@shuffleio/shuffle-mcps 0.0.40 → 0.0.46

package/dist/{appsCache-EFH5WV4I.mjs → appsCache-ITT5ZZQS.mjs}

@@ -2,7 +2,7 @@ import {
   fetchApps,
   fetchAppsViaApiConfig,
   invalidateAppsCache
-} from "./chunk-5LZ5IZ2O.mjs";
+} from "./chunk-45B7UK6Q.mjs";
 export {
   fetchApps,
   fetchAppsViaApiConfig,

package/dist/{chunk-5LZ5IZ2O.mjs → chunk-45B7UK6Q.mjs}

@@ -1,4 +1,40 @@
 // fetchBreaker.ts
+var rewriteShufflerApiToShuffleSecurity = (input) => {
+  if (typeof window === "undefined") return input;
+  const currentHost = window.location.hostname.toLowerCase();
+  const isOnShuffleSecurity = currentHost === "shuffle.security" || currentHost.endsWith(".shuffle.security") || currentHost === "localhost" || currentHost === "127.0.0.1" || currentHost.includes("lovable");
+  if (!isOnShuffleSecurity) return input;
+  let urlStr = null;
+  if (typeof input === "string") urlStr = input;
+  else if (input instanceof URL) urlStr = input.toString();
+  else if (input && typeof input.url === "string") urlStr = input.url;
+  if (!urlStr) return input;
+  if (!urlStr.includes("/api/") || urlStr.includes("/api/v1/auth/exchange")) {
+    return input;
+  }
+  try {
+    const u = new URL(urlStr, window.location.href);
+    const host = u.hostname.toLowerCase();
+    if (host === "shuffler.io" || host === "www.shuffler.io") {
+      u.protocol = "https:";
+      u.hostname = "uk.shuffle.security";
+      const rewritten = u.toString();
+      if (typeof input === "string") return rewritten;
+      if (input instanceof URL) return new URL(rewritten);
+      if (typeof Request !== "undefined" && input instanceof Request) return new Request(rewritten, input);
+    } else if (host.endsWith(".shuffler.io")) {
+      const subdomain = host.slice(0, -".shuffler.io".length);
+      u.protocol = "https:";
+      u.hostname = `${subdomain}.shuffle.security`;
+      const rewritten = u.toString();
+      if (typeof input === "string") return rewritten;
+      if (input instanceof URL) return new URL(rewritten);
+      if (typeof Request !== "undefined" && input instanceof Request) return new Request(rewritten, input);
+    }
+  } catch {
+  }
+  return input;
+};
 var FAIL_THRESHOLD = 12;
 var ROLLING_WINDOW_MS = 5e3;
 var COOLDOWN_MS = 1e4;
@@ -64,12 +100,24 @@ var withStoredAuth = (input, init) => {
     if (url.pathname === "/api/v1/login" || url.pathname === "/api/v1/users/register") return init;
     const sessionToken = window.localStorage.getItem("session_token");
     const token = sessionToken && sessionToken.trim().length > 0 ? sessionToken.trim() : null;
+    const authMode = window.localStorage.getItem("shuffle_auth_mode");
+    const isCapacitor = Boolean(
+      window.Capacitor?.isNativePlatform?.() || window._isCapacitorNative
+    );
     const requestHeaders = typeof Request !== "undefined" && input instanceof Request ? input.headers : void 0;
     const headers = new Headers(requestHeaders);
     if (init?.headers) {
       new Headers(init.headers).forEach((value, name) => headers.set(name, value));
     }
-    if (token && !headers.has("Authorization")) {
+    const rootDomain = (host) => {
+      const parts = host.split(".");
+      return parts.length <= 2 ? host : parts.slice(-2).join(".");
+    };
+    const backendHost = url.hostname.toLowerCase();
+    const frontendHost = window.location.hostname.toLowerCase();
+    const isLocalPair = ["localhost", "127.0.0.1"].includes(backendHost) && ["localhost", "127.0.0.1"].includes(frontendHost);
+    const isCrossDomain = backendHost !== frontendHost && !isLocalPair && rootDomain(backendHost) !== rootDomain(frontendHost);
+    if (token && (authMode === "bearer" || isCapacitor || isCrossDomain) && !headers.has("Authorization")) {
       headers.set("Authorization", `Bearer ${token}`);
     }
     if (!headers.has("Org-Id")) {
@@ -117,9 +165,10 @@ var installFetchBreaker = () => {
   installed = true;
   const original = window.fetch.bind(window);
   window.fetch = (async (input, init) => {
-    const authenticatedInit = withStoredAuth(input, init);
-    const key = keyFor(input, authenticatedInit);
-    if (!key) return original(input, authenticatedInit);
+    const finalInput = rewriteShufflerApiToShuffleSecurity(input);
+    const authenticatedInit = withStoredAuth(finalInput, init);
+    const key = keyFor(finalInput, authenticatedInit);
+    if (!key) return original(finalInput, authenticatedInit);
     const entry = getEntry(key);
     const now = Date.now();
     let isProbe = false;
@@ -153,7 +202,7 @@ var installFetchBreaker = () => {
     };
     let response;
     try {
-      response = await original(input, authenticatedInit);
+      response = await original(finalInput, authenticatedInit);
     } catch (err) {
       const ts = Date.now();
       entry.failures.push(ts);
@@ -240,23 +289,26 @@ var getShuffleCoreBaseUrl = () => {
       if (savedCore && savedCore.trim().length > 0) {
         return savedCore.trim().replace(/\/+$/, "");
       }
+    } catch {
+    }
+  }
+  if (typeof window !== "undefined" && isManagedDomain()) {
+    return "https://shuffler.io";
+  }
+  if (typeof window !== "undefined") {
+    try {
       const customHost = localStorage.getItem("shuffle_custom_host_url");
       if (customHost && customHost.trim().length > 0) {
         const cleaned = customHost.trim().replace(/\/+$/, "");
         if (cleaned.includes(":5001")) {
           return cleaned.replace(":5001", ":3001");
         }
-        return cleaned;
       }
     } catch {
     }
   }
   if (typeof window !== "undefined") {
     const hostname = window.location.hostname;
-    const isManaged = isManagedDomain();
-    if (isManaged) {
-      return "https://shuffler.io";
-    }
     if (window.location.port === "3001") {
       return window.location.origin;
     }
@@ -270,6 +322,212 @@ var getShuffleCoreUrl = (path) => {
   const cleanPath = path.startsWith("/") ? path : `/${path}`;
   return `${base}${cleanPath}`;
 };
+var getShuffleSecurityBaseUrl = () => {
+  const envUrl = readEnv("VITE_SHUFFLE_SECURITY_URL") || readEnv("SHUFFLE_SECURITY_URL");
+  if (envUrl) {
+    return envUrl.replace(/\/+$/, "");
+  }
+  if (typeof window !== "undefined") {
+    if (window.location.port !== "3001" && !window.location.hostname.includes("shuffler.io")) {
+      return window.location.origin;
+    }
+    if (window.location.port === "3001") {
+      return `${window.location.protocol}//${window.location.hostname}:3002`;
+    }
+  }
+  return "https://shuffle.security";
+};
+var getShuffleSecurityUrl = (path) => {
+  const base = getShuffleSecurityBaseUrl();
+  if (!path) return base;
+  const cleanPath = path.startsWith("/") ? path : `/${path}`;
+  return `${base}${cleanPath}`;
+};
+var getCurrentShuffleProduct = (override) => {
+  if (override) {
+    const o = override.trim().toLowerCase();
+    if (o === "core" || o === "automation") return "core";
+    if (o === "security") return "security";
+  }
+  if (typeof window !== "undefined") {
+    try {
+      const urlParams = new URLSearchParams(window.location.search);
+      const param = urlParams.get("product") || urlParams.get("shuffle_product");
+      if (param) {
+        const p = param.trim().toLowerCase();
+        if (p === "core" || p === "automation") return "core";
+        if (p === "security") return "security";
+      }
+    } catch {
+    }
+  }
+  const envProduct = readEnv("VITE_SHUFFLE_PRODUCT") || readEnv("SHUFFLE_PRODUCT");
+  if (envProduct) {
+    const p = envProduct.trim().toLowerCase();
+    if (p === "core" || p === "automation") return "core";
+    if (p === "security") return "security";
+  }
+  if (typeof window !== "undefined") {
+    const win = window;
+    if (win.__SHUFFLE_PRODUCT__) {
+      const p = String(win.__SHUFFLE_PRODUCT__).trim().toLowerCase();
+      if (p === "core" || p === "automation") return "core";
+      if (p === "security") return "security";
+    }
+    const hostname = window.location.hostname.toLowerCase();
+    const port = window.location.port;
+    if (port === "3001") return "core";
+    if (port === "3002") return "security";
+    if (hostname.includes("shuffler.io")) {
+      if (hostname.startsWith("security.") || hostname.includes(".security.")) {
+        return "security";
+      }
+      return "core";
+    }
+    if (hostname.includes("shuffle.security")) {
+      return "security";
+    }
+  }
+  return "security";
+};
+var CORE_EXCLUSIVE_PATH_PREFIXES = [
+  "/workflows",
+  "/new-dashboard",
+  "/apps/new"
+];
+var CORE_ADMIN_TABS = ["datastore", "files", "locations", "runtime_locations"];
+var SECURITY_EXCLUSIVE_PATH_PREFIXES = [
+  "/incidents",
+  "/incidents-simple",
+  "/alerts",
+  "/cases",
+  "/monitors",
+  "/vulnerabilities",
+  "/detection",
+  "/assets",
+  "/tickets"
+];
+var isCoreExclusivePath = (path) => {
+  if (!path) return false;
+  const clean = path.startsWith("/") ? path : `/${path}`;
+  const [pathname, search] = clean.split("?");
+  if (CORE_EXCLUSIVE_PATH_PREFIXES.some((prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`))) {
+    return true;
+  }
+  if (pathname === "/admin" && search) {
+    const params = new URLSearchParams(search);
+    const tab = params.get("tab");
+    if (tab && CORE_ADMIN_TABS.includes(tab.toLowerCase())) {
+      return true;
+    }
+  }
+  return false;
+};
+var isSecurityExclusivePath = (path) => {
+  if (!path) return false;
+  const clean = path.startsWith("/") ? path : `/${path}`;
+  const [pathname] = clean.split("?");
+  return SECURITY_EXCLUSIVE_PATH_PREFIXES.some((prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`));
+};
+var resolveProductLink = (href, currentProductOverride) => {
+  const currentProduct = getCurrentShuffleProduct(currentProductOverride);
+  const trimmed = (href || "").trim();
+  if (!trimmed) {
+    return { url: "", isInternal: false, targetProduct: "external", isCrossDomainToCore: false };
+  }
+  if (trimmed.startsWith("#")) {
+    return { url: trimmed, isInternal: true, targetProduct: "doc", isCrossDomainToCore: false };
+  }
+  let pathname = "";
+  let searchAndHash = "";
+  let isAbsolute = false;
+  let isShufflerIoDomain = false;
+  let isShuffleSecurityDomain = false;
+  try {
+    if (/^[a-z][a-z\d+.-]*:/i.test(trimmed)) {
+      isAbsolute = true;
+      const parsed = new URL(trimmed);
+      pathname = parsed.pathname;
+      searchAndHash = `${parsed.search}${parsed.hash}`;
+      const host = parsed.hostname.toLowerCase();
+      if (host === "shuffler.io" || host.endsWith(".shuffler.io") && !host.includes("security.")) {
+        isShufflerIoDomain = true;
+      } else if (host.includes("shuffle.security") || host.includes("security.shuffler.io")) {
+        isShuffleSecurityDomain = true;
+      }
+    } else {
+      const splitIdx = trimmed.search(/[?#]/);
+      if (splitIdx !== -1) {
+        pathname = trimmed.slice(0, splitIdx);
+        searchAndHash = trimmed.slice(splitIdx);
+      } else {
+        pathname = trimmed;
+      }
+    }
+  } catch {
+    pathname = trimmed;
+  }
+  const fullRelativePath = `${pathname}${searchAndHash}`;
+  const isDocPath = /^\/docs(?:\/|$)/i.test(pathname) || /(?:^|\/)\.?\.?\/?[^/#?]+\.md(?:$|[?#])/i.test(trimmed);
+  if (isDocPath) {
+    return {
+      url: fullRelativePath,
+      isInternal: true,
+      targetProduct: "doc",
+      isCrossDomainToCore: false
+    };
+  }
+  const targetsCore = isCoreExclusivePath(fullRelativePath) || isShufflerIoDomain;
+  const targetsSecurity = isSecurityExclusivePath(fullRelativePath) || isShuffleSecurityDomain;
+  if (targetsCore) {
+    if (currentProduct === "core") {
+      return {
+        url: fullRelativePath,
+        isInternal: true,
+        targetProduct: "core",
+        isCrossDomainToCore: false
+      };
+    }
+    const targetUrl = getShuffleCoreUrl(fullRelativePath);
+    return {
+      url: targetUrl,
+      isInternal: false,
+      targetProduct: "core",
+      isCrossDomainToCore: true
+    };
+  }
+  if (targetsSecurity) {
+    if (currentProduct === "security") {
+      return {
+        url: fullRelativePath,
+        isInternal: true,
+        targetProduct: "security",
+        isCrossDomainToCore: false
+      };
+    }
+    const targetUrl = getShuffleSecurityUrl(fullRelativePath);
+    return {
+      url: targetUrl,
+      isInternal: false,
+      targetProduct: "security",
+      isCrossDomainToCore: false
+    };
+  }
+  if (trimmed.startsWith("/")) {
+    return {
+      url: trimmed,
+      isInternal: true,
+      targetProduct: currentProduct,
+      isCrossDomainToCore: false
+    };
+  }
+  return {
+    url: trimmed,
+    isInternal: false,
+    targetProduct: "external",
+    isCrossDomainToCore: false
+  };
+};
 
 // ../lib/platform.ts
 var getPlatform = () => {
@@ -328,9 +586,57 @@ if (typeof window !== "undefined") {
 // api.ts
 installFetchBreaker();
 var DEV_BACKEND = "https://tunnel.schemaless.org";
-var PROD_BACKEND = "https://uk.shuffler.io";
+var PROD_BACKEND = "https://uk.shuffle.security";
 var SHUFFLE_AUTOMATION_URL = getShuffleCoreUrl("/new-dashboard");
-var CLOUD_DOMAINS = ["shuffle.security", "www.shuffle.security", "security.shuffler.io", "shutdown.no", "www.shutdown.no"];
+var CLOUD_DOMAINS = [
+  "shuffle.security",
+  "www.shuffle.security",
+  "uk.shuffle.security",
+  "security.shuffler.io",
+  "shuffler.io",
+  "shutdown.no",
+  "www.shutdown.no"
+];
+var isShuffleCloudDomain = (url) => {
+  if (!url || typeof url !== "string") return false;
+  try {
+    const raw = url.trim();
+    const parsed = new URL(raw.includes("://") ? raw : `https://${raw}`);
+    const host = parsed.hostname.toLowerCase();
+    return host === "shuffler.io" || host.endsWith(".shuffler.io") || host === "shuffle.security" || host.endsWith(".shuffle.security");
+  } catch {
+    return false;
+  }
+};
+var mapCloudRegionUrl = (url) => {
+  if (!url || typeof url !== "string") return "";
+  const trimmed = url.trim();
+  if (!trimmed) return "";
+  const hasScheme = /^[a-zA-Z][a-zA-Z\d+\-.]*:\/\//.test(trimmed);
+  const toParse = hasScheme ? trimmed : `https://${trimmed}`;
+  try {
+    const parsed = new URL(toParse);
+    const hostname = parsed.hostname.toLowerCase();
+    if (hostname === "shuffler.io" || hostname === "www.shuffler.io" || hostname === "shuffle.security" || hostname === "www.shuffle.security") {
+      parsed.protocol = "https:";
+      parsed.hostname = "uk.shuffle.security";
+      return parsed.toString().replace(/\/+$/, "");
+    }
+    if (hostname.endsWith(".shuffler.io")) {
+      const subdomain = hostname.slice(0, -".shuffler.io".length);
+      parsed.protocol = "https:";
+      parsed.hostname = `${subdomain}.shuffle.security`;
+      return parsed.toString().replace(/\/+$/, "");
+    }
+    if (hostname.endsWith(".shuffle.security")) {
+      parsed.protocol = "https:";
+      return parsed.toString().replace(/\/+$/, "");
+    }
+    return trimmed.replace(/\/+$/, "");
+  } catch {
+    return trimmed.replace(/\/+$/, "");
+  }
+};
 var getEnvVar = (key) => {
   try {
     const meta = new Function("try { return import.meta } catch { return undefined }")();
@@ -345,9 +651,12 @@ var isDevEnvironment = () => {
   return hostname.includes("lovableproject.com") || hostname.includes("id-preview--") || hostname.endsWith(".lovable.app") || hostname.endsWith(".lovable.dev");
 };
 var isCloudDomain = () => {
-  if (isCapacitorNative()) return true;
+  if (isCapacitorNative()) {
+    if (getHostBaseUrl()) return false;
+    return true;
+  }
   const hostname = typeof window !== "undefined" ? window.location.hostname : "";
-  return CLOUD_DOMAINS.includes(hostname);
+  return CLOUD_DOMAINS.includes(hostname) || hostname.endsWith(".shuffle.security") || hostname.endsWith(".shuffler.io");
 };
 var isCloud = () => isCloudDomain();
 var isOnprem = () => !isDevEnvironment() && !isCloudDomain();
@@ -357,7 +666,11 @@ var getDefaultBaseUrl = () => {
     return envUrl;
   }
   if (isDevEnvironment()) return DEV_BACKEND;
-  if (isCapacitorNative()) return PROD_BACKEND;
+  if (isCapacitorNative()) {
+    const customHost = getHostBaseUrl();
+    if (customHost) return customHost;
+    return PROD_BACKEND;
+  }
   if (isCloudDomain()) return PROD_BACKEND;
   if (typeof window !== "undefined") {
     return window.location.origin;
@@ -371,11 +684,13 @@ var readCachedRegion = () => {
     const raw = localStorage.getItem(REGION_STORAGE_KEY);
     if (!raw) return { url: null, orgId: null };
     const parsed = JSON.parse(raw);
-    const url = parsed?.url ? parsed.url.replace(/\/+$/, "") : null;
-    if (url === "https://shuffler.io" || url === PROD_BACKEND) {
+    const rawUrl = parsed?.url ? parsed.url.replace(/\/+$/, "") : null;
+    if (!rawUrl) return { url: null, orgId: parsed?.orgId || null };
+    const mapped = mapCloudRegionUrl(rawUrl);
+    if (mapped === "https://shuffler.io" || mapped === "https://uk.shuffler.io" || mapped === "https://shuffle.security" || mapped === "https://uk.shuffle.security" || mapped === PROD_BACKEND) {
       return { url: null, orgId: parsed?.orgId || null };
     }
-    return { url, orgId: parsed?.orgId || null };
+    return { url: mapped, orgId: parsed?.orgId || null };
   } catch {
     return { url: null, orgId: null };
   }
@@ -389,7 +704,23 @@ var readCachedCustomHost = () => {
     if (mode && mode !== "self-hosted") return null;
     const raw = localStorage.getItem("shuffle_custom_host_url");
     const cleaned = raw ? raw.trim().replace(/\/+$/, "") : null;
-    if (!cleaned) return null;
+    if (!cleaned) {
+      const host = window.location.hostname.toLowerCase();
+      if ((host === "localhost" || host === "127.0.0.1" || host === "[::1]" || host.endsWith(".localhost")) && mode !== "cloud") {
+        return "http://localhost:5001";
+      }
+      return null;
+    }
+    if (isShuffleCloudDomain(cleaned)) {
+      try {
+        localStorage.removeItem("shuffle_custom_host_url");
+        if (mode === "self-hosted") {
+          localStorage.setItem("shuffle_selected_server_mode", "cloud");
+        }
+      } catch {
+      }
+      return null;
+    }
     if (cleaned === DEV_BACKEND && !isDevEnvironment() && mode !== "self-hosted") {
       try {
         localStorage.removeItem("shuffle_custom_host_url");
@@ -437,23 +768,28 @@ if (typeof window !== "undefined") {
     if (e.key === REGION_STORAGE_KEY) sync();
   });
 }
-var isShufflerSubdomain = (url) => {
-  try {
-    const parsed = new URL(url);
-    return parsed.hostname.endsWith(".shuffler.io") || parsed.hostname === "shuffler.io";
-  } catch {
-    return false;
-  }
-};
 var setRegionUrl = (regionUrl, orgId) => {
   _trackedOrgId = orgId || null;
-  if (regionUrl && isShufflerSubdomain(regionUrl)) {
-    const normalized = regionUrl.replace(/\/+$/, "");
-    const isDefaultCloud = normalized === PROD_BACKEND || normalized === "https://shuffler.io";
-    if (!isDefaultCloud) {
-      _regionUrl = normalized;
+  if (regionUrl) {
+    const isSelfHosted = !isCloudDomain() || Boolean(_hostBaseUrl);
+    if (isShuffleCloudDomain(regionUrl)) {
+      if (isSelfHosted) {
+        _regionUrl = null;
+        persistRegion(null, _trackedOrgId);
+        return;
+      }
+      const mapped = mapCloudRegionUrl(regionUrl);
+      const normalized = mapped.replace(/\/+$/, "");
+      const isDefaultCloud = normalized === PROD_BACKEND || normalized === "https://shuffler.io" || normalized === "https://uk.shuffler.io" || normalized === "https://shuffle.security" || normalized === "https://uk.shuffle.security";
+      if (!isDefaultCloud) {
+        _regionUrl = normalized;
+        persistRegion(_regionUrl, _trackedOrgId);
+        console.log(`[API] Region URL set to: ${_regionUrl}`);
+        return;
+      }
+    } else {
+      _regionUrl = regionUrl.replace(/\/+$/, "");
       persistRegion(_regionUrl, _trackedOrgId);
-      console.log(`[API] Region URL set to: ${_regionUrl}`);
       return;
     }
   }
@@ -463,7 +799,8 @@ var setRegionUrl = (regionUrl, orgId) => {
 var applyRegionFromPayload = (payload, orgIdOverride) => {
   if (!payload || typeof payload !== "object") return null;
   const orgId = orgIdOverride ?? payload?.active_org?.id ?? payload?.org_id ?? null;
-  const regionUrl = payload?.region_url || payload?.active_org?.region_url || null;
+  const rawRegionUrl = payload?.region_url || payload?.active_org?.region_url || null;
+  const regionUrl = rawRegionUrl ? mapCloudRegionUrl(rawRegionUrl) : null;
   setRegionUrl(regionUrl, orgId);
   return regionUrl;
 };
@@ -518,9 +855,12 @@ var getSessionToken = () => {
       localStorage.removeItem(LEGACY_API_KEY_STORAGE_KEY);
     }
     const stored = localStorage.getItem("session_token");
-    if (stored && stored.trim().length > 0 && stored !== "null" && stored !== "undefined") {
+    if (stored && stored.trim().length > 0 && stored !== "null" && stored !== "undefined" && stored !== "authenticated" && stored !== "session" && stored !== "cookie-session") {
       return stored.trim();
     }
+    if (stored === "authenticated" || stored === "session" || stored === "cookie-session") {
+      localStorage.removeItem("session_token");
+    }
     return null;
   } catch {
     return null;
@@ -528,13 +868,62 @@ var getSessionToken = () => {
 };
 var setSessionToken = (token) => {
   clearAuthTokens();
-  if (token && token.trim().length > 0) {
+  if (token && token.trim().length > 0 && token !== "authenticated" && token !== "session" && token !== "cookie-session" && token !== "null" && token !== "undefined") {
     try {
       localStorage.setItem("session_token", token.trim());
     } catch {
     }
   }
 };
+var isShuffleSecurityBackend = (backendUrl) => {
+  try {
+    const backend = backendUrl || API_CONFIG.baseUrl || "";
+    if (backend) {
+      const parsed = new URL(backend.includes("://") ? backend : `https://${backend}`);
+      const host = parsed.hostname.toLowerCase();
+      if (host === "shuffle.security" || host.endsWith(".shuffle.security") || host === "shuffler.io" || host.endsWith(".shuffler.io")) {
+        return true;
+      }
+    }
+  } catch {
+  }
+  if (typeof window !== "undefined") {
+    try {
+      const windowHost = window.location.hostname.toLowerCase();
+      if (windowHost === "shuffle.security" || windowHost.endsWith(".shuffle.security") || windowHost === "shuffler.io" || windowHost.endsWith(".shuffler.io")) {
+        return true;
+      }
+    } catch {
+    }
+  }
+  return false;
+};
+var isCrossDomainBackend = (targetUrl) => {
+  if (typeof window === "undefined") return false;
+  try {
+    const backendUrl = targetUrl || API_CONFIG.baseUrl;
+    if (!backendUrl) return false;
+    const backendHost = new URL(backendUrl, window.location.origin).hostname.toLowerCase();
+    const frontendHost = window.location.hostname.toLowerCase();
+    if (backendHost === frontendHost) return false;
+    const isLocalFrontend = frontendHost === "localhost" || frontendHost === "127.0.0.1";
+    const isLocalBackend = backendHost === "localhost" || backendHost === "127.0.0.1";
+    if (isLocalFrontend && isLocalBackend) return false;
+    const getRootDomain = (host) => {
+      const parts = host.split(".");
+      if (parts.length <= 2) return host;
+      return parts.slice(-2).join(".");
+    };
+    const frontendRoot = getRootDomain(frontendHost);
+    const backendRoot = getRootDomain(backendHost);
+    if (frontendRoot && backendRoot && frontendRoot === backendRoot) {
+      return false;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+};
 var API_CONFIG = {
   // Shuffle backend URL — host override beats region URL beats default.
   get baseUrl() {
@@ -575,8 +964,9 @@ var shuffleFetch = (url, init) => {
 };
 var getAuthHeader = (overrideOrgId) => {
   const headers = {};
+  const authMode = typeof localStorage !== "undefined" ? localStorage.getItem("shuffle_auth_mode") : null;
   const token = getSessionToken();
-  if (token) {
+  if (token && (authMode === "bearer" || isCapacitorNative() || isCrossDomainBackend())) {
     headers["Authorization"] = `Bearer ${token}`;
   }
   let orgId = overrideOrgId ?? _trackedOrgId;
@@ -661,9 +1051,12 @@ var fetchAppsViaApiConfig = () => {
 };
 
 export {
+  resolveProductLink,
   registerProtectedOrigin,
   installFetchBreaker,
   isCapacitorNative,
+  isShuffleCloudDomain,
+  mapCloudRegionUrl,
   isCloudDomain,
   isCloud,
   isOnprem,
@@ -673,6 +1066,7 @@ export {
   setHostBaseUrl,
   getHostBaseUrl,
   getTrackedOrgId,
+  isShuffleSecurityBackend,
   API_CONFIG,
   getApiUrl,
   shuffleFetch,