@inneropen/marvin-sdk 2.0.1 → 3.0.1

package/dist/platform.cjs

@@ -43,7 +43,8 @@ __export(platform_exports, {
   WebhooksModule: () => WebhooksModule,
   WorkspaceMembersModule: () => WorkspaceMembersModule,
   WorkspacesModule: () => WorkspacesModule,
-  createPlatformClient: () => createPlatformClient
+  createPlatformClient: () => createPlatformClient,
+  createPlatformConfigFromEnv: () => createPlatformConfigFromEnv
 });
 module.exports = __toCommonJS(platform_exports);
 
@@ -77,6 +78,49 @@ ${body}` : ""}`;
     return new _MarvinApiError(message, status, endpoint, body);
   }
 };
+var MarvinAuthError = class _MarvinAuthError extends MarvinError {
+  constructor(message, statusCode) {
+    super(message, "AUTH_ERROR", statusCode);
+    this.name = "MarvinAuthError";
+    Object.setPrototypeOf(this, _MarvinAuthError.prototype);
+  }
+};
+var MarvinValidationError = class _MarvinValidationError extends MarvinError {
+  constructor(message, field) {
+    super(message, "VALIDATION_ERROR");
+    this.field = field;
+    this.name = "MarvinValidationError";
+    Object.setPrototypeOf(this, _MarvinValidationError.prototype);
+  }
+  field;
+};
+var MarvinNotFoundError = class _MarvinNotFoundError extends MarvinError {
+  constructor(message, endpoint) {
+    super(message, "NOT_FOUND", 404);
+    this.endpoint = endpoint;
+    this.name = "MarvinNotFoundError";
+    Object.setPrototypeOf(this, _MarvinNotFoundError.prototype);
+  }
+  endpoint;
+};
+var MarvinNetworkError = class _MarvinNetworkError extends MarvinError {
+  constructor(message, originalError) {
+    super(message, "NETWORK_ERROR");
+    this.originalError = originalError;
+    this.name = "MarvinNetworkError";
+    Object.setPrototypeOf(this, _MarvinNetworkError.prototype);
+  }
+  originalError;
+};
+var MarvinServerError = class _MarvinServerError extends MarvinError {
+  constructor(message, statusCode, endpoint) {
+    super(message, "SERVER_ERROR", statusCode);
+    this.endpoint = endpoint;
+    this.name = "MarvinServerError";
+    Object.setPrototypeOf(this, _MarvinServerError.prototype);
+  }
+  endpoint;
+};
 
 // src/core/http/HttpClient.ts
 var HttpClient = class {
@@ -85,12 +129,47 @@ var HttpClient = class {
   defaultHeaders;
   credentials;
   timeout;
+  debug;
+  retryConfig;
+  logger;
   constructor(config) {
     this.baseUrl = config.baseUrl;
     this.auth = config.auth;
     this.defaultHeaders = config.defaultHeaders || {};
     this.credentials = config.credentials || "same-origin";
-    this.timeout = config.timeout || 3e4;
+    const MAX_TIMEOUT = 12e4;
+    this.timeout = Math.min(config.timeout || 3e4, MAX_TIMEOUT);
+    this.debug = config.debug ?? false;
+    this.logger = config.logger ?? console;
+    this.retryConfig = {
+      maxRetries: config.retry?.maxRetries ?? 3,
+      initialDelay: config.retry?.initialDelay ?? 1e3,
+      maxDelay: config.retry?.maxDelay ?? 1e4,
+      retryableStatuses: config.retry?.retryableStatuses ?? [408, 429, 500, 502, 503, 504]
+    };
+  }
+  /**
+   * Validate path parameter to prevent path traversal attacks
+   */
+  validatePathParam(param, paramName = "parameter") {
+    if (typeof param === "number") {
+      return String(param);
+    }
+    if (!param || typeof param !== "string") {
+      throw new MarvinValidationError(`Invalid ${paramName}: must be a non-empty string or number`);
+    }
+    if (param.includes("..") || param.includes("/") || param.includes("\\")) {
+      throw new MarvinValidationError(
+        `Invalid ${paramName}: cannot contain path traversal characters (.. / \\)`
+      );
+    }
+    if (param.includes("\0")) {
+      throw new MarvinValidationError(`Invalid ${paramName}: cannot contain null bytes`);
+    }
+    if (param.length > 255) {
+      throw new MarvinValidationError(`Invalid ${paramName}: exceeds maximum length of 255 characters`);
+    }
+    return param;
   }
   /**
    * Build full URL from endpoint
@@ -124,14 +203,78 @@ var HttpClient = class {
     return filtered.length > 0 ? `?${filtered.join("&")}` : "";
   }
   /**
-   * Perform HTTP request
+   * Sanitize data for logging by redacting sensitive fields
+   */
+  sanitizeForLogging(data) {
+    if (!data || typeof data !== "object") {
+      return data;
+    }
+    const sensitiveFields = [
+      "token",
+      "access_token",
+      "refresh_token",
+      "password",
+      "secret",
+      "apiKey",
+      "api_key",
+      "bearer",
+      "authorization",
+      "csrf_token",
+      "session",
+      "cookie"
+    ];
+    const sanitize = (obj) => {
+      const sanitized = {};
+      for (const [key, value] of Object.entries(obj)) {
+        const keyLower = key.toLowerCase();
+        const isSensitive = sensitiveFields.some((field) => keyLower.includes(field));
+        if (isSensitive) {
+          sanitized[key] = "[REDACTED]";
+        } else if (value && typeof value === "object" && !Array.isArray(value)) {
+          sanitized[key] = sanitize(value);
+        } else if (Array.isArray(value)) {
+          sanitized[key] = value.map(
+            (item) => item && typeof item === "object" ? sanitize(item) : item
+          );
+        } else {
+          sanitized[key] = value;
+        }
+      }
+      return sanitized;
+    };
+    if (Array.isArray(data)) {
+      return data.map(
+        (item) => item && typeof item === "object" ? sanitize(item) : item
+      );
+    }
+    return sanitize(data);
+  }
+  /**
+   * Calculate delay for retry with exponential backoff
    */
-  async request(method, endpoint, options) {
+  calculateRetryDelay(attempt) {
+    const delay = this.retryConfig.initialDelay * Math.pow(2, attempt);
+    return Math.min(delay, this.retryConfig.maxDelay);
+  }
+  /**
+   * Sleep for specified milliseconds
+   */
+  sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+  }
+  /**
+   * Perform HTTP request with automatic retry on transient failures
+   */
+  async request(method, endpoint, options, retryAttempt = 0) {
     const url = this.buildUrl(endpoint) + (options?.params ? this.buildQueryString(options.params) : "");
     const isFormData = options?.body instanceof FormData;
     const headers = this.buildHeaders(options?.headers, isFormData);
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), this.timeout);
+    const startTime = Date.now();
+    if (this.debug) {
+      this.logger.log(`[Marvin] ${method} ${url}`);
+    }
     try {
       const response = await fetch(url, {
         method,
@@ -141,11 +284,54 @@ var HttpClient = class {
         signal: controller.signal
       });
       clearTimeout(timeoutId);
+      const duration = Date.now() - startTime;
+      if (this.debug) {
+        this.logger.log(
+          `[Marvin] ${response.status} ${response.statusText} (${duration}ms)`
+        );
+      }
       if (response.status === 401 && this.auth.handleUnauthorized) {
         await this.auth.handleUnauthorized();
       }
       if (!response.ok) {
         const errorText = await response.text().catch(() => "");
+        if (this.debug) {
+          this.logger.error(
+            `[Marvin] Error response: ${response.status} ${response.statusText}`,
+            errorText ? `Body: ${errorText}` : ""
+          );
+        }
+        const isRetryable = this.retryConfig.retryableStatuses.includes(response.status);
+        const canRetry = retryAttempt < this.retryConfig.maxRetries;
+        if (isRetryable && canRetry) {
+          const delay = this.calculateRetryDelay(retryAttempt);
+          if (this.debug) {
+            this.logger.warn(
+              `[Marvin] Retry ${retryAttempt + 1}/${this.retryConfig.maxRetries} after ${delay}ms (status: ${response.status})`
+            );
+          }
+          await this.sleep(delay);
+          return this.request(method, endpoint, options, retryAttempt + 1);
+        }
+        if (response.status === 404) {
+          throw new MarvinNotFoundError(
+            `Resource not found: ${endpoint}`,
+            endpoint
+          );
+        }
+        if (response.status === 401 || response.status === 403) {
+          throw new MarvinAuthError(
+            `Authentication failed: ${response.statusText}`,
+            response.status
+          );
+        }
+        if (response.status >= 500) {
+          throw new MarvinServerError(
+            `Server error: ${response.status} ${response.statusText}`,
+            response.status,
+            endpoint
+          );
+        }
         throw MarvinApiError.fromResponse(
           response.status,
           response.statusText,
@@ -157,21 +343,39 @@ var HttpClient = class {
       if (!contentType || !contentType.includes("application/json")) {
         return void 0;
       }
-      return await response.json();
+      const data = await response.json();
+      if (this.debug) {
+        const sanitized = this.sanitizeForLogging(data);
+        this.logger.log("[Marvin] Response:", JSON.stringify(sanitized, null, 2));
+      }
+      return data;
     } catch (error) {
       clearTimeout(timeoutId);
-      if (error instanceof MarvinApiError) {
+      if (error instanceof MarvinApiError || error instanceof MarvinNotFoundError || error instanceof MarvinAuthError || error instanceof MarvinServerError) {
         throw error;
       }
       if (error instanceof Error) {
+        const canRetry = retryAttempt < this.retryConfig.maxRetries;
+        if (canRetry && error.name !== "AbortError") {
+          const delay = this.calculateRetryDelay(retryAttempt);
+          if (this.debug) {
+            this.logger.warn(
+              `[Marvin] Retry ${retryAttempt + 1}/${this.retryConfig.maxRetries} after ${delay}ms (network error)`
+            );
+          }
+          await this.sleep(delay);
+          return this.request(method, endpoint, options, retryAttempt + 1);
+        }
         if (error.name === "AbortError") {
-          throw new MarvinApiError(
+          throw new MarvinNetworkError(
             `Request timeout after ${this.timeout}ms`,
-            408,
-            endpoint
+            error
           );
         }
-        throw new MarvinApiError(error.message, 0, endpoint);
+        throw new MarvinNetworkError(
+          `Network error: ${error.message}`,
+          error
+        );
       }
       throw error;
     }
@@ -216,10 +420,27 @@ var SessionAuth = class {
   }
   sessionToken;
   onUnauthorized;
+  csrfToken;
+  /**
+   * Set CSRF token for cross-site request forgery protection
+   * The token should be obtained from the server after login
+   */
+  setCsrfToken(token) {
+    this.csrfToken = token;
+  }
+  /**
+   * Get current CSRF token
+   */
+  getCsrfToken() {
+    return this.csrfToken;
+  }
   injectAuth(headers) {
     if (this.sessionToken) {
       headers.set("Authorization", `Bearer ${this.sessionToken}`);
     }
+    if (this.csrfToken) {
+      headers.set("X-CSRF-Token", this.csrfToken);
+    }
   }
   async handleUnauthorized() {
     if (this.onUnauthorized) {
@@ -227,7 +448,9 @@ var SessionAuth = class {
     }
   }
   getDescription() {
-    return this.sessionToken ? "Session authentication (explicit token)" : "Session authentication (cookies)";
+    const auth = this.sessionToken ? "Session authentication (explicit token)" : "Session authentication (cookies)";
+    const csrf = this.csrfToken ? " with CSRF protection" : "";
+    return auth + csrf;
   }
 };
 
@@ -247,7 +470,8 @@ var EntriesModule = class {
    * Get a single entry by ID
    */
   async get(id) {
-    return this.http.get(`/api/platform/entries/${id}`);
+    const validId = this.http.validatePathParam(id, "entry ID");
+    return this.http.get(`/api/platform/entries/${validId}`);
   }
   /**
    * Create a new entry
@@ -259,26 +483,31 @@ var EntriesModule = class {
    * Update an entry
    */
   async update(id, data) {
-    return this.http.patch(`/api/platform/entries/${id}`, data);
+    const validId = this.http.validatePathParam(id, "entry ID");
+    return this.http.patch(`/api/platform/entries/${validId}`, data);
   }
   /**
    * Delete an entry
    */
   async delete(id) {
-    return this.http.delete(`/api/platform/entries/${id}`);
+    const validId = this.http.validatePathParam(id, "entry ID");
+    return this.http.delete(`/api/platform/entries/${validId}`);
   }
   /**
    * Get collections that this entry belongs to
    */
   async listCollections(entryId) {
-    return this.http.get(`/api/platform/entries/${entryId}/collections`);
+    const validId = this.http.validatePathParam(entryId, "entry ID");
+    return this.http.get(`/api/platform/entries/${validId}/collections`);
   }
   /**
    * Add entry to a collection
    */
   async addToCollection(entryId, collectionId) {
+    const validEntryId = this.http.validatePathParam(entryId, "entry ID");
+    const validCollectionId = this.http.validatePathParam(collectionId, "collection ID");
     return this.http.post(
-      `/api/platform/entries/${entryId}/collections/${collectionId}`,
+      `/api/platform/entries/${validEntryId}/collections/${validCollectionId}`,
       {}
     );
   }
@@ -286,7 +515,9 @@ var EntriesModule = class {
    * Remove entry from a collection
    */
   async removeFromCollection(entryId, collectionId) {
-    return this.http.delete(`/api/platform/entries/${entryId}/collections/${collectionId}`);
+    const validEntryId = this.http.validatePathParam(entryId, "entry ID");
+    const validCollectionId = this.http.validatePathParam(collectionId, "collection ID");
+    return this.http.delete(`/api/platform/entries/${validEntryId}/collections/${validCollectionId}`);
   }
 };
 
@@ -306,7 +537,8 @@ var CollectionsModule = class {
    * Get a single collection by ID
    */
   async get(id) {
-    return this.http.get(`/api/platform/collections/${id}`);
+    const validId = this.http.validatePathParam(id, "id");
+    return this.http.get(`/api/platform/collections/${validId}`);
   }
   /**
    * Create a new collection
@@ -318,25 +550,29 @@ var CollectionsModule = class {
    * Update a collection
    */
   async update(id, data) {
-    return this.http.patch(`/api/platform/collections/${id}`, data);
+    const validId = this.http.validatePathParam(id, "id");
+    return this.http.patch(`/api/platform/collections/${validId}`, data);
   }
   /**
    * Delete a collection
    */
   async delete(id) {
-    return this.http.delete(`/api/platform/collections/${id}`);
+    const validId = this.http.validatePathParam(id, "collection ID");
+    return this.http.delete(`/api/platform/collections/${validId}`);
   }
   /**
    * Get entries in a collection
    */
   async getEntries(id) {
-    return this.http.get(`/api/platform/collections/${id}/entries`);
+    const validId = this.http.validatePathParam(id, "collection ID");
+    return this.http.get(`/api/platform/collections/${validId}/entries`);
   }
   /**
    * Reorder entries in a collection
    */
   async reorderEntries(id, entries) {
-    return this.http.patch(`/api/platform/collections/${id}/entries/order`, { entries });
+    const validId = this.http.validatePathParam(id, "collection ID");
+    return this.http.patch(`/api/platform/collections/${validId}/entries/order`, { entries });
   }
 };
 
@@ -356,7 +592,8 @@ var ResourcesModule = class {
    * Get a single resource by ID
    */
   async get(id) {
-    return this.http.get(`/api/platform/resources/${id}`);
+    const validId = this.http.validatePathParam(id, "id");
+    return this.http.get(`/api/platform/resources/${validId}`);
   }
   /**
    * Create a new resource
@@ -368,7 +605,8 @@ var ResourcesModule = class {
    * Update a resource
    */
   async update(id, data) {
-    return this.http.patch(`/api/platform/resources/${id}`, data);
+    const validId = this.http.validatePathParam(id, "id");
+    return this.http.patch(`/api/platform/resources/${validId}`, data);
   }
   /**
    * Delete a resource
@@ -390,6 +628,47 @@ var AssetsModule = class {
     this.http = http;
   }
   http;
+  /**
+   * Validate file before upload
+   */
+  validateFile(file, options) {
+    const maxSize = options?.maxFileSize || 100 * 1024 * 1024;
+    const allowedTypes = options?.allowedMimeTypes;
+    if (file.size === 0) {
+      throw new MarvinValidationError("File is empty");
+    }
+    if (file.size > maxSize) {
+      const maxMB = Math.round(maxSize / (1024 * 1024));
+      const fileMB = Math.round(file.size / (1024 * 1024));
+      throw new MarvinValidationError(
+        `File size (${fileMB}MB) exceeds maximum allowed size of ${maxMB}MB`
+      );
+    }
+    if (allowedTypes && allowedTypes.length > 0) {
+      if (file instanceof File && file.type) {
+        const isAllowed = allowedTypes.some((allowed) => {
+          if (allowed.endsWith("/*")) {
+            const prefix = allowed.slice(0, -2);
+            return file.type.startsWith(prefix);
+          }
+          return file.type === allowed;
+        });
+        if (!isAllowed) {
+          throw new MarvinValidationError(
+            `File type "${file.type}" is not allowed. Allowed types: ${allowedTypes.join(", ")}`
+          );
+        }
+      }
+    }
+    if (file instanceof File) {
+      if (!file.name || file.name.trim().length === 0) {
+        throw new MarvinValidationError("File must have a valid name");
+      }
+      if (file.name.includes("..") || file.name.includes("/") || file.name.includes("\\")) {
+        throw new MarvinValidationError("Invalid filename: cannot contain path separators");
+      }
+    }
+  }
   /**
    * List all assets
    */
@@ -400,16 +679,31 @@ var AssetsModule = class {
    * Get a single asset by ID
    */
   async get(id) {
-    return this.http.get(`/api/platform/assets/${id}`);
+    const validId = this.http.validatePathParam(id, "id");
+    return this.http.get(`/api/platform/assets/${validId}`);
   }
   /**
    * Upload a new asset file
    *
    * @param file - The file to upload (File or Blob)
    * @param metadata - Asset metadata (slug, name, altText, description, metadata)
+   * @param options - Upload options (file size limits, allowed types)
    * @returns The created asset with extracted metadata
+   *
+   * @example
+   * ```typescript
+   * // Upload with default limits (100MB, all types)
+   * const asset = await assets.upload(file, { slug: 'my-image', name: 'My Image' });
+   *
+   * // Upload with restrictions
+   * const asset = await assets.upload(file,
+   *   { slug: 'avatar', name: 'Avatar' },
+   *   { maxFileSize: 5 * 1024 * 1024, allowedMimeTypes: ['image/*'] }
+   * );
+   * ```
    */
-  async upload(file, metadata) {
+  async upload(file, metadata, options) {
+    this.validateFile(file, options);
     const formData = new FormData();
     formData.append("file", file);
     formData.append("slug", metadata.slug);
@@ -429,13 +723,24 @@ var AssetsModule = class {
    * Update an asset (editable fields only: slug, name, altText, description, metadata)
    */
   async update(id, data) {
-    return this.http.patch(`/api/platform/assets/${id}`, data);
+    const validId = this.http.validatePathParam(id, "id");
+    return this.http.patch(`/api/platform/assets/${validId}`, data);
   }
   /**
    * Delete an asset (removes file from storage and database)
    */
   async delete(id) {
-    return this.http.delete(`/api/platform/assets/${id}`);
+    const validId = this.http.validatePathParam(id, "asset ID");
+    return this.http.delete(`/api/platform/assets/${validId}`);
+  }
+  /**
+   * Get download URL for an asset file
+   * Use this to create download links or fetch the file directly
+   */
+  getDownloadUrl(id, baseUrl) {
+    const validId = this.http.validatePathParam(id, "asset ID");
+    const base = baseUrl || (typeof window !== "undefined" && window.location ? window.location.origin : "");
+    return `${base}/api/platform/assets/${validId}/file`;
   }
 };
 
@@ -455,7 +760,8 @@ var APIClientsModule = class {
    * Get a single API client by ID
    */
   async get(id) {
-    return this.http.get(`/api/platform/api-clients/${id}`);
+    const validId = this.http.validatePathParam(id, "id");
+    return this.http.get(`/api/platform/api-clients/${validId}`);
   }
   /**
    * Create a new API client (returns client with token)
@@ -467,7 +773,8 @@ var APIClientsModule = class {
    * Update an API client
    */
   async update(id, data) {
-    return this.http.patch(`/api/platform/api-clients/${id}`, data);
+    const validId = this.http.validatePathParam(id, "id");
+    return this.http.patch(`/api/platform/api-clients/${validId}`, data);
   }
   /**
    * Delete an API client
@@ -631,6 +938,15 @@ var WorkspacesModule = class {
     const url = `/api/admin/groups/${id}${force ? "?force=true" : ""}`;
     await this.http.delete(url);
   }
+  /**
+   * Export workspace data as JSON (collections, entry types, entries, site config)
+   */
+  async export(options) {
+    const pretty = options?.pretty ?? true;
+    const endpoint = pretty ? "/api/platform/workspace/export/pretty" : "/api/platform/workspace/export";
+    const params = options?.includeSystemTypes ? { include_system_types: true } : void 0;
+    return this.http.get(endpoint, params);
+  }
   /**
    * Get workspace preferences
    */
@@ -646,6 +962,12 @@ var WorkspacesModule = class {
 };
 
 // src/platform/invites.ts
+function getEnv(key) {
+  if (typeof process !== "undefined" && process.env) {
+    return process.env[key];
+  }
+  return void 0;
+}
 var InvitesModule = class {
   constructor(http) {
     this.http = http;
@@ -678,27 +1000,47 @@ var InvitesModule = class {
   }
   /**
    * Generate invitation URL from a token
-   * Uses MARVIN_FRONTEND_URL for the base URL, falls back to MARVIN_API_URL with common port mappings
+   *
+   * @param token - Invitation token
+   * @param baseUrl - Base URL for the frontend (required in browser environments)
+   * @returns Full invitation URL
+   *
+   * @example
+   * ```typescript
+   * // Node.js (can use env vars)
+   * const url = invites.getInvitationUrl(token);
+   *
+   * // Browser (must provide baseUrl)
+   * const url = invites.getInvitationUrl(token, 'https://app.example.com');
+   * ```
    */
   getInvitationUrl(token, baseUrl) {
     let base = baseUrl;
     if (!base) {
-      base = process.env.MARVIN_FRONTEND_URL;
-      if (!base && process.env.MARVIN_API_URL) {
-        const apiUrl = process.env.MARVIN_API_URL;
-        if (apiUrl.includes(":8080")) {
-          base = apiUrl.replace(":8080", ":4321");
-        } else if (apiUrl.includes(":3000")) {
-          base = apiUrl.replace(":3000", ":4321");
-        } else {
-          base = apiUrl;
+      base = getEnv("MARVIN_FRONTEND_URL");
+      if (!base) {
+        const apiUrl = getEnv("MARVIN_API_URL");
+        if (apiUrl) {
+          if (apiUrl.includes(":8080")) {
+            base = apiUrl.replace(":8080", ":4321");
+          } else if (apiUrl.includes(":3000")) {
+            base = apiUrl.replace(":3000", ":4321");
+          } else {
+            base = apiUrl;
+          }
         }
       }
-      if (!base) {
-        base = "http://localhost:4321";
+    }
+    if (!base) {
+      if (typeof window !== "undefined" && window.location) {
+        base = window.location.origin;
+      } else {
+        throw new Error(
+          'baseUrl is required when not in Node.js environment. Pass the frontend URL as second argument: getInvitationUrl(token, "https://app.example.com")'
+        );
       }
     }
-    return `${base}/register?token=${token}`;
+    return `${base}/register?token=${encodeURIComponent(token)}`;
   }
 };
 
@@ -752,6 +1094,57 @@ var WebhooksModule = class {
     this.http = http;
   }
   http;
+  /**
+   * Validate webhook URL to prevent SSRF attacks
+   */
+  validateWebhookUrl(url) {
+    if (!url || typeof url !== "string") {
+      throw new MarvinValidationError("Webhook URL is required and must be a string");
+    }
+    let parsed;
+    try {
+      parsed = new URL(url);
+    } catch {
+      throw new MarvinValidationError("Invalid webhook URL format. Expected: https://example.com/webhook");
+    }
+    if (!["http:", "https:"].includes(parsed.protocol)) {
+      throw new MarvinValidationError(
+        `Webhook URL must use HTTP or HTTPS protocol. Got: ${parsed.protocol}`
+      );
+    }
+    const hostname = parsed.hostname.toLowerCase();
+    const blockedHosts = [
+      "localhost",
+      "127.0.0.1",
+      "0.0.0.0",
+      "::1",
+      "169.254.169.254",
+      // AWS metadata service
+      "[::]"
+    ];
+    if (blockedHosts.some((blocked) => hostname === blocked || hostname.includes(blocked))) {
+      throw new MarvinValidationError(
+        "Webhook URL cannot target localhost or internal network addresses"
+      );
+    }
+    const ipv4Regex = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
+    const match = hostname.match(ipv4Regex);
+    if (match) {
+      const octets = match.slice(1).map(Number);
+      if (octets[0] === 10) {
+        throw new MarvinValidationError("Webhook URL cannot target private IP range (10.x.x.x)");
+      }
+      if (octets[0] === 172 && octets[1] >= 16 && octets[1] <= 31) {
+        throw new MarvinValidationError("Webhook URL cannot target private IP range (172.16-31.x.x)");
+      }
+      if (octets[0] === 192 && octets[1] === 168) {
+        throw new MarvinValidationError("Webhook URL cannot target private IP range (192.168.x.x)");
+      }
+    }
+    if (url.length > 2048) {
+      throw new MarvinValidationError("Webhook URL exceeds maximum length of 2048 characters");
+    }
+  }
   /**
    * List all webhooks for the current workspace
    */
@@ -763,31 +1156,43 @@ var WebhooksModule = class {
    * Get a webhook by ID
    */
   async get(id) {
-    return this.http.get(`/api/groups/webhooks/${id}`);
+    const validId = this.http.validatePathParam(id, "webhook ID");
+    return this.http.get(`/api/groups/webhooks/${validId}`);
   }
   /**
    * Create a new webhook
+   * Validates URL to prevent SSRF attacks
    */
   async create(data) {
+    if (data.url) {
+      this.validateWebhookUrl(data.url);
+    }
     return this.http.post("/api/groups/webhooks", data);
   }
   /**
    * Update a webhook
+   * Validates URL if provided to prevent SSRF attacks
    */
   async update(id, data) {
-    return this.http.put(`/api/groups/webhooks/${id}`, data);
+    const validId = this.http.validatePathParam(id, "webhook ID");
+    if (data.url) {
+      this.validateWebhookUrl(data.url);
+    }
+    return this.http.put(`/api/groups/webhooks/${validId}`, data);
   }
   /**
    * Delete a webhook
    */
   async delete(id) {
-    await this.http.delete(`/api/groups/webhooks/${id}`);
+    const validId = this.http.validatePathParam(id, "webhook ID");
+    await this.http.delete(`/api/groups/webhooks/${validId}`);
   }
   /**
    * Test a webhook
    */
   async test(id) {
-    return this.http.post(`/api/groups/webhooks/${id}/test`, {});
+    const validId = this.http.validatePathParam(id, "webhook ID");
+    return this.http.post(`/api/groups/webhooks/${validId}/test`, {});
   }
   /**
    * Rerun failed webhooks
@@ -879,6 +1284,7 @@ var AdminSystemModule = class {
   }
   /**
    * Update email settings
+   * Note: Password field is write-only and will not be returned in response
    */
   async updateEmailSettings(data) {
     return this.http.put("/api/admin/email", data);
@@ -1162,53 +1568,40 @@ var EmailTemplatesClient = class {
   http;
   /**
    * List all email templates for the workspace
-   * @param groupId - Workspace ID
    */
   async list(groupId) {
     return this.http.get(`/api/platform/workspaces/${groupId}/email-templates`);
   }
   /**
    * Get a specific email template
-   * @param groupId - Workspace ID
-   * @param templateId - Template ID
    */
   async get(groupId, templateId) {
     return this.http.get(`/api/platform/workspaces/${groupId}/email-templates/${templateId}`);
   }
   /**
    * Create a new email template
-   * @param groupId - Workspace ID
-   * @param data - Template data
    */
   async create(groupId, data) {
     return this.http.post(`/api/platform/workspaces/${groupId}/email-templates`, data);
   }
   /**
    * Update an email template
-   * @param groupId - Workspace ID
-   * @param templateId - Template ID
-   * @param data - Updated template data
    */
   async update(groupId, templateId, data) {
     return this.http.patch(`/api/platform/workspaces/${groupId}/email-templates/${templateId}`, data);
   }
   /**
    * Delete an email template
-   * @param groupId - Workspace ID
-   * @param templateId - Template ID
    */
   async delete(groupId, templateId) {
     await this.http.delete(`/api/platform/workspaces/${groupId}/email-templates/${templateId}`);
   }
   /**
    * Send a test email using a template
-   * @param groupId - Workspace ID
-   * @param templateId - Template ID
-   * @param recipientEmail - Test recipient email address
    */
   async sendTest(groupId, templateId, recipientEmail) {
     return this.http.post(`/api/platform/workspaces/${groupId}/email-templates/${templateId}/test`, {
-      recipient_email: recipientEmail
+      email: recipientEmail
     });
   }
 };
@@ -1229,7 +1622,8 @@ var ScheduledTasksModule = class {
    * Get a scheduled task by ID or slug
    */
   async get(idOrSlug) {
-    return this.http.get(`/api/platform/scheduled-tasks/${idOrSlug}`);
+    const validIdOrSlug = this.http.validatePathParam(idOrSlug, "idOrSlug");
+    return this.http.get(`/api/platform/scheduled-tasks/${validIdOrSlug}`);
   }
   /**
    * Create a new scheduled task
@@ -1241,7 +1635,8 @@ var ScheduledTasksModule = class {
    * Update a scheduled task
    */
   async update(idOrSlug, data) {
-    return this.http.patch(`/api/platform/scheduled-tasks/${idOrSlug}`, data);
+    const validIdOrSlug = this.http.validatePathParam(idOrSlug, "idOrSlug");
+    return this.http.patch(`/api/platform/scheduled-tasks/${validIdOrSlug}`, data);
   }
   /**
    * Delete a scheduled task
@@ -1287,6 +1682,34 @@ var FormsModule = class {
     this.http = http;
   }
   http;
+  /**
+   * Validate form submission data
+   * - Prevents XSS by checking for script tags
+   * - Validates data is a proper object
+   * - Checks for reasonable size limits
+   */
+  validateFormData(data) {
+    if (!data || typeof data !== "object") {
+      throw new MarvinValidationError("Form data must be a valid object");
+    }
+    const jsonString = JSON.stringify(data);
+    const sizeInBytes = new Blob([jsonString]).size;
+    if (sizeInBytes > 1024 * 1024) {
+      throw new MarvinValidationError("Form data exceeds maximum size of 1MB");
+    }
+    const checkForScripts = (value) => {
+      if (typeof value === "string") {
+        if (/<script[\s\S]*?>[\s\S]*?<\/script>/gi.test(value)) {
+          throw new MarvinValidationError("Form data contains potentially malicious content");
+        }
+      } else if (Array.isArray(value)) {
+        value.forEach(checkForScripts);
+      } else if (value && typeof value === "object") {
+        Object.values(value).forEach(checkForScripts);
+      }
+    };
+    Object.values(data).forEach(checkForScripts);
+  }
   /**
    * List all forms
    */
@@ -1297,7 +1720,8 @@ var FormsModule = class {
    * Get a single form by ID
    */
   async get(id) {
-    return this.http.get(`/api/platform/forms/${id}`);
+    const validId = this.http.validatePathParam(id, "id");
+    return this.http.get(`/api/platform/forms/${validId}`);
   }
   /**
    * Create a new form
@@ -1309,7 +1733,8 @@ var FormsModule = class {
    * Update a form
    */
   async update(id, data) {
-    return this.http.patch(`/api/platform/forms/${id}`, data);
+    const validId = this.http.validatePathParam(id, "id");
+    return this.http.patch(`/api/platform/forms/${validId}`, data);
   }
   /**
    * Delete a form
@@ -1331,15 +1756,31 @@ var FormsModule = class {
   }
   /**
    * Submit data to a published form (Publishing API - public access)
+   * Validates data before submission to prevent XSS and malicious content
    */
   async submitForm(slug, data) {
-    return this.http.post(`/api/publish/forms/${slug}/submit`, {
+    const validSlug = this.http.validatePathParam(slug, "form slug");
+    this.validateFormData(data);
+    return this.http.post(`/api/publish/forms/${validSlug}/submit`, {
       dataJson: data
     });
   }
 };
 
 // src/platform/client.ts
+function getEnv2(key) {
+  if (typeof process !== "undefined" && process.env) {
+    return process.env[key];
+  }
+  return void 0;
+}
+function createPlatformConfigFromEnv(overrides) {
+  return {
+    apiUrl: overrides?.apiUrl || getEnv2("MARVIN_API_URL") || "http://localhost:8080",
+    userToken: overrides?.userToken || getEnv2("MARVIN_USER_TOKEN"),
+    credentials: overrides?.credentials || "include"
+  };
+}
 var PlatformClient = class extends HttpClient {
   entries;
   collections;
@@ -1366,7 +1807,7 @@ var PlatformClient = class extends HttpClient {
   adminMaintenance;
   constructor(config) {
     const httpConfig = {
-      baseUrl: config.apiUrl,
+      baseUrl: config.apiUrl || "http://localhost:8080",
       auth: new SessionAuth(config.userToken),
       credentials: config.credentials || "include"
     };
@@ -1396,7 +1837,8 @@ var PlatformClient = class extends HttpClient {
   }
 };
 function createPlatformClient(config) {
-  return new PlatformClient(config);
+  const finalConfig = createPlatformConfigFromEnv(config);
+  return new PlatformClient(finalConfig);
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
@@ -1423,5 +1865,6 @@ function createPlatformClient(config) {
   WebhooksModule,
   WorkspaceMembersModule,
   WorkspacesModule,
-  createPlatformClient
+  createPlatformClient,
+  createPlatformConfigFromEnv
 });