@cookiemunch/sdk 0.6.0 → 0.7.1

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 Every published release, newest first. Dates are the day the version was cut.
 
+## 0.7.1 (2026-10-24)
+
+- Changed: `ConsentInsights.byLanguage` and `timeToDecision` are now filled in — opt-in by the banner's language, and a time-to-decision histogram with its median bucket — or `null` with `notRecorded` saying why.
+
+## 0.7.0 (2026-10-24)
+
+- Added: `sandbox.get` / `create` / `delete` — a sandbox organisation made from yours: the same people and plan, never billed, test keys only, every rights request a test.
+- Added: dated API versions — the `apiVersion` client option (sends `CookieMunch-Version`), `versions()`, and `keys.updateSelf({ apiVersion })`. Keys minted from 2026-10-24 are strict about unknown body fields by default; older keys behave as before.
+- Added: `exchangeOperatorToken()` — swap an identity provider's token for a key that lasts at most an hour (RFC 8693 token exchange).
+- Added: `sandbox` and `sandboxOf` on `me()`.
+
 ## 0.6.0 (2026-10-24)
 
 - Added: `dsar.openCase` / `getCase` / `cancelCase` / `caseReceipt` / `caseReceiptPdf` / `listByTrace` — rights cases fanned out to every connected system, with one `executeAfter`, a trace and a signed receipt.

package/dist/index.cjs

@@ -26,9 +26,11 @@ __export(src_exports, {
   CookieMunchApiError: () => CookieMunchApiError,
   DEFAULT_JWKS_URL: () => DEFAULT_JWKS_URL,
   SDK_VERSION: () => SDK_VERSION,
+  TokenExchangeError: () => TokenExchangeError,
   canaryIdentityFor: () => canaryIdentityFor,
   consentSignaturePayload: () => consentSignaturePayload,
   createCookieMunch: () => createCookieMunch,
+  exchangeOperatorToken: () => exchangeOperatorToken,
   getConsent: () => getConsent,
   isAllowed: () => isAllowed,
   mintConsentSyncToken: () => mintConsentSyncToken,
@@ -426,8 +428,44 @@ async function runExecutorConformance(o) {
   }
 }
 
+// src/token-exchange.ts
+var TokenExchangeError = class extends Error {
+  constructor(error, status, description) {
+    super(description ? `${error}: ${description}` : error);
+    this.error = error;
+    this.status = status;
+    this.name = "TokenExchangeError";
+  }
+};
+async function exchangeOperatorToken(input) {
+  const base = (input.baseUrl ?? "https://api.cookiemunch.net").replace(/\/+$/, "");
+  const form = new URLSearchParams({
+    grant_type: "urn:ietf:params:oauth:grant-type:token-exchange",
+    subject_token: input.subjectToken,
+    subject_token_type: `urn:ietf:params:oauth:token-type:${input.subjectTokenType ?? "access_token"}`,
+    scope: input.scope.join(" "),
+    resource: input.resource,
+    audience: "cookiemunch",
+    ...input.expiresIn !== void 0 ? { expires_in: String(input.expiresIn) } : {}
+  });
+  const res = await (input.fetch ?? fetch)(`${base}/v1/oauth/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
+    body: form.toString()
+  });
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    throw new TokenExchangeError(typeof body.error === "string" ? body.error : `http_${res.status}`, res.status, typeof body.error_description === "string" ? body.error_description : void 0);
+  }
+  return {
+    accessToken: String(body.access_token),
+    expiresIn: Number(body.expires_in),
+    scope: String(body.scope ?? "").split(" ").filter(Boolean)
+  };
+}
+
 // src/index.ts
-var SDK_VERSION = "0.6.0";
+var SDK_VERSION = "0.7.1";
 var CookieMunchApiError = class extends Error {
   constructor(status, message, code, body) {
     super(message);
@@ -460,6 +498,7 @@ function createCookieMunch(opts) {
   async function request(method, path, body, raw = false, extraHeaders = {}) {
     const headers = { Authorization: `Bearer ${opts.apiKey}`, "User-Agent": opts.userAgent ?? `cookiemunch-js/${SDK_VERSION}`, ...extraHeaders };
     if (opts.strictUnknownFields && method !== "GET") headers["Prefer"] = "strict-unknown-fields";
+    if (opts.apiVersion) headers["CookieMunch-Version"] = opts.apiVersion;
     if (opts.secretRecipient && method !== "GET") headers["X-Secret-Recipient"] = opts.secretRecipient;
     for (const [k, v] of Object.entries(opts.headers ?? {})) headers[k] = v;
     const init = { method, headers };
@@ -803,12 +842,19 @@ function createCookieMunch(opts) {
       report: (o) => get(`/keys/report${qs({ unusedDays: o?.unusedDays, expiringDays: o?.expiringDays })}`),
       listStandard: () => get("/keys?shape=standard"),
       self: () => get("/keys/self"),
+      updateSelf: (input) => request("PATCH", "/keys/self", input),
       rollSelf: () => request("POST", "/keys/self/roll"),
       vend: (input) => request("POST", "/keys/vend", input),
       revokeLeaked: (report) => request("POST", "/keys/revoke_leaked", report)
     },
     usage: () => get("/usage"),
     entitlements: () => get("/entitlements"),
+    versions: () => get("/versions"),
+    sandbox: {
+      get: async () => (await get("/sandbox")).sandbox,
+      create: (input) => request("POST", "/sandbox", input ?? {}),
+      delete: () => request("DELETE", "/sandbox")
+    },
     integrationHealth: (cbid) => get(`/integration-health${qs({ cbid })}`),
     healthWaivers: {
       list: (cbid) => get(`/integration-health/waivers${qs({ cbid })}`),
@@ -940,9 +986,11 @@ function createCookieMunch(opts) {
   CookieMunchApiError,
   DEFAULT_JWKS_URL,
   SDK_VERSION,
+  TokenExchangeError,
   canaryIdentityFor,
   consentSignaturePayload,
   createCookieMunch,
+  exchangeOperatorToken,
   getConsent,
   isAllowed,
   mintConsentSyncToken,