@c15t/react 3.1.0 → 3.2.0-canary.0

package/docs/concepts/modes.md

@@ -1,6 +1,6 @@
 ---
 title: Consent modes
-description: Reference for manifest(), hosted() and offline() in every c15t
+description: Reference for manifest(), hosted() and local() in every c15t
   framework package, where each one resolves the visitor's policy, what it adds
   to first-load JavaScript, the build-time manifest fetch and its failure
   policy, and the backend URL variable each framework reads.
@@ -11,7 +11,8 @@ group: concepts
 
 A mode decides how c15t finds the policy that applies to a visitor. Every
 framework package exports the same three factories, `manifest()`, `hosted()`
-and `offline()`. Consent choices go to the backend in `manifest()` and
+and `local()`. `local()` was called `offline()` before c15t 3.2, and the old
+name still works until c15t v4. Consent choices go to the backend in `manifest()` and
 `hosted()`, whether that backend is [Inth](https://inth.com) or a
 [self-hosted c15t backend](https://c15t.com/docs/self-host/quickstart).
 
@@ -19,7 +20,7 @@ and `offline()`. Consent choices go to the backend in `manifest()` and
 | ------------------------- | ------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `manifest()`, the default | Your server, from the policy the build downloaded. With `resolve: 'browser'`, or in a single-page app, the browser. | None to resolve the policy, unless the browser needs a location it doesn't have. Choices post to `/subjects`. | Server-rendered apps. Rebuild to ship policy changes, or set `source: 'runtime'`.                                                                             |
 | `hosted()`                | The backend's `GET /init`                                                                                           | One `/init` per page that resolves consent.                                                                   | Single-page apps and static hosting without a server, where the backend reads each visitor's location from the request. Policy edits apply without a rebuild. |
-| `offline()`               | The browser, from rules in your bundle                                                                              | None. Choices stay in the browser.                                                                            | Local development, tests and demos. Not recommended for production environments.                                                                              |
+| `local()`                 | The browser, from rules in your bundle                                                                              | None. Choices stay in the browser, and c15t keeps no server-side record of consent.                           | Local development, tests and demos. Not recommended for production environments.                                                                              |
 
 `manifest()` is the default in Next.js, TanStack Start, Nuxt, Astro and
 SvelteKit. React, Vue, Svelte and `@c15t/browser` have no default: pass a
@@ -38,18 +39,18 @@ custom transport and same-origin proxies.
 There are two kinds of factory, and each framework package exports the kind it
 needs under the same three names.
 
-| Framework      | Import from           | Pass the mode to                                                                                                                | Kind      |
-| -------------- | --------------------- | ------------------------------------------------------------------------------------------------------------------------------- | --------- |
-| Next.js        | `c15t/next`           | `mode` in `c15t.config.ts`                                                                                                      | Data      |
-| TanStack Start | `c15t/tanstack-start` | `createConsentStateHandler({ mode })`                                                                                           | Data      |
-| Nuxt           | `c15t/vue`            | `c15t.mode` in `nuxt.config.ts`                                                                                                 | Data      |
-| Astro          | `c15t/astro`          | `c15t({ mode })` in `astro.config.mjs`                                                                                          | Data      |
-| SvelteKit      | `@c15t/svelte/kit`    | `c15tHandle({ mode })` in `src/hooks.server.ts`                                                                                 | Data      |
-| React          | `c15t/react`          | `ConsentProvider`'s `options.mode`                                                                                              | Transport |
-| Vue            | `c15t/vue/vue-plugin` | `app.use(c15tVue, { mode })`                                                                                                    | Transport |
-| Svelte         | `@c15t/svelte`        | `<ConsentProvider mode={...}>`                                                                                                  | Transport |
-| JavaScript     | `@c15t/browser`       | `init({ mode })`                                                                                                                | Transport |
-| Script tag     | none                  | The bundle file: `c15t.js` is hosted, `c15t.offline.js` offline. The headless and IAB scripts also take `data-mode="manifest"`. | Name      |
+| Framework      | Import from           | Pass the mode to                                                                                                            | Kind      |
+| -------------- | --------------------- | --------------------------------------------------------------------------------------------------------------------------- | --------- |
+| Next.js        | `c15t/next`           | `mode` in `c15t.config.ts`                                                                                                  | Data      |
+| TanStack Start | `c15t/tanstack-start` | `createConsentStateHandler({ mode })`                                                                                       | Data      |
+| Nuxt           | `c15t/vue`            | `c15t.mode` in `nuxt.config.ts`                                                                                             | Data      |
+| Astro          | `c15t/astro`          | `c15t({ mode })` in `astro.config.mjs`                                                                                      | Data      |
+| SvelteKit      | `c15t/svelte/kit`     | `c15tHandle({ mode })` in `src/hooks.server.ts`                                                                             | Data      |
+| React          | `c15t/react`          | `ConsentProvider`'s `options.mode`                                                                                          | Transport |
+| Vue            | `c15t/vue/vue-plugin` | `app.use(c15tVue, { mode })`                                                                                                | Transport |
+| Svelte         | `c15t/svelte`         | `<ConsentProvider mode={...}>`                                                                                              | Transport |
+| JavaScript     | `@c15t/browser`       | `init({ mode })`                                                                                                            | Transport |
+| Script tag     | none                  | The bundle file: `c15t.js` is hosted, `c15t.local.js` local. The headless and IAB scripts also take `data-mode="manifest"`. | Name      |
 
 **Data factories** return a plain object such as `{ type: 'manifest' }`.
 Server-rendered frameworks read their config on the server and in the
@@ -86,7 +87,7 @@ holds your policy rules and copy, and no visitor data.
 | `inputs`      | none       | `{ country, region }` when the page already knows the visitor's location, for example from an edge worker. Browser resolution only.                                                                                                 |
 
 The transport `manifest()` from `c15t/react`, `c15t/vue/vue-plugin`,
-`@c15t/svelte` and `@c15t/browser` always resolves in the browser, so it has
+`c15t/svelte` and `@c15t/browser` always resolve in the browser, so they have
 no `resolve` option. It also takes `backendURL`, `headers`, `credentials`,
 `domain`, `fetch` and `initFallback`. With no options it reads the snapshot
 and the backend URL your build integration downloaded. With `manifestURL`,
@@ -98,7 +99,7 @@ know the country or region, browser resolution asks `geoURL`, then the
 backend's `/init`. Set `initFallback: false` to resolve for an unknown location
 instead. A policy with location rules therefore saves no request in a
 single-page app unless you pass `inputs` or `geoURL`. The `consentManifest()`
-plugins from `c15t/build`, `c15t/vue/vite` and `@c15t/svelte/vite` warn
+plugins from `c15t/build`, `c15t/vue/vite` and `c15t/svelte/vite` warn
 about this when a single-page app build bundles such a policy.
 
 ## hosted()
@@ -122,36 +123,85 @@ against and the backend can reject a save made against a stale policy.
 `backendURL`. The framework exports fill it in from your config or your
 build.
 
-## offline()
+## local()
 
 Not recommended for production environments.
 
-`offline()` resolves policy rules in the browser and stores choices in browser
-storage. Nothing reaches a backend, so there is no consent record, no
-cross-device history and no IP geolocation.
+`local()` resolves policy rules in the browser and stores choices in browser
+storage. Nothing reaches a backend, so c15t keeps no server-side record of
+consent. There is also no cross-device history, and with no IP geolocation
+every visitor gets the policy for an unknown location unless you pass
+`overrides`.
 
-| Option        | Default                   | Behavior                                                    |
-| ------------- | ------------------------- | ----------------------------------------------------------- |
-| `policyRules` | the recommended rule pack | Rules to resolve. Passing rules replaces the pack entirely. |
+| Option                 | Default                   | Behavior                                                                       |
+| ---------------------- | ------------------------- | ------------------------------------------------------------------------------ |
+| `policyRules`          | the recommended rule pack | Rules to resolve. Passing rules replaces the pack entirely.                    |
+| `acknowledgeNoRecords` | `false`                   | `true` hides the development warning described below. It changes nothing else. |
 
 Unknown country and region are real inputs: test the missing-location case
 against your rules. See [policy rules](./policies.md).
 
+### The development warning
+
+In a development build, local mode logs one `console.warn` per page load:
+
+```txt
+[c15t] Local mode keeps consent only in this browser. c15t keeps no
+server-side record of consent. Local mode also has no geolocation, so
+every visitor gets the same policy. Use it for development and tests. For
+production, see https://c15t.com/docs/concepts/modes
+Set acknowledgeNoRecords: true to hide this message.
+```
+
+Production builds never log it, and it never blocks the banner or a save.
+The script-tag files are production builds, so `c15t.local.js`, and
+`c15t.headless.js` or `c15t.iab.js` without a backend URL, log it on
+development hosts instead:
+`localhost`, `127.0.0.1`, `[::1]`, `0.0.0.0` and names ending in
+`.localhost`, `.local` or `.test`. A script tag hides it with
+`data-acknowledge-no-records`.
+
+Set `acknowledgeNoRecords: true` once you have decided a browser-only record is
+enough, such as in tests, or on a site that keeps its own record through
+[callbacks](https://c15t.com/docs/frameworks/javascript/callbacks) or a [`custom()` transport](./data-fetching.md#can-i-provide-my-own-transport):
+
+```ts
+import { local } from 'c15t/react';
+
+const mode = local({ acknowledgeNoRecords: true });
+```
+
+c15t v4 removes the `offline()` name and makes `acknowledgeNoRecords: true`
+required in `local()`'s type.
+
+### What a consent record proves
+
+A consent record is the backend's copy of a choice: which categories the
+visitor granted or denied, when, and against which policy and copy. Under the
+GDPR, the business that relies on consent must be able to show that the
+visitor gave it (Article 7(1)). Browser storage alone cannot do that: the
+visitor can clear it, and it never leaves their device.
+
+`manifest()` and `hosted()` post each choice to the backend, which keeps the
+record. To keep records without Inth, run a
+[self-hosted backend](https://c15t.com/docs/self-host/overview), or send each choice to your
+own API with `custom()`.
+
 ## What each mode adds to first-load JavaScript
 
 In a server-rendered framework, the browser receives the resolved state with
 the page. It only needs the code to save a choice, and loads the rest when it
 runs:
 
-| Mode                               | First-load JavaScript                                  | Loaded with `import()` when it runs                                                                                                           |
-| ---------------------------------- | ------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------- |
-| `manifest()`                       | The code that saves choices and builds an init request | The hosted init path, if the browser has to resolve consent again                                                                             |
-| `manifest({ resolve: 'browser' })` | The code that saves choices                            | The browser resolver, English copy and the fetch of `${routePrefix}/manifest` or `${backendURL}/manifest`. Other languages load per language. |
-| `hosted()`                         | The code that saves choices                            | The hosted init path                                                                                                                          |
-| `offline()`                        | Nothing mode-specific                                  | The offline transport, the rule pack and its copy                                                                                             |
+| Mode                               | First-load JavaScript                                  | Loaded with `import()` when it runs                                                                                                                                                             |
+| ---------------------------------- | ------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `manifest()`                       | The code that saves choices and builds an init request | The hosted init path, if the browser has to resolve consent again                                                                                                                               |
+| `manifest({ resolve: 'browser' })` | The code that saves choices                            | The browser resolver, English copy and the fetch of `${routePrefix}/manifest` or `${backendURL}/manifest`, unless the server state already holds the policy. Other languages load per language. |
+| `hosted()`                         | The code that saves choices                            | The hosted init path                                                                                                                                                                            |
+| `local()`                          | Nothing mode-specific                                  | The local transport, the rule pack and its copy                                                                                                                                                 |
 
 With `manifest()` resolved on the server, the manifest snapshot, the resolver,
-the offline rule pack and other languages stay out of the browser bundle.
+the local rule pack and other languages stay out of the browser bundle.
 
 In a single-page app the bundle contains the mode you imported:
 
@@ -159,7 +209,7 @@ In a single-page app the bundle contains the mode you imported:
 | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
 | `manifest()` | The snapshot, when the build downloaded one, and the code that saves choices. The resolver starts loading when `manifest()` runs, unless the policy needs a location the page does not know. English copy is bundled; other languages load the first time a visitor needs one. |
 | `hosted()`   | The hosted transport                                                                                                                                                                                                                                                           |
-| `offline()`  | The offline transport, the recommended rule pack and its copy                                                                                                                                                                                                                  |
+| `local()`    | The local transport, the recommended rule pack and its copy                                                                                                                                                                                                                    |
 
 ## Set the backend URL
 
@@ -204,7 +254,7 @@ build integration downloads from `${backendURL}/manifest`:
 | TanStack Start       | `consentManifest()` from `c15t/tanstack-start/build`                | `@c15t/tanstack-start/build` |
 | React and JavaScript | `consentManifest()` from `c15t/build`                               | `@c15t/core/build`           |
 | Vue                  | `consentManifest()` from `c15t/vue/vite`                            | `@c15t/vue/vite`             |
-| Svelte and SvelteKit | `consentManifest()` from `@c15t/svelte/vite`                        | `@c15t/svelte/vite`          |
+| Svelte and SvelteKit | `consentManifest()` from `c15t/svelte/vite`                         | `@c15t/svelte/vite`          |
 | Nuxt                 | the `c15t/vue` module                                               | `@c15t/vue`                  |
 | Astro                | the `c15t()` integration                                            | `@c15t/astro`                |
 
@@ -266,13 +316,13 @@ snapshot:
 * The backend URL is relative, such as `/api/c15t`. With an explicit
   `onBuildError: 'fail'`, a relative URL stops the build instead.
 * Next.js builds with `output: 'export'`, which has no server.
-* The mode is `hosted()`, `offline()`, `manifest({ snapshot })` or
+* The mode is `hosted()`, `local()`, `manifest({ snapshot })` or
   `manifest({ source: 'runtime' })` in Next.js, Nuxt and Astro. Next.js reads
   the mode from `c15t.config.ts`.
 * A single-page app built with Vite (React, Vue, Svelte, JavaScript) does
   not use `manifest()`. The mode is set in app code, so the plugin downloads
   the manifest only once the bundle turns out to read it, after unused code
-  is dropped. A `hosted()` or `offline()` build never contacts the backend.
+  is dropped. A `hosted()` or `local()` build never contacts the backend.
   SvelteKit and TanStack Start choose the mode on the server at runtime, so
   their builds always download it.
 

package/docs/customization/recipes.md

@@ -86,7 +86,7 @@ Render `CookieBanner` in place of `ConsentBanner`, inside
 
 ```svelte title="src/lib/cookie-banner.svelte"
 <script lang="ts">
-	import { ConsentBanner } from '@c15t/svelte';
+	import { ConsentBanner } from 'c15t/svelte';
 </script>
 
 <!-- The stock banner, drawn as a full-width bar along the bottom edge. -->
@@ -250,7 +250,7 @@ Svelte scopes component styles, so the classes live in a global
 stylesheet.
 
 ```ts title="src/lib/consent-options.ts"
-import type { ConsentManagerOptions } from '@c15t/svelte';
+import type { ConsentManagerOptions } from 'c15t/svelte';
 
 import './slim-bar.css';
 
@@ -456,8 +456,8 @@ opens.
 
 ```svelte title="src/lib/cookie-bar.svelte"
 <script lang="ts">
-	import { getHeadlessConsent } from '@c15t/svelte';
-	import type { PresentationAction } from '@c15t/svelte';
+	import { getHeadlessConsent } from 'c15t/svelte';
+	import type { PresentationAction } from 'c15t/svelte';
 
 	import './cookie-bar.css';
 

package/docs/customization/stylesheets.md

@@ -69,7 +69,7 @@ render. The elements stay after the surface unmounts. The Svelte dialog's
 sheets, its rules and the primitives, load with the dialog's code.
 
 On a server-rendered SvelteKit page, the banner leaves a
-`<meta name="c15t-styles">` marker, and `c15tHandle` from `@c15t/svelte/kit`
+`<meta name="c15t-styles">` marker, and `c15tHandle` from `c15t/svelte/kit`
 writes the sheets into the HTML `<head>` as `<style>` elements. The banner is
 styled before hydration with no stylesheet request. Without `c15tHandle` in
 `src/hooks.server.ts`, a server-rendered banner shows unstyled until
@@ -109,7 +109,7 @@ need control over the file:
 | Next.js           | `options.styles` in `c15t.config.ts` or on `ConsentRoot` | `c15t/next/styles.css`, and `c15t/next/iab/styles.css` for IAB TCF                     |
 | TanStack Start    | `options.styles` on `ConsentRoot`                        | `c15t/tanstack-start/styles.css`, and `c15t/tanstack-start/iab/styles.css` for IAB TCF |
 | React             | `options.styles` on `ConsentProvider`                    | `c15t/react/styles.css`, and `c15t/react/iab/styles.css` for IAB TCF                   |
-| Svelte, SvelteKit | `options.styles` on `ConsentProvider` or `ConsentRoot`   | `@c15t/svelte/styles.css`, and `@c15t/svelte/iab/styles.css` for IAB TCF               |
+| Svelte, SvelteKit | `options.styles` on `ConsentProvider` or `ConsentRoot`   | `c15t/svelte/styles.css`, and `c15t/svelte/iab/styles.css` for IAB TCF                 |
 | Astro             | `styles` in the `c15t()` integration options             | See [load Astro's stylesheets yourself](#load-astros-stylesheets-yourself)             |
 
 ```ts title="c15t.config.ts (Next.js)"
@@ -132,7 +132,7 @@ the first paint. Remove the import, or add `styles: false` if you need it.
 | Next.js, TanStack Start, React | In the dialog sheet that `ConsentDialog` and `ConsentWidget` render. It ships with the dialog's lazily loaded code. With `styles: false`, in `styles.css`. No `@c15t/react` or `@c15t/ui` module imports CSS, so a Next.js app that uses only the Pages Router builds without `transpilePackages`                                                                                                                                           |
 | Nuxt, Vue                      | The dialog component imports its stylesheet, so the rules load with the dialog's code, not the banner's                                                                                                                                                                                                                                                                                                                                     |
 | Astro                          | In `@c15t/ui/styles/sheets/dialog.css`. The Svelte dialog, the default `ui`, also needs the primitives stylesheet. c15t links both when a visitor first points at, focuses or opens a control that opens the dialog, waits for them before it shows the dialog, and keeps them across `ClientRouter` navigation. On a Tailwind CSS 3 site, the dialog's rules are in `c15t/astro/styles.css`, and c15t links only the primitives stylesheet |
-| Svelte, SvelteKit              | In the dialog's sheets, which load with the dialog's code. With `styles: false`, in `@c15t/svelte/styles.css`                                                                                                                                                                                                                                                                                                                               |
+| Svelte, SvelteKit              | In the dialog's sheets, which load with the dialog's code. With `styles: false`, in `c15t/svelte/styles.css`                                                                                                                                                                                                                                                                                                                                |
 | HTML, JavaScript               | Part of the stylesheet in the shadow root, which holds only the rules the stock surfaces use                                                                                                                                                                                                                                                                                                                                                |
 
 `styles.css` still holds every stock surface's rules for apps that set

package/docs/customization/tailwind.md

@@ -31,7 +31,7 @@ fixture. The Next.js 15 and webpack fixtures use the same files. The check
 confirms that c15t's banner and dialog keep their styles under Tailwind's
 preflight, that a padding utility on the banner root
 beats c15t's own padding, and that the `dark:` variant applies. The fixtures run
-without a backend, so they use `offline()` mode or a local `backendURL`. Keep the
+without a backend, so they use `local()` mode or a local `backendURL`. Keep the
 `mode` or `backendURL` from your quickstart.
 
 ## Set up Tailwind CSS 4
@@ -165,13 +165,13 @@ when it opens, so the CSS entry holds only Tailwind. Add
 import svelte from '@astrojs/svelte';
 import tailwindcss from '@tailwindcss/vite';
 import { defineConfig } from 'astro/config';
-import c15t, { offline } from 'c15t/astro';
+import c15t, { local } from 'c15t/astro';
 
 export default defineConfig({
 	integrations: [
 		svelte(),
 		c15t({
-			mode: offline({
+			mode: local({
 				policyRules: [
 					{
 						id: 'tailwind-matrix',
@@ -264,11 +264,10 @@ detects Tailwind 3 and links `c15t/astro/styles.css` itself. Every c15t
 package that ships a stylesheet exports the plugin as
 `<package>/postcss-tailwind3`, so use the one from the package you installed:
 
-| You installed                                             | Plugin name                       |
-| --------------------------------------------------------- | --------------------------------- |
-| `c15t` (React, Next.js, TanStack Start, Vue, Nuxt, Astro) | `c15t/postcss-tailwind3`          |
-| `@c15t/svelte` (Svelte, SvelteKit)                        | `@c15t/svelte/postcss-tailwind3`  |
-| `@c15t/browser` (script tag in the light DOM)             | `@c15t/browser/postcss-tailwind3` |
+| You installed                                                                | Plugin name                       |
+| ---------------------------------------------------------------------------- | --------------------------------- |
+| `c15t` (React, Next.js, TanStack Start, Vue, Nuxt, Astro, Svelte, SvelteKit) | `c15t/postcss-tailwind3`          |
+| `@c15t/browser` (script tag in the light DOM)                                | `@c15t/browser/postcss-tailwind3` |
 
 They are the same plugin. A config that already lists
 `@c15t/ui/postcss-tailwind3` keeps working.
@@ -303,17 +302,9 @@ class. Add the important modifier to utilities you pass to c15t parts:
 `!bg-red-500`, `hover:!bg-red-500`. A bare `bg-red-500` has no effect. Theme
 tokens work the same on Tailwind 3 and 4.
 
-In React and Next.js apps, `c15t setup` adds the plugin and the stylesheet
-import when it finds Tailwind 3, but does not set `styles: false`. Add that
-yourself. It replaces an existing
-`styles.tw3.css` import from an earlier setup with `styles.css`. When it
-cannot edit your PostCSS config, it prints the step to do by hand. See
-[setup](https://c15t.com/docs/cli/commands/setup#set-up-styles-and-tailwind-css).
-
 Create React App ignores PostCSS config files, so Tailwind 3 cannot run the
-plugin and the build fails on c15t's stylesheet. `c15t setup` warns
-about this. Add the plugin before `tailwindcss` through CRACO, eject, or move
-the app to Vite.
+plugin and the build fails on c15t's stylesheet. Add the plugin before
+`tailwindcss` through CRACO, eject, or move the app to Vite.
 
 **Next.js**
 
@@ -521,11 +512,7 @@ stylesheet:
 
 ```js title="postcss.config.mjs"
 export default {
-	plugins: {
-		'@c15t/svelte/postcss-tailwind3': {},
-		tailwindcss: {},
-		autoprefixer: {},
-	},
+	plugins: { 'c15t/postcss-tailwind3': {}, tailwindcss: {}, autoprefixer: {} },
 };
 ```
 
@@ -540,13 +527,13 @@ export default {
 } satisfies Config;
 ```
 
-Import `@c15t/svelte/styles.css` above the directives, import this
+Import `c15t/svelte/styles.css` above the directives, import this
 stylesheet from `src/main.ts`, and pass `styles={false}` to
 `ConsentProvider`:
 
 ```css title="src/app.css"
 /* Vite ignores an @import below other rules, so it goes first. */
-@import '@c15t/svelte/styles.css';
+@import 'c15t/svelte/styles.css';
 
 @tailwind base;
 @tailwind components;
@@ -557,11 +544,7 @@ stylesheet from `src/main.ts`, and pass `styles={false}` to
 
 ```js title="postcss.config.mjs"
 export default {
-	plugins: {
-		'@c15t/svelte/postcss-tailwind3': {},
-		tailwindcss: {},
-		autoprefixer: {},
-	},
+	plugins: { 'c15t/postcss-tailwind3': {}, tailwindcss: {}, autoprefixer: {} },
 };
 ```
 
@@ -576,13 +559,13 @@ export default {
 } satisfies Config;
 ```
 
-Import `@c15t/svelte/styles.css` above the directives, import this
+Import `c15t/svelte/styles.css` above the directives, import this
 stylesheet from your root `+layout.svelte`, and pass `styles={false}` to
 `ConsentRoot`:
 
 ```css title="src/app.css"
 /* Vite ignores an @import below other rules, so it goes first. */
-@import '@c15t/svelte/styles.css';
+@import 'c15t/svelte/styles.css';
 
 @tailwind base;
 @tailwind components;
@@ -792,7 +775,7 @@ stylesheet, and the layer order keeps it above preflight:
 
 ```html title="light-dom.html"
 <script
-	src="/c15t.offline.js"
+	src="/c15t.local.js"
 	data-mode="offline"
 	data-country="DE"
 	data-shadow="false"
@@ -814,7 +797,7 @@ instead:
 	window.c15t = [['config', { ui: { shadow: false, styles: false } }]];
 </script>
 <script
-	src="/c15t.offline.js"
+	src="/c15t.local.js"
 	data-mode="offline"
 	data-country="DE"
 	defer

package/docs/customization/translations.md

@@ -35,7 +35,7 @@ Nuxt module have no `i18n` option; their copy comes from the backend.
 
 c15t bundles English. Every other language it ships is a separate entry point
 in `@c15t/translations`, named by its language code. Importing one registers
-c15t's built-in copy for that language. Offline mode can then switch to it,
+c15t's built-in copy for that language. Local mode can then switch to it,
 and your messages that repeat its wording don't hide backend edits. Import
 them in the file that configures the provider, so they load in the browser:
 
@@ -51,9 +51,11 @@ string or build your messages from it:
 import { translations as de } from '@c15t/translations/de';
 ```
 
-The entries are `bg`, `cs`, `cy`, `da`, `de`, `el`, `es`, `et`, `fi`, `fr`,
-`ga`, `gu`, `he`, `hi`, `hr`, `hu`, `id`, `is`, `it`, `lb`, `lt`, `lv`, `mt`,
-`nb`, `nl`, `nn`, `pl`, `pt`, `rm`, `ro`, `sk`, `sl`, `sv` and `zh`.
+The entries are `ar`, `bg`, `bn`, `cs`, `cy`, `da`, `de`, `el`, `es`, `et`,
+`fi`, `fr`, `ga`, `gu`, `he`, `hi`, `hr`, `ht`, `hu`, `id`, `is`, `it`, `ja`,
+`kn`, `ko`, `lb`, `lt`, `lv`, `ml`, `mr`, `ms`, `mt`, `nb`, `nl`, `nn`, `pa`,
+`pl`, `pt`, `rm`, `ro`, `ru`, `sk`, `sl`, `sv`, `ta`, `te`, `th`, `tr`, `ur`,
+`vi`, `yi` and `zh`.
 `@c15t/translations/all` still loads every language at once. The `c15t`
 package doesn't re-export these entries, so add `@c15t/translations` to your
 dependencies.
@@ -102,26 +104,30 @@ production. Rename the section to `consentGate` to remove the warning.
 ## Show right-to-left languages
 
 c15t sets `dir="rtl"` on its surfaces when the resolved language is Arabic,
-Hebrew, Persian, Urdu, Pashto, Sindhi, Kurdish or Dhivehi. It matches the
-primary language, so `ar-EG` counts as Arabic. Hebrew is the only
-right-to-left translation c15t ships. For the others, supply your own
-messages or the copy from your Inth project.
+Hebrew, Yiddish, Persian, Urdu, Pashto, Sindhi, Central Kurdish (`ckb`),
+Uyghur, Dhivehi, Syriac or N'Ko. It matches the primary language, so `ar-EG`
+counts as Arabic, and accepts the older codes `iw` and `ji`. A script subtag
+decides over the language: `ku-Arab` and `pa-Arab` are right to left, and
+`sd-Deva` is left to right. Plain `ku` is left to right because it usually
+means Kurmanji, which uses Latin script. c15t ships right-to-left
+translations for Arabic, Hebrew, Urdu and Yiddish. For the others, supply
+your own messages or the copy from your Inth project.
 
 What follows the direction:
 
 * Text, headings and the button row in the banner, the preference dialog and
   the preference widget flow right to left.
-* A floating or widget banner in its default corner moves to the mirrored
-  corner, so `bottom-left` becomes `bottom-right`. A `position` you set
-  yourself stays where you put it.
 * The HTML script tag, `@c15t/browser` and Astro's banner also set `lang` on
   their surfaces. React, Vue and Svelte set `dir` only, so set `lang` on
   `<html>` yourself.
 
+The banner and the floating `ConsentDialogTrigger` stay in their corners. A
+`bottom-left` banner is still at the bottom left in Hebrew, so it doesn't
+jump across the page when the visitor's language changes.
+
 What does not follow yet:
 
 * The IAB TCF dialog aligns several labels, indents and borders to the left.
-* The floating `ConsentDialogTrigger` keeps the corner you give it.
 
 Test right-to-left pages with a real translation before you ship them.
 

package/docs/frameworks/react/clear-on-revocation.md

@@ -62,8 +62,9 @@ replaces the automatic attempts for that field. Partitioned cookies need
 `partitioned: true`. A prefix only finds cookies the current page can read,
 so use an exact name for a cookie on another path.
 
-c15t never deletes its own consent records, even when a pattern matches
-them.
+c15t never deletes its own consent records or the `c15t-sid` subject ID
+cookie, even when a pattern matches them. The subject ID stays so an
+opt-out can still reach what was kept under it.
 
 ## When cleanup runs
 

package/docs/frameworks/react/components/consent-banner.md

@@ -63,7 +63,7 @@ rule with `model: 'none'` owes no rights, so nothing renders unless you add
 failed, no rule matched and you set no default, or init is still withheld, no
 consent surface renders: not the banner, the dialog, the widget, the
 preferences link, or the trigger. They appear as soon as a rule resolves,
-without a remount. `offline()` without `policyRules` resolves the recommended
+without a remount. `local()` without `policyRules` resolves the recommended
 pack, so it shows the strict opt-in banner until you pass a country.
 
 Acknowledging a notice records its dismissal. It does not record consent or
@@ -201,8 +201,8 @@ Each variant accepts its own positions:
 | `widget`   | `bottom-left`, `bottom-right`, `top-left`, `top-right`                                | `bottom-right` |
 | `wall`     | `center`                                                                              | `center`       |
 
-A default corner mirrors left and right for right-to-left languages. A
-position you set is never mirrored. A position that is not valid for the
+Right-to-left languages keep the same position; only the text direction
+changes. A position that is not valid for the
 variant falls back to the default and logs an `invalid-position` diagnostic
 in development.
 

package/docs/frameworks/react/components/consent-provider.md

@@ -68,35 +68,35 @@ the provider to change them. `scripts`, `vendors`, `networkBlocker`,
 `iframeBlocker`, `consentCategories`, `overrides`, `user`, `callbacks` and
 `enabled` apply when they change.
 
-| Option                        | Purpose                                                                                                                                                                                                                         |
-| ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `mode`                        | Required. `hosted()` for the backend's `/init`, `manifest()` for a bundled policy, `offline()` for local policies, all from `c15t/react`, or `custom()` for your own transport. See [consent modes](../../../concepts/modes.md) |
-| `prefetch`                    | Server-resolved state, or a promise of it, from a framework adapter's server helper                                                                                                                                             |
-| `scripts`                     | Consent-gated vendor scripts. See [scripts and embeds](../scripts.md)                                                                                                                                                           |
-| `vendors`                     | Vendors listed under their category with their own switch. See [vendor consent](../vendor-consent.md)                                                                                                                           |
-| `scriptLoader`                | Options for the script loader module                                                                                                                                                                                            |
-| `networkBlocker`              | Rules that hold `fetch` and `XMLHttpRequest` calls until their category is allowed, or `false`                                                                                                                                  |
-| `iframeBlocker`               | Gates DOM iframes that carry `data-category`. On by default; `false` turns it off                                                                                                                                               |
-| `persistence`                 | Stores the visitor's choice in a cookie and localStorage. On by default                                                                                                                                                         |
-| `storageConfig`               | Storage key and cookie settings for the stored choice                                                                                                                                                                           |
-| `clearOnRevocation`           | Cookies and storage keys to delete when a category is denied                                                                                                                                                                    |
-| `reloadOnConsentRevoked`      | Reload the page after the visitor turns off a granted category or vendor. Defaults to `true`                                                                                                                                    |
-| `consentCategories`           | Categories the preference dialog offers alongside those your scripts use, within the policy's scope                                                                                                                             |
-| `overrides`                   | Force the country, region or language the policy is resolved for, for testing                                                                                                                                                   |
-| `user`                        | Link consent records to a signed-in user                                                                                                                                                                                        |
-| `callbacks`                   | Choice, permission and error events                                                                                                                                                                                             |
-| `i18n`                        | Languages and message overrides                                                                                                                                                                                                 |
-| `legalLinks`                  | Privacy policy and other links shown in the banner and dialog                                                                                                                                                                   |
-| `theme`                       | `consentActions` and slot styles. Tokens go through `ConsentTheme`; see [customize](../customize.md)                                                                                                                            |
-| `components`                  | Slot attributes per component part                                                                                                                                                                                              |
-| `presentation`                | Banner and dialog shape, position and blocking                                                                                                                                                                                  |
-| `experiment`                  | A/B test of `presentation`, read once at mount. See [banner experiments](../../../guides/banner-experiments.md)                                                                                                                 |
-| `journey`                     | Random id that links each `/init` to the save that follows. See [session reports](../../../concepts/data-fetching.md#link-an-init-to-the-save-that-follows)                                                                     |
-| `colorScheme`                 | `'light'`, `'dark'`, `'system'`, or `null` to leave the `c15t-dark` class alone                                                                                                                                                 |
-| `noStyle`, `disableAnimation` | Drop the built-in styles, or turn off animations                                                                                                                                                                                |
-| `preloadDialog`               | When the deferred `ConsentDialog` starts loading: `'idle'` (default) or `'intent'`; see [ConsentDialog](./consent-dialog.md#behavior)                                                                                           |
-| `nonce`                       | Content Security Policy nonce for script elements c15t inserts                                                                                                                                                                  |
-| `enabled`                     | Set `false` only when you deliberately bypass consent enforcement                                                                                                                                                               |
+| Option                        | Purpose                                                                                                                                                                                                                       |
+| ----------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `mode`                        | Required. `hosted()` for the backend's `/init`, `manifest()` for a bundled policy, `local()` for local policies, all from `c15t/react`, or `custom()` for your own transport. See [consent modes](../../../concepts/modes.md) |
+| `prefetch`                    | Server-resolved state, or a promise of it, from a framework adapter's server helper                                                                                                                                           |
+| `scripts`                     | Consent-gated vendor scripts. See [scripts and embeds](../scripts.md)                                                                                                                                                         |
+| `vendors`                     | Vendors listed under their category with their own switch. See [vendor consent](../vendor-consent.md)                                                                                                                         |
+| `scriptLoader`                | Options for the script loader module                                                                                                                                                                                          |
+| `networkBlocker`              | Rules that hold `fetch` and `XMLHttpRequest` calls until their category is allowed, or `false`                                                                                                                                |
+| `iframeBlocker`               | Gates DOM iframes that carry `data-category`. On by default; `false` turns it off                                                                                                                                             |
+| `persistence`                 | Stores the visitor's choice in a cookie and localStorage. On by default                                                                                                                                                       |
+| `storageConfig`               | Storage key and cookie settings for the stored choice                                                                                                                                                                         |
+| `clearOnRevocation`           | Cookies and storage keys to delete when a category is denied                                                                                                                                                                  |
+| `reloadOnConsentRevoked`      | Reload the page after the visitor turns off a granted category or vendor. Defaults to `true`                                                                                                                                  |
+| `consentCategories`           | Categories the preference dialog offers alongside those your scripts use, within the policy's scope                                                                                                                           |
+| `overrides`                   | Force the country, region or language the policy is resolved for, for testing                                                                                                                                                 |
+| `user`                        | Link consent records to a signed-in user                                                                                                                                                                                      |
+| `callbacks`                   | Choice, permission and error events                                                                                                                                                                                           |
+| `i18n`                        | Languages and message overrides                                                                                                                                                                                               |
+| `legalLinks`                  | Privacy policy and other links shown in the banner and dialog                                                                                                                                                                 |
+| `theme`                       | `consentActions` and slot styles. Tokens go through `ConsentTheme`; see [customize](../customize.md)                                                                                                                          |
+| `components`                  | Slot attributes per component part                                                                                                                                                                                            |
+| `presentation`                | Banner and dialog shape, position and blocking                                                                                                                                                                                |
+| `experiment`                  | A/B test of `presentation`, read once at mount. See [banner experiments](../../../guides/banner-experiments.md)                                                                                                               |
+| `journey`                     | Random id that links each `/init` to the save that follows. See [session reports](../../../concepts/data-fetching.md#link-an-init-to-the-save-that-follows)                                                                   |
+| `colorScheme`                 | `'light'`, `'dark'`, `'system'`, or `null` to leave the `c15t-dark` class alone                                                                                                                                               |
+| `noStyle`, `disableAnimation` | Drop the built-in styles, or turn off animations                                                                                                                                                                              |
+| `preloadDialog`               | When the deferred `ConsentDialog` starts loading: `'idle'` (default) or `'intent'`; see [ConsentDialog](./consent-dialog.md#behavior)                                                                                         |
+| `nonce`                       | Content Security Policy nonce for script elements c15t inserts                                                                                                                                                                |
+| `enabled`                     | Set `false` only when you deliberately bypass consent enforcement                                                                                                                                                             |
 
 `enabled: false` grants categories and allows gated loading while suppressing
 consent UI. It is not a way to fix failed initialization or hide a banner in

package/docs/frameworks/react/gpp.md

@@ -36,7 +36,7 @@ The props are the GPP options listed below, for example
 pass to `ConsentProvider` as `runtime`.
 
 The GPP string follows the policy and location your backend resolves for the
-visitor, so a US visitor's state comes from the backend. With `offline()`
+visitor, so a US visitor's state comes from the backend. With `local()`
 mode, pass the state yourself, for example
 `overrides: { country: 'US', region: 'CA' }`.