@cookiemunch/mcp 0.7.0 → 0.8.0

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 Every published release, newest first. Dates are the day the version was cut. Each release tracks the same-numbered `@cookiemunch/sdk`.
 
+## 0.8.0 (2026-10-30)
+
+- Added: `connect_dsar_executor` takes `mintFrom` and `externalId`; `secretKey` is optional. Built on `@cookiemunch/sdk` 0.8.0.
+- Added: `connect_identity_provider`: one-call connect for an identity provider's privacy orchestrator.
+
+## 0.7.1 (2026-10-24)
+
+- Changed: tool descriptions name each vendor's own embed manifest (`/.well-known/<product>-embed.json`); built on `@cookiemunch/sdk` 0.7.1.
+
 ## 0.7.0 (2026-10-24)
 
 - Added: `get_sandbox`, `create_sandbox` (erasing a sandbox stays a person's `cookiemunch sandbox delete`), `list_api_versions`, `set_own_api_version`.

package/dist/bin.cjs

@@ -557,8 +557,10 @@ function registerPlatformTools(tool, client) {
       revokeAtlasIdGrant: import_zod2.z.boolean().optional().describe("A preset param, when the preset's params list it: default false. True adds an optional step that revokes the person's app grant on erasure; a credential without the scope reports skipped: insufficient_scope."),
       label: import_zod2.z.string().optional().describe("Your name for the credential, shown beside keyPrefix."),
       system: import_zod2.z.string().optional().describe("The name this connection answers to in a plan, e.g. identity or crm. Required unless the preset has a default."),
-      baseUrl: import_zod2.z.string().optional().describe("The system's public https origin. Required unless the preset sets it."),
-      secretKey: import_zod2.z.string().describe("Its API key, with whatever scope that system needs to export and erase a user."),
+      baseUrl: import_zod2.z.string().optional().describe("The system's public https origin, or a base with a path (cm-standard-v1 v4 on: the path replaces /api/privacy; cm-standard-v2: the contract paths hang off it). Required unless the preset sets it."),
+      secretKey: import_zod2.z.string().optional().describe("Its API key, with whatever scope that system needs to export and erase a user. Send this or mintFrom."),
+      mintFrom: import_zod2.z.string().optional().describe("In place of secretKey: a partner id (one that registered an executorKeyUrl, e.g. chatly, forumulate, referalli) that mints the key for the site under its partner link. The connection is scoped to that site. With dryRun, the answer's mint says who would mint it; nothing is minted."),
+      externalId: import_zod2.z.string().optional().describe("With mintFrom: the partner account the key is minted for. Default: the one the site's live link for that partner names."),
       webhookSecret: import_zod2.z.string().optional().describe("Signing secret of its webhook endpoint. Optional: polling closes tasks without it."),
       auto: import_zod2.z.boolean().optional().describe("Open a sub-task automatically when a request reaches fulfilment. Default true."),
       orchestrator: import_zod2.z.union([import_zod2.z.literal(1), import_zod2.z.literal(2)]).optional().describe("How it takes part in cases. Default 2 (v2 headers on every call); 1 is the v1 adapter. The answer carries a completionSecret, shown once, that signs its completions."),
@@ -805,7 +807,7 @@ function registerIntegrationTools(tool, client) {
   );
   tool(
     "get_embed_manifest",
-    "A site\u2019s embed manifest (the tenant variant of /.well-known/forgedeck-embed.json): every origin the Cookie Munch embed touches on that site, by CSP directive (non-origin sources such as 'unsafe-inline' under requires), every cookie and browser-storage key it writes with category and lifetime, the checkers\u2019 User-Agent, and the hosts of the site\u2019s rights page and preference centre. Use it to build a Content-Security-Policy. Read-only.",
+    "A site\u2019s embed manifest (the tenant variant of /.well-known/cookiemunch-embed.json): every origin the Cookie Munch embed touches on that site, by CSP directive (non-origin sources such as 'unsafe-inline' under requires), every cookie and browser-storage key it writes with category and lifetime, the checkers\u2019 User-Agent, and the hosts of the site\u2019s rights page and preference centre. Use it to build a Content-Security-Policy. Read-only.",
     { cbid: import_zod3.z.string() },
     (a) => client.embedManifest(a.cbid)
   );
@@ -927,12 +929,12 @@ function registerKeyAndTagTools(tool, client) {
   const tagsSchema = import_zod4.z.object({
     type: import_zod4.z.enum(TAGGED),
     id: import_zod4.z.string(),
-    metadata: import_zod4.z.record(import_zod4.z.union([import_zod4.z.string(), import_zod4.z.number(), import_zod4.z.boolean(), import_zod4.z.null()])).describe("Keys to set; null removes one. forgedeck_sandbox cannot be set here."),
+    metadata: import_zod4.z.record(import_zod4.z.union([import_zod4.z.string(), import_zod4.z.number(), import_zod4.z.boolean(), import_zod4.z.null()])).describe("Keys to set; null removes one. stack_sandbox cannot be set here."),
     dryRun: import_zod4.z.boolean().optional().describe("Answer with the diff, storing nothing. Do this first.")
   });
   tool(
     "update_resource_tags",
-    "Change a resource\u2019s tags (merge). For adopting resources created before tags existed, e.g. forgedeck_product and forgedeck_env. A resource can never be made a sandbox after it was created.",
+    "Change a resource\u2019s tags (merge). For adopting resources created before tags existed, e.g. stack_product and stack_env. A resource can never be made a sandbox after it was created.",
     tagsSchema.shape,
     (a) => {
       const { type, id, metadata, dryRun } = tagsSchema.parse(a);
@@ -967,7 +969,7 @@ function registerKeyAndTagTools(tool, client) {
   );
   tool(
     "get_provision_env",
-    "What `forgedeck env` writes for a product provisioned with this forgedeck ref: variable names, non-secret values (cbid, script URL, API base) and references for secrets, never a secret. Read-only.",
+    "What `env` writes for a product provisioned with this stack ref: variable names, non-secret values (cbid, script URL, API base) and references for secrets, never a secret. Read-only.",
     { ref: import_zod4.z.string() },
     (a) => client.provisionEnv(a.ref)
   );
@@ -1413,13 +1415,13 @@ ${JSON.stringify(r, null, 2)}` : r;
       type: import_zod6.z.string().describe("access | deletion | closure | restriction | rectification, or erasure / erase / export."),
       emails: import_zod6.z.array(import_zod6.z.string()).optional().describe("The person's addresses."),
       identity: import_zod6.z.object({ iss: import_zod6.z.string(), sub: import_zod6.z.string(), ext: import_zod6.z.string().optional(), principal: import_zod6.z.string().optional() }).optional().describe("A signed-in identity from the site's sign-in issuer. People are never linked on email when it is present."),
-      source: import_zod6.z.enum(["product", "atlas", "admin"]).optional(),
+      source: import_zod6.z.enum(["product", "identity", "admin"]).optional().describe("identity: the site's sign-in provider, whichever it is."),
       reason: import_zod6.z.string().optional(),
       skipSystems: import_zod6.z.array(import_zod6.z.string()).optional().describe("System names, connection ids, or self."),
       fulfill: import_zod6.z.boolean().optional(),
       test: import_zod6.z.boolean().optional(),
       idempotencyKey: import_zod6.z.string().optional(),
-      trace: import_zod6.z.string().optional().describe("An X-ForgeDeck-Trace to keep, from the caller.")
+      trace: import_zod6.z.string().optional().describe("An X-Trace-Id to keep, from the caller.")
     },
     (a) => client.dsar.openCase(
       {
@@ -1458,7 +1460,7 @@ ${JSON.stringify(r, null, 2)}` : r;
   );
   tool(
     "find_dsar_by_trace",
-    "The rights request carrying one X-ForgeDeck-Trace id \u2014 to follow one event across products. Read-only.",
+    "The rights request carrying one X-Trace-Id id \u2014 to follow one event across products. Read-only.",
     { trace: import_zod6.z.string() },
     (a) => client.dsar.listByTrace(a.trace)
   );
@@ -1488,6 +1490,22 @@ ${JSON.stringify(r, null, 2)}` : r;
       typeof a.iss === "string" && typeof a.sub === "string" ? { iss: a.iss, sub: a.sub } : { email: String(a.email ?? "") }
     )
   );
+  tool(
+    "connect_identity_provider",
+    "Connect an identity provider's privacy orchestrator in one call, so it opens a rights case here when a person deletes their account there. Mints a key holding only dsar:write, locked to the site (no keys:write needed), and hands it to the provider, authorised with the provider instance key. The minted key is never returned, only its prefix; connecting again replaces it. Built in: atlas. Any other provider: pass connector. Run with dryRun first: it mints and sends nothing.",
+    {
+      provider: import_zod6.z.string().describe("The provider id, e.g. atlas."),
+      cbid: import_zod6.z.string().describe("The site the provider opens cases on."),
+      providerKey: import_zod6.z.string().describe("The provider instance's secret key (Atlas: the instance secret key). Used for this one call, never stored."),
+      connector: import_zod6.z.object({ url: import_zod6.z.string(), method: import_zod6.z.enum(["PUT", "POST"]).optional(), body: import_zod6.z.record(import_zod6.z.unknown()) }).optional().describe('Only for a provider with no built-in connector: its https orchestrator URL and JSON body; a body value "{apiKey}" becomes the minted key.'),
+      dryRun: import_zod6.z.boolean().optional().describe("Show the key and the request that would be made, minting and sending nothing.")
+    },
+    (a) => client.integrations.connect(
+      a.provider,
+      { cbid: a.cbid, providerKey: a.providerKey, ...a.connector ? { connector: a.connector } : {} },
+      { dryRun: a.dryRun === true }
+    )
+  );
   tool(
     "advance_dsar",
     "Advance a DSAR to a new status (received \u2192 verifying \u2192 in_progress \u2192 completed, or rejected).",
@@ -1875,7 +1893,7 @@ ${JSON.stringify(r, null, 2)}` : r;
     (a) => client.sites.applyImport(a.cbid, a.data, a.overwrite ? { overwrite: true } : void 0)
   );
   const declarationShape = {
-    category: import_zod6.z.string().describe("necessary, preferences, statistics, marketing, or one of the site\u2019s categories.custom ids."),
+    category: import_zod6.z.string().describe("necessary, preferences, statistics, marketing, or one of the site\u2019s categories.suite or categories.custom ids."),
     purpose: import_zod6.z.string().describe("What the cookie does, as visitors will read it \u2014 and the fallback for any language purposes lacks."),
     purposes: import_zod6.z.record(import_zod6.z.string(), import_zod6.z.string().max(1e3)).nullable().optional().describe('The purpose in other languages, keyed by BCP-47 tag: {"es": "\u2026", "pt-BR": "\u2026"}. The banner, data-cc="declaration" and cookie-declaration.js draw the visitor\u2019s language. null clears.'),
     provider: import_zod6.z.string().optional(),
@@ -1968,7 +1986,7 @@ ${JSON.stringify(r, null, 2)}` : r;
   );
   tool(
     "import_cookie_manifest",
-    'Declare ANY vendor\u2019s cookies and browser storage from its embed manifest (/.well-known/forgedeck-embed.json): give its https URL (re-read hourly afterwards) or the manifest document. The vendor id is the manifest\u2019s product; rows are marked source "manifest". An invalid manifest is refused with each broken rule named. Use dryRun first; remove it with remove_cookie_preset and the product id.',
+    'Declare ANY vendor\u2019s cookies and browser storage from its embed manifest (/.well-known/<product>-embed.json): give its https URL (re-read hourly afterwards) or the manifest document. The vendor id is the manifest\u2019s product; rows are marked source "manifest". An invalid manifest is refused with each broken rule named. Use dryRun first; remove it with remove_cookie_preset and the product id.',
     {
       cbid: import_zod6.z.string(),
       url: import_zod6.z.string().optional().describe("An https:// embed manifest URL."),
@@ -2425,7 +2443,7 @@ ${JSON.stringify(r, null, 2)}` : r;
 }
 
 // src/index.ts
-var MCP_VERSION = "0.7.0";
+var MCP_VERSION = "0.8.0";
 function createCookieMunchMcp(opts) {
   const client = opts.client ?? (0, import_sdk.createCookieMunch)({ apiKey: opts.apiKey, baseUrl: opts.baseUrl, userAgent: opts.userAgent ?? `cookiemunch-mcp/${MCP_VERSION}` });
   const server = new import_mcp.McpServer({ name: "cookiemunch", version: "1.0.0" });