@cookiemunch/sdk 0.5.1 → 0.7.0

package/dist/index.cjs

@@ -20,15 +20,25 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var src_exports = {};
 __export(src_exports, {
+  CANARY_ISSUER: () => CANARY_ISSUER,
+  CONFORMANCE_RULES: () => CONFORMANCE_RULES,
   CONSENT_COOKIE_NAME: () => CONSENT_COOKIE_NAME,
   CookieMunchApiError: () => CookieMunchApiError,
+  DEFAULT_JWKS_URL: () => DEFAULT_JWKS_URL,
   SDK_VERSION: () => SDK_VERSION,
+  TokenExchangeError: () => TokenExchangeError,
+  canaryIdentityFor: () => canaryIdentityFor,
+  consentSignaturePayload: () => consentSignaturePayload,
   createCookieMunch: () => createCookieMunch,
+  exchangeOperatorToken: () => exchangeOperatorToken,
   getConsent: () => getConsent,
   isAllowed: () => isAllowed,
   mintConsentSyncToken: () => mintConsentSyncToken,
   parseConsentValue: () => parseConsentValue,
   readConsent: () => readConsent,
+  runExecutorConformance: () => runExecutorConformance,
+  verifyDecisionSignature: () => verifyDecisionSignature,
+  verifyToken: () => verifyToken,
   verifyWebhookSignature: () => verifyWebhookSignature
 });
 module.exports = __toCommonJS(src_exports);
@@ -89,6 +99,7 @@ function normalize(o) {
     for (const [k, v] of Object.entries(r.custom)) if (bool(v)) custom[k] = v;
     if (Object.keys(custom).length > 0) out.custom = custom;
   }
+  if (typeof r.sig === "string") out.sig = r.sig;
   return out;
 }
 function parseConsentValue(raw) {
@@ -108,6 +119,12 @@ function parseConsentValue(raw) {
 }
 var DAY_MS = 24 * 60 * 60 * 1e3;
 function readConsent(source, opts = {}) {
+  const consent = readUnsigned(source, opts);
+  if (opts.requireSigned !== true) return consent;
+  if (!consent?.sig) return Promise.resolve(null);
+  return verifyDecisionSignature(consent, opts).then((ok) => ok ? consent : null);
+}
+function readUnsigned(source, opts) {
   const raw = cookieValue(cookieHeaderOf(source), opts.cookieName ?? CONSENT_COOKIE_NAME);
   const consent = raw ? parseConsentValue(raw) : null;
   if (!consent) return null;
@@ -128,6 +145,78 @@ function isAllowed(consent, category) {
   if (category === "marketing") return consent.marketing === true;
   return consent.custom?.[category] === true;
 }
+var DEFAULT_JWKS_URL = "https://api.cookiemunch.net/v1/partner/jwks.json";
+function consentSignaturePayload(d) {
+  const b = (v) => v ? "1" : "0";
+  const custom = d.custom ?? {};
+  const named = Object.keys(custom).sort().map((k) => `${k}=${b(custom[k])}`).join(",");
+  return `cmc1|${d.stamp}|${d.ver}|${d.utc}|${b(d.preferences)}${b(d.statistics)}${b(d.marketing)}|${named}`;
+}
+var jwksCache = /* @__PURE__ */ new Map();
+var JWKS_TTL_MS = 60 * 60 * 1e3;
+async function keySet(opts, kid) {
+  if (opts.jwks) return opts.jwks;
+  const url = opts.jwksUrl ?? DEFAULT_JWKS_URL;
+  const hit = jwksCache.get(url);
+  if (hit && Date.now() - hit.at < JWKS_TTL_MS && hit.set.keys.some((k) => k.kid === kid)) return hit.set;
+  const f = opts.fetch ?? globalThis.fetch;
+  if (!f) throw new Error("no fetch available to load the key set; pass `jwks`");
+  const res = await f(url);
+  if (!res.ok) throw new Error(`key set ${url} answered ${res.status}`);
+  const set = await res.json();
+  if (!set || !Array.isArray(set.keys)) throw new Error(`key set ${url} is not a JWKS`);
+  jwksCache.set(url, { at: Date.now(), set });
+  return set;
+}
+function b64urlBytes(s) {
+  const b64 = s.replace(/-/g, "+").replace(/_/g, "/") + "===".slice((s.length + 3) % 4);
+  const bin = atob(b64);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+}
+async function edVerify(jwk, data, signature) {
+  const subtle = globalThis.crypto?.subtle;
+  if (!subtle) throw new Error("WebCrypto is unavailable in this runtime");
+  if (jwk.kty !== "OKP" || jwk.crv !== "Ed25519" || !jwk.x) return false;
+  const key = await subtle.importKey("jwk", { kty: "OKP", crv: "Ed25519", x: jwk.x }, { name: "Ed25519" }, false, ["verify"]);
+  return subtle.verify({ name: "Ed25519" }, key, b64urlBytes(signature), new TextEncoder().encode(data));
+}
+async function verifyDecisionSignature(consent, opts = {}) {
+  const dot = consent.sig?.lastIndexOf(".") ?? -1;
+  if (!consent.sig || dot <= 0) return false;
+  const kid = consent.sig.slice(0, dot);
+  try {
+    const jwk = (await keySet(opts, kid)).keys.find((k) => k.kid === kid);
+    if (!jwk) return false;
+    return await edVerify(jwk, consentSignaturePayload(consent), consent.sig.slice(dot + 1));
+  } catch {
+    return false;
+  }
+}
+async function verifyToken(token, opts = {}) {
+  const parts = typeof token === "string" ? token.split(".") : [];
+  if (parts.length !== 3) throw new Error("not a JWT");
+  const [h, p, s] = parts;
+  let header;
+  let claims;
+  try {
+    header = JSON.parse(new TextDecoder().decode(b64urlBytes(h)));
+    claims = JSON.parse(new TextDecoder().decode(b64urlBytes(p)));
+  } catch {
+    throw new Error("malformed token");
+  }
+  if (header.alg !== "EdDSA" || !header.kid) throw new Error("unexpected token algorithm");
+  const jwk = (await keySet(opts, header.kid)).keys.find((k) => k.kid === header.kid);
+  if (!jwk || !await edVerify(jwk, `${h}.${p}`, s)) throw new Error("bad signature");
+  if (claims.token_use !== "consent") throw new Error("not a consent token");
+  const now = (opts.now ?? Date.now()) / 1e3;
+  const leeway = opts.leewaySeconds ?? 30;
+  if (typeof claims.exp !== "number" || now > claims.exp + leeway) throw new Error("expired");
+  if (typeof claims.iat === "number" && claims.iat > now + leeway) throw new Error("issued in the future");
+  if (opts.cbid !== void 0 && (claims.cbid !== opts.cbid || claims.aud !== `cookiemunch:${opts.cbid}`)) throw new Error("token is for another site");
+  return claims;
+}
 
 // src/webhooks.ts
 var import_node_crypto = require("crypto");
@@ -164,8 +253,219 @@ function mintConsentSyncToken(input) {
   return `cms1.${payload}.${sig}`;
 }
 
+// src/executor-conformance.ts
+var CANARY_ISSUER = "https://canary.cookiemunch.net";
+var CANARY_EMAIL_RE = /^canary-([0-9a-f]{16})@canary\.cookiemunch\.net$/;
+function canaryIdentityFor(canaryEmail) {
+  const m = CANARY_EMAIL_RE.exec(canaryEmail.trim().toLowerCase());
+  if (!m) throw new Error("canaryEmail must be the canary address canary-<16 hex>@canary.cookiemunch.net");
+  return { iss: CANARY_ISSUER, sub: `canary_${m[1]}`, ext: `canary:${m[1]}` };
+}
+var CONFORMANCE_RULES = [
+  { id: "auth.required", title: "A request without the credential is refused (401 or 403)." },
+  { id: "lookup.email.found", title: "The canary subject is found by its email." },
+  { id: "lookup.identity.found", title: "The canary subject is found by its identity alone (iss + sub), and it is the same subject." },
+  { id: "lookup.unknown.no_match", title: 'An address nobody has answers { subjectId: null, status: "no_match" }.' },
+  { id: "lookup.identity_beats_email", title: "An identity that matches no one is never matched through the email of someone else." },
+  { id: "requests.bad_body.400", title: "A request with an unknown type answers 400 { error, field }." },
+  { id: "requests.alias.canonical_type", title: 'An alias (erasure) is accepted and answered with canonicalType "deletion".' },
+  { id: "requests.execute_after.scheduled", title: 'A deletion with a future executeAfter is "scheduled" with eta equal to executeAfter \u2014 nothing is deleted before it.' },
+  { id: "requests.idempotency.replay", title: "The same Idempotency-Key with the same body returns the same request, not a second one." },
+  { id: "requests.idempotency.mismatch_409", title: "The same Idempotency-Key with a different body answers 409." },
+  { id: "requests.get", title: "GET /privacy/requests/{id} returns the request, still scheduled." },
+  { id: "requests.unknown.404", title: "An unknown request id answers 404." },
+  { id: "requests.cancel.before_execute_after", title: 'A cancel before executeAfter answers status "cancelled".' },
+  { id: "requests.cancel.keeps_data", title: "After a cancel the subject is still there: a lookup finds it." },
+  { id: "version.header", title: "Answers carry X-Version (the highest contract version the executor supports)." }
+];
+function randomTag() {
+  const bytes = new Uint8Array(8);
+  const c = globalThis.crypto;
+  if (c?.getRandomValues) c.getRandomValues(bytes);
+  else for (let i = 0; i < bytes.length; i++) bytes[i] = Math.floor(Math.random() * 256);
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function field(json, key) {
+  return json && typeof json === "object" ? json[key] : void 0;
+}
+async function runExecutorConformance(o) {
+  const doFetch = o.fetch ?? fetch;
+  const now = o.now ?? (() => Date.now());
+  const base = o.baseUrl.replace(/\/+$/, "") + (o.prefix ?? "/privacy");
+  let url;
+  try {
+    url = new URL(base);
+  } catch {
+    throw new Error("baseUrl must be an absolute URL");
+  }
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && /^(localhost|127\.0\.0\.1|\[::1\])$/.test(url.hostname))) {
+    throw new Error("baseUrl must be https (http only for localhost)");
+  }
+  const identity = canaryIdentityFor(o.canaryEmail);
+  const canaryEmail = o.canaryEmail.trim().toLowerCase();
+  const auth = o.auth ?? { header: "Authorization", format: "Bearer {secret}" };
+  const run = o.runId ?? randomTag();
+  const results = /* @__PURE__ */ new Map();
+  let version;
+  const set = (id, status, detail) => {
+    const rule = CONFORMANCE_RULES.find((r) => r.id === id);
+    results.set(id, { id, title: rule.title, status, ...detail ? { detail } : {} });
+  };
+  const pass = (id) => set(id, "pass");
+  const fail = (id, detail) => set(id, "fail", detail);
+  const skip = (id, detail) => set(id, "skip", detail);
+  async function call(method, path, body, extra = {}, withAuth = true) {
+    const headers = {
+      accept: "application/json",
+      "X-Version": "2",
+      ...withAuth ? { [auth.header]: auth.format.replace("{secret}", o.secret) } : {},
+      ...body !== void 0 ? { "content-type": "application/json" } : {},
+      ...extra
+    };
+    try {
+      const res = await doFetch(base + path, { method, headers, ...body !== void 0 ? { body: JSON.stringify(body) } : {} });
+      const text = await res.text().catch(() => "");
+      let json;
+      try {
+        json = text ? JSON.parse(text) : void 0;
+      } catch {
+        json = void 0;
+      }
+      const v = res.headers.get("x-version");
+      if (v && !version) version = v;
+      return { status: res.status, json, version: v };
+    } catch (err) {
+      return { status: 0, json: void 0, version: null, error: err instanceof Error ? err.message : String(err) };
+    }
+  }
+  const said = (a) => a.status === 0 ? `unreachable: ${a.error}` : `HTTP ${a.status} ${JSON.stringify(a.json ?? null).slice(0, 200)}`;
+  const key = (rule) => `conformance:${run}:${rule}`;
+  const anon = await call("POST", "/lookup", { emails: [canaryEmail] }, {}, false);
+  if (anon.status === 0) {
+    for (const r of CONFORMANCE_RULES) skip(r.id, said(anon));
+    fail("auth.required", said(anon));
+    return report();
+  }
+  if (anon.status === 401 || anon.status === 403) pass("auth.required");
+  else fail("auth.required", `without a credential: ${said(anon)}`);
+  const byEmail = await call("POST", "/lookup", { emails: [canaryEmail] }, { "Idempotency-Key": key("lookup-email") });
+  const subjectId = field(byEmail.json, "subjectId");
+  if (byEmail.status === 200 && field(byEmail.json, "status") === "found" && typeof subjectId === "string" && subjectId) pass("lookup.email.found");
+  else fail("lookup.email.found", `the canary address: ${said(byEmail)}`);
+  const byIdentity = await call("POST", "/lookup", { emails: [], identity, atlas: identity }, { "Idempotency-Key": key("lookup-identity") });
+  if (byIdentity.status === 200 && field(byIdentity.json, "status") === "found" && field(byIdentity.json, "subjectId") === subjectId && typeof subjectId === "string") {
+    pass("lookup.identity.found");
+  } else {
+    fail("lookup.identity.found", `the canary identity ${identity.sub}: ${said(byIdentity)}${typeof subjectId === "string" ? ` (by email it was ${subjectId})` : ""}`);
+  }
+  const nobody = await call("POST", "/lookup", { emails: [`nobody-${run}@canary.cookiemunch.net`] }, { "Idempotency-Key": key("lookup-nobody") });
+  if (nobody.status === 200 && field(nobody.json, "status") === "no_match" && field(nobody.json, "subjectId") === null) pass("lookup.unknown.no_match");
+  else fail("lookup.unknown.no_match", said(nobody));
+  const stranger = { iss: identity.iss, sub: `canary_other_${run}` };
+  const crossed = await call("POST", "/lookup", { emails: [canaryEmail], identity: stranger, atlas: stranger }, { "Idempotency-Key": key("lookup-crossed") });
+  if (crossed.status === 200 && field(crossed.json, "status") === "no_match") pass("lookup.identity_beats_email");
+  else {
+    fail(
+      "lookup.identity_beats_email",
+      `an identity nobody has (${stranger.sub}) with the canary's email: ${said(crossed)} \u2014 the email belongs to a different identity, so this must be no_match`
+    );
+  }
+  const bad = await call("POST", "/requests", { subjectId: subjectId ?? "x", type: "teleport", caseId: `conformance-${run}` }, { "Idempotency-Key": key("bad-body") });
+  if (bad.status === 400 && typeof field(bad.json, "error") === "string" && typeof field(bad.json, "field") === "string") pass("requests.bad_body.400");
+  else fail("requests.bad_body.400", said(bad));
+  if (typeof subjectId !== "string") {
+    for (const id of ["requests.alias.canonical_type", "requests.execute_after.scheduled", "requests.idempotency.replay", "requests.idempotency.mismatch_409", "requests.get", "requests.cancel.before_execute_after", "requests.cancel.keeps_data"]) {
+      skip(id, "needs the canary subject, which the lookup did not find");
+    }
+  } else {
+    const executeAfter = new Date(Math.ceil((now() + 36e5) / 1e3) * 1e3).toISOString();
+    const body = { subjectId, type: "erasure", executeAfter, caseId: `conformance-${run}`, reason: "Cookie Munch conformance check (canary subject)" };
+    const opened = await call("POST", "/requests", body, { "Idempotency-Key": key("open") });
+    const id = field(opened.json, "id");
+    const st = field(opened.json, "status");
+    if ((opened.status === 200 || opened.status === 201) && field(opened.json, "canonicalType") === "deletion") pass("requests.alias.canonical_type");
+    else fail("requests.alias.canonical_type", `type "erasure": ${said(opened)}`);
+    const eta = field(opened.json, "eta");
+    if ((opened.status === 200 || opened.status === 201) && st === "scheduled" && typeof eta === "string" && Date.parse(eta) === Date.parse(executeAfter)) {
+      pass("requests.execute_after.scheduled");
+    } else if (st === "completed" || st === "completed_with_retention" || st === "processing") {
+      fail("requests.execute_after.scheduled", `executeAfter is ${executeAfter}, an hour away, and the executor answered "${String(st)}": it acted before executeAfter`);
+    } else {
+      fail("requests.execute_after.scheduled", `expected status "scheduled" with eta ${executeAfter}: ${said(opened)}`);
+    }
+    const replay = await call("POST", "/requests", body, { "Idempotency-Key": key("open") });
+    if (typeof id === "string" && (replay.status === 200 || replay.status === 201) && field(replay.json, "id") === id) pass("requests.idempotency.replay");
+    else fail("requests.idempotency.replay", `a retry with the same key: ${said(replay)}${typeof id === "string" ? ` (first answer id ${id})` : ""}`);
+    const mismatch = await call("POST", "/requests", { ...body, reason: "a different body" }, { "Idempotency-Key": key("open") });
+    if (mismatch.status === 409) pass("requests.idempotency.mismatch_409");
+    else fail("requests.idempotency.mismatch_409", `the same key with a different body: ${said(mismatch)}`);
+    if (typeof id !== "string") {
+      skip("requests.get", "no request id came back");
+      skip("requests.cancel.before_execute_after", "no request id came back");
+      skip("requests.cancel.keeps_data", "no request id came back");
+    } else {
+      const got = await call("GET", `/requests/${encodeURIComponent(id)}`, void 0, { "Idempotency-Key": key("get") });
+      if (got.status === 200 && field(got.json, "id") === id && field(got.json, "status") === "scheduled") pass("requests.get");
+      else fail("requests.get", said(got));
+      const cancelled = await call("POST", `/requests/${encodeURIComponent(id)}/cancel`, {}, { "Idempotency-Key": key("cancel") });
+      if (cancelled.status === 200 && field(cancelled.json, "status") === "cancelled") pass("requests.cancel.before_execute_after");
+      else fail("requests.cancel.before_execute_after", said(cancelled));
+      const after = await call("POST", "/lookup", { emails: [canaryEmail] }, { "Idempotency-Key": key("lookup-after-cancel") });
+      if (after.status === 200 && field(after.json, "status") === "found") pass("requests.cancel.keeps_data");
+      else fail("requests.cancel.keeps_data", `a lookup after the cancel: ${said(after)} \u2014 a cancel before executeAfter must leave the data intact`);
+    }
+  }
+  const unknown = await call("GET", `/requests/conformance-missing-${run}`, void 0, { "Idempotency-Key": key("unknown") });
+  if (unknown.status === 404) pass("requests.unknown.404");
+  else fail("requests.unknown.404", said(unknown));
+  if (version) pass("version.header");
+  else fail("version.header", "no answer carried an X-Version header");
+  return report();
+  function report() {
+    const rules = CONFORMANCE_RULES.map((r) => results.get(r.id) ?? { id: r.id, title: r.title, status: "skip", detail: "not reached" });
+    const count = (s) => rules.filter((r) => r.status === s).length;
+    return { ok: count("fail") === 0, passed: count("pass"), failed: count("fail"), skipped: count("skip"), rules, ...version ? { version } : {} };
+  }
+}
+
+// src/token-exchange.ts
+var TokenExchangeError = class extends Error {
+  constructor(error, status, description) {
+    super(description ? `${error}: ${description}` : error);
+    this.error = error;
+    this.status = status;
+    this.name = "TokenExchangeError";
+  }
+};
+async function exchangeOperatorToken(input) {
+  const base = (input.baseUrl ?? "https://api.cookiemunch.net").replace(/\/+$/, "");
+  const form = new URLSearchParams({
+    grant_type: "urn:ietf:params:oauth:grant-type:token-exchange",
+    subject_token: input.subjectToken,
+    subject_token_type: `urn:ietf:params:oauth:token-type:${input.subjectTokenType ?? "access_token"}`,
+    scope: input.scope.join(" "),
+    resource: input.resource,
+    audience: "cookiemunch",
+    ...input.expiresIn !== void 0 ? { expires_in: String(input.expiresIn) } : {}
+  });
+  const res = await (input.fetch ?? fetch)(`${base}/v1/oauth/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
+    body: form.toString()
+  });
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    throw new TokenExchangeError(typeof body.error === "string" ? body.error : `http_${res.status}`, res.status, typeof body.error_description === "string" ? body.error_description : void 0);
+  }
+  return {
+    accessToken: String(body.access_token),
+    expiresIn: Number(body.expires_in),
+    scope: String(body.scope ?? "").split(" ").filter(Boolean)
+  };
+}
+
 // src/index.ts
-var SDK_VERSION = "0.5.1";
+var SDK_VERSION = "0.7.0";
 var CookieMunchApiError = class extends Error {
   constructor(status, message, code, body) {
     super(message);
@@ -176,6 +476,10 @@ var CookieMunchApiError = class extends Error {
   }
 };
 var withBase = (doc, opts) => opts?.baseUpdatedAt !== void 0 ? { ...doc, baseUpdatedAt: opts.baseUpdatedAt } : doc;
+function metaQs(o) {
+  const parts = Object.entries(o?.metadata ?? {}).map(([k, v]) => `metadata%5B${encodeURIComponent(k)}%5D=${encodeURIComponent(v)}`);
+  return parts.length ? `?${parts.join("&")}` : "";
+}
 function qs(query) {
   if (!query) return "";
   const parts = [];
@@ -191,9 +495,12 @@ function createCookieMunch(opts) {
   const base = `${opts.baseUrl.replace(/\/+$/, "")}/v1`;
   const doFetch = opts.fetch ?? globalThis.fetch;
   if (!doFetch) throw new Error("No fetch available; pass { fetch } in CookieMunchOptions.");
-  async function request(method, path, body, raw = false) {
-    const headers = { Authorization: `Bearer ${opts.apiKey}`, "User-Agent": opts.userAgent ?? `cookiemunch-js/${SDK_VERSION}` };
+  async function request(method, path, body, raw = false, extraHeaders = {}) {
+    const headers = { Authorization: `Bearer ${opts.apiKey}`, "User-Agent": opts.userAgent ?? `cookiemunch-js/${SDK_VERSION}`, ...extraHeaders };
     if (opts.strictUnknownFields && method !== "GET") headers["Prefer"] = "strict-unknown-fields";
+    if (opts.apiVersion) headers["CookieMunch-Version"] = opts.apiVersion;
+    if (opts.secretRecipient && method !== "GET") headers["X-Secret-Recipient"] = opts.secretRecipient;
+    for (const [k, v] of Object.entries(opts.headers ?? {})) headers[k] = v;
     const init = { method, headers };
     if (body !== void 0) {
       headers["Content-Type"] = "application/json";
@@ -219,22 +526,49 @@ function createCookieMunch(opts) {
     return contentType.includes("application/json") ? res.json() : res.text();
   }
   const get = (p) => request("GET", p);
+  async function requestBytes(path) {
+    const res = await doFetch(`${base}${path}`, { method: "GET", headers: { Authorization: `Bearer ${opts.apiKey}`, "User-Agent": opts.userAgent ?? `cookiemunch-js/${SDK_VERSION}` } });
+    if (!res.ok) {
+      let message = `request failed with status ${res.status}`;
+      let code;
+      try {
+        const data = await res.json();
+        if (typeof data.error === "string") message = data.error;
+        if (typeof data.code === "string") code = data.code;
+      } catch {
+      }
+      throw new CookieMunchApiError(res.status, message, code);
+    }
+    return res.arrayBuffer();
+  }
   const enc = encodeURIComponent;
   return {
     me: () => get("/me"),
     languages: () => get("/languages"),
     orgs: {
-      list: () => get("/orgs"),
-      create: (name, opts2) => request("POST", "/orgs", { name, ...opts2 ?? {} })
+      list: (o) => get(`/orgs${metaQs(o)}`),
+      create: (name, opts2) => request("POST", "/orgs", { name, ...opts2 ?? {} }),
+      deleteSandbox: (id) => request("DELETE", `/orgs/${enc(id)}?hard=1`)
+    },
+    metadata: {
+      get: (type, id) => get(`/metadata/${enc(type)}/${enc(id)}`),
+      update: (type, id, metadata, o) => request("PATCH", `/metadata/${enc(type)}/${enc(id)}${qs({ dryRun: o?.dryRun ? "1" : void 0 })}`, { metadata })
+    },
+    partnerLinks: {
+      list: (o) => get(`/partner_links${metaQs(o)}`),
+      create: (input) => request("POST", "/partner_links", input),
+      revoke: (id) => request("DELETE", `/partner_links/${enc(id)}`)
     },
+    provisionEnv: (ref) => get(`/provision/env${qs({ ref })}`),
     sites: {
-      list: () => get("/sites"),
+      list: (o) => get(`/sites${metaQs(o)}`),
       create: (input) => request("POST", "/sites", input),
       get: (cbid) => get(`/sites/${enc(cbid)}`),
       update: (cbid, patch, o) => request("PATCH", `/sites/${enc(cbid)}${qs({ dryRun: o?.dryRun ? "1" : void 0 })}`, patch),
       delete: async (cbid) => {
         await request("DELETE", `/sites/${enc(cbid)}`);
       },
+      deleteSandbox: (cbid) => request("DELETE", `/sites/${enc(cbid)}?hard=1`),
       listPartners: (cbid) => get(`/sites/${enc(cbid)}/partners`),
       linkPartner: (cbid, input, o) => request("POST", `/sites/${enc(cbid)}/partners${qs({ dryRun: o?.dryRun ? "1" : void 0 })}`, input),
       unlinkPartner: (cbid, linkId) => request("DELETE", `/sites/${enc(cbid)}/partners/${enc(linkId)}`),
@@ -283,6 +617,9 @@ function createCookieMunch(opts) {
       }),
       cookiePresets: (cbid) => get(`/sites/${enc(cbid)}/cookies/presets`),
       applyCookiePreset: (cbid, vendor, params, o) => request("PUT", `/sites/${enc(cbid)}/cookies/presets/${enc(vendor)}${qs({ dryRun: o?.dryRun ? "1" : void 0 })}`, params ?? {}),
+      importCookieManifest: (cbid, input, o) => request("PUT", `/sites/${enc(cbid)}/cookies/presets/custom${qs({ dryRun: o?.dryRun ? "1" : void 0 })}`, input),
+      cookieSuggestions: (cbid) => get(`/sites/${enc(cbid)}/cookies/suggestions`),
+      declareCookieSuggestions: (cbid, input, o) => request("POST", `/sites/${enc(cbid)}/cookies/suggestions/declare${qs({ dryRun: o?.dryRun ? "1" : void 0 })}`, input ?? {}),
       removeCookiePreset: (cbid, vendor, o) => request("DELETE", `/sites/${enc(cbid)}/cookies/presets/${enc(vendor)}${qs({ dryRun: o?.dryRun ? "1" : void 0 })}`),
       deleteObservedCookie: (async (cbid, name, o) => {
         const out = await request("DELETE", `/sites/${enc(cbid)}/observed-cookies/${enc(name)}${qs({ dryRun: o?.dryRun ? "1" : void 0 })}`);
@@ -300,6 +637,8 @@ function createCookieMunch(opts) {
       verifyChallenge: (cbid) => get(`/sites/${enc(cbid)}/verify/challenge`),
       createBulk: (sites) => request("POST", "/sites/bulk", { sites }),
       brand: (cbid) => request("POST", `/sites/${enc(cbid)}/brand`, {}),
+      getBrand: (cbid) => get(`/sites/${enc(cbid)}/brand`),
+      setBrand: (cbid, input, o) => request("PUT", `/sites/${enc(cbid)}/brand${qs({ dryRun: o?.dryRun ? "1" : void 0 })}`, input),
       getFlow: (cbid) => get(`/sites/${enc(cbid)}/flow`),
       editFlow: (cbid, operations) => request("POST", `/sites/${enc(cbid)}/flow/ops`, { operations }),
       setFlow: (cbid, config) => request("PUT", `/sites/${enc(cbid)}/flow`, config)
@@ -307,11 +646,13 @@ function createCookieMunch(opts) {
     consent: {
       verify: (cbid) => get(`/sites/${enc(cbid)}/consent/verify`),
       stats: (cbid, query) => get(`/sites/${enc(cbid)}/consent/stats${qs(toQuery(query))}`),
+      insights: (cbid, query) => get(`/sites/${enc(cbid)}/consent/insights${qs(toQuery(query))}`),
       log: (cbid, query) => get(`/sites/${enc(cbid)}/consent/log${qs(toQuery(query))}`),
       export: (cbid, query) => request("GET", `/sites/${enc(cbid)}/consent/export${qs(toQuery(query))}`, void 0, true),
       receipt: (cbid, stamp) => get(`/sites/${enc(cbid)}/receipt/${enc(stamp)}`),
       eraseSubject: (cbid, stamp) => request("POST", `/sites/${enc(cbid)}/erase-consent`, { stamp }),
       exportSubject: (cbid, stamp) => request("GET", `/sites/${enc(cbid)}/subject-export?stamp=${enc(stamp)}`),
+      categoryRegistry: () => get("/categories/registry"),
       ingest: async (input) => {
         const res = await doFetch(`${opts.baseUrl.replace(/\/+$/, "")}/api/v1/consent`, {
           method: "POST",
@@ -342,7 +683,16 @@ function createCookieMunch(opts) {
       delete: async (id) => {
         await request("DELETE", `/dsar/${enc(id)}`);
       },
-      markTest: (id) => request("POST", `/dsar/${enc(id)}/mark-test`)
+      markTest: (id) => request("POST", `/dsar/${enc(id)}/mark-test`),
+      listByTrace: (trace) => get(`/dsar${qs({ trace })}`),
+      openCase: (input, o) => request("POST", "/dsar/requests", input, false, {
+        ...o?.idempotencyKey ? { "Idempotency-Key": o.idempotencyKey } : {},
+        ...o?.trace ? { "X-ForgeDeck-Trace": o.trace } : {}
+      }),
+      getCase: (id) => get(`/dsar/requests/${enc(id)}`),
+      cancelCase: (id) => request("POST", `/dsar/requests/${enc(id)}/cancel`),
+      caseReceipt: (id) => get(`/dsar/requests/${enc(id)}/receipt`),
+      caseReceiptPdf: (id) => requestBytes(`/dsar/requests/${enc(id)}/receipt?format=pdf`)
     },
     vendors: {
       list: () => get("/vendors"),
@@ -445,7 +795,8 @@ function createCookieMunch(opts) {
       status: (requestId) => get(`/dsar/${enc(requestId)}/fulfillment`),
       pendingTasks: (limit) => get(`/dsar/agent/tasks${qs({ limit })}`),
       reportTask: (taskId, ok, error) => request("POST", `/dsar/agent/tasks/${enc(taskId)}/result`, { ok, ...error !== void 0 ? { error } : {} }),
-      executors: () => get("/dsar/executors"),
+      executors: (o) => get(`/dsar/executors${metaQs(o)}`),
+      executor: (id) => get(`/dsar/executors/${enc(id)}`),
       connectExecutor: (input) => request("POST", "/dsar/executors", input),
       updateExecutor: (id, patch) => request("PATCH", `/dsar/executors/${enc(id)}`, patch),
       dryRunConnectExecutor: (input) => request("POST", "/dsar/executors?dryRun=1", input),
@@ -460,7 +811,11 @@ function createCookieMunch(opts) {
       },
       taskExport: (requestId, taskId) => get(`/dsar/${enc(requestId)}/tasks/${enc(taskId)}/export`),
       task: (requestId, taskId) => get(`/dsar/${enc(requestId)}/tasks/${enc(taskId)}`),
-      testExecutor: (id, input) => request("POST", `/dsar/executors/${enc(id)}/test`, input)
+      testExecutor: (id, input) => request("POST", `/dsar/executors/${enc(id)}/test`, input),
+      recheckExecutor: (id) => request("POST", `/dsar/executors/${enc(id)}/recheck`),
+      executorHealthHistory: (id, opts2 = {}) => get(`/dsar/executors/${enc(id)}/health/history${qs({ limit: opts2.limit })}`),
+      executorConformance: (id) => request("POST", `/dsar/executors/${enc(id)}/test`, { conformance: true }),
+      rollExecutorCompletionSecret: (id) => request("POST", `/dsar/executors/${enc(id)}/completion-secret/roll`)
     },
     preferences: {
       list: () => get("/preferences"),
@@ -484,11 +839,32 @@ function createCookieMunch(opts) {
       },
       roll: (prefix) => request("POST", `/keys/${enc(prefix)}/roll`),
       update: (prefix, patch) => request("PATCH", `/keys/${enc(prefix)}`, patch),
-      report: (o) => get(`/keys/report${qs({ unusedDays: o?.unusedDays, expiringDays: o?.expiringDays })}`)
+      report: (o) => get(`/keys/report${qs({ unusedDays: o?.unusedDays, expiringDays: o?.expiringDays })}`),
+      listStandard: () => get("/keys?shape=standard"),
+      self: () => get("/keys/self"),
+      updateSelf: (input) => request("PATCH", "/keys/self", input),
+      rollSelf: () => request("POST", "/keys/self/roll"),
+      vend: (input) => request("POST", "/keys/vend", input),
+      revokeLeaked: (report) => request("POST", "/keys/revoke_leaked", report)
     },
     usage: () => get("/usage"),
+    entitlements: () => get("/entitlements"),
+    versions: () => get("/versions"),
+    sandbox: {
+      get: async () => (await get("/sandbox")).sandbox,
+      create: (input) => request("POST", "/sandbox", input ?? {}),
+      delete: () => request("DELETE", "/sandbox")
+    },
     integrationHealth: (cbid) => get(`/integration-health${qs({ cbid })}`),
-    provision: (input, o) => request("POST", `/provision${qs({ dryRun: o?.dryRun ? "1" : void 0 })}`, input),
+    healthWaivers: {
+      list: (cbid) => get(`/integration-health/waivers${qs({ cbid })}`),
+      set: (input) => request("PUT", "/integration-health/waivers", input),
+      remove: async (check, opts2) => {
+        await request("DELETE", `/integration-health/waivers${qs({ check, cbid: opts2?.cbid, subject: opts2?.subject })}`);
+      }
+    },
+    embedManifest: (cbid) => get(`/embed${qs({ cbid })}`),
+    provision: (input, o) => request("POST", `/provision${qs({ dryRun: o?.dryRun ? "1" : void 0, fromStep: o?.fromStep })}`, input),
     org: {
       get: () => get("/org"),
       update: (patch) => request("PATCH", "/org", patch),
@@ -518,7 +894,14 @@ function createCookieMunch(opts) {
         remove: () => request("DELETE", "/org/rights-identity")
       }
     },
-    audit: (limit) => get(`/audit${qs({ limit })}`),
+    audit: (limit, opts2) => get(`/audit${qs({ limit, actor: opts2?.actor })}`),
+    auditSink: {
+      get: () => get("/audit/sink"),
+      set: (input) => request("PUT", "/audit/sink", input),
+      remove: async () => {
+        await request("DELETE", "/audit/sink");
+      }
+    },
     assets: {
       upload: (input) => request("POST", "/assets", input),
       delete: async (urlOrFileName) => {
@@ -541,7 +924,7 @@ function createCookieMunch(opts) {
       }
     },
     webhooks: {
-      list: () => get("/webhooks"),
+      list: (o) => get(`/webhooks${metaQs(o)}`),
       create: (input) => request("POST", "/webhooks", input),
       update: (id, patch) => request("PATCH", `/webhooks/${enc(id)}`, patch),
       delete: async (id) => {
@@ -550,7 +933,8 @@ function createCookieMunch(opts) {
       rollSecret: (id) => request("POST", `/webhooks/${enc(id)}/roll`),
       test: (id) => request("POST", `/webhooks/${enc(id)}/test`),
       deadLetters: () => get("/webhooks/dead-letters"),
-      replayDeadLetter: (id) => request("POST", `/webhooks/dead-letters/${enc(id)}/replay`)
+      replayDeadLetter: (id) => request("POST", `/webhooks/dead-letters/${enc(id)}/replay`),
+      replay: (id, since, opts2) => request("POST", `/webhooks/${enc(id)}/replay${qs({ since: String(since), limit: opts2?.limit })}`)
     },
     rightsLinks: {
       create: (cbid, input) => request("POST", `/sites/${enc(cbid)}/rights-links`, input)
@@ -570,6 +954,13 @@ function createCookieMunch(opts) {
       set: (cbid, input) => request("PUT", `/sites/${enc(cbid)}/rights-identity`, input),
       remove: (cbid) => request("DELETE", `/sites/${enc(cbid)}/rights-identity`)
     },
+    dsarSettings: {
+      get: (cbid) => get(`/sites/${enc(cbid)}/dsar-settings`),
+      set: (cbid, input) => request("PUT", `/sites/${enc(cbid)}/dsar-settings`, input)
+    },
+    integrations: {
+      subjectCard: (app, person) => get(`/integrations/${enc(app)}/card${qs(person)}`)
+    },
     subjects: {
       consent: (subjectId) => get(`/subjects/${enc(subjectId)}/consent`)
     },
@@ -589,15 +980,25 @@ function createCookieMunch(opts) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  CANARY_ISSUER,
+  CONFORMANCE_RULES,
   CONSENT_COOKIE_NAME,
   CookieMunchApiError,
+  DEFAULT_JWKS_URL,
   SDK_VERSION,
+  TokenExchangeError,
+  canaryIdentityFor,
+  consentSignaturePayload,
   createCookieMunch,
+  exchangeOperatorToken,
   getConsent,
   isAllowed,
   mintConsentSyncToken,
   parseConsentValue,
   readConsent,
+  runExecutorConformance,
+  verifyDecisionSignature,
+  verifyToken,
   verifyWebhookSignature
 });
 //# sourceMappingURL=index.cjs.map