@redacto.io/consent-sdk-react 10.4.0-beta.1 → 11.0.0-beta.3

package/README.md

@@ -117,6 +117,67 @@ npm install @tanstack/react-query @tanstack/react-table \
 
 If you only use `RedactoNoticeConsent` or `RedactoNoticeConsentInline`, these peers are not needed.
 
+### API host (`baseUrl`)
+
+Pass the Redacto **API host** as `baseUrl`, for example `https://api.redacto.io`. Every component, `createConsentClient` and `BaseUrlProvider` take it, and the SDK reaches each backend service under it:
+
+| Service | URL |
+| --- | --- |
+| Consent server | `{baseUrl}/consent` |
+| Consent ledger | `{baseUrl}/consent-ledger` |
+| User service (Privacy Center branding) | `{baseUrl}/user/api/0` |
+
+A host behind a path prefix works the same way: `https://gateway.example.com/redacto` reaches the consent server at `https://gateway.example.com/redacto/consent`, and so on.
+
+| Request | Service |
+| --- | --- |
+| `RedactoNoticeConsent` notice read | Ledger with a JWT; consent server in sandbox and in the magic-link (`applicationId`) flow |
+| `RedactoNoticeConsent` notice audio | Ledger, sandbox included |
+| `RedactoNoticeConsentInline` notice read | Ledger with an `accessToken`; consent server without one and in the magic-link (`applicationId`) flow |
+| Consent writes (`submit-consent`) and the already-consented check (`check-consent`) | Ledger |
+| `RedactoNoticeAssisted` notice, audio and OTP; guardian verification (DigiLocker) | Consent server |
+| Privacy Center user consents, product purposes, receipts, manage consent | Ledger |
+| Privacy Center DSAR form, cases, activities, identities, OTP, token exchange, notifications, uploads, products, settings | Consent server |
+| Privacy Center org branding (by organisation UUID) | User service |
+
+For custom Privacy Center compositions, `useBaseUrl()` returns the consent server URL as `baseUrl`, the ledger URL as `ledgerBaseUrl` and the host as `apiHost`.
+
+#### The consent server URL (deprecated, still supported)
+
+Earlier releases documented the **consent server URL** as `baseUrl` (`https://api.redacto.io/consent`), with an optional `ledgerBaseUrl`. Both keep working exactly as before, so upgrading changes nothing until you switch:
+
+- With the consent server URL, every request goes where earlier releases sent it. Consent writes, the already-consented check and the Privacy Center's consents and receipts use the ledger only when `ledgerBaseUrl` is set; without it they stay on the consent server's legacy routes. `useBaseUrl()` returns both values as passed, with `apiHost` undefined.
+- Without `baseUrl`, the notice components still use the built-in production default.
+- The SDK tells the two apart by shape: an absolute `http(s)` URL that does not end in `/consent` is the API host; anything else (omitted, ending in `/consent`, or relative) is used as passed. A `baseUrl` ending in `/consent-ledger` resolves to its host the same way, so the ledger URL earlier releases took as `ledgerBaseUrl` also works as `baseUrl`. A consent server that is not mounted at `/consent` is therefore read as a host, so keep passing its URL ending in `/consent` until you switch.
+- Each deprecated form logs one console warning per page load; passing the host clears them.
+
+Compared with the consent server URL plus `ledgerBaseUrl`, the host changes two routes: `RedactoNoticeConsentInline` reads its notice from the ledger when it has an `accessToken`, and `RedactoNoticeConsent` plays sandbox audio from the ledger. The user service also keeps any path prefix of the host.
+
+#### `ledgerBaseUrl` (deprecated)
+
+Read only when `baseUrl` is the consent server URL (`…/consent`) or omitted, as in earlier releases. Ignored when `baseUrl` is the API host: the ledger is then always `{baseUrl}/consent-ledger`, and the SDK logs one console warning asking you to remove `ledgerBaseUrl`.
+
+#### Local development
+
+Put the services behind one local gateway, the way production does, and pass its address as `baseUrl`. For example, with [Caddy](https://caddyserver.com), the consent server on port 8000 and the ledger on port 8090:
+
+```caddyfile
+:8080 {
+	handle /consent-ledger/* {
+		reverse_proxy localhost:8090
+	}
+	handle /consent/* {
+		reverse_proxy localhost:8000
+	}
+}
+```
+
+Then pass `baseUrl="http://localhost:8080"`. Both services serve their own path prefix (`/consent/…`, `/consent-ledger/…`), so the gateway forwards paths unchanged. Any reverse proxy works the same way (nginx, Traefik, your docker-compose gateway).
+
+#### When your backend reuses the value
+
+Your backend's token calls go to the consent server. If your frontend sends its `baseUrl` to your backend (as `base_url` in [Backend Server Setup](#backend-server-setup)), the backend appends `/consent` to the host: `{host}/consent/public/organisations/{organisation_uuid}/workspaces/{workspace_uuid}/tokens/generate`. A backend that still receives the consent server URL keeps appending `/public/...` to it directly.
+
 ## Sandbox Mode (No Backend Required)
 
 Sandbox mode lets you build and test a full consent PoC — **notice → Privacy Center → DSAR** — straight from your app, with **no backend and no token minting**. Instead of your server generating a JWT, you paste a **static sandbox token** into the SDK. Everything you create is recorded as test data, isolated from your live records.
@@ -138,6 +199,7 @@ Pass the sandbox `token`, org/workspace, and a test identity (`email`, `mobile`,
 import { RedactoNoticeConsent } from "@redacto.io/consent-sdk-react";
 
 <RedactoNoticeConsent
+  baseUrl="https://api.redacto.io"
   noticeId={NOTICE_UUID}
   token={SANDBOX_TOKEN}
   organisationUuid={ORG_UUID}
@@ -156,11 +218,11 @@ Point the Privacy Center at the same sandbox token and test identity. The same t
 import { RedactoPrivacyCenter } from "@redacto.io/consent-sdk-react/privacy-center";
 
 <RedactoPrivacyCenter
+  baseUrl="https://api.redacto.io"
   token={SANDBOX_TOKEN}
   organisationUuid={ORG_UUID}
   workspaceUuid={WORKSPACE_UUID}
   email="test.user@example.com" // or `mobile`, or `ucic`
-  slug="acme-co"
   onError={(error) => {
     console.error(error);
     return false;
@@ -183,7 +245,7 @@ import { RedactoPrivacyCenter } from "@redacto.io/consent-sdk-react/privacy-cent
 
 - The SDK sends the sandbox token as an `X-Consent-Token` header and the test identity inside each request (query params on reads, body on writes) — no JWT decode, no token refresh (a `401` fails fast).
 - The server records everything under `environment=test`, namespaced so sandbox data never mixes with — or reads — your live records.
-- Sandbox always talks to the consent server; it never routes to the Go ledger.
+- Sandbox requests go to the same services as live ones (see [API host](#api-host-baseurl)), except that the notice read stays on the consent server.
 
 ### Going live
 
@@ -216,6 +278,7 @@ app.post(
   async (req: Request, res: Response): Promise<void> => {
     try {
       const { email } = req.body;
+      // base_url is the API host the frontend passes as baseUrl, e.g. https://api.redacto.io
       const { organisation_uuid, workspace_uuid, base_url } = req.query;
 
       if (!CMS_API_KEY) {
@@ -224,7 +287,7 @@ app.post(
 
       // Call Redacto API to generate access token
       const response = await axios.post(
-        `${base_url}/public/organisations/${organisation_uuid}/workspaces/${workspace_uuid}/tokens/generate-access-token`,
+        `${base_url}/consent/public/organisations/${organisation_uuid}/workspaces/${workspace_uuid}/tokens/generate`,
         {
           email,
           // expires_in_days: 1, // Optional: set token expiration
@@ -263,7 +326,7 @@ app.post(
 
       // Call Redacto API to refresh access token
       const response = await axios.post(
-        `${base_url}/consent/public/organisations/${organisation_uuid}/workspaces/${workspace_uuid}/tokens/refresh-token`,
+        `${base_url}/consent/public/organisations/${organisation_uuid}/workspaces/${workspace_uuid}/tokens/refresh`,
         { refresh_token: refresh_token },
         {
           headers: {
@@ -287,16 +350,16 @@ app.post(
 
 #### Redacto API Endpoints Used
 
-Your backend needs to call the following Redacto API endpoints:
+Your backend needs to call the following Redacto API endpoints on the API host (e.g. `https://api.redacto.io`):
 
 1. **Generate Access Token**
-   - **Endpoint**: `POST /public/organisations/{organisation_uuid}/workspaces/{workspace_uuid}/tokens/generate-access-token`
+   - **Endpoint**: `POST /consent/public/organisations/{organisation_uuid}/workspaces/{workspace_uuid}/tokens/generate`
    - **Headers**: `X-CMS-API-Key: {your-cms-api-key}`
    - **Body**: `{ email, expires_in_days? }`
    - **Response**: `{ detail: { token, refresh_token, expires_at } }`
 
 2. **Refresh Access Token**
-   - **Endpoint**: `POST /consent/public/organisations/{organisation_uuid}/workspaces/{workspace_uuid}/tokens/refresh-token`
+   - **Endpoint**: `POST /consent/public/organisations/{organisation_uuid}/workspaces/{workspace_uuid}/tokens/refresh`
    - **Headers**: `X-CMS-API-Key: {your-cms-api-key}`
    - **Body**: `{ refresh_token }`
    - **Response**: `{ detail: { token, refresh_token, expires_at } }`
@@ -322,8 +385,8 @@ A modal popup component for consent collection. Displays a full-screen modal wit
 | `noticeId`        | `string`                 | Yes      | -       | UUID of the consent notice          |
 | `accessToken`     | `string`                 | Yes      | -       | Authentication token for API calls  |
 | `refreshToken`    | `string`                 | Yes      | -       | Refresh token for token renewal     |
-| `baseUrl`         | `string`                 | No       | -       | Base URL for the consent API        |
-| `ledgerBaseUrl`   | `string`                 | No       | -       | Go ledger base URL. When set, consent writes and prior-consent checks route through the ledger (falls back: ledger → baseUrl → default). Omit to keep the legacy consent-server path. |
+| `baseUrl`         | `string`                 | No       | Production API | API host, e.g. `https://api.redacto.io` (see [API host](#api-host-baseurl)). The consent server URL (`…/consent`) still works but is deprecated |
+| `ledgerBaseUrl`   | `string`                 | No       | -       | **Deprecated.** Read only when `baseUrl` is the consent server URL (`…/consent`) or omitted, as in earlier releases. Ignored when `baseUrl` is the API host. There, it routes consent writes and prior-consent checks through the ledger (falls back: ledger → baseUrl → default) |
 | `blockUI`         | `boolean`                | No       | `true`  | Whether to block UI interaction     |
 | `language`        | `string`                 | No       | `"en"`  | Language code                       |
 | `settings`        | `object`                 | No       | -       | Optional code overrides; win over the console appearance key by key. See [Appearance](#notice-appearance) |
@@ -409,8 +472,8 @@ The component automatically submits consent when all of the following conditions
 | `notice_uuid`        | `string`                     | Yes      | -       | Notice UUID                            |
 | `accessToken`        | `string`                     | No       | -       | Authentication token                   |
 | `refreshToken`       | `string`                     | No       | -       | Refresh token                          |
-| `baseUrl`            | `string`                     | No       | -       | Base URL for the consent API           |
-| `ledgerBaseUrl`      | `string`                     | No       | -       | Go ledger base URL. When set, consent writes and already-consented checks route through the ledger. Omit for legacy behavior. |
+| `baseUrl`            | `string`                     | No       | Production API | API host, e.g. `https://api.redacto.io` (see [API host](#api-host-baseurl)). The consent server URL (`…/consent`) still works but is deprecated |
+| `ledgerBaseUrl`      | `string`                     | No       | -       | **Deprecated.** Read only when `baseUrl` is the consent server URL (`…/consent`) or omitted, as in earlier releases. Ignored when `baseUrl` is the API host. There, it routes consent writes and already-consented checks through the ledger |
 | `language`           | `string`                     | No       | `"en"`  | Language code                          |
 | `settings`           | `object`                     | No       | -       | Optional code overrides of the console appearance |
 | `applicationId`      | `string`                     | No       | -       | Application-specific UUID              |
@@ -440,8 +503,8 @@ A modal, agent-assisted consent widget for collecting consent from an end-user w
 | `organisationUuid` | `string`     | Yes      | -                        | Organisation UUID (path segment of the public notice endpoint)        |
 | `workspaceUuid`    | `string`     | Yes      | -                        | Workspace UUID (path segment of the public notice endpoint)           |
 | `noticeUuid`       | `string`     | Yes      | -                        | Notice UUID to fetch and render                                       |
-| `baseUrl`          | `string`     | No       | Production consent API   | Base URL for the consent API                                          |
-| `ledgerBaseUrl`    | `string`     | No       | -                        | Go ledger base URL. When set, the consent write routes through the ledger (falls back: ledger → baseUrl → default). Notice fetch, OTP, and TTS always stay on `baseUrl`. Omit for legacy behavior. |
+| `baseUrl`          | `string`     | No       | Production API           | API host, e.g. `https://api.redacto.io` (see [API host](#api-host-baseurl)). The consent server URL (`…/consent`) still works but is deprecated |
+| `ledgerBaseUrl`    | `string`     | No       | -                        | **Deprecated.** Read only when `baseUrl` is the consent server URL (`…/consent`) or omitted, as in earlier releases. Ignored when `baseUrl` is the API host. There, it routes the consent write through the ledger (falls back: ledger → baseUrl → default); notice fetch, OTP, and TTS stay on the consent server |
 | `onDecline`        | `() => void` | No       | Logs and resets the flow | Called when the agent/customer declines (host should unmount the modal) |
 | `onComplete`       | `() => void` | No       | Logs and resets the flow | Called when the agent clicks "Proceed" on the confirmed screen        |
 
@@ -478,6 +541,7 @@ function SignUpPage() {
 
     try {
       // Step 1: Get tokens from your backend
+      // BASE_URL is the Redacto API host, e.g. https://api.redacto.io
       const response = await fetch(
         `${BACKEND_URL}/api/consent/token?workspace_uuid=${WORKSPACE_UUID}&organisation_uuid=${ORG_UUID}&base_url=${BASE_URL}`,
         {
@@ -715,7 +779,7 @@ import { RedactoNoticeAssisted } from "@redacto.io/consent-sdk-react";
 const ORG_UUID = "your-organisation-uuid";
 const WORKSPACE_UUID = "your-workspace-uuid";
 const NOTICE_UUID = "your-notice-uuid";
-const BASE_URL = "https://api.redacto.io/consent"; // Optional: override the consent API
+const BASE_URL = "https://api.redacto.io"; // The Redacto API host
 
 export function AssistedConsent() {
   const [open, setOpen] = useState(false);
@@ -960,7 +1024,6 @@ import { RedactoPrivacyCenter } from "@redacto.io/consent-sdk-react/privacy-cent
 
 <RedactoPrivacyCenter
   baseUrl={BASE_URL}
-  slug="acme-co"
   accessToken={accessToken}
   refreshToken={refreshToken}
   settings={{ theme: "glass" }}
@@ -976,13 +1039,13 @@ import { RedactoPrivacyCenter } from "@redacto.io/consent-sdk-react/privacy-cent
 
 | Prop              | Type                                              | Required | Default             | Description |
 | ----------------- | ------------------------------------------------- | -------- | ------------------- | ----------- |
-| `baseUrl`         | `string`                                          | Yes      | -                   | Consent server base URL |
-| `ledgerBaseUrl`   | `string`                                          | No       | -                   | Go ledger base URL. When set, user consents, group purposes, receipts, and manage-consent route through the ledger, and the DSAR form's product picker is overlaid from ledger-served consents. Omit to use the legacy `/dsar/privacy-center/*` routes. |
-| `slug`            | `string`                                          | Yes      | -                   | Organisation slug |
+| `baseUrl`         | `string`                                          | Yes      | -                   | API host, e.g. `https://api.redacto.io` (see [API host](#api-host-baseurl)). The consent server URL (`…/consent`) still works but is deprecated |
+| `ledgerBaseUrl`   | `string`                                          | No       | -                   | **Deprecated.** Read only when `baseUrl` is the consent server URL (`…/consent`) or omitted, as in earlier releases. Ignored when `baseUrl` is the API host. There, it routes user consents, group purposes, receipts, and manage-consent through the ledger and overlays the DSAR form's product picker from ledger-served consents; omitted, the legacy `/dsar/privacy-center/*` routes are used |
+| `slug`            | `string`                                          | No       | -                   | **Deprecated** and ignored; will be removed in a future major release. Passing it logs a one-time console warning. The organisation comes from the access token, or from `organisationUuid` and `workspaceUuid` |
 | `accessToken`     | `string`                                          | No       | -                   | JWT access token. Without one the Privacy Center waits for it, or shows its built-in sign-in when `builtInSignIn` is on (see [Sign-in](#privacy-center-sign-in)) |
 | `refreshToken`    | `string`                                          | No       | -                   | JWT refresh token |
-| `organisationUuid`| `string`                                          | No       | -                   | Organisation UUID for sign-in and settings when there is no token; looked up from `slug` when omitted (also the sandbox org) |
-| `workspaceUuid`   | `string`                                          | No       | -                   | Workspace UUID for sign-in when there is no token; looked up from `slug` when omitted (also the sandbox workspace) |
+| `organisationUuid`| `string`                                          | No       | -                   | Organisation UUID for sign-in, settings and branding when there is no token; the built-in sign-in needs it with `workspaceUuid` (also the sandbox org) |
+| `workspaceUuid`   | `string`                                          | No       | -                   | Workspace UUID for sign-in when there is no token; the built-in sign-in needs it with `organisationUuid` (also the sandbox workspace) |
 | `onError`         | `(error: Error) => boolean`                       | Yes      | -                   | Error handler; return `true` if handled |
 | `settings`        | `PrivacyCenterSettings`                           | No       | -                   | Overrides for the settings published from the console, merged field by field per group (see [Settings](#privacy-center-settings)). `theme` is kept as an alias for `branding.style` |
 | `builtInSignIn`   | `boolean`                                         | No       | `false`             | Show the built-in OTP sign-in when there is no token. Off, the Privacy Center keeps its loading state until the host passes a token |
@@ -1016,7 +1079,7 @@ type PrivacyCenterRequestSubmission = {
 
 ### Settings
 
-The Privacy Center reads the settings an admin publishes in the Redacto console (Rights Management › Privacy Center › Settings) from the public endpoint `GET {baseUrl}/public/organisations/{organisation_uuid}/privacy-center-settings/?lang={language}`. The organisation comes from `organisationUuid`, the access token, the session, or a lookup by `slug`. The settings are fetched again, localised, when the visitor changes language, and cached in memory per organisation and language.
+The Privacy Center reads the settings an admin publishes in the Redacto console (Rights Management › Privacy Center › Settings) from the consent server's public endpoint `GET {consent server}/public/organisations/{organisation_uuid}/privacy-center-settings/?lang={language}` (`{baseUrl}/consent/public/...` with the API host). The organisation comes from `organisationUuid`, the access token, or the session. The settings are fetched again, localised, when the visitor changes language, and cached in memory per organisation and language.
 
 Rendering never waits for them: the Privacy Center starts with the defaults and swaps the published values in when they arrive. **With nothing published, or if the request fails, it looks and behaves exactly as before settings existed.**
 
@@ -1039,7 +1102,6 @@ Override any of it in code; each group merges field by field over what was publi
 ```tsx
 <RedactoPrivacyCenter
   baseUrl={BASE_URL}
-  slug="acme-co"
   accessToken={accessToken}
   onError={() => false}
   settings={{
@@ -1059,7 +1121,13 @@ The full shape is exported as `ResolvedPrivacyCenterSettings` (with `DEFAULT_PRI
 Pass `builtInSignIn` and, with no `accessToken`, the Privacy Center shows its own sign-in instead of a loader: the visitor enters a mobile number or email, receives a one-time code (resend after 50 seconds) and is signed straight in with the tokens it issues. Layout (card, split or minimal), background, copy, channels (SMS, email or both), default country code, notice line and support link come from the `sign_in` settings. It is off by default, so a host that passes its token a moment after mounting never flashes a sign-in screen.
 
 ```tsx
-<RedactoPrivacyCenter baseUrl={BASE_URL} slug="acme-co" builtInSignIn onError={() => false} />
+<RedactoPrivacyCenter
+  baseUrl={BASE_URL}
+  organisationUuid={ORG_UUID}
+  workspaceUuid={WORKSPACE_UUID}
+  builtInSignIn
+  onError={() => false}
+/>
 ```
 
 ### Custom CSS
@@ -1109,11 +1177,11 @@ These rely on the same context providers (`AuthProvider`, `BaseUrlProvider`, `Na
 
 For consumers who want their own UI, the headless core exposes the API client, orchestration helpers, hooks, and auth utilities:
 
-- **API client**: `createConsentClient` (returns a typed `BaseRequest`-aware fetcher)
+- **API client**: `createConsentClient(baseUrl, ledgerBaseUrl?)` (takes the API host, like the components; returns a typed `BaseRequest`-aware fetcher that picks the service per request. The consent server URL and `ledgerBaseUrl` still work as before, deprecated; `ledgerBaseUrl` is ignored with the API host)
 - **Orchestration helpers** (handle auth retry / token refresh internally): `getFormData`, `createCaseRequest`, `fetchProducts`, `fetchUserConsents`, `manageConsent`, `fetchActivities`, `fetchCaseHistory`, `createOtp`, `verifyOtp`, `exchangeToken`
 - **Auth utilities**: `decodeJwtToken`, `isJwtExpired`, `ensureValidToken`, `signOutPrivacyCenter`, `getCookieValue`, `setRefreshTokenCookie`, `checkAndRefreshAuth`, `compareEmails`, `isUserAuthenticated`, `getInitialState`, `getActivityTypeStatus`, `formatActivityType`
 - **React Query hook**: `useCaseHistory`
-- **Context providers**: `AuthProvider` + `useAuth`, `BaseUrlProvider` + `useBaseUrl`, `NavigationProvider` + `useInternalNavigation`
+- **Context providers**: `AuthProvider` + `useAuth`, `BaseUrlProvider` + `useBaseUrl` (`BaseUrlProvider` takes the API host as `baseUrl`; `useBaseUrl()` returns the consent server URL as `baseUrl`, the ledger URL as `ledgerBaseUrl`, the host as `apiHost` and the client), `NavigationProvider` + `useInternalNavigation`
 - **Types**: `Workspace`, `OrganizationDetail`, `DataElement`, `Purpose`, `UserConsent`, `Activity`, `CaseHistoryDetail`, `RequestTypeEnum`, `GrievanceTypeEnum`, `ConsentStatusEnum`, and more (see `privacy-center.ts` for the full export list)
 
 ### Style Injection
@@ -1166,7 +1234,7 @@ injectPCStyles();
 - Verify authentication setup is correct for your environment
 - Check that API key generation is working
 - Ensure organisation and workspace UUIDs are correct
-- Verify base URL matches your environment (staging vs production)
+- Verify `base_url` is your environment's API host (staging vs production) and that your backend calls the consent server under it (`{host}/consent/...`)
 
 ### Validation not working
 
@@ -1178,11 +1246,11 @@ injectPCStyles();
 
 ### Redacto CMP API Endpoints
 
-The SDK communicates with Redacto's CMP API. Key endpoints used:
+The SDK communicates with Redacto's CMP API on the API host (see [API host](#api-host-baseurl)). Key endpoints used:
 
-- **Get Consent Notice**: `GET /public/organisations/{org_uuid}/workspaces/{workspace_uuid}/notices/{notice_uuid}`
-- **Submit Consent**: `POST /public/organisations/{org_uuid}/workspaces/{workspace_uuid}/submit-consent`
-- **Generate Access Token**: `POST /public/organisations/{org_uuid}/workspaces/{workspace_uuid}/tokens/generate-access-token`
+- **Get Consent Notice** (JWT session): `GET {baseUrl}/consent-ledger/public/organisations/{org_uuid}/workspaces/{workspace_uuid}/notices/{notice_uuid}`
+- **Submit Consent**: `POST {baseUrl}/consent-ledger/public/organisations/{org_uuid}/workspaces/{workspace_uuid}/submit-consent`
+- **Generate Access Token** (your backend): `POST {baseUrl}/consent/public/organisations/{org_uuid}/workspaces/{workspace_uuid}/tokens/generate`
 
 For complete API documentation, visit: [Redacto API Documentation](https://staging.api.redacto.io/consent/docs)
 

package/dist/{chunk-DGMUTOWJ.mjs → chunk-W45JQYDG.mjs}

@@ -682,6 +682,66 @@ var useMediaQuery = (query) => {
   return matches;
 };
 
+// src/shared/endpoints.ts
+var CONSENT_PATH = "/consent";
+var LEDGER_PATH = "/consent-ledger";
+var ABSOLUTE_HTTP_URL = /^https?:\/\/(?:\[[0-9a-f:.]+\]|[^\s/?#@:[\]]+)(?::\d+)?(?:\/[^\s?#]*)?$/i;
+var trimUrl = (value) => (value != null ? value : "").trim().replace(/\/+$/, "");
+var isConsentServerUrl = (trimmed) => ABSOLUTE_HTTP_URL.test(trimmed) && trimmed.endsWith(CONSENT_PATH);
+var isHostForm = (trimmed) => ABSOLUTE_HTTP_URL.test(trimmed) && !trimmed.endsWith(CONSENT_PATH);
+function resolveEndpoints(baseUrl, ledgerBaseUrl) {
+  const trimmed = trimUrl(baseUrl);
+  if (!isHostForm(trimmed)) {
+    return { mode: "legacy", apiHost: void 0, baseUrl, ledgerBaseUrl };
+  }
+  const apiHost = trimmed.endsWith(LEDGER_PATH) ? trimmed.slice(0, -LEDGER_PATH.length) : trimmed;
+  return {
+    mode: "host",
+    apiHost,
+    baseUrl: `${apiHost}${CONSENT_PATH}`,
+    ledgerBaseUrl: `${apiHost}${LEDGER_PATH}`
+  };
+}
+var ENDPOINT_WARNINGS = {
+  missingBaseUrl: "[Redacto] baseUrl is not set, so the SDK's built-in production default is used. Pass baseUrl: your API host.",
+  consentServerBaseUrl: "[Redacto] baseUrl is the consent server URL (ending in /consent), which is deprecated. Pass the API host instead; the SDK derives the consent server and ledger URLs from it.",
+  ledgerBaseUrl: "[Redacto] ledgerBaseUrl is deprecated. Pass the Redacto API host as baseUrl instead; the SDK then reaches the consent server and the ledger under it.",
+  ledgerBaseUrlIgnored: "[Redacto] ledgerBaseUrl is ignored because baseUrl is the API host; the SDK reaches the ledger under that host. Remove ledgerBaseUrl.",
+  slugIgnored: "[Redacto] slug is deprecated and ignored. The Privacy Center reads the organisation from the access token, or from organisationUuid and workspaceUuid. Remove slug."
+};
+var issuedWarnings = /* @__PURE__ */ new Set();
+var warnOnce = (warning) => {
+  if (issuedWarnings.has(warning)) {
+    return;
+  }
+  issuedWarnings.add(warning);
+  console.warn(ENDPOINT_WARNINGS[warning]);
+};
+var warnEndpointUsage = (baseUrl, ledgerBaseUrl, { hasBuiltInDefault }) => {
+  if (!baseUrl) {
+    if (hasBuiltInDefault) {
+      warnOnce("missingBaseUrl");
+    }
+  } else if (isConsentServerUrl(trimUrl(baseUrl))) {
+    warnOnce("consentServerBaseUrl");
+  }
+  if (trimUrl(ledgerBaseUrl)) {
+    warnOnce(isHostForm(trimUrl(baseUrl)) ? "ledgerBaseUrlIgnored" : "ledgerBaseUrl");
+  }
+};
+var warnSlugDeprecated = () => {
+  warnOnce("slugIgnored");
+};
+
+// src/shared/useResolvedEndpoints.ts
+import { useMemo } from "react";
+var useResolvedEndpoints = (baseUrl, ledgerBaseUrl, { warn = true, hasBuiltInDefault = true } = {}) => useMemo(() => {
+  if (warn) {
+    warnEndpointUsage(baseUrl, ledgerBaseUrl, { hasBuiltInDefault });
+  }
+  return resolveEndpoints(baseUrl, ledgerBaseUrl);
+}, [baseUrl, ledgerBaseUrl, warn, hasBuiltInDefault]);
+
 // src/shared/sandbox.ts
 var SANDBOX_TOKEN_HEADER = "X-Consent-Token";
 
@@ -757,5 +817,9 @@ export {
   configureNoticeFonts,
   loadNoticeWebfont,
   useMediaQuery,
-  applyScopedCustomCss
+  applyScopedCustomCss,
+  resolveEndpoints,
+  warnEndpointUsage,
+  warnSlugDeprecated,
+  useResolvedEndpoints
 };

package/dist/index.d.mts

@@ -1,6 +1,6 @@
 import * as React from 'react';
 import React__default from 'react';
-import { A as AppearanceStyle, N as NoticeControlStyle, a as NoticeMobileLayout, b as NoticeDesktopPosition, c as NoticeBackdrop, d as NoticePhoneFooter, e as NoticeTextScale, f as NoticeAppearance } from './types-Bwtzvz4W.mjs';
+import { A as AppearanceStyle, N as NoticeControlStyle, a as NoticeMobileLayout, b as NoticeDesktopPosition, c as NoticeBackdrop, d as NoticePhoneFooter, e as NoticeTextScale, f as NoticeAppearance } from './types-B8qroG0j.mjs';
 import { f as NoticeFontOptions } from './types-xaCyZUfo.mjs';
 
 /**
@@ -341,6 +341,11 @@ type ConsentFlowState = "age-check" | "guardian-details" | "digilocker-pending"
  */
 type DigiLockerCallbackProps = {
     accessToken: string;
+    /**
+     * API host, e.g. https://api.redacto.io (recommended). The consent server
+     * URL (…/consent) still works but is deprecated. Defaults to the URL the
+     * notice stored before redirecting.
+     */
     baseUrl?: string;
     onSuccess?: (verificationReference: string) => void;
     onError?: (error: Error, errorCode?: GuardianVerificationErrorCode) => void;
@@ -376,7 +381,17 @@ type Props$1 = Readonly<{
     organisationUuid?: string;
     /** Sandbox workspace UUID (replaces the JWT-decoded workspace in sandbox mode). */
     workspaceUuid?: string;
+    /**
+     * API host, e.g. https://api.redacto.io (recommended). The consent server
+     * URL (…/consent) still works but is deprecated.
+     * When omitted, the SDK's built-in production default is used.
+     */
     baseUrl?: string;
+    /**
+     * @deprecated Read only when `baseUrl` is the consent server URL
+     * (`…/consent`) or omitted, as in earlier releases. Ignored when `baseUrl`
+     * is the API host.
+     */
     ledgerBaseUrl?: string;
     /**
      * Optional code-side styling. The notice's look is set in the Redacto
@@ -452,7 +467,17 @@ type Props = Readonly<{
     notice_uuid: string;
     accessToken?: string;
     refreshToken?: string;
+    /**
+     * API host, e.g. https://api.redacto.io (recommended). The consent server
+     * URL (…/consent) still works but is deprecated.
+     * When omitted, the SDK's built-in production default is used.
+     */
     baseUrl?: string;
+    /**
+     * @deprecated Read only when `baseUrl` is the consent server URL
+     * (`…/consent`) or omitted, as in earlier releases. Ignored when `baseUrl`
+     * is the API host.
+     */
     ledgerBaseUrl?: string;
     /**
      * Optional code-side styling; overrides the appearance set in the Redacto
@@ -468,7 +493,7 @@ type Props = Readonly<{
 }>;
 
 declare const RedactoConsentInline: React.MemoExoticComponent<{
-    ({ org_uuid, workspace_uuid, notice_uuid, accessToken, baseUrl, ledgerBaseUrl, language, onAccept, onError, onValidationChange, settings, applicationId, }: Props): React.JSX.Element | null;
+    ({ org_uuid, workspace_uuid, notice_uuid, accessToken, baseUrl: baseUrlProp, ledgerBaseUrl: ledgerBaseUrlProp, language, onAccept, onError, onValidationChange, settings, applicationId, }: Props): React.JSX.Element | null;
     displayName: string;
 }>;
 
@@ -484,9 +509,18 @@ type RedactoNoticeAssistedProps = {
     workspaceUuid: string;
     /** Notice UUID to fetch and render. */
     noticeUuid: string;
-    /** API base URL (defaults to the production consent API). */
+    /**
+     * API host, e.g. https://api.redacto.io (recommended). The consent server
+     * URL (…/consent) still works but is deprecated.
+     * When omitted, the SDK's built-in production default is used.
+     */
     baseUrl?: string;
-    /** Go ledger base URL — routes the consent write to the ledger; omit to use the legacy consent server. */
+    /**
+     * @deprecated Read only when `baseUrl` is the consent server URL
+     * (`…/consent`) or omitted, as in earlier releases. Ignored when `baseUrl`
+     * is the API host. With the consent server URL, it routes the consent write to
+     * the ledger; omit it there to use the legacy consent server.
+     */
     ledgerBaseUrl?: string;
     /** Called when the agent/customer declines (host should unmount the modal). */
     onDecline?: () => void;
@@ -514,7 +548,7 @@ type RedactoNoticeAssistedProps = {
  * submit, `onComplete` fires immediately with no confirmation screen (mirroring
  * RedactoNoticeConsent's `onAccept`). Steps: `notice` → `verify` (with `otpSent`).
  */
-declare const RedactoNoticeAssisted: ({ organisationUuid, workspaceUuid, noticeUuid, baseUrl, ledgerBaseUrl, onDecline, onComplete, settings, }: RedactoNoticeAssistedProps) => React.JSX.Element;
+declare const RedactoNoticeAssisted: ({ organisationUuid, workspaceUuid, noticeUuid, baseUrl: baseUrlProp, ledgerBaseUrl: ledgerBaseUrlProp, onDecline, onComplete, settings, }: RedactoNoticeAssistedProps) => React.JSX.Element;
 
 /**
  * The notice exactly as the SDK draws it, from content the Redacto console

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import * as React from 'react';
 import React__default from 'react';
-import { A as AppearanceStyle, N as NoticeControlStyle, a as NoticeMobileLayout, b as NoticeDesktopPosition, c as NoticeBackdrop, d as NoticePhoneFooter, e as NoticeTextScale, f as NoticeAppearance } from './types-Bwtzvz4W.js';
+import { A as AppearanceStyle, N as NoticeControlStyle, a as NoticeMobileLayout, b as NoticeDesktopPosition, c as NoticeBackdrop, d as NoticePhoneFooter, e as NoticeTextScale, f as NoticeAppearance } from './types-B8qroG0j.js';
 import { f as NoticeFontOptions } from './types-xaCyZUfo.js';
 
 /**
@@ -341,6 +341,11 @@ type ConsentFlowState = "age-check" | "guardian-details" | "digilocker-pending"
  */
 type DigiLockerCallbackProps = {
     accessToken: string;
+    /**
+     * API host, e.g. https://api.redacto.io (recommended). The consent server
+     * URL (…/consent) still works but is deprecated. Defaults to the URL the
+     * notice stored before redirecting.
+     */
     baseUrl?: string;
     onSuccess?: (verificationReference: string) => void;
     onError?: (error: Error, errorCode?: GuardianVerificationErrorCode) => void;
@@ -376,7 +381,17 @@ type Props$1 = Readonly<{
     organisationUuid?: string;
     /** Sandbox workspace UUID (replaces the JWT-decoded workspace in sandbox mode). */
     workspaceUuid?: string;
+    /**
+     * API host, e.g. https://api.redacto.io (recommended). The consent server
+     * URL (…/consent) still works but is deprecated.
+     * When omitted, the SDK's built-in production default is used.
+     */
     baseUrl?: string;
+    /**
+     * @deprecated Read only when `baseUrl` is the consent server URL
+     * (`…/consent`) or omitted, as in earlier releases. Ignored when `baseUrl`
+     * is the API host.
+     */
     ledgerBaseUrl?: string;
     /**
      * Optional code-side styling. The notice's look is set in the Redacto
@@ -452,7 +467,17 @@ type Props = Readonly<{
     notice_uuid: string;
     accessToken?: string;
     refreshToken?: string;
+    /**
+     * API host, e.g. https://api.redacto.io (recommended). The consent server
+     * URL (…/consent) still works but is deprecated.
+     * When omitted, the SDK's built-in production default is used.
+     */
     baseUrl?: string;
+    /**
+     * @deprecated Read only when `baseUrl` is the consent server URL
+     * (`…/consent`) or omitted, as in earlier releases. Ignored when `baseUrl`
+     * is the API host.
+     */
     ledgerBaseUrl?: string;
     /**
      * Optional code-side styling; overrides the appearance set in the Redacto
@@ -468,7 +493,7 @@ type Props = Readonly<{
 }>;
 
 declare const RedactoConsentInline: React.MemoExoticComponent<{
-    ({ org_uuid, workspace_uuid, notice_uuid, accessToken, baseUrl, ledgerBaseUrl, language, onAccept, onError, onValidationChange, settings, applicationId, }: Props): React.JSX.Element | null;
+    ({ org_uuid, workspace_uuid, notice_uuid, accessToken, baseUrl: baseUrlProp, ledgerBaseUrl: ledgerBaseUrlProp, language, onAccept, onError, onValidationChange, settings, applicationId, }: Props): React.JSX.Element | null;
     displayName: string;
 }>;
 
@@ -484,9 +509,18 @@ type RedactoNoticeAssistedProps = {
     workspaceUuid: string;
     /** Notice UUID to fetch and render. */
     noticeUuid: string;
-    /** API base URL (defaults to the production consent API). */
+    /**
+     * API host, e.g. https://api.redacto.io (recommended). The consent server
+     * URL (…/consent) still works but is deprecated.
+     * When omitted, the SDK's built-in production default is used.
+     */
     baseUrl?: string;
-    /** Go ledger base URL — routes the consent write to the ledger; omit to use the legacy consent server. */
+    /**
+     * @deprecated Read only when `baseUrl` is the consent server URL
+     * (`…/consent`) or omitted, as in earlier releases. Ignored when `baseUrl`
+     * is the API host. With the consent server URL, it routes the consent write to
+     * the ledger; omit it there to use the legacy consent server.
+     */
     ledgerBaseUrl?: string;
     /** Called when the agent/customer declines (host should unmount the modal). */
     onDecline?: () => void;
@@ -514,7 +548,7 @@ type RedactoNoticeAssistedProps = {
  * submit, `onComplete` fires immediately with no confirmation screen (mirroring
  * RedactoNoticeConsent's `onAccept`). Steps: `notice` → `verify` (with `otpSent`).
  */
-declare const RedactoNoticeAssisted: ({ organisationUuid, workspaceUuid, noticeUuid, baseUrl, ledgerBaseUrl, onDecline, onComplete, settings, }: RedactoNoticeAssistedProps) => React.JSX.Element;
+declare const RedactoNoticeAssisted: ({ organisationUuid, workspaceUuid, noticeUuid, baseUrl: baseUrlProp, ledgerBaseUrl: ledgerBaseUrlProp, onDecline, onComplete, settings, }: RedactoNoticeAssistedProps) => React.JSX.Element;
 
 /**
  * The notice exactly as the SDK draws it, from content the Redacto console