@burdenoff/fe-libs 2026.615.1 → 2026.616.2

package/dist/shared/utils/gatewayFetchRewrite.d.ts

@@ -34,6 +34,29 @@ export interface GatewayBaseMapping {
  * @param localDefaults - Override defaults for local development
  */
 export declare function resolveGatewayBases(extraMappings?: GatewayBaseMapping[], localDefaults?: GatewayBases): GatewayBases;
+/**
+ * Attach Cloudflare Access service-token headers to a request iff a token is
+ * provided AND the request targets one of the CF-protected gateway origins.
+ * Pure + exported so it can be unit-tested without mocking `import.meta.env`.
+ */
+export declare function maybeAttachCfAccessHeaders(request: Request, gatewayOrigins: ReadonlySet<string>, clientId?: string, clientSecret?: string): Request;
+/**
+ * Options for installGatewayFetchRewrite.
+ */
+export interface GatewayFetchRewriteOptions {
+    /**
+     * Cloudflare Access service-token. Vite only statically inlines custom VITE_
+     * env vars in APP source, not inside this bundled library, so the app reads
+     * `import.meta.env.VITE_CF_ACCESS_CLIENT_ID/_SECRET` in its own source and
+     * forwards them here. When both are present, CF-Access-Client-Id/Secret headers
+     * are attached to requests targeting a configured gateway origin. Omit on
+     * prod/local (gateways are not CF-gated).
+     */
+    cfAccess?: {
+        clientId?: string;
+        clientSecret?: string;
+    };
+}
 /**
  * Install a global fetch interceptor that rewrites GraphQL request URLs
  * to the correct gateway domain based on the URL path.
@@ -42,8 +65,9 @@ export declare function resolveGatewayBases(extraMappings?: GatewayBaseMapping[]
  * - `/workspaces/graphql` → workspaceBase
  *
  * @param bases - Gateway base URLs to rewrite to
+ * @param options - Optional CF Access service-token for header injection
  */
-export declare function installGatewayFetchRewrite(bases: GatewayBases): void;
+export declare function installGatewayFetchRewrite(bases: GatewayBases, options?: GatewayFetchRewriteOptions): void;
 /**
  * Suppress verbose console output in production/non-debug environments.
  *

package/dist/shared/utils/gatewayFetchRewrite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gatewayFetchRewrite.d.ts","sourceRoot":"","sources":["../../../src/shared/utils/gatewayFetchRewrite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,2BAA2B;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,sCAAsC;IACtC,KAAK,EAAE,YAAY,CAAC;CACrB;AAmID;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,aAAa,CAAC,EAAE,kBAAkB,EAAE,EACpC,aAAa,CAAC,EAAE,YAAY,GAC3B,YAAY,CAad;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAqHpE;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,SAAyB,GAAG,IAAI,CAQtE"}
+{"version":3,"file":"gatewayFetchRewrite.d.ts","sourceRoot":"","sources":["../../../src/shared/utils/gatewayFetchRewrite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,2BAA2B;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,sCAAsC;IACtC,KAAK,EAAE,YAAY,CAAC;CACrB;AAmID;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,aAAa,CAAC,EAAE,kBAAkB,EAAE,EACpC,aAAa,CAAC,EAAE,YAAY,GAC3B,YAAY,CAad;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,OAAO,EAChB,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,EACnC,QAAQ,CAAC,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAaT;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACzD;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,0BAA0B,GACnC,IAAI,CA6IN;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,SAAyB,GAAG,IAAI,CAQtE"}

package/dist/shared/utils/gatewayFetchRewrite.js

@@ -81,22 +81,38 @@ function v(e, t) {
 	for (let e of a) if (n === e.hostname) return e.bases;
 	return t ?? i;
 }
-function y(e) {
-	let { globalBase: t, workspaceBase: n } = e;
-	if (!t || !n) return;
-	let r = globalThis.fetch.bind(globalThis), i = window.location.origin, o = new Set([i, "https://gw-global.local.burdenoff.com"]), s = new Set([i, "https://gw-wspace.local.burdenoff.com"]), c = (e) => /(?:^|\/)global\/graphql$/.test(e) ? "/global/graphql" : /(?:^|\/)workspaces\/graphql$/.test(e) ? "/workspaces/graphql" : "", u = (e) => {
-		let r = new URL(e, window.location.origin), i = c(r.pathname);
-		return i === "/global/graphql" && o.has(r.origin) ? `${t}${i}${r.search}${r.hash}` : i === "/workspaces/graphql" && s.has(r.origin) ? `${n}${i}${r.search}${r.hash}` : e;
-	}, d = async (e) => {
-		if (!(e.method.toUpperCase() === "POST" && /(?:^|\/)graphql$/.test(new URL(e.url).pathname))) return r(e);
-		let t = await e.clone().text(), n = _(e.clone()), i = m(t);
-		if (!i?.length) return r(e);
-		let o = t.trimStart().startsWith("["), s = i.map((e) => p(n, e));
+function y(e, t, n, r) {
+	if (!n || !r) return e;
+	let i;
+	try {
+		i = new URL(e.url).origin;
+	} catch {
+		return e;
+	}
+	if (!t.has(i)) return e;
+	let a = new Headers(e.headers);
+	return a.set("CF-Access-Client-Id", n), a.set("CF-Access-Client-Secret", r), new Request(e, { headers: a });
+}
+function b(e, t) {
+	let { globalBase: n, workspaceBase: r } = e;
+	if (!n || !r) return;
+	let i = globalThis.fetch.bind(globalThis), o = window.location.origin, s = t?.cfAccess?.clientId, c = t?.cfAccess?.clientSecret, u = !!(s && c), d = /* @__PURE__ */ new Set();
+	if (u) for (let e of [n, r]) try {
+		d.add(new URL(e).origin);
+	} catch {}
+	let f = (e) => u ? y(e, d, s, c) : e, v = new Set([o, "https://gw-global.local.burdenoff.com"]), b = new Set([o, "https://gw-wspace.local.burdenoff.com"]), x = (e) => /(?:^|\/)global\/graphql$/.test(e) ? "/global/graphql" : /(?:^|\/)workspaces\/graphql$/.test(e) ? "/workspaces/graphql" : "", S = (e) => {
+		let t = new URL(e, window.location.origin), i = x(t.pathname);
+		return i === "/global/graphql" && v.has(t.origin) ? `${n}${i}${t.search}${t.hash}` : i === "/workspaces/graphql" && b.has(t.origin) ? `${r}${i}${t.search}${t.hash}` : e;
+	}, C = async (e) => {
+		if (!(e.method.toUpperCase() === "POST" && /(?:^|\/)graphql$/.test(new URL(e.url).pathname))) return i(e);
+		let t = await e.clone().text(), n = _(e.clone()), r = m(t);
+		if (!r?.length) return i(e);
+		let o = t.trimStart().startsWith("["), s = r.map((e) => p(n, e));
 		if (g() && s.every(Boolean)) {
 			let e = l(), t = s.map((t) => e.get(t)), n = Date.now();
 			if (t.every((e) => e && e.expiresAt > n)) return h(t.map((e) => e.value), o);
 		}
-		let c = await r(e);
+		let c = await i(e);
 		if (!c.ok || !s.some(Boolean) || !g()) return c;
 		try {
 			let e = await c.clone().json(), t = Array.isArray(e) ? e : [e], n = l();
@@ -109,18 +125,18 @@ function y(e) {
 			});
 		} catch {}
 		return c;
-	}, f = r, v = ((e, t) => {
-		if (e == null) return r(e, t);
+	}, w = i, T = ((e, t) => {
+		if (e == null) return i(e, t);
 		if (e instanceof Request) {
-			let n = u(e.url), r = new Request(n, e);
-			return d(t ? new Request(r, t) : r);
+			let n = S(e.url), r = new Request(n, e);
+			return C(f(t ? new Request(r, t) : r));
 		}
 		let n = typeof e == "string" ? e : e.toString();
-		return d(new Request(u(n), t));
+		return C(f(new Request(S(n), t)));
 	});
-	f.preconnect && (v.preconnect = f.preconnect), globalThis.fetch = v;
+	w.preconnect && (T.preconnect = w.preconnect), globalThis.fetch = T;
 }
-function b(e = "VITE_VERBOSE_CONSOLE") {
+function x(e = "VITE_VERBOSE_CONSOLE") {
 	({
 		BASE_URL: "/",
 		DEV: !1,
@@ -130,4 +146,4 @@ function b(e = "VITE_VERBOSE_CONSOLE") {
 	})?.[e] !== "true" && (console.log = () => {}, console.info = () => {}, console.debug = () => {});
 }
 //#endregion
-export { y as installGatewayFetchRewrite, v as resolveGatewayBases, b as suppressConsole };
+export { b as installGatewayFetchRewrite, v as resolveGatewayBases, x as suppressConsole };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@burdenoff/fe-libs",
-  "version": "2026.615.1",
+  "version": "2026.616.2",
   "description": "Burdenoff frontend primitives and domain libraries",
   "type": "module",
   "imports": {