@consentera/consent-sdk 2.0.0

package/dist/types/core/errors.d.ts

@@ -0,0 +1,108 @@
+/**
+ * Consentera Consent SDK — the error taxonomy.
+ *
+ * ONE class with a discriminant, plus subclasses for `instanceof`. Before 2.0.0
+ * there was a single `ConsentEraApiError` carrying `statusCode` and the raw
+ * `responseBody`, which meant a caller who wanted to know *what went wrong* had
+ * to dig a string out of an untyped body — and the two things support asks for
+ * first, the canonical code and the request id, were both discarded. The API
+ * has carried them the whole time: the envelope is `{code, message}`
+ * (core/apierrors/errors.go:33-38) over ~141 codes of which 22 are canonical
+ * (core/apierrors/canonical_codes.go), and `X-Request-ID` is set by
+ * chi middleware and CORS-exposed so a browser can read it
+ * (cmd/api/main.go:1266, :1272).
+ *
+ * `kind` is the discriminant to switch on. The CODE is the platform's word and
+ * may be one of many; the KIND is this SDK's classification of it and is a
+ * closed set, so `switch (err.kind)` stays exhaustive when the platform adds a
+ * code. Both are on the error — never infer the kind from the code yourself.
+ */
+/** The closed set of error classes a caller can switch on. */
+export type ConsenteraErrorKind = 'config' | 'auth' | 'permission' | 'validation' | 'identity' | 'guardian' | 'not_found' | 'conflict' | 'rate_limit' | 'server' | 'network' | 'timeout' | 'cancelled' | 'unknown';
+export interface ConsenteraErrorInit {
+    kind: ConsenteraErrorKind;
+    message: string;
+    status?: number;
+    code?: string;
+    requestId?: string;
+    responseBody?: unknown;
+    retryable?: boolean;
+    retryAfterMs?: number;
+    cause?: unknown;
+}
+/**
+ * Parse `Retry-After`, which RFC 9110 §10.2.3 allows to be either a count of
+ * seconds or an HTTP-date. Returns milliseconds, or undefined when the header
+ * is absent or unparseable — never NaN, because a NaN delay becomes an
+ * immediate retry and turns a 429 into a hot loop.
+ */
+export declare function parseRetryAfterMs(header: string | null | undefined, now?: number): number | undefined;
+/** The base error every road in this SDK throws. */
+export declare class ConsenteraError extends Error {
+    /** This SDK's classification. A closed set — safe to switch on. */
+    readonly kind: ConsenteraErrorKind;
+    /** The platform's canonical error code, when the response carried one. */
+    readonly code: string | undefined;
+    /** HTTP status; 0 for a transport failure that never reached a status. */
+    readonly status: number;
+    /** `X-Request-ID` off the response. Quote this in a support ticket. */
+    readonly requestId: string | undefined;
+    /** The parsed response body, or the raw text when it was not JSON. */
+    readonly responseBody: unknown;
+    /** Whether THIS SDK would retry it. Already applied internally. */
+    readonly retryable: boolean;
+    /** Server-asked wait, from `Retry-After`, in ms. */
+    readonly retryAfterMs: number | undefined;
+    constructor(init: ConsenteraErrorInit);
+    /** @deprecated 2.0.0 — use `status`. Kept so 1.x `err.statusCode` still reads. */
+    get statusCode(): number;
+    /** A one-line form safe to log: no body, no identifiers. */
+    toString(): string;
+}
+export declare class ConsenteraConfigError extends ConsenteraError {
+}
+export declare class ConsenteraAuthError extends ConsenteraError {
+}
+export declare class ConsenteraPermissionError extends ConsenteraError {
+}
+export declare class ConsenteraValidationError extends ConsenteraError {
+}
+export declare class ConsenteraIdentityError extends ConsenteraError {
+}
+export declare class ConsenteraGuardianError extends ConsenteraError {
+}
+export declare class ConsenteraNotFoundError extends ConsenteraError {
+}
+export declare class ConsenteraConflictError extends ConsenteraError {
+}
+export declare class ConsenteraRateLimitError extends ConsenteraError {
+}
+export declare class ConsenteraServerError extends ConsenteraError {
+}
+export declare class ConsenteraNetworkError extends ConsenteraError {
+}
+export declare class ConsenteraTimeoutError extends ConsenteraError {
+}
+/** Build the error for a non-2xx response. */
+export declare function errorFromResponse(args: {
+    status: number;
+    statusText?: string;
+    body: unknown;
+    requestId?: string;
+    retryAfterMs?: number;
+    method: string;
+    path: string;
+}): ConsenteraError;
+/** A request that never reached a status: DNS, TLS, offline, CORS. */
+export declare function networkError(message: string, cause?: unknown): ConsenteraNetworkError;
+/** The SDK's own deadline fired. */
+export declare function timeoutError(message: string, cause?: unknown): ConsenteraTimeoutError;
+/** The caller's AbortSignal fired. NEVER retryable: the caller asked to stop. */
+export declare function cancelledError(message: string, cause?: unknown): ConsenteraError;
+/** Misconfiguration found before anything went on the wire. */
+export declare function configError(message: string, code?: string): ConsenteraConfigError;
+/**
+ * @deprecated 2.0.0 — `ConsentEraApiError` is now an alias of {@link ConsenteraError}.
+ * `instanceof` and `.statusCode` still work; `.code`, `.kind` and `.requestId` are new.
+ */
+export declare const ConsentEraApiError: typeof ConsenteraError;

package/dist/types/core/http.d.ts

@@ -0,0 +1,176 @@
+/**
+ * Consentera Consent SDK — the transport.
+ *
+ * Everything that talks to the platform goes through `HttpTransport.request`.
+ * One implementation, because the four things below are the ones that are
+ * always missing when each caller writes its own `fetch`:
+ *
+ *  1. A DEADLINE. `fetch` has none. Before 2.0.0 a hung connection hung the
+ *     caller's promise forever, which on a consent gate means a page that never
+ *     renders. Every request now carries an AbortController, linked to the
+ *     caller's own signal so `AbortSignal` cancellation still works.
+ *  2. RETRIES that are safe. Exponential backoff with full jitter on network
+ *     failure, 5xx and 429, honouring `Retry-After` when the server sends one.
+ *  3. ONE IDEMPOTENCY KEY PER LOGICAL OPERATION. Before 2.0.0 the key was
+ *     minted inside the request function from `Date.now()` + `Math.random()`,
+ *     so it changed on every attempt and the caller could not supply one — a
+ *     dedupe mechanism that was present and could not dedupe anything. The key
+ *     is now minted ONCE per logical operation, reused on every retry of it,
+ *     and `options.idempotencyKey` overrides it.
+ *  4. THE REQUEST ID. The platform sets `X-Request-ID` and CORS-exposes it
+ *     (cmd/api/main.go:1266, :1272). It is now on every error.
+ *
+ * WHAT IS DELIBERATELY NOT HERE: no request or response BODY is ever logged.
+ * The body of a session create is the Data Principal's identifiers.
+ */
+import type { Logger } from '../utils/Logger';
+/**
+ * Which door a road goes through, and therefore what credential it may carry.
+ *
+ * OWNER RULING 2026-09-22: a browser bundle never carries a secret.
+ *
+ *  - `df`      identifier-bearing or tenant-scoped. Needs a DF credential, which
+ *              is a SECRET. In a browser it must go through `proxyEndpoint` —
+ *              the Data Fiduciary's own server, which holds the key.
+ *  - `public`  a public road (notice fetch, consent-page config/submit). May
+ *              carry the public site key; carries no secret ever.
+ *  - `session` bound to a consent session by its id and nonce. Carries no key
+ *              at all: the session id IS the capability.
+ */
+export type RoadClass = 'df' | 'public' | 'session';
+export interface RetryPolicy {
+    /** Refuse retry if the server requires a longer wait; never retry early. Absent honors full Retry-After. */
+    maxRetryAfterMs?: number;
+    /** Total attempts including the first. 1 disables retrying. Default 3. */
+    attempts: number;
+    /** First backoff in ms; doubles per attempt. Default 250. */
+    baseDelayMs: number;
+    /** Ceiling for a single backoff, before Retry-After is considered. Default 4000. */
+    maxDelayMs: number;
+}
+export declare const DEFAULT_RETRY: RetryPolicy;
+export declare const DEFAULT_TIMEOUT_MS = 10000;
+export interface RequestOptions {
+    /** Which door. Decides the credential policy. Default 'df'. */
+    road?: RoadClass;
+    /** Query parameters; undefined/null values are dropped. */
+    query?: Record<string, string | number | boolean | undefined | null>;
+    /**
+     * The idempotency key for this LOGICAL operation. Supply it to make a retry
+     * from your own code — a user pressing the button twice, a job re-running —
+     * collapse into one write. Omit it and the SDK mints one per call and reuses
+     * it across its own retries.
+     */
+    idempotencyKey?: string;
+    /** Caller cancellation. Composed with the SDK's own deadline. */
+    signal?: AbortSignal;
+    /** Per-request deadline. Default 10s. */
+    timeoutMs?: number;
+    /** Per-request retry policy override. */
+    retry?: Partial<RetryPolicy>;
+    /** Extra headers for this request only. */
+    headers?: Record<string, string>;
+    /**
+     * Resolve with the STATUS and the body instead of the body alone — see
+     * {@link TransportResponse}. For a road where two success codes mean two
+     * different things: the artifact read answers 200 with the artifact and 202
+     * with "recorded, still being written", and a caller that only sees the body
+     * cannot tell a pending notice from an artifact.
+     */
+    raw?: boolean;
+}
+/**
+ * A 2xx answer with its status. Resolved instead of the bare body when the
+ * request asked for `raw: true`; a non-2xx is still a thrown ConsenteraError.
+ */
+export interface TransportResponse<T> {
+    status: number;
+    body: T;
+    /** `X-Request-ID`, when the platform (or the Data Fiduciary's proxy) sent it. */
+    requestId?: string;
+    /** `Retry-After`, in ms, when the answer carried one (the artifact read's 202 does). */
+    retryAfterMs?: number;
+}
+export interface TransportConfig {
+    /** Internal API plane selection; cookie preferences share the canonical retry transport. */
+    apiPathPrefix?: '/api/v1/public' | '/api/v1/cookie-consent';
+    /** Sent as X-Tenant-Id on direct roads only; a proxy supplies the tenant. */
+    tenantId?: string;
+    apiEndpoint?: string;
+    proxyEndpoint?: string;
+    apiKey?: string;
+    siteKey?: string;
+    customHeaders?: Record<string, string> | (() => Record<string, string>);
+    /**
+     * ESCAPE HATCH, AND IT IS LOUD ON PURPOSE. Sending a secret key from a
+     * browser publishes it to every visitor. Setting this true is allowed only
+     * for a non-browser bundle run in a browser-shaped test harness; every
+     * request then warns.
+     */
+    unsafeAllowSecretKeyInBrowser?: boolean;
+    timeoutMs?: number;
+    retry?: Partial<RetryPolicy>;
+    /**
+     * Last look at every request body before it leaves the browser. Return the
+     * body to send, or throw to stop the call. The Data Fiduciary owns the data
+     * in these payloads; this is where they redact, add or refuse.
+     *
+     * Returning `null` is a REFUSAL and raises `BEFORE_SEND_REFUSED` — it never
+     * silently sends nothing, because a consent write that quietly did not happen
+     * is the failure this SDK exists to avoid.
+     */
+    beforeSend?: (req: {
+        method: string;
+        path: string;
+        body: unknown;
+    }) => unknown | null;
+    /** Default fetch implementation; injected in tests. */
+    fetchImpl?: typeof fetch;
+}
+/** `typeof window !== 'undefined'` in one place, so a test can reason about it. */
+export declare function isBrowser(): boolean;
+/** A secret DF key: the platform's prefixes for the two secret classes. */
+export declare function isSecretKey(key: string | undefined): boolean;
+/** A public site key. */
+export declare function isSiteKey(key: string | undefined): boolean;
+/**
+ * THE ONE REFUSAL, in one place — used by BOTH entry points (ConsentEraClient
+ * and ConsenteraConsent), because a rule enforced at only one door is not a
+ * rule. A secret key in a browser is not a warning: the bundle is public, so by
+ * the time it runs the key is already published to every visitor. Refusing at
+ * construction is the only point at which the integrator still has the option
+ * of not shipping it.
+ *
+ * `fix` is the entry-point-specific remedy (a proxy endpoint for the lifecycle
+ * client, a public site key for the cookie SDK); everything else — the reason,
+ * the prefix echo, the escape hatch — is identical, which is exactly why it
+ * lives here rather than being copied and left to drift.
+ */
+export declare function assertNoSecretKeyInBrowser(opts: {
+    apiKey?: string;
+    unsafeAllowSecretKeyInBrowser?: boolean;
+    fix: string;
+}): void;
+/**
+ * Crypto-strong id. `Math.random()` was what minted idempotency keys before
+ * 2.0.0; it is neither unpredictable nor collision-safe at 6 characters.
+ */
+export declare function newRequestId(): string;
+/** Full-jitter backoff (AWS's "Exponential Backoff and Jitter"): random in [0, cap]. */
+export declare function backoffMs(attempt: number, policy: RetryPolicy, random?: () => number): number;
+export declare class HttpTransport {
+    private config;
+    private logger;
+    constructor(config: TransportConfig, logger: Logger);
+    /** Swap config after construction (the client re-reads customHeaders each call). */
+    updateConfig(patch: Partial<TransportConfig>): void;
+    /**
+     * The credential decision for one road, in one place so the policy can be
+     * read rather than reconstructed from call sites.
+     *
+     * Returns the auth headers to send, or throws a config error naming the fix.
+     */
+    authHeadersFor(road: RoadClass, viaProxy: boolean): Record<string, string>;
+    private urlFor;
+    request<T>(method: 'GET' | 'POST' | 'PUT' | 'DELETE', path: string, body?: unknown, options?: RequestOptions): Promise<T>;
+}

package/dist/types/core/version.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The SDK's own version, sent on every request as `X-Consentera-SDK`.
+ *
+ * KEPT IN SYNC BY A TEST, NOT BY A BUILD STEP. `src/__tests__/core/version.test.ts`
+ * reads package.json and fails when the two disagree, so a release that forgets
+ * this file cannot go green. A build-time codegen would have been the other
+ * option; it was rejected because the constant then does not exist when a host
+ * builds from src, and because a generated file in the tree is one command from
+ * being overwritten with the wrong value and nothing noticing.
+ */
+export declare const SDK_NAME = "consent-sdk-js";
+export declare const SDK_VERSION = "2.0.0";
+export declare const SDK_PLATFORM = "web";
+/** The value of the `X-Consentera-SDK` header: `<surface>/<version>`. */
+export declare const SDK_HEADER_VALUE = "js/2.0.0";
+/**
+ * The `User-Agent` half of the pair, agreed across all six surfaces
+ * (coordinator ruling 2026-09-22):
+ *
+ *     User-Agent:        ConsenteraSDK/2.0.0 (<platform>; <runtime>)
+ *     X-Consentera-SDK:  <surface>/2.0.0
+ *
+ * `ConsenteraSDK/<version>` is the form the PLATFORM ALREADY PARSES:
+ * `internal/core/audit/user_agent_coarsening_test.go:39-40` asserts that
+ * `ConsenteraSDK/2.3.1 (Android 14; SM-G991B; build 4471)` coarsens to
+ * `ConsenteraSDK/2`, so this is the shape its audit pipeline expects rather
+ * than a new one. (A second spelling, `consentera-sdk/1.2`, appears in
+ * `validation_envelope_test.go:233`; the pair above is the agreed one.)
+ *
+ * IN A BROWSER THIS HEADER CANNOT BE SENT. `User-Agent` is a forbidden header
+ * name (fetch spec §forbidden-request-header), so a browser silently drops any
+ * attempt to set it — the SDK does not try, and the browser build identifies
+ * itself with `X-Consentera-SDK` alone. The Node build (and the CLI) send both,
+ * because there the header is ours to set.
+ */
+export declare function userAgentValue(runtime?: string): string;

package/dist/types/df/DFConfigClient.d.ts

@@ -0,0 +1,59 @@
+/**
+ * ConsentEra Consent SDK — DF Configuration Client
+ * Fetch Data Fiduciary configuration, purposes, and notice details
+ */
+import { DFConfig, DFPurpose, NoticePurposesResponse } from '../types/consent-lifecycle';
+import { Logger } from '../utils/Logger';
+import type { RequestOptions } from '../core/http';
+type RequestFn = <T>(method: 'GET' | 'POST' | 'PUT' | 'DELETE', path: string, body?: unknown, queryParams?: Record<string, string | number | boolean | undefined | null>, options?: RequestOptions) => Promise<T>;
+export declare class DFConfigClient {
+    private request;
+    private logger;
+    private cachedConfig;
+    constructor(request: RequestFn, logger: Logger);
+    /**
+     * Get the full DF configuration (tenant info, purposes, notices, branding).
+     * Results are cached for the lifetime of the client instance.
+     */
+    getConfig(language?: string): Promise<DFConfig>;
+    /**
+     * Get all purposes configured for this DF.
+     */
+    getPurposes(): Promise<DFPurpose[]>;
+    /**
+     * Get purposes associated with a specific notice.
+     * This returns the ordered list of purposes as they appear in the notice.
+     */
+    getNoticePurposes(noticeInternalName?: string, language?: string): Promise<NoticePurposesResponse>;
+    /**
+     * Get the pre-rendered HTML+CSS snapshot for a notice, including purpose snapshot.
+     * Use this instead of getConfig() for bootstrapping notice-based consent UIs.
+     *
+     * @param noticeName - internal_name of the notice (required)
+     * @param noticeLanguage - language of the notice content (default: tenant primary language)
+     * @param templateLanguage - language for widget UI labels (optional)
+     */
+    getNoticeTemplate(noticeName: string, noticeLanguage?: string, templateLanguage?: string): Promise<Record<string, unknown>>;
+    /**
+     * Get the widget template for a consent SESSION's collection UI.
+     *
+     * THE ROUTE CHANGED IN 2.0.0, because the old one did not exist. This called
+     * GET /df/widget-template, which is a 404 — there is no such platform route.
+     * The real widget template is session-scoped: GET
+     * /consent/sessions/{id}/widget-template (routes_consent.go:125), which sits
+     * in the pre-auth throttle group and takes NO DF credential — the session id
+     * and its nonce are the capability. So this needs a session id, and rides the
+     * `session` road (no key, no proxy required).
+     *
+     * For the notice-authoring template keyed by internal_name, use
+     * {@link getNoticeTemplate}, which is the site-key-openable /df/notice/template.
+     *
+     * @param sessionId the consent_session_id from createSession()
+     */
+    getSessionWidgetTemplate(sessionId: string): Promise<Record<string, unknown>>;
+    /**
+     * Clear the cached config (useful after config changes).
+     */
+    clearCache(): void;
+}
+export {};

package/dist/types/gcm/ConsentModeBridge.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Google Consent Mode v2 bridge.
+ *
+ * Maps Consentera purpose decisions onto the four Consent Mode v2 signals
+ * (analytics_storage, ad_storage, ad_user_data, ad_personalization) and
+ * pushes them through gtag's dataLayer — `default` denied at install (before
+ * any Google tag fires), `update` on every consent.changed event.
+ *
+ * Usage:
+ *   const bridge = installConsentModeBridge(client, {
+ *     analytics_storage:   ['product_analytics'],
+ *     ad_storage:          ['marketing_communications'],
+ *     ad_user_data:        ['marketing_communications'],
+ *     ad_personalization:  ['marketing_communications'],
+ *   });
+ *   // after reading current state (e.g. update-context or validate):
+ *   bridge.apply({ product_analytics: true, marketing_communications: false });
+ *
+ * The bridge never loads Google code itself — it only writes the standard
+ * dataLayer entries, so it is inert until/unless a Google tag is present.
+ */
+export type ConsentModeSignal = 'analytics_storage' | 'ad_storage' | 'ad_user_data' | 'ad_personalization';
+export type ConsentModeMapping = Partial<Record<ConsentModeSignal, string[]>>;
+interface ChangedPayload {
+    dataPrincipalId: string;
+    changes: {
+        purpose_id: string;
+        status: string;
+    }[];
+    source: string;
+}
+interface BusLike {
+    on(event: string, cb: (payload: ChangedPayload) => void): void;
+}
+export declare class ConsentModeBridge {
+    private mapping;
+    /** purpose id/code → granted? — the bridge's view of current state. */
+    private state;
+    constructor(mapping: ConsentModeMapping);
+    /** Send the Consent Mode v2 `default` (everything mapped → denied). */
+    sendDefault(waitForUpdateMs?: number): void;
+    /** Replace the bridge's purpose state wholesale and push an update. */
+    apply(purposeStates: Record<string, boolean>): void;
+    /** Fold a consent.changed event into state and push an update. */
+    onChanged(payload: ChangedPayload): void;
+    private push;
+}
+/**
+ * Install the bridge: sends the denied `default` immediately and subscribes
+ * to the client's `consent.changed` bus. Returns the bridge so the caller can
+ * `apply()` the current state once known.
+ */
+export declare function installConsentModeBridge(bus: BusLike, mapping: ConsentModeMapping): ConsentModeBridge;
+export {};

package/dist/types/gpp/GPPManager.d.ts

@@ -0,0 +1,62 @@
+/**
+ * GPP Manager
+ * IAB Global Privacy Platform implementation
+ */
+import { GPPConfig, GPPData, ConsentPreferences } from '../types';
+export declare class GPPManager {
+    private config;
+    private gppData;
+    constructor(config: GPPConfig);
+    /**
+     * Initialize GPP API
+     */
+    init(): Promise<void>;
+    /**
+     * Create __gpp stub
+     */
+    private createGPPApiStub;
+    /**
+     * Get default GPP data
+     */
+    private getDefaultGPPData;
+    /**
+     * Get section data
+     */
+    private getSectionData;
+    /**
+     * Get field value
+     */
+    private getFieldValue;
+    /**
+     * Update consent in GPP format
+     */
+    updateConsent(preferences: ConsentPreferences): Promise<void>;
+    /**
+     * Build GPP string
+     */
+    private buildGPPString;
+    /**
+     * Encode GPP string
+     */
+    private encodeGPPString;
+    /**
+     * Determine applicable sections
+     */
+    private determineSections;
+    /**
+     * Dispatch GPP event
+     */
+    private dispatchGPPEvent;
+    /**
+     * Get current GPP data
+     */
+    getGPPData(): GPPData | null;
+    /**
+     * Get GPP string
+     */
+    getGPPString(): string;
+    /**
+     * Destroy GPP manager
+     */
+    destroy(): void;
+}

package/dist/types/index.d.mts

@@ -0,0 +1,5 @@
+// GENERATED by scripts/emit-esm-types.mjs — do not edit.
+// The ESM-flavoured door into the shared declaration tree; that script says
+// why a .d.mts entry is needed at all.
+export * from './index.js';
+export { default } from './index.js';

package/dist/types/index.d.ts

@@ -0,0 +1,28 @@
+/**
+ * ConsentEra Consent SDK
+ * DPDP, GDPR, TCF 2.2 compliant consent management for web applications
+ */
+import { ConsentEraConsent } from './core/ConsenteraConsent';
+import { ConsentBanner } from './ui/ConsentBanner';
+import { PreferenceCenter } from './ui/PreferenceCenter';
+import { ConsentStorage } from './storage/ConsentStorage';
+import { TCFManager } from './tcf/TCFManager';
+import { GPPManager } from './gpp/GPPManager';
+export { ConsentEraConsent, ConsentBanner, PreferenceCenter, ConsentStorage, TCFManager, GPPManager, };
+export * from './types';
+export { ConsentEraClient } from './core/ConsentEraClient';
+export { ConsenteraError, ConsentEraApiError, ConsenteraConfigError, ConsenteraAuthError, ConsenteraPermissionError, ConsenteraValidationError, ConsenteraIdentityError, ConsenteraGuardianError, ConsenteraNotFoundError, ConsenteraConflictError, ConsenteraRateLimitError, ConsenteraServerError, ConsenteraNetworkError, ConsenteraTimeoutError, parseRetryAfterMs, type ConsenteraErrorKind, } from './core/errors';
+export { HttpTransport, isBrowser, isSecretKey, isSiteKey, newRequestId, DEFAULT_RETRY, DEFAULT_TIMEOUT_MS, type RoadClass, type RetryPolicy, type RequestOptions, type TransportResponse, type TransportConfig, } from './core/http';
+export { SDK_NAME, SDK_VERSION, SDK_PLATFORM, SDK_HEADER_VALUE } from './core/version';
+export { readStored, writeStored, removeStored, storageAvailable, storageKeys, type StorageKind, } from './utils/browserStorage';
+export { ConsentSession } from './consent/ConsentSession';
+export { ConsentValidator } from './consent/ConsentValidator';
+export { ConsentManager } from './consent/ConsentManager';
+export { CallbackHandler, verifyCallbackSignature, claimedCallbackStatus, type CallbackClaimedStatus, type CallbackResult, type CallbackStatus, type CallbackParams, type CallbackSignatureVerifier, type CallbackHandlerOptions, } from './consent/CallbackHandler';
+export { readDecisionMessage, type ConsentPopupResult, type ConsentPopupDecision, type ConsentPopupDismissed, type ConsentPopupOptions, type DecisionStatus, } from './consent/consentPopup';
+export { DFConfigClient } from './df/DFConfigClient';
+export { PrincipalClient } from './principal/PrincipalClient';
+export { ConsentModeBridge, installConsentModeBridge, type ConsentModeMapping, type ConsentModeSignal, } from './gcm/ConsentModeBridge';
+export * from './types/consent-lifecycle';
+export { principalBody, buildClientContext, type PrincipalRef, type ContextMode } from './utils/context';
+export default ConsentEraConsent;

package/dist/types/principal/PrincipalClient.d.ts

@@ -0,0 +1,34 @@
+/**
+ * ConsentEra Consent SDK — Principal Client
+ * Data principal rights: Portal SSO, data export, deletion requests
+ */
+import { ConsentEraClientConfig, PrincipalTokenResponse } from '../types/consent-lifecycle';
+import { Logger } from '../utils/Logger';
+import type { RequestOptions } from '../core/http';
+type RequestFn = <T>(method: 'GET' | 'POST' | 'PUT' | 'DELETE', path: string, body?: unknown, queryParams?: Record<string, string | number | boolean | undefined | null>, options?: RequestOptions) => Promise<T>;
+export declare class PrincipalClient {
+    private request;
+    private logger;
+    constructor(request: RequestFn, _config: ConsentEraClientConfig, logger: Logger);
+    /**
+     * Generate a principal portal SSO token.
+     * Returns a URL the data principal can visit to manage their consents.
+     *
+     * THIS ROAD STILL TAKES data_principal_ref, AND THAT IS CORRECT. It is
+     * identity/dfclient's (handlers.go:1418-1428), not the consent module's, so
+     * the 2026-09-21 ruling that refuses the field across the consent surface
+     * does not reach it. A sweep that converted this call would break a working
+     * endpoint.
+     */
+    getPortalToken(dataPrincipalRef: string, redirectPath?: string): Promise<PrincipalTokenResponse>;
+    /**
+     * Get the full portal URL for a data principal.
+     * Convenience method that returns just the redirect URL string.
+     */
+    getPortalUrl(dataPrincipalRef: string, redirectPath?: string): Promise<string>;
+    /**
+     * Open the principal portal in a new browser window/tab.
+     */
+    openPortal(dataPrincipalRef: string, redirectPath?: string): Promise<void>;
+}
+export {};

package/dist/types/react/ConsentEraProvider.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Consentera Consent SDK — React Provider
+ *
+ * TWO THINGS CHANGED IN 2.0.0, both of which a React reviewer would have caught
+ * and neither of which a test would have:
+ *
+ *  1. The client used to be constructed inside `useMemo` with `setError` called
+ *     from the factory — a setState DURING RENDER. React 18 warns about it and
+ *     React 19 escalates the common cross-component case to an error; under
+ *     StrictMode the factory also runs twice, so the error was set twice.
+ *  2. When construction failed the provider returned `<>{children}</>` WITHOUT
+ *     the context, so every hook below it threw
+ *     "useConsentEraClient must be used within <ConsentEraProvider>" — in a tree
+ *     that plainly was inside one. The real cause (a missing tenantId, a secret
+ *     key in a browser) sat in a state nothing rendered. The provider now always
+ *     provides, with `client: null` and the real error on the context. Since
+ *     WEB-038 no hook THROWS on it either: a throw during render blanks the
+ *     page, so the hooks return `client: null` with the error and the gate
+ *     renders its fallback.
+ *
+ * `'use client'` is at the top of this file AND emitted as a banner on the built
+ * bundle (rollup.config.js). Without it, importing this package from a Next.js
+ * App Router tree fails the build with "You're importing a component that needs
+ * createContext" — which is most React apps written today.
+ */
+import { type ReactNode } from 'react';
+import { ConsentEraClient } from '../core/ConsentEraClient';
+import { ConsentEraClientConfig } from '../types/consent-lifecycle';
+export interface ConsentEraContextValue {
+    /** The client, or null when the configuration was refused. */
+    client: ConsentEraClient | null;
+    loading: boolean;
+    /** Construction or runtime error. Non-null with `client: null` means config. */
+    error: Error | null;
+}
+export interface ConsentEraProviderProps {
+    config: ConsentEraClientConfig;
+    children: ReactNode;
+}
+export declare function ConsentEraProvider({ config, children }: ConsentEraProviderProps): import("react").JSX.Element;
+/**
+ * The context as provided: `client` is null when the configuration was
+ * refused (then `error` says why) or when there is no provider at all (then
+ * `error` says that). NEVER throws.
+ */
+export declare function useConsentEraContext(): ConsentEraContextValue;
+/**
+ * The client, or `client: null` with the reason in `error`. NEVER throws
+ * during render (SDK register WEB-038).
+ *
+ * It used to throw when the provider's configuration was refused: a missing
+ * tenantId, a secret key in a browser. That threw from inside render, so a
+ * configuration mistake did not produce a closed consent gate. It produced a
+ * blank page, measured in the React demos. Render your fallback on
+ * `client === null`. `error` is a ConsenteraError whose `code` names the
+ * refusal (`SECRET_KEY_IN_BROWSER`, `ENDPOINT_REQUIRED`, …).
+ */
+export declare function useConsentEraClient(): ConsentEraContextValue;

package/dist/types/react/ConsentGate.d.ts

@@ -0,0 +1,40 @@
+/**
+ * ConsentEra Consent SDK — ConsentGate Component
+ * Conditionally renders children based on consent validation.
+ *
+ * @example
+ * ```tsx
+ * <ConsentGate
+ *   who={{ data_principal_identifiers: { email: "user@example.com" } }}
+ *   purposeCode="marketing_email"
+ *   fallback={<p>Marketing consent required.</p>}>
+ *   <MarketingContent />
+ * </ConsentGate>
+ * ```
+ */
+import { ReactNode } from 'react';
+import type { PrincipalRef } from '../utils/context';
+export interface ConsentGateProps {
+    /**
+     * Who to validate for: `{ data_principal_id }` when you hold the platform's
+     * uuid, or `{ data_principal_identifiers: { …the fields of this
+     * organisation's locked integration key… } }` (F015: an open, per-tenant
+     * scheme-keyed map, not a fixed set).
+     *
+     * This replaced a `dataPrincipalRef: string` prop that went on the wire as
+     * `data_principal_ref` — a field the API now refuses outright
+     * (`DATA_PRINCIPAL_REF_REFUSED`), so the old prop could only build a request
+     * that 400s. The mobile atom is `mobile` on this road and on create alike
+     * (F015); `phone` is refused by name.
+     */
+    who: PrincipalRef;
+    /** Purpose code to validate against */
+    purposeCode: string;
+    /** Content to render when consent is granted */
+    children: ReactNode;
+    /** Content to render when consent is denied or loading (defaults to null) */
+    fallback?: ReactNode;
+    /** Content to render while validation is in progress (defaults to fallback) */
+    loading?: ReactNode;
+}
+export declare function ConsentGate({ who, purposeCode, children, fallback, loading: loadingContent, }: ConsentGateProps): import("react").JSX.Element;