@consentera/consent-sdk 2.0.0

package/dist/types/consent/ConsentSession.d.ts

@@ -0,0 +1,127 @@
+/**
+ * ConsentEra Consent SDK — Session Management
+ * Create consent sessions, retrieve artifacts, handle redirect flows
+ */
+import { ConsentEraClientConfig, CreateSessionRequest, CreateSessionResponse, ArtifactReadResult } from '../types/consent-lifecycle';
+import { type ArtifactReadOptions } from './artifactRead';
+import { Logger } from '../utils/Logger';
+import { type RequestOptions } from '../core/http';
+import { type ConsentPopupOptions, type ConsentPopupResult } from './consentPopup';
+type RequestFn = <T>(method: 'GET' | 'POST' | 'PUT' | 'DELETE', path: string, body?: unknown, queryParams?: Record<string, string | number | boolean | undefined | null>, options?: RequestOptions) => Promise<T>;
+export declare class ConsentSession {
+    private request;
+    private config;
+    private logger;
+    /**
+     * The callback_url each session was created with, in this page. The popup
+     * needs it: /collect posts its decision to that URL's origin.
+     */
+    private callbackUrls;
+    constructor(request: RequestFn, config: ConsentEraClientConfig, logger: Logger);
+    /**
+     * Create a new consent session for consent collection.
+     * Returns a session with consent_url for redirect/popup flow.
+     *
+     *   createSession({
+     *     data_principal: { email: 'riya@example.in' },
+     *     notice_internal_name: 'bnb_consent_v2',
+     *     age: { date_of_birth: '1998-04-12' },
+     *   })
+     *
+     * Identity is `data_principal` — the identifiers, keyed by THIS
+     * ORGANISATION'S locked integration key — or `data_principal_id`; the type of
+     * {@link CreateSessionRequest} requires at least one of the two, because the
+     * API refuses a request with neither.
+     *
+     * ─── THIS IS THE U58 WIRE, AND THERE IS NO OVERLAP WINDOW ────────────────
+     *
+     * `data_principal_ref`, `data_principal_ref_type`, `data_principal_details`,
+     * `locale_pref`, `notice_language`, `template_language` and `purpose_ids` are
+     * DELETED from the API's request struct. This SDK version talks to an API
+     * carrying U58 and to no other, in both directions:
+     *
+     *   old SDK -> new API   the identifiers are dropped, then 400
+     *   new SDK -> old API   the identifiers are dropped, then 400
+     *
+     * EVERY FIELD THIS BUILDS IS A FIELD THE API DECODES. The handler decodes
+     * with a plain `json.Decoder` and NO `DisallowUnknownFields` — on BOTH wires
+     * — so a key it does not know is dropped in silence rather than refused. That
+     * is why the two wires cannot be mixed and why the failure above is a 400
+     * about a MISSING identifier rather than about the field you sent. Check a
+     * field against the request struct before adding it.
+     */
+    createSession(params: CreateSessionRequest, options?: {
+        idempotencyKey?: string;
+        signal?: AbortSignal;
+        timeoutMs?: number;
+    }): Promise<CreateSessionResponse>;
+    /**
+     * Redirect the user to the ConsentEra consent collection widget.
+     * Only works in browser environments.
+     */
+    redirectToConsent(session: CreateSessionResponse): void;
+    /**
+     * Open the consent page in a dialog ON THIS PAGE and resolve with the
+     * decision it reports, or `{ outcome: 'dismissed' }` when the person closes
+     * it. Rejects after `timeoutMs` (default 10 minutes).
+     *
+     *   const r = await consent.openConsentPopup(session);
+     *   if (r.outcome === 'decided') confirmOnServer(r.session_id, r.artifact_id);
+     *
+     * It listens for the ONE message /collect posts, `consentera:submitted` /
+     * `consentera:declined`, from the /collect origin and the frame it opened.
+     * See consent/consentPopup.ts for the wire and for why this is a dialog and
+     * not window.open (a top-level /collect posts nothing) (SDK register WEB-035).
+     *
+     * THIS PAGE MUST BE ON THE CALLBACK'S ORIGIN: /collect addresses the message
+     * to the session's callback_url origin. A session created by this SDK is
+     * checked before anything opens (`CALLBACK_ORIGIN_MISMATCH`); pass
+     * `callbackUrl` when your server set a different one. The page must also be
+     * in your integration client's Allowed Domains, or the platform refuses to
+     * be framed (frame-ancestors).
+     *
+     * The result is what the platform page reported, not the consent record:
+     * confirm the artefact before acting on a grant.
+     */
+    openConsentPopup(session: CreateSessionResponse, options?: ConsentPopupOptions): Promise<ConsentPopupResult>;
+    /**
+     * Read a consent artifact.
+     *
+     *   const r = await consent.getArtifact(artifactId, { sessionId });
+     *   if (r.state === 'pending') retryIn(r.retryAfterMs);   // 202: recorded, still being written
+     *   else use(r.artifact);                                  // 200
+     *
+     * PASS THE SESSION ID the callback gave you. The platform answers 202 for a
+     * consent whose artifact is still being written only when it can see which
+     * session is asking; without it that consent is a 404, the same answer a
+     * guessed id gets. A 404 WITH a session id means the artifact was never
+     * issued for that session: it throws a ConsenteraNotFoundError.
+     *
+     * A 200 is not proof the artifact belongs to your session — the platform
+     * checks the session only while the artifact is missing (walk finding F077).
+     * Compare `artifact.data_principal_id` with your session's.
+     */
+    getArtifact(artifactId: string, options?: ArtifactReadOptions): Promise<ArtifactReadResult>;
+}
+/**
+ * A fresh per-attempt callback state: 32 random bytes, hex. From the platform
+ * CSPRNG only — there is no Math.random fallback, because a guessable state is
+ * a forgeable callback. (`newRequestId` may fall back; this must not.)
+ */
+export declare function newCallbackState(): string;
+/**
+ * callback_url with this SDK's `state` added to its query.
+ *
+ * WHY IT SURVIVES THE ROUND TRIP — a platform fact, read on pre-main
+ * 35cd853ac7: addRedirectParams appends session_id/artifact_id to callback_url
+ * with `&` when it already has a `?` (redirect_params.go:17), and
+ * setRedirectParam then parses, SETS status / pending / sig and re-encodes —
+ * every other key, `state` included, is kept. The mobile SDKs have bound their
+ * callbacks this way since 2.0.0.
+ *
+ * `state` IS RESERVED. A callback_url that already carries one is refused
+ * rather than overwritten: overwriting would silently break the Data
+ * Fiduciary's own use of it, and keeping theirs would bind nothing.
+ */
+export declare function withCallbackState(callbackUrl: string, state: string): string;
+export {};

package/dist/types/consent/ConsentValidator.d.ts

@@ -0,0 +1,63 @@
+/**
+ * ConsentEra Consent SDK — Consent Validation
+ * Validate consent status for single or multiple purposes
+ */
+import { ValidateResponse, BulkValidateResponse } from '../types/consent-lifecycle';
+import { Logger } from '../utils/Logger';
+import { type PrincipalRef } from '../utils/context';
+import type { RequestOptions } from '../core/http';
+type RequestFn = <T>(method: 'GET' | 'POST' | 'PUT' | 'DELETE', path: string, body?: unknown, queryParams?: Record<string, string | number | boolean | undefined | null>, options?: RequestOptions) => Promise<T>;
+/**
+ * Per-check knobs. `signal` is what lets a React hook drop a validation whose
+ * answer it no longer wants — without it an out-of-order response can overwrite
+ * a newer decision, which on a consent gate fails OPEN.
+ */
+export interface ValidateOptions {
+    signal?: AbortSignal;
+    timeoutMs?: number;
+}
+export declare class ConsentValidator {
+    private request;
+    private logger;
+    constructor(request: RequestFn, logger: Logger);
+    /**
+     * Validate consent for a single purpose.
+     * Returns ALLOW or DENY with reason code.
+     *
+     *   check({ data_principal_identifiers: { email: 'riya@example.in' } },
+     *         'product_analytics')
+     *   check({ data_principal_id: '…' }, 'product_analytics')
+     *
+     * ─── data_principal_ref IS REFUSED OUTRIGHT ────────────────────────────
+     *
+     * Owner ruling 2026-09-21, no transition period
+     * (consent/lifecycle_identity.go:8-11). A request carrying it is answered
+     * 400 VALIDATION_ERROR whose message begins `DATA_PRINCIPAL_REF_REFUSED`,
+     * and the refusal fires even when `data_principal_id` is also present.
+     *
+     * NAME PEOPLE BY THE ORGANISATION'S LOCKED KEY FIELDS (F015): the mobile atom
+     * is `mobile` on this road AND on create — `phone` is refused by name. See
+     * {@link DataPrincipalIdentifiers}.
+     */
+    check(who: PrincipalRef, purposeCode: string, options?: ValidateOptions): Promise<ValidateResponse>;
+    /**
+     * Validate consent for multiple purposes at once.
+     * Returns results map indexed by purpose code.
+     *
+     * `data_principal_ref` AND `data_principal_refs` are both refused here
+     * (consent/validate.go:249,257).
+     */
+    checkBulk(who: PrincipalRef, purposeCodes: string[], options?: ValidateOptions): Promise<BulkValidateResponse>;
+    /**
+     * Quick boolean check — is this purpose allowed?
+     *
+     *   isAllowed({ data_principal_identifiers: { email: 'riya@example.in' } },
+     *             'product_analytics')
+     */
+    isAllowed(who: PrincipalRef, purposeCode: string, options?: ValidateOptions): Promise<boolean>;
+    /**
+     * Check multiple purposes and return a map of purpose → boolean.
+     */
+    areAllowed(who: PrincipalRef, purposeCodes: string[]): Promise<Map<string, boolean>>;
+}
+export {};

package/dist/types/consent/artifactRead.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Consentera Consent SDK — THE artifact read, in one place.
+ *
+ * `ConsentSession.getArtifact` and the callback handler's confirmation both
+ * read GET /consent/artifacts/{artifact_id}, and before this file each spelled
+ * the request itself. Both spelled it WITHOUT `?session_id=`, which on the
+ * platform that ships is the difference between two answers:
+ *
+ *   without session_id   a consent whose artifact is still being written is a
+ *                        404 ARTIFACT_NOT_FOUND — the same word a guessed id
+ *                        gets. The callback handler therefore had to read
+ *                        every 404 as "maybe pending" and poll it, so a FORGED
+ *                        artifact_id came back `pending` instead of refused.
+ *   with session_id      202 + Retry-After while the projection is owed; 404
+ *                        only when the id was never issued for that session or
+ *                        will never be written. (GetArtifactHandler,
+ *                        consent/collection.go:4409-4520 at 4fda7e3d05; walk
+ *                        finding F018; SDK register WEB-033.)
+ *
+ * Measured on setup.consentera.in (4fda7e3d05): an unknown artifact read with a
+ * real session is 404; the walk's real artifact with its session is 200. See
+ * fixtures/platform-wire/artifact-read.*.json at the repo root.
+ *
+ * WHAT THE session_id DOES NOT DO (walk finding F077, measured): once the
+ * artifact row exists the 200 path reads by tenant + artifact_id ALONE. The
+ * same artifact read with a random session_id is still 200. So a 200 does not
+ * prove the artifact belongs to your session; compare its `data_principal_id`
+ * with the one your session create returned (the callback handler does).
+ */
+import type { ArtifactReadResult } from '../types/consent-lifecycle';
+import type { RequestOptions } from '../core/http';
+type RequestFn = <T>(method: 'GET' | 'POST' | 'PUT' | 'DELETE', path: string, body?: unknown, queryParams?: Record<string, string | number | boolean | undefined | null>, options?: RequestOptions) => Promise<T>;
+export interface ArtifactReadOptions {
+    /**
+     * The session the callback named. SEND IT: without it the platform cannot
+     * tell "still being written" from "never issued", and answers 404 for both.
+     */
+    sessionId?: string;
+    signal?: AbortSignal;
+    timeoutMs?: number;
+}
+export declare function artifactPath(artifactId: string): string;
+/**
+ * Read one artifact. Resolves `recorded` (200) or `pending` (202); a 404, a
+ * 403 and everything else is the transport's typed ConsenteraError.
+ */
+export declare function readArtifact(request: RequestFn, artifactId: string, options?: ArtifactReadOptions): Promise<ArtifactReadResult>;
+export {};

package/dist/types/consent/consentPopup.d.ts

@@ -0,0 +1,115 @@
+/**
+ * Consentera Consent SDK — the consent popup, and the ONE message it listens for.
+ *
+ * ─── WHAT /collect ACTUALLY POSTS (SDK register WEB-035) ────────────────────
+ *
+ * After a decision, an EMBEDDED /collect page (window.parent !== window) posts
+ * exactly one message to its parent. That is decisionMessage() in
+ * consentera-ui/src/app/collect/[sessionId]/decision-message.ts, posted at
+ * page.tsx:1535-1545 (grant) and :1670-1680 (decline) on the served commit
+ * 4fda7e3d05:
+ *
+ *   { type: 'consentera:submitted' | 'consentera:declined',
+ *     session_id, artifact_id, status: 'granted'|'partial'|'denied', pending,
+ *     sessionId, redirectUrl, choices }          // the three legacy fields
+ *
+ * `choices` rides only on a submit. The TARGET ORIGIN is the origin of the
+ * session's callback_url (redirect-trust.ts parentOriginFor), so the page that
+ * frames /collect must be on the callback's origin or the browser drops the
+ * message without a word.
+ *
+ * Before this file the SDK opened the page with window.open and listened for
+ * `consentera:consent-result`, a type the platform has never sent. That was
+ * wrong twice over, because a window.open popup is a TOP-LEVEL page. It posts
+ * nothing: it navigates to the callback instead. The storage fallback polled
+ * sessionStorage, which a separate window does not share. So the promise could
+ * end only when the window closed, as `unverified`, or at the 10-minute
+ * timeout.
+ *
+ * So the popup is now what the platform's own website popup is: a dialog on
+ * THIS page with /collect in an iframe (consentera-ui/src/lib/onboarding/
+ * website-consent.ts, createDialog). It is the presentation in which /collect
+ * reports the decision.
+ *
+ * ─── WHAT THE RESULT IS, AND WHAT IT IS NOT ────────────────────────────────
+ *
+ * The message comes from the platform's origin and from the frame this SDK
+ * opened (both are checked), so it is the platform page's report of the
+ * decision. It is not the consent record. The record is the artefact: confirm
+ * it with getArtifact(artifact_id, { sessionId }) through your proxy, or on
+ * your server, before you act on a grant.
+ */
+export type DecisionStatus = 'granted' | 'partial' | 'denied';
+/** The decision /collect reported. */
+export interface ConsentPopupDecision {
+    outcome: 'decided';
+    type: 'consentera:submitted' | 'consentera:declined';
+    session_id: string;
+    /** '' only when an older platform build posted the legacy fields alone and its redirectUrl named none. */
+    artifact_id: string;
+    status: DecisionStatus;
+    /**
+     * The PROJECTION state, as the platform means it (redirect `pending=1`,
+     * collection.go:4274): the consent is recorded and the artifact named here is
+     * still being written, so a read may answer 202 + Retry-After. It is not a
+     * consent state and not a double opt-in (the platform names that
+     * `awaiting_confirmation`). A hint, not proof: confirm through your backend.
+     */
+    pending: boolean;
+    /** The callback URL with the callback query on it, when the session has a callback. */
+    redirect_url?: string;
+    /** purpose → granted, on a submit. */
+    choices?: Record<string, boolean>;
+}
+/** The person closed the dialog without deciding. Nothing was recorded by this dialog. */
+export interface ConsentPopupDismissed {
+    outcome: 'dismissed';
+    session_id: string;
+}
+export type ConsentPopupResult = ConsentPopupDecision | ConsentPopupDismissed;
+/**
+ * Read a MessageEvent as /collect's decision — or null when it is not one, or
+ * not from where it must come from.
+ *
+ * Exported for a Data Fiduciary that frames consent_url itself: the same
+ * checks, one implementation.
+ *
+ *   origin    must equal the /collect origin (the consent_url's origin)
+ *   source    when given, must be the frame that was opened
+ *   type      consentera:submitted | consentera:declined
+ *   session   `session_id` (or the legacy `sessionId`) must be this session;
+ *             when both are present they must agree
+ */
+export declare function readDecisionMessage(event: Pick<MessageEvent, 'origin' | 'data' | 'source'>, expected: {
+    origin: string;
+    sessionId: string;
+    source?: MessageEventSource | null;
+}): ConsentPopupDecision | null;
+export interface ConsentPopupOptions {
+    /** Reject after this long with no decision. Default 10 minutes. */
+    timeoutMs?: number;
+    /**
+     * The callback_url the session was created with, when it is not the one
+     * this SDK sent (a server that sets its own). /collect posts the decision to
+     * THAT origin, so this page must be on it; the SDK refuses up front when it
+     * is not, instead of waiting for a message the browser will drop.
+     */
+    callbackUrl?: string;
+    /** The dialog's accessible name. */
+    title?: string;
+    /** Where to attach the dialog. Default document.body. */
+    container?: HTMLElement;
+}
+/**
+ * Refuse a callback that cannot deliver the decision to this page.
+ * Returns the refusal, or null when the callback is fine or unknown.
+ */
+export declare function callbackOriginProblem(callbackUrl: string | undefined, pageOrigin: string): string | null;
+/**
+ * Open consent_url in a dialog on this page and resolve with the decision
+ * /collect posts, or `dismissed` when the person closes it.
+ */
+export declare function openConsentDialog(session: {
+    consent_session_id: string;
+    consent_url: string;
+}, options?: ConsentPopupOptions): Promise<ConsentPopupResult>;

package/dist/types/core/ConsentEraClient.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Consentera Consent SDK — the client.
+ *
+ * ─── THE CREDENTIAL RULE, AND IT IS ENFORCED HERE AT CONSTRUCTION ──────────
+ *
+ * A BROWSER BUNDLE NEVER CARRIES A SECRET (owner ruling 2026-09-22). Before
+ * 2.0.0 this file said the opposite in a comment — "Prefer site key (public,
+ * safe for frontend) over API key (secret, server-side only)" — and then sent
+ * whichever of the two it was given, from wherever it was running. Both halves
+ * of that sentence were wrong in a way that only showed up in production:
+ *
+ *   the site key does not work.  The platform replaces a site key's permissions
+ *   with exactly {consent.render, widget.render, session.submit, session.render}
+ *   (core/auth/df/api_usage.go:105-110, :1115) and NO ROUTE REQUIRES ANY OF THEM
+ *   — a grep for RequireDFPermission of those four names over the whole API
+ *   returns nothing. Every consent lifecycle road requires
+ *   engagement.consent.{collect,read,validate,update,withdraw,renew}
+ *   (cmd/api/routes_consent.go:377-569). The intersection is empty, so a browser
+ *   configured the recommended way got 403 on every call.
+ *
+ *   the secret key does work — which is worse. It is the only credential that
+ *   authorises those roads, so "make it work" meant putting a tiq_live_ key in
+ *   a public bundle.
+ *
+ * So the rule is now structural rather than advisory:
+ *
+ *   in a browser  a Data Fiduciary road MUST go through `proxyEndpoint` — your
+ *                 own server route, which holds the secret and forwards. An
+ *                 `apiKey` in a browser is REFUSED AT CONSTRUCTION.
+ *   on a server   `apiKey` directly, as always.
+ *   public roads  may carry `siteKey`; they carry no secret.
+ *   session roads carry no key at all: the session id and its nonce are the
+ *                 capability.
+ *
+ * WHAT THE PLATFORM MUST STILL DO for the public half to be usable from a
+ * browser without a proxy is a separate unit and is written down in
+ * README.md → "What the platform must guarantee".
+ */
+import { ConsentEraClientConfig } from '../types/consent-lifecycle';
+import { ConsentSession } from '../consent/ConsentSession';
+import { ConsentValidator } from '../consent/ConsentValidator';
+import { ConsentManager } from '../consent/ConsentManager';
+import { CallbackHandler } from '../consent/CallbackHandler';
+import { DFConfigClient } from '../df/DFConfigClient';
+import { PrincipalClient } from '../principal/PrincipalClient';
+import { EventEmitter } from '../utils/EventEmitter';
+import { buildClientContext, buildAffirmativeAction } from '../utils/context';
+import { type RequestOptions } from './http';
+export declare class ConsentEraClient extends EventEmitter {
+    private config;
+    private logger;
+    private transport;
+    /** Consent session creation and artifact retrieval */
+    readonly session: ConsentSession;
+    /** Consent validation (single + bulk) */
+    readonly validate: ConsentValidator;
+    /** Consent update, withdrawal, and renewal */
+    readonly manage: ConsentManager;
+    /** Callback handler for redirect flows */
+    readonly callback: CallbackHandler;
+    /** DF configuration and notice purposes */
+    readonly df: DFConfigClient;
+    /** Data principal rights and portal SSO */
+    readonly principal: PrincipalClient;
+    /**
+     * Unified consent namespace — aggregates session, validate, manage, callback.
+     */
+    readonly consent: {
+        createSession: ConsentSession['createSession'];
+        redirectToConsent: ConsentSession['redirectToConsent'];
+        openConsentPopup: ConsentSession['openConsentPopup'];
+        getArtifact: ConsentSession['getArtifact'];
+        validate: ConsentValidator['check'];
+        validateBulk: ConsentValidator['checkBulk'];
+        isAllowed: ConsentValidator['isAllowed'];
+        areAllowed: ConsentValidator['areAllowed'];
+        handleCallback: CallbackHandler['parseCallback'];
+        isCallback: CallbackHandler['isCallback'];
+        getContext: ConsentManager['getUpdateContext'];
+        update: ConsentManager['update'];
+        grant: ConsentManager['grant'];
+        deny: ConsentManager['deny'];
+        getWithdrawalContext: ConsentManager['getWithdrawalContext'];
+        withdraw: ConsentManager['withdraw'];
+        withdrawBulk: ConsentManager['withdrawBulk'];
+        getRenewalContext: ConsentManager['getRenewalContext'];
+        renew: ConsentManager['renew'];
+        renewBulk: ConsentManager['renewBulk'];
+    };
+    constructor(config: ConsentEraClientConfig);
+    /**
+     * Central HTTP request method. Delegates to {@link HttpTransport}, which owns
+     * the deadline, the retry policy, the idempotency key and the credential rule.
+     *
+     * @param queryParams query string values (the legacy 4th-argument position)
+     * @param options     per-request road, idempotency key, signal, timeout, retry
+     */
+    request<T>(method: 'GET' | 'POST' | 'PUT' | 'DELETE', path: string, body?: unknown, queryParams?: Record<string, string | number | boolean | undefined | null>, options?: RequestOptions): Promise<T>;
+    /** Build client context — delegates to shared helper */
+    static buildClientContext: typeof buildClientContext;
+    /** Build affirmative action — delegates to shared helper */
+    static buildAffirmativeAction: typeof buildAffirmativeAction;
+    /** Get the current configuration. The credentials are redacted. */
+    getConfig(): ConsentEraClientConfig;
+}
+export { ConsenteraError, ConsentEraApiError, ConsenteraConfigError, ConsenteraAuthError, ConsenteraPermissionError, ConsenteraValidationError, ConsenteraIdentityError, ConsenteraGuardianError, ConsenteraNotFoundError, ConsenteraConflictError, ConsenteraRateLimitError, ConsenteraServerError, ConsenteraNetworkError, ConsenteraTimeoutError, type ConsenteraErrorKind, } from './errors';

package/dist/types/core/ConsenteraConsent.d.ts

@@ -0,0 +1,163 @@
+/**
+ * ConsentEra Consent SDK Core Module
+ * Main entry point for consent management
+ */
+import { ConsentEraConfig, ConsentData, ConsentPreferences, ConsentResponse, ConfigResponse, PurposeCategory, CookieConsentConfigResponse } from '../types';
+import { EventEmitter } from '../utils/EventEmitter';
+export declare class ConsentEraConsent extends EventEmitter {
+    private config;
+    private storage;
+    private banner;
+    private preferenceCenter;
+    private tcfManager;
+    private gppManager;
+    private logger;
+    private initialized;
+    private initPromise;
+    private destroyed;
+    private remoteConfig;
+    private remotePolicyVersion;
+    private ageGateEnabled;
+    private ageGatePrompt;
+    private pendingIsAdult;
+    private readonly deviceId;
+    constructor(config: ConsentEraConfig);
+    private mergeDefaults;
+    private getOrCreateDeviceId;
+    /**
+     * Supply a self-declared adult/minor signal (DPDP §9(3)) before calling
+     * acceptAll()/rejectAll()/savePreferences(). Optional — if never called,
+     * the server treats the visitor as unknown-age and force-denies tracking
+     * categories regardless of what the visitor otherwise selects.
+     */
+    setAgeDeclaration(isAdult: boolean): void;
+    /**
+     * Whether the tenant has DPDP §9(3) age assurance turned on for this
+     * banner. Populated from the real config once init() resolves; false
+     * before that.
+     */
+    isAgeGateEnabled(): boolean;
+    /**
+     * The tenant-configured age-gate prompt text, if any — for an integrator
+     * building their own age-check UI ahead of calling setAgeDeclaration().
+     */
+    getAgeGatePrompt(): string | undefined;
+    /**
+     * Initialize the SDK
+     */
+    init(): Promise<void>;
+    private doInit;
+    private authHeaders;
+    /**
+     * Fetch configuration from server — the real, public, unauthenticated
+     * (beyond X-Tenant-Id) /api/v1/cookie-consent/config surface. Previously
+     * this called {apiEndpoint}/consent/config/{tenantId}, a route that does
+     * not exist anywhere in the API, so every real embed silently fell back to
+     * getDefaultConfig() and never showed the tenant's actual categories.
+     */
+    private fetchConfig;
+    /**
+     * Show consent banner
+     */
+    showBanner(): void;
+    /**
+     * Hide consent banner
+     */
+    hideBanner(): void;
+    /**
+     * Show preference center
+     */
+    showPreferences(): void;
+    /**
+     * Hide preference center
+     */
+    hidePreferences(): void;
+    /**
+     * Accept all consent purposes
+     */
+    acceptAll(): Promise<ConsentResponse>;
+    /**
+     * Reject all non-essential purposes
+     */
+    rejectAll(): Promise<ConsentResponse>;
+    /**
+     * Save consent preferences
+     */
+    savePreferences(preferences: ConsentPreferences): Promise<ConsentResponse>;
+    private saveConsent;
+    /** Client-requested selections, keyed by category/purpose id — required
+     * (mandatory) categories are always true regardless of the input. This is
+     * what gets POSTed; the server may still override individual entries in
+     * its response (see effective_selections above). */
+    private buildSelections;
+    private selectionsToPreferences;
+    private buildConsentData;
+    /**
+     * POST /api/v1/cookie-consent/preferences — the real submit endpoint.
+     * Previously this posted to {apiEndpoint}/consent, a route that does not
+     * exist anywhere in the API, so no real embed ever actually recorded a
+     * consent decision server-side (it silently failed and kept only the
+     * local copy).
+     *
+     * ─── IT THROWS. IT USED TO SWALLOW, AND THAT WAS THE WORST DEFECT HERE ────
+     *
+     * Until 2.0.0 every failure — offline, 403, a wrong host, a 500 — was caught,
+     * logged at warn, and turned into `return null`. The caller then wrote the
+     * local cookie anyway, hid the banner, fired `consent_given` and reported
+     * success. The visitor had clicked Reject All; the platform had no record of
+     * it; and because the cookie existed the banner never came back to ask again.
+     * A withdrawal was lost the same way. The SDK's own log line was the only
+     * trace, at a level nobody reads in production.
+     *
+     * Now the failure reaches the caller, the local copy is NOT written, the
+     * banner stays up, and the host hears about it on `sync_failed` and
+     * `callbacks.onSyncFailed`.
+     */
+    private syncConsent;
+    /**
+     * Get current consent data
+     */
+    getConsent(): ConsentData | null;
+    /**
+     * Check if consent has been given
+     */
+    hasConsent(): boolean;
+    /**
+     * Withdraw consent for specified purposes (or all optional purposes if
+     * none given). There is no separate public withdraw endpoint for the
+     * cookie widget — the real API expresses withdrawal the same way a
+     * changed-mind re-visit is expressed: resubmitting selections via
+     * POST /api/v1/cookie-consent/preferences with the withdrawn categories
+     * set to false. Previously this called {apiEndpoint}/consent/withdraw,
+     * a route that does not exist anywhere in the API.
+     */
+    withdrawConsent(purposes?: string[]): Promise<ConsentResponse>;
+    /**
+     * Check if consent is given for a specific purpose
+     */
+    isConsentGiven(purpose: string): boolean;
+    /**
+     * Get current preferences
+     */
+    getPreferences(): ConsentPreferences;
+    /**
+     * Set language
+     */
+    setLanguage(language: string): void;
+    /**
+     * Destroy SDK instance
+     */
+    destroy(): void;
+}
+/**
+ * Translates the real /api/v1/cookie-consent/config response into the SDK's
+ * own internal ConfigResponse/BannerConfig/PurposeConfig shape that
+ * ConsentBanner and PreferenceCenter render from. Isolated here (rather than
+ * rewriting those two renderers around the real field names) so the
+ * rendering layer's contract stays stable while only the network layer
+ * changes — the real backend's vocabulary (cookie "categories" with a
+ * mandatory/sort_order flag) is a different shape than the SDK's generic
+ * "purposes", not just a rename.
+ */
+export declare function mapCookieConfigToSDKConfig(real: CookieConsentConfigResponse, config: ConsentEraConfig): ConfigResponse;
+export declare function mapCategoryKeyToPurposeCategory(key: string): PurposeCategory;