@dpdpguard/react-native 1.1.1 → 1.2.0

package/README.md

@@ -78,6 +78,25 @@ Every non-2xx response throws a `DpdpGuardApiError` with a `code` from the
 ADR-002 error catalog (`err.code`, e.g. `"NOT_FOUND"`) and the HTTP
 `status`.
 
+### Types
+
+The wire types are generated from `@dpdpguard/contract`'s `openapi/v1.yaml`
+and re-exported, so you can name what the client returns instead of
+re-declaring it:
+
+```ts
+import type { DsrRequest, Notice, components } from '@dpdpguard/react-native';
+
+const notice: Notice = await client.getNotice(noticeId);
+
+// Endpoints this SDK deliberately doesn't wrap are still typed:
+type GateDecision = components['schemas']['ConsentGateDecision'];
+```
+
+The contract version these were generated from is recorded in
+`src/CONTRACT_VERSION`; `src/contractVersion.test.ts` fails if an install
+drifts off it.
+
 ## Contract
 
 Depends on

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dpdpguard/react-native",
-  "version": "1.1.1",
+  "version": "1.2.0",
   "description": "DPDP Guard React Native SDK - typed HTTP client over the DPDP Guard /api/v1 surface, usable via plain fetch (no native module)",
   "main": "src/index",
   "files": [
@@ -31,6 +31,6 @@
     "typescript": "~5.8"
   },
   "dependencies": {
-    "@dpdpguard/contract": "^1.5.0"
+    "@dpdpguard/contract": "^1.6.0"
   }
 }

package/src/CONTRACT_VERSION

@@ -0,0 +1 @@
+1.6.0

package/src/generated/api-types.ts

@@ -330,6 +330,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/consent-status": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Look up an org's per-purpose consent state by email (docs/specs/ecommerce-cms-plugins.md, §4).
+         * @description Read-only: a WooCommerce/Shopify plugin's only fact about a customer is an email address from its own storefront — every other consent-reading route requires a dpdpbot-internal consent id or a brokered principal token. This resolves an email to the calling organization's own current per-purpose consent grants, so a plugin can gate a marketing sync in real time. `found: false` (not a 404) means the identifier is not yet a customer of record for this organization — distinct from "known, with no active consent", which is `found: true` and an empty or all-opted-out `purposes` array. Requires the `dpdp_consent_status_lookup_enabled` flag; while it is off, this route behaves as if it doesn't exist (404). Write access to consent stays `POST`/`DELETE /cm/v1/consent` — there is no corresponding write route here (ADR-007 D3).
+         */
+        get: operations["getConsentStatus"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/breaches": {
         parameters: {
             query?: never;
@@ -1939,6 +1959,69 @@ export interface operations {
             };
         };
     };
+    getConsentStatus: {
+        parameters: {
+            query: {
+                email: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The calling key's organization's consent status for this email. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        identifier: string;
+                        /** @enum {string} */
+                        identifierType: "email";
+                        found: boolean;
+                        purposes: {
+                            purposeKey: string;
+                            /** @enum {string} */
+                            category: "essential" | "non_essential";
+                            /** @enum {string} */
+                            status: "opt_in" | "opt_out";
+                            /** @description Epoch ms this purpose was withdrawn, if any. */
+                            withdrawnAt?: number;
+                        }[];
+                    };
+                };
+            };
+            /** @description Missing `email` query parameter. */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            /** @description Missing or invalid API key. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+            /** @description The `dpdp_consent_status_lookup_enabled` flag is off. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiError"];
+                };
+            };
+        };
+    };
     listBreaches: {
         parameters: {
             query?: never;

package/src/index.ts

@@ -4,3 +4,30 @@ export { DpdpGuardApiError, ERROR_CATALOG } from './errorCatalog';
 export type { ApiErrorCode, ErrorCatalogEntry } from './errorCatalog';
 export { hasConsent } from './consentGate';
 export type { ConsentRecord } from './consentGate';
+
+// The openapi-typescript output generated from the installed
+// @dpdpguard/contract's openapi/v1.yaml, re-exported so consumers can name
+// the wire types this client returns (and reach endpoints `DpdpGuardClient`
+// deliberately doesn't wrap) instead of re-declaring them by hand. Mirrors
+// dpdpguard-ios-sdk, which exposes its whole generated `DPDPGuardConsentAPI`
+// target alongside the hand-written facade.
+export type {
+	components,
+	operations,
+	paths,
+} from './generated/api-types';
+
+import type { components } from './generated/api-types';
+
+export type OrgSummary = components['schemas']['OrgSummary'];
+export type Notice = components['schemas']['Notice'];
+export type DsrRequest = components['schemas']['DsrRequest'];
+export type Grievance = components['schemas']['Grievance'];
+export type Nomination = components['schemas']['Nomination'];
+export type ApiError = components['schemas']['ApiError'];
+/**
+ * The wire-level consent record from `/cm/v1/consent`. Distinct from this
+ * package's own {@link ConsentRecord}, which is the minimal shape
+ * {@link hasConsent} gates on.
+ */
+export type ApiConsentRecord = components['schemas']['ConsentRecord'];