@consenti/api 0.3.0 → 0.4.0

package/dist/index.d.ts

@@ -13,6 +13,32 @@ type DeepPartial<T> = T extends Function ? T : T extends Array<infer InferredArr
     [Key in keyof T]?: DeepPartial<T[Key]> | null;
 } : T;
 
+/**
+ * Single source of truth for all compliance groups, regulations, and country mappings.
+ *
+ * This is DATA, not types. The `Compliance` and `ComplianceGroupId` literal types
+ * derived from the ID arrays below live in @consenti/types (packages/types/src/compliance.ts),
+ * via a type-only import — that keeps @consenti/types free of runtime code.
+ *
+ * ─── HOW TO UPDATE ────────────────────────────────────────────────────────────
+ *
+ * ADD A NEW REGULATION:
+ *   1. Add regulation ID string to `COMPLIANCE_REGULATION_IDS` below
+ *      (the `Compliance` type in @consenti/types auto-updates from it).
+ *   2. Add it to the appropriate group's `compliances` array below.
+ *   3. Add / update the country entry in `EMBEDDED_COMPLIANCE_MAP` below.
+ *   That is all — no other files need touching.
+ *
+ * ADD A NEW COMPLIANCE GROUP:
+ *   1. Add the kebab-case ID to `COMPLIANCE_GROUP_IDS` below.
+ *   2. Add a full group entry to `COMPLIANCE_GROUPS` below (label, compliances, flags).
+ *   3. Add a validation rule set to `COMPLIANCE_VALIDATION_RULES` below.
+ *   4. Map affected countries in `EMBEDDED_COMPLIANCE_MAP` to the new group.
+ *
+ * ADD OR UPDATE A COUNTRY:
+ *   Edit the entry in `EMBEDDED_COMPLIANCE_MAP.countries` below. That is the ONLY
+ *   place that needs changing for country-level jurisdiction updates.
+ */
 declare const COMPLIANCE_GROUP_IDS: readonly ["opt-in", "opt-out", "opt-out-strict", "opt-in-dpdpa", "opt-in-china", "opt-in-brazil", "general-privacy-consent", "notice-only"];
 declare const COOKIE_PURPOSE_IDS: readonly ["necessary", "functional", "preferences", "analytics", "marketing"];
 
@@ -42,6 +68,8 @@ interface LocaleContentInput {
     mainBanner: MainBanner;
     gpcBanner?: GpcBanner;
     preferenceModal: PreferenceModal;
+    /** Only meaningful when the profile's `ageGate.enabled` is true. */
+    ageGateModal?: AgeGateModalContent;
 }
 interface StorageConfig {
     driver: 'sqlite' | 'better-sqlite3' | 'node-sqlite3-wasm' | 'node:sqlite' | 'mongodb' | 'mysql' | 'postgresql' | 'json';
@@ -85,7 +113,7 @@ interface SamlConfig {
 }
 interface AuthConfig {
     mode: 'local' | 'jwt' | 'custom' | 'oidc' | 'saml';
-    jwtSecret?: string;
+    masterSecret?: string;
     validateUser?: (req: unknown) => Promise<AdminUser | null>;
     adminEmail?: string;
     adminPassword?: string;
@@ -101,6 +129,14 @@ type GeoResult = {
     country: string | null;
     region: string | null;
     locale: string | null;
+    /** Optional escape hatch: when set, `GeoResolverService` uses this compliance group directly
+     * instead of computing one from `country`/`region` against the jurisdiction map — for a
+     * provider that already carries legal-grade jurisdiction data (e.g. a paid geo-IP service) and
+     * needs to route a visitor into an operator-defined custom group the built-in map can't express.
+     * `country`/`region`/`locale` are still used for locale resolution and the `requiresSensitiveOptIn`
+     * region carve-out, which are independent of which group applies. Optional — omitting it (or
+     * returning `undefined`) preserves the existing country/region-map resolution exactly as before. */
+    complianceGroup?: string;
 };
 type CountryResolverFn = (ctx: {
     ip: string;
@@ -178,31 +214,49 @@ interface OptInStats {
     byLocale: Record<string, OptInByLocale>;
     byDate: OptInByDate[];
 }
-type ComplianceMapOverride = 'default' | ComplianceMapData | 'auto';
 interface ComplianceMapData {
     version: string;
     countries: Record<string, CountryComplianceEntry>;
 }
 interface CountryComplianceEntry {
     complianceGroup: ComplianceGroupId;
-    default: ComplianceGroupId;
-    description: string;
+    /** Fallback group used when only the country (not the region) is known. Defaults to
+     * `complianceGroup` when omitted — only set this explicitly when a region within this
+     * country can be stricter than the country-wide baseline (see `overriddenRegions`). */
+    default?: ComplianceGroupId;
+    description?: string;
     overriddenRegions?: Record<string, {
         complianceGroup: ComplianceGroupId;
-        description: string;
+        description?: string;
     }>;
 }
 interface ComplianceConfig {
-    /** @deprecated use type */
-    gdpr?: boolean;
-    /** @deprecated use type */
-    ccpa?: boolean;
+    /** Server-side GPC enforcement on `POST`/`PUT /consent`: re-applies GPC-driven denial when a
+     * write carries `gpcDetected`, independent of the widget's own client-side `gpcMode` handling.
+     * `false` disables this defense-in-depth check entirely. Default: enabled. */
     gpc?: boolean | 'strict';
     type?: ComplianceGroupId | 'auto';
-    /** @deprecated use 'default' instead of 'language' or 'timezone'; 'geoip' and 'hosted-geoip-lite' removed */
-    geoDataProvider?: 'default' | 'maxmind' | 'language' | 'timezone' | 'geoip' | 'hosted-geoip-lite' | CountryResolverFn;
-    autoComplianceMap?: ComplianceMapOverride;
-    complianceMapUrl?: string;
+    geoDataProvider?: 'default' | 'maxmind' | 'geoip' | 'hosted-geoip-lite' | CountryResolverFn;
+    /** `'default'` (embedded map, the default), a URL to fetch a JSON `ComplianceMapData` document
+     * from (refreshed in the background per the response's `Cache-Control`/`Expires` header, 24h
+     * fallback if absent), or an inline operator-supplied `ComplianceMapData` object. Invalid data
+     * from either a URL or an object logs an error and falls back to `'default'`. */
+    complianceMap?: 'default' | string | ComplianceMapData;
+    tcf?: TcfConfig;
+    gpp?: GppConfig;
+    /** Signs server-stored consent records (HMAC-SHA256 at create/update time, hex-encoded into
+     * `signature`, checked on `GET /consent/:visitorId/verify`), ownership cookies, and
+     * parental-consent request/resolve tokens (see `POST /consent/:visitorId/parental-consent-request`),
+     * and salts hashed IPs — independent of the widget's own cookie-signing
+     * (`core.cookieSigningKey`). Auto-generated in memory when unset, so all of the above are
+     * always active — but an auto-generated value isn't persisted, so a restart invalidates
+     * outstanding ownership cookies, in-flight parental-consent tokens, and (if compared across
+     * restarts) hashed-IP continuity. Set this explicitly for anything beyond local dev. */
+    dataSigningHash?: string;
+    dataRetention?: DataRetentionConfig;
+    /** Expiry window for parental-consent tokens issued by `POST /consent/:visitorId/parental-consent-request`.
+     * Default: 7 days. */
+    parentalConsentTokenTtlDays?: number;
 }
 interface DashboardConfig {
     enabled?: boolean;
@@ -211,23 +265,35 @@ interface DashboardConfig {
 interface MultiTenantConfig {
     enabled: boolean;
 }
-interface AgeGateConfig {
-    enabled: boolean;
-    minimumAge: number;
-    requireParentalConsent?: boolean;
-}
 interface TcfConfig {
     enabled: boolean;
     cmpId: number;
     cmpVersion: number;
+    /** ISO 3166-1 alpha-2 country code of the publisher (e.g. 'DE', 'FR'). Required for
+     * spec-correct binary TC-string encoding — without it, real encoding is skipped and
+     * Consenti falls back to the simplified (non-spec) TC string. No default: there is no
+     * honest country to assume on a publisher's behalf. */
+    publisherCC?: string;
+}
+/** IAB Global Privacy Platform (GPP), US National ("usnat") section only — the umbrella section
+ * most MSPA/programmatic US bidders read. Individual state sections (US-CA, US-CO, etc.) aren't
+ * encoded yet. Requires the optional `@iabgpp/cmpapi` peer dependency (see `gpp/gpp-string.ts`) —
+ * unlike TCF there's no simplified fallback format, since a non-spec GPP string has no consumer
+ * that would accept it: when the dependency isn't installed, `gppString`/`window.__gpp` are
+ * simply not produced. */
+interface GppConfig {
+    enabled: boolean;
+    cmpId: number;
+    cmpVersion: number;
+    /** MSPA "covered transaction" — whether this deployment's data transactions fall under MSPA
+     * signatory obligations. No honest default, so it's required rather than optional. */
+    mspaCoveredTransaction: boolean;
+    /** IAB's tri-state encoding for both MSPA fields: 0 = not applicable, 1 = yes, 2 = no. */
+    mspaOptOutOptionMode: 0 | 1 | 2;
+    mspaServiceProviderMode: 0 | 1 | 2;
 }
 interface DataRetentionConfig {
     purgeAfterDays: number;
-    /** When set, audit log entries older than this are purged on the same daily timer as consent
-     * record retention. Independent of `purgeAfterDays` since audit trails are often required to
-     * be kept longer than the consent records they reference for compliance/investigation
-     * purposes. Unset by default — audit logs are kept indefinitely unless explicitly configured. */
-    auditLogPurgeAfterDays?: number;
 }
 interface BrandingConfig {
     /** Display name shown in the dashboard (login page, header, browser tab). Default: 'Consenti'. */
@@ -250,18 +316,10 @@ interface ConsentiServerConfig {
     compliance?: ComplianceConfig;
     multiTenant?: MultiTenantConfig;
     plugins?: ConsentiServerPlugin[];
-    ageGate?: AgeGateConfig;
-    tcf?: TcfConfig;
-    dataRetention?: DataRetentionConfig;
     maxBodySize?: number;
     trustedProxies?: string[];
     branding?: BrandingConfig;
     s3Api?: S3ApiConfig;
-    /** When set, every consent record is HMAC-SHA256 signed at create/update time (hex-encoded,
-     * stored in `signature`) and the signature is checked on `GET /consent/:visitorId/verify`.
-     * No-op and no schema burden when unset — opt-in tamper-evidence for server-stored records,
-     * independent of the widget's own cookie-signing (`core.cookieSigningKey`). */
-    consentSigningKey?: string;
     /** Called after every profile activate/deactivate/delete. isPurge=true means invalidate; false means warm. */
     handleCache?: (paths: string[], profileId: string, isPurge: boolean) => void;
 }
@@ -279,13 +337,40 @@ interface TenantSettings {
      * fallback. The public API has no auth token, so this is its only access gate. */
     allowedOrigins?: string[];
     /** Admin API origin allowlist — an additional CORS-layer check on top of Bearer-token auth
-     * for browser-originated `/consenti/admin/*` requests. Empty/unset means no restriction
+     * for browser-originated `/consenti/admin/v1/*` requests. Empty/unset means no restriction
      * (Bearer token auth alone still applies); only enforced when the request carries an
      * `Origin` header — server-to-server callers are unaffected. */
     adminAllowedOrigins?: string[];
     /** Whether this tenant has completed (or skipped) the first-run setup wizard. Gates the
      * one-time `#/setup` redirect in the dashboard — never reset once true. Default: false. */
     setupCompleted?: boolean;
+    /** Whether `POST /setup/seed-profiles` has been called at least once for this tenant (an
+     * empty `groups: []` call counts). `POST /setup/complete` rejects until this is true, closing
+     * the bypass where the wizard's step-1 skip (or a direct API call) could mark setup complete
+     * without ever passing through config review or the profile step. */
+    profilesSeeded?: boolean;
+    /** Last-confirmed TCF `{cmpId, cmpVersion}` registration snapshot, hashed rather than stored
+     * in full — the live values always come from the static `compliance.tcf` config, never the DB.
+     * A hash mismatch (including never having confirmed) means TCF is treated as unconfirmed and
+     * fails closed: no `window.__tcfapi`, no TC string, a logged server error. Re-confirming in the
+     * dashboard (against the cached IAB CMP List) writes a fresh hash here. */
+    tcfConfirmation?: RegistrationConfirmation;
+    /** Same governance shape as `tcfConfirmation`, for the GPP US National section's own
+     * `compliance.gpp.{cmpId, cmpVersion}`. Self-attestation only — IAB doesn't publish a
+     * CMP-List equivalent for GPP, so there's no external registry to validate against. */
+    gppConfirmation?: RegistrationConfirmation;
+}
+/** Hash-based confirmation record — proves a specific `{cmpId, cmpVersion}` config was reviewed
+ * and confirmed as registered, without persisting the config values themselves in the DB. */
+interface RegistrationConfirmation {
+    /** Hash of the confirmed `{cmpId, cmpVersion}` (and `publisherCC` for TCF). Compared against a
+     * fresh hash of the live static config on every check — any drift (including a first-ever
+     * check) means unconfirmed. */
+    configHash: string;
+    confirmedAt: string;
+    /** User id of the admin who checked the confirmation box. Undefined for confirmations made
+     * before this field existed. */
+    confirmedBy?: string;
 }
 interface ApiKey {
     id: string;
@@ -323,9 +408,10 @@ interface ConsentDbRecord {
     ageVerified?: boolean;
     parentalConsentToken?: string;
     tcfString?: string;
-    /** HMAC-SHA256 signature over the record's core fields, hex-encoded. Only present when
-     * `consentSigningKey` is configured — opt-in tamper-evidence for server-stored records,
-     * independent of the widget's own cookie-signing (`core.cookieSigningKey`). */
+    gppString?: string;
+    /** HMAC-SHA256 signature over the record's core fields, hex-encoded — tamper-evidence for
+     * server-stored records via `dataSigningHash` (auto-generated when unset), independent of the
+     * widget's own cookie-signing (`core.cookieSigningKey`). */
     signature?: string;
     createdAt: string;
     updatedAt: string;
@@ -405,10 +491,11 @@ interface AuditLog {
     createdAt: string;
 }
 /** List-view shape for consents — omits the fields not shown in a table row (`consentJson`,
- * `parentalConsentToken`, `tcfString`, `signature`), so paginated list queries don't have to pull
- * those blobs off disk for every row. Fetch the full `ConsentDbRecord` via `getConsent(visitorId)`
- * when a single record's full detail is actually needed (e.g. opening a detail modal). */
-type ConsentSummary = Omit<ConsentDbRecord, 'consentJson' | 'parentalConsentToken' | 'tcfString' | 'signature'>;
+ * `parentalConsentToken`, `tcfString`, `gppString`, `signature`), so paginated list queries don't
+ * have to pull those blobs off disk for every row. Fetch the full `ConsentDbRecord` via
+ * `getConsent(visitorId)` when a single record's full detail is actually needed (e.g. opening a
+ * detail modal). */
+type ConsentSummary = Omit<ConsentDbRecord, 'consentJson' | 'parentalConsentToken' | 'tcfString' | 'gppString' | 'signature'>;
 /** List-view shape for audit logs — omits `oldData`/`newData` (full before/after snapshots) for
  * the same reason as `ConsentSummary`. Fetch the full `AuditLog` via `getAuditLogById(id)` when a
  * single entry's full detail is needed. */
@@ -443,6 +530,7 @@ interface CreateConsentInput {
     ageVerified?: boolean;
     parentalConsentToken?: string;
     tcfString?: string;
+    gppString?: string;
     signature?: string;
 }
 interface UpdateConsentInput {
@@ -639,7 +727,6 @@ interface StorageAdapter {
     deleteApiKey(id: string): Promise<void>;
     getApiKeys(tenantId: string): Promise<ApiKey[]>;
     purgeExpiredConsents(olderThanDays: number): Promise<number>;
-    purgeExpiredAuditLogs(olderThanDays: number): Promise<number>;
     createConsentTemplate(data: CreateConsentTemplateInput): Promise<ServerConsentTemplate>;
     updateConsentTemplate(id: string, data: UpdateConsentTemplateInput): Promise<ServerConsentTemplate>;
     deleteConsentTemplate(id: string): Promise<void>;
@@ -799,6 +886,17 @@ interface PreferenceModal extends Omit<MainBanner, "position"> {
     receiptLabel?: string;
     /** Description shown beneath the consent-receipt checkbox. Falls back to a default when omitted. */
     receiptDescription?: string;
+    /**
+     * Renders a "Forget me" control in the modal body, below the categories — only shown to
+     * visitors who already have a stored consent decision (nothing to erase otherwise). Wired to
+     * the same `DELETE /consent/:visitorId` erasure endpoint as `widget.deleteConsent()`, giving
+     * visitors self-service access to GDPR Art. 17 / CCPA-CPRA / LGPD Art. 18 / UK GDPR / DPDPA /
+     * KVKK / POPIA / PDPA-TH / APPI erasure-equivalent rights without the host wiring a link
+     * themselves. See the "Right to erasure" guide for the full compliance mapping.
+     */
+    showForgetMe?: boolean;
+    /** Label for the "Forget me" button (shown when `showForgetMe` is true). Falls back to a default when omitted. */
+    forgetMeLabel?: string;
 }
 /**
  * A UI-template button definition. Keyed by its own machine id (e.g. `'accept-all'`) inside
@@ -833,11 +931,16 @@ interface TemplateModalDef extends Omit<TemplateBannerDef, 'position'> {
     persistent?: boolean;
     hasSubheading?: boolean;
     mobileFullScreenBreakpoint?: number;
+    /** Renders a "Forget me" control below the categories, for visitors who already have a stored
+     * consent decision. See {@link PreferenceModal.showForgetMe}. */
+    showForgetMe?: boolean;
 }
 interface LocaleTranslations {
     mainBanner: DeepPartial<MainBanner>;
     gpcBanner?: DeepPartial<GpcBanner>;
     preferenceModal: DeepPartial<PreferenceModal>;
+    /** Only meaningful when the profile's `ageGate.enabled` is true. */
+    ageGateModal?: DeepPartial<AgeGateModalContent>;
 }
 interface ProfileTranslations {
     [locale: string]: LocaleTranslations;
@@ -847,6 +950,29 @@ interface DpdpaConfig {
     grievanceEmail: string;
     purposeDescription?: string;
 }
+/**
+ * Per-profile age gate — GDPR Art. 8's consent age varies 13–16 by EU member state and DPDPA has
+ * its own child-data age rules, so one global age (the old `ConsentiServerConfig.ageGate`) was
+ * wrong for a multi-region deployment. Mirrors `dpdpa` exactly: profile-scoped, not global.
+ */
+interface AgeGateConfig {
+    enabled: boolean;
+    minimumAge: number;
+    requireParentalConsent?: boolean;
+}
+/** Per-locale age-gate modal text — translated the same way `mainBanner`/`preferenceModal`
+ * content is, unlike the widget's own hardcoded UI chrome (close button, locale switcher). */
+interface AgeGateModalContent {
+    heading?: string;
+    htmlText: string;
+    confirmButtonLabel: string;
+    denyButtonLabel: string;
+    parentalConsent: {
+        heading?: string;
+        htmlText: string;
+        confirmButtonLabel: string;
+    };
+}
 interface LocaleTextContent {
     mainBanner: {
         heading?: string;
@@ -873,7 +999,11 @@ interface LocaleTextContent {
         }>;
         receiptLabel?: string;
         receiptDescription?: string;
+        /** Per-locale override of `PreferenceModal.forgetMeLabel`; only meaningful when `showForgetMe` is true. */
+        forgetMeLabel?: string;
     };
+    /** Only meaningful when the profile's `ageGate.enabled` is true. */
+    ageGateModal?: AgeGateModalContent;
 }
 interface ProfileConfig {
     id: string;
@@ -888,6 +1018,12 @@ interface ProfileConfig {
     darkMode?: boolean;
     allowedOrigins?: string[];
     dpdpa?: DpdpaConfig;
+    ageGate?: AgeGateConfig;
+    /** Default locale's age-gate modal text — mirrors `mainBanner`/`preferenceModal` (inline,
+     * required-shape-when-present), not `dpdpa` (which has no locale text at all). Every other
+     * locale's `ageGateModal` lives in `localeContents`/`LocaleContentInput` like the rest of
+     * that locale's content. */
+    ageGateModal?: AgeGateModalContent;
     regulation?: 'gdpr' | 'ccpa' | 'cpra' | 'dpdpa' | 'uk-gdpr' | 'lgpd' | 'pipeda' | 'popia' | 'pdpa-th' | 'appi' | 'kvkk';
     regulations?: string[];
     consentTemplateId?: string;
@@ -1005,6 +1141,8 @@ interface PublicProfileResponse {
     allowReceipt?: boolean;
     darkMode?: boolean;
     dpdpa?: DpdpaConfig;
+    ageGate?: AgeGateConfig;
+    ageGateModal?: AgeGateModalContent;
     showFooterMetadata?: boolean;
     enhanceAccessibility?: boolean;
     createdAt?: string;
@@ -1123,6 +1261,20 @@ declare class ProfileService {
      * requested via `getVersionFile()`, which works for these ids too.
      */
     listArchivedProfiles(): Promise<ArchivedProfileSummary[]>;
+    /** Strips display text from an embedded profile's button map — a `UITemplate`'s buttons own
+     * layout/behavior only, never text (button labels are authored per-locale on the profile
+     * instead, see `LocaleTextContent.*.buttonLabels`). */
+    private toTemplateButtonMap;
+    /** Builds a `UITemplate`'s structural definitions (position, buttons, close/locale-switcher
+     * flags) from an embedded profile's English translation — no heading/htmlText/button text,
+     * which stay inline on the seeded profile as per-locale content, never on the template. */
+    private buildSeedUiTemplatePayload;
+    /**
+     * Idempotently gets-or-creates the `ConsentTemplate` + `UITemplate` pair backing one seeded
+     * compliance group's profile, named consistently with the profile itself (`Default — {group}`).
+     * Looked up by name/tenant first so re-running the setup wizard never creates duplicates.
+     */
+    private getOrCreateSeedTemplates;
     /**
      * Seeds a default profile for a compliance group from the embedded English profile in
      * `@consenti/utils`, merged with locale text overlays for de/es/fr/ja. Every locale — including
@@ -1132,6 +1284,14 @@ declare class ProfileService {
      * Only creates the profile if no active profile already exists for the compliance group.
      * Safe to call repeatedly (idempotent).
      *
+     * Also seeds (idempotently) a `ConsentTemplate`/`UITemplate` pair for the group and links the
+     * profile to both via `consentTemplateId`/`uiTemplateId` — same as a dashboard-authored profile
+     * is required to. The profile is a *snapshot*, not a live pointer: `cookies`/`mainBanner`/
+     * `gpcBanner`/`preferenceModal` stay fully resolved inline (DB row + on-disk locale files)
+     * exactly as before; the template ids are additive, purely for traceability and so the editor
+     * knows which template to re-offer on next edit. Editing the template later never silently
+     * changes this profile — only an explicit re-save of the profile itself does.
+     *
      * @param complianceGroup - One of the 8 compliance group IDs.
      */
     seedDefaultProfile(complianceGroup: string): Promise<void>;
@@ -1186,9 +1346,14 @@ declare class ConsentService {
     private eventBus?;
     private tcfConfig?;
     private storage?;
-    private consentSigningKey?;
-    constructor(consents: ConsentRepo, visitors: VisitorRepo, profiles: ProfileRepo, audit: AuditRepo, tenantId?: string, compliance?: ComplianceConfig | undefined, pluginEngine?: PluginEngine | undefined, eventBus?: EventEmitter | undefined, tcfConfig?: TcfConfig | undefined, storage?: StorageAdapter | undefined, consentSigningKey?: string | undefined);
+    private dataSigningHash?;
+    private gppConfig?;
+    constructor(consents: ConsentRepo, visitors: VisitorRepo, profiles: ProfileRepo, audit: AuditRepo, tenantId?: string, compliance?: ComplianceConfig | undefined, pluginEngine?: PluginEngine | undefined, eventBus?: EventEmitter | undefined, tcfConfig?: TcfConfig | undefined, storage?: StorageAdapter | undefined, dataSigningHash?: string | undefined, gppConfig?: GppConfig | undefined);
     private sign;
+    /** Fails closed: no `storage` to check against means unconfirmed, never assumed confirmed. */
+    private isTcfConfirmed;
+    /** Same fail-closed shape as isTcfConfirmed() — see registration-confirmation.ts. */
+    private isGppConfirmed;
     /**
      * Profiles created via the dashboard wizard reference a consent template (`consentTemplateId`)
      * rather than embedding `cookies`/`preferenceModal.categories` directly on `profileJson` — those
@@ -1210,7 +1375,8 @@ declare class VisitorService {
     private visitors;
     private tenantId;
     private eventBus?;
-    constructor(visitors: VisitorRepo, tenantId?: string, eventBus?: EventEmitter | undefined);
+    private dataSigningHash;
+    constructor(visitors: VisitorRepo, tenantId?: string, eventBus?: EventEmitter | undefined, dataSigningHash?: string);
     upsert(data: {
         visitorId: string;
         ip?: string;
@@ -1335,7 +1501,6 @@ declare class BetterSqlite3Adapter implements StorageAdapter {
     getSettings(tenantId: string): Promise<TenantSettings>;
     updateSettings(tenantId: string, data: Partial<TenantSettings>): Promise<TenantSettings>;
     purgeExpiredConsents(olderThanDays: number): Promise<number>;
-    purgeExpiredAuditLogs(olderThanDays: number): Promise<number>;
     private mapApiKey;
     createApiKey(data: CreateApiKeyInput): Promise<ApiKey>;
     getApiKeyByHash(keyHash: string): Promise<ApiKey | null>;
@@ -1440,7 +1605,6 @@ declare class MongoDBAdapter implements StorageAdapter {
     getSettings(tenantId: string): Promise<TenantSettings>;
     updateSettings(tenantId: string, data: Partial<TenantSettings>): Promise<TenantSettings>;
     purgeExpiredConsents(olderThanDays: number): Promise<number>;
-    purgeExpiredAuditLogs(olderThanDays: number): Promise<number>;
     createConsentTemplate(): Promise<never>;
     updateConsentTemplate(): Promise<never>;
     deleteConsentTemplate(): Promise<void>;
@@ -1533,7 +1697,6 @@ declare class MySQLAdapter implements StorageAdapter {
     updateSettings(tenantId: string, data: Partial<TenantSettings>): Promise<TenantSettings>;
     deleteTenant(id: string): Promise<void>;
     purgeExpiredConsents(olderThanDays: number): Promise<number>;
-    purgeExpiredAuditLogs(olderThanDays: number): Promise<number>;
     createConsentTemplate(): Promise<never>;
     updateConsentTemplate(): Promise<never>;
     deleteConsentTemplate(): Promise<void>;
@@ -1625,7 +1788,6 @@ declare class PostgreSQLAdapter implements StorageAdapter {
     getSettings(tenantId: string): Promise<TenantSettings>;
     updateSettings(tenantId: string, data: Partial<TenantSettings>): Promise<TenantSettings>;
     purgeExpiredConsents(olderThanDays: number): Promise<number>;
-    purgeExpiredAuditLogs(olderThanDays: number): Promise<number>;
     createConsentTemplate(): Promise<never>;
     updateConsentTemplate(): Promise<never>;
     deleteConsentTemplate(): Promise<void>;
@@ -1649,8 +1811,8 @@ declare class PostgreSQLAdapter implements StorageAdapter {
  *
  * Watches a single consent parameter across *every* visitor's submission (not just one
  * browser's own state) and fires `onGrant`/`onDeny` when that parameter's status actually
- * changes — via the same `eventBus` `createConsenti()` already emits `consent.created`/
- * `consent.updated` on. Useful for server-side integrations (CRM sync, suppression lists,
+ * changes — via the same `eventBus` `createConsenti()` already emits `consent:created`/
+ * `consent:updated` on. Useful for server-side integrations (CRM sync, suppression lists,
  * downstream webhooks) that need to react to consent decisions without polling the database.
  *
  * There is no server equivalent of the widget's `ConsentScript` — injecting a `<script>` tag
@@ -1691,7 +1853,7 @@ interface ConsentActionOptions {
     onDeny?: (params: ConsentActionParams) => void;
 }
 /**
- * Watches a single consent parameter across every incoming `consent.created`/`consent.updated`
+ * Watches a single consent parameter across every incoming `consent:created`/`consent:updated`
  * event and fires `onGrant`/`onDeny` on transitions. Call {@link ConsentAction.destroy} to
  * remove the event listeners when the hook is no longer needed.
  */
@@ -1750,8 +1912,8 @@ interface CategoryActionOptions {
     onDeny?: (params: CategoryActionParams) => void;
 }
 /**
- * Watches a category's rollup consent status across every incoming `consent.created`/
- * `consent.updated` event and fires `onGrant`/`onDeny` on transitions. Call
+ * Watches a category's rollup consent status across every incoming `consent:created`/
+ * `consent:updated` event and fires `onGrant`/`onDeny` on transitions. Call
  * {@link CategoryAction.destroy} to remove the event listeners when no longer needed.
  */
 declare class CategoryAction {