@cookiemunch/cli 0.5.0 → 0.6.0

package/dist/chunk-2ADK3C47.js

@@ -1,921 +0,0 @@
-// src/diff.ts
-var READ_ONLY_CONFIG_FIELDS = ["effective", "warnings", "designWarnings", "region", "regulation", "copy", "rightsFormUrl", "version", "observeToken"];
-function withoutReadOnly(cfg) {
-  const out2 = { ...cfg };
-  for (const k of READ_ONLY_CONFIG_FIELDS) delete out2[k];
-  return out2;
-}
-function isPlainObject(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-function mergeLikeServer(base, patch) {
-  const out2 = { ...base };
-  for (const [k, v] of Object.entries(patch)) {
-    const b = base[k];
-    if (v === null) delete out2[k];
-    else out2[k] = isPlainObject(v) ? mergeLikeServer(isPlainObject(b) ? b : {}, v) : v;
-  }
-  return out2;
-}
-function join(path, key) {
-  return path ? `${path}.${key}` : key;
-}
-function diffJson(before, after, path = "") {
-  if (isPlainObject(before) && isPlainObject(after)) {
-    const keys = [.../* @__PURE__ */ new Set([...Object.keys(before), ...Object.keys(after)])].sort();
-    return keys.flatMap((k) => {
-      const p = join(path, k);
-      if (!(k in after)) return [{ path: p, kind: "removed", from: before[k] }];
-      if (!(k in before)) return [{ path: p, kind: "added", to: after[k] }];
-      return diffJson(before[k], after[k], p);
-    });
-  }
-  if (Array.isArray(before) && Array.isArray(after)) {
-    const out2 = [];
-    const n = Math.max(before.length, after.length);
-    for (let i = 0; i < n; i++) {
-      const p = `${path}[${i}]`;
-      if (i >= after.length) out2.push({ path: p, kind: "removed", from: before[i] });
-      else if (i >= before.length) out2.push({ path: p, kind: "added", to: after[i] });
-      else out2.push(...diffJson(before[i], after[i], p));
-    }
-    return out2;
-  }
-  if (JSON.stringify(before) === JSON.stringify(after)) return [];
-  return [{ path: path || "(root)", kind: "changed", from: before, to: after }];
-}
-function show(v) {
-  const s = JSON.stringify(v);
-  return s === void 0 ? "undefined" : s.length > 120 ? `${s.slice(0, 117)}...` : s;
-}
-function formatChanges(changes) {
-  return changes.map(
-    (c) => c.kind === "added" ? `+ ${c.path}: ${show(c.to)}` : c.kind === "removed" ? `- ${c.path}: ${show(c.from)}` : `~ ${c.path}: ${show(c.from)} -> ${show(c.to)}`
-  ).join("\n");
-}
-
-// src/rights-page.ts
-import { CookieMunchApiError } from "@cookiemunch/sdk";
-var isConflict = (e) => e instanceof CookieMunchApiError && e.status === 409;
-function baseFrom(flag, read, h) {
-  if (flag === void 0) return read ?? null;
-  if (typeof flag === "string" && /^\d+$/.test(flag)) return Number(flag);
-  if (typeof flag === "string" && /^\d{4}-\d{2}-\d{2}T/.test(flag) && Number.isFinite(Date.parse(flag))) return flag;
-  throw h.usage("--base must be the draft\u2019s updatedAt (epoch ms, as pull prints it, or an ISO date)");
-}
-function issuesOf(e) {
-  if (!(e instanceof CookieMunchApiError) || e.status !== 422) return null;
-  const body = e.body;
-  return body?.issues ?? body?.problems ?? [];
-}
-async function rightsPageCommand(sub, p, io, client, h) {
-  const cbid = h.requireSite();
-  const report = (list) => io.stderr(`${list.map((i) => `  ${i.path || "(document)"}: ${i.message}`).join("\n")}
-`);
-  if (sub === "pull") {
-    const { draft, updatedAt } = await client.rightsPage.get(cbid);
-    const text = `${JSON.stringify(draft, null, 2)}
-`;
-    const out2 = typeof p.flags.out === "string" ? p.flags.out : void 0;
-    if (out2) {
-      await io.writeFile(out2, text);
-      io.stderr(`Wrote ${cbid}'s rights page draft to ${out2}
-`);
-    } else io.stdout(text);
-    if (updatedAt != null) io.stderr(`To refuse a push if anyone saves the draft after this pull, push with: --base ${updatedAt}
-`);
-    return 0;
-  }
-  if (sub === "diff" || sub === "push") {
-    const file = await h.readJson(p.positional[2]);
-    const read = await client.rightsPage.get(cbid);
-    const current = read.draft;
-    const base = baseFrom(p.flags.base, read.updatedAt, h);
-    let proposed2;
-    try {
-      proposed2 = (await client.rightsPage.dryRun(cbid, file, { mode: "put" })).draft;
-    } catch (e) {
-      const list = issuesOf(e);
-      if (!list) throw e;
-      io.stderr(`${p.positional[2]} is not a valid rights page:
-`);
-      report(list);
-      return 1;
-    }
-    const changes = diffJson(current, proposed2);
-    if (!changes.length) {
-      io.stderr(`No changes: ${cbid}'s rights page draft already matches.
-`);
-      return 0;
-    }
-    io.stdout(`${formatChanges(changes)}
-`);
-    if (sub === "diff") {
-      io.stderr(`${changes.length} change${changes.length === 1 ? "" : "s"} (nothing saved). Apply with: cookiemunch rights-page push --site ${cbid} ${p.positional[2]}
-`);
-      return p.flags["exit-code"] === true ? 1 : 0;
-    }
-    let saved;
-    try {
-      saved = await client.rightsPage.put(cbid, file, { baseUpdatedAt: base });
-    } catch (e) {
-      if (!isConflict(e)) throw e;
-      io.stderr(`Not saved: ${cbid}'s rights page draft changed since ${p.flags.base !== void 0 ? "the --base you gave" : "this diff"} (someone else saved it).
-See what changed with: cookiemunch rights-page diff --site ${cbid} ${p.positional[2]}
-then push again.
-`);
-      return 1;
-    }
-    io.stderr(`Saved the draft (${changes.length} change${changes.length === 1 ? "" : "s"}). Nothing is live until: cookiemunch rights-page publish --site ${cbid}
-`);
-    if (saved.warnings.length) {
-      io.stderr("It cannot be published yet:\n");
-      report(saved.warnings);
-    }
-    return 0;
-  }
-  if (sub === "publish") {
-    const base = p.flags.base !== void 0 ? baseFrom(p.flags.base, null, h) : (await client.rightsPage.get(cbid)).updatedAt ?? null;
-    if (p.flags.yes !== true) {
-      if (!io.confirm) throw h.usage("rights-page publish puts the draft live and there is no terminal to confirm in. Pass --yes to publish without a prompt.");
-      if (!await io.confirm(`Publish ${cbid}'s rights page draft? It goes live at once. [y/N] `)) {
-        io.stderr("Not published.\n");
-        return 1;
-      }
-    }
-    try {
-      const r = await client.rightsPage.publish(cbid, { baseUpdatedAt: base });
-      io.stderr(`Published version ${r.version} of ${cbid}'s rights page.
-`);
-      return 0;
-    } catch (e) {
-      if (isConflict(e)) {
-        io.stderr(`Nothing was published: ${cbid}'s rights page draft changed since it was read (someone else saved it).
-Review it with: cookiemunch rights-page pull --site ${cbid}
-then publish again.
-`);
-        return 1;
-      }
-      const list = issuesOf(e);
-      if (!list) throw e;
-      io.stderr("The rights page cannot be published:\n");
-      report(list);
-      return 1;
-    }
-  }
-  throw h.usage(`unknown rights-page command: ${sub ?? "(none)"} \u2014 use pull, diff, push or publish`);
-}
-
-// src/cli.ts
-import { createCookieMunch, CookieMunchApiError as CookieMunchApiError2, mintConsentSyncToken } from "@cookiemunch/sdk";
-
-// src/integrations.ts
-var out = (io, v) => io.stdout(`${JSON.stringify(v, null, 2)}
-`);
-async function siteCommand(sub, io, client, h) {
-  if (sub !== "update") throw h.usage("usage: cookiemunch site update --site <cbid> [--domain <host>] [--name <name>] [--aliases a,b] [--dry-run]");
-  const cbid = h.requireSite();
-  const domain = h.flag("domain");
-  const name = h.flag("name");
-  const aliases = h.flag("aliases");
-  const patch = {};
-  if (typeof domain === "string") patch.domain = domain;
-  if (h.flag("clear-name") === true) patch.name = null;
-  else if (typeof name === "string") patch.name = name;
-  if (typeof aliases === "string") patch.aliases = aliases.split(",").map((a) => a.trim()).filter(Boolean);
-  if (Object.keys(patch).length === 0) throw h.usage("nothing to change: give --domain, --name, --clear-name or --aliases");
-  const r = await client.sites.update(cbid, patch, { dryRun: h.flag("dry-run") === true });
-  out(io, r);
-  if (r.effects.verification === "reset") io.stderr("The domain moved: verify the new domain (GET /v1/sites/{cbid}/verify/challenge).\n");
-  for (const w of r.warnings ?? []) io.stderr(`warning (${w.field}): ${w.reason}
-`);
-  return 0;
-}
-async function healthCommand(io, client, h) {
-  const r = await client.integrationHealth(h.site());
-  if (h.flag("json") === true) out(io, r);
-  else {
-    for (const c of r.checks) {
-      const mark = c.ok === true ? "ok  " : c.ok === false ? c.severity === "error" ? "FAIL" : "WARN" : "--  ";
-      io.stdout(`${mark} ${c.check} \u2014 ${c.subject}${c.detail ? `: ${c.detail}` : ""}
-`);
-      if (c.ok === false && c.fixHint) io.stdout(`     fix: ${c.fixHint}
-`);
-    }
-    io.stdout(`${r.counts.error} error(s), ${r.counts.warning} warning(s), ${r.counts.notChecked} not checked
-`);
-  }
-  return r.ok ? 0 : 1;
-}
-async function provisionCommand(file, io, client, h) {
-  const input = await h.readJson(file);
-  const withSecrets = { ...input };
-  if (input.atlas || io.env.COOKIEMUNCH_ATLAS_SECRET_KEY) {
-    const secretKey = io.env.COOKIEMUNCH_ATLAS_SECRET_KEY ?? input.atlas?.secretKey;
-    if (!secretKey) throw h.usage("set COOKIEMUNCH_ATLAS_SECRET_KEY for the atlas step");
-    withSecrets.atlas = { ...input.atlas ?? {}, secretKey };
-  }
-  if (input.forumulate) {
-    const token = io.env.COOKIEMUNCH_FORUMULATE_TOKEN ?? input.forumulate.token;
-    if (!token) throw h.usage("set COOKIEMUNCH_FORUMULATE_TOKEN for the forumulate step");
-    withSecrets.forumulate = { ...input.forumulate, token };
-  }
-  const r = await client.provision(withSecrets, { dryRun: h.flag("dry-run") === true });
-  for (const s of r.steps) {
-    io.stdout(`${s.status.padEnd(12)} ${s.step}${s.detail ? ` \u2014 ${s.detail}` : ""}${s.waitingOn ? ` (waiting on ${s.waitingOn})` : ""}
-`);
-  }
-  io.stdout(`${r.dryRun ? "dry run: " : ""}${r.summary.changed} changed, ${r.summary.unchanged} unchanged, ${r.summary.waiting} waiting, ${r.summary.failed} failed
-`);
-  return r.summary.failed ? 1 : 0;
-}
-async function partnersCommand(sub, rest, io, client, h) {
-  const cbid = h.requireSite();
-  if (sub === "list") {
-    out(io, await client.sites.listPartners(cbid));
-    return 0;
-  }
-  if (sub === "link") {
-    const partner = h.flag("partner");
-    const externalId = h.flag("external-id");
-    if (partner !== "forumulate" && partner !== "atlas") throw h.usage("--partner forumulate|atlas is required");
-    if (typeof externalId !== "string") throw h.usage("--external-id <the partner\u2019s account id> is required");
-    const label = h.flag("label");
-    const input = { partner, externalId, ...typeof label === "string" ? { label } : {} };
-    out(io, await client.sites.linkPartner(cbid, input, { dryRun: h.flag("dry-run") === true }));
-    return 0;
-  }
-  if (sub === "unlink") {
-    const id = rest[0];
-    if (!id) throw h.usage("usage: cookiemunch partners unlink <linkId> --site <cbid>");
-    out(io, await client.sites.unlinkPartner(cbid, id));
-    return 0;
-  }
-  throw h.usage("usage: cookiemunch partners list|link|unlink --site <cbid>");
-}
-async function keysCommand(sub, io, client, h) {
-  if (sub !== "report") throw h.usage("usage: cookiemunch keys report [--unused-days <n>] [--expiring-days <n>] [--json]");
-  const n = (name) => {
-    const v = h.flag(name);
-    if (v === void 0) return void 0;
-    const x = Number(v);
-    if (!Number.isInteger(x) || x < 1 || x > 3650) throw h.usage(`--${name} must be whole days from 1 to 3650`);
-    return x;
-  };
-  const unusedDays = n("unused-days");
-  const expiringDays = n("expiring-days");
-  const r = await client.keys.report({ ...unusedDays ? { unusedDays } : {}, ...expiringDays ? { expiringDays } : {} });
-  if (h.flag("json") === true) {
-    out(io, r);
-    return 0;
-  }
-  const section = (title, rows) => {
-    io.stdout(`${title}: ${rows.length}
-`);
-    for (const k of rows) io.stdout(`  ${k.prefix}${k.name ? ` (${k.name})` : ""} \u2014 ${k.reason}
-`);
-  };
-  section(`Unused for ${r.unusedDays}+ days`, r.unused);
-  section("Broad access", r.broad);
-  section(`Expiring within ${r.expiringDays} days`, r.expiringSoon);
-  io.stdout(`${r.total} key(s), ${r.noExpiry} with no expiry
-`);
-  return 0;
-}
-
-// src/design-warnings.ts
-function where(f) {
-  const w = f.where ?? {};
-  return [
-    f.layer === "banner" ? "first layer" : `${f.layer} layer`,
-    w.view ? `view "${w.view}"` : "",
-    w.variant && w.variant !== "base" ? `variant ${w.variant}` : "",
-    w.theme === "dark" ? "dark theme" : "",
-    w.breakpoint === "mobile" ? "mobile" : "",
-    w.language ? `language ${w.language}` : ""
-  ].filter(Boolean).join(", ");
-}
-function formatDesignWarnings(findings) {
-  return findings.map((f) => `${f.severity === "warning" ? "warning" : "notice "}  ${f.code}  ${where(f)}
-    ${f.detail}
-    fix: ${f.fix}`).join("\n");
-}
-function countBySeverity(findings) {
-  const warnings = findings.filter((f) => f.severity === "warning").length;
-  return { warnings, notices: findings.length - warnings };
-}
-function summaryLine(findings) {
-  const { warnings, notices } = countBySeverity(findings);
-  if (warnings + notices === 0) return "No design warnings: Accept all and Reject all have equal weight.";
-  if (warnings === 0) {
-    return `Design: 0 warnings, ${notices} notice${notices === 1 ? "" : "s"} \u2014 worth a look, not a finding that Accept is favoured. See https://cookiemunch.net/docs/fair-consent-buttons`;
-  }
-  return `Design: ${warnings} warning${warnings === 1 ? "" : "s"}, ${notices} notice${notices === 1 ? "" : "s"} \u2014 Accept is pushed harder than Reject. Regulators treat that as a dark pattern; make both buttons the same style. See https://cookiemunch.net/docs/fair-consent-buttons`;
-}
-
-// src/cli.ts
-var DEFAULT_BASE_URL = "https://api.cookiemunch.net";
-var USAGE = `cookiemunch \u2014 Cookie Munch from the command line
-
-Usage:
-  cookiemunch config pull  --site <cbid> [--out <file>]
-      Write the site's config as JSON (to stdout, or to <file>).
-  cookiemunch config diff  --site <cbid> <file> [--replace] [--exit-code]
-      Show what pushing <file> would change (the server's dry run; nothing is stored).
-      Read-only fields a pulled file carries (effective, designWarnings, ...) are ignored.
-  cookiemunch config push  --site <cbid> <file> [--replace] [--strict]
-      Apply <file>. Default: merged over the stored config (PATCH) \u2014 fields the file
-      leaves out keep their value, and a field set to null is removed (it takes its
-      default). --replace sends it whole (PUT): a top-level field the file leaves out
-      reverts to its default. Prints any design warnings the server found. --strict
-      checks the file first and does not push it (exit 1) when Accept all is pushed
-      harder than Reject all anywhere \u2014 for CI.
-  cookiemunch config validate --site <cbid> <file> [--replace] [--strict]
-      Check <file> for consent-button parity on the server, without writing: is Accept
-      all more prominent than Reject all (colour, size, placement, copy, custom CSS)?
-      Merged over the stored config like push; --replace checks it as sent. --strict
-      exits 1 when there is any warning (notices never fail).
-  cookiemunch preview --site <cbid> [--url <page>] [--region <eu|de|us-ca\u2026>] [--lang <de\u2026>]
-                      [--ttl <seconds>] [--open]
-      Print (and with --open, open) a link showing the banner as a visitor in that
-      region and language sees it. Works in headless browsers; nothing is recorded.
-  cookiemunch executors test <id> (--email <email> | --canary) [--operation <locate|export|erase>]
-      Try a connected system against one person without filing a request.
-      --operation defaults to locate (lookup is accepted as another name for it).
-      --canary uses the organisation's canary address instead: no real person, and
-      a canary locate also updates the connection's health. Exits 1 when not ok.
-  cookiemunch executors webhook-test <id> --headers-file <json> --body-file <file>
-      Would this webhook delivery verify? Sends the headers (a JSON object) and the
-      body file byte for byte to the receiver's check; nothing is acted on. Prints
-      { verified, stage, reason } and exits 1 when it does not verify.
-  cookiemunch executors deliveries <id>
-      The last 50 deliveries to that connection's webhook, each with its reason.
-  cookiemunch executors presets
-      The versioned presets, which are usable now and which wait on another
-      platform, and the organisation's canary address.
-  cookiemunch executors upgrade-preset <id> [--preset <name>] [--version <n>]
-                      [--org-id <id>] [--atlas-id-app-id <id>] [--dry-run]
-      Rebuild a connection from its preset's latest version (or --version), keeping
-      its id and credentials; --preset adopts one on a hand-written connection.
-      Prints the diff; --dry-run changes nothing.
-  cookiemunch rights-page pull    --site <cbid> [--out <file>]
-      Write the site's rights page draft as JSON, and print its updatedAt for --base.
-  cookiemunch rights-page diff    --site <cbid> <file> [--exit-code]
-      Validate <file> on the server (dry run) and show what pushing it would change.
-  cookiemunch rights-page push    --site <cbid> <file> [--base <updatedAt>]
-      Replace the draft with <file>. Nothing is live until publish. Refused (exit 1)
-      if the draft changed since the diff, or since --base (the updatedAt pull printed).
-  cookiemunch rights-page publish --site <cbid> [--yes] [--base <updatedAt>]
-      Publish the draft (it goes live at once). Asks first; --yes skips the question
-      and is required when there is no terminal to ask in. Prints why when the page
-      cannot go live. Refused (exit 1) if the draft changed after it was read (or
-      since --base); --yes never overrides that.
-
-  cookiemunch scan --site <cbid> [--wait] [--timeout <seconds>]
-      Start a cookie crawl of the site and print its state (JSON). --wait holds on
-      until it is done or failed (default up to 120 s, --timeout to change) and exits
-      1 when it failed or is still running at the end. A scan already running is
-      waited on rather than started twice.
-
-  cookiemunch cookies presets --site <cbid>
-      The declaration presets (atlas, forumulate, chatly, cookiemunch, referally): what each takes,
-      what it declared on this site, and whether the vendor's own manifest exists yet.
-  cookiemunch cookies preset <vendor> --site <cbid> [--param k=v \u2026] [--dry-run]
-      Declare what that platform writes (cookies and browser storage), marked as
-      declared by it; run again to re-sync. Atlas: --param frontendApiHost=auth.example.com
-      [--param crossSubdomainCookies=false]. Chatly: --param publicId=ch_web_\u2026 .
-      Referally: [--param cookieDomain=.example.com] [--param cookieDays=60] [--param category=\u2026].
-  cookiemunch cookies unpreset <vendor> --site <cbid> [--dry-run]
-      Remove every declaration that vendor's preset made.
-  cookiemunch cookies delete-observed <name> --site <cbid> [--dry-run]
-      Remove every stored row of that name (a name the site never sets). A declaration stays.
-  cookiemunch cookies purge-observed --site <cbid> --since <time> [--until <time>] [--dry-run]
-      Remove every row a real visit first reported in that window (ISO-8601 or epoch ms).
-      Crawled rows and declarations stay. Run with --dry-run first.
-  cookiemunch site update --site <cbid> [--domain <host>] [--name <name> | --clear-name]
-                          [--aliases <a,b>] [--dry-run]
-      Rename or move a site. The cbid and consent ledger stay; a domain move clears
-      verification. --dry-run prints the diff and its effects without saving.
-  cookiemunch consent-sync status --site <cbid>
-      Whether hosted consent sync is set up (the secret's last four characters, when it was minted).
-  cookiemunch consent-sync rotate --site <cbid>
-      Mint the site's consent-sync signing secret, or replace it (the old one stops at once).
-      Prints the secret alone on stdout, so it can be piped into your secret store: it is shown once.
-  cookiemunch consent-sync remove --site <cbid> --yes
-      Remove it: hosted consent sync stops for every visitor.
-  cookiemunch consent-sync token --site <cbid> --subject <id> [--ttl <seconds>]
-      Sign a test token locally with COOKIEMUNCH_CONSENT_SYNC_SECRET (nothing is sent), e.g. to try
-      GET /api/v1/<cbid>/profile with curl.
-  cookiemunch health [--site <cbid>] [--json]
-      Every link the site's privacy wiring depends on, with a fix hint for each that
-      fails. Exits 1 when a check fails (checks that could not run do not count).
-  cookiemunch provision <file> [--dry-run]
-      Wire a product's privacy in one call (site, connections, Atlas, Forumulate) from
-      a JSON file without secrets: the Atlas key and Forumulate token come from
-      COOKIEMUNCH_ATLAS_SECRET_KEY and COOKIEMUNCH_FORUMULATE_TOKEN. Re-running is a
-      no-op. Exits 1 when a step failed.
-  cookiemunch keys report [--unused-days <n>] [--expiring-days <n>] [--json]
-      Key hygiene: keys unused for n days (default 90), keys with broad access, and
-      keys expiring within n days (default 14). Needs a full-access key.
-  cookiemunch partners list|link|unlink --site <cbid> [--partner forumulate|atlas]
-                       [--external-id <id>] [--label <text>] [<linkId>]
-      Grant a partner platform the site's consent events (no secret is created), list
-      the grants, or revoke one.
-
-Environment:
-  COOKIEMUNCH_API_KEY   an API key (fck_\u2026). Required.
-  COOKIEMUNCH_BASE_URL  the API origin. Default ${DEFAULT_BASE_URL}.
-  COOKIEMUNCH_SITE      default for --site.
-  COOKIEMUNCH_STRICT_FIELDS=1  send Prefer: strict-unknown-fields on writes: a field the
-                        API does not know is refused (400 unknown_field), not ignored.
-`;
-var UsageError = class extends Error {
-};
-var BOOLEAN_FLAGS = /* @__PURE__ */ new Set(["replace", "exit-code", "open", "help", "json", "yes", "strict", "wait", "canary", "dry-run", "clear-name"]);
-function parseArgs(argv) {
-  const positional = [];
-  const flags = {};
-  for (let i = 0; i < argv.length; i++) {
-    const a = argv[i];
-    if (a === "-h") {
-      flags.help = true;
-    } else if (a.startsWith("--")) {
-      const eq = a.indexOf("=");
-      const name = eq > 0 ? a.slice(2, eq) : a.slice(2);
-      let value;
-      if (eq > 0) value = a.slice(eq + 1);
-      else if (BOOLEAN_FLAGS.has(name)) value = true;
-      else {
-        const v = argv[i + 1];
-        if (v === void 0 || v.startsWith("--")) throw new UsageError(`--${name} needs a value`);
-        value = v;
-        i++;
-      }
-      if (name === "param" && typeof value === "string" && typeof flags.param === "string") flags.param = `${flags.param}
-${value}`;
-      else flags[name] = value;
-    } else {
-      positional.push(a);
-    }
-  }
-  return { positional, flags };
-}
-function str(flags, name) {
-  const v = flags[name];
-  return typeof v === "string" ? v : void 0;
-}
-function requireSite(p, io) {
-  const site = str(p.flags, "site") ?? io.env.COOKIEMUNCH_SITE;
-  if (!site) throw new UsageError("--site <cbid> is required (or set COOKIEMUNCH_SITE)");
-  return site;
-}
-async function readConfigFile(io, path) {
-  if (!path) throw new UsageError("a config file is required");
-  let text;
-  try {
-    text = await io.readFile(path);
-  } catch (e) {
-    throw new UsageError(`cannot read ${path}: ${e.message}`);
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(text);
-  } catch (e) {
-    throw new UsageError(`${path} is not valid JSON: ${e.message}`);
-  }
-  if (!isPlainObject(parsed)) throw new UsageError(`${path} must hold a JSON object`);
-  return parsed;
-}
-function proposed(current, file, replace, cbid) {
-  return replace ? { ...file, cbid } : mergeLikeServer(current, file);
-}
-var CLI_VERSION = "0.5.0";
-function userAgent(io) {
-  return io.env.COOKIEMUNCH_USER_AGENT || `cookiemunch-cli/${CLI_VERSION}`;
-}
-async function rawRequest(io, base, key, method, path, body) {
-  const res = await io.fetch(`${base.replace(/\/+$/, "")}/v1${path}`, {
-    method,
-    headers: { Authorization: `Bearer ${key}`, "User-Agent": userAgent(io), ...body !== void 0 ? { "Content-Type": "application/json" } : {} },
-    ...body !== void 0 ? { body: JSON.stringify(body) } : {}
-  });
-  const text = await res.text();
-  let data = text;
-  try {
-    data = text ? JSON.parse(text) : void 0;
-  } catch {
-  }
-  if (!res.ok) {
-    const err = isPlainObject(data) ? data : {};
-    throw new CookieMunchApiError2(
-      res.status,
-      typeof err.error === "string" ? err.error : `request failed with status ${res.status}`,
-      typeof err.code === "string" ? err.code : void 0
-    );
-  }
-  return data;
-}
-async function configChanges(client, cbid, file, replace) {
-  const body = withoutReadOnly(file);
-  try {
-    const r = await client.sites.dryRunConfig(cbid, body, { mode: replace ? "put" : "patch" });
-    if (r && r.dryRun === true && Array.isArray(r.diff)) {
-      return r.diff.map((c) => {
-        const ch = { path: c.path, kind: c.from === void 0 ? "added" : c.to === void 0 ? "removed" : "changed" };
-        if (c.from !== void 0) ch.from = c.from;
-        if (c.to !== void 0) ch.to = c.to;
-        return ch;
-      });
-    }
-  } catch {
-  }
-  const current = withoutReadOnly(await client.sites.getConfig(cbid));
-  return diffJson(current, proposed(current, body, replace, cbid));
-}
-async function configCommand(sub, p, io, client) {
-  const cbid = requireSite(p, io);
-  if (sub === "pull") {
-    const cfg = await client.sites.getConfig(cbid);
-    const text = `${JSON.stringify(cfg, null, 2)}
-`;
-    const out2 = str(p.flags, "out");
-    if (out2) {
-      await io.writeFile(out2, text);
-      io.stderr(`Wrote ${cbid}'s config to ${out2}
-`);
-    } else {
-      io.stdout(text);
-    }
-    return 0;
-  }
-  if (sub === "validate") {
-    const file = await readConfigFile(io, p.positional[2]);
-    const r = await client.sites.lintConfig(cbid, file, p.flags.replace === true ? { replace: true } : {});
-    if (r.designWarnings.length) io.stdout(`${formatDesignWarnings(r.designWarnings)}
-`);
-    io.stderr(`${summaryLine(r.designWarnings)}
-`);
-    return p.flags.strict === true && countBySeverity(r.designWarnings).warnings > 0 ? 1 : 0;
-  }
-  if (sub === "diff" || sub === "push") {
-    const file = await readConfigFile(io, p.positional[2]);
-    const replace = p.flags.replace === true;
-    if (sub === "push" && p.flags.strict === true) {
-      const lint = await client.sites.lintConfig(cbid, file, replace ? { replace: true } : {});
-      if (countBySeverity(lint.designWarnings).warnings > 0) {
-        io.stderr(`${formatDesignWarnings(lint.designWarnings)}
-${summaryLine(lint.designWarnings)}
-not pushed (--strict).
-`);
-        return 1;
-      }
-    }
-    const changes = await configChanges(client, cbid, file, replace);
-    if (changes.length === 0) {
-      io.stderr(`No changes: ${cbid}'s config already matches.
-`);
-      return 0;
-    }
-    io.stdout(`${formatChanges(changes)}
-`);
-    if (sub === "diff") {
-      io.stderr(`${changes.length} change${changes.length === 1 ? "" : "s"} (nothing sent). Apply with: cookiemunch config push --site ${cbid} ${p.positional[2]}${replace ? " --replace" : ""}
-`);
-      return p.flags["exit-code"] === true ? 1 : 0;
-    }
-    const saved = replace ? await client.sites.putConfig(cbid, { ...file, cbid }) : await client.sites.patchConfig(cbid, file);
-    io.stderr(`Applied ${changes.length} change${changes.length === 1 ? "" : "s"} to ${cbid}.
-`);
-    const found = Array.isArray(saved?.designWarnings) ? saved.designWarnings : [];
-    if (found.length) io.stderr(`${formatDesignWarnings(found)}
-${summaryLine(found)}
-`);
-    return 0;
-  }
-  throw new UsageError(`unknown config command: ${sub ?? "(none)"} \u2014 use pull, diff, push or validate`);
-}
-async function previewCommand(p, io, client) {
-  const cbid = requireSite(p, io);
-  const ttl = str(p.flags, "ttl");
-  const ttlSeconds = ttl === void 0 ? void 0 : Number(ttl);
-  if (ttlSeconds !== void 0 && (!Number.isInteger(ttlSeconds) || ttlSeconds < 1 || ttlSeconds > 3600)) {
-    throw new UsageError("--ttl must be a whole number of seconds from 1 to 3600");
-  }
-  const r = await client.sites.previewToken(cbid, {
-    ...str(p.flags, "region") ? { region: str(p.flags, "region") } : {},
-    ...str(p.flags, "lang") ? { lang: str(p.flags, "lang") } : {},
-    ...str(p.flags, "url") ? { url: str(p.flags, "url") } : {},
-    ...ttlSeconds !== void 0 ? { ttlSeconds } : {}
-  });
-  if (p.flags.json === true) {
-    io.stdout(`${JSON.stringify(r, null, 2)}
-`);
-  } else if (r.previewUrl) {
-    io.stdout(`${r.previewUrl}
-`);
-  } else {
-    io.stdout(`${r.token}
-`);
-    io.stderr("Add ?cm_preview=<token>&cm_region=..&cm_lang=.. to any page of the site.\n");
-  }
-  io.stderr(`Valid until ${new Date(r.expiresAt).toISOString()}.
-`);
-  if (p.flags.open === true && r.previewUrl) await io.openUrl(r.previewUrl);
-  return 0;
-}
-async function consentSyncCommand(sub, p, io, client) {
-  const cbid = requireSite(p, io);
-  if (sub === "status") {
-    io.stdout(`${JSON.stringify(await client.consentSyncSecret.get(cbid), null, 2)}
-`);
-    return 0;
-  }
-  if (sub === "rotate") {
-    const r = await client.consentSyncSecret.rotate(cbid);
-    io.stdout(`${r.secret}
-`);
-    io.stderr("This secret is shown once: store it on your server (never in a page). A previous secret stopped working.\n");
-    return 0;
-  }
-  if (sub === "remove") {
-    if (p.flags.yes !== true) throw new UsageError("consent-sync remove stops hosted consent sync for every visitor: add --yes");
-    await client.consentSyncSecret.remove(cbid);
-    io.stderr(`Hosted consent sync is off for ${cbid}.
-`);
-    return 0;
-  }
-  if (sub === "token") {
-    const secret = io.env.COOKIEMUNCH_CONSENT_SYNC_SECRET;
-    if (!secret) throw new UsageError("set COOKIEMUNCH_CONSENT_SYNC_SECRET to the site's consent-sync secret");
-    const subject = str(p.flags, "subject");
-    if (!subject) throw new UsageError("--subject <id> is required");
-    const ttl = str(p.flags, "ttl");
-    try {
-      io.stdout(`${mintConsentSyncToken({ secret, cbid, subject, ...ttl !== void 0 ? { ttlSeconds: Number(ttl) } : {} })}
-`);
-    } catch (e) {
-      throw new UsageError(e.message);
-    }
-    return 0;
-  }
-  throw new UsageError(`unknown consent-sync command: ${sub ?? "(none)"} \u2014 use status, rotate, remove or token`);
-}
-async function executorsCommand(sub, p, io, base, key, client) {
-  if (sub === "webhook-test") {
-    const id2 = p.positional[2];
-    if (!id2) throw new UsageError("executors webhook-test <id> needs the connection id");
-    const headersFile = str(p.flags, "headers-file");
-    const bodyFile = str(p.flags, "body-file");
-    if (!headersFile || !bodyFile) throw new UsageError("--headers-file and --body-file are both required");
-    let headers;
-    try {
-      headers = JSON.parse(await io.readFile(headersFile));
-    } catch {
-      throw new UsageError(`${headersFile} is not a JSON object of header name to value`);
-    }
-    if (!isPlainObject(headers)) throw new UsageError(`${headersFile} is not a JSON object of header name to value`);
-    const body = await io.readFile(bodyFile);
-    const r = await client.fulfillment.testExecutorWebhook(id2, { headers, body });
-    io.stdout(`${JSON.stringify(r, null, 2)}
-`);
-    return r.verified ? 0 : 1;
-  }
-  if (sub === "deliveries") {
-    const id2 = p.positional[2];
-    if (!id2) throw new UsageError("executors deliveries <id> needs the connection id");
-    io.stdout(`${JSON.stringify(await client.fulfillment.executorWebhookDeliveries(id2), null, 2)}
-`);
-    return 0;
-  }
-  if (sub === "presets") {
-    io.stdout(`${JSON.stringify(await client.fulfillment.executorPresets(), null, 2)}
-`);
-    return 0;
-  }
-  if (sub === "upgrade-preset") {
-    const id2 = p.positional[2];
-    if (!id2) throw new UsageError("executors upgrade-preset <id> needs the connection id");
-    const version = str(p.flags, "version");
-    if (version !== void 0 && !/^[1-9]\d*$/.test(version)) throw new UsageError("--version must be a positive whole number");
-    const preset = str(p.flags, "preset");
-    const orgId = str(p.flags, "org-id");
-    const atlasIdAppId = str(p.flags, "atlas-id-app-id");
-    const input = {
-      ...preset ? { preset } : {},
-      ...version ? { presetVersion: Number(version) } : {},
-      ...orgId ? { orgId } : {},
-      ...atlasIdAppId ? { atlasIdAppId } : {}
-    };
-    const r = p.flags["dry-run"] === true ? await client.fulfillment.dryRunUpgradeExecutorPreset(id2, input) : await client.fulfillment.upgradeExecutorPreset(id2, input);
-    io.stdout(`${JSON.stringify(r, null, 2)}
-`);
-    return 0;
-  }
-  if (sub !== "test") throw new UsageError(`unknown executors command: ${sub ?? "(none)"} \u2014 use test, webhook-test, deliveries, presets or upgrade-preset`);
-  const id = p.positional[2];
-  if (!id) throw new UsageError("executors test <id> needs the connection id");
-  const canary = p.flags.canary === true;
-  const email = str(p.flags, "email");
-  if (canary && email) throw new UsageError("use --email or --canary, not both");
-  if (!email && !canary) throw new UsageError("--email (or --canary) is required");
-  const asked = str(p.flags, "operation") ?? "locate";
-  const operation = asked === "lookup" ? "locate" : asked;
-  try {
-    const r = await rawRequest(io, base, key, "POST", `/dsar/executors/${encodeURIComponent(id)}/test`, canary ? { canary: true, operation } : { email, operation });
-    io.stdout(`${JSON.stringify(r, null, 2)}
-`);
-    return canary && r.ok === false ? 1 : 0;
-  } catch (e) {
-    if (e instanceof CookieMunchApiError2 && e.status === 404 && e.message === "not found") {
-      io.stderr("This server does not offer connection tests yet (POST /v1/dsar/executors/{id}/test).\n");
-      return 1;
-    }
-    throw e;
-  }
-}
-async function scanCommand(p, io, client) {
-  const cbid = requireSite(p, io);
-  const timeout = str(p.flags, "timeout");
-  const timeoutS = timeout === void 0 ? 120 : Number(timeout);
-  if (!Number.isFinite(timeoutS) || timeoutS < 1 || timeoutS > 3600) throw new UsageError("--timeout must be a number of seconds from 1 to 3600");
-  let started = null;
-  try {
-    started = await client.sites.scan(cbid);
-  } catch (e) {
-    if (!(e instanceof CookieMunchApiError2 && e.status === 409)) throw e;
-    io.stderr(`A scan of ${cbid} is already running${p.flags.wait === true ? "; waiting for it" : ""}.
-`);
-    if (p.flags.wait !== true) return 0;
-  }
-  if (p.flags.wait !== true) {
-    io.stdout(`${JSON.stringify(started, null, 2)}
-`);
-    return 0;
-  }
-  const r = await client.sites.waitForScan(cbid, { timeoutMs: timeoutS * 1e3 });
-  io.stdout(`${JSON.stringify(r, null, 2)}
-`);
-  if (r.state === "failed") {
-    io.stderr(`Scan ${r.scanId ?? ""} failed: ${r.error ?? "no reason given"}
-`);
-    return 1;
-  }
-  if (r.status === "scanning") {
-    io.stderr(`Scan ${r.scanId ?? ""} is still running after ${timeoutS} s.
-`);
-    return 1;
-  }
-  const n = r.cookieCount ?? 0;
-  const pages = r.pagesVisited !== void 0 ? ` on ${r.pagesVisited} page${r.pagesVisited === 1 ? "" : "s"}` : "";
-  const kept = r.keptFromEarlier ? `, ${r.keptFromEarlier} kept from earlier crawls and visits` : "";
-  const took = r.durationMs !== void 0 ? ` in ${Math.round(r.durationMs / 1e3)} s` : "";
-  const landed = r.finalUrl ? ` (redirected to ${r.finalUrl})` : "";
-  io.stderr(`Scan ${r.scanId ?? ""} done${took}: ${n} cookie${n === 1 ? "" : "s"} seen${pages}${kept}${landed}.
-`);
-  return 0;
-}
-var PRESET_VENDORS = ["atlas", "forumulate", "chatly", "cookiemunch", "referally"];
-function vendorArg(v) {
-  if (!v || !PRESET_VENDORS.includes(v)) throw new UsageError(`a vendor is required: ${PRESET_VENDORS.join(", ")}`);
-  return v;
-}
-function presetParams(p) {
-  const raw = str(p.flags, "param");
-  const out2 = {};
-  for (const line of raw ? raw.split("\n") : []) {
-    const eq = line.indexOf("=");
-    if (eq <= 0) throw new UsageError(`--param takes key=value, got "${line}"`);
-    const v = line.slice(eq + 1);
-    const k = line.slice(0, eq);
-    out2[k] = v === "true" ? true : v === "false" ? false : k === "cookieDays" && /^\d+$/.test(v) ? Number(v) : v;
-  }
-  return out2;
-}
-async function cookiesCommand(sub, p, io, client) {
-  const dry = p.flags["dry-run"] === true ? { dryRun: true } : void 0;
-  const print = (v) => io.stdout(`${JSON.stringify(v, null, 2)}
-`);
-  if (sub === "presets") {
-    print(await client.sites.cookiePresets(requireSite(p, io)));
-    return 0;
-  }
-  if (sub === "preset" || sub === "unpreset") {
-    const cbid = requireSite(p, io);
-    const vendor = vendorArg(p.positional[2]);
-    if (sub === "unpreset") {
-      print(await client.sites.removeCookiePreset(cbid, vendor, dry));
-      return 0;
-    }
-    const r = await client.sites.applyCookiePreset(cbid, vendor, presetParams(p), dry);
-    print(r);
-    if (r.note) io.stderr(`${r.note}
-`);
-    for (const s of r.skipped ?? []) io.stderr(`skipped ${s.name}: ${s.reason}
-`);
-    if (r.manifest.status === "waiting_on_vendor") io.stderr(`Built-in rows: ${r.manifest.waitingOn} does not publish a manifest yet (${r.manifest.item}).
-`);
-    return 0;
-  }
-  if (sub === "delete-observed") {
-    const cbid = requireSite(p, io);
-    const name = p.positional[2];
-    if (!name) throw new UsageError("a cookie name is required");
-    if (dry) print(await client.sites.deleteObservedCookie(cbid, name, dry));
-    else {
-      await client.sites.deleteObservedCookie(cbid, name);
-      io.stderr(`Removed ${name}.
-`);
-    }
-    return 0;
-  }
-  if (sub === "purge-observed") {
-    const cbid = requireSite(p, io);
-    const since = str(p.flags, "since");
-    if (!since) throw new UsageError("--since is required (ISO-8601 or epoch ms)");
-    const until = str(p.flags, "until");
-    const r = await client.sites.purgeObservedCookies(cbid, { since, ...until ? { until } : {} }, dry);
-    print(r);
-    io.stderr(`${dry ? "Would remove" : "Removed"} ${r.count} row${r.count === 1 ? "" : "s"}.
-`);
-    return 0;
-  }
-  throw new UsageError(`unknown cookies command: ${sub ?? "(none)"}`);
-}
-async function run(argv, io) {
-  let p;
-  try {
-    p = parseArgs(argv);
-  } catch (e) {
-    io.stderr(`${e.message}
-
-${USAGE}`);
-    return 2;
-  }
-  const [cmd, sub] = p.positional;
-  if (!cmd || p.flags.help === true || cmd === "help") {
-    io.stdout(USAGE);
-    return cmd || p.flags.help === true ? 0 : 2;
-  }
-  const key = io.env.COOKIEMUNCH_API_KEY;
-  if (!key) {
-    io.stderr("COOKIEMUNCH_API_KEY is not set. Create a key under Developers in the dashboard.\n");
-    return 2;
-  }
-  const base = io.env.COOKIEMUNCH_BASE_URL || DEFAULT_BASE_URL;
-  const client = createCookieMunch({ apiKey: key, baseUrl: base, fetch: io.fetch, userAgent: userAgent(io), ...io.env.COOKIEMUNCH_STRICT_FIELDS === "1" ? { strictUnknownFields: true } : {} });
-  try {
-    if (cmd === "config") return await configCommand(sub, p, io, client);
-    if (cmd === "preview") return await previewCommand(p, io, client);
-    if (cmd === "scan") return await scanCommand(p, io, client);
-    if (cmd === "consent-sync") return await consentSyncCommand(sub, p, io, client);
-    if (cmd === "cookies") return await cookiesCommand(sub, p, io, client);
-    if (cmd === "executors") return await executorsCommand(sub, p, io, base, key, client);
-    const helpers = {
-      requireSite: () => requireSite(p, io),
-      site: () => str(p.flags, "site") ?? io.env.COOKIEMUNCH_SITE,
-      readJson: (path) => readConfigFile(io, path),
-      usage: (m) => new UsageError(m),
-      flag: (name) => p.flags[name]
-    };
-    if (cmd === "site") return await siteCommand(sub, io, client, helpers);
-    if (cmd === "health") return await healthCommand(io, client, helpers);
-    if (cmd === "provision") return await provisionCommand(sub, io, client, helpers);
-    if (cmd === "keys") return await keysCommand(sub, io, client, helpers);
-    if (cmd === "partners") return await partnersCommand(sub, p.positional.slice(2), io, client, helpers);
-    if (cmd === "rights-page") {
-      return await rightsPageCommand(sub, p, io, client, {
-        requireSite: () => requireSite(p, io),
-        readJson: (path) => readConfigFile(io, path),
-        usage: (m) => new UsageError(m)
-      });
-    }
-    throw new UsageError(`unknown command: ${cmd}`);
-  } catch (e) {
-    if (e instanceof UsageError) {
-      io.stderr(`${e.message}
-
-${USAGE}`);
-      return 2;
-    }
-    if (e instanceof CookieMunchApiError2) {
-      io.stderr(`API error ${e.status}${e.code ? ` (${e.code})` : ""}: ${e.message}
-`);
-      return 1;
-    }
-    io.stderr(`${e.message ?? String(e)}
-`);
-    return 1;
-  }
-}
-
-export {
-  mergeLikeServer,
-  diffJson,
-  formatChanges,
-  rightsPageCommand,
-  DEFAULT_BASE_URL,
-  USAGE,
-  parseArgs,
-  run
-};
-//# sourceMappingURL=chunk-2ADK3C47.js.map