@cookiemunch/sdk 0.9.1 → 0.11.0

package/dist/index.d.ts

@@ -20,7 +20,7 @@ import type { ConformanceReport } from './executor-conformance.js';
  * This package's version, sent in the default User-Agent. Cloudflare answers a request with
  * no recognisable User-Agent with `403 error code: 1010`; a test pins this to package.json.
  */
-export declare const SDK_VERSION = "0.9.1";
+export declare const SDK_VERSION = "0.11.0";
 export interface CookieMunchOptions {
     apiKey: string;
     /** "https://api.cookiemunch.net" — the /v1 prefix is appended automatically. */
@@ -1167,6 +1167,24 @@ export interface ApiKeyPrefix {
     /** The dated API version this key is pinned to. */
     apiVersion?: string;
 }
+/** A signed audit-anchor receipt (POST /v1/anchors). Verify `signature` (Ed25519, base64url) over the canonical JSON of every other field with the key `keyId` in /v1/partner/jwks.json. */
+export interface AnchorReceipt {
+    id: string;
+    org: string;
+    stream: string;
+    head: string;
+    seq: number;
+    receivedAt: string;
+    keyId: string;
+    alg: 'EdDSA';
+    signature: string;
+}
+/** GET /v1/anchors/{stream}: newest first; pass `nextBefore` as `before` until it is null. */
+export interface AnchorList {
+    stream: string;
+    anchors: AnchorReceipt[];
+    nextBefore: number | null;
+}
 /** A live organisation's sandbox (GET /v1/sandbox). */
 export interface SandboxOrg {
     orgId: string;
@@ -1308,8 +1326,12 @@ export interface WebhookSubscription {
     id: string;
     orgId: string;
     url: string;
+    /** Shown once on create, and only when Cookie Munch generated it. */
     secret?: string;
+    /** The patterns as given: event names, `*`, `<family>.*`. */
     events: string[];
+    /** The events those patterns take today. A wildcard also takes events added later. */
+    matches?: string[];
     cbid: string | null;
     active: boolean;
     createdAt: number;
@@ -1719,8 +1741,11 @@ export interface DsarExportResult {
 /** Input for creating a webhook subscription. */
 export interface WebhookCreate {
     url: string;
+    /** Event names, `*` (every event; needs a full-access key) or `<family>.*` such as `consent.*`. */
     events: string[];
     cbid?: string;
+    /** Your own signing secret, 32–256 printable characters. Not echoed back; omit it and one is generated and returned once. */
+    secret?: string;
 }
 /** Fields to change on a webhook subscription. Only those present are sent. */
 export interface WebhookUpdate {
@@ -2154,6 +2179,8 @@ export interface DsarExecutor {
     lastSignedCompletionAt?: number | null;
     /** Where signed cm-standard-v2 completions go. */
     completionsUrl?: string;
+    /** True: its erasures wait (status `awaiting_approval`) for `approveTask` or `rejectTask`. */
+    requireApproval?: boolean;
     /** On create only: the completion secret, shown this once. */
     completionSecret?: string;
 }
@@ -2180,6 +2207,8 @@ export interface ExecutorHealth {
     code?: string;
     /** When a check last passed. */
     lastSuccessAt?: number;
+    /** The `X-Version` the system last answered with. */
+    version?: string;
     /** On reads: true when the last check is more than an hour old, with the command that re-checks it in `hint`. */
     stale?: boolean;
     hint?: string;
@@ -2216,6 +2245,8 @@ export interface DsarExecutorPresetInput {
     label?: string;
     /** Default 2. */
     orchestrator?: 1 | 2;
+    /** Park its erasures for a person's approval. Default false. */
+    requireApproval?: boolean;
 }
 /** What `upgradeExecutorPreset` takes: a version, a preset to adopt, or params to add. */
 export interface ExecutorPresetUpgrade {
@@ -2334,8 +2365,17 @@ export interface DsarExecutorInput {
     profile: ExecutorProfile;
     /** Default 2. */
     orchestrator?: 1 | 2;
+    /** Park its erasures for a person's approval. Default false. */
+    requireApproval?: boolean;
 }
-export type DsarExecutorCreated = DsarExecutor;
+export type DsarExecutorCreated = DsarExecutor & {
+    warnings?: Array<{
+        field: string;
+        reason: string;
+    }>;
+    /** With `connectExecutor(…, { verify })`: what the canary probe found. */
+    verify?: ExecutorTestResult;
+};
 /** The fields `updateExecutor` may change. */
 export interface DsarExecutorPatch {
     profile?: unknown;
@@ -2351,24 +2391,28 @@ export interface DsarExecutorPatch {
     presetPinned?: boolean;
     /** Opt in to (2) or out of (1) orchestrator v2. */
     orchestrator?: 1 | 2;
+    /** Park its erasures for approval; false stops parking new ones (parked ones still wait). */
+    requireApproval?: boolean;
 }
 /** One entry in a fulfilment task's status history. */
 export interface DsarTaskEvent {
     at: number;
     kind: 'created' | 'changed' | 'version_changed';
-    status: 'pending' | 'running' | 'done' | 'failed' | 'cancelled';
+    status: DsarTaskStatus;
     detail?: string;
     outcome?: DsarTaskOutcome;
     scheduledFor?: number;
     externalRef?: string;
 }
+/** `awaiting_approval`: an erasure parked until `approveTask` (→ pending) or `rejectTask` (→ failed). */
+export type DsarTaskStatus = 'pending' | 'running' | 'done' | 'failed' | 'cancelled' | 'awaiting_approval';
 /** What a task's answer means for the person. `exported` only once the export was fetched. */
 export type DsarTaskOutcome = 'located' | 'exported' | 'erased' | 'no_record' | 'done_without_artifact' | 'not_applicable' | 'already_erased' | 'external_identity';
 /** One request made to a connected system on a task's behalf, credentials removed. Kept 30 days. */
 export interface DsarTaskLogEntry {
     id?: string;
     system?: string;
-    step: 'lookup' | 'open' | 'poll' | 'export' | 'grant';
+    step: 'lookup' | 'open' | 'poll' | 'export' | 'grant' | 'cancel' | 'preview';
     method: string;
     path: string;
     /** Absent when the system never answered. */
@@ -2395,7 +2439,7 @@ export interface DsarTask {
     requestId: string;
     system: string;
     operation: FulfillmentOp;
-    status: 'pending' | 'running' | 'done' | 'failed' | 'cancelled';
+    status: DsarTaskStatus;
     detail?: string;
     outcome?: DsarTaskOutcome;
     attempts: number;
@@ -2415,6 +2459,19 @@ export interface DsarTask {
     upstreamVersions?: string[];
     /** The system was redeployed while this task was in flight. */
     versionChanged: boolean;
+    /** For an erasure awaiting approval: what the system said it would remove (≤4000 chars, redacted). */
+    preview?: {
+        at: number;
+        text?: string;
+        error?: string;
+    };
+    /** The account at that system, when one email matched several there (one task each). */
+    subjectKey?: string;
+    /** How the requester was verified, as sent to the system. */
+    verification?: {
+        method: 'code' | 'session' | 'account_link' | 'attested' | 'none' | 'controller';
+        emailVerified: boolean;
+    };
 }
 /** What testing a connection found. Nothing was filed. */
 export interface ExecutorTestResult {
@@ -2443,6 +2500,8 @@ export interface ExecutorTestResult {
     }>;
     /** Present when the test used the org canary address, with the address in `email`. */
     canary?: boolean;
+    /** The accounts the lookup found, when one email matched several (subjectLookup.idsPath). */
+    subjects?: string[];
     email?: string;
     /** Every upstream answer, as the system gave it (credentials removed). */
     exchanges: DsarTaskLogEntry[];
@@ -2740,7 +2799,7 @@ export interface CookieMunchClient {
             dryRun: true;
         }): Promise<DeclarationDryRun>;
         /**
-         * Declare many at once (all-or-nothing). `replace` also removes declarations not listed;
+         * Declare many at once (all-or-nothing). `replace` also removes your own declarations not listed (vendor-preset rows stay);
          * `dryRun` answers with what would be stored and a diff, storing nothing.
          */
         declareCookies(cbid: string, cookies: Array<DeclaredCookieInput & {
@@ -2827,8 +2886,17 @@ export interface CookieMunchClient {
          * wrapped as `{ request }`, so `create(...).request.id` is what you pass here.
          */
         get(id: string): Promise<DsarRequest>;
+        /** `skipped`: connections scoped to another property (or to one, when the request names none), never planned for it. */
         create(input: DsarCreate & ResourceTagsInput): Promise<{
             request: DsarRequest;
+            consent?: {
+                count: number;
+                sites: string[];
+            };
+            skipped?: Array<{
+                system: string;
+                reason: string;
+            }>;
         }>;
         /** `opts.messageToSubject` replaces the line the subject reads in the notice — for a rejection, why. */
         advance(id: string, toStatus: DsarStatus, opts?: {
@@ -2864,6 +2932,8 @@ export interface CookieMunchClient {
         }>;
         /** Requests carrying one X-Trace-Id (`GET /v1/dsar?trace=`). */
         listByTrace(trace: string): Promise<DsarRequest[]>;
+        /** Requests with one origin (`GET /v1/dsar?origin=`): `account_deletion`, those a person's own account deletion opened. */
+        listByOrigin(origin: 'account_deletion'): Promise<DsarRequest[]>;
         /**
          * Open a case fanned out to every connected system (POST /v1/dsar/requests). `opts.idempotencyKey`
          * (16–128 chars) makes a retry answer the same case; `opts.trace` passes your X-Trace-Id on.
@@ -3133,7 +3203,14 @@ export interface CookieMunchClient {
          * Connect one. The secret is stored encrypted and never returned; the response carries
          * the URL to point that system's webhook at.
          */
-        connectExecutor(input: (DsarExecutorInput | DsarExecutorPresetInput) & ResourceTagsInput): Promise<DsarExecutorCreated>;
+        connectExecutor(input: (DsarExecutorInput | DsarExecutorPresetInput) & ResourceTagsInput, 
+        /**
+         * `verify: true` probes it first (a canary locate; no erasure is sent) and refuses a failing one
+         * (422 `verify_failed`, nothing stored); `'warn'` stores it with the verdict in `warnings`.
+         */
+        opts?: {
+            verify?: true | 'warn';
+        }): Promise<DsarExecutorCreated>;
         /**
          * Change a connection in place. Only what you send changes, and the stored credential
          * is kept unless you pass a new `secretKey` — so adding a field to a profile does not
@@ -3178,6 +3255,12 @@ export interface CookieMunchClient {
          * its behalf (`log`, redacted, 30 days) and whether that system's version changed mid-way.
          */
         task(requestId: string, taskId: string): Promise<DsarTask>;
+        /** Approve an erasure awaiting approval: it is sent now. Audited with your key. 409 when it is not waiting. */
+        approveTask(requestId: string, taskId: string): Promise<DsarTask>;
+        /** Reject an erasure awaiting approval: nothing is sent and the task fails with `reason`. Audited. */
+        rejectTask(requestId: string, taskId: string, opts?: {
+            reason?: string;
+        }): Promise<DsarTask>;
         /**
          * Try a connection against one email without filing anything: runs the lookup, returns
          * the raw (redacted) upstream answers and what a real request would have sent.
@@ -3280,6 +3363,26 @@ export interface CookieMunchClient {
     versions(): Promise<ApiVersions>;
     /** What the org may use: every plan feature (`whiteLabel`, `tcf`, …) and limit, in the suite-standard shape. Any key may read it. */
     entitlements(): Promise<Entitlements>;
+    /**
+     * Audit anchoring: post the head of your own hash-chained log and get a receipt signed by Cookie Munch's
+     * platform key. `seq` must strictly increase per stream; the same seq and head again returns the original
+     * receipt, a different head for an anchored seq is a 409 (`anchor_head_mismatch`). Needs `anchors:write` / `anchors:read`.
+     */
+    anchors: {
+        /** Anchor `head` at `seq` on `stream` (POST /v1/anchors). */
+        create(input: {
+            stream: string;
+            head: string;
+            seq: number;
+        }): Promise<AnchorReceipt>;
+        /** A stream's receipts, newest first (GET /v1/anchors/{stream}). */
+        list(stream: string, query?: {
+            limit?: number;
+            before?: number;
+        }): Promise<AnchorList>;
+        /** One receipt (GET /v1/anchors/{stream}/{id}). */
+        get(stream: string, id: string): Promise<AnchorReceipt>;
+    };
     /**
      * The organisation's sandbox: a separate test organisation with the same people and plan features, never billed.
      * Its keys are test-format keys and its rights requests are all tests. `create` and `delete` need an unscoped key or `orgs:create`.
@@ -3426,9 +3529,12 @@ export interface CookieMunchClient {
         /** Change or pause a subscription. `{ active: false }` pauses without deleting it. */
         update(id: string, patch: WebhookUpdate): Promise<WebhookSubscription>;
         delete(id: string): Promise<void>;
-        /** Rotate the signing secret. The new secret is returned once. */
-        rollSecret(id: string): Promise<{
-            secret: string;
+        /** Rotate the signing secret. A generated one is returned once; `{ secret }` you choose is not echoed (`rolled: true`). */
+        rollSecret(id: string, opts?: {
+            secret?: string;
+        }): Promise<{
+            secret?: string;
+            rolled?: boolean;
         }>;
         /** Send a signed test event now and report what the endpoint answered. */
         test(id: string): Promise<WebhookTestResult>;

package/dist/index.js

@@ -9,6 +9,12 @@ import {
   verifyDecisionSignature,
   verifyToken
 } from "./chunk-OSVTQPQG.js";
+import {
+  CANARY_ISSUER,
+  CONFORMANCE_RULES,
+  canaryIdentityFor,
+  runExecutorConformance
+} from "./chunk-U5OJSPE5.js";
 
 // src/webhooks.ts
 import { createHmac, timingSafeEqual } from "crypto";
@@ -45,181 +51,6 @@ function mintConsentSyncToken(input) {
   return `cms1.${payload}.${sig}`;
 }
 
-// src/executor-conformance.ts
-var CANARY_ISSUER = "https://canary.cookiemunch.net";
-var CANARY_EMAIL_RE = /^canary-([0-9a-f]{16})@canary\.cookiemunch\.net$/;
-function canaryIdentityFor(canaryEmail) {
-  const m = CANARY_EMAIL_RE.exec(canaryEmail.trim().toLowerCase());
-  if (!m) throw new Error("canaryEmail must be the canary address canary-<16 hex>@canary.cookiemunch.net");
-  return { iss: CANARY_ISSUER, sub: `canary_${m[1]}`, ext: `canary:${m[1]}` };
-}
-var CONFORMANCE_RULES = [
-  { id: "auth.required", title: "A request without the credential is refused (401 or 403)." },
-  { id: "lookup.email.found", title: "The canary subject is found by its email." },
-  { id: "lookup.identity.found", title: "The canary subject is found by its identity alone (iss + sub), and it is the same subject." },
-  { id: "lookup.unknown.no_match", title: 'An address nobody has answers { subjectId: null, status: "no_match" }.' },
-  { id: "lookup.identity_beats_email", title: "An identity that matches no one is never matched through the email of someone else." },
-  { id: "requests.bad_body.400", title: "A request with an unknown type answers 400 { error, field }." },
-  { id: "requests.alias.canonical_type", title: 'An alias (erasure) is accepted and answered with canonicalType "deletion".' },
-  { id: "requests.execute_after.scheduled", title: 'A deletion with a future executeAfter is "scheduled" with eta equal to executeAfter \u2014 nothing is deleted before it.' },
-  { id: "requests.idempotency.replay", title: "The same Idempotency-Key with the same body returns the same request, not a second one." },
-  { id: "requests.idempotency.mismatch_409", title: "The same Idempotency-Key with a different body answers 409." },
-  { id: "requests.get", title: "GET /privacy/requests/{id} returns the request, still scheduled." },
-  { id: "requests.unknown.404", title: "An unknown request id answers 404." },
-  { id: "requests.cancel.before_execute_after", title: 'A cancel before executeAfter answers status "cancelled".' },
-  { id: "requests.cancel.keeps_data", title: "After a cancel the subject is still there: a lookup finds it." },
-  { id: "version.header", title: "Answers carry X-Version (the highest contract version the executor supports)." }
-];
-function randomTag() {
-  const bytes = new Uint8Array(8);
-  const c = globalThis.crypto;
-  if (c?.getRandomValues) c.getRandomValues(bytes);
-  else for (let i = 0; i < bytes.length; i++) bytes[i] = Math.floor(Math.random() * 256);
-  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
-}
-function field(json, key) {
-  return json && typeof json === "object" ? json[key] : void 0;
-}
-async function runExecutorConformance(o) {
-  const doFetch = o.fetch ?? fetch;
-  const now = o.now ?? (() => Date.now());
-  const base = o.baseUrl.replace(/\/+$/, "") + (o.prefix ?? "/privacy");
-  let url;
-  try {
-    url = new URL(base);
-  } catch {
-    throw new Error("baseUrl must be an absolute URL");
-  }
-  if (url.protocol !== "https:" && !(url.protocol === "http:" && /^(localhost|127\.0\.0\.1|\[::1\])$/.test(url.hostname))) {
-    throw new Error("baseUrl must be https (http only for localhost)");
-  }
-  const identity = canaryIdentityFor(o.canaryEmail);
-  const canaryEmail = o.canaryEmail.trim().toLowerCase();
-  const auth = o.auth ?? { header: "Authorization", format: "Bearer {secret}" };
-  const run = o.runId ?? randomTag();
-  const results = /* @__PURE__ */ new Map();
-  let version;
-  const set = (id, status, detail) => {
-    const rule = CONFORMANCE_RULES.find((r) => r.id === id);
-    results.set(id, { id, title: rule.title, status, ...detail ? { detail } : {} });
-  };
-  const pass = (id) => set(id, "pass");
-  const fail = (id, detail) => set(id, "fail", detail);
-  const skip = (id, detail) => set(id, "skip", detail);
-  async function call(method, path, body, extra = {}, withAuth = true) {
-    const headers = {
-      accept: "application/json",
-      "X-Version": "2",
-      ...withAuth ? { [auth.header]: auth.format.replace("{secret}", o.secret) } : {},
-      ...body !== void 0 ? { "content-type": "application/json" } : {},
-      ...extra
-    };
-    try {
-      const res = await doFetch(base + path, { method, headers, ...body !== void 0 ? { body: JSON.stringify(body) } : {} });
-      const text = await res.text().catch(() => "");
-      let json;
-      try {
-        json = text ? JSON.parse(text) : void 0;
-      } catch {
-        json = void 0;
-      }
-      const v = res.headers.get("x-version");
-      if (v && !version) version = v;
-      return { status: res.status, json, version: v };
-    } catch (err) {
-      return { status: 0, json: void 0, version: null, error: err instanceof Error ? err.message : String(err) };
-    }
-  }
-  const said = (a) => a.status === 0 ? `unreachable: ${a.error}` : `HTTP ${a.status} ${JSON.stringify(a.json ?? null).slice(0, 200)}`;
-  const key = (rule) => `conformance:${run}:${rule}`;
-  const anon = await call("POST", "/lookup", { emails: [canaryEmail] }, {}, false);
-  if (anon.status === 0) {
-    for (const r of CONFORMANCE_RULES) skip(r.id, said(anon));
-    fail("auth.required", said(anon));
-    return report();
-  }
-  if (anon.status === 401 || anon.status === 403) pass("auth.required");
-  else fail("auth.required", `without a credential: ${said(anon)}`);
-  const byEmail = await call("POST", "/lookup", { emails: [canaryEmail] }, { "Idempotency-Key": key("lookup-email") });
-  const subjectId = field(byEmail.json, "subjectId");
-  if (byEmail.status === 200 && field(byEmail.json, "status") === "found" && typeof subjectId === "string" && subjectId) pass("lookup.email.found");
-  else fail("lookup.email.found", `the canary address: ${said(byEmail)}`);
-  const byIdentity = await call("POST", "/lookup", { emails: [], identity, atlas: identity }, { "Idempotency-Key": key("lookup-identity") });
-  if (byIdentity.status === 200 && field(byIdentity.json, "status") === "found" && field(byIdentity.json, "subjectId") === subjectId && typeof subjectId === "string") {
-    pass("lookup.identity.found");
-  } else {
-    fail("lookup.identity.found", `the canary identity ${identity.sub}: ${said(byIdentity)}${typeof subjectId === "string" ? ` (by email it was ${subjectId})` : ""}`);
-  }
-  const nobody = await call("POST", "/lookup", { emails: [`nobody-${run}@canary.cookiemunch.net`] }, { "Idempotency-Key": key("lookup-nobody") });
-  if (nobody.status === 200 && field(nobody.json, "status") === "no_match" && field(nobody.json, "subjectId") === null) pass("lookup.unknown.no_match");
-  else fail("lookup.unknown.no_match", said(nobody));
-  const stranger = { iss: identity.iss, sub: `canary_other_${run}` };
-  const crossed = await call("POST", "/lookup", { emails: [canaryEmail], identity: stranger, atlas: stranger }, { "Idempotency-Key": key("lookup-crossed") });
-  if (crossed.status === 200 && field(crossed.json, "status") === "no_match") pass("lookup.identity_beats_email");
-  else {
-    fail(
-      "lookup.identity_beats_email",
-      `an identity nobody has (${stranger.sub}) with the canary's email: ${said(crossed)} \u2014 the email belongs to a different identity, so this must be no_match`
-    );
-  }
-  const bad = await call("POST", "/requests", { subjectId: subjectId ?? "x", type: "teleport", caseId: `conformance-${run}` }, { "Idempotency-Key": key("bad-body") });
-  if (bad.status === 400 && typeof field(bad.json, "error") === "string" && typeof field(bad.json, "field") === "string") pass("requests.bad_body.400");
-  else fail("requests.bad_body.400", said(bad));
-  if (typeof subjectId !== "string") {
-    for (const id of ["requests.alias.canonical_type", "requests.execute_after.scheduled", "requests.idempotency.replay", "requests.idempotency.mismatch_409", "requests.get", "requests.cancel.before_execute_after", "requests.cancel.keeps_data"]) {
-      skip(id, "needs the canary subject, which the lookup did not find");
-    }
-  } else {
-    const executeAfter = new Date(Math.ceil((now() + 36e5) / 1e3) * 1e3).toISOString();
-    const body = { subjectId, type: "erasure", executeAfter, caseId: `conformance-${run}`, reason: "Cookie Munch conformance check (canary subject)" };
-    const opened = await call("POST", "/requests", body, { "Idempotency-Key": key("open") });
-    const id = field(opened.json, "id");
-    const st = field(opened.json, "status");
-    if ((opened.status === 200 || opened.status === 201) && field(opened.json, "canonicalType") === "deletion") pass("requests.alias.canonical_type");
-    else fail("requests.alias.canonical_type", `type "erasure": ${said(opened)}`);
-    const eta = field(opened.json, "eta");
-    if ((opened.status === 200 || opened.status === 201) && st === "scheduled" && typeof eta === "string" && Date.parse(eta) === Date.parse(executeAfter)) {
-      pass("requests.execute_after.scheduled");
-    } else if (st === "completed" || st === "completed_with_retention" || st === "processing") {
-      fail("requests.execute_after.scheduled", `executeAfter is ${executeAfter}, an hour away, and the executor answered "${String(st)}": it acted before executeAfter`);
-    } else {
-      fail("requests.execute_after.scheduled", `expected status "scheduled" with eta ${executeAfter}: ${said(opened)}`);
-    }
-    const replay = await call("POST", "/requests", body, { "Idempotency-Key": key("open") });
-    if (typeof id === "string" && (replay.status === 200 || replay.status === 201) && field(replay.json, "id") === id) pass("requests.idempotency.replay");
-    else fail("requests.idempotency.replay", `a retry with the same key: ${said(replay)}${typeof id === "string" ? ` (first answer id ${id})` : ""}`);
-    const mismatch = await call("POST", "/requests", { ...body, reason: "a different body" }, { "Idempotency-Key": key("open") });
-    if (mismatch.status === 409) pass("requests.idempotency.mismatch_409");
-    else fail("requests.idempotency.mismatch_409", `the same key with a different body: ${said(mismatch)}`);
-    if (typeof id !== "string") {
-      skip("requests.get", "no request id came back");
-      skip("requests.cancel.before_execute_after", "no request id came back");
-      skip("requests.cancel.keeps_data", "no request id came back");
-    } else {
-      const got = await call("GET", `/requests/${encodeURIComponent(id)}`, void 0, { "Idempotency-Key": key("get") });
-      if (got.status === 200 && field(got.json, "id") === id && field(got.json, "status") === "scheduled") pass("requests.get");
-      else fail("requests.get", said(got));
-      const cancelled = await call("POST", `/requests/${encodeURIComponent(id)}/cancel`, {}, { "Idempotency-Key": key("cancel") });
-      if (cancelled.status === 200 && field(cancelled.json, "status") === "cancelled") pass("requests.cancel.before_execute_after");
-      else fail("requests.cancel.before_execute_after", said(cancelled));
-      const after = await call("POST", "/lookup", { emails: [canaryEmail] }, { "Idempotency-Key": key("lookup-after-cancel") });
-      if (after.status === 200 && field(after.json, "status") === "found") pass("requests.cancel.keeps_data");
-      else fail("requests.cancel.keeps_data", `a lookup after the cancel: ${said(after)} \u2014 a cancel before executeAfter must leave the data intact`);
-    }
-  }
-  const unknown = await call("GET", `/requests/conformance-missing-${run}`, void 0, { "Idempotency-Key": key("unknown") });
-  if (unknown.status === 404) pass("requests.unknown.404");
-  else fail("requests.unknown.404", said(unknown));
-  if (version) pass("version.header");
-  else fail("version.header", "no answer carried an X-Version header");
-  return report();
-  function report() {
-    const rules = CONFORMANCE_RULES.map((r) => results.get(r.id) ?? { id: r.id, title: r.title, status: "skip", detail: "not reached" });
-    const count = (s) => rules.filter((r) => r.status === s).length;
-    return { ok: count("fail") === 0, passed: count("pass"), failed: count("fail"), skipped: count("skip"), rules, ...version ? { version } : {} };
-  }
-}
-
 // src/token-exchange.ts
 var TokenExchangeError = class extends Error {
   constructor(error, status, description) {
@@ -257,7 +88,7 @@ async function exchangeOperatorToken(input) {
 }
 
 // src/index.ts
-var SDK_VERSION = "0.9.1";
+var SDK_VERSION = "0.11.0";
 var CookieMunchApiError = class extends Error {
   constructor(status, message, code, body) {
     super(message);
@@ -477,6 +308,7 @@ function createCookieMunch(opts) {
       },
       markTest: (id) => request("POST", `/dsar/${enc(id)}/mark-test`),
       listByTrace: (trace) => get(`/dsar${qs({ trace })}`),
+      listByOrigin: (origin) => get(`/dsar${qs({ origin })}`),
       openCase: (input, o) => request("POST", "/dsar/requests", input, false, {
         ...o?.idempotencyKey ? { "Idempotency-Key": o.idempotencyKey } : {},
         ...o?.trace ? { "X-Trace-Id": o.trace } : {}
@@ -590,7 +422,7 @@ function createCookieMunch(opts) {
       reportTask: (taskId, ok, error) => request("POST", `/dsar/agent/tasks/${enc(taskId)}/result`, { ok, ...error !== void 0 ? { error } : {} }),
       executors: (o) => get(`/dsar/executors${metaQs(o)}`),
       executor: (id) => get(`/dsar/executors/${enc(id)}`),
-      connectExecutor: (input) => request("POST", "/dsar/executors", input),
+      connectExecutor: (input, o) => request("POST", `/dsar/executors${qs({ verify: o?.verify ? o.verify === "warn" ? "warn" : "1" : void 0 })}`, input),
       updateExecutor: (id, patch) => request("PATCH", `/dsar/executors/${enc(id)}`, patch),
       dryRunConnectExecutor: (input) => request("POST", "/dsar/executors?dryRun=1", input),
       executorPresets: () => get("/dsar/executors/presets"),
@@ -604,6 +436,8 @@ function createCookieMunch(opts) {
       },
       taskExport: (requestId, taskId) => get(`/dsar/${enc(requestId)}/tasks/${enc(taskId)}/export`),
       task: (requestId, taskId) => get(`/dsar/${enc(requestId)}/tasks/${enc(taskId)}`),
+      approveTask: (requestId, taskId) => request("POST", `/dsar/${enc(requestId)}/tasks/${enc(taskId)}/approve`),
+      rejectTask: (requestId, taskId, o = {}) => request("POST", `/dsar/${enc(requestId)}/tasks/${enc(taskId)}/reject`, o.reason !== void 0 ? { reason: o.reason } : {}),
       testExecutor: (id, input) => request("POST", `/dsar/executors/${enc(id)}/test`, input),
       recheckExecutor: (id) => request("POST", `/dsar/executors/${enc(id)}/recheck`),
       executorHealthHistory: (id, opts2 = {}) => get(`/dsar/executors/${enc(id)}/health/history${qs({ limit: opts2.limit })}`),
@@ -643,6 +477,11 @@ function createCookieMunch(opts) {
     usage: () => get("/usage"),
     entitlements: () => get("/entitlements"),
     versions: () => get("/versions"),
+    anchors: {
+      create: (input) => request("POST", "/anchors", input),
+      list: (stream, query) => get(`/anchors/${enc(stream)}${qs(query)}`),
+      get: (stream, id) => get(`/anchors/${enc(stream)}/${enc(id)}`)
+    },
     sandbox: {
       get: async () => (await get("/sandbox")).sandbox,
       create: (input) => request("POST", "/sandbox", input ?? {}),
@@ -723,7 +562,7 @@ function createCookieMunch(opts) {
       delete: async (id) => {
         await request("DELETE", `/webhooks/${enc(id)}`);
       },
-      rollSecret: (id) => request("POST", `/webhooks/${enc(id)}/roll`),
+      rollSecret: (id, opts2) => request("POST", `/webhooks/${enc(id)}/roll`, opts2?.secret ? { secret: opts2.secret } : void 0),
       test: (id) => request("POST", `/webhooks/${enc(id)}/test`),
       deadLetters: () => get("/webhooks/dead-letters"),
       replayDeadLetter: (id) => request("POST", `/webhooks/dead-letters/${enc(id)}/replay`),