@redacto.io/consent-sdk-react-native 5.0.0-beta.6 → 5.0.0-beta.8

package/dist/index.mjs

@@ -1,6 +1,7 @@
 import {
+  SANDBOX_TOKEN_HEADER,
   toLanguageCode
-} from "./chunk-UVRSRLYW.mjs";
+} from "./chunk-B2TXWC2C.mjs";
 
 // src/RedactoNoticeConsent/RedactoNoticeConsent.tsx
 import {
@@ -29,6 +30,64 @@ import Svg3, { Path as Path3, Rect, SvgUri } from "react-native-svg";
 // src/RedactoNoticeConsent/api/index.ts
 import { jwtDecode } from "jwt-decode";
 
+// src/RedactoNoticeConsent/api/sandbox.ts
+var resolveSandboxAuth = (params) => {
+  var _a, _b, _c, _d, _e;
+  const token = (_a = params.token) == null ? void 0 : _a.trim();
+  if (!token) {
+    return null;
+  }
+  const organisationUuid = (_b = params.organisationUuid) == null ? void 0 : _b.trim();
+  const workspaceUuid = (_c = params.workspaceUuid) == null ? void 0 : _c.trim();
+  const ucic = (_d = params.sandboxUcic) == null ? void 0 : _d.trim();
+  const subject = (_e = params.sandboxSubject) == null ? void 0 : _e.trim();
+  if (!organisationUuid || !workspaceUuid) {
+    throw new Error(
+      "Sandbox mode requires organisationUuid and workspaceUuid props"
+    );
+  }
+  if (!ucic && !subject) {
+    throw new Error("Sandbox mode requires a UCIC, email, or mobile");
+  }
+  return { token, ucic, subject: subject != null ? subject : "", organisationUuid, workspaceUuid };
+};
+var resolveRequestAuth = (accessToken, sandboxParams, decodeTokenSafely2) => {
+  const sandbox = resolveSandboxAuth(sandboxParams);
+  if (sandbox) {
+    return {
+      organisationUuid: sandbox.organisationUuid,
+      workspaceUuid: sandbox.workspaceUuid,
+      sandbox
+    };
+  }
+  const decodedToken = accessToken ? decodeTokenSafely2(accessToken) : null;
+  if (!decodedToken) {
+    throw new Error("Invalid access token");
+  }
+  const { organisation_uuid, workspace_uuid } = decodedToken;
+  if (!organisation_uuid || !workspace_uuid) {
+    throw new Error("Invalid token: missing organization or workspace UUID");
+  }
+  return {
+    organisationUuid: organisation_uuid,
+    workspaceUuid: workspace_uuid,
+    sandbox: null
+  };
+};
+var buildAuthHeaders = (accessToken, sandbox) => {
+  if (sandbox) {
+    return { [SANDBOX_TOKEN_HEADER]: sandbox.token };
+  }
+  return { Authorization: `Bearer ${accessToken}` };
+};
+var sandboxBodyIdentity = (sandbox) => {
+  if (sandbox.ucic) {
+    return { org_user_id: sandbox.ucic };
+  }
+  return sandbox.subject.includes("@") ? { primary_email: sandbox.subject } : { primary_mobile: sandbox.subject };
+};
+var sandboxQueryIdentity = (sandbox) => sandboxBodyIdentity(sandbox);
+
 // src/constants.ts
 var DEFAULT_CONSENT_API_BASE_URL = "https://api.redacto.io/consent";
 
@@ -67,21 +126,19 @@ var fetchConsentContent = async ({
   specific_uuid,
   validate_against = "all",
   include_fully_consented_data = false,
-  signal
+  signal,
+  ...sandboxParams
 }) => {
-  if (!noticeId || !accessToken || !validate_against) {
-    throw new Error("noticeId and accessToken are required");
-  }
-  const decodedToken = decodeTokenSafely(accessToken);
-  if (!decodedToken) {
-    throw new Error("Invalid access token");
+  if (!noticeId || !validate_against) {
+    throw new Error("noticeId is required");
   }
-  const { organisation_uuid: ORGANISATION_UUID, workspace_uuid: WORKSPACE_UUID } = decodedToken;
-  if (!ORGANISATION_UUID || !WORKSPACE_UUID) {
-    throw new Error("Invalid token: missing organization or workspace UUID");
+  if (!accessToken && !sandboxParams.token) {
+    throw new Error("accessToken or token is required");
   }
+  const { organisationUuid: ORGANISATION_UUID, workspaceUuid: WORKSPACE_UUID, sandbox } = resolveRequestAuth(accessToken, sandboxParams, decodeTokenSafely);
   const apiBaseUrl = baseUrl || DEFAULT_CONSENT_API_BASE_URL;
-  const cacheKey = `${accessToken}-${noticeId}-${validate_against}-${language}-${specific_uuid || ""}-${include_fully_consented_data}`;
+  const cacheIdentity = sandbox ? `sandbox:${sandbox.organisationUuid}:${sandbox.workspaceUuid}:${sandbox.ucic || sandbox.subject}` : accessToken;
+  const cacheKey = `${cacheIdentity}-${noticeId}-${validate_against}-${language}-${specific_uuid || ""}-${include_fully_consented_data}`;
   if (validate_against === "all" && !specific_uuid) {
     const cachedData = getCachedData(cacheKey);
     if (cachedData) {
@@ -98,10 +155,15 @@ var fetchConsentContent = async ({
   if (include_fully_consented_data) {
     url.searchParams.append("include_fully_consented_data", "true");
   }
+  if (sandbox) {
+    for (const [key, value] of Object.entries(sandboxQueryIdentity(sandbox))) {
+      url.searchParams.append(key, value);
+    }
+  }
   const response = await fetch(url.toString(), {
     method: "GET",
     headers: {
-      Authorization: `Bearer ${accessToken}`,
+      ...buildAuthHeaders(accessToken, sandbox),
       "Accept-Language": language,
       "Content-Type": "application/json"
     },
@@ -141,20 +203,17 @@ var submitConsentEvent = async ({
   guardianVerificationReference,
   selfDeclaredAdult,
   language,
-  signal
+  signal,
+  ...sandboxParams
 }) => {
-  if (!noticeUuid || !accessToken || !Array.isArray(purposes)) {
-    throw new Error("noticeUuid, accessToken, and purposes array are required");
+  if (!noticeUuid || !Array.isArray(purposes)) {
+    throw new Error("noticeUuid and purposes array are required");
   }
-  const decodedToken = decodeTokenSafely(accessToken);
-  if (!decodedToken) {
-    throw new Error("Invalid access token");
-  }
-  const { organisation_uuid: ORGANISATION_UUID, workspace_uuid: WORKSPACE_UUID } = decodedToken;
-  if (!ORGANISATION_UUID || !WORKSPACE_UUID) {
-    throw new Error("Invalid token: missing organization or workspace UUID");
+  if (!accessToken && !sandboxParams.token) {
+    throw new Error("accessToken or token is required");
   }
-  const apiBaseUrl = ledgerBaseUrl || baseUrl || DEFAULT_CONSENT_API_BASE_URL;
+  const { organisationUuid: ORGANISATION_UUID, workspaceUuid: WORKSPACE_UUID, sandbox } = resolveRequestAuth(accessToken, sandboxParams, decodeTokenSafely);
+  const apiBaseUrl = (sandbox ? null : ledgerBaseUrl) || baseUrl || DEFAULT_CONSENT_API_BASE_URL;
   const validatedPurposes = purposes.map((purpose) => {
     if (!purpose.uuid) {
       throw new Error("Invalid purpose data: missing uuid");
@@ -180,15 +239,16 @@ var submitConsentEvent = async ({
     self_declared_adult: selfDeclaredAdult,
     language: toLanguageCode(language)
   };
+  const requestBody = sandbox ? { ...payload, ...sandboxBodyIdentity(sandbox) } : payload;
   const response = await fetch(
     `${apiBaseUrl}/public/organisations/${ORGANISATION_UUID}/workspaces/${WORKSPACE_UUID}/submit-consent`,
     {
       method: "POST",
       headers: {
-        Authorization: `Bearer ${accessToken}`,
+        ...buildAuthHeaders(accessToken, sandbox),
         "Content-Type": "application/json"
       },
-      body: JSON.stringify(payload),
+      body: JSON.stringify(requestBody),
       signal
     }
   );
@@ -214,28 +274,30 @@ var submitConsentEvent = async ({
 var fetchTTSAudioUrls = async ({
   accessToken,
   baseUrl,
+  ledgerBaseUrl,
   noticeUuid,
   language,
-  signal
+  signal,
+  ...sandboxParams
 }) => {
-  if (!accessToken || !noticeUuid || !language) {
-    throw new Error("accessToken, noticeUuid, and language are required");
-  }
-  const decodedToken = decodeTokenSafely(accessToken);
-  if (!decodedToken) {
-    throw new Error("Invalid access token");
-  }
-  const { organisation_uuid: ORGANISATION_UUID, workspace_uuid: WORKSPACE_UUID } = decodedToken;
-  if (!ORGANISATION_UUID || !WORKSPACE_UUID) {
-    throw new Error("Invalid token: missing organization or workspace UUID");
+  if (!accessToken && !sandboxParams.token || !noticeUuid || !language) {
+    throw new Error("accessToken (or token), noticeUuid, and language are required");
   }
-  const apiBaseUrl = baseUrl || DEFAULT_CONSENT_API_BASE_URL;
+  const { organisationUuid: ORGANISATION_UUID, workspaceUuid: WORKSPACE_UUID, sandbox } = resolveRequestAuth(accessToken, sandboxParams, decodeTokenSafely);
+  const apiBaseUrl = (sandbox ? null : ledgerBaseUrl) || baseUrl || DEFAULT_CONSENT_API_BASE_URL;
   const normalizedLanguage = language === "en" || language === "EN" ? "English" : language;
-  const url = `${apiBaseUrl}/public/organisations/${ORGANISATION_UUID}/workspaces/${WORKSPACE_UUID}/notices/${noticeUuid}/audio/${encodeURIComponent(normalizedLanguage)}`;
-  const response = await fetch(url, {
+  const url = new URL(
+    `${apiBaseUrl}/public/organisations/${ORGANISATION_UUID}/workspaces/${WORKSPACE_UUID}/notices/${noticeUuid}/audio/${encodeURIComponent(normalizedLanguage)}`
+  );
+  if (sandbox) {
+    for (const [key, value] of Object.entries(sandboxQueryIdentity(sandbox))) {
+      url.searchParams.append(key, value);
+    }
+  }
+  const response = await fetch(url.toString(), {
     method: "GET",
     headers: {
-      Authorization: `Bearer ${accessToken}`,
+      ...buildAuthHeaders(accessToken, sandbox),
       Accept: "application/json",
       "Content-Type": "application/json"
     },
@@ -1749,6 +1811,12 @@ var RedactoNoticeConsent = ({
   noticeId,
   accessToken,
   refreshToken: _refreshToken,
+  token,
+  email,
+  mobile,
+  ucic,
+  organisationUuid,
+  workspaceUuid,
   baseUrl,
   ledgerBaseUrl,
   settings,
@@ -1764,6 +1832,16 @@ var RedactoNoticeConsent = ({
 }) => {
   var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q, _r, _s, _t, _u;
   const { isMobile } = useResponsive();
+  const sandboxParams = useMemo(
+    () => ({
+      token,
+      sandboxUcic: ucic,
+      sandboxSubject: email || mobile,
+      organisationUuid,
+      workspaceUuid
+    }),
+    [token, ucic, email, mobile, organisationUuid, workspaceUuid]
+  );
   const [content, setContent] = useState(null);
   const [isLoading, setIsLoading] = useState(true);
   const [isSubmitting, setIsSubmitting] = useState(false);
@@ -1818,20 +1896,22 @@ var RedactoNoticeConsent = ({
     setIsLoading(true);
     setErrorMessage(null);
     try {
+      const noticeBaseUrl = ledgerBaseUrl && !applicationId && !token ? ledgerBaseUrl : baseUrl;
       const data = await fetchConsentContent({
         noticeId,
         accessToken,
-        baseUrl,
+        baseUrl: noticeBaseUrl,
         language: "English",
         validate_against: validateAgainst,
         include_fully_consented_data: includeFullyConsentedData,
         specific_uuid: applicationId,
-        signal: abortControllerRef.current.signal
+        signal: abortControllerRef.current.signal,
+        ...sandboxParams
       });
       const activeConfig2 = data.detail.active_config;
       let purposeSelections = data.detail.purpose_selections;
       let reconsentRequired = data.detail.reconsent_required || false;
-      if (ledgerBaseUrl && !applicationId) {
+      if (accessToken && ledgerBaseUrl && !applicationId && !token) {
         const ledgerStatus = await fetchNoticeConsentStatus({
           accessToken,
           ledgerBaseUrl,
@@ -1908,7 +1988,7 @@ var RedactoNoticeConsent = ({
     } finally {
       setIsLoading(false);
     }
-  }, [noticeId, accessToken, baseUrl, ledgerBaseUrl, validateAgainst, includeFullyConsentedData, applicationId, onAccept, onError]);
+  }, [noticeId, accessToken, sandboxParams, token, baseUrl, ledgerBaseUrl, validateAgainst, includeFullyConsentedData, applicationId, onAccept, onError]);
   useEffect2(() => {
     hasBootstrappedLanguageRef.current = false;
   }, [noticeId, accessToken]);
@@ -1929,8 +2009,10 @@ var RedactoNoticeConsent = ({
       const data = await fetchTTSAudioUrls({
         accessToken,
         baseUrl,
+        ledgerBaseUrl,
         noticeUuid: content.detail.active_config.notice_uuid,
-        language: selectedLanguage
+        language: selectedLanguage,
+        ...sandboxParams
       });
       const urls = {
         notice_text: data.detail.notice_text_audio_url,
@@ -1984,7 +2066,7 @@ var RedactoNoticeConsent = ({
       setTtsAudioUrls({});
       setIsTTSAvailable(false);
     }
-  }, [content, accessToken, baseUrl, selectedLanguage]);
+  }, [content, accessToken, sandboxParams, baseUrl, ledgerBaseUrl, selectedLanguage]);
   const clearPlaybackWatchers = useCallback(() => {
     if (playbackSubscriptionRef.current) {
       playbackSubscriptionRef.current.remove();
@@ -2325,7 +2407,8 @@ var RedactoNoticeConsent = ({
         meta_data: applicationId ? { specific_uuid: applicationId } : void 0,
         guardianVerificationReference: verificationReferenceRef.current || void 0,
         selfDeclaredAdult: selfDeclaredAdult || void 0,
-        language: selectedLanguage
+        language: selectedLanguage,
+        ...sandboxParams
       });
       await stopAudio();
       clearApiCache();
@@ -2340,7 +2423,7 @@ var RedactoNoticeConsent = ({
     } finally {
       setIsSubmitting(false);
     }
-  }, [content, accessToken, baseUrl, ledgerBaseUrl, applicationId, selectedPurposes, selectedDataElements, selectedLanguage, stopAudio, onAccept, onError]);
+  }, [content, accessToken, sandboxParams, baseUrl, ledgerBaseUrl, applicationId, selectedPurposes, selectedDataElements, selectedLanguage, selfDeclaredAdult, stopAudio, onAccept, onError]);
   const handleDecline = useCallback(() => {
     stopAudio();
     stopPolling();
@@ -2955,14 +3038,16 @@ var fetchConsentContent2 = async ({
   org_uuid,
   workspace_uuid,
   notice_uuid,
+  accessToken,
   baseUrl,
   language = "en",
   specific_uuid,
   signal
 }) => {
   const apiBaseUrl = baseUrl || DEFAULT_CONSENT_API_BASE_URL;
+  const noticesUrl = `${apiBaseUrl}/public/organisations/${org_uuid}/workspaces/${workspace_uuid}/notices`;
   const url = new URL(
-    `${apiBaseUrl}/public/organisations/${org_uuid}/workspaces/${workspace_uuid}/notices/get-notice/${notice_uuid}`
+    accessToken ? `${noticesUrl}/${notice_uuid}` : `${noticesUrl}/get-notice/${notice_uuid}`
   );
   if (specific_uuid) {
     url.searchParams.append("specific_uuid", specific_uuid);
@@ -2971,7 +3056,8 @@ var fetchConsentContent2 = async ({
     method: "GET",
     headers: {
       "Content-Type": "application/json",
-      "Accept-Language": language
+      "Accept-Language": language,
+      ...accessToken ? { Authorization: `Bearer ${accessToken}` } : {}
     },
     signal
   });
@@ -3412,11 +3498,13 @@ var RedactoConsentInlineComponent = ({
   const fetchNotice = useCallback2(async (signal) => {
     setIsLoading(true);
     setFetchError(null);
+    setHasAlreadyConsented(false);
     try {
       const consentContentData = await fetchConsentContent2({
         org_uuid,
         workspace_uuid,
         notice_uuid,
+        accessToken,
         baseUrl,
         language,
         specific_uuid: applicationId,
@@ -3466,7 +3554,7 @@ var RedactoConsentInlineComponent = ({
         setIsLoading(false);
       }
     }
-  }, [org_uuid, workspace_uuid, notice_uuid, baseUrl, language, applicationId, onError]);
+  }, [org_uuid, workspace_uuid, notice_uuid, accessToken, baseUrl, language, applicationId, onError]);
   useEffect3(() => {
     const controller = new AbortController();
     void fetchNotice(controller.signal);

package/dist/privacy-center.d.mts

@@ -301,6 +301,7 @@ type UserConsent = {
     product_name?: string;
     product_description?: string | null;
     nominator_info?: NominatorInfo;
+    revoke_warning_message?: string | null;
     notice_uuid?: string | null;
 };
 type NominatorInfo = {
@@ -333,6 +334,7 @@ type PurposeItem = {
     method: string;
     data_elements: ConsentDataElement[];
     link_reason: string | null;
+    revoke_warning_message?: string | null;
     notice_uuid?: string | null;
 };
 type ConsentGroup = {
@@ -484,6 +486,29 @@ type CaseDetailsTab = Readonly<{
     id: TabId;
     label: string;
 }>;
+/**
+ * One data principal sharing this session's contact.
+ *
+ * `org_user_id` is unique per principal within the org/workspace, so it is the
+ * reliable way to tell profiles apart when the email and mobile are identical —
+ * which is the whole point of a shared contact.
+ */
+type IdentityCandidate = Readonly<{
+    uuid: string;
+    org_user_id?: string | null;
+    primary_email?: string | null;
+    primary_mobile?: string | null;
+    created_at?: string | null;
+}>;
+type IdentityListResponse = Readonly<{
+    identities: IdentityCandidate[];
+}>;
+/** Fresh tokens scoped to the chosen principal. */
+type SelectPrincipalResponse = Readonly<{
+    token: string;
+    refresh_token: string;
+    expires_at?: string;
+}>;
 
 type InternalPage = 'home' | 'consent-manager' | 'form' | 'activity' | 'receipts' | 'case-details' | 'notifications';
 interface NavigationContextType {
@@ -512,15 +537,38 @@ interface RedactoPrivacyCenterProps {
      * Accepted for backwards compatibility but ignored.
      */
     theme?: 'light' | 'dark';
-    accessToken: string;
-    refreshToken: string;
+    /** JWT access token. Optional so sandbox mode (see `token`) can omit it. */
+    accessToken?: string;
+    /** JWT refresh token. Optional; used by the OTP-refresh loop in the JWT flow. */
+    refreshToken?: string;
+    /**
+     * Sandbox PoC: a pasted static token. When set, the Privacy Center runs
+     * against the sandbox with no JWT — it sends the single `X-Consent-Token`
+     * header, carries the acting identity (`email` || `mobile`) in each request's
+     * own payload, takes org/workspace from `organisationUuid`/`workspaceUuid`,
+     * and never calls `/otp/refresh`.
+     */
+    token?: string;
+    /** Sandbox test subject email (carried in the request payload when set). */
+    email?: string;
+    /** Sandbox test subject mobile (fallback subject when `email` is absent). */
+    mobile?: string;
+    /**
+     * Sandbox UCIC: the client's own user id / org_user_id, e.g. a UUID or
+     * customer code; optional third identifier alongside email/mobile.
+     */
+    ucic?: string;
+    /** Sandbox org UUID (replaces the JWT-decoded org in sandbox mode). */
+    organisationUuid?: string;
+    /** Sandbox workspace UUID (replaces the JWT-decoded workspace in sandbox mode). */
+    workspaceUuid?: string;
     onError: (error: Error) => boolean;
     initialPage?: InternalPage;
     /** Optional deep-link: open a specific case (use with initialPage='case-details'). */
     initialCaseUuid?: string;
     onBack?: 'back' | 'signout';
 }
-declare function RedactoPrivacyCenter({ baseUrl, ledgerBaseUrl, slug, theme: _theme, accessToken, refreshToken, onError, initialPage, initialCaseUuid, onBack, }: RedactoPrivacyCenterProps): React.JSX.Element;
+declare function RedactoPrivacyCenter({ baseUrl, ledgerBaseUrl, slug, theme: _theme, accessToken, refreshToken, token, email, mobile, ucic, organisationUuid, workspaceUuid, onError, initialPage, initialCaseUuid, onBack, }: RedactoPrivacyCenterProps): React.JSX.Element;
 
 declare function ConsentManager(): React__default.JSX.Element;
 
@@ -704,6 +752,18 @@ declare function createConsentClient(baseUrl: string, ledgerBaseUrl?: string): {
      * Get activities (privacy center)
      */
     getActivities(baseRequest: BaseRequest, offset?: number, limit?: number, language?: string, authToken?: string, options?: Omit<ApiFetchOptions, "getAuthToken">): Promise<unknown>;
+    /**
+     * List all data principals that share this session's contact
+     * (shared-contact profile picker). Identity is derived server-side from the
+     * JWT — the caller sends nothing but its bearer token.
+     */
+    listIdentities(baseRequest: BaseRequest, authToken?: string, options?: Omit<ApiFetchOptions, "getAuthToken">): Promise<IdentityListResponse>;
+    /**
+     * Re-scope the session to a chosen principal uuid (must be one of the
+     * principals sharing this session's contact). Returns fresh access/refresh
+     * tokens scoped to that principal.
+     */
+    selectPrincipal(baseRequest: BaseRequest, principalUuid: string, authToken?: string, options?: Omit<ApiFetchOptions, "getAuthToken">): Promise<SelectPrincipalResponse>;
     /**
      * Get receipts (privacy center)
      */
@@ -876,9 +936,26 @@ interface AuthProviderProps {
     children: ReactNode;
     accessToken: string;
     refreshToken: string;
+    /**
+     * Sandbox PoC: when set, the Privacy Center skips the JWT entirely — it seeds
+     * org/workspace/subject from the props below, sends the single
+     * `X-Consent-Token` header, carries the acting identity in each request's own
+     * payload, and never calls `/otp/refresh`.
+     */
+    token?: string;
+    /** Sandbox UCIC — the client's own user id (`org_user_id`); takes precedence over the subject. */
+    sandboxUcic?: string;
+    /** Sandbox subject (email or mobile) — carried in the request payload. */
+    sandboxSubject?: string;
+    /** Sandbox org UUID (replaces the JWT-decoded org). */
+    organisationUuid?: string;
+    /** Sandbox workspace UUID (replaces the JWT-decoded workspace). */
+    workspaceUuid?: string;
+    /** Organisation slug — used to seed the sandbox config. */
+    slug?: string;
     onError: (error: Error) => boolean;
 }
-declare function AuthProvider({ children, accessToken: initialAccessToken, refreshToken: initialRefreshToken, onError }: AuthProviderProps): React.JSX.Element;
+declare function AuthProvider(props: AuthProviderProps): React.JSX.Element;
 declare function useAuth(): AuthContextType;
 
 /**

package/dist/privacy-center.d.ts

@@ -301,6 +301,7 @@ type UserConsent = {
     product_name?: string;
     product_description?: string | null;
     nominator_info?: NominatorInfo;
+    revoke_warning_message?: string | null;
     notice_uuid?: string | null;
 };
 type NominatorInfo = {
@@ -333,6 +334,7 @@ type PurposeItem = {
     method: string;
     data_elements: ConsentDataElement[];
     link_reason: string | null;
+    revoke_warning_message?: string | null;
     notice_uuid?: string | null;
 };
 type ConsentGroup = {
@@ -484,6 +486,29 @@ type CaseDetailsTab = Readonly<{
     id: TabId;
     label: string;
 }>;
+/**
+ * One data principal sharing this session's contact.
+ *
+ * `org_user_id` is unique per principal within the org/workspace, so it is the
+ * reliable way to tell profiles apart when the email and mobile are identical —
+ * which is the whole point of a shared contact.
+ */
+type IdentityCandidate = Readonly<{
+    uuid: string;
+    org_user_id?: string | null;
+    primary_email?: string | null;
+    primary_mobile?: string | null;
+    created_at?: string | null;
+}>;
+type IdentityListResponse = Readonly<{
+    identities: IdentityCandidate[];
+}>;
+/** Fresh tokens scoped to the chosen principal. */
+type SelectPrincipalResponse = Readonly<{
+    token: string;
+    refresh_token: string;
+    expires_at?: string;
+}>;
 
 type InternalPage = 'home' | 'consent-manager' | 'form' | 'activity' | 'receipts' | 'case-details' | 'notifications';
 interface NavigationContextType {
@@ -512,15 +537,38 @@ interface RedactoPrivacyCenterProps {
      * Accepted for backwards compatibility but ignored.
      */
     theme?: 'light' | 'dark';
-    accessToken: string;
-    refreshToken: string;
+    /** JWT access token. Optional so sandbox mode (see `token`) can omit it. */
+    accessToken?: string;
+    /** JWT refresh token. Optional; used by the OTP-refresh loop in the JWT flow. */
+    refreshToken?: string;
+    /**
+     * Sandbox PoC: a pasted static token. When set, the Privacy Center runs
+     * against the sandbox with no JWT — it sends the single `X-Consent-Token`
+     * header, carries the acting identity (`email` || `mobile`) in each request's
+     * own payload, takes org/workspace from `organisationUuid`/`workspaceUuid`,
+     * and never calls `/otp/refresh`.
+     */
+    token?: string;
+    /** Sandbox test subject email (carried in the request payload when set). */
+    email?: string;
+    /** Sandbox test subject mobile (fallback subject when `email` is absent). */
+    mobile?: string;
+    /**
+     * Sandbox UCIC: the client's own user id / org_user_id, e.g. a UUID or
+     * customer code; optional third identifier alongside email/mobile.
+     */
+    ucic?: string;
+    /** Sandbox org UUID (replaces the JWT-decoded org in sandbox mode). */
+    organisationUuid?: string;
+    /** Sandbox workspace UUID (replaces the JWT-decoded workspace in sandbox mode). */
+    workspaceUuid?: string;
     onError: (error: Error) => boolean;
     initialPage?: InternalPage;
     /** Optional deep-link: open a specific case (use with initialPage='case-details'). */
     initialCaseUuid?: string;
     onBack?: 'back' | 'signout';
 }
-declare function RedactoPrivacyCenter({ baseUrl, ledgerBaseUrl, slug, theme: _theme, accessToken, refreshToken, onError, initialPage, initialCaseUuid, onBack, }: RedactoPrivacyCenterProps): React.JSX.Element;
+declare function RedactoPrivacyCenter({ baseUrl, ledgerBaseUrl, slug, theme: _theme, accessToken, refreshToken, token, email, mobile, ucic, organisationUuid, workspaceUuid, onError, initialPage, initialCaseUuid, onBack, }: RedactoPrivacyCenterProps): React.JSX.Element;
 
 declare function ConsentManager(): React__default.JSX.Element;
 
@@ -704,6 +752,18 @@ declare function createConsentClient(baseUrl: string, ledgerBaseUrl?: string): {
      * Get activities (privacy center)
      */
     getActivities(baseRequest: BaseRequest, offset?: number, limit?: number, language?: string, authToken?: string, options?: Omit<ApiFetchOptions, "getAuthToken">): Promise<unknown>;
+    /**
+     * List all data principals that share this session's contact
+     * (shared-contact profile picker). Identity is derived server-side from the
+     * JWT — the caller sends nothing but its bearer token.
+     */
+    listIdentities(baseRequest: BaseRequest, authToken?: string, options?: Omit<ApiFetchOptions, "getAuthToken">): Promise<IdentityListResponse>;
+    /**
+     * Re-scope the session to a chosen principal uuid (must be one of the
+     * principals sharing this session's contact). Returns fresh access/refresh
+     * tokens scoped to that principal.
+     */
+    selectPrincipal(baseRequest: BaseRequest, principalUuid: string, authToken?: string, options?: Omit<ApiFetchOptions, "getAuthToken">): Promise<SelectPrincipalResponse>;
     /**
      * Get receipts (privacy center)
      */
@@ -876,9 +936,26 @@ interface AuthProviderProps {
     children: ReactNode;
     accessToken: string;
     refreshToken: string;
+    /**
+     * Sandbox PoC: when set, the Privacy Center skips the JWT entirely — it seeds
+     * org/workspace/subject from the props below, sends the single
+     * `X-Consent-Token` header, carries the acting identity in each request's own
+     * payload, and never calls `/otp/refresh`.
+     */
+    token?: string;
+    /** Sandbox UCIC — the client's own user id (`org_user_id`); takes precedence over the subject. */
+    sandboxUcic?: string;
+    /** Sandbox subject (email or mobile) — carried in the request payload. */
+    sandboxSubject?: string;
+    /** Sandbox org UUID (replaces the JWT-decoded org). */
+    organisationUuid?: string;
+    /** Sandbox workspace UUID (replaces the JWT-decoded workspace). */
+    workspaceUuid?: string;
+    /** Organisation slug — used to seed the sandbox config. */
+    slug?: string;
     onError: (error: Error) => boolean;
 }
-declare function AuthProvider({ children, accessToken: initialAccessToken, refreshToken: initialRefreshToken, onError }: AuthProviderProps): React.JSX.Element;
+declare function AuthProvider(props: AuthProviderProps): React.JSX.Element;
 declare function useAuth(): AuthContextType;
 
 /**