@inneropen/marvin-sdk 2.0.0-next.17 → 2.0.0-next.2

package/dist/platform.js

@@ -1,9 +1,8 @@
 import {
   HttpClient,
-  MarvinValidationError,
   SessionAuth,
   init_core
-} from "./chunk-WJC4X7TB.js";
+} from "./chunk-25F3IF6S.js";
 
 // src/platform/client.ts
 init_core();
@@ -24,8 +23,7 @@ var EntriesModule = class {
    * Get a single entry by ID
    */
   async get(id) {
-    const validId = this.http.validatePathParam(id, "entry ID");
-    return this.http.get(`/api/platform/entries/${validId}`);
+    return this.http.get(`/api/platform/entries/${id}`);
   }
   /**
    * Create a new entry
@@ -37,31 +35,26 @@ var EntriesModule = class {
    * Update an entry
    */
   async update(id, data) {
-    const validId = this.http.validatePathParam(id, "entry ID");
-    return this.http.patch(`/api/platform/entries/${validId}`, data);
+    return this.http.patch(`/api/platform/entries/${id}`, data);
   }
   /**
    * Delete an entry
    */
   async delete(id) {
-    const validId = this.http.validatePathParam(id, "entry ID");
-    return this.http.delete(`/api/platform/entries/${validId}`);
+    return this.http.delete(`/api/platform/entries/${id}`);
   }
   /**
    * Get collections that this entry belongs to
    */
   async listCollections(entryId) {
-    const validId = this.http.validatePathParam(entryId, "entry ID");
-    return this.http.get(`/api/platform/entries/${validId}/collections`);
+    return this.http.get(`/api/platform/entries/${entryId}/collections`);
   }
   /**
    * Add entry to a collection
    */
   async addToCollection(entryId, collectionId) {
-    const validEntryId = this.http.validatePathParam(entryId, "entry ID");
-    const validCollectionId = this.http.validatePathParam(collectionId, "collection ID");
     return this.http.post(
-      `/api/platform/entries/${validEntryId}/collections/${validCollectionId}`,
+      `/api/platform/entries/${entryId}/collections/${collectionId}`,
       {}
     );
   }
@@ -69,9 +62,7 @@ var EntriesModule = class {
    * Remove entry from a collection
    */
   async removeFromCollection(entryId, collectionId) {
-    const validEntryId = this.http.validatePathParam(entryId, "entry ID");
-    const validCollectionId = this.http.validatePathParam(collectionId, "collection ID");
-    return this.http.delete(`/api/platform/entries/${validEntryId}/collections/${validCollectionId}`);
+    return this.http.delete(`/api/platform/entries/${entryId}/collections/${collectionId}`);
   }
 };
 
@@ -91,8 +82,7 @@ var CollectionsModule = class {
    * Get a single collection by ID
    */
   async get(id) {
-    const validId = this.http.validatePathParam(id, "id");
-    return this.http.get(`/api/platform/collections/${validId}`);
+    return this.http.get(`/api/platform/collections/${id}`);
   }
   /**
    * Create a new collection
@@ -104,29 +94,25 @@ var CollectionsModule = class {
    * Update a collection
    */
   async update(id, data) {
-    const validId = this.http.validatePathParam(id, "id");
-    return this.http.patch(`/api/platform/collections/${validId}`, data);
+    return this.http.patch(`/api/platform/collections/${id}`, data);
   }
   /**
    * Delete a collection
    */
   async delete(id) {
-    const validId = this.http.validatePathParam(id, "collection ID");
-    return this.http.delete(`/api/platform/collections/${validId}`);
+    return this.http.delete(`/api/platform/collections/${id}`);
   }
   /**
    * Get entries in a collection
    */
   async getEntries(id) {
-    const validId = this.http.validatePathParam(id, "collection ID");
-    return this.http.get(`/api/platform/collections/${validId}/entries`);
+    return this.http.get(`/api/platform/collections/${id}/entries`);
   }
   /**
    * Reorder entries in a collection
    */
   async reorderEntries(id, entries) {
-    const validId = this.http.validatePathParam(id, "collection ID");
-    return this.http.patch(`/api/platform/collections/${validId}/entries/order`, { entries });
+    return this.http.patch(`/api/platform/collections/${id}/entries/order`, { entries });
   }
 };
 
@@ -146,8 +132,7 @@ var ResourcesModule = class {
    * Get a single resource by ID
    */
   async get(id) {
-    const validId = this.http.validatePathParam(id, "id");
-    return this.http.get(`/api/platform/resources/${validId}`);
+    return this.http.get(`/api/platform/resources/${id}`);
   }
   /**
    * Create a new resource
@@ -159,8 +144,7 @@ var ResourcesModule = class {
    * Update a resource
    */
   async update(id, data) {
-    const validId = this.http.validatePathParam(id, "id");
-    return this.http.patch(`/api/platform/resources/${validId}`, data);
+    return this.http.patch(`/api/platform/resources/${id}`, data);
   }
   /**
    * Delete a resource
@@ -177,53 +161,11 @@ var ResourcesModule = class {
 };
 
 // src/platform/assets.ts
-init_core();
 var AssetsModule = class {
   constructor(http) {
     this.http = http;
   }
   http;
-  /**
-   * Validate file before upload
-   */
-  validateFile(file, options) {
-    const maxSize = options?.maxFileSize || 100 * 1024 * 1024;
-    const allowedTypes = options?.allowedMimeTypes;
-    if (file.size === 0) {
-      throw new MarvinValidationError("File is empty");
-    }
-    if (file.size > maxSize) {
-      const maxMB = Math.round(maxSize / (1024 * 1024));
-      const fileMB = Math.round(file.size / (1024 * 1024));
-      throw new MarvinValidationError(
-        `File size (${fileMB}MB) exceeds maximum allowed size of ${maxMB}MB`
-      );
-    }
-    if (allowedTypes && allowedTypes.length > 0) {
-      if (file instanceof File && file.type) {
-        const isAllowed = allowedTypes.some((allowed) => {
-          if (allowed.endsWith("/*")) {
-            const prefix = allowed.slice(0, -2);
-            return file.type.startsWith(prefix);
-          }
-          return file.type === allowed;
-        });
-        if (!isAllowed) {
-          throw new MarvinValidationError(
-            `File type "${file.type}" is not allowed. Allowed types: ${allowedTypes.join(", ")}`
-          );
-        }
-      }
-    }
-    if (file instanceof File) {
-      if (!file.name || file.name.trim().length === 0) {
-        throw new MarvinValidationError("File must have a valid name");
-      }
-      if (file.name.includes("..") || file.name.includes("/") || file.name.includes("\\")) {
-        throw new MarvinValidationError("Invalid filename: cannot contain path separators");
-      }
-    }
-  }
   /**
    * List all assets
    */
@@ -234,31 +176,16 @@ var AssetsModule = class {
    * Get a single asset by ID
    */
   async get(id) {
-    const validId = this.http.validatePathParam(id, "id");
-    return this.http.get(`/api/platform/assets/${validId}`);
+    return this.http.get(`/api/platform/assets/${id}`);
   }
   /**
    * Upload a new asset file
    *
    * @param file - The file to upload (File or Blob)
    * @param metadata - Asset metadata (slug, name, altText, description, metadata)
-   * @param options - Upload options (file size limits, allowed types)
    * @returns The created asset with extracted metadata
-   *
-   * @example
-   * ```typescript
-   * // Upload with default limits (100MB, all types)
-   * const asset = await assets.upload(file, { slug: 'my-image', name: 'My Image' });
-   *
-   * // Upload with restrictions
-   * const asset = await assets.upload(file,
-   *   { slug: 'avatar', name: 'Avatar' },
-   *   { maxFileSize: 5 * 1024 * 1024, allowedMimeTypes: ['image/*'] }
-   * );
-   * ```
    */
-  async upload(file, metadata, options) {
-    this.validateFile(file, options);
+  async upload(file, metadata) {
     const formData = new FormData();
     formData.append("file", file);
     formData.append("slug", metadata.slug);
@@ -278,24 +205,13 @@ var AssetsModule = class {
    * Update an asset (editable fields only: slug, name, altText, description, metadata)
    */
   async update(id, data) {
-    const validId = this.http.validatePathParam(id, "id");
-    return this.http.patch(`/api/platform/assets/${validId}`, data);
+    return this.http.patch(`/api/platform/assets/${id}`, data);
   }
   /**
    * Delete an asset (removes file from storage and database)
    */
   async delete(id) {
-    const validId = this.http.validatePathParam(id, "asset ID");
-    return this.http.delete(`/api/platform/assets/${validId}`);
-  }
-  /**
-   * Get download URL for an asset file
-   * Use this to create download links or fetch the file directly
-   */
-  getDownloadUrl(id, baseUrl) {
-    const validId = this.http.validatePathParam(id, "asset ID");
-    const base = baseUrl || (typeof window !== "undefined" && window.location ? window.location.origin : "");
-    return `${base}/api/platform/assets/${validId}/file`;
+    return this.http.delete(`/api/platform/assets/${id}`);
   }
 };
 
@@ -315,8 +231,7 @@ var APIClientsModule = class {
    * Get a single API client by ID
    */
   async get(id) {
-    const validId = this.http.validatePathParam(id, "id");
-    return this.http.get(`/api/platform/api-clients/${validId}`);
+    return this.http.get(`/api/platform/api-clients/${id}`);
   }
   /**
    * Create a new API client (returns client with token)
@@ -328,8 +243,7 @@ var APIClientsModule = class {
    * Update an API client
    */
   async update(id, data) {
-    const validId = this.http.validatePathParam(id, "id");
-    return this.http.patch(`/api/platform/api-clients/${validId}`, data);
+    return this.http.patch(`/api/platform/api-clients/${id}`, data);
   }
   /**
    * Delete an API client
@@ -540,23 +454,11 @@ var InvitesModule = class {
   }
   /**
    * Generate invitation URL from a token
-   *
-   * @param token - Invitation token
-   * @param baseUrl - Base URL for the frontend (required in browser environments)
-   * @returns Full invitation URL
-   *
-   * @example
-   * ```typescript
-   * // Node.js (can use env vars)
-   * const url = invites.getInvitationUrl(token);
-   *
-   * // Browser (must provide baseUrl)
-   * const url = invites.getInvitationUrl(token, 'https://app.example.com');
-   * ```
+   * Uses MARVIN_FRONTEND_URL for the base URL, falls back to MARVIN_API_URL with common port mappings
    */
   getInvitationUrl(token, baseUrl) {
     let base = baseUrl;
-    if (!base && typeof process !== "undefined" && process.env) {
+    if (!base) {
       base = process.env.MARVIN_FRONTEND_URL;
       if (!base && process.env.MARVIN_API_URL) {
         const apiUrl = process.env.MARVIN_API_URL;
@@ -568,17 +470,11 @@ var InvitesModule = class {
           base = apiUrl;
         }
       }
-    }
-    if (!base) {
-      if (typeof window !== "undefined" && window.location) {
-        base = window.location.origin;
-      } else {
-        throw new Error(
-          'baseUrl is required when not in Node.js environment. Pass the frontend URL as second argument: getInvitationUrl(token, "https://app.example.com")'
-        );
+      if (!base) {
+        base = "http://localhost:4321";
       }
     }
-    return `${base}/register?token=${encodeURIComponent(token)}`;
+    return `${base}/register?token=${token}`;
   }
 };
 
@@ -627,63 +523,11 @@ var NotificationsModule = class {
 };
 
 // src/platform/webhooks.ts
-init_core();
 var WebhooksModule = class {
   constructor(http) {
     this.http = http;
   }
   http;
-  /**
-   * Validate webhook URL to prevent SSRF attacks
-   */
-  validateWebhookUrl(url) {
-    if (!url || typeof url !== "string") {
-      throw new MarvinValidationError("Webhook URL is required and must be a string");
-    }
-    let parsed;
-    try {
-      parsed = new URL(url);
-    } catch {
-      throw new MarvinValidationError("Invalid webhook URL format. Expected: https://example.com/webhook");
-    }
-    if (!["http:", "https:"].includes(parsed.protocol)) {
-      throw new MarvinValidationError(
-        `Webhook URL must use HTTP or HTTPS protocol. Got: ${parsed.protocol}`
-      );
-    }
-    const hostname = parsed.hostname.toLowerCase();
-    const blockedHosts = [
-      "localhost",
-      "127.0.0.1",
-      "0.0.0.0",
-      "::1",
-      "169.254.169.254",
-      // AWS metadata service
-      "[::]"
-    ];
-    if (blockedHosts.some((blocked) => hostname === blocked || hostname.includes(blocked))) {
-      throw new MarvinValidationError(
-        "Webhook URL cannot target localhost or internal network addresses"
-      );
-    }
-    const ipv4Regex = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
-    const match = hostname.match(ipv4Regex);
-    if (match) {
-      const octets = match.slice(1).map(Number);
-      if (octets[0] === 10) {
-        throw new MarvinValidationError("Webhook URL cannot target private IP range (10.x.x.x)");
-      }
-      if (octets[0] === 172 && octets[1] >= 16 && octets[1] <= 31) {
-        throw new MarvinValidationError("Webhook URL cannot target private IP range (172.16-31.x.x)");
-      }
-      if (octets[0] === 192 && octets[1] === 168) {
-        throw new MarvinValidationError("Webhook URL cannot target private IP range (192.168.x.x)");
-      }
-    }
-    if (url.length > 2048) {
-      throw new MarvinValidationError("Webhook URL exceeds maximum length of 2048 characters");
-    }
-  }
   /**
    * List all webhooks for the current workspace
    */
@@ -695,43 +539,31 @@ var WebhooksModule = class {
    * Get a webhook by ID
    */
   async get(id) {
-    const validId = this.http.validatePathParam(id, "webhook ID");
-    return this.http.get(`/api/groups/webhooks/${validId}`);
+    return this.http.get(`/api/groups/webhooks/${id}`);
   }
   /**
    * Create a new webhook
-   * Validates URL to prevent SSRF attacks
    */
   async create(data) {
-    if (data.url) {
-      this.validateWebhookUrl(data.url);
-    }
     return this.http.post("/api/groups/webhooks", data);
   }
   /**
    * Update a webhook
-   * Validates URL if provided to prevent SSRF attacks
    */
   async update(id, data) {
-    const validId = this.http.validatePathParam(id, "webhook ID");
-    if (data.url) {
-      this.validateWebhookUrl(data.url);
-    }
-    return this.http.put(`/api/groups/webhooks/${validId}`, data);
+    return this.http.put(`/api/groups/webhooks/${id}`, data);
   }
   /**
    * Delete a webhook
    */
   async delete(id) {
-    const validId = this.http.validatePathParam(id, "webhook ID");
-    await this.http.delete(`/api/groups/webhooks/${validId}`);
+    await this.http.delete(`/api/groups/webhooks/${id}`);
   }
   /**
    * Test a webhook
    */
   async test(id) {
-    const validId = this.http.validatePathParam(id, "webhook ID");
-    return this.http.post(`/api/groups/webhooks/${validId}/test`, {});
+    return this.http.post(`/api/groups/webhooks/${id}/test`, {});
   }
   /**
    * Rerun failed webhooks
@@ -823,7 +655,6 @@ var AdminSystemModule = class {
   }
   /**
    * Update email settings
-   * Note: Password field is write-only and will not be returned in response
    */
   async updateEmailSettings(data) {
     return this.http.put("/api/admin/email", data);
@@ -1099,235 +930,7 @@ var ThemeModule = class {
   }
 };
 
-// src/platform/emailTemplates.ts
-var EmailTemplatesClient = class {
-  constructor(http) {
-    this.http = http;
-  }
-  http;
-  /**
-   * List all email templates for the workspace
-   * @param groupId - Workspace ID
-   */
-  async list(groupId) {
-    return this.http.get(`/api/platform/workspaces/${groupId}/email-templates`);
-  }
-  /**
-   * Get a specific email template
-   * @param groupId - Workspace ID
-   * @param templateId - Template ID
-   */
-  async get(groupId, templateId) {
-    return this.http.get(`/api/platform/workspaces/${groupId}/email-templates/${templateId}`);
-  }
-  /**
-   * Create a new email template
-   * @param groupId - Workspace ID
-   * @param data - Template data
-   */
-  async create(groupId, data) {
-    return this.http.post(`/api/platform/workspaces/${groupId}/email-templates`, data);
-  }
-  /**
-   * Update an email template
-   * @param groupId - Workspace ID
-   * @param templateId - Template ID
-   * @param data - Updated template data
-   */
-  async update(groupId, templateId, data) {
-    return this.http.patch(`/api/platform/workspaces/${groupId}/email-templates/${templateId}`, data);
-  }
-  /**
-   * Delete an email template
-   * @param groupId - Workspace ID
-   * @param templateId - Template ID
-   */
-  async delete(groupId, templateId) {
-    await this.http.delete(`/api/platform/workspaces/${groupId}/email-templates/${templateId}`);
-  }
-  /**
-   * Send a test email using a template
-   * @param groupId - Workspace ID
-   * @param templateId - Template ID
-   * @param recipientEmail - Test recipient email address
-   */
-  async sendTest(groupId, templateId, recipientEmail) {
-    return this.http.post(`/api/platform/workspaces/${groupId}/email-templates/${templateId}/test`, {
-      recipient_email: recipientEmail
-    });
-  }
-};
-
-// src/platform/scheduledTasks.ts
-var ScheduledTasksModule = class {
-  constructor(http) {
-    this.http = http;
-  }
-  http;
-  /**
-   * List all scheduled tasks for the current workspace
-   */
-  async list() {
-    return this.http.get("/api/platform/scheduled-tasks");
-  }
-  /**
-   * Get a scheduled task by ID or slug
-   */
-  async get(idOrSlug) {
-    const validIdOrSlug = this.http.validatePathParam(idOrSlug, "idOrSlug");
-    return this.http.get(`/api/platform/scheduled-tasks/${validIdOrSlug}`);
-  }
-  /**
-   * Create a new scheduled task
-   */
-  async create(data) {
-    return this.http.post("/api/platform/scheduled-tasks", data);
-  }
-  /**
-   * Update a scheduled task
-   */
-  async update(idOrSlug, data) {
-    const validIdOrSlug = this.http.validatePathParam(idOrSlug, "idOrSlug");
-    return this.http.patch(`/api/platform/scheduled-tasks/${validIdOrSlug}`, data);
-  }
-  /**
-   * Delete a scheduled task
-   */
-  async delete(idOrSlug) {
-    await this.http.delete(`/api/platform/scheduled-tasks/${idOrSlug}`);
-  }
-  /**
-   * Manually trigger task execution (bypass schedule)
-   */
-  async execute(idOrSlug) {
-    await this.http.post(`/api/platform/scheduled-tasks/${idOrSlug}/execute`, {});
-  }
-  /**
-   * Get task execution history
-   */
-  async history(idOrSlug, options) {
-    const params = new URLSearchParams();
-    if (options?.limit) {
-      params.set("limit", options.limit.toString());
-    }
-    const query = params.toString() ? `?${params.toString()}` : "";
-    return this.http.get(
-      `/api/platform/scheduled-tasks/${idOrSlug}/history${query}`
-    );
-  }
-  /**
-   * Get available task types
-   */
-  async taskTypes(options) {
-    const params = new URLSearchParams();
-    if (options?.detailed) {
-      params.set("detailed", "true");
-    }
-    const query = params.toString() ? `?${params.toString()}` : "";
-    return this.http.get(`/api/platform/scheduled-tasks/task-types${query}`);
-  }
-};
-
-// src/platform/forms.ts
-init_core();
-var FormsModule = class {
-  constructor(http) {
-    this.http = http;
-  }
-  http;
-  /**
-   * Validate form submission data
-   * - Prevents XSS by checking for script tags
-   * - Validates data is a proper object
-   * - Checks for reasonable size limits
-   */
-  validateFormData(data) {
-    if (!data || typeof data !== "object") {
-      throw new MarvinValidationError("Form data must be a valid object");
-    }
-    const jsonString = JSON.stringify(data);
-    const sizeInBytes = new Blob([jsonString]).size;
-    if (sizeInBytes > 1024 * 1024) {
-      throw new MarvinValidationError("Form data exceeds maximum size of 1MB");
-    }
-    const checkForScripts = (value) => {
-      if (typeof value === "string") {
-        if (/<script[\s\S]*?>[\s\S]*?<\/script>/gi.test(value)) {
-          throw new MarvinValidationError("Form data contains potentially malicious content");
-        }
-      } else if (Array.isArray(value)) {
-        value.forEach(checkForScripts);
-      } else if (value && typeof value === "object") {
-        Object.values(value).forEach(checkForScripts);
-      }
-    };
-    Object.values(data).forEach(checkForScripts);
-  }
-  /**
-   * List all forms
-   */
-  async list() {
-    return this.http.get("/api/platform/forms");
-  }
-  /**
-   * Get a single form by ID
-   */
-  async get(id) {
-    const validId = this.http.validatePathParam(id, "id");
-    return this.http.get(`/api/platform/forms/${validId}`);
-  }
-  /**
-   * Create a new form
-   */
-  async create(data) {
-    return this.http.post("/api/platform/forms", data);
-  }
-  /**
-   * Update a form
-   */
-  async update(id, data) {
-    const validId = this.http.validatePathParam(id, "id");
-    return this.http.patch(`/api/platform/forms/${validId}`, data);
-  }
-  /**
-   * Delete a form
-   */
-  async delete(id) {
-    return this.http.delete(`/api/platform/forms/${id}`);
-  }
-  /**
-   * Get submissions for a form
-   */
-  async getSubmissions(formId) {
-    return this.http.get(`/api/platform/forms/${formId}/submissions`);
-  }
-  /**
-   * Get a published form by slug (Publishing API - public access)
-   */
-  async getPublishedForm(slug) {
-    return this.http.get(`/api/publish/forms/${slug}`);
-  }
-  /**
-   * Submit data to a published form (Publishing API - public access)
-   * Validates data before submission to prevent XSS and malicious content
-   */
-  async submitForm(slug, data) {
-    const validSlug = this.http.validatePathParam(slug, "form slug");
-    this.validateFormData(data);
-    return this.http.post(`/api/publish/forms/${validSlug}/submit`, {
-      dataJson: data
-    });
-  }
-};
-
 // src/platform/client.ts
-function createPlatformConfigFromEnv(overrides) {
-  return {
-    apiUrl: overrides?.apiUrl || process.env.MARVIN_API_URL || "http://localhost:8080",
-    userToken: overrides?.userToken || process.env.MARVIN_USER_TOKEN,
-    credentials: overrides?.credentials || "include"
-  };
-}
 var PlatformClient = class extends HttpClient {
   entries;
   collections;
@@ -1345,16 +948,13 @@ var PlatformClient = class extends HttpClient {
   eventLog;
   session;
   theme;
-  emailTemplates;
-  scheduledTasks;
-  forms;
   // Admin modules
   adminUsers;
   adminSystem;
   adminMaintenance;
   constructor(config) {
     const httpConfig = {
-      baseUrl: config.apiUrl || "http://localhost:8080",
+      baseUrl: config.apiUrl,
       auth: new SessionAuth(config.userToken),
       credentials: config.credentials || "include"
     };
@@ -1375,17 +975,13 @@ var PlatformClient = class extends HttpClient {
     this.eventLog = new EventLogModule(this);
     this.session = new AuthModule(this);
     this.theme = new ThemeModule(this);
-    this.emailTemplates = new EmailTemplatesClient(this);
-    this.scheduledTasks = new ScheduledTasksModule(this);
-    this.forms = new FormsModule(this);
     this.adminUsers = new AdminUsersModule(this);
     this.adminSystem = new AdminSystemModule(this);
     this.adminMaintenance = new AdminMaintenanceModule(this);
   }
 };
 function createPlatformClient(config) {
-  const finalConfig = createPlatformConfigFromEnv(config);
-  return new PlatformClient(finalConfig);
+  return new PlatformClient(config);
 }
 export {
   APIClientsModule,
@@ -1395,22 +991,18 @@ export {
   AssetsModule,
   AuthModule,
   CollectionsModule,
-  EmailTemplatesClient,
   EntriesModule,
   EntryTypesModule,
   EventLogModule,
   EventsModule,
-  FormsModule,
   InvitesModule,
   NotificationsModule,
   PlatformClient,
   ResourcesModule,
-  ScheduledTasksModule,
   ThemeModule,
   UserModule,
   WebhooksModule,
   WorkspaceMembersModule,
   WorkspacesModule,
-  createPlatformClient,
-  createPlatformConfigFromEnv
+  createPlatformClient
 };