@c15t/react 3.0.0-alpha.10 → 3.0.0-alpha.12

package/docs/guides/banner-experiments.md

@@ -397,6 +397,22 @@ arm re-assigns only the visitors who were in it. For a clean analysis, change
 Built-in assignment is not available in Astro; see
 [Astro](#astro).
 
+A Vite app's early `/init` script, from `consentManifest()`, picks the arm
+the same way when you pass it the experiment, and the app then runs that
+arm. Import the same object into `vite.config.ts`:
+
+```ts title="vite.config.ts"
+consentManifest({ initPrefetch: { experiment: bannerExperiment } });
+```
+
+Without it, the app sends its own `/init` for visitors who have not chosen
+yet. The same goes for `consentPrefetchHead` in TanStack Start and
+`buildPrefetchScript` elsewhere, which take the same `experiment` option.
+
+When a feature flag picks the arm, leave `experiment` out of
+`initPrefetch`. The script would pick its own arm and send it to the
+backend, and the app would then send a second `/init` with the flag's arm.
+
 ## Acknowledge presentation diagnostics
 
 Each arm is resolved under the visitor's policy the same way `presentation`

package/docs/integrations/overview.md

@@ -75,6 +75,7 @@ kernel to control its DOM lifecycle. Embeds do not require `@c15t/integrations`.
 | [Rybbit Analytics](./rybbit-analytics.md)                 | `rybbitAnalytics`        | `measurement`                                   | Waits for effective permission                                                                       |
 | [Umami Analytics](./umami-analytics.md)                   | `umamiAnalytics`         | `measurement`                                   | Waits for effective permission                                                                       |
 | [Vercel Analytics](./vercel-analytics.md)                 | `vercelAnalytics`        | `measurement`                                   | Waits for effective permission                                                                       |
+| [Vercel Speed Insights](./vercel-speed-insights.md)       | `vercelSpeedInsights`    | `measurement`                                   | Waits for effective permission; drops reports after revocation                                       |
 
 ## Chat and support
 

package/docs/integrations/vercel-speed-insights.md

@@ -0,0 +1,306 @@
+---
+title: Vercel Speed Insights
+description: Load the Vercel Speed Insights collector only after measurement
+  consent with the c15t vercelSpeedInsights helper, drop Web Vitals reports on
+  revocation, and check it in DevTools.
+icon: vercel-analytics
+group: integrations
+---
+
+## Configure Vercel Speed Insights
+
+Enable Speed Insights for the project in Vercel. Remove the `SpeedInsights`
+component or `injectSpeedInsights()` call from `@vercel/speed-insights`. The
+collector starts once per page, so a copy loaded outside c15t keeps reporting
+before consent.
+
+| Package manager | Command                                |
+| :-------------- | :------------------------------------- |
+| npm             | `npm install @c15t/integrations@alpha` |
+| pnpm            | `pnpm add @c15t/integrations@alpha`    |
+| yarn            | `yarn add @c15t/integrations@alpha`    |
+| bun             | `bun add @c15t/integrations@alpha`     |
+
+```ts title="src/consent-scripts.ts"
+import { vercelSpeedInsights } from '@c15t/integrations/vercel-speed-insights';
+
+export const scripts = [vercelSpeedInsights()];
+```
+
+## Register the scripts
+
+Complete your [framework quickstart](https://v3.c15t.com/docs/frameworks) first. Keep its Inth
+endpoint, policy, styles and consent UI. Remove the vendor's original script,
+SDK initializer or tag-manager entry, so the vendor loads only through c15t.
+
+The vendor pages put the helper in `src/consent-scripts.ts`. If your framework
+quickstart already has a `scripts` array, such as the one in `c15t.config.ts`
+in the Next.js guide, add the helper to that array instead of creating a
+second file.
+The `scripts` export is a configuration, not an initializer. Add it to the c15t provider you already have, at the registration
+point for your framework below. These are edits to that provider, not a second
+provider.
+
+**Next.js**
+
+Add the configuration to `scripts` in `c15t.config.ts`, next to
+`next.config.ts`:
+
+```ts title="c15t.config.ts"
+import { defineConsentConfig } from 'c15t/next';
+import { scripts } from './src/consent-scripts';
+
+export default defineConsentConfig({ scripts });
+```
+
+Keep the rest of your config, such as `mode` and `routePrefix`, in the
+same call. `ConsentRoot` reads the config in the browser, so the layout
+keeps passing only `state`. App Router, Pages Router and static export all
+read the same file. See
+[Next.js scripts and embeds](https://v3.c15t.com/docs/frameworks/next/scripts).
+
+**TanStack Start**
+
+Import the configuration into your root route and pass it to the existing
+`ConsentRoot` as a top-level prop. Keep the loader from the
+[TanStack Start quickstart](https://v3.c15t.com/docs/frameworks/tanstack-start/quickstart):
+
+```tsx title="src/routes/__root.tsx"
+import { scripts } from '../consent-scripts';
+
+<ConsentRoot state={consent} scripts={scripts}>
+```
+
+Import vendor helpers in the root route module, not in a server function.
+A server function's return value must be serializable, and script
+configurations carry callbacks. See
+[TanStack Start scripts](https://v3.c15t.com/docs/frameworks/tanstack-start/scripts).
+
+**React**
+
+Add the configuration to the existing `ConsentProvider` options, next to
+`mode`:
+
+```tsx title="src/consent.tsx"
+import { scripts } from './consent-scripts';
+
+<ConsentProvider options={{ mode, scripts }}>
+```
+
+`mode` is the `manifest()` value from the
+[React quickstart](../frameworks/react/quickstart.md). Keep the banner,
+dialog and preferences link inside the provider. See
+[React scripts and embeds](../frameworks/react/scripts.md).
+
+**Nuxt**
+
+Register the scripts under the `c15t` key in `app/app.config.ts`. Adjust the
+relative import to where you created `consent-scripts.ts`:
+
+```ts title="app/app.config.ts"
+import { scripts } from '../src/consent-scripts';
+
+export default defineAppConfig({
+  c15t: { scripts },
+});
+```
+
+The Nuxt module merges this over its options in `nuxt.config.ts` and starts
+one script loader in the browser after hydration, once it has applied the
+visitor's stored choice and privacy signals. Keep `scripts` out of
+`nuxt.config.ts`, which reaches the browser as JSON and drops the vendor
+callbacks. Write the vendor IDs into `consent-scripts.ts`. See
+[Nuxt scripts and embeds](https://v3.c15t.com/docs/frameworks/nuxt/scripts).
+
+**Vue**
+
+Pass the scripts to the existing `c15tVue` plugin call in `src/main.ts`:
+
+```ts title="src/main.ts"
+import { c15tVue, manifest } from 'c15t/vue/vue-plugin';
+import { scripts } from './consent-scripts';
+
+app.use(c15tVue, {
+  mode: manifest(),
+  scripts,
+});
+```
+
+Keep your existing `mode` and other options. The plugin starts one
+script loader when the app mounts, after it has applied the visitor's stored
+choice. Do not also call `createScriptLoader` from a component. See
+[Vue scripts and embeds](https://v3.c15t.com/docs/frameworks/vue/scripts).
+
+**Astro**
+
+Add the scripts to the client entrypoint from the
+[Astro quickstart](https://v3.c15t.com/docs/frameworks/astro/quickstart), `src/c15t.client.ts`,
+which the integration finds on its own. Keep `astro.config.mjs` as it is.
+If the module already exports scripts, combine the two arrays.
+
+```ts title="src/c15t.client.ts"
+import type { C15tClientOptionsExtension } from 'c15t/astro';
+import { scripts } from './consent-scripts';
+
+export default { scripts } satisfies C15tClientOptionsExtension;
+```
+
+Vendor helpers contain callbacks, and the integration options in
+`astro.config.mjs` are serialized into the page, so do not put helpers in
+the integration's `scripts` option. The integration passes the client
+entrypoint to the one runtime every page shares, including across
+`ClientRouter` navigation.
+
+**Svelte**
+
+Import the scripts in the component that owns your existing provider and
+pass them as a top-level prop:
+
+```svelte title="src/App.svelte"
+<script lang="ts">
+  import { ConsentProvider, manifest } from '@c15t/svelte';
+  import { scripts } from './consent-scripts';
+</script>
+
+<ConsentProvider mode={manifest()} {scripts}>
+  <!-- Keep your application, consent UI and preferences link here. -->
+</ConsentProvider>
+```
+
+Retain the styles and consent UI from the [Svelte quickstart](https://v3.c15t.com/docs/frameworks/svelte/quickstart).
+The provider owns the loader and disposes it on unmount.
+
+**SvelteKit**
+
+Add the scripts to the existing `ConsentRoot` in the root layout. Keep the
+handle and the layout load from the [SvelteKit quickstart](https://v3.c15t.com/docs/frameworks/sveltekit/quickstart).
+
+```svelte title="src/routes/+layout.svelte"
+<script lang="ts">
+  import { ConsentRoot } from '@c15t/svelte';
+  import { scripts } from '../consent-scripts';
+
+  let { children, data } = $props();
+</script>
+
+<ConsentRoot state={data.consent} {scripts}>
+  {@render children()}
+  <!-- Keep your consent UI and preferences link here. -->
+</ConsentRoot>
+```
+
+Import vendor helpers in the layout component, not in `+layout.server.ts`:
+a server load cannot send functions to the browser. Prerendered, static and
+SPA-mode pages use the same `scripts` prop. If you pass an externally owned
+`runtime` to the provider, register scripts when creating that runtime instead.
+
+**HTML**
+
+The helpers in `@c15t/integrations` are ES modules that need a bundler. On a
+page that loads the c15t script tag, paste the vendor's own snippet instead
+and keep it inert until its category is allowed:
+
+```html
+<script type="text/plain" data-c15t-category="measurement">
+  // The vendor's snippet, unchanged
+</script>
+```
+
+Use the category this guide names for the vendor. c15t runs the snippet
+once that category is allowed, and reloads the page when the visitor
+withdraws it. Helper options on this page, such as `loadMode`, do not apply
+to a pasted snippet. See [HTML scripts](https://v3.c15t.com/docs/frameworks/html/scripts).
+
+**JavaScript**
+
+Pass the scripts to `init()` from `@c15t/browser`, next to your mode:
+
+```ts
+import { init, manifest } from '@c15t/browser';
+import { scripts } from './consent-scripts';
+
+const consent = init({
+  mode: manifest(),
+  scripts,
+});
+```
+
+Keep the mode from your quickstart. With
+`createConsentRuntime` from `c15t/runtime`, pass `scripts` to it instead.
+A kernel you create yourself needs a loader from
+`c15t/modules/script-loader`. Attach one loader per kernel. See
+[JavaScript scripts](https://v3.c15t.com/docs/frameworks/javascript/scripts).
+
+## Options
+
+| Option       | Default                                                     | Behavior                                                                                                                                     |
+| ------------ | ----------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
+| `dsn`        | None                                                        | Project DSN for deployments outside Vercel, set as `data-dsn`. Reports go to Vercel's vitals endpoint for that DSN.                          |
+| `mode`       | None                                                        | `'development'` loads the debug script. `'auto'` and `'production'` load the production script. The helper does not detect your environment. |
+| `debug`      | None                                                        | `true` loads `https://va.vercel-scripts.com/v1/speed-insights/script.debug.js`, which logs reports to the console and sends nothing.         |
+| `endpoint`   | None                                                        | Custom vitals endpoint, set as `data-endpoint`.                                                                                              |
+| `scriptUrl`  | `https://va.vercel-scripts.com/v1/speed-insights/script.js` | Loader URL override, such as `/_vercel/speed-insights/script.js` on Vercel. Takes precedence over `mode` and `debug`.                        |
+| `sampleRate` | `1`                                                         | Share of page loads that report, from `0` to `1`, set as `data-sample-rate`. Other values throw a `TypeError`.                               |
+| `beforeSend` | None                                                        | Edits or drops a report while measurement is allowed. Return the event, with a changed `url` if needed, or `null` to drop it.                |
+
+The helper also sets `data-sdkn="c15t"` on the script element. Without `dsn`
+or `endpoint`, the collector posts to `/_vercel/speed-insights/vitals` on your
+own origin, which exists only on Vercel deployments with Speed Insights on.
+
+## Loading and revocation
+
+`vercelSpeedInsights` uses the `measurement` category. When measurement becomes
+allowed, the helper defines the `window.siq` queue and a `window.si` stub,
+unless they exist, registers a `beforeSend` callback and loads the script.
+
+The collector keeps its listeners after its script element is removed and
+sends queued reports on `pagehide` and navigation. On revocation the helper
+removes the script element and its `beforeSend` callback starts returning
+`null`, so no report is sent, including during the reload c15t runs on
+revocation. A later grant re-adds the script, which does not start a second
+collector, and reports resume. Reports also stop when the provider that owns
+the scripts unmounts.
+
+The collector holds one `beforeSend` callback. Pass yours through the
+`beforeSend` option. Calling `window.si('beforeSend', ...)` yourself replaces
+the helper's consent check.
+
+Reports only cover page loads after consent. The collector reads buffered
+paint and navigation timings, but interactions before consent are missed. The
+helper does not set `data-route`, so Vercel groups reports by URL rather than
+by route pattern such as `/blog/[slug]`.
+
+## Verify Vercel Speed Insights
+
+Filter DevTools Network by `speed-insights`. After you allow measurement,
+`script.js` loads from `va.vercel-scripts.com` with `data-sdkn="c15t"`. Change
+route or switch tabs, and a `POST` to `/_vercel/speed-insights/vitals` follows.
+Automated browsers that set `navigator.webdriver` load the collector but send
+nothing. With `debug` or `mode: 'development'` the reports appear in the
+console instead.
+
+Test in a private window with an opt-in policy. Open DevTools Network, disable
+the cache and filter by the vendor's domain:
+
+1. Load the page. No request goes to the vendor before you choose.
+2. Click Reject, then reload. There is still no vendor request.
+3. Open Privacy settings and allow the helper's category. The vendor script
+   loads without a page reload.
+4. Turn the category off again and save. c15t reloads the page, and the new
+   page makes no vendor request.
+
+c15t reloads on revocation because removing a script element does not stop
+code that already ran. The vendor's listeners, timers and queued events stay
+alive until the page unloads. If you set `reloadOnConsentRevoked: false`, stop
+the vendor yourself. Register a callback-only script whose `onConsentChange`
+calls the vendor's opt-out API, as shown in
+[custom integrations](./building-integrations.md), and check the
+permission before each of your own event calls. The reload does not delete
+cookies the vendor already set; see
+[clear on revocation for your framework](./overview.md#vendor-switches-and-cookie-cleanup).
+
+The helper sets `vendor` to its script ID, so once you declare that vendor a
+visitor can turn it off inside an allowed category. See
+[vendor consent for your framework](./overview.md#vendor-switches-and-cookie-cleanup). The
+[consent verification guide](../guides/verify-consent.md) covers navigation,
+expiry and hosting checks.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@c15t/react",
-	"version": "3.0.0-alpha.10",
+	"version": "3.0.0-alpha.12",
 	"description": "React cookie banner, consent manager, preference center, and headless CMP components with IAB TCF and Consent Mode support.",
 	"keywords": [
 		"ccpa",
@@ -264,16 +264,16 @@
 		"test:watch": "bun prebuild && vitest"
 	},
 	"dependencies": {
-		"@c15t/core": "3.0.0-alpha.10",
-		"@c15t/dev-tools": "3.0.0-alpha.10",
-		"@c15t/iab": "3.0.0-alpha.10",
-		"@c15t/schema": "3.0.0-alpha.8",
+		"@c15t/core": "3.0.0-alpha.11",
+		"@c15t/dev-tools": "3.0.0-alpha.11",
+		"@c15t/iab": "3.0.0-alpha.11",
+		"@c15t/schema": "3.0.0-alpha.9",
 		"@c15t/translations": "3.0.0-alpha.6",
-		"@c15t/ui": "3.0.0-alpha.10",
+		"@c15t/ui": "3.0.0-alpha.12",
 		"@types/google.maps": "3.65.3"
 	},
 	"devDependencies": {
-		"@c15t/backend": "3.0.0-alpha.10",
+		"@c15t/backend": "3.0.0-alpha.12",
 		"@c15t/conformance": "0.0.1",
 		"@c15t/typescript-config": "0.0.1",
 		"@c15t/vitest-config": "1.0.0",