@burdenoff/fe-libs 2026.615.1 → 2026.616.1

package/dist/shared/utils/gatewayFetchRewrite.d.ts

@@ -34,6 +34,12 @@ export interface GatewayBaseMapping {
  * @param localDefaults - Override defaults for local development
  */
 export declare function resolveGatewayBases(extraMappings?: GatewayBaseMapping[], localDefaults?: GatewayBases): GatewayBases;
+/**
+ * Attach Cloudflare Access service-token headers to a request iff a token is
+ * provided AND the request targets one of the CF-protected gateway origins.
+ * Pure + exported so it can be unit-tested without mocking `import.meta.env`.
+ */
+export declare function maybeAttachCfAccessHeaders(request: Request, gatewayOrigins: ReadonlySet<string>, clientId?: string, clientSecret?: string): Request;
 /**
  * Install a global fetch interceptor that rewrites GraphQL request URLs
  * to the correct gateway domain based on the URL path.

package/dist/shared/utils/gatewayFetchRewrite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gatewayFetchRewrite.d.ts","sourceRoot":"","sources":["../../../src/shared/utils/gatewayFetchRewrite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,2BAA2B;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,sCAAsC;IACtC,KAAK,EAAE,YAAY,CAAC;CACrB;AAmID;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,aAAa,CAAC,EAAE,kBAAkB,EAAE,EACpC,aAAa,CAAC,EAAE,YAAY,GAC3B,YAAY,CAad;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAqHpE;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,SAAyB,GAAG,IAAI,CAQtE"}
+{"version":3,"file":"gatewayFetchRewrite.d.ts","sourceRoot":"","sources":["../../../src/shared/utils/gatewayFetchRewrite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,2BAA2B;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,sCAAsC;IACtC,KAAK,EAAE,YAAY,CAAC;CACrB;AAmID;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,aAAa,CAAC,EAAE,kBAAkB,EAAE,EACpC,aAAa,CAAC,EAAE,YAAY,GAC3B,YAAY,CAad;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,OAAO,EAChB,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,EACnC,QAAQ,CAAC,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAaT;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CA+IpE;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,SAAyB,GAAG,IAAI,CAQtE"}

package/dist/shared/utils/gatewayFetchRewrite.js

@@ -81,13 +81,35 @@ function v(e, t) {
 	for (let e of a) if (n === e.hostname) return e.bases;
 	return t ?? i;
 }
-function y(e) {
+function y(e, t, n, r) {
+	if (!n || !r) return e;
+	let i;
+	try {
+		i = new URL(e.url).origin;
+	} catch {
+		return e;
+	}
+	if (!t.has(i)) return e;
+	let a = new Headers(e.headers);
+	return a.set("CF-Access-Client-Id", n), a.set("CF-Access-Client-Secret", r), new Request(e, { headers: a });
+}
+function b(e) {
 	let { globalBase: t, workspaceBase: n } = e;
 	if (!t || !n) return;
-	let r = globalThis.fetch.bind(globalThis), i = window.location.origin, o = new Set([i, "https://gw-global.local.burdenoff.com"]), s = new Set([i, "https://gw-wspace.local.burdenoff.com"]), c = (e) => /(?:^|\/)global\/graphql$/.test(e) ? "/global/graphql" : /(?:^|\/)workspaces\/graphql$/.test(e) ? "/workspaces/graphql" : "", u = (e) => {
-		let r = new URL(e, window.location.origin), i = c(r.pathname);
-		return i === "/global/graphql" && o.has(r.origin) ? `${t}${i}${r.search}${r.hash}` : i === "/workspaces/graphql" && s.has(r.origin) ? `${n}${i}${r.search}${r.hash}` : e;
-	}, d = async (e) => {
+	let r = globalThis.fetch.bind(globalThis), i = window.location.origin, o = {
+		BASE_URL: "/",
+		DEV: !1,
+		MODE: "production",
+		PROD: !0,
+		SSR: !1
+	}, s = o.VITE_CF_ACCESS_CLIENT_ID, c = o.VITE_CF_ACCESS_CLIENT_SECRET, u = !!(s && c), d = /* @__PURE__ */ new Set();
+	if (u) for (let e of [t, n]) try {
+		d.add(new URL(e).origin);
+	} catch {}
+	let f = (e) => u ? y(e, d, s, c) : e, v = new Set([i, "https://gw-global.local.burdenoff.com"]), b = new Set([i, "https://gw-wspace.local.burdenoff.com"]), x = (e) => /(?:^|\/)global\/graphql$/.test(e) ? "/global/graphql" : /(?:^|\/)workspaces\/graphql$/.test(e) ? "/workspaces/graphql" : "", S = (e) => {
+		let r = new URL(e, window.location.origin), i = x(r.pathname);
+		return i === "/global/graphql" && v.has(r.origin) ? `${t}${i}${r.search}${r.hash}` : i === "/workspaces/graphql" && b.has(r.origin) ? `${n}${i}${r.search}${r.hash}` : e;
+	}, C = async (e) => {
 		if (!(e.method.toUpperCase() === "POST" && /(?:^|\/)graphql$/.test(new URL(e.url).pathname))) return r(e);
 		let t = await e.clone().text(), n = _(e.clone()), i = m(t);
 		if (!i?.length) return r(e);
@@ -109,18 +131,18 @@ function y(e) {
 			});
 		} catch {}
 		return c;
-	}, f = r, v = ((e, t) => {
+	}, w = r, T = ((e, t) => {
 		if (e == null) return r(e, t);
 		if (e instanceof Request) {
-			let n = u(e.url), r = new Request(n, e);
-			return d(t ? new Request(r, t) : r);
+			let n = S(e.url), r = new Request(n, e);
+			return C(f(t ? new Request(r, t) : r));
 		}
 		let n = typeof e == "string" ? e : e.toString();
-		return d(new Request(u(n), t));
+		return C(f(new Request(S(n), t)));
 	});
-	f.preconnect && (v.preconnect = f.preconnect), globalThis.fetch = v;
+	w.preconnect && (T.preconnect = w.preconnect), globalThis.fetch = T;
 }
-function b(e = "VITE_VERBOSE_CONSOLE") {
+function x(e = "VITE_VERBOSE_CONSOLE") {
 	({
 		BASE_URL: "/",
 		DEV: !1,
@@ -130,4 +152,4 @@ function b(e = "VITE_VERBOSE_CONSOLE") {
 	})?.[e] !== "true" && (console.log = () => {}, console.info = () => {}, console.debug = () => {});
 }
 //#endregion
-export { y as installGatewayFetchRewrite, v as resolveGatewayBases, b as suppressConsole };
+export { b as installGatewayFetchRewrite, v as resolveGatewayBases, x as suppressConsole };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@burdenoff/fe-libs",
-  "version": "2026.615.1",
+  "version": "2026.616.1",
   "description": "Burdenoff frontend primitives and domain libraries",
   "type": "module",
   "imports": {