@burdenoff/fe-libs 2026.802.1 → 2026.803.1

package/dist/shared/hooks/shell/useProducts.d.ts

@@ -6,6 +6,13 @@
  *
  * @module @burdenoff/fe-libs/shared/hooks/shell/useProducts
  */
+/**
+ * Reject API appUrls that are clearly not production-safe: non-https schemes,
+ * localhost/loopback addresses, or empty values. The static catalog URL is
+ * authoritative for the switcher, so a bad API value falls back instead of
+ * shipping a broken link (BOFF-5485).
+ */
+export declare function isTrustedAppUrl(url: string | null | undefined): url is string;
 export interface Product {
     id: string;
     name: string;

package/dist/shared/hooks/shell/useProducts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useProducts.d.ts","sourceRoot":"","sources":["../../../../src/shared/hooks/shell/useProducts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA8DH,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAeD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,iBAAiB,CAuE3E"}
+{"version":3,"file":"useProducts.d.ts","sourceRoot":"","sources":["../../../../src/shared/hooks/shell/useProducts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA8DH;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,GAAG,IAAI,MAAM,CAU7E;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAeD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,iBAAiB,CAuE3E"}

package/dist/shared/hooks/shell/useProducts.js

@@ -28,7 +28,16 @@ var d = s`
 function f(e) {
 	return c.has(e);
 }
-function p() {
+function p(e) {
+	if (!e || !e.startsWith("https://") || e.includes("localhost") || e.includes("127.0.0.1")) return !1;
+	try {
+		let t = new URL(e);
+		return t.protocol === "https:" && t.hostname.length > 0;
+	} catch {
+		return !1;
+	}
+}
+function m() {
 	return e.map((e) => ({
 		id: e.id,
 		name: e.name,
@@ -39,9 +48,9 @@ function p() {
 		comingSoon: e.comingSoon === !0
 	}));
 }
-function m(s) {
-	let c = r("global"), [l, m] = o(p()), [h, g] = o(s?.autoFetch !== !1), [_, v] = o(null), y = i(async () => {
-		g(!0), v(null);
+function h(s) {
+	let c = r("global"), [l, h] = o(m()), [g, _] = o(s?.autoFetch !== !1), [v, y] = o(null), b = i(async () => {
+		_(!0), y(null);
 		try {
 			let r = (await c.query({
 				query: d,
@@ -55,32 +64,32 @@ function m(s) {
 				return {
 					id: e.id,
 					name: e.name,
-					url: r?.appUrl || n(e.id),
+					url: p(r?.appUrl) ? r.appUrl : n(e.id),
 					icon: e.icon,
 					color: r?.metadata && typeof r.metadata.color == "string" ? r.metadata.color : e.color,
 					logoUrl: t(e.id),
 					comingSoon: r ? u(e.id, r.status, r.appUrl) : e.comingSoon === !0
 				};
 			});
-			a.sort((e, t) => e.name.localeCompare(t.name)), m(a);
+			a.sort((e, t) => e.name.localeCompare(t.name)), h(a);
 		} catch (e) {
-			v(e instanceof Error ? e.message : "Failed to fetch products"), m(p());
+			y(e instanceof Error ? e.message : "Failed to fetch products"), h(m());
 		} finally {
-			g(!1);
+			_(!1);
 		}
 	}, [c]);
 	return a(() => {
 		if (s?.autoFetch === !1) {
-			g(!1);
+			_(!1);
 			return;
 		}
-		y();
+		b();
 	}, []), {
 		products: l,
-		isLoading: h,
-		error: _,
-		refetch: y
+		isLoading: g,
+		error: v,
+		refetch: b
 	};
 }
 //#endregion
-export { m as useProducts };
+export { h as useProducts };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@burdenoff/fe-libs",
-  "version": "2026.802.1",
+  "version": "2026.803.1",
   "description": "Burdenoff frontend primitives and domain libraries",
   "type": "module",
   "bin": {