@cookiemunch/sdk 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -0,0 +1,51 @@
+# Changelog: @cookiemunch/sdk
+
+Every published release, newest first. Dates are the day the version was cut.
+
+## 0.5.0 (2026-10-23)
+
+- Added: `org.controller.get()` / `set()` / `remove()`: the organisation's own data-controller identity, named in rights-request notices filed without a `cbid`. Needs an unscoped key or the new `rights:write` scope.
+- Added: `consentSyncSecret.get(cbid)` / `rotate(cbid)` / `remove(cbid)`: the per-site secret for hosted cross-device consent sync. `rotate` returns the secret once.
+- Added: `mintConsentSyncToken({ secret, cbid, subject, ttlSeconds })`: signs the short-lived token your server hands the page for `CookieMunch.setSyncToken()`. It runs locally with no request.
+- Added: `preferenceCenter.mintToken({ cbid, email | subjectId, ttlSeconds })`: mints the preference-centre token a signed-in visitor's page passes to `CookieMunch.setSubjectToken()`.
+
+## 0.4.1 (2026-10-22)
+
+- Added: the `referally` cookie preset (`cookieDomain`, `cookieDays`, `category` parameters on `applyCookiePreset`).
+- Added: every request sends `User-Agent: cookiemunch-js/<version>`; set your own with the `userAgent` option.
+
+## 0.4.0 (2026-10-19)
+
+- Added: site PATCH (rename or move a site, keeping its cbid), integration health, `provision` and partner links.
+- Added: the executor presets and canary health checks for connected systems; `connectExecutor` takes a `preset`.
+- Added: declaration presets for the platforms a site is built on, observed-cookie removal and storage types on declarations.
+- Added: opt-in strict writes and API key hygiene (`X-14`, `X-15`).
+
+## 0.3.0 (2026-10-15)
+
+- Added: `retireCookie` and `unretireCookie`.
+- Added: `scan` can wait for the result, and `waitForScan`.
+
+## 0.2.0 (2026-10-15)
+
+- Added: executor webhook test and delivery log, with dry runs.
+- Added: `purposes` (per-language text) and `dryRun` on declared cookies; `?lang=` on the public cookie feed.
+- Added: document verification on rights-request intake answers (`trustEmailClaim`, `oidc_jwt`).
+- Added: rights-page identity configuration.
+- Fixed: design warnings say what happened and notices are not blamed on Accept.
+
+## 0.1.2 (2026-10-15)
+
+- Changed: the package builds standalone from its public repository and is published with npm provenance.
+
+## 0.1.1 (2026-10-14)
+
+- Added: `declareCookie`, bulk declare, `undeclareCookie` and applying a scan import.
+- Added: `PUT ?keep=unspecified` and `null` in a PATCH removes the key.
+- Added: `dryRunConfig`, and `lintConfig` with `designWarnings` on every config read and write.
+- Added: `client.rightsPage`: draft, dry run, publish, versions, rollback (with `baseUpdatedAt` conflicts), custom domains, mail provider and account-linked rights links.
+- Fixed: per-claim CNAME targets; a hostname already pointing at us is proven with the TXT token.
+
+## 0.1.0 (2026-10-14)
+
+- First release: a typed client for the Cookie Munch Developer API (`/v1`): sites, config, consent log and stats, DSAR, vendors and RoPA.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Cookie Munch
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/index.cjs

@@ -22,9 +22,11 @@ var src_exports = {};
 __export(src_exports, {
   CONSENT_COOKIE_NAME: () => CONSENT_COOKIE_NAME,
   CookieMunchApiError: () => CookieMunchApiError,
+  SDK_VERSION: () => SDK_VERSION,
   createCookieMunch: () => createCookieMunch,
   getConsent: () => getConsent,
   isAllowed: () => isAllowed,
+  mintConsentSyncToken: () => mintConsentSyncToken,
   parseConsentValue: () => parseConsentValue,
   readConsent: () => readConsent,
   verifyWebhookSignature: () => verifyWebhookSignature
@@ -147,7 +149,23 @@ function verifyWebhookSignature(input) {
   return (0, import_node_crypto.timingSafeEqual)(got, want);
 }
 
+// src/consent-sync.ts
+var import_node_crypto2 = require("crypto");
+var SUBJECT_RE = /^[A-Za-z0-9._:@+/=~-]{1,128}$/;
+function mintConsentSyncToken(input) {
+  if (!input.secret) throw new Error("mintConsentSyncToken: secret is required");
+  if (!input.cbid) throw new Error("mintConsentSyncToken: cbid is required");
+  if (!SUBJECT_RE.test(input.subject)) throw new Error("mintConsentSyncToken: subject must be 1\u2013128 characters of A-Z a-z 0-9 . _ : @ + / = ~ -");
+  const ttl = Math.floor(input.ttlSeconds ?? 3600);
+  if (!(ttl >= 1 && ttl <= 86400)) throw new Error("mintConsentSyncToken: ttlSeconds must be between 1 and 86400");
+  const iat = Math.floor((input.now ?? Date.now()) / 1e3);
+  const payload = Buffer.from(JSON.stringify({ c: input.cbid, s: input.subject, iat, exp: iat + ttl })).toString("base64url");
+  const sig = (0, import_node_crypto2.createHmac)("sha256", input.secret).update(`cms1.${payload}`).digest("base64url");
+  return `cms1.${payload}.${sig}`;
+}
+
 // src/index.ts
+var SDK_VERSION = "0.5.0";
 var CookieMunchApiError = class extends Error {
   constructor(status, message, code, body) {
     super(message);
@@ -174,7 +192,7 @@ function createCookieMunch(opts) {
   const doFetch = opts.fetch ?? globalThis.fetch;
   if (!doFetch) throw new Error("No fetch available; pass { fetch } in CookieMunchOptions.");
   async function request(method, path, body, raw = false) {
-    const headers = { Authorization: `Bearer ${opts.apiKey}` };
+    const headers = { Authorization: `Bearer ${opts.apiKey}`, "User-Agent": opts.userAgent ?? `cookiemunch-js/${SDK_VERSION}` };
     if (opts.strictUnknownFields && method !== "GET") headers["Prefer"] = "strict-unknown-fields";
     const init = { method, headers };
     if (body !== void 0) {
@@ -449,6 +467,9 @@ function createCookieMunch(opts) {
       save: (subjectId, purposes) => request("POST", "/preferences", { subjectId, purposes }),
       get: (subjectId) => get(`/preferences/${enc(subjectId)}`)
     },
+    preferenceCenter: {
+      mintToken: (input) => request("POST", "/preference-center/tokens", input)
+    },
     members: {
       list: () => get("/members"),
       invite: (email, role) => request("POST", "/members", { email, role }),
@@ -479,6 +500,13 @@ function createCookieMunch(opts) {
         },
         test: (to) => request("POST", "/org/mail-provider/test", to ? { to } : {})
       },
+      controller: {
+        get: () => get("/org/controller"),
+        set: (input) => request("PUT", "/org/controller", input),
+        remove: async () => {
+          await request("DELETE", "/org/controller");
+        }
+      },
       rightsCaptcha: {
         get: () => get("/org/rights-captcha"),
         set: (input) => request("PUT", "/org/rights-captcha", input),
@@ -527,6 +555,11 @@ function createCookieMunch(opts) {
     rightsLinks: {
       create: (cbid, input) => request("POST", `/sites/${enc(cbid)}/rights-links`, input)
     },
+    consentSyncSecret: {
+      get: (cbid) => get(`/sites/${enc(cbid)}/consent-sync-secret`),
+      rotate: (cbid) => request("POST", `/sites/${enc(cbid)}/consent-sync-secret`),
+      remove: (cbid) => request("DELETE", `/sites/${enc(cbid)}/consent-sync-secret`)
+    },
     rightsCaptcha: {
       get: (cbid) => get(`/sites/${enc(cbid)}/rights-captcha`),
       set: (cbid, input) => request("PUT", `/sites/${enc(cbid)}/rights-captcha`, input),
@@ -558,9 +591,11 @@ function createCookieMunch(opts) {
 0 && (module.exports = {
   CONSENT_COOKIE_NAME,
   CookieMunchApiError,
+  SDK_VERSION,
   createCookieMunch,
   getConsent,
   isAllowed,
+  mintConsentSyncToken,
   parseConsentValue,
   readConsent,
   verifyWebhookSignature