@morscherlab/mint-sdk 1.2.0-beta.1 → 1.2.0-beta.3

package/src/composables/useMobileSupportGate.ts

@@ -1,80 +0,0 @@
-import { computed, onMounted, onUnmounted, ref, unref, watch, type ComputedRef, type Ref } from 'vue'
-
-export const DEFAULT_MOBILE_VIEWPORT_QUERY = '(max-width: 767px)'
-
-export type MobileSupportSource = boolean | Ref<boolean> | ComputedRef<boolean>
-export type MobileViewportQuerySource = string | Ref<string> | ComputedRef<string>
-
-export interface UseMobileSupportGateOptions {
-  supported?: MobileSupportSource
-  mediaQuery?: MobileViewportQuerySource
-}
-
-export interface UseMobileSupportGateReturn {
-  isMobileViewport: Ref<boolean>
-  isSupported: ComputedRef<boolean>
-  shouldShowUnsupported: ComputedRef<boolean>
-}
-
-export function useMobileSupportGate(options: UseMobileSupportGateOptions = {}): UseMobileSupportGateReturn {
-  const isMobileViewport = ref(false)
-
-  const mediaQuery = computed(() => {
-    const value = unref(options.mediaQuery)
-    return value?.trim() || DEFAULT_MOBILE_VIEWPORT_QUERY
-  })
-
-  const isSupported = computed(() => {
-    if (options.supported === undefined) return true
-    return Boolean(unref(options.supported))
-  })
-
-  const shouldShowUnsupported = computed(() => isMobileViewport.value && !isSupported.value)
-
-  let mediaQueryList: MediaQueryList | null = null
-  let removeMediaListener: (() => void) | undefined
-
-  const syncMobileState = (event?: MediaQueryListEvent | MediaQueryList) => {
-    isMobileViewport.value = Boolean(event?.matches ?? mediaQueryList?.matches)
-  }
-
-  const unbindMediaQuery = () => {
-    removeMediaListener?.()
-    removeMediaListener = undefined
-    mediaQueryList = null
-  }
-
-  const bindMediaQuery = () => {
-    unbindMediaQuery()
-
-    if (typeof window === 'undefined' || typeof window.matchMedia !== 'function') {
-      isMobileViewport.value = false
-      return
-    }
-
-    const queryList = window.matchMedia(mediaQuery.value)
-    mediaQueryList = queryList
-    syncMobileState(queryList)
-
-    const handleChange = (event: MediaQueryListEvent) => syncMobileState(event)
-
-    if (typeof queryList.addEventListener === 'function') {
-      queryList.addEventListener('change', handleChange)
-      removeMediaListener = () => queryList.removeEventListener('change', handleChange)
-      return
-    }
-
-    queryList.addListener(handleChange)
-    removeMediaListener = () => queryList.removeListener(handleChange)
-  }
-
-  onMounted(bindMediaQuery)
-  watch(mediaQuery, bindMediaQuery, { flush: 'post' })
-  onUnmounted(unbindMediaQuery)
-
-  return {
-    isMobileViewport,
-    isSupported,
-    shouldShowUnsupported,
-  }
-}

package/src/composables/useOptimisticMutation.ts

@@ -1,107 +0,0 @@
-import { computed, ref, shallowRef, type ComputedRef, type Ref, type ShallowRef } from 'vue'
-
-export interface OptimisticMutationContext<TVariables, TSnapshot> {
-  variables: TVariables
-  snapshot: TSnapshot | undefined
-}
-
-export interface UseOptimisticMutationOptions<TVariables, TData, TSnapshot = unknown> {
-  mutation: (variables: TVariables) => Promise<TData>
-  snapshot?: (variables: TVariables) => TSnapshot
-  apply?: (variables: TVariables, snapshot: TSnapshot | undefined) => void
-  commit?: (data: TData, context: OptimisticMutationContext<TVariables, TSnapshot>) => void
-  rollback?: (
-    snapshot: TSnapshot | undefined,
-    variables: TVariables,
-    error: unknown,
-  ) => void
-  onSuccess?: (data: TData, context: OptimisticMutationContext<TVariables, TSnapshot>) => void
-  onError?: (error: unknown, context: OptimisticMutationContext<TVariables, TSnapshot>) => void
-  onSettled?: (context: OptimisticMutationContext<TVariables, TSnapshot>) => void
-  readErrorMessage?: (error: unknown) => string
-}
-
-export interface UseOptimisticMutationReturn<TVariables, TData, TSnapshot = unknown> {
-  loading: ShallowRef<boolean>
-  error: Ref<string | null>
-  data: Ref<TData | null>
-  lastSnapshot: Ref<TSnapshot | undefined>
-  isIdle: ComputedRef<boolean>
-  run: (variables: TVariables) => Promise<TData>
-  clearError: () => void
-  reset: () => void
-}
-
-/** Run async mutations with optional optimistic local updates and rollback. */
-export function useOptimisticMutation<TVariables, TData, TSnapshot = unknown>(
-  options: UseOptimisticMutationOptions<TVariables, TData, TSnapshot>,
-): UseOptimisticMutationReturn<TVariables, TData, TSnapshot> {
-  const loading = shallowRef(false)
-  const error = ref<string | null>(null)
-  const data = ref<TData | null>(null) as Ref<TData | null>
-  const lastSnapshot = ref<TSnapshot | undefined>(undefined) as Ref<TSnapshot | undefined>
-  const isIdle = computed(() => !loading.value && data.value === null && error.value === null)
-
-  function clearError(): void {
-    error.value = null
-  }
-
-  function reset(): void {
-    loading.value = false
-    error.value = null
-    data.value = null
-    lastSnapshot.value = undefined
-  }
-
-  async function run(variables: TVariables): Promise<TData> {
-    const snapshot = options.snapshot?.(variables)
-    const context: OptimisticMutationContext<TVariables, TSnapshot> = { variables, snapshot }
-
-    loading.value = true
-    error.value = null
-    lastSnapshot.value = snapshot
-    options.apply?.(variables, snapshot)
-
-    try {
-      const result = await options.mutation(variables)
-      data.value = result
-      options.commit?.(result, context)
-      options.onSuccess?.(result, context)
-      return result
-    } catch (err) {
-      options.rollback?.(snapshot, variables, err)
-      error.value = options.readErrorMessage?.(err) ?? readErrorMessage(err)
-      options.onError?.(err, context)
-      throw err
-    } finally {
-      loading.value = false
-      options.onSettled?.(context)
-    }
-  }
-
-  return {
-    loading,
-    error,
-    data,
-    lastSnapshot,
-    isIdle,
-    run,
-    clearError,
-    reset,
-  }
-}
-
-function readErrorMessage(value: unknown): string {
-  if (value instanceof Error && value.message) return value.message
-  if (typeof value === 'string' && value.trim()) return value
-  if (
-    typeof value === 'object'
-    && value !== null
-    && 'message' in value
-    && typeof (value as { message?: unknown }).message === 'string'
-    && (value as { message: string }).message.trim()
-  ) {
-    return (value as { message: string }).message
-  }
-  return 'Request failed.'
-}

package/src/composables/usePasskey.ts

@@ -1,216 +0,0 @@
-import axios from 'axios'
-import { useAuthStore } from '../stores/auth'
-import { useSettingsStore } from '../stores/settings'
-import type { CredentialInfo } from '../types'
-
-// Lazy-load @simplewebauthn/browser so plugins that never call usePasskey
-// don't need the optional peer dep installed (avoids build failures).
-async function loadWebAuthn() {
-  try {
-    return await import('@simplewebauthn/browser')
-  } catch {
-    throw new Error(
-      '@simplewebauthn/browser is required for passkey support. Install it: bun add @simplewebauthn/browser',
-    )
-  }
-}
-
-interface PasskeyLoginResponse {
-  access_token: string
-  token_type: string
-  expires_in: number
-}
-
-/** Registers and authenticates passkeys using WebAuthn, lazily loading the browser dependency. */
-export function usePasskey() {
-  const authStore = useAuthStore()
-  const settingsStore = useSettingsStore()
-
-  function getApiBaseUrl(): string {
-    return settingsStore.getApiBaseUrl()
-  }
-
-  async function isSupported(): Promise<boolean> {
-    try {
-      const { browserSupportsWebAuthn } = await loadWebAuthn()
-      return browserSupportsWebAuthn()
-    } catch {
-      return false
-    }
-  }
-
-  async function registerPasskey(deviceName?: string): Promise<boolean> {
-    const webauthn = await loadWebAuthn()
-    if (!webauthn.browserSupportsWebAuthn()) {
-      authStore.setError('WebAuthn is not supported in this browser')
-      return false
-    }
-
-    authStore.setLoading(true)
-    authStore.setError(null)
-
-    try {
-      const optionsResponse = await axios.get<{ options: string }>(
-        `${getApiBaseUrl()}/auth/passkey/register/options`,
-        {
-          headers: { Authorization: `Bearer ${authStore.token}` },
-          withCredentials: true,
-        }
-      )
-
-      const options = JSON.parse(optionsResponse.data.options)
-
-      const credential = await webauthn.startRegistration(options)
-
-      await axios.post(
-        `${getApiBaseUrl()}/auth/passkey/register/verify`,
-        {
-          credential: JSON.stringify(credential),
-          device_name: deviceName,
-        },
-        {
-          headers: { Authorization: `Bearer ${authStore.token}` },
-          withCredentials: true,
-        }
-      )
-
-      authStore.setAuthConfig({
-        ...authStore.authConfig,
-        passkeyRegistered: true,
-      })
-
-      return true
-    } catch (error) {
-      if (axios.isAxiosError(error) && error.response) {
-        authStore.setError(error.response.data.detail || 'Passkey registration failed')
-      } else if (error instanceof Error) {
-        if (error.name === 'NotAllowedError') {
-          authStore.setError('Registration was cancelled or timed out')
-        } else if (error.name === 'InvalidStateError') {
-          authStore.setError('This authenticator is already registered')
-        } else {
-          authStore.setError(error.message)
-        }
-      } else {
-        authStore.setError('Passkey registration failed')
-      }
-      return false
-    } finally {
-      authStore.setLoading(false)
-    }
-  }
-
-  async function loginWithPasskey(): Promise<boolean> {
-    const webauthn = await loadWebAuthn()
-    if (!webauthn.browserSupportsWebAuthn()) {
-      authStore.setError('WebAuthn is not supported in this browser')
-      return false
-    }
-
-    authStore.setLoading(true)
-    authStore.setError(null)
-
-    try {
-      const optionsResponse = await axios.get<{ options: string }>(
-        `${getApiBaseUrl()}/auth/passkey/login/options`,
-        { withCredentials: true }
-      )
-
-      const options = JSON.parse(optionsResponse.data.options)
-
-      const credential = await webauthn.startAuthentication(options)
-
-      const response = await axios.post<PasskeyLoginResponse>(
-        `${getApiBaseUrl()}/auth/passkey/login/verify`,
-        { credential: JSON.stringify(credential) },
-        { withCredentials: true }
-      )
-
-      authStore.setToken(response.data.access_token, response.data.expires_in)
-
-      return true
-    } catch (error) {
-      if (axios.isAxiosError(error) && error.response) {
-        if (error.response.status === 404) {
-          authStore.setError('No passkeys registered. Please login with password first.')
-        } else {
-          authStore.setError(error.response.data.detail || 'Passkey login failed')
-        }
-      } else if (error instanceof Error) {
-        if (error.name === 'NotAllowedError') {
-          authStore.setError('Authentication was cancelled or timed out')
-        } else {
-          authStore.setError(error.message)
-        }
-      } else {
-        authStore.setError('Passkey login failed')
-      }
-      return false
-    } finally {
-      authStore.setLoading(false)
-    }
-  }
-
-  async function listCredentials(): Promise<CredentialInfo[]> {
-    try {
-      const response = await axios.get<{ credentials: CredentialInfo[] }>(
-        `${getApiBaseUrl()}/auth/passkey/credentials`,
-        {
-          headers: { Authorization: `Bearer ${authStore.token}` },
-        }
-      )
-      return response.data.credentials
-    } catch {
-      return []
-    }
-  }
-
-  async function deleteCredential(credentialId: string): Promise<boolean> {
-    try {
-      await axios.delete(
-        `${getApiBaseUrl()}/auth/passkey/credentials/${encodeURIComponent(credentialId)}`,
-        {
-          headers: { Authorization: `Bearer ${authStore.token}` },
-        }
-      )
-
-      const remaining = await listCredentials()
-      if (remaining.length === 0) {
-        authStore.setAuthConfig({
-          ...authStore.authConfig,
-          passkeyRegistered: false,
-        })
-      }
-
-      return true
-    } catch {
-      return false
-    }
-  }
-
-  async function deleteAllCredentials(): Promise<boolean> {
-    try {
-      await axios.delete(`${getApiBaseUrl()}/auth/passkey/credentials`, {
-        headers: { Authorization: `Bearer ${authStore.token}` },
-      })
-
-      authStore.setAuthConfig({
-        ...authStore.authConfig,
-        passkeyRegistered: false,
-      })
-
-      return true
-    } catch {
-      return false
-    }
-  }
-
-  return {
-    isSupported,
-    registerPasskey,
-    loginWithPasskey,
-    listCredentials,
-    deleteCredential,
-    deleteAllCredentials,
-  }
-}

package/src/composables/usePlatformContext.ts

@@ -1,299 +0,0 @@
-import { ref, computed, onMounted, onUnmounted } from 'vue'
-import type { PlatformContext, PlatformContextOptions, PlatformEvent } from '../types'
-
-const DEFAULT_CONTEXT: PlatformContext = {
-  isIntegrated: false,
-  theme: 'system',
-}
-
-const platformContext = ref<PlatformContext>({ ...DEFAULT_CONTEXT })
-
-// Track allowed origins for postMessage security.
-// Inferred origins come from platform injection and URL params.
-// Consumer origins and allowAnyOrigin are tracked per composable instance.
-let inferredOrigins: Set<string> = new Set()
-let allowedOrigins: Set<string> = new Set()
-let allowAnyOrigin = false
-let initialized = false
-let listenerCount = 0
-let nextConsumerId = 0
-let currentHandler: ((event: MessageEvent) => void) | null = null
-const consumerOrigins: Map<number, Set<string>> = new Map()
-const allowAnyOriginConsumers: Set<number> = new Set()
-
-/**
- * Derive origin from URL (protocol + host)
- */
-function getOriginFromUrl(url: string): string | null {
-  try {
-    const parsed = new URL(url)
-    return parsed.origin
-  } catch {
-    return null
-  }
-}
-
-function normalizeAllowedOrigins(origins: string[] | undefined): Set<string> {
-  const normalized = new Set<string>()
-  if (!origins) {
-    return normalized
-  }
-
-  for (const origin of origins) {
-    normalized.add(getOriginFromUrl(origin) || origin)
-  }
-  return normalized
-}
-
-function recomputeOriginPolicy(): void {
-  allowedOrigins = new Set(inferredOrigins)
-  for (const origins of consumerOrigins.values()) {
-    for (const origin of origins) {
-      allowedOrigins.add(origin)
-    }
-  }
-  allowAnyOrigin = allowAnyOriginConsumers.size > 0
-}
-
-function resetPlatformContextState(): void {
-  inferredOrigins = new Set()
-  allowedOrigins = new Set()
-  allowAnyOrigin = false
-  initialized = false
-  listenerCount = 0
-  currentHandler = null
-  consumerOrigins.clear()
-  allowAnyOriginConsumers.clear()
-  platformContext.value = { ...DEFAULT_CONTEXT }
-}
-
-/**
- * Check if an origin is allowed for postMessage communication
- */
-function isOriginAllowed(origin: string): boolean {
-  // Development mode: allow any origin (must be explicitly enabled)
-  if (allowAnyOrigin) {
-    console.warn('[MINT SDK] postMessage origin validation disabled - only use in development')
-    return true
-  }
-
-  // Same origin is always allowed
-  if (origin === window.location.origin) {
-    return true
-  }
-
-  // Check against allowed origins list
-  return allowedOrigins.has(origin)
-}
-
-/**
- * Platform context composable for plugin integration with MINT Platform.
- *
- * Provides secure communication with the parent platform via postMessage.
- *
- * @param options - Configuration options
- * @param options.allowedOrigins - List of allowed origins for postMessage
- * @param options.allowAnyOrigin - Allow any origin (UNSAFE, development only)
- *
- * @example
- * ```typescript
- * // Basic usage - derives origin from platform injection
- * const { isIntegrated, user, theme } = usePlatformContext()
- *
- * // With explicit allowed origins
- * const { isIntegrated } = usePlatformContext({
- *   allowedOrigins: ['https://mint.example.com']
- * })
- *
- * // Development mode (UNSAFE)
- * const { isIntegrated } = usePlatformContext({
- *   allowAnyOrigin: import.meta.env.DEV
- * })
- * ```
- */
-/** Connects a plugin to the MINT platform via postMessage, exposing user, theme, and experiment context. */
-export function usePlatformContext(options: PlatformContextOptions = {}) {
-  const consumerId = ++nextConsumerId
-  const instanceOrigins = normalizeAllowedOrigins(options.allowedOrigins)
-  const instanceAllowAnyOrigin = options.allowAnyOrigin === true
-
-  function detectPlatform(): void {
-    const detectedOrigins = new Set<string>()
-
-    // Check if running under MINT Platform by looking for platform-injected global
-    const platformData = (window as unknown as { __MINT_PLATFORM__?: PlatformContext }).__MINT_PLATFORM__
-
-    if (platformData) {
-      platformContext.value = {
-        ...platformData,
-        isIntegrated: true,
-      }
-
-      // Derive platform origin from injected data
-      if (platformData.platformOrigin) {
-        detectedOrigins.add(platformData.platformOrigin)
-      } else if (platformData.platformApiUrl) {
-        const origin = getOriginFromUrl(platformData.platformApiUrl)
-        if (origin) {
-          detectedOrigins.add(origin)
-        }
-      }
-    } else {
-      // Check for platform indicator in URL or localStorage
-      const urlParams = new URLSearchParams(window.location.search)
-      const hasPluginParam = urlParams.has('mint-plugin')
-
-      // Try to get platform origin from URL parameter
-      const platformOrigin = urlParams.get('mint-origin')
-      if (platformOrigin) {
-        const origin = getOriginFromUrl(platformOrigin)
-        if (origin) {
-          detectedOrigins.add(origin)
-        }
-      }
-
-      platformContext.value = {
-        isIntegrated: hasPluginParam,
-        theme: (() => {
-          try {
-            const s = localStorage.getItem('mint-settings')
-            if (s) return (JSON.parse(s).theme as 'light' | 'dark' | 'system') || 'system'
-          } catch { /* ignore */ }
-          return 'system'
-        })(),
-        platformOrigin: platformOrigin || undefined,
-      }
-    }
-
-    inferredOrigins = detectedOrigins
-  }
-
-  function handlePlatformMessage(event: MessageEvent): void {
-    // Only accept messages from parent window (platform)
-    if (event.source !== window.parent) return
-
-    // Validate origin for security
-    if (!isOriginAllowed(event.origin)) {
-      console.warn(`[MINT SDK] Rejected postMessage from untrusted origin: ${event.origin}`)
-      return
-    }
-
-    try {
-      const platformEvent = event.data as PlatformEvent
-      if (!platformEvent.type?.startsWith('mint:')) return
-
-      switch (platformEvent.type) {
-        case 'mint:theme-changed':
-          platformContext.value.theme = platformEvent.payload as 'light' | 'dark' | 'system'
-          break
-        case 'mint:user-changed':
-          platformContext.value.user = platformEvent.payload as PlatformContext['user']
-          break
-      }
-    } catch {
-      // Ignore invalid messages
-    }
-  }
-
-  /**
-   * Send a message to the parent platform.
-   * Uses validated target origin for security.
-   */
-  function sendToPlatform(event: PlatformEvent): void {
-    if (!platformContext.value.isIntegrated || window.parent === window) {
-      return
-    }
-
-    // Determine target origin
-    let targetOrigin: string
-
-    if (platformContext.value.platformOrigin) {
-      // Use explicitly configured platform origin
-      targetOrigin = platformContext.value.platformOrigin
-    } else if (allowedOrigins.size > 0) {
-      // Use first allowed origin (typically the platform)
-      targetOrigin = allowedOrigins.values().next().value as string
-    } else if (allowAnyOrigin) {
-      // Development mode fallback
-      targetOrigin = '*'
-      console.warn('[MINT SDK] Using wildcard origin for postMessage - only use in development')
-    } else {
-      // Safety: if no origin is configured, log warning and don't send
-      console.warn('[MINT SDK] Cannot send postMessage: no platform origin configured')
-      return
-    }
-
-    window.parent.postMessage(event, targetOrigin)
-  }
-
-  /**
-   * Request navigation to a path in the platform.
-   */
-  function navigate(path: string): void {
-    sendToPlatform({
-      type: 'mint:navigate',
-      payload: path,
-    })
-  }
-
-  /**
-   * Show a notification in the platform.
-   */
-  function notify(message: string, type: 'success' | 'error' | 'warning' | 'info' = 'info'): void {
-    sendToPlatform({
-      type: 'mint:notification',
-      payload: { message, type },
-    })
-  }
-
-  onMounted(() => {
-    consumerOrigins.set(consumerId, instanceOrigins)
-    if (instanceAllowAnyOrigin) {
-      allowAnyOriginConsumers.add(consumerId)
-    }
-
-    if (!initialized) {
-      detectPlatform()
-      currentHandler = handlePlatformMessage
-      window.addEventListener('message', handlePlatformMessage)
-      initialized = true
-    }
-
-    listenerCount++
-    recomputeOriginPolicy()
-  })
-
-  onUnmounted(() => {
-    consumerOrigins.delete(consumerId)
-    allowAnyOriginConsumers.delete(consumerId)
-
-    listenerCount = Math.max(0, listenerCount - 1)
-    if (listenerCount === 0) {
-      if (currentHandler) {
-        window.removeEventListener('message', currentHandler)
-      }
-      resetPlatformContextState()
-      return
-    }
-
-    recomputeOriginPolicy()
-  })
-
-  const isIntegrated = computed(() => platformContext.value.isIntegrated)
-  const plugin = computed(() => platformContext.value.plugin)
-  const user = computed(() => platformContext.value.user)
-  const theme = computed(() => platformContext.value.theme)
-  const features = computed(() => platformContext.value.features)
-
-  return {
-    context: platformContext,
-    isIntegrated,
-    plugin,
-    user,
-    theme,
-    features,
-    navigate,
-    notify,
-    sendToPlatform,
-  }
-}