Nastardocs v1 · API v1

Last updated 2026-09-22

Changelog

What's actually built, deployed, and working today — not a marketing timeline. Nastar is serving publicly: nastar.dev for the site and dashboard, api.nastar.dev for the API, and cdn.nastar.dev for the SDK and published site configs. There are no dated release entries yet because the product is early; the SDK's own versions are listed below and in the SDK reference's compatibility table.

Available today

Account & organizations

  • Email + one-time-code sign-up and login — no passwords.
  • Create an organization and manage multiple websites from one dashboard.
  • Invite teammates by email with a role (admin/editor/viewer); revoke a pending invite any time.
  • See and revoke your account's active sessions individually, device by device.

Consent banner & SDK

  • Clearer site screens — each site now has one tab per job. Banner holds the text and the look together, with the live preview beside them and one Save; Cookies lists each category with the services behind it; Languages translates side by side with the original text; Integrations is just Google's two integrations; Domains shows protection as three steps. Overview has a checklist that only ticks what the site has really done, and Publish now opens a dialog listing what changes — including whether returning visitors will be asked again — with the QA checklist alongside.
  • Built-in Dutch translation — Dutch is now one click away on the Banner tab. It stays off until you add it; when you do, the standard banner text and the four default categories are filled in in Dutch, so a site that kept the default English text can publish Dutch without translating anything. Text you rewrote in English yourself, and your own services, are left for you to translate rather than given a stock sentence that no longer matches what your site says.
  • Banner appearance (@nastar/consent-sdk v0.4.0) — brand the banner from the dashboard's new Appearance tab: light or dark mode, placement, five colours, corner radius, your logo, and links to your privacy and cookie policies, with a live preview at desktop and mobile widths that mounts the real SDK rather than a lookalike. Colours are checked against WCAG 2.2 AA when you save and again when you publish, and a combination that fails is refused with the measured ratio and a value that would pass. There is deliberately no per-button colour and no CSS field: Accept all, Reject all and Customize keep identical size, padding and weight, so branding cannot turn into a dark pattern.
    Two things change for existing sites. First, the banner now renders inside an open shadow root, so any CSS on your own site that targeted .nastar-* classes stops applying — that isolation is what makes the contrast and equal prominence guarantees hold on a real page, but it will surprise anyone who was restyling the banner by hand; move those choices into the Appearance tab. Second, tests and scripts that reached the banner through document.querySelector now need document.querySelector('[data-nastar-root]').shadowRoot. A site that sets no appearance renders exactly as it did before.
  • Multiple banner languages (@nastar/consent-sdk v0.4.0) — publish the banner, category and service text in more than one language. The SDK picks a locale from <html lang> first, then the browser's languages, then the site default, and re-renders in place when the page language changes. A language can only be published once it is complete; a half-translated consent notice is refused at publish, naming exactly which strings are missing.
    This changes when returning visitors are asked again. Until now any publish re-prompted everyone, because the SDK compared the stored config version against the published one. Publishing now also emits a consentRelevantVersion hash covering only what a visitor actually consented to — the enabled categories and which category each service belongs to — and the SDK compares that instead. So fixing a typo, changing colours or adding a translation no longer resets anyone's consent, while adding a category or switching one on or off still does. Visitors who last decided before this release are re-prompted once, because a stored decision with no hash is treated as unverifiable rather than assumed fine.
  • Configure banner copy and consent categories per site, preview, and publish a versioned, immutable configuration.
  • @nastar/consent-sdk — a framework-independent client with an accessible default banner, fail-closed behavior, cross-tab sync, and a small public API (hasConsent, loadWhenConsented, openPreferences, and more — see SDK reference).
  • Three choices in the preferences dialog (@nastar/consent-sdk v0.6.0) — the dialog now offers Reject all, Allow selection and Accept all, equally sized, so a visitor who opens it is never a step further from rejecting than from accepting. The two all-or-nothing buttons use the banner's own labels. New sites label the selection button Allow selection (Dutch: Selectie toestaan); existing sites keep their saved text, editable on the Banner tab.
  • The preferences dialog no longer runs the divider under the last category into the Save preferences button (@nastar/consent-sdk v0.5.2); the button now has room above it.
  • The consent banner no longer blocks the page behind it (@nastar/consent-sdk v0.5.1). It was meant to be non-modal, but it sat on a full-screen dimmed backdrop that swallowed every click, so a visitor who had not yet chosen could not follow a link, submit a form or log in until they did. The backdrop is gone from the banner and the rest of the page stays usable; the banner itself is unchanged. The Customize dialog is still modal, as before.
  • Google Analytics page views in Advanced consent mode (@nastar/consent-sdk v0.3.1) — trackPageView() is now gated on Google Analytics being loaded, the same as the initial page view the SDK fires itself. Previously it also required consent, so an Advanced-mode site that routes client-side reported one page view per full page load and nothing for route changes made by an undecided visitor — while an identically configured multi-page site reported every one. Advanced mode now reports those route changes as the cookieless pings it is meant to; the consent signal sent alongside them is unchanged. Basic mode is unaffected: Google Analytics still loads only after consent, and stops reporting if consent is withdrawn.
  • Google Analytics integration (@nastar/consent-sdk v0.3.0) — enable GA4 from the dashboard with a Measurement ID and Basic/Advanced Consent Mode; the SDK loads gtag.js, calls gtag('config', ...), and fires page views itself. Optional, off by default, and not a Google-certified integration. Builds on the existing Google Consent Mode v2 signal mapping rather than replacing it.
  • Google Consent Mode v2 (@nastar/consent-sdk v0.2.0) — map each of Google's four consent signals (ad_storage, analytics_storage, ad_user_data, ad_personalization) to a consent category per site; the SDK fires the documented gtag('consent', ...) calls automatically as visitors decide. Optional, off by default, and not a Google-certified integration — see SDK reference.

Automation & AI integration

  • Scoped setup tokens for AI IDEs, CLIs, and CI — create, reveal once, and revoke from the dashboard.
  • A dedicated automation API (API reference) and an AI IDE integration guide with copyable prompts.

Documentation

  • This documentation site, a machine-readable index at /llms.txt, and a downloadable agent-instructions file for AI-assisted integrations.

Hosting & delivery

  • A public deployment: the site and dashboard on nastar.dev, the API on api.nastar.dev (with its generated OpenAPI document at /openapi.json), and the SDK plus published site configs on cdn.nastar.dev, CORS-enabled so any origin's SDK can fetch its config.
  • Two CDN paths per SDK build — a rolling /sdk/v1/ that always serves the current release, and an immutable /sdk/<version>/ for anyone who wants to pin. See SDK reference for the trade-off.
  • Nastar's own consent banner runs on this site, using the same public snippet the dashboard hands customers.

Not yet available

  • @nastar/consent-sdk on the npm registry — the package isn't published, so npm install @nastar/consent-sdk fails. Install from the CDN instead (SDK reference); the ESM build there is the same module the package will ship.
  • Astro, Next.js, and WordPress integration guides — not written and not tested. Plain HTML and Nuxt are the two that exist.
  • Shipped translation packs — you can publish the banner in any language you write yourself (above), but Nastar supplies no ready-made translations, and the dashboard's own interface is English only.
  • Full-text search across this documentation.
  • A public support channel or security disclosure process — see Security.