@cookiemunch/sdk 0.6.0 → 0.7.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +11 -0
- package/dist/index.cjs +49 -1
- package/dist/index.cjs.map +1 -1
- package/dist/index.d.cts +130 -7
- package/dist/index.d.ts +130 -7
- package/dist/index.js +47 -1
- package/dist/index.js.map +1 -1
- package/package.json +1 -1
package/dist/index.d.cts
CHANGED
|
@@ -26,6 +26,10 @@ interface Identity {
|
|
|
26
26
|
propertyLocked?: boolean;
|
|
27
27
|
cbids?: string[];
|
|
28
28
|
reseller?: boolean;
|
|
29
|
+
/** This organisation is a sandbox (`sandbox.create()`): test keys, test rights requests, never billed. */
|
|
30
|
+
sandbox?: boolean;
|
|
31
|
+
/** For a sandbox: the live organisation it belongs to. */
|
|
32
|
+
sandboxOf?: string;
|
|
29
33
|
}
|
|
30
34
|
type PlanSource = 'org' | 'account';
|
|
31
35
|
/** One organisation on an account (GET /v1/orgs, and the `org_limit` refusal). */
|
|
@@ -707,6 +711,49 @@ declare const CONFORMANCE_RULES: ReadonlyArray<{
|
|
|
707
711
|
/** Run every rule against one executor. Never throws for an executor's answer; only for bad options. */
|
|
708
712
|
declare function runExecutorConformance(o: ConformanceOptions): Promise<ConformanceReport>;
|
|
709
713
|
|
|
714
|
+
/**
|
|
715
|
+
* Operator token exchange (RFC 8693, CMU-X33): swap your identity provider's token for a short-lived,
|
|
716
|
+
* scoped Cookie Munch API key, so no long-lived key has to live in a file.
|
|
717
|
+
*
|
|
718
|
+
* import { exchangeOperatorToken, createCookieMunch } from '@cookiemunch/sdk';
|
|
719
|
+
* const { accessToken } = await exchangeOperatorToken({
|
|
720
|
+
* subjectToken: process.env.STAFF_ACCESS_TOKEN!, // from the sign-in your organisation trusts
|
|
721
|
+
* scope: ['sites:read', 'dsar:read'],
|
|
722
|
+
* resource: 'org:2f1c…', // or 'site:<cbid>' to lock the key to one site
|
|
723
|
+
* });
|
|
724
|
+
* const client = createCookieMunch({ apiKey: accessToken, baseUrl: 'https://api.cookiemunch.net' });
|
|
725
|
+
*
|
|
726
|
+
* No API key is needed for the exchange itself. The key it returns expires on its own (at most an hour).
|
|
727
|
+
*/
|
|
728
|
+
interface OperatorTokenExchangeInput {
|
|
729
|
+
/** The access or ID token from an OIDC issuer the deployment trusts. */
|
|
730
|
+
subjectToken: string;
|
|
731
|
+
/** Which kind of token `subjectToken` is. Default `access_token`. */
|
|
732
|
+
subjectTokenType?: 'access_token' | 'jwt' | 'id_token';
|
|
733
|
+
/** The API scopes the key should carry. Required: an exchanged key is never full access. */
|
|
734
|
+
scope: string[];
|
|
735
|
+
/** `org:<id>`, or `site:<cbid>` to lock the key to one site. */
|
|
736
|
+
resource: `org:${string}` | `site:${string}`;
|
|
737
|
+
/** Seconds, 60 to 3600. Default 3600. */
|
|
738
|
+
expiresIn?: number;
|
|
739
|
+
/** Default `https://api.cookiemunch.net`. */
|
|
740
|
+
baseUrl?: string;
|
|
741
|
+
fetch?: typeof fetch;
|
|
742
|
+
}
|
|
743
|
+
interface OperatorTokenExchangeResult {
|
|
744
|
+
/** A scoped Cookie Munch API key. */
|
|
745
|
+
accessToken: string;
|
|
746
|
+
expiresIn: number;
|
|
747
|
+
scope: string[];
|
|
748
|
+
}
|
|
749
|
+
/** Thrown with the RFC 6749 `error` and `error_description` the server answered. */
|
|
750
|
+
declare class TokenExchangeError extends Error {
|
|
751
|
+
readonly error: string;
|
|
752
|
+
readonly status: number;
|
|
753
|
+
constructor(error: string, status: number, description?: string);
|
|
754
|
+
}
|
|
755
|
+
declare function exchangeOperatorToken(input: OperatorTokenExchangeInput): Promise<OperatorTokenExchangeResult>;
|
|
756
|
+
|
|
710
757
|
/**
|
|
711
758
|
* Types for `window.__fdConsent`, the shared consent API any embed can code against — a chat
|
|
712
759
|
* widget, a referral snippet, an analytics tag — whatever CMP the page runs. Cookie Munch sets
|
|
@@ -791,7 +838,7 @@ declare global {
|
|
|
791
838
|
* This package's version, sent in the default User-Agent. Cloudflare answers a request with
|
|
792
839
|
* no recognisable User-Agent with `403 error code: 1010`; a test pins this to package.json.
|
|
793
840
|
*/
|
|
794
|
-
declare const SDK_VERSION = "0.
|
|
841
|
+
declare const SDK_VERSION = "0.7.1";
|
|
795
842
|
interface CookieMunchOptions {
|
|
796
843
|
apiKey: string;
|
|
797
844
|
/** "https://api.cookiemunch.net" — the /v1 prefix is appended automatically. */
|
|
@@ -805,6 +852,11 @@ interface CookieMunchOptions {
|
|
|
805
852
|
strictUnknownFields?: boolean;
|
|
806
853
|
/** The `User-Agent` sent on every request. Default `cookiemunch-js/<version>`. */
|
|
807
854
|
userAgent?: string;
|
|
855
|
+
/**
|
|
856
|
+
* Serve every request under this dated API version (`CookieMunch-Version`, e.g. `'2026-10-24'`) instead of the
|
|
857
|
+
* one your key is pinned to. `versions()` lists them; `keys.updateSelf({ apiVersion })` re-pins the key.
|
|
858
|
+
*/
|
|
859
|
+
apiVersion?: string;
|
|
808
860
|
/**
|
|
809
861
|
* Seal every once-shown secret to this X25519 public key (`x25519:<base64>`): answers carry `sealed_secret`
|
|
810
862
|
* (a libsodium sealed box) and `sealed_field` instead of the plaintext. Sent as `X-Secret-Recipient` on writes.
|
|
@@ -1902,6 +1954,39 @@ interface ApiKeyPrefix {
|
|
|
1902
1954
|
env?: 'live' | 'test' | null;
|
|
1903
1955
|
format?: 'cookiemunch' | 'legacy';
|
|
1904
1956
|
strictUnknownFields?: boolean;
|
|
1957
|
+
/** The dated API version this key is pinned to. */
|
|
1958
|
+
apiVersion?: string;
|
|
1959
|
+
}
|
|
1960
|
+
/** A live organisation's sandbox (GET /v1/sandbox). */
|
|
1961
|
+
interface SandboxOrg {
|
|
1962
|
+
orgId: string;
|
|
1963
|
+
name: string;
|
|
1964
|
+
sandboxOf: string;
|
|
1965
|
+
createdAt: string;
|
|
1966
|
+
}
|
|
1967
|
+
/** POST /v1/sandbox: the sandbox and a test key for it, shown once. */
|
|
1968
|
+
interface SandboxCreated {
|
|
1969
|
+
sandbox: SandboxOrg;
|
|
1970
|
+
created: boolean;
|
|
1971
|
+
key: string;
|
|
1972
|
+
keyPrefix: string;
|
|
1973
|
+
keyExpiresAt: string;
|
|
1974
|
+
}
|
|
1975
|
+
/** GET /v1/versions. */
|
|
1976
|
+
interface ApiVersions {
|
|
1977
|
+
latest: string;
|
|
1978
|
+
base: string;
|
|
1979
|
+
/** With a key: the version it is pinned to. */
|
|
1980
|
+
yours?: string;
|
|
1981
|
+
versions: Array<{
|
|
1982
|
+
version: string;
|
|
1983
|
+
summary: string;
|
|
1984
|
+
changes: Array<{
|
|
1985
|
+
id: string;
|
|
1986
|
+
summary: string;
|
|
1987
|
+
docs: string;
|
|
1988
|
+
}>;
|
|
1989
|
+
}>;
|
|
1905
1990
|
}
|
|
1906
1991
|
/** A revoked key in the report: when, by whom, why; never the secret. */
|
|
1907
1992
|
interface ApiKeyRevoked {
|
|
@@ -2092,11 +2177,29 @@ interface ConsentInsights {
|
|
|
2092
2177
|
optInRate: number | null;
|
|
2093
2178
|
}>;
|
|
2094
2179
|
byVariantWindow: 'all_time';
|
|
2095
|
-
|
|
2096
|
-
|
|
2097
|
-
|
|
2098
|
-
|
|
2099
|
-
|
|
2180
|
+
/** Decisions made on a banner, by the language it was shown in; null when none in the window. */
|
|
2181
|
+
byLanguage: Array<{
|
|
2182
|
+
language: string;
|
|
2183
|
+
decisions: number;
|
|
2184
|
+
optIns: number;
|
|
2185
|
+
optInRate: number | null;
|
|
2186
|
+
}> | null;
|
|
2187
|
+
/** How long after the banner appeared visitors decided, as a histogram; null when none in the window. */
|
|
2188
|
+
timeToDecision: {
|
|
2189
|
+
decisions: number;
|
|
2190
|
+
buckets: Array<{
|
|
2191
|
+
upToSeconds: number | null;
|
|
2192
|
+
count: number;
|
|
2193
|
+
}>;
|
|
2194
|
+
median: {
|
|
2195
|
+
fromSeconds: number;
|
|
2196
|
+
upToSeconds: number | null;
|
|
2197
|
+
} | null;
|
|
2198
|
+
} | null;
|
|
2199
|
+
/** Present for a figure with nothing recorded in the window, saying why. */
|
|
2200
|
+
notRecorded?: {
|
|
2201
|
+
byLanguage?: string;
|
|
2202
|
+
timeToDecision?: string;
|
|
2100
2203
|
};
|
|
2101
2204
|
}
|
|
2102
2205
|
/** One cookie read from another CMP's export. */
|
|
@@ -3883,6 +3986,10 @@ interface CookieMunchClient {
|
|
|
3883
3986
|
listStandard(): Promise<StandardKeyList>;
|
|
3884
3987
|
/** The calling key itself, whatever its scopes: check its own expiry. */
|
|
3885
3988
|
self(): Promise<ApiKeyPrefix>;
|
|
3989
|
+
/** Re-pin the calling key to another dated API version. Any key may, for itself. */
|
|
3990
|
+
updateSelf(input: {
|
|
3991
|
+
apiVersion: string;
|
|
3992
|
+
}): Promise<ApiKeyPrefix>;
|
|
3886
3993
|
/** The calling key rotates itself; the old secret stops at once. Use a client with an Idempotency-Key header. */
|
|
3887
3994
|
rollSelf(): Promise<ApiKeyIssued>;
|
|
3888
3995
|
/** A short-lived key (ttlSeconds at most 43200) within this key's own scopes and properties. Needs keys:write or full access. */
|
|
@@ -3898,8 +4005,24 @@ interface CookieMunchClient {
|
|
|
3898
4005
|
}>;
|
|
3899
4006
|
};
|
|
3900
4007
|
usage(): Promise<Usage>;
|
|
4008
|
+
/** The dated API versions, what each changed, and the one this key is pinned to (`yours`). */
|
|
4009
|
+
versions(): Promise<ApiVersions>;
|
|
3901
4010
|
/** What the org may use: every plan feature (`whiteLabel`, `tcf`, …) and limit, in the suite-standard shape. Any key may read it. */
|
|
3902
4011
|
entitlements(): Promise<Entitlements>;
|
|
4012
|
+
/**
|
|
4013
|
+
* The organisation's sandbox: a separate test organisation with the same people and plan features, never billed.
|
|
4014
|
+
* Its keys are test-format keys and its rights requests are all tests. `create` and `delete` need an unscoped key or `orgs:create`.
|
|
4015
|
+
*/
|
|
4016
|
+
sandbox: {
|
|
4017
|
+
/** The sandbox, or null. From a sandbox key, the sandbox itself. */
|
|
4018
|
+
get(): Promise<SandboxOrg | null>;
|
|
4019
|
+
/** Make the sandbox (or return the existing one, `created: false`) with a new test key for it. */
|
|
4020
|
+
create(input?: {
|
|
4021
|
+
keyName?: string;
|
|
4022
|
+
}): Promise<SandboxCreated>;
|
|
4023
|
+
/** Erase the sandbox entirely. Cannot be undone; the live organisation is not touched. */
|
|
4024
|
+
delete(): Promise<SandboxPurge>;
|
|
4025
|
+
};
|
|
3903
4026
|
/** Every link a site's privacy wiring depends on, one row each with `ok` and a fix hint. `cbid` may be omitted with one site. */
|
|
3904
4027
|
integrationHealth(cbid?: string): Promise<IntegrationHealthReport>;
|
|
3905
4028
|
/** Waive a health check you chose not to meet: the row reports `ok: null` with `waived`. Audited. */
|
|
@@ -4141,4 +4264,4 @@ interface CookieMunchClient {
|
|
|
4141
4264
|
}
|
|
4142
4265
|
declare function createCookieMunch(opts: CookieMunchOptions): CookieMunchClient;
|
|
4143
4266
|
|
|
4144
|
-
export { type AbResult, type AccountOrg, type AccountOrgs, type AdPersonalizationInput, type AiInspectInput, type AiInspectResult, type ApiKey, type ApiKeyIssueInput, type ApiKeyIssued, type ApiKeyPrefix, type ApiKeyReport, type ApiKeyRevoked, type ApiKeyUpdate, type ApiKeyVended, type AppliedImport, type AssetUpload, type AuditEntry, type AuditSink, type AuditSinkInput, type BannerRecord, type BannerSummary, type BlockedReport, type BrandExtractionResult, type BrandImportInput, type BrandKit, type BrandKitCreate, type BrandMappingRow, type BrandReadBack, type BrandSuggestion, type BulkSiteInput, type BulkSiteResult, type ButtonParityFinding, type ButtonParityLint, type ButtonParityScan, CANARY_ISSUER, CONFORMANCE_RULES, type CategorizedCookie, type CategoryRegistry, type CenterToken, type CenterTokenInput, type ChildKeyInput, type CompletionSecretRolled, type ConfigChange, type ConfigDryRun, type ConfigWarning, type ConformanceOptions, type ConformanceReport, type ConformanceRuleResult, type ConformanceStatus, type ConsentDay, type ConsentDecisionInput, type ConsentIngestInput, type ConsentInsights, type ConsentLogRow, type ConsentSyncSecret, type ConsentSyncSecretMinted, type CookieDeclaration, CookieMunchApiError, type CookieMunchClient, type CookieMunchOptions, type CookiePreset, type CookiePresetManifest, type CookiePresetParams, type CookiePresetResult, type CookiePresetVendor, type CookieSuggestion, type CookieSuggestions, type CookieSuggestionsDeclared, type CspSources, type CustomPresetInput, type DeclarationDiff, type DeclarationDryRun, type DeclarationWarning, type DeclaredCookie, type DeclaredCookieInput, type DnsRecordInstruction, type DsarCase, type DsarCaseCreate, type DsarCaseReceipt, type DsarCaseStatus, type DsarCaseTask, type DsarCreate, type DsarEraseResult, type DsarExecutor, type DsarExecutorCreated, type DsarExecutorDryRun, type DsarExecutorInput, type DsarExecutorPatch, type DsarExecutorPresetInput, type DsarExportResult, type DsarRequest, type DsarSettings, type DsarStatus, type DsarSubject, type DsarTask, type DsarTaskEvent, type DsarTaskExport, type DsarTaskLogEntry, type DsarTaskOutcome, type DsarType, type DsarTypeWord, type EmbedManifest, type EmbedManifestStorage, type EmbedManifestSurface, type EnforcementRuleInput, type Entitlement, type Entitlements, type ExecutorConformanceResult, type ExecutorHealth, type ExecutorPresetName, type ExecutorPresetStep, type ExecutorPresetUpgrade, type ExecutorPresets, type ExecutorProfile, type ExecutorTestInput, type ExecutorTestResult, type ExecutorWebhookDelivery, type ExecutorWebhookTestResult, type FdCause, type FdConsent, type FdConsentQueue, type FdQueuedCall, type FdRequestOptions, type FdSnapshot, type FlowIssue, type FlowOp, type FlowOpResponse, type FulfillmentOp, type HealthRow, type HealthWaiver, type HealthWaiverInput, type Identifier, type Identity, type ImportedCookie, type ImportedDeclaration, type InstallSnippet, type IntegrationHealthReport, type LeakReport, type LegalBasis, type LogQuery, type MailProvider, type MailProviderInput, type MailProviderKind, type MailProviderTestResult, type Member, type MetadataFilter, type MintConsentSyncTokenInput, type ObservedPurgeResult, type OptInMethod, type Org, type OrgControllerIdentity, type OrgControllerInput, type OrgUpdate, type ParityControlSummary, type PartnerCatalogEntry, type PartnerId, type PartnerLink, type PartnerLinkCreate, type PlanSource, type PolicyOptions, type PreferenceItem, type PreferenceRecord, type PreviewToken, type PreviewTokenOptions, type ProfileAttributeInput, type ProvisionEnv, type ProvisionRequest, type ProvisionRequestV2, type ProvisionResult, type ProvisionStep, type PublicDsarFiled, type PublicDsarPending, type PublicVerification, type PutConfigOptions, type RangeQuery, type Regulation, type RegulationSummary, type RegulatoryFeedResult, type ResellerChild, type ResellerChildCreate, type ResellerChildList, type ResellerChildPatch, type ResourceMetadata, type ResourceTags, type ResourceTagsInput, type ResourceTagsUpdate, type RetentionLine, type RetiredCookie, type RightKind, type RightsCaptcha, type RightsCaptchaInput, type RightsCaptchaProvider, type RightsIdentity, type RightsIdentityInput, type RightsIdentityType, type RightsLink, type RightsLinkInput, type RightsPageDocument, type RightsPageDomain, type RightsPageDomainList, type RightsPageDraft, type RightsPageDraftConflict, type RightsPageDryRun, type RightsPageIssue, type RightsPagePublishResult, type RightsPagePublished, type RightsPagePublisher, type RightsPageVersions, type RightsPageWriteOptions, type RiskScore, type RopaEntry, type RopaInput, SDK_VERSION, type SandboxPurge, type ScanResult, type ScanStatus, type ScoredVendor, type ScrollbarTheme, type SessionAnalysisInput, type SignedReceipt, type Site, type SiteConfig, type SiteCookie, type SiteCreate, type SiteFlow, type SiteUpdate, type SiteUpdateResult, type SnippetOptions, type StandardKeyList, type StandardPartnerLink, type StandardPartnerLinkCreate, type StorageType, type SubjectCard, type SubjectIdentity, type SubscriptionTopicInput, type SuggestedRejectStyle, type SupportedLanguage, type TaggedType, type Usage, type VendorInput, type VendorRecord, type VerifyResult, type VerifyWebhookInput, type WebhookCreate, type WebhookDeadLetter, type WebhookKeyForm, type WebhookReplayResult, type WebhookStage, type WebhookSubscription, type WebhookTestResult, type WebhookUpdate, canaryIdentityFor, createCookieMunch, mintConsentSyncToken, runExecutorConformance, verifyWebhookSignature };
|
|
4267
|
+
export { type AbResult, type AccountOrg, type AccountOrgs, type AdPersonalizationInput, type AiInspectInput, type AiInspectResult, type ApiKey, type ApiKeyIssueInput, type ApiKeyIssued, type ApiKeyPrefix, type ApiKeyReport, type ApiKeyRevoked, type ApiKeyUpdate, type ApiKeyVended, type ApiVersions, type AppliedImport, type AssetUpload, type AuditEntry, type AuditSink, type AuditSinkInput, type BannerRecord, type BannerSummary, type BlockedReport, type BrandExtractionResult, type BrandImportInput, type BrandKit, type BrandKitCreate, type BrandMappingRow, type BrandReadBack, type BrandSuggestion, type BulkSiteInput, type BulkSiteResult, type ButtonParityFinding, type ButtonParityLint, type ButtonParityScan, CANARY_ISSUER, CONFORMANCE_RULES, type CategorizedCookie, type CategoryRegistry, type CenterToken, type CenterTokenInput, type ChildKeyInput, type CompletionSecretRolled, type ConfigChange, type ConfigDryRun, type ConfigWarning, type ConformanceOptions, type ConformanceReport, type ConformanceRuleResult, type ConformanceStatus, type ConsentDay, type ConsentDecisionInput, type ConsentIngestInput, type ConsentInsights, type ConsentLogRow, type ConsentSyncSecret, type ConsentSyncSecretMinted, type CookieDeclaration, CookieMunchApiError, type CookieMunchClient, type CookieMunchOptions, type CookiePreset, type CookiePresetManifest, type CookiePresetParams, type CookiePresetResult, type CookiePresetVendor, type CookieSuggestion, type CookieSuggestions, type CookieSuggestionsDeclared, type CspSources, type CustomPresetInput, type DeclarationDiff, type DeclarationDryRun, type DeclarationWarning, type DeclaredCookie, type DeclaredCookieInput, type DnsRecordInstruction, type DsarCase, type DsarCaseCreate, type DsarCaseReceipt, type DsarCaseStatus, type DsarCaseTask, type DsarCreate, type DsarEraseResult, type DsarExecutor, type DsarExecutorCreated, type DsarExecutorDryRun, type DsarExecutorInput, type DsarExecutorPatch, type DsarExecutorPresetInput, type DsarExportResult, type DsarRequest, type DsarSettings, type DsarStatus, type DsarSubject, type DsarTask, type DsarTaskEvent, type DsarTaskExport, type DsarTaskLogEntry, type DsarTaskOutcome, type DsarType, type DsarTypeWord, type EmbedManifest, type EmbedManifestStorage, type EmbedManifestSurface, type EnforcementRuleInput, type Entitlement, type Entitlements, type ExecutorConformanceResult, type ExecutorHealth, type ExecutorPresetName, type ExecutorPresetStep, type ExecutorPresetUpgrade, type ExecutorPresets, type ExecutorProfile, type ExecutorTestInput, type ExecutorTestResult, type ExecutorWebhookDelivery, type ExecutorWebhookTestResult, type FdCause, type FdConsent, type FdConsentQueue, type FdQueuedCall, type FdRequestOptions, type FdSnapshot, type FlowIssue, type FlowOp, type FlowOpResponse, type FulfillmentOp, type HealthRow, type HealthWaiver, type HealthWaiverInput, type Identifier, type Identity, type ImportedCookie, type ImportedDeclaration, type InstallSnippet, type IntegrationHealthReport, type LeakReport, type LegalBasis, type LogQuery, type MailProvider, type MailProviderInput, type MailProviderKind, type MailProviderTestResult, type Member, type MetadataFilter, type MintConsentSyncTokenInput, type ObservedPurgeResult, type OperatorTokenExchangeInput, type OperatorTokenExchangeResult, type OptInMethod, type Org, type OrgControllerIdentity, type OrgControllerInput, type OrgUpdate, type ParityControlSummary, type PartnerCatalogEntry, type PartnerId, type PartnerLink, type PartnerLinkCreate, type PlanSource, type PolicyOptions, type PreferenceItem, type PreferenceRecord, type PreviewToken, type PreviewTokenOptions, type ProfileAttributeInput, type ProvisionEnv, type ProvisionRequest, type ProvisionRequestV2, type ProvisionResult, type ProvisionStep, type PublicDsarFiled, type PublicDsarPending, type PublicVerification, type PutConfigOptions, type RangeQuery, type Regulation, type RegulationSummary, type RegulatoryFeedResult, type ResellerChild, type ResellerChildCreate, type ResellerChildList, type ResellerChildPatch, type ResourceMetadata, type ResourceTags, type ResourceTagsInput, type ResourceTagsUpdate, type RetentionLine, type RetiredCookie, type RightKind, type RightsCaptcha, type RightsCaptchaInput, type RightsCaptchaProvider, type RightsIdentity, type RightsIdentityInput, type RightsIdentityType, type RightsLink, type RightsLinkInput, type RightsPageDocument, type RightsPageDomain, type RightsPageDomainList, type RightsPageDraft, type RightsPageDraftConflict, type RightsPageDryRun, type RightsPageIssue, type RightsPagePublishResult, type RightsPagePublished, type RightsPagePublisher, type RightsPageVersions, type RightsPageWriteOptions, type RiskScore, type RopaEntry, type RopaInput, SDK_VERSION, type SandboxCreated, type SandboxOrg, type SandboxPurge, type ScanResult, type ScanStatus, type ScoredVendor, type ScrollbarTheme, type SessionAnalysisInput, type SignedReceipt, type Site, type SiteConfig, type SiteCookie, type SiteCreate, type SiteFlow, type SiteUpdate, type SiteUpdateResult, type SnippetOptions, type StandardKeyList, type StandardPartnerLink, type StandardPartnerLinkCreate, type StorageType, type SubjectCard, type SubjectIdentity, type SubscriptionTopicInput, type SuggestedRejectStyle, type SupportedLanguage, type TaggedType, TokenExchangeError, type Usage, type VendorInput, type VendorRecord, type VerifyResult, type VerifyWebhookInput, type WebhookCreate, type WebhookDeadLetter, type WebhookKeyForm, type WebhookReplayResult, type WebhookStage, type WebhookSubscription, type WebhookTestResult, type WebhookUpdate, canaryIdentityFor, createCookieMunch, exchangeOperatorToken, mintConsentSyncToken, runExecutorConformance, verifyWebhookSignature };
|
package/dist/index.d.ts
CHANGED
|
@@ -26,6 +26,10 @@ interface Identity {
|
|
|
26
26
|
propertyLocked?: boolean;
|
|
27
27
|
cbids?: string[];
|
|
28
28
|
reseller?: boolean;
|
|
29
|
+
/** This organisation is a sandbox (`sandbox.create()`): test keys, test rights requests, never billed. */
|
|
30
|
+
sandbox?: boolean;
|
|
31
|
+
/** For a sandbox: the live organisation it belongs to. */
|
|
32
|
+
sandboxOf?: string;
|
|
29
33
|
}
|
|
30
34
|
type PlanSource = 'org' | 'account';
|
|
31
35
|
/** One organisation on an account (GET /v1/orgs, and the `org_limit` refusal). */
|
|
@@ -707,6 +711,49 @@ declare const CONFORMANCE_RULES: ReadonlyArray<{
|
|
|
707
711
|
/** Run every rule against one executor. Never throws for an executor's answer; only for bad options. */
|
|
708
712
|
declare function runExecutorConformance(o: ConformanceOptions): Promise<ConformanceReport>;
|
|
709
713
|
|
|
714
|
+
/**
|
|
715
|
+
* Operator token exchange (RFC 8693, CMU-X33): swap your identity provider's token for a short-lived,
|
|
716
|
+
* scoped Cookie Munch API key, so no long-lived key has to live in a file.
|
|
717
|
+
*
|
|
718
|
+
* import { exchangeOperatorToken, createCookieMunch } from '@cookiemunch/sdk';
|
|
719
|
+
* const { accessToken } = await exchangeOperatorToken({
|
|
720
|
+
* subjectToken: process.env.STAFF_ACCESS_TOKEN!, // from the sign-in your organisation trusts
|
|
721
|
+
* scope: ['sites:read', 'dsar:read'],
|
|
722
|
+
* resource: 'org:2f1c…', // or 'site:<cbid>' to lock the key to one site
|
|
723
|
+
* });
|
|
724
|
+
* const client = createCookieMunch({ apiKey: accessToken, baseUrl: 'https://api.cookiemunch.net' });
|
|
725
|
+
*
|
|
726
|
+
* No API key is needed for the exchange itself. The key it returns expires on its own (at most an hour).
|
|
727
|
+
*/
|
|
728
|
+
interface OperatorTokenExchangeInput {
|
|
729
|
+
/** The access or ID token from an OIDC issuer the deployment trusts. */
|
|
730
|
+
subjectToken: string;
|
|
731
|
+
/** Which kind of token `subjectToken` is. Default `access_token`. */
|
|
732
|
+
subjectTokenType?: 'access_token' | 'jwt' | 'id_token';
|
|
733
|
+
/** The API scopes the key should carry. Required: an exchanged key is never full access. */
|
|
734
|
+
scope: string[];
|
|
735
|
+
/** `org:<id>`, or `site:<cbid>` to lock the key to one site. */
|
|
736
|
+
resource: `org:${string}` | `site:${string}`;
|
|
737
|
+
/** Seconds, 60 to 3600. Default 3600. */
|
|
738
|
+
expiresIn?: number;
|
|
739
|
+
/** Default `https://api.cookiemunch.net`. */
|
|
740
|
+
baseUrl?: string;
|
|
741
|
+
fetch?: typeof fetch;
|
|
742
|
+
}
|
|
743
|
+
interface OperatorTokenExchangeResult {
|
|
744
|
+
/** A scoped Cookie Munch API key. */
|
|
745
|
+
accessToken: string;
|
|
746
|
+
expiresIn: number;
|
|
747
|
+
scope: string[];
|
|
748
|
+
}
|
|
749
|
+
/** Thrown with the RFC 6749 `error` and `error_description` the server answered. */
|
|
750
|
+
declare class TokenExchangeError extends Error {
|
|
751
|
+
readonly error: string;
|
|
752
|
+
readonly status: number;
|
|
753
|
+
constructor(error: string, status: number, description?: string);
|
|
754
|
+
}
|
|
755
|
+
declare function exchangeOperatorToken(input: OperatorTokenExchangeInput): Promise<OperatorTokenExchangeResult>;
|
|
756
|
+
|
|
710
757
|
/**
|
|
711
758
|
* Types for `window.__fdConsent`, the shared consent API any embed can code against — a chat
|
|
712
759
|
* widget, a referral snippet, an analytics tag — whatever CMP the page runs. Cookie Munch sets
|
|
@@ -791,7 +838,7 @@ declare global {
|
|
|
791
838
|
* This package's version, sent in the default User-Agent. Cloudflare answers a request with
|
|
792
839
|
* no recognisable User-Agent with `403 error code: 1010`; a test pins this to package.json.
|
|
793
840
|
*/
|
|
794
|
-
declare const SDK_VERSION = "0.
|
|
841
|
+
declare const SDK_VERSION = "0.7.1";
|
|
795
842
|
interface CookieMunchOptions {
|
|
796
843
|
apiKey: string;
|
|
797
844
|
/** "https://api.cookiemunch.net" — the /v1 prefix is appended automatically. */
|
|
@@ -805,6 +852,11 @@ interface CookieMunchOptions {
|
|
|
805
852
|
strictUnknownFields?: boolean;
|
|
806
853
|
/** The `User-Agent` sent on every request. Default `cookiemunch-js/<version>`. */
|
|
807
854
|
userAgent?: string;
|
|
855
|
+
/**
|
|
856
|
+
* Serve every request under this dated API version (`CookieMunch-Version`, e.g. `'2026-10-24'`) instead of the
|
|
857
|
+
* one your key is pinned to. `versions()` lists them; `keys.updateSelf({ apiVersion })` re-pins the key.
|
|
858
|
+
*/
|
|
859
|
+
apiVersion?: string;
|
|
808
860
|
/**
|
|
809
861
|
* Seal every once-shown secret to this X25519 public key (`x25519:<base64>`): answers carry `sealed_secret`
|
|
810
862
|
* (a libsodium sealed box) and `sealed_field` instead of the plaintext. Sent as `X-Secret-Recipient` on writes.
|
|
@@ -1902,6 +1954,39 @@ interface ApiKeyPrefix {
|
|
|
1902
1954
|
env?: 'live' | 'test' | null;
|
|
1903
1955
|
format?: 'cookiemunch' | 'legacy';
|
|
1904
1956
|
strictUnknownFields?: boolean;
|
|
1957
|
+
/** The dated API version this key is pinned to. */
|
|
1958
|
+
apiVersion?: string;
|
|
1959
|
+
}
|
|
1960
|
+
/** A live organisation's sandbox (GET /v1/sandbox). */
|
|
1961
|
+
interface SandboxOrg {
|
|
1962
|
+
orgId: string;
|
|
1963
|
+
name: string;
|
|
1964
|
+
sandboxOf: string;
|
|
1965
|
+
createdAt: string;
|
|
1966
|
+
}
|
|
1967
|
+
/** POST /v1/sandbox: the sandbox and a test key for it, shown once. */
|
|
1968
|
+
interface SandboxCreated {
|
|
1969
|
+
sandbox: SandboxOrg;
|
|
1970
|
+
created: boolean;
|
|
1971
|
+
key: string;
|
|
1972
|
+
keyPrefix: string;
|
|
1973
|
+
keyExpiresAt: string;
|
|
1974
|
+
}
|
|
1975
|
+
/** GET /v1/versions. */
|
|
1976
|
+
interface ApiVersions {
|
|
1977
|
+
latest: string;
|
|
1978
|
+
base: string;
|
|
1979
|
+
/** With a key: the version it is pinned to. */
|
|
1980
|
+
yours?: string;
|
|
1981
|
+
versions: Array<{
|
|
1982
|
+
version: string;
|
|
1983
|
+
summary: string;
|
|
1984
|
+
changes: Array<{
|
|
1985
|
+
id: string;
|
|
1986
|
+
summary: string;
|
|
1987
|
+
docs: string;
|
|
1988
|
+
}>;
|
|
1989
|
+
}>;
|
|
1905
1990
|
}
|
|
1906
1991
|
/** A revoked key in the report: when, by whom, why; never the secret. */
|
|
1907
1992
|
interface ApiKeyRevoked {
|
|
@@ -2092,11 +2177,29 @@ interface ConsentInsights {
|
|
|
2092
2177
|
optInRate: number | null;
|
|
2093
2178
|
}>;
|
|
2094
2179
|
byVariantWindow: 'all_time';
|
|
2095
|
-
|
|
2096
|
-
|
|
2097
|
-
|
|
2098
|
-
|
|
2099
|
-
|
|
2180
|
+
/** Decisions made on a banner, by the language it was shown in; null when none in the window. */
|
|
2181
|
+
byLanguage: Array<{
|
|
2182
|
+
language: string;
|
|
2183
|
+
decisions: number;
|
|
2184
|
+
optIns: number;
|
|
2185
|
+
optInRate: number | null;
|
|
2186
|
+
}> | null;
|
|
2187
|
+
/** How long after the banner appeared visitors decided, as a histogram; null when none in the window. */
|
|
2188
|
+
timeToDecision: {
|
|
2189
|
+
decisions: number;
|
|
2190
|
+
buckets: Array<{
|
|
2191
|
+
upToSeconds: number | null;
|
|
2192
|
+
count: number;
|
|
2193
|
+
}>;
|
|
2194
|
+
median: {
|
|
2195
|
+
fromSeconds: number;
|
|
2196
|
+
upToSeconds: number | null;
|
|
2197
|
+
} | null;
|
|
2198
|
+
} | null;
|
|
2199
|
+
/** Present for a figure with nothing recorded in the window, saying why. */
|
|
2200
|
+
notRecorded?: {
|
|
2201
|
+
byLanguage?: string;
|
|
2202
|
+
timeToDecision?: string;
|
|
2100
2203
|
};
|
|
2101
2204
|
}
|
|
2102
2205
|
/** One cookie read from another CMP's export. */
|
|
@@ -3883,6 +3986,10 @@ interface CookieMunchClient {
|
|
|
3883
3986
|
listStandard(): Promise<StandardKeyList>;
|
|
3884
3987
|
/** The calling key itself, whatever its scopes: check its own expiry. */
|
|
3885
3988
|
self(): Promise<ApiKeyPrefix>;
|
|
3989
|
+
/** Re-pin the calling key to another dated API version. Any key may, for itself. */
|
|
3990
|
+
updateSelf(input: {
|
|
3991
|
+
apiVersion: string;
|
|
3992
|
+
}): Promise<ApiKeyPrefix>;
|
|
3886
3993
|
/** The calling key rotates itself; the old secret stops at once. Use a client with an Idempotency-Key header. */
|
|
3887
3994
|
rollSelf(): Promise<ApiKeyIssued>;
|
|
3888
3995
|
/** A short-lived key (ttlSeconds at most 43200) within this key's own scopes and properties. Needs keys:write or full access. */
|
|
@@ -3898,8 +4005,24 @@ interface CookieMunchClient {
|
|
|
3898
4005
|
}>;
|
|
3899
4006
|
};
|
|
3900
4007
|
usage(): Promise<Usage>;
|
|
4008
|
+
/** The dated API versions, what each changed, and the one this key is pinned to (`yours`). */
|
|
4009
|
+
versions(): Promise<ApiVersions>;
|
|
3901
4010
|
/** What the org may use: every plan feature (`whiteLabel`, `tcf`, …) and limit, in the suite-standard shape. Any key may read it. */
|
|
3902
4011
|
entitlements(): Promise<Entitlements>;
|
|
4012
|
+
/**
|
|
4013
|
+
* The organisation's sandbox: a separate test organisation with the same people and plan features, never billed.
|
|
4014
|
+
* Its keys are test-format keys and its rights requests are all tests. `create` and `delete` need an unscoped key or `orgs:create`.
|
|
4015
|
+
*/
|
|
4016
|
+
sandbox: {
|
|
4017
|
+
/** The sandbox, or null. From a sandbox key, the sandbox itself. */
|
|
4018
|
+
get(): Promise<SandboxOrg | null>;
|
|
4019
|
+
/** Make the sandbox (or return the existing one, `created: false`) with a new test key for it. */
|
|
4020
|
+
create(input?: {
|
|
4021
|
+
keyName?: string;
|
|
4022
|
+
}): Promise<SandboxCreated>;
|
|
4023
|
+
/** Erase the sandbox entirely. Cannot be undone; the live organisation is not touched. */
|
|
4024
|
+
delete(): Promise<SandboxPurge>;
|
|
4025
|
+
};
|
|
3903
4026
|
/** Every link a site's privacy wiring depends on, one row each with `ok` and a fix hint. `cbid` may be omitted with one site. */
|
|
3904
4027
|
integrationHealth(cbid?: string): Promise<IntegrationHealthReport>;
|
|
3905
4028
|
/** Waive a health check you chose not to meet: the row reports `ok: null` with `waived`. Audited. */
|
|
@@ -4141,4 +4264,4 @@ interface CookieMunchClient {
|
|
|
4141
4264
|
}
|
|
4142
4265
|
declare function createCookieMunch(opts: CookieMunchOptions): CookieMunchClient;
|
|
4143
4266
|
|
|
4144
|
-
export { type AbResult, type AccountOrg, type AccountOrgs, type AdPersonalizationInput, type AiInspectInput, type AiInspectResult, type ApiKey, type ApiKeyIssueInput, type ApiKeyIssued, type ApiKeyPrefix, type ApiKeyReport, type ApiKeyRevoked, type ApiKeyUpdate, type ApiKeyVended, type AppliedImport, type AssetUpload, type AuditEntry, type AuditSink, type AuditSinkInput, type BannerRecord, type BannerSummary, type BlockedReport, type BrandExtractionResult, type BrandImportInput, type BrandKit, type BrandKitCreate, type BrandMappingRow, type BrandReadBack, type BrandSuggestion, type BulkSiteInput, type BulkSiteResult, type ButtonParityFinding, type ButtonParityLint, type ButtonParityScan, CANARY_ISSUER, CONFORMANCE_RULES, type CategorizedCookie, type CategoryRegistry, type CenterToken, type CenterTokenInput, type ChildKeyInput, type CompletionSecretRolled, type ConfigChange, type ConfigDryRun, type ConfigWarning, type ConformanceOptions, type ConformanceReport, type ConformanceRuleResult, type ConformanceStatus, type ConsentDay, type ConsentDecisionInput, type ConsentIngestInput, type ConsentInsights, type ConsentLogRow, type ConsentSyncSecret, type ConsentSyncSecretMinted, type CookieDeclaration, CookieMunchApiError, type CookieMunchClient, type CookieMunchOptions, type CookiePreset, type CookiePresetManifest, type CookiePresetParams, type CookiePresetResult, type CookiePresetVendor, type CookieSuggestion, type CookieSuggestions, type CookieSuggestionsDeclared, type CspSources, type CustomPresetInput, type DeclarationDiff, type DeclarationDryRun, type DeclarationWarning, type DeclaredCookie, type DeclaredCookieInput, type DnsRecordInstruction, type DsarCase, type DsarCaseCreate, type DsarCaseReceipt, type DsarCaseStatus, type DsarCaseTask, type DsarCreate, type DsarEraseResult, type DsarExecutor, type DsarExecutorCreated, type DsarExecutorDryRun, type DsarExecutorInput, type DsarExecutorPatch, type DsarExecutorPresetInput, type DsarExportResult, type DsarRequest, type DsarSettings, type DsarStatus, type DsarSubject, type DsarTask, type DsarTaskEvent, type DsarTaskExport, type DsarTaskLogEntry, type DsarTaskOutcome, type DsarType, type DsarTypeWord, type EmbedManifest, type EmbedManifestStorage, type EmbedManifestSurface, type EnforcementRuleInput, type Entitlement, type Entitlements, type ExecutorConformanceResult, type ExecutorHealth, type ExecutorPresetName, type ExecutorPresetStep, type ExecutorPresetUpgrade, type ExecutorPresets, type ExecutorProfile, type ExecutorTestInput, type ExecutorTestResult, type ExecutorWebhookDelivery, type ExecutorWebhookTestResult, type FdCause, type FdConsent, type FdConsentQueue, type FdQueuedCall, type FdRequestOptions, type FdSnapshot, type FlowIssue, type FlowOp, type FlowOpResponse, type FulfillmentOp, type HealthRow, type HealthWaiver, type HealthWaiverInput, type Identifier, type Identity, type ImportedCookie, type ImportedDeclaration, type InstallSnippet, type IntegrationHealthReport, type LeakReport, type LegalBasis, type LogQuery, type MailProvider, type MailProviderInput, type MailProviderKind, type MailProviderTestResult, type Member, type MetadataFilter, type MintConsentSyncTokenInput, type ObservedPurgeResult, type OptInMethod, type Org, type OrgControllerIdentity, type OrgControllerInput, type OrgUpdate, type ParityControlSummary, type PartnerCatalogEntry, type PartnerId, type PartnerLink, type PartnerLinkCreate, type PlanSource, type PolicyOptions, type PreferenceItem, type PreferenceRecord, type PreviewToken, type PreviewTokenOptions, type ProfileAttributeInput, type ProvisionEnv, type ProvisionRequest, type ProvisionRequestV2, type ProvisionResult, type ProvisionStep, type PublicDsarFiled, type PublicDsarPending, type PublicVerification, type PutConfigOptions, type RangeQuery, type Regulation, type RegulationSummary, type RegulatoryFeedResult, type ResellerChild, type ResellerChildCreate, type ResellerChildList, type ResellerChildPatch, type ResourceMetadata, type ResourceTags, type ResourceTagsInput, type ResourceTagsUpdate, type RetentionLine, type RetiredCookie, type RightKind, type RightsCaptcha, type RightsCaptchaInput, type RightsCaptchaProvider, type RightsIdentity, type RightsIdentityInput, type RightsIdentityType, type RightsLink, type RightsLinkInput, type RightsPageDocument, type RightsPageDomain, type RightsPageDomainList, type RightsPageDraft, type RightsPageDraftConflict, type RightsPageDryRun, type RightsPageIssue, type RightsPagePublishResult, type RightsPagePublished, type RightsPagePublisher, type RightsPageVersions, type RightsPageWriteOptions, type RiskScore, type RopaEntry, type RopaInput, SDK_VERSION, type SandboxPurge, type ScanResult, type ScanStatus, type ScoredVendor, type ScrollbarTheme, type SessionAnalysisInput, type SignedReceipt, type Site, type SiteConfig, type SiteCookie, type SiteCreate, type SiteFlow, type SiteUpdate, type SiteUpdateResult, type SnippetOptions, type StandardKeyList, type StandardPartnerLink, type StandardPartnerLinkCreate, type StorageType, type SubjectCard, type SubjectIdentity, type SubscriptionTopicInput, type SuggestedRejectStyle, type SupportedLanguage, type TaggedType, type Usage, type VendorInput, type VendorRecord, type VerifyResult, type VerifyWebhookInput, type WebhookCreate, type WebhookDeadLetter, type WebhookKeyForm, type WebhookReplayResult, type WebhookStage, type WebhookSubscription, type WebhookTestResult, type WebhookUpdate, canaryIdentityFor, createCookieMunch, mintConsentSyncToken, runExecutorConformance, verifyWebhookSignature };
|
|
4267
|
+
export { type AbResult, type AccountOrg, type AccountOrgs, type AdPersonalizationInput, type AiInspectInput, type AiInspectResult, type ApiKey, type ApiKeyIssueInput, type ApiKeyIssued, type ApiKeyPrefix, type ApiKeyReport, type ApiKeyRevoked, type ApiKeyUpdate, type ApiKeyVended, type ApiVersions, type AppliedImport, type AssetUpload, type AuditEntry, type AuditSink, type AuditSinkInput, type BannerRecord, type BannerSummary, type BlockedReport, type BrandExtractionResult, type BrandImportInput, type BrandKit, type BrandKitCreate, type BrandMappingRow, type BrandReadBack, type BrandSuggestion, type BulkSiteInput, type BulkSiteResult, type ButtonParityFinding, type ButtonParityLint, type ButtonParityScan, CANARY_ISSUER, CONFORMANCE_RULES, type CategorizedCookie, type CategoryRegistry, type CenterToken, type CenterTokenInput, type ChildKeyInput, type CompletionSecretRolled, type ConfigChange, type ConfigDryRun, type ConfigWarning, type ConformanceOptions, type ConformanceReport, type ConformanceRuleResult, type ConformanceStatus, type ConsentDay, type ConsentDecisionInput, type ConsentIngestInput, type ConsentInsights, type ConsentLogRow, type ConsentSyncSecret, type ConsentSyncSecretMinted, type CookieDeclaration, CookieMunchApiError, type CookieMunchClient, type CookieMunchOptions, type CookiePreset, type CookiePresetManifest, type CookiePresetParams, type CookiePresetResult, type CookiePresetVendor, type CookieSuggestion, type CookieSuggestions, type CookieSuggestionsDeclared, type CspSources, type CustomPresetInput, type DeclarationDiff, type DeclarationDryRun, type DeclarationWarning, type DeclaredCookie, type DeclaredCookieInput, type DnsRecordInstruction, type DsarCase, type DsarCaseCreate, type DsarCaseReceipt, type DsarCaseStatus, type DsarCaseTask, type DsarCreate, type DsarEraseResult, type DsarExecutor, type DsarExecutorCreated, type DsarExecutorDryRun, type DsarExecutorInput, type DsarExecutorPatch, type DsarExecutorPresetInput, type DsarExportResult, type DsarRequest, type DsarSettings, type DsarStatus, type DsarSubject, type DsarTask, type DsarTaskEvent, type DsarTaskExport, type DsarTaskLogEntry, type DsarTaskOutcome, type DsarType, type DsarTypeWord, type EmbedManifest, type EmbedManifestStorage, type EmbedManifestSurface, type EnforcementRuleInput, type Entitlement, type Entitlements, type ExecutorConformanceResult, type ExecutorHealth, type ExecutorPresetName, type ExecutorPresetStep, type ExecutorPresetUpgrade, type ExecutorPresets, type ExecutorProfile, type ExecutorTestInput, type ExecutorTestResult, type ExecutorWebhookDelivery, type ExecutorWebhookTestResult, type FdCause, type FdConsent, type FdConsentQueue, type FdQueuedCall, type FdRequestOptions, type FdSnapshot, type FlowIssue, type FlowOp, type FlowOpResponse, type FulfillmentOp, type HealthRow, type HealthWaiver, type HealthWaiverInput, type Identifier, type Identity, type ImportedCookie, type ImportedDeclaration, type InstallSnippet, type IntegrationHealthReport, type LeakReport, type LegalBasis, type LogQuery, type MailProvider, type MailProviderInput, type MailProviderKind, type MailProviderTestResult, type Member, type MetadataFilter, type MintConsentSyncTokenInput, type ObservedPurgeResult, type OperatorTokenExchangeInput, type OperatorTokenExchangeResult, type OptInMethod, type Org, type OrgControllerIdentity, type OrgControllerInput, type OrgUpdate, type ParityControlSummary, type PartnerCatalogEntry, type PartnerId, type PartnerLink, type PartnerLinkCreate, type PlanSource, type PolicyOptions, type PreferenceItem, type PreferenceRecord, type PreviewToken, type PreviewTokenOptions, type ProfileAttributeInput, type ProvisionEnv, type ProvisionRequest, type ProvisionRequestV2, type ProvisionResult, type ProvisionStep, type PublicDsarFiled, type PublicDsarPending, type PublicVerification, type PutConfigOptions, type RangeQuery, type Regulation, type RegulationSummary, type RegulatoryFeedResult, type ResellerChild, type ResellerChildCreate, type ResellerChildList, type ResellerChildPatch, type ResourceMetadata, type ResourceTags, type ResourceTagsInput, type ResourceTagsUpdate, type RetentionLine, type RetiredCookie, type RightKind, type RightsCaptcha, type RightsCaptchaInput, type RightsCaptchaProvider, type RightsIdentity, type RightsIdentityInput, type RightsIdentityType, type RightsLink, type RightsLinkInput, type RightsPageDocument, type RightsPageDomain, type RightsPageDomainList, type RightsPageDraft, type RightsPageDraftConflict, type RightsPageDryRun, type RightsPageIssue, type RightsPagePublishResult, type RightsPagePublished, type RightsPagePublisher, type RightsPageVersions, type RightsPageWriteOptions, type RiskScore, type RopaEntry, type RopaInput, SDK_VERSION, type SandboxCreated, type SandboxOrg, type SandboxPurge, type ScanResult, type ScanStatus, type ScoredVendor, type ScrollbarTheme, type SessionAnalysisInput, type SignedReceipt, type Site, type SiteConfig, type SiteCookie, type SiteCreate, type SiteFlow, type SiteUpdate, type SiteUpdateResult, type SnippetOptions, type StandardKeyList, type StandardPartnerLink, type StandardPartnerLinkCreate, type StorageType, type SubjectCard, type SubjectIdentity, type SubscriptionTopicInput, type SuggestedRejectStyle, type SupportedLanguage, type TaggedType, TokenExchangeError, type Usage, type VendorInput, type VendorRecord, type VerifyResult, type VerifyWebhookInput, type WebhookCreate, type WebhookDeadLetter, type WebhookKeyForm, type WebhookReplayResult, type WebhookStage, type WebhookSubscription, type WebhookTestResult, type WebhookUpdate, canaryIdentityFor, createCookieMunch, exchangeOperatorToken, mintConsentSyncToken, runExecutorConformance, verifyWebhookSignature };
|
package/dist/index.js
CHANGED
|
@@ -220,8 +220,44 @@ async function runExecutorConformance(o) {
|
|
|
220
220
|
}
|
|
221
221
|
}
|
|
222
222
|
|
|
223
|
+
// src/token-exchange.ts
|
|
224
|
+
var TokenExchangeError = class extends Error {
|
|
225
|
+
constructor(error, status, description) {
|
|
226
|
+
super(description ? `${error}: ${description}` : error);
|
|
227
|
+
this.error = error;
|
|
228
|
+
this.status = status;
|
|
229
|
+
this.name = "TokenExchangeError";
|
|
230
|
+
}
|
|
231
|
+
};
|
|
232
|
+
async function exchangeOperatorToken(input) {
|
|
233
|
+
const base = (input.baseUrl ?? "https://api.cookiemunch.net").replace(/\/+$/, "");
|
|
234
|
+
const form = new URLSearchParams({
|
|
235
|
+
grant_type: "urn:ietf:params:oauth:grant-type:token-exchange",
|
|
236
|
+
subject_token: input.subjectToken,
|
|
237
|
+
subject_token_type: `urn:ietf:params:oauth:token-type:${input.subjectTokenType ?? "access_token"}`,
|
|
238
|
+
scope: input.scope.join(" "),
|
|
239
|
+
resource: input.resource,
|
|
240
|
+
audience: "cookiemunch",
|
|
241
|
+
...input.expiresIn !== void 0 ? { expires_in: String(input.expiresIn) } : {}
|
|
242
|
+
});
|
|
243
|
+
const res = await (input.fetch ?? fetch)(`${base}/v1/oauth/token`, {
|
|
244
|
+
method: "POST",
|
|
245
|
+
headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
|
|
246
|
+
body: form.toString()
|
|
247
|
+
});
|
|
248
|
+
const body = await res.json().catch(() => ({}));
|
|
249
|
+
if (!res.ok) {
|
|
250
|
+
throw new TokenExchangeError(typeof body.error === "string" ? body.error : `http_${res.status}`, res.status, typeof body.error_description === "string" ? body.error_description : void 0);
|
|
251
|
+
}
|
|
252
|
+
return {
|
|
253
|
+
accessToken: String(body.access_token),
|
|
254
|
+
expiresIn: Number(body.expires_in),
|
|
255
|
+
scope: String(body.scope ?? "").split(" ").filter(Boolean)
|
|
256
|
+
};
|
|
257
|
+
}
|
|
258
|
+
|
|
223
259
|
// src/index.ts
|
|
224
|
-
var SDK_VERSION = "0.
|
|
260
|
+
var SDK_VERSION = "0.7.1";
|
|
225
261
|
var CookieMunchApiError = class extends Error {
|
|
226
262
|
constructor(status, message, code, body) {
|
|
227
263
|
super(message);
|
|
@@ -254,6 +290,7 @@ function createCookieMunch(opts) {
|
|
|
254
290
|
async function request(method, path, body, raw = false, extraHeaders = {}) {
|
|
255
291
|
const headers = { Authorization: `Bearer ${opts.apiKey}`, "User-Agent": opts.userAgent ?? `cookiemunch-js/${SDK_VERSION}`, ...extraHeaders };
|
|
256
292
|
if (opts.strictUnknownFields && method !== "GET") headers["Prefer"] = "strict-unknown-fields";
|
|
293
|
+
if (opts.apiVersion) headers["CookieMunch-Version"] = opts.apiVersion;
|
|
257
294
|
if (opts.secretRecipient && method !== "GET") headers["X-Secret-Recipient"] = opts.secretRecipient;
|
|
258
295
|
for (const [k, v] of Object.entries(opts.headers ?? {})) headers[k] = v;
|
|
259
296
|
const init = { method, headers };
|
|
@@ -597,12 +634,19 @@ function createCookieMunch(opts) {
|
|
|
597
634
|
report: (o) => get(`/keys/report${qs({ unusedDays: o?.unusedDays, expiringDays: o?.expiringDays })}`),
|
|
598
635
|
listStandard: () => get("/keys?shape=standard"),
|
|
599
636
|
self: () => get("/keys/self"),
|
|
637
|
+
updateSelf: (input) => request("PATCH", "/keys/self", input),
|
|
600
638
|
rollSelf: () => request("POST", "/keys/self/roll"),
|
|
601
639
|
vend: (input) => request("POST", "/keys/vend", input),
|
|
602
640
|
revokeLeaked: (report) => request("POST", "/keys/revoke_leaked", report)
|
|
603
641
|
},
|
|
604
642
|
usage: () => get("/usage"),
|
|
605
643
|
entitlements: () => get("/entitlements"),
|
|
644
|
+
versions: () => get("/versions"),
|
|
645
|
+
sandbox: {
|
|
646
|
+
get: async () => (await get("/sandbox")).sandbox,
|
|
647
|
+
create: (input) => request("POST", "/sandbox", input ?? {}),
|
|
648
|
+
delete: () => request("DELETE", "/sandbox")
|
|
649
|
+
},
|
|
606
650
|
integrationHealth: (cbid) => get(`/integration-health${qs({ cbid })}`),
|
|
607
651
|
healthWaivers: {
|
|
608
652
|
list: (cbid) => get(`/integration-health/waivers${qs({ cbid })}`),
|
|
@@ -733,9 +777,11 @@ export {
|
|
|
733
777
|
CookieMunchApiError,
|
|
734
778
|
DEFAULT_JWKS_URL,
|
|
735
779
|
SDK_VERSION,
|
|
780
|
+
TokenExchangeError,
|
|
736
781
|
canaryIdentityFor,
|
|
737
782
|
consentSignaturePayload,
|
|
738
783
|
createCookieMunch,
|
|
784
|
+
exchangeOperatorToken,
|
|
739
785
|
getConsent,
|
|
740
786
|
isAllowed,
|
|
741
787
|
mintConsentSyncToken,
|