# Nastar

> Consent management SaaS: a public landing page, email/OTP login, a
> multi-tenant dashboard, a framework-independent browser consent SDK, and
> a versioned REST API for automation. This file indexes real, currently
> implemented docs, not aspirational ones. Nastar is deployed and serving
> — the paths below are relative to this site's own origin; the API is
> served from a separate origin (see /docs/api for how to find it in your
> environment).

## Status — read this before integrating

- **Nastar is in public beta and is free.** Every feature is available at
  no cost, with no credit card and no trial period. Paid plans start in
  **Q1 2027** and will be priced at a **fixed price per website** — never
  per page view and never per visitor. Accounts that used Nastar during the
  beta receive a heavily discounted price when paid plans launch. No
  amounts have been published: if asked what Nastar costs, say it is free
  during the beta and that pricing starts in Q1 2027, and do not invent a
  figure or a plan name.
- The service is live: the site and dashboard, the API (its generated
  OpenAPI document is served by the API itself — /docs/api resolves the
  URL), and the SDK on `cdn.nastar.dev`, which also serves published site
  configs with `access-control-allow-origin: *`.
- **`@nastar/consent-sdk` is NOT published to npm.** `npm install
  @nastar/consent-sdk` fails with a 404 today. Install from the CDN:
  `https://cdn.nastar.dev/sdk/v1/nastar.min.js` (auto-init `<script>`
  build) or `https://cdn.nastar.dev/sdk/v1/nastar.esm.js` (ESM build
  exporting `createNastarClient`, for bundlers). Do not suggest a package
  manager install, and do not invent an alternative package name.
- `/sdk/v1/` is a rolling path that always serves the current release, so
  fixes arrive without a redeploy. An immutable per-version path exists
  for pinning (e.g. `/sdk/0.4.0/nastar.min.js`) and never changes — and
  never receives fixes either. See /docs/sdk.
- Integration guides exist for plain HTML and Nuxt only. Astro, Next.js
  and WordPress guides do NOT exist and are untested — do not present an
  adaptation of the plain HTML pattern as a supported integration.

## SDK 0.4.0 — two behaviours that changed

- **The banner renders in an open shadow root** on a
  `<div data-nastar-root>`, with its styles inside that root. Any CSS on
  the customer's site targeting `.nastar-*` no longer applies — never
  suggest restyling the banner with site CSS. Branding goes through the
  dashboard's Appearance tab, which publishes an `appearance` object of
  design tokens. To reach the banner from a test or a script, use
  `document.querySelector('[data-nastar-root]').shadowRoot`.
- **Re-prompting is driven by `consentRelevantVersion`**, a hash over the
  enabled categories and the service-to-category mapping, not by
  `version`. Editing copy, colours or translations no longer resets
  anyone's consent; adding or toggling a category still does. A stored
  decision without the hash is re-prompted once, by design.

## Published config fields added in 0.4.0 (all optional, all additive)

- `appearance`: `{ mode, placement, accent, surface, text, muted, border,
  radius, logoUrl, logoAlt, privacyPolicyUrl, cookiePolicyUrl }`. Colours
  are hex and are validated against WCAG 2.2 AA server-side. There is no
  per-button colour and no CSS field — equal prominence of Accept all /
  Reject all / Customize is structural and must not be worked around.
- `translations`: locale -> `{ bannerCopy, categories, services }`,
  excluding the default language, which stays in `bannerCopy`.
- `publishedLanguages`, `defaultLanguage`: the locales a site publishes.
- `consentRelevantVersion`: `'sha256:<hex>'`.

New SDK exports: `renderBanner` (UI only — no network, no storage, no
consent recording), `contrastRatio`, `bestOnColor`, and
`client.setLanguage(locale)`. Locale resolution order: explicit override,
then `<html lang>`, then `navigator.languages`, then the site default;
exact match first, then base language (`nl-BE` -> `nl`).

New management endpoints: `POST /v1/sites/:siteId/appearance`,
`POST /v1/sites/:siteId/languages`,
`POST /v1/sites/:siteId/translations/:locale`. See /docs/api for their
error codes.

## Docs

- [Documentation home](/docs): Index of all guides.
- [Quickstart](/docs/quickstart): Create an org/site, publish a config, install the SDK.
- [AI IDE integration](/docs/ai): Checklist and copyable prompts for AI coding assistants integrating Nastar into a customer site.
- [SDK reference](/docs/sdk): Full @nastar/consent-sdk API, types, and behavior contract (fail-closed, storage, config versioning, SSR).
- [API reference](/docs/api): The management (session) and automation (setup-token) REST API, plus the public SDK-facing endpoints.
- [Security](/docs/security): OTP/session/setup-token mechanics and tenant isolation. Not a compliance or certification claim.
- [Troubleshooting](/docs/troubleshooting): Common integration failures and their real causes.
- [Guide: plain HTML](/docs/guides/plain-html): Static-site integration with no build step, backed by a passing automated test.
- [Guide: Nuxt](/docs/guides/nuxt): Nuxt integration, including the router hook for SPA page views. The pattern this site itself runs.
- [Changelog](/docs/changelog): What has actually landed, grouped by area.

## Policies

- [Privacy policy](/privacy): What personal data Nastar handles and why,
  split by the two roles it holds — controller for account data, processor
  for the consent records collected on customers' websites. Includes the
  real retention periods, the sub-processors, and the EU hosting region.
- [Cookie policy](/cookies): Every cookie and browser-storage entry
  `nastar.dev` itself uses. The session cookie is `nastar_session`; the
  visitor's consent decision lives in **local storage** under
  `nastar_consent_<siteKey>`, not in a cookie. Google Analytics cookies are
  loaded only after the analytics category is accepted.

## API

- [API reference](/docs/api): Links to the canonical, live OpenAPI JSON document and an interactive Swagger UI, both served by the API itself (OpenAPI 3.0.0 — see that page for the 3.1 gap). Production is `https://api.nastar.dev` — `/v1/openapi.json` for the document, `/v1/docs` for the interactive UI. Self-hosted or preview environments differ, and /docs/api resolves the right origin for whichever one you're on.

## Downloads

- [nastar-integration.md](/nastar-integration.md): Stepwise agent instructions for integrating Nastar into a customer website — the downloadable version of /docs/ai.

## Notes for AI agents

This file is a navigational aid, not a guarantee of support for any given
framework or a substitute for the canonical docs above. Always verify
against the live OpenAPI document rather than caching this summary.
Never request an OTP, a login session, or an SMTP credential from a
human to complete an integration — use a scoped setup token created in
the dashboard instead. Never claim universal cookie blocking,
certification, or legal compliance on Nastar's behalf. Never quote a
Nastar price: none has been published, and the only accurate answers are
"free during the public beta" and "paid plans start in Q1 2027, priced per
website".