@c15t/scripts 2.2.0-canary-20260727202135 → 2.2.0

package/dist/engine/runtime.cjs

@@ -144,6 +144,8 @@ function executeStep(step) {
             }
         case 'setGlobalPath':
             {
+                const rootGlobal = step.path[0];
+                if (step.ifGlobalIsQueue && (!rootGlobal || !Array.isArray(win[rootGlobal]))) break;
                 const pathTarget = getPathTarget(win, step.path);
                 if (!pathTarget) break;
                 pathTarget.target[pathTarget.key] = cloneStepValue(step.value);
@@ -214,6 +216,7 @@ function executeStep(step) {
             {
                 const target = win[step.target];
                 if (null === target || 'object' != typeof target && 'function' != typeof target) break;
+                if (step.ifGlobalIsQueue && !Array.isArray(target)) break;
                 const targetRecord = target;
                 for (const method of step.methods)targetRecord[method.name] = 'return' === method.behavior ? ()=>cloneStepValue(method.value) : ()=>{};
                 break;

package/dist/engine/runtime.js

@@ -112,6 +112,8 @@ function executeStep(step) {
             }
         case 'setGlobalPath':
             {
+                const rootGlobal = step.path[0];
+                if (step.ifGlobalIsQueue && (!rootGlobal || !Array.isArray(win[rootGlobal]))) break;
                 const pathTarget = getPathTarget(win, step.path);
                 if (!pathTarget) break;
                 pathTarget.target[pathTarget.key] = cloneStepValue(step.value);
@@ -182,6 +184,7 @@ function executeStep(step) {
             {
                 const target = win[step.target];
                 if (null === target || 'object' != typeof target && 'function' != typeof target) break;
+                if (step.ifGlobalIsQueue && !Array.isArray(target)) break;
                 const targetRecord = target;
                 for (const method of step.methods)targetRecord[method.name] = 'return' === method.behavior ? ()=>cloneStepValue(method.value) : ()=>{};
                 break;

package/dist/vendors/analytics/posthog.cjs

@@ -87,29 +87,51 @@ const posthogManifest = {
         {
             type: 'setGlobal',
             name: 'posthog',
-            value: {},
+            value: [],
             ifUndefined: true
         },
+        {
+            type: 'setGlobalPath',
+            path: [
+                'posthog',
+                '_i'
+            ],
+            value: [
+                [
+                    '{{id}}',
+                    '{{initOptions}}',
+                    'posthog'
+                ]
+            ],
+            ifGlobalIsQueue: true
+        },
+        {
+            type: 'setGlobalPath',
+            path: [
+                'posthog',
+                'people'
+            ],
+            value: [],
+            ifGlobalIsQueue: true
+        },
+        {
+            type: 'defineQueueMethods',
+            target: 'posthog',
+            methods: [
+                'capture',
+                'opt_in_capturing',
+                'opt_out_capturing'
+            ]
+        },
         {
             type: 'defineGlobalMethods',
             target: 'posthog',
+            ifGlobalIsQueue: true,
             methods: [
                 {
                     name: 'init',
                     behavior: 'noop'
                 },
-                {
-                    name: 'capture',
-                    behavior: 'noop'
-                },
-                {
-                    name: 'opt_in_capturing',
-                    behavior: 'noop'
-                },
-                {
-                    name: 'opt_out_capturing',
-                    behavior: 'noop'
-                },
                 {
                     name: 'get_explicit_consent_status',
                     behavior: 'return',
@@ -130,14 +152,24 @@ const posthogManifest = {
             }
         }
     ],
-    afterLoad: [
+    onBeforeLoadGranted: [
         {
-            type: 'callGlobal',
-            global: 'posthog',
-            method: 'init',
-            args: [
-                '{{id}}',
-                '{{initOptions}}'
+            type: 'pushToQueue',
+            queue: 'posthog',
+            value: [
+                'opt_in_capturing',
+                {
+                    captureEventName: null
+                }
+            ]
+        }
+    ],
+    onBeforeLoadDenied: [
+        {
+            type: 'pushToQueue',
+            queue: 'posthog',
+            value: [
+                'opt_out_capturing'
             ]
         }
     ],

package/dist/vendors/analytics/posthog.js

@@ -54,29 +54,51 @@ const posthogManifest = {
         {
             type: 'setGlobal',
             name: 'posthog',
-            value: {},
+            value: [],
             ifUndefined: true
         },
+        {
+            type: 'setGlobalPath',
+            path: [
+                'posthog',
+                '_i'
+            ],
+            value: [
+                [
+                    '{{id}}',
+                    '{{initOptions}}',
+                    'posthog'
+                ]
+            ],
+            ifGlobalIsQueue: true
+        },
+        {
+            type: 'setGlobalPath',
+            path: [
+                'posthog',
+                'people'
+            ],
+            value: [],
+            ifGlobalIsQueue: true
+        },
+        {
+            type: 'defineQueueMethods',
+            target: 'posthog',
+            methods: [
+                'capture',
+                'opt_in_capturing',
+                'opt_out_capturing'
+            ]
+        },
         {
             type: 'defineGlobalMethods',
             target: 'posthog',
+            ifGlobalIsQueue: true,
             methods: [
                 {
                     name: 'init',
                     behavior: 'noop'
                 },
-                {
-                    name: 'capture',
-                    behavior: 'noop'
-                },
-                {
-                    name: 'opt_in_capturing',
-                    behavior: 'noop'
-                },
-                {
-                    name: 'opt_out_capturing',
-                    behavior: 'noop'
-                },
                 {
                     name: 'get_explicit_consent_status',
                     behavior: 'return',
@@ -97,14 +119,24 @@ const posthogManifest = {
             }
         }
     ],
-    afterLoad: [
+    onBeforeLoadGranted: [
         {
-            type: 'callGlobal',
-            global: 'posthog',
-            method: 'init',
-            args: [
-                '{{id}}',
-                '{{initOptions}}'
+            type: 'pushToQueue',
+            queue: 'posthog',
+            value: [
+                'opt_in_capturing',
+                {
+                    captureEventName: null
+                }
+            ]
+        }
+    ],
+    onBeforeLoadDenied: [
+        {
+            type: 'pushToQueue',
+            queue: 'posthog',
+            value: [
+                'opt_out_capturing'
             ]
         }
     ],

package/dist-types/types.d.ts

@@ -119,6 +119,8 @@ export interface SetGlobalPathStep {
     path: string[];
     /** Value to assign at the target path */
     value: unknown;
+    /** Only assign while the root global is still a snippet queue array. */
+    ifGlobalIsQueue?: boolean;
 }
 export interface DefineQueueMethodsStep {
     type: 'defineQueueMethods';
@@ -182,6 +184,8 @@ export interface DefineGlobalMethodsStep {
     /** Global object name to receive the methods */
     target: string;
     methods: Array<GlobalMethodBehavior>;
+    /** Only define methods while the target is still a snippet queue array. */
+    ifGlobalIsQueue?: boolean;
 }
 export interface ConstructGlobalStep {
     type: 'constructGlobal';

package/dist-types/vendors/analytics/posthog.d.ts

@@ -12,6 +12,12 @@ declare global {
             opt_out_capturing: () => void;
             get_explicit_consent_status: () => string;
             capture: (event: string, properties?: Record<string, unknown>) => void;
+            /**
+             * Pending `[token, config, instanceName]` init tuples, as seeded by
+             * the official PostHog snippet. `array.js` only installs its runtime
+             * over an existing `window.posthog` when this is an array.
+             */
+            _i?: unknown[][];
         };
     }
 }
@@ -33,23 +39,29 @@ export declare const posthogManifest: {
     readonly bootstrap: [{
         readonly type: 'setGlobal';
         readonly name: 'posthog';
-        readonly value: {};
+        readonly value: readonly [];
         readonly ifUndefined: true;
+    }, {
+        readonly type: 'setGlobalPath';
+        readonly path: ["posthog", "_i"];
+        readonly value: readonly [readonly ["{{id}}", "{{initOptions}}", "posthog"]];
+        readonly ifGlobalIsQueue: true;
+    }, {
+        readonly type: 'setGlobalPath';
+        readonly path: ["posthog", "people"];
+        readonly value: readonly [];
+        readonly ifGlobalIsQueue: true;
+    }, {
+        readonly type: 'defineQueueMethods';
+        readonly target: 'posthog';
+        readonly methods: ["capture", "opt_in_capturing", "opt_out_capturing"];
     }, {
         readonly type: 'defineGlobalMethods';
         readonly target: 'posthog';
+        readonly ifGlobalIsQueue: true;
         readonly methods: [{
             readonly name: 'init';
             readonly behavior: 'noop';
-        }, {
-            readonly name: 'capture';
-            readonly behavior: 'noop';
-        }, {
-            readonly name: 'opt_in_capturing';
-            readonly behavior: 'noop';
-        }, {
-            readonly name: 'opt_out_capturing';
-            readonly behavior: 'noop';
         }, {
             readonly name: 'get_explicit_consent_status';
             readonly behavior: 'return';
@@ -66,11 +78,17 @@ export declare const posthogManifest: {
             readonly 'data-ui-host': '{{uiHost}}';
         };
     }];
-    readonly afterLoad: [{
-        readonly type: 'callGlobal';
-        readonly global: 'posthog';
-        readonly method: 'init';
-        readonly args: ["{{id}}", "{{initOptions}}"];
+    readonly onBeforeLoadGranted: [{
+        readonly type: 'pushToQueue';
+        readonly queue: 'posthog';
+        readonly value: readonly ["opt_in_capturing", {
+            readonly captureEventName: null;
+        }];
+    }];
+    readonly onBeforeLoadDenied: [{
+        readonly type: 'pushToQueue';
+        readonly queue: 'posthog';
+        readonly value: readonly ["opt_out_capturing"];
     }];
     readonly onLoadGranted: [{
         readonly type: 'callGlobal';

package/docs/frameworks/javascript/script-loader.md

@@ -252,6 +252,8 @@ Control where the script is injected and whether the element id is anonymized:
 
 Set `anonymizeId: false` only when another script or test needs a stable DOM id. Pass `nonce` when your CSP requires it; c15t applies it directly to the generated `<script>` element.
 
+You usually do not need a per-script `nonce`. Setting `nonce` once on the provider covers every injected script (and the theme stylesheet); a per-script value overrides it for that script alone.
+
 ## Dynamic Management
 
 Framework packages expose script-manager methods so integrations can be added, removed, or inspected at runtime. Use this for tenant-specific tools, feature-flagged scripts, or vendors that are configured after sign-in:

package/docs/frameworks/next/script-loader.md

@@ -298,6 +298,8 @@ Control where the script is injected and whether the element id is anonymized:
 
 Set `anonymizeId: false` only when another script or test needs a stable DOM id. Pass `nonce` when your CSP requires it; c15t applies it directly to the generated `<script>` element.
 
+You usually do not need a per-script `nonce`. Setting `nonce` once on the provider covers every injected script (and the theme stylesheet); a per-script value overrides it for that script alone.
+
 ## Dynamic Management
 
 Framework packages expose script-manager methods so integrations can be added, removed, or inspected at runtime. Use this for tenant-specific tools, feature-flagged scripts, or vendors that are configured after sign-in:
@@ -487,7 +489,7 @@ For iframe-only embeds, use the [iframe blocking](/docs/frameworks/next/iframe-b
 * The provider and any component that calls `useConsentManager()` must be client components.
 * Keep vendor ids out of static examples when they differ per environment — read them from `process.env.NEXT_PUBLIC_*` or runtime config.
 * If a script must be available before a page becomes interactive, prefer a built-in helper that models denied-consent defaults rather than adding a separate `next/script` tag.
-* If you use CSP nonces, pass the nonce through the `Script` object so c15t applies it to the generated script element.
+* If you use CSP nonces, set `nonce` on the provider options so c15t applies it to every injected script element and the theme stylesheet. See [Content Security Policy](/docs/frameworks/next/components/consent-manager-provider#content-security-policy) for reading the nonce in the App Router.
 
 ## API Reference
 

package/docs/frameworks/react/script-loader.md

@@ -296,6 +296,8 @@ Control where the script is injected and whether the element id is anonymized:
 
 Set `anonymizeId: false` only when another script or test needs a stable DOM id. Pass `nonce` when your CSP requires it; c15t applies it directly to the generated `<script>` element.
 
+You usually do not need a per-script `nonce`. Setting `nonce` once on the provider covers every injected script (and the theme stylesheet); a per-script value overrides it for that script alone.
+
 ## Dynamic Management
 
 Framework packages expose script-manager methods so integrations can be added, removed, or inspected at runtime. Use this for tenant-specific tools, feature-flagged scripts, or vendors that are configured after sign-in:

package/docs/integrations/posthog.md

@@ -83,7 +83,7 @@ This is the recommended approach if you're using the PostHog JS SDK; it's common
 
 If you want to load PostHog via a script tag, it's recommended to use this approach.
 
-1. **Choose a region and loading mode** The c15t helper loads PostHog's bootstrap script, calls `posthog.init()` for you, and then synchronizes consent through `posthog.opt_in_capturing()` / `posthog.opt_out_capturing()`. You do not need to call `posthog.init()` separately.
+1. **Choose a region and loading mode** The c15t helper seeds PostHog's initialization queue, loads the bootstrap script, and synchronizes consent through `posthog.opt_in_capturing()` / `posthog.opt_out_capturing()`. You do not need to call `posthog.init()` separately.
 
    Use region to keep PostHog's API, UI, and bootstrap script hosts aligned. c15t defaults to region: 'eu'; set region: 'us' for PostHog Cloud US. You can still pass apiHost, uiHost, or scriptUrl for self-hosted or proxied setups.
 
@@ -221,7 +221,7 @@ posthog({
 The behavior depends on which pattern you chose:
 
 * **SDK Implementation** — your app loaded `posthog-js` itself, so `posthog.capture(...)` is available once your SDK setup has run. c15t calls `opt_in_capturing()` / `opt_out_capturing()` for you. Pending events before c15t syncs consent may be dropped; after denial, PostHog captures cookieless events.
-* **Script Implementation with `loadMode: 'always'`** — `window.posthog` is defined early. c15t calls `opt_in_capturing()` / `opt_out_capturing()` based on consent. Pending events before the PostHog bootstrap finishes may be dropped; after denial, PostHog captures cookieless events when your PostHog project supports cookieless mode.
+* **Script Implementation with `loadMode: 'always'`** — `window.posthog` is defined early as a queue. Calls to `posthog.capture(...)` before the bootstrap finishes are replayed after the SDK installs instead of being dropped. c15t queues the current consent decision ahead of those calls, then keeps calling `opt_in_capturing()` / `opt_out_capturing()` as consent changes. After denial, PostHog captures cookieless events when your PostHog project supports cookieless mode.
 * **Script Implementation with `loadMode: 'after-consent'`** — PostHog is unavailable until measurement consent is granted. Guard `posthog.capture(...)` calls or call them only after consent.
 
 > ⚠️ **Warning:**

package/docs/shared/react/guides/script-loader.md

@@ -229,6 +229,8 @@ Control where the script is injected and whether the element id is anonymized:
 
 Set `anonymizeId: false` only when another script or test needs a stable DOM id. Pass `nonce` when your CSP requires it; c15t applies it directly to the generated `<script>` element.
 
+You usually do not need a per-script `nonce`. Setting `nonce` once on the provider covers every injected script (and the theme stylesheet); a per-script value overrides it for that script alone.
+
 ## Dynamic Management
 
 Framework packages expose script-manager methods so integrations can be added, removed, or inspected at runtime. Use this for tenant-specific tools, feature-flagged scripts, or vendors that are configured after sign-in:

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@c15t/scripts",
-	"version": "2.2.0-canary-20260727202135",
+	"version": "2.2.0",
 	"description": "Consent-aware script integrations for Google Tag Manager, Google Consent Mode v2, GA4, Google Ads, Meta Pixel, and more.",
 	"keywords": [
 		"c15t",
@@ -253,7 +253,7 @@
 	"devDependencies": {
 		"@c15t/typescript-config": "0.0.1",
 		"@c15t/vitest-config": "1.0.0",
-		"c15t": "2.2.0-canary-20260727202135",
+		"c15t": "2.2.0",
 		"playwright": "1.58.2"
 	},
 	"publishConfig": {