@inneropen/marvin-sdk 2.0.0-next.13 → 2.0.0-next.15

package/dist/platform.cjs

@@ -43,7 +43,8 @@ __export(platform_exports, {
   WebhooksModule: () => WebhooksModule,
   WorkspaceMembersModule: () => WorkspaceMembersModule,
   WorkspacesModule: () => WorkspacesModule,
-  createPlatformClient: () => createPlatformClient
+  createPlatformClient: () => createPlatformClient,
+  createPlatformConfigFromEnv: () => createPlatformConfigFromEnv
 });
 module.exports = __toCommonJS(platform_exports);
 
@@ -84,6 +85,15 @@ var MarvinAuthError = class _MarvinAuthError extends MarvinError {
     Object.setPrototypeOf(this, _MarvinAuthError.prototype);
   }
 };
+var MarvinValidationError = class _MarvinValidationError extends MarvinError {
+  constructor(message, field) {
+    super(message, "VALIDATION_ERROR");
+    this.field = field;
+    this.name = "MarvinValidationError";
+    Object.setPrototypeOf(this, _MarvinValidationError.prototype);
+  }
+  field;
+};
 var MarvinNotFoundError = class _MarvinNotFoundError extends MarvinError {
   constructor(message, endpoint) {
     super(message, "NOT_FOUND", 404);
@@ -120,15 +130,46 @@ var HttpClient = class {
   credentials;
   timeout;
   debug;
+  retryConfig;
   logger;
   constructor(config) {
     this.baseUrl = config.baseUrl;
     this.auth = config.auth;
     this.defaultHeaders = config.defaultHeaders || {};
     this.credentials = config.credentials || "same-origin";
-    this.timeout = config.timeout || 3e4;
+    const MAX_TIMEOUT = 12e4;
+    this.timeout = Math.min(config.timeout || 3e4, MAX_TIMEOUT);
     this.debug = config.debug ?? false;
     this.logger = config.logger ?? console;
+    this.retryConfig = {
+      maxRetries: config.retry?.maxRetries ?? 3,
+      initialDelay: config.retry?.initialDelay ?? 1e3,
+      maxDelay: config.retry?.maxDelay ?? 1e4,
+      retryableStatuses: config.retry?.retryableStatuses ?? [408, 429, 500, 502, 503, 504]
+    };
+  }
+  /**
+   * Validate path parameter to prevent path traversal attacks
+   */
+  validatePathParam(param, paramName = "parameter") {
+    if (typeof param === "number") {
+      return String(param);
+    }
+    if (!param || typeof param !== "string") {
+      throw new MarvinValidationError(`Invalid ${paramName}: must be a non-empty string or number`);
+    }
+    if (param.includes("..") || param.includes("/") || param.includes("\\")) {
+      throw new MarvinValidationError(
+        `Invalid ${paramName}: cannot contain path traversal characters (.. / \\)`
+      );
+    }
+    if (param.includes("\0")) {
+      throw new MarvinValidationError(`Invalid ${paramName}: cannot contain null bytes`);
+    }
+    if (param.length > 255) {
+      throw new MarvinValidationError(`Invalid ${paramName}: exceeds maximum length of 255 characters`);
+    }
+    return param;
   }
   /**
    * Build full URL from endpoint
@@ -162,9 +203,69 @@ var HttpClient = class {
     return filtered.length > 0 ? `?${filtered.join("&")}` : "";
   }
   /**
-   * Perform HTTP request
+   * Sanitize data for logging by redacting sensitive fields
    */
-  async request(method, endpoint, options) {
+  sanitizeForLogging(data) {
+    if (!data || typeof data !== "object") {
+      return data;
+    }
+    const sensitiveFields = [
+      "token",
+      "access_token",
+      "refresh_token",
+      "password",
+      "secret",
+      "apiKey",
+      "api_key",
+      "bearer",
+      "authorization",
+      "csrf_token",
+      "session",
+      "cookie"
+    ];
+    const sanitize = (obj) => {
+      const sanitized = {};
+      for (const [key, value] of Object.entries(obj)) {
+        const keyLower = key.toLowerCase();
+        const isSensitive = sensitiveFields.some((field) => keyLower.includes(field));
+        if (isSensitive) {
+          sanitized[key] = "[REDACTED]";
+        } else if (value && typeof value === "object" && !Array.isArray(value)) {
+          sanitized[key] = sanitize(value);
+        } else if (Array.isArray(value)) {
+          sanitized[key] = value.map(
+            (item) => item && typeof item === "object" ? sanitize(item) : item
+          );
+        } else {
+          sanitized[key] = value;
+        }
+      }
+      return sanitized;
+    };
+    if (Array.isArray(data)) {
+      return data.map(
+        (item) => item && typeof item === "object" ? sanitize(item) : item
+      );
+    }
+    return sanitize(data);
+  }
+  /**
+   * Calculate delay for retry with exponential backoff
+   */
+  calculateRetryDelay(attempt) {
+    const delay = this.retryConfig.initialDelay * Math.pow(2, attempt);
+    return Math.min(delay, this.retryConfig.maxDelay);
+  }
+  /**
+   * Sleep for specified milliseconds
+   */
+  sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+  }
+  /**
+   * Perform HTTP request with automatic retry on transient failures
+   */
+  async request(method, endpoint, options, retryAttempt = 0) {
     const url = this.buildUrl(endpoint) + (options?.params ? this.buildQueryString(options.params) : "");
     const isFormData = options?.body instanceof FormData;
     const headers = this.buildHeaders(options?.headers, isFormData);
@@ -200,6 +301,18 @@ var HttpClient = class {
             errorText ? `Body: ${errorText}` : ""
           );
         }
+        const isRetryable = this.retryConfig.retryableStatuses.includes(response.status);
+        const canRetry = retryAttempt < this.retryConfig.maxRetries;
+        if (isRetryable && canRetry) {
+          const delay = this.calculateRetryDelay(retryAttempt);
+          if (this.debug) {
+            this.logger.warn(
+              `[Marvin] Retry ${retryAttempt + 1}/${this.retryConfig.maxRetries} after ${delay}ms (status: ${response.status})`
+            );
+          }
+          await this.sleep(delay);
+          return this.request(method, endpoint, options, retryAttempt + 1);
+        }
         if (response.status === 404) {
           throw new MarvinNotFoundError(
             `Resource not found: ${endpoint}`,
@@ -232,8 +345,8 @@ var HttpClient = class {
       }
       const data = await response.json();
       if (this.debug) {
-        const preview = typeof data === "object" && data !== null ? Array.isArray(data) ? `Array(${data.length})` : `Object with keys: ${Object.keys(data).join(", ")}` : String(data);
-        this.logger.log(`[Marvin] Response: ${preview}`);
+        const sanitized = this.sanitizeForLogging(data);
+        this.logger.log("[Marvin] Response:", JSON.stringify(sanitized, null, 2));
       }
       return data;
     } catch (error) {
@@ -242,6 +355,17 @@ var HttpClient = class {
         throw error;
       }
       if (error instanceof Error) {
+        const canRetry = retryAttempt < this.retryConfig.maxRetries;
+        if (canRetry && error.name !== "AbortError") {
+          const delay = this.calculateRetryDelay(retryAttempt);
+          if (this.debug) {
+            this.logger.warn(
+              `[Marvin] Retry ${retryAttempt + 1}/${this.retryConfig.maxRetries} after ${delay}ms (network error)`
+            );
+          }
+          await this.sleep(delay);
+          return this.request(method, endpoint, options, retryAttempt + 1);
+        }
         if (error.name === "AbortError") {
           throw new MarvinNetworkError(
             `Request timeout after ${this.timeout}ms`,
@@ -296,10 +420,27 @@ var SessionAuth = class {
   }
   sessionToken;
   onUnauthorized;
+  csrfToken;
+  /**
+   * Set CSRF token for cross-site request forgery protection
+   * The token should be obtained from the server after login
+   */
+  setCsrfToken(token) {
+    this.csrfToken = token;
+  }
+  /**
+   * Get current CSRF token
+   */
+  getCsrfToken() {
+    return this.csrfToken;
+  }
   injectAuth(headers) {
     if (this.sessionToken) {
       headers.set("Authorization", `Bearer ${this.sessionToken}`);
     }
+    if (this.csrfToken) {
+      headers.set("X-CSRF-Token", this.csrfToken);
+    }
   }
   async handleUnauthorized() {
     if (this.onUnauthorized) {
@@ -307,7 +448,9 @@ var SessionAuth = class {
     }
   }
   getDescription() {
-    return this.sessionToken ? "Session authentication (explicit token)" : "Session authentication (cookies)";
+    const auth = this.sessionToken ? "Session authentication (explicit token)" : "Session authentication (cookies)";
+    const csrf = this.csrfToken ? " with CSRF protection" : "";
+    return auth + csrf;
   }
 };
 
@@ -327,7 +470,8 @@ var EntriesModule = class {
    * Get a single entry by ID
    */
   async get(id) {
-    return this.http.get(`/api/platform/entries/${id}`);
+    const validId = this.http.validatePathParam(id, "entry ID");
+    return this.http.get(`/api/platform/entries/${validId}`);
   }
   /**
    * Create a new entry
@@ -339,26 +483,31 @@ var EntriesModule = class {
    * Update an entry
    */
   async update(id, data) {
-    return this.http.patch(`/api/platform/entries/${id}`, data);
+    const validId = this.http.validatePathParam(id, "entry ID");
+    return this.http.patch(`/api/platform/entries/${validId}`, data);
   }
   /**
    * Delete an entry
    */
   async delete(id) {
-    return this.http.delete(`/api/platform/entries/${id}`);
+    const validId = this.http.validatePathParam(id, "entry ID");
+    return this.http.delete(`/api/platform/entries/${validId}`);
   }
   /**
    * Get collections that this entry belongs to
    */
   async listCollections(entryId) {
-    return this.http.get(`/api/platform/entries/${entryId}/collections`);
+    const validId = this.http.validatePathParam(entryId, "entry ID");
+    return this.http.get(`/api/platform/entries/${validId}/collections`);
   }
   /**
    * Add entry to a collection
    */
   async addToCollection(entryId, collectionId) {
+    const validEntryId = this.http.validatePathParam(entryId, "entry ID");
+    const validCollectionId = this.http.validatePathParam(collectionId, "collection ID");
     return this.http.post(
-      `/api/platform/entries/${entryId}/collections/${collectionId}`,
+      `/api/platform/entries/${validEntryId}/collections/${validCollectionId}`,
       {}
     );
   }
@@ -366,7 +515,9 @@ var EntriesModule = class {
    * Remove entry from a collection
    */
   async removeFromCollection(entryId, collectionId) {
-    return this.http.delete(`/api/platform/entries/${entryId}/collections/${collectionId}`);
+    const validEntryId = this.http.validatePathParam(entryId, "entry ID");
+    const validCollectionId = this.http.validatePathParam(collectionId, "collection ID");
+    return this.http.delete(`/api/platform/entries/${validEntryId}/collections/${validCollectionId}`);
   }
 };
 
@@ -386,7 +537,8 @@ var CollectionsModule = class {
    * Get a single collection by ID
    */
   async get(id) {
-    return this.http.get(`/api/platform/collections/${id}`);
+    const validId = this.http.validatePathParam(id, "id");
+    return this.http.get(`/api/platform/collections/${validId}`);
   }
   /**
    * Create a new collection
@@ -398,25 +550,29 @@ var CollectionsModule = class {
    * Update a collection
    */
   async update(id, data) {
-    return this.http.patch(`/api/platform/collections/${id}`, data);
+    const validId = this.http.validatePathParam(id, "id");
+    return this.http.patch(`/api/platform/collections/${validId}`, data);
   }
   /**
    * Delete a collection
    */
   async delete(id) {
-    return this.http.delete(`/api/platform/collections/${id}`);
+    const validId = this.http.validatePathParam(id, "collection ID");
+    return this.http.delete(`/api/platform/collections/${validId}`);
   }
   /**
    * Get entries in a collection
    */
   async getEntries(id) {
-    return this.http.get(`/api/platform/collections/${id}/entries`);
+    const validId = this.http.validatePathParam(id, "collection ID");
+    return this.http.get(`/api/platform/collections/${validId}/entries`);
   }
   /**
    * Reorder entries in a collection
    */
   async reorderEntries(id, entries) {
-    return this.http.patch(`/api/platform/collections/${id}/entries/order`, { entries });
+    const validId = this.http.validatePathParam(id, "collection ID");
+    return this.http.patch(`/api/platform/collections/${validId}/entries/order`, { entries });
   }
 };
 
@@ -436,7 +592,8 @@ var ResourcesModule = class {
    * Get a single resource by ID
    */
   async get(id) {
-    return this.http.get(`/api/platform/resources/${id}`);
+    const validId = this.http.validatePathParam(id, "id");
+    return this.http.get(`/api/platform/resources/${validId}`);
   }
   /**
    * Create a new resource
@@ -448,7 +605,8 @@ var ResourcesModule = class {
    * Update a resource
    */
   async update(id, data) {
-    return this.http.patch(`/api/platform/resources/${id}`, data);
+    const validId = this.http.validatePathParam(id, "id");
+    return this.http.patch(`/api/platform/resources/${validId}`, data);
   }
   /**
    * Delete a resource
@@ -470,6 +628,47 @@ var AssetsModule = class {
     this.http = http;
   }
   http;
+  /**
+   * Validate file before upload
+   */
+  validateFile(file, options) {
+    const maxSize = options?.maxFileSize || 100 * 1024 * 1024;
+    const allowedTypes = options?.allowedMimeTypes;
+    if (file.size === 0) {
+      throw new MarvinValidationError("File is empty");
+    }
+    if (file.size > maxSize) {
+      const maxMB = Math.round(maxSize / (1024 * 1024));
+      const fileMB = Math.round(file.size / (1024 * 1024));
+      throw new MarvinValidationError(
+        `File size (${fileMB}MB) exceeds maximum allowed size of ${maxMB}MB`
+      );
+    }
+    if (allowedTypes && allowedTypes.length > 0) {
+      if (file instanceof File && file.type) {
+        const isAllowed = allowedTypes.some((allowed) => {
+          if (allowed.endsWith("/*")) {
+            const prefix = allowed.slice(0, -2);
+            return file.type.startsWith(prefix);
+          }
+          return file.type === allowed;
+        });
+        if (!isAllowed) {
+          throw new MarvinValidationError(
+            `File type "${file.type}" is not allowed. Allowed types: ${allowedTypes.join(", ")}`
+          );
+        }
+      }
+    }
+    if (file instanceof File) {
+      if (!file.name || file.name.trim().length === 0) {
+        throw new MarvinValidationError("File must have a valid name");
+      }
+      if (file.name.includes("..") || file.name.includes("/") || file.name.includes("\\")) {
+        throw new MarvinValidationError("Invalid filename: cannot contain path separators");
+      }
+    }
+  }
   /**
    * List all assets
    */
@@ -480,16 +679,31 @@ var AssetsModule = class {
    * Get a single asset by ID
    */
   async get(id) {
-    return this.http.get(`/api/platform/assets/${id}`);
+    const validId = this.http.validatePathParam(id, "id");
+    return this.http.get(`/api/platform/assets/${validId}`);
   }
   /**
    * Upload a new asset file
    *
    * @param file - The file to upload (File or Blob)
    * @param metadata - Asset metadata (slug, name, altText, description, metadata)
+   * @param options - Upload options (file size limits, allowed types)
    * @returns The created asset with extracted metadata
+   *
+   * @example
+   * ```typescript
+   * // Upload with default limits (100MB, all types)
+   * const asset = await assets.upload(file, { slug: 'my-image', name: 'My Image' });
+   *
+   * // Upload with restrictions
+   * const asset = await assets.upload(file,
+   *   { slug: 'avatar', name: 'Avatar' },
+   *   { maxFileSize: 5 * 1024 * 1024, allowedMimeTypes: ['image/*'] }
+   * );
+   * ```
    */
-  async upload(file, metadata) {
+  async upload(file, metadata, options) {
+    this.validateFile(file, options);
     const formData = new FormData();
     formData.append("file", file);
     formData.append("slug", metadata.slug);
@@ -509,13 +723,24 @@ var AssetsModule = class {
    * Update an asset (editable fields only: slug, name, altText, description, metadata)
    */
   async update(id, data) {
-    return this.http.patch(`/api/platform/assets/${id}`, data);
+    const validId = this.http.validatePathParam(id, "id");
+    return this.http.patch(`/api/platform/assets/${validId}`, data);
   }
   /**
    * Delete an asset (removes file from storage and database)
    */
   async delete(id) {
-    return this.http.delete(`/api/platform/assets/${id}`);
+    const validId = this.http.validatePathParam(id, "asset ID");
+    return this.http.delete(`/api/platform/assets/${validId}`);
+  }
+  /**
+   * Get download URL for an asset file
+   * Use this to create download links or fetch the file directly
+   */
+  getDownloadUrl(id, baseUrl) {
+    const validId = this.http.validatePathParam(id, "asset ID");
+    const base = baseUrl || (typeof window !== "undefined" && window.location ? window.location.origin : "");
+    return `${base}/api/platform/assets/${validId}/file`;
   }
 };
 
@@ -535,7 +760,8 @@ var APIClientsModule = class {
    * Get a single API client by ID
    */
   async get(id) {
-    return this.http.get(`/api/platform/api-clients/${id}`);
+    const validId = this.http.validatePathParam(id, "id");
+    return this.http.get(`/api/platform/api-clients/${validId}`);
   }
   /**
    * Create a new API client (returns client with token)
@@ -547,7 +773,8 @@ var APIClientsModule = class {
    * Update an API client
    */
   async update(id, data) {
-    return this.http.patch(`/api/platform/api-clients/${id}`, data);
+    const validId = this.http.validatePathParam(id, "id");
+    return this.http.patch(`/api/platform/api-clients/${validId}`, data);
   }
   /**
    * Delete an API client
@@ -758,11 +985,23 @@ var InvitesModule = class {
   }
   /**
    * Generate invitation URL from a token
-   * Uses MARVIN_FRONTEND_URL for the base URL, falls back to MARVIN_API_URL with common port mappings
+   *
+   * @param token - Invitation token
+   * @param baseUrl - Base URL for the frontend (required in browser environments)
+   * @returns Full invitation URL
+   *
+   * @example
+   * ```typescript
+   * // Node.js (can use env vars)
+   * const url = invites.getInvitationUrl(token);
+   *
+   * // Browser (must provide baseUrl)
+   * const url = invites.getInvitationUrl(token, 'https://app.example.com');
+   * ```
    */
   getInvitationUrl(token, baseUrl) {
     let base = baseUrl;
-    if (!base) {
+    if (!base && typeof process !== "undefined" && process.env) {
       base = process.env.MARVIN_FRONTEND_URL;
       if (!base && process.env.MARVIN_API_URL) {
         const apiUrl = process.env.MARVIN_API_URL;
@@ -774,11 +1013,17 @@ var InvitesModule = class {
           base = apiUrl;
         }
       }
-      if (!base) {
-        base = "http://localhost:4321";
+    }
+    if (!base) {
+      if (typeof window !== "undefined" && window.location) {
+        base = window.location.origin;
+      } else {
+        throw new Error(
+          'baseUrl is required when not in Node.js environment. Pass the frontend URL as second argument: getInvitationUrl(token, "https://app.example.com")'
+        );
       }
     }
-    return `${base}/register?token=${token}`;
+    return `${base}/register?token=${encodeURIComponent(token)}`;
   }
 };
 
@@ -832,6 +1077,57 @@ var WebhooksModule = class {
     this.http = http;
   }
   http;
+  /**
+   * Validate webhook URL to prevent SSRF attacks
+   */
+  validateWebhookUrl(url) {
+    if (!url || typeof url !== "string") {
+      throw new MarvinValidationError("Webhook URL is required and must be a string");
+    }
+    let parsed;
+    try {
+      parsed = new URL(url);
+    } catch {
+      throw new MarvinValidationError("Invalid webhook URL format. Expected: https://example.com/webhook");
+    }
+    if (!["http:", "https:"].includes(parsed.protocol)) {
+      throw new MarvinValidationError(
+        `Webhook URL must use HTTP or HTTPS protocol. Got: ${parsed.protocol}`
+      );
+    }
+    const hostname = parsed.hostname.toLowerCase();
+    const blockedHosts = [
+      "localhost",
+      "127.0.0.1",
+      "0.0.0.0",
+      "::1",
+      "169.254.169.254",
+      // AWS metadata service
+      "[::]"
+    ];
+    if (blockedHosts.some((blocked) => hostname === blocked || hostname.includes(blocked))) {
+      throw new MarvinValidationError(
+        "Webhook URL cannot target localhost or internal network addresses"
+      );
+    }
+    const ipv4Regex = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
+    const match = hostname.match(ipv4Regex);
+    if (match) {
+      const octets = match.slice(1).map(Number);
+      if (octets[0] === 10) {
+        throw new MarvinValidationError("Webhook URL cannot target private IP range (10.x.x.x)");
+      }
+      if (octets[0] === 172 && octets[1] >= 16 && octets[1] <= 31) {
+        throw new MarvinValidationError("Webhook URL cannot target private IP range (172.16-31.x.x)");
+      }
+      if (octets[0] === 192 && octets[1] === 168) {
+        throw new MarvinValidationError("Webhook URL cannot target private IP range (192.168.x.x)");
+      }
+    }
+    if (url.length > 2048) {
+      throw new MarvinValidationError("Webhook URL exceeds maximum length of 2048 characters");
+    }
+  }
   /**
    * List all webhooks for the current workspace
    */
@@ -843,31 +1139,43 @@ var WebhooksModule = class {
    * Get a webhook by ID
    */
   async get(id) {
-    return this.http.get(`/api/groups/webhooks/${id}`);
+    const validId = this.http.validatePathParam(id, "webhook ID");
+    return this.http.get(`/api/groups/webhooks/${validId}`);
   }
   /**
    * Create a new webhook
+   * Validates URL to prevent SSRF attacks
    */
   async create(data) {
+    if (data.url) {
+      this.validateWebhookUrl(data.url);
+    }
     return this.http.post("/api/groups/webhooks", data);
   }
   /**
    * Update a webhook
+   * Validates URL if provided to prevent SSRF attacks
    */
   async update(id, data) {
-    return this.http.put(`/api/groups/webhooks/${id}`, data);
+    const validId = this.http.validatePathParam(id, "webhook ID");
+    if (data.url) {
+      this.validateWebhookUrl(data.url);
+    }
+    return this.http.put(`/api/groups/webhooks/${validId}`, data);
   }
   /**
    * Delete a webhook
    */
   async delete(id) {
-    await this.http.delete(`/api/groups/webhooks/${id}`);
+    const validId = this.http.validatePathParam(id, "webhook ID");
+    await this.http.delete(`/api/groups/webhooks/${validId}`);
   }
   /**
    * Test a webhook
    */
   async test(id) {
-    return this.http.post(`/api/groups/webhooks/${id}/test`, {});
+    const validId = this.http.validatePathParam(id, "webhook ID");
+    return this.http.post(`/api/groups/webhooks/${validId}/test`, {});
   }
   /**
    * Rerun failed webhooks
@@ -959,6 +1267,7 @@ var AdminSystemModule = class {
   }
   /**
    * Update email settings
+   * Note: Password field is write-only and will not be returned in response
    */
   async updateEmailSettings(data) {
     return this.http.put("/api/admin/email", data);
@@ -1309,7 +1618,8 @@ var ScheduledTasksModule = class {
    * Get a scheduled task by ID or slug
    */
   async get(idOrSlug) {
-    return this.http.get(`/api/platform/scheduled-tasks/${idOrSlug}`);
+    const validIdOrSlug = this.http.validatePathParam(idOrSlug, "idOrSlug");
+    return this.http.get(`/api/platform/scheduled-tasks/${validIdOrSlug}`);
   }
   /**
    * Create a new scheduled task
@@ -1321,7 +1631,8 @@ var ScheduledTasksModule = class {
    * Update a scheduled task
    */
   async update(idOrSlug, data) {
-    return this.http.patch(`/api/platform/scheduled-tasks/${idOrSlug}`, data);
+    const validIdOrSlug = this.http.validatePathParam(idOrSlug, "idOrSlug");
+    return this.http.patch(`/api/platform/scheduled-tasks/${validIdOrSlug}`, data);
   }
   /**
    * Delete a scheduled task
@@ -1367,6 +1678,34 @@ var FormsModule = class {
     this.http = http;
   }
   http;
+  /**
+   * Validate form submission data
+   * - Prevents XSS by checking for script tags
+   * - Validates data is a proper object
+   * - Checks for reasonable size limits
+   */
+  validateFormData(data) {
+    if (!data || typeof data !== "object") {
+      throw new MarvinValidationError("Form data must be a valid object");
+    }
+    const jsonString = JSON.stringify(data);
+    const sizeInBytes = new Blob([jsonString]).size;
+    if (sizeInBytes > 1024 * 1024) {
+      throw new MarvinValidationError("Form data exceeds maximum size of 1MB");
+    }
+    const checkForScripts = (value) => {
+      if (typeof value === "string") {
+        if (/<script[\s\S]*?>[\s\S]*?<\/script>/gi.test(value)) {
+          throw new MarvinValidationError("Form data contains potentially malicious content");
+        }
+      } else if (Array.isArray(value)) {
+        value.forEach(checkForScripts);
+      } else if (value && typeof value === "object") {
+        Object.values(value).forEach(checkForScripts);
+      }
+    };
+    Object.values(data).forEach(checkForScripts);
+  }
   /**
    * List all forms
    */
@@ -1377,7 +1716,8 @@ var FormsModule = class {
    * Get a single form by ID
    */
   async get(id) {
-    return this.http.get(`/api/platform/forms/${id}`);
+    const validId = this.http.validatePathParam(id, "id");
+    return this.http.get(`/api/platform/forms/${validId}`);
   }
   /**
    * Create a new form
@@ -1389,7 +1729,8 @@ var FormsModule = class {
    * Update a form
    */
   async update(id, data) {
-    return this.http.patch(`/api/platform/forms/${id}`, data);
+    const validId = this.http.validatePathParam(id, "id");
+    return this.http.patch(`/api/platform/forms/${validId}`, data);
   }
   /**
    * Delete a form
@@ -1411,15 +1752,25 @@ var FormsModule = class {
   }
   /**
    * Submit data to a published form (Publishing API - public access)
+   * Validates data before submission to prevent XSS and malicious content
    */
   async submitForm(slug, data) {
-    return this.http.post(`/api/publish/forms/${slug}/submit`, {
+    const validSlug = this.http.validatePathParam(slug, "form slug");
+    this.validateFormData(data);
+    return this.http.post(`/api/publish/forms/${validSlug}/submit`, {
       dataJson: data
     });
   }
 };
 
 // src/platform/client.ts
+function createPlatformConfigFromEnv(overrides) {
+  return {
+    apiUrl: overrides?.apiUrl || process.env.MARVIN_API_URL || "http://localhost:8080",
+    userToken: overrides?.userToken || process.env.MARVIN_USER_TOKEN,
+    credentials: overrides?.credentials || "include"
+  };
+}
 var PlatformClient = class extends HttpClient {
   entries;
   collections;
@@ -1446,7 +1797,7 @@ var PlatformClient = class extends HttpClient {
   adminMaintenance;
   constructor(config) {
     const httpConfig = {
-      baseUrl: config.apiUrl,
+      baseUrl: config.apiUrl || "http://localhost:8080",
       auth: new SessionAuth(config.userToken),
       credentials: config.credentials || "include"
     };
@@ -1476,7 +1827,8 @@ var PlatformClient = class extends HttpClient {
   }
 };
 function createPlatformClient(config) {
-  return new PlatformClient(config);
+  const finalConfig = createPlatformConfigFromEnv(config);
+  return new PlatformClient(finalConfig);
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
@@ -1503,5 +1855,6 @@ function createPlatformClient(config) {
   WebhooksModule,
   WorkspaceMembersModule,
   WorkspacesModule,
-  createPlatformClient
+  createPlatformClient,
+  createPlatformConfigFromEnv
 });