@c15t/backend 2.1.0 → 2.2.0-canary-20260728085441

package/AGENTS.md

@@ -0,0 +1,20 @@
+# @c15t/backend
+
+> Self-hosted c15t backend docs for configuration, APIs, storage, policy packs, and operations.
+
+These docs ship inside the package so coding agents can read them offline. Open the topic file you need from the list below — paths are relative to this file.
+
+## Self Host
+
+Run the c15t backend, configure storage, and operate consent infrastructure.
+
+- [Configuration Reference](./docs/self-host/api/configuration.md): Complete reference for all c15t backend configuration options.
+- [API Endpoints](./docs/self-host/api/endpoints.md): Full reference for every c15t consent backend endpoint.
+- [Caching](./docs/self-host/guides/caching.md): Add a caching layer to your self-hosted c15t backend for production performance.
+- [Database Setup](./docs/self-host/guides/database-setup.md): Configure a database adapter for your self-hosted c15t backend.
+- [Edge Deployment](./docs/self-host/guides/edge-deployment.md): Run consent policy resolution at the edge for faster initial banner loads.
+- [Framework Integration](./docs/self-host/guides/framework-integration.md): Mount the c15t consent backend in any JavaScript framework or runtime.
+- [IAB TCF Support](./docs/self-host/guides/iab-tcf.md): Enable IAB Transparency and Consent Framework (TCF) support in your self-hosted backend.
+- [Observability](./docs/self-host/guides/observability.md): Add logging, metrics, and tracing to your self-hosted c15t backend.
+- [Policy Packs](./docs/self-host/guides/policy-packs.md): Configure regional policy packs on the backend and return deterministic runtime policy decisions from /init.
+- [Quickstart](./docs/self-host/quickstart.md): Self-host the c15t consent management backend in your own infrastructure.

package/README.md

@@ -9,25 +9,27 @@
 
 # @c15t/backend: Consent Management Backend
 
-[![GitHub stars](https://img.shields.io/github/stars/c15t/c15t?style=flat-square)](https://github.com/c15t/c15t)
-[![CI](https://img.shields.io/github/actions/workflow/status/c15t/c15t/ci.yml?style=flat-square)](https://github.com/c15t/c15t/actions/workflows/ci.yml)
-[![License](https://img.shields.io/badge/license-Apache%202.0-blue.svg?style=flat-square)](https://github.com/c15t/c15t/blob/main/LICENSE.md)
-[![Discord](https://img.shields.io/discord/1312171102268690493?style=flat-square)](https://c15t.link/discord)
-[![npm version](https://img.shields.io/npm/v/%40c15t%2Fbackend?style=flat-square)](https://www.npmjs.com/package/@c15t/backend)
-[![Top Language](https://img.shields.io/github/languages/top/c15t/c15t?style=flat-square)](https://github.com/c15t/c15t)
-[![Last Commit](https://img.shields.io/github/last-commit/c15t/c15t?style=flat-square)](https://github.com/c15t/c15t/commits/main)
-[![Open Issues](https://img.shields.io/github/issues/c15t/c15t?style=flat-square)](https://github.com/c15t/c15t/issues)
+<p>
+<a href="https://www.npmjs.com/package/@c15t/backend"><picture><source media="(prefers-color-scheme: dark)" srcset="https://shieldcn.dev/npm/%40c15t%2Fbackend.svg?variant=outline&mode=dark"><img src="https://shieldcn.dev/npm/%40c15t%2Fbackend.svg?variant=outline&mode=light" alt="Latest NPM Version"></picture></a>
+<a href="https://github.com/c15t/c15t"><picture><source media="(prefers-color-scheme: dark)" srcset="https://shieldcn.dev/github/c15t/c15t/stars.svg?variant=outline&mode=dark"><img src="https://shieldcn.dev/github/c15t/c15t/stars.svg?variant=outline&mode=light" alt="Stars"></picture></a>
+<a href="https://github.com/c15t/c15t/blob/main/LICENSE.md"><picture><source media="(prefers-color-scheme: dark)" srcset="https://shieldcn.dev/github/c15t/c15t/license.svg?variant=outline&mode=dark"><img src="https://shieldcn.dev/github/c15t/c15t/license.svg?variant=outline&mode=light" alt="License"></picture></a>
+<a href="https://c15t.link/discord"><picture><source media="(prefers-color-scheme: dark)" srcset="https://shieldcn.dev/discord/1312171102268690493.svg?variant=outline&mode=dark"><img src="https://shieldcn.dev/discord/1312171102268690493.svg?variant=outline&mode=light" alt="Discord"></picture></a>
+<a href="https://skills.sh/c15t/skills/c15t"><picture><source media="(prefers-color-scheme: dark)" srcset="https://shieldcn.dev/skills/c15t/skills/c15t.svg?variant=outline&mode=dark"><img src="https://shieldcn.dev/skills/c15t/skills/c15t.svg?variant=outline&mode=light" alt="Skills"></picture></a>
+<a href="https://inth.com?utm_source=npm&utm_medium=readme&utm_campaign=oss_readme&utm_content=%40c15t%2Fbackend"><picture><source media="(prefers-color-scheme: dark)" srcset="https://shieldcn.dev/badge/Made%20By-Inth-ffc803.svg?logo=data%3Aimage%2Fsvg%2Bxml%3Bbase64%2CPHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIGZpbGw9Im5vbmUiIHZpZXdCb3g9IjAgMCAzOTMgNDAwIj48cGF0aCBmaWxsPSIjMDAwIiBkPSJNMTgyLjY2MiAwdjM2Ljg5NWgtNTkuMDMxdjgyLjczM2g1OS4wMzF2MzYuODkzSDI3LjQ4MnYtMzYuODkzaDU5LjAzVjM2Ljg5NWgtNTkuMDNWMHpNMzIxLjk0MSA4OS44NVYwaDM1LjM1NXYxNTYuNTIxaC0yNS43MTNsLTg2LjEzNy05MC4zNjR2OTAuMzY0aC0zNS4zNTVWMGgyNi4zNTV6Ii8%2BPHBhdGggZmlsbD0iIzAwMCIgZmlsbC1ydWxlPSJldmVub2RkIiBkPSJNMzE4LjU3MSAxODUuNzE0aDc0LjI4NlY0MDBIMFYxODUuNzE0aDI3Mi44NTd2LTQ3LjE0M3ptLTI5MS4wOSAyOC45Njl2MzcuMTE4aDU4LjEzN3YxMTkuNjI4aDM2Ljg5NVYyNTEuODAxaDU4LjU4NHYtMzcuMTE4em0xODIuNjEuMjI0djE1Ni41MjJoMzYuODk0VjMxMy41OWg3My4zNDF2NTcuODM5aDM3LjExOFYyMTQuOTA3aC0zNy4xMTh2NjEuNzg4aC03My4zNDF2LTYxLjc4OHoiIGNsaXAtcnVsZT0iZXZlbm9kZCIvPjwvc3ZnPg%3D%3D&color=ffc803&labelTextColor=000000&valueColor=000000&mode=dark"><img src="https://shieldcn.dev/badge/Made%20By-Inth-ffc803.svg?logo=data%3Aimage%2Fsvg%2Bxml%3Bbase64%2CPHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIGZpbGw9Im5vbmUiIHZpZXdCb3g9IjAgMCAzOTMgNDAwIj48cGF0aCBmaWxsPSIjMDAwIiBkPSJNMTgyLjY2MiAwdjM2Ljg5NWgtNTkuMDMxdjgyLjczM2g1OS4wMzF2MzYuODkzSDI3LjQ4MnYtMzYuODkzaDU5LjAzVjM2Ljg5NWgtNTkuMDNWMHpNMzIxLjk0MSA4OS44NVYwaDM1LjM1NXYxNTYuNTIxaC0yNS43MTNsLTg2LjEzNy05MC4zNjR2OTAuMzY0aC0zNS4zNTVWMGgyNi4zNTV6Ii8%2BPHBhdGggZmlsbD0iIzAwMCIgZmlsbC1ydWxlPSJldmVub2RkIiBkPSJNMzE4LjU3MSAxODUuNzE0aDc0LjI4NlY0MDBIMFYxODUuNzE0aDI3Mi44NTd2LTQ3LjE0M3ptLTI5MS4wOSAyOC45Njl2MzcuMTE4aDU4LjEzN3YxMTkuNjI4aDM2Ljg5NVYyNTEuODAxaDU4LjU4NHYtMzcuMTE4em0xODIuNjEuMjI0djE1Ni41MjJoMzYuODk0VjMxMy41OWg3My4zNDF2NTcuODM5aDM3LjExOFYyMTQuOTA3aC0zNy4xMTh2NjEuNzg4aC03My4zNDF2LTYxLjc4OHoiIGNsaXAtcnVsZT0iZXZlbm9kZCIvPjwvc3ZnPg%3D%3D&color=ffc803&labelTextColor=000000&valueColor=000000&mode=light" alt="Made by Inth"></picture></a>
+</p>
 
-Consent policy engine and API for c15t. Powers the cookie banner, consent manager, and preference center. Webhooks, audit logs, storage adapters. Self-host or use inth.com
+Self-hostable consent management backend for c15t. Powers cookie banners, consent managers, preference centers, policy resolution, audit logs, and consent records.
 
 ## Key Features
 
-- Consent Management: Track and manage user consent preferences
-- Geo-Location: Identify user's location to show relevant consent preferences
+- Self-hosted CMP backend: Run c15t on your own infrastructure with your own database
+- Consent Management: Track and manage user consent preferences and consent records
+- Geo-Location: Identify a user's location to show relevant consent preferences
 - Server-Side Translation: Reduce banner bundle size by translating consent preferences on the server
 - Audit Logging: Comprehensive logging of all consent-related actions
 - Domain Management: Handle multiple domains and subdomains
 - Policy Management: Version and manage consent policies
+- IAB TCF 2.3 support: Configure GVL, CMP registration, and custom vendors
 
 ## Prerequisites
 
@@ -48,7 +50,18 @@ Configure your database adapter (supports Drizzle, Kysely, Prisma, TypeORM, and
 
 ## Documentation
 
-For further information, guides, and examples visit the [reference documentation](https://c15t.com/docs/self-host/v2).
+For further information, guides, and examples visit the [reference documentation](https://c15t.com/docs/self-host/quickstart).
+
+## Hosted or Self-Hosted
+
+Use [inth.com](https://inth.com) when you want a hosted c15t backend with no infrastructure to maintain. Use @c15t/backend when you need full control over hosting, database, CORS origins, policy configuration, audit logs, and deployment topology.
+
+## Related Packages
+
+- [c15t](https://www.npmjs.com/package/c15t): Headless JavaScript consent engine
+- [@c15t/react](https://www.npmjs.com/package/@c15t/react): React consent UI and headless hooks
+- [@c15t/nextjs](https://www.npmjs.com/package/@c15t/nextjs): Next.js App Router and Pages Router integration
+- [@c15t/node-sdk](https://www.npmjs.com/package/@c15t/node-sdk): Type-safe Node.js API client
 
 ## Support
 

package/dist/{583.js → 261.js}

@@ -2,7 +2,7 @@ import { inspectPolicies, resolvePolicyDecision, resolvePolicySync, validatePoli
 import { deepMergeTranslations, selectLanguage } from "@c15t/translations";
 import { baseTranslations } from "@c15t/translations/all";
 import { SignJWT, errors, jwtVerify } from "jose";
-import { createGVLResolver, getMetrics } from "./302.js";
+import { createGVLResolver, getMetrics } from "./744.js";
 const DEFAULT_PROFILE = 'default';
 const warnedKeys = new Set();
 function isSupportedBaseLanguage(lang) {

package/dist/{915.js → 49.js}

@@ -1,13 +1,12 @@
 import { hashSha256Hex } from "@c15t/schema/types";
 import base_x from "base-x";
-import { checkConsentOutputSchema, checkConsentQuerySchema, getSubjectInputSchema, getSubjectOutputSchema, initOutputSchema, legalDocumentCurrentInputSchema, legalDocumentCurrentOutputSchema, legalDocumentCurrentParamsSchema, listSubjectsOutputSchema, listSubjectsQuerySchema, patchSubjectOutputSchema, postSubjectInputSchema, postSubjectOutputSchema, statusOutputSchema, subjectIdSchema } from "@c15t/schema";
+import { checkConsentOutputSchema, checkConsentQuerySchema, getSubjectOutputSchema, getSubjectParamsSchema, getSubjectQuerySchema, initOutputSchema, isLegalDocumentType, legalDocumentCurrentInputSchema, legalDocumentCurrentOutputSchema, legalDocumentCurrentParamsSchema, listSubjectsOutputSchema, listSubjectsQuerySchema, patchSubjectInputSchema, patchSubjectOutputSchema, patchSubjectParamsSchema, postSubjectInputSchema, postSubjectOutputSchema, statusOutputSchema } from "@c15t/schema";
 import { Hono } from "hono";
 import { describeRoute, resolver, validator } from "hono-openapi";
 import { HTTPException } from "hono/http-exception";
 import { errors, jwtVerify } from "jose";
-import { extractErrorMessage, getMetrics, withDatabaseSpan } from "./302.js";
-import { getLocation, resolveInitPayload, policy_resolvePolicyDecision, verifyPolicySnapshotToken, getJurisdiction } from "./583.js";
-import * as __rspack_external_valibot from "valibot";
+import { version, getMetrics, withDatabaseSpan, extractErrorMessage } from "./744.js";
+import { getLocation, resolveInitPayload, policy_resolvePolicyDecision, verifyPolicySnapshotToken, getJurisdiction } from "./261.js";
 const prefixes = {
     auditLog: 'log',
     consent: 'cns',
@@ -18,11 +17,12 @@ const prefixes = {
     subject: 'sub'
 };
 const b58 = base_x('123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz');
-function generateId(model) {
-    const buf = crypto.getRandomValues(new Uint8Array(20));
-    const prefix = prefixes[model];
-    const EPOCH_TIMESTAMP = 1700000000000;
-    const t = Date.now() - EPOCH_TIMESTAMP;
+const generate_id_EPOCH_TIMESTAMP = 1700000000000;
+const ID_BYTE_LENGTH = 20;
+const TIMESTAMP_BYTE_LENGTH = 8;
+function writeTimestamp(buf, timestamp) {
+    const offset = timestamp - generate_id_EPOCH_TIMESTAMP;
+    const t = Number.isFinite(offset) ? Math.max(0, offset) : 0;
     const high = Math.floor(t / 0x100000000);
     const low = t >>> 0;
     buf[0] = high >>> 24 & 255;
@@ -33,7 +33,21 @@ function generateId(model) {
     buf[5] = low >>> 16 & 255;
     buf[6] = low >>> 8 & 255;
     buf[7] = 255 & low;
-    return `${prefix}_${b58.encode(buf)}`;
+}
+function generateId(model) {
+    const buf = crypto.getRandomValues(new Uint8Array(ID_BYTE_LENGTH));
+    writeTimestamp(buf, Date.now());
+    return `${prefixes[model]}_${b58.encode(buf)}`;
+}
+async function generateDeterministicId(model, timestamp, identity) {
+    const digest = await hashSha256Hex(JSON.stringify(identity));
+    const buf = new Uint8Array(ID_BYTE_LENGTH);
+    writeTimestamp(buf, timestamp);
+    for(let i = TIMESTAMP_BYTE_LENGTH; i < ID_BYTE_LENGTH; i++){
+        const offset = (i - TIMESTAMP_BYTE_LENGTH) * 2;
+        buf[i] = Number.parseInt(digest.slice(offset, offset + 2), 16);
+    }
+    return `${prefixes[model]}_${b58.encode(buf)}`;
 }
 async function generateUniqueId(db, model, ctx, options = {}) {
     const { maxRetries = 10, attempt = 0, baseDelay = 5 } = options;
@@ -709,7 +723,7 @@ const statusHandler = async (c)=>{
     try {
         await ctx.db.findFirst('subject', {});
         return c.json({
-            version: "2.1.0",
+            version: version,
             timestamp: new Date(),
             client: clientInfo
         });
@@ -813,6 +827,7 @@ const getSubjectHandler = async (c)=>{
         });
     }
 };
+const SUBJECT_ID_BATCH_SIZE = 500;
 const listSubjectsHandler = async (c)=>{
     const ctx = c.get('c15tContext');
     const logger = ctx.logger;
@@ -838,21 +853,42 @@ const listSubjectsHandler = async (c)=>{
         const subjects = await db.findMany('subject', {
             where: (b)=>b('externalId', '=', externalId)
         });
-        const subjectItems = await Promise.all(subjects.map(async (subject)=>{
-            const consents = await db.findMany('consent', {
-                where: (b)=>b('subjectId', '=', subject.id)
+        if (0 === subjects.length) {
+            logger.info('Found subjects for externalId', {
+                externalId,
+                count: 0
             });
-            const consentItems = await enrichConsents(consents, {
-                db,
-                registry
+            return c.json({
+                subjects: []
             });
-            return {
+        }
+        const subjectIds = subjects.map((subject)=>subject.id);
+        const findConsents = (batch)=>db.findMany('consent', {
+                where: (b)=>b('subjectId', 'in', batch)
+            });
+        const consents = await findConsents(subjectIds.slice(0, SUBJECT_ID_BATCH_SIZE));
+        for(let index = SUBJECT_ID_BATCH_SIZE; index < subjectIds.length; index += SUBJECT_ID_BATCH_SIZE){
+            const batch = await findConsents(subjectIds.slice(index, index + SUBJECT_ID_BATCH_SIZE));
+            consents.push(...batch);
+        }
+        const consentItems = await enrichConsents(consents, {
+            db,
+            registry
+        });
+        const consentsBySubjectId = new Map();
+        for (const [index, consent] of consents.entries()){
+            const consentItem = consentItems[index];
+            if (!consentItem) throw new Error('Consent enrichment returned an incomplete result');
+            const subjectConsents = consentsBySubjectId.get(consent.subjectId) ?? [];
+            subjectConsents.push(consentItem);
+            consentsBySubjectId.set(consent.subjectId, subjectConsents);
+        }
+        const subjectItems = subjects.map((subject)=>({
                 id: subject.id,
                 externalId: subject.externalId ?? externalId,
                 createdAt: subject.createdAt,
-                consents: consentItems
-            };
-        }));
+                consents: consentsBySubjectId.get(subject.id) ?? []
+            }));
         logger.info('Found subjects for externalId', {
             externalId,
             count: subjectItems.length
@@ -1041,9 +1077,6 @@ const patchSubjectHandler = async (c)=>{
 };
 const DEFAULT_ISSUER = 'c15t';
 const DEFAULT_AUDIENCE = 'c15t-legal-document-snapshot';
-function isLegalDocumentPolicyType(type) {
-    return 'privacy_policy' === type || 'terms_and_conditions' === type || 'dpa' === type;
-}
 function resolveSnapshotIssuer(options) {
     return options?.issuer?.trim() || DEFAULT_ISSUER;
 }
@@ -1056,7 +1089,7 @@ function getSigningKey(secret) {
     return new TextEncoder().encode(secret);
 }
 function isLegalDocumentSnapshotPayload(payload) {
-    return 'string' == typeof payload.iss && 'string' == typeof payload.aud && 'string' == typeof payload.sub && isLegalDocumentPolicyType(payload.type) && 'string' == typeof payload.version && 'string' == typeof payload.hash && 'string' == typeof payload.effectiveDate && 'number' == typeof payload.iat && 'number' == typeof payload.exp;
+    return 'string' == typeof payload.iss && 'string' == typeof payload.aud && 'string' == typeof payload.sub && isLegalDocumentType(payload.type) && 'string' == typeof payload.version && 'string' == typeof payload.hash && 'string' == typeof payload.effectiveDate && 'number' == typeof payload.iat && 'number' == typeof payload.exp;
 }
 async function verifyLegalDocumentSnapshotToken(params) {
     const { token, options, tenantId } = params;
@@ -1112,6 +1145,38 @@ async function verifyLegalDocumentSnapshotToken(params) {
         };
     }
 }
+function buildConsentId(input) {
+    return generateDeterministicId('consent', input.givenAt.getTime(), [
+        input.tenantId ?? null,
+        input.subjectId,
+        input.domainId,
+        input.policyId ?? null,
+        input.givenAt.toISOString()
+    ]);
+}
+function findConsentById(database, consentId) {
+    return database.findFirst('consent', {
+        where: (builder)=>builder('id', '=', consentId)
+    });
+}
+async function findExistingConsentSubmission(database, consentId, identity) {
+    const deterministicConsent = await findConsentById(database, consentId);
+    if (deterministicConsent) return deterministicConsent;
+    return database.findFirst('consent', {
+        where: (builder)=>builder.and(builder('subjectId', '=', identity.subjectId), builder('domainId', '=', identity.domainId), builder('policyId', '=', identity.policyId ?? null), builder('givenAt', '=', identity.givenAt), void 0 === identity.tenantId ? builder.isNull('tenantId') : builder('tenantId', '=', identity.tenantId))
+    });
+}
+function isUniqueConstraintViolationError(error) {
+    const code = 'object' == typeof error && null !== error && 'code' in error ? String(error.code) : void 0;
+    if ('23505' === code || 'ER_DUP_ENTRY' === code || '1062' === code || 'P2002' === code || code?.startsWith('SQLITE_CONSTRAINT')) return true;
+    const message = extractErrorMessage(error).toLowerCase();
+    return message.includes('unique constraint') || message.includes('unique violation') || message.includes('duplicate key') || message.includes('duplicate entry') || message.includes('unique conflict');
+}
+const MAX_FUTURE_CONSENT_TIME_DRIFT_MS = 300000;
+function clampConsentGivenAt(givenAt, now = Date.now()) {
+    if (givenAt.getTime() > now + MAX_FUTURE_CONSENT_TIME_DRIFT_MS) return new Date(now);
+    return givenAt;
+}
 function buildRuntimeDecisionDedupeKey(input) {
     return [
         input.tenantId ?? 'default',
@@ -1191,9 +1256,6 @@ function parseLanguageFromHeader(header) {
     if (!firstLanguage) return;
     return firstLanguage.split('-')[0]?.toLowerCase();
 }
-function isLegalDocumentType(type) {
-    return 'privacy_policy' === type || 'terms_and_conditions' === type || 'dpa' === type;
-}
 function resolveSnapshotFailureMode(ctx) {
     return ctx.policySnapshot?.onValidationFailure ?? 'reject';
 }
@@ -1275,7 +1337,13 @@ const postSubjectHandler = async (c)=>{
     const input = await c.req.json();
     const { type, subjectId, identityProvider, externalSubjectId, domain, metadata, givenAt: givenAtEpoch } = input;
     const preferences = 'preferences' in input ? input.preferences : void 0;
-    const givenAt = new Date(givenAtEpoch);
+    const requestedGivenAt = new Date(givenAtEpoch);
+    const givenAt = clampConsentGivenAt(requestedGivenAt);
+    const wasGivenAtClamped = givenAt.getTime() !== requestedGivenAt.getTime();
+    if (wasGivenAtClamped) logger.warn('Consent givenAt was too far in the future and was clamped to server time', {
+        requestedGivenAt: requestedGivenAt.toISOString(),
+        clampedGivenAt: givenAt.toISOString()
+    });
     const rawConsentAction = 'consentAction' in input ? input.consentAction : void 0;
     let derivedConsentAction;
     logger.debug('Request parameters', {
@@ -1510,6 +1578,9 @@ const postSubjectHandler = async (c)=>{
             ...metadata ?? {},
             ...shouldStoreLanguage && effectiveLanguage ? {
                 policyLanguage: effectiveLanguage
+            } : {},
+            ...wasGivenAtClamped ? {
+                clientGivenAt: requestedGivenAt.toISOString()
             } : {}
         };
         const effectiveJurisdiction = hasValidSnapshot && snapshotPayload ? snapshotPayload.jurisdiction : resolvedJurisdiction;
@@ -1528,9 +1599,15 @@ const postSubjectHandler = async (c)=>{
             language: effectiveLanguage,
             proofConfig
         });
-        const existingConsent = await db.findFirst('consent', {
-            where: (b)=>b.and(b('subjectId', '=', subject.id), b('domainId', '=', domainRecord.id), b('policyId', '=', policyId), b('givenAt', '=', givenAt))
-        });
+        const consentIdentity = {
+            tenantId: ctx.tenantId,
+            subjectId: subject.id,
+            domainId: domainRecord.id,
+            policyId,
+            givenAt: requestedGivenAt
+        };
+        const consentId = await buildConsentId(consentIdentity);
+        const existingConsent = await findExistingConsentSubmission(db, consentId, consentIdentity);
         if (existingConsent) {
             logger.debug('Duplicate consent detected, returning existing record', {
                 consentId: existingConsent.id
@@ -1547,103 +1624,132 @@ const postSubjectHandler = async (c)=>{
                 givenAt: existingConsent.givenAt
             });
         }
-        const result = await db.transaction(async (tx)=>{
-            logger.debug('Creating consent record', {
-                subjectId: subject.id,
-                domainId: domainRecord.id,
-                policyId,
-                purposeIds
-            });
-            const runtimePolicyDecision = decisionPayload ? await tx.findFirst('runtimePolicyDecision', {
-                where: (b)=>b('dedupeKey', '=', decisionPayload.dedupeKey)
-            }) ?? await tx.create('runtimePolicyDecision', {
-                id: `rpd_${crypto.randomUUID().replaceAll('-', '')}`,
-                tenantId: decisionPayload.tenantId,
-                policyId: decisionPayload.policyId,
-                fingerprint: decisionPayload.fingerprint,
-                matchedBy: decisionPayload.matchedBy,
-                countryCode: decisionPayload.countryCode,
-                regionCode: decisionPayload.regionCode,
-                jurisdiction: decisionPayload.jurisdiction,
-                language: decisionPayload.language,
-                model: decisionPayload.model,
-                policyI18n: decisionPayload.policyI18n ? {
-                    json: decisionPayload.policyI18n
-                } : void 0,
-                uiMode: decisionPayload.uiMode,
-                bannerUi: decisionPayload.bannerUi ? {
-                    json: decisionPayload.bannerUi
-                } : void 0,
-                dialogUi: decisionPayload.dialogUi ? {
-                    json: decisionPayload.dialogUi
-                } : void 0,
-                categories: decisionPayload.categories ? {
-                    json: decisionPayload.categories
-                } : void 0,
-                preselectedCategories: decisionPayload.preselectedCategories ? {
-                    json: decisionPayload.preselectedCategories
-                } : void 0,
-                proofConfig: decisionPayload.proofConfig ? {
-                    json: decisionPayload.proofConfig
-                } : void 0,
-                dedupeKey: decisionPayload.dedupeKey
-            }).catch(async ()=>tx.findFirst('runtimePolicyDecision', {
+        const runConsentTransaction = ()=>db.transaction(async (tx)=>{
+                logger.debug('Creating consent record', {
+                    subjectId: subject.id,
+                    domainId: domainRecord.id,
+                    policyId,
+                    purposeIds
+                });
+                const runtimePolicyDecision = decisionPayload ? await tx.findFirst('runtimePolicyDecision', {
                     where: (b)=>b('dedupeKey', '=', decisionPayload.dedupeKey)
-                })) : void 0;
-            const consentRecord = await tx.create('consent', {
-                id: await utils_generateUniqueId(tx, 'consent', ctx),
-                subjectId: subject.id,
-                domainId: domainRecord.id,
-                policyId,
-                purposeIds: {
-                    json: purposeIds
-                },
-                metadata: Object.keys(metadataWithPolicy).length > 0 ? {
-                    json: metadataWithPolicy
-                } : void 0,
-                ipAddress: shouldStoreIp ? ctx.ipAddress : null,
-                userAgent: shouldStoreUserAgent ? ctx.userAgent : null,
-                jurisdiction: effectiveJurisdiction,
-                jurisdictionModel: effectiveModel,
-                tcString: input.tcString,
-                uiSource: input.uiSource,
-                consentAction: derivedConsentAction,
-                givenAt,
-                validUntil,
-                runtimePolicyDecisionId: runtimePolicyDecision?.id,
-                runtimePolicySource: decisionPayload?.source
-            });
-            logger.debug('Created consent', {
-                consentRecord: consentRecord.id
-            });
-            if (!consentRecord) throw new HTTPException(500, {
-                message: 'Failed to create consent',
-                cause: {
-                    code: 'CONSENT_CREATION_FAILED',
+                }) ?? await tx.create('runtimePolicyDecision', {
+                    id: `rpd_${crypto.randomUUID().replaceAll('-', '')}`,
+                    tenantId: decisionPayload.tenantId,
+                    policyId: decisionPayload.policyId,
+                    fingerprint: decisionPayload.fingerprint,
+                    matchedBy: decisionPayload.matchedBy,
+                    countryCode: decisionPayload.countryCode,
+                    regionCode: decisionPayload.regionCode,
+                    jurisdiction: decisionPayload.jurisdiction,
+                    language: decisionPayload.language,
+                    model: decisionPayload.model,
+                    policyI18n: decisionPayload.policyI18n ? {
+                        json: decisionPayload.policyI18n
+                    } : void 0,
+                    uiMode: decisionPayload.uiMode,
+                    bannerUi: decisionPayload.bannerUi ? {
+                        json: decisionPayload.bannerUi
+                    } : void 0,
+                    dialogUi: decisionPayload.dialogUi ? {
+                        json: decisionPayload.dialogUi
+                    } : void 0,
+                    categories: decisionPayload.categories ? {
+                        json: decisionPayload.categories
+                    } : void 0,
+                    preselectedCategories: decisionPayload.preselectedCategories ? {
+                        json: decisionPayload.preselectedCategories
+                    } : void 0,
+                    proofConfig: decisionPayload.proofConfig ? {
+                        json: decisionPayload.proofConfig
+                    } : void 0,
+                    dedupeKey: decisionPayload.dedupeKey
+                }) : void 0;
+                const consentRecord = await tx.create('consent', {
+                    id: consentId,
                     subjectId: subject.id,
-                    domain
-                }
+                    domainId: domainRecord.id,
+                    policyId,
+                    purposeIds: {
+                        json: purposeIds
+                    },
+                    metadata: Object.keys(metadataWithPolicy).length > 0 ? {
+                        json: metadataWithPolicy
+                    } : void 0,
+                    ipAddress: shouldStoreIp ? ctx.ipAddress : null,
+                    userAgent: shouldStoreUserAgent ? ctx.userAgent : null,
+                    jurisdiction: effectiveJurisdiction,
+                    jurisdictionModel: effectiveModel,
+                    tcString: input.tcString,
+                    uiSource: input.uiSource,
+                    consentAction: derivedConsentAction,
+                    givenAt,
+                    validUntil,
+                    runtimePolicyDecisionId: runtimePolicyDecision?.id,
+                    runtimePolicySource: decisionPayload?.source
+                });
+                if (!consentRecord) throw new HTTPException(500, {
+                    message: 'Failed to create consent',
+                    cause: {
+                        code: 'CONSENT_CREATION_FAILED',
+                        subjectId: subject.id,
+                        domain
+                    }
+                });
+                logger.debug('Created consent', {
+                    consentRecord: consentRecord.id
+                });
+                return {
+                    consent: consentRecord,
+                    created: true
+                };
             });
-            return {
-                consent: consentRecord
-            };
+        const maxTransactionAttempts = 3;
+        let result;
+        for(let attempt = 1; attempt <= maxTransactionAttempts; attempt++)try {
+            result = await runConsentTransaction();
+            break;
+        } catch (error) {
+            if (!isUniqueConstraintViolationError(error)) throw error;
+            const concurrentConsent = await findConsentById(db, consentId);
+            if (concurrentConsent) {
+                logger.debug('Consent insert conflicted, returning existing record', {
+                    consentId: concurrentConsent.id
+                });
+                result = {
+                    consent: concurrentConsent,
+                    created: false
+                };
+                break;
+            }
+            if (attempt === maxTransactionAttempts) throw error;
+        }
+        if (!result) throw new HTTPException(500, {
+            message: 'Failed to create consent',
+            cause: {
+                code: 'CONSENT_CREATION_FAILED',
+                subjectId: subject.id,
+                domain
+            }
         });
-        const metrics = getMetrics();
-        if (metrics) {
-            const jurisdiction = effectiveJurisdiction;
-            metrics.recordConsentCreated({
-                type,
-                jurisdiction
-            });
-            const hasAccepted = preferences && Object.values(preferences).some(Boolean);
-            if (hasAccepted) metrics.recordConsentAccepted({
-                type,
-                jurisdiction
-            });
-            else metrics.recordConsentRejected({
-                type,
-                jurisdiction
-            });
+        if (result.created) {
+            const metrics = getMetrics();
+            if (metrics) {
+                const jurisdiction = effectiveJurisdiction;
+                metrics.recordConsentCreated({
+                    type,
+                    jurisdiction
+                });
+                const hasAccepted = preferences && Object.values(preferences).some(Boolean);
+                if (hasAccepted) metrics.recordConsentAccepted({
+                    type,
+                    jurisdiction
+                });
+                else metrics.recordConsentRejected({
+                    type,
+                    jurisdiction
+                });
+            }
         }
         return c.json({
             subjectId: subject.id,
@@ -1698,10 +1804,10 @@ const createSubjectRoutes = ()=>{
                 description: 'Subject not found for the given ID'
             }
         }
-    }), validator('param', getSubjectInputSchema), getSubjectHandler);
+    }), validator('param', getSubjectParamsSchema), validator('query', getSubjectQuerySchema), getSubjectHandler);
     app.post('/', describeRoute({
         summary: 'Record consent for a subject',
-        description: "Creates a new consent record (append-only). Creates the subject if it does not exist.\n\n**Request body by `type`:**\n- `cookie_banner` – Requires `preferences` object\n- `privacy_policy`, `dpa`, `terms_and_conditions` – Prefer a signed `documentSnapshotToken`; otherwise use a release `policyHash`, with `policyId` kept only for compatibility\n- `marketing_communications`, `age_verification`, `other` – Optional `preferences`",
+        description: "Creates a new consent record (append-only). Creates the subject if it does not exist.\n\n**Request body by `type`:**\n- `cookie_banner` – Requires `preferences` object\n- `privacy_policy`, `dpa`, `terms_and_conditions`, and suffixed legal-document variants such as `terms_and_conditions_b2b` – Prefer a signed `documentSnapshotToken`; otherwise use a release `policyHash`, with `policyId` kept only for compatibility\n- `marketing_communications`, `age_verification`, `other` – Optional `preferences`",
         tags: [
             'Subject',
             'Consent'
@@ -1739,12 +1845,7 @@ const createSubjectRoutes = ()=>{
                 description: 'Subject not found for the given ID'
             }
         }
-    }), validator('param', __rspack_external_valibot.object({
-        id: subjectIdSchema
-    })), validator('json', __rspack_external_valibot.object({
-        externalId: __rspack_external_valibot.string(),
-        identityProvider: __rspack_external_valibot.optional(__rspack_external_valibot.string())
-    })), patchSubjectHandler);
+    }), validator('param', patchSubjectParamsSchema), validator('json', patchSubjectInputSchema), patchSubjectHandler);
     app.get('/', describeRoute({
         summary: 'List subjects by external ID (API key required)',
         description: 'Returns all subjects linked to the given external ID. Requires Bearer token (API key). Use for server-side consent lookups.',

package/dist/{302.js → 744.js}

@@ -1,4 +1,5 @@
 import { SpanKind, SpanStatusCode as api_SpanStatusCode, context, metrics, trace } from "@opentelemetry/api";
+const version = '2.2.0-canary-20260728085441';
 function extractErrorMessage(error) {
     if (error instanceof AggregateError && error.errors?.length > 0) {
         const inner = error.errors.map((e)=>e instanceof Error ? e.message : String(e)).join('; ');
@@ -13,7 +14,7 @@ function createTelemetryOptions(appName = 'c15t', telemetryConfig, tenantId) {
     const defaultAttributes = {
         ...telemetryConfig?.defaultAttributes || {},
         'service.name': String(appName),
-        'service.version': "2.1.0"
+        'service.version': version
     };
     if (tenantId) defaultAttributes['tenant.id'] = tenantId;
     const config = {
@@ -315,7 +316,6 @@ function getMetrics(options) {
     metricsInstance = createMetrics(getMeter(options));
     return metricsInstance;
 }
-const GVL_TTL_MS = 259200000;
 const memory_memoryCache = new Map();
 function createMemoryCacheAdapter() {
     return {
@@ -368,6 +368,7 @@ function createCacheKey(appName, namespace, ...parts) {
     ];
     return allParts.join(':');
 }
+const GVL_TTL_MS = 259200000;
 const GVL_ENDPOINT = 'https://gvl.inth.app';
 const inflightRequests = new Map();
 async function fetchGVLWithLanguage(language, vendorIds, endpoint = GVL_ENDPOINT) {
@@ -469,4 +470,4 @@ function createGVLResolver(options) {
         }
     };
 }
-export { GVL_TTL_MS, clearMemoryCache, createCacheKey, createGVLCacheKey, createGVLResolver, createMemoryCacheAdapter, createRequestSpan, createTelemetryOptions, extractErrorMessage, getMemoryCacheSize, getMetrics, getTraceContext, handleSpanError, isTelemetryEnabled, withDatabaseSpan, withSpanContext };
+export { GVL_TTL_MS, clearMemoryCache, createCacheKey, createGVLCacheKey, createGVLResolver, createMemoryCacheAdapter, createRequestSpan, createTelemetryOptions, extractErrorMessage, getMemoryCacheSize, getMetrics, getTraceContext, handleSpanError, isTelemetryEnabled, version, withDatabaseSpan, withSpanContext };