@burdenoff/website-sdk 2026.1101.1 → 2026.1101.2

package/dist/chunk-5JRJ57CL.mjs

@@ -0,0 +1,329 @@
+import { __publicField } from './chunk-VNS5WDWO.mjs';
+import { createContext, useMemo, useContext } from 'react';
+import { jsx } from 'react/jsx-runtime';
+
+// src/client/security.ts
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1"]);
+var RESERVED_HEADERS = /* @__PURE__ */ new Set([
+  "authorization",
+  "cookie",
+  "x-actor-id",
+  "x-actor-type",
+  "x-consent-granted-by",
+  "x-consent-scope",
+  "x-consent-granted-at",
+  "x-consent-expires-at"
+]);
+function validateGatewayUrl(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("Gateway URL must be a valid absolute URL");
+  }
+  if (url.protocol === "https:") {
+    return url.toString();
+  }
+  if (url.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname.toLowerCase())) {
+    return url.toString();
+  }
+  throw new Error("Gateway URL must use HTTPS unless it targets localhost");
+}
+function sanitizeHeaders(headers) {
+  if (!headers) return void 0;
+  return Object.fromEntries(
+    Object.entries(headers).filter(
+      ([key]) => !RESERVED_HEADERS.has(key.toLowerCase())
+    )
+  );
+}
+var CF_ACCESS_GATED_HOSTS = /* @__PURE__ */ new Set([
+  "alphagraphql.burdenoff.com",
+  "alphagraphqlworkspaces.burdenoff.com"
+]);
+function cfAccessHeaders(gatewayUrl, cfAccess) {
+  const clientId = cfAccess?.clientId?.trim();
+  const clientSecret = cfAccess?.clientSecret?.trim();
+  if (!clientId || !clientSecret) return {};
+  let host;
+  try {
+    host = new URL(gatewayUrl).hostname.toLowerCase();
+  } catch {
+    return {};
+  }
+  if (!CF_ACCESS_GATED_HOSTS.has(host)) return {};
+  return {
+    "CF-Access-Client-Id": clientId,
+    "CF-Access-Client-Secret": clientSecret
+  };
+}
+
+// src/client/graphql-client.ts
+var _WebSDKClient = class _WebSDKClient {
+  constructor(config) {
+    __publicField(this, "config");
+    __publicField(this, "queryCache", /* @__PURE__ */ new Map());
+    __publicField(this, "inflight", /* @__PURE__ */ new Map());
+    this.config = {
+      ...config,
+      gatewayUrl: validateGatewayUrl(config.gatewayUrl),
+      headers: sanitizeHeaders(config.headers)
+    };
+  }
+  getConfig() {
+    return this.config;
+  }
+  /**
+   * Execute a GraphQL query (with deduplication and caching).
+   *
+   * Pass `{ cache: false }` to bypass the cache entirely — required for poll
+   * loops, where every tick must reach the network.
+   */
+  async query(query, variables, options) {
+    if (options?.cache === false) {
+      return this.request(query, variables, true, options.timeoutMs);
+    }
+    const cacheKey = JSON.stringify({ query, variables });
+    const cached = this.queryCache.get(cacheKey);
+    if (cached) {
+      if (Date.now() - cached.ts < _WebSDKClient.CACHE_TTL) {
+        return cached.data;
+      }
+      this.queryCache.delete(cacheKey);
+    }
+    const existing = this.inflight.get(cacheKey);
+    if (existing) {
+      return existing;
+    }
+    const promise = this.request(query, variables, true, options?.timeoutMs).then((result) => {
+      if (result.data && !result.errors?.length) {
+        if (this.queryCache.size >= _WebSDKClient.MAX_CACHE_ENTRIES) {
+          const oldestEntry = this.queryCache.keys().next().value;
+          if (oldestEntry) {
+            this.queryCache.delete(oldestEntry);
+          }
+        }
+        this.queryCache.set(cacheKey, { data: result, ts: Date.now() });
+      }
+      return result;
+    }).finally(() => {
+      this.inflight.delete(cacheKey);
+    });
+    this.inflight.set(cacheKey, promise);
+    return promise;
+  }
+  /**
+   * Execute a GraphQL mutation
+   */
+  async mutate(mutation, variables, options) {
+    return this.request(mutation, variables, false, options?.timeoutMs);
+  }
+  /** HTTP statuses worth another attempt — transient server/edge conditions. */
+  static isRetriableStatus(status) {
+    return status === 429 || status === 408 || status >= 500 && status < 600;
+  }
+  static sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+  }
+  /**
+   * Perform the HTTP call with a hard timeout. Every outcome resolves to a
+   * GraphQLResponse — callers never hang, so a UI's `loading` state always
+   * settles into data or a renderable error.
+   */
+  async attempt(query, variables, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+      const response = await fetch(this.config.gatewayUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "x-product-id": this.config.productId,
+          ...this.config.headers,
+          ...cfAccessHeaders(this.config.gatewayUrl, this.config.cfAccess)
+        },
+        body: JSON.stringify({ query, variables }),
+        signal: controller.signal
+      });
+      if (!response.ok) {
+        console.error(
+          "[WebSDK] GraphQL request failed",
+          response.status,
+          response.statusText
+        );
+        return {
+          res: {
+            errors: [
+              {
+                message: `HTTP ${response.status}: ${response.statusText}`,
+                extensions: { code: `HTTP_${response.status}` }
+              }
+            ]
+          },
+          retriable: _WebSDKClient.isRetriableStatus(response.status)
+        };
+      }
+      return {
+        res: await response.json(),
+        retriable: false
+      };
+    } catch (error) {
+      const aborted = error instanceof Error && (error.name === "AbortError" || controller.signal.aborted);
+      const message = aborted ? `Request timed out after ${timeoutMs}ms` : error instanceof Error ? error.message : "Network error";
+      console.error("[WebSDK] Network error", message);
+      return {
+        res: {
+          errors: [
+            {
+              message,
+              extensions: { code: aborted ? "TIMEOUT" : "NETWORK_ERROR" }
+            }
+          ]
+        },
+        // Transport-level failures are worth one more try; a genuine outage
+        // just fails twice quickly and still renders an error state.
+        retriable: true
+      };
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  async request(query, variables, retry = true, timeoutOverrideMs) {
+    const timeoutMs = timeoutOverrideMs ?? this.config.timeoutMs ?? _WebSDKClient.DEFAULT_TIMEOUT_MS;
+    const maxRetries = retry ? this.config.maxRetries ?? _WebSDKClient.DEFAULT_MAX_RETRIES : 0;
+    let last;
+    for (let i = 0; i <= maxRetries; i++) {
+      const { res, retriable } = await this.attempt(
+        query,
+        variables,
+        timeoutMs
+      );
+      if (!retriable || i === maxRetries) return res;
+      last = res;
+      await _WebSDKClient.sleep(
+        _WebSDKClient.RETRY_BASE_DELAY_MS * (i + 1) + Math.random() * 200
+      );
+    }
+    return last;
+  }
+};
+__publicField(_WebSDKClient, "CACHE_TTL", 5 * 60 * 1e3);
+// 5 minutes
+__publicField(_WebSDKClient, "MAX_CACHE_ENTRIES", 100);
+__publicField(_WebSDKClient, "DEFAULT_TIMEOUT_MS", 12e3);
+__publicField(_WebSDKClient, "DEFAULT_MAX_RETRIES", 1);
+__publicField(_WebSDKClient, "RETRY_BASE_DELAY_MS", 400);
+var WebSDKClient = _WebSDKClient;
+
+// src/client/gateway-resolver.ts
+var PROD_GATEWAY = "https://graphql.burdenoff.com/global/graphql";
+var ALPHA_GATEWAY = "https://alphagraphql.burdenoff.com/global/graphql";
+function getLocalFallback() {
+  if (typeof window !== "undefined") {
+    return `${window.location.origin}/global/graphql`;
+  }
+  return "http://localhost:4000/global/graphql";
+}
+var PRODUCT_DOMAINS = [
+  "burdenoff.com",
+  "algoshred.com",
+  "vibecontrols.com",
+  "fluidgrids.com",
+  "botmanor.com",
+  "botlit.ai",
+  // legacy BotManor domain, still served
+  "bigconsole.com",
+  "gethealthybowl.com",
+  "headshotmarketing.com",
+  "timecampus.com",
+  "ggnomad.com",
+  "movethewheels.com",
+  "crewfoundry.com",
+  "planmagnet.com",
+  "eventfullymanaged.com",
+  "kadaikodi.com",
+  "assethandler.com",
+  "technospam.com",
+  "semanticfed.com",
+  "manufacturedops.com",
+  "theglobalfuel.com",
+  "housingvista.com",
+  "proserviceworld.com",
+  "mybodyshield.com",
+  "artistrybase.com",
+  "collabkin.com",
+  "brainyrich.com",
+  "theculturepost.com",
+  "comradecircle.com",
+  "cosmicintersection.com",
+  "govcitizenhub.com",
+  "intelwatchtower.com",
+  "ecoimpacthub.com",
+  "buildmyiq.com",
+  "fluidgrids.ai"
+];
+function isProductionHost(hostname) {
+  return PRODUCT_DOMAINS.some(
+    (d) => hostname === d || hostname === `www.${d}` || hostname === `app.${d}`
+  );
+}
+function isAlphaHost(hostname) {
+  return PRODUCT_DOMAINS.some(
+    (d) => hostname === `alpha.${d}` || hostname === `alphaapp.${d}` || hostname === `staging.${d}`
+  );
+}
+function resolveGatewayUrl(explicitUrl) {
+  if (explicitUrl && isAbsoluteUrl(explicitUrl) && !isLocalhostUrl(explicitUrl)) {
+    return explicitUrl;
+  }
+  if (typeof window === "undefined") {
+    return explicitUrl && isAbsoluteUrl(explicitUrl) ? explicitUrl : getLocalFallback();
+  }
+  const hostname = window.location.hostname.toLowerCase();
+  if (isProductionHost(hostname)) return PROD_GATEWAY;
+  if (isAlphaHost(hostname)) return ALPHA_GATEWAY;
+  return getLocalFallback();
+}
+function isAbsoluteUrl(url) {
+  try {
+    new URL(url);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isLocalhostUrl(url) {
+  try {
+    const parsed = new URL(url);
+    const h = parsed.hostname;
+    return h === "localhost" || h === "127.0.0.1" || h === "::1";
+  } catch {
+    return false;
+  }
+}
+var WebSDKContext = createContext(null);
+function WebSDKProvider({ config, children }) {
+  const client = useMemo(() => {
+    const resolvedConfig = {
+      ...config,
+      gatewayUrl: resolveGatewayUrl(config.gatewayUrl)
+    };
+    return new WebSDKClient(resolvedConfig);
+  }, [config]);
+  return /* @__PURE__ */ jsx(WebSDKContext.Provider, { value: client, children });
+}
+function useWebSDK() {
+  const client = useContext(WebSDKContext);
+  if (!client) {
+    throw new Error("useWebSDK must be used within a WebSDKProvider");
+  }
+  return client;
+}
+function useWebSDKConfig() {
+  const client = useWebSDK();
+  return client.getConfig();
+}
+
+export { WebSDKClient, WebSDKProvider, cfAccessHeaders, resolveGatewayUrl, useWebSDK, useWebSDKConfig };
+//# sourceMappingURL=chunk-5JRJ57CL.mjs.map
+//# sourceMappingURL=chunk-5JRJ57CL.mjs.map

package/dist/chunk-5JRJ57CL.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/client/security.ts","../src/client/graphql-client.ts","../src/client/gateway-resolver.ts","../src/client/provider.tsx"],"names":[],"mappings":";;;;;AAAA,IAAM,iCAAiB,IAAI,GAAA,CAAI,CAAC,WAAA,EAAa,WAAA,EAAa,KAAK,CAAC,CAAA;AAChE,IAAM,gBAAA,uBAAuB,GAAA,CAAI;AAAA,EAC/B,eAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,cAAA;AAAA,EACA,sBAAA;AAAA,EACA,iBAAA;AAAA,EACA,sBAAA;AAAA,EACA;AACF,CAAC,CAAA;AAEM,SAAS,mBAAmB,KAAA,EAAuB;AACxD,EAAA,IAAI,GAAA;AAEJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,KAAK,CAAA;AAAA,EACrB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAAA,EAC5D;AAEA,EAAA,IAAI,GAAA,CAAI,aAAa,QAAA,EAAU;AAC7B,IAAA,OAAO,IAAI,QAAA,EAAS;AAAA,EACtB;AAEA,EAAA,IACE,GAAA,CAAI,aAAa,OAAA,IACjB,cAAA,CAAe,IAAI,GAAA,CAAI,QAAA,CAAS,WAAA,EAAa,CAAA,EAC7C;AACA,IAAA,OAAO,IAAI,QAAA,EAAS;AAAA,EACtB;AAEA,EAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAC1E;AAEO,SAAS,gBACd,OAAA,EACoC;AACpC,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AAErB,EAAA,OAAO,MAAA,CAAO,WAAA;AAAA,IACZ,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,CAAE,MAAA;AAAA,MACtB,CAAC,CAAC,GAAG,CAAA,KAAM,CAAC,gBAAA,CAAiB,GAAA,CAAI,GAAA,CAAI,WAAA,EAAa;AAAA;AACpD,GACF;AACF;AAQA,IAAM,qBAAA,uBAA4B,GAAA,CAAI;AAAA,EACpC,4BAAA;AAAA,EACA;AACF,CAAC,CAAA;AAQM,SAAS,eAAA,CACd,YACA,QAAA,EACwB;AACxB,EAAA,MAAM,QAAA,GAAW,QAAA,EAAU,QAAA,EAAU,IAAA,EAAK;AAC1C,EAAA,MAAM,YAAA,GAAe,QAAA,EAAU,YAAA,EAAc,IAAA,EAAK;AAClD,EAAA,IAAI,CAAC,QAAA,IAAY,CAAC,YAAA,SAAqB,EAAC;AAExC,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,IAAI,GAAA,CAAI,UAAU,CAAA,CAAE,SAAS,WAAA,EAAY;AAAA,EAClD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,IAAI,CAAC,qBAAA,CAAsB,GAAA,CAAI,IAAI,CAAA,SAAU,EAAC;AAE9C,EAAA,OAAO;AAAA,IACL,qBAAA,EAAuB,QAAA;AAAA,IACvB,yBAAA,EAA2B;AAAA,GAC7B;AACF;;;ACMO,IAAM,aAAA,GAAN,MAAM,aAAA,CAAa;AAAA,EAaxB,YAAY,MAAA,EAA4B;AAZxC,IAAA,aAAA,CAAA,IAAA,EAAQ,QAAA,CAAA;AACR,IAAA,aAAA,CAAA,IAAA,EAAQ,YAAA,sBAAiB,GAAA,EAGvB,CAAA;AACF,IAAA,aAAA,CAAA,IAAA,EAAQ,UAAA,sBAAe,GAAA,EAA+C,CAAA;AAQpE,IAAA,IAAA,CAAK,MAAA,GAAS;AAAA,MACZ,GAAG,MAAA;AAAA,MACH,UAAA,EAAY,kBAAA,CAAmB,MAAA,CAAO,UAAU,CAAA;AAAA,MAChD,OAAA,EAAS,eAAA,CAAgB,MAAA,CAAO,OAAO;AAAA,KACzC;AAAA,EACF;AAAA,EAEA,SAAA,GAAgC;AAC9B,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAA,CACJ,KAAA,EACA,SAAA,EACA,OAAA,EAC6B;AAK7B,IAAA,IAAI,OAAA,EAAS,UAAU,KAAA,EAAO;AAC5B,MAAA,OAAO,KAAK,OAAA,CAAW,KAAA,EAAO,SAAA,EAAW,IAAA,EAAM,QAAQ,SAAS,CAAA;AAAA,IAClE;AAEA,IAAA,MAAM,WAAW,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,WAAW,CAAA;AAGpD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,QAAQ,CAAA;AAC3C,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,IAAI,KAAK,GAAA,EAAI,GAAI,MAAA,CAAO,EAAA,GAAK,cAAa,SAAA,EAAW;AACnD,QAAA,OAAO,MAAA,CAAO,IAAA;AAAA,MAChB;AACA,MAAA,IAAA,CAAK,UAAA,CAAW,OAAO,QAAQ,CAAA;AAAA,IACjC;AAGA,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,QAAQ,CAAA;AAC3C,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,OAAO,QAAA;AAAA,IACT;AAEA,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,CAAW,KAAA,EAAO,SAAA,EAAW,IAAA,EAAM,OAAA,EAAS,SAAS,CAAA,CACvE,IAAA,CAAK,CAAC,MAAA,KAAW;AAEhB,MAAA,IAAI,MAAA,CAAO,IAAA,IAAQ,CAAC,MAAA,CAAO,QAAQ,MAAA,EAAQ;AACzC,QAAA,IAAI,IAAA,CAAK,UAAA,CAAW,IAAA,IAAQ,aAAA,CAAa,iBAAA,EAAmB;AAC1D,UAAA,MAAM,cAAc,IAAA,CAAK,UAAA,CAAW,IAAA,EAAK,CAAE,MAAK,CAAE,KAAA;AAClD,UAAA,IAAI,WAAA,EAAa;AACf,YAAA,IAAA,CAAK,UAAA,CAAW,OAAO,WAAW,CAAA;AAAA,UACpC;AAAA,QACF;AACA,QAAA,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,QAAA,EAAU,EAAE,IAAA,EAAM,QAAQ,EAAA,EAAI,IAAA,CAAK,GAAA,EAAI,EAAG,CAAA;AAAA,MAChE;AACA,MAAA,OAAO,MAAA;AAAA,IACT,CAAC,CAAA,CACA,OAAA,CAAQ,MAAM;AACb,MAAA,IAAA,CAAK,QAAA,CAAS,OAAO,QAAQ,CAAA;AAAA,IAC/B,CAAC,CAAA;AAEH,IAAA,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,QAAA,EAAU,OAAO,CAAA;AACnC,IAAA,OAAO,OAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,MAAA,CACJ,QAAA,EACA,SAAA,EACA,OAAA,EAC6B;AAG7B,IAAA,OAAO,KAAK,OAAA,CAAW,QAAA,EAAU,SAAA,EAAW,KAAA,EAAO,SAAS,SAAS,CAAA;AAAA,EACvE;AAAA;AAAA,EAGA,OAAe,kBAAkB,MAAA,EAAyB;AACxD,IAAA,OAAO,WAAW,GAAA,IAAO,MAAA,KAAW,GAAA,IAAQ,MAAA,IAAU,OAAO,MAAA,GAAS,GAAA;AAAA,EACxE;AAAA,EAEA,OAAe,MAAM,EAAA,EAA2B;AAC9C,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,EAAE,CAAC,CAAA;AAAA,EACzD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,OAAA,CACZ,KAAA,EACA,SAAA,EACA,SAAA,EAC0D;AAC1D,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,SAAS,CAAA;AAC5D,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,IAAA,CAAK,OAAO,UAAA,EAAY;AAAA,QACnD,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,kBAAA;AAAA,UAChB,cAAA,EAAgB,KAAK,MAAA,CAAO,SAAA;AAAA,UAC5B,GAAG,KAAK,MAAA,CAAO,OAAA;AAAA,UACf,GAAG,eAAA,CAAgB,IAAA,CAAK,OAAO,UAAA,EAAY,IAAA,CAAK,OAAO,QAAQ;AAAA,SACjE;AAAA,QACA,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,WAAW,CAAA;AAAA,QACzC,QAAQ,UAAA,CAAW;AAAA,OACpB,CAAA;AAED,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,OAAA,CAAQ,KAAA;AAAA,UACN,iCAAA;AAAA,UACA,QAAA,CAAS,MAAA;AAAA,UACT,QAAA,CAAS;AAAA,SACX;AACA,QAAA,OAAO;AAAA,UACL,GAAA,EAAK;AAAA,YACH,MAAA,EAAQ;AAAA,cACN;AAAA,gBACE,SAAS,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,EAAA,EAAK,SAAS,UAAU,CAAA,CAAA;AAAA,gBACxD,YAAY,EAAE,IAAA,EAAM,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,CAAA;AAAG;AAChD;AACF,WACF;AAAA,UACA,SAAA,EAAW,aAAA,CAAa,iBAAA,CAAkB,QAAA,CAAS,MAAM;AAAA,SAC3D;AAAA,MACF;AAEA,MAAA,OAAO;AAAA,QACL,GAAA,EAAM,MAAM,QAAA,CAAS,IAAA,EAAK;AAAA,QAC1B,SAAA,EAAW;AAAA,OACb;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,UACJ,KAAA,YAAiB,KAAA,KAChB,MAAM,IAAA,KAAS,YAAA,IAAgB,WAAW,MAAA,CAAO,OAAA,CAAA;AACpD,MAAA,MAAM,OAAA,GAAU,UACZ,CAAA,wBAAA,EAA2B,SAAS,OACpC,KAAA,YAAiB,KAAA,GACf,MAAM,OAAA,GACN,eAAA;AACN,MAAA,OAAA,CAAQ,KAAA,CAAM,0BAA0B,OAAO,CAAA;AAC/C,MAAA,OAAO;AAAA,QACL,GAAA,EAAK;AAAA,UACH,MAAA,EAAQ;AAAA,YACN;AAAA,cACE,OAAA;AAAA,cACA,UAAA,EAAY,EAAE,IAAA,EAAM,OAAA,GAAU,YAAY,eAAA;AAAgB;AAC5D;AACF,SACF;AAAA;AAAA;AAAA,QAGA,SAAA,EAAW;AAAA,OACb;AAAA,IACF,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAAA,EACF;AAAA,EAEA,MAAc,OAAA,CACZ,KAAA,EACA,SAAA,EACA,KAAA,GAAQ,MACR,iBAAA,EAC6B;AAC7B,IAAA,MAAM,SAAA,GACJ,iBAAA,IACA,IAAA,CAAK,MAAA,CAAO,aACZ,aAAA,CAAa,kBAAA;AACf,IAAA,MAAM,aAAa,KAAA,GACd,IAAA,CAAK,MAAA,CAAO,UAAA,IAAc,cAAa,mBAAA,GACxC,CAAA;AAEJ,IAAA,IAAI,IAAA;AACJ,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,IAAK,UAAA,EAAY,CAAA,EAAA,EAAK;AACpC,MAAA,MAAM,EAAE,GAAA,EAAK,SAAA,EAAU,GAAI,MAAM,IAAA,CAAK,OAAA;AAAA,QACpC,KAAA;AAAA,QACA,SAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,IAAI,CAAC,SAAA,IAAa,CAAA,KAAM,UAAA,EAAY,OAAO,GAAA;AAC3C,MAAA,IAAA,GAAO,GAAA;AAEP,MAAA,MAAM,aAAA,CAAa,KAAA;AAAA,QACjB,cAAa,mBAAA,IAAuB,CAAA,GAAI,CAAA,CAAA,GAAK,IAAA,CAAK,QAAO,GAAI;AAAA,OAC/D;AAAA,IACF;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AACF,CAAA;AA5ME,aAAA,CAPW,aAAA,EAOI,WAAA,EAAY,CAAA,GAAI,EAAA,GAAK,GAAA,CAAA;AAAA;AACpC,aAAA,CARW,eAQI,mBAAA,EAAoB,GAAA,CAAA;AACnC,aAAA,CATW,eASI,oBAAA,EAAqB,IAAA,CAAA;AACpC,aAAA,CAVW,eAUI,qBAAA,EAAsB,CAAA,CAAA;AACrC,aAAA,CAXW,eAWI,qBAAA,EAAsB,GAAA,CAAA;AAXhC,IAAM,YAAA,GAAN;;;AC3EP,IAAM,YAAA,GAAe,8CAAA;AACrB,IAAM,aAAA,GAAgB,mDAAA;AAOtB,SAAS,gBAAA,GAA2B;AAClC,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACjC,IAAA,OAAO,CAAA,EAAG,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,eAAA,CAAA;AAAA,EAClC;AACA,EAAA,OAAO,sCAAA;AACT;AAMA,IAAM,eAAA,GAAkB;AAAA,EACtB,eAAA;AAAA,EACA,eAAA;AAAA,EACA,kBAAA;AAAA,EACA,gBAAA;AAAA,EACA,cAAA;AAAA,EACA,WAAA;AAAA;AAAA,EACA,gBAAA;AAAA,EACA,oBAAA;AAAA,EACA,uBAAA;AAAA,EACA,gBAAA;AAAA,EACA,aAAA;AAAA,EACA,mBAAA;AAAA,EACA,iBAAA;AAAA,EACA,gBAAA;AAAA,EACA,uBAAA;AAAA,EACA,eAAA;AAAA,EACA,kBAAA;AAAA,EACA,gBAAA;AAAA,EACA,iBAAA;AAAA,EACA,qBAAA;AAAA,EACA,mBAAA;AAAA,EACA,kBAAA;AAAA,EACA,qBAAA;AAAA,EACA,kBAAA;AAAA,EACA,kBAAA;AAAA,EACA,eAAA;AAAA,EACA,gBAAA;AAAA,EACA,oBAAA;AAAA,EACA,mBAAA;AAAA,EACA,wBAAA;AAAA,EACA,mBAAA;AAAA,EACA,qBAAA;AAAA,EACA,kBAAA;AAAA,EACA,eAAA;AAAA,EACA;AACF,CAAA;AAEA,SAAS,iBAAiB,QAAA,EAA2B;AACnD,EAAA,OAAO,eAAA,CAAgB,IAAA;AAAA,IACrB,CAAC,CAAA,KAAM,QAAA,KAAa,CAAA,IAAK,QAAA,KAAa,OAAO,CAAC,CAAA,CAAA,IAAM,QAAA,KAAa,CAAA,IAAA,EAAO,CAAC,CAAA;AAAA,GAC3E;AACF;AAEA,SAAS,YAAY,QAAA,EAA2B;AAC9C,EAAA,OAAO,eAAA,CAAgB,IAAA;AAAA,IACrB,CAAC,CAAA,KACC,QAAA,KAAa,CAAA,MAAA,EAAS,CAAC,CAAA,CAAA,IACvB,QAAA,KAAa,CAAA,SAAA,EAAY,CAAC,CAAA,CAAA,IAC1B,QAAA,KAAa,CAAA,QAAA,EAAW,CAAC,CAAA;AAAA,GAC7B;AACF;AAUO,SAAS,kBAAkB,WAAA,EAA8B;AAO9D,EAAA,IACE,eACA,aAAA,CAAc,WAAW,KACzB,CAAC,cAAA,CAAe,WAAW,CAAA,EAC3B;AACA,IAAA,OAAO,WAAA;AAAA,EACT;AAEA,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AAGjC,IAAA,OAAO,WAAA,IAAe,aAAA,CAAc,WAAW,CAAA,GAC3C,cACA,gBAAA,EAAiB;AAAA,EACvB;AAEA,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,QAAA,CAAS,QAAA,CAAS,WAAA,EAAY;AAEtD,EAAA,IAAI,gBAAA,CAAiB,QAAQ,CAAA,EAAG,OAAO,YAAA;AACvC,EAAA,IAAI,WAAA,CAAY,QAAQ,CAAA,EAAG,OAAO,aAAA;AAIlC,EAAA,OAAO,gBAAA,EAAiB;AAC1B;AAEA,SAAS,cAAc,GAAA,EAAsB;AAC3C,EAAA,IAAI;AACF,IAAA,IAAI,IAAI,GAAG,CAAA;AACX,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,SAAS,eAAe,GAAA,EAAsB;AAC5C,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAG,CAAA;AAC1B,IAAA,MAAM,IAAI,MAAA,CAAO,QAAA;AACjB,IAAA,OAAO,CAAA,KAAM,WAAA,IAAe,CAAA,KAAM,WAAA,IAAe,CAAA,KAAM,KAAA;AAAA,EACzD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;ACrIA,IAAM,aAAA,GAAgB,cAAmC,IAAI,CAAA;AAuBtD,SAAS,cAAA,CAAe,EAAE,MAAA,EAAQ,QAAA,EAAS,EAAwB;AACxE,EAAA,MAAM,MAAA,GAAS,QAAQ,MAAM;AAC3B,IAAA,MAAM,cAAA,GAAiB;AAAA,MACrB,GAAG,MAAA;AAAA,MACH,UAAA,EAAY,iBAAA,CAAkB,MAAA,CAAO,UAAU;AAAA,KACjD;AACA,IAAA,OAAO,IAAI,aAAa,cAAc,CAAA;AAAA,EACxC,CAAA,EAAG,CAAC,MAAM,CAAC,CAAA;AAEX,EAAA,2BACG,aAAA,CAAc,QAAA,EAAd,EAAuB,KAAA,EAAO,QAAS,QAAA,EAAS,CAAA;AAErD;AAMO,SAAS,SAAA,GAA0B;AACxC,EAAA,MAAM,MAAA,GAAS,WAAW,aAAa,CAAA;AACvC,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAM,IAAI,MAAM,gDAAgD,CAAA;AAAA,EAClE;AACA,EAAA,OAAO,MAAA;AACT;AAMO,SAAS,eAAA,GAAsC;AACpD,EAAA,MAAM,SAAS,SAAA,EAAU;AACzB,EAAA,OAAO,OAAO,SAAA,EAAU;AAC1B","file":"chunk-5JRJ57CL.mjs","sourcesContent":["const LOOPBACK_HOSTS = new Set([\"localhost\", \"127.0.0.1\", \"::1\"]);\nconst RESERVED_HEADERS = new Set([\n  \"authorization\",\n  \"cookie\",\n  \"x-actor-id\",\n  \"x-actor-type\",\n  \"x-consent-granted-by\",\n  \"x-consent-scope\",\n  \"x-consent-granted-at\",\n  \"x-consent-expires-at\",\n]);\n\nexport function validateGatewayUrl(value: string): string {\n  let url: URL;\n\n  try {\n    url = new URL(value);\n  } catch {\n    throw new Error(\"Gateway URL must be a valid absolute URL\");\n  }\n\n  if (url.protocol === \"https:\") {\n    return url.toString();\n  }\n\n  if (\n    url.protocol === \"http:\" &&\n    LOOPBACK_HOSTS.has(url.hostname.toLowerCase())\n  ) {\n    return url.toString();\n  }\n\n  throw new Error(\"Gateway URL must use HTTPS unless it targets localhost\");\n}\n\nexport function sanitizeHeaders(\n  headers?: Record<string, string>,\n): Record<string, string> | undefined {\n  if (!headers) return undefined;\n\n  return Object.fromEntries(\n    Object.entries(headers).filter(\n      ([key]) => !RESERVED_HEADERS.has(key.toLowerCase()),\n    ),\n  );\n}\n\n/**\n * Hostnames whose Cloudflare Access application gates the GraphQL gateway.\n *\n * Only the alpha gateways are gated; the production gateways are public, so a token is never\n * attached there even if one is configured.\n */\nconst CF_ACCESS_GATED_HOSTS = new Set([\n  \"alphagraphql.burdenoff.com\",\n  \"alphagraphqlworkspaces.burdenoff.com\",\n]);\n\n/**\n * Service-token headers for a gated gateway, or nothing.\n *\n * Returns an empty object unless the target really is a gated host AND both halves of the token\n * are present — a half-configured token would send a malformed credential to every request.\n */\nexport function cfAccessHeaders(\n  gatewayUrl: string,\n  cfAccess?: { clientId?: string; clientSecret?: string },\n): Record<string, string> {\n  const clientId = cfAccess?.clientId?.trim();\n  const clientSecret = cfAccess?.clientSecret?.trim();\n  if (!clientId || !clientSecret) return {};\n\n  let host: string;\n  try {\n    host = new URL(gatewayUrl).hostname.toLowerCase();\n  } catch {\n    return {};\n  }\n  if (!CF_ACCESS_GATED_HOSTS.has(host)) return {};\n\n  return {\n    \"CF-Access-Client-Id\": clientId,\n    \"CF-Access-Client-Secret\": clientSecret,\n  };\n}\n","/**\n * Lightweight GraphQL client for the Burdenoff Web SDK.\n * Uses native fetch - zero external dependencies.\n * All calls are unauthenticated (public gateway operations only).\n */\n\nimport {\n  cfAccessHeaders,\n  sanitizeHeaders,\n  validateGatewayUrl,\n} from \"./security\";\n\nexport interface WebSDKClientConfig {\n  /** Global public gateway URL (e.g. \"https://api.burdenoff.com/global/graphql\") */\n  gatewayUrl: string;\n  /** Platform product ID for scoping operations */\n  productId: string;\n  /** Product slug (used for public product queries) */\n  productSlug?: string;\n  /** reCAPTCHA site key (if not fetched from product config) */\n  recaptchaSiteKey?: string;\n  /** Rybbit analytics site ID */\n  rybbitSiteId?: string;\n  /** Custom headers to include in all requests */\n  headers?: Record<string, string>;\n  /**\n   * Cloudflare Access service token, for the ALPHA gateway hosts only.\n   *\n   * `alphagraphql.burdenoff.com` sits behind a Cloudflare Access application, so an\n   * unauthenticated browser XHR is answered with a 302 to the Access login on a different\n   * origin — which the browser reports as an opaque CORS failure rather than a 401. Attaching\n   * the service-token headers is how every app shell already passes that gate (fe-libs\n   * `installGatewayFetchRewrite`); the website SDK previously had no equivalent, so contact,\n   * newsletter, waitlist and explore all failed on alpha.\n   *\n   * Vite only inlines `VITE_*` into APP source, never into a bundled library, so the host app\n   * must read `import.meta.env` and pass the values in. Production gateways are not gated and\n   * receive no headers.\n   */\n  cfAccess?: { clientId?: string; clientSecret?: string };\n  /**\n   * Per-request timeout in ms. Kept below the gateway's operation timeout so a\n   * stalled request surfaces as an error the UI can render, instead of leaving\n   * a page stuck on loading skeletons forever. Default 12000.\n   */\n  timeoutMs?: number;\n  /**\n   * Extra attempts for transient failures (timeout / network / 5xx / 429) on\n   * QUERIES ONLY. Mutations are never retried — a retried contact-form or\n   * waitlist submit would double-submit. Default 1 (2 attempts total).\n   */\n  maxRetries?: number;\n}\n\n/**\n * Per-call overrides for {@link WebSDKClient.query}.\n *\n * The defaults (5-minute response cache + in-flight deduplication) are right\n * for the read-once content queries most SDK components make, and wrong for a\n * poll loop: the second poll of the same `(query, variables)` pair would be\n * served straight from the cache and the UI would freeze on the first\n * response forever. Pass `{ cache: false }` for anything polled.\n */\nexport interface WebSDKQueryOptions {\n  /**\n   * Use the response cache and in-flight deduplication. Default `true`.\n   * `false` skips the cache read, the dedupe map AND the cache write, so the\n   * call always hits the network and never poisons a later cached read.\n   */\n  cache?: boolean;\n  /** Override the client-wide request timeout for this call only. */\n  timeoutMs?: number;\n}\n\n/** Per-call overrides for {@link WebSDKClient.mutate}. */\nexport interface WebSDKMutateOptions {\n  /** Override the client-wide request timeout for this call only. */\n  timeoutMs?: number;\n}\n\nexport interface GraphQLResponse<T = Record<string, unknown>> {\n  data?: T;\n  errors?: Array<{\n    message: string;\n    locations?: Array<{ line: number; column: number }>;\n    path?: Array<string | number>;\n    extensions?: Record<string, unknown>;\n  }>;\n}\n\nexport class WebSDKClient {\n  private config: WebSDKClientConfig;\n  private queryCache = new Map<\n    string,\n    { data: GraphQLResponse<unknown>; ts: number }\n  >();\n  private inflight = new Map<string, Promise<GraphQLResponse<unknown>>>();\n  private static CACHE_TTL = 5 * 60 * 1000; // 5 minutes\n  private static MAX_CACHE_ENTRIES = 100;\n  private static DEFAULT_TIMEOUT_MS = 12_000;\n  private static DEFAULT_MAX_RETRIES = 1;\n  private static RETRY_BASE_DELAY_MS = 400;\n\n  constructor(config: WebSDKClientConfig) {\n    this.config = {\n      ...config,\n      gatewayUrl: validateGatewayUrl(config.gatewayUrl),\n      headers: sanitizeHeaders(config.headers),\n    };\n  }\n\n  getConfig(): WebSDKClientConfig {\n    return this.config;\n  }\n\n  /**\n   * Execute a GraphQL query (with deduplication and caching).\n   *\n   * Pass `{ cache: false }` to bypass the cache entirely — required for poll\n   * loops, where every tick must reach the network.\n   */\n  async query<T = Record<string, unknown>>(\n    query: string,\n    variables?: Record<string, unknown>,\n    options?: WebSDKQueryOptions,\n  ): Promise<GraphQLResponse<T>> {\n    // Uncached path: no cache read, no in-flight dedupe, no cache write.\n    // Deliberately bypasses the dedupe map too — two identical polls issued a\n    // few hundred ms apart must both hit the network, otherwise the second one\n    // resolves with the first one's (already stale) snapshot.\n    if (options?.cache === false) {\n      return this.request<T>(query, variables, true, options.timeoutMs);\n    }\n\n    const cacheKey = JSON.stringify({ query, variables });\n\n    // Return cached response if still valid, evict if expired\n    const cached = this.queryCache.get(cacheKey);\n    if (cached) {\n      if (Date.now() - cached.ts < WebSDKClient.CACHE_TTL) {\n        return cached.data as GraphQLResponse<T>;\n      }\n      this.queryCache.delete(cacheKey);\n    }\n\n    // Deduplicate: if same query is already in-flight, reuse the promise\n    const existing = this.inflight.get(cacheKey);\n    if (existing) {\n      return existing as Promise<GraphQLResponse<T>>;\n    }\n\n    const promise = this.request<T>(query, variables, true, options?.timeoutMs)\n      .then((result) => {\n        // Cache successful responses only\n        if (result.data && !result.errors?.length) {\n          if (this.queryCache.size >= WebSDKClient.MAX_CACHE_ENTRIES) {\n            const oldestEntry = this.queryCache.keys().next().value;\n            if (oldestEntry) {\n              this.queryCache.delete(oldestEntry);\n            }\n          }\n          this.queryCache.set(cacheKey, { data: result, ts: Date.now() });\n        }\n        return result;\n      })\n      .finally(() => {\n        this.inflight.delete(cacheKey);\n      });\n\n    this.inflight.set(cacheKey, promise);\n    return promise;\n  }\n\n  /**\n   * Execute a GraphQL mutation\n   */\n  async mutate<T = Record<string, unknown>>(\n    mutation: string,\n    variables?: Record<string, unknown>,\n    options?: WebSDKMutateOptions,\n  ): Promise<GraphQLResponse<T>> {\n    // retry=false: a retried mutation could double-submit (contact form,\n    // waitlist signup, order). Only the timeout applies here.\n    return this.request<T>(mutation, variables, false, options?.timeoutMs);\n  }\n\n  /** HTTP statuses worth another attempt — transient server/edge conditions. */\n  private static isRetriableStatus(status: number): boolean {\n    return status === 429 || status === 408 || (status >= 500 && status < 600);\n  }\n\n  private static sleep(ms: number): Promise<void> {\n    return new Promise((resolve) => setTimeout(resolve, ms));\n  }\n\n  /**\n   * Perform the HTTP call with a hard timeout. Every outcome resolves to a\n   * GraphQLResponse — callers never hang, so a UI's `loading` state always\n   * settles into data or a renderable error.\n   */\n  private async attempt<T>(\n    query: string,\n    variables: Record<string, unknown> | undefined,\n    timeoutMs: number,\n  ): Promise<{ res: GraphQLResponse<T>; retriable: boolean }> {\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), timeoutMs);\n    try {\n      const response = await fetch(this.config.gatewayUrl, {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\",\n          \"x-product-id\": this.config.productId,\n          ...this.config.headers,\n          ...cfAccessHeaders(this.config.gatewayUrl, this.config.cfAccess),\n        },\n        body: JSON.stringify({ query, variables }),\n        signal: controller.signal,\n      });\n\n      if (!response.ok) {\n        console.error(\n          \"[WebSDK] GraphQL request failed\",\n          response.status,\n          response.statusText,\n        );\n        return {\n          res: {\n            errors: [\n              {\n                message: `HTTP ${response.status}: ${response.statusText}`,\n                extensions: { code: `HTTP_${response.status}` },\n              },\n            ],\n          },\n          retriable: WebSDKClient.isRetriableStatus(response.status),\n        };\n      }\n\n      return {\n        res: (await response.json()) as GraphQLResponse<T>,\n        retriable: false,\n      };\n    } catch (error) {\n      const aborted =\n        error instanceof Error &&\n        (error.name === \"AbortError\" || controller.signal.aborted);\n      const message = aborted\n        ? `Request timed out after ${timeoutMs}ms`\n        : error instanceof Error\n          ? error.message\n          : \"Network error\";\n      console.error(\"[WebSDK] Network error\", message);\n      return {\n        res: {\n          errors: [\n            {\n              message,\n              extensions: { code: aborted ? \"TIMEOUT\" : \"NETWORK_ERROR\" },\n            },\n          ],\n        },\n        // Transport-level failures are worth one more try; a genuine outage\n        // just fails twice quickly and still renders an error state.\n        retriable: true,\n      };\n    } finally {\n      clearTimeout(timer);\n    }\n  }\n\n  private async request<T>(\n    query: string,\n    variables?: Record<string, unknown>,\n    retry = true,\n    timeoutOverrideMs?: number,\n  ): Promise<GraphQLResponse<T>> {\n    const timeoutMs =\n      timeoutOverrideMs ??\n      this.config.timeoutMs ??\n      WebSDKClient.DEFAULT_TIMEOUT_MS;\n    const maxRetries = retry\n      ? (this.config.maxRetries ?? WebSDKClient.DEFAULT_MAX_RETRIES)\n      : 0;\n\n    let last: GraphQLResponse<T> | undefined;\n    for (let i = 0; i <= maxRetries; i++) {\n      const { res, retriable } = await this.attempt<T>(\n        query,\n        variables,\n        timeoutMs,\n      );\n      if (!retriable || i === maxRetries) return res;\n      last = res;\n      // Small backoff with jitter so a burst of clients doesn't retry in lockstep.\n      await WebSDKClient.sleep(\n        WebSDKClient.RETRY_BASE_DELAY_MS * (i + 1) + Math.random() * 200,\n      );\n    }\n    return last as GraphQLResponse<T>;\n  }\n}\n","/**\n * Runtime gateway URL resolution for product marketing websites.\n *\n * Mirrors the app shell pattern from @burdenoff/fe-libs/shared/config/gatewayUrls\n * but scoped to the website SDK's needs (global gateway only, no workspace gateway).\n *\n * Resolution priority:\n * 1. Explicit `gatewayUrl` passed in config — used as-is only if it is a valid\n *    absolute, non-localhost URL (relative/invalid values fall through)\n * 2. Hostname-based auto-detection:\n *    - Production domains (vibecontrols.com, bigconsole.com, ...) → prod gateway\n *    - Alpha domains (alpha.vibecontrols.com, ...) → alpha gateway\n *    - Everything else (localhost, *.local.burdenoff.com) → relative `/global/graphql`\n */\n\nconst PROD_GATEWAY = \"https://graphql.burdenoff.com/global/graphql\";\nconst ALPHA_GATEWAY = \"https://alphagraphql.burdenoff.com/global/graphql\";\n/**\n * Build the local fallback URL. In a browser context we need an absolute\n * URL (the SDK's security validator rejects relative paths), so we\n * prepend `window.location.origin`. During SSR/build (no window) we\n * return a placeholder localhost URL that the validator accepts.\n */\nfunction getLocalFallback(): string {\n  if (typeof window !== \"undefined\") {\n    return `${window.location.origin}/global/graphql`;\n  }\n  return \"http://localhost:4000/global/graphql\";\n}\n\n/**\n * All known product domains. When the website is served from any of these,\n * we can determine the environment from the subdomain pattern.\n */\nconst PRODUCT_DOMAINS = [\n  \"burdenoff.com\",\n  \"algoshred.com\",\n  \"vibecontrols.com\",\n  \"fluidgrids.com\",\n  \"botmanor.com\",\n  \"botlit.ai\", // legacy BotManor domain, still served\n  \"bigconsole.com\",\n  \"gethealthybowl.com\",\n  \"headshotmarketing.com\",\n  \"timecampus.com\",\n  \"ggnomad.com\",\n  \"movethewheels.com\",\n  \"crewfoundry.com\",\n  \"planmagnet.com\",\n  \"eventfullymanaged.com\",\n  \"kadaikodi.com\",\n  \"assethandler.com\",\n  \"technospam.com\",\n  \"semanticfed.com\",\n  \"manufacturedops.com\",\n  \"theglobalfuel.com\",\n  \"housingvista.com\",\n  \"proserviceworld.com\",\n  \"mybodyshield.com\",\n  \"artistrybase.com\",\n  \"collabkin.com\",\n  \"brainyrich.com\",\n  \"theculturepost.com\",\n  \"comradecircle.com\",\n  \"cosmicintersection.com\",\n  \"govcitizenhub.com\",\n  \"intelwatchtower.com\",\n  \"ecoimpacthub.com\",\n  \"buildmyiq.com\",\n  \"fluidgrids.ai\",\n];\n\nfunction isProductionHost(hostname: string): boolean {\n  return PRODUCT_DOMAINS.some(\n    (d) => hostname === d || hostname === `www.${d}` || hostname === `app.${d}`,\n  );\n}\n\nfunction isAlphaHost(hostname: string): boolean {\n  return PRODUCT_DOMAINS.some(\n    (d) =>\n      hostname === `alpha.${d}` ||\n      hostname === `alphaapp.${d}` ||\n      hostname === `staging.${d}`,\n  );\n}\n\n/**\n * Resolve the global gateway URL at runtime based on the current hostname.\n *\n * @param explicitUrl - URL explicitly passed in SDK config. Honored only when\n *   it is a valid absolute, non-localhost URL; relative/invalid values are\n *   ignored so hostname auto-detection can resolve the correct gateway.\n * @returns Resolved gateway URL\n */\nexport function resolveGatewayUrl(explicitUrl?: string): string {\n  // Only honor an explicit URL if it's an *absolute* URL and not a localhost\n  // dev default. Consumers commonly pass a relative fallback like\n  // `'/global/graphql'` when their build-time env var is unset; treating that\n  // as authoritative would skip hostname auto-detection and then fail the\n  // absolute-URL validator (blank page). A relative/invalid value is ignored\n  // here so detection can resolve the correct prod/alpha gateway.\n  if (\n    explicitUrl &&\n    isAbsoluteUrl(explicitUrl) &&\n    !isLocalhostUrl(explicitUrl)\n  ) {\n    return explicitUrl;\n  }\n\n  if (typeof window === \"undefined\") {\n    // SSR / build-time — can't detect hostname. Use the explicit URL only if\n    // it's absolute; otherwise the localhost fallback (validator-safe).\n    return explicitUrl && isAbsoluteUrl(explicitUrl)\n      ? explicitUrl\n      : getLocalFallback();\n  }\n\n  const hostname = window.location.hostname.toLowerCase();\n\n  if (isProductionHost(hostname)) return PROD_GATEWAY;\n  if (isAlphaHost(hostname)) return ALPHA_GATEWAY;\n\n  // Local dev, *.local.burdenoff.com, or unknown — use relative URL\n  // which the Vite proxy (dev) or nginx (containerized) will handle.\n  return getLocalFallback();\n}\n\nfunction isAbsoluteUrl(url: string): boolean {\n  try {\n    new URL(url);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nfunction isLocalhostUrl(url: string): boolean {\n  try {\n    const parsed = new URL(url);\n    const h = parsed.hostname;\n    return h === \"localhost\" || h === \"127.0.0.1\" || h === \"::1\";\n  } catch {\n    return false;\n  }\n}\n","/**\n * React context provider for the Web SDK client.\n * Wraps the application with WebSDKClient configuration.\n */\n\"use client\";\n\nimport { createContext, useContext, useMemo } from \"react\";\nimport type { ReactNode } from \"react\";\n\nimport { resolveGatewayUrl } from \"./gateway-resolver\";\nimport { WebSDKClient, type WebSDKClientConfig } from \"./graphql-client\";\n\nconst WebSDKContext = createContext<WebSDKClient | null>(null);\n\nexport interface WebSDKProviderProps {\n  /** SDK client configuration */\n  config: WebSDKClientConfig;\n  /** Child components */\n  children: ReactNode;\n}\n\n/**\n * Provider component that makes the WebSDKClient available to all child components.\n *\n * @example\n * ```tsx\n * <WebSDKProvider config={{\n *   gatewayUrl: \"https://api.burdenoff.com/global/graphql\",\n *   productId: \"your-product-id\",\n *   productSlug: \"your-product\",\n * }}>\n *   <App />\n * </WebSDKProvider>\n * ```\n */\nexport function WebSDKProvider({ config, children }: WebSDKProviderProps) {\n  const client = useMemo(() => {\n    const resolvedConfig = {\n      ...config,\n      gatewayUrl: resolveGatewayUrl(config.gatewayUrl),\n    };\n    return new WebSDKClient(resolvedConfig);\n  }, [config]);\n\n  return (\n    <WebSDKContext.Provider value={client}>{children}</WebSDKContext.Provider>\n  );\n}\n\n/**\n * Hook to access the WebSDKClient instance.\n * Must be used within a WebSDKProvider.\n */\nexport function useWebSDK(): WebSDKClient {\n  const client = useContext(WebSDKContext);\n  if (!client) {\n    throw new Error(\"useWebSDK must be used within a WebSDKProvider\");\n  }\n  return client;\n}\n\n/**\n * Hook to access the SDK configuration.\n * Useful for components that need config values like productId, recaptchaSiteKey, etc.\n */\nexport function useWebSDKConfig(): WebSDKClientConfig {\n  const client = useWebSDK();\n  return client.getConfig();\n}\n"]}

package/dist/chunk-6C2DKIC7.js

@@ -0,0 +1,4 @@
+'use strict';
+
+//# sourceMappingURL=chunk-6C2DKIC7.js.map
+//# sourceMappingURL=chunk-6C2DKIC7.js.map

package/dist/chunk-6C2DKIC7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"chunk-6C2DKIC7.js"}

package/dist/chunk-6IBFBWC5.mjs

@@ -0,0 +1,17 @@
+import { useState, useCallback } from 'react';
+
+var RECAPTCHA_WIDGET_HEIGHT = 78;
+function useDeferredRecaptcha(siteKey) {
+  const [engaged, setEngaged] = useState(false);
+  const arm = useCallback(() => setEngaged(true), []);
+  const enabled = siteKey.length > 0;
+  return {
+    armed: enabled && engaged,
+    arm,
+    formProps: enabled && !engaged ? { onFocus: arm, onPointerDown: arm } : {}
+  };
+}
+
+export { RECAPTCHA_WIDGET_HEIGHT, useDeferredRecaptcha };
+//# sourceMappingURL=chunk-6IBFBWC5.mjs.map
+//# sourceMappingURL=chunk-6IBFBWC5.mjs.map

package/dist/chunk-6IBFBWC5.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/hooks/use-deferred-recaptcha.ts"],"names":[],"mappings":";;AAMO,IAAM,uBAAA,GAA0B;AAuBhC,SAAS,qBAAqB,OAAA,EAAoC;AACvE,EAAA,MAAM,CAAC,OAAA,EAAS,UAAU,CAAA,GAAI,SAAS,KAAK,CAAA;AAC5C,EAAA,MAAM,MAAM,WAAA,CAAY,MAAM,WAAW,IAAI,CAAA,EAAG,EAAE,CAAA;AAClD,EAAA,MAAM,OAAA,GAAU,QAAQ,MAAA,GAAS,CAAA;AACjC,EAAA,OAAO;AAAA,IACL,OAAO,OAAA,IAAW,OAAA;AAAA,IAClB,GAAA;AAAA,IACA,SAAA,EAAW,OAAA,IAAW,CAAC,OAAA,GAAU,EAAE,SAAS,GAAA,EAAK,aAAA,EAAe,GAAA,EAAI,GAAI;AAAC,GAC3E;AACF","file":"chunk-6IBFBWC5.mjs","sourcesContent":["import { useCallback, useState } from \"react\";\n\n/**\n * reCAPTCHA v2 widget height (normal size). Reserved before the widget mounts so\n * arming it does not shift the layout under the visitor's pointer.\n */\nexport const RECAPTCHA_WIDGET_HEIGHT = 78;\n\nexport interface DeferredRecaptcha {\n  /** True once the visitor has engaged with the form AND a site key is configured. */\n  armed: boolean;\n  /** Mount the widget now (e.g. a submit that arrived before any focus). */\n  arm: () => void;\n  /** Spread onto the guarded <form>: the first focus or pointer press arms the widget. */\n  formProps: { onFocus?: () => void; onPointerDown?: () => void };\n}\n\n/**\n * Mount Google reCAPTCHA only once the visitor engages with the form it guards.\n *\n * Mounting it eagerly loaded google.com/recaptcha on every page that carries a\n * newsletter or contact form — the site footer, so every page. That shipped\n * third-party JS nobody had asked for, logged Google's own CSP report-only\n * violations into the page console (Lighthouse best-practices\n * `errors-in-console` / `inspector-issues`), and let the injected <script> and\n * origin-trial <meta> leak into build-time prerendered snapshots ahead of\n * <meta charset>. The token check at submit is unchanged: an unarmed form has\n * no token, so a submit still asks the visitor to complete the challenge.\n */\nexport function useDeferredRecaptcha(siteKey: string): DeferredRecaptcha {\n  const [engaged, setEngaged] = useState(false);\n  const arm = useCallback(() => setEngaged(true), []);\n  const enabled = siteKey.length > 0;\n  return {\n    armed: enabled && engaged,\n    arm,\n    formProps: enabled && !engaged ? { onFocus: arm, onPointerDown: arm } : {},\n  };\n}\n"]}

package/dist/chunk-6KY2ZRVI.js

@@ -0,0 +1,116 @@
+'use strict';
+
+// src/comparison/index.ts
+var DEFAULT_COMPARISON_MAX_AGE_DAYS = 180;
+var DAY_MS = 24 * 60 * 60 * 1e3;
+var ISO_DATE = /^\d{4}-\d{2}-\d{2}$/;
+function parseVerifiedAt(value) {
+  if (typeof value !== "string" || !ISO_DATE.test(value)) return null;
+  const date = /* @__PURE__ */ new Date(`${value}T00:00:00.000Z`);
+  if (Number.isNaN(date.getTime())) return null;
+  return date.toISOString().slice(0, 10) === value ? date : null;
+}
+function isHttpUrl(value) {
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" || url.protocol === "http:";
+  } catch {
+    return false;
+  }
+}
+function checkComparisonFreshness(claims, options = {}) {
+  const maxAgeDays = options.maxAgeDays ?? DEFAULT_COMPARISON_MAX_AGE_DAYS;
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  const issues = [];
+  for (const claim of claims) {
+    const sources = claim.sources ?? [];
+    if (sources.length === 0) {
+      issues.push({
+        path: claim.path,
+        problem: "missing-source",
+        detail: "no source: add { url, verifiedAt } for the vendor page this claim was checked against"
+      });
+      continue;
+    }
+    let newest = null;
+    for (const source of sources) {
+      if (!isHttpUrl(source.url)) {
+        issues.push({
+          path: claim.path,
+          problem: "invalid-url",
+          detail: `source URL is not an http(s) URL: ${JSON.stringify(source.url)}`
+        });
+      }
+      const verified = parseVerifiedAt(source.verifiedAt);
+      if (!verified) {
+        issues.push({
+          path: claim.path,
+          problem: "invalid-date",
+          detail: `verifiedAt must be YYYY-MM-DD, got ${JSON.stringify(source.verifiedAt)}`
+        });
+        continue;
+      }
+      if (verified.getTime() > now.getTime() + DAY_MS) {
+        issues.push({
+          path: claim.path,
+          problem: "future-date",
+          detail: `verifiedAt ${source.verifiedAt} is in the future`
+        });
+        continue;
+      }
+      if (!newest || verified.getTime() > newest.getTime()) newest = verified;
+    }
+    if (newest) {
+      const ageDays = Math.floor((now.getTime() - newest.getTime()) / DAY_MS);
+      if (ageDays > maxAgeDays) {
+        issues.push({
+          path: claim.path,
+          problem: "stale",
+          detail: `last verified ${newest.toISOString().slice(0, 10)} (${ageDays} days ago, limit ${maxAgeDays}): re-read the vendor page and update verifiedAt or the claim`
+        });
+      }
+    }
+  }
+  return issues;
+}
+function latestVerification(claims) {
+  let latest = null;
+  for (const claim of claims) {
+    for (const source of claim.sources ?? []) {
+      if (parseVerifiedAt(source.verifiedAt) && (!latest || source.verifiedAt > latest)) {
+        latest = source.verifiedAt;
+      }
+    }
+  }
+  return latest;
+}
+function oldestVerification(claims) {
+  let oldest = null;
+  for (const claim of claims) {
+    for (const source of claim.sources ?? []) {
+      if (parseVerifiedAt(source.verifiedAt) && (!oldest || source.verifiedAt < oldest)) {
+        oldest = source.verifiedAt;
+      }
+    }
+  }
+  return oldest;
+}
+function formatFreshnessReport(issues) {
+  if (issues.length === 0)
+    return "Comparison sources: all claims sourced and fresh.";
+  const lines = issues.map((i) => `  - [${i.problem}] ${i.path}: ${i.detail}`);
+  return [
+    `Comparison sources: ${issues.length} problem(s) found.`,
+    ...lines,
+    "Re-check each claim against the vendor's current page, then update the claim and its verifiedAt."
+  ].join("\n");
+}
+
+exports.DEFAULT_COMPARISON_MAX_AGE_DAYS = DEFAULT_COMPARISON_MAX_AGE_DAYS;
+exports.checkComparisonFreshness = checkComparisonFreshness;
+exports.formatFreshnessReport = formatFreshnessReport;
+exports.latestVerification = latestVerification;
+exports.oldestVerification = oldestVerification;
+exports.parseVerifiedAt = parseVerifiedAt;
+//# sourceMappingURL=chunk-6KY2ZRVI.js.map
+//# sourceMappingURL=chunk-6KY2ZRVI.js.map

package/dist/chunk-6KY2ZRVI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/comparison/index.ts"],"names":[],"mappings":";;;AA2EO,IAAM,+BAAA,GAAkC;AAE/C,IAAM,MAAA,GAAS,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,GAAA;AAC9B,IAAM,QAAA,GAAW,qBAAA;AAGV,SAAS,gBAAgB,KAAA,EAA4B;AAC1D,EAAA,IAAI,OAAO,UAAU,QAAA,IAAY,CAAC,SAAS,IAAA,CAAK,KAAK,GAAG,OAAO,IAAA;AAC/D,EAAA,MAAM,IAAA,mBAAO,IAAI,IAAA,CAAK,CAAA,EAAG,KAAK,CAAA,cAAA,CAAgB,CAAA;AAC9C,EAAA,IAAI,OAAO,KAAA,CAAM,IAAA,CAAK,OAAA,EAAS,GAAG,OAAO,IAAA;AAEzC,EAAA,OAAO,IAAA,CAAK,aAAY,CAAE,KAAA,CAAM,GAAG,EAAE,CAAA,KAAM,QAAQ,IAAA,GAAO,IAAA;AAC5D;AAEA,SAAS,UAAU,KAAA,EAAwB;AACzC,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,KAAK,CAAA;AACzB,IAAA,OAAO,GAAA,CAAI,QAAA,KAAa,QAAA,IAAY,GAAA,CAAI,QAAA,KAAa,OAAA;AAAA,EACvD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAOO,SAAS,wBAAA,CACd,MAAA,EACA,OAAA,GAA4B,EAAC,EACX;AAClB,EAAA,MAAM,UAAA,GAAa,QAAQ,UAAA,IAAc,+BAAA;AACzC,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,oBAAO,IAAI,IAAA,EAAK;AACpC,EAAA,MAAM,SAA2B,EAAC;AAElC,EAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,IAAA,MAAM,OAAA,GAAU,KAAA,CAAM,OAAA,IAAW,EAAC;AAClC,IAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AACxB,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACV,MAAM,KAAA,CAAM,IAAA;AAAA,QACZ,OAAA,EAAS,gBAAA;AAAA,QACT,MAAA,EACE;AAAA,OACH,CAAA;AACD,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,MAAA,GAAsB,IAAA;AAC1B,IAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,MAAA,IAAI,CAAC,SAAA,CAAU,MAAA,CAAO,GAAG,CAAA,EAAG;AAC1B,QAAA,MAAA,CAAO,IAAA,CAAK;AAAA,UACV,MAAM,KAAA,CAAM,IAAA;AAAA,UACZ,OAAA,EAAS,aAAA;AAAA,UACT,QAAQ,CAAA,kCAAA,EAAqC,IAAA,CAAK,SAAA,CAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,SACxE,CAAA;AAAA,MACH;AACA,MAAA,MAAM,QAAA,GAAW,eAAA,CAAgB,MAAA,CAAO,UAAU,CAAA;AAClD,MAAA,IAAI,CAAC,QAAA,EAAU;AACb,QAAA,MAAA,CAAO,IAAA,CAAK;AAAA,UACV,MAAM,KAAA,CAAM,IAAA;AAAA,UACZ,OAAA,EAAS,cAAA;AAAA,UACT,QAAQ,CAAA,mCAAA,EAAsC,IAAA,CAAK,SAAA,CAAU,MAAA,CAAO,UAAU,CAAC,CAAA;AAAA,SAChF,CAAA;AACD,QAAA;AAAA,MACF;AACA,MAAA,IAAI,SAAS,OAAA,EAAQ,GAAI,GAAA,CAAI,OAAA,KAAY,MAAA,EAAQ;AAC/C,QAAA,MAAA,CAAO,IAAA,CAAK;AAAA,UACV,MAAM,KAAA,CAAM,IAAA;AAAA,UACZ,OAAA,EAAS,aAAA;AAAA,UACT,MAAA,EAAQ,CAAA,WAAA,EAAc,MAAA,CAAO,UAAU,CAAA,iBAAA;AAAA,SACxC,CAAA;AACD,QAAA;AAAA,MACF;AACA,MAAA,IAAI,CAAC,UAAU,QAAA,CAAS,OAAA,KAAY,MAAA,CAAO,OAAA,IAAW,MAAA,GAAS,QAAA;AAAA,IACjE;AAEA,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,MAAM,OAAA,GAAU,KAAK,KAAA,CAAA,CAAO,GAAA,CAAI,SAAQ,GAAI,MAAA,CAAO,OAAA,EAAQ,IAAK,MAAM,CAAA;AACtE,MAAA,IAAI,UAAU,UAAA,EAAY;AACxB,QAAA,MAAA,CAAO,IAAA,CAAK;AAAA,UACV,MAAM,KAAA,CAAM,IAAA;AAAA,UACZ,OAAA,EAAS,OAAA;AAAA,UACT,MAAA,EAAQ,CAAA,cAAA,EAAiB,MAAA,CAAO,WAAA,EAAY,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA,EAAA,EAAK,OAAO,CAAA,iBAAA,EAAoB,UAAU,CAAA,6DAAA;AAAA,SACrG,CAAA;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,MAAA;AACT;AAGO,SAAS,mBACd,MAAA,EACe;AACf,EAAA,IAAI,MAAA,GAAwB,IAAA;AAC5B,EAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,IAAA,KAAA,MAAW,MAAA,IAAU,KAAA,CAAM,OAAA,IAAW,EAAC,EAAG;AACxC,MAAA,IACE,eAAA,CAAgB,OAAO,UAAU,CAAA,KAChC,CAAC,MAAA,IAAU,MAAA,CAAO,aAAa,MAAA,CAAA,EAChC;AACA,QAAA,MAAA,GAAS,MAAA,CAAO,UAAA;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAGO,SAAS,mBACd,MAAA,EACe;AACf,EAAA,IAAI,MAAA,GAAwB,IAAA;AAC5B,EAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,IAAA,KAAA,MAAW,MAAA,IAAU,KAAA,CAAM,OAAA,IAAW,EAAC,EAAG;AACxC,MAAA,IACE,eAAA,CAAgB,OAAO,UAAU,CAAA,KAChC,CAAC,MAAA,IAAU,MAAA,CAAO,aAAa,MAAA,CAAA,EAChC;AACA,QAAA,MAAA,GAAS,MAAA,CAAO,UAAA;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAGO,SAAS,sBACd,MAAA,EACQ;AACR,EAAA,IAAI,OAAO,MAAA,KAAW,CAAA;AACpB,IAAA,OAAO,mDAAA;AACT,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,GAAA,CAAI,CAAC,MAAM,CAAA,KAAA,EAAQ,CAAA,CAAE,OAAO,CAAA,EAAA,EAAK,CAAA,CAAE,IAAI,CAAA,EAAA,EAAK,CAAA,CAAE,MAAM,CAAA,CAAE,CAAA;AAC3E,EAAA,OAAO;AAAA,IACL,CAAA,oBAAA,EAAuB,OAAO,MAAM,CAAA,kBAAA,CAAA;AAAA,IACpC,GAAG,KAAA;AAAA,IACH;AAAA,GACF,CAAE,KAAK,IAAI,CAAA;AACb","file":"chunk-6KY2ZRVI.js","sourcesContent":["/**\n * @burdenoff/website-sdk - Comparison page sources and freshness (BOFF-9971)\n *\n * Every product website with a /vs (competitor comparison) page makes claims\n * about other vendors. Those claims age fast: a vendor ships the feature we\n * said it lacked, or changes its prices. This module gives every site the same\n * contract and the same check:\n *\n * - each claim carries at least one source `{ url, verifiedAt }` (enforced by\n *   the `Sourced` type at compile time), and\n * - `checkComparisonFreshness` fails when a claim has no source, a source is\n *   not an http(s) URL, a date is malformed or in the future, or the newest\n *   verification is older than `maxAgeDays` (180 by default).\n *\n * Sites run the check in their PR Check workflow, so a stale or unsourced\n * comparison blocks the next change until someone re-reads the vendor's page.\n *\n * @example\n * ```ts\n * import { checkComparisonFreshness, formatFreshnessReport } from '@burdenoff/website-sdk/comparison'\n *\n * const issues = checkComparisonFreshness(collectClaims(COMPETITORS))\n * if (issues.length) {\n *   console.error(formatFreshnessReport(issues))\n *   process.exit(1)\n * }\n * ```\n */\n\n/** Where a comparison claim was checked, and when (ISO date, YYYY-MM-DD). */\nexport interface ComparisonSource {\n  /** The vendor page (or docs page) the claim was checked against. */\n  url: string;\n  /** The day a person last read that page and confirmed the claim. */\n  verifiedAt: string;\n  /** Optional short label shown with the link, e.g. \"Pricing\". */\n  label?: string;\n}\n\n/** A non-empty list: a sourced claim always has at least one source. */\nexport type NonEmptySources = readonly [\n  ComparisonSource,\n  ...ComparisonSource[],\n];\n\n/** Mix-in for any comparison claim (table row, profile, pricing row). */\nexport interface Sourced {\n  sources: NonEmptySources;\n}\n\n/** One claim to check, located by a human-readable path for the report. */\nexport interface ComparisonClaim {\n  /** Where the claim lives, e.g. \"zapier.featureRows[Workflow versioning]\". */\n  path: string;\n  /** Its sources; missing or empty fails the check. */\n  sources?: readonly ComparisonSource[] | null;\n}\n\nexport type FreshnessProblem =\n  \"missing-source\" | \"invalid-url\" | \"invalid-date\" | \"future-date\" | \"stale\";\n\nexport interface FreshnessIssue {\n  path: string;\n  problem: FreshnessProblem;\n  detail: string;\n}\n\nexport interface FreshnessOptions {\n  /** Oldest acceptable verification, in days. Default 180. */\n  maxAgeDays?: number;\n  /** The clock to check against. Default: now. */\n  now?: Date;\n}\n\n/** Default staleness threshold for comparison claims. */\nexport const DEFAULT_COMPARISON_MAX_AGE_DAYS = 180;\n\nconst DAY_MS = 24 * 60 * 60 * 1000;\nconst ISO_DATE = /^\\d{4}-\\d{2}-\\d{2}$/;\n\n/** Parse a strict YYYY-MM-DD date as UTC midnight, or null when invalid. */\nexport function parseVerifiedAt(value: string): Date | null {\n  if (typeof value !== \"string\" || !ISO_DATE.test(value)) return null;\n  const date = new Date(`${value}T00:00:00.000Z`);\n  if (Number.isNaN(date.getTime())) return null;\n  // Reject rollovers such as 2026-02-31 → 2026-03-03.\n  return date.toISOString().slice(0, 10) === value ? date : null;\n}\n\nfunction isHttpUrl(value: string): boolean {\n  try {\n    const url = new URL(value);\n    return url.protocol === \"https:\" || url.protocol === \"http:\";\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Check every claim and return the problems found (empty when all is well).\n * A claim passes on its newest valid source, so adding a fresh source to an\n * old claim is enough to clear a \"stale\" issue.\n */\nexport function checkComparisonFreshness(\n  claims: readonly ComparisonClaim[],\n  options: FreshnessOptions = {},\n): FreshnessIssue[] {\n  const maxAgeDays = options.maxAgeDays ?? DEFAULT_COMPARISON_MAX_AGE_DAYS;\n  const now = options.now ?? new Date();\n  const issues: FreshnessIssue[] = [];\n\n  for (const claim of claims) {\n    const sources = claim.sources ?? [];\n    if (sources.length === 0) {\n      issues.push({\n        path: claim.path,\n        problem: \"missing-source\",\n        detail:\n          \"no source: add { url, verifiedAt } for the vendor page this claim was checked against\",\n      });\n      continue;\n    }\n\n    let newest: Date | null = null;\n    for (const source of sources) {\n      if (!isHttpUrl(source.url)) {\n        issues.push({\n          path: claim.path,\n          problem: \"invalid-url\",\n          detail: `source URL is not an http(s) URL: ${JSON.stringify(source.url)}`,\n        });\n      }\n      const verified = parseVerifiedAt(source.verifiedAt);\n      if (!verified) {\n        issues.push({\n          path: claim.path,\n          problem: \"invalid-date\",\n          detail: `verifiedAt must be YYYY-MM-DD, got ${JSON.stringify(source.verifiedAt)}`,\n        });\n        continue;\n      }\n      if (verified.getTime() > now.getTime() + DAY_MS) {\n        issues.push({\n          path: claim.path,\n          problem: \"future-date\",\n          detail: `verifiedAt ${source.verifiedAt} is in the future`,\n        });\n        continue;\n      }\n      if (!newest || verified.getTime() > newest.getTime()) newest = verified;\n    }\n\n    if (newest) {\n      const ageDays = Math.floor((now.getTime() - newest.getTime()) / DAY_MS);\n      if (ageDays > maxAgeDays) {\n        issues.push({\n          path: claim.path,\n          problem: \"stale\",\n          detail: `last verified ${newest.toISOString().slice(0, 10)} (${ageDays} days ago, limit ${maxAgeDays}): re-read the vendor page and update verifiedAt or the claim`,\n        });\n      }\n    }\n  }\n\n  return issues;\n}\n\n/** Newest valid verification date across all claims, or null. */\nexport function latestVerification(\n  claims: readonly ComparisonClaim[],\n): string | null {\n  let latest: string | null = null;\n  for (const claim of claims) {\n    for (const source of claim.sources ?? []) {\n      if (\n        parseVerifiedAt(source.verifiedAt) &&\n        (!latest || source.verifiedAt > latest)\n      ) {\n        latest = source.verifiedAt;\n      }\n    }\n  }\n  return latest;\n}\n\n/** Oldest valid verification date across all claims, or null. */\nexport function oldestVerification(\n  claims: readonly ComparisonClaim[],\n): string | null {\n  let oldest: string | null = null;\n  for (const claim of claims) {\n    for (const source of claim.sources ?? []) {\n      if (\n        parseVerifiedAt(source.verifiedAt) &&\n        (!oldest || source.verifiedAt < oldest)\n      ) {\n        oldest = source.verifiedAt;\n      }\n    }\n  }\n  return oldest;\n}\n\n/** A plain-text report for CI logs, one line per issue. */\nexport function formatFreshnessReport(\n  issues: readonly FreshnessIssue[],\n): string {\n  if (issues.length === 0)\n    return \"Comparison sources: all claims sourced and fresh.\";\n  const lines = issues.map((i) => `  - [${i.problem}] ${i.path}: ${i.detail}`);\n  return [\n    `Comparison sources: ${issues.length} problem(s) found.`,\n    ...lines,\n    \"Re-check each claim against the vendor's current page, then update the claim and its verifiedAt.\",\n  ].join(\"\\n\");\n}\n"]}