@redacto.io/consent-sdk-react 10.0.0-beta.8 → 10.0.0-beta.9

package/dist/index.mjs

@@ -1,6 +1,7 @@
 import {
+  SANDBOX_TOKEN_HEADER,
   useMediaQuery
-} from "./chunk-6A665OPR.mjs";
+} from "./chunk-OGL6OC3A.mjs";
 
 // src/RedactoNoticeConsent/RedactoNoticeConsent.tsx
 import { useCallback, useEffect, useMemo, useRef, useState } from "react";
@@ -66,6 +67,64 @@ async function parseApiError(response, fallbackMessage) {
   });
 }
 
+// src/RedactoNoticeConsent/api/sandbox.ts
+var resolveSandboxAuth = (params) => {
+  var _a, _b, _c, _d, _e;
+  const token = (_a = params.token) == null ? void 0 : _a.trim();
+  if (!token) {
+    return null;
+  }
+  const organisationUuid = (_b = params.organisationUuid) == null ? void 0 : _b.trim();
+  const workspaceUuid = (_c = params.workspaceUuid) == null ? void 0 : _c.trim();
+  const ucic = (_d = params.sandboxUcic) == null ? void 0 : _d.trim();
+  const subject = (_e = params.sandboxSubject) == null ? void 0 : _e.trim();
+  if (!organisationUuid || !workspaceUuid) {
+    throw new Error(
+      "Sandbox mode requires organisationUuid and workspaceUuid props"
+    );
+  }
+  if (!ucic && !subject) {
+    throw new Error("Sandbox mode requires a UCIC, email, or mobile");
+  }
+  return { token, ucic, subject: subject != null ? subject : "", organisationUuid, workspaceUuid };
+};
+var resolveRequestAuth = (accessToken, sandboxParams, decodeTokenSafely2) => {
+  const sandbox = resolveSandboxAuth(sandboxParams);
+  if (sandbox) {
+    return {
+      organisationUuid: sandbox.organisationUuid,
+      workspaceUuid: sandbox.workspaceUuid,
+      sandbox
+    };
+  }
+  const decodedToken = accessToken ? decodeTokenSafely2(accessToken) : null;
+  if (!decodedToken) {
+    throw new Error("Invalid access token");
+  }
+  const { organisation_uuid, workspace_uuid } = decodedToken;
+  if (!organisation_uuid || !workspace_uuid) {
+    throw new Error("Invalid token: missing organization or workspace UUID");
+  }
+  return {
+    organisationUuid: organisation_uuid,
+    workspaceUuid: workspace_uuid,
+    sandbox: null
+  };
+};
+var buildAuthHeaders = (accessToken, sandbox) => {
+  if (sandbox) {
+    return { [SANDBOX_TOKEN_HEADER]: sandbox.token };
+  }
+  return { Authorization: `Bearer ${accessToken}` };
+};
+var sandboxBodyIdentity = (sandbox) => {
+  if (sandbox.ucic) {
+    return { org_user_id: sandbox.ucic };
+  }
+  return sandbox.subject.includes("@") ? { primary_email: sandbox.subject } : { primary_mobile: sandbox.subject };
+};
+var sandboxQueryIdentity = (sandbox) => sandboxBodyIdentity(sandbox);
+
 // src/shared/notice-consent-status.ts
 import { jwtDecode } from "jwt-decode";
 var decodeNoticeConsentToken = (token) => {
@@ -179,21 +238,19 @@ var fetchConsentContent = async ({
   specific_uuid,
   validate_against = "all",
   include_fully_consented_data = false,
-  signal
+  signal,
+  ...sandboxParams
 }) => {
-  if (!noticeId || !accessToken || !validate_against) {
-    throw new Error("noticeId and accessToken are required");
+  if (!noticeId || !validate_against) {
+    throw new Error("noticeId is required");
   }
-  const decodedToken = decodeTokenSafely(accessToken);
-  if (!decodedToken) {
-    throw new Error("Invalid access token");
-  }
-  const { organisation_uuid: ORGANISATION_UUID, workspace_uuid: WORKSPACE_UUID } = decodedToken;
-  if (!ORGANISATION_UUID || !WORKSPACE_UUID) {
-    throw new Error("Invalid token: missing organization or workspace UUID");
+  if (!accessToken && !sandboxParams.token) {
+    throw new Error("accessToken or token is required");
   }
+  const { organisationUuid: ORGANISATION_UUID, workspaceUuid: WORKSPACE_UUID, sandbox } = resolveRequestAuth(accessToken, sandboxParams, decodeTokenSafely);
   const apiBaseUrl = baseUrl || BASE_URL;
-  const cacheKey = `${accessToken}-${noticeId}-${validate_against}-${language}-${specific_uuid || ""}-${include_fully_consented_data}`;
+  const cacheIdentity = sandbox ? `sandbox:${sandbox.organisationUuid}:${sandbox.workspaceUuid}:${sandbox.ucic || sandbox.subject}` : accessToken;
+  const cacheKey = `${cacheIdentity}-${noticeId}-${validate_against}-${language}-${specific_uuid || ""}-${include_fully_consented_data}`;
   if (validate_against === "all" && !specific_uuid) {
     const cachedData = getCachedData(cacheKey);
     if (cachedData) {
@@ -210,10 +267,15 @@ var fetchConsentContent = async ({
   if (include_fully_consented_data) {
     url.searchParams.append("include_fully_consented_data", "true");
   }
+  if (sandbox) {
+    for (const [key, value] of Object.entries(sandboxQueryIdentity(sandbox))) {
+      url.searchParams.append(key, value);
+    }
+  }
   const response = await fetch(url.toString(), {
     method: "GET",
     headers: {
-      Authorization: `Bearer ${accessToken}`,
+      ...buildAuthHeaders(accessToken, sandbox),
       "Accept-Language": language
     },
     signal
@@ -241,20 +303,17 @@ var submitConsentEvent = async ({
   meta_data,
   guardianVerificationReference,
   selfDeclaredAdult,
-  signal
+  signal,
+  ...sandboxParams
 }) => {
-  if (!noticeUuid || !accessToken || !Array.isArray(purposes)) {
-    throw new Error("noticeUuid, accessToken, and purposes array are required");
-  }
-  const decodedToken = decodeTokenSafely(accessToken);
-  if (!decodedToken) {
-    throw new Error("Invalid access token");
+  if (!noticeUuid || !Array.isArray(purposes)) {
+    throw new Error("noticeUuid and purposes array are required");
   }
-  const { organisation_uuid: ORGANISATION_UUID, workspace_uuid: WORKSPACE_UUID } = decodedToken;
-  if (!ORGANISATION_UUID || !WORKSPACE_UUID) {
-    throw new Error("Invalid token: missing organization or workspace UUID");
+  if (!accessToken && !sandboxParams.token) {
+    throw new Error("accessToken or token is required");
   }
-  const apiBaseUrl = ledgerBaseUrl || baseUrl || BASE_URL;
+  const { organisationUuid: ORGANISATION_UUID, workspaceUuid: WORKSPACE_UUID, sandbox } = resolveRequestAuth(accessToken, sandboxParams, decodeTokenSafely);
+  const apiBaseUrl = (sandbox ? null : ledgerBaseUrl) || baseUrl || BASE_URL;
   const validatedPurposes = purposes.map((purpose) => {
     if (!purpose.uuid) {
       throw new Error(`Invalid purpose data: missing uuid`);
@@ -280,15 +339,16 @@ var submitConsentEvent = async ({
     guardian_verification_reference: guardianVerificationReference,
     self_declared_adult: selfDeclaredAdult
   };
+  const requestBody = sandbox ? { ...payload, ...sandboxBodyIdentity(sandbox) } : payload;
   const response = await fetch(
     `${apiBaseUrl}/public/organisations/${ORGANISATION_UUID}/workspaces/${WORKSPACE_UUID}/submit-consent`,
     {
       method: "POST",
       headers: {
-        Authorization: `Bearer ${accessToken}`,
+        ...buildAuthHeaders(accessToken, sandbox),
         "Content-Type": "application/json"
       },
-      body: JSON.stringify(payload),
+      body: JSON.stringify(requestBody),
       signal
     }
   );
@@ -344,25 +404,26 @@ var fetchTTSAudioUrls = async ({
   baseUrl,
   noticeUuid,
   language,
-  signal
+  signal,
+  ...sandboxParams
 }) => {
-  if (!accessToken || !noticeUuid || !language) {
-    throw new Error("accessToken, noticeUuid, and language are required");
-  }
-  const decodedToken = decodeTokenSafely(accessToken);
-  if (!decodedToken) {
-    throw new Error("Invalid access token");
-  }
-  const { organisation_uuid: ORGANISATION_UUID, workspace_uuid: WORKSPACE_UUID } = decodedToken;
-  if (!ORGANISATION_UUID || !WORKSPACE_UUID) {
-    throw new Error("Invalid token: missing organization or workspace UUID");
+  if (!accessToken && !sandboxParams.token || !noticeUuid || !language) {
+    throw new Error("accessToken (or token), noticeUuid, and language are required");
   }
+  const { organisationUuid: ORGANISATION_UUID, workspaceUuid: WORKSPACE_UUID, sandbox } = resolveRequestAuth(accessToken, sandboxParams, decodeTokenSafely);
   const apiBaseUrl = baseUrl || BASE_URL;
-  const url = `${apiBaseUrl}/public/organisations/${ORGANISATION_UUID}/workspaces/${WORKSPACE_UUID}/notices/${noticeUuid}/audio/${language}`;
-  const response = await fetch(url, {
+  const url = new URL(
+    `${apiBaseUrl}/public/organisations/${ORGANISATION_UUID}/workspaces/${WORKSPACE_UUID}/notices/${noticeUuid}/audio/${language}`
+  );
+  if (sandbox) {
+    for (const [key, value] of Object.entries(sandboxQueryIdentity(sandbox))) {
+      url.searchParams.append(key, value);
+    }
+  }
+  const response = await fetch(url.toString(), {
     method: "GET",
     headers: {
-      Authorization: `Bearer ${accessToken}`,
+      ...buildAuthHeaders(accessToken, sandbox),
       Accept: "application/json"
     },
     signal
@@ -404,7 +465,10 @@ var initiateGuardianVerification = async ({
     if (!decodedToken) {
       throw new Error("Invalid access token");
     }
-    const { organisation_uuid: ORGANISATION_UUID, workspace_uuid: WORKSPACE_UUID } = decodedToken;
+    const {
+      organisation_uuid: ORGANISATION_UUID,
+      workspace_uuid: WORKSPACE_UUID
+    } = decodedToken;
     if (!ORGANISATION_UUID || !WORKSPACE_UUID) {
       throw new Error("Invalid token: missing organization or workspace UUID");
     }
@@ -478,7 +542,10 @@ var verifyGuardianStatus = async ({
   if (!decodedToken) {
     throw new Error("Invalid access token");
   }
-  const { organisation_uuid: ORGANISATION_UUID, workspace_uuid: WORKSPACE_UUID } = decodedToken;
+  const {
+    organisation_uuid: ORGANISATION_UUID,
+    workspace_uuid: WORKSPACE_UUID
+  } = decodedToken;
   if (!ORGANISATION_UUID || !WORKSPACE_UUID) {
     throw new Error("Invalid token: missing organization or workspace UUID");
   }
@@ -491,9 +558,7 @@ var verifyGuardianStatus = async ({
         Authorization: `Bearer ${accessToken}`,
         "Content-Type": "application/json"
       },
-      body: JSON.stringify({
-        session_token: sessionToken
-      }),
+      body: JSON.stringify({ session_token: sessionToken }),
       signal
     }
   );
@@ -2355,6 +2420,12 @@ var RedactoNoticeConsent = ({
   noticeId,
   accessToken,
   refreshToken,
+  token,
+  email,
+  mobile,
+  ucic,
+  organisationUuid,
+  workspaceUuid,
   baseUrl,
   ledgerBaseUrl,
   language = "en",
@@ -2373,15 +2444,43 @@ var RedactoNoticeConsent = ({
   reviewModeButtonText = "Continue"
 }) => {
   var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q;
+  const sandboxParams = useMemo(
+    () => ({
+      token,
+      sandboxUcic: ucic,
+      sandboxSubject: email || mobile,
+      organisationUuid,
+      workspaceUuid
+    }),
+    [token, ucic, email, mobile, organisationUuid, workspaceUuid]
+  );
   const propValidationError = useMemo(() => {
     if (!(noticeId == null ? void 0 : noticeId.trim())) {
       return "RedactoNoticeConsent: 'noticeId' prop is required and cannot be empty";
     }
+    if (token == null ? void 0 : token.trim()) {
+      if (!(organisationUuid == null ? void 0 : organisationUuid.trim()) || !(workspaceUuid == null ? void 0 : workspaceUuid.trim())) {
+        return "RedactoNoticeConsent: sandbox mode requires 'organisationUuid' and 'workspaceUuid'";
+      }
+      if (!(email == null ? void 0 : email.trim()) && !(mobile == null ? void 0 : mobile.trim()) && !(ucic == null ? void 0 : ucic.trim())) {
+        return "RedactoNoticeConsent: sandbox mode requires 'email', 'mobile', or 'ucic'";
+      }
+      return null;
+    }
     if (!(accessToken == null ? void 0 : accessToken.trim())) {
       return "RedactoNoticeConsent: 'accessToken' prop is required and cannot be empty";
     }
     return null;
-  }, [noticeId, accessToken]);
+  }, [
+    noticeId,
+    accessToken,
+    token,
+    organisationUuid,
+    workspaceUuid,
+    email,
+    mobile,
+    ucic
+  ]);
   if (propValidationError) {
     return /* @__PURE__ */ jsxs(
       "div",
@@ -2734,7 +2833,8 @@ var RedactoNoticeConsent = ({
         specific_uuid: applicationId,
         validate_against: validateAgainst,
         include_fully_consented_data: includeFullyConsentedData,
-        signal: (_a2 = abortControllerRef.current) == null ? void 0 : _a2.signal
+        signal: (_a2 = abortControllerRef.current) == null ? void 0 : _a2.signal,
+        ...sandboxParams
       });
       const activeConfig = consentContentData.detail.active_config;
       setContent(activeConfig);
@@ -2759,7 +2859,8 @@ var RedactoNoticeConsent = ({
           accessToken,
           ledgerBaseUrl,
           noticeUuid: noticeId,
-          signal: (_b2 = abortControllerRef.current) == null ? void 0 : _b2.signal
+          signal: (_b2 = abortControllerRef.current) == null ? void 0 : _b2.signal,
+          ...sandboxParams
         });
         if (ledgerStatus) {
           const overlay = buildLedgerConsentOverlay(
@@ -2891,6 +2992,7 @@ var RedactoNoticeConsent = ({
     noticeId,
     accessToken,
     refreshToken,
+    sandboxParams,
     language,
     applicationId,
     validateAgainst,
@@ -3007,7 +3109,8 @@ var RedactoNoticeConsent = ({
           meta_data: applicationId ? { specific_uuid: applicationId } : void 0,
           guardianVerificationReference: verificationReference || void 0,
           selfDeclaredAdult: selfDeclaredAdult || void 0,
-          signal: submitController.signal
+          signal: submitController.signal,
+          ...sandboxParams
         });
       }
       onAccept == null ? void 0 : onAccept();
@@ -3190,7 +3293,7 @@ var RedactoNoticeConsent = ({
     } finally {
       setIsSubmittingGuardian(false);
     }
-  }, [accessToken, baseUrl, guardianFormData, digilockerMode, digilockerCallbackUrl, selectedPurposes, selectedDataElements, noticeId, onError]);
+  }, [accessToken, sandboxParams, baseUrl, guardianFormData, digilockerMode, digilockerCallbackUrl, selectedPurposes, selectedDataElements, noticeId, onError]);
   const handleAgeVerificationYes = useCallback(() => {
     setShowAgeVerification(false);
     setIsMinorFlow(false);
@@ -3247,7 +3350,7 @@ var RedactoNoticeConsent = ({
     setIsPollingStatus(false);
     isPollingStatusRef.current = false;
     setIsInitiatingVerification(false);
-  }, [accessToken, baseUrl]);
+  }, [accessToken, sandboxParams, baseUrl]);
   const startPopupMonitoring = useCallback((popup) => {
     popupCheckIntervalRef.current = window.setInterval(() => {
       if (popup.closed) {
@@ -3275,8 +3378,8 @@ var RedactoNoticeConsent = ({
     []
   );
   const startStatusPolling = useCallback(
-    (token) => {
-      verificationSessionTokenRef.current = token;
+    (token2) => {
+      verificationSessionTokenRef.current = token2;
       setIsPollingStatus(true);
       isPollingStatusRef.current = true;
       setVerificationError(null);
@@ -3328,7 +3431,7 @@ var RedactoNoticeConsent = ({
           const response = await verifyGuardianStatus({
             accessToken,
             baseUrl,
-            sessionToken: token
+            sessionToken: token2
           });
           consecutiveErrors = 0;
           if (response.status === "verified") {
@@ -3398,7 +3501,7 @@ var RedactoNoticeConsent = ({
       };
       statusPollIntervalRef.current = window.setTimeout(poll, POLL_INTERVAL);
     },
-    [accessToken, baseUrl, getVerificationErrorMessage]
+    [accessToken, sandboxParams, baseUrl, getVerificationErrorMessage]
   );
   const handleBackToGuardianForm = useCallback((clearName = false) => {
     var _a2, _b2;
@@ -3740,7 +3843,8 @@ var RedactoNoticeConsent = ({
       baseUrl,
       noticeUuid: content.notice_uuid,
       language: languageCode,
-      signal: ttsAbortController.signal
+      signal: ttsAbortController.signal,
+      ...sandboxParams
     }).then((response) => {
       setTtsAudioUrls(response.detail);
       setIsTTSAvailable(true);
@@ -3753,7 +3857,7 @@ var RedactoNoticeConsent = ({
     return () => {
       ttsAbortController.abort();
     };
-  }, [content, selectedLanguage, accessToken, baseUrl, getLanguageCode]);
+  }, [content, selectedLanguage, accessToken, sandboxParams, baseUrl, getLanguageCode]);
   const modalStyle = {
     borderRadius: (settings == null ? void 0 : settings.borderRadius) || "8px",
     backgroundColor: (settings == null ? void 0 : settings.backgroundColor) || "#ffffff"

package/dist/privacy-center.d.mts

@@ -382,6 +382,7 @@ type NominatorInfo = {
 };
 type PurposeItem = {
     purpose_uuid: string;
+    uuid?: string;
     name: string;
     description: string | null;
     status: ConsentStatusEnum | string;
@@ -661,13 +662,36 @@ interface RedactoPrivacyCenterProps {
     baseUrl: string;
     ledgerBaseUrl?: string;
     slug: string;
-    accessToken: string;
-    refreshToken: string;
+    /** JWT access token. Optional so sandbox mode (see `token`) can omit it. */
+    accessToken?: string;
+    /** JWT refresh token. Optional; used by the OTP-refresh loop in the JWT flow. */
+    refreshToken?: string;
+    /**
+     * Sandbox PoC: a pasted static token. When set, the Privacy Center runs
+     * against the sandbox with no JWT — it sends the single `X-Consent-Token`
+     * header, carries the acting identity (`email` || `mobile`) in each request's
+     * own payload, takes org/workspace from `organisationUuid`/`workspaceUuid`,
+     * and never calls `/otp/refresh`.
+     */
+    token?: string;
+    /** Sandbox test subject email (carried in the request payload when set). */
+    email?: string;
+    /** Sandbox test subject mobile (fallback subject when `email` is absent). */
+    mobile?: string;
+    /**
+     * Sandbox UCIC: the client's own user id / org_user_id, e.g. a UUID or
+     * customer code; optional third identifier alongside email/mobile.
+     */
+    ucic?: string;
+    /** Sandbox org UUID (replaces the JWT-decoded org in sandbox mode). */
+    organisationUuid?: string;
+    /** Sandbox workspace UUID (replaces the JWT-decoded workspace in sandbox mode). */
+    workspaceUuid?: string;
     onError: (error: Error) => boolean;
     initialPage?: InternalPage;
     onBack?: 'back' | 'signout';
 }
-declare function RedactoPrivacyCenter({ baseUrl, ledgerBaseUrl, slug, accessToken, refreshToken, onError, initialPage, onBack, }: RedactoPrivacyCenterProps): react.JSX.Element;
+declare function RedactoPrivacyCenter({ baseUrl, ledgerBaseUrl, slug, accessToken, refreshToken, token, email, mobile, ucic, organisationUuid, workspaceUuid, onError, initialPage, onBack, }: RedactoPrivacyCenterProps): react.JSX.Element;
 
 interface PrivacyCenterLayoutProps {
     children: ReactNode;
@@ -688,6 +712,29 @@ declare const PrivacyCenterCaseDetailsPage: () => react.JSX.Element | null;
 
 declare const NotificationsPage: () => react.JSX.Element;
 
+type AuthProviderProps = Readonly<{
+    children: ReactNode;
+    accessToken?: string;
+    refreshToken?: string;
+    /**
+     * Sandbox PoC: when set, the Privacy Center skips the JWT entirely — it seeds
+     * org/workspace/subject from the props below, sends the single
+     * `X-Consent-Token` header, carries the acting identity in each request's own
+     * payload, and never calls `/otp/refresh`.
+     */
+    token?: string;
+    /** Sandbox UCIC — the client's own user id (`org_user_id`); takes precedence over the subject. */
+    sandboxUcic?: string;
+    /** Sandbox subject (email or mobile) — carried in the request payload. */
+    sandboxSubject?: string;
+    /** Sandbox org UUID (replaces the JWT-decoded org). */
+    organisationUuid?: string;
+    /** Sandbox workspace UUID (replaces the JWT-decoded workspace). */
+    workspaceUuid?: string;
+    /** Organisation slug — used to seed sandbox sessionStorage. */
+    slug?: string;
+    onError: (error: Error) => boolean;
+}>;
 type AuthContextValue = Readonly<{
     accessToken: string;
     refreshToken: string;
@@ -878,13 +925,7 @@ declare const fetchCaseHistory: (organizationId: string, workspaceId: string, co
 
 declare const useCaseHistory: (organizationId: string | undefined, workspaceId: string | undefined, contact: string | undefined, authContext?: AuthContext) => _tanstack_react_query.UseQueryResult<NoInfer<CaseRequest[]>, Error>;
 
-interface AuthProviderProps {
-    children: ReactNode;
-    accessToken: string;
-    refreshToken: string;
-    onError: (error: Error) => boolean;
-}
-declare const AuthProvider: ({ children, accessToken: initialAccessToken, refreshToken: initialRefreshToken, onError, }: AuthProviderProps) => react.JSX.Element;
+declare const AuthProvider: (props: AuthProviderProps) => react.JSX.Element;
 declare const useAuth: () => AuthContextValue;
 
 /**

package/dist/privacy-center.d.ts

@@ -382,6 +382,7 @@ type NominatorInfo = {
 };
 type PurposeItem = {
     purpose_uuid: string;
+    uuid?: string;
     name: string;
     description: string | null;
     status: ConsentStatusEnum | string;
@@ -661,13 +662,36 @@ interface RedactoPrivacyCenterProps {
     baseUrl: string;
     ledgerBaseUrl?: string;
     slug: string;
-    accessToken: string;
-    refreshToken: string;
+    /** JWT access token. Optional so sandbox mode (see `token`) can omit it. */
+    accessToken?: string;
+    /** JWT refresh token. Optional; used by the OTP-refresh loop in the JWT flow. */
+    refreshToken?: string;
+    /**
+     * Sandbox PoC: a pasted static token. When set, the Privacy Center runs
+     * against the sandbox with no JWT — it sends the single `X-Consent-Token`
+     * header, carries the acting identity (`email` || `mobile`) in each request's
+     * own payload, takes org/workspace from `organisationUuid`/`workspaceUuid`,
+     * and never calls `/otp/refresh`.
+     */
+    token?: string;
+    /** Sandbox test subject email (carried in the request payload when set). */
+    email?: string;
+    /** Sandbox test subject mobile (fallback subject when `email` is absent). */
+    mobile?: string;
+    /**
+     * Sandbox UCIC: the client's own user id / org_user_id, e.g. a UUID or
+     * customer code; optional third identifier alongside email/mobile.
+     */
+    ucic?: string;
+    /** Sandbox org UUID (replaces the JWT-decoded org in sandbox mode). */
+    organisationUuid?: string;
+    /** Sandbox workspace UUID (replaces the JWT-decoded workspace in sandbox mode). */
+    workspaceUuid?: string;
     onError: (error: Error) => boolean;
     initialPage?: InternalPage;
     onBack?: 'back' | 'signout';
 }
-declare function RedactoPrivacyCenter({ baseUrl, ledgerBaseUrl, slug, accessToken, refreshToken, onError, initialPage, onBack, }: RedactoPrivacyCenterProps): react.JSX.Element;
+declare function RedactoPrivacyCenter({ baseUrl, ledgerBaseUrl, slug, accessToken, refreshToken, token, email, mobile, ucic, organisationUuid, workspaceUuid, onError, initialPage, onBack, }: RedactoPrivacyCenterProps): react.JSX.Element;
 
 interface PrivacyCenterLayoutProps {
     children: ReactNode;
@@ -688,6 +712,29 @@ declare const PrivacyCenterCaseDetailsPage: () => react.JSX.Element | null;
 
 declare const NotificationsPage: () => react.JSX.Element;
 
+type AuthProviderProps = Readonly<{
+    children: ReactNode;
+    accessToken?: string;
+    refreshToken?: string;
+    /**
+     * Sandbox PoC: when set, the Privacy Center skips the JWT entirely — it seeds
+     * org/workspace/subject from the props below, sends the single
+     * `X-Consent-Token` header, carries the acting identity in each request's own
+     * payload, and never calls `/otp/refresh`.
+     */
+    token?: string;
+    /** Sandbox UCIC — the client's own user id (`org_user_id`); takes precedence over the subject. */
+    sandboxUcic?: string;
+    /** Sandbox subject (email or mobile) — carried in the request payload. */
+    sandboxSubject?: string;
+    /** Sandbox org UUID (replaces the JWT-decoded org). */
+    organisationUuid?: string;
+    /** Sandbox workspace UUID (replaces the JWT-decoded workspace). */
+    workspaceUuid?: string;
+    /** Organisation slug — used to seed sandbox sessionStorage. */
+    slug?: string;
+    onError: (error: Error) => boolean;
+}>;
 type AuthContextValue = Readonly<{
     accessToken: string;
     refreshToken: string;
@@ -878,13 +925,7 @@ declare const fetchCaseHistory: (organizationId: string, workspaceId: string, co
 
 declare const useCaseHistory: (organizationId: string | undefined, workspaceId: string | undefined, contact: string | undefined, authContext?: AuthContext) => _tanstack_react_query.UseQueryResult<NoInfer<CaseRequest[]>, Error>;
 
-interface AuthProviderProps {
-    children: ReactNode;
-    accessToken: string;
-    refreshToken: string;
-    onError: (error: Error) => boolean;
-}
-declare const AuthProvider: ({ children, accessToken: initialAccessToken, refreshToken: initialRefreshToken, onError, }: AuthProviderProps) => react.JSX.Element;
+declare const AuthProvider: (props: AuthProviderProps) => react.JSX.Element;
 declare const useAuth: () => AuthContextValue;
 
 /**