@mosano-product-framework/sdk 0.2.0

package/dist/chunk-GQJ3QQPH.js

@@ -0,0 +1,339 @@
+import { issueAdminToken, createTurnstileMiddleware, createAdminAuthMiddleware, AdminEmptyUserIDError, AdminEmptySecretError } from './chunk-K2ELAI2X.js';
+import { shouldRetryRequest, requestRetry, isRetryDisabled, isReplayableBody, getRetryAttempt, executeResponseMiddlewares, executeRequestMiddlewares, executeErrorMiddlewares, disableRetry, createTenantMiddleware, createRetryMiddleware, createHttpClient, createAuthMiddleware, clearRetryFlag, attachStandardMiddlewares, TENANT_ROLE_HEADER, TENANT_HEADER, MPFClient, MAX_REQUEST_ATTEMPTS } from './chunk-LRM6JJ63.js';
+import { __export, isMPFValidationError, isMPFNetworkError, isMPFError, isMPFAuthError, isMPFAPIError, MPFValidationError, MPFTimeoutError, MPFNetworkError, MPFError, MPFAuthError, MPFAPIError } from './chunk-AJWM5MDZ.js';
+
+// src/client/middlewares/logging.ts
+var DEFAULT_REDACT_HEADERS = [
+  "authorization",
+  "cookie",
+  "x-api-key",
+  "x-auth-token",
+  "x-access-token",
+  "set-cookie"
+];
+function formatHeaders(headers, redactHeaders) {
+  const result = {};
+  if (!headers) {
+    return result;
+  }
+  const headersObj = headers instanceof Headers ? headers : new Headers(headers);
+  const redactSet = new Set(redactHeaders.map((h) => h.toLowerCase()));
+  headersObj.forEach((value, key) => {
+    const lowerKey = key.toLowerCase();
+    if (redactSet.has(lowerKey)) {
+      result[key] = "[REDACTED]";
+    } else {
+      result[key] = value;
+    }
+  });
+  return result;
+}
+function getTimestamp() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function getMethod(init) {
+  return (init.method ?? "GET").toUpperCase();
+}
+function truncateBody(body, maxLength = 1e3) {
+  if (body === void 0 || body === null) {
+    return "";
+  }
+  let bodyStr;
+  if (typeof body === "string") {
+    bodyStr = body;
+  } else if (body instanceof FormData) {
+    return "[FormData]";
+  } else if (body instanceof Blob) {
+    return `[Blob: ${body.size} bytes]`;
+  } else if (body instanceof ArrayBuffer || ArrayBuffer.isView(body)) {
+    const size = body instanceof ArrayBuffer ? body.byteLength : body.byteLength;
+    return `[Binary: ${size} bytes]`;
+  } else if (body instanceof URLSearchParams) {
+    bodyStr = body.toString();
+  } else if (body instanceof ReadableStream) {
+    return "[ReadableStream]";
+  } else {
+    try {
+      bodyStr = JSON.stringify(body);
+    } catch {
+      return "[Unserializable]";
+    }
+  }
+  if (bodyStr.length > maxLength) {
+    return bodyStr.substring(0, maxLength) + `... (${bodyStr.length} chars total)`;
+  }
+  return bodyStr;
+}
+function createLoggingMiddleware(options) {
+  const {
+    logger = console,
+    logBody = false,
+    prefix = "[MPF SDK]",
+    logHeaders = false,
+    redactHeaders = DEFAULT_REDACT_HEADERS,
+    minDuration = 0,
+    includeTimestamp = true,
+    formatRequest: customFormatRequest,
+    formatResponse: customFormatResponse,
+    formatError: customFormatError
+  } = options ?? {};
+  function buildPrefix() {
+    if (includeTimestamp) {
+      return `${prefix} [${getTimestamp()}]`;
+    }
+    return prefix;
+  }
+  return {
+    name: "logging",
+    onRequest(ctx) {
+      ctx.metadata["__requestStartTime"] = Date.now();
+      ctx.metadata["__requestMethod"] = getMethod(ctx.init);
+      ctx.metadata["__requestUrl"] = ctx.url;
+      const method = ctx.metadata["__requestMethod"];
+      const logPrefix = buildPrefix();
+      if (customFormatRequest) {
+        logger.log(customFormatRequest(ctx));
+      } else {
+        const parts = [`${logPrefix} --> ${method} ${ctx.url}`];
+        if (logHeaders && ctx.init.headers) {
+          const headers = formatHeaders(ctx.init.headers, redactHeaders);
+          parts.push(`  Headers: ${JSON.stringify(headers)}`);
+        }
+        if (logBody && ctx.init.body) {
+          const body = truncateBody(ctx.init.body);
+          if (body) {
+            parts.push(`  Body: ${body}`);
+          }
+        }
+        logger.log(parts.join("\n"));
+      }
+      return ctx;
+    },
+    onResponse(ctx) {
+      const startTime = ctx.metadata["__requestStartTime"];
+      const duration = startTime ? Date.now() - startTime : 0;
+      if (duration < minDuration) {
+        return ctx;
+      }
+      const method = ctx.metadata["__requestMethod"] || "GET";
+      const status = ctx.response.status;
+      const statusText = ctx.response.statusText;
+      const url = ctx.metadata["__requestUrl"] || ctx.response.url || "(unknown)";
+      const logPrefix = buildPrefix();
+      if (customFormatResponse) {
+        logger.log(customFormatResponse(ctx));
+      } else {
+        const statusIcon = status >= 200 && status < 300 ? "OK" : status >= 400 ? "ERR" : "WARN";
+        const parts = [
+          `${logPrefix} <-- ${method} ${url} ${status} ${statusText} (${duration}ms) [${statusIcon}]`
+        ];
+        if (logHeaders) {
+          const headers = formatHeaders(ctx.response.headers, redactHeaders);
+          parts.push(`  Headers: ${JSON.stringify(headers)}`);
+        }
+        if (logBody && ctx.data !== void 0) {
+          const body = truncateBody(ctx.data);
+          if (body) {
+            parts.push(`  Body: ${body}`);
+          }
+        }
+        logger.log(parts.join("\n"));
+      }
+      return ctx;
+    },
+    onError(error, ctx) {
+      const startTime = ctx.metadata["__requestStartTime"];
+      const duration = startTime ? Date.now() - startTime : 0;
+      const method = getMethod(ctx.init);
+      const logPrefix = buildPrefix();
+      if (customFormatError) {
+        logger.error(customFormatError(error, ctx));
+      } else {
+        const parts = [
+          `${logPrefix} <-- ${method} ${ctx.url} ERROR (${duration}ms)`,
+          `  Error: ${error.name}: ${error.message}`
+        ];
+        if (error.stack) {
+          const stackLines = error.stack.split("\n").slice(1, 4);
+          parts.push(`  Stack: ${stackLines.join("\n         ")}`);
+        }
+        logger.error(parts.join("\n"));
+      }
+      throw error;
+    }
+  };
+}
+
+// src/client/utils/url.ts
+function buildUrl(baseUrl, path, params) {
+  const normalizedBase = baseUrl.replace(/\/+$/, "");
+  const normalizedPath = path.startsWith("/") ? path : `/${path}`;
+  const base = /^https?:\/\//.test(normalizedBase) ? normalizedBase : typeof window !== "undefined" ? window.location.origin : "http://localhost";
+  const url = new URL(`${normalizedBase}${normalizedPath}`, base);
+  if (params) {
+    for (const [key, value] of Object.entries(params)) {
+      if (value !== void 0 && value !== null) {
+        url.searchParams.append(key, String(value));
+      }
+    }
+  }
+  return url.toString();
+}
+function joinPath(...segments) {
+  return segments.map((segment, index) => {
+    if (index > 0) {
+      segment = segment.replace(/^\/+/, "");
+    }
+    if (index < segments.length - 1) {
+      segment = segment.replace(/\/+$/, "");
+    }
+    return segment;
+  }).filter(Boolean).join("/");
+}
+
+// src/client/graphql/client.ts
+var MPFGraphQLClient = class extends MPFClient {
+  /** The GraphQL endpoint path */
+  graphqlEndpoint;
+  constructor(config) {
+    super(config);
+    this.graphqlEndpoint = config.endpoint ?? "/graphql";
+  }
+  /**
+   * Execute a GraphQL query operation
+   *
+   * @param document - The GraphQL query (string or typed document node)
+   * @param variables - Optional variables for the query
+   * @param options - Optional request options (headers, signal)
+   * @returns The query result data
+   * @throws {MPFAPIError} When GraphQL errors occur or no data is returned
+   */
+  async query(document, variables, options) {
+    return this.executeOperation(document, variables, options);
+  }
+  /**
+   * Execute a GraphQL mutation operation
+   *
+   * @param document - The GraphQL mutation (string or typed document node)
+   * @param variables - Optional variables for the mutation
+   * @param options - Optional request options (headers, signal)
+   * @returns The mutation result data
+   * @throws {MPFAPIError} When GraphQL errors occur or no data is returned
+   */
+  async mutate(document, variables, options) {
+    return this.executeOperation(document, variables, options);
+  }
+  /**
+   * Execute a GraphQL operation (query or mutation)
+   *
+   * @internal
+   */
+  async executeOperation(document, variables, options) {
+    const query = typeof document === "string" ? document : document.toString();
+    const response = await this.post(
+      this.graphqlEndpoint,
+      { query, variables },
+      options
+    );
+    if (response.errors && response.errors.length > 0) {
+      const firstError = response.errors[0];
+      const errorCode = firstError.extensions?.code ?? "GRAPHQL_ERROR";
+      throw new MPFAPIError(
+        firstError.message,
+        errorCode,
+        200,
+        response.errors
+      );
+    }
+    if (response.data === void 0 || response.data === null) {
+      throw new MPFAPIError(
+        "No data returned from GraphQL operation",
+        "NO_DATA",
+        200
+      );
+    }
+    return response.data;
+  }
+};
+
+// src/client/graphql/operation.ts
+function stripLeadingTrivia(source) {
+  let rest = source;
+  for (; ; ) {
+    const trimmed = rest.replace(/^[\s,\uFEFF]+/, "");
+    if (trimmed.startsWith("#")) {
+      const newline = trimmed.indexOf("\n");
+      rest = newline === -1 ? "" : trimmed.slice(newline + 1);
+      continue;
+    }
+    if (trimmed !== rest) {
+      rest = trimmed;
+      continue;
+    }
+    return trimmed;
+  }
+}
+function getOperationKind(document) {
+  const source = stripLeadingTrivia(document);
+  if (source.startsWith("{")) {
+    return "query";
+  }
+  const match = /^(query|mutation|subscription)\b/.exec(source);
+  if (!match) {
+    return "unknown";
+  }
+  return match[1];
+}
+function isSubscription(document) {
+  return getOperationKind(document) === "subscription";
+}
+
+// src/client/peer-free.ts
+var peer_free_exports = {};
+__export(peer_free_exports, {
+  AdminEmptySecretError: () => AdminEmptySecretError,
+  AdminEmptyUserIDError: () => AdminEmptyUserIDError,
+  MAX_REQUEST_ATTEMPTS: () => MAX_REQUEST_ATTEMPTS,
+  MPFAPIError: () => MPFAPIError,
+  MPFAuthError: () => MPFAuthError,
+  MPFClient: () => MPFClient,
+  MPFError: () => MPFError,
+  MPFGraphQLClient: () => MPFGraphQLClient,
+  MPFNetworkError: () => MPFNetworkError,
+  MPFTimeoutError: () => MPFTimeoutError,
+  MPFValidationError: () => MPFValidationError,
+  TENANT_HEADER: () => TENANT_HEADER,
+  TENANT_ROLE_HEADER: () => TENANT_ROLE_HEADER,
+  attachStandardMiddlewares: () => attachStandardMiddlewares,
+  buildUrl: () => buildUrl,
+  clearRetryFlag: () => clearRetryFlag,
+  createAdminAuthMiddleware: () => createAdminAuthMiddleware,
+  createAuthMiddleware: () => createAuthMiddleware,
+  createHttpClient: () => createHttpClient,
+  createLoggingMiddleware: () => createLoggingMiddleware,
+  createRetryMiddleware: () => createRetryMiddleware,
+  createTenantMiddleware: () => createTenantMiddleware,
+  createTurnstileMiddleware: () => createTurnstileMiddleware,
+  disableRetry: () => disableRetry,
+  executeErrorMiddlewares: () => executeErrorMiddlewares,
+  executeRequestMiddlewares: () => executeRequestMiddlewares,
+  executeResponseMiddlewares: () => executeResponseMiddlewares,
+  getOperationKind: () => getOperationKind,
+  getRetryAttempt: () => getRetryAttempt,
+  isMPFAPIError: () => isMPFAPIError,
+  isMPFAuthError: () => isMPFAuthError,
+  isMPFError: () => isMPFError,
+  isMPFNetworkError: () => isMPFNetworkError,
+  isMPFValidationError: () => isMPFValidationError,
+  isReplayableBody: () => isReplayableBody,
+  isRetryDisabled: () => isRetryDisabled,
+  isSubscription: () => isSubscription,
+  issueAdminToken: () => issueAdminToken,
+  joinPath: () => joinPath,
+  requestRetry: () => requestRetry,
+  shouldRetryRequest: () => shouldRetryRequest
+});
+
+export { MPFGraphQLClient, buildUrl, createLoggingMiddleware, getOperationKind, isSubscription, joinPath, peer_free_exports };
+//# sourceMappingURL=chunk-GQJ3QQPH.js.map
+//# sourceMappingURL=chunk-GQJ3QQPH.js.map

package/dist/chunk-GQJ3QQPH.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/client/middlewares/logging.ts","../src/client/utils/url.ts","../src/client/graphql/client.ts","../src/client/graphql/operation.ts","../src/client/peer-free.ts"],"names":[],"mappings":";;;;;AAgFA,IAAM,sBAAA,GAAyB;AAAA,EAC7B,eAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA,cAAA;AAAA,EACA,gBAAA;AAAA,EACA;AACF,CAAA;AAKA,SAAS,aAAA,CACP,SACA,aAAA,EACwB;AACxB,EAAA,MAAM,SAAiC,EAAC;AAExC,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,MAAM,aAAa,OAAA,YAAmB,OAAA,GAAU,OAAA,GAAU,IAAI,QAAQ,OAAO,CAAA;AAC7E,EAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,aAAA,CAAc,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,WAAA,EAAa,CAAC,CAAA;AAEnE,EAAA,UAAA,CAAW,OAAA,CAAQ,CAAC,KAAA,EAAO,GAAA,KAAQ;AACjC,IAAA,MAAM,QAAA,GAAW,IAAI,WAAA,EAAY;AACjC,IAAA,IAAI,SAAA,CAAU,GAAA,CAAI,QAAQ,CAAA,EAAG;AAC3B,MAAA,MAAA,CAAO,GAAG,CAAA,GAAI,YAAA;AAAA,IAChB,CAAA,MAAO;AACL,MAAA,MAAA,CAAO,GAAG,CAAA,GAAI,KAAA;AAAA,IAChB;AAAA,EACF,CAAC,CAAA;AAED,EAAA,OAAO,MAAA;AACT;AAKA,SAAS,YAAA,GAAuB;AAC9B,EAAA,OAAA,iBAAO,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAChC;AAKA,SAAS,UAAU,IAAA,EAA2B;AAC5C,EAAA,OAAA,CAAQ,IAAA,CAAK,MAAA,IAAU,KAAA,EAAO,WAAA,EAAY;AAC5C;AAKA,SAAS,YAAA,CAAa,IAAA,EAAe,SAAA,GAAoB,GAAA,EAAc;AACrE,EAAA,IAAI,IAAA,KAAS,MAAA,IAAa,IAAA,KAAS,IAAA,EAAM;AACvC,IAAA,OAAO,EAAA;AAAA,EACT;AAEA,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,IAAA,OAAA,GAAU,IAAA;AAAA,EACZ,CAAA,MAAA,IAAW,gBAAgB,QAAA,EAAU;AACnC,IAAA,OAAO,YAAA;AAAA,EACT,CAAA,MAAA,IAAW,gBAAgB,IAAA,EAAM;AAC/B,IAAA,OAAO,CAAA,OAAA,EAAU,KAAK,IAAI,CAAA,OAAA,CAAA;AAAA,EAC5B,WAAW,IAAA,YAAgB,WAAA,IAAe,WAAA,CAAY,MAAA,CAAO,IAAI,CAAA,EAAG;AAClE,IAAA,MAAM,IAAA,GAAO,IAAA,YAAgB,WAAA,GAAc,IAAA,CAAK,aAAa,IAAA,CAAK,UAAA;AAClE,IAAA,OAAO,YAAY,IAAI,CAAA,OAAA,CAAA;AAAA,EACzB,CAAA,MAAA,IAAW,gBAAgB,eAAA,EAAiB;AAC1C,IAAA,OAAA,GAAU,KAAK,QAAA,EAAS;AAAA,EAC1B,CAAA,MAAA,IAAW,gBAAgB,cAAA,EAAgB;AACzC,IAAA,OAAO,kBAAA;AAAA,EACT,CAAA,MAAO;AACL,IAAA,IAAI;AACF,MAAA,OAAA,GAAU,IAAA,CAAK,UAAU,IAAI,CAAA;AAAA,IAC/B,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,kBAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,IAAI,OAAA,CAAQ,SAAS,SAAA,EAAW;AAC9B,IAAA,OAAO,QAAQ,SAAA,CAAU,CAAA,EAAG,SAAS,CAAA,GAAI,CAAA,KAAA,EAAQ,QAAQ,MAAM,CAAA,aAAA,CAAA;AAAA,EACjE;AAEA,EAAA,OAAO,OAAA;AACT;AAoCO,SAAS,wBAAwB,OAAA,EAAgD;AACtF,EAAA,MAAM;AAAA,IACJ,MAAA,GAAS,OAAA;AAAA,IACT,OAAA,GAAU,KAAA;AAAA,IACV,MAAA,GAAS,WAAA;AAAA,IACT,UAAA,GAAa,KAAA;AAAA,IACb,aAAA,GAAgB,sBAAA;AAAA,IAChB,WAAA,GAAc,CAAA;AAAA,IACd,gBAAA,GAAmB,IAAA;AAAA,IACnB,aAAA,EAAe,mBAAA;AAAA,IACf,cAAA,EAAgB,oBAAA;AAAA,IAChB,WAAA,EAAa;AAAA,GACf,GAAI,WAAW,EAAC;AAKhB,EAAA,SAAS,WAAA,GAAsB;AAC7B,IAAA,IAAI,gBAAA,EAAkB;AACpB,MAAA,OAAO,CAAA,EAAG,MAAM,CAAA,EAAA,EAAK,YAAA,EAAc,CAAA,CAAA,CAAA;AAAA,IACrC;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,SAAA;AAAA,IAEN,UAAU,GAAA,EAAqC;AAE7C,MAAA,GAAA,CAAI,QAAA,CAAS,oBAAoB,CAAA,GAAI,IAAA,CAAK,GAAA,EAAI;AAC9C,MAAA,GAAA,CAAI,QAAA,CAAS,iBAAiB,CAAA,GAAI,SAAA,CAAU,IAAI,IAAI,CAAA;AACpD,MAAA,GAAA,CAAI,QAAA,CAAS,cAAc,CAAA,GAAI,GAAA,CAAI,GAAA;AAEnC,MAAA,MAAM,MAAA,GAAS,GAAA,CAAI,QAAA,CAAS,iBAAiB,CAAA;AAC7C,MAAA,MAAM,YAAY,WAAA,EAAY;AAE9B,MAAA,IAAI,mBAAA,EAAqB;AACvB,QAAA,MAAA,CAAO,GAAA,CAAI,mBAAA,CAAoB,GAAG,CAAC,CAAA;AAAA,MACrC,CAAA,MAAO;AACL,QAAA,MAAM,KAAA,GAAkB,CAAC,CAAA,EAAG,SAAS,QAAQ,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,GAAG,CAAA,CAAE,CAAA;AAEhE,QAAA,IAAI,UAAA,IAAc,GAAA,CAAI,IAAA,CAAK,OAAA,EAAS;AAClC,UAAA,MAAM,OAAA,GAAU,aAAA,CAAc,GAAA,CAAI,IAAA,CAAK,SAAS,aAAa,CAAA;AAC7D,UAAA,KAAA,CAAM,KAAK,CAAA,WAAA,EAAc,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA,CAAE,CAAA;AAAA,QACpD;AAEA,QAAA,IAAI,OAAA,IAAW,GAAA,CAAI,IAAA,CAAK,IAAA,EAAM;AAC5B,UAAA,MAAM,IAAA,GAAO,YAAA,CAAa,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA;AACvC,UAAA,IAAI,IAAA,EAAM;AACR,YAAA,KAAA,CAAM,IAAA,CAAK,CAAA,QAAA,EAAW,IAAI,CAAA,CAAE,CAAA;AAAA,UAC9B;AAAA,QACF;AAEA,QAAA,MAAA,CAAO,GAAA,CAAI,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,MAC7B;AAEA,MAAA,OAAO,GAAA;AAAA,IACT,CAAA;AAAA,IAEA,WAAc,GAAA,EAA6C;AACzD,MAAA,MAAM,SAAA,GAAY,GAAA,CAAI,QAAA,CAAS,oBAAoB,CAAA;AACnD,MAAA,MAAM,QAAA,GAAW,SAAA,GAAY,IAAA,CAAK,GAAA,KAAQ,SAAA,GAAY,CAAA;AAGtD,MAAA,IAAI,WAAW,WAAA,EAAa;AAC1B,QAAA,OAAO,GAAA;AAAA,MACT;AAEA,MAAA,MAAM,MAAA,GAAU,GAAA,CAAI,QAAA,CAAS,iBAAiB,CAAA,IAAgB,KAAA;AAC9D,MAAA,MAAM,MAAA,GAAS,IAAI,QAAA,CAAS,MAAA;AAC5B,MAAA,MAAM,UAAA,GAAa,IAAI,QAAA,CAAS,UAAA;AAChC,MAAA,MAAM,MAAO,GAAA,CAAI,QAAA,CAAS,cAAc,CAAA,IAAgB,GAAA,CAAI,SAAS,GAAA,IAAO,WAAA;AAC5E,MAAA,MAAM,YAAY,WAAA,EAAY;AAE9B,MAAA,IAAI,oBAAA,EAAsB;AACxB,QAAA,MAAA,CAAO,GAAA,CAAI,oBAAA,CAAqB,GAAG,CAAC,CAAA;AAAA,MACtC,CAAA,MAAO;AACL,QAAA,MAAM,UAAA,GAAa,UAAU,GAAA,IAAO,MAAA,GAAS,MAAM,IAAA,GAAO,MAAA,IAAU,MAAM,KAAA,GAAQ,MAAA;AAClF,QAAA,MAAM,KAAA,GAAkB;AAAA,UACtB,CAAA,EAAG,SAAS,CAAA,KAAA,EAAQ,MAAM,CAAA,CAAA,EAAI,GAAG,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA,EAAI,UAAU,CAAA,EAAA,EAAK,QAAQ,QAAQ,UAAU,CAAA,CAAA;AAAA,SAC1F;AAEA,QAAA,IAAI,UAAA,EAAY;AACd,UAAA,MAAM,OAAA,GAAU,aAAA,CAAc,GAAA,CAAI,QAAA,CAAS,SAAS,aAAa,CAAA;AACjE,UAAA,KAAA,CAAM,KAAK,CAAA,WAAA,EAAc,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA,CAAE,CAAA;AAAA,QACpD;AAEA,QAAA,IAAI,OAAA,IAAW,GAAA,CAAI,IAAA,KAAS,MAAA,EAAW;AACrC,UAAA,MAAM,IAAA,GAAO,YAAA,CAAa,GAAA,CAAI,IAAI,CAAA;AAClC,UAAA,IAAI,IAAA,EAAM;AACR,YAAA,KAAA,CAAM,IAAA,CAAK,CAAA,QAAA,EAAW,IAAI,CAAA,CAAE,CAAA;AAAA,UAC9B;AAAA,QACF;AAEA,QAAA,MAAA,CAAO,GAAA,CAAI,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,MAC7B;AAEA,MAAA,OAAO,GAAA;AAAA,IACT,CAAA;AAAA,IAEA,OAAA,CAAQ,OAAc,GAAA,EAA4B;AAChD,MAAA,MAAM,SAAA,GAAY,GAAA,CAAI,QAAA,CAAS,oBAAoB,CAAA;AACnD,MAAA,MAAM,QAAA,GAAW,SAAA,GAAY,IAAA,CAAK,GAAA,KAAQ,SAAA,GAAY,CAAA;AACtD,MAAA,MAAM,MAAA,GAAS,SAAA,CAAU,GAAA,CAAI,IAAI,CAAA;AACjC,MAAA,MAAM,YAAY,WAAA,EAAY;AAE9B,MAAA,IAAI,iBAAA,EAAmB;AACrB,QAAA,MAAA,CAAO,KAAA,CAAM,iBAAA,CAAkB,KAAA,EAAO,GAAG,CAAC,CAAA;AAAA,MAC5C,CAAA,MAAO;AACL,QAAA,MAAM,KAAA,GAAkB;AAAA,UACtB,CAAA,EAAG,SAAS,CAAA,KAAA,EAAQ,MAAM,IAAI,GAAA,CAAI,GAAG,WAAW,QAAQ,CAAA,GAAA,CAAA;AAAA,UACxD,CAAA,SAAA,EAAY,KAAA,CAAM,IAAI,CAAA,EAAA,EAAK,MAAM,OAAO,CAAA;AAAA,SAC1C;AAEA,QAAA,IAAI,MAAM,KAAA,EAAO;AAEf,UAAA,MAAM,UAAA,GAAa,MAAM,KAAA,CAAM,KAAA,CAAM,IAAI,CAAA,CAAE,KAAA,CAAM,GAAG,CAAC,CAAA;AACrD,UAAA,KAAA,CAAM,KAAK,CAAA,SAAA,EAAY,UAAA,CAAW,IAAA,CAAK,aAAa,CAAC,CAAA,CAAE,CAAA;AAAA,QACzD;AAEA,QAAA,MAAA,CAAO,KAAA,CAAM,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,MAC/B;AAEA,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,GACF;AACF;;;AC5TO,SAAS,QAAA,CACd,OAAA,EACA,IAAA,EACA,MAAA,EACQ;AAER,EAAA,MAAM,cAAA,GAAiB,OAAA,CAAQ,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AAGjD,EAAA,MAAM,iBAAiB,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,GAAI,IAAA,GAAO,IAAI,IAAI,CAAA,CAAA;AAE7D,EAAA,MAAM,IAAA,GAAO,cAAA,CAAe,IAAA,CAAK,cAAc,CAAA,GAC3C,cAAA,GACC,OAAO,MAAA,KAAW,WAAA,GAAc,MAAA,CAAO,QAAA,CAAS,MAAA,GAAS,kBAAA;AAC9D,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,CAAA,EAAG,cAAc,CAAA,EAAG,cAAc,IAAI,IAAI,CAAA;AAE9D,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AACjD,MAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,EAAM;AACzC,QAAA,GAAA,CAAI,YAAA,CAAa,MAAA,CAAO,GAAA,EAAK,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,IAAI,QAAA,EAAS;AACtB;AAQO,SAAS,YAAY,QAAA,EAA4B;AACtD,EAAA,OAAO,QAAA,CACJ,GAAA,CAAI,CAAC,OAAA,EAAS,KAAA,KAAU;AAEvB,IAAA,IAAI,QAAQ,CAAA,EAAG;AACb,MAAA,OAAA,GAAU,OAAA,CAAQ,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AAAA,IACtC;AAEA,IAAA,IAAI,KAAA,GAAQ,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG;AAC/B,MAAA,OAAA,GAAU,OAAA,CAAQ,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AAAA,IACtC;AACA,IAAA,OAAO,OAAA;AAAA,EACT,CAAC,CAAA,CACA,MAAA,CAAO,OAAO,CAAA,CACd,KAAK,GAAG,CAAA;AACb;;;ACjBO,IAAM,gBAAA,GAAN,cAA+B,SAAA,CAAU;AAAA;AAAA,EAEpC,eAAA;AAAA,EAEV,YAAY,MAAA,EAA6B;AACvC,IAAA,KAAA,CAAM,MAAM,CAAA;AACZ,IAAA,IAAA,CAAK,eAAA,GAAkB,OAAO,QAAA,IAAY,UAAA;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,KAAA,CACJ,QAAA,EACA,SAAA,EACA,OAAA,EACgB;AAChB,IAAA,OAAO,IAAA,CAAK,gBAAA,CAAoC,QAAA,EAAU,SAAA,EAAW,OAAO,CAAA;AAAA,EAC9E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,MAAA,CACJ,QAAA,EACA,SAAA,EACA,OAAA,EACgB;AAChB,IAAA,OAAO,IAAA,CAAK,gBAAA,CAAoC,QAAA,EAAU,SAAA,EAAW,OAAO,CAAA;AAAA,EAC9E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,gBAAA,CACZ,QAAA,EACA,SAAA,EACA,OAAA,EACgB;AAChB,IAAA,MAAM,QAAQ,OAAO,QAAA,KAAa,QAAA,GAAW,QAAA,GAAW,SAAS,QAAA,EAAS;AAE1E,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA;AAAA,MAC1B,IAAA,CAAK,eAAA;AAAA,MACL,EAAE,OAAO,SAAA,EAAU;AAAA,MACnB;AAAA,KACF;AAGA,IAAA,IAAI,QAAA,CAAS,MAAA,IAAU,QAAA,CAAS,MAAA,CAAO,SAAS,CAAA,EAAG;AACjD,MAAA,MAAM,UAAA,GAAa,QAAA,CAAS,MAAA,CAAO,CAAC,CAAA;AACpC,MAAA,MAAM,SAAA,GACH,UAAA,CAAW,UAAA,EAAY,IAAA,IAA+B,eAAA;AAEzD,MAAA,MAAM,IAAI,WAAA;AAAA,QACR,UAAA,CAAW,OAAA;AAAA,QACX,SAAA;AAAA,QACA,GAAA;AAAA,QACA,QAAA,CAAS;AAAA,OACX;AAAA,IACF;AAEA,IAAA,IAAI,QAAA,CAAS,IAAA,KAAS,MAAA,IAAa,QAAA,CAAS,SAAS,IAAA,EAAM;AACzD,MAAA,MAAM,IAAI,WAAA;AAAA,QACR,yCAAA;AAAA,QACA,SAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAEA,IAAA,OAAO,QAAA,CAAS,IAAA;AAAA,EAClB;AACF;;;AC3GA,SAAS,mBAAmB,MAAA,EAAwB;AAClD,EAAA,IAAI,IAAA,GAAO,MAAA;AACX,EAAA,WAAS;AACP,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,CAAQ,eAAA,EAAiB,EAAE,CAAA;AAChD,IAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,GAAG,CAAA,EAAG;AAC3B,MAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,CAAQ,IAAI,CAAA;AACpC,MAAA,IAAA,GAAO,YAAY,EAAA,GAAK,EAAA,GAAK,OAAA,CAAQ,KAAA,CAAM,UAAU,CAAC,CAAA;AACtD,MAAA;AAAA,IACF;AACA,IAAA,IAAI,YAAY,IAAA,EAAM;AACpB,MAAA,IAAA,GAAO,OAAA;AACP,MAAA;AAAA,IACF;AACA,IAAA,OAAO,OAAA;AAAA,EACT;AACF;AASO,SAAS,iBAAiB,QAAA,EAAiC;AAChE,EAAA,MAAM,MAAA,GAAS,mBAAmB,QAAQ,CAAA;AAE1C,EAAA,IAAI,MAAA,CAAO,UAAA,CAAW,GAAG,CAAA,EAAG;AAC1B,IAAA,OAAO,OAAA;AAAA,EACT;AAEA,EAAA,MAAM,KAAA,GAAQ,kCAAA,CAAmC,IAAA,CAAK,MAAM,CAAA;AAC5D,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,OAAO,SAAA;AAAA,EACT;AAEA,EAAA,OAAO,MAAM,CAAC,CAAA;AAChB;AAGO,SAAS,eAAe,QAAA,EAA2B;AACxD,EAAA,OAAO,gBAAA,CAAiB,QAAQ,CAAA,KAAM,cAAA;AACxC;;;AC/DA,IAAA,iBAAA,GAAA;AAAA,QAAA,CAAA,iBAAA,EAAA;AAAA,EAAA,qBAAA,EAAA,MAAA,qBAAA;AAAA,EAAA,qBAAA,EAAA,MAAA,qBAAA;AAAA,EAAA,oBAAA,EAAA,MAAA,oBAAA;AAAA,EAAA,WAAA,EAAA,MAAA,WAAA;AAAA,EAAA,YAAA,EAAA,MAAA,YAAA;AAAA,EAAA,SAAA,EAAA,MAAA,SAAA;AAAA,EAAA,QAAA,EAAA,MAAA,QAAA;AAAA,EAAA,gBAAA,EAAA,MAAA,gBAAA;AAAA,EAAA,eAAA,EAAA,MAAA,eAAA;AAAA,EAAA,eAAA,EAAA,MAAA,eAAA;AAAA,EAAA,kBAAA,EAAA,MAAA,kBAAA;AAAA,EAAA,aAAA,EAAA,MAAA,aAAA;AAAA,EAAA,kBAAA,EAAA,MAAA,kBAAA;AAAA,EAAA,yBAAA,EAAA,MAAA,yBAAA;AAAA,EAAA,QAAA,EAAA,MAAA,QAAA;AAAA,EAAA,cAAA,EAAA,MAAA,cAAA;AAAA,EAAA,yBAAA,EAAA,MAAA,yBAAA;AAAA,EAAA,oBAAA,EAAA,MAAA,oBAAA;AAAA,EAAA,gBAAA,EAAA,MAAA,gBAAA;AAAA,EAAA,uBAAA,EAAA,MAAA,uBAAA;AAAA,EAAA,qBAAA,EAAA,MAAA,qBAAA;AAAA,EAAA,sBAAA,EAAA,MAAA,sBAAA;AAAA,EAAA,yBAAA,EAAA,MAAA,yBAAA;AAAA,EAAA,YAAA,EAAA,MAAA,YAAA;AAAA,EAAA,uBAAA,EAAA,MAAA,uBAAA;AAAA,EAAA,yBAAA,EAAA,MAAA,yBAAA;AAAA,EAAA,0BAAA,EAAA,MAAA,0BAAA;AAAA,EAAA,gBAAA,EAAA,MAAA,gBAAA;AAAA,EAAA,eAAA,EAAA,MAAA,eAAA;AAAA,EAAA,aAAA,EAAA,MAAA,aAAA;AAAA,EAAA,cAAA,EAAA,MAAA,cAAA;AAAA,EAAA,UAAA,EAAA,MAAA,UAAA;AAAA,EAAA,iBAAA,EAAA,MAAA,iBAAA;AAAA,EAAA,oBAAA,EAAA,MAAA,oBAAA;AAAA,EAAA,gBAAA,EAAA,MAAA,gBAAA;AAAA,EAAA,eAAA,EAAA,MAAA,eAAA;AAAA,EAAA,cAAA,EAAA,MAAA,cAAA;AAAA,EAAA,eAAA,EAAA,MAAA,eAAA;AAAA,EAAA,QAAA,EAAA,MAAA,QAAA;AAAA,EAAA,YAAA,EAAA,MAAA,YAAA;AAAA,EAAA,kBAAA,EAAA,MAAA;AAAA,CAAA,CAAA","file":"chunk-GQJ3QQPH.js","sourcesContent":["import type { Middleware } from '../core/middleware.js';\nimport type { RequestContext, ResponseContext } from '../core/types.js';\n\n/**\n * Logger interface compatible with console and custom loggers.\n */\nexport interface Logger {\n  log: (message: string, ...args: unknown[]) => void;\n  error: (message: string, ...args: unknown[]) => void;\n}\n\n/**\n * Options for the logging middleware.\n */\nexport interface LoggingMiddlewareOptions {\n  /**\n   * Logger instance to use for output.\n   * Defaults to console.\n   */\n  logger?: Logger;\n\n  /**\n   * Whether to log request/response bodies.\n   * Default is false for security (bodies may contain sensitive data).\n   * @default false\n   */\n  logBody?: boolean;\n\n  /**\n   * Prefix for all log messages.\n   * @default '[MPF SDK]'\n   */\n  prefix?: string;\n\n  /**\n   * Whether to log request headers.\n   * Sensitive headers like Authorization are always redacted.\n   * @default false\n   */\n  logHeaders?: boolean;\n\n  /**\n   * List of header names to redact from logs (case-insensitive).\n   * @default ['authorization', 'cookie', 'x-api-key', 'x-auth-token']\n   */\n  redactHeaders?: string[];\n\n  /**\n   * Minimum duration in ms to log. Requests faster than this are not logged.\n   * Useful for reducing log volume in high-traffic scenarios.\n   * @default 0 (log all requests)\n   */\n  minDuration?: number;\n\n  /**\n   * Whether to include timestamp in log messages.\n   * @default true\n   */\n  includeTimestamp?: boolean;\n\n  /**\n   * Custom log formatter for requests.\n   * If provided, overrides the default request logging format.\n   */\n  formatRequest?: (ctx: RequestContext) => string;\n\n  /**\n   * Custom log formatter for responses.\n   * If provided, overrides the default response logging format.\n   */\n  formatResponse?: <T>(ctx: ResponseContext<T>) => string;\n\n  /**\n   * Custom log formatter for errors.\n   * If provided, overrides the default error logging format.\n   */\n  formatError?: (error: Error, ctx: RequestContext) => string;\n}\n\n/** Default headers to redact from logs */\nconst DEFAULT_REDACT_HEADERS = [\n  'authorization',\n  'cookie',\n  'x-api-key',\n  'x-auth-token',\n  'x-access-token',\n  'set-cookie',\n];\n\n/**\n * Format headers for logging, redacting sensitive values.\n */\nfunction formatHeaders(\n  headers: Headers | HeadersInit | undefined,\n  redactHeaders: string[]\n): Record<string, string> {\n  const result: Record<string, string> = {};\n\n  if (!headers) {\n    return result;\n  }\n\n  const headersObj = headers instanceof Headers ? headers : new Headers(headers);\n  const redactSet = new Set(redactHeaders.map((h) => h.toLowerCase()));\n\n  headersObj.forEach((value, key) => {\n    const lowerKey = key.toLowerCase();\n    if (redactSet.has(lowerKey)) {\n      result[key] = '[REDACTED]';\n    } else {\n      result[key] = value;\n    }\n  });\n\n  return result;\n}\n\n/**\n * Get current timestamp in ISO format.\n */\nfunction getTimestamp(): string {\n  return new Date().toISOString();\n}\n\n/**\n * Extract HTTP method from request init.\n */\nfunction getMethod(init: RequestInit): string {\n  return (init.method ?? 'GET').toUpperCase();\n}\n\n/**\n * Truncate body for logging if too long.\n */\nfunction truncateBody(body: unknown, maxLength: number = 1000): string {\n  if (body === undefined || body === null) {\n    return '';\n  }\n\n  let bodyStr: string;\n  if (typeof body === 'string') {\n    bodyStr = body;\n  } else if (body instanceof FormData) {\n    return '[FormData]';\n  } else if (body instanceof Blob) {\n    return `[Blob: ${body.size} bytes]`;\n  } else if (body instanceof ArrayBuffer || ArrayBuffer.isView(body)) {\n    const size = body instanceof ArrayBuffer ? body.byteLength : body.byteLength;\n    return `[Binary: ${size} bytes]`;\n  } else if (body instanceof URLSearchParams) {\n    bodyStr = body.toString();\n  } else if (body instanceof ReadableStream) {\n    return '[ReadableStream]';\n  } else {\n    try {\n      bodyStr = JSON.stringify(body);\n    } catch {\n      return '[Unserializable]';\n    }\n  }\n\n  if (bodyStr.length > maxLength) {\n    return bodyStr.substring(0, maxLength) + `... (${bodyStr.length} chars total)`;\n  }\n\n  return bodyStr;\n}\n\n/**\n * Creates a logging middleware for debugging and monitoring.\n *\n * The middleware logs:\n * - Request method, URL, and optionally body/headers\n * - Response status, URL, and duration\n * - Errors with context\n *\n * Sensitive headers (Authorization, Cookie, etc.) are automatically redacted.\n *\n * @param options - Configuration options for the logging middleware\n * @returns A middleware instance\n *\n * @example\n * ```typescript\n * const loggingMiddleware = createLoggingMiddleware({\n *   prefix: '[MyApp API]',\n *   logBody: false,\n *   logHeaders: true,\n * });\n * ```\n *\n * @example\n * ```typescript\n * // With custom logger\n * const loggingMiddleware = createLoggingMiddleware({\n *   logger: {\n *     log: (msg, ...args) => myLogger.info(msg, ...args),\n *     error: (msg, ...args) => myLogger.error(msg, ...args),\n *   },\n *   minDuration: 100, // Only log requests taking > 100ms\n * });\n * ```\n */\nexport function createLoggingMiddleware(options?: LoggingMiddlewareOptions): Middleware {\n  const {\n    logger = console,\n    logBody = false,\n    prefix = '[MPF SDK]',\n    logHeaders = false,\n    redactHeaders = DEFAULT_REDACT_HEADERS,\n    minDuration = 0,\n    includeTimestamp = true,\n    formatRequest: customFormatRequest,\n    formatResponse: customFormatResponse,\n    formatError: customFormatError,\n  } = options ?? {};\n\n  /**\n   * Build log prefix with optional timestamp.\n   */\n  function buildPrefix(): string {\n    if (includeTimestamp) {\n      return `${prefix} [${getTimestamp()}]`;\n    }\n    return prefix;\n  }\n\n  return {\n    name: 'logging',\n\n    onRequest(ctx: RequestContext): RequestContext {\n      // Store start time and request info for response logging\n      ctx.metadata['__requestStartTime'] = Date.now();\n      ctx.metadata['__requestMethod'] = getMethod(ctx.init);\n      ctx.metadata['__requestUrl'] = ctx.url;\n\n      const method = ctx.metadata['__requestMethod'] as string;\n      const logPrefix = buildPrefix();\n\n      if (customFormatRequest) {\n        logger.log(customFormatRequest(ctx));\n      } else {\n        const parts: string[] = [`${logPrefix} --> ${method} ${ctx.url}`];\n\n        if (logHeaders && ctx.init.headers) {\n          const headers = formatHeaders(ctx.init.headers, redactHeaders);\n          parts.push(`  Headers: ${JSON.stringify(headers)}`);\n        }\n\n        if (logBody && ctx.init.body) {\n          const body = truncateBody(ctx.init.body);\n          if (body) {\n            parts.push(`  Body: ${body}`);\n          }\n        }\n\n        logger.log(parts.join('\\n'));\n      }\n\n      return ctx;\n    },\n\n    onResponse<T>(ctx: ResponseContext<T>): ResponseContext<T> {\n      const startTime = ctx.metadata['__requestStartTime'] as number | undefined;\n      const duration = startTime ? Date.now() - startTime : 0;\n\n      // Skip logging if duration is below threshold\n      if (duration < minDuration) {\n        return ctx;\n      }\n\n      const method = (ctx.metadata['__requestMethod'] as string) || 'GET';\n      const status = ctx.response.status;\n      const statusText = ctx.response.statusText;\n      const url = (ctx.metadata['__requestUrl'] as string) || ctx.response.url || '(unknown)';\n      const logPrefix = buildPrefix();\n\n      if (customFormatResponse) {\n        logger.log(customFormatResponse(ctx));\n      } else {\n        const statusIcon = status >= 200 && status < 300 ? 'OK' : status >= 400 ? 'ERR' : 'WARN';\n        const parts: string[] = [\n          `${logPrefix} <-- ${method} ${url} ${status} ${statusText} (${duration}ms) [${statusIcon}]`,\n        ];\n\n        if (logHeaders) {\n          const headers = formatHeaders(ctx.response.headers, redactHeaders);\n          parts.push(`  Headers: ${JSON.stringify(headers)}`);\n        }\n\n        if (logBody && ctx.data !== undefined) {\n          const body = truncateBody(ctx.data);\n          if (body) {\n            parts.push(`  Body: ${body}`);\n          }\n        }\n\n        logger.log(parts.join('\\n'));\n      }\n\n      return ctx;\n    },\n\n    onError(error: Error, ctx: RequestContext): never {\n      const startTime = ctx.metadata['__requestStartTime'] as number | undefined;\n      const duration = startTime ? Date.now() - startTime : 0;\n      const method = getMethod(ctx.init);\n      const logPrefix = buildPrefix();\n\n      if (customFormatError) {\n        logger.error(customFormatError(error, ctx));\n      } else {\n        const parts: string[] = [\n          `${logPrefix} <-- ${method} ${ctx.url} ERROR (${duration}ms)`,\n          `  Error: ${error.name}: ${error.message}`,\n        ];\n\n        if (error.stack) {\n          // Only include first 3 lines of stack trace\n          const stackLines = error.stack.split('\\n').slice(1, 4);\n          parts.push(`  Stack: ${stackLines.join('\\n         ')}`);\n        }\n\n        logger.error(parts.join('\\n'));\n      }\n\n      throw error;\n    },\n  };\n}\n","/**\n * URL building utilities for the MPF SDK\n */\n\n/**\n * Build a URL with query parameters\n *\n * @param baseUrl - The base URL\n * @param path - The path to append\n * @param params - Optional query parameters\n * @returns The full URL with query string\n */\nexport function buildUrl(\n  baseUrl: string,\n  path: string,\n  params?: Record<string, string | number | boolean | undefined | null>\n): string {\n  // Remove trailing slash from base URL\n  const normalizedBase = baseUrl.replace(/\\/+$/, '');\n\n  // Ensure path starts with a slash\n  const normalizedPath = path.startsWith('/') ? path : `/${path}`;\n\n  const base = /^https?:\\/\\//.test(normalizedBase)\n    ? normalizedBase\n    : (typeof window !== 'undefined' ? window.location.origin : 'http://localhost');\n  const url = new URL(`${normalizedBase}${normalizedPath}`, base);\n\n  if (params) {\n    for (const [key, value] of Object.entries(params)) {\n      if (value !== undefined && value !== null) {\n        url.searchParams.append(key, String(value));\n      }\n    }\n  }\n\n  return url.toString();\n}\n\n/**\n * Join URL segments safely\n *\n * @param segments - URL segments to join\n * @returns Joined URL path\n */\nexport function joinPath(...segments: string[]): string {\n  return segments\n    .map((segment, index) => {\n      // Remove leading slash except for first segment\n      if (index > 0) {\n        segment = segment.replace(/^\\/+/, '');\n      }\n      // Remove trailing slash except for last segment\n      if (index < segments.length - 1) {\n        segment = segment.replace(/\\/+$/, '');\n      }\n      return segment;\n    })\n    .filter(Boolean)\n    .join('/');\n}\n","/**\n * GraphQL client that extends the base MPF client\n */\n\nimport { MPFClient } from '../core/client.js';\nimport type { ClientConfig } from '../core/types.js';\nimport type {\n  TypedDocumentNode,\n  GraphQLResponse,\n  GraphQLRequestOptions,\n} from './types.js';\nimport { MPFAPIError } from '../core/errors.js';\n\n/**\n * Configuration options for the GraphQL client\n */\nexport interface GraphQLClientConfig extends ClientConfig {\n  /**\n   * GraphQL endpoint path (default: '/graphql')\n   */\n  endpoint?: string;\n}\n\n/**\n * GraphQL client for MPF services\n *\n * Supports both raw query strings and typed document nodes for type-safe operations.\n *\n * @example\n * ```typescript\n * const client = new MPFGraphQLClient({ baseUrl: 'https://api.example.com' });\n *\n * // Using raw query string\n * const result = await client.query(`\n *   query GetUser($id: ID!) {\n *     user(id: $id) { id name email }\n *   }\n * `, { id: '123' });\n *\n * // Using typed document node (from codegen)\n * const typedResult = await client.query(GetUserDocument, { id: '123' });\n * ```\n */\nexport class MPFGraphQLClient extends MPFClient {\n  /** The GraphQL endpoint path */\n  protected graphqlEndpoint: string;\n\n  constructor(config: GraphQLClientConfig) {\n    super(config);\n    this.graphqlEndpoint = config.endpoint ?? '/graphql';\n  }\n\n  /**\n   * Execute a GraphQL query operation\n   *\n   * @param document - The GraphQL query (string or typed document node)\n   * @param variables - Optional variables for the query\n   * @param options - Optional request options (headers, signal)\n   * @returns The query result data\n   * @throws {MPFAPIError} When GraphQL errors occur or no data is returned\n   */\n  async query<TData, TVariables = Record<string, unknown>>(\n    document: TypedDocumentNode<TData, TVariables> | string,\n    variables?: TVariables,\n    options?: GraphQLRequestOptions\n  ): Promise<TData> {\n    return this.executeOperation<TData, TVariables>(document, variables, options);\n  }\n\n  /**\n   * Execute a GraphQL mutation operation\n   *\n   * @param document - The GraphQL mutation (string or typed document node)\n   * @param variables - Optional variables for the mutation\n   * @param options - Optional request options (headers, signal)\n   * @returns The mutation result data\n   * @throws {MPFAPIError} When GraphQL errors occur or no data is returned\n   */\n  async mutate<TData, TVariables = Record<string, unknown>>(\n    document: TypedDocumentNode<TData, TVariables> | string,\n    variables?: TVariables,\n    options?: GraphQLRequestOptions\n  ): Promise<TData> {\n    return this.executeOperation<TData, TVariables>(document, variables, options);\n  }\n\n  /**\n   * Execute a GraphQL operation (query or mutation)\n   *\n   * @internal\n   */\n  private async executeOperation<TData, TVariables>(\n    document: TypedDocumentNode<TData, TVariables> | string,\n    variables?: TVariables,\n    options?: GraphQLRequestOptions\n  ): Promise<TData> {\n    const query = typeof document === 'string' ? document : document.toString();\n\n    const response = await this.post<GraphQLResponse<TData>>(\n      this.graphqlEndpoint,\n      { query, variables },\n      options\n    );\n\n    // Handle GraphQL errors (they come in the response body, not HTTP status)\n    if (response.errors && response.errors.length > 0) {\n      const firstError = response.errors[0];\n      const errorCode =\n        (firstError.extensions?.code as string | undefined) ?? 'GRAPHQL_ERROR';\n\n      throw new MPFAPIError(\n        firstError.message,\n        errorCode,\n        200,\n        response.errors\n      );\n    }\n\n    if (response.data === undefined || response.data === null) {\n      throw new MPFAPIError(\n        'No data returned from GraphQL operation',\n        'NO_DATA',\n        200\n      );\n    }\n\n    return response.data;\n  }\n}\n","/**\n * Cheap operation-kind detection — no `graphql` parser dependency.\n *\n * The hybrid client only needs ONE bit: \"is this a subscription\". A full AST\n * parse (`graphql`'s `parse()` + `getOperationAST()`) would answer that too,\n * but it drags `graphql` into the HTTP-only path as a hard dependency, which\n * defeats the point of `graphql` staying an optional peer (see\n * `graphql/ws-client.ts`). A GraphQL document's operation keyword is always\n * the first non-trivia token — `query`/`mutation`/`subscription`, or omitted\n * entirely for the anonymous-query shorthand (`{ ... }`) — so a regex over the\n * leading trivia is exact, not a heuristic.\n */\n\n/** The three GraphQL operation kinds, plus `unknown` for an unparseable document. */\nexport type OperationKind = 'query' | 'mutation' | 'subscription' | 'unknown';\n\n/**\n * Strip GraphQL trivia (whitespace, commas, `#`-comments) from the START of a\n * document string, mirroring the lexer's own definition of \"ignored tokens\"\n * (GraphQL spec §2.1.4) closely enough to find the first real token.\n */\nfunction stripLeadingTrivia(source: string): string {\n  let rest = source;\n  for (;;) {\n    const trimmed = rest.replace(/^[\\s,\\uFEFF]+/, '');\n    if (trimmed.startsWith('#')) {\n      const newline = trimmed.indexOf('\\n');\n      rest = newline === -1 ? '' : trimmed.slice(newline + 1);\n      continue;\n    }\n    if (trimmed !== rest) {\n      rest = trimmed;\n      continue;\n    }\n    return trimmed;\n  }\n}\n\n/**\n * Determine a GraphQL document's operation kind from its source text.\n *\n * `{ ... }` (no keyword) is the anonymous-query shorthand and is always a\n * `query` — a `subscription` document is never allowed to omit its keyword,\n * per the GraphQL spec, so this cannot misclassify a subscription as a query.\n */\nexport function getOperationKind(document: string): OperationKind {\n  const source = stripLeadingTrivia(document);\n\n  if (source.startsWith('{')) {\n    return 'query';\n  }\n\n  const match = /^(query|mutation|subscription)\\b/.exec(source);\n  if (!match) {\n    return 'unknown';\n  }\n\n  return match[1] as OperationKind;\n}\n\n/** Whether a GraphQL document is a subscription. */\nexport function isSubscription(document: string): boolean {\n  return getOperationKind(document) === 'subscription';\n}\n","/**\n * The part of `./client` that reaches NO optional peer dependency.\n *\n * This file exists so the root barrel can expose a `client` namespace without\n * dragging `graphql-ws` into every consumer's module graph.\n *\n * `createGraphQLClient` (in `graphql/factory.ts`) and `createGraphQLWsTransport`\n * (in `graphql/ws-client.ts`) reach `graphql-ws`. It is only ever loaded through\n * a dynamic `import()`, so nothing breaks at runtime for an app that never\n * subscribes — but a *static* export chain from `src/index.ts` still puts those\n * modules (and the dynamic-import chunk a bundler emits for them) in the graph\n * of every consumer, including plain-HTTP ones. So they are reachable from the\n * `./client` subpath only, never from the root namespace.\n *\n * This is the same rule `./react` follows for its `react` peer. See\n * `tests/module-boundaries.test.ts` (\"depends on jose only\") for the guard.\n *\n * @packageDocumentation\n */\n\n// Core transport: client, middleware machinery, errors, shared types.\nexport * from './core/index.js';\n\n// Generic middlewares: auth, admin-auth, tenant, retry, logging, turnstile.\nexport * from './middlewares/index.js';\n\n// URL helpers.\nexport * from './utils/url.js';\n\n// GraphQL over plain HTTP. No optional peer involved: the request goes through\n// the same `fetch` path as every other client.\nexport { MPFGraphQLClient, type GraphQLClientConfig } from './graphql/client.js';\nexport type {\n  TypedDocumentNode,\n  GraphQLError,\n  GraphQLResponse,\n  GraphQLRequestOptions,\n} from './graphql/types.js';\n\n// Pure string inspection of a GraphQL document — no dependencies at all.\nexport { getOperationKind, isSubscription, type OperationKind } from './graphql/operation.js';\n"]}

package/dist/chunk-K2ELAI2X.js

@@ -0,0 +1,64 @@
+import { createAuthMiddleware } from './chunk-LRM6JJ63.js';
+import { SignJWT } from 'jose';
+
+var AdminEmptySecretError = class extends Error {
+  constructor() {
+    super("auth: admin JWT signing secret must not be empty");
+    this.name = "AdminEmptySecretError";
+  }
+};
+var AdminEmptyUserIDError = class extends Error {
+  constructor() {
+    super("auth: act_on_behalf_of.user_id must not be empty");
+    this.name = "AdminEmptyUserIDError";
+  }
+};
+async function issueAdminToken(secret, actOnBehalfOf, ttlSeconds) {
+  if (!secret) {
+    throw new AdminEmptySecretError();
+  }
+  if (!actOnBehalfOf.userId) {
+    throw new AdminEmptyUserIDError();
+  }
+  const nowSeconds = Math.floor(Date.now() / 1e3);
+  const key = new TextEncoder().encode(secret);
+  const actClaim = {
+    user_id: actOnBehalfOf.userId,
+    ...actOnBehalfOf.onTenantId ? { on_tenant_id: actOnBehalfOf.onTenantId } : {}
+  };
+  return new SignJWT({ act_on_behalf_of: actClaim }).setProtectedHeader({ alg: "HS256" }).setIssuedAt(nowSeconds).setExpirationTime(nowSeconds + ttlSeconds).sign(key);
+}
+function createAdminAuthMiddleware(options) {
+  const getAccessToken = "token" in options && options.token !== void 0 ? () => options.token : () => {
+    const { secret, actOnBehalfOf, ttlSeconds } = options.config;
+    return issueAdminToken(secret, actOnBehalfOf, ttlSeconds);
+  };
+  return createAuthMiddleware({
+    getAccessToken,
+    tokenType: "Admin"
+  });
+}
+
+// src/client/middlewares/turnstile.ts
+function createTurnstileMiddleware(options) {
+  const { getToken, protectedPaths } = options;
+  return {
+    name: "turnstile",
+    async onRequest(ctx) {
+      const url = new URL(ctx.url, "http://localhost");
+      const isProtected = protectedPaths.some((path) => url.pathname.endsWith(path));
+      if (!isProtected) {
+        return ctx;
+      }
+      const token = await getToken();
+      const headers = new Headers(ctx.init.headers);
+      headers.set("X-Turnstile-Token", token);
+      ctx.init.headers = headers;
+      return ctx;
+    }
+  };
+}
+
+export { AdminEmptySecretError, AdminEmptyUserIDError, createAdminAuthMiddleware, createTurnstileMiddleware, issueAdminToken };
+//# sourceMappingURL=chunk-K2ELAI2X.js.map
+//# sourceMappingURL=chunk-K2ELAI2X.js.map

package/dist/chunk-K2ELAI2X.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/client/middlewares/admin-auth.ts","../src/client/middlewares/turnstile.ts"],"names":[],"mappings":";;;AAmBO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/C,WAAA,GAAc;AACZ,IAAA,KAAA,CAAM,kDAAkD,CAAA;AACxD,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AAAA,EACd;AACF;AAGO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/C,WAAA,GAAc;AACZ,IAAA,KAAA,CAAM,kDAAkD,CAAA;AACxD,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AAAA,EACd;AACF;AA0BA,eAAsB,eAAA,CACpB,MAAA,EACA,aAAA,EACA,UAAA,EACiB;AACjB,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAM,IAAI,qBAAA,EAAsB;AAAA,EAClC;AACA,EAAA,IAAI,CAAC,cAAc,MAAA,EAAQ;AACzB,IAAA,MAAM,IAAI,qBAAA,EAAsB;AAAA,EAClC;AAEA,EAAA,MAAM,aAAa,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAC/C,EAAA,MAAM,GAAA,GAAM,IAAI,WAAA,EAAY,CAAE,OAAO,MAAM,CAAA;AAE3C,EAAA,MAAM,QAAA,GAAuD;AAAA,IAC3D,SAAS,aAAA,CAAc,MAAA;AAAA,IACvB,GAAI,cAAc,UAAA,GAAa,EAAE,cAAc,aAAA,CAAc,UAAA,KAAe;AAAC,GAC/E;AAEA,EAAA,OAAO,IAAI,QAAQ,EAAE,gBAAA,EAAkB,UAAU,CAAA,CAC9C,mBAAmB,EAAE,GAAA,EAAK,SAAS,CAAA,CACnC,YAAY,UAAU,CAAA,CACtB,kBAAkB,UAAA,GAAa,UAAU,CAAA,CACzC,IAAA,CAAK,GAAG,CAAA;AACb;AA+CO,SAAS,0BAA0B,OAAA,EAAiD;AACzF,EAAA,MAAM,cAAA,GACJ,WAAW,OAAA,IAAW,OAAA,CAAQ,UAAU,MAAA,GACpC,MAAM,OAAA,CAAQ,KAAA,GACd,MAAM;AACJ,IAAA,MAAM,EAAE,MAAA,EAAQ,aAAA,EAAe,UAAA,KAAe,OAAA,CAAQ,MAAA;AACtD,IAAA,OAAO,eAAA,CAAgB,MAAA,EAAQ,aAAA,EAAe,UAAU,CAAA;AAAA,EAC1D,CAAA;AAEN,EAAA,OAAO,oBAAA,CAAqB;AAAA,IAC1B,cAAA;AAAA,IACA,SAAA,EAAW;AAAA,GACZ,CAAA;AACH;;;ACnGO,SAAS,0BAA0B,OAAA,EAAiD;AACzF,EAAA,MAAM,EAAE,QAAA,EAAU,cAAA,EAAe,GAAI,OAAA;AAErC,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,WAAA;AAAA,IAEN,MAAM,UAAU,GAAA,EAA8C;AAE5D,MAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,GAAA,CAAI,KAAK,kBAAkB,CAAA;AAC/C,MAAA,MAAM,WAAA,GAAc,eAAe,IAAA,CAAK,CAAA,IAAA,KAAQ,IAAI,QAAA,CAAS,QAAA,CAAS,IAAI,CAAC,CAAA;AAE3E,MAAA,IAAI,CAAC,WAAA,EAAa;AAChB,QAAA,OAAO,GAAA;AAAA,MACT;AAEA,MAAA,MAAM,KAAA,GAAQ,MAAM,QAAA,EAAS;AAC7B,MAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,GAAA,CAAI,KAAK,OAAO,CAAA;AAC5C,MAAA,OAAA,CAAQ,GAAA,CAAI,qBAAqB,KAAK,CAAA;AACtC,MAAA,GAAA,CAAI,KAAK,OAAA,GAAU,OAAA;AAEnB,MAAA,OAAO,GAAA;AAAA,IACT;AAAA,GACF;AACF","file":"chunk-K2ELAI2X.js","sourcesContent":["import { SignJWT } from 'jose';\nimport type { Middleware } from '../core/middleware.js';\nimport { createAuthMiddleware } from './auth.js';\n\n/**\n * Impersonation payload embedded in an admin token.\n *\n * Mirrors the Go `ActOnBehalfOf` struct\n * (`internal/go-chi-middleware-auth/types.go`), which the Go verifier reads\n * from the `act_on_behalf_of` JWT claim.\n */\nexport interface AdminActOnBehalfOf {\n  /** The subject (user) the admin token acts on behalf of. Required. */\n  userId: string;\n  /** Optionally scopes the impersonation to a tenant. */\n  onTenantId?: string;\n}\n\n/** Error thrown when an admin token is minted without a signing secret. */\nexport class AdminEmptySecretError extends Error {\n  constructor() {\n    super('auth: admin JWT signing secret must not be empty');\n    this.name = 'AdminEmptySecretError';\n  }\n}\n\n/** Error thrown when an admin token is minted without a subject user id. */\nexport class AdminEmptyUserIDError extends Error {\n  constructor() {\n    super('auth: act_on_behalf_of.user_id must not be empty');\n    this.name = 'AdminEmptyUserIDError';\n  }\n}\n\n/**\n * Mints an HS256-signed Admin JWT that impersonates `actOnBehalfOf`.\n *\n * The minted token interoperates byte-for-byte with the Go verifier in\n * `internal/go-chi-middleware-auth/auth.go` (`parseAdmin`):\n *   - Protected header `{ alg: 'HS256' }`.\n *   - Required `exp` claim (`now + ttlSeconds`), which the Go side enforces via\n *     `jwt.WithExpirationRequired()`.\n *   - An `iat` claim of `now`.\n *   - An `act_on_behalf_of` object claim with `user_id` (required) and an\n *     optional `on_tenant_id`, matching the Go `ActOnBehalfOf` JSON tags.\n *\n * SECURITY: Minting an admin token requires the shared `ADMIN_JWT_SECRET`.\n * This secret grants the ability to impersonate ANY user, so it MUST ONLY be\n * used server-side or by trusted backend services. NEVER ship the secret to a\n * browser or any untrusted client, and never embed it in frontend bundles.\n *\n * @param secret - The shared HS256 signing secret (`ADMIN_JWT_SECRET`).\n * @param actOnBehalfOf - The principal to impersonate.\n * @param ttlSeconds - Token lifetime in seconds (added to the current time).\n * @returns The signed compact JWT string.\n * @throws {AdminEmptySecretError} when `secret` is empty.\n * @throws {AdminEmptyUserIDError} when `actOnBehalfOf.userId` is empty.\n */\nexport async function issueAdminToken(\n  secret: string,\n  actOnBehalfOf: AdminActOnBehalfOf,\n  ttlSeconds: number\n): Promise<string> {\n  if (!secret) {\n    throw new AdminEmptySecretError();\n  }\n  if (!actOnBehalfOf.userId) {\n    throw new AdminEmptyUserIDError();\n  }\n\n  const nowSeconds = Math.floor(Date.now() / 1000);\n  const key = new TextEncoder().encode(secret);\n\n  const actClaim: { user_id: string; on_tenant_id?: string } = {\n    user_id: actOnBehalfOf.userId,\n    ...(actOnBehalfOf.onTenantId ? { on_tenant_id: actOnBehalfOf.onTenantId } : {}),\n  };\n\n  return new SignJWT({ act_on_behalf_of: actClaim })\n    .setProtectedHeader({ alg: 'HS256' })\n    .setIssuedAt(nowSeconds)\n    .setExpirationTime(nowSeconds + ttlSeconds)\n    .sign(key);\n}\n\n/**\n * Options for the admin auth middleware.\n *\n * Exactly one of `token` (pre-minted) or `config` (mint-per-request) must be\n * provided.\n */\nexport type AdminAuthMiddlewareOptions =\n  | {\n      /** A pre-minted admin JWT to attach as `Authorization: Admin <token>`. */\n      token: string;\n      config?: never;\n    }\n  | {\n      token?: never;\n      /**\n       * Per-request minting config (analogous to Go's `AdminRoundTripper`):\n       * a fresh admin token is minted for every request.\n       */\n      config: {\n        /** The shared HS256 signing secret (`ADMIN_JWT_SECRET`). */\n        secret: string;\n        /** The principal to impersonate. */\n        actOnBehalfOf: AdminActOnBehalfOf;\n        /** Token lifetime in seconds. */\n        ttlSeconds: number;\n      };\n    };\n\n/**\n * Creates an admin authentication middleware that stamps an\n * `Authorization: Admin <token>` header on outgoing requests.\n *\n * Reuses {@link createAuthMiddleware} with `tokenType: 'Admin'`. Two ergonomics\n * are supported:\n *   - `{ token }`: attach a pre-minted admin token.\n *   - `{ config }`: mint a fresh admin token per request (like Go's\n *     `AdminRoundTripper`).\n *\n * SECURITY: When using `config`, the `ADMIN_JWT_SECRET` is held in memory and\n * used to mint tokens. Only construct this middleware server-side / in trusted\n * services. NEVER ship the secret to a browser.\n *\n * @param options - Either a pre-minted `token` or a minting `config`.\n * @returns A middleware instance.\n */\nexport function createAdminAuthMiddleware(options: AdminAuthMiddlewareOptions): Middleware {\n  const getAccessToken =\n    'token' in options && options.token !== undefined\n      ? () => options.token\n      : () => {\n          const { secret, actOnBehalfOf, ttlSeconds } = options.config;\n          return issueAdminToken(secret, actOnBehalfOf, ttlSeconds);\n        };\n\n  return createAuthMiddleware({\n    getAccessToken,\n    tokenType: 'Admin',\n  });\n}\n","import type { Middleware } from '../core/middleware.js';\nimport type { RequestContext } from '../core/types.js';\n\n/**\n * Options for the Turnstile middleware.\n */\nexport interface TurnstileMiddlewareOptions {\n  /**\n   * Async function that mints a fresh Turnstile token.\n   * Called once per protected request. Must return a valid token string.\n   * Should throw if token cannot be obtained.\n   */\n  getToken: () => Promise<string>;\n\n  /**\n   * URL path suffixes that require a Turnstile token.\n   * Matched against the end of the request URL path.\n   * Example: ['/sign-up-email-password', '/sign-in-email-password']\n   */\n  protectedPaths: string[];\n}\n\n/**\n * Creates a Cloudflare Turnstile middleware that attaches `X-Turnstile-Token`\n * headers to requests matching the configured protected paths.\n *\n * The middleware only calls `getToken()` for requests whose URL path ends\n * with one of the `protectedPaths` entries — all other requests pass through\n * untouched with zero overhead.\n *\n * @param options - Configuration options for the turnstile middleware\n * @returns A middleware instance\n *\n * @example\n * ```typescript\n * const turnstileMiddleware = createTurnstileMiddleware({\n *   getToken: async () => {\n *     // Render Turnstile widget and return token\n *     return await turnstile.execute(siteKey);\n *   },\n *   protectedPaths: ['/sign-up-email-password', '/sign-in-email-password'],\n * });\n * ```\n */\nexport function createTurnstileMiddleware(options: TurnstileMiddlewareOptions): Middleware {\n  const { getToken, protectedPaths } = options;\n\n  return {\n    name: 'turnstile',\n\n    async onRequest(ctx: RequestContext): Promise<RequestContext> {\n      // Check if this request URL matches any protected path\n      const url = new URL(ctx.url, 'http://localhost');\n      const isProtected = protectedPaths.some(path => url.pathname.endsWith(path));\n\n      if (!isProtected) {\n        return ctx;\n      }\n\n      const token = await getToken();\n      const headers = new Headers(ctx.init.headers);\n      headers.set('X-Turnstile-Token', token);\n      ctx.init.headers = headers;\n\n      return ctx;\n    },\n  };\n}\n"]}