@redacto.io/consent-sdk-js 1.0.0-beta.0 → 1.0.0

package/dist/redacto.js

@@ -182,17 +182,6 @@ function createMediaQuery(query) {
   };
 }
 
-// src/core/jwt-decode.ts
-var import_jwt_decode = require("jwt-decode");
-function decodeTokenSafely(token) {
-  try {
-    return (0, import_jwt_decode.jwtDecode)(token);
-  } catch (error) {
-    console.warn("Failed to decode JWT token:", error);
-    return null;
-  }
-}
-
 // src/services/cache.ts
 var apiCache = /* @__PURE__ */ new Map();
 var CACHE_TTL = 5 * 60 * 1e3;
@@ -213,6 +202,133 @@ function clearApiCache() {
   apiCache.clear();
 }
 
+// src/core/jwt-decode.ts
+var import_jwt_decode = require("jwt-decode");
+function decodeTokenSafely(token) {
+  try {
+    return (0, import_jwt_decode.jwtDecode)(token);
+  } catch (error) {
+    console.warn("Failed to decode JWT token:", error);
+    return null;
+  }
+}
+
+// src/api/sandbox.ts
+var SANDBOX_TOKEN_HEADER = "X-Consent-Token";
+var resolveSandboxAuth = (options) => {
+  var _a, _b, _c, _d, _e;
+  const token = (_a = options.token) == null ? void 0 : _a.trim();
+  if (!token) {
+    return null;
+  }
+  const organisationUuid = (_b = options.organisationUuid) == null ? void 0 : _b.trim();
+  const workspaceUuid = (_c = options.workspaceUuid) == null ? void 0 : _c.trim();
+  const ucic = (_d = options.sandboxUcic) == null ? void 0 : _d.trim();
+  const subject = (_e = options.sandboxSubject) == null ? void 0 : _e.trim();
+  if (!organisationUuid || !workspaceUuid) {
+    throw new Error(
+      "Sandbox mode requires organisationUuid and workspaceUuid"
+    );
+  }
+  if (!ucic && !subject) {
+    throw new Error("Sandbox mode requires a UCIC, email, or mobile");
+  }
+  return { token, ucic, subject: subject != null ? subject : "", organisationUuid, workspaceUuid };
+};
+var resolveRequestAuth = (accessToken, options) => {
+  const sandbox = resolveSandboxAuth(options);
+  if (sandbox) {
+    return {
+      organisationUuid: sandbox.organisationUuid,
+      workspaceUuid: sandbox.workspaceUuid,
+      sandbox
+    };
+  }
+  const decodedToken = accessToken ? decodeTokenSafely(accessToken) : null;
+  if (!decodedToken) {
+    throw new Error("Invalid access token");
+  }
+  const { organisation_uuid, workspace_uuid } = decodedToken;
+  if (!organisation_uuid || !workspace_uuid) {
+    throw new Error("Invalid token: missing organization or workspace UUID");
+  }
+  return {
+    organisationUuid: organisation_uuid,
+    workspaceUuid: workspace_uuid,
+    sandbox: null
+  };
+};
+var buildAuthHeaders = (accessToken, sandbox) => {
+  if (sandbox) {
+    return { [SANDBOX_TOKEN_HEADER]: sandbox.token };
+  }
+  return { Authorization: `Bearer ${accessToken}` };
+};
+var sandboxBodyIdentity = (sandbox) => {
+  if (sandbox.ucic) {
+    return { org_user_id: sandbox.ucic };
+  }
+  return sandbox.subject.includes("@") ? { primary_email: sandbox.subject } : { primary_mobile: sandbox.subject };
+};
+var sandboxQueryIdentity = (sandbox) => sandboxBodyIdentity(sandbox);
+
+// src/api/constants.ts
+var CODE_BY_NAME = /* @__PURE__ */ new Map([
+  ["english", "en"],
+  ["assamese", "as"],
+  ["bengali", "bn"],
+  ["bodo", "brx"],
+  ["dogri", "doi"],
+  ["goan konkani", "gom"],
+  ["gujarati", "gu"],
+  ["hindi", "hi"],
+  ["kannada", "kn"],
+  ["kashmiri", "ks"],
+  ["maithili", "mai"],
+  ["malayalam", "ml"],
+  ["manipuri", "mni-Mtei"],
+  ["marathi", "mr"],
+  ["nepali", "ne"],
+  ["odia", "or"],
+  ["punjabi", "pa"],
+  ["sanskrit", "sa"],
+  ["santali", "sat"],
+  ["sindhi", "sd"],
+  ["tamil", "ta"],
+  ["telugu", "te"],
+  ["urdu", "ur"]
+]);
+var CODE_BY_LOWER = new Map(
+  [...CODE_BY_NAME.values()].map((c) => [c.toLowerCase(), c])
+);
+
+// src/api/language.ts
+function toLanguageCode(lang) {
+  var _a, _b;
+  if (!lang) {
+    return void 0;
+  }
+  const trimmed = lang.trim();
+  if (!trimmed) {
+    return void 0;
+  }
+  const lower = trimmed.toLowerCase();
+  return (_b = (_a = CODE_BY_LOWER.get(lower)) != null ? _a : CODE_BY_NAME.get(lower)) != null ? _b : trimmed;
+}
+function resolveDisplayLanguage(requested, defaultLanguage, translations) {
+  const fallback = defaultLanguage || "en";
+  const requestedCode = toLanguageCode(requested);
+  if (!requestedCode) {
+    return fallback;
+  }
+  for (const key of Object.keys(translations || {})) {
+    if (toLanguageCode(key) === requestedCode) {
+      return key;
+    }
+  }
+  return fallback;
+}
+
 // src/api/index.ts
 var BASE_URL = "https://api.redacto.io/consent";
 var BASE_URL_PUBLIC = "https://api.redacto.tech/consent";
@@ -224,17 +340,22 @@ var fetchConsentContent = async ({
   specific_uuid,
   validate_against = "all",
   include_fully_consented_data = false,
-  signal
+  signal,
+  ...sandboxParams
 }) => {
-  if (!noticeId || !accessToken || !validate_against) {
-    throw new Error("noticeId and accessToken are required");
+  if (!noticeId || !validate_against) {
+    throw new Error("noticeId is required");
   }
-  const decodedToken = decodeTokenSafely(accessToken);
-  if (!decodedToken) throw new Error("Invalid access token");
-  const { organisation_uuid: ORG, workspace_uuid: WS } = decodedToken;
-  if (!ORG || !WS) throw new Error("Invalid token: missing organization or workspace UUID");
+  if (!accessToken && !sandboxParams.token) {
+    throw new Error("accessToken or token is required");
+  }
+  const { organisationUuid: ORG, workspaceUuid: WS, sandbox } = resolveRequestAuth(
+    accessToken,
+    sandboxParams
+  );
   const apiBaseUrl = baseUrl || BASE_URL;
-  const cacheKey = `${accessToken}-${noticeId}-${validate_against}-${language}-${specific_uuid || ""}-${include_fully_consented_data}`;
+  const cacheIdentity = sandbox ? `sandbox:${sandbox.organisationUuid}:${sandbox.workspaceUuid}:${sandbox.ucic || sandbox.subject}` : accessToken;
+  const cacheKey = `${cacheIdentity}-${noticeId}-${validate_against}-${language}-${specific_uuid || ""}-${include_fully_consented_data}`;
   if (validate_against === "all" && !specific_uuid) {
     const cached = getCachedData(cacheKey);
     if (cached) return cached;
@@ -243,10 +364,15 @@ var fetchConsentContent = async ({
   if (specific_uuid) url.searchParams.append("specific_uuid", specific_uuid);
   url.searchParams.append("validate_against", validate_against);
   if (include_fully_consented_data) url.searchParams.append("include_fully_consented_data", "true");
+  if (sandbox) {
+    for (const [key, value] of Object.entries(sandboxQueryIdentity(sandbox))) {
+      url.searchParams.append(key, value);
+    }
+  }
   const response = await fetch(url.toString(), {
     method: "GET",
     headers: {
-      Authorization: `Bearer ${accessToken}`,
+      ...buildAuthHeaders(accessToken, sandbox),
       "Accept-Language": language
     },
     signal
@@ -272,18 +398,24 @@ var fetchConsentContentPublic = async ({
   org_uuid,
   workspace_uuid,
   notice_uuid,
+  accessToken,
   baseUrl,
   language = "en",
   specific_uuid
 }) => {
   const apiBaseUrl = baseUrl || BASE_URL_PUBLIC;
+  const noticesUrl = `${apiBaseUrl}/public/organisations/${org_uuid}/workspaces/${workspace_uuid}/notices`;
   const url = new URL(
-    `${apiBaseUrl}/public/organisations/${org_uuid}/workspaces/${workspace_uuid}/notices/get-notice/${notice_uuid}`
+    accessToken ? `${noticesUrl}/${notice_uuid}` : `${noticesUrl}/get-notice/${notice_uuid}`
   );
   if (specific_uuid) url.searchParams.append("specific_uuid", specific_uuid);
   const response = await fetch(url.toString(), {
     method: "GET",
-    headers: { "Content-Type": "application/json" }
+    headers: {
+      "Content-Type": "application/json",
+      "Accept-Language": language,
+      ...accessToken ? { Authorization: `Bearer ${accessToken}` } : {}
+    }
   });
   if (response.status === 401) {
     const error = new Error("Unauthorized");
@@ -310,16 +442,21 @@ var submitConsentEvent = async ({
   meta_data,
   guardianVerificationReference,
   selfDeclaredAdult,
-  signal
+  language,
+  signal,
+  ...sandboxParams
 }) => {
-  if (!noticeUuid || !accessToken || !Array.isArray(purposes)) {
-    throw new Error("noticeUuid, accessToken, and purposes array are required");
+  if (!noticeUuid || !Array.isArray(purposes)) {
+    throw new Error("noticeUuid and purposes array are required");
   }
-  const decodedToken = decodeTokenSafely(accessToken);
-  if (!decodedToken) throw new Error("Invalid access token");
-  const { organisation_uuid: ORG, workspace_uuid: WS } = decodedToken;
-  if (!ORG || !WS) throw new Error("Invalid token: missing organization or workspace UUID");
-  const apiBaseUrl = ledgerBaseUrl || baseUrl || BASE_URL;
+  if (!accessToken && !sandboxParams.token) {
+    throw new Error("accessToken or token is required");
+  }
+  const { organisationUuid: ORG, workspaceUuid: WS, sandbox } = resolveRequestAuth(
+    accessToken,
+    sandboxParams
+  );
+  const apiBaseUrl = (sandbox ? null : ledgerBaseUrl) || baseUrl || BASE_URL;
   const validatedPurposes = purposes.map((purpose) => {
     if (!purpose.uuid) throw new Error("Invalid purpose data: missing uuid");
     const dataElements = (purpose.data_elements || []).filter((element) => element.enabled).map((element) => ({
@@ -340,17 +477,19 @@ var submitConsentEvent = async ({
     declined: Boolean(declined),
     meta_data: meta_data ? { specific_uuid: meta_data.specific_uuid, minor_age: meta_data.minor_age } : void 0,
     guardian_verification_reference: guardianVerificationReference,
-    self_declared_adult: selfDeclaredAdult
+    self_declared_adult: selfDeclaredAdult,
+    language: toLanguageCode(language)
   };
+  const requestBody = sandbox ? { ...payload, ...sandboxBodyIdentity(sandbox) } : payload;
   const response = await fetch(
     `${apiBaseUrl}/public/organisations/${ORG}/workspaces/${WS}/submit-consent`,
     {
       method: "POST",
       headers: {
-        Authorization: `Bearer ${accessToken}`,
+        ...buildAuthHeaders(accessToken, sandbox),
         "Content-Type": "application/json"
       },
-      body: JSON.stringify(payload),
+      body: JSON.stringify(requestBody),
       signal
     }
   );
@@ -382,7 +521,8 @@ var submitConsentEventPublic = async ({
   noticeUuid,
   purposes,
   declined,
-  meta_data
+  meta_data,
+  language
 }) => {
   var _a, _b;
   const apiBaseUrl = ledgerBaseUrl || baseUrl || BASE_URL_PUBLIC;
@@ -403,7 +543,8 @@ var submitConsentEventPublic = async ({
     select_all_mandatory: false,
     source: "WEB",
     declined,
-    meta_data
+    meta_data,
+    language: toLanguageCode(language)
   };
   const response = await fetch(
     `${apiBaseUrl}/public/organisations/${org_uuid}/workspaces/${workspace_uuid}/submit-consent`,
@@ -442,23 +583,32 @@ var submitConsentEventPublic = async ({
 var fetchTTSAudioUrls = async ({
   accessToken,
   baseUrl,
+  ledgerBaseUrl,
   noticeUuid,
   language,
-  signal
+  signal,
+  ...sandboxParams
 }) => {
-  if (!accessToken || !noticeUuid || !language) {
-    throw new Error("accessToken, noticeUuid, and language are required");
+  if (!accessToken && !sandboxParams.token || !noticeUuid || !language) {
+    throw new Error("accessToken (or token), noticeUuid, and language are required");
   }
-  const decodedToken = decodeTokenSafely(accessToken);
-  if (!decodedToken) throw new Error("Invalid access token");
-  const { organisation_uuid: ORG, workspace_uuid: WS } = decodedToken;
-  if (!ORG || !WS) throw new Error("Invalid token: missing organization or workspace UUID");
-  const apiBaseUrl = baseUrl || BASE_URL;
-  const url = `${apiBaseUrl}/public/organisations/${ORG}/workspaces/${WS}/notices/${noticeUuid}/audio/${language}`;
-  const response = await fetch(url, {
+  const { organisationUuid: ORG, workspaceUuid: WS, sandbox } = resolveRequestAuth(
+    accessToken,
+    sandboxParams
+  );
+  const apiBaseUrl = (sandbox ? null : ledgerBaseUrl) || baseUrl || BASE_URL;
+  const url = new URL(
+    `${apiBaseUrl}/public/organisations/${ORG}/workspaces/${WS}/notices/${noticeUuid}/audio/${language}`
+  );
+  if (sandbox) {
+    for (const [key, value] of Object.entries(sandboxQueryIdentity(sandbox))) {
+      url.searchParams.append(key, value);
+    }
+  }
+  const response = await fetch(url.toString(), {
     method: "GET",
     headers: {
-      Authorization: `Bearer ${accessToken}`,
+      ...buildAuthHeaders(accessToken, sandbox),
       Accept: "application/json"
     },
     signal
@@ -925,6 +1075,42 @@ var styles = {
     padding: 0,
     boxSizing: "border-box"
   },
+  // The main notice header is two stacked rows: the logo alone on row 1,
+  // aligned per active_config.logo_position, then the title and the
+  // TTS/language controls on row 2. `topSection` and `topLeft` above keep their
+  // single-row shape for the age-verification, guardian and verification
+  // screens, which have no controls to place and share those styles.
+  // Mirrors consent-sdk-react/src/RedactoNoticeConsent/styles.ts.
+  headerStack: {
+    display: "flex",
+    flexDirection: "column",
+    alignItems: "stretch",
+    gap: "10px",
+    paddingBottom: "15px",
+    borderBottom: "none",
+    backgroundColor: "#ffffff",
+    margin: 0,
+    boxSizing: "border-box",
+    textAlign: "left"
+  },
+  logoRow: {
+    display: "flex",
+    alignItems: "center",
+    width: "100%",
+    margin: 0,
+    padding: 0,
+    boxSizing: "border-box"
+  },
+  headerRow: {
+    display: "flex",
+    alignItems: "center",
+    justifyContent: "space-between",
+    gap: "10px",
+    width: "100%",
+    margin: 0,
+    padding: 0,
+    boxSizing: "border-box"
+  },
   logo: {
     height: "32px",
     width: "auto",
@@ -1156,6 +1342,9 @@ var styles = {
   },
   languageSelectorContainer: {
     position: "relative",
+    // Shares `headerRow` with the title, which grows; without this a long
+    // heading squeezes the language button instead of wrapping itself.
+    flexShrink: 0,
     margin: 0,
     padding: 0,
     boxSizing: "border-box"
@@ -1718,6 +1907,12 @@ var updateConsentState = (updates) => {
 };
 
 // src/constants.ts
+var DEFAULT_LOGO_POSITION = "left";
+var LOGO_POSITION_JUSTIFY = {
+  left: "flex-start",
+  center: "center",
+  right: "flex-end"
+};
 var DPO_AUDIO_ELEMENT_MAP = [
   { audioKey: "grievance_text_audio_url", elementId: "dpo-grievance-text" },
   { audioKey: "grievance_anchor_text_audio_url", elementId: "dpo-grievance-link" },
@@ -1776,9 +1971,15 @@ var TTSManager = class {
       const response = await fetchTTSAudioUrls({
         accessToken: params.accessToken,
         baseUrl: params.baseUrl,
+        ledgerBaseUrl: params.ledgerBaseUrl,
         noticeUuid: params.noticeUuid,
         language: params.language,
-        signal: this.abortController.signal
+        signal: this.abortController.signal,
+        token: params.token,
+        sandboxUcic: params.sandboxUcic,
+        sandboxSubject: params.sandboxSubject,
+        organisationUuid: params.organisationUuid,
+        workspaceUuid: params.workspaceUuid
       });
       this.audioUrls = response.detail;
       this.buildSequences(params.content);
@@ -2743,6 +2944,14 @@ function resolveColors(settings, activeConfig) {
   };
 }
 
+// src/modal/layout.ts
+function resolveLogoPosition(raw) {
+  return raw === "center" || raw === "right" ? raw : DEFAULT_LOGO_POSITION;
+}
+function logoRowJustify(position) {
+  return LOGO_POSITION_JUSTIFY[position];
+}
+
 // src/modal/index.ts
 var ModalController = class {
   constructor(options) {
@@ -2847,21 +3056,41 @@ var ModalController = class {
     this.langSelectorRefs = null;
   }
   // ─── Private ───
+  /**
+   * Sandbox auth options to forward to every API call. When `token` is set the
+   * API layer sends the single `X-Consent-Token` header, injects the subject
+   * into each request's payload, and reads org/workspace from these fields
+   * instead of decoding the JWT. Empty in the normal JWT flow.
+   */
+  sandboxParams() {
+    return {
+      token: this.options.token,
+      // The static token carries no identity; read the acting principal from the
+      // optional ucic/email/mobile. UCIC takes precedence server-side.
+      // sandboxUcic / sandboxSubject stay as fallbacks.
+      sandboxUcic: this.options.ucic || this.options.sandboxUcic,
+      sandboxSubject: this.options.email || this.options.mobile || this.options.sandboxSubject,
+      organisationUuid: this.options.organisationUuid,
+      workspaceUuid: this.options.workspaceUuid
+    };
+  }
   async fetchNotice() {
     var _a, _b, _c, _d;
     this.abortController = new AbortController();
     this.store.setState({ isLoading: true, fetchError: null });
     try {
+      const noticeBaseUrl = this.options.ledgerBaseUrl && !this.options.applicationId && !this.options.token ? this.options.ledgerBaseUrl : this.options.baseUrl;
       const data = await fetchConsentContent({
         noticeId: this.options.noticeId,
         accessToken: this.options.accessToken,
         refreshToken: this.options.refreshToken,
-        baseUrl: this.options.baseUrl,
+        baseUrl: noticeBaseUrl,
         language: this.options.language,
         specific_uuid: this.options.applicationId,
         validate_against: this.options.validateAgainst || "all",
         include_fully_consented_data: this.options.includeFullyConsentedData,
-        signal: this.abortController.signal
+        signal: this.abortController.signal,
+        ...this.sandboxParams()
       });
       const activeConfig = data.detail.active_config;
       let purposeSelections = data.detail.purpose_selections;
@@ -2923,10 +3152,11 @@ var ModalController = class {
       if (this.options.includeFullyConsentedData && needsConsentPurposes.length === 0 && alreadyConsentedPurposes.length > 0) {
         isFullyConsentedReviewMode = true;
       }
-      let selectedLanguage = this.options.language || "en";
-      if (activeConfig.default_language) {
-        selectedLanguage = activeConfig.default_language;
-      }
+      const selectedLanguage = resolveDisplayLanguage(
+        this.options.language,
+        activeConfig.default_language,
+        activeConfig.supported_languages_and_translations
+      );
       let isMinorFlow = false;
       let showAgeVerification = false;
       let restoreState = {};
@@ -3224,49 +3454,32 @@ var ModalController = class {
     (_g = this.ttsManager) == null ? void 0 : _g.fetchAudioUrls({
       accessToken: this.options.accessToken,
       baseUrl: this.options.baseUrl,
+      ledgerBaseUrl: this.options.ledgerBaseUrl,
       noticeUuid: activeConfig.notice_uuid,
       language: this.getLanguageCode(state.selectedLanguage),
-      content: activeConfig
+      content: activeConfig,
+      ...this.sandboxParams()
     });
     const topRight = el("div", {
       style: { display: "flex", alignItems: "center", gap: "8px", flexShrink: 0 }
     }, this.ttsButton, this.langSelectorRefs.container);
-    let topSection;
-    if (isMobile) {
-      const headerRow = el(
-        "div",
-        {
-          style: {
-            display: "flex",
-            alignItems: "center",
-            gap: "10px",
-            width: "100%"
-          }
-        },
-        ...logoImg ? [logoImg] : [],
+    const logoPosition = resolveLogoPosition(activeConfig.logo_position);
+    const headerRows = [];
+    if (logoImg) {
+      headerRows.push(
         el(
           "div",
-          { style: { marginLeft: "auto", display: "flex", alignItems: "center" } },
-          topRight
+          { style: { ...styles.logoRow, justifyContent: logoRowJustify(logoPosition) } },
+          logoImg
         )
       );
-      topSection = el(
-        "div",
-        {
-          style: {
-            ...styles.topSection,
-            flexDirection: "column",
-            alignItems: "stretch",
-            flexWrap: "nowrap"
-          }
-        },
-        headerRow,
-        this.noticeTitleEl
-      );
-    } else {
-      const topLeft = el("div", { style: styles.topLeft }, logoImg, this.noticeTitleEl);
-      topSection = el("div", { style: styles.topSection }, topLeft, topRight);
     }
+    headerRows.push(el("div", { style: styles.headerRow }, this.noticeTitleEl, topRight));
+    const topSection = el(
+      "div",
+      { style: { ...styles.headerStack, gap: isMobile ? "12px" : "10px" } },
+      ...headerRows
+    );
     this.middleSection = el("div", { style: styles.middleSection });
     const baseTextStyle = { ...styles.privacyText, color: textColor, fontFamily: font, fontSize: isMobile ? "14px" : "16px" };
     const noticeTextSpan = el("span", { id: "privacy-notice-text" });
@@ -3701,7 +3914,9 @@ var ModalController = class {
         meta_data: this.options.applicationId ? { specific_uuid: this.options.applicationId } : void 0,
         guardianVerificationReference: state.verificationReference || void 0,
         selfDeclaredAdult: state.selfDeclaredAdult || void 0,
-        signal: this.abortController.signal
+        language: state.selectedLanguage,
+        signal: this.abortController.signal,
+        ...this.sandboxParams()
       });
       this.options.onAccept();
       this.destroy();
@@ -4446,7 +4661,10 @@ var InlineController = class {
     this.errorEl = null;
     this.hasSubmitted = false;
     this.hasCheckedLedgerConsent = false;
+    this.fetchedWithToken = false;
+    this.fetchGeneration = 0;
     this.unsubscribe = null;
+    this.abortController = null;
     this.options = options;
     this.store = new Store({
       content: null,
@@ -4464,6 +4682,7 @@ var InlineController = class {
     this.mediaQuery = createMediaQuery("(max-width: 768px)");
   }
   async init() {
+    this.abortController = new AbortController();
     if (typeof this.options.target === "string") {
       this.targetEl = document.querySelector(this.options.target);
       if (!this.targetEl) {
@@ -4486,8 +4705,9 @@ var InlineController = class {
     await this.fetchNotice();
   }
   destroy() {
-    var _a;
-    (_a = this.unsubscribe) == null ? void 0 : _a.call(this);
+    var _a, _b;
+    (_a = this.abortController) == null ? void 0 : _a.abort();
+    (_b = this.unsubscribe) == null ? void 0 : _b.call(this);
     this.mediaQuery.destroy();
     this.store.destroy();
     if (this.hostEl && this.hostEl.parentNode) {
@@ -4500,6 +4720,10 @@ var InlineController = class {
   }
   updateToken(accessToken) {
     this.options = { ...this.options, accessToken };
+    if (accessToken && !this.fetchedWithToken) {
+      void this.fetchNotice();
+      return;
+    }
     if (this.shouldCheckLedgerConsent()) {
       void this.checkLedgerConsent();
       return;
@@ -4507,18 +4731,30 @@ var InlineController = class {
     this.tryAutoSubmit();
   }
   // ─── Private ───
+  // destroy() aborts the controller, so an aborted signal is the marker that
+  // teardown has happened and async continuations must not touch the host.
+  isDestroyed() {
+    var _a;
+    return Boolean((_a = this.abortController) == null ? void 0 : _a.signal.aborted);
+  }
   async fetchNotice() {
     var _a, _b, _c, _d;
-    this.store.setState({ isLoading: true, fetchError: null });
+    const generation = ++this.fetchGeneration;
+    this.fetchedWithToken = Boolean(this.options.accessToken);
+    this.store.setState({ isLoading: true, fetchError: null, hasAlreadyConsented: false });
     try {
       const data = await fetchConsentContentPublic({
         org_uuid: this.options.org_uuid,
         workspace_uuid: this.options.workspace_uuid,
         notice_uuid: this.options.notice_uuid,
+        accessToken: this.options.accessToken,
         baseUrl: this.options.baseUrl,
         language: this.options.language,
         specific_uuid: this.options.applicationId
       });
+      if (this.isDestroyed() || generation !== this.fetchGeneration) {
+        return;
+      }
       const activeConfig = data.detail.active_config;
       const initialCollapsed = {};
       const initialPurposes = {};
@@ -4534,12 +4770,19 @@ var InlineController = class {
       this.store.setState({
         content: activeConfig,
         isLoading: false,
-        selectedLanguage: activeConfig.default_language || this.options.language || "en",
+        selectedLanguage: resolveDisplayLanguage(
+          this.options.language,
+          activeConfig.default_language,
+          activeConfig.supported_languages_and_translations
+        ),
         collapsedPurposes: initialCollapsed,
         selectedPurposes: initialPurposes,
         selectedDataElements: initialElements
       });
     } catch (err) {
+      if (this.isDestroyed() || generation !== this.fetchGeneration) {
+        return;
+      }
       const error = err;
       if (error.status === 409) {
         this.store.setState({ hasAlreadyConsented: true, isLoading: false });
@@ -4558,7 +4801,7 @@ var InlineController = class {
   // (the 409 path governs) and for the magic-link applicationId flow. Any
   // failure returns null and falls through to the normal flow.
   async checkLedgerConsent() {
-    var _a, _b;
+    var _a, _b, _c;
     if (!this.shouldCheckLedgerConsent()) return;
     this.hasCheckedLedgerConsent = true;
     this.store.setState({ isCheckingConsent: true });
@@ -4568,15 +4811,21 @@ var InlineController = class {
         ledgerBaseUrl: this.options.ledgerBaseUrl,
         organisationUuid: this.options.org_uuid,
         workspaceUuid: this.options.workspace_uuid,
-        noticeUuid: this.options.notice_uuid
+        noticeUuid: this.options.notice_uuid,
+        signal: (_a = this.abortController) == null ? void 0 : _a.signal
       });
+      if (this.isDestroyed()) {
+        return;
+      }
       if (status && isNoticeFullyConsented(status)) {
         this.store.setState({ hasAlreadyConsented: true });
-        (_b = (_a = this.options).onAccept) == null ? void 0 : _b.call(_a);
+        (_c = (_b = this.options).onAccept) == null ? void 0 : _c.call(_b);
       }
     } finally {
-      this.store.setState({ isCheckingConsent: false });
-      this.tryAutoSubmit();
+      if (!this.isDestroyed()) {
+        this.store.setState({ isCheckingConsent: false });
+        this.tryAutoSubmit();
+      }
     }
   }
   handleStateChange(state, prevState) {
@@ -4798,6 +5047,9 @@ var InlineController = class {
   }
   async tryAutoSubmit() {
     var _a, _b;
+    if (this.isDestroyed()) {
+      return;
+    }
     const state = this.store.getState();
     const accessToken = this.options.accessToken;
     if (accessToken && state.content && this.areAllRequiredElementsChecked() && !state.isSubmitting && !state.isCheckingConsent && !state.hasAlreadyConsented && !this.hasSubmitted) {
@@ -4845,7 +5097,8 @@ var InlineController = class {
           };
         }),
         declined: false,
-        meta_data: this.options.applicationId ? { specific_uuid: this.options.applicationId } : void 0
+        meta_data: this.options.applicationId ? { specific_uuid: this.options.applicationId } : void 0,
+        language: state.selectedLanguage
       });
       (_b = (_a = this.options).onAccept) == null ? void 0 : _b.call(_a);
       this.hasSubmitted = false;