@c15t/react 3.0.0-alpha.4 → 3.0.0-alpha.6

package/docs/frameworks/react/gpp.md

@@ -0,0 +1,163 @@
+---
+title: IAB GPP
+description: Add the IAB Global Privacy Platform API (__gpp) to a React app with
+  ConsentGPP from @c15t/react/gpp, so ad tech can read US state opt-outs and the
+  TCF EU consent string.
+group: frameworks
+---
+
+## What GPP does
+
+`ConsentGPP` from `@c15t/react/gpp` installs `window.__gpp`, the GPP 1.1 CMP
+API, and keeps its GPP string in step with the visitor's choices. Prebid.js,
+Google Ad Manager and other ad tech read US privacy signals from it.
+
+## Turn on GPP
+
+Render `ConsentGPP` inside `ConsentProvider`:
+
+```tsx title="src/consent.tsx"
+import { ConsentGPP } from '@c15t/react/gpp';
+
+<ConsentProvider options={{ mode, scripts }}>
+	<ConsentGPP />
+	{children}
+</ConsentProvider>;
+```
+
+`ConsentGPP` renders nothing. It installs `__gpp` after it mounts and
+removes it when it unmounts. It lives in its own entry, like
+`@c15t/react/iab`, so apps that do not import it bundle none of the GPP
+code. `@c15t/react` already depends on `@c15t/iab`; with the `c15t`
+package, import from `c15t/react/gpp`.
+
+The props are the GPP options listed below, for example
+`<ConsentGPP usFallback="none" />`. It works the same with a runtime you
+pass to `ConsentProvider` as `runtime`.
+
+The GPP string follows the policy and location your backend resolves for the
+visitor, so a US visitor's state comes from the backend. With `offline()`
+mode, pass the state yourself, for example
+`overrides: { country: 'US', region: 'CA' }`.
+
+To add the TCF EU section for visitors under an `iab` policy, set up
+[IAB TCF](./iab.md) as well.
+
+## How the policy decides the section
+
+The policy rule c15t matched for the visitor decides whether a section
+applies. The visitor's location only picks which US section carries it.
+
+| Matched rule and visitor                                                                       | Section in the GPP string                                                  |
+| ---------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- |
+| `iab` rule, with IAB TCF set up                                                                | `tcfeuv2` (ID 2): the TC String the CMP confirmed, unchanged               |
+| `iab` rule, any visitor, with `tcf: false`                                                     | None; `applicableSections` is `[-1]`                                       |
+| Any other rule with the `preferences` or `opt-out` right, US visitor in a state with a section | That state's section, such as `usca` (ID 8)                                |
+| The same rule, US visitor whose region is unknown or whose state has no section                | `usnat` (ID 7), MSPA US National version 2; none with `usFallback: 'none'` |
+| The same rule, `usApproach: 'national'`                                                        | `usnat` for every US visitor                                               |
+| A rule without those rights, such as `none`                                                    | None                                                                       |
+| A visitor outside the US under any rule other than `iab`                                       | None                                                                       |
+
+Every `opt-in` and `opt-out` rule has the `preferences` right, and every
+`opt-out` rule also has `opt-out`. A `none` rule has them only if you add
+them. A rule that gives the visitor no way to opt out produces no US
+section, even when the visitor sends a GPC signal.
+
+State sections exist for California, Colorado, Connecticut, Delaware, Florida,
+Iowa, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon,
+Tennessee, Texas, Utah and Virginia. Indiana, Kentucky, Maryland and Rhode
+Island are not encoded yet: their published specifications start the section
+with a header that the IAB reference implementation does not encode. Visitors
+there get the fallback, `usnat` by default. So does a US visitor whose region
+the geo headers did not supply.
+
+The MSPA US National specification describes `usnat` for MSPA signatories
+that chose the national approach. Without `mspaMode`, c15t reports the
+fallback as a transaction the MSPA does not cover (`MspaCoveredTransaction:
+2`), which still carries the opt-outs to vendors such as Prebid.js. If you
+reserve `usnat` for the national approach, set `usFallback: 'none'`; those
+visitors then get no section until their state resolves.
+
+## What the US sections report
+
+* `SaleOptOut`, `SharingOptOut` and `TargetedAdvertisingOptOut`: `1` (opted
+  out) when the `marketing` category is not permitted, otherwise `2`. A
+  refusal, a GPC signal the rule maps to `marketing` through
+  `privacySignals.gpc`, and an opt-in rule without a grant all count.
+* The opt-out notices: `1` (given), since the rule offers an opt-out.
+* The sharing or processing notice: `1` when the rule has the `disclosure`
+  right, otherwise `2`.
+* `Gpc`: the browser's Global Privacy Control signal, in sections that have a
+  GPC subsection. It is reported even when the rule does not map GPC to a
+  category, so give US rules a `privacySignals.gpc` mapping if the opt-outs
+  should follow it too.
+* Sensitive data and known-child consents: `0` (not applicable). c15t has no
+  category for them, so the string states that you do not process sensitive
+  data or knowingly process children's data. If you do, GPP from c15t does
+  not describe your processing; collect and signal that consent separately.
+* `MspaCoveredTransaction`: `2` (not covered) unless you set `mspaMode`.
+
+The notice fields are your attestation, made through the rule's rights:
+c15t cannot see whether your privacy notice is on the page. Show the notices
+the rule promises, including a persistent opt-out control.
+
+## GPP options
+
+Every field is optional. Pass them in the `gpp` option, where `gpp: true`
+uses the defaults, as props on `ConsentGPP` in React, or to `mountGPP()` in
+`@c15t/browser`.
+
+| Option             | Default                             | Effect                                                                                                                                                                                                                          |
+| ------------------ | ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `cmpId`            | the IAB CMP ID c15t holds, else `1` | CMP ID reported by `ping`. The GPP specification has string creators without a registered ID, including MSPA US National creators, use `1`. A TCF EU section needs the registered ID its TC String names.                       |
+| `usApproach`       | `'state'`                           | `'state'` uses the visitor's state section. `'national'` reports `usnat` for every US visitor; the MSPA reserves it for signatories that chose the national approach.                                                           |
+| `usFallback`       | `'usnat'`                           | Under the state approach, the section for a US visitor whose state is unknown or has no section: `'usnat'` or `'none'`.                                                                                                         |
+| `mspaMode`         | unset                               | `'opt-out-option'` or `'service-provider'`. Set it only if you signed the IAB Multi-State Privacy Agreement; the transaction is then reported as covered. In service provider mode the opt-outs are reported as not applicable. |
+| `optOutCategories` | `['marketing']`                     | Categories whose refusal reports an opt-out of sale, sharing and targeted advertising.                                                                                                                                          |
+| `tcf`              | `true`                              | Include the `tcfeuv2` section under an `iab` policy. It needs IAB TCF set up as well.                                                                                                                                           |
+
+## Check the signal
+
+Open the browser console on a page with GPP on and call:
+
+```js
+__gpp('ping', (data) => console.log(data));
+```
+
+For a California visitor who has not opted out, the result includes
+`applicableSections: [8]`, `signalStatus: 'ready'` and
+`parsedSections.usca[0].SaleOptOut === 2`. After the visitor refuses
+`marketing`, `SaleOptOut` is `1`. `__gpp('getField', cb, 'usca.SaleOptOut')`
+returns the same value. Scripts in iframes reach the API through the
+`__gppLocator` frame and `postMessage`.
+
+Under an `iab` rule, `parsedSections.tcfeuv2` uses the field names of the
+IAB Europe TCF section, such as `PurposeConsent`, `VendorConsent` and
+`PubRestrictions`. `getSection` and `getField` answer `null` for `tcfeuv2`,
+as the IAB reference implementation does: TCF vendors read consent from
+events, not on demand.
+
+`signalStatus` stays `'not ready'` while the policy is pending, while the
+banner or dialog is open, while an `iab` rule has no confirmed TC String,
+and while a new TC String is decoded. Listeners added with
+`addEventListener` get `signalStatus: 'not ready'`, then `cmpDisplayStatus`
+and `sectionChange` events, then `signalStatus: 'ready'`.
+
+## Ad tags that load before c15t
+
+c15t installs `__gpp` in the browser once consent starts, after it loads the
+GPP code. Vendor scripts that call `__gpp` earlier need a stub. c15t takes over
+the calls and listeners a stub queued, whether the stub keeps listeners on
+`__gpp.events`, as the GPP specification's sample does, or returns them from
+`__gpp('events')`, as `@iabgpp/stub` does. Call `initializeGPPStub()` from
+`@c15t/iab/gpp` in your first script, or use the IAB's own stub snippet.
+When another stub already answers iframes, c15t leaves that to it, so each
+iframe call gets one reply.
+
+If a CMP that has already loaded owns `__gpp`, c15t leaves it in place.
+The `gpp` option reports the conflict to the `onError` callback,
+`ConsentGPP` logs it, and `mountGPP()` and `createGPP()` throw. Run one GPP
+CMP per page.
+
+GPP signals what the visitor chose; it does not block scripts. Gate vendor
+scripts with c15t's script loading as well.

package/docs/frameworks/react/headless.md

@@ -34,13 +34,13 @@ import { useHeadlessConsentUI, useTranslations } from 'c15t/react/headless';
 
 const ACTION_LABELS = {
 	accept: 'acceptAll',
-	reject: 'rejectAll',
 	customize: 'customize',
 	dismiss: 'acknowledge',
+	reject: 'rejectAll',
 	save: 'save',
 } as const;
 
-export function Banner() {
+export const Banner = () => {
 	const { banner, performAction, openDialog } = useHeadlessConsentUI();
 	const { common, rights } = useTranslations();
 
@@ -49,7 +49,7 @@ export function Banner() {
 	}
 
 	return (
-		<section role="region" aria-label="Privacy">
+		<section aria-label="Privacy">
 			{banner.preferenceControls.map((right) => (
 				<button key={right} type="button" onClick={openDialog}>
 					{right === 'opt-out' ? rights?.optOut : rights?.preferences}
@@ -71,7 +71,7 @@ export function Banner() {
 			))}
 		</section>
 	);
-}
+};
 ```
 
 `banner.actionGroups` is the resolved layout: reject and accept share a group

package/docs/frameworks/react/hooks.md

@@ -14,10 +14,10 @@ from components rendered inside that provider and import them from
 ```tsx title="src/optional-feature.tsx"
 import { useConsent } from 'c15t/react';
 
-export function OptionalFeature() {
+export const OptionalFeature = () => {
 	const allowed = useConsent('marketing');
 	return allowed ? <div>Optional marketing content</div> : null;
-}
+};
 ```
 
 Call hooks inside the consent provider. `useConsent` reads effective permission,
@@ -42,14 +42,19 @@ Render this component inside your existing `ConsentProvider`.
 ```tsx title="src/reject-button.tsx"
 import { useSaveConsents } from 'c15t/react';
 
-export function RejectButton() {
+export const RejectButton = () => {
 	const save = useSaveConsents();
 	return (
-		<button type="button" onClick={() => void save('none')}>
+		<button
+			type="button"
+			onClick={() => {
+				void save('none');
+			}}
+		>
 			Reject optional
 		</button>
 	);
-}
+};
 ```
 
 This is an isolated action example, not a complete policy-aware banner. Use the

package/docs/frameworks/react/iab.md

@@ -33,14 +33,12 @@ import {
 	IABConsentDialog,
 } from 'c15t/react/iab';
 
-export function IABConsent({ cmpId }: { cmpId: number }) {
-	return (
-		<IABProvider cmpId={cmpId}>
-			<IABConsentBanner />
-			<IABConsentDialog />
-		</IABProvider>
-	);
-}
+export const IABConsent = ({ cmpId }: { cmpId: number }) => (
+	<IABProvider cmpId={cmpId}>
+		<IABConsentBanner />
+		<IABConsentDialog />
+	</IABProvider>
+);
 ```
 
 Supply the CMP ID from your deployment's IAB configuration. Keep a persistent
@@ -85,14 +83,12 @@ const publisherRestrictions = [
 	{ purposeId: 7, restrictionType: 2 as const, vendorIds: [755] },
 ];
 
-export function IABConsent({ cmpId }: { cmpId: number }) {
-	return (
-		<IABProvider cmpId={cmpId} publisherRestrictions={publisherRestrictions}>
-			<IABConsentBanner />
-			<IABConsentDialog />
-		</IABProvider>
-	);
-}
+export const IABConsent = ({ cmpId }: { cmpId: number }) => (
+	<IABProvider cmpId={cmpId} publisherRestrictions={publisherRestrictions}>
+		<IABConsentBanner />
+		<IABConsentDialog />
+	</IABProvider>
+);
 ```
 
 Each restriction type has a requirement that depends on the vendor list:
@@ -154,8 +150,10 @@ because turning one off would change nothing the vendors rely on; its
 objection control is the opt-out. Such a purpose does not decide its c15t
 category: the category follows the purposes in it that the visitor can
 consent to. Legitimate interest never grants a category on its own. If none of
-a category's purposes has a consent basis, the category needs all of them
-consented, which only Accept All does. Stack switches
+a category's purposes has a consent basis, nothing can consent to them, Accept
+All included, so the category stays denied. See
+[categories under an IAB policy](../../concepts/consent-state.md#categories-under-an-iab-policy).
+Stack switches
 cover only the purposes some vendor processes on consent. Display-model rows
 expose this as `hasConsentBasis`. Custom preference UIs can call
 `applyPublisherRestrictionsToGVL` from `@c15t/iab/headless`, or pass
@@ -209,6 +207,14 @@ the special purposes only. `featureRows` holds the features, with
 `featuresStandardText` is the standard text, or `null` when you should use the
 translation.
 
+Each vendor's privacy policy and legitimate interest links come from its
+`urls[]` entry in the Global Vendor List. The stock preference centres pick
+the entry for the language the banner shows, then English. A custom UI gets
+the same links from `resolveIABVendorUrls(vendor, language)` in
+`@c15t/iab/headless`, or from `policyUrl` and `legitimateInterestUrl` on the
+vendors `processGVLForDialog` returns when you pass it `language`. Vendor lists
+older than GVL v3 have a single `policyUrl` field, which c15t still reads.
+
 ## Consent scope
 
 c15t stores TCF choices per site and browser, which the TCF calls

package/docs/frameworks/react/quickstart.md

@@ -8,8 +8,9 @@ group: frameworks
 ## Before you start
 
 This guide sets up a client-rendered React app built with Vite. The browser
-loads the page, asks the consent backend for the visitor's policy, then shows
-the banner or runs the scripts the visitor allowed.
+loads the page, resolves the visitor's policy, then shows the banner or runs
+the scripts the visitor allowed. The build-time step bundles the public
+policy; regional policies may still need a backend location request.
 
 * **Next.js or TanStack Start?** Use that framework's guide from the
   [framework list](https://c15t.com/docs/frameworks). Their adapters resolve consent on the
@@ -26,6 +27,10 @@ the backend URL.
 [Choose your setup](../../concepts/choose-your-setup.md#decide-who-runs-the-consent-backend)
 covers self-hosting and offline mode.
 
+Build-time manifests are the recommended production setup. Complete the
+[build-time manifest step](#bundle-the-manifest-during-builds) before
+deploying, and rebuild after changing policies, translations or vendors.
+
 ## Install c15t
 
 | Package manager | Command                                           |
@@ -40,14 +45,12 @@ vendor loaders used below.
 
 ## Register your vendor scripts
 
-Create `src/scripts.ts`. PostHog waits for measurement permission and X Pixel
-waits for marketing permission, so your policy must include both categories.
-Remove any other PostHog or X Pixel loader from your app so each vendor loads
-once.
+Create `src/scripts.ts`. PostHog waits for measurement permission, so your
+policy must include that category. Remove any other PostHog loader from your
+app so PostHog loads once.
 
 ```ts title="src/scripts.ts"
 import { posthog } from '@c15t/integrations/posthog';
-import { xPixel } from '@c15t/integrations/x-pixel';
 
 export const scripts = [
 	posthog({
@@ -55,13 +58,11 @@ export const scripts = [
 		initOptions: { cookieless_mode: 'never' },
 		loadMode: 'after-consent',
 	}),
-	xPixel({ pixelId: 'your-pixel-id' }),
 ];
 ```
 
-Replace `phc_your_project_key` with your PostHog project key and
-`your-pixel-id` with your X Pixel ID. PostHog uses its EU host; add
-`region: 'us'` for a US project. Remove the loader for a vendor you don't use.
+Replace `phc_your_project_key` with your PostHog project key. PostHog uses its
+EU host; add `region: 'us'` for a US project.
 
 `loadMode: 'after-consent'` keeps the PostHog SDK off the page until the
 visitor allows measurement. `cookieless_mode: 'never'` turns off PostHog's
@@ -130,6 +131,66 @@ router, render the router inside `Consent` so navigation does not remount the
 provider. The stylesheet import in `src/consent.tsx` styles the banner and
 dialog; import it once.
 
+## Bundle the manifest during builds
+
+The build fetches your public policy once and bundles it, so the server never
+fetches it at runtime.
+
+Add `consentManifest` to your existing Vite plugin list:
+
+```ts title="vite.config.ts (plugins option)"
+import { consentManifest } from 'c15t/build';
+
+export default {
+	plugins: [
+		// Keep your existing framework plugins here.
+		consentManifest({ backendURL: 'https://your-project.inth.app' }),
+	],
+};
+```
+
+Vite writes `src/c15t-manifest.ts` before compiling, including at development
+startup. Keep the generated file out of Git. Install `@c15t/browser@alpha` for
+its browser manifest transport. In the quickstart's `src/consent.tsx`, replace
+the `hosted()` mode with this factory:
+
+```tsx title="src/consent.tsx"
+import { manifest } from '@c15t/browser/headless';
+
+import { consentManifest } from './c15t-manifest';
+
+const mode = manifest({
+	backendURL: 'https://your-project.inth.app',
+	manifest: consentManifest,
+});
+```
+
+Keep passing `mode` to `ConsentProvider`. The browser resolves the snapshot
+without `/manifest` when it has the geography the policy needs, or the policy
+does not depend on geography. Supply known country and region through `inputs`
+or overrides to keep regional resolution on the snapshot.
+
+When the required country or region is missing, the transport calls backend
+`/init` and uses its resolved policy and translations. That response can use
+newer backend policy than the build snapshot. This is a full consent resolution,
+so these visitors still wait for a backend round trip.
+
+Policy and resolver code are part of the browser bundle.
+
+The snapshot is fixed at build time:
+
+* Rebuild after changing policies, translations or vendors. If your CI caches
+  build output, force a fresh build.
+* The build must reach the backend. A failed fetch fails the build.
+* Consent choices still go to the backend.
+
+Run `vite build` or `vite dev` before a standalone `tsc`, `vue-tsc` or
+`svelte-check`; the generated file doesn't exist on a fresh checkout.
+
+For policy updates without a rebuild, keep the original `hosted()` factory
+and omit the build plugin. That setup resolves policy through the backend
+`/init` on each page load.
+
 ## Gate your own features
 
 Read a category's permission with `useConsent` inside the provider:
@@ -155,16 +216,16 @@ then open the site in a private window with DevTools open on the Network tab.
 Test under a policy that asks for a choice, such as an EU opt-in policy.
 
 1. **Before a choice.** The banner shows. There are no requests to
-   `posthog.com` or `static.ads-twitter.com`.
+   `posthog.com`.
 2. **Reject All.** The banner closes and the vendor requests stay absent.
 3. **Reload.** The banner stays closed and the vendor requests stay absent.
 4. **Privacy settings.** The footer link opens the dialog with **Analytics** (the
-   `measurement` category) and **Marketing** off. Turn on **Analytics** and save. PostHog's `array.js` loads and
-   X Pixel stays absent.
+   `measurement` category) and **Marketing** off. Turn on **Analytics** and
+   save. PostHog's `array.js` loads.
 5. **Turn Analytics off again.** The page reloads and PostHog does not load.
 
-If the banner never appears, check the Network tab for the request to
-`/init` on your backend URL. [Troubleshooting](./troubleshooting.md)
+If the banner never appears, check the generated policy and any location
+request to `/init` on your backend URL. [Troubleshooting](./troubleshooting.md)
 covers the common causes. [Verify consent](../../guides/verify-consent.md) has the
 full release checklist.
 

package/docs/frameworks/react/rendering.md

@@ -23,14 +23,79 @@ read the visitor's cookie and location on the server, so the banner can be in
 the first HTML. [Choose your setup](../../concepts/choose-your-setup.md#server-rendering-or-browser-rendering)
 explains the difference in general terms.
 
+## Bundle the manifest during Vite builds
+
+The build fetches your public policy once and bundles it, so the server never
+fetches it at runtime.
+
+Add `consentManifest` to your existing Vite plugin list:
+
+```ts title="vite.config.ts (plugins option)"
+import { consentManifest } from 'c15t/build';
+
+export default {
+	plugins: [
+		// Keep your existing framework plugins here.
+		consentManifest({ backendURL: 'https://your-project.inth.app' }),
+	],
+};
+```
+
+Vite writes `src/c15t-manifest.ts` before compiling, including at development
+startup. Keep the generated file out of Git. Install `@c15t/browser@alpha` for
+its browser manifest transport. In the quickstart's `src/consent.tsx`, replace
+the `hosted()` mode with this factory:
+
+```tsx title="src/consent.tsx"
+import { manifest } from '@c15t/browser/headless';
+
+import { consentManifest } from './c15t-manifest';
+
+const mode = manifest({
+	backendURL: 'https://your-project.inth.app',
+	manifest: consentManifest,
+});
+```
+
+Keep passing `mode` to `ConsentProvider`. The browser resolves the snapshot
+without `/manifest` when it has the geography the policy needs, or the policy
+does not depend on geography. Supply known country and region through `inputs`
+or overrides to keep regional resolution on the snapshot.
+
+When the required country or region is missing, the transport calls backend
+`/init` and uses its resolved policy and translations. That response can use
+newer backend policy than the build snapshot. This is a full consent resolution,
+so these visitors still wait for a backend round trip.
+
+Policy and resolver code are part of the browser bundle.
+
+The snapshot is fixed at build time:
+
+* Rebuild after changing policies, translations or vendors. If your CI caches
+  build output, force a fresh build.
+* The build must reach the backend. A failed fetch fails the build.
+* Consent choices still go to the backend.
+
+Run `vite build` or `vite dev` before a standalone `tsc`, `vue-tsc` or
+`svelte-check`; the generated file doesn't exist on a fresh checkout.
+
+For policy updates without a rebuild, keep the original `hosted()` factory
+and omit the build plugin. That setup resolves policy through the backend
+`/init` on each page load.
+
 ## Client-rendered apps
 
-The [quickstart](./quickstart.md) setup runs entirely in the
-browser:
+The recommended [quickstart](./quickstart.md) bundles the
+manifest and resolves it in the browser. See [build-time manifests](#bundle-the-manifest-during-vite-builds).
+
+For policy updates without rebuilding, keep `hosted({ url })`. That runtime
+path works as follows:
 
 1. The page loads with no consent state. Every optional category is denied.
-2. `ConsentProvider` requests `GET /init` from your backend URL. The backend
-   picks the visitor's policy from their location.
+2. `ConsentProvider` requests `GET /init` from your backend URL while it first
+   renders, before the page paints. The backend picks the visitor's policy
+   from their location. With an `experiment`, the request waits until the
+   provider mounts, because it carries the visitor's arm.
 3. The provider applies the policy and any stored choice. It shows the banner
    if the policy asks for one, and loads the scripts the visitor allowed.
 
@@ -47,8 +112,11 @@ around the outlet. In React Router framework mode that is `app/root.tsx`.
 browser takes over after hydration:
 
 * The server HTML contains your page but no banner and no consent state.
-* After hydration the browser requests `/init`, then shows the banner if the
-  policy asks for one.
+* After hydration the browser resolves the bundled manifest, then shows the
+  banner if the policy asks for one. When required country or region is
+  missing, it calls `/init` and uses the backend's current policy and
+  translations, which can differ from the build snapshot. With `hosted()`,
+  it always calls `/init`.
 * The server render and the first browser render agree, so hydration does not
   warn or change a stored choice.
 
@@ -96,8 +164,9 @@ browser path.
 ## Static and prerendered pages
 
 A prerendered page is the same HTML for every visitor, so it cannot contain one
-visitor's consent. Use the quickstart setup unchanged. The browser talks to the
-backend URL directly, so the static host needs no server route. Add the site's
+visitor's consent. Use the quickstart's build-time snapshot. Consent saves and
+any `/init` requests go to the backend URL directly, so the static host
+needs no server route. Add the site's
 origin to the trusted origins in your Inth project.
 
 Do not cache a response that contains a visitor's consent in a CDN or a shared
@@ -122,7 +191,9 @@ custom transports.
 1. Open the page in a private window and view the page source. In a
    server-rendered app the HTML contains your content and no element with
    `data-testid="consent-banner-root"`.
-2. In DevTools Network, filter by your backend URL. One `/init` request runs
-   after the JavaScript loads, or none if you pass `initialData`.
-3. The banner appears once that request finishes. Vendor requests stay absent
+2. In DevTools Network, confirm there is no `/manifest` request with a
+   build-time snapshot. A regional policy may still need an `/init` request
+   to resolve consent when geography is missing. With `hosted()`, one `/init`
+   request runs unless you supply `initialData`.
+3. The banner appears once the policy resolves. Vendor requests stay absent
    until you allow their category.

package/docs/frameworks/react/scripts.md

@@ -11,11 +11,10 @@ group: frameworks
 Pass vendor loaders to `ConsentProvider` through `options.scripts`. The
 provider loads each script when its category is allowed and removes it when
 the category is denied. The [quickstart](./quickstart.md)
-registers PostHog and X Pixel this way:
+registers PostHog this way:
 
 ```ts title="src/scripts.ts"
 import { posthog } from '@c15t/integrations/posthog';
-import { xPixel } from '@c15t/integrations/x-pixel';
 
 export const scripts = [
 	posthog({
@@ -23,7 +22,6 @@ export const scripts = [
 		initOptions: { cookieless_mode: 'never' },
 		loadMode: 'after-consent',
 	}),
-	xPixel({ pixelId: 'your-pixel-id' }),
 ];
 ```
 
@@ -76,6 +74,13 @@ covers a vendor without one.
   load before consent and pass the visitor's choice to the vendor. Read the
   vendor's guide; a category on a script does not always mean zero requests.
 
+## When the script loader downloads
+
+The script loader is a separate chunk, downloaded only when `scripts` is not
+empty. `ConsentProvider` loads it when it mounts. The Next.js and TanStack
+Start `ConsentRoot` start the download earlier, during their first render,
+when the visitor's consent already lets a script run.
+
 ## Embeds and other requests
 
 Scripts cover vendor code c15t loads for you. For the rest: