@c15t/astro 3.0.0-alpha.1 → 3.0.0-alpha.2

package/AGENTS.md

@@ -48,12 +48,14 @@ These docs describe v3. Start with Inth hosted setup, identify the framework, ro
 - [Clear on revocation](./docs/integrations/clear-on-revocation.md): Remove configured first-party cookies and Web Storage keys when their consent category is denied.
 - [Clearbit](./docs/integrations/clearbit.md): Configure Clearbit with c15t v3, understand marketing permission and verify loading and revocation.
 - [Cloudflare Web Analytics](./docs/integrations/cloudflare-web-analytics.md): Configure Cloudflare Web Analytics with c15t v3, understand measurement permission and verify loading and revocation.
+- [Cloudflare Zaraz](./docs/integrations/cloudflare-zaraz.md): Synchronize c15t permissions with Zaraz purposes while Cloudflare manages your tools.
 - [Crisp](./docs/integrations/crisp.md): Configure Crisp with c15t v3, understand functionality permission and verify loading and revocation.
 - [Databuddy](./docs/integrations/databuddy.md): Configure Databuddy's initial and updated consent state with c15t v3.
 - [Fathom Analytics](./docs/integrations/fathom-analytics.md): Configure Fathom Analytics with c15t v3, understand measurement permission and verify loading and revocation.
 - [Google Maps](./docs/integrations/google-maps.md): Prevent a map iframe from mounting before the required permission.
 - [Google Tag](./docs/integrations/google-tag.md): Configure gtag with c15t Consent Mode signals and understand its loading behavior.
 - [Google Tag Manager](./docs/integrations/google-tag-manager.md): Load GTM with c15t consent signals and verify the tags inside your container.
+- [Granular consent](./docs/integrations/granular-consent.md): Let visitors grant a category and still turn one vendor off, without adopting IAB TCF.
 - [Heap](./docs/integrations/heap.md): Configure Heap with c15t v3, understand measurement permission and verify loading and revocation.
 - [Hightouch](./docs/integrations/hightouch.md): Configure Hightouch with c15t v3, understand measurement permission and verify loading and revocation.
 - [Hotjar](./docs/integrations/hotjar.md): Configure Hotjar with c15t v3, understand measurement permission and verify loading and revocation.

package/dist/api/handlers.js

@@ -1,7 +1,7 @@
 import { serveGvlReference } from "@c15t/core";
 import { MANIFEST_PASSTHROUGH_HEADERS, fetchCachedGvl, fetchCachedManifest, getManifestAge } from "@c15t/core/server";
 import { extractConsentRequestInputs } from "@c15t/schema/types";
-import { loadConsentManifest, resolveManifestInit, resolveManifestSourceFrom } from "./manifest-init.js";
+import { loadConsentManifest, resolveManifestInit, resolveManifestSourceFrom, resolveSessionReportURL } from "./manifest-init.js";
 const INIT_CACHE_CONTROL = 'private, no-store';
 const MANIFEST_ROUTE_SUFFIX = '/manifest';
 const handlers_waitUntilFromLocals = function(revalidation, locals) {
@@ -42,7 +42,14 @@ const handlers_createConsentRouteHandlers = function(handlerOptions) {
             inputs: extractConsentRequestInputs(request.headers, {
                 language: handlerOptions.options.i18n?.locale
             }),
-            manifest
+            manifest,
+            report: {
+                backendURL: resolveSessionReportURL(handlerOptions.options),
+                headers: request.headers,
+                method: request.method,
+                source: 'route',
+                waitUntil: handlers_bindBackgroundRevalidate(handlerOptions, lifetime)
+            }
         });
         return Response.json(payload, {
             headers: {

package/dist/api/index.js

@@ -1,3 +1,3 @@
 export { createConsentRouteHandlers, resolveManifestSourceURL, waitUntilFromLocals } from "./handlers.js";
-export { loadConsentManifest, resolveManifestInit, resolveManifestSourceFrom } from "./manifest-init.js";
+export { loadConsentManifest, resolveManifestInit, resolveManifestSourceFrom, resolveSessionReportURL } from "./manifest-init.js";
 export { MANIFEST_DEDUPE_TTL_SECONDS, MANIFEST_PASSTHROUGH_HEADERS, clearManifestCache, createManifestRequestURL, fetchCachedManifest, getManifestSMaxAge, getManifestStaleWhileRevalidate } from "@c15t/core/server";

package/dist/api/manifest-init.js

@@ -1,5 +1,5 @@
 import { deferInitGvlToRoute } from "@c15t/core";
-import { fetchCachedManifest } from "@c15t/core/server";
+import { fetchCachedManifest, reportConsentSession, resolveSessionReportBackendURL } from "@c15t/core/server";
 import { consentInputsToOverrides, resolveBackendURL, resolveInitFromManifest } from "@c15t/schema/types";
 import { baseTranslations } from "@c15t/translations/all";
 const MANIFEST_ROUTE_SUFFIX = '/manifest';
@@ -67,6 +67,13 @@ const manifest_init_defaultFetchGvl = async function(input) {
     if (!response.ok) throw new Error(`@c15t/astro: GVL responded ${response.status} ${response.statusText}`);
     return await response.json();
 };
+const manifest_init_resolveSessionReportURL = function(options) {
+    const { mode } = options;
+    if ('manifest' !== mode.type || false === mode.reportSessions) return;
+    return resolveSessionReportBackendURL({
+        backendURL: mode.backendURL ?? manifest_init_getEnv('C15T_BACKEND_URL') ?? manifest_init_getEnv('PUBLIC_C15T_BACKEND_URL')
+    });
+};
 const manifest_init_resolveManifestInit = async function(input) {
     const { inputs, manifest } = input;
     const payload = resolveInitFromManifest(manifest, {
@@ -90,6 +97,18 @@ const manifest_init_resolveManifestInit = async function(input) {
             payload.gvl = null;
         }
     }
+    if (input.report?.backendURL) reportConsentSession({
+        adapter: '@c15t/astro',
+        backendURL: input.report.backendURL,
+        fetch: input.fetch,
+        headers: input.report.headers,
+        init: payload,
+        inputs,
+        manifest,
+        method: input.report.method,
+        source: input.report.source,
+        waitUntil: input.report.waitUntil
+    });
     payload.resolvedOverrides = consentInputsToOverrides({
         country: inputs.country,
         language: inputs.language,
@@ -100,4 +119,4 @@ const manifest_init_resolveManifestInit = async function(input) {
     };
     return !input.gvlRoute || input.fetch || input.fetchGvl ? payload : deferInitGvlToRoute(payload, input.gvlRoute);
 };
-export { manifest_init_defaultFetchGvl as defaultFetchGvl, manifest_init_loadConsentManifest as loadConsentManifest, manifest_init_resolveManifestInit as resolveManifestInit, manifest_init_resolveManifestSourceFrom as resolveManifestSourceFrom };
+export { manifest_init_defaultFetchGvl as defaultFetchGvl, manifest_init_loadConsentManifest as loadConsentManifest, manifest_init_resolveManifestInit as resolveManifestInit, manifest_init_resolveManifestSourceFrom as resolveManifestSourceFrom, manifest_init_resolveSessionReportURL as resolveSessionReportURL };

package/dist/server.js

@@ -5,7 +5,7 @@ import { fetchCachedGvl } from "@c15t/core/server";
 import { readProducerPolicyContract } from "@c15t/core/transports";
 import { CONSENT_REQUEST_HEADER_NAMES, consentInputsToOverrides, extractConsentRequestInputs, resolveBackendURL } from "@c15t/schema/types";
 import { baseTranslations } from "@c15t/translations/all";
-import { loadConsentManifest, resolveManifestInit } from "./api/manifest-init.js";
+import { loadConsentManifest, resolveManifestInit, resolveSessionReportURL } from "./api/manifest-init.js";
 import { filterCookieHeader } from "./libs/cookies.js";
 const server_resolveTranslations = function(options, inputs) {
     const detect = options.i18n?.detectLanguage !== false;
@@ -164,7 +164,13 @@ const server_prefetchManifest = async function(input, mode) {
                     url: reference.url
                 }),
             inputs: input.inputs,
-            manifest
+            manifest,
+            report: {
+                backendURL: resolveSessionReportURL(input.options),
+                headers: input.headers,
+                source: 'render',
+                waitUntil: input.onBackgroundRevalidate
+            }
         });
         return mergeInitOutputIntoKernelConfig(input.base, !input.fetch && manifest.iab?.gvl ? deferInitGvlToRoute(payload, input.options.endpoints.initPath) : payload, server_forwardHeaders(input.headers, input.base.initialOverrides ?? {}, {
             allowCookie: absoluteTarget ? server_mayForwardCookie(absoluteTarget, input.url) : false,

package/dist-types/api/handlers.d.ts

@@ -15,8 +15,8 @@
  *   `private, no-store`.
  */
 import type { ManifestFetch } from '@c15t/core/server';
-import type { C15tResolvedOptions } from '../types';
-import type { FetchGvl } from './manifest-init';
+import type { C15tResolvedOptions } from '../types.js';
+import type { FetchGvl } from './manifest-init.js';
 /**
  * The per-request context a route or the middleware can pass so a
  * background refresh is registered with the platform. Astro adapters that

package/dist-types/api/index.d.ts

@@ -5,9 +5,9 @@
  * Next.js, Nuxt and SvelteKit layers so no two hosts can disagree about
  * cache lifetimes or revalidation.
  */
-export { createConsentRouteHandlers, resolveManifestSourceURL, waitUntilFromLocals, } from './handlers';
-export type { ConsentRouteHandlerOptions, RequestLifetime } from './handlers';
-export { loadConsentManifest, resolveManifestInit, resolveManifestSourceFrom, } from './manifest-init';
-export type { FetchGvl, RequestSource, ResolvedInitOutput, } from './manifest-init';
+export { createConsentRouteHandlers, resolveManifestSourceURL, waitUntilFromLocals, } from './handlers.js';
+export type { ConsentRouteHandlerOptions, RequestLifetime } from './handlers.js';
+export { loadConsentManifest, resolveManifestInit, resolveManifestSourceFrom, resolveSessionReportURL, } from './manifest-init.js';
+export type { FetchGvl, RequestSource, ResolvedInitOutput, SessionReportTarget, } from './manifest-init.js';
 export { clearManifestCache, createManifestRequestURL, fetchCachedManifest, getManifestSMaxAge, getManifestStaleWhileRevalidate, MANIFEST_DEDUPE_TTL_SECONDS, MANIFEST_PASSTHROUGH_HEADERS, } from '@c15t/core/server';
 export type { CachedManifestResponse, FetchCachedManifestOptions, ManifestFetch, ManifestSourceConfig, } from '@c15t/core/server';

package/dist-types/api/manifest-init.d.ts

@@ -1,6 +1,6 @@
 import type { ManifestFetch } from '@c15t/core/server';
-import type { ConsentManifest, ConsentManifestGVLReference, ConsentRequestHeaderInputs, GlobalVendorList, InitOutput } from '@c15t/schema/types';
-import type { C15tResolvedOptions } from '../types';
+import type { ConsentManifest, ConsentManifestGVLReference, ConsentRequestHeaderInputs, ConsentSessionSource, GlobalVendorList, InitOutput } from '@c15t/schema/types';
+import type { C15tResolvedOptions } from '../types.js';
 /** Fetches the Global Vendor List when the resolved policy is IAB. */
 export type FetchGvl = (input: {
     reference: ConsentManifestGVLReference;
@@ -56,6 +56,30 @@ export declare const defaultFetchGvl: FetchGvl;
 export type ResolvedInitOutput = InitOutput & {
     resolvedOverrides?: Record<string, unknown>;
 };
+/** How a resolution reports itself to the backend's `POST /sessions`. */
+export interface SessionReportTarget {
+    /** Where the resolution happened. */
+    source: ConsentSessionSource;
+    /** The visitor's request headers; only IP chain and user agent travel. */
+    headers: Headers;
+    /** Absolute backend URL, or `undefined` to send no report. */
+    backendURL: string | undefined;
+    /** The request's method, when there is one; only a `GET` is reported. */
+    method?: string;
+    /** Keeps the detached report alive on runtimes that need it. */
+    waitUntil?: (task: Promise<void>) => void;
+}
+/**
+ * Where a resolution reports sessions, when it can: an absolute backend,
+ * read as configured rather than resolved against the request. A relative
+ * backend resolved to this site's origin is its own injected route, not a
+ * backend, and means no report; nothing is inferred from a manifest URL.
+ * `undefined` when reporting is off or nothing absolute is set.
+ *
+ * @param options - The resolved integration options.
+ * @returns The backend base URL, or `undefined`.
+ */
+export declare const resolveSessionReportURL: (options: C15tResolvedOptions) => string | undefined;
 /**
  * Resolve one request's `/init` payload from an already-loaded manifest.
  *
@@ -70,4 +94,6 @@ export declare const resolveManifestInit: (input: {
     /** Same-origin init route that serves versioned public lists. */
     gvlRoute?: string;
     fetchGvl?: FetchGvl;
+    /** Session report to send once resolved. Absent means none. */
+    report?: SessionReportTarget;
 }) => Promise<ResolvedInitOutput>;

package/dist-types/client.d.ts

@@ -20,8 +20,8 @@
  */
 import type { ConsentSnapshot, ConsentState, KernelUser, Unsubscribe } from '@c15t/core';
 import type { ConsentRuntime } from '@c15t/core/runtime';
-import type { C15tClientOptionsExtension, C15tResolvedOptions } from './types';
-import type { ConsentDialogKind } from './ui/adapter';
+import type { C15tClientOptionsExtension, C15tResolvedOptions } from './types.js';
+import type { ConsentDialogKind } from './ui/adapter.js';
 /** Attribute the server-rendered banner puts on its action buttons. */
 export declare const ACTION_ATTRIBUTE = "data-c15t-action";
 /** Attribute selecting which dialog a `customize` action opens. */
@@ -145,8 +145,8 @@ export declare const openDialog: (kind?: ConsentDialogKind, tab?: "purposes" | "
  * open the preference centre.
  */
 export declare const preloadDialog: () => Promise<void>;
-export { activateGatedScripts } from './browser/inline-scripts';
+export { activateGatedScripts } from './browser/inline-scripts.js';
 export type { ConsentRuntime } from '@c15t/core/runtime';
-export type { ConsentDialogKind } from './ui/adapter';
-export { registerDialogAdapter, registerDialogSurface } from './ui/adapter';
-export type { ConsentDialogAdapter, ConsentDialogContext, ConsentDialogHandle, ConsentDialogSurfaceLoader, } from './ui/adapter';
+export type { ConsentDialogKind } from './ui/adapter.js';
+export { registerDialogAdapter, registerDialogSurface } from './ui/adapter.js';
+export type { ConsentDialogAdapter, ConsentDialogContext, ConsentDialogHandle, ConsentDialogSurfaceLoader, } from './ui/adapter.js';

package/dist-types/index.d.ts

@@ -19,14 +19,14 @@
  * });
  * ```
  */
-export { c15t, c15t as default, resolveOptions } from './integration';
-export { createConsentMiddleware } from './middleware-handler';
-export type { ConsentMiddlewareOptions } from './middleware-handler';
-export { hostedMode as hosted, manifestMode as manifest, offlineMode as offline, resolveTransportFactory, custom, } from './mode';
-export type { ManifestClientEndpoints } from './mode';
-export type { C15tAstroOptions, C15tClientOptionsExtension, C15tColorScheme, C15tEndpointOptions, C15tHostedDescriptor, C15tI18nOptions, C15tIABOptions, C15tLocals, C15tManifestDescriptor, C15tMiddlewareOptions, C15tModeDescriptor, C15tOfflineDescriptor, C15tResolvedOptions, C15tUIAdapterName, } from './types';
-export type { ConsentDialogAdapter, ConsentDialogContext, ConsentDialogHandle, ConsentDialogKind, ConsentDialogSurfaceLoader, } from './ui/adapter';
-export { registerDialogAdapter, registerDialogSurface } from './ui/adapter';
+export { c15t, c15t as default, resolveOptions } from './integration.js';
+export { createConsentMiddleware } from './middleware-handler.js';
+export type { ConsentMiddlewareOptions } from './middleware-handler.js';
+export { hostedMode as hosted, manifestMode as manifest, offlineMode as offline, resolveTransportFactory, custom, } from './mode.js';
+export type { ManifestClientEndpoints } from './mode.js';
+export type { C15tAstroOptions, C15tClientOptionsExtension, C15tColorScheme, C15tEndpointOptions, C15tHostedDescriptor, C15tI18nOptions, C15tIABOptions, C15tLocals, C15tManifestDescriptor, C15tMiddlewareOptions, C15tModeDescriptor, C15tOfflineDescriptor, C15tResolvedOptions, C15tUIAdapterName, } from './types.js';
+export type { ConsentDialogAdapter, ConsentDialogContext, ConsentDialogHandle, ConsentDialogKind, ConsentDialogSurfaceLoader, } from './ui/adapter.js';
+export { registerDialogAdapter, registerDialogSurface } from './ui/adapter.js';
 export type { ConsentRuntime, ConsentRuntimeOptions } from '@c15t/core/runtime';
 export type { AllConsentNames, ConsentSnapshot, ConsentState, KernelConfig, LegalLinks, PolicyRule, Script, StorageConfig, } from '@c15t/core';
 export { policyRulePresets } from '@c15t/core';

package/dist-types/integration.d.ts

@@ -14,7 +14,7 @@
  *    options to all of the above.
  */
 import type { AstroIntegration } from 'astro';
-import type { C15tAstroOptions, C15tResolvedOptions } from './types';
+import type { C15tAstroOptions, C15tResolvedOptions } from './types.js';
 /**
  * Normalize user options into the serializable shape every consumer reads.
  *

package/dist-types/middleware-handler.d.ts

@@ -6,7 +6,7 @@
  * tests and advanced setups bind it to their own.
  */
 import type { MiddlewareHandler } from 'astro';
-import type { C15tResolvedOptions } from './types';
+import type { C15tResolvedOptions } from './types.js';
 /** Options for {@link createConsentMiddleware}. */
 export interface ConsentMiddlewareOptions {
     /** Override fetch, mainly for tests. */

package/dist-types/middleware.d.ts

@@ -5,7 +5,7 @@
  * endpoints and server islands alike — sees `Astro.locals.c15t` already
  * populated. See {@link createConsentMiddleware} for what it does.
  */
-import type { C15tLocals } from './types';
+import type { C15tLocals } from './types.js';
 declare global {
     namespace App {
         interface Locals {
@@ -16,5 +16,5 @@ declare global {
 }
 export declare const onRequest: import("astro").MiddlewareHandler;
 export default onRequest;
-export { createConsentMiddleware } from './middleware-handler';
-export type { ConsentMiddlewareOptions } from './middleware-handler';
+export { createConsentMiddleware } from './middleware-handler.js';
+export type { ConsentMiddlewareOptions } from './middleware-handler.js';

package/dist-types/mode.d.ts

@@ -8,7 +8,7 @@
  */
 import { custom } from '@c15t/core';
 import type { ProviderTransportFactory } from '@c15t/core';
-import type { C15tHostedDescriptor, C15tManifestDescriptor, C15tModeDescriptor, C15tOfflineDescriptor } from './types';
+import type { C15tHostedDescriptor, C15tManifestDescriptor, C15tModeDescriptor, C15tOfflineDescriptor } from './types.js';
 /**
  * Talk to a c15t backend over HTTP.
  *

package/dist-types/server.d.ts

@@ -1,6 +1,6 @@
 import type { ConsentSnapshot, KernelConfig, KernelTranslations } from '@c15t/core';
 import type { ConsentRequestHeaderInputs } from '@c15t/schema/types';
-import type { C15tColorScheme, C15tLocals, C15tResolvedOptions } from './types';
+import type { C15tColorScheme, C15tLocals, C15tResolvedOptions } from './types.js';
 /** Input for {@link resolveConsentContext}. */
 export interface ResolveConsentContextOptions {
     /** The incoming request headers. */

package/dist-types/types.d.ts

@@ -42,6 +42,15 @@ export interface C15tManifestDescriptor {
     backendURL?: string;
     /** Inline manifest. Takes precedence over `manifestURL`. */
     manifest?: ConsentManifest;
+    /**
+     * Report each init the server resolves, in the middleware and the init
+     * route, to the backend's `POST /sessions`, server-to-server and
+     * detached from the response, so the backend still counts visitors it
+     * never served `/init` to. Set `false` to send none.
+     *
+     * @default true
+     */
+    reportSessions?: boolean;
 }
 /**
  * Which framework renders the on-demand dialog islands.

package/dist-types/ui/adapter.d.ts

@@ -15,7 +15,7 @@
  * that is the only place a framework specifier appears.
  */
 import type { ConsentRuntime } from '@c15t/core/runtime';
-import type { C15tResolvedOptions, C15tUIAdapterName } from '../types';
+import type { C15tResolvedOptions, C15tUIAdapterName } from '../types.js';
 /** Which dialog a caller asked for. */
 export type ConsentDialogKind = 'preferences' | 'iab';
 /** Context handed to an adapter when a dialog opens. */

package/dist-types/ui/provider-props.d.ts

@@ -7,7 +7,7 @@
  * and theme tokens the banner and dialog both read.
  */
 import type { ConsentRuntime } from '@c15t/core/runtime';
-import type { C15tResolvedOptions } from '../types';
+import type { C15tResolvedOptions } from '../types.js';
 /**
  * The slice of the integration options a dialog island renders with.
  *

package/dist-types/ui/react.d.ts

@@ -14,6 +14,6 @@
  * here: a `.tsx` file can only be compiled by the consuming app's build,
  * and only that build knows whether `@astrojs/react` is present.
  */
-import type { ConsentDialogAdapter } from './adapter';
+import type { ConsentDialogAdapter } from './adapter.js';
 /** The React 18/19 dialog surface implementation. */
 export declare const reactDialogAdapter: ConsentDialogAdapter;

package/dist-types/ui/svelte.d.ts

@@ -16,6 +16,6 @@
  * its `runtime` prop, so there is one kernel per page no matter how many
  * islands, scripts or frameworks read it.
  */
-import type { ConsentDialogAdapter } from './adapter';
+import type { ConsentDialogAdapter } from './adapter.js';
 /** The Svelte 5 dialog surface implementation. */
 export declare const svelteDialogAdapter: ConsentDialogAdapter;

package/dist-types/ui/vue.d.ts

@@ -14,6 +14,6 @@
  * here: a `.vue` file can only be compiled by the consuming app's build,
  * and only that build knows whether `@astrojs/vue` is present.
  */
-import type { ConsentDialogAdapter } from './adapter';
+import type { ConsentDialogAdapter } from './adapter.js';
 /** The Vue 3 dialog surface implementation. */
 export declare const vueDialogAdapter: ConsentDialogAdapter;

package/docs/README.md

@@ -48,12 +48,14 @@ These docs describe v3. Start with Inth hosted setup, identify the framework, ro
 - [Clear on revocation](./integrations/clear-on-revocation.md): Remove configured first-party cookies and Web Storage keys when their consent category is denied.
 - [Clearbit](./integrations/clearbit.md): Configure Clearbit with c15t v3, understand marketing permission and verify loading and revocation.
 - [Cloudflare Web Analytics](./integrations/cloudflare-web-analytics.md): Configure Cloudflare Web Analytics with c15t v3, understand measurement permission and verify loading and revocation.
+- [Cloudflare Zaraz](./integrations/cloudflare-zaraz.md): Synchronize c15t permissions with Zaraz purposes while Cloudflare manages your tools.
 - [Crisp](./integrations/crisp.md): Configure Crisp with c15t v3, understand functionality permission and verify loading and revocation.
 - [Databuddy](./integrations/databuddy.md): Configure Databuddy's initial and updated consent state with c15t v3.
 - [Fathom Analytics](./integrations/fathom-analytics.md): Configure Fathom Analytics with c15t v3, understand measurement permission and verify loading and revocation.
 - [Google Maps](./integrations/google-maps.md): Prevent a map iframe from mounting before the required permission.
 - [Google Tag](./integrations/google-tag.md): Configure gtag with c15t Consent Mode signals and understand its loading behavior.
 - [Google Tag Manager](./integrations/google-tag-manager.md): Load GTM with c15t consent signals and verify the tags inside your container.
+- [Granular consent](./integrations/granular-consent.md): Let visitors grant a category and still turn one vendor off, without adopting IAB TCF.
 - [Heap](./integrations/heap.md): Configure Heap with c15t v3, understand measurement permission and verify loading and revocation.
 - [Hightouch](./integrations/hightouch.md): Configure Hightouch with c15t v3, understand measurement permission and verify loading and revocation.
 - [Hotjar](./integrations/hotjar.md): Configure Hotjar with c15t v3, understand measurement permission and verify loading and revocation.

package/docs/frameworks/astro/quickstart.md

@@ -119,7 +119,11 @@ stale and refresh it in the background. On adapters that expose
 `locals.runtime.ctx.waitUntil` (Cloudflare) the refresh is handed to it so it
 is not cut short when the response is sent; nothing is needed from you. For
 another lifetime API, pass `onBackgroundRevalidate` to
-`createConsentRouteHandlers` or `resolveConsentContext`.
+`createConsentRouteHandlers` or `resolveConsentContext`. Session reports go
+through the same hook: after each resolution, in the middleware and the init
+route, the server posts a small report to the backend's `POST /sessions` so
+the backend still counts visitors it never served `/init` to. Set
+`reportSessions: false` on `manifest()` to send none.
 
 The framework integration must appear before `c15t()`. For React or Vue, install
 that framework's Astro integration and c15t adapter, register the matching

package/docs/guides/deployment-modes.md

@@ -30,6 +30,18 @@ in your application while consent writes still go to Inth. Regular backend
 browser setup. See [data fetching and transports](./data-fetching.md) for
 the comparison, including custom transports and offline mode.
 
+Manifest resolution removes the per-visitor `/init` request, and with it the
+backend's only count of visitors. The server adapters replace it with a session
+report: after each resolution, on a server-rendered page or the same-origin
+init route, the host posts a small report to the backend's `POST /sessions`,
+server-to-server and detached from the response. The browser makes no request
+and the report stores no identity; the visitor's IP and user agent travel as
+forwarded headers under the backend's usual IP handling. Each report is one
+resolution; a page view can produce a `render` and a `route` report, and the
+consuming side groups them into sessions by address and user agent within a
+window. Static output resolves in the browser and sends none. Set `reportSessions: false` on an adapter to turn
+it off.
+
 ## Match initialization to your application output
 
 | Application output | Initial state             | Required setup                                              |

package/docs/integrations/building-integrations.md

@@ -31,6 +31,11 @@ Replace the example URL and implement the vendor's initialization. This is a
 loader template, not a functioning analytics SDK. The script stays blocked
 while measurement permission is denied.
 
+Add `vendor: 'example-analytics'` and declare the vendor in the runtime's
+`vendors` option or in the backend manifest when visitors should be able to
+turn this vendor off inside a granted category. See
+[granular consent](./granular-consent.md).
+
 ## Define revocation deliberately
 
 `onConsentChange` receives current permission information. Use it to update the