@axcode/axcloud-sdk 0.1.0 → 0.1.1

package/README.md

@@ -8,6 +8,35 @@ SDK for building websites with AxCloud CMS and member management.
 npm install @axcode/axcloud-sdk
 ```
 
+### Version Tags
+
+The SDK is published with two tags for different environments:
+
+| Tag | Purpose | Stability | Install |
+|-----|---------|-----------|---------|
+| `latest` | Production | Stable, tested | `npm install @axcode/axcloud-sdk` |
+| `next` | Development/Staging | Preview, may have breaking changes | `npm install @axcode/axcloud-sdk@next` |
+
+**Recommended setup:**
+
+```json
+// Production project (package.json)
+{
+  "dependencies": {
+    "@axcode/axcloud-sdk": "^0.1.0"
+  }
+}
+
+// Development/Staging project (package.json)
+{
+  "dependencies": {
+    "@axcode/axcloud-sdk": "next"
+  }
+}
+```
+
+This allows you to test new SDK features in your staging environment before they reach production.
+
 ## Quick Start
 
 ### 1. Wrap your app with AxCloudProvider
@@ -20,7 +49,7 @@ function App() {
     <AxCloudProvider
       orgId="org_ba81807b"  // Your organization ID
       apiUrl="https://api.axcloud.app"
-      apiKey="sk_live_..."  // API key from Settings → API Keys
+      apiKey="pk_live_..."  // Public API key from Settings → API Keys
       auth0={{
         domain: "auth.axcloud.app",
         clientId: "your-client-id",

package/dist/index.d.mts

@@ -37,6 +37,11 @@ declare class AxCloudClient {
      * Build URL with query parameters
      */
     private buildUrl;
+    /**
+     * API key should only be sent to public endpoints.
+     * This avoids leaking public keys to authenticated/internal routes.
+     */
+    private shouldAttachApiKey;
     /**
      * Make an authenticated request
      */
@@ -761,7 +766,7 @@ declare function useOrg(): {
  * @example
  * // With pagination
  * ```tsx
- * const { data, hasMore, fetchNextPage } = useNews({
+ * const { data, hasMore, refetch } = useNews({
  *   pageSize: 10,
  *   status: 'published'
  * })

package/dist/index.d.ts

@@ -37,6 +37,11 @@ declare class AxCloudClient {
      * Build URL with query parameters
      */
     private buildUrl;
+    /**
+     * API key should only be sent to public endpoints.
+     * This avoids leaking public keys to authenticated/internal routes.
+     */
+    private shouldAttachApiKey;
     /**
      * Make an authenticated request
      */
@@ -761,7 +766,7 @@ declare function useOrg(): {
  * @example
  * // With pagination
  * ```tsx
- * const { data, hasMore, fetchNextPage } = useNews({
+ * const { data, hasMore, refetch } = useNews({
  *   pageSize: 10,
  *   status: 'published'
  * })

package/dist/index.js

@@ -118,6 +118,14 @@ var AxCloudClient = class {
     }
     return url.toString();
   }
+  /**
+   * API key should only be sent to public endpoints.
+   * This avoids leaking public keys to authenticated/internal routes.
+   */
+  shouldAttachApiKey(path) {
+    const normalized = path.startsWith("/") ? path : `/${path}`;
+    return normalized.startsWith("/public/") || normalized.startsWith("/api/public/") || normalized.startsWith("/content/public/");
+  }
   /**
    * Make an authenticated request
    */
@@ -130,7 +138,7 @@ var AxCloudClient = class {
       const customHeadersRecord = customHeaders;
       Object.assign(headers, customHeadersRecord);
     }
-    if (this.apiKey) {
+    if (this.apiKey && this.shouldAttachApiKey(path)) {
       headers["x-api-key"] = this.apiKey;
     }
     if (this.getAccessToken) {
@@ -249,30 +257,55 @@ function userHasAllPermissions(user, permissions) {
 
 // src/core/forms.ts
 async function submitForm(apiUrl, submission) {
-  const url = `${apiUrl.replace(/\/$/, "")}/public/submit`;
-  const response = await fetch(url, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json"
-    },
-    body: JSON.stringify({
-      api_key: submission.apiKey,
-      site: submission.site,
-      form_type: submission.formType,
-      email: submission.email,
-      data: submission.data || {}
-    })
-  });
-  if (!response.ok) {
-    const error = await response.json().catch(() => ({ message: "Form submission failed" }));
-    throw new Error(error.message || "Form submission failed");
+  const baseUrl = apiUrl.replace(/\/$/, "");
+  try {
+    const response = await fetch(`${baseUrl}/public/submit`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        api_key: submission.apiKey,
+        site: submission.site,
+        form_type: submission.formType,
+        email: submission.email,
+        data: submission.data || {}
+      })
+    });
+    if (!response.ok) {
+      const error = await response.json().catch(() => ({ message: "Form submission failed" }));
+      throw new Error(error.message || "Form submission failed");
+    }
+    const result = await response.json();
+    return {
+      success: result.success,
+      message: result.message,
+      submissionId: result.submission_id
+    };
+  } catch (primaryError) {
+    try {
+      const notifyResponse = await fetch(`${baseUrl}/public/notify`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          api_key: submission.apiKey,
+          site: submission.site,
+          form_type: submission.formType,
+          email: submission.email
+        })
+      });
+      if (notifyResponse.ok) {
+        const result = await notifyResponse.json();
+        return {
+          success: true,
+          message: result.message || "Thanks! We'll notify you when we launch.",
+          submissionId: "fallback"
+        };
+      }
+    } catch {
+    }
+    throw primaryError;
   }
-  const result = await response.json();
-  return {
-    success: result.success,
-    message: result.message,
-    submissionId: result.submission_id
-  };
 }
 function createFormHelper(config) {
   return {
@@ -572,8 +605,8 @@ function useUser() {
   };
 }
 function useOrg() {
-  const { client, orgId, stage, config } = useAxCloudContext();
-  const usePublicEndpoint = Boolean(config.apiKey);
+  const { client, orgId, stage, isPublicMode } = useAxCloudContext();
+  const usePublicEndpoint = isPublicMode;
   const query = reactQuery.useQuery({
     queryKey: ["axcloud", "organization", orgId, stage, usePublicEndpoint],
     queryFn: async () => {
@@ -632,7 +665,20 @@ function useNews(options = {}) {
   } = options;
   const usePublicEndpoint = isPublicMode || publicOnly;
   const query = reactQuery.useQuery({
-    queryKey: ["axcloud", "news", orgId, usePublicEndpoint, options],
+    queryKey: [
+      "axcloud",
+      "news",
+      orgId,
+      usePublicEndpoint,
+      page,
+      pageSize,
+      status,
+      visibility,
+      sectionId,
+      search,
+      sortBy,
+      sortOrder
+    ],
     queryFn: async () => {
       const endpoint = usePublicEndpoint ? `/content/public/${orgId}/news` : `/content/members/${orgId}/news`;
       return client.get(endpoint, {
@@ -663,6 +709,7 @@ var MEMBER_ENDPOINT_TYPES = ["news", "pages", "events"];
 function useContent(contentType, options = {}) {
   const { client, orgId, isPublicMode } = useAxCloudContext();
   const {
+    publicOnly = false,
     page = 1,
     pageSize = 20,
     status = "published",
@@ -673,9 +720,24 @@ function useContent(contentType, options = {}) {
     sortOrder = "desc"
   } = options;
   const query = reactQuery.useQuery({
-    queryKey: ["axcloud", "content", orgId, contentType, isPublicMode, options],
+    queryKey: [
+      "axcloud",
+      "content",
+      orgId,
+      contentType,
+      isPublicMode,
+      publicOnly,
+      page,
+      pageSize,
+      status,
+      visibility,
+      sectionId,
+      search,
+      sortBy,
+      sortOrder
+    ],
     queryFn: async () => {
-      const useMemberEndpoint = !isPublicMode && MEMBER_ENDPOINT_TYPES.includes(contentType);
+      const useMemberEndpoint = !isPublicMode && !publicOnly && MEMBER_ENDPOINT_TYPES.includes(contentType);
       const endpoint = useMemberEndpoint ? `/content/members/${orgId}/${contentType}` : `/content/public/${orgId}/${contentType}`;
       return client.get(endpoint, {
         page,
@@ -781,7 +843,7 @@ function useForms(options = {}) {
   const { client, stage } = useAxCloudContext();
   const { formType, status, limit = 50, cursor } = options;
   const query = reactQuery.useQuery({
-    queryKey: ["axcloud", "forms", "submissions", stage, options],
+    queryKey: ["axcloud", "forms", "submissions", stage, formType, status, limit, cursor],
     queryFn: async () => {
       const params = { limit };
       if (formType) params.form_type = formType;
@@ -842,13 +904,13 @@ function useUpdateFormSubmission() {
 }
 var LINKED_ACCOUNTS_QUERY_KEY = ["axcloud", "linked-accounts"];
 function useLinkedAccounts() {
+  const { client, stage } = useAxCloudContext();
   const { isAuthenticated } = useAuth();
   const queryClient = reactQuery.useQueryClient();
   const query = reactQuery.useQuery({
-    queryKey: LINKED_ACCOUNTS_QUERY_KEY,
+    queryKey: [...LINKED_ACCOUNTS_QUERY_KEY, stage],
     queryFn: async () => {
-      const client = getClient();
-      return client.get("/api/users/me/identities");
+      return client.get(`/${stage}/api/users/me/identities`);
     },
     enabled: isAuthenticated,
     staleTime: 1e3 * 60 * 5
@@ -856,9 +918,8 @@ function useLinkedAccounts() {
   });
   const linkMutation = reactQuery.useMutation({
     mutationFn: async (provider) => {
-      const client = getClient();
       const response = await client.post(
-        `/api/users/me/identities/${provider}/link`,
+        `/${stage}/api/users/me/identities/${provider}/link`,
         {}
       );
       if (response.authorization_url) {
@@ -872,9 +933,8 @@ function useLinkedAccounts() {
   });
   const unlinkMutation = reactQuery.useMutation({
     mutationFn: async (provider) => {
-      const client = getClient();
       return client.delete(
-        `/api/users/me/identities/${provider}`
+        `/${stage}/api/users/me/identities/${provider}`
       );
     },
     onSuccess: () => {