reflet-sdk 0.1.1 → 0.1.3

package/README.md

@@ -112,7 +112,7 @@ For production apps, sign user tokens on your server to prevent spoofing:
 import { signUser } from 'reflet-sdk/server';
 
 export async function getUserToken(user: User) {
-  const { token, expiresAt } = signUser(
+  const { token, expiresAt } = await signUser(
     {
       id: user.id,
       email: user.email,
@@ -185,14 +185,16 @@ const reflet = new Reflet(config: RefletConfig);
 
 ### Server Utilities
 
+Works in Node.js, Edge runtimes, Cloudflare Workers, and Convex.
+
 ```typescript
 import { signUser, verifyUser } from 'reflet-sdk/server';
 
-// Sign a user token
-const { token, expiresAt } = signUser(user, secretKey, expiresInSeconds?);
+// Sign a user token (async - uses Web Crypto API)
+const { token, expiresAt } = await signUser(user, secretKey, expiresInSeconds?);
 
 // Verify a token (optional - server-side validation)
-const user = verifyUser(token, secretKey);
+const user = await verifyUser(token, secretKey);
 ```
 
 ## Types

package/dist/{chunk-AHWT4I4V.js → chunk-C342WLTD.js}

@@ -185,9 +185,9 @@ var Reflet = class {
     return await this.request("GET", url);
   }
   /**
-   * Make an authenticated API request
+   * Build request headers with authentication
    */
-  async request(method, path, body) {
+  buildHeaders() {
     const headers = {
       "Content-Type": "application/json",
       Authorization: `Bearer ${this.publicKey}`
@@ -196,21 +196,62 @@ var Reflet = class {
     if (token) {
       headers["X-User-Token"] = token;
     }
-    const response = await fetch(`${this.baseUrl}${path}`, {
-      method,
-      headers,
-      body: body ? JSON.stringify(body) : void 0
-    });
-    const data = await response.json();
-    if (!response.ok) {
-      const errorMessage = data.error ?? "Request failed";
-      if (response.status === 401) {
-        throw new RefletAuthError(errorMessage);
-      }
-      if (response.status === 404) {
-        throw new RefletNotFoundError(errorMessage);
+    return headers;
+  }
+  /**
+   * Parse JSON response text safely
+   */
+  parseJsonSafely(text, status) {
+    try {
+      return JSON.parse(text);
+    } catch (parseError) {
+      throw new RefletError(
+        `Invalid response: ${parseError instanceof Error ? parseError.message : "Failed to parse JSON"}`,
+        status
+      );
+    }
+  }
+  /**
+   * Throw appropriate error based on status code
+   */
+  throwHttpError(message, status) {
+    if (status === 401) {
+      throw new RefletAuthError(message);
+    }
+    if (status === 404) {
+      throw new RefletNotFoundError(message);
+    }
+    throw new RefletError(message, status);
+  }
+  /**
+   * Make an authenticated API request
+   */
+  async request(method, path, body) {
+    let response;
+    try {
+      response = await fetch(`${this.baseUrl}${path}`, {
+        method,
+        headers: this.buildHeaders(),
+        body: body ? JSON.stringify(body) : void 0
+      });
+    } catch (networkError) {
+      const message = networkError instanceof Error ? networkError.message : "Failed to connect";
+      throw new RefletError(`Network error: ${message}`, 0);
+    }
+    const text = await response.text();
+    if (!text) {
+      if (!response.ok) {
+        this.throwHttpError(
+          `Request failed with status ${response.status}`,
+          response.status
+        );
       }
-      throw new RefletError(errorMessage, response.status);
+      return {};
+    }
+    const data = this.parseJsonSafely(text, response.status);
+    if (!response.ok) {
+      const errorMessage = data.error ?? `Request failed with status ${response.status}`;
+      this.throwHttpError(errorMessage, response.status);
     }
     return data;
   }
@@ -237,5 +278,5 @@ var Reflet = class {
 };
 
 export { Reflet, RefletAuthError, RefletError, RefletNotFoundError, RefletValidationError };
-//# sourceMappingURL=chunk-AHWT4I4V.js.map
-//# sourceMappingURL=chunk-AHWT4I4V.js.map
+//# sourceMappingURL=chunk-C342WLTD.js.map
+//# sourceMappingURL=chunk-C342WLTD.js.map

package/dist/chunk-C342WLTD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/types.ts","../src/client.ts"],"names":[],"mappings":";AA+OO,IAAM,WAAA,GAAN,cAA0B,KAAA,CAAM;AAAA,EAC5B,MAAA;AAAA,EACA,IAAA;AAAA,EAET,WAAA,CAAY,OAAA,EAAiB,MAAA,EAAgB,IAAA,EAAe;AAC1D,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,aAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAEO,IAAM,eAAA,GAAN,cAA8B,WAAA,CAAY;AAAA,EAC/C,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAA,EAAS,KAAK,YAAY,CAAA;AAChC,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AAAA,EACd;AACF;AAEO,IAAM,qBAAA,GAAN,cAAoC,WAAA,CAAY;AAAA,EACrD,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAA,EAAS,KAAK,kBAAkB,CAAA;AACtC,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AAAA,EACd;AACF;AAEO,IAAM,mBAAA,GAAN,cAAkC,WAAA,CAAY;AAAA,EACnD,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAA,EAAS,KAAK,WAAW,CAAA;AAC/B,IAAA,IAAA,CAAK,IAAA,GAAO,qBAAA;AAAA,EACd;AACF;;;ACvPA,IAAM,eAAA,GAAkB,wCAAA;AAwBjB,IAAM,SAAN,MAAa;AAAA,EACD,SAAA;AAAA,EACA,OAAA;AAAA,EACT,SAAA;AAAA,EACA,IAAA;AAAA,EAER,YAAY,MAAA,EAAsB;AAChC,IAAA,IAAA,CAAK,YAAY,MAAA,CAAO,SAAA;AACxB,IAAA,IAAA,CAAK,OAAA,GAAU,OAAO,OAAA,IAAW,eAAA;AACjC,IAAA,IAAA,CAAK,YAAY,MAAA,CAAO,SAAA;AACxB,IAAA,IAAA,CAAK,OAAO,MAAA,CAAO,IAAA;AAEnB,IAAA,IAAI,CAAC,KAAK,SAAA,EAAW;AACnB,MAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,IACjD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,QAAQ,IAAA,EAAoC;AAC1C,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,SAAA,GAAY,MAAA;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA,EAKA,aAAa,KAAA,EAAiC;AAC5C,IAAA,IAAA,CAAK,SAAA,GAAY,KAAA;AACjB,IAAA,IAAA,CAAK,IAAA,GAAO,MAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,SAAA,GAAkC;AACtC,IAAA,OAAO,MAAM,IAAA,CAAK,OAAA,CAAqB,KAAA,EAAO,kBAAkB,CAAA;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,KAAK,MAAA,EAA4D;AACrE,IAAA,MAAM,YAAA,GAAe,IAAI,eAAA,EAAgB;AAEzC,IAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,MAAA,YAAA,CAAa,GAAA,CAAI,UAAA,EAAY,MAAA,CAAO,QAAQ,CAAA;AAAA,IAC9C;AACA,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,YAAA,CAAa,GAAA,CAAI,QAAA,EAAU,MAAA,CAAO,MAAM,CAAA;AAAA,IAC1C;AACA,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,YAAA,CAAa,GAAA,CAAI,QAAA,EAAU,MAAA,CAAO,MAAM,CAAA;AAAA,IAC1C;AACA,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,YAAA,CAAa,GAAA,CAAI,QAAA,EAAU,MAAA,CAAO,MAAM,CAAA;AAAA,IAC1C;AACA,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,YAAA,CAAa,GAAA,CAAI,OAAA,EAAS,MAAA,CAAO,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,IAChD;AACA,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,YAAA,CAAa,GAAA,CAAI,QAAA,EAAU,MAAA,CAAO,MAAA,CAAO,MAAM,CAAC,CAAA;AAAA,IAClD;AAEA,IAAA,MAAM,KAAA,GAAQ,aAAa,QAAA,EAAS;AACpC,IAAA,MAAM,MAAM,CAAA,qBAAA,EAAwB,KAAA,GAAQ,CAAA,CAAA,EAAI,KAAK,KAAK,EAAE,CAAA,CAAA;AAE5D,IAAA,OAAO,MAAM,IAAA,CAAK,OAAA,CAA8B,KAAA,EAAO,GAAG,CAAA;AAAA,EAC5D;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,IAAI,UAAA,EAA6C;AACrD,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,OAAA;AAAA,MACxB,KAAA;AAAA,MACA,CAAA,yBAAA,EAA4B,kBAAA,CAAmB,UAAU,CAAC,CAAA;AAAA,KAC5D;AAEA,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,MAAM,IAAI,oBAAoB,oBAAoB,CAAA;AAAA,IACpD;AAEA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAO,MAAA,EAA+D;AAC1E,IAAA,OAAO,MAAM,IAAA,CAAK,OAAA;AAAA,MAChB,MAAA;AAAA,MACA,yBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,IAAA,CACJ,UAAA,EACA,IAAA,GAA8B,QAAA,EACP;AACvB,IAAA,OAAO,MAAM,IAAA,CAAK,OAAA,CAAsB,MAAA,EAAQ,uBAAA,EAAyB;AAAA,MACvE,UAAA;AAAA,MACA,QAAA,EAAU;AAAA,KACX,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,WAAA,CACJ,UAAA,EACA,MAAA,GAA8B,QAAA,EACV;AACpB,IAAA,OAAO,MAAM,IAAA,CAAK,OAAA;AAAA,MAChB,KAAA;AAAA,MACA,CAAA,qCAAA,EAAwC,kBAAA,CAAmB,UAAU,CAAC,WAAW,MAAM,CAAA;AAAA,KACzF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,QAAQ,MAAA,EAAuD;AACnE,IAAA,OAAO,MAAM,IAAA,CAAK,OAAA;AAAA,MAChB,MAAA;AAAA,MACA,0BAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,UAAU,UAAA,EAAgD;AAC9D,IAAA,OAAO,MAAM,IAAA,CAAK,OAAA;AAAA,MAChB,MAAA;AAAA,MACA,4BAAA;AAAA,MACA;AAAA,QACE;AAAA;AACF,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,YAAY,UAAA,EAAkD;AAClE,IAAA,OAAO,MAAM,IAAA,CAAK,OAAA;AAAA,MAChB,MAAA;AAAA,MACA,8BAAA;AAAA,MACA;AAAA,QACE;AAAA;AACF,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAA,GAA+B;AACnC,IAAA,OAAO,MAAM,IAAA,CAAK,OAAA,CAAiB,KAAA,EAAO,0BAA0B,CAAA;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,KAAA,EAA2C;AAC5D,IAAA,MAAM,GAAA,GAAM,KAAA,GACR,CAAA,iCAAA,EAAoC,KAAK,CAAA,CAAA,GACzC,4BAAA;AAEJ,IAAA,OAAO,MAAM,IAAA,CAAK,OAAA,CAA0B,KAAA,EAAO,GAAG,CAAA;AAAA,EACxD;AAAA;AAAA;AAAA;AAAA,EAKQ,YAAA,GAAuC;AAC7C,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,cAAA,EAAgB,kBAAA;AAAA,MAChB,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,SAAS,CAAA;AAAA,KACzC;AAEA,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,SAAA,IAAa,IAAA,CAAK,iBAAA,EAAkB;AACvD,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,OAAA,CAAQ,cAAc,CAAA,GAAI,KAAA;AAAA,IAC5B;AAEA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKQ,eAAA,CACN,MACA,MAAA,EACuB;AACvB,IAAA,IAAI;AACF,MAAA,OAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,IACxB,SAAS,UAAA,EAAY;AACnB,MAAA,MAAM,IAAI,WAAA;AAAA,QACR,CAAA,kBAAA,EAAqB,UAAA,YAAsB,KAAA,GAAQ,UAAA,CAAW,UAAU,sBAAsB,CAAA,CAAA;AAAA,QAC9F;AAAA,OACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,cAAA,CAAe,SAAiB,MAAA,EAAuB;AAC7D,IAAA,IAAI,WAAW,GAAA,EAAK;AAClB,MAAA,MAAM,IAAI,gBAAgB,OAAO,CAAA;AAAA,IACnC;AACA,IAAA,IAAI,WAAW,GAAA,EAAK;AAClB,MAAA,MAAM,IAAI,oBAAoB,OAAO,CAAA;AAAA,IACvC;AACA,IAAA,MAAM,IAAI,WAAA,CAAY,OAAA,EAAS,MAAM,CAAA;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,OAAA,CACZ,MAAA,EACA,IAAA,EACA,IAAA,EACY;AACZ,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,MAAM,KAAA,CAAM,CAAA,EAAG,KAAK,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI;AAAA,QAC/C,MAAA;AAAA,QACA,OAAA,EAAS,KAAK,YAAA,EAAa;AAAA,QAC3B,IAAA,EAAM,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,GAAI,KAAA;AAAA,OACrC,CAAA;AAAA,IACH,SAAS,YAAA,EAAc;AACrB,MAAA,MAAM,OAAA,GACJ,YAAA,YAAwB,KAAA,GACpB,YAAA,CAAa,OAAA,GACb,mBAAA;AACN,MAAA,MAAM,IAAI,WAAA,CAAY,CAAA,eAAA,EAAkB,OAAO,IAAI,CAAC,CAAA;AAAA,IACtD;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AAGjC,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,IAAA,CAAK,cAAA;AAAA,UACH,CAAA,2BAAA,EAA8B,SAAS,MAAM,CAAA,CAAA;AAAA,UAC7C,QAAA,CAAS;AAAA,SACX;AAAA,MACF;AACA,MAAA,OAAO,EAAC;AAAA,IACV;AAEA,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,eAAA,CAAmB,IAAA,EAAM,SAAS,MAAM,CAAA;AAE1D,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,YAAA,GACH,IAAA,CAA4B,KAAA,IAC7B,CAAA,2BAAA,EAA8B,SAAS,MAAM,CAAA,CAAA;AAC/C,MAAA,IAAA,CAAK,cAAA,CAAe,YAAA,EAAc,QAAA,CAAS,MAAM,CAAA;AAAA,IACnD;AAEA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,iBAAA,GAAwC;AAC9C,IAAA,IAAI,CAAC,KAAK,IAAA,EAAM;AACd,MAAA,OAAO,MAAA;AAAA,IACT;AAIA,IAAA,MAAM,OAAA,GAAU;AAAA,MACd,EAAA,EAAI,KAAK,IAAA,CAAK,EAAA;AAAA,MACd,KAAA,EAAO,KAAK,IAAA,CAAK,KAAA;AAAA,MACjB,IAAA,EAAM,KAAK,IAAA,CAAK,IAAA;AAAA,MAChB,KAAK,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAAA,MACjC,KAAK,IAAA,CAAK,KAAA,CAAM,KAAK,GAAA,EAAI,GAAI,GAAI,CAAA,GAAI;AAAA;AAAA,KACvC;AAEA,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,EAAE,KAAK,MAAA,EAAQ,GAAA,EAAK,KAAA,EAAO,CAAC,CAAA;AAC/D,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA;AAE/C,IAAA,OAAO,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,UAAU,CAAA,CAAA,CAAA;AAAA,EAChC;AACF","file":"chunk-C342WLTD.js","sourcesContent":["/**\n * Reflet SDK Types\n */\n\n// ============================================\n// Configuration\n// ============================================\n\nexport interface RefletConfig {\n  /** Your board's public API key (fb_pub_xxx) */\n  publicKey: string;\n  /** API base URL (optional, defaults to Reflet production API) */\n  baseUrl?: string;\n  /** User identification for SSO */\n  user?: RefletUser;\n  /** Pre-signed user token (alternative to user object) */\n  userToken?: string;\n}\n\nexport interface RefletUser {\n  /** Unique identifier for the user in your system */\n  id: string;\n  /** User's email address */\n  email?: string;\n  /** User's display name */\n  name?: string;\n  /** URL to user's avatar image */\n  avatar?: string;\n  /** Additional metadata */\n  metadata?: Record<string, unknown>;\n}\n\n// ============================================\n// API Responses\n// ============================================\n\nexport interface BoardConfig {\n  id: string;\n  name: string;\n  slug: string;\n  description?: string;\n  isPublic: boolean;\n  settings?: BoardSettings;\n  organization: {\n    id: string;\n    name: string;\n    slug: string;\n    logo?: string;\n    primaryColor?: string;\n  };\n  statuses: BoardStatus[];\n}\n\nexport interface BoardSettings {\n  allowAnonymousVoting?: boolean;\n  requireApproval?: boolean;\n  defaultStatus?: FeedbackStatus;\n}\n\nexport interface BoardStatus {\n  id: string;\n  name: string;\n  color: string;\n  icon?: string;\n  order: number;\n}\n\nexport type FeedbackStatus =\n  | \"open\"\n  | \"under_review\"\n  | \"planned\"\n  | \"in_progress\"\n  | \"completed\"\n  | \"closed\";\n\n// ============================================\n// Feedback\n// ============================================\n\nexport interface FeedbackItem {\n  id: string;\n  title: string;\n  description: string;\n  status: FeedbackStatus;\n  voteCount: number;\n  commentCount: number;\n  isPinned: boolean;\n  hasVoted: boolean;\n  createdAt: number;\n  updatedAt: number;\n  completedAt?: number;\n  tags: FeedbackTag[];\n  boardStatus: {\n    id: string;\n    name: string;\n    color: string;\n  } | null;\n  author: FeedbackAuthor | null;\n}\n\nexport interface FeedbackDetail extends FeedbackItem {\n  isSubscribed: boolean;\n}\n\nexport interface FeedbackTag {\n  id: string;\n  name: string;\n  color: string;\n}\n\nexport interface FeedbackAuthor {\n  name?: string;\n  email?: string;\n  avatar?: string;\n  isExternal: boolean;\n}\n\nexport interface FeedbackListResponse {\n  items: FeedbackItem[];\n  total: number;\n  hasMore: boolean;\n}\n\nexport interface FeedbackListParams {\n  /** Filter by custom status ID */\n  statusId?: string;\n  /** Filter by status name */\n  status?: FeedbackStatus;\n  /** Search in title and description */\n  search?: string;\n  /** Sort order */\n  sortBy?: \"votes\" | \"newest\" | \"oldest\" | \"comments\";\n  /** Number of items to return (max 100) */\n  limit?: number;\n  /** Offset for pagination */\n  offset?: number;\n}\n\nexport interface CreateFeedbackParams {\n  title: string;\n  description: string;\n}\n\nexport interface CreateFeedbackResponse {\n  feedbackId: string;\n  isApproved: boolean;\n}\n\nexport interface VoteResponse {\n  voted: boolean;\n  voteCount: number;\n}\n\n// ============================================\n// Comments\n// ============================================\n\nexport interface Comment {\n  id: string;\n  body: string;\n  isOfficial: boolean;\n  author: FeedbackAuthor | null;\n  replies: CommentReply[];\n  createdAt: number;\n  updatedAt: number;\n}\n\nexport interface CommentReply {\n  id: string;\n  body: string;\n  isOfficial: boolean;\n  author: FeedbackAuthor | null;\n  createdAt: number;\n  updatedAt: number;\n}\n\nexport interface AddCommentParams {\n  feedbackId: string;\n  body: string;\n  parentId?: string;\n}\n\nexport interface AddCommentResponse {\n  commentId: string;\n}\n\n// ============================================\n// Subscriptions\n// ============================================\n\nexport interface SubscribeResponse {\n  subscribed: boolean;\n  alreadySubscribed?: boolean;\n}\n\nexport interface UnsubscribeResponse {\n  unsubscribed: boolean;\n  wasNotSubscribed?: boolean;\n}\n\n// ============================================\n// Roadmap\n// ============================================\n\nexport interface Roadmap {\n  lanes: RoadmapLane[];\n}\n\nexport interface RoadmapLane {\n  id: string;\n  name: string;\n  color: string;\n  items: RoadmapItem[];\n}\n\nexport interface RoadmapItem {\n  id: string;\n  title: string;\n  status: FeedbackStatus;\n  voteCount: number;\n}\n\n// ============================================\n// Changelog\n// ============================================\n\nexport interface ChangelogEntry {\n  id: string;\n  title: string;\n  description?: string;\n  version?: string;\n  publishedAt?: number;\n  feedback: { id: string; title: string }[];\n}\n\n// ============================================\n// Errors\n// ============================================\n\nexport class RefletError extends Error {\n  readonly status: number;\n  readonly code?: string;\n\n  constructor(message: string, status: number, code?: string) {\n    super(message);\n    this.name = \"RefletError\";\n    this.status = status;\n    this.code = code;\n  }\n}\n\nexport class RefletAuthError extends RefletError {\n  constructor(message: string) {\n    super(message, 401, \"AUTH_ERROR\");\n    this.name = \"RefletAuthError\";\n  }\n}\n\nexport class RefletValidationError extends RefletError {\n  constructor(message: string) {\n    super(message, 400, \"VALIDATION_ERROR\");\n    this.name = \"RefletValidationError\";\n  }\n}\n\nexport class RefletNotFoundError extends RefletError {\n  constructor(message: string) {\n    super(message, 404, \"NOT_FOUND\");\n    this.name = \"RefletNotFoundError\";\n  }\n}\n","import {\n  type AddCommentParams,\n  type AddCommentResponse,\n  type BoardConfig,\n  type ChangelogEntry,\n  type Comment,\n  type CreateFeedbackParams,\n  type CreateFeedbackResponse,\n  type FeedbackDetail,\n  type FeedbackListParams,\n  type FeedbackListResponse,\n  RefletAuthError,\n  type RefletConfig,\n  RefletError,\n  RefletNotFoundError,\n  type RefletUser,\n  type Roadmap,\n  type SubscribeResponse,\n  type UnsubscribeResponse,\n  type VoteResponse,\n} from \"./types\";\n\n// Default to Reflet production API\nconst DEFAULT_API_URL = \"https://harmless-clam-802.convex.cloud\";\n\n/**\n * Reflet SDK Client\n *\n * @example\n * ```ts\n * import { Reflet } from 'reflet-sdk';\n *\n * const reflet = new Reflet({\n *   publicKey: 'fb_pub_xxx',\n *   user: { id: 'user_123', email: 'user@example.com', name: 'John' }\n * });\n *\n * // List feedback\n * const { items } = await reflet.list({ status: 'open' });\n *\n * // Vote on feedback\n * await reflet.vote('feedback_id');\n *\n * // Submit new feedback\n * await reflet.create({ title: 'Great idea', description: 'Details...' });\n * ```\n */\nexport class Reflet {\n  private readonly publicKey: string;\n  private readonly baseUrl: string;\n  private userToken: string | undefined;\n  private user: RefletUser | undefined;\n\n  constructor(config: RefletConfig) {\n    this.publicKey = config.publicKey;\n    this.baseUrl = config.baseUrl ?? DEFAULT_API_URL;\n    this.userToken = config.userToken;\n    this.user = config.user;\n\n    if (!this.publicKey) {\n      throw new Error(\"Reflet: publicKey is required\");\n    }\n  }\n\n  /**\n   * Update the user identification\n   */\n  setUser(user: RefletUser | undefined): void {\n    this.user = user;\n    this.userToken = undefined;\n  }\n\n  /**\n   * Set the user token directly (for server-signed tokens)\n   */\n  setUserToken(token: string | undefined): void {\n    this.userToken = token;\n    this.user = undefined;\n  }\n\n  /**\n   * Get the board configuration\n   */\n  async getConfig(): Promise<BoardConfig> {\n    return await this.request<BoardConfig>(\"GET\", \"/api/v1/feedback\");\n  }\n\n  /**\n   * List feedback items with optional filtering\n   */\n  async list(params?: FeedbackListParams): Promise<FeedbackListResponse> {\n    const searchParams = new URLSearchParams();\n\n    if (params?.statusId) {\n      searchParams.set(\"statusId\", params.statusId);\n    }\n    if (params?.status) {\n      searchParams.set(\"status\", params.status);\n    }\n    if (params?.search) {\n      searchParams.set(\"search\", params.search);\n    }\n    if (params?.sortBy) {\n      searchParams.set(\"sortBy\", params.sortBy);\n    }\n    if (params?.limit) {\n      searchParams.set(\"limit\", String(params.limit));\n    }\n    if (params?.offset) {\n      searchParams.set(\"offset\", String(params.offset));\n    }\n\n    const query = searchParams.toString();\n    const url = `/api/v1/feedback/list${query ? `?${query}` : \"\"}`;\n\n    return await this.request<FeedbackListResponse>(\"GET\", url);\n  }\n\n  /**\n   * Get a single feedback item by ID\n   */\n  async get(feedbackId: string): Promise<FeedbackDetail> {\n    const result = await this.request<FeedbackDetail | null>(\n      \"GET\",\n      `/api/v1/feedback/item?id=${encodeURIComponent(feedbackId)}`\n    );\n\n    if (!result) {\n      throw new RefletNotFoundError(\"Feedback not found\");\n    }\n\n    return result;\n  }\n\n  /**\n   * Create new feedback\n   * Requires user identification\n   */\n  async create(params: CreateFeedbackParams): Promise<CreateFeedbackResponse> {\n    return await this.request<CreateFeedbackResponse>(\n      \"POST\",\n      \"/api/v1/feedback/create\",\n      params\n    );\n  }\n\n  /**\n   * Toggle vote on feedback\n   * Requires user identification\n   */\n  async vote(\n    feedbackId: string,\n    type: \"upvote\" | \"downvote\" = \"upvote\"\n  ): Promise<VoteResponse> {\n    return await this.request<VoteResponse>(\"POST\", \"/api/v1/feedback/vote\", {\n      feedbackId,\n      voteType: type,\n    });\n  }\n\n  /**\n   * Get comments for a feedback item\n   */\n  async getComments(\n    feedbackId: string,\n    sortBy: \"newest\" | \"oldest\" = \"oldest\"\n  ): Promise<Comment[]> {\n    return await this.request<Comment[]>(\n      \"GET\",\n      `/api/v1/feedback/comments?feedbackId=${encodeURIComponent(feedbackId)}&sortBy=${sortBy}`\n    );\n  }\n\n  /**\n   * Add a comment to feedback\n   * Requires user identification\n   */\n  async comment(params: AddCommentParams): Promise<AddCommentResponse> {\n    return await this.request<AddCommentResponse>(\n      \"POST\",\n      \"/api/v1/feedback/comment\",\n      params\n    );\n  }\n\n  /**\n   * Subscribe to feedback updates\n   * Requires user identification\n   */\n  async subscribe(feedbackId: string): Promise<SubscribeResponse> {\n    return await this.request<SubscribeResponse>(\n      \"POST\",\n      \"/api/v1/feedback/subscribe\",\n      {\n        feedbackId,\n      }\n    );\n  }\n\n  /**\n   * Unsubscribe from feedback updates\n   * Requires user identification\n   */\n  async unsubscribe(feedbackId: string): Promise<UnsubscribeResponse> {\n    return await this.request<UnsubscribeResponse>(\n      \"POST\",\n      \"/api/v1/feedback/unsubscribe\",\n      {\n        feedbackId,\n      }\n    );\n  }\n\n  /**\n   * Get roadmap data\n   */\n  async getRoadmap(): Promise<Roadmap> {\n    return await this.request<Roadmap>(\"GET\", \"/api/v1/feedback/roadmap\");\n  }\n\n  /**\n   * Get changelog entries\n   */\n  async getChangelog(limit?: number): Promise<ChangelogEntry[]> {\n    const url = limit\n      ? `/api/v1/feedback/changelog?limit=${limit}`\n      : \"/api/v1/feedback/changelog\";\n\n    return await this.request<ChangelogEntry[]>(\"GET\", url);\n  }\n\n  /**\n   * Build request headers with authentication\n   */\n  private buildHeaders(): Record<string, string> {\n    const headers: Record<string, string> = {\n      \"Content-Type\": \"application/json\",\n      Authorization: `Bearer ${this.publicKey}`,\n    };\n\n    const token = this.userToken ?? this.generateUserToken();\n    if (token) {\n      headers[\"X-User-Token\"] = token;\n    }\n\n    return headers;\n  }\n\n  /**\n   * Parse JSON response text safely\n   */\n  private parseJsonSafely<T>(\n    text: string,\n    status: number\n  ): T | { error: string } {\n    try {\n      return JSON.parse(text) as T | { error: string };\n    } catch (parseError) {\n      throw new RefletError(\n        `Invalid response: ${parseError instanceof Error ? parseError.message : \"Failed to parse JSON\"}`,\n        status\n      );\n    }\n  }\n\n  /**\n   * Throw appropriate error based on status code\n   */\n  private throwHttpError(message: string, status: number): never {\n    if (status === 401) {\n      throw new RefletAuthError(message);\n    }\n    if (status === 404) {\n      throw new RefletNotFoundError(message);\n    }\n    throw new RefletError(message, status);\n  }\n\n  /**\n   * Make an authenticated API request\n   */\n  private async request<T>(\n    method: string,\n    path: string,\n    body?: unknown\n  ): Promise<T> {\n    let response: Response;\n    try {\n      response = await fetch(`${this.baseUrl}${path}`, {\n        method,\n        headers: this.buildHeaders(),\n        body: body ? JSON.stringify(body) : undefined,\n      });\n    } catch (networkError) {\n      const message =\n        networkError instanceof Error\n          ? networkError.message\n          : \"Failed to connect\";\n      throw new RefletError(`Network error: ${message}`, 0);\n    }\n\n    const text = await response.text();\n\n    // Handle empty response\n    if (!text) {\n      if (!response.ok) {\n        this.throwHttpError(\n          `Request failed with status ${response.status}`,\n          response.status\n        );\n      }\n      return {} as T;\n    }\n\n    const data = this.parseJsonSafely<T>(text, response.status);\n\n    if (!response.ok) {\n      const errorMessage =\n        (data as { error?: string }).error ??\n        `Request failed with status ${response.status}`;\n      this.throwHttpError(errorMessage, response.status);\n    }\n\n    return data as T;\n  }\n\n  /**\n   * Generate a simple user token for client-side use\n   * Note: For production, use server-side token signing\n   */\n  private generateUserToken(): string | undefined {\n    if (!this.user) {\n      return undefined;\n    }\n\n    // Simple base64 encoding for client-side use\n    // In production, tokens should be signed server-side\n    const payload = {\n      id: this.user.id,\n      email: this.user.email,\n      name: this.user.name,\n      iat: Math.floor(Date.now() / 1000),\n      exp: Math.floor(Date.now() / 1000) + 86_400, // 24 hours\n    };\n\n    const header = btoa(JSON.stringify({ alg: \"none\", typ: \"JWT\" }));\n    const payloadB64 = btoa(JSON.stringify(payload));\n\n    return `${header}.${payloadB64}.`;\n  }\n}\n"]}

package/dist/index.d.ts

@@ -276,6 +276,18 @@ declare class Reflet {
      * Get changelog entries
      */
     getChangelog(limit?: number): Promise<ChangelogEntry[]>;
+    /**
+     * Build request headers with authentication
+     */
+    private buildHeaders;
+    /**
+     * Parse JSON response text safely
+     */
+    private parseJsonSafely;
+    /**
+     * Throw appropriate error based on status code
+     */
+    private throwHttpError;
     /**
      * Make an authenticated API request
      */

package/dist/index.js

@@ -1,3 +1,3 @@
-export { Reflet, RefletAuthError, RefletError, RefletNotFoundError, RefletValidationError } from './chunk-AHWT4I4V.js';
+export { Reflet, RefletAuthError, RefletError, RefletNotFoundError, RefletValidationError } from './chunk-C342WLTD.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/react.js

@@ -1,5 +1,5 @@
-import { Reflet } from './chunk-AHWT4I4V.js';
-export { Reflet } from './chunk-AHWT4I4V.js';
+import { Reflet } from './chunk-C342WLTD.js';
+export { Reflet } from './chunk-C342WLTD.js';
 import { createContext, useState, useMemo, useEffect, useContext, useCallback } from 'react';
 import { jsx } from 'react/jsx-runtime';
 

package/dist/server.d.ts

@@ -1,12 +1,12 @@
 /**
  * Server-side utilities for Reflet SDK
- * Use these functions on your backend to securely sign user tokens
+ * Works in Node.js, Edge runtimes, Cloudflare Workers, and Convex
  *
  * @example
  * ```ts
  * import { signUser } from 'reflet-sdk/server';
  *
- * const { token } = signUser(
+ * const { token } = await signUser(
  *   { id: user.id, email: user.email, name: user.name },
  *   process.env.REFLET_SECRET_KEY!
  * );
@@ -32,13 +32,13 @@ interface SignedUserToken {
 }
 /**
  * Sign a user token for secure client-side identification
- * Uses HMAC-SHA256 for cryptographically secure signatures
+ * Uses HMAC-SHA256 via Web Crypto API (works in all runtimes)
  */
-declare function signUser(user: SignUserOptions, secretKey: string, expiresInSeconds?: number): SignedUserToken;
+declare function signUser(user: SignUserOptions, secretKey: string, expiresInSeconds?: number): Promise<SignedUserToken>;
 /**
  * Verify a user token
  * Returns the user data if valid, null otherwise
  */
-declare function verifyUser(token: string, secretKey: string): SignUserOptions | null;
+declare function verifyUser(token: string, secretKey: string): Promise<SignUserOptions | null>;
 
 export { type SignUserOptions as RefletServerUser, type SignUserOptions, type SignedUserToken, signUser, verifyUser };

package/dist/server.js

@@ -1,12 +1,10 @@
-import { createHmac } from 'crypto';
-
 // src/server.ts
 var PLUS_REGEX = /\+/g;
 var SLASH_REGEX = /\//g;
 var PADDING_REGEX = /=+$/;
 var DASH_REGEX = /-/g;
 var UNDERSCORE_REGEX = /_/g;
-function signUser(user, secretKey, expiresInSeconds = 86400) {
+async function signUser(user, secretKey, expiresInSeconds = 86400) {
   if (!secretKey) {
     throw new Error("signUser: secretKey is required");
   }
@@ -28,7 +26,7 @@ function signUser(user, secretKey, expiresInSeconds = 86400) {
   };
   const headerB64 = base64UrlEncode(JSON.stringify(header));
   const payloadB64 = base64UrlEncode(JSON.stringify(payload));
-  const signature = createHmacSha256Signature(
+  const signature = await createHmacSha256Signature(
     `${headerB64}.${payloadB64}`,
     secretKey
   );
@@ -37,7 +35,7 @@ function signUser(user, secretKey, expiresInSeconds = 86400) {
     expiresAt: exp * 1e3
   };
 }
-function verifyUser(token, secretKey) {
+async function verifyUser(token, secretKey) {
   if (!(token && secretKey)) {
     return null;
   }
@@ -46,7 +44,7 @@ function verifyUser(token, secretKey) {
     return null;
   }
   const [headerB64, payloadB64, signature] = parts;
-  const expectedSignature = createHmacSha256Signature(
+  const expectedSignature = await createHmacSha256Signature(
     `${headerB64}.${payloadB64}`,
     secretKey
   );
@@ -74,20 +72,48 @@ function verifyUser(token, secretKey) {
   }
 }
 function base64UrlEncode(str) {
-  const base64 = Buffer.from(str).toString("base64");
+  const bytes = new TextEncoder().encode(str);
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  const base64 = btoa(binary);
   return base64.replace(PLUS_REGEX, "-").replace(SLASH_REGEX, "_").replace(PADDING_REGEX, "");
 }
 function base64UrlDecode(str) {
   const padding = 4 - str.length % 4;
   const paddedStr = padding < 4 ? str + "=".repeat(padding) : str;
   const base64 = paddedStr.replace(DASH_REGEX, "+").replace(UNDERSCORE_REGEX, "/");
-  return Buffer.from(base64, "base64").toString();
+  const binary = atob(base64);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return new TextDecoder().decode(bytes);
 }
-function createHmacSha256Signature(data, secret) {
-  const hmac = createHmac("sha256", secret);
-  hmac.update(data);
-  const signature = hmac.digest("base64");
-  return signature.replace(PLUS_REGEX, "-").replace(SLASH_REGEX, "_").replace(PADDING_REGEX, "");
+async function createHmacSha256Signature(data, secret) {
+  const encoder = new TextEncoder();
+  const keyData = encoder.encode(secret);
+  const messageData = encoder.encode(data);
+  const cryptoKey = await crypto.subtle.importKey(
+    "raw",
+    keyData,
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const signatureBuffer = await crypto.subtle.sign(
+    "HMAC",
+    cryptoKey,
+    messageData
+  );
+  const signatureArray = new Uint8Array(signatureBuffer);
+  let binary = "";
+  for (const byte of signatureArray) {
+    binary += String.fromCharCode(byte);
+  }
+  const base64 = btoa(binary);
+  return base64.replace(PLUS_REGEX, "-").replace(SLASH_REGEX, "_").replace(PADDING_REGEX, "");
 }
 function constantTimeEqual(a, b) {
   if (a.length !== b.length) {

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/server.ts"],"names":[],"mappings":";;;AAkBA,IAAM,UAAA,GAAa,KAAA;AACnB,IAAM,WAAA,GAAc,KAAA;AACpB,IAAM,aAAA,GAAgB,KAAA;AACtB,IAAM,UAAA,GAAa,IAAA;AACnB,IAAM,gBAAA,GAAmB,IAAA;AA0BlB,SAAS,QAAA,CACd,IAAA,EACA,SAAA,EACA,gBAAA,GAAmB,KAAA,EACF;AACjB,EAAA,IAAI,CAAC,SAAA,EAAW;AACd,IAAA,MAAM,IAAI,MAAM,iCAAiC,CAAA;AAAA,EACnD;AAEA,EAAA,IAAI,CAAC,KAAK,EAAA,EAAI;AACZ,IAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,EACjD;AAEA,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,EAAA,MAAM,MAAM,GAAA,GAAM,gBAAA;AAElB,EAAA,MAAM,MAAA,GAAS,EAAE,GAAA,EAAK,OAAA,EAAS,KAAK,KAAA,EAAM;AAC1C,EAAA,MAAM,OAAA,GAAU;AAAA,IACd,KAAK,IAAA,CAAK,EAAA;AAAA,IACV,IAAI,IAAA,CAAK,EAAA;AAAA,IACT,OAAO,IAAA,CAAK,KAAA;AAAA,IACZ,MAAM,IAAA,CAAK,IAAA;AAAA,IACX,QAAQ,IAAA,CAAK,MAAA;AAAA,IACb,UAAU,IAAA,CAAK,QAAA;AAAA,IACf,GAAA,EAAK,GAAA;AAAA,IACL;AAAA,GACF;AAEA,EAAA,MAAM,SAAA,GAAY,eAAA,CAAgB,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAA;AACxD,EAAA,MAAM,UAAA,GAAa,eAAA,CAAgB,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA;AAG1D,EAAA,MAAM,SAAA,GAAY,yBAAA;AAAA,IAChB,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,UAAU,CAAA,CAAA;AAAA,IAC1B;AAAA,GACF;AAEA,EAAA,OAAO;AAAA,IACL,OAAO,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,UAAU,IAAI,SAAS,CAAA,CAAA;AAAA,IAC9C,WAAW,GAAA,GAAM;AAAA,GACnB;AACF;AAMO,SAAS,UAAA,CACd,OACA,SAAA,EACwB;AACxB,EAAA,IAAI,EAAE,SAAS,SAAA,CAAA,EAAY;AACzB,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,CAAC,SAAA,EAAW,UAAA,EAAY,SAAS,CAAA,GAAI,KAAA;AAG3C,EAAA,MAAM,iBAAA,GAAoB,yBAAA;AAAA,IACxB,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,UAAU,CAAA,CAAA;AAAA,IAC1B;AAAA,GACF;AAEA,EAAA,IAAI,CAAC,iBAAA,CAAkB,SAAA,EAAW,iBAAiB,CAAA,EAAG;AACpD,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,eAAA,CAAgB,UAAU,CAAC,CAAA;AAWtD,IAAA,IAAI,QAAQ,GAAA,IAAO,IAAA,CAAK,KAAI,GAAI,OAAA,CAAQ,MAAM,GAAA,EAAM;AAClD,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,EAAA,IAAM,OAAA,CAAQ,GAAA;AACrC,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,MAAA;AAAA,MACJ,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd,QAAQ,OAAA,CAAQ,MAAA;AAAA,MAChB,UAAU,OAAA,CAAQ;AAAA,KACpB;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAMA,SAAS,gBAAgB,GAAA,EAAqB;AAC5C,EAAA,MAAM,SAAS,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,CAAE,SAAS,QAAQ,CAAA;AAEjD,EAAA,OAAO,MAAA,CACJ,OAAA,CAAQ,UAAA,EAAY,GAAG,CAAA,CACvB,OAAA,CAAQ,WAAA,EAAa,GAAG,CAAA,CACxB,OAAA,CAAQ,aAAA,EAAe,EAAE,CAAA;AAC9B;AAEA,SAAS,gBAAgB,GAAA,EAAqB;AAE5C,EAAA,MAAM,OAAA,GAAU,CAAA,GAAK,GAAA,CAAI,MAAA,GAAS,CAAA;AAClC,EAAA,MAAM,YAAY,OAAA,GAAU,CAAA,GAAI,MAAM,GAAA,CAAI,MAAA,CAAO,OAAO,CAAA,GAAI,GAAA;AAG5D,EAAA,MAAM,MAAA,GAAS,UACZ,OAAA,CAAQ,UAAA,EAAY,GAAG,CAAA,CACvB,OAAA,CAAQ,kBAAkB,GAAG,CAAA;AAEhC,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,MAAA,EAAQ,QAAQ,EAAE,QAAA,EAAS;AAChD;AAKA,SAAS,yBAAA,CAA0B,MAAc,MAAA,EAAwB;AACvE,EAAA,MAAM,IAAA,GAAO,UAAA,CAAW,QAAA,EAAU,MAAM,CAAA;AACxC,EAAA,IAAA,CAAK,OAAO,IAAI,CAAA;AAChB,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,MAAA,CAAO,QAAQ,CAAA;AAGtC,EAAA,OAAO,SAAA,CACJ,OAAA,CAAQ,UAAA,EAAY,GAAG,CAAA,CACvB,OAAA,CAAQ,WAAA,EAAa,GAAG,CAAA,CACxB,OAAA,CAAQ,aAAA,EAAe,EAAE,CAAA;AAC9B;AAKA,SAAS,iBAAA,CAAkB,GAAW,CAAA,EAAoB;AACxD,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ;AACzB,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AAEjC,IAAA,MAAA,IAAU,EAAE,UAAA,CAAW,CAAC,CAAA,GAAI,CAAA,CAAE,WAAW,CAAC,CAAA;AAAA,EAC5C;AAEA,EAAA,OAAO,MAAA,KAAW,CAAA;AACpB","file":"server.js","sourcesContent":["/**\n * Server-side utilities for Reflet SDK\n * Use these functions on your backend to securely sign user tokens\n *\n * @example\n * ```ts\n * import { signUser } from 'reflet-sdk/server';\n *\n * const { token } = signUser(\n *   { id: user.id, email: user.email, name: user.name },\n *   process.env.REFLET_SECRET_KEY!\n * );\n * ```\n */\n\nimport { createHmac } from \"node:crypto\";\n\n// Top-level regex patterns for base64url encoding\nconst PLUS_REGEX = /\\+/g;\nconst SLASH_REGEX = /\\//g;\nconst PADDING_REGEX = /=+$/;\nconst DASH_REGEX = /-/g;\nconst UNDERSCORE_REGEX = /_/g;\n\nexport interface SignUserOptions {\n  /** User's unique ID in your system */\n  id: string;\n  /** User's email address */\n  email?: string;\n  /** User's display name */\n  name?: string;\n  /** URL to user's avatar image */\n  avatar?: string;\n  /** Additional metadata */\n  metadata?: Record<string, unknown>;\n}\n\nexport interface SignedUserToken {\n  /** The signed JWT token */\n  token: string;\n  /** Token expiration timestamp (ms) */\n  expiresAt: number;\n}\n\n/**\n * Sign a user token for secure client-side identification\n * Uses HMAC-SHA256 for cryptographically secure signatures\n */\nexport function signUser(\n  user: SignUserOptions,\n  secretKey: string,\n  expiresInSeconds = 86_400 // 24 hours default\n): SignedUserToken {\n  if (!secretKey) {\n    throw new Error(\"signUser: secretKey is required\");\n  }\n\n  if (!user.id) {\n    throw new Error(\"signUser: user.id is required\");\n  }\n\n  const now = Math.floor(Date.now() / 1000);\n  const exp = now + expiresInSeconds;\n\n  const header = { alg: \"HS256\", typ: \"JWT\" };\n  const payload = {\n    sub: user.id,\n    id: user.id,\n    email: user.email,\n    name: user.name,\n    avatar: user.avatar,\n    metadata: user.metadata,\n    iat: now,\n    exp,\n  };\n\n  const headerB64 = base64UrlEncode(JSON.stringify(header));\n  const payloadB64 = base64UrlEncode(JSON.stringify(payload));\n\n  // Create signature using HMAC-SHA256\n  const signature = createHmacSha256Signature(\n    `${headerB64}.${payloadB64}`,\n    secretKey\n  );\n\n  return {\n    token: `${headerB64}.${payloadB64}.${signature}`,\n    expiresAt: exp * 1000,\n  };\n}\n\n/**\n * Verify a user token\n * Returns the user data if valid, null otherwise\n */\nexport function verifyUser(\n  token: string,\n  secretKey: string\n): SignUserOptions | null {\n  if (!(token && secretKey)) {\n    return null;\n  }\n\n  const parts = token.split(\".\");\n  if (parts.length !== 3) {\n    return null;\n  }\n\n  const [headerB64, payloadB64, signature] = parts;\n\n  // Verify signature using constant-time comparison\n  const expectedSignature = createHmacSha256Signature(\n    `${headerB64}.${payloadB64}`,\n    secretKey\n  );\n\n  if (!constantTimeEqual(signature, expectedSignature)) {\n    return null;\n  }\n\n  try {\n    const payload = JSON.parse(base64UrlDecode(payloadB64)) as {\n      id?: string;\n      sub?: string;\n      email?: string;\n      name?: string;\n      avatar?: string;\n      metadata?: Record<string, unknown>;\n      exp?: number;\n    };\n\n    // Check expiration\n    if (payload.exp && Date.now() > payload.exp * 1000) {\n      return null;\n    }\n\n    const userId = payload.id ?? payload.sub;\n    if (!userId) {\n      return null;\n    }\n\n    return {\n      id: userId,\n      email: payload.email,\n      name: payload.name,\n      avatar: payload.avatar,\n      metadata: payload.metadata,\n    };\n  } catch {\n    return null;\n  }\n}\n\n// ============================================\n// Utility Functions\n// ============================================\n\nfunction base64UrlEncode(str: string): string {\n  const base64 = Buffer.from(str).toString(\"base64\");\n\n  return base64\n    .replace(PLUS_REGEX, \"-\")\n    .replace(SLASH_REGEX, \"_\")\n    .replace(PADDING_REGEX, \"\");\n}\n\nfunction base64UrlDecode(str: string): string {\n  // Restore base64 padding\n  const padding = 4 - (str.length % 4);\n  const paddedStr = padding < 4 ? str + \"=\".repeat(padding) : str;\n\n  // Replace URL-safe characters\n  const base64 = paddedStr\n    .replace(DASH_REGEX, \"+\")\n    .replace(UNDERSCORE_REGEX, \"/\");\n\n  return Buffer.from(base64, \"base64\").toString();\n}\n\n/**\n * Create HMAC-SHA256 signature (cryptographically secure)\n */\nfunction createHmacSha256Signature(data: string, secret: string): string {\n  const hmac = createHmac(\"sha256\", secret);\n  hmac.update(data);\n  const signature = hmac.digest(\"base64\");\n\n  // Convert to base64url\n  return signature\n    .replace(PLUS_REGEX, \"-\")\n    .replace(SLASH_REGEX, \"_\")\n    .replace(PADDING_REGEX, \"\");\n}\n\n/**\n * Constant-time string comparison to prevent timing attacks\n */\nfunction constantTimeEqual(a: string, b: string): boolean {\n  if (a.length !== b.length) {\n    return false;\n  }\n\n  let result = 0;\n  for (let i = 0; i < a.length; i++) {\n    // biome-ignore lint/suspicious/noBitwiseOperators: intentional for constant-time comparison\n    result |= a.charCodeAt(i) ^ b.charCodeAt(i);\n  }\n\n  return result === 0;\n}\n\n// Export types\nexport type { SignUserOptions as RefletServerUser };\n"]}
+{"version":3,"sources":["../src/server.ts"],"names":[],"mappings":";AAgBA,IAAM,UAAA,GAAa,KAAA;AACnB,IAAM,WAAA,GAAc,KAAA;AACpB,IAAM,aAAA,GAAgB,KAAA;AACtB,IAAM,UAAA,GAAa,IAAA;AACnB,IAAM,gBAAA,GAAmB,IAAA;AA0BzB,eAAsB,QAAA,CACpB,IAAA,EACA,SAAA,EACA,gBAAA,GAAmB,KAAA,EACO;AAC1B,EAAA,IAAI,CAAC,SAAA,EAAW;AACd,IAAA,MAAM,IAAI,MAAM,iCAAiC,CAAA;AAAA,EACnD;AAEA,EAAA,IAAI,CAAC,KAAK,EAAA,EAAI;AACZ,IAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,EACjD;AAEA,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,EAAA,MAAM,MAAM,GAAA,GAAM,gBAAA;AAElB,EAAA,MAAM,MAAA,GAAS,EAAE,GAAA,EAAK,OAAA,EAAS,KAAK,KAAA,EAAM;AAC1C,EAAA,MAAM,OAAA,GAAU;AAAA,IACd,KAAK,IAAA,CAAK,EAAA;AAAA,IACV,IAAI,IAAA,CAAK,EAAA;AAAA,IACT,OAAO,IAAA,CAAK,KAAA;AAAA,IACZ,MAAM,IAAA,CAAK,IAAA;AAAA,IACX,QAAQ,IAAA,CAAK,MAAA;AAAA,IACb,UAAU,IAAA,CAAK,QAAA;AAAA,IACf,GAAA,EAAK,GAAA;AAAA,IACL;AAAA,GACF;AAEA,EAAA,MAAM,SAAA,GAAY,eAAA,CAAgB,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAA;AACxD,EAAA,MAAM,UAAA,GAAa,eAAA,CAAgB,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA;AAG1D,EAAA,MAAM,YAAY,MAAM,yBAAA;AAAA,IACtB,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,UAAU,CAAA,CAAA;AAAA,IAC1B;AAAA,GACF;AAEA,EAAA,OAAO;AAAA,IACL,OAAO,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,UAAU,IAAI,SAAS,CAAA,CAAA;AAAA,IAC9C,WAAW,GAAA,GAAM;AAAA,GACnB;AACF;AAMA,eAAsB,UAAA,CACpB,OACA,SAAA,EACiC;AACjC,EAAA,IAAI,EAAE,SAAS,SAAA,CAAA,EAAY;AACzB,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,CAAC,SAAA,EAAW,UAAA,EAAY,SAAS,CAAA,GAAI,KAAA;AAG3C,EAAA,MAAM,oBAAoB,MAAM,yBAAA;AAAA,IAC9B,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,UAAU,CAAA,CAAA;AAAA,IAC1B;AAAA,GACF;AAEA,EAAA,IAAI,CAAC,iBAAA,CAAkB,SAAA,EAAW,iBAAiB,CAAA,EAAG;AACpD,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,eAAA,CAAgB,UAAU,CAAC,CAAA;AAWtD,IAAA,IAAI,QAAQ,GAAA,IAAO,IAAA,CAAK,KAAI,GAAI,OAAA,CAAQ,MAAM,GAAA,EAAM;AAClD,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,EAAA,IAAM,OAAA,CAAQ,GAAA;AACrC,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,MAAA;AAAA,MACJ,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd,QAAQ,OAAA,CAAQ,MAAA;AAAA,MAChB,UAAU,OAAA,CAAQ;AAAA,KACpB;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAMA,SAAS,gBAAgB,GAAA,EAAqB;AAE5C,EAAA,MAAM,KAAA,GAAQ,IAAI,WAAA,EAAY,CAAE,OAAO,GAAG,CAAA;AAC1C,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAA,IAAU,MAAA,CAAO,aAAa,IAAI,CAAA;AAAA,EACpC;AACA,EAAA,MAAM,MAAA,GAAS,KAAK,MAAM,CAAA;AAE1B,EAAA,OAAO,MAAA,CACJ,OAAA,CAAQ,UAAA,EAAY,GAAG,CAAA,CACvB,OAAA,CAAQ,WAAA,EAAa,GAAG,CAAA,CACxB,OAAA,CAAQ,aAAA,EAAe,EAAE,CAAA;AAC9B;AAEA,SAAS,gBAAgB,GAAA,EAAqB;AAE5C,EAAA,MAAM,OAAA,GAAU,CAAA,GAAK,GAAA,CAAI,MAAA,GAAS,CAAA;AAClC,EAAA,MAAM,YAAY,OAAA,GAAU,CAAA,GAAI,MAAM,GAAA,CAAI,MAAA,CAAO,OAAO,CAAA,GAAI,GAAA;AAG5D,EAAA,MAAM,MAAA,GAAS,UACZ,OAAA,CAAQ,UAAA,EAAY,GAAG,CAAA,CACvB,OAAA,CAAQ,kBAAkB,GAAG,CAAA;AAEhC,EAAA,MAAM,MAAA,GAAS,KAAK,MAAM,CAAA;AAC1B,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAA,CAAO,MAAM,CAAA;AAC1C,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,QAAQ,CAAA,EAAA,EAAK;AACtC,IAAA,KAAA,CAAM,CAAC,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA;AAAA,EAChC;AACA,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAA;AACvC;AAMA,eAAe,yBAAA,CACb,MACA,MAAA,EACiB;AACjB,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,MAAA,CAAO,MAAM,CAAA;AACrC,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,MAAA,CAAO,IAAI,CAAA;AAGvC,EAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA;AAAA,IACpC,KAAA;AAAA,IACA,OAAA;AAAA,IACA,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAU;AAAA,IAChC,KAAA;AAAA,IACA,CAAC,MAAM;AAAA,GACT;AAGA,EAAA,MAAM,eAAA,GAAkB,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA;AAAA,IAC1C,MAAA;AAAA,IACA,SAAA;AAAA,IACA;AAAA,GACF;AAGA,EAAA,MAAM,cAAA,GAAiB,IAAI,UAAA,CAAW,eAAe,CAAA;AACrD,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,MAAW,QAAQ,cAAA,EAAgB;AACjC,IAAA,MAAA,IAAU,MAAA,CAAO,aAAa,IAAI,CAAA;AAAA,EACpC;AACA,EAAA,MAAM,MAAA,GAAS,KAAK,MAAM,CAAA;AAE1B,EAAA,OAAO,MAAA,CACJ,OAAA,CAAQ,UAAA,EAAY,GAAG,CAAA,CACvB,OAAA,CAAQ,WAAA,EAAa,GAAG,CAAA,CACxB,OAAA,CAAQ,aAAA,EAAe,EAAE,CAAA;AAC9B;AAKA,SAAS,iBAAA,CAAkB,GAAW,CAAA,EAAoB;AACxD,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ;AACzB,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,QAAQ,CAAA,EAAA,EAAK;AAEjC,IAAA,MAAA,IAAU,EAAE,UAAA,CAAW,CAAC,CAAA,GAAI,CAAA,CAAE,WAAW,CAAC,CAAA;AAAA,EAC5C;AAEA,EAAA,OAAO,MAAA,KAAW,CAAA;AACpB","file":"server.js","sourcesContent":["/**\n * Server-side utilities for Reflet SDK\n * Works in Node.js, Edge runtimes, Cloudflare Workers, and Convex\n *\n * @example\n * ```ts\n * import { signUser } from 'reflet-sdk/server';\n *\n * const { token } = await signUser(\n *   { id: user.id, email: user.email, name: user.name },\n *   process.env.REFLET_SECRET_KEY!\n * );\n * ```\n */\n\n// Top-level regex patterns for base64url encoding\nconst PLUS_REGEX = /\\+/g;\nconst SLASH_REGEX = /\\//g;\nconst PADDING_REGEX = /=+$/;\nconst DASH_REGEX = /-/g;\nconst UNDERSCORE_REGEX = /_/g;\n\nexport interface SignUserOptions {\n  /** User's unique ID in your system */\n  id: string;\n  /** User's email address */\n  email?: string;\n  /** User's display name */\n  name?: string;\n  /** URL to user's avatar image */\n  avatar?: string;\n  /** Additional metadata */\n  metadata?: Record<string, unknown>;\n}\n\nexport interface SignedUserToken {\n  /** The signed JWT token */\n  token: string;\n  /** Token expiration timestamp (ms) */\n  expiresAt: number;\n}\n\n/**\n * Sign a user token for secure client-side identification\n * Uses HMAC-SHA256 via Web Crypto API (works in all runtimes)\n */\nexport async function signUser(\n  user: SignUserOptions,\n  secretKey: string,\n  expiresInSeconds = 86_400 // 24 hours default\n): Promise<SignedUserToken> {\n  if (!secretKey) {\n    throw new Error(\"signUser: secretKey is required\");\n  }\n\n  if (!user.id) {\n    throw new Error(\"signUser: user.id is required\");\n  }\n\n  const now = Math.floor(Date.now() / 1000);\n  const exp = now + expiresInSeconds;\n\n  const header = { alg: \"HS256\", typ: \"JWT\" };\n  const payload = {\n    sub: user.id,\n    id: user.id,\n    email: user.email,\n    name: user.name,\n    avatar: user.avatar,\n    metadata: user.metadata,\n    iat: now,\n    exp,\n  };\n\n  const headerB64 = base64UrlEncode(JSON.stringify(header));\n  const payloadB64 = base64UrlEncode(JSON.stringify(payload));\n\n  // Create signature using HMAC-SHA256 via Web Crypto API\n  const signature = await createHmacSha256Signature(\n    `${headerB64}.${payloadB64}`,\n    secretKey\n  );\n\n  return {\n    token: `${headerB64}.${payloadB64}.${signature}`,\n    expiresAt: exp * 1000,\n  };\n}\n\n/**\n * Verify a user token\n * Returns the user data if valid, null otherwise\n */\nexport async function verifyUser(\n  token: string,\n  secretKey: string\n): Promise<SignUserOptions | null> {\n  if (!(token && secretKey)) {\n    return null;\n  }\n\n  const parts = token.split(\".\");\n  if (parts.length !== 3) {\n    return null;\n  }\n\n  const [headerB64, payloadB64, signature] = parts;\n\n  // Verify signature using constant-time comparison\n  const expectedSignature = await createHmacSha256Signature(\n    `${headerB64}.${payloadB64}`,\n    secretKey\n  );\n\n  if (!constantTimeEqual(signature, expectedSignature)) {\n    return null;\n  }\n\n  try {\n    const payload = JSON.parse(base64UrlDecode(payloadB64)) as {\n      id?: string;\n      sub?: string;\n      email?: string;\n      name?: string;\n      avatar?: string;\n      metadata?: Record<string, unknown>;\n      exp?: number;\n    };\n\n    // Check expiration\n    if (payload.exp && Date.now() > payload.exp * 1000) {\n      return null;\n    }\n\n    const userId = payload.id ?? payload.sub;\n    if (!userId) {\n      return null;\n    }\n\n    return {\n      id: userId,\n      email: payload.email,\n      name: payload.name,\n      avatar: payload.avatar,\n      metadata: payload.metadata,\n    };\n  } catch {\n    return null;\n  }\n}\n\n// ============================================\n// Utility Functions (Web Crypto API - Universal)\n// ============================================\n\nfunction base64UrlEncode(str: string): string {\n  // Use TextEncoder for universal compatibility\n  const bytes = new TextEncoder().encode(str);\n  let binary = \"\";\n  for (const byte of bytes) {\n    binary += String.fromCharCode(byte);\n  }\n  const base64 = btoa(binary);\n\n  return base64\n    .replace(PLUS_REGEX, \"-\")\n    .replace(SLASH_REGEX, \"_\")\n    .replace(PADDING_REGEX, \"\");\n}\n\nfunction base64UrlDecode(str: string): string {\n  // Restore base64 padding\n  const padding = 4 - (str.length % 4);\n  const paddedStr = padding < 4 ? str + \"=\".repeat(padding) : str;\n\n  // Replace URL-safe characters\n  const base64 = paddedStr\n    .replace(DASH_REGEX, \"+\")\n    .replace(UNDERSCORE_REGEX, \"/\");\n\n  const binary = atob(base64);\n  const bytes = new Uint8Array(binary.length);\n  for (let i = 0; i < binary.length; i++) {\n    bytes[i] = binary.charCodeAt(i);\n  }\n  return new TextDecoder().decode(bytes);\n}\n\n/**\n * Create HMAC-SHA256 signature using Web Crypto API\n * Works in Node.js 18+, Edge runtimes, Cloudflare Workers, Convex, etc.\n */\nasync function createHmacSha256Signature(\n  data: string,\n  secret: string\n): Promise<string> {\n  const encoder = new TextEncoder();\n  const keyData = encoder.encode(secret);\n  const messageData = encoder.encode(data);\n\n  // Import the secret key\n  const cryptoKey = await crypto.subtle.importKey(\n    \"raw\",\n    keyData,\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"]\n  );\n\n  // Sign the data\n  const signatureBuffer = await crypto.subtle.sign(\n    \"HMAC\",\n    cryptoKey,\n    messageData\n  );\n\n  // Convert to base64url\n  const signatureArray = new Uint8Array(signatureBuffer);\n  let binary = \"\";\n  for (const byte of signatureArray) {\n    binary += String.fromCharCode(byte);\n  }\n  const base64 = btoa(binary);\n\n  return base64\n    .replace(PLUS_REGEX, \"-\")\n    .replace(SLASH_REGEX, \"_\")\n    .replace(PADDING_REGEX, \"\");\n}\n\n/**\n * Constant-time string comparison to prevent timing attacks\n */\nfunction constantTimeEqual(a: string, b: string): boolean {\n  if (a.length !== b.length) {\n    return false;\n  }\n\n  let result = 0;\n  for (let i = 0; i < a.length; i++) {\n    // biome-ignore lint/suspicious/noBitwiseOperators: intentional for constant-time comparison\n    result |= a.charCodeAt(i) ^ b.charCodeAt(i);\n  }\n\n  return result === 0;\n}\n\n// Export types\nexport type { SignUserOptions as RefletServerUser };\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "reflet-sdk",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Official Reflet SDK - Collect user feedback, feature requests, and bug reports from your app",
   "license": "MIT",
   "author": "Reflet <hello@reflet.app>",

package/dist/chunk-AHWT4I4V.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/types.ts","../src/client.ts"],"names":[],"mappings":";AA+OO,IAAM,WAAA,GAAN,cAA0B,KAAA,CAAM;AAAA,EAC5B,MAAA;AAAA,EACA,IAAA;AAAA,EAET,WAAA,CAAY,OAAA,EAAiB,MAAA,EAAgB,IAAA,EAAe;AAC1D,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,aAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAEO,IAAM,eAAA,GAAN,cAA8B,WAAA,CAAY;AAAA,EAC/C,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAA,EAAS,KAAK,YAAY,CAAA;AAChC,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AAAA,EACd;AACF;AAEO,IAAM,qBAAA,GAAN,cAAoC,WAAA,CAAY;AAAA,EACrD,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAA,EAAS,KAAK,kBAAkB,CAAA;AACtC,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AAAA,EACd;AACF;AAEO,IAAM,mBAAA,GAAN,cAAkC,WAAA,CAAY;AAAA,EACnD,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAA,EAAS,KAAK,WAAW,CAAA;AAC/B,IAAA,IAAA,CAAK,IAAA,GAAO,qBAAA;AAAA,EACd;AACF;;;ACvPA,IAAM,eAAA,GAAkB,wCAAA;AAwBjB,IAAM,SAAN,MAAa;AAAA,EACD,SAAA;AAAA,EACA,OAAA;AAAA,EACT,SAAA;AAAA,EACA,IAAA;AAAA,EAER,YAAY,MAAA,EAAsB;AAChC,IAAA,IAAA,CAAK,YAAY,MAAA,CAAO,SAAA;AACxB,IAAA,IAAA,CAAK,OAAA,GAAU,OAAO,OAAA,IAAW,eAAA;AACjC,IAAA,IAAA,CAAK,YAAY,MAAA,CAAO,SAAA;AACxB,IAAA,IAAA,CAAK,OAAO,MAAA,CAAO,IAAA;AAEnB,IAAA,IAAI,CAAC,KAAK,SAAA,EAAW;AACnB,MAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,IACjD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,QAAQ,IAAA,EAAoC;AAC1C,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,SAAA,GAAY,MAAA;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA,EAKA,aAAa,KAAA,EAAiC;AAC5C,IAAA,IAAA,CAAK,SAAA,GAAY,KAAA;AACjB,IAAA,IAAA,CAAK,IAAA,GAAO,MAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,SAAA,GAAkC;AACtC,IAAA,OAAO,MAAM,IAAA,CAAK,OAAA,CAAqB,KAAA,EAAO,kBAAkB,CAAA;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,KAAK,MAAA,EAA4D;AACrE,IAAA,MAAM,YAAA,GAAe,IAAI,eAAA,EAAgB;AAEzC,IAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,MAAA,YAAA,CAAa,GAAA,CAAI,UAAA,EAAY,MAAA,CAAO,QAAQ,CAAA;AAAA,IAC9C;AACA,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,YAAA,CAAa,GAAA,CAAI,QAAA,EAAU,MAAA,CAAO,MAAM,CAAA;AAAA,IAC1C;AACA,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,YAAA,CAAa,GAAA,CAAI,QAAA,EAAU,MAAA,CAAO,MAAM,CAAA;AAAA,IAC1C;AACA,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,YAAA,CAAa,GAAA,CAAI,QAAA,EAAU,MAAA,CAAO,MAAM,CAAA;AAAA,IAC1C;AACA,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,YAAA,CAAa,GAAA,CAAI,OAAA,EAAS,MAAA,CAAO,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,IAChD;AACA,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,YAAA,CAAa,GAAA,CAAI,QAAA,EAAU,MAAA,CAAO,MAAA,CAAO,MAAM,CAAC,CAAA;AAAA,IAClD;AAEA,IAAA,MAAM,KAAA,GAAQ,aAAa,QAAA,EAAS;AACpC,IAAA,MAAM,MAAM,CAAA,qBAAA,EAAwB,KAAA,GAAQ,CAAA,CAAA,EAAI,KAAK,KAAK,EAAE,CAAA,CAAA;AAE5D,IAAA,OAAO,MAAM,IAAA,CAAK,OAAA,CAA8B,KAAA,EAAO,GAAG,CAAA;AAAA,EAC5D;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,IAAI,UAAA,EAA6C;AACrD,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,OAAA;AAAA,MACxB,KAAA;AAAA,MACA,CAAA,yBAAA,EAA4B,kBAAA,CAAmB,UAAU,CAAC,CAAA;AAAA,KAC5D;AAEA,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,MAAM,IAAI,oBAAoB,oBAAoB,CAAA;AAAA,IACpD;AAEA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAO,MAAA,EAA+D;AAC1E,IAAA,OAAO,MAAM,IAAA,CAAK,OAAA;AAAA,MAChB,MAAA;AAAA,MACA,yBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,IAAA,CACJ,UAAA,EACA,IAAA,GAA8B,QAAA,EACP;AACvB,IAAA,OAAO,MAAM,IAAA,CAAK,OAAA,CAAsB,MAAA,EAAQ,uBAAA,EAAyB;AAAA,MACvE,UAAA;AAAA,MACA,QAAA,EAAU;AAAA,KACX,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,WAAA,CACJ,UAAA,EACA,MAAA,GAA8B,QAAA,EACV;AACpB,IAAA,OAAO,MAAM,IAAA,CAAK,OAAA;AAAA,MAChB,KAAA;AAAA,MACA,CAAA,qCAAA,EAAwC,kBAAA,CAAmB,UAAU,CAAC,WAAW,MAAM,CAAA;AAAA,KACzF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,QAAQ,MAAA,EAAuD;AACnE,IAAA,OAAO,MAAM,IAAA,CAAK,OAAA;AAAA,MAChB,MAAA;AAAA,MACA,0BAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,UAAU,UAAA,EAAgD;AAC9D,IAAA,OAAO,MAAM,IAAA,CAAK,OAAA;AAAA,MAChB,MAAA;AAAA,MACA,4BAAA;AAAA,MACA;AAAA,QACE;AAAA;AACF,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,YAAY,UAAA,EAAkD;AAClE,IAAA,OAAO,MAAM,IAAA,CAAK,OAAA;AAAA,MAChB,MAAA;AAAA,MACA,8BAAA;AAAA,MACA;AAAA,QACE;AAAA;AACF,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAA,GAA+B;AACnC,IAAA,OAAO,MAAM,IAAA,CAAK,OAAA,CAAiB,KAAA,EAAO,0BAA0B,CAAA;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,KAAA,EAA2C;AAC5D,IAAA,MAAM,GAAA,GAAM,KAAA,GACR,CAAA,iCAAA,EAAoC,KAAK,CAAA,CAAA,GACzC,4BAAA;AAEJ,IAAA,OAAO,MAAM,IAAA,CAAK,OAAA,CAA0B,KAAA,EAAO,GAAG,CAAA;AAAA,EACxD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,OAAA,CACZ,MAAA,EACA,IAAA,EACA,IAAA,EACY;AACZ,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,cAAA,EAAgB,kBAAA;AAAA,MAChB,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,SAAS,CAAA;AAAA,KACzC;AAGA,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,SAAA,IAAa,IAAA,CAAK,iBAAA,EAAkB;AACvD,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,OAAA,CAAQ,cAAc,CAAA,GAAI,KAAA;AAAA,IAC5B;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,CAAA,EAAG,KAAK,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI;AAAA,MACrD,MAAA;AAAA,MACA,OAAA;AAAA,MACA,IAAA,EAAM,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,GAAI;AAAA,KACrC,CAAA;AAED,IAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAElC,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,YAAA,GACH,KAA4B,KAAA,IAAS,gBAAA;AAExC,MAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EAAK;AAC3B,QAAA,MAAM,IAAI,gBAAgB,YAAY,CAAA;AAAA,MACxC;AACA,MAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EAAK;AAC3B,QAAA,MAAM,IAAI,oBAAoB,YAAY,CAAA;AAAA,MAC5C;AAEA,MAAA,MAAM,IAAI,WAAA,CAAY,YAAA,EAAc,QAAA,CAAS,MAAM,CAAA;AAAA,IACrD;AAEA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,iBAAA,GAAwC;AAC9C,IAAA,IAAI,CAAC,KAAK,IAAA,EAAM;AACd,MAAA,OAAO,MAAA;AAAA,IACT;AAIA,IAAA,MAAM,OAAA,GAAU;AAAA,MACd,EAAA,EAAI,KAAK,IAAA,CAAK,EAAA;AAAA,MACd,KAAA,EAAO,KAAK,IAAA,CAAK,KAAA;AAAA,MACjB,IAAA,EAAM,KAAK,IAAA,CAAK,IAAA;AAAA,MAChB,KAAK,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAAA,MACjC,KAAK,IAAA,CAAK,KAAA,CAAM,KAAK,GAAA,EAAI,GAAI,GAAI,CAAA,GAAI;AAAA;AAAA,KACvC;AAEA,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,EAAE,KAAK,MAAA,EAAQ,GAAA,EAAK,KAAA,EAAO,CAAC,CAAA;AAC/D,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA;AAE/C,IAAA,OAAO,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,UAAU,CAAA,CAAA,CAAA;AAAA,EAChC;AACF","file":"chunk-AHWT4I4V.js","sourcesContent":["/**\n * Reflet SDK Types\n */\n\n// ============================================\n// Configuration\n// ============================================\n\nexport interface RefletConfig {\n  /** Your board's public API key (fb_pub_xxx) */\n  publicKey: string;\n  /** API base URL (optional, defaults to Reflet production API) */\n  baseUrl?: string;\n  /** User identification for SSO */\n  user?: RefletUser;\n  /** Pre-signed user token (alternative to user object) */\n  userToken?: string;\n}\n\nexport interface RefletUser {\n  /** Unique identifier for the user in your system */\n  id: string;\n  /** User's email address */\n  email?: string;\n  /** User's display name */\n  name?: string;\n  /** URL to user's avatar image */\n  avatar?: string;\n  /** Additional metadata */\n  metadata?: Record<string, unknown>;\n}\n\n// ============================================\n// API Responses\n// ============================================\n\nexport interface BoardConfig {\n  id: string;\n  name: string;\n  slug: string;\n  description?: string;\n  isPublic: boolean;\n  settings?: BoardSettings;\n  organization: {\n    id: string;\n    name: string;\n    slug: string;\n    logo?: string;\n    primaryColor?: string;\n  };\n  statuses: BoardStatus[];\n}\n\nexport interface BoardSettings {\n  allowAnonymousVoting?: boolean;\n  requireApproval?: boolean;\n  defaultStatus?: FeedbackStatus;\n}\n\nexport interface BoardStatus {\n  id: string;\n  name: string;\n  color: string;\n  icon?: string;\n  order: number;\n}\n\nexport type FeedbackStatus =\n  | \"open\"\n  | \"under_review\"\n  | \"planned\"\n  | \"in_progress\"\n  | \"completed\"\n  | \"closed\";\n\n// ============================================\n// Feedback\n// ============================================\n\nexport interface FeedbackItem {\n  id: string;\n  title: string;\n  description: string;\n  status: FeedbackStatus;\n  voteCount: number;\n  commentCount: number;\n  isPinned: boolean;\n  hasVoted: boolean;\n  createdAt: number;\n  updatedAt: number;\n  completedAt?: number;\n  tags: FeedbackTag[];\n  boardStatus: {\n    id: string;\n    name: string;\n    color: string;\n  } | null;\n  author: FeedbackAuthor | null;\n}\n\nexport interface FeedbackDetail extends FeedbackItem {\n  isSubscribed: boolean;\n}\n\nexport interface FeedbackTag {\n  id: string;\n  name: string;\n  color: string;\n}\n\nexport interface FeedbackAuthor {\n  name?: string;\n  email?: string;\n  avatar?: string;\n  isExternal: boolean;\n}\n\nexport interface FeedbackListResponse {\n  items: FeedbackItem[];\n  total: number;\n  hasMore: boolean;\n}\n\nexport interface FeedbackListParams {\n  /** Filter by custom status ID */\n  statusId?: string;\n  /** Filter by status name */\n  status?: FeedbackStatus;\n  /** Search in title and description */\n  search?: string;\n  /** Sort order */\n  sortBy?: \"votes\" | \"newest\" | \"oldest\" | \"comments\";\n  /** Number of items to return (max 100) */\n  limit?: number;\n  /** Offset for pagination */\n  offset?: number;\n}\n\nexport interface CreateFeedbackParams {\n  title: string;\n  description: string;\n}\n\nexport interface CreateFeedbackResponse {\n  feedbackId: string;\n  isApproved: boolean;\n}\n\nexport interface VoteResponse {\n  voted: boolean;\n  voteCount: number;\n}\n\n// ============================================\n// Comments\n// ============================================\n\nexport interface Comment {\n  id: string;\n  body: string;\n  isOfficial: boolean;\n  author: FeedbackAuthor | null;\n  replies: CommentReply[];\n  createdAt: number;\n  updatedAt: number;\n}\n\nexport interface CommentReply {\n  id: string;\n  body: string;\n  isOfficial: boolean;\n  author: FeedbackAuthor | null;\n  createdAt: number;\n  updatedAt: number;\n}\n\nexport interface AddCommentParams {\n  feedbackId: string;\n  body: string;\n  parentId?: string;\n}\n\nexport interface AddCommentResponse {\n  commentId: string;\n}\n\n// ============================================\n// Subscriptions\n// ============================================\n\nexport interface SubscribeResponse {\n  subscribed: boolean;\n  alreadySubscribed?: boolean;\n}\n\nexport interface UnsubscribeResponse {\n  unsubscribed: boolean;\n  wasNotSubscribed?: boolean;\n}\n\n// ============================================\n// Roadmap\n// ============================================\n\nexport interface Roadmap {\n  lanes: RoadmapLane[];\n}\n\nexport interface RoadmapLane {\n  id: string;\n  name: string;\n  color: string;\n  items: RoadmapItem[];\n}\n\nexport interface RoadmapItem {\n  id: string;\n  title: string;\n  status: FeedbackStatus;\n  voteCount: number;\n}\n\n// ============================================\n// Changelog\n// ============================================\n\nexport interface ChangelogEntry {\n  id: string;\n  title: string;\n  description?: string;\n  version?: string;\n  publishedAt?: number;\n  feedback: { id: string; title: string }[];\n}\n\n// ============================================\n// Errors\n// ============================================\n\nexport class RefletError extends Error {\n  readonly status: number;\n  readonly code?: string;\n\n  constructor(message: string, status: number, code?: string) {\n    super(message);\n    this.name = \"RefletError\";\n    this.status = status;\n    this.code = code;\n  }\n}\n\nexport class RefletAuthError extends RefletError {\n  constructor(message: string) {\n    super(message, 401, \"AUTH_ERROR\");\n    this.name = \"RefletAuthError\";\n  }\n}\n\nexport class RefletValidationError extends RefletError {\n  constructor(message: string) {\n    super(message, 400, \"VALIDATION_ERROR\");\n    this.name = \"RefletValidationError\";\n  }\n}\n\nexport class RefletNotFoundError extends RefletError {\n  constructor(message: string) {\n    super(message, 404, \"NOT_FOUND\");\n    this.name = \"RefletNotFoundError\";\n  }\n}\n","import {\n  type AddCommentParams,\n  type AddCommentResponse,\n  type BoardConfig,\n  type ChangelogEntry,\n  type Comment,\n  type CreateFeedbackParams,\n  type CreateFeedbackResponse,\n  type FeedbackDetail,\n  type FeedbackListParams,\n  type FeedbackListResponse,\n  RefletAuthError,\n  type RefletConfig,\n  RefletError,\n  RefletNotFoundError,\n  type RefletUser,\n  type Roadmap,\n  type SubscribeResponse,\n  type UnsubscribeResponse,\n  type VoteResponse,\n} from \"./types\";\n\n// Default to Reflet production API\nconst DEFAULT_API_URL = \"https://harmless-clam-802.convex.cloud\";\n\n/**\n * Reflet SDK Client\n *\n * @example\n * ```ts\n * import { Reflet } from 'reflet-sdk';\n *\n * const reflet = new Reflet({\n *   publicKey: 'fb_pub_xxx',\n *   user: { id: 'user_123', email: 'user@example.com', name: 'John' }\n * });\n *\n * // List feedback\n * const { items } = await reflet.list({ status: 'open' });\n *\n * // Vote on feedback\n * await reflet.vote('feedback_id');\n *\n * // Submit new feedback\n * await reflet.create({ title: 'Great idea', description: 'Details...' });\n * ```\n */\nexport class Reflet {\n  private readonly publicKey: string;\n  private readonly baseUrl: string;\n  private userToken: string | undefined;\n  private user: RefletUser | undefined;\n\n  constructor(config: RefletConfig) {\n    this.publicKey = config.publicKey;\n    this.baseUrl = config.baseUrl ?? DEFAULT_API_URL;\n    this.userToken = config.userToken;\n    this.user = config.user;\n\n    if (!this.publicKey) {\n      throw new Error(\"Reflet: publicKey is required\");\n    }\n  }\n\n  /**\n   * Update the user identification\n   */\n  setUser(user: RefletUser | undefined): void {\n    this.user = user;\n    this.userToken = undefined;\n  }\n\n  /**\n   * Set the user token directly (for server-signed tokens)\n   */\n  setUserToken(token: string | undefined): void {\n    this.userToken = token;\n    this.user = undefined;\n  }\n\n  /**\n   * Get the board configuration\n   */\n  async getConfig(): Promise<BoardConfig> {\n    return await this.request<BoardConfig>(\"GET\", \"/api/v1/feedback\");\n  }\n\n  /**\n   * List feedback items with optional filtering\n   */\n  async list(params?: FeedbackListParams): Promise<FeedbackListResponse> {\n    const searchParams = new URLSearchParams();\n\n    if (params?.statusId) {\n      searchParams.set(\"statusId\", params.statusId);\n    }\n    if (params?.status) {\n      searchParams.set(\"status\", params.status);\n    }\n    if (params?.search) {\n      searchParams.set(\"search\", params.search);\n    }\n    if (params?.sortBy) {\n      searchParams.set(\"sortBy\", params.sortBy);\n    }\n    if (params?.limit) {\n      searchParams.set(\"limit\", String(params.limit));\n    }\n    if (params?.offset) {\n      searchParams.set(\"offset\", String(params.offset));\n    }\n\n    const query = searchParams.toString();\n    const url = `/api/v1/feedback/list${query ? `?${query}` : \"\"}`;\n\n    return await this.request<FeedbackListResponse>(\"GET\", url);\n  }\n\n  /**\n   * Get a single feedback item by ID\n   */\n  async get(feedbackId: string): Promise<FeedbackDetail> {\n    const result = await this.request<FeedbackDetail | null>(\n      \"GET\",\n      `/api/v1/feedback/item?id=${encodeURIComponent(feedbackId)}`\n    );\n\n    if (!result) {\n      throw new RefletNotFoundError(\"Feedback not found\");\n    }\n\n    return result;\n  }\n\n  /**\n   * Create new feedback\n   * Requires user identification\n   */\n  async create(params: CreateFeedbackParams): Promise<CreateFeedbackResponse> {\n    return await this.request<CreateFeedbackResponse>(\n      \"POST\",\n      \"/api/v1/feedback/create\",\n      params\n    );\n  }\n\n  /**\n   * Toggle vote on feedback\n   * Requires user identification\n   */\n  async vote(\n    feedbackId: string,\n    type: \"upvote\" | \"downvote\" = \"upvote\"\n  ): Promise<VoteResponse> {\n    return await this.request<VoteResponse>(\"POST\", \"/api/v1/feedback/vote\", {\n      feedbackId,\n      voteType: type,\n    });\n  }\n\n  /**\n   * Get comments for a feedback item\n   */\n  async getComments(\n    feedbackId: string,\n    sortBy: \"newest\" | \"oldest\" = \"oldest\"\n  ): Promise<Comment[]> {\n    return await this.request<Comment[]>(\n      \"GET\",\n      `/api/v1/feedback/comments?feedbackId=${encodeURIComponent(feedbackId)}&sortBy=${sortBy}`\n    );\n  }\n\n  /**\n   * Add a comment to feedback\n   * Requires user identification\n   */\n  async comment(params: AddCommentParams): Promise<AddCommentResponse> {\n    return await this.request<AddCommentResponse>(\n      \"POST\",\n      \"/api/v1/feedback/comment\",\n      params\n    );\n  }\n\n  /**\n   * Subscribe to feedback updates\n   * Requires user identification\n   */\n  async subscribe(feedbackId: string): Promise<SubscribeResponse> {\n    return await this.request<SubscribeResponse>(\n      \"POST\",\n      \"/api/v1/feedback/subscribe\",\n      {\n        feedbackId,\n      }\n    );\n  }\n\n  /**\n   * Unsubscribe from feedback updates\n   * Requires user identification\n   */\n  async unsubscribe(feedbackId: string): Promise<UnsubscribeResponse> {\n    return await this.request<UnsubscribeResponse>(\n      \"POST\",\n      \"/api/v1/feedback/unsubscribe\",\n      {\n        feedbackId,\n      }\n    );\n  }\n\n  /**\n   * Get roadmap data\n   */\n  async getRoadmap(): Promise<Roadmap> {\n    return await this.request<Roadmap>(\"GET\", \"/api/v1/feedback/roadmap\");\n  }\n\n  /**\n   * Get changelog entries\n   */\n  async getChangelog(limit?: number): Promise<ChangelogEntry[]> {\n    const url = limit\n      ? `/api/v1/feedback/changelog?limit=${limit}`\n      : \"/api/v1/feedback/changelog\";\n\n    return await this.request<ChangelogEntry[]>(\"GET\", url);\n  }\n\n  /**\n   * Make an authenticated API request\n   */\n  private async request<T>(\n    method: string,\n    path: string,\n    body?: unknown\n  ): Promise<T> {\n    const headers: Record<string, string> = {\n      \"Content-Type\": \"application/json\",\n      Authorization: `Bearer ${this.publicKey}`,\n    };\n\n    // Add user token if available\n    const token = this.userToken ?? this.generateUserToken();\n    if (token) {\n      headers[\"X-User-Token\"] = token;\n    }\n\n    const response = await fetch(`${this.baseUrl}${path}`, {\n      method,\n      headers,\n      body: body ? JSON.stringify(body) : undefined,\n    });\n\n    const data = (await response.json()) as T | { error: string };\n\n    if (!response.ok) {\n      const errorMessage =\n        (data as { error?: string }).error ?? \"Request failed\";\n\n      if (response.status === 401) {\n        throw new RefletAuthError(errorMessage);\n      }\n      if (response.status === 404) {\n        throw new RefletNotFoundError(errorMessage);\n      }\n\n      throw new RefletError(errorMessage, response.status);\n    }\n\n    return data as T;\n  }\n\n  /**\n   * Generate a simple user token for client-side use\n   * Note: For production, use server-side token signing\n   */\n  private generateUserToken(): string | undefined {\n    if (!this.user) {\n      return undefined;\n    }\n\n    // Simple base64 encoding for client-side use\n    // In production, tokens should be signed server-side\n    const payload = {\n      id: this.user.id,\n      email: this.user.email,\n      name: this.user.name,\n      iat: Math.floor(Date.now() / 1000),\n      exp: Math.floor(Date.now() / 1000) + 86_400, // 24 hours\n    };\n\n    const header = btoa(JSON.stringify({ alg: \"none\", typ: \"JWT\" }));\n    const payloadB64 = btoa(JSON.stringify(payload));\n\n    return `${header}.${payloadB64}.`;\n  }\n}\n"]}