@cookiemunch/mcp 0.7.1 → 0.9.0

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 Every published release, newest first. Dates are the day the version was cut. Each release tracks the same-numbered `@cookiemunch/sdk`.
 
+## 0.9.0 (2026-10-30)
+
+- Added: `get_site_upcoming_regulations`. Built on `@cookiemunch/sdk` 0.9.0.
+
+## 0.8.0 (2026-10-30)
+
+- Added: `connect_dsar_executor` takes `mintFrom` and `externalId`; `secretKey` is optional. Built on `@cookiemunch/sdk` 0.8.0.
+- Added: `connect_identity_provider`: one-call connect for an identity provider's privacy orchestrator.
+
 ## 0.7.1 (2026-10-24)
 
 - Changed: tool descriptions name each vendor's own embed manifest (`/.well-known/<product>-embed.json`); built on `@cookiemunch/sdk` 0.7.1.

package/dist/bin.cjs

@@ -17,7 +17,7 @@ function registerConfigTools(tool, client) {
   const blockingModeEnum = import_zod.z.enum(["auto", "manual"]);
   const bannerModeEnum = import_zod.z.enum(["opt-in", "opt-out", "off"]);
   const bannerTypeEnum = import_zod.z.enum(["multilevel", "inline", "accept-decline", "accept-only", "do-not-sell"]);
-  const bannerLayoutEnum = import_zod.z.enum(["top", "bottom", "push-down", "popup", "overlay"]);
+  const bannerLayoutEnum = import_zod.z.enum(["top", "bottom", "push-down", "popup", "overlay", "sidebar"]);
   const consentModeModeEnum = import_zod.z.enum(["basic", "advanced"]);
   const geoRuleSchema = import_zod.z.object({
     match: import_zod.z.object({
@@ -193,9 +193,14 @@ function registerConfigTools(tool, client) {
   const setBannerBasicsSchema = import_zod.z.object({
     cbid: import_zod.z.string().describe("Site identifier (cbid)."),
     type: bannerTypeEnum.optional().describe("Banner type. multilevel | inline | accept-decline | accept-only | do-not-sell."),
-    layout: bannerLayoutEnum.optional().describe("Banner layout. top | bottom | push-down | popup | overlay."),
+    layout: bannerLayoutEnum.optional().describe("Banner layout. top | bottom | push-down | popup | overlay | sidebar."),
     preset: import_zod.z.enum(["bar", "box", "full"]).optional().describe("Named shape that sets type/secondLayer (and layout for box): bar = slim one-row bar + categories in a modal; box = centred card + modal; full = every category in the first layer."),
-    secondLayer: import_zod.z.enum(["expand", "popup", "modal"]).optional().describe("Where the categories open from an inline banner."),
+    secondLayer: import_zod.z.enum(["expand", "popup", "modal", "sidebar"]).optional().describe("Where the categories open from an inline banner."),
+    sidebar: import_zod.z.object({
+      side: import_zod.z.enum(["left", "right"]).optional(),
+      width: import_zod.z.number().min(280).max(640).optional(),
+      backdrop: import_zod.z.boolean().optional()
+    }).optional().describe("The drawer of a sidebar layout or second layer: side (default right, mirrored for RTL), width in px 280\u2013640 (default 400), backdrop (default true). Merged onto the stored value."),
     density: import_zod.z.enum(["comfortable", "compact"]).optional().describe("compact = one-row bar from 760px wide."),
     theme: import_zod.z.record(import_zod.z.unknown()).optional().describe("Partial ThemeTokens \u2014 deep-merged onto the existing banner theme. Includes `scrollbar`: { style: themed|thin|native|hidden, thumb?, thumbHover?, track?, width? 4\u201316, radius? 0\u2013999 }."),
     content: import_zod.z.record(import_zod.z.unknown()).optional().describe("Partial BannerContent \u2014 banner copy overrides (title, body, button labels, policyUrl, etc.).")
@@ -205,7 +210,7 @@ function registerConfigTools(tool, client) {
     "Configure v1 banner appearance for a site: preset, type, layout, second layer, density, theme tokens, and copy (content.preferencesTitle titles the preferences dialog). Fetches the current config, patches only those banner fields, and PUTs. Setting type or secondLayer (or layout under the box preset) without a preset removes the stored preset, which would otherwise re-derive them.",
     setBannerBasicsSchema.shape,
     async (a) => {
-      const { cbid: siteId, type, layout, preset, secondLayer, density, theme, content } = setBannerBasicsSchema.parse(a);
+      const { cbid: siteId, type, layout, preset, secondLayer, sidebar, density, theme, content } = setBannerBasicsSchema.parse(a);
       const cfg = await client.sites.getConfig(siteId);
       const existingBanner = cfg["banner"] ?? {};
       const existingTheme = existingBanner["theme"] ?? {};
@@ -215,12 +220,14 @@ function registerConfigTools(tool, client) {
         ...type !== void 0 ? { type } : {},
         ...layout !== void 0 ? { layout } : {},
         ...secondLayer !== void 0 ? { secondLayer } : {},
+        ...sidebar !== void 0 ? { sidebar: { ...existingBanner["sidebar"], ...sidebar } } : {},
         ...density !== void 0 ? { density } : {},
         ...preset !== void 0 ? { preset } : {},
         ...theme !== void 0 ? { theme: { ...existingTheme, ...theme } } : {},
         ...content !== void 0 ? { content: { ...existingContent, ...content } } : {}
       };
-      const owned = type !== void 0 || secondLayer !== void 0 || layout !== void 0 && banner["preset"] === "box";
+      const ownedLayout = layout !== void 0 && (banner["preset"] === "box" || banner["preset"] === "bar" && !["top", "bottom", "push-down"].includes(layout));
+      const owned = type !== void 0 || secondLayer !== void 0 || ownedLayout;
       if (preset === void 0 && owned) delete banner["preset"];
       return client.sites.putConfig(siteId, { ...cfg, banner });
     }
@@ -514,6 +521,19 @@ function registerPlatformTools(tool, client) {
     { days: import_zod2.z.number().int().positive().optional() },
     (a) => client.regulatory.upcoming(a.days)
   );
+  tool(
+    "get_site_upcoming_regulations",
+    "Privacy laws taking effect soon (default 90 days) where a site\u2019s visitors are: those whose jurisdiction holds at least minShare (default 0.01) of the site\u2019s last 30 days of consent decisions. Each has daysUntil, trafficShare and, for a US state law, what changes (GPC duty, sensitive-data opt-in, minors rule). A shipped dataset with a review date, not legal advice.",
+    {
+      cbid: import_zod2.z.string().describe("The site id."),
+      days: import_zod2.z.number().int().positive().optional(),
+      minShare: import_zod2.z.number().min(0).max(1).optional()
+    },
+    (a) => client.regulatory.upcomingForSite(a.cbid, {
+      ...a.days !== void 0 ? { days: a.days } : {},
+      ...a.minShare !== void 0 ? { minShare: a.minShare } : {}
+    })
+  );
   tool(
     "get_dsr_sla",
     "The rights queue at a glance: how many requests are overdue, due today, due soon or on track, plus the overdue ids.",
@@ -557,8 +577,10 @@ function registerPlatformTools(tool, client) {
       revokeAtlasIdGrant: import_zod2.z.boolean().optional().describe("A preset param, when the preset's params list it: default false. True adds an optional step that revokes the person's app grant on erasure; a credential without the scope reports skipped: insufficient_scope."),
       label: import_zod2.z.string().optional().describe("Your name for the credential, shown beside keyPrefix."),
       system: import_zod2.z.string().optional().describe("The name this connection answers to in a plan, e.g. identity or crm. Required unless the preset has a default."),
-      baseUrl: import_zod2.z.string().optional().describe("The system's public https origin. Required unless the preset sets it."),
-      secretKey: import_zod2.z.string().describe("Its API key, with whatever scope that system needs to export and erase a user."),
+      baseUrl: import_zod2.z.string().optional().describe("The system's public https origin, or a base with a path (cm-standard-v1 v4 on: the path replaces /api/privacy; cm-standard-v2: the contract paths hang off it). Required unless the preset sets it."),
+      secretKey: import_zod2.z.string().optional().describe("Its API key, with whatever scope that system needs to export and erase a user. Send this or mintFrom."),
+      mintFrom: import_zod2.z.string().optional().describe("In place of secretKey: a partner id (one that registered an executorKeyUrl, e.g. chatly, forumulate, referalli) that mints the key for the site under its partner link. The connection is scoped to that site. With dryRun, the answer's mint says who would mint it; nothing is minted."),
+      externalId: import_zod2.z.string().optional().describe("With mintFrom: the partner account the key is minted for. Default: the one the site's live link for that partner names."),
       webhookSecret: import_zod2.z.string().optional().describe("Signing secret of its webhook endpoint. Optional: polling closes tasks without it."),
       auto: import_zod2.z.boolean().optional().describe("Open a sub-task automatically when a request reaches fulfilment. Default true."),
       orchestrator: import_zod2.z.union([import_zod2.z.literal(1), import_zod2.z.literal(2)]).optional().describe("How it takes part in cases. Default 2 (v2 headers on every call); 1 is the v1 adapter. The answer carries a completionSecret, shown once, that signs its completions."),
@@ -927,12 +949,12 @@ function registerKeyAndTagTools(tool, client) {
   const tagsSchema = import_zod4.z.object({
     type: import_zod4.z.enum(TAGGED),
     id: import_zod4.z.string(),
-    metadata: import_zod4.z.record(import_zod4.z.union([import_zod4.z.string(), import_zod4.z.number(), import_zod4.z.boolean(), import_zod4.z.null()])).describe("Keys to set; null removes one. forgedeck_sandbox cannot be set here."),
+    metadata: import_zod4.z.record(import_zod4.z.union([import_zod4.z.string(), import_zod4.z.number(), import_zod4.z.boolean(), import_zod4.z.null()])).describe("Keys to set; null removes one. stack_sandbox cannot be set here."),
     dryRun: import_zod4.z.boolean().optional().describe("Answer with the diff, storing nothing. Do this first.")
   });
   tool(
     "update_resource_tags",
-    "Change a resource\u2019s tags (merge). For adopting resources created before tags existed, e.g. forgedeck_product and forgedeck_env. A resource can never be made a sandbox after it was created.",
+    "Change a resource\u2019s tags (merge). For adopting resources created before tags existed, e.g. stack_product and stack_env. A resource can never be made a sandbox after it was created.",
     tagsSchema.shape,
     (a) => {
       const { type, id, metadata, dryRun } = tagsSchema.parse(a);
@@ -967,7 +989,7 @@ function registerKeyAndTagTools(tool, client) {
   );
   tool(
     "get_provision_env",
-    "What `forgedeck env` writes for a product provisioned with this forgedeck ref: variable names, non-secret values (cbid, script URL, API base) and references for secrets, never a secret. Read-only.",
+    "What `env` writes for a product provisioned with this stack ref: variable names, non-secret values (cbid, script URL, API base) and references for secrets, never a secret. Read-only.",
     { ref: import_zod4.z.string() },
     (a) => client.provisionEnv(a.ref)
   );
@@ -1413,13 +1435,13 @@ ${JSON.stringify(r, null, 2)}` : r;
       type: import_zod6.z.string().describe("access | deletion | closure | restriction | rectification, or erasure / erase / export."),
       emails: import_zod6.z.array(import_zod6.z.string()).optional().describe("The person's addresses."),
       identity: import_zod6.z.object({ iss: import_zod6.z.string(), sub: import_zod6.z.string(), ext: import_zod6.z.string().optional(), principal: import_zod6.z.string().optional() }).optional().describe("A signed-in identity from the site's sign-in issuer. People are never linked on email when it is present."),
-      source: import_zod6.z.enum(["product", "atlas", "admin"]).optional(),
+      source: import_zod6.z.enum(["product", "identity", "admin"]).optional().describe("identity: the site's sign-in provider, whichever it is."),
       reason: import_zod6.z.string().optional(),
       skipSystems: import_zod6.z.array(import_zod6.z.string()).optional().describe("System names, connection ids, or self."),
       fulfill: import_zod6.z.boolean().optional(),
       test: import_zod6.z.boolean().optional(),
       idempotencyKey: import_zod6.z.string().optional(),
-      trace: import_zod6.z.string().optional().describe("An X-ForgeDeck-Trace to keep, from the caller.")
+      trace: import_zod6.z.string().optional().describe("An X-Trace-Id to keep, from the caller.")
     },
     (a) => client.dsar.openCase(
       {
@@ -1458,7 +1480,7 @@ ${JSON.stringify(r, null, 2)}` : r;
   );
   tool(
     "find_dsar_by_trace",
-    "The rights request carrying one X-ForgeDeck-Trace id \u2014 to follow one event across products. Read-only.",
+    "The rights request carrying one X-Trace-Id id \u2014 to follow one event across products. Read-only.",
     { trace: import_zod6.z.string() },
     (a) => client.dsar.listByTrace(a.trace)
   );
@@ -1488,6 +1510,22 @@ ${JSON.stringify(r, null, 2)}` : r;
       typeof a.iss === "string" && typeof a.sub === "string" ? { iss: a.iss, sub: a.sub } : { email: String(a.email ?? "") }
     )
   );
+  tool(
+    "connect_identity_provider",
+    "Connect an identity provider's privacy orchestrator in one call, so it opens a rights case here when a person deletes their account there. Mints a key holding only dsar:write, locked to the site (no keys:write needed), and hands it to the provider, authorised with the provider instance key. The minted key is never returned, only its prefix; connecting again replaces it. Built in: atlas. Any other provider: pass connector. Run with dryRun first: it mints and sends nothing.",
+    {
+      provider: import_zod6.z.string().describe("The provider id, e.g. atlas."),
+      cbid: import_zod6.z.string().describe("The site the provider opens cases on."),
+      providerKey: import_zod6.z.string().describe("The provider instance's secret key (Atlas: the instance secret key). Used for this one call, never stored."),
+      connector: import_zod6.z.object({ url: import_zod6.z.string(), method: import_zod6.z.enum(["PUT", "POST"]).optional(), body: import_zod6.z.record(import_zod6.z.unknown()) }).optional().describe('Only for a provider with no built-in connector: its https orchestrator URL and JSON body; a body value "{apiKey}" becomes the minted key.'),
+      dryRun: import_zod6.z.boolean().optional().describe("Show the key and the request that would be made, minting and sending nothing.")
+    },
+    (a) => client.integrations.connect(
+      a.provider,
+      { cbid: a.cbid, providerKey: a.providerKey, ...a.connector ? { connector: a.connector } : {} },
+      { dryRun: a.dryRun === true }
+    )
+  );
   tool(
     "advance_dsar",
     "Advance a DSAR to a new status (received \u2192 verifying \u2192 in_progress \u2192 completed, or rejected).",
@@ -1875,7 +1913,7 @@ ${JSON.stringify(r, null, 2)}` : r;
     (a) => client.sites.applyImport(a.cbid, a.data, a.overwrite ? { overwrite: true } : void 0)
   );
   const declarationShape = {
-    category: import_zod6.z.string().describe("necessary, preferences, statistics, marketing, or one of the site\u2019s categories.custom ids."),
+    category: import_zod6.z.string().describe("necessary, preferences, statistics, marketing, or one of the site\u2019s categories.suite or categories.custom ids."),
     purpose: import_zod6.z.string().describe("What the cookie does, as visitors will read it \u2014 and the fallback for any language purposes lacks."),
     purposes: import_zod6.z.record(import_zod6.z.string(), import_zod6.z.string().max(1e3)).nullable().optional().describe('The purpose in other languages, keyed by BCP-47 tag: {"es": "\u2026", "pt-BR": "\u2026"}. The banner, data-cc="declaration" and cookie-declaration.js draw the visitor\u2019s language. null clears.'),
     provider: import_zod6.z.string().optional(),
@@ -2425,7 +2463,7 @@ ${JSON.stringify(r, null, 2)}` : r;
 }
 
 // src/index.ts
-var MCP_VERSION = "0.7.1";
+var MCP_VERSION = "0.9.0";
 function createCookieMunchMcp(opts) {
   const client = opts.client ?? (0, import_sdk.createCookieMunch)({ apiKey: opts.apiKey, baseUrl: opts.baseUrl, userAgent: opts.userAgent ?? `cookiemunch-mcp/${MCP_VERSION}` });
   const server = new import_mcp.McpServer({ name: "cookiemunch", version: "1.0.0" });