@cookiemunch/sdk 0.0.0-stage → 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,1620 @@
+export { CONSENT_COOKIE_NAME, ConsentCategory, ConsentSource, ReadConsentOptions, ServerConsent, getConsent, isAllowed, parseConsentValue, readConsent } from './consent.js';
+
+/**
+ * Request/response shapes for the Cookie Munch Developer API (/v1). These mirror the
+ * server's dev-api surface; they are defined here (rather than imported) so the SDK
+ * has no runtime/workspace dependency on the server package.
+ */
+interface Identity {
+    orgId: string;
+    orgName?: string | null;
+    /** The EFFECTIVE plan — the one every feature gate and limit uses. */
+    plan: string;
+    /**
+     * Why: `org` = this org's own subscription (or free, or a reseller-managed `child` plan);
+     * `account` = another org with the same owner pays for a higher plan that covers this one.
+     */
+    planSource: PlanSource;
+    /** What this org subscribes to itself (`free` = no subscription of its own). */
+    subscribedPlan: string;
+    /** Features the effective plan unlocks (e.g. `whiteLabel`, `tcf`, `sso`, `abTesting`). */
+    features: string[];
+    keyPrefix: string;
+    /** null = full access. */
+    scopes?: string[] | null;
+    unscoped?: boolean;
+    propertyLocked?: boolean;
+    cbids?: string[];
+    reseller?: boolean;
+}
+type PlanSource = 'org' | 'account';
+/** One organisation on an account (GET /v1/orgs, and the `org_limit` refusal). */
+interface AccountOrg {
+    id: string;
+    name: string;
+    /** The effective plan. */
+    plan: string;
+    planSource: PlanSource;
+    subscribedPlan: string;
+    /** Present on a reseller-managed child organisation. */
+    parentOrgId?: string;
+    createdAt: number;
+    /** True for the organisation the calling key belongs to. */
+    current: boolean;
+}
+interface AccountOrgs {
+    orgs: AccountOrg[];
+    /** The per-account org cap: `max` (null = unlimited), the `plan` that sets it, and `used`. */
+    orgLimit: {
+        max: number | null;
+        plan: string;
+        used: number;
+    };
+    /** The dashboard billing page, where a plan is chosen. */
+    upgradeUrl: string;
+}
+interface Site {
+    cbid: string;
+    orgId: string;
+    domain: string;
+}
+interface SiteCreate {
+    domain: string;
+    /** Optional; the server auto-generates a cbid when omitted. */
+    cbid?: string;
+}
+/** Site config is an open, deeply-nested object owned by @cookiemunch/core. */
+type SiteConfig = Record<string, unknown>;
+interface ConsentDay {
+    Date: string;
+    OptIn: number;
+    OptOut: number;
+    OptInImplied: number;
+    OptInStrict: number;
+    TypeOptInPref: number;
+    TypeOptInStat: number;
+    TypeOptInMark: number;
+    Impressions: number;
+    Countries: Record<string, number>;
+}
+interface ConsentLogRow {
+    stamp: string;
+    receivedAt: number;
+    region: string;
+    method: string;
+    choices: {
+        preferences: boolean;
+        statistics: boolean;
+        marketing: boolean;
+    };
+    anonIp: string;
+    url: string;
+}
+interface RangeQuery {
+    from?: number;
+    to?: number;
+}
+interface LogQuery extends RangeQuery {
+    limit?: number;
+}
+type DsarType = 'access' | 'deletion' | 'rectification' | 'portability' | 'opt-out';
+type Regulation = 'gdpr' | 'ccpa';
+type DsarStatus = 'received' | 'verifying' | 'in_progress' | 'completed' | 'rejected';
+interface DsarRequest {
+    id: string;
+    type: DsarType;
+    subjectEmail: string;
+    regulation: Regulation;
+    status: DsarStatus;
+    createdAt: number;
+    dueAt: number;
+    /** Where the subject said they are, when the intake captured it. */
+    jurisdiction?: string;
+    note?: string;
+    /** A test request: off the SLA board, labelled, and deletable with `dsar.delete`. */
+    test?: boolean;
+}
+interface DsarCreate {
+    type: DsarType;
+    subjectEmail: string;
+    /** Picks the statutory response window. */
+    regulation: Regulation;
+    /**
+     * Where the subject says they are (ISO 3166 country or country-subdivision, e.g.
+     * `US-TX`). The response notice names the statute that governs there — without it a
+     * Texan is told their request was handled under a Virginia law, since every US state
+     * shares one `regulation` for the deadline.
+     */
+    jurisdiction?: string;
+    note?: string;
+    /** The property this request belongs to; decides which connected systems answer it. */
+    cbid?: string;
+    /** The subject's consent-receipt id. */
+    stamp?: string;
+    /**
+     * Mark it as a test: left out of SLA metrics and the deadline board, labelled as a test,
+     * and deletable with `dsar.delete(id)`. For end-to-end checks of a rights flow.
+     */
+    test?: boolean;
+}
+interface VendorInput {
+    name: string;
+    category: string;
+    dataShared: string[];
+    dpaSigned: boolean;
+    subprocessors: number;
+    certifications: string[];
+    region: string;
+}
+interface RiskScore {
+    score: number;
+    band: 'low' | 'medium' | 'high';
+}
+/** A stored vendor record (no computed risk; see {@link ScoredVendor}). Returned as the
+ *  `vendor` field of POST /v1/vendors. */
+interface VendorRecord extends VendorInput {
+    id: string;
+}
+/** A vendor as listed, with its computed risk flattened in. */
+interface ScoredVendor extends VendorRecord {
+    risk: RiskScore;
+}
+type LegalBasis = 'consent' | 'contract' | 'legal-obligation' | 'vital-interests' | 'public-task' | 'legitimate-interests';
+interface RopaInput {
+    name: string;
+    purpose: string;
+    legalBasis: LegalBasis;
+    dataCategories: string[];
+    recipients: string[];
+    retentionDays: number;
+    crossBorderTransfer: boolean;
+}
+interface RopaEntry extends RopaInput {
+    id: string;
+}
+/** A signed consent receipt (shape owned by @cookiemunch/receipts). */
+type SignedReceipt = Record<string, unknown>;
+/** How a preference-center opt-in was captured. Mirrors @cookiemunch/preferences OptInMethod. */
+type OptInMethod = 'single-opt-in' | 'double-opt-in';
+/**
+ * A subject's saved preference-center record (identity-keyed named purposes, distinct
+ * from the org-level {@link PreferenceItem} catalog). Matches @cookiemunch/preferences
+ * PreferenceRecord (mirrored here per this package's no-server-dependency convention).
+ * Returned wrapped as `{ record }` by POST /v1/preferences.
+ */
+interface PreferenceRecord {
+    subjectId: string;
+    purposes: Record<string, boolean>;
+    method: OptInMethod;
+    confirmed: boolean;
+    updatedAt: number;
+    version: number;
+}
+
+interface VerifyWebhookInput {
+    /** The raw request body, exactly as received. Do NOT re-stringify parsed JSON. */
+    payload: string;
+    /** The `X-CookieMunch-Signature` header value. */
+    signature: string | undefined | null;
+    /** The `X-CookieMunch-Timestamp` header value (unix seconds). */
+    timestamp: string | number | undefined | null;
+    /** The subscription secret (`whsec_…`), shown once when the webhook was created. */
+    secret: string;
+    /**
+     * Maximum age (in seconds) of a delivery before it is rejected as stale/replayed.
+     * Defaults to 300 (5 minutes). Pass 0 to disable the freshness check entirely.
+     */
+    toleranceSeconds?: number;
+    /** Current time in ms (injectable for tests); defaults to `Date.now()`. */
+    now?: number;
+}
+/**
+ * Returns true only when the signature is valid AND (unless disabled) the timestamp is fresh.
+ * Fail-closed: any missing/malformed input returns false rather than throwing.
+ */
+declare function verifyWebhookSignature(input: VerifyWebhookInput): boolean;
+
+/**
+ * @cookiemunch/sdk — a small, typed REST client for the Cookie Munch Developer API
+ * (the /v1 surface). Construct it with an API key; the org is derived server-side
+ * from the key, so callers never pass an orgId. `fetch` is injectable for testing
+ * and non-browser/non-Node runtimes; it defaults to the global fetch.
+ *
+ *   const fc = createCookieMunch({ apiKey: 'fck_…', baseUrl: 'https://cmp.example.com' });
+ *   const sites = await fc.sites.list();
+ */
+
+interface CookieMunchOptions {
+    apiKey: string;
+    /** e.g. "https://cmp.example.com" — the /v1 prefix is appended automatically. */
+    baseUrl: string;
+    /** Injectable for tests / custom runtimes. Defaults to the global fetch. */
+    fetch?: typeof fetch;
+}
+/**
+ * Thrown for any non-2xx response. `message` is the server's `error` field when present;
+ * `code` is populated from the server's `code` field whenever the error body carries one
+ * (e.g. banner-library conflicts, docs-admin checks) — not only for scoped-key
+ * (`insufficient_scope`) responses. It's `undefined` when the body has no `code`.
+ */
+declare class CookieMunchApiError extends Error {
+    readonly status: number;
+    readonly code?: string;
+    constructor(status: number, message: string, code?: string);
+}
+/** A cookie discovered on a site, classified into a consent category (wire shape of the
+ *  cookie-declaration feed). Matches the server's CategorizedCookie schema. */
+interface CategorizedCookie {
+    name: string;
+    category: 'necessary' | 'preferences' | 'statistics' | 'marketing' | 'unclassified' | (string & {});
+    domain?: string;
+    provider?: string;
+    purpose?: string;
+    expiry?: string;
+}
+/** A site's cookie declaration: the latest scan's categorized cookies. This is what
+ *  GET /v1/sites/:cbid/cookies actually returns (a wrapper, not a bare array). */
+interface CookieDeclaration {
+    /** Epoch-ms of the latest scan, or 0 if none. */
+    updatedAt: number;
+    cookies: CategorizedCookie[];
+}
+/** @deprecated The server returns {@link CookieDeclaration}; kept only for back-compat. */
+interface SiteCookie {
+    name: string;
+    domain: string;
+    category: string;
+    provider?: string;
+    purpose?: string;
+    expiry?: string;
+    firstSeen?: number;
+}
+/** Cookie-scan status, from GET /v1/sites/:cbid/scan. */
+interface ScanStatus {
+    status: 'idle' | 'scanning';
+    /** Epoch-ms of the last completed scan, or null. */
+    lastScannedAt: number | null;
+}
+/** @deprecated The server returns {@link ScanStatus}; kept only for back-compat. */
+interface ScanResult {
+    scanId: string;
+    status: 'queued' | 'running' | 'complete' | 'failed';
+    startedAt?: number;
+    finishedAt?: number;
+    pagesScanned?: number;
+    cookiesFound?: number;
+}
+/** A/B banner experiment results for a single variant. */
+interface AbResult {
+    variant: string;
+    impressions: number;
+    optIns: number;
+    optInRate: number;
+}
+/** The response shape of GET /v1/sites/:cbid/snippet. */
+interface InstallSnippet {
+    /** The exact `<script>` tag to paste into `<head>`. */
+    snippet: string;
+    /** URL of the consent.js embed file (the embed/CDN origin). */
+    src: string;
+    /** The API origin (beacons + consent-tcf.js). Present when the server reports it. */
+    api?: string;
+    /** The site identifier. */
+    cbid: string;
+    /** The blocking mode on the tag — the site's `blocking.mode` unless overridden. */
+    blockingMode: string;
+    /** Where `blockingMode` came from: the site's config, or the `blockingMode` option. */
+    blockingModeSource?: 'config' | 'query';
+    /** The tag's data-culture, when it has one. */
+    culture?: string;
+    /** CSP sources this site needs, by directive, plus a paste-able `policy`. */
+    csp?: CspSources;
+    /** Present when an override disagrees with the stored config. */
+    warnings?: ConfigWarning[];
+}
+/** Content Security Policy sources the embed needs. */
+interface CspSources {
+    script: string[];
+    connect: string[];
+    img: string[];
+    /** Always includes 'unsafe-inline' (the banner's shadow-root <style>), unless you use a nonce. */
+    style: string[];
+    font: string[];
+    frame: string[];
+    /** The same as one policy fragment. */
+    policy: string;
+}
+/** Something a config write did not store as sent. */
+interface ConfigWarning {
+    field: string;
+    reason: string;
+}
+/** One leaf a config write would change. */
+interface ConfigChange {
+    path: string;
+    from?: unknown;
+    to?: unknown;
+}
+/** What a config write would do (`?dryRun=1`) — nothing is saved. */
+interface ConfigDryRun {
+    dryRun: true;
+    /** The config as it would be saved. */
+    config: SiteConfig;
+    /** Every leaf that would change. */
+    diff: ConfigChange[];
+    warnings?: ConfigWarning[];
+}
+/** Options for POST /v1/sites/:cbid/preview-token. All optional. */
+interface PreviewTokenOptions {
+    /** Lifetime in seconds, 1..3600. Default 900. */
+    ttlSeconds?: number;
+    /** The page to preview. Default: the site's registered domain. */
+    url?: string;
+    /** Region to force: a country or subdivision code (`de`, `us-ca`) or `eu`. */
+    region?: string;
+    /** Language to force, as a BCP 47 tag (`de`, `pt-BR`). */
+    lang?: string;
+}
+/** A banner preview token, and the page URL that opens the preview. */
+interface PreviewToken {
+    cbid: string;
+    token: string;
+    /** Epoch milliseconds. */
+    expiresAt: number;
+    region?: string;
+    lang?: string;
+    /** The page with `cm_preview` / `cm_region` / `cm_lang` added. */
+    previewUrl?: string;
+}
+/** Options for the snippet endpoint. */
+interface SnippetOptions {
+    /** Override the site's configured `blocking.mode`. Default: the config's. */
+    blockingMode?: 'auto' | 'manual';
+    /** Language culture override, e.g. "en" or "fr". */
+    culture?: string;
+}
+/**
+ * The result of domain verification.
+ * Keep in sync with the POST /v1/sites/:cbid/verify response in
+ * packages/server/src/dev-api.ts (~L267) — note the server adds `method` on success,
+ * so this wire shape is wider than domain-verify.ts's internal VerifyResult.
+ */
+interface VerifyResult {
+    verified: boolean;
+    method?: 'dns' | 'meta' | 'file';
+    reason?: string;
+}
+/** A site brand suggestion ("Match my site"). Keep in sync with packages/server/src/brand-extract.ts BrandSuggestion. */
+interface BrandSuggestion {
+    background?: string;
+    text?: string;
+    highlight?: string;
+    fontFamily?: string;
+    fontUrl?: string;
+    palette?: string[];
+}
+/** The response shape of POST /v1/sites/:cbid/brand. */
+interface BrandExtractionResult {
+    suggestion: BrandSuggestion;
+}
+/** A validation/lint issue on a v2 banner flow. */
+interface FlowIssue {
+    code: string;
+    message: string;
+    path?: string;
+}
+/** A site's v2 banner flow + lint issues, from GET /v1/sites/:cbid/flow. */
+interface SiteFlow {
+    v: 2;
+    flow: Record<string, unknown>;
+    categories: Record<string, unknown>;
+    customCss?: string;
+    lint: FlowIssue[];
+}
+/**
+ * A single structured flow edit operation. `op` selects the kind; remaining fields are
+ * that op's args (e.g. { op: 'addView', id, surface, layoutMode }).
+ */
+type FlowOp = {
+    op: string;
+} & Record<string, unknown>;
+/**
+ * Result of editFlow/setFlow. On success the new flow is persisted and returned;
+ * on a validation/lint failure the config is NOT saved and `issues` says why.
+ */
+type FlowOpResponse = {
+    ok: true;
+    flow: Record<string, unknown>;
+} | {
+    ok: false;
+    failedAt?: number;
+    op?: unknown;
+    issues: FlowIssue[];
+};
+/** A reusable brand kit (colors/logo/typography) for banner theming. */
+interface BrandKit {
+    id: string;
+    orgId: string;
+    name: string;
+    /** Banner theme tokens (opaque design object). */
+    theme: Record<string, unknown>;
+    /** Optional banner content overrides (opaque). */
+    content?: Record<string, unknown>;
+    logoUrl?: string;
+    customCss?: string;
+}
+/** A configurable consent preference/purpose item. */
+interface PreferenceItem {
+    id: string;
+    orgId: string;
+    cbid?: string;
+    label: string;
+    description?: string;
+    category?: string;
+}
+/** An organization member. */
+interface Member {
+    userId: string;
+    email: string;
+    role: 'owner' | 'admin' | 'member' | 'viewer' | (string & {});
+}
+/** Display metadata for an issued key — never the secret. Returned by keys.list(). */
+interface ApiKeyPrefix {
+    prefix: string;
+    createdAt?: number;
+}
+/** A newly issued key. `key` is returned ONCE and never again. Returned by keys.issue(). */
+interface ApiKeyIssued {
+    key: string;
+    prefix: string;
+}
+/** @deprecated No endpoint returns this shape; use {@link ApiKeyPrefix} / {@link ApiKeyIssued}. */
+interface ApiKey {
+    id: string;
+    orgId: string;
+    prefix: string;
+    name?: string;
+    createdAt: number;
+    lastUsedAt?: number;
+    secret?: string;
+}
+/**
+ * Input for issuing a new API key.
+ *
+ * NOTE: the server's POST /v1/keys currently accepts no body and always mints an
+ * unscoped key — `name` is not yet honoured server-side. It's kept here (rather than
+ * dropped) so a future scoped/named-key endpoint can start reading it without an SDK
+ * major version bump; see {@link CookieMunchClient.keys}.
+ */
+interface ApiKeyIssueInput {
+    name?: string;
+    /** Least privilege: grant only these scopes. Omit for a full-access key. */
+    scopes?: string[];
+    /**
+     * Lock the key to these properties. A locked key works only on those sites and on no
+     * org-wide endpoint — see "Keys locked to properties" in the client reference.
+     */
+    cbids?: string[];
+    /** Expire the key after this many days (1–3650). */
+    expiresInDays?: number;
+}
+/** Org usage/quota summary. Matches the server's Usage schema. */
+interface Usage {
+    domains: number;
+    seats: number;
+    monthlyEvents: number;
+}
+/** A webhook subscription. `secret` is present only in the create response. */
+interface WebhookSubscription {
+    id: string;
+    orgId: string;
+    url: string;
+    secret?: string;
+    events: string[];
+    cbid: string | null;
+    active: boolean;
+    createdAt: number;
+}
+/** One cookie read from another CMP's export. */
+interface ImportedCookie {
+    name: string;
+    domain: string;
+    /** Ours, or `unclassified` when their category did not map to one. */
+    category: 'necessary' | 'preferences' | 'statistics' | 'marketing' | 'unclassified';
+    /** What the previous vendor called it, kept for review. */
+    sourceCategory: string;
+    purpose: string;
+    provider: string;
+    expiry: string;
+}
+/** What a competitor's cookie-declaration export contained, in our vocabulary. */
+interface ImportedDeclaration {
+    source: 'onetrust' | 'cookiebot' | 'cookieyes' | 'unknown';
+    cookies: ImportedCookie[];
+    /** Rows whose category could not be placed — review these first. */
+    unmapped: Array<{
+        name: string;
+        category: string;
+    }>;
+}
+/**
+ * A page that refused to load the banner renderer. The site is live and configured, so
+ * every other signal looks healthy; this is the one that says nobody can be asked.
+ */
+interface BlockedReport {
+    cbid: string;
+    /** Origin of the page the embed was running on. */
+    page: string;
+    /** The bundle URL that page refused. */
+    url: string;
+    reason: string;
+    firstSeen: number;
+    lastSeen: number;
+    /** How many times this page has reported. Repeats are counted, not stored. */
+    count: number;
+}
+/** A webhook delivery that failed every retry. Replay it by `id`. */
+interface WebhookDeadLetter {
+    id: string;
+    orgId: string;
+    subscriptionId: string;
+    url: string;
+    eventType: string;
+    cbid: string | null;
+    payload: unknown;
+    attempts: number;
+    lastStatus?: number;
+    lastError?: string;
+    failedAt: number;
+}
+/** What a test delivery's endpoint answered. */
+interface WebhookTestResult {
+    ok: boolean;
+    status?: number;
+    error?: string;
+}
+/** The key's organisation. */
+interface Org {
+    id: string;
+    name: string;
+    plan: string;
+    logoUrl: string | null;
+}
+/** Change an org's name or logo. `logoUrl: null` removes the logo. */
+interface OrgUpdate {
+    name?: string;
+    logoUrl?: string | null;
+}
+/** One entry in the org's audit log. */
+interface AuditEntry {
+    id: string;
+    orgId: string;
+    actorUserId: string;
+    actorEmail?: string;
+    action: string;
+    target?: string;
+    meta?: Record<string, unknown>;
+    at: number;
+}
+/** Rename a key, or replace its scopes or the properties it is locked to. */
+interface ApiKeyUpdate {
+    name?: string;
+    scopes?: string[];
+    cbids?: string[];
+}
+/** An image to upload: base64 (or a `data:` URL) plus its type. */
+interface AssetUpload {
+    data: string;
+    contentType: 'image/png' | 'image/jpeg' | 'image/webp' | 'image/gif' | 'image/svg+xml';
+}
+/** Result of erasing a subject's consent for a deletion request. */
+interface DsarEraseResult {
+    erased: number;
+    encryptionEnabled: boolean;
+    /** Present when no KEK is configured, so nothing was cryptographically erased. */
+    warning?: string;
+    request: DsarRequest;
+}
+/** Result of exporting a subject's consent for an access or portability request. */
+interface DsarExportResult {
+    records: unknown[];
+    count: number;
+    request: DsarRequest;
+}
+/** Input for creating a webhook subscription. */
+interface WebhookCreate {
+    url: string;
+    events: string[];
+    cbid?: string;
+}
+/** Fields to change on a webhook subscription. Only those present are sent. */
+interface WebhookUpdate {
+    url?: string;
+    events?: string[];
+    /** One property, or null for every property in the org. */
+    cbid?: string | null;
+    /** false pauses delivery without deleting the subscription. */
+    active?: boolean;
+}
+/** One site to create in a bulk call. */
+interface BulkSiteInput {
+    domain: string;
+    cbid?: string;
+    platform?: string;
+}
+/** Per-item outcome of a bulk create, in input order. */
+interface BulkSiteResult {
+    ok: boolean;
+    cbid?: string;
+    domain?: string;
+    error?: string;
+}
+/** Input for creating a brand kit. */
+interface BrandKitCreate {
+    name: string;
+    theme: unknown;
+    content?: unknown;
+    logoUrl?: string;
+    customCss?: string;
+}
+/** A lightweight summary of an account-level banner, as returned by GET /v1/banners. */
+interface BannerSummary {
+    id: string;
+    name: string;
+    updatedAt: number;
+    assignedCbids: string[];
+}
+/** A full account-level banner record, including its config JSON. */
+interface BannerRecord {
+    id: string;
+    orgId: string;
+    name: string;
+    json: SiteConfig;
+    createdAt: number;
+    updatedAt: number;
+}
+/**
+ * Input for the public consent-log ingest endpoint (POST /api/v1/consent) — the
+ * tamper-evident, hash-chained ledger write the browser embed makes. Mirrors the
+ * server's ConsentPayload; optional fields are sent only when set. Records are
+ * anonymised (IP truncated) and hash-chained server-side.
+ */
+interface ConsentIngestInput {
+    /** The registered site id the consent belongs to. */
+    cbid: string;
+    /** Stable per-subject consent-receipt id (used for erase/export). */
+    stamp: string;
+    /** The subject's cookie-category choices. */
+    choices: {
+        preferences: boolean;
+        statistics: boolean;
+        marketing: boolean;
+    };
+    /** How consent was captured. */
+    method: 'explicit' | 'implied';
+    /** Consent/notice version number. */
+    ver: number;
+    /** Epoch-ms the decision was made. */
+    utc: number;
+    /** The URL / screen where consent was captured. */
+    url: string;
+    /** Optional IAB TCF consent string (TCF mode only). */
+    tcString?: string;
+    /** Optional GPP string (GPP mode only). */
+    gppString?: string;
+    /** Optional named-purpose map beyond the standard categories. */
+    purposes?: Record<string, boolean>;
+    /** Optional opaque digest of the exact notice text shown to the subject. */
+    subjectPolicyHash?: string;
+    /** Optional map: named purpose → RoPA entry id. */
+    purposeRopa?: Record<string, string>;
+    /** Optional A/B variant id. */
+    variant?: string;
+    /**
+     * Optional, app-supplied STABLE cross-surface subject id. Lets an org retrieve one
+     * subject's consent history across ALL its sites/surfaces (web + mobile + desktop).
+     * Opaque — stored and bound into the record hash server-side, never interpreted.
+     */
+    subjectId?: string;
+}
+/** One of a person's identifiers: an identity-space code plus the normalised value. */
+interface Identifier {
+    space: string;
+    value: string;
+}
+interface ConsentDecisionInput {
+    purpose: string;
+    allowed: boolean;
+    legalBasis?: string;
+    jurisdiction?: string;
+    provenance?: string;
+    collectedAt?: number;
+}
+interface ProfileAttributeInput {
+    value: string;
+    purpose?: string;
+    collectedAt?: number;
+}
+interface SubscriptionTopicInput {
+    code: string;
+    name?: string;
+    channels: string[];
+    downstream?: Record<string, string>;
+}
+/** A warehouse-native enforcement rule. See POST /v1/discovery/enforcement. */
+interface EnforcementRuleInput {
+    id: string;
+    action: 'mask' | 'restrict';
+    /** Select columns at or above this sensitivity. */
+    minSensitivity?: 'personal' | 'sensitive';
+    /** Select columns in any of these categories. */
+    categories?: string[];
+    /** mask: roles that still see the raw value. */
+    allowRoles?: string[];
+    /** restrict: the purpose a subject must have consented to. */
+    purpose?: string;
+    /** restrict: the column holding the subject id. Default SUBJECT_ID. */
+    subjectColumn?: string;
+}
+interface RegulationSummary {
+    id: string;
+    jurisdiction: string;
+    name: string;
+    /** ISO date the law takes (or took) effect. */
+    effective: string;
+    model: 'opt-in' | 'opt-out';
+    obligations: string[];
+    /** Primary source — the statute or the regulator. */
+    source: string;
+}
+interface RegulatoryFeedResult {
+    /** When a human last checked the dataset against its sources. */
+    reviewedAt: string;
+    /** Days since that review. */
+    ageDays: number;
+    /** How long a review is considered good for. */
+    reviewAfterDays: number;
+    /** True once the review interval has passed — treat the answer with caution. */
+    stale: boolean;
+    regulations: RegulationSummary[];
+}
+interface AiInspectInput {
+    prompt: string;
+    purpose: string;
+    model?: string;
+    actor?: string;
+    direction?: 'prompt' | 'response';
+    /** The subject's current permits, when the call concerns an identified person. */
+    consent?: Record<string, boolean>;
+}
+interface AiInspectResult {
+    action: 'allow' | 'redact' | 'block';
+    /** The text to forward: redacted when `redact`, empty when `block`. */
+    prompt: string;
+    findings: unknown[];
+    reasons: string[];
+    policyIds: string[];
+    blocked: boolean;
+    direction: 'prompt' | 'response';
+}
+type FulfillmentOp = 'locate' | 'export' | 'erase' | 'optOut';
+/** A child org provisioned by a reseller. */
+interface ResellerChild {
+    id: string;
+    name: string;
+    status: 'active' | 'suspended';
+    delegatedAccess?: boolean;
+    /** Per-child DSAR routing override; unset defers to the reseller's policy. */
+    dsarRouting?: 'reseller' | 'child';
+    createdAt?: number;
+    usage?: unknown;
+}
+interface ResellerChildList {
+    children: ResellerChild[];
+    /** Pooled usage across the reseller and all its children, when metering is wired. */
+    aggregate?: {
+        childOrgs: number;
+        sites: number;
+        monthlyEvents: number;
+        monthlyEventsCap: number | null;
+        overCap: boolean;
+    };
+}
+interface ResellerChildCreate {
+    name: string;
+    ownerEmail?: string;
+    /** legalName, contactEmail, address, dpoContact. */
+    controller?: Record<string, unknown>;
+    /** Branding overrides, merged onto the reseller's white-label defaults. */
+    whiteLabel?: Record<string, unknown>;
+    delegatedAccess?: boolean;
+    /** Also issue an API key for the new child; it is returned once, as `apiKey`. */
+    mintKey?: boolean;
+    /** Scopes for that key. Defaults to ["sites:read"]. */
+    keyScopes?: string[];
+}
+interface ResellerChildPatch {
+    status?: 'active' | 'suspended';
+    delegatedAccess?: boolean;
+    /** Pin this child's DSAR routing; null clears the override. */
+    dsarRouting?: 'reseller' | 'child' | null;
+    controller?: Record<string, unknown>;
+}
+interface ChildKeyInput {
+    name?: string;
+    scopes?: string[];
+    /** Lock the key to these properties of the child org. */
+    cbids?: string[];
+}
+interface PolicyOptions {
+    /** Contact email shown in the policy. Falls back to the org controller's, then the owner's. */
+    contactEmail?: string;
+    /** YYYY-MM-DD. Defaults to today. */
+    effectiveDate?: string;
+    /** Override the jurisdictions the policy addresses. */
+    jurisdictions?: string[];
+}
+interface AdPersonalizationInput {
+    enabled: boolean;
+    /** Whether personalised ads start on before the visitor chooses. */
+    default?: boolean;
+    label?: string;
+}
+interface SessionAnalysisInput {
+    /** A HAR export of the captured session. */
+    har?: unknown;
+    /** Or the requests directly. */
+    requests?: unknown[];
+    /** The consent state the session ran under. */
+    consent?: Record<string, boolean>;
+    /** Whether Global Privacy Control was set. */
+    gpc?: boolean;
+}
+/**
+ * How to drive one system's rights API, as data. This is what makes a connection specific to
+ * a platform — Cookie Munch names none of them, so connecting a new system is a profile
+ * rather than a release. Paths are relative to `baseUrl`; placeholders are `{email}`,
+ * `{subject}`, `{operation}`, `{correlation}` and `{id}`.
+ */
+interface ExecutorProfile {
+    /** How requests carry the credential. Defaults to `Authorization: Bearer {secret}`. */
+    auth?: {
+        header: string;
+        format: string;
+    };
+    /**
+     * Optional first step: turn the subject's email into the id this system uses. `noMatch`
+     * names how the system says "no record of that person" in its body — a sentinel id is
+     * never read as a person when it is set.
+     */
+    subjectLookup?: {
+        method: 'GET' | 'POST';
+        path: string;
+        body?: unknown;
+        idPath: string;
+        noMatch?: {
+            statusPath: string;
+            values: string[];
+        };
+    };
+    /** Response header carrying the system's version, recorded in the task log. Default `X-Version`. */
+    versionHeader?: string;
+    /** How to open a request. An operation left out of `operations` is one this system does not run. */
+    open: {
+        method: 'POST' | 'PUT';
+        path: string;
+        body?: unknown;
+        operations: {
+            export?: string;
+            erase?: string;
+        };
+        idPath: string;
+        statusPath?: string;
+    };
+    /** How to ask how it is going. Polling is the truth; a webhook only prompts a check. */
+    poll: {
+        method?: 'GET';
+        path: string;
+        statusPath: string;
+        resultPath?: string;
+        /** Whether `resultPath` holds the bundle itself or a URL to fetch it from. */
+        resultIs?: 'inline' | 'url';
+        /** Where a date the work is waiting for lives (an erasure in a grace period). */
+        scheduledPath?: string;
+    };
+    /** That system's status words → the three answers a sub-task can have. */
+    statuses: {
+        running: string[];
+        done: string[];
+        failed: string[];
+    };
+    idempotencyHeader?: string;
+    /** How that system signs its webhooks, if it sends any. */
+    webhook?: {
+        algorithm: 'hmac-sha256';
+        /** Must include `{body}`, or the signature proves nothing about it. */
+        signedPayload: string;
+        headers: {
+            signature: string;
+            timestamp?: string;
+            id?: string;
+        };
+        encoding?: 'base64' | 'hex';
+        prefix?: string;
+        toleranceSeconds?: number;
+        timestampUnit?: 'seconds' | 'milliseconds' | 'auto';
+    };
+}
+/** A system connected to run part of a rights request. Credentials are never included. */
+interface DsarExecutor {
+    id: string;
+    /** The name it answers to in a fulfillment plan, e.g. `identity` or `crm`. */
+    system: string;
+    profile: ExecutorProfile;
+    baseUrl: string;
+    keyPrefix: string;
+    hasWebhookSecret: boolean;
+    /** Open a sub-task automatically when a request reaches fulfilment. */
+    auto: boolean;
+    createdAt: number;
+}
+interface DsarExecutorInput {
+    /** The name this connection answers to in a plan, e.g. `identity` or `crm`. */
+    system: string;
+    /** The system's public https origin. */
+    baseUrl: string;
+    /** Its API key. Stored encrypted; never returned. */
+    secretKey: string;
+    /** The signing secret of its webhook endpoint. Optional — polling closes tasks without it. */
+    webhookSecret?: string;
+    auto?: boolean;
+    /** How to drive it. */
+    profile: ExecutorProfile;
+}
+interface DsarExecutorCreated extends DsarExecutor {
+    /** Point the connected system's webhook endpoint here. */
+    webhookUrl: string;
+}
+/** One entry in a fulfilment task's status history. */
+interface DsarTaskEvent {
+    at: number;
+    kind: 'created' | 'changed' | 'version_changed';
+    status: 'pending' | 'running' | 'done' | 'failed';
+    detail?: string;
+    outcome?: DsarTaskOutcome;
+    scheduledFor?: number;
+    externalRef?: string;
+}
+/** What a task's answer means for the person. `exported` only once the export was fetched. */
+type DsarTaskOutcome = 'located' | 'exported' | 'erased' | 'no_record' | 'done_without_artifact' | 'not_applicable';
+/** One request made to a connected system on a task's behalf, credentials removed. Kept 30 days. */
+interface DsarTaskLogEntry {
+    id?: string;
+    system?: string;
+    step: 'lookup' | 'open' | 'poll' | 'export';
+    method: string;
+    path: string;
+    /** Absent when the system never answered. */
+    status?: number;
+    latencyMs: number;
+    requestHeaders?: Record<string, string>;
+    /** The first ~2 KB of what was sent. */
+    request?: string;
+    /** The first ~2 KB of what came back. */
+    response?: string;
+    error?: string;
+    /** The system's version header on this answer. */
+    version?: string;
+    at: number;
+}
+/** One fulfilment task with its history and its upstream request log. */
+interface DsarTask {
+    id: string;
+    requestId: string;
+    system: string;
+    operation: FulfillmentOp;
+    status: 'pending' | 'running' | 'done' | 'failed';
+    detail?: string;
+    outcome?: DsarTaskOutcome;
+    attempts: number;
+    executor?: string;
+    externalRef?: string;
+    scheduledFor?: number;
+    artifacts?: Array<{
+        kind: string;
+        system: string;
+        ref: string;
+    }>;
+    createdAt: number;
+    updatedAt: number;
+    events: DsarTaskEvent[];
+    log: DsarTaskLogEntry[];
+    /** Versions the system reported while working on this task, in order of change. */
+    upstreamVersions?: string[];
+    /** The system was redeployed while this task was in flight. */
+    versionChanged: boolean;
+}
+/** What testing a connection found. Nothing was filed. */
+interface ExecutorTestResult {
+    system: string;
+    /** Did the lookup find the person; null when there is no lookup step or it failed. */
+    matched: boolean | null;
+    subject?: string;
+    operationWord?: string;
+    /** The open request a real request would send, when it was not sent. */
+    wouldSend?: {
+        method: string;
+        path: string;
+        body: unknown;
+    };
+    /** One sentence: what a real request would have done. */
+    verdict: string;
+    ok: boolean;
+    /** Every upstream answer, as the system gave it (credentials removed). */
+    exchanges: DsarTaskLogEntry[];
+}
+interface ExecutorTestInput {
+    email: string;
+    /** Default `locate`. */
+    operation?: 'locate' | 'export' | 'erase';
+    /** For `export` only: open a real export and poll it once. An erasure is never sent. */
+    open?: boolean;
+}
+interface DsarTaskExport {
+    system: string;
+    ref: string;
+    /** The bundle as that system returned it. Not stored here. */
+    bundle: unknown;
+}
+/** A language the banner already has copy for. */
+interface SupportedLanguage {
+    /** BCP-47 tag, lowercase. Matched exactly, then by language prefix. */
+    code: string;
+    /** English name. */
+    name: string;
+    /** The language's name in itself. */
+    endonym: string;
+    /** Written right to left; the banner flips for these. */
+    rtl: boolean;
+    /** `bundled` ships in consent.js; `extended` ships in the renderer, fetched when a banner is first drawn. */
+    source: 'bundled' | 'extended';
+}
+interface CookieMunchClient {
+    me(): Promise<Identity>;
+    /**
+     * Languages the banner already speaks. Diff this against the locales your visitors
+     * use to see which ones you still need to write copy for in `banner.i18n`.
+     */
+    languages(): Promise<SupportedLanguage[]>;
+    orgs: {
+        /**
+         * Every organisation on this key's account, each with its effective plan and where that
+         * comes from, plus the per-account org cap and the upgrade URL. Needs an unscoped key that
+         * is not locked to properties.
+         */
+        list(): Promise<AccountOrgs>;
+        /**
+         * Create a sibling organisation owned by the same account — for a separate business of
+         * your own. Needs an unscoped key. Not reseller provisioning, which is for your customers.
+         */
+        create(name: string, opts?: {
+            mintKey?: boolean;
+            keyScopes?: string[];
+        }): Promise<{
+            org: {
+                id: string;
+                name: string;
+                role: string;
+            };
+            apiKey?: string;
+            keyError?: string;
+        }>;
+    };
+    sites: {
+        list(): Promise<Site[]>;
+        create(input: SiteCreate): Promise<Site>;
+        get(cbid: string): Promise<Site>;
+        delete(cbid: string): Promise<void>;
+        getConfig(cbid: string): Promise<SiteConfig>;
+        /** Replaces the whole config — a top-level field you omit reverts to its default. */
+        putConfig(cbid: string, config: SiteConfig): Promise<SiteConfig>;
+        /** Changes some of the config — omitted fields keep their stored value. */
+        patchConfig(cbid: string, config: Partial<SiteConfig>): Promise<SiteConfig>;
+        /**
+         * Preview a config write without saving it: the merged result and a diff. `mode: 'put'`
+         * previews a replace (the diff then lists everything that would revert to its default).
+         */
+        dryRunConfig(cbid: string, config: Partial<SiteConfig>, opts?: {
+            mode?: 'patch' | 'put';
+        }): Promise<ConfigDryRun>;
+        cookies(cbid: string): Promise<CookieDeclaration>;
+        scan(cbid: string): Promise<ScanStatus>;
+        scanStatus(cbid: string): Promise<ScanStatus>;
+        ab(cbid: string): Promise<AbResult[]>;
+        /** Generate the site's privacy and cookie policy, as Markdown. */
+        policy(cbid: string, opts?: PolicyOptions): Promise<string>;
+        /** Turn on the personalised-ads split on whichever banner form the site uses. */
+        setAdPersonalization(cbid: string, input: AdPersonalizationInput): Promise<unknown>;
+        /** Analyse a captured session: trackers that fired after opt-out, personal data leaving the page. */
+        analyzeSession(cbid: string, input: SessionAnalysisInput): Promise<unknown>;
+        /** Which banner design this site uses, or null when none is assigned. */
+        banner(cbid: string): Promise<{
+            bannerId: string | null;
+        }>;
+        /**
+         * Pages where the embed could not load its banner renderer — the host page's CSP or
+         * Trusted Types policy refused it, so nobody on that page can be asked. An empty list
+         * is the healthy answer.
+         */
+        blocked(cbid: string): Promise<{
+            reports: BlockedReport[];
+        }>;
+        /**
+         * Read a cookie declaration exported from another CMP and translate its categories
+         * into ours. Nothing is applied: their vocabulary is not ours, and a cookie in the
+         * wrong category is a tag firing against a refusal, so the result is for review.
+         */
+        importDeclaration(cbid: string, data: string): Promise<ImportedDeclaration>;
+        snippet(cbid: string, opts?: SnippetOptions): Promise<InstallSnippet>;
+        /**
+         * Mint a short-lived signed token to see the banner as a visitor in a given region and
+         * language sees it — even from a headless browser, and without recording anything.
+         */
+        previewToken(cbid: string, opts?: PreviewTokenOptions): Promise<PreviewToken>;
+        verify(cbid: string, method: 'dns' | 'meta' | 'file' | 'embed'): Promise<VerifyResult>;
+        /** Exactly what to publish to prove control of the domain, for each verification method. */
+        verifyChallenge(cbid: string): Promise<unknown>;
+        /** Create up to 100 sites. Partial success: a bad or duplicate item fails only itself. */
+        createBulk(sites: BulkSiteInput[]): Promise<{
+            results: BulkSiteResult[];
+        }>;
+        brand(cbid: string): Promise<BrandExtractionResult>;
+        /** Read a site's v2 banner flow (views, categories) plus any lint issues. */
+        getFlow(cbid: string): Promise<SiteFlow>;
+        /** Apply an ordered batch of structured edit ops; validated + persisted if lint-clean. */
+        editFlow(cbid: string, operations: FlowOp[]): Promise<FlowOpResponse>;
+        /** Wholesale-replace the flow with a full v2 config; validated + persisted if valid. */
+        setFlow(cbid: string, config: Record<string, unknown>): Promise<FlowOpResponse>;
+    };
+    consent: {
+        /**
+         * Verify the consent log's tamper-evident hash chain. Each record carries the hash of the
+         * one before it, so an edited, reordered or removed record answers `false`. This is the
+         * evidence behind the log: proof that what it says today is what it said when written.
+         */
+        verify(cbid: string): Promise<{
+            valid: boolean;
+        }>;
+        stats(cbid: string, query?: RangeQuery): Promise<ConsentDay[]>;
+        log(cbid: string, query?: LogQuery): Promise<ConsentLogRow[]>;
+        export(cbid: string, query?: RangeQuery): Promise<string>;
+        receipt(cbid: string, stamp: string): Promise<SignedReceipt>;
+        /** Crypto-erase a subject's consent records by their consent-receipt stamp. Irreversible. */
+        eraseSubject(cbid: string, stamp: string): Promise<{
+            erased: number;
+        }>;
+        /** Export a data subject's consent records by their consent-receipt stamp (GDPR access/portability). */
+        exportSubject(cbid: string, stamp: string): Promise<{
+            cbid: string;
+            stamp: string;
+            records: unknown[];
+            count: number;
+        }>;
+        /** Record a consent decision via the PUBLIC ingest endpoint (POST /api/v1/consent). No `/v1`
+         *  prefix and no auth is required by the server (the cbid must be a registered site); for
+         *  server-side / non-browser consent flows. Pass `subjectId` to correlate a subject cross-surface. */
+        ingest(input: ConsentIngestInput): Promise<void>;
+    };
+    dsar: {
+        list(): Promise<DsarRequest[]>;
+        /**
+         * One request, in the same shape `list` returns — note that `create` answers with it
+         * wrapped as `{ request }`, so `create(...).request.id` is what you pass here.
+         */
+        get(id: string): Promise<DsarRequest>;
+        create(input: DsarCreate): Promise<{
+            request: DsarRequest;
+        }>;
+        advance(id: string, toStatus: DsarStatus): Promise<{
+            request: DsarRequest;
+        }>;
+        /** The subject-facing response notice for a request, as plain text. */
+        response(id: string): Promise<string>;
+        /**
+         * Erase a subject's consent records on one site, for a deletion request past identity
+         * verification. Noted on the request. Requires dsar:write and consent:write.
+         */
+        erase(id: string, cbid: string, stamp: string): Promise<DsarEraseResult>;
+        /**
+         * A subject's consent records on one site, for an access or portability request past
+         * identity verification. Noted on the request. Requires dsar:write and consent:read.
+         */
+        export(id: string, cbid: string, stamp: string): Promise<DsarExportResult>;
+        /**
+         * Delete a TEST request (created with `test: true`), with its tasks and their log. A
+         * real request cannot be deleted (409 `not_a_test_request`); the deletion is audited.
+         */
+        delete(id: string): Promise<void>;
+    };
+    vendors: {
+        list(): Promise<ScoredVendor[]>;
+        create(input: VendorInput): Promise<{
+            vendor: VendorRecord;
+            risk: RiskScore;
+        }>;
+    };
+    ropa: {
+        list(): Promise<RopaEntry[]>;
+        create(input: RopaInput): Promise<{
+            entry: RopaEntry;
+        }>;
+        /** The org's RoPA (GDPR Art. 30) as CSV. */
+        exportCsv(): Promise<string>;
+    };
+    brandKits: {
+        list(): Promise<BrandKit[]>;
+        create(input: BrandKitCreate): Promise<{
+            kit: BrandKit;
+        }>;
+        delete(id: string): Promise<void>;
+    };
+    /**
+     * Identity resolution. Reads are POSTs on purpose: a person's identifiers travel in the
+     * body, never a URL where they would land in access logs.
+     */
+    identity: {
+        /** Canonical subject id for any known identifier, else null. */
+        resolve(identifiers: Identifier[]): Promise<{
+            subjectId: string | null;
+        }>;
+        /** Stitch identifiers into one subject (merging clusters when a link bridges them). */
+        link(identifiers: Identifier[]): Promise<{
+            subjectId: string;
+        }>;
+        cluster(subjectId: string): Promise<{
+            subjectId: string;
+            identifiers: Identifier[];
+        }>;
+    };
+    /** The Permission Vault: a resolved person's current consent state. */
+    vault: {
+        record(identifiers: Identifier[], decisions: ConsentDecisionInput[]): Promise<{
+            subjectId: string;
+            permits: unknown[];
+        }>;
+        current(identifiers: Identifier[]): Promise<{
+            purposes: Record<string, boolean>;
+        }>;
+        permits(identifiers: Identifier[]): Promise<{
+            permits: unknown[];
+        }>;
+    };
+    /** The unified profile, with consent enforced at ACTIVATION time. */
+    profile: {
+        get(identifiers: Identifier[]): Promise<unknown>;
+        setAttributes(identifiers: Identifier[], attributes: Record<string, ProfileAttributeInput>): Promise<{
+            subjectId: string;
+        }>;
+        /** Attribute values usable for `purpose` — {} when the person hasn't consented to it. */
+        activate(identifiers: Identifier[], purpose: string): Promise<{
+            attributes: Record<string, string>;
+        }>;
+    };
+    /** Marketing preferences as topics x channels. */
+    subscriptions: {
+        /** The org's topic catalog — what a subject can subscribe TO. */
+        topics(): Promise<{
+            topics: SubscriptionTopicInput[];
+        }>;
+        /** Replace the catalog. It is authored whole, not patched. */
+        setTopics(topics: SubscriptionTopicInput[]): Promise<{
+            topics: SubscriptionTopicInput[];
+        }>;
+        get(subjectId: string): Promise<unknown>;
+        set(subjectId: string, topic: string, channel: string, optedIn: boolean): Promise<unknown>;
+        unsubscribeAll(subjectId: string): Promise<unknown>;
+        resubscribe(subjectId: string): Promise<unknown>;
+        activation(subjectId: string, topics: SubscriptionTopicInput[]): Promise<{
+            entries: unknown[];
+        }>;
+    };
+    /** DPIA / PIA / LIA / TIA / AI-impact / vendor assessments. */
+    assessments: {
+        templates(): Promise<{
+            templates: unknown[];
+        }>;
+        list(): Promise<{
+            assessments: unknown[];
+        }>;
+        start(template: string, subject: string): Promise<unknown>;
+        /** The record plus its derived score, completeness and SME routing. */
+        get(id: string): Promise<unknown>;
+        answer(id: string, questionId: string, value: string | number | boolean): Promise<unknown>;
+        /** Fill from the org's latest data map; never overwrites a human answer. */
+        autoPopulateFromMap(id: string): Promise<{
+            assessment: unknown;
+            applied: string[];
+        }>;
+        /** Fill from evidence you supply. Never overwrites a human answer; records `source` as provenance. */
+        autoPopulate(id: string, evidence: Record<string, unknown>, source?: string): Promise<{
+            assessment: unknown;
+            applied: string[];
+        }>;
+        submit(id: string): Promise<unknown>;
+        approve(id: string, by: string): Promise<unknown>;
+        reject(id: string, by: string, reason: string): Promise<unknown>;
+    };
+    /** The data map produced by an in-environment scan (metadata only). */
+    discovery: {
+        ingestMap(map: unknown): Promise<{
+            scannedAt: number;
+            systems: number;
+        }>;
+        getMap(): Promise<unknown>;
+        ropaDrafts(): Promise<{
+            drafts: unknown[];
+        }>;
+        evidence(): Promise<{
+            evidence: Record<string, unknown>;
+        }>;
+        /** What changed since the last scan, and where the RoPA disagrees with reality. */
+        drift(): Promise<{
+            comparedTo: number | null;
+            sinceLastScan: unknown[];
+            againstRecord: unknown[];
+        }>;
+        /**
+         * Plan warehouse-native policy from the latest map. Returns a PLAN with its own
+         * revert — nothing is applied to your warehouse by calling this.
+         */
+        planEnforcement(dialect: 'postgres' | 'mysql' | 'snowflake', rules: EnforcementRuleInput[], opts?: {
+            permitsTable?: string;
+            policyPrefix?: string;
+        }): Promise<{
+            plan: {
+                statements: unknown[];
+                revert: unknown[];
+                skipped: unknown[];
+            };
+        }>;
+    };
+    /**
+     * Regulatory intelligence: the curated privacy-law dataset. Every response carries
+     * `reviewedAt` — the dataset ships with the product and is only as current as its
+     * last review. Not legal advice.
+     */
+    regulatory: {
+        /** The dataset, optionally narrowed to the jurisdictions you operate in. */
+        feed(jurisdictions?: string[]): Promise<RegulatoryFeedResult>;
+        /** What takes effect within `days` (default 180), soonest first. */
+        upcoming(days?: number): Promise<RegulatoryFeedResult>;
+    };
+    /** AI governance: policy, the inline gateway, inventory and lineage. */
+    ai: {
+        getPolicy(): Promise<{
+            policy: unknown;
+            configured: boolean;
+        }>;
+        setPolicy(policy: unknown): Promise<{
+            policy: unknown;
+        }>;
+        /** Enforce consent + policy on a prompt or response. Requires the ai:inspect scope. */
+        inspect(input: AiInspectInput): Promise<AiInspectResult>;
+        inventory(): Promise<{
+            systems: unknown[];
+            shadow: unknown[];
+        }>;
+        lineage(): Promise<{
+            lineage: Record<string, string[]>;
+        }>;
+        registerSystem(input: {
+            id: string;
+            name: string;
+            provider?: string;
+            purpose?: string;
+        }): Promise<unknown>;
+        /** The AI systems declared with registerSystem. */
+        systems(): Promise<unknown>;
+        audit(limit?: number): Promise<{
+            entries: unknown[];
+        }>;
+    };
+    /** DSR fulfillment: plan work per system, poll it from an in-VPC agent, report outcomes. */
+    fulfillment: {
+        sla(): Promise<unknown>;
+        plan(requestId: string, systems: Array<{
+            system: string;
+            operation: FulfillmentOp;
+        }>, includeHistorical?: boolean): Promise<{
+            requestId: string;
+            tasks: unknown[];
+        }>;
+        status(requestId: string): Promise<unknown>;
+        /** In-VPC agent: poll pending tasks. */
+        pendingTasks(limit?: number): Promise<{
+            tasks: unknown[];
+        }>;
+        /** In-VPC agent: report an outcome. Only the outcome crosses the boundary. */
+        reportTask(taskId: string, ok: boolean, error?: string): Promise<unknown>;
+        /**
+         * Systems you have connected that run part of a request themselves — an identity
+         * platform holding your users' accounts, for instance. The in-VPC agent covers the
+         * systems we cannot reach; these are the ones we can.
+         */
+        executors(): Promise<DsarExecutor[]>;
+        /**
+         * Connect one. The secret is stored encrypted and never returned; the response carries
+         * the URL to point that system's webhook at.
+         */
+        connectExecutor(input: DsarExecutorInput): Promise<DsarExecutorCreated>;
+        /**
+         * Change a connection in place. Only what you send changes, and the stored credential
+         * is kept unless you pass a new `secretKey` — so adding a field to a profile does not
+         * cost you the connection or its id.
+         */
+        updateExecutor(id: string, patch: {
+            profile?: unknown;
+            baseUrl?: string;
+            secretKey?: string;
+            webhookSecret?: string | null;
+            auto?: boolean;
+        }): Promise<DsarExecutor>;
+        /** Disconnect a system; its open sub-tasks stop being driven. */
+        disconnectExecutor(id: string): Promise<void>;
+        /** The export bundle a connected system produced, fetched from it on demand. */
+        taskExport(requestId: string, taskId: string): Promise<DsarTaskExport>;
+        /**
+         * One task: its status history (`events`), every request made to a connected system on
+         * its behalf (`log`, redacted, 30 days) and whether that system's version changed mid-way.
+         */
+        task(requestId: string, taskId: string): Promise<DsarTask>;
+        /**
+         * Try a connection against one email without filing anything: runs the lookup, returns
+         * the raw (redacted) upstream answers and what a real request would have sent.
+         */
+        testExecutor(id: string, input: ExecutorTestInput): Promise<ExecutorTestResult>;
+    };
+    preferences: {
+        list(): Promise<PreferenceItem[]>;
+        /** Save/update a subject's named-purpose opt-ins. Returns the persisted record. */
+        save(subjectId: string, purposes: Record<string, boolean>): Promise<{
+            record: PreferenceRecord;
+        }>;
+        /** One subject's record. A subject with none has empty `purposes`. */
+        get(subjectId: string): Promise<PreferenceRecord>;
+    };
+    members: {
+        list(): Promise<Member[]>;
+        invite(email: string, role: string): Promise<{
+            member: {
+                userId: string;
+                email: string;
+                role: string;
+            };
+        }>;
+        setRole(userId: string, role: string): Promise<{
+            member: {
+                userId: string;
+                email: string;
+                role: string;
+            };
+        }>;
+        remove(userId: string): Promise<{
+            ok: true;
+        }>;
+    };
+    keys: {
+        list(): Promise<ApiKeyPrefix[]>;
+        /**
+         * Issue a new API key; the secret is returned once. Pass `scopes` and/or `cbids` for a
+         * least-privilege key — omit both for full access to the whole org.
+         */
+        issue(input?: ApiKeyIssueInput): Promise<ApiKeyIssued>;
+        /** Revoke a key by its prefix. Immediate. */
+        revoke(prefix: string): Promise<void>;
+        /** Rotate a key: a new secret, returned once, with the same scopes, lock and expiry. The old one stops working. */
+        roll(prefix: string): Promise<ApiKeyIssued>;
+        /** Rename a key, or replace its scopes or property lock. Only the fields sent change. */
+        update(prefix: string, patch: ApiKeyUpdate): Promise<{
+            ok: true;
+        }>;
+    };
+    usage(): Promise<Usage>;
+    /** The key's organisation. Requires an unscoped key that is not property-locked. */
+    org: {
+        get(): Promise<Org>;
+        /** Rename the org or set its logo. Deleting the org is not available through the API. */
+        update(patch: OrgUpdate): Promise<Org>;
+    };
+    /** The org's audit log, newest first. API actions appear as `apikey:<prefix>`. */
+    audit(limit?: number): Promise<{
+        entries: AuditEntry[];
+    }>;
+    assets: {
+        /** Upload a banner image (≤ 1,000,000 bytes) and get its public URL. Requires sites:write. */
+        upload(input: AssetUpload): Promise<{
+            url: string;
+        }>;
+        /**
+         * Delete a stored image. Takes the URL `upload` returned, or just its file name. Only
+         * your own org's images are reachable — the folder comes from your API key.
+         */
+        delete(urlOrFileName: string): Promise<void>;
+    };
+    /** Provision and manage child orgs. Requires a key with the reseller:* scopes. */
+    reseller: {
+        list(): Promise<ResellerChildList>;
+        /** Provision a child org. With `mintKey`, its first API key is returned once, as `apiKey`. */
+        create(input: ResellerChildCreate): Promise<{
+            child: ResellerChild;
+            apiKey?: string;
+        }>;
+        get(id: string): Promise<unknown>;
+        update(id: string, patch: ResellerChildPatch): Promise<unknown>;
+        /**
+         * Deprovision a child. Suspends it by default, which is reversible; `{ purge: true }`
+         * hard-deletes it and its data, which is not.
+         */
+        deprovision(id: string, opts?: {
+            purge?: boolean;
+        }): Promise<void>;
+        listKeys(id: string): Promise<ApiKeyPrefix[]>;
+        /** Mint an API key for a child. The secret is returned once. */
+        mintKey(id: string, input?: ChildKeyInput): Promise<ApiKeyIssued>;
+        revokeKey(id: string, prefix: string): Promise<void>;
+    };
+    webhooks: {
+        list(): Promise<WebhookSubscription[]>;
+        create(input: WebhookCreate): Promise<WebhookSubscription>;
+        /** Change or pause a subscription. `{ active: false }` pauses without deleting it. */
+        update(id: string, patch: WebhookUpdate): Promise<WebhookSubscription>;
+        delete(id: string): Promise<void>;
+        /** Rotate the signing secret. The new secret is returned once. */
+        rollSecret(id: string): Promise<{
+            secret: string;
+        }>;
+        /** Send a signed test event now and report what the endpoint answered. */
+        test(id: string): Promise<WebhookTestResult>;
+        /** Deliveries that failed every retry, newest first. */
+        deadLetters(): Promise<{
+            deadLetters: WebhookDeadLetter[];
+        }>;
+        /** Deliver a dead letter again, to the subscription as it is now. */
+        replayDeadLetter(id: string): Promise<unknown>;
+    };
+    /** One person's consent across every site in the org, by the subjectId your apps attach. */
+    subjects: {
+        /** Requires consent:read; not available to property-locked keys. */
+        consent(subjectId: string): Promise<{
+            subjectId: string;
+            records: unknown[];
+            count: number;
+            sites: string[];
+        }>;
+    };
+    banners: {
+        list(): Promise<BannerSummary[]>;
+        create(input: {
+            name: string;
+            json: SiteConfig;
+        }): Promise<BannerRecord>;
+        get(id: string): Promise<BannerRecord>;
+        update(id: string, patch: {
+            name?: string;
+            json?: SiteConfig;
+        }): Promise<BannerRecord>;
+        delete(id: string): Promise<void>;
+        assignments(id: string): Promise<{
+            cbids: string[];
+        }>;
+        setAssignments(id: string, cbids: string[]): Promise<{
+            cbids: string[];
+        }>;
+        publish(id: string): Promise<{
+            publishedCbids: string[];
+        }>;
+    };
+}
+declare function createCookieMunch(opts: CookieMunchOptions): CookieMunchClient;
+
+export { type AbResult, type AccountOrg, type AccountOrgs, type AdPersonalizationInput, type AiInspectInput, type AiInspectResult, type ApiKey, type ApiKeyIssueInput, type ApiKeyIssued, type ApiKeyPrefix, type ApiKeyUpdate, type AssetUpload, type AuditEntry, type BannerRecord, type BannerSummary, type BlockedReport, type BrandExtractionResult, type BrandKit, type BrandKitCreate, type BrandSuggestion, type BulkSiteInput, type BulkSiteResult, type CategorizedCookie, type ChildKeyInput, type ConfigChange, type ConfigDryRun, type ConfigWarning, type ConsentDay, type ConsentDecisionInput, type ConsentIngestInput, type ConsentLogRow, type CookieDeclaration, CookieMunchApiError, type CookieMunchClient, type CookieMunchOptions, type CspSources, type DsarCreate, type DsarEraseResult, type DsarExecutor, type DsarExecutorCreated, type DsarExecutorInput, type DsarExportResult, type DsarRequest, type DsarStatus, type DsarTask, type DsarTaskEvent, type DsarTaskExport, type DsarTaskLogEntry, type DsarTaskOutcome, type DsarType, type EnforcementRuleInput, type ExecutorProfile, type ExecutorTestInput, type ExecutorTestResult, type FlowIssue, type FlowOp, type FlowOpResponse, type FulfillmentOp, type Identifier, type Identity, type ImportedCookie, type ImportedDeclaration, type InstallSnippet, type LegalBasis, type LogQuery, type Member, type OptInMethod, type Org, type OrgUpdate, type PlanSource, type PolicyOptions, type PreferenceItem, type PreferenceRecord, type PreviewToken, type PreviewTokenOptions, type ProfileAttributeInput, type RangeQuery, type Regulation, type RegulationSummary, type RegulatoryFeedResult, type ResellerChild, type ResellerChildCreate, type ResellerChildList, type ResellerChildPatch, type RiskScore, type RopaEntry, type RopaInput, type ScanResult, type ScanStatus, type ScoredVendor, type SessionAnalysisInput, type SignedReceipt, type Site, type SiteConfig, type SiteCookie, type SiteCreate, type SiteFlow, type SnippetOptions, type SubscriptionTopicInput, type SupportedLanguage, type Usage, type VendorInput, type VendorRecord, type VerifyResult, type VerifyWebhookInput, type WebhookCreate, type WebhookDeadLetter, type WebhookSubscription, type WebhookTestResult, type WebhookUpdate, createCookieMunch, verifyWebhookSignature };