@cookiemunch/sdk 0.4.1 → 0.5.0

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 Every published release, newest first. Dates are the day the version was cut.
 
+## 0.5.0 (2026-10-23)
+
+- Added: `org.controller.get()` / `set()` / `remove()`: the organisation's own data-controller identity, named in rights-request notices filed without a `cbid`. Needs an unscoped key or the new `rights:write` scope.
+- Added: `consentSyncSecret.get(cbid)` / `rotate(cbid)` / `remove(cbid)`: the per-site secret for hosted cross-device consent sync. `rotate` returns the secret once.
+- Added: `mintConsentSyncToken({ secret, cbid, subject, ttlSeconds })`: signs the short-lived token your server hands the page for `CookieMunch.setSyncToken()`. It runs locally with no request.
+- Added: `preferenceCenter.mintToken({ cbid, email | subjectId, ttlSeconds })`: mints the preference-centre token a signed-in visitor's page passes to `CookieMunch.setSubjectToken()`.
+
 ## 0.4.1 (2026-10-22)
 
 - Added: the `referally` cookie preset (`cookieDomain`, `cookieDays`, `category` parameters on `applyCookiePreset`).

package/dist/index.cjs

@@ -26,6 +26,7 @@ __export(src_exports, {
   createCookieMunch: () => createCookieMunch,
   getConsent: () => getConsent,
   isAllowed: () => isAllowed,
+  mintConsentSyncToken: () => mintConsentSyncToken,
   parseConsentValue: () => parseConsentValue,
   readConsent: () => readConsent,
   verifyWebhookSignature: () => verifyWebhookSignature
@@ -148,8 +149,23 @@ function verifyWebhookSignature(input) {
   return (0, import_node_crypto.timingSafeEqual)(got, want);
 }
 
+// src/consent-sync.ts
+var import_node_crypto2 = require("crypto");
+var SUBJECT_RE = /^[A-Za-z0-9._:@+/=~-]{1,128}$/;
+function mintConsentSyncToken(input) {
+  if (!input.secret) throw new Error("mintConsentSyncToken: secret is required");
+  if (!input.cbid) throw new Error("mintConsentSyncToken: cbid is required");
+  if (!SUBJECT_RE.test(input.subject)) throw new Error("mintConsentSyncToken: subject must be 1\u2013128 characters of A-Z a-z 0-9 . _ : @ + / = ~ -");
+  const ttl = Math.floor(input.ttlSeconds ?? 3600);
+  if (!(ttl >= 1 && ttl <= 86400)) throw new Error("mintConsentSyncToken: ttlSeconds must be between 1 and 86400");
+  const iat = Math.floor((input.now ?? Date.now()) / 1e3);
+  const payload = Buffer.from(JSON.stringify({ c: input.cbid, s: input.subject, iat, exp: iat + ttl })).toString("base64url");
+  const sig = (0, import_node_crypto2.createHmac)("sha256", input.secret).update(`cms1.${payload}`).digest("base64url");
+  return `cms1.${payload}.${sig}`;
+}
+
 // src/index.ts
-var SDK_VERSION = "0.4.1";
+var SDK_VERSION = "0.5.0";
 var CookieMunchApiError = class extends Error {
   constructor(status, message, code, body) {
     super(message);
@@ -451,6 +467,9 @@ function createCookieMunch(opts) {
       save: (subjectId, purposes) => request("POST", "/preferences", { subjectId, purposes }),
       get: (subjectId) => get(`/preferences/${enc(subjectId)}`)
     },
+    preferenceCenter: {
+      mintToken: (input) => request("POST", "/preference-center/tokens", input)
+    },
     members: {
       list: () => get("/members"),
       invite: (email, role) => request("POST", "/members", { email, role }),
@@ -481,6 +500,13 @@ function createCookieMunch(opts) {
         },
         test: (to) => request("POST", "/org/mail-provider/test", to ? { to } : {})
       },
+      controller: {
+        get: () => get("/org/controller"),
+        set: (input) => request("PUT", "/org/controller", input),
+        remove: async () => {
+          await request("DELETE", "/org/controller");
+        }
+      },
       rightsCaptcha: {
         get: () => get("/org/rights-captcha"),
         set: (input) => request("PUT", "/org/rights-captcha", input),
@@ -529,6 +555,11 @@ function createCookieMunch(opts) {
     rightsLinks: {
       create: (cbid, input) => request("POST", `/sites/${enc(cbid)}/rights-links`, input)
     },
+    consentSyncSecret: {
+      get: (cbid) => get(`/sites/${enc(cbid)}/consent-sync-secret`),
+      rotate: (cbid) => request("POST", `/sites/${enc(cbid)}/consent-sync-secret`),
+      remove: (cbid) => request("DELETE", `/sites/${enc(cbid)}/consent-sync-secret`)
+    },
     rightsCaptcha: {
       get: (cbid) => get(`/sites/${enc(cbid)}/rights-captcha`),
       set: (cbid, input) => request("PUT", `/sites/${enc(cbid)}/rights-captcha`, input),
@@ -564,6 +595,7 @@ function createCookieMunch(opts) {
   createCookieMunch,
   getConsent,
   isAllowed,
+  mintConsentSyncToken,
   parseConsentValue,
   readConsent,
   verifyWebhookSignature