@cookiemunch/sdk 0.7.1 → 0.9.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cookiemunch/sdk",
-  "version": "0.7.1",
+  "version": "0.9.0",
   "description": "Typed REST client for the Cookie Munch Developer API (/v1)",
   "license": "MIT",
   "type": "module",
@@ -32,7 +32,7 @@
     "access": "public"
   },
   "scripts": {
-    "build": "tsup",
+    "build": "tsup && tsc -p tsconfig.json --emitDeclarationOnly --declaration",
     "test": "vitest run"
   },
   "homepage": "https://cookiemunch.net/docs",

package/dist/consent.d.cts

@@ -1,169 +0,0 @@
-/**
- * Server-side consent reading. The Cookie Munch embed stores the visitor's decision in a
- * first-party `CookieMunch` cookie (URL-encoded JSON). This lets a server / edge worker read
- * that decision from the incoming request — to gate server-rendered tags or SSR'd third-party
- * scripts BEFORE they hit the browser — without shipping the whole embed. Zero-dependency and
- * runtime-agnostic: accepts a raw Cookie header, a Node `req` (`req.headers.cookie`), or a
- * Fetch `Request` (`request.headers.get('cookie')`).
- *
- *   import { readConsent, isAllowed } from '@cookiemunch/sdk/consent';
- *   const consent = readConsent(req.headers.cookie);   // ServerConsent | null
- *   if (isAllowed(consent, 'statistics')) { …render analytics tag… }
- *
- * The contract is documented at https://cookiemunch.net/docs/consent-cookie. It accepts
- * exactly what the embed accepts, so a server never grants what the browser would refuse:
- * strict JSON (URL-encoded or not) and the relaxed object literal Cookiebot writes.
- *
- * This module imports nothing — `@cookiemunch/sdk/consent` pulls in no API client.
- */
-/** The first-party cookie the embed writes (mirrors @cookiemunch/core COOKIE_NAME). */
-declare const CONSENT_COOKIE_NAME = "CookieMunch";
-/** A visitor's consent decision, read from the request cookie. `necessary` is always true. */
-interface ServerConsent {
-    necessary: true;
-    preferences: boolean;
-    statistics: boolean;
-    marketing: boolean;
-    /** How consent was given. `implied` = not yet an explicit choice. */
-    method: 'explicit' | 'implied';
-    /** Custom (non-standard) categories, when the site defines any. */
-    custom?: Record<string, boolean>;
-    /** Consent-policy version the decision was made under (see `minVersion`). */
-    ver: number;
-    /** When the decision was made, epoch milliseconds (see `expiryDays`). */
-    utc: number;
-    /** Region code the decision was made in (`unknown` when undetected). */
-    region: string;
-    /** The anonymous consent-receipt id tying this browser to the consent log. */
-    stamp: string;
-    /**
-     * `<kid>.<base64url>`: the API's Ed25519 signature over this decision, issued when the
-     * ledger recorded it. Absent on a decision no ledger holds (a hand-written cookie).
-     */
-    sig?: string;
-}
-/** The site's consent policy, so the server applies the same rules the embed does. */
-interface ReadConsentOptions {
-    /** Cookie name. Default `CookieMunch`. */
-    cookieName?: string;
-    /**
-     * The site's current consent version (`consent.version`, or the config `ver` when that is
-     * higher). A decision made under an older version is not honoured by the embed — the
-     * visitor is asked again — so it reads as `null` here too.
-     */
-    minVersion?: number;
-    /** The site's `consent.expiryDays`: a decision older than this reads as `null`. */
-    expiryDays?: number;
-    /** Clock for `expiryDays`, epoch ms. Default `Date.now()`. */
-    now?: number;
-}
-/** Where the platform's public signing keys come from, for signatures and consent tokens. */
-interface KeySetOptions {
-    /** A key set you already hold (`{ keys: [...] }`). Skips the fetch. */
-    jwks?: JsonWebKeySet;
-    /** Default `https://api.cookiemunch.net/v1/partner/jwks.json`. */
-    jwksUrl?: string;
-    /** Injectable fetch. Default: the global one. */
-    fetch?: typeof fetch;
-}
-/** `readConsent` with `requireSigned: true`: only a decision the API signed counts. */
-interface ReadSignedConsentOptions extends ReadConsentOptions, KeySetOptions {
-    requireSigned: true;
-}
-/** Anything we can pull a Cookie header off of. */
-type ConsentSource = string | null | undefined | {
-    headers?: {
-        cookie?: string | null;
-        get?(name: string): string | null;
-    } | Record<string, unknown>;
-};
-/**
- * Parse a raw cookie value into a validated ServerConsent, or null. Accepts the two formats
- * the embed reads: URL-encoded (or plain) strict JSON, and Cookiebot's relaxed object
- * literal — `{stamp:'…',necessary:true,…}` — left behind by a site migrating from Cookiebot.
- */
-declare function parseConsentValue(raw: string): ServerConsent | null;
-/**
- * Read the visitor's consent from a request: a raw `Cookie` header, a Node `req`, or a Fetch
- * `Request`. Returns null when there is no decision the embed would honour — no cookie, an
- * unparseable one, or (with the options) one made under an older version or past expiry.
- */
-declare function readConsent(source: ConsentSource, opts: ReadSignedConsentOptions): Promise<ServerConsent | null>;
-declare function readConsent(source: ConsentSource, opts?: ReadConsentOptions & {
-    requireSigned?: false;
-}): ServerConsent | null;
-/**
- * Read the visitor's consent from a request. The original spelling of {@link readConsent},
- * kept for existing callers; the second argument is the cookie name.
- */
-declare function getConsent(source: ConsentSource, cookieName?: string): ServerConsent | null;
-/** Standard + custom consent categories. */
-type ConsentCategory = 'necessary' | 'preferences' | 'statistics' | 'marketing' | (string & {});
-/**
- * Whether a category is allowed for this visitor. `necessary` is always allowed. A missing
- * consent (`null` — visitor hasn't decided) is treated as NOT allowed for non-necessary
- * categories (fail-closed / prior-blocking posture), matching the embed.
- */
-declare function isAllowed(consent: ServerConsent | null, category: ConsentCategory): boolean;
-declare const DEFAULT_JWKS_URL = "https://api.cookiemunch.net/v1/partner/jwks.json";
-/** The fields of a decision its signature covers. */
-interface SignableDecision {
-    stamp: string;
-    ver: number;
-    utc: number;
-    preferences: boolean;
-    statistics: boolean;
-    marketing: boolean;
-    custom?: Record<string, boolean> | undefined;
-}
-/**
- * The exact line the API signs for a recorded decision. Identical to @cookiemunch/core's
- * `consentSignaturePayload` (a server test pins the two together).
- */
-declare function consentSignaturePayload(d: SignableDecision): string;
-interface Jwk {
-    kty?: string;
-    crv?: string;
-    x?: string;
-    kid?: string;
-    alg?: string;
-}
-interface JsonWebKeySet {
-    keys: Jwk[];
-}
-/** Does the cookie's `sig` verify for this decision? False on anything malformed. */
-declare function verifyDecisionSignature(consent: ServerConsent, opts?: KeySetOptions): Promise<boolean>;
-/** What a consent token (`CookieMunch.getConsentToken()`) asserts. */
-interface ConsentTokenClaims {
-    iss: string;
-    /** The decision's stamp. */
-    sub: string;
-    /** `cookiemunch:<cbid>`. */
-    aud: string;
-    token_use: 'consent';
-    cbid: string;
-    stamp: string;
-    /** Every category the decision answered, `necessary` included. */
-    choices: Record<string, boolean>;
-    ver: number;
-    /** When the decision was made, epoch ms. */
-    decidedAt: number;
-    cause?: string;
-    iat: number;
-    exp: number;
-}
-interface VerifyTokenOptions extends KeySetOptions {
-    /** Require the token to be for this site. */
-    cbid?: string;
-    /** Clock, epoch ms. Default `Date.now()`. */
-    now?: number;
-    /** Allowed clock skew, seconds. Default 30. */
-    leewaySeconds?: number;
-}
-/**
- * Verify a consent token from `CookieMunch.getConsentToken()` (CMU-F06) against the published
- * key set and return its claims. Throws on a bad signature, a wrong site, or an expired token.
- */
-declare function verifyToken(token: string, opts?: VerifyTokenOptions): Promise<ConsentTokenClaims>;
-
-export { CONSENT_COOKIE_NAME, type ConsentCategory, type ConsentSource, type ConsentTokenClaims, DEFAULT_JWKS_URL, type JsonWebKeySet, type KeySetOptions, type ReadConsentOptions, type ReadSignedConsentOptions, type ServerConsent, type SignableDecision, type VerifyTokenOptions, consentSignaturePayload, getConsent, isAllowed, parseConsentValue, readConsent, verifyDecisionSignature, verifyToken };