@burdenoff/website-sdk 2026.828.2 → 2026.828.4

package/dist/product/index.js

@@ -42,6 +42,26 @@ function sanitizeHeaders(headers) {
     )
   );
 }
+var CF_ACCESS_GATED_HOSTS = /* @__PURE__ */ new Set([
+  "alphagraphql.burdenoff.com",
+  "alphagraphqlworkspaces.burdenoff.com"
+]);
+function cfAccessHeaders(gatewayUrl, cfAccess) {
+  const clientId = cfAccess?.clientId?.trim();
+  const clientSecret = cfAccess?.clientSecret?.trim();
+  if (!clientId || !clientSecret) return {};
+  let host;
+  try {
+    host = new URL(gatewayUrl).hostname.toLowerCase();
+  } catch {
+    return {};
+  }
+  if (!CF_ACCESS_GATED_HOSTS.has(host)) return {};
+  return {
+    "CF-Access-Client-Id": clientId,
+    "CF-Access-Client-Secret": clientSecret
+  };
+}
 
 // src/client/graphql-client.ts
 var _WebSDKClient = class _WebSDKClient {
@@ -124,7 +144,8 @@ var _WebSDKClient = class _WebSDKClient {
         headers: {
           "Content-Type": "application/json",
           "x-product-id": this.config.productId,
-          ...this.config.headers
+          ...this.config.headers,
+          ...cfAccessHeaders(this.config.gatewayUrl, this.config.cfAccess)
         },
         body: JSON.stringify({ query, variables }),
         signal: controller.signal

package/dist/product/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/client/security.ts","../../src/client/graphql-client.ts","../../src/client/provider.tsx","../../src/product/product-provider.tsx"],"names":["createContext","useContext","useState","useCallback","useLayoutEffect","useMemo","jsx"],"mappings":";;;;;;;;;;AAAA,IAAM,iCAAiB,IAAI,GAAA,CAAI,CAAC,WAAA,EAAa,WAAA,EAAa,KAAK,CAAC,CAAA;AAChE,IAAM,gBAAA,uBAAuB,GAAA,CAAI;AAAA,EAC/B,eAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,cAAA;AAAA,EACA,sBAAA;AAAA,EACA,iBAAA;AAAA,EACA,sBAAA;AAAA,EACA;AACF,CAAC,CAAA;AAEM,SAAS,mBAAmB,KAAA,EAAuB;AACxD,EAAA,IAAI,GAAA;AAEJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,KAAK,CAAA;AAAA,EACrB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAAA,EAC5D;AAEA,EAAA,IAAI,GAAA,CAAI,aAAa,QAAA,EAAU;AAC7B,IAAA,OAAO,IAAI,QAAA,EAAS;AAAA,EACtB;AAEA,EAAA,IACE,GAAA,CAAI,aAAa,OAAA,IACjB,cAAA,CAAe,IAAI,GAAA,CAAI,QAAA,CAAS,WAAA,EAAa,CAAA,EAC7C;AACA,IAAA,OAAO,IAAI,QAAA,EAAS;AAAA,EACtB;AAEA,EAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAC1E;AAEO,SAAS,gBACd,OAAA,EACoC;AACpC,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AAErB,EAAA,OAAO,MAAA,CAAO,WAAA;AAAA,IACZ,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,CAAE,MAAA;AAAA,MACtB,CAAC,CAAC,GAAG,CAAA,KAAM,CAAC,gBAAA,CAAiB,GAAA,CAAI,GAAA,CAAI,WAAA,EAAa;AAAA;AACpD,GACF;AACF;;;AC0BO,IAAM,aAAA,GAAN,MAAM,aAAA,CAAa;AAAA,EAaxB,YAAY,MAAA,EAA4B;AAZxC,IAAA,aAAA,CAAA,IAAA,EAAQ,QAAA,CAAA;AACR,IAAA,aAAA,CAAA,IAAA,EAAQ,YAAA,sBAAiB,GAAA,EAGvB,CAAA;AACF,IAAA,aAAA,CAAA,IAAA,EAAQ,UAAA,sBAAe,GAAA,EAA+C,CAAA;AAQpE,IAAA,IAAA,CAAK,MAAA,GAAS;AAAA,MACZ,GAAG,MAAA;AAAA,MACH,UAAA,EAAY,kBAAA,CAAmB,MAAA,CAAO,UAAU,CAAA;AAAA,MAChD,OAAA,EAAS,eAAA,CAAgB,MAAA,CAAO,OAAO;AAAA,KACzC;AAAA,EACF;AAAA,EAEA,SAAA,GAAgC;AAC9B,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAA,CACJ,KAAA,EACA,SAAA,EACA,OAAA,EAC6B;AAK7B,IAAA,IAAI,OAAA,EAAS,UAAU,KAAA,EAAO;AAC5B,MAAA,OAAO,KAAK,OAAA,CAAW,KAAA,EAAO,SAAA,EAAW,IAAA,EAAM,QAAQ,SAAS,CAAA;AAAA,IAClE;AAEA,IAAA,MAAM,WAAW,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,WAAW,CAAA;AAGpD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,QAAQ,CAAA;AAC3C,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,IAAI,KAAK,GAAA,EAAI,GAAI,MAAA,CAAO,EAAA,GAAK,cAAa,SAAA,EAAW;AACnD,QAAA,OAAO,MAAA,CAAO,IAAA;AAAA,MAChB;AACA,MAAA,IAAA,CAAK,UAAA,CAAW,OAAO,QAAQ,CAAA;AAAA,IACjC;AAGA,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,QAAQ,CAAA;AAC3C,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,OAAO,QAAA;AAAA,IACT;AAEA,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,CAAW,KAAA,EAAO,SAAA,EAAW,IAAA,EAAM,OAAA,EAAS,SAAS,CAAA,CACvE,IAAA,CAAK,CAAC,MAAA,KAAW;AAEhB,MAAA,IAAI,MAAA,CAAO,IAAA,IAAQ,CAAC,MAAA,CAAO,QAAQ,MAAA,EAAQ;AACzC,QAAA,IAAI,IAAA,CAAK,UAAA,CAAW,IAAA,IAAQ,aAAA,CAAa,iBAAA,EAAmB;AAC1D,UAAA,MAAM,cAAc,IAAA,CAAK,UAAA,CAAW,IAAA,EAAK,CAAE,MAAK,CAAE,KAAA;AAClD,UAAA,IAAI,WAAA,EAAa;AACf,YAAA,IAAA,CAAK,UAAA,CAAW,OAAO,WAAW,CAAA;AAAA,UACpC;AAAA,QACF;AACA,QAAA,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,QAAA,EAAU,EAAE,IAAA,EAAM,QAAQ,EAAA,EAAI,IAAA,CAAK,GAAA,EAAI,EAAG,CAAA;AAAA,MAChE;AACA,MAAA,OAAO,MAAA;AAAA,IACT,CAAC,CAAA,CACA,OAAA,CAAQ,MAAM;AACb,MAAA,IAAA,CAAK,QAAA,CAAS,OAAO,QAAQ,CAAA;AAAA,IAC/B,CAAC,CAAA;AAEH,IAAA,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,QAAA,EAAU,OAAO,CAAA;AACnC,IAAA,OAAO,OAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,MAAA,CACJ,QAAA,EACA,SAAA,EACA,OAAA,EAC6B;AAG7B,IAAA,OAAO,KAAK,OAAA,CAAW,QAAA,EAAU,SAAA,EAAW,KAAA,EAAO,SAAS,SAAS,CAAA;AAAA,EACvE;AAAA;AAAA,EAGA,OAAe,kBAAkB,MAAA,EAAyB;AACxD,IAAA,OAAO,WAAW,GAAA,IAAO,MAAA,KAAW,GAAA,IAAQ,MAAA,IAAU,OAAO,MAAA,GAAS,GAAA;AAAA,EACxE;AAAA,EAEA,OAAe,MAAM,EAAA,EAA2B;AAC9C,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,EAAE,CAAC,CAAA;AAAA,EACzD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,OAAA,CACZ,KAAA,EACA,SAAA,EACA,SAAA,EAC0D;AAC1D,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,SAAS,CAAA;AAC5D,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,IAAA,CAAK,OAAO,UAAA,EAAY;AAAA,QACnD,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,kBAAA;AAAA,UAChB,cAAA,EAAgB,KAAK,MAAA,CAAO,SAAA;AAAA,UAC5B,GAAG,KAAK,MAAA,CAAO;AAAA,SACjB;AAAA,QACA,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,WAAW,CAAA;AAAA,QACzC,QAAQ,UAAA,CAAW;AAAA,OACpB,CAAA;AAED,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,OAAA,CAAQ,KAAA;AAAA,UACN,iCAAA;AAAA,UACA,QAAA,CAAS,MAAA;AAAA,UACT,QAAA,CAAS;AAAA,SACX;AACA,QAAA,OAAO;AAAA,UACL,GAAA,EAAK;AAAA,YACH,MAAA,EAAQ;AAAA,cACN;AAAA,gBACE,SAAS,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,EAAA,EAAK,SAAS,UAAU,CAAA,CAAA;AAAA,gBACxD,YAAY,EAAE,IAAA,EAAM,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,CAAA;AAAG;AAChD;AACF,WACF;AAAA,UACA,SAAA,EAAW,aAAA,CAAa,iBAAA,CAAkB,QAAA,CAAS,MAAM;AAAA,SAC3D;AAAA,MACF;AAEA,MAAA,OAAO;AAAA,QACL,GAAA,EAAM,MAAM,QAAA,CAAS,IAAA,EAAK;AAAA,QAC1B,SAAA,EAAW;AAAA,OACb;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,UACJ,KAAA,YAAiB,KAAA,KAChB,MAAM,IAAA,KAAS,YAAA,IAAgB,WAAW,MAAA,CAAO,OAAA,CAAA;AACpD,MAAA,MAAM,OAAA,GAAU,UACZ,CAAA,wBAAA,EAA2B,SAAS,OACpC,KAAA,YAAiB,KAAA,GACf,MAAM,OAAA,GACN,eAAA;AACN,MAAA,OAAA,CAAQ,KAAA,CAAM,0BAA0B,OAAO,CAAA;AAC/C,MAAA,OAAO;AAAA,QACL,GAAA,EAAK;AAAA,UACH,MAAA,EAAQ;AAAA,YACN;AAAA,cACE,OAAA;AAAA,cACA,UAAA,EAAY,EAAE,IAAA,EAAM,OAAA,GAAU,YAAY,eAAA;AAAgB;AAC5D;AACF,SACF;AAAA;AAAA;AAAA,QAGA,SAAA,EAAW;AAAA,OACb;AAAA,IACF,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAAA,EACF;AAAA,EAEA,MAAc,OAAA,CACZ,KAAA,EACA,SAAA,EACA,KAAA,GAAQ,MACR,iBAAA,EAC6B;AAC7B,IAAA,MAAM,SAAA,GACJ,iBAAA,IACA,IAAA,CAAK,MAAA,CAAO,aACZ,aAAA,CAAa,kBAAA;AACf,IAAA,MAAM,aAAa,KAAA,GACd,IAAA,CAAK,MAAA,CAAO,UAAA,IAAc,cAAa,mBAAA,GACxC,CAAA;AAEJ,IAAA,IAAI,IAAA;AACJ,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,IAAK,UAAA,EAAY,CAAA,EAAA,EAAK;AACpC,MAAA,MAAM,EAAE,GAAA,EAAK,SAAA,EAAU,GAAI,MAAM,IAAA,CAAK,OAAA;AAAA,QACpC,KAAA;AAAA,QACA,SAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,IAAI,CAAC,SAAA,IAAa,CAAA,KAAM,UAAA,EAAY,OAAO,GAAA;AAC3C,MAAA,IAAA,GAAO,GAAA;AAEP,MAAA,MAAM,aAAA,CAAa,KAAA;AAAA,QACjB,cAAa,mBAAA,IAAuB,CAAA,GAAI,CAAA,CAAA,GAAK,IAAA,CAAK,QAAO,GAAI;AAAA,OAC/D;AAAA,IACF;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AACF,CAAA;AA3ME,aAAA,CAPW,aAAA,EAOI,WAAA,EAAY,CAAA,GAAI,EAAA,GAAK,GAAA,CAAA;AAAA;AACpC,aAAA,CARW,eAQI,mBAAA,EAAoB,GAAA,CAAA;AACnC,aAAA,CATW,eASI,oBAAA,EAAqB,IAAA,CAAA;AACpC,aAAA,CAVW,eAUI,qBAAA,EAAsB,CAAA,CAAA;AACrC,aAAA,CAXW,eAWI,qBAAA,EAAsB,GAAA,CAAA;ACtEvC,IAAM,aAAA,GAAgBA,oBAAmC,IAAI,CAAA;AAyCtD,SAAS,SAAA,GAA0B;AACxC,EAAA,MAAM,MAAA,GAASC,iBAAW,aAAa,CAAA;AACvC,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAM,IAAI,MAAM,gDAAgD,CAAA;AAAA,EAClE;AACA,EAAA,OAAO,MAAA;AACT;AAMO,SAAS,eAAA,GAAsC;AACpD,EAAA,MAAM,SAAS,SAAA,EAAU;AACzB,EAAA,OAAO,OAAO,SAAA,EAAU;AAC1B;ACOA,IAAM,mBAAA,GAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAmC5B,IAAM,oBAAA,GAAuB;AAAA;AAAA;AAAA,MAAA,EAGrB,mBAAmB;AAAA;AAAA;AAAA;AAAA,CAAA;AAY3B,IAAM,6BAAA,GAAgC;AAAA;AAAA;AAAA,MAAA,EAG9B,mBAAmB;AAAA;AAAA;AAAA,CAAA;AAiB3B,IAAM,iBAAiBD,mBAAAA,CAAmC;AAAA,EACxD,OAAA,EAAS,IAAA;AAAA,EACT,OAAA,EAAS,IAAA;AAAA,EACT,KAAA,EAAO,IAAA;AAAA,EACP,WAAA,EAAa,KAAA;AAAA,EACb,SAAS,MAAM;AAAA,EAAC;AAClB,CAAC,CAAA;AAmBM,SAAS,eAAA,CAAgB,EAAE,QAAA,EAAU,QAAA,EAAS,EAAyB;AAC5E,EAAA,MAAM,SAAS,SAAA,EAAU;AACzB,EAAA,MAAM,SAAS,eAAA,EAAgB;AAC/B,EAAA,MAAM,CAAC,OAAA,EAAS,UAAU,CAAA,GAAIE,cAAA;AAAA,IAC5B,WAAY,QAAA,GAA2B;AAAA,GACzC;AACA,EAAA,MAAM,CAAC,OAAA,EAAS,UAAU,CAAA,GAAIA,eAAS,IAAI,CAAA;AAC3C,EAAA,MAAM,CAAC,KAAA,EAAO,QAAQ,CAAA,GAAIA,eAAwB,IAAI,CAAA;AACtD,EAAA,MAAM,YAAA,GAAeC,kBAAY,YAAY;AAC3C,IAAA,IAAI,CAAC,OAAO,WAAA,EAAa;AACvB,MAAA,UAAA,CAAW,KAAK,CAAA;AAChB,MAAA;AAAA,IACF;AAEA,IAAA,UAAA,CAAW,IAAI,CAAA;AACf,IAAA,QAAA,CAAS,IAAI,CAAA;AAEb,IAAA,IAAI;AACF,MAAA,IAAI,MAAA,GAAS,MAAM,MAAA,CAAO,KAAA;AAAA,QACxB,oBAAA;AAAA,QACA,EAAE,IAAA,EAAM,MAAA,CAAO,WAAA;AAAY,OAC7B;AASA,MAAA,MAAM,0BAAA,GAA6B,OAAO,MAAA,EAAQ,IAAA;AAAA,QAAK,CAAC,CAAA,KACtD,6CAAA,CAA8C,IAAA,CAAK,CAAA,EAAG,WAAW,EAAE;AAAA,OACrE;AACA,MAAA,IAAI,0BAAA,EAA4B;AAC9B,QAAA,MAAA,GAAS,MAAM,MAAA,CAAO,KAAA;AAAA,UACpB,6BAAA;AAAA,UACA,EAAE,IAAA,EAAM,MAAA,CAAO,WAAA;AAAY,SAC7B;AAAA,MACF;AAEA,MAAA,IAAI,MAAA,CAAO,QAAQ,MAAA,EAAQ;AACzB,QAAA,QAAA,CAAS,MAAA,CAAO,MAAA,CAAO,CAAC,CAAA,EAAG,WAAW,eAAe,CAAA;AAAA,MACvD,CAAA,MAAA,IAAW,MAAA,CAAO,IAAA,EAAM,aAAA,EAAe;AACrC,QAAA,UAAA,CAAW,MAAA,CAAO,KAAK,aAAa,CAAA;AAAA,MACtC;AAAA,IACF,SAAS,GAAA,EAAK;AACZ,MAAA,QAAA,CAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,yBAAyB,CAAA;AAAA,IACzE,CAAA,SAAE;AACA,MAAA,UAAA,CAAW,KAAK,CAAA;AAAA,IAClB;AAAA,EACF,CAAA,EAAG,CAAC,MAAA,EAAQ,MAAA,CAAO,WAAW,CAAC,CAAA;AAK/B,EAAAC,qBAAA,CAAgB,MAAM;AACpB,IAAA,YAAA,EAAa;AAAA,EACf,CAAA,EAAG,CAAC,YAAY,CAAC,CAAA;AAEjB,EAAA,MAAM,KAAA,GAAQC,aAAAA;AAAA,IACZ,OAAO;AAAA,MACL,OAAA;AAAA,MACA,OAAA;AAAA,MACA,KAAA;AAAA,MACA,WAAA,EAAa,IAAA;AAAA,MACb,OAAA,EAAS;AAAA,KACX,CAAA;AAAA,IACA,CAAC,OAAA,EAAS,OAAA,EAAS,KAAA,EAAO,YAAY;AAAA,GACxC;AAEA,EAAA,uBACEC,cAAAA,CAAC,cAAA,CAAe,QAAA,EAAf,EAAwB,OAAe,QAAA,EAAS,CAAA;AAErD;AAgBO,SAAS,UAAA,GAAkC;AAChD,EAAA,OAAOL,iBAAW,cAAc,CAAA;AAClC;AAYO,SAAS,gBAAA,GAQd;AACA,EAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,UAAA,EAAW;AAC/B,EAAA,MAAM,SAAS,eAAA,EAAgB;AAE/B,EAAA,OAAO;AAAA;AAAA,IAEL,gBAAA,EACE,OAAA,EAAS,gBAAA,IAAoB,MAAA,CAAO,gBAAA,IAAoB,IAAA;AAAA,IAC1D,YAAA,EAAc,OAAA,EAAS,YAAA,IAAgB,MAAA,CAAO,YAAA,IAAgB,IAAA;AAAA,IAC9D,YAAA,EAAc,SAAS,YAAA,IAAgB,IAAA;AAAA,IACvC,YAAA,EAAc,SAAS,YAAA,IAAgB,IAAA;AAAA,IACvC,iBAAA,EACE,OAAA,EAAS,iBAAA,IAAqB,OAAA,EAAS,YAAA,IAAgB,IAAA;AAAA,IACzD,WAAA,EAAa,SAAS,IAAA,IAAQ,IAAA;AAAA,IAC9B,OAAA,EAAS,SAAS,OAAA,IAAW;AAAA,GAC/B;AACF","file":"index.js","sourcesContent":["const LOOPBACK_HOSTS = new Set([\"localhost\", \"127.0.0.1\", \"::1\"]);\nconst RESERVED_HEADERS = new Set([\n  \"authorization\",\n  \"cookie\",\n  \"x-actor-id\",\n  \"x-actor-type\",\n  \"x-consent-granted-by\",\n  \"x-consent-scope\",\n  \"x-consent-granted-at\",\n  \"x-consent-expires-at\",\n]);\n\nexport function validateGatewayUrl(value: string): string {\n  let url: URL;\n\n  try {\n    url = new URL(value);\n  } catch {\n    throw new Error(\"Gateway URL must be a valid absolute URL\");\n  }\n\n  if (url.protocol === \"https:\") {\n    return url.toString();\n  }\n\n  if (\n    url.protocol === \"http:\" &&\n    LOOPBACK_HOSTS.has(url.hostname.toLowerCase())\n  ) {\n    return url.toString();\n  }\n\n  throw new Error(\"Gateway URL must use HTTPS unless it targets localhost\");\n}\n\nexport function sanitizeHeaders(\n  headers?: Record<string, string>,\n): Record<string, string> | undefined {\n  if (!headers) return undefined;\n\n  return Object.fromEntries(\n    Object.entries(headers).filter(\n      ([key]) => !RESERVED_HEADERS.has(key.toLowerCase()),\n    ),\n  );\n}\n","/**\n * Lightweight GraphQL client for the Burdenoff Web SDK.\n * Uses native fetch - zero external dependencies.\n * All calls are unauthenticated (public gateway operations only).\n */\n\nimport { sanitizeHeaders, validateGatewayUrl } from \"./security\";\n\nexport interface WebSDKClientConfig {\n  /** Global public gateway URL (e.g. \"https://api.burdenoff.com/global/graphql\") */\n  gatewayUrl: string;\n  /** Platform product ID for scoping operations */\n  productId: string;\n  /** Product slug (used for public product queries) */\n  productSlug?: string;\n  /** reCAPTCHA site key (if not fetched from product config) */\n  recaptchaSiteKey?: string;\n  /** Rybbit analytics site ID */\n  rybbitSiteId?: string;\n  /** Custom headers to include in all requests */\n  headers?: Record<string, string>;\n  /**\n   * Per-request timeout in ms. Kept below the gateway's operation timeout so a\n   * stalled request surfaces as an error the UI can render, instead of leaving\n   * a page stuck on loading skeletons forever. Default 12000.\n   */\n  timeoutMs?: number;\n  /**\n   * Extra attempts for transient failures (timeout / network / 5xx / 429) on\n   * QUERIES ONLY. Mutations are never retried — a retried contact-form or\n   * waitlist submit would double-submit. Default 1 (2 attempts total).\n   */\n  maxRetries?: number;\n}\n\n/**\n * Per-call overrides for {@link WebSDKClient.query}.\n *\n * The defaults (5-minute response cache + in-flight deduplication) are right\n * for the read-once content queries most SDK components make, and wrong for a\n * poll loop: the second poll of the same `(query, variables)` pair would be\n * served straight from the cache and the UI would freeze on the first\n * response forever. Pass `{ cache: false }` for anything polled.\n */\nexport interface WebSDKQueryOptions {\n  /**\n   * Use the response cache and in-flight deduplication. Default `true`.\n   * `false` skips the cache read, the dedupe map AND the cache write, so the\n   * call always hits the network and never poisons a later cached read.\n   */\n  cache?: boolean;\n  /** Override the client-wide request timeout for this call only. */\n  timeoutMs?: number;\n}\n\n/** Per-call overrides for {@link WebSDKClient.mutate}. */\nexport interface WebSDKMutateOptions {\n  /** Override the client-wide request timeout for this call only. */\n  timeoutMs?: number;\n}\n\nexport interface GraphQLResponse<T = Record<string, unknown>> {\n  data?: T;\n  errors?: Array<{\n    message: string;\n    locations?: Array<{ line: number; column: number }>;\n    path?: Array<string | number>;\n    extensions?: Record<string, unknown>;\n  }>;\n}\n\nexport class WebSDKClient {\n  private config: WebSDKClientConfig;\n  private queryCache = new Map<\n    string,\n    { data: GraphQLResponse<unknown>; ts: number }\n  >();\n  private inflight = new Map<string, Promise<GraphQLResponse<unknown>>>();\n  private static CACHE_TTL = 5 * 60 * 1000; // 5 minutes\n  private static MAX_CACHE_ENTRIES = 100;\n  private static DEFAULT_TIMEOUT_MS = 12_000;\n  private static DEFAULT_MAX_RETRIES = 1;\n  private static RETRY_BASE_DELAY_MS = 400;\n\n  constructor(config: WebSDKClientConfig) {\n    this.config = {\n      ...config,\n      gatewayUrl: validateGatewayUrl(config.gatewayUrl),\n      headers: sanitizeHeaders(config.headers),\n    };\n  }\n\n  getConfig(): WebSDKClientConfig {\n    return this.config;\n  }\n\n  /**\n   * Execute a GraphQL query (with deduplication and caching).\n   *\n   * Pass `{ cache: false }` to bypass the cache entirely — required for poll\n   * loops, where every tick must reach the network.\n   */\n  async query<T = Record<string, unknown>>(\n    query: string,\n    variables?: Record<string, unknown>,\n    options?: WebSDKQueryOptions,\n  ): Promise<GraphQLResponse<T>> {\n    // Uncached path: no cache read, no in-flight dedupe, no cache write.\n    // Deliberately bypasses the dedupe map too — two identical polls issued a\n    // few hundred ms apart must both hit the network, otherwise the second one\n    // resolves with the first one's (already stale) snapshot.\n    if (options?.cache === false) {\n      return this.request<T>(query, variables, true, options.timeoutMs);\n    }\n\n    const cacheKey = JSON.stringify({ query, variables });\n\n    // Return cached response if still valid, evict if expired\n    const cached = this.queryCache.get(cacheKey);\n    if (cached) {\n      if (Date.now() - cached.ts < WebSDKClient.CACHE_TTL) {\n        return cached.data as GraphQLResponse<T>;\n      }\n      this.queryCache.delete(cacheKey);\n    }\n\n    // Deduplicate: if same query is already in-flight, reuse the promise\n    const existing = this.inflight.get(cacheKey);\n    if (existing) {\n      return existing as Promise<GraphQLResponse<T>>;\n    }\n\n    const promise = this.request<T>(query, variables, true, options?.timeoutMs)\n      .then((result) => {\n        // Cache successful responses only\n        if (result.data && !result.errors?.length) {\n          if (this.queryCache.size >= WebSDKClient.MAX_CACHE_ENTRIES) {\n            const oldestEntry = this.queryCache.keys().next().value;\n            if (oldestEntry) {\n              this.queryCache.delete(oldestEntry);\n            }\n          }\n          this.queryCache.set(cacheKey, { data: result, ts: Date.now() });\n        }\n        return result;\n      })\n      .finally(() => {\n        this.inflight.delete(cacheKey);\n      });\n\n    this.inflight.set(cacheKey, promise);\n    return promise;\n  }\n\n  /**\n   * Execute a GraphQL mutation\n   */\n  async mutate<T = Record<string, unknown>>(\n    mutation: string,\n    variables?: Record<string, unknown>,\n    options?: WebSDKMutateOptions,\n  ): Promise<GraphQLResponse<T>> {\n    // retry=false: a retried mutation could double-submit (contact form,\n    // waitlist signup, order). Only the timeout applies here.\n    return this.request<T>(mutation, variables, false, options?.timeoutMs);\n  }\n\n  /** HTTP statuses worth another attempt — transient server/edge conditions. */\n  private static isRetriableStatus(status: number): boolean {\n    return status === 429 || status === 408 || (status >= 500 && status < 600);\n  }\n\n  private static sleep(ms: number): Promise<void> {\n    return new Promise((resolve) => setTimeout(resolve, ms));\n  }\n\n  /**\n   * Perform the HTTP call with a hard timeout. Every outcome resolves to a\n   * GraphQLResponse — callers never hang, so a UI's `loading` state always\n   * settles into data or a renderable error.\n   */\n  private async attempt<T>(\n    query: string,\n    variables: Record<string, unknown> | undefined,\n    timeoutMs: number,\n  ): Promise<{ res: GraphQLResponse<T>; retriable: boolean }> {\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), timeoutMs);\n    try {\n      const response = await fetch(this.config.gatewayUrl, {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\",\n          \"x-product-id\": this.config.productId,\n          ...this.config.headers,\n        },\n        body: JSON.stringify({ query, variables }),\n        signal: controller.signal,\n      });\n\n      if (!response.ok) {\n        console.error(\n          \"[WebSDK] GraphQL request failed\",\n          response.status,\n          response.statusText,\n        );\n        return {\n          res: {\n            errors: [\n              {\n                message: `HTTP ${response.status}: ${response.statusText}`,\n                extensions: { code: `HTTP_${response.status}` },\n              },\n            ],\n          },\n          retriable: WebSDKClient.isRetriableStatus(response.status),\n        };\n      }\n\n      return {\n        res: (await response.json()) as GraphQLResponse<T>,\n        retriable: false,\n      };\n    } catch (error) {\n      const aborted =\n        error instanceof Error &&\n        (error.name === \"AbortError\" || controller.signal.aborted);\n      const message = aborted\n        ? `Request timed out after ${timeoutMs}ms`\n        : error instanceof Error\n          ? error.message\n          : \"Network error\";\n      console.error(\"[WebSDK] Network error\", message);\n      return {\n        res: {\n          errors: [\n            {\n              message,\n              extensions: { code: aborted ? \"TIMEOUT\" : \"NETWORK_ERROR\" },\n            },\n          ],\n        },\n        // Transport-level failures are worth one more try; a genuine outage\n        // just fails twice quickly and still renders an error state.\n        retriable: true,\n      };\n    } finally {\n      clearTimeout(timer);\n    }\n  }\n\n  private async request<T>(\n    query: string,\n    variables?: Record<string, unknown>,\n    retry = true,\n    timeoutOverrideMs?: number,\n  ): Promise<GraphQLResponse<T>> {\n    const timeoutMs =\n      timeoutOverrideMs ??\n      this.config.timeoutMs ??\n      WebSDKClient.DEFAULT_TIMEOUT_MS;\n    const maxRetries = retry\n      ? (this.config.maxRetries ?? WebSDKClient.DEFAULT_MAX_RETRIES)\n      : 0;\n\n    let last: GraphQLResponse<T> | undefined;\n    for (let i = 0; i <= maxRetries; i++) {\n      const { res, retriable } = await this.attempt<T>(\n        query,\n        variables,\n        timeoutMs,\n      );\n      if (!retriable || i === maxRetries) return res;\n      last = res;\n      // Small backoff with jitter so a burst of clients doesn't retry in lockstep.\n      await WebSDKClient.sleep(\n        WebSDKClient.RETRY_BASE_DELAY_MS * (i + 1) + Math.random() * 200,\n      );\n    }\n    return last as GraphQLResponse<T>;\n  }\n}\n","/**\n * React context provider for the Web SDK client.\n * Wraps the application with WebSDKClient configuration.\n */\n\"use client\";\n\nimport { createContext, useContext, useMemo } from \"react\";\nimport type { ReactNode } from \"react\";\n\nimport { resolveGatewayUrl } from \"./gateway-resolver\";\nimport { WebSDKClient, type WebSDKClientConfig } from \"./graphql-client\";\n\nconst WebSDKContext = createContext<WebSDKClient | null>(null);\n\nexport interface WebSDKProviderProps {\n  /** SDK client configuration */\n  config: WebSDKClientConfig;\n  /** Child components */\n  children: ReactNode;\n}\n\n/**\n * Provider component that makes the WebSDKClient available to all child components.\n *\n * @example\n * ```tsx\n * <WebSDKProvider config={{\n *   gatewayUrl: \"https://api.burdenoff.com/global/graphql\",\n *   productId: \"your-product-id\",\n *   productSlug: \"your-product\",\n * }}>\n *   <App />\n * </WebSDKProvider>\n * ```\n */\nexport function WebSDKProvider({ config, children }: WebSDKProviderProps) {\n  const client = useMemo(() => {\n    const resolvedConfig = {\n      ...config,\n      gatewayUrl: resolveGatewayUrl(config.gatewayUrl),\n    };\n    return new WebSDKClient(resolvedConfig);\n  }, [config]);\n\n  return (\n    <WebSDKContext.Provider value={client}>{children}</WebSDKContext.Provider>\n  );\n}\n\n/**\n * Hook to access the WebSDKClient instance.\n * Must be used within a WebSDKProvider.\n */\nexport function useWebSDK(): WebSDKClient {\n  const client = useContext(WebSDKContext);\n  if (!client) {\n    throw new Error(\"useWebSDK must be used within a WebSDKProvider\");\n  }\n  return client;\n}\n\n/**\n * Hook to access the SDK configuration.\n * Useful for components that need config values like productId, recaptchaSiteKey, etc.\n */\nexport function useWebSDKConfig(): WebSDKClientConfig {\n  const client = useWebSDK();\n  return client.getConfig();\n}\n","/**\n * Product Provider\n *\n * React context and hooks for accessing product metadata from the global tenant service.\n * Fetches product info (name, logo, SEO, contact, reCAPTCHA key, etc.) on mount\n * and provides it to all child components.\n */\n\"use client\";\n\nimport {\n  createContext,\n  useContext,\n  useState,\n  useLayoutEffect,\n  useCallback,\n  useMemo,\n} from \"react\";\nimport type { ReactNode } from \"react\";\n\nimport { useWebSDK, useWebSDKConfig } from \"../client/provider\";\n\n// ============================================================================\n// Types\n// ============================================================================\n\nexport interface ProductData {\n  id: string;\n  name: string;\n  slug: string;\n  description?: string | null;\n  status: string;\n  logoUrl?: string | null;\n  website?: string | null;\n  appUrl?: string | null;\n  docsUrl?: string | null;\n  contactEmail?: string | null;\n  supportEmail?: string | null;\n  contactPhone?: string | null;\n  contactAddress?: string | null;\n  seoTitle?: string | null;\n  seoDescription?: string | null;\n  seoKeywords?: string | null;\n  ogImage?: string | null;\n  socialLinks?: Record<string, string> | null;\n  /**\n   * Resource links for the website footer \"Resources\" column\n   * (JSON: { docs, community, careers, team, companies, ... }).\n   * Same shape as socialLinks. Free-form keys; the ResourceLinks\n   * component renders known keys and silently ignores the rest.\n   * Backed by Product.resourceLinks on the backend (global-tenant-svc).\n   */\n  resourceLinks?: Record<string, string> | null;\n  recaptchaSiteKey?: string | null;\n  rybbitSiteId?: string | null;\n  notificationEmail?: string | null;\n  metadata?: Record<string, unknown> | null;\n}\n\nexport interface ProductProviderProps {\n  /** Child components */\n  children: ReactNode;\n  /** Optional fallback product data (used while loading) */\n  fallback?: Partial<ProductData>;\n}\n\n// ============================================================================\n// GraphQL Query\n// ============================================================================\n\n/**\n * Body of fields requested for every product fetch — shared by the primary\n * query and the legacy-backend fallback below. Kept as a string fragment\n * (not a real GraphQL `fragment` block) so we can append/strip\n * `resourceLinks` without touching anything else.\n */\nconst PRODUCT_FIELDS_BASE = `\n      id\n      name\n      slug\n      description\n      status\n      logoUrl\n      website\n      appUrl\n      docsUrl\n      contactEmail\n      supportEmail\n      contactPhone\n      contactAddress\n      seoTitle\n      seoDescription\n      seoKeywords\n      ogImage\n      socialLinks\n      recaptchaSiteKey\n      rybbitSiteId\n      notificationEmail\n      metadata\n`;\n\n/**\n * Primary query — includes the recently-added `resourceLinks` field.\n * Backends that have run the corresponding `global-tenant-svc` migration\n * (PR #64) expose this field; older ones don't, in which case\n * GraphQL validation rejects the whole query with\n * `Cannot query field \"resourceLinks\" on type \"PublicProduct\"`. The fetch\n * helper detects that specific error and transparently retries the\n * fallback below, so the SDK works on both pre- and post-migration\n * deployments without consumer-side gating.\n */\nconst PUBLIC_PRODUCT_QUERY = `\n  query PublicProduct($slug: String!) {\n    publicProduct(slug: $slug) {\n      ${PRODUCT_FIELDS_BASE}\n      resourceLinks\n    }\n  }\n`;\n\n/**\n * Fallback query for older backend deployments. Identical to the primary\n * minus `resourceLinks`. Consumers see `product.resourceLinks === undefined`\n * and any consumer (e.g. `<ResourceLinks/>`) falls through to prop / default\n * resolution paths.\n */\nconst PUBLIC_PRODUCT_QUERY_FALLBACK = `\n  query PublicProductFallback($slug: String!) {\n    publicProduct(slug: $slug) {\n      ${PRODUCT_FIELDS_BASE}\n    }\n  }\n`;\n\n// ============================================================================\n// Context\n// ============================================================================\n\ninterface ProductContextValue {\n  product: ProductData | null;\n  loading: boolean;\n  error: string | null;\n  hasProvider: boolean;\n  refetch: () => void;\n}\n\nconst ProductContext = createContext<ProductContextValue>({\n  product: null,\n  loading: true,\n  error: null,\n  hasProvider: false,\n  refetch: () => {},\n});\n\n// ============================================================================\n// Provider\n// ============================================================================\n\n/**\n * ProductProvider fetches and provides product metadata to child components.\n * Uses the product slug from WebSDKConfig to fetch from the public API.\n *\n * @example\n * ```tsx\n * <WebSDKProvider config={sdkConfig}>\n *   <ProductProvider>\n *     <App />\n *   </ProductProvider>\n * </WebSDKProvider>\n * ```\n */\nexport function ProductProvider({ children, fallback }: ProductProviderProps) {\n  const client = useWebSDK();\n  const config = useWebSDKConfig();\n  const [product, setProduct] = useState<ProductData | null>(\n    fallback ? (fallback as ProductData) : null,\n  );\n  const [loading, setLoading] = useState(true);\n  const [error, setError] = useState<string | null>(null);\n  const fetchProduct = useCallback(async () => {\n    if (!config.productSlug) {\n      setLoading(false);\n      return;\n    }\n\n    setLoading(true);\n    setError(null);\n\n    try {\n      let result = await client.query<{ publicProduct: ProductData | null }>(\n        PUBLIC_PRODUCT_QUERY,\n        { slug: config.productSlug },\n      );\n\n      // Backwards-compat fallback: if the backend's `publicProduct` schema\n      // doesn't yet expose `resourceLinks` (deployed before\n      // `global-tenant-svc` PR #64), the primary query fails validation\n      // with a \"Cannot query field …\" error and `result.data` is null.\n      // Retry the fallback query that omits `resourceLinks`; consumers\n      // gracefully see `product.resourceLinks === undefined` and fall\n      // through their own resolution paths.\n      const schemaMissingResourceLinks = result.errors?.some((e) =>\n        /Cannot query field [\"']?resourceLinks[\"']?/i.test(e?.message ?? \"\"),\n      );\n      if (schemaMissingResourceLinks) {\n        result = await client.query<{ publicProduct: ProductData | null }>(\n          PUBLIC_PRODUCT_QUERY_FALLBACK,\n          { slug: config.productSlug },\n        );\n      }\n\n      if (result.errors?.length) {\n        setError(result.errors[0]?.message ?? \"Unknown error\");\n      } else if (result.data?.publicProduct) {\n        setProduct(result.data.publicProduct);\n      }\n    } catch (err) {\n      setError(err instanceof Error ? err.message : \"Failed to fetch product\");\n    } finally {\n      setLoading(false);\n    }\n  }, [client, config.productSlug]);\n\n  // Use useLayoutEffect for earliest possible fetch after commit (before paint).\n  // Runs when slug or client changes. Client-side query cache + dedup ensures\n  // no duplicate network requests even if React StrictMode fires this twice.\n  useLayoutEffect(() => {\n    fetchProduct();\n  }, [fetchProduct]);\n\n  const value = useMemo(\n    () => ({\n      product,\n      loading,\n      error,\n      hasProvider: true,\n      refetch: fetchProduct,\n    }),\n    [product, loading, error, fetchProduct],\n  );\n\n  return (\n    <ProductContext.Provider value={value}>{children}</ProductContext.Provider>\n  );\n}\n\n// ============================================================================\n// Hooks\n// ============================================================================\n\n/**\n * Hook to access the current product data.\n *\n * @example\n * ```tsx\n * const { product, loading } = useProduct();\n * if (loading) return <Loading />;\n * return <h1>{product?.name}</h1>;\n * ```\n */\nexport function useProduct(): ProductContextValue {\n  return useContext(ProductContext);\n}\n\n/**\n * Hook to get product-specific configuration.\n * Merges SDK config with fetched product data.\n * Useful for getting reCAPTCHA keys, analytics IDs, etc.\n *\n * @example\n * ```tsx\n * const { recaptchaSiteKey, rybbitSiteId } = useProductConfig();\n * ```\n */\nexport function useProductConfig(): {\n  recaptchaSiteKey: string | null;\n  rybbitSiteId: string | null;\n  contactEmail: string | null;\n  supportEmail: string | null;\n  notificationEmail: string | null;\n  productName: string | null;\n  logoUrl: string | null;\n} {\n  const { product } = useProduct();\n  const config = useWebSDKConfig();\n\n  return {\n    // Prefer product-level config, fall back to SDK config\n    recaptchaSiteKey:\n      product?.recaptchaSiteKey ?? config.recaptchaSiteKey ?? null,\n    rybbitSiteId: product?.rybbitSiteId ?? config.rybbitSiteId ?? null,\n    contactEmail: product?.contactEmail ?? null,\n    supportEmail: product?.supportEmail ?? null,\n    notificationEmail:\n      product?.notificationEmail ?? product?.contactEmail ?? null,\n    productName: product?.name ?? null,\n    logoUrl: product?.logoUrl ?? null,\n  };\n}\n"]}
+{"version":3,"sources":["../../src/client/security.ts","../../src/client/graphql-client.ts","../../src/client/provider.tsx","../../src/product/product-provider.tsx"],"names":["createContext","useContext","useState","useCallback","useLayoutEffect","useMemo","jsx"],"mappings":";;;;;;;;;;AAAA,IAAM,iCAAiB,IAAI,GAAA,CAAI,CAAC,WAAA,EAAa,WAAA,EAAa,KAAK,CAAC,CAAA;AAChE,IAAM,gBAAA,uBAAuB,GAAA,CAAI;AAAA,EAC/B,eAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,cAAA;AAAA,EACA,sBAAA;AAAA,EACA,iBAAA;AAAA,EACA,sBAAA;AAAA,EACA;AACF,CAAC,CAAA;AAEM,SAAS,mBAAmB,KAAA,EAAuB;AACxD,EAAA,IAAI,GAAA;AAEJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,KAAK,CAAA;AAAA,EACrB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAAA,EAC5D;AAEA,EAAA,IAAI,GAAA,CAAI,aAAa,QAAA,EAAU;AAC7B,IAAA,OAAO,IAAI,QAAA,EAAS;AAAA,EACtB;AAEA,EAAA,IACE,GAAA,CAAI,aAAa,OAAA,IACjB,cAAA,CAAe,IAAI,GAAA,CAAI,QAAA,CAAS,WAAA,EAAa,CAAA,EAC7C;AACA,IAAA,OAAO,IAAI,QAAA,EAAS;AAAA,EACtB;AAEA,EAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAC1E;AAEO,SAAS,gBACd,OAAA,EACoC;AACpC,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AAErB,EAAA,OAAO,MAAA,CAAO,WAAA;AAAA,IACZ,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,CAAE,MAAA;AAAA,MACtB,CAAC,CAAC,GAAG,CAAA,KAAM,CAAC,gBAAA,CAAiB,GAAA,CAAI,GAAA,CAAI,WAAA,EAAa;AAAA;AACpD,GACF;AACF;AAQA,IAAM,qBAAA,uBAA4B,GAAA,CAAI;AAAA,EACpC,4BAAA;AAAA,EACA;AACF,CAAC,CAAA;AAQM,SAAS,eAAA,CACd,YACA,QAAA,EACwB;AACxB,EAAA,MAAM,QAAA,GAAW,QAAA,EAAU,QAAA,EAAU,IAAA,EAAK;AAC1C,EAAA,MAAM,YAAA,GAAe,QAAA,EAAU,YAAA,EAAc,IAAA,EAAK;AAClD,EAAA,IAAI,CAAC,QAAA,IAAY,CAAC,YAAA,SAAqB,EAAC;AAExC,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,IAAI,GAAA,CAAI,UAAU,CAAA,CAAE,SAAS,WAAA,EAAY;AAAA,EAClD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,IAAI,CAAC,qBAAA,CAAsB,GAAA,CAAI,IAAI,CAAA,SAAU,EAAC;AAE9C,EAAA,OAAO;AAAA,IACL,qBAAA,EAAuB,QAAA;AAAA,IACvB,yBAAA,EAA2B;AAAA,GAC7B;AACF;;;ACMO,IAAM,aAAA,GAAN,MAAM,aAAA,CAAa;AAAA,EAaxB,YAAY,MAAA,EAA4B;AAZxC,IAAA,aAAA,CAAA,IAAA,EAAQ,QAAA,CAAA;AACR,IAAA,aAAA,CAAA,IAAA,EAAQ,YAAA,sBAAiB,GAAA,EAGvB,CAAA;AACF,IAAA,aAAA,CAAA,IAAA,EAAQ,UAAA,sBAAe,GAAA,EAA+C,CAAA;AAQpE,IAAA,IAAA,CAAK,MAAA,GAAS;AAAA,MACZ,GAAG,MAAA;AAAA,MACH,UAAA,EAAY,kBAAA,CAAmB,MAAA,CAAO,UAAU,CAAA;AAAA,MAChD,OAAA,EAAS,eAAA,CAAgB,MAAA,CAAO,OAAO;AAAA,KACzC;AAAA,EACF;AAAA,EAEA,SAAA,GAAgC;AAC9B,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAA,CACJ,KAAA,EACA,SAAA,EACA,OAAA,EAC6B;AAK7B,IAAA,IAAI,OAAA,EAAS,UAAU,KAAA,EAAO;AAC5B,MAAA,OAAO,KAAK,OAAA,CAAW,KAAA,EAAO,SAAA,EAAW,IAAA,EAAM,QAAQ,SAAS,CAAA;AAAA,IAClE;AAEA,IAAA,MAAM,WAAW,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,WAAW,CAAA;AAGpD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,QAAQ,CAAA;AAC3C,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,IAAI,KAAK,GAAA,EAAI,GAAI,MAAA,CAAO,EAAA,GAAK,cAAa,SAAA,EAAW;AACnD,QAAA,OAAO,MAAA,CAAO,IAAA;AAAA,MAChB;AACA,MAAA,IAAA,CAAK,UAAA,CAAW,OAAO,QAAQ,CAAA;AAAA,IACjC;AAGA,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,QAAQ,CAAA;AAC3C,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,OAAO,QAAA;AAAA,IACT;AAEA,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,CAAW,KAAA,EAAO,SAAA,EAAW,IAAA,EAAM,OAAA,EAAS,SAAS,CAAA,CACvE,IAAA,CAAK,CAAC,MAAA,KAAW;AAEhB,MAAA,IAAI,MAAA,CAAO,IAAA,IAAQ,CAAC,MAAA,CAAO,QAAQ,MAAA,EAAQ;AACzC,QAAA,IAAI,IAAA,CAAK,UAAA,CAAW,IAAA,IAAQ,aAAA,CAAa,iBAAA,EAAmB;AAC1D,UAAA,MAAM,cAAc,IAAA,CAAK,UAAA,CAAW,IAAA,EAAK,CAAE,MAAK,CAAE,KAAA;AAClD,UAAA,IAAI,WAAA,EAAa;AACf,YAAA,IAAA,CAAK,UAAA,CAAW,OAAO,WAAW,CAAA;AAAA,UACpC;AAAA,QACF;AACA,QAAA,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,QAAA,EAAU,EAAE,IAAA,EAAM,QAAQ,EAAA,EAAI,IAAA,CAAK,GAAA,EAAI,EAAG,CAAA;AAAA,MAChE;AACA,MAAA,OAAO,MAAA;AAAA,IACT,CAAC,CAAA,CACA,OAAA,CAAQ,MAAM;AACb,MAAA,IAAA,CAAK,QAAA,CAAS,OAAO,QAAQ,CAAA;AAAA,IAC/B,CAAC,CAAA;AAEH,IAAA,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,QAAA,EAAU,OAAO,CAAA;AACnC,IAAA,OAAO,OAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,MAAA,CACJ,QAAA,EACA,SAAA,EACA,OAAA,EAC6B;AAG7B,IAAA,OAAO,KAAK,OAAA,CAAW,QAAA,EAAU,SAAA,EAAW,KAAA,EAAO,SAAS,SAAS,CAAA;AAAA,EACvE;AAAA;AAAA,EAGA,OAAe,kBAAkB,MAAA,EAAyB;AACxD,IAAA,OAAO,WAAW,GAAA,IAAO,MAAA,KAAW,GAAA,IAAQ,MAAA,IAAU,OAAO,MAAA,GAAS,GAAA;AAAA,EACxE;AAAA,EAEA,OAAe,MAAM,EAAA,EAA2B;AAC9C,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,EAAE,CAAC,CAAA;AAAA,EACzD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,OAAA,CACZ,KAAA,EACA,SAAA,EACA,SAAA,EAC0D;AAC1D,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,SAAS,CAAA;AAC5D,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,IAAA,CAAK,OAAO,UAAA,EAAY;AAAA,QACnD,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,kBAAA;AAAA,UAChB,cAAA,EAAgB,KAAK,MAAA,CAAO,SAAA;AAAA,UAC5B,GAAG,KAAK,MAAA,CAAO,OAAA;AAAA,UACf,GAAG,eAAA,CAAgB,IAAA,CAAK,OAAO,UAAA,EAAY,IAAA,CAAK,OAAO,QAAQ;AAAA,SACjE;AAAA,QACA,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,WAAW,CAAA;AAAA,QACzC,QAAQ,UAAA,CAAW;AAAA,OACpB,CAAA;AAED,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,OAAA,CAAQ,KAAA;AAAA,UACN,iCAAA;AAAA,UACA,QAAA,CAAS,MAAA;AAAA,UACT,QAAA,CAAS;AAAA,SACX;AACA,QAAA,OAAO;AAAA,UACL,GAAA,EAAK;AAAA,YACH,MAAA,EAAQ;AAAA,cACN;AAAA,gBACE,SAAS,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,EAAA,EAAK,SAAS,UAAU,CAAA,CAAA;AAAA,gBACxD,YAAY,EAAE,IAAA,EAAM,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,CAAA;AAAG;AAChD;AACF,WACF;AAAA,UACA,SAAA,EAAW,aAAA,CAAa,iBAAA,CAAkB,QAAA,CAAS,MAAM;AAAA,SAC3D;AAAA,MACF;AAEA,MAAA,OAAO;AAAA,QACL,GAAA,EAAM,MAAM,QAAA,CAAS,IAAA,EAAK;AAAA,QAC1B,SAAA,EAAW;AAAA,OACb;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,UACJ,KAAA,YAAiB,KAAA,KAChB,MAAM,IAAA,KAAS,YAAA,IAAgB,WAAW,MAAA,CAAO,OAAA,CAAA;AACpD,MAAA,MAAM,OAAA,GAAU,UACZ,CAAA,wBAAA,EAA2B,SAAS,OACpC,KAAA,YAAiB,KAAA,GACf,MAAM,OAAA,GACN,eAAA;AACN,MAAA,OAAA,CAAQ,KAAA,CAAM,0BAA0B,OAAO,CAAA;AAC/C,MAAA,OAAO;AAAA,QACL,GAAA,EAAK;AAAA,UACH,MAAA,EAAQ;AAAA,YACN;AAAA,cACE,OAAA;AAAA,cACA,UAAA,EAAY,EAAE,IAAA,EAAM,OAAA,GAAU,YAAY,eAAA;AAAgB;AAC5D;AACF,SACF;AAAA;AAAA;AAAA,QAGA,SAAA,EAAW;AAAA,OACb;AAAA,IACF,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAAA,EACF;AAAA,EAEA,MAAc,OAAA,CACZ,KAAA,EACA,SAAA,EACA,KAAA,GAAQ,MACR,iBAAA,EAC6B;AAC7B,IAAA,MAAM,SAAA,GACJ,iBAAA,IACA,IAAA,CAAK,MAAA,CAAO,aACZ,aAAA,CAAa,kBAAA;AACf,IAAA,MAAM,aAAa,KAAA,GACd,IAAA,CAAK,MAAA,CAAO,UAAA,IAAc,cAAa,mBAAA,GACxC,CAAA;AAEJ,IAAA,IAAI,IAAA;AACJ,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,IAAK,UAAA,EAAY,CAAA,EAAA,EAAK;AACpC,MAAA,MAAM,EAAE,GAAA,EAAK,SAAA,EAAU,GAAI,MAAM,IAAA,CAAK,OAAA;AAAA,QACpC,KAAA;AAAA,QACA,SAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,IAAI,CAAC,SAAA,IAAa,CAAA,KAAM,UAAA,EAAY,OAAO,GAAA;AAC3C,MAAA,IAAA,GAAO,GAAA;AAEP,MAAA,MAAM,aAAA,CAAa,KAAA;AAAA,QACjB,cAAa,mBAAA,IAAuB,CAAA,GAAI,CAAA,CAAA,GAAK,IAAA,CAAK,QAAO,GAAI;AAAA,OAC/D;AAAA,IACF;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AACF,CAAA;AA5ME,aAAA,CAPW,aAAA,EAOI,WAAA,EAAY,CAAA,GAAI,EAAA,GAAK,GAAA,CAAA;AAAA;AACpC,aAAA,CARW,eAQI,mBAAA,EAAoB,GAAA,CAAA;AACnC,aAAA,CATW,eASI,oBAAA,EAAqB,IAAA,CAAA;AACpC,aAAA,CAVW,eAUI,qBAAA,EAAsB,CAAA,CAAA;AACrC,aAAA,CAXW,eAWI,qBAAA,EAAsB,GAAA,CAAA;ACzFvC,IAAM,aAAA,GAAgBA,oBAAmC,IAAI,CAAA;AAyCtD,SAAS,SAAA,GAA0B;AACxC,EAAA,MAAM,MAAA,GAASC,iBAAW,aAAa,CAAA;AACvC,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAM,IAAI,MAAM,gDAAgD,CAAA;AAAA,EAClE;AACA,EAAA,OAAO,MAAA;AACT;AAMO,SAAS,eAAA,GAAsC;AACpD,EAAA,MAAM,SAAS,SAAA,EAAU;AACzB,EAAA,OAAO,OAAO,SAAA,EAAU;AAC1B;ACOA,IAAM,mBAAA,GAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAmC5B,IAAM,oBAAA,GAAuB;AAAA;AAAA;AAAA,MAAA,EAGrB,mBAAmB;AAAA;AAAA;AAAA;AAAA,CAAA;AAY3B,IAAM,6BAAA,GAAgC;AAAA;AAAA;AAAA,MAAA,EAG9B,mBAAmB;AAAA;AAAA;AAAA,CAAA;AAiB3B,IAAM,iBAAiBD,mBAAAA,CAAmC;AAAA,EACxD,OAAA,EAAS,IAAA;AAAA,EACT,OAAA,EAAS,IAAA;AAAA,EACT,KAAA,EAAO,IAAA;AAAA,EACP,WAAA,EAAa,KAAA;AAAA,EACb,SAAS,MAAM;AAAA,EAAC;AAClB,CAAC,CAAA;AAmBM,SAAS,eAAA,CAAgB,EAAE,QAAA,EAAU,QAAA,EAAS,EAAyB;AAC5E,EAAA,MAAM,SAAS,SAAA,EAAU;AACzB,EAAA,MAAM,SAAS,eAAA,EAAgB;AAC/B,EAAA,MAAM,CAAC,OAAA,EAAS,UAAU,CAAA,GAAIE,cAAA;AAAA,IAC5B,WAAY,QAAA,GAA2B;AAAA,GACzC;AACA,EAAA,MAAM,CAAC,OAAA,EAAS,UAAU,CAAA,GAAIA,eAAS,IAAI,CAAA;AAC3C,EAAA,MAAM,CAAC,KAAA,EAAO,QAAQ,CAAA,GAAIA,eAAwB,IAAI,CAAA;AACtD,EAAA,MAAM,YAAA,GAAeC,kBAAY,YAAY;AAC3C,IAAA,IAAI,CAAC,OAAO,WAAA,EAAa;AACvB,MAAA,UAAA,CAAW,KAAK,CAAA;AAChB,MAAA;AAAA,IACF;AAEA,IAAA,UAAA,CAAW,IAAI,CAAA;AACf,IAAA,QAAA,CAAS,IAAI,CAAA;AAEb,IAAA,IAAI;AACF,MAAA,IAAI,MAAA,GAAS,MAAM,MAAA,CAAO,KAAA;AAAA,QACxB,oBAAA;AAAA,QACA,EAAE,IAAA,EAAM,MAAA,CAAO,WAAA;AAAY,OAC7B;AASA,MAAA,MAAM,0BAAA,GAA6B,OAAO,MAAA,EAAQ,IAAA;AAAA,QAAK,CAAC,CAAA,KACtD,6CAAA,CAA8C,IAAA,CAAK,CAAA,EAAG,WAAW,EAAE;AAAA,OACrE;AACA,MAAA,IAAI,0BAAA,EAA4B;AAC9B,QAAA,MAAA,GAAS,MAAM,MAAA,CAAO,KAAA;AAAA,UACpB,6BAAA;AAAA,UACA,EAAE,IAAA,EAAM,MAAA,CAAO,WAAA;AAAY,SAC7B;AAAA,MACF;AAEA,MAAA,IAAI,MAAA,CAAO,QAAQ,MAAA,EAAQ;AACzB,QAAA,QAAA,CAAS,MAAA,CAAO,MAAA,CAAO,CAAC,CAAA,EAAG,WAAW,eAAe,CAAA;AAAA,MACvD,CAAA,MAAA,IAAW,MAAA,CAAO,IAAA,EAAM,aAAA,EAAe;AACrC,QAAA,UAAA,CAAW,MAAA,CAAO,KAAK,aAAa,CAAA;AAAA,MACtC;AAAA,IACF,SAAS,GAAA,EAAK;AACZ,MAAA,QAAA,CAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,yBAAyB,CAAA;AAAA,IACzE,CAAA,SAAE;AACA,MAAA,UAAA,CAAW,KAAK,CAAA;AAAA,IAClB;AAAA,EACF,CAAA,EAAG,CAAC,MAAA,EAAQ,MAAA,CAAO,WAAW,CAAC,CAAA;AAK/B,EAAAC,qBAAA,CAAgB,MAAM;AACpB,IAAA,YAAA,EAAa;AAAA,EACf,CAAA,EAAG,CAAC,YAAY,CAAC,CAAA;AAEjB,EAAA,MAAM,KAAA,GAAQC,aAAAA;AAAA,IACZ,OAAO;AAAA,MACL,OAAA;AAAA,MACA,OAAA;AAAA,MACA,KAAA;AAAA,MACA,WAAA,EAAa,IAAA;AAAA,MACb,OAAA,EAAS;AAAA,KACX,CAAA;AAAA,IACA,CAAC,OAAA,EAAS,OAAA,EAAS,KAAA,EAAO,YAAY;AAAA,GACxC;AAEA,EAAA,uBACEC,cAAAA,CAAC,cAAA,CAAe,QAAA,EAAf,EAAwB,OAAe,QAAA,EAAS,CAAA;AAErD;AAgBO,SAAS,UAAA,GAAkC;AAChD,EAAA,OAAOL,iBAAW,cAAc,CAAA;AAClC;AAYO,SAAS,gBAAA,GAQd;AACA,EAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,UAAA,EAAW;AAC/B,EAAA,MAAM,SAAS,eAAA,EAAgB;AAE/B,EAAA,OAAO;AAAA;AAAA,IAEL,gBAAA,EACE,OAAA,EAAS,gBAAA,IAAoB,MAAA,CAAO,gBAAA,IAAoB,IAAA;AAAA,IAC1D,YAAA,EAAc,OAAA,EAAS,YAAA,IAAgB,MAAA,CAAO,YAAA,IAAgB,IAAA;AAAA,IAC9D,YAAA,EAAc,SAAS,YAAA,IAAgB,IAAA;AAAA,IACvC,YAAA,EAAc,SAAS,YAAA,IAAgB,IAAA;AAAA,IACvC,iBAAA,EACE,OAAA,EAAS,iBAAA,IAAqB,OAAA,EAAS,YAAA,IAAgB,IAAA;AAAA,IACzD,WAAA,EAAa,SAAS,IAAA,IAAQ,IAAA;AAAA,IAC9B,OAAA,EAAS,SAAS,OAAA,IAAW;AAAA,GAC/B;AACF","file":"index.js","sourcesContent":["const LOOPBACK_HOSTS = new Set([\"localhost\", \"127.0.0.1\", \"::1\"]);\nconst RESERVED_HEADERS = new Set([\n  \"authorization\",\n  \"cookie\",\n  \"x-actor-id\",\n  \"x-actor-type\",\n  \"x-consent-granted-by\",\n  \"x-consent-scope\",\n  \"x-consent-granted-at\",\n  \"x-consent-expires-at\",\n]);\n\nexport function validateGatewayUrl(value: string): string {\n  let url: URL;\n\n  try {\n    url = new URL(value);\n  } catch {\n    throw new Error(\"Gateway URL must be a valid absolute URL\");\n  }\n\n  if (url.protocol === \"https:\") {\n    return url.toString();\n  }\n\n  if (\n    url.protocol === \"http:\" &&\n    LOOPBACK_HOSTS.has(url.hostname.toLowerCase())\n  ) {\n    return url.toString();\n  }\n\n  throw new Error(\"Gateway URL must use HTTPS unless it targets localhost\");\n}\n\nexport function sanitizeHeaders(\n  headers?: Record<string, string>,\n): Record<string, string> | undefined {\n  if (!headers) return undefined;\n\n  return Object.fromEntries(\n    Object.entries(headers).filter(\n      ([key]) => !RESERVED_HEADERS.has(key.toLowerCase()),\n    ),\n  );\n}\n\n/**\n * Hostnames whose Cloudflare Access application gates the GraphQL gateway.\n *\n * Only the alpha gateways are gated; the production gateways are public, so a token is never\n * attached there even if one is configured.\n */\nconst CF_ACCESS_GATED_HOSTS = new Set([\n  \"alphagraphql.burdenoff.com\",\n  \"alphagraphqlworkspaces.burdenoff.com\",\n]);\n\n/**\n * Service-token headers for a gated gateway, or nothing.\n *\n * Returns an empty object unless the target really is a gated host AND both halves of the token\n * are present — a half-configured token would send a malformed credential to every request.\n */\nexport function cfAccessHeaders(\n  gatewayUrl: string,\n  cfAccess?: { clientId?: string; clientSecret?: string },\n): Record<string, string> {\n  const clientId = cfAccess?.clientId?.trim();\n  const clientSecret = cfAccess?.clientSecret?.trim();\n  if (!clientId || !clientSecret) return {};\n\n  let host: string;\n  try {\n    host = new URL(gatewayUrl).hostname.toLowerCase();\n  } catch {\n    return {};\n  }\n  if (!CF_ACCESS_GATED_HOSTS.has(host)) return {};\n\n  return {\n    \"CF-Access-Client-Id\": clientId,\n    \"CF-Access-Client-Secret\": clientSecret,\n  };\n}\n","/**\n * Lightweight GraphQL client for the Burdenoff Web SDK.\n * Uses native fetch - zero external dependencies.\n * All calls are unauthenticated (public gateway operations only).\n */\n\nimport {\n  cfAccessHeaders,\n  sanitizeHeaders,\n  validateGatewayUrl,\n} from \"./security\";\n\nexport interface WebSDKClientConfig {\n  /** Global public gateway URL (e.g. \"https://api.burdenoff.com/global/graphql\") */\n  gatewayUrl: string;\n  /** Platform product ID for scoping operations */\n  productId: string;\n  /** Product slug (used for public product queries) */\n  productSlug?: string;\n  /** reCAPTCHA site key (if not fetched from product config) */\n  recaptchaSiteKey?: string;\n  /** Rybbit analytics site ID */\n  rybbitSiteId?: string;\n  /** Custom headers to include in all requests */\n  headers?: Record<string, string>;\n  /**\n   * Cloudflare Access service token, for the ALPHA gateway hosts only.\n   *\n   * `alphagraphql.burdenoff.com` sits behind a Cloudflare Access application, so an\n   * unauthenticated browser XHR is answered with a 302 to the Access login on a different\n   * origin — which the browser reports as an opaque CORS failure rather than a 401. Attaching\n   * the service-token headers is how every app shell already passes that gate (fe-libs\n   * `installGatewayFetchRewrite`); the website SDK previously had no equivalent, so contact,\n   * newsletter, waitlist and explore all failed on alpha.\n   *\n   * Vite only inlines `VITE_*` into APP source, never into a bundled library, so the host app\n   * must read `import.meta.env` and pass the values in. Production gateways are not gated and\n   * receive no headers.\n   */\n  cfAccess?: { clientId?: string; clientSecret?: string };\n  /**\n   * Per-request timeout in ms. Kept below the gateway's operation timeout so a\n   * stalled request surfaces as an error the UI can render, instead of leaving\n   * a page stuck on loading skeletons forever. Default 12000.\n   */\n  timeoutMs?: number;\n  /**\n   * Extra attempts for transient failures (timeout / network / 5xx / 429) on\n   * QUERIES ONLY. Mutations are never retried — a retried contact-form or\n   * waitlist submit would double-submit. Default 1 (2 attempts total).\n   */\n  maxRetries?: number;\n}\n\n/**\n * Per-call overrides for {@link WebSDKClient.query}.\n *\n * The defaults (5-minute response cache + in-flight deduplication) are right\n * for the read-once content queries most SDK components make, and wrong for a\n * poll loop: the second poll of the same `(query, variables)` pair would be\n * served straight from the cache and the UI would freeze on the first\n * response forever. Pass `{ cache: false }` for anything polled.\n */\nexport interface WebSDKQueryOptions {\n  /**\n   * Use the response cache and in-flight deduplication. Default `true`.\n   * `false` skips the cache read, the dedupe map AND the cache write, so the\n   * call always hits the network and never poisons a later cached read.\n   */\n  cache?: boolean;\n  /** Override the client-wide request timeout for this call only. */\n  timeoutMs?: number;\n}\n\n/** Per-call overrides for {@link WebSDKClient.mutate}. */\nexport interface WebSDKMutateOptions {\n  /** Override the client-wide request timeout for this call only. */\n  timeoutMs?: number;\n}\n\nexport interface GraphQLResponse<T = Record<string, unknown>> {\n  data?: T;\n  errors?: Array<{\n    message: string;\n    locations?: Array<{ line: number; column: number }>;\n    path?: Array<string | number>;\n    extensions?: Record<string, unknown>;\n  }>;\n}\n\nexport class WebSDKClient {\n  private config: WebSDKClientConfig;\n  private queryCache = new Map<\n    string,\n    { data: GraphQLResponse<unknown>; ts: number }\n  >();\n  private inflight = new Map<string, Promise<GraphQLResponse<unknown>>>();\n  private static CACHE_TTL = 5 * 60 * 1000; // 5 minutes\n  private static MAX_CACHE_ENTRIES = 100;\n  private static DEFAULT_TIMEOUT_MS = 12_000;\n  private static DEFAULT_MAX_RETRIES = 1;\n  private static RETRY_BASE_DELAY_MS = 400;\n\n  constructor(config: WebSDKClientConfig) {\n    this.config = {\n      ...config,\n      gatewayUrl: validateGatewayUrl(config.gatewayUrl),\n      headers: sanitizeHeaders(config.headers),\n    };\n  }\n\n  getConfig(): WebSDKClientConfig {\n    return this.config;\n  }\n\n  /**\n   * Execute a GraphQL query (with deduplication and caching).\n   *\n   * Pass `{ cache: false }` to bypass the cache entirely — required for poll\n   * loops, where every tick must reach the network.\n   */\n  async query<T = Record<string, unknown>>(\n    query: string,\n    variables?: Record<string, unknown>,\n    options?: WebSDKQueryOptions,\n  ): Promise<GraphQLResponse<T>> {\n    // Uncached path: no cache read, no in-flight dedupe, no cache write.\n    // Deliberately bypasses the dedupe map too — two identical polls issued a\n    // few hundred ms apart must both hit the network, otherwise the second one\n    // resolves with the first one's (already stale) snapshot.\n    if (options?.cache === false) {\n      return this.request<T>(query, variables, true, options.timeoutMs);\n    }\n\n    const cacheKey = JSON.stringify({ query, variables });\n\n    // Return cached response if still valid, evict if expired\n    const cached = this.queryCache.get(cacheKey);\n    if (cached) {\n      if (Date.now() - cached.ts < WebSDKClient.CACHE_TTL) {\n        return cached.data as GraphQLResponse<T>;\n      }\n      this.queryCache.delete(cacheKey);\n    }\n\n    // Deduplicate: if same query is already in-flight, reuse the promise\n    const existing = this.inflight.get(cacheKey);\n    if (existing) {\n      return existing as Promise<GraphQLResponse<T>>;\n    }\n\n    const promise = this.request<T>(query, variables, true, options?.timeoutMs)\n      .then((result) => {\n        // Cache successful responses only\n        if (result.data && !result.errors?.length) {\n          if (this.queryCache.size >= WebSDKClient.MAX_CACHE_ENTRIES) {\n            const oldestEntry = this.queryCache.keys().next().value;\n            if (oldestEntry) {\n              this.queryCache.delete(oldestEntry);\n            }\n          }\n          this.queryCache.set(cacheKey, { data: result, ts: Date.now() });\n        }\n        return result;\n      })\n      .finally(() => {\n        this.inflight.delete(cacheKey);\n      });\n\n    this.inflight.set(cacheKey, promise);\n    return promise;\n  }\n\n  /**\n   * Execute a GraphQL mutation\n   */\n  async mutate<T = Record<string, unknown>>(\n    mutation: string,\n    variables?: Record<string, unknown>,\n    options?: WebSDKMutateOptions,\n  ): Promise<GraphQLResponse<T>> {\n    // retry=false: a retried mutation could double-submit (contact form,\n    // waitlist signup, order). Only the timeout applies here.\n    return this.request<T>(mutation, variables, false, options?.timeoutMs);\n  }\n\n  /** HTTP statuses worth another attempt — transient server/edge conditions. */\n  private static isRetriableStatus(status: number): boolean {\n    return status === 429 || status === 408 || (status >= 500 && status < 600);\n  }\n\n  private static sleep(ms: number): Promise<void> {\n    return new Promise((resolve) => setTimeout(resolve, ms));\n  }\n\n  /**\n   * Perform the HTTP call with a hard timeout. Every outcome resolves to a\n   * GraphQLResponse — callers never hang, so a UI's `loading` state always\n   * settles into data or a renderable error.\n   */\n  private async attempt<T>(\n    query: string,\n    variables: Record<string, unknown> | undefined,\n    timeoutMs: number,\n  ): Promise<{ res: GraphQLResponse<T>; retriable: boolean }> {\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), timeoutMs);\n    try {\n      const response = await fetch(this.config.gatewayUrl, {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\",\n          \"x-product-id\": this.config.productId,\n          ...this.config.headers,\n          ...cfAccessHeaders(this.config.gatewayUrl, this.config.cfAccess),\n        },\n        body: JSON.stringify({ query, variables }),\n        signal: controller.signal,\n      });\n\n      if (!response.ok) {\n        console.error(\n          \"[WebSDK] GraphQL request failed\",\n          response.status,\n          response.statusText,\n        );\n        return {\n          res: {\n            errors: [\n              {\n                message: `HTTP ${response.status}: ${response.statusText}`,\n                extensions: { code: `HTTP_${response.status}` },\n              },\n            ],\n          },\n          retriable: WebSDKClient.isRetriableStatus(response.status),\n        };\n      }\n\n      return {\n        res: (await response.json()) as GraphQLResponse<T>,\n        retriable: false,\n      };\n    } catch (error) {\n      const aborted =\n        error instanceof Error &&\n        (error.name === \"AbortError\" || controller.signal.aborted);\n      const message = aborted\n        ? `Request timed out after ${timeoutMs}ms`\n        : error instanceof Error\n          ? error.message\n          : \"Network error\";\n      console.error(\"[WebSDK] Network error\", message);\n      return {\n        res: {\n          errors: [\n            {\n              message,\n              extensions: { code: aborted ? \"TIMEOUT\" : \"NETWORK_ERROR\" },\n            },\n          ],\n        },\n        // Transport-level failures are worth one more try; a genuine outage\n        // just fails twice quickly and still renders an error state.\n        retriable: true,\n      };\n    } finally {\n      clearTimeout(timer);\n    }\n  }\n\n  private async request<T>(\n    query: string,\n    variables?: Record<string, unknown>,\n    retry = true,\n    timeoutOverrideMs?: number,\n  ): Promise<GraphQLResponse<T>> {\n    const timeoutMs =\n      timeoutOverrideMs ??\n      this.config.timeoutMs ??\n      WebSDKClient.DEFAULT_TIMEOUT_MS;\n    const maxRetries = retry\n      ? (this.config.maxRetries ?? WebSDKClient.DEFAULT_MAX_RETRIES)\n      : 0;\n\n    let last: GraphQLResponse<T> | undefined;\n    for (let i = 0; i <= maxRetries; i++) {\n      const { res, retriable } = await this.attempt<T>(\n        query,\n        variables,\n        timeoutMs,\n      );\n      if (!retriable || i === maxRetries) return res;\n      last = res;\n      // Small backoff with jitter so a burst of clients doesn't retry in lockstep.\n      await WebSDKClient.sleep(\n        WebSDKClient.RETRY_BASE_DELAY_MS * (i + 1) + Math.random() * 200,\n      );\n    }\n    return last as GraphQLResponse<T>;\n  }\n}\n","/**\n * React context provider for the Web SDK client.\n * Wraps the application with WebSDKClient configuration.\n */\n\"use client\";\n\nimport { createContext, useContext, useMemo } from \"react\";\nimport type { ReactNode } from \"react\";\n\nimport { resolveGatewayUrl } from \"./gateway-resolver\";\nimport { WebSDKClient, type WebSDKClientConfig } from \"./graphql-client\";\n\nconst WebSDKContext = createContext<WebSDKClient | null>(null);\n\nexport interface WebSDKProviderProps {\n  /** SDK client configuration */\n  config: WebSDKClientConfig;\n  /** Child components */\n  children: ReactNode;\n}\n\n/**\n * Provider component that makes the WebSDKClient available to all child components.\n *\n * @example\n * ```tsx\n * <WebSDKProvider config={{\n *   gatewayUrl: \"https://api.burdenoff.com/global/graphql\",\n *   productId: \"your-product-id\",\n *   productSlug: \"your-product\",\n * }}>\n *   <App />\n * </WebSDKProvider>\n * ```\n */\nexport function WebSDKProvider({ config, children }: WebSDKProviderProps) {\n  const client = useMemo(() => {\n    const resolvedConfig = {\n      ...config,\n      gatewayUrl: resolveGatewayUrl(config.gatewayUrl),\n    };\n    return new WebSDKClient(resolvedConfig);\n  }, [config]);\n\n  return (\n    <WebSDKContext.Provider value={client}>{children}</WebSDKContext.Provider>\n  );\n}\n\n/**\n * Hook to access the WebSDKClient instance.\n * Must be used within a WebSDKProvider.\n */\nexport function useWebSDK(): WebSDKClient {\n  const client = useContext(WebSDKContext);\n  if (!client) {\n    throw new Error(\"useWebSDK must be used within a WebSDKProvider\");\n  }\n  return client;\n}\n\n/**\n * Hook to access the SDK configuration.\n * Useful for components that need config values like productId, recaptchaSiteKey, etc.\n */\nexport function useWebSDKConfig(): WebSDKClientConfig {\n  const client = useWebSDK();\n  return client.getConfig();\n}\n","/**\n * Product Provider\n *\n * React context and hooks for accessing product metadata from the global tenant service.\n * Fetches product info (name, logo, SEO, contact, reCAPTCHA key, etc.) on mount\n * and provides it to all child components.\n */\n\"use client\";\n\nimport {\n  createContext,\n  useContext,\n  useState,\n  useLayoutEffect,\n  useCallback,\n  useMemo,\n} from \"react\";\nimport type { ReactNode } from \"react\";\n\nimport { useWebSDK, useWebSDKConfig } from \"../client/provider\";\n\n// ============================================================================\n// Types\n// ============================================================================\n\nexport interface ProductData {\n  id: string;\n  name: string;\n  slug: string;\n  description?: string | null;\n  status: string;\n  logoUrl?: string | null;\n  website?: string | null;\n  appUrl?: string | null;\n  docsUrl?: string | null;\n  contactEmail?: string | null;\n  supportEmail?: string | null;\n  contactPhone?: string | null;\n  contactAddress?: string | null;\n  seoTitle?: string | null;\n  seoDescription?: string | null;\n  seoKeywords?: string | null;\n  ogImage?: string | null;\n  socialLinks?: Record<string, string> | null;\n  /**\n   * Resource links for the website footer \"Resources\" column\n   * (JSON: { docs, community, careers, team, companies, ... }).\n   * Same shape as socialLinks. Free-form keys; the ResourceLinks\n   * component renders known keys and silently ignores the rest.\n   * Backed by Product.resourceLinks on the backend (global-tenant-svc).\n   */\n  resourceLinks?: Record<string, string> | null;\n  recaptchaSiteKey?: string | null;\n  rybbitSiteId?: string | null;\n  notificationEmail?: string | null;\n  metadata?: Record<string, unknown> | null;\n}\n\nexport interface ProductProviderProps {\n  /** Child components */\n  children: ReactNode;\n  /** Optional fallback product data (used while loading) */\n  fallback?: Partial<ProductData>;\n}\n\n// ============================================================================\n// GraphQL Query\n// ============================================================================\n\n/**\n * Body of fields requested for every product fetch — shared by the primary\n * query and the legacy-backend fallback below. Kept as a string fragment\n * (not a real GraphQL `fragment` block) so we can append/strip\n * `resourceLinks` without touching anything else.\n */\nconst PRODUCT_FIELDS_BASE = `\n      id\n      name\n      slug\n      description\n      status\n      logoUrl\n      website\n      appUrl\n      docsUrl\n      contactEmail\n      supportEmail\n      contactPhone\n      contactAddress\n      seoTitle\n      seoDescription\n      seoKeywords\n      ogImage\n      socialLinks\n      recaptchaSiteKey\n      rybbitSiteId\n      notificationEmail\n      metadata\n`;\n\n/**\n * Primary query — includes the recently-added `resourceLinks` field.\n * Backends that have run the corresponding `global-tenant-svc` migration\n * (PR #64) expose this field; older ones don't, in which case\n * GraphQL validation rejects the whole query with\n * `Cannot query field \"resourceLinks\" on type \"PublicProduct\"`. The fetch\n * helper detects that specific error and transparently retries the\n * fallback below, so the SDK works on both pre- and post-migration\n * deployments without consumer-side gating.\n */\nconst PUBLIC_PRODUCT_QUERY = `\n  query PublicProduct($slug: String!) {\n    publicProduct(slug: $slug) {\n      ${PRODUCT_FIELDS_BASE}\n      resourceLinks\n    }\n  }\n`;\n\n/**\n * Fallback query for older backend deployments. Identical to the primary\n * minus `resourceLinks`. Consumers see `product.resourceLinks === undefined`\n * and any consumer (e.g. `<ResourceLinks/>`) falls through to prop / default\n * resolution paths.\n */\nconst PUBLIC_PRODUCT_QUERY_FALLBACK = `\n  query PublicProductFallback($slug: String!) {\n    publicProduct(slug: $slug) {\n      ${PRODUCT_FIELDS_BASE}\n    }\n  }\n`;\n\n// ============================================================================\n// Context\n// ============================================================================\n\ninterface ProductContextValue {\n  product: ProductData | null;\n  loading: boolean;\n  error: string | null;\n  hasProvider: boolean;\n  refetch: () => void;\n}\n\nconst ProductContext = createContext<ProductContextValue>({\n  product: null,\n  loading: true,\n  error: null,\n  hasProvider: false,\n  refetch: () => {},\n});\n\n// ============================================================================\n// Provider\n// ============================================================================\n\n/**\n * ProductProvider fetches and provides product metadata to child components.\n * Uses the product slug from WebSDKConfig to fetch from the public API.\n *\n * @example\n * ```tsx\n * <WebSDKProvider config={sdkConfig}>\n *   <ProductProvider>\n *     <App />\n *   </ProductProvider>\n * </WebSDKProvider>\n * ```\n */\nexport function ProductProvider({ children, fallback }: ProductProviderProps) {\n  const client = useWebSDK();\n  const config = useWebSDKConfig();\n  const [product, setProduct] = useState<ProductData | null>(\n    fallback ? (fallback as ProductData) : null,\n  );\n  const [loading, setLoading] = useState(true);\n  const [error, setError] = useState<string | null>(null);\n  const fetchProduct = useCallback(async () => {\n    if (!config.productSlug) {\n      setLoading(false);\n      return;\n    }\n\n    setLoading(true);\n    setError(null);\n\n    try {\n      let result = await client.query<{ publicProduct: ProductData | null }>(\n        PUBLIC_PRODUCT_QUERY,\n        { slug: config.productSlug },\n      );\n\n      // Backwards-compat fallback: if the backend's `publicProduct` schema\n      // doesn't yet expose `resourceLinks` (deployed before\n      // `global-tenant-svc` PR #64), the primary query fails validation\n      // with a \"Cannot query field …\" error and `result.data` is null.\n      // Retry the fallback query that omits `resourceLinks`; consumers\n      // gracefully see `product.resourceLinks === undefined` and fall\n      // through their own resolution paths.\n      const schemaMissingResourceLinks = result.errors?.some((e) =>\n        /Cannot query field [\"']?resourceLinks[\"']?/i.test(e?.message ?? \"\"),\n      );\n      if (schemaMissingResourceLinks) {\n        result = await client.query<{ publicProduct: ProductData | null }>(\n          PUBLIC_PRODUCT_QUERY_FALLBACK,\n          { slug: config.productSlug },\n        );\n      }\n\n      if (result.errors?.length) {\n        setError(result.errors[0]?.message ?? \"Unknown error\");\n      } else if (result.data?.publicProduct) {\n        setProduct(result.data.publicProduct);\n      }\n    } catch (err) {\n      setError(err instanceof Error ? err.message : \"Failed to fetch product\");\n    } finally {\n      setLoading(false);\n    }\n  }, [client, config.productSlug]);\n\n  // Use useLayoutEffect for earliest possible fetch after commit (before paint).\n  // Runs when slug or client changes. Client-side query cache + dedup ensures\n  // no duplicate network requests even if React StrictMode fires this twice.\n  useLayoutEffect(() => {\n    fetchProduct();\n  }, [fetchProduct]);\n\n  const value = useMemo(\n    () => ({\n      product,\n      loading,\n      error,\n      hasProvider: true,\n      refetch: fetchProduct,\n    }),\n    [product, loading, error, fetchProduct],\n  );\n\n  return (\n    <ProductContext.Provider value={value}>{children}</ProductContext.Provider>\n  );\n}\n\n// ============================================================================\n// Hooks\n// ============================================================================\n\n/**\n * Hook to access the current product data.\n *\n * @example\n * ```tsx\n * const { product, loading } = useProduct();\n * if (loading) return <Loading />;\n * return <h1>{product?.name}</h1>;\n * ```\n */\nexport function useProduct(): ProductContextValue {\n  return useContext(ProductContext);\n}\n\n/**\n * Hook to get product-specific configuration.\n * Merges SDK config with fetched product data.\n * Useful for getting reCAPTCHA keys, analytics IDs, etc.\n *\n * @example\n * ```tsx\n * const { recaptchaSiteKey, rybbitSiteId } = useProductConfig();\n * ```\n */\nexport function useProductConfig(): {\n  recaptchaSiteKey: string | null;\n  rybbitSiteId: string | null;\n  contactEmail: string | null;\n  supportEmail: string | null;\n  notificationEmail: string | null;\n  productName: string | null;\n  logoUrl: string | null;\n} {\n  const { product } = useProduct();\n  const config = useWebSDKConfig();\n\n  return {\n    // Prefer product-level config, fall back to SDK config\n    recaptchaSiteKey:\n      product?.recaptchaSiteKey ?? config.recaptchaSiteKey ?? null,\n    rybbitSiteId: product?.rybbitSiteId ?? config.rybbitSiteId ?? null,\n    contactEmail: product?.contactEmail ?? null,\n    supportEmail: product?.supportEmail ?? null,\n    notificationEmail:\n      product?.notificationEmail ?? product?.contactEmail ?? null,\n    productName: product?.name ?? null,\n    logoUrl: product?.logoUrl ?? null,\n  };\n}\n"]}

package/dist/product/index.mjs

@@ -40,6 +40,26 @@ function sanitizeHeaders(headers) {
     )
   );
 }
+var CF_ACCESS_GATED_HOSTS = /* @__PURE__ */ new Set([
+  "alphagraphql.burdenoff.com",
+  "alphagraphqlworkspaces.burdenoff.com"
+]);
+function cfAccessHeaders(gatewayUrl, cfAccess) {
+  const clientId = cfAccess?.clientId?.trim();
+  const clientSecret = cfAccess?.clientSecret?.trim();
+  if (!clientId || !clientSecret) return {};
+  let host;
+  try {
+    host = new URL(gatewayUrl).hostname.toLowerCase();
+  } catch {
+    return {};
+  }
+  if (!CF_ACCESS_GATED_HOSTS.has(host)) return {};
+  return {
+    "CF-Access-Client-Id": clientId,
+    "CF-Access-Client-Secret": clientSecret
+  };
+}
 
 // src/client/graphql-client.ts
 var _WebSDKClient = class _WebSDKClient {
@@ -122,7 +142,8 @@ var _WebSDKClient = class _WebSDKClient {
         headers: {
           "Content-Type": "application/json",
           "x-product-id": this.config.productId,
-          ...this.config.headers
+          ...this.config.headers,
+          ...cfAccessHeaders(this.config.gatewayUrl, this.config.cfAccess)
         },
         body: JSON.stringify({ query, variables }),
         signal: controller.signal

package/dist/product/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/client/security.ts","../../src/client/graphql-client.ts","../../src/client/provider.tsx","../../src/product/product-provider.tsx"],"names":["createContext","useMemo","jsx","useContext"],"mappings":";;;;;;;;AAAA,IAAM,iCAAiB,IAAI,GAAA,CAAI,CAAC,WAAA,EAAa,WAAA,EAAa,KAAK,CAAC,CAAA;AAChE,IAAM,gBAAA,uBAAuB,GAAA,CAAI;AAAA,EAC/B,eAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,cAAA;AAAA,EACA,sBAAA;AAAA,EACA,iBAAA;AAAA,EACA,sBAAA;AAAA,EACA;AACF,CAAC,CAAA;AAEM,SAAS,mBAAmB,KAAA,EAAuB;AACxD,EAAA,IAAI,GAAA;AAEJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,KAAK,CAAA;AAAA,EACrB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAAA,EAC5D;AAEA,EAAA,IAAI,GAAA,CAAI,aAAa,QAAA,EAAU;AAC7B,IAAA,OAAO,IAAI,QAAA,EAAS;AAAA,EACtB;AAEA,EAAA,IACE,GAAA,CAAI,aAAa,OAAA,IACjB,cAAA,CAAe,IAAI,GAAA,CAAI,QAAA,CAAS,WAAA,EAAa,CAAA,EAC7C;AACA,IAAA,OAAO,IAAI,QAAA,EAAS;AAAA,EACtB;AAEA,EAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAC1E;AAEO,SAAS,gBACd,OAAA,EACoC;AACpC,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AAErB,EAAA,OAAO,MAAA,CAAO,WAAA;AAAA,IACZ,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,CAAE,MAAA;AAAA,MACtB,CAAC,CAAC,GAAG,CAAA,KAAM,CAAC,gBAAA,CAAiB,GAAA,CAAI,GAAA,CAAI,WAAA,EAAa;AAAA;AACpD,GACF;AACF;;;AC0BO,IAAM,aAAA,GAAN,MAAM,aAAA,CAAa;AAAA,EAaxB,YAAY,MAAA,EAA4B;AAZxC,IAAA,aAAA,CAAA,IAAA,EAAQ,QAAA,CAAA;AACR,IAAA,aAAA,CAAA,IAAA,EAAQ,YAAA,sBAAiB,GAAA,EAGvB,CAAA;AACF,IAAA,aAAA,CAAA,IAAA,EAAQ,UAAA,sBAAe,GAAA,EAA+C,CAAA;AAQpE,IAAA,IAAA,CAAK,MAAA,GAAS;AAAA,MACZ,GAAG,MAAA;AAAA,MACH,UAAA,EAAY,kBAAA,CAAmB,MAAA,CAAO,UAAU,CAAA;AAAA,MAChD,OAAA,EAAS,eAAA,CAAgB,MAAA,CAAO,OAAO;AAAA,KACzC;AAAA,EACF;AAAA,EAEA,SAAA,GAAgC;AAC9B,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAA,CACJ,KAAA,EACA,SAAA,EACA,OAAA,EAC6B;AAK7B,IAAA,IAAI,OAAA,EAAS,UAAU,KAAA,EAAO;AAC5B,MAAA,OAAO,KAAK,OAAA,CAAW,KAAA,EAAO,SAAA,EAAW,IAAA,EAAM,QAAQ,SAAS,CAAA;AAAA,IAClE;AAEA,IAAA,MAAM,WAAW,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,WAAW,CAAA;AAGpD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,QAAQ,CAAA;AAC3C,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,IAAI,KAAK,GAAA,EAAI,GAAI,MAAA,CAAO,EAAA,GAAK,cAAa,SAAA,EAAW;AACnD,QAAA,OAAO,MAAA,CAAO,IAAA;AAAA,MAChB;AACA,MAAA,IAAA,CAAK,UAAA,CAAW,OAAO,QAAQ,CAAA;AAAA,IACjC;AAGA,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,QAAQ,CAAA;AAC3C,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,OAAO,QAAA;AAAA,IACT;AAEA,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,CAAW,KAAA,EAAO,SAAA,EAAW,IAAA,EAAM,OAAA,EAAS,SAAS,CAAA,CACvE,IAAA,CAAK,CAAC,MAAA,KAAW;AAEhB,MAAA,IAAI,MAAA,CAAO,IAAA,IAAQ,CAAC,MAAA,CAAO,QAAQ,MAAA,EAAQ;AACzC,QAAA,IAAI,IAAA,CAAK,UAAA,CAAW,IAAA,IAAQ,aAAA,CAAa,iBAAA,EAAmB;AAC1D,UAAA,MAAM,cAAc,IAAA,CAAK,UAAA,CAAW,IAAA,EAAK,CAAE,MAAK,CAAE,KAAA;AAClD,UAAA,IAAI,WAAA,EAAa;AACf,YAAA,IAAA,CAAK,UAAA,CAAW,OAAO,WAAW,CAAA;AAAA,UACpC;AAAA,QACF;AACA,QAAA,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,QAAA,EAAU,EAAE,IAAA,EAAM,QAAQ,EAAA,EAAI,IAAA,CAAK,GAAA,EAAI,EAAG,CAAA;AAAA,MAChE;AACA,MAAA,OAAO,MAAA;AAAA,IACT,CAAC,CAAA,CACA,OAAA,CAAQ,MAAM;AACb,MAAA,IAAA,CAAK,QAAA,CAAS,OAAO,QAAQ,CAAA;AAAA,IAC/B,CAAC,CAAA;AAEH,IAAA,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,QAAA,EAAU,OAAO,CAAA;AACnC,IAAA,OAAO,OAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,MAAA,CACJ,QAAA,EACA,SAAA,EACA,OAAA,EAC6B;AAG7B,IAAA,OAAO,KAAK,OAAA,CAAW,QAAA,EAAU,SAAA,EAAW,KAAA,EAAO,SAAS,SAAS,CAAA;AAAA,EACvE;AAAA;AAAA,EAGA,OAAe,kBAAkB,MAAA,EAAyB;AACxD,IAAA,OAAO,WAAW,GAAA,IAAO,MAAA,KAAW,GAAA,IAAQ,MAAA,IAAU,OAAO,MAAA,GAAS,GAAA;AAAA,EACxE;AAAA,EAEA,OAAe,MAAM,EAAA,EAA2B;AAC9C,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,EAAE,CAAC,CAAA;AAAA,EACzD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,OAAA,CACZ,KAAA,EACA,SAAA,EACA,SAAA,EAC0D;AAC1D,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,SAAS,CAAA;AAC5D,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,IAAA,CAAK,OAAO,UAAA,EAAY;AAAA,QACnD,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,kBAAA;AAAA,UAChB,cAAA,EAAgB,KAAK,MAAA,CAAO,SAAA;AAAA,UAC5B,GAAG,KAAK,MAAA,CAAO;AAAA,SACjB;AAAA,QACA,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,WAAW,CAAA;AAAA,QACzC,QAAQ,UAAA,CAAW;AAAA,OACpB,CAAA;AAED,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,OAAA,CAAQ,KAAA;AAAA,UACN,iCAAA;AAAA,UACA,QAAA,CAAS,MAAA;AAAA,UACT,QAAA,CAAS;AAAA,SACX;AACA,QAAA,OAAO;AAAA,UACL,GAAA,EAAK;AAAA,YACH,MAAA,EAAQ;AAAA,cACN;AAAA,gBACE,SAAS,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,EAAA,EAAK,SAAS,UAAU,CAAA,CAAA;AAAA,gBACxD,YAAY,EAAE,IAAA,EAAM,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,CAAA;AAAG;AAChD;AACF,WACF;AAAA,UACA,SAAA,EAAW,aAAA,CAAa,iBAAA,CAAkB,QAAA,CAAS,MAAM;AAAA,SAC3D;AAAA,MACF;AAEA,MAAA,OAAO;AAAA,QACL,GAAA,EAAM,MAAM,QAAA,CAAS,IAAA,EAAK;AAAA,QAC1B,SAAA,EAAW;AAAA,OACb;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,UACJ,KAAA,YAAiB,KAAA,KAChB,MAAM,IAAA,KAAS,YAAA,IAAgB,WAAW,MAAA,CAAO,OAAA,CAAA;AACpD,MAAA,MAAM,OAAA,GAAU,UACZ,CAAA,wBAAA,EAA2B,SAAS,OACpC,KAAA,YAAiB,KAAA,GACf,MAAM,OAAA,GACN,eAAA;AACN,MAAA,OAAA,CAAQ,KAAA,CAAM,0BAA0B,OAAO,CAAA;AAC/C,MAAA,OAAO;AAAA,QACL,GAAA,EAAK;AAAA,UACH,MAAA,EAAQ;AAAA,YACN;AAAA,cACE,OAAA;AAAA,cACA,UAAA,EAAY,EAAE,IAAA,EAAM,OAAA,GAAU,YAAY,eAAA;AAAgB;AAC5D;AACF,SACF;AAAA;AAAA;AAAA,QAGA,SAAA,EAAW;AAAA,OACb;AAAA,IACF,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAAA,EACF;AAAA,EAEA,MAAc,OAAA,CACZ,KAAA,EACA,SAAA,EACA,KAAA,GAAQ,MACR,iBAAA,EAC6B;AAC7B,IAAA,MAAM,SAAA,GACJ,iBAAA,IACA,IAAA,CAAK,MAAA,CAAO,aACZ,aAAA,CAAa,kBAAA;AACf,IAAA,MAAM,aAAa,KAAA,GACd,IAAA,CAAK,MAAA,CAAO,UAAA,IAAc,cAAa,mBAAA,GACxC,CAAA;AAEJ,IAAA,IAAI,IAAA;AACJ,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,IAAK,UAAA,EAAY,CAAA,EAAA,EAAK;AACpC,MAAA,MAAM,EAAE,GAAA,EAAK,SAAA,EAAU,GAAI,MAAM,IAAA,CAAK,OAAA;AAAA,QACpC,KAAA;AAAA,QACA,SAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,IAAI,CAAC,SAAA,IAAa,CAAA,KAAM,UAAA,EAAY,OAAO,GAAA;AAC3C,MAAA,IAAA,GAAO,GAAA;AAEP,MAAA,MAAM,aAAA,CAAa,KAAA;AAAA,QACjB,cAAa,mBAAA,IAAuB,CAAA,GAAI,CAAA,CAAA,GAAK,IAAA,CAAK,QAAO,GAAI;AAAA,OAC/D;AAAA,IACF;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AACF,CAAA;AA3ME,aAAA,CAPW,aAAA,EAOI,WAAA,EAAY,CAAA,GAAI,EAAA,GAAK,GAAA,CAAA;AAAA;AACpC,aAAA,CARW,eAQI,mBAAA,EAAoB,GAAA,CAAA;AACnC,aAAA,CATW,eASI,oBAAA,EAAqB,IAAA,CAAA;AACpC,aAAA,CAVW,eAUI,qBAAA,EAAsB,CAAA,CAAA;AACrC,aAAA,CAXW,eAWI,qBAAA,EAAsB,GAAA,CAAA;ACtEvC,IAAM,aAAA,GAAgB,cAAmC,IAAI,CAAA;AAyCtD,SAAS,SAAA,GAA0B;AACxC,EAAA,MAAM,MAAA,GAAS,WAAW,aAAa,CAAA;AACvC,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAM,IAAI,MAAM,gDAAgD,CAAA;AAAA,EAClE;AACA,EAAA,OAAO,MAAA;AACT;AAMO,SAAS,eAAA,GAAsC;AACpD,EAAA,MAAM,SAAS,SAAA,EAAU;AACzB,EAAA,OAAO,OAAO,SAAA,EAAU;AAC1B;ACOA,IAAM,mBAAA,GAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAmC5B,IAAM,oBAAA,GAAuB;AAAA;AAAA;AAAA,MAAA,EAGrB,mBAAmB;AAAA;AAAA;AAAA;AAAA,CAAA;AAY3B,IAAM,6BAAA,GAAgC;AAAA;AAAA;AAAA,MAAA,EAG9B,mBAAmB;AAAA;AAAA;AAAA,CAAA;AAiB3B,IAAM,iBAAiBA,aAAAA,CAAmC;AAAA,EACxD,OAAA,EAAS,IAAA;AAAA,EACT,OAAA,EAAS,IAAA;AAAA,EACT,KAAA,EAAO,IAAA;AAAA,EACP,WAAA,EAAa,KAAA;AAAA,EACb,SAAS,MAAM;AAAA,EAAC;AAClB,CAAC,CAAA;AAmBM,SAAS,eAAA,CAAgB,EAAE,QAAA,EAAU,QAAA,EAAS,EAAyB;AAC5E,EAAA,MAAM,SAAS,SAAA,EAAU;AACzB,EAAA,MAAM,SAAS,eAAA,EAAgB;AAC/B,EAAA,MAAM,CAAC,OAAA,EAAS,UAAU,CAAA,GAAI,QAAA;AAAA,IAC5B,WAAY,QAAA,GAA2B;AAAA,GACzC;AACA,EAAA,MAAM,CAAC,OAAA,EAAS,UAAU,CAAA,GAAI,SAAS,IAAI,CAAA;AAC3C,EAAA,MAAM,CAAC,KAAA,EAAO,QAAQ,CAAA,GAAI,SAAwB,IAAI,CAAA;AACtD,EAAA,MAAM,YAAA,GAAe,YAAY,YAAY;AAC3C,IAAA,IAAI,CAAC,OAAO,WAAA,EAAa;AACvB,MAAA,UAAA,CAAW,KAAK,CAAA;AAChB,MAAA;AAAA,IACF;AAEA,IAAA,UAAA,CAAW,IAAI,CAAA;AACf,IAAA,QAAA,CAAS,IAAI,CAAA;AAEb,IAAA,IAAI;AACF,MAAA,IAAI,MAAA,GAAS,MAAM,MAAA,CAAO,KAAA;AAAA,QACxB,oBAAA;AAAA,QACA,EAAE,IAAA,EAAM,MAAA,CAAO,WAAA;AAAY,OAC7B;AASA,MAAA,MAAM,0BAAA,GAA6B,OAAO,MAAA,EAAQ,IAAA;AAAA,QAAK,CAAC,CAAA,KACtD,6CAAA,CAA8C,IAAA,CAAK,CAAA,EAAG,WAAW,EAAE;AAAA,OACrE;AACA,MAAA,IAAI,0BAAA,EAA4B;AAC9B,QAAA,MAAA,GAAS,MAAM,MAAA,CAAO,KAAA;AAAA,UACpB,6BAAA;AAAA,UACA,EAAE,IAAA,EAAM,MAAA,CAAO,WAAA;AAAY,SAC7B;AAAA,MACF;AAEA,MAAA,IAAI,MAAA,CAAO,QAAQ,MAAA,EAAQ;AACzB,QAAA,QAAA,CAAS,MAAA,CAAO,MAAA,CAAO,CAAC,CAAA,EAAG,WAAW,eAAe,CAAA;AAAA,MACvD,CAAA,MAAA,IAAW,MAAA,CAAO,IAAA,EAAM,aAAA,EAAe;AACrC,QAAA,UAAA,CAAW,MAAA,CAAO,KAAK,aAAa,CAAA;AAAA,MACtC;AAAA,IACF,SAAS,GAAA,EAAK;AACZ,MAAA,QAAA,CAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,yBAAyB,CAAA;AAAA,IACzE,CAAA,SAAE;AACA,MAAA,UAAA,CAAW,KAAK,CAAA;AAAA,IAClB;AAAA,EACF,CAAA,EAAG,CAAC,MAAA,EAAQ,MAAA,CAAO,WAAW,CAAC,CAAA;AAK/B,EAAA,eAAA,CAAgB,MAAM;AACpB,IAAA,YAAA,EAAa;AAAA,EACf,CAAA,EAAG,CAAC,YAAY,CAAC,CAAA;AAEjB,EAAA,MAAM,KAAA,GAAQC,OAAAA;AAAA,IACZ,OAAO;AAAA,MACL,OAAA;AAAA,MACA,OAAA;AAAA,MACA,KAAA;AAAA,MACA,WAAA,EAAa,IAAA;AAAA,MACb,OAAA,EAAS;AAAA,KACX,CAAA;AAAA,IACA,CAAC,OAAA,EAAS,OAAA,EAAS,KAAA,EAAO,YAAY;AAAA,GACxC;AAEA,EAAA,uBACEC,GAAAA,CAAC,cAAA,CAAe,QAAA,EAAf,EAAwB,OAAe,QAAA,EAAS,CAAA;AAErD;AAgBO,SAAS,UAAA,GAAkC;AAChD,EAAA,OAAOC,WAAW,cAAc,CAAA;AAClC;AAYO,SAAS,gBAAA,GAQd;AACA,EAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,UAAA,EAAW;AAC/B,EAAA,MAAM,SAAS,eAAA,EAAgB;AAE/B,EAAA,OAAO;AAAA;AAAA,IAEL,gBAAA,EACE,OAAA,EAAS,gBAAA,IAAoB,MAAA,CAAO,gBAAA,IAAoB,IAAA;AAAA,IAC1D,YAAA,EAAc,OAAA,EAAS,YAAA,IAAgB,MAAA,CAAO,YAAA,IAAgB,IAAA;AAAA,IAC9D,YAAA,EAAc,SAAS,YAAA,IAAgB,IAAA;AAAA,IACvC,YAAA,EAAc,SAAS,YAAA,IAAgB,IAAA;AAAA,IACvC,iBAAA,EACE,OAAA,EAAS,iBAAA,IAAqB,OAAA,EAAS,YAAA,IAAgB,IAAA;AAAA,IACzD,WAAA,EAAa,SAAS,IAAA,IAAQ,IAAA;AAAA,IAC9B,OAAA,EAAS,SAAS,OAAA,IAAW;AAAA,GAC/B;AACF","file":"index.mjs","sourcesContent":["const LOOPBACK_HOSTS = new Set([\"localhost\", \"127.0.0.1\", \"::1\"]);\nconst RESERVED_HEADERS = new Set([\n  \"authorization\",\n  \"cookie\",\n  \"x-actor-id\",\n  \"x-actor-type\",\n  \"x-consent-granted-by\",\n  \"x-consent-scope\",\n  \"x-consent-granted-at\",\n  \"x-consent-expires-at\",\n]);\n\nexport function validateGatewayUrl(value: string): string {\n  let url: URL;\n\n  try {\n    url = new URL(value);\n  } catch {\n    throw new Error(\"Gateway URL must be a valid absolute URL\");\n  }\n\n  if (url.protocol === \"https:\") {\n    return url.toString();\n  }\n\n  if (\n    url.protocol === \"http:\" &&\n    LOOPBACK_HOSTS.has(url.hostname.toLowerCase())\n  ) {\n    return url.toString();\n  }\n\n  throw new Error(\"Gateway URL must use HTTPS unless it targets localhost\");\n}\n\nexport function sanitizeHeaders(\n  headers?: Record<string, string>,\n): Record<string, string> | undefined {\n  if (!headers) return undefined;\n\n  return Object.fromEntries(\n    Object.entries(headers).filter(\n      ([key]) => !RESERVED_HEADERS.has(key.toLowerCase()),\n    ),\n  );\n}\n","/**\n * Lightweight GraphQL client for the Burdenoff Web SDK.\n * Uses native fetch - zero external dependencies.\n * All calls are unauthenticated (public gateway operations only).\n */\n\nimport { sanitizeHeaders, validateGatewayUrl } from \"./security\";\n\nexport interface WebSDKClientConfig {\n  /** Global public gateway URL (e.g. \"https://api.burdenoff.com/global/graphql\") */\n  gatewayUrl: string;\n  /** Platform product ID for scoping operations */\n  productId: string;\n  /** Product slug (used for public product queries) */\n  productSlug?: string;\n  /** reCAPTCHA site key (if not fetched from product config) */\n  recaptchaSiteKey?: string;\n  /** Rybbit analytics site ID */\n  rybbitSiteId?: string;\n  /** Custom headers to include in all requests */\n  headers?: Record<string, string>;\n  /**\n   * Per-request timeout in ms. Kept below the gateway's operation timeout so a\n   * stalled request surfaces as an error the UI can render, instead of leaving\n   * a page stuck on loading skeletons forever. Default 12000.\n   */\n  timeoutMs?: number;\n  /**\n   * Extra attempts for transient failures (timeout / network / 5xx / 429) on\n   * QUERIES ONLY. Mutations are never retried — a retried contact-form or\n   * waitlist submit would double-submit. Default 1 (2 attempts total).\n   */\n  maxRetries?: number;\n}\n\n/**\n * Per-call overrides for {@link WebSDKClient.query}.\n *\n * The defaults (5-minute response cache + in-flight deduplication) are right\n * for the read-once content queries most SDK components make, and wrong for a\n * poll loop: the second poll of the same `(query, variables)` pair would be\n * served straight from the cache and the UI would freeze on the first\n * response forever. Pass `{ cache: false }` for anything polled.\n */\nexport interface WebSDKQueryOptions {\n  /**\n   * Use the response cache and in-flight deduplication. Default `true`.\n   * `false` skips the cache read, the dedupe map AND the cache write, so the\n   * call always hits the network and never poisons a later cached read.\n   */\n  cache?: boolean;\n  /** Override the client-wide request timeout for this call only. */\n  timeoutMs?: number;\n}\n\n/** Per-call overrides for {@link WebSDKClient.mutate}. */\nexport interface WebSDKMutateOptions {\n  /** Override the client-wide request timeout for this call only. */\n  timeoutMs?: number;\n}\n\nexport interface GraphQLResponse<T = Record<string, unknown>> {\n  data?: T;\n  errors?: Array<{\n    message: string;\n    locations?: Array<{ line: number; column: number }>;\n    path?: Array<string | number>;\n    extensions?: Record<string, unknown>;\n  }>;\n}\n\nexport class WebSDKClient {\n  private config: WebSDKClientConfig;\n  private queryCache = new Map<\n    string,\n    { data: GraphQLResponse<unknown>; ts: number }\n  >();\n  private inflight = new Map<string, Promise<GraphQLResponse<unknown>>>();\n  private static CACHE_TTL = 5 * 60 * 1000; // 5 minutes\n  private static MAX_CACHE_ENTRIES = 100;\n  private static DEFAULT_TIMEOUT_MS = 12_000;\n  private static DEFAULT_MAX_RETRIES = 1;\n  private static RETRY_BASE_DELAY_MS = 400;\n\n  constructor(config: WebSDKClientConfig) {\n    this.config = {\n      ...config,\n      gatewayUrl: validateGatewayUrl(config.gatewayUrl),\n      headers: sanitizeHeaders(config.headers),\n    };\n  }\n\n  getConfig(): WebSDKClientConfig {\n    return this.config;\n  }\n\n  /**\n   * Execute a GraphQL query (with deduplication and caching).\n   *\n   * Pass `{ cache: false }` to bypass the cache entirely — required for poll\n   * loops, where every tick must reach the network.\n   */\n  async query<T = Record<string, unknown>>(\n    query: string,\n    variables?: Record<string, unknown>,\n    options?: WebSDKQueryOptions,\n  ): Promise<GraphQLResponse<T>> {\n    // Uncached path: no cache read, no in-flight dedupe, no cache write.\n    // Deliberately bypasses the dedupe map too — two identical polls issued a\n    // few hundred ms apart must both hit the network, otherwise the second one\n    // resolves with the first one's (already stale) snapshot.\n    if (options?.cache === false) {\n      return this.request<T>(query, variables, true, options.timeoutMs);\n    }\n\n    const cacheKey = JSON.stringify({ query, variables });\n\n    // Return cached response if still valid, evict if expired\n    const cached = this.queryCache.get(cacheKey);\n    if (cached) {\n      if (Date.now() - cached.ts < WebSDKClient.CACHE_TTL) {\n        return cached.data as GraphQLResponse<T>;\n      }\n      this.queryCache.delete(cacheKey);\n    }\n\n    // Deduplicate: if same query is already in-flight, reuse the promise\n    const existing = this.inflight.get(cacheKey);\n    if (existing) {\n      return existing as Promise<GraphQLResponse<T>>;\n    }\n\n    const promise = this.request<T>(query, variables, true, options?.timeoutMs)\n      .then((result) => {\n        // Cache successful responses only\n        if (result.data && !result.errors?.length) {\n          if (this.queryCache.size >= WebSDKClient.MAX_CACHE_ENTRIES) {\n            const oldestEntry = this.queryCache.keys().next().value;\n            if (oldestEntry) {\n              this.queryCache.delete(oldestEntry);\n            }\n          }\n          this.queryCache.set(cacheKey, { data: result, ts: Date.now() });\n        }\n        return result;\n      })\n      .finally(() => {\n        this.inflight.delete(cacheKey);\n      });\n\n    this.inflight.set(cacheKey, promise);\n    return promise;\n  }\n\n  /**\n   * Execute a GraphQL mutation\n   */\n  async mutate<T = Record<string, unknown>>(\n    mutation: string,\n    variables?: Record<string, unknown>,\n    options?: WebSDKMutateOptions,\n  ): Promise<GraphQLResponse<T>> {\n    // retry=false: a retried mutation could double-submit (contact form,\n    // waitlist signup, order). Only the timeout applies here.\n    return this.request<T>(mutation, variables, false, options?.timeoutMs);\n  }\n\n  /** HTTP statuses worth another attempt — transient server/edge conditions. */\n  private static isRetriableStatus(status: number): boolean {\n    return status === 429 || status === 408 || (status >= 500 && status < 600);\n  }\n\n  private static sleep(ms: number): Promise<void> {\n    return new Promise((resolve) => setTimeout(resolve, ms));\n  }\n\n  /**\n   * Perform the HTTP call with a hard timeout. Every outcome resolves to a\n   * GraphQLResponse — callers never hang, so a UI's `loading` state always\n   * settles into data or a renderable error.\n   */\n  private async attempt<T>(\n    query: string,\n    variables: Record<string, unknown> | undefined,\n    timeoutMs: number,\n  ): Promise<{ res: GraphQLResponse<T>; retriable: boolean }> {\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), timeoutMs);\n    try {\n      const response = await fetch(this.config.gatewayUrl, {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\",\n          \"x-product-id\": this.config.productId,\n          ...this.config.headers,\n        },\n        body: JSON.stringify({ query, variables }),\n        signal: controller.signal,\n      });\n\n      if (!response.ok) {\n        console.error(\n          \"[WebSDK] GraphQL request failed\",\n          response.status,\n          response.statusText,\n        );\n        return {\n          res: {\n            errors: [\n              {\n                message: `HTTP ${response.status}: ${response.statusText}`,\n                extensions: { code: `HTTP_${response.status}` },\n              },\n            ],\n          },\n          retriable: WebSDKClient.isRetriableStatus(response.status),\n        };\n      }\n\n      return {\n        res: (await response.json()) as GraphQLResponse<T>,\n        retriable: false,\n      };\n    } catch (error) {\n      const aborted =\n        error instanceof Error &&\n        (error.name === \"AbortError\" || controller.signal.aborted);\n      const message = aborted\n        ? `Request timed out after ${timeoutMs}ms`\n        : error instanceof Error\n          ? error.message\n          : \"Network error\";\n      console.error(\"[WebSDK] Network error\", message);\n      return {\n        res: {\n          errors: [\n            {\n              message,\n              extensions: { code: aborted ? \"TIMEOUT\" : \"NETWORK_ERROR\" },\n            },\n          ],\n        },\n        // Transport-level failures are worth one more try; a genuine outage\n        // just fails twice quickly and still renders an error state.\n        retriable: true,\n      };\n    } finally {\n      clearTimeout(timer);\n    }\n  }\n\n  private async request<T>(\n    query: string,\n    variables?: Record<string, unknown>,\n    retry = true,\n    timeoutOverrideMs?: number,\n  ): Promise<GraphQLResponse<T>> {\n    const timeoutMs =\n      timeoutOverrideMs ??\n      this.config.timeoutMs ??\n      WebSDKClient.DEFAULT_TIMEOUT_MS;\n    const maxRetries = retry\n      ? (this.config.maxRetries ?? WebSDKClient.DEFAULT_MAX_RETRIES)\n      : 0;\n\n    let last: GraphQLResponse<T> | undefined;\n    for (let i = 0; i <= maxRetries; i++) {\n      const { res, retriable } = await this.attempt<T>(\n        query,\n        variables,\n        timeoutMs,\n      );\n      if (!retriable || i === maxRetries) return res;\n      last = res;\n      // Small backoff with jitter so a burst of clients doesn't retry in lockstep.\n      await WebSDKClient.sleep(\n        WebSDKClient.RETRY_BASE_DELAY_MS * (i + 1) + Math.random() * 200,\n      );\n    }\n    return last as GraphQLResponse<T>;\n  }\n}\n","/**\n * React context provider for the Web SDK client.\n * Wraps the application with WebSDKClient configuration.\n */\n\"use client\";\n\nimport { createContext, useContext, useMemo } from \"react\";\nimport type { ReactNode } from \"react\";\n\nimport { resolveGatewayUrl } from \"./gateway-resolver\";\nimport { WebSDKClient, type WebSDKClientConfig } from \"./graphql-client\";\n\nconst WebSDKContext = createContext<WebSDKClient | null>(null);\n\nexport interface WebSDKProviderProps {\n  /** SDK client configuration */\n  config: WebSDKClientConfig;\n  /** Child components */\n  children: ReactNode;\n}\n\n/**\n * Provider component that makes the WebSDKClient available to all child components.\n *\n * @example\n * ```tsx\n * <WebSDKProvider config={{\n *   gatewayUrl: \"https://api.burdenoff.com/global/graphql\",\n *   productId: \"your-product-id\",\n *   productSlug: \"your-product\",\n * }}>\n *   <App />\n * </WebSDKProvider>\n * ```\n */\nexport function WebSDKProvider({ config, children }: WebSDKProviderProps) {\n  const client = useMemo(() => {\n    const resolvedConfig = {\n      ...config,\n      gatewayUrl: resolveGatewayUrl(config.gatewayUrl),\n    };\n    return new WebSDKClient(resolvedConfig);\n  }, [config]);\n\n  return (\n    <WebSDKContext.Provider value={client}>{children}</WebSDKContext.Provider>\n  );\n}\n\n/**\n * Hook to access the WebSDKClient instance.\n * Must be used within a WebSDKProvider.\n */\nexport function useWebSDK(): WebSDKClient {\n  const client = useContext(WebSDKContext);\n  if (!client) {\n    throw new Error(\"useWebSDK must be used within a WebSDKProvider\");\n  }\n  return client;\n}\n\n/**\n * Hook to access the SDK configuration.\n * Useful for components that need config values like productId, recaptchaSiteKey, etc.\n */\nexport function useWebSDKConfig(): WebSDKClientConfig {\n  const client = useWebSDK();\n  return client.getConfig();\n}\n","/**\n * Product Provider\n *\n * React context and hooks for accessing product metadata from the global tenant service.\n * Fetches product info (name, logo, SEO, contact, reCAPTCHA key, etc.) on mount\n * and provides it to all child components.\n */\n\"use client\";\n\nimport {\n  createContext,\n  useContext,\n  useState,\n  useLayoutEffect,\n  useCallback,\n  useMemo,\n} from \"react\";\nimport type { ReactNode } from \"react\";\n\nimport { useWebSDK, useWebSDKConfig } from \"../client/provider\";\n\n// ============================================================================\n// Types\n// ============================================================================\n\nexport interface ProductData {\n  id: string;\n  name: string;\n  slug: string;\n  description?: string | null;\n  status: string;\n  logoUrl?: string | null;\n  website?: string | null;\n  appUrl?: string | null;\n  docsUrl?: string | null;\n  contactEmail?: string | null;\n  supportEmail?: string | null;\n  contactPhone?: string | null;\n  contactAddress?: string | null;\n  seoTitle?: string | null;\n  seoDescription?: string | null;\n  seoKeywords?: string | null;\n  ogImage?: string | null;\n  socialLinks?: Record<string, string> | null;\n  /**\n   * Resource links for the website footer \"Resources\" column\n   * (JSON: { docs, community, careers, team, companies, ... }).\n   * Same shape as socialLinks. Free-form keys; the ResourceLinks\n   * component renders known keys and silently ignores the rest.\n   * Backed by Product.resourceLinks on the backend (global-tenant-svc).\n   */\n  resourceLinks?: Record<string, string> | null;\n  recaptchaSiteKey?: string | null;\n  rybbitSiteId?: string | null;\n  notificationEmail?: string | null;\n  metadata?: Record<string, unknown> | null;\n}\n\nexport interface ProductProviderProps {\n  /** Child components */\n  children: ReactNode;\n  /** Optional fallback product data (used while loading) */\n  fallback?: Partial<ProductData>;\n}\n\n// ============================================================================\n// GraphQL Query\n// ============================================================================\n\n/**\n * Body of fields requested for every product fetch — shared by the primary\n * query and the legacy-backend fallback below. Kept as a string fragment\n * (not a real GraphQL `fragment` block) so we can append/strip\n * `resourceLinks` without touching anything else.\n */\nconst PRODUCT_FIELDS_BASE = `\n      id\n      name\n      slug\n      description\n      status\n      logoUrl\n      website\n      appUrl\n      docsUrl\n      contactEmail\n      supportEmail\n      contactPhone\n      contactAddress\n      seoTitle\n      seoDescription\n      seoKeywords\n      ogImage\n      socialLinks\n      recaptchaSiteKey\n      rybbitSiteId\n      notificationEmail\n      metadata\n`;\n\n/**\n * Primary query — includes the recently-added `resourceLinks` field.\n * Backends that have run the corresponding `global-tenant-svc` migration\n * (PR #64) expose this field; older ones don't, in which case\n * GraphQL validation rejects the whole query with\n * `Cannot query field \"resourceLinks\" on type \"PublicProduct\"`. The fetch\n * helper detects that specific error and transparently retries the\n * fallback below, so the SDK works on both pre- and post-migration\n * deployments without consumer-side gating.\n */\nconst PUBLIC_PRODUCT_QUERY = `\n  query PublicProduct($slug: String!) {\n    publicProduct(slug: $slug) {\n      ${PRODUCT_FIELDS_BASE}\n      resourceLinks\n    }\n  }\n`;\n\n/**\n * Fallback query for older backend deployments. Identical to the primary\n * minus `resourceLinks`. Consumers see `product.resourceLinks === undefined`\n * and any consumer (e.g. `<ResourceLinks/>`) falls through to prop / default\n * resolution paths.\n */\nconst PUBLIC_PRODUCT_QUERY_FALLBACK = `\n  query PublicProductFallback($slug: String!) {\n    publicProduct(slug: $slug) {\n      ${PRODUCT_FIELDS_BASE}\n    }\n  }\n`;\n\n// ============================================================================\n// Context\n// ============================================================================\n\ninterface ProductContextValue {\n  product: ProductData | null;\n  loading: boolean;\n  error: string | null;\n  hasProvider: boolean;\n  refetch: () => void;\n}\n\nconst ProductContext = createContext<ProductContextValue>({\n  product: null,\n  loading: true,\n  error: null,\n  hasProvider: false,\n  refetch: () => {},\n});\n\n// ============================================================================\n// Provider\n// ============================================================================\n\n/**\n * ProductProvider fetches and provides product metadata to child components.\n * Uses the product slug from WebSDKConfig to fetch from the public API.\n *\n * @example\n * ```tsx\n * <WebSDKProvider config={sdkConfig}>\n *   <ProductProvider>\n *     <App />\n *   </ProductProvider>\n * </WebSDKProvider>\n * ```\n */\nexport function ProductProvider({ children, fallback }: ProductProviderProps) {\n  const client = useWebSDK();\n  const config = useWebSDKConfig();\n  const [product, setProduct] = useState<ProductData | null>(\n    fallback ? (fallback as ProductData) : null,\n  );\n  const [loading, setLoading] = useState(true);\n  const [error, setError] = useState<string | null>(null);\n  const fetchProduct = useCallback(async () => {\n    if (!config.productSlug) {\n      setLoading(false);\n      return;\n    }\n\n    setLoading(true);\n    setError(null);\n\n    try {\n      let result = await client.query<{ publicProduct: ProductData | null }>(\n        PUBLIC_PRODUCT_QUERY,\n        { slug: config.productSlug },\n      );\n\n      // Backwards-compat fallback: if the backend's `publicProduct` schema\n      // doesn't yet expose `resourceLinks` (deployed before\n      // `global-tenant-svc` PR #64), the primary query fails validation\n      // with a \"Cannot query field …\" error and `result.data` is null.\n      // Retry the fallback query that omits `resourceLinks`; consumers\n      // gracefully see `product.resourceLinks === undefined` and fall\n      // through their own resolution paths.\n      const schemaMissingResourceLinks = result.errors?.some((e) =>\n        /Cannot query field [\"']?resourceLinks[\"']?/i.test(e?.message ?? \"\"),\n      );\n      if (schemaMissingResourceLinks) {\n        result = await client.query<{ publicProduct: ProductData | null }>(\n          PUBLIC_PRODUCT_QUERY_FALLBACK,\n          { slug: config.productSlug },\n        );\n      }\n\n      if (result.errors?.length) {\n        setError(result.errors[0]?.message ?? \"Unknown error\");\n      } else if (result.data?.publicProduct) {\n        setProduct(result.data.publicProduct);\n      }\n    } catch (err) {\n      setError(err instanceof Error ? err.message : \"Failed to fetch product\");\n    } finally {\n      setLoading(false);\n    }\n  }, [client, config.productSlug]);\n\n  // Use useLayoutEffect for earliest possible fetch after commit (before paint).\n  // Runs when slug or client changes. Client-side query cache + dedup ensures\n  // no duplicate network requests even if React StrictMode fires this twice.\n  useLayoutEffect(() => {\n    fetchProduct();\n  }, [fetchProduct]);\n\n  const value = useMemo(\n    () => ({\n      product,\n      loading,\n      error,\n      hasProvider: true,\n      refetch: fetchProduct,\n    }),\n    [product, loading, error, fetchProduct],\n  );\n\n  return (\n    <ProductContext.Provider value={value}>{children}</ProductContext.Provider>\n  );\n}\n\n// ============================================================================\n// Hooks\n// ============================================================================\n\n/**\n * Hook to access the current product data.\n *\n * @example\n * ```tsx\n * const { product, loading } = useProduct();\n * if (loading) return <Loading />;\n * return <h1>{product?.name}</h1>;\n * ```\n */\nexport function useProduct(): ProductContextValue {\n  return useContext(ProductContext);\n}\n\n/**\n * Hook to get product-specific configuration.\n * Merges SDK config with fetched product data.\n * Useful for getting reCAPTCHA keys, analytics IDs, etc.\n *\n * @example\n * ```tsx\n * const { recaptchaSiteKey, rybbitSiteId } = useProductConfig();\n * ```\n */\nexport function useProductConfig(): {\n  recaptchaSiteKey: string | null;\n  rybbitSiteId: string | null;\n  contactEmail: string | null;\n  supportEmail: string | null;\n  notificationEmail: string | null;\n  productName: string | null;\n  logoUrl: string | null;\n} {\n  const { product } = useProduct();\n  const config = useWebSDKConfig();\n\n  return {\n    // Prefer product-level config, fall back to SDK config\n    recaptchaSiteKey:\n      product?.recaptchaSiteKey ?? config.recaptchaSiteKey ?? null,\n    rybbitSiteId: product?.rybbitSiteId ?? config.rybbitSiteId ?? null,\n    contactEmail: product?.contactEmail ?? null,\n    supportEmail: product?.supportEmail ?? null,\n    notificationEmail:\n      product?.notificationEmail ?? product?.contactEmail ?? null,\n    productName: product?.name ?? null,\n    logoUrl: product?.logoUrl ?? null,\n  };\n}\n"]}
+{"version":3,"sources":["../../src/client/security.ts","../../src/client/graphql-client.ts","../../src/client/provider.tsx","../../src/product/product-provider.tsx"],"names":["createContext","useMemo","jsx","useContext"],"mappings":";;;;;;;;AAAA,IAAM,iCAAiB,IAAI,GAAA,CAAI,CAAC,WAAA,EAAa,WAAA,EAAa,KAAK,CAAC,CAAA;AAChE,IAAM,gBAAA,uBAAuB,GAAA,CAAI;AAAA,EAC/B,eAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,cAAA;AAAA,EACA,sBAAA;AAAA,EACA,iBAAA;AAAA,EACA,sBAAA;AAAA,EACA;AACF,CAAC,CAAA;AAEM,SAAS,mBAAmB,KAAA,EAAuB;AACxD,EAAA,IAAI,GAAA;AAEJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,KAAK,CAAA;AAAA,EACrB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAAA,EAC5D;AAEA,EAAA,IAAI,GAAA,CAAI,aAAa,QAAA,EAAU;AAC7B,IAAA,OAAO,IAAI,QAAA,EAAS;AAAA,EACtB;AAEA,EAAA,IACE,GAAA,CAAI,aAAa,OAAA,IACjB,cAAA,CAAe,IAAI,GAAA,CAAI,QAAA,CAAS,WAAA,EAAa,CAAA,EAC7C;AACA,IAAA,OAAO,IAAI,QAAA,EAAS;AAAA,EACtB;AAEA,EAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAC1E;AAEO,SAAS,gBACd,OAAA,EACoC;AACpC,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AAErB,EAAA,OAAO,MAAA,CAAO,WAAA;AAAA,IACZ,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,CAAE,MAAA;AAAA,MACtB,CAAC,CAAC,GAAG,CAAA,KAAM,CAAC,gBAAA,CAAiB,GAAA,CAAI,GAAA,CAAI,WAAA,EAAa;AAAA;AACpD,GACF;AACF;AAQA,IAAM,qBAAA,uBAA4B,GAAA,CAAI;AAAA,EACpC,4BAAA;AAAA,EACA;AACF,CAAC,CAAA;AAQM,SAAS,eAAA,CACd,YACA,QAAA,EACwB;AACxB,EAAA,MAAM,QAAA,GAAW,QAAA,EAAU,QAAA,EAAU,IAAA,EAAK;AAC1C,EAAA,MAAM,YAAA,GAAe,QAAA,EAAU,YAAA,EAAc,IAAA,EAAK;AAClD,EAAA,IAAI,CAAC,QAAA,IAAY,CAAC,YAAA,SAAqB,EAAC;AAExC,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,IAAI,GAAA,CAAI,UAAU,CAAA,CAAE,SAAS,WAAA,EAAY;AAAA,EAClD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,IAAI,CAAC,qBAAA,CAAsB,GAAA,CAAI,IAAI,CAAA,SAAU,EAAC;AAE9C,EAAA,OAAO;AAAA,IACL,qBAAA,EAAuB,QAAA;AAAA,IACvB,yBAAA,EAA2B;AAAA,GAC7B;AACF;;;ACMO,IAAM,aAAA,GAAN,MAAM,aAAA,CAAa;AAAA,EAaxB,YAAY,MAAA,EAA4B;AAZxC,IAAA,aAAA,CAAA,IAAA,EAAQ,QAAA,CAAA;AACR,IAAA,aAAA,CAAA,IAAA,EAAQ,YAAA,sBAAiB,GAAA,EAGvB,CAAA;AACF,IAAA,aAAA,CAAA,IAAA,EAAQ,UAAA,sBAAe,GAAA,EAA+C,CAAA;AAQpE,IAAA,IAAA,CAAK,MAAA,GAAS;AAAA,MACZ,GAAG,MAAA;AAAA,MACH,UAAA,EAAY,kBAAA,CAAmB,MAAA,CAAO,UAAU,CAAA;AAAA,MAChD,OAAA,EAAS,eAAA,CAAgB,MAAA,CAAO,OAAO;AAAA,KACzC;AAAA,EACF;AAAA,EAEA,SAAA,GAAgC;AAC9B,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAA,CACJ,KAAA,EACA,SAAA,EACA,OAAA,EAC6B;AAK7B,IAAA,IAAI,OAAA,EAAS,UAAU,KAAA,EAAO;AAC5B,MAAA,OAAO,KAAK,OAAA,CAAW,KAAA,EAAO,SAAA,EAAW,IAAA,EAAM,QAAQ,SAAS,CAAA;AAAA,IAClE;AAEA,IAAA,MAAM,WAAW,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,WAAW,CAAA;AAGpD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,QAAQ,CAAA;AAC3C,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,IAAI,KAAK,GAAA,EAAI,GAAI,MAAA,CAAO,EAAA,GAAK,cAAa,SAAA,EAAW;AACnD,QAAA,OAAO,MAAA,CAAO,IAAA;AAAA,MAChB;AACA,MAAA,IAAA,CAAK,UAAA,CAAW,OAAO,QAAQ,CAAA;AAAA,IACjC;AAGA,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,QAAQ,CAAA;AAC3C,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,OAAO,QAAA;AAAA,IACT;AAEA,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,CAAW,KAAA,EAAO,SAAA,EAAW,IAAA,EAAM,OAAA,EAAS,SAAS,CAAA,CACvE,IAAA,CAAK,CAAC,MAAA,KAAW;AAEhB,MAAA,IAAI,MAAA,CAAO,IAAA,IAAQ,CAAC,MAAA,CAAO,QAAQ,MAAA,EAAQ;AACzC,QAAA,IAAI,IAAA,CAAK,UAAA,CAAW,IAAA,IAAQ,aAAA,CAAa,iBAAA,EAAmB;AAC1D,UAAA,MAAM,cAAc,IAAA,CAAK,UAAA,CAAW,IAAA,EAAK,CAAE,MAAK,CAAE,KAAA;AAClD,UAAA,IAAI,WAAA,EAAa;AACf,YAAA,IAAA,CAAK,UAAA,CAAW,OAAO,WAAW,CAAA;AAAA,UACpC;AAAA,QACF;AACA,QAAA,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,QAAA,EAAU,EAAE,IAAA,EAAM,QAAQ,EAAA,EAAI,IAAA,CAAK,GAAA,EAAI,EAAG,CAAA;AAAA,MAChE;AACA,MAAA,OAAO,MAAA;AAAA,IACT,CAAC,CAAA,CACA,OAAA,CAAQ,MAAM;AACb,MAAA,IAAA,CAAK,QAAA,CAAS,OAAO,QAAQ,CAAA;AAAA,IAC/B,CAAC,CAAA;AAEH,IAAA,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,QAAA,EAAU,OAAO,CAAA;AACnC,IAAA,OAAO,OAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,MAAA,CACJ,QAAA,EACA,SAAA,EACA,OAAA,EAC6B;AAG7B,IAAA,OAAO,KAAK,OAAA,CAAW,QAAA,EAAU,SAAA,EAAW,KAAA,EAAO,SAAS,SAAS,CAAA;AAAA,EACvE;AAAA;AAAA,EAGA,OAAe,kBAAkB,MAAA,EAAyB;AACxD,IAAA,OAAO,WAAW,GAAA,IAAO,MAAA,KAAW,GAAA,IAAQ,MAAA,IAAU,OAAO,MAAA,GAAS,GAAA;AAAA,EACxE;AAAA,EAEA,OAAe,MAAM,EAAA,EAA2B;AAC9C,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,EAAE,CAAC,CAAA;AAAA,EACzD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,OAAA,CACZ,KAAA,EACA,SAAA,EACA,SAAA,EAC0D;AAC1D,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,SAAS,CAAA;AAC5D,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,IAAA,CAAK,OAAO,UAAA,EAAY;AAAA,QACnD,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,kBAAA;AAAA,UAChB,cAAA,EAAgB,KAAK,MAAA,CAAO,SAAA;AAAA,UAC5B,GAAG,KAAK,MAAA,CAAO,OAAA;AAAA,UACf,GAAG,eAAA,CAAgB,IAAA,CAAK,OAAO,UAAA,EAAY,IAAA,CAAK,OAAO,QAAQ;AAAA,SACjE;AAAA,QACA,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,WAAW,CAAA;AAAA,QACzC,QAAQ,UAAA,CAAW;AAAA,OACpB,CAAA;AAED,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,OAAA,CAAQ,KAAA;AAAA,UACN,iCAAA;AAAA,UACA,QAAA,CAAS,MAAA;AAAA,UACT,QAAA,CAAS;AAAA,SACX;AACA,QAAA,OAAO;AAAA,UACL,GAAA,EAAK;AAAA,YACH,MAAA,EAAQ;AAAA,cACN;AAAA,gBACE,SAAS,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,EAAA,EAAK,SAAS,UAAU,CAAA,CAAA;AAAA,gBACxD,YAAY,EAAE,IAAA,EAAM,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,CAAA;AAAG;AAChD;AACF,WACF;AAAA,UACA,SAAA,EAAW,aAAA,CAAa,iBAAA,CAAkB,QAAA,CAAS,MAAM;AAAA,SAC3D;AAAA,MACF;AAEA,MAAA,OAAO;AAAA,QACL,GAAA,EAAM,MAAM,QAAA,CAAS,IAAA,EAAK;AAAA,QAC1B,SAAA,EAAW;AAAA,OACb;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,UACJ,KAAA,YAAiB,KAAA,KAChB,MAAM,IAAA,KAAS,YAAA,IAAgB,WAAW,MAAA,CAAO,OAAA,CAAA;AACpD,MAAA,MAAM,OAAA,GAAU,UACZ,CAAA,wBAAA,EAA2B,SAAS,OACpC,KAAA,YAAiB,KAAA,GACf,MAAM,OAAA,GACN,eAAA;AACN,MAAA,OAAA,CAAQ,KAAA,CAAM,0BAA0B,OAAO,CAAA;AAC/C,MAAA,OAAO;AAAA,QACL,GAAA,EAAK;AAAA,UACH,MAAA,EAAQ;AAAA,YACN;AAAA,cACE,OAAA;AAAA,cACA,UAAA,EAAY,EAAE,IAAA,EAAM,OAAA,GAAU,YAAY,eAAA;AAAgB;AAC5D;AACF,SACF;AAAA;AAAA;AAAA,QAGA,SAAA,EAAW;AAAA,OACb;AAAA,IACF,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAAA,EACF;AAAA,EAEA,MAAc,OAAA,CACZ,KAAA,EACA,SAAA,EACA,KAAA,GAAQ,MACR,iBAAA,EAC6B;AAC7B,IAAA,MAAM,SAAA,GACJ,iBAAA,IACA,IAAA,CAAK,MAAA,CAAO,aACZ,aAAA,CAAa,kBAAA;AACf,IAAA,MAAM,aAAa,KAAA,GACd,IAAA,CAAK,MAAA,CAAO,UAAA,IAAc,cAAa,mBAAA,GACxC,CAAA;AAEJ,IAAA,IAAI,IAAA;AACJ,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,IAAK,UAAA,EAAY,CAAA,EAAA,EAAK;AACpC,MAAA,MAAM,EAAE,GAAA,EAAK,SAAA,EAAU,GAAI,MAAM,IAAA,CAAK,OAAA;AAAA,QACpC,KAAA;AAAA,QACA,SAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,IAAI,CAAC,SAAA,IAAa,CAAA,KAAM,UAAA,EAAY,OAAO,GAAA;AAC3C,MAAA,IAAA,GAAO,GAAA;AAEP,MAAA,MAAM,aAAA,CAAa,KAAA;AAAA,QACjB,cAAa,mBAAA,IAAuB,CAAA,GAAI,CAAA,CAAA,GAAK,IAAA,CAAK,QAAO,GAAI;AAAA,OAC/D;AAAA,IACF;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AACF,CAAA;AA5ME,aAAA,CAPW,aAAA,EAOI,WAAA,EAAY,CAAA,GAAI,EAAA,GAAK,GAAA,CAAA;AAAA;AACpC,aAAA,CARW,eAQI,mBAAA,EAAoB,GAAA,CAAA;AACnC,aAAA,CATW,eASI,oBAAA,EAAqB,IAAA,CAAA;AACpC,aAAA,CAVW,eAUI,qBAAA,EAAsB,CAAA,CAAA;AACrC,aAAA,CAXW,eAWI,qBAAA,EAAsB,GAAA,CAAA;ACzFvC,IAAM,aAAA,GAAgB,cAAmC,IAAI,CAAA;AAyCtD,SAAS,SAAA,GAA0B;AACxC,EAAA,MAAM,MAAA,GAAS,WAAW,aAAa,CAAA;AACvC,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAM,IAAI,MAAM,gDAAgD,CAAA;AAAA,EAClE;AACA,EAAA,OAAO,MAAA;AACT;AAMO,SAAS,eAAA,GAAsC;AACpD,EAAA,MAAM,SAAS,SAAA,EAAU;AACzB,EAAA,OAAO,OAAO,SAAA,EAAU;AAC1B;ACOA,IAAM,mBAAA,GAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAmC5B,IAAM,oBAAA,GAAuB;AAAA;AAAA;AAAA,MAAA,EAGrB,mBAAmB;AAAA;AAAA;AAAA;AAAA,CAAA;AAY3B,IAAM,6BAAA,GAAgC;AAAA;AAAA;AAAA,MAAA,EAG9B,mBAAmB;AAAA;AAAA;AAAA,CAAA;AAiB3B,IAAM,iBAAiBA,aAAAA,CAAmC;AAAA,EACxD,OAAA,EAAS,IAAA;AAAA,EACT,OAAA,EAAS,IAAA;AAAA,EACT,KAAA,EAAO,IAAA;AAAA,EACP,WAAA,EAAa,KAAA;AAAA,EACb,SAAS,MAAM;AAAA,EAAC;AAClB,CAAC,CAAA;AAmBM,SAAS,eAAA,CAAgB,EAAE,QAAA,EAAU,QAAA,EAAS,EAAyB;AAC5E,EAAA,MAAM,SAAS,SAAA,EAAU;AACzB,EAAA,MAAM,SAAS,eAAA,EAAgB;AAC/B,EAAA,MAAM,CAAC,OAAA,EAAS,UAAU,CAAA,GAAI,QAAA;AAAA,IAC5B,WAAY,QAAA,GAA2B;AAAA,GACzC;AACA,EAAA,MAAM,CAAC,OAAA,EAAS,UAAU,CAAA,GAAI,SAAS,IAAI,CAAA;AAC3C,EAAA,MAAM,CAAC,KAAA,EAAO,QAAQ,CAAA,GAAI,SAAwB,IAAI,CAAA;AACtD,EAAA,MAAM,YAAA,GAAe,YAAY,YAAY;AAC3C,IAAA,IAAI,CAAC,OAAO,WAAA,EAAa;AACvB,MAAA,UAAA,CAAW,KAAK,CAAA;AAChB,MAAA;AAAA,IACF;AAEA,IAAA,UAAA,CAAW,IAAI,CAAA;AACf,IAAA,QAAA,CAAS,IAAI,CAAA;AAEb,IAAA,IAAI;AACF,MAAA,IAAI,MAAA,GAAS,MAAM,MAAA,CAAO,KAAA;AAAA,QACxB,oBAAA;AAAA,QACA,EAAE,IAAA,EAAM,MAAA,CAAO,WAAA;AAAY,OAC7B;AASA,MAAA,MAAM,0BAAA,GAA6B,OAAO,MAAA,EAAQ,IAAA;AAAA,QAAK,CAAC,CAAA,KACtD,6CAAA,CAA8C,IAAA,CAAK,CAAA,EAAG,WAAW,EAAE;AAAA,OACrE;AACA,MAAA,IAAI,0BAAA,EAA4B;AAC9B,QAAA,MAAA,GAAS,MAAM,MAAA,CAAO,KAAA;AAAA,UACpB,6BAAA;AAAA,UACA,EAAE,IAAA,EAAM,MAAA,CAAO,WAAA;AAAY,SAC7B;AAAA,MACF;AAEA,MAAA,IAAI,MAAA,CAAO,QAAQ,MAAA,EAAQ;AACzB,QAAA,QAAA,CAAS,MAAA,CAAO,MAAA,CAAO,CAAC,CAAA,EAAG,WAAW,eAAe,CAAA;AAAA,MACvD,CAAA,MAAA,IAAW,MAAA,CAAO,IAAA,EAAM,aAAA,EAAe;AACrC,QAAA,UAAA,CAAW,MAAA,CAAO,KAAK,aAAa,CAAA;AAAA,MACtC;AAAA,IACF,SAAS,GAAA,EAAK;AACZ,MAAA,QAAA,CAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,yBAAyB,CAAA;AAAA,IACzE,CAAA,SAAE;AACA,MAAA,UAAA,CAAW,KAAK,CAAA;AAAA,IAClB;AAAA,EACF,CAAA,EAAG,CAAC,MAAA,EAAQ,MAAA,CAAO,WAAW,CAAC,CAAA;AAK/B,EAAA,eAAA,CAAgB,MAAM;AACpB,IAAA,YAAA,EAAa;AAAA,EACf,CAAA,EAAG,CAAC,YAAY,CAAC,CAAA;AAEjB,EAAA,MAAM,KAAA,GAAQC,OAAAA;AAAA,IACZ,OAAO;AAAA,MACL,OAAA;AAAA,MACA,OAAA;AAAA,MACA,KAAA;AAAA,MACA,WAAA,EAAa,IAAA;AAAA,MACb,OAAA,EAAS;AAAA,KACX,CAAA;AAAA,IACA,CAAC,OAAA,EAAS,OAAA,EAAS,KAAA,EAAO,YAAY;AAAA,GACxC;AAEA,EAAA,uBACEC,GAAAA,CAAC,cAAA,CAAe,QAAA,EAAf,EAAwB,OAAe,QAAA,EAAS,CAAA;AAErD;AAgBO,SAAS,UAAA,GAAkC;AAChD,EAAA,OAAOC,WAAW,cAAc,CAAA;AAClC;AAYO,SAAS,gBAAA,GAQd;AACA,EAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,UAAA,EAAW;AAC/B,EAAA,MAAM,SAAS,eAAA,EAAgB;AAE/B,EAAA,OAAO;AAAA;AAAA,IAEL,gBAAA,EACE,OAAA,EAAS,gBAAA,IAAoB,MAAA,CAAO,gBAAA,IAAoB,IAAA;AAAA,IAC1D,YAAA,EAAc,OAAA,EAAS,YAAA,IAAgB,MAAA,CAAO,YAAA,IAAgB,IAAA;AAAA,IAC9D,YAAA,EAAc,SAAS,YAAA,IAAgB,IAAA;AAAA,IACvC,YAAA,EAAc,SAAS,YAAA,IAAgB,IAAA;AAAA,IACvC,iBAAA,EACE,OAAA,EAAS,iBAAA,IAAqB,OAAA,EAAS,YAAA,IAAgB,IAAA;AAAA,IACzD,WAAA,EAAa,SAAS,IAAA,IAAQ,IAAA;AAAA,IAC9B,OAAA,EAAS,SAAS,OAAA,IAAW;AAAA,GAC/B;AACF","file":"index.mjs","sourcesContent":["const LOOPBACK_HOSTS = new Set([\"localhost\", \"127.0.0.1\", \"::1\"]);\nconst RESERVED_HEADERS = new Set([\n  \"authorization\",\n  \"cookie\",\n  \"x-actor-id\",\n  \"x-actor-type\",\n  \"x-consent-granted-by\",\n  \"x-consent-scope\",\n  \"x-consent-granted-at\",\n  \"x-consent-expires-at\",\n]);\n\nexport function validateGatewayUrl(value: string): string {\n  let url: URL;\n\n  try {\n    url = new URL(value);\n  } catch {\n    throw new Error(\"Gateway URL must be a valid absolute URL\");\n  }\n\n  if (url.protocol === \"https:\") {\n    return url.toString();\n  }\n\n  if (\n    url.protocol === \"http:\" &&\n    LOOPBACK_HOSTS.has(url.hostname.toLowerCase())\n  ) {\n    return url.toString();\n  }\n\n  throw new Error(\"Gateway URL must use HTTPS unless it targets localhost\");\n}\n\nexport function sanitizeHeaders(\n  headers?: Record<string, string>,\n): Record<string, string> | undefined {\n  if (!headers) return undefined;\n\n  return Object.fromEntries(\n    Object.entries(headers).filter(\n      ([key]) => !RESERVED_HEADERS.has(key.toLowerCase()),\n    ),\n  );\n}\n\n/**\n * Hostnames whose Cloudflare Access application gates the GraphQL gateway.\n *\n * Only the alpha gateways are gated; the production gateways are public, so a token is never\n * attached there even if one is configured.\n */\nconst CF_ACCESS_GATED_HOSTS = new Set([\n  \"alphagraphql.burdenoff.com\",\n  \"alphagraphqlworkspaces.burdenoff.com\",\n]);\n\n/**\n * Service-token headers for a gated gateway, or nothing.\n *\n * Returns an empty object unless the target really is a gated host AND both halves of the token\n * are present — a half-configured token would send a malformed credential to every request.\n */\nexport function cfAccessHeaders(\n  gatewayUrl: string,\n  cfAccess?: { clientId?: string; clientSecret?: string },\n): Record<string, string> {\n  const clientId = cfAccess?.clientId?.trim();\n  const clientSecret = cfAccess?.clientSecret?.trim();\n  if (!clientId || !clientSecret) return {};\n\n  let host: string;\n  try {\n    host = new URL(gatewayUrl).hostname.toLowerCase();\n  } catch {\n    return {};\n  }\n  if (!CF_ACCESS_GATED_HOSTS.has(host)) return {};\n\n  return {\n    \"CF-Access-Client-Id\": clientId,\n    \"CF-Access-Client-Secret\": clientSecret,\n  };\n}\n","/**\n * Lightweight GraphQL client for the Burdenoff Web SDK.\n * Uses native fetch - zero external dependencies.\n * All calls are unauthenticated (public gateway operations only).\n */\n\nimport {\n  cfAccessHeaders,\n  sanitizeHeaders,\n  validateGatewayUrl,\n} from \"./security\";\n\nexport interface WebSDKClientConfig {\n  /** Global public gateway URL (e.g. \"https://api.burdenoff.com/global/graphql\") */\n  gatewayUrl: string;\n  /** Platform product ID for scoping operations */\n  productId: string;\n  /** Product slug (used for public product queries) */\n  productSlug?: string;\n  /** reCAPTCHA site key (if not fetched from product config) */\n  recaptchaSiteKey?: string;\n  /** Rybbit analytics site ID */\n  rybbitSiteId?: string;\n  /** Custom headers to include in all requests */\n  headers?: Record<string, string>;\n  /**\n   * Cloudflare Access service token, for the ALPHA gateway hosts only.\n   *\n   * `alphagraphql.burdenoff.com` sits behind a Cloudflare Access application, so an\n   * unauthenticated browser XHR is answered with a 302 to the Access login on a different\n   * origin — which the browser reports as an opaque CORS failure rather than a 401. Attaching\n   * the service-token headers is how every app shell already passes that gate (fe-libs\n   * `installGatewayFetchRewrite`); the website SDK previously had no equivalent, so contact,\n   * newsletter, waitlist and explore all failed on alpha.\n   *\n   * Vite only inlines `VITE_*` into APP source, never into a bundled library, so the host app\n   * must read `import.meta.env` and pass the values in. Production gateways are not gated and\n   * receive no headers.\n   */\n  cfAccess?: { clientId?: string; clientSecret?: string };\n  /**\n   * Per-request timeout in ms. Kept below the gateway's operation timeout so a\n   * stalled request surfaces as an error the UI can render, instead of leaving\n   * a page stuck on loading skeletons forever. Default 12000.\n   */\n  timeoutMs?: number;\n  /**\n   * Extra attempts for transient failures (timeout / network / 5xx / 429) on\n   * QUERIES ONLY. Mutations are never retried — a retried contact-form or\n   * waitlist submit would double-submit. Default 1 (2 attempts total).\n   */\n  maxRetries?: number;\n}\n\n/**\n * Per-call overrides for {@link WebSDKClient.query}.\n *\n * The defaults (5-minute response cache + in-flight deduplication) are right\n * for the read-once content queries most SDK components make, and wrong for a\n * poll loop: the second poll of the same `(query, variables)` pair would be\n * served straight from the cache and the UI would freeze on the first\n * response forever. Pass `{ cache: false }` for anything polled.\n */\nexport interface WebSDKQueryOptions {\n  /**\n   * Use the response cache and in-flight deduplication. Default `true`.\n   * `false` skips the cache read, the dedupe map AND the cache write, so the\n   * call always hits the network and never poisons a later cached read.\n   */\n  cache?: boolean;\n  /** Override the client-wide request timeout for this call only. */\n  timeoutMs?: number;\n}\n\n/** Per-call overrides for {@link WebSDKClient.mutate}. */\nexport interface WebSDKMutateOptions {\n  /** Override the client-wide request timeout for this call only. */\n  timeoutMs?: number;\n}\n\nexport interface GraphQLResponse<T = Record<string, unknown>> {\n  data?: T;\n  errors?: Array<{\n    message: string;\n    locations?: Array<{ line: number; column: number }>;\n    path?: Array<string | number>;\n    extensions?: Record<string, unknown>;\n  }>;\n}\n\nexport class WebSDKClient {\n  private config: WebSDKClientConfig;\n  private queryCache = new Map<\n    string,\n    { data: GraphQLResponse<unknown>; ts: number }\n  >();\n  private inflight = new Map<string, Promise<GraphQLResponse<unknown>>>();\n  private static CACHE_TTL = 5 * 60 * 1000; // 5 minutes\n  private static MAX_CACHE_ENTRIES = 100;\n  private static DEFAULT_TIMEOUT_MS = 12_000;\n  private static DEFAULT_MAX_RETRIES = 1;\n  private static RETRY_BASE_DELAY_MS = 400;\n\n  constructor(config: WebSDKClientConfig) {\n    this.config = {\n      ...config,\n      gatewayUrl: validateGatewayUrl(config.gatewayUrl),\n      headers: sanitizeHeaders(config.headers),\n    };\n  }\n\n  getConfig(): WebSDKClientConfig {\n    return this.config;\n  }\n\n  /**\n   * Execute a GraphQL query (with deduplication and caching).\n   *\n   * Pass `{ cache: false }` to bypass the cache entirely — required for poll\n   * loops, where every tick must reach the network.\n   */\n  async query<T = Record<string, unknown>>(\n    query: string,\n    variables?: Record<string, unknown>,\n    options?: WebSDKQueryOptions,\n  ): Promise<GraphQLResponse<T>> {\n    // Uncached path: no cache read, no in-flight dedupe, no cache write.\n    // Deliberately bypasses the dedupe map too — two identical polls issued a\n    // few hundred ms apart must both hit the network, otherwise the second one\n    // resolves with the first one's (already stale) snapshot.\n    if (options?.cache === false) {\n      return this.request<T>(query, variables, true, options.timeoutMs);\n    }\n\n    const cacheKey = JSON.stringify({ query, variables });\n\n    // Return cached response if still valid, evict if expired\n    const cached = this.queryCache.get(cacheKey);\n    if (cached) {\n      if (Date.now() - cached.ts < WebSDKClient.CACHE_TTL) {\n        return cached.data as GraphQLResponse<T>;\n      }\n      this.queryCache.delete(cacheKey);\n    }\n\n    // Deduplicate: if same query is already in-flight, reuse the promise\n    const existing = this.inflight.get(cacheKey);\n    if (existing) {\n      return existing as Promise<GraphQLResponse<T>>;\n    }\n\n    const promise = this.request<T>(query, variables, true, options?.timeoutMs)\n      .then((result) => {\n        // Cache successful responses only\n        if (result.data && !result.errors?.length) {\n          if (this.queryCache.size >= WebSDKClient.MAX_CACHE_ENTRIES) {\n            const oldestEntry = this.queryCache.keys().next().value;\n            if (oldestEntry) {\n              this.queryCache.delete(oldestEntry);\n            }\n          }\n          this.queryCache.set(cacheKey, { data: result, ts: Date.now() });\n        }\n        return result;\n      })\n      .finally(() => {\n        this.inflight.delete(cacheKey);\n      });\n\n    this.inflight.set(cacheKey, promise);\n    return promise;\n  }\n\n  /**\n   * Execute a GraphQL mutation\n   */\n  async mutate<T = Record<string, unknown>>(\n    mutation: string,\n    variables?: Record<string, unknown>,\n    options?: WebSDKMutateOptions,\n  ): Promise<GraphQLResponse<T>> {\n    // retry=false: a retried mutation could double-submit (contact form,\n    // waitlist signup, order). Only the timeout applies here.\n    return this.request<T>(mutation, variables, false, options?.timeoutMs);\n  }\n\n  /** HTTP statuses worth another attempt — transient server/edge conditions. */\n  private static isRetriableStatus(status: number): boolean {\n    return status === 429 || status === 408 || (status >= 500 && status < 600);\n  }\n\n  private static sleep(ms: number): Promise<void> {\n    return new Promise((resolve) => setTimeout(resolve, ms));\n  }\n\n  /**\n   * Perform the HTTP call with a hard timeout. Every outcome resolves to a\n   * GraphQLResponse — callers never hang, so a UI's `loading` state always\n   * settles into data or a renderable error.\n   */\n  private async attempt<T>(\n    query: string,\n    variables: Record<string, unknown> | undefined,\n    timeoutMs: number,\n  ): Promise<{ res: GraphQLResponse<T>; retriable: boolean }> {\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), timeoutMs);\n    try {\n      const response = await fetch(this.config.gatewayUrl, {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\",\n          \"x-product-id\": this.config.productId,\n          ...this.config.headers,\n          ...cfAccessHeaders(this.config.gatewayUrl, this.config.cfAccess),\n        },\n        body: JSON.stringify({ query, variables }),\n        signal: controller.signal,\n      });\n\n      if (!response.ok) {\n        console.error(\n          \"[WebSDK] GraphQL request failed\",\n          response.status,\n          response.statusText,\n        );\n        return {\n          res: {\n            errors: [\n              {\n                message: `HTTP ${response.status}: ${response.statusText}`,\n                extensions: { code: `HTTP_${response.status}` },\n              },\n            ],\n          },\n          retriable: WebSDKClient.isRetriableStatus(response.status),\n        };\n      }\n\n      return {\n        res: (await response.json()) as GraphQLResponse<T>,\n        retriable: false,\n      };\n    } catch (error) {\n      const aborted =\n        error instanceof Error &&\n        (error.name === \"AbortError\" || controller.signal.aborted);\n      const message = aborted\n        ? `Request timed out after ${timeoutMs}ms`\n        : error instanceof Error\n          ? error.message\n          : \"Network error\";\n      console.error(\"[WebSDK] Network error\", message);\n      return {\n        res: {\n          errors: [\n            {\n              message,\n              extensions: { code: aborted ? \"TIMEOUT\" : \"NETWORK_ERROR\" },\n            },\n          ],\n        },\n        // Transport-level failures are worth one more try; a genuine outage\n        // just fails twice quickly and still renders an error state.\n        retriable: true,\n      };\n    } finally {\n      clearTimeout(timer);\n    }\n  }\n\n  private async request<T>(\n    query: string,\n    variables?: Record<string, unknown>,\n    retry = true,\n    timeoutOverrideMs?: number,\n  ): Promise<GraphQLResponse<T>> {\n    const timeoutMs =\n      timeoutOverrideMs ??\n      this.config.timeoutMs ??\n      WebSDKClient.DEFAULT_TIMEOUT_MS;\n    const maxRetries = retry\n      ? (this.config.maxRetries ?? WebSDKClient.DEFAULT_MAX_RETRIES)\n      : 0;\n\n    let last: GraphQLResponse<T> | undefined;\n    for (let i = 0; i <= maxRetries; i++) {\n      const { res, retriable } = await this.attempt<T>(\n        query,\n        variables,\n        timeoutMs,\n      );\n      if (!retriable || i === maxRetries) return res;\n      last = res;\n      // Small backoff with jitter so a burst of clients doesn't retry in lockstep.\n      await WebSDKClient.sleep(\n        WebSDKClient.RETRY_BASE_DELAY_MS * (i + 1) + Math.random() * 200,\n      );\n    }\n    return last as GraphQLResponse<T>;\n  }\n}\n","/**\n * React context provider for the Web SDK client.\n * Wraps the application with WebSDKClient configuration.\n */\n\"use client\";\n\nimport { createContext, useContext, useMemo } from \"react\";\nimport type { ReactNode } from \"react\";\n\nimport { resolveGatewayUrl } from \"./gateway-resolver\";\nimport { WebSDKClient, type WebSDKClientConfig } from \"./graphql-client\";\n\nconst WebSDKContext = createContext<WebSDKClient | null>(null);\n\nexport interface WebSDKProviderProps {\n  /** SDK client configuration */\n  config: WebSDKClientConfig;\n  /** Child components */\n  children: ReactNode;\n}\n\n/**\n * Provider component that makes the WebSDKClient available to all child components.\n *\n * @example\n * ```tsx\n * <WebSDKProvider config={{\n *   gatewayUrl: \"https://api.burdenoff.com/global/graphql\",\n *   productId: \"your-product-id\",\n *   productSlug: \"your-product\",\n * }}>\n *   <App />\n * </WebSDKProvider>\n * ```\n */\nexport function WebSDKProvider({ config, children }: WebSDKProviderProps) {\n  const client = useMemo(() => {\n    const resolvedConfig = {\n      ...config,\n      gatewayUrl: resolveGatewayUrl(config.gatewayUrl),\n    };\n    return new WebSDKClient(resolvedConfig);\n  }, [config]);\n\n  return (\n    <WebSDKContext.Provider value={client}>{children}</WebSDKContext.Provider>\n  );\n}\n\n/**\n * Hook to access the WebSDKClient instance.\n * Must be used within a WebSDKProvider.\n */\nexport function useWebSDK(): WebSDKClient {\n  const client = useContext(WebSDKContext);\n  if (!client) {\n    throw new Error(\"useWebSDK must be used within a WebSDKProvider\");\n  }\n  return client;\n}\n\n/**\n * Hook to access the SDK configuration.\n * Useful for components that need config values like productId, recaptchaSiteKey, etc.\n */\nexport function useWebSDKConfig(): WebSDKClientConfig {\n  const client = useWebSDK();\n  return client.getConfig();\n}\n","/**\n * Product Provider\n *\n * React context and hooks for accessing product metadata from the global tenant service.\n * Fetches product info (name, logo, SEO, contact, reCAPTCHA key, etc.) on mount\n * and provides it to all child components.\n */\n\"use client\";\n\nimport {\n  createContext,\n  useContext,\n  useState,\n  useLayoutEffect,\n  useCallback,\n  useMemo,\n} from \"react\";\nimport type { ReactNode } from \"react\";\n\nimport { useWebSDK, useWebSDKConfig } from \"../client/provider\";\n\n// ============================================================================\n// Types\n// ============================================================================\n\nexport interface ProductData {\n  id: string;\n  name: string;\n  slug: string;\n  description?: string | null;\n  status: string;\n  logoUrl?: string | null;\n  website?: string | null;\n  appUrl?: string | null;\n  docsUrl?: string | null;\n  contactEmail?: string | null;\n  supportEmail?: string | null;\n  contactPhone?: string | null;\n  contactAddress?: string | null;\n  seoTitle?: string | null;\n  seoDescription?: string | null;\n  seoKeywords?: string | null;\n  ogImage?: string | null;\n  socialLinks?: Record<string, string> | null;\n  /**\n   * Resource links for the website footer \"Resources\" column\n   * (JSON: { docs, community, careers, team, companies, ... }).\n   * Same shape as socialLinks. Free-form keys; the ResourceLinks\n   * component renders known keys and silently ignores the rest.\n   * Backed by Product.resourceLinks on the backend (global-tenant-svc).\n   */\n  resourceLinks?: Record<string, string> | null;\n  recaptchaSiteKey?: string | null;\n  rybbitSiteId?: string | null;\n  notificationEmail?: string | null;\n  metadata?: Record<string, unknown> | null;\n}\n\nexport interface ProductProviderProps {\n  /** Child components */\n  children: ReactNode;\n  /** Optional fallback product data (used while loading) */\n  fallback?: Partial<ProductData>;\n}\n\n// ============================================================================\n// GraphQL Query\n// ============================================================================\n\n/**\n * Body of fields requested for every product fetch — shared by the primary\n * query and the legacy-backend fallback below. Kept as a string fragment\n * (not a real GraphQL `fragment` block) so we can append/strip\n * `resourceLinks` without touching anything else.\n */\nconst PRODUCT_FIELDS_BASE = `\n      id\n      name\n      slug\n      description\n      status\n      logoUrl\n      website\n      appUrl\n      docsUrl\n      contactEmail\n      supportEmail\n      contactPhone\n      contactAddress\n      seoTitle\n      seoDescription\n      seoKeywords\n      ogImage\n      socialLinks\n      recaptchaSiteKey\n      rybbitSiteId\n      notificationEmail\n      metadata\n`;\n\n/**\n * Primary query — includes the recently-added `resourceLinks` field.\n * Backends that have run the corresponding `global-tenant-svc` migration\n * (PR #64) expose this field; older ones don't, in which case\n * GraphQL validation rejects the whole query with\n * `Cannot query field \"resourceLinks\" on type \"PublicProduct\"`. The fetch\n * helper detects that specific error and transparently retries the\n * fallback below, so the SDK works on both pre- and post-migration\n * deployments without consumer-side gating.\n */\nconst PUBLIC_PRODUCT_QUERY = `\n  query PublicProduct($slug: String!) {\n    publicProduct(slug: $slug) {\n      ${PRODUCT_FIELDS_BASE}\n      resourceLinks\n    }\n  }\n`;\n\n/**\n * Fallback query for older backend deployments. Identical to the primary\n * minus `resourceLinks`. Consumers see `product.resourceLinks === undefined`\n * and any consumer (e.g. `<ResourceLinks/>`) falls through to prop / default\n * resolution paths.\n */\nconst PUBLIC_PRODUCT_QUERY_FALLBACK = `\n  query PublicProductFallback($slug: String!) {\n    publicProduct(slug: $slug) {\n      ${PRODUCT_FIELDS_BASE}\n    }\n  }\n`;\n\n// ============================================================================\n// Context\n// ============================================================================\n\ninterface ProductContextValue {\n  product: ProductData | null;\n  loading: boolean;\n  error: string | null;\n  hasProvider: boolean;\n  refetch: () => void;\n}\n\nconst ProductContext = createContext<ProductContextValue>({\n  product: null,\n  loading: true,\n  error: null,\n  hasProvider: false,\n  refetch: () => {},\n});\n\n// ============================================================================\n// Provider\n// ============================================================================\n\n/**\n * ProductProvider fetches and provides product metadata to child components.\n * Uses the product slug from WebSDKConfig to fetch from the public API.\n *\n * @example\n * ```tsx\n * <WebSDKProvider config={sdkConfig}>\n *   <ProductProvider>\n *     <App />\n *   </ProductProvider>\n * </WebSDKProvider>\n * ```\n */\nexport function ProductProvider({ children, fallback }: ProductProviderProps) {\n  const client = useWebSDK();\n  const config = useWebSDKConfig();\n  const [product, setProduct] = useState<ProductData | null>(\n    fallback ? (fallback as ProductData) : null,\n  );\n  const [loading, setLoading] = useState(true);\n  const [error, setError] = useState<string | null>(null);\n  const fetchProduct = useCallback(async () => {\n    if (!config.productSlug) {\n      setLoading(false);\n      return;\n    }\n\n    setLoading(true);\n    setError(null);\n\n    try {\n      let result = await client.query<{ publicProduct: ProductData | null }>(\n        PUBLIC_PRODUCT_QUERY,\n        { slug: config.productSlug },\n      );\n\n      // Backwards-compat fallback: if the backend's `publicProduct` schema\n      // doesn't yet expose `resourceLinks` (deployed before\n      // `global-tenant-svc` PR #64), the primary query fails validation\n      // with a \"Cannot query field …\" error and `result.data` is null.\n      // Retry the fallback query that omits `resourceLinks`; consumers\n      // gracefully see `product.resourceLinks === undefined` and fall\n      // through their own resolution paths.\n      const schemaMissingResourceLinks = result.errors?.some((e) =>\n        /Cannot query field [\"']?resourceLinks[\"']?/i.test(e?.message ?? \"\"),\n      );\n      if (schemaMissingResourceLinks) {\n        result = await client.query<{ publicProduct: ProductData | null }>(\n          PUBLIC_PRODUCT_QUERY_FALLBACK,\n          { slug: config.productSlug },\n        );\n      }\n\n      if (result.errors?.length) {\n        setError(result.errors[0]?.message ?? \"Unknown error\");\n      } else if (result.data?.publicProduct) {\n        setProduct(result.data.publicProduct);\n      }\n    } catch (err) {\n      setError(err instanceof Error ? err.message : \"Failed to fetch product\");\n    } finally {\n      setLoading(false);\n    }\n  }, [client, config.productSlug]);\n\n  // Use useLayoutEffect for earliest possible fetch after commit (before paint).\n  // Runs when slug or client changes. Client-side query cache + dedup ensures\n  // no duplicate network requests even if React StrictMode fires this twice.\n  useLayoutEffect(() => {\n    fetchProduct();\n  }, [fetchProduct]);\n\n  const value = useMemo(\n    () => ({\n      product,\n      loading,\n      error,\n      hasProvider: true,\n      refetch: fetchProduct,\n    }),\n    [product, loading, error, fetchProduct],\n  );\n\n  return (\n    <ProductContext.Provider value={value}>{children}</ProductContext.Provider>\n  );\n}\n\n// ============================================================================\n// Hooks\n// ============================================================================\n\n/**\n * Hook to access the current product data.\n *\n * @example\n * ```tsx\n * const { product, loading } = useProduct();\n * if (loading) return <Loading />;\n * return <h1>{product?.name}</h1>;\n * ```\n */\nexport function useProduct(): ProductContextValue {\n  return useContext(ProductContext);\n}\n\n/**\n * Hook to get product-specific configuration.\n * Merges SDK config with fetched product data.\n * Useful for getting reCAPTCHA keys, analytics IDs, etc.\n *\n * @example\n * ```tsx\n * const { recaptchaSiteKey, rybbitSiteId } = useProductConfig();\n * ```\n */\nexport function useProductConfig(): {\n  recaptchaSiteKey: string | null;\n  rybbitSiteId: string | null;\n  contactEmail: string | null;\n  supportEmail: string | null;\n  notificationEmail: string | null;\n  productName: string | null;\n  logoUrl: string | null;\n} {\n  const { product } = useProduct();\n  const config = useWebSDKConfig();\n\n  return {\n    // Prefer product-level config, fall back to SDK config\n    recaptchaSiteKey:\n      product?.recaptchaSiteKey ?? config.recaptchaSiteKey ?? null,\n    rybbitSiteId: product?.rybbitSiteId ?? config.rybbitSiteId ?? null,\n    contactEmail: product?.contactEmail ?? null,\n    supportEmail: product?.supportEmail ?? null,\n    notificationEmail:\n      product?.notificationEmail ?? product?.contactEmail ?? null,\n    productName: product?.name ?? null,\n    logoUrl: product?.logoUrl ?? null,\n  };\n}\n"]}

package/dist/{provider-D_uUM7_e.d.ts → provider-Dwgz4d0r.d.ts}

@@ -1,6 +1,6 @@
 import * as react from 'react';
 import { ReactNode } from 'react';
-import { a as WebSDKClientConfig, W as WebSDKClient } from './graphql-client-BXn6RYV0.js';
+import { a as WebSDKClientConfig, W as WebSDKClient } from './graphql-client-CI9vbgat.js';
 
 interface WebSDKProviderProps {
     /** SDK client configuration */

package/dist/{provider-CUfI8meE.d.mts → provider-MFV1NVqZ.d.mts}

@@ -1,6 +1,6 @@
 import * as react from 'react';
 import { ReactNode } from 'react';
-import { a as WebSDKClientConfig, W as WebSDKClient } from './graphql-client-BXn6RYV0.mjs';
+import { a as WebSDKClientConfig, W as WebSDKClient } from './graphql-client-CI9vbgat.mjs';
 
 interface WebSDKProviderProps {
     /** SDK client configuration */

package/dist/store/index.js

@@ -267,6 +267,26 @@ function sanitizeHeaders(headers) {
     )
   );
 }
+var CF_ACCESS_GATED_HOSTS = /* @__PURE__ */ new Set([
+  "alphagraphql.burdenoff.com",
+  "alphagraphqlworkspaces.burdenoff.com"
+]);
+function cfAccessHeaders(gatewayUrl, cfAccess) {
+  const clientId = cfAccess?.clientId?.trim();
+  const clientSecret = cfAccess?.clientSecret?.trim();
+  if (!clientId || !clientSecret) return {};
+  let host;
+  try {
+    host = new URL(gatewayUrl).hostname.toLowerCase();
+  } catch {
+    return {};
+  }
+  if (!CF_ACCESS_GATED_HOSTS.has(host)) return {};
+  return {
+    "CF-Access-Client-Id": clientId,
+    "CF-Access-Client-Secret": clientSecret
+  };
+}
 
 // src/client/graphql-client.ts
 var _WebSDKClient = class _WebSDKClient {
@@ -349,7 +369,8 @@ var _WebSDKClient = class _WebSDKClient {
         headers: {
           "Content-Type": "application/json",
           "x-product-id": this.config.productId,
-          ...this.config.headers
+          ...this.config.headers,
+          ...cfAccessHeaders(this.config.gatewayUrl, this.config.cfAccess)
         },
         body: JSON.stringify({ query, variables }),
         signal: controller.signal