@redacto.io/consent-sdk-react 10.3.1 → 11.0.0-beta.2

package/README.md

@@ -117,6 +117,67 @@ npm install @tanstack/react-query @tanstack/react-table \
 
 If you only use `RedactoNoticeConsent` or `RedactoNoticeConsentInline`, these peers are not needed.
 
+### API host (`baseUrl`)
+
+Pass the Redacto **API host** as `baseUrl`, for example `https://api.redacto.io`. Every component, `createConsentClient` and `BaseUrlProvider` take it, and the SDK reaches each backend service under it:
+
+| Service | URL |
+| --- | --- |
+| Consent server | `{baseUrl}/consent` |
+| Consent ledger | `{baseUrl}/consent-ledger` |
+| User service (Privacy Center branding) | `{baseUrl}/user/api/0` |
+
+A host behind a path prefix works the same way: `https://gateway.example.com/redacto` reaches the consent server at `https://gateway.example.com/redacto/consent`, and so on.
+
+| Request | Service |
+| --- | --- |
+| `RedactoNoticeConsent` notice read | Ledger with a JWT; consent server in sandbox and in the magic-link (`applicationId`) flow |
+| `RedactoNoticeConsent` notice audio | Ledger, sandbox included |
+| `RedactoNoticeConsentInline` notice read | Ledger with an `accessToken`; consent server without one and in the magic-link (`applicationId`) flow |
+| Consent writes (`submit-consent`) and the already-consented check (`check-consent`) | Ledger |
+| `RedactoNoticeAssisted` notice, audio and OTP; guardian verification (DigiLocker) | Consent server |
+| Privacy Center user consents, product purposes, receipts, manage consent | Ledger |
+| Privacy Center DSAR form, cases, activities, identities, OTP, token exchange, notifications, uploads, products, settings | Consent server |
+| Privacy Center org branding (by organisation UUID) | User service |
+
+For custom Privacy Center compositions, `useBaseUrl()` returns the consent server URL as `baseUrl`, the ledger URL as `ledgerBaseUrl` and the host as `apiHost`.
+
+#### The consent server URL (deprecated, still supported)
+
+Earlier releases documented the **consent server URL** as `baseUrl` (`https://api.redacto.io/consent`), with an optional `ledgerBaseUrl`. Both keep working exactly as before, so upgrading changes nothing until you switch:
+
+- With the consent server URL, every request goes where earlier releases sent it. Consent writes, the already-consented check and the Privacy Center's consents and receipts use the ledger only when `ledgerBaseUrl` is set; without it they stay on the consent server's legacy routes. `useBaseUrl()` returns both values as passed, with `apiHost` undefined.
+- Without `baseUrl`, the notice components still use the built-in production default.
+- The SDK tells the two apart by shape: an absolute `http(s)` URL that does not end in `/consent` is the API host; anything else (omitted, ending in `/consent`, or relative) is used as passed. A `baseUrl` ending in `/consent-ledger` resolves to its host the same way, so the ledger URL earlier releases took as `ledgerBaseUrl` also works as `baseUrl`. A consent server that is not mounted at `/consent` is therefore read as a host, so keep passing its URL ending in `/consent` until you switch.
+- Each deprecated form logs one console warning per page load; passing the host clears them.
+
+Compared with the consent server URL plus `ledgerBaseUrl`, the host changes two routes: `RedactoNoticeConsentInline` reads its notice from the ledger when it has an `accessToken`, and `RedactoNoticeConsent` plays sandbox audio from the ledger. The user service also keeps any path prefix of the host.
+
+#### `ledgerBaseUrl` (deprecated)
+
+Read only when `baseUrl` is the consent server URL (`…/consent`) or omitted, as in earlier releases. Ignored when `baseUrl` is the API host: the ledger is then always `{baseUrl}/consent-ledger`, and the SDK logs one console warning asking you to remove `ledgerBaseUrl`.
+
+#### Local development
+
+Put the services behind one local gateway, the way production does, and pass its address as `baseUrl`. For example, with [Caddy](https://caddyserver.com), the consent server on port 8000 and the ledger on port 8090:
+
+```caddyfile
+:8080 {
+	handle /consent-ledger/* {
+		reverse_proxy localhost:8090
+	}
+	handle /consent/* {
+		reverse_proxy localhost:8000
+	}
+}
+```
+
+Then pass `baseUrl="http://localhost:8080"`. Both services serve their own path prefix (`/consent/…`, `/consent-ledger/…`), so the gateway forwards paths unchanged. Any reverse proxy works the same way (nginx, Traefik, your docker-compose gateway).
+
+#### When your backend reuses the value
+
+Your backend's token calls go to the consent server. If your frontend sends its `baseUrl` to your backend (as `base_url` in [Backend Server Setup](#backend-server-setup)), the backend appends `/consent` to the host: `{host}/consent/public/organisations/{organisation_uuid}/workspaces/{workspace_uuid}/tokens/generate`. A backend that still receives the consent server URL keeps appending `/public/...` to it directly.
+
 ## Sandbox Mode (No Backend Required)
 
 Sandbox mode lets you build and test a full consent PoC — **notice → Privacy Center → DSAR** — straight from your app, with **no backend and no token minting**. Instead of your server generating a JWT, you paste a **static sandbox token** into the SDK. Everything you create is recorded as test data, isolated from your live records.
@@ -138,6 +199,7 @@ Pass the sandbox `token`, org/workspace, and a test identity (`email`, `mobile`,
 import { RedactoNoticeConsent } from "@redacto.io/consent-sdk-react";
 
 <RedactoNoticeConsent
+  baseUrl="https://api.redacto.io"
   noticeId={NOTICE_UUID}
   token={SANDBOX_TOKEN}
   organisationUuid={ORG_UUID}
@@ -156,11 +218,11 @@ Point the Privacy Center at the same sandbox token and test identity. The same t
 import { RedactoPrivacyCenter } from "@redacto.io/consent-sdk-react/privacy-center";
 
 <RedactoPrivacyCenter
+  baseUrl="https://api.redacto.io"
   token={SANDBOX_TOKEN}
   organisationUuid={ORG_UUID}
   workspaceUuid={WORKSPACE_UUID}
   email="test.user@example.com" // or `mobile`, or `ucic`
-  slug="acme-co"
   onError={(error) => {
     console.error(error);
     return false;
@@ -183,7 +245,7 @@ import { RedactoPrivacyCenter } from "@redacto.io/consent-sdk-react/privacy-cent
 
 - The SDK sends the sandbox token as an `X-Consent-Token` header and the test identity inside each request (query params on reads, body on writes) — no JWT decode, no token refresh (a `401` fails fast).
 - The server records everything under `environment=test`, namespaced so sandbox data never mixes with — or reads — your live records.
-- Sandbox always talks to the consent server; it never routes to the Go ledger.
+- Sandbox requests go to the same services as live ones (see [API host](#api-host-baseurl)), except that the notice read stays on the consent server.
 
 ### Going live
 
@@ -216,6 +278,7 @@ app.post(
   async (req: Request, res: Response): Promise<void> => {
     try {
       const { email } = req.body;
+      // base_url is the API host the frontend passes as baseUrl, e.g. https://api.redacto.io
       const { organisation_uuid, workspace_uuid, base_url } = req.query;
 
       if (!CMS_API_KEY) {
@@ -224,7 +287,7 @@ app.post(
 
       // Call Redacto API to generate access token
       const response = await axios.post(
-        `${base_url}/public/organisations/${organisation_uuid}/workspaces/${workspace_uuid}/tokens/generate-access-token`,
+        `${base_url}/consent/public/organisations/${organisation_uuid}/workspaces/${workspace_uuid}/tokens/generate`,
         {
           email,
           // expires_in_days: 1, // Optional: set token expiration
@@ -263,7 +326,7 @@ app.post(
 
       // Call Redacto API to refresh access token
       const response = await axios.post(
-        `${base_url}/consent/public/organisations/${organisation_uuid}/workspaces/${workspace_uuid}/tokens/refresh-token`,
+        `${base_url}/consent/public/organisations/${organisation_uuid}/workspaces/${workspace_uuid}/tokens/refresh`,
         { refresh_token: refresh_token },
         {
           headers: {
@@ -287,16 +350,16 @@ app.post(
 
 #### Redacto API Endpoints Used
 
-Your backend needs to call the following Redacto API endpoints:
+Your backend needs to call the following Redacto API endpoints on the API host (e.g. `https://api.redacto.io`):
 
 1. **Generate Access Token**
-   - **Endpoint**: `POST /public/organisations/{organisation_uuid}/workspaces/{workspace_uuid}/tokens/generate-access-token`
+   - **Endpoint**: `POST /consent/public/organisations/{organisation_uuid}/workspaces/{workspace_uuid}/tokens/generate`
    - **Headers**: `X-CMS-API-Key: {your-cms-api-key}`
    - **Body**: `{ email, expires_in_days? }`
    - **Response**: `{ detail: { token, refresh_token, expires_at } }`
 
 2. **Refresh Access Token**
-   - **Endpoint**: `POST /consent/public/organisations/{organisation_uuid}/workspaces/{workspace_uuid}/tokens/refresh-token`
+   - **Endpoint**: `POST /consent/public/organisations/{organisation_uuid}/workspaces/{workspace_uuid}/tokens/refresh`
    - **Headers**: `X-CMS-API-Key: {your-cms-api-key}`
    - **Body**: `{ refresh_token }`
    - **Response**: `{ detail: { token, refresh_token, expires_at } }`
@@ -322,8 +385,8 @@ A modal popup component for consent collection. Displays a full-screen modal wit
 | `noticeId`        | `string`                 | Yes      | -       | UUID of the consent notice          |
 | `accessToken`     | `string`                 | Yes      | -       | Authentication token for API calls  |
 | `refreshToken`    | `string`                 | Yes      | -       | Refresh token for token renewal     |
-| `baseUrl`         | `string`                 | No       | -       | Base URL for the consent API        |
-| `ledgerBaseUrl`   | `string`                 | No       | -       | Go ledger base URL. When set, consent writes and prior-consent checks route through the ledger (falls back: ledger → baseUrl → default). Omit to keep the legacy consent-server path. |
+| `baseUrl`         | `string`                 | No       | Production API | API host, e.g. `https://api.redacto.io` (see [API host](#api-host-baseurl)). The consent server URL (`…/consent`) still works but is deprecated |
+| `ledgerBaseUrl`   | `string`                 | No       | -       | **Deprecated.** Read only when `baseUrl` is the consent server URL (`…/consent`) or omitted, as in earlier releases. Ignored when `baseUrl` is the API host. There, it routes consent writes and prior-consent checks through the ledger (falls back: ledger → baseUrl → default) |
 | `blockUI`         | `boolean`                | No       | `true`  | Whether to block UI interaction     |
 | `language`        | `string`                 | No       | `"en"`  | Language code                       |
 | `settings`        | `object`                 | No       | -       | Optional code overrides; win over the console appearance key by key. See [Appearance](#notice-appearance) |
@@ -409,8 +472,8 @@ The component automatically submits consent when all of the following conditions
 | `notice_uuid`        | `string`                     | Yes      | -       | Notice UUID                            |
 | `accessToken`        | `string`                     | No       | -       | Authentication token                   |
 | `refreshToken`       | `string`                     | No       | -       | Refresh token                          |
-| `baseUrl`            | `string`                     | No       | -       | Base URL for the consent API           |
-| `ledgerBaseUrl`      | `string`                     | No       | -       | Go ledger base URL. When set, consent writes and already-consented checks route through the ledger. Omit for legacy behavior. |
+| `baseUrl`            | `string`                     | No       | Production API | API host, e.g. `https://api.redacto.io` (see [API host](#api-host-baseurl)). The consent server URL (`…/consent`) still works but is deprecated |
+| `ledgerBaseUrl`      | `string`                     | No       | -       | **Deprecated.** Read only when `baseUrl` is the consent server URL (`…/consent`) or omitted, as in earlier releases. Ignored when `baseUrl` is the API host. There, it routes consent writes and already-consented checks through the ledger |
 | `language`           | `string`                     | No       | `"en"`  | Language code                          |
 | `settings`           | `object`                     | No       | -       | Optional code overrides of the console appearance |
 | `applicationId`      | `string`                     | No       | -       | Application-specific UUID              |
@@ -440,8 +503,8 @@ A modal, agent-assisted consent widget for collecting consent from an end-user w
 | `organisationUuid` | `string`     | Yes      | -                        | Organisation UUID (path segment of the public notice endpoint)        |
 | `workspaceUuid`    | `string`     | Yes      | -                        | Workspace UUID (path segment of the public notice endpoint)           |
 | `noticeUuid`       | `string`     | Yes      | -                        | Notice UUID to fetch and render                                       |
-| `baseUrl`          | `string`     | No       | Production consent API   | Base URL for the consent API                                          |
-| `ledgerBaseUrl`    | `string`     | No       | -                        | Go ledger base URL. When set, the consent write routes through the ledger (falls back: ledger → baseUrl → default). Notice fetch, OTP, and TTS always stay on `baseUrl`. Omit for legacy behavior. |
+| `baseUrl`          | `string`     | No       | Production API           | API host, e.g. `https://api.redacto.io` (see [API host](#api-host-baseurl)). The consent server URL (`…/consent`) still works but is deprecated |
+| `ledgerBaseUrl`    | `string`     | No       | -                        | **Deprecated.** Read only when `baseUrl` is the consent server URL (`…/consent`) or omitted, as in earlier releases. Ignored when `baseUrl` is the API host. There, it routes the consent write through the ledger (falls back: ledger → baseUrl → default); notice fetch, OTP, and TTS stay on the consent server |
 | `onDecline`        | `() => void` | No       | Logs and resets the flow | Called when the agent/customer declines (host should unmount the modal) |
 | `onComplete`       | `() => void` | No       | Logs and resets the flow | Called when the agent clicks "Proceed" on the confirmed screen        |
 
@@ -478,6 +541,7 @@ function SignUpPage() {
 
     try {
       // Step 1: Get tokens from your backend
+      // BASE_URL is the Redacto API host, e.g. https://api.redacto.io
       const response = await fetch(
         `${BACKEND_URL}/api/consent/token?workspace_uuid=${WORKSPACE_UUID}&organisation_uuid=${ORG_UUID}&base_url=${BASE_URL}`,
         {
@@ -715,7 +779,7 @@ import { RedactoNoticeAssisted } from "@redacto.io/consent-sdk-react";
 const ORG_UUID = "your-organisation-uuid";
 const WORKSPACE_UUID = "your-workspace-uuid";
 const NOTICE_UUID = "your-notice-uuid";
-const BASE_URL = "https://api.redacto.io/consent"; // Optional: override the consent API
+const BASE_URL = "https://api.redacto.io"; // The Redacto API host
 
 export function AssistedConsent() {
   const [open, setOpen] = useState(false);
@@ -960,7 +1024,6 @@ import { RedactoPrivacyCenter } from "@redacto.io/consent-sdk-react/privacy-cent
 
 <RedactoPrivacyCenter
   baseUrl={BASE_URL}
-  slug="acme-co"
   accessToken={accessToken}
   refreshToken={refreshToken}
   settings={{ theme: "glass" }}
@@ -974,23 +1037,121 @@ import { RedactoPrivacyCenter } from "@redacto.io/consent-sdk-react/privacy-cent
 
 **Props:**
 
-| Prop           | Type                                                                                                                       | Required | Default              | Description                                              |
-| -------------- | -------------------------------------------------------------------------------------------------------------------------- | -------- | -------------------- | -------------------------------------------------------- |
-| `baseUrl`      | `string`                                                                                                                   | Yes      | -                    | Consent server base URL                                  |
-| `ledgerBaseUrl` | `string`                                                                                                                  | No       | -                    | Go ledger base URL. When set, user consents, group purposes, receipts, and manage-consent route through the ledger, and the DSAR form's product picker is overlaid from ledger-served consents. Omit to use the legacy `/dsar/privacy-center/*` routes. |
-| `slug`         | `string`                                                                                                                   | Yes      | -                    | Workspace slug                                           |
-| `accessToken`  | `string`                                                                                                                   | Yes      | -                    | JWT access token                                         |
-| `refreshToken` | `string`                                                                                                                   | Yes      | -                    | JWT refresh token                                        |
-| `onError`      | `(error: Error) => boolean`                                                                                                | Yes      | -                    | Error handler; return `true` if handled                  |
-| `settings`     | `{ theme?: "classic" \| "glass" }`                                                                                        | No       | -                    | Presentation options; `theme` picks the visual style (see [Theme](#privacy-center-appearance)). Colours always come from workspace branding |
-| `initialPage`  | `"consent-manager" \| "form" \| "activity" \| "case-details"`                                                              | No       | `"consent-manager"` | Page to render first                                     |
-| `onBack`       | `"back" \| "signout"`                                                                                                      | No       | -                    | Behaviour of the navbar back/signout control             |
+| Prop              | Type                                              | Required | Default             | Description |
+| ----------------- | ------------------------------------------------- | -------- | ------------------- | ----------- |
+| `baseUrl`         | `string`                                          | Yes      | -                   | API host, e.g. `https://api.redacto.io` (see [API host](#api-host-baseurl)). The consent server URL (`…/consent`) still works but is deprecated |
+| `ledgerBaseUrl`   | `string`                                          | No       | -                   | **Deprecated.** Read only when `baseUrl` is the consent server URL (`…/consent`) or omitted, as in earlier releases. Ignored when `baseUrl` is the API host. There, it routes user consents, group purposes, receipts, and manage-consent through the ledger and overlays the DSAR form's product picker from ledger-served consents; omitted, the legacy `/dsar/privacy-center/*` routes are used |
+| `slug`            | `string`                                          | No       | -                   | **Deprecated** and ignored; will be removed in a future major release. Passing it logs a one-time console warning. The organisation comes from the access token, or from `organisationUuid` and `workspaceUuid` |
+| `accessToken`     | `string`                                          | No       | -                   | JWT access token. Without one the Privacy Center waits for it, or shows its built-in sign-in when `builtInSignIn` is on (see [Sign-in](#privacy-center-sign-in)) |
+| `refreshToken`    | `string`                                          | No       | -                   | JWT refresh token |
+| `organisationUuid`| `string`                                          | No       | -                   | Organisation UUID for sign-in, settings and branding when there is no token; the built-in sign-in needs it with `workspaceUuid` (also the sandbox org) |
+| `workspaceUuid`   | `string`                                          | No       | -                   | Workspace UUID for sign-in when there is no token; the built-in sign-in needs it with `organisationUuid` (also the sandbox workspace) |
+| `onError`         | `(error: Error) => boolean`                       | Yes      | -                   | Error handler; return `true` if handled |
+| `settings`        | `PrivacyCenterSettings`                           | No       | -                   | Overrides for the settings published from the console, merged field by field per group (see [Settings](#privacy-center-settings)). `theme` is kept as an alias for `branding.style` |
+| `builtInSignIn`   | `boolean`                                         | No       | `false`             | Show the built-in OTP sign-in when there is no token. Off, the Privacy Center keeps its loading state until the host passes a token |
+| `initialPage`     | `"consent-manager" \| "form" \| "activity" \| "case-details" \| "notifications" \| "receipts"` | No | `"consent-manager"` | Page to render first; a section switched off in the settings falls back to the first enabled one |
+| `onBack`          | `"back" \| "signout"`                              | No       | -                   | Behaviour of the navbar back/signout control |
+| `onReady`         | `(event: { signedIn: boolean }) => void`          | No       | -                   | Called once, when the first screen (sign-in or the Privacy Center) is on show |
+| `onConsentChange` | `(change: PrivacyCenterConsentChange) => void`    | No       | -                   | Called after a consent was withdrawn, re-granted or renewed |
+| `onRequestSubmit` | `(request: PrivacyCenterRequestSubmission) => void` | No     | -                   | Called after a data request (case) was created |
+| `onSignOut`       | `(event: { reason: "user" \| "timeout" \| "session-expired" }) => void` | No | - | Called when the visitor is signed out |
+
+The callbacks never throw into the Privacy Center: an exception in a handler is logged and ignored. Their payloads:
+
+```ts
+type PrivacyCenterConsentChange = {
+  action: "revoke" | "regrant" | "renew";
+  purposeUuid: string;
+  productUuid: string | null;
+  dataElementUuids: readonly string[]; // empty when the change covered the whole purpose
+  nominatorUuid: string | null;        // set when acting on behalf of a nominator
+};
+
+type PrivacyCenterRequestSubmission = {
+  caseId: string;      // the case id shown to the visitor
+  caseUuid: string;
+  requestType: "access" | "correction" | "erasure" | "nomination" | "grievance";
+  productUuid: string | null; // null for nomination and grievance
+};
+```
+
+<a id="privacy-center-settings"></a>
+
+### Settings
+
+The Privacy Center reads the settings an admin publishes in the Redacto console (Rights Management › Privacy Center › Settings) from the consent server's public endpoint `GET {consent server}/public/organisations/{organisation_uuid}/privacy-center-settings/?lang={language}` (`{baseUrl}/consent/public/...` with the API host). The organisation comes from `organisationUuid`, the access token, or the session. The settings are fetched again, localised, when the visitor changes language, and cached in memory per organisation and language.
+
+Rendering never waits for them: the Privacy Center starts with the defaults and swaps the published values in when they arrive. **With nothing published, or if the request fails, it looks and behaves exactly as before settings existed.**
+
+What the settings control:
+
+- **Branding**: classic or glass style, the organisation's own colours, font, name and logo instead of the workspace branding, logo height and corner radius.
+- **Menu**: section order, labels, and which sections are on. A section switched off disappears from the menu and can't be opened; switching off `notifications` hides the bell too.
+- **Welcome message** at the top of the consent manager.
+- **Requests**: which request types the form offers, in what order and under what names (narrowed to the server's own list when it sends one), which grievance categories are offered, whether erasure also revokes consent, and the default withdraw warning (a purpose's own warning still wins).
+- **Languages**: which languages the switcher offers, whether it shows, the default language and whether the browser's language is detected. Once settings are published (or the host overrides them), Urdu, Sindhi and Kashmiri render right to left; with nothing published the text direction is inherited as before.
+- **Session timeout**: sign the visitor out after 15, 30 or 60 minutes without activity.
+- **Footer**: links, privacy policy, grievance contact, copyright and "Powered by".
+- **Sign-in screen**: layout, background, copy, channels and default country code (see below).
+- **Custom CSS** (see below).
+
+Copy can use `{brand}`, `{legal}`, `{year}`, `{contact}` and `{name}`; `resolvePlaceholders(text, context)` is exported for the same substitution in your own UI.
+
+Override any of it in code; each group merges field by field over what was published:
+
+```tsx
+<RedactoPrivacyCenter
+  baseUrl={BASE_URL}
+  accessToken={accessToken}
+  onError={() => false}
+  settings={{
+    branding: { style: "glass" },
+    portal: { welcome_enabled: true, session_timeout_minutes: 30 },
+    languages: { enabled: ["en", "hi"], default: "en" },
+  }}
+/>
+```
+
+The full shape is exported as `ResolvedPrivacyCenterSettings` (with `DEFAULT_PRIVACY_CENTER_SETTINGS`); `PrivacyCenterSettings` is the override type.
+
+<a id="privacy-center-sign-in"></a>
+
+### Sign-in
+
+Pass `builtInSignIn` and, with no `accessToken`, the Privacy Center shows its own sign-in instead of a loader: the visitor enters a mobile number or email, receives a one-time code (resend after 50 seconds) and is signed straight in with the tokens it issues. Layout (card, split or minimal), background, copy, channels (SMS, email or both), default country code, notice line and support link come from the `sign_in` settings. It is off by default, so a host that passes its token a moment after mounting never flashes a sign-in screen.
+
+```tsx
+<RedactoPrivacyCenter
+  baseUrl={BASE_URL}
+  organisationUuid={ORG_UUID}
+  workspaceUuid={WORKSPACE_UUID}
+  builtInSignIn
+  onError={() => false}
+/>
+```
+
+### Custom CSS
+
+`custom_css` from the settings is injected inside an `@scope` for this Privacy Center only, after the same safety checks as a notice's custom CSS, so it never reaches the host page. Target these stable parts:
+
+| Part | Element |
+| --- | --- |
+| `[data-redacto-part="topbar"]` | Top bar |
+| `[data-redacto-part="nav"]` / `"nav-item"` | Menu and each menu entry |
+| `[data-redacto-part="welcome"]` | Welcome message |
+| `[data-redacto-part="consent-card"]` | Consent manager card (and each product card on phones) |
+| `[data-redacto-part="request-form"]` | Data request form |
+| `[data-redacto-part="button-primary"]` | Primary buttons |
+| `[data-redacto-part="footer"]` | Footer |
+| `[data-redacto-part="signin-card"]` | Sign-in form |
+
+The `--pc-*` theme variables are scoped the same way: workspace branding and the settings' colours apply to this Privacy Center (and its menus and tooltips) without writing to the host page's `<html>`.
 
 <a id="privacy-center-appearance"></a>
 
 ### Theme
 
-`settings.theme` picks the visual style; colours, logo and brand name still come from the workspace's branding.
+`settings.theme` (or `settings.branding.style`) picks the visual style; colours, logo and brand name come from the workspace's branding unless the published settings replace them.
 
 - **`classic`** (default): the standard look.
 - **`glass`**: frosted, translucent surfaces over a soft wash of the brand colour, pill-shaped controls and motion. On phones, dialogs and the navigation menu rise as bottom sheets; on wider screens dialogs float as centred cards. Motion respects `prefers-reduced-motion`.
@@ -1016,11 +1177,11 @@ These rely on the same context providers (`AuthProvider`, `BaseUrlProvider`, `Na
 
 For consumers who want their own UI, the headless core exposes the API client, orchestration helpers, hooks, and auth utilities:
 
-- **API client**: `createConsentClient` (returns a typed `BaseRequest`-aware fetcher)
+- **API client**: `createConsentClient(baseUrl, ledgerBaseUrl?)` (takes the API host, like the components; returns a typed `BaseRequest`-aware fetcher that picks the service per request. The consent server URL and `ledgerBaseUrl` still work as before, deprecated; `ledgerBaseUrl` is ignored with the API host)
 - **Orchestration helpers** (handle auth retry / token refresh internally): `getFormData`, `createCaseRequest`, `fetchProducts`, `fetchUserConsents`, `manageConsent`, `fetchActivities`, `fetchCaseHistory`, `createOtp`, `verifyOtp`, `exchangeToken`
 - **Auth utilities**: `decodeJwtToken`, `isJwtExpired`, `ensureValidToken`, `signOutPrivacyCenter`, `getCookieValue`, `setRefreshTokenCookie`, `checkAndRefreshAuth`, `compareEmails`, `isUserAuthenticated`, `getInitialState`, `getActivityTypeStatus`, `formatActivityType`
 - **React Query hook**: `useCaseHistory`
-- **Context providers**: `AuthProvider` + `useAuth`, `BaseUrlProvider` + `useBaseUrl`, `NavigationProvider` + `useInternalNavigation`
+- **Context providers**: `AuthProvider` + `useAuth`, `BaseUrlProvider` + `useBaseUrl` (`BaseUrlProvider` takes the API host as `baseUrl`; `useBaseUrl()` returns the consent server URL as `baseUrl`, the ledger URL as `ledgerBaseUrl`, the host as `apiHost` and the client), `NavigationProvider` + `useInternalNavigation`
 - **Types**: `Workspace`, `OrganizationDetail`, `DataElement`, `Purpose`, `UserConsent`, `Activity`, `CaseHistoryDetail`, `RequestTypeEnum`, `GrievanceTypeEnum`, `ConsentStatusEnum`, and more (see `privacy-center.ts` for the full export list)
 
 ### Style Injection
@@ -1073,7 +1234,7 @@ injectPCStyles();
 - Verify authentication setup is correct for your environment
 - Check that API key generation is working
 - Ensure organisation and workspace UUIDs are correct
-- Verify base URL matches your environment (staging vs production)
+- Verify `base_url` is your environment's API host (staging vs production) and that your backend calls the consent server under it (`{host}/consent/...`)
 
 ### Validation not working
 
@@ -1085,11 +1246,11 @@ injectPCStyles();
 
 ### Redacto CMP API Endpoints
 
-The SDK communicates with Redacto's CMP API. Key endpoints used:
+The SDK communicates with Redacto's CMP API on the API host (see [API host](#api-host-baseurl)). Key endpoints used:
 
-- **Get Consent Notice**: `GET /public/organisations/{org_uuid}/workspaces/{workspace_uuid}/notices/{notice_uuid}`
-- **Submit Consent**: `POST /public/organisations/{org_uuid}/workspaces/{workspace_uuid}/submit-consent`
-- **Generate Access Token**: `POST /public/organisations/{org_uuid}/workspaces/{workspace_uuid}/tokens/generate-access-token`
+- **Get Consent Notice** (JWT session): `GET {baseUrl}/consent-ledger/public/organisations/{org_uuid}/workspaces/{workspace_uuid}/notices/{notice_uuid}`
+- **Submit Consent**: `POST {baseUrl}/consent-ledger/public/organisations/{org_uuid}/workspaces/{workspace_uuid}/submit-consent`
+- **Generate Access Token** (your backend): `POST {baseUrl}/consent/public/organisations/{org_uuid}/workspaces/{workspace_uuid}/tokens/generate`
 
 For complete API documentation, visit: [Redacto API Documentation](https://staging.api.redacto.io/consent/docs)
 

package/dist/{chunk-RG4PVVKF.mjs → chunk-W45JQYDG.mjs}

@@ -218,6 +218,8 @@ var NOTICE_DISALLOWED_CSS_TOKENS = [
   "expression(",
   "behavior:"
 ];
+var CSS_SCOPE_AT_RULE = "@scope";
+var CSS_STRING_SPECIALS_RE = /["\\\n]/g;
 var CSS_ESCAPE_RE = /\\([0-9a-f]{1,6})(?:\r\n|[ \t\r\n\f])?|\\([\s\S])/gi;
 var CSS_BRACKET_PAIRS = {
   "{": "}",
@@ -255,6 +257,63 @@ var buildTtsCssVariables = (colors) => Object.fromEntries(
 );
 var buildTtsRootAttributes = (colors) => colors.tts_highlight_text ? { [TTS_TEXT_ATTRIBUTE]: "" } : {};
 
+// src/shared/appearance/customCss.ts
+var decodeCssEscapes = (value) => value.replace(
+  CSS_ESCAPE_RE,
+  (_match, hex, literal) => {
+    if (hex === void 0) {
+      return literal;
+    }
+    const codePoint = Number.parseInt(hex, HEX_RADIX);
+    if (codePoint === 0 || codePoint > MAX_CODE_POINT || codePoint >= SURROGATE_MIN && codePoint <= SURROGATE_MAX) {
+      return CSS_REPLACEMENT_CHARACTER;
+    }
+    return String.fromCodePoint(codePoint);
+  }
+);
+var hasBalancedBlocks = (css) => {
+  const open = [];
+  let quote;
+  let inComment = false;
+  for (let index = 0; index < css.length; index += 1) {
+    const char = css[index];
+    if (inComment) {
+      if (char === "*" && css[index + 1] === "/") {
+        inComment = false;
+        index += 1;
+      }
+    } else if (char === "\\") {
+      index += 1;
+    } else if (quote) {
+      if (char === quote) {
+        quote = void 0;
+      } else if (CSS_NEWLINES.includes(char)) {
+        return false;
+      }
+    } else if (char === "/" && css[index + 1] === "*") {
+      inComment = true;
+      index += 1;
+    } else if (CSS_QUOTES.includes(char)) {
+      quote = char;
+    } else if (char in CSS_BRACKET_PAIRS) {
+      open.push(CSS_BRACKET_PAIRS[char]);
+    } else if (CSS_CLOSING_BRACKETS.includes(char) && open.pop() !== char) {
+      return false;
+    }
+  }
+  return open.length === 0 && !quote && !inComment;
+};
+var isSafeCustomCss = (css) => {
+  if (css.length > NOTICE_CUSTOM_CSS_MAX_LENGTH || !hasBalancedBlocks(css)) {
+    return false;
+  }
+  const lowered = css.toLowerCase();
+  const decoded = decodeCssEscapes(css).toLowerCase();
+  return NOTICE_DISALLOWED_CSS_TOKENS.every(
+    (token) => !lowered.includes(token) && !decoded.includes(token)
+  );
+};
+
 // src/shared/appearance/registry.ts
 var DEFAULT_APPEARANCE = "classic";
 var APPEARANCE_ATTRIBUTE = "data-redacto-appearance";
@@ -325,63 +384,6 @@ var prefersReducedMotion = () => {
   return typeof window !== "undefined" && ((_b = (_a = window.matchMedia) == null ? void 0 : _a.call(window, "(prefers-reduced-motion: reduce)")) == null ? void 0 : _b.matches) === true;
 };
 
-// src/shared/appearance/customCss.ts
-var decodeCssEscapes = (value) => value.replace(
-  CSS_ESCAPE_RE,
-  (_match, hex, literal) => {
-    if (hex === void 0) {
-      return literal;
-    }
-    const codePoint = Number.parseInt(hex, HEX_RADIX);
-    if (codePoint === 0 || codePoint > MAX_CODE_POINT || codePoint >= SURROGATE_MIN && codePoint <= SURROGATE_MAX) {
-      return CSS_REPLACEMENT_CHARACTER;
-    }
-    return String.fromCodePoint(codePoint);
-  }
-);
-var hasBalancedBlocks = (css) => {
-  const open = [];
-  let quote;
-  let inComment = false;
-  for (let index = 0; index < css.length; index += 1) {
-    const char = css[index];
-    if (inComment) {
-      if (char === "*" && css[index + 1] === "/") {
-        inComment = false;
-        index += 1;
-      }
-    } else if (char === "\\") {
-      index += 1;
-    } else if (quote) {
-      if (char === quote) {
-        quote = void 0;
-      } else if (CSS_NEWLINES.includes(char)) {
-        return false;
-      }
-    } else if (char === "/" && css[index + 1] === "*") {
-      inComment = true;
-      index += 1;
-    } else if (CSS_QUOTES.includes(char)) {
-      quote = char;
-    } else if (char in CSS_BRACKET_PAIRS) {
-      open.push(CSS_BRACKET_PAIRS[char]);
-    } else if (CSS_CLOSING_BRACKETS.includes(char) && open.pop() !== char) {
-      return false;
-    }
-  }
-  return open.length === 0 && !quote && !inComment;
-};
-var isSafeCustomCss = (css) => {
-  if (css.length > NOTICE_CUSTOM_CSS_MAX_LENGTH || !hasBalancedBlocks(css)) {
-    return false;
-  }
-  const lowered = css.toLowerCase();
-  const decoded = decodeCssEscapes(css).toLowerCase();
-  return NOTICE_DISALLOWED_CSS_TOKENS.every(
-    (token) => !lowered.includes(token) && !decoded.includes(token)
-  );
-};
-
 // src/shared/appearance/resolve.ts
 var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var pickColors = (raw) => {
@@ -680,6 +682,66 @@ var useMediaQuery = (query) => {
   return matches;
 };
 
+// src/shared/endpoints.ts
+var CONSENT_PATH = "/consent";
+var LEDGER_PATH = "/consent-ledger";
+var ABSOLUTE_HTTP_URL = /^https?:\/\/(?:\[[0-9a-f:.]+\]|[^\s/?#@:[\]]+)(?::\d+)?(?:\/[^\s?#]*)?$/i;
+var trimUrl = (value) => (value != null ? value : "").trim().replace(/\/+$/, "");
+var isConsentServerUrl = (trimmed) => ABSOLUTE_HTTP_URL.test(trimmed) && trimmed.endsWith(CONSENT_PATH);
+var isHostForm = (trimmed) => ABSOLUTE_HTTP_URL.test(trimmed) && !trimmed.endsWith(CONSENT_PATH);
+function resolveEndpoints(baseUrl, ledgerBaseUrl) {
+  const trimmed = trimUrl(baseUrl);
+  if (!isHostForm(trimmed)) {
+    return { mode: "legacy", apiHost: void 0, baseUrl, ledgerBaseUrl };
+  }
+  const apiHost = trimmed.endsWith(LEDGER_PATH) ? trimmed.slice(0, -LEDGER_PATH.length) : trimmed;
+  return {
+    mode: "host",
+    apiHost,
+    baseUrl: `${apiHost}${CONSENT_PATH}`,
+    ledgerBaseUrl: `${apiHost}${LEDGER_PATH}`
+  };
+}
+var ENDPOINT_WARNINGS = {
+  missingBaseUrl: "[Redacto] baseUrl is not set, so the SDK's built-in production default is used. Pass baseUrl: your API host.",
+  consentServerBaseUrl: "[Redacto] baseUrl is the consent server URL (ending in /consent), which is deprecated. Pass the API host instead; the SDK derives the consent server and ledger URLs from it.",
+  ledgerBaseUrl: "[Redacto] ledgerBaseUrl is deprecated. Pass the Redacto API host as baseUrl instead; the SDK then reaches the consent server and the ledger under it.",
+  ledgerBaseUrlIgnored: "[Redacto] ledgerBaseUrl is ignored because baseUrl is the API host; the SDK reaches the ledger under that host. Remove ledgerBaseUrl.",
+  slugIgnored: "[Redacto] slug is deprecated and ignored. The Privacy Center reads the organisation from the access token, or from organisationUuid and workspaceUuid. Remove slug."
+};
+var issuedWarnings = /* @__PURE__ */ new Set();
+var warnOnce = (warning) => {
+  if (issuedWarnings.has(warning)) {
+    return;
+  }
+  issuedWarnings.add(warning);
+  console.warn(ENDPOINT_WARNINGS[warning]);
+};
+var warnEndpointUsage = (baseUrl, ledgerBaseUrl, { hasBuiltInDefault }) => {
+  if (!baseUrl) {
+    if (hasBuiltInDefault) {
+      warnOnce("missingBaseUrl");
+    }
+  } else if (isConsentServerUrl(trimUrl(baseUrl))) {
+    warnOnce("consentServerBaseUrl");
+  }
+  if (trimUrl(ledgerBaseUrl)) {
+    warnOnce(isHostForm(trimUrl(baseUrl)) ? "ledgerBaseUrlIgnored" : "ledgerBaseUrl");
+  }
+};
+var warnSlugDeprecated = () => {
+  warnOnce("slugIgnored");
+};
+
+// src/shared/useResolvedEndpoints.ts
+import { useMemo } from "react";
+var useResolvedEndpoints = (baseUrl, ledgerBaseUrl, { warn = true, hasBuiltInDefault = true } = {}) => useMemo(() => {
+  if (warn) {
+    warnEndpointUsage(baseUrl, ledgerBaseUrl, { hasBuiltInDefault });
+  }
+  return resolveEndpoints(baseUrl, ledgerBaseUrl);
+}, [baseUrl, ledgerBaseUrl, warn, hasBuiltInDefault]);
+
 // src/shared/sandbox.ts
 var SANDBOX_TOKEN_HEADER = "X-Consent-Token";
 
@@ -687,6 +749,36 @@ var SANDBOX_TOKEN_HEADER = "X-Consent-Token";
 var DEFAULT_CONSENT_API_BASE_URL = "https://api.redacto.io/consent";
 var USER_SERVICE_PATH = "/user/api/0";
 
+// src/shared/appearance/scopedCss.ts
+var escapesScope = (style) => {
+  var _a, _b;
+  return Array.from((_b = (_a = style.sheet) == null ? void 0 : _a.cssRules) != null ? _b : []).some(
+    (rule) => !rule.cssText.startsWith(CSS_SCOPE_AT_RULE)
+  );
+};
+var applyScopedCustomCss = ({
+  scopeAttribute,
+  scopeId,
+  markerAttribute,
+  css
+}) => {
+  if (typeof document === "undefined" || !css.trim() || !isSafeCustomCss(css)) {
+    return () => void 0;
+  }
+  const id = scopeId.replace(CSS_STRING_SPECIALS_RE, "\\$&");
+  const style = document.createElement("style");
+  style.setAttribute(markerAttribute, scopeId);
+  style.textContent = `${CSS_SCOPE_AT_RULE} ([${scopeAttribute}="${id}"]) {
+${css}
+}`;
+  document.head.appendChild(style);
+  if (escapesScope(style)) {
+    style.remove();
+    return () => void 0;
+  }
+  return () => style.remove();
+};
+
 export {
   SANDBOX_TOKEN_HEADER,
   withIdempotencyKey,
@@ -724,5 +816,10 @@ export {
   Collapse,
   configureNoticeFonts,
   loadNoticeWebfont,
-  useMediaQuery
+  useMediaQuery,
+  applyScopedCustomCss,
+  resolveEndpoints,
+  warnEndpointUsage,
+  warnSlugDeprecated,
+  useResolvedEndpoints
 };