@c15t/svelte 3.0.0-alpha.1 → 3.0.0-alpha.2

package/dist/context.svelte.d.ts

@@ -1,4 +1,4 @@
-import type { ActiveUI, AllConsentNames, ConsentKernel, ConsentPresentation, ResolvedConsentPresentation, ConsentSnapshot, ConsentState, ConsentType, HasCondition, KernelIABState, Model, TranslationConfig } from '@c15t/core';
+import type { ActiveUI, AllConsentNames, ConsentKernel, ConsentPresentation, ResolvedConsentPresentation, ConsentSnapshot, ConsentState, ConsentType, HasCondition, KernelIABState, Model, ResolvedVendor, TranslationConfig } from '@c15t/core';
 import type { Theme, UIOptions } from '@c15t/ui/theme';
 import type { ConsentManagerOptions } from './types';
 export type SaveType = 'all' | 'custom' | 'necessary';
@@ -22,16 +22,34 @@ export interface SvelteIABState extends KernelIABState {
 }
 export interface ConsentDraftState {
     readonly values: Partial<ConsentState>;
+    /**
+     * Granted flag per declared vendor. Seeded from the denials the gate
+     * honors, so a vendor declared `disabled` reads `true` whatever an older
+     * record says; every vendor not denied is `true`. Empty under an `iab`
+     * policy.
+     */
+    readonly vendors: Readonly<Record<string, boolean>>;
     readonly isStale: boolean;
     set: (name: AllConsentNames, value: boolean) => void;
+    /**
+     * Stage one vendor's grant. Recorded by the next save. Ignored for a
+     * vendor that is not declared or is declared `disabled`, since the kernel
+     * would drop the grant on save.
+     *
+     * @param vendorId - Vendor slug as declared in `vendors` or on a script.
+     * @param granted - Whether the vendor may load once the draft is saved.
+     */
+    setVendor: (vendorId: string, granted: boolean) => void;
     reset: () => void;
     save: (categories: readonly AllConsentNames[]) => Promise<void>;
 }
-export interface ConsentManagerState extends Pick<ConsentSnapshot, 'explicitChoice' | 'effectivePermissions' | 'promptRequirement' | 'noticeDismissal' | 'privacySignals' | 'optOutDirectives' | 'resolution' | 'policyRule' | 'restrictions' | 'nextDeadline' | 'subject' | 'evaluatedAt' | 'evaluationPolicy' | 'policyPending' | 'location' | 'overrides' | 'revision' | 'translations' | 'user'> {
+export interface ConsentManagerState extends Pick<ConsentSnapshot, 'explicitChoice' | 'effectivePermissions' | 'promptRequirement' | 'noticeDismissal' | 'privacySignals' | 'optOutDirectives' | 'resolution' | 'policyRule' | 'restrictions' | 'nextDeadline' | 'subject' | 'evaluatedAt' | 'evaluationPolicy' | 'policyPending' | 'location' | 'overrides' | 'revision' | 'translations' | 'user' | 'vendors' | 'vendorChoice'> {
     activeUI: ActiveUI;
     branding: NonNullable<ConsentSnapshot['branding']>;
     selectedConsents: Partial<ConsentState>;
     selectedConsentTypes: Partial<ConsentState>;
+    /** Granted flag per declared vendor in the draft. */
+    selectedVendors: Readonly<Record<string, boolean>>;
     presentation?: ConsentPresentation;
     readonly draft: ConsentDraftState;
     consentCategories: AllConsentNames[];
@@ -56,6 +74,15 @@ export interface ConsentManagerState extends Pick<ConsentSnapshot, 'explicitChoi
     legalLinks: ConsentManagerOptions['legalLinks'];
     translationConfig: TranslationConfig;
     getDisplayedConsents: () => ConsentType[];
+    /**
+     * The vendors listed under one category: presentable, naming that
+     * category, without a negation. Empty under an `iab` policy, where the
+     * TC string decides and vendor rows are not shown.
+     *
+     * @param category - The category row being rendered.
+     * @returns The vendors to list, in declared order.
+     */
+    getDisplayedVendors: (category: AllConsentNames) => ResolvedVendor[];
     has: (condition: HasCondition<AllConsentNames>) => boolean;
     dismissNotice: () => Promise<unknown>;
     saveConsents: (type: SaveType) => Promise<void>;
@@ -65,6 +92,13 @@ export interface ConsentManagerState extends Pick<ConsentSnapshot, 'explicitChoi
     setConsent: (name: AllConsentNames, value: boolean) => void;
     setLanguage: (code: string) => void;
     setSelectedConsent: (name: AllConsentNames, value: boolean) => void;
+    /**
+     * Stage one vendor's grant on the draft. Recorded by the next save.
+     *
+     * @param vendorId - Vendor slug as declared in `vendors` or on a script.
+     * @param granted - Whether the vendor may load once the draft is saved.
+     */
+    setSelectedVendor: (vendorId: string, granted: boolean) => void;
     subscribeToConsentChanges: (listener: (state: ConsentState) => void) => () => void;
 }
 export interface ConsentContextValue {

package/dist/context.svelte.js

@@ -1,4 +1,4 @@
-import { allConsentNames, consentTypes as defaultConsentTypes, defaultTranslationConfig, has as evaluateHas, resolveConsentPresentation, } from '@c15t/core';
+import { allConsentNames, consentTypes as defaultConsentTypes, defaultTranslationConfig, has as evaluateHas, resolveConsentPresentation, vendorsListedUnder, } from '@c15t/core';
 import { getContext, setContext } from 'svelte';
 const CONSENT_CONTEXT_KEY = Symbol('c15t-v3-consent');
 const THEME_CONTEXT_KEY = Symbol('c15t-v3-theme');
@@ -64,6 +64,12 @@ const createConsentState = function createConsentState(kernel, options) {
         getDisplayedConsents() {
             return displayedConsentTypes(controller.consentCategories);
         },
+        getDisplayedVendors(category) {
+            const snapshot = getSnapshotLocal();
+            return snapshot.model === 'iab'
+                ? []
+                : vendorsListedUnder(snapshot.vendors?.declared ?? [], category);
+        },
         has(condition) {
             const snapshot = getSnapshotLocal();
             return evaluateHas(condition, snapshot.effectivePermissions);
@@ -200,6 +206,9 @@ const createConsentState = function createConsentState(kernel, options) {
         get selectedConsentTypes() {
             return options.getDraft().values;
         },
+        get selectedVendors() {
+            return options.getDraft().vendors;
+        },
         setActiveUI(ui) {
             actionSequence += 1;
             kernel.set.activeUI(ui);
@@ -214,6 +223,9 @@ const createConsentState = function createConsentState(kernel, options) {
         setSelectedConsent(name, value) {
             options.getDraft().set(name, value);
         },
+        setSelectedVendor(vendorId, granted) {
+            options.getDraft().setVendor(vendorId, granted);
+        },
         subscribeToConsentChanges(listener) {
             return kernel.subscribe((snapshot) => listener(snapshot.effectivePermissions));
         },
@@ -223,6 +235,12 @@ const createConsentState = function createConsentState(kernel, options) {
         get translations() {
             return getSnapshotLocal().translations;
         },
+        get vendorChoice() {
+            return getSnapshotLocal().vendorChoice;
+        },
+        get vendors() {
+            return getSnapshotLocal().vendors;
+        },
         get user() {
             return getSnapshotLocal().user;
         },

package/dist/index.d.ts

@@ -15,7 +15,9 @@ export { default as ConsentDialogLink } from './components/panel-link.svelte';
 export { default as ConsentDialogTrigger } from './components/panel-trigger.svelte';
 export { default as ConsentManagerProvider } from './components/manager-provider.svelte';
 export { default as ConsentWidget } from './components/preferences.svelte';
-export { default as Frame } from './components/frame.svelte';
+export { default as ConsentGate } from './components/consent-gate.svelte';
+/** @deprecated Renamed to `ConsentGate`. */
+export { default as Frame } from './components/consent-gate.svelte';
 export { default as IABConsentBanner } from './components/iab-prompt.svelte';
 export { default as IABConsentDialog } from './components/iab-panel.svelte';
 export { getConsentKernel, getConsentManager, getHeadlessConsent, getIAB, getSnapshot, type HeadlessConsentSurfaceState, type SvelteIABState, } from './context.svelte';

package/dist/index.js

@@ -12,7 +12,9 @@ export { default as ConsentDialogLink } from './components/panel-link.svelte';
 export { default as ConsentDialogTrigger } from './components/panel-trigger.svelte';
 export { default as ConsentManagerProvider } from './components/manager-provider.svelte';
 export { default as ConsentWidget } from './components/preferences.svelte';
-export { default as Frame } from './components/frame.svelte';
+export { default as ConsentGate } from './components/consent-gate.svelte';
+/** @deprecated Renamed to `ConsentGate`. */
+export { default as Frame } from './components/consent-gate.svelte';
 export { default as IABConsentBanner } from './components/iab-prompt.svelte';
 export { default as IABConsentDialog } from './components/iab-panel.svelte';
 export { getConsentKernel, getConsentManager, getHeadlessConsent, getIAB, getSnapshot, } from './context.svelte';

package/dist/kit/routes.js

@@ -15,7 +15,7 @@ import { deferInitGvlToRoute, serveGvlReference } from '@c15t/core';
  * - The init route is per-request (geo, language, GPC) and therefore
  *   `private, no-store`.
  */
-import { fetchCachedManifest, getManifestAge, MANIFEST_PASSTHROUGH_HEADERS, } from '@c15t/core/server';
+import { fetchCachedManifest, getManifestAge, MANIFEST_PASSTHROUGH_HEADERS, reportConsentSession, resolveSessionReportBackendURL, } from '@c15t/core/server';
 import { consentInputsToOverrides, extractConsentRequestInputs, resolveBackendURL, resolveInitFromManifest, } from '@c15t/schema/types';
 import { baseTranslations } from '@c15t/translations/all';
 const INIT_CACHE_CONTROL = 'private, no-store';
@@ -84,6 +84,17 @@ const resolveManifestSource = function resolveManifestSource(event, options) {
     }
     return { manifestURL: `${resolved}${MANIFEST_ROUTE_SUFFIX}` };
 };
+/**
+ * Where the init route reports sessions, when it can: an absolute backend,
+ * read as configured rather than resolved against the request. A relative
+ * backend resolved to this app's origin is its own route, not a backend,
+ * and means no report; nothing is inferred from a manifest URL.
+ */
+const resolveReportBackendURL = function resolveReportBackendURL(options) {
+    return resolveSessionReportBackendURL({
+        backendURL: options.backendURL ?? getEnv('C15T_BACKEND_URL'),
+    });
+};
 const shouldFetchGvl = function shouldFetchGvl(manifest, payload) {
     return (manifest.iab?.enabled === true &&
         manifest.iab.gvl !== undefined &&
@@ -156,6 +167,20 @@ export const createSvelteKitConsentRouteHandlers = function createSvelteKitConse
                 reference: manifest.iab.gvl,
             });
         }
+        if (options.reportSessions !== false) {
+            reportConsentSession({
+                adapter: '@c15t/svelte',
+                backendURL: resolveReportBackendURL(options),
+                fetch: options.fetch,
+                headers: event.request.headers,
+                init: payload,
+                inputs,
+                manifest,
+                method: event.request.method,
+                source: 'route',
+                waitUntil: bindBackgroundRevalidate(options, event),
+            });
+        }
         // The resolver's inputs are the only place GPC survives on the SSR
         // path — the browser never sends `Sec-GPC` to this route when the
         // page was server-rendered. Echo them back so the kernel folds the

package/dist/kit/types.d.ts

@@ -53,4 +53,14 @@ export interface ConsentManifestOptions extends ManifestSourceConfig {
      * manifest is fresh or the request itself waits on the upstream.
      */
     onBackgroundRevalidate?: (revalidation: Promise<void>, event: RequestEvent) => void;
+    /**
+     * Report each init the route resolves to the backend's `POST /sessions`,
+     * server-to-server and detached from the response, so the backend still
+     * counts visitors it never served `/init` to. The report is handed to
+     * `onBackgroundRevalidate` like a manifest refresh. Set `false` to send
+     * none.
+     *
+     * @default true
+     */
+    reportSessions?: boolean;
 }

package/dist/primitives/preference-item/index.d.ts

@@ -16,6 +16,7 @@ export declare const PreferenceItem: {
         children?: import("svelte").Snippet;
         class?: string;
         innerClassName?: string;
+        noStyle?: boolean;
         viewportClassName?: string;
     }, {}, "">;
     Control: import("svelte").Component<import("svelte/elements").HTMLAttributes<HTMLDivElement> & {

package/dist/primitives/preference-item/preference-item-content.svelte

@@ -17,12 +17,23 @@
 		children,
 		class: localClassName,
 		innerClassName,
+		noStyle: localNoStyle,
 		viewportClassName,
 		...restProps
 	}: HTMLAttributes<HTMLDivElement> & {
 		children?: Snippet;
 		class?: string;
 		innerClassName?: string;
+		/**
+		 * Drop the primitive's built-in classes. Falls back to the root's
+		 * `noStyle`, like the React primitive and the sibling trigger, so a
+		 * headless root strips the whole item. The IAB items set `noStyle`
+		 * on their root only to own the item class and pass an explicit
+		 * `false` here to keep the collapse rules; the consent widget
+		 * inherits the root's `noStyle` and supplies the accordion classes
+		 * itself, as React's does.
+		 */
+		noStyle?: boolean;
 		/** Presentation class for the consent widget viewport.
 		 * @internal
 		 */
@@ -33,14 +44,17 @@
 	const triggerId = $derived(context.triggerId);
 	const contentId = $derived(context.contentId);
 	const dataState = $derived(getPreferenceItemState(open));
+	const noStyle = $derived(localNoStyle ?? context.noStyle);
 	const contentClassName = $derived.by(() =>
-		variants.content({ class: localClassName })
+		noStyle ? localClassName : variants.content({ class: localClassName })
 	);
 	const viewportClassNameValue = $derived.by(() =>
-		variants.contentViewport({ class: viewportClassName })
+		noStyle
+			? viewportClassName
+			: variants.contentViewport({ class: viewportClassName })
 	);
 	const innerClassNameValue = $derived.by(() =>
-		variants.contentInner({ class: innerClassName })
+		noStyle ? innerClassName : variants.contentInner({ class: innerClassName })
 	);
 </script>
 

package/dist/primitives/preference-item/preference-item-content.svelte.d.ts

@@ -4,6 +4,16 @@ type $$ComponentProps = HTMLAttributes<HTMLDivElement> & {
     children?: Snippet;
     class?: string;
     innerClassName?: string;
+    /**
+     * Drop the primitive's built-in classes. Falls back to the root's
+     * `noStyle`, like the React primitive and the sibling trigger, so a
+     * headless root strips the whole item. The IAB items set `noStyle`
+     * on their root only to own the item class and pass an explicit
+     * `false` here to keep the collapse rules; the consent widget
+     * inherits the root's `noStyle` and supplies the accordion classes
+     * itself, as React's does.
+     */
+    noStyle?: boolean;
     /** Presentation class for the consent widget viewport.
      * @internal
      */

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const version = "3.0.0-alpha.1";
+export declare const version = "3.0.0-alpha.2";

package/dist/version.js

@@ -1,2 +1,2 @@
 // Generated by genversion.
-export const version = '3.0.0-alpha.1';
+export const version = '3.0.0-alpha.2';

package/docs/README.md

@@ -50,12 +50,14 @@ These docs describe v3. Start with Inth hosted setup, identify the framework, ro
 - [Clear on revocation](./integrations/clear-on-revocation.md): Remove configured first-party cookies and Web Storage keys when their consent category is denied.
 - [Clearbit](./integrations/clearbit.md): Configure Clearbit with c15t v3, understand marketing permission and verify loading and revocation.
 - [Cloudflare Web Analytics](./integrations/cloudflare-web-analytics.md): Configure Cloudflare Web Analytics with c15t v3, understand measurement permission and verify loading and revocation.
+- [Cloudflare Zaraz](./integrations/cloudflare-zaraz.md): Synchronize c15t permissions with Zaraz purposes while Cloudflare manages your tools.
 - [Crisp](./integrations/crisp.md): Configure Crisp with c15t v3, understand functionality permission and verify loading and revocation.
 - [Databuddy](./integrations/databuddy.md): Configure Databuddy's initial and updated consent state with c15t v3.
 - [Fathom Analytics](./integrations/fathom-analytics.md): Configure Fathom Analytics with c15t v3, understand measurement permission and verify loading and revocation.
 - [Google Maps](./integrations/google-maps.md): Prevent a map iframe from mounting before the required permission.
 - [Google Tag](./integrations/google-tag.md): Configure gtag with c15t Consent Mode signals and understand its loading behavior.
 - [Google Tag Manager](./integrations/google-tag-manager.md): Load GTM with c15t consent signals and verify the tags inside your container.
+- [Granular consent](./integrations/granular-consent.md): Let visitors grant a category and still turn one vendor off, without adopting IAB TCF.
 - [Heap](./integrations/heap.md): Configure Heap with c15t v3, understand measurement permission and verify loading and revocation.
 - [Hightouch](./integrations/hightouch.md): Configure Hightouch with c15t v3, understand measurement permission and verify loading and revocation.
 - [Hotjar](./integrations/hotjar.md): Configure Hotjar with c15t v3, understand measurement permission and verify loading and revocation.

package/docs/frameworks/sveltekit/quickstart.md

@@ -116,6 +116,10 @@ the background. On adapters that expose `event.platform.context.waitUntil`
 (Cloudflare, Vercel edge) the handlers hand the refresh to it so it is not cut
 short when the response is sent; nothing is needed from you. For another
 lifetime API, pass `onBackgroundRevalidate(refresh, event)` to the handlers.
+The init route hands its session report to the same hook: after each
+resolution it posts a small report to the backend's `POST /sessions`,
+server-to-server, so the backend still counts visitors it never served
+`/init` to. Pass `reportSessions: false` to send none.
 
 ## Use static hosting
 

package/docs/guides/deployment-modes.md

@@ -30,6 +30,18 @@ in your application while consent writes still go to Inth. Regular backend
 browser setup. See [data fetching and transports](./data-fetching.md) for
 the comparison, including custom transports and offline mode.
 
+Manifest resolution removes the per-visitor `/init` request, and with it the
+backend's only count of visitors. The server adapters replace it with a session
+report: after each resolution, on a server-rendered page or the same-origin
+init route, the host posts a small report to the backend's `POST /sessions`,
+server-to-server and detached from the response. The browser makes no request
+and the report stores no identity; the visitor's IP and user agent travel as
+forwarded headers under the backend's usual IP handling. Each report is one
+resolution; a page view can produce a `render` and a `route` report, and the
+consuming side groups them into sessions by address and user agent within a
+window. Static output resolves in the browser and sends none. Set `reportSessions: false` on an adapter to turn
+it off.
+
 ## Match initialization to your application output
 
 | Application output | Initial state             | Required setup                                              |

package/docs/integrations/building-integrations.md

@@ -31,6 +31,11 @@ Replace the example URL and implement the vendor's initialization. This is a
 loader template, not a functioning analytics SDK. The script stays blocked
 while measurement permission is denied.
 
+Add `vendor: 'example-analytics'` and declare the vendor in the runtime's
+`vendors` option or in the backend manifest when visitors should be able to
+turn this vendor off inside a granted category. See
+[granular consent](./granular-consent.md).
+
 ## Define revocation deliberately
 
 `onConsentChange` receives current permission information. Use it to update the