npm - @intlayer/api - Versions diffs - 9.3.3 → 9.4.0 - Mend

@intlayer/api 9.3.3 → 9.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (337) hide show

package/README.md CHANGED Viewed

@@ -214,6 +214,7 @@ Explore our comprehensive documentation to get started with Intlayer and learn h
   <li><a href="https://intlayer.org/doc/environment/vite-and-vue" rel=''>Vite + Vue</a></li>
   <li><a href="https://intlayer.org/doc/environment/nuxt-and-vue" rel=''>Vite + Nuxt</a></li>
   <li><a href="https://intlayer.org/doc/environment/vite-and-solid" rel=''>Vite + Solid</a></li>
+  <li><a href="https://intlayer.org/doc/environment/solid-start" rel=''>Solid Start</a></li>
   <li><a href="https://intlayer.org/doc/environment/angular" rel=''>Angular</a></li>
   <li>
      <a href="https://intlayer.org/doc/environment/express" rel=''>Backend</a>
@@ -223,7 +224,9 @@ Explore our comprehensive documentation to get started with Intlayer and learn h
       <li><a href="https://intlayer.org/doc/environment/fastify" rel=''>Fastify</a></li>
       <li><a href="https://intlayer.org/doc/environment/adonisjs" rel=''>AdonisJS</a></li>
       <li><a href="https://intlayer.org/doc/environment/hono" rel=''>Hono</a></li>
+      <li><a href="https://intlayer.org/doc/environment/elysia" rel=''>Elysia</a></li>
     </ul>
   </li>
 </ul>
 </details>
@@ -327,4 +330,4 @@ Contribute on [GitHub](https://github.com/aymericzip/intlayer), [GitLab](https:/
 If you like Intlayer, give us a ⭐ on GitHub. It helps others discover the project! [See why GitHub Stars matter](https://github.com/aymericzip/intlayer/blob/main/CONTRIBUTING.md#why-github-stars-matter-).
-[![Star History Chart](https://api.star-history.com/svg?repos=aymericzip/intlayer&type=Date)](https://star-history.com/#aymericzip/intlayer&Date)
+[![Star History Chart](https://star-history.dera.page/svg?repos=aymericzip/intlayer&type=Date)](https://star-history.dera.page/#aymericzip/intlayer&Date)

package/dist/cjs/cms/createAuthManager.cjs CHANGED Viewed

@@ -1,10 +1,13 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_getIntlayerAPI_oAuth = require('../getIntlayerAPI/oAuth.cjs');
 let _intlayer_config_built = require("@intlayer/config/built");
+let _intlayer_config_secrets = require("@intlayer/config/secrets");
 let defu = require("defu");
 //#region src/cms/createAuthManager.ts
 const ONE_MINUTE_MS = 6e4;
+/** Whether the current runtime is a browser rather than a server. */
+const isBrowser = () => typeof window !== "undefined";
 /**
 * Resolves the expiration timestamp (in ms since epoch) from an OAuth2
 * token-like payload, supporting both absolute dates and relative durations.
@@ -32,7 +35,10 @@ const getExpiryTimestamp = (token) => {
 */
 const createAuthManager = (intlayerConfig = { editor: _intlayer_config_built.editor }, options = {}) => {
 	const { baseFetcherOptions = {}, sessionToken } = options;
-	const resolvedConfig = (0, defu.defu)(intlayerConfig ?? {}, { editor: _intlayer_config_built.editor });
+	const resolvedConfig = (0, defu.defu)(intlayerConfig ?? {}, { editor: {
+		..._intlayer_config_built.editor,
+		clientSecret: _intlayer_config_built.editor?.clientId ? (0, _intlayer_config_secrets.getEditorClientSecret)() : void 0
+	} });
 	const fetcherOptions = {
 		...baseFetcherOptions,
 		credentials: "omit"
@@ -78,6 +84,9 @@ const createAuthManager = (intlayerConfig = { editor: _intlayer_config_built.edi
 		expiryTimestamp = void 0;
 	};
 	const withAuth = (method, skipAuth = !hasCredentials) => {
+		if (skipAuth && !sessionToken && isBrowser()) return async () => {
+			throw new Error("Intlayer CMS credentials are not available in the browser. `clientSecret` is a server-side credential and is never bundled. Call this from a server route, or pass a user session token: createIntlayerCMS(config, { sessionToken }).");
+		};
 		if (skipAuth) return method;
 		return async (...args) => {
 			await ensureAuth();

package/dist/cjs/cms/createAuthManager.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"createAuthManager.cjs","names":["getOAuthAPI"],"sources":["../../../src/cms/createAuthManager.ts"],"sourcesContent":["import { editor } from '@intlayer/config/built';\nimport type { IntlayerConfig } from '@intlayer/types/config';\nimport { defu } from 'defu';\nimport type { FetcherOptions } from '../fetcher';\nimport { getOAuthAPI } from '../getIntlayerAPI/oAuth';\n\n/*\n Shape of the various OAuth2 token payloads the backend may return. Only the\n * fields used to derive the expiration timestamp are described here.\n /\ntype OAuthTokenLike = {\n accessToken?: string;\n accessTokenExpiresAt?: string \| Date;\n expires_in?: number;\n expiresIn?: number;\n expiresAt?: string \| Date;\n};\n\n/\n Any asynchronous API method exposed by a domain section\n * (e.g. `getDictionaries`, `pushDictionaries`).\n /\ntype AsyncMethod<Arguments extends unknown[], Result> = (\n ...args: Arguments\n) => Promise<Result>;\n\n/\n A domain section factory: builds a plain object of async methods from shared\n * fetcher options and the Intlayer configuration.\n /\ntype SectionFactory<Section extends Record<string, unknown>> = (\n fetcherOptions: FetcherOptions,\n intlayerConfig: IntlayerConfig\n) => Section;\n\nconst ONE_MINUTE_MS = 60_000;\n\n/\n Resolves the expiration timestamp (in ms since epoch) from an OAuth2\n * token-like payload, supporting both absolute dates and relative durations.\n /\nconst getExpiryTimestamp = (\n token: OAuthTokenLike \| undefined\n): number \| undefined => {\n if (!token) return undefined;\n\n const dateLike = (token.accessTokenExpiresAt ?? token.expiresAt) as\n \| string\n \| Date\n \| undefined;\n\n if (dateLike) {\n const timestamp =\n typeof dateLike === 'string'\n ? Date.parse(dateLike)\n : dateLike.getTime?.();\n if (typeof timestamp === 'number' && Number.isFinite(timestamp)) {\n return timestamp;\n }\n }\n\n const seconds = token.expires_in ?? token.expiresIn;\n if (typeof seconds === 'number' && Number.isFinite(seconds)) {\n return Date.now() + seconds 1000;\n }\n\n return undefined;\n};\n\n/*\n Options accepted when creating an {@link AuthManager}.\n /\nexport type AuthManagerOptions = {\n /\n Base fetcher options merged into every request (e.g. custom headers).\n /\n baseFetcherOptions?: FetcherOptions;\n /\n A pre-issued CLI session token (prefixed with `clisession_`). When provided,\n * it is used directly as the Bearer token and the OAuth2 `client_credentials`\n * exchange is skipped entirely.\n /\n sessionToken?: string;\n};\n\n/\n Options accepted when binding a domain section to an {@link AuthManager}.\n /\nexport type BindSectionOptions = {\n /\n Forces auth injection on (`false`) or off (`true`). Defaults to enabled\n * whenever credentials are available.\n /\n skipAuth?: boolean;\n};\n\n/\n Manages CMS authentication for a set of API calls.\n \n The manager owns a single mutable {@link FetcherOptions} object\n * (`fetcherOptions`). Domain factories bound through it share the same\n * reference, so refreshing the token in place transparently authenticates every\n * call — without rebuilding the API clients.\n /\nexport type AuthManager = {\n /\n Mutable fetcher options carrying the `Authorization` header. Bound sections\n * share this reference so the injected token is reused everywhere.\n /\n fetcherOptions: FetcherOptions;\n /\n The resolved Intlayer configuration (merged with the build-time defaults).\n /\n intlayerConfig: IntlayerConfig;\n /\n `true` when credentials are available — either a session token or a\n * `clientId`/`clientSecret` pair in the configuration.\n /\n hasCredentials: boolean;\n /\n Ensures a valid access token is available and applies it to\n * `fetcherOptions`. Called automatically by {@link withAuth}.\n /\n ensureAuth: () => Promise<void>;\n /\n Forces a token refresh on the next call by clearing the cached token.\n /\n reset: () => void;\n /\n Wraps a single API method so it injects (and, on failure, refreshes) the\n * access token on every invocation while preserving the method's signature.\n /\n withAuth: <Arguments extends unknown[], Result>(\n method: AsyncMethod<Arguments, Result>,\n skipAuth?: boolean\n ) => AsyncMethod<Arguments, Result>;\n /\n Instantiates a domain factory with the managed fetcher options and config,\n * returning a section whose every method authenticates automatically.\n \n @example\n * ```ts\n * const dictionary = authManager.bindSection(getDictionaryAPI);\n * await dictionary.pushDictionaries(dictionaries);\n * ```\n /\n bindSection: <Section extends Record<string, unknown>>(\n factory: SectionFactory<Section>,\n options?: BindSectionOptions\n ) => Section;\n};\n\n/\n Creates an instance-scoped {@link AuthManager} handling the OAuth2\n * `client_credentials` flow (or a pre-issued CLI session token).\n \n Unlike a global token cache, each manager keeps its own token state, so\n * independent SDK instances never interfere with one another.\n \n @param intlayerConfig - Intlayer configuration carrying the `editor`\n * credentials. Defaults to the build-time configuration.\n * @param options - Optional session token and base fetcher options.\n */\nexport const createAuthManager = (\n intlayerConfig: Pick<IntlayerConfig, 'editor'> = { editor },\n options: AuthManagerOptions = {}\n): AuthManager => {\n const { baseFetcherOptions = {}, sessionToken } = options;\n\n const resolvedConfig = defu(intlayerConfig ?? {}, {\n editor,\n }) as IntlayerConfig;\n\n // `credentials: 'omit'` prevents the browser from attaching session cookies;\n // authentication is handled exclusively through the injected Bearer token.\n // This is required because the backend only allows credentialed requests for\n // whitelisted first-party origins.\n const fetcherOptions: FetcherOptions = {\n ...baseFetcherOptions,\n credentials: 'omit',\n };\n\n const hasCredentials =\n Boolean(sessionToken) \|\|\n Boolean(\n resolvedConfig?.editor?.clientId && resolvedConfig?.editor?.clientSecret\n );\n\n // A session token is used as-is and never expires within the SDK's concern,\n // so inject it once up-front and skip the OAuth2 exchange.\n if (sessionToken) {\n fetcherOptions.headers = {\n ...(fetcherOptions.headers ?? {}),\n Authorization: `Bearer ${sessionToken}`,\n } as HeadersInit;\n }\n\n let accessToken: string \| undefined;\n let expiryTimestamp: number \| undefined;\n let pendingRefresh: Promise<void> \| undefined;\n\n const needsRefresh = (): boolean => {\n if (!accessToken) return true;\n if (!expiryTimestamp) return false; // Unknown expiry: assume usable until failure.\n\n // Refresh one minute before the actual expiry to avoid edge-of-expiry races.\n return Date.now() + ONE_MINUTE_MS >= expiryTimestamp;\n };\n\n const refreshToken = async (): Promise<void> => {\n const doRefresh = async (): Promise<void> => {\n const oAuthAPI = getOAuthAPI({}, resolvedConfig);\n const response = await oAuthAPI.getOAuth2AccessToken();\n const tokenData = response?.data as OAuthTokenLike \| undefined;\n\n accessToken = tokenData?.accessToken;\n expiryTimestamp = getExpiryTimestamp(tokenData);\n };\n\n // De-duplicate concurrent refreshes so a burst of calls triggers one fetch.\n pendingRefresh ??= doRefresh().finally(() => {\n pendingRefresh = undefined;\n });\n\n await pendingRefresh;\n };\n\n const applyAuthHeader = (): void => {\n if (!accessToken) return;\n fetcherOptions.headers = {\n ...(fetcherOptions.headers ?? {}),\n Authorization: `Bearer ${accessToken}`,\n } as HeadersInit;\n };\n\n const ensureAuth = async (): Promise<void> => {\n if (sessionToken) return; // Already injected; nothing to refresh.\n if (needsRefresh()) {\n await refreshToken();\n }\n applyAuthHeader();\n };\n\n const reset = (): void => {\n accessToken = undefined;\n expiryTimestamp = undefined;\n };\n\n const withAuth = <Arguments extends unknown[], Result>(\n method: AsyncMethod<Arguments, Result>,\n skipAuth = !hasCredentials\n ): AsyncMethod<Arguments, Result> => {\n if (skipAuth) return method;\n\n return async (...args: Arguments): Promise<Result> => {\n await ensureAuth();\n\n try {\n return await method(...args);\n } catch (error) {\n // The token may have been revoked or expired early: refresh once and\n // retry before surfacing the error. A session token cannot be\n // refreshed, so re-throw immediately in that case.\n if (sessionToken) throw error;\n\n await refreshToken();\n applyAuthHeader();\n return await method(...args);\n }\n };\n };\n\n const bindSection = <Section extends Record<string, unknown>>(\n factory: SectionFactory<Section>,\n bindOptions: BindSectionOptions = {}\n ): Section => {\n const section = factory(fetcherOptions, resolvedConfig);\n const skipAuth = bindOptions.skipAuth ?? !hasCredentials;\n\n return new Proxy(section, {\n get(target, property, receiver) {\n const value = Reflect.get(target, property, receiver);\n\n if (typeof value !== 'function') return value;\n\n return withAuth(\n (value as AsyncMethod<unknown[], unknown>).bind(target),\n skipAuth\n );\n },\n });\n };\n\n return {\n fetcherOptions,\n intlayerConfig: resolvedConfig,\n hasCredentials,\n ensureAuth,\n reset,\n withAuth,\n bindSection,\n };\n};\n"],"mappings":";;;;;;AAmCA,MAAM,gBAAgB;;;;;AAMtB,MAAM,sBACJ,UACuB;CACvB,IAAI,CAAC,OAAO,OAAO;CAEnB,MAAM,WAAY,MAAM,wBAAwB,MAAM;CAKtD,IAAI,UAAU;EACZ,MAAM,YACJ,OAAO,aAAa,WAChB,KAAK,MAAM,QAAQ,IACnB,SAAS,UAAU;EACzB,IAAI,OAAO,cAAc,YAAY,OAAO,SAAS,SAAS,GAC5D,OAAO;CAEX;CAEA,MAAM,UAAU,MAAM,cAAc,MAAM;CAC1C,IAAI,OAAO,YAAY,YAAY,OAAO,SAAS,OAAO,GACxD,OAAO,KAAK,IAAI,IAAI,UAAU;AAIlC;;;;;;;;;;;;AAgGA,MAAa,qBACX,iBAAiD,EAAE,sCAAO,GAC1D,UAA8B,CAAC,MACf;CAChB,MAAM,EAAE,qBAAqB,CAAC,GAAG,iBAAiB;CAElD,MAAM,qBAAiB,WAAK,kBAAkB,CAAC,GAAG,EAChD,sCACF,CAAC;CAMD,MAAM,iBAAiC;EACrC,GAAG;EACH,aAAa;CACf;CAEA,MAAM,iBACJ,QAAQ,YAAY,KACpB,QACE,gBAAgB,QAAQ,YAAY,gBAAgB,QAAQ,YAC9D;CAIF,IAAI,cACF,eAAe,UAAU;EACvB,GAAI,eAAe,WAAW,CAAC;EAC/B,eAAe,UAAU;CAC3B;CAGF,IAAI;CACJ,IAAI;CACJ,IAAI;CAEJ,MAAM,qBAA8B;EAClC,IAAI,CAAC,aAAa,OAAO;EACzB,IAAI,CAAC,iBAAiB,OAAO;EAG7B,OAAO,KAAK,IAAI,IAAI,iBAAiB;CACvC;CAEA,MAAM,eAAe,YAA2B;EAC9C,MAAM,YAAY,YAA2B;GAG3C,MAAM,aAAY,MAFDA,yCAAY,CAAC,GAAG,cACH,CAAC,CAAC,qBAAqB,EAC3B,EAAE;GAE5B,cAAc,WAAW;GACzB,kBAAkB,mBAAmB,SAAS;EAChD;EAGA,mBAAmB,UAAU,CAAC,CAAC,cAAc;GAC3C,iBAAiB;EACnB,CAAC;EAED,MAAM;CACR;CAEA,MAAM,wBAA8B;EAClC,IAAI,CAAC,aAAa;EAClB,eAAe,UAAU;GACvB,GAAI,eAAe,WAAW,CAAC;GAC/B,eAAe,UAAU;EAC3B;CACF;CAEA,MAAM,aAAa,YAA2B;EAC5C,IAAI,cAAc;EAClB,IAAI,aAAa,GACf,MAAM,aAAa;EAErB,gBAAgB;CAClB;CAEA,MAAM,cAAoB;EACxB,cAAc;EACd,kBAAkB;CACpB;CAEA,MAAM,YACJ,QACA,WAAW,CAAC,mBACuB;EACnC,IAAI,UAAU,OAAO;EAErB,OAAO,OAAO,GAAG,SAAqC;GACpD,MAAM,WAAW;GAEjB,IAAI;IACF,OAAO,MAAM,OAAO,GAAG,IAAI;GAC7B,SAAS,OAAO;IAId,IAAI,cAAc,MAAM;IAExB,MAAM,aAAa;IACnB,gBAAgB;IAChB,OAAO,MAAM,OAAO,GAAG,IAAI;GAC7B;EACF;CACF;CAEA,MAAM,eACJ,SACA,cAAkC,CAAC,MACvB;EACZ,MAAM,UAAU,QAAQ,gBAAgB,cAAc;EACtD,MAAM,WAAW,YAAY,YAAY,CAAC;EAE1C,OAAO,IAAI,MAAM,SAAS,EACxB,IAAI,QAAQ,UAAU,UAAU;GAC9B,MAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU,QAAQ;GAEpD,IAAI,OAAO,UAAU,YAAY,OAAO;GAExC,OAAO,SACJ,MAA0C,KAAK,MAAM,GACtD,QACF;EACF,EACF,CAAC;CACH;CAEA,OAAO;EACL;EACA,gBAAgB;EAChB;EACA;EACA;EACA;EACA;CACF;AACF"}
1	+ {"version":3,"file":"createAuthManager.cjs","names":["editor","getEditorClientSecret","getOAuthAPI"],"sources":["../../../src/cms/createAuthManager.ts"],"sourcesContent":["import { editor } from '@intlayer/config/built';\nimport { getEditorClientSecret } from '@intlayer/config/secrets';\nimport type { IntlayerConfig } from '@intlayer/types/config';\nimport { defu } from 'defu';\nimport type { FetcherOptions } from '../fetcher';\nimport { getOAuthAPI } from '../getIntlayerAPI/oAuth';\n\n/*\n Shape of the various OAuth2 token payloads the backend may return. Only the\n * fields used to derive the expiration timestamp are described here.\n /\ntype OAuthTokenLike = {\n accessToken?: string;\n accessTokenExpiresAt?: string \| Date;\n expires_in?: number;\n expiresIn?: number;\n expiresAt?: string \| Date;\n};\n\n/\n Any asynchronous API method exposed by a domain section\n * (e.g. `getDictionaries`, `pushDictionaries`).\n /\ntype AsyncMethod<Arguments extends unknown[], Result> = (\n ...args: Arguments\n) => Promise<Result>;\n\n/\n A domain section factory: builds a plain object of async methods from shared\n * fetcher options and the Intlayer configuration.\n /\ntype SectionFactory<Section extends Record<string, unknown>> = (\n fetcherOptions: FetcherOptions,\n intlayerConfig: IntlayerConfig\n) => Section;\n\nconst ONE_MINUTE_MS = 60_000;\n\n/* Whether the current runtime is a browser rather than a server. /\nconst isBrowser = (): boolean => typeof window !== 'undefined';\n\n/\n Resolves the expiration timestamp (in ms since epoch) from an OAuth2\n * token-like payload, supporting both absolute dates and relative durations.\n /\nconst getExpiryTimestamp = (\n token: OAuthTokenLike \| undefined\n): number \| undefined => {\n if (!token) return undefined;\n\n const dateLike = (token.accessTokenExpiresAt ?? token.expiresAt) as\n \| string\n \| Date\n \| undefined;\n\n if (dateLike) {\n const timestamp =\n typeof dateLike === 'string'\n ? Date.parse(dateLike)\n : dateLike.getTime?.();\n if (typeof timestamp === 'number' && Number.isFinite(timestamp)) {\n return timestamp;\n }\n }\n\n const seconds = token.expires_in ?? token.expiresIn;\n if (typeof seconds === 'number' && Number.isFinite(seconds)) {\n return Date.now() + seconds 1000;\n }\n\n return undefined;\n};\n\n/*\n Options accepted when creating an {@link AuthManager}.\n /\nexport type AuthManagerOptions = {\n /\n Base fetcher options merged into every request (e.g. custom headers).\n /\n baseFetcherOptions?: FetcherOptions;\n /\n A pre-issued CLI session token (prefixed with `clisession_`). When provided,\n * it is used directly as the Bearer token and the OAuth2 `client_credentials`\n * exchange is skipped entirely.\n /\n sessionToken?: string;\n};\n\n/\n Options accepted when binding a domain section to an {@link AuthManager}.\n /\nexport type BindSectionOptions = {\n /\n Forces auth injection on (`false`) or off (`true`). Defaults to enabled\n * whenever credentials are available.\n /\n skipAuth?: boolean;\n};\n\n/\n Manages CMS authentication for a set of API calls.\n \n The manager owns a single mutable {@link FetcherOptions} object\n * (`fetcherOptions`). Domain factories bound through it share the same\n * reference, so refreshing the token in place transparently authenticates every\n * call — without rebuilding the API clients.\n /\nexport type AuthManager = {\n /\n Mutable fetcher options carrying the `Authorization` header. Bound sections\n * share this reference so the injected token is reused everywhere.\n /\n fetcherOptions: FetcherOptions;\n /\n The resolved Intlayer configuration (merged with the build-time defaults).\n /\n intlayerConfig: IntlayerConfig;\n /\n `true` when credentials are available — either a session token or a\n * `clientId`/`clientSecret` pair in the configuration.\n /\n hasCredentials: boolean;\n /\n Ensures a valid access token is available and applies it to\n * `fetcherOptions`. Called automatically by {@link withAuth}.\n /\n ensureAuth: () => Promise<void>;\n /\n Forces a token refresh on the next call by clearing the cached token.\n /\n reset: () => void;\n /\n Wraps a single API method so it injects (and, on failure, refreshes) the\n * access token on every invocation while preserving the method's signature.\n /\n withAuth: <Arguments extends unknown[], Result>(\n method: AsyncMethod<Arguments, Result>,\n skipAuth?: boolean\n ) => AsyncMethod<Arguments, Result>;\n /\n Instantiates a domain factory with the managed fetcher options and config,\n * returning a section whose every method authenticates automatically.\n \n @example\n * ```ts\n * const dictionary = authManager.bindSection(getDictionaryAPI);\n * await dictionary.pushDictionaries(dictionaries);\n * ```\n /\n bindSection: <Section extends Record<string, unknown>>(\n factory: SectionFactory<Section>,\n options?: BindSectionOptions\n ) => Section;\n};\n\n/\n Creates an instance-scoped {@link AuthManager} handling the OAuth2\n * `client_credentials` flow (or a pre-issued CLI session token).\n \n Unlike a global token cache, each manager keeps its own token state, so\n * independent SDK instances never interfere with one another.\n \n @param intlayerConfig - Intlayer configuration carrying the `editor`\n * credentials. Defaults to the build-time configuration.\n * @param options - Optional session token and base fetcher options.\n /\nexport const createAuthManager = (\n intlayerConfig: Pick<IntlayerConfig, 'editor'> = { editor },\n options: AuthManagerOptions = {}\n): AuthManager => {\n const { baseFetcherOptions = {}, sessionToken } = options;\n\n // `editor` comes from the generated build-time configuration, which never\n // carries `clientSecret` — it would be inlined into client bundles. The\n // secret is supplied server-side by `@intlayer/config/secrets`, which\n // resolves to an inert stub in the browser; `hasCredentials` then stays false\n // there and the OAuth2 exchange never runs.\n //\n // Only consulted when the configuration declares a `clientId`, so a project\n // that comments its credentials out stays uncredentialed even with the\n // environment variables still defined.\n const resolvedConfig = defu(intlayerConfig ?? {}, {\n editor: {\n ...editor,\n clientSecret: editor?.clientId ? getEditorClientSecret() : undefined,\n },\n }) as IntlayerConfig;\n\n // `credentials: 'omit'` prevents the browser from attaching session cookies;\n // authentication is handled exclusively through the injected Bearer token.\n // This is required because the backend only allows credentialed requests for\n // whitelisted first-party origins.\n const fetcherOptions: FetcherOptions = {\n ...baseFetcherOptions,\n credentials: 'omit',\n };\n\n const hasCredentials =\n Boolean(sessionToken) \|\|\n Boolean(\n resolvedConfig?.editor?.clientId && resolvedConfig?.editor?.clientSecret\n );\n\n // A session token is used as-is and never expires within the SDK's concern,\n // so inject it once up-front and skip the OAuth2 exchange.\n if (sessionToken) {\n fetcherOptions.headers = {\n ...(fetcherOptions.headers ?? {}),\n Authorization: `Bearer ${sessionToken}`,\n } as HeadersInit;\n }\n\n let accessToken: string \| undefined;\n let expiryTimestamp: number \| undefined;\n let pendingRefresh: Promise<void> \| undefined;\n\n const needsRefresh = (): boolean => {\n if (!accessToken) return true;\n if (!expiryTimestamp) return false; // Unknown expiry: assume usable until failure.\n\n // Refresh one minute before the actual expiry to avoid edge-of-expiry races.\n return Date.now() + ONE_MINUTE_MS >= expiryTimestamp;\n };\n\n const refreshToken = async (): Promise<void> => {\n const doRefresh = async (): Promise<void> => {\n const oAuthAPI = getOAuthAPI({}, resolvedConfig);\n const response = await oAuthAPI.getOAuth2AccessToken();\n const tokenData = response?.data as OAuthTokenLike \| undefined;\n\n accessToken = tokenData?.accessToken;\n expiryTimestamp = getExpiryTimestamp(tokenData);\n };\n\n // De-duplicate concurrent refreshes so a burst of calls triggers one fetch.\n pendingRefresh ??= doRefresh().finally(() => {\n pendingRefresh = undefined;\n });\n\n await pendingRefresh;\n };\n\n const applyAuthHeader = (): void => {\n if (!accessToken) return;\n fetcherOptions.headers = {\n ...(fetcherOptions.headers ?? {}),\n Authorization: `Bearer ${accessToken}`,\n } as HeadersInit;\n };\n\n const ensureAuth = async (): Promise<void> => {\n if (sessionToken) return; // Already injected; nothing to refresh.\n if (needsRefresh()) {\n await refreshToken();\n }\n applyAuthHeader();\n };\n\n const reset = (): void => {\n accessToken = undefined;\n expiryTimestamp = undefined;\n };\n\n const withAuth = <Arguments extends unknown[], Result>(\n method: AsyncMethod<Arguments, Result>,\n skipAuth = !hasCredentials\n ): AsyncMethod<Arguments, Result> => {\n // In a browser the project credentials are structurally unavailable, so an\n // authenticated call would silently go out unauthenticated and come back\n // 401. Fail with an actionable message instead: a browser must authenticate\n // as the signed-in user* (a session token, or the session cookie on a\n // first-party origin), never as the project.\n if (skipAuth && !sessionToken && isBrowser()) {\n return async () => {\n throw new Error(\n 'Intlayer CMS credentials are not available in the browser. ' +\n '`clientSecret` is a server-side credential and is never bundled. ' +\n 'Call this from a server route, or pass a user session token: ' +\n 'createIntlayerCMS(config, { sessionToken }).'\n );\n };\n }\n\n if (skipAuth) return method;\n\n return async (...args: Arguments): Promise<Result> => {\n await ensureAuth();\n\n try {\n return await method(...args);\n } catch (error) {\n // The token may have been revoked or expired early: refresh once and\n // retry before surfacing the error. A session token cannot be\n // refreshed, so re-throw immediately in that case.\n if (sessionToken) throw error;\n\n await refreshToken();\n applyAuthHeader();\n return await method(...args);\n }\n };\n };\n\n const bindSection = <Section extends Record<string, unknown>>(\n factory: SectionFactory<Section>,\n bindOptions: BindSectionOptions = {}\n ): Section => {\n const section = factory(fetcherOptions, resolvedConfig);\n const skipAuth = bindOptions.skipAuth ?? !hasCredentials;\n\n return new Proxy(section, {\n get(target, property, receiver) {\n const value = Reflect.get(target, property, receiver);\n\n if (typeof value !== 'function') return value;\n\n return withAuth(\n (value as AsyncMethod<unknown[], unknown>).bind(target),\n skipAuth\n );\n },\n });\n };\n\n return {\n fetcherOptions,\n intlayerConfig: resolvedConfig,\n hasCredentials,\n ensureAuth,\n reset,\n withAuth,\n bindSection,\n };\n};\n"],"mappings":";;;;;;;AAoCA,MAAM,gBAAgB;;AAGtB,MAAM,kBAA2B,OAAO,WAAW;;;;;AAMnD,MAAM,sBACJ,UACuB;CACvB,IAAI,CAAC,OAAO,OAAO;CAEnB,MAAM,WAAY,MAAM,wBAAwB,MAAM;CAKtD,IAAI,UAAU;EACZ,MAAM,YACJ,OAAO,aAAa,WAChB,KAAK,MAAM,QAAQ,IACnB,SAAS,UAAU;EACzB,IAAI,OAAO,cAAc,YAAY,OAAO,SAAS,SAAS,GAC5D,OAAO;CAEX;CAEA,MAAM,UAAU,MAAM,cAAc,MAAM;CAC1C,IAAI,OAAO,YAAY,YAAY,OAAO,SAAS,OAAO,GACxD,OAAO,KAAK,IAAI,IAAI,UAAU;AAIlC;;;;;;;;;;;;AAgGA,MAAa,qBACX,iBAAiD,EAAE,sCAAO,GAC1D,UAA8B,CAAC,MACf;CAChB,MAAM,EAAE,qBAAqB,CAAC,GAAG,iBAAiB;CAWlD,MAAM,qBAAiB,WAAK,kBAAkB,CAAC,GAAG,EAChD,QAAQ;EACN,GAAGA;EACH,cAAcA,+BAAQ,eAAWC,gDAAsB,IAAI;CAC7D,EACF,CAAC;CAMD,MAAM,iBAAiC;EACrC,GAAG;EACH,aAAa;CACf;CAEA,MAAM,iBACJ,QAAQ,YAAY,KACpB,QACE,gBAAgB,QAAQ,YAAY,gBAAgB,QAAQ,YAC9D;CAIF,IAAI,cACF,eAAe,UAAU;EACvB,GAAI,eAAe,WAAW,CAAC;EAC/B,eAAe,UAAU;CAC3B;CAGF,IAAI;CACJ,IAAI;CACJ,IAAI;CAEJ,MAAM,qBAA8B;EAClC,IAAI,CAAC,aAAa,OAAO;EACzB,IAAI,CAAC,iBAAiB,OAAO;EAG7B,OAAO,KAAK,IAAI,IAAI,iBAAiB;CACvC;CAEA,MAAM,eAAe,YAA2B;EAC9C,MAAM,YAAY,YAA2B;GAG3C,MAAM,aAAY,MAFDC,yCAAY,CAAC,GAAG,cACH,CAAC,CAAC,qBAAqB,EAC3B,EAAE;GAE5B,cAAc,WAAW;GACzB,kBAAkB,mBAAmB,SAAS;EAChD;EAGA,mBAAmB,UAAU,CAAC,CAAC,cAAc;GAC3C,iBAAiB;EACnB,CAAC;EAED,MAAM;CACR;CAEA,MAAM,wBAA8B;EAClC,IAAI,CAAC,aAAa;EAClB,eAAe,UAAU;GACvB,GAAI,eAAe,WAAW,CAAC;GAC/B,eAAe,UAAU;EAC3B;CACF;CAEA,MAAM,aAAa,YAA2B;EAC5C,IAAI,cAAc;EAClB,IAAI,aAAa,GACf,MAAM,aAAa;EAErB,gBAAgB;CAClB;CAEA,MAAM,cAAoB;EACxB,cAAc;EACd,kBAAkB;CACpB;CAEA,MAAM,YACJ,QACA,WAAW,CAAC,mBACuB;EAMnC,IAAI,YAAY,CAAC,gBAAgB,UAAU,GACzC,OAAO,YAAY;GACjB,MAAM,IAAI,MACR,uOAIF;EACF;EAGF,IAAI,UAAU,OAAO;EAErB,OAAO,OAAO,GAAG,SAAqC;GACpD,MAAM,WAAW;GAEjB,IAAI;IACF,OAAO,MAAM,OAAO,GAAG,IAAI;GAC7B,SAAS,OAAO;IAId,IAAI,cAAc,MAAM;IAExB,MAAM,aAAa;IACnB,gBAAgB;IAChB,OAAO,MAAM,OAAO,GAAG,IAAI;GAC7B;EACF;CACF;CAEA,MAAM,eACJ,SACA,cAAkC,CAAC,MACvB;EACZ,MAAM,UAAU,QAAQ,gBAAgB,cAAc;EACtD,MAAM,WAAW,YAAY,YAAY,CAAC;EAE1C,OAAO,IAAI,MAAM,SAAS,EACxB,IAAI,QAAQ,UAAU,UAAU;GAC9B,MAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU,QAAQ;GAEpD,IAAI,OAAO,UAAU,YAAY,OAAO;GAExC,OAAO,SACJ,MAA0C,KAAK,MAAM,GACtD,QACF;EACF,EACF,CAAC;CACH;CAEA,OAAO;EACL;EACA,gBAAgB;EAChB;EACA;EACA;EACA;EACA;CACF;AACF"}

package/dist/cjs/getIntlayerAPI/analytics.cjs CHANGED Viewed

@@ -23,13 +23,14 @@ const getAnalyticsAPI = (authAPIOptions = {}, intlayerConfig) => {
 	const getOverview = async (otherOptions = {}) => await require_fetcher.fetcher(`${ANALYTICS_API_ROUTE}/overview`, authAPIOptions, otherOptions, { method: "GET" });
 	/**
 	* Audience report: distinct visitors (today / 7d / window), page views, the
-	* daily evolution series, and locale + country breakdowns.
-	* @param days - Rolling window size in days (default 30).
+	* evolution series, and locale + country breakdowns.
+	* @param range - Rolling window, either a named range (`1h`, `24h`, `7d`,
+	*   `30d`, `90d`, `6mo`, `1y`, `3y`) or a number of days (default 30).
 	* @returns The audience statistics.
 	*/
-	const getAudience = async (days = 30, otherOptions = {}) => await require_fetcher.fetcher(`${ANALYTICS_API_ROUTE}/audience`, authAPIOptions, otherOptions, {
+	const getAudience = async (range = 30, otherOptions = {}) => await require_fetcher.fetcher(`${ANALYTICS_API_ROUTE}/audience`, authAPIOptions, otherOptions, {
 		method: "GET",
-		params: { days: String(days) }
+		params: typeof range === "number" ? { days: String(range) } : { range }
 	});
 	/**
 	* Per-content exposure totals — "which content is actually shown".

package/dist/cjs/getIntlayerAPI/analytics.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"analytics.cjs","names":["editor","fetcher","createEndpoint"],"sources":["../../../src/getIntlayerAPI/analytics.ts"],"sourcesContent":["import type {\n GetAnalyticsOverviewResult,\n GetAudienceResult,\n GetContentStatsResult,\n GetExperimentResultsResult,\n IngestAnalyticsBody,\n IngestAnalyticsResult,\n} from '@intlayer/backend';\nimport { editor } from '@intlayer/config/built';\nimport type { IntlayerConfig } from '@intlayer/types/config';\nimport { createEndpoint } from '../cms/createIntlayerCMS';\nimport { type FetcherOptions, fetcher } from '../fetcher';\n\nexport const getAnalyticsAPI = (\n authAPIOptions: FetcherOptions = {},\n intlayerConfig?: IntlayerConfig\n) => {\n const backendURL = intlayerConfig?.editor?.backendURL ?? editor.backendURL;\n\n const ANALYTICS_API_ROUTE = `${backendURL}/api/analytics`;\n\n /*\n Ingest a batch of analytics events. Public — attribution is by the\n * project's `clientId` in the body.\n * @param body - Session id, sdk version, and the collected events.\n * @returns The number of accepted events.\n /\n const sendEvents = async (\n body: IngestAnalyticsBody,\n otherOptions: FetcherOptions = {}\n ) =>\n await fetcher<IngestAnalyticsResult>(\n `${ANALYTICS_API_ROUTE}/events`,\n authAPIOptions,\n otherOptions,\n {\n method: 'POST',\n body,\n }\n );\n\n /\n Page/locale totals for the authenticated project.\n * @returns Views grouped by url and locale.\n /\n const getOverview = async (otherOptions: FetcherOptions = {}) =>\n await fetcher<GetAnalyticsOverviewResult>(\n `${ANALYTICS_API_ROUTE}/overview`,\n authAPIOptions,\n otherOptions,\n { method: 'GET' }\n );\n\n /\n Audience report: distinct visitors (today / 7d / window), page views, the\n * ~~daily~~ evolution series, and locale + country breakdowns.\n * @param ~~days~~ - Rolling window ~~size~~ in days (default 30).\n * @returns The audience statistics.\n /\n const getAudience = async (~~days~~ = 30, otherOptions: FetcherOptions = {}) =>\n await fetcher<GetAudienceResult>(\n `${ANALYTICS_API_ROUTE}/audience`,\n authAPIOptions,\n otherOptions,\n {\n method: 'GET',\n params: { days: String(~~days~~) },\n }\n );\n\n /\n Per-content exposure totals — \"which content is actually shown\".\n * @returns Exposures grouped by dictionary key, key path, and locale.\n /\n const getContentStats = async (otherOptions: FetcherOptions = {}) =>\n await fetcher<GetContentStatsResult>(\n `${ANALYTICS_API_ROUTE}/content-stats`,\n authAPIOptions,\n otherOptions,\n { method: 'GET' }\n );\n\n /\n A/B experiment results with per-variant conversion rates and significance.\n * @param experimentKey - The experiment to evaluate.\n * @returns The experiment result set.\n /\n const getExperimentResults = async (\n experimentKey: string,\n otherOptions: FetcherOptions = {}\n ) =>\n await fetcher<GetExperimentResultsResult>(\n `${ANALYTICS_API_ROUTE}/experiments/${experimentKey}`,\n authAPIOptions,\n otherOptions,\n { method: 'GET' }\n );\n\n return {\n sendEvents,\n getOverview,\n getAudience,\n getContentStats,\n getExperimentResults,\n };\n};\n\n/\n Authenticated `analytics` endpoint bound to an Intlayer CMS authenticator.\n \n Pass an authenticator created with `createIntlayerCMS`, or omit it to use\n * the build-time configuration (`@intlayer/config/built`).\n */\nexport const analyticsEndpoint = createEndpoint(getAnalyticsAPI);\n"],"mappings":";;;;;;~~AAaA~~,MAAa,mBACX,iBAAiC,CAAC,GAClC,mBACG;CAGH,MAAM,sBAAsB,GAFT,gBAAgB,QAAQ,cAAcA,8BAAO,WAEtB;;;;;;;CAQ1C,MAAM,aAAa,OACjB,MACA,eAA+B,CAAC,MAEhC,MAAMC,wBACJ,GAAG,oBAAoB,UACvB,gBACA,cACA;EACE,QAAQ;EACR;CACF,CACF;;;;;CAMF,MAAM,cAAc,OAAO,eAA+B,CAAC,MACzD,MAAMA,wBACJ,GAAG,oBAAoB,YACvB,gBACA,cACA,EAAE,QAAQ,MAAM,CAClB~~;;;;;;;CAQF~~,MAAM,cAAc,~~OAAO~~,~~OAAO~~,~~IAAI~~,eAA+B,CAAC,~~MACpE~~,MAAMA,wBACJ,GAAG,oBAAoB,YACvB,gBACA,cACA;EACE,QAAQ;EACR,QAAQ,EAAE,MAAM,OAAO,IAAI,EAAE;~~CAC/B~~,CACF;;;;;CAMF,MAAM,kBAAkB,OAAO,eAA+B,CAAC,MAC7D,MAAMA,wBACJ,GAAG,oBAAoB,iBACvB,gBACA,cACA,EAAE,QAAQ,MAAM,CAClB;;;;;;CAOF,MAAM,uBAAuB,OAC3B,eACA,eAA+B,CAAC,MAEhC,MAAMA,wBACJ,GAAG,oBAAoB,eAAe,iBACtC,gBACA,cACA,EAAE,QAAQ,MAAM,CAClB;CAEF,OAAO;EACL;EACA;EACA;EACA;EACA;CACF;AACF;;;;;;;AAQA,MAAa,oBAAoBC,6CAAe,eAAe"}
1	+ {"version":3,"file":"analytics.cjs","names":["editor","fetcher","createEndpoint"],"sources":["../../../src/getIntlayerAPI/analytics.ts"],"sourcesContent":["import type {\n AudienceRange,\n GetAnalyticsOverviewResult,\n GetAudienceResult,\n GetContentStatsResult,\n GetExperimentResultsResult,\n IngestAnalyticsBody,\n IngestAnalyticsResult,\n} from '@intlayer/backend';\nimport { editor } from '@intlayer/config/built';\nimport type { IntlayerConfig } from '@intlayer/types/config';\nimport { createEndpoint } from '../cms/createIntlayerCMS';\nimport { type FetcherOptions, fetcher } from '../fetcher';\n\nexport const getAnalyticsAPI = (\n authAPIOptions: FetcherOptions = {},\n intlayerConfig?: IntlayerConfig\n) => {\n const backendURL = intlayerConfig?.editor?.backendURL ?? editor.backendURL;\n\n const ANALYTICS_API_ROUTE = `${backendURL}/api/analytics`;\n\n /*\n Ingest a batch of analytics events. Public — attribution is by the\n * project's `clientId` in the body.\n * @param body - Session id, sdk version, and the collected events.\n * @returns The number of accepted events.\n /\n const sendEvents = async (\n body: IngestAnalyticsBody,\n otherOptions: FetcherOptions = {}\n ) =>\n await fetcher<IngestAnalyticsResult>(\n `${ANALYTICS_API_ROUTE}/events`,\n authAPIOptions,\n otherOptions,\n {\n method: 'POST',\n body,\n }\n );\n\n /\n Page/locale totals for the authenticated project.\n * @returns Views grouped by url and locale.\n /\n const getOverview = async (otherOptions: FetcherOptions = {}) =>\n await fetcher<GetAnalyticsOverviewResult>(\n `${ANALYTICS_API_ROUTE}/overview`,\n authAPIOptions,\n otherOptions,\n { method: 'GET' }\n );\n\n /\n Audience report: distinct visitors (today / 7d / window), page views, the\n * evolution series, and locale + country breakdowns.\n * @param range - Rolling window, either a named range (`1h`, `24h`, `7d`,\n * `30d`, `90d`, `6mo`, `1y`, `3y`) or a number of days (default 30).\n * @returns The audience statistics.\n /\n const getAudience = async (\n range: AudienceRange \| number = 30,\n otherOptions: FetcherOptions = {}\n ) =>\n await fetcher<GetAudienceResult>(\n `${ANALYTICS_API_ROUTE}/audience`,\n authAPIOptions,\n otherOptions,\n {\n method: 'GET',\n params: typeof range === 'number' ? { days: String(range) } : { range },\n }\n );\n\n /\n Per-content exposure totals — \"which content is actually shown\".\n * @returns Exposures grouped by dictionary key, key path, and locale.\n /\n const getContentStats = async (otherOptions: FetcherOptions = {}) =>\n await fetcher<GetContentStatsResult>(\n `${ANALYTICS_API_ROUTE}/content-stats`,\n authAPIOptions,\n otherOptions,\n { method: 'GET' }\n );\n\n /\n A/B experiment results with per-variant conversion rates and significance.\n * @param experimentKey - The experiment to evaluate.\n * @returns The experiment result set.\n /\n const getExperimentResults = async (\n experimentKey: string,\n otherOptions: FetcherOptions = {}\n ) =>\n await fetcher<GetExperimentResultsResult>(\n `${ANALYTICS_API_ROUTE}/experiments/${experimentKey}`,\n authAPIOptions,\n otherOptions,\n { method: 'GET' }\n );\n\n return {\n sendEvents,\n getOverview,\n getAudience,\n getContentStats,\n getExperimentResults,\n };\n};\n\n/\n Authenticated `analytics` endpoint bound to an Intlayer CMS authenticator.\n \n Pass an authenticator created with `createIntlayerCMS`, or omit it to use\n * the build-time configuration (`@intlayer/config/built`).\n */\nexport const analyticsEndpoint = createEndpoint(getAnalyticsAPI);\n"],"mappings":";;;;;;AAcA,MAAa,mBACX,iBAAiC,CAAC,GAClC,mBACG;CAGH,MAAM,sBAAsB,GAFT,gBAAgB,QAAQ,cAAcA,8BAAO,WAEtB;;;;;;;CAQ1C,MAAM,aAAa,OACjB,MACA,eAA+B,CAAC,MAEhC,MAAMC,wBACJ,GAAG,oBAAoB,UACvB,gBACA,cACA;EACE,QAAQ;EACR;CACF,CACF;;;;;CAMF,MAAM,cAAc,OAAO,eAA+B,CAAC,MACzD,MAAMA,wBACJ,GAAG,oBAAoB,YACvB,gBACA,cACA,EAAE,QAAQ,MAAM,CAClB;;;;;;;;CASF,MAAM,cAAc,OAClB,QAAgC,IAChC,eAA+B,CAAC,MAEhC,MAAMA,wBACJ,GAAG,oBAAoB,YACvB,gBACA,cACA;EACE,QAAQ;EACR,QAAQ,OAAO,UAAU,WAAW,EAAE,MAAM,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM;CACxE,CACF;;;;;CAMF,MAAM,kBAAkB,OAAO,eAA+B,CAAC,MAC7D,MAAMA,wBACJ,GAAG,oBAAoB,iBACvB,gBACA,cACA,EAAE,QAAQ,MAAM,CAClB;;;;;;CAOF,MAAM,uBAAuB,OAC3B,eACA,eAA+B,CAAC,MAEhC,MAAMA,wBACJ,GAAG,oBAAoB,eAAe,iBACtC,gBACA,cACA,EAAE,QAAQ,MAAM,CAClB;CAEF,OAAO;EACL;EACA;EACA;EACA;EACA;CACF;AACF;;;;;;;AAQA,MAAa,oBAAoBC,6CAAe,eAAe"}

package/dist/cjs/public/createPublicClient.cjs ADDED Viewed

@@ -0,0 +1,123 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+let _intlayer_config_built = require("@intlayer/config/built");
+//#region src/public/createPublicClient.ts
+/**
+* Browser-safe Intlayer client, authenticated without any confidential
+* credential.
+*
+* This is the Google-Analytics model applied to the whole SDK: the page ships
+* only the **public** `editor.clientId`, exchanges it for a short-lived scoped
+* token, and calls the API directly. No server route, no server action, and no
+* `clientSecret` in the bundle.
+*
+* What it can do is deliberately narrow, and that is what makes shipping the
+* key safe: read the project's published dictionary content — the content the
+* page already renders — and submit analytics events. Writing content, reading
+* a project, an organization or a user still require a real credential
+* (server-side) or a signed-in user.
+*
+* @example
+* ```ts
+* import { createPublicClient } from '@intlayer/api/public';
+*
+* const client = createPublicClient();
+*
+* const keys = await client.getDictionaryKeys();
+* const [dictionary] = await client.getDictionaries(['navbar']);
+* ```
+*/
+/** `sessionStorage` key holding the cached token for this tab. */
+const TOKEN_STORAGE_KEY = "__intlayer_public_token__";
+/**
+* Refresh margin: a token within this window of expiry is treated as expired,
+* so a request is never sent with a token that dies in flight.
+*/
+const EXPIRY_MARGIN_MS = 6e4;
+/** Reads the cached token for this tab, ignoring an unusable cache. */
+const readStoredToken = () => {
+	try {
+		const raw = globalThis.sessionStorage?.getItem(TOKEN_STORAGE_KEY);
+		if (!raw) return null;
+		const parsed = JSON.parse(raw);
+		if (typeof parsed?.token !== "string") return null;
+		if (typeof parsed?.expiresAt !== "number") return null;
+		return parsed;
+	} catch {
+		return null;
+	}
+};
+/** Persists the token for this tab. Best-effort: storage may be unavailable. */
+const writeStoredToken = (cached) => {
+	try {
+		globalThis.sessionStorage?.setItem(TOKEN_STORAGE_KEY, JSON.stringify(cached));
+	} catch {}
+};
+/**
+* Creates a {@link PublicClient} for the configured project.
+*
+* @param options - Optional configuration override.
+* @returns A client that authenticates itself with the public project key.
+*/
+const createPublicClient = ({ intlayerConfig } = {}) => {
+	const resolvedEditor = intlayerConfig?.editor ?? _intlayer_config_built.editor;
+	const backendURL = (resolvedEditor?.backendURL ?? "").replace(/\/$/, "");
+	const clientId = resolvedEditor?.clientId;
+	let cached = null;
+	let pendingExchange = null;
+	const isUsable = (candidate) => candidate !== null && candidate.expiresAt - EXPIRY_MARGIN_MS > Date.now();
+	const exchange = async () => {
+		const response = await fetch(`${backendURL}/api/public/token`, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({ clientId }),
+			credentials: "omit",
+			mode: "cors"
+		});
+		if (!response.ok) return null;
+		const payload = await response.json();
+		const token = payload?.data?.token;
+		const expiresIn = payload?.data?.expiresIn ?? 0;
+		if (!token || expiresIn <= 0) return null;
+		cached = {
+			token,
+			expiresAt: Date.now() + expiresIn * 1e3
+		};
+		writeStoredToken(cached);
+		return token;
+	};
+	const getToken = async () => {
+		if (isUsable(cached)) return cached.token;
+		const stored = readStoredToken();
+		if (isUsable(stored)) {
+			cached = stored;
+			return stored.token;
+		}
+		if (!clientId) return null;
+		pendingExchange ??= exchange().finally(() => {
+			pendingExchange = null;
+		});
+		return await pendingExchange;
+	};
+	/** Issues an authorised GET against the public surface. */
+	const request = async (path, fallback) => {
+		const token = await getToken();
+		if (!token) return fallback;
+		const response = await fetch(`${backendURL}/api/public${path}`, {
+			headers: { Authorization: `Bearer ${token}` },
+			credentials: "omit",
+			mode: "cors"
+		});
+		if (!response.ok) return fallback;
+		return (await response.json())?.data ?? fallback;
+	};
+	return {
+		getToken,
+		getDictionaryKeys: () => request("/dictionaries/keys", []),
+		getDictionaries: (keys) => request(`/dictionaries?keys=${encodeURIComponent(keys.join(","))}`, [])
+	};
+};
+//#endregion
+exports.createPublicClient = createPublicClient;
+//# sourceMappingURL=createPublicClient.cjs.map

package/dist/cjs/public/createPublicClient.cjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"createPublicClient.cjs","names":["editor"],"sources":["../../../src/public/createPublicClient.ts"],"sourcesContent":["import type { DictionaryAPI } from '@intlayer/backend';\nimport { editor } from '@intlayer/config/built';\nimport type { IntlayerConfig } from '@intlayer/types/config';\n\n/**\n * Browser-safe Intlayer client, authenticated without any confidential\n * credential.\n *\n * This is the Google-Analytics model applied to the whole SDK: the page ships\n * only the **public** `editor.clientId`, exchanges it for a short-lived scoped\n * token, and calls the API directly. No server route, no server action, and no\n * `clientSecret` in the bundle.\n *\n * What it can do is deliberately narrow, and that is what makes shipping the\n * key safe: read the project's published dictionary content — the content the\n * page already renders — and submit analytics events. Writing content, reading\n * a project, an organization or a user still require a real credential\n * (server-side) or a signed-in user.\n *\n * @example\n * ```ts\n * import { createPublicClient } from '@intlayer/api/public';\n *\n * const client = createPublicClient();\n *\n * const keys = await client.getDictionaryKeys();\n * const [dictionary] = await client.getDictionaries(['navbar']);\n * ```\n */\n\n/** `sessionStorage` key holding the cached token for this tab. */\nconst TOKEN_STORAGE_KEY = '__intlayer_public_token__';\n\n/**\n * Refresh margin: a token within this window of expiry is treated as expired,\n * so a request is never sent with a token that dies in flight.\n */\nconst EXPIRY_MARGIN_MS = 60 * 1000;\n\ntype CachedToken = {\n token: string;\n /** Epoch milliseconds. */\n expiresAt: number;\n};\n\n/** Reads the cached token for this tab, ignoring an unusable cache. */\nconst readStoredToken = (): CachedToken | null => {\n try {\n const raw = globalThis.sessionStorage?.getItem(TOKEN_STORAGE_KEY);\n if (!raw) return null;\n\n const parsed = JSON.parse(raw) as CachedToken;\n\n if (typeof parsed?.token !== 'string') return null;\n if (typeof parsed?.expiresAt !== 'number') return null;\n\n return parsed;\n } catch {\n // Private mode, disabled storage, or a corrupted entry — start fresh.\n return null;\n }\n};\n\n/** Persists the token for this tab. Best-effort: storage may be unavailable. */\nconst writeStoredToken = (cached: CachedToken): void => {\n try {\n globalThis.sessionStorage?.setItem(\n TOKEN_STORAGE_KEY,\n JSON.stringify(cached)\n );\n } catch {\n /* ignore — the in-memory cache still applies for this page */\n }\n};\n\n/** Options accepted by {@link createPublicClient}. */\nexport type PublicClientOptions = {\n /** Overrides the build-time `editor` configuration. */\n intlayerConfig?: Pick<IntlayerConfig, 'editor'>;\n};\n\n/** The credential-free client returned by {@link createPublicClient}. */\nexport type PublicClient = {\n /**\n * Returns the current token, exchanging the public `clientId` for one when\n * needed. `null` when the project is unknown or the origin is not allowed.\n */\n getToken: () => Promise<string | null>;\n /** Every dictionary key published for the project. */\n getDictionaryKeys: () => Promise<string[]>;\n /**\n * Published dictionary content for the given keys.\n *\n * @param keys - Dictionary keys to fetch (at most 100 per call).\n */\n getDictionaries: (keys: string[]) => Promise<DictionaryAPI[]>;\n};\n\n/**\n * Creates a {@link PublicClient} for the configured project.\n *\n * @param options - Optional configuration override.\n * @returns A client that authenticates itself with the public project key.\n */\nexport const createPublicClient = ({\n intlayerConfig,\n}: PublicClientOptions = {}): PublicClient => {\n const resolvedEditor = intlayerConfig?.editor ?? editor;\n const backendURL = (resolvedEditor?.backendURL ?? '').replace(/\\/$/, '');\n const clientId = resolvedEditor?.clientId;\n\n let cached: CachedToken | null = null;\n let pendingExchange: Promise<string | null> | null = null;\n\n const isUsable = (candidate: CachedToken | null): candidate is CachedToken =>\n candidate !== null && candidate.expiresAt - EXPIRY_MARGIN_MS > Date.now();\n\n const exchange = async (): Promise<string | null> => {\n const response = await fetch(`${backendURL}/api/public/token`, {\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({ clientId }),\n // Authorised by `Origin`, never by cookies.\n credentials: 'omit',\n mode: 'cors',\n });\n\n if (!response.ok) return null;\n\n const payload = (await response.json()) as {\n data?: { token?: string | null; expiresIn?: number };\n };\n\n const token = payload?.data?.token;\n const expiresIn = payload?.data?.expiresIn ?? 0;\n\n if (!token || expiresIn <= 0) return null;\n\n cached = { token, expiresAt: Date.now() + expiresIn * 1000 };\n writeStoredToken(cached);\n\n return token;\n };\n\n const getToken = async (): Promise<string | null> => {\n if (isUsable(cached)) return cached.token;\n\n const stored = readStoredToken();\n if (isUsable(stored)) {\n cached = stored;\n return stored.token;\n }\n\n if (!clientId) return null;\n\n // De-duplicate concurrent exchanges so a burst of calls triggers one fetch.\n pendingExchange ??= exchange().finally(() => {\n pendingExchange = null;\n });\n\n return await pendingExchange;\n };\n\n /** Issues an authorised GET against the public surface. */\n const request = async <Result>(\n path: string,\n fallback: Result\n ): Promise<Result> => {\n const token = await getToken();\n\n if (!token) return fallback;\n\n const response = await fetch(`${backendURL}/api/public${path}`, {\n headers: { Authorization: `Bearer ${token}` },\n credentials: 'omit',\n mode: 'cors',\n });\n\n if (!response.ok) return fallback;\n\n const payload = (await response.json()) as { data?: Result };\n\n return payload?.data ?? fallback;\n };\n\n return {\n getToken,\n getDictionaryKeys: () => request<string[]>('/dictionaries/keys', []),\n getDictionaries: (keys) =>\n request<DictionaryAPI[]>(\n `/dictionaries?keys=${encodeURIComponent(keys.join(','))}`,\n []\n ),\n };\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,MAAM,oBAAoB;;;;;AAM1B,MAAM,mBAAmB;;AASzB,MAAM,wBAA4C;CAChD,IAAI;EACF,MAAM,MAAM,WAAW,gBAAgB,QAAQ,iBAAiB;EAChE,IAAI,CAAC,KAAK,OAAO;EAEjB,MAAM,SAAS,KAAK,MAAM,GAAG;EAE7B,IAAI,OAAO,QAAQ,UAAU,UAAU,OAAO;EAC9C,IAAI,OAAO,QAAQ,cAAc,UAAU,OAAO;EAElD,OAAO;CACT,QAAQ;EAEN,OAAO;CACT;AACF;;AAGA,MAAM,oBAAoB,WAA8B;CACtD,IAAI;EACF,WAAW,gBAAgB,QACzB,mBACA,KAAK,UAAU,MAAM,CACvB;CACF,QAAQ,CAER;AACF;;;;;;;AA+BA,MAAa,sBAAsB,EACjC,mBACuB,CAAC,MAAoB;CAC5C,MAAM,iBAAiB,gBAAgB,UAAUA;CACjD,MAAM,cAAc,gBAAgB,cAAc,GAAE,CAAE,QAAQ,OAAO,EAAE;CACvE,MAAM,WAAW,gBAAgB;CAEjC,IAAI,SAA6B;CACjC,IAAI,kBAAiD;CAErD,MAAM,YAAY,cAChB,cAAc,QAAQ,UAAU,YAAY,mBAAmB,KAAK,IAAI;CAE1E,MAAM,WAAW,YAAoC;EACnD,MAAM,WAAW,MAAM,MAAM,GAAG,WAAW,oBAAoB;GAC7D,QAAQ;GACR,SAAS,EAAE,gBAAgB,mBAAmB;GAC9C,MAAM,KAAK,UAAU,EAAE,SAAS,CAAC;GAEjC,aAAa;GACb,MAAM;EACR,CAAC;EAED,IAAI,CAAC,SAAS,IAAI,OAAO;EAEzB,MAAM,UAAW,MAAM,SAAS,KAAK;EAIrC,MAAM,QAAQ,SAAS,MAAM;EAC7B,MAAM,YAAY,SAAS,MAAM,aAAa;EAE9C,IAAI,CAAC,SAAS,aAAa,GAAG,OAAO;EAErC,SAAS;GAAE;GAAO,WAAW,KAAK,IAAI,IAAI,YAAY;EAAK;EAC3D,iBAAiB,MAAM;EAEvB,OAAO;CACT;CAEA,MAAM,WAAW,YAAoC;EACnD,IAAI,SAAS,MAAM,GAAG,OAAO,OAAO;EAEpC,MAAM,SAAS,gBAAgB;EAC/B,IAAI,SAAS,MAAM,GAAG;GACpB,SAAS;GACT,OAAO,OAAO;EAChB;EAEA,IAAI,CAAC,UAAU,OAAO;EAGtB,oBAAoB,SAAS,CAAC,CAAC,cAAc;GAC3C,kBAAkB;EACpB,CAAC;EAED,OAAO,MAAM;CACf;;CAGA,MAAM,UAAU,OACd,MACA,aACoB;EACpB,MAAM,QAAQ,MAAM,SAAS;EAE7B,IAAI,CAAC,OAAO,OAAO;EAEnB,MAAM,WAAW,MAAM,MAAM,GAAG,WAAW,aAAa,QAAQ;GAC9D,SAAS,EAAE,eAAe,UAAU,QAAQ;GAC5C,aAAa;GACb,MAAM;EACR,CAAC;EAED,IAAI,CAAC,SAAS,IAAI,OAAO;EAIzB,QAAO,MAFgB,SAAS,KAAK,EAEvB,EAAE,QAAQ;CAC1B;CAEA,OAAO;EACL;EACA,yBAAyB,QAAkB,sBAAsB,CAAC,CAAC;EACnE,kBAAkB,SAChB,QACE,sBAAsB,mBAAmB,KAAK,KAAK,GAAG,CAAC,KACvD,CAAC,CACH;CACJ;AACF"}

package/dist/cjs/public/index.cjs ADDED Viewed

@@ -0,0 +1,4 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_public_createPublicClient = require('./createPublicClient.cjs');
+exports.createPublicClient = require_public_createPublicClient.createPublicClient;

package/dist/esm/cms/createAuthManager.mjs CHANGED Viewed

@@ -1,9 +1,12 @@
 import { getOAuthAPI } from "../getIntlayerAPI/oAuth.mjs";
 import { editor } from "@intlayer/config/built";
+import { getEditorClientSecret } from "@intlayer/config/secrets";
 import { defu } from "defu";
 //#region src/cms/createAuthManager.ts
 const ONE_MINUTE_MS = 6e4;
+/** Whether the current runtime is a browser rather than a server. */
+const isBrowser = () => typeof window !== "undefined";
 /**
 * Resolves the expiration timestamp (in ms since epoch) from an OAuth2
 * token-like payload, supporting both absolute dates and relative durations.
@@ -31,7 +34,10 @@ const getExpiryTimestamp = (token) => {
 */
 const createAuthManager = (intlayerConfig = { editor }, options = {}) => {
 	const { baseFetcherOptions = {}, sessionToken } = options;
-	const resolvedConfig = defu(intlayerConfig ?? {}, { editor });
+	const resolvedConfig = defu(intlayerConfig ?? {}, { editor: {
+		...editor,
+		clientSecret: editor?.clientId ? getEditorClientSecret() : void 0
+	} });
 	const fetcherOptions = {
 		...baseFetcherOptions,
 		credentials: "omit"
@@ -77,6 +83,9 @@ const createAuthManager = (intlayerConfig = { editor }, options = {}) => {
 		expiryTimestamp = void 0;
 	};
 	const withAuth = (method, skipAuth = !hasCredentials) => {
+		if (skipAuth && !sessionToken && isBrowser()) return async () => {
+			throw new Error("Intlayer CMS credentials are not available in the browser. `clientSecret` is a server-side credential and is never bundled. Call this from a server route, or pass a user session token: createIntlayerCMS(config, { sessionToken }).");
+		};
 		if (skipAuth) return method;
 		return async (...args) => {
 			await ensureAuth();

package/dist/esm/cms/createAuthManager.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"createAuthManager.mjs","names":[],"sources":["../../../src/cms/createAuthManager.ts"],"sourcesContent":["import { editor } from '@intlayer/config/built';\nimport type { IntlayerConfig } from '@intlayer/types/config';\nimport { defu } from 'defu';\nimport type { FetcherOptions } from '../fetcher';\nimport { getOAuthAPI } from '../getIntlayerAPI/oAuth';\n\n/*\n Shape of the various OAuth2 token payloads the backend may return. Only the\n * fields used to derive the expiration timestamp are described here.\n /\ntype OAuthTokenLike = {\n accessToken?: string;\n accessTokenExpiresAt?: string \| Date;\n expires_in?: number;\n expiresIn?: number;\n expiresAt?: string \| Date;\n};\n\n/\n Any asynchronous API method exposed by a domain section\n * (e.g. `getDictionaries`, `pushDictionaries`).\n /\ntype AsyncMethod<Arguments extends unknown[], Result> = (\n ...args: Arguments\n) => Promise<Result>;\n\n/\n A domain section factory: builds a plain object of async methods from shared\n * fetcher options and the Intlayer configuration.\n /\ntype SectionFactory<Section extends Record<string, unknown>> = (\n fetcherOptions: FetcherOptions,\n intlayerConfig: IntlayerConfig\n) => Section;\n\nconst ONE_MINUTE_MS = 60_000;\n\n/\n Resolves the expiration timestamp (in ms since epoch) from an OAuth2\n * token-like payload, supporting both absolute dates and relative durations.\n /\nconst getExpiryTimestamp = (\n token: OAuthTokenLike \| undefined\n): number \| undefined => {\n if (!token) return undefined;\n\n const dateLike = (token.accessTokenExpiresAt ?? token.expiresAt) as\n \| string\n \| Date\n \| undefined;\n\n if (dateLike) {\n const timestamp =\n typeof dateLike === 'string'\n ? Date.parse(dateLike)\n : dateLike.getTime?.();\n if (typeof timestamp === 'number' && Number.isFinite(timestamp)) {\n return timestamp;\n }\n }\n\n const seconds = token.expires_in ?? token.expiresIn;\n if (typeof seconds === 'number' && Number.isFinite(seconds)) {\n return Date.now() + seconds 1000;\n }\n\n return undefined;\n};\n\n/*\n Options accepted when creating an {@link AuthManager}.\n /\nexport type AuthManagerOptions = {\n /\n Base fetcher options merged into every request (e.g. custom headers).\n /\n baseFetcherOptions?: FetcherOptions;\n /\n A pre-issued CLI session token (prefixed with `clisession_`). When provided,\n * it is used directly as the Bearer token and the OAuth2 `client_credentials`\n * exchange is skipped entirely.\n /\n sessionToken?: string;\n};\n\n/\n Options accepted when binding a domain section to an {@link AuthManager}.\n /\nexport type BindSectionOptions = {\n /\n Forces auth injection on (`false`) or off (`true`). Defaults to enabled\n * whenever credentials are available.\n /\n skipAuth?: boolean;\n};\n\n/\n Manages CMS authentication for a set of API calls.\n \n The manager owns a single mutable {@link FetcherOptions} object\n * (`fetcherOptions`). Domain factories bound through it share the same\n * reference, so refreshing the token in place transparently authenticates every\n * call — without rebuilding the API clients.\n /\nexport type AuthManager = {\n /\n Mutable fetcher options carrying the `Authorization` header. Bound sections\n * share this reference so the injected token is reused everywhere.\n /\n fetcherOptions: FetcherOptions;\n /\n The resolved Intlayer configuration (merged with the build-time defaults).\n /\n intlayerConfig: IntlayerConfig;\n /\n `true` when credentials are available — either a session token or a\n * `clientId`/`clientSecret` pair in the configuration.\n /\n hasCredentials: boolean;\n /\n Ensures a valid access token is available and applies it to\n * `fetcherOptions`. Called automatically by {@link withAuth}.\n /\n ensureAuth: () => Promise<void>;\n /\n Forces a token refresh on the next call by clearing the cached token.\n /\n reset: () => void;\n /\n Wraps a single API method so it injects (and, on failure, refreshes) the\n * access token on every invocation while preserving the method's signature.\n /\n withAuth: <Arguments extends unknown[], Result>(\n method: AsyncMethod<Arguments, Result>,\n skipAuth?: boolean\n ) => AsyncMethod<Arguments, Result>;\n /\n Instantiates a domain factory with the managed fetcher options and config,\n * returning a section whose every method authenticates automatically.\n \n @example\n * ```ts\n * const dictionary = authManager.bindSection(getDictionaryAPI);\n * await dictionary.pushDictionaries(dictionaries);\n * ```\n /\n bindSection: <Section extends Record<string, unknown>>(\n factory: SectionFactory<Section>,\n options?: BindSectionOptions\n ) => Section;\n};\n\n/\n Creates an instance-scoped {@link AuthManager} handling the OAuth2\n * `client_credentials` flow (or a pre-issued CLI session token).\n \n Unlike a global token cache, each manager keeps its own token state, so\n * independent SDK instances never interfere with one another.\n \n @param intlayerConfig - Intlayer configuration carrying the `editor`\n * credentials. Defaults to the build-time configuration.\n * @param options - Optional session token and base fetcher options.\n */\nexport const createAuthManager = (\n intlayerConfig: Pick<IntlayerConfig, 'editor'> = { editor },\n options: AuthManagerOptions = {}\n): AuthManager => {\n const { baseFetcherOptions = {}, sessionToken } = options;\n\n const resolvedConfig = defu(intlayerConfig ?? {}, {\n editor,\n }) as IntlayerConfig;\n\n // `credentials: 'omit'` prevents the browser from attaching session cookies;\n // authentication is handled exclusively through the injected Bearer token.\n // This is required because the backend only allows credentialed requests for\n // whitelisted first-party origins.\n const fetcherOptions: FetcherOptions = {\n ...baseFetcherOptions,\n credentials: 'omit',\n };\n\n const hasCredentials =\n Boolean(sessionToken) \|\|\n Boolean(\n resolvedConfig?.editor?.clientId && resolvedConfig?.editor?.clientSecret\n );\n\n // A session token is used as-is and never expires within the SDK's concern,\n // so inject it once up-front and skip the OAuth2 exchange.\n if (sessionToken) {\n fetcherOptions.headers = {\n ...(fetcherOptions.headers ?? {}),\n Authorization: `Bearer ${sessionToken}`,\n } as HeadersInit;\n }\n\n let accessToken: string \| undefined;\n let expiryTimestamp: number \| undefined;\n let pendingRefresh: Promise<void> \| undefined;\n\n const needsRefresh = (): boolean => {\n if (!accessToken) return true;\n if (!expiryTimestamp) return false; // Unknown expiry: assume usable until failure.\n\n // Refresh one minute before the actual expiry to avoid edge-of-expiry races.\n return Date.now() + ONE_MINUTE_MS >= expiryTimestamp;\n };\n\n const refreshToken = async (): Promise<void> => {\n const doRefresh = async (): Promise<void> => {\n const oAuthAPI = getOAuthAPI({}, resolvedConfig);\n const response = await oAuthAPI.getOAuth2AccessToken();\n const tokenData = response?.data as OAuthTokenLike \| undefined;\n\n accessToken = tokenData?.accessToken;\n expiryTimestamp = getExpiryTimestamp(tokenData);\n };\n\n // De-duplicate concurrent refreshes so a burst of calls triggers one fetch.\n pendingRefresh ??= doRefresh().finally(() => {\n pendingRefresh = undefined;\n });\n\n await pendingRefresh;\n };\n\n const applyAuthHeader = (): void => {\n if (!accessToken) return;\n fetcherOptions.headers = {\n ...(fetcherOptions.headers ?? {}),\n Authorization: `Bearer ${accessToken}`,\n } as HeadersInit;\n };\n\n const ensureAuth = async (): Promise<void> => {\n if (sessionToken) return; // Already injected; nothing to refresh.\n if (needsRefresh()) {\n await refreshToken();\n }\n applyAuthHeader();\n };\n\n const reset = (): void => {\n accessToken = undefined;\n expiryTimestamp = undefined;\n };\n\n const withAuth = <Arguments extends unknown[], Result>(\n method: AsyncMethod<Arguments, Result>,\n skipAuth = !hasCredentials\n ): AsyncMethod<Arguments, Result> => {\n if (skipAuth) return method;\n\n return async (...args: Arguments): Promise<Result> => {\n await ensureAuth();\n\n try {\n return await method(...args);\n } catch (error) {\n // The token may have been revoked or expired early: refresh once and\n // retry before surfacing the error. A session token cannot be\n // refreshed, so re-throw immediately in that case.\n if (sessionToken) throw error;\n\n await refreshToken();\n applyAuthHeader();\n return await method(...args);\n }\n };\n };\n\n const bindSection = <Section extends Record<string, unknown>>(\n factory: SectionFactory<Section>,\n bindOptions: BindSectionOptions = {}\n ): Section => {\n const section = factory(fetcherOptions, resolvedConfig);\n const skipAuth = bindOptions.skipAuth ?? !hasCredentials;\n\n return new Proxy(section, {\n get(target, property, receiver) {\n const value = Reflect.get(target, property, receiver);\n\n if (typeof value !== 'function') return value;\n\n return withAuth(\n (value as AsyncMethod<unknown[], unknown>).bind(target),\n skipAuth\n );\n },\n });\n };\n\n return {\n fetcherOptions,\n intlayerConfig: resolvedConfig,\n hasCredentials,\n ensureAuth,\n reset,\n withAuth,\n bindSection,\n };\n};\n"],"mappings":";;;;;AAmCA,MAAM,gBAAgB;;;;;AAMtB,MAAM,sBACJ,UACuB;CACvB,IAAI,CAAC,OAAO,OAAO;CAEnB,MAAM,WAAY,MAAM,wBAAwB,MAAM;CAKtD,IAAI,UAAU;EACZ,MAAM,YACJ,OAAO,aAAa,WAChB,KAAK,MAAM,QAAQ,IACnB,SAAS,UAAU;EACzB,IAAI,OAAO,cAAc,YAAY,OAAO,SAAS,SAAS,GAC5D,OAAO;CAEX;CAEA,MAAM,UAAU,MAAM,cAAc,MAAM;CAC1C,IAAI,OAAO,YAAY,YAAY,OAAO,SAAS,OAAO,GACxD,OAAO,KAAK,IAAI,IAAI,UAAU;AAIlC;;;;;;;;;;;;AAgGA,MAAa,qBACX,iBAAiD,EAAE,OAAO,GAC1D,UAA8B,CAAC,MACf;CAChB,MAAM,EAAE,qBAAqB,CAAC,GAAG,iBAAiB;CAElD,MAAM,iBAAiB,KAAK,kBAAkB,CAAC,GAAG,EAChD,OACF,CAAC;CAMD,MAAM,iBAAiC;EACrC,GAAG;EACH,aAAa;CACf;CAEA,MAAM,iBACJ,QAAQ,YAAY,KACpB,QACE,gBAAgB,QAAQ,YAAY,gBAAgB,QAAQ,YAC9D;CAIF,IAAI,cACF,eAAe,UAAU;EACvB,GAAI,eAAe,WAAW,CAAC;EAC/B,eAAe,UAAU;CAC3B;CAGF,IAAI;CACJ,IAAI;CACJ,IAAI;CAEJ,MAAM,qBAA8B;EAClC,IAAI,CAAC,aAAa,OAAO;EACzB,IAAI,CAAC,iBAAiB,OAAO;EAG7B,OAAO,KAAK,IAAI,IAAI,iBAAiB;CACvC;CAEA,MAAM,eAAe,YAA2B;EAC9C,MAAM,YAAY,YAA2B;GAG3C,MAAM,aAAY,MAFD,YAAY,CAAC,GAAG,cACH,CAAC,CAAC,qBAAqB,EAC3B,EAAE;GAE5B,cAAc,WAAW;GACzB,kBAAkB,mBAAmB,SAAS;EAChD;EAGA,mBAAmB,UAAU,CAAC,CAAC,cAAc;GAC3C,iBAAiB;EACnB,CAAC;EAED,MAAM;CACR;CAEA,MAAM,wBAA8B;EAClC,IAAI,CAAC,aAAa;EAClB,eAAe,UAAU;GACvB,GAAI,eAAe,WAAW,CAAC;GAC/B,eAAe,UAAU;EAC3B;CACF;CAEA,MAAM,aAAa,YAA2B;EAC5C,IAAI,cAAc;EAClB,IAAI,aAAa,GACf,MAAM,aAAa;EAErB,gBAAgB;CAClB;CAEA,MAAM,cAAoB;EACxB,cAAc;EACd,kBAAkB;CACpB;CAEA,MAAM,YACJ,QACA,WAAW,CAAC,mBACuB;EACnC,IAAI,UAAU,OAAO;EAErB,OAAO,OAAO,GAAG,SAAqC;GACpD,MAAM,WAAW;GAEjB,IAAI;IACF,OAAO,MAAM,OAAO,GAAG,IAAI;GAC7B,SAAS,OAAO;IAId,IAAI,cAAc,MAAM;IAExB,MAAM,aAAa;IACnB,gBAAgB;IAChB,OAAO,MAAM,OAAO,GAAG,IAAI;GAC7B;EACF;CACF;CAEA,MAAM,eACJ,SACA,cAAkC,CAAC,MACvB;EACZ,MAAM,UAAU,QAAQ,gBAAgB,cAAc;EACtD,MAAM,WAAW,YAAY,YAAY,CAAC;EAE1C,OAAO,IAAI,MAAM,SAAS,EACxB,IAAI,QAAQ,UAAU,UAAU;GAC9B,MAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU,QAAQ;GAEpD,IAAI,OAAO,UAAU,YAAY,OAAO;GAExC,OAAO,SACJ,MAA0C,KAAK,MAAM,GACtD,QACF;EACF,EACF,CAAC;CACH;CAEA,OAAO;EACL;EACA,gBAAgB;EAChB;EACA;EACA;EACA;EACA;CACF;AACF"}
1	+ {"version":3,"file":"createAuthManager.mjs","names":[],"sources":["../../../src/cms/createAuthManager.ts"],"sourcesContent":["import { editor } from '@intlayer/config/built';\nimport { getEditorClientSecret } from '@intlayer/config/secrets';\nimport type { IntlayerConfig } from '@intlayer/types/config';\nimport { defu } from 'defu';\nimport type { FetcherOptions } from '../fetcher';\nimport { getOAuthAPI } from '../getIntlayerAPI/oAuth';\n\n/*\n Shape of the various OAuth2 token payloads the backend may return. Only the\n * fields used to derive the expiration timestamp are described here.\n /\ntype OAuthTokenLike = {\n accessToken?: string;\n accessTokenExpiresAt?: string \| Date;\n expires_in?: number;\n expiresIn?: number;\n expiresAt?: string \| Date;\n};\n\n/\n Any asynchronous API method exposed by a domain section\n * (e.g. `getDictionaries`, `pushDictionaries`).\n /\ntype AsyncMethod<Arguments extends unknown[], Result> = (\n ...args: Arguments\n) => Promise<Result>;\n\n/\n A domain section factory: builds a plain object of async methods from shared\n * fetcher options and the Intlayer configuration.\n /\ntype SectionFactory<Section extends Record<string, unknown>> = (\n fetcherOptions: FetcherOptions,\n intlayerConfig: IntlayerConfig\n) => Section;\n\nconst ONE_MINUTE_MS = 60_000;\n\n/* Whether the current runtime is a browser rather than a server. /\nconst isBrowser = (): boolean => typeof window !== 'undefined';\n\n/\n Resolves the expiration timestamp (in ms since epoch) from an OAuth2\n * token-like payload, supporting both absolute dates and relative durations.\n /\nconst getExpiryTimestamp = (\n token: OAuthTokenLike \| undefined\n): number \| undefined => {\n if (!token) return undefined;\n\n const dateLike = (token.accessTokenExpiresAt ?? token.expiresAt) as\n \| string\n \| Date\n \| undefined;\n\n if (dateLike) {\n const timestamp =\n typeof dateLike === 'string'\n ? Date.parse(dateLike)\n : dateLike.getTime?.();\n if (typeof timestamp === 'number' && Number.isFinite(timestamp)) {\n return timestamp;\n }\n }\n\n const seconds = token.expires_in ?? token.expiresIn;\n if (typeof seconds === 'number' && Number.isFinite(seconds)) {\n return Date.now() + seconds 1000;\n }\n\n return undefined;\n};\n\n/*\n Options accepted when creating an {@link AuthManager}.\n /\nexport type AuthManagerOptions = {\n /\n Base fetcher options merged into every request (e.g. custom headers).\n /\n baseFetcherOptions?: FetcherOptions;\n /\n A pre-issued CLI session token (prefixed with `clisession_`). When provided,\n * it is used directly as the Bearer token and the OAuth2 `client_credentials`\n * exchange is skipped entirely.\n /\n sessionToken?: string;\n};\n\n/\n Options accepted when binding a domain section to an {@link AuthManager}.\n /\nexport type BindSectionOptions = {\n /\n Forces auth injection on (`false`) or off (`true`). Defaults to enabled\n * whenever credentials are available.\n /\n skipAuth?: boolean;\n};\n\n/\n Manages CMS authentication for a set of API calls.\n \n The manager owns a single mutable {@link FetcherOptions} object\n * (`fetcherOptions`). Domain factories bound through it share the same\n * reference, so refreshing the token in place transparently authenticates every\n * call — without rebuilding the API clients.\n /\nexport type AuthManager = {\n /\n Mutable fetcher options carrying the `Authorization` header. Bound sections\n * share this reference so the injected token is reused everywhere.\n /\n fetcherOptions: FetcherOptions;\n /\n The resolved Intlayer configuration (merged with the build-time defaults).\n /\n intlayerConfig: IntlayerConfig;\n /\n `true` when credentials are available — either a session token or a\n * `clientId`/`clientSecret` pair in the configuration.\n /\n hasCredentials: boolean;\n /\n Ensures a valid access token is available and applies it to\n * `fetcherOptions`. Called automatically by {@link withAuth}.\n /\n ensureAuth: () => Promise<void>;\n /\n Forces a token refresh on the next call by clearing the cached token.\n /\n reset: () => void;\n /\n Wraps a single API method so it injects (and, on failure, refreshes) the\n * access token on every invocation while preserving the method's signature.\n /\n withAuth: <Arguments extends unknown[], Result>(\n method: AsyncMethod<Arguments, Result>,\n skipAuth?: boolean\n ) => AsyncMethod<Arguments, Result>;\n /\n Instantiates a domain factory with the managed fetcher options and config,\n * returning a section whose every method authenticates automatically.\n \n @example\n * ```ts\n * const dictionary = authManager.bindSection(getDictionaryAPI);\n * await dictionary.pushDictionaries(dictionaries);\n * ```\n /\n bindSection: <Section extends Record<string, unknown>>(\n factory: SectionFactory<Section>,\n options?: BindSectionOptions\n ) => Section;\n};\n\n/\n Creates an instance-scoped {@link AuthManager} handling the OAuth2\n * `client_credentials` flow (or a pre-issued CLI session token).\n \n Unlike a global token cache, each manager keeps its own token state, so\n * independent SDK instances never interfere with one another.\n \n @param intlayerConfig - Intlayer configuration carrying the `editor`\n * credentials. Defaults to the build-time configuration.\n * @param options - Optional session token and base fetcher options.\n /\nexport const createAuthManager = (\n intlayerConfig: Pick<IntlayerConfig, 'editor'> = { editor },\n options: AuthManagerOptions = {}\n): AuthManager => {\n const { baseFetcherOptions = {}, sessionToken } = options;\n\n // `editor` comes from the generated build-time configuration, which never\n // carries `clientSecret` — it would be inlined into client bundles. The\n // secret is supplied server-side by `@intlayer/config/secrets`, which\n // resolves to an inert stub in the browser; `hasCredentials` then stays false\n // there and the OAuth2 exchange never runs.\n //\n // Only consulted when the configuration declares a `clientId`, so a project\n // that comments its credentials out stays uncredentialed even with the\n // environment variables still defined.\n const resolvedConfig = defu(intlayerConfig ?? {}, {\n editor: {\n ...editor,\n clientSecret: editor?.clientId ? getEditorClientSecret() : undefined,\n },\n }) as IntlayerConfig;\n\n // `credentials: 'omit'` prevents the browser from attaching session cookies;\n // authentication is handled exclusively through the injected Bearer token.\n // This is required because the backend only allows credentialed requests for\n // whitelisted first-party origins.\n const fetcherOptions: FetcherOptions = {\n ...baseFetcherOptions,\n credentials: 'omit',\n };\n\n const hasCredentials =\n Boolean(sessionToken) \|\|\n Boolean(\n resolvedConfig?.editor?.clientId && resolvedConfig?.editor?.clientSecret\n );\n\n // A session token is used as-is and never expires within the SDK's concern,\n // so inject it once up-front and skip the OAuth2 exchange.\n if (sessionToken) {\n fetcherOptions.headers = {\n ...(fetcherOptions.headers ?? {}),\n Authorization: `Bearer ${sessionToken}`,\n } as HeadersInit;\n }\n\n let accessToken: string \| undefined;\n let expiryTimestamp: number \| undefined;\n let pendingRefresh: Promise<void> \| undefined;\n\n const needsRefresh = (): boolean => {\n if (!accessToken) return true;\n if (!expiryTimestamp) return false; // Unknown expiry: assume usable until failure.\n\n // Refresh one minute before the actual expiry to avoid edge-of-expiry races.\n return Date.now() + ONE_MINUTE_MS >= expiryTimestamp;\n };\n\n const refreshToken = async (): Promise<void> => {\n const doRefresh = async (): Promise<void> => {\n const oAuthAPI = getOAuthAPI({}, resolvedConfig);\n const response = await oAuthAPI.getOAuth2AccessToken();\n const tokenData = response?.data as OAuthTokenLike \| undefined;\n\n accessToken = tokenData?.accessToken;\n expiryTimestamp = getExpiryTimestamp(tokenData);\n };\n\n // De-duplicate concurrent refreshes so a burst of calls triggers one fetch.\n pendingRefresh ??= doRefresh().finally(() => {\n pendingRefresh = undefined;\n });\n\n await pendingRefresh;\n };\n\n const applyAuthHeader = (): void => {\n if (!accessToken) return;\n fetcherOptions.headers = {\n ...(fetcherOptions.headers ?? {}),\n Authorization: `Bearer ${accessToken}`,\n } as HeadersInit;\n };\n\n const ensureAuth = async (): Promise<void> => {\n if (sessionToken) return; // Already injected; nothing to refresh.\n if (needsRefresh()) {\n await refreshToken();\n }\n applyAuthHeader();\n };\n\n const reset = (): void => {\n accessToken = undefined;\n expiryTimestamp = undefined;\n };\n\n const withAuth = <Arguments extends unknown[], Result>(\n method: AsyncMethod<Arguments, Result>,\n skipAuth = !hasCredentials\n ): AsyncMethod<Arguments, Result> => {\n // In a browser the project credentials are structurally unavailable, so an\n // authenticated call would silently go out unauthenticated and come back\n // 401. Fail with an actionable message instead: a browser must authenticate\n // as the signed-in user* (a session token, or the session cookie on a\n // first-party origin), never as the project.\n if (skipAuth && !sessionToken && isBrowser()) {\n return async () => {\n throw new Error(\n 'Intlayer CMS credentials are not available in the browser. ' +\n '`clientSecret` is a server-side credential and is never bundled. ' +\n 'Call this from a server route, or pass a user session token: ' +\n 'createIntlayerCMS(config, { sessionToken }).'\n );\n };\n }\n\n if (skipAuth) return method;\n\n return async (...args: Arguments): Promise<Result> => {\n await ensureAuth();\n\n try {\n return await method(...args);\n } catch (error) {\n // The token may have been revoked or expired early: refresh once and\n // retry before surfacing the error. A session token cannot be\n // refreshed, so re-throw immediately in that case.\n if (sessionToken) throw error;\n\n await refreshToken();\n applyAuthHeader();\n return await method(...args);\n }\n };\n };\n\n const bindSection = <Section extends Record<string, unknown>>(\n factory: SectionFactory<Section>,\n bindOptions: BindSectionOptions = {}\n ): Section => {\n const section = factory(fetcherOptions, resolvedConfig);\n const skipAuth = bindOptions.skipAuth ?? !hasCredentials;\n\n return new Proxy(section, {\n get(target, property, receiver) {\n const value = Reflect.get(target, property, receiver);\n\n if (typeof value !== 'function') return value;\n\n return withAuth(\n (value as AsyncMethod<unknown[], unknown>).bind(target),\n skipAuth\n );\n },\n });\n };\n\n return {\n fetcherOptions,\n intlayerConfig: resolvedConfig,\n hasCredentials,\n ensureAuth,\n reset,\n withAuth,\n bindSection,\n };\n};\n"],"mappings":";;;;;;AAoCA,MAAM,gBAAgB;;AAGtB,MAAM,kBAA2B,OAAO,WAAW;;;;;AAMnD,MAAM,sBACJ,UACuB;CACvB,IAAI,CAAC,OAAO,OAAO;CAEnB,MAAM,WAAY,MAAM,wBAAwB,MAAM;CAKtD,IAAI,UAAU;EACZ,MAAM,YACJ,OAAO,aAAa,WAChB,KAAK,MAAM,QAAQ,IACnB,SAAS,UAAU;EACzB,IAAI,OAAO,cAAc,YAAY,OAAO,SAAS,SAAS,GAC5D,OAAO;CAEX;CAEA,MAAM,UAAU,MAAM,cAAc,MAAM;CAC1C,IAAI,OAAO,YAAY,YAAY,OAAO,SAAS,OAAO,GACxD,OAAO,KAAK,IAAI,IAAI,UAAU;AAIlC;;;;;;;;;;;;AAgGA,MAAa,qBACX,iBAAiD,EAAE,OAAO,GAC1D,UAA8B,CAAC,MACf;CAChB,MAAM,EAAE,qBAAqB,CAAC,GAAG,iBAAiB;CAWlD,MAAM,iBAAiB,KAAK,kBAAkB,CAAC,GAAG,EAChD,QAAQ;EACN,GAAG;EACH,cAAc,QAAQ,WAAW,sBAAsB,IAAI;CAC7D,EACF,CAAC;CAMD,MAAM,iBAAiC;EACrC,GAAG;EACH,aAAa;CACf;CAEA,MAAM,iBACJ,QAAQ,YAAY,KACpB,QACE,gBAAgB,QAAQ,YAAY,gBAAgB,QAAQ,YAC9D;CAIF,IAAI,cACF,eAAe,UAAU;EACvB,GAAI,eAAe,WAAW,CAAC;EAC/B,eAAe,UAAU;CAC3B;CAGF,IAAI;CACJ,IAAI;CACJ,IAAI;CAEJ,MAAM,qBAA8B;EAClC,IAAI,CAAC,aAAa,OAAO;EACzB,IAAI,CAAC,iBAAiB,OAAO;EAG7B,OAAO,KAAK,IAAI,IAAI,iBAAiB;CACvC;CAEA,MAAM,eAAe,YAA2B;EAC9C,MAAM,YAAY,YAA2B;GAG3C,MAAM,aAAY,MAFD,YAAY,CAAC,GAAG,cACH,CAAC,CAAC,qBAAqB,EAC3B,EAAE;GAE5B,cAAc,WAAW;GACzB,kBAAkB,mBAAmB,SAAS;EAChD;EAGA,mBAAmB,UAAU,CAAC,CAAC,cAAc;GAC3C,iBAAiB;EACnB,CAAC;EAED,MAAM;CACR;CAEA,MAAM,wBAA8B;EAClC,IAAI,CAAC,aAAa;EAClB,eAAe,UAAU;GACvB,GAAI,eAAe,WAAW,CAAC;GAC/B,eAAe,UAAU;EAC3B;CACF;CAEA,MAAM,aAAa,YAA2B;EAC5C,IAAI,cAAc;EAClB,IAAI,aAAa,GACf,MAAM,aAAa;EAErB,gBAAgB;CAClB;CAEA,MAAM,cAAoB;EACxB,cAAc;EACd,kBAAkB;CACpB;CAEA,MAAM,YACJ,QACA,WAAW,CAAC,mBACuB;EAMnC,IAAI,YAAY,CAAC,gBAAgB,UAAU,GACzC,OAAO,YAAY;GACjB,MAAM,IAAI,MACR,uOAIF;EACF;EAGF,IAAI,UAAU,OAAO;EAErB,OAAO,OAAO,GAAG,SAAqC;GACpD,MAAM,WAAW;GAEjB,IAAI;IACF,OAAO,MAAM,OAAO,GAAG,IAAI;GAC7B,SAAS,OAAO;IAId,IAAI,cAAc,MAAM;IAExB,MAAM,aAAa;IACnB,gBAAgB;IAChB,OAAO,MAAM,OAAO,GAAG,IAAI;GAC7B;EACF;CACF;CAEA,MAAM,eACJ,SACA,cAAkC,CAAC,MACvB;EACZ,MAAM,UAAU,QAAQ,gBAAgB,cAAc;EACtD,MAAM,WAAW,YAAY,YAAY,CAAC;EAE1C,OAAO,IAAI,MAAM,SAAS,EACxB,IAAI,QAAQ,UAAU,UAAU;GAC9B,MAAM,QAAQ,QAAQ,IAAI,QAAQ,UAAU,QAAQ;GAEpD,IAAI,OAAO,UAAU,YAAY,OAAO;GAExC,OAAO,SACJ,MAA0C,KAAK,MAAM,GACtD,QACF;EACF,EACF,CAAC;CACH;CAEA,OAAO;EACL;EACA,gBAAgB;EAChB;EACA;EACA;EACA;EACA;CACF;AACF"}

package/dist/esm/getIntlayerAPI/analytics.mjs CHANGED Viewed

@@ -22,13 +22,14 @@ const getAnalyticsAPI = (authAPIOptions = {}, intlayerConfig) => {
 	const getOverview = async (otherOptions = {}) => await fetcher(`${ANALYTICS_API_ROUTE}/overview`, authAPIOptions, otherOptions, { method: "GET" });
 	/**
 	* Audience report: distinct visitors (today / 7d / window), page views, the
-	* daily evolution series, and locale + country breakdowns.
-	* @param days - Rolling window size in days (default 30).
+	* evolution series, and locale + country breakdowns.
+	* @param range - Rolling window, either a named range (`1h`, `24h`, `7d`,
+	*   `30d`, `90d`, `6mo`, `1y`, `3y`) or a number of days (default 30).
 	* @returns The audience statistics.
 	*/
-	const getAudience = async (days = 30, otherOptions = {}) => await fetcher(`${ANALYTICS_API_ROUTE}/audience`, authAPIOptions, otherOptions, {
+	const getAudience = async (range = 30, otherOptions = {}) => await fetcher(`${ANALYTICS_API_ROUTE}/audience`, authAPIOptions, otherOptions, {
 		method: "GET",
-		params: { days: String(days) }
+		params: typeof range === "number" ? { days: String(range) } : { range }
 	});
 	/**
 	* Per-content exposure totals — "which content is actually shown".

package/dist/esm/getIntlayerAPI/analytics.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"analytics.mjs","names":[],"sources":["../../../src/getIntlayerAPI/analytics.ts"],"sourcesContent":["import type {\n GetAnalyticsOverviewResult,\n GetAudienceResult,\n GetContentStatsResult,\n GetExperimentResultsResult,\n IngestAnalyticsBody,\n IngestAnalyticsResult,\n} from '@intlayer/backend';\nimport { editor } from '@intlayer/config/built';\nimport type { IntlayerConfig } from '@intlayer/types/config';\nimport { createEndpoint } from '../cms/createIntlayerCMS';\nimport { type FetcherOptions, fetcher } from '../fetcher';\n\nexport const getAnalyticsAPI = (\n authAPIOptions: FetcherOptions = {},\n intlayerConfig?: IntlayerConfig\n) => {\n const backendURL = intlayerConfig?.editor?.backendURL ?? editor.backendURL;\n\n const ANALYTICS_API_ROUTE = `${backendURL}/api/analytics`;\n\n /*\n Ingest a batch of analytics events. Public — attribution is by the\n * project's `clientId` in the body.\n * @param body - Session id, sdk version, and the collected events.\n * @returns The number of accepted events.\n /\n const sendEvents = async (\n body: IngestAnalyticsBody,\n otherOptions: FetcherOptions = {}\n ) =>\n await fetcher<IngestAnalyticsResult>(\n `${ANALYTICS_API_ROUTE}/events`,\n authAPIOptions,\n otherOptions,\n {\n method: 'POST',\n body,\n }\n );\n\n /\n Page/locale totals for the authenticated project.\n * @returns Views grouped by url and locale.\n /\n const getOverview = async (otherOptions: FetcherOptions = {}) =>\n await fetcher<GetAnalyticsOverviewResult>(\n `${ANALYTICS_API_ROUTE}/overview`,\n authAPIOptions,\n otherOptions,\n { method: 'GET' }\n );\n\n /\n Audience report: distinct visitors (today / 7d / window), page views, the\n * ~~daily~~ evolution series, and locale + country breakdowns.\n * @param ~~days~~ - Rolling window ~~size~~ in days (default 30).\n * @returns The audience statistics.\n /\n const getAudience = async (~~days~~ = 30, otherOptions: FetcherOptions = {}) =>\n await fetcher<GetAudienceResult>(\n `${ANALYTICS_API_ROUTE}/audience`,\n authAPIOptions,\n otherOptions,\n {\n method: 'GET',\n params: { days: String(~~days~~) },\n }\n );\n\n /\n Per-content exposure totals — \"which content is actually shown\".\n * @returns Exposures grouped by dictionary key, key path, and locale.\n /\n const getContentStats = async (otherOptions: FetcherOptions = {}) =>\n await fetcher<GetContentStatsResult>(\n `${ANALYTICS_API_ROUTE}/content-stats`,\n authAPIOptions,\n otherOptions,\n { method: 'GET' }\n );\n\n /\n A/B experiment results with per-variant conversion rates and significance.\n * @param experimentKey - The experiment to evaluate.\n * @returns The experiment result set.\n /\n const getExperimentResults = async (\n experimentKey: string,\n otherOptions: FetcherOptions = {}\n ) =>\n await fetcher<GetExperimentResultsResult>(\n `${ANALYTICS_API_ROUTE}/experiments/${experimentKey}`,\n authAPIOptions,\n otherOptions,\n { method: 'GET' }\n );\n\n return {\n sendEvents,\n getOverview,\n getAudience,\n getContentStats,\n getExperimentResults,\n };\n};\n\n/\n Authenticated `analytics` endpoint bound to an Intlayer CMS authenticator.\n \n Pass an authenticator created with `createIntlayerCMS`, or omit it to use\n * the build-time configuration (`@intlayer/config/built`).\n */\nexport const analyticsEndpoint = createEndpoint(getAnalyticsAPI);\n"],"mappings":";;;;;~~AAaA~~,MAAa,mBACX,iBAAiC,CAAC,GAClC,mBACG;CAGH,MAAM,sBAAsB,GAFT,gBAAgB,QAAQ,cAAc,OAAO,WAEtB;;;;;;;CAQ1C,MAAM,aAAa,OACjB,MACA,eAA+B,CAAC,MAEhC,MAAM,QACJ,GAAG,oBAAoB,UACvB,gBACA,cACA;EACE,QAAQ;EACR;CACF,CACF;;;;;CAMF,MAAM,cAAc,OAAO,eAA+B,CAAC,MACzD,MAAM,QACJ,GAAG,oBAAoB,YACvB,gBACA,cACA,EAAE,QAAQ,MAAM,CAClB~~;;;;;;;CAQF~~,MAAM,cAAc,~~OAAO~~,~~OAAO~~,~~IAAI~~,eAA+B,CAAC,~~MACpE~~,MAAM,QACJ,GAAG,oBAAoB,YACvB,gBACA,cACA;EACE,QAAQ;EACR,QAAQ,EAAE,MAAM,OAAO,IAAI,EAAE;~~CAC/B~~,CACF;;;;;CAMF,MAAM,kBAAkB,OAAO,eAA+B,CAAC,MAC7D,MAAM,QACJ,GAAG,oBAAoB,iBACvB,gBACA,cACA,EAAE,QAAQ,MAAM,CAClB;;;;;;CAOF,MAAM,uBAAuB,OAC3B,eACA,eAA+B,CAAC,MAEhC,MAAM,QACJ,GAAG,oBAAoB,eAAe,iBACtC,gBACA,cACA,EAAE,QAAQ,MAAM,CAClB;CAEF,OAAO;EACL;EACA;EACA;EACA;EACA;CACF;AACF;;;;;;;AAQA,MAAa,oBAAoB,eAAe,eAAe"}
1	+ {"version":3,"file":"analytics.mjs","names":[],"sources":["../../../src/getIntlayerAPI/analytics.ts"],"sourcesContent":["import type {\n AudienceRange,\n GetAnalyticsOverviewResult,\n GetAudienceResult,\n GetContentStatsResult,\n GetExperimentResultsResult,\n IngestAnalyticsBody,\n IngestAnalyticsResult,\n} from '@intlayer/backend';\nimport { editor } from '@intlayer/config/built';\nimport type { IntlayerConfig } from '@intlayer/types/config';\nimport { createEndpoint } from '../cms/createIntlayerCMS';\nimport { type FetcherOptions, fetcher } from '../fetcher';\n\nexport const getAnalyticsAPI = (\n authAPIOptions: FetcherOptions = {},\n intlayerConfig?: IntlayerConfig\n) => {\n const backendURL = intlayerConfig?.editor?.backendURL ?? editor.backendURL;\n\n const ANALYTICS_API_ROUTE = `${backendURL}/api/analytics`;\n\n /*\n Ingest a batch of analytics events. Public — attribution is by the\n * project's `clientId` in the body.\n * @param body - Session id, sdk version, and the collected events.\n * @returns The number of accepted events.\n /\n const sendEvents = async (\n body: IngestAnalyticsBody,\n otherOptions: FetcherOptions = {}\n ) =>\n await fetcher<IngestAnalyticsResult>(\n `${ANALYTICS_API_ROUTE}/events`,\n authAPIOptions,\n otherOptions,\n {\n method: 'POST',\n body,\n }\n );\n\n /\n Page/locale totals for the authenticated project.\n * @returns Views grouped by url and locale.\n /\n const getOverview = async (otherOptions: FetcherOptions = {}) =>\n await fetcher<GetAnalyticsOverviewResult>(\n `${ANALYTICS_API_ROUTE}/overview`,\n authAPIOptions,\n otherOptions,\n { method: 'GET' }\n );\n\n /\n Audience report: distinct visitors (today / 7d / window), page views, the\n * evolution series, and locale + country breakdowns.\n * @param range - Rolling window, either a named range (`1h`, `24h`, `7d`,\n * `30d`, `90d`, `6mo`, `1y`, `3y`) or a number of days (default 30).\n * @returns The audience statistics.\n /\n const getAudience = async (\n range: AudienceRange \| number = 30,\n otherOptions: FetcherOptions = {}\n ) =>\n await fetcher<GetAudienceResult>(\n `${ANALYTICS_API_ROUTE}/audience`,\n authAPIOptions,\n otherOptions,\n {\n method: 'GET',\n params: typeof range === 'number' ? { days: String(range) } : { range },\n }\n );\n\n /\n Per-content exposure totals — \"which content is actually shown\".\n * @returns Exposures grouped by dictionary key, key path, and locale.\n /\n const getContentStats = async (otherOptions: FetcherOptions = {}) =>\n await fetcher<GetContentStatsResult>(\n `${ANALYTICS_API_ROUTE}/content-stats`,\n authAPIOptions,\n otherOptions,\n { method: 'GET' }\n );\n\n /\n A/B experiment results with per-variant conversion rates and significance.\n * @param experimentKey - The experiment to evaluate.\n * @returns The experiment result set.\n /\n const getExperimentResults = async (\n experimentKey: string,\n otherOptions: FetcherOptions = {}\n ) =>\n await fetcher<GetExperimentResultsResult>(\n `${ANALYTICS_API_ROUTE}/experiments/${experimentKey}`,\n authAPIOptions,\n otherOptions,\n { method: 'GET' }\n );\n\n return {\n sendEvents,\n getOverview,\n getAudience,\n getContentStats,\n getExperimentResults,\n };\n};\n\n/\n Authenticated `analytics` endpoint bound to an Intlayer CMS authenticator.\n \n Pass an authenticator created with `createIntlayerCMS`, or omit it to use\n * the build-time configuration (`@intlayer/config/built`).\n */\nexport const analyticsEndpoint = createEndpoint(getAnalyticsAPI);\n"],"mappings":";;;;;AAcA,MAAa,mBACX,iBAAiC,CAAC,GAClC,mBACG;CAGH,MAAM,sBAAsB,GAFT,gBAAgB,QAAQ,cAAc,OAAO,WAEtB;;;;;;;CAQ1C,MAAM,aAAa,OACjB,MACA,eAA+B,CAAC,MAEhC,MAAM,QACJ,GAAG,oBAAoB,UACvB,gBACA,cACA;EACE,QAAQ;EACR;CACF,CACF;;;;;CAMF,MAAM,cAAc,OAAO,eAA+B,CAAC,MACzD,MAAM,QACJ,GAAG,oBAAoB,YACvB,gBACA,cACA,EAAE,QAAQ,MAAM,CAClB;;;;;;;;CASF,MAAM,cAAc,OAClB,QAAgC,IAChC,eAA+B,CAAC,MAEhC,MAAM,QACJ,GAAG,oBAAoB,YACvB,gBACA,cACA;EACE,QAAQ;EACR,QAAQ,OAAO,UAAU,WAAW,EAAE,MAAM,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM;CACxE,CACF;;;;;CAMF,MAAM,kBAAkB,OAAO,eAA+B,CAAC,MAC7D,MAAM,QACJ,GAAG,oBAAoB,iBACvB,gBACA,cACA,EAAE,QAAQ,MAAM,CAClB;;;;;;CAOF,MAAM,uBAAuB,OAC3B,eACA,eAA+B,CAAC,MAEhC,MAAM,QACJ,GAAG,oBAAoB,eAAe,iBACtC,gBACA,cACA,EAAE,QAAQ,MAAM,CAClB;CAEF,OAAO;EACL;EACA;EACA;EACA;EACA;CACF;AACF;;;;;;;AAQA,MAAa,oBAAoB,eAAe,eAAe"}

package/dist/esm/public/createPublicClient.mjs ADDED Viewed

@@ -0,0 +1,122 @@
+import { editor } from "@intlayer/config/built";
+//#region src/public/createPublicClient.ts
+/**
+* Browser-safe Intlayer client, authenticated without any confidential
+* credential.
+*
+* This is the Google-Analytics model applied to the whole SDK: the page ships
+* only the **public** `editor.clientId`, exchanges it for a short-lived scoped
+* token, and calls the API directly. No server route, no server action, and no
+* `clientSecret` in the bundle.
+*
+* What it can do is deliberately narrow, and that is what makes shipping the
+* key safe: read the project's published dictionary content — the content the
+* page already renders — and submit analytics events. Writing content, reading
+* a project, an organization or a user still require a real credential
+* (server-side) or a signed-in user.
+*
+* @example
+* ```ts
+* import { createPublicClient } from '@intlayer/api/public';
+*
+* const client = createPublicClient();
+*
+* const keys = await client.getDictionaryKeys();
+* const [dictionary] = await client.getDictionaries(['navbar']);
+* ```
+*/
+/** `sessionStorage` key holding the cached token for this tab. */
+const TOKEN_STORAGE_KEY = "__intlayer_public_token__";
+/**
+* Refresh margin: a token within this window of expiry is treated as expired,
+* so a request is never sent with a token that dies in flight.
+*/
+const EXPIRY_MARGIN_MS = 6e4;
+/** Reads the cached token for this tab, ignoring an unusable cache. */
+const readStoredToken = () => {
+	try {
+		const raw = globalThis.sessionStorage?.getItem(TOKEN_STORAGE_KEY);
+		if (!raw) return null;
+		const parsed = JSON.parse(raw);
+		if (typeof parsed?.token !== "string") return null;
+		if (typeof parsed?.expiresAt !== "number") return null;
+		return parsed;
+	} catch {
+		return null;
+	}
+};
+/** Persists the token for this tab. Best-effort: storage may be unavailable. */
+const writeStoredToken = (cached) => {
+	try {
+		globalThis.sessionStorage?.setItem(TOKEN_STORAGE_KEY, JSON.stringify(cached));
+	} catch {}
+};
+/**
+* Creates a {@link PublicClient} for the configured project.
+*
+* @param options - Optional configuration override.
+* @returns A client that authenticates itself with the public project key.
+*/
+const createPublicClient = ({ intlayerConfig } = {}) => {
+	const resolvedEditor = intlayerConfig?.editor ?? editor;
+	const backendURL = (resolvedEditor?.backendURL ?? "").replace(/\/$/, "");
+	const clientId = resolvedEditor?.clientId;
+	let cached = null;
+	let pendingExchange = null;
+	const isUsable = (candidate) => candidate !== null && candidate.expiresAt - EXPIRY_MARGIN_MS > Date.now();
+	const exchange = async () => {
+		const response = await fetch(`${backendURL}/api/public/token`, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({ clientId }),
+			credentials: "omit",
+			mode: "cors"
+		});
+		if (!response.ok) return null;
+		const payload = await response.json();
+		const token = payload?.data?.token;
+		const expiresIn = payload?.data?.expiresIn ?? 0;
+		if (!token || expiresIn <= 0) return null;
+		cached = {
+			token,
+			expiresAt: Date.now() + expiresIn * 1e3
+		};
+		writeStoredToken(cached);
+		return token;
+	};
+	const getToken = async () => {
+		if (isUsable(cached)) return cached.token;
+		const stored = readStoredToken();
+		if (isUsable(stored)) {
+			cached = stored;
+			return stored.token;
+		}
+		if (!clientId) return null;
+		pendingExchange ??= exchange().finally(() => {
+			pendingExchange = null;
+		});
+		return await pendingExchange;
+	};
+	/** Issues an authorised GET against the public surface. */
+	const request = async (path, fallback) => {
+		const token = await getToken();
+		if (!token) return fallback;
+		const response = await fetch(`${backendURL}/api/public${path}`, {
+			headers: { Authorization: `Bearer ${token}` },
+			credentials: "omit",
+			mode: "cors"
+		});
+		if (!response.ok) return fallback;
+		return (await response.json())?.data ?? fallback;
+	};
+	return {
+		getToken,
+		getDictionaryKeys: () => request("/dictionaries/keys", []),
+		getDictionaries: (keys) => request(`/dictionaries?keys=${encodeURIComponent(keys.join(","))}`, [])
+	};
+};
+//#endregion
+export { createPublicClient };
+//# sourceMappingURL=createPublicClient.mjs.map

package/dist/esm/public/createPublicClient.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"createPublicClient.mjs","names":[],"sources":["../../../src/public/createPublicClient.ts"],"sourcesContent":["import type { DictionaryAPI } from '@intlayer/backend';\nimport { editor } from '@intlayer/config/built';\nimport type { IntlayerConfig } from '@intlayer/types/config';\n\n/**\n * Browser-safe Intlayer client, authenticated without any confidential\n * credential.\n *\n * This is the Google-Analytics model applied to the whole SDK: the page ships\n * only the **public** `editor.clientId`, exchanges it for a short-lived scoped\n * token, and calls the API directly. No server route, no server action, and no\n * `clientSecret` in the bundle.\n *\n * What it can do is deliberately narrow, and that is what makes shipping the\n * key safe: read the project's published dictionary content — the content the\n * page already renders — and submit analytics events. Writing content, reading\n * a project, an organization or a user still require a real credential\n * (server-side) or a signed-in user.\n *\n * @example\n * ```ts\n * import { createPublicClient } from '@intlayer/api/public';\n *\n * const client = createPublicClient();\n *\n * const keys = await client.getDictionaryKeys();\n * const [dictionary] = await client.getDictionaries(['navbar']);\n * ```\n */\n\n/** `sessionStorage` key holding the cached token for this tab. */\nconst TOKEN_STORAGE_KEY = '__intlayer_public_token__';\n\n/**\n * Refresh margin: a token within this window of expiry is treated as expired,\n * so a request is never sent with a token that dies in flight.\n */\nconst EXPIRY_MARGIN_MS = 60 * 1000;\n\ntype CachedToken = {\n token: string;\n /** Epoch milliseconds. */\n expiresAt: number;\n};\n\n/** Reads the cached token for this tab, ignoring an unusable cache. */\nconst readStoredToken = (): CachedToken | null => {\n try {\n const raw = globalThis.sessionStorage?.getItem(TOKEN_STORAGE_KEY);\n if (!raw) return null;\n\n const parsed = JSON.parse(raw) as CachedToken;\n\n if (typeof parsed?.token !== 'string') return null;\n if (typeof parsed?.expiresAt !== 'number') return null;\n\n return parsed;\n } catch {\n // Private mode, disabled storage, or a corrupted entry — start fresh.\n return null;\n }\n};\n\n/** Persists the token for this tab. Best-effort: storage may be unavailable. */\nconst writeStoredToken = (cached: CachedToken): void => {\n try {\n globalThis.sessionStorage?.setItem(\n TOKEN_STORAGE_KEY,\n JSON.stringify(cached)\n );\n } catch {\n /* ignore — the in-memory cache still applies for this page */\n }\n};\n\n/** Options accepted by {@link createPublicClient}. */\nexport type PublicClientOptions = {\n /** Overrides the build-time `editor` configuration. */\n intlayerConfig?: Pick<IntlayerConfig, 'editor'>;\n};\n\n/** The credential-free client returned by {@link createPublicClient}. */\nexport type PublicClient = {\n /**\n * Returns the current token, exchanging the public `clientId` for one when\n * needed. `null` when the project is unknown or the origin is not allowed.\n */\n getToken: () => Promise<string | null>;\n /** Every dictionary key published for the project. */\n getDictionaryKeys: () => Promise<string[]>;\n /**\n * Published dictionary content for the given keys.\n *\n * @param keys - Dictionary keys to fetch (at most 100 per call).\n */\n getDictionaries: (keys: string[]) => Promise<DictionaryAPI[]>;\n};\n\n/**\n * Creates a {@link PublicClient} for the configured project.\n *\n * @param options - Optional configuration override.\n * @returns A client that authenticates itself with the public project key.\n */\nexport const createPublicClient = ({\n intlayerConfig,\n}: PublicClientOptions = {}): PublicClient => {\n const resolvedEditor = intlayerConfig?.editor ?? editor;\n const backendURL = (resolvedEditor?.backendURL ?? '').replace(/\\/$/, '');\n const clientId = resolvedEditor?.clientId;\n\n let cached: CachedToken | null = null;\n let pendingExchange: Promise<string | null> | null = null;\n\n const isUsable = (candidate: CachedToken | null): candidate is CachedToken =>\n candidate !== null && candidate.expiresAt - EXPIRY_MARGIN_MS > Date.now();\n\n const exchange = async (): Promise<string | null> => {\n const response = await fetch(`${backendURL}/api/public/token`, {\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({ clientId }),\n // Authorised by `Origin`, never by cookies.\n credentials: 'omit',\n mode: 'cors',\n });\n\n if (!response.ok) return null;\n\n const payload = (await response.json()) as {\n data?: { token?: string | null; expiresIn?: number };\n };\n\n const token = payload?.data?.token;\n const expiresIn = payload?.data?.expiresIn ?? 0;\n\n if (!token || expiresIn <= 0) return null;\n\n cached = { token, expiresAt: Date.now() + expiresIn * 1000 };\n writeStoredToken(cached);\n\n return token;\n };\n\n const getToken = async (): Promise<string | null> => {\n if (isUsable(cached)) return cached.token;\n\n const stored = readStoredToken();\n if (isUsable(stored)) {\n cached = stored;\n return stored.token;\n }\n\n if (!clientId) return null;\n\n // De-duplicate concurrent exchanges so a burst of calls triggers one fetch.\n pendingExchange ??= exchange().finally(() => {\n pendingExchange = null;\n });\n\n return await pendingExchange;\n };\n\n /** Issues an authorised GET against the public surface. */\n const request = async <Result>(\n path: string,\n fallback: Result\n ): Promise<Result> => {\n const token = await getToken();\n\n if (!token) return fallback;\n\n const response = await fetch(`${backendURL}/api/public${path}`, {\n headers: { Authorization: `Bearer ${token}` },\n credentials: 'omit',\n mode: 'cors',\n });\n\n if (!response.ok) return fallback;\n\n const payload = (await response.json()) as { data?: Result };\n\n return payload?.data ?? fallback;\n };\n\n return {\n getToken,\n getDictionaryKeys: () => request<string[]>('/dictionaries/keys', []),\n getDictionaries: (keys) =>\n request<DictionaryAPI[]>(\n `/dictionaries?keys=${encodeURIComponent(keys.join(','))}`,\n []\n ),\n };\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,MAAM,oBAAoB;;;;;AAM1B,MAAM,mBAAmB;;AASzB,MAAM,wBAA4C;CAChD,IAAI;EACF,MAAM,MAAM,WAAW,gBAAgB,QAAQ,iBAAiB;EAChE,IAAI,CAAC,KAAK,OAAO;EAEjB,MAAM,SAAS,KAAK,MAAM,GAAG;EAE7B,IAAI,OAAO,QAAQ,UAAU,UAAU,OAAO;EAC9C,IAAI,OAAO,QAAQ,cAAc,UAAU,OAAO;EAElD,OAAO;CACT,QAAQ;EAEN,OAAO;CACT;AACF;;AAGA,MAAM,oBAAoB,WAA8B;CACtD,IAAI;EACF,WAAW,gBAAgB,QACzB,mBACA,KAAK,UAAU,MAAM,CACvB;CACF,QAAQ,CAER;AACF;;;;;;;AA+BA,MAAa,sBAAsB,EACjC,mBACuB,CAAC,MAAoB;CAC5C,MAAM,iBAAiB,gBAAgB,UAAU;CACjD,MAAM,cAAc,gBAAgB,cAAc,GAAE,CAAE,QAAQ,OAAO,EAAE;CACvE,MAAM,WAAW,gBAAgB;CAEjC,IAAI,SAA6B;CACjC,IAAI,kBAAiD;CAErD,MAAM,YAAY,cAChB,cAAc,QAAQ,UAAU,YAAY,mBAAmB,KAAK,IAAI;CAE1E,MAAM,WAAW,YAAoC;EACnD,MAAM,WAAW,MAAM,MAAM,GAAG,WAAW,oBAAoB;GAC7D,QAAQ;GACR,SAAS,EAAE,gBAAgB,mBAAmB;GAC9C,MAAM,KAAK,UAAU,EAAE,SAAS,CAAC;GAEjC,aAAa;GACb,MAAM;EACR,CAAC;EAED,IAAI,CAAC,SAAS,IAAI,OAAO;EAEzB,MAAM,UAAW,MAAM,SAAS,KAAK;EAIrC,MAAM,QAAQ,SAAS,MAAM;EAC7B,MAAM,YAAY,SAAS,MAAM,aAAa;EAE9C,IAAI,CAAC,SAAS,aAAa,GAAG,OAAO;EAErC,SAAS;GAAE;GAAO,WAAW,KAAK,IAAI,IAAI,YAAY;EAAK;EAC3D,iBAAiB,MAAM;EAEvB,OAAO;CACT;CAEA,MAAM,WAAW,YAAoC;EACnD,IAAI,SAAS,MAAM,GAAG,OAAO,OAAO;EAEpC,MAAM,SAAS,gBAAgB;EAC/B,IAAI,SAAS,MAAM,GAAG;GACpB,SAAS;GACT,OAAO,OAAO;EAChB;EAEA,IAAI,CAAC,UAAU,OAAO;EAGtB,oBAAoB,SAAS,CAAC,CAAC,cAAc;GAC3C,kBAAkB;EACpB,CAAC;EAED,OAAO,MAAM;CACf;;CAGA,MAAM,UAAU,OACd,MACA,aACoB;EACpB,MAAM,QAAQ,MAAM,SAAS;EAE7B,IAAI,CAAC,OAAO,OAAO;EAEnB,MAAM,WAAW,MAAM,MAAM,GAAG,WAAW,aAAa,QAAQ;GAC9D,SAAS,EAAE,eAAe,UAAU,QAAQ;GAC5C,aAAa;GACb,MAAM;EACR,CAAC;EAED,IAAI,CAAC,SAAS,IAAI,OAAO;EAIzB,QAAO,MAFgB,SAAS,KAAK,EAEvB,EAAE,QAAQ;CAC1B;CAEA,OAAO;EACL;EACA,yBAAyB,QAAkB,sBAAsB,CAAC,CAAC;EACnE,kBAAkB,SAChB,QACE,sBAAsB,mBAAmB,KAAK,KAAK,GAAG,CAAC,KACvD,CAAC,CACH;CACJ;AACF"}

package/dist/esm/public/index.mjs ADDED Viewed

@@ -0,0 +1,3 @@
+import { createPublicClient } from "./createPublicClient.mjs";
+export { createPublicClient };

package/dist/types/cms/createAuthManager.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"createAuthManager.d.ts","names":[],"sources":["../../../src/cms/createAuthManager.ts"],"mappings":";;;;;;;~~KAsBK~~,YAAY,6BAA6B,cACzC,MAAM,cACN,QAAQ;;;;;KAMR,eAAe,gBAAgB,4BAClC,gBAAgB,gBAChB,gBAAgB,mBACb;;;;~~KAuCO~~;;;;EAIV,qBAAqB;;;;;;EAMrB;;;;;KAMU;;;;;EAKV;;;;;;;;;;KAWU;;;;;EAKV,gBAAgB;;;;EAIhB,gBAAgB;;;;;EAKhB;;;;;EAKA,kBAAkB;;;;EAIlB;;;;;EAKA,WAAW,6BAA6B,QACtC,QAAQ,YAAY,WAAW,SAC/B,uBACG,YAAY,WAAW;;;;;;;;;;;EAW5B,cAAc,gBAAgB,yBAC5B,SAAS,eAAe,UACxB,UAAU,uBACP;;;;;;;;;;;;;cAcM,oBAAiB,iBACZ,KAAK,2BAAyB,UACrC,uBACR"}
1	+ {"version":3,"file":"createAuthManager.d.ts","names":[],"sources":["../../../src/cms/createAuthManager.ts"],"mappings":";;;;;;;KAuBK,YAAY,6BAA6B,cACzC,MAAM,cACN,QAAQ;;;;;KAMR,eAAe,gBAAgB,4BAClC,gBAAgB,gBAChB,gBAAgB,mBACb;;;;KA0CO;;;;EAIV,qBAAqB;;;;;;EAMrB;;;;;KAMU;;;;;EAKV;;;;;;;;;;KAWU;;;;;EAKV,gBAAgB;;;;EAIhB,gBAAgB;;;;;EAKhB;;;;;EAKA,kBAAkB;;;;EAIlB;;;;;EAKA,WAAW,6BAA6B,QACtC,QAAQ,YAAY,WAAW,SAC/B,uBACG,YAAY,WAAW;;;;;;;;;;;EAW5B,cAAc,gBAAgB,yBAC5B,SAAS,eAAe,UACxB,UAAU,uBACP;;;;;;;;;;;;;cAcM,oBAAiB,iBACZ,KAAK,2BAAyB,UACrC,uBACR"}