@01.software/sdk 0.1.5 → 0.1.7

package/README.md

@@ -16,6 +16,7 @@ pnpm add @01.software/sdk
 - Browser and server environment support
 - React Query integration (both BrowserClient and ServerClient)
 - Mutation hooks (useCreate, useUpdate, useRemove) with automatic cache invalidation
+- Customer auth hooks (useCustomerMe, useCustomerLogin, etc.) with cache management
 - Automatic retry with exponential backoff (non-retryable: 401, 403, 404, 422)
 - Webhook handling with HMAC-SHA256 signature verification
 - Sub-path imports (`./auth`, `./webhook`, `./components`) for tree-shaking
@@ -35,6 +36,9 @@ import { handleWebhook, createTypedWebhookHandler } from '@01.software/sdk/webho
 
 // Components only - React components
 import { RichTextContent } from '@01.software/sdk/components'
+
+// Metadata only - SEO meta → Next.js Metadata
+import { generateMetadata } from '@01.software/sdk/metadata'
 ```
 
 ## Getting Started
@@ -177,7 +181,7 @@ interface PayloadMutationResponse<T> {
 
 ### React Query Hooks
 
-Available on both `BrowserClient` and `ServerClient` via `client.query.*`.
+Read hooks are available on both `BrowserClient` and `ServerClient` via `client.query.*`. Mutation hooks (`useCreate`, `useUpdate`, `useRemove`) are only available on `ServerClient`.
 
 ```typescript
 // List query
@@ -204,7 +208,7 @@ const { data, fetchNextPage, hasNextPage } = client.query.useInfiniteQuery({
   options: { limit: 20 },
 })
 
-// Mutation hooks (auto-invalidate cache on success)
+// Mutation hooks — ServerClient only (auto-invalidate cache on success)
 const { mutate: create } = client.query.useCreate({ collection: 'products' })
 const { mutate: update } = client.query.useUpdate({ collection: 'products' })
 const { mutate: remove } = client.query.useRemove({ collection: 'products' })
@@ -222,6 +226,53 @@ await client.query.prefetchInfiniteQuery({ collection: 'products', pageSize: 20
 client.query.invalidateQueries('products')
 client.query.getQueryData('products', 'list', options)
 client.query.setQueryData('products', 'detail', id, data)
+
+// Customer auth hooks (BrowserClient only)
+const { data: profile } = client.query.useCustomerMe()
+const { mutate: login } = client.query.useCustomerLogin()
+const { mutate: register } = client.query.useCustomerRegister()
+const { mutate: logout } = client.query.useCustomerLogout()
+
+login({ email: 'user@example.com', password: 'password' })
+
+// Other customer mutations
+client.query.useCustomerForgotPassword()
+client.query.useCustomerResetPassword()
+client.query.useCustomerVerifyEmail()
+client.query.useCustomerChangePassword()
+
+// Customer cache utilities
+client.query.invalidateCustomerQueries()
+client.query.getCustomerData()
+client.query.setCustomerData(profile)
+```
+
+### Customer Auth
+
+Available on BrowserClient via `client.customer.*`.
+
+```typescript
+const client = createBrowserClient({
+  clientKey: process.env.NEXT_PUBLIC_SOFTWARE_CLIENT_KEY,
+  customer: {
+    onTokenChange: (token) => localStorage.setItem('customer-token', token ?? ''),
+  },
+})
+
+// Register & login
+const { customer } = await client.customer.register({ name: 'John', email: 'john@example.com', password: 'secure123' })
+const { token, customer } = await client.customer.login({ email: 'john@example.com', password: 'secure123' })
+
+// Profile & token management
+const profile = await client.customer.me()
+client.customer.isAuthenticated()
+client.customer.logout()
+
+// Password & email
+await client.customer.forgotPassword('john@example.com')
+await client.customer.resetPassword(token, newPassword)
+await client.customer.changePassword(currentPassword, newPassword)
+await client.customer.verifyEmail(verificationToken)
 ```
 
 ### Server API
@@ -229,14 +280,46 @@ client.query.setQueryData('products', 'detail', id, data)
 Available only in ServerClient via `client.api.*`.
 
 ```typescript
-// Create order
+// Orders
 await client.api.createOrder(params)
-
-// Update order status
 await client.api.updateOrder({ orderNumber, status })
+await client.api.getOrder({ orderNumber })
+await client.api.checkout({ cartId, paymentId, orderNumber, customerSnapshot })
 
-// Update transaction
+// Fulfillment & transactions
+await client.api.createFulfillment({ orderNumber, carrier, trackingNumber, items })
 await client.api.updateTransaction({ paymentId, status, paymentMethod, receiptUrl })
+
+// Returns
+await client.api.createReturn({ orderNumber, returnProducts, refundAmount, reason? })
+await client.api.updateReturn({ returnId, status })
+await client.api.returnWithRefund({ orderNumber, returnProducts, refundAmount, paymentId })
+```
+
+### Product API
+
+Available only in ServerClient via `client.product.*`.
+
+```typescript
+// Batch stock check
+const { results, allAvailable } = await client.product.stockCheck({
+  items: [{ optionId: 1, quantity: 2 }, { optionId: 3, quantity: 1 }],
+})
+```
+
+### Cart API
+
+Available in both ServerClient and BrowserClient via `client.cart.*`.
+
+```typescript
+// Add item to cart
+await client.cart.addItem({ cartId, product, variant, option, quantity })
+
+// Update item quantity
+await client.cart.updateItem({ cartItemId, quantity })
+
+// Remove item from cart
+await client.cart.removeItem({ cartItemId })
 ```
 
 ### Webhook
@@ -271,7 +354,10 @@ const handler = createTypedWebhookHandler('orders', async (event) => {
 | -------- | ---------------------------------------------------------------------------------------------------------------------------------- |
 | Tenant   | `tenants`, `tenant-metadata`, `tenant-logos`, `tenant-og-images`                                                                   |
 | Products | `products`, `product-variants`, `product-options`, `product-categories`, `product-tags`, `product-images`, `brands`, `brand-logos` |
-| Orders   | `orders`, `order-products`, `returns`, `return-products`, `transactions`                                                           |
+| Orders   | `orders`, `order-products`, `returns`, `return-products`, `exchanges`, `exchange-products`, `fulfillments`, `fulfillment-items`, `transactions` |
+| Customers | `customers`, `customer-addresses`                                                                                                 |
+| Carts    | `carts`, `cart-items`                                                                                                              |
+| Commerce | `discounts`, `shipping-policies`                                                                                                   |
 | Content  | `posts`, `post-categories`, `post-tags`, `post-images`, `documents`, `document-categories`, `document-images`                      |
 | Media    | `playlists`, `playlist-images`, `musics`, `galleries`, `gallery-images`, `media`                                                   |
 | Forms    | `forms`, `form-submissions`                                                                                                        |

package/dist/{auth-DNaV-5wt.d.ts → auth-Cl6xQinU.d.cts}

@@ -1,5 +1,5 @@
 import { Sort, Where } from 'payload';
-import './payload-types-BAZCcssT.js';
+import './payload-types-9ZTBbiqb.cjs';
 
 declare class SDKError extends Error {
     readonly code: string;
@@ -96,6 +96,16 @@ interface ClientBrowserConfig {
      * @example 'https://my-custom-api.example.com'
      */
     baseUrl?: string;
+    /**
+     * Customer authentication options.
+     * Used to initialize CustomerAuth on BrowserClient.
+     */
+    customer?: {
+        /** Initial token (e.g. from SSR cookie) */
+        token?: string;
+        /** Called when token changes (login/logout) — use to persist in localStorage/cookie */
+        onTokenChange?: (token: string | null) => void;
+    };
 }
 interface ClientServerConfig extends ClientBrowserConfig {
     secretKey: string;
@@ -176,6 +186,7 @@ type ExtractArrayType<T> = T extends (infer U)[] ? U : never;
 interface FetchOptions extends RequestInit {
     clientKey?: string;
     secretKey?: string;
+    customerToken?: string;
     timeout?: number;
     baseUrl?: string;
     debug?: boolean | DebugConfig;

package/dist/{auth-DMvniYSs.d.cts → auth-u5YEtV1J.d.ts}

@@ -1,5 +1,5 @@
 import { Sort, Where } from 'payload';
-import './payload-types-BAZCcssT.cjs';
+import './payload-types-9ZTBbiqb.js';
 
 declare class SDKError extends Error {
     readonly code: string;
@@ -96,6 +96,16 @@ interface ClientBrowserConfig {
      * @example 'https://my-custom-api.example.com'
      */
     baseUrl?: string;
+    /**
+     * Customer authentication options.
+     * Used to initialize CustomerAuth on BrowserClient.
+     */
+    customer?: {
+        /** Initial token (e.g. from SSR cookie) */
+        token?: string;
+        /** Called when token changes (login/logout) — use to persist in localStorage/cookie */
+        onTokenChange?: (token: string | null) => void;
+    };
 }
 interface ClientServerConfig extends ClientBrowserConfig {
     secretKey: string;
@@ -176,6 +186,7 @@ type ExtractArrayType<T> = T extends (infer U)[] ? U : never;
 interface FetchOptions extends RequestInit {
     clientKey?: string;
     secretKey?: string;
+    customerToken?: string;
     timeout?: number;
     baseUrl?: string;
     debug?: boolean | DebugConfig;

package/dist/auth.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/auth.ts","../src/core/internal/utils/index.ts"],"sourcesContent":["export type { JwtPayload } from './core/internal/utils'\nexport {\n  createServerToken,\n  verifyServerToken,\n  decodeServerToken,\n  createApiKey,\n  parseApiKey,\n} from './core/internal/utils'\n","import { SignJWT, jwtVerify, decodeJwt } from 'jose'\nimport { createNetworkError, createUsageLimitError, createTimeoutError, TimeoutError, NetworkError } from '../errors'\nimport type { DebugConfig, RetryConfig } from '../../client/types'\nimport { API_URLS } from '../../client/types'\n\nconst DEFAULT_TIMEOUT = 30000\nconst DEFAULT_RETRYABLE_STATUSES = [408, 429, 500, 502, 503, 504]\nconst NON_RETRYABLE_STATUSES = [401, 403, 404, 422]\n\nexport interface FetchOptions extends RequestInit {\n  clientKey?: string\n  secretKey?: string\n  timeout?: number\n  baseUrl?: string\n  debug?: boolean | DebugConfig\n  retry?: RetryConfig\n}\n\nexport interface JwtPayload {\n  clientKey: string\n  iat?: number\n  exp?: number\n}\n\n/**\n * Creates a JWT token for server-side authentication.\n * The token is valid for 1 hour by default.\n *\n * @param clientKey - Client API key\n * @param secretKey - Secret key used for signing\n * @param expiresIn - Token expiration time (default: '1h')\n * @returns Promise<string> JWT token\n *\n * @example\n * ```typescript\n * const token = await createServerToken('client-key', 'secret-key')\n * // Use in Authorization header: `Bearer ${token}`\n * ```\n */\nexport async function createServerToken(\n  clientKey: string,\n  secretKey: string,\n  expiresIn: string = '1h',\n): Promise<string> {\n  if (!clientKey || !secretKey) {\n    throw new Error('clientKey and secretKey are required.')\n  }\n\n  const secret = new TextEncoder().encode(secretKey)\n  return new SignJWT({ clientKey })\n    .setProtectedHeader({ alg: 'HS256' })\n    .setIssuedAt()\n    .setExpirationTime(expiresIn)\n    .sign(secret)\n}\n\n/**\n * Verifies a JWT token and returns the payload.\n *\n * @param token - JWT token to verify\n * @param secretKey - Secret key used for verification\n * @returns Promise<JwtPayload> Verified payload containing clientKey\n * @throws Error if token is invalid or expired\n *\n * @example\n * ```typescript\n * const payload = await verifyServerToken(token, 'secret-key')\n * console.log(payload.clientKey)\n * ```\n */\nexport async function verifyServerToken(\n  token: string,\n  secretKey: string,\n): Promise<JwtPayload> {\n  if (!token || !secretKey) {\n    throw new Error('token and secretKey are required.')\n  }\n\n  const secret = new TextEncoder().encode(secretKey)\n  const { payload } = await jwtVerify(token, secret, {\n    algorithms: ['HS256'],\n  })\n\n  if (!payload.clientKey || typeof payload.clientKey !== 'string') {\n    throw new Error('Invalid token payload: clientKey is missing')\n  }\n\n  return {\n    clientKey: payload.clientKey as string,\n    iat: payload.iat,\n    exp: payload.exp,\n  }\n}\n\n/**\n * Decodes a JWT token without verification.\n * WARNING: Use this only when you need to inspect token contents.\n * Always use verifyServerToken for authentication.\n *\n * @param token - JWT token to decode\n * @returns JwtPayload Decoded payload (unverified)\n *\n * @example\n * ```typescript\n * const payload = decodeServerToken(token)\n * console.log(payload.clientKey) // Unverified!\n * ```\n */\nexport function decodeServerToken(token: string): JwtPayload {\n  if (!token) {\n    throw new Error('token is required.')\n  }\n\n  const payload = decodeJwt(token)\n\n  if (!payload.clientKey || typeof payload.clientKey !== 'string') {\n    throw new Error('Invalid token payload: clientKey is missing')\n  }\n\n  return {\n    clientKey: payload.clientKey as string,\n    iat: payload.iat,\n    exp: payload.exp,\n  }\n}\n\n// ============================================================================\n// API Key Utilities\n// ============================================================================\n\n/**\n * Creates a Base64-encoded API key from clientKey and secretKey.\n * Use this for MCP server authentication.\n *\n * @param clientKey - Client API key\n * @param secretKey - Secret key\n * @returns Base64-encoded API key\n *\n * @example\n * ```typescript\n * const apiKey = createApiKey('client-key', 'secret-key')\n * // Use in x-api-key header\n * ```\n */\nexport function createApiKey(clientKey: string, secretKey: string): string {\n  if (!clientKey || !secretKey) {\n    throw new Error('clientKey and secretKey are required.')\n  }\n\n  // Browser와 Node.js 모두 지원\n  if (typeof Buffer !== 'undefined') {\n    return Buffer.from(`${clientKey}:${secretKey}`).toString('base64')\n  }\n  return btoa(`${clientKey}:${secretKey}`)\n}\n\n/**\n * Parses a Base64-encoded API key to extract clientKey and secretKey.\n *\n * @param apiKey - Base64-encoded API key\n * @returns Object containing clientKey and secretKey\n * @throws Error if API key is invalid\n *\n * @example\n * ```typescript\n * const { clientKey, secretKey } = parseApiKey(apiKey)\n * ```\n */\nexport function parseApiKey(apiKey: string): {\n  clientKey: string\n  secretKey: string\n} {\n  if (!apiKey) {\n    throw new Error('apiKey is required.')\n  }\n\n  try {\n    let decoded: string\n    if (typeof Buffer !== 'undefined') {\n      decoded = Buffer.from(apiKey, 'base64').toString('utf-8')\n    } else {\n      decoded = atob(apiKey)\n    }\n\n    const colonIndex = decoded.indexOf(':')\n    if (colonIndex === -1) {\n      throw new Error('Invalid format: missing colon separator')\n    }\n\n    const clientKey = decoded.substring(0, colonIndex)\n    const secretKey = decoded.substring(colonIndex + 1)\n\n    if (!clientKey || !secretKey) {\n      throw new Error('Invalid format: empty clientKey or secretKey')\n    }\n\n    return { clientKey, secretKey }\n  } catch {\n    throw new Error('Invalid API key. Expected Base64 encoded \"clientKey:secretKey\"')\n  }\n}\n\nfunction debugLog(\n  debug: boolean | DebugConfig | undefined,\n  type: 'request' | 'response' | 'error',\n  message: string,\n  data?: unknown,\n) {\n  if (!debug) return\n\n  const shouldLog =\n    debug === true ||\n    (type === 'request' && (debug as DebugConfig).logRequests) ||\n    (type === 'response' && (debug as DebugConfig).logResponses) ||\n    (type === 'error' && (debug as DebugConfig).logErrors)\n\n  if (shouldLog) {\n    console.group(`[SDK ${type.toUpperCase()}] ${message}`)\n    if (data) console.log(data)\n    console.groupEnd()\n  }\n}\n\nfunction getErrorSuggestion(status: number): string | undefined {\n  if (status === 401) return 'Please check your authentication credentials.'\n  if (status === 404) return 'The requested resource was not found.'\n  if (status >= 500)\n    return 'A server error occurred. Please try again later.'\n  return undefined\n}\n\nasync function delay(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms))\n}\n\nexport async function _fetch(\n  url: string,\n  options?: FetchOptions,\n): Promise<Response> {\n  const {\n    clientKey,\n    secretKey,\n    timeout = DEFAULT_TIMEOUT,\n    baseUrl = API_URLS.production,\n    debug,\n    retry,\n    ...requestInit\n  } = options || {}\n\n  const retryConfig = {\n    maxRetries: retry?.maxRetries ?? 3,\n    retryableStatuses: retry?.retryableStatuses ?? DEFAULT_RETRYABLE_STATUSES,\n    retryDelay:\n      retry?.retryDelay ??\n      ((attempt: number) => Math.min(1000 * 2 ** attempt, 10000)),\n  }\n\n  // Generate JWT once before retry loop (token valid for 1h)\n  let authToken: string | undefined\n  if (secretKey && clientKey) {\n    authToken = await createServerToken(clientKey, secretKey)\n  }\n\n  let lastError: Error | undefined\n\n  for (let attempt = 0; attempt <= retryConfig.maxRetries; attempt++) {\n    try {\n      const headers = new Headers(requestInit.headers)\n\n      if (clientKey) {\n        headers.set('X-Client-Key', clientKey)\n      }\n\n      if (authToken) {\n        headers.set('Authorization', `Bearer ${authToken}`)\n      }\n\n      if (!headers.has('Content-Type') && requestInit.body) {\n        headers.set('Content-Type', 'application/json')\n      }\n\n      debugLog(debug, 'request', url, {\n        method: requestInit.method || 'GET',\n        headers: Object.fromEntries(headers.entries()),\n        attempt: attempt + 1,\n      })\n\n      const controller = new AbortController()\n      const timeoutId = setTimeout(() => controller.abort(), timeout)\n\n      const response = await fetch(`${baseUrl}${url}`, {\n        ...requestInit,\n        headers,\n        signal: controller.signal,\n      })\n\n      clearTimeout(timeoutId)\n\n      debugLog(debug, 'response', url, {\n        status: response.status,\n        statusText: response.statusText,\n        headers: Object.fromEntries(response.headers.entries()),\n      })\n\n      if (!response.ok) {\n        // Usage limit 429 — never retry (distinguished by X-Usage-Limit header)\n        if (\n          response.status === 429 &&\n          response.headers.get('X-Usage-Limit')\n        ) {\n          const limit = parseInt(response.headers.get('X-Usage-Limit') || '0', 10)\n          const current = parseInt(response.headers.get('X-Usage-Current') || '0', 10)\n          const remaining = parseInt(response.headers.get('X-Usage-Remaining') || '0', 10)\n\n          throw createUsageLimitError(\n            `Monthly API usage limit exceeded (${current.toLocaleString()}/${limit.toLocaleString()})`,\n            { limit, current, remaining },\n            { url, method: requestInit.method || 'GET', attempt: attempt + 1 },\n            'Monthly API call limit exceeded. Please upgrade your plan.',\n            'Upgrade your tenant plan to increase the monthly API call limit.',\n          )\n        }\n\n        // Never retry non-retryable statuses regardless of user config\n        if (NON_RETRYABLE_STATUSES.includes(response.status)) {\n          throw createNetworkError(\n            `HTTP ${response.status}: ${response.statusText}`,\n            response.status,\n            { url, method: requestInit.method || 'GET', attempt: attempt + 1 },\n            `Request failed (status: ${response.status})`,\n            getErrorSuggestion(response.status),\n          )\n        }\n\n        const error = createNetworkError(\n          `HTTP ${response.status}: ${response.statusText}`,\n          response.status,\n          { url, method: requestInit.method || 'GET', attempt: attempt + 1 },\n          `Request failed (status: ${response.status})`,\n          getErrorSuggestion(response.status),\n        )\n\n        if (\n          attempt < retryConfig.maxRetries &&\n          retryConfig.retryableStatuses.includes(response.status)\n        ) {\n          lastError = error\n          const retryDelay = retryConfig.retryDelay(attempt)\n          debugLog(debug, 'error', `Retrying in ${retryDelay}ms...`, error)\n          await delay(retryDelay)\n          continue\n        }\n\n        throw error\n      }\n\n      return response\n    } catch (error) {\n      debugLog(debug, 'error', url, error)\n\n      if (error instanceof Error && error.name === 'AbortError') {\n        const timeoutError = createTimeoutError(\n          `Request timed out after ${timeout}ms.`,\n          { url, timeout, attempt: attempt + 1 },\n          'The request timed out.',\n          'Please check your network connection or try again later.',\n        )\n\n        if (attempt < retryConfig.maxRetries) {\n          lastError = timeoutError\n          await delay(retryConfig.retryDelay(attempt))\n          continue\n        }\n\n        throw timeoutError\n      }\n\n      if (error instanceof TypeError) {\n        const networkError = createNetworkError(\n          'Network connection failed.',\n          undefined,\n          { url, originalError: error.message, attempt: attempt + 1 },\n          'Network connection failed.',\n          'Please check your internet connection and try again.',\n        )\n\n        if (attempt < retryConfig.maxRetries) {\n          lastError = networkError\n          await delay(retryConfig.retryDelay(attempt))\n          continue\n        }\n\n        throw networkError\n      }\n\n      if (error instanceof NetworkError || error instanceof TimeoutError) {\n        if (\n          attempt < retryConfig.maxRetries &&\n          error.status &&\n          !NON_RETRYABLE_STATUSES.includes(error.status) &&\n          retryConfig.retryableStatuses.includes(error.status)\n        ) {\n          lastError = error\n          await delay(retryConfig.retryDelay(attempt))\n          continue\n        }\n\n        throw error\n      }\n\n      const unknownError = createNetworkError(\n        error instanceof Error\n          ? error.message\n          : 'An unknown network error occurred.',\n        undefined,\n        { url, originalError: error, attempt: attempt + 1 },\n        'An unknown error occurred.',\n        'Please try again later.',\n      )\n\n      if (attempt < retryConfig.maxRetries) {\n        lastError = unknownError\n        await delay(retryConfig.retryDelay(attempt))\n        continue\n      }\n\n      throw unknownError\n    }\n  }\n\n  throw lastError!\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,kBAA8C;AAuC9C,SAAsB,kBACpB,WACA,WACA,YAAoB,MACH;AAAA;AACjB,QAAI,CAAC,aAAa,CAAC,WAAW;AAC5B,YAAM,IAAI,MAAM,uCAAuC;AAAA,IACzD;AAEA,UAAM,SAAS,IAAI,YAAY,EAAE,OAAO,SAAS;AACjD,WAAO,IAAI,oBAAQ,EAAE,UAAU,CAAC,EAC7B,mBAAmB,EAAE,KAAK,QAAQ,CAAC,EACnC,YAAY,EACZ,kBAAkB,SAAS,EAC3B,KAAK,MAAM;AAAA,EAChB;AAAA;AAgBA,SAAsB,kBACpB,OACA,WACqB;AAAA;AACrB,QAAI,CAAC,SAAS,CAAC,WAAW;AACxB,YAAM,IAAI,MAAM,mCAAmC;AAAA,IACrD;AAEA,UAAM,SAAS,IAAI,YAAY,EAAE,OAAO,SAAS;AACjD,UAAM,EAAE,QAAQ,IAAI,UAAM,uBAAU,OAAO,QAAQ;AAAA,MACjD,YAAY,CAAC,OAAO;AAAA,IACtB,CAAC;AAED,QAAI,CAAC,QAAQ,aAAa,OAAO,QAAQ,cAAc,UAAU;AAC/D,YAAM,IAAI,MAAM,6CAA6C;AAAA,IAC/D;AAEA,WAAO;AAAA,MACL,WAAW,QAAQ;AAAA,MACnB,KAAK,QAAQ;AAAA,MACb,KAAK,QAAQ;AAAA,IACf;AAAA,EACF;AAAA;AAgBO,SAAS,kBAAkB,OAA2B;AAC3D,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,oBAAoB;AAAA,EACtC;AAEA,QAAM,cAAU,uBAAU,KAAK;AAE/B,MAAI,CAAC,QAAQ,aAAa,OAAO,QAAQ,cAAc,UAAU;AAC/D,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AAEA,SAAO;AAAA,IACL,WAAW,QAAQ;AAAA,IACnB,KAAK,QAAQ;AAAA,IACb,KAAK,QAAQ;AAAA,EACf;AACF;AAoBO,SAAS,aAAa,WAAmB,WAA2B;AACzE,MAAI,CAAC,aAAa,CAAC,WAAW;AAC5B,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACzD;AAGA,MAAI,OAAO,WAAW,aAAa;AACjC,WAAO,OAAO,KAAK,GAAG,SAAS,IAAI,SAAS,EAAE,EAAE,SAAS,QAAQ;AAAA,EACnE;AACA,SAAO,KAAK,GAAG,SAAS,IAAI,SAAS,EAAE;AACzC;AAcO,SAAS,YAAY,QAG1B;AACA,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,qBAAqB;AAAA,EACvC;AAEA,MAAI;AACF,QAAI;AACJ,QAAI,OAAO,WAAW,aAAa;AACjC,gBAAU,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,OAAO;AAAA,IAC1D,OAAO;AACL,gBAAU,KAAK,MAAM;AAAA,IACvB;AAEA,UAAM,aAAa,QAAQ,QAAQ,GAAG;AACtC,QAAI,eAAe,IAAI;AACrB,YAAM,IAAI,MAAM,yCAAyC;AAAA,IAC3D;AAEA,UAAM,YAAY,QAAQ,UAAU,GAAG,UAAU;AACjD,UAAM,YAAY,QAAQ,UAAU,aAAa,CAAC;AAElD,QAAI,CAAC,aAAa,CAAC,WAAW;AAC5B,YAAM,IAAI,MAAM,8CAA8C;AAAA,IAChE;AAEA,WAAO,EAAE,WAAW,UAAU;AAAA,EAChC,SAAQ;AACN,UAAM,IAAI,MAAM,gEAAgE;AAAA,EAClF;AACF;","names":[]}
+{"version":3,"sources":["../src/auth.ts","../src/core/internal/utils/index.ts"],"sourcesContent":["export type { JwtPayload } from './core/internal/utils'\nexport {\n  createServerToken,\n  verifyServerToken,\n  decodeServerToken,\n  createApiKey,\n  parseApiKey,\n} from './core/internal/utils'\n","import { SignJWT, jwtVerify, decodeJwt } from 'jose'\nimport { createNetworkError, createUsageLimitError, createTimeoutError, TimeoutError, NetworkError } from '../errors'\nimport type { DebugConfig, RetryConfig } from '../../client/types'\nimport { API_URLS } from '../../client/types'\n\nconst DEFAULT_TIMEOUT = 30000\nconst DEFAULT_RETRYABLE_STATUSES = [408, 429, 500, 502, 503, 504]\nconst NON_RETRYABLE_STATUSES = [401, 403, 404, 422]\nconst SAFE_METHODS = ['GET', 'HEAD', 'OPTIONS']\n\nexport interface FetchOptions extends RequestInit {\n  clientKey?: string\n  secretKey?: string\n  customerToken?: string\n  timeout?: number\n  baseUrl?: string\n  debug?: boolean | DebugConfig\n  retry?: RetryConfig\n}\n\nexport interface JwtPayload {\n  clientKey: string\n  iat?: number\n  exp?: number\n}\n\n/**\n * Creates a JWT token for server-side authentication.\n * The token is valid for 1 hour by default.\n *\n * @param clientKey - Client API key\n * @param secretKey - Secret key used for signing\n * @param expiresIn - Token expiration time (default: '1h')\n * @returns Promise<string> JWT token\n *\n * @example\n * ```typescript\n * const token = await createServerToken('client-key', 'secret-key')\n * // Use in Authorization header: `Bearer ${token}`\n * ```\n */\nexport async function createServerToken(\n  clientKey: string,\n  secretKey: string,\n  expiresIn: string = '1h',\n): Promise<string> {\n  if (!clientKey || !secretKey) {\n    throw new Error('clientKey and secretKey are required.')\n  }\n\n  const secret = new TextEncoder().encode(secretKey)\n  return new SignJWT({ clientKey })\n    .setProtectedHeader({ alg: 'HS256' })\n    .setIssuedAt()\n    .setExpirationTime(expiresIn)\n    .sign(secret)\n}\n\n/**\n * Verifies a JWT token and returns the payload.\n *\n * @param token - JWT token to verify\n * @param secretKey - Secret key used for verification\n * @returns Promise<JwtPayload> Verified payload containing clientKey\n * @throws Error if token is invalid or expired\n *\n * @example\n * ```typescript\n * const payload = await verifyServerToken(token, 'secret-key')\n * console.log(payload.clientKey)\n * ```\n */\nexport async function verifyServerToken(\n  token: string,\n  secretKey: string,\n): Promise<JwtPayload> {\n  if (!token || !secretKey) {\n    throw new Error('token and secretKey are required.')\n  }\n\n  const secret = new TextEncoder().encode(secretKey)\n  const { payload } = await jwtVerify(token, secret, {\n    algorithms: ['HS256'],\n  })\n\n  if (!payload.clientKey || typeof payload.clientKey !== 'string') {\n    throw new Error('Invalid token payload: clientKey is missing')\n  }\n\n  return {\n    clientKey: payload.clientKey as string,\n    iat: payload.iat,\n    exp: payload.exp,\n  }\n}\n\n/**\n * Decodes a JWT token without verification.\n * WARNING: Use this only when you need to inspect token contents.\n * Always use verifyServerToken for authentication.\n *\n * @param token - JWT token to decode\n * @returns JwtPayload Decoded payload (unverified)\n *\n * @example\n * ```typescript\n * const payload = decodeServerToken(token)\n * console.log(payload.clientKey) // Unverified!\n * ```\n */\nexport function decodeServerToken(token: string): JwtPayload {\n  if (!token) {\n    throw new Error('token is required.')\n  }\n\n  const payload = decodeJwt(token)\n\n  if (!payload.clientKey || typeof payload.clientKey !== 'string') {\n    throw new Error('Invalid token payload: clientKey is missing')\n  }\n\n  return {\n    clientKey: payload.clientKey as string,\n    iat: payload.iat,\n    exp: payload.exp,\n  }\n}\n\n// ============================================================================\n// API Key Utilities\n// ============================================================================\n\n/**\n * Creates a Base64-encoded API key from clientKey and secretKey.\n * Use this for MCP server authentication.\n *\n * @param clientKey - Client API key\n * @param secretKey - Secret key\n * @returns Base64-encoded API key\n *\n * @example\n * ```typescript\n * const apiKey = createApiKey('client-key', 'secret-key')\n * // Use in x-api-key header\n * ```\n */\nexport function createApiKey(clientKey: string, secretKey: string): string {\n  if (!clientKey || !secretKey) {\n    throw new Error('clientKey and secretKey are required.')\n  }\n\n  // Browser와 Node.js 모두 지원\n  if (typeof Buffer !== 'undefined') {\n    return Buffer.from(`${clientKey}:${secretKey}`).toString('base64')\n  }\n  return btoa(`${clientKey}:${secretKey}`)\n}\n\n/**\n * Parses a Base64-encoded API key to extract clientKey and secretKey.\n *\n * @param apiKey - Base64-encoded API key\n * @returns Object containing clientKey and secretKey\n * @throws Error if API key is invalid\n *\n * @example\n * ```typescript\n * const { clientKey, secretKey } = parseApiKey(apiKey)\n * ```\n */\nexport function parseApiKey(apiKey: string): {\n  clientKey: string\n  secretKey: string\n} {\n  if (!apiKey) {\n    throw new Error('apiKey is required.')\n  }\n\n  try {\n    let decoded: string\n    if (typeof Buffer !== 'undefined') {\n      decoded = Buffer.from(apiKey, 'base64').toString('utf-8')\n    } else {\n      decoded = atob(apiKey)\n    }\n\n    const colonIndex = decoded.indexOf(':')\n    if (colonIndex === -1) {\n      throw new Error('Invalid format: missing colon separator')\n    }\n\n    const clientKey = decoded.substring(0, colonIndex)\n    const secretKey = decoded.substring(colonIndex + 1)\n\n    if (!clientKey || !secretKey) {\n      throw new Error('Invalid format: empty clientKey or secretKey')\n    }\n\n    return { clientKey, secretKey }\n  } catch {\n    throw new Error('Invalid API key. Expected Base64 encoded \"clientKey:secretKey\"')\n  }\n}\n\nfunction debugLog(\n  debug: boolean | DebugConfig | undefined,\n  type: 'request' | 'response' | 'error',\n  message: string,\n  data?: unknown,\n) {\n  if (!debug) return\n\n  const shouldLog =\n    debug === true ||\n    (type === 'request' && (debug as DebugConfig).logRequests) ||\n    (type === 'response' && (debug as DebugConfig).logResponses) ||\n    (type === 'error' && (debug as DebugConfig).logErrors)\n\n  if (shouldLog) {\n    console.group(`[SDK ${type.toUpperCase()}] ${message}`)\n    if (data) console.log(data)\n    console.groupEnd()\n  }\n}\n\nfunction getErrorSuggestion(status: number): string | undefined {\n  if (status === 401) return 'Please check your authentication credentials.'\n  if (status === 404) return 'The requested resource was not found.'\n  if (status >= 500)\n    return 'A server error occurred. Please try again later.'\n  return undefined\n}\n\nasync function delay(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms))\n}\n\nexport async function _fetch(\n  url: string,\n  options?: FetchOptions,\n): Promise<Response> {\n  const {\n    clientKey,\n    secretKey,\n    customerToken,\n    timeout = DEFAULT_TIMEOUT,\n    baseUrl = API_URLS.production,\n    debug,\n    retry,\n    ...requestInit\n  } = options || {}\n\n  const retryConfig = {\n    maxRetries: retry?.maxRetries ?? 3,\n    retryableStatuses: retry?.retryableStatuses ?? DEFAULT_RETRYABLE_STATUSES,\n    retryDelay:\n      retry?.retryDelay ??\n      ((attempt: number) => Math.min(1000 * 2 ** attempt, 10000)),\n  }\n\n  // Generate JWT once before retry loop (token valid for 1h)\n  let authToken: string | undefined\n  if (secretKey && clientKey) {\n    authToken = await createServerToken(clientKey, secretKey)\n  } else if (customerToken) {\n    authToken = customerToken\n  }\n\n  let lastError: Error | undefined\n\n  for (let attempt = 0; attempt <= retryConfig.maxRetries; attempt++) {\n    try {\n      const headers = new Headers(requestInit.headers)\n\n      if (clientKey) {\n        headers.set('X-Client-Key', clientKey)\n      }\n\n      if (authToken) {\n        headers.set('Authorization', `Bearer ${authToken}`)\n      }\n\n      if (!headers.has('Content-Type') && requestInit.body) {\n        headers.set('Content-Type', 'application/json')\n      }\n\n      // Redact sensitive headers for debug logging\n      const redactedHeaders = Object.fromEntries(headers.entries())\n      if (redactedHeaders['authorization']) {\n        const token = redactedHeaders['authorization']\n        // Show only \"Bearer eyJ...****\" to aid debugging without exposing the full token\n        redactedHeaders['authorization'] = token.length > 15\n          ? `${token.slice(0, 15)}...****`\n          : '****'\n      }\n\n      debugLog(debug, 'request', url, {\n        method: requestInit.method || 'GET',\n        headers: redactedHeaders,\n        attempt: attempt + 1,\n      })\n\n      const controller = new AbortController()\n      const timeoutId = setTimeout(() => controller.abort(), timeout)\n\n      const response = await fetch(`${baseUrl}${url}`, {\n        ...requestInit,\n        headers,\n        signal: controller.signal,\n      })\n\n      clearTimeout(timeoutId)\n\n      debugLog(debug, 'response', url, {\n        status: response.status,\n        statusText: response.statusText,\n        headers: Object.fromEntries(response.headers.entries()),\n      })\n\n      if (!response.ok) {\n        // Usage limit 429 — never retry (distinguished by X-Usage-Limit header)\n        if (\n          response.status === 429 &&\n          response.headers.get('X-Usage-Limit')\n        ) {\n          const limit = parseInt(response.headers.get('X-Usage-Limit') || '0', 10)\n          const current = parseInt(response.headers.get('X-Usage-Current') || '0', 10)\n          const remaining = parseInt(response.headers.get('X-Usage-Remaining') || '0', 10)\n\n          throw createUsageLimitError(\n            `Monthly API usage limit exceeded (${current.toLocaleString()}/${limit.toLocaleString()})`,\n            { limit, current, remaining },\n            { url, method: requestInit.method || 'GET', attempt: attempt + 1 },\n            'Monthly API call limit exceeded. Please upgrade your plan.',\n            'Upgrade your tenant plan to increase the monthly API call limit.',\n          )\n        }\n\n        // Never retry non-retryable statuses regardless of user config\n        if (NON_RETRYABLE_STATUSES.includes(response.status)) {\n          throw createNetworkError(\n            `HTTP ${response.status}: ${response.statusText}`,\n            response.status,\n            { url, method: requestInit.method || 'GET', attempt: attempt + 1 },\n            `Request failed (status: ${response.status})`,\n            getErrorSuggestion(response.status),\n          )\n        }\n\n        const error = createNetworkError(\n          `HTTP ${response.status}: ${response.statusText}`,\n          response.status,\n          { url, method: requestInit.method || 'GET', attempt: attempt + 1 },\n          `Request failed (status: ${response.status})`,\n          getErrorSuggestion(response.status),\n        )\n\n        const method = (requestInit.method || 'GET').toUpperCase()\n        if (\n          attempt < retryConfig.maxRetries &&\n          SAFE_METHODS.includes(method) &&\n          retryConfig.retryableStatuses.includes(response.status)\n        ) {\n          lastError = error\n          const retryDelay = retryConfig.retryDelay(attempt)\n          debugLog(debug, 'error', `Retrying in ${retryDelay}ms...`, error)\n          await delay(retryDelay)\n          continue\n        }\n\n        throw error\n      }\n\n      return response\n    } catch (error) {\n      debugLog(debug, 'error', url, error)\n\n      const method = (requestInit.method || 'GET').toUpperCase()\n      const isSafe = SAFE_METHODS.includes(method)\n\n      if (error instanceof Error && error.name === 'AbortError') {\n        const timeoutError = createTimeoutError(\n          `Request timed out after ${timeout}ms.`,\n          { url, timeout, attempt: attempt + 1 },\n          'The request timed out.',\n          'Please check your network connection or try again later.',\n        )\n\n        if (isSafe && attempt < retryConfig.maxRetries) {\n          lastError = timeoutError\n          await delay(retryConfig.retryDelay(attempt))\n          continue\n        }\n\n        throw timeoutError\n      }\n\n      if (error instanceof TypeError) {\n        const networkError = createNetworkError(\n          'Network connection failed.',\n          undefined,\n          { url, originalError: error.message, attempt: attempt + 1 },\n          'Network connection failed.',\n          'Please check your internet connection and try again.',\n        )\n\n        if (isSafe && attempt < retryConfig.maxRetries) {\n          lastError = networkError\n          await delay(retryConfig.retryDelay(attempt))\n          continue\n        }\n\n        throw networkError\n      }\n\n      if (error instanceof NetworkError || error instanceof TimeoutError) {\n        if (\n          isSafe &&\n          attempt < retryConfig.maxRetries &&\n          error.status &&\n          !NON_RETRYABLE_STATUSES.includes(error.status) &&\n          retryConfig.retryableStatuses.includes(error.status)\n        ) {\n          lastError = error\n          await delay(retryConfig.retryDelay(attempt))\n          continue\n        }\n\n        throw error\n      }\n\n      const unknownError = createNetworkError(\n        error instanceof Error\n          ? error.message\n          : 'An unknown network error occurred.',\n        undefined,\n        { url, originalError: error, attempt: attempt + 1 },\n        'An unknown error occurred.',\n        'Please try again later.',\n      )\n\n      if (isSafe && attempt < retryConfig.maxRetries) {\n        lastError = unknownError\n        await delay(retryConfig.retryDelay(attempt))\n        continue\n      }\n\n      throw unknownError\n    }\n  }\n\n  throw lastError ?? new NetworkError('Request failed after retries')\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,kBAA8C;AAyC9C,SAAsB,kBACpB,WACA,WACA,YAAoB,MACH;AAAA;AACjB,QAAI,CAAC,aAAa,CAAC,WAAW;AAC5B,YAAM,IAAI,MAAM,uCAAuC;AAAA,IACzD;AAEA,UAAM,SAAS,IAAI,YAAY,EAAE,OAAO,SAAS;AACjD,WAAO,IAAI,oBAAQ,EAAE,UAAU,CAAC,EAC7B,mBAAmB,EAAE,KAAK,QAAQ,CAAC,EACnC,YAAY,EACZ,kBAAkB,SAAS,EAC3B,KAAK,MAAM;AAAA,EAChB;AAAA;AAgBA,SAAsB,kBACpB,OACA,WACqB;AAAA;AACrB,QAAI,CAAC,SAAS,CAAC,WAAW;AACxB,YAAM,IAAI,MAAM,mCAAmC;AAAA,IACrD;AAEA,UAAM,SAAS,IAAI,YAAY,EAAE,OAAO,SAAS;AACjD,UAAM,EAAE,QAAQ,IAAI,UAAM,uBAAU,OAAO,QAAQ;AAAA,MACjD,YAAY,CAAC,OAAO;AAAA,IACtB,CAAC;AAED,QAAI,CAAC,QAAQ,aAAa,OAAO,QAAQ,cAAc,UAAU;AAC/D,YAAM,IAAI,MAAM,6CAA6C;AAAA,IAC/D;AAEA,WAAO;AAAA,MACL,WAAW,QAAQ;AAAA,MACnB,KAAK,QAAQ;AAAA,MACb,KAAK,QAAQ;AAAA,IACf;AAAA,EACF;AAAA;AAgBO,SAAS,kBAAkB,OAA2B;AAC3D,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,oBAAoB;AAAA,EACtC;AAEA,QAAM,cAAU,uBAAU,KAAK;AAE/B,MAAI,CAAC,QAAQ,aAAa,OAAO,QAAQ,cAAc,UAAU;AAC/D,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AAEA,SAAO;AAAA,IACL,WAAW,QAAQ;AAAA,IACnB,KAAK,QAAQ;AAAA,IACb,KAAK,QAAQ;AAAA,EACf;AACF;AAoBO,SAAS,aAAa,WAAmB,WAA2B;AACzE,MAAI,CAAC,aAAa,CAAC,WAAW;AAC5B,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACzD;AAGA,MAAI,OAAO,WAAW,aAAa;AACjC,WAAO,OAAO,KAAK,GAAG,SAAS,IAAI,SAAS,EAAE,EAAE,SAAS,QAAQ;AAAA,EACnE;AACA,SAAO,KAAK,GAAG,SAAS,IAAI,SAAS,EAAE;AACzC;AAcO,SAAS,YAAY,QAG1B;AACA,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,qBAAqB;AAAA,EACvC;AAEA,MAAI;AACF,QAAI;AACJ,QAAI,OAAO,WAAW,aAAa;AACjC,gBAAU,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,OAAO;AAAA,IAC1D,OAAO;AACL,gBAAU,KAAK,MAAM;AAAA,IACvB;AAEA,UAAM,aAAa,QAAQ,QAAQ,GAAG;AACtC,QAAI,eAAe,IAAI;AACrB,YAAM,IAAI,MAAM,yCAAyC;AAAA,IAC3D;AAEA,UAAM,YAAY,QAAQ,UAAU,GAAG,UAAU;AACjD,UAAM,YAAY,QAAQ,UAAU,aAAa,CAAC;AAElD,QAAI,CAAC,aAAa,CAAC,WAAW;AAC5B,YAAM,IAAI,MAAM,8CAA8C;AAAA,IAChE;AAEA,WAAO,EAAE,WAAW,UAAU;AAAA,EAChC,SAAQ;AACN,UAAM,IAAI,MAAM,gEAAgE;AAAA,EAClF;AACF;","names":[]}

package/dist/auth.d.cts

@@ -1,3 +1,3 @@
-export { J as JwtPayload, q as createApiKey, o as createServerToken, p as decodeServerToken, r as parseApiKey, v as verifyServerToken } from './auth-DMvniYSs.cjs';
+export { J as JwtPayload, q as createApiKey, o as createServerToken, p as decodeServerToken, r as parseApiKey, v as verifyServerToken } from './auth-Cl6xQinU.cjs';
 import 'payload';
-import './payload-types-BAZCcssT.cjs';
+import './payload-types-9ZTBbiqb.cjs';

package/dist/auth.d.ts

@@ -1,3 +1,3 @@
-export { J as JwtPayload, q as createApiKey, o as createServerToken, p as decodeServerToken, r as parseApiKey, v as verifyServerToken } from './auth-DNaV-5wt.js';
+export { J as JwtPayload, q as createApiKey, o as createServerToken, p as decodeServerToken, r as parseApiKey, v as verifyServerToken } from './auth-u5YEtV1J.js';
 import 'payload';
-import './payload-types-BAZCcssT.js';
+import './payload-types-9ZTBbiqb.js';

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/core/internal/utils/index.ts"],"sourcesContent":["import { SignJWT, jwtVerify, decodeJwt } from 'jose'\nimport { createNetworkError, createUsageLimitError, createTimeoutError, TimeoutError, NetworkError } from '../errors'\nimport type { DebugConfig, RetryConfig } from '../../client/types'\nimport { API_URLS } from '../../client/types'\n\nconst DEFAULT_TIMEOUT = 30000\nconst DEFAULT_RETRYABLE_STATUSES = [408, 429, 500, 502, 503, 504]\nconst NON_RETRYABLE_STATUSES = [401, 403, 404, 422]\n\nexport interface FetchOptions extends RequestInit {\n  clientKey?: string\n  secretKey?: string\n  timeout?: number\n  baseUrl?: string\n  debug?: boolean | DebugConfig\n  retry?: RetryConfig\n}\n\nexport interface JwtPayload {\n  clientKey: string\n  iat?: number\n  exp?: number\n}\n\n/**\n * Creates a JWT token for server-side authentication.\n * The token is valid for 1 hour by default.\n *\n * @param clientKey - Client API key\n * @param secretKey - Secret key used for signing\n * @param expiresIn - Token expiration time (default: '1h')\n * @returns Promise<string> JWT token\n *\n * @example\n * ```typescript\n * const token = await createServerToken('client-key', 'secret-key')\n * // Use in Authorization header: `Bearer ${token}`\n * ```\n */\nexport async function createServerToken(\n  clientKey: string,\n  secretKey: string,\n  expiresIn: string = '1h',\n): Promise<string> {\n  if (!clientKey || !secretKey) {\n    throw new Error('clientKey and secretKey are required.')\n  }\n\n  const secret = new TextEncoder().encode(secretKey)\n  return new SignJWT({ clientKey })\n    .setProtectedHeader({ alg: 'HS256' })\n    .setIssuedAt()\n    .setExpirationTime(expiresIn)\n    .sign(secret)\n}\n\n/**\n * Verifies a JWT token and returns the payload.\n *\n * @param token - JWT token to verify\n * @param secretKey - Secret key used for verification\n * @returns Promise<JwtPayload> Verified payload containing clientKey\n * @throws Error if token is invalid or expired\n *\n * @example\n * ```typescript\n * const payload = await verifyServerToken(token, 'secret-key')\n * console.log(payload.clientKey)\n * ```\n */\nexport async function verifyServerToken(\n  token: string,\n  secretKey: string,\n): Promise<JwtPayload> {\n  if (!token || !secretKey) {\n    throw new Error('token and secretKey are required.')\n  }\n\n  const secret = new TextEncoder().encode(secretKey)\n  const { payload } = await jwtVerify(token, secret, {\n    algorithms: ['HS256'],\n  })\n\n  if (!payload.clientKey || typeof payload.clientKey !== 'string') {\n    throw new Error('Invalid token payload: clientKey is missing')\n  }\n\n  return {\n    clientKey: payload.clientKey as string,\n    iat: payload.iat,\n    exp: payload.exp,\n  }\n}\n\n/**\n * Decodes a JWT token without verification.\n * WARNING: Use this only when you need to inspect token contents.\n * Always use verifyServerToken for authentication.\n *\n * @param token - JWT token to decode\n * @returns JwtPayload Decoded payload (unverified)\n *\n * @example\n * ```typescript\n * const payload = decodeServerToken(token)\n * console.log(payload.clientKey) // Unverified!\n * ```\n */\nexport function decodeServerToken(token: string): JwtPayload {\n  if (!token) {\n    throw new Error('token is required.')\n  }\n\n  const payload = decodeJwt(token)\n\n  if (!payload.clientKey || typeof payload.clientKey !== 'string') {\n    throw new Error('Invalid token payload: clientKey is missing')\n  }\n\n  return {\n    clientKey: payload.clientKey as string,\n    iat: payload.iat,\n    exp: payload.exp,\n  }\n}\n\n// ============================================================================\n// API Key Utilities\n// ============================================================================\n\n/**\n * Creates a Base64-encoded API key from clientKey and secretKey.\n * Use this for MCP server authentication.\n *\n * @param clientKey - Client API key\n * @param secretKey - Secret key\n * @returns Base64-encoded API key\n *\n * @example\n * ```typescript\n * const apiKey = createApiKey('client-key', 'secret-key')\n * // Use in x-api-key header\n * ```\n */\nexport function createApiKey(clientKey: string, secretKey: string): string {\n  if (!clientKey || !secretKey) {\n    throw new Error('clientKey and secretKey are required.')\n  }\n\n  // Browser와 Node.js 모두 지원\n  if (typeof Buffer !== 'undefined') {\n    return Buffer.from(`${clientKey}:${secretKey}`).toString('base64')\n  }\n  return btoa(`${clientKey}:${secretKey}`)\n}\n\n/**\n * Parses a Base64-encoded API key to extract clientKey and secretKey.\n *\n * @param apiKey - Base64-encoded API key\n * @returns Object containing clientKey and secretKey\n * @throws Error if API key is invalid\n *\n * @example\n * ```typescript\n * const { clientKey, secretKey } = parseApiKey(apiKey)\n * ```\n */\nexport function parseApiKey(apiKey: string): {\n  clientKey: string\n  secretKey: string\n} {\n  if (!apiKey) {\n    throw new Error('apiKey is required.')\n  }\n\n  try {\n    let decoded: string\n    if (typeof Buffer !== 'undefined') {\n      decoded = Buffer.from(apiKey, 'base64').toString('utf-8')\n    } else {\n      decoded = atob(apiKey)\n    }\n\n    const colonIndex = decoded.indexOf(':')\n    if (colonIndex === -1) {\n      throw new Error('Invalid format: missing colon separator')\n    }\n\n    const clientKey = decoded.substring(0, colonIndex)\n    const secretKey = decoded.substring(colonIndex + 1)\n\n    if (!clientKey || !secretKey) {\n      throw new Error('Invalid format: empty clientKey or secretKey')\n    }\n\n    return { clientKey, secretKey }\n  } catch {\n    throw new Error('Invalid API key. Expected Base64 encoded \"clientKey:secretKey\"')\n  }\n}\n\nfunction debugLog(\n  debug: boolean | DebugConfig | undefined,\n  type: 'request' | 'response' | 'error',\n  message: string,\n  data?: unknown,\n) {\n  if (!debug) return\n\n  const shouldLog =\n    debug === true ||\n    (type === 'request' && (debug as DebugConfig).logRequests) ||\n    (type === 'response' && (debug as DebugConfig).logResponses) ||\n    (type === 'error' && (debug as DebugConfig).logErrors)\n\n  if (shouldLog) {\n    console.group(`[SDK ${type.toUpperCase()}] ${message}`)\n    if (data) console.log(data)\n    console.groupEnd()\n  }\n}\n\nfunction getErrorSuggestion(status: number): string | undefined {\n  if (status === 401) return 'Please check your authentication credentials.'\n  if (status === 404) return 'The requested resource was not found.'\n  if (status >= 500)\n    return 'A server error occurred. Please try again later.'\n  return undefined\n}\n\nasync function delay(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms))\n}\n\nexport async function _fetch(\n  url: string,\n  options?: FetchOptions,\n): Promise<Response> {\n  const {\n    clientKey,\n    secretKey,\n    timeout = DEFAULT_TIMEOUT,\n    baseUrl = API_URLS.production,\n    debug,\n    retry,\n    ...requestInit\n  } = options || {}\n\n  const retryConfig = {\n    maxRetries: retry?.maxRetries ?? 3,\n    retryableStatuses: retry?.retryableStatuses ?? DEFAULT_RETRYABLE_STATUSES,\n    retryDelay:\n      retry?.retryDelay ??\n      ((attempt: number) => Math.min(1000 * 2 ** attempt, 10000)),\n  }\n\n  // Generate JWT once before retry loop (token valid for 1h)\n  let authToken: string | undefined\n  if (secretKey && clientKey) {\n    authToken = await createServerToken(clientKey, secretKey)\n  }\n\n  let lastError: Error | undefined\n\n  for (let attempt = 0; attempt <= retryConfig.maxRetries; attempt++) {\n    try {\n      const headers = new Headers(requestInit.headers)\n\n      if (clientKey) {\n        headers.set('X-Client-Key', clientKey)\n      }\n\n      if (authToken) {\n        headers.set('Authorization', `Bearer ${authToken}`)\n      }\n\n      if (!headers.has('Content-Type') && requestInit.body) {\n        headers.set('Content-Type', 'application/json')\n      }\n\n      debugLog(debug, 'request', url, {\n        method: requestInit.method || 'GET',\n        headers: Object.fromEntries(headers.entries()),\n        attempt: attempt + 1,\n      })\n\n      const controller = new AbortController()\n      const timeoutId = setTimeout(() => controller.abort(), timeout)\n\n      const response = await fetch(`${baseUrl}${url}`, {\n        ...requestInit,\n        headers,\n        signal: controller.signal,\n      })\n\n      clearTimeout(timeoutId)\n\n      debugLog(debug, 'response', url, {\n        status: response.status,\n        statusText: response.statusText,\n        headers: Object.fromEntries(response.headers.entries()),\n      })\n\n      if (!response.ok) {\n        // Usage limit 429 — never retry (distinguished by X-Usage-Limit header)\n        if (\n          response.status === 429 &&\n          response.headers.get('X-Usage-Limit')\n        ) {\n          const limit = parseInt(response.headers.get('X-Usage-Limit') || '0', 10)\n          const current = parseInt(response.headers.get('X-Usage-Current') || '0', 10)\n          const remaining = parseInt(response.headers.get('X-Usage-Remaining') || '0', 10)\n\n          throw createUsageLimitError(\n            `Monthly API usage limit exceeded (${current.toLocaleString()}/${limit.toLocaleString()})`,\n            { limit, current, remaining },\n            { url, method: requestInit.method || 'GET', attempt: attempt + 1 },\n            'Monthly API call limit exceeded. Please upgrade your plan.',\n            'Upgrade your tenant plan to increase the monthly API call limit.',\n          )\n        }\n\n        // Never retry non-retryable statuses regardless of user config\n        if (NON_RETRYABLE_STATUSES.includes(response.status)) {\n          throw createNetworkError(\n            `HTTP ${response.status}: ${response.statusText}`,\n            response.status,\n            { url, method: requestInit.method || 'GET', attempt: attempt + 1 },\n            `Request failed (status: ${response.status})`,\n            getErrorSuggestion(response.status),\n          )\n        }\n\n        const error = createNetworkError(\n          `HTTP ${response.status}: ${response.statusText}`,\n          response.status,\n          { url, method: requestInit.method || 'GET', attempt: attempt + 1 },\n          `Request failed (status: ${response.status})`,\n          getErrorSuggestion(response.status),\n        )\n\n        if (\n          attempt < retryConfig.maxRetries &&\n          retryConfig.retryableStatuses.includes(response.status)\n        ) {\n          lastError = error\n          const retryDelay = retryConfig.retryDelay(attempt)\n          debugLog(debug, 'error', `Retrying in ${retryDelay}ms...`, error)\n          await delay(retryDelay)\n          continue\n        }\n\n        throw error\n      }\n\n      return response\n    } catch (error) {\n      debugLog(debug, 'error', url, error)\n\n      if (error instanceof Error && error.name === 'AbortError') {\n        const timeoutError = createTimeoutError(\n          `Request timed out after ${timeout}ms.`,\n          { url, timeout, attempt: attempt + 1 },\n          'The request timed out.',\n          'Please check your network connection or try again later.',\n        )\n\n        if (attempt < retryConfig.maxRetries) {\n          lastError = timeoutError\n          await delay(retryConfig.retryDelay(attempt))\n          continue\n        }\n\n        throw timeoutError\n      }\n\n      if (error instanceof TypeError) {\n        const networkError = createNetworkError(\n          'Network connection failed.',\n          undefined,\n          { url, originalError: error.message, attempt: attempt + 1 },\n          'Network connection failed.',\n          'Please check your internet connection and try again.',\n        )\n\n        if (attempt < retryConfig.maxRetries) {\n          lastError = networkError\n          await delay(retryConfig.retryDelay(attempt))\n          continue\n        }\n\n        throw networkError\n      }\n\n      if (error instanceof NetworkError || error instanceof TimeoutError) {\n        if (\n          attempt < retryConfig.maxRetries &&\n          error.status &&\n          !NON_RETRYABLE_STATUSES.includes(error.status) &&\n          retryConfig.retryableStatuses.includes(error.status)\n        ) {\n          lastError = error\n          await delay(retryConfig.retryDelay(attempt))\n          continue\n        }\n\n        throw error\n      }\n\n      const unknownError = createNetworkError(\n        error instanceof Error\n          ? error.message\n          : 'An unknown network error occurred.',\n        undefined,\n        { url, originalError: error, attempt: attempt + 1 },\n        'An unknown error occurred.',\n        'Please try again later.',\n      )\n\n      if (attempt < retryConfig.maxRetries) {\n        lastError = unknownError\n        await delay(retryConfig.retryDelay(attempt))\n        continue\n      }\n\n      throw unknownError\n    }\n  }\n\n  throw lastError!\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS,WAAW,iBAAiB;AAuC9C,SAAsB,kBACpB,WACA,WACA,YAAoB,MACH;AAAA;AACjB,QAAI,CAAC,aAAa,CAAC,WAAW;AAC5B,YAAM,IAAI,MAAM,uCAAuC;AAAA,IACzD;AAEA,UAAM,SAAS,IAAI,YAAY,EAAE,OAAO,SAAS;AACjD,WAAO,IAAI,QAAQ,EAAE,UAAU,CAAC,EAC7B,mBAAmB,EAAE,KAAK,QAAQ,CAAC,EACnC,YAAY,EACZ,kBAAkB,SAAS,EAC3B,KAAK,MAAM;AAAA,EAChB;AAAA;AAgBA,SAAsB,kBACpB,OACA,WACqB;AAAA;AACrB,QAAI,CAAC,SAAS,CAAC,WAAW;AACxB,YAAM,IAAI,MAAM,mCAAmC;AAAA,IACrD;AAEA,UAAM,SAAS,IAAI,YAAY,EAAE,OAAO,SAAS;AACjD,UAAM,EAAE,QAAQ,IAAI,MAAM,UAAU,OAAO,QAAQ;AAAA,MACjD,YAAY,CAAC,OAAO;AAAA,IACtB,CAAC;AAED,QAAI,CAAC,QAAQ,aAAa,OAAO,QAAQ,cAAc,UAAU;AAC/D,YAAM,IAAI,MAAM,6CAA6C;AAAA,IAC/D;AAEA,WAAO;AAAA,MACL,WAAW,QAAQ;AAAA,MACnB,KAAK,QAAQ;AAAA,MACb,KAAK,QAAQ;AAAA,IACf;AAAA,EACF;AAAA;AAgBO,SAAS,kBAAkB,OAA2B;AAC3D,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,oBAAoB;AAAA,EACtC;AAEA,QAAM,UAAU,UAAU,KAAK;AAE/B,MAAI,CAAC,QAAQ,aAAa,OAAO,QAAQ,cAAc,UAAU;AAC/D,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AAEA,SAAO;AAAA,IACL,WAAW,QAAQ;AAAA,IACnB,KAAK,QAAQ;AAAA,IACb,KAAK,QAAQ;AAAA,EACf;AACF;AAoBO,SAAS,aAAa,WAAmB,WAA2B;AACzE,MAAI,CAAC,aAAa,CAAC,WAAW;AAC5B,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACzD;AAGA,MAAI,OAAO,WAAW,aAAa;AACjC,WAAO,OAAO,KAAK,GAAG,SAAS,IAAI,SAAS,EAAE,EAAE,SAAS,QAAQ;AAAA,EACnE;AACA,SAAO,KAAK,GAAG,SAAS,IAAI,SAAS,EAAE;AACzC;AAcO,SAAS,YAAY,QAG1B;AACA,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,qBAAqB;AAAA,EACvC;AAEA,MAAI;AACF,QAAI;AACJ,QAAI,OAAO,WAAW,aAAa;AACjC,gBAAU,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,OAAO;AAAA,IAC1D,OAAO;AACL,gBAAU,KAAK,MAAM;AAAA,IACvB;AAEA,UAAM,aAAa,QAAQ,QAAQ,GAAG;AACtC,QAAI,eAAe,IAAI;AACrB,YAAM,IAAI,MAAM,yCAAyC;AAAA,IAC3D;AAEA,UAAM,YAAY,QAAQ,UAAU,GAAG,UAAU;AACjD,UAAM,YAAY,QAAQ,UAAU,aAAa,CAAC;AAElD,QAAI,CAAC,aAAa,CAAC,WAAW;AAC5B,YAAM,IAAI,MAAM,8CAA8C;AAAA,IAChE;AAEA,WAAO,EAAE,WAAW,UAAU;AAAA,EAChC,SAAQ;AACN,UAAM,IAAI,MAAM,gEAAgE;AAAA,EAClF;AACF;","names":[]}
+{"version":3,"sources":["../src/core/internal/utils/index.ts"],"sourcesContent":["import { SignJWT, jwtVerify, decodeJwt } from 'jose'\nimport { createNetworkError, createUsageLimitError, createTimeoutError, TimeoutError, NetworkError } from '../errors'\nimport type { DebugConfig, RetryConfig } from '../../client/types'\nimport { API_URLS } from '../../client/types'\n\nconst DEFAULT_TIMEOUT = 30000\nconst DEFAULT_RETRYABLE_STATUSES = [408, 429, 500, 502, 503, 504]\nconst NON_RETRYABLE_STATUSES = [401, 403, 404, 422]\nconst SAFE_METHODS = ['GET', 'HEAD', 'OPTIONS']\n\nexport interface FetchOptions extends RequestInit {\n  clientKey?: string\n  secretKey?: string\n  customerToken?: string\n  timeout?: number\n  baseUrl?: string\n  debug?: boolean | DebugConfig\n  retry?: RetryConfig\n}\n\nexport interface JwtPayload {\n  clientKey: string\n  iat?: number\n  exp?: number\n}\n\n/**\n * Creates a JWT token for server-side authentication.\n * The token is valid for 1 hour by default.\n *\n * @param clientKey - Client API key\n * @param secretKey - Secret key used for signing\n * @param expiresIn - Token expiration time (default: '1h')\n * @returns Promise<string> JWT token\n *\n * @example\n * ```typescript\n * const token = await createServerToken('client-key', 'secret-key')\n * // Use in Authorization header: `Bearer ${token}`\n * ```\n */\nexport async function createServerToken(\n  clientKey: string,\n  secretKey: string,\n  expiresIn: string = '1h',\n): Promise<string> {\n  if (!clientKey || !secretKey) {\n    throw new Error('clientKey and secretKey are required.')\n  }\n\n  const secret = new TextEncoder().encode(secretKey)\n  return new SignJWT({ clientKey })\n    .setProtectedHeader({ alg: 'HS256' })\n    .setIssuedAt()\n    .setExpirationTime(expiresIn)\n    .sign(secret)\n}\n\n/**\n * Verifies a JWT token and returns the payload.\n *\n * @param token - JWT token to verify\n * @param secretKey - Secret key used for verification\n * @returns Promise<JwtPayload> Verified payload containing clientKey\n * @throws Error if token is invalid or expired\n *\n * @example\n * ```typescript\n * const payload = await verifyServerToken(token, 'secret-key')\n * console.log(payload.clientKey)\n * ```\n */\nexport async function verifyServerToken(\n  token: string,\n  secretKey: string,\n): Promise<JwtPayload> {\n  if (!token || !secretKey) {\n    throw new Error('token and secretKey are required.')\n  }\n\n  const secret = new TextEncoder().encode(secretKey)\n  const { payload } = await jwtVerify(token, secret, {\n    algorithms: ['HS256'],\n  })\n\n  if (!payload.clientKey || typeof payload.clientKey !== 'string') {\n    throw new Error('Invalid token payload: clientKey is missing')\n  }\n\n  return {\n    clientKey: payload.clientKey as string,\n    iat: payload.iat,\n    exp: payload.exp,\n  }\n}\n\n/**\n * Decodes a JWT token without verification.\n * WARNING: Use this only when you need to inspect token contents.\n * Always use verifyServerToken for authentication.\n *\n * @param token - JWT token to decode\n * @returns JwtPayload Decoded payload (unverified)\n *\n * @example\n * ```typescript\n * const payload = decodeServerToken(token)\n * console.log(payload.clientKey) // Unverified!\n * ```\n */\nexport function decodeServerToken(token: string): JwtPayload {\n  if (!token) {\n    throw new Error('token is required.')\n  }\n\n  const payload = decodeJwt(token)\n\n  if (!payload.clientKey || typeof payload.clientKey !== 'string') {\n    throw new Error('Invalid token payload: clientKey is missing')\n  }\n\n  return {\n    clientKey: payload.clientKey as string,\n    iat: payload.iat,\n    exp: payload.exp,\n  }\n}\n\n// ============================================================================\n// API Key Utilities\n// ============================================================================\n\n/**\n * Creates a Base64-encoded API key from clientKey and secretKey.\n * Use this for MCP server authentication.\n *\n * @param clientKey - Client API key\n * @param secretKey - Secret key\n * @returns Base64-encoded API key\n *\n * @example\n * ```typescript\n * const apiKey = createApiKey('client-key', 'secret-key')\n * // Use in x-api-key header\n * ```\n */\nexport function createApiKey(clientKey: string, secretKey: string): string {\n  if (!clientKey || !secretKey) {\n    throw new Error('clientKey and secretKey are required.')\n  }\n\n  // Browser와 Node.js 모두 지원\n  if (typeof Buffer !== 'undefined') {\n    return Buffer.from(`${clientKey}:${secretKey}`).toString('base64')\n  }\n  return btoa(`${clientKey}:${secretKey}`)\n}\n\n/**\n * Parses a Base64-encoded API key to extract clientKey and secretKey.\n *\n * @param apiKey - Base64-encoded API key\n * @returns Object containing clientKey and secretKey\n * @throws Error if API key is invalid\n *\n * @example\n * ```typescript\n * const { clientKey, secretKey } = parseApiKey(apiKey)\n * ```\n */\nexport function parseApiKey(apiKey: string): {\n  clientKey: string\n  secretKey: string\n} {\n  if (!apiKey) {\n    throw new Error('apiKey is required.')\n  }\n\n  try {\n    let decoded: string\n    if (typeof Buffer !== 'undefined') {\n      decoded = Buffer.from(apiKey, 'base64').toString('utf-8')\n    } else {\n      decoded = atob(apiKey)\n    }\n\n    const colonIndex = decoded.indexOf(':')\n    if (colonIndex === -1) {\n      throw new Error('Invalid format: missing colon separator')\n    }\n\n    const clientKey = decoded.substring(0, colonIndex)\n    const secretKey = decoded.substring(colonIndex + 1)\n\n    if (!clientKey || !secretKey) {\n      throw new Error('Invalid format: empty clientKey or secretKey')\n    }\n\n    return { clientKey, secretKey }\n  } catch {\n    throw new Error('Invalid API key. Expected Base64 encoded \"clientKey:secretKey\"')\n  }\n}\n\nfunction debugLog(\n  debug: boolean | DebugConfig | undefined,\n  type: 'request' | 'response' | 'error',\n  message: string,\n  data?: unknown,\n) {\n  if (!debug) return\n\n  const shouldLog =\n    debug === true ||\n    (type === 'request' && (debug as DebugConfig).logRequests) ||\n    (type === 'response' && (debug as DebugConfig).logResponses) ||\n    (type === 'error' && (debug as DebugConfig).logErrors)\n\n  if (shouldLog) {\n    console.group(`[SDK ${type.toUpperCase()}] ${message}`)\n    if (data) console.log(data)\n    console.groupEnd()\n  }\n}\n\nfunction getErrorSuggestion(status: number): string | undefined {\n  if (status === 401) return 'Please check your authentication credentials.'\n  if (status === 404) return 'The requested resource was not found.'\n  if (status >= 500)\n    return 'A server error occurred. Please try again later.'\n  return undefined\n}\n\nasync function delay(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms))\n}\n\nexport async function _fetch(\n  url: string,\n  options?: FetchOptions,\n): Promise<Response> {\n  const {\n    clientKey,\n    secretKey,\n    customerToken,\n    timeout = DEFAULT_TIMEOUT,\n    baseUrl = API_URLS.production,\n    debug,\n    retry,\n    ...requestInit\n  } = options || {}\n\n  const retryConfig = {\n    maxRetries: retry?.maxRetries ?? 3,\n    retryableStatuses: retry?.retryableStatuses ?? DEFAULT_RETRYABLE_STATUSES,\n    retryDelay:\n      retry?.retryDelay ??\n      ((attempt: number) => Math.min(1000 * 2 ** attempt, 10000)),\n  }\n\n  // Generate JWT once before retry loop (token valid for 1h)\n  let authToken: string | undefined\n  if (secretKey && clientKey) {\n    authToken = await createServerToken(clientKey, secretKey)\n  } else if (customerToken) {\n    authToken = customerToken\n  }\n\n  let lastError: Error | undefined\n\n  for (let attempt = 0; attempt <= retryConfig.maxRetries; attempt++) {\n    try {\n      const headers = new Headers(requestInit.headers)\n\n      if (clientKey) {\n        headers.set('X-Client-Key', clientKey)\n      }\n\n      if (authToken) {\n        headers.set('Authorization', `Bearer ${authToken}`)\n      }\n\n      if (!headers.has('Content-Type') && requestInit.body) {\n        headers.set('Content-Type', 'application/json')\n      }\n\n      // Redact sensitive headers for debug logging\n      const redactedHeaders = Object.fromEntries(headers.entries())\n      if (redactedHeaders['authorization']) {\n        const token = redactedHeaders['authorization']\n        // Show only \"Bearer eyJ...****\" to aid debugging without exposing the full token\n        redactedHeaders['authorization'] = token.length > 15\n          ? `${token.slice(0, 15)}...****`\n          : '****'\n      }\n\n      debugLog(debug, 'request', url, {\n        method: requestInit.method || 'GET',\n        headers: redactedHeaders,\n        attempt: attempt + 1,\n      })\n\n      const controller = new AbortController()\n      const timeoutId = setTimeout(() => controller.abort(), timeout)\n\n      const response = await fetch(`${baseUrl}${url}`, {\n        ...requestInit,\n        headers,\n        signal: controller.signal,\n      })\n\n      clearTimeout(timeoutId)\n\n      debugLog(debug, 'response', url, {\n        status: response.status,\n        statusText: response.statusText,\n        headers: Object.fromEntries(response.headers.entries()),\n      })\n\n      if (!response.ok) {\n        // Usage limit 429 — never retry (distinguished by X-Usage-Limit header)\n        if (\n          response.status === 429 &&\n          response.headers.get('X-Usage-Limit')\n        ) {\n          const limit = parseInt(response.headers.get('X-Usage-Limit') || '0', 10)\n          const current = parseInt(response.headers.get('X-Usage-Current') || '0', 10)\n          const remaining = parseInt(response.headers.get('X-Usage-Remaining') || '0', 10)\n\n          throw createUsageLimitError(\n            `Monthly API usage limit exceeded (${current.toLocaleString()}/${limit.toLocaleString()})`,\n            { limit, current, remaining },\n            { url, method: requestInit.method || 'GET', attempt: attempt + 1 },\n            'Monthly API call limit exceeded. Please upgrade your plan.',\n            'Upgrade your tenant plan to increase the monthly API call limit.',\n          )\n        }\n\n        // Never retry non-retryable statuses regardless of user config\n        if (NON_RETRYABLE_STATUSES.includes(response.status)) {\n          throw createNetworkError(\n            `HTTP ${response.status}: ${response.statusText}`,\n            response.status,\n            { url, method: requestInit.method || 'GET', attempt: attempt + 1 },\n            `Request failed (status: ${response.status})`,\n            getErrorSuggestion(response.status),\n          )\n        }\n\n        const error = createNetworkError(\n          `HTTP ${response.status}: ${response.statusText}`,\n          response.status,\n          { url, method: requestInit.method || 'GET', attempt: attempt + 1 },\n          `Request failed (status: ${response.status})`,\n          getErrorSuggestion(response.status),\n        )\n\n        const method = (requestInit.method || 'GET').toUpperCase()\n        if (\n          attempt < retryConfig.maxRetries &&\n          SAFE_METHODS.includes(method) &&\n          retryConfig.retryableStatuses.includes(response.status)\n        ) {\n          lastError = error\n          const retryDelay = retryConfig.retryDelay(attempt)\n          debugLog(debug, 'error', `Retrying in ${retryDelay}ms...`, error)\n          await delay(retryDelay)\n          continue\n        }\n\n        throw error\n      }\n\n      return response\n    } catch (error) {\n      debugLog(debug, 'error', url, error)\n\n      const method = (requestInit.method || 'GET').toUpperCase()\n      const isSafe = SAFE_METHODS.includes(method)\n\n      if (error instanceof Error && error.name === 'AbortError') {\n        const timeoutError = createTimeoutError(\n          `Request timed out after ${timeout}ms.`,\n          { url, timeout, attempt: attempt + 1 },\n          'The request timed out.',\n          'Please check your network connection or try again later.',\n        )\n\n        if (isSafe && attempt < retryConfig.maxRetries) {\n          lastError = timeoutError\n          await delay(retryConfig.retryDelay(attempt))\n          continue\n        }\n\n        throw timeoutError\n      }\n\n      if (error instanceof TypeError) {\n        const networkError = createNetworkError(\n          'Network connection failed.',\n          undefined,\n          { url, originalError: error.message, attempt: attempt + 1 },\n          'Network connection failed.',\n          'Please check your internet connection and try again.',\n        )\n\n        if (isSafe && attempt < retryConfig.maxRetries) {\n          lastError = networkError\n          await delay(retryConfig.retryDelay(attempt))\n          continue\n        }\n\n        throw networkError\n      }\n\n      if (error instanceof NetworkError || error instanceof TimeoutError) {\n        if (\n          isSafe &&\n          attempt < retryConfig.maxRetries &&\n          error.status &&\n          !NON_RETRYABLE_STATUSES.includes(error.status) &&\n          retryConfig.retryableStatuses.includes(error.status)\n        ) {\n          lastError = error\n          await delay(retryConfig.retryDelay(attempt))\n          continue\n        }\n\n        throw error\n      }\n\n      const unknownError = createNetworkError(\n        error instanceof Error\n          ? error.message\n          : 'An unknown network error occurred.',\n        undefined,\n        { url, originalError: error, attempt: attempt + 1 },\n        'An unknown error occurred.',\n        'Please try again later.',\n      )\n\n      if (isSafe && attempt < retryConfig.maxRetries) {\n        lastError = unknownError\n        await delay(retryConfig.retryDelay(attempt))\n        continue\n      }\n\n      throw unknownError\n    }\n  }\n\n  throw lastError ?? new NetworkError('Request failed after retries')\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS,WAAW,iBAAiB;AAyC9C,SAAsB,kBACpB,WACA,WACA,YAAoB,MACH;AAAA;AACjB,QAAI,CAAC,aAAa,CAAC,WAAW;AAC5B,YAAM,IAAI,MAAM,uCAAuC;AAAA,IACzD;AAEA,UAAM,SAAS,IAAI,YAAY,EAAE,OAAO,SAAS;AACjD,WAAO,IAAI,QAAQ,EAAE,UAAU,CAAC,EAC7B,mBAAmB,EAAE,KAAK,QAAQ,CAAC,EACnC,YAAY,EACZ,kBAAkB,SAAS,EAC3B,KAAK,MAAM;AAAA,EAChB;AAAA;AAgBA,SAAsB,kBACpB,OACA,WACqB;AAAA;AACrB,QAAI,CAAC,SAAS,CAAC,WAAW;AACxB,YAAM,IAAI,MAAM,mCAAmC;AAAA,IACrD;AAEA,UAAM,SAAS,IAAI,YAAY,EAAE,OAAO,SAAS;AACjD,UAAM,EAAE,QAAQ,IAAI,MAAM,UAAU,OAAO,QAAQ;AAAA,MACjD,YAAY,CAAC,OAAO;AAAA,IACtB,CAAC;AAED,QAAI,CAAC,QAAQ,aAAa,OAAO,QAAQ,cAAc,UAAU;AAC/D,YAAM,IAAI,MAAM,6CAA6C;AAAA,IAC/D;AAEA,WAAO;AAAA,MACL,WAAW,QAAQ;AAAA,MACnB,KAAK,QAAQ;AAAA,MACb,KAAK,QAAQ;AAAA,IACf;AAAA,EACF;AAAA;AAgBO,SAAS,kBAAkB,OAA2B;AAC3D,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,oBAAoB;AAAA,EACtC;AAEA,QAAM,UAAU,UAAU,KAAK;AAE/B,MAAI,CAAC,QAAQ,aAAa,OAAO,QAAQ,cAAc,UAAU;AAC/D,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AAEA,SAAO;AAAA,IACL,WAAW,QAAQ;AAAA,IACnB,KAAK,QAAQ;AAAA,IACb,KAAK,QAAQ;AAAA,EACf;AACF;AAoBO,SAAS,aAAa,WAAmB,WAA2B;AACzE,MAAI,CAAC,aAAa,CAAC,WAAW;AAC5B,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACzD;AAGA,MAAI,OAAO,WAAW,aAAa;AACjC,WAAO,OAAO,KAAK,GAAG,SAAS,IAAI,SAAS,EAAE,EAAE,SAAS,QAAQ;AAAA,EACnE;AACA,SAAO,KAAK,GAAG,SAAS,IAAI,SAAS,EAAE;AACzC;AAcO,SAAS,YAAY,QAG1B;AACA,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,qBAAqB;AAAA,EACvC;AAEA,MAAI;AACF,QAAI;AACJ,QAAI,OAAO,WAAW,aAAa;AACjC,gBAAU,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,OAAO;AAAA,IAC1D,OAAO;AACL,gBAAU,KAAK,MAAM;AAAA,IACvB;AAEA,UAAM,aAAa,QAAQ,QAAQ,GAAG;AACtC,QAAI,eAAe,IAAI;AACrB,YAAM,IAAI,MAAM,yCAAyC;AAAA,IAC3D;AAEA,UAAM,YAAY,QAAQ,UAAU,GAAG,UAAU;AACjD,UAAM,YAAY,QAAQ,UAAU,aAAa,CAAC;AAElD,QAAI,CAAC,aAAa,CAAC,WAAW;AAC5B,YAAM,IAAI,MAAM,8CAA8C;AAAA,IAChE;AAEA,WAAO,EAAE,WAAW,UAAU;AAAA,EAChC,SAAQ;AACN,UAAM,IAAI,MAAM,gEAAgE;AAAA,EAClF;AACF;","names":[]}