@cookiemunch/sdk 0.0.0-stage → 0.1.1

package/README.md

@@ -1,3 +1,60 @@
-# Temporary Holding Version
+# @cookiemunch/sdk
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+A small, typed REST client for the Cookie Munch Developer API (the `/v1` surface).
+Authenticate with an API key — the organization is derived server-side from the key,
+so you never pass an `orgId`.
+
+```ts
+import { createCookieMunch, CookieMunchApiError } from '@cookiemunch/sdk';
+
+const fc = createCookieMunch({
+  apiKey: process.env.COOKIEMUNCH_API_KEY!, // "fck_…"
+  baseUrl: 'https://cmp.example.com',         // "/v1" is appended automatically
+});
+
+const sites = await fc.sites.list();
+const site = await fc.sites.create({ domain: 'example.com' }); // cbid auto-generated
+const stats = await fc.consent.stats(site.cbid, { from: 0, to: Date.now() });
+
+try {
+  await fc.sites.get('does-not-exist');
+} catch (e) {
+  if (e instanceof CookieMunchApiError) console.error(e.status, e.message);
+}
+```
+
+`fetch` is injectable via `createCookieMunch({ ..., fetch })` for tests or custom
+runtimes; it defaults to the global `fetch`.
+
+## Methods
+
+- `me()`
+- `sites.list() / create(input) / get(cbid) / delete(cbid) / getConfig(cbid) / putConfig(cbid, config)`
+- `consent.stats(cbid, {from?,to?}) / log(cbid, {from?,to?,limit?}) / export(cbid, {from?,to?}) / receipt(cbid, stamp)`
+- `dsar.list() / create(input) / advance(id, toStatus)`
+- `vendors.list() / create(input)`
+- `ropa.list() / create(input)`
+- `webhooks.list() / create(input)`
+
+`export()` returns the raw CSV string; all other methods return parsed JSON. Any
+non-2xx response throws a `CookieMunchApiError { status, code?, message }`. Error `code`
+values are catalogued in [`docs/api/error-codes.md`](../../docs/api/error-codes.md).
+
+## Verifying webhooks
+
+`verifyWebhookSignature(...)` validates an inbound webhook's `X-CookieMunch-Signature`
+(HMAC-SHA256 over `` `${timestamp}.${rawBody}` ``) and its freshness. It's the authoritative
+verifier — always matches the server. Fail-closed; returns a boolean.
+
+```ts
+import { verifyWebhookSignature } from '@cookiemunch/sdk';
+
+const ok = verifyWebhookSignature({
+  payload: rawBody,                          // exact request body bytes (a string)
+  signature: headers['x-cookiemunch-signature'],
+  timestamp: headers['x-cookiemunch-timestamp'],
+  secret: process.env.CM_WEBHOOK_SECRET!,    // the whsec_… shown once on create
+});
+```
+
+Full recipe (Express, edge/WebCrypto, replay protection): [`docs/api/webhook-signing.md`](../../docs/api/webhook-signing.md).

package/dist/chunk-G7ORTXTK.js

@@ -0,0 +1,104 @@
+// src/consent.ts
+var CONSENT_COOKIE_NAME = "CookieMunch";
+function cookieHeaderOf(src) {
+  if (typeof src === "string") return src;
+  if (!src || typeof src !== "object") return "";
+  const h = src.headers;
+  if (!h) return "";
+  if (typeof h.get === "function") {
+    return h.get("cookie") ?? "";
+  }
+  const c = h.cookie;
+  return typeof c === "string" ? c : "";
+}
+function cookieValue(header, name) {
+  for (const part of header.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq === -1) continue;
+    if (part.slice(0, eq).trim() === name) return part.slice(eq + 1).trim();
+  }
+  return null;
+}
+function bool(v) {
+  return typeof v === "boolean";
+}
+function decode(raw) {
+  try {
+    return decodeURIComponent(raw);
+  } catch {
+    return raw;
+  }
+}
+function normalize(o) {
+  if (!o || typeof o !== "object") return null;
+  const r = o;
+  if (!bool(r.preferences) || !bool(r.statistics) || !bool(r.marketing)) return null;
+  if (r.method !== "explicit" && r.method !== "implied") return null;
+  if (typeof r.ver !== "number" || typeof r.utc !== "number") return null;
+  if (typeof r.stamp !== "string" && typeof r.stamp !== "number") return null;
+  if (typeof r.region !== "string") return null;
+  const out = {
+    necessary: true,
+    // never trust a cookie that claims necessary:false
+    preferences: r.preferences,
+    statistics: r.statistics,
+    marketing: r.marketing,
+    method: r.method,
+    ver: r.ver,
+    utc: r.utc,
+    region: r.region,
+    stamp: String(r.stamp)
+  };
+  if (r.custom && typeof r.custom === "object" && !Array.isArray(r.custom)) {
+    const custom = {};
+    for (const [k, v] of Object.entries(r.custom)) if (bool(v)) custom[k] = v;
+    if (Object.keys(custom).length > 0) out.custom = custom;
+  }
+  return out;
+}
+function parseConsentValue(raw) {
+  if (!raw) return null;
+  const decoded = decode(raw);
+  try {
+    return normalize(JSON.parse(decoded));
+  } catch {
+  }
+  if (!decoded.includes("necessary")) return null;
+  const json = decoded.replace(/'/g, '"').replace(/([{,]\s*)([A-Za-z_][\w]*)\s*:/g, '$1"$2":');
+  try {
+    return normalize(JSON.parse(json));
+  } catch {
+    return null;
+  }
+}
+var DAY_MS = 24 * 60 * 60 * 1e3;
+function readConsent(source, opts = {}) {
+  const raw = cookieValue(cookieHeaderOf(source), opts.cookieName ?? CONSENT_COOKIE_NAME);
+  const consent = raw ? parseConsentValue(raw) : null;
+  if (!consent) return null;
+  if (typeof opts.minVersion === "number" && consent.ver < opts.minVersion) return null;
+  if (typeof opts.expiryDays === "number" && opts.expiryDays > 0) {
+    if ((opts.now ?? Date.now()) - consent.utc > opts.expiryDays * DAY_MS) return null;
+  }
+  return consent;
+}
+function getConsent(source, cookieName = CONSENT_COOKIE_NAME) {
+  return readConsent(source, { cookieName });
+}
+function isAllowed(consent, category) {
+  if (category === "necessary") return true;
+  if (!consent) return false;
+  if (category === "preferences") return consent.preferences === true;
+  if (category === "statistics") return consent.statistics === true;
+  if (category === "marketing") return consent.marketing === true;
+  return consent.custom?.[category] === true;
+}
+
+export {
+  CONSENT_COOKIE_NAME,
+  parseConsentValue,
+  readConsent,
+  getConsent,
+  isAllowed
+};
+//# sourceMappingURL=chunk-G7ORTXTK.js.map

package/dist/chunk-G7ORTXTK.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/consent.ts"],"sourcesContent":["/**\n * Server-side consent reading. The Cookie Munch embed stores the visitor's decision in a\n * first-party `CookieMunch` cookie (URL-encoded JSON). This lets a server / edge worker read\n * that decision from the incoming request — to gate server-rendered tags or SSR'd third-party\n * scripts BEFORE they hit the browser — without shipping the whole embed. Zero-dependency and\n * runtime-agnostic: accepts a raw Cookie header, a Node `req` (`req.headers.cookie`), or a\n * Fetch `Request` (`request.headers.get('cookie')`).\n *\n *   import { readConsent, isAllowed } from '@cookiemunch/sdk/consent';\n *   const consent = readConsent(req.headers.cookie);   // ServerConsent | null\n *   if (isAllowed(consent, 'statistics')) { …render analytics tag… }\n *\n * The contract is documented at https://cookiemunch.net/docs/consent-cookie. It accepts\n * exactly what the embed accepts, so a server never grants what the browser would refuse:\n * strict JSON (URL-encoded or not) and the relaxed object literal Cookiebot writes.\n *\n * This module imports nothing — `@cookiemunch/sdk/consent` pulls in no API client.\n */\n\n/** The first-party cookie the embed writes (mirrors @cookiemunch/core COOKIE_NAME). */\nexport const CONSENT_COOKIE_NAME = 'CookieMunch';\n\n/** A visitor's consent decision, read from the request cookie. `necessary` is always true. */\nexport interface ServerConsent {\n  necessary: true;\n  preferences: boolean;\n  statistics: boolean;\n  marketing: boolean;\n  /** How consent was given. `implied` = not yet an explicit choice. */\n  method: 'explicit' | 'implied';\n  /** Custom (non-standard) categories, when the site defines any. */\n  custom?: Record<string, boolean>;\n  /** Consent-policy version the decision was made under (see `minVersion`). */\n  ver: number;\n  /** When the decision was made, epoch milliseconds (see `expiryDays`). */\n  utc: number;\n  /** Region code the decision was made in (`unknown` when undetected). */\n  region: string;\n  /** The anonymous consent-receipt id tying this browser to the consent log. */\n  stamp: string;\n}\n\n/** The site's consent policy, so the server applies the same rules the embed does. */\nexport interface ReadConsentOptions {\n  /** Cookie name. Default `CookieMunch`. */\n  cookieName?: string;\n  /**\n   * The site's current consent version (`consent.version`, or the config `ver` when that is\n   * higher). A decision made under an older version is not honoured by the embed — the\n   * visitor is asked again — so it reads as `null` here too.\n   */\n  minVersion?: number;\n  /** The site's `consent.expiryDays`: a decision older than this reads as `null`. */\n  expiryDays?: number;\n  /** Clock for `expiryDays`, epoch ms. Default `Date.now()`. */\n  now?: number;\n}\n\n/** Anything we can pull a Cookie header off of. */\nexport type ConsentSource =\n  | string\n  | null\n  | undefined\n  | { headers?: { cookie?: string | null; get?(name: string): string | null } | Record<string, unknown> };\n\nfunction cookieHeaderOf(src: ConsentSource): string {\n  if (typeof src === 'string') return src;\n  if (!src || typeof src !== 'object') return '';\n  const h = src.headers;\n  if (!h) return '';\n  // Fetch Request: headers.get('cookie'); Node: headers.cookie.\n  if (typeof (h as { get?(n: string): string | null }).get === 'function') {\n    return (h as { get(n: string): string | null }).get('cookie') ?? '';\n  }\n  const c = (h as Record<string, unknown>).cookie;\n  return typeof c === 'string' ? c : '';\n}\n\n/** Extract one cookie's raw value from a Cookie header (no decoding). */\nfunction cookieValue(header: string, name: string): string | null {\n  for (const part of header.split(';')) {\n    const eq = part.indexOf('=');\n    if (eq === -1) continue;\n    if (part.slice(0, eq).trim() === name) return part.slice(eq + 1).trim();\n  }\n  return null;\n}\n\nfunction bool(v: unknown): v is boolean {\n  return typeof v === 'boolean';\n}\n\nfunction decode(raw: string): string {\n  try {\n    return decodeURIComponent(raw);\n  } catch {\n    return raw; // not URL-encoded; use as-is\n  }\n}\n\n/** The embed's own validation (core cookie.ts `normalize`), field for field. */\nfunction normalize(o: unknown): ServerConsent | null {\n  if (!o || typeof o !== 'object') return null;\n  const r = o as Record<string, unknown>;\n  if (!bool(r.preferences) || !bool(r.statistics) || !bool(r.marketing)) return null;\n  if (r.method !== 'explicit' && r.method !== 'implied') return null;\n  if (typeof r.ver !== 'number' || typeof r.utc !== 'number') return null;\n  if (typeof r.stamp !== 'string' && typeof r.stamp !== 'number') return null;\n  if (typeof r.region !== 'string') return null;\n  const out: ServerConsent = {\n    necessary: true, // never trust a cookie that claims necessary:false\n    preferences: r.preferences,\n    statistics: r.statistics,\n    marketing: r.marketing,\n    method: r.method,\n    ver: r.ver,\n    utc: r.utc,\n    region: r.region,\n    stamp: String(r.stamp),\n  };\n  if (r.custom && typeof r.custom === 'object' && !Array.isArray(r.custom)) {\n    const custom: Record<string, boolean> = {};\n    for (const [k, v] of Object.entries(r.custom as Record<string, unknown>)) if (bool(v)) custom[k] = v;\n    if (Object.keys(custom).length > 0) out.custom = custom;\n  }\n  return out;\n}\n\n/**\n * Parse a raw cookie value into a validated ServerConsent, or null. Accepts the two formats\n * the embed reads: URL-encoded (or plain) strict JSON, and Cookiebot's relaxed object\n * literal — `{stamp:'…',necessary:true,…}` — left behind by a site migrating from Cookiebot.\n */\nexport function parseConsentValue(raw: string): ServerConsent | null {\n  if (!raw) return null;\n  const decoded = decode(raw);\n  try {\n    return normalize(JSON.parse(decoded));\n  } catch {\n    /* not strict JSON — try the Cookiebot literal */\n  }\n  if (!decoded.includes('necessary')) return null;\n  const json = decoded.replace(/'/g, '\"').replace(/([{,]\\s*)([A-Za-z_][\\w]*)\\s*:/g, '$1\"$2\":');\n  try {\n    return normalize(JSON.parse(json));\n  } catch {\n    return null;\n  }\n}\n\nconst DAY_MS = 24 * 60 * 60 * 1000;\n\n/**\n * Read the visitor's consent from a request: a raw `Cookie` header, a Node `req`, or a Fetch\n * `Request`. Returns null when there is no decision the embed would honour — no cookie, an\n * unparseable one, or (with the options) one made under an older version or past expiry.\n */\nexport function readConsent(source: ConsentSource, opts: ReadConsentOptions = {}): ServerConsent | null {\n  const raw = cookieValue(cookieHeaderOf(source), opts.cookieName ?? CONSENT_COOKIE_NAME);\n  const consent = raw ? parseConsentValue(raw) : null;\n  if (!consent) return null;\n  if (typeof opts.minVersion === 'number' && consent.ver < opts.minVersion) return null;\n  if (typeof opts.expiryDays === 'number' && opts.expiryDays > 0) {\n    if ((opts.now ?? Date.now()) - consent.utc > opts.expiryDays * DAY_MS) return null;\n  }\n  return consent;\n}\n\n/**\n * Read the visitor's consent from a request. The original spelling of {@link readConsent},\n * kept for existing callers; the second argument is the cookie name.\n */\nexport function getConsent(source: ConsentSource, cookieName: string = CONSENT_COOKIE_NAME): ServerConsent | null {\n  return readConsent(source, { cookieName });\n}\n\n/** Standard + custom consent categories. */\nexport type ConsentCategory = 'necessary' | 'preferences' | 'statistics' | 'marketing' | (string & {});\n\n/**\n * Whether a category is allowed for this visitor. `necessary` is always allowed. A missing\n * consent (`null` — visitor hasn't decided) is treated as NOT allowed for non-necessary\n * categories (fail-closed / prior-blocking posture), matching the embed.\n */\nexport function isAllowed(consent: ServerConsent | null, category: ConsentCategory): boolean {\n  if (category === 'necessary') return true;\n  if (!consent) return false;\n  // Explicit per-literal access rather than `consent[category]`: the `(string & {})` arm of\n  // ConsentCategory defeats control-flow narrowing, so a dynamic index is typed as an\n  // implicit-any index into ServerConsent (TS7053, which fails the tsup DTS build).\n  if (category === 'preferences') return consent.preferences === true;\n  if (category === 'statistics') return consent.statistics === true;\n  if (category === 'marketing') return consent.marketing === true;\n  return consent.custom?.[category] === true;\n}\n"],"mappings":";AAoBO,IAAM,sBAAsB;AA6CnC,SAAS,eAAe,KAA4B;AAClD,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,QAAM,IAAI,IAAI;AACd,MAAI,CAAC,EAAG,QAAO;AAEf,MAAI,OAAQ,EAAyC,QAAQ,YAAY;AACvE,WAAQ,EAAwC,IAAI,QAAQ,KAAK;AAAA,EACnE;AACA,QAAM,IAAK,EAA8B;AACzC,SAAO,OAAO,MAAM,WAAW,IAAI;AACrC;AAGA,SAAS,YAAY,QAAgB,MAA6B;AAChE,aAAW,QAAQ,OAAO,MAAM,GAAG,GAAG;AACpC,UAAM,KAAK,KAAK,QAAQ,GAAG;AAC3B,QAAI,OAAO,GAAI;AACf,QAAI,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK,MAAM,KAAM,QAAO,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK;AAAA,EACxE;AACA,SAAO;AACT;AAEA,SAAS,KAAK,GAA0B;AACtC,SAAO,OAAO,MAAM;AACtB;AAEA,SAAS,OAAO,KAAqB;AACnC,MAAI;AACF,WAAO,mBAAmB,GAAG;AAAA,EAC/B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,SAAS,UAAU,GAAkC;AACnD,MAAI,CAAC,KAAK,OAAO,MAAM,SAAU,QAAO;AACxC,QAAM,IAAI;AACV,MAAI,CAAC,KAAK,EAAE,WAAW,KAAK,CAAC,KAAK,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE,SAAS,EAAG,QAAO;AAC9E,MAAI,EAAE,WAAW,cAAc,EAAE,WAAW,UAAW,QAAO;AAC9D,MAAI,OAAO,EAAE,QAAQ,YAAY,OAAO,EAAE,QAAQ,SAAU,QAAO;AACnE,MAAI,OAAO,EAAE,UAAU,YAAY,OAAO,EAAE,UAAU,SAAU,QAAO;AACvE,MAAI,OAAO,EAAE,WAAW,SAAU,QAAO;AACzC,QAAM,MAAqB;AAAA,IACzB,WAAW;AAAA;AAAA,IACX,aAAa,EAAE;AAAA,IACf,YAAY,EAAE;AAAA,IACd,WAAW,EAAE;AAAA,IACb,QAAQ,EAAE;AAAA,IACV,KAAK,EAAE;AAAA,IACP,KAAK,EAAE;AAAA,IACP,QAAQ,EAAE;AAAA,IACV,OAAO,OAAO,EAAE,KAAK;AAAA,EACvB;AACA,MAAI,EAAE,UAAU,OAAO,EAAE,WAAW,YAAY,CAAC,MAAM,QAAQ,EAAE,MAAM,GAAG;AACxE,UAAM,SAAkC,CAAC;AACzC,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,EAAE,MAAiC,EAAG,KAAI,KAAK,CAAC,EAAG,QAAO,CAAC,IAAI;AACnG,QAAI,OAAO,KAAK,MAAM,EAAE,SAAS,EAAG,KAAI,SAAS;AAAA,EACnD;AACA,SAAO;AACT;AAOO,SAAS,kBAAkB,KAAmC;AACnE,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,UAAU,OAAO,GAAG;AAC1B,MAAI;AACF,WAAO,UAAU,KAAK,MAAM,OAAO,CAAC;AAAA,EACtC,QAAQ;AAAA,EAER;AACA,MAAI,CAAC,QAAQ,SAAS,WAAW,EAAG,QAAO;AAC3C,QAAM,OAAO,QAAQ,QAAQ,MAAM,GAAG,EAAE,QAAQ,kCAAkC,SAAS;AAC3F,MAAI;AACF,WAAO,UAAU,KAAK,MAAM,IAAI,CAAC;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,IAAM,SAAS,KAAK,KAAK,KAAK;AAOvB,SAAS,YAAY,QAAuB,OAA2B,CAAC,GAAyB;AACtG,QAAM,MAAM,YAAY,eAAe,MAAM,GAAG,KAAK,cAAc,mBAAmB;AACtF,QAAM,UAAU,MAAM,kBAAkB,GAAG,IAAI;AAC/C,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI,OAAO,KAAK,eAAe,YAAY,QAAQ,MAAM,KAAK,WAAY,QAAO;AACjF,MAAI,OAAO,KAAK,eAAe,YAAY,KAAK,aAAa,GAAG;AAC9D,SAAK,KAAK,OAAO,KAAK,IAAI,KAAK,QAAQ,MAAM,KAAK,aAAa,OAAQ,QAAO;AAAA,EAChF;AACA,SAAO;AACT;AAMO,SAAS,WAAW,QAAuB,aAAqB,qBAA2C;AAChH,SAAO,YAAY,QAAQ,EAAE,WAAW,CAAC;AAC3C;AAUO,SAAS,UAAU,SAA+B,UAAoC;AAC3F,MAAI,aAAa,YAAa,QAAO;AACrC,MAAI,CAAC,QAAS,QAAO;AAIrB,MAAI,aAAa,cAAe,QAAO,QAAQ,gBAAgB;AAC/D,MAAI,aAAa,aAAc,QAAO,QAAQ,eAAe;AAC7D,MAAI,aAAa,YAAa,QAAO,QAAQ,cAAc;AAC3D,SAAO,QAAQ,SAAS,QAAQ,MAAM;AACxC;","names":[]}

package/dist/consent.cjs

@@ -0,0 +1,132 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/consent.ts
+var consent_exports = {};
+__export(consent_exports, {
+  CONSENT_COOKIE_NAME: () => CONSENT_COOKIE_NAME,
+  getConsent: () => getConsent,
+  isAllowed: () => isAllowed,
+  parseConsentValue: () => parseConsentValue,
+  readConsent: () => readConsent
+});
+module.exports = __toCommonJS(consent_exports);
+var CONSENT_COOKIE_NAME = "CookieMunch";
+function cookieHeaderOf(src) {
+  if (typeof src === "string") return src;
+  if (!src || typeof src !== "object") return "";
+  const h = src.headers;
+  if (!h) return "";
+  if (typeof h.get === "function") {
+    return h.get("cookie") ?? "";
+  }
+  const c = h.cookie;
+  return typeof c === "string" ? c : "";
+}
+function cookieValue(header, name) {
+  for (const part of header.split(";")) {
+    const eq = part.indexOf("=");
+    if (eq === -1) continue;
+    if (part.slice(0, eq).trim() === name) return part.slice(eq + 1).trim();
+  }
+  return null;
+}
+function bool(v) {
+  return typeof v === "boolean";
+}
+function decode(raw) {
+  try {
+    return decodeURIComponent(raw);
+  } catch {
+    return raw;
+  }
+}
+function normalize(o) {
+  if (!o || typeof o !== "object") return null;
+  const r = o;
+  if (!bool(r.preferences) || !bool(r.statistics) || !bool(r.marketing)) return null;
+  if (r.method !== "explicit" && r.method !== "implied") return null;
+  if (typeof r.ver !== "number" || typeof r.utc !== "number") return null;
+  if (typeof r.stamp !== "string" && typeof r.stamp !== "number") return null;
+  if (typeof r.region !== "string") return null;
+  const out = {
+    necessary: true,
+    // never trust a cookie that claims necessary:false
+    preferences: r.preferences,
+    statistics: r.statistics,
+    marketing: r.marketing,
+    method: r.method,
+    ver: r.ver,
+    utc: r.utc,
+    region: r.region,
+    stamp: String(r.stamp)
+  };
+  if (r.custom && typeof r.custom === "object" && !Array.isArray(r.custom)) {
+    const custom = {};
+    for (const [k, v] of Object.entries(r.custom)) if (bool(v)) custom[k] = v;
+    if (Object.keys(custom).length > 0) out.custom = custom;
+  }
+  return out;
+}
+function parseConsentValue(raw) {
+  if (!raw) return null;
+  const decoded = decode(raw);
+  try {
+    return normalize(JSON.parse(decoded));
+  } catch {
+  }
+  if (!decoded.includes("necessary")) return null;
+  const json = decoded.replace(/'/g, '"').replace(/([{,]\s*)([A-Za-z_][\w]*)\s*:/g, '$1"$2":');
+  try {
+    return normalize(JSON.parse(json));
+  } catch {
+    return null;
+  }
+}
+var DAY_MS = 24 * 60 * 60 * 1e3;
+function readConsent(source, opts = {}) {
+  const raw = cookieValue(cookieHeaderOf(source), opts.cookieName ?? CONSENT_COOKIE_NAME);
+  const consent = raw ? parseConsentValue(raw) : null;
+  if (!consent) return null;
+  if (typeof opts.minVersion === "number" && consent.ver < opts.minVersion) return null;
+  if (typeof opts.expiryDays === "number" && opts.expiryDays > 0) {
+    if ((opts.now ?? Date.now()) - consent.utc > opts.expiryDays * DAY_MS) return null;
+  }
+  return consent;
+}
+function getConsent(source, cookieName = CONSENT_COOKIE_NAME) {
+  return readConsent(source, { cookieName });
+}
+function isAllowed(consent, category) {
+  if (category === "necessary") return true;
+  if (!consent) return false;
+  if (category === "preferences") return consent.preferences === true;
+  if (category === "statistics") return consent.statistics === true;
+  if (category === "marketing") return consent.marketing === true;
+  return consent.custom?.[category] === true;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  CONSENT_COOKIE_NAME,
+  getConsent,
+  isAllowed,
+  parseConsentValue,
+  readConsent
+});
+//# sourceMappingURL=consent.cjs.map

package/dist/consent.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/consent.ts"],"sourcesContent":["/**\n * Server-side consent reading. The Cookie Munch embed stores the visitor's decision in a\n * first-party `CookieMunch` cookie (URL-encoded JSON). This lets a server / edge worker read\n * that decision from the incoming request — to gate server-rendered tags or SSR'd third-party\n * scripts BEFORE they hit the browser — without shipping the whole embed. Zero-dependency and\n * runtime-agnostic: accepts a raw Cookie header, a Node `req` (`req.headers.cookie`), or a\n * Fetch `Request` (`request.headers.get('cookie')`).\n *\n *   import { readConsent, isAllowed } from '@cookiemunch/sdk/consent';\n *   const consent = readConsent(req.headers.cookie);   // ServerConsent | null\n *   if (isAllowed(consent, 'statistics')) { …render analytics tag… }\n *\n * The contract is documented at https://cookiemunch.net/docs/consent-cookie. It accepts\n * exactly what the embed accepts, so a server never grants what the browser would refuse:\n * strict JSON (URL-encoded or not) and the relaxed object literal Cookiebot writes.\n *\n * This module imports nothing — `@cookiemunch/sdk/consent` pulls in no API client.\n */\n\n/** The first-party cookie the embed writes (mirrors @cookiemunch/core COOKIE_NAME). */\nexport const CONSENT_COOKIE_NAME = 'CookieMunch';\n\n/** A visitor's consent decision, read from the request cookie. `necessary` is always true. */\nexport interface ServerConsent {\n  necessary: true;\n  preferences: boolean;\n  statistics: boolean;\n  marketing: boolean;\n  /** How consent was given. `implied` = not yet an explicit choice. */\n  method: 'explicit' | 'implied';\n  /** Custom (non-standard) categories, when the site defines any. */\n  custom?: Record<string, boolean>;\n  /** Consent-policy version the decision was made under (see `minVersion`). */\n  ver: number;\n  /** When the decision was made, epoch milliseconds (see `expiryDays`). */\n  utc: number;\n  /** Region code the decision was made in (`unknown` when undetected). */\n  region: string;\n  /** The anonymous consent-receipt id tying this browser to the consent log. */\n  stamp: string;\n}\n\n/** The site's consent policy, so the server applies the same rules the embed does. */\nexport interface ReadConsentOptions {\n  /** Cookie name. Default `CookieMunch`. */\n  cookieName?: string;\n  /**\n   * The site's current consent version (`consent.version`, or the config `ver` when that is\n   * higher). A decision made under an older version is not honoured by the embed — the\n   * visitor is asked again — so it reads as `null` here too.\n   */\n  minVersion?: number;\n  /** The site's `consent.expiryDays`: a decision older than this reads as `null`. */\n  expiryDays?: number;\n  /** Clock for `expiryDays`, epoch ms. Default `Date.now()`. */\n  now?: number;\n}\n\n/** Anything we can pull a Cookie header off of. */\nexport type ConsentSource =\n  | string\n  | null\n  | undefined\n  | { headers?: { cookie?: string | null; get?(name: string): string | null } | Record<string, unknown> };\n\nfunction cookieHeaderOf(src: ConsentSource): string {\n  if (typeof src === 'string') return src;\n  if (!src || typeof src !== 'object') return '';\n  const h = src.headers;\n  if (!h) return '';\n  // Fetch Request: headers.get('cookie'); Node: headers.cookie.\n  if (typeof (h as { get?(n: string): string | null }).get === 'function') {\n    return (h as { get(n: string): string | null }).get('cookie') ?? '';\n  }\n  const c = (h as Record<string, unknown>).cookie;\n  return typeof c === 'string' ? c : '';\n}\n\n/** Extract one cookie's raw value from a Cookie header (no decoding). */\nfunction cookieValue(header: string, name: string): string | null {\n  for (const part of header.split(';')) {\n    const eq = part.indexOf('=');\n    if (eq === -1) continue;\n    if (part.slice(0, eq).trim() === name) return part.slice(eq + 1).trim();\n  }\n  return null;\n}\n\nfunction bool(v: unknown): v is boolean {\n  return typeof v === 'boolean';\n}\n\nfunction decode(raw: string): string {\n  try {\n    return decodeURIComponent(raw);\n  } catch {\n    return raw; // not URL-encoded; use as-is\n  }\n}\n\n/** The embed's own validation (core cookie.ts `normalize`), field for field. */\nfunction normalize(o: unknown): ServerConsent | null {\n  if (!o || typeof o !== 'object') return null;\n  const r = o as Record<string, unknown>;\n  if (!bool(r.preferences) || !bool(r.statistics) || !bool(r.marketing)) return null;\n  if (r.method !== 'explicit' && r.method !== 'implied') return null;\n  if (typeof r.ver !== 'number' || typeof r.utc !== 'number') return null;\n  if (typeof r.stamp !== 'string' && typeof r.stamp !== 'number') return null;\n  if (typeof r.region !== 'string') return null;\n  const out: ServerConsent = {\n    necessary: true, // never trust a cookie that claims necessary:false\n    preferences: r.preferences,\n    statistics: r.statistics,\n    marketing: r.marketing,\n    method: r.method,\n    ver: r.ver,\n    utc: r.utc,\n    region: r.region,\n    stamp: String(r.stamp),\n  };\n  if (r.custom && typeof r.custom === 'object' && !Array.isArray(r.custom)) {\n    const custom: Record<string, boolean> = {};\n    for (const [k, v] of Object.entries(r.custom as Record<string, unknown>)) if (bool(v)) custom[k] = v;\n    if (Object.keys(custom).length > 0) out.custom = custom;\n  }\n  return out;\n}\n\n/**\n * Parse a raw cookie value into a validated ServerConsent, or null. Accepts the two formats\n * the embed reads: URL-encoded (or plain) strict JSON, and Cookiebot's relaxed object\n * literal — `{stamp:'…',necessary:true,…}` — left behind by a site migrating from Cookiebot.\n */\nexport function parseConsentValue(raw: string): ServerConsent | null {\n  if (!raw) return null;\n  const decoded = decode(raw);\n  try {\n    return normalize(JSON.parse(decoded));\n  } catch {\n    /* not strict JSON — try the Cookiebot literal */\n  }\n  if (!decoded.includes('necessary')) return null;\n  const json = decoded.replace(/'/g, '\"').replace(/([{,]\\s*)([A-Za-z_][\\w]*)\\s*:/g, '$1\"$2\":');\n  try {\n    return normalize(JSON.parse(json));\n  } catch {\n    return null;\n  }\n}\n\nconst DAY_MS = 24 * 60 * 60 * 1000;\n\n/**\n * Read the visitor's consent from a request: a raw `Cookie` header, a Node `req`, or a Fetch\n * `Request`. Returns null when there is no decision the embed would honour — no cookie, an\n * unparseable one, or (with the options) one made under an older version or past expiry.\n */\nexport function readConsent(source: ConsentSource, opts: ReadConsentOptions = {}): ServerConsent | null {\n  const raw = cookieValue(cookieHeaderOf(source), opts.cookieName ?? CONSENT_COOKIE_NAME);\n  const consent = raw ? parseConsentValue(raw) : null;\n  if (!consent) return null;\n  if (typeof opts.minVersion === 'number' && consent.ver < opts.minVersion) return null;\n  if (typeof opts.expiryDays === 'number' && opts.expiryDays > 0) {\n    if ((opts.now ?? Date.now()) - consent.utc > opts.expiryDays * DAY_MS) return null;\n  }\n  return consent;\n}\n\n/**\n * Read the visitor's consent from a request. The original spelling of {@link readConsent},\n * kept for existing callers; the second argument is the cookie name.\n */\nexport function getConsent(source: ConsentSource, cookieName: string = CONSENT_COOKIE_NAME): ServerConsent | null {\n  return readConsent(source, { cookieName });\n}\n\n/** Standard + custom consent categories. */\nexport type ConsentCategory = 'necessary' | 'preferences' | 'statistics' | 'marketing' | (string & {});\n\n/**\n * Whether a category is allowed for this visitor. `necessary` is always allowed. A missing\n * consent (`null` — visitor hasn't decided) is treated as NOT allowed for non-necessary\n * categories (fail-closed / prior-blocking posture), matching the embed.\n */\nexport function isAllowed(consent: ServerConsent | null, category: ConsentCategory): boolean {\n  if (category === 'necessary') return true;\n  if (!consent) return false;\n  // Explicit per-literal access rather than `consent[category]`: the `(string & {})` arm of\n  // ConsentCategory defeats control-flow narrowing, so a dynamic index is typed as an\n  // implicit-any index into ServerConsent (TS7053, which fails the tsup DTS build).\n  if (category === 'preferences') return consent.preferences === true;\n  if (category === 'statistics') return consent.statistics === true;\n  if (category === 'marketing') return consent.marketing === true;\n  return consent.custom?.[category] === true;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAoBO,IAAM,sBAAsB;AA6CnC,SAAS,eAAe,KAA4B;AAClD,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,QAAM,IAAI,IAAI;AACd,MAAI,CAAC,EAAG,QAAO;AAEf,MAAI,OAAQ,EAAyC,QAAQ,YAAY;AACvE,WAAQ,EAAwC,IAAI,QAAQ,KAAK;AAAA,EACnE;AACA,QAAM,IAAK,EAA8B;AACzC,SAAO,OAAO,MAAM,WAAW,IAAI;AACrC;AAGA,SAAS,YAAY,QAAgB,MAA6B;AAChE,aAAW,QAAQ,OAAO,MAAM,GAAG,GAAG;AACpC,UAAM,KAAK,KAAK,QAAQ,GAAG;AAC3B,QAAI,OAAO,GAAI;AACf,QAAI,KAAK,MAAM,GAAG,EAAE,EAAE,KAAK,MAAM,KAAM,QAAO,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK;AAAA,EACxE;AACA,SAAO;AACT;AAEA,SAAS,KAAK,GAA0B;AACtC,SAAO,OAAO,MAAM;AACtB;AAEA,SAAS,OAAO,KAAqB;AACnC,MAAI;AACF,WAAO,mBAAmB,GAAG;AAAA,EAC/B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,SAAS,UAAU,GAAkC;AACnD,MAAI,CAAC,KAAK,OAAO,MAAM,SAAU,QAAO;AACxC,QAAM,IAAI;AACV,MAAI,CAAC,KAAK,EAAE,WAAW,KAAK,CAAC,KAAK,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE,SAAS,EAAG,QAAO;AAC9E,MAAI,EAAE,WAAW,cAAc,EAAE,WAAW,UAAW,QAAO;AAC9D,MAAI,OAAO,EAAE,QAAQ,YAAY,OAAO,EAAE,QAAQ,SAAU,QAAO;AACnE,MAAI,OAAO,EAAE,UAAU,YAAY,OAAO,EAAE,UAAU,SAAU,QAAO;AACvE,MAAI,OAAO,EAAE,WAAW,SAAU,QAAO;AACzC,QAAM,MAAqB;AAAA,IACzB,WAAW;AAAA;AAAA,IACX,aAAa,EAAE;AAAA,IACf,YAAY,EAAE;AAAA,IACd,WAAW,EAAE;AAAA,IACb,QAAQ,EAAE;AAAA,IACV,KAAK,EAAE;AAAA,IACP,KAAK,EAAE;AAAA,IACP,QAAQ,EAAE;AAAA,IACV,OAAO,OAAO,EAAE,KAAK;AAAA,EACvB;AACA,MAAI,EAAE,UAAU,OAAO,EAAE,WAAW,YAAY,CAAC,MAAM,QAAQ,EAAE,MAAM,GAAG;AACxE,UAAM,SAAkC,CAAC;AACzC,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,EAAE,MAAiC,EAAG,KAAI,KAAK,CAAC,EAAG,QAAO,CAAC,IAAI;AACnG,QAAI,OAAO,KAAK,MAAM,EAAE,SAAS,EAAG,KAAI,SAAS;AAAA,EACnD;AACA,SAAO;AACT;AAOO,SAAS,kBAAkB,KAAmC;AACnE,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,UAAU,OAAO,GAAG;AAC1B,MAAI;AACF,WAAO,UAAU,KAAK,MAAM,OAAO,CAAC;AAAA,EACtC,QAAQ;AAAA,EAER;AACA,MAAI,CAAC,QAAQ,SAAS,WAAW,EAAG,QAAO;AAC3C,QAAM,OAAO,QAAQ,QAAQ,MAAM,GAAG,EAAE,QAAQ,kCAAkC,SAAS;AAC3F,MAAI;AACF,WAAO,UAAU,KAAK,MAAM,IAAI,CAAC;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,IAAM,SAAS,KAAK,KAAK,KAAK;AAOvB,SAAS,YAAY,QAAuB,OAA2B,CAAC,GAAyB;AACtG,QAAM,MAAM,YAAY,eAAe,MAAM,GAAG,KAAK,cAAc,mBAAmB;AACtF,QAAM,UAAU,MAAM,kBAAkB,GAAG,IAAI;AAC/C,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI,OAAO,KAAK,eAAe,YAAY,QAAQ,MAAM,KAAK,WAAY,QAAO;AACjF,MAAI,OAAO,KAAK,eAAe,YAAY,KAAK,aAAa,GAAG;AAC9D,SAAK,KAAK,OAAO,KAAK,IAAI,KAAK,QAAQ,MAAM,KAAK,aAAa,OAAQ,QAAO;AAAA,EAChF;AACA,SAAO;AACT;AAMO,SAAS,WAAW,QAAuB,aAAqB,qBAA2C;AAChH,SAAO,YAAY,QAAQ,EAAE,WAAW,CAAC;AAC3C;AAUO,SAAS,UAAU,SAA+B,UAAoC;AAC3F,MAAI,aAAa,YAAa,QAAO;AACrC,MAAI,CAAC,QAAS,QAAO;AAIrB,MAAI,aAAa,cAAe,QAAO,QAAQ,gBAAgB;AAC/D,MAAI,aAAa,aAAc,QAAO,QAAQ,eAAe;AAC7D,MAAI,aAAa,YAAa,QAAO,QAAQ,cAAc;AAC3D,SAAO,QAAQ,SAAS,QAAQ,MAAM;AACxC;","names":[]}

package/dist/consent.d.cts

@@ -0,0 +1,88 @@
+/**
+ * Server-side consent reading. The Cookie Munch embed stores the visitor's decision in a
+ * first-party `CookieMunch` cookie (URL-encoded JSON). This lets a server / edge worker read
+ * that decision from the incoming request — to gate server-rendered tags or SSR'd third-party
+ * scripts BEFORE they hit the browser — without shipping the whole embed. Zero-dependency and
+ * runtime-agnostic: accepts a raw Cookie header, a Node `req` (`req.headers.cookie`), or a
+ * Fetch `Request` (`request.headers.get('cookie')`).
+ *
+ *   import { readConsent, isAllowed } from '@cookiemunch/sdk/consent';
+ *   const consent = readConsent(req.headers.cookie);   // ServerConsent | null
+ *   if (isAllowed(consent, 'statistics')) { …render analytics tag… }
+ *
+ * The contract is documented at https://cookiemunch.net/docs/consent-cookie. It accepts
+ * exactly what the embed accepts, so a server never grants what the browser would refuse:
+ * strict JSON (URL-encoded or not) and the relaxed object literal Cookiebot writes.
+ *
+ * This module imports nothing — `@cookiemunch/sdk/consent` pulls in no API client.
+ */
+/** The first-party cookie the embed writes (mirrors @cookiemunch/core COOKIE_NAME). */
+declare const CONSENT_COOKIE_NAME = "CookieMunch";
+/** A visitor's consent decision, read from the request cookie. `necessary` is always true. */
+interface ServerConsent {
+    necessary: true;
+    preferences: boolean;
+    statistics: boolean;
+    marketing: boolean;
+    /** How consent was given. `implied` = not yet an explicit choice. */
+    method: 'explicit' | 'implied';
+    /** Custom (non-standard) categories, when the site defines any. */
+    custom?: Record<string, boolean>;
+    /** Consent-policy version the decision was made under (see `minVersion`). */
+    ver: number;
+    /** When the decision was made, epoch milliseconds (see `expiryDays`). */
+    utc: number;
+    /** Region code the decision was made in (`unknown` when undetected). */
+    region: string;
+    /** The anonymous consent-receipt id tying this browser to the consent log. */
+    stamp: string;
+}
+/** The site's consent policy, so the server applies the same rules the embed does. */
+interface ReadConsentOptions {
+    /** Cookie name. Default `CookieMunch`. */
+    cookieName?: string;
+    /**
+     * The site's current consent version (`consent.version`, or the config `ver` when that is
+     * higher). A decision made under an older version is not honoured by the embed — the
+     * visitor is asked again — so it reads as `null` here too.
+     */
+    minVersion?: number;
+    /** The site's `consent.expiryDays`: a decision older than this reads as `null`. */
+    expiryDays?: number;
+    /** Clock for `expiryDays`, epoch ms. Default `Date.now()`. */
+    now?: number;
+}
+/** Anything we can pull a Cookie header off of. */
+type ConsentSource = string | null | undefined | {
+    headers?: {
+        cookie?: string | null;
+        get?(name: string): string | null;
+    } | Record<string, unknown>;
+};
+/**
+ * Parse a raw cookie value into a validated ServerConsent, or null. Accepts the two formats
+ * the embed reads: URL-encoded (or plain) strict JSON, and Cookiebot's relaxed object
+ * literal — `{stamp:'…',necessary:true,…}` — left behind by a site migrating from Cookiebot.
+ */
+declare function parseConsentValue(raw: string): ServerConsent | null;
+/**
+ * Read the visitor's consent from a request: a raw `Cookie` header, a Node `req`, or a Fetch
+ * `Request`. Returns null when there is no decision the embed would honour — no cookie, an
+ * unparseable one, or (with the options) one made under an older version or past expiry.
+ */
+declare function readConsent(source: ConsentSource, opts?: ReadConsentOptions): ServerConsent | null;
+/**
+ * Read the visitor's consent from a request. The original spelling of {@link readConsent},
+ * kept for existing callers; the second argument is the cookie name.
+ */
+declare function getConsent(source: ConsentSource, cookieName?: string): ServerConsent | null;
+/** Standard + custom consent categories. */
+type ConsentCategory = 'necessary' | 'preferences' | 'statistics' | 'marketing' | (string & {});
+/**
+ * Whether a category is allowed for this visitor. `necessary` is always allowed. A missing
+ * consent (`null` — visitor hasn't decided) is treated as NOT allowed for non-necessary
+ * categories (fail-closed / prior-blocking posture), matching the embed.
+ */
+declare function isAllowed(consent: ServerConsent | null, category: ConsentCategory): boolean;
+
+export { CONSENT_COOKIE_NAME, type ConsentCategory, type ConsentSource, type ReadConsentOptions, type ServerConsent, getConsent, isAllowed, parseConsentValue, readConsent };

package/dist/consent.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Server-side consent reading. The Cookie Munch embed stores the visitor's decision in a
+ * first-party `CookieMunch` cookie (URL-encoded JSON). This lets a server / edge worker read
+ * that decision from the incoming request — to gate server-rendered tags or SSR'd third-party
+ * scripts BEFORE they hit the browser — without shipping the whole embed. Zero-dependency and
+ * runtime-agnostic: accepts a raw Cookie header, a Node `req` (`req.headers.cookie`), or a
+ * Fetch `Request` (`request.headers.get('cookie')`).
+ *
+ *   import { readConsent, isAllowed } from '@cookiemunch/sdk/consent';
+ *   const consent = readConsent(req.headers.cookie);   // ServerConsent | null
+ *   if (isAllowed(consent, 'statistics')) { …render analytics tag… }
+ *
+ * The contract is documented at https://cookiemunch.net/docs/consent-cookie. It accepts
+ * exactly what the embed accepts, so a server never grants what the browser would refuse:
+ * strict JSON (URL-encoded or not) and the relaxed object literal Cookiebot writes.
+ *
+ * This module imports nothing — `@cookiemunch/sdk/consent` pulls in no API client.
+ */
+/** The first-party cookie the embed writes (mirrors @cookiemunch/core COOKIE_NAME). */
+declare const CONSENT_COOKIE_NAME = "CookieMunch";
+/** A visitor's consent decision, read from the request cookie. `necessary` is always true. */
+interface ServerConsent {
+    necessary: true;
+    preferences: boolean;
+    statistics: boolean;
+    marketing: boolean;
+    /** How consent was given. `implied` = not yet an explicit choice. */
+    method: 'explicit' | 'implied';
+    /** Custom (non-standard) categories, when the site defines any. */
+    custom?: Record<string, boolean>;
+    /** Consent-policy version the decision was made under (see `minVersion`). */
+    ver: number;
+    /** When the decision was made, epoch milliseconds (see `expiryDays`). */
+    utc: number;
+    /** Region code the decision was made in (`unknown` when undetected). */
+    region: string;
+    /** The anonymous consent-receipt id tying this browser to the consent log. */
+    stamp: string;
+}
+/** The site's consent policy, so the server applies the same rules the embed does. */
+interface ReadConsentOptions {
+    /** Cookie name. Default `CookieMunch`. */
+    cookieName?: string;
+    /**
+     * The site's current consent version (`consent.version`, or the config `ver` when that is
+     * higher). A decision made under an older version is not honoured by the embed — the
+     * visitor is asked again — so it reads as `null` here too.
+     */
+    minVersion?: number;
+    /** The site's `consent.expiryDays`: a decision older than this reads as `null`. */
+    expiryDays?: number;
+    /** Clock for `expiryDays`, epoch ms. Default `Date.now()`. */
+    now?: number;
+}
+/** Anything we can pull a Cookie header off of. */
+type ConsentSource = string | null | undefined | {
+    headers?: {
+        cookie?: string | null;
+        get?(name: string): string | null;
+    } | Record<string, unknown>;
+};
+/**
+ * Parse a raw cookie value into a validated ServerConsent, or null. Accepts the two formats
+ * the embed reads: URL-encoded (or plain) strict JSON, and Cookiebot's relaxed object
+ * literal — `{stamp:'…',necessary:true,…}` — left behind by a site migrating from Cookiebot.
+ */
+declare function parseConsentValue(raw: string): ServerConsent | null;
+/**
+ * Read the visitor's consent from a request: a raw `Cookie` header, a Node `req`, or a Fetch
+ * `Request`. Returns null when there is no decision the embed would honour — no cookie, an
+ * unparseable one, or (with the options) one made under an older version or past expiry.
+ */
+declare function readConsent(source: ConsentSource, opts?: ReadConsentOptions): ServerConsent | null;
+/**
+ * Read the visitor's consent from a request. The original spelling of {@link readConsent},
+ * kept for existing callers; the second argument is the cookie name.
+ */
+declare function getConsent(source: ConsentSource, cookieName?: string): ServerConsent | null;
+/** Standard + custom consent categories. */
+type ConsentCategory = 'necessary' | 'preferences' | 'statistics' | 'marketing' | (string & {});
+/**
+ * Whether a category is allowed for this visitor. `necessary` is always allowed. A missing
+ * consent (`null` — visitor hasn't decided) is treated as NOT allowed for non-necessary
+ * categories (fail-closed / prior-blocking posture), matching the embed.
+ */
+declare function isAllowed(consent: ServerConsent | null, category: ConsentCategory): boolean;
+
+export { CONSENT_COOKIE_NAME, type ConsentCategory, type ConsentSource, type ReadConsentOptions, type ServerConsent, getConsent, isAllowed, parseConsentValue, readConsent };

package/dist/consent.js

@@ -0,0 +1,15 @@
+import {
+  CONSENT_COOKIE_NAME,
+  getConsent,
+  isAllowed,
+  parseConsentValue,
+  readConsent
+} from "./chunk-G7ORTXTK.js";
+export {
+  CONSENT_COOKIE_NAME,
+  getConsent,
+  isAllowed,
+  parseConsentValue,
+  readConsent
+};
+//# sourceMappingURL=consent.js.map

package/dist/consent.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}