@consentera/consent-sdk 2.0.0

package/dist/consentera-consent.cjs

@@ -0,0 +1,4919 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+/**
+ * Consentera Consent SDK — guarded browser storage.
+ *
+ * EVERY ACCESS IS WRAPPED, AND THAT IS NOT DEFENSIVENESS. `localStorage` and
+ * `sessionStorage` THROW rather than return null in ordinary, common
+ * configurations: Safari's private browsing on old versions, a site with
+ * cookies blocked, a sandboxed iframe without `allow-same-origin`, a quota that
+ * is full. Before 2.0.0 `ConsentStorage.save()` called `localStorage.setItem`
+ * bare, so a visitor with storage blocked did not get a degraded banner — they
+ * got an exception out of the middle of a consent write.
+ *
+ * ONE implementation, so the "did we remember to try/catch this one" question
+ * is asked once. `ConsenteraConsent.getOrCreateDeviceId` already had the right
+ * shape; it was the only place that did.
+ *
+ * When storage is unavailable the SDK degrades to a per-page memory map: the
+ * flow still works within the page, it just does not survive a reload. That is
+ * the correct trade for a consent handshake, which is short-lived.
+ */
+const memory = {
+    local: new Map(),
+    session: new Map(),
+};
+/** The one place key names are spelled, so a reader and a writer cannot drift. */
+const storageKeys = {
+    session: (id) => `consentera_session_${id}`,
+    callback: (id) => `consentera_callback_${id}`,
+    pendingSync: 'consentera_pending_sync',
+    deviceId: 'consentera_device_id',
+};
+function backing(kind) {
+    try {
+        if (typeof window === 'undefined')
+            return null;
+        const s = kind === 'local' ? window.localStorage : window.sessionStorage;
+        // Touching the object is itself what throws in a blocked context, so the
+        // probe has to be a real operation rather than a truthiness check.
+        const probe = '__consentera_probe__';
+        s.setItem(probe, '1');
+        s.removeItem(probe);
+        return s;
+    }
+    catch {
+        return null;
+    }
+}
+/** True when the real browser store is usable; false when we are on memory. */
+function storageAvailable(kind) {
+    return backing(kind) !== null;
+}
+function readStored(kind, key) {
+    const s = backing(kind);
+    if (!s)
+        return memory[kind].get(key) ?? null;
+    try {
+        return s.getItem(key);
+    }
+    catch {
+        return memory[kind].get(key) ?? null;
+    }
+}
+/** Returns false when the value could not be persisted anywhere durable. */
+function writeStored(kind, key, value) {
+    const s = backing(kind);
+    if (s) {
+        try {
+            s.setItem(key, value);
+            return true;
+        }
+        catch {
+            /* quota or policy — fall through to memory */
+        }
+    }
+    memory[kind].set(key, value);
+    return false;
+}
+function removeStored(kind, key) {
+    const s = backing(kind);
+    if (s) {
+        try {
+            s.removeItem(key);
+        }
+        catch {
+            /* ignore */
+        }
+    }
+    memory[kind].delete(key);
+}
+
+/**
+ * Consent Storage Module
+ * Handles persistence of consent data
+ */
+/**
+ * A cookie over this many bytes is silently dropped by every browser (the
+ * per-cookie limit is 4096 bytes including the name and attributes). Dropped
+ * silently means `exists()` stays false forever and the banner returns on every
+ * page view, with nothing anywhere saying why.
+ */
+const COOKIE_BYTE_LIMIT = 4096;
+class ConsentStorage {
+    config;
+    key;
+    constructor(config) {
+        this.config = {
+            type: 'cookie',
+            cookieName: 'consentera_consent',
+            cookieExpiry: 365,
+            cookiePath: '/',
+            // `secure` BY PROTOCOL, not unconditionally. A `; secure` cookie on an
+            // http:// origin is dropped by every browser WITHOUT AN ERROR, so a
+            // hardcoded true meant the consent cookie never stored on a developer's
+            // http://localhost — exists() stayed false, the banner returned on every
+            // page view, and nothing said why. https stays secure, which is the case
+            // that matters.
+            secure: typeof location !== 'undefined' ? location.protocol === 'https:' : true,
+            sameSite: 'Lax',
+            ...config,
+        };
+        this.key = this.config.cookieName;
+    }
+    /**
+     * Save consent data
+     */
+    save(consent) {
+        const data = JSON.stringify(consent);
+        switch (this.config.type) {
+            case 'cookie':
+                return this.setCookie(data);
+            case 'localStorage':
+                return writeStored('local', this.key, data);
+            case 'sessionStorage':
+                return writeStored('session', this.key, data);
+            default:
+                return false;
+        }
+    }
+    /**
+     * Get consent data
+     */
+    get() {
+        let data = null;
+        switch (this.config.type) {
+            case 'cookie':
+                data = this.getCookie();
+                break;
+            case 'localStorage':
+                data = readStored('local', this.key);
+                break;
+            case 'sessionStorage':
+                data = readStored('session', this.key);
+                break;
+        }
+        if (!data)
+            return null;
+        try {
+            return JSON.parse(data);
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Check if consent exists
+     */
+    exists() {
+        return this.get() !== null;
+    }
+    /**
+     * Clear consent data
+     */
+    clear() {
+        switch (this.config.type) {
+            case 'cookie':
+                this.deleteCookie();
+                break;
+            case 'localStorage':
+                removeStored('local', this.key);
+                break;
+            case 'sessionStorage':
+                removeStored('session', this.key);
+                break;
+        }
+    }
+    /**
+     * Set cookie
+     */
+    /** @returns false when the value could not be stored (and says why). */
+    setCookie(value) {
+        const { cookieExpiry, cookiePath, cookieDomain, secure, sameSite } = this.config;
+        let cookie = `${encodeURIComponent(this.key)}=${encodeURIComponent(value)}`;
+        if (cookieExpiry) {
+            const date = new Date();
+            date.setTime(date.getTime() + cookieExpiry * 24 * 60 * 60 * 1000);
+            cookie += `; expires=${date.toUTCString()}`;
+        }
+        if (cookiePath) {
+            cookie += `; path=${cookiePath}`;
+        }
+        if (cookieDomain) {
+            cookie += `; domain=${cookieDomain}`;
+        }
+        if (secure) {
+            cookie += '; secure';
+        }
+        if (sameSite) {
+            cookie += `; samesite=${sameSite}`;
+        }
+        // OVER THE LIMIT THE BROWSER DROPS IT WITHOUT A WORD. Refusing here, loudly,
+        // beats a consent record that appears to be saved and is not.
+        const size = new Blob([cookie]).size;
+        if (size > COOKIE_BYTE_LIMIT) {
+            // eslint-disable-next-line no-console
+            console.error(`[Consentera] the consent cookie is ${size} bytes, over the ${COOKIE_BYTE_LIMIT}-byte ` +
+                'browser limit, and would be dropped silently. Use storage.type "localStorage", or ' +
+                'reduce the number of purposes stored on the device.');
+            return false;
+        }
+        if (typeof document === 'undefined')
+            return false;
+        try {
+            document.cookie = cookie;
+        }
+        catch {
+            return false;
+        }
+        return this.getCookie() !== null;
+    }
+    /**
+     * Get cookie value
+     */
+    getCookie() {
+        if (typeof document === 'undefined')
+            return null;
+        const name = encodeURIComponent(this.key) + '=';
+        const cookies = document.cookie.split(';');
+        for (let cookie of cookies) {
+            cookie = cookie.trim();
+            if (cookie.indexOf(name) === 0) {
+                return decodeURIComponent(cookie.substring(name.length));
+            }
+        }
+        return null;
+    }
+    /**
+     * Delete cookie
+     */
+    deleteCookie() {
+        if (typeof document === 'undefined')
+            return;
+        const { cookiePath, cookieDomain } = this.config;
+        let cookie = `${encodeURIComponent(this.key)}=; expires=Thu, 01 Jan 1970 00:00:00 GMT`;
+        if (cookiePath) {
+            cookie += `; path=${cookiePath}`;
+        }
+        if (cookieDomain) {
+            cookie += `; domain=${cookieDomain}`;
+        }
+        document.cookie = cookie;
+    }
+}
+
+/**
+ * Consent Banner UI Component
+ */
+// SEC-H10 FIX: Escape HTML entities in server content before innerHTML assignment.
+function escapeHtml$1(str) {
+    const div = document.createElement('div');
+    div.textContent = str;
+    return div.innerHTML;
+}
+// Sanitize a URL for use in href attributes (allow only http/https/mailto).
+function sanitizeUrl$1(url) {
+    try {
+        const parsed = new URL(url, window.location.origin);
+        if (['http:', 'https:', 'mailto:'].includes(parsed.protocol)) {
+            return parsed.href;
+        }
+    }
+    catch {
+        // invalid URL
+    }
+    return '#';
+}
+class ConsentBanner {
+    config;
+    theme;
+    sdk;
+    container = null;
+    isVisible = false;
+    constructor(config, theme, sdk) {
+        this.config = config;
+        this.theme = theme;
+        this.sdk = sdk;
+    }
+    show() {
+        if (this.isVisible)
+            return;
+        this.createBanner();
+        this.isVisible = true;
+    }
+    hide() {
+        if (!this.isVisible || !this.container)
+            return;
+        this.container.classList.add('consentera-banner--closing');
+        setTimeout(() => {
+            this.container?.remove();
+            this.container = null;
+            this.isVisible = false;
+        }, 300);
+    }
+    createBanner() {
+        // Create container
+        this.container = document.createElement('div');
+        this.container.id = 'consentera-consent-banner';
+        this.container.className = `consentera-banner consentera-banner--${this.theme.position || 'bottom'}`;
+        this.container.setAttribute('role', 'dialog');
+        this.container.setAttribute('aria-modal', 'true');
+        this.container.setAttribute('aria-labelledby', 'consentera-banner-title');
+        // Inject styles
+        this.injectStyles();
+        // Create content
+        this.container.innerHTML = this.getBannerHTML();
+        // Add event listeners
+        this.attachEventListeners();
+        // Append to body
+        document.body.appendChild(this.container);
+        // Trigger animation
+        requestAnimationFrame(() => {
+            this.container?.classList.add('consentera-banner--visible');
+        });
+    }
+    getBannerHTML() {
+        const { banner } = this.config;
+        return `
+      <div class="consentera-banner__content">
+        ${this.theme.showLogo ? `
+          <div class="consentera-banner__logo">
+            ${this.theme.logoUrl
+            ? `<img src="${sanitizeUrl$1(this.theme.logoUrl)}" alt="Logo" />`
+            : this.getDefaultLogo()}
+          </div>
+        ` : ''}
+
+        <div class="consentera-banner__text">
+          <h2 id="consentera-banner-title" class="consentera-banner__title">
+            ${escapeHtml$1(banner.title || 'We value your privacy')}
+          </h2>
+          <p class="consentera-banner__description">
+            ${escapeHtml$1(banner.description || 'We use cookies to enhance your experience.')}
+          </p>
+          ${banner.showPrivacyPolicy && banner.privacyPolicyUrl ? `
+            <a href="${sanitizeUrl$1(banner.privacyPolicyUrl)}" target="_blank" rel="noopener" class="consentera-banner__link">
+              Privacy Policy
+            </a>
+          ` : ''}
+        </div>
+
+        <div class="consentera-banner__actions">
+          ${banner.showCustomize ? `
+            <button type="button" class="consentera-btn consentera-btn--secondary" data-action="customize">
+              ${escapeHtml$1(banner.customizeText || 'Customize')}
+            </button>
+          ` : ''}
+          ${banner.showRejectAll ? `
+            <button type="button" class="consentera-btn consentera-btn--secondary" data-action="reject">
+              ${escapeHtml$1(banner.rejectAllText || 'Reject All')}
+            </button>
+          ` : ''}
+          <button type="button" class="consentera-btn consentera-btn--primary" data-action="accept">
+            ${escapeHtml$1(banner.acceptAllText || 'Accept All')}
+          </button>
+        </div>
+      </div>
+    `;
+    }
+    getDefaultLogo() {
+        return `
+      <svg width="32" height="32" viewBox="0 0 32 32" fill="none" xmlns="http://www.w3.org/2000/svg">
+        <rect width="32" height="32" rx="8" fill="${this.theme.primaryColor || '#2563eb'}"/>
+        <path d="M16 6L24 10V16C24 21.52 20.6 26.74 16 28C11.4 26.74 8 21.52 8 16V10L16 6Z"
+              stroke="white" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+        <path d="M12 16L14.5 18.5L20 13"
+              stroke="white" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+      </svg>
+    `;
+    }
+    attachEventListeners() {
+        if (!this.container)
+            return;
+        this.container.addEventListener('click', (e) => {
+            const target = e.target;
+            const action = target.dataset.action;
+            if (!action)
+                return;
+            switch (action) {
+                case 'accept':
+                    this.sdk.acceptAll();
+                    break;
+                case 'reject':
+                    this.sdk.rejectAll();
+                    break;
+                case 'customize':
+                    this.hide();
+                    this.sdk.showPreferences();
+                    break;
+            }
+        });
+        // Handle escape key
+        document.addEventListener('keydown', this.handleKeyDown.bind(this));
+    }
+    handleKeyDown(e) {
+        if (e.key === 'Escape' && this.isVisible) ;
+    }
+    injectStyles() {
+        if (document.getElementById('consentera-consent-styles'))
+            return;
+        const styleElement = document.createElement('style');
+        styleElement.id = 'consentera-consent-styles';
+        styleElement.textContent = this.getStyles();
+        document.head.appendChild(styleElement);
+    }
+    getStyles() {
+        const { primaryColor, backgroundColor, textColor, borderRadius, fontFamily } = this.theme;
+        return `
+      .consentera-banner {
+        position: fixed;
+        left: 0;
+        right: 0;
+        z-index: 999999;
+        font-family: ${fontFamily || '-apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif'};
+        opacity: 0;
+        transform: translateY(100%);
+        transition: opacity 0.3s ease, transform 0.3s ease;
+      }
+
+      .consentera-banner--bottom {
+        bottom: 0;
+      }
+
+      .consentera-banner--top {
+        top: 0;
+        transform: translateY(-100%);
+      }
+
+      .consentera-banner--visible {
+        opacity: 1;
+        transform: translateY(0);
+      }
+
+      .consentera-banner--closing {
+        opacity: 0;
+        transform: translateY(100%);
+      }
+
+      .consentera-banner--top.consentera-banner--closing {
+        transform: translateY(-100%);
+      }
+
+      .consentera-banner__content {
+        display: flex;
+        align-items: center;
+        gap: 24px;
+        padding: 20px 24px;
+        background: ${backgroundColor || '#ffffff'};
+        color: ${textColor || '#1f2937'};
+        box-shadow: 0 -4px 20px rgba(0, 0, 0, 0.1);
+        border-radius: ${borderRadius || '0'} ${borderRadius || '0'} 0 0;
+      }
+
+      .consentera-banner--top .consentera-banner__content {
+        border-radius: 0 0 ${borderRadius || '0'} ${borderRadius || '0'};
+        box-shadow: 0 4px 20px rgba(0, 0, 0, 0.1);
+      }
+
+      .consentera-banner__logo {
+        flex-shrink: 0;
+      }
+
+      .consentera-banner__logo img,
+      .consentera-banner__logo svg {
+        width: 48px;
+        height: 48px;
+        object-fit: contain;
+      }
+
+      .consentera-banner__text {
+        flex: 1;
+        min-width: 0;
+      }
+
+      .consentera-banner__title {
+        margin: 0 0 4px 0;
+        font-size: 16px;
+        font-weight: 600;
+        color: ${textColor || '#1f2937'};
+      }
+
+      .consentera-banner__description {
+        margin: 0;
+        font-size: 14px;
+        color: ${textColor || '#6b7280'};
+        line-height: 1.5;
+      }
+
+      .consentera-banner__link {
+        display: inline-block;
+        margin-top: 8px;
+        font-size: 13px;
+        color: ${primaryColor || '#2563eb'};
+        text-decoration: underline;
+      }
+
+      .consentera-banner__actions {
+        display: flex;
+        gap: 12px;
+        flex-shrink: 0;
+      }
+
+      .consentera-btn {
+        padding: 10px 20px;
+        border: none;
+        border-radius: 6px;
+        font-size: 14px;
+        font-weight: 500;
+        cursor: pointer;
+        transition: all 0.2s ease;
+        white-space: nowrap;
+      }
+
+      .consentera-btn--primary {
+        background: ${primaryColor || '#2563eb'};
+        color: #ffffff;
+      }
+
+      .consentera-btn--primary:hover {
+        opacity: 0.9;
+      }
+
+      .consentera-btn--secondary {
+        background: transparent;
+        color: ${textColor || '#4b5563'};
+        border: 1px solid ${textColor || '#d1d5db'};
+      }
+
+      .consentera-btn--secondary:hover {
+        background: rgba(0, 0, 0, 0.05);
+      }
+
+      @media (max-width: 768px) {
+        .consentera-banner__content {
+          flex-direction: column;
+          text-align: center;
+          padding: 16px;
+          gap: 16px;
+        }
+
+        .consentera-banner__actions {
+          width: 100%;
+          flex-direction: column;
+        }
+
+        .consentera-btn {
+          width: 100%;
+        }
+      }
+
+      /* Accessibility */
+      .consentera-btn:focus {
+        outline: 2px solid ${primaryColor || '#2563eb'};
+        outline-offset: 2px;
+      }
+
+      @media (prefers-reduced-motion: reduce) {
+        .consentera-banner {
+          transition: none;
+        }
+      }
+    `;
+    }
+    destroy() {
+        document.removeEventListener('keydown', this.handleKeyDown.bind(this));
+        this.container?.remove();
+        this.container = null;
+        this.isVisible = false;
+    }
+}
+
+/**
+ * Preference Center UI Component
+ */
+// SEC-H10 FIX: Escape HTML entities in server content before innerHTML assignment.
+function escapeHtml(str) {
+    const div = document.createElement('div');
+    div.textContent = str;
+    return div.innerHTML;
+}
+function sanitizeUrl(url) {
+    try {
+        const parsed = new URL(url, window.location.origin);
+        if (['http:', 'https:', 'mailto:'].includes(parsed.protocol)) {
+            return parsed.href;
+        }
+    }
+    catch {
+        // invalid URL
+    }
+    return '#';
+}
+class PreferenceCenter {
+    config;
+    theme;
+    sdk;
+    container = null;
+    overlay = null;
+    isVisible = false;
+    preferences;
+    constructor(config, theme, sdk) {
+        this.config = config;
+        this.theme = theme;
+        this.sdk = sdk;
+        this.preferences = sdk.getPreferences();
+    }
+    show() {
+        if (this.isVisible)
+            return;
+        this.preferences = this.sdk.getPreferences();
+        this.createPreferenceCenter();
+        this.isVisible = true;
+    }
+    hide() {
+        if (!this.isVisible)
+            return;
+        this.container?.classList.add('consentera-preferences--closing');
+        this.overlay?.classList.add('consentera-overlay--closing');
+        setTimeout(() => {
+            this.container?.remove();
+            this.overlay?.remove();
+            this.container = null;
+            this.overlay = null;
+            this.isVisible = false;
+        }, 300);
+    }
+    createPreferenceCenter() {
+        // Create overlay
+        this.overlay = document.createElement('div');
+        this.overlay.className = 'consentera-overlay';
+        this.overlay.addEventListener('click', () => this.hide());
+        // Create container
+        this.container = document.createElement('div');
+        this.container.id = 'consentera-preference-center';
+        this.container.className = 'consentera-preferences';
+        this.container.setAttribute('role', 'dialog');
+        this.container.setAttribute('aria-modal', 'true');
+        this.container.setAttribute('aria-labelledby', 'consentera-preferences-title');
+        // Inject styles
+        this.injectStyles();
+        // Create content
+        this.container.innerHTML = this.getPreferenceCenterHTML();
+        // Add event listeners
+        this.attachEventListeners();
+        // Append to body
+        document.body.appendChild(this.overlay);
+        document.body.appendChild(this.container);
+        // Trigger animation
+        requestAnimationFrame(() => {
+            this.overlay?.classList.add('consentera-overlay--visible');
+            this.container?.classList.add('consentera-preferences--visible');
+        });
+        // Focus trap
+        this.container.querySelector('.consentera-preferences__close')?.focus();
+    }
+    getPreferenceCenterHTML() {
+        const { banner, purposes } = this.config;
+        return `
+      <div class="consentera-preferences__header">
+        <h2 id="consentera-preferences-title" class="consentera-preferences__title">
+          Cookie Preferences
+        </h2>
+        <button type="button" class="consentera-preferences__close" data-action="close" aria-label="Close">
+          <svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+            <path d="M18 6L6 18M6 6l12 12"/>
+          </svg>
+        </button>
+      </div>
+
+      <div class="consentera-preferences__body">
+        <p class="consentera-preferences__description">
+          We use cookies and similar technologies to personalize content, analyze traffic, and improve your experience.
+          You can choose which categories of cookies you allow below.
+        </p>
+
+        <div class="consentera-preferences__purposes">
+          ${purposes.map((purpose) => `
+            <div class="consentera-purpose">
+              <div class="consentera-purpose__header">
+                <div class="consentera-purpose__info">
+                  <h3 class="consentera-purpose__name">${escapeHtml(purpose.name)}</h3>
+                  ${purpose.required ? '<span class="consentera-purpose__required">Always Active</span>' : ''}
+                </div>
+                <label class="consentera-toggle">
+                  <input type="checkbox"
+                         id="purpose-${purpose.id}"
+                         data-purpose="${purpose.id}"
+                         ${purpose.required ? 'checked disabled' : ''}
+                         ${this.preferences[purpose.id] ? 'checked' : ''}
+                  />
+                  <span class="consentera-toggle__slider"></span>
+                </label>
+              </div>
+              <p class="consentera-purpose__description">${escapeHtml(purpose.description)}</p>
+              ${purpose.cookies && purpose.cookies.length > 0 ? `
+                <details class="consentera-purpose__cookies">
+                  <summary>View cookies (${purpose.cookies.length})</summary>
+                  <table class="consentera-cookies-table">
+                    <thead>
+                      <tr>
+                        <th>Cookie</th>
+                        <th>Provider</th>
+                        <th>Purpose</th>
+                        <th>Expiry</th>
+                      </tr>
+                    </thead>
+                    <tbody>
+                      ${purpose.cookies.map((cookie) => `
+                        <tr>
+                          <td>${escapeHtml(cookie.name)}</td>
+                          <td>${escapeHtml(cookie.provider)}</td>
+                          <td>${escapeHtml(cookie.purpose)}</td>
+                          <td>${escapeHtml(cookie.expiry)}</td>
+                        </tr>
+                      `).join('')}
+                    </tbody>
+                  </table>
+                </details>
+              ` : ''}
+            </div>
+          `).join('')}
+        </div>
+      </div>
+
+      <div class="consentera-preferences__footer">
+        <div class="consentera-preferences__links">
+          ${banner.privacyPolicyUrl ? `
+            <a href="${sanitizeUrl(banner.privacyPolicyUrl)}" target="_blank" rel="noopener">Privacy Policy</a>
+          ` : ''}
+          ${banner.cookiePolicyUrl ? `
+            <a href="${sanitizeUrl(banner.cookiePolicyUrl)}" target="_blank" rel="noopener">Cookie Policy</a>
+          ` : ''}
+        </div>
+        <div class="consentera-preferences__actions">
+          <button type="button" class="consentera-btn consentera-btn--secondary" data-action="reject">
+            ${banner.rejectAllText || 'Reject All'}
+          </button>
+          <button type="button" class="consentera-btn consentera-btn--secondary" data-action="accept">
+            ${banner.acceptAllText || 'Accept All'}
+          </button>
+          <button type="button" class="consentera-btn consentera-btn--primary" data-action="save">
+            ${banner.saveText || 'Save Preferences'}
+          </button>
+        </div>
+      </div>
+    `;
+    }
+    attachEventListeners() {
+        if (!this.container)
+            return;
+        // Button actions
+        this.container.addEventListener('click', (e) => {
+            const target = e.target;
+            const action = target.dataset.action || target.closest('[data-action]')?.getAttribute('data-action');
+            if (!action)
+                return;
+            switch (action) {
+                case 'close':
+                    this.hide();
+                    break;
+                case 'accept':
+                    this.sdk.acceptAll();
+                    this.hide();
+                    break;
+                case 'reject':
+                    this.sdk.rejectAll();
+                    this.hide();
+                    break;
+                case 'save':
+                    this.savePreferences();
+                    break;
+            }
+        });
+        // Toggle changes
+        this.container.querySelectorAll('input[data-purpose]').forEach((input) => {
+            input.addEventListener('change', (e) => {
+                const target = e.target;
+                const purpose = target.dataset.purpose;
+                this.preferences[purpose] = target.checked;
+            });
+        });
+        // Escape key
+        document.addEventListener('keydown', this.handleKeyDown.bind(this));
+    }
+    handleKeyDown(e) {
+        if (e.key === 'Escape' && this.isVisible) {
+            this.hide();
+        }
+    }
+    savePreferences() {
+        this.sdk.savePreferences(this.preferences);
+        this.hide();
+    }
+    injectStyles() {
+        if (document.getElementById('consentera-preferences-styles'))
+            return;
+        const styleElement = document.createElement('style');
+        styleElement.id = 'consentera-preferences-styles';
+        styleElement.textContent = this.getStyles();
+        document.head.appendChild(styleElement);
+    }
+    getStyles() {
+        const { primaryColor, backgroundColor, textColor, borderRadius } = this.theme;
+        return `
+      .consentera-overlay {
+        position: fixed;
+        inset: 0;
+        background: rgba(0, 0, 0, 0.5);
+        z-index: 999998;
+        opacity: 0;
+        transition: opacity 0.3s ease;
+      }
+
+      .consentera-overlay--visible {
+        opacity: 1;
+      }
+
+      .consentera-overlay--closing {
+        opacity: 0;
+      }
+
+      .consentera-preferences {
+        position: fixed;
+        top: 50%;
+        left: 50%;
+        transform: translate(-50%, -50%) scale(0.95);
+        width: 90%;
+        max-width: 640px;
+        max-height: 85vh;
+        background: ${backgroundColor || '#ffffff'};
+        border-radius: ${borderRadius || '12px'};
+        box-shadow: 0 20px 60px rgba(0, 0, 0, 0.2);
+        z-index: 999999;
+        display: flex;
+        flex-direction: column;
+        opacity: 0;
+        transition: opacity 0.3s ease, transform 0.3s ease;
+      }
+
+      .consentera-preferences--visible {
+        opacity: 1;
+        transform: translate(-50%, -50%) scale(1);
+      }
+
+      .consentera-preferences--closing {
+        opacity: 0;
+        transform: translate(-50%, -50%) scale(0.95);
+      }
+
+      .consentera-preferences__header {
+        display: flex;
+        align-items: center;
+        justify-content: space-between;
+        padding: 20px 24px;
+        border-bottom: 1px solid #e5e7eb;
+      }
+
+      .consentera-preferences__title {
+        margin: 0;
+        font-size: 18px;
+        font-weight: 600;
+        color: ${textColor || '#1f2937'};
+      }
+
+      .consentera-preferences__close {
+        background: none;
+        border: none;
+        padding: 4px;
+        cursor: pointer;
+        color: ${textColor || '#6b7280'};
+        border-radius: 4px;
+      }
+
+      .consentera-preferences__close:hover {
+        background: rgba(0, 0, 0, 0.05);
+      }
+
+      .consentera-preferences__body {
+        flex: 1;
+        overflow-y: auto;
+        padding: 24px;
+      }
+
+      .consentera-preferences__description {
+        margin: 0 0 24px 0;
+        font-size: 14px;
+        color: ${textColor || '#6b7280'};
+        line-height: 1.5;
+      }
+
+      .consentera-preferences__purposes {
+        display: flex;
+        flex-direction: column;
+        gap: 16px;
+      }
+
+      .consentera-purpose {
+        padding: 16px;
+        background: #f9fafb;
+        border-radius: 8px;
+      }
+
+      .consentera-purpose__header {
+        display: flex;
+        align-items: center;
+        justify-content: space-between;
+        margin-bottom: 8px;
+      }
+
+      .consentera-purpose__info {
+        display: flex;
+        align-items: center;
+        gap: 8px;
+      }
+
+      .consentera-purpose__name {
+        margin: 0;
+        font-size: 15px;
+        font-weight: 600;
+        color: ${textColor || '#1f2937'};
+      }
+
+      .consentera-purpose__required {
+        font-size: 11px;
+        padding: 2px 6px;
+        background: ${primaryColor || '#2563eb'};
+        color: white;
+        border-radius: 4px;
+        font-weight: 500;
+      }
+
+      .consentera-purpose__description {
+        margin: 0;
+        font-size: 13px;
+        color: ${textColor || '#6b7280'};
+        line-height: 1.5;
+      }
+
+      .consentera-purpose__cookies {
+        margin-top: 12px;
+      }
+
+      .consentera-purpose__cookies summary {
+        font-size: 12px;
+        color: ${primaryColor || '#2563eb'};
+        cursor: pointer;
+      }
+
+      .consentera-cookies-table {
+        width: 100%;
+        margin-top: 8px;
+        font-size: 12px;
+        border-collapse: collapse;
+      }
+
+      .consentera-cookies-table th,
+      .consentera-cookies-table td {
+        padding: 8px;
+        text-align: left;
+        border-bottom: 1px solid #e5e7eb;
+      }
+
+      .consentera-cookies-table th {
+        font-weight: 600;
+        color: ${textColor || '#374151'};
+      }
+
+      .consentera-cookies-table td {
+        color: ${textColor || '#6b7280'};
+      }
+
+      .consentera-toggle {
+        position: relative;
+        display: inline-block;
+        width: 48px;
+        height: 26px;
+      }
+
+      .consentera-toggle input {
+        opacity: 0;
+        width: 0;
+        height: 0;
+      }
+
+      .consentera-toggle__slider {
+        position: absolute;
+        cursor: pointer;
+        inset: 0;
+        background: #d1d5db;
+        border-radius: 26px;
+        transition: 0.3s;
+      }
+
+      .consentera-toggle__slider::before {
+        position: absolute;
+        content: "";
+        height: 20px;
+        width: 20px;
+        left: 3px;
+        bottom: 3px;
+        background: white;
+        border-radius: 50%;
+        transition: 0.3s;
+      }
+
+      .consentera-toggle input:checked + .consentera-toggle__slider {
+        background: ${primaryColor || '#2563eb'};
+      }
+
+      .consentera-toggle input:checked + .consentera-toggle__slider::before {
+        transform: translateX(22px);
+      }
+
+      .consentera-toggle input:disabled + .consentera-toggle__slider {
+        opacity: 0.7;
+        cursor: not-allowed;
+      }
+
+      .consentera-preferences__footer {
+        display: flex;
+        align-items: center;
+        justify-content: space-between;
+        padding: 16px 24px;
+        border-top: 1px solid #e5e7eb;
+        gap: 16px;
+      }
+
+      .consentera-preferences__links {
+        display: flex;
+        gap: 16px;
+      }
+
+      .consentera-preferences__links a {
+        font-size: 13px;
+        color: ${primaryColor || '#2563eb'};
+        text-decoration: underline;
+      }
+
+      .consentera-preferences__actions {
+        display: flex;
+        gap: 8px;
+      }
+
+      @media (max-width: 640px) {
+        .consentera-preferences {
+          width: 100%;
+          height: 100%;
+          max-height: 100%;
+          border-radius: 0;
+        }
+
+        .consentera-preferences__footer {
+          flex-direction: column;
+        }
+
+        .consentera-preferences__actions {
+          width: 100%;
+          flex-direction: column;
+        }
+
+        .consentera-btn {
+          width: 100%;
+        }
+      }
+    `;
+    }
+    destroy() {
+        document.removeEventListener('keydown', this.handleKeyDown.bind(this));
+        this.container?.remove();
+        this.overlay?.remove();
+        this.container = null;
+        this.overlay = null;
+        this.isVisible = false;
+    }
+}
+
+/**
+ * TCF 2.2 Manager
+ * IAB Transparency & Consent Framework implementation
+ */
+class TCFManager {
+    config;
+    tcfData = null;
+    constructor(config) {
+        this.config = {
+            cmpId: 123, // Replace with actual CMP ID
+            cmpVersion: 1,
+            publisherCountryCode: 'IN',
+            gdprApplies: true,
+            ...config,
+        };
+    }
+    /**
+     * Initialize TCF API
+     */
+    async init() {
+        // Create TCF API stub
+        this.createTCFApiStub();
+        // Initialize TCF data
+        this.tcfData = this.getDefaultTCFData();
+    }
+    /**
+     * Create __tcfapi stub
+     */
+    createTCFApiStub() {
+        if (typeof window === 'undefined')
+            return;
+        // Create stub
+        window.__tcfapi = (command, version, callback, parameter) => {
+            if (command === 'ping') {
+                callback({
+                    gdprApplies: this.config.gdprApplies,
+                    cmpLoaded: true,
+                    cmpStatus: 'loaded',
+                    displayStatus: 'visible',
+                    apiVersion: '2.2',
+                    cmpVersion: this.config.cmpVersion,
+                    cmpId: this.config.cmpId,
+                    gvlVersion: 100,
+                    tcfPolicyVersion: 4,
+                });
+            }
+            else if (command === 'getTCData') {
+                callback(this.tcfData, true);
+            }
+            else if (command === 'addEventListener') {
+                // Handle event listener
+                callback({
+                    ...this.tcfData,
+                    eventStatus: 'tcloaded',
+                    listenerId: Math.random(),
+                }, true);
+            }
+            else if (command === 'removeEventListener') {
+                callback(true);
+            }
+            else ;
+        };
+        // Mark as CMP
+        window.__tcfapi.gdprApplies = this.config.gdprApplies;
+        window.__tcfapi.cmpLoaded = true;
+    }
+    /**
+     * Get default TCF data
+     */
+    getDefaultTCFData() {
+        return {
+            cmpId: this.config.cmpId,
+            cmpVersion: this.config.cmpVersion,
+            gdprApplies: this.config.gdprApplies,
+            tcString: '',
+            tcfPolicyVersion: 4,
+            isServiceSpecific: true,
+            useNonStandardStacks: false,
+            purposeOneTreatment: false,
+            publisherCC: this.config.publisherCountryCode,
+            vendorConsents: {},
+            vendorLegitimateInterests: {},
+            purposeConsents: {},
+            purposeLegitimateInterests: {},
+            specialFeatureOptins: {},
+            publisherRestrictions: [],
+        };
+    }
+    /**
+     * Update consent in TCF format
+     */
+    async updateConsent(preferences) {
+        if (!this.tcfData)
+            return;
+        // Map preferences to TCF purposes
+        // TCF Purposes:
+        // 1: Store and/or access information on a device
+        // 2: Select basic ads
+        // 3: Create a personalised ads profile
+        // 4: Select personalised ads
+        // 5: Create a personalised content profile
+        // 6: Select personalised content
+        // 7: Measure ad performance
+        // 8: Measure content performance
+        // 9: Apply market research to generate audience insights
+        // 10: Develop and improve products
+        this.tcfData.purposeConsents = {
+            1: preferences.essential,
+            2: preferences.advertising,
+            3: preferences.personalization,
+            4: preferences.advertising,
+            5: preferences.personalization,
+            6: preferences.personalization,
+            7: preferences.analytics,
+            8: preferences.analytics,
+            9: preferences.analytics,
+            10: preferences.functional,
+        };
+        // Generate TC String
+        this.tcfData.tcString = this.generateTCString();
+        // Dispatch event
+        this.dispatchTCFEvent('useractioncomplete');
+    }
+    /**
+     * Generate TC String (simplified version)
+     */
+    generateTCString() {
+        // In production, use proper TC String encoding
+        // This is a placeholder that would be replaced with actual IAB TCF encoding
+        const data = {
+            version: 2,
+            created: Date.now(),
+            lastUpdated: Date.now(),
+            cmpId: this.config.cmpId,
+            cmpVersion: this.config.cmpVersion,
+            purposeConsents: this.tcfData?.purposeConsents || {},
+        };
+        return btoa(JSON.stringify(data));
+    }
+    /**
+     * Dispatch TCF event
+     */
+    dispatchTCFEvent(eventStatus) {
+        if (typeof window === 'undefined')
+            return;
+        const event = new CustomEvent('tcfapi', {
+            detail: {
+                ...this.tcfData,
+                eventStatus,
+            },
+        });
+        window.dispatchEvent(event);
+    }
+    /**
+     * Get current TCF data
+     */
+    getTCFData() {
+        return this.tcfData;
+    }
+    /**
+     * Get TC String
+     */
+    getTCString() {
+        return this.tcfData?.tcString || '';
+    }
+    /**
+     * Destroy TCF manager
+     */
+    destroy() {
+        if (typeof window !== 'undefined') {
+            delete window.__tcfapi;
+        }
+        this.tcfData = null;
+    }
+}
+
+/**
+ * GPP Manager
+ * IAB Global Privacy Platform implementation
+ */
+class GPPManager {
+    config;
+    gppData = null;
+    constructor(config) {
+        this.config = {
+            sections: ['tcfeuv2', 'uspv1'],
+            ...config,
+        };
+    }
+    /**
+     * Initialize GPP API
+     */
+    async init() {
+        // Create GPP API stub
+        this.createGPPApiStub();
+        // Initialize GPP data
+        this.gppData = this.getDefaultGPPData();
+    }
+    /**
+     * Create __gpp stub
+     */
+    createGPPApiStub() {
+        if (typeof window === 'undefined')
+            return;
+        const eventQueue = [];
+        const cmpStatus = 'loaded';
+        const cmpDisplayStatus = 'visible';
+        window.__gpp = (command, callback, parameter) => {
+            switch (command) {
+                case 'ping':
+                    callback({
+                        gppVersion: '1.1',
+                        cmpStatus,
+                        cmpDisplayStatus,
+                        supportedAPIs: this.config.sections,
+                        cmpId: 123, // Replace with actual CMP ID
+                        sectionList: this.gppData?.sectionIds || [],
+                        applicableSections: this.gppData?.applicableSections || [],
+                        gppString: this.gppData?.gppString || '',
+                    });
+                    break;
+                case 'getSection':
+                    if (this.gppData) {
+                        callback({
+                            sectionId: parameter,
+                            sectionData: this.getSectionData(parameter),
+                        });
+                    }
+                    break;
+                case 'getField':
+                    callback(this.getFieldValue(parameter));
+                    break;
+                case 'hasSection':
+                    callback(this.gppData?.sectionIds.includes(parameter) || false);
+                    break;
+                case 'addEventListener':
+                    eventQueue.push({ callback, listenerId: Math.random() });
+                    callback({
+                        eventName: 'listenerRegistered',
+                        listenerId: eventQueue.length - 1,
+                        data: this.gppData?.gppString || '',
+                        pingData: {
+                            gppVersion: '1.1',
+                            cmpStatus,
+                            cmpDisplayStatus,
+                        },
+                    });
+                    break;
+                case 'removeEventListener': {
+                    const index = eventQueue.findIndex((e) => e.listenerId === parameter);
+                    if (index > -1) {
+                        eventQueue.splice(index, 1);
+                        callback(true);
+                    }
+                    else {
+                        callback(false);
+                    }
+                    break;
+                }
+                default:
+                    callback(null);
+            }
+        };
+        // Set GPP API version
+        window.__gpp.version = '1.1';
+    }
+    /**
+     * Get default GPP data
+     */
+    getDefaultGPPData() {
+        return {
+            gppString: '',
+            sectionIds: [],
+            applicableSections: [],
+        };
+    }
+    /**
+     * Get section data
+     */
+    getSectionData(sectionId) {
+        // Return section-specific data
+        switch (sectionId) {
+            case 2: // TCF EU v2
+                return {
+                    Version: 2,
+                    Created: Math.floor(Date.now() / 100),
+                    LastUpdated: Math.floor(Date.now() / 100),
+                    CmpId: 123,
+                    CmpVersion: 1,
+                    ConsentScreen: 1,
+                    ConsentLanguage: 'EN',
+                };
+            case 6: // USP v1
+                return {
+                    Version: 1,
+                    Notice: 'Y',
+                    OptOutSale: 'N',
+                    LspaCovered: 'Y',
+                };
+            default:
+                return null;
+        }
+    }
+    /**
+     * Get field value
+     */
+    getFieldValue(_field) {
+        // STUB: the GPP `getField` command is accepted and answers null for every
+        // field. Named with a leading underscore so it reads as deliberately
+        // unused rather than as a parameter someone forgot to wire.
+        return null;
+    }
+    /**
+     * Update consent in GPP format
+     */
+    async updateConsent(preferences) {
+        if (!this.gppData)
+            return;
+        // Build GPP string based on preferences
+        this.gppData.gppString = this.buildGPPString(preferences);
+        // Update section IDs based on applicable regulations
+        this.gppData.sectionIds = this.determineSections(preferences);
+        this.gppData.applicableSections = this.gppData.sectionIds;
+        // Dispatch event
+        this.dispatchGPPEvent('signalStatus');
+    }
+    /**
+     * Build GPP string
+     */
+    buildGPPString(preferences) {
+        // In production, use proper GPP string encoding
+        // This is a simplified version
+        const sections = [];
+        // TCF EU v2 section (section ID 2)
+        if (this.config.sections?.includes('tcfeuv2')) {
+            sections.push({
+                id: 2,
+                purposes: {
+                    1: preferences.essential,
+                    2: preferences.advertising,
+                    3: preferences.personalization,
+                    4: preferences.advertising,
+                    7: preferences.analytics,
+                    10: preferences.functional,
+                },
+            });
+        }
+        // USP v1 section (section ID 6)
+        if (this.config.sections?.includes('uspv1')) {
+            sections.push({
+                id: 6,
+                notice: true,
+                optOut: !preferences.thirdParty,
+                lspaCovered: true,
+            });
+        }
+        // Generate encoded string
+        return this.encodeGPPString(sections);
+    }
+    /**
+     * Encode GPP string
+     */
+    encodeGPPString(sections) {
+        // Simplified encoding - in production use proper GPP encoding
+        const header = {
+            version: 1,
+            sectionIds: sections.map((s) => s.id),
+        };
+        return btoa(JSON.stringify({ header, sections }));
+    }
+    /**
+     * Determine applicable sections
+     */
+    determineSections(_preferences) {
+        const sections = [];
+        // Add TCF EU v2 (2) if GDPR applicable
+        if (this.config.sections?.includes('tcfeuv2')) {
+            sections.push(2);
+        }
+        // Add USP v1 (6) if CCPA applicable
+        if (this.config.sections?.includes('uspv1')) {
+            sections.push(6);
+        }
+        // Add other sections as needed
+        return sections;
+    }
+    /**
+     * Dispatch GPP event
+     */
+    dispatchGPPEvent(eventName) {
+        if (typeof window === 'undefined')
+            return;
+        const event = new CustomEvent('gpp', {
+            detail: {
+                eventName,
+                data: this.gppData?.gppString || '',
+                pingData: {
+                    gppVersion: '1.1',
+                    cmpStatus: 'loaded',
+                    applicableSections: this.gppData?.applicableSections || [],
+                },
+            },
+        });
+        window.dispatchEvent(event);
+    }
+    /**
+     * Get current GPP data
+     */
+    getGPPData() {
+        return this.gppData;
+    }
+    /**
+     * Get GPP string
+     */
+    getGPPString() {
+        return this.gppData?.gppString || '';
+    }
+    /**
+     * Destroy GPP manager
+     */
+    destroy() {
+        if (typeof window !== 'undefined') {
+            delete window.__gpp;
+        }
+        this.gppData = null;
+    }
+}
+
+/**
+ * Simple Event Emitter
+ */
+class EventEmitter {
+    events = new Map();
+    /**
+     * Register event listener
+     */
+    on(event, callback) {
+        if (!this.events.has(event)) {
+            this.events.set(event, new Set());
+        }
+        this.events.get(event).add(callback);
+    }
+    /**
+     * Remove event listener
+     */
+    off(event, callback) {
+        const callbacks = this.events.get(event);
+        if (callbacks) {
+            callbacks.delete(callback);
+        }
+    }
+    /**
+     * Emit event
+     */
+    emit(event, ...args) {
+        const callbacks = this.events.get(event);
+        if (callbacks) {
+            callbacks.forEach((callback) => {
+                try {
+                    callback(...args);
+                }
+                catch (error) {
+                    console.error(`Error in event handler for ${event}:`, error);
+                }
+            });
+        }
+    }
+    /**
+     * Register one-time event listener
+     */
+    once(event, callback) {
+        const onceWrapper = (...args) => {
+            this.off(event, onceWrapper);
+            callback(...args);
+        };
+        this.on(event, onceWrapper);
+    }
+    /**
+     * Remove all listeners
+     */
+    removeAllListeners(event) {
+        if (event) {
+            this.events.delete(event);
+        }
+        else {
+            this.events.clear();
+        }
+    }
+}
+
+/* eslint-disable no-console -- THIS FILE IS THE CONSOLE WRITE. The `no-console`
+   rule exists so that no OTHER file writes to the host's console directly; the
+   whole point of routing through here is that a host can set the level or
+   replace the sink. Disabling it anywhere else is the thing the rule is for. */
+class Logger {
+    level;
+    prefix = '[ConsentEra]';
+    constructor(level = 'info') {
+        this.level = level;
+    }
+    shouldLog(level) {
+        const levels = ['debug', 'info', 'warn', 'error'];
+        return levels.indexOf(level) >= levels.indexOf(this.level);
+    }
+    debug(...args) {
+        if (this.shouldLog('debug')) {
+            console.debug(this.prefix, ...args);
+        }
+    }
+    info(...args) {
+        if (this.shouldLog('info')) {
+            console.info(this.prefix, ...args);
+        }
+    }
+    warn(...args) {
+        if (this.shouldLog('warn')) {
+            console.warn(this.prefix, ...args);
+        }
+    }
+    error(...args) {
+        if (this.shouldLog('error')) {
+            console.error(this.prefix, ...args);
+        }
+    }
+    setLevel(level) {
+        this.level = level;
+    }
+}
+
+/**
+ * Utility helper functions
+ */
+/**
+ * Generate a unique consent ID
+ */
+function generateConsentId() {
+    const timestamp = Date.now().toString(36);
+    const randomPart = Math.random().toString(36).substring(2, 15);
+    return `consent_${timestamp}_${randomPart}`;
+}
+/**
+ * Get device information
+ */
+function getDeviceInfo() {
+    const ua = navigator.userAgent.toLowerCase();
+    let type = 'desktop';
+    if (/mobile|android|iphone|ipod|blackberry|iemobile|opera mini/i.test(ua)) {
+        type = 'mobile';
+    }
+    else if (/tablet|ipad|playbook|silk/i.test(ua)) {
+        type = 'tablet';
+    }
+    let os;
+    if (/windows/i.test(ua))
+        os = 'Windows';
+    else if (/macintosh|mac os x/i.test(ua))
+        os = 'macOS';
+    else if (/linux/i.test(ua))
+        os = 'Linux';
+    else if (/android/i.test(ua))
+        os = 'Android';
+    else if (/iphone|ipad|ipod/i.test(ua))
+        os = 'iOS';
+    let browser;
+    if (/chrome/i.test(ua) && !/edge|edg/i.test(ua))
+        browser = 'Chrome';
+    else if (/firefox/i.test(ua))
+        browser = 'Firefox';
+    else if (/safari/i.test(ua) && !/chrome/i.test(ua))
+        browser = 'Safari';
+    else if (/edge|edg/i.test(ua))
+        browser = 'Edge';
+    else if (/msie|trident/i.test(ua))
+        browser = 'IE';
+    return { type, os, browser };
+}
+
+/**
+ * Consentera Consent SDK — the error taxonomy.
+ *
+ * ONE class with a discriminant, plus subclasses for `instanceof`. Before 2.0.0
+ * there was a single `ConsentEraApiError` carrying `statusCode` and the raw
+ * `responseBody`, which meant a caller who wanted to know *what went wrong* had
+ * to dig a string out of an untyped body — and the two things support asks for
+ * first, the canonical code and the request id, were both discarded. The API
+ * has carried them the whole time: the envelope is `{code, message}`
+ * (core/apierrors/errors.go:33-38) over ~141 codes of which 22 are canonical
+ * (core/apierrors/canonical_codes.go), and `X-Request-ID` is set by
+ * chi middleware and CORS-exposed so a browser can read it
+ * (cmd/api/main.go:1266, :1272).
+ *
+ * `kind` is the discriminant to switch on. The CODE is the platform's word and
+ * may be one of many; the KIND is this SDK's classification of it and is a
+ * closed set, so `switch (err.kind)` stays exhaustive when the platform adds a
+ * code. Both are on the error — never infer the kind from the code yourself.
+ */
+/**
+ * Canonical code → kind. Codes taken from the platform's registry; anything not
+ * listed falls back to the HTTP status, and a code we have never seen is
+ * therefore still classified rather than dropped into `unknown`.
+ */
+const CODE_KIND = {
+    // 400 — the request itself
+    VALIDATION_ERROR: 'validation',
+    INVALID_REQUEST_BODY: 'validation',
+    INVALID_JSON: 'validation',
+    INVALID_UUID: 'validation',
+    BAD_REQUEST: 'validation',
+    MISSING_REQUIRED_FIELD: 'validation',
+    MISSING_TENANT_ID: 'validation',
+    INVALID_TENANT_ID: 'validation',
+    INVALID_DATE_OF_BIRTH: 'validation',
+    INVALID_IDENTIFIER_FORMAT: 'validation',
+    // identity — the U58 / lifecycle identity family, which is what an
+    // integrator gets wrong most often and most expensively
+    DATA_PRINCIPAL_REF_REFUSED: 'identity',
+    UNKNOWN_IDENTIFIER_FIELD: 'identity',
+    IDENTIFIER_REQUIRED: 'identity',
+    IDENTITY_MISMATCH: 'identity',
+    // guardian / age
+    GUARDIAN_REQUIRED: 'guardian',
+    GUARDIAN_CONSENT_REQUIRED: 'guardian',
+    GUARDIAN_TOKEN_REQUIRED: 'guardian',
+    GUARDIAN_EVIDENCE_MISSING: 'guardian',
+    GUARDIAN_IDENTITY_NOT_VERIFIED: 'guardian',
+    GUARDIAN_ADULT_NOT_VERIFIED: 'guardian',
+    GUARDIAN_VERIFICATION_METHOD_INVALID: 'guardian',
+    AGE_REQUIRED: 'guardian',
+    // 401
+    UNAUTHORIZED: 'auth',
+    INVALID_CREDENTIALS: 'auth',
+    TOKEN_MISSING: 'auth',
+    TOKEN_INVALID: 'auth',
+    TOKEN_EXPIRED: 'auth',
+    TOKEN_MALFORMED: 'auth',
+    TOKEN_REVOKED: 'auth',
+    SESSION_NOT_FOUND: 'auth',
+    SESSION_EXPIRED: 'auth',
+    SESSION_REVOKED: 'auth',
+    // 403
+    FORBIDDEN: 'permission',
+    TENANT_MISMATCH: 'permission',
+    TENANT_SUSPENDED: 'permission',
+    ACCOUNT_DISABLED: 'permission',
+    PRIVILEGE_ESCALATION: 'permission',
+    SCHEME_NOT_CONFIGURED: 'permission',
+    CSRF_TOKEN_MISSING: 'permission',
+    CSRF_TOKEN_INVALID: 'permission',
+    // 404 / 409 / 429 / 5xx
+    NOT_FOUND: 'not_found',
+    USER_NOT_FOUND: 'not_found',
+    CONFLICT: 'conflict',
+    IDEMPOTENCY_KEY_REUSE: 'conflict',
+    RATE_LIMIT_EXCEEDED: 'rate_limit',
+    INTERNAL_ERROR: 'server',
+    INTERNAL_SERVER_ERROR: 'server',
+    DATABASE_ERROR: 'server',
+};
+function kindForStatus(status) {
+    if (status === 401)
+        return 'auth';
+    if (status === 403)
+        return 'permission';
+    if (status === 404)
+        return 'not_found';
+    if (status === 409)
+        return 'conflict';
+    if (status === 429)
+        return 'rate_limit';
+    if (status >= 500)
+        return 'server';
+    if (status >= 400)
+        return 'validation';
+    return 'unknown';
+}
+/**
+ * Parse `Retry-After`, which RFC 9110 §10.2.3 allows to be either a count of
+ * seconds or an HTTP-date. Returns milliseconds, or undefined when the header
+ * is absent or unparseable — never NaN, because a NaN delay becomes an
+ * immediate retry and turns a 429 into a hot loop.
+ */
+function parseRetryAfterMs(header, now = Date.now()) {
+    if (!header)
+        return undefined;
+    const trimmed = header.trim();
+    if (/^\d+$/.test(trimmed)) {
+        const seconds = Number(trimmed);
+        return Number.isFinite(seconds) ? Math.max(0, seconds * 1000) : undefined;
+    }
+    const at = Date.parse(trimmed);
+    if (Number.isNaN(at))
+        return undefined;
+    return Math.max(0, at - now);
+}
+/** The base error every road in this SDK throws. */
+class ConsenteraError extends Error {
+    /** This SDK's classification. A closed set — safe to switch on. */
+    kind;
+    /** The platform's canonical error code, when the response carried one. */
+    code;
+    /** HTTP status; 0 for a transport failure that never reached a status. */
+    status;
+    /** `X-Request-ID` off the response. Quote this in a support ticket. */
+    requestId;
+    /** The parsed response body, or the raw text when it was not JSON. */
+    responseBody;
+    /** Whether THIS SDK would retry it. Already applied internally. */
+    retryable;
+    /** Server-asked wait, from `Retry-After`, in ms. */
+    retryAfterMs;
+    constructor(init) {
+        super(init.message, init.cause === undefined ? undefined : { cause: init.cause });
+        this.name = new.target.name;
+        this.kind = init.kind;
+        this.code = init.code;
+        this.status = init.status ?? 0;
+        this.requestId = init.requestId;
+        this.responseBody = init.responseBody;
+        this.retryable = init.retryable ?? false;
+        this.retryAfterMs = init.retryAfterMs;
+        // Extending Error across the ES5 target rollup emits breaks instanceof
+        // without this; new.target is the actual subclass.
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+    /** @deprecated 2.0.0 — use `status`. Kept so 1.x `err.statusCode` still reads. */
+    get statusCode() {
+        return this.status;
+    }
+    /** A one-line form safe to log: no body, no identifiers. */
+    toString() {
+        const bits = [this.name, this.code ?? this.kind];
+        if (this.status)
+            bits.push(String(this.status));
+        if (this.requestId)
+            bits.push(`req=${this.requestId}`);
+        return `${bits.join(' ')}: ${this.message}`;
+    }
+}
+class ConsenteraConfigError extends ConsenteraError {
+}
+class ConsenteraAuthError extends ConsenteraError {
+}
+class ConsenteraPermissionError extends ConsenteraError {
+}
+class ConsenteraValidationError extends ConsenteraError {
+}
+class ConsenteraIdentityError extends ConsenteraError {
+}
+class ConsenteraGuardianError extends ConsenteraError {
+}
+class ConsenteraNotFoundError extends ConsenteraError {
+}
+class ConsenteraConflictError extends ConsenteraError {
+}
+class ConsenteraRateLimitError extends ConsenteraError {
+}
+class ConsenteraServerError extends ConsenteraError {
+}
+class ConsenteraNetworkError extends ConsenteraError {
+}
+class ConsenteraTimeoutError extends ConsenteraError {
+}
+const KIND_CLASS = {
+    config: ConsenteraConfigError,
+    auth: ConsenteraAuthError,
+    permission: ConsenteraPermissionError,
+    validation: ConsenteraValidationError,
+    identity: ConsenteraIdentityError,
+    guardian: ConsenteraGuardianError,
+    not_found: ConsenteraNotFoundError,
+    conflict: ConsenteraConflictError,
+    rate_limit: ConsenteraRateLimitError,
+    server: ConsenteraServerError,
+    network: ConsenteraNetworkError,
+    timeout: ConsenteraTimeoutError,
+    cancelled: ConsenteraError,
+    unknown: ConsenteraError,
+};
+function newOfKind(init) {
+    return new KIND_CLASS[init.kind](init);
+}
+/** Pull `{code, message}` off a parsed body, tolerating the `{error:{...}}` wrapper. */
+function readEnvelope(body) {
+    if (!body || typeof body !== 'object')
+        return {};
+    const o = body;
+    const inner = o.error && typeof o.error === 'object' ? o.error : o;
+    const code = typeof inner.code === 'string' ? inner.code : undefined;
+    const message = typeof inner.message === 'string' ? inner.message : undefined;
+    return { code, message };
+}
+/** Build the error for a non-2xx response. */
+function errorFromResponse(args) {
+    const { code, message } = readEnvelope(args.body);
+    const kind = (code && CODE_KIND[code]) || kindForStatus(args.status);
+    const retryable = args.status === 429 || args.status >= 500;
+    return newOfKind({
+        kind,
+        code,
+        status: args.status,
+        requestId: args.requestId,
+        responseBody: args.body,
+        retryable,
+        retryAfterMs: args.retryAfterMs,
+        message: message ||
+            `${args.method} ${args.path} failed: ${args.status}${args.statusText ? ` ${args.statusText}` : ''}`,
+    });
+}
+/** A request that never reached a status: DNS, TLS, offline, CORS. */
+function networkError(message, cause) {
+    return new ConsenteraNetworkError({ kind: 'network', message, status: 0, retryable: true, cause });
+}
+/** The SDK's own deadline fired. */
+function timeoutError(message, cause) {
+    return new ConsenteraTimeoutError({ kind: 'timeout', message, status: 0, retryable: true, cause });
+}
+/** The caller's AbortSignal fired. NEVER retryable: the caller asked to stop. */
+function cancelledError(message, cause) {
+    return new ConsenteraError({ kind: 'cancelled', message, status: 0, retryable: false, cause });
+}
+/** Misconfiguration found before anything went on the wire. */
+function configError(message, code) {
+    return new ConsenteraConfigError({ kind: 'config', message, status: 0, code, retryable: false });
+}
+/**
+ * @deprecated 2.0.0 — `ConsentEraApiError` is now an alias of {@link ConsenteraError}.
+ * `instanceof` and `.statusCode` still work; `.code`, `.kind` and `.requestId` are new.
+ */
+const ConsentEraApiError = ConsenteraError;
+
+/**
+ * The SDK's own version, sent on every request as `X-Consentera-SDK`.
+ *
+ * KEPT IN SYNC BY A TEST, NOT BY A BUILD STEP. `src/__tests__/core/version.test.ts`
+ * reads package.json and fails when the two disagree, so a release that forgets
+ * this file cannot go green. A build-time codegen would have been the other
+ * option; it was rejected because the constant then does not exist when a host
+ * builds from src, and because a generated file in the tree is one command from
+ * being overwritten with the wrong value and nothing noticing.
+ */
+const SDK_NAME = 'consent-sdk-js';
+const SDK_VERSION = '2.0.0';
+const SDK_PLATFORM = 'web';
+/** The value of the `X-Consentera-SDK` header: `<surface>/<version>`. */
+const SDK_HEADER_VALUE = `js/${SDK_VERSION}`;
+/**
+ * The `User-Agent` half of the pair, agreed across all six surfaces
+ * (coordinator ruling 2026-09-22):
+ *
+ *     User-Agent:        ConsenteraSDK/2.0.0 (<platform>; <runtime>)
+ *     X-Consentera-SDK:  <surface>/2.0.0
+ *
+ * `ConsenteraSDK/<version>` is the form the PLATFORM ALREADY PARSES:
+ * `internal/core/audit/user_agent_coarsening_test.go:39-40` asserts that
+ * `ConsenteraSDK/2.3.1 (Android 14; SM-G991B; build 4471)` coarsens to
+ * `ConsenteraSDK/2`, so this is the shape its audit pipeline expects rather
+ * than a new one. (A second spelling, `consentera-sdk/1.2`, appears in
+ * `validation_envelope_test.go:233`; the pair above is the agreed one.)
+ *
+ * IN A BROWSER THIS HEADER CANNOT BE SENT. `User-Agent` is a forbidden header
+ * name (fetch spec §forbidden-request-header), so a browser silently drops any
+ * attempt to set it — the SDK does not try, and the browser build identifies
+ * itself with `X-Consentera-SDK` alone. The Node build (and the CLI) send both,
+ * because there the header is ours to set.
+ */
+function userAgentValue(runtime) {
+    const rt = (typeof process !== 'undefined' && process.versions?.node ? `node ${process.versions.node}` : 'unknown');
+    return `ConsenteraSDK/${SDK_VERSION} (${SDK_PLATFORM}; ${rt})`;
+}
+
+/**
+ * Consentera Consent SDK — the transport.
+ *
+ * Everything that talks to the platform goes through `HttpTransport.request`.
+ * One implementation, because the four things below are the ones that are
+ * always missing when each caller writes its own `fetch`:
+ *
+ *  1. A DEADLINE. `fetch` has none. Before 2.0.0 a hung connection hung the
+ *     caller's promise forever, which on a consent gate means a page that never
+ *     renders. Every request now carries an AbortController, linked to the
+ *     caller's own signal so `AbortSignal` cancellation still works.
+ *  2. RETRIES that are safe. Exponential backoff with full jitter on network
+ *     failure, 5xx and 429, honouring `Retry-After` when the server sends one.
+ *  3. ONE IDEMPOTENCY KEY PER LOGICAL OPERATION. Before 2.0.0 the key was
+ *     minted inside the request function from `Date.now()` + `Math.random()`,
+ *     so it changed on every attempt and the caller could not supply one — a
+ *     dedupe mechanism that was present and could not dedupe anything. The key
+ *     is now minted ONCE per logical operation, reused on every retry of it,
+ *     and `options.idempotencyKey` overrides it.
+ *  4. THE REQUEST ID. The platform sets `X-Request-ID` and CORS-exposes it
+ *     (cmd/api/main.go:1266, :1272). It is now on every error.
+ *
+ * WHAT IS DELIBERATELY NOT HERE: no request or response BODY is ever logged.
+ * The body of a session create is the Data Principal's identifiers.
+ */
+const DEFAULT_RETRY = { attempts: 3, baseDelayMs: 250, maxDelayMs: 4000 };
+const DEFAULT_TIMEOUT_MS = 10_000;
+/** `typeof window !== 'undefined'` in one place, so a test can reason about it. */
+function isBrowser() {
+    return typeof window !== 'undefined';
+}
+/** A secret DF key: the platform's prefixes for the two secret classes. */
+function isSecretKey(key) {
+    return !!key && (key.startsWith('tiq_live_') || key.startsWith('tiq_test_'));
+}
+/** A public site key. */
+function isSiteKey(key) {
+    return !!key && key.startsWith('tiq_pub_');
+}
+/**
+ * THE ONE REFUSAL, in one place — used by BOTH entry points (ConsentEraClient
+ * and ConsenteraConsent), because a rule enforced at only one door is not a
+ * rule. A secret key in a browser is not a warning: the bundle is public, so by
+ * the time it runs the key is already published to every visitor. Refusing at
+ * construction is the only point at which the integrator still has the option
+ * of not shipping it.
+ *
+ * `fix` is the entry-point-specific remedy (a proxy endpoint for the lifecycle
+ * client, a public site key for the cookie SDK); everything else — the reason,
+ * the prefix echo, the escape hatch — is identical, which is exactly why it
+ * lives here rather than being copied and left to drift.
+ */
+function assertNoSecretKeyInBrowser(opts) {
+    if (!isBrowser() || !opts.apiKey || opts.unsafeAllowSecretKeyInBrowser)
+        return;
+    throw configError('Consentera: `apiKey` is a SECRET and this SDK is running in a browser, where every ' +
+        'visitor can read the bundle. ' +
+        opts.fix +
+        ' ' +
+        (isSecretKey(opts.apiKey)
+            ? `The key supplied starts with "${opts.apiKey.slice(0, 9)}" — rotate it, it is now in a bundle. `
+            : '') +
+        'If you are certain this code never reaches a browser (a test harness with a jsdom window, ' +
+        'a server-side render that only looks like one), set `unsafeAllowSecretKeyInBrowser: true` ' +
+        'and every request will warn.', 'SECRET_KEY_IN_BROWSER');
+}
+/**
+ * Crypto-strong id. `Math.random()` was what minted idempotency keys before
+ * 2.0.0; it is neither unpredictable nor collision-safe at 6 characters.
+ */
+function newRequestId() {
+    const c = typeof globalThis !== 'undefined' ? globalThis.crypto : undefined;
+    if (c && typeof c.randomUUID === 'function')
+        return c.randomUUID();
+    if (c && typeof c.getRandomValues === 'function') {
+        const b = c.getRandomValues(new Uint8Array(16));
+        return Array.from(b, (x) => x.toString(16).padStart(2, '0')).join('');
+    }
+    // Last resort for an ancient browser. Recorded rather than silent: a caller
+    // on such a browser should supply its own idempotencyKey.
+    return `nc-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+}
+function sleep(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted) {
+            reject(cancelledError('request cancelled'));
+            return;
+        }
+        const t = setTimeout(() => {
+            signal?.removeEventListener('abort', onAbort);
+            resolve();
+        }, ms);
+        const onAbort = () => {
+            clearTimeout(t);
+            reject(cancelledError('request cancelled'));
+        };
+        signal?.addEventListener('abort', onAbort, { once: true });
+    });
+}
+/** Full-jitter backoff (AWS's "Exponential Backoff and Jitter"): random in [0, cap]. */
+function backoffMs(attempt, policy, random = Math.random) {
+    const exp = Math.min(policy.maxDelayMs, policy.baseDelayMs * 2 ** attempt);
+    return Math.floor(random() * exp);
+}
+class HttpTransport {
+    config;
+    logger;
+    constructor(config, logger) {
+        this.config = config;
+        this.logger = logger;
+    }
+    /** Swap config after construction (the client re-reads customHeaders each call). */
+    updateConfig(patch) {
+        this.config = { ...this.config, ...patch };
+    }
+    /**
+     * The credential decision for one road, in one place so the policy can be
+     * read rather than reconstructed from call sites.
+     *
+     * Returns the auth headers to send, or throws a config error naming the fix.
+     */
+    authHeadersFor(road, viaProxy) {
+        const { apiKey, siteKey, unsafeAllowSecretKeyInBrowser } = this.config;
+        const browser = isBrowser();
+        // In proxy mode the DF's own server holds the credential and adds it. The
+        // SDK sends none — a key sent here would be a key in the bundle.
+        if (viaProxy)
+            return {};
+        if (road === 'session')
+            return {};
+        if (road === 'public') {
+            if (siteKey)
+                return { 'X-API-Key': siteKey };
+            // A public road with no site key is legitimate: /notices/current takes a
+            // tenant_code in the query.
+            return {};
+        }
+        // road === 'df'
+        if (browser && !unsafeAllowSecretKeyInBrowser) {
+            throw configError('Consentera: this call needs a Data Fiduciary credential, which is a SECRET and must ' +
+                'never be in a browser bundle. Set `proxyEndpoint` to your own server route (it holds ' +
+                'the tiq_live_/tiq_test_ key and forwards the call), or run this call server-side. ' +
+                'A public site key (tiq_pub_) cannot authorise it: the lifecycle roads are ' +
+                'server-to-server. A site key opens only the public read roads and the ' +
+                'session-scoped render/submit, and only for the origins in its allowed_domains.', 'SECRET_KEY_IN_BROWSER');
+        }
+        if (apiKey) {
+            if (browser && unsafeAllowSecretKeyInBrowser) {
+                this.logger.warn('Consentera: SENDING A SECRET KEY FROM A BROWSER because ' +
+                    'unsafeAllowSecretKeyInBrowser is set. Every visitor to this page can read it. ' +
+                    'Rotate the key and move to proxyEndpoint.');
+            }
+            return { 'X-API-Key': apiKey };
+        }
+        if (isSiteKey(siteKey)) {
+            throw configError('Consentera: a site key (tiq_pub_) was supplied for a Data Fiduciary lifecycle road. ' +
+                'Those roads are server-to-server; a site key opens only the public read roads and the ' +
+                'session-scoped render/submit, so this call would be refused 403. Use `proxyEndpoint`, ' +
+                'or a secret key server-side.', 'SITE_KEY_ON_DF_ROAD');
+        }
+        throw configError('Consentera: no credential for a Data Fiduciary road. Set `proxyEndpoint` (browser) or ' +
+            '`apiKey` (server).', 'NO_CREDENTIAL');
+    }
+    urlFor(path, query) {
+        const { proxyEndpoint, apiEndpoint } = this.config;
+        // A session/public road is reachable without the DF's proxy, but when a
+        // proxy is configured everything goes through it: one origin to allow-list.
+        const viaProxy = !!proxyEndpoint;
+        const base = viaProxy ? proxyEndpoint : apiEndpoint;
+        const prefix = this.config.apiPathPrefix ?? '/api/v1/public';
+        if (prefix !== '/api/v1/public' && prefix !== '/api/v1/cookie-consent') {
+            throw configError('Consentera: unsupported transport API plane.');
+        }
+        let url = viaProxy ? `${base}${path}` : `${base}${prefix}${path}`;
+        if (query) {
+            const params = new URLSearchParams();
+            for (const [k, v] of Object.entries(query)) {
+                if (v !== undefined && v !== null)
+                    params.set(k, String(v));
+            }
+            const qs = params.toString();
+            if (qs)
+                url += `?${qs}`;
+        }
+        return { url, viaProxy };
+    }
+    async request(method, path, body, options = {}) {
+        const road = options.road ?? 'df';
+        const { url, viaProxy } = this.urlFor(path, options.query);
+        const policy = { ...DEFAULT_RETRY, ...this.config.retry, ...options.retry };
+        const timeoutMs = options.timeoutMs ?? this.config.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        const doFetch = this.config.fetchImpl ?? globalThis.fetch;
+        if (typeof doFetch !== 'function') {
+            throw configError('Consentera: no fetch implementation available in this environment.');
+        }
+        const headers = {
+            Accept: 'application/json',
+            // THE PAIR, and why only one half of it is here.
+            //
+            // All six surfaces identify themselves as
+            //   User-Agent:       ConsenteraSDK/<version> (<platform>; <runtime>)
+            //   X-Consentera-SDK: <surface>/<version>
+            // the first being the form the platform's audit pipeline already parses
+            // (core/audit/user_agent_coarsening_test.go:39-40 coarsens
+            // `ConsenteraSDK/2.3.1 (…)` to `ConsenteraSDK/2`).
+            //
+            // `User-Agent` is a FORBIDDEN HEADER NAME in a browser: fetch drops any
+            // attempt to set it, silently, so setting it here would be a line that
+            // looks like identification and is not. It is therefore added only when
+            // there is no `window` — the Node build — and the browser identifies
+            // itself with X-Consentera-SDK alone.
+            'X-Consentera-SDK': SDK_HEADER_VALUE,
+            ...(isBrowser() ? {} : { 'User-Agent': userAgentValue() }),
+            ...this.authHeadersFor(road, viaProxy),
+        };
+        if (!viaProxy && road !== 'session' && this.config.tenantId)
+            headers['X-Tenant-Id'] = this.config.tenantId;
+        if (body !== undefined)
+            headers['Content-Type'] = 'application/json';
+        // ONE key for this logical operation, reused on every attempt below.
+        if (method !== 'GET')
+            headers['Idempotency-Key'] = options.idempotencyKey ?? newRequestId();
+        const custom = typeof this.config.customHeaders === 'function' ? this.config.customHeaders() : this.config.customHeaders;
+        Object.assign(headers, custom, options.headers);
+        let outgoing = body;
+        if (body !== undefined && this.config.beforeSend) {
+            const kept = this.config.beforeSend({ method, path, body });
+            if (kept === null || kept === undefined) {
+                throw configError(`Consentera: beforeSend refused ${method} ${path}. Nothing was sent.`, 'BEFORE_SEND_REFUSED');
+            }
+            outgoing = kept;
+        }
+        const payload = outgoing === undefined ? undefined : JSON.stringify(outgoing);
+        let lastError;
+        for (let attempt = 0; attempt < policy.attempts; attempt++) {
+            if (options.signal?.aborted)
+                throw cancelledError('request cancelled before attempt');
+            const started = Date.now();
+            let timedOut = false;
+            const controller = new AbortController();
+            const timer = setTimeout(() => {
+                timedOut = true;
+                controller.abort();
+            }, timeoutMs);
+            const onCallerAbort = () => controller.abort();
+            options.signal?.addEventListener('abort', onCallerAbort, { once: true });
+            try {
+                const response = await doFetch(url, {
+                    method,
+                    headers,
+                    body: payload,
+                    signal: controller.signal,
+                });
+                const elapsed = Date.now() - started;
+                const requestId = response.headers?.get?.('X-Request-Id') ?? undefined;
+                if (response.ok) {
+                    // NEVER the body — see the header of this file.
+                    this.logger.debug(`${method} ${path} -> ${response.status} (${elapsed}ms)`, { requestId });
+                    const wrap = (parsed) => (options.raw
+                        ? {
+                            status: response.status,
+                            body: parsed,
+                            requestId,
+                            retryAfterMs: parseRetryAfterMs(response.headers?.get?.('Retry-After')),
+                        }
+                        : parsed);
+                    if (response.status === 204)
+                        return wrap(undefined);
+                    const text = await response.text();
+                    if (!text)
+                        return wrap(undefined);
+                    try {
+                        return wrap(JSON.parse(text));
+                    }
+                    catch {
+                        // A 200 whose body is not JSON is a SERVER problem. Reporting it as
+                        // a network error (which 1.x did) sends the integrator to look at
+                        // their connection.
+                        throw errorFromResponse({
+                            status: response.status,
+                            body: text,
+                            requestId,
+                            method,
+                            path,
+                            statusText: 'response body is not JSON',
+                        });
+                    }
+                }
+                const rawText = await response.text();
+                let parsed = rawText;
+                try {
+                    parsed = JSON.parse(rawText);
+                }
+                catch {
+                    /* keep the text */
+                }
+                const retryAfterMs = parseRetryAfterMs(response.headers?.get?.('Retry-After'));
+                lastError = errorFromResponse({
+                    status: response.status,
+                    statusText: response.statusText,
+                    body: parsed,
+                    requestId,
+                    retryAfterMs,
+                    method,
+                    path,
+                });
+                this.logger.debug(`${method} ${path} -> ${response.status} ${lastError.code ?? ''} (${elapsed}ms)`, { requestId });
+            }
+            catch (err) {
+                if (err instanceof ConsenteraError) {
+                    if (!err.retryable)
+                        throw err;
+                    lastError = err;
+                }
+                else if (timedOut) {
+                    lastError = timeoutError(`${method} ${path} timed out after ${timeoutMs}ms`, err);
+                }
+                else if (options.signal?.aborted) {
+                    throw cancelledError(`${method} ${path} cancelled`, err);
+                }
+                else {
+                    lastError = networkError(`${method} ${path}: ${err?.message ?? 'network error'}`, err);
+                }
+            }
+            finally {
+                clearTimeout(timer);
+                options.signal?.removeEventListener('abort', onCallerAbort);
+            }
+            if (!lastError.retryable || attempt === policy.attempts - 1)
+                throw lastError;
+            if (policy.maxRetryAfterMs !== undefined && lastError.retryAfterMs !== undefined &&
+                lastError.retryAfterMs > policy.maxRetryAfterMs)
+                throw lastError;
+            const wait = lastError.retryAfterMs ?? backoffMs(attempt, policy);
+            this.logger.debug(`${method} ${path} retry ${attempt + 1}/${policy.attempts - 1} in ${wait}ms (${lastError.code ?? lastError.kind})`);
+            await sleep(wait, options.signal);
+        }
+        /* istanbul ignore next — the loop always throws on its last attempt. */
+        throw lastError ?? networkError(`${method} ${path} failed`);
+    }
+}
+
+/**
+ * ConsentEra Consent SDK Core Module
+ * Main entry point for consent management
+ */
+class ConsentEraConsent extends EventEmitter {
+    config;
+    storage;
+    banner = null;
+    preferenceCenter = null;
+    tcfManager = null;
+    gppManager = null;
+    logger;
+    initialized = false;
+    // Memoizes concurrent init() calls (autoShow's constructor-triggered init()
+    // racing an integrator's own explicit init() call is a realistic pattern,
+    // not just a React StrictMode artifact) so the async fetch + UI-component
+    // construction only ever happens once.
+    initPromise = null;
+    // Set by destroy(). init()'s fetchConfig() await is a suspend point — a
+    // caller that destroys the SDK while a first init() is still in flight
+    // (React StrictMode's mount->cleanup->mount double-invoke does exactly
+    // this) must not have that stale in-flight call resurrect a banner after
+    // teardown.
+    destroyed = false;
+    remoteConfig = null;
+    // Set from the real config response's policy_version — sent back on every
+    // preferences submission so the server can tell which notice/category
+    // snapshot the visitor's decision was recorded against.
+    remotePolicyVersion = '';
+    ageGateEnabled = false;
+    ageGatePrompt;
+    // Populated only if the integrator calls setAgeDeclaration() before saving.
+    // Left unset by default — the server already fails closed (force-denies
+    // tracking categories) for an unknown-age visitor, so omitting this is
+    // safe, not a compliance gap; it's an enhancement for integrators who
+    // collect their own age signal.
+    pendingIsAdult = null;
+    // A visitor-stable identifier persisted in localStorage (separate from the
+    // consent record itself) — the API's integrity-hash chain and expiry are
+    // scoped "per device", so this must be stable across visits, unlike the
+    // per-action IDs generateConsentId() produces elsewhere in this class.
+    deviceId;
+    constructor(config) {
+        super();
+        // THE P0 THIS SDK USED TO HAVE. ConsenteraConsent is the package DEFAULT
+        // export and the ConsentEraClient refusal did not reach it. authHeaders()
+        // below builds `siteKey || apiKey` into X-API-Key, so a tiq_live_ SECRET
+        // handed to it in a browser shipped straight to /api/v1/cookie-consent/*
+        // — and that plane IGNORES the key, so nothing refused it and nothing
+        // failed; the leak was silent. Same fail-closed rule as the lifecycle
+        // client, through the same shared guard, so the two doors cannot drift.
+        assertNoSecretKeyInBrowser({
+            apiKey: config.apiKey,
+            unsafeAllowSecretKeyInBrowser: config.unsafeAllowSecretKeyInBrowser,
+            fix: 'The cookie-consent plane needs no secret at all — use a public site key ' +
+                '(`siteKey: "tiq_pub_…"`), which is what it reads. Keep the tiq_live_/tiq_test_ key ' +
+                'on your own server.',
+        });
+        // NO DEFAULT SERVER. Until 2.0.0 an omitted `apiEndpoint` fell back to a
+        // built-in host on the `.io` domain, which the company does not own: it
+        // did not resolve, so every such embed failed, and it was one DNS record
+        // away from handing the visitor's consent payload and the site key to
+        // whoever holds that domain. It then moved to `api.consentera.in`, which
+        // does not exist either (NXDOMAIN, 2026-09-22). There is no host this SDK
+        // could guess correctly — the tenant's API host is deployment-specific —
+        // so it is required, and refused by name here, the same code and the same
+        // rule ConsentEraClient applies (ENDPOINT_REQUIRED).
+        if (typeof config.apiEndpoint !== 'string' || config.apiEndpoint.trim() === '') {
+            throw configError('Consentera: `apiEndpoint` is required — there is no default server. Set it to your ' +
+                "Consentera API origin (the SDK calls `${apiEndpoint}/api/v1/cookie-consent/*`); with " +
+                'the script-tag build, set `data-api-endpoint`.', 'ENDPOINT_REQUIRED');
+        }
+        this.config = this.mergeDefaults(config);
+        this.logger = new Logger(config.apiKey ? 'info' : 'debug');
+        this.storage = new ConsentStorage(this.config.storage);
+        this.deviceId = this.getOrCreateDeviceId();
+        if (this.config.autoShow) {
+            this.init()
+                .then(() => {
+                if (!this.hasConsent()) {
+                    this.showBanner();
+                }
+            })
+                .catch((error) => {
+                // init() now REJECTS when the tenant configuration cannot be loaded
+                // (it used to fabricate a generic notice and carry on). An unhandled
+                // rejection in a constructor is invisible, so it is caught here and
+                // announced: no banner is shown, and the host is told why.
+                this.logger.error('Consentera: auto-init failed; no banner will be shown.', error);
+                this.emit('error', error);
+                this.config.callbacks?.onError?.(error);
+            });
+        }
+    }
+    mergeDefaults(config) {
+        return {
+            // `apiEndpoint` HAS NO DEFAULT, and none belongs here. It is a bare
+            // origin — real routes are mounted at /api/v1/cookie-consent/... (built
+            // into the request URLs below), not under a versioned apiEndpoint prefix,
+            // matching ConsentEraClient's convention — and the constructor has
+            // already refused a config without one.
+            //
+            // The history, because the next person will be tempted to "helpfully"
+            // restore a default: until 2.0.0 it was a host on the `.io` domain, which
+            // is not the company's. That host did not resolve, so every integrator
+            // who omitted `apiEndpoint` got a DNS failure, which 1.x swallowed into a
+            // fabricated banner and a silently-unrecorded consent; three tests
+            // asserted it, so the wrong default was pinned by the suite rather than
+            // caught by it. And the `.io` apex DOES resolve, to someone else's
+            // servers, so it was one DNS record away from receiving consent payloads
+            // and the site key. The first fix moved it to `api.consentera.in`, which
+            // does not exist either. A default only moves the problem; the
+            // integrator's own API host is the only right answer.
+            autoShow: true,
+            language: 'en',
+            region: 'IN',
+            regulations: ['DPDP'],
+            theme: {
+                position: 'bottom',
+                type: 'banner',
+                primaryColor: '#2563eb',
+                backgroundColor: '#ffffff',
+                textColor: '#1f2937',
+                borderRadius: '8px',
+                showLogo: true,
+            },
+            storage: {
+                type: 'cookie',
+                cookieName: 'consentera_consent',
+                cookieExpiry: 365,
+                cookiePath: '/',
+                // `secure` IS DELIBERATELY ABSENT so ConsentStorage's protocol-aware
+                // default applies. A SECOND copy of the storage defaults lived here
+                // with `secure: true` hardcoded, which overrode ConsentStorage's own
+                // default — so on an http:// origin the browser dropped the consent
+                // cookie silently, exists() stayed false and the banner returned on
+                // every page view. One implementation of a default, in the class that
+                // owns it.
+                sameSite: 'Lax',
+            },
+            ...config,
+        };
+    }
+    getOrCreateDeviceId() {
+        const KEY = 'consentera_device_id';
+        try {
+            let id = window.localStorage.getItem(KEY);
+            if (!id) {
+                id = generateConsentId();
+                window.localStorage.setItem(KEY, id);
+            }
+            return id;
+        }
+        catch {
+            // localStorage unavailable (privacy mode, SSR) — fall back to a
+            // session-only id; consent will still work, just won't survive reload.
+            return generateConsentId();
+        }
+    }
+    /**
+     * Supply a self-declared adult/minor signal (DPDP §9(3)) before calling
+     * acceptAll()/rejectAll()/savePreferences(). Optional — if never called,
+     * the server treats the visitor as unknown-age and force-denies tracking
+     * categories regardless of what the visitor otherwise selects.
+     */
+    setAgeDeclaration(isAdult) {
+        this.pendingIsAdult = isAdult;
+    }
+    /**
+     * Whether the tenant has DPDP §9(3) age assurance turned on for this
+     * banner. Populated from the real config once init() resolves; false
+     * before that.
+     */
+    isAgeGateEnabled() {
+        return this.ageGateEnabled;
+    }
+    /**
+     * The tenant-configured age-gate prompt text, if any — for an integrator
+     * building their own age-check UI ahead of calling setAgeDeclaration().
+     */
+    getAgeGatePrompt() {
+        return this.ageGatePrompt;
+    }
+    /**
+     * Initialize the SDK
+     */
+    init() {
+        if (this.initialized) {
+            this.logger.warn('ConsentEra Consent SDK already initialized');
+            return Promise.resolve();
+        }
+        // A second concurrent call (e.g. autoShow's constructor-triggered init()
+        // racing an integrator's own explicit init() call) joins the same
+        // in-flight promise instead of re-fetching config and constructing a
+        // second set of UI components.
+        if (this.initPromise) {
+            return this.initPromise;
+        }
+        this.initPromise = this.doInit().finally(() => {
+            this.initPromise = null;
+        });
+        return this.initPromise;
+    }
+    async doInit() {
+        try {
+            this.logger.info('Initializing ConsentEra Consent SDK...');
+            // Fetch remote configuration
+            const remoteConfig = await this.fetchConfig();
+            // destroy() may have run while fetchConfig() was in flight (e.g. React
+            // StrictMode's dev-mode mount->cleanup->mount double-invoke destroys
+            // the first instance before its init() resolves) — a torn-down
+            // instance must not resurrect a banner/preference center.
+            if (this.destroyed) {
+                return;
+            }
+            this.remoteConfig = remoteConfig;
+            // Initialize TCF if enabled
+            if (this.config.tcf?.enabled) {
+                this.tcfManager = new TCFManager(this.config.tcf);
+                await this.tcfManager.init();
+            }
+            // Initialize GPP if enabled
+            if (this.config.gpp?.enabled) {
+                this.gppManager = new GPPManager(this.config.gpp);
+                await this.gppManager.init();
+            }
+            if (this.destroyed) {
+                return;
+            }
+            // Create UI components
+            this.banner = new ConsentBanner(this.remoteConfig, this.config.theme, this);
+            this.preferenceCenter = new PreferenceCenter(this.remoteConfig, this.config.theme, this);
+            this.initialized = true;
+            this.emit('ready');
+            this.config.callbacks?.onReady?.();
+            this.logger.info('ConsentEra Consent SDK initialized successfully');
+        }
+        catch (error) {
+            this.logger.error('Failed to initialize SDK:', error);
+            this.config.callbacks?.onError?.(error);
+            throw error;
+        }
+    }
+    authHeaders() {
+        const headers = { 'X-Tenant-Id': this.config.tenantId };
+        // Site key FIRST — it is the credential this plane is meant to carry. A
+        // secret apiKey only reaches here in a browser through
+        // unsafeAllowSecretKeyInBrowser (the constructor refuses it otherwise), and
+        // then every request says so, the way the transport does.
+        const key = this.config.siteKey || this.config.apiKey;
+        if (key) {
+            if (isBrowser() && !this.config.siteKey && isSecretKey(this.config.apiKey)) {
+                this.logger.warn('Consentera: SENDING A SECRET KEY FROM A BROWSER because ' +
+                    'unsafeAllowSecretKeyInBrowser is set. Every visitor to this page can read it. ' +
+                    'The cookie-consent plane needs only a public site key — rotate this one.');
+            }
+            headers['X-API-Key'] = key;
+        }
+        return headers;
+    }
+    /**
+     * Fetch configuration from server — the real, public, unauthenticated
+     * (beyond X-Tenant-Id) /api/v1/cookie-consent/config surface. Previously
+     * this called {apiEndpoint}/consent/config/{tenantId}, a route that does
+     * not exist anywhere in the API, so every real embed silently fell back to
+     * getDefaultConfig() and never showed the tenant's actual categories.
+     */
+    async fetchConfig() {
+        try {
+            const response = await fetch(`${this.config.apiEndpoint}/api/v1/cookie-consent/config`, {
+                headers: {
+                    ...this.authHeaders(),
+                    'Accept-Language': this.config.language || 'en',
+                },
+            });
+            if (!response.ok) {
+                throw new Error(`Failed to fetch config: ${response.statusText}`);
+            }
+            const real = await response.json();
+            this.remotePolicyVersion = real.policy_version;
+            this.ageGateEnabled = real.age_gate_enabled;
+            this.ageGatePrompt = real.age_gate_prompt;
+            return mapCookieConfigToSDKConfig(real, this.config);
+        }
+        catch (error) {
+            // NO FABRICATED NOTICE. Until 2.0.0 this fell back to getDefaultConfig():
+            // a hardcoded "We value your privacy" banner with invented purpose ids
+            // (essential / analytics / marketing) that are not the tenant's, and a
+            // policy_version of ''. A decision taken against a notice the controller
+            // never published is not a consent, so there is nothing safe to render
+            // here — the banner stays away and the host is told.
+            this.logger.error('Consentera: the tenant consent configuration could not be loaded.', error);
+            throw error instanceof Error ? error : new Error(String(error));
+        }
+    }
+    // getDefaultConfig() WAS HERE AND IS DELETED (2.0.0). It returned a generic
+    // banner with fabricated purposes whenever the tenant's real configuration
+    // could not be fetched, and consent was then collected against it. See
+    // fetchConfig above for why there is no safe fallback.
+    /**
+     * Show consent banner
+     */
+    showBanner() {
+        if (!this.initialized) {
+            this.logger.warn('SDK not initialized. Call init() first.');
+            return;
+        }
+        this.banner?.show();
+        this.emit('banner_shown');
+        this.config.callbacks?.onBannerShown?.();
+    }
+    /**
+     * Hide consent banner
+     */
+    hideBanner() {
+        this.banner?.hide();
+        this.emit('banner_closed');
+        this.config.callbacks?.onBannerClosed?.();
+    }
+    /**
+     * Show preference center
+     */
+    showPreferences() {
+        if (!this.initialized) {
+            this.logger.warn('SDK not initialized. Call init() first.');
+            return;
+        }
+        this.preferenceCenter?.show();
+        this.emit('preferences_opened');
+    }
+    /**
+     * Hide preference center
+     */
+    hidePreferences() {
+        this.preferenceCenter?.hide();
+    }
+    /**
+     * Accept all consent purposes
+     */
+    async acceptAll() {
+        const preferences = {
+            essential: true,
+            functional: true,
+            analytics: true,
+            marketing: true,
+            personalization: true,
+            advertising: true,
+            thirdParty: true,
+        };
+        this.emit('accept_all');
+        return this.saveConsent(preferences);
+    }
+    /**
+     * Reject all non-essential purposes
+     */
+    async rejectAll() {
+        const preferences = {
+            essential: true,
+            functional: false,
+            analytics: false,
+            marketing: false,
+            personalization: false,
+            advertising: false,
+            thirdParty: false,
+        };
+        this.emit('reject_all');
+        return this.saveConsent(preferences);
+    }
+    /**
+     * Save consent preferences
+     */
+    async savePreferences(preferences) {
+        this.emit('preferences_saved', preferences);
+        return this.saveConsent(preferences);
+    }
+    async saveConsent(preferences) {
+        try {
+            const selections = this.buildSelections(preferences);
+            // syncConsent THROWS when the platform did not record the decision, so
+            // nothing below this line runs on a failure: no local cookie, no hidden
+            // banner, no consent_given. That is the point — see syncConsent.
+            const submitResult = await this.syncConsent(selections);
+            // DPDP §9(3): effective_selections is the server-authoritative result
+            // AFTER the minor force-deny gate. Building the stored/emitted consent
+            // from the client's raw `preferences` instead — as this used to do —
+            // would let a minor's tracking-category consent read as granted
+            // locally even when the server denied it.
+            const effective = submitResult.effective_selections ?? selections;
+            const consent = this.buildConsentData(effective);
+            this.storage.save(consent);
+            if (this.tcfManager) {
+                await this.tcfManager.updateConsent(this.selectionsToPreferences(effective));
+            }
+            if (this.gppManager) {
+                await this.gppManager.updateConsent(this.selectionsToPreferences(effective));
+            }
+            this.hideBanner();
+            this.hidePreferences();
+            this.emit('consent_given', consent);
+            this.config.callbacks?.onConsentGiven?.(consent);
+            // onPreferencesUpdated is part of the public ConsentCallbacks type but was
+            // never invoked — an integrator who wired it got silence forever. Fire it
+            // from the SERVER-AUTHORITATIVE effective selections (post §9(3) force-deny),
+            // not the client's raw request, so a listener that re-gates scripts on this
+            // payload inherits the same protection as isConsentGiven().
+            this.config.callbacks?.onPreferencesUpdated?.(this.selectionsToPreferences(effective));
+            return { success: true, consentId: consent.consentId };
+        }
+        catch (error) {
+            this.logger.error('Failed to save consent:', error);
+            return { success: false, error: error.message };
+        }
+    }
+    /** Client-requested selections, keyed by category/purpose id — required
+     * (mandatory) categories are always true regardless of the input. This is
+     * what gets POSTed; the server may still override individual entries in
+     * its response (see effective_selections above). */
+    buildSelections(preferences) {
+        const selections = {};
+        for (const purpose of this.remoteConfig?.purposes || []) {
+            selections[purpose.id] = purpose.required || !!preferences[purpose.id];
+        }
+        return selections;
+    }
+    selectionsToPreferences(selections) {
+        const prefs = {
+            essential: true,
+            functional: false,
+            analytics: false,
+            marketing: false,
+            personalization: false,
+            advertising: false,
+            thirdParty: false,
+        };
+        for (const [id, granted] of Object.entries(selections)) {
+            prefs[id] = granted;
+        }
+        return prefs;
+    }
+    buildConsentData(selections) {
+        const purposes = (this.remoteConfig?.purposes || []).map((p) => ({
+            id: p.id,
+            name: p.name,
+            description: p.description,
+            category: p.category,
+            required: p.required,
+            consented: p.required || !!selections[p.id],
+            legalBasis: p.required ? 'legitimate_interest' : 'consent',
+        }));
+        return {
+            consentId: generateConsentId(),
+            timestamp: new Date().toISOString(),
+            version: this.remotePolicyVersion || '1.0',
+            purposes,
+            legalBasis: 'consent',
+            regulation: this.config.regulations?.[0] || 'DPDP',
+            metadata: {
+                userAgent: navigator.userAgent,
+                pageUrl: window.location.href,
+                referrer: document.referrer,
+                device: getDeviceInfo(),
+            },
+        };
+    }
+    /**
+     * POST /api/v1/cookie-consent/preferences — the real submit endpoint.
+     * Previously this posted to {apiEndpoint}/consent, a route that does not
+     * exist anywhere in the API, so no real embed ever actually recorded a
+     * consent decision server-side (it silently failed and kept only the
+     * local copy).
+     *
+     * ─── IT THROWS. IT USED TO SWALLOW, AND THAT WAS THE WORST DEFECT HERE ────
+     *
+     * Until 2.0.0 every failure — offline, 403, a wrong host, a 500 — was caught,
+     * logged at warn, and turned into `return null`. The caller then wrote the
+     * local cookie anyway, hid the banner, fired `consent_given` and reported
+     * success. The visitor had clicked Reject All; the platform had no record of
+     * it; and because the cookie existed the banner never came back to ask again.
+     * A withdrawal was lost the same way. The SDK's own log line was the only
+     * trace, at a level nobody reads in production.
+     *
+     * Now the failure reaches the caller, the local copy is NOT written, the
+     * banner stays up, and the host hears about it on `sync_failed` and
+     * `callbacks.onSyncFailed`.
+     */
+    async syncConsent(selections) {
+        try {
+            const body = {
+                device_id: this.deviceId,
+                policy_version: this.remotePolicyVersion,
+                selections,
+                affirmative_action: {
+                    type: 'button',
+                    ui_event_id: generateConsentId(),
+                    captured_at: new Date().toISOString(),
+                },
+            };
+            if (this.ageGateEnabled && this.pendingIsAdult !== null) {
+                body.age_declaration = { is_adult: this.pendingIsAdult };
+            }
+            const transport = new HttpTransport({
+                apiEndpoint: this.config.apiEndpoint,
+                apiPathPrefix: '/api/v1/cookie-consent',
+                retry: { maxRetryAfterMs: 5000 },
+            }, this.logger);
+            return await transport.request('POST', '/preferences', body, { road: 'public', headers: this.authHeaders() });
+        }
+        catch (error) {
+            this.logger.error('Consentera: consent sync failed — the decision was not recorded.', {
+                message: error?.message,
+            });
+            this.emit('sync_failed', error);
+            this.config.callbacks?.onSyncFailed?.(error);
+            throw error;
+        }
+    }
+    /**
+     * Get current consent data
+     */
+    getConsent() {
+        return this.storage.get();
+    }
+    /**
+     * Check if consent has been given
+     */
+    hasConsent() {
+        return this.storage.exists();
+    }
+    /**
+     * Withdraw consent for specified purposes (or all optional purposes if
+     * none given). There is no separate public withdraw endpoint for the
+     * cookie widget — the real API expresses withdrawal the same way a
+     * changed-mind re-visit is expressed: resubmitting selections via
+     * POST /api/v1/cookie-consent/preferences with the withdrawn categories
+     * set to false. Previously this called {apiEndpoint}/consent/withdraw,
+     * a route that does not exist anywhere in the API.
+     */
+    async withdrawConsent(purposes) {
+        try {
+            const currentConsent = this.getConsent();
+            if (!currentConsent) {
+                return { success: false, error: 'No consent found' };
+            }
+            const selections = {};
+            for (const purpose of this.remoteConfig?.purposes || []) {
+                if (purpose.required) {
+                    selections[purpose.id] = true;
+                    continue;
+                }
+                const isWithdrawn = purposes ? purposes.includes(purpose.id) : true;
+                if (isWithdrawn) {
+                    selections[purpose.id] = false;
+                }
+                else {
+                    const wasConsented = currentConsent.purposes.find((p) => p.id === purpose.id)?.consented ?? false;
+                    selections[purpose.id] = wasConsented;
+                }
+            }
+            const submitResult = await this.syncConsent(selections);
+            const effective = submitResult.effective_selections ?? selections;
+            const consent = this.buildConsentData(effective);
+            this.storage.save(consent);
+            if (this.tcfManager) {
+                await this.tcfManager.updateConsent(this.selectionsToPreferences(effective));
+            }
+            if (this.gppManager) {
+                await this.gppManager.updateConsent(this.selectionsToPreferences(effective));
+            }
+            this.emit('consent_withdrawn', purposes || []);
+            this.config.callbacks?.onConsentWithdrawn?.(purposes || []);
+            return { success: true, consentId: consent.consentId };
+        }
+        catch (error) {
+            return { success: false, error: error.message };
+        }
+    }
+    /**
+     * Check if consent is given for a specific purpose
+     */
+    isConsentGiven(purpose) {
+        const consent = this.getConsent();
+        if (!consent)
+            return false;
+        const purposeData = consent.purposes.find((p) => p.id === purpose);
+        return purposeData?.consented || false;
+    }
+    /**
+     * Get current preferences
+     */
+    getPreferences() {
+        const consent = this.getConsent();
+        if (!consent) {
+            return {
+                essential: true,
+                functional: false,
+                analytics: false,
+                marketing: false,
+                personalization: false,
+                advertising: false,
+                thirdParty: false,
+            };
+        }
+        const preferences = { essential: true };
+        consent.purposes.forEach((p) => {
+            preferences[p.id] = p.consented;
+        });
+        return preferences;
+    }
+    /**
+     * Set language
+     */
+    setLanguage(language) {
+        this.config.language = language;
+        // Refetch config with new language if needed
+    }
+    /**
+     * Destroy SDK instance
+     */
+    destroy() {
+        this.destroyed = true;
+        this.banner?.destroy();
+        this.preferenceCenter?.destroy();
+        this.tcfManager?.destroy();
+        this.gppManager?.destroy();
+        this.removeAllListeners();
+        this.initialized = false;
+    }
+}
+/**
+ * Translates the real /api/v1/cookie-consent/config response into the SDK's
+ * own internal ConfigResponse/BannerConfig/PurposeConfig shape that
+ * ConsentBanner and PreferenceCenter render from. Isolated here (rather than
+ * rewriting those two renderers around the real field names) so the
+ * rendering layer's contract stays stable while only the network layer
+ * changes — the real backend's vocabulary (cookie "categories" with a
+ * mandatory/sort_order flag) is a different shape than the SDK's generic
+ * "purposes", not just a rename.
+ */
+function mapCookieConfigToSDKConfig(real, config) {
+    const purposes = [...real.categories]
+        .sort((a, b) => a.sort_order - b.sort_order)
+        .map((c) => ({
+        id: c.key,
+        name: c.name,
+        description: c.description,
+        required: c.mandatory,
+        defaultEnabled: c.mandatory,
+        category: mapCategoryKeyToPurposeCategory(c.key),
+    }));
+    // Messaging keys mirror what the admin Banners tab actually writes
+    // (page.tsx's bannerForm.messaging: title/description/accept_text/
+    // reject_text/customize_text) — this is a free-form map on the backend,
+    // not a fixed schema, but these are the keys real banners contain.
+    const msg = real.banner?.messaging || {};
+    const banner = {
+        title: msg.title,
+        description: msg.description,
+        acceptAllText: msg.accept_text,
+        rejectAllText: msg.reject_text,
+        customizeText: msg.customize_text,
+        saveText: msg.save_text,
+        showRejectAll: real.ui_options?.reject_all ?? true,
+        showCustomize: real.ui_options?.customize ?? true,
+        showPrivacyPolicy: true,
+        purposes,
+    };
+    return {
+        tenantId: real.tenant_id,
+        banner,
+        purposes,
+        theme: config.theme,
+        regulations: config.regulations || ['DPDP'],
+        languages: [real.language_code],
+    };
+}
+function mapCategoryKeyToPurposeCategory(key) {
+    const k = key.toLowerCase();
+    if (k.includes('essential') || k.includes('necess') || k.includes('strict') || k.includes('security')) {
+        return 'essential';
+    }
+    if (k.includes('analyt'))
+        return 'analytics';
+    if (k.includes('market') || k.includes('advertis'))
+        return 'marketing';
+    if (k.includes('function') || k.includes('prefer'))
+        return 'functional';
+    if (k.includes('personal'))
+        return 'personalization';
+    return 'third_party';
+}
+
+/**
+ * Consentera Consent SDK — THE artifact read, in one place.
+ *
+ * `ConsentSession.getArtifact` and the callback handler's confirmation both
+ * read GET /consent/artifacts/{artifact_id}, and before this file each spelled
+ * the request itself. Both spelled it WITHOUT `?session_id=`, which on the
+ * platform that ships is the difference between two answers:
+ *
+ *   without session_id   a consent whose artifact is still being written is a
+ *                        404 ARTIFACT_NOT_FOUND — the same word a guessed id
+ *                        gets. The callback handler therefore had to read
+ *                        every 404 as "maybe pending" and poll it, so a FORGED
+ *                        artifact_id came back `pending` instead of refused.
+ *   with session_id      202 + Retry-After while the projection is owed; 404
+ *                        only when the id was never issued for that session or
+ *                        will never be written. (GetArtifactHandler,
+ *                        consent/collection.go:4409-4520 at 4fda7e3d05; walk
+ *                        finding F018; SDK register WEB-033.)
+ *
+ * Measured on setup.consentera.in (4fda7e3d05): an unknown artifact read with a
+ * real session is 404; the walk's real artifact with its session is 200. See
+ * fixtures/platform-wire/artifact-read.*.json at the repo root.
+ *
+ * WHAT THE session_id DOES NOT DO (walk finding F077, measured): once the
+ * artifact row exists the 200 path reads by tenant + artifact_id ALONE. The
+ * same artifact read with a random session_id is still 200. So a 200 does not
+ * prove the artifact belongs to your session; compare its `data_principal_id`
+ * with the one your session create returned (the callback handler does).
+ */
+/** Retry-After when the 202 carried neither the header nor `retry_after`. */
+const DEFAULT_PENDING_RETRY_MS = 1000;
+function artifactPath(artifactId) {
+    // encodeURIComponent: an id with a URL-special character (or a caller passing
+    // a path fragment) would otherwise reshape the request.
+    return `/consent/artifacts/${encodeURIComponent(artifactId)}`;
+}
+/**
+ * Read one artifact. Resolves `recorded` (200) or `pending` (202); a 404, a
+ * 403 and everything else is the transport's typed ConsenteraError.
+ */
+async function readArtifact(request, artifactId, options = {}) {
+    const res = await request('GET', artifactPath(artifactId), undefined, { session_id: options.sessionId || undefined }, { raw: true, signal: options.signal, timeoutMs: options.timeoutMs });
+    if (res.status === 200 && res.body && typeof res.body === 'object') {
+        return { state: 'recorded', artifact: res.body, requestId: res.requestId };
+    }
+    if (res.status === 202 && res.body && typeof res.body === 'object') {
+        const pending = res.body;
+        const fromBody = typeof pending.retry_after === 'number' && pending.retry_after >= 0 ? pending.retry_after * 1000 : undefined;
+        return {
+            state: 'pending',
+            pending,
+            retryAfterMs: res.retryAfterMs ?? fromBody ?? DEFAULT_PENDING_RETRY_MS,
+            requestId: res.requestId,
+        };
+    }
+    // Any other 2xx (a 204, a 200 with no body) is not an answer this road
+    // gives. Reporting it as an artifact would be inventing one.
+    throw errorFromResponse({
+        status: res.status,
+        statusText: 'not an artifact read answer (expected 200 or 202 with a JSON body)',
+        body: res.body,
+        requestId: res.requestId,
+        method: 'GET',
+        path: artifactPath(artifactId),
+    });
+}
+
+/**
+ * Consentera Consent SDK — the consent popup, and the ONE message it listens for.
+ *
+ * ─── WHAT /collect ACTUALLY POSTS (SDK register WEB-035) ────────────────────
+ *
+ * After a decision, an EMBEDDED /collect page (window.parent !== window) posts
+ * exactly one message to its parent. That is decisionMessage() in
+ * consentera-ui/src/app/collect/[sessionId]/decision-message.ts, posted at
+ * page.tsx:1535-1545 (grant) and :1670-1680 (decline) on the served commit
+ * 4fda7e3d05:
+ *
+ *   { type: 'consentera:submitted' | 'consentera:declined',
+ *     session_id, artifact_id, status: 'granted'|'partial'|'denied', pending,
+ *     sessionId, redirectUrl, choices }          // the three legacy fields
+ *
+ * `choices` rides only on a submit. The TARGET ORIGIN is the origin of the
+ * session's callback_url (redirect-trust.ts parentOriginFor), so the page that
+ * frames /collect must be on the callback's origin or the browser drops the
+ * message without a word.
+ *
+ * Before this file the SDK opened the page with window.open and listened for
+ * `consentera:consent-result`, a type the platform has never sent. That was
+ * wrong twice over, because a window.open popup is a TOP-LEVEL page. It posts
+ * nothing: it navigates to the callback instead. The storage fallback polled
+ * sessionStorage, which a separate window does not share. So the promise could
+ * end only when the window closed, as `unverified`, or at the 10-minute
+ * timeout.
+ *
+ * So the popup is now what the platform's own website popup is: a dialog on
+ * THIS page with /collect in an iframe (consentera-ui/src/lib/onboarding/
+ * website-consent.ts, createDialog). It is the presentation in which /collect
+ * reports the decision.
+ *
+ * ─── WHAT THE RESULT IS, AND WHAT IT IS NOT ────────────────────────────────
+ *
+ * The message comes from the platform's origin and from the frame this SDK
+ * opened (both are checked), so it is the platform page's report of the
+ * decision. It is not the consent record. The record is the artefact: confirm
+ * it with getArtifact(artifact_id, { sessionId }) through your proxy, or on
+ * your server, before you act on a grant.
+ */
+const TYPES = new Set(['consentera:submitted', 'consentera:declined']);
+const STATUSES = new Set(['granted', 'partial', 'denied']);
+function queryOf(url) {
+    if (typeof url !== 'string' || !url)
+        return null;
+    try {
+        return new URL(url, 'https://collect.invalid').searchParams;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The platform's own rule for a status the message did not carry
+ * (decision-message.ts decisionStatus): the redirect URL's status when it has
+ * one, else from the choices — none granted → denied, some denied → partial,
+ * else granted.
+ */
+function derivedStatus(q, choices) {
+    const fromUrl = q?.get('status');
+    if (fromUrl && STATUSES.has(fromUrl))
+        return fromUrl;
+    const values = Object.values(choices ?? {});
+    const granted = values.filter(Boolean).length;
+    if (granted === 0)
+        return 'denied';
+    if (granted < values.length)
+        return 'partial';
+    return 'granted';
+}
+/**
+ * Read a MessageEvent as /collect's decision — or null when it is not one, or
+ * not from where it must come from.
+ *
+ * Exported for a Data Fiduciary that frames consent_url itself: the same
+ * checks, one implementation.
+ *
+ *   origin    must equal the /collect origin (the consent_url's origin)
+ *   source    when given, must be the frame that was opened
+ *   type      consentera:submitted | consentera:declined
+ *   session   `session_id` (or the legacy `sessionId`) must be this session;
+ *             when both are present they must agree
+ */
+function readDecisionMessage(event, expected) {
+    if (!expected.origin || event.origin !== expected.origin)
+        return null;
+    if (expected.source !== undefined && event.source !== expected.source)
+        return null;
+    const data = event.data;
+    if (!data || typeof data !== 'object' || typeof data.type !== 'string' || !TYPES.has(data.type))
+        return null;
+    const snake = typeof data.session_id === 'string' && data.session_id ? data.session_id : undefined;
+    const legacy = typeof data.sessionId === 'string' && data.sessionId ? data.sessionId : undefined;
+    if (snake && legacy && snake !== legacy)
+        return null;
+    const sessionId = snake ?? legacy;
+    if (!sessionId || sessionId !== expected.sessionId)
+        return null;
+    const redirectUrl = typeof data.redirectUrl === 'string' && data.redirectUrl ? data.redirectUrl : undefined;
+    const q = queryOf(redirectUrl);
+    const choices = data.choices && typeof data.choices === 'object' ? data.choices : undefined;
+    const type = data.type;
+    // The platform's own value when it sent one; otherwise its own derivation.
+    // A decline carries no choices, so it derives `denied` unless the redirect
+    // URL says otherwise.
+    const status = typeof data.status === 'string' && STATUSES.has(data.status)
+        ? data.status
+        : derivedStatus(q, type === 'consentera:declined' ? undefined : choices);
+    const artifactId = typeof data.artifact_id === 'string' && data.artifact_id ? data.artifact_id : (q?.get('artifact_id') ?? '');
+    return {
+        outcome: 'decided',
+        type,
+        session_id: sessionId,
+        artifact_id: artifactId,
+        status,
+        pending: data.pending === true || q?.get('pending') === '1',
+        ...(redirectUrl ? { redirect_url: redirectUrl } : {}),
+        ...(choices ? { choices } : {}),
+    };
+}
+/**
+ * Refuse a callback that cannot deliver the decision to this page.
+ * Returns the refusal, or null when the callback is fine or unknown.
+ */
+function callbackOriginProblem(callbackUrl, pageOrigin) {
+    if (!callbackUrl)
+        return null;
+    let cb;
+    try {
+        cb = new URL(callbackUrl, pageOrigin);
+    }
+    catch {
+        return `the session's callback_url (${callbackUrl}) is not a URL`;
+    }
+    if (cb.protocol !== 'https:' && cb.protocol !== 'http:') {
+        return (`the session's callback_url is an app link (${cb.protocol}//…). /collect then posts its decision to its ` +
+            'own origin, which this page is not, so the popup would never hear it. Use redirectToConsent, or ' +
+            'create the session with a callback_url on this page’s origin.');
+    }
+    if (cb.origin !== pageOrigin) {
+        return (`/collect posts the decision to the callback's origin (${cb.origin}), and this page is ${pageOrigin}. ` +
+            'The browser drops a message addressed to another origin, so the popup would never hear it. ' +
+            'Create the session with a callback_url on this page’s origin.');
+    }
+    return null;
+}
+/**
+ * Open consent_url in a dialog on this page and resolve with the decision
+ * /collect posts, or `dismissed` when the person closes it.
+ */
+function openConsentDialog(session, options = {}) {
+    if (typeof window === 'undefined' || typeof document === 'undefined') {
+        throw new Error('openConsentPopup can only be used in browser environments');
+    }
+    const problem = callbackOriginProblem(options.callbackUrl, window.location.origin);
+    if (problem) {
+        return Promise.reject(configError(`Consentera: ${problem}`, 'CALLBACK_ORIGIN_MISMATCH'));
+    }
+    let consentOrigin;
+    try {
+        consentOrigin = new URL(session.consent_url, window.location.href).origin;
+    }
+    catch {
+        return Promise.reject(configError('Consentera: consent_url is not a URL.', 'CONSENT_URL_INVALID'));
+    }
+    const timeoutMs = options.timeoutMs ?? 10 * 60 * 1000;
+    const title = options.title ?? 'Your consent choices';
+    const host = options.container ?? document.body;
+    return new Promise((resolve, reject) => {
+        const previouslyFocused = document.activeElement;
+        const previousOverflow = document.documentElement.style.overflow;
+        const overlay = document.createElement('div');
+        overlay.dataset.consenteraPopup = 'true';
+        overlay.style.cssText =
+            'position:fixed;inset:0;z-index:2147483000;display:flex;align-items:center;justify-content:center;' +
+                'padding:12px;background:rgba(15,23,42,.6)';
+        const box = document.createElement('div');
+        box.setAttribute('role', 'dialog');
+        box.setAttribute('aria-modal', 'true');
+        box.setAttribute('aria-label', title);
+        box.style.cssText =
+            'display:flex;flex-direction:column;width:100%;max-width:680px;height:min(780px,100%);background:#fff;' +
+                'border-radius:14px;overflow:hidden;box-shadow:0 24px 64px rgba(0,0,0,.35)';
+        const head = document.createElement('div');
+        head.style.cssText = 'display:flex;justify-content:flex-end;padding:8px;border-bottom:1px solid #e5e7eb';
+        const close = document.createElement('button');
+        close.type = 'button';
+        close.textContent = 'Close';
+        close.setAttribute('aria-label', `Close — ${title}`);
+        close.style.cssText =
+            'font:inherit;font-size:14px;padding:8px 14px;min-height:40px;border:1px solid #d1d5db;border-radius:8px;' +
+                'background:#fff;color:#111827;cursor:pointer';
+        const frame = document.createElement('iframe');
+        frame.title = title;
+        frame.src = session.consent_url;
+        frame.style.cssText = 'flex:1;width:100%;border:0;background:#fff';
+        head.append(close);
+        box.append(head, frame);
+        overlay.append(box);
+        host.append(overlay);
+        document.documentElement.style.overflow = 'hidden';
+        close.focus();
+        let settled = false;
+        const finish = (fn) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(deadline);
+            window.removeEventListener('message', onMessage);
+            document.removeEventListener('keydown', onKey, true);
+            overlay.remove();
+            document.documentElement.style.overflow = previousOverflow;
+            if (previouslyFocused && typeof previouslyFocused.focus === 'function')
+                previouslyFocused.focus();
+            fn();
+        };
+        const dismiss = () => finish(() => resolve({ outcome: 'dismissed', session_id: session.consent_session_id }));
+        const onMessage = (event) => {
+            const decision = readDecisionMessage(event, {
+                origin: consentOrigin,
+                sessionId: session.consent_session_id,
+                source: frame.contentWindow,
+            });
+            if (decision)
+                finish(() => resolve(decision));
+        };
+        const onKey = (event) => {
+            if (event.key === 'Escape') {
+                event.preventDefault();
+                dismiss();
+            }
+        };
+        const deadline = setTimeout(() => finish(() => reject(new Error(`Consentera: the consent dialog had no decision within ${timeoutMs}ms. The session is still ` +
+            'valid — verify it server-side, or reopen it.'))), timeoutMs);
+        close.addEventListener('click', dismiss);
+        window.addEventListener('message', onMessage);
+        document.addEventListener('keydown', onKey, true);
+    });
+}
+
+/**
+ * ConsentEra Consent SDK — Session Management
+ * Create consent sessions, retrieve artifacts, handle redirect flows
+ */
+class ConsentSession {
+    request;
+    config;
+    logger;
+    /**
+     * The callback_url each session was created with, in this page. The popup
+     * needs it: /collect posts its decision to that URL's origin.
+     */
+    callbackUrls = new Map();
+    constructor(request, config, logger) {
+        this.request = request;
+        this.config = config;
+        this.logger = logger;
+    }
+    /**
+     * Create a new consent session for consent collection.
+     * Returns a session with consent_url for redirect/popup flow.
+     *
+     *   createSession({
+     *     data_principal: { email: 'riya@example.in' },
+     *     notice_internal_name: 'bnb_consent_v2',
+     *     age: { date_of_birth: '1998-04-12' },
+     *   })
+     *
+     * Identity is `data_principal` — the identifiers, keyed by THIS
+     * ORGANISATION'S locked integration key — or `data_principal_id`; the type of
+     * {@link CreateSessionRequest} requires at least one of the two, because the
+     * API refuses a request with neither.
+     *
+     * ─── THIS IS THE U58 WIRE, AND THERE IS NO OVERLAP WINDOW ────────────────
+     *
+     * `data_principal_ref`, `data_principal_ref_type`, `data_principal_details`,
+     * `locale_pref`, `notice_language`, `template_language` and `purpose_ids` are
+     * DELETED from the API's request struct. This SDK version talks to an API
+     * carrying U58 and to no other, in both directions:
+     *
+     *   old SDK -> new API   the identifiers are dropped, then 400
+     *   new SDK -> old API   the identifiers are dropped, then 400
+     *
+     * EVERY FIELD THIS BUILDS IS A FIELD THE API DECODES. The handler decodes
+     * with a plain `json.Decoder` and NO `DisallowUnknownFields` — on BOTH wires
+     * — so a key it does not know is dropped in silence rather than refused. That
+     * is why the two wires cannot be mixed and why the failure above is a 400
+     * about a MISSING identifier rather than about the field you sent. Check a
+     * field against the request struct before adding it.
+     */
+    async createSession(params, options) {
+        // THE CALLBACK STATE, minted here and nowhere else — before the call,
+        // because callback_url is a REQUEST field. See withCallbackState.
+        const requestedCallback = params.callback_url || this.config.callbackUrl;
+        const state = requestedCallback ? newCallbackState() : undefined;
+        const body = {
+            ui_mode: params.ui_mode || 'redirect',
+            callback_url: requestedCallback && state ? withCallbackState(requestedCallback, state) : undefined,
+        };
+        // The identifiers, by the tenant's own field names. Sent as-is: this SDK
+        // does not know the key and must not guess at it — a field outside the key
+        // is the API's 400 UNKNOWN_IDENTIFIER_FIELD, which can name the allowed
+        // fields, and a guess here could only turn that into silence.
+        if (params.data_principal && Object.keys(params.data_principal).length > 0) {
+            body.data_principal = params.data_principal;
+        }
+        if (params.data_principal_id)
+            body.data_principal_id = params.data_principal_id;
+        if (params.age && params.age.date_of_birth) {
+            body.age = { date_of_birth: params.age.date_of_birth };
+        }
+        // ONE language field. Only sent when a language was actually asked for: it
+        // goes to the FRONT of the server's locale fallback chain, AHEAD of the
+        // tenant's own default, so a hard-coded fallback here would override that
+        // default for every caller who never set one.
+        const language = params.language || this.config.language;
+        if (language)
+            body.language = language;
+        if (params.session_ref)
+            body.session_ref = params.session_ref;
+        if (params.notice_internal_name)
+            body.notice_internal_name = params.notice_internal_name;
+        if (params.notice_version_number !== undefined) {
+            body.notice_version_number = params.notice_version_number;
+        }
+        if (params.customer_token)
+            body.customer_token = params.customer_token;
+        // The guardian channel — top-level, and never inside data_principal, which
+        // holds the identifiers of the person the consent is ABOUT. Either, not
+        // both: one invitation goes to one address.
+        if (params.guardian_email)
+            body.guardian_email = params.guardian_email;
+        if (params.guardian_phone)
+            body.guardian_phone = params.guardian_phone;
+        if (params.guardian_relationship) {
+            body.guardian_relationship = params.guardian_relationship;
+        }
+        const response = await this.request('POST', '/consent/sessions', body, undefined, {
+            // ONE key for this logical session creation, reused across the
+            // transport's own retries so a retried create cannot mint two sessions
+            // for one person.
+            idempotencyKey: options?.idempotencyKey ?? newRequestId(),
+            signal: options?.signal,
+            timeoutMs: options?.timeoutMs,
+        });
+        // THE STORED HALF OF THE CALLBACK HANDSHAKE. CallbackHandler.parseCallback
+        // reads this record back, compares the session id and the STATE this SDK
+        // put on callback_url, and refuses anything that does not match. It is not
+        // the server's challengeNonce: that is the hosted page's credential, it
+        // rides consent_url, and the platform's return never carries it — storing
+        // it here is what made every genuine web redirect come back `unverified`.
+        const persisted = writeStored('session', storageKeys.session(response.consent_session_id), JSON.stringify({
+            session_id: response.consent_session_id,
+            ...(state ? { state } : {}),
+            notice_hash: response.notice_hash,
+            // The person this session is ABOUT. The callback handler compares it
+            // with the artifact's data_principal_id, because the platform's 200
+            // artifact read does not check the session (walk finding F077).
+            data_principal_id: response.data_principal_id,
+            created_at: new Date().toISOString(),
+        }));
+        if (!persisted) {
+            // Storage is blocked; the handshake now lives in memory and will not
+            // survive the redirect. Say so, because the callback will come back
+            // `unverified` and the integrator needs to know why.
+            this.logger.warn('Consentera: browser storage is unavailable, so the callback handshake cannot survive a ' +
+                'page navigation. Use ui_mode "popup", or verify the artifact server-side.');
+        }
+        if (typeof body.callback_url === 'string' && body.callback_url) {
+            this.callbackUrls.set(response.consent_session_id, body.callback_url);
+        }
+        this.logger.info('Consent session created', {
+            session_id: response.consent_session_id,
+        });
+        return response;
+    }
+    /**
+     * Redirect the user to the ConsentEra consent collection widget.
+     * Only works in browser environments.
+     */
+    redirectToConsent(session) {
+        if (typeof window === 'undefined') {
+            throw new Error('redirectToConsent can only be used in browser environments');
+        }
+        window.location.href = session.consent_url;
+    }
+    /**
+     * Open the consent page in a dialog ON THIS PAGE and resolve with the
+     * decision it reports, or `{ outcome: 'dismissed' }` when the person closes
+     * it. Rejects after `timeoutMs` (default 10 minutes).
+     *
+     *   const r = await consent.openConsentPopup(session);
+     *   if (r.outcome === 'decided') confirmOnServer(r.session_id, r.artifact_id);
+     *
+     * It listens for the ONE message /collect posts, `consentera:submitted` /
+     * `consentera:declined`, from the /collect origin and the frame it opened.
+     * See consent/consentPopup.ts for the wire and for why this is a dialog and
+     * not window.open (a top-level /collect posts nothing) (SDK register WEB-035).
+     *
+     * THIS PAGE MUST BE ON THE CALLBACK'S ORIGIN: /collect addresses the message
+     * to the session's callback_url origin. A session created by this SDK is
+     * checked before anything opens (`CALLBACK_ORIGIN_MISMATCH`); pass
+     * `callbackUrl` when your server set a different one. The page must also be
+     * in your integration client's Allowed Domains, or the platform refuses to
+     * be framed (frame-ancestors).
+     *
+     * The result is what the platform page reported, not the consent record:
+     * confirm the artefact before acting on a grant.
+     */
+    openConsentPopup(session, options) {
+        return openConsentDialog(session, {
+            ...options,
+            callbackUrl: options?.callbackUrl ?? this.callbackUrls.get(session.consent_session_id) ?? this.config.callbackUrl,
+        });
+    }
+    /**
+     * Read a consent artifact.
+     *
+     *   const r = await consent.getArtifact(artifactId, { sessionId });
+     *   if (r.state === 'pending') retryIn(r.retryAfterMs);   // 202: recorded, still being written
+     *   else use(r.artifact);                                  // 200
+     *
+     * PASS THE SESSION ID the callback gave you. The platform answers 202 for a
+     * consent whose artifact is still being written only when it can see which
+     * session is asking; without it that consent is a 404, the same answer a
+     * guessed id gets. A 404 WITH a session id means the artifact was never
+     * issued for that session: it throws a ConsenteraNotFoundError.
+     *
+     * A 200 is not proof the artifact belongs to your session — the platform
+     * checks the session only while the artifact is missing (walk finding F077).
+     * Compare `artifact.data_principal_id` with your session's.
+     */
+    async getArtifact(artifactId, options) {
+        return readArtifact(this.request, artifactId, options);
+    }
+}
+/**
+ * A fresh per-attempt callback state: 32 random bytes, hex. From the platform
+ * CSPRNG only — there is no Math.random fallback, because a guessable state is
+ * a forgeable callback. (`newRequestId` may fall back; this must not.)
+ */
+function newCallbackState() {
+    const c = typeof globalThis !== 'undefined' ? globalThis.crypto : undefined;
+    if (!c || typeof c.getRandomValues !== 'function') {
+        throw configError('Consentera: no crypto.getRandomValues here, so no unguessable callback state can be made. ' +
+            'This SDK will not fall back to Math.random for it.', 'NO_SECURE_RANDOM');
+    }
+    return Array.from(c.getRandomValues(new Uint8Array(32)), (b) => b.toString(16).padStart(2, '0')).join('');
+}
+/**
+ * callback_url with this SDK's `state` added to its query.
+ *
+ * WHY IT SURVIVES THE ROUND TRIP — a platform fact, read on pre-main
+ * 35cd853ac7: addRedirectParams appends session_id/artifact_id to callback_url
+ * with `&` when it already has a `?` (redirect_params.go:17), and
+ * setRedirectParam then parses, SETS status / pending / sig and re-encodes —
+ * every other key, `state` included, is kept. The mobile SDKs have bound their
+ * callbacks this way since 2.0.0.
+ *
+ * `state` IS RESERVED. A callback_url that already carries one is refused
+ * rather than overwritten: overwriting would silently break the Data
+ * Fiduciary's own use of it, and keeping theirs would bind nothing.
+ */
+function withCallbackState(callbackUrl, state) {
+    let u;
+    try {
+        u = new URL(callbackUrl);
+    }
+    catch {
+        throw configError(`Consentera: callback_url must be an absolute URL (the platform refuses anything else); got ${JSON.stringify(callbackUrl.slice(0, 80))}`, 'INVALID_CALLBACK_URL');
+    }
+    if (u.searchParams.has('state')) {
+        throw configError('Consentera: callback_url already carries a `state` parameter. This SDK puts its own callback ' +
+            'state there to bind the return to this browser; use a different parameter name for yours.', 'CALLBACK_STATE_RESERVED');
+    }
+    u.searchParams.set('state', state);
+    return u.toString();
+}
+
+/**
+ * ConsentEra Consent SDK — Context Helpers
+ * Build client context and affirmative action payloads
+ */
+/** Strip the query and fragment: the parts that carry the host's own data. */
+function pagePath(href) {
+    try {
+        const u = new URL(href);
+        return `${u.origin}${u.pathname}`;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Build client context from the current browser environment.
+ *
+ * @param sessionId optional consent session to correlate against
+ * @param mode      how much to collect; see {@link ContextMode}. Default `minimal`.
+ */
+function buildClientContext(sessionId, mode = 'minimal') {
+    if (mode === 'none')
+        return undefined;
+    if (typeof window === 'undefined') {
+        return {
+            user_agent: 'Consentera SDK (SSR)',
+            platform: 'web',
+        };
+    }
+    const ua = navigator.userAgent;
+    let browserName = 'Unknown';
+    let browserVersion = '';
+    let osName = 'Unknown';
+    let osVersion = '';
+    let deviceType = 'desktop';
+    // Browser detection
+    if (ua.includes('Chrome') && !ua.includes('Edg')) {
+        browserName = 'Chrome';
+        browserVersion = ua.match(/Chrome\/([\d.]+)/)?.[1] || '';
+    }
+    else if (ua.includes('Safari') && !ua.includes('Chrome')) {
+        browserName = 'Safari';
+        browserVersion = ua.match(/Version\/([\d.]+)/)?.[1] || '';
+    }
+    else if (ua.includes('Firefox')) {
+        browserName = 'Firefox';
+        browserVersion = ua.match(/Firefox\/([\d.]+)/)?.[1] || '';
+    }
+    else if (ua.includes('Edg')) {
+        browserName = 'Edge';
+        browserVersion = ua.match(/Edg\/([\d.]+)/)?.[1] || '';
+    }
+    // OS detection
+    if (ua.includes('Windows')) {
+        osName = 'Windows';
+        osVersion = ua.match(/Windows NT ([\d.]+)/)?.[1] || '';
+    }
+    else if (ua.includes('Mac OS X')) {
+        osName = 'macOS';
+        osVersion = ua.match(/Mac OS X ([\d_.]+)/)?.[1]?.replace(/_/g, '.') || '';
+    }
+    else if (ua.includes('Android')) {
+        osName = 'Android';
+        osVersion = ua.match(/Android ([\d.]+)/)?.[1] || '';
+    }
+    else if (ua.includes('iPhone') || ua.includes('iPad')) {
+        osName = 'iOS';
+        osVersion = ua.match(/OS ([\d_]+)/)?.[1]?.replace(/_/g, '.') || '';
+    }
+    else if (ua.includes('Linux')) {
+        osName = 'Linux';
+    }
+    // Device type
+    if (/Mobi|Android.*Mobile|iPhone/.test(ua)) {
+        deviceType = 'mobile';
+    }
+    else if (/iPad|Android(?!.*Mobile)|Tablet/.test(ua)) {
+        deviceType = 'tablet';
+    }
+    const minimal = {
+        platform: 'web',
+        device_type: deviceType,
+        browser_name: browserName,
+        os_name: osName,
+        session_id: sessionId,
+    };
+    if (mode === 'minimal')
+        return minimal;
+    return {
+        ...minimal,
+        user_agent: ua,
+        screen_resolution: `${window.screen.width}x${window.screen.height}`,
+        timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
+        browser_version: browserVersion,
+        os_version: osVersion,
+        page_url: pagePath(window.location.href),
+        referrer: document.referrer ? pagePath(document.referrer) : undefined,
+    };
+}
+/**
+ * Build an affirmative action payload.
+ */
+function buildAffirmativeAction(uiEventId, type = 'button') {
+    return {
+        type,
+        ui_event_id: uiEventId,
+        captured_at: new Date().toISOString(),
+    };
+}
+/**
+ * Turn a {@link PrincipalRef} into the request-body fields that name the
+ * person. Sends exactly ONE of the two keys, never both and never an empty
+ * object.
+ *
+ * NEVER BOTH, and that is not tidiness: the API refuses a request carrying
+ * `data_principal_ref` even when `data_principal_id` is also present, for the
+ * stated reason that two fields naming a person can disagree and the caller
+ * would never learn which one the answer was about. Sending one key keeps this
+ * SDK on the right side of that rule by construction.
+ */
+function principalBody(who) {
+    if ('data_principal_id' in who && who.data_principal_id) {
+        return { data_principal_id: who.data_principal_id };
+    }
+    const ids = who.data_principal_identifiers;
+    if (!ids || Object.keys(ids).length === 0) {
+        // The identifier FIELDS are the tenant's own locked integration key, which
+        // this SDK cannot know and does not enumerate (F015): a message listing a
+        // fixed five would name fields this organisation may not use and omit ones
+        // it does. The SERVER lists the key's actual fields in its
+        // UNKNOWN_IDENTIFIER_FIELD refusal; here we only say WHERE the fields come
+        // from.
+        throw new Error('Consentera: name the Data Principal with data_principal_id, or with ' +
+            'data_principal_identifiers carrying the identifier fields of this ' +
+            'organisation\'s integration key. data_principal_ref is refused by the API.');
+    }
+    return { data_principal_identifiers: ids };
+}
+
+/**
+ * ConsentEra Consent SDK — Consent Validation
+ * Validate consent status for single or multiple purposes
+ */
+class ConsentValidator {
+    request;
+    logger;
+    constructor(request, logger) {
+        this.request = request;
+        this.logger = logger;
+    }
+    /**
+     * Validate consent for a single purpose.
+     * Returns ALLOW or DENY with reason code.
+     *
+     *   check({ data_principal_identifiers: { email: 'riya@example.in' } },
+     *         'product_analytics')
+     *   check({ data_principal_id: '…' }, 'product_analytics')
+     *
+     * ─── data_principal_ref IS REFUSED OUTRIGHT ────────────────────────────
+     *
+     * Owner ruling 2026-09-21, no transition period
+     * (consent/lifecycle_identity.go:8-11). A request carrying it is answered
+     * 400 VALIDATION_ERROR whose message begins `DATA_PRINCIPAL_REF_REFUSED`,
+     * and the refusal fires even when `data_principal_id` is also present.
+     *
+     * NAME PEOPLE BY THE ORGANISATION'S LOCKED KEY FIELDS (F015): the mobile atom
+     * is `mobile` on this road AND on create — `phone` is refused by name. See
+     * {@link DataPrincipalIdentifiers}.
+     */
+    async check(who, purposeCode, options) {
+        const body = { ...principalBody(who), purpose_code: purposeCode };
+        const response = await this.request('POST', '/consent/validate', body, undefined, { signal: options?.signal, timeoutMs: options?.timeoutMs });
+        // Never log the identifiers themselves — they are raw PII, and this line
+        // used to carry the opaque handle verbatim. Log WHICH way the person was
+        // named, which is what a support question actually needs.
+        this.logger.debug('Consent validated', {
+            namedBy: 'data_principal_id' in who ? 'data_principal_id' : 'data_principal_identifiers',
+            purpose: purposeCode,
+            decision: response.decision,
+        });
+        return response;
+    }
+    /**
+     * Validate consent for multiple purposes at once.
+     * Returns results map indexed by purpose code.
+     *
+     * `data_principal_ref` AND `data_principal_refs` are both refused here
+     * (consent/validate.go:249,257).
+     */
+    async checkBulk(who, purposeCodes, options) {
+        const body = {
+            ...principalBody(who),
+            purpose_codes: purposeCodes,
+        };
+        const response = await this.request('POST', '/consent/validate/bulk', body, undefined, { signal: options?.signal, timeoutMs: options?.timeoutMs });
+        this.logger.debug('Bulk consent validated', {
+            namedBy: 'data_principal_id' in who ? 'data_principal_id' : 'data_principal_identifiers',
+            purposes: purposeCodes.length,
+            results: response.results?.map((r) => `${r.purpose_code}:${r.decision}`),
+        });
+        return response;
+    }
+    /**
+     * Quick boolean check — is this purpose allowed?
+     *
+     *   isAllowed({ data_principal_identifiers: { email: 'riya@example.in' } },
+     *             'product_analytics')
+     */
+    async isAllowed(who, purposeCode, options) {
+        const result = await this.check(who, purposeCode, options);
+        return result.decision === 'ALLOW';
+    }
+    /**
+     * Check multiple purposes and return a map of purpose → boolean.
+     */
+    async areAllowed(who, purposeCodes) {
+        const response = await this.checkBulk(who, purposeCodes);
+        const map = new Map();
+        for (const result of response.results || []) {
+            // purpose_code is omitempty on the wire; a result without one is keyed
+            // by its purpose_id rather than dropped under an `undefined` key.
+            map.set(result.purpose_code ?? result.purpose_id, result.decision === 'ALLOW');
+        }
+        return map;
+    }
+}
+
+/**
+ * ConsentEra Consent SDK — Consent Lifecycle Manager
+ * Update, withdraw, and renew consent decisions
+ */
+class ConsentManager {
+    request;
+    logger;
+    /**
+     * Called after every successful consent mutation with
+     * {dataPrincipalId, changes:[{purpose_id,status}], source}. The client wires this
+     * to its EventEmitter as the public `consent.changed` event — downstream
+     * code (tracker gates, Consent Mode bridges) subscribes instead of polling.
+     */
+    onChanged;
+    contextMode;
+    constructor(request, logger, options) {
+        this.request = request;
+        this.logger = logger;
+        this.contextMode = options?.contextMode ?? 'minimal';
+    }
+    /** The client context for a mutation, at whatever detail the host allowed. */
+    context() {
+        return buildClientContext(undefined, this.contextMode);
+    }
+    /** One key per logical operation, reused by the transport across its retries. */
+    mutation(options) {
+        return {
+            idempotencyKey: options?.idempotencyKey ?? newRequestId(),
+            signal: options?.signal,
+            timeoutMs: options?.timeoutMs,
+        };
+    }
+    emitChanged(dataPrincipalId, changes, source) {
+        try {
+            this.onChanged?.({ dataPrincipalId, changes, source });
+        }
+        catch (e) {
+            this.logger.warn('consent.changed listener threw', { error: String(e) });
+        }
+    }
+    // =========================================================================
+    // Consent Update
+    // =========================================================================
+    /**
+     * Get the current consent context for a data principal.
+     * Returns all consents with their current status.
+     *
+     * ─── THIS ROAD TAKES THE ID AND NOTHING ELSE ──────────────────────────
+     *
+     * It is a GET, so the only place an identifier could go is the query string,
+     * and the platform refuses to put one there: a query string is written
+     * VERBATIM into the access log of every hop that sees the request line, kept
+     * in browser history, and sent onward in the Referer header
+     * (consent/lifecycle_identity.go:120-133). So this road was RESTRICTED to
+     * `data_principal_id`, not converted to identifiers the way the POST roads
+     * were — `?data_principal_ref=` is refused `DATA_PRINCIPAL_REF_REFUSED`
+     * even when `data_principal_id` is also present.
+     *
+     * IF YOU HOLD AN IDENTIFIER AND NOT THE ID: resolve it once with
+     * `validate.check({ data_principal_identifiers: … }, purpose)` and read
+     * `data_principal_id` off that response, then call this with the id.
+     *
+     * The parameter used to be `dataPrincipalIdOrRef` and guessed by UUID shape:
+     * anything not UUID-shaped went out as `data_principal_ref`, which this road
+     * now refuses. The guess is gone — a non-UUID is rejected here, by name.
+     */
+    async getUpdateContext(dataPrincipalId, queryParams) {
+        if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(dataPrincipalId)) {
+            throw new Error('Consentera: getUpdateContext takes a data_principal_id (a uuid), not an identifier. ' +
+                'This road deliberately accepts no identifiers — a query string is written verbatim ' +
+                'into access logs, browser history and Referer headers. Resolve the id once with ' +
+                'validate.check({ data_principal_identifiers: … }, purpose) and pass the ' +
+                'data_principal_id from its response.');
+        }
+        const params = { data_principal_id: dataPrincipalId };
+        if (queryParams?.language_code)
+            params.language_code = queryParams.language_code;
+        return this.request('GET', '/consent/update/context', undefined, params);
+    }
+    /**
+     * Update consent decisions for a data principal.
+     * Pass an array of purpose updates (grant or deny).
+     */
+    async update(dataPrincipalId, updates, context, uiEventId = 'btn_save_preferences', options) {
+        const body = {
+            data_principal_id: dataPrincipalId,
+            notice_version_id: context.noticeVersionId,
+            notice_hash: context.noticeHash,
+            language_code: context.languageCode || 'en',
+            updates,
+            affirmative_action: buildAffirmativeAction(uiEventId),
+            client_context: this.context(),
+        };
+        await this.request('POST', '/consent/update', body, undefined, this.mutation(options));
+        this.logger.info('Consent updated', {
+            dataPrincipal: dataPrincipalId,
+            updates: updates.map((u) => `${u.purpose_id}:${u.new_status}`),
+        });
+        this.emitChanged(dataPrincipalId, updates.map((u) => ({ purpose_id: u.purpose_id, status: u.new_status })), 'update');
+    }
+    /**
+     * Convenience: Grant specific purposes.
+     */
+    async grant(dataPrincipalId, purposeIds, context, uiEventId = 'btn_grant_consent', options) {
+        const updates = purposeIds.map((id) => ({
+            purpose_id: id,
+            new_status: 'granted',
+        }));
+        return this.update(dataPrincipalId, updates, context, uiEventId, options);
+    }
+    /**
+     * Convenience: Deny specific purposes.
+     */
+    async deny(dataPrincipalId, purposeIds, context, uiEventId = 'btn_deny_consent', options) {
+        const updates = purposeIds.map((id) => ({
+            purpose_id: id,
+            new_status: 'denied',
+        }));
+        return this.update(dataPrincipalId, updates, context, uiEventId, options);
+    }
+    // =========================================================================
+    // Consent Withdrawal
+    // =========================================================================
+    /**
+     * Get the withdrawal context — which consents can be withdrawn.
+     */
+    async getWithdrawalContext(dataPrincipalId) {
+        return this.request('GET', '/consent/withdrawal/context', undefined, { data_principal_id: dataPrincipalId });
+    }
+    /**
+     * Withdraw consent for specific purposes.
+     */
+    async withdraw(dataPrincipalId, purposeIds, reason, uiEventId = 'btn_withdraw_consent', options) {
+        const body = {
+            data_principal_id: dataPrincipalId,
+            purposes: purposeIds,
+            reason,
+            affirmative_action: buildAffirmativeAction(uiEventId),
+            client_context: this.context(),
+        };
+        await this.request('POST', '/consent/withdraw', body, undefined, this.mutation(options));
+        this.logger.info('Consent withdrawn', {
+            dataPrincipal: dataPrincipalId,
+            purposes: purposeIds,
+        });
+        this.emitChanged(dataPrincipalId, purposeIds.map((p) => ({ purpose_id: p, status: 'withdrawn' })), 'withdraw');
+    }
+    /**
+     * Bulk withdraw consent for multiple purposes.
+     */
+    async withdrawBulk(dataPrincipalId, purposeIds, reason, uiEventId = 'btn_withdraw_all', options) {
+        const body = {
+            data_principal_id: dataPrincipalId,
+            purposes: purposeIds,
+            reason,
+            affirmative_action: buildAffirmativeAction(uiEventId),
+            client_context: this.context(),
+        };
+        await this.request('POST', '/consent/withdraw/bulk', body, undefined, this.mutation(options));
+        this.logger.info('Bulk consent withdrawn', {
+            dataPrincipal: dataPrincipalId,
+            purposes: purposeIds.length,
+        });
+        this.emitChanged(dataPrincipalId, purposeIds.map((p) => ({ purpose_id: p, status: 'withdrawn' })), 'withdraw_bulk');
+    }
+    /**
+     * Get withdrawal analytics (reasons, trends).
+     */
+    async getWithdrawalAnalytics() {
+        return this.request('GET', '/consent/withdrawal/analytics');
+    }
+    // =========================================================================
+    // Consent Renewal
+    // =========================================================================
+    /**
+     * Get the renewal context — which consents are expiring and need renewal.
+     */
+    async getRenewalContext(dataPrincipalId) {
+        return this.request('GET', '/consent/renewal/context', undefined, { data_principal_id: dataPrincipalId });
+    }
+    /**
+     * Renew consent for specific purposes.
+     */
+    async renew(dataPrincipalId, purposeIds, noticeHash, uiEventId = 'btn_renew_consent', options) {
+        const body = {
+            data_principal_id: dataPrincipalId,
+            purpose_ids: purposeIds,
+            notice_hash: noticeHash,
+            captured_at: buildAffirmativeAction(uiEventId).captured_at,
+            client_context: this.context(),
+        };
+        const response = await this.request('POST', '/consent/renew', body, undefined, { ...this.mutation(options), raw: true });
+        this.logger.info('Consent renewed', {
+            dataPrincipal: dataPrincipalId,
+            purposes: purposeIds,
+        });
+        this.emitChanged(dataPrincipalId, response.body.renewed_consents.map((p) => ({ purpose_id: p.purpose_id, status: 'granted' })), 'renew');
+        return response;
+    }
+    /**
+     * Bulk renew all expiring consents.
+     */
+    async renewBulk(dataPrincipalId, purposeIds, noticeHash, uiEventId = 'btn_renew_all', options) {
+        const body = {
+            data_principal_id: dataPrincipalId,
+            renewals: purposeIds.map(purpose_id => ({ purpose_id })),
+            notice_hash: noticeHash,
+            captured_at: buildAffirmativeAction(uiEventId).captured_at,
+            client_context: this.context(),
+        };
+        const response = await this.request('POST', '/consent/renew/bulk', body, undefined, { ...this.mutation(options), raw: true });
+        this.logger.info('Bulk consent renewed', {
+            dataPrincipal: dataPrincipalId,
+            purposes: response.body.success_count,
+        });
+        if (response.body.renewed_consents.length > 0) {
+            this.emitChanged(dataPrincipalId, response.body.renewed_consents.map((p) => ({
+                purpose_id: p.purpose_id, status: 'granted',
+            })), 'renew');
+        }
+        return response;
+    }
+}
+
+/**
+ * Consentera Consent SDK — Callback Handler
+ *
+ * ─── THIS ROAD FAILS CLOSED, AND BEFORE 2.0.0 IT DID NOT ───────────────────
+ *
+ * The 1.x handler read `session_id`, `artifact_id` and `status` out of
+ * `window.location.search`, looked up the stored session, logged
+ * "Callback verified against stored session" — and then verified NOTHING. It
+ * never parsed the record it had stored, never compared the nonce, never
+ * compared the notice hash, and returned `status: 'completed'` for any URL
+ * carrying an `artifact_id` (the `normalizeStatus` default). A link to
+ *
+ *     https://your-site.example/consent/done?session_id=x&artifact_id=y
+ *
+ * made `consent.handleCallback()` answer "completed" with no consent given.
+ * The log line said "verified" the whole time, which is why it survived review.
+ *
+ * What replaces it:
+ *
+ *   1. The stored record is PARSED. Its session id must equal the one in the
+ *      URL, and the `state` THIS SDK minted and put on callback_url at create
+ *      must come back on the return. A mismatch, an absence, or an
+ *      unparseable record is `unverified`.
+ *
+ *      IT IS THE SDK'S OWN STATE, NOT THE SERVER'S challengeNonce. Until the
+ *      callback-contract fix this compared the create response's
+ *      `challengeNonce` with a `nonce` on the return — and the platform's
+ *      return never carries one (collection.go:4225-4288 adds session_id,
+ *      artifact_id, status, pending and, when signed, sig). challengeNonce is
+ *      the hosted page's own credential: it rides consent_url
+ *      (`/collect/<id>?nonce=…`, :2010) and comes back on the page's submit
+ *      (:3509-3543). So every genuine web redirect came back `unverified`.
+ *      The state survives because the platform builds the return ON TOP of
+ *      callback_url's existing query — the mobile SDKs' binding, the same way.
+ *   2. `completed` is only ever reached by CONFIRMING THE ARTIFACT with the
+ *      platform — `GET /consent/artifacts/{id}` through the same road the rest
+ *      of the SDK uses, which in a browser is the Data Fiduciary's proxy. The
+ *      URL is a claim; the artifact is the evidence.
+ *   3. Everything else is `unverified`. There is no path from a query string to
+ *      `completed`.
+ *
+ * `parseCallback` is therefore ASYNC now. The synchronous
+ * {@link CallbackHandler.readCallbackParams} is kept for a caller that only
+ * wants to know what the URL says — it is named so that using it as a decision
+ * is visibly the wrong thing.
+ */
+const PLATFORM_CALLBACK_STATUSES = new Set(['granted', 'partial', 'denied']);
+/** Map the raw `status` query value onto the platform's vocabulary. Exact match: the server writes lowercase. */
+function claimedCallbackStatus(raw) {
+    return raw && PLATFORM_CALLBACK_STATUSES.has(raw) ? raw : 'unknown';
+}
+/**
+ * Compute and compare the platform's callback signature. SERVER-SIDE ONLY —
+ * the secret must never reach a browser.
+ *
+ * The canonical string is `session_id + "|" + artifact_id + "|" + status`, in
+ * that order, with the raw values as they appear on the URL.
+ */
+async function verifyCallbackSignature(secret, params) {
+    if (!secret || !params.sig)
+        return false;
+    const subtle = subtleCrypto();
+    if (!subtle) {
+        // THROWING, NOT RETURNING FALSE. A false here is indistinguishable from
+        // "the signature is wrong", which would make every callback look forged on
+        // a runtime that simply has no SubtleCrypto — a wrong answer that reads
+        // like a security finding. The handler turns this into `unverifiable`.
+        throw configError('Consentera: no SubtleCrypto available, so the callback signature cannot be verified here. ' +
+            'Verify it on a runtime that has WebCrypto (Node 20+, any modern browser) — but note the ' +
+            'signing key is your callback_signing_secret and must not be in a browser.', 'NO_SUBTLE_CRYPTO');
+    }
+    const enc = new TextEncoder();
+    const key = await subtle.importKey('raw', enc.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const canonical = `${params.sessionId}|${params.artifactId}|${params.status}`;
+    const mac = await subtle.sign('HMAC', key, enc.encode(canonical));
+    const expected = Array.from(new Uint8Array(mac), (b) => b.toString(16).padStart(2, '0')).join('');
+    return timingSafeEqual(expected, params.sig.toLowerCase());
+}
+class CallbackHandler {
+    logger;
+    request;
+    options;
+    constructor(logger, request, options = {}) {
+        this.logger = logger;
+        this.request = request;
+        this.options = options;
+    }
+    /**
+     * Read the callback URL's claims. THIS IS NOT A DECISION — the values come
+     * from the address bar and anyone can type them. Use {@link parseCallback}.
+     */
+    readCallbackParams(searchParams) {
+        let params;
+        if (!searchParams) {
+            if (typeof window === 'undefined') {
+                throw new Error('readCallbackParams requires searchParams in non-browser environments');
+            }
+            params = new URLSearchParams(window.location.search);
+        }
+        else if (typeof searchParams === 'string') {
+            params = new URLSearchParams(searchParams);
+        }
+        else {
+            params = searchParams;
+        }
+        return {
+            session_id: params.get('session_id') || params.get('consent_session_id') || '',
+            artifact_id: params.get('artifact_id') || params.get('consent_artifact_id') || undefined,
+            raw_status: params.get('status') || '',
+            claimed_status: claimedCallbackStatus(params.get('status')),
+            pending: params.get('pending') === '1',
+            state: params.get('state') || undefined,
+            // The platform's HMAC over session|artifact|status; present only when the
+            // DF registered a callback_signing_secret (collection.go:4280-4288).
+            sig: params.get('sig') || undefined,
+            error: params.get('error') || undefined,
+        };
+    }
+    /**
+     * Verify a consent callback. Resolves `completed` ONLY when the stored
+     * session matches and the artifact was confirmed with the platform.
+     */
+    async parseCallback(searchParams) {
+        const claim = this.readCallbackParams(searchParams);
+        const base = {
+            session_id: claim.session_id,
+            artifact_id: claim.artifact_id,
+            claimed_status: claim.claimed_status,
+            claimed_pending: claim.pending,
+            status: 'unverified',
+        };
+        if (claim.error) {
+            return this.finish({ ...base, status: 'error', error: claim.error, reason: 'the platform returned an error' });
+        }
+        if (!claim.session_id) {
+            return this.finish({ ...base, status: 'unverified', reason: 'the callback names no session' });
+        }
+        // 1. The stored side of the handshake.
+        const raw = readStored('session', storageKeys.session(claim.session_id));
+        if (!raw) {
+            return this.finish({
+                ...base,
+                reason: 'no session was stored in this browser for that id — the session was created elsewhere, ' +
+                    'the tab was replaced, or the callback was not produced by this flow',
+            });
+        }
+        let stored;
+        try {
+            stored = JSON.parse(raw);
+        }
+        catch {
+            removeStored('session', storageKeys.session(claim.session_id));
+            return this.finish({ ...base, reason: 'the stored session record could not be parsed' });
+        }
+        removeStored('session', storageKeys.session(claim.session_id));
+        if (stored.session_id && stored.session_id !== claim.session_id) {
+            return this.finish({ ...base, reason: 'the stored session id does not match the callback' });
+        }
+        // The state is the anti-forgery binding: this SDK minted it at create, put
+        // it on callback_url, and only a real return trip to THIS browser carries
+        // it back. It is REQUIRED — a record without one cannot bind anything.
+        if (!stored.state) {
+            return this.finish({
+                ...base,
+                reason: 'the stored session has no callback state: it was created without a callback_url, or by an ' +
+                    'SDK version that bound the callback to the server challengeNonce (which the platform never ' +
+                    'returns). Read the consent back through your backend instead.',
+            });
+        }
+        if (!claim.state) {
+            return this.finish({ ...base, reason: 'the callback carries no state, and the session was created with one' });
+        }
+        if (!timingSafeEqual(stored.state, claim.state)) {
+            return this.finish({ ...base, reason: 'the callback state does not match the stored session' });
+        }
+        // 2. THE PLATFORM'S SIGNATURE, when it sent one.
+        //
+        // A `sig` on the URL means the DF registered a callback_signing_secret and
+        // the platform signed status + artifact with it. Ignoring it would make the
+        // signature decorative, so a sig that cannot be checked is `unverified` —
+        // the SDK does not fall back to "well, the state matched".
+        let signature = 'absent';
+        if (claim.sig) {
+            if (!this.options.verifySignature) {
+                return this.finish({
+                    ...base,
+                    signature: 'unverifiable',
+                    reason: 'the callback is signed and no verifier is configured. The signing key is your ' +
+                        'callback_signing_secret, which must not be in a browser: set ' +
+                        '`verifyCallbackSignature` to call your own server, which uses ' +
+                        'verifyCallbackSignature(secret, …) from this package.',
+                });
+            }
+            let ok = false;
+            try {
+                ok = await this.options.verifySignature({
+                    sessionId: claim.session_id,
+                    artifactId: claim.artifact_id ?? '',
+                    status: claim.raw_status,
+                    sig: claim.sig,
+                });
+            }
+            catch (err) {
+                return this.finish({
+                    ...base,
+                    signature: 'unverifiable',
+                    reason: `the signature verifier threw: ${String(err)}`,
+                });
+            }
+            if (!ok) {
+                return this.finish({ ...base, signature: 'invalid', reason: 'the callback signature did not verify' });
+            }
+            signature = 'verified';
+        }
+        // 3. The platform's vocabulary, exactly: granted | partial | denied
+        //    (collection.go:4094-4098). A denial is a real, verified outcome — no
+        //    artifact exists to confirm, and the state above proved the round trip.
+        //    Anything else did not come from the platform and goes nowhere near the
+        //    success road: before this, `completed`, `success`, a missing status or
+        //    any other value fell through to the artifact read and could come back
+        //    `completed`, while `expired`/`rejected`/`timeout` — which the platform
+        //    never sends — had branches of their own.
+        if (claim.claimed_status === 'denied') {
+            return this.finish({ ...base, status: 'denied', signature });
+        }
+        if (claim.claimed_status === 'unknown') {
+            return this.finish({
+                ...base,
+                signature,
+                reason: `the callback status ${JSON.stringify(claim.raw_status)} is not a status the platform issues ` +
+                    '(granted | partial | denied). Read the consent back through your backend.',
+            });
+        }
+        // 4. granted | partial: `completed` requires the artifact, from the
+        //    platform, not the URL. pending=1 (always set on the capture road)
+        //    means the first read may be a 202; confirmArtifact waits for it.
+        if (!claim.artifact_id) {
+            return this.finish({ ...base, signature, reason: 'the callback claims success but names no artifact' });
+        }
+        if (!this.request) {
+            return this.finish({
+                ...base,
+                signature,
+                reason: 'no transport available to confirm the artifact. Construct the handler through ' +
+                    'ConsentEraClient so it can call GET /consent/artifacts/{id}.',
+            });
+        }
+        return this.confirmArtifact(base, claim.artifact_id, claim.session_id, stored.data_principal_id, signature);
+    }
+    /**
+     * Read the artifact back FOR THIS SESSION, waiting while the platform says
+     * it is still being written.
+     *
+     * THE READ CARRIES ?session_id=, AND THAT DECIDES WHAT A 404 MEANS (WEB-033).
+     * With it the platform answers 202 + Retry-After while the projection is
+     * owed and 404 only when the id was never issued for this session (or will
+     * never be written). Until WEB-033 the read went out without it, so every
+     * absence was a 404, and this method polled every 404 as "maybe pending" — a
+     * forged artifact_id came back `pending` instead of refused.
+     *
+     *   200  the artifact. Then it must name the person this browser's session
+     *        was created for (below). Then `completed`.
+     *   202  recorded, not readable yet: wait Retry-After inside the budget, else
+     *        `pending`.
+     *   404  `unverified`, at once. Not polled: it is an answer, not a delay.
+     *   else `unverified` (403, network, timeout — unproven is unproven).
+     *
+     * THE BINDING IS THE PERSON, NOT A RESPONSE FIELD (WEB-034). This method used
+     * to compare `consent_session_id` on the artifact with the callback's
+     * session. The platform's artifact carries no such field (measured on
+     * setup.consentera.in, fixtures/platform-wire/artifact-read.200.*.json), so
+     * the check was skipped on every real response and bound nothing. What the
+     * artifact does carry is `data_principal_id`, and the session create
+     * returned the same field for the person the session is about. They must be
+     * equal. This matters because the platform's 200 path does not check the
+     * session (walk finding F077, measured: the same artifact read with a random
+     * session_id is still 200), so without it a callback carrying someone
+     * else's artifact_id would confirm.
+     */
+    async confirmArtifact(base, artifactId, sessionId, expectedPrincipal, signature) {
+        const budgetMs = this.options.artifactWaitMs ?? 15_000;
+        const deadline = Date.now() + budgetMs;
+        for (;;) {
+            let read;
+            try {
+                read = await readArtifact(this.request, artifactId, { sessionId });
+            }
+            catch (err) {
+                const detail = err instanceof ConsenteraError ? err.toString() : String(err);
+                if (err instanceof ConsenteraError && (err.status === 404 || err.kind === 'not_found')) {
+                    return this.finish({
+                        ...base,
+                        signature,
+                        reason: `the platform has no artifact ${artifactId} for session ${sessionId}: it was never ` +
+                            'issued for this session, or will never be written. A forged or mismatched ' +
+                            `artifact_id reads exactly like this. (${detail})`,
+                    });
+                }
+                // A 403, a network failure, anything else: unproven, so unverified.
+                return this.finish({ ...base, signature, reason: `the artifact could not be confirmed: ${detail}` });
+            }
+            if (read.state === 'recorded') {
+                const artifact = read.artifact;
+                if (artifact.artifact_id && artifact.artifact_id !== artifactId) {
+                    return this.finish({ ...base, signature, reason: 'the platform returned a different artifact than the one read' });
+                }
+                if (!expectedPrincipal) {
+                    return this.finish({
+                        ...base,
+                        signature,
+                        reason: 'the stored session names no data_principal_id, so the artifact cannot be tied to ' +
+                            'the person this session was created for. Create the session with this SDK version, ' +
+                            'or confirm the artifact server-side.',
+                    });
+                }
+                if (artifact.data_principal_id !== expectedPrincipal) {
+                    return this.finish({
+                        ...base,
+                        signature,
+                        reason: "the artifact names a different Data Principal from this browser's session — it is " +
+                            'not this consent',
+                    });
+                }
+                return this.finish({ ...base, status: 'completed', artifact, signature });
+            }
+            // 202: recorded, still being written.
+            const remaining = deadline - Date.now();
+            if (remaining <= 0 || read.retryAfterMs > remaining) {
+                return this.finish({
+                    ...base,
+                    status: 'pending',
+                    signature,
+                    retryAfterMs: read.retryAfterMs,
+                    reason: `the platform says the consent was recorded and its artifact is still being written ` +
+                        `(${read.pending.reason || 'pending'}); read it again in ${read.retryAfterMs}ms. ` +
+                        'This is NOT a failure and NOT a consent that did not happen.',
+                });
+            }
+            await new Promise((r) => setTimeout(r, read.retryAfterMs));
+        }
+    }
+    /** Is this page a consent callback? Says nothing about whether it is genuine. */
+    isCallback(searchParams) {
+        const params = new URLSearchParams(searchParams || (typeof window !== 'undefined' ? window.location.search : ''));
+        return params.has('session_id') || params.has('consent_session_id');
+    }
+    /** Record the outcome for the popup flow to collect, and log it. */
+    finish(result) {
+        if (result.session_id) {
+            writeStored('session', storageKeys.callback(result.session_id), JSON.stringify(result));
+        }
+        if (result.status === 'completed') {
+            this.logger.info('Consent callback verified', { session_id: result.session_id, status: result.status });
+        }
+        else if (result.status === 'pending') {
+            this.logger.info('Consent callback verified; artifact not readable yet', {
+                session_id: result.session_id,
+                status: result.status,
+            });
+        }
+        else {
+            this.logger.warn('Consent callback NOT verified', {
+                session_id: result.session_id,
+                status: result.status,
+                reason: result.reason,
+            });
+        }
+        return result;
+    }
+}
+/**
+ * SubtleCrypto, wherever this is running. `globalThis.crypto.subtle` is the
+ * standard spelling and is present in browsers and in Node 20+; jsdom, which is
+ * where this package's tests run, exposes `crypto` WITHOUT `subtle`, so the
+ * node:crypto webcrypto instance is the fallback. This function is server-side
+ * by design, so reaching for node here is not a layering break.
+ */
+function subtleCrypto() {
+    const fromGlobal = globalThis.crypto?.subtle;
+    if (fromGlobal)
+        return fromGlobal;
+    try {
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const nodeCrypto = require('node:crypto');
+        return nodeCrypto?.webcrypto?.subtle;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Constant-time string compare, so a state cannot be guessed byte by byte. */
+function timingSafeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return diff === 0;
+}
+
+/**
+ * ConsentEra Consent SDK — DF Configuration Client
+ * Fetch Data Fiduciary configuration, purposes, and notice details
+ */
+class DFConfigClient {
+    request;
+    logger;
+    cachedConfig = null;
+    constructor(request, logger) {
+        this.request = request;
+        this.logger = logger;
+    }
+    /**
+     * Get the full DF configuration (tenant info, purposes, notices, branding).
+     * Results are cached for the lifetime of the client instance.
+     */
+    async getConfig(language) {
+        if (this.cachedConfig)
+            return this.cachedConfig;
+        const params = {};
+        if (language)
+            params.language_code = language;
+        const config = await this.request('GET', '/df/config', undefined, params, 
+        // The DF read roads are openable by a public site key (route membership,
+        // not the four legacy permission names — see README). Marking the road
+        // 'public' is what stops the transport demanding a secret / proxy for a
+        // browser call that legitimately carries only the site key.
+        { road: 'public' });
+        this.cachedConfig = config;
+        this.logger.info('DF config loaded', {
+            tenant: config.tenant_name,
+            purposes: config.purposes?.length,
+        });
+        return config;
+    }
+    /**
+     * Get all purposes configured for this DF.
+     */
+    async getPurposes() {
+        const response = await this.request('GET', '/df/purposes', undefined, undefined, { road: 'public' });
+        return Array.isArray(response) ? response : response.purposes || [];
+    }
+    /**
+     * Get purposes associated with a specific notice.
+     * This returns the ordered list of purposes as they appear in the notice.
+     */
+    async getNoticePurposes(noticeInternalName, language) {
+        const params = {};
+        if (noticeInternalName)
+            params.notice_internal_name = noticeInternalName;
+        if (language)
+            params.language_code = language;
+        return this.request('GET', '/df/notice/purposes', undefined, params, { road: 'public' });
+    }
+    /**
+     * Get the pre-rendered HTML+CSS snapshot for a notice, including purpose snapshot.
+     * Use this instead of getConfig() for bootstrapping notice-based consent UIs.
+     *
+     * @param noticeName - internal_name of the notice (required)
+     * @param noticeLanguage - language of the notice content (default: tenant primary language)
+     * @param templateLanguage - language for widget UI labels (optional)
+     */
+    async getNoticeTemplate(noticeName, noticeLanguage, templateLanguage) {
+        const params = { notice: noticeName };
+        if (noticeLanguage)
+            params.notice_language = noticeLanguage;
+        if (templateLanguage)
+            params.template_language = templateLanguage;
+        const response = await this.request('GET', '/df/notice/template', undefined, params, { road: 'public' });
+        this.logger.info('Notice template loaded', { notice: noticeName, language: noticeLanguage });
+        // The endpoint wraps in { data: ... }
+        return response.data ?? response;
+    }
+    /**
+     * Get the widget template for a consent SESSION's collection UI.
+     *
+     * THE ROUTE CHANGED IN 2.0.0, because the old one did not exist. This called
+     * GET /df/widget-template, which is a 404 — there is no such platform route.
+     * The real widget template is session-scoped: GET
+     * /consent/sessions/{id}/widget-template (routes_consent.go:125), which sits
+     * in the pre-auth throttle group and takes NO DF credential — the session id
+     * and its nonce are the capability. So this needs a session id, and rides the
+     * `session` road (no key, no proxy required).
+     *
+     * For the notice-authoring template keyed by internal_name, use
+     * {@link getNoticeTemplate}, which is the site-key-openable /df/notice/template.
+     *
+     * @param sessionId the consent_session_id from createSession()
+     */
+    async getSessionWidgetTemplate(sessionId) {
+        return this.request('GET', `/consent/sessions/${encodeURIComponent(sessionId)}/widget-template`, undefined, undefined, { road: 'session' });
+    }
+    /**
+     * Clear the cached config (useful after config changes).
+     */
+    clearCache() {
+        this.cachedConfig = null;
+    }
+}
+
+/**
+ * ConsentEra Consent SDK — Principal Client
+ * Data principal rights: Portal SSO, data export, deletion requests
+ */
+class PrincipalClient {
+    request;
+    logger;
+    // `config` is accepted and ignored: the portal road takes nothing from it,
+    // and the argument stays so the client's construction call reads the same as
+    // every other sub-client's.
+    constructor(request, _config, logger) {
+        this.request = request;
+        this.logger = logger;
+    }
+    /**
+     * Generate a principal portal SSO token.
+     * Returns a URL the data principal can visit to manage their consents.
+     *
+     * THIS ROAD STILL TAKES data_principal_ref, AND THAT IS CORRECT. It is
+     * identity/dfclient's (handlers.go:1418-1428), not the consent module's, so
+     * the 2026-09-21 ruling that refuses the field across the consent surface
+     * does not reach it. A sweep that converted this call would break a working
+     * endpoint.
+     */
+    async getPortalToken(dataPrincipalRef, redirectPath) {
+        const body = {
+            data_principal_ref: dataPrincipalRef,
+            redirect_path: redirectPath,
+        };
+        const response = await this.request('POST', '/df/principal-token', body);
+        this.logger.info('Principal portal token generated', {
+            dataPrincipal: dataPrincipalRef,
+            expires_in: response.expires_in,
+        });
+        return response;
+    }
+    /**
+     * Get the full portal URL for a data principal.
+     * Convenience method that returns just the redirect URL string.
+     */
+    async getPortalUrl(dataPrincipalRef, redirectPath) {
+        const token = await this.getPortalToken(dataPrincipalRef, redirectPath);
+        return token.redirect_url;
+    }
+    /**
+     * Open the principal portal in a new browser window/tab.
+     */
+    async openPortal(dataPrincipalRef, redirectPath) {
+        if (typeof window === 'undefined') {
+            throw new Error('openPortal can only be used in browser environments');
+        }
+        const url = await this.getPortalUrl(dataPrincipalRef, redirectPath);
+        window.open(url, '_blank', 'noopener,noreferrer');
+        this.logger.info('Principal portal opened', { dataPrincipal: dataPrincipalRef });
+    }
+}
+
+/**
+ * Consentera Consent SDK — the client.
+ *
+ * ─── THE CREDENTIAL RULE, AND IT IS ENFORCED HERE AT CONSTRUCTION ──────────
+ *
+ * A BROWSER BUNDLE NEVER CARRIES A SECRET (owner ruling 2026-09-22). Before
+ * 2.0.0 this file said the opposite in a comment — "Prefer site key (public,
+ * safe for frontend) over API key (secret, server-side only)" — and then sent
+ * whichever of the two it was given, from wherever it was running. Both halves
+ * of that sentence were wrong in a way that only showed up in production:
+ *
+ *   the site key does not work.  The platform replaces a site key's permissions
+ *   with exactly {consent.render, widget.render, session.submit, session.render}
+ *   (core/auth/df/api_usage.go:105-110, :1115) and NO ROUTE REQUIRES ANY OF THEM
+ *   — a grep for RequireDFPermission of those four names over the whole API
+ *   returns nothing. Every consent lifecycle road requires
+ *   engagement.consent.{collect,read,validate,update,withdraw,renew}
+ *   (cmd/api/routes_consent.go:377-569). The intersection is empty, so a browser
+ *   configured the recommended way got 403 on every call.
+ *
+ *   the secret key does work — which is worse. It is the only credential that
+ *   authorises those roads, so "make it work" meant putting a tiq_live_ key in
+ *   a public bundle.
+ *
+ * So the rule is now structural rather than advisory:
+ *
+ *   in a browser  a Data Fiduciary road MUST go through `proxyEndpoint` — your
+ *                 own server route, which holds the secret and forwards. An
+ *                 `apiKey` in a browser is REFUSED AT CONSTRUCTION.
+ *   on a server   `apiKey` directly, as always.
+ *   public roads  may carry `siteKey`; they carry no secret.
+ *   session roads carry no key at all: the session id and its nonce are the
+ *                 capability.
+ *
+ * WHAT THE PLATFORM MUST STILL DO for the public half to be usable from a
+ * browser without a proxy is a separate unit and is written down in
+ * README.md → "What the platform must guarantee".
+ */
+class ConsentEraClient extends EventEmitter {
+    config;
+    logger;
+    transport;
+    /** Consent session creation and artifact retrieval */
+    session;
+    /** Consent validation (single + bulk) */
+    validate;
+    /** Consent update, withdrawal, and renewal */
+    manage;
+    /** Callback handler for redirect flows */
+    callback;
+    /** DF configuration and notice purposes */
+    df;
+    /** Data principal rights and portal SSO */
+    principal;
+    /**
+     * Unified consent namespace — aggregates session, validate, manage, callback.
+     */
+    consent;
+    constructor(config) {
+        super();
+        if (!config.apiEndpoint && !config.proxyEndpoint) {
+            throw configError('Consentera: set `proxyEndpoint` (your own server route — required in a browser for ' +
+                'consent lifecycle roads) or `apiEndpoint` (server-side use).', 'ENDPOINT_REQUIRED');
+        }
+        // A tenant id is needed only where THIS SDK names the tenant: direct mode,
+        // which sends X-Tenant-Id. Behind `proxyEndpoint` your server holds the key
+        // and the key names the tenant, so the SDK sends no tenant header, and
+        // demanding the value anyway made every integrator invent one (WEB-036).
+        if (!config.tenantId && !config.proxyEndpoint) {
+            throw configError('Consentera: tenantId is required with `apiEndpoint`. (Behind `proxyEndpoint` it is optional: ' +
+                'your server supplies the tenant.)', 'TENANT_ID_REQUIRED');
+        }
+        // THE ONE REFUSAL — the shared guard, so this client and the ConsenteraConsent
+        // cookie SDK enforce the identical rule at their two doors.
+        assertNoSecretKeyInBrowser({
+            apiKey: config.apiKey,
+            unsafeAllowSecretKeyInBrowser: config.unsafeAllowSecretKeyInBrowser,
+            fix: 'Move the key to your own server and point the SDK at it with ' +
+                '`proxyEndpoint: "/api/consentera"`; the browser then sends no credential at all.',
+        });
+        this.config = config;
+        this.logger = new Logger(config.debug ? 'debug' : 'info');
+        this.transport = new HttpTransport({
+            tenantId: config.tenantId,
+            apiEndpoint: config.apiEndpoint,
+            proxyEndpoint: config.proxyEndpoint,
+            apiKey: config.apiKey,
+            siteKey: config.siteKey,
+            customHeaders: config.customHeaders,
+            unsafeAllowSecretKeyInBrowser: config.unsafeAllowSecretKeyInBrowser,
+            timeoutMs: config.timeoutMs,
+            retry: config.retry,
+            beforeSend: config.beforeSend,
+            fetchImpl: config.fetchImpl,
+        }, this.logger);
+        const requestFn = this.request.bind(this);
+        this.session = new ConsentSession(requestFn, config, this.logger);
+        this.validate = new ConsentValidator(requestFn, this.logger);
+        this.manage = new ConsentManager(requestFn, this.logger, {
+            contextMode: config.collectContext ?? 'minimal',
+        });
+        // Public event bus: every successful consent mutation (update/grant/deny/
+        // withdraw/renew) re-emits as `consent.changed` — subscribe with
+        // client.on('consent.changed', cb) instead of polling validate.
+        this.manage.onChanged = (payload) => this.emit('consent.changed', payload);
+        this.callback = new CallbackHandler(this.logger, requestFn, {
+            verifySignature: config.verifyCallbackSignature,
+            artifactWaitMs: config.artifactWaitMs,
+        });
+        this.df = new DFConfigClient(requestFn, this.logger);
+        this.principal = new PrincipalClient(requestFn, config, this.logger);
+        this.consent = {
+            createSession: this.session.createSession.bind(this.session),
+            redirectToConsent: this.session.redirectToConsent.bind(this.session),
+            openConsentPopup: this.session.openConsentPopup.bind(this.session),
+            getArtifact: this.session.getArtifact.bind(this.session),
+            validate: this.validate.check.bind(this.validate),
+            validateBulk: this.validate.checkBulk.bind(this.validate),
+            isAllowed: this.validate.isAllowed.bind(this.validate),
+            areAllowed: this.validate.areAllowed.bind(this.validate),
+            handleCallback: this.callback.parseCallback.bind(this.callback),
+            isCallback: this.callback.isCallback.bind(this.callback),
+            getContext: this.manage.getUpdateContext.bind(this.manage),
+            update: this.manage.update.bind(this.manage),
+            grant: this.manage.grant.bind(this.manage),
+            deny: this.manage.deny.bind(this.manage),
+            getWithdrawalContext: this.manage.getWithdrawalContext.bind(this.manage),
+            withdraw: this.manage.withdraw.bind(this.manage),
+            withdrawBulk: this.manage.withdrawBulk.bind(this.manage),
+            getRenewalContext: this.manage.getRenewalContext.bind(this.manage),
+            renew: this.manage.renew.bind(this.manage),
+            renewBulk: this.manage.renewBulk.bind(this.manage),
+        };
+        this.logger.info('Consentera client initialised', {
+            mode: config.proxyEndpoint ? 'proxy' : 'direct',
+            tenantId: config.tenantId,
+        });
+    }
+    /**
+     * Central HTTP request method. Delegates to {@link HttpTransport}, which owns
+     * the deadline, the retry policy, the idempotency key and the credential rule.
+     *
+     * @param queryParams query string values (the legacy 4th-argument position)
+     * @param options     per-request road, idempotency key, signal, timeout, retry
+     */
+    async request(method, path, body, queryParams, options = {}) {
+        try {
+            return await this.transport.request(method, path, body, {
+                ...options,
+                query: { ...queryParams, ...options.query },
+            });
+        }
+        catch (err) {
+            if (err instanceof ConsenteraError)
+                this.emit('error', err);
+            throw err;
+        }
+    }
+    /** Build client context — delegates to shared helper */
+    static buildClientContext = buildClientContext;
+    /** Build affirmative action — delegates to shared helper */
+    static buildAffirmativeAction = buildAffirmativeAction;
+    /** Get the current configuration. The credentials are redacted. */
+    getConfig() {
+        const copy = { ...this.config };
+        if (copy.apiKey)
+            copy.apiKey = `${copy.apiKey.slice(0, 9)}…`;
+        return copy;
+    }
+}
+
+/**
+ * Google Consent Mode v2 bridge.
+ *
+ * Maps Consentera purpose decisions onto the four Consent Mode v2 signals
+ * (analytics_storage, ad_storage, ad_user_data, ad_personalization) and
+ * pushes them through gtag's dataLayer — `default` denied at install (before
+ * any Google tag fires), `update` on every consent.changed event.
+ *
+ * Usage:
+ *   const bridge = installConsentModeBridge(client, {
+ *     analytics_storage:   ['product_analytics'],
+ *     ad_storage:          ['marketing_communications'],
+ *     ad_user_data:        ['marketing_communications'],
+ *     ad_personalization:  ['marketing_communications'],
+ *   });
+ *   // after reading current state (e.g. update-context or validate):
+ *   bridge.apply({ product_analytics: true, marketing_communications: false });
+ *
+ * The bridge never loads Google code itself — it only writes the standard
+ * dataLayer entries, so it is inert until/unless a Google tag is present.
+ */
+const ALL_SIGNALS = [
+    'analytics_storage',
+    'ad_storage',
+    'ad_user_data',
+    'ad_personalization',
+];
+function gtag() {
+    const w = globalThis;
+    if (typeof w.gtag === 'function')
+        return w.gtag;
+    w.dataLayer = w.dataLayer || [];
+    return function (...args) {
+        w.dataLayer.push(args);
+    };
+}
+class ConsentModeBridge {
+    mapping;
+    /** purpose id/code → granted? — the bridge's view of current state. */
+    state = {};
+    constructor(mapping) {
+        this.mapping = mapping;
+    }
+    /** Send the Consent Mode v2 `default` (everything mapped → denied). */
+    sendDefault(waitForUpdateMs = 500) {
+        const defaults = { wait_for_update: waitForUpdateMs };
+        for (const signal of ALL_SIGNALS) {
+            if (this.mapping[signal]?.length)
+                defaults[signal] = 'denied';
+        }
+        gtag()('consent', 'default', defaults);
+    }
+    /** Replace the bridge's purpose state wholesale and push an update. */
+    apply(purposeStates) {
+        this.state = { ...purposeStates };
+        this.push();
+    }
+    /** Fold a consent.changed event into state and push an update. */
+    onChanged(payload) {
+        for (const c of payload.changes) {
+            this.state[c.purpose_id] = c.status === 'granted';
+        }
+        this.push();
+    }
+    push() {
+        const update = {};
+        for (const signal of ALL_SIGNALS) {
+            const purposes = this.mapping[signal];
+            if (!purposes?.length)
+                continue;
+            // A signal is granted only when EVERY mapped purpose is granted —
+            // the conservative reading a regulator would expect.
+            update[signal] = purposes.every((p) => this.state[p] === true) ? 'granted' : 'denied';
+        }
+        gtag()('consent', 'update', update);
+    }
+}
+/**
+ * Install the bridge: sends the denied `default` immediately and subscribes
+ * to the client's `consent.changed` bus. Returns the bridge so the caller can
+ * `apply()` the current state once known.
+ */
+function installConsentModeBridge(bus, mapping) {
+    const bridge = new ConsentModeBridge(mapping);
+    bridge.sendDefault();
+    bus.on('consent.changed', (payload) => bridge.onChanged(payload));
+    return bridge;
+}
+
+/**
+ * ConsentEra Consent SDK
+ * DPDP, GDPR, TCF 2.2 compliant consent management for web applications
+ */
+// =============================================================================
+// Cookie Banner SDK (existing)
+// =============================================================================
+// =============================================================================
+// Auto-initialization (script tag usage)
+// =============================================================================
+// Auto-initialize if script tag has data-auto-init
+if (typeof window !== 'undefined') {
+    const script = document.currentScript;
+    if (script?.dataset?.autoInit === 'true') {
+        const siteKey = script.dataset.siteKey;
+        const apiKey = script.dataset.apiKey; // Legacy support
+        const tenantId = script.dataset.tenantId;
+        // REQUIRED: there is no default server. Before 2.0.0 this block had no
+        // way to name the API at all, so every script-tag embed talked to the
+        // SDK's built-in default — a host on a domain the company does not own.
+        const apiEndpoint = script.dataset.apiEndpoint ?? '';
+        const authKey = siteKey || apiKey;
+        if (authKey && tenantId) {
+            // A refusal here must not take the bundle down with it: this runs at
+            // module evaluation, and an uncaught throw would also skip the global
+            // exposure below. So the constructor's own error is caught and SAID,
+            // naming the attribute, and nothing is initialised.
+            try {
+                window.ConsentEra = new ConsentEraConsent({
+                    ...(siteKey ? { siteKey } : { apiKey: apiKey }),
+                    tenantId,
+                    apiEndpoint,
+                    autoShow: true,
+                });
+            }
+            catch (error) {
+                console.error('Consentera: data-auto-init did not initialise. ' +
+                    (apiEndpoint ? '' : 'Set data-api-endpoint="https://<your Consentera API host>" on the script tag. '), error);
+            }
+        }
+    }
+}
+// Expose to window for script tag usage
+if (typeof window !== 'undefined') {
+    // The UMD/CDN global. Both spellings are set: `Consentera` is the name the
+    // UMD build registers from 2.0.0, `ConsentEraConsent` is the 1.x name a
+    // script-tag integrator will already have in their page.
+    window.Consentera = ConsentEraConsent;
+    window.ConsentEraConsent = ConsentEraConsent;
+}
+
+exports.CallbackHandler = CallbackHandler;
+exports.ConsentBanner = ConsentBanner;
+exports.ConsentEraApiError = ConsentEraApiError;
+exports.ConsentEraClient = ConsentEraClient;
+exports.ConsentEraConsent = ConsentEraConsent;
+exports.ConsentManager = ConsentManager;
+exports.ConsentModeBridge = ConsentModeBridge;
+exports.ConsentSession = ConsentSession;
+exports.ConsentStorage = ConsentStorage;
+exports.ConsentValidator = ConsentValidator;
+exports.ConsenteraAuthError = ConsenteraAuthError;
+exports.ConsenteraConfigError = ConsenteraConfigError;
+exports.ConsenteraConflictError = ConsenteraConflictError;
+exports.ConsenteraError = ConsenteraError;
+exports.ConsenteraGuardianError = ConsenteraGuardianError;
+exports.ConsenteraIdentityError = ConsenteraIdentityError;
+exports.ConsenteraNetworkError = ConsenteraNetworkError;
+exports.ConsenteraNotFoundError = ConsenteraNotFoundError;
+exports.ConsenteraPermissionError = ConsenteraPermissionError;
+exports.ConsenteraRateLimitError = ConsenteraRateLimitError;
+exports.ConsenteraServerError = ConsenteraServerError;
+exports.ConsenteraTimeoutError = ConsenteraTimeoutError;
+exports.ConsenteraValidationError = ConsenteraValidationError;
+exports.DEFAULT_RETRY = DEFAULT_RETRY;
+exports.DEFAULT_TIMEOUT_MS = DEFAULT_TIMEOUT_MS;
+exports.DFConfigClient = DFConfigClient;
+exports.GPPManager = GPPManager;
+exports.HttpTransport = HttpTransport;
+exports.PreferenceCenter = PreferenceCenter;
+exports.PrincipalClient = PrincipalClient;
+exports.SDK_HEADER_VALUE = SDK_HEADER_VALUE;
+exports.SDK_NAME = SDK_NAME;
+exports.SDK_PLATFORM = SDK_PLATFORM;
+exports.SDK_VERSION = SDK_VERSION;
+exports.TCFManager = TCFManager;
+exports.buildClientContext = buildClientContext;
+exports.claimedCallbackStatus = claimedCallbackStatus;
+exports.default = ConsentEraConsent;
+exports.installConsentModeBridge = installConsentModeBridge;
+exports.isBrowser = isBrowser;
+exports.isSecretKey = isSecretKey;
+exports.isSiteKey = isSiteKey;
+exports.newRequestId = newRequestId;
+exports.parseRetryAfterMs = parseRetryAfterMs;
+exports.principalBody = principalBody;
+exports.readDecisionMessage = readDecisionMessage;
+exports.readStored = readStored;
+exports.removeStored = removeStored;
+exports.storageAvailable = storageAvailable;
+exports.storageKeys = storageKeys;
+exports.verifyCallbackSignature = verifyCallbackSignature;
+exports.writeStored = writeStored;
+//# sourceMappingURL=consentera-consent.cjs.map