@cookiemunch/sdk 0.5.1 → 0.6.0

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { CONSENT_COOKIE_NAME, ConsentCategory, ConsentSource, ReadConsentOptions, ServerConsent, getConsent, isAllowed, parseConsentValue, readConsent } from './consent.js';
+export { CONSENT_COOKIE_NAME, ConsentCategory, ConsentSource, ConsentTokenClaims, DEFAULT_JWKS_URL, JsonWebKeySet, KeySetOptions, ReadConsentOptions, ReadSignedConsentOptions, ServerConsent, SignableDecision, VerifyTokenOptions, consentSignaturePayload, getConsent, isAllowed, parseConsentValue, readConsent, verifyDecisionSignature, verifyToken } from './consent.js';
 
 /**
  * Request/response shapes for the Cookie Munch Developer API (/v1). These mirror the
@@ -93,25 +93,72 @@ interface SiteUpdateResult {
 }
 /** One row of GET /v1/integration-health. `ok: null` = the check could not run (see `detail`). */
 interface HealthRow {
+    /** The suite shape's name for `check` (always equal). */
+    id: string;
     check: string;
+    /** The generic check this row is an instance of (`forumulate.webhook` → `webhook.delivery`); otherwise `check`. */
+    kind: string;
+    /** The vendor a vendor-specific instance is about. */
+    vendor?: string;
     ok: boolean | null;
     severity: 'error' | 'warning' | 'info';
     subject: string;
     fixHint?: string;
+    /** The same as fixHint (suite shape). */
+    fix?: string;
+    /** Where the check and its fix are explained. */
+    docs: string;
     detail?: string;
+    /** Network checks: the hop that failed (or, on success, the last one reached). */
+    hop?: 'dns' | 'tls' | 'http' | 'challenge' | 'auth';
+    status?: number;
+    elapsedMs?: number;
+    /** Failed network checks: a stable code (ENOTFOUND, timeout, challenge, http_503, …). */
+    error?: string;
+    /** A waiver covers this failing row; `ok` is then null. */
+    waived?: {
+        reason: string;
+        by: string;
+        until: number | null;
+    };
     lastCheckedAt: number;
 }
 interface IntegrationHealthReport {
     cbid: string;
     checkedAt: number;
+    generatedAt: string;
     ok: boolean;
     counts: {
         error: number;
         warning: number;
         notChecked: number;
+        waived: number;
     };
     checks: HealthRow[];
 }
+/** PUT /v1/integration-health/waivers. */
+interface HealthWaiverInput {
+    /** Optional when the organisation has one site. */
+    cbid?: string;
+    /** A row's `check` or `kind`. */
+    check: string;
+    /** A row's `subject`; omitted: every subject of the check (`*`). */
+    subject?: string;
+    /** Why this is deliberate (1–500 characters). */
+    reason: string;
+    /** ISO date or epoch ms, future, within a year; omitted or null: never expires. */
+    until?: string | number | null;
+}
+interface HealthWaiver {
+    cbid: string;
+    check: string;
+    subject: string;
+    reason: string;
+    by: string;
+    until: number | null;
+    createdAt: number;
+    expired?: boolean;
+}
 /** POST /v1/provision. Secrets are used for the request only and never returned. */
 interface ProvisionRequest {
     product: string;
@@ -120,10 +167,12 @@ interface ProvisionRequest {
     aliases?: string[];
     cbid?: string;
     /** `frontendApiHost` (e.g. auth.example.com) lets provision declare Atlas's sign-in cookies on the site. */
+    /** `rightsIdentity` (default true) makes Atlas the site's rights sign-in (step `rights.identity`). */
     atlas?: {
         secretKey: string;
         cookieConsent?: boolean;
         dsrWebhook?: boolean;
+        rightsIdentity?: boolean;
         frontendApiHost?: string;
     };
     forumulate?: {
@@ -140,15 +189,21 @@ interface ProvisionRequest {
     };
 }
 interface ProvisionStep {
+    /** v2 answers: the stable step id (`fromStep` takes it). */
+    id?: string;
     step: string;
-    status: 'created' | 'updated' | 'unchanged' | 'would_create' | 'would_update' | 'skipped' | 'waiting' | 'failed' | 'passed';
+    status: 'created' | 'updated' | 'unchanged' | 'would_create' | 'would_update' | 'skipped' | 'waiting' | 'waiting_on' | 'failed' | 'passed';
     detail?: string;
     diff?: Array<{
         field: string;
         before: unknown;
         after: unknown;
     }>;
-    waitingOn?: string;
+    /** A string in v1 answers; `{ platform, items }` in v2 answers. */
+    waitingOn?: string | {
+        platform: string;
+        items: string[];
+    };
 }
 interface ProvisionResult {
     dryRun: boolean;
@@ -161,8 +216,19 @@ interface ProvisionResult {
         waiting: number;
         failed: number;
     };
+    /** v2 answers only. */
+    version?: 2;
+    ids?: {
+        orgId: string;
+        cbid: string | null;
+        executors: Record<string, string>;
+        webhooks: string[];
+    };
+    sealedSecrets?: Array<Record<string, unknown>>;
+    checklist?: string[];
 }
-type PartnerId = 'forumulate' | 'atlas';
+/** A partner the deployment knows: built in (forumulate, atlas, chatly, referalli) or any other registered on it. */
+type PartnerId = 'forumulate' | 'atlas' | 'chatly' | 'referalli' | (string & {});
 interface PartnerLinkCreate {
     partner: PartnerId;
     /** The partner's id for the receiving account (a Forumulate organisation id, an Atlas instance id). */
@@ -235,9 +301,11 @@ interface RangeQuery {
 interface LogQuery extends RangeQuery {
     limit?: number;
 }
-type DsarType = 'access' | 'deletion' | 'rectification' | 'portability' | 'opt-out';
+type DsarType = 'access' | 'deletion' | 'rectification' | 'portability' | 'opt-out' | 'closure' | 'restriction';
+/** A type word as sent: the canonical words, or an alias (`erasure`/`erase` → deletion, `export` → access). */
+type DsarTypeWord = DsarType | 'erasure' | 'erase' | 'export';
 type Regulation = 'gdpr' | 'ccpa';
-type DsarStatus = 'received' | 'verifying' | 'in_progress' | 'completed' | 'rejected';
+type DsarStatus = 'received' | 'verifying' | 'in_progress' | 'completed' | 'rejected' | 'cancelled';
 interface DsarRequest {
     id: string;
     type: DsarType;
@@ -254,6 +322,147 @@ interface DsarRequest {
     messageToSubject?: string;
     /** A test request: off the SLA board, labelled, and deletable with `dsar.delete`. A closed request can be marked one with `dsar.markTest`. */
     test?: boolean;
+    /** Its type in the suite vocabulary (`erasure` was stored as `deletion`). */
+    canonicalType?: string;
+    /** The case's X-ForgeDeck-Trace, when it has one. */
+    trace?: string;
+}
+/** A signed-in identity from any OIDC issuer the site trusts. `(iss, sub)` is the key. */
+interface SubjectIdentity {
+    iss: string;
+    sub: string;
+    ext?: string;
+    principal?: string;
+}
+/** Who a case is about. `atlas` is accepted as an alias of `identity`. */
+interface DsarSubject {
+    emails: string[];
+    identity?: SubjectIdentity;
+    atlas?: SubjectIdentity;
+}
+/** POST /v1/dsar/requests. */
+interface DsarCaseCreate {
+    cbid: string;
+    type: DsarTypeWord;
+    subject?: DsarSubject;
+    /** The person's own token from the site's sign-in issuer (aud `cookiemunch:<cbid>`). */
+    subjectToken?: string;
+    /** product and atlas need dsar:write and attest the person; admin (default) files it received. */
+    source?: 'product' | 'atlas' | 'admin';
+    reason?: string;
+    /** Connections not to ask: system names, connection ids, or `self`. */
+    skipSystems?: string[];
+    /** Default true. */
+    fulfill?: boolean;
+    regulation?: 'gdpr' | 'ccpa' | 'lgpd' | 'pipeda' | 'vcdpa';
+    jurisdiction?: string;
+    test?: boolean;
+}
+type DsarCaseStatus = 'pending' | 'scheduled' | 'processing' | 'completed' | 'completed_with_retention' | 'rejected' | 'cancelled';
+interface RetentionLine {
+    category: string;
+    basis: 'legal_obligation' | 'legal_claims' | 'contract' | 'public_interest';
+    until?: string;
+}
+interface DsarCaseTask {
+    system: string;
+    executorId: string | null;
+    taskId: string;
+    status: DsarCaseStatus | 'no_match';
+    requestId: string | null;
+    eta: string | null;
+    completedAt: string | null;
+    detail: string | null;
+    retention?: RetentionLine[];
+}
+/** A case across every connected system. */
+interface DsarCase {
+    id: string;
+    type: DsarType;
+    canonicalType: string;
+    status: DsarCaseStatus;
+    requestStatus: DsarStatus;
+    cbid?: string;
+    source: 'product' | 'atlas' | 'rights_page' | 'admin' | null;
+    reason: string | null;
+    openedAt: string;
+    /** Nothing is erased anywhere before this. */
+    executeAfter: string | null;
+    graceDays: number | null;
+    closedAt: string | null;
+    /** False for a closure: no statutory clock. */
+    statutory: boolean;
+    dueAt: string | null;
+    verification: string | null;
+    trace: string | null;
+    subject: {
+        emails: string[];
+        identity: SubjectIdentity | null;
+    };
+    skipSystems: string[];
+    fulfill: boolean | null;
+    cancelRequestedAt: string | null;
+    test: boolean;
+    tasks: DsarCaseTask[];
+    receiptUrl: string;
+    /** Lets the person who asked read this case through POST /api/v1/public/dsar/status. */
+    statusToken?: string;
+}
+/** One signed receipt for a case (Ed25519; verify with GET /v1/partner/jwks.json). */
+interface DsarCaseReceipt {
+    receiptVersion: number;
+    caseId: string;
+    type: DsarType;
+    canonicalType: string;
+    status: DsarCaseStatus;
+    openedAt: string;
+    executeAfter: string | null;
+    closedAt: string | null;
+    verification: string | null;
+    trace: string | null;
+    subject: {
+        emailHashes: string[];
+        identityHash?: string;
+        atlasSubHash?: string;
+    };
+    systems: Array<{
+        system: string;
+        executorId: string | null;
+        requestId: string | null;
+        status: string;
+        completedAt: string | null;
+        trace: string | null;
+        retention?: RetentionLine[];
+    }>;
+    issuedAt: string;
+    signature: {
+        alg: 'Ed25519';
+        kid: string;
+        value: string;
+        covers?: string;
+    };
+}
+/** A site's rights-request settings. */
+interface DsarSettings {
+    cbid: string;
+    /** Days an erasure or account closure waits before any system acts (0–30). 7 for a new site; 0 for one that existed before (opt-in). */
+    graceDays: number;
+    /** site: set explicitly; default: a new site's 7 days; legacy: an existing site, 0 until set. */
+    source: 'site' | 'default' | 'legacy';
+    updatedAt: number | null;
+}
+/** GET /v1/integrations/{app}/card. */
+interface SubjectCard {
+    app: string;
+    openCases: Array<{
+        id: string;
+        type: string;
+        status: string;
+        executeAfter: string | null;
+        openedAt: string;
+        receiptUrl: string;
+    }>;
+    consent: null;
 }
 /**
  * How a rights-page requester was verified — on every answer of the public intake
@@ -366,6 +575,24 @@ interface PreferenceRecord {
     updatedAt: number;
     version: number;
 }
+/** GET /v1/categories/registry — the reserved category templates (CMU-X15). */
+interface CategoryRegistry {
+    version: 1;
+    standard: string[];
+    suite: Array<{
+        id: 'support_chat' | 'referrals';
+        stance: 'necessary_on_request' | 'opt_in_eu_uk';
+        fallback: 'preferences' | 'marketing';
+        /** By banner language. */
+        labels: Record<string, string>;
+        descriptions: Record<string, string>;
+        basis?: string[];
+        vendors?: Array<{
+            product: string;
+            storage: string[];
+        }>;
+    }>;
+}
 
 interface VerifyWebhookInput {
     /** The raw request body, exactly as received. Do NOT re-stringify parsed JSON. */
@@ -404,6 +631,152 @@ interface MintConsentSyncTokenInput {
 }
 declare function mintConsentSyncToken(input: MintConsentSyncTokenInput): string;
 
+/**
+ * The cm-standard-v2 executor conformance kit (CMU-X20).
+ *
+ * cm-standard-v2 is an open contract: any system that holds personal data can implement it and
+ * be driven by Cookie Munch with no code on our side (docs: cookiemunch.net/docs/executor-contract-v2).
+ * This kit checks an implementation rule by rule, and names the rule that fails. It is the same
+ * suite Cookie Munch runs on `POST /v1/dsar/executors/{id}/test {conformance: true}`, and the
+ * `cookiemunch executors conformance <baseUrl>` command runs it from a terminal or CI.
+ *
+ * It only ever touches the CANARY subject — an address no real person has. The contract asks every
+ * implementation to treat the canary as an existing synthetic person: it is found by its email and
+ * by its identity, requests on it move through the full state machine, and nothing real is ever
+ * erased. So the kit can check that an erasure waits for `executeAfter`, that a cancel leaves the
+ * person in place, and that an identity is never matched to someone else through a shared email —
+ * without a real person's data being anywhere near it.
+ *
+ * No dependencies: `fetch` only, so it runs in Node 18+, a browser, or an edge runtime.
+ */
+type ConformanceStatus = 'pass' | 'fail' | 'skip';
+interface ConformanceRuleResult {
+    /** A stable id, e.g. `requests.execute_after.scheduled`. */
+    id: string;
+    /** What the rule says, in one sentence. */
+    title: string;
+    status: ConformanceStatus;
+    /** What was seen, when it failed or was skipped. */
+    detail?: string;
+}
+interface ConformanceReport {
+    /** True when no rule failed. */
+    ok: boolean;
+    passed: number;
+    failed: number;
+    skipped: number;
+    rules: ConformanceRuleResult[];
+    /** The `X-Version` the executor answered with, when it sent one. */
+    version?: string;
+}
+interface ConformanceOptions {
+    /** The executor's base: the contract paths are `{baseUrl}/privacy/lookup` and so on. https (http only for localhost). */
+    baseUrl: string;
+    /** The credential Cookie Munch would send. */
+    secret: string;
+    /**
+     * The canary address: `canary-<16 hex>@canary.cookiemunch.net`, per organisation
+     * (`GET /v1/dsar/executors/presets` → `canaryEmail`).
+     */
+    canaryEmail: string;
+    /** How the secret is sent. Default `Authorization: Bearer {secret}`. */
+    auth?: {
+        header: string;
+        format: string;
+    };
+    /** Path prefix under baseUrl. Default `/privacy`. */
+    prefix?: string;
+    fetch?: typeof fetch;
+    now?: () => number;
+    /** A per-run tag for idempotency keys and case ids. Default random. */
+    runId?: string;
+}
+/** The issuer the canary identity carries. */
+declare const CANARY_ISSUER = "https://canary.cookiemunch.net";
+/** The canary subject's identity, derived from its address. */
+declare function canaryIdentityFor(canaryEmail: string): {
+    iss: string;
+    sub: string;
+    ext: string;
+};
+/** Every rule, in the order they run. */
+declare const CONFORMANCE_RULES: ReadonlyArray<{
+    id: string;
+    title: string;
+}>;
+/** Run every rule against one executor. Never throws for an executor's answer; only for bad options. */
+declare function runExecutorConformance(o: ConformanceOptions): Promise<ConformanceReport>;
+
+/**
+ * Types for `window.__fdConsent`, the shared consent API any embed can code against — a chat
+ * widget, a referral snippet, an analytics tag — whatever CMP the page runs. Cookie Munch sets
+ * it natively; `fd-consent-shim.js` sets the same object over Cookiebot, OneTrust or no CMP.
+ * Type-only: importing this module adds nothing to a bundle.
+ *
+ *   import type { FdConsent, FdConsentQueue } from '@cookiemunch/sdk';
+ *   const fd = (window.__fdConsent ??= { q: [] });
+ *   if ('version' in fd) fd.on('change', (s) => …); else fd.q.push(['on', 'change', (s) => …]);
+ *
+ * `version` changes only with a breaking change; new members do not bump it.
+ */
+/** What caused a change. The same causes Cookie Munch's ledger records. */
+type FdCause = 'replay' | 'accept' | 'decline' | 'selection' | 'withdraw' | 'implied' | 'sync' | 'request' | 'migrated';
+interface FdSnapshot {
+    /** False until the visitor has answered. */
+    decided: boolean;
+    /** False when this visitor's region and the site's rules need no answer (a default applies). */
+    required: boolean;
+    /** Every category the site offers (standard, custom, reserved) and its answer. */
+    categories: Record<string, boolean>;
+    /** The decision's stamp (`CookieMunch.consentId()`), or null. */
+    stamp: string | null;
+    region: string;
+    /** A Global Privacy Control signal was seen. */
+    gpc: boolean;
+    /** ISO 8601, or null before a decision. */
+    decidedAt: string | null;
+}
+interface FdRequestOptions {
+    /** One sentence in the page's language: what will be stored and why. Shown as the prompt's text. */
+    reason: string;
+    /** Who is asking: your vendor id. Recorded with the answer. */
+    vendor: string;
+}
+interface FdConsent {
+    readonly version: 1;
+    /** `cookiemunch`, or `shim:cookiebot` / `shim:onetrust` / `shim:none`. */
+    readonly provider: string;
+    /** Resolves once a decision exists, or at once where the region needs none. */
+    ready(): Promise<FdSnapshot>;
+    /** true / false, or null while a required decision is pending. Never false for "not decided". */
+    has(category: string): boolean | null;
+    /** Fires once per decision (a returning visitor's as `replay`); a withdrawal synchronously. Returns unsubscribe. */
+    on(event: 'change', cb: (snapshot: FdSnapshot, cause: FdCause) => void): () => void;
+    /** Ask for one category at the moment you need it. Never re-asks a refusal; one prompt per category per page view. */
+    request(category: string, opts: FdRequestOptions): Promise<boolean>;
+    /** Not available yet: warns once and does nothing. */
+    identify(token: string): void;
+    layout: {
+        bottomInset(): number;
+        on(cb: (insetPx: number) => void): () => void;
+    };
+    /** Calls made on the queue before this existed ran in order; later pushes run at once. */
+    q: {
+        push(...calls: FdQueuedCall[]): number;
+    };
+}
+/** A call queued before the real object exists. */
+type FdQueuedCall = ['on', 'change', (snapshot: FdSnapshot, cause: FdCause) => void] | ['ready', (snapshot: FdSnapshot) => void] | ['request', string, FdRequestOptions, (granted: boolean) => void] | ['identify', string];
+/** What an embed that loads first creates: `window.__fdConsent = window.__fdConsent || { q: [] }`. */
+interface FdConsentQueue {
+    q: FdQueuedCall[];
+}
+declare global {
+    interface Window {
+        __fdConsent?: FdConsent | FdConsentQueue;
+    }
+}
+
 /**
  * @cookiemunch/sdk — a small, typed REST client for the Cookie Munch Developer API
  * (the /v1 surface). Construct it with an API key; the org is derived server-side
@@ -418,7 +791,7 @@ declare function mintConsentSyncToken(input: MintConsentSyncTokenInput): string;
  * This package's version, sent in the default User-Agent. Cloudflare answers a request with
  * no recognisable User-Agent with `403 error code: 1010`; a test pins this to package.json.
  */
-declare const SDK_VERSION = "0.5.1";
+declare const SDK_VERSION = "0.6.0";
 interface CookieMunchOptions {
     apiKey: string;
     /** "https://api.cookiemunch.net" — the /v1 prefix is appended automatically. */
@@ -432,7 +805,183 @@ interface CookieMunchOptions {
     strictUnknownFields?: boolean;
     /** The `User-Agent` sent on every request. Default `cookiemunch-js/<version>`. */
     userAgent?: string;
+    /**
+     * Seal every once-shown secret to this X25519 public key (`x25519:<base64>`): answers carry `sealed_secret`
+     * (a libsodium sealed box) and `sealed_field` instead of the plaintext. Sent as `X-Secret-Recipient` on writes.
+     */
+    secretRecipient?: string;
+    /**
+     * Extra headers on every request, e.g. `{ 'Idempotency-Key': '<forgedeck ref>:<run>' }` on a client made for
+     * one create: a retry with the same key replays the first answer (secrets included) for 24 hours.
+     */
+    headers?: Record<string, string>;
+}
+/** Tags on a created resource (CMU-X29). `forgedeck_sandbox: true` can only be set at creation. */
+type ResourceMetadata = Record<string, string | number | boolean>;
+/** Keep only resources whose tags match, e.g. `{ forgedeck_product: 'referalli' }`. */
+interface MetadataFilter {
+    metadata?: Record<string, string>;
+}
+/** externalRef and metadata, accepted by every create (orgs, sites, webhooks, executors, DSARs, partner links). */
+interface ResourceTagsInput {
+    /** Your own name for it, unique per org and type: a repeat create with the same body returns the existing one. */
+    externalRef?: string;
+    metadata?: ResourceMetadata;
+}
+type TaggedType = 'org' | 'site' | 'webhook' | 'executor' | 'dsar' | 'partner_link';
+interface ResourceTags {
+    type: TaggedType;
+    id: string;
+    metadata: ResourceMetadata;
+    externalRef: string | null;
+    sandbox: boolean;
+}
+interface ResourceTagsUpdate {
+    dryRun?: true;
+    type: TaggedType;
+    id: string;
+    metadata: ResourceMetadata;
+    diff: Array<{
+        field: string;
+        before: unknown;
+        after: unknown;
+    }>;
+}
+/** What a sandbox hard delete removed. */
+interface SandboxPurge {
+    deleted: true;
+    cbid?: string;
+    orgId?: string;
+    counts: Record<string, number>;
+}
+/** A partner link in the suite-standard shape (CMU-X34). */
+interface StandardPartnerLink {
+    id: string;
+    partner: string;
+    resource: string;
+    scopes: string[];
+    created_at: string | null;
+    expires_at: string | null;
+    last_used_at: string | null;
+    calls_30d: number;
+    status: 'active' | 'waiting_on_partner' | 'revoked' | 'expired';
+    externalId?: string;
+    label?: string;
+}
+interface StandardPartnerLinkCreate extends ResourceTagsInput {
+    partner: string;
+    /** `site:<cbid>` or `org:<org id>`. */
+    resource: string;
+    scopes: Array<'consent:read' | 'receipt:read' | 'dsar:read' | 'dsar:write' | 'dsar:rights-links' | 'sites:read'>;
+    expires_at?: string;
+    externalId?: string;
+    label?: string;
+}
+/** POST /v1/provision v2: the `cookiemunch` block of a forgedeck.yaml (see the forgedeck API map page). */
+interface ProvisionRequestV2 {
+    forgedeck: {
+        ref?: string;
+        product: string;
+        env?: string;
+        sandbox?: boolean;
+    };
+    site: {
+        domain: string;
+        name?: string;
+        aliases?: string[];
+        locales?: string[];
+        preset?: string;
+        devOrigins?: string[];
+    };
+    cbid?: string;
+    categories?: string[];
+    rightsIdentity?: Record<string, unknown>;
+    dsar?: {
+        graceDays?: number;
+    };
+    atlas?: {
+        instanceId?: string;
+        secretKey?: string;
+        cookieConsent?: boolean;
+        executor?: boolean;
+        frontendApiHost?: string;
+    };
+    forumulate?: {
+        org?: string;
+        orgId?: string;
+        token?: string;
+        consent?: boolean;
+        executor?: boolean;
+        label?: string;
+    };
+    chatly?: {
+        workspace?: string;
+        publicId?: string;
+        vendorHook?: boolean;
+        executor?: boolean;
+    };
+    self?: {
+        baseUrl: string;
+        contract?: string;
+        secret: string;
+    };
+    referalli?: {
+        orgId?: string;
+        trackingToken?: string;
+        preset?: boolean;
+        partner?: boolean;
+        executor?: string | boolean;
+    };
+    embedManifests?: string | string[];
+    brand?: {
+        url?: string;
+    };
+}
+/** GET /v1/provision/env: names, non-secret values, and references for secrets. */
+interface ProvisionEnv {
+    ref: string;
+    cbid: string;
+    env: Array<{
+        name: string;
+        value?: string;
+        secretRef?: string;
+    }>;
 }
+/** A vended short-lived key, shown once. */
+interface ApiKeyVended {
+    key: string;
+    prefix: string;
+    expiresAt: number;
+    scopes: string[];
+    cbids: string[] | null;
+}
+/** The suite-standard key listing (GET /v1/keys?shape=standard). */
+interface StandardKeyList {
+    keys: Array<{
+        id: string;
+        prefix: string;
+        name: string | null;
+        owner: string | null;
+        kind: string | null;
+        env: string | null;
+        format: string | null;
+        scopes: string[] | null;
+        resources: string[] | null;
+        created_at: string | null;
+        expires_at: string | null;
+        last_used_at: string | null;
+        last_used_ip: string | null;
+        status: 'active' | 'expired';
+    }>;
+}
+/** A leaked secret to revoke (POST /v1/keys/revoke_leaked, no authentication needed). */
+type LeakReport = {
+    key: string;
+    source?: string;
+} | {
+    keys: string[];
+    source?: string;
+};
 /**
  * Thrown for any non-2xx response. `message` is the server's `error` field when present;
  * `code` is populated from the server's `code` field whenever the error body carries one
@@ -553,15 +1102,88 @@ interface DeclaredCookie extends DeclaredCookieInput {
     vendor?: string;
 }
 /** A platform whose cookies and storage a preset declares. */
-type CookiePresetVendor = 'atlas' | 'forumulate' | 'chatly' | 'cookiemunch' | 'referally';
+type CookiePresetVendor = 'atlas' | 'forumulate' | 'chatly' | 'cookiemunch' | 'referalli' | 'firstpromoter' | 'partnerstack' | 'tapfiliate' | 'impact'
+/** @deprecated the old name of `referalli`, accepted until 2027-10-23. */
+ | 'referally';
 /** Where a vendor's live manifest will come from, and whether it exists yet. */
 interface CookiePresetManifest {
-    status: 'builtin' | 'waiting_on_vendor';
+    /** `live`/`stale`/`invalid`: the vendor's embed manifest feeds the preset; `waiting_on_vendor`: built-in rows. */
+    status: 'builtin' | 'live' | 'stale' | 'invalid' | 'waiting_on_vendor';
     waitingOn?: string;
     item?: string;
     contract?: string;
+    /** Where the manifest is read from, or `upload`. */
+    source?: string;
+    /** The `updated` of the copy in effect. */
+    updated?: string;
+    fetchedAt?: number;
+    /** Why the latest read was not accepted, by rule (1–6). */
+    errors?: Array<{
+        rule?: number;
+        path?: string;
+        code?: string;
+        message: string;
+    }>;
+    warnings?: Array<{
+        rule?: number;
+        path?: string;
+        code?: string;
+        message: string;
+    }>;
 }
-/** Preset parameters: Atlas `frontendApiHost`/`crossSubdomainCookies`; Chatly `publicId`/`dragging`/`category`; Referally `cookieDomain`/`cookieDays`/`category`. */
+/** PUT /v1/sites/:cbid/cookies/presets/custom — any vendor's embed manifest, by URL or as a body. */
+type CustomPresetInput = ({
+    url: string;
+    manifest?: never;
+} | {
+    manifest: EmbedManifest;
+    url?: never;
+}) & {
+    /** Values for the manifest's `{placeholders}`. */
+    params?: Record<string, string>;
+};
+/** One suggestion in GET /v1/sites/:cbid/cookies/suggestions. */
+interface CookieSuggestion {
+    name: string;
+    storage: 'cookie' | 'localStorage' | 'sessionStorage' | 'indexedDB';
+    foundOnPages: string[];
+    /** `denied`: a crawl saw it before any consent; `granted`: after accepting all. */
+    consentStates?: Array<'denied' | 'granted'>;
+    suggestedPreset?: string;
+    suggestedCategory: string;
+    confidence: 'high' | 'medium' | 'low';
+    purpose?: string;
+    reason: string;
+}
+/** GET /v1/sites/:cbid/cookies/suggestions */
+interface CookieSuggestions {
+    suggestions: CookieSuggestion[];
+    vendors: Array<{
+        vendor: string;
+        display: string;
+        preset: string | null;
+        applied: boolean;
+        needsParams: boolean;
+        evidence: Array<{
+            kind: 'script' | 'storage' | 'manifest';
+            value: string;
+            pages?: string[];
+        }>;
+    }>;
+}
+/** POST /v1/sites/:cbid/cookies/suggestions/declare */
+interface CookieSuggestionsDeclared {
+    presetsApplied: string[];
+    declaredCount: number;
+    skipped?: Array<{
+        name: string;
+        reason: string;
+    }>;
+    dryRun?: true;
+    declared?: DeclaredCookie[];
+    diff?: DeclarationDiff;
+}
+/** Preset parameters: Atlas `frontendApiHost`/`crossSubdomainCookies`; Chatly `publicId`/`dragging`/`category`; referral and affiliate presets (referalli, firstpromoter, partnerstack, tapfiliate, impact) `cookieDomain`/`cookieDays`/`category`, referalli `legacyName`, impact `campaignId`. */
 interface CookiePresetParams {
     frontendApiHost?: string;
     crossSubdomainCookies?: boolean;
@@ -570,10 +1192,77 @@ interface CookiePresetParams {
     category?: string;
     cookieDomain?: string;
     cookieDays?: number;
+    /** referalli: default true, also declare referally_ctx (the pre-rename copy aff.js still writes). */
+    legacyName?: boolean;
+    /** impact: your program id; declares IR_<campaignId> too. */
+    campaignId?: string;
+}
+/** One browser key a surface writes, in an embed manifest. */
+interface EmbedManifestStorage {
+    name: string;
+    type: 'cookie' | 'localStorage' | 'sessionStorage' | 'indexedDB';
+    category: string;
+    /** `session`, `persistent` or a duration such as `365d`. */
+    lifetime?: string;
+    /** By language; `en` is always there. */
+    purpose: Record<string, string>;
+    domain?: string;
+    sentTo?: string;
+}
+/** One embeddable surface in an embed manifest: its origins by CSP directive and its storage. */
+interface EmbedManifestSurface {
+    /** Origins by CSP directive (`script-src`, `connect-src`, …). */
+    csp?: Record<string, string[]>;
+    /** Non-origin sources the surface needs (`'unsafe-inline'`, `data:`). */
+    requires?: Record<string, string[]>;
+    trustedTypes?: string[];
+    consentCategory?: string;
+    storage?: EmbedManifestStorage[];
+    sri?: Record<string, string>;
+}
+/** The shared embed/origins manifest (https://cookiemunch.net/schemas/embed-v1.json). */
+interface EmbedManifest {
+    schema: string;
+    product: string;
+    updated: string;
+    openapi?: string;
+    llms?: string;
+    status?: string;
+    changelog?: string;
+    docs?: string;
+    checkers?: {
+        userAgent?: string;
+        egress?: string[];
+        agents?: Array<{
+            role: string;
+            userAgent?: string;
+            userAgentContains?: string;
+            description?: string;
+        }>;
+    };
+    surfaces: Record<string, EmbedManifestSurface>;
+    changes?: Array<{
+        effective: string;
+        surface: string;
+        add?: Record<string, string[]>;
+        remove?: Record<string, string[]>;
+        note?: string;
+    }>;
+    /** The tenant variant only: the site and its hosts. */
+    tenant?: {
+        cbid: string;
+        siteHosts: string[];
+        rightsPage: string;
+        preferenceCentre: string;
+    };
 }
 /** One preset in GET /v1/sites/:cbid/cookies/presets. */
 interface CookiePreset {
-    vendor: CookiePresetVendor;
+    /** A first-class preset, or a custom preset's product id. */
+    vendor: CookiePresetVendor | (string & {});
+    /** A custom preset (importCookieManifest). */
+    custom?: boolean;
+    url?: string;
     params: Array<{
         name: string;
         type: string;
@@ -586,7 +1275,9 @@ interface CookiePreset {
 }
 /** What applying a preset declared. */
 interface CookiePresetResult {
-    vendor: CookiePresetVendor;
+    vendor: CookiePresetVendor | (string & {});
+    /** `manifest` when the rows came from the vendor's embed manifest. */
+    source?: 'manifest';
     cookies: DeclaredCookie[];
     removed: string[];
     skipped?: Array<{
@@ -594,6 +1285,16 @@ interface CookiePresetResult {
         reason: string;
     }>;
     note?: string;
+    /** Rows filed under a category this site has switched off (`cookies[<name>].category`). */
+    warnings?: Array<{
+        field: string;
+        reason: string;
+    }>;
+    /** With `warnings`: a body for `sites.patchConfig` that fixes them; apply the preset again after. */
+    suggestedConfigPatch?: Record<string, unknown>;
+    /** True when called with the deprecated name `referally`. */
+    deprecated?: true;
+    deprecatedAlias?: string;
     manifest: CookiePresetManifest;
     dryRun?: true;
     declared?: DeclaredCookie[];
@@ -656,8 +1357,8 @@ interface ScanStatus {
     lastScannedAt: number | null;
     /** What the last scan saw of the live banner's Accept all / Reject all. Absent until measured. */
     buttonParity?: ButtonParityScan;
-    /** Where the last scan is. Absent when the site was never scanned. */
-    state?: 'queued' | 'scanning' | 'done' | 'failed';
+    /** Where the last scan is: `idle` when the site was never scanned (older servers left it out). */
+    state?: 'idle' | 'queued' | 'scanning' | 'done' | 'failed';
     scanId?: string;
     startedAt?: number;
     finishedAt?: number;
@@ -785,7 +1486,7 @@ interface ParityControlSummary {
  * A warning, never an error — the config is saved regardless. See /docs/fair-consent-buttons.
  */
 interface ButtonParityFinding {
-    code: 'reject_missing_first_layer' | 'reject_missing_same_layer' | 'reject_hidden' | 'reject_below_fold' | 'reject_isolated' | 'reject_low_emphasis' | 'saturation_gap' | 'color_mismatch' | 'reject_text_low_contrast' | 'reject_styled_as_link' | 'font_size_gap' | 'font_weight_gap' | 'size_gap' | 'padding_gap' | 'border_mismatch' | 'reject_label_missing' | 'reject_label_long' | 'confirmshaming' | 'custom_css_asymmetric';
+    code: 'reject_missing_first_layer' | 'reject_missing_same_layer' | 'reject_hidden' | 'reject_below_fold' | 'reject_isolated' | 'reject_low_emphasis' | 'saturation_gap' | 'color_mismatch' | 'reject_text_low_contrast' | 'reject_styled_as_link' | 'font_size_gap' | 'font_weight_gap' | 'size_gap' | 'padding_gap' | 'border_mismatch' | 'reject_label_missing' | 'reject_label_long' | 'confirmshaming' | 'custom_css_asymmetric' | 'text_low_contrast' | 'link_low_contrast' | 'button_text_low_contrast' | 'focus_ring_low_contrast' | 'toggle_low_contrast' | 'control_boundary_low_contrast';
     severity: 'warning' | 'notice';
     layer: 'banner' | 'preferences' | 'modal' | 'popup' | 'bar' | 'inline' | 'custom';
     accept: ParityControlSummary | null;
@@ -807,6 +1508,8 @@ interface ButtonParityFinding {
         language?: string;
         url?: string;
     };
+    /** On a contrast finding: the WCAG success criterion (1.4.3 text, 1.4.11 non-text). */
+    wcag?: '1.4.3' | '1.4.11';
 }
 /** Reject all style values that would match the Accept all on the same layer. */
 interface SuggestedRejectStyle {
@@ -1072,6 +1775,51 @@ interface BrandSuggestion {
 interface BrandExtractionResult {
     suggestion: BrandSuggestion;
 }
+/** PUT /v1/sites/{cbid}/brand: `{url}` alone (fetched once, https only), or a DTCG brand.json document. */
+type BrandImportInput = {
+    url: string;
+} | Record<string, unknown>;
+/** One brand.json role and what it became. */
+interface BrandMappingRow {
+    role: string;
+    /** The site-config path it sets, e.g. `banner.theme.highlight`. */
+    target: string;
+    value: string | number;
+    /** The rights-page theme token the same value feeds. */
+    rightsPage?: string;
+    /** `site` when the site's own banner theme value wins over brand.json. */
+    source: 'brand.json' | 'site';
+    inForce?: string | number;
+    /** Variants that override it for some visitors. */
+    variants?: string[];
+}
+/** The read-back of a brand.json import. Precedence: brand.json < site banner theme < per-banner variant. */
+interface BrandReadBack {
+    cbid: string;
+    dryRun?: boolean;
+    source: {
+        type: 'url';
+        url: string;
+    } | {
+        type: 'body';
+    };
+    importedAt: number;
+    precedence: string;
+    mapping: BrandMappingRow[];
+    ignored: Array<{
+        role: string;
+        reason: string;
+    }>;
+    warnings: Array<{
+        role: string;
+        code: 'third_party_font_host';
+        message: string;
+    }>;
+    configWarnings?: Array<{
+        field: string;
+        reason: string;
+    }>;
+}
 /** A validation/lint issue on a v2 banner flow. */
 interface FlowIssue {
     code: string;
@@ -1146,6 +1894,30 @@ interface ApiKeyPrefix {
     cbids?: string[] | null;
     /** Epoch ms it last authenticated a request (recorded at most hourly); null = not since recording began. */
     lastUsedAt?: number | null;
+    /** The address of that request. */
+    lastUsedIp?: string | null;
+    /** `user:<id>`, `service:<name>` or `apikey:<prefix>`. */
+    owner?: string | null;
+    kind?: 'org' | 'site' | null;
+    env?: 'live' | 'test' | null;
+    format?: 'cookiemunch' | 'legacy';
+    strictUnknownFields?: boolean;
+}
+/** A revoked key in the report: when, by whom, why; never the secret. */
+interface ApiKeyRevoked {
+    prefix: string;
+    name: string | null;
+    owner: string | null;
+    scopes: string[] | null;
+    cbids: string[] | null;
+    createdAt: number;
+    expiresAt: number | null;
+    lastUsedAt: number | null;
+    lastUsedIp: string | null;
+    revokedAt: number;
+    revokedBy: string;
+    reason: 'revoked' | 'rolled' | 'leaked';
+    leakSource: string | null;
 }
 /** GET /v1/keys/report — key hygiene. */
 interface ApiKeyReport {
@@ -1163,11 +1935,21 @@ interface ApiKeyReport {
     }>;
     noExpiry: number;
     total: number;
+    /** Revoked, rolled and leak-revoked keys, newest first. */
+    revoked?: ApiKeyRevoked[];
 }
-/** A newly issued key. `key` is returned ONCE and never again. Returned by keys.issue(). */
+/** A newly issued key. `key` is returned ONCE and never again (or, with `secretRecipient`, sealed). */
 interface ApiKeyIssued {
     key: string;
     prefix: string;
+    expiresAt?: number | null;
+    scopes?: string[] | null;
+    cbids?: string[] | null;
+    /** No expiry, or one over 365 days. */
+    warnings?: string[];
+    /** With `secretRecipient`: the key, sealed (and `key` absent). */
+    sealed_secret?: string;
+    sealed_field?: string;
 }
 /** @deprecated No endpoint returns this shape; use {@link ApiKeyPrefix} / {@link ApiKeyIssued}. */
 interface ApiKey {
@@ -1180,14 +1962,14 @@ interface ApiKey {
     secret?: string;
 }
 /**
- * Input for issuing a new API key.
- *
- * NOTE: the server's POST /v1/keys currently accepts no body and always mints an
- * unscoped key — `name` is not yet honoured server-side. It's kept here (rather than
- * dropped) so a future scoped/named-key endpoint can start reading it without an SDK
- * major version bump; see {@link CookieMunchClient.keys}.
+ * Input for issuing a new API key (POST /v1/keys). Every field is honoured: `scopes`, `cbids`,
+ * `expiresInDays` / `expiresAt`, `name`, `owner` and `strictUnknownFields`.
  */
 interface ApiKeyIssueInput {
+    /** `user:<id>`, `service:<name>` or `apikey:<prefix>`. Default: the calling key. */
+    owner?: string;
+    /** Writes with the new key refuse unknown body fields unless they send `Prefer: lenient-unknown-fields`. */
+    strictUnknownFields?: boolean;
     name?: string;
     /** Least privilege: grant only these scopes. Omit for a full-access key. */
     scopes?: string[];
@@ -1201,6 +1983,25 @@ interface ApiKeyIssueInput {
     /** Or when it expires: epoch ms or an ISO date-time (not with expiresInDays). Omit both: never. */
     expiresAt?: number | string;
 }
+/** One entitlement (suite-standard shape). A feature is `{key, enabled}`; a limit is `limits.<name>`. */
+interface Entitlement {
+    key: string;
+    enabled: boolean;
+    /** Limits only. null = unlimited, 0 = not on this plan. */
+    limit?: number | null;
+    /** Limits the server meters, when metering is wired. */
+    used?: number;
+    source: 'plan';
+}
+/** GET /v1/entitlements: what the org may use, from its effective plan. */
+interface Entitlements {
+    orgId: string;
+    plan: string;
+    planSource: 'org' | 'account';
+    subscribedPlan: string;
+    entitlements: Entitlement[];
+    generatedAt: string;
+}
 /** Org usage/quota summary. Matches the server's Usage schema. */
 interface Usage {
     domains: number;
@@ -1217,6 +2018,86 @@ interface WebhookSubscription {
     cbid: string | null;
     active: boolean;
     createdAt: number;
+    /** The endpoint lifecycle: `failing` from the first event that failed every retry, `disabled` after 72 hours. */
+    state?: 'healthy' | 'failing' | 'disabled' | 'paused';
+    failingSince?: number | null;
+    disabledAt?: number | null;
+    lastSuccessAt?: number | null;
+    lastFailure?: {
+        at: number;
+        status: number | null;
+        error: string | null;
+    } | null;
+    lastDeliveryAt?: number | null;
+    lastStatus?: number | null;
+    consecutiveFailures?: number;
+    /** Who is emailed when it fails; null: the organisation's owners. */
+    alertContacts?: string[] | null;
+    /** On an update that re-enabled a disabled endpoint: how to send what it missed. */
+    replay?: {
+        since: number;
+        path: string;
+    };
+}
+/** POST /v1/webhooks/{id}/replay. */
+interface WebhookReplayResult {
+    ok: boolean;
+    replayed: number;
+    failed: number;
+    remaining: number;
+    stoppedAt?: string;
+    status?: number;
+    error?: string;
+}
+/** The audit-log export (GET/PUT /v1/audit/sink). Never the secret. */
+interface AuditSink {
+    type: 'webhook';
+    url: string;
+    secretSet: true;
+    createdAt: number;
+    updatedAt: number;
+    lastDeliveryAt: number | null;
+    lastStatus: number | null;
+    lastError: string | null;
+}
+interface AuditSinkInput {
+    type: 'webhook';
+    url: string;
+    /** 16–256 characters; omitted: one is generated and returned once. */
+    secret?: string;
+}
+/** GET /v1/sites/{cbid}/consent/insights. */
+interface ConsentInsights {
+    cbid: string;
+    from: number;
+    to: number;
+    totals: {
+        impressions: number | null;
+        decisions: number;
+        optIns: number;
+        optOuts: number;
+        optInRate: number | null;
+        decisionRate: number | null;
+    };
+    byRegion: Array<{
+        region: string;
+        decisions: number;
+        optIns: number;
+        optInRate: number | null;
+    }>;
+    byVariant: Array<{
+        variant: string;
+        impressions: number;
+        optIns: number;
+        optInRate: number | null;
+    }>;
+    byVariantWindow: 'all_time';
+    byLanguage: null;
+    timeToDecision: null;
+    notRecorded: {
+        byLanguage: string;
+        timeToDecision: string;
+    };
 }
 /** One cookie read from another CMP's export. */
 interface ImportedCookie {
@@ -1495,6 +2376,8 @@ interface AuditEntry {
 }
 /** Rename a key, or replace its scopes or the properties it is locked to. */
 interface ApiKeyUpdate {
+    owner?: string;
+    strictUnknownFields?: boolean;
     name?: string;
     scopes?: string[];
     cbids?: string[];
@@ -1532,8 +2415,10 @@ interface WebhookUpdate {
     events?: string[];
     /** One property, or null for every property in the org. */
     cbid?: string | null;
-    /** false pauses delivery without deleting the subscription. */
+    /** false pauses delivery without deleting the subscription; true re-enables a disabled one. */
     active?: boolean;
+    /** 1–10 addresses emailed when it fails; null: back to the organisation's owners. */
+    alertContacts?: string[] | null;
 }
 /** One site to create in a bulk call. */
 interface BulkSiteInput {
@@ -1900,14 +2785,53 @@ interface DsarExecutor {
     presetParams?: Record<string, string>;
     /** How the stored address and profile differ from what its preset version builds. Empty: unmodified. */
     presetDiff?: ConfigChange[];
+    /** Preset-built: profile fields you removed or changed by hand; `upgradeExecutorPreset` keeps them. */
+    profileOverrides?: Array<{
+        path: string;
+        kind: 'removed' | 'changed';
+        at: number;
+    }>;
+    /** Preset-built: true when it must not follow its preset. */
+    presetPinned?: boolean;
+    /** Your name for the credential. */
+    label?: string;
+    /** 2: orchestrator v2 headers on every call; 1: the v1 adapter every connection made before v2 has. */
+    orchestrator?: 1 | 2;
+    hasCompletionSecret?: boolean;
+    completionSecretPrefix?: string;
+    /** When a signed completion last verified; running work is then polled every 6 hours. */
+    lastSignedCompletionAt?: number | null;
+    /** Where signed cm-standard-v2 completions go. */
+    completionsUrl?: string;
+    /** On create only: the completion secret, shown this once. */
+    completionSecret?: string;
+}
+/** POST …/completion-secret/roll. */
+interface CompletionSecretRolled {
+    id: string;
+    completionSecret: string;
+    completionSecretPrefix: string;
+    previousRetiresAt: string | null;
+    completionsUrl?: string;
+}
+/** POST …/test {conformance: true}: the conformance kit's report. */
+interface ExecutorConformanceResult extends ConformanceReport {
+    conformance: true;
+    canary: true;
+    email: string;
 }
-/** A connection's last canary health check. */
+/** A connection's last health check. */
 interface ExecutorHealth {
     lastCheckedAt: number;
     ok: boolean;
     verdict: string;
     /** e.g. `base_url_redirects`, `credential_unavailable`. */
     code?: string;
+    /** When a check last passed. */
+    lastSuccessAt?: number;
+    /** On reads: true when the last check is more than an hour old, with the command that re-checks it in `hint`. */
+    stale?: boolean;
+    hint?: string;
 }
 /** A preset's name, as `executorPresets()` lists them. Not enumerated here: presets are data. */
 type ExecutorPresetName = string;
@@ -1924,9 +2848,15 @@ interface DsarExecutorPresetInput {
     baseUrl?: string;
     orgId?: string;
     atlasIdAppId?: string;
+    /** A preset param, when the preset lists it: default false. True adds an optional step revoking the person's app grant on erasure. */
+    revokeAtlasIdGrant?: boolean;
     webhookSecret?: string;
     auto?: boolean;
     cbid?: string;
+    /** Your name for the credential, shown beside `keyPrefix`. */
+    label?: string;
+    /** Default 2. */
+    orchestrator?: 1 | 2;
 }
 /** What `upgradeExecutorPreset` takes: a version, a preset to adopt, or params to add. */
 interface ExecutorPresetUpgrade {
@@ -1934,6 +2864,25 @@ interface ExecutorPresetUpgrade {
     presetVersion?: number;
     orgId?: string;
     atlasIdAppId?: string;
+    revokeAtlasIdGrant?: boolean;
+    /** Overridden paths (`profileOverrides`) that take the preset's value again; every other override is kept. */
+    acceptPreset?: string | string[];
+}
+/** One step a preset builds, and whether it can run now (CMU-B01). */
+interface ExecutorPresetStep {
+    name: 'subjectLookup' | 'open' | 'poll' | 'webhook' | 'grantRevoke';
+    available: boolean;
+    /** Never fails a connection: a credential without the scope reports `skipped: insufficient_scope`. */
+    optional?: boolean;
+    /** False: added only with `param`. */
+    defaultOn: boolean;
+    param?: string;
+    note?: string;
+    waitingOn?: {
+        platform: string;
+        items: string[];
+        operations: string[];
+    };
 }
 /** The presets, which are usable now, and this org's canary address. */
 interface ExecutorPresets {
@@ -1947,6 +2896,7 @@ interface ExecutorPresets {
             name: string;
             required: boolean;
             description: string;
+            type?: 'string' | 'boolean';
         }>;
         available: boolean;
         waitingOn?: {
@@ -1954,6 +2904,7 @@ interface ExecutorPresets {
             items: string[];
             operations: string[];
         };
+        steps: ExecutorPresetStep[];
     }>;
 }
 /** What a connection write would do (`?dryRun=1`). Nothing was stored. */
@@ -2015,6 +2966,8 @@ interface DsarExecutorInput {
     subjectNote?: string;
     /** How to drive it. */
     profile: ExecutorProfile;
+    /** Default 2. */
+    orchestrator?: 1 | 2;
 }
 type DsarExecutorCreated = DsarExecutor;
 /** The fields `updateExecutor` may change. */
@@ -2026,12 +2979,18 @@ interface DsarExecutorPatch {
     auto?: boolean;
     /** null removes it. */
     subjectNote?: string | null;
+    /** Your name for the credential; null removes it. */
+    label?: string | null;
+    /** Preset-built only: true stops `upgradeExecutorPreset` changing it. */
+    presetPinned?: boolean;
+    /** Opt in to (2) or out of (1) orchestrator v2. */
+    orchestrator?: 1 | 2;
 }
 /** One entry in a fulfilment task's status history. */
 interface DsarTaskEvent {
     at: number;
     kind: 'created' | 'changed' | 'version_changed';
-    status: 'pending' | 'running' | 'done' | 'failed';
+    status: 'pending' | 'running' | 'done' | 'failed' | 'cancelled';
     detail?: string;
     outcome?: DsarTaskOutcome;
     scheduledFor?: number;
@@ -2070,7 +3029,7 @@ interface DsarTask {
     requestId: string;
     system: string;
     operation: FulfillmentOp;
-    status: 'pending' | 'running' | 'done' | 'failed';
+    status: 'pending' | 'running' | 'done' | 'failed' | 'cancelled';
     detail?: string;
     outcome?: DsarTaskOutcome;
     attempts: number;
@@ -2111,6 +3070,11 @@ interface ExecutorTestResult {
     code?: string;
     /** The subject's app grant at an identity platform, when the profile has a grant step. Never revoked by a test. */
     grant?: string;
+    /** Optional steps this credential may not run: reported, never a failure. */
+    skipped?: Array<{
+        step: string;
+        reason: 'insufficient_scope';
+    }>;
     /** Present when the test used the org canary address, with the address in `email`. */
     canary?: boolean;
     email?: string;
@@ -2159,7 +3123,7 @@ interface CookieMunchClient {
          * comes from, plus the per-account org cap and the upgrade URL. Needs an unscoped key that
          * is not locked to properties.
          */
-        list(): Promise<AccountOrgs>;
+        list(opts?: MetadataFilter): Promise<AccountOrgs>;
         /**
          * Create a sibling organisation owned by the same account — for a separate business of
          * your own. Needs an unscoped key. Not reseller provisioning, which is for your customers.
@@ -2167,7 +3131,9 @@ interface CookieMunchClient {
         create(name: string, opts?: {
             mintKey?: boolean;
             keyScopes?: string[];
-        }): Promise<{
+            keyExpiresInDays?: number;
+            keyOwner?: string;
+        } & ResourceTagsInput): Promise<{
             org: {
                 id: string;
                 name: string;
@@ -2176,10 +3142,28 @@ interface CookieMunchClient {
             apiKey?: string;
             keyError?: string;
         }>;
+        /** Hard-delete a SANDBOX organisation of this account (created with metadata.forgedeck_sandbox). Anything else: 403 not_a_sandbox. */
+        deleteSandbox(id: string): Promise<SandboxPurge>;
+    };
+    /** Tags on any created resource (CMU-X29). */
+    metadata: {
+        get(type: TaggedType, id: string): Promise<ResourceTags>;
+        /** Merge tags (null removes one). `forgedeck_sandbox` cannot be set here. `{ dryRun: true }` answers with the diff. */
+        update(type: TaggedType, id: string, metadata: Record<string, string | number | boolean | null>, opts?: {
+            dryRun?: boolean;
+        }): Promise<ResourceTagsUpdate>;
+    };
+    /** Partner links in the suite-standard shape (CMU-X34). */
+    partnerLinks: {
+        list(opts?: MetadataFilter): Promise<StandardPartnerLink[]>;
+        create(input: StandardPartnerLinkCreate): Promise<StandardPartnerLink>;
+        revoke(id: string): Promise<StandardPartnerLink>;
     };
+    /** What `forgedeck env` writes for a product provisioned with this forgedeck ref: names, values, secret references. */
+    provisionEnv(ref: string): Promise<ProvisionEnv>;
     sites: {
-        list(): Promise<Site[]>;
-        create(input: SiteCreate): Promise<Site>;
+        list(opts?: MetadataFilter): Promise<Site[]>;
+        create(input: SiteCreate & ResourceTagsInput): Promise<Site>;
         get(cbid: string): Promise<Site>;
         /**
          * Rename or move a site: domain, display name, aliases. The cbid and the consent ledger stay; a domain
@@ -2189,6 +3173,8 @@ interface CookieMunchClient {
             dryRun?: boolean;
         }): Promise<SiteUpdateResult>;
         delete(cbid: string): Promise<void>;
+        /** Purge a SANDBOX site: its consent ledger, declarations and test rights requests too. Anything else: 403 not_a_sandbox. */
+        deleteSandbox(cbid: string): Promise<SandboxPurge>;
         /** Partner platforms granted this site's consent events, and the partners on offer. */
         listPartners(cbid: string): Promise<{
             links: PartnerLink[];
@@ -2326,9 +3312,10 @@ interface CookieMunchClient {
             dryRun: true;
             retired: RetiredCookie[];
         }>;
-        /** Every declaration preset (atlas, forumulate, chatly, cookiemunch, referally): params, what it declared here, manifest status. */
+        /** Every declaration preset (atlas, forumulate, chatly, cookiemunch, referalli, firstpromoter, partnerstack, tapfiliate, impact): params, what it declared here, manifest status. */
         cookiePresets(cbid: string): Promise<{
             presets: CookiePreset[];
+            aliases?: Record<string, string>;
         }>;
         /**
          * Apply (or re-sync) a vendor preset: declares what that platform writes, marked
@@ -2337,11 +3324,28 @@ interface CookieMunchClient {
         applyCookiePreset(cbid: string, vendor: CookiePresetVendor, params?: CookiePresetParams, opts?: {
             dryRun?: boolean;
         }): Promise<CookiePresetResult>;
+        /**
+         * Declare ANY vendor's cookies and storage from its embed manifest (`url`, re-read hourly, or
+         * the `manifest` itself). The vendor id is the manifest's `product`; remove it with
+         * removeCookiePreset(cbid, product). `dryRun` stores nothing.
+         */
+        importCookieManifest(cbid: string, input: CustomPresetInput, opts?: {
+            dryRun?: boolean;
+        }): Promise<CookiePresetResult>;
+        /** What to declare: detected vendors (script, storage, manifest) and one suggestion per undeclared row. */
+        cookieSuggestions(cbid: string): Promise<CookieSuggestions>;
+        /** Declare the suggestions: detected vendors' presets, then every other suggestion with a purpose. Try `dryRun` first. */
+        declareCookieSuggestions(cbid: string, input?: {
+            names?: string[];
+            presets?: boolean;
+        }, opts?: {
+            dryRun?: boolean;
+        }): Promise<CookieSuggestionsDeclared>;
         /** Remove every declaration a vendor preset made. */
-        removeCookiePreset(cbid: string, vendor: CookiePresetVendor, opts?: {
+        removeCookiePreset(cbid: string, vendor: CookiePresetVendor | (string & {}), opts?: {
             dryRun?: boolean;
         }): Promise<{
-            vendor: CookiePresetVendor;
+            vendor: string;
             removed: string[];
             dryRun?: true;
             declared?: DeclaredCookie[];
@@ -2400,6 +3404,12 @@ interface CookieMunchClient {
             results: BulkSiteResult[];
         }>;
         brand(cbid: string): Promise<BrandExtractionResult>;
+        /** Read back the brand.json last imported: each role, its source (brand.json or site), ignored[] and warnings[]. 404 when none. */
+        getBrand(cbid: string): Promise<BrandReadBack>;
+        /** Import a brand.json (`{url}` or the document) into the banner theme and the rights page. `dryRun` saves nothing. */
+        setBrand(cbid: string, input: BrandImportInput, opts?: {
+            dryRun?: boolean;
+        }): Promise<BrandReadBack>;
         /** Read a site's v2 banner flow (views, categories) plus any lint issues. */
         getFlow(cbid: string): Promise<SiteFlow>;
         /** Apply an ordered batch of structured edit ops; validated + persisted if lint-clean. */
@@ -2417,6 +3427,8 @@ interface CookieMunchClient {
             valid: boolean;
         }>;
         stats(cbid: string, query?: RangeQuery): Promise<ConsentDay[]>;
+        /** Opt-in by region and A/B variant, and the decision rate. Language and time-to-decision are not recorded (null). */
+        insights(cbid: string, query?: RangeQuery): Promise<ConsentInsights>;
         log(cbid: string, query?: LogQuery): Promise<ConsentLogRow[]>;
         export(cbid: string, query?: RangeQuery): Promise<string>;
         receipt(cbid: string, stamp: string): Promise<SignedReceipt>;
@@ -2435,6 +3447,12 @@ interface CookieMunchClient {
          *  prefix and no auth is required by the server (the cbid must be a registered site); for
          *  server-side / non-browser consent flows. Pass `subjectId` to correlate a subject cross-surface. */
         ingest(input: ConsentIngestInput): Promise<void>;
+        /**
+         * The reserved categories any site can switch on with `categories.suite` (`support_chat`,
+         * `referrals`): stance, fallback, regulatory basis, wording in every banner language, and
+         * known vendors. Public — `GET /v1/categories/registry` needs no key.
+         */
+        categoryRegistry(): Promise<CategoryRegistry>;
     };
     dsar: {
         list(): Promise<DsarRequest[]>;
@@ -2443,7 +3461,7 @@ interface CookieMunchClient {
          * wrapped as `{ request }`, so `create(...).request.id` is what you pass here.
          */
         get(id: string): Promise<DsarRequest>;
-        create(input: DsarCreate): Promise<{
+        create(input: DsarCreate & ResourceTagsInput): Promise<{
             request: DsarRequest;
         }>;
         /** `opts.messageToSubject` replaces the line the subject reads in the notice — for a rejection, why. */
@@ -2478,6 +3496,24 @@ interface CookieMunchClient {
             request: DsarRequest;
             changed: boolean;
         }>;
+        /** Requests carrying one X-ForgeDeck-Trace (`GET /v1/dsar?trace=`). */
+        listByTrace(trace: string): Promise<DsarRequest[]>;
+        /**
+         * Open a case fanned out to every connected system (POST /v1/dsar/requests). `opts.idempotencyKey`
+         * (16–128 chars) makes a retry answer the same case; `opts.trace` passes your X-ForgeDeck-Trace on.
+         */
+        openCase(input: DsarCaseCreate, opts?: {
+            idempotencyKey?: string;
+            trace?: string;
+        }): Promise<DsarCase>;
+        /** One case across every system. */
+        getCase(id: string): Promise<DsarCase>;
+        /** Cancel a case before executeAfter; status `cancelled` once every system confirmed. */
+        cancelCase(id: string): Promise<DsarCase>;
+        /** The signed receipt for a case. */
+        caseReceipt(id: string): Promise<DsarCaseReceipt>;
+        /** The signed receipt as a PDF. */
+        caseReceiptPdf(id: string): Promise<ArrayBuffer>;
     };
     vendors: {
         list(): Promise<ScoredVendor[]>;
@@ -2716,12 +3752,14 @@ interface CookieMunchClient {
          * platform holding your users' accounts, for instance. The in-VPC agent covers the
          * systems we cannot reach; these are the ones we can.
          */
-        executors(): Promise<DsarExecutor[]>;
+        executors(opts?: MetadataFilter): Promise<DsarExecutor[]>;
+        /** One connection with its full profile, never the credentials. Read it before changing `profile`: `updateExecutor` replaces the whole profile. */
+        executor(id: string): Promise<DsarExecutor>;
         /**
          * Connect one. The secret is stored encrypted and never returned; the response carries
          * the URL to point that system's webhook at.
          */
-        connectExecutor(input: DsarExecutorInput | DsarExecutorPresetInput): Promise<DsarExecutorCreated>;
+        connectExecutor(input: (DsarExecutorInput | DsarExecutorPresetInput) & ResourceTagsInput): Promise<DsarExecutorCreated>;
         /**
          * Change a connection in place. Only what you send changes, and the stored credential
          * is kept unless you pass a new `secretKey` — so adding a field to a profile does not
@@ -2771,6 +3809,16 @@ interface CookieMunchClient {
          * the raw (redacted) upstream answers and what a real request would have sent.
          */
         testExecutor(id: string, input: ExecutorTestInput): Promise<ExecutorTestResult>;
+        /** Re-check a connection now (a canary test that records its health); for a deploy pipeline. */
+        recheckExecutor(id: string): Promise<ExecutorTestResult>;
+        /** A connection's last health checks, newest first (`limit` 1 to 50, default 50). */
+        executorHealthHistory(id: string, opts?: {
+            limit?: number;
+        }): Promise<ExecutorHealth[]>;
+        /** Run the cm-standard-v2 conformance kit against a connection, on the canary subject only. */
+        executorConformance(id: string): Promise<ExecutorConformanceResult>;
+        /** A new completion secret, shown once; the old one keeps verifying for 24 hours. */
+        rollExecutorCompletionSecret(id: string): Promise<CompletionSecretRolled>;
     };
     preferences: {
         list(): Promise<PreferenceItem[]>;
@@ -2831,16 +3879,55 @@ interface CookieMunchClient {
             unusedDays?: number;
             expiringDays?: number;
         }): Promise<ApiKeyReport>;
+        /** The suite-standard listing (`?shape=standard`). */
+        listStandard(): Promise<StandardKeyList>;
+        /** The calling key itself, whatever its scopes: check its own expiry. */
+        self(): Promise<ApiKeyPrefix>;
+        /** The calling key rotates itself; the old secret stops at once. Use a client with an Idempotency-Key header. */
+        rollSelf(): Promise<ApiKeyIssued>;
+        /** A short-lived key (ttlSeconds at most 43200) within this key's own scopes and properties. Needs keys:write or full access. */
+        vend(input: {
+            scopes: string[];
+            ttlSeconds: number;
+            cbids?: string[];
+            name?: string;
+        }): Promise<ApiKeyVended>;
+        /** Revoke a leaked secret (works without a valid key; always answers { received }). */
+        revokeLeaked(report: LeakReport): Promise<{
+            received: number;
+        }>;
     };
     usage(): Promise<Usage>;
+    /** What the org may use: every plan feature (`whiteLabel`, `tcf`, …) and limit, in the suite-standard shape. Any key may read it. */
+    entitlements(): Promise<Entitlements>;
     /** Every link a site's privacy wiring depends on, one row each with `ok` and a fix hint. `cbid` may be omitted with one site. */
     integrationHealth(cbid?: string): Promise<IntegrationHealthReport>;
+    /** Waive a health check you chose not to meet: the row reports `ok: null` with `waived`. Audited. */
+    healthWaivers: {
+        list(cbid?: string): Promise<{
+            cbid: string;
+            waivers: HealthWaiver[];
+        }>;
+        set(input: HealthWaiverInput): Promise<{
+            waiver: HealthWaiver;
+        }>;
+        remove(check: string, opts?: {
+            cbid?: string;
+            subject?: string;
+        }): Promise<void>;
+    };
+    /**
+     * The site's embed manifest: the tenant variant of `/.well-known/forgedeck-embed.json` — every
+     * origin by CSP directive and every browser key the embed writes for this site's config. Public.
+     */
+    embedManifest(cbid: string): Promise<EmbedManifest>;
     /**
      * Wire a product's privacy in one call: the site, connected systems, Atlas and Forumulate. Idempotent;
      * `{ dryRun: true }` writes nothing anywhere. No secret appears in the answer.
      */
-    provision(input: ProvisionRequest, opts?: {
+    provision(input: ProvisionRequest | ProvisionRequestV2, opts?: {
         dryRun?: boolean;
+        fromStep?: string;
     }): Promise<ProvisionResult>;
     /** The key's organisation. Requires an unscoped key that is not property-locked. */
     org: {
@@ -2889,9 +3976,23 @@ interface CookieMunchClient {
         };
     };
     /** The org's audit log, newest first. API actions appear as `apikey:<prefix>`. */
-    audit(limit?: number): Promise<{
+    /** `{ actor: 'self' }` reads the calling key's own rows, the one form a scoped key may call. */
+    audit(limit?: number, opts?: {
+        actor?: string;
+    }): Promise<{
         entries: AuditEntry[];
     }>;
+    /** Stream the audit log to an HTTPS endpoint as CloudEvents 1.0. Unscoped keys. */
+    auditSink: {
+        get(): Promise<{
+            sink: AuditSink;
+        }>;
+        set(input: AuditSinkInput): Promise<{
+            sink: AuditSink;
+            secret?: string;
+        }>;
+        remove(): Promise<void>;
+    };
     assets: {
         /** Upload a banner image (≤ 1,000,000 bytes) and get its public URL. Requires sites:write. */
         upload(input: AssetUpload): Promise<{
@@ -2926,8 +4027,8 @@ interface CookieMunchClient {
         revokeKey(id: string, prefix: string): Promise<void>;
     };
     webhooks: {
-        list(): Promise<WebhookSubscription[]>;
-        create(input: WebhookCreate): Promise<WebhookSubscription>;
+        list(opts?: MetadataFilter): Promise<WebhookSubscription[]>;
+        create(input: WebhookCreate & ResourceTagsInput): Promise<WebhookSubscription>;
         /** Change or pause a subscription. `{ active: false }` pauses without deleting it. */
         update(id: string, patch: WebhookUpdate): Promise<WebhookSubscription>;
         delete(id: string): Promise<void>;
@@ -2943,6 +4044,10 @@ interface CookieMunchClient {
         }>;
         /** Deliver a dead letter again, to the subscription as it is now. */
         replayDeadLetter(id: string): Promise<unknown>;
+        /** Send what a failing or disabled endpoint missed since `since` (epoch ms or ISO), oldest first, stopping at the first failure. */
+        replay(id: string, since: number | string, opts?: {
+            limit?: number;
+        }): Promise<WebhookReplayResult>;
     };
     /**
      * Account-linked rights requests: a single-use link to the hosted rights page for a person your
@@ -2984,6 +4089,23 @@ interface CookieMunchClient {
         /** Remove the site's own setting: it inherits the organisation default again. */
         remove(cbid: string): Promise<RightsIdentity>;
     };
+    /** A site's rights-request settings: graceDays (0–30; 7 for a new site, 0 until set for one that existed before). Requires dsar:read / dsar:write. */
+    dsarSettings: {
+        get(cbid: string): Promise<DsarSettings>;
+        set(cbid: string, input: {
+            graceDays: number;
+        }): Promise<DsarSettings>;
+    };
+    /** Cards for support, CRM and helpdesk sidebars. Requires dsar:read. */
+    integrations: {
+        /** Open rights requests for one person, by identity (preferred) or email. */
+        subjectCard(app: string, person: {
+            iss: string;
+            sub: string;
+        } | {
+            email: string;
+        }): Promise<SubjectCard>;
+    };
     /** One person's consent across every site in the org, by the subjectId your apps attach. */
     subjects: {
         /** Requires consent:read; not available to property-locked keys. */
@@ -3019,4 +4141,4 @@ interface CookieMunchClient {
 }
 declare function createCookieMunch(opts: CookieMunchOptions): CookieMunchClient;
 
-export { type AbResult, type AccountOrg, type AccountOrgs, type AdPersonalizationInput, type AiInspectInput, type AiInspectResult, type ApiKey, type ApiKeyIssueInput, type ApiKeyIssued, type ApiKeyPrefix, type ApiKeyReport, type ApiKeyUpdate, type AppliedImport, type AssetUpload, type AuditEntry, type BannerRecord, type BannerSummary, type BlockedReport, type BrandExtractionResult, type BrandKit, type BrandKitCreate, type BrandSuggestion, type BulkSiteInput, type BulkSiteResult, type ButtonParityFinding, type ButtonParityLint, type ButtonParityScan, type CategorizedCookie, type CenterToken, type CenterTokenInput, type ChildKeyInput, type ConfigChange, type ConfigDryRun, type ConfigWarning, type ConsentDay, type ConsentDecisionInput, type ConsentIngestInput, type ConsentLogRow, type ConsentSyncSecret, type ConsentSyncSecretMinted, type CookieDeclaration, CookieMunchApiError, type CookieMunchClient, type CookieMunchOptions, type CookiePreset, type CookiePresetManifest, type CookiePresetParams, type CookiePresetResult, type CookiePresetVendor, type CspSources, type DeclarationDiff, type DeclarationDryRun, type DeclarationWarning, type DeclaredCookie, type DeclaredCookieInput, type DnsRecordInstruction, type DsarCreate, type DsarEraseResult, type DsarExecutor, type DsarExecutorCreated, type DsarExecutorDryRun, type DsarExecutorInput, type DsarExecutorPatch, type DsarExecutorPresetInput, type DsarExportResult, type DsarRequest, type DsarStatus, type DsarTask, type DsarTaskEvent, type DsarTaskExport, type DsarTaskLogEntry, type DsarTaskOutcome, type DsarType, type EnforcementRuleInput, type ExecutorHealth, type ExecutorPresetName, type ExecutorPresetUpgrade, type ExecutorPresets, type ExecutorProfile, type ExecutorTestInput, type ExecutorTestResult, type ExecutorWebhookDelivery, type ExecutorWebhookTestResult, type FlowIssue, type FlowOp, type FlowOpResponse, type FulfillmentOp, type HealthRow, type Identifier, type Identity, type ImportedCookie, type ImportedDeclaration, type InstallSnippet, type IntegrationHealthReport, type LegalBasis, type LogQuery, type MailProvider, type MailProviderInput, type MailProviderKind, type MailProviderTestResult, type Member, type MintConsentSyncTokenInput, type ObservedPurgeResult, type OptInMethod, type Org, type OrgControllerIdentity, type OrgControllerInput, type OrgUpdate, type ParityControlSummary, type PartnerCatalogEntry, type PartnerId, type PartnerLink, type PartnerLinkCreate, type PlanSource, type PolicyOptions, type PreferenceItem, type PreferenceRecord, type PreviewToken, type PreviewTokenOptions, type ProfileAttributeInput, type ProvisionRequest, type ProvisionResult, type ProvisionStep, type PublicDsarFiled, type PublicDsarPending, type PublicVerification, type PutConfigOptions, type RangeQuery, type Regulation, type RegulationSummary, type RegulatoryFeedResult, type ResellerChild, type ResellerChildCreate, type ResellerChildList, type ResellerChildPatch, type RetiredCookie, type RightKind, type RightsCaptcha, type RightsCaptchaInput, type RightsCaptchaProvider, type RightsIdentity, type RightsIdentityInput, type RightsIdentityType, type RightsLink, type RightsLinkInput, type RightsPageDocument, type RightsPageDomain, type RightsPageDomainList, type RightsPageDraft, type RightsPageDraftConflict, type RightsPageDryRun, type RightsPageIssue, type RightsPagePublishResult, type RightsPagePublished, type RightsPagePublisher, type RightsPageVersions, type RightsPageWriteOptions, type RiskScore, type RopaEntry, type RopaInput, SDK_VERSION, type ScanResult, type ScanStatus, type ScoredVendor, type ScrollbarTheme, type SessionAnalysisInput, type SignedReceipt, type Site, type SiteConfig, type SiteCookie, type SiteCreate, type SiteFlow, type SiteUpdate, type SiteUpdateResult, type SnippetOptions, type StorageType, type SubscriptionTopicInput, type SuggestedRejectStyle, type SupportedLanguage, type Usage, type VendorInput, type VendorRecord, type VerifyResult, type VerifyWebhookInput, type WebhookCreate, type WebhookDeadLetter, type WebhookKeyForm, type WebhookStage, type WebhookSubscription, type WebhookTestResult, type WebhookUpdate, createCookieMunch, mintConsentSyncToken, verifyWebhookSignature };
+export { type AbResult, type AccountOrg, type AccountOrgs, type AdPersonalizationInput, type AiInspectInput, type AiInspectResult, type ApiKey, type ApiKeyIssueInput, type ApiKeyIssued, type ApiKeyPrefix, type ApiKeyReport, type ApiKeyRevoked, type ApiKeyUpdate, type ApiKeyVended, type AppliedImport, type AssetUpload, type AuditEntry, type AuditSink, type AuditSinkInput, type BannerRecord, type BannerSummary, type BlockedReport, type BrandExtractionResult, type BrandImportInput, type BrandKit, type BrandKitCreate, type BrandMappingRow, type BrandReadBack, type BrandSuggestion, type BulkSiteInput, type BulkSiteResult, type ButtonParityFinding, type ButtonParityLint, type ButtonParityScan, CANARY_ISSUER, CONFORMANCE_RULES, type CategorizedCookie, type CategoryRegistry, type CenterToken, type CenterTokenInput, type ChildKeyInput, type CompletionSecretRolled, type ConfigChange, type ConfigDryRun, type ConfigWarning, type ConformanceOptions, type ConformanceReport, type ConformanceRuleResult, type ConformanceStatus, type ConsentDay, type ConsentDecisionInput, type ConsentIngestInput, type ConsentInsights, type ConsentLogRow, type ConsentSyncSecret, type ConsentSyncSecretMinted, type CookieDeclaration, CookieMunchApiError, type CookieMunchClient, type CookieMunchOptions, type CookiePreset, type CookiePresetManifest, type CookiePresetParams, type CookiePresetResult, type CookiePresetVendor, type CookieSuggestion, type CookieSuggestions, type CookieSuggestionsDeclared, type CspSources, type CustomPresetInput, type DeclarationDiff, type DeclarationDryRun, type DeclarationWarning, type DeclaredCookie, type DeclaredCookieInput, type DnsRecordInstruction, type DsarCase, type DsarCaseCreate, type DsarCaseReceipt, type DsarCaseStatus, type DsarCaseTask, type DsarCreate, type DsarEraseResult, type DsarExecutor, type DsarExecutorCreated, type DsarExecutorDryRun, type DsarExecutorInput, type DsarExecutorPatch, type DsarExecutorPresetInput, type DsarExportResult, type DsarRequest, type DsarSettings, type DsarStatus, type DsarSubject, type DsarTask, type DsarTaskEvent, type DsarTaskExport, type DsarTaskLogEntry, type DsarTaskOutcome, type DsarType, type DsarTypeWord, type EmbedManifest, type EmbedManifestStorage, type EmbedManifestSurface, type EnforcementRuleInput, type Entitlement, type Entitlements, type ExecutorConformanceResult, type ExecutorHealth, type ExecutorPresetName, type ExecutorPresetStep, type ExecutorPresetUpgrade, type ExecutorPresets, type ExecutorProfile, type ExecutorTestInput, type ExecutorTestResult, type ExecutorWebhookDelivery, type ExecutorWebhookTestResult, type FdCause, type FdConsent, type FdConsentQueue, type FdQueuedCall, type FdRequestOptions, type FdSnapshot, type FlowIssue, type FlowOp, type FlowOpResponse, type FulfillmentOp, type HealthRow, type HealthWaiver, type HealthWaiverInput, type Identifier, type Identity, type ImportedCookie, type ImportedDeclaration, type InstallSnippet, type IntegrationHealthReport, type LeakReport, type LegalBasis, type LogQuery, type MailProvider, type MailProviderInput, type MailProviderKind, type MailProviderTestResult, type Member, type MetadataFilter, type MintConsentSyncTokenInput, type ObservedPurgeResult, type OptInMethod, type Org, type OrgControllerIdentity, type OrgControllerInput, type OrgUpdate, type ParityControlSummary, type PartnerCatalogEntry, type PartnerId, type PartnerLink, type PartnerLinkCreate, type PlanSource, type PolicyOptions, type PreferenceItem, type PreferenceRecord, type PreviewToken, type PreviewTokenOptions, type ProfileAttributeInput, type ProvisionEnv, type ProvisionRequest, type ProvisionRequestV2, type ProvisionResult, type ProvisionStep, type PublicDsarFiled, type PublicDsarPending, type PublicVerification, type PutConfigOptions, type RangeQuery, type Regulation, type RegulationSummary, type RegulatoryFeedResult, type ResellerChild, type ResellerChildCreate, type ResellerChildList, type ResellerChildPatch, type ResourceMetadata, type ResourceTags, type ResourceTagsInput, type ResourceTagsUpdate, type RetentionLine, type RetiredCookie, type RightKind, type RightsCaptcha, type RightsCaptchaInput, type RightsCaptchaProvider, type RightsIdentity, type RightsIdentityInput, type RightsIdentityType, type RightsLink, type RightsLinkInput, type RightsPageDocument, type RightsPageDomain, type RightsPageDomainList, type RightsPageDraft, type RightsPageDraftConflict, type RightsPageDryRun, type RightsPageIssue, type RightsPagePublishResult, type RightsPagePublished, type RightsPagePublisher, type RightsPageVersions, type RightsPageWriteOptions, type RiskScore, type RopaEntry, type RopaInput, SDK_VERSION, type SandboxPurge, type ScanResult, type ScanStatus, type ScoredVendor, type ScrollbarTheme, type SessionAnalysisInput, type SignedReceipt, type Site, type SiteConfig, type SiteCookie, type SiteCreate, type SiteFlow, type SiteUpdate, type SiteUpdateResult, type SnippetOptions, type StandardKeyList, type StandardPartnerLink, type StandardPartnerLinkCreate, type StorageType, type SubjectCard, type SubjectIdentity, type SubscriptionTopicInput, type SuggestedRejectStyle, type SupportedLanguage, type TaggedType, type Usage, type VendorInput, type VendorRecord, type VerifyResult, type VerifyWebhookInput, type WebhookCreate, type WebhookDeadLetter, type WebhookKeyForm, type WebhookReplayResult, type WebhookStage, type WebhookSubscription, type WebhookTestResult, type WebhookUpdate, canaryIdentityFor, createCookieMunch, mintConsentSyncToken, runExecutorConformance, verifyWebhookSignature };