@cookiemunch/cli 0.7.0 → 0.8.0

package/dist/cli.d.ts

@@ -0,0 +1,62 @@
+/**
+ * `cookiemunch` — the Developer API from a terminal or a CI job.
+ *
+ *   cookiemunch config pull  --site <cbid> [--out file]
+ *   cookiemunch config diff  --site <cbid> <file> [--replace] [--exit-code]
+ *   cookiemunch config push  --site <cbid> <file> [--replace] [--strict]
+ *   cookiemunch config validate --site <cbid> <file> [--replace] [--strict]
+ *   cookiemunch preview      --site <cbid> [--url <url>] [--region eu] [--lang de] [--ttl 900] [--open]
+ *   cookiemunch executors test <id> --email <email> [--operation locate]
+ *   cookiemunch executors webhook-test <id> --headers-file <json> --body-file <file>
+ *   cookiemunch executors deliveries <id>
+ *   cookiemunch executors presets
+ *   cookiemunch executors conformance <baseUrl> --secret-env <NAME> [--canary-email <addr>] [--prefix /privacy] [--json]
+ *   cookiemunch executors conformance --connection <id> [--json]
+ *   cookiemunch executors roll-completion-secret <id>
+ *   cookiemunch executors upgrade-preset <id> [--preset <name>] [--version <n>] [--org-id <id>] [--atlas-id-app-id <id>]
+ *                      [--revoke-atlas-id-grant] [--accept-preset <path> …] [--dry-run]
+ *   cookiemunch executors recheck <id>
+ *   cookiemunch executors health <id> [--limit <n>]
+ *   cookiemunch rights-page pull|diff|push|publish --site <cbid> [<file>] [--base <updatedAt>] [--yes]
+ *   cookiemunch scan         --site <cbid> [--wait] [--timeout <seconds>]
+ *   cookiemunch cookies presets|preset|unpreset|delete-observed|purge-observed --site <cbid> …
+ *   cookiemunch site update  --site <cbid> [--domain <host>] [--name <name>] [--aliases a,b] [--dry-run]
+ *   cookiemunch site brand   --site <cbid> [--url <https URL> | <brand.json>] [--dry-run]
+ *   cookiemunch health       [--site <cbid>] [--json] [--fail-on error|warning|never]
+ *   cookiemunch provision    <file> [--dry-run]
+ *   cookiemunch partners     list|link|unlink --site <cbid> …
+ *   cookiemunch consent-sync status|rotate|remove|token --site <cbid> …
+ *   cookiemunch csp          --merge <vendors|urls> [--framework next|express|nginx] [--site <cbid>]
+ *
+ * Everything goes through the typed SDK (@cookiemunch/sdk) except where the SDK has no
+ * method yet; those calls go through `rawRequest` with the same key and base URL. All I/O
+ * is injected, so the whole CLI is testable with a mocked fetch.
+ */
+export declare const DEFAULT_BASE_URL = "https://api.cookiemunch.net";
+export interface CliIo {
+    env: Record<string, string | undefined>;
+    fetch: typeof fetch;
+    stdout: (text: string) => void;
+    stderr: (text: string) => void;
+    readFile: (path: string) => Promise<string>;
+    /** `mode` is the file mode for a new file (0o600 for anything holding a secret). */
+    writeFile: (path: string, data: string, mode?: number) => Promise<void>;
+    /** Open a URL in the user's browser. */
+    openUrl: (url: string) => Promise<void>;
+    /**
+     * Ask a yes/no question. Present only when a person can answer (an interactive terminal);
+     * absent, a command that needs confirmation refuses unless given --yes.
+     */
+    confirm?: (question: string) => Promise<boolean>;
+}
+export declare const USAGE = "cookiemunch \u2014 Cookie Munch from the command line\n\nUsage:\n  cookiemunch config pull  --site <cbid> [--out <file>]\n      Write the site's config as JSON (to stdout, or to <file>).\n  cookiemunch config diff  --site <cbid> <file> [--replace] [--exit-code]\n      Show what pushing <file> would change (the server's dry run; nothing is stored).\n      Read-only fields a pulled file carries (effective, designWarnings, ...) are ignored.\n  cookiemunch config push  --site <cbid> <file> [--replace] [--strict]\n      Apply <file>. Default: merged over the stored config (PATCH) \u2014 fields the file\n      leaves out keep their value, and a field set to null is removed (it takes its\n      default). --replace sends it whole (PUT): a top-level field the file leaves out\n      reverts to its default. Prints any design warnings the server found. --strict\n      checks the file first and does not push it (exit 1) when Accept all is pushed\n      harder than Reject all anywhere \u2014 for CI.\n  cookiemunch config validate --site <cbid> <file> [--replace] [--strict]\n      Check <file> for consent-button parity on the server, without writing: is Accept\n      all more prominent than Reject all (colour, size, placement, copy, custom CSS)?\n      Merged over the stored config like push; --replace checks it as sent. --strict\n      exits 1 when there is any warning (notices never fail).\n  cookiemunch preview --site <cbid> [--url <page>] [--region <eu|de|us-ca\u2026>] [--lang <de\u2026>]\n                      [--ttl <seconds>] [--open]\n      Print (and with --open, open) a link showing the banner as a visitor in that\n      region and language sees it. Works in headless browsers; nothing is recorded.\n  cookiemunch executors test <id> (--email <email> | --canary) [--operation <locate|export|erase>]\n      Try a connected system against one person without filing a request.\n      --operation defaults to locate (lookup is accepted as another name for it).\n      --canary uses the organisation's canary address instead: no real person, and\n      a canary locate also updates the connection's health. Exits 1 when not ok.\n  cookiemunch executors webhook-test <id> --headers-file <json> --body-file <file>\n      Would this webhook delivery verify? Sends the headers (a JSON object) and the\n      body file byte for byte to the receiver's check; nothing is acted on. Prints\n      { verified, stage, reason } and exits 1 when it does not verify.\n  cookiemunch executors deliveries <id>\n      The last 50 deliveries to that connection's webhook, each with its reason.\n  cookiemunch executors presets\n      The versioned presets, which are usable now and which wait on another\n      platform, and the organisation's canary address.\n  cookiemunch executors conformance <baseUrl> --secret-env <NAME> [--canary-email <addr>]\n                      [--prefix /privacy] [--json]\n      Check any system against the open cm-standard-v2 executor contract, rule by\n      rule, using only the canary subject. The credential is read from the\n      environment variable NAME, never from the command line. Without\n      --canary-email the organisation's canary address is fetched (needs\n      COOKIEMUNCH_API_KEY); with it, no Cookie Munch key is needed at all.\n      Exits 1 when any rule fails.\n  cookiemunch executors conformance --connection <id> [--json]\n      The same suite, run by Cookie Munch against a connected system.\n  cookiemunch executors roll-completion-secret <id>\n      A new completion secret for that connection, printed once; the old one keeps\n      verifying for 24 hours.\n  cookiemunch executors upgrade-preset <id> [--preset <name>] [--version <n>]\n                      [--org-id <id>] [--atlas-id-app-id <id>] [--revoke-atlas-id-grant]\n                      [--accept-preset <path> \u2026] [--dry-run]\n      Rebuild a connection from its preset's latest version (or --version), keeping\n      its id and credentials; --preset adopts one on a hand-written connection.\n      Your hand edits are kept (the diff marks them kept or conflict); --accept-preset\n      (repeatable) takes the preset's value for that path. Prints the diff; --dry-run\n      changes nothing. A pinned connection is refused.\n  cookiemunch executors recheck <id>\n      Re-check a connection now (a canary test that records its health): the hook to\n      run after deploying that system's rights API. Exits 1 when it is not ok.\n  cookiemunch executors health <id> [--limit <n>]\n      The connection's last health checks, newest first (up to 50).\n  cookiemunch rights-page pull    --site <cbid> [--out <file>]\n      Write the site's rights page draft as JSON, and print its updatedAt for --base.\n  cookiemunch rights-page diff    --site <cbid> <file> [--exit-code]\n      Validate <file> on the server (dry run) and show what pushing it would change.\n  cookiemunch rights-page push    --site <cbid> <file> [--base <updatedAt>]\n      Replace the draft with <file>. Nothing is live until publish. Refused (exit 1)\n      if the draft changed since the diff, or since --base (the updatedAt pull printed).\n  cookiemunch rights-page publish --site <cbid> [--yes] [--base <updatedAt>]\n      Publish the draft (it goes live at once). Asks first; --yes skips the question\n      and is required when there is no terminal to ask in. Prints why when the page\n      cannot go live. Refused (exit 1) if the draft changed after it was read (or\n      since --base); --yes never overrides that.\n\n  cookiemunch scan --site <cbid> [--wait] [--timeout <seconds>]\n      Start a cookie crawl of the site and print its state (JSON). --wait holds on\n      until it is done or failed (default up to 120 s, --timeout to change) and exits\n      1 when it failed or is still running at the end. A scan already running is\n      waited on rather than started twice.\n\n  cookiemunch cookies presets --site <cbid>\n      The declaration presets (atlas, forumulate, chatly, cookiemunch, referalli, firstpromoter,\n      partnerstack, tapfiliate, impact; referally is the deprecated old name of referalli): what each takes,\n      what it declared on this site, and whether the vendor's own manifest exists yet.\n  cookiemunch cookies preset <vendor> --site <cbid> [--param k=v \u2026] [--dry-run]\n      Declare what that platform writes (cookies and browser storage), marked as\n      declared by it; run again to re-sync. Atlas: --param frontendApiHost=auth.example.com\n      [--param crossSubdomainCookies=false]. Chatly: --param publicId=ch_web_\u2026 .\n      Referral and affiliate presets (referalli, firstpromoter, partnerstack, tapfiliate, impact):\n      [--param cookieDomain=.example.com] [--param cookieDays=60] [--param category=\u2026];\n      referalli [--param legacyName=false], impact [--param campaignId=\u2026]. A row filed under a\n      disabled category prints a warning and a suggestedConfigPatch. Any other vendor is\n      declared with the API (PUT /v1/sites/{cbid}/cookies).\n  cookiemunch cookies unpreset <vendor> --site <cbid> [--dry-run]\n      Remove every declaration that vendor's preset made.\n  cookiemunch cookies import-manifest <url> --site <cbid> [--file <manifest.json>] [--dry-run]\n      Declare any vendor's cookies and storage from its embed manifest\n      (/.well-known/<product>-embed.json), by URL or from a file. Remove it with\n      cookies unpreset <product>.\n  cookiemunch cookies suggestions --site <cbid>\n      What to declare: the platforms detected on the site and each undeclared row.\n  cookiemunch cookies declare-suggestions --site <cbid> [--names a,b] [--dry-run]\n      Declare them: detected vendors' presets, then every other suggestion with a purpose.\n  cookiemunch cookies delete-observed <name> --site <cbid> [--dry-run]\n      Remove every stored row of that name (a name the site never sets). A declaration stays.\n  cookiemunch cookies purge-observed --site <cbid> --since <time> [--until <time>] [--dry-run]\n      Remove every row a real visit first reported in that window (ISO-8601 or epoch ms).\n      Crawled rows and declarations stay. Run with --dry-run first.\n  cookiemunch site update --site <cbid> [--domain <host>] [--name <name> | --clear-name]\n                          [--aliases <a,b>] [--dry-run]\n      Rename or move a site. The cbid and consent ledger stay; a domain move clears\n      verification. --dry-run prints the diff and its effects without saving.\n  cookiemunch site brand --site <cbid> [--url <https URL> | <brand.json>] [--dry-run]\n      Import a brand.json into the banner theme (the rights page uses it too). Values the\n      site set itself are kept. With neither --url nor a file, prints the last import.\n  cookiemunch consent-sync status --site <cbid>\n      Whether hosted consent sync is set up (the secret's last four characters, when it was minted).\n  cookiemunch consent-sync rotate --site <cbid>\n      Mint the site's consent-sync signing secret, or replace it (the old one stops at once).\n      Prints the secret alone on stdout, so it can be piped into your secret store: it is shown once.\n  cookiemunch consent-sync remove --site <cbid> --yes\n      Remove it: hosted consent sync stops for every visitor.\n  cookiemunch consent-sync token --site <cbid> --subject <id> [--ttl <seconds>]\n      Sign a test token locally with COOKIEMUNCH_CONSENT_SYNC_SECRET (nothing is sent), e.g. to try\n      GET /api/v1/<cbid>/profile with curl.\n  cookiemunch health [--site <cbid>] [--json] [--fail-on error|warning|never]\n      Every link the site's privacy wiring depends on, with a fix hint for each that\n      fails. Exits 1 when a check fails (checks that could not run, or are waived, do not count).\n      --fail-on error ignores warnings; --fail-on never always exits 0.\n  cookiemunch provision <file> [--dry-run]\n      Wire a product's privacy in one call (site, connections, Atlas, Forumulate) from\n      a JSON file without secrets: the Atlas key and Forumulate token come from\n      COOKIEMUNCH_ATLAS_SECRET_KEY and COOKIEMUNCH_FORUMULATE_TOKEN. Re-running is a\n      no-op. Exits 1 when a step failed.\n  cookiemunch keys report [--unused-days <n>] [--expiring-days <n>] [--json]\n      Key hygiene: keys unused for n days (default 90), keys with broad access, and\n      keys expiring within n days (default 14). Needs a full-access key.\n  cookiemunch partners list|link|unlink --site <cbid> [--partner <id>]\n                       [--external-id <id>] [--label <text>] [<linkId>]\n      Grant a partner platform the site's consent events (no secret is created), list\n      the grants, or revoke one. Any partner this deployment knows (forumulate, atlas, chatly,\n      referalli, or one registered for it).\n  cookiemunch token exchange --subject-token-env NAME --scope <a,b> --resource org:<id>|site:<cbid> [--expires-in <s>]\n      Swap your identity provider's token (read from the variable NAME) for a short-lived, scoped\n      API key (at most 1 hour); prints the key alone. Needs no API key.\n  cookiemunch csp --merge <vendors|urls> [--framework next|express|nginx] [--site <cbid>]\n      One Content-Security-Policy from several products' embed manifests\n      (/.well-known/<product>-embed.json): cookiemunch, atlas, chatly, forumulate,\n      referalli, or any manifest URL. --framework prints it for next.config.js,\n      Express or nginx; without it, the header value. --site uses your site's own\n      Cookie Munch manifest (its logo, fonts, sync endpoint). Needs no API key. Exits 1\n      when a named product has not published a manifest (the rest are still merged).\n  cookiemunch cookies diff|push <file> --site <cbid> [--replace] [--exit-code]\n      Declarations as a file ({\"cookies\": [...]}), through the server's dry run. push applies\n      only when something differs; --replace also removes declarations the file leaves out.\n  cookiemunch executors pull [<file>] | diff <file> | push <file> [--secret-env NAME]\n      Connected systems as a file. The file never carries a secret: a new connection's API key\n      comes from the environment variable --secret-env names.\n  cookiemunch dsar test [--types access,deletion] [--with-cbid --site <cbid>] [--without-cbid]\n                        [--email <addr>] [--cleanup]\n      File TEST rights requests and read each back. --cleanup deletes exactly the ones this run\n      filed (by id; it never deletes by listing).\n  cookiemunch doctor [--site <cbid>] [--org <id>]\n      The key (and whose org it is, against --org or COOKIEMUNCH_ORG), its expiry, the CLI\n      version against the latest, and integration health. Exits 1 when a check fails.\n  cookiemunch keys vend --scopes <a,b> --ttl <1h|30m|seconds> [--cbids <x,y>] [--name <n>]\n      A short-lived key (at most 12 h) within this key's own scopes; prints the key alone.\n      Needs keys:write (or a full-access key).\n  cookiemunch keys self | rotate-self\n      This key's own prefix, scopes and expiry; or rotate it (the new key is printed once).\n  cookiemunch sandbox [show] | create [--key-name <n>] | delete [--yes]\n      The organisation's sandbox: a separate test organisation with the same people and plan\n      features, never billed; its keys are test keys and its rights requests are all tests.\n      create makes it (or reuses it) and prints a new key for it alone; delete erases it and\n      everything in it, after asking. create and delete need a full-access key or orgs:create.\n  cookiemunch plan [cookiemunch.json] [--exit-code] [--json]\n  cookiemunch apply [cookiemunch.json] [--secret-env NAME] [--secrets-out <file>]\n      One file for a site: {site, config, cookies, presets, executors, webhooks, rightsPage,\n      partners}, no secrets. plan prints the server's dry run of every part (\"No changes\" when\n      it matches); apply applies them in dependency order and logs each. New webhook secrets\n      go to --secrets-out (mode 0600).\n  cookiemunch --version | version [--json]\n      The CLI version; --json adds the API version the server documents.\n\nEvery command takes --json for machine-readable output.\n\nExit codes:\n  0  ok, or nothing to change\n  1  a difference (with --exit-code), a failure, or a failed check\n  2  a usage mistake\n\nEnvironment:\n  COOKIEMUNCH_API_KEY   an API key (cookiemunch_live_\u2026, or a legacy fck_\u2026). Required.\n  COOKIEMUNCH_BASE_URL  the API origin. Default https://api.cookiemunch.net.\n  COOKIEMUNCH_SITE      default for --site.\n  COOKIEMUNCH_STRICT_FIELDS=1  send Prefer: strict-unknown-fields on writes: a field the\n                        API does not know is refused (400 unknown_field), not ignored.\n  COOKIEMUNCH_SECRET_RECIPIENT=x25519:<base64>  answers carry once-shown secrets sealed to\n                        this key (sealed_secret), never in plaintext.\n  COOKIEMUNCH_ORG       the org id doctor checks the key against.\n  --idempotency-key <k> send Idempotency-Key on writes: a retry replays the first answer.\n";
+interface Parsed {
+    positional: string[];
+    flags: Record<string, string | true>;
+}
+export declare function parseArgs(argv: string[]): Parsed;
+/** This package's version, sent in the default User-Agent (a test pins it to package.json). */
+export declare const CLI_VERSION = "0.8.0";
+/** Run the CLI. Returns the process exit code: 0 ok, 1 failed, 2 usage. */
+export declare function run(argv: string[], io: CliIo): Promise<number>;
+export {};

package/dist/csp.d.ts

@@ -0,0 +1,70 @@
+/**
+ * `cookiemunch csp --merge <vendors|urls> [--framework next|express|nginx] [--site <cbid>]`
+ *
+ * One Content-Security-Policy from several products' embed manifests
+ * (`/.well-known/<product>-embed.json`, schema https://cookiemunch.net/schemas/embed-v1.json):
+ * each manifest lists its origins by directive (`csp`) and the non-origin sources it needs
+ * (`requires`); the policy is their union, plus `'self'`.
+ *
+ * Vendor-neutral: `--merge` takes any manifest URL. The names below are first-class shortcuts
+ * for products whose manifest host is known — the same host map the API's importer uses
+ * (packages/server/src/manifest-importer.ts; a test keeps the two equal). A product that has not
+ * published its manifest yet is reported, and the policy is built from the rest.
+ *
+ * Needs no API key: every manifest is public, `--site` included (`GET /v1/embed?cbid=`).
+ */
+/** Where a known product publishes its manifest: the apex first, then its API host. */
+export declare const KNOWN_MANIFEST_HOSTS: Readonly<Record<string, readonly string[]>>;
+export declare const CSP_FRAMEWORKS: readonly ["next", "express", "nginx"];
+export type CspFramework = (typeof CSP_FRAMEWORKS)[number];
+type Surface = {
+    csp?: Record<string, unknown>;
+    requires?: Record<string, unknown>;
+};
+type Manifest = {
+    product?: unknown;
+    surfaces?: Record<string, Surface>;
+};
+export interface ManifestSource {
+    /** What the user named: a vendor or a URL. */
+    label: string;
+    /** URLs to try, in order. */
+    urls: string[];
+    product?: string;
+}
+/** `atlas,chatly,https://x/.well-known/x-embed.json` → sources to fetch. */
+export declare function manifestSources(list: string, opts: {
+    site?: string;
+    apiBase: string;
+}): {
+    sources: ManifestSource[];
+    unknown: string[];
+};
+/** The union of every surface's origins and requirements, by directive; `'self'` first. */
+export declare function mergeManifests(manifests: Manifest[]): Map<string, string[]>;
+/** Placeholders a manifest left for the tenant to fill in: reported, never guessed. */
+export declare function placeholders(manifests: Manifest[]): string[];
+export declare function policyString(policy: Map<string, string[]>): string;
+/** The policy as the framework writes it. */
+export declare function renderPolicy(policy: Map<string, string[]>, framework?: CspFramework): string;
+/** Fetch one manifest, trying each URL in turn. */
+export declare function fetchManifest(src: ManifestSource, fetchImpl: typeof fetch): Promise<{
+    ok: true;
+    manifest: Manifest;
+    url: string;
+} | {
+    ok: false;
+    error: string;
+}>;
+export interface CspIo {
+    fetch: typeof fetch;
+    stdout: (text: string) => void;
+    stderr: (text: string) => void;
+}
+export declare function cspCommand(opts: {
+    merge?: string;
+    framework?: string;
+    site?: string;
+    apiBase: string;
+}, io: CspIo, usage: (message: string) => Error): Promise<number>;
+export {};

package/dist/design-warnings.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Consent-button parity findings, as terminal text: one line per finding (severity, code,
+ * where), then its explanation and fix, indented. See /docs/fair-consent-buttons.
+ */
+import type { ButtonParityFinding } from '@cookiemunch/sdk';
+export declare function formatDesignWarnings(findings: ButtonParityFinding[]): string;
+export declare function countBySeverity(findings: ButtonParityFinding[]): {
+    warnings: number;
+    notices: number;
+};
+export declare function summaryLine(findings: ButtonParityFinding[]): string;

package/dist/diff.d.ts

@@ -0,0 +1,32 @@
+/**
+ * What a config push would change, computed on this side of the wire.
+ *
+ * `mergeLikeServer` mirrors the server's `PATCH /v1/sites/{cbid}/config` semantics exactly
+ * (JSON Merge Patch, RFC 7386 — packages/server/src/site-config-write.ts mergePatch): the
+ * patch wins, nested plain objects merge, arrays and primitives replace wholesale, and a
+ * `null` removes the key. A diff computed against any other merge would describe a change
+ * the server is not going to make.
+ */
+export type Json = null | boolean | number | string | Json[] | {
+    [k: string]: Json;
+};
+export interface Change {
+    /** Dotted path; array indices in brackets: `banner.content.title`, `geoRules[0].mode`. */
+    path: string;
+    kind: 'added' | 'removed' | 'changed';
+    from?: Json;
+    to?: Json;
+}
+/**
+ * Returned by a config read, never a setting; the server drops them from a write
+ * (packages/server/src/site-config-write.ts READ_ONLY_CONFIG_FIELDS, pinned by a test).
+ */
+export declare const READ_ONLY_CONFIG_FIELDS: readonly ["effective", "warnings", "designWarnings", "region", "regulation", "copy", "rightsFormUrl", "version", "observeToken", "sdkBoot", "originEnv"];
+/** A copy of a config without its read-only fields, so a pulled file diffs clean against the server. */
+export declare function withoutReadOnly(cfg: Record<string, unknown>): Record<string, unknown>;
+export declare function isPlainObject(v: unknown): v is Record<string, unknown>;
+export declare function mergeLikeServer(base: Record<string, unknown>, patch: Record<string, unknown>): Record<string, unknown>;
+/** Every leaf that differs between `before` and `after`, in a stable order. */
+export declare function diffJson(before: unknown, after: unknown, path?: string): Change[];
+/** A unified-diff-ish rendering: one line per change. */
+export declare function formatChanges(changes: Change[]): string;

package/dist/index.d.ts

@@ -1,165 +1,4 @@
-import { CookieMunchClient } from '@cookiemunch/sdk';
-
-/**
- * `cookiemunch` — the Developer API from a terminal or a CI job.
- *
- *   cookiemunch config pull  --site <cbid> [--out file]
- *   cookiemunch config diff  --site <cbid> <file> [--replace] [--exit-code]
- *   cookiemunch config push  --site <cbid> <file> [--replace] [--strict]
- *   cookiemunch config validate --site <cbid> <file> [--replace] [--strict]
- *   cookiemunch preview      --site <cbid> [--url <url>] [--region eu] [--lang de] [--ttl 900] [--open]
- *   cookiemunch executors test <id> --email <email> [--operation locate]
- *   cookiemunch executors webhook-test <id> --headers-file <json> --body-file <file>
- *   cookiemunch executors deliveries <id>
- *   cookiemunch executors presets
- *   cookiemunch executors conformance <baseUrl> --secret-env <NAME> [--canary-email <addr>] [--prefix /privacy] [--json]
- *   cookiemunch executors conformance --connection <id> [--json]
- *   cookiemunch executors roll-completion-secret <id>
- *   cookiemunch executors upgrade-preset <id> [--preset <name>] [--version <n>] [--org-id <id>] [--atlas-id-app-id <id>]
- *                      [--revoke-atlas-id-grant] [--accept-preset <path> …] [--dry-run]
- *   cookiemunch executors recheck <id>
- *   cookiemunch executors health <id> [--limit <n>]
- *   cookiemunch rights-page pull|diff|push|publish --site <cbid> [<file>] [--base <updatedAt>] [--yes]
- *   cookiemunch scan         --site <cbid> [--wait] [--timeout <seconds>]
- *   cookiemunch cookies presets|preset|unpreset|delete-observed|purge-observed --site <cbid> …
- *   cookiemunch site update  --site <cbid> [--domain <host>] [--name <name>] [--aliases a,b] [--dry-run]
- *   cookiemunch site brand   --site <cbid> [--url <https URL> | <brand.json>] [--dry-run]
- *   cookiemunch health       [--site <cbid>] [--json] [--fail-on error|warning|never]
- *   cookiemunch provision    <file> [--dry-run]
- *   cookiemunch partners     list|link|unlink --site <cbid> …
- *   cookiemunch consent-sync status|rotate|remove|token --site <cbid> …
- *   cookiemunch csp          --merge <vendors|urls> [--framework next|express|nginx] [--site <cbid>]
- *
- * Everything goes through the typed SDK (@cookiemunch/sdk) except where the SDK has no
- * method yet; those calls go through `rawRequest` with the same key and base URL. All I/O
- * is injected, so the whole CLI is testable with a mocked fetch.
- */
-declare const DEFAULT_BASE_URL = "https://api.cookiemunch.net";
-interface CliIo {
-    env: Record<string, string | undefined>;
-    fetch: typeof fetch;
-    stdout: (text: string) => void;
-    stderr: (text: string) => void;
-    readFile: (path: string) => Promise<string>;
-    /** `mode` is the file mode for a new file (0o600 for anything holding a secret). */
-    writeFile: (path: string, data: string, mode?: number) => Promise<void>;
-    /** Open a URL in the user's browser. */
-    openUrl: (url: string) => Promise<void>;
-    /**
-     * Ask a yes/no question. Present only when a person can answer (an interactive terminal);
-     * absent, a command that needs confirmation refuses unless given --yes.
-     */
-    confirm?: (question: string) => Promise<boolean>;
-}
-declare const USAGE = "cookiemunch \u2014 Cookie Munch from the command line\n\nUsage:\n  cookiemunch config pull  --site <cbid> [--out <file>]\n      Write the site's config as JSON (to stdout, or to <file>).\n  cookiemunch config diff  --site <cbid> <file> [--replace] [--exit-code]\n      Show what pushing <file> would change (the server's dry run; nothing is stored).\n      Read-only fields a pulled file carries (effective, designWarnings, ...) are ignored.\n  cookiemunch config push  --site <cbid> <file> [--replace] [--strict]\n      Apply <file>. Default: merged over the stored config (PATCH) \u2014 fields the file\n      leaves out keep their value, and a field set to null is removed (it takes its\n      default). --replace sends it whole (PUT): a top-level field the file leaves out\n      reverts to its default. Prints any design warnings the server found. --strict\n      checks the file first and does not push it (exit 1) when Accept all is pushed\n      harder than Reject all anywhere \u2014 for CI.\n  cookiemunch config validate --site <cbid> <file> [--replace] [--strict]\n      Check <file> for consent-button parity on the server, without writing: is Accept\n      all more prominent than Reject all (colour, size, placement, copy, custom CSS)?\n      Merged over the stored config like push; --replace checks it as sent. --strict\n      exits 1 when there is any warning (notices never fail).\n  cookiemunch preview --site <cbid> [--url <page>] [--region <eu|de|us-ca\u2026>] [--lang <de\u2026>]\n                      [--ttl <seconds>] [--open]\n      Print (and with --open, open) a link showing the banner as a visitor in that\n      region and language sees it. Works in headless browsers; nothing is recorded.\n  cookiemunch executors test <id> (--email <email> | --canary) [--operation <locate|export|erase>]\n      Try a connected system against one person without filing a request.\n      --operation defaults to locate (lookup is accepted as another name for it).\n      --canary uses the organisation's canary address instead: no real person, and\n      a canary locate also updates the connection's health. Exits 1 when not ok.\n  cookiemunch executors webhook-test <id> --headers-file <json> --body-file <file>\n      Would this webhook delivery verify? Sends the headers (a JSON object) and the\n      body file byte for byte to the receiver's check; nothing is acted on. Prints\n      { verified, stage, reason } and exits 1 when it does not verify.\n  cookiemunch executors deliveries <id>\n      The last 50 deliveries to that connection's webhook, each with its reason.\n  cookiemunch executors presets\n      The versioned presets, which are usable now and which wait on another\n      platform, and the organisation's canary address.\n  cookiemunch executors conformance <baseUrl> --secret-env <NAME> [--canary-email <addr>]\n                      [--prefix /privacy] [--json]\n      Check any system against the open cm-standard-v2 executor contract, rule by\n      rule, using only the canary subject. The credential is read from the\n      environment variable NAME, never from the command line. Without\n      --canary-email the organisation's canary address is fetched (needs\n      COOKIEMUNCH_API_KEY); with it, no Cookie Munch key is needed at all.\n      Exits 1 when any rule fails.\n  cookiemunch executors conformance --connection <id> [--json]\n      The same suite, run by Cookie Munch against a connected system.\n  cookiemunch executors roll-completion-secret <id>\n      A new completion secret for that connection, printed once; the old one keeps\n      verifying for 24 hours.\n  cookiemunch executors upgrade-preset <id> [--preset <name>] [--version <n>]\n                      [--org-id <id>] [--atlas-id-app-id <id>] [--revoke-atlas-id-grant]\n                      [--accept-preset <path> \u2026] [--dry-run]\n      Rebuild a connection from its preset's latest version (or --version), keeping\n      its id and credentials; --preset adopts one on a hand-written connection.\n      Your hand edits are kept (the diff marks them kept or conflict); --accept-preset\n      (repeatable) takes the preset's value for that path. Prints the diff; --dry-run\n      changes nothing. A pinned connection is refused.\n  cookiemunch executors recheck <id>\n      Re-check a connection now (a canary test that records its health): the hook to\n      run after deploying that system's rights API. Exits 1 when it is not ok.\n  cookiemunch executors health <id> [--limit <n>]\n      The connection's last health checks, newest first (up to 50).\n  cookiemunch rights-page pull    --site <cbid> [--out <file>]\n      Write the site's rights page draft as JSON, and print its updatedAt for --base.\n  cookiemunch rights-page diff    --site <cbid> <file> [--exit-code]\n      Validate <file> on the server (dry run) and show what pushing it would change.\n  cookiemunch rights-page push    --site <cbid> <file> [--base <updatedAt>]\n      Replace the draft with <file>. Nothing is live until publish. Refused (exit 1)\n      if the draft changed since the diff, or since --base (the updatedAt pull printed).\n  cookiemunch rights-page publish --site <cbid> [--yes] [--base <updatedAt>]\n      Publish the draft (it goes live at once). Asks first; --yes skips the question\n      and is required when there is no terminal to ask in. Prints why when the page\n      cannot go live. Refused (exit 1) if the draft changed after it was read (or\n      since --base); --yes never overrides that.\n\n  cookiemunch scan --site <cbid> [--wait] [--timeout <seconds>]\n      Start a cookie crawl of the site and print its state (JSON). --wait holds on\n      until it is done or failed (default up to 120 s, --timeout to change) and exits\n      1 when it failed or is still running at the end. A scan already running is\n      waited on rather than started twice.\n\n  cookiemunch cookies presets --site <cbid>\n      The declaration presets (atlas, forumulate, chatly, cookiemunch, referalli, firstpromoter,\n      partnerstack, tapfiliate, impact; referally is the deprecated old name of referalli): what each takes,\n      what it declared on this site, and whether the vendor's own manifest exists yet.\n  cookiemunch cookies preset <vendor> --site <cbid> [--param k=v \u2026] [--dry-run]\n      Declare what that platform writes (cookies and browser storage), marked as\n      declared by it; run again to re-sync. Atlas: --param frontendApiHost=auth.example.com\n      [--param crossSubdomainCookies=false]. Chatly: --param publicId=ch_web_\u2026 .\n      Referral and affiliate presets (referalli, firstpromoter, partnerstack, tapfiliate, impact):\n      [--param cookieDomain=.example.com] [--param cookieDays=60] [--param category=\u2026];\n      referalli [--param legacyName=false], impact [--param campaignId=\u2026]. A row filed under a\n      disabled category prints a warning and a suggestedConfigPatch. Any other vendor is\n      declared with the API (PUT /v1/sites/{cbid}/cookies).\n  cookiemunch cookies unpreset <vendor> --site <cbid> [--dry-run]\n      Remove every declaration that vendor's preset made.\n  cookiemunch cookies import-manifest <url> --site <cbid> [--file <manifest.json>] [--dry-run]\n      Declare any vendor's cookies and storage from its embed manifest\n      (/.well-known/forgedeck-embed.json), by URL or from a file. Remove it with\n      cookies unpreset <product>.\n  cookiemunch cookies suggestions --site <cbid>\n      What to declare: the platforms detected on the site and each undeclared row.\n  cookiemunch cookies declare-suggestions --site <cbid> [--names a,b] [--dry-run]\n      Declare them: detected vendors' presets, then every other suggestion with a purpose.\n  cookiemunch cookies delete-observed <name> --site <cbid> [--dry-run]\n      Remove every stored row of that name (a name the site never sets). A declaration stays.\n  cookiemunch cookies purge-observed --site <cbid> --since <time> [--until <time>] [--dry-run]\n      Remove every row a real visit first reported in that window (ISO-8601 or epoch ms).\n      Crawled rows and declarations stay. Run with --dry-run first.\n  cookiemunch site update --site <cbid> [--domain <host>] [--name <name> | --clear-name]\n                          [--aliases <a,b>] [--dry-run]\n      Rename or move a site. The cbid and consent ledger stay; a domain move clears\n      verification. --dry-run prints the diff and its effects without saving.\n  cookiemunch site brand --site <cbid> [--url <https URL> | <brand.json>] [--dry-run]\n      Import a brand.json into the banner theme (the rights page uses it too). Values the\n      site set itself are kept. With neither --url nor a file, prints the last import.\n  cookiemunch consent-sync status --site <cbid>\n      Whether hosted consent sync is set up (the secret's last four characters, when it was minted).\n  cookiemunch consent-sync rotate --site <cbid>\n      Mint the site's consent-sync signing secret, or replace it (the old one stops at once).\n      Prints the secret alone on stdout, so it can be piped into your secret store: it is shown once.\n  cookiemunch consent-sync remove --site <cbid> --yes\n      Remove it: hosted consent sync stops for every visitor.\n  cookiemunch consent-sync token --site <cbid> --subject <id> [--ttl <seconds>]\n      Sign a test token locally with COOKIEMUNCH_CONSENT_SYNC_SECRET (nothing is sent), e.g. to try\n      GET /api/v1/<cbid>/profile with curl.\n  cookiemunch health [--site <cbid>] [--json] [--fail-on error|warning|never]\n      Every link the site's privacy wiring depends on, with a fix hint for each that\n      fails. Exits 1 when a check fails (checks that could not run, or are waived, do not count).\n      --fail-on error ignores warnings; --fail-on never always exits 0.\n  cookiemunch provision <file> [--dry-run]\n      Wire a product's privacy in one call (site, connections, Atlas, Forumulate) from\n      a JSON file without secrets: the Atlas key and Forumulate token come from\n      COOKIEMUNCH_ATLAS_SECRET_KEY and COOKIEMUNCH_FORUMULATE_TOKEN. Re-running is a\n      no-op. Exits 1 when a step failed.\n  cookiemunch keys report [--unused-days <n>] [--expiring-days <n>] [--json]\n      Key hygiene: keys unused for n days (default 90), keys with broad access, and\n      keys expiring within n days (default 14). Needs a full-access key.\n  cookiemunch partners list|link|unlink --site <cbid> [--partner <id>]\n                       [--external-id <id>] [--label <text>] [<linkId>]\n      Grant a partner platform the site's consent events (no secret is created), list\n      the grants, or revoke one. Any partner this deployment knows (forumulate, atlas, chatly,\n      referalli, or one registered for it).\n  cookiemunch token exchange --subject-token-env NAME --scope <a,b> --resource org:<id>|site:<cbid> [--expires-in <s>]\n      Swap your identity provider's token (read from the variable NAME) for a short-lived, scoped\n      API key (at most 1 hour); prints the key alone. Needs no API key.\n  cookiemunch csp --merge <vendors|urls> [--framework next|express|nginx] [--site <cbid>]\n      One Content-Security-Policy from several products' embed manifests\n      (/.well-known/forgedeck-embed.json): cookiemunch, atlas, chatly, forumulate,\n      referalli, or any manifest URL. --framework prints it for next.config.js,\n      Express or nginx; without it, the header value. --site uses your site's own\n      Cookie Munch manifest (its logo, fonts, sync endpoint). Needs no API key. Exits 1\n      when a named product has not published a manifest (the rest are still merged).\n  cookiemunch cookies diff|push <file> --site <cbid> [--replace] [--exit-code]\n      Declarations as a file ({\"cookies\": [...]}), through the server's dry run. push applies\n      only when something differs; --replace also removes declarations the file leaves out.\n  cookiemunch executors pull [<file>] | diff <file> | push <file> [--secret-env NAME]\n      Connected systems as a file. The file never carries a secret: a new connection's API key\n      comes from the environment variable --secret-env names.\n  cookiemunch dsar test [--types access,deletion] [--with-cbid --site <cbid>] [--without-cbid]\n                        [--email <addr>] [--cleanup]\n      File TEST rights requests and read each back. --cleanup deletes exactly the ones this run\n      filed (by id; it never deletes by listing).\n  cookiemunch doctor [--site <cbid>] [--org <id>]\n      The key (and whose org it is, against --org or COOKIEMUNCH_ORG), its expiry, the CLI\n      version against the latest, and integration health. Exits 1 when a check fails.\n  cookiemunch keys vend --scopes <a,b> --ttl <1h|30m|seconds> [--cbids <x,y>] [--name <n>]\n      A short-lived key (at most 12 h) within this key's own scopes; prints the key alone.\n      Needs keys:write (or a full-access key).\n  cookiemunch keys self | rotate-self\n      This key's own prefix, scopes and expiry; or rotate it (the new key is printed once).\n  cookiemunch sandbox [show] | create [--key-name <n>] | delete [--yes]\n      The organisation's sandbox: a separate test organisation with the same people and plan\n      features, never billed; its keys are test keys and its rights requests are all tests.\n      create makes it (or reuses it) and prints a new key for it alone; delete erases it and\n      everything in it, after asking. create and delete need a full-access key or orgs:create.\n  cookiemunch plan [cookiemunch.json] [--exit-code] [--json]\n  cookiemunch apply [cookiemunch.json] [--secret-env NAME] [--secrets-out <file>]\n      One file for a site: {site, config, cookies, presets, executors, webhooks, rightsPage,\n      partners}, no secrets. plan prints the server's dry run of every part (\"No changes\" when\n      it matches); apply applies them in dependency order and logs each. New webhook secrets\n      go to --secrets-out (mode 0600).\n  cookiemunch --version | version [--json]\n      The CLI version; --json adds the API version the server documents.\n\nEvery command takes --json for machine-readable output.\n\nExit codes:\n  0  ok, or nothing to change\n  1  a difference (with --exit-code), a failure, or a failed check\n  2  a usage mistake\n\nEnvironment:\n  COOKIEMUNCH_API_KEY   an API key (cookiemunch_live_\u2026, or a legacy fck_\u2026). Required.\n  COOKIEMUNCH_BASE_URL  the API origin. Default https://api.cookiemunch.net.\n  COOKIEMUNCH_SITE      default for --site.\n  COOKIEMUNCH_STRICT_FIELDS=1  send Prefer: strict-unknown-fields on writes: a field the\n                        API does not know is refused (400 unknown_field), not ignored.\n  COOKIEMUNCH_SECRET_RECIPIENT=x25519:<base64>  answers carry once-shown secrets sealed to\n                        this key (sealed_secret), never in plaintext.\n  COOKIEMUNCH_ORG       the org id doctor checks the key against.\n  --idempotency-key <k> send Idempotency-Key on writes: a retry replays the first answer.\n";
-interface Parsed {
-    positional: string[];
-    flags: Record<string, string | true>;
-}
-declare function parseArgs(argv: string[]): Parsed;
-/** Run the CLI. Returns the process exit code: 0 ok, 1 failed, 2 usage. */
-declare function run(argv: string[], io: CliIo): Promise<number>;
-
-/**
- * What a config push would change, computed on this side of the wire.
- *
- * `mergeLikeServer` mirrors the server's `PATCH /v1/sites/{cbid}/config` semantics exactly
- * (JSON Merge Patch, RFC 7386 — packages/server/src/site-config-write.ts mergePatch): the
- * patch wins, nested plain objects merge, arrays and primitives replace wholesale, and a
- * `null` removes the key. A diff computed against any other merge would describe a change
- * the server is not going to make.
- */
-type Json = null | boolean | number | string | Json[] | {
-    [k: string]: Json;
-};
-interface Change {
-    /** Dotted path; array indices in brackets: `banner.content.title`, `geoRules[0].mode`. */
-    path: string;
-    kind: 'added' | 'removed' | 'changed';
-    from?: Json;
-    to?: Json;
-}
-declare function mergeLikeServer(base: Record<string, unknown>, patch: Record<string, unknown>): Record<string, unknown>;
-/** Every leaf that differs between `before` and `after`, in a stable order. */
-declare function diffJson(before: unknown, after: unknown, path?: string): Change[];
-/** A unified-diff-ish rendering: one line per change. */
-declare function formatChanges(changes: Change[]): string;
-
-/**
- * `cookiemunch rights-page pull|diff|push|publish` — the hosted rights page as code.
- *
- * Unlike `config diff`, `diff` asks the server: the rights page has a real dry run, so the
- * diff is against what the server would store (normalised and sanitised), and an invalid
- * file fails with the server's issues before anything is written.
- */
-
-interface Helpers {
-    requireSite(): string;
-    readJson(path: string | undefined): Promise<Record<string, unknown>>;
-    usage(msg: string): Error;
-}
-declare function rightsPageCommand(sub: string | undefined, p: {
-    positional: string[];
-    flags: Record<string, string | true>;
-}, io: CliIo, client: CookieMunchClient, h: Helpers): Promise<number>;
-
-/**
- * `cookiemunch csp --merge <vendors|urls> [--framework next|express|nginx] [--site <cbid>]`
- *
- * One Content-Security-Policy from several products' embed manifests
- * (`/.well-known/forgedeck-embed.json`, schema https://cookiemunch.net/schemas/embed-v1.json):
- * each manifest lists its origins by directive (`csp`) and the non-origin sources it needs
- * (`requires`); the policy is their union, plus `'self'`.
- *
- * Vendor-neutral: `--merge` takes any manifest URL. The names below are first-class shortcuts
- * for products whose manifest host is known — the same host map the API's importer uses
- * (packages/server/src/manifest-importer.ts; a test keeps the two equal). A product that has not
- * published its manifest yet is reported, and the policy is built from the rest.
- *
- * Needs no API key: every manifest is public, `--site` included (`GET /v1/embed?cbid=`).
- */
-/** Where a known product publishes its manifest: the apex first, then its API host. */
-declare const KNOWN_MANIFEST_HOSTS: Readonly<Record<string, readonly string[]>>;
-declare const CSP_FRAMEWORKS: readonly ["next", "express", "nginx"];
-type CspFramework = (typeof CSP_FRAMEWORKS)[number];
-type Surface = {
-    csp?: Record<string, unknown>;
-    requires?: Record<string, unknown>;
-};
-type Manifest = {
-    product?: unknown;
-    surfaces?: Record<string, Surface>;
-};
-interface ManifestSource {
-    /** What the user named: a vendor or a URL. */
-    label: string;
-    /** URLs to try, in order. */
-    urls: string[];
-    product?: string;
-}
-/** `atlas,chatly,https://x/.well-known/forgedeck-embed.json` → sources to fetch. */
-declare function manifestSources(list: string, opts: {
-    site?: string;
-    apiBase: string;
-}): {
-    sources: ManifestSource[];
-    unknown: string[];
-};
-/** The union of every surface's origins and requirements, by directive; `'self'` first. */
-declare function mergeManifests(manifests: Manifest[]): Map<string, string[]>;
-declare function policyString(policy: Map<string, string[]>): string;
-/** The policy as the framework writes it. */
-declare function renderPolicy(policy: Map<string, string[]>, framework?: CspFramework): string;
-interface CspIo {
-    fetch: typeof fetch;
-    stdout: (text: string) => void;
-    stderr: (text: string) => void;
-}
-declare function cspCommand(opts: {
-    merge?: string;
-    framework?: string;
-    site?: string;
-    apiBase: string;
-}, io: CspIo, usage: (message: string) => Error): Promise<number>;
-
-export { CSP_FRAMEWORKS, type Change, type CliIo, type CspFramework, DEFAULT_BASE_URL, KNOWN_MANIFEST_HOSTS, USAGE, cspCommand, diffJson, formatChanges, manifestSources, mergeLikeServer, mergeManifests, parseArgs, policyString, renderPolicy, rightsPageCommand, run };
+export { run, parseArgs, USAGE, DEFAULT_BASE_URL, type CliIo } from './cli.js';
+export { diffJson, formatChanges, mergeLikeServer, type Change } from './diff.js';
+export { rightsPageCommand } from './rights-page.js';
+export { cspCommand, mergeManifests, renderPolicy, policyString, manifestSources, KNOWN_MANIFEST_HOSTS, CSP_FRAMEWORKS, type CspFramework } from './csp.js';

package/dist/index.js

@@ -14,7 +14,7 @@ import {
   renderPolicy,
   rightsPageCommand,
   run
-} from "./chunk-HTHRKPXA.js";
+} from "./chunk-6KXGHY4M.js";
 export {
   CSP_FRAMEWORKS,
   DEFAULT_BASE_URL,

package/dist/integrations.d.ts

@@ -0,0 +1,27 @@
+/**
+ * `cookiemunch site update`, `cookiemunch health`, `cookiemunch provision` and `cookiemunch partners`.
+ *
+ * Provisioning secrets are read from the environment (COOKIEMUNCH_ATLAS_SECRET_KEY,
+ * COOKIEMUNCH_FORUMULATE_TOKEN), never from the command line where they would land in shell history,
+ * and are never printed.
+ */
+import type { CookieMunchClient } from '@cookiemunch/sdk';
+import type { CliIo } from './cli.js';
+interface Helpers {
+    requireSite(): string;
+    site(): string | undefined;
+    readJson(path: string | undefined): Promise<Record<string, unknown>>;
+    usage(msg: string): Error;
+    flag(name: string): string | true | undefined;
+}
+/** `cookiemunch site update --site <cbid> [--domain d] [--name n | --clear-name] [--aliases a,b] [--dry-run]` */
+export declare function siteCommand(sub: string | undefined, io: CliIo, client: CookieMunchClient, h: Helpers, file?: string): Promise<number>;
+/** `cookiemunch health [--site <cbid>]` — exits 1 when a check fails, so CI can gate on it. */
+export declare function healthCommand(io: CliIo, client: CookieMunchClient, h: Helpers): Promise<number>;
+/** `cookiemunch provision <file> [--dry-run]` — the file has no secrets; the environment supplies them. */
+export declare function provisionCommand(file: string | undefined, io: CliIo, client: CookieMunchClient, h: Helpers): Promise<number>;
+/** `cookiemunch partners list|link|unlink --site <cbid> …` */
+export declare function partnersCommand(sub: string | undefined, rest: string[], io: CliIo, client: CookieMunchClient, h: Helpers): Promise<number>;
+/** `cookiemunch keys report [--unused-days n] [--expiring-days n] [--json]` */
+export declare function keysCommand(sub: string | undefined, io: CliIo, client: CookieMunchClient, h: Helpers): Promise<number>;
+export {};

package/dist/ops.d.ts

@@ -0,0 +1,48 @@
+/**
+ * CLI completeness (CMU-B15, D11, D12, S02):
+ *
+ *   cookiemunch --version | version [--json]
+ *   cookiemunch cookies diff|push <file> --site <cbid> [--replace]      declarations as a file, through the server's dry run
+ *   cookiemunch executors pull|diff|push <file> [--secret-env NAME]     connected systems as a file, never carrying a secret
+ *   cookiemunch dsar test --types access,deletion [--with-cbid] [--without-cbid] [--cleanup]
+ *   cookiemunch doctor [--site <cbid>] [--org <id>]
+ *   cookiemunch keys vend --scopes a,b --ttl 1h [--cbids x,y] [--name n]
+ *   cookiemunch keys self | rotate-self
+ *   cookiemunch sandbox [show] | create [--key-name n] | delete [--yes]
+ *   cookiemunch plan|apply <cookiemunch.json>
+ *
+ * Exit codes everywhere: 0 ok (or no changes), 1 a difference, a failure or a failed check, 2 a usage mistake.
+ */
+import type { CookieMunchClient } from '@cookiemunch/sdk';
+import type { CliIo } from './cli.js';
+export interface OpsHelpers {
+    requireSite(): string;
+    site(): string | undefined;
+    readJson(path: string | undefined): Promise<Record<string, unknown>>;
+    usage(msg: string): Error;
+    flag(name: string): string | true | undefined;
+    positional: string[];
+}
+/** `version [--json]`: the CLI's version, and with --json the API version the server documents. */
+export declare function versionCommand(io: CliIo, cliVersion: string, base: string, asJson: boolean): Promise<number>;
+export declare function cookiesFileCommand(sub: 'diff' | 'push', io: CliIo, client: CookieMunchClient, h: OpsHelpers): Promise<number>;
+export declare function executorsFileCommand(sub: 'pull' | 'diff' | 'push', io: CliIo, client: CookieMunchClient, h: OpsHelpers): Promise<number>;
+/**
+ * File test rights requests (guide step 16), read each back, and with --cleanup delete EXACTLY the ids this
+ * run created: never a list-and-delete, which once removed live rows (memory never-clean-up-by-listing).
+ */
+export declare function dsarTestCommand(io: CliIo, client: CookieMunchClient, h: OpsHelpers): Promise<number>;
+export declare function doctorCommand(io: CliIo, client: CookieMunchClient, h: OpsHelpers, cliVersion: string): Promise<number>;
+/** `1h`, `30m`, `90s`, `3600` → seconds. */
+export declare function parseTtl(v: string): number | null;
+export declare function keysExtraCommand(sub: string, io: CliIo, client: CookieMunchClient, h: OpsHelpers): Promise<number>;
+/** `sandbox [show]`, `sandbox create [--key-name n]` (prints the test key alone), `sandbox delete [--yes]`. */
+export declare function sandboxCommand(sub: string | undefined, io: CliIo, client: CookieMunchClient, h: OpsHelpers): Promise<number>;
+/**
+ * One file for everything a site's privacy setup is (CMU-D12). `plan` asks the server's dry run of every part
+ * and prints one combined diff; `apply` applies the parts in dependency order (site → config → cookies →
+ * presets → rights page → executors → webhooks → partners), reads each back, and logs when.
+ * No secret ever goes in the file: an executor's key comes from --secret-env, a new webhook's secret is
+ * written to --secrets-out (0600) or the webhook is not created.
+ */
+export declare function bundleCommand(sub: 'plan' | 'apply', io: CliIo, client: CookieMunchClient, h: OpsHelpers): Promise<number>;

package/dist/rights-page.d.ts

@@ -0,0 +1,19 @@
+/**
+ * `cookiemunch rights-page pull|diff|push|publish` — the hosted rights page as code.
+ *
+ * Unlike `config diff`, `diff` asks the server: the rights page has a real dry run, so the
+ * diff is against what the server would store (normalised and sanitised), and an invalid
+ * file fails with the server's issues before anything is written.
+ */
+import { type CookieMunchClient } from '@cookiemunch/sdk';
+import type { CliIo } from './cli.js';
+interface Helpers {
+    requireSite(): string;
+    readJson(path: string | undefined): Promise<Record<string, unknown>>;
+    usage(msg: string): Error;
+}
+export declare function rightsPageCommand(sub: string | undefined, p: {
+    positional: string[];
+    flags: Record<string, string | true>;
+}, io: CliIo, client: CookieMunchClient, h: Helpers): Promise<number>;
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cookiemunch/cli",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "cookiemunch — config as code, banner previews and connection tests from a terminal or CI, over the Cookie Munch Developer API",
   "license": "MIT",
   "type": "module",
@@ -31,11 +31,11 @@
     "access": "public"
   },
   "scripts": {
-    "build": "tsup",
+    "build": "tsup && tsc -p tsconfig.json --emitDeclarationOnly --declaration",
     "test": "vitest run"
   },
   "dependencies": {
-    "@cookiemunch/sdk": "^0.7.0"
+    "@cookiemunch/sdk": "^0.8.0"
   },
   "homepage": "https://cookiemunch.net/docs",
   "bugs": {