@morscherlab/mld-sdk 0.6.0

package/dist/composables/usePasskey.js

@@ -0,0 +1,171 @@
+import axios from "axios";
+import { startAuthentication, startRegistration, browserSupportsWebAuthn } from "@simplewebauthn/browser";
+import { useAuthStore } from "../stores/auth.js";
+import { useSettingsStore } from "../stores/settings.js";
+function usePasskey() {
+  const authStore = useAuthStore();
+  const settingsStore = useSettingsStore();
+  function getApiBaseUrl() {
+    return settingsStore.getApiBaseUrl();
+  }
+  function isSupported() {
+    return browserSupportsWebAuthn();
+  }
+  async function registerPasskey(deviceName) {
+    if (!isSupported()) {
+      authStore.setError("WebAuthn is not supported in this browser");
+      return false;
+    }
+    authStore.setLoading(true);
+    authStore.setError(null);
+    try {
+      const optionsResponse = await axios.get(
+        `${getApiBaseUrl()}/auth/passkey/register/options`,
+        {
+          headers: { Authorization: `Bearer ${authStore.token}` },
+          withCredentials: true
+        }
+      );
+      const options = JSON.parse(
+        optionsResponse.data.options
+      );
+      const credential = await startRegistration(options);
+      await axios.post(
+        `${getApiBaseUrl()}/auth/passkey/register/verify`,
+        {
+          credential: JSON.stringify(credential),
+          device_name: deviceName
+        },
+        {
+          headers: { Authorization: `Bearer ${authStore.token}` },
+          withCredentials: true
+        }
+      );
+      authStore.setAuthConfig({
+        ...authStore.authConfig,
+        passkeyRegistered: true
+      });
+      return true;
+    } catch (error) {
+      if (axios.isAxiosError(error) && error.response) {
+        authStore.setError(error.response.data.detail || "Passkey registration failed");
+      } else if (error instanceof Error) {
+        if (error.name === "NotAllowedError") {
+          authStore.setError("Registration was cancelled or timed out");
+        } else if (error.name === "InvalidStateError") {
+          authStore.setError("This authenticator is already registered");
+        } else {
+          authStore.setError(error.message);
+        }
+      } else {
+        authStore.setError("Passkey registration failed");
+      }
+      return false;
+    } finally {
+      authStore.setLoading(false);
+    }
+  }
+  async function loginWithPasskey() {
+    if (!isSupported()) {
+      authStore.setError("WebAuthn is not supported in this browser");
+      return false;
+    }
+    authStore.setLoading(true);
+    authStore.setError(null);
+    try {
+      const optionsResponse = await axios.get(
+        `${getApiBaseUrl()}/auth/passkey/login/options`,
+        { withCredentials: true }
+      );
+      const options = JSON.parse(
+        optionsResponse.data.options
+      );
+      const credential = await startAuthentication(options);
+      const response = await axios.post(
+        `${getApiBaseUrl()}/auth/passkey/login/verify`,
+        { credential: JSON.stringify(credential) },
+        { withCredentials: true }
+      );
+      authStore.setToken(response.data.access_token, response.data.expires_in);
+      return true;
+    } catch (error) {
+      if (axios.isAxiosError(error) && error.response) {
+        if (error.response.status === 404) {
+          authStore.setError("No passkeys registered. Please login with password first.");
+        } else {
+          authStore.setError(error.response.data.detail || "Passkey login failed");
+        }
+      } else if (error instanceof Error) {
+        if (error.name === "NotAllowedError") {
+          authStore.setError("Authentication was cancelled or timed out");
+        } else {
+          authStore.setError(error.message);
+        }
+      } else {
+        authStore.setError("Passkey login failed");
+      }
+      return false;
+    } finally {
+      authStore.setLoading(false);
+    }
+  }
+  async function listCredentials() {
+    try {
+      const response = await axios.get(
+        `${getApiBaseUrl()}/auth/passkey/credentials`,
+        {
+          headers: { Authorization: `Bearer ${authStore.token}` }
+        }
+      );
+      return response.data.credentials;
+    } catch {
+      return [];
+    }
+  }
+  async function deleteCredential(credentialId) {
+    try {
+      await axios.delete(
+        `${getApiBaseUrl()}/auth/passkey/credentials/${encodeURIComponent(credentialId)}`,
+        {
+          headers: { Authorization: `Bearer ${authStore.token}` }
+        }
+      );
+      const remaining = await listCredentials();
+      if (remaining.length === 0) {
+        authStore.setAuthConfig({
+          ...authStore.authConfig,
+          passkeyRegistered: false
+        });
+      }
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  async function deleteAllCredentials() {
+    try {
+      await axios.delete(`${getApiBaseUrl()}/auth/passkey/credentials`, {
+        headers: { Authorization: `Bearer ${authStore.token}` }
+      });
+      authStore.setAuthConfig({
+        ...authStore.authConfig,
+        passkeyRegistered: false
+      });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  return {
+    isSupported,
+    registerPasskey,
+    loginWithPasskey,
+    listCredentials,
+    deleteCredential,
+    deleteAllCredentials
+  };
+}
+export {
+  usePasskey
+};
+//# sourceMappingURL=usePasskey.js.map

package/dist/composables/usePasskey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"usePasskey.js","sources":["../../src/composables/usePasskey.ts"],"sourcesContent":["import axios from 'axios'\nimport {\n  startRegistration,\n  startAuthentication,\n  browserSupportsWebAuthn,\n} from '@simplewebauthn/browser'\nimport type {\n  PublicKeyCredentialCreationOptionsJSON,\n  PublicKeyCredentialRequestOptionsJSON,\n} from '@simplewebauthn/types'\nimport { useAuthStore } from '../stores/auth'\nimport { useSettingsStore } from '../stores/settings'\nimport type { CredentialInfo } from '../types'\n\ninterface PasskeyLoginResponse {\n  access_token: string\n  token_type: string\n  expires_in: number\n}\n\nexport function usePasskey() {\n  const authStore = useAuthStore()\n  const settingsStore = useSettingsStore()\n\n  function getApiBaseUrl(): string {\n    return settingsStore.getApiBaseUrl()\n  }\n\n  function isSupported(): boolean {\n    return browserSupportsWebAuthn()\n  }\n\n  async function registerPasskey(deviceName?: string): Promise<boolean> {\n    if (!isSupported()) {\n      authStore.setError('WebAuthn is not supported in this browser')\n      return false\n    }\n\n    authStore.setLoading(true)\n    authStore.setError(null)\n\n    try {\n      const optionsResponse = await axios.get<{ options: string }>(\n        `${getApiBaseUrl()}/auth/passkey/register/options`,\n        {\n          headers: { Authorization: `Bearer ${authStore.token}` },\n          withCredentials: true,\n        }\n      )\n\n      const options: PublicKeyCredentialCreationOptionsJSON = JSON.parse(\n        optionsResponse.data.options\n      )\n\n      const credential = await startRegistration(options)\n\n      await axios.post(\n        `${getApiBaseUrl()}/auth/passkey/register/verify`,\n        {\n          credential: JSON.stringify(credential),\n          device_name: deviceName,\n        },\n        {\n          headers: { Authorization: `Bearer ${authStore.token}` },\n          withCredentials: true,\n        }\n      )\n\n      authStore.setAuthConfig({\n        ...authStore.authConfig,\n        passkeyRegistered: true,\n      })\n\n      return true\n    } catch (error) {\n      if (axios.isAxiosError(error) && error.response) {\n        authStore.setError(error.response.data.detail || 'Passkey registration failed')\n      } else if (error instanceof Error) {\n        if (error.name === 'NotAllowedError') {\n          authStore.setError('Registration was cancelled or timed out')\n        } else if (error.name === 'InvalidStateError') {\n          authStore.setError('This authenticator is already registered')\n        } else {\n          authStore.setError(error.message)\n        }\n      } else {\n        authStore.setError('Passkey registration failed')\n      }\n      return false\n    } finally {\n      authStore.setLoading(false)\n    }\n  }\n\n  async function loginWithPasskey(): Promise<boolean> {\n    if (!isSupported()) {\n      authStore.setError('WebAuthn is not supported in this browser')\n      return false\n    }\n\n    authStore.setLoading(true)\n    authStore.setError(null)\n\n    try {\n      const optionsResponse = await axios.get<{ options: string }>(\n        `${getApiBaseUrl()}/auth/passkey/login/options`,\n        { withCredentials: true }\n      )\n\n      const options: PublicKeyCredentialRequestOptionsJSON = JSON.parse(\n        optionsResponse.data.options\n      )\n\n      const credential = await startAuthentication(options)\n\n      const response = await axios.post<PasskeyLoginResponse>(\n        `${getApiBaseUrl()}/auth/passkey/login/verify`,\n        { credential: JSON.stringify(credential) },\n        { withCredentials: true }\n      )\n\n      authStore.setToken(response.data.access_token, response.data.expires_in)\n\n      return true\n    } catch (error) {\n      if (axios.isAxiosError(error) && error.response) {\n        if (error.response.status === 404) {\n          authStore.setError('No passkeys registered. Please login with password first.')\n        } else {\n          authStore.setError(error.response.data.detail || 'Passkey login failed')\n        }\n      } else if (error instanceof Error) {\n        if (error.name === 'NotAllowedError') {\n          authStore.setError('Authentication was cancelled or timed out')\n        } else {\n          authStore.setError(error.message)\n        }\n      } else {\n        authStore.setError('Passkey login failed')\n      }\n      return false\n    } finally {\n      authStore.setLoading(false)\n    }\n  }\n\n  async function listCredentials(): Promise<CredentialInfo[]> {\n    try {\n      const response = await axios.get<{ credentials: CredentialInfo[] }>(\n        `${getApiBaseUrl()}/auth/passkey/credentials`,\n        {\n          headers: { Authorization: `Bearer ${authStore.token}` },\n        }\n      )\n      return response.data.credentials\n    } catch {\n      return []\n    }\n  }\n\n  async function deleteCredential(credentialId: string): Promise<boolean> {\n    try {\n      await axios.delete(\n        `${getApiBaseUrl()}/auth/passkey/credentials/${encodeURIComponent(credentialId)}`,\n        {\n          headers: { Authorization: `Bearer ${authStore.token}` },\n        }\n      )\n\n      const remaining = await listCredentials()\n      if (remaining.length === 0) {\n        authStore.setAuthConfig({\n          ...authStore.authConfig,\n          passkeyRegistered: false,\n        })\n      }\n\n      return true\n    } catch {\n      return false\n    }\n  }\n\n  async function deleteAllCredentials(): Promise<boolean> {\n    try {\n      await axios.delete(`${getApiBaseUrl()}/auth/passkey/credentials`, {\n        headers: { Authorization: `Bearer ${authStore.token}` },\n      })\n\n      authStore.setAuthConfig({\n        ...authStore.authConfig,\n        passkeyRegistered: false,\n      })\n\n      return true\n    } catch {\n      return false\n    }\n  }\n\n  return {\n    isSupported,\n    registerPasskey,\n    loginWithPasskey,\n    listCredentials,\n    deleteCredential,\n    deleteAllCredentials,\n  }\n}\n"],"names":[],"mappings":";;;;AAoBO,SAAS,aAAa;AAC3B,QAAM,YAAY,aAAA;AAClB,QAAM,gBAAgB,iBAAA;AAEtB,WAAS,gBAAwB;AAC/B,WAAO,cAAc,cAAA;AAAA,EACvB;AAEA,WAAS,cAAuB;AAC9B,WAAO,wBAAA;AAAA,EACT;AAEA,iBAAe,gBAAgB,YAAuC;AACpE,QAAI,CAAC,eAAe;AAClB,gBAAU,SAAS,2CAA2C;AAC9D,aAAO;AAAA,IACT;AAEA,cAAU,WAAW,IAAI;AACzB,cAAU,SAAS,IAAI;AAEvB,QAAI;AACF,YAAM,kBAAkB,MAAM,MAAM;AAAA,QAClC,GAAG,eAAe;AAAA,QAClB;AAAA,UACE,SAAS,EAAE,eAAe,UAAU,UAAU,KAAK,GAAA;AAAA,UACnD,iBAAiB;AAAA,QAAA;AAAA,MACnB;AAGF,YAAM,UAAkD,KAAK;AAAA,QAC3D,gBAAgB,KAAK;AAAA,MAAA;AAGvB,YAAM,aAAa,MAAM,kBAAkB,OAAO;AAElD,YAAM,MAAM;AAAA,QACV,GAAG,eAAe;AAAA,QAClB;AAAA,UACE,YAAY,KAAK,UAAU,UAAU;AAAA,UACrC,aAAa;AAAA,QAAA;AAAA,QAEf;AAAA,UACE,SAAS,EAAE,eAAe,UAAU,UAAU,KAAK,GAAA;AAAA,UACnD,iBAAiB;AAAA,QAAA;AAAA,MACnB;AAGF,gBAAU,cAAc;AAAA,QACtB,GAAG,UAAU;AAAA,QACb,mBAAmB;AAAA,MAAA,CACpB;AAED,aAAO;AAAA,IACT,SAAS,OAAO;AACd,UAAI,MAAM,aAAa,KAAK,KAAK,MAAM,UAAU;AAC/C,kBAAU,SAAS,MAAM,SAAS,KAAK,UAAU,6BAA6B;AAAA,MAChF,WAAW,iBAAiB,OAAO;AACjC,YAAI,MAAM,SAAS,mBAAmB;AACpC,oBAAU,SAAS,yCAAyC;AAAA,QAC9D,WAAW,MAAM,SAAS,qBAAqB;AAC7C,oBAAU,SAAS,0CAA0C;AAAA,QAC/D,OAAO;AACL,oBAAU,SAAS,MAAM,OAAO;AAAA,QAClC;AAAA,MACF,OAAO;AACL,kBAAU,SAAS,6BAA6B;AAAA,MAClD;AACA,aAAO;AAAA,IACT,UAAA;AACE,gBAAU,WAAW,KAAK;AAAA,IAC5B;AAAA,EACF;AAEA,iBAAe,mBAAqC;AAClD,QAAI,CAAC,eAAe;AAClB,gBAAU,SAAS,2CAA2C;AAC9D,aAAO;AAAA,IACT;AAEA,cAAU,WAAW,IAAI;AACzB,cAAU,SAAS,IAAI;AAEvB,QAAI;AACF,YAAM,kBAAkB,MAAM,MAAM;AAAA,QAClC,GAAG,eAAe;AAAA,QAClB,EAAE,iBAAiB,KAAA;AAAA,MAAK;AAG1B,YAAM,UAAiD,KAAK;AAAA,QAC1D,gBAAgB,KAAK;AAAA,MAAA;AAGvB,YAAM,aAAa,MAAM,oBAAoB,OAAO;AAEpD,YAAM,WAAW,MAAM,MAAM;AAAA,QAC3B,GAAG,eAAe;AAAA,QAClB,EAAE,YAAY,KAAK,UAAU,UAAU,EAAA;AAAA,QACvC,EAAE,iBAAiB,KAAA;AAAA,MAAK;AAG1B,gBAAU,SAAS,SAAS,KAAK,cAAc,SAAS,KAAK,UAAU;AAEvE,aAAO;AAAA,IACT,SAAS,OAAO;AACd,UAAI,MAAM,aAAa,KAAK,KAAK,MAAM,UAAU;AAC/C,YAAI,MAAM,SAAS,WAAW,KAAK;AACjC,oBAAU,SAAS,2DAA2D;AAAA,QAChF,OAAO;AACL,oBAAU,SAAS,MAAM,SAAS,KAAK,UAAU,sBAAsB;AAAA,QACzE;AAAA,MACF,WAAW,iBAAiB,OAAO;AACjC,YAAI,MAAM,SAAS,mBAAmB;AACpC,oBAAU,SAAS,2CAA2C;AAAA,QAChE,OAAO;AACL,oBAAU,SAAS,MAAM,OAAO;AAAA,QAClC;AAAA,MACF,OAAO;AACL,kBAAU,SAAS,sBAAsB;AAAA,MAC3C;AACA,aAAO;AAAA,IACT,UAAA;AACE,gBAAU,WAAW,KAAK;AAAA,IAC5B;AAAA,EACF;AAEA,iBAAe,kBAA6C;AAC1D,QAAI;AACF,YAAM,WAAW,MAAM,MAAM;AAAA,QAC3B,GAAG,eAAe;AAAA,QAClB;AAAA,UACE,SAAS,EAAE,eAAe,UAAU,UAAU,KAAK,GAAA;AAAA,QAAG;AAAA,MACxD;AAEF,aAAO,SAAS,KAAK;AAAA,IACvB,QAAQ;AACN,aAAO,CAAA;AAAA,IACT;AAAA,EACF;AAEA,iBAAe,iBAAiB,cAAwC;AACtE,QAAI;AACF,YAAM,MAAM;AAAA,QACV,GAAG,cAAA,CAAe,6BAA6B,mBAAmB,YAAY,CAAC;AAAA,QAC/E;AAAA,UACE,SAAS,EAAE,eAAe,UAAU,UAAU,KAAK,GAAA;AAAA,QAAG;AAAA,MACxD;AAGF,YAAM,YAAY,MAAM,gBAAA;AACxB,UAAI,UAAU,WAAW,GAAG;AAC1B,kBAAU,cAAc;AAAA,UACtB,GAAG,UAAU;AAAA,UACb,mBAAmB;AAAA,QAAA,CACpB;AAAA,MACH;AAEA,aAAO;AAAA,IACT,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAEA,iBAAe,uBAAyC;AACtD,QAAI;AACF,YAAM,MAAM,OAAO,GAAG,cAAA,CAAe,6BAA6B;AAAA,QAChE,SAAS,EAAE,eAAe,UAAU,UAAU,KAAK,GAAA;AAAA,MAAG,CACvD;AAED,gBAAU,cAAc;AAAA,QACtB,GAAG,UAAU;AAAA,QACb,mBAAmB;AAAA,MAAA,CACpB;AAED,aAAO;AAAA,IACT,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAEJ;"}

package/dist/composables/usePlatformContext.d.ts

@@ -0,0 +1,125 @@
+import { PlatformContext, PlatformContextOptions, PlatformEvent } from '../types';
+/**
+ * Platform context composable for plugin integration with MLD Platform.
+ *
+ * Provides secure communication with the parent platform via postMessage.
+ *
+ * @param options - Configuration options
+ * @param options.allowedOrigins - List of allowed origins for postMessage
+ * @param options.allowAnyOrigin - Allow any origin (UNSAFE, development only)
+ *
+ * @example
+ * ```typescript
+ * // Basic usage - derives origin from platform injection
+ * const { isIntegrated, user, theme } = usePlatformContext()
+ *
+ * // With explicit allowed origins
+ * const { isIntegrated } = usePlatformContext({
+ *   allowedOrigins: ['https://mld.example.com']
+ * })
+ *
+ * // Development mode (UNSAFE)
+ * const { isIntegrated } = usePlatformContext({
+ *   allowAnyOrigin: import.meta.env.DEV
+ * })
+ * ```
+ */
+export declare function usePlatformContext(options?: PlatformContextOptions): {
+    context: import('vue').Ref<{
+        isIntegrated: boolean;
+        plugin?: {
+            id: string;
+            name: string;
+            version: string;
+            description?: string | undefined;
+            icon?: string | undefined;
+            route_prefix: string;
+            api_prefix: string;
+            nav_items?: {
+                id: string;
+                label: string;
+                path: string;
+                icon?: string | undefined;
+                children?: /*elided*/ any[] | undefined;
+            }[] | undefined;
+            settings?: import('..').PluginSettings | undefined;
+        } | undefined;
+        platformApiUrl?: string | undefined;
+        platformOrigin?: string | undefined;
+        user?: {
+            id: string;
+            username: string;
+            role: string;
+        } | undefined;
+        theme: "light" | "dark" | "system";
+        features?: {
+            experiments?: boolean | undefined;
+            passkey?: boolean | undefined;
+            multiUser?: boolean | undefined;
+        } | undefined;
+    }, PlatformContext | {
+        isIntegrated: boolean;
+        plugin?: {
+            id: string;
+            name: string;
+            version: string;
+            description?: string | undefined;
+            icon?: string | undefined;
+            route_prefix: string;
+            api_prefix: string;
+            nav_items?: {
+                id: string;
+                label: string;
+                path: string;
+                icon?: string | undefined;
+                children?: /*elided*/ any[] | undefined;
+            }[] | undefined;
+            settings?: import('..').PluginSettings | undefined;
+        } | undefined;
+        platformApiUrl?: string | undefined;
+        platformOrigin?: string | undefined;
+        user?: {
+            id: string;
+            username: string;
+            role: string;
+        } | undefined;
+        theme: "light" | "dark" | "system";
+        features?: {
+            experiments?: boolean | undefined;
+            passkey?: boolean | undefined;
+            multiUser?: boolean | undefined;
+        } | undefined;
+    }>;
+    isIntegrated: import('vue').ComputedRef<boolean>;
+    plugin: import('vue').ComputedRef<{
+        id: string;
+        name: string;
+        version: string;
+        description?: string | undefined;
+        icon?: string | undefined;
+        route_prefix: string;
+        api_prefix: string;
+        nav_items?: {
+            id: string;
+            label: string;
+            path: string;
+            icon?: string | undefined;
+            children?: /*elided*/ any[] | undefined;
+        }[] | undefined;
+        settings?: import('..').PluginSettings | undefined;
+    } | undefined>;
+    user: import('vue').ComputedRef<{
+        id: string;
+        username: string;
+        role: string;
+    } | undefined>;
+    theme: import('vue').ComputedRef<"system" | "light" | "dark">;
+    features: import('vue').ComputedRef<{
+        experiments?: boolean | undefined;
+        passkey?: boolean | undefined;
+        multiUser?: boolean | undefined;
+    } | undefined>;
+    navigate: (path: string) => void;
+    notify: (message: string, type?: "success" | "error" | "warning" | "info") => void;
+    sendToPlatform: (event: PlatformEvent) => void;
+};

package/dist/composables/usePlatformContext.js

@@ -0,0 +1,149 @@
+import { onMounted, onUnmounted, computed, ref } from "vue";
+const platformContext = ref({
+  isIntegrated: false,
+  theme: "system"
+});
+let allowedOrigins = /* @__PURE__ */ new Set();
+let allowAnyOrigin = false;
+let initialized = false;
+function getOriginFromUrl(url) {
+  try {
+    const parsed = new URL(url);
+    return parsed.origin;
+  } catch {
+    return null;
+  }
+}
+function isOriginAllowed(origin) {
+  if (allowAnyOrigin) {
+    console.warn("[MLD SDK] postMessage origin validation disabled - only use in development");
+    return true;
+  }
+  if (origin === window.location.origin) {
+    return true;
+  }
+  return allowedOrigins.has(origin);
+}
+function usePlatformContext(options = {}) {
+  function detectPlatform() {
+    const platformData = window.__MLD_PLATFORM__;
+    if (platformData) {
+      platformContext.value = {
+        ...platformData,
+        isIntegrated: true
+      };
+      if (platformData.platformOrigin) {
+        allowedOrigins.add(platformData.platformOrigin);
+      } else if (platformData.platformApiUrl) {
+        const origin = getOriginFromUrl(platformData.platformApiUrl);
+        if (origin) {
+          allowedOrigins.add(origin);
+        }
+      }
+    } else {
+      const urlParams = new URLSearchParams(window.location.search);
+      const hasPluginParam = urlParams.has("mld-plugin");
+      const platformOrigin = urlParams.get("mld-origin");
+      if (platformOrigin) {
+        const origin = getOriginFromUrl(platformOrigin);
+        if (origin) {
+          allowedOrigins.add(origin);
+        }
+      }
+      platformContext.value = {
+        isIntegrated: hasPluginParam,
+        theme: localStorage.getItem("mld-theme") || "system",
+        platformOrigin: platformOrigin || void 0
+      };
+    }
+    if (options.allowedOrigins) {
+      for (const origin of options.allowedOrigins) {
+        const normalized = getOriginFromUrl(origin) || origin;
+        allowedOrigins.add(normalized);
+      }
+    }
+    if (options.allowAnyOrigin) {
+      allowAnyOrigin = true;
+    }
+  }
+  function handlePlatformMessage(event) {
+    var _a;
+    if (event.source !== window.parent) return;
+    if (!isOriginAllowed(event.origin)) {
+      console.warn(`[MLD SDK] Rejected postMessage from untrusted origin: ${event.origin}`);
+      return;
+    }
+    try {
+      const platformEvent = event.data;
+      if (!((_a = platformEvent.type) == null ? void 0 : _a.startsWith("mld:"))) return;
+      switch (platformEvent.type) {
+        case "mld:theme-changed":
+          platformContext.value.theme = platformEvent.payload;
+          break;
+        case "mld:user-changed":
+          platformContext.value.user = platformEvent.payload;
+          break;
+      }
+    } catch {
+    }
+  }
+  function sendToPlatform(event) {
+    if (!platformContext.value.isIntegrated || window.parent === window) {
+      return;
+    }
+    let targetOrigin;
+    if (platformContext.value.platformOrigin) {
+      targetOrigin = platformContext.value.platformOrigin;
+    } else if (allowedOrigins.size > 0) {
+      targetOrigin = allowedOrigins.values().next().value;
+    } else if (allowAnyOrigin) {
+      targetOrigin = "*";
+      console.warn("[MLD SDK] Using wildcard origin for postMessage - only use in development");
+    } else {
+      console.warn("[MLD SDK] Cannot send postMessage: no platform origin configured");
+      return;
+    }
+    window.parent.postMessage(event, targetOrigin);
+  }
+  function navigate(path) {
+    sendToPlatform({
+      type: "mld:navigate",
+      payload: path
+    });
+  }
+  function notify(message, type = "info") {
+    sendToPlatform({
+      type: "mld:notification",
+      payload: { message, type }
+    });
+  }
+  onMounted(() => {
+    if (!initialized) {
+      detectPlatform();
+      window.addEventListener("message", handlePlatformMessage);
+      initialized = true;
+    }
+  });
+  onUnmounted(() => {
+  });
+  const isIntegrated = computed(() => platformContext.value.isIntegrated);
+  const plugin = computed(() => platformContext.value.plugin);
+  const user = computed(() => platformContext.value.user);
+  const theme = computed(() => platformContext.value.theme);
+  const features = computed(() => platformContext.value.features);
+  return {
+    context: platformContext,
+    isIntegrated,
+    plugin,
+    user,
+    theme,
+    features,
+    navigate,
+    notify,
+    sendToPlatform
+  };
+}
+export {
+  usePlatformContext
+};
+//# sourceMappingURL=usePlatformContext.js.map

package/dist/composables/usePlatformContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"usePlatformContext.js","sources":["../../src/composables/usePlatformContext.ts"],"sourcesContent":["import { ref, computed, onMounted, onUnmounted } from 'vue'\nimport type { PlatformContext, PlatformContextOptions, PlatformEvent } from '../types'\n\nconst platformContext = ref<PlatformContext>({\n  isIntegrated: false,\n  theme: 'system',\n})\n\n// Track allowed origins for postMessage security\nlet allowedOrigins: Set<string> = new Set()\nlet allowAnyOrigin = false\nlet initialized = false\n\n/**\n * Derive origin from URL (protocol + host)\n */\nfunction getOriginFromUrl(url: string): string | null {\n  try {\n    const parsed = new URL(url)\n    return parsed.origin\n  } catch {\n    return null\n  }\n}\n\n/**\n * Check if an origin is allowed for postMessage communication\n */\nfunction isOriginAllowed(origin: string): boolean {\n  // Development mode: allow any origin (must be explicitly enabled)\n  if (allowAnyOrigin) {\n    console.warn('[MLD SDK] postMessage origin validation disabled - only use in development')\n    return true\n  }\n\n  // Same origin is always allowed\n  if (origin === window.location.origin) {\n    return true\n  }\n\n  // Check against allowed origins list\n  return allowedOrigins.has(origin)\n}\n\n/**\n * Platform context composable for plugin integration with MLD Platform.\n *\n * Provides secure communication with the parent platform via postMessage.\n *\n * @param options - Configuration options\n * @param options.allowedOrigins - List of allowed origins for postMessage\n * @param options.allowAnyOrigin - Allow any origin (UNSAFE, development only)\n *\n * @example\n * ```typescript\n * // Basic usage - derives origin from platform injection\n * const { isIntegrated, user, theme } = usePlatformContext()\n *\n * // With explicit allowed origins\n * const { isIntegrated } = usePlatformContext({\n *   allowedOrigins: ['https://mld.example.com']\n * })\n *\n * // Development mode (UNSAFE)\n * const { isIntegrated } = usePlatformContext({\n *   allowAnyOrigin: import.meta.env.DEV\n * })\n * ```\n */\nexport function usePlatformContext(options: PlatformContextOptions = {}) {\n  function detectPlatform(): void {\n    // Check if running under MLD Platform by looking for platform-injected global\n    const platformData = (window as unknown as { __MLD_PLATFORM__?: PlatformContext }).__MLD_PLATFORM__\n\n    if (platformData) {\n      platformContext.value = {\n        ...platformData,\n        isIntegrated: true,\n      }\n\n      // Derive platform origin from injected data\n      if (platformData.platformOrigin) {\n        allowedOrigins.add(platformData.platformOrigin)\n      } else if (platformData.platformApiUrl) {\n        const origin = getOriginFromUrl(platformData.platformApiUrl)\n        if (origin) {\n          allowedOrigins.add(origin)\n        }\n      }\n    } else {\n      // Check for platform indicator in URL or localStorage\n      const urlParams = new URLSearchParams(window.location.search)\n      const hasPluginParam = urlParams.has('mld-plugin')\n\n      // Try to get platform origin from URL parameter\n      const platformOrigin = urlParams.get('mld-origin')\n      if (platformOrigin) {\n        const origin = getOriginFromUrl(platformOrigin)\n        if (origin) {\n          allowedOrigins.add(origin)\n        }\n      }\n\n      platformContext.value = {\n        isIntegrated: hasPluginParam,\n        theme: (localStorage.getItem('mld-theme') as 'light' | 'dark' | 'system') || 'system',\n        platformOrigin: platformOrigin || undefined,\n      }\n    }\n\n    // Add user-provided allowed origins\n    if (options.allowedOrigins) {\n      for (const origin of options.allowedOrigins) {\n        const normalized = getOriginFromUrl(origin) || origin\n        allowedOrigins.add(normalized)\n      }\n    }\n\n    // Set development mode flag\n    if (options.allowAnyOrigin) {\n      allowAnyOrigin = true\n    }\n  }\n\n  function handlePlatformMessage(event: MessageEvent): void {\n    // Only accept messages from parent window (platform)\n    if (event.source !== window.parent) return\n\n    // Validate origin for security\n    if (!isOriginAllowed(event.origin)) {\n      console.warn(`[MLD SDK] Rejected postMessage from untrusted origin: ${event.origin}`)\n      return\n    }\n\n    try {\n      const platformEvent = event.data as PlatformEvent\n      if (!platformEvent.type?.startsWith('mld:')) return\n\n      switch (platformEvent.type) {\n        case 'mld:theme-changed':\n          platformContext.value.theme = platformEvent.payload as 'light' | 'dark' | 'system'\n          break\n        case 'mld:user-changed':\n          platformContext.value.user = platformEvent.payload as PlatformContext['user']\n          break\n      }\n    } catch {\n      // Ignore invalid messages\n    }\n  }\n\n  /**\n   * Send a message to the parent platform.\n   * Uses validated target origin for security.\n   */\n  function sendToPlatform(event: PlatformEvent): void {\n    if (!platformContext.value.isIntegrated || window.parent === window) {\n      return\n    }\n\n    // Determine target origin\n    let targetOrigin: string\n\n    if (platformContext.value.platformOrigin) {\n      // Use explicitly configured platform origin\n      targetOrigin = platformContext.value.platformOrigin\n    } else if (allowedOrigins.size > 0) {\n      // Use first allowed origin (typically the platform)\n      targetOrigin = allowedOrigins.values().next().value as string\n    } else if (allowAnyOrigin) {\n      // Development mode fallback\n      targetOrigin = '*'\n      console.warn('[MLD SDK] Using wildcard origin for postMessage - only use in development')\n    } else {\n      // Safety: if no origin is configured, log warning and don't send\n      console.warn('[MLD SDK] Cannot send postMessage: no platform origin configured')\n      return\n    }\n\n    window.parent.postMessage(event, targetOrigin)\n  }\n\n  /**\n   * Request navigation to a path in the platform.\n   */\n  function navigate(path: string): void {\n    sendToPlatform({\n      type: 'mld:navigate',\n      payload: path,\n    })\n  }\n\n  /**\n   * Show a notification in the platform.\n   */\n  function notify(message: string, type: 'success' | 'error' | 'warning' | 'info' = 'info'): void {\n    sendToPlatform({\n      type: 'mld:notification',\n      payload: { message, type },\n    })\n  }\n\n  onMounted(() => {\n    if (!initialized) {\n      detectPlatform()\n      window.addEventListener('message', handlePlatformMessage)\n      initialized = true\n    }\n  })\n\n  onUnmounted(() => {\n    // Don't remove listener as other components may still need it\n  })\n\n  const isIntegrated = computed(() => platformContext.value.isIntegrated)\n  const plugin = computed(() => platformContext.value.plugin)\n  const user = computed(() => platformContext.value.user)\n  const theme = computed(() => platformContext.value.theme)\n  const features = computed(() => platformContext.value.features)\n\n  return {\n    context: platformContext,\n    isIntegrated,\n    plugin,\n    user,\n    theme,\n    features,\n    navigate,\n    notify,\n    sendToPlatform,\n  }\n}\n"],"names":[],"mappings":";AAGA,MAAM,kBAAkB,IAAqB;AAAA,EAC3C,cAAc;AAAA,EACd,OAAO;AACT,CAAC;AAGD,IAAI,qCAAkC,IAAA;AACtC,IAAI,iBAAiB;AACrB,IAAI,cAAc;AAKlB,SAAS,iBAAiB,KAA4B;AACpD,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,WAAO,OAAO;AAAA,EAChB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAKA,SAAS,gBAAgB,QAAyB;AAEhD,MAAI,gBAAgB;AAClB,YAAQ,KAAK,4EAA4E;AACzF,WAAO;AAAA,EACT;AAGA,MAAI,WAAW,OAAO,SAAS,QAAQ;AACrC,WAAO;AAAA,EACT;AAGA,SAAO,eAAe,IAAI,MAAM;AAClC;AA2BO,SAAS,mBAAmB,UAAkC,IAAI;AACvE,WAAS,iBAAuB;AAE9B,UAAM,eAAgB,OAA6D;AAEnF,QAAI,cAAc;AAChB,sBAAgB,QAAQ;AAAA,QACtB,GAAG;AAAA,QACH,cAAc;AAAA,MAAA;AAIhB,UAAI,aAAa,gBAAgB;AAC/B,uBAAe,IAAI,aAAa,cAAc;AAAA,MAChD,WAAW,aAAa,gBAAgB;AACtC,cAAM,SAAS,iBAAiB,aAAa,cAAc;AAC3D,YAAI,QAAQ;AACV,yBAAe,IAAI,MAAM;AAAA,QAC3B;AAAA,MACF;AAAA,IACF,OAAO;AAEL,YAAM,YAAY,IAAI,gBAAgB,OAAO,SAAS,MAAM;AAC5D,YAAM,iBAAiB,UAAU,IAAI,YAAY;AAGjD,YAAM,iBAAiB,UAAU,IAAI,YAAY;AACjD,UAAI,gBAAgB;AAClB,cAAM,SAAS,iBAAiB,cAAc;AAC9C,YAAI,QAAQ;AACV,yBAAe,IAAI,MAAM;AAAA,QAC3B;AAAA,MACF;AAEA,sBAAgB,QAAQ;AAAA,QACtB,cAAc;AAAA,QACd,OAAQ,aAAa,QAAQ,WAAW,KAAqC;AAAA,QAC7E,gBAAgB,kBAAkB;AAAA,MAAA;AAAA,IAEtC;AAGA,QAAI,QAAQ,gBAAgB;AAC1B,iBAAW,UAAU,QAAQ,gBAAgB;AAC3C,cAAM,aAAa,iBAAiB,MAAM,KAAK;AAC/C,uBAAe,IAAI,UAAU;AAAA,MAC/B;AAAA,IACF;AAGA,QAAI,QAAQ,gBAAgB;AAC1B,uBAAiB;AAAA,IACnB;AAAA,EACF;AAEA,WAAS,sBAAsB,OAA2B;;AAExD,QAAI,MAAM,WAAW,OAAO,OAAQ;AAGpC,QAAI,CAAC,gBAAgB,MAAM,MAAM,GAAG;AAClC,cAAQ,KAAK,yDAAyD,MAAM,MAAM,EAAE;AACpF;AAAA,IACF;AAEA,QAAI;AACF,YAAM,gBAAgB,MAAM;AAC5B,UAAI,GAAC,mBAAc,SAAd,mBAAoB,WAAW,SAAS;AAE7C,cAAQ,cAAc,MAAA;AAAA,QACpB,KAAK;AACH,0BAAgB,MAAM,QAAQ,cAAc;AAC5C;AAAA,QACF,KAAK;AACH,0BAAgB,MAAM,OAAO,cAAc;AAC3C;AAAA,MAAA;AAAA,IAEN,QAAQ;AAAA,IAER;AAAA,EACF;AAMA,WAAS,eAAe,OAA4B;AAClD,QAAI,CAAC,gBAAgB,MAAM,gBAAgB,OAAO,WAAW,QAAQ;AACnE;AAAA,IACF;AAGA,QAAI;AAEJ,QAAI,gBAAgB,MAAM,gBAAgB;AAExC,qBAAe,gBAAgB,MAAM;AAAA,IACvC,WAAW,eAAe,OAAO,GAAG;AAElC,qBAAe,eAAe,SAAS,KAAA,EAAO;AAAA,IAChD,WAAW,gBAAgB;AAEzB,qBAAe;AACf,cAAQ,KAAK,2EAA2E;AAAA,IAC1F,OAAO;AAEL,cAAQ,KAAK,kEAAkE;AAC/E;AAAA,IACF;AAEA,WAAO,OAAO,YAAY,OAAO,YAAY;AAAA,EAC/C;AAKA,WAAS,SAAS,MAAoB;AACpC,mBAAe;AAAA,MACb,MAAM;AAAA,MACN,SAAS;AAAA,IAAA,CACV;AAAA,EACH;AAKA,WAAS,OAAO,SAAiB,OAAiD,QAAc;AAC9F,mBAAe;AAAA,MACb,MAAM;AAAA,MACN,SAAS,EAAE,SAAS,KAAA;AAAA,IAAK,CAC1B;AAAA,EACH;AAEA,YAAU,MAAM;AACd,QAAI,CAAC,aAAa;AAChB,qBAAA;AACA,aAAO,iBAAiB,WAAW,qBAAqB;AACxD,oBAAc;AAAA,IAChB;AAAA,EACF,CAAC;AAED,cAAY,MAAM;AAAA,EAElB,CAAC;AAED,QAAM,eAAe,SAAS,MAAM,gBAAgB,MAAM,YAAY;AACtE,QAAM,SAAS,SAAS,MAAM,gBAAgB,MAAM,MAAM;AAC1D,QAAM,OAAO,SAAS,MAAM,gBAAgB,MAAM,IAAI;AACtD,QAAM,QAAQ,SAAS,MAAM,gBAAgB,MAAM,KAAK;AACxD,QAAM,WAAW,SAAS,MAAM,gBAAgB,MAAM,QAAQ;AAE9D,SAAO;AAAA,IACL,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAEJ;"}

package/dist/composables/useProtocolTemplates.d.ts

@@ -0,0 +1,43 @@
+import { Ref, ComputedRef } from 'vue';
+import { ProtocolStep, ProtocolStepType } from '../types';
+export interface ParameterDefinition {
+    key: string;
+    label: string;
+    type: 'number' | 'text' | 'select' | 'concentration' | 'temperature' | 'duration' | 'reagent';
+    unit?: string;
+    options?: Array<{
+        value: string;
+        label: string;
+    }>;
+    required?: boolean;
+    default?: unknown;
+    min?: number;
+    max?: number;
+    placeholder?: string;
+}
+export interface StepTemplate {
+    id: string;
+    type: ProtocolStepType;
+    name: string;
+    description?: string;
+    defaultDuration?: number;
+    parameters: ParameterDefinition[];
+    isBuiltIn?: boolean;
+}
+export interface ValidationResult {
+    valid: boolean;
+    errors: Record<string, string>;
+}
+export interface UseProtocolTemplatesReturn {
+    builtInTemplates: StepTemplate[];
+    customTemplates: Ref<StepTemplate[]>;
+    allTemplates: ComputedRef<StepTemplate[]>;
+    getTemplateByType: (type: ProtocolStepType) => StepTemplate | undefined;
+    getTemplateById: (id: string) => StepTemplate | undefined;
+    saveCustomTemplate: (template: StepTemplate) => void;
+    deleteCustomTemplate: (templateId: string) => void;
+    validateStep: (step: ProtocolStep, template: StepTemplate) => ValidationResult;
+    createStepFromTemplate: (template: StepTemplate, overrides?: Partial<ProtocolStep>) => ProtocolStep;
+    formatParameterValue: (value: unknown, param: ParameterDefinition) => string;
+}
+export declare function useProtocolTemplates(): UseProtocolTemplatesReturn;