@burdenoff/website-sdk 2026.828.2 → 2026.828.4

package/dist/index.mjs

@@ -58,6 +58,26 @@ function sanitizeHeaders(headers) {
     )
   );
 }
+var CF_ACCESS_GATED_HOSTS = /* @__PURE__ */ new Set([
+  "alphagraphql.burdenoff.com",
+  "alphagraphqlworkspaces.burdenoff.com"
+]);
+function cfAccessHeaders(gatewayUrl, cfAccess) {
+  const clientId = cfAccess?.clientId?.trim();
+  const clientSecret = cfAccess?.clientSecret?.trim();
+  if (!clientId || !clientSecret) return {};
+  let host;
+  try {
+    host = new URL(gatewayUrl).hostname.toLowerCase();
+  } catch {
+    return {};
+  }
+  if (!CF_ACCESS_GATED_HOSTS.has(host)) return {};
+  return {
+    "CF-Access-Client-Id": clientId,
+    "CF-Access-Client-Secret": clientSecret
+  };
+}
 
 // src/client/graphql-client.ts
 var _WebSDKClient = class _WebSDKClient {
@@ -140,7 +160,8 @@ var _WebSDKClient = class _WebSDKClient {
         headers: {
           "Content-Type": "application/json",
           "x-product-id": this.config.productId,
-          ...this.config.headers
+          ...this.config.headers,
+          ...cfAccessHeaders(this.config.gatewayUrl, this.config.cfAccess)
         },
         body: JSON.stringify({ query, variables }),
         signal: controller.signal