@01.software/sdk 0.2.7 → 0.2.9-dev.260305.4f1735b

package/README.md

@@ -125,9 +125,18 @@ const product = await client.from('products').findById('id')
 // Create (server only) - returns PayloadMutationResponse
 const { doc, message } = await client.from('products').create({ name: 'Product' })
 
+// Create with file upload (server only) - uses multipart/form-data
+const { doc } = await client.from('product-images').create(
+  { product: 'product_id', alt: 'Hero image' },
+  { file: imageFile, filename: 'hero.jpg' },
+)
+
 // Update (server only) - returns PayloadMutationResponse
 const { doc } = await client.from('products').update('id', { name: 'Updated' })
 
+// Update with file replacement (server only)
+await client.from('media').update('id', { alt: 'New alt' }, { file: newFile })
+
 // Delete (server only) - returns document directly
 const deletedDoc = await client.from('products').remove('id')
 
@@ -219,11 +228,11 @@ const { data, fetchNextPage, hasNextPage } = client.query.useInfiniteQuery({
 })
 
 // Mutation hooks — ServerClient only (auto-invalidate cache on success)
-const { mutate: create } = client.query.useCreate({ collection: 'products' })
+const { mutate: create } = client.query.useCreate({ collection: 'product-images' })
 const { mutate: update } = client.query.useUpdate({ collection: 'products' })
 const { mutate: remove } = client.query.useRemove({ collection: 'products' })
 
-create({ title: 'New Product' })
+create({ data: { alt: 'Hero' }, file: imageFile, filename: 'hero.jpg' })
 update({ id: 'product_id', data: { title: 'Updated' } })
 remove('product_id')
 

package/dist/{auth-ZBsN9vPn.d.cts → auth-3qWmYUln.d.cts}

@@ -1,5 +1,5 @@
 import { Sort, Where } from 'payload';
-import './payload-types-CRSz8jfP.cjs';
+import './payload-types-Bpi16SHO.cjs';
 
 declare class SDKError extends Error {
     readonly code: string;

package/dist/{auth-D-_Ju7m5.d.ts → auth-BfGmV75P.d.ts}

@@ -1,5 +1,5 @@
 import { Sort, Where } from 'payload';
-import './payload-types-CRSz8jfP.js';
+import './payload-types-Bpi16SHO.js';
 
 declare class SDKError extends Error {
     readonly code: string;

package/dist/auth.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/auth.ts","../src/core/internal/utils/index.ts"],"sourcesContent":["export type { JwtPayload } from './core/internal/utils'\nexport {\n  createServerToken,\n  verifyServerToken,\n  decodeServerToken,\n  createApiKey,\n  parseApiKey,\n} from './core/internal/utils'\n","import { SignJWT, jwtVerify, decodeJwt } from 'jose'\nimport { createNetworkError, createUsageLimitError, createTimeoutError, TimeoutError, NetworkError } from '../errors'\nimport type { DebugConfig, RetryConfig } from '../../client/types'\nimport { API_URLS } from '../../client/types'\n\nconst DEFAULT_TIMEOUT = 30000\nconst DEFAULT_RETRYABLE_STATUSES = [408, 429, 500, 502, 503, 504]\nconst NON_RETRYABLE_STATUSES = [401, 403, 404, 422]\nconst SAFE_METHODS = ['GET', 'HEAD', 'OPTIONS']\n\nexport interface FetchOptions extends RequestInit {\n  clientKey?: string\n  secretKey?: string\n  customerToken?: string\n  timeout?: number\n  baseUrl?: string\n  debug?: boolean | DebugConfig\n  retry?: RetryConfig\n}\n\nexport interface JwtPayload {\n  clientKey: string\n  iat?: number\n  exp?: number\n}\n\n/**\n * Creates a JWT token for server-side authentication.\n * The token is valid for 1 hour by default.\n *\n * @param clientKey - Client API key\n * @param secretKey - Secret key used for signing\n * @param expiresIn - Token expiration time (default: '1h')\n * @returns Promise<string> JWT token\n *\n * @example\n * ```typescript\n * const token = await createServerToken('client-key', 'secret-key')\n * // Use in Authorization header: `Bearer ${token}`\n * ```\n */\nexport async function createServerToken(\n  clientKey: string,\n  secretKey: string,\n  expiresIn: string = '1h',\n): Promise<string> {\n  if (!clientKey || !secretKey) {\n    throw new Error('clientKey and secretKey are required.')\n  }\n\n  const secret = new TextEncoder().encode(secretKey)\n  return new SignJWT({ clientKey })\n    .setProtectedHeader({ alg: 'HS256' })\n    .setIssuedAt()\n    .setExpirationTime(expiresIn)\n    .sign(secret)\n}\n\n/**\n * Verifies a JWT token and returns the payload.\n *\n * @param token - JWT token to verify\n * @param secretKey - Secret key used for verification\n * @returns Promise<JwtPayload> Verified payload containing clientKey\n * @throws Error if token is invalid or expired\n *\n * @example\n * ```typescript\n * const payload = await verifyServerToken(token, 'secret-key')\n * console.log(payload.clientKey)\n * ```\n */\nexport async function verifyServerToken(\n  token: string,\n  secretKey: string,\n): Promise<JwtPayload> {\n  if (!token || !secretKey) {\n    throw new Error('token and secretKey are required.')\n  }\n\n  const secret = new TextEncoder().encode(secretKey)\n  const { payload } = await jwtVerify(token, secret, {\n    algorithms: ['HS256'],\n  })\n\n  if (!payload.clientKey || typeof payload.clientKey !== 'string') {\n    throw new Error('Invalid token payload: clientKey is missing')\n  }\n\n  return {\n    clientKey: payload.clientKey as string,\n    iat: payload.iat,\n    exp: payload.exp,\n  }\n}\n\n/**\n * Decodes a JWT token without verification.\n * WARNING: Use this only when you need to inspect token contents.\n * Always use verifyServerToken for authentication.\n *\n * @param token - JWT token to decode\n * @returns JwtPayload Decoded payload (unverified)\n *\n * @example\n * ```typescript\n * const payload = decodeServerToken(token)\n * console.log(payload.clientKey) // Unverified!\n * ```\n */\nexport function decodeServerToken(token: string): JwtPayload {\n  if (!token) {\n    throw new Error('token is required.')\n  }\n\n  const payload = decodeJwt(token)\n\n  if (!payload.clientKey || typeof payload.clientKey !== 'string') {\n    throw new Error('Invalid token payload: clientKey is missing')\n  }\n\n  return {\n    clientKey: payload.clientKey as string,\n    iat: payload.iat,\n    exp: payload.exp,\n  }\n}\n\n// ============================================================================\n// API Key Utilities\n// ============================================================================\n\n/**\n * Creates a Base64-encoded API key from clientKey and secretKey.\n * Use this for MCP server authentication.\n *\n * @param clientKey - Client API key\n * @param secretKey - Secret key\n * @returns Base64-encoded API key\n *\n * @example\n * ```typescript\n * const apiKey = createApiKey('client-key', 'secret-key')\n * // Use in x-api-key header\n * ```\n */\nexport function createApiKey(clientKey: string, secretKey: string): string {\n  if (!clientKey || !secretKey) {\n    throw new Error('clientKey and secretKey are required.')\n  }\n\n  // Browser와 Node.js 모두 지원\n  if (typeof Buffer !== 'undefined') {\n    return Buffer.from(`${clientKey}:${secretKey}`).toString('base64')\n  }\n  return btoa(`${clientKey}:${secretKey}`)\n}\n\n/**\n * Parses a Base64-encoded API key to extract clientKey and secretKey.\n *\n * @param apiKey - Base64-encoded API key\n * @returns Object containing clientKey and secretKey\n * @throws Error if API key is invalid\n *\n * @example\n * ```typescript\n * const { clientKey, secretKey } = parseApiKey(apiKey)\n * ```\n */\nexport function parseApiKey(apiKey: string): {\n  clientKey: string\n  secretKey: string\n} {\n  if (!apiKey) {\n    throw new Error('apiKey is required.')\n  }\n\n  try {\n    let decoded: string\n    if (typeof Buffer !== 'undefined') {\n      decoded = Buffer.from(apiKey, 'base64').toString('utf-8')\n    } else {\n      decoded = atob(apiKey)\n    }\n\n    const colonIndex = decoded.indexOf(':')\n    if (colonIndex === -1) {\n      throw new Error('Invalid format: missing colon separator')\n    }\n\n    const clientKey = decoded.substring(0, colonIndex)\n    const secretKey = decoded.substring(colonIndex + 1)\n\n    if (!clientKey || !secretKey) {\n      throw new Error('Invalid format: empty clientKey or secretKey')\n    }\n\n    return { clientKey, secretKey }\n  } catch {\n    throw new Error('Invalid API key. Expected Base64 encoded \"clientKey:secretKey\"')\n  }\n}\n\nfunction debugLog(\n  debug: boolean | DebugConfig | undefined,\n  type: 'request' | 'response' | 'error',\n  message: string,\n  data?: unknown,\n) {\n  if (!debug) return\n\n  const shouldLog =\n    debug === true ||\n    (type === 'request' && (debug as DebugConfig).logRequests) ||\n    (type === 'response' && (debug as DebugConfig).logResponses) ||\n    (type === 'error' && (debug as DebugConfig).logErrors)\n\n  if (shouldLog) {\n    console.group(`[SDK ${type.toUpperCase()}] ${message}`)\n    if (data) console.log(data)\n    console.groupEnd()\n  }\n}\n\nfunction getErrorSuggestion(status: number): string | undefined {\n  if (status === 401) return 'Please check your authentication credentials.'\n  if (status === 404) return 'The requested resource was not found.'\n  if (status >= 500)\n    return 'A server error occurred. Please try again later.'\n  return undefined\n}\n\nasync function delay(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms))\n}\n\nexport async function _fetch(\n  url: string,\n  options?: FetchOptions,\n): Promise<Response> {\n  const {\n    clientKey,\n    secretKey,\n    customerToken,\n    timeout = DEFAULT_TIMEOUT,\n    baseUrl = API_URLS.production,\n    debug,\n    retry,\n    ...requestInit\n  } = options || {}\n\n  const retryConfig = {\n    maxRetries: retry?.maxRetries ?? 3,\n    retryableStatuses: retry?.retryableStatuses ?? DEFAULT_RETRYABLE_STATUSES,\n    retryDelay:\n      retry?.retryDelay ??\n      ((attempt: number) => Math.min(1000 * 2 ** attempt, 10000)),\n  }\n\n  // Generate JWT once before retry loop (token valid for 1h)\n  let authToken: string | undefined\n  if (secretKey && clientKey) {\n    authToken = await createServerToken(clientKey, secretKey)\n  } else if (customerToken) {\n    authToken = customerToken\n  }\n\n  let lastError: Error | undefined\n\n  for (let attempt = 0; attempt <= retryConfig.maxRetries; attempt++) {\n    try {\n      const headers = new Headers(requestInit.headers)\n\n      if (clientKey) {\n        headers.set('X-Client-Key', clientKey)\n      }\n\n      if (authToken) {\n        headers.set('Authorization', `Bearer ${authToken}`)\n      }\n\n      if (!headers.has('Content-Type') && requestInit.body) {\n        headers.set('Content-Type', 'application/json')\n      }\n\n      // Redact sensitive headers for debug logging\n      const redactedHeaders = Object.fromEntries(headers.entries())\n      if (redactedHeaders['authorization']) {\n        const token = redactedHeaders['authorization']\n        // Show only \"Bearer eyJ...****\" to aid debugging without exposing the full token\n        redactedHeaders['authorization'] = token.length > 15\n          ? `${token.slice(0, 15)}...****`\n          : '****'\n      }\n\n      debugLog(debug, 'request', url, {\n        method: requestInit.method || 'GET',\n        headers: redactedHeaders,\n        attempt: attempt + 1,\n      })\n\n      const controller = new AbortController()\n      const timeoutId = setTimeout(() => controller.abort(), timeout)\n\n      const response = await fetch(`${baseUrl}${url}`, {\n        ...requestInit,\n        headers,\n        signal: controller.signal,\n      })\n\n      clearTimeout(timeoutId)\n\n      debugLog(debug, 'response', url, {\n        status: response.status,\n        statusText: response.statusText,\n        headers: Object.fromEntries(response.headers.entries()),\n      })\n\n      if (!response.ok) {\n        // Usage limit 429 — never retry (distinguished by X-Usage-Limit header)\n        if (\n          response.status === 429 &&\n          response.headers.get('X-Usage-Limit')\n        ) {\n          const limit = parseInt(response.headers.get('X-Usage-Limit') || '0', 10)\n          const current = parseInt(response.headers.get('X-Usage-Current') || '0', 10)\n          const remaining = parseInt(response.headers.get('X-Usage-Remaining') || '0', 10)\n\n          throw createUsageLimitError(\n            `Monthly API usage limit exceeded (${current.toLocaleString()}/${limit.toLocaleString()})`,\n            { limit, current, remaining },\n            { url, method: requestInit.method || 'GET', attempt: attempt + 1 },\n            'Monthly API call limit exceeded. Please upgrade your plan.',\n            'Upgrade your tenant plan to increase the monthly API call limit.',\n          )\n        }\n\n        // Never retry non-retryable statuses regardless of user config\n        if (NON_RETRYABLE_STATUSES.includes(response.status)) {\n          throw createNetworkError(\n            `HTTP ${response.status}: ${response.statusText}`,\n            response.status,\n            { url, method: requestInit.method || 'GET', attempt: attempt + 1 },\n            `Request failed (status: ${response.status})`,\n            getErrorSuggestion(response.status),\n          )\n        }\n\n        const error = createNetworkError(\n          `HTTP ${response.status}: ${response.statusText}`,\n          response.status,\n          { url, method: requestInit.method || 'GET', attempt: attempt + 1 },\n          `Request failed (status: ${response.status})`,\n          getErrorSuggestion(response.status),\n        )\n\n        const method = (requestInit.method || 'GET').toUpperCase()\n        if (\n          attempt < retryConfig.maxRetries &&\n          SAFE_METHODS.includes(method) &&\n          retryConfig.retryableStatuses.includes(response.status)\n        ) {\n          lastError = error\n          const retryDelay = retryConfig.retryDelay(attempt)\n          debugLog(debug, 'error', `Retrying in ${retryDelay}ms...`, error)\n          await delay(retryDelay)\n          continue\n        }\n\n        throw error\n      }\n\n      return response\n    } catch (error) {\n      debugLog(debug, 'error', url, error)\n\n      const method = (requestInit.method || 'GET').toUpperCase()\n      const isSafe = SAFE_METHODS.includes(method)\n\n      if (error instanceof Error && error.name === 'AbortError') {\n        const timeoutError = createTimeoutError(\n          `Request timed out after ${timeout}ms.`,\n          { url, timeout, attempt: attempt + 1 },\n          'The request timed out.',\n          'Please check your network connection or try again later.',\n        )\n\n        if (isSafe && attempt < retryConfig.maxRetries) {\n          lastError = timeoutError\n          await delay(retryConfig.retryDelay(attempt))\n          continue\n        }\n\n        throw timeoutError\n      }\n\n      if (error instanceof TypeError) {\n        const networkError = createNetworkError(\n          'Network connection failed.',\n          undefined,\n          { url, originalError: error.message, attempt: attempt + 1 },\n          'Network connection failed.',\n          'Please check your internet connection and try again.',\n        )\n\n        if (isSafe && attempt < retryConfig.maxRetries) {\n          lastError = networkError\n          await delay(retryConfig.retryDelay(attempt))\n          continue\n        }\n\n        throw networkError\n      }\n\n      if (error instanceof NetworkError || error instanceof TimeoutError) {\n        if (\n          isSafe &&\n          attempt < retryConfig.maxRetries &&\n          error.status &&\n          !NON_RETRYABLE_STATUSES.includes(error.status) &&\n          retryConfig.retryableStatuses.includes(error.status)\n        ) {\n          lastError = error\n          await delay(retryConfig.retryDelay(attempt))\n          continue\n        }\n\n        throw error\n      }\n\n      const unknownError = createNetworkError(\n        error instanceof Error\n          ? error.message\n          : 'An unknown network error occurred.',\n        undefined,\n        { url, originalError: error, attempt: attempt + 1 },\n        'An unknown error occurred.',\n        'Please try again later.',\n      )\n\n      if (isSafe && attempt < retryConfig.maxRetries) {\n        lastError = unknownError\n        await delay(retryConfig.retryDelay(attempt))\n        continue\n      }\n\n      throw unknownError\n    }\n  }\n\n  throw lastError ?? new NetworkError('Request failed after retries')\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,kBAA8C;AAyC9C,SAAsB,kBACpB,WACA,WACA,YAAoB,MACH;AAAA;AACjB,QAAI,CAAC,aAAa,CAAC,WAAW;AAC5B,YAAM,IAAI,MAAM,uCAAuC;AAAA,IACzD;AAEA,UAAM,SAAS,IAAI,YAAY,EAAE,OAAO,SAAS;AACjD,WAAO,IAAI,oBAAQ,EAAE,UAAU,CAAC,EAC7B,mBAAmB,EAAE,KAAK,QAAQ,CAAC,EACnC,YAAY,EACZ,kBAAkB,SAAS,EAC3B,KAAK,MAAM;AAAA,EAChB;AAAA;AAgBA,SAAsB,kBACpB,OACA,WACqB;AAAA;AACrB,QAAI,CAAC,SAAS,CAAC,WAAW;AACxB,YAAM,IAAI,MAAM,mCAAmC;AAAA,IACrD;AAEA,UAAM,SAAS,IAAI,YAAY,EAAE,OAAO,SAAS;AACjD,UAAM,EAAE,QAAQ,IAAI,UAAM,uBAAU,OAAO,QAAQ;AAAA,MACjD,YAAY,CAAC,OAAO;AAAA,IACtB,CAAC;AAED,QAAI,CAAC,QAAQ,aAAa,OAAO,QAAQ,cAAc,UAAU;AAC/D,YAAM,IAAI,MAAM,6CAA6C;AAAA,IAC/D;AAEA,WAAO;AAAA,MACL,WAAW,QAAQ;AAAA,MACnB,KAAK,QAAQ;AAAA,MACb,KAAK,QAAQ;AAAA,IACf;AAAA,EACF;AAAA;AAgBO,SAAS,kBAAkB,OAA2B;AAC3D,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,oBAAoB;AAAA,EACtC;AAEA,QAAM,cAAU,uBAAU,KAAK;AAE/B,MAAI,CAAC,QAAQ,aAAa,OAAO,QAAQ,cAAc,UAAU;AAC/D,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AAEA,SAAO;AAAA,IACL,WAAW,QAAQ;AAAA,IACnB,KAAK,QAAQ;AAAA,IACb,KAAK,QAAQ;AAAA,EACf;AACF;AAoBO,SAAS,aAAa,WAAmB,WAA2B;AACzE,MAAI,CAAC,aAAa,CAAC,WAAW;AAC5B,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACzD;AAGA,MAAI,OAAO,WAAW,aAAa;AACjC,WAAO,OAAO,KAAK,GAAG,SAAS,IAAI,SAAS,EAAE,EAAE,SAAS,QAAQ;AAAA,EACnE;AACA,SAAO,KAAK,GAAG,SAAS,IAAI,SAAS,EAAE;AACzC;AAcO,SAAS,YAAY,QAG1B;AACA,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,qBAAqB;AAAA,EACvC;AAEA,MAAI;AACF,QAAI;AACJ,QAAI,OAAO,WAAW,aAAa;AACjC,gBAAU,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,OAAO;AAAA,IAC1D,OAAO;AACL,gBAAU,KAAK,MAAM;AAAA,IACvB;AAEA,UAAM,aAAa,QAAQ,QAAQ,GAAG;AACtC,QAAI,eAAe,IAAI;AACrB,YAAM,IAAI,MAAM,yCAAyC;AAAA,IAC3D;AAEA,UAAM,YAAY,QAAQ,UAAU,GAAG,UAAU;AACjD,UAAM,YAAY,QAAQ,UAAU,aAAa,CAAC;AAElD,QAAI,CAAC,aAAa,CAAC,WAAW;AAC5B,YAAM,IAAI,MAAM,8CAA8C;AAAA,IAChE;AAEA,WAAO,EAAE,WAAW,UAAU;AAAA,EAChC,SAAQ;AACN,UAAM,IAAI,MAAM,gEAAgE;AAAA,EAClF;AACF;","names":[]}
+{"version":3,"sources":["../src/auth.ts","../src/core/internal/utils/index.ts"],"sourcesContent":["export type { JwtPayload } from './core/internal/utils'\nexport {\n  createServerToken,\n  verifyServerToken,\n  decodeServerToken,\n  createApiKey,\n  parseApiKey,\n} from './core/internal/utils'\n","import { SignJWT, jwtVerify, decodeJwt } from 'jose'\nimport { createNetworkError, createUsageLimitError, createTimeoutError, TimeoutError, NetworkError } from '../errors'\nimport type { DebugConfig, RetryConfig } from '../../client/types'\nimport { API_URLS } from '../../client/types'\n\nconst DEFAULT_TIMEOUT = 30000\nconst DEFAULT_RETRYABLE_STATUSES = [408, 429, 500, 502, 503, 504]\nconst NON_RETRYABLE_STATUSES = [401, 403, 404, 422]\nconst SAFE_METHODS = ['GET', 'HEAD', 'OPTIONS']\n\nexport interface FetchOptions extends RequestInit {\n  clientKey?: string\n  secretKey?: string\n  customerToken?: string\n  timeout?: number\n  baseUrl?: string\n  debug?: boolean | DebugConfig\n  retry?: RetryConfig\n}\n\nexport interface JwtPayload {\n  clientKey: string\n  iat?: number\n  exp?: number\n}\n\n/**\n * Creates a JWT token for server-side authentication.\n * The token is valid for 1 hour by default.\n *\n * @param clientKey - Client API key\n * @param secretKey - Secret key used for signing\n * @param expiresIn - Token expiration time (default: '1h')\n * @returns Promise<string> JWT token\n *\n * @example\n * ```typescript\n * const token = await createServerToken('client-key', 'secret-key')\n * // Use in Authorization header: `Bearer ${token}`\n * ```\n */\nexport async function createServerToken(\n  clientKey: string,\n  secretKey: string,\n  expiresIn: string = '1h',\n): Promise<string> {\n  if (!clientKey || !secretKey) {\n    throw new Error('clientKey and secretKey are required.')\n  }\n\n  const secret = new TextEncoder().encode(secretKey)\n  return new SignJWT({ clientKey })\n    .setProtectedHeader({ alg: 'HS256' })\n    .setIssuedAt()\n    .setExpirationTime(expiresIn)\n    .sign(secret)\n}\n\n/**\n * Verifies a JWT token and returns the payload.\n *\n * @param token - JWT token to verify\n * @param secretKey - Secret key used for verification\n * @returns Promise<JwtPayload> Verified payload containing clientKey\n * @throws Error if token is invalid or expired\n *\n * @example\n * ```typescript\n * const payload = await verifyServerToken(token, 'secret-key')\n * console.log(payload.clientKey)\n * ```\n */\nexport async function verifyServerToken(\n  token: string,\n  secretKey: string,\n): Promise<JwtPayload> {\n  if (!token || !secretKey) {\n    throw new Error('token and secretKey are required.')\n  }\n\n  const secret = new TextEncoder().encode(secretKey)\n  const { payload } = await jwtVerify(token, secret, {\n    algorithms: ['HS256'],\n  })\n\n  if (!payload.clientKey || typeof payload.clientKey !== 'string') {\n    throw new Error('Invalid token payload: clientKey is missing')\n  }\n\n  return {\n    clientKey: payload.clientKey as string,\n    iat: payload.iat,\n    exp: payload.exp,\n  }\n}\n\n/**\n * Decodes a JWT token without verification.\n * WARNING: Use this only when you need to inspect token contents.\n * Always use verifyServerToken for authentication.\n *\n * @param token - JWT token to decode\n * @returns JwtPayload Decoded payload (unverified)\n *\n * @example\n * ```typescript\n * const payload = decodeServerToken(token)\n * console.log(payload.clientKey) // Unverified!\n * ```\n */\nexport function decodeServerToken(token: string): JwtPayload {\n  if (!token) {\n    throw new Error('token is required.')\n  }\n\n  const payload = decodeJwt(token)\n\n  if (!payload.clientKey || typeof payload.clientKey !== 'string') {\n    throw new Error('Invalid token payload: clientKey is missing')\n  }\n\n  return {\n    clientKey: payload.clientKey as string,\n    iat: payload.iat,\n    exp: payload.exp,\n  }\n}\n\n// ============================================================================\n// API Key Utilities\n// ============================================================================\n\n/**\n * Creates a Base64-encoded API key from clientKey and secretKey.\n * Use this for MCP server authentication.\n *\n * @param clientKey - Client API key\n * @param secretKey - Secret key\n * @returns Base64-encoded API key\n *\n * @example\n * ```typescript\n * const apiKey = createApiKey('client-key', 'secret-key')\n * // Use in x-api-key header\n * ```\n */\nexport function createApiKey(clientKey: string, secretKey: string): string {\n  if (!clientKey || !secretKey) {\n    throw new Error('clientKey and secretKey are required.')\n  }\n\n  // Browser와 Node.js 모두 지원\n  if (typeof Buffer !== 'undefined') {\n    return Buffer.from(`${clientKey}:${secretKey}`).toString('base64')\n  }\n  return btoa(`${clientKey}:${secretKey}`)\n}\n\n/**\n * Parses a Base64-encoded API key to extract clientKey and secretKey.\n *\n * @param apiKey - Base64-encoded API key\n * @returns Object containing clientKey and secretKey\n * @throws Error if API key is invalid\n *\n * @example\n * ```typescript\n * const { clientKey, secretKey } = parseApiKey(apiKey)\n * ```\n */\nexport function parseApiKey(apiKey: string): {\n  clientKey: string\n  secretKey: string\n} {\n  if (!apiKey) {\n    throw new Error('apiKey is required.')\n  }\n\n  try {\n    let decoded: string\n    if (typeof Buffer !== 'undefined') {\n      decoded = Buffer.from(apiKey, 'base64').toString('utf-8')\n    } else {\n      decoded = atob(apiKey)\n    }\n\n    const colonIndex = decoded.indexOf(':')\n    if (colonIndex === -1) {\n      throw new Error('Invalid format: missing colon separator')\n    }\n\n    const clientKey = decoded.substring(0, colonIndex)\n    const secretKey = decoded.substring(colonIndex + 1)\n\n    if (!clientKey || !secretKey) {\n      throw new Error('Invalid format: empty clientKey or secretKey')\n    }\n\n    return { clientKey, secretKey }\n  } catch {\n    throw new Error('Invalid API key. Expected Base64 encoded \"clientKey:secretKey\"')\n  }\n}\n\nfunction debugLog(\n  debug: boolean | DebugConfig | undefined,\n  type: 'request' | 'response' | 'error',\n  message: string,\n  data?: unknown,\n) {\n  if (!debug) return\n\n  const shouldLog =\n    debug === true ||\n    (type === 'request' && (debug as DebugConfig).logRequests) ||\n    (type === 'response' && (debug as DebugConfig).logResponses) ||\n    (type === 'error' && (debug as DebugConfig).logErrors)\n\n  if (shouldLog) {\n    console.group(`[SDK ${type.toUpperCase()}] ${message}`)\n    if (data) console.log(data)\n    console.groupEnd()\n  }\n}\n\nfunction getErrorSuggestion(status: number): string | undefined {\n  if (status === 401) return 'Please check your authentication credentials.'\n  if (status === 404) return 'The requested resource was not found.'\n  if (status >= 500)\n    return 'A server error occurred. Please try again later.'\n  return undefined\n}\n\nasync function delay(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms))\n}\n\nexport async function _fetch(\n  url: string,\n  options?: FetchOptions,\n): Promise<Response> {\n  const {\n    clientKey,\n    secretKey,\n    customerToken,\n    timeout = DEFAULT_TIMEOUT,\n    baseUrl = API_URLS.production,\n    debug,\n    retry,\n    ...requestInit\n  } = options || {}\n\n  const retryConfig = {\n    maxRetries: retry?.maxRetries ?? 3,\n    retryableStatuses: retry?.retryableStatuses ?? DEFAULT_RETRYABLE_STATUSES,\n    retryDelay:\n      retry?.retryDelay ??\n      ((attempt: number) => Math.min(1000 * 2 ** attempt, 10000)),\n  }\n\n  // Generate JWT once before retry loop (token valid for 1h)\n  let authToken: string | undefined\n  if (secretKey && clientKey) {\n    authToken = await createServerToken(clientKey, secretKey)\n  } else if (customerToken) {\n    authToken = customerToken\n  }\n\n  let lastError: Error | undefined\n\n  for (let attempt = 0; attempt <= retryConfig.maxRetries; attempt++) {\n    try {\n      const headers = new Headers(requestInit.headers)\n\n      if (clientKey) {\n        headers.set('X-Client-Key', clientKey)\n      }\n\n      if (authToken) {\n        headers.set('Authorization', `Bearer ${authToken}`)\n      }\n\n      if (!headers.has('Content-Type') && requestInit.body && !(requestInit.body instanceof FormData)) {\n        headers.set('Content-Type', 'application/json')\n      }\n\n      // Redact sensitive headers for debug logging\n      const redactedHeaders = Object.fromEntries(headers.entries())\n      if (redactedHeaders['authorization']) {\n        const token = redactedHeaders['authorization']\n        // Show only \"Bearer eyJ...****\" to aid debugging without exposing the full token\n        redactedHeaders['authorization'] = token.length > 15\n          ? `${token.slice(0, 15)}...****`\n          : '****'\n      }\n\n      debugLog(debug, 'request', url, {\n        method: requestInit.method || 'GET',\n        headers: redactedHeaders,\n        attempt: attempt + 1,\n      })\n\n      const controller = new AbortController()\n      const timeoutId = setTimeout(() => controller.abort(), timeout)\n\n      const response = await fetch(`${baseUrl}${url}`, {\n        ...requestInit,\n        headers,\n        signal: controller.signal,\n      })\n\n      clearTimeout(timeoutId)\n\n      debugLog(debug, 'response', url, {\n        status: response.status,\n        statusText: response.statusText,\n        headers: Object.fromEntries(response.headers.entries()),\n      })\n\n      if (!response.ok) {\n        // Usage limit 429 — never retry (distinguished by X-Usage-Limit header)\n        if (\n          response.status === 429 &&\n          response.headers.get('X-Usage-Limit')\n        ) {\n          const limit = parseInt(response.headers.get('X-Usage-Limit') || '0', 10)\n          const current = parseInt(response.headers.get('X-Usage-Current') || '0', 10)\n          const remaining = parseInt(response.headers.get('X-Usage-Remaining') || '0', 10)\n\n          throw createUsageLimitError(\n            `Monthly API usage limit exceeded (${current.toLocaleString()}/${limit.toLocaleString()})`,\n            { limit, current, remaining },\n            { url, method: requestInit.method || 'GET', attempt: attempt + 1 },\n            'Monthly API call limit exceeded. Please upgrade your plan.',\n            'Upgrade your tenant plan to increase the monthly API call limit.',\n          )\n        }\n\n        // Never retry non-retryable statuses regardless of user config\n        if (NON_RETRYABLE_STATUSES.includes(response.status)) {\n          throw createNetworkError(\n            `HTTP ${response.status}: ${response.statusText}`,\n            response.status,\n            { url, method: requestInit.method || 'GET', attempt: attempt + 1 },\n            `Request failed (status: ${response.status})`,\n            getErrorSuggestion(response.status),\n          )\n        }\n\n        const error = createNetworkError(\n          `HTTP ${response.status}: ${response.statusText}`,\n          response.status,\n          { url, method: requestInit.method || 'GET', attempt: attempt + 1 },\n          `Request failed (status: ${response.status})`,\n          getErrorSuggestion(response.status),\n        )\n\n        const method = (requestInit.method || 'GET').toUpperCase()\n        if (\n          attempt < retryConfig.maxRetries &&\n          SAFE_METHODS.includes(method) &&\n          retryConfig.retryableStatuses.includes(response.status)\n        ) {\n          lastError = error\n          const retryDelay = retryConfig.retryDelay(attempt)\n          debugLog(debug, 'error', `Retrying in ${retryDelay}ms...`, error)\n          await delay(retryDelay)\n          continue\n        }\n\n        throw error\n      }\n\n      return response\n    } catch (error) {\n      debugLog(debug, 'error', url, error)\n\n      const method = (requestInit.method || 'GET').toUpperCase()\n      const isSafe = SAFE_METHODS.includes(method)\n\n      if (error instanceof Error && error.name === 'AbortError') {\n        const timeoutError = createTimeoutError(\n          `Request timed out after ${timeout}ms.`,\n          { url, timeout, attempt: attempt + 1 },\n          'The request timed out.',\n          'Please check your network connection or try again later.',\n        )\n\n        if (isSafe && attempt < retryConfig.maxRetries) {\n          lastError = timeoutError\n          await delay(retryConfig.retryDelay(attempt))\n          continue\n        }\n\n        throw timeoutError\n      }\n\n      if (error instanceof TypeError) {\n        const networkError = createNetworkError(\n          'Network connection failed.',\n          undefined,\n          { url, originalError: error.message, attempt: attempt + 1 },\n          'Network connection failed.',\n          'Please check your internet connection and try again.',\n        )\n\n        if (isSafe && attempt < retryConfig.maxRetries) {\n          lastError = networkError\n          await delay(retryConfig.retryDelay(attempt))\n          continue\n        }\n\n        throw networkError\n      }\n\n      if (error instanceof NetworkError || error instanceof TimeoutError) {\n        if (\n          isSafe &&\n          attempt < retryConfig.maxRetries &&\n          error.status &&\n          !NON_RETRYABLE_STATUSES.includes(error.status) &&\n          retryConfig.retryableStatuses.includes(error.status)\n        ) {\n          lastError = error\n          await delay(retryConfig.retryDelay(attempt))\n          continue\n        }\n\n        throw error\n      }\n\n      const unknownError = createNetworkError(\n        error instanceof Error\n          ? error.message\n          : 'An unknown network error occurred.',\n        undefined,\n        { url, originalError: error, attempt: attempt + 1 },\n        'An unknown error occurred.',\n        'Please try again later.',\n      )\n\n      if (isSafe && attempt < retryConfig.maxRetries) {\n        lastError = unknownError\n        await delay(retryConfig.retryDelay(attempt))\n        continue\n      }\n\n      throw unknownError\n    }\n  }\n\n  throw lastError ?? new NetworkError('Request failed after retries')\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,kBAA8C;AAyC9C,SAAsB,kBACpB,WACA,WACA,YAAoB,MACH;AAAA;AACjB,QAAI,CAAC,aAAa,CAAC,WAAW;AAC5B,YAAM,IAAI,MAAM,uCAAuC;AAAA,IACzD;AAEA,UAAM,SAAS,IAAI,YAAY,EAAE,OAAO,SAAS;AACjD,WAAO,IAAI,oBAAQ,EAAE,UAAU,CAAC,EAC7B,mBAAmB,EAAE,KAAK,QAAQ,CAAC,EACnC,YAAY,EACZ,kBAAkB,SAAS,EAC3B,KAAK,MAAM;AAAA,EAChB;AAAA;AAgBA,SAAsB,kBACpB,OACA,WACqB;AAAA;AACrB,QAAI,CAAC,SAAS,CAAC,WAAW;AACxB,YAAM,IAAI,MAAM,mCAAmC;AAAA,IACrD;AAEA,UAAM,SAAS,IAAI,YAAY,EAAE,OAAO,SAAS;AACjD,UAAM,EAAE,QAAQ,IAAI,UAAM,uBAAU,OAAO,QAAQ;AAAA,MACjD,YAAY,CAAC,OAAO;AAAA,IACtB,CAAC;AAED,QAAI,CAAC,QAAQ,aAAa,OAAO,QAAQ,cAAc,UAAU;AAC/D,YAAM,IAAI,MAAM,6CAA6C;AAAA,IAC/D;AAEA,WAAO;AAAA,MACL,WAAW,QAAQ;AAAA,MACnB,KAAK,QAAQ;AAAA,MACb,KAAK,QAAQ;AAAA,IACf;AAAA,EACF;AAAA;AAgBO,SAAS,kBAAkB,OAA2B;AAC3D,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,oBAAoB;AAAA,EACtC;AAEA,QAAM,cAAU,uBAAU,KAAK;AAE/B,MAAI,CAAC,QAAQ,aAAa,OAAO,QAAQ,cAAc,UAAU;AAC/D,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AAEA,SAAO;AAAA,IACL,WAAW,QAAQ;AAAA,IACnB,KAAK,QAAQ;AAAA,IACb,KAAK,QAAQ;AAAA,EACf;AACF;AAoBO,SAAS,aAAa,WAAmB,WAA2B;AACzE,MAAI,CAAC,aAAa,CAAC,WAAW;AAC5B,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACzD;AAGA,MAAI,OAAO,WAAW,aAAa;AACjC,WAAO,OAAO,KAAK,GAAG,SAAS,IAAI,SAAS,EAAE,EAAE,SAAS,QAAQ;AAAA,EACnE;AACA,SAAO,KAAK,GAAG,SAAS,IAAI,SAAS,EAAE;AACzC;AAcO,SAAS,YAAY,QAG1B;AACA,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,qBAAqB;AAAA,EACvC;AAEA,MAAI;AACF,QAAI;AACJ,QAAI,OAAO,WAAW,aAAa;AACjC,gBAAU,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,OAAO;AAAA,IAC1D,OAAO;AACL,gBAAU,KAAK,MAAM;AAAA,IACvB;AAEA,UAAM,aAAa,QAAQ,QAAQ,GAAG;AACtC,QAAI,eAAe,IAAI;AACrB,YAAM,IAAI,MAAM,yCAAyC;AAAA,IAC3D;AAEA,UAAM,YAAY,QAAQ,UAAU,GAAG,UAAU;AACjD,UAAM,YAAY,QAAQ,UAAU,aAAa,CAAC;AAElD,QAAI,CAAC,aAAa,CAAC,WAAW;AAC5B,YAAM,IAAI,MAAM,8CAA8C;AAAA,IAChE;AAEA,WAAO,EAAE,WAAW,UAAU;AAAA,EAChC,SAAQ;AACN,UAAM,IAAI,MAAM,gEAAgE;AAAA,EAClF;AACF;","names":[]}

package/dist/auth.d.cts

@@ -1,3 +1,3 @@
-export { J as JwtPayload, q as createApiKey, o as createServerToken, p as decodeServerToken, r as parseApiKey, v as verifyServerToken } from './auth-ZBsN9vPn.cjs';
+export { J as JwtPayload, q as createApiKey, o as createServerToken, p as decodeServerToken, r as parseApiKey, v as verifyServerToken } from './auth-3qWmYUln.cjs';
 import 'payload';
-import './payload-types-CRSz8jfP.cjs';
+import './payload-types-Bpi16SHO.cjs';

package/dist/auth.d.ts

@@ -1,3 +1,3 @@
-export { J as JwtPayload, q as createApiKey, o as createServerToken, p as decodeServerToken, r as parseApiKey, v as verifyServerToken } from './auth-D-_Ju7m5.js';
+export { J as JwtPayload, q as createApiKey, o as createServerToken, p as decodeServerToken, r as parseApiKey, v as verifyServerToken } from './auth-BfGmV75P.js';
 import 'payload';
-import './payload-types-CRSz8jfP.js';
+import './payload-types-Bpi16SHO.js';

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/core/internal/utils/index.ts"],"sourcesContent":["import { SignJWT, jwtVerify, decodeJwt } from 'jose'\nimport { createNetworkError, createUsageLimitError, createTimeoutError, TimeoutError, NetworkError } from '../errors'\nimport type { DebugConfig, RetryConfig } from '../../client/types'\nimport { API_URLS } from '../../client/types'\n\nconst DEFAULT_TIMEOUT = 30000\nconst DEFAULT_RETRYABLE_STATUSES = [408, 429, 500, 502, 503, 504]\nconst NON_RETRYABLE_STATUSES = [401, 403, 404, 422]\nconst SAFE_METHODS = ['GET', 'HEAD', 'OPTIONS']\n\nexport interface FetchOptions extends RequestInit {\n  clientKey?: string\n  secretKey?: string\n  customerToken?: string\n  timeout?: number\n  baseUrl?: string\n  debug?: boolean | DebugConfig\n  retry?: RetryConfig\n}\n\nexport interface JwtPayload {\n  clientKey: string\n  iat?: number\n  exp?: number\n}\n\n/**\n * Creates a JWT token for server-side authentication.\n * The token is valid for 1 hour by default.\n *\n * @param clientKey - Client API key\n * @param secretKey - Secret key used for signing\n * @param expiresIn - Token expiration time (default: '1h')\n * @returns Promise<string> JWT token\n *\n * @example\n * ```typescript\n * const token = await createServerToken('client-key', 'secret-key')\n * // Use in Authorization header: `Bearer ${token}`\n * ```\n */\nexport async function createServerToken(\n  clientKey: string,\n  secretKey: string,\n  expiresIn: string = '1h',\n): Promise<string> {\n  if (!clientKey || !secretKey) {\n    throw new Error('clientKey and secretKey are required.')\n  }\n\n  const secret = new TextEncoder().encode(secretKey)\n  return new SignJWT({ clientKey })\n    .setProtectedHeader({ alg: 'HS256' })\n    .setIssuedAt()\n    .setExpirationTime(expiresIn)\n    .sign(secret)\n}\n\n/**\n * Verifies a JWT token and returns the payload.\n *\n * @param token - JWT token to verify\n * @param secretKey - Secret key used for verification\n * @returns Promise<JwtPayload> Verified payload containing clientKey\n * @throws Error if token is invalid or expired\n *\n * @example\n * ```typescript\n * const payload = await verifyServerToken(token, 'secret-key')\n * console.log(payload.clientKey)\n * ```\n */\nexport async function verifyServerToken(\n  token: string,\n  secretKey: string,\n): Promise<JwtPayload> {\n  if (!token || !secretKey) {\n    throw new Error('token and secretKey are required.')\n  }\n\n  const secret = new TextEncoder().encode(secretKey)\n  const { payload } = await jwtVerify(token, secret, {\n    algorithms: ['HS256'],\n  })\n\n  if (!payload.clientKey || typeof payload.clientKey !== 'string') {\n    throw new Error('Invalid token payload: clientKey is missing')\n  }\n\n  return {\n    clientKey: payload.clientKey as string,\n    iat: payload.iat,\n    exp: payload.exp,\n  }\n}\n\n/**\n * Decodes a JWT token without verification.\n * WARNING: Use this only when you need to inspect token contents.\n * Always use verifyServerToken for authentication.\n *\n * @param token - JWT token to decode\n * @returns JwtPayload Decoded payload (unverified)\n *\n * @example\n * ```typescript\n * const payload = decodeServerToken(token)\n * console.log(payload.clientKey) // Unverified!\n * ```\n */\nexport function decodeServerToken(token: string): JwtPayload {\n  if (!token) {\n    throw new Error('token is required.')\n  }\n\n  const payload = decodeJwt(token)\n\n  if (!payload.clientKey || typeof payload.clientKey !== 'string') {\n    throw new Error('Invalid token payload: clientKey is missing')\n  }\n\n  return {\n    clientKey: payload.clientKey as string,\n    iat: payload.iat,\n    exp: payload.exp,\n  }\n}\n\n// ============================================================================\n// API Key Utilities\n// ============================================================================\n\n/**\n * Creates a Base64-encoded API key from clientKey and secretKey.\n * Use this for MCP server authentication.\n *\n * @param clientKey - Client API key\n * @param secretKey - Secret key\n * @returns Base64-encoded API key\n *\n * @example\n * ```typescript\n * const apiKey = createApiKey('client-key', 'secret-key')\n * // Use in x-api-key header\n * ```\n */\nexport function createApiKey(clientKey: string, secretKey: string): string {\n  if (!clientKey || !secretKey) {\n    throw new Error('clientKey and secretKey are required.')\n  }\n\n  // Browser와 Node.js 모두 지원\n  if (typeof Buffer !== 'undefined') {\n    return Buffer.from(`${clientKey}:${secretKey}`).toString('base64')\n  }\n  return btoa(`${clientKey}:${secretKey}`)\n}\n\n/**\n * Parses a Base64-encoded API key to extract clientKey and secretKey.\n *\n * @param apiKey - Base64-encoded API key\n * @returns Object containing clientKey and secretKey\n * @throws Error if API key is invalid\n *\n * @example\n * ```typescript\n * const { clientKey, secretKey } = parseApiKey(apiKey)\n * ```\n */\nexport function parseApiKey(apiKey: string): {\n  clientKey: string\n  secretKey: string\n} {\n  if (!apiKey) {\n    throw new Error('apiKey is required.')\n  }\n\n  try {\n    let decoded: string\n    if (typeof Buffer !== 'undefined') {\n      decoded = Buffer.from(apiKey, 'base64').toString('utf-8')\n    } else {\n      decoded = atob(apiKey)\n    }\n\n    const colonIndex = decoded.indexOf(':')\n    if (colonIndex === -1) {\n      throw new Error('Invalid format: missing colon separator')\n    }\n\n    const clientKey = decoded.substring(0, colonIndex)\n    const secretKey = decoded.substring(colonIndex + 1)\n\n    if (!clientKey || !secretKey) {\n      throw new Error('Invalid format: empty clientKey or secretKey')\n    }\n\n    return { clientKey, secretKey }\n  } catch {\n    throw new Error('Invalid API key. Expected Base64 encoded \"clientKey:secretKey\"')\n  }\n}\n\nfunction debugLog(\n  debug: boolean | DebugConfig | undefined,\n  type: 'request' | 'response' | 'error',\n  message: string,\n  data?: unknown,\n) {\n  if (!debug) return\n\n  const shouldLog =\n    debug === true ||\n    (type === 'request' && (debug as DebugConfig).logRequests) ||\n    (type === 'response' && (debug as DebugConfig).logResponses) ||\n    (type === 'error' && (debug as DebugConfig).logErrors)\n\n  if (shouldLog) {\n    console.group(`[SDK ${type.toUpperCase()}] ${message}`)\n    if (data) console.log(data)\n    console.groupEnd()\n  }\n}\n\nfunction getErrorSuggestion(status: number): string | undefined {\n  if (status === 401) return 'Please check your authentication credentials.'\n  if (status === 404) return 'The requested resource was not found.'\n  if (status >= 500)\n    return 'A server error occurred. Please try again later.'\n  return undefined\n}\n\nasync function delay(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms))\n}\n\nexport async function _fetch(\n  url: string,\n  options?: FetchOptions,\n): Promise<Response> {\n  const {\n    clientKey,\n    secretKey,\n    customerToken,\n    timeout = DEFAULT_TIMEOUT,\n    baseUrl = API_URLS.production,\n    debug,\n    retry,\n    ...requestInit\n  } = options || {}\n\n  const retryConfig = {\n    maxRetries: retry?.maxRetries ?? 3,\n    retryableStatuses: retry?.retryableStatuses ?? DEFAULT_RETRYABLE_STATUSES,\n    retryDelay:\n      retry?.retryDelay ??\n      ((attempt: number) => Math.min(1000 * 2 ** attempt, 10000)),\n  }\n\n  // Generate JWT once before retry loop (token valid for 1h)\n  let authToken: string | undefined\n  if (secretKey && clientKey) {\n    authToken = await createServerToken(clientKey, secretKey)\n  } else if (customerToken) {\n    authToken = customerToken\n  }\n\n  let lastError: Error | undefined\n\n  for (let attempt = 0; attempt <= retryConfig.maxRetries; attempt++) {\n    try {\n      const headers = new Headers(requestInit.headers)\n\n      if (clientKey) {\n        headers.set('X-Client-Key', clientKey)\n      }\n\n      if (authToken) {\n        headers.set('Authorization', `Bearer ${authToken}`)\n      }\n\n      if (!headers.has('Content-Type') && requestInit.body) {\n        headers.set('Content-Type', 'application/json')\n      }\n\n      // Redact sensitive headers for debug logging\n      const redactedHeaders = Object.fromEntries(headers.entries())\n      if (redactedHeaders['authorization']) {\n        const token = redactedHeaders['authorization']\n        // Show only \"Bearer eyJ...****\" to aid debugging without exposing the full token\n        redactedHeaders['authorization'] = token.length > 15\n          ? `${token.slice(0, 15)}...****`\n          : '****'\n      }\n\n      debugLog(debug, 'request', url, {\n        method: requestInit.method || 'GET',\n        headers: redactedHeaders,\n        attempt: attempt + 1,\n      })\n\n      const controller = new AbortController()\n      const timeoutId = setTimeout(() => controller.abort(), timeout)\n\n      const response = await fetch(`${baseUrl}${url}`, {\n        ...requestInit,\n        headers,\n        signal: controller.signal,\n      })\n\n      clearTimeout(timeoutId)\n\n      debugLog(debug, 'response', url, {\n        status: response.status,\n        statusText: response.statusText,\n        headers: Object.fromEntries(response.headers.entries()),\n      })\n\n      if (!response.ok) {\n        // Usage limit 429 — never retry (distinguished by X-Usage-Limit header)\n        if (\n          response.status === 429 &&\n          response.headers.get('X-Usage-Limit')\n        ) {\n          const limit = parseInt(response.headers.get('X-Usage-Limit') || '0', 10)\n          const current = parseInt(response.headers.get('X-Usage-Current') || '0', 10)\n          const remaining = parseInt(response.headers.get('X-Usage-Remaining') || '0', 10)\n\n          throw createUsageLimitError(\n            `Monthly API usage limit exceeded (${current.toLocaleString()}/${limit.toLocaleString()})`,\n            { limit, current, remaining },\n            { url, method: requestInit.method || 'GET', attempt: attempt + 1 },\n            'Monthly API call limit exceeded. Please upgrade your plan.',\n            'Upgrade your tenant plan to increase the monthly API call limit.',\n          )\n        }\n\n        // Never retry non-retryable statuses regardless of user config\n        if (NON_RETRYABLE_STATUSES.includes(response.status)) {\n          throw createNetworkError(\n            `HTTP ${response.status}: ${response.statusText}`,\n            response.status,\n            { url, method: requestInit.method || 'GET', attempt: attempt + 1 },\n            `Request failed (status: ${response.status})`,\n            getErrorSuggestion(response.status),\n          )\n        }\n\n        const error = createNetworkError(\n          `HTTP ${response.status}: ${response.statusText}`,\n          response.status,\n          { url, method: requestInit.method || 'GET', attempt: attempt + 1 },\n          `Request failed (status: ${response.status})`,\n          getErrorSuggestion(response.status),\n        )\n\n        const method = (requestInit.method || 'GET').toUpperCase()\n        if (\n          attempt < retryConfig.maxRetries &&\n          SAFE_METHODS.includes(method) &&\n          retryConfig.retryableStatuses.includes(response.status)\n        ) {\n          lastError = error\n          const retryDelay = retryConfig.retryDelay(attempt)\n          debugLog(debug, 'error', `Retrying in ${retryDelay}ms...`, error)\n          await delay(retryDelay)\n          continue\n        }\n\n        throw error\n      }\n\n      return response\n    } catch (error) {\n      debugLog(debug, 'error', url, error)\n\n      const method = (requestInit.method || 'GET').toUpperCase()\n      const isSafe = SAFE_METHODS.includes(method)\n\n      if (error instanceof Error && error.name === 'AbortError') {\n        const timeoutError = createTimeoutError(\n          `Request timed out after ${timeout}ms.`,\n          { url, timeout, attempt: attempt + 1 },\n          'The request timed out.',\n          'Please check your network connection or try again later.',\n        )\n\n        if (isSafe && attempt < retryConfig.maxRetries) {\n          lastError = timeoutError\n          await delay(retryConfig.retryDelay(attempt))\n          continue\n        }\n\n        throw timeoutError\n      }\n\n      if (error instanceof TypeError) {\n        const networkError = createNetworkError(\n          'Network connection failed.',\n          undefined,\n          { url, originalError: error.message, attempt: attempt + 1 },\n          'Network connection failed.',\n          'Please check your internet connection and try again.',\n        )\n\n        if (isSafe && attempt < retryConfig.maxRetries) {\n          lastError = networkError\n          await delay(retryConfig.retryDelay(attempt))\n          continue\n        }\n\n        throw networkError\n      }\n\n      if (error instanceof NetworkError || error instanceof TimeoutError) {\n        if (\n          isSafe &&\n          attempt < retryConfig.maxRetries &&\n          error.status &&\n          !NON_RETRYABLE_STATUSES.includes(error.status) &&\n          retryConfig.retryableStatuses.includes(error.status)\n        ) {\n          lastError = error\n          await delay(retryConfig.retryDelay(attempt))\n          continue\n        }\n\n        throw error\n      }\n\n      const unknownError = createNetworkError(\n        error instanceof Error\n          ? error.message\n          : 'An unknown network error occurred.',\n        undefined,\n        { url, originalError: error, attempt: attempt + 1 },\n        'An unknown error occurred.',\n        'Please try again later.',\n      )\n\n      if (isSafe && attempt < retryConfig.maxRetries) {\n        lastError = unknownError\n        await delay(retryConfig.retryDelay(attempt))\n        continue\n      }\n\n      throw unknownError\n    }\n  }\n\n  throw lastError ?? new NetworkError('Request failed after retries')\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS,WAAW,iBAAiB;AAyC9C,SAAsB,kBACpB,WACA,WACA,YAAoB,MACH;AAAA;AACjB,QAAI,CAAC,aAAa,CAAC,WAAW;AAC5B,YAAM,IAAI,MAAM,uCAAuC;AAAA,IACzD;AAEA,UAAM,SAAS,IAAI,YAAY,EAAE,OAAO,SAAS;AACjD,WAAO,IAAI,QAAQ,EAAE,UAAU,CAAC,EAC7B,mBAAmB,EAAE,KAAK,QAAQ,CAAC,EACnC,YAAY,EACZ,kBAAkB,SAAS,EAC3B,KAAK,MAAM;AAAA,EAChB;AAAA;AAgBA,SAAsB,kBACpB,OACA,WACqB;AAAA;AACrB,QAAI,CAAC,SAAS,CAAC,WAAW;AACxB,YAAM,IAAI,MAAM,mCAAmC;AAAA,IACrD;AAEA,UAAM,SAAS,IAAI,YAAY,EAAE,OAAO,SAAS;AACjD,UAAM,EAAE,QAAQ,IAAI,MAAM,UAAU,OAAO,QAAQ;AAAA,MACjD,YAAY,CAAC,OAAO;AAAA,IACtB,CAAC;AAED,QAAI,CAAC,QAAQ,aAAa,OAAO,QAAQ,cAAc,UAAU;AAC/D,YAAM,IAAI,MAAM,6CAA6C;AAAA,IAC/D;AAEA,WAAO;AAAA,MACL,WAAW,QAAQ;AAAA,MACnB,KAAK,QAAQ;AAAA,MACb,KAAK,QAAQ;AAAA,IACf;AAAA,EACF;AAAA;AAgBO,SAAS,kBAAkB,OAA2B;AAC3D,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,oBAAoB;AAAA,EACtC;AAEA,QAAM,UAAU,UAAU,KAAK;AAE/B,MAAI,CAAC,QAAQ,aAAa,OAAO,QAAQ,cAAc,UAAU;AAC/D,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AAEA,SAAO;AAAA,IACL,WAAW,QAAQ;AAAA,IACnB,KAAK,QAAQ;AAAA,IACb,KAAK,QAAQ;AAAA,EACf;AACF;AAoBO,SAAS,aAAa,WAAmB,WAA2B;AACzE,MAAI,CAAC,aAAa,CAAC,WAAW;AAC5B,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACzD;AAGA,MAAI,OAAO,WAAW,aAAa;AACjC,WAAO,OAAO,KAAK,GAAG,SAAS,IAAI,SAAS,EAAE,EAAE,SAAS,QAAQ;AAAA,EACnE;AACA,SAAO,KAAK,GAAG,SAAS,IAAI,SAAS,EAAE;AACzC;AAcO,SAAS,YAAY,QAG1B;AACA,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,qBAAqB;AAAA,EACvC;AAEA,MAAI;AACF,QAAI;AACJ,QAAI,OAAO,WAAW,aAAa;AACjC,gBAAU,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,OAAO;AAAA,IAC1D,OAAO;AACL,gBAAU,KAAK,MAAM;AAAA,IACvB;AAEA,UAAM,aAAa,QAAQ,QAAQ,GAAG;AACtC,QAAI,eAAe,IAAI;AACrB,YAAM,IAAI,MAAM,yCAAyC;AAAA,IAC3D;AAEA,UAAM,YAAY,QAAQ,UAAU,GAAG,UAAU;AACjD,UAAM,YAAY,QAAQ,UAAU,aAAa,CAAC;AAElD,QAAI,CAAC,aAAa,CAAC,WAAW;AAC5B,YAAM,IAAI,MAAM,8CAA8C;AAAA,IAChE;AAEA,WAAO,EAAE,WAAW,UAAU;AAAA,EAChC,SAAQ;AACN,UAAM,IAAI,MAAM,gEAAgE;AAAA,EAClF;AACF;","names":[]}
+{"version":3,"sources":["../src/core/internal/utils/index.ts"],"sourcesContent":["import { SignJWT, jwtVerify, decodeJwt } from 'jose'\nimport { createNetworkError, createUsageLimitError, createTimeoutError, TimeoutError, NetworkError } from '../errors'\nimport type { DebugConfig, RetryConfig } from '../../client/types'\nimport { API_URLS } from '../../client/types'\n\nconst DEFAULT_TIMEOUT = 30000\nconst DEFAULT_RETRYABLE_STATUSES = [408, 429, 500, 502, 503, 504]\nconst NON_RETRYABLE_STATUSES = [401, 403, 404, 422]\nconst SAFE_METHODS = ['GET', 'HEAD', 'OPTIONS']\n\nexport interface FetchOptions extends RequestInit {\n  clientKey?: string\n  secretKey?: string\n  customerToken?: string\n  timeout?: number\n  baseUrl?: string\n  debug?: boolean | DebugConfig\n  retry?: RetryConfig\n}\n\nexport interface JwtPayload {\n  clientKey: string\n  iat?: number\n  exp?: number\n}\n\n/**\n * Creates a JWT token for server-side authentication.\n * The token is valid for 1 hour by default.\n *\n * @param clientKey - Client API key\n * @param secretKey - Secret key used for signing\n * @param expiresIn - Token expiration time (default: '1h')\n * @returns Promise<string> JWT token\n *\n * @example\n * ```typescript\n * const token = await createServerToken('client-key', 'secret-key')\n * // Use in Authorization header: `Bearer ${token}`\n * ```\n */\nexport async function createServerToken(\n  clientKey: string,\n  secretKey: string,\n  expiresIn: string = '1h',\n): Promise<string> {\n  if (!clientKey || !secretKey) {\n    throw new Error('clientKey and secretKey are required.')\n  }\n\n  const secret = new TextEncoder().encode(secretKey)\n  return new SignJWT({ clientKey })\n    .setProtectedHeader({ alg: 'HS256' })\n    .setIssuedAt()\n    .setExpirationTime(expiresIn)\n    .sign(secret)\n}\n\n/**\n * Verifies a JWT token and returns the payload.\n *\n * @param token - JWT token to verify\n * @param secretKey - Secret key used for verification\n * @returns Promise<JwtPayload> Verified payload containing clientKey\n * @throws Error if token is invalid or expired\n *\n * @example\n * ```typescript\n * const payload = await verifyServerToken(token, 'secret-key')\n * console.log(payload.clientKey)\n * ```\n */\nexport async function verifyServerToken(\n  token: string,\n  secretKey: string,\n): Promise<JwtPayload> {\n  if (!token || !secretKey) {\n    throw new Error('token and secretKey are required.')\n  }\n\n  const secret = new TextEncoder().encode(secretKey)\n  const { payload } = await jwtVerify(token, secret, {\n    algorithms: ['HS256'],\n  })\n\n  if (!payload.clientKey || typeof payload.clientKey !== 'string') {\n    throw new Error('Invalid token payload: clientKey is missing')\n  }\n\n  return {\n    clientKey: payload.clientKey as string,\n    iat: payload.iat,\n    exp: payload.exp,\n  }\n}\n\n/**\n * Decodes a JWT token without verification.\n * WARNING: Use this only when you need to inspect token contents.\n * Always use verifyServerToken for authentication.\n *\n * @param token - JWT token to decode\n * @returns JwtPayload Decoded payload (unverified)\n *\n * @example\n * ```typescript\n * const payload = decodeServerToken(token)\n * console.log(payload.clientKey) // Unverified!\n * ```\n */\nexport function decodeServerToken(token: string): JwtPayload {\n  if (!token) {\n    throw new Error('token is required.')\n  }\n\n  const payload = decodeJwt(token)\n\n  if (!payload.clientKey || typeof payload.clientKey !== 'string') {\n    throw new Error('Invalid token payload: clientKey is missing')\n  }\n\n  return {\n    clientKey: payload.clientKey as string,\n    iat: payload.iat,\n    exp: payload.exp,\n  }\n}\n\n// ============================================================================\n// API Key Utilities\n// ============================================================================\n\n/**\n * Creates a Base64-encoded API key from clientKey and secretKey.\n * Use this for MCP server authentication.\n *\n * @param clientKey - Client API key\n * @param secretKey - Secret key\n * @returns Base64-encoded API key\n *\n * @example\n * ```typescript\n * const apiKey = createApiKey('client-key', 'secret-key')\n * // Use in x-api-key header\n * ```\n */\nexport function createApiKey(clientKey: string, secretKey: string): string {\n  if (!clientKey || !secretKey) {\n    throw new Error('clientKey and secretKey are required.')\n  }\n\n  // Browser와 Node.js 모두 지원\n  if (typeof Buffer !== 'undefined') {\n    return Buffer.from(`${clientKey}:${secretKey}`).toString('base64')\n  }\n  return btoa(`${clientKey}:${secretKey}`)\n}\n\n/**\n * Parses a Base64-encoded API key to extract clientKey and secretKey.\n *\n * @param apiKey - Base64-encoded API key\n * @returns Object containing clientKey and secretKey\n * @throws Error if API key is invalid\n *\n * @example\n * ```typescript\n * const { clientKey, secretKey } = parseApiKey(apiKey)\n * ```\n */\nexport function parseApiKey(apiKey: string): {\n  clientKey: string\n  secretKey: string\n} {\n  if (!apiKey) {\n    throw new Error('apiKey is required.')\n  }\n\n  try {\n    let decoded: string\n    if (typeof Buffer !== 'undefined') {\n      decoded = Buffer.from(apiKey, 'base64').toString('utf-8')\n    } else {\n      decoded = atob(apiKey)\n    }\n\n    const colonIndex = decoded.indexOf(':')\n    if (colonIndex === -1) {\n      throw new Error('Invalid format: missing colon separator')\n    }\n\n    const clientKey = decoded.substring(0, colonIndex)\n    const secretKey = decoded.substring(colonIndex + 1)\n\n    if (!clientKey || !secretKey) {\n      throw new Error('Invalid format: empty clientKey or secretKey')\n    }\n\n    return { clientKey, secretKey }\n  } catch {\n    throw new Error('Invalid API key. Expected Base64 encoded \"clientKey:secretKey\"')\n  }\n}\n\nfunction debugLog(\n  debug: boolean | DebugConfig | undefined,\n  type: 'request' | 'response' | 'error',\n  message: string,\n  data?: unknown,\n) {\n  if (!debug) return\n\n  const shouldLog =\n    debug === true ||\n    (type === 'request' && (debug as DebugConfig).logRequests) ||\n    (type === 'response' && (debug as DebugConfig).logResponses) ||\n    (type === 'error' && (debug as DebugConfig).logErrors)\n\n  if (shouldLog) {\n    console.group(`[SDK ${type.toUpperCase()}] ${message}`)\n    if (data) console.log(data)\n    console.groupEnd()\n  }\n}\n\nfunction getErrorSuggestion(status: number): string | undefined {\n  if (status === 401) return 'Please check your authentication credentials.'\n  if (status === 404) return 'The requested resource was not found.'\n  if (status >= 500)\n    return 'A server error occurred. Please try again later.'\n  return undefined\n}\n\nasync function delay(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms))\n}\n\nexport async function _fetch(\n  url: string,\n  options?: FetchOptions,\n): Promise<Response> {\n  const {\n    clientKey,\n    secretKey,\n    customerToken,\n    timeout = DEFAULT_TIMEOUT,\n    baseUrl = API_URLS.production,\n    debug,\n    retry,\n    ...requestInit\n  } = options || {}\n\n  const retryConfig = {\n    maxRetries: retry?.maxRetries ?? 3,\n    retryableStatuses: retry?.retryableStatuses ?? DEFAULT_RETRYABLE_STATUSES,\n    retryDelay:\n      retry?.retryDelay ??\n      ((attempt: number) => Math.min(1000 * 2 ** attempt, 10000)),\n  }\n\n  // Generate JWT once before retry loop (token valid for 1h)\n  let authToken: string | undefined\n  if (secretKey && clientKey) {\n    authToken = await createServerToken(clientKey, secretKey)\n  } else if (customerToken) {\n    authToken = customerToken\n  }\n\n  let lastError: Error | undefined\n\n  for (let attempt = 0; attempt <= retryConfig.maxRetries; attempt++) {\n    try {\n      const headers = new Headers(requestInit.headers)\n\n      if (clientKey) {\n        headers.set('X-Client-Key', clientKey)\n      }\n\n      if (authToken) {\n        headers.set('Authorization', `Bearer ${authToken}`)\n      }\n\n      if (!headers.has('Content-Type') && requestInit.body && !(requestInit.body instanceof FormData)) {\n        headers.set('Content-Type', 'application/json')\n      }\n\n      // Redact sensitive headers for debug logging\n      const redactedHeaders = Object.fromEntries(headers.entries())\n      if (redactedHeaders['authorization']) {\n        const token = redactedHeaders['authorization']\n        // Show only \"Bearer eyJ...****\" to aid debugging without exposing the full token\n        redactedHeaders['authorization'] = token.length > 15\n          ? `${token.slice(0, 15)}...****`\n          : '****'\n      }\n\n      debugLog(debug, 'request', url, {\n        method: requestInit.method || 'GET',\n        headers: redactedHeaders,\n        attempt: attempt + 1,\n      })\n\n      const controller = new AbortController()\n      const timeoutId = setTimeout(() => controller.abort(), timeout)\n\n      const response = await fetch(`${baseUrl}${url}`, {\n        ...requestInit,\n        headers,\n        signal: controller.signal,\n      })\n\n      clearTimeout(timeoutId)\n\n      debugLog(debug, 'response', url, {\n        status: response.status,\n        statusText: response.statusText,\n        headers: Object.fromEntries(response.headers.entries()),\n      })\n\n      if (!response.ok) {\n        // Usage limit 429 — never retry (distinguished by X-Usage-Limit header)\n        if (\n          response.status === 429 &&\n          response.headers.get('X-Usage-Limit')\n        ) {\n          const limit = parseInt(response.headers.get('X-Usage-Limit') || '0', 10)\n          const current = parseInt(response.headers.get('X-Usage-Current') || '0', 10)\n          const remaining = parseInt(response.headers.get('X-Usage-Remaining') || '0', 10)\n\n          throw createUsageLimitError(\n            `Monthly API usage limit exceeded (${current.toLocaleString()}/${limit.toLocaleString()})`,\n            { limit, current, remaining },\n            { url, method: requestInit.method || 'GET', attempt: attempt + 1 },\n            'Monthly API call limit exceeded. Please upgrade your plan.',\n            'Upgrade your tenant plan to increase the monthly API call limit.',\n          )\n        }\n\n        // Never retry non-retryable statuses regardless of user config\n        if (NON_RETRYABLE_STATUSES.includes(response.status)) {\n          throw createNetworkError(\n            `HTTP ${response.status}: ${response.statusText}`,\n            response.status,\n            { url, method: requestInit.method || 'GET', attempt: attempt + 1 },\n            `Request failed (status: ${response.status})`,\n            getErrorSuggestion(response.status),\n          )\n        }\n\n        const error = createNetworkError(\n          `HTTP ${response.status}: ${response.statusText}`,\n          response.status,\n          { url, method: requestInit.method || 'GET', attempt: attempt + 1 },\n          `Request failed (status: ${response.status})`,\n          getErrorSuggestion(response.status),\n        )\n\n        const method = (requestInit.method || 'GET').toUpperCase()\n        if (\n          attempt < retryConfig.maxRetries &&\n          SAFE_METHODS.includes(method) &&\n          retryConfig.retryableStatuses.includes(response.status)\n        ) {\n          lastError = error\n          const retryDelay = retryConfig.retryDelay(attempt)\n          debugLog(debug, 'error', `Retrying in ${retryDelay}ms...`, error)\n          await delay(retryDelay)\n          continue\n        }\n\n        throw error\n      }\n\n      return response\n    } catch (error) {\n      debugLog(debug, 'error', url, error)\n\n      const method = (requestInit.method || 'GET').toUpperCase()\n      const isSafe = SAFE_METHODS.includes(method)\n\n      if (error instanceof Error && error.name === 'AbortError') {\n        const timeoutError = createTimeoutError(\n          `Request timed out after ${timeout}ms.`,\n          { url, timeout, attempt: attempt + 1 },\n          'The request timed out.',\n          'Please check your network connection or try again later.',\n        )\n\n        if (isSafe && attempt < retryConfig.maxRetries) {\n          lastError = timeoutError\n          await delay(retryConfig.retryDelay(attempt))\n          continue\n        }\n\n        throw timeoutError\n      }\n\n      if (error instanceof TypeError) {\n        const networkError = createNetworkError(\n          'Network connection failed.',\n          undefined,\n          { url, originalError: error.message, attempt: attempt + 1 },\n          'Network connection failed.',\n          'Please check your internet connection and try again.',\n        )\n\n        if (isSafe && attempt < retryConfig.maxRetries) {\n          lastError = networkError\n          await delay(retryConfig.retryDelay(attempt))\n          continue\n        }\n\n        throw networkError\n      }\n\n      if (error instanceof NetworkError || error instanceof TimeoutError) {\n        if (\n          isSafe &&\n          attempt < retryConfig.maxRetries &&\n          error.status &&\n          !NON_RETRYABLE_STATUSES.includes(error.status) &&\n          retryConfig.retryableStatuses.includes(error.status)\n        ) {\n          lastError = error\n          await delay(retryConfig.retryDelay(attempt))\n          continue\n        }\n\n        throw error\n      }\n\n      const unknownError = createNetworkError(\n        error instanceof Error\n          ? error.message\n          : 'An unknown network error occurred.',\n        undefined,\n        { url, originalError: error, attempt: attempt + 1 },\n        'An unknown error occurred.',\n        'Please try again later.',\n      )\n\n      if (isSafe && attempt < retryConfig.maxRetries) {\n        lastError = unknownError\n        await delay(retryConfig.retryDelay(attempt))\n        continue\n      }\n\n      throw unknownError\n    }\n  }\n\n  throw lastError ?? new NetworkError('Request failed after retries')\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS,WAAW,iBAAiB;AAyC9C,SAAsB,kBACpB,WACA,WACA,YAAoB,MACH;AAAA;AACjB,QAAI,CAAC,aAAa,CAAC,WAAW;AAC5B,YAAM,IAAI,MAAM,uCAAuC;AAAA,IACzD;AAEA,UAAM,SAAS,IAAI,YAAY,EAAE,OAAO,SAAS;AACjD,WAAO,IAAI,QAAQ,EAAE,UAAU,CAAC,EAC7B,mBAAmB,EAAE,KAAK,QAAQ,CAAC,EACnC,YAAY,EACZ,kBAAkB,SAAS,EAC3B,KAAK,MAAM;AAAA,EAChB;AAAA;AAgBA,SAAsB,kBACpB,OACA,WACqB;AAAA;AACrB,QAAI,CAAC,SAAS,CAAC,WAAW;AACxB,YAAM,IAAI,MAAM,mCAAmC;AAAA,IACrD;AAEA,UAAM,SAAS,IAAI,YAAY,EAAE,OAAO,SAAS;AACjD,UAAM,EAAE,QAAQ,IAAI,MAAM,UAAU,OAAO,QAAQ;AAAA,MACjD,YAAY,CAAC,OAAO;AAAA,IACtB,CAAC;AAED,QAAI,CAAC,QAAQ,aAAa,OAAO,QAAQ,cAAc,UAAU;AAC/D,YAAM,IAAI,MAAM,6CAA6C;AAAA,IAC/D;AAEA,WAAO;AAAA,MACL,WAAW,QAAQ;AAAA,MACnB,KAAK,QAAQ;AAAA,MACb,KAAK,QAAQ;AAAA,IACf;AAAA,EACF;AAAA;AAgBO,SAAS,kBAAkB,OAA2B;AAC3D,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,oBAAoB;AAAA,EACtC;AAEA,QAAM,UAAU,UAAU,KAAK;AAE/B,MAAI,CAAC,QAAQ,aAAa,OAAO,QAAQ,cAAc,UAAU;AAC/D,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AAEA,SAAO;AAAA,IACL,WAAW,QAAQ;AAAA,IACnB,KAAK,QAAQ;AAAA,IACb,KAAK,QAAQ;AAAA,EACf;AACF;AAoBO,SAAS,aAAa,WAAmB,WAA2B;AACzE,MAAI,CAAC,aAAa,CAAC,WAAW;AAC5B,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACzD;AAGA,MAAI,OAAO,WAAW,aAAa;AACjC,WAAO,OAAO,KAAK,GAAG,SAAS,IAAI,SAAS,EAAE,EAAE,SAAS,QAAQ;AAAA,EACnE;AACA,SAAO,KAAK,GAAG,SAAS,IAAI,SAAS,EAAE;AACzC;AAcO,SAAS,YAAY,QAG1B;AACA,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,qBAAqB;AAAA,EACvC;AAEA,MAAI;AACF,QAAI;AACJ,QAAI,OAAO,WAAW,aAAa;AACjC,gBAAU,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,OAAO;AAAA,IAC1D,OAAO;AACL,gBAAU,KAAK,MAAM;AAAA,IACvB;AAEA,UAAM,aAAa,QAAQ,QAAQ,GAAG;AACtC,QAAI,eAAe,IAAI;AACrB,YAAM,IAAI,MAAM,yCAAyC;AAAA,IAC3D;AAEA,UAAM,YAAY,QAAQ,UAAU,GAAG,UAAU;AACjD,UAAM,YAAY,QAAQ,UAAU,aAAa,CAAC;AAElD,QAAI,CAAC,aAAa,CAAC,WAAW;AAC5B,YAAM,IAAI,MAAM,8CAA8C;AAAA,IAChE;AAEA,WAAO,EAAE,WAAW,UAAU;AAAA,EAChC,SAAQ;AACN,UAAM,IAAI,MAAM,gEAAgE;AAAA,EAClF;AACF;","names":[]}

package/dist/components.d.cts

@@ -2,7 +2,7 @@ import React, { CSSProperties } from 'react';
 import { SerializedLinkNode, SerializedBlockNode } from '@payloadcms/richtext-lexical';
 import { SerializedEditorState, SerializedLexicalNode } from '@payloadcms/richtext-lexical/lexical';
 import { JSXConverter } from '@payloadcms/richtext-lexical/react';
-import { F as Form } from './payload-types-CRSz8jfP.cjs';
+import { F as Form } from './payload-types-Bpi16SHO.cjs';
 import { I as ImageData } from './image-TT8lTsk5.cjs';
 
 type RichTextData = SerializedEditorState<SerializedLexicalNode>;

package/dist/components.d.ts

@@ -2,7 +2,7 @@ import React, { CSSProperties } from 'react';
 import { SerializedLinkNode, SerializedBlockNode } from '@payloadcms/richtext-lexical';
 import { SerializedEditorState, SerializedLexicalNode } from '@payloadcms/richtext-lexical/lexical';
 import { JSXConverter } from '@payloadcms/richtext-lexical/react';
-import { F as Form } from './payload-types-CRSz8jfP.js';
+import { F as Form } from './payload-types-Bpi16SHO.js';
 import { I as ImageData } from './image-TT8lTsk5.js';
 
 type RichTextData = SerializedEditorState<SerializedLexicalNode>;

package/dist/index.cjs

@@ -385,7 +385,7 @@ function _fetch(url, options) {
         if (authToken) {
           headers.set("Authorization", `Bearer ${authToken}`);
         }
-        if (!headers.has("Content-Type") && requestInit.body) {
+        if (!headers.has("Content-Type") && requestInit.body && !(requestInit.body instanceof FormData)) {
           headers.set("Content-Type", "application/json");
         }
         const redactedHeaders = Object.fromEntries(headers.entries());
@@ -701,7 +701,7 @@ var ProductApi = class {
 
 // src/utils/types.ts
 var resolveRelation = (ref) => {
-  if (typeof ref === "string" || typeof ref === "number" || ref === null || ref === void 0)
+  if (typeof ref === "string" || ref === null || ref === void 0)
     return null;
   return ref;
 };
@@ -789,12 +789,18 @@ var CollectionQueryBuilder = class {
    * POST /api/{collection}
    * @returns Payload CMS mutation response with doc and message
    */
-  create(data) {
+  create(data, options) {
     return __async(this, null, function* () {
-      return this.api.requestCreate(
-        `/api/${String(this.collection)}`,
-        data
-      );
+      const endpoint = `/api/${String(this.collection)}`;
+      if (options == null ? void 0 : options.file) {
+        return this.api.requestCreateWithFile(
+          endpoint,
+          data,
+          options.file,
+          options.filename
+        );
+      }
+      return this.api.requestCreate(endpoint, data);
     });
   }
   /**
@@ -802,12 +808,18 @@ var CollectionQueryBuilder = class {
    * PATCH /api/{collection}/{id}
    * @returns Payload CMS mutation response with doc and message
    */
-  update(id, data) {
+  update(id, data, options) {
     return __async(this, null, function* () {
-      return this.api.requestUpdate(
-        `/api/${String(this.collection)}/${String(id)}`,
-        data
-      );
+      const endpoint = `/api/${String(this.collection)}/${String(id)}`;
+      if (options == null ? void 0 : options.file) {
+        return this.api.requestUpdateWithFile(
+          endpoint,
+          data,
+          options.file,
+          options.filename
+        );
+      }
+      return this.api.requestUpdate(endpoint, data);
     });
   }
   /**
@@ -1007,6 +1019,14 @@ var HttpClient = class {
 };
 
 // src/core/collection/collection-client.ts
+function buildPayloadFormData(data, file, filename) {
+  const formData = new FormData();
+  formData.append("file", file, filename);
+  if (data != null) {
+    formData.append("_payload", JSON.stringify(data));
+  }
+  return formData;
+}
 var CollectionClient = class extends HttpClient {
   constructor(clientKey, secretKey, baseUrl, getCustomerToken) {
     super(clientKey, secretKey, baseUrl, getCustomerToken);
@@ -1114,6 +1134,32 @@ var CollectionClient = class extends HttpClient {
       return this.parseFindResponse(response);
     });
   }
+  /**
+   * Create document with file upload
+   * POST /api/{collection} (multipart/form-data)
+   */
+  requestCreateWithFile(endpoint, data, file, filename) {
+    return __async(this, null, function* () {
+      const response = yield _fetch(endpoint, __spreadProps(__spreadValues({}, this.defaultOptions), {
+        method: "POST",
+        body: buildPayloadFormData(data, file, filename)
+      }));
+      return this.parseMutationResponse(response);
+    });
+  }
+  /**
+   * Update document with file upload
+   * PATCH /api/{collection}/{id} (multipart/form-data)
+   */
+  requestUpdateWithFile(endpoint, data, file, filename) {
+    return __async(this, null, function* () {
+      const response = yield _fetch(endpoint, __spreadProps(__spreadValues({}, this.defaultOptions), {
+        method: "PATCH",
+        body: buildPayloadFormData(data, file, filename)
+      }));
+      return this.parseMutationResponse(response);
+    });
+  }
 };
 
 // src/core/collection/const.ts
@@ -1556,8 +1602,11 @@ var QueryHooks = class {
   useCreate(params, options) {
     const { collection } = params;
     return (0, import_react_query2.useMutation)({
-      mutationFn: (data) => __async(this, null, function* () {
-        return yield this.collectionClient.from(collection).create(data);
+      mutationFn: (variables) => __async(this, null, function* () {
+        return yield this.collectionClient.from(collection).create(
+          variables.data,
+          variables.file ? { file: variables.file, filename: variables.filename } : void 0
+        );
       }),
       onSuccess: (data) => {
         var _a;
@@ -1572,7 +1621,11 @@ var QueryHooks = class {
     const { collection } = params;
     return (0, import_react_query2.useMutation)({
       mutationFn: (variables) => __async(this, null, function* () {
-        return yield this.collectionClient.from(collection).update(variables.id, variables.data);
+        return yield this.collectionClient.from(collection).update(
+          variables.id,
+          variables.data,
+          variables.file ? { file: variables.file, filename: variables.filename } : void 0
+        );
       }),
       onSuccess: (data) => {
         var _a;