@flamingo-stack/openframe-frontend-core 0.0.217 → 0.0.218-snapshot.20260602043552

package/src/utils/embed-authed-fetch.ts

@@ -22,6 +22,117 @@
 
 import { applyProxyAuth } from './embed-proxy-auth-storage'
 
+// =============================================================================
+// Host-supplied auth adapter (opt-in)
+// =============================================================================
+
+/**
+ * Hosts that have their own auth model (cookie sessions, app-specific
+ * JWT in localStorage, OAuth access tokens, …) can register an adapter
+ * to override the lib's default `embedProxyAuth` flow. When set, the
+ * adapter's `getHeaders()` result is merged onto every `embedAuthedFetch`
+ * call AFTER the default proxy-auth header step (so adapter headers
+ * win over both caller and proxy values), and `credentials` overrides
+ * the default `'same-origin'` behaviour.
+ *
+ * Default (no adapter): MPH-style proxy-impersonation — bearer + act-as
+ * read from localStorage, `credentials: 'same-origin'`. No consumer
+ * needs to touch this unless they want a different auth model.
+ *
+ * Use cases:
+ *   - openframe-frontend has its own JWT in `localStorage.of_access_token`
+ *     and cookie-based session; register an adapter to attach the JWT
+ *     and request `credentials: 'include'` so cookies travel cross-origin
+ *     to the openframe gateway.
+ *   - Future embed hosts with OAuth access tokens, signed URLs, etc.
+ *
+ * Lifetime: setter is module-level (intentionally — `embedAuthedFetch`
+ * is a plain utility, not a hook, so it can't read React context). Host
+ * runtime providers should call `setEmbedAuthAdapter(...)` on mount and
+ * `setEmbedAuthAdapter(null)` on unmount. Multiple hosts registering at
+ * once is a programming error (one chat panel per app).
+ */
+export interface EmbedAuthAdapter {
+  /** Headers merged onto every embedded-fetch call. Return `{}` to add
+   *  nothing. Called per-request so reactive token refresh sees the latest
+   *  value from your auth store / storage. Values typed as
+   *  `string | undefined` so the common narrowed shape
+   *  `{ Authorization: token ? 'Bearer …' : undefined }` (or a conditional
+   *  `token ? { Authorization: … } : {}`) assigns cleanly — `undefined`
+   *  values are filtered before being merged into the request headers. */
+  getHeaders?: () => Record<string, string | undefined>
+  /** `RequestInit.credentials` mode. Default when no adapter: callers'
+   *  `init.credentials` or `'same-origin'`. Use `'include'` for cookie
+   *  auth against a different origin (CORS + `SameSite=None` required). */
+  credentials?: RequestCredentials
+  /**
+   * Optional 401 self-heal. When a request comes back `401`,
+   * `embedAuthedFetch` calls this once, and — if it resolves `true` —
+   * retries the SAME request exactly once with freshly-recomputed
+   * headers (so a rotated bearer from `getHeaders()` is picked up).
+   * Resolve `false` to surface the 401 to the caller unchanged.
+   *
+   * This is the capability the openframe `apiClient` has had all along
+   * (refresh-the-access-token-then-retry); registering it here gives the
+   * embedded chat/ticket surfaces the same self-healing auth instead of
+   * dying on an expired token. Concurrent 401s are de-duplicated by the
+   * wrapper, so this fires at most once per refresh cycle even when a
+   * stampede of chat requests all expire together — your implementation
+   * does NOT need its own in-flight guard (though a token-refresh manager
+   * that already dedups is harmless).
+   *
+   * Keep it idempotent and side-effect-light: on failure the wrapper just
+   * returns the original 401 — logout/redirect decisions belong to the
+   * host's own auth layer, not to this fetch wrapper.
+   */
+  refresh?: () => Promise<boolean>
+}
+
+/**
+ * The registered adapter is parked on `globalThis`, NOT in a module-private
+ * `let`. Reason: this lib ships multiple entry points (`/utils`,
+ * `/components/chat`, …) and a consumer's bundler can inline this file into
+ * more than one chunk — giving each chunk its OWN module scope. If the host
+ * calls `setEmbedAuthAdapter` from the `/utils` copy while the chat's
+ * `embedAuthedFetch` runs from the `/components/chat` copy, a module-local
+ * `let` would be set on one copy and read as `null` on the other (the exact
+ * "credentials: same-origin, no Bearer, no refresh" symptom). A single
+ * `globalThis` slot is shared across every copy, so registration always
+ * reaches the fetch path.
+ */
+const ADAPTER_GLOBAL_KEY = '__embedAuthedFetchAdapter__'
+
+function getRegisteredAuthAdapter(): EmbedAuthAdapter | null {
+  if (typeof globalThis === 'undefined') return null
+  return (globalThis as Record<string, unknown>)[ADAPTER_GLOBAL_KEY] as EmbedAuthAdapter | null ?? null
+}
+
+function storeRegisteredAuthAdapter(adapter: EmbedAuthAdapter | null): void {
+  if (typeof globalThis === 'undefined') return
+  ;(globalThis as Record<string, unknown>)[ADAPTER_GLOBAL_KEY] = adapter
+}
+
+/**
+ * Register a host-owned auth adapter for `embedAuthedFetch`. Pass `null`
+ * to clear (typically on provider unmount).
+ *
+ * Module-level state — there is one chat panel per app, so a single
+ * registration is sufficient. Calling this twice with different non-null
+ * adapters replaces the previous one (the most recent registration wins);
+ * a `console.warn` flags the overwrite so duplicate-provider mounts get
+ * caught in dev.
+ */
+export function setEmbedAuthAdapter(adapter: EmbedAuthAdapter | null): void {
+  if (adapter && getRegisteredAuthAdapter() && process.env.NODE_ENV !== 'production') {
+    console.warn(
+      '[setEmbedAuthAdapter] overwriting a previously-registered auth ' +
+        'adapter. Two chat-runtime providers should not coexist — verify ' +
+        'mount order and pass `null` from the unmounting provider.',
+    )
+  }
+  storeRegisteredAuthAdapter(adapter)
+}
+
 /**
  * `fetch` wrapper that attaches embed-proxy bearer headers (when
  * present in sessionStorage) and forces `credentials: 'same-origin'`
@@ -40,13 +151,26 @@ import { applyProxyAuth } from './embed-proxy-auth-storage'
  * the current window's origin; cross-origin URLs throw before the bearer
  * leaves the page. This is a defense-in-depth guard for future call sites
  * — there is no legitimate cross-origin use of this fetch wrapper.
+ *
+ * **401 self-heal:** when a registered adapter supplies `refresh`, a `401`
+ * response triggers a single token refresh + retry of the same request
+ * (see `EmbedAuthAdapter.refresh`). This is the openframe `apiClient`'s
+ * refresh-then-retry behaviour, lifted into the lib so embedded surfaces
+ * no longer need a host-side `window.fetch` monkey-patch to survive an
+ * expired access token mid-chat. With no adapter (or no `refresh`), the
+ * 401 passes straight through unchanged.
  */
 export function embedAuthedFetch(url: string, init: RequestInit = {}): Promise<Response> {
+  // Same-origin guard runs SYNCHRONOUSLY (not awaited inside the async
+  // helper below) so a bearer-leaking cross-origin URL throws before any
+  // promise is created — callers and tests rely on the synchronous throw.
   assertSameOrigin(url)
 
   // `applyProxyAuth` accepts `Record<string, string>`; normalize the
-  // caller's headers to that shape. RequestInit accepts `HeadersInit`
-  // which is broader (Headers instance OR array of tuples).
+  // caller's headers to that shape ONCE, up front. RequestInit accepts
+  // `HeadersInit` which is broader (Headers instance OR array of tuples).
+  // We re-derive the per-request headers from this base on every attempt
+  // (initial + post-refresh retry) so a rotated bearer is picked up.
   //
   // When the caller passes no headers, fall back to the same default
   // `applyProxyAuth` uses internally — `Content-Type: application/json` —
@@ -69,14 +193,114 @@ export function embedAuthedFetch(url: string, init: RequestInit = {}): Promise<R
     }
   }
 
-  const { url: authedUrl, headers } = applyProxyAuth(url, baseHeaders)
-  return fetch(authedUrl, {
+  return fetchWithRefresh(url, init, baseHeaders, false)
+}
+
+/**
+ * Single in-flight refresh shared across all concurrent `embedAuthedFetch`
+ * callers. A stampede of chat requests that all 401 at the same moment must
+ * trigger the adapter's `refresh()` ONCE, not N times — otherwise an
+ * expiring session fires a thundering herd of refresh calls at the auth
+ * server. Resets to `null` once settled so the next genuine expiry can
+ * refresh again.
+ */
+// Stored on `globalThis` rather than a module-local so the "single refresh"
+// guarantee survives module duplication. Bundlers can ship more than one copy
+// of this module (e.g. across chunks or a host + embedded build); a per-module
+// variable would let each copy run its own refresh cycle, re-creating the
+// thundering-herd this dedupe exists to prevent.
+const IN_FLIGHT_REFRESH_GLOBAL_KEY = '__embedAuthedFetchInFlightRefresh__'
+
+function getInFlightRefresh(): Promise<boolean> | null {
+  if (typeof globalThis === 'undefined') return null
+  return (
+    ((globalThis as Record<string, unknown>)[IN_FLIGHT_REFRESH_GLOBAL_KEY] as
+      | Promise<boolean>
+      | null
+      | undefined) ?? null
+  )
+}
+
+function setInFlightRefresh(refresh: Promise<boolean> | null): void {
+  if (typeof globalThis === 'undefined') return
+  ;(globalThis as Record<string, unknown>)[IN_FLIGHT_REFRESH_GLOBAL_KEY] = refresh
+}
+
+function dedupedRefresh(): Promise<boolean> {
+  const adapter = getRegisteredAuthAdapter()
+  if (!adapter?.refresh) return Promise.resolve(false)
+  let inFlightRefresh = getInFlightRefresh()
+  if (!inFlightRefresh) {
+    // Wrap in `Promise.resolve` so an adapter that throws synchronously
+    // (rather than rejecting) still funnels through the shared slot and
+    // clears it. A rejected refresh is treated as "could not refresh".
+    inFlightRefresh = Promise.resolve()
+      .then(() => adapter.refresh!())
+      .catch(() => false)
+      .finally(() => {
+        setInFlightRefresh(null)
+      })
+    setInFlightRefresh(inFlightRefresh)
+  }
+  return inFlightRefresh
+}
+
+/**
+ * Core fetch path: merge proxy-auth + adapter headers, issue the request,
+ * and — on a `401` with a refresh-capable adapter — refresh once and retry
+ * the identical request a single time. Mirrors the openframe `apiClient`'s
+ * refresh-then-retry contract (`isRetry` guards against infinite loops).
+ */
+async function fetchWithRefresh(
+  url: string,
+  init: RequestInit,
+  baseHeaders: Record<string, string>,
+  isRetry: boolean,
+): Promise<Response> {
+  // Re-run the merge each attempt: `applyProxyAuth` reads the latest stored
+  // proxy creds and `getHeaders()` reads the latest bearer, so a retry after
+  // refresh carries the rotated token rather than the stale one. `{...baseHeaders}`
+  // keeps the caller's normalized headers immutable across attempts.
+  const { url: authedUrl, headers } = applyProxyAuth(url, { ...baseHeaders })
+
+  // Host-supplied auth adapter layer. Runs AFTER the proxy-auth merge so
+  // adapter headers override both caller and proxy values — the adapter
+  // is the host's explicit "this is my auth model" override, intentionally
+  // last-writer-wins. When no adapter is registered, this is a zero-cost
+  // no-op (object spread of `{}`).
+  const adapter = getRegisteredAuthAdapter()
+  if (adapter?.getHeaders) {
+    // Filter `undefined` values — the adapter type allows them so consumers
+    // don't have to narrow `{ Authorization: token ? '…' : undefined }`-shaped
+    // returns, but `fetch` headers must be strings.
+    for (const [k, v] of Object.entries(adapter.getHeaders())) {
+      if (v !== undefined) headers[k] = v
+    }
+  }
+  const credentials = adapter?.credentials ?? init.credentials ?? 'same-origin'
+
+  const response = await fetch(authedUrl, {
     ...init,
     headers,
-    // Always include Supabase auth cookies. `applyProxyAuth` handles
-    // the bearer header layer; cookies are the session-tier carrier.
-    credentials: init.credentials ?? 'same-origin',
+    // Default `same-origin` carries Supabase cookies for the MPH proxy-
+    // auth model. Hosts on different origins (openframe-frontend ↔
+    // openframe gateway) register `credentials: 'include'` via the
+    // adapter to make their own cookies travel cross-origin (CORS +
+    // `SameSite=None` must be configured server-side for that to work).
+    credentials,
   })
+
+  // 401 self-heal: refresh the token once and retry. Only when an adapter
+  // opted into `refresh`, and only on the first attempt — a 401 on the
+  // retry means the fresh token is also unauthorized, so surface it.
+  if (response.status === 401 && !isRetry && adapter?.refresh) {
+    const refreshed = await dedupedRefresh()
+    if (refreshed) {
+      return fetchWithRefresh(url, init, baseHeaders, true)
+    }
+  }
+
+  return response
 }
 
 /**
@@ -118,6 +342,22 @@ function assertSameOrigin(url: string): void {
     )
   }
   if (target.origin !== pageOrigin) {
+    // Dev-mode escape hatch — embedded apps (e.g. openframe-frontend)
+    // run on a different origin from their gateway during local dev,
+    // and forcing a Next.js `rewrites()` workaround is more error-prone
+    // than relaxing the guard for the dev build. In production
+    // (`NODE_ENV === 'production'`) the guard stays absolute — same
+    // defense-in-depth bearer-leak protection as before. The check is
+    // baked at build time by Next/webpack/Turbopack so prod bundles
+    // contain only the throwing branch (no dev string in the artifact).
+    if (process.env.NODE_ENV !== 'production') {
+      console.warn(
+        `[embedAuthedFetch] cross-origin fetch to ${target.origin} ` +
+          `allowed in dev (NODE_ENV !== 'production'). Production builds ` +
+          `will reject this — wire a same-origin proxy before shipping.`,
+      )
+      return
+    }
     throw new Error(
       `embedAuthedFetch: refusing cross-origin fetch to ${target.origin} — pass a relative /api/* path instead`,
     )

package/src/utils/index.ts

@@ -20,6 +20,14 @@ export * from './validation-utils'
 export * from './confidence-helpers'
 // Release date formatting utilities
 export * from './date-formatters'
+// Product-release card helpers (lifted from the hub so every embedder gets the
+// rich card metadata): badge-color mapping + cover-image fallback resolution.
+export * from './release-badge'
+export * from './release-cover'
+// Dev-center URL param keys — the ONE source for the `?search=` / `?status=` / … keys the
+// chrome registry writes and the list views read; re-exported so embedders (and the hub's
+// dev-section-url helper) build deep-links with the same keys instead of a bare literal.
+export { DEV_SECTION_PARAM_KEYS } from './dev-sections/dev-section-param-keys'
 // Dynamic icon registry — single source of truth lives at
 // components/chat/utils/icon-registry. Re-exported here so existing
 // `@flamingo-stack/openframe-frontend-core/utils` callers (hub admin
@@ -120,7 +128,11 @@ export {
 // surfaces from importing a chat-prefixed symbol. Old chat-prefixed
 // aliases are kept as @deprecated re-exports at
 // `components/chat/utils/chat-authed-fetch.ts` + `chat-proxy-auth-storage.ts`.
-export { embedAuthedFetch } from './embed-authed-fetch'
+export {
+  embedAuthedFetch,
+  setEmbedAuthAdapter,
+  type EmbedAuthAdapter,
+} from './embed-authed-fetch'
 export {
   type EmbedProxyAuth,
   getEmbedProxyAuth,
@@ -212,3 +224,21 @@ export {
   type ScrollElementIntoViewOptions,
   scrollElementIntoView,
 } from './scroll-into-view'
+
+// Shared list-API URL builder — the single source for the per-type chat
+// entity-card fetch shapes. The hub's 12 RAG mapper `listApi` closures
+// delegate here (byte-parity test guards the migration); embedders wire
+// `endpoints.buildListUrl = (t, ids) => buildListUrl(t, ids, '/content')`.
+// Pure + server-safe (the hub imports it server-side from this barrel).
+export { buildListUrl } from './list-url'
+
+// Embedder-configurable content-URL composer for the existing
+// `runtime.composeContentUrl` seam — relative href for host-served types,
+// hub origin for the rest. Pure + server-safe.
+export {
+  DEFAULT_CONTENT_SUFFIXES,
+  makeComposeContentUrl,
+  buildDefaultHref,
+  type ContentHrefOptions,
+  type ComposeContentUrl,
+} from './content-href'

package/src/utils/list-url.ts

@@ -0,0 +1,94 @@
+/**
+ * Shared list-API URL builder — the single un-replicable piece of the
+ * chat entity-card fetch path.
+ *
+ * ## Why this exists
+ *
+ * A fetch-mode entity card (`dispatch.tsx` → `useChatCardItem`) expands a
+ * compact `[card://<type>:<id>]` marker by fetching the type's public list
+ * endpoint with an `?ids=` (or `?task_ids=`) filter and matching the row
+ * back by id. The per-type URL SHAPE is non-obvious — `task_ids` for the
+ * ClickUp-backed types, `pageSize` for blog, `&limit=N&filter=all` for the
+ * programs trio, a distinct `/customer-interviews` path, etc. — and lives in
+ * the hub's 12 RAG mapper closures (`lib/config/rag-mappers/*.ts`). An
+ * embedder can't reverse-engineer those shapes, so a wrong/missing builder
+ * resolves a null URL ⇒ `enabled:false` ⇒ the card never fetches and renders
+ * nothing.
+ *
+ * This builder is the ONE source for those shapes. The hub's 12 mappers
+ * delegate their `listApi` here (a byte-parity test guards the migration),
+ * and embedders wire it once:
+ *
+ *   endpoints.buildListUrl = (type, ids) => buildListUrl(type, ids, '/content')
+ *
+ * `base=''` (default) yields the hub-relative `/api/...`; `base='/content'`
+ * (or any reverse-proxy prefix) yields `/content/api/...`.
+ *
+ * Pure + server-safe (no React, no browser APIs) so the hub's server-side
+ * mappers can import it from `@flamingo-stack/openframe-frontend-core/utils`.
+ */
+
+/**
+ * Legacy ContentRef aliases that predate the RAG `documentType`
+ * unification — direct lib/embedder callers (e.g. the chat dispatcher's
+ * `endpoints.buildListUrl`) still emit `blog_post_existing`. Mirrors the
+ * hub's own `LEGACY_TYPE_ALIASES` (`lib/utils/entity-list-api.ts`); both
+ * entry points un-alias to the canonical `documentType` before lookup.
+ */
+const ALIASES: Record<string, string> = { blog_post_existing: 'blog_post' }
+
+/**
+ * One builder per fetch-mode `contentRefType`, keyed by the canonical
+ * `documentType`. Each body is copied VERBATIM from the matching hub
+ * mapper's `listApi` (raw, unencoded `join(',')`; exact param names) —
+ * the byte-parity test (`__tests__/list-url.test.ts`) fails if any drifts.
+ *
+ * An ABSENT key ⇒ `buildListUrl` returns null (no-fetch). The no-list
+ * types (`github_*`, `slack_message`, financials, docs) are intentionally
+ * NOT enumerated here — their absence IS the null. `marketing_campaign`
+ * is handled as a literal case in `buildListUrl` (see there).
+ */
+const BUILDERS: Record<string, (ids: string[], base: string) => string> = {
+  roadmap_item: (ids, b) => `${b}/api/roadmap?task_ids=${ids.join(',')}`,
+  delivery_item: (ids, b) => `${b}/api/delivery?task_ids=${ids.join(',')}`,
+  internal_task: (ids, b) => `${b}/api/internal-tasks?task_ids=${ids.join(',')}`,
+  blog_post: (ids, b) => `${b}/api/blog/posts?ids=${ids.join(',')}&pageSize=${ids.length}`,
+  webinar: (ids, b) => `${b}/api/programs/webinars?ids=${ids.join(',')}&limit=${ids.length}&filter=all`,
+  podcast: (ids, b) => `${b}/api/programs/podcasts?ids=${ids.join(',')}&limit=${ids.length}&filter=all`,
+  event: (ids, b) => `${b}/api/programs/events?ids=${ids.join(',')}&limit=${ids.length}&filter=all`,
+  onboarding_guide: (ids, b) => `${b}/api/onboarding-guides?ids=${ids.join(',')}&limit=${ids.length}`,
+  case_study: (ids, b) => `${b}/api/case-studies?ids=${ids.join(',')}&limit=${ids.length}`,
+  product_release: (ids, b) => `${b}/api/releases?ids=${ids.join(',')}&limit=${ids.length}`,
+  customer_interview: (ids, b) => `${b}/api/customer-interviews?ids=${ids.join(',')}&limit=${ids.length}`,
+  investor_update: (ids, b) => `${b}/api/investor-updates?ids=${ids.join(',')}&limit=${ids.length}`,
+}
+
+/**
+ * Build a list-API URL that returns full rows for the given ids, or `null`
+ * when the type has no list endpoint (the caller skips fetching rather than
+ * fabricating a URL).
+ *
+ *   buildListUrl('roadmap_item', ['a','b'])             → '/api/roadmap?task_ids=a,b'
+ *   buildListUrl('blog_post_existing', ['a','b'])       → '/api/blog/posts?ids=a,b&pageSize=2'  (alias)
+ *   buildListUrl('roadmap_item', ['a','b'], '/content') → '/content/api/roadmap?task_ids=a,b'
+ *   buildListUrl('github_pr', ['a'])                    → null  (absent key)
+ *
+ * `marketing_campaign` (admin-only, non-RAG) is a LITERAL case, NOT a
+ * `BUILDERS` entry — a static branch keeps CodeQL able to prove no
+ * user-controlled dynamic dispatch reaches the admin endpoint; embedders
+ * can't hit `/api/admin` through their proxy anyway.
+ */
+export function buildListUrl(contentRefType: string, ids: string[], base = ''): string | null {
+  if (ids.length === 0) return null
+  const key = ALIASES[contentRefType] ?? contentRefType
+  if (key === 'marketing_campaign') {
+    // Keep this URL in sync with the hub's `entity-list-api.ts` buildNonRagListUrl
+    // — an intentional dual literal (a static branch in each) so CodeQL can prove
+    // no user-controlled dynamic dispatch reaches `/api/admin`.
+    return `${base}/api/admin/marketing/campaigns?ids=${ids.join(',')}&pageSize=${ids.length}`
+  }
+  // `hasOwnProperty` guard so a prototype key (`constructor`, `__proto__`)
+  // can't dispatch to a non-builder — absent key ⇒ null.
+  const fn = Object.prototype.hasOwnProperty.call(BUILDERS, key) ? BUILDERS[key] : undefined
+  return fn ? fn(ids, base) : null
+}

package/src/utils/release-badge.ts

@@ -0,0 +1,46 @@
+/**
+ * Single source of truth for mapping a product release's `release_type` to
+ * the `StatusBadge` colorScheme used in the `ProductReleaseCard` lg variant's
+ * metadata-grid Type cell. Every surface that renders a
+ * `<ProductReleaseCard size="lg" ...>` must pass this value as
+ * `releaseTypeBadgeColor` or the card falls back to a `'—'` placeholder
+ * (the card requires BOTH `releaseType && releaseTypeBadgeColor` to paint a
+ * colored badge).
+ *
+ * Mapping mirrors the visual hierarchy operators expect at a glance:
+ *   major  → error   (red, breaking change)
+ *   minor  → cyan    (accent, feature)
+ *   patch  → success (green, safe bump)
+ *   beta/alpha → warning (yellow, preview)
+ *
+ * (Lifted from the hub so every embedder — not just the hub — gets the rich
+ * card metadata. The admin form's `releaseTypeOptions.color` array uses a
+ * different color vocabulary — different concern; don't unify here.)
+ */
+export type ReleaseType = 'major' | 'minor' | 'patch' | 'beta' | 'alpha'
+export type ReleaseTypeBadgeColor = 'error' | 'cyan' | 'success' | 'warning'
+
+/**
+ * Accepts a wider input type than `ReleaseType` because list-API rows can
+ * carry legacy / unenforced `release_type` values. Returns `undefined` for
+ * unknown values — the card guards on `releaseType && releaseTypeBadgeColor`
+ * to decide whether to render a colored badge or fall back to an em-dash, so
+ * an undefined return is the correct failure mode (badge hidden), not a crash.
+ */
+export function releaseTypeToBadgeColor(
+  t: ReleaseType | string | null | undefined,
+): ReleaseTypeBadgeColor | undefined {
+  switch (t) {
+    case 'major':
+      return 'error'
+    case 'minor':
+      return 'cyan'
+    case 'patch':
+      return 'success'
+    case 'beta':
+    case 'alpha':
+      return 'warning'
+    default:
+      return undefined
+  }
+}

package/src/utils/release-cover.ts

@@ -0,0 +1,46 @@
+/**
+ * Single source of truth for the ProductReleaseCard cover-image fallback
+ * priority. Every surface that renders a `<ProductReleaseCard>` (catalog row,
+ * chat-inline dispatcher, chat wrapper) computes the cover via this helper —
+ * adding a new fallback source or reordering the priority is ONE edit.
+ *
+ * **Priority** (intentional):
+ *   1. `featured_image` — editor-curated cover, always wins.
+ *   2. `highlight_video_thumbnail` — AI-generated highlight reel thumb.
+ *   3. `main_video_thumbnail` — full-release video thumb.
+ *   4. `og_image_url` — SEO fallback.
+ *   5. `null` — caller renders the entity placeholder.
+ *
+ * **`hasVideoCover`** fires ONLY when the active cover is a video thumb
+ * (priority 2 or 3). When the editor configured a still `featured_image`, a
+ * Play overlay would be misleading and is suppressed.
+ *
+ * Operator note: `||` (not `??`) so empty-string DB values fall through to the
+ * next fallback rather than rendering `<Image src="">`.
+ *
+ * (Lifted from the hub so the rich `buildProductReleaseCardProps` works in the
+ * lib / any embedder, not just the hub.)
+ */
+
+export interface ReleaseCoverSource {
+  featured_image?: string | null
+  highlight_video_thumbnail?: string | null
+  main_video_thumbnail?: string | null
+  og_image_url?: string | null
+}
+
+export interface ReleaseCoverResult {
+  cover: string | null
+  hasVideoCover: boolean
+}
+
+export function resolveReleaseCover(r: ReleaseCoverSource): ReleaseCoverResult {
+  const cover =
+    r.featured_image ||
+    r.highlight_video_thumbnail ||
+    r.main_video_thumbnail ||
+    r.og_image_url ||
+    null
+  const hasVideoCover = !r.featured_image && !!(r.highlight_video_thumbnail || r.main_video_thumbnail)
+  return { cover, hasVideoCover }
+}

package/dist/chunk-664KA5FI.cjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["/home/runner/work/openframe-oss-lib/openframe-oss-lib/openframe-frontend-core/dist/chunk-664KA5FI.cjs","../src/utils/cn.ts"],"names":[],"mappings":"AAAA,qFAAY;AACZ;AACE;AACF,wDAA6B;AAC7B;AACA;ACLA,4BAAsC;AACtC,+CAAoC;AAa7B,SAAS,EAAA,CAAA,GAAM,MAAA,EAAsB;AAC1C,EAAA,OAAO,OAAA,CAAQ,wBAAA,MAAW,CAAC,CAAA;AAC7B;AAKO,SAAS,wBAAA,CAAyB,QAAA,EAA0B;AACjE,EAAA,OAAA,CAAQ,QAAA,EAAU;AAAA;AAAA,IAEhB,KAAK,eAAA;AACH,MAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,8BAAA,GAAiC,mCAAA;AAAA,IACtD,KAAK,aAAA;AACH,MAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,4BAAA,GAA+B,iCAAA;AAAA,IACpD,KAAK,aAAA;AACH,MAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,4BAAA,GAA+B,iCAAA;AAAA,IACpD,KAAK,aAAA;AACH,MAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,4BAAA,GAA+B,iCAAA;AAAA,IACpD,KAAK,YAAA;AACH,MAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,2BAAA,GAA8B,gCAAA;AAAA;AAAA,IAEnD,KAAK,SAAA;AACH,MAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,wBAAA,GAA2B,wBAAA;AAAA,IAChD,KAAK,UAAA;AACH,MAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,yBAAA,GAA4B,0BAAA;AAAA,IACjD,KAAK,MAAA;AACH,MAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,qBAAA,GAAwB,wBAAA;AAAA,IAC7C,KAAK,iBAAA;AACH,MAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,yBAAA,GAA4B,0BAAA;AAAA,IACjD,KAAK,WAAA;AACH,MAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,0BAAA,GAA6B,sBAAA;AAAA,IAClD,KAAK,WAAA;AACH,MAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,yBAAA,GAA4B,0BAAA;AAAA,IACjD,OAAA;AACE,MAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,yBAAA,GAA4B,0BAAA;AAAA,EACnD;AACF;AAeO,SAAS,yBAAA,CAAA,EAAsC;AACpD,EAAA,GAAA,CAAI,OAAO,OAAA,IAAW,WAAA,EAAa,OAAO,CAAC,CAAA;AAE3C,EAAA,MAAM,SAAA,EAAW,MAAA,CAAO,QAAA,CAAS,QAAA;AAGjC,EAAA,GAAA,CAAI,SAAA,IAAa,YAAA,GACb,SAAA,IAAa,YAAA,GACb,QAAA,CAAS,UAAA,CAAW,MAAM,CAAA,EAAG;AAC/B,IAAA,OAAO,CAAC,CAAA;AAAA,EACV;AAGA,EAAA,MAAM,gBAAA,EAAkB,OAAA,CAAQ,GAAA,CAAI,WAAA,IAAe,UAAA,GAC5B,OAAA,CAAQ,GAAA,CAAI,uBAAA,IAA2B,UAAA,GACvC,QAAA,CAAS,QAAA,CAAS,aAAa,CAAA;AAEtD,EAAA,GAAA,CAAI,eAAA,EAAiB;AACnB,IAAA,OAAO,CAAC,aAAA,EAAe,YAAY,CAAA;AAAA,EACrC;AAKA,EAAA,MAAM,oBAAA,EAAsB;AAAA,IAC1B,eAAA;AAAA,IAAiB,aAAA;AAAA,IAAe,aAAA;AAAA,IAAe,aAAA;AAAA,IAAe,YAAA;AAAA,IAC9D,SAAA;AAAA,IAAW,UAAA;AAAA,IAAY,MAAA;AAAA,IAAQ,iBAAA;AAAA,IAAmB,WAAA;AAAA,IAAa;AAAA,EACjE,CAAA;AAEA,EAAA,MAAM,YAAA,kBAAc,IAAI,GAAA,CAAY,CAAA;AAEpC,EAAA,mBAAA,CAAoB,OAAA,CAAQ,CAAA,QAAA,EAAA,GAAY;AACtC,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,EAAM,wBAAA,CAAyB,QAAQ,CAAA;AAC7C,MAAA,MAAM,YAAA,EAAc,IAAI,GAAA,CAAI,GAAG,CAAA,CAAE,QAAA;AACjC,MAAA,MAAM,MAAA,EAAQ,WAAA,CAAY,KAAA,CAAM,GAAG,CAAA;AAEnC,MAAA,GAAA,CAAI,KAAA,CAAM,OAAA,GAAU,CAAA,EAAG;AACrB,QAAA,MAAM,WAAA,EAAa,KAAA,CAAM,KAAA,CAAM,CAAA,CAAE,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AAC3C,QAAA,WAAA,CAAY,GAAA,CAAI,CAAA,CAAA,EAAI,UAAU,CAAA,CAAA;AACJ,QAAA;AAC5B,MAAA;AACc,IAAA;AACD,MAAA;AACf,IAAA;AACD,EAAA;AAE4B,EAAA;AAC/B;AAqCsD;AAEvB,EAAA;AACR,IAAA;AACrB,EAAA;AAGc,EAAA;AACoB,IAAA;AAClC,EAAA;AAGgB,EAAA;AACgB,IAAA;AAChC,EAAA;AAKO,EAAA;AACT;AAvKM;AAHN;AAAA,EAAA;AAAA,IAAA;AAGsD,IAAA;AAC5C,MAAA;AACO,QAAA;AACQ,UAAA;AACrB,QAAA;AACF,MAAA;AACD,IAAA;AAAA,EAAA;AAAA;ADiGsC;AACA;AACA;AACA;AACA;AACA;AACA;AACA","file":"/home/runner/work/openframe-oss-lib/openframe-oss-lib/openframe-frontend-core/dist/chunk-664KA5FI.cjs","sourcesContent":[null,"import { clsx, type ClassValue } from \"clsx\"\nimport { extendTailwindMerge } from \"tailwind-merge\"\n\nconst twMerge = extendTailwindMerge<'ods-typography'>({\n  extend: {\n    classGroups: {\n      'ods-typography': ['text-h1', 'text-h2', 'text-h3', 'text-h4', 'text-h5', 'text-h6'],\n    },\n  },\n})\n\n/**\n * Combine class names with Tailwind's merge utility\n */\nexport function cn(...inputs: ClassValue[]) {\n  return twMerge(clsx(inputs))\n}\n\n/**\n * Platform URL mappings for production (with environment variable overrides)\n */\nexport function getPlatformProductionUrl(platform: string): string {\n  switch (platform) {\n    // *-hub platforms — env var convention: NEXT_PUBLIC_<NAME>_HUB_URL\n    case 'marketing-hub':\n      return process.env.NEXT_PUBLIC_MARKETING_HUB_URL || 'https://marketing-hub.flamingo.so';\n    case 'company-hub':\n      return process.env.NEXT_PUBLIC_COMPANY_HUB_URL || 'https://company-hub.flamingo.so';\n    case 'product-hub':\n      return process.env.NEXT_PUBLIC_PRODUCT_HUB_URL || 'https://product-hub.flamingo.so';\n    case 'revenue-hub':\n      return process.env.NEXT_PUBLIC_REVENUE_HUB_URL || 'https://revenue-hub.flamingo.so';\n    case 'people-hub':\n      return process.env.NEXT_PUBLIC_PEOPLE_HUB_URL || 'https://people-hub.flamingo.so';\n    // Standalone platforms — env var convention: NEXT_PUBLIC_<NAME>_URL\n    case 'openmsp':\n      return process.env.NEXT_PUBLIC_OPENMSP_URL || 'https://www.openmsp.ai';\n    case 'flamingo':\n      return process.env.NEXT_PUBLIC_FLAMINGO_URL || 'https://www.flamingo.run';\n    case 'tmcg':\n      return process.env.NEXT_PUBLIC_TMCG_URL || 'https://www.tmcg.miami';\n    case 'flamingo-teaser':\n      return process.env.NEXT_PUBLIC_FLAMINGO_URL || 'https://www.flamingo.run';\n    case 'openframe':\n      return process.env.NEXT_PUBLIC_OPENFRAME_URL || 'https://openframe.ai';\n    case 'universal':\n      return process.env.NEXT_PUBLIC_FLAMINGO_URL || 'https://www.flamingo.run';\n    default:\n      return process.env.NEXT_PUBLIC_FLAMINGO_URL || 'https://www.flamingo.run';\n  }\n}\n\n/**\n * Get ALL unique base domains from getPlatformProductionUrl\n *\n * Extracts domains by calling getPlatformProductionUrl for each platform identifier.\n * Platform identifiers match the switch cases in getPlatformProductionUrl.\n *\n * Handles 3 cases:\n * 1. LOCALHOST DEBUG - No domain (hostname-specific cookies)\n * 2. VERCEL PREVIEW (*.vercel.app) - Use vercel.app domain\n * 3. PRODUCTION - Extract from ALL platform URLs via getPlatformProductionUrl\n *\n * @returns Array of all unique base domains (with and without wildcard)\n */\nexport function getAllPlatformBaseDomains(): string[] {\n  if (typeof window === 'undefined') return []\n\n  const hostname = window.location.hostname\n\n  // Case 1: LOCALHOST DEBUG - no domains needed\n  if (hostname === 'localhost' ||\n      hostname === '127.0.0.1' ||\n      hostname.startsWith('127.')) {\n    return []\n  }\n\n  // Case 2: VERCEL PREVIEW - use vercel.app domain\n  const isVercelPreview = process.env.VERCEL_ENV === 'preview' ||\n                         process.env.NEXT_PUBLIC_VERCEL_ENV === 'preview' ||\n                         hostname.includes('.vercel.app')\n\n  if (isVercelPreview) {\n    return ['.vercel.app', 'vercel.app']\n  }\n\n  // Case 3: PRODUCTION - extract from ALL platforms using getPlatformProductionUrl\n  // Platform identifiers MUST match switch cases in getPlatformProductionUrl —\n  // otherwise the corresponding domain is omitted from cookie scope.\n  const platformIdentifiers = [\n    'marketing-hub', 'company-hub', 'product-hub', 'revenue-hub', 'people-hub',\n    'openmsp', 'flamingo', 'tmcg', 'flamingo-teaser', 'openframe', 'universal'\n  ]\n\n  const baseDomains = new Set<string>()\n\n  platformIdentifiers.forEach(platform => {\n    try {\n      const url = getPlatformProductionUrl(platform)\n      const urlHostname = new URL(url).hostname\n      const parts = urlHostname.split('.')\n\n      if (parts.length >= 2) {\n        const baseDomain = parts.slice(-2).join('.')\n        baseDomains.add(`.${baseDomain}`) // Wildcard\n        baseDomains.add(baseDomain) // Non-wildcard\n      }\n    } catch (error) {\n      console.warn('[Platform Domains] Failed to parse URL for platform:', platform, error)\n    }\n  })\n\n  return Array.from(baseDomains)\n}\n\n/**\n * Get the application base URL for the current environment\n *\n * @param platform - Optional platform name (openmsp, flamingo, tmcg, openframe, etc.)\n * @returns The base URL with protocol (https:// or http://)\n *\n * Priority order:\n * 1. Environment variable override (NEXT_PUBLIC_*_URL)\n * 2. Platform-specific URL (if platform parameter provided)\n * 3. VERCEL_PROJECT_PRODUCTION_URL (Vercel production domain)\n * 4. Production fallback (current app or openmsp)\n * 5. Development (http://localhost:3000)\n *\n * Environment Variables (optional overrides — only set when production domain\n * differs from the hardcoded default):\n *\n * Hub deployments (NEXT_PUBLIC_<NAME>_HUB_URL):\n * - NEXT_PUBLIC_MARKETING_HUB_URL  -> marketing-hub.flamingo.so\n * - NEXT_PUBLIC_COMPANY_HUB_URL    -> company-hub.flamingo.so\n * - NEXT_PUBLIC_PRODUCT_HUB_URL    -> product-hub.flamingo.so\n * - NEXT_PUBLIC_REVENUE_HUB_URL    -> revenue-hub.flamingo.so\n * - NEXT_PUBLIC_PEOPLE_HUB_URL     -> people-hub.flamingo.so\n *\n * Standalone platforms (NEXT_PUBLIC_<NAME>_URL):\n * - NEXT_PUBLIC_OPENMSP_URL          -> www.openmsp.ai\n * - NEXT_PUBLIC_FLAMINGO_URL         -> www.flamingo.run\n * - NEXT_PUBLIC_TMCG_URL             -> www.tmcg.miami\n * - NEXT_PUBLIC_FLAMINGO_TEASER_URL  -> www.flamingo.cx\n * - NEXT_PUBLIC_OPENFRAME_URL        -> openframe.ai\n *\n * @example\n * getBaseUrl() // Current app URL\n * getBaseUrl('flamingo') // https://www.flamingo.run (production) or http://localhost:3000 (dev)\n * getBaseUrl('openmsp') // https://www.openmsp.ai (or NEXT_PUBLIC_OPENMSP_URL if set)\n */\nexport function getBaseUrl(platform?: string): string {\n  // In development, always use localhost (regardless of platform)\n  if (process.env.NODE_ENV !== 'production') {\n    return process.env.NEXT_PUBLIC_DEV_URL || 'http://localhost:3000'\n  }\n\n  // If platform is specified, return its production URL with env variable override support\n  if (platform) {\n    return getPlatformProductionUrl(platform)\n  }\n\n  // Production: Use Vercel domain if available\n  if (process.env.VERCEL_PROJECT_PRODUCTION_URL) {\n    return `https://${process.env.VERCEL_PROJECT_PRODUCTION_URL}`\n  }\n\n  // Production fallback: Use canonical www domain to avoid Google \"Page with redirect\" issue.\n  // openmsp.ai redirects to www.openmsp.ai, so we set the base URL to the\n  // final destination to ensure canonical URLs do not require a redirect.\n  return 'https://www.openmsp.ai'\n}\n"]}