@cookiemunch/mcp 0.1.0 → 0.2.0

package/dist/{chunk-G5TN4KJA.js → chunk-PLBLLTYO.js}

@@ -3,7 +3,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { createCookieMunch } from "@cookiemunch/sdk";
 
 // src/tools.ts
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 
 // src/tools-config.ts
 import { z } from "zod";
@@ -543,9 +543,29 @@ function registerPlatformTools(tool, client) {
       secretKey: z2.string().describe("Its API key, with whatever scope that system needs to export and erase a user."),
       webhookSecret: z2.string().optional().describe("Signing secret of its webhook endpoint. Optional: polling closes tasks without it."),
       auto: z2.boolean().optional().describe("Open a sub-task automatically when a request reaches fulfilment. Default true."),
-      profile: z2.record(z2.unknown()).describe("How to drive that system: { open, poll, statuses } required, plus optional subjectLookup, auth, idempotencyHeader and webhook. See the connected-systems docs for the shape.")
+      profile: z2.record(z2.unknown()).describe("How to drive that system: { open, poll, statuses } required, plus optional subjectLookup, auth, idempotencyHeader and webhook. See the connected-systems docs for the shape."),
+      dryRun: z2.boolean().optional().describe("Validate everything and answer the connection that would be created, storing nothing.")
     },
-    (a) => client.fulfillment.connectExecutor(a)
+    (a) => {
+      const { dryRun, ...input } = a;
+      return dryRun === true ? client.fulfillment.dryRunConnectExecutor(input) : client.fulfillment.connectExecutor(input);
+    }
+  );
+  tool(
+    "test_dsar_executor_webhook",
+    "Would this webhook delivery from a connected system verify? Runs the receiver's exact check (headers, timestamp tolerance, prefix, HMAC) on headers and a raw body you supply, acts on nothing, and returns { verified, stage, reason } naming the stage that failed. `body` must be the raw request body string, byte for byte. Read-only.",
+    {
+      id: z2.string().describe("The connection id."),
+      headers: z2.record(z2.string()).describe("The delivery headers, e.g. its id, timestamp and signature headers."),
+      body: z2.string().describe("The raw body exactly as it was signed.")
+    },
+    (a) => client.fulfillment.testExecutorWebhook(a.id, { headers: a.headers, body: a.body })
+  );
+  tool(
+    "list_dsar_executor_webhook_deliveries",
+    "The last 50 deliveries to a connected system's webhook, newest first, each with whether it verified and, if not, the stage and reason. Never includes the secret, the signature or the body (only a short hash and size). Read-only.",
+    { id: z2.string().describe("The connection id.") },
+    (a) => client.fulfillment.executorWebhookDeliveries(a.id)
   );
   tool(
     "disconnect_dsar_executor",
@@ -658,10 +678,176 @@ function registerPlatformTools(tool, client) {
   );
 }
 
+// src/tools-rights-page.ts
+import { z as z3 } from "zod";
+function registerRightsTools(tool, client) {
+  const cbid = { cbid: z3.string().describe("Site identifier (cbid). Must belong to your org.") };
+  const base = {
+    baseUpdatedAt: z3.union([z3.number().int(), z3.string(), z3.null()]).optional().describe("The draft\u2019s updatedAt from your last read (null if it had none). If someone saved since, the write is refused with 409 draft_conflict and the current draft; omit to overwrite regardless.")
+  };
+  const baseOpt = (a) => a.baseUpdatedAt !== void 0 ? { baseUpdatedAt: a.baseUpdatedAt } : {};
+  tool("get_rights_page", "Read the site\u2019s rights page DRAFT (the default page until first saved), with warnings that would block publishing.", cbid, (a) => client.rightsPage.get(a.cbid));
+  tool(
+    "update_rights_page",
+    "Replace the rights page draft with a full document (theme, sections, form, i18n, seo, customCss). Nothing goes live until publish_rights_page. Prefer patch_rights_page for small changes and preview_rights_page when unsure. Pass baseUpdatedAt (from get_rights_page) to avoid overwriting someone else\u2019s save: a mismatch is 409 draft_conflict with the current draft.",
+    { ...cbid, page: z3.record(z3.unknown()).describe("The whole RightsPage document (v: 1)."), ...base },
+    (a) => client.rightsPage.put(a.cbid, a.page, baseOpt(a))
+  );
+  tool(
+    "patch_rights_page",
+    "Change part of the rights page draft: objects merge, arrays (sections, request types, fields) replace whole, null removes a field. baseUpdatedAt works as on update_rights_page (409 draft_conflict).",
+    { ...cbid, patch: z3.record(z3.unknown()), ...base },
+    (a) => client.rightsPage.patch(a.cbid, a.patch, baseOpt(a))
+  );
+  tool(
+    "preview_rights_page",
+    'Validate a rights-page write WITHOUT saving: returns the document as it would be stored and any publish warnings. mode "patch" (default) or "put".',
+    { ...cbid, page: z3.record(z3.unknown()), mode: z3.enum(["patch", "put"]).optional() },
+    (a) => client.rightsPage.dryRun(a.cbid, a.page, { mode: a.mode ?? "patch" })
+  );
+  tool("get_published_rights_page", "Read the LIVE rights page document (404 not_published while the site shows the default page).", cbid, (a) => client.rightsPage.getPublished(a.cbid));
+  tool(
+    "publish_rights_page",
+    "Publish the draft as the next version: it goes live at once, to every visitor. Refused unless the page has exactly one form section and an enabled request type. Pass baseUpdatedAt (from get_rights_page) so only the draft you read goes live; without it, whatever the draft holds now is published, including someone else\u2019s later edits. A mismatch is 409 draft_conflict with the current draft.",
+    { ...cbid, ...base },
+    (a) => client.rightsPage.publish(a.cbid, baseOpt(a))
+  );
+  tool("list_rights_page_versions", "Published versions of the rights page, newest first, each with publishedBy, publishedByEmail (null for an API key) and publishedVia.", cbid, (a) => client.rightsPage.versions(a.cbid));
+  tool(
+    "rollback_rights_page",
+    "Publish an earlier version of the rights page again (as a new version): it goes live at once and REPLACES the current draft, so unpublished edits are lost and cannot be recovered (versions hold only published documents). Pass baseUpdatedAt (from get_rights_page) to refuse with 409 draft_conflict if anyone saved the draft since you read it.",
+    { ...cbid, version: z3.number().int().min(1), ...base },
+    (a) => client.rightsPage.rollback(a.cbid, a.version, baseOpt(a))
+  );
+}
+function registerRightsPageTools(tool, client) {
+  const site = z3.object({ cbid: z3.string().describe("Site identifier (cbid). Must belong to your org.") });
+  const host = site.extend({
+    hostname: z3.string().describe("The custom hostname, e.g. privacy.example.com (unicode or punycode).")
+  });
+  tool(
+    "list_rights_page_domains",
+    "List the custom hostnames serving a site's rights page, each with its status (pending_dns, verifying, issuing, active, error), the exact DNS records to create, and the plan's allowance.",
+    site.shape,
+    (a) => client.rightsPage.listDomains(site.parse(a).cbid)
+  );
+  tool(
+    "add_rights_page_domain",
+    "Add a custom hostname for a site's rights page (e.g. privacy.example.com). Returns the DNS records the owner must create: a CNAME to this domain's own <token>.cname.cookiemunch.net (a CNAME to anything else never verifies it), or for an apex / flattened / proxied record the _cookiemunch TXT. Then call verify_rights_page_domain. Plans include Free 0, Starter 1, Pro 5, Scale unlimited.",
+    host.shape,
+    (a) => {
+      const { cbid, hostname } = host.parse(a);
+      return client.rightsPage.addDomain(cbid, hostname);
+    }
+  );
+  tool(
+    "verify_rights_page_domain",
+    "Check a custom hostname now: DNS while it is pending or in error, the HTTPS answer once it is routed. Returns the domain as it now stands; lastError and dnsSeen say what is missing.",
+    host.shape,
+    (a) => {
+      const { cbid, hostname } = host.parse(a);
+      return client.rightsPage.verifyDomain(cbid, hostname);
+    }
+  );
+  tool(
+    "remove_rights_page_domain",
+    "Remove a custom hostname from a site's rights page. It stops being served at once and its certificate is no longer renewed.",
+    host.shape,
+    async (a) => {
+      const { cbid, hostname } = host.parse(a);
+      await client.rightsPage.removeDomain(cbid, hostname);
+      return { removed: hostname };
+    }
+  );
+}
+
+// src/design-warnings.ts
+function whereText(f) {
+  const w = f.where ?? {};
+  const bits = [
+    f.layer === "banner" ? "first layer" : `${f.layer} layer`,
+    w.view ? `view "${w.view}"` : "",
+    w.variant && w.variant !== "base" ? `variant ${w.variant}` : "",
+    w.theme === "dark" ? "dark theme" : "",
+    w.breakpoint === "mobile" ? "mobile" : "",
+    w.language ? `language ${w.language}` : "",
+    w.url ? w.url : ""
+  ].filter(Boolean);
+  return bits.join(", ");
+}
+function styleText(s) {
+  const parts = [
+    s.background ? `background ${s.background}` : "",
+    s.color ? `text ${s.color}` : "",
+    s.borderColor ? `border ${s.borderWidth ?? 1}px ${s.borderColor}` : "",
+    s.fontSize ? `font ${s.fontSize}px` : "",
+    s.fontWeight ? `weight ${s.fontWeight}` : "",
+    s.width && s.height ? `${Math.round(s.width)}\xD7${Math.round(s.height)}px` : ""
+  ].filter(Boolean);
+  return parts.join(", ");
+}
+var CONTEXT_TEXT = {
+  saved: "The config was saved as sent; this is a warning, not an error.",
+  preview: "Nothing was saved: this is a preview of the write.",
+  lint: "Nothing was saved: this is a lint of a proposed config.",
+  read: "This describes the config as it is stored now; nothing was changed.",
+  scan: "This was measured on the live site by the last cookie scan; fix the banner, then scan again."
+};
+function designContext(tool, value) {
+  const v = value && typeof value === "object" ? value : {};
+  if (tool === "lint_banner_config") return "lint";
+  if (v.dryRun === true || tool.startsWith("preview_")) return "preview";
+  if (v.buttonParity && typeof v.buttonParity === "object") return "scan";
+  if (/^(update|patch|set|edit|create|assign|apply)_/.test(tool)) return "saved";
+  return "read";
+}
+function designWarningText(findings, suggested, context = "read") {
+  if (!Array.isArray(findings) || findings.length === 0) return "";
+  const warnings = findings.filter((f) => f.severity === "warning");
+  const notices = findings.filter((f) => f.severity !== "warning");
+  const lines = [];
+  if (warnings.length) {
+    lines.push(
+      `Design warning: the Accept button is more prominent than Reject (${warnings.length} issue${warnings.length === 1 ? "" : "s"}). Regulators treat this as a dark pattern (EDPB Guidelines 03/2022, the EDPB cookie banner taskforce, CNIL). Make both buttons the same style. ${CONTEXT_TEXT[context]}`
+    );
+    for (const f of warnings) lines.push(`- [${f.code}] (${whereText(f)}) ${f.detail} Fix: ${f.fix}`);
+  }
+  if (notices.length) {
+    lines.push(
+      `Design notice: ${notices.length} thing${notices.length === 1 ? "" : "s"} to check about how Reject compares with Accept.` + (warnings.length ? "" : ` ${CONTEXT_TEXT[context]}`)
+    );
+    for (const f of notices) lines.push(`- [${f.code}] (${whereText(f)}) ${f.detail} Fix: ${f.fix}`);
+  }
+  const fixes = suggested && suggested.length ? suggested : findings.filter((f) => f.accept && f.reject).slice(0, 1).map((f) => ({ ...f.accept, layer: f.layer, view: f.where?.view }));
+  for (const s of fixes) {
+    const style = styleText(s);
+    if (style) {
+      lines.push(
+        `Suggested fix: style Reject all${s.view ? ` in view "${s.view}"` : ""} with ${style} \u2014 the same as Accept all. In a flow design, give the Reject button the same \`variant\` and size as the Accept button.`
+      );
+    }
+  }
+  return lines.join("\n");
+}
+function withDesignWarnings(value, body, tool = "") {
+  if (!value || typeof value !== "object") return body;
+  const nested = value.buttonParity;
+  const v = nested && typeof nested === "object" ? nested : value;
+  if (!Array.isArray(v.designWarnings) || v.designWarnings.length === 0) return body;
+  const head = designWarningText(
+    v.designWarnings,
+    Array.isArray(v.suggestedReject) ? v.suggestedReject : void 0,
+    designContext(tool, value)
+  );
+  return head ? `${head}
+
+${body}` : body;
+}
+
 // src/tools.ts
-function text(value) {
+function text(value, tool = "") {
   const body = typeof value === "string" ? value : JSON.stringify(value, null, 2);
-  return { content: [{ type: "text", text: body }] };
+  return { content: [{ type: "text", text: withDesignWarnings(value, body, tool) }] };
 }
 function fail(err) {
   const message = err instanceof Error ? err.message : String(err);
@@ -671,16 +857,16 @@ function registerTools(server, client) {
   const tool = (name, description, inputSchema, run) => {
     server.registerTool(name, { description, inputSchema }, async (args) => {
       try {
-        return text(await run(args));
+        return text(await run(args), name);
       } catch (err) {
         return fail(err);
       }
     });
   };
-  const cbid = { cbid: z3.string().describe("Site identifier (cbid). Must belong to your org.") };
+  const cbid = { cbid: z4.string().describe("Site identifier (cbid). Must belong to your org.") };
   const range = {
-    from: z3.number().optional().describe("Epoch-ms lower bound."),
-    to: z3.number().optional().describe("Epoch-ms upper bound.")
+    from: z4.number().optional().describe("Epoch-ms lower bound."),
+    to: z4.number().optional().describe("Epoch-ms upper bound.")
   };
   tool(
     "whoami",
@@ -698,19 +884,19 @@ function registerTools(server, client) {
   tool(
     "get_site",
     "One site: its domain, cbid and verification status. Read-only.",
-    { cbid: z3.string() },
+    { cbid: z4.string() },
     (a) => client.sites.get(a.cbid)
   );
   tool(
     "get_site_banner",
     "Which banner design a site uses, or bannerId null when none is assigned. Read-only.",
-    { cbid: z3.string() },
+    { cbid: z4.string() },
     (a) => client.sites.banner(a.cbid)
   );
   tool(
     "get_privacy_policy",
     "Generate the site's privacy and cookie policy as Markdown, naming the org's data controller. Needs a contact email: the one given, else the org controller's, else the owner's. Read-only \u2014 nothing is published.",
-    { cbid: z3.string(), contactEmail: z3.string().optional(), effectiveDate: z3.string().optional().describe("YYYY-MM-DD; defaults to today."), jurisdictions: z3.array(z3.string()).optional() },
+    { cbid: z4.string(), contactEmail: z4.string().optional(), effectiveDate: z4.string().optional().describe("YYYY-MM-DD; defaults to today."), jurisdictions: z4.array(z4.string()).optional() },
     (a) => client.sites.policy(a.cbid, {
       ...a.contactEmail ? { contactEmail: a.contactEmail } : {},
       ...a.effectiveDate ? { effectiveDate: a.effectiveDate } : {},
@@ -720,7 +906,7 @@ function registerTools(server, client) {
   tool(
     "set_ad_personalization",
     "Add or remove the separate 'personalised ads' choice on the site's live banner. With it on, accepting marketing no longer implies personalised ads unless `default` is true.",
-    { cbid: z3.string(), enabled: z3.boolean(), default: z3.boolean().optional(), label: z3.string().optional() },
+    { cbid: z4.string(), enabled: z4.boolean(), default: z4.boolean().optional(), label: z4.string().optional() },
     (a) => client.sites.setAdPersonalization(a.cbid, {
       enabled: a.enabled,
       ...a.default !== void 0 ? { default: a.default } : {},
@@ -731,11 +917,11 @@ function registerTools(server, client) {
     "analyze_session",
     "Analyse a captured browsing session against the consent it ran under: which trackers fired after the visitor opted out, and what personal data left the page. Read-only.",
     {
-      cbid: z3.string(),
-      har: z3.unknown().optional().describe("A HAR export of the session."),
-      requests: z3.array(z3.unknown()).optional().describe("Or the requests directly."),
-      consent: z3.record(z3.string(), z3.boolean()).optional(),
-      gpc: z3.boolean().optional()
+      cbid: z4.string(),
+      har: z4.unknown().optional().describe("A HAR export of the session."),
+      requests: z4.array(z4.unknown()).optional().describe("Or the requests directly."),
+      consent: z4.record(z4.string(), z4.boolean()).optional(),
+      gpc: z4.boolean().optional()
     },
     (a) => client.sites.analyzeSession(a.cbid, {
       ...a.har !== void 0 ? { har: a.har } : {},
@@ -747,39 +933,62 @@ function registerTools(server, client) {
   tool(
     "create_site",
     "Create a new site. The cbid is auto-generated if you omit it.",
-    { domain: z3.string().describe("The site domain, e.g. example.com."), cbid: z3.string().optional().describe("Optional explicit cbid.") },
+    { domain: z4.string().describe("The site domain, e.g. example.com."), cbid: z4.string().optional().describe("Optional explicit cbid.") },
     (a) => client.sites.create({ domain: a.domain, ...typeof a.cbid === "string" ? { cbid: a.cbid } : {} })
   );
   tool(
     "create_sites_bulk",
     "Create up to 100 sites in one call. Partial success: each item reports ok or its own error, and a bad or duplicate item fails only itself.",
     {
-      sites: z3.array(z3.object({ domain: z3.string(), cbid: z3.string().optional(), platform: z3.string().optional() })).min(1).max(100)
+      sites: z4.array(z4.object({ domain: z4.string(), cbid: z4.string().optional(), platform: z4.string().optional() })).min(1).max(100)
     },
     (a) => client.sites.createBulk(a.sites)
   );
   tool("get_site_config", "Get the banner/consent configuration for a site.", { ...cbid }, (a) => client.sites.getConfig(a.cbid));
   tool(
     "update_site_config",
-    "Replace (overwrite) the banner/consent configuration for a site via PUT. This is destructive, not a merge: any top-level SiteConfig field you omit from `config` reverts to its default rather than keeping its current value. To change one setting, use patch_site_config instead \u2014 it merges server-side. Prefer the narrower set_* tools (set_blocking, set_banner_basics, etc.) when they cover your change.",
-    { ...cbid, config: z3.record(z3.unknown()).describe("The full SiteConfig to write, not a patch. Omitted top-level fields are NOT preserved from the current config \u2014 fetch get_site_config first and merge client-side.") },
-    (a) => client.sites.putConfig(a.cbid, a.config)
+    "Replace (overwrite) the banner/consent configuration for a site via PUT. This is destructive, not a merge: any top-level SiteConfig field you omit from `config` reverts to its default rather than keeping its current value \u2014 unless keepUnspecified is true, in which case omitted top-level fields keep their stored value and only the fields you send are replaced (each whole). A top-level field sent as null reverts to its default. To change one setting, use patch_site_config instead \u2014 it merges server-side. Prefer the narrower set_* tools (set_blocking, set_banner_basics, etc.) when they cover your change.",
+    {
+      ...cbid,
+      config: z4.record(z4.unknown()).describe("The full SiteConfig to write, not a patch. Without keepUnspecified, omitted top-level fields are NOT preserved from the current config."),
+      keepUnspecified: z4.boolean().optional().describe("PUT ?keep=unspecified: keep the stored value of every top-level field `config` omits, instead of reverting it to its default.")
+    },
+    (a) => a.keepUnspecified === true ? client.sites.putConfig(a.cbid, a.config, { keep: "unspecified" }) : client.sites.putConfig(a.cbid, a.config)
   );
   tool(
     "patch_site_config",
-    "Change part of a site's banner/consent configuration. The patch is deep-merged over the stored config server-side, so any field you omit keeps its current value \u2014 this is the safe way to flip one setting, and it needs no read-modify-write. Use update_site_config only when you genuinely mean to replace the whole document.",
-    { ...cbid, config: z3.record(z3.unknown()).describe('The subset of SiteConfig to change, e.g. { "banner": { "showRightsLink": true } }. Everything else is preserved.') },
+    `Change part of a site's banner/consent configuration. The patch is a JSON Merge Patch (RFC 7386) over the stored config server-side: any field you omit keeps its current value, and a field set to null is REMOVED (it falls back to its default) \u2014 e.g. { "banner": { "i18n": { "es": null } } } drops the Spanish override. This is the safe way to flip one setting, and it needs no read-modify-write. Use update_site_config only when you genuinely mean to replace the whole document.`,
+    { ...cbid, config: z4.record(z4.unknown()).describe('The subset of SiteConfig to change, e.g. { "banner": { "showRightsLink": true } }. Everything else is preserved; null removes a field.') },
     (a) => client.sites.patchConfig(a.cbid, a.config)
   );
   tool(
     "preview_site_config",
-    'Preview a config change WITHOUT saving it: returns the config as it would be saved, a diff of every field that would change, and any warnings (plan-gated or unrecognised fields). mode "patch" (default) previews patch_site_config; mode "put" previews update_site_config, and its diff lists everything a replace would revert to its default. Use it before any write you are not sure of.',
+    'Preview a config change WITHOUT saving it: returns the config as it would be saved, a diff of every field that would change, and any warnings (plan-gated or unrecognised fields). mode "patch" (default) previews patch_site_config; mode "put" previews update_site_config, and its diff lists everything a replace would revert to its default (unless keepUnspecified is true). Use it before any write you are not sure of.',
+    {
+      ...cbid,
+      config: z4.record(z4.unknown()).describe('The patch (or, with mode "put", the full config) to preview.'),
+      mode: z4.enum(["patch", "put"]).optional().describe("patch (default) merges; put replaces."),
+      keepUnspecified: z4.boolean().optional().describe('With mode "put": preview update_site_config with keepUnspecified (omitted top-level fields keep their stored value).')
+    },
+    (a) => client.sites.dryRunConfig(a.cbid, a.config, {
+      mode: a.mode ?? "patch",
+      ...a.keepUnspecified === true ? { keep: "unspecified" } : {}
+    })
+  );
+  tool(
+    "lint_banner_config",
+    'Check a banner config for consent-button parity WITHOUT saving it: is "Accept all" more prominent than "Reject all" anywhere \u2014 a brighter or more saturated colour, a bigger or bolder button, Reject styled as a link, hidden, below the fold, set apart, missing from the first layer, or worded to guilt-trip? Regulators (EDPB, CNIL) treat that as a dark pattern. Returns findings, a 0\u2013100 score and the reject style that would match Accept. It checks exactly what the write would store: merged over the stored config as patch_site_config would, or with replace: true replaced as update_site_config would. Run it before writing any banner design.',
     {
       ...cbid,
-      config: z3.record(z3.unknown()).describe('The patch (or, with mode "put", the full config) to preview.'),
-      mode: z3.enum(["patch", "put"]).optional().describe("patch (default) merges; put replaces.")
+      config: z4.record(z4.unknown()).describe("The proposed SiteConfig (or a partial one, or a v2 flow design)."),
+      replace: z4.boolean().optional().describe("Check what update_site_config (a full replace) would store, instead of what patch_site_config (a merge) would.")
     },
-    (a) => client.sites.dryRunConfig(a.cbid, a.config, { mode: a.mode ?? "patch" })
+    async (a) => {
+      const r = await client.sites.lintConfig(a.cbid, a.config, a.replace === true ? { replace: true } : {});
+      return r.designWarnings.length === 0 ? `No design warnings: Accept all and Reject all have equal weight on every surface checked (score ${r.score}). Nothing was saved.
+
+${JSON.stringify(r, null, 2)}` : r;
+    }
   );
   tool(
     "verify_consent_log",
@@ -796,7 +1005,7 @@ function registerTools(server, client) {
   tool(
     "get_consent_log",
     "Get recent anonymised consent records for a site.",
-    { ...cbid, ...range, limit: z3.number().optional().describe("Max records to return (default 200).") },
+    { ...cbid, ...range, limit: z4.number().optional().describe("Max records to return (default 200).") },
     (a) => client.consent.log(a.cbid, {
       from: a.from,
       to: a.to,
@@ -806,49 +1015,53 @@ function registerTools(server, client) {
   tool(
     "get_subject_consent",
     "One person's consent records across every site in the org \u2014 web, mobile and desktop \u2014 by the subjectId your apps attach. Consent data: needs the consent:read scope. Read-only.",
-    { subjectId: z3.string() },
+    { subjectId: z4.string() },
     (a) => client.subjects.consent(a.subjectId)
   );
   tool("list_dsar", "List all Data Subject Access Requests for your organization.", {}, () => client.dsar.list());
   tool(
     "update_dsar_executor",
-    "Change a connected system in place \u2014 its profile, address, credential or auto flag. Only what you pass changes; the stored credential is kept unless you give a new one.",
-    { id: z3.string(), patch: z3.record(z3.unknown()) },
-    (a) => client.fulfillment.updateExecutor(a.id, a.patch)
+    "Change a connected system in place \u2014 its profile, address, credential or auto flag. Only what you pass changes; the stored credential is kept unless you give a new one. With dryRun, answers the connection as it would be and a diff, and changes nothing.",
+    {
+      id: z4.string(),
+      patch: z4.record(z4.unknown()),
+      dryRun: z4.boolean().optional().describe("Validate and diff without saving.")
+    },
+    (a) => a.dryRun === true ? client.fulfillment.dryRunUpdateExecutor(a.id, a.patch) : client.fulfillment.updateExecutor(a.id, a.patch)
   );
   tool(
     "get_dsar",
     "One rights request by id, including its status and the deadline it must be answered by.",
-    { id: z3.string() },
+    { id: z4.string() },
     (a) => client.dsar.get(a.id)
   );
   tool(
     "erase_dsar_subject",
     "For a deletion request that is past identity verification: erase the person\u2019s consent records on one site, identified by their consent stamp. Irreversible. The erasure is noted on the request. If the response carries a warning, nothing was cryptographically erased \u2014 tell the user.",
-    { id: z3.string(), cbid: z3.string(), stamp: z3.string() },
+    { id: z4.string(), cbid: z4.string(), stamp: z4.string() },
     (a) => client.dsar.erase(a.id, a.cbid, a.stamp)
   );
   tool(
     "export_dsar_subject",
     "For an access or portability request that is past identity verification: the person\u2019s consent records on one site, identified by their consent stamp. The export is noted on the request.",
-    { id: z3.string(), cbid: z3.string(), stamp: z3.string() },
+    { id: z4.string(), cbid: z4.string(), stamp: z4.string() },
     (a) => client.dsar.export(a.id, a.cbid, a.stamp)
   );
   tool(
     "get_dsar_response_notice",
     "The subject-facing response notice for a request, as plain text \u2014 what to send the person. Read-only; nothing is sent.",
-    { id: z3.string() },
+    { id: z4.string() },
     (a) => client.dsar.response(a.id)
   );
   tool(
     "create_dsar",
     "Open a new Data Subject Access Request.",
     {
-      type: z3.enum(["access", "deletion", "rectification", "portability", "opt-out"]).describe("DSAR right being exercised."),
-      subjectEmail: z3.string().describe("The data subject\u2019s email."),
-      regulation: z3.enum(["gdpr", "ccpa"]).describe("Governing regulation."),
-      note: z3.string().optional().describe("Optional free-text note."),
-      test: z3.boolean().optional().describe("Mark it as a test request: kept off the SLA board and deletable afterwards with delete_test_dsar.")
+      type: z4.enum(["access", "deletion", "rectification", "portability", "opt-out"]).describe("DSAR right being exercised."),
+      subjectEmail: z4.string().describe("The data subject\u2019s email."),
+      regulation: z4.enum(["gdpr", "ccpa"]).describe("Governing regulation."),
+      note: z4.string().optional().describe("Optional free-text note."),
+      test: z4.boolean().optional().describe("Mark it as a test request: kept off the SLA board and deletable afterwards with delete_test_dsar.")
     },
     (a) => client.dsar.create({
       type: a.type,
@@ -858,21 +1071,43 @@ function registerTools(server, client) {
       ...a.test === true ? { test: true } : {}
     })
   );
+  tool(
+    "create_rights_link",
+    "Mint a signed, single-use link to a site\u2019s hosted rights page for a person you know is signed in to that site. On the page their email is filled in and locked and the email-code step is skipped; the filed request is recorded as verified by their account. Give the link only to that person. Expires in 15 minutes by default (max 1 hour). Needs dsar:write.",
+    {
+      cbid: z4.string().describe("Site identifier (cbid). Must belong to your org."),
+      email: z4.string().describe("The signed-in person\u2019s verified email address."),
+      userId: z4.string().optional().describe("Your own account id for them; recorded on the request."),
+      rights: z4.array(z4.enum(["access", "erasure", "rectification", "portability", "restriction", "objection", "opt_out_sale", "opt_out_targeted", "limit_sensitive"])).min(1).optional().describe("Limit the link to these rights. Default: every right the page offers."),
+      ttlSeconds: z4.number().int().min(60).max(3600).optional().describe("How long the link works, in seconds (default 900).")
+    },
+    (a) => client.rightsLinks.create(a.cbid, {
+      subject: { email: a.email, ...typeof a.userId === "string" ? { userId: a.userId } : {} },
+      ...Array.isArray(a.rights) ? { rights: a.rights } : {},
+      ...typeof a.ttlSeconds === "number" ? { ttlSeconds: a.ttlSeconds } : {}
+    })
+  );
   tool(
     "delete_test_dsar",
     "Delete a TEST rights request (one created with test: true), with its tasks and their upstream log. Real requests cannot be deleted and are refused. The deletion is recorded in the audit log.",
-    { id: z3.string().describe("The test request id.") },
+    { id: z4.string().describe("The test request id.") },
     async (a) => {
       await client.dsar.delete(a.id);
       return { deleted: a.id };
     }
   );
+  tool(
+    "mark_dsar_test",
+    "Mark a CLOSED rights request (completed or rejected) as a test request, after the fact \u2014 for trial requests filed before test: true existed. An open request is refused (request_not_closed), so a live obligation can never be relabelled. Recorded in the audit log; afterwards delete_test_dsar can remove it. Returns { request, changed }.",
+    { id: z4.string().describe("The closed request id.") },
+    (a) => client.dsar.markTest(a.id)
+  );
   tool(
     "advance_dsar",
     "Advance a DSAR to a new status (received \u2192 verifying \u2192 in_progress \u2192 completed, or rejected).",
     {
-      id: z3.string().describe("The DSAR id."),
-      toStatus: z3.enum(["received", "verifying", "in_progress", "completed", "rejected"]).describe("Target status.")
+      id: z4.string().describe("The DSAR id."),
+      toStatus: z4.enum(["received", "verifying", "in_progress", "completed", "rejected"]).describe("Target status.")
     },
     (a) => client.dsar.advance(a.id, a.toStatus)
   );
@@ -885,7 +1120,7 @@ function registerTools(server, client) {
   tool(
     "get_receipt",
     "Fetch the signed consent receipt for a single consent record (by stamp).",
-    { ...cbid, stamp: z3.string().describe("The consent record stamp/id.") },
+    { ...cbid, stamp: z4.string().describe("The consent record stamp/id.") },
     (a) => client.consent.receipt(a.cbid, a.stamp)
   );
   tool("delete_site", "Delete a site (cbid) and its configuration from your org.", { ...cbid }, async (a) => {
@@ -897,13 +1132,13 @@ function registerTools(server, client) {
     "create_vendor",
     "Register a vendor (processor) and compute its risk score.",
     {
-      name: z3.string().describe("Vendor name."),
-      category: z3.string().describe("Vendor category, e.g. analytics."),
-      dataShared: z3.array(z3.string()).describe("Categories of data shared with the vendor."),
-      dpaSigned: z3.boolean().describe("Whether a Data Processing Agreement is signed."),
-      subprocessors: z3.number().describe("Number of subprocessors."),
-      certifications: z3.array(z3.string()).describe("Compliance certifications, e.g. ISO27001."),
-      region: z3.string().describe("Primary processing region, e.g. EU.")
+      name: z4.string().describe("Vendor name."),
+      category: z4.string().describe("Vendor category, e.g. analytics."),
+      dataShared: z4.array(z4.string()).describe("Categories of data shared with the vendor."),
+      dpaSigned: z4.boolean().describe("Whether a Data Processing Agreement is signed."),
+      subprocessors: z4.number().describe("Number of subprocessors."),
+      certifications: z4.array(z4.string()).describe("Compliance certifications, e.g. ISO27001."),
+      region: z4.string().describe("Primary processing region, e.g. EU.")
     },
     (a) => client.vendors.create({
       name: a.name,
@@ -921,13 +1156,13 @@ function registerTools(server, client) {
     "create_ropa",
     "Create a Record of Processing Activity (RoPA) entry.",
     {
-      name: z3.string().describe("Activity name."),
-      purpose: z3.string().describe("Purpose of processing."),
-      legalBasis: z3.enum(["consent", "contract", "legal-obligation", "vital-interests", "public-task", "legitimate-interests"]).describe("GDPR legal basis."),
-      dataCategories: z3.array(z3.string()).describe("Categories of personal data."),
-      recipients: z3.array(z3.string()).describe("Recipients of the data."),
-      retentionDays: z3.number().describe("Retention period in days."),
-      crossBorderTransfer: z3.boolean().describe("Whether data is transferred across borders.")
+      name: z4.string().describe("Activity name."),
+      purpose: z4.string().describe("Purpose of processing."),
+      legalBasis: z4.enum(["consent", "contract", "legal-obligation", "vital-interests", "public-task", "legitimate-interests"]).describe("GDPR legal basis."),
+      dataCategories: z4.array(z4.string()).describe("Categories of personal data."),
+      recipients: z4.array(z4.string()).describe("Recipients of the data."),
+      retentionDays: z4.number().describe("Retention period in days."),
+      crossBorderTransfer: z4.boolean().describe("Whether data is transferred across borders.")
     },
     (a) => client.ropa.create({
       name: a.name,
@@ -973,9 +1208,9 @@ function registerTools(server, client) {
     "create_webhook",
     "Create a webhook subscription. The response includes the signing secret (shown once).",
     {
-      url: z3.string().describe("HTTPS endpoint to deliver events to."),
-      events: z3.array(z3.string()).describe("Event names to subscribe to, e.g. consent.created."),
-      cbid: z3.string().optional().describe("Optional site cbid to scope the subscription to.")
+      url: z4.string().describe("HTTPS endpoint to deliver events to."),
+      events: z4.array(z4.string()).describe("Event names to subscribe to, e.g. consent.created."),
+      cbid: z4.string().optional().describe("Optional site cbid to scope the subscription to.")
     },
     (a) => client.webhooks.create({
       url: a.url,
@@ -986,13 +1221,13 @@ function registerTools(server, client) {
   tool(
     "roll_webhook_secret",
     "Rotate a webhook subscription\u2019s signing secret. The new secret is returned once; the receiving endpoint must be updated to verify with it.",
-    { id: z3.string() },
+    { id: z4.string() },
     (a) => client.webhooks.rollSecret(a.id)
   );
   tool(
     "test_webhook",
     "Send a signed test event to a webhook subscription now, and report what the endpoint answered.",
-    { id: z3.string() },
+    { id: z4.string() },
     (a) => client.webhooks.test(a.id)
   );
   tool(
@@ -1004,18 +1239,18 @@ function registerTools(server, client) {
   tool(
     "replay_webhook_dead_letter",
     "Deliver a dead-lettered webhook event again, to the subscription as it is now.",
-    { id: z3.string() },
+    { id: z4.string() },
     (a) => client.webhooks.replayDeadLetter(a.id)
   );
   tool(
     "update_webhook",
     "Change a webhook subscription, or pause it with active:false (delivery stops; the subscription is kept). Only the fields given change. cbid: null widens it to every property in the org.",
     {
-      id: z3.string(),
-      url: z3.string().optional(),
-      events: z3.array(z3.string()).optional(),
-      cbid: z3.string().nullable().optional(),
-      active: z3.boolean().optional()
+      id: z4.string(),
+      url: z4.string().optional(),
+      events: z4.array(z4.string()).optional(),
+      cbid: z4.string().nullable().optional(),
+      active: z4.boolean().optional()
     },
     (a) => client.webhooks.update(a.id, {
       ...a.url !== void 0 ? { url: a.url } : {},
@@ -1024,20 +1259,20 @@ function registerTools(server, client) {
       ...a.active !== void 0 ? { active: a.active } : {}
     })
   );
-  tool("delete_webhook", "Delete a webhook subscription by id.", { id: z3.string().describe("The webhook subscription id.") }, async (a) => {
+  tool("delete_webhook", "Delete a webhook subscription by id.", { id: z4.string().describe("The webhook subscription id.") }, async (a) => {
     await client.webhooks.delete(a.id);
     return { ok: true };
   });
   tool(
     "verify_site",
     "Verify that your organization controls a domain by one of three challenge methods (dns / meta / file). Required to unlock consent export and signed receipts.",
-    { ...cbid, method: z3.enum(["dns", "meta", "file"]).describe("Challenge method: dns (TXT record), meta (HTML tag), or file (/.well-known/cookiemunch-verify.txt).") },
+    { ...cbid, method: z4.enum(["dns", "meta", "file"]).describe("Challenge method: dns (TXT record), meta (HTML tag), or file (/.well-known/cookiemunch-verify.txt).") },
     (a) => client.sites.verify(a.cbid, a.method)
   );
   tool(
     "get_verification_challenge",
     "Exactly what to publish to prove control of a site\u2019s domain: the DNS TXT record, the meta tag, the file, or installing the embed. Read-only \u2014 publish one, then call verify_site.",
-    { cbid: z3.string() },
+    { cbid: z4.string() },
     (a) => client.sites.verifyChallenge(a.cbid)
   );
   tool(
@@ -1049,15 +1284,15 @@ function registerTools(server, client) {
   tool(
     "get_flow",
     "Get the v2 banner flow config for a site, including current views, categories, and any lint issues.",
-    { cbid: z3.string().describe("Site identifier (cbid).") },
+    { cbid: z4.string().describe("Site identifier (cbid).") },
     (a) => client.sites.getFlow(a.cbid)
   );
   tool(
     "edit_flow",
     "Apply a batch of structured edit operations to a site's v2 banner flow. All ops are validated server-side and the final config must be lint-clean before it is saved.",
     {
-      cbid: z3.string().describe("Site identifier (cbid)."),
-      operations: z3.array(z3.record(z3.unknown())).describe(
+      cbid: z4.string().describe("Site identifier (cbid)."),
+      operations: z4.array(z4.record(z4.unknown())).describe(
         'Ordered list of ops. Each must have an "op" field: addView | removeView | addElement | setButtonTransition | addCustomCategory.'
       )
     },
@@ -1067,19 +1302,21 @@ function registerTools(server, client) {
     "set_flow",
     "Wholesale replace a site's v2 banner flow with a complete config (e.g. from a template). Validated server-side before it is saved.",
     {
-      cbid: z3.string().describe("Site identifier (cbid)."),
-      config: z3.record(z3.unknown()).describe("A full v2 FlowConfig object ({ v:2, flow, categories, ... }).")
+      cbid: z4.string().describe("Site identifier (cbid)."),
+      config: z4.record(z4.unknown()).describe("A full v2 FlowConfig object ({ v:2, flow, categories, ... }).")
     },
     (a) => client.sites.setFlow(a.cbid, a.config)
   );
   registerConfigTools(tool, client);
   registerPlatformTools(tool, client);
+  registerRightsTools(tool, client);
+  registerRightsPageTools(tool, client);
   tool(
     "invite_member",
     "Invite a person to your organization by email. role must be admin, member, or viewer. The org is derived from the API key \u2014 you cannot invite into a different org.",
     {
-      email: z3.string().describe("Email address of the person to invite."),
-      role: z3.enum(["admin", "member", "viewer"]).describe("Role to assign: admin, member, or viewer. owner is not assignable via API key.")
+      email: z4.string().describe("Email address of the person to invite."),
+      role: z4.enum(["admin", "member", "viewer"]).describe("Role to assign: admin, member, or viewer. owner is not assignable via API key.")
     },
     (a) => client.members.invite(a.email, a.role)
   );
@@ -1087,8 +1324,8 @@ function registerTools(server, client) {
     "set_member_role",
     "Change the role of a member in your organization. The org owner's role cannot be changed.",
     {
-      userId: z3.string().describe("The userId of the member whose role to change."),
-      role: z3.enum(["admin", "member", "viewer"]).describe("New role: admin, member, or viewer.")
+      userId: z4.string().describe("The userId of the member whose role to change."),
+      role: z4.enum(["admin", "member", "viewer"]).describe("New role: admin, member, or viewer.")
     },
     (a) => client.members.setRole(a.userId, a.role)
   );
@@ -1096,7 +1333,7 @@ function registerTools(server, client) {
     "remove_member",
     "Remove a member from your organization. The org owner cannot be removed.",
     {
-      userId: z3.string().describe("The userId of the member to remove.")
+      userId: z4.string().describe("The userId of the member to remove.")
     },
     async (a) => {
       await client.members.remove(a.userId);
@@ -1107,11 +1344,11 @@ function registerTools(server, client) {
     "create_brand_kit",
     "Create a reusable brand kit (colors, logo, typography) for your organization's consent banners.",
     {
-      name: z3.string().describe("Display name for the brand kit."),
-      theme: z3.record(z3.unknown()).describe("Theme tokens (colors, fonts, etc.) as a JSON object."),
-      content: z3.record(z3.unknown()).optional().describe("Optional banner copy overrides."),
-      logoUrl: z3.string().optional().describe("Optional URL for your org logo."),
-      customCss: z3.string().optional().describe("Optional custom CSS string to inject into the banner.")
+      name: z4.string().describe("Display name for the brand kit."),
+      theme: z4.record(z4.unknown()).describe("Theme tokens (colors, fonts, etc.) as a JSON object."),
+      content: z4.record(z4.unknown()).optional().describe("Optional banner copy overrides."),
+      logoUrl: z4.string().optional().describe("Optional URL for your org logo."),
+      customCss: z4.string().optional().describe("Optional custom CSS string to inject into the banner.")
     },
     (a) => client.brandKits.create({
       name: a.name,
@@ -1125,7 +1362,7 @@ function registerTools(server, client) {
     "delete_brand_kit",
     "Delete a brand kit by id. The kit must belong to your organization (cross-org deletes are rejected).",
     {
-      id: z3.string().describe("The brand kit id to delete.")
+      id: z4.string().describe("The brand kit id to delete.")
     },
     async (a) => {
       await client.brandKits.delete(a.id);
@@ -1136,25 +1373,25 @@ function registerTools(server, client) {
     "save_preference",
     "Save or update the consent preferences for an end-user (by subjectId) within your organization. purposes is a map of purpose-name \u2192 boolean.",
     {
-      subjectId: z3.string().describe("The end-user identifier (e.g. email or internal user id)."),
-      purposes: z3.record(z3.boolean()).describe('Map of purpose names to consent values, e.g. { "newsletter": true, "analytics": false }.')
+      subjectId: z4.string().describe("The end-user identifier (e.g. email or internal user id)."),
+      purposes: z4.record(z4.boolean()).describe('Map of purpose names to consent values, e.g. { "newsletter": true, "analytics": false }.')
     },
     (a) => client.preferences.save(a.subjectId, a.purposes)
   );
   tool(
     "get_preference",
     "One end-user\u2019s saved preferences, by subjectId. Read-only.",
-    { subjectId: z3.string() },
+    { subjectId: z4.string() },
     (a) => client.preferences.get(a.subjectId)
   );
   tool(
     "issue_api_key",
     "Issue a new API key. The secret is returned once and never again. Prefer the least privilege the job needs: `scopes` limits what it can do, `cbids` locks it to specific sites (it then cannot reach anything org-wide), `expiresInDays` retires it. Omitting all three mints a full-access, org-wide, non-expiring key.",
     {
-      name: z3.string().optional(),
-      scopes: z3.array(z3.string()).optional(),
-      cbids: z3.array(z3.string()).min(1).optional(),
-      expiresInDays: z3.number().int().min(1).max(3650).optional()
+      name: z4.string().optional(),
+      scopes: z4.array(z4.string()).optional(),
+      cbids: z4.array(z4.string()).min(1).optional(),
+      expiresInDays: z4.number().int().min(1).max(3650).optional()
     },
     (a) => client.keys.issue({
       ...a.name ? { name: a.name } : {},
@@ -1163,36 +1400,80 @@ function registerTools(server, client) {
       ...a.expiresInDays !== void 0 ? { expiresInDays: a.expiresInDays } : {}
     })
   );
-  tool("revoke_api_key", "Revoke an API key by its prefix. Takes effect immediately; anything using that key stops working.", { prefix: z3.string() }, async (a) => {
+  tool("revoke_api_key", "Revoke an API key by its prefix. Takes effect immediately; anything using that key stops working.", { prefix: z4.string() }, async (a) => {
     await client.keys.revoke(a.prefix);
     return { revoked: a.prefix };
   });
   tool(
     "import_cookie_declaration",
     "Read a cookie declaration exported from another CMP (OneTrust, Cookiebot, CookieYes, or any CSV/JSON with the same columns) and translate its categories into ours. Nothing is applied \u2014 it comes back for review, with the rows whose category could not be placed listed separately.",
-    { cbid: z3.string(), data: z3.string().describe("The exported file, as text (CSV or JSON).") },
+    { cbid: z4.string(), data: z4.string().describe("The exported file, as text (CSV or JSON).") },
     (a) => client.sites.importDeclaration(a.cbid, a.data)
   );
+  tool(
+    "apply_cookie_import",
+    "Import a cookie declaration exported from another CMP AND declare it: every row whose category mapped to ours and that has a purpose becomes a site declaration; the rest come back in `skipped` with the reason. Cookies the site already declared are kept unless overwrite is true. Prefer import_cookie_declaration first to review.",
+    { cbid: z4.string(), data: z4.string().describe("The exported file, as text (CSV or JSON)."), overwrite: z4.boolean().optional() },
+    (a) => client.sites.applyImport(a.cbid, a.data, a.overwrite ? { overwrite: true } : void 0)
+  );
+  const declarationShape = {
+    category: z4.string().describe("necessary, preferences, statistics, marketing, or one of the site\u2019s categories.custom ids."),
+    purpose: z4.string().describe("What the cookie does, as visitors will read it \u2014 and the fallback for any language purposes lacks."),
+    purposes: z4.record(z4.string(), z4.string().max(1e3)).nullable().optional().describe('The purpose in other languages, keyed by BCP-47 tag: {"es": "\u2026", "pt-BR": "\u2026"}. The banner, data-cc="declaration" and cookie-declaration.js draw the visitor\u2019s language. null clears.'),
+    provider: z4.string().optional(),
+    expiry: z4.string().optional().describe('e.g. "Session", "30 days", "1 year" (the banner localises these forms).'),
+    domain: z4.string().optional(),
+    pattern: z4.boolean().optional().describe("Treat the name as a prefix wildcard (a trailing * does the same).")
+  };
+  const dryRunArg = z4.boolean().optional().describe("Store nothing: answer with the would-be declarations and a diff (added / removed / changed) to check first.");
+  tool(
+    "declare_cookie",
+    'Declare what one of the site\u2019s cookies is. Overrides the scanner, observed visits and the cookie database everywhere the declaration is shown (API, preference modal, data-cc="declaration"). Use for the site\u2019s own cookies the database cannot know. A name ending in * covers every cookie with that prefix.',
+    { cbid: z4.string(), name: z4.string(), ...declarationShape, dryRun: dryRunArg },
+    (a) => {
+      const { cbid: cbid2, name, dryRun, ...rest } = a;
+      return client.sites.declareCookie(cbid2, name, rest, dryRun ? { dryRun: true } : void 0);
+    }
+  );
+  tool(
+    "declare_cookies",
+    "Declare many cookies at once. All-or-nothing: one invalid item refuses the whole request and nothing is saved. replace: true also removes every declaration the list does not name.",
+    { cbid: z4.string(), cookies: z4.array(z4.object({ name: z4.string(), ...declarationShape })).max(500), replace: z4.boolean().optional(), dryRun: dryRunArg },
+    (a) => {
+      const o = { ...a.replace ? { replace: true } : {}, ...a.dryRun ? { dryRun: true } : {} };
+      return client.sites.declareCookies(a.cbid, a.cookies, Object.keys(o).length ? o : void 0);
+    }
+  );
+  tool(
+    "undeclare_cookie",
+    "Remove a cookie declaration; the scanned/observed classification applies again.",
+    { cbid: z4.string(), name: z4.string(), dryRun: dryRunArg },
+    async (a) => {
+      if (a.dryRun) return client.sites.undeclareCookie(a.cbid, a.name, { dryRun: true });
+      await client.sites.undeclareCookie(a.cbid, a.name);
+      return { undeclared: a.name };
+    }
+  );
   tool(
     "get_blocked_pages",
     "Pages where the embed could not load its banner renderer \u2014 the page\u2019s Content Security Policy or Trusted Types policy refused it, so nobody there can be asked for consent. An empty list is healthy. Read-only.",
-    { cbid: z3.string() },
+    { cbid: z4.string() },
     (a) => client.sites.blocked(a.cbid)
   );
   tool(
     "roll_api_key",
     "Rotate an API key: returns a new secret once, with the same name, scopes, property lock and expiry. The old secret stops working immediately \u2014 if it is the key this server runs with, this server stops working too until it is reconfigured.",
-    { prefix: z3.string() },
+    { prefix: z4.string() },
     (a) => client.keys.roll(a.prefix)
   );
   tool(
     "update_api_key",
     "Rename an API key, or replace its scopes or the properties it is locked to. Only the fields given change; the secret does not.",
     {
-      prefix: z3.string(),
-      name: z3.string().optional(),
-      scopes: z3.array(z3.string()).optional(),
-      cbids: z3.array(z3.string()).min(1).optional()
+      prefix: z4.string(),
+      name: z4.string().optional(),
+      scopes: z4.array(z4.string()).optional(),
+      cbids: z4.array(z4.string()).min(1).optional()
     },
     (a) => client.keys.update(a.prefix, {
       ...a.name !== void 0 ? { name: a.name } : {},
@@ -1204,31 +1485,170 @@ function registerTools(server, client) {
   tool(
     "update_org",
     "Rename your organisation or set its logo. logoUrl: null removes the logo; upload an image with upload_asset to get a URL. Deleting the organisation is not possible here.",
-    { name: z3.string().min(1).optional(), logoUrl: z3.string().nullable().optional() },
+    { name: z4.string().min(1).optional(), logoUrl: z4.string().nullable().optional() },
     (a) => client.org.update({
       ...a.name !== void 0 ? { name: a.name } : {},
       ...a.logoUrl !== void 0 ? { logoUrl: a.logoUrl } : {}
     })
   );
+  tool(
+    "get_mail_provider",
+    "Your own mail provider for rights-request mail (verification codes and other privacy-request mail), if any. Never returns the credential, only its last four characters. `sender` says whether verification codes are mailed through it now (own) or not at all (none) \u2014 there is no shared sender. Read-only.",
+    {},
+    () => client.org.mailProvider.get()
+  );
+  tool(
+    "set_mail_provider",
+    "Connect your own mail provider for rights-request mail \u2014 recommended, so codes come from your own domain. Replaces the stored one. It carries mail only after test_mail_provider succeeds; every save clears that. Omit secret to keep the stored one (same provider only).",
+    {
+      provider: z4.enum(["brevo", "sendgrid", "postmark", "resend", "ses", "smtp"]),
+      fromEmail: z4.string().describe("An address on a domain your provider has verified."),
+      fromName: z4.string().max(100).nullable().optional(),
+      replyTo: z4.string().nullable().optional(),
+      secret: z4.string().optional().describe("API key (Brevo, SendGrid, Resend), server token (Postmark), secret access key (SES) or SMTP password. Write-only."),
+      ses: z4.object({ region: z4.string(), accessKeyId: z4.string() }).optional().describe("Required for ses."),
+      smtp: z4.object({ host: z4.string(), port: z4.union([z4.literal(25), z4.literal(465), z4.literal(587), z4.literal(2525)]), security: z4.enum(["tls", "starttls"]), username: z4.string() }).optional().describe("Required for smtp. TLS is always required.")
+    },
+    (a) => client.org.mailProvider.set(a)
+  );
+  tool(
+    "test_mail_provider",
+    "Send a test message through your own mail provider (never Cookie Munch\u2019s) and report what it answered. Success marks the configuration verified, after which it carries all rights mail.",
+    { to: z4.string().optional().describe("Recipient. Default: the reply-to, else the from address.") },
+    (a) => client.org.mailProvider.test(a.to)
+  );
+  tool(
+    "remove_mail_provider",
+    "Remove your own mail provider. Rights mail goes back to Cookie Munch\u2019s shared sender, labelled as sending on your site\u2019s behalf.",
+    {},
+    async () => {
+      await client.org.mailProvider.remove();
+      return { removed: true };
+    }
+  );
+  const CAPTCHA_OFF = "Off removes spam protection beyond the hidden spam-trap field, the rate limits and the email code: expect more spam requests. Own keys are recommended.";
+  const captchaInput = {
+    mode: z4.enum(["own", "off"]).describe(`own: your own captcha provider keys (recommended). off: no captcha. ${CAPTCHA_OFF}`),
+    provider: z4.enum(["turnstile", "hcaptcha", "recaptcha_v2", "recaptcha_v3"]).optional().describe("Required for own."),
+    siteKey: z4.string().optional().describe("Required for own: the public site key. List your rights-page hostnames on it at the provider."),
+    secret: z4.string().optional().describe("The provider secret key. Write-only; never returned. Omit to keep the stored one (same provider)."),
+    minScore: z4.number().min(0.1).max(0.9).optional().describe("reCAPTCHA v3 only. Default 0.5.")
+  };
+  const captchaBody = (a) => ({
+    mode: a.mode,
+    ...a.provider !== void 0 ? { provider: a.provider } : {},
+    ...a.siteKey !== void 0 ? { siteKey: a.siteKey } : {},
+    ...a.secret !== void 0 ? { secret: a.secret } : {},
+    ...a.minScore !== void 0 ? { minScore: a.minScore } : {}
+  });
+  tool(
+    "get_rights_captcha",
+    "The captcha on a site\u2019s hosted rights page: its own setting, else the organisation default, else off (`source` says which). Never returns the secret. Read-only.",
+    { cbid: z4.string() },
+    (a) => client.rightsCaptcha.get(a.cbid)
+  );
+  tool(
+    "set_rights_captcha",
+    `Set a site\u2019s rights-page captcha: your own Turnstile, hCaptcha or reCAPTCHA keys (recommended; the provider must accept the secret before it is saved), or off. ${CAPTCHA_OFF} Audited with the old and new mode.`,
+    { cbid: z4.string(), ...captchaInput },
+    (a) => client.rightsCaptcha.set(a.cbid, captchaBody(a))
+  );
+  tool(
+    "remove_rights_captcha",
+    "Remove a site\u2019s own captcha setting: it inherits the organisation default again (or off). Returns the setting now in force.",
+    { cbid: z4.string() },
+    (a) => client.rightsCaptcha.remove(a.cbid)
+  );
+  tool(
+    "get_rights_captcha_default",
+    "The organisation default captcha for its rights pages, used by every site without its own setting. Never returns the secret. Read-only.",
+    {},
+    () => client.org.rightsCaptcha.get()
+  );
+  tool(
+    "set_rights_captcha_default",
+    `Set the organisation default captcha for its rights pages: your own keys (recommended) or off. ${CAPTCHA_OFF}`,
+    captchaInput,
+    (a) => client.org.rightsCaptcha.set(captchaBody(a))
+  );
+  tool(
+    "remove_rights_captcha_default",
+    "Remove the organisation default: sites without their own setting then have no captcha. Returns the setting now in force.",
+    {},
+    () => client.org.rightsCaptcha.remove()
+  );
+  const IDENTITY_NOTE = "The JWKS is fetched and checked before anything is saved. The session token must carry the email and a verified-email claim (default email_verified) set to true (Clerk: add email: {{user.primary_email_address}} to the session token; Clerk documents no claim for whether that address is verified, so either add your own or set trustEmailClaim). oidc_jwt needs an audience or authorizedParties.";
+  const identityInput = {
+    type: z4.enum(["clerk", "atlas", "oidc_jwt"]).describe("clerk, atlas (Clerk-shaped), or oidc_jwt (any issuer that signs session JWTs with a published JWKS)."),
+    issuer: z4.string().describe("https URL exactly as in the token\u2019s iss (Clerk: your Frontend API URL)."),
+    jwksUrl: z4.string().optional().describe("Required for oidc_jwt; clerk/atlas default to <issuer>/.well-known/jwks.json."),
+    audience: z4.string().optional().describe("Expected aud. For oidc_jwt an audience or authorizedParties is required (a shared issuer mints tokens for every app)."),
+    authorizedParties: z4.array(z4.string()).optional().describe("Your own origins (https://www.example.com) the token\u2019s azp must be one of. Required for clerk and atlas; for oidc_jwt when there is no audience."),
+    emailClaim: z4.string().optional().describe("Default email."),
+    emailVerifiedClaim: z4.string().optional().describe("Default email_verified; must be exactly true."),
+    sessionCookieName: z4.string().optional().describe("Default __session: the cookie the hosted page on your custom domain reads."),
+    trustEmailClaim: z4.boolean().optional().describe("clerk/atlas only, default false. True: a token without the verified claim is accepted, its email claim taken as verified. Set only if every address your provider puts in that claim is verified.")
+  };
+  const identityBody = (a) => {
+    const out = { type: a.type, issuer: a.issuer };
+    for (const k of ["jwksUrl", "audience", "authorizedParties", "emailClaim", "emailVerifiedClaim", "sessionCookieName", "trustEmailClaim"]) if (a[k] !== void 0) out[k] = a[k];
+    return out;
+  };
+  tool(
+    "get_rights_identity",
+    "The sign-in provider a site\u2019s rights requests are verified with: its own setting, else the organisation default, else none (`source` says which). Read-only.",
+    { cbid: z4.string() },
+    (a) => client.rightsIdentity.get(a.cbid)
+  );
+  tool(
+    "set_rights_identity",
+    `Connect a site\u2019s sign-in provider so a visitor signed in to the site is verified by their session, with no code mail. ${IDENTITY_NOTE} Audited.`,
+    { cbid: z4.string(), ...identityInput },
+    (a) => client.rightsIdentity.set(a.cbid, identityBody(a))
+  );
+  tool(
+    "remove_rights_identity",
+    "Remove a site\u2019s own sign-in provider: it inherits the organisation default again (or none). Returns the setting now in force.",
+    { cbid: z4.string() },
+    (a) => client.rightsIdentity.remove(a.cbid)
+  );
+  tool(
+    "get_rights_identity_default",
+    "The organisation default sign-in provider for its rights requests, used by every site without its own. Read-only.",
+    {},
+    () => client.org.rightsIdentity.get()
+  );
+  tool(
+    "set_rights_identity_default",
+    `Set the organisation default sign-in provider for its rights requests. ${IDENTITY_NOTE}`,
+    identityInput,
+    (a) => client.org.rightsIdentity.set(identityBody(a))
+  );
+  tool(
+    "remove_rights_identity_default",
+    "Remove the organisation default sign-in provider. Returns the setting now in force.",
+    {},
+    () => client.org.rightsIdentity.remove()
+  );
   tool(
     "get_audit_log",
     "The organisation\u2019s audit log, newest first: administrative changes made in the dashboard or through the API, and who made them. Read-only.",
-    { limit: z3.number().int().min(1).max(500).optional() },
+    { limit: z4.number().int().min(1).max(500).optional() },
     (a) => client.audit(a.limit)
   );
   tool(
     "upload_asset",
     "Upload an image \u2014 a banner logo \u2014 and get its public URL. data is base64 (a data: URL also works); PNG, JPEG, WebP, GIF or SVG, up to 1,000,000 bytes.",
     {
-      data: z3.string(),
-      contentType: z3.enum(["image/png", "image/jpeg", "image/webp", "image/gif", "image/svg+xml"])
+      data: z4.string(),
+      contentType: z4.enum(["image/png", "image/jpeg", "image/webp", "image/gif", "image/svg+xml"])
     },
     (a) => client.assets.upload({ data: a.data, contentType: a.contentType })
   );
   tool(
     "delete_asset",
     "Delete a stored image by its URL (or file name). Only your own organisation\u2019s images can be named.",
-    { url: z3.string().describe("The URL upload_asset returned, or just its file name.") },
+    { url: z4.string().describe("The URL upload_asset returned, or just its file name.") },
     async (a) => {
       await client.assets.delete(a.url);
       return { deleted: a.url };
@@ -1243,18 +1663,18 @@ function registerTools(server, client) {
   tool(
     "get_customer",
     "One child org: its controller details and usage. Read-only.",
-    { id: z3.string() },
+    { id: z4.string() },
     (a) => client.reseller.get(a.id)
   );
   tool(
     "provision_customer",
     "Create a new child org under this reseller. With `mintKey`, its first API key is returned once. Counts toward the reseller plan\u2019s pooled limits.",
     {
-      name: z3.string(),
-      ownerEmail: z3.string().optional(),
-      delegatedAccess: z3.boolean().optional().describe("Whether this reseller may act inside the child."),
-      mintKey: z3.boolean().optional(),
-      keyScopes: z3.array(z3.string()).optional()
+      name: z4.string(),
+      ownerEmail: z4.string().optional(),
+      delegatedAccess: z4.boolean().optional().describe("Whether this reseller may act inside the child."),
+      mintKey: z4.boolean().optional(),
+      keyScopes: z4.array(z4.string()).optional()
     },
     (a) => client.reseller.create({
       name: a.name,
@@ -1268,10 +1688,10 @@ function registerTools(server, client) {
     "update_customer",
     "Change a child org\u2019s status, delegated access or DSAR routing. `dsarRouting: null` clears the override.",
     {
-      id: z3.string(),
-      status: z3.enum(["active", "suspended"]).optional(),
-      delegatedAccess: z3.boolean().optional(),
-      dsarRouting: z3.enum(["reseller", "child"]).nullable().optional()
+      id: z4.string(),
+      status: z4.enum(["active", "suspended"]).optional(),
+      delegatedAccess: z4.boolean().optional(),
+      dsarRouting: z4.enum(["reseller", "child"]).nullable().optional()
     },
     (a) => client.reseller.update(a.id, {
       ...a.status ? { status: a.status } : {},
@@ -1282,7 +1702,7 @@ function registerTools(server, client) {
   tool(
     "suspend_customer",
     "Suspend a child org: it stops ingesting consent and its keys stop working, and it can be reactivated with update_customer. Its data is kept. (Permanent deletion is deliberately not available here.)",
-    { id: z3.string() },
+    { id: z4.string() },
     async (a) => {
       await client.reseller.deprovision(a.id);
       return { suspended: a.id };
@@ -1291,72 +1711,72 @@ function registerTools(server, client) {
   tool(
     "list_customer_keys",
     "A child org's API key prefixes. Never the secrets. Read-only.",
-    { id: z3.string() },
+    { id: z4.string() },
     (a) => client.reseller.listKeys(a.id)
   );
   tool(
     "issue_customer_key",
     "Mint an API key for a child org. The secret is returned once. Prefer scopes and a property lock over a full-access key.",
-    { id: z3.string(), name: z3.string().optional(), scopes: z3.array(z3.string()).optional(), cbids: z3.array(z3.string()).min(1).optional() },
+    { id: z4.string(), name: z4.string().optional(), scopes: z4.array(z4.string()).optional(), cbids: z4.array(z4.string()).min(1).optional() },
     (a) => client.reseller.mintKey(a.id, {
       ...a.name ? { name: a.name } : {},
       ...a.scopes ? { scopes: a.scopes } : {},
       ...a.cbids ? { cbids: a.cbids } : {}
     })
   );
-  tool("revoke_customer_key", "Revoke a child org's API key by prefix. Takes effect immediately.", { id: z3.string(), prefix: z3.string() }, async (a) => {
+  tool("revoke_customer_key", "Revoke a child org's API key by prefix. Takes effect immediately.", { id: z4.string(), prefix: z4.string() }, async (a) => {
     await client.reseller.revokeKey(a.id, a.prefix);
     return { revoked: a.prefix };
   });
   tool(
     "erase_subject_data",
     "IRREVERSIBLY crypto-erase a data subject's consent records by their consent-receipt stamp (GDPR/CCPA deletion). Destroys the encryption key; the tamper-evident chain stays intact.",
-    { cbid: z3.string(), stamp: z3.string() },
+    { cbid: z4.string(), stamp: z4.string() },
     (a) => client.consent.eraseSubject(a.cbid, a.stamp)
   );
   tool(
     "export_subject_data",
     "Export a data subject's consent records (GDPR access/portability).",
-    { cbid: z3.string(), stamp: z3.string() },
+    { cbid: z4.string(), stamp: z4.string() },
     (a) => client.consent.exportSubject(a.cbid, a.stamp)
   );
   tool("list_banners", "List reusable banner designs in your org.", {}, () => client.banners.list());
   tool(
     "create_banner",
     "Create a reusable banner design.",
-    { name: z3.string(), json: z3.record(z3.unknown()).describe("A v2 BannerConfig.") },
+    { name: z4.string(), json: z4.record(z4.unknown()).describe("A v2 BannerConfig.") },
     (a) => client.banners.create({ name: a.name, json: a.json })
   );
-  tool("get_banner", "Get a banner design by id.", { id: z3.string() }, (a) => client.banners.get(a.id));
+  tool("get_banner", "Get a banner design by id.", { id: z4.string() }, (a) => client.banners.get(a.id));
   tool(
     "update_banner",
     "Update a banner design (name and/or config).",
-    { id: z3.string(), name: z3.string().optional(), json: z3.record(z3.unknown()).optional() },
+    { id: z4.string(), name: z4.string().optional(), json: z4.record(z4.unknown()).optional() },
     (a) => client.banners.update(a.id, {
       ...a.name !== void 0 ? { name: a.name } : {},
       ...a.json !== void 0 ? { json: a.json } : {}
     })
   );
-  tool("delete_banner", "Delete a banner design (fails if assigned to sites).", { id: z3.string() }, async (a) => {
+  tool("delete_banner", "Delete a banner design (fails if assigned to sites).", { id: z4.string() }, async (a) => {
     await client.banners.delete(a.id);
     return { ok: true };
   });
   tool(
     "get_banner_assignments",
     "The sites (cbids) a banner design is currently assigned to. Read-only.",
-    { id: z3.string() },
+    { id: z4.string() },
     (a) => client.banners.assignments(a.id)
   );
   tool(
     "assign_banner",
     "Set which sites (cbids) use a banner design.",
-    { id: z3.string(), cbids: z3.array(z3.string()) },
+    { id: z4.string(), cbids: z4.array(z4.string()) },
     (a) => client.banners.setAssignments(a.id, a.cbids)
   );
   tool(
     "publish_banner",
     "Publish a design live to all its assigned sites.",
-    { id: z3.string() },
+    { id: z4.string() },
     (a) => client.banners.publish(a.id)
   );
 }
@@ -1373,4 +1793,4 @@ export {
   registerTools,
   createCookieMunchMcp
 };
-//# sourceMappingURL=chunk-G5TN4KJA.js.map
+//# sourceMappingURL=chunk-PLBLLTYO.js.map