@c15t/scripts 3.0.0-alpha.2 → 3.0.0-alpha.4

package/docs/integrations/amplitude.md

@@ -1,36 +1,42 @@
 ---
 title: Amplitude
-description: Configure Amplitude with c15t v3, understand measurement permission
-  and verify loading and revocation.
+description: Load the Amplitude Browser SDK 2 only after measurement consent
+  with the c15t amplitude helper, which opts the SDK out on revocation and back
+  in on a new grant.
+icon: amplitude
 group: integrations
 ---
 
 ## Configure Amplitude
 
-Use the browser project API key. The helper initializes Amplitude Browser SDK 2 for you; remove an existing SDK initializer before registering it.
+Use your Amplitude project API key. The `amplitude` helper initializes Browser
+SDK 2 for you, so remove any existing Amplitude snippet or `init` call.
 
-| Package manager | Command                     |
-| :-------------- | :-------------------------- |
-| npm             | `npm install @c15t/scripts` |
-| pnpm            | `pnpm add @c15t/scripts`    |
-| yarn            | `yarn add @c15t/scripts`    |
-| bun             | `bun add @c15t/scripts`     |
+| Package manager | Command                                |
+| :-------------- | :------------------------------------- |
+| npm             | `npm install @c15t/integrations@alpha` |
+| pnpm            | `pnpm add @c15t/integrations@alpha`    |
+| yarn            | `yarn add @c15t/integrations@alpha`    |
+| bun             | `bun add @c15t/integrations@alpha`     |
 
 ```ts title="src/consent-scripts.ts"
-import { amplitude } from '@c15t/scripts/amplitude';
+import { amplitude } from '@c15t/integrations/amplitude';
 
-export const scripts = [amplitude({ apiKey: 'YOUR_PROJECT_API_KEY', initOptions: { autocapture: false } })];
+export const scripts = [amplitude({ apiKey: 'YOUR_PROJECT_API_KEY' })];
 ```
 
 ## Register the scripts
 
 Complete your [framework quickstart](https://c15t.com/docs/frameworks) first. Keep its Inth
 endpoint, policy, styles and consent UI. Remove the vendor's original script,
-SDK initializer or tag-manager entry so c15t owns loading once.
+SDK initializer or tag-manager entry, so the vendor loads only through c15t.
 
-The `scripts` export in `src/consent-scripts.ts` is a configuration, not an
-initializer. Add it to your existing consent owner using the registration point
-below. These are partial edits to that owner, not additional providers.
+The vendor pages put the helper in `src/consent-scripts.ts`. If your framework
+quickstart already created a scripts file, such as `lib/scripts.ts` in the
+Next.js guide, add the helper to that array instead of creating a second file.
+The `scripts` export is a configuration, not an initializer. Add it to the c15t provider you already have, at the registration
+point for your framework below. These are edits to that provider, not a second
+provider.
 
 **Next.js**
 
@@ -51,158 +57,106 @@ router guide. Its manifest, init and save URLs stay in effect. Add
 </ConsentRoot>
 ```
 
-For a Pages Router or static-export setup using `ConsentProvider`, add
-`scripts` to its existing `options` instead. Keep the router-specific setup
-from [Next.js script loading](../frameworks/next/script-loader.md).
+App Router, Pages Router and static export all use this `ConsentRoot` in
+the `'use client'` wrapper `components/consent.tsx`. Keep `scripts` there,
+because a Server Component cannot pass script callbacks to it. See
+[Next.js scripts and embeds](../frameworks/next/scripts.md).
 
 **TanStack Start**
 
-In your existing root route component, import the scripts alongside
-`ConsentRoot`. Keep the server loader from the [TanStack Start quickstart](https://c15t.com/docs/frameworks/tanstack-start/quickstart).
+Import the configuration into your root route and pass it to the existing
+`ConsentRoot` as a top-level prop. Keep the loader, `backendURL` and
+`initRoute` from the [TanStack Start quickstart](https://c15t.com/docs/frameworks/tanstack-start/quickstart):
 
-```tsx
-import { Outlet } from '@tanstack/react-router';
-import { ConsentRoot } from 'c15t/tanstack-start';
+```tsx title="src/routes/__root.tsx"
 import { scripts } from '../consent-scripts';
 
-function Root() {
-  const state = Route.useLoaderData();
-  return (
-    <ConsentRoot state={state} backendURL={backendURL} initRoute={false} scripts={scripts}>
-      <Outlet />
-      {/* Keep your consent banner, dialog and preferences link here. */}
-    </ConsentRoot>
-  );
-}
+<ConsentRoot
+  state={consent}
+  backendURL={backendURL}
+  initRoute={false}
+  scripts={scripts}
+>
 ```
 
-This edits the existing route. `Route` and `backendURL` come from its setup;
-keep the document shell and head components if they are part of your root.
-`initRoute={false}` keeps the quickstart's direct-backend initialization.
-If your app mounts a consent server route, retain its existing `initRoute`
-instead. Do not return script callbacks from a server function or route loader.
+Import vendor helpers in the root route module, not in a server function.
+A server function's return value must be serializable, and script
+configurations carry callbacks. See
+[TanStack Start scripts](../frameworks/tanstack-start/scripts.md).
 
 **React**
 
-Import the scripts into your existing provider component:
+Add the configuration to the existing `ConsentProvider` options, next to
+`mode`:
 
-```ts
-import { ConsentProvider } from 'c15t/react';
+```tsx title="src/consent.tsx"
 import { scripts } from './consent-scripts';
-```
-
-Keep the existing options and add `scripts`:
 
-```tsx
-<ConsentProvider options={{ ...consentOptions, scripts }}>
-  {children}
-</ConsentProvider>
+<ConsentProvider options={{ mode, scripts }}>
 ```
 
-Here `consentOptions` is your existing configuration, including
-`mode: hosted({ url: backendURL })`. Keep the banner, dialog and preferences
-link inside the provider. See [React script loading](../frameworks/react/script-loader.md).
+`mode` is the `hosted({ url: 'https://your-project.inth.app' })` value
+from the [React quickstart](https://c15t.com/docs/frameworks/react/quickstart). Keep the banner,
+dialog and preferences link inside the provider. See
+[React scripts and embeds](../frameworks/react/scripts.md).
 
 **Nuxt**
 
-Attach one loader from the root `app.vue`, after the Nuxt module has
-started its browser runtime. This keeps vendor callbacks in application code rather
-than serialized `nuxt.config.ts` runtime configuration.
+Register the scripts under the `c15t` key in `app/app.config.ts`. Adjust the
+relative import to where you created `consent-scripts.ts`:
 
-```vue title="app/app.vue"
-<script setup lang="ts">
-import { onUnmounted } from 'vue';
-import { createScriptLoader } from 'c15t/modules/script-loader';
+```ts title="app/app.config.ts"
 import { scripts } from '../src/consent-scripts';
 
-const nuxtApp = useNuxtApp();
-const kernel = useConsentKernel();
-let loader: ReturnType<typeof createScriptLoader> | undefined;
-
-const removeMountedHook = nuxtApp.hook('app:mounted', () => {
-  loader = createScriptLoader({ kernel, scripts });
-});
-onUnmounted(() => {
-  removeMountedHook();
-  loader?.dispose();
+export default defineAppConfig({
+  c15t: { scripts },
 });
-</script>
-
-<template>
-  <ConsentRoot />
-  <NuxtPage />
-</template>
 ```
 
-Merge the setup code into your root and retain its footer and preferences
-link. `useConsentKernel` is auto-imported by the c15t Nuxt module. Adjust the
-relative script import if your `app.vue` is at the project root. This loader
-waits until the module has applied browser persistence and privacy signals,
-then reads the current snapshot and observes future changes. Do not also register these scripts
-in another loader. See the [Nuxt quickstart](https://c15t.com/docs/frameworks/nuxt/quickstart).
+The Nuxt module merges this over its options in `nuxt.config.ts` and starts
+one script loader in the browser after hydration, once it has applied the
+visitor's stored choice and privacy signals. Keep `scripts` out of
+`nuxt.config.ts`, which reaches the browser as JSON and drops the vendor
+callbacks. Write the vendor IDs into `consent-scripts.ts`. See
+[Nuxt scripts and embeds](../frameworks/nuxt/scripts.md).
 
 **Vue**
 
-Use the kernel already provided by the Vue plugin. Merge this setup into
-`App.vue`, whose lifetime covers the application:
+Pass the scripts to the existing `c15tVue` plugin call in `src/main.ts`:
 
-```vue title="src/App.vue"
-<script setup lang="ts">
-import { onMounted, onUnmounted } from 'vue';
-import { createScriptLoader } from 'c15t/modules/script-loader';
-import { useConsentKernel } from 'c15t/vue/vue-plugin';
-import ConsentRoot from 'c15t/vue/consent-root';
+```ts title="src/main.ts"
 import { scripts } from './consent-scripts';
 
-const kernel = useConsentKernel();
-let loader: ReturnType<typeof createScriptLoader> | undefined;
-
-onMounted(() => {
-  loader = createScriptLoader({ kernel, scripts });
+app.use(c15tVue, {
+  backendURL: 'https://your-project.inth.app',
+  scripts,
 });
-onUnmounted(() => loader?.dispose());
-</script>
-
-<template>
-  <ConsentRoot />
-  <main>Your application</main>
-</template>
 ```
 
-Keep your existing page content and preferences link. The plugin still owns
-the kernel and persistence; this component owns only the vendor loader.
-Do not register the same scripts in plugin configuration as well. See the
-[Vue quickstart](https://c15t.com/docs/frameworks/vue/quickstart).
+Keep your existing backend URL and other options. The plugin starts one
+script loader when the app mounts, after it has applied the visitor's stored
+choice. Do not also call `createScriptLoader` from a component. See
+[Vue scripts and embeds](../frameworks/vue/scripts.md).
 
 **Astro**
 
-Point the existing Astro integration at a client module. Keep its `mode`,
-`ui` and framework integration from the [Astro quickstart](https://c15t.com/docs/frameworks/astro/quickstart).
-Import `fileURLToPath` in your Astro configuration:
-
-```js title="astro.config.mjs"
-import { fileURLToPath } from 'node:url';
-```
-
-Add this option to the existing `c15t({ ... })` call. Resolve the path from
-the configuration file because Astro injects the import into a virtual module:
+Add the scripts to the client entrypoint from the
+[Astro quickstart](https://c15t.com/docs/frameworks/astro/quickstart), the module that the
+integration's `clientEntrypoint` option names. Keep `mode`, `ui` and the
+framework integration in `astro.config.mjs` as they are. If the module
+already exports scripts, combine the two arrays.
 
-```js
-clientEntrypoint: fileURLToPath(new URL('./src/c15t.client.ts', import.meta.url)),
-```
-
-Export the scripts from that module:
-
-```ts title="src/c15t.client.ts"
+```ts title="src/consent-client.ts"
 import type { C15tClientOptionsExtension } from 'c15t/astro';
 import { scripts } from './consent-scripts';
 
 export default { scripts } satisfies C15tClientOptionsExtension;
 ```
 
-The integration passes this extension to its shared browser runtime. Vendor
-helpers contain callbacks, so do not put them in the serialized `scripts`
-option in `astro.config.mjs`. Keep one runtime across consent islands and
+Vendor helpers contain callbacks, and the integration options in
+`astro.config.mjs` are serialized into the page, so do not put helpers in
+the integration's `scripts` option. The integration passes the client
+entrypoint to the one runtime every page shares, including across
 `ClientRouter` navigation.
 
 **Svelte**
@@ -215,9 +169,7 @@ pass them as a top-level prop:
   import { ConsentManagerProvider, hosted } from '@c15t/svelte';
   import { scripts } from './consent-scripts';
 
-  const backendURL = import.meta.env.VITE_C15T_BACKEND_URL;
-  if (!backendURL) throw new Error('Set VITE_C15T_BACKEND_URL');
-  const mode = hosted({ url: backendURL });
+  const mode = hosted({ url: 'https://your-project.inth.app' });
 </script>
 
 <ConsentManagerProvider {mode} {scripts}>
@@ -239,7 +191,7 @@ and its serializable prefetch data from the [SvelteKit quickstart](https://c15t.
   import { scripts } from '../consent-scripts';
 
   let { children, data } = $props();
-  const mode = hosted({ url: data.backendURL });
+  const mode = hosted({ url: 'https://your-project.inth.app' });
 </script>
 
 <ConsentManagerProvider {mode} {scripts} prefetch={data.prefetch}>
@@ -248,45 +200,99 @@ and its serializable prefetch data from the [SvelteKit quickstart](https://c15t.
 </ConsentManagerProvider>
 ```
 
-Import vendor helpers in the layout component, not in `+layout.server.ts`.
-For static hosting, keep your browser-only `mode` setup and omit request
-prefetch; the `scripts` prop stays the same. If you pass an externally owned
+Import vendor helpers in the layout component, not in `+layout.server.ts`:
+a server load cannot send functions to the browser. Prerendered, static and
+SPA-mode pages use the same `scripts` prop. If you pass an externally owned
 `runtime` to the provider, register scripts when creating that runtime instead.
 
-**JavaScript**
-
-Attach the loader to your existing kernel before calling
-`kernel.commands.init()`:
+**HTML**
 
-```ts
-import { createScriptLoader } from 'c15t/modules/script-loader';
-import { scripts } from './consent-scripts';
+The helpers in `@c15t/integrations` are ES modules that need a bundler. On a
+page that loads the c15t script tag, paste the vendor's own snippet instead
+and keep it inert until its category is allowed:
 
-const loader = createScriptLoader({ kernel, scripts });
+```html
+<script type="text/plain" data-c15t-category="measurement">
+  // The vendor's snippet, unchanged
+</script>
 ```
 
-Call `loader.dispose()` when that application instance is destroyed.
-`kernel` is the hosted kernel from your quickstart. A provider-owned kernel
-already has a loader; do not attach a second one. See
-[JavaScript script loading](../frameworks/javascript/script-loader.md).
+Use the category this guide names for the vendor. c15t runs the snippet
+once that category is allowed, and reloads the page when the visitor
+withdraws it. Helper options on this page, such as `loadMode`, do not apply
+to a pasted snippet. See [HTML scripts](../frameworks/html/scripts.md).
 
-## Options
+**JavaScript**
 
-| Option        | Behavior                                                                                   |
-| ------------- | ------------------------------------------------------------------------------------------ |
-| `apiKey`      | Required non-empty project API key.                                                        |
-| `initOptions` | Optional JSON-serializable Browser SDK 2 initialization options.                           |
-| `scriptUrl`   | Optional loader override. The built-in loader is pinned to Browser SDK 2 version `2.44.4`. |
+Pass the scripts to `init()` from `@c15t/browser`, next to your backend
+URL:
 
-## Consent behavior
+```ts
+import { init } from '@c15t/browser';
+import { scripts } from './consent-scripts';
 
-The SDK waits for measurement permission. Once loaded, consent changes call `setOptOut(false)` or `setOptOut(true)`. Keep application event calls behind the same permission, even when the global API still exists.
+const consent = init({
+  backendURL: 'https://your-project.inth.app',
+  scripts,
+});
+```
 
-## Verify the integration
+Keep the backend URL from your quickstart. With
+`createConsentRuntime` from `c15t/runtime`, pass `scripts` to it instead.
+A kernel you create yourself needs a loader from
+`c15t/modules/script-loader`. Attach one loader per kernel. See
+[JavaScript scripts](../frameworks/javascript/scripts.md).
 
-Verify the SDK initializes once and that a test event appears only while measurement is allowed. Revoke permission and inspect the `setOptOut(true)` transition before testing navigation.
+## Options
 
-Use a fresh session with an opt-in policy to check initial denial. Then grant
-`measurement`, revoke it, and reload. Inspect both network requests and future
-application events. Removing a script cannot undo code or requests that already
-ran. Follow the [consent verification guide](../guides/verify-consent.md).
+| Option        | Default                                                             | Behavior                                                                                                       |
+| ------------- | ------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- |
+| `apiKey`      | Required                                                            | Project API key passed to `amplitude.init`. The helper trims it. Empty or whitespace-only values throw.        |
+| `initOptions` | `{}`                                                                | Browser SDK 2 options passed as the second argument to `init`. Use JSON-serializable values only.              |
+| `scriptUrl`   | `https://cdn.amplitude.com/libs/analytics-browser-2.44.4-min.js.gz` | Loader URL override. The default pins Browser SDK 2 version `2.44.4`. A blank value falls back to the default. |
+
+## Loading and revocation
+
+`amplitude` uses the `measurement` category. Before measurement is allowed,
+c15t defines no `window.amplitude` and loads nothing from Amplitude. When
+measurement becomes allowed, the helper creates the Browser SDK 2 queue stub,
+queues `init(apiKey, initOptions)` and `setOptOut(false)`, then loads the SDK,
+which replays the queue. Amplitude saves an opt-out in its cookie, so the
+queued `setOptOut(false)` clears one left by an earlier revocation.
+
+On revocation the helper calls `amplitude.setOptOut(true)` and leaves the SDK
+on the page, because removing the script would not stop the running client.
+If the visitor allows measurement again before the page reloads, the helper
+calls `setOptOut(false)` on that SDK instead of loading a second copy.
+
+## Verify Amplitude
+
+After you allow measurement, the `analytics-browser-2.44.4-min.js.gz` request
+loads and a test event reaches your Amplitude project. Revoke measurement, then
+allow it again on a later page and check that events reach Amplitude again.
+
+Test in a private window with an opt-in policy. Open DevTools Network, disable
+the cache and filter by the vendor's domain:
+
+1. Load the page. No request goes to the vendor before you choose.
+2. Click Reject, then reload. There is still no vendor request.
+3. Open Privacy settings and allow the helper's category. The vendor script
+   loads without a page reload.
+4. Turn the category off again and save. c15t reloads the page, and the new
+   page makes no vendor request.
+
+c15t reloads on revocation because removing a script element does not stop
+code that already ran. The vendor's listeners, timers and queued events stay
+alive until the page unloads. If you set `reloadOnConsentRevoked: false`, stop
+the vendor yourself. Register a callback-only script whose `onConsentChange`
+calls the vendor's opt-out API, as shown in
+[custom integrations](./building-integrations.md), and check the
+permission before each of your own event calls. The reload does not delete
+cookies the vendor already set; see
+[clear on revocation for your framework](./overview.md#vendor-switches-and-cookie-cleanup).
+
+The helper sets `vendor` to its script ID, so once you declare that vendor a
+visitor can turn it off inside an allowed category. See
+[vendor consent for your framework](./overview.md#vendor-switches-and-cookie-cleanup). The
+[consent verification guide](../guides/verify-consent.md) covers navigation,
+expiry and hosting checks.

package/docs/integrations/building-integrations.md

@@ -1,52 +1,151 @@
 ---
 title: Custom integrations
-description: Define loading, initialization and consent-change behavior for a
-  vendor without a helper.
+description: Gate a vendor that has no @c15t/integrations helper, or sync
+  consent with an SDK your app already loads, using a c15t script configuration.
 group: integrations
 ---
 
-## Start with a script configuration
+## Define a script
 
-Check the installed `@c15t/scripts` exports first. For an unlisted SDK, define a
-stable ID, category and source URL, then pass the configuration to the existing
-provider or loader:
+Check the [integration list](./overview.md) first. For a vendor
+without a helper, write a script configuration with a stable `id`, a category
+and the source URL, then register it like any helper:
+
+```ts title="src/consent-scripts.ts"
+import type { Script } from 'c15t';
+
+const exampleAnalytics: Script = {
+	id: 'example-analytics',
+	category: 'measurement',
+	src: 'https://analytics.example.com/sdk.js',
+	onLoad() {
+		// Initialize the vendor here with its documented API.
+	},
+	onError({ error }) {
+		console.error('Analytics SDK failed to load', error);
+	},
+};
+
+export const scripts = [exampleAnalytics];
+```
+
+Replace the URL and the `onLoad` body with the vendor's own setup. c15t adds the
+`<script>` element only while measurement is allowed. To register `scripts`
+with your framework, follow any vendor guide, for example
+[Ahrefs Analytics](./ahrefs-analytics.md).
+
+## Script fields
+
+| Field                                           | Default                | Behavior                                                                                                              |
+| ----------------------------------------------- | ---------------------- | --------------------------------------------------------------------------------------------------------------------- |
+| `id`                                            | Required               | Stable identifier. c15t tracks the script by it across renders.                                                       |
+| `category`                                      | Required               | A category name, or a condition such as `{ or: ['measurement', 'marketing'] }`, `{ and: [...] }` or `{ not: '...' }`. |
+| `src` / `textContent`                           | None                   | Set exactly one, unless `callbackOnly` is `true`.                                                                     |
+| `vendor`                                        | None                   | Vendor slug, so a visitor can turn this vendor off inside an allowed category.                                        |
+| `callbackOnly`                                  | `false`                | Run callbacks without adding a script element.                                                                        |
+| `alwaysLoad`                                    | `false`                | Load regardless of permission.                                                                                        |
+| `persistAfterConsentRevoked`                    | `false`                | Keep the script element when permission is revoked.                                                                   |
+| `onBeforeLoad`, `onLoad`, `onError`             | None                   | Run before the element is added, after it loads, and if it fails.                                                     |
+| `onConsentChange`                               | None                   | Runs when permissions change after the script has loaded, and when it is removed.                                     |
+| `onDispose`                                     | None                   | Runs when this configuration is removed or its loader is disposed. Revocation alone does not call it.                 |
+| `target`                                        | `'head'`               | `'head'` or `'body'`.                                                                                                 |
+| `async`, `defer`, `attributes`, `fetchPriority` | None                   | Copied to the script element.                                                                                         |
+| `nonce`                                         | The provider's `nonce` | Content Security Policy nonce for this element.                                                                       |
+| `anonymizeId`                                   | `true`                 | Use a random element ID. Set `false` for `c15t-script-<id>`.                                                          |
+
+Every callback receives `{ id, elementId, hasConsent, consents }`, plus
+`vendor` when the script declares one, and `element` for scripts with an
+element.
+
+## Load before consent and signal the vendor
+
+Use `alwaysLoad` only for an SDK that has its own consent API, such as a
+Consent Mode tag. The script loads on every page and c15t never removes it on
+a permission change. `hasConsent` in each callback still reports the real
+permission, so pass it to the SDK:
 
 ```ts
-import type { Script } from 'c15t/modules/script-loader';
-
-export const analyticsScript = {
-  id: 'example-analytics',
-  category: 'measurement',
-  src: 'https://analytics.example.com/sdk.js',
-  onLoad() {
-    // Initialize the vendor here using its documented API.
-  },
-  onError({ error }) {
-    console.error('Analytics SDK failed to load', error);
-  },
-} satisfies Script;
+const consentModeTag = {
+	id: 'example-consent-mode',
+	category: 'marketing',
+	src: 'https://tags.example.com/tag.js',
+	alwaysLoad: true,
+	onBeforeLoad({ hasConsent }) {
+		window.exampleTag = window.exampleTag ?? [];
+		window.exampleTag.push(['consent', hasConsent ? 'grant' : 'deny']);
+	},
+	onConsentChange({ hasConsent }) {
+		window.exampleTag?.push(['consent', hasConsent ? 'grant' : 'deny']);
+	},
+};
 ```
 
-Replace the example URL and implement the vendor's initialization. This is a
-loader template, not a functioning analytics SDK. The script stays blocked
-while measurement permission is denied.
+`window.exampleTag` stands for the vendor's own queue. An `alwaysLoad` script
+makes requests before any choice, so it does not meet a requirement of no
+vendor request before consent.
 
-Add `vendor: 'example-analytics'` and declare the vendor in the runtime's
-`vendors` option or in the backend manifest when visitors should be able to
-turn this vendor off inside a granted category. See
-[granular consent](./granular-consent.md).
+## Keep a loaded SDK and switch it off
+
+`persistAfterConsentRevoked: true` keeps the script element when permission is
+revoked. c15t then calls `onConsentChange` with `hasConsent: false`, which is
+where you call the vendor's opt-out API. If permission comes back on the same
+page, c15t reuses the element and calls `onConsentChange` again with
+`hasConsent: true`; `onLoad` does not run twice.
+
+```ts
+const examplePixel = {
+	id: 'example-pixel',
+	category: 'marketing',
+	src: 'https://pixel.example.com/pixel.js',
+	persistAfterConsentRevoked: true,
+	onConsentChange({ hasConsent }) {
+		window.examplePixel?.(hasConsent ? 'optIn' : 'optOut');
+	},
+};
+```
+
+Nothing persists across a reload. After c15t's revocation reload, or any later
+page load, the script loads again only when permission allows it. Without
+`persistAfterConsentRevoked`, c15t removes the element on revocation, then
+calls `onConsentChange`.
+
+## Sync an SDK your app already loads
+
+`callbackOnly: true` adds no script element. Use it when your app imports and
+initializes the SDK itself and c15t only has to tell it the permission. Pair
+it with `alwaysLoad` so the callbacks run on the first page load even while
+permission is denied:
+
+```ts
+const existingSdkConsent = {
+	id: 'existing-sdk-consent',
+	category: 'measurement',
+	callbackOnly: true,
+	alwaysLoad: true,
+	onBeforeLoad({ hasConsent }) {
+		existingSdk.setTracking(hasConsent);
+	},
+	onConsentChange({ hasConsent }) {
+		existingSdk.setTracking(hasConsent);
+	},
+};
+```
 
-## Define revocation deliberately
+`existingSdk` stands for your initialized SDK. c15t does not delay its import
+or its first request, so initialize it with tracking off. Without `alwaysLoad`,
+a callback-only script runs `onBeforeLoad` and `onLoad` only once permission is
+allowed. [PostHog](./posthog.md#use-an-existing-posthog-sdk) shows
+this pattern with a real SDK.
 
-`onConsentChange` receives current permission information. Use it to update the
-vendor's consent API or disable future work. `persistAfterConsentRevoked` retains
-a loaded script when set; `alwaysLoad` bypasses initial category gating. Enable
-those only when the vendor's own consent behavior matches the intended design.
+## Revocation and verification
 
-For a library imported elsewhere, `callbackOnly` allows lifecycle callbacks
-without inserting a script element. It does not prevent that earlier import
-from running. For SDKs with side effects at import time, defer the import too.
+By default c15t reloads the page when a visitor turns off a category or vendor
+they had allowed, because removing a script element does not stop code that
+already ran. Set `reloadOnConsentRevoked: false` only if every script stops
+itself in `onConsentChange`.
 
-A browser cannot undo executed JavaScript merely by removing its script tag.
-Test cleanup, queued events, re-grant and navigation. Use the provider's nonce
-option or a per-script nonce for a nonce-based Content Security Policy.
+For a nonce-based Content Security Policy, set the provider's `nonce` option or
+a per-script `nonce`. Then test the script the way the vendor guides do. Check
+for no request before a choice or after rejection, a load after allowing, and
+no request after revocation and reload. See
+[consent verification](../guides/verify-consent.md).