@inneropen/marvin-sdk 2.0.0-next.18 → 2.0.0-next.2

package/README.md

@@ -1,35 +1,7 @@
 # Marvin TypeScript SDK
 
-> 🔒 **Enterprise-Grade Security** | ✅ **Zero Vulnerabilities** | 🚀 **Production-Ready**
-
 The official TypeScript SDK for Marvin CMS. A modern, workspace-first SDK for building applications that integrate with Marvin.
 
-[![Security Status](https://img.shields.io/badge/security-enterprise%20grade-brightgreen)](./SECURITY_FIXES_SUMMARY.md)
-[![Version](https://img.shields.io/badge/version-2.0.1-blue)](https://github.com/inneropen/marvin-sdk/releases)
-[![TypeScript](https://img.shields.io/badge/TypeScript-100%25-blue)](https://www.typescriptlang.org/)
-
-## Security First
-
-**The Marvin SDK has undergone a comprehensive security audit and achieved zero security vulnerabilities.** All 20 identified issues have been fixed, including:
-
-- ✅ 8 HIGH priority vulnerabilities eliminated
-- ✅ 7 MEDIUM priority security issues resolved
-- ✅ 5 LOW priority code quality improvements implemented
-
-**[View Complete Security Audit →](./COMPLETE_SECURITY_AUDIT.md)**
-
-### Key Security Features
-
-- 🔐 **Token Sanitization** - Automatic redaction of sensitive data in logs/errors
-- 🛡️ **Input Validation** - Path injection, XSS, and SSRF prevention
-- 📧 **Email Validation** - RFC 5322 compliant validation
-- 📁 **File Upload Security** - Size, type, and filename validation
-- 🔄 **Network Resilience** - Automatic retry with exponential backoff
-- 🔒 **CSRF Protection** - Session authentication security
-- ✅ **Type Safety** - 100% TypeScript with zero `any` types
-
-**[View Security Best Practices →](./AUTHENTICATION.md#security-best-practices)**
-
 ## Why This SDK?
 
 Marvin is becoming a platform, not simply a CMS. This SDK is the primary way to integrate with Marvin across:
@@ -47,64 +19,42 @@ The SDK provides:
 - 📘 **Fully Typed** - Complete TypeScript support
 - 🔄 **Backwards Compatible** - Works with existing publishing APIs
 - 🎨 **Object-Oriented** - Rich objects instead of raw JSON
-- 🔒 **Enterprise Security** - Production-ready with comprehensive security features
+- 🔒 **Secure** - Site client tokens, never user tokens
 
 ## Installation
 
 ```bash
-npm install @inneropen/marvin-sdk@^2.0.1
-```
-
-**Latest stable version:** v2.0.1 with complete security fixes and enterprise-grade quality.
-
-## Entry Points
-
-The SDK provides three distinct entry points for different use cases:
-
-### 📖 Publishing API (`/publish`)
-Read-only access to published content (frontends, websites)
-```typescript
-import { createMarvinClient } from '@inneropen/marvin-sdk/publish';
+# Copy into your project
+cp -r /path/to/marvin/packages/marvin-sdk src/lib/marvin
 ```
-**Auth:** Site client tokens (`MARVIN_SITE_CLIENT_TOKEN`)
 
-### ⚙️ Platform API (`/platform`)
-Full CRUD admin operations (backend, CLI, automation)
-```typescript
-import { createPlatformClient } from '@inneropen/marvin-sdk/platform';
-```
-**Auth:** User tokens (`MARVIN_USER_TOKEN`) or session cookies
+Or symlink for development:
 
-### 🔐 Auth API (Default export)
-Public registration, login, password reset
-```typescript
-import { createAuthClient } from '@inneropen/marvin-sdk';
+```bash
+ln -s /path/to/marvin/packages/marvin-sdk src/lib/marvin
 ```
-**Auth:** None required (public endpoints)
-
-📚 **[See complete authentication guide →](./AUTHENTICATION.md)**
 
-## Quick Start - Publishing API
+## Quick Start
 
 ### 1. Configure Environment
 
 ```env
 MARVIN_API_URL=https://marvin.example.com
-MARVIN_SITE_CLIENT_TOKEN=your-site-client-token
+MARVIN_SITE_CLIENT_TOKEN=your-token-here
 MARVIN_WORKSPACE_SLUG=your-workspace
 ```
 
 ### 2. Create Client
 
-```typescript
-import { createMarvinClient } from '@inneropen/marvin-sdk/publish';
+```ts
+import { createMarvinClient } from './marvin-sdk';
 
 const marvin = createMarvinClient();
 ```
 
 ### 3. Fetch Content
 
-```typescript
+```ts
 // Get workspace
 const workspace = await marvin.getWorkspace();
 console.log(workspace.site?.title);
@@ -121,35 +71,6 @@ const projects = await marvin.collection('projects');
 const projectEntries = await projects.entries();
 ```
 
-## Quick Start - Platform API
-
-### Programmatic Admin Access
-
-```typescript
-import { createPlatformClient } from '@inneropen/marvin-sdk/platform';
-
-// From environment (MARVIN_USER_TOKEN)
-const platform = createPlatformClient();
-
-// Or explicit token
-const platform = createPlatformClient({
-  userToken: 'your-user-token'
-});
-
-// Full CRUD operations
-await platform.entries.create({
-  title: 'New Post',
-  content: 'Content here...',
-  collection_id: collectionId
-});
-
-await platform.entries.update(entryId, {
-  title: 'Updated Title'
-});
-
-await platform.entries.delete(entryId);
-```
-
 ## Architecture
 
 ### Workspace-First Design
@@ -713,31 +634,6 @@ The SDK uses these Marvin publishing API endpoints:
 
 ## Security
 
-### Security Features
-
-The SDK includes comprehensive security protections:
-
-#### Input Validation
-- **Path Injection Prevention** - Validates all path parameters to prevent `../` attacks
-- **Email Validation** - RFC 5322 compliant email format checking
-- **Webhook URL Validation** - SSRF prevention for webhook endpoints
-- **File Upload Validation** - Size limits (10MB), type checking, and filename sanitization
-- **Form Submission Validation** - XSS prevention with script tag detection
-
-#### Data Protection
-- **Token Sanitization** - Automatic redaction of sensitive data in debug logs and errors
-  - Tokens, passwords, secrets, API keys automatically masked
-  - Recursive sanitization for nested objects and arrays
-- **Email Password Security** - Passwords never returned in API responses
-- **CSRF Protection** - Session authentication with CSRF token support
-
-#### Network Security
-- **Retry Logic** - Automatic exponential backoff for transient failures (3 retries, configurable)
-- **Timeout Limits** - Maximum 2-minute timeout to prevent resource exhaustion
-- **Error Handling** - Comprehensive error types with actionable messages
-
-**[Complete Security Documentation →](./SECURITY_FIXES_SUMMARY.md)**
-
 ### Site Client Tokens
 
 Always use **site client tokens**, never user tokens.
@@ -764,17 +660,6 @@ const marvin = createMarvinClient();
 </script>
 ```
 
-### Security Best Practices
-
-1. **Environment Variables** - Never commit tokens to version control
-2. **Token Rotation** - Regenerate user tokens periodically
-3. **Debug Mode** - Tokens are automatically sanitized in logs, but still use caution
-4. **Input Validation** - The SDK validates all inputs, but validate on your side too
-5. **HTTPS Only** - Always use HTTPS in production (enforced by default)
-6. **CSRF Tokens** - Enable CSRF protection for browser-based admin UIs
-
-**[Complete Authentication Guide →](./AUTHENTICATION.md)**
-
 ## Future Modules
 
 The SDK architecture supports future expansion:
@@ -829,18 +714,8 @@ Make sure your `tsconfig.json` includes:
 
 MIT - Part of the Marvin project.
 
-## Documentation
-
-- 🔒 [Security Audit Report](./COMPLETE_SECURITY_AUDIT.md) - Complete security fixes (20 issues resolved)
-- 📋 [Security Fixes Summary](./SECURITY_FIXES_SUMMARY.md) - Key improvements and migration guide
-- 🔐 [Authentication Guide](./AUTHENTICATION.md) - Complete auth documentation and security best practices
-- ⚠️ [Error Handling Guide](./ERROR_HANDLING_GUIDE.md) - Comprehensive error handling patterns
-- 🧪 [Testing Guide](./TESTING.md) - Testing strategy and security test examples
-- 🔄 [Migration Guide v2.0](./MIGRATION-v2.md) - Upgrade from v1.x to v2.0
-
 ## Support
 
 - 📖 [Full Documentation](./examples.md)
 - 🚀 [Quick Start Guide](./QUICKSTART.md)
 - 🐛 [Report Issues](https://github.com/jmashburn/Marvin/issues)
-- 🔒 [Security Policy](./SECURITY.md) - Vulnerability reporting and security policy

package/dist/{HttpClient-CdF3IHM1.d.cts → HttpClient-CLtgQGXH.d.cts}

@@ -33,22 +33,11 @@ declare class BearerTokenAuth implements AuthStrategy {
 /**
  * Session-based authentication (Platform/Admin APIs in browser)
  * Relies on HTTP-only cookies set by the server
- * Optionally supports CSRF token protection
  */
 declare class SessionAuth implements AuthStrategy {
     private sessionToken?;
     private onUnauthorized?;
-    private csrfToken?;
     constructor(sessionToken?: string | undefined, onUnauthorized?: (() => Promise<void>) | undefined);
-    /**
-     * Set CSRF token for cross-site request forgery protection
-     * The token should be obtained from the server after login
-     */
-    setCsrfToken(token: string): void;
-    /**
-     * Get current CSRF token
-     */
-    getCsrfToken(): string | undefined;
     injectAuth(headers: Headers): void;
     handleUnauthorized(): Promise<void>;
     getDescription(): string;
@@ -65,29 +54,12 @@ declare class NoAuth implements AuthStrategy {
  * Base HTTP client for Marvin APIs
  */
 
-interface RetryConfig {
-    /** Maximum number of retry attempts (default: 3) */
-    maxRetries: number;
-    /** Initial delay in ms before first retry (default: 1000) */
-    initialDelay: number;
-    /** Maximum delay in ms between retries (default: 10000) */
-    maxDelay: number;
-    /** HTTP status codes that should trigger a retry (default: [408, 429, 500, 502, 503, 504]) */
-    retryableStatuses: number[];
-}
 interface HttpClientConfig {
     baseUrl: string;
     auth: AuthStrategy;
     defaultHeaders?: Record<string, string>;
     credentials?: RequestCredentials;
     timeout?: number;
-    debug?: boolean;
-    retry?: Partial<RetryConfig>;
-    logger?: {
-        log: (message: string, ...args: unknown[]) => void;
-        warn: (message: string, ...args: unknown[]) => void;
-        error: (message: string, ...args: unknown[]) => void;
-    };
 }
 declare class HttpClient {
     private baseUrl;
@@ -95,14 +67,7 @@ declare class HttpClient {
     private defaultHeaders;
     private credentials;
     private timeout;
-    private debug;
-    private retryConfig;
-    private logger;
     constructor(config: HttpClientConfig);
-    /**
-     * Validate path parameter to prevent path traversal attacks
-     */
-    validatePathParam(param: string | number, paramName?: string): string;
     /**
      * Build full URL from endpoint
      */
@@ -116,25 +81,13 @@ declare class HttpClient {
      */
     buildQueryString(params: Record<string, string | number | boolean | undefined>): string;
     /**
-     * Sanitize data for logging by redacting sensitive fields
-     */
-    private sanitizeForLogging;
-    /**
-     * Calculate delay for retry with exponential backoff
-     */
-    private calculateRetryDelay;
-    /**
-     * Sleep for specified milliseconds
-     */
-    private sleep;
-    /**
-     * Perform HTTP request with automatic retry on transient failures
+     * Perform HTTP request
      */
     request<T>(method: string, endpoint: string, options?: {
         body?: unknown;
         headers?: Record<string, string>;
         params?: Record<string, string | number | boolean | undefined>;
-    }, retryAttempt?: number): Promise<T>;
+    }): Promise<T>;
     /**
      * GET request
      */

package/dist/{HttpClient-CdF3IHM1.d.ts → HttpClient-CLtgQGXH.d.ts}

@@ -33,22 +33,11 @@ declare class BearerTokenAuth implements AuthStrategy {
 /**
  * Session-based authentication (Platform/Admin APIs in browser)
  * Relies on HTTP-only cookies set by the server
- * Optionally supports CSRF token protection
  */
 declare class SessionAuth implements AuthStrategy {
     private sessionToken?;
     private onUnauthorized?;
-    private csrfToken?;
     constructor(sessionToken?: string | undefined, onUnauthorized?: (() => Promise<void>) | undefined);
-    /**
-     * Set CSRF token for cross-site request forgery protection
-     * The token should be obtained from the server after login
-     */
-    setCsrfToken(token: string): void;
-    /**
-     * Get current CSRF token
-     */
-    getCsrfToken(): string | undefined;
     injectAuth(headers: Headers): void;
     handleUnauthorized(): Promise<void>;
     getDescription(): string;
@@ -65,29 +54,12 @@ declare class NoAuth implements AuthStrategy {
  * Base HTTP client for Marvin APIs
  */
 
-interface RetryConfig {
-    /** Maximum number of retry attempts (default: 3) */
-    maxRetries: number;
-    /** Initial delay in ms before first retry (default: 1000) */
-    initialDelay: number;
-    /** Maximum delay in ms between retries (default: 10000) */
-    maxDelay: number;
-    /** HTTP status codes that should trigger a retry (default: [408, 429, 500, 502, 503, 504]) */
-    retryableStatuses: number[];
-}
 interface HttpClientConfig {
     baseUrl: string;
     auth: AuthStrategy;
     defaultHeaders?: Record<string, string>;
     credentials?: RequestCredentials;
     timeout?: number;
-    debug?: boolean;
-    retry?: Partial<RetryConfig>;
-    logger?: {
-        log: (message: string, ...args: unknown[]) => void;
-        warn: (message: string, ...args: unknown[]) => void;
-        error: (message: string, ...args: unknown[]) => void;
-    };
 }
 declare class HttpClient {
     private baseUrl;
@@ -95,14 +67,7 @@ declare class HttpClient {
     private defaultHeaders;
     private credentials;
     private timeout;
-    private debug;
-    private retryConfig;
-    private logger;
     constructor(config: HttpClientConfig);
-    /**
-     * Validate path parameter to prevent path traversal attacks
-     */
-    validatePathParam(param: string | number, paramName?: string): string;
     /**
      * Build full URL from endpoint
      */
@@ -116,25 +81,13 @@ declare class HttpClient {
      */
     buildQueryString(params: Record<string, string | number | boolean | undefined>): string;
     /**
-     * Sanitize data for logging by redacting sensitive fields
-     */
-    private sanitizeForLogging;
-    /**
-     * Calculate delay for retry with exponential backoff
-     */
-    private calculateRetryDelay;
-    /**
-     * Sleep for specified milliseconds
-     */
-    private sleep;
-    /**
-     * Perform HTTP request with automatic retry on transient failures
+     * Perform HTTP request
      */
     request<T>(method: string, endpoint: string, options?: {
         body?: unknown;
         headers?: Record<string, string>;
         params?: Record<string, string | number | boolean | undefined>;
-    }, retryAttempt?: number): Promise<T>;
+    }): Promise<T>;
     /**
      * GET request
      */