@cookiemunch/sdk 0.7.1 → 0.9.0

package/dist/index.d.ts

@@ -1,829 +1,3 @@
-export { CONSENT_COOKIE_NAME, ConsentCategory, ConsentSource, ConsentTokenClaims, DEFAULT_JWKS_URL, JsonWebKeySet, KeySetOptions, ReadConsentOptions, ReadSignedConsentOptions, ServerConsent, SignableDecision, VerifyTokenOptions, consentSignaturePayload, getConsent, isAllowed, parseConsentValue, readConsent, verifyDecisionSignature, verifyToken } from './consent.js';
-
-/**
- * Request/response shapes for the Cookie Munch Developer API (/v1). These mirror the
- * server's dev-api surface; they are defined here (rather than imported) so the SDK
- * has no runtime/workspace dependency on the server package.
- */
-interface Identity {
-    orgId: string;
-    orgName?: string | null;
-    /** The EFFECTIVE plan — the one every feature gate and limit uses. */
-    plan: string;
-    /**
-     * Why: `org` = this org's own subscription (or free, or a reseller-managed `child` plan);
-     * `account` = another org with the same owner pays for a higher plan that covers this one.
-     */
-    planSource: PlanSource;
-    /** What this org subscribes to itself (`free` = no subscription of its own). */
-    subscribedPlan: string;
-    /** Features the effective plan unlocks (e.g. `whiteLabel`, `tcf`, `sso`, `abTesting`). */
-    features: string[];
-    keyPrefix: string;
-    /** null = full access. */
-    scopes?: string[] | null;
-    unscoped?: boolean;
-    propertyLocked?: boolean;
-    cbids?: string[];
-    reseller?: boolean;
-    /** This organisation is a sandbox (`sandbox.create()`): test keys, test rights requests, never billed. */
-    sandbox?: boolean;
-    /** For a sandbox: the live organisation it belongs to. */
-    sandboxOf?: string;
-}
-type PlanSource = 'org' | 'account';
-/** One organisation on an account (GET /v1/orgs, and the `org_limit` refusal). */
-interface AccountOrg {
-    id: string;
-    name: string;
-    /** The effective plan. */
-    plan: string;
-    planSource: PlanSource;
-    subscribedPlan: string;
-    /** Present on a reseller-managed child organisation. */
-    parentOrgId?: string;
-    createdAt: number;
-    /** True for the organisation the calling key belongs to. */
-    current: boolean;
-}
-interface AccountOrgs {
-    orgs: AccountOrg[];
-    /** The per-account org cap: `max` (null = unlimited), the `plan` that sets it, and `used`. */
-    orgLimit: {
-        max: number | null;
-        plan: string;
-        used: number;
-    };
-    /** The dashboard billing page, where a plan is chosen. */
-    upgradeUrl: string;
-}
-interface Site {
-    cbid: string;
-    orgId: string;
-    domain: string;
-    /** The business name data subjects see on the rights page, in notices and the policy. Absent: the domain is shown. */
-    name?: string;
-    /** Other hosts serving the site: accepted consent-ingest origins, never verified claims. */
-    aliases?: string[];
-    verified?: boolean;
-}
-/** PATCH /v1/sites/{cbid} — rename or move a site. `name: null` clears the name; `aliases: []` clears them. */
-interface SiteUpdate {
-    domain?: string;
-    name?: string | null;
-    aliases?: string[];
-}
-interface SiteUpdateResult {
-    dryRun?: true;
-    site: Site;
-    diff: Array<{
-        field: 'domain' | 'name' | 'aliases' | 'verified';
-        before: unknown;
-        after: unknown;
-    }>;
-    effects: {
-        /** `reset`: the domain moved; verify the new one. */
-        verification: 'kept' | 'reset';
-        scanTarget: string;
-        previewDefaultUrl: string;
-        displayName: string;
-        /** Custom rights-page hostnames no longer under the domain or an alias (left in place). */
-        staleRightsDomains: string[];
-    };
-    warnings?: Array<{
-        field: string;
-        reason: string;
-    }>;
-}
-/** One row of GET /v1/integration-health. `ok: null` = the check could not run (see `detail`). */
-interface HealthRow {
-    /** The suite shape's name for `check` (always equal). */
-    id: string;
-    check: string;
-    /** The generic check this row is an instance of (`forumulate.webhook` → `webhook.delivery`); otherwise `check`. */
-    kind: string;
-    /** The vendor a vendor-specific instance is about. */
-    vendor?: string;
-    ok: boolean | null;
-    severity: 'error' | 'warning' | 'info';
-    subject: string;
-    fixHint?: string;
-    /** The same as fixHint (suite shape). */
-    fix?: string;
-    /** Where the check and its fix are explained. */
-    docs: string;
-    detail?: string;
-    /** Network checks: the hop that failed (or, on success, the last one reached). */
-    hop?: 'dns' | 'tls' | 'http' | 'challenge' | 'auth';
-    status?: number;
-    elapsedMs?: number;
-    /** Failed network checks: a stable code (ENOTFOUND, timeout, challenge, http_503, …). */
-    error?: string;
-    /** A waiver covers this failing row; `ok` is then null. */
-    waived?: {
-        reason: string;
-        by: string;
-        until: number | null;
-    };
-    lastCheckedAt: number;
-}
-interface IntegrationHealthReport {
-    cbid: string;
-    checkedAt: number;
-    generatedAt: string;
-    ok: boolean;
-    counts: {
-        error: number;
-        warning: number;
-        notChecked: number;
-        waived: number;
-    };
-    checks: HealthRow[];
-}
-/** PUT /v1/integration-health/waivers. */
-interface HealthWaiverInput {
-    /** Optional when the organisation has one site. */
-    cbid?: string;
-    /** A row's `check` or `kind`. */
-    check: string;
-    /** A row's `subject`; omitted: every subject of the check (`*`). */
-    subject?: string;
-    /** Why this is deliberate (1–500 characters). */
-    reason: string;
-    /** ISO date or epoch ms, future, within a year; omitted or null: never expires. */
-    until?: string | number | null;
-}
-interface HealthWaiver {
-    cbid: string;
-    check: string;
-    subject: string;
-    reason: string;
-    by: string;
-    until: number | null;
-    createdAt: number;
-    expired?: boolean;
-}
-/** POST /v1/provision. Secrets are used for the request only and never returned. */
-interface ProvisionRequest {
-    product: string;
-    domain: string;
-    name?: string;
-    aliases?: string[];
-    cbid?: string;
-    /** `frontendApiHost` (e.g. auth.example.com) lets provision declare Atlas's sign-in cookies on the site. */
-    /** `rightsIdentity` (default true) makes Atlas the site's rights sign-in (step `rights.identity`). */
-    atlas?: {
-        secretKey: string;
-        cookieConsent?: boolean;
-        dsrWebhook?: boolean;
-        rightsIdentity?: boolean;
-        frontendApiHost?: string;
-    };
-    forumulate?: {
-        token: string;
-        orgId: string;
-        consent?: boolean;
-        executorKey?: boolean;
-        label?: string;
-    };
-    rightsApi?: {
-        baseUrl: string;
-        secretKey: string;
-        profilePreset?: string;
-    };
-}
-interface ProvisionStep {
-    /** v2 answers: the stable step id (`fromStep` takes it). */
-    id?: string;
-    step: string;
-    status: 'created' | 'updated' | 'unchanged' | 'would_create' | 'would_update' | 'skipped' | 'waiting' | 'waiting_on' | 'failed' | 'passed';
-    detail?: string;
-    diff?: Array<{
-        field: string;
-        before: unknown;
-        after: unknown;
-    }>;
-    /** A string in v1 answers; `{ platform, items }` in v2 answers. */
-    waitingOn?: string | {
-        platform: string;
-        items: string[];
-    };
-}
-interface ProvisionResult {
-    dryRun: boolean;
-    product: string;
-    cbid: string | null;
-    steps: ProvisionStep[];
-    summary: {
-        changed: number;
-        unchanged: number;
-        waiting: number;
-        failed: number;
-    };
-    /** v2 answers only. */
-    version?: 2;
-    ids?: {
-        orgId: string;
-        cbid: string | null;
-        executors: Record<string, string>;
-        webhooks: string[];
-    };
-    sealedSecrets?: Array<Record<string, unknown>>;
-    checklist?: string[];
-}
-/** A partner the deployment knows: built in (forumulate, atlas, chatly, referalli) or any other registered on it. */
-type PartnerId = 'forumulate' | 'atlas' | 'chatly' | 'referalli' | (string & {});
-interface PartnerLinkCreate {
-    partner: PartnerId;
-    /** The partner's id for the receiving account (a Forumulate organisation id, an Atlas instance id). */
-    externalId: string;
-    label?: string;
-    events?: Array<'consent.recorded' | 'consent.withdrawn'>;
-}
-interface PartnerLink {
-    id: string;
-    cbid: string;
-    partner: PartnerId;
-    externalId: string;
-    label?: string;
-    events: string[];
-    status: 'active' | 'waiting_on_partner' | 'revoked';
-    /** e.g. "Forumulate (docs) — receiving consent events". */
-    summary: string;
-    waitingOn?: string;
-    createdAt: number;
-    createdBy?: string;
-    revokedAt?: number;
-    revokedBy?: string | null;
-    lastDeliveryAt: number | null;
-    lastError: string | null;
-}
-interface PartnerCatalogEntry {
-    id: PartnerId;
-    label: string;
-    externalIdLabel: string;
-    events: string[];
-    available: boolean;
-    waitingOn?: string;
-}
-interface SiteCreate {
-    domain: string;
-    /** Optional; the server auto-generates a cbid when omitted. */
-    cbid?: string;
-}
-/** Site config is an open, deeply-nested object owned by @cookiemunch/core. */
-type SiteConfig = Record<string, unknown>;
-interface ConsentDay {
-    Date: string;
-    OptIn: number;
-    OptOut: number;
-    OptInImplied: number;
-    OptInStrict: number;
-    TypeOptInPref: number;
-    TypeOptInStat: number;
-    TypeOptInMark: number;
-    Impressions: number;
-    Countries: Record<string, number>;
-}
-interface ConsentLogRow {
-    stamp: string;
-    receivedAt: number;
-    region: string;
-    method: string;
-    choices: {
-        preferences: boolean;
-        statistics: boolean;
-        marketing: boolean;
-    };
-    anonIp: string;
-    url: string;
-}
-interface RangeQuery {
-    from?: number;
-    to?: number;
-}
-interface LogQuery extends RangeQuery {
-    limit?: number;
-}
-type DsarType = 'access' | 'deletion' | 'rectification' | 'portability' | 'opt-out' | 'closure' | 'restriction';
-/** A type word as sent: the canonical words, or an alias (`erasure`/`erase` → deletion, `export` → access). */
-type DsarTypeWord = DsarType | 'erasure' | 'erase' | 'export';
-type Regulation = 'gdpr' | 'ccpa';
-type DsarStatus = 'received' | 'verifying' | 'in_progress' | 'completed' | 'rejected' | 'cancelled';
-interface DsarRequest {
-    id: string;
-    type: DsarType;
-    subjectEmail: string;
-    regulation: Regulation;
-    status: DsarStatus;
-    createdAt: number;
-    dueAt: number;
-    /** Where the subject said they are, when the intake captured it. */
-    jurisdiction?: string;
-    /** INTERNAL: intake note plus the audit lines `/erase` and `/export` append. Never shown to the subject. */
-    note?: string;
-    /** The line the subject reads in the response notice. */
-    messageToSubject?: string;
-    /** A test request: off the SLA board, labelled, and deletable with `dsar.delete`. A closed request can be marked one with `dsar.markTest`. */
-    test?: boolean;
-    /** Its type in the suite vocabulary (`erasure` was stored as `deletion`). */
-    canonicalType?: string;
-    /** The case's X-ForgeDeck-Trace, when it has one. */
-    trace?: string;
-}
-/** A signed-in identity from any OIDC issuer the site trusts. `(iss, sub)` is the key. */
-interface SubjectIdentity {
-    iss: string;
-    sub: string;
-    ext?: string;
-    principal?: string;
-}
-/** Who a case is about. `atlas` is accepted as an alias of `identity`. */
-interface DsarSubject {
-    emails: string[];
-    identity?: SubjectIdentity;
-    atlas?: SubjectIdentity;
-}
-/** POST /v1/dsar/requests. */
-interface DsarCaseCreate {
-    cbid: string;
-    type: DsarTypeWord;
-    subject?: DsarSubject;
-    /** The person's own token from the site's sign-in issuer (aud `cookiemunch:<cbid>`). */
-    subjectToken?: string;
-    /** product and atlas need dsar:write and attest the person; admin (default) files it received. */
-    source?: 'product' | 'atlas' | 'admin';
-    reason?: string;
-    /** Connections not to ask: system names, connection ids, or `self`. */
-    skipSystems?: string[];
-    /** Default true. */
-    fulfill?: boolean;
-    regulation?: 'gdpr' | 'ccpa' | 'lgpd' | 'pipeda' | 'vcdpa';
-    jurisdiction?: string;
-    test?: boolean;
-}
-type DsarCaseStatus = 'pending' | 'scheduled' | 'processing' | 'completed' | 'completed_with_retention' | 'rejected' | 'cancelled';
-interface RetentionLine {
-    category: string;
-    basis: 'legal_obligation' | 'legal_claims' | 'contract' | 'public_interest';
-    until?: string;
-}
-interface DsarCaseTask {
-    system: string;
-    executorId: string | null;
-    taskId: string;
-    status: DsarCaseStatus | 'no_match';
-    requestId: string | null;
-    eta: string | null;
-    completedAt: string | null;
-    detail: string | null;
-    retention?: RetentionLine[];
-}
-/** A case across every connected system. */
-interface DsarCase {
-    id: string;
-    type: DsarType;
-    canonicalType: string;
-    status: DsarCaseStatus;
-    requestStatus: DsarStatus;
-    cbid?: string;
-    source: 'product' | 'atlas' | 'rights_page' | 'admin' | null;
-    reason: string | null;
-    openedAt: string;
-    /** Nothing is erased anywhere before this. */
-    executeAfter: string | null;
-    graceDays: number | null;
-    closedAt: string | null;
-    /** False for a closure: no statutory clock. */
-    statutory: boolean;
-    dueAt: string | null;
-    verification: string | null;
-    trace: string | null;
-    subject: {
-        emails: string[];
-        identity: SubjectIdentity | null;
-    };
-    skipSystems: string[];
-    fulfill: boolean | null;
-    cancelRequestedAt: string | null;
-    test: boolean;
-    tasks: DsarCaseTask[];
-    receiptUrl: string;
-    /** Lets the person who asked read this case through POST /api/v1/public/dsar/status. */
-    statusToken?: string;
-}
-/** One signed receipt for a case (Ed25519; verify with GET /v1/partner/jwks.json). */
-interface DsarCaseReceipt {
-    receiptVersion: number;
-    caseId: string;
-    type: DsarType;
-    canonicalType: string;
-    status: DsarCaseStatus;
-    openedAt: string;
-    executeAfter: string | null;
-    closedAt: string | null;
-    verification: string | null;
-    trace: string | null;
-    subject: {
-        emailHashes: string[];
-        identityHash?: string;
-        atlasSubHash?: string;
-    };
-    systems: Array<{
-        system: string;
-        executorId: string | null;
-        requestId: string | null;
-        status: string;
-        completedAt: string | null;
-        trace: string | null;
-        retention?: RetentionLine[];
-    }>;
-    issuedAt: string;
-    signature: {
-        alg: 'Ed25519';
-        kid: string;
-        value: string;
-        covers?: string;
-    };
-}
-/** A site's rights-request settings. */
-interface DsarSettings {
-    cbid: string;
-    /** Days an erasure or account closure waits before any system acts (0–30). 7 for a new site; 0 for one that existed before (opt-in). */
-    graceDays: number;
-    /** site: set explicitly; default: a new site's 7 days; legacy: an existing site, 0 until set. */
-    source: 'site' | 'default' | 'legacy';
-    updatedAt: number | null;
-}
-/** GET /v1/integrations/{app}/card. */
-interface SubjectCard {
-    app: string;
-    openCases: Array<{
-        id: string;
-        type: string;
-        status: string;
-        executeAfter: string | null;
-        openedAt: string;
-        receiptUrl: string;
-    }>;
-    consent: null;
-}
-/**
- * How a rights-page requester was verified — on every answer of the public intake
- * (`POST /api/v1/public/dsar`, `/verify`, `/resend`) and so in the `dsar.created` webhook payload.
- * `email_code` on a 202: a code was mailed through your own provider; on a 201: the code matched.
- * `none` with a `reason`: filed without verification — confirm the requester yourself. `none`
- * without one: an opt-out, which needs no verification.
- */
-type PublicVerification = {
-    method: 'session' | 'email_code' | 'account_link';
-} | {
-    method: 'none';
-    reason?: 'no_verification_configured' | 'mail_failed' | 'recipient_rejected';
-};
-/** A public intake that filed a request (201): also the `dsar.created` payload for one. */
-interface PublicDsarFiled {
-    id: string;
-    status: 'received' | 'verifying';
-    /** Epoch ms the statutory response is due. */
-    deadline: number;
-    /** Only when filed without verification; the same as `verification.method` `none` with a `reason`. */
-    unverified?: true;
-    verification: PublicVerification;
-}
-/** A public intake waiting for its email code (202). */
-interface PublicDsarPending {
-    pendingId: string;
-    expiresAt: number;
-    resendAfter?: number;
-    verification: {
-        method: 'email_code';
-    };
-}
-interface DsarCreate {
-    type: DsarType;
-    subjectEmail: string;
-    /** Picks the statutory response window. */
-    regulation: Regulation;
-    /**
-     * Where the subject says they are (ISO 3166 country or country-subdivision, e.g.
-     * `US-TX`). The response notice names the statute that governs there — without it a
-     * Texan is told their request was handled under a Virginia law, since every US state
-     * shares one `regulation` for the deadline.
-     */
-    jurisdiction?: string;
-    /** INTERNAL: kept on the request, never shown to the subject. */
-    note?: string;
-    /** The one free-text line the subject reads in the notice (≤2000 chars; an API key or key prefix is refused). */
-    messageToSubject?: string;
-    /** The property this request belongs to; decides which connected systems answer it. */
-    cbid?: string;
-    /** The subject's consent-receipt id. */
-    stamp?: string;
-    /**
-     * Mark it as a test: left out of SLA metrics and the deadline board, labelled as a test,
-     * and deletable with `dsar.delete(id)`. For end-to-end checks of a rights flow.
-     */
-    test?: boolean;
-}
-interface VendorInput {
-    name: string;
-    category: string;
-    dataShared: string[];
-    dpaSigned: boolean;
-    subprocessors: number;
-    certifications: string[];
-    region: string;
-}
-interface RiskScore {
-    score: number;
-    band: 'low' | 'medium' | 'high';
-}
-/** A stored vendor record (no computed risk; see {@link ScoredVendor}). Returned as the
- *  `vendor` field of POST /v1/vendors. */
-interface VendorRecord extends VendorInput {
-    id: string;
-}
-/** A vendor as listed, with its computed risk flattened in. */
-interface ScoredVendor extends VendorRecord {
-    risk: RiskScore;
-}
-type LegalBasis = 'consent' | 'contract' | 'legal-obligation' | 'vital-interests' | 'public-task' | 'legitimate-interests';
-interface RopaInput {
-    name: string;
-    purpose: string;
-    legalBasis: LegalBasis;
-    dataCategories: string[];
-    recipients: string[];
-    retentionDays: number;
-    crossBorderTransfer: boolean;
-}
-interface RopaEntry extends RopaInput {
-    id: string;
-}
-/** A signed consent receipt (shape owned by @cookiemunch/receipts). */
-type SignedReceipt = Record<string, unknown>;
-/** How a preference-center opt-in was captured. Mirrors @cookiemunch/preferences OptInMethod. */
-type OptInMethod = 'single-opt-in' | 'double-opt-in';
-/**
- * A subject's saved preference-center record (identity-keyed named purposes, distinct
- * from the org-level {@link PreferenceItem} catalog). Matches @cookiemunch/preferences
- * PreferenceRecord (mirrored here per this package's no-server-dependency convention).
- * Returned wrapped as `{ record }` by POST /v1/preferences.
- */
-interface PreferenceRecord {
-    subjectId: string;
-    purposes: Record<string, boolean>;
-    method: OptInMethod;
-    confirmed: boolean;
-    updatedAt: number;
-    version: number;
-}
-/** GET /v1/categories/registry — the reserved category templates (CMU-X15). */
-interface CategoryRegistry {
-    version: 1;
-    standard: string[];
-    suite: Array<{
-        id: 'support_chat' | 'referrals';
-        stance: 'necessary_on_request' | 'opt_in_eu_uk';
-        fallback: 'preferences' | 'marketing';
-        /** By banner language. */
-        labels: Record<string, string>;
-        descriptions: Record<string, string>;
-        basis?: string[];
-        vendors?: Array<{
-            product: string;
-            storage: string[];
-        }>;
-    }>;
-}
-
-interface VerifyWebhookInput {
-    /** The raw request body, exactly as received. Do NOT re-stringify parsed JSON. */
-    payload: string;
-    /** The `X-CookieMunch-Signature` header value. */
-    signature: string | undefined | null;
-    /** The `X-CookieMunch-Timestamp` header value (unix seconds). */
-    timestamp: string | number | undefined | null;
-    /** The subscription secret (`whsec_…`), shown once when the webhook was created. */
-    secret: string;
-    /**
-     * Maximum age (in seconds) of a delivery before it is rejected as stale/replayed.
-     * Defaults to 300 (5 minutes). Pass 0 to disable the freshness check entirely.
-     */
-    toleranceSeconds?: number;
-    /** Current time in ms (injectable for tests); defaults to `Date.now()`. */
-    now?: number;
-}
-/**
- * Returns true only when the signature is valid AND (unless disabled) the timestamp is fresh.
- * Fail-closed: any missing/malformed input returns false rather than throwing.
- */
-declare function verifyWebhookSignature(input: VerifyWebhookInput): boolean;
-
-interface MintConsentSyncTokenInput {
-    /** The site's consent-sync secret (`cmss_…`). */
-    secret: string;
-    /** The site the token is for. A token for one site is refused by every other. */
-    cbid: string;
-    /** Who is signed in: 1–128 of `A-Z a-z 0-9 . _ : @ + / = ~ -`. Use an opaque id. */
-    subject: string;
-    /** Lifetime in seconds. Default 3600; at most 86400 (Cookie Munch refuses longer). */
-    ttlSeconds?: number;
-    /** Current time in ms (injectable for tests). */
-    now?: number;
-}
-declare function mintConsentSyncToken(input: MintConsentSyncTokenInput): string;
-
-/**
- * The cm-standard-v2 executor conformance kit (CMU-X20).
- *
- * cm-standard-v2 is an open contract: any system that holds personal data can implement it and
- * be driven by Cookie Munch with no code on our side (docs: cookiemunch.net/docs/executor-contract-v2).
- * This kit checks an implementation rule by rule, and names the rule that fails. It is the same
- * suite Cookie Munch runs on `POST /v1/dsar/executors/{id}/test {conformance: true}`, and the
- * `cookiemunch executors conformance <baseUrl>` command runs it from a terminal or CI.
- *
- * It only ever touches the CANARY subject — an address no real person has. The contract asks every
- * implementation to treat the canary as an existing synthetic person: it is found by its email and
- * by its identity, requests on it move through the full state machine, and nothing real is ever
- * erased. So the kit can check that an erasure waits for `executeAfter`, that a cancel leaves the
- * person in place, and that an identity is never matched to someone else through a shared email —
- * without a real person's data being anywhere near it.
- *
- * No dependencies: `fetch` only, so it runs in Node 18+, a browser, or an edge runtime.
- */
-type ConformanceStatus = 'pass' | 'fail' | 'skip';
-interface ConformanceRuleResult {
-    /** A stable id, e.g. `requests.execute_after.scheduled`. */
-    id: string;
-    /** What the rule says, in one sentence. */
-    title: string;
-    status: ConformanceStatus;
-    /** What was seen, when it failed or was skipped. */
-    detail?: string;
-}
-interface ConformanceReport {
-    /** True when no rule failed. */
-    ok: boolean;
-    passed: number;
-    failed: number;
-    skipped: number;
-    rules: ConformanceRuleResult[];
-    /** The `X-Version` the executor answered with, when it sent one. */
-    version?: string;
-}
-interface ConformanceOptions {
-    /** The executor's base: the contract paths are `{baseUrl}/privacy/lookup` and so on. https (http only for localhost). */
-    baseUrl: string;
-    /** The credential Cookie Munch would send. */
-    secret: string;
-    /**
-     * The canary address: `canary-<16 hex>@canary.cookiemunch.net`, per organisation
-     * (`GET /v1/dsar/executors/presets` → `canaryEmail`).
-     */
-    canaryEmail: string;
-    /** How the secret is sent. Default `Authorization: Bearer {secret}`. */
-    auth?: {
-        header: string;
-        format: string;
-    };
-    /** Path prefix under baseUrl. Default `/privacy`. */
-    prefix?: string;
-    fetch?: typeof fetch;
-    now?: () => number;
-    /** A per-run tag for idempotency keys and case ids. Default random. */
-    runId?: string;
-}
-/** The issuer the canary identity carries. */
-declare const CANARY_ISSUER = "https://canary.cookiemunch.net";
-/** The canary subject's identity, derived from its address. */
-declare function canaryIdentityFor(canaryEmail: string): {
-    iss: string;
-    sub: string;
-    ext: string;
-};
-/** Every rule, in the order they run. */
-declare const CONFORMANCE_RULES: ReadonlyArray<{
-    id: string;
-    title: string;
-}>;
-/** Run every rule against one executor. Never throws for an executor's answer; only for bad options. */
-declare function runExecutorConformance(o: ConformanceOptions): Promise<ConformanceReport>;
-
-/**
- * Operator token exchange (RFC 8693, CMU-X33): swap your identity provider's token for a short-lived,
- * scoped Cookie Munch API key, so no long-lived key has to live in a file.
- *
- *   import { exchangeOperatorToken, createCookieMunch } from '@cookiemunch/sdk';
- *   const { accessToken } = await exchangeOperatorToken({
- *     subjectToken: process.env.STAFF_ACCESS_TOKEN!,   // from the sign-in your organisation trusts
- *     scope: ['sites:read', 'dsar:read'],
- *     resource: 'org:2f1c…',                            // or 'site:<cbid>' to lock the key to one site
- *   });
- *   const client = createCookieMunch({ apiKey: accessToken, baseUrl: 'https://api.cookiemunch.net' });
- *
- * No API key is needed for the exchange itself. The key it returns expires on its own (at most an hour).
- */
-interface OperatorTokenExchangeInput {
-    /** The access or ID token from an OIDC issuer the deployment trusts. */
-    subjectToken: string;
-    /** Which kind of token `subjectToken` is. Default `access_token`. */
-    subjectTokenType?: 'access_token' | 'jwt' | 'id_token';
-    /** The API scopes the key should carry. Required: an exchanged key is never full access. */
-    scope: string[];
-    /** `org:<id>`, or `site:<cbid>` to lock the key to one site. */
-    resource: `org:${string}` | `site:${string}`;
-    /** Seconds, 60 to 3600. Default 3600. */
-    expiresIn?: number;
-    /** Default `https://api.cookiemunch.net`. */
-    baseUrl?: string;
-    fetch?: typeof fetch;
-}
-interface OperatorTokenExchangeResult {
-    /** A scoped Cookie Munch API key. */
-    accessToken: string;
-    expiresIn: number;
-    scope: string[];
-}
-/** Thrown with the RFC 6749 `error` and `error_description` the server answered. */
-declare class TokenExchangeError extends Error {
-    readonly error: string;
-    readonly status: number;
-    constructor(error: string, status: number, description?: string);
-}
-declare function exchangeOperatorToken(input: OperatorTokenExchangeInput): Promise<OperatorTokenExchangeResult>;
-
-/**
- * Types for `window.__fdConsent`, the shared consent API any embed can code against — a chat
- * widget, a referral snippet, an analytics tag — whatever CMP the page runs. Cookie Munch sets
- * it natively; `fd-consent-shim.js` sets the same object over Cookiebot, OneTrust or no CMP.
- * Type-only: importing this module adds nothing to a bundle.
- *
- *   import type { FdConsent, FdConsentQueue } from '@cookiemunch/sdk';
- *   const fd = (window.__fdConsent ??= { q: [] });
- *   if ('version' in fd) fd.on('change', (s) => …); else fd.q.push(['on', 'change', (s) => …]);
- *
- * `version` changes only with a breaking change; new members do not bump it.
- */
-/** What caused a change. The same causes Cookie Munch's ledger records. */
-type FdCause = 'replay' | 'accept' | 'decline' | 'selection' | 'withdraw' | 'implied' | 'sync' | 'request' | 'migrated';
-interface FdSnapshot {
-    /** False until the visitor has answered. */
-    decided: boolean;
-    /** False when this visitor's region and the site's rules need no answer (a default applies). */
-    required: boolean;
-    /** Every category the site offers (standard, custom, reserved) and its answer. */
-    categories: Record<string, boolean>;
-    /** The decision's stamp (`CookieMunch.consentId()`), or null. */
-    stamp: string | null;
-    region: string;
-    /** A Global Privacy Control signal was seen. */
-    gpc: boolean;
-    /** ISO 8601, or null before a decision. */
-    decidedAt: string | null;
-}
-interface FdRequestOptions {
-    /** One sentence in the page's language: what will be stored and why. Shown as the prompt's text. */
-    reason: string;
-    /** Who is asking: your vendor id. Recorded with the answer. */
-    vendor: string;
-}
-interface FdConsent {
-    readonly version: 1;
-    /** `cookiemunch`, or `shim:cookiebot` / `shim:onetrust` / `shim:none`. */
-    readonly provider: string;
-    /** Resolves once a decision exists, or at once where the region needs none. */
-    ready(): Promise<FdSnapshot>;
-    /** true / false, or null while a required decision is pending. Never false for "not decided". */
-    has(category: string): boolean | null;
-    /** Fires once per decision (a returning visitor's as `replay`); a withdrawal synchronously. Returns unsubscribe. */
-    on(event: 'change', cb: (snapshot: FdSnapshot, cause: FdCause) => void): () => void;
-    /** Ask for one category at the moment you need it. Never re-asks a refusal; one prompt per category per page view. */
-    request(category: string, opts: FdRequestOptions): Promise<boolean>;
-    /** Not available yet: warns once and does nothing. */
-    identify(token: string): void;
-    layout: {
-        bottomInset(): number;
-        on(cb: (insetPx: number) => void): () => void;
-    };
-    /** Calls made on the queue before this existed ran in order; later pushes run at once. */
-    q: {
-        push(...calls: FdQueuedCall[]): number;
-    };
-}
-/** A call queued before the real object exists. */
-type FdQueuedCall = ['on', 'change', (snapshot: FdSnapshot, cause: FdCause) => void] | ['ready', (snapshot: FdSnapshot) => void] | ['request', string, FdRequestOptions, (granted: boolean) => void] | ['identify', string];
-/** What an embed that loads first creates: `window.__fdConsent = window.__fdConsent || { q: [] }`. */
-interface FdConsentQueue {
-    q: FdQueuedCall[];
-}
-declare global {
-    interface Window {
-        __fdConsent?: FdConsent | FdConsentQueue;
-    }
-}
-
 /**
  * @cookiemunch/sdk — a small, typed REST client for the Cookie Munch Developer API
  * (the /v1 surface). Construct it with an API key; the org is derived server-side
@@ -833,13 +7,21 @@ declare global {
  *   const fc = createCookieMunch({ apiKey: 'fck_…', baseUrl: 'https://api.cookiemunch.net' });
  *   const sites = await fc.sites.list();
  */
-
+export * from './types.js';
+export * from './consent.js';
+export * from './webhooks.js';
+export * from './consent-sync.js';
+export * from './executor-conformance.js';
+export * from './token-exchange.js';
+export type * from './fd-consent.js';
+import type { CategoryRegistry, Identity, AccountOrgs, Site, SiteCreate, SiteConfig, SiteUpdate, SiteUpdateResult, IntegrationHealthReport, HealthWaiver, HealthWaiverInput, ProvisionRequest, ProvisionResult, PartnerLink, PartnerLinkCreate, PartnerCatalogEntry, ConsentDay, ConsentLogRow, RangeQuery, LogQuery, DsarRequest, DsarCreate, DsarCase, DsarCaseCreate, DsarCaseReceipt, DsarSettings, SubjectCard, IntegrationConnect, IntegrationConnectResult, DsarStatus, ScoredVendor, VendorInput, VendorRecord, RiskScore, RopaEntry, RopaInput, SignedReceipt, PreferenceRecord } from './types.js';
+import type { ConformanceReport } from './executor-conformance.js';
 /**
  * This package's version, sent in the default User-Agent. Cloudflare answers a request with
  * no recognisable User-Agent with `403 error code: 1010`; a test pins this to package.json.
  */
-declare const SDK_VERSION = "0.7.1";
-interface CookieMunchOptions {
+export declare const SDK_VERSION = "0.9.0";
+export interface CookieMunchOptions {
     apiKey: string;
     /** "https://api.cookiemunch.net" — the /v1 prefix is appended automatically. */
     baseUrl: string;
@@ -863,32 +45,32 @@ interface CookieMunchOptions {
      */
     secretRecipient?: string;
     /**
-     * Extra headers on every request, e.g. `{ 'Idempotency-Key': '<forgedeck ref>:<run>' }` on a client made for
+     * Extra headers on every request, e.g. `{ 'Idempotency-Key': '<stack ref>:<run>' }` on a client made for
      * one create: a retry with the same key replays the first answer (secrets included) for 24 hours.
      */
     headers?: Record<string, string>;
 }
-/** Tags on a created resource (CMU-X29). `forgedeck_sandbox: true` can only be set at creation. */
-type ResourceMetadata = Record<string, string | number | boolean>;
-/** Keep only resources whose tags match, e.g. `{ forgedeck_product: 'referalli' }`. */
-interface MetadataFilter {
+/** Tags on a created resource (CMU-X29). `stack_sandbox: true` can only be set at creation. */
+export type ResourceMetadata = Record<string, string | number | boolean>;
+/** Keep only resources whose tags match, e.g. `{ stack_product: 'referalli' }`. */
+export interface MetadataFilter {
     metadata?: Record<string, string>;
 }
 /** externalRef and metadata, accepted by every create (orgs, sites, webhooks, executors, DSARs, partner links). */
-interface ResourceTagsInput {
+export interface ResourceTagsInput {
     /** Your own name for it, unique per org and type: a repeat create with the same body returns the existing one. */
     externalRef?: string;
     metadata?: ResourceMetadata;
 }
-type TaggedType = 'org' | 'site' | 'webhook' | 'executor' | 'dsar' | 'partner_link';
-interface ResourceTags {
+export type TaggedType = 'org' | 'site' | 'webhook' | 'executor' | 'dsar' | 'partner_link';
+export interface ResourceTags {
     type: TaggedType;
     id: string;
     metadata: ResourceMetadata;
     externalRef: string | null;
     sandbox: boolean;
 }
-interface ResourceTagsUpdate {
+export interface ResourceTagsUpdate {
     dryRun?: true;
     type: TaggedType;
     id: string;
@@ -900,14 +82,14 @@ interface ResourceTagsUpdate {
     }>;
 }
 /** What a sandbox hard delete removed. */
-interface SandboxPurge {
+export interface SandboxPurge {
     deleted: true;
     cbid?: string;
     orgId?: string;
     counts: Record<string, number>;
 }
 /** A partner link in the suite-standard shape (CMU-X34). */
-interface StandardPartnerLink {
+export interface StandardPartnerLink {
     id: string;
     partner: string;
     resource: string;
@@ -920,7 +102,7 @@ interface StandardPartnerLink {
     externalId?: string;
     label?: string;
 }
-interface StandardPartnerLinkCreate extends ResourceTagsInput {
+export interface StandardPartnerLinkCreate extends ResourceTagsInput {
     partner: string;
     /** `site:<cbid>` or `org:<org id>`. */
     resource: string;
@@ -929,9 +111,9 @@ interface StandardPartnerLinkCreate extends ResourceTagsInput {
     externalId?: string;
     label?: string;
 }
-/** POST /v1/provision v2: the `cookiemunch` block of a forgedeck.yaml (see the forgedeck API map page). */
-interface ProvisionRequestV2 {
-    forgedeck: {
+/** POST /v1/provision v2: the `cookiemunch` block of a stack.yaml (see the provisioning API map page). */
+export interface ProvisionRequestV2 {
+    stack: {
         ref?: string;
         product: string;
         env?: string;
@@ -990,7 +172,7 @@ interface ProvisionRequestV2 {
     };
 }
 /** GET /v1/provision/env: names, non-secret values, and references for secrets. */
-interface ProvisionEnv {
+export interface ProvisionEnv {
     ref: string;
     cbid: string;
     env: Array<{
@@ -1000,7 +182,7 @@ interface ProvisionEnv {
     }>;
 }
 /** A vended short-lived key, shown once. */
-interface ApiKeyVended {
+export interface ApiKeyVended {
     key: string;
     prefix: string;
     expiresAt: number;
@@ -1008,7 +190,7 @@ interface ApiKeyVended {
     cbids: string[] | null;
 }
 /** The suite-standard key listing (GET /v1/keys?shape=standard). */
-interface StandardKeyList {
+export interface StandardKeyList {
     keys: Array<{
         id: string;
         prefix: string;
@@ -1027,7 +209,7 @@ interface StandardKeyList {
     }>;
 }
 /** A leaked secret to revoke (POST /v1/keys/revoke_leaked, no authentication needed). */
-type LeakReport = {
+export type LeakReport = {
     key: string;
     source?: string;
 } | {
@@ -1040,7 +222,7 @@ type LeakReport = {
  * (e.g. `forbidden` on a scope failure, whose `message` is `insufficient_scope`,
  * or `banner_in_use` on a banner-library conflict). It's `undefined` when the body has no `code`.
  */
-declare class CookieMunchApiError extends Error {
+export declare class CookieMunchApiError extends Error {
     readonly status: number;
     readonly code?: string;
     /** The parsed JSON error body, when there was one (e.g. `issues` on a 422). */
@@ -1049,7 +231,7 @@ declare class CookieMunchApiError extends Error {
 }
 /** A cookie discovered on a site, classified into a consent category (wire shape of the
  *  cookie-declaration feed). Matches the server's CategorizedCookie schema. */
-interface CategorizedCookie {
+export interface CategorizedCookie {
     name: string;
     category: 'necessary' | 'preferences' | 'statistics' | 'marketing' | 'unclassified' | (string & {});
     domain?: string;
@@ -1100,9 +282,9 @@ interface CategorizedCookie {
     vendor?: string;
 }
 /** What a declaration row describes. */
-type StorageType = 'cookie' | 'localStorage' | 'sessionStorage' | 'indexedDB';
+export type StorageType = 'cookie' | 'localStorage' | 'sessionStorage' | 'indexedDB';
 /** A cookie the site owner retired: the site renamed or stopped setting it. */
-interface RetiredCookie {
+export interface RetiredCookie {
     /** Exact name, or a `prefix*` wildcard. */
     name: string;
     /** Epoch-ms it was retired; anything seen after this brings it back. */
@@ -1115,7 +297,7 @@ interface RetiredCookie {
 }
 /** A site's cookie declaration: the latest scan and observed visits with the site's own
  *  declarations on top. This is what GET /v1/sites/:cbid/cookies returns. */
-interface CookieDeclaration {
+export interface CookieDeclaration {
     /** Epoch-ms of the latest scan or declaration change, or 0 if none. */
     updatedAt: number;
     cookies: CategorizedCookie[];
@@ -1125,7 +307,7 @@ interface CookieDeclaration {
     retired?: RetiredCookie[];
 }
 /** What the site owner says a cookie is (PUT /v1/sites/:cbid/cookies/:name). */
-interface DeclaredCookieInput {
+export interface DeclaredCookieInput {
     /** A standard category or one of the site's `categories.custom` ids. Not `unclassified`. */
     category: string;
     /** Shown to visitors, and the fallback for any language `purposes` lacks. */
@@ -1145,7 +327,7 @@ interface DeclaredCookieInput {
     type?: StorageType;
 }
 /** A stored declaration. */
-interface DeclaredCookie extends DeclaredCookieInput {
+export interface DeclaredCookie extends DeclaredCookieInput {
     name: string;
     updatedAt: number;
     /** `import` when a vendor preset wrote it. */
@@ -1154,11 +336,11 @@ interface DeclaredCookie extends DeclaredCookieInput {
     vendor?: string;
 }
 /** A platform whose cookies and storage a preset declares. */
-type CookiePresetVendor = 'atlas' | 'forumulate' | 'chatly' | 'cookiemunch' | 'referalli' | 'firstpromoter' | 'partnerstack' | 'tapfiliate' | 'impact'
+export type CookiePresetVendor = 'atlas' | 'forumulate' | 'chatly' | 'cookiemunch' | 'referalli' | 'firstpromoter' | 'partnerstack' | 'tapfiliate' | 'impact'
 /** @deprecated the old name of `referalli`, accepted until 2027-10-23. */
  | 'referally';
 /** Where a vendor's live manifest will come from, and whether it exists yet. */
-interface CookiePresetManifest {
+export interface CookiePresetManifest {
     /** `live`/`stale`/`invalid`: the vendor's embed manifest feeds the preset; `waiting_on_vendor`: built-in rows. */
     status: 'builtin' | 'live' | 'stale' | 'invalid' | 'waiting_on_vendor';
     waitingOn?: string;
@@ -1176,15 +358,20 @@ interface CookiePresetManifest {
         code?: string;
         message: string;
     }>;
+    /**
+     * About the copy in effect: `entry_skipped` / `storage_entry_skipped` (one entry was unreadable and left out; the
+     * rest still applies, and a left-out storage entry gives `name`), or `short_notice`.
+     */
     warnings?: Array<{
         rule?: number;
         path?: string;
         code?: string;
         message: string;
+        name?: string;
     }>;
 }
 /** PUT /v1/sites/:cbid/cookies/presets/custom — any vendor's embed manifest, by URL or as a body. */
-type CustomPresetInput = ({
+export type CustomPresetInput = ({
     url: string;
     manifest?: never;
 } | {
@@ -1195,7 +382,7 @@ type CustomPresetInput = ({
     params?: Record<string, string>;
 };
 /** One suggestion in GET /v1/sites/:cbid/cookies/suggestions. */
-interface CookieSuggestion {
+export interface CookieSuggestion {
     name: string;
     storage: 'cookie' | 'localStorage' | 'sessionStorage' | 'indexedDB';
     foundOnPages: string[];
@@ -1208,7 +395,7 @@ interface CookieSuggestion {
     reason: string;
 }
 /** GET /v1/sites/:cbid/cookies/suggestions */
-interface CookieSuggestions {
+export interface CookieSuggestions {
     suggestions: CookieSuggestion[];
     vendors: Array<{
         vendor: string;
@@ -1224,7 +411,7 @@ interface CookieSuggestions {
     }>;
 }
 /** POST /v1/sites/:cbid/cookies/suggestions/declare */
-interface CookieSuggestionsDeclared {
+export interface CookieSuggestionsDeclared {
     presetsApplied: string[];
     declaredCount: number;
     skipped?: Array<{
@@ -1236,7 +423,7 @@ interface CookieSuggestionsDeclared {
     diff?: DeclarationDiff;
 }
 /** Preset parameters: Atlas `frontendApiHost`/`crossSubdomainCookies`; Chatly `publicId`/`dragging`/`category`; referral and affiliate presets (referalli, firstpromoter, partnerstack, tapfiliate, impact) `cookieDomain`/`cookieDays`/`category`, referalli `legacyName`, impact `campaignId`. */
-interface CookiePresetParams {
+export interface CookiePresetParams {
     frontendApiHost?: string;
     crossSubdomainCookies?: boolean;
     publicId?: string;
@@ -1250,7 +437,7 @@ interface CookiePresetParams {
     campaignId?: string;
 }
 /** One browser key a surface writes, in an embed manifest. */
-interface EmbedManifestStorage {
+export interface EmbedManifestStorage {
     name: string;
     type: 'cookie' | 'localStorage' | 'sessionStorage' | 'indexedDB';
     category: string;
@@ -1262,7 +449,7 @@ interface EmbedManifestStorage {
     sentTo?: string;
 }
 /** One embeddable surface in an embed manifest: its origins by CSP directive and its storage. */
-interface EmbedManifestSurface {
+export interface EmbedManifestSurface {
     /** Origins by CSP directive (`script-src`, `connect-src`, …). */
     csp?: Record<string, string[]>;
     /** Non-origin sources the surface needs (`'unsafe-inline'`, `data:`). */
@@ -1273,7 +460,7 @@ interface EmbedManifestSurface {
     sri?: Record<string, string>;
 }
 /** The shared embed/origins manifest (https://cookiemunch.net/schemas/embed-v1.json). */
-interface EmbedManifest {
+export interface EmbedManifest {
     schema: string;
     product: string;
     updated: string;
@@ -1309,7 +496,7 @@ interface EmbedManifest {
     };
 }
 /** One preset in GET /v1/sites/:cbid/cookies/presets. */
-interface CookiePreset {
+export interface CookiePreset {
     /** A first-class preset, or a custom preset's product id. */
     vendor: CookiePresetVendor | (string & {});
     /** A custom preset (importCookieManifest). */
@@ -1326,10 +513,10 @@ interface CookiePreset {
     manifest: CookiePresetManifest;
 }
 /** What applying a preset declared. */
-interface CookiePresetResult {
+export interface CookiePresetResult {
     vendor: CookiePresetVendor | (string & {});
-    /** `manifest` when the rows came from the vendor's embed manifest. */
-    source?: 'manifest';
+    /** `builtin` (Cookie Munch's own rows, also while the vendor's manifest is invalid), `manifest` (its valid embed manifest), or `instance`. */
+    source?: 'builtin' | 'manifest' | 'instance';
     cookies: DeclaredCookie[];
     removed: string[];
     skipped?: Array<{
@@ -1353,7 +540,7 @@ interface CookiePresetResult {
     diff?: DeclarationDiff;
 }
 /** What removing observed rows removed (or, with `dryRun`, would). */
-interface ObservedPurgeResult {
+export interface ObservedPurgeResult {
     removed: string[];
     count: number;
     since?: number;
@@ -1361,7 +548,7 @@ interface ObservedPurgeResult {
     dryRun?: true;
 }
 /** What a declaration write would change (`dryRun`). */
-interface DeclarationDiff {
+export interface DeclarationDiff {
     added: DeclaredCookie[];
     removed: DeclaredCookie[];
     changed: Array<{
@@ -1371,19 +558,19 @@ interface DeclarationDiff {
     }>;
 }
 /** The answer to a `dryRun` declaration write: nothing was stored. */
-interface DeclarationDryRun {
+export interface DeclarationDryRun {
     dryRun: true;
     /** Every declaration the site would have. */
     declared: DeclaredCookie[];
     diff: DeclarationDiff;
 }
 /** A warning about a write: e.g. the category is switched off for the site. */
-interface DeclarationWarning {
+export interface DeclarationWarning {
     field: string;
     reason: string;
 }
 /** What an import with `apply` declared, on top of what it read. */
-interface AppliedImport extends ImportedDeclaration {
+export interface AppliedImport extends ImportedDeclaration {
     applied: number;
     skipped: Array<{
         name: string;
@@ -1392,7 +579,7 @@ interface AppliedImport extends ImportedDeclaration {
     warnings?: DeclarationWarning[];
 }
 /** @deprecated The server returns {@link CookieDeclaration}; kept only for back-compat. */
-interface SiteCookie {
+export interface SiteCookie {
     name: string;
     domain: string;
     category: string;
@@ -1402,7 +589,7 @@ interface SiteCookie {
     firstSeen?: number;
 }
 /** Cookie-scan status, from GET /v1/sites/:cbid/scan. */
-interface ScanStatus {
+export interface ScanStatus {
     /** `scanning` while the last scan is queued or crawling. Kept for older clients; read `state`. */
     status: 'idle' | 'scanning';
     /** Epoch-ms of the last completed scan, or null. */
@@ -1425,7 +612,7 @@ interface ScanStatus {
     error?: string;
 }
 /** Consent-button parity of the banner a real browser saw on the site (see ScanStatus). */
-interface ButtonParityScan {
+export interface ButtonParityScan {
     url: string;
     /** False when no visible consent accept control was found in a recognisable banner. */
     bannerFound: boolean;
@@ -1444,7 +631,7 @@ interface ButtonParityScan {
     checkedAt?: number;
 }
 /** @deprecated The server returns {@link ScanStatus}; kept only for back-compat. */
-interface ScanResult {
+export interface ScanResult {
     scanId: string;
     status: 'queued' | 'running' | 'complete' | 'failed';
     startedAt?: number;
@@ -1453,14 +640,14 @@ interface ScanResult {
     cookiesFound?: number;
 }
 /** A/B banner experiment results for a single variant. */
-interface AbResult {
+export interface AbResult {
     variant: string;
     impressions: number;
     optIns: number;
     optInRate: number;
 }
 /** The response shape of GET /v1/sites/:cbid/snippet. */
-interface InstallSnippet {
+export interface InstallSnippet {
     /** The exact `<script>` tag to paste into `<head>`. */
     snippet: string;
     /** URL of the consent.js embed file (the embed/CDN origin). */
@@ -1481,7 +668,7 @@ interface InstallSnippet {
     warnings?: ConfigWarning[];
 }
 /** Content Security Policy sources the embed needs. */
-interface CspSources {
+export interface CspSources {
     script: string[];
     connect: string[];
     img: string[];
@@ -1493,22 +680,22 @@ interface CspSources {
     policy: string;
 }
 /** Something a config write did not store as sent. */
-interface ConfigWarning {
+export interface ConfigWarning {
     field: string;
     reason: string;
 }
 /** One leaf a config write would change. */
-interface ConfigChange {
+export interface ConfigChange {
     path: string;
     from?: unknown;
     to?: unknown;
 }
 /** `PUT …/config` options. `keep: 'unspecified'` keeps the stored value of every top-level field the body omits. */
-interface PutConfigOptions {
+export interface PutConfigOptions {
     keep?: 'unspecified';
 }
 /** What a config write would do (`?dryRun=1`) — nothing is saved. */
-interface ConfigDryRun {
+export interface ConfigDryRun {
     dryRun: true;
     /** The config as it would be saved. */
     config: SiteConfig;
@@ -1519,7 +706,7 @@ interface ConfigDryRun {
     designWarnings: ButtonParityFinding[];
 }
 /** The effective style of an Accept all / Reject all control. */
-interface ParityControlSummary {
+export interface ParityControlSummary {
     id?: string;
     label: string;
     element: 'button' | 'link';
@@ -1537,8 +724,8 @@ interface ParityControlSummary {
  * CSS). Returned as `designWarnings` on every config read and write, and by `lintConfig`.
  * A warning, never an error — the config is saved regardless. See /docs/fair-consent-buttons.
  */
-interface ButtonParityFinding {
-    code: 'reject_missing_first_layer' | 'reject_missing_same_layer' | 'reject_hidden' | 'reject_below_fold' | 'reject_isolated' | 'reject_low_emphasis' | 'saturation_gap' | 'color_mismatch' | 'reject_text_low_contrast' | 'reject_styled_as_link' | 'font_size_gap' | 'font_weight_gap' | 'size_gap' | 'padding_gap' | 'border_mismatch' | 'reject_label_missing' | 'reject_label_long' | 'confirmshaming' | 'custom_css_asymmetric' | 'text_low_contrast' | 'link_low_contrast' | 'button_text_low_contrast' | 'focus_ring_low_contrast' | 'toggle_low_contrast' | 'control_boundary_low_contrast';
+export interface ButtonParityFinding {
+    code: 'reject_missing_first_layer' | 'reject_missing_same_layer' | 'reject_hidden' | 'reject_below_fold' | 'reject_isolated' | 'reject_low_emphasis' | 'saturation_gap' | 'color_mismatch' | 'reject_text_low_contrast' | 'reject_styled_as_link' | 'font_size_gap' | 'font_weight_gap' | 'size_gap' | 'padding_gap' | 'border_mismatch' | 'reject_label_missing' | 'reject_label_long' | 'confirmshaming' | 'custom_css_asymmetric' | 'customize_label_clash' | 'text_low_contrast' | 'link_low_contrast' | 'button_text_low_contrast' | 'focus_ring_low_contrast' | 'toggle_low_contrast' | 'control_boundary_low_contrast';
     severity: 'warning' | 'notice';
     layer: 'banner' | 'preferences' | 'modal' | 'popup' | 'bar' | 'inline' | 'custom';
     accept: ParityControlSummary | null;
@@ -1564,7 +751,7 @@ interface ButtonParityFinding {
     wcag?: '1.4.3' | '1.4.11';
 }
 /** Reject all style values that would match the Accept all on the same layer. */
-interface SuggestedRejectStyle {
+export interface SuggestedRejectStyle {
     layer: string;
     view?: string;
     background?: string;
@@ -1577,19 +764,28 @@ interface SuggestedRejectStyle {
     height?: number;
 }
 /** `POST /v1/sites/:cbid/config/lint` — nothing is saved. */
-interface ButtonParityLint {
+export interface ButtonParityLint {
     /** `merged` = what PATCH would store (merged over the stored config); `replaced` = what PUT would store (`replace: true`). */
     mode: 'merged' | 'replaced';
     designWarnings: ButtonParityFinding[];
     /** 100 minus 20 per warning and 5 per notice, floored at 0. */
     score: number;
     suggestedReject: SuggestedRejectStyle[];
+    /** Laws taking effect within 90 days where at least 1% of the site's recent decisions come from. Absent when none. */
+    regulatoryWarnings?: Array<{
+        code: 'law_upcoming';
+        law: string;
+        effective: string;
+        daysUntil: number;
+        trafficShare: number;
+        message: string;
+    }>;
 }
 /**
  * Scrollbars on the surfaces Cookie Munch renders — the same shape on the banner theme (`theme.scrollbar`)
  * and the rights-page theme. Colours are #hex, rgb() or hsl(); width is clamped to 4–16, radius to 0–999.
  */
-interface ScrollbarTheme {
+export interface ScrollbarTheme {
     style: 'themed' | 'thin' | 'native' | 'hidden';
     thumb?: string;
     thumbHover?: string;
@@ -1598,7 +794,7 @@ interface ScrollbarTheme {
     radius?: number;
 }
 /** The hosted rights page document. See docs/rights-page for each section type's props. */
-interface RightsPageDocument {
+export interface RightsPageDocument {
     v: 1;
     theme: {
         preset: 'brand' | 'light' | 'dark' | 'custom';
@@ -1644,13 +840,13 @@ interface RightsPageDocument {
     customCss?: string;
 }
 /** `message` is English; `code` (+ `params`) is stable, for your own wording or language. */
-interface RightsPageIssue {
+export interface RightsPageIssue {
     path: string;
     message: string;
     code?: string;
     params?: Record<string, string | number>;
 }
-interface RightsPageDraft {
+export interface RightsPageDraft {
     cbid: string;
     draft: RightsPageDocument;
     version: number;
@@ -1658,19 +854,19 @@ interface RightsPageDraft {
     updatedAt: number | null;
     warnings: RightsPageIssue[];
 }
-interface RightsPageDryRun {
+export interface RightsPageDryRun {
     dryRun: true;
     cbid: string;
     draft: RightsPageDocument;
     warnings: RightsPageIssue[];
 }
 /** Who published a version: `publishedBy` is an actor id; `publishedByEmail` names a dashboard user (null for an API key). */
-interface RightsPagePublisher {
+export interface RightsPagePublisher {
     publishedBy: string;
     publishedByEmail: string | null;
     publishedVia: 'dashboard' | 'api_key';
 }
-interface RightsPagePublished {
+export interface RightsPagePublished {
     cbid: string;
     page: RightsPageDocument;
     version: number;
@@ -1685,22 +881,22 @@ interface RightsPagePublished {
  * body is RightsPageDraftConflict. Omitted: a full write (put) is last-write-wins; a patch merges onto the draft
  * as it is when written, so a concurrent edit is not lost.
  */
-interface RightsPageWriteOptions {
+export interface RightsPageWriteOptions {
     baseUpdatedAt?: number | string | null;
 }
-interface RightsPageDraftConflict {
+export interface RightsPageDraftConflict {
     error: 'draft_conflict';
     draft: RightsPageDraft;
 }
 /** `draftUpdatedAt`: the draft's updatedAt after the call — pass it as the next `baseUpdatedAt`. */
-interface RightsPagePublishResult {
+export interface RightsPagePublishResult {
     cbid: string;
     version: number;
     publishedAt: number;
     draftUpdatedAt: number;
     rolledBackTo?: number;
 }
-interface RightsPageVersions {
+export interface RightsPageVersions {
     cbid: string;
     versions: Array<{
         version: number;
@@ -1708,7 +904,7 @@ interface RightsPageVersions {
     } & RightsPagePublisher>;
 }
 /** Options for POST /v1/sites/:cbid/preview-token. All optional. */
-interface PreviewTokenOptions {
+export interface PreviewTokenOptions {
     /** Lifetime in seconds, 1..3600. Default 900. */
     ttlSeconds?: number;
     /** The page to preview. Default: the site's registered domain. */
@@ -1719,7 +915,7 @@ interface PreviewTokenOptions {
     lang?: string;
 }
 /** A banner preview token, and the page URL that opens the preview. */
-interface PreviewToken {
+export interface PreviewToken {
     cbid: string;
     token: string;
     /** Epoch milliseconds. */
@@ -1730,9 +926,9 @@ interface PreviewToken {
     previewUrl?: string;
 }
 /** A right a rights link may file (the hosted rights page's request-type kinds). */
-type RightKind = 'access' | 'erasure' | 'rectification' | 'portability' | 'restriction' | 'objection' | 'opt_out_sale' | 'opt_out_targeted' | 'limit_sensitive';
+export type RightKind = 'access' | 'erasure' | 'rectification' | 'portability' | 'restriction' | 'objection' | 'opt_out_sale' | 'opt_out_targeted' | 'limit_sensitive';
 /** Input for POST /v1/sites/:cbid/rights-links. */
-interface RightsLinkInput {
+export interface RightsLinkInput {
     /** The signed-in person. `email` must be an address you have verified. */
     subject: {
         email: string;
@@ -1744,7 +940,7 @@ interface RightsLinkInput {
     ttlSeconds?: number;
 }
 /** A signed, single-use link to the hosted rights page for one signed-in person. */
-interface RightsLink {
+export interface RightsLink {
     /** `https://<customDomain>/?t=…`, or `https://cookiemunch.net/r/<cbid>?t=…` when `customDomain` is null. */
     url: string;
     /** Epoch milliseconds. */
@@ -1753,13 +949,13 @@ interface RightsLink {
     customDomain: string | null;
 }
 /** One DNS record to create, exactly as written. */
-interface DnsRecordInstruction {
+export interface DnsRecordInstruction {
     type: 'CNAME' | 'TXT';
     name: string;
     value: string;
 }
 /** A custom hostname serving a site's rights page. */
-interface RightsPageDomain {
+export interface RightsPageDomain {
     /** Lowercase ASCII form (punycode for an internationalised name). */
     hostname: string;
     /** As a person reads it. */
@@ -1790,14 +986,14 @@ interface RightsPageDomain {
     };
 }
 /** The site's custom hostnames, the plan allowance (null = unlimited) and the org's usage. */
-interface RightsPageDomainList {
+export interface RightsPageDomainList {
     domains: RightsPageDomain[];
     limit: number | null;
     used: number;
     target: string;
 }
 /** Options for the snippet endpoint. */
-interface SnippetOptions {
+export interface SnippetOptions {
     /** Override the site's configured `blocking.mode`. Default: the config's. */
     blockingMode?: 'auto' | 'manual';
     /** Language culture override, e.g. "en" or "fr". */
@@ -1809,13 +1005,13 @@ interface SnippetOptions {
  * packages/server/src/dev-api.ts (~L267) — note the server adds `method` on success,
  * so this wire shape is wider than domain-verify.ts's internal VerifyResult.
  */
-interface VerifyResult {
+export interface VerifyResult {
     verified: boolean;
     method?: 'dns' | 'meta' | 'file';
     reason?: string;
 }
 /** A site brand suggestion ("Match my site"). Keep in sync with packages/server/src/brand-extract.ts BrandSuggestion. */
-interface BrandSuggestion {
+export interface BrandSuggestion {
     background?: string;
     text?: string;
     highlight?: string;
@@ -1824,15 +1020,15 @@ interface BrandSuggestion {
     palette?: string[];
 }
 /** The response shape of POST /v1/sites/:cbid/brand. */
-interface BrandExtractionResult {
+export interface BrandExtractionResult {
     suggestion: BrandSuggestion;
 }
 /** PUT /v1/sites/{cbid}/brand: `{url}` alone (fetched once, https only), or a DTCG brand.json document. */
-type BrandImportInput = {
+export type BrandImportInput = {
     url: string;
 } | Record<string, unknown>;
 /** One brand.json role and what it became. */
-interface BrandMappingRow {
+export interface BrandMappingRow {
     role: string;
     /** The site-config path it sets, e.g. `banner.theme.highlight`. */
     target: string;
@@ -1846,7 +1042,7 @@ interface BrandMappingRow {
     variants?: string[];
 }
 /** The read-back of a brand.json import. Precedence: brand.json < site banner theme < per-banner variant. */
-interface BrandReadBack {
+export interface BrandReadBack {
     cbid: string;
     dryRun?: boolean;
     source: {
@@ -1873,13 +1069,13 @@ interface BrandReadBack {
     }>;
 }
 /** A validation/lint issue on a v2 banner flow. */
-interface FlowIssue {
+export interface FlowIssue {
     code: string;
     message: string;
     path?: string;
 }
 /** A site's v2 banner flow + lint issues, from GET /v1/sites/:cbid/flow. */
-interface SiteFlow {
+export interface SiteFlow {
     v: 2;
     flow: Record<string, unknown>;
     categories: Record<string, unknown>;
@@ -1890,14 +1086,14 @@ interface SiteFlow {
  * A single structured flow edit operation. `op` selects the kind; remaining fields are
  * that op's args (e.g. { op: 'addView', id, surface, layoutMode }).
  */
-type FlowOp = {
+export type FlowOp = {
     op: string;
 } & Record<string, unknown>;
 /**
  * Result of editFlow/setFlow. On success the new flow is persisted and returned;
  * on a validation/lint failure the config is NOT saved and `issues` says why.
  */
-type FlowOpResponse = {
+export type FlowOpResponse = {
     ok: true;
     flow: Record<string, unknown>; /** Consent-button parity of the saved design. */
     designWarnings?: ButtonParityFinding[];
@@ -1908,7 +1104,7 @@ type FlowOpResponse = {
     issues: FlowIssue[];
 };
 /** A reusable brand kit (colors/logo/typography) for banner theming. */
-interface BrandKit {
+export interface BrandKit {
     id: string;
     orgId: string;
     name: string;
@@ -1920,7 +1116,7 @@ interface BrandKit {
     customCss?: string;
 }
 /** A configurable consent preference/purpose item. */
-interface PreferenceItem {
+export interface PreferenceItem {
     id: string;
     orgId: string;
     cbid?: string;
@@ -1929,13 +1125,13 @@ interface PreferenceItem {
     category?: string;
 }
 /** An organization member. */
-interface Member {
+export interface Member {
     userId: string;
     email: string;
     role: 'owner' | 'admin' | 'member' | 'viewer' | (string & {});
 }
 /** Display metadata for an issued key — never the secret. Returned by keys.list(). */
-interface ApiKeyPrefix {
+export interface ApiKeyPrefix {
     prefix: string;
     createdAt?: number;
     /** Epoch ms the key stops working; null = never. */
@@ -1958,14 +1154,14 @@ interface ApiKeyPrefix {
     apiVersion?: string;
 }
 /** A live organisation's sandbox (GET /v1/sandbox). */
-interface SandboxOrg {
+export interface SandboxOrg {
     orgId: string;
     name: string;
     sandboxOf: string;
     createdAt: string;
 }
 /** POST /v1/sandbox: the sandbox and a test key for it, shown once. */
-interface SandboxCreated {
+export interface SandboxCreated {
     sandbox: SandboxOrg;
     created: boolean;
     key: string;
@@ -1973,7 +1169,7 @@ interface SandboxCreated {
     keyExpiresAt: string;
 }
 /** GET /v1/versions. */
-interface ApiVersions {
+export interface ApiVersions {
     latest: string;
     base: string;
     /** With a key: the version it is pinned to. */
@@ -1989,7 +1185,7 @@ interface ApiVersions {
     }>;
 }
 /** A revoked key in the report: when, by whom, why; never the secret. */
-interface ApiKeyRevoked {
+export interface ApiKeyRevoked {
     prefix: string;
     name: string | null;
     owner: string | null;
@@ -2005,7 +1201,7 @@ interface ApiKeyRevoked {
     leakSource: string | null;
 }
 /** GET /v1/keys/report — key hygiene. */
-interface ApiKeyReport {
+export interface ApiKeyReport {
     generatedAt: number;
     unusedDays: number;
     expiringDays: number;
@@ -2024,7 +1220,7 @@ interface ApiKeyReport {
     revoked?: ApiKeyRevoked[];
 }
 /** A newly issued key. `key` is returned ONCE and never again (or, with `secretRecipient`, sealed). */
-interface ApiKeyIssued {
+export interface ApiKeyIssued {
     key: string;
     prefix: string;
     expiresAt?: number | null;
@@ -2037,7 +1233,7 @@ interface ApiKeyIssued {
     sealed_field?: string;
 }
 /** @deprecated No endpoint returns this shape; use {@link ApiKeyPrefix} / {@link ApiKeyIssued}. */
-interface ApiKey {
+export interface ApiKey {
     id: string;
     orgId: string;
     prefix: string;
@@ -2050,7 +1246,7 @@ interface ApiKey {
  * Input for issuing a new API key (POST /v1/keys). Every field is honoured: `scopes`, `cbids`,
  * `expiresInDays` / `expiresAt`, `name`, `owner` and `strictUnknownFields`.
  */
-interface ApiKeyIssueInput {
+export interface ApiKeyIssueInput {
     /** `user:<id>`, `service:<name>` or `apikey:<prefix>`. Default: the calling key. */
     owner?: string;
     /** Writes with the new key refuse unknown body fields unless they send `Prefer: lenient-unknown-fields`. */
@@ -2069,7 +1265,7 @@ interface ApiKeyIssueInput {
     expiresAt?: number | string;
 }
 /** One entitlement (suite-standard shape). A feature is `{key, enabled}`; a limit is `limits.<name>`. */
-interface Entitlement {
+export interface Entitlement {
     key: string;
     enabled: boolean;
     /** Limits only. null = unlimited, 0 = not on this plan. */
@@ -2079,7 +1275,7 @@ interface Entitlement {
     source: 'plan';
 }
 /** GET /v1/entitlements: what the org may use, from its effective plan. */
-interface Entitlements {
+export interface Entitlements {
     orgId: string;
     plan: string;
     planSource: 'org' | 'account';
@@ -2088,13 +1284,13 @@ interface Entitlements {
     generatedAt: string;
 }
 /** Org usage/quota summary. Matches the server's Usage schema. */
-interface Usage {
+export interface Usage {
     domains: number;
     seats: number;
     monthlyEvents: number;
 }
 /** A webhook subscription. `secret` is present only in the create response. */
-interface WebhookSubscription {
+export interface WebhookSubscription {
     id: string;
     orgId: string;
     url: string;
@@ -2125,7 +1321,7 @@ interface WebhookSubscription {
     };
 }
 /** POST /v1/webhooks/{id}/replay. */
-interface WebhookReplayResult {
+export interface WebhookReplayResult {
     ok: boolean;
     replayed: number;
     failed: number;
@@ -2135,7 +1331,7 @@ interface WebhookReplayResult {
     error?: string;
 }
 /** The audit-log export (GET/PUT /v1/audit/sink). Never the secret. */
-interface AuditSink {
+export interface AuditSink {
     type: 'webhook';
     url: string;
     secretSet: true;
@@ -2145,14 +1341,14 @@ interface AuditSink {
     lastStatus: number | null;
     lastError: string | null;
 }
-interface AuditSinkInput {
+export interface AuditSinkInput {
     type: 'webhook';
     url: string;
     /** 16–256 characters; omitted: one is generated and returned once. */
     secret?: string;
 }
 /** GET /v1/sites/{cbid}/consent/insights. */
-interface ConsentInsights {
+export interface ConsentInsights {
     cbid: string;
     from: number;
     to: number;
@@ -2203,7 +1399,7 @@ interface ConsentInsights {
     };
 }
 /** One cookie read from another CMP's export. */
-interface ImportedCookie {
+export interface ImportedCookie {
     name: string;
     domain: string;
     /** Ours, or `unclassified` when their category did not map to one. */
@@ -2215,7 +1411,7 @@ interface ImportedCookie {
     expiry: string;
 }
 /** What a competitor's cookie-declaration export contained, in our vocabulary. */
-interface ImportedDeclaration {
+export interface ImportedDeclaration {
     source: 'onetrust' | 'cookiebot' | 'cookieyes' | 'unknown';
     cookies: ImportedCookie[];
     /** Rows whose category could not be placed — review these first. */
@@ -2228,7 +1424,7 @@ interface ImportedDeclaration {
  * A page that refused to load the banner renderer. The site is live and configured, so
  * every other signal looks healthy; this is the one that says nobody can be asked.
  */
-interface BlockedReport {
+export interface BlockedReport {
     cbid: string;
     /** Origin of the page the embed was running on. */
     page: string;
@@ -2241,7 +1437,7 @@ interface BlockedReport {
     count: number;
 }
 /** A webhook delivery that failed every retry. Replay it by `id`. */
-interface WebhookDeadLetter {
+export interface WebhookDeadLetter {
     id: string;
     orgId: string;
     subscriptionId: string;
@@ -2255,25 +1451,25 @@ interface WebhookDeadLetter {
     failedAt: number;
 }
 /** What a test delivery's endpoint answered. */
-interface WebhookTestResult {
+export interface WebhookTestResult {
     ok: boolean;
     status?: number;
     error?: string;
 }
 /** The key's organisation. */
-interface Org {
+export interface Org {
     id: string;
     name: string;
     plan: string;
     logoUrl: string | null;
 }
-type MailProviderKind = 'brevo' | 'sendgrid' | 'postmark' | 'resend' | 'ses' | 'smtp';
+export type MailProviderKind = 'brevo' | 'sendgrid' | 'postmark' | 'resend' | 'ses' | 'smtp';
 /**
  * The org's own mail provider for rights-request mail. The credential is never returned —
  * `secretLast4` only. `sender` says whether verification codes go through it right now
  * (`own`) or are not mailed at all (`none`): there is no shared sender for rights mail.
  */
-interface MailProvider {
+export interface MailProvider {
     configured: boolean;
     sender: 'own' | 'none';
     provider?: MailProviderKind;
@@ -2303,7 +1499,7 @@ interface MailProvider {
     note?: string;
 }
 /** Save a provider. `secret` is write-only; omit it to keep the stored one (same provider only). */
-interface MailProviderInput {
+export interface MailProviderInput {
     provider: MailProviderKind;
     fromEmail: string;
     fromName?: string | null;
@@ -2320,13 +1516,13 @@ interface MailProviderInput {
         username: string;
     };
 }
-type RightsCaptchaProvider = 'turnstile' | 'hcaptcha' | 'recaptcha_v2' | 'recaptcha_v3';
+export type RightsCaptchaProvider = 'turnstile' | 'hcaptcha' | 'recaptcha_v2' | 'recaptcha_v3';
 /**
  * The rights page's captcha in force: your own keys (`own`, recommended) or none (`off`, the default).
  * Cookie Munch's own captcha is never used on rights pages. The secret is never returned.
  */
 /** Whether hosted consent sync is set up for a site. The secret itself is never read back. */
-interface ConsentSyncSecret {
+export interface ConsentSyncSecret {
     cbid: string;
     configured: boolean;
     secretLast4: string | null;
@@ -2337,7 +1533,7 @@ interface ConsentSyncSecret {
  * Who a preference-centre token is for: a site of your organisation and exactly one of `email`
  * (resolved as the emailed preference link resolves it) or `subjectId`.
  */
-type CenterTokenInput = {
+export type CenterTokenInput = {
     cbid: string;
     ttlSeconds?: number;
 } & ({
@@ -2348,16 +1544,16 @@ type CenterTokenInput = {
     email?: never;
 });
 /** A preference-centre token. A credential: hand it to `CookieMunch.setSubjectToken`, never put it in a shared URL or a log. */
-interface CenterToken {
+export interface CenterToken {
     token: string;
     /** ISO 8601. */
     expiresAt: string;
 }
 /** A freshly minted or rotated consent-sync secret: `secret` is shown this once. */
-interface ConsentSyncSecretMinted extends ConsentSyncSecret {
+export interface ConsentSyncSecretMinted extends ConsentSyncSecret {
     secret: string;
 }
-interface RightsCaptcha {
+export interface RightsCaptcha {
     /** `site`: the site's own setting; `org`: the organisation default; `default`: neither (off). */
     source: 'site' | 'org' | 'default';
     mode: 'own' | 'off';
@@ -2378,7 +1574,7 @@ interface RightsCaptcha {
  * anything is saved (422 captcha_secret_invalid / 502 captcha_unreachable). `off` removes spam protection beyond
  * the hidden spam-trap field, the rate limits and the email code.
  */
-interface RightsCaptchaInput {
+export interface RightsCaptchaInput {
     mode: 'own' | 'off';
     provider?: RightsCaptchaProvider;
     siteKey?: string;
@@ -2387,12 +1583,12 @@ interface RightsCaptchaInput {
     /** reCAPTCHA v3 only: 0.1–0.9, default 0.5. */
     minScore?: number;
 }
-type RightsIdentityType = 'clerk' | 'atlas' | 'oidc_jwt';
+export type RightsIdentityType = 'clerk' | 'atlas' | 'oidc_jwt';
 /**
  * The sign-in provider rights requests are verified with: a visitor signed in to your site is
  * verified by their session, with no code mail. Nothing here is secret.
  */
-interface RightsIdentity {
+export interface RightsIdentity {
     /** `site`: the site's own setting; `org`: the organisation default; `default`: neither (none). */
     source: 'site' | 'org' | 'default';
     configured: boolean;
@@ -2417,7 +1613,7 @@ interface RightsIdentity {
  * never an IP address. The token must carry the email and a verified-email claim set to `true`
  * (clerk/atlas with `trustEmailClaim`: the verified claim may be absent).
  */
-interface RightsIdentityInput {
+export interface RightsIdentityInput {
     type: RightsIdentityType;
     /** Exactly the token's `iss` (Clerk: your Frontend API URL). */
     issuer: string;
@@ -2438,7 +1634,7 @@ interface RightsIdentityInput {
     trustEmailClaim?: boolean;
 }
 /** The organisation's own data-controller identity (GET /v1/org/controller). */
-interface OrgControllerIdentity {
+export interface OrgControllerIdentity {
     /** False when none is set; then only `updatedAt` (null) is present. */
     set: boolean;
     legalName?: string;
@@ -2449,25 +1645,25 @@ interface OrgControllerIdentity {
     updatedAt: number | null;
 }
 /** Replaces the identity: a field left out is removed. `legalName` is required. */
-interface OrgControllerInput {
+export interface OrgControllerInput {
     legalName: string;
     contactEmail?: string;
     address?: string;
     dpoContact?: string;
 }
-interface MailProviderTestResult {
+export interface MailProviderTestResult {
     ok: boolean;
     sentTo: string;
     error?: string;
     mailProvider: MailProvider;
 }
 /** Change an org's name or logo. `logoUrl: null` removes the logo. */
-interface OrgUpdate {
+export interface OrgUpdate {
     name?: string;
     logoUrl?: string | null;
 }
 /** One entry in the org's audit log. */
-interface AuditEntry {
+export interface AuditEntry {
     id: string;
     orgId: string;
     actorUserId: string;
@@ -2478,7 +1674,7 @@ interface AuditEntry {
     at: number;
 }
 /** Rename a key, or replace its scopes or the properties it is locked to. */
-interface ApiKeyUpdate {
+export interface ApiKeyUpdate {
     owner?: string;
     strictUnknownFields?: boolean;
     name?: string;
@@ -2488,12 +1684,12 @@ interface ApiKeyUpdate {
     expiresAt?: number | string | null;
 }
 /** An image to upload: base64 (or a `data:` URL) plus its type. */
-interface AssetUpload {
+export interface AssetUpload {
     data: string;
     contentType: 'image/png' | 'image/jpeg' | 'image/webp' | 'image/gif' | 'image/svg+xml';
 }
 /** Result of erasing a subject's consent for a deletion request. */
-interface DsarEraseResult {
+export interface DsarEraseResult {
     erased: number;
     encryptionEnabled: boolean;
     /** Present when no KEK is configured, so nothing was cryptographically erased. */
@@ -2501,19 +1697,19 @@ interface DsarEraseResult {
     request: DsarRequest;
 }
 /** Result of exporting a subject's consent for an access or portability request. */
-interface DsarExportResult {
+export interface DsarExportResult {
     records: unknown[];
     count: number;
     request: DsarRequest;
 }
 /** Input for creating a webhook subscription. */
-interface WebhookCreate {
+export interface WebhookCreate {
     url: string;
     events: string[];
     cbid?: string;
 }
 /** Fields to change on a webhook subscription. Only those present are sent. */
-interface WebhookUpdate {
+export interface WebhookUpdate {
     url?: string;
     events?: string[];
     /** One property, or null for every property in the org. */
@@ -2524,20 +1720,20 @@ interface WebhookUpdate {
     alertContacts?: string[] | null;
 }
 /** One site to create in a bulk call. */
-interface BulkSiteInput {
+export interface BulkSiteInput {
     domain: string;
     cbid?: string;
     platform?: string;
 }
 /** Per-item outcome of a bulk create, in input order. */
-interface BulkSiteResult {
+export interface BulkSiteResult {
     ok: boolean;
     cbid?: string;
     domain?: string;
     error?: string;
 }
 /** Input for creating a brand kit. */
-interface BrandKitCreate {
+export interface BrandKitCreate {
     name: string;
     theme: unknown;
     content?: unknown;
@@ -2545,7 +1741,7 @@ interface BrandKitCreate {
     customCss?: string;
 }
 /** A lightweight summary of an account-level banner, as returned by GET /v1/banners. */
-interface BannerSummary {
+export interface BannerSummary {
     id: string;
     name: string;
     updatedAt: number;
@@ -2554,7 +1750,7 @@ interface BannerSummary {
     designWarningCount: number;
 }
 /** A full account-level banner record, including its config JSON. */
-interface BannerRecord {
+export interface BannerRecord {
     id: string;
     orgId: string;
     name: string;
@@ -2570,7 +1766,7 @@ interface BannerRecord {
  * server's ConsentPayload; optional fields are sent only when set. Records are
  * anonymised (IP truncated) and hash-chained server-side.
  */
-interface ConsentIngestInput {
+export interface ConsentIngestInput {
     /** The registered site id the consent belongs to. */
     cbid: string;
     /** Stable per-subject consent-receipt id (used for erase/export). */
@@ -2609,11 +1805,11 @@ interface ConsentIngestInput {
     subjectId?: string;
 }
 /** One of a person's identifiers: an identity-space code plus the normalised value. */
-interface Identifier {
+export interface Identifier {
     space: string;
     value: string;
 }
-interface ConsentDecisionInput {
+export interface ConsentDecisionInput {
     purpose: string;
     allowed: boolean;
     legalBasis?: string;
@@ -2621,19 +1817,19 @@ interface ConsentDecisionInput {
     provenance?: string;
     collectedAt?: number;
 }
-interface ProfileAttributeInput {
+export interface ProfileAttributeInput {
     value: string;
     purpose?: string;
     collectedAt?: number;
 }
-interface SubscriptionTopicInput {
+export interface SubscriptionTopicInput {
     code: string;
     name?: string;
     channels: string[];
     downstream?: Record<string, string>;
 }
 /** A warehouse-native enforcement rule. See POST /v1/discovery/enforcement. */
-interface EnforcementRuleInput {
+export interface EnforcementRuleInput {
     id: string;
     action: 'mask' | 'restrict';
     /** Select columns at or above this sensitivity. */
@@ -2647,7 +1843,7 @@ interface EnforcementRuleInput {
     /** restrict: the column holding the subject id. Default SUBJECT_ID. */
     subjectColumn?: string;
 }
-interface RegulationSummary {
+export interface RegulationSummary {
     id: string;
     jurisdiction: string;
     name: string;
@@ -2658,7 +1854,7 @@ interface RegulationSummary {
     /** Primary source — the statute or the regulator. */
     source: string;
 }
-interface RegulatoryFeedResult {
+export interface RegulatoryFeedResult {
     /** When a human last checked the dataset against its sources. */
     reviewedAt: string;
     /** Days since that review. */
@@ -2669,7 +1865,45 @@ interface RegulatoryFeedResult {
     stale: boolean;
     regulations: RegulationSummary[];
 }
-interface AiInspectInput {
+/** A law taking effect soon where a site's visitors are. */
+export interface SiteUpcomingRegulation {
+    id: string;
+    name: string;
+    jurisdiction: string;
+    effective: string;
+    /** Whole days from today; 0 = takes effect today. */
+    daysUntil: number;
+    /** Share (0–1) of the site's decisions in the window from where this law applies. */
+    trafficShare: number;
+    obligations: string[];
+    /** For a US state law: what changes for the banner. */
+    changes?: {
+        universalOptOut: boolean;
+        universalOptOutFrom?: string;
+        sensitiveOptIn: boolean;
+        minorOptInUnder: number;
+        minorsAds: 'opt-in' | 'prohibited';
+    };
+    source: string;
+}
+/** `GET /v1/sites/{cbid}/regulatory/upcoming`. */
+export interface SiteUpcomingRegulations {
+    reviewedAt: string;
+    ageDays: number;
+    reviewAfterDays: number;
+    stale: boolean;
+    days: number;
+    minShare: number;
+    /** The traffic window, epoch ms: the last 30 days. */
+    window: {
+        from: number;
+        to: number;
+    };
+    /** Decisions recorded in the window. */
+    decisions: number;
+    upcoming: SiteUpcomingRegulation[];
+}
+export interface AiInspectInput {
     prompt: string;
     purpose: string;
     model?: string;
@@ -2678,7 +1912,7 @@ interface AiInspectInput {
     /** The subject's current permits, when the call concerns an identified person. */
     consent?: Record<string, boolean>;
 }
-interface AiInspectResult {
+export interface AiInspectResult {
     action: 'allow' | 'redact' | 'block';
     /** The text to forward: redacted when `redact`, empty when `block`. */
     prompt: string;
@@ -2688,9 +1922,9 @@ interface AiInspectResult {
     blocked: boolean;
     direction: 'prompt' | 'response';
 }
-type FulfillmentOp = 'locate' | 'export' | 'erase' | 'optOut';
+export type FulfillmentOp = 'locate' | 'export' | 'erase' | 'optOut';
 /** A child org provisioned by a reseller. */
-interface ResellerChild {
+export interface ResellerChild {
     id: string;
     name: string;
     status: 'active' | 'suspended';
@@ -2700,7 +1934,7 @@ interface ResellerChild {
     createdAt?: number;
     usage?: unknown;
 }
-interface ResellerChildList {
+export interface ResellerChildList {
     children: ResellerChild[];
     /** Pooled usage across the reseller and all its children, when metering is wired. */
     aggregate?: {
@@ -2711,7 +1945,7 @@ interface ResellerChildList {
         overCap: boolean;
     };
 }
-interface ResellerChildCreate {
+export interface ResellerChildCreate {
     name: string;
     ownerEmail?: string;
     /** legalName, contactEmail, address, dpoContact. */
@@ -2724,20 +1958,20 @@ interface ResellerChildCreate {
     /** Scopes for that key. Defaults to ["sites:read"]. */
     keyScopes?: string[];
 }
-interface ResellerChildPatch {
+export interface ResellerChildPatch {
     status?: 'active' | 'suspended';
     delegatedAccess?: boolean;
     /** Pin this child's DSAR routing; null clears the override. */
     dsarRouting?: 'reseller' | 'child' | null;
     controller?: Record<string, unknown>;
 }
-interface ChildKeyInput {
+export interface ChildKeyInput {
     name?: string;
     scopes?: string[];
     /** Lock the key to these properties of the child org. */
     cbids?: string[];
 }
-interface PolicyOptions {
+export interface PolicyOptions {
     /** Contact email shown in the policy. Falls back to the org controller's, then the owner's. */
     contactEmail?: string;
     /** YYYY-MM-DD. Defaults to today. */
@@ -2745,13 +1979,13 @@ interface PolicyOptions {
     /** Override the jurisdictions the policy addresses. */
     jurisdictions?: string[];
 }
-interface AdPersonalizationInput {
+export interface AdPersonalizationInput {
     enabled: boolean;
     /** Whether personalised ads start on before the visitor chooses. */
     default?: boolean;
     label?: string;
 }
-interface SessionAnalysisInput {
+export interface SessionAnalysisInput {
     /** A HAR export of the captured session. */
     har?: unknown;
     /** Or the requests directly. */
@@ -2767,7 +2001,7 @@ interface SessionAnalysisInput {
  * rather than a release. Paths are relative to `baseUrl`; placeholders are `{email}`,
  * `{subject}`, `{operation}`, `{correlation}` and `{id}`.
  */
-interface ExecutorProfile {
+export interface ExecutorProfile {
     /** How requests carry the credential. Defaults to `Authorization: Bearer {secret}`. */
     auth?: {
         header: string;
@@ -2859,7 +2093,7 @@ interface ExecutorProfile {
     };
 }
 /** A system connected to run part of a rights request. Credentials are never included. */
-interface DsarExecutor {
+export interface DsarExecutor {
     id: string;
     /** The name it answers to in a fulfillment plan, e.g. `identity` or `crm`. */
     system: string;
@@ -2910,7 +2144,7 @@ interface DsarExecutor {
     completionSecret?: string;
 }
 /** POST …/completion-secret/roll. */
-interface CompletionSecretRolled {
+export interface CompletionSecretRolled {
     id: string;
     completionSecret: string;
     completionSecretPrefix: string;
@@ -2918,13 +2152,13 @@ interface CompletionSecretRolled {
     completionsUrl?: string;
 }
 /** POST …/test {conformance: true}: the conformance kit's report. */
-interface ExecutorConformanceResult extends ConformanceReport {
+export interface ExecutorConformanceResult extends ConformanceReport {
     conformance: true;
     canary: true;
     email: string;
 }
 /** A connection's last health check. */
-interface ExecutorHealth {
+export interface ExecutorHealth {
     lastCheckedAt: number;
     ok: boolean;
     verdict: string;
@@ -2937,16 +2171,24 @@ interface ExecutorHealth {
     hint?: string;
 }
 /** A preset's name, as `executorPresets()` lists them. Not enumerated here: presets are data. */
-type ExecutorPresetName = string;
+export type ExecutorPresetName = string;
 /**
  * Connect a system from a versioned preset instead of a hand-written profile. Each preset
  * lists the params it takes (`executorPresets()`); a preset waiting on another platform is
  * refused with `preset_waiting_on_platform`.
  */
-interface DsarExecutorPresetInput {
+export interface DsarExecutorPresetInput {
     preset: ExecutorPresetName;
     presetVersion?: number;
-    secretKey: string;
+    /** The connection's key. Send this or `mintFrom`. */
+    secretKey?: string;
+    /**
+     * A partner id (it registered an `executorKeyUrl`: chatly, forumulate, referalli, …) that mints the key for
+     * the site under its partner link, in place of `secretKey`. The connection is scoped to that site.
+     */
+    mintFrom?: string;
+    /** With `mintFrom`: the partner account the key is minted for. Default: the one the site's live link for that partner names. */
+    externalId?: string;
     system?: string;
     baseUrl?: string;
     orgId?: string;
@@ -2962,7 +2204,7 @@ interface DsarExecutorPresetInput {
     orchestrator?: 1 | 2;
 }
 /** What `upgradeExecutorPreset` takes: a version, a preset to adopt, or params to add. */
-interface ExecutorPresetUpgrade {
+export interface ExecutorPresetUpgrade {
     preset?: ExecutorPresetName;
     presetVersion?: number;
     orgId?: string;
@@ -2972,7 +2214,7 @@ interface ExecutorPresetUpgrade {
     acceptPreset?: string | string[];
 }
 /** One step a preset builds, and whether it can run now (CMU-B01). */
-interface ExecutorPresetStep {
+export interface ExecutorPresetStep {
     name: 'subjectLookup' | 'open' | 'poll' | 'webhook' | 'grantRevoke';
     available: boolean;
     /** Never fails a connection: a credential without the scope reports `skipped: insufficient_scope`. */
@@ -2988,7 +2230,7 @@ interface ExecutorPresetStep {
     };
 }
 /** The presets, which are usable now, and this org's canary address. */
-interface ExecutorPresets {
+export interface ExecutorPresets {
     canaryEmail: string;
     presets: Array<{
         name: ExecutorPresetName;
@@ -3011,7 +2253,7 @@ interface ExecutorPresets {
     }>;
 }
 /** What a connection write would do (`?dryRun=1`). Nothing was stored. */
-interface DsarExecutorDryRun {
+export interface DsarExecutorDryRun {
     dryRun: true;
     /** The connection as it would be, credentials excluded. A create has no `id` or `webhookUrl` yet. */
     executor: Partial<DsarExecutor> & Record<string, unknown>;
@@ -3021,13 +2263,20 @@ interface DsarExecutorDryRun {
         field: string;
         reason: string;
     }>;
+    /** With `mintFrom`: who would mint the key, for which account and site. Nothing is minted. */
+    mint?: {
+        partner: string;
+        externalId: string | null;
+        cbid: string;
+        detail: string;
+    };
 }
 /** Where a webhook check stopped. */
-type WebhookStage = 'configuration' | 'headers' | 'timestamp' | 'prefix' | 'signature';
+export type WebhookStage = 'configuration' | 'headers' | 'timestamp' | 'prefix' | 'signature';
 /** Which key a verified delivery matched: a `whsec_` secret's base64-decoded remainder, or the secret as typed. */
-type WebhookKeyForm = 'decoded' | 'raw';
+export type WebhookKeyForm = 'decoded' | 'raw';
 /** Whether a supplied delivery verified (`stage` and `reason` are null when it did). */
-interface ExecutorWebhookTestResult {
+export interface ExecutorWebhookTestResult {
     verified: boolean;
     stage: WebhookStage | null;
     reason: string | null;
@@ -3035,7 +2284,7 @@ interface ExecutorWebhookTestResult {
     keyForm: WebhookKeyForm | null;
 }
 /** One delivery to a connection's webhook. Never the secret, the signature or the body. */
-interface ExecutorWebhookDelivery {
+export interface ExecutorWebhookDelivery {
     id: string;
     executorId: string;
     at: number;
@@ -3050,7 +2299,7 @@ interface ExecutorWebhookDelivery {
     /** Which key form matched; null when refused (or logged before this was kept). Never the key. */
     keyForm: WebhookKeyForm | null;
 }
-interface DsarExecutorInput {
+export interface DsarExecutorInput {
     /** The name this connection answers to in a plan, e.g. `identity` or `crm`. */
     system: string;
     /** The system's public https origin. */
@@ -3072,9 +2321,9 @@ interface DsarExecutorInput {
     /** Default 2. */
     orchestrator?: 1 | 2;
 }
-type DsarExecutorCreated = DsarExecutor;
+export type DsarExecutorCreated = DsarExecutor;
 /** The fields `updateExecutor` may change. */
-interface DsarExecutorPatch {
+export interface DsarExecutorPatch {
     profile?: unknown;
     baseUrl?: string;
     secretKey?: string;
@@ -3090,7 +2339,7 @@ interface DsarExecutorPatch {
     orchestrator?: 1 | 2;
 }
 /** One entry in a fulfilment task's status history. */
-interface DsarTaskEvent {
+export interface DsarTaskEvent {
     at: number;
     kind: 'created' | 'changed' | 'version_changed';
     status: 'pending' | 'running' | 'done' | 'failed' | 'cancelled';
@@ -3100,9 +2349,9 @@ interface DsarTaskEvent {
     externalRef?: string;
 }
 /** What a task's answer means for the person. `exported` only once the export was fetched. */
-type DsarTaskOutcome = 'located' | 'exported' | 'erased' | 'no_record' | 'done_without_artifact' | 'not_applicable' | 'already_erased' | 'external_identity';
+export type DsarTaskOutcome = 'located' | 'exported' | 'erased' | 'no_record' | 'done_without_artifact' | 'not_applicable' | 'already_erased' | 'external_identity';
 /** One request made to a connected system on a task's behalf, credentials removed. Kept 30 days. */
-interface DsarTaskLogEntry {
+export interface DsarTaskLogEntry {
     id?: string;
     system?: string;
     step: 'lookup' | 'open' | 'poll' | 'export' | 'grant';
@@ -3127,7 +2376,7 @@ interface DsarTaskLogEntry {
     at: number;
 }
 /** One fulfilment task with its history and its upstream request log. */
-interface DsarTask {
+export interface DsarTask {
     id: string;
     requestId: string;
     system: string;
@@ -3154,7 +2403,7 @@ interface DsarTask {
     versionChanged: boolean;
 }
 /** What testing a connection found. Nothing was filed. */
-interface ExecutorTestResult {
+export interface ExecutorTestResult {
     system: string;
     /** Did the lookup find the person; null when there is no lookup step or it failed. */
     matched: boolean | null;
@@ -3184,7 +2433,7 @@ interface ExecutorTestResult {
     /** Every upstream answer, as the system gave it (credentials removed). */
     exchanges: DsarTaskLogEntry[];
 }
-interface ExecutorTestInput {
+export interface ExecutorTestInput {
     /** The address to look up. Required unless `canary` is true. */
     email?: string;
     /** Use this org's canary address — no real person. A canary `locate` also updates `health`. */
@@ -3194,14 +2443,14 @@ interface ExecutorTestInput {
     /** For `export` only: open a real export and poll it once. An erasure is never sent. */
     open?: boolean;
 }
-interface DsarTaskExport {
+export interface DsarTaskExport {
     system: string;
     ref: string;
     /** The bundle as that system returned it. Not stored here. */
     bundle: unknown;
 }
 /** A language the banner already has copy for. */
-interface SupportedLanguage {
+export interface SupportedLanguage {
     /** BCP-47 tag, lowercase. Matched exactly, then by language prefix. */
     code: string;
     /** English name. */
@@ -3213,7 +2462,7 @@ interface SupportedLanguage {
     /** `bundled` ships in consent.js; `extended` ships in the renderer, fetched when a banner is first drawn. */
     source: 'bundled' | 'extended';
 }
-interface CookieMunchClient {
+export interface CookieMunchClient {
     me(): Promise<Identity>;
     /**
      * Languages the banner already speaks. Diff this against the locales your visitors
@@ -3245,13 +2494,13 @@ interface CookieMunchClient {
             apiKey?: string;
             keyError?: string;
         }>;
-        /** Hard-delete a SANDBOX organisation of this account (created with metadata.forgedeck_sandbox). Anything else: 403 not_a_sandbox. */
+        /** Hard-delete a SANDBOX organisation of this account (created with metadata.stack_sandbox). Anything else: 403 not_a_sandbox. */
         deleteSandbox(id: string): Promise<SandboxPurge>;
     };
     /** Tags on any created resource (CMU-X29). */
     metadata: {
         get(type: TaggedType, id: string): Promise<ResourceTags>;
-        /** Merge tags (null removes one). `forgedeck_sandbox` cannot be set here. `{ dryRun: true }` answers with the diff. */
+        /** Merge tags (null removes one). `stack_sandbox` cannot be set here. `{ dryRun: true }` answers with the diff. */
         update(type: TaggedType, id: string, metadata: Record<string, string | number | boolean | null>, opts?: {
             dryRun?: boolean;
         }): Promise<ResourceTagsUpdate>;
@@ -3262,7 +2511,7 @@ interface CookieMunchClient {
         create(input: StandardPartnerLinkCreate): Promise<StandardPartnerLink>;
         revoke(id: string): Promise<StandardPartnerLink>;
     };
-    /** What `forgedeck env` writes for a product provisioned with this forgedeck ref: names, values, secret references. */
+    /** What `env` writes for a product provisioned with this stack ref: names, values, secret references. */
     provisionEnv(ref: string): Promise<ProvisionEnv>;
     sites: {
         list(opts?: MetadataFilter): Promise<Site[]>;
@@ -3599,11 +2848,11 @@ interface CookieMunchClient {
             request: DsarRequest;
             changed: boolean;
         }>;
-        /** Requests carrying one X-ForgeDeck-Trace (`GET /v1/dsar?trace=`). */
+        /** Requests carrying one X-Trace-Id (`GET /v1/dsar?trace=`). */
         listByTrace(trace: string): Promise<DsarRequest[]>;
         /**
          * Open a case fanned out to every connected system (POST /v1/dsar/requests). `opts.idempotencyKey`
-         * (16–128 chars) makes a retry answer the same case; `opts.trace` passes your X-ForgeDeck-Trace on.
+         * (16–128 chars) makes a retry answer the same case; `opts.trace` passes your X-Trace-Id on.
          */
         openCase(input: DsarCaseCreate, opts?: {
             idempotencyKey?: string;
@@ -3802,6 +3051,14 @@ interface CookieMunchClient {
         feed(jurisdictions?: string[]): Promise<RegulatoryFeedResult>;
         /** What takes effect within `days` (default 180), soonest first. */
         upcoming(days?: number): Promise<RegulatoryFeedResult>;
+        /**
+         * `GET /v1/sites/{cbid}/regulatory/upcoming`: what takes effect within `days` (default 90)
+         * where at least `minShare` (default 0.01) of this site's last 30 days of decisions came from.
+         */
+        upcomingForSite(cbid: string, opts?: {
+            days?: number;
+            minShare?: number;
+        }): Promise<SiteUpcomingRegulations>;
     };
     /** AI governance: policy, the inline gateway, inventory and lineage. */
     ai: {
@@ -4040,7 +3297,7 @@ interface CookieMunchClient {
         }): Promise<void>;
     };
     /**
-     * The site's embed manifest: the tenant variant of `/.well-known/forgedeck-embed.json` — every
+     * The site's embed manifest: the tenant variant of `/.well-known/cookiemunch-embed.json` — every
      * origin by CSP directive and every browser key the embed writes for this site's config. Public.
      */
     embedManifest(cbid: string): Promise<EmbedManifest>;
@@ -4219,7 +3476,7 @@ interface CookieMunchClient {
             graceDays: number;
         }): Promise<DsarSettings>;
     };
-    /** Cards for support, CRM and helpdesk sidebars. Requires dsar:read. */
+    /** Cards for support, CRM and helpdesk sidebars (dsar:read), and one-call identity-provider connect (dsar:write). */
     integrations: {
         /** Open rights requests for one person, by identity (preferred) or email. */
         subjectCard(app: string, person: {
@@ -4228,6 +3485,14 @@ interface CookieMunchClient {
         } | {
             email: string;
         }): Promise<SubjectCard>;
+        /**
+         * Connect an identity provider's privacy orchestrator (`atlas`, or any provider with `connector`): mints a
+         * dsar:write key locked to `cbid` and hands it to the provider, authorised with `providerKey`. The minted key
+         * is never returned (only its prefix). `{ dryRun: true }` mints and sends nothing.
+         */
+        connect(provider: string, input: IntegrationConnect, opts?: {
+            dryRun?: boolean;
+        }): Promise<IntegrationConnectResult>;
     };
     /** One person's consent across every site in the org, by the subjectId your apps attach. */
     subjects: {
@@ -4262,6 +3527,4 @@ interface CookieMunchClient {
         }>;
     };
 }
-declare function createCookieMunch(opts: CookieMunchOptions): CookieMunchClient;
-
-export { type AbResult, type AccountOrg, type AccountOrgs, type AdPersonalizationInput, type AiInspectInput, type AiInspectResult, type ApiKey, type ApiKeyIssueInput, type ApiKeyIssued, type ApiKeyPrefix, type ApiKeyReport, type ApiKeyRevoked, type ApiKeyUpdate, type ApiKeyVended, type ApiVersions, type AppliedImport, type AssetUpload, type AuditEntry, type AuditSink, type AuditSinkInput, type BannerRecord, type BannerSummary, type BlockedReport, type BrandExtractionResult, type BrandImportInput, type BrandKit, type BrandKitCreate, type BrandMappingRow, type BrandReadBack, type BrandSuggestion, type BulkSiteInput, type BulkSiteResult, type ButtonParityFinding, type ButtonParityLint, type ButtonParityScan, CANARY_ISSUER, CONFORMANCE_RULES, type CategorizedCookie, type CategoryRegistry, type CenterToken, type CenterTokenInput, type ChildKeyInput, type CompletionSecretRolled, type ConfigChange, type ConfigDryRun, type ConfigWarning, type ConformanceOptions, type ConformanceReport, type ConformanceRuleResult, type ConformanceStatus, type ConsentDay, type ConsentDecisionInput, type ConsentIngestInput, type ConsentInsights, type ConsentLogRow, type ConsentSyncSecret, type ConsentSyncSecretMinted, type CookieDeclaration, CookieMunchApiError, type CookieMunchClient, type CookieMunchOptions, type CookiePreset, type CookiePresetManifest, type CookiePresetParams, type CookiePresetResult, type CookiePresetVendor, type CookieSuggestion, type CookieSuggestions, type CookieSuggestionsDeclared, type CspSources, type CustomPresetInput, type DeclarationDiff, type DeclarationDryRun, type DeclarationWarning, type DeclaredCookie, type DeclaredCookieInput, type DnsRecordInstruction, type DsarCase, type DsarCaseCreate, type DsarCaseReceipt, type DsarCaseStatus, type DsarCaseTask, type DsarCreate, type DsarEraseResult, type DsarExecutor, type DsarExecutorCreated, type DsarExecutorDryRun, type DsarExecutorInput, type DsarExecutorPatch, type DsarExecutorPresetInput, type DsarExportResult, type DsarRequest, type DsarSettings, type DsarStatus, type DsarSubject, type DsarTask, type DsarTaskEvent, type DsarTaskExport, type DsarTaskLogEntry, type DsarTaskOutcome, type DsarType, type DsarTypeWord, type EmbedManifest, type EmbedManifestStorage, type EmbedManifestSurface, type EnforcementRuleInput, type Entitlement, type Entitlements, type ExecutorConformanceResult, type ExecutorHealth, type ExecutorPresetName, type ExecutorPresetStep, type ExecutorPresetUpgrade, type ExecutorPresets, type ExecutorProfile, type ExecutorTestInput, type ExecutorTestResult, type ExecutorWebhookDelivery, type ExecutorWebhookTestResult, type FdCause, type FdConsent, type FdConsentQueue, type FdQueuedCall, type FdRequestOptions, type FdSnapshot, type FlowIssue, type FlowOp, type FlowOpResponse, type FulfillmentOp, type HealthRow, type HealthWaiver, type HealthWaiverInput, type Identifier, type Identity, type ImportedCookie, type ImportedDeclaration, type InstallSnippet, type IntegrationHealthReport, type LeakReport, type LegalBasis, type LogQuery, type MailProvider, type MailProviderInput, type MailProviderKind, type MailProviderTestResult, type Member, type MetadataFilter, type MintConsentSyncTokenInput, type ObservedPurgeResult, type OperatorTokenExchangeInput, type OperatorTokenExchangeResult, type OptInMethod, type Org, type OrgControllerIdentity, type OrgControllerInput, type OrgUpdate, type ParityControlSummary, type PartnerCatalogEntry, type PartnerId, type PartnerLink, type PartnerLinkCreate, type PlanSource, type PolicyOptions, type PreferenceItem, type PreferenceRecord, type PreviewToken, type PreviewTokenOptions, type ProfileAttributeInput, type ProvisionEnv, type ProvisionRequest, type ProvisionRequestV2, type ProvisionResult, type ProvisionStep, type PublicDsarFiled, type PublicDsarPending, type PublicVerification, type PutConfigOptions, type RangeQuery, type Regulation, type RegulationSummary, type RegulatoryFeedResult, type ResellerChild, type ResellerChildCreate, type ResellerChildList, type ResellerChildPatch, type ResourceMetadata, type ResourceTags, type ResourceTagsInput, type ResourceTagsUpdate, type RetentionLine, type RetiredCookie, type RightKind, type RightsCaptcha, type RightsCaptchaInput, type RightsCaptchaProvider, type RightsIdentity, type RightsIdentityInput, type RightsIdentityType, type RightsLink, type RightsLinkInput, type RightsPageDocument, type RightsPageDomain, type RightsPageDomainList, type RightsPageDraft, type RightsPageDraftConflict, type RightsPageDryRun, type RightsPageIssue, type RightsPagePublishResult, type RightsPagePublished, type RightsPagePublisher, type RightsPageVersions, type RightsPageWriteOptions, type RiskScore, type RopaEntry, type RopaInput, SDK_VERSION, type SandboxCreated, type SandboxOrg, type SandboxPurge, type ScanResult, type ScanStatus, type ScoredVendor, type ScrollbarTheme, type SessionAnalysisInput, type SignedReceipt, type Site, type SiteConfig, type SiteCookie, type SiteCreate, type SiteFlow, type SiteUpdate, type SiteUpdateResult, type SnippetOptions, type StandardKeyList, type StandardPartnerLink, type StandardPartnerLinkCreate, type StorageType, type SubjectCard, type SubjectIdentity, type SubscriptionTopicInput, type SuggestedRejectStyle, type SupportedLanguage, type TaggedType, TokenExchangeError, type Usage, type VendorInput, type VendorRecord, type VerifyResult, type VerifyWebhookInput, type WebhookCreate, type WebhookDeadLetter, type WebhookKeyForm, type WebhookReplayResult, type WebhookStage, type WebhookSubscription, type WebhookTestResult, type WebhookUpdate, canaryIdentityFor, createCookieMunch, exchangeOperatorToken, mintConsentSyncToken, runExecutorConformance, verifyWebhookSignature };
+export declare function createCookieMunch(opts: CookieMunchOptions): CookieMunchClient;