example). The promise never rejects. Not called when
+     * the manifest is fresh or the request itself waits on the upstream.
+     */
+    onBackgroundRevalidate?: (revalidation: Promise<void>) => void;
+}
+/**
+ * Work out where `GET /manifest` lives for this request.
+ *
+ * Explicit options win, then `C15T_MANIFEST_URL` / `C15T_BACKEND_URL`.
+ *
+ * @param request - The incoming request, used to resolve relative URLs.
+ * @param options - The resolved integration options.
+ * @returns An absolute manifest URL.
+ * @throws {Error} When neither a manifest URL nor a backend URL is configured.
+ */
+export declare const resolveManifestSourceURL: (request: Request, options: C15tResolvedOptions) => string;
+/**
+ * Build the `init` and `manifest` route handlers.
+ *
+ * @param handlerOptions - Integration options plus test seams.
+ * @returns `init`, `manifest`, and a `GET` that dispatches between them.
+ * @example
+ * ```ts
+ * // src/pages/api/c15t/init.ts
+ * import options from 'virtual:c15t/options';
+ * import { createConsentRouteHandlers } from '@c15t/astro/api';
+ *
+ * const handlers = createConsentRouteHandlers({ options });
+ * export const GET = ({ request }) => handlers.init(request);
+ * ```
+ */
+export declare const createConsentRouteHandlers: (handlerOptions: ConsentRouteHandlerOptions) => {
+    GET: (request: Request) => Promise<Response>;
+    init: (request: Request, lifetime?: RequestLifetime) => Promise<Response>;
+    manifest: (request: Request, lifetime?: RequestLifetime) => Promise<Response>;
+};

package/dist-types/api/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * `@c15t/astro/api` — route handlers for the injected consent endpoints.
+ *
+ * The manifest cache itself lives in `@c15t/core/server`, shared with the
+ * Next.js, Nuxt and SvelteKit layers so no two hosts can disagree about
+ * cache lifetimes or revalidation.
+ */
+export { createConsentRouteHandlers, resolveManifestSourceURL, waitUntilFromLocals, } from './handlers';
+export type { ConsentRouteHandlerOptions, RequestLifetime } from './handlers';
+export { loadConsentManifest, resolveManifestInit, resolveManifestSourceFrom, } from './manifest-init';
+export type { FetchGvl, RequestSource, ResolvedInitOutput, } from './manifest-init';
+export { clearManifestCache, createManifestRequestURL, fetchCachedManifest, getManifestSMaxAge, getManifestStaleWhileRevalidate, MANIFEST_DEDUPE_TTL_SECONDS, MANIFEST_PASSTHROUGH_HEADERS, } from '@c15t/core/server';
+export type { CachedManifestResponse, FetchCachedManifestOptions, ManifestFetch, ManifestSourceConfig, } from '@c15t/core/server';

package/dist-types/api/init.d.ts

@@ -0,0 +1,10 @@
+/**
+ * `GET /api/c15t/init` — injected by the integration in manifest mode.
+ *
+ * Resolves the consent decision for this request from the cached manifest,
+ * so the browser gets an `/init` payload without the backend being on the
+ * request path and without shipping the manifest to the client.
+ */
+import type { APIRoute } from 'astro';
+export declare const GET: APIRoute;
+export declare const prerender = false;

package/dist-types/api/manifest-init.d.ts

@@ -0,0 +1,73 @@
+import type { ManifestFetch } from '@c15t/core/server';
+import type { ConsentManifest, ConsentManifestGVLReference, ConsentRequestHeaderInputs, GlobalVendorList, InitOutput } from '@c15t/schema/types';
+import type { C15tResolvedOptions } from '../types';
+/** Fetches the Global Vendor List when the resolved policy is IAB. */
+export type FetchGvl = (input: {
+    reference: ConsentManifestGVLReference;
+    language: string;
+    fetch: ManifestFetch;
+}) => Promise<GlobalVendorList | null>;
+/**
+ * The parts of a request URL resolution needs.
+ *
+ * The middleware has `Astro.locals`-adjacent `Headers` and a URL string; the
+ * route handlers have a whole `Request`. Both narrow to this.
+ */
+export interface RequestSource {
+    /** The absolute request URL, when the caller has one. */
+    url?: string;
+    /** The incoming request headers. */
+    headers: Headers;
+}
+/**
+ * Work out where `GET /manifest` lives for this request.
+ *
+ * Explicit options win, then `C15T_MANIFEST_URL` / `C15T_BACKEND_URL`.
+ *
+ * @param source - The request URL and headers, used to resolve relative URLs.
+ * @param options - The resolved integration options.
+ * @returns An absolute manifest URL.
+ * @throws {Error} When neither a manifest URL nor a backend URL is configured.
+ */
+export declare const resolveManifestSourceFrom: (source: RequestSource, options: C15tResolvedOptions) => string;
+/**
+ * Load the manifest for this request through the shared in-process cache.
+ *
+ * An inline `manifest` short-circuits the network entirely; otherwise this
+ * is `fetchCachedManifest`, so concurrent requests collapse into one
+ * upstream call and later ones revalidate by `ETag` on the backend's
+ * schedule instead of re-downloading per render.
+ *
+ * @param input - Request source, integration options, and a fetch seam.
+ * @returns The tenant manifest.
+ * @throws {Error} When the manifest source cannot be resolved or the
+ * upstream responds non-2xx.
+ */
+export declare const loadConsentManifest: (input: {
+    source: RequestSource;
+    options: C15tResolvedOptions;
+    fetch?: ManifestFetch;
+    query?: string;
+    onBackgroundRevalidate?: (revalidation: Promise<void>) => void;
+}) => Promise<ConsentManifest>;
+/** Plain `GET` of the manifest's GVL reference. */
+export declare const defaultFetchGvl: FetchGvl;
+/** An `InitOutput` carrying the overrides the request implied. */
+export type ResolvedInitOutput = InitOutput & {
+    resolvedOverrides?: Record<string, unknown>;
+};
+/**
+ * Resolve one request's `/init` payload from an already-loaded manifest.
+ *
+ * @param input - The manifest, the request inputs, and the GVL seams.
+ * @returns The resolved init payload, with `resolvedOverrides` echoed back.
+ *   `gvl` is `null` when the vendor list could not be fetched.
+ */
+export declare const resolveManifestInit: (input: {
+    manifest: ConsentManifest;
+    inputs: ConsentRequestHeaderInputs;
+    fetch?: ManifestFetch;
+    /** Same-origin init route that serves versioned public lists. */
+    gvlRoute?: string;
+    fetchGvl?: FetchGvl;
+}) => Promise<ResolvedInitOutput>;

package/dist-types/api/manifest.d.ts

@@ -0,0 +1,9 @@
+/**
+ * `GET /api/c15t/manifest` — injected by the integration in manifest mode.
+ *
+ * Proxies the backend's manifest with its cache headers intact, so a CDN in
+ * front of the site can cache it exactly as the backend intended.
+ */
+import type { APIRoute } from 'astro';
+export declare const GET: APIRoute;
+export declare const prerender = false;

package/dist-types/browser/iab.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The page's lazy IAB factory.
+ *
+ * The runtime calls `createIAB` synchronously, but a static import would
+ * put the whole TCF implementation in the boot chunk of every page,
+ * including sites that never turn IAB on. `createLazyIABFactory` from
+ * `@c15t/core/runtime` keeps the synchronous call site and defers the
+ * bytes; {@link whenIABReady} closes the window between the two, and the
+ * client awaits it before mounting the IAB dialog.
+ */
+/** The `createIAB` the client hands the runtime. */
+export declare const lazyCreateIAB: import("@c15t/core/runtime").ConsentRuntimeIABFactory;
+/** Resolves once every pending `@c15t/iab` load has settled. */
+export declare const whenIABReady: () => Promise<void>;

package/dist-types/browser/inline-scripts.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Consent gating for scripts already present in the HTML.
+ *
+ * Astro renders a lot of third-party embeds inline, and the core script
+ * loader only knows about scripts declared in configuration. This scanner
+ * covers the other half: mark a tag as inert and label it, and it runs the
+ * moment consent allows it.
+ *
+ * ```astro
+ * <script data-c15t-category="measurement" is:inline type="text/plain">
+ *   console.log('only with measurement consent');
+ * </script>
+ * ```
+ *
+ * `is:inline` matters: without it Astro hoists the tag into a bundled
+ * module and runs it regardless of consent.
+ *
+ * `data-c15t-category` accepts one category name. The tag is left alone
+ * until consent is granted, then replaced by a live `<script>` in the same
+ * position. Revoking consent does not un-run a script that already
+ * executed, so the element is marked and skipped instead.
+ */
+import type { ConsentSnapshot } from '@c15t/core';
+/** Attribute that marks a script for consent gating. */
+export declare const CATEGORY_ATTRIBUTE = "data-c15t-category";
+/** Attribute stamped on a gated script once it has been activated. */
+export declare const ACTIVATED_ATTRIBUTE = "data-c15t-activated";
+/**
+ * Activate every gated script the current consent state allows.
+ *
+ * Safe to call repeatedly — activated scripts are stamped and skipped, so
+ * re-running it after a ClientRouter navigation only picks up new tags.
+ *
+ * @param snapshot - The current kernel snapshot.
+ * @param root - Where to scan. Defaults to the whole document.
+ * @returns The number of scripts activated by this pass.
+ */
+export declare const activateGatedScripts: (snapshot: ConsentSnapshot, root?: ParentNode) => number;

package/dist-types/client.d.ts

@@ -0,0 +1,152 @@
+/**
+ * `@c15t/astro/client` — the page-level consent runtime.
+ *
+ * Astro is an MPA and islands do not share a component tree, so there is
+ * nothing for a provider to hang off. Instead the integration injects a
+ * boot script that creates exactly one runtime per page; islands, plain
+ * `<script>` tags and any framework on the page all read that one object.
+ *
+ * The runtime survives ClientRouter navigation: the module is evaluated
+ * once and re-attaches to the swapped DOM on `astro:page-load` and
+ * `astro:after-swap`, so consent state does not reset when a visitor moves
+ * between pages.
+ *
+ * ```ts
+ * import { getConsentClient } from '@c15t/astro/client';
+ *
+ * const c15t = getConsentClient();
+ * c15t?.subscribe((snapshot) => console.log(snapshot.effectivePermissions));
+ * ```
+ */
+import type { ConsentSnapshot, ConsentState, KernelUser, Unsubscribe } from '@c15t/core';
+import type { ConsentRuntime } from '@c15t/core/runtime';
+import type { C15tClientOptionsExtension, C15tResolvedOptions } from './types';
+import type { ConsentDialogKind } from './ui/adapter';
+/** Attribute the server-rendered banner puts on its action buttons. */
+export declare const ACTION_ATTRIBUTE = "data-c15t-action";
+/** Attribute selecting which dialog a `customize` action opens. */
+export declare const DIALOG_ATTRIBUTE = "data-c15t-dialog";
+/**
+ * Attribute selecting which tab the IAB preference centre opens on.
+ *
+ * The IAB banner's "N partners" link is a `customize` action that should
+ * land on the vendors tab rather than purposes, the way the React, Svelte
+ * and Vue banners do.
+ */
+export declare const DIALOG_TAB_ATTRIBUTE = "data-c15t-tab";
+/** Actions the banner can trigger. */
+export type ConsentAction = 'accept' | 'reject' | 'customize' | 'dismiss' | 'close';
+/** The page-level consent client. */
+export interface AstroConsentClient {
+    /** The runtime that owns this page's kernel. */
+    readonly runtime: ConsentRuntime;
+    /** The resolved integration options. */
+    readonly options: C15tResolvedOptions;
+    /** The current consent snapshot. */
+    getConsent: () => ConsentSnapshot;
+    /**
+     * Observe consent changes.
+     *
+     * @param listener - Called with every new snapshot.
+     * @returns An unsubscribe function.
+     */
+    subscribe: (listener: (snapshot: ConsentSnapshot) => void) => Unsubscribe;
+    /**
+     * Open a dialog, mounting its island on first use.
+     *
+     * @param kind - `'preferences'` (default) or `'iab'`.
+     * @param tab - Which IAB preference-centre tab to land on. Ignored by
+     * the preferences dialog, which has no tabs.
+     */
+    openDialog: (kind?: ConsentDialogKind, tab?: 'purposes' | 'vendors') => Promise<void>;
+    /** Close the open dialog. */
+    closeDialog: () => void;
+    /** Accept every configured category. */
+    acceptAll: () => Promise<void>;
+    /** Reject everything but strictly necessary. */
+    rejectAll: () => Promise<void>;
+    /**
+     * Save a specific set of consents.
+     *
+     * @param consents - The categories to persist.
+     */
+    save: (consents: Partial<ConsentState>) => Promise<void>;
+    /**
+     * Associate this consent record with an external identity.
+     *
+     * @param user - The external user.
+     */
+    identify: (user: KernelUser) => Promise<void>;
+    /** Tear the runtime down. Mainly for tests. */
+    dispose: () => void;
+}
+/**
+ * Show or hide the persistent consent controls the page rendered on the
+ * server (`<ConsentDialogTrigger />`) as the policy resolution changes.
+ *
+ * With nothing to manage the controls stay hidden: before a rule resolves,
+ * and under a `none` rule that owes no rights. They appear on their own once
+ * a later init supplies a rule that does.
+ *
+ * @param snapshot - The current kernel snapshot.
+ */
+export declare const syncSurfaceVisibility: (snapshot: ConsentSnapshot) => void;
+export declare const syncBannerVisibility: (snapshot: ConsentSnapshot) => void;
+/**
+ * The page's consent client, if the integration has booted.
+ *
+ * @returns The client, or `null` outside the browser or before boot.
+ */
+export declare const getConsentClient: () => AstroConsentClient | null;
+/**
+ * Wire the delegated handler for the server-rendered banner's buttons.
+ *
+ * The banner ships zero framework JavaScript: the buttons carry
+ * `data-c15t-action` and one document-level listener turns them into
+ * runtime calls. Calling this more than once is a no-op.
+ */
+export declare const attachBannerActions: () => void;
+/**
+ * Create the page's consent runtime, or return the existing one.
+ *
+ * The integration calls this from the script it injects into every page;
+ * application code uses {@link getConsentClient} instead.
+ *
+ * @param options - The serialized integration options.
+ * @param extension - Non-serializable additions from `clientEntrypoint`.
+ * @returns The page-level consent client.
+ */
+export declare const boot: (options: C15tResolvedOptions, extension?: C15tClientOptionsExtension) => AstroConsentClient;
+/**
+ * The current consent snapshot.
+ *
+ * @returns The snapshot, or `null` before boot.
+ */
+export declare const getConsent: () => ConsentSnapshot | null;
+/**
+ * Observe consent changes.
+ *
+ * @param listener - Called with every new snapshot.
+ * @returns An unsubscribe function. A no-op before boot.
+ */
+export declare const subscribe: (listener: (snapshot: ConsentSnapshot) => void) => Unsubscribe;
+/**
+ * Open a consent dialog.
+ *
+ * @param kind - `'preferences'` (default) or `'iab'`.
+ * @param tab - Which IAB preference-centre tab to open on.
+ */
+export declare const openDialog: (kind?: ConsentDialogKind, tab?: "purposes" | "vendors") => Promise<void>;
+/**
+ * Download the dialog surface's chunks without mounting it.
+ *
+ * Use it from an idle callback when the first open needs to feel instant;
+ * skip it when you would rather not spend the bytes on visitors who never
+ * open the preference centre.
+ */
+export declare const preloadDialog: () => Promise<void>;
+export { activateGatedScripts } from './browser/inline-scripts';
+export type { ConsentRuntime } from '@c15t/core/runtime';
+export type { ConsentDialogKind } from './ui/adapter';
+export { registerDialogAdapter, registerDialogSurface } from './ui/adapter';
+export type { ConsentDialogAdapter, ConsentDialogContext, ConsentDialogHandle, ConsentDialogSurfaceLoader, } from './ui/adapter';

package/dist-types/index.d.ts

@@ -0,0 +1,33 @@
+/**
+ * `@c15t/astro` — consent management for Astro.
+ *
+ * The banner is a server-rendered `.astro` component with no framework
+ * JavaScript; the preference centre and the IAB dialog are Svelte islands
+ * mounted only when someone opens them; and because Astro islands never
+ * share a component tree, the kernel is a page-level singleton created by
+ * the script this integration injects rather than a provider.
+ *
+ * ```js
+ * // astro.config.mjs
+ * import { defineConfig } from 'astro/config';
+ * import svelte from '@astrojs/svelte';
+ * import c15t, { hosted } from '@c15t/astro';
+ *
+ * export default defineConfig({
+ *   output: 'server',
+ *   integrations: [svelte(), c15t({ mode: hosted({ url: '/api/c15t' }) })],
+ * });
+ * ```
+ */
+export { c15t, c15t as default, resolveOptions } from './integration';
+export { createConsentMiddleware } from './middleware-handler';
+export type { ConsentMiddlewareOptions } from './middleware-handler';
+export { hostedMode as hosted, manifestMode as manifest, offlineMode as offline, resolveTransportFactory, custom, } from './mode';
+export type { ManifestClientEndpoints } from './mode';
+export type { C15tAstroOptions, C15tClientOptionsExtension, C15tColorScheme, C15tEndpointOptions, C15tHostedDescriptor, C15tI18nOptions, C15tIABOptions, C15tLocals, C15tManifestDescriptor, C15tMiddlewareOptions, C15tModeDescriptor, C15tOfflineDescriptor, C15tResolvedOptions, C15tUIAdapterName, } from './types';
+export type { ConsentDialogAdapter, ConsentDialogContext, ConsentDialogHandle, ConsentDialogKind, ConsentDialogSurfaceLoader, } from './ui/adapter';
+export { registerDialogAdapter, registerDialogSurface } from './ui/adapter';
+export type { ConsentRuntime, ConsentRuntimeOptions } from '@c15t/core/runtime';
+export type { AllConsentNames, ConsentSnapshot, ConsentState, KernelConfig, LegalLinks, PolicyRule, Script, StorageConfig, } from '@c15t/core';
+export { policyRulePresets } from '@c15t/core';
+export type { Theme } from '@c15t/ui/theme';

package/dist-types/integration.d.ts

@@ -0,0 +1,53 @@
+/**
+ * The `c15t()` Astro integration.
+ *
+ * It wires four things into an Astro app:
+ *
+ * 1. A `pre`-order middleware that resolves consent for every request into
+ *    `Astro.locals.c15t`.
+ * 2. A page-level boot script that creates the one consent runtime the page
+ *    shares — Astro islands never share a component tree, so the runtime is
+ *    a page singleton rather than a provider.
+ * 3. Optional `/api/c15t/init` and `/api/c15t/manifest` routes for
+ *    `manifest` mode, with the same semantics as `@c15t/nextjs/api`.
+ * 4. A virtual module (`virtual:c15t/options`) carrying the serialized
+ *    options to all of the above.
+ */
+import type { AstroIntegration } from 'astro';
+import type { C15tAstroOptions, C15tResolvedOptions } from './types';
+/**
+ * Normalize user options into the serializable shape every consumer reads.
+ *
+ * @param options - The options passed to `c15t()`.
+ * @returns Options with defaults applied.
+ * @throws {Error} When `mode` is missing, is not a mode descriptor, or is a
+ * manifest mode with nowhere to save consent.
+ */
+export declare const resolveOptions: (options: C15tAstroOptions) => C15tResolvedOptions;
+/**
+ * Create the c15t Astro integration.
+ *
+ * @param options - Consent configuration for the site.
+ * @returns The Astro integration to list in `astro.config.mjs`.
+ * @throws {Error} When `mode` is missing, or when the Astro integration for
+ * the configured `ui` is not listed in `astro.config`.
+ * @example
+ * ```js
+ * import { defineConfig } from 'astro/config';
+ * import svelte from '@astrojs/svelte';
+ * import c15t, { hosted } from '@c15t/astro';
+ *
+ * export default defineConfig({
+ *   output: 'server',
+ *   integrations: [
+ *     svelte(),
+ *     c15t({
+ *       mode: hosted({ url: 'https://consent.example.com' }),
+ *       consentCategories: ['necessary', 'measurement', 'marketing'],
+ *     }),
+ *   ],
+ * });
+ * ```
+ */
+export declare const c15t: (options: C15tAstroOptions) => AstroIntegration;
+export default c15t;

package/dist-types/libs/cookies.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Cookie helpers for the server-side consent fetches.
+ */
+/**
+ * Keeps only the named cookies from a `Cookie` request header.
+ *
+ * The server-side `/init` call replays the visitor's cookies at the consent
+ * backend. Replaying the whole header would hand a third-party host every
+ * session and auth cookie the site owns, so only the consent cookie travels.
+ *
+ * @param cookieHeader - The incoming `Cookie` header value.
+ * @param names - Cookie names to keep.
+ * @returns The filtered header, or `undefined` when nothing remains.
+ */
+export declare const filterCookieHeader: (cookieHeader: string, names: readonly string[]) => string | undefined;

package/dist-types/middleware-handler.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The middleware factory behind `@c15t/astro/middleware`.
+ *
+ * Kept separate from the entrypoint so it can be constructed with explicit
+ * options — the entrypoint binds it to the build-time virtual module, and
+ * tests and advanced setups bind it to their own.
+ */
+import type { MiddlewareHandler } from 'astro';
+import type { C15tResolvedOptions } from './types';
+/** Options for {@link createConsentMiddleware}. */
+export interface ConsentMiddlewareOptions {
+    /** Override fetch, mainly for tests. */
+    fetch?: typeof globalThis.fetch;
+}
+/**
+ * Build the `pre`-order middleware that populates `Astro.locals.c15t`.
+ *
+ * It reads the consent cookie and the geo/GPC headers, resolves the policy
+ * decision through the configured mode, and leaves the result on locals so
+ * the components render the right thing on the server and the browser boots
+ * without an `/init` roundtrip.
+ *
+ * A prerendered route is skipped: there is no per-visitor request to read,
+ * and resolving one would bake one visitor's geo into a shared HTML file.
+ * Use `<ConsentBannerDeferred />` when a cached page still needs live geo.
+ *
+ * So are the integration's own init and manifest routes, and anything
+ * listed in `middleware.skip` — those run `next()` with `Astro.locals.c15t`
+ * left unset.
+ *
+ * @param options - The resolved integration options.
+ * @param middlewareOptions - Test seams.
+ * @returns An Astro middleware handler.
+ */
+export declare const createConsentMiddleware: (options: C15tResolvedOptions, middlewareOptions?: ConsentMiddlewareOptions) => MiddlewareHandler;

package/dist-types/middleware.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Astro middleware entrypoint for `@c15t/astro`.
+ *
+ * The integration registers this with `order: 'pre'` so every route — pages,
+ * endpoints and server islands alike — sees `Astro.locals.c15t` already
+ * populated. See {@link createConsentMiddleware} for what it does.
+ */
+import type { C15tLocals } from './types';
+declare global {
+    namespace App {
+        interface Locals {
+            /** Consent context resolved by the c15t middleware. */
+            c15t: C15tLocals;
+        }
+    }
+}
+export declare const onRequest: import("astro").MiddlewareHandler;
+export default onRequest;
+export { createConsentMiddleware } from './middleware-handler';
+export type { ConsentMiddlewareOptions } from './middleware-handler';