@c15t/scripts 2.1.0 → 2.2.0-canary-20260804162155

package/docs/integrations/building-integrations.md

@@ -0,0 +1,239 @@
+---
+title: Build a Custom Script Integration
+description: Learn when to use a raw Script, when to build a reusable
+  manifest-backed integration, and how to debug and test custom consent-aware
+  scripts in c15t.
+group: integrations
+---
+If you cannot find a prebuilt integration in [`@c15t/scripts`](/docs/integrations), you have two good options:
+
+1. Build a one-off `Script` object directly in your app.
+2. Build a reusable manifest-backed integration helper.
+
+Use the first option for app-specific scripts. Use the second option when you want something reusable, testable, and aligned with c15t's manifest system.
+
+## Choose the Right Level
+
+### One-off app script
+
+Use a raw `Script` when:
+
+* the integration is only used in one app
+* the vendor setup is small
+* you do not need to publish or share the helper
+
+```ts
+import type { Script } from 'c15t';
+
+export function acmeAnalytics(siteId: string): Script {
+  return {
+    id: 'acme-analytics',
+    src: `https://cdn.acme.com/analytics.js?site=${siteId}`,
+    category: 'measurement',
+    onBeforeLoad: () => {
+      window.acmeQueue = window.acmeQueue || [];
+    },
+    onConsentChange: ({ hasConsent }) => {
+      window.acme?.setConsent(hasConsent);
+    },
+  };
+}
+```
+
+### Reusable manifest-backed integration
+
+Use a manifest-backed helper when:
+
+* you want to contribute to `@c15t/scripts`
+* you want the integration to be reusable across apps
+* you need structured startup/setup phases
+* you want compatibility with c15t's server-side support for script loading
+
+Manifest integrations should be declarative, serializable, and built from structured steps rather than raw inline JavaScript strings.
+
+## Manifest Contract
+
+Every reusable manifest carries two contract fields:
+
+* `kind`: identifies the payload as a c15t vendor manifest
+* `schemaVersion`: identifies which manifest schema the runtime should compile
+
+Use `vendorManifestContract` so helpers stay aligned with the runtime's current contract:
+
+```ts
+const acmeManifest = {
+  ...vendorManifestContract,
+  vendor: 'acme-analytics',
+  // ...
+} as const satisfies VendorManifest;
+```
+
+If manifests are sent from a server later, these fields are how the client can validate that it knows how to interpret the payload before executing anything.
+
+## Manifest Mental Model
+
+The manifest runtime executes a script in ordered phases:
+
+* `bootstrap`: globals or stubs that must exist before anything else
+* `install`: startup steps plus a single `loadScript`
+* `afterLoad`: work that should run after the external script loads
+* `onBeforeLoadGranted` / `onBeforeLoadDenied`: initial consent-specific setup
+* `onLoadGranted` / `onLoadDenied`: post-load consent-specific setup
+* `onConsentChange`: runs on every consent update
+* `onConsentGranted` / `onConsentDenied`: branch-specific consent updates
+
+For vendors with explicit consent APIs, you can also use:
+
+* `consentMapping`
+* `consentSignal`
+* `consentSignalTarget`
+
+That is how the Google integrations map c15t consent categories to Consent Mode v2 and inject `default` and `update` signals in the correct phase order.
+
+`category` supports the same consent condition model as a plain `Script`, so manifests can represent simple or nested rules such as:
+
+```ts
+category: { and: ['measurement', { not: 'marketing' }] }
+```
+
+## Structured Steps
+
+Prefer structured steps over raw script text. The current manifest DSL supports patterns like:
+
+* `setGlobal`
+* `setGlobalPath`
+* `defineQueueFunction`
+* `defineStubFunction`
+* `pushToQueue`
+* `callGlobal`
+* `defineQueueMethods`
+* `defineGlobalMethods`
+* `constructGlobal`
+* `loadScript`
+
+These steps are easier to validate, test, debug, and eventually transport from the server.
+
+## Example Manifest Integration
+
+If you are building a reusable helper, the pattern looks like this:
+
+```ts
+import type { Script } from 'c15t';
+import { resolveManifest } from '@c15t/scripts/resolve';
+import {
+  vendorManifestContract,
+  type VendorManifest,
+} from '@c15t/scripts/types';
+
+const acmeManifest = {
+  ...vendorManifestContract,
+  vendor: 'acme-analytics',
+  category: 'measurement',
+  bootstrap: [
+    {
+      type: 'setGlobal',
+      name: 'acmeQueue',
+      value: [],
+      ifUndefined: true,
+    },
+    {
+      type: 'defineQueueFunction',
+      name: 'acme',
+      queue: 'acmeQueue',
+      ifUndefined: true,
+    },
+  ],
+  install: [
+    {
+      type: 'callGlobal',
+      global: 'acme',
+      args: ['init', '{{siteId}}'],
+    },
+    {
+      type: 'loadScript',
+      src: 'https://cdn.acme.com/analytics.js?site={{siteId}}',
+      async: true,
+    },
+  ],
+  onConsentGranted: [
+    {
+      type: 'callGlobal',
+      global: 'acme',
+      args: ['consent', true],
+    },
+  ],
+  onConsentDenied: [
+    {
+      type: 'callGlobal',
+      global: 'acme',
+      args: ['consent', false],
+    },
+  ],
+} as const satisfies VendorManifest;
+
+export function acmeAnalytics(siteId: string): Script {
+  return resolveManifest(acmeManifest, { siteId });
+}
+```
+
+## Design Guidelines
+
+When building an integration, prefer these rules:
+
+* Keep helper logic thin. Put behavior in the manifest, not in post-resolution callback mutation.
+* Keep manifests serializable. Avoid helper-only runtime branches where possible.
+* Use explicit config inputs. Avoid generic override bags when a named option is clearer.
+* Use `alwaysLoad` only when the vendor truly manages its own consent correctly.
+* Use `persistAfterConsentRevoked` only when the vendor exposes a real consent toggle and does not need a full reload.
+* Keep vendor-specific naming out of the core DSL when a generic step can express it.
+
+## Testing Checklist
+
+At minimum, test these flows:
+
+1. Initial page load with consent denied.
+2. Initial page load with consent granted.
+3. Consent granted after the script was previously denied.
+4. Consent revoked after the script was previously active.
+5. Existing script element reuse if the script persists after revocation.
+6. Error handling if the vendor global or loader is missing.
+
+If you are contributing to `@c15t/scripts`, add focused engine/helper tests similar to the existing tests in `packages/scripts/src/engine.test.ts` and `packages/scripts/src/helpers.test.ts`.
+
+## Debugging
+
+Use `@c15t/dev-tools` while implementing and testing integrations.
+
+The scripts panel now shows:
+
+* whether a script is loaded, pending, or blocked
+* grouped activity for `onBeforeLoad`, `onLoad`, and `onConsentChange`
+* manifest phase activity such as `bootstrap`, `consent-default`, `setup`, and `afterLoad`
+
+The events panel also records script lifecycle and manifest step events, which is useful when a vendor reads consent too early or a startup step runs in the wrong order.
+
+## When to Stop and Use a Plain Script
+
+Not every integration needs a reusable manifest helper.
+
+If the vendor snippet is tiny, unique to one app, or mostly static, a plain `Script` object in your runtime options is usually the simpler choice. Reach for the manifest system when you need reuse, consistency, structured startup behavior, or a path to server-driven manifests.
+
+## Reference Types
+
+### Script
+
+|Property|Value|
+|:--|:--|
+|Type Name|\`Script\`|
+|Source Path|\`./packages/core/src/libs/script-loader/types.ts\`|
+
+\*ExtractedTypeTable: Could not extract "Script" from "./packages/core/src/libs/script-loader/types.ts" using base path "/home/runner/work/c15t/c15t". Verify the path/name and that the file is included by your tsconfig.\*
+
+### VendorManifest
+
+|Property|Value|
+|:--|:--|
+|Type Name|\`VendorManifest\`|
+|Source Path|\`./packages/scripts/src/types.ts\`|
+
+\*ExtractedTypeTable: Could not extract "VendorManifest" from "./packages/scripts/src/types.ts" using base path "/home/runner/work/c15t/c15t". Verify the path/name and that the file is included by your tsconfig.\*

package/docs/integrations/clearbit.md

@@ -0,0 +1,130 @@
+---
+title: Clearbit
+description: Visitor and company enrichment loaded with Clearbit's account-keyed
+  tags.js snippet.
+group: integrations
+icon: clearbit
+---
+[Clearbit](https://clearbit.com) provides visitor and company enrichment for go-to-market workflows. The official embed loads `https://tag.clearbitscripts.com/v1/{publishableKey}/tags.js` with a `referrerpolicy` of `strict-origin-when-cross-origin`.
+
+## Integrate with c15t
+
+**React**
+
+```tsx
+import { type ReactNode } from 'react';
+import { ConsentManagerProvider } from '@c15t/react';
+import { clearbit } from '@c15t/scripts/clearbit';
+
+const scripts = [
+  clearbit({
+    publishableKey: 'YOUR_PUBLISHABLE_KEY',
+  }),
+];
+
+export function ConsentProvider({ children }: { children: ReactNode }) {
+  return (
+    <ConsentManagerProvider
+      options={{
+        mode: 'hosted',
+        backendURL: 'https://your-instance.c15t.dev',
+        scripts,
+      }}
+    >
+      {children}
+    </ConsentManagerProvider>
+  );
+}
+```
+
+**Next.js**
+
+```tsx
+'use client';
+
+import { type ReactNode } from 'react';
+import { ConsentManagerProvider } from '@c15t/nextjs';
+import { clearbit } from '@c15t/scripts/clearbit';
+
+const scripts = [
+  clearbit({
+    publishableKey: 'YOUR_PUBLISHABLE_KEY',
+  }),
+];
+
+export function ConsentProvider({ children }: { children: ReactNode }) {
+  return (
+    <ConsentManagerProvider
+      options={{
+        mode: 'hosted',
+        backendURL: '/api/c15t',
+        scripts,
+      }}
+    >
+      {children}
+    </ConsentManagerProvider>
+  );
+}
+```
+
+**JavaScript**
+
+```ts
+import { getOrCreateConsentRuntime } from 'c15t';
+import { clearbit } from '@c15t/scripts/clearbit';
+
+getOrCreateConsentRuntime({
+  mode: 'hosted',
+  backendURL: 'https://your-instance.c15t.dev',
+  scripts: [
+    clearbit({
+      publishableKey: 'YOUR_PUBLISHABLE_KEY',
+    }),
+  ],
+});
+```
+
+## How c15t loads it
+
+* **Category:** `marketing` (Analytics discovery, marketing-sensitive consent)
+* **Loads when:** marketing consent is granted
+* **On revocation:** unloaded — c15t removes the script element from the DOM.
+
+Clearbit enrichment tools are privacy-sensitive because they can identify visitors and companies for profiling, enrichment, and intent use cases. The GitHub issue left the category open between measurement and marketing; c15t defaults this integration to `marketing` because enrichment is not just aggregate measurement. The script stays blocked until marketing consent is granted. On revocation c15t removes the script element it created; tags that Clearbit's loader has already appended can keep running until the next page load (c15t reloads the page on revocation by default), so treat the load gate as the consent boundary.
+
+The helper maps Clearbit's official snippet:
+
+```ts
+clearbit({
+  publishableKey: 'YOUR_PUBLISHABLE_KEY',
+})
+```
+
+To proxy or self-host the loader, pass a custom URL:
+
+```ts
+clearbit({
+  publishableKey: 'YOUR_PUBLISHABLE_KEY',
+  scriptUrl: 'https://analytics.example.com/clearbit-tags.js',
+})
+```
+
+## Types
+
+### ClearbitOptions
+
+|Property|Value|
+|:--|:--|
+|Type Name|\`ClearbitOptions\`|
+|Source Path|\`./packages/scripts/src/vendors/analytics/clearbit.ts\`|
+
+\*ExtractedTypeTable: Could not extract "ClearbitOptions" from "./packages/scripts/src/vendors/analytics/clearbit.ts" using base path "/home/runner/work/c15t/c15t". Verify the path/name and that the file is included by your tsconfig.\*
+
+### Script
+
+|Property|Value|
+|:--|:--|
+|Type Name|\`Script\`|
+|Source Path|\`./packages/core/src/libs/script-loader/types.ts\`|
+
+\*ExtractedTypeTable: Could not extract "Script" from "./packages/core/src/libs/script-loader/types.ts" using base path "/home/runner/work/c15t/c15t". Verify the path/name and that the file is included by your tsconfig.\*

package/docs/integrations/cloudflare-web-analytics.md

@@ -0,0 +1,126 @@
+---
+title: Cloudflare Web Analytics
+description: Cookieless analytics from Cloudflare with a prebuilt helper that
+  serializes the beacon config into the `data-cf-beacon` attribute.
+group: integrations
+icon: cloudflare-web-analytics
+---
+Cloudflare Web Analytics is a cookieless analytics product configured through a single `data-cf-beacon` attribute on its loader. The `cloudflareWebAnalytics()` helper serializes your token and single-page application (SPA) preference into that attribute and hands the result to c15t's script loader.
+
+## Integrate with c15t
+
+**React**
+
+```tsx
+import { type ReactNode } from 'react';
+import { ConsentManagerProvider } from '@c15t/react';
+import { cloudflareWebAnalytics } from '@c15t/scripts/cloudflare-web-analytics';
+
+const scripts = [
+  cloudflareWebAnalytics({
+    token: 'your-cloudflare-token',
+  }),
+];
+
+export function ConsentProvider({ children }: { children: ReactNode }) {
+  return (
+    <ConsentManagerProvider
+      options={{
+        mode: 'hosted',
+        backendURL: 'https://your-instance.c15t.dev',
+        scripts,
+      }}
+    >
+      {children}
+    </ConsentManagerProvider>
+  );
+}
+```
+
+**Next.js**
+
+```tsx
+'use client';
+
+import { type ReactNode } from 'react';
+import { ConsentManagerProvider } from '@c15t/nextjs';
+import { cloudflareWebAnalytics } from '@c15t/scripts/cloudflare-web-analytics';
+
+const scripts = [
+  cloudflareWebAnalytics({
+    token: 'your-cloudflare-token',
+  }),
+];
+
+export function ConsentProvider({ children }: { children: ReactNode }) {
+  return (
+    <ConsentManagerProvider
+      options={{
+        mode: 'hosted',
+        backendURL: '/api/c15t',
+        scripts,
+      }}
+    >
+      {children}
+    </ConsentManagerProvider>
+  );
+}
+```
+
+**JavaScript**
+
+```ts
+import { getOrCreateConsentRuntime } from 'c15t';
+import { cloudflareWebAnalytics } from '@c15t/scripts/cloudflare-web-analytics';
+
+getOrCreateConsentRuntime({
+  mode: 'hosted',
+  backendURL: 'https://your-instance.c15t.dev',
+  scripts: [
+    cloudflareWebAnalytics({
+      token: 'your-cloudflare-token',
+    }),
+  ],
+});
+```
+
+## How c15t loads it
+
+* **Category:** `measurement` (Analytics)
+* **Loads when:** measurement consent is granted
+* **On revocation:** unloaded — c15t removes the script element from the DOM. Cloudflare Web Analytics is cookieless, so no client-side state needs clearing.
+
+SPA route tracking is enabled by default. Disable it for traditional multi-page apps:
+
+```ts
+cloudflareWebAnalytics({
+  token: 'your-cloudflare-token',
+  spa: false,
+})
+```
+
+The helper JSON-encodes `{ token, spa }` into the `data-cf-beacon` attribute that Cloudflare's loader reads at startup, matching Cloudflare's recommended embed.
+
+## Tracking events in your app
+
+Cloudflare Web Analytics has no app-facing event API — the beacon tracks pageviews automatically once the script is loaded. There are no event calls in your application code to guard, so c15t's consent gating fully controls when and whether tracking happens.
+
+## Types
+
+### CloudflareWebAnalyticsOptions
+
+|Property|Value|
+|:--|:--|
+|Type Name|\`CloudflareWebAnalyticsOptions\`|
+|Source Path|\`./packages/scripts/src/vendors/analytics/cloudflare-web-analytics.ts\`|
+
+\*ExtractedTypeTable: Could not extract "CloudflareWebAnalyticsOptions" from "./packages/scripts/src/vendors/analytics/cloudflare-web-analytics.ts" using base path "/home/runner/work/c15t/c15t". Verify the path/name and that the file is included by your tsconfig.\*
+
+### Script
+
+|Property|Value|
+|:--|:--|
+|Type Name|\`Script\`|
+|Source Path|\`./packages/core/src/libs/script-loader/types.ts\`|
+
+\*ExtractedTypeTable: Could not extract "Script" from "./packages/core/src/libs/script-loader/types.ts" using base path "/home/runner/work/c15t/c15t". Verify the path/name and that the file is included by your tsconfig.\*

package/docs/integrations/crisp.md

@@ -0,0 +1,140 @@
+---
+title: Crisp
+description: Load Crisp live chat with website ID, runtime, cookie, and session options.
+group: integrations
+icon: crisp
+---
+Crisp adds the Crisp live chat widget and exposes the `$crisp` queue for
+chatbox actions such as opening the chat, setting user details, and resetting
+sessions.
+
+## Official Crisp documentation
+
+* [Web Chat SDK](https://docs.crisp.chat/guides/chatbox-sdks/web-sdk/)
+* [$crisp methods](https://docs.crisp.chat/guides/chatbox-sdks/web-sdk/dollar-crisp/)
+* [Identity verification](https://docs.crisp.chat/guides/chatbox-sdks/web-sdk/identity-verification/)
+* [Cookie policies](https://docs.crisp.chat/guides/chatbox-sdks/web-sdk/cookie-policies/)
+* [Session continuity](https://docs.crisp.chat/guides/chatbox-sdks/web-sdk/session-continuity/)
+* [Language customization](https://docs.crisp.chat/guides/chatbox-sdks/web-sdk/language-customization/)
+
+## Integrate with c15t
+
+**React**
+
+```tsx
+import { type ReactNode } from 'react';
+import { ConsentManagerProvider } from '@c15t/react';
+import { crisp } from '@c15t/scripts/crisp';
+
+const scripts = [crisp({ websiteId: 'crisp-123' })];
+
+export function ConsentProvider({ children }: { children: ReactNode }) {
+  return (
+    <ConsentManagerProvider
+      options={{
+        mode: 'hosted',
+        backendURL: 'https://your-instance.c15t.dev',
+        scripts,
+      }}
+    >
+      {children}
+    </ConsentManagerProvider>
+  );
+}
+```
+
+**Next.js**
+
+```tsx
+'use client';
+
+import { type ReactNode } from 'react';
+import { ConsentManagerProvider } from '@c15t/nextjs';
+import { crisp } from '@c15t/scripts/crisp';
+
+const scripts = [crisp({ websiteId: 'crisp-123' })];
+
+export function ConsentProvider({ children }: { children: ReactNode }) {
+  return (
+    <ConsentManagerProvider
+      options={{
+        mode: 'hosted',
+        backendURL: '/api/c15t',
+        scripts,
+      }}
+    >
+      {children}
+    </ConsentManagerProvider>
+  );
+}
+```
+
+**JavaScript**
+
+```ts
+import { getOrCreateConsentRuntime } from 'c15t';
+import { crisp } from '@c15t/scripts/crisp';
+
+getOrCreateConsentRuntime({
+  mode: 'hosted',
+  backendURL: 'https://your-instance.c15t.dev',
+  scripts: [crisp({ websiteId: 'crisp-123' })],
+});
+```
+
+## How c15t loads it
+
+* **Category:** `functionality` (Functional)
+* **Loads when:** functionality consent is granted
+* **Before load:** c15t seeds `window.$crisp`, `CRISP_WEBSITE_ID`, and any
+  optional Crisp runtime globals
+* **On revocation:** c15t follows the default script loader behavior for
+  non-persistent scripts
+
+## Configure the integration
+
+The helper seeds Crisp's documented globals before loading
+`https://client.crisp.chat/l.js`.
+
+```ts
+crisp({
+  websiteId: 'crisp-123',
+  locale: 'fr',
+  cookieDomain: 'app.example.com',
+  cookieExpiry: 3600,
+  tokenId: 'secure-user-token',
+  sessionMerge: true,
+  safeMode: true,
+})
+```
+
+`locale` and `sessionMerge` are written to `CRISP_RUNTIME_CONFIG`.
+`cookieDomain` maps to `CRISP_COOKIE_DOMAIN`, `cookieExpiry` maps to
+`CRISP_COOKIE_EXPIRE`, and `tokenId` maps to `CRISP_TOKEN_ID`. `safeMode`
+queues `['safe', true]` on `window.$crisp` before the loader runs so Crisp
+starts in safe mode.
+
+For session continuity, generate `tokenId` on your backend with a secure random
+value. Do not use emails, hashes of emails, timestamps, or incrementing IDs as
+Crisp session tokens. If you verify user emails, generate the HMAC signature on
+your backend and set it with Crisp's `$crisp` API after the helper loads.
+
+## Types
+
+### CrispOptions
+
+|Property|Value|
+|:--|:--|
+|Type Name|\`CrispOptions\`|
+|Source Path|\`./packages/scripts/src/vendors/functional/crisp.ts\`|
+
+\*ExtractedTypeTable: Could not extract "CrispOptions" from "./packages/scripts/src/vendors/functional/crisp.ts" using base path "/home/runner/work/c15t/c15t". Verify the path/name and that the file is included by your tsconfig.\*
+
+### Script
+
+|Property|Value|
+|:--|:--|
+|Type Name|\`Script\`|
+|Source Path|\`./packages/core/src/libs/script-loader/types.ts\`|
+
+\*ExtractedTypeTable: Could not extract "Script" from "./packages/core/src/libs/script-loader/types.ts" using base path "/home/runner/work/c15t/c15t". Verify the path/name and that the file is included by your tsconfig.\*