riksdagsmonitor 0.9.6 → 0.9.8

package/SECURITY.md

@@ -187,7 +187,7 @@ Riksdagsmonitor's security practices are part of Hack23 AB's comprehensive Infor
 
 ### IMF data scope
 
-Riksdagsmonitor consumes **public, anonymous, unauthenticated** macro/fiscal/monetary statistics from the IMF Datamapper REST API (`www.imf.org/external/datamapper/api/v1`) and the IMF SDMX 3.0 endpoint (`sdmxcentral.imf.org`). **No personal data, no credentials, no auth tokens** are exchanged with the IMF. The IMF integration is therefore out of scope for GDPR DPIA but in scope for this security policy as a third-party dependency.
+Riksdagsmonitor consumes **public** macro/fiscal/monetary statistics from the IMF Datamapper REST API (`www.imf.org/external/datamapper/api/v1`, **unauthenticated**) and the IMF SDMX 3.0 endpoint (`api.imf.org/external/sdmx/3.0`, **subscription-key authenticated** via the Azure APIM `Ocp-Apim-Subscription-Key` header / `IMF_SDMX_SUBSCRIPTION_KEY` secret). The subscription key gates throttle/quota at the gateway; the underlying payloads remain public macro statistics. **No personal data, no auth tokens** are exchanged with the IMF; the subscription key is treated as a credential per the secrets-management policy. The IMF integration is therefore out of scope for GDPR DPIA but in scope for this security policy as a third-party dependency.
 
 ### IMF-specific security posture
 
@@ -206,7 +206,7 @@ If you discover a vulnerability in our IMF integration (e.g., cache integrity by
 
 ### IMF egress allow-list
 
-**Egress hosts** (allow-list): `www.imf.org` (Datamapper REST · WEO/FM), `sdmxcentral.imf.org` (SDMX 3.0 REST · IFS/BOP/DOTS/GFS/PCPS/ER/MFS_IR/MFS_PR). Both HTTPS-only, anonymous, public — no credentials required.
+**Egress hosts** (allow-list): `www.imf.org` (Datamapper REST · WEO/FM, **unauthenticated**), `api.imf.org` (SDMX 3.0 REST · IFS/BOP/DOTS/GFS/PCPS/ER/MFS_IR/MFS_PR, **subscription-key authenticated** via the Azure APIM `Ocp-Apim-Subscription-Key` header / `IMF_SDMX_SUBSCRIPTION_KEY` secret). Both HTTPS-only; payloads are public macro statistics with no PII.
 
 **Canonical rule.** Every economic claim in a Riksdagsmonitor article cites an IMF dataflow first; World Bank citations are reserved for governance, environment and social residue (the classes IMF does not publish). SCB is the Swedish-specific ground truth layer. See `ECONOMIC_DATA_CONTRACT.md` v2.1 for the banned-phrase list and vintage discipline (>6 mo → annotation).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "riksdagsmonitor",
-  "version": "0.9.6",
+  "version": "0.9.8",
   "type": "module",
   "description": "Swedish Parliament (Riksdag) intelligence platform — TypeScript utilities for political data visualization, dashboards, and open data analysis with Chart.js and D3.js",
   "main": "dist/lib/shared/index.js",
@@ -197,7 +197,7 @@
     "remark-gfm": "^4.0.1",
     "remark-parse": "^11.0.0",
     "remark-rehype": "^11.1.2",
-    "start-server-and-test": "3.0.2",
+    "start-server-and-test": "3.0.4",
     "tsx": "4.21.0",
     "typedoc": "0.28.19",
     "typedoc-plugin-mdn-links": "5.1.1",