> Part of the walkerOS documentation. Project overview and full index: <https://www.walkeros.io/llms.txt>

# CMP sources

walkerOS provides ready-made source packages for popular Consent Management Platforms. Each source listens for CMP events and automatically calls `elb('walker consent', state)`, with no manual event listener code needed.

| CMP                                                                                | Package                                 |
| ---------------------------------------------------------------------------------- | --------------------------------------- |
| [CookieFirst](https://www.walkeros.io/docs/sources/web/cmps/cookiefirst.md)        | `@walkeros/web-source-cmp-cookiefirst`  |
| [CookiePro / OneTrust](https://www.walkeros.io/docs/sources/web/cmps/cookiepro.md) | `@walkeros/web-source-cmp-cookiepro`    |
| [Usercentrics](https://www.walkeros.io/docs/sources/web/cmps/usercentrics.md)      | `@walkeros/web-source-cmp-usercentrics` |

## Conditional activation with `require`[​](#conditional-activation-with-require "Direct link to conditional-activation-with-require")

Some sources and destinations shouldn't act on lifecycle events right away. They may depend on consent status being resolved first, or need information provided by other sources (like session IDs). The `require` option solves this by gating `on()` delivery (for sources) or initialization (for destinations) until specific collector events have fired.

Add `require` to any source or destination `config` to gate it on the listed events:

```
{
  "sources": {
    "consent": {
      "package": "@walkeros/web-source-cmp-cookiefirst"
    },
    "session": {
      "package": "@walkeros/web-source-session",
      "config": { "require": ["consent"] }
    },
    "dataLayer": {
      "package": "@walkeros/web-source-dataLayer",
      "config": { "require": ["consent"] }
    }
  },
  "destinations": {
    "ga4": {
      "package": "@walkeros/web-destination-gtag",
      "config": {
        "require": ["consent"],
        "consent": { "marketing": true }
      }
    }
  }
}
```

In this example the CMP source initializes immediately and fires `elb('walker consent', state)` once the user makes a choice. That `consent` event unblocks the session source, the dataLayer source, and the GA4 destination, all at once.

### How `require` works[​](#how-require-works "Direct link to how-require-works")

1. Sources are registered immediately and their `Instance.init()` runs eagerly after registration. `require` does not block init — it gates `on()` delivery. Lifecycle events targeted at a source with unmet `require` are buffered in `Instance.queueOn`.
2. Destinations with `require` are held as **pending** during initialization until their listed events fire.
3. A `require` entry is satisfied by the collector's **current recorded state**, not only by a future event. So order does not matter: a step activates whether the required state (such as a CMP applying consent) was recorded before or after the step registered. The collector reconciles every pending step against current state at each state change, at the run barrier, and once after all sources have registered.
4. Sources whose `require` just emptied have their queued lifecycle events replayed via `source.on(type, data)`. Destinations whose `require` just emptied are registered and become eligible to initialize/send; any previously queued events are preserved and delivered once the collector is allowed to push, so no data is lost.

### Key points[​](#key-points "Direct link to Key points")

* **CMP sources must not have `require`**: they need to fire consent immediately, so the collector should be able to call `on('consent', …)` on them right away
* **Accepted values**: any collector event type, such as `"consent"`, `"session"`, `"user"`, `"run"`, `"config"`, `"globals"`, etc.
* **AND logic**: `require: ["consent", "session"]` waits for **both** events
* **Cascading**: a CMP source fires `consent` → session source's require clears, its queued `on('consent', …)` replays, it fires `session` → a dataLayer source waiting for `["session"]` clears next

## How CMP sources work[​](#how-cmp-sources-work "Direct link to How CMP sources work")

1. Detecting if the CMP is already loaded and reading existing consent
2. Listening for CMP-specific events on consent changes
3. Mapping CMP categories to walkerOS consent groups via `categoryMap`
4. Calling `elb('walker consent', state)` with the mapped state

CMP and session sources perform their initial consent read during `init()`, not in the source factory. The factory stays side-effect free; the consent emit happens once the collector runs the source's `init()`. Combined with the current-state `require` matching above, this means a `require:["consent"]` step activates reliably regardless of which source provided the consent or when.

All CMP sources support `explicitOnly` (default: `true`) to filter out implicit/default consent and only process active user choices.

For more details on how consent works in walkerOS, see the [consent management guide](https://www.walkeros.io/docs/guides/consent.md).