@siedata/tag

Sovereign Intent Engine capture tag — the zero-dep JavaScript SDK that turns any agency-built client site into a compliant SIE publisher. Drop it in, and you get:

• A tenant-aware Consent Management Platform (CMP) banner, branded per-agency
• HMAC-signed event capture to api.siedata.dev
• TCF v2.2 awareness if an upstream CMP is already on the page
• Auto-capture of page views, form submissions (on form[data-sie-capture]), and tagged clicks
• Helpers for calculator results, quiz completions, and custom events

Signals, not scores. Intent, not eligibility. This SDK never collects FCRA-regulated fields.

Install

Via npm

npm install @siedata/tag

import SIETag from '@siedata/tag';

await SIETag.init({
  agency_id: 'acme-marketing',   // your agency tenant id
  client_id: 'client-123',        // the end-client site id
  api_base: 'https://api.siedata.dev',
});

Via CDN

<script
  src="https://cdn.siedata.dev/tag.js"
  data-agency-id="acme-marketing"
  data-client-id="client-123"
  async
></script>

The CDN bundle auto-initializes from data-* attributes on DOMContentLoaded.

Optional attributes: data-api-base, data-debug="1".

API

SIETag.init(config: InitConfig): Promise<void>

| Field | Required | Description | |---|---|---| | agency_id | yes | Agency tenant id | | client_id | yes | End-client site id | | api_base | no | Defaults to https://api.siedata.dev | | debug | no | Console logging | | disable_autocapture | no | Turn off page-view / form / click auto-listeners | | disable_cmp | no | Skip rendering the banner (use if host already has a CMP) | | hmac_secret | no | Shared secret for per-event HMAC-SHA256 signing | | hmac_key_id | no | Key id sent as X-SIE-Key-Id header |

SIETag.capture(event_type, payload?): Promise<CaptureResult>

Send a custom event. Built-in event types: pageview, form_submit, calculator_result, quiz_complete, click, custom (or any string).

await SIETag.capture('calculator_result', {
  calculator: 'mortgage',
  home_price: 450000,
  down_payment: 90000,
  rate_pct: 6.75,
});

SIETag.getConsent() / SIETag.setConsent({...})

Read or programmatically update the stored consent state. Always agency-scoped in localStorage.

SIETag.openPreferences()

Re-open the CMP banner (e.g. from a footer "Privacy Choices" link).

Auto-capture attributes

<!-- Captures form submit automatically -->
<form data-sie-capture data-sie-event="newsletter_signup">
  <input name="email" type="email" required />
  <button>Subscribe</button>
</form>

<!-- Captures click -->
<a href="/pricing" data-sie-capture data-sie-event="pricing_cta_click">See pricing</a>

Build

cd apps/sdk
npm install
npm run typecheck        # tsc --noEmit
npm run build            # produces dist/index.js (IIFE) + dist/index.esm.js (ESM) + dist/*.d.ts

Target bundle: < 20 KB minified, zero runtime dependencies.

FCRA Firewall

The SDK refuses to send fields whose names match the server-side FCRA blocklist. Any payload containing credit_score, fico_score, bankruptcy, payment_history, collections, employment_history, rental_history, criminal_record, or anything flagged regulatory_class = FCRA is rejected at the server. The SDK does not attempt to enforce this client-side — that is the server's job — but callers should not attempt to send those fields.

License

MIT. See LICENSE.