@cookiemunch/cli 0.4.2 → 0.6.0

package/dist/chunk-LJ433UVC.js

@@ -0,0 +1,1785 @@
+// src/diff.ts
+var READ_ONLY_CONFIG_FIELDS = ["effective", "warnings", "designWarnings", "region", "regulation", "copy", "rightsFormUrl", "version", "observeToken", "sdkBoot", "originEnv"];
+function withoutReadOnly(cfg) {
+  const out2 = { ...cfg };
+  for (const k of READ_ONLY_CONFIG_FIELDS) delete out2[k];
+  return out2;
+}
+function isPlainObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function mergeLikeServer(base, patch) {
+  const out2 = { ...base };
+  for (const [k, v] of Object.entries(patch)) {
+    const b = base[k];
+    if (v === null) delete out2[k];
+    else out2[k] = isPlainObject(v) ? mergeLikeServer(isPlainObject(b) ? b : {}, v) : v;
+  }
+  return out2;
+}
+function join(path, key) {
+  return path ? `${path}.${key}` : key;
+}
+function diffJson(before, after, path = "") {
+  if (isPlainObject(before) && isPlainObject(after)) {
+    const keys = [.../* @__PURE__ */ new Set([...Object.keys(before), ...Object.keys(after)])].sort();
+    return keys.flatMap((k) => {
+      const p = join(path, k);
+      if (!(k in after)) return [{ path: p, kind: "removed", from: before[k] }];
+      if (!(k in before)) return [{ path: p, kind: "added", to: after[k] }];
+      return diffJson(before[k], after[k], p);
+    });
+  }
+  if (Array.isArray(before) && Array.isArray(after)) {
+    const out2 = [];
+    const n = Math.max(before.length, after.length);
+    for (let i = 0; i < n; i++) {
+      const p = `${path}[${i}]`;
+      if (i >= after.length) out2.push({ path: p, kind: "removed", from: before[i] });
+      else if (i >= before.length) out2.push({ path: p, kind: "added", to: after[i] });
+      else out2.push(...diffJson(before[i], after[i], p));
+    }
+    return out2;
+  }
+  if (JSON.stringify(before) === JSON.stringify(after)) return [];
+  return [{ path: path || "(root)", kind: "changed", from: before, to: after }];
+}
+function show(v) {
+  const s = JSON.stringify(v);
+  return s === void 0 ? "undefined" : s.length > 120 ? `${s.slice(0, 117)}...` : s;
+}
+function formatChanges(changes) {
+  return changes.map(
+    (c) => c.kind === "added" ? `+ ${c.path}: ${show(c.to)}` : c.kind === "removed" ? `- ${c.path}: ${show(c.from)}` : `~ ${c.path}: ${show(c.from)} -> ${show(c.to)}`
+  ).join("\n");
+}
+
+// src/rights-page.ts
+import { CookieMunchApiError } from "@cookiemunch/sdk";
+var isConflict = (e) => e instanceof CookieMunchApiError && e.status === 409;
+function baseFrom(flag, read, h) {
+  if (flag === void 0) return read ?? null;
+  if (typeof flag === "string" && /^\d+$/.test(flag)) return Number(flag);
+  if (typeof flag === "string" && /^\d{4}-\d{2}-\d{2}T/.test(flag) && Number.isFinite(Date.parse(flag))) return flag;
+  throw h.usage("--base must be the draft\u2019s updatedAt (epoch ms, as pull prints it, or an ISO date)");
+}
+function issuesOf(e) {
+  if (!(e instanceof CookieMunchApiError) || e.status !== 422) return null;
+  const body = e.body;
+  return body?.issues ?? body?.problems ?? [];
+}
+async function rightsPageCommand(sub, p, io, client, h) {
+  const cbid = h.requireSite();
+  const report = (list) => io.stderr(`${list.map((i) => `  ${i.path || "(document)"}: ${i.message}`).join("\n")}
+`);
+  if (sub === "pull") {
+    const { draft, updatedAt } = await client.rightsPage.get(cbid);
+    const text = `${JSON.stringify(draft, null, 2)}
+`;
+    const out2 = typeof p.flags.out === "string" ? p.flags.out : void 0;
+    if (out2) {
+      await io.writeFile(out2, text);
+      io.stderr(`Wrote ${cbid}'s rights page draft to ${out2}
+`);
+    } else io.stdout(text);
+    if (updatedAt != null) io.stderr(`To refuse a push if anyone saves the draft after this pull, push with: --base ${updatedAt}
+`);
+    return 0;
+  }
+  if (sub === "diff" || sub === "push") {
+    const file = await h.readJson(p.positional[2]);
+    const read = await client.rightsPage.get(cbid);
+    const current = read.draft;
+    const base = baseFrom(p.flags.base, read.updatedAt, h);
+    let proposed2;
+    try {
+      proposed2 = (await client.rightsPage.dryRun(cbid, file, { mode: "put" })).draft;
+    } catch (e) {
+      const list = issuesOf(e);
+      if (!list) throw e;
+      io.stderr(`${p.positional[2]} is not a valid rights page:
+`);
+      report(list);
+      return 1;
+    }
+    const changes = diffJson(current, proposed2);
+    if (p.flags.json === true && (sub === "diff" || !changes.length)) io.stdout(`${JSON.stringify({ cbid, changes }, null, 2)}
+`);
+    if (!changes.length) {
+      io.stderr(`No changes: ${cbid}'s rights page draft already matches.
+`);
+      return 0;
+    }
+    if (p.flags.json !== true) io.stdout(`${formatChanges(changes)}
+`);
+    if (sub === "diff") {
+      io.stderr(`${changes.length} change${changes.length === 1 ? "" : "s"} (nothing saved). Apply with: cookiemunch rights-page push --site ${cbid} ${p.positional[2]}
+`);
+      return p.flags["exit-code"] === true ? 1 : 0;
+    }
+    let saved;
+    try {
+      saved = await client.rightsPage.put(cbid, file, { baseUpdatedAt: base });
+    } catch (e) {
+      if (!isConflict(e)) throw e;
+      io.stderr(`Not saved: ${cbid}'s rights page draft changed since ${p.flags.base !== void 0 ? "the --base you gave" : "this diff"} (someone else saved it).
+See what changed with: cookiemunch rights-page diff --site ${cbid} ${p.positional[2]}
+then push again.
+`);
+      return 1;
+    }
+    io.stderr(`Saved the draft (${changes.length} change${changes.length === 1 ? "" : "s"}). Nothing is live until: cookiemunch rights-page publish --site ${cbid}
+`);
+    if (saved.warnings.length) {
+      io.stderr("It cannot be published yet:\n");
+      report(saved.warnings);
+    }
+    return 0;
+  }
+  if (sub === "publish") {
+    const base = p.flags.base !== void 0 ? baseFrom(p.flags.base, null, h) : (await client.rightsPage.get(cbid)).updatedAt ?? null;
+    if (p.flags.yes !== true) {
+      if (!io.confirm) throw h.usage("rights-page publish puts the draft live and there is no terminal to confirm in. Pass --yes to publish without a prompt.");
+      if (!await io.confirm(`Publish ${cbid}'s rights page draft? It goes live at once. [y/N] `)) {
+        io.stderr("Not published.\n");
+        return 1;
+      }
+    }
+    try {
+      const r = await client.rightsPage.publish(cbid, { baseUpdatedAt: base });
+      io.stderr(`Published version ${r.version} of ${cbid}'s rights page.
+`);
+      return 0;
+    } catch (e) {
+      if (isConflict(e)) {
+        io.stderr(`Nothing was published: ${cbid}'s rights page draft changed since it was read (someone else saved it).
+Review it with: cookiemunch rights-page pull --site ${cbid}
+then publish again.
+`);
+        return 1;
+      }
+      const list = issuesOf(e);
+      if (!list) throw e;
+      io.stderr("The rights page cannot be published:\n");
+      report(list);
+      return 1;
+    }
+  }
+  throw h.usage(`unknown rights-page command: ${sub ?? "(none)"} \u2014 use pull, diff, push or publish`);
+}
+
+// src/csp.ts
+var KNOWN_MANIFEST_HOSTS = {
+  cookiemunch: ["cookiemunch.net", "api.cookiemunch.net"],
+  atlas: ["atlasauth.net", "api.atlasauth.net"],
+  chatly: ["chatlychat.com", "api.chatlychat.com"],
+  forumulate: ["forumulate.com"],
+  referalli: ["referalli.com"]
+};
+var ALIASES = { referally: "referalli" };
+var CSP_FRAMEWORKS = ["next", "express", "nginx"];
+function manifestSources(list, opts) {
+  const sources = [];
+  const unknown = [];
+  for (const raw of list.split(",").map((s) => s.trim()).filter(Boolean)) {
+    if (/^https:\/\//i.test(raw)) {
+      sources.push({ label: raw, urls: [raw] });
+      continue;
+    }
+    const name = ALIASES[raw.toLowerCase()] ?? raw.toLowerCase();
+    const hosts = KNOWN_MANIFEST_HOSTS[name];
+    if (!hosts) {
+      unknown.push(raw);
+      continue;
+    }
+    if (name === "cookiemunch" && opts.site) {
+      sources.push({ label: `cookiemunch (site ${opts.site})`, urls: [`${opts.apiBase.replace(/\/$/, "")}/v1/embed?cbid=${encodeURIComponent(opts.site)}`], product: name });
+      continue;
+    }
+    sources.push({ label: name, urls: hosts.map((h) => `https://${h}/.well-known/forgedeck-embed.json`), product: name });
+  }
+  return { sources, unknown };
+}
+var ORIGIN = /^(https|wss):\/\/[^\s*'"]+$/;
+var KEYWORD = /^('unsafe-inline'|'unsafe-eval'|'wasm-unsafe-eval'|'unsafe-hashes'|data:|blob:)$/;
+function mergeManifests(manifests) {
+  const byDirective = /* @__PURE__ */ new Map();
+  const add = (directive, list, allowKeywords) => {
+    if (!Array.isArray(list) || !/^[a-z-]+-src$|^form-action$/.test(directive)) return;
+    let set = byDirective.get(directive);
+    if (!set) byDirective.set(directive, set = /* @__PURE__ */ new Set());
+    for (const src of list) {
+      if (typeof src !== "string") continue;
+      if (src.includes("{")) continue;
+      if (ORIGIN.test(src) || allowKeywords && KEYWORD.test(src)) set.add(src);
+    }
+  };
+  for (const m of manifests) {
+    for (const s of Object.values(m.surfaces ?? {})) {
+      for (const [d, list] of Object.entries(s.csp ?? {})) add(d, list, false);
+      for (const [d, list] of Object.entries(s.requires ?? {})) add(d, list, true);
+    }
+  }
+  const out2 = /* @__PURE__ */ new Map();
+  out2.set("default-src", ["'self'"]);
+  for (const [d, set] of [...byDirective.entries()].sort(([a], [b]) => a.localeCompare(b))) {
+    if (set.size === 0) continue;
+    const keywords = [...set].filter((s) => !ORIGIN.test(s)).sort();
+    const origins = [...set].filter((s) => ORIGIN.test(s)).sort();
+    out2.set(d, ["'self'", ...keywords, ...origins]);
+  }
+  return out2;
+}
+function placeholders(manifests) {
+  const out2 = /* @__PURE__ */ new Set();
+  for (const m of manifests) {
+    for (const s of Object.values(m.surfaces ?? {})) {
+      for (const map of [s.csp, s.requires]) {
+        for (const list of Object.values(map ?? {})) {
+          if (Array.isArray(list)) {
+            for (const src of list) if (typeof src === "string" && src.includes("{")) out2.add(src);
+          }
+        }
+      }
+    }
+  }
+  return [...out2].sort();
+}
+function policyString(policy) {
+  return [...policy.entries()].map(([d, list]) => `${d} ${list.join(" ")}`).join("; ");
+}
+function renderPolicy(policy, framework) {
+  const value = policyString(policy);
+  if (framework === "next") {
+    return [
+      "// next.config.js",
+      "async headers() {",
+      "  return [{",
+      "    source: '/(.*)',",
+      `    headers: [{ key: 'Content-Security-Policy', value: ${JSON.stringify(value)} }],`,
+      "  }];",
+      "},"
+    ].join("\n");
+  }
+  if (framework === "express") {
+    return `app.use((req, res, next) => { res.setHeader('Content-Security-Policy', ${JSON.stringify(value)}); next(); });`;
+  }
+  if (framework === "nginx") return `add_header Content-Security-Policy "${value.replace(/"/g, '\\"')}" always;`;
+  return value;
+}
+async function fetchManifest(src, fetchImpl) {
+  const tried = [];
+  for (const url of src.urls) {
+    try {
+      const res = await fetchImpl(url, { headers: { Accept: "application/json" }, redirect: "manual" });
+      if (!res.ok) {
+        tried.push(`${url} answered ${res.status}`);
+        continue;
+      }
+      const doc = await res.json();
+      if (!doc || typeof doc !== "object" || !doc.surfaces || typeof doc.surfaces !== "object") {
+        tried.push(`${url} is not an embed manifest (no surfaces)`);
+        continue;
+      }
+      if (src.product && doc.product !== src.product) {
+        tried.push(`${url} speaks for "${String(doc.product)}", not ${src.product}`);
+        continue;
+      }
+      return { ok: true, manifest: doc, url };
+    } catch (e) {
+      tried.push(`${url}: ${e.message}`);
+    }
+  }
+  return { ok: false, error: tried.join("; ") || "no URL to try" };
+}
+async function cspCommand(opts, io, usage) {
+  if (!opts.merge) throw usage("--merge is required: vendor names (cookiemunch, atlas, chatly, forumulate, referalli) or manifest URLs, comma-separated");
+  if (opts.framework !== void 0 && !CSP_FRAMEWORKS.includes(opts.framework)) {
+    throw usage(`--framework must be one of ${CSP_FRAMEWORKS.join(", ")}`);
+  }
+  const { sources, unknown } = manifestSources(opts.merge, { apiBase: opts.apiBase, ...opts.site ? { site: opts.site } : {} });
+  if (unknown.length) throw usage(`unknown vendor: ${unknown.join(", ")}. Name one of ${Object.keys(KNOWN_MANIFEST_HOSTS).join(", ")}, or pass its manifest URL (https://\u2026/.well-known/forgedeck-embed.json).`);
+  const manifests = [];
+  let failed = 0;
+  for (const src of sources) {
+    const r = await fetchManifest(src, io.fetch);
+    if (r.ok) manifests.push(r.manifest);
+    else {
+      failed++;
+      io.stderr(`${src.label}: no manifest \u2014 ${r.error}
+`);
+    }
+  }
+  if (manifests.length === 0) return 1;
+  const policy = mergeManifests(manifests);
+  io.stdout(`${renderPolicy(policy, opts.framework)}
+`);
+  const left = placeholders(manifests);
+  if (left.length) io.stderr(`Tenant-specific sources left out (fill in your own value): ${left.join(", ")}
+`);
+  return failed ? 1 : 0;
+}
+
+// src/cli.ts
+import { createCookieMunch, CookieMunchApiError as CookieMunchApiError2, mintConsentSyncToken, runExecutorConformance } from "@cookiemunch/sdk";
+
+// src/integrations.ts
+var out = (io, v) => io.stdout(`${JSON.stringify(v, null, 2)}
+`);
+async function siteCommand(sub, io, client, h, file) {
+  if (sub === "brand") return brandCommand(io, client, h, file);
+  if (sub !== "update") throw h.usage("usage: cookiemunch site update --site <cbid> [--domain <host>] [--name <name>] [--aliases a,b] [--dry-run]");
+  const cbid = h.requireSite();
+  const domain = h.flag("domain");
+  const name = h.flag("name");
+  const aliases = h.flag("aliases");
+  const patch = {};
+  if (typeof domain === "string") patch.domain = domain;
+  if (h.flag("clear-name") === true) patch.name = null;
+  else if (typeof name === "string") patch.name = name;
+  if (typeof aliases === "string") patch.aliases = aliases.split(",").map((a) => a.trim()).filter(Boolean);
+  if (Object.keys(patch).length === 0) throw h.usage("nothing to change: give --domain, --name, --clear-name or --aliases");
+  const r = await client.sites.update(cbid, patch, { dryRun: h.flag("dry-run") === true });
+  out(io, r);
+  if (r.effects.verification === "reset") io.stderr("The domain moved: verify the new domain (GET /v1/sites/{cbid}/verify/challenge).\n");
+  for (const w of r.warnings ?? []) io.stderr(`warning (${w.field}): ${w.reason}
+`);
+  return 0;
+}
+async function brandCommand(io, client, h, file) {
+  const cbid = h.requireSite();
+  const url = h.flag("url");
+  const r = typeof url === "string" ? await client.sites.setBrand(cbid, { url }, { dryRun: h.flag("dry-run") === true }) : file ? await client.sites.setBrand(cbid, await h.readJson(file), { dryRun: h.flag("dry-run") === true }) : await client.sites.getBrand(cbid);
+  out(io, r);
+  for (const w of r.warnings) io.stderr(`warning (${w.role}): ${w.message}
+`);
+  for (const w of r.configWarnings ?? []) io.stderr(`warning (${w.field}): ${w.reason}
+`);
+  return 0;
+}
+async function healthCommand(io, client, h) {
+  const failOn = h.flag("fail-on") ?? "warning";
+  if (failOn !== "error" && failOn !== "warning" && failOn !== "never") throw h.usage("--fail-on must be error, warning or never");
+  const r = await client.integrationHealth(h.site());
+  if (h.flag("json") === true) out(io, r);
+  else {
+    for (const c of r.checks) {
+      const mark = c.waived ? "WAIV" : c.ok === true ? "ok  " : c.ok === false ? c.severity === "error" ? "FAIL" : "WARN" : "--  ";
+      const net = c.hop ? ` (${c.hop}${c.status !== void 0 ? ` ${c.status}` : ""}${c.elapsedMs !== void 0 ? `, ${c.elapsedMs} ms` : ""})` : "";
+      io.stdout(`${mark} ${c.check} \u2014 ${c.subject}${c.detail ? `: ${c.detail}` : ""}${net}${c.waived ? ` \u2014 waived: ${c.waived.reason}` : ""}
+`);
+      const fix = c.fix ?? c.fixHint;
+      if (c.ok === false && fix) io.stdout(`     fix: ${fix}
+`);
+    }
+    io.stdout(`${r.counts.error} error(s), ${r.counts.warning} warning(s), ${r.counts.notChecked} not checked${r.counts.waived ? `, ${r.counts.waived} waived` : ""}
+`);
+  }
+  if (failOn === "never") return 0;
+  const failing = r.checks.filter((c) => c.ok === false && (c.severity === "error" || failOn === "warning" && c.severity === "warning"));
+  return failing.length ? 1 : 0;
+}
+async function provisionCommand(file, io, client, h) {
+  const input = await h.readJson(file);
+  const v2 = input;
+  if (v2.forgedeck !== void 0 || v2.site && typeof v2.site === "object") {
+    const body = { ...v2 };
+    if (body.self) {
+      const { keyEnv, ...self } = body.self;
+      const secret = typeof keyEnv === "string" ? io.env[keyEnv] : void 0;
+      if (!secret) throw h.usage(`self needs its key: set self.keyEnv in the file and export that variable`);
+      body.self = { ...self, secret };
+    }
+    if (body.atlas && io.env.COOKIEMUNCH_ATLAS_SECRET_KEY) body.atlas = { ...body.atlas, secretKey: io.env.COOKIEMUNCH_ATLAS_SECRET_KEY };
+    if (body.forumulate && io.env.COOKIEMUNCH_FORUMULATE_TOKEN) body.forumulate = { ...body.forumulate, token: io.env.COOKIEMUNCH_FORUMULATE_TOKEN };
+    const fromStep = h.flag("from-step");
+    const r2 = await client.provision(body, { dryRun: h.flag("dry-run") === true, ...typeof fromStep === "string" ? { fromStep } : {} });
+    if (h.flag("json") === true) out(io, r2);
+    else {
+      for (const s of r2.steps) {
+        const w = s.waitingOn;
+        const waiting = typeof w === "string" ? w : w ? `${w.platform}: ${(w.items ?? []).join(", ")}` : "";
+        io.stdout(`${s.status.padEnd(12)} ${s.id ?? s.step}${s.detail ? ` \u2014 ${s.detail}` : ""}${waiting ? ` (waiting on ${waiting})` : ""}
+`);
+      }
+      io.stdout(`${r2.dryRun ? "dry run: " : ""}${r2.summary.changed} changed, ${r2.summary.unchanged} unchanged, ${r2.summary.waiting} waiting, ${r2.summary.failed} failed
+`);
+    }
+    return r2.summary.failed ? 1 : 0;
+  }
+  const withSecrets = { ...input };
+  if (input.atlas || io.env.COOKIEMUNCH_ATLAS_SECRET_KEY) {
+    const secretKey = io.env.COOKIEMUNCH_ATLAS_SECRET_KEY ?? input.atlas?.secretKey;
+    if (!secretKey) throw h.usage("set COOKIEMUNCH_ATLAS_SECRET_KEY for the atlas step");
+    withSecrets.atlas = { ...input.atlas ?? {}, secretKey };
+  }
+  if (input.forumulate) {
+    const token = io.env.COOKIEMUNCH_FORUMULATE_TOKEN ?? input.forumulate.token;
+    if (!token) throw h.usage("set COOKIEMUNCH_FORUMULATE_TOKEN for the forumulate step");
+    withSecrets.forumulate = { ...input.forumulate, token };
+  }
+  const r = await client.provision(withSecrets, { dryRun: h.flag("dry-run") === true });
+  if (h.flag("json") === true) {
+    out(io, r);
+    return r.summary.failed ? 1 : 0;
+  }
+  for (const s of r.steps) {
+    io.stdout(`${s.status.padEnd(12)} ${s.step}${s.detail ? ` \u2014 ${s.detail}` : ""}${s.waitingOn ? ` (waiting on ${s.waitingOn})` : ""}
+`);
+  }
+  io.stdout(`${r.dryRun ? "dry run: " : ""}${r.summary.changed} changed, ${r.summary.unchanged} unchanged, ${r.summary.waiting} waiting, ${r.summary.failed} failed
+`);
+  return r.summary.failed ? 1 : 0;
+}
+async function partnersCommand(sub, rest, io, client, h) {
+  const cbid = h.requireSite();
+  if (sub === "list") {
+    out(io, await client.sites.listPartners(cbid));
+    return 0;
+  }
+  if (sub === "link") {
+    const partner = h.flag("partner");
+    const externalId = h.flag("external-id");
+    if (typeof partner !== "string" || !/^[a-z][a-z0-9_]{1,39}$/.test(partner)) throw h.usage("--partner <id> is required: forumulate, atlas, chatly, referalli, or one registered on the deployment");
+    if (typeof externalId !== "string") throw h.usage("--external-id <the partner\u2019s account id> is required");
+    const label = h.flag("label");
+    const input = { partner, externalId, ...typeof label === "string" ? { label } : {} };
+    out(io, await client.sites.linkPartner(cbid, input, { dryRun: h.flag("dry-run") === true }));
+    return 0;
+  }
+  if (sub === "unlink") {
+    const id = rest[0];
+    if (!id) throw h.usage("usage: cookiemunch partners unlink <linkId> --site <cbid>");
+    out(io, await client.sites.unlinkPartner(cbid, id));
+    return 0;
+  }
+  throw h.usage("usage: cookiemunch partners list|link|unlink --site <cbid>");
+}
+async function keysCommand(sub, io, client, h) {
+  if (sub !== "report") throw h.usage("usage: cookiemunch keys report [--unused-days <n>] [--expiring-days <n>] [--json]");
+  const n = (name) => {
+    const v = h.flag(name);
+    if (v === void 0) return void 0;
+    const x = Number(v);
+    if (!Number.isInteger(x) || x < 1 || x > 3650) throw h.usage(`--${name} must be whole days from 1 to 3650`);
+    return x;
+  };
+  const unusedDays = n("unused-days");
+  const expiringDays = n("expiring-days");
+  const r = await client.keys.report({ ...unusedDays ? { unusedDays } : {}, ...expiringDays ? { expiringDays } : {} });
+  if (h.flag("json") === true) {
+    out(io, r);
+    return 0;
+  }
+  const section = (title, rows) => {
+    io.stdout(`${title}: ${rows.length}
+`);
+    for (const k of rows) io.stdout(`  ${k.prefix}${k.name ? ` (${k.name})` : ""} \u2014 ${k.reason}
+`);
+  };
+  section(`Unused for ${r.unusedDays}+ days`, r.unused);
+  section("Broad access", r.broad);
+  section(`Expiring within ${r.expiringDays} days`, r.expiringSoon);
+  const revoked = r.revoked ?? [];
+  io.stdout(`Revoked: ${revoked.length}
+`);
+  for (const k of revoked) io.stdout(`  ${k.prefix}${k.name ? ` (${k.name})` : ""} \u2014 ${k.reason} ${new Date(k.revokedAt).toISOString()} by ${k.revokedBy}; last used ${k.lastUsedAt ? new Date(k.lastUsedAt).toISOString() : "never"}
+`);
+  io.stdout(`${r.total} key(s), ${r.noExpiry} with no expiry
+`);
+  return 0;
+}
+
+// src/design-warnings.ts
+function where(f) {
+  const w = f.where ?? {};
+  return [
+    f.layer === "banner" ? "first layer" : `${f.layer} layer`,
+    w.view ? `view "${w.view}"` : "",
+    w.variant && w.variant !== "base" ? `variant ${w.variant}` : "",
+    w.theme === "dark" ? "dark theme" : "",
+    w.breakpoint === "mobile" ? "mobile" : "",
+    w.language ? `language ${w.language}` : ""
+  ].filter(Boolean).join(", ");
+}
+function formatDesignWarnings(findings) {
+  return findings.map((f) => `${f.severity === "warning" ? "warning" : "notice "}  ${f.code}  ${where(f)}
+    ${f.detail}
+    fix: ${f.fix}`).join("\n");
+}
+function countBySeverity(findings) {
+  const warnings = findings.filter((f) => f.severity === "warning").length;
+  return { warnings, notices: findings.length - warnings };
+}
+function summaryLine(findings) {
+  const { warnings, notices } = countBySeverity(findings);
+  if (warnings + notices === 0) return "No design warnings: Accept all and Reject all have equal weight.";
+  if (warnings === 0) {
+    return `Design: 0 warnings, ${notices} notice${notices === 1 ? "" : "s"} \u2014 worth a look, not a finding that Accept is favoured. See https://cookiemunch.net/docs/fair-consent-buttons`;
+  }
+  return `Design: ${warnings} warning${warnings === 1 ? "" : "s"}, ${notices} notice${notices === 1 ? "" : "s"} \u2014 Accept is pushed harder than Reject. Regulators treat that as a dark pattern; make both buttons the same style. See https://cookiemunch.net/docs/fair-consent-buttons`;
+}
+
+// src/ops.ts
+var json = (h) => h.flag("json") === true;
+var print = (io, v) => io.stdout(`${JSON.stringify(v, null, 2)}
+`);
+var str = (h, name) => {
+  const v = h.flag(name);
+  return typeof v === "string" ? v : void 0;
+};
+async function versionCommand(io, cliVersion, base, asJson) {
+  if (!asJson) {
+    io.stdout(`${cliVersion}
+`);
+    return 0;
+  }
+  let api = null;
+  try {
+    const res = await io.fetch(`${base.replace(/\/+$/, "")}/v1/openapi.json`);
+    if (res.ok) api = (await res.json()).info?.version ?? null;
+  } catch {
+  }
+  print(io, { cli: cliVersion, api });
+  return 0;
+}
+function cookieRows(file) {
+  const rows = Array.isArray(file) ? file : Array.isArray(file.cookies) ? file.cookies : null;
+  if (!rows || !rows.every((r) => r && typeof r === "object" && typeof r.name === "string")) {
+    throw new Error('the file must hold { "cookies": [ { "name", "category", "purpose", \u2026 } ] } or that array');
+  }
+  return rows;
+}
+async function cookiesFileCommand(sub, io, client, h) {
+  const cbid = h.requireSite();
+  const path = h.positional[2];
+  if (!path) throw h.usage(`usage: cookiemunch cookies ${sub} <file> --site <cbid> [--replace]`);
+  let rows;
+  try {
+    rows = cookieRows(await h.readJson(path));
+  } catch (e) {
+    throw h.usage(e.message);
+  }
+  const replace = h.flag("replace") === true;
+  const dry = await client.sites.declareCookies(cbid, rows, { replace, dryRun: true });
+  const diff = dry.diff ?? { added: [], removed: [], changed: [] };
+  const n = diff.added.length + diff.removed.length + diff.changed.length;
+  if (json(h)) print(io, { cbid, changes: n, diff, ...dry.warnings?.length ? { warnings: dry.warnings } : {} });
+  else if (n === 0) io.stderr(`No changes: ${cbid}'s declarations already match.
+`);
+  else {
+    for (const c of diff.added) io.stdout(`+ ${c.name} (${c.category})
+`);
+    for (const c of diff.removed) io.stdout(`- ${c.name}
+`);
+    for (const c of diff.changed) io.stdout(`~ ${c.name}: ${formatChanges(diffJson(c.before, c.after))}
+`);
+  }
+  for (const w of dry.warnings ?? []) io.stderr(`warning: ${JSON.stringify(w)}
+`);
+  if (sub === "diff") return n > 0 && h.flag("exit-code") === true ? 1 : 0;
+  if (n === 0) return 0;
+  const saved = await client.sites.declareCookies(cbid, rows, { replace });
+  io.stderr(`Applied: ${saved.saved} saved, ${saved.removed} removed.
+`);
+  return 0;
+}
+var EXECUTOR_FIELDS = ["system", "baseUrl", "profile", "auto", "subjectNote", "cbid", "preset", "presetVersion", "presetParams"];
+function executorFileView(e) {
+  const out2 = { id: e.id };
+  for (const k of EXECUTOR_FIELDS) {
+    const v = e[k];
+    if (v !== void 0) out2[k] = v;
+  }
+  return out2;
+}
+async function executorsFileCommand(sub, io, client, h) {
+  const current = (await client.fulfillment.executors()).map(executorFileView);
+  if (sub === "pull") {
+    const text = `${JSON.stringify({ executors: current }, null, 2)}
+`;
+    const path2 = str(h, "out") ?? h.positional[2];
+    if (path2) {
+      await io.writeFile(path2, text);
+      io.stderr(`Wrote ${current.length} connection(s) to ${path2} (no secrets).
+`);
+    } else io.stdout(text);
+    return 0;
+  }
+  const path = h.positional[2];
+  if (!path) throw h.usage(`usage: cookiemunch executors ${sub} <file> [--secret-env NAME]`);
+  const file = await h.readJson(path);
+  const wanted = Array.isArray(file.executors) ? file.executors : null;
+  if (!wanted) throw h.usage(`${path} must hold { "executors": [ \u2026 ] } (cookiemunch executors pull writes one)`);
+  for (const w of wanted) {
+    for (const k of ["secretKey", "secret", "webhookSecret"]) if (k in w) throw h.usage(`${path} carries ${k}: secrets never go in this file; pass --secret-env NAME`);
+  }
+  const plan = [];
+  for (const w of wanted) {
+    const match = current.find((c) => w.id && c.id === w.id || !w.id && c.system === w.system);
+    const { id: _i, ...want } = w;
+    if (!match) {
+      plan.push({ system: String(w.system), action: "create", changes: diffJson({}, want) });
+      continue;
+    }
+    const { id, ...have } = match;
+    const changes = diffJson(Object.fromEntries(Object.keys(want).map((k) => [k, have[k] ?? null])), want);
+    plan.push({ system: String(w.system), action: changes.length ? "update" : "unchanged", id: String(id), changes });
+  }
+  const pending = plan.filter((p) => p.action !== "unchanged");
+  if (json(h)) print(io, { plan });
+  else if (!pending.length) io.stderr("No changes: every connection already matches.\n");
+  else for (const p of pending) io.stdout(`${p.action} ${p.system}${p.id ? ` (${p.id})` : ""}
+${formatChanges(p.changes).replace(/^/gm, "  ")}
+`);
+  if (sub === "diff") return pending.length && h.flag("exit-code") === true ? 1 : 0;
+  const secretEnv = str(h, "secret-env");
+  const creating = pending.filter((p) => p.action === "create");
+  if (creating.length && !(secretEnv && io.env[secretEnv])) {
+    throw h.usage(`creating ${creating.map((p) => p.system).join(", ")} needs its API key: pass --secret-env NAME and export NAME`);
+  }
+  for (const p of pending) {
+    const w = wanted.find((x) => String(x.system) === p.system);
+    const { id: _i, ...body } = w;
+    if (p.action === "update") {
+      await client.fulfillment.updateExecutor(p.id, Object.fromEntries(p.changes.map((c) => c.path.split(/[.[]/)[0]).filter((k, i, a) => a.indexOf(k) === i).map((k) => [k, body[k]])));
+    } else {
+      const secretKey = secretEnv ? io.env[secretEnv] : void 0;
+      if (!secretKey) throw h.usage(`creating ${p.system} needs its API key: set --secret-env NAME and export NAME`);
+      await client.fulfillment.connectExecutor({ ...body, secretKey });
+    }
+  }
+  io.stderr(`Applied ${pending.length} change(s).
+`);
+  return 0;
+}
+async function dsarTestCommand(io, client, h) {
+  const types = (str(h, "types") ?? "access").split(",").map((t) => t.trim()).filter(Boolean);
+  const allowed = ["access", "deletion", "rectification", "portability", "opt-out"];
+  const bad = types.filter((t) => !allowed.includes(t));
+  if (bad.length) throw h.usage(`--types takes ${allowed.join(", ")}; not ${bad.join(", ")}`);
+  const withCbid = h.flag("with-cbid") === true;
+  const without = h.flag("without-cbid") === true || !withCbid;
+  const cbid = withCbid ? h.requireSite() : void 0;
+  const email = str(h, "email") ?? "cookiemunch-cli-test@example.invalid";
+  const created = [];
+  let failed = false;
+  try {
+    for (const type of types) {
+      for (const scoped of [...withCbid ? [true] : [], ...without ? [false] : []]) {
+        const r = await client.dsar.create({ type, subjectEmail: email, regulation: "gdpr", test: true, ...scoped ? { cbid } : {} });
+        const back = await client.dsar.get(r.request.id);
+        created.push({ id: r.request.id, type, cbid: scoped ? cbid : null, status: String(back.status) });
+      }
+    }
+  } catch (e) {
+    failed = true;
+    io.stderr(`dsar test: ${e.message}
+`);
+  }
+  const deleted = [];
+  if (h.flag("cleanup") === true) {
+    for (const c of created) {
+      try {
+        await client.dsar.delete(c.id);
+        deleted.push(c.id);
+      } catch (e) {
+        failed = true;
+        io.stderr(`could not delete test request ${c.id}: ${e.message}
+`);
+      }
+    }
+  }
+  if (json(h)) print(io, { created, deleted });
+  else {
+    for (const c of created) io.stdout(`${c.id}  ${c.type}${c.cbid ? ` cbid=${c.cbid}` : " (no cbid)"}  ${c.status}${deleted.includes(c.id) ? "  (deleted)" : ""}
+`);
+    io.stderr(`${created.length} test request(s) filed${h.flag("cleanup") === true ? `, ${deleted.length} deleted` : "; delete them with --cleanup or DELETE /v1/dsar/{id}"}.
+`);
+  }
+  return failed ? 1 : 0;
+}
+async function doctorCommand(io, client, h, cliVersion) {
+  const checks = [];
+  let me = null;
+  try {
+    me = await client.me();
+    checks.push({ check: "key", ok: true, detail: `org ${me?.orgName ?? me?.orgId} (${me?.orgId}), key ${me?.keyPrefix}${me?.unscoped ? ", full access" : ""}` });
+  } catch (e) {
+    checks.push({ check: "key", ok: false, detail: e.message });
+  }
+  const wantOrg = str(h, "org") ?? io.env.COOKIEMUNCH_ORG;
+  if (wantOrg && me?.orgId) checks.push({ check: "org", ok: me.orgId === wantOrg, detail: me.orgId === wantOrg ? `this key belongs to ${wantOrg}` : `this key's org is ${me.orgId}, not ${wantOrg}, the org your config names` });
+  try {
+    const self = await client.keys.self();
+    const left = typeof self.expiresAt === "number" ? Math.floor((self.expiresAt - Date.now()) / 864e5) : null;
+    checks.push({ check: "key expiry", ok: left === null ? null : left > 7, detail: left === null ? "no expiry: give automation keys one" : `expires in ${left} day(s)` });
+  } catch {
+    checks.push({ check: "key expiry", ok: null, detail: "this server cannot read the key itself (GET /v1/keys/self)" });
+  }
+  try {
+    const res = await io.fetch("https://registry.npmjs.org/@cookiemunch/cli/latest");
+    const latest = res.ok ? (await res.json()).version : void 0;
+    checks.push({ check: "cli version", ok: latest ? latest === cliVersion : null, detail: latest ? latest === cliVersion ? `${cliVersion}, the latest` : `${cliVersion}; ${latest} is out` : `${cliVersion}; could not check the latest` });
+  } catch {
+    checks.push({ check: "cli version", ok: null, detail: `${cliVersion}; could not check the latest` });
+  }
+  const site = h.site();
+  if (site || me) {
+    try {
+      const r = await client.integrationHealth(site);
+      checks.push({ check: "integration health", ok: r.ok, detail: `${r.counts.error} error(s), ${r.counts.warning} warning(s)` });
+    } catch (e) {
+      checks.push({ check: "integration health", ok: null, detail: e.message });
+    }
+  }
+  if (json(h)) print(io, { ok: checks.every((c) => c.ok !== false), checks });
+  else for (const c of checks) io.stdout(`${c.ok === true ? "ok  " : c.ok === false ? "FAIL" : "--  "} ${c.check}: ${c.detail}
+`);
+  return checks.some((c) => c.ok === false) ? 1 : 0;
+}
+function parseTtl(v) {
+  const m = /^(\d+)([smh]?)$/.exec(v.trim());
+  if (!m) return null;
+  const n = Number(m[1]) * (m[2] === "h" ? 3600 : m[2] === "m" ? 60 : 1);
+  return n >= 60 && n <= 43200 ? n : null;
+}
+async function keysExtraCommand(sub, io, client, h) {
+  if (sub === "self") {
+    print(io, await client.keys.self());
+    return 0;
+  }
+  if (sub === "rotate-self") {
+    const r = await client.keys.rollSelf();
+    if (json(h)) print(io, r);
+    else {
+      io.stdout(`${r.key ?? r.sealed_secret}
+`);
+      io.stderr("The old key stopped working. This new one is shown once: store it now.\n");
+    }
+    return 0;
+  }
+  if (sub === "vend") {
+    const scopes = (str(h, "scopes") ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+    if (!scopes.length) throw h.usage("--scopes a,b is required (a vended key is never full access)");
+    const ttl = parseTtl(str(h, "ttl") ?? "");
+    if (ttl === null) throw h.usage("--ttl is required: 1h, 30m or seconds, from 60 s to 12 h");
+    const cbids = str(h, "cbids")?.split(",").map((s) => s.trim()).filter(Boolean);
+    const name = str(h, "name");
+    const r = await client.keys.vend({ scopes, ttlSeconds: ttl, ...cbids?.length ? { cbids } : {}, ...name ? { name } : {} });
+    if (json(h)) print(io, r);
+    else {
+      io.stdout(`${r.key ?? r.sealed_secret}
+`);
+      io.stderr(`Valid until ${new Date(r.expiresAt).toISOString()} (${scopes.join(", ")}).
+`);
+    }
+    return 0;
+  }
+  throw h.usage("usage: cookiemunch keys report|vend|self|rotate-self");
+}
+var PARTS = ["site", "config", "cookies", "presets", "rightsPage", "executors", "webhooks", "partners"];
+async function bundleCommand(sub, io, client, h) {
+  const path = h.positional[1] ?? "cookiemunch.json";
+  const b = await h.readJson(path);
+  for (const k of Object.keys(b)) if (!PARTS.includes(k) && k !== "$schema") throw h.usage(`${path}: unknown part ${k}; parts are ${PARTS.join(", ")}`);
+  const cbid = b.site?.cbid ?? h.site();
+  if (!cbid) throw h.usage(`${path} needs site.cbid (or --site)`);
+  const plans = [];
+  if (b.site) {
+    const patch = { ...b.site.domain ? { domain: b.site.domain } : {}, ...b.site.name !== void 0 ? { name: b.site.name } : {}, ...b.site.aliases ? { aliases: b.site.aliases } : {} };
+    if (Object.keys(patch).length) {
+      const r = await client.sites.update(cbid, patch, { dryRun: true });
+      plans.push({ part: "site", changes: r.diff.length, detail: r.diff.map((d) => `${d.field}: ${JSON.stringify(d.before)} \u2192 ${JSON.stringify(d.after)}`), apply: async () => {
+        await client.sites.update(cbid, patch);
+        return "site updated";
+      } });
+    } else plans.push({ part: "site", changes: 0, detail: [] });
+  }
+  if (b.config) {
+    const r = await client.sites.dryRunConfig(cbid, b.config, { mode: "patch" });
+    const diff = r.diff ?? [];
+    plans.push({ part: "config", changes: diff.length, detail: diff.map((d) => `${d.path}: ${JSON.stringify(d.from)} \u2192 ${JSON.stringify(d.to)}`), apply: async () => {
+      await client.sites.patchConfig(cbid, b.config);
+      return "config patched";
+    } });
+  }
+  if (b.cookies) {
+    const r = await client.sites.declareCookies(cbid, b.cookies, { dryRun: true });
+    const d = r.diff ?? { added: [], removed: [], changed: [] };
+    plans.push({ part: "cookies", changes: d.added.length + d.removed.length + d.changed.length, detail: [...d.added.map((c) => `+ ${c.name}`), ...d.removed.map((c) => `- ${c.name}`), ...d.changed.map((c) => `~ ${c.name}`)], apply: async () => {
+      const s = await client.sites.declareCookies(cbid, b.cookies);
+      return `${s.saved} declaration(s) saved`;
+    } });
+  }
+  for (const p of b.presets ?? []) {
+    const r = await client.sites.applyCookiePreset(cbid, p.vendor, p.params ?? {}, { dryRun: true });
+    const d = r.diff;
+    const n = d ? d.added.length + d.removed.length + d.changed.length : 0;
+    plans.push({ part: "presets", changes: n, detail: n ? [`${p.vendor}: ${n} declaration change(s)`] : [], apply: async () => {
+      await client.sites.applyCookiePreset(cbid, p.vendor, p.params ?? {});
+      return `preset ${p.vendor} applied`;
+    } });
+  }
+  if (b.rightsPage) {
+    const r = await client.rightsPage.dryRun(cbid, b.rightsPage, { mode: "put" });
+    const diff = r.diff ?? [];
+    plans.push({ part: "rightsPage", changes: diff.length, detail: diff.map((d) => d.path), apply: async () => {
+      await client.rightsPage.put(cbid, b.rightsPage);
+      return "rights page draft saved (publish it with cookiemunch rights-page publish)";
+    } });
+  }
+  if (b.executors) {
+    const current = (await client.fulfillment.executors()).map(executorFileView);
+    let n = 0;
+    const detail = [];
+    for (const w of b.executors) {
+      for (const k of ["secretKey", "secret", "webhookSecret"]) if (k in w) throw h.usage(`${path}: executors carry no secrets (${k}); use --secret-env`);
+      const m = current.find((c) => c.system === w.system);
+      const { id: _i, ...want } = w;
+      const changes = m ? diffJson(Object.fromEntries(Object.keys(want).map((k) => [k, m[k] ?? null])), want) : diffJson({}, want);
+      if (changes.length) {
+        n++;
+        detail.push(`${m ? "update" : "create"} ${String(w.system)}`);
+      }
+    }
+    plans.push({ part: "executors", changes: n, detail, apply: async () => {
+      await executorsFileCommand("push", io, client, { ...h, positional: ["executors", "push", path], readJson: async () => ({ executors: b.executors }) });
+      return "executors pushed";
+    } });
+  }
+  if (b.webhooks) {
+    const have = await client.webhooks.list();
+    const missing = b.webhooks.filter((w) => !have.some((x) => x.url === w.url));
+    const changed = b.webhooks.filter((w) => {
+      const x = have.find((y) => y.url === w.url);
+      return x && JSON.stringify([...x.events].sort()) !== JSON.stringify([...w.events].sort());
+    });
+    plans.push({
+      part: "webhooks",
+      changes: missing.length + changed.length,
+      detail: [...missing.map((w) => `+ ${w.url}`), ...changed.map((w) => `~ ${w.url} events`)],
+      apply: async () => {
+        const secretsOut = str(h, "secrets-out");
+        if (missing.length && !secretsOut) throw h.usage("creating webhooks shows their signing secrets once: pass --secrets-out <file> (written 0600)");
+        const secrets = {};
+        for (const w of missing) {
+          const s = await client.webhooks.create({ url: w.url, events: w.events, ...w.cbid !== void 0 ? { cbid: w.cbid } : {} });
+          if (s.secret) secrets[w.url] = s.secret;
+        }
+        for (const w of changed) {
+          const x = have.find((y) => y.url === w.url);
+          await client.webhooks.update(x.id, { events: w.events });
+        }
+        if (secretsOut && Object.keys(secrets).length) await io.writeFile(secretsOut, `${JSON.stringify(secrets, null, 2)}
+`, 384);
+        return `${missing.length} created, ${changed.length} updated`;
+      }
+    });
+  }
+  if (b.partners) {
+    const have = await client.partnerLinks.list();
+    const missing = b.partners.filter((p) => !have.some((l) => l.partner === p.partner && l.resource === p.resource && l.status !== "revoked"));
+    plans.push({ part: "partners", changes: missing.length, detail: missing.map((p) => `+ ${p.partner} on ${p.resource} (${p.scopes.join(", ")})`), apply: async () => {
+      for (const p of missing) await client.partnerLinks.create(p);
+      return `${missing.length} link(s) created`;
+    } });
+  }
+  const total = plans.reduce((n, p) => n + p.changes, 0);
+  if (sub === "plan") {
+    if (json(h)) print(io, { file: path, cbid, changes: total, parts: plans.map(({ apply: _a, ...p }) => p) });
+    else for (const p of plans) {
+      io.stdout(`${p.part}: ${p.changes ? `${p.changes} change(s)` : "No changes"}
+`);
+      for (const d of p.detail) io.stdout(`  ${d}
+`);
+    }
+    if (!json(h)) io.stderr(total ? `${total} change(s) in ${plans.filter((p) => p.changes).length} part(s). Apply with: cookiemunch apply ${path}
+` : `No changes: all ${plans.length} part(s) match.
+`);
+    return total && h.flag("exit-code") === true ? 1 : 0;
+  }
+  const log = [];
+  for (const p of plans) {
+    if (!p.changes || !p.apply) continue;
+    const result = await p.apply();
+    log.push({ part: p.part, at: (/* @__PURE__ */ new Date()).toISOString(), result });
+    if (!json(h)) io.stderr(`${log[log.length - 1].at} ${p.part}: ${result}
+`);
+  }
+  if (json(h)) print(io, { file: path, cbid, applied: log });
+  else if (!log.length) io.stderr("No changes: nothing to apply.\n");
+  return 0;
+}
+
+// src/cli.ts
+var DEFAULT_BASE_URL = "https://api.cookiemunch.net";
+var USAGE = `cookiemunch \u2014 Cookie Munch from the command line
+
+Usage:
+  cookiemunch config pull  --site <cbid> [--out <file>]
+      Write the site's config as JSON (to stdout, or to <file>).
+  cookiemunch config diff  --site <cbid> <file> [--replace] [--exit-code]
+      Show what pushing <file> would change (the server's dry run; nothing is stored).
+      Read-only fields a pulled file carries (effective, designWarnings, ...) are ignored.
+  cookiemunch config push  --site <cbid> <file> [--replace] [--strict]
+      Apply <file>. Default: merged over the stored config (PATCH) \u2014 fields the file
+      leaves out keep their value, and a field set to null is removed (it takes its
+      default). --replace sends it whole (PUT): a top-level field the file leaves out
+      reverts to its default. Prints any design warnings the server found. --strict
+      checks the file first and does not push it (exit 1) when Accept all is pushed
+      harder than Reject all anywhere \u2014 for CI.
+  cookiemunch config validate --site <cbid> <file> [--replace] [--strict]
+      Check <file> for consent-button parity on the server, without writing: is Accept
+      all more prominent than Reject all (colour, size, placement, copy, custom CSS)?
+      Merged over the stored config like push; --replace checks it as sent. --strict
+      exits 1 when there is any warning (notices never fail).
+  cookiemunch preview --site <cbid> [--url <page>] [--region <eu|de|us-ca\u2026>] [--lang <de\u2026>]
+                      [--ttl <seconds>] [--open]
+      Print (and with --open, open) a link showing the banner as a visitor in that
+      region and language sees it. Works in headless browsers; nothing is recorded.
+  cookiemunch executors test <id> (--email <email> | --canary) [--operation <locate|export|erase>]
+      Try a connected system against one person without filing a request.
+      --operation defaults to locate (lookup is accepted as another name for it).
+      --canary uses the organisation's canary address instead: no real person, and
+      a canary locate also updates the connection's health. Exits 1 when not ok.
+  cookiemunch executors webhook-test <id> --headers-file <json> --body-file <file>
+      Would this webhook delivery verify? Sends the headers (a JSON object) and the
+      body file byte for byte to the receiver's check; nothing is acted on. Prints
+      { verified, stage, reason } and exits 1 when it does not verify.
+  cookiemunch executors deliveries <id>
+      The last 50 deliveries to that connection's webhook, each with its reason.
+  cookiemunch executors presets
+      The versioned presets, which are usable now and which wait on another
+      platform, and the organisation's canary address.
+  cookiemunch executors conformance <baseUrl> --secret-env <NAME> [--canary-email <addr>]
+                      [--prefix /privacy] [--json]
+      Check any system against the open cm-standard-v2 executor contract, rule by
+      rule, using only the canary subject. The credential is read from the
+      environment variable NAME, never from the command line. Without
+      --canary-email the organisation's canary address is fetched (needs
+      COOKIEMUNCH_API_KEY); with it, no Cookie Munch key is needed at all.
+      Exits 1 when any rule fails.
+  cookiemunch executors conformance --connection <id> [--json]
+      The same suite, run by Cookie Munch against a connected system.
+  cookiemunch executors roll-completion-secret <id>
+      A new completion secret for that connection, printed once; the old one keeps
+      verifying for 24 hours.
+  cookiemunch executors upgrade-preset <id> [--preset <name>] [--version <n>]
+                      [--org-id <id>] [--atlas-id-app-id <id>] [--revoke-atlas-id-grant]
+                      [--accept-preset <path> \u2026] [--dry-run]
+      Rebuild a connection from its preset's latest version (or --version), keeping
+      its id and credentials; --preset adopts one on a hand-written connection.
+      Your hand edits are kept (the diff marks them kept or conflict); --accept-preset
+      (repeatable) takes the preset's value for that path. Prints the diff; --dry-run
+      changes nothing. A pinned connection is refused.
+  cookiemunch executors recheck <id>
+      Re-check a connection now (a canary test that records its health): the hook to
+      run after deploying that system's rights API. Exits 1 when it is not ok.
+  cookiemunch executors health <id> [--limit <n>]
+      The connection's last health checks, newest first (up to 50).
+  cookiemunch rights-page pull    --site <cbid> [--out <file>]
+      Write the site's rights page draft as JSON, and print its updatedAt for --base.
+  cookiemunch rights-page diff    --site <cbid> <file> [--exit-code]
+      Validate <file> on the server (dry run) and show what pushing it would change.
+  cookiemunch rights-page push    --site <cbid> <file> [--base <updatedAt>]
+      Replace the draft with <file>. Nothing is live until publish. Refused (exit 1)
+      if the draft changed since the diff, or since --base (the updatedAt pull printed).
+  cookiemunch rights-page publish --site <cbid> [--yes] [--base <updatedAt>]
+      Publish the draft (it goes live at once). Asks first; --yes skips the question
+      and is required when there is no terminal to ask in. Prints why when the page
+      cannot go live. Refused (exit 1) if the draft changed after it was read (or
+      since --base); --yes never overrides that.
+
+  cookiemunch scan --site <cbid> [--wait] [--timeout <seconds>]
+      Start a cookie crawl of the site and print its state (JSON). --wait holds on
+      until it is done or failed (default up to 120 s, --timeout to change) and exits
+      1 when it failed or is still running at the end. A scan already running is
+      waited on rather than started twice.
+
+  cookiemunch cookies presets --site <cbid>
+      The declaration presets (atlas, forumulate, chatly, cookiemunch, referalli, firstpromoter,
+      partnerstack, tapfiliate, impact; referally is the deprecated old name of referalli): what each takes,
+      what it declared on this site, and whether the vendor's own manifest exists yet.
+  cookiemunch cookies preset <vendor> --site <cbid> [--param k=v \u2026] [--dry-run]
+      Declare what that platform writes (cookies and browser storage), marked as
+      declared by it; run again to re-sync. Atlas: --param frontendApiHost=auth.example.com
+      [--param crossSubdomainCookies=false]. Chatly: --param publicId=ch_web_\u2026 .
+      Referral and affiliate presets (referalli, firstpromoter, partnerstack, tapfiliate, impact):
+      [--param cookieDomain=.example.com] [--param cookieDays=60] [--param category=\u2026];
+      referalli [--param legacyName=false], impact [--param campaignId=\u2026]. A row filed under a
+      disabled category prints a warning and a suggestedConfigPatch. Any other vendor is
+      declared with the API (PUT /v1/sites/{cbid}/cookies).
+  cookiemunch cookies unpreset <vendor> --site <cbid> [--dry-run]
+      Remove every declaration that vendor's preset made.
+  cookiemunch cookies import-manifest <url> --site <cbid> [--file <manifest.json>] [--dry-run]
+      Declare any vendor's cookies and storage from its embed manifest
+      (/.well-known/forgedeck-embed.json), by URL or from a file. Remove it with
+      cookies unpreset <product>.
+  cookiemunch cookies suggestions --site <cbid>
+      What to declare: the platforms detected on the site and each undeclared row.
+  cookiemunch cookies declare-suggestions --site <cbid> [--names a,b] [--dry-run]
+      Declare them: detected vendors' presets, then every other suggestion with a purpose.
+  cookiemunch cookies delete-observed <name> --site <cbid> [--dry-run]
+      Remove every stored row of that name (a name the site never sets). A declaration stays.
+  cookiemunch cookies purge-observed --site <cbid> --since <time> [--until <time>] [--dry-run]
+      Remove every row a real visit first reported in that window (ISO-8601 or epoch ms).
+      Crawled rows and declarations stay. Run with --dry-run first.
+  cookiemunch site update --site <cbid> [--domain <host>] [--name <name> | --clear-name]
+                          [--aliases <a,b>] [--dry-run]
+      Rename or move a site. The cbid and consent ledger stay; a domain move clears
+      verification. --dry-run prints the diff and its effects without saving.
+  cookiemunch site brand --site <cbid> [--url <https URL> | <brand.json>] [--dry-run]
+      Import a brand.json into the banner theme (the rights page uses it too). Values the
+      site set itself are kept. With neither --url nor a file, prints the last import.
+  cookiemunch consent-sync status --site <cbid>
+      Whether hosted consent sync is set up (the secret's last four characters, when it was minted).
+  cookiemunch consent-sync rotate --site <cbid>
+      Mint the site's consent-sync signing secret, or replace it (the old one stops at once).
+      Prints the secret alone on stdout, so it can be piped into your secret store: it is shown once.
+  cookiemunch consent-sync remove --site <cbid> --yes
+      Remove it: hosted consent sync stops for every visitor.
+  cookiemunch consent-sync token --site <cbid> --subject <id> [--ttl <seconds>]
+      Sign a test token locally with COOKIEMUNCH_CONSENT_SYNC_SECRET (nothing is sent), e.g. to try
+      GET /api/v1/<cbid>/profile with curl.
+  cookiemunch health [--site <cbid>] [--json] [--fail-on error|warning|never]
+      Every link the site's privacy wiring depends on, with a fix hint for each that
+      fails. Exits 1 when a check fails (checks that could not run, or are waived, do not count).
+      --fail-on error ignores warnings; --fail-on never always exits 0.
+  cookiemunch provision <file> [--dry-run]
+      Wire a product's privacy in one call (site, connections, Atlas, Forumulate) from
+      a JSON file without secrets: the Atlas key and Forumulate token come from
+      COOKIEMUNCH_ATLAS_SECRET_KEY and COOKIEMUNCH_FORUMULATE_TOKEN. Re-running is a
+      no-op. Exits 1 when a step failed.
+  cookiemunch keys report [--unused-days <n>] [--expiring-days <n>] [--json]
+      Key hygiene: keys unused for n days (default 90), keys with broad access, and
+      keys expiring within n days (default 14). Needs a full-access key.
+  cookiemunch partners list|link|unlink --site <cbid> [--partner <id>]
+                       [--external-id <id>] [--label <text>] [<linkId>]
+      Grant a partner platform the site's consent events (no secret is created), list
+      the grants, or revoke one. Any partner this deployment knows (forumulate, atlas, chatly,
+      referalli, or one registered for it).
+  cookiemunch csp --merge <vendors|urls> [--framework next|express|nginx] [--site <cbid>]
+      One Content-Security-Policy from several products' embed manifests
+      (/.well-known/forgedeck-embed.json): cookiemunch, atlas, chatly, forumulate,
+      referalli, or any manifest URL. --framework prints it for next.config.js,
+      Express or nginx; without it, the header value. --site uses your site's own
+      Cookie Munch manifest (its logo, fonts, sync endpoint). Needs no API key. Exits 1
+      when a named product has not published a manifest (the rest are still merged).
+  cookiemunch cookies diff|push <file> --site <cbid> [--replace] [--exit-code]
+      Declarations as a file ({"cookies": [...]}), through the server's dry run. push applies
+      only when something differs; --replace also removes declarations the file leaves out.
+  cookiemunch executors pull [<file>] | diff <file> | push <file> [--secret-env NAME]
+      Connected systems as a file. The file never carries a secret: a new connection's API key
+      comes from the environment variable --secret-env names.
+  cookiemunch dsar test [--types access,deletion] [--with-cbid --site <cbid>] [--without-cbid]
+                        [--email <addr>] [--cleanup]
+      File TEST rights requests and read each back. --cleanup deletes exactly the ones this run
+      filed (by id; it never deletes by listing).
+  cookiemunch doctor [--site <cbid>] [--org <id>]
+      The key (and whose org it is, against --org or COOKIEMUNCH_ORG), its expiry, the CLI
+      version against the latest, and integration health. Exits 1 when a check fails.
+  cookiemunch keys vend --scopes <a,b> --ttl <1h|30m|seconds> [--cbids <x,y>] [--name <n>]
+      A short-lived key (at most 12 h) within this key's own scopes; prints the key alone.
+      Needs keys:write (or a full-access key).
+  cookiemunch keys self | rotate-self
+      This key's own prefix, scopes and expiry; or rotate it (the new key is printed once).
+  cookiemunch plan [cookiemunch.json] [--exit-code] [--json]
+  cookiemunch apply [cookiemunch.json] [--secret-env NAME] [--secrets-out <file>]
+      One file for a site: {site, config, cookies, presets, executors, webhooks, rightsPage,
+      partners}, no secrets. plan prints the server's dry run of every part ("No changes" when
+      it matches); apply applies them in dependency order and logs each. New webhook secrets
+      go to --secrets-out (mode 0600).
+  cookiemunch --version | version [--json]
+      The CLI version; --json adds the API version the server documents.
+
+Every command takes --json for machine-readable output.
+
+Exit codes:
+  0  ok, or nothing to change
+  1  a difference (with --exit-code), a failure, or a failed check
+  2  a usage mistake
+
+Environment:
+  COOKIEMUNCH_API_KEY   an API key (cookiemunch_live_\u2026, or a legacy fck_\u2026). Required.
+  COOKIEMUNCH_BASE_URL  the API origin. Default ${DEFAULT_BASE_URL}.
+  COOKIEMUNCH_SITE      default for --site.
+  COOKIEMUNCH_STRICT_FIELDS=1  send Prefer: strict-unknown-fields on writes: a field the
+                        API does not know is refused (400 unknown_field), not ignored.
+  COOKIEMUNCH_SECRET_RECIPIENT=x25519:<base64>  answers carry once-shown secrets sealed to
+                        this key (sealed_secret), never in plaintext.
+  COOKIEMUNCH_ORG       the org id doctor checks the key against.
+  --idempotency-key <k> send Idempotency-Key on writes: a retry replays the first answer.
+`;
+var UsageError = class extends Error {
+};
+var BOOLEAN_FLAGS = /* @__PURE__ */ new Set(["replace", "exit-code", "open", "help", "json", "yes", "strict", "wait", "canary", "dry-run", "clear-name", "revoke-atlas-id-grant", "with-cbid", "without-cbid", "cleanup"]);
+function parseArgs(argv) {
+  const positional = [];
+  const flags = {};
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "-h") {
+      flags.help = true;
+    } else if (a.startsWith("--")) {
+      const eq = a.indexOf("=");
+      const name = eq > 0 ? a.slice(2, eq) : a.slice(2);
+      let value;
+      if (eq > 0) value = a.slice(eq + 1);
+      else if (BOOLEAN_FLAGS.has(name)) value = true;
+      else {
+        const v = argv[i + 1];
+        if (v === void 0 || v.startsWith("--")) throw new UsageError(`--${name} needs a value`);
+        value = v;
+        i++;
+      }
+      if ((name === "param" || name === "accept-preset") && typeof value === "string" && typeof flags[name] === "string") flags[name] = `${flags[name]}
+${value}`;
+      else flags[name] = value;
+    } else {
+      positional.push(a);
+    }
+  }
+  return { positional, flags };
+}
+function str2(flags, name) {
+  const v = flags[name];
+  return typeof v === "string" ? v : void 0;
+}
+function requireSite(p, io) {
+  const site = str2(p.flags, "site") ?? io.env.COOKIEMUNCH_SITE;
+  if (!site) throw new UsageError("--site <cbid> is required (or set COOKIEMUNCH_SITE)");
+  return site;
+}
+async function readConfigFile(io, path) {
+  if (!path) throw new UsageError("a config file is required");
+  let text;
+  try {
+    text = await io.readFile(path);
+  } catch (e) {
+    throw new UsageError(`cannot read ${path}: ${e.message}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (e) {
+    throw new UsageError(`${path} is not valid JSON: ${e.message}`);
+  }
+  if (!isPlainObject(parsed)) throw new UsageError(`${path} must hold a JSON object`);
+  return parsed;
+}
+function proposed(current, file, replace, cbid) {
+  return replace ? { ...file, cbid } : mergeLikeServer(current, file);
+}
+var CLI_VERSION = "0.6.0";
+function userAgent(io) {
+  return io.env.COOKIEMUNCH_USER_AGENT || `cookiemunch-cli/${CLI_VERSION}`;
+}
+async function rawRequest(io, base, key, method, path, body) {
+  const res = await io.fetch(`${base.replace(/\/+$/, "")}/v1${path}`, {
+    method,
+    headers: { Authorization: `Bearer ${key}`, "User-Agent": userAgent(io), ...body !== void 0 ? { "Content-Type": "application/json" } : {} },
+    ...body !== void 0 ? { body: JSON.stringify(body) } : {}
+  });
+  const text = await res.text();
+  let data = text;
+  try {
+    data = text ? JSON.parse(text) : void 0;
+  } catch {
+  }
+  if (!res.ok) {
+    const err = isPlainObject(data) ? data : {};
+    throw new CookieMunchApiError2(
+      res.status,
+      typeof err.error === "string" ? err.error : `request failed with status ${res.status}`,
+      typeof err.code === "string" ? err.code : void 0
+    );
+  }
+  return data;
+}
+async function configChanges(client, cbid, file, replace) {
+  const body = withoutReadOnly(file);
+  try {
+    const r = await client.sites.dryRunConfig(cbid, body, { mode: replace ? "put" : "patch" });
+    if (r && r.dryRun === true && Array.isArray(r.diff)) {
+      return r.diff.map((c) => {
+        const ch = { path: c.path, kind: c.from === void 0 ? "added" : c.to === void 0 ? "removed" : "changed" };
+        if (c.from !== void 0) ch.from = c.from;
+        if (c.to !== void 0) ch.to = c.to;
+        return ch;
+      });
+    }
+  } catch {
+  }
+  const current = withoutReadOnly(await client.sites.getConfig(cbid));
+  return diffJson(current, proposed(current, body, replace, cbid));
+}
+async function configCommand(sub, p, io, client) {
+  const cbid = requireSite(p, io);
+  if (sub === "pull") {
+    const cfg = await client.sites.getConfig(cbid);
+    const text = `${JSON.stringify(cfg, null, 2)}
+`;
+    const out2 = str2(p.flags, "out");
+    if (out2) {
+      await io.writeFile(out2, text);
+      io.stderr(`Wrote ${cbid}'s config to ${out2}
+`);
+    } else {
+      io.stdout(text);
+    }
+    return 0;
+  }
+  if (sub === "validate") {
+    const file = await readConfigFile(io, p.positional[2]);
+    const r = await client.sites.lintConfig(cbid, file, p.flags.replace === true ? { replace: true } : {});
+    if (p.flags.json === true) io.stdout(`${JSON.stringify({ cbid, designWarnings: r.designWarnings }, null, 2)}
+`);
+    else if (r.designWarnings.length) io.stdout(`${formatDesignWarnings(r.designWarnings)}
+`);
+    io.stderr(`${summaryLine(r.designWarnings)}
+`);
+    return p.flags.strict === true && countBySeverity(r.designWarnings).warnings > 0 ? 1 : 0;
+  }
+  if (sub === "diff" || sub === "push") {
+    const file = await readConfigFile(io, p.positional[2]);
+    const replace = p.flags.replace === true;
+    if (sub === "push" && p.flags.strict === true) {
+      const lint = await client.sites.lintConfig(cbid, file, replace ? { replace: true } : {});
+      if (countBySeverity(lint.designWarnings).warnings > 0) {
+        io.stderr(`${formatDesignWarnings(lint.designWarnings)}
+${summaryLine(lint.designWarnings)}
+not pushed (--strict).
+`);
+        return 1;
+      }
+    }
+    const changes = await configChanges(client, cbid, file, replace);
+    if (p.flags.json === true && (sub === "diff" || changes.length === 0)) io.stdout(`${JSON.stringify({ cbid, changes }, null, 2)}
+`);
+    if (changes.length === 0) {
+      io.stderr(`No changes: ${cbid}'s config already matches.
+`);
+      return 0;
+    }
+    if (p.flags.json !== true) io.stdout(`${formatChanges(changes)}
+`);
+    if (sub === "diff") {
+      io.stderr(`${changes.length} change${changes.length === 1 ? "" : "s"} (nothing sent). Apply with: cookiemunch config push --site ${cbid} ${p.positional[2]}${replace ? " --replace" : ""}
+`);
+      return p.flags["exit-code"] === true ? 1 : 0;
+    }
+    const saved = replace ? await client.sites.putConfig(cbid, { ...file, cbid }) : await client.sites.patchConfig(cbid, file);
+    io.stderr(`Applied ${changes.length} change${changes.length === 1 ? "" : "s"} to ${cbid}.
+`);
+    const found = Array.isArray(saved?.designWarnings) ? saved.designWarnings : [];
+    if (p.flags.json === true) io.stdout(`${JSON.stringify({ cbid, applied: changes, designWarnings: found }, null, 2)}
+`);
+    if (found.length) io.stderr(`${formatDesignWarnings(found)}
+${summaryLine(found)}
+`);
+    return 0;
+  }
+  throw new UsageError(`unknown config command: ${sub ?? "(none)"} \u2014 use pull, diff, push or validate`);
+}
+async function previewCommand(p, io, client) {
+  const cbid = requireSite(p, io);
+  const ttl = str2(p.flags, "ttl");
+  const ttlSeconds = ttl === void 0 ? void 0 : Number(ttl);
+  if (ttlSeconds !== void 0 && (!Number.isInteger(ttlSeconds) || ttlSeconds < 1 || ttlSeconds > 3600)) {
+    throw new UsageError("--ttl must be a whole number of seconds from 1 to 3600");
+  }
+  const r = await client.sites.previewToken(cbid, {
+    ...str2(p.flags, "region") ? { region: str2(p.flags, "region") } : {},
+    ...str2(p.flags, "lang") ? { lang: str2(p.flags, "lang") } : {},
+    ...str2(p.flags, "url") ? { url: str2(p.flags, "url") } : {},
+    ...ttlSeconds !== void 0 ? { ttlSeconds } : {}
+  });
+  if (p.flags.json === true) {
+    io.stdout(`${JSON.stringify(r, null, 2)}
+`);
+  } else if (r.previewUrl) {
+    io.stdout(`${r.previewUrl}
+`);
+  } else {
+    io.stdout(`${r.token}
+`);
+    io.stderr("Add ?cm_preview=<token>&cm_region=..&cm_lang=.. to any page of the site.\n");
+  }
+  io.stderr(`Valid until ${new Date(r.expiresAt).toISOString()}.
+`);
+  if (p.flags.open === true && r.previewUrl) await io.openUrl(r.previewUrl);
+  return 0;
+}
+async function consentSyncCommand(sub, p, io, client) {
+  const cbid = requireSite(p, io);
+  if (sub === "status") {
+    io.stdout(`${JSON.stringify(await client.consentSyncSecret.get(cbid), null, 2)}
+`);
+    return 0;
+  }
+  if (sub === "rotate") {
+    const r = await client.consentSyncSecret.rotate(cbid);
+    io.stdout(p.flags.json === true ? `${JSON.stringify(r, null, 2)}
+` : `${r.secret}
+`);
+    io.stderr("This secret is shown once: store it on your server (never in a page). A previous secret stopped working.\n");
+    return 0;
+  }
+  if (sub === "remove") {
+    if (p.flags.yes !== true) throw new UsageError("consent-sync remove stops hosted consent sync for every visitor: add --yes");
+    await client.consentSyncSecret.remove(cbid);
+    io.stderr(`Hosted consent sync is off for ${cbid}.
+`);
+    return 0;
+  }
+  if (sub === "token") {
+    const secret = io.env.COOKIEMUNCH_CONSENT_SYNC_SECRET;
+    if (!secret) throw new UsageError("set COOKIEMUNCH_CONSENT_SYNC_SECRET to the site's consent-sync secret");
+    const subject = str2(p.flags, "subject");
+    if (!subject) throw new UsageError("--subject <id> is required");
+    const ttl = str2(p.flags, "ttl");
+    try {
+      const token = mintConsentSyncToken({ secret, cbid, subject, ...ttl !== void 0 ? { ttlSeconds: Number(ttl) } : {} });
+      io.stdout(p.flags.json === true ? `${JSON.stringify({ token }, null, 2)}
+` : `${token}
+`);
+    } catch (e) {
+      throw new UsageError(e.message);
+    }
+    return 0;
+  }
+  throw new UsageError(`unknown consent-sync command: ${sub ?? "(none)"} \u2014 use status, rotate, remove or token`);
+}
+async function executorsCommand(sub, p, io, base, key, client) {
+  if (sub === "webhook-test") {
+    const id2 = p.positional[2];
+    if (!id2) throw new UsageError("executors webhook-test <id> needs the connection id");
+    const headersFile = str2(p.flags, "headers-file");
+    const bodyFile = str2(p.flags, "body-file");
+    if (!headersFile || !bodyFile) throw new UsageError("--headers-file and --body-file are both required");
+    let headers;
+    try {
+      headers = JSON.parse(await io.readFile(headersFile));
+    } catch {
+      throw new UsageError(`${headersFile} is not a JSON object of header name to value`);
+    }
+    if (!isPlainObject(headers)) throw new UsageError(`${headersFile} is not a JSON object of header name to value`);
+    const body = await io.readFile(bodyFile);
+    const r = await client.fulfillment.testExecutorWebhook(id2, { headers, body });
+    io.stdout(`${JSON.stringify(r, null, 2)}
+`);
+    return r.verified ? 0 : 1;
+  }
+  if (sub === "deliveries") {
+    const id2 = p.positional[2];
+    if (!id2) throw new UsageError("executors deliveries <id> needs the connection id");
+    io.stdout(`${JSON.stringify(await client.fulfillment.executorWebhookDeliveries(id2), null, 2)}
+`);
+    return 0;
+  }
+  if (sub === "presets") {
+    io.stdout(`${JSON.stringify(await client.fulfillment.executorPresets(), null, 2)}
+`);
+    return 0;
+  }
+  if (sub === "conformance") return conformanceCommand(p, io, client);
+  if (sub === "roll-completion-secret") {
+    const id2 = p.positional[2];
+    if (!id2) throw new UsageError("executors roll-completion-secret <id> needs the connection id");
+    io.stdout(`${JSON.stringify(await client.fulfillment.rollExecutorCompletionSecret(id2), null, 2)}
+`);
+    return 0;
+  }
+  if (sub === "upgrade-preset") {
+    const id2 = p.positional[2];
+    if (!id2) throw new UsageError("executors upgrade-preset <id> needs the connection id");
+    const version = str2(p.flags, "version");
+    if (version !== void 0 && !/^[1-9]\d*$/.test(version)) throw new UsageError("--version must be a positive whole number");
+    const preset = str2(p.flags, "preset");
+    const orgId = str2(p.flags, "org-id");
+    const atlasIdAppId = str2(p.flags, "atlas-id-app-id");
+    const accept = str2(p.flags, "accept-preset");
+    const input = {
+      ...preset ? { preset } : {},
+      ...version ? { presetVersion: Number(version) } : {},
+      ...orgId ? { orgId } : {},
+      ...atlasIdAppId ? { atlasIdAppId } : {},
+      ...p.flags["revoke-atlas-id-grant"] === true ? { revokeAtlasIdGrant: true } : {},
+      ...accept ? { acceptPreset: accept.split("\n") } : {}
+    };
+    const r = p.flags["dry-run"] === true ? await client.fulfillment.dryRunUpgradeExecutorPreset(id2, input) : await client.fulfillment.upgradeExecutorPreset(id2, input);
+    io.stdout(`${JSON.stringify(r, null, 2)}
+`);
+    return 0;
+  }
+  if (sub === "recheck") {
+    const id2 = p.positional[2];
+    if (!id2) throw new UsageError("executors recheck <id> needs the connection id");
+    const r = await client.fulfillment.recheckExecutor(id2);
+    io.stdout(`${JSON.stringify(r, null, 2)}
+`);
+    return r.ok === false ? 1 : 0;
+  }
+  if (sub === "health") {
+    const id2 = p.positional[2];
+    if (!id2) throw new UsageError("executors health <id> needs the connection id");
+    const limit = str2(p.flags, "limit");
+    if (limit !== void 0 && !/^[1-9]\d*$/.test(limit)) throw new UsageError("--limit must be a whole number from 1 to 50");
+    io.stdout(`${JSON.stringify(await client.fulfillment.executorHealthHistory(id2, limit ? { limit: Number(limit) } : {}), null, 2)}
+`);
+    return 0;
+  }
+  if (sub !== "test") throw new UsageError(`unknown executors command: ${sub ?? "(none)"} \u2014 use test, webhook-test, deliveries, presets, upgrade-preset, conformance, roll-completion-secret, recheck or health`);
+  const id = p.positional[2];
+  if (!id) throw new UsageError("executors test <id> needs the connection id");
+  const canary = p.flags.canary === true;
+  const email = str2(p.flags, "email");
+  if (canary && email) throw new UsageError("use --email or --canary, not both");
+  if (!email && !canary) throw new UsageError("--email (or --canary) is required");
+  const asked = str2(p.flags, "operation") ?? "locate";
+  const operation = asked === "lookup" ? "locate" : asked;
+  try {
+    const r = await rawRequest(io, base, key, "POST", `/dsar/executors/${encodeURIComponent(id)}/test`, canary ? { canary: true, operation } : { email, operation });
+    io.stdout(`${JSON.stringify(r, null, 2)}
+`);
+    return canary && r.ok === false ? 1 : 0;
+  } catch (e) {
+    if (e instanceof CookieMunchApiError2 && e.status === 404 && e.message === "not found") {
+      io.stderr("This server does not offer connection tests yet (POST /v1/dsar/executors/{id}/test).\n");
+      return 1;
+    }
+    throw e;
+  }
+}
+function printConformance(io, report, asJson) {
+  if (asJson) {
+    io.stdout(`${JSON.stringify(report, null, 2)}
+`);
+  } else {
+    for (const r of report.rules) {
+      io.stdout(`${r.status.toUpperCase().padEnd(4)}  ${r.id}  ${r.title}
+`);
+      if (r.detail && r.status !== "pass") io.stdout(`      ${r.detail}
+`);
+    }
+    io.stdout(`
+${report.passed} passed, ${report.failed} failed, ${report.skipped} skipped
+`);
+  }
+  return report.ok ? 0 : 1;
+}
+async function conformanceCommand(p, io, client) {
+  const asJson = p.flags.json === true;
+  const connection = str2(p.flags, "connection");
+  if (connection) {
+    if (!client) throw new UsageError("--connection runs on Cookie Munch: set COOKIEMUNCH_API_KEY");
+    return printConformance(io, await client.fulfillment.executorConformance(connection), asJson);
+  }
+  const baseUrl = p.positional[2];
+  if (!baseUrl) throw new UsageError("executors conformance <baseUrl> --secret-env <NAME> (or --connection <id>)");
+  const secretEnv = str2(p.flags, "secret-env");
+  if (!secretEnv) throw new UsageError("--secret-env <NAME> names the environment variable holding the executor credential");
+  const secret = io.env[secretEnv];
+  if (!secret) throw new UsageError(`the environment variable ${secretEnv} is empty`);
+  let canaryEmail = str2(p.flags, "canary-email");
+  if (!canaryEmail) {
+    if (!client) throw new UsageError("pass --canary-email, or set COOKIEMUNCH_API_KEY to use your organisation's canary address");
+    canaryEmail = (await client.fulfillment.executorPresets()).canaryEmail;
+  }
+  const prefix = str2(p.flags, "prefix");
+  let report;
+  try {
+    report = await runExecutorConformance({ baseUrl, secret, canaryEmail, fetch: io.fetch, ...prefix ? { prefix } : {} });
+  } catch (e) {
+    throw new UsageError(e.message);
+  }
+  return printConformance(io, report, asJson);
+}
+async function scanCommand(p, io, client) {
+  const cbid = requireSite(p, io);
+  const timeout = str2(p.flags, "timeout");
+  const timeoutS = timeout === void 0 ? 120 : Number(timeout);
+  if (!Number.isFinite(timeoutS) || timeoutS < 1 || timeoutS > 3600) throw new UsageError("--timeout must be a number of seconds from 1 to 3600");
+  let started = null;
+  try {
+    started = await client.sites.scan(cbid);
+  } catch (e) {
+    if (!(e instanceof CookieMunchApiError2 && e.status === 409)) throw e;
+    io.stderr(`A scan of ${cbid} is already running${p.flags.wait === true ? "; waiting for it" : ""}.
+`);
+    if (p.flags.wait !== true) return 0;
+  }
+  if (p.flags.wait !== true) {
+    io.stdout(`${JSON.stringify(started, null, 2)}
+`);
+    return 0;
+  }
+  const r = await client.sites.waitForScan(cbid, { timeoutMs: timeoutS * 1e3 });
+  io.stdout(`${JSON.stringify(r, null, 2)}
+`);
+  if (r.state === "failed") {
+    io.stderr(`Scan ${r.scanId ?? ""} failed: ${r.error ?? "no reason given"}
+`);
+    return 1;
+  }
+  if (r.status === "scanning") {
+    io.stderr(`Scan ${r.scanId ?? ""} is still running after ${timeoutS} s.
+`);
+    return 1;
+  }
+  const n = r.cookieCount ?? 0;
+  const pages = r.pagesVisited !== void 0 ? ` on ${r.pagesVisited} page${r.pagesVisited === 1 ? "" : "s"}` : "";
+  const kept = r.keptFromEarlier ? `, ${r.keptFromEarlier} kept from earlier crawls and visits` : "";
+  const took = r.durationMs !== void 0 ? ` in ${Math.round(r.durationMs / 1e3)} s` : "";
+  const landed = r.finalUrl ? ` (redirected to ${r.finalUrl})` : "";
+  io.stderr(`Scan ${r.scanId ?? ""} done${took}: ${n} cookie${n === 1 ? "" : "s"} seen${pages}${kept}${landed}.
+`);
+  return 0;
+}
+var PRESET_VENDORS = ["atlas", "forumulate", "chatly", "cookiemunch", "referalli", "firstpromoter", "partnerstack", "tapfiliate", "impact"];
+var PRESET_ALIASES = { referally: "referalli" };
+function vendorArg(v) {
+  if (v && Object.prototype.hasOwnProperty.call(PRESET_ALIASES, v)) return PRESET_ALIASES[v];
+  if (!v || !PRESET_VENDORS.includes(v)) throw new UsageError(`a vendor is required: ${PRESET_VENDORS.join(", ")}`);
+  return v;
+}
+function presetParams(p) {
+  const raw = str2(p.flags, "param");
+  const out2 = {};
+  for (const line of raw ? raw.split("\n") : []) {
+    const eq = line.indexOf("=");
+    if (eq <= 0) throw new UsageError(`--param takes key=value, got "${line}"`);
+    const v = line.slice(eq + 1);
+    const k = line.slice(0, eq);
+    out2[k] = v === "true" ? true : v === "false" ? false : k === "cookieDays" && /^\d+$/.test(v) ? Number(v) : v;
+  }
+  return out2;
+}
+async function cookiesCommand(sub, p, io, client) {
+  const dry = p.flags["dry-run"] === true ? { dryRun: true } : void 0;
+  const print2 = (v) => io.stdout(`${JSON.stringify(v, null, 2)}
+`);
+  if (sub === "presets") {
+    print2(await client.sites.cookiePresets(requireSite(p, io)));
+    return 0;
+  }
+  if (sub === "unpreset" && p.positional[2] && !PRESET_VENDORS.includes(p.positional[2])) {
+    print2(await client.sites.removeCookiePreset(requireSite(p, io), p.positional[2], dry));
+    return 0;
+  }
+  if (sub === "preset" || sub === "unpreset") {
+    const cbid = requireSite(p, io);
+    const vendor = vendorArg(p.positional[2]);
+    if (sub === "unpreset") {
+      print2(await client.sites.removeCookiePreset(cbid, vendor, dry));
+      return 0;
+    }
+    const r = await client.sites.applyCookiePreset(cbid, vendor, presetParams(p), dry);
+    print2(r);
+    if (r.note) io.stderr(`${r.note}
+`);
+    for (const s of r.skipped ?? []) io.stderr(`skipped ${s.name}: ${s.reason}
+`);
+    if (r.manifest.status === "waiting_on_vendor") io.stderr(`Built-in rows: ${r.manifest.waitingOn} does not publish a manifest yet (${r.manifest.item}).
+`);
+    return 0;
+  }
+  if (sub === "import-manifest") {
+    const cbid = requireSite(p, io);
+    const src = p.positional[2];
+    const file = str2(p.flags, "file");
+    if (!src && !file) throw new UsageError("a manifest URL (https://\u2026/.well-known/forgedeck-embed.json) or --file <manifest.json> is required");
+    const input = file ? { manifest: JSON.parse(await io.readFile(file)) } : { url: src };
+    const r = await client.sites.importCookieManifest(cbid, input, dry);
+    print2(r);
+    for (const s of r.skipped ?? []) io.stderr(`skipped ${s.name}: ${s.reason}
+`);
+    return 0;
+  }
+  if (sub === "suggestions") {
+    const r = await client.sites.cookieSuggestions(requireSite(p, io));
+    print2(r);
+    io.stderr(`${r.suggestions.length} suggestion${r.suggestions.length === 1 ? "" : "s"}; ${r.vendors.length} platform${r.vendors.length === 1 ? "" : "s"} detected.
+`);
+    return 0;
+  }
+  if (sub === "declare-suggestions") {
+    const cbid = requireSite(p, io);
+    const names = str2(p.flags, "names");
+    const r = await client.sites.declareCookieSuggestions(cbid, names ? { names: names.split(",").map((n) => n.trim()).filter(Boolean) } : {}, dry);
+    print2(r);
+    io.stderr(`${dry ? "Would declare" : "Declared"} ${r.declaredCount} row${r.declaredCount === 1 ? "" : "s"} and ${r.presetsApplied.length} preset${r.presetsApplied.length === 1 ? "" : "s"}.
+`);
+    return 0;
+  }
+  if (sub === "delete-observed") {
+    const cbid = requireSite(p, io);
+    const name = p.positional[2];
+    if (!name) throw new UsageError("a cookie name is required");
+    if (dry) print2(await client.sites.deleteObservedCookie(cbid, name, dry));
+    else {
+      await client.sites.deleteObservedCookie(cbid, name);
+      io.stderr(`Removed ${name}.
+`);
+    }
+    return 0;
+  }
+  if (sub === "purge-observed") {
+    const cbid = requireSite(p, io);
+    const since = str2(p.flags, "since");
+    if (!since) throw new UsageError("--since is required (ISO-8601 or epoch ms)");
+    const until = str2(p.flags, "until");
+    const r = await client.sites.purgeObservedCookies(cbid, { since, ...until ? { until } : {} }, dry);
+    print2(r);
+    io.stderr(`${dry ? "Would remove" : "Removed"} ${r.count} row${r.count === 1 ? "" : "s"}.
+`);
+    return 0;
+  }
+  throw new UsageError(`unknown cookies command: ${sub ?? "(none)"}`);
+}
+async function run(argv, io) {
+  if (argv[0] === "--version" || argv[0] === "-V") return versionCommand(io, CLI_VERSION, io.env.COOKIEMUNCH_BASE_URL || DEFAULT_BASE_URL, argv.includes("--json"));
+  let p;
+  try {
+    p = parseArgs(argv);
+  } catch (e) {
+    io.stderr(`${e.message}
+
+${USAGE}`);
+    return 2;
+  }
+  const [cmd, sub] = p.positional;
+  if (cmd === "version") {
+    return versionCommand(io, CLI_VERSION, io.env.COOKIEMUNCH_BASE_URL || DEFAULT_BASE_URL, p.flags.json === true);
+  }
+  if (!cmd || p.flags.help === true || cmd === "help") {
+    io.stdout(USAGE);
+    return cmd || p.flags.help === true ? 0 : 2;
+  }
+  if (cmd === "executors" && sub === "conformance" && !io.env.COOKIEMUNCH_API_KEY && str2(p.flags, "canary-email")) {
+    try {
+      return await conformanceCommand(p, io, null);
+    } catch (e) {
+      if (e instanceof UsageError) {
+        io.stderr(`${e.message}
+`);
+        return 2;
+      }
+      throw e;
+    }
+  }
+  const base = io.env.COOKIEMUNCH_BASE_URL || DEFAULT_BASE_URL;
+  if (cmd === "csp") {
+    try {
+      const merge = str2(p.flags, "merge");
+      const framework = str2(p.flags, "framework");
+      const site = str2(p.flags, "site") ?? io.env.COOKIEMUNCH_SITE;
+      return await cspCommand(
+        { apiBase: base, ...merge ? { merge } : {}, ...framework ? { framework } : {}, ...site ? { site } : {} },
+        io,
+        (m) => new UsageError(m)
+      );
+    } catch (e) {
+      if (e instanceof UsageError) {
+        io.stderr(`${e.message}
+
+${USAGE}`);
+        return 2;
+      }
+      io.stderr(`${e.message ?? String(e)}
+`);
+      return 1;
+    }
+  }
+  const key = io.env.COOKIEMUNCH_API_KEY;
+  if (!key) {
+    io.stderr("COOKIEMUNCH_API_KEY is not set. Create a key under Developers in the dashboard.\n");
+    return 2;
+  }
+  const client = createCookieMunch({
+    apiKey: key,
+    baseUrl: base,
+    fetch: io.fetch,
+    userAgent: userAgent(io),
+    ...io.env.COOKIEMUNCH_STRICT_FIELDS === "1" ? { strictUnknownFields: true } : {},
+    ...io.env.COOKIEMUNCH_SECRET_RECIPIENT ? { secretRecipient: io.env.COOKIEMUNCH_SECRET_RECIPIENT } : {},
+    ...typeof p.flags["idempotency-key"] === "string" ? { headers: { "Idempotency-Key": p.flags["idempotency-key"] } } : {}
+  });
+  const ops = {
+    requireSite: () => requireSite(p, io),
+    site: () => str2(p.flags, "site") ?? io.env.COOKIEMUNCH_SITE,
+    readJson: (path) => readConfigFile(io, path),
+    usage: (m) => new UsageError(m),
+    flag: (name) => p.flags[name],
+    positional: p.positional
+  };
+  try {
+    if (cmd === "cookies" && (sub === "diff" || sub === "push")) return await cookiesFileCommand(sub, io, client, ops);
+    if (cmd === "executors" && (sub === "pull" || sub === "diff" || sub === "push")) return await executorsFileCommand(sub, io, client, ops);
+    if (cmd === "dsar" && sub === "test") return await dsarTestCommand(io, client, ops);
+    if (cmd === "doctor") return await doctorCommand(io, client, ops, CLI_VERSION);
+    if (cmd === "keys" && sub && sub !== "report") return await keysExtraCommand(sub, io, client, ops);
+    if (cmd === "plan" || cmd === "apply") return await bundleCommand(cmd, io, client, ops);
+    if (cmd === "config") return await configCommand(sub, p, io, client);
+    if (cmd === "preview") return await previewCommand(p, io, client);
+    if (cmd === "scan") return await scanCommand(p, io, client);
+    if (cmd === "consent-sync") return await consentSyncCommand(sub, p, io, client);
+    if (cmd === "cookies") return await cookiesCommand(sub, p, io, client);
+    if (cmd === "executors") return await executorsCommand(sub, p, io, base, key, client);
+    const helpers = {
+      requireSite: () => requireSite(p, io),
+      site: () => str2(p.flags, "site") ?? io.env.COOKIEMUNCH_SITE,
+      readJson: (path) => readConfigFile(io, path),
+      usage: (m) => new UsageError(m),
+      flag: (name) => p.flags[name]
+    };
+    if (cmd === "site") return await siteCommand(sub, io, client, helpers, p.positional[2]);
+    if (cmd === "health") return await healthCommand(io, client, helpers);
+    if (cmd === "provision") return await provisionCommand(sub, io, client, helpers);
+    if (cmd === "keys") return await keysCommand(sub, io, client, helpers);
+    if (cmd === "partners") return await partnersCommand(sub, p.positional.slice(2), io, client, helpers);
+    if (cmd === "rights-page") {
+      return await rightsPageCommand(sub, p, io, client, {
+        requireSite: () => requireSite(p, io),
+        readJson: (path) => readConfigFile(io, path),
+        usage: (m) => new UsageError(m)
+      });
+    }
+    throw new UsageError(`unknown command: ${cmd}`);
+  } catch (e) {
+    if (e instanceof UsageError) {
+      io.stderr(`${e.message}
+
+${USAGE}`);
+      return 2;
+    }
+    if (e instanceof CookieMunchApiError2) {
+      io.stderr(`API error ${e.status}${e.code ? ` (${e.code})` : ""}: ${e.message}
+`);
+      return 1;
+    }
+    io.stderr(`${e.message ?? String(e)}
+`);
+    return 1;
+  }
+}
+
+export {
+  mergeLikeServer,
+  diffJson,
+  formatChanges,
+  rightsPageCommand,
+  KNOWN_MANIFEST_HOSTS,
+  CSP_FRAMEWORKS,
+  manifestSources,
+  mergeManifests,
+  policyString,
+  renderPolicy,
+  cspCommand,
+  DEFAULT_BASE_URL,
+  USAGE,
+  parseArgs,
+  run
+};
+//# sourceMappingURL=chunk-LJ433UVC.js.map