@inneropen/marvin-sdk 2.0.0-next.17 → 2.0.0-next.2

package/dist/platform.cjs

@@ -27,24 +27,20 @@ __export(platform_exports, {
   AssetsModule: () => AssetsModule,
   AuthModule: () => AuthModule,
   CollectionsModule: () => CollectionsModule,
-  EmailTemplatesClient: () => EmailTemplatesClient,
   EntriesModule: () => EntriesModule,
   EntryTypesModule: () => EntryTypesModule,
   EventLogModule: () => EventLogModule,
   EventsModule: () => EventsModule,
-  FormsModule: () => FormsModule,
   InvitesModule: () => InvitesModule,
   NotificationsModule: () => NotificationsModule,
   PlatformClient: () => PlatformClient,
   ResourcesModule: () => ResourcesModule,
-  ScheduledTasksModule: () => ScheduledTasksModule,
   ThemeModule: () => ThemeModule,
   UserModule: () => UserModule,
   WebhooksModule: () => WebhooksModule,
   WorkspaceMembersModule: () => WorkspaceMembersModule,
   WorkspacesModule: () => WorkspacesModule,
-  createPlatformClient: () => createPlatformClient,
-  createPlatformConfigFromEnv: () => createPlatformConfigFromEnv
+  createPlatformClient: () => createPlatformClient
 });
 module.exports = __toCommonJS(platform_exports);
 
@@ -78,49 +74,6 @@ ${body}` : ""}`;
     return new _MarvinApiError(message, status, endpoint, body);
   }
 };
-var MarvinAuthError = class _MarvinAuthError extends MarvinError {
-  constructor(message, statusCode) {
-    super(message, "AUTH_ERROR", statusCode);
-    this.name = "MarvinAuthError";
-    Object.setPrototypeOf(this, _MarvinAuthError.prototype);
-  }
-};
-var MarvinValidationError = class _MarvinValidationError extends MarvinError {
-  constructor(message, field) {
-    super(message, "VALIDATION_ERROR");
-    this.field = field;
-    this.name = "MarvinValidationError";
-    Object.setPrototypeOf(this, _MarvinValidationError.prototype);
-  }
-  field;
-};
-var MarvinNotFoundError = class _MarvinNotFoundError extends MarvinError {
-  constructor(message, endpoint) {
-    super(message, "NOT_FOUND", 404);
-    this.endpoint = endpoint;
-    this.name = "MarvinNotFoundError";
-    Object.setPrototypeOf(this, _MarvinNotFoundError.prototype);
-  }
-  endpoint;
-};
-var MarvinNetworkError = class _MarvinNetworkError extends MarvinError {
-  constructor(message, originalError) {
-    super(message, "NETWORK_ERROR");
-    this.originalError = originalError;
-    this.name = "MarvinNetworkError";
-    Object.setPrototypeOf(this, _MarvinNetworkError.prototype);
-  }
-  originalError;
-};
-var MarvinServerError = class _MarvinServerError extends MarvinError {
-  constructor(message, statusCode, endpoint) {
-    super(message, "SERVER_ERROR", statusCode);
-    this.endpoint = endpoint;
-    this.name = "MarvinServerError";
-    Object.setPrototypeOf(this, _MarvinServerError.prototype);
-  }
-  endpoint;
-};
 
 // src/core/http/HttpClient.ts
 var HttpClient = class {
@@ -129,47 +82,12 @@ var HttpClient = class {
   defaultHeaders;
   credentials;
   timeout;
-  debug;
-  retryConfig;
-  logger;
   constructor(config) {
     this.baseUrl = config.baseUrl;
     this.auth = config.auth;
     this.defaultHeaders = config.defaultHeaders || {};
     this.credentials = config.credentials || "same-origin";
-    const MAX_TIMEOUT = 12e4;
-    this.timeout = Math.min(config.timeout || 3e4, MAX_TIMEOUT);
-    this.debug = config.debug ?? false;
-    this.logger = config.logger ?? console;
-    this.retryConfig = {
-      maxRetries: config.retry?.maxRetries ?? 3,
-      initialDelay: config.retry?.initialDelay ?? 1e3,
-      maxDelay: config.retry?.maxDelay ?? 1e4,
-      retryableStatuses: config.retry?.retryableStatuses ?? [408, 429, 500, 502, 503, 504]
-    };
-  }
-  /**
-   * Validate path parameter to prevent path traversal attacks
-   */
-  validatePathParam(param, paramName = "parameter") {
-    if (typeof param === "number") {
-      return String(param);
-    }
-    if (!param || typeof param !== "string") {
-      throw new MarvinValidationError(`Invalid ${paramName}: must be a non-empty string or number`);
-    }
-    if (param.includes("..") || param.includes("/") || param.includes("\\")) {
-      throw new MarvinValidationError(
-        `Invalid ${paramName}: cannot contain path traversal characters (.. / \\)`
-      );
-    }
-    if (param.includes("\0")) {
-      throw new MarvinValidationError(`Invalid ${paramName}: cannot contain null bytes`);
-    }
-    if (param.length > 255) {
-      throw new MarvinValidationError(`Invalid ${paramName}: exceeds maximum length of 255 characters`);
-    }
-    return param;
+    this.timeout = config.timeout || 3e4;
   }
   /**
    * Build full URL from endpoint
@@ -203,78 +121,14 @@ var HttpClient = class {
     return filtered.length > 0 ? `?${filtered.join("&")}` : "";
   }
   /**
-   * Sanitize data for logging by redacting sensitive fields
-   */
-  sanitizeForLogging(data) {
-    if (!data || typeof data !== "object") {
-      return data;
-    }
-    const sensitiveFields = [
-      "token",
-      "access_token",
-      "refresh_token",
-      "password",
-      "secret",
-      "apiKey",
-      "api_key",
-      "bearer",
-      "authorization",
-      "csrf_token",
-      "session",
-      "cookie"
-    ];
-    const sanitize = (obj) => {
-      const sanitized = {};
-      for (const [key, value] of Object.entries(obj)) {
-        const keyLower = key.toLowerCase();
-        const isSensitive = sensitiveFields.some((field) => keyLower.includes(field));
-        if (isSensitive) {
-          sanitized[key] = "[REDACTED]";
-        } else if (value && typeof value === "object" && !Array.isArray(value)) {
-          sanitized[key] = sanitize(value);
-        } else if (Array.isArray(value)) {
-          sanitized[key] = value.map(
-            (item) => item && typeof item === "object" ? sanitize(item) : item
-          );
-        } else {
-          sanitized[key] = value;
-        }
-      }
-      return sanitized;
-    };
-    if (Array.isArray(data)) {
-      return data.map(
-        (item) => item && typeof item === "object" ? sanitize(item) : item
-      );
-    }
-    return sanitize(data);
-  }
-  /**
-   * Calculate delay for retry with exponential backoff
-   */
-  calculateRetryDelay(attempt) {
-    const delay = this.retryConfig.initialDelay * Math.pow(2, attempt);
-    return Math.min(delay, this.retryConfig.maxDelay);
-  }
-  /**
-   * Sleep for specified milliseconds
+   * Perform HTTP request
    */
-  sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-  }
-  /**
-   * Perform HTTP request with automatic retry on transient failures
-   */
-  async request(method, endpoint, options, retryAttempt = 0) {
+  async request(method, endpoint, options) {
     const url = this.buildUrl(endpoint) + (options?.params ? this.buildQueryString(options.params) : "");
     const isFormData = options?.body instanceof FormData;
     const headers = this.buildHeaders(options?.headers, isFormData);
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), this.timeout);
-    const startTime = Date.now();
-    if (this.debug) {
-      this.logger.log(`[Marvin] ${method} ${url}`);
-    }
     try {
       const response = await fetch(url, {
         method,
@@ -284,54 +138,11 @@ var HttpClient = class {
         signal: controller.signal
       });
       clearTimeout(timeoutId);
-      const duration = Date.now() - startTime;
-      if (this.debug) {
-        this.logger.log(
-          `[Marvin] ${response.status} ${response.statusText} (${duration}ms)`
-        );
-      }
       if (response.status === 401 && this.auth.handleUnauthorized) {
         await this.auth.handleUnauthorized();
       }
       if (!response.ok) {
         const errorText = await response.text().catch(() => "");
-        if (this.debug) {
-          this.logger.error(
-            `[Marvin] Error response: ${response.status} ${response.statusText}`,
-            errorText ? `Body: ${errorText}` : ""
-          );
-        }
-        const isRetryable = this.retryConfig.retryableStatuses.includes(response.status);
-        const canRetry = retryAttempt < this.retryConfig.maxRetries;
-        if (isRetryable && canRetry) {
-          const delay = this.calculateRetryDelay(retryAttempt);
-          if (this.debug) {
-            this.logger.warn(
-              `[Marvin] Retry ${retryAttempt + 1}/${this.retryConfig.maxRetries} after ${delay}ms (status: ${response.status})`
-            );
-          }
-          await this.sleep(delay);
-          return this.request(method, endpoint, options, retryAttempt + 1);
-        }
-        if (response.status === 404) {
-          throw new MarvinNotFoundError(
-            `Resource not found: ${endpoint}`,
-            endpoint
-          );
-        }
-        if (response.status === 401 || response.status === 403) {
-          throw new MarvinAuthError(
-            `Authentication failed: ${response.statusText}`,
-            response.status
-          );
-        }
-        if (response.status >= 500) {
-          throw new MarvinServerError(
-            `Server error: ${response.status} ${response.statusText}`,
-            response.status,
-            endpoint
-          );
-        }
         throw MarvinApiError.fromResponse(
           response.status,
           response.statusText,
@@ -343,39 +154,21 @@ var HttpClient = class {
       if (!contentType || !contentType.includes("application/json")) {
         return void 0;
       }
-      const data = await response.json();
-      if (this.debug) {
-        const sanitized = this.sanitizeForLogging(data);
-        this.logger.log("[Marvin] Response:", JSON.stringify(sanitized, null, 2));
-      }
-      return data;
+      return await response.json();
     } catch (error) {
       clearTimeout(timeoutId);
-      if (error instanceof MarvinApiError || error instanceof MarvinNotFoundError || error instanceof MarvinAuthError || error instanceof MarvinServerError) {
+      if (error instanceof MarvinApiError) {
         throw error;
       }
       if (error instanceof Error) {
-        const canRetry = retryAttempt < this.retryConfig.maxRetries;
-        if (canRetry && error.name !== "AbortError") {
-          const delay = this.calculateRetryDelay(retryAttempt);
-          if (this.debug) {
-            this.logger.warn(
-              `[Marvin] Retry ${retryAttempt + 1}/${this.retryConfig.maxRetries} after ${delay}ms (network error)`
-            );
-          }
-          await this.sleep(delay);
-          return this.request(method, endpoint, options, retryAttempt + 1);
-        }
         if (error.name === "AbortError") {
-          throw new MarvinNetworkError(
+          throw new MarvinApiError(
             `Request timeout after ${this.timeout}ms`,
-            error
+            408,
+            endpoint
           );
         }
-        throw new MarvinNetworkError(
-          `Network error: ${error.message}`,
-          error
-        );
+        throw new MarvinApiError(error.message, 0, endpoint);
       }
       throw error;
     }
@@ -420,27 +213,10 @@ var SessionAuth = class {
   }
   sessionToken;
   onUnauthorized;
-  csrfToken;
-  /**
-   * Set CSRF token for cross-site request forgery protection
-   * The token should be obtained from the server after login
-   */
-  setCsrfToken(token) {
-    this.csrfToken = token;
-  }
-  /**
-   * Get current CSRF token
-   */
-  getCsrfToken() {
-    return this.csrfToken;
-  }
   injectAuth(headers) {
     if (this.sessionToken) {
       headers.set("Authorization", `Bearer ${this.sessionToken}`);
     }
-    if (this.csrfToken) {
-      headers.set("X-CSRF-Token", this.csrfToken);
-    }
   }
   async handleUnauthorized() {
     if (this.onUnauthorized) {
@@ -448,9 +224,7 @@ var SessionAuth = class {
     }
   }
   getDescription() {
-    const auth = this.sessionToken ? "Session authentication (explicit token)" : "Session authentication (cookies)";
-    const csrf = this.csrfToken ? " with CSRF protection" : "";
-    return auth + csrf;
+    return this.sessionToken ? "Session authentication (explicit token)" : "Session authentication (cookies)";
   }
 };
 
@@ -470,8 +244,7 @@ var EntriesModule = class {
    * Get a single entry by ID
    */
   async get(id) {
-    const validId = this.http.validatePathParam(id, "entry ID");
-    return this.http.get(`/api/platform/entries/${validId}`);
+    return this.http.get(`/api/platform/entries/${id}`);
   }
   /**
    * Create a new entry
@@ -483,31 +256,26 @@ var EntriesModule = class {
    * Update an entry
    */
   async update(id, data) {
-    const validId = this.http.validatePathParam(id, "entry ID");
-    return this.http.patch(`/api/platform/entries/${validId}`, data);
+    return this.http.patch(`/api/platform/entries/${id}`, data);
   }
   /**
    * Delete an entry
    */
   async delete(id) {
-    const validId = this.http.validatePathParam(id, "entry ID");
-    return this.http.delete(`/api/platform/entries/${validId}`);
+    return this.http.delete(`/api/platform/entries/${id}`);
   }
   /**
    * Get collections that this entry belongs to
    */
   async listCollections(entryId) {
-    const validId = this.http.validatePathParam(entryId, "entry ID");
-    return this.http.get(`/api/platform/entries/${validId}/collections`);
+    return this.http.get(`/api/platform/entries/${entryId}/collections`);
   }
   /**
    * Add entry to a collection
    */
   async addToCollection(entryId, collectionId) {
-    const validEntryId = this.http.validatePathParam(entryId, "entry ID");
-    const validCollectionId = this.http.validatePathParam(collectionId, "collection ID");
     return this.http.post(
-      `/api/platform/entries/${validEntryId}/collections/${validCollectionId}`,
+      `/api/platform/entries/${entryId}/collections/${collectionId}`,
       {}
     );
   }
@@ -515,9 +283,7 @@ var EntriesModule = class {
    * Remove entry from a collection
    */
   async removeFromCollection(entryId, collectionId) {
-    const validEntryId = this.http.validatePathParam(entryId, "entry ID");
-    const validCollectionId = this.http.validatePathParam(collectionId, "collection ID");
-    return this.http.delete(`/api/platform/entries/${validEntryId}/collections/${validCollectionId}`);
+    return this.http.delete(`/api/platform/entries/${entryId}/collections/${collectionId}`);
   }
 };
 
@@ -537,8 +303,7 @@ var CollectionsModule = class {
    * Get a single collection by ID
    */
   async get(id) {
-    const validId = this.http.validatePathParam(id, "id");
-    return this.http.get(`/api/platform/collections/${validId}`);
+    return this.http.get(`/api/platform/collections/${id}`);
   }
   /**
    * Create a new collection
@@ -550,29 +315,25 @@ var CollectionsModule = class {
    * Update a collection
    */
   async update(id, data) {
-    const validId = this.http.validatePathParam(id, "id");
-    return this.http.patch(`/api/platform/collections/${validId}`, data);
+    return this.http.patch(`/api/platform/collections/${id}`, data);
   }
   /**
    * Delete a collection
    */
   async delete(id) {
-    const validId = this.http.validatePathParam(id, "collection ID");
-    return this.http.delete(`/api/platform/collections/${validId}`);
+    return this.http.delete(`/api/platform/collections/${id}`);
   }
   /**
    * Get entries in a collection
    */
   async getEntries(id) {
-    const validId = this.http.validatePathParam(id, "collection ID");
-    return this.http.get(`/api/platform/collections/${validId}/entries`);
+    return this.http.get(`/api/platform/collections/${id}/entries`);
   }
   /**
    * Reorder entries in a collection
    */
   async reorderEntries(id, entries) {
-    const validId = this.http.validatePathParam(id, "collection ID");
-    return this.http.patch(`/api/platform/collections/${validId}/entries/order`, { entries });
+    return this.http.patch(`/api/platform/collections/${id}/entries/order`, { entries });
   }
 };
 
@@ -592,8 +353,7 @@ var ResourcesModule = class {
    * Get a single resource by ID
    */
   async get(id) {
-    const validId = this.http.validatePathParam(id, "id");
-    return this.http.get(`/api/platform/resources/${validId}`);
+    return this.http.get(`/api/platform/resources/${id}`);
   }
   /**
    * Create a new resource
@@ -605,8 +365,7 @@ var ResourcesModule = class {
    * Update a resource
    */
   async update(id, data) {
-    const validId = this.http.validatePathParam(id, "id");
-    return this.http.patch(`/api/platform/resources/${validId}`, data);
+    return this.http.patch(`/api/platform/resources/${id}`, data);
   }
   /**
    * Delete a resource
@@ -628,47 +387,6 @@ var AssetsModule = class {
     this.http = http;
   }
   http;
-  /**
-   * Validate file before upload
-   */
-  validateFile(file, options) {
-    const maxSize = options?.maxFileSize || 100 * 1024 * 1024;
-    const allowedTypes = options?.allowedMimeTypes;
-    if (file.size === 0) {
-      throw new MarvinValidationError("File is empty");
-    }
-    if (file.size > maxSize) {
-      const maxMB = Math.round(maxSize / (1024 * 1024));
-      const fileMB = Math.round(file.size / (1024 * 1024));
-      throw new MarvinValidationError(
-        `File size (${fileMB}MB) exceeds maximum allowed size of ${maxMB}MB`
-      );
-    }
-    if (allowedTypes && allowedTypes.length > 0) {
-      if (file instanceof File && file.type) {
-        const isAllowed = allowedTypes.some((allowed) => {
-          if (allowed.endsWith("/*")) {
-            const prefix = allowed.slice(0, -2);
-            return file.type.startsWith(prefix);
-          }
-          return file.type === allowed;
-        });
-        if (!isAllowed) {
-          throw new MarvinValidationError(
-            `File type "${file.type}" is not allowed. Allowed types: ${allowedTypes.join(", ")}`
-          );
-        }
-      }
-    }
-    if (file instanceof File) {
-      if (!file.name || file.name.trim().length === 0) {
-        throw new MarvinValidationError("File must have a valid name");
-      }
-      if (file.name.includes("..") || file.name.includes("/") || file.name.includes("\\")) {
-        throw new MarvinValidationError("Invalid filename: cannot contain path separators");
-      }
-    }
-  }
   /**
    * List all assets
    */
@@ -679,31 +397,16 @@ var AssetsModule = class {
    * Get a single asset by ID
    */
   async get(id) {
-    const validId = this.http.validatePathParam(id, "id");
-    return this.http.get(`/api/platform/assets/${validId}`);
+    return this.http.get(`/api/platform/assets/${id}`);
   }
   /**
    * Upload a new asset file
    *
    * @param file - The file to upload (File or Blob)
    * @param metadata - Asset metadata (slug, name, altText, description, metadata)
-   * @param options - Upload options (file size limits, allowed types)
    * @returns The created asset with extracted metadata
-   *
-   * @example
-   * ```typescript
-   * // Upload with default limits (100MB, all types)
-   * const asset = await assets.upload(file, { slug: 'my-image', name: 'My Image' });
-   *
-   * // Upload with restrictions
-   * const asset = await assets.upload(file,
-   *   { slug: 'avatar', name: 'Avatar' },
-   *   { maxFileSize: 5 * 1024 * 1024, allowedMimeTypes: ['image/*'] }
-   * );
-   * ```
    */
-  async upload(file, metadata, options) {
-    this.validateFile(file, options);
+  async upload(file, metadata) {
     const formData = new FormData();
     formData.append("file", file);
     formData.append("slug", metadata.slug);
@@ -723,24 +426,13 @@ var AssetsModule = class {
    * Update an asset (editable fields only: slug, name, altText, description, metadata)
    */
   async update(id, data) {
-    const validId = this.http.validatePathParam(id, "id");
-    return this.http.patch(`/api/platform/assets/${validId}`, data);
+    return this.http.patch(`/api/platform/assets/${id}`, data);
   }
   /**
    * Delete an asset (removes file from storage and database)
    */
   async delete(id) {
-    const validId = this.http.validatePathParam(id, "asset ID");
-    return this.http.delete(`/api/platform/assets/${validId}`);
-  }
-  /**
-   * Get download URL for an asset file
-   * Use this to create download links or fetch the file directly
-   */
-  getDownloadUrl(id, baseUrl) {
-    const validId = this.http.validatePathParam(id, "asset ID");
-    const base = baseUrl || (typeof window !== "undefined" && window.location ? window.location.origin : "");
-    return `${base}/api/platform/assets/${validId}/file`;
+    return this.http.delete(`/api/platform/assets/${id}`);
   }
 };
 
@@ -760,8 +452,7 @@ var APIClientsModule = class {
    * Get a single API client by ID
    */
   async get(id) {
-    const validId = this.http.validatePathParam(id, "id");
-    return this.http.get(`/api/platform/api-clients/${validId}`);
+    return this.http.get(`/api/platform/api-clients/${id}`);
   }
   /**
    * Create a new API client (returns client with token)
@@ -773,8 +464,7 @@ var APIClientsModule = class {
    * Update an API client
    */
   async update(id, data) {
-    const validId = this.http.validatePathParam(id, "id");
-    return this.http.patch(`/api/platform/api-clients/${validId}`, data);
+    return this.http.patch(`/api/platform/api-clients/${id}`, data);
   }
   /**
    * Delete an API client
@@ -985,23 +675,11 @@ var InvitesModule = class {
   }
   /**
    * Generate invitation URL from a token
-   *
-   * @param token - Invitation token
-   * @param baseUrl - Base URL for the frontend (required in browser environments)
-   * @returns Full invitation URL
-   *
-   * @example
-   * ```typescript
-   * // Node.js (can use env vars)
-   * const url = invites.getInvitationUrl(token);
-   *
-   * // Browser (must provide baseUrl)
-   * const url = invites.getInvitationUrl(token, 'https://app.example.com');
-   * ```
+   * Uses MARVIN_FRONTEND_URL for the base URL, falls back to MARVIN_API_URL with common port mappings
    */
   getInvitationUrl(token, baseUrl) {
     let base = baseUrl;
-    if (!base && typeof process !== "undefined" && process.env) {
+    if (!base) {
       base = process.env.MARVIN_FRONTEND_URL;
       if (!base && process.env.MARVIN_API_URL) {
         const apiUrl = process.env.MARVIN_API_URL;
@@ -1013,17 +691,11 @@ var InvitesModule = class {
           base = apiUrl;
         }
       }
-    }
-    if (!base) {
-      if (typeof window !== "undefined" && window.location) {
-        base = window.location.origin;
-      } else {
-        throw new Error(
-          'baseUrl is required when not in Node.js environment. Pass the frontend URL as second argument: getInvitationUrl(token, "https://app.example.com")'
-        );
+      if (!base) {
+        base = "http://localhost:4321";
       }
     }
-    return `${base}/register?token=${encodeURIComponent(token)}`;
+    return `${base}/register?token=${token}`;
   }
 };
 
@@ -1077,57 +749,6 @@ var WebhooksModule = class {
     this.http = http;
   }
   http;
-  /**
-   * Validate webhook URL to prevent SSRF attacks
-   */
-  validateWebhookUrl(url) {
-    if (!url || typeof url !== "string") {
-      throw new MarvinValidationError("Webhook URL is required and must be a string");
-    }
-    let parsed;
-    try {
-      parsed = new URL(url);
-    } catch {
-      throw new MarvinValidationError("Invalid webhook URL format. Expected: https://example.com/webhook");
-    }
-    if (!["http:", "https:"].includes(parsed.protocol)) {
-      throw new MarvinValidationError(
-        `Webhook URL must use HTTP or HTTPS protocol. Got: ${parsed.protocol}`
-      );
-    }
-    const hostname = parsed.hostname.toLowerCase();
-    const blockedHosts = [
-      "localhost",
-      "127.0.0.1",
-      "0.0.0.0",
-      "::1",
-      "169.254.169.254",
-      // AWS metadata service
-      "[::]"
-    ];
-    if (blockedHosts.some((blocked) => hostname === blocked || hostname.includes(blocked))) {
-      throw new MarvinValidationError(
-        "Webhook URL cannot target localhost or internal network addresses"
-      );
-    }
-    const ipv4Regex = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
-    const match = hostname.match(ipv4Regex);
-    if (match) {
-      const octets = match.slice(1).map(Number);
-      if (octets[0] === 10) {
-        throw new MarvinValidationError("Webhook URL cannot target private IP range (10.x.x.x)");
-      }
-      if (octets[0] === 172 && octets[1] >= 16 && octets[1] <= 31) {
-        throw new MarvinValidationError("Webhook URL cannot target private IP range (172.16-31.x.x)");
-      }
-      if (octets[0] === 192 && octets[1] === 168) {
-        throw new MarvinValidationError("Webhook URL cannot target private IP range (192.168.x.x)");
-      }
-    }
-    if (url.length > 2048) {
-      throw new MarvinValidationError("Webhook URL exceeds maximum length of 2048 characters");
-    }
-  }
   /**
    * List all webhooks for the current workspace
    */
@@ -1139,43 +760,31 @@ var WebhooksModule = class {
    * Get a webhook by ID
    */
   async get(id) {
-    const validId = this.http.validatePathParam(id, "webhook ID");
-    return this.http.get(`/api/groups/webhooks/${validId}`);
+    return this.http.get(`/api/groups/webhooks/${id}`);
   }
   /**
    * Create a new webhook
-   * Validates URL to prevent SSRF attacks
    */
   async create(data) {
-    if (data.url) {
-      this.validateWebhookUrl(data.url);
-    }
     return this.http.post("/api/groups/webhooks", data);
   }
   /**
    * Update a webhook
-   * Validates URL if provided to prevent SSRF attacks
    */
   async update(id, data) {
-    const validId = this.http.validatePathParam(id, "webhook ID");
-    if (data.url) {
-      this.validateWebhookUrl(data.url);
-    }
-    return this.http.put(`/api/groups/webhooks/${validId}`, data);
+    return this.http.put(`/api/groups/webhooks/${id}`, data);
   }
   /**
    * Delete a webhook
    */
   async delete(id) {
-    const validId = this.http.validatePathParam(id, "webhook ID");
-    await this.http.delete(`/api/groups/webhooks/${validId}`);
+    await this.http.delete(`/api/groups/webhooks/${id}`);
   }
   /**
    * Test a webhook
    */
   async test(id) {
-    const validId = this.http.validatePathParam(id, "webhook ID");
-    return this.http.post(`/api/groups/webhooks/${validId}/test`, {});
+    return this.http.post(`/api/groups/webhooks/${id}/test`, {});
   }
   /**
    * Rerun failed webhooks
@@ -1267,7 +876,6 @@ var AdminSystemModule = class {
   }
   /**
    * Update email settings
-   * Note: Password field is write-only and will not be returned in response
    */
   async updateEmailSettings(data) {
     return this.http.put("/api/admin/email", data);
@@ -1543,234 +1151,7 @@ var ThemeModule = class {
   }
 };
 
-// src/platform/emailTemplates.ts
-var EmailTemplatesClient = class {
-  constructor(http) {
-    this.http = http;
-  }
-  http;
-  /**
-   * List all email templates for the workspace
-   * @param groupId - Workspace ID
-   */
-  async list(groupId) {
-    return this.http.get(`/api/platform/workspaces/${groupId}/email-templates`);
-  }
-  /**
-   * Get a specific email template
-   * @param groupId - Workspace ID
-   * @param templateId - Template ID
-   */
-  async get(groupId, templateId) {
-    return this.http.get(`/api/platform/workspaces/${groupId}/email-templates/${templateId}`);
-  }
-  /**
-   * Create a new email template
-   * @param groupId - Workspace ID
-   * @param data - Template data
-   */
-  async create(groupId, data) {
-    return this.http.post(`/api/platform/workspaces/${groupId}/email-templates`, data);
-  }
-  /**
-   * Update an email template
-   * @param groupId - Workspace ID
-   * @param templateId - Template ID
-   * @param data - Updated template data
-   */
-  async update(groupId, templateId, data) {
-    return this.http.patch(`/api/platform/workspaces/${groupId}/email-templates/${templateId}`, data);
-  }
-  /**
-   * Delete an email template
-   * @param groupId - Workspace ID
-   * @param templateId - Template ID
-   */
-  async delete(groupId, templateId) {
-    await this.http.delete(`/api/platform/workspaces/${groupId}/email-templates/${templateId}`);
-  }
-  /**
-   * Send a test email using a template
-   * @param groupId - Workspace ID
-   * @param templateId - Template ID
-   * @param recipientEmail - Test recipient email address
-   */
-  async sendTest(groupId, templateId, recipientEmail) {
-    return this.http.post(`/api/platform/workspaces/${groupId}/email-templates/${templateId}/test`, {
-      recipient_email: recipientEmail
-    });
-  }
-};
-
-// src/platform/scheduledTasks.ts
-var ScheduledTasksModule = class {
-  constructor(http) {
-    this.http = http;
-  }
-  http;
-  /**
-   * List all scheduled tasks for the current workspace
-   */
-  async list() {
-    return this.http.get("/api/platform/scheduled-tasks");
-  }
-  /**
-   * Get a scheduled task by ID or slug
-   */
-  async get(idOrSlug) {
-    const validIdOrSlug = this.http.validatePathParam(idOrSlug, "idOrSlug");
-    return this.http.get(`/api/platform/scheduled-tasks/${validIdOrSlug}`);
-  }
-  /**
-   * Create a new scheduled task
-   */
-  async create(data) {
-    return this.http.post("/api/platform/scheduled-tasks", data);
-  }
-  /**
-   * Update a scheduled task
-   */
-  async update(idOrSlug, data) {
-    const validIdOrSlug = this.http.validatePathParam(idOrSlug, "idOrSlug");
-    return this.http.patch(`/api/platform/scheduled-tasks/${validIdOrSlug}`, data);
-  }
-  /**
-   * Delete a scheduled task
-   */
-  async delete(idOrSlug) {
-    await this.http.delete(`/api/platform/scheduled-tasks/${idOrSlug}`);
-  }
-  /**
-   * Manually trigger task execution (bypass schedule)
-   */
-  async execute(idOrSlug) {
-    await this.http.post(`/api/platform/scheduled-tasks/${idOrSlug}/execute`, {});
-  }
-  /**
-   * Get task execution history
-   */
-  async history(idOrSlug, options) {
-    const params = new URLSearchParams();
-    if (options?.limit) {
-      params.set("limit", options.limit.toString());
-    }
-    const query = params.toString() ? `?${params.toString()}` : "";
-    return this.http.get(
-      `/api/platform/scheduled-tasks/${idOrSlug}/history${query}`
-    );
-  }
-  /**
-   * Get available task types
-   */
-  async taskTypes(options) {
-    const params = new URLSearchParams();
-    if (options?.detailed) {
-      params.set("detailed", "true");
-    }
-    const query = params.toString() ? `?${params.toString()}` : "";
-    return this.http.get(`/api/platform/scheduled-tasks/task-types${query}`);
-  }
-};
-
-// src/platform/forms.ts
-var FormsModule = class {
-  constructor(http) {
-    this.http = http;
-  }
-  http;
-  /**
-   * Validate form submission data
-   * - Prevents XSS by checking for script tags
-   * - Validates data is a proper object
-   * - Checks for reasonable size limits
-   */
-  validateFormData(data) {
-    if (!data || typeof data !== "object") {
-      throw new MarvinValidationError("Form data must be a valid object");
-    }
-    const jsonString = JSON.stringify(data);
-    const sizeInBytes = new Blob([jsonString]).size;
-    if (sizeInBytes > 1024 * 1024) {
-      throw new MarvinValidationError("Form data exceeds maximum size of 1MB");
-    }
-    const checkForScripts = (value) => {
-      if (typeof value === "string") {
-        if (/<script[\s\S]*?>[\s\S]*?<\/script>/gi.test(value)) {
-          throw new MarvinValidationError("Form data contains potentially malicious content");
-        }
-      } else if (Array.isArray(value)) {
-        value.forEach(checkForScripts);
-      } else if (value && typeof value === "object") {
-        Object.values(value).forEach(checkForScripts);
-      }
-    };
-    Object.values(data).forEach(checkForScripts);
-  }
-  /**
-   * List all forms
-   */
-  async list() {
-    return this.http.get("/api/platform/forms");
-  }
-  /**
-   * Get a single form by ID
-   */
-  async get(id) {
-    const validId = this.http.validatePathParam(id, "id");
-    return this.http.get(`/api/platform/forms/${validId}`);
-  }
-  /**
-   * Create a new form
-   */
-  async create(data) {
-    return this.http.post("/api/platform/forms", data);
-  }
-  /**
-   * Update a form
-   */
-  async update(id, data) {
-    const validId = this.http.validatePathParam(id, "id");
-    return this.http.patch(`/api/platform/forms/${validId}`, data);
-  }
-  /**
-   * Delete a form
-   */
-  async delete(id) {
-    return this.http.delete(`/api/platform/forms/${id}`);
-  }
-  /**
-   * Get submissions for a form
-   */
-  async getSubmissions(formId) {
-    return this.http.get(`/api/platform/forms/${formId}/submissions`);
-  }
-  /**
-   * Get a published form by slug (Publishing API - public access)
-   */
-  async getPublishedForm(slug) {
-    return this.http.get(`/api/publish/forms/${slug}`);
-  }
-  /**
-   * Submit data to a published form (Publishing API - public access)
-   * Validates data before submission to prevent XSS and malicious content
-   */
-  async submitForm(slug, data) {
-    const validSlug = this.http.validatePathParam(slug, "form slug");
-    this.validateFormData(data);
-    return this.http.post(`/api/publish/forms/${validSlug}/submit`, {
-      dataJson: data
-    });
-  }
-};
-
 // src/platform/client.ts
-function createPlatformConfigFromEnv(overrides) {
-  return {
-    apiUrl: overrides?.apiUrl || process.env.MARVIN_API_URL || "http://localhost:8080",
-    userToken: overrides?.userToken || process.env.MARVIN_USER_TOKEN,
-    credentials: overrides?.credentials || "include"
-  };
-}
 var PlatformClient = class extends HttpClient {
   entries;
   collections;
@@ -1788,16 +1169,13 @@ var PlatformClient = class extends HttpClient {
   eventLog;
   session;
   theme;
-  emailTemplates;
-  scheduledTasks;
-  forms;
   // Admin modules
   adminUsers;
   adminSystem;
   adminMaintenance;
   constructor(config) {
     const httpConfig = {
-      baseUrl: config.apiUrl || "http://localhost:8080",
+      baseUrl: config.apiUrl,
       auth: new SessionAuth(config.userToken),
       credentials: config.credentials || "include"
     };
@@ -1818,17 +1196,13 @@ var PlatformClient = class extends HttpClient {
     this.eventLog = new EventLogModule(this);
     this.session = new AuthModule(this);
     this.theme = new ThemeModule(this);
-    this.emailTemplates = new EmailTemplatesClient(this);
-    this.scheduledTasks = new ScheduledTasksModule(this);
-    this.forms = new FormsModule(this);
     this.adminUsers = new AdminUsersModule(this);
     this.adminSystem = new AdminSystemModule(this);
     this.adminMaintenance = new AdminMaintenanceModule(this);
   }
 };
 function createPlatformClient(config) {
-  const finalConfig = createPlatformConfigFromEnv(config);
-  return new PlatformClient(finalConfig);
+  return new PlatformClient(config);
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
@@ -1839,22 +1213,18 @@ function createPlatformClient(config) {
   AssetsModule,
   AuthModule,
   CollectionsModule,
-  EmailTemplatesClient,
   EntriesModule,
   EntryTypesModule,
   EventLogModule,
   EventsModule,
-  FormsModule,
   InvitesModule,
   NotificationsModule,
   PlatformClient,
   ResourcesModule,
-  ScheduledTasksModule,
   ThemeModule,
   UserModule,
   WebhooksModule,
   WorkspaceMembersModule,
   WorkspacesModule,
-  createPlatformClient,
-  createPlatformConfigFromEnv
+  createPlatformClient
 });