@c15t/react 3.2.0-canary.0 → 3.2.1

package/docs/frameworks/react/quickstart.md

@@ -21,11 +21,11 @@ visitor's location from the request, so regional policies need no extra setup.
   [rendering](./rendering.md#react-router-remix-and-other-server-rendered-apps)
   for what that means for the first paint.
 
-You need an [Inth](https://inth.com) project. In the project, set the policy
+You need an [Inth project](https://inth.com/dashboard/sign-up?framework=react). In the project, set the policy
 rules for your regions, add your site's origin to the trusted origins, and copy
 the backend URL.
-[Choose your setup](../../concepts/choose-your-setup.md#decide-who-runs-the-consent-backend)
-covers self-hosting and local mode.
+[Choose your setup](../../concepts/choose-your-setup.md#set-up-the-consent-backend)
+covers local mode for development and tests.
 
 The guide uses `hosted()` mode. Policy, translation and vendor edits in your
 project reach visitors on their next page load, without a rebuild.

package/docs/frameworks/react/upgrade-v3.md

@@ -34,7 +34,7 @@ When you finish, list the files you changed, anything you could not migrate, and
   client can't read a v2 backend. See
   [Upgrade a self-hosted backend](https://c15t.com/docs/self-host/upgrade-v3).
   Inth-hosted backends need no change.
-* Install the [Inth CLI](https://c15t.com/docs/cli/overview#install-the-inth-cli). The
+* Install the [Inth CLI](https://inth.com/docs/cli/getting-started). The
   codemods run through `inth c15t codemods`.
 
 ## Replace the packages
@@ -632,7 +632,7 @@ React removes nothing besides the modes above. Import `manifest()` from
 ## Update the CLI
 
 * Setup moved to the Inth CLI.
-  [Install the Inth CLI](https://c15t.com/docs/cli/overview#install-the-inth-cli), then run
+  [Install the Inth CLI](https://inth.com/docs/cli/getting-started), then run
   `inth c15t` in place of `c15t setup` and `inth c15t codemods` in place of
   `c15t codemods`.
 * Sign in with `inth login`. Sessions saved by the v2 CLI aren't read.

package/docs/integrations/activecampaign.md

@@ -0,0 +1,297 @@
+---
+title: ActiveCampaign
+description: Load ActiveCampaign after marketing consent, configure its tracking
+  settings, and verify loading and withdrawal with c15t.
+seoTitle: ActiveCampaign cookie consent with c15t
+seoDescription: Gate ActiveCampaign on marketing consent with c15t. Configure
+  the loader, understand withdrawal limits, and verify vendor requests and
+  storage.
+icon: chart-line
+group: integrations
+---
+
+`activeCampaignTracking` waits for `marketing` consent before creating vendor globals or downloading ActiveCampaign.
+
+## Configure ActiveCampaign
+
+Copy the account ID from your ActiveCampaign site tracking snippet and remove the original snippet. Enable site tracking and authorize your site in ActiveCampaign.
+
+| Package manager | Command                          |
+| :-------------- | :------------------------------- |
+| npm             | `npm install @c15t/integrations` |
+| pnpm            | `pnpm add @c15t/integrations`    |
+| yarn            | `yarn add @c15t/integrations`    |
+| bun             | `bun add @c15t/integrations`     |
+
+```ts title="src/consent-scripts.ts"
+import { activeCampaignTracking } from '@c15t/integrations/activecampaign';
+
+export const scripts = [
+	activeCampaignTracking({ accountId: 'YOUR_ACCOUNT_ID' }),
+];
+```
+
+## Register the scripts
+
+Complete your [framework quickstart](https://c15t.com/docs/frameworks) first. Keep its Inth
+endpoint, policy, styles and consent UI. Remove the vendor's original script,
+SDK initializer or tag-manager entry, so the vendor loads only through c15t.
+
+The vendor pages put the helper in `src/consent-scripts.ts`. If your framework
+quickstart already has a `scripts` array, such as the one in `c15t.config.ts`
+in the Next.js guide, add the helper to that array instead of creating a
+second file.
+The `scripts` export is a configuration, not an initializer. Add it to the c15t provider you already have, at the registration
+point for your framework below. These are edits to that provider, not a second
+provider.
+
+**Next.js**
+
+Add the configuration to `scripts` in `c15t.config.ts`, next to
+`next.config.ts`:
+
+```ts title="c15t.config.ts"
+import { defineConsentConfig } from 'c15t/next';
+import { scripts } from './src/consent-scripts';
+
+export default defineConsentConfig({ scripts });
+```
+
+Keep the rest of your config, such as `mode` and `routePrefix`, in the
+same call. `ConsentRoot` reads the config in the browser, so the layout
+keeps passing only `state`. App Router, Pages Router and static export all
+read the same file. See
+[Next.js scripts and embeds](https://c15t.com/docs/frameworks/next/scripts).
+
+**TanStack Start**
+
+Import the configuration into your root route and pass it to the existing
+`ConsentRoot` as a top-level prop. Keep the loader from the
+[TanStack Start quickstart](https://c15t.com/docs/frameworks/tanstack-start/quickstart):
+
+```tsx title="src/routes/__root.tsx"
+import { scripts } from '../consent-scripts';
+
+<ConsentRoot state={consent} scripts={scripts}>
+```
+
+Import vendor helpers in the root route module, not in a server function.
+A server function's return value must be serializable, and script
+configurations carry callbacks. See
+[TanStack Start scripts](https://c15t.com/docs/frameworks/tanstack-start/scripts).
+
+**React**
+
+Add the configuration to the existing `ConsentProvider` options, next to
+`mode`:
+
+```tsx title="src/consent.tsx"
+import { scripts } from './consent-scripts';
+
+<ConsentProvider options={{ mode, scripts }}>
+```
+
+`mode` is the `manifest()` value from the
+[React quickstart](../frameworks/react/quickstart.md). Keep the banner,
+dialog and preferences link inside the provider. See
+[React scripts and embeds](../frameworks/react/scripts.md).
+
+**Nuxt**
+
+Register the scripts under the `c15t` key in `app/app.config.ts`. Adjust the
+relative import to where you created `consent-scripts.ts`:
+
+```ts title="app/app.config.ts"
+import { scripts } from '../src/consent-scripts';
+
+export default defineAppConfig({
+  c15t: { scripts },
+});
+```
+
+The Nuxt module merges this over its options in `nuxt.config.ts` and starts
+one script loader in the browser after hydration, once it has applied the
+visitor's stored choice and privacy signals. Keep `scripts` out of
+`nuxt.config.ts`, which reaches the browser as JSON and drops the vendor
+callbacks. Write the vendor IDs into `consent-scripts.ts`. See
+[Nuxt scripts and embeds](https://c15t.com/docs/frameworks/nuxt/scripts).
+
+**Vue**
+
+Pass the scripts to the existing `c15tVue` plugin call in `src/main.ts`:
+
+```ts title="src/main.ts"
+import { c15tVue, manifest } from 'c15t/vue/vue-plugin';
+import { scripts } from './consent-scripts';
+
+app.use(c15tVue, {
+  mode: manifest(),
+  scripts,
+});
+```
+
+Keep your existing `mode` and other options. The plugin starts one
+script loader when the app mounts, after it has applied the visitor's stored
+choice. Do not also call `createScriptLoader` from a component. See
+[Vue scripts and embeds](https://c15t.com/docs/frameworks/vue/scripts).
+
+**Astro**
+
+Add the scripts to the client entrypoint from the
+[Astro quickstart](https://c15t.com/docs/frameworks/astro/quickstart), `src/c15t.client.ts`,
+which the integration finds on its own. Keep `astro.config.mjs` as it is.
+If the module already exports scripts, combine the two arrays.
+
+```ts title="src/c15t.client.ts"
+import type { C15tClientOptionsExtension } from 'c15t/astro';
+import { scripts } from './consent-scripts';
+
+export default { scripts } satisfies C15tClientOptionsExtension;
+```
+
+Vendor helpers contain callbacks, and the integration options in
+`astro.config.mjs` are serialized into the page, so do not put helpers in
+the integration's `scripts` option. The integration passes the client
+entrypoint to the one runtime every page shares, including across
+`ClientRouter` navigation.
+
+**Svelte**
+
+Import the scripts in the component that owns your existing provider and
+pass them as a top-level prop:
+
+```svelte title="src/App.svelte"
+<script lang="ts">
+  import { ConsentProvider, manifest } from 'c15t/svelte';
+  import { scripts } from './consent-scripts';
+</script>
+
+<ConsentProvider mode={manifest()} {scripts}>
+  <!-- Keep your application, consent UI and preferences link here. -->
+</ConsentProvider>
+```
+
+Retain the styles and consent UI from the [Svelte quickstart](https://c15t.com/docs/frameworks/svelte/quickstart).
+The provider owns the loader and disposes it on unmount.
+
+**SvelteKit**
+
+Add the scripts to the existing `ConsentRoot` in the root layout. Keep the
+handle and the layout load from the [SvelteKit quickstart](https://c15t.com/docs/frameworks/sveltekit/quickstart).
+
+```svelte title="src/routes/+layout.svelte"
+<script lang="ts">
+  import { ConsentRoot } from 'c15t/svelte';
+  import { scripts } from '../consent-scripts';
+
+  let { children, data } = $props();
+</script>
+
+<ConsentRoot state={data.consent} {scripts}>
+  {@render children()}
+  <!-- Keep your consent UI and preferences link here. -->
+</ConsentRoot>
+```
+
+Import vendor helpers in the layout component, not in `+layout.server.ts`:
+a server load cannot send functions to the browser. Prerendered, static and
+SPA-mode pages use the same `scripts` prop. If you pass an externally owned
+`runtime` to the provider, register scripts when creating that runtime instead.
+
+**HTML**
+
+The helpers in `@c15t/integrations` are ES modules that need a bundler. On a
+page that loads the c15t script tag, paste the vendor's own snippet instead
+and keep it inert until its category is allowed:
+
+```html
+<script type="text/plain" data-c15t-category="measurement">
+  // The vendor's snippet, unchanged
+</script>
+```
+
+Use the category this guide names for the vendor. c15t runs the snippet
+once that category is allowed, and reloads the page when the visitor
+withdraws it. Helper options on this page, such as `loadMode`, do not apply
+to a pasted snippet. See [HTML scripts](https://c15t.com/docs/frameworks/html/scripts).
+
+**JavaScript**
+
+Pass the scripts to `init()` from `@c15t/browser`, next to your mode:
+
+```ts
+import { init, manifest } from '@c15t/browser';
+import { scripts } from './consent-scripts';
+
+const consent = init({
+  mode: manifest(),
+  scripts,
+});
+```
+
+Keep the mode from your quickstart. With
+`createConsentRuntime` from `c15t/runtime`, pass `scripts` to it instead.
+A kernel you create yourself needs a loader from
+`c15t/modules/script-loader`. Attach one loader per kernel. See
+[JavaScript scripts](https://c15t.com/docs/frameworks/javascript/scripts).
+
+## Options
+
+| Option      | Default                                                 | Behavior                                                                                                                       |
+| ----------- | ------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
+| `accountId` | Required                                                | ActiveCampaign account ID. Fixed once loading starts on this page.                                                             |
+| `email`     | Unset                                                   | Email for future requests, updated through `setEmail` after consent. Removing or blanking it clears the runtime's email field. |
+| `category`  | `marketing`                                             | Consent condition for the whole loader.                                                                                        |
+| `scriptUrl` | `https://diffuser-cdn.app-us1.com/diffuser/diffuser.js` | Regional or proxied loader URL. Blank values use the default. Fixed once loading starts on this page.                          |
+
+Missing or blank required values log an error and never load.
+
+## Loading and revocation
+
+After consent, the helper creates the callable `pgo` queue, sets its alias and timestamp, configures the account, and sets `setTrackByDefault(false)`. After the SDK loads it calls `process('allowTracking')`, which sends the page request itself. The helper sends no duplicate `process` call at initial load. Once tracking starts, a settled denial reported by an active registration requires a page reload. The helper sends no further tracking or email commands on that page, even after a regrant.
+
+Recreating the helper with the same options or a different `email` keeps the same SDK tag. After sign-in, register the helper with the contact's email. An email update changes future vendor requests and sends no additional page request. Omitting `email`, or passing a blank string, clears the runtime's email field after consent. This does not clear tracking cookies, reset the visitor ID, or erase identity already copied into vendor services.
+
+If another script replaces the captured `pgo` dispatcher, the helper sends no further commands and requires a page reload.
+
+Without a browser document, the script loader does not start ActiveCampaign. Replacing the helper or disposing its loader also requires no browser cleanup.
+
+Use one account, loader URL and contact email across registrations on the page. Every active registration must have its mapped consent before the helper enables tracking. Conflicting registrations withhold further helper commands. Resolving a conflict or remounting a registration does not send another page request on an already activated runtime. Changing `accountId` or `scriptUrl` after loading starts requires a new page; the helper logs the conflict and keeps the original SDK. A `category` change updates c15t eligibility, not vendor configuration. Consent and option updates settle after the current JavaScript turn.
+
+Keep `reloadOnConsentRevoked` enabled. The fetched runtime has no documented stop command. `setTrackByDefault(false)` does not stop services already started by `allowTracking`. Removing its script or registration cannot stop running code, clear stored identifiers or cancel requests. If a running helper changes to a denied category, reload the page as part of that configuration change. The helper logs that a reload is required; `reloadOnConsentRevoked` observes consent changes, not helper replacements. The permitted tag stays in the DOM across withdrawal and registration disposal to avoid installing a second runtime on remount. A pending download completed without consent or an active registration receives no `allowTracking` until a consenting registration exists and all active registrations agree on the configuration and have consent. An interrupted mount, failed download or externally detached SDK requires a page reload. The next denied page does not load the tag.
+
+ActiveCampaign uses first-party tracking cookies. Cookie names and other storage can vary with the vendor runtime and account configuration. Inspect your own deployment after grant.
+
+The default loads ActiveCampaign's Diffuser SDK directly from its vendor CDN. During verification, the `prism.js` URL from ActiveCampaign's tracking snippet redirected to `diffuser.js,?` and returned 403. The clean CDN URL returned JavaScript, accepted the same `pgo` queue, and initialized the tracker. The default bypasses that malformed redirect. Use `scriptUrl` for another region or a proxy and verify that it serves the matching ActiveCampaign runtime.
+
+## Verify ActiveCampaign
+
+Check for no `diffuser.js`, `pgo`, `prismGlobalObjectAlias`, cookies or browser storage before consent and after unrelated consent. Grant marketing and confirm the vendor runtime replaces the queue. Verify the page request with your own configured account. Revoke and check that the next denied page does not load the tracker.
+
+Sources: [tracking snippet](https://developers.activecampaign.com/reference/retrieve-site-tracking-code), [GDPR flow](https://help.activecampaign.com/hc/en-us/articles/360000872064-Site-tracking-and-the-GDPR), and [site tracking setup](https://help.activecampaign.com/hc/en-us/articles/20315300118044-How-to-set-up-Site-Tracking).
+
+Test in a private window with an opt-in policy. Open DevTools Network, disable
+the cache and filter by the vendor's domain:
+
+1. Load the page. No request goes to the vendor before you choose.
+2. Click Reject, then reload. There is still no vendor request.
+3. Open Privacy settings and allow the helper's category. The vendor script
+   loads without a page reload.
+4. Turn the category off again and save. c15t reloads the page, and the new
+   page makes no vendor request.
+
+c15t reloads on revocation because removing a script element does not stop
+code that already ran. The vendor's listeners, timers and queued events stay
+alive until the page unloads. If you set `reloadOnConsentRevoked: false`, stop
+the vendor yourself. Register a callback-only script whose `onConsentChange`
+calls the vendor's opt-out API, as shown in
+[custom integrations](./building-integrations.md), and check the
+permission before each of your own event calls. The reload does not delete
+cookies the vendor already set; see
+[clear on revocation for your framework](./overview.md#vendor-switches-and-cookie-cleanup).
+
+The helper lists its vendor by name in the preference dialog, so a visitor can
+turn it off inside an allowed category. See
+[vendor consent for your framework](./overview.md#vendor-switches-and-cookie-cleanup). The
+[consent verification guide](../guides/verify-consent.md) covers navigation,
+expiry and hosting checks.