@c15t/react 3.0.0-alpha.1 → 3.0.0-alpha.11

package/docs/frameworks/react/components/{frame.md → consent-gate.md}

@@ -1,14 +1,14 @@
 ---
-title: Frame
-description: Gate a YouTube or map iframe behind consent with Frame in React,
-  showing a placeholder that opens the preference center until the category is
-  allowed.
+title: ConsentGate
+description: Gate a YouTube or map iframe behind consent with ConsentGate in
+  React, showing a placeholder that opens the preference center until the
+  category is allowed.
 group: frameworks
 ---
 
 ## Gate an embed behind consent
 
-`Frame` mounts its children only while the effective permission for one
+`ConsentGate` mounts its children only while the effective permission for one
 consent category is granted, and shows a placeholder otherwise. Wrap any
 iframe or third-party widget that would set cookies or contact a vendor on
 load. Render it anywhere inside the `ConsentProvider` from your
@@ -16,30 +16,30 @@ load. Render it anywhere inside the `ConsentProvider` from your
 placeholder button opens.
 
 ```tsx title="src/product-video.tsx"
-import { Frame } from 'c15t/react';
+import { ConsentGate } from 'c15t/react';
 
 export function ProductVideo() {
-  return (
-    <Frame category="marketing" className="video-frame">
-      <iframe
-        src="https://www.youtube-nocookie.com/embed/dQw4w9WgXcQ"
-        title="Product tour"
-        loading="lazy"
-        allowFullScreen
-        style={{ width: '100%', aspectRatio: '16 / 9', border: 0 }}
-      />
-    </Frame>
-  );
+	return (
+		<ConsentGate category="marketing" className="video-frame">
+			<iframe
+				src="https://www.youtube-nocookie.com/embed/dQw4w9WgXcQ"
+				title="Product tour"
+				loading="lazy"
+				allowFullScreen
+				style={{ width: '100%', aspectRatio: '16 / 9', border: 0 }}
+			/>
+		</ConsentGate>
+	);
 }
 ```
 
 `marketing` must be in your policy scope. If you set a non-empty
 `options.consentCategories` list on `ConsentProvider`, include `marketing`
-there too so the preference center can display and save it. `Frame` does
+there too so the preference center can display and save it. `ConsentGate` does
 not add categories to that list.
 
 The placeholder names the category using its title from your translations. Set `className` or `style`
-on `Frame` to reserve the embed's space, so the page does not shift when the
+on `ConsentGate` to reserve the embed's space, so the page does not shift when the
 placeholder is replaced.
 
 ## Props
@@ -51,51 +51,54 @@ placeholder is replaced.
 | `placeholder` | `ReactNode`       | built-in placeholder | Replaces the built-in title and button while the category is not allowed. Falsy values such as `null`, `false`, `0` and an empty string use the built-in placeholder. Pass an empty fragment, `<></>`, to render no placeholder content. |
 
 Other `div` attributes such as `className`, `style` and `ref` apply to the
-wrapper element that stays in the page in both states. `FrameProps` also
+wrapper element that stays in the page in both states. `ConsentGateProps` also
 declares `noStyle` and `theme`, but the component does not apply them yet;
-style the wrapper with `className` and theme the placeholder through the
-provider `theme` option.
+style the wrapper with `className`, and style the built-in placeholder
+through its parts in the provider options.
 
 ## Behavior
 
-`Frame` renders a `div` wrapper. Inside it, when the effective permission for
+`ConsentGate` renders a `div` wrapper. Inside it, when the effective permission for
 `category` is granted, it renders the children; otherwise it renders the
 placeholder. Permission is the same value `useConsent(category)` returns,
 so it can be granted under an opt-out rule before the visitor records a
 choice, and a recorded grant can be overridden by a privacy signal.
 
 While effective permission is denied, the children are absent from the DOM,
-so an iframe or a third-party widget inside `Frame` sends no requests. When the visitor later revokes it, the
-children unmount and the embed disappears. `Frame` does not depend on the
+so an iframe or a third-party widget inside `ConsentGate` sends no requests. When the visitor later revokes it, the
+children unmount and the embed disappears. `ConsentGate` does not depend on the
 network blocker or the iframe blocker modules; use those for markup you
 cannot wrap in a component.
 
-The built-in placeholder shows the title `frame.title`, "Accept {category}
-consent to view this content.", with `{category}` replaced by
-`consentTypes.<category>.title`, and a button labelled `frame.actionButton`,
-"Enable {category} consent". The button opens the preference center; it
+The built-in placeholder shows the title `consentGate.title`,
+`Accept {category} consent to view this content.`, with `{category}`
+replaced by `consentTypes.<category>.title`, and a button labelled
+`consentGate.actionButton`, `Enable {category} consent`. The button opens the
+preference center; it
 does not grant the category by itself, because the visitor still has to
 save. Mount a `ConsentDialog` in the same provider so the button has
 something to open.
 
 Under a policy with `scopeMode: 'strict'`, a category outside the rule's
-scope cannot be granted. The built-in placeholder then shows `frame.policyBlocked`,
+scope cannot be granted. The built-in placeholder then shows `consentGate.policyBlocked`,
 "This content is unavailable under your region's consent policy.", without
 the button, and a stored grant for that category stays blocked.
 
 When the provider starts from a snapshot prefetched on the server, the
-server renders the children or placeholder according to effective permission.
-A grant in the request cookie allows the embed only when policy and privacy
-signals permit it. Browser privacy signals detected during hydration can
+server renders the placeholder for a denied category. For a granted
+category it renders the empty wrapper, and the children mount once
+hydration completes, so an iframe loads once even when the page streams
+inside a `Suspense` boundary. A grant in the request cookie allows the
+embed only when policy and privacy signals permit it. Browser privacy signals detected during hydration can
 withdraw that permission. In a browser-only setup the
 provider has no permission until it resolves policy on the client, so
-`Frame` shows the placeholder first and swaps in the embed after resolution
+`ConsentGate` shows the placeholder first and swaps in the embed after resolution
 when the category is already granted.
 
-`Frame` is one component on this page; the per-vendor embed guides for
+`ConsentGate` is one component on this page; the per-vendor embed guides for
 [YouTube](../../../integrations/youtube.md) and
 [Google Maps](../../../integrations/google-maps.md) show a complete embed
-configuration with sizing, titles and the same `Frame` usage across
+configuration with sizing, titles and the same `ConsentGate` usage across
 frameworks.
 
 To read the same permission in your own components, use `useConsent` from
@@ -104,34 +107,50 @@ also import from there.
 
 ## Composition
 
-The placeholder parts are available as `Frame.Root`, `Frame.Title` and
-`Frame.Button` for a custom placeholder that keeps the built-in copy and
-behavior. `Frame.Title` and `Frame.Button` accept `category` and fill in the
+The placeholder parts are available as `ConsentGate.Root`, `ConsentGate.Title` and
+`ConsentGate.Button` for a custom placeholder that keeps the built-in copy and
+behavior. `ConsentGate.Title` and `ConsentGate.Button` accept `category` and fill in the
 translated text; pass children to either to replace it.
 
 ```tsx
-<Frame
+<ConsentGate
   category="marketing"
   placeholder={
-    <Frame.Root>
-      <Frame.Title category="marketing" />
+    <ConsentGate.Root>
+      <ConsentGate.Title category="marketing" />
       <p>The video is also available on our channel.</p>
-      <Frame.Button category="marketing">Choose cookies</Frame.Button>
-    </Frame.Root>
+      <ConsentGate.Button category="marketing">Choose cookies</ConsentGate.Button>
+    </ConsentGate.Root>
   }
 >
   <iframe src="https://www.youtube-nocookie.com/embed/..." title="Product tour" />
-</Frame>
+</ConsentGate>
 ```
 
-The built-in placeholder carries `data-testid="frame-placeholder"` and its
-button `data-testid="frame-open-dialog"`.
+To restyle the built-in placeholder without replacing it, set its parts
+under `components['consent-gate']` in the provider options. `root` is the
+card, and `title` and `button` are its text and button. The `consentGate`, `consentGateTitle` and
+`consentGateButton` theme slots reach the same parts. The button part
+applies on top of `button.primary`.
+
+```tsx
+components: {
+  'consent-gate': {
+    root: { className: 'rounded-none' },
+    button: { className: 'font-semibold' },
+  },
+},
+```
+
+The built-in placeholder carries `data-testid="consent-gate-placeholder"`,
+its title `data-testid="consent-gate-title"` and its button
+`data-testid="consent-gate-button"`.
 
 ## Accessibility
 
 The placeholder is plain text and a `button`, so it is readable and
 operable without the embed. Give the iframe a descriptive `title`, and keep a
-transcript, address or link outside the `Frame` for visitors who decline
+transcript, address or link outside the `ConsentGate` for visitors who decline
 the category. A denied category may be fixed by policy, so opening the
 preference center does not guarantee that the visitor can grant it.
 
@@ -142,7 +161,9 @@ center and is not restricted by policy or privacy signals such as GPC.
 Load the page with the category denied. The placeholder text names the
 category and the network panel shows no request to the embed's host. With a
 prefetched snapshot, the server HTML contains the placeholder for a denied
-category or the embed for a granted category. Browser-only initialization
+category and neither placeholder nor embed for a granted category; the
+embed appears after hydration and the network panel shows one request for
+its document. Browser-only initialization
 shows the placeholder before policy resolves, then replaces it with the
 embed if the category is granted. After policy resolves, activate the
 placeholder button: the preference center opens. Turn the category on and

package/docs/frameworks/react/components/consent-provider.md

@@ -0,0 +1,143 @@
+---
+title: ConsentProvider
+description: Mount ConsentProvider in a React app and configure its backend,
+  scripts, storage, blocking and presentation options.
+group: frameworks
+---
+
+## Mount one provider
+
+`ConsentProvider` creates the consent runtime, loads the policy, stores the
+visitor's choice and loads consent-gated scripts. Render one provider at the
+root of your app and put the banner, dialog and a preferences link inside it.
+The [quickstart](../quickstart.md) does this in
+`src/consent.tsx`:
+
+```tsx title="src/consent.tsx"
+import { posthog } from '@c15t/integrations/posthog';
+import {
+	ConsentBanner,
+	ConsentDialog,
+	ConsentDialogLink,
+	ConsentProvider,
+	hosted,
+} from 'c15t/react';
+import type { ReactNode } from 'react';
+
+const options = {
+	// Asks VITE_C15T_BACKEND_URL for each visitor's policy.
+	mode: hosted(),
+	scripts: [
+		posthog({
+			id: 'phc_your_project_key',
+			initOptions: { cookieless_mode: 'never' },
+			loadMode: 'after-consent',
+		}),
+	],
+};
+
+export const Consent = ({ children }: { children: ReactNode }) => (
+	<ConsentProvider options={options}>
+		{children}
+		<ConsentBanner />
+		<ConsentDialog />
+		<footer>
+			<ConsentDialogLink>Privacy settings</ConsentDialogLink>
+		</footer>
+	</ConsentProvider>
+);
+```
+
+`hosted()` from `c15t/react` asks the backend's `/init` for the visitor's
+policy on each page load, and sends consent choices to the same backend. It
+uses the backend URL `consentManifest()` read from `VITE_C15T_BACKEND_URL` or
+`VITE_INTH_PROJECT_URL`. Set one to the backend URL from your Inth project. To
+resolve a bundled policy in the browser instead, pass `manifest()` from
+`c15t/react`; see
+[rendering](../rendering.md#bundle-the-policy-at-build-time).
+The Next.js and TanStack Start adapters export `ConsentRoot` instead, which wraps
+this provider and passes it server-resolved state.
+
+## Provider options
+
+Keep the provider mounted across client navigation. It reads `mode`,
+`prefetch`, `persistence`, `storageConfig`, `clearOnRevocation`, `i18n` and
+`experiment` once, when it mounts. Outside production, changing `mode`,
+`i18n`, `experiment`, `persistence` or `storageConfig` logs a warning. Remount
+the provider to change them. `scripts`, `vendors`, `networkBlocker`,
+`iframeBlocker`, `consentCategories`, `overrides`, `user`, `callbacks` and
+`enabled` apply when they change.
+
+| Option                        | Purpose                                                                                                                                                                                                                         |
+| ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `mode`                        | Required. `hosted()` for the backend's `/init`, `manifest()` for a bundled policy, `offline()` for local policies, all from `c15t/react`, or `custom()` for your own transport. See [consent modes](../../../concepts/modes.md) |
+| `prefetch`                    | Server-resolved state, or a promise of it, from a framework adapter's server helper                                                                                                                                             |
+| `scripts`                     | Consent-gated vendor scripts. See [scripts and embeds](../scripts.md)                                                                                                                                                           |
+| `vendors`                     | Vendors listed under their category with their own switch. See [vendor consent](../vendor-consent.md)                                                                                                                           |
+| `scriptLoader`                | Options for the script loader module                                                                                                                                                                                            |
+| `networkBlocker`              | Rules that hold `fetch` and `XMLHttpRequest` calls until their category is allowed, or `false`                                                                                                                                  |
+| `iframeBlocker`               | Gates DOM iframes that carry `data-category`. On by default; `false` turns it off                                                                                                                                               |
+| `persistence`                 | Stores the visitor's choice in a cookie and localStorage. On by default                                                                                                                                                         |
+| `storageConfig`               | Storage key and cookie settings for the stored choice                                                                                                                                                                           |
+| `clearOnRevocation`           | Cookies and storage keys to delete when a category is denied                                                                                                                                                                    |
+| `reloadOnConsentRevoked`      | Reload the page after the visitor turns off a granted category or vendor. Defaults to `true`                                                                                                                                    |
+| `consentCategories`           | Categories the preference dialog offers alongside those your scripts use, within the policy's scope                                                                                                                             |
+| `overrides`                   | Force the country, region or language the policy is resolved for, for testing                                                                                                                                                   |
+| `user`                        | Link consent records to a signed-in user                                                                                                                                                                                        |
+| `callbacks`                   | Choice, permission and error events                                                                                                                                                                                             |
+| `i18n`                        | Languages and message overrides                                                                                                                                                                                                 |
+| `legalLinks`                  | Privacy policy and other links shown in the banner and dialog                                                                                                                                                                   |
+| `theme`                       | `consentActions` and slot styles. Tokens go through `ConsentTheme`; see [customize](../customize.md)                                                                                                                            |
+| `components`                  | Slot attributes per component part                                                                                                                                                                                              |
+| `presentation`                | Banner and dialog shape, position and blocking                                                                                                                                                                                  |
+| `experiment`                  | A/B test of `presentation`, read once at mount. See [banner experiments](../../../guides/banner-experiments.md)                                                                                                                 |
+| `journey`                     | Random id that links each `/init` to the save that follows. See [session reports](../../../concepts/data-fetching.md#link-an-init-to-the-save-that-follows)                                                                     |
+| `colorScheme`                 | `'light'`, `'dark'`, `'system'`, or `null` to leave the `c15t-dark` class alone                                                                                                                                                 |
+| `noStyle`, `disableAnimation` | Drop the built-in styles, or turn off animations                                                                                                                                                                                |
+| `preloadDialog`               | When the deferred `ConsentDialog` starts loading: `'idle'` (default) or `'intent'`; see [ConsentDialog](./consent-dialog.md#behavior)                                                                                           |
+| `nonce`                       | Content Security Policy nonce for script elements c15t inserts                                                                                                                                                                  |
+| `enabled`                     | Set `false` only when you deliberately bypass consent enforcement                                                                                                                                                               |
+
+`enabled: false` grants categories and allows gated loading while suppressing
+consent UI. It is not a way to fix failed initialization or hide a banner in
+production.
+
+## Observe changes without inventing choices
+
+`onChoiceRecorded` reports explicit accept, reject and save actions.
+`onPermissionsChanged` also covers changes caused by policy, expiry or privacy
+signals. Hydration and notice dismissal do not become explicit choices.
+
+An externally owned runtime can be passed through `runtime`. Its owner must
+start and dispose it. A provider borrowing that runtime must not initialize or
+dispose a second copy. Passing a different `runtime` moves the provider and its
+hooks to the new runtime's kernel and unsubscribes them from the previous one.
+The previous runtime keeps running until its owner disposes it. Switch the
+provider to another runtime, or unmount it, before disposing the runtime it
+renders. Changing between a borrowed runtime and a provider-created one still
+requires remounting the provider. IAB actions taken before its handle is ready
+wait for that handle. If the provider unmounts or switches runtimes first, a
+pending `save()` rejects with an `AbortError` instead of waiting indefinitely.
+See [how consent works](../../../concepts/how-consent-works.md#a-permission-is-not-a-recorded-choice) and
+[choose your setup](../../../concepts/choose-your-setup.md).
+
+## Reload after revocation
+
+Removing a script cannot stop code that already ran. A vendor's listeners,
+timers and widgets keep working until the page unloads. When an accept, reject
+or save turns off a category or vendor that was granted, the provider reloads
+the page once the save request settles, so the next page runs only permitted
+code. `onBeforeConsentRevocationReload` runs just before the reload.
+
+Otherwise, expiry, policy changes and privacy signals do not reload the page. Set
+`reloadOnConsentRevoked: false` only when every gated vendor stops itself on
+revocation, for example through its own opt-out API.
+
+## Clear data when consent is denied
+
+Set `options.clearOnRevocation` to declare cookies, localStorage keys, and
+sessionStorage keys by optional consent category. Cleanup waits for policy
+resolution, then clears denied categories and later allowed-to-denied
+transitions. This option is initial-only. See
+[clear on revocation](../clear-on-revocation.md) for examples,
+cookie scopes, and browser limits.

package/docs/frameworks/react/components/consent-widget.md

@@ -8,7 +8,7 @@ group: frameworks
 ## Embed the preference center inline
 
 `ConsentWidget` renders the preference center in the page flow instead of in
-a modal: the category switches and the Reject all, Accept all and Save
+a modal: the category switches and the Reject All, Accept All and Save Settings
 actions, without a title, backdrop or portal. Use it on a privacy or
 settings page where the visitor expects the controls to be part of the
 content. Render it anywhere inside the `ConsentProvider` from your
@@ -19,16 +19,16 @@ banner's Customize button and preference links still have a dialog to open.
 import { ConsentWidget } from 'c15t/react';
 
 export function PrivacyPage() {
-  return (
-    <main>
-      <h1>Privacy</h1>
-      <p>Choose which optional categories this site may use.</p>
-      <section aria-labelledby="cookie-preferences">
-        <h2 id="cookie-preferences">Cookie preferences</h2>
-        <ConsentWidget />
-      </section>
-    </main>
-  );
+	return (
+		<main>
+			<h1>Privacy</h1>
+			<p>Choose which optional categories this site may use.</p>
+			<section aria-labelledby="cookie-preferences">
+				<h2 id="cookie-preferences">Cookie preferences</h2>
+				<ConsentWidget />
+			</section>
+		</main>
+	);
 }
 ```
 
@@ -49,13 +49,16 @@ or dialog by itself.
 
 The widget is the preference center without the modal around it: an
 accordion with one row per category, each with a switch, followed by the
-Reject all, Accept all and Save actions. `ConsentDialog` renders this same
+Reject All, Accept All and Save Settings actions. `ConsentDialog` renders this same
 widget inside its card. Standalone, the widget renders in place, takes part
 in server rendering, and does not touch the active surface, so it suits a
 privacy page or an account settings screen.
 
 The rows are `necessary` plus the categories in the active policy's scope,
-narrowed to the provider `options.consentCategories` when that list is non-empty.
+narrowed to the categories the provider declares: `options.consentCategories`
+and the categories of its scripts, network rules, vendors and discovered
+frames. When nothing is declared, a permissive policy shows only `necessary`
+and a strict one its whole scope.
 The `necessary` switch is on and disabled. Row titles and descriptions come
 from `consentTypes.<category>.title` and `.description`; the action labels
 from `common.rejectAll`, `common.acceptAll` and `common.save`. One row is
@@ -68,8 +71,8 @@ until Save. The draft seeds each category from the recorded choice; without
 one it uses `presentation.preferences.defaults` from the provider options,
 and without that it is on under an opt-out rule and on only for the rule's
 preselected categories under an opt-in rule. Save records the displayed
-categories, then reseeds the draft from the new record. Accept all and
-Reject all record immediately without a separate Save. A save answers a
+categories, then reseeds the draft from the new record. Accept All and
+Reject All record immediately without a separate Save. A save answers a
 choice prompt, so an open choice banner closes; it does not dismiss a
 `notice` prompt, which keeps its own acknowledgement record. Unsaved toggles
 are lost when the widget unmounts.
@@ -85,10 +88,35 @@ Privacy Control overrides shows a note under its row: "Your saved choice is
 restricted by the current privacy settings." The switch still reflects the
 saved value; the effective permission is off.
 
+### Vendors
+
+When the provider declares `vendors`, each category's expanded description
+ends with one card per vendor whose category condition names that category,
+styled like a category row: the vendor's name and a switch on the header,
+and its description and privacy policy link behind the card's own expand
+control. Cards start collapsed, so a long list stays one line per vendor,
+and the category list scrolls inside the dialog rather than growing it.
+A collapsed category or card renders its content element empty and mounts
+the content the first time it opens, then keeps it mounted, so a long
+vendor list costs nothing until a visitor expands its category.
+Vendor switches edit the same draft as the category
+switches and record on Save. Saving with one vendor off denies that vendor
+only; the category stays granted and its other vendors keep loading. While
+the category is off in the draft the vendor switches are disabled, with the
+hint "Turn on this category to choose vendors." A vendor declared
+`disabled`, or one that only falls under `necessary`, is listed without a
+switch. Accept All and Reject All clear every vendor denial, including one
+staged but not yet saved. Under an `iab` policy no vendor rows render.
+Vendors that are only referenced by a script slug, without a name and
+privacy policy URL, still gate loading but are not listed, and so does a
+vendor whose condition negates a category, since no category row can
+host it. See
+[vendor consent](../vendor-consent.md).
+
 ### Actions
 
-The preference center always renders Reject all, Accept all and Save, with
-Save as the primary action. `presentation.preferences.layout`,
+The preference center always renders Reject All, Accept All and Save Settings, with
+Save Settings as the primary action. `presentation.preferences.layout`,
 `primaryActions`, `direction` and `uiProfile` in the provider options
 reorder and restyle them; a layout that omits one of the three has it
 restored. Customize and dismiss actions never render here.
@@ -102,8 +130,12 @@ such as `['disclosure']`, renders the widget and Save completes without
 writing a consent record.
 
 For a fully custom preference center, `useConsentDraft()` returns the same
-draft: `values`, `displayedCategories`, `isDirty`, `isStale`, `set`,
-`update`, `acceptAll`, `rejectAll`, `save` and `reset`.
+draft: `values`, `displayedCategories`, `vendors`, `isDirty`, `isStale`,
+`set`, `update`, `setVendor`, `acceptAll`, `rejectAll`, `save` and `reset`.
+A custom vendor control alone takes `useVendorDraft()`, the vendor slice of
+that draft: `vendors`, `setVendor`, `isDirty`, `isStale`, `save` and `reset`.
+`useDeclaredVendors()`, `useVendorChoice()` and `useVendorAllowed(id)` read
+the declared list, the recorded denials and one vendor's effective result.
 
 `useConsentDraft` and `ConsentDraftProvider` import from `c15t/react`.
 
@@ -112,7 +144,10 @@ draft: `values`, `displayedCategories`, `isDirty`, `isStale`, `set`,
 Each row is a disclosure: a button that expands the category description
 and a switch beside it, so a visitor can read the description without
 changing the choice. Each switch has the category title as its accessible
-name. The policy-change alert uses `role="alert"`, and a restriction note is
+name. A category's vendor cards sit in a `region` named "Vendors" with the
+count; each card's expand button carries `aria-expanded`, each vendor
+switch is named "Allow" followed by the vendor name, and is described by
+the vendor's name element. The policy-change alert uses `role="alert"`, and a restriction note is
 an `output` element linked to its switch through `aria-describedby`. The
 root's `dir` attribute follows the active language.
 
@@ -122,7 +157,8 @@ Every part is available as `ConsentWidget.<Part>`. `Root` provides the
 draft and accepts `noStyle`, `disableAnimation` and `uiSource`. `Accordion`
 and `AccordionItems` render the stock rows; `AccordionItem`,
 `AccordionTrigger`, `AccordionTriggerInner`, `AccordionContent`,
-`AccordionArrow` and `Switch` build your own. `PolicyActions` renders the
+`AccordionArrow` and `Switch` build your own; `VendorList` renders one
+category's vendor rows and takes a `category` prop. `PolicyActions` renders the
 resolved actions in `Footer` and `FooterSubGroup` and accepts `renderAction`
 to replace one button; `AcceptAllButton`, `RejectButton`, `SaveButton` and
 `CustomizeButton` are the individual buttons.
@@ -155,11 +191,20 @@ export function PreferenceCenter() {
 Provider component slots for the stock structure are `manager.root`,
 `manager.footer`, `manager.actionGroup`, `accordion.root`,
 `accordion.triggerRow`, `accordion.title`, `accordion.control`,
-`accordion-item.root`, `accordion-item.trigger`, `accordion-item.content`
-and `tag.manager`.
+`accordion-item.root`, `accordion-item.trigger`, `accordion-item.content`,
+`vendor-list.root`, `vendor-list.trigger`, `vendor-list.content`,
+`vendor-list.item`, `vendor-list.header`,
+`vendor-list.name`, `vendor-list.description`, `vendor-list.link`,
+`vendor-list.control` and `tag.manager`.
+
+`ConsentWidget` from the package root and from the
+`c15t/react/consent-widget` subpath loads its code in a separate chunk the
+first time it renders, so a page that never renders it does not download
+it. `c15t/react/components/consent-widget` exports the widget without that
+deferral, plus each part as a named export.
 
 The compound parts import from `c15t/react` as properties of `ConsentWidget`.
-See [Styling](../styling/overview.md) for slots and tokens.
+See [customize](../customize.md) for slots and tokens.
 
 ## Verify