@c15t/react 3.0.0-alpha.10 → 3.0.0-alpha.12

package/docs/frameworks/react/components.md

@@ -42,13 +42,13 @@ import {
 	ConsentDialog,
 	ConsentDialogLink,
 	ConsentProvider,
-	manifest,
+	hosted,
 } from 'c15t/react';
 import type { ReactNode } from 'react';
 
 const options = {
-	// The policy the build downloaded from VITE_C15T_BACKEND_URL.
-	mode: manifest(),
+	// Asks VITE_C15T_BACKEND_URL for each visitor's policy.
+	mode: hosted(),
 	scripts: [
 		posthog({
 			id: 'phc_your_project_key',

package/docs/frameworks/react/content-security-policy.md

@@ -16,6 +16,7 @@ A React app with c15t adds these to the page, and your policy must allow them:
 | `c15t/react/styles.css`, only if you import it with `styles: false`                                             | `style-src 'self'`                                    |
 | The `<style id="c15t-theme">` element, if you render `ConsentTheme`                                             | `style-src` with a nonce or its hash                  |
 | `<script>` elements the script loader creates for `scripts` entries, both `src` and inline                      | `script-src` with each vendor's host, or a nonce      |
+| The inline `<script>` that `consentManifest()` adds to `index.html` to send `/init` early                       | `script-src` with a nonce or its hash                 |
 | With server rendering, the inline `<script>` before the banner's buttons that holds a tap made before hydration | `script-src` with a nonce or its hash                 |
 | Browser requests to your backend's `/init` and `/subjects`                                                      | `connect-src` with the backend origin                 |
 | Iframes inside `ConsentGate`, and the frames, images and requests your vendors load                             | `frame-src`, `img-src`, `connect-src` for each vendor |
@@ -70,8 +71,9 @@ entry takes precedence for that element. The stock components put it on the
 With Vite, set `html.cspNonce` to a placeholder in `vite.config.ts`, and have
 your server replace it with a new nonce on every response. Vite then adds
 `<meta property="csp-nonce" nonce="...">` to the page, and the browser keeps the
-value in the tag's `nonce` property. Read it where you create the provider, in
-the quickstart's `src/consent.tsx`:
+value in the tag's `nonce` property. Vite also stamps the nonce on the early
+`/init` script. Read it where you create the provider, in the
+quickstart's `src/consent.tsx`:
 
 ```tsx title="src/consent.tsx (partial)"
 const nonce =
@@ -88,6 +90,10 @@ The provider reads `options.nonce` once, when it mounts. A server-rendered
 React app, such as one built with React Router framework mode, reads the nonce
 from its own request and passes it the same way.
 
+On a static host, allow the early `/init` script by the hash in the browser's
+`Refused to execute inline script` error. If the policy blocks it, the app
+sends `/init` itself.
+
 ## Allow c15t's style elements
 
 The banner, dialog and other stock components render c15t's rules as

package/docs/frameworks/react/iab.md

@@ -67,6 +67,25 @@ your error boundary or the framework's error overlay shows it. Render `IABProvid
 `c15t/react/iab` for those visitors, or remove the `iab` model from the
 policy.
 
+## When the dialog loads
+
+`IABConsentDialog` loads its code on demand, so the first page load
+carries the banner without the preference center. The code downloads at
+the first of:
+
+* The browser's first idle period after the page's `load` event, while
+  the IAB banner is shown.
+* Hover or focus on the banner's Customize button or partners link.
+* The dialog opening.
+
+A visitor who opens the dialog before the download finishes waits for
+it. `open={true}` and `showTrigger` load it on mount, under a model the
+dialog's `models` prop lists. Under another model, `showTrigger` loads
+only the trigger. Set
+`preloadDialog: 'intent'` in the consent provider options to skip the
+idle download. Idle loading is also skipped with Save-Data on, on `2g`
+and `slow-2g` connections, and while offline.
+
 ## Verify vendor and purpose choices
 
 Test category choices alongside vendor, purpose, legitimate-interest and special

package/docs/frameworks/react/quickstart.md

@@ -7,11 +7,10 @@ group: frameworks
 
 ## Before you start
 
-This guide sets up a client-rendered React app built with Vite. The build
-bundles your project's public policy. The browser loads the page, resolves the
-visitor's policy from that bundle, then shows the banner or runs the scripts
-the visitor allowed. Regional policies may still need a backend location
-request.
+This guide sets up a client-rendered React app built with Vite. The browser
+loads the page and asks your consent backend for the visitor's policy, then
+shows the banner or runs the scripts the visitor allowed. The backend reads the
+visitor's location from the request, so regional policies need no extra setup.
 
 * **Next.js or TanStack Start?** Use that framework's guide from the
   [framework list](https://v3.c15t.com/docs/frameworks). Their adapters resolve consent on the
@@ -28,8 +27,8 @@ the backend URL.
 [Choose your setup](../../concepts/choose-your-setup.md#decide-who-runs-the-consent-backend)
 covers self-hosting and offline mode.
 
-Bundling the policy at build time is the recommended production setup.
-Rebuild after changing policies, translations or vendors.
+The guide uses `hosted()` mode. Policy, translation and vendor edits in your
+project reach visitors on their next page load, without a rebuild.
 
 ## Install c15t
 
@@ -43,7 +42,7 @@ Rebuild after changing policies, translations or vendors.
 `c15t` contains the React adapter at `c15t/react` and the Vite plugin at
 `c15t/build`. `@c15t/integrations` holds the vendor loaders used below.
 
-## Bundle your policy
+## Add the Vite plugin
 
 Add `consentManifest` to `vite.config.ts`:
 
@@ -66,60 +65,14 @@ VITE_C15T_BACKEND_URL=https://your-project.inth.app
 If your app already sets `VITE_INTH_PROJECT_URL` for other Inth SDKs, that works
 too. When both are set, `VITE_C15T_BACKEND_URL` wins.
 
-`consentManifest` downloads your project's public policy from `/manifest`
-during `vite build`, or in `vite dev` when the app first loads it, and serves
-it to your app as `snapshot`
-from `c15t/generated`. No file is written into your project.
+`consentManifest` hands the backend URL to `hosted()` through
+`c15t/generated`. No file is written into your project. Without the plugin,
+pass the URL as `hosted({ backendURL })`.
 
-The snapshot is fixed at build time:
-
-* Rebuild after changing policies, translations or vendors. If your CI caches
-  build output, force a fresh build.
-* Consent choices still go to the backend.
-
-The build reads the backend URL from your public backend URL variable when
-the config doesn't pass one: `NEXT_PUBLIC_C15T_BACKEND_URL` in Next.js,
-`NUXT_PUBLIC_C15T_BACKEND_URL` in Nuxt, `PUBLIC_C15T_BACKEND_URL` in Astro,
-Svelte and SvelteKit, and `VITE_C15T_BACKEND_URL` in TanStack Start and other
-Vite apps. Each also reads the matching Inth variable, such as
-`NEXT_PUBLIC_INTH_PROJECT_URL`, when the c15t one is unset. See
-[set the backend URL](../../concepts/modes.md#set-the-backend-url).
-
-The fetch waits at most 10 seconds. When it fails, or no backend URL is set,
-every framework does the same thing:
-
-| Command                                                                   | Default when the fetch fails                             |
-| ------------------------------------------------------------------------- | -------------------------------------------------------- |
-| Production build: `next build`, `vite build`, `nuxt build`, `astro build` | The build stops with an error.                           |
-| Dev: `next dev`, `vite dev`, `nuxt dev`, `astro dev`                      | A warning, and the server fetches the policy at runtime. |
-
-Set `onBuildError` to use one behaviour for both. `'fail'` stops dev too.
-`'runtime'` lets a production build finish, and the server fetches the policy
-at runtime. The `C15T_ON_BUILD_ERROR` environment variable overrides the
-option, so you can deploy during a backend outage without a code change:
-
-```sh
-C15T_ON_BUILD_ERROR=runtime npm run build
-```
-
-Turborepo's strict environment mode hides undeclared variables from tasks, so
-list `C15T_ON_BUILD_ERROR` in the build task's `passThroughEnv` there.
-
-The build skips the fetch, without an error, when it can't use a snapshot,
-for example when the backend URL is relative. With `onBuildError: 'fail'`, a
-relative URL stops the build. [Consent modes](../../concepts/modes.md#what-happens-when-the-download-fails)
-lists every case.
-
-`vite build` and `vite dev` fetch the manifest when they start. `vite preview`
-serves the last build without fetching. The plugin writes no file into your
-app, so there is nothing to keep out of Git. `c15t/generated` ships its own
-types, so `tsc`, `vue-tsc` and `svelte-check` pass on a fresh checkout without
-a build first.
-
-The plugin can't see the options your app passes to `manifest()`. When the
-app passes `source: 'runtime'` or `manifestURL`, set
-`consentManifest({ source: 'runtime' })` too. The build then downloads no
-manifest, so it doesn't fail when the backend's `/manifest` is down.
+The plugin also adds a small script to `index.html` that sends `/init` while
+your JavaScript downloads, so the banner shows sooner.
+[Rendering](./rendering.md#send-init-before-the-app-loads)
+covers when to turn it off.
 
 ## Mount the provider
 
@@ -135,13 +88,13 @@ import {
 	ConsentDialog,
 	ConsentDialogLink,
 	ConsentProvider,
-	manifest,
+	hosted,
 } from 'c15t/react';
 import type { ReactNode } from 'react';
 
 const options = {
-	// The policy the build downloaded from VITE_C15T_BACKEND_URL.
-	mode: manifest(),
+	// Asks VITE_C15T_BACKEND_URL for each visitor's policy.
+	mode: hosted(),
 	scripts: [
 		posthog({
 			id: 'phc_your_project_key',
@@ -163,18 +116,11 @@ export const Consent = ({ children }: { children: ReactNode }) => (
 );
 ```
 
-`manifest()` resolves the policy from the bundled snapshot in the browser,
-with no `/manifest` request. It reads the snapshot and the backend URL from
-what `consentManifest` downloaded. Consent choices go to that backend, and so
-does an `/init` request when the policy depends on the visitor's country or
-region and the browser does not know it. That request returns the backend's
-current policy, which can be newer than the snapshot. Vite reads
-`VITE_C15T_BACKEND_URL` at build time, so set it before you build, not when
-you serve the files.
-
-To apply policy edits without rebuilding, use `hosted()` from `c15t/react` as
-the mode. The browser then requests the policy from `/init` on every page load.
-[Consent modes](../../concepts/modes.md) compares the three modes.
+`hosted()` makes one `/init` request to your backend, started early by the
+script in `index.html`. The backend picks the policy from the visitor's
+location and language and returns its current version. Consent choices go to
+the same backend. Vite reads `VITE_C15T_BACKEND_URL` at build time, so set it
+before you build, not when you serve the files.
 
 PostHog waits for measurement permission, so your policy must include that
 category. Replace `phc_your_project_key` with your PostHog project key.
@@ -234,7 +180,8 @@ Build and preview the production bundle with `vite build` and `vite preview`,
 then open the site in a private window with DevTools open on the Network tab.
 Test under a policy that asks for a choice, such as an EU opt-in policy.
 
-1. **Before a choice.** The banner shows, with no `/manifest` request. There
+1. **Before a choice.** One `/init` request goes to your backend URL, starting
+   before your JavaScript finishes downloading, and the banner shows. There
    are no requests to `posthog.com`.
 2. **Reject All.** The banner closes and the vendor requests stay absent.
 3. **Reload.** The banner stays closed and the vendor requests stay absent.
@@ -243,8 +190,7 @@ Test under a policy that asks for a choice, such as an EU opt-in policy.
    save. PostHog's `array.js` loads.
 5. **Turn Analytics off again.** The page reloads and PostHog does not load.
 
-If the banner never appears, check the generated policy and any location
-request to `/init` on your backend URL. [Troubleshooting](./troubleshooting.md)
+If the banner never appears, check the `/init` request to your backend URL. [Troubleshooting](./troubleshooting.md)
 covers the common causes. [Verify consent](../../guides/verify-consent.md) has the
 full release checklist.
 

package/docs/frameworks/react/rendering.md

@@ -23,15 +23,168 @@ read the visitor's cookie and location on the server, so the banner can be in
 the first HTML. [Choose your setup](../../concepts/choose-your-setup.md#server-rendering-or-browser-rendering)
 explains the difference in general terms.
 
-## Bundle the manifest during Vite builds
+## Client-rendered apps
 
 The [quickstart](./quickstart.md) and `examples/react` in
-the c15t repository use this setup.
+the c15t repository use `hosted()` from `c15t/react`. It reads the backend URL
+`consentManifest` read from `VITE_C15T_BACKEND_URL` or
+`VITE_INTH_PROJECT_URL`; without the plugin, pass `hosted({ backendURL })`.
+Policy edits apply on the next page load, without a rebuild. The page loads
+like this:
+
+1. The page loads with no consent state. Every optional category is denied.
+2. The browser requests `GET /init` from your backend URL. A
+   [script in `index.html`](#send-init-before-the-app-loads) sends it while
+   the JavaScript downloads. The backend picks the visitor's policy from their
+   location. With an `experiment`, pass it to the plugin as
+   `initPrefetch: { experiment }` so the early request carries the visitor's
+   arm. Without that, the provider sends its own `/init` when it mounts.
+3. The provider applies the policy and any stored choice. It shows the banner
+   if the policy asks for one, and loads the scripts the visitor allowed.
+
+Until step 3 finishes, gated scripts and `ConsentGate` embeds stay blocked. If
+the backend request fails, they stay blocked and no banner shows.
+
+### Send `/init` before the app loads
+
+`consentManifest()` adds a small inline script to the `<head>` of
+`index.html`. It sends `/init` while the browser downloads your JavaScript,
+and `hosted()` uses that response instead of sending its own. The banner
+usually shows 50 to 250 ms sooner. There is nothing to configure.
+
+The early request can't read your app's options, so in a few setups it won't
+match and the app sends a second `/init`. Pass `initPrefetch: false` when the
+app uses `offline()` or gives `hosted()` its own `backendURL`, `fetch`,
+`initURL` or `headers`. With its own `fetch`, `hosted()` sends `/init` through
+it and ignores the early response. If it sets `credentials`, `overrides`, `storageKey`, an
+`experiment`, or `journey: false`, pass the same values as
+`initPrefetch: { credentials, experiment, journey, overrides, storageKey }`.
+With `journey: 'tab'`, passing it too makes a tab's first `/init` report the
+`'tab'` scope instead of `'page'`. It doesn't save a request.
+Pass `experiment` only when c15t assigns the arm. If a feature flag picks
+it, leave it out, or the script sends an arm the visitor may never see.
+The dev server adds the script even to a `manifest()` app, which then sends
+one `/init` per page load that it doesn't use. A production build leaves it
+out.
+
+## React Router, Remix and other server-rendered apps
+
+React Router framework mode, Remix and similar frameworks have no c15t adapter.
+Use the quickstart's `Consent` component and render it in your root component,
+around the outlet. In React Router framework mode that is `app/root.tsx`.
+
+`ConsentProvider` renders on the server without touching browser APIs, and the
+browser takes over after hydration:
+
+* The server HTML contains your page but no banner and no consent state.
+* After hydration the browser calls `/init`, then shows the banner if the
+  policy asks for one.
+* The server render and the first browser render agree, so hydration does not
+  warn or change a stored choice.
+
+The Vite setup needs no change. The banner renders in the browser and brings
+its own `<style>` element, so there is no stylesheet to import.
+
+These frameworks render their own HTML, so the Vite plugin can't add the
+early `/init` script. Put `buildPrefetchScript({ backendURL })` from `c15t` in
+a `<script>` in the root `<head>` instead, unless your loader supplies
+`initialData` as described below. The two are alternatives: with
+`initialData` the provider never reads the script's response.
+
+### Skip the browser's first init request
+
+This is optional. `fetchSSRData` from `c15t/react/server` calls the backend's
+`/init` from your server loader, forwarding the visitor's location and
+language headers. Pass the result to the browser, wrap it in a promise and give
+it to `hosted({ backendURL, initialData })`. The provider's first init then uses that
+response instead of a network request.
+
+Know its limits before you add it:
+
+* It saves the browser's round trip to the backend. It does not put the banner
+  in the server HTML; the banner still mounts after hydration.
+* Every page view makes a server-to-server `/init` request. Do not cache the
+  loader response, because it contains one visitor's policy.
+* It returns `undefined` when the request has no location or language headers,
+  and the browser then requests `/init` as usual.
+* `mode` is read once, when the provider mounts. Create the `hosted()` mode once
+  in the browser rather than on every render.
+* A relative `backendURL` resolves against the request's `host` header, over
+  `https` for a domain name and over `http` for `localhost`, an IP address or
+  a single-label host. `fetchSSRData` ignores `x-forwarded-host`,
+  `x-forwarded-proto` and `forwarded`, and does not send them to the backend.
+  Behind a proxy that overwrites those headers, pass
+  `trustForwardedHeaders: true` to use them.
+* If your server answers requests for any `Host` header, such as a Node server
+  exposed directly or a proxy that forwards `Host` from its default virtual
+  host, pass `fetchSSRData` an absolute `backendURL`. A relative one resolves
+  against whatever `Host` the request sent.
+
+### Render the banner in the server HTML
+
+c15t has no framework-neutral helper for this. `ConsentProvider` accepts a
+server-resolved `prefetch` state, but the Next.js and TanStack Start adapters
+build that state from the request's cookie, headers and a cached policy
+manifest. Building it by hand ties your app to internal shapes. If the banner
+must be part of the first paint, use one of those adapters. Otherwise keep the
+browser path.
+
+## Static and prerendered pages
+
+A prerendered page is the same HTML for every visitor, so it cannot contain one
+visitor's consent. Use the quickstart's setup. `/init` requests and consent
+saves go to the backend URL directly, so the static host needs no server
+route. Add the site's
+origin to the trusted origins in your Inth project.
+
+Do not cache a response that contains a visitor's consent in a CDN or a shared
+page cache. [Data fetching](../../concepts/data-fetching.md) covers what is safe to
+cache.
+
+## Where the browser sends requests
+
+With `hosted()`, the browser calls two backend endpoints:
+
+| Request               | When                                       |
+| --------------------- | ------------------------------------------ |
+| `GET {url}/init`      | Once per page load, to resolve the policy  |
+| `POST {url}/subjects` | When the visitor accepts, rejects or saves |
+
+These requests go to the backend's origin, so it must list your site as a
+trusted origin.
+[Data fetching](../../concepts/data-fetching.md) compares this with proxies and
+custom transports.
+
+## Check the rendering path
+
+1. Open the page in a private window and view the page source. In a
+   server-rendered app the HTML contains your content and no element with
+   `data-testid="consent-banner-root"`.
+2. In DevTools Network, confirm one `/init` request runs, unless you supply
+   `initialData`.
+3. The banner appears once the policy resolves. Vendor requests stay absent
+   until you allow their category.
+
+## Bundle the policy at build time
+
+`manifest()` resolves the policy in the browser from a snapshot the build
+downloaded. It saves the `/init` request only in these cases:
+
+* The policy has no location rules, or every location gets the same banner.
+* The page already knows the visitor's location, for example from an edge
+  worker, and passes it as `inputs`.
+* You run a same-origin `geoURL` route that returns the location.
+
+Otherwise the browser still calls `/init` on a first visit and uses the
+backend's answer, so the bundle adds bytes without saving a request.
+`consentManifest` warns during the build when that happens. The resolver adds
+about 3 KB gzipped to the bundle, and policy edits need a rebuild. The browser
+sends no `/init`, so the backend doesn't count visitors it resolves this way.
 
 The build fetches your public policy once and bundles it, so the server never
 fetches it at runtime.
 
-Add `consentManifest` to your existing Vite plugin list:
+Keep `consentManifest` in your Vite plugin list:
 
 ```ts title="vite.config.ts (plugins option)"
 import { consentManifest } from 'c15t/build';
@@ -68,20 +221,16 @@ When the build has no snapshot, as in `vite dev` after a failed fetch,
 `${backendURL}/manifest` instead.
 
 When the required country or region is missing, the transport calls backend
-`/init` and uses its resolved policy and translations. `consentManifest` warns
-during the build when it downloads such a policy, and suggests `hosted()`. That response can use
-newer backend policy than the build snapshot. This is a full consent resolution,
-so these visitors still wait for a backend round trip. `ConsentProvider` sends
-that request while it first renders, before the page mounts, unless the visitor
-has a stored choice.
+`/init` and uses its resolved policy and translations. That response can use
+newer backend policy than the build snapshot. `ConsentProvider` sends that
+request while it first renders, before the page mounts, unless the visitor has
+a stored choice.
 
 The browser cannot guess the banner from the snapshot alone when locations
 differ. With a European opt-in rule and no banner elsewhere, a banner shown
 before `/init` answers would vanish for most of the world. The exception is a
 policy whose country and region rules all show the same banner, with a default
-rule that covers everywhere else: the browser resolves it at once. To skip the
-round trip for location-specific rules, pass the country your CDN or edge
-already knows through `inputs`.
+rule that covers everywhere else: the browser resolves it at once.
 
 Policy and resolver code are part of the browser bundle.
 
@@ -134,130 +283,3 @@ The plugin can't see the options your app passes to `manifest()`. When the
 app passes `source: 'runtime'` or `manifestURL`, set
 `consentManifest({ source: 'runtime' })` too. The build then downloads no
 manifest, so it doesn't fail when the backend's `/manifest` is down.
-
-For policy updates without a rebuild, use `hosted({ backendURL })` from `c15t/react`
-as the mode and omit the build plugin. That setup resolves policy through the
-backend `/init` on each page load.
-
-## Client-rendered apps
-
-The recommended [quickstart](./quickstart.md) bundles the
-manifest and resolves it in the browser. See [build-time manifests](#bundle-the-manifest-during-vite-builds).
-
-For policy updates without rebuilding, use `hosted()` from `c15t/react` as
-the mode. It reads the backend URL `consentManifest` read from
-`VITE_C15T_BACKEND_URL` or `VITE_INTH_PROJECT_URL`; without the plugin, pass
-`hosted({ backendURL })`.
-That runtime path works as follows:
-
-1. The page loads with no consent state. Every optional category is denied.
-2. `ConsentProvider` requests `GET /init` from your backend URL while it first
-   renders, before the page paints. The backend picks the visitor's policy
-   from their location. With an `experiment`, the request waits until the
-   provider mounts, because it carries the visitor's arm.
-3. The provider applies the policy and any stored choice. It shows the banner
-   if the policy asks for one, and loads the scripts the visitor allowed.
-
-Until step 3 finishes, gated scripts and `ConsentGate` embeds stay blocked. If
-the backend request fails, they stay blocked and no banner shows.
-
-## React Router, Remix and other server-rendered apps
-
-React Router framework mode, Remix and similar frameworks have no c15t adapter.
-Use the quickstart's `Consent` component and render it in your root component,
-around the outlet. In React Router framework mode that is `app/root.tsx`.
-
-`ConsentProvider` renders on the server without touching browser APIs, and the
-browser takes over after hydration:
-
-* The server HTML contains your page but no banner and no consent state.
-* After hydration the browser resolves the bundled manifest, then shows the
-  banner if the policy asks for one. When the banner depends on a country or
-  region the browser does not know, it calls `/init` and uses the backend's
-  current policy and translations, which can differ from the build snapshot.
-  With `hosted()`, it always calls `/init`.
-* The server render and the first browser render agree, so hydration does not
-  warn or change a stored choice.
-
-The Vite setup needs no change. The banner renders in the browser and brings
-its own `<style>` element, so there is no stylesheet to import.
-
-### Skip the browser's first init request
-
-This is optional. `fetchSSRData` from `c15t/react/server` calls the backend's
-`/init` from your server loader, forwarding the visitor's location and
-language headers. Pass the result to the browser, wrap it in a promise and give
-it to `hosted({ backendURL, initialData })`. The provider's first init then uses that
-response instead of a network request.
-
-Know its limits before you add it:
-
-* It saves the browser's round trip to the backend. It does not put the banner
-  in the server HTML; the banner still mounts after hydration.
-* Every page view makes a server-to-server `/init` request. Do not cache the
-  loader response, because it contains one visitor's policy.
-* It returns `undefined` when the request has no location or language headers,
-  and the browser then requests `/init` as usual.
-* `mode` is read once, when the provider mounts. Create the `hosted()` mode once
-  in the browser rather than on every render.
-* A relative `backendURL` resolves against the request's `host` header, over
-  `https` for a domain name and over `http` for `localhost`, an IP address or
-  a single-label host. `fetchSSRData` ignores `x-forwarded-host`,
-  `x-forwarded-proto` and `forwarded`, and does not send them to the backend.
-  Behind a proxy that overwrites those headers, pass
-  `trustForwardedHeaders: true` to use them.
-* If your server answers requests for any `Host` header, such as a Node server
-  exposed directly or a proxy that forwards `Host` from its default virtual
-  host, pass `fetchSSRData` an absolute `backendURL`. A relative one resolves
-  against whatever `Host` the request sent.
-
-### Render the banner in the server HTML
-
-c15t has no framework-neutral helper for this. `ConsentProvider` accepts a
-server-resolved `prefetch` state, but the Next.js and TanStack Start adapters
-build that state from the request's cookie, headers and a cached policy
-manifest. Building it by hand ties your app to internal shapes. If the banner
-must be part of the first paint, use one of those adapters. Otherwise keep the
-browser path.
-
-## Static and prerendered pages
-
-A prerendered page is the same HTML for every visitor, so it cannot contain one
-visitor's consent. Use the quickstart's build-time snapshot. Consent saves and
-any `/init` requests go to the backend URL directly, so the static host
-needs no server route. Add the site's
-origin to the trusted origins in your Inth project.
-
-Do not cache a response that contains a visitor's consent in a CDN or a shared
-page cache. [Data fetching](../../concepts/data-fetching.md) covers what is safe to
-cache.
-
-## Where the browser sends requests
-
-With `hosted()`, the browser calls two backend endpoints:
-
-| Request               | When                                       |
-| --------------------- | ------------------------------------------ |
-| `GET {url}/init`      | Once per page load, to resolve the policy  |
-| `POST {url}/subjects` | When the visitor accepts, rejects or saves |
-
-With a bundled manifest, `manifest()` sends the same
-`/subjects` request, and requests `/init` only when the policy depends on a
-country or region the browser does not know.
-
-These requests go to the backend's origin, so it must list your site as a
-trusted origin.
-[Data fetching](../../concepts/data-fetching.md) compares this with proxies and
-custom transports.
-
-## Check the rendering path
-
-1. Open the page in a private window and view the page source. In a
-   server-rendered app the HTML contains your content and no element with
-   `data-testid="consent-banner-root"`.
-2. In DevTools Network, confirm there is no `/manifest` request with a
-   build-time snapshot. A regional policy may still need an `/init` request
-   to resolve consent when geography is missing. With `hosted()`, one `/init`
-   request runs unless you supply `initialData`.
-3. The banner appears once the policy resolves. Vendor requests stay absent
-   until you allow their category.

package/docs/frameworks/react/scripts.md

@@ -20,13 +20,13 @@ import {
 	ConsentDialog,
 	ConsentDialogLink,
 	ConsentProvider,
-	manifest,
+	hosted,
 } from 'c15t/react';
 import type { ReactNode } from 'react';
 
 const options = {
-	// The policy the build downloaded from VITE_C15T_BACKEND_URL.
-	mode: manifest(),
+	// Asks VITE_C15T_BACKEND_URL for each visitor's policy.
+	mode: hosted(),
 	scripts: [
 		posthog({
 			id: 'phc_your_project_key',

package/docs/frameworks/react/troubleshooting.md

@@ -5,6 +5,23 @@ description: Fix a missing banner, early vendor requests, unstyled components
 group: frameworks
 ---
 
+## There is no banner
+
+**Check.** In DevTools Network, find the `GET` request to `/init` on your
+backend URL. With `hosted()`, the browser sends it while the provider first
+renders. With a bundled `manifest()`, the browser makes no request before the
+banner unless the policy depends on a country or region it does not know.
+
+| What you see                    | Cause                                                                                                                         | Fix                                                                                                                                                               |
+| ------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| No request and no banner        | `ConsentProvider` is not mounted, an error stopped `src/consent.tsx` from rendering, or the bundled policy asks for no banner | Check the console for errors, render one provider at the app root as in the [quickstart](./quickstart.md), and inspect the active policy with the component below |
+| `/init` fails with a CORS error | Your site's origin is not trusted                                                                                             | Add the exact origin, including port in development, to the trusted origins in your Inth project                                                                  |
+| `/init` returns 200             | The policy for this visitor asks for no banner, or a stored choice is still valid                                             | Inspect the active policy with the component below, or clear site data                                                                                            |
+
+A policy with `prompt: 'none'` shows no banner by design, and so does a
+returning visitor with a valid stored choice. [Policies](../../concepts/policies.md)
+explains why a region may not show one.
+
 ## Why does the build fail to download the manifest?
 
 **Check.** `vite build` stops with an error from `consentManifest` that
@@ -59,22 +76,6 @@ requests `${backendURL}/manifest` on page load.
 Fix the cause, then restart `vite dev` or rebuild. The plugin fetches once
 when Vite starts.
 
-## There is no banner
-
-**Check.** In DevTools Network, find the `GET` request to `/init` on your
-backend URL. With the bundled manifest, the browser makes no request before
-the banner unless the policy depends on a country or region it does not know.
-
-| What you see                    | Cause                                                                                                                         | Fix                                                                                                                                                               |
-| ------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| No request and no banner        | `ConsentProvider` is not mounted, an error stopped `src/consent.tsx` from rendering, or the bundled policy asks for no banner | Check the console for errors, render one provider at the app root as in the [quickstart](./quickstart.md), and inspect the active policy with the component below |
-| `/init` fails with a CORS error | Your site's origin is not trusted                                                                                             | Add the exact origin, including port in development, to the trusted origins in your Inth project                                                                  |
-| `/init` returns 200             | The policy for this visitor asks for no banner, or a stored choice is still valid                                             | Inspect the active policy with the component below, or clear site data                                                                                            |
-
-A policy with `prompt: 'none'` shows no banner by design, and so does a
-returning visitor with a valid stored choice. [Policies](../../concepts/policies.md)
-explains why a region may not show one.
-
 ## The page throws that no IABProvider is mounted
 
 The visitor's policy uses the `iab` model and the backend sent its vendor

package/docs/frameworks/react/upgrade-v3.md

@@ -255,10 +255,11 @@ projects use URLs such as `https://your-project.inth.app`. The
 [React quickstart](./quickstart.md) shows the full provider,
 and [data fetching](../../concepts/data-fetching.md) covers custom transports.
 
-v3 also adds `manifest()`, which the quickstart uses: `consentManifest()` from
-`c15t/build` downloads the policy when Vite builds, and the browser resolves it
-without asking `/init`. `manifest()` and `hosted()` then read the backend URL
-from `VITE_C15T_BACKEND_URL`, so they need no arguments. See
+The quickstart keeps `hosted()` and adds `consentManifest()` from
+`c15t/build` to `vite.config.ts`. `hosted()` then reads the backend URL from
+`VITE_C15T_BACKEND_URL`, so it needs no arguments. v3 also adds `manifest()`,
+which bundles the policy when Vite builds. It skips `/init` only when the
+policy has no location rules or the page knows the visitor's location. See
 [consent modes](../../concepts/modes.md).
 
 Offline mode keeps choices in the browser and records nothing on a server. Not