@assembly-js/app-foundation 0.0.21 → 0.0.22

package/CLAUDE.md

@@ -197,6 +197,7 @@ Because the app runs in an iframe inside the parent dashboard, several normal Ne
   ```
   `bun run build` fails (`check:next-config`) if `next.config.ts` is rewritten away from the wrapper form.
 - **Leave `instrumentation-client.ts` in place.** It's a dev-only preview helper (hides Next's red error overlay and relays build status to the builder preview) that no-ops in production. Don't remove or repurpose it.
+- **Leave the paint beacon alone.** After hydration the foundation posts `app.painted` to the parent and `sendBeacon('/__assembly/painted')` so the preview can tell executed from rendered. Do not add your own `/__assembly/painted` route, do not post `app.painted` yourself, and do not remove `<PaintBeacon />` from the root layout. None of this needs agent action. `bun run build` fails (`check:paint-beacon`) if the layout stops rendering it or the proxy stops routing its beacon POST.
 - **`localStorage` works** but is scoped per-origin — the app's own Vercel domain. Useful for caching, not for sharing state with the parent.
 - **Mobile-first layout with appropriate width.** The app renders in the iframe and must work down to 320 px. Design mobile-first: start with a single-column layout and scale up with `sm:`/`md:`/`lg:` breakpoints. **Content width depends on the app type:** most apps (tables, dashboards, boards) should use the full available width. Form-centric, single-column, or text-heavy apps that would look sparse at full width should center their content in a narrower column (`max-w-3xl mx-auto`). If the task description or plan specifies a content width, follow it; otherwise choose whichever looks better for the content. **When narrowing, place the `max-w-*` wrapper as the outermost page-level container** — outside `Tabs`, filter bars, and all other page chrome — so everything aligns to the same column. Do not narrow only the inner content of each tab panel while leaving `TabsList` or other siblings full-width.
 - **Page gutters.** Every page must have horizontal padding so content never touches the iframe edges. Add `px-4 sm:px-6` to the outermost page container (typically `<main>` or the top-level wrapper div). This applies to both full-width and narrow layouts. Tables, filter bars, and cards should all sit inside this padded container — never render content edge-to-edge against the viewport.

package/bin/check-paint-beacon.mjs

@@ -0,0 +1,81 @@
+#!/usr/bin/env node
+// Fails the build when the post-paint beacon has been removed or bypassed.
+// Dependency-free on purpose: it runs inside the generated app's sandbox
+// before any deps beyond Node exist.
+//
+// The beacon (`<PaintBeacon />` in the root layout, `sendBeacon('/__assembly/painted')`
+// + `app.painted` from paint-beacon.ts, and the proxy's beacon route) is how the
+// builder preview tells "the page executed" from "the page actually rendered" —
+// see the foundation CLAUDE.md's "Leave the paint beacon alone" and the
+// assembly-dev-server-logs skill's "foundation-owned" lines. Both are prose;
+// this check is the enforcement, mirroring check-next-config.mjs for the
+// platform-owned Next config wrapper.
+//
+// An app without app/components/paint-beacon.tsx predates the vNext beacon
+// (cloned from an older foundation). There the beacon was never the contract,
+// so this check exits 0 — those apps have no paint signal to protect.
+import { readFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+
+const ROOT = process.cwd();
+const BEACON_COMPONENT = join('app', 'components', 'paint-beacon.tsx');
+const LAYOUT_FILE = join('app', 'layout.tsx');
+const PROXY_FILE = 'proxy.ts';
+
+if (!existsSync(join(ROOT, BEACON_COMPONENT))) {
+  process.exit(0); // pre-beacon app: not this check's contract
+}
+
+if (!existsSync(join(ROOT, LAYOUT_FILE))) {
+  console.error(
+    `check-paint-beacon: ${BEACON_COMPONENT} exists but ${LAYOUT_FILE} is missing. ` +
+      'The root layout is where <PaintBeacon /> must render — restore it.',
+  );
+  process.exit(1);
+}
+
+const layout = readFileSync(join(ROOT, LAYOUT_FILE), 'utf8');
+const importsBeacon = /from\s+['"]@\/app\/components\/paint-beacon['"]/.test(layout);
+const rendersBeacon = /<PaintBeacon\b/.test(layout);
+
+if (!importsBeacon || !rendersBeacon) {
+  console.error(
+    `check-paint-beacon: ${LAYOUT_FILE} must import and render the foundation-owned paint beacon:\n\n` +
+      "  import PaintBeacon from '@/app/components/paint-beacon';\n" +
+      '  // …inside the root layout body:\n' +
+      '  <PaintBeacon />\n\n' +
+      'This posts app.painted and sendBeacon(\'/__assembly/painted\') after hydration so the ' +
+      'builder preview can tell "executed" from "actually rendered". Do not remove it, and do not ' +
+      'post app.painted or hit /__assembly/painted yourself — the beacon already does both.',
+  );
+  process.exit(1);
+}
+
+if (existsSync(join(ROOT, PROXY_FILE))) {
+  // Strip whole-line comments first so a commented-out route can't satisfy
+  // the check. Line comments only: a naive /* */ strip eats string literals
+  // like 'https://*.assembly.com' in the CSP list, and dependency-free means
+  // no real tokenizer.
+  const proxy = readFileSync(join(ROOT, PROXY_FILE), 'utf8').replace(/^\s*\/\/.*$/gm, '');
+  const importsHelpers =
+    /isPaintedBeaconPath/.test(proxy) && /handlePaintedBeacon/.test(proxy);
+  const usesHelpers =
+    /isPaintedBeaconPath\s*\(/.test(proxy) && /handlePaintedBeacon\s*\(/.test(proxy);
+
+  if (!importsHelpers || !usesHelpers) {
+    console.error(
+      `check-paint-beacon: ${PROXY_FILE} must route the beacon's POST before CSRF/exchange:\n\n` +
+        "  import { isPaintedBeaconPath, handlePaintedBeacon } from '@assembly-js/app-foundation/client';\n" +
+        '  // …first thing in the proxy function:\n' +
+        "  if (request.method === 'POST' && isPaintedBeaconPath(request.nextUrl.pathname)) {\n" +
+        '    return handlePaintedBeacon();\n' +
+        '  }\n\n' +
+        "sendBeacon is a headerless POST — routing it through the normal CSRF/exchange path 403s it, " +
+        'silently breaking the paint signal. POST only: a GET to the path must fall through, not ' +
+        'mint a fake painted line.',
+    );
+    process.exit(1);
+  }
+}
+
+process.exit(0);

package/dist/client.d.ts

@@ -1,6 +1,7 @@
 export * from './session-exchange.js';
 export * from './network-capture.js';
-export * from './parent-origin.js';
+export * from './paint-beacon.js';
+export * from './origin-bootstrap.js';
 export * from './client-companies.js';
 export * from './pagination.js';
 export * from './theme.js';

package/dist/client.js

@@ -7,9 +7,11 @@
 // also runs in the Edge middleware runtime that proxy.ts uses.
 export * from './session-exchange.js';
 export * from './network-capture.js';
-// Self-running on client module load (see the module comment): registers the
-// framing origin with the app-bridge allowlist so custom-domain portals work.
-export * from './parent-origin.js';
+export * from './paint-beacon.js';
+// Self-running on client module load: register the proxy-resolved portal
+// origin with the bridge allowlist, and schedule the post-paint beacon. See
+// each module's comment.
+export * from './origin-bootstrap.js';
 export * from './client-companies.js';
 export * from './pagination.js';
 export * from './theme.js';

package/dist/network-capture.js

@@ -1,13 +1,14 @@
 // Client-side network capture: monkey-patches window.fetch and XMLHttpRequest so every
 // generated app records its own HTTP traffic and reports it to the parent frame for
-// debugging. This module only emits postMessage records — the wave-2 webapp relay that
-// listens for MESSAGE_TYPE, and the backend ingest that stores them, ship separately.
-// Until that listener exists this is inert: postToParent() no-ops if there's no parent
-// to receive it.
+// debugging. Posts go through the bridge's postToParent as droppable telemetry:
+// delivered once the parent origin is learned, dropped before that — capture
+// volume must never evict contract messages (app.ready) from the bridge's
+// pre-learn buffer.
 //
 // Redaction here is best-effort and CLIENT-SIDE ONLY. The real security boundary is
 // server-side, at ingest — never trust this module alone to keep secrets out of a
 // downstream store.
+import { AssemblyBridge } from '@assembly-js/app-bridge';
 export const NETWORK_CAPTURE_MESSAGE_TYPE = 'assembly.debug.network';
 // Header names whose values are fingerprinted instead of forwarded. Matched
 // case-insensitively against both request and response header names.
@@ -255,46 +256,13 @@ const ring = [];
 export function getCapturedRecords() {
     return ring;
 }
-let cachedParentOrigin;
-// Mirrors sdk/app-bridge's src/core/origins.ts allowlist. Kept as a local copy (rather
-// than importing the npm package) because only its public AssemblyBridge API — not this
-// internal helper — is exported for consumers.
-const ALLOWED_PARENT_ORIGIN_PATTERNS = [
-    /^https?:\/\/localhost(:\d+)?$/,
-    /^https?:\/\/127\.0\.0\.1(:\d+)?$/,
-    /^https:\/\/([a-z0-9-]+\.)?copilot\.app$/,
-    /^https:\/\/([a-z0-9-]+\.)?myassembly\.com$/,
-    /^https:\/\/dashboard\.assembly\.com$/,
-    /^https:\/\/([a-z0-9-]+\.)?copilot-staging\.app$/,
-    /^https:\/\/([a-z0-9-]+\.)?myassembly-staging\.com$/,
-    /^https:\/\/dashboard\.assembly-staging\.com$/,
-];
-function isAllowedParentOrigin(origin) {
-    return ALLOWED_PARENT_ORIGIN_PATTERNS.some((pattern) => pattern.test(origin));
-}
-function getParentOrigin() {
-    if (cachedParentOrigin !== undefined)
-        return cachedParentOrigin;
-    if (typeof document === 'undefined' || !document.referrer) {
-        cachedParentOrigin = null;
-        return null;
-    }
-    try {
-        cachedParentOrigin = new URL(document.referrer).origin;
-    }
-    catch {
-        cachedParentOrigin = null;
-    }
-    return cachedParentOrigin;
-}
 function postToParent(record) {
     if (typeof window === 'undefined' || window.parent === window)
         return;
-    const origin = getParentOrigin();
-    if (!origin || !isAllowedParentOrigin(origin))
+    if (!AssemblyBridge.postToParent)
         return;
     try {
-        window.parent.postMessage({ type: NETWORK_CAPTURE_MESSAGE_TYPE, record }, origin);
+        AssemblyBridge.postToParent({ type: NETWORK_CAPTURE_MESSAGE_TYPE, record }, { droppable: true });
     }
     catch {
         // Best-effort telemetry — never let a postMessage failure surface to the app.

package/dist/origin-bootstrap.d.ts

@@ -0,0 +1,22 @@
+export declare const PORTAL_ORIGIN_COOKIE_NAME = "assembly-portal-origin";
+export declare const CLIENT_FLAGS_COOKIE_NAME = "assembly-flags";
+export declare const PREVIEW_V2_FLAG = "app-builder-preview-v2";
+/**
+ * Reads a single cookie by name from a cookie string (defaults to
+ * `document.cookie`). Shared by every module that reads a proxy-mirrored
+ * cookie, so the parse/decode logic lives in exactly one place.
+ */
+export declare function readCookie(name: string, cookieString?: string): string | null;
+/**
+ * Whether the given flag key is present in the proxy-mirrored flags cookie.
+ * Exported for other vNext modules (e.g. the paint beacon) to check the same
+ * cookie without re-parsing it themselves.
+ */
+export declare function hasClientFlag(key: string, cookieString?: string): boolean;
+/**
+ * Register the workspace's portal origin with the bridge allowlist — from the
+ * proxy-set cookie when the preview-v2 flag is on, from the legacy framing
+ * origin otherwise. Returns the origin it registered, or null when there was
+ * nothing to do. Exported for tests; runs once at module load in the browser.
+ */
+export declare function bootstrapPortalOrigin(cookieString?: string): string | null;

package/dist/origin-bootstrap.js

@@ -0,0 +1,120 @@
+// Self-running: every app's client bundle imports this package, and module
+// evaluation precedes hydration — so the workspace's portal origin joins the
+// bridge allowlist before any component's first header/session-token call.
+//
+// The preview-v2 flag selects WHICH trust source registers the origin — it
+// never selects whether anything registers at all (flag-off must keep custom
+// portal domains working exactly as pre-vNext package versions did):
+//
+//  - flag ON: the proxy-set cookie. The value is platform-resolved, never
+//    inferred client-side — the proxy already fetches workspace.portalUrl for
+//    its CSP frame-ancestors header and mirrors it into this client-readable
+//    cookie. Immune to the navigation-state poisoning below.
+//  - flag OFF (or flags cookie unreadable): the legacy browser-reported
+//    framing origin (ancestorOrigins, referrer fallback). Trusting it is
+//    sound because the proxy's CSP frame-ancestors already gates who may
+//    frame the app, but it rides navigation state — strip-able by privacy
+//    modes and poisoned by in-iframe reloads — which is why the cookie path
+//    replaces it.
+//
+// The bridge has no trust bypass, so one of these registrations is the only
+// way a custom portal domain becomes a valid parent (dashboard/platform
+// domains are built into the bridge's defaults). Nothing resolvable → no-op:
+// the app still works on every default-allowlisted surface.
+import { AssemblyBridge } from '@assembly-js/app-bridge';
+export const PORTAL_ORIGIN_COOKIE_NAME = 'assembly-portal-origin';
+// Mirrors the bearer's `flags` claim (see session-exchange.ts's
+// ExchangedSession.flags / hasFlag) — the bearer itself is HttpOnly and
+// unreadable client-side, so the proxy mirrors the decoded array into this
+// plain, comma-separated cookie on every request (set or cleared, never
+// left stale).
+export const CLIENT_FLAGS_COOKIE_NAME = 'assembly-flags';
+export const PREVIEW_V2_FLAG = 'app-builder-preview-v2';
+/**
+ * Reads a single cookie by name from a cookie string (defaults to
+ * `document.cookie`). Shared by every module that reads a proxy-mirrored
+ * cookie, so the parse/decode logic lives in exactly one place.
+ */
+export function readCookie(name, cookieString) {
+    const cookies = cookieString ?? (typeof document !== 'undefined' ? document.cookie : '');
+    if (!cookies)
+        return null;
+    const record = cookies.split(/; */).find((c) => c.startsWith(`${name}=`));
+    if (!record)
+        return null;
+    try {
+        return decodeURIComponent(record.slice(name.length + 1));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Whether the given flag key is present in the proxy-mirrored flags cookie.
+ * Exported for other vNext modules (e.g. the paint beacon) to check the same
+ * cookie without re-parsing it themselves.
+ */
+export function hasClientFlag(key, cookieString) {
+    const raw = readCookie(CLIENT_FLAGS_COOKIE_NAME, cookieString);
+    if (!raw)
+        return false;
+    return raw.split(',').includes(key);
+}
+/**
+ * Legacy (pre-vNext) framing-origin resolution: `location.ancestorOrigins`
+ * (browser-attested; Chromium/WebKit), falling back to `document.referrer`
+ * (Firefox). Null outside an iframe or when neither source is available.
+ */
+function resolveLegacyParentOrigin() {
+    if (typeof window === 'undefined')
+        return null;
+    if (window.parent === window)
+        return null;
+    const ancestor = window.location.ancestorOrigins?.[0];
+    if (ancestor)
+        return ancestor;
+    try {
+        const referrer = document.referrer;
+        if (referrer)
+            return new URL(referrer).origin;
+    }
+    catch {
+        // Unparseable referrer — fall through to null.
+    }
+    return null;
+}
+/**
+ * Register the workspace's portal origin with the bridge allowlist — from the
+ * proxy-set cookie when the preview-v2 flag is on, from the legacy framing
+ * origin otherwise. Returns the origin it registered, or null when there was
+ * nothing to do. Exported for tests; runs once at module load in the browser.
+ */
+export function bootstrapPortalOrigin(cookieString) {
+    if (!hasClientFlag(PREVIEW_V2_FLAG, cookieString)) {
+        // Flag off: behave exactly like pre-vNext package versions so custom
+        // portal domains keep a working bridge — and so turning the flag OFF is
+        // a true rollback, not a third state. Https-only: local dev origins are
+        // already on the default allowlist.
+        const origin = resolveLegacyParentOrigin();
+        if (!origin || !origin.startsWith('https://'))
+            return null;
+        AssemblyBridge.configure({ additionalOrigins: [origin] });
+        return origin;
+    }
+    const record = readCookie(PORTAL_ORIGIN_COOKIE_NAME, cookieString);
+    if (!record)
+        return null;
+    // Accept only a bare https origin — anything else (paths, http, garbage)
+    // is not a value the proxy writes and must not reach the allowlist.
+    try {
+        if (!record.startsWith('https://') || new URL(record).origin !== record) {
+            return null;
+        }
+    }
+    catch {
+        return null;
+    }
+    AssemblyBridge.configure({ additionalOrigins: [record] });
+    return record;
+}
+bootstrapPortalOrigin();

package/dist/paint-beacon.d.ts

@@ -0,0 +1,10 @@
+export declare const PAINTED_BEACON_PATH = "/__assembly/painted";
+export declare const PAINTED_BEACON_EVENT = "assembly.painted";
+/**
+ * Schedule the post-paint beacon. Safe to call more than once — the first
+ * hydration + rAF wins. Does nothing on the server.
+ */
+export declare function installPaintBeacon(): void;
+export declare function isPaintedBeaconPath(pathname: string): boolean;
+export declare function logPaintedBeacon(): void;
+export declare function handlePaintedBeacon(): Response;

package/dist/paint-beacon.js

@@ -0,0 +1,68 @@
+// Post-paint beacon: tells the parent (bridge) and the proxy (HTTP) that the
+// iframe actually rendered. Must not fire at import — an at-import beacon
+// reproduces the executed-isn't-rendered blind spot. Callers schedule this
+// after hydration + one animation frame.
+//
+// The HTTP route is handled in proxy.ts via the helpers below (same
+// package-delegation pattern as session-exchange). The bridge post rides
+// buffer-until-learned, so a paint that beats the parent's hello is not lost.
+//
+// Gated on the preview-v2 flag (see origin-bootstrap.ts's hasClientFlag):
+// installPaintBeacon() no-ops for a flag-off workspace, so the client never
+// calls sendBeacon and the proxy's route never sees a request — no need to
+// separately gate handlePaintedBeacon() below.
+import { AssemblyBridge } from '@assembly-js/app-bridge';
+import { hasClientFlag, PREVIEW_V2_FLAG } from './origin-bootstrap.js';
+export const PAINTED_BEACON_PATH = '/__assembly/painted';
+export const PAINTED_BEACON_EVENT = 'assembly.painted';
+let scheduled = false;
+let fired = false;
+function firePaintBeacon() {
+    if (fired)
+        return;
+    fired = true;
+    if (typeof navigator !== 'undefined' && typeof navigator.sendBeacon === 'function') {
+        navigator.sendBeacon(PAINTED_BEACON_PATH);
+    }
+    if (AssemblyBridge.postToParent) {
+        AssemblyBridge.postToParent({ type: 'app.painted' });
+    }
+}
+/**
+ * Schedule the post-paint beacon. Safe to call more than once — the first
+ * hydration + rAF wins. Does nothing on the server.
+ */
+export function installPaintBeacon() {
+    if (typeof window === 'undefined' || scheduled)
+        return;
+    if (!hasClientFlag(PREVIEW_V2_FLAG))
+        return;
+    scheduled = true;
+    const afterPaint = () => {
+        requestAnimationFrame(firePaintBeacon);
+    };
+    // Already past load (late client import): one macrotask so this is not
+    // synchronous with module evaluation, then one rAF for paint.
+    if (document.readyState === 'complete') {
+        setTimeout(afterPaint, 0);
+        return;
+    }
+    window.addEventListener('load', afterPaint, { once: true });
+}
+export function isPaintedBeaconPath(pathname) {
+    return pathname === PAINTED_BEACON_PATH;
+}
+export function logPaintedBeacon() {
+    console.log(JSON.stringify({ event_type: PAINTED_BEACON_EVENT }));
+}
+// Callers gate on POST (see the proxy) so navigations/prefetches to the path
+// can't mint painted lines. The signal is still spoofable by design —
+// sendBeacon is an unauthenticated headerless POST — so consumers must treat
+// it as a hint, never proof.
+export function handlePaintedBeacon() {
+    logPaintedBeacon();
+    return new Response(null, { status: 204 });
+}
+if (typeof window !== 'undefined') {
+    installPaintBeacon();
+}

package/dist/session-exchange.d.ts

@@ -10,6 +10,18 @@ export declare const EXCHANGE_REJECTION_HEADER = "x-assembly-exchange-rejection"
 export type ExchangeRejectedViewer = 'same_viewer' | 'different_viewer';
 export declare function parseExchangeRejection(value: string | null): ExchangeRejectedViewer | undefined;
 export declare function isSessionExchangeEnabled(): boolean;
+export declare const COOKIE_OUTCOME_EVENT = "assembly.cookie_outcome";
+export type CookieOutcome = 'served_from_cookie' | 'minted' | `fail_closed:${string}`;
+export declare function logCookieOutcome(outcome: CookieOutcome, detail?: {
+    rejectedToken?: string;
+}): void;
+export declare function isDocumentRequest(request: {
+    method: string;
+    headers: {
+        get(name: string): string | null;
+        has(name: string): boolean;
+    };
+}): boolean;
 export interface ExchangedSession {
     workspaceId: string;
     clientId?: string;

package/dist/session-exchange.js

@@ -73,6 +73,39 @@ export function parseExchangeRejection(value) {
 export function isSessionExchangeEnabled() {
     return process.env.ENABLE_APP_SESSION_TOKEN_EXCHANGE === 'true';
 }
+// One structured line per document request. Outcomes are a closed set so the
+// reporter can parse them without guessing. Exchange semantics are unchanged —
+// this is log-only.
+export const COOKIE_OUTCOME_EVENT = 'assembly.cookie_outcome';
+export function logCookieOutcome(outcome, 
+// `rejectedToken` carries the rejection reason when a ?token= was refused
+// but the warm cookie still answered — otherwise served_from_cookie would
+// silently swallow the replay/rejection signal.
+detail) {
+    console.log(JSON.stringify({
+        event_type: COOKIE_OUTCOME_EVENT,
+        outcome,
+        ...(detail?.rejectedToken ? { rejected_token: detail.rejectedToken } : {}),
+    }));
+}
+// Two-tier detection: Sec-Fetch-Dest when the browser sends it (all evergreen
+// browsers; 'iframe' is what an embedded app's navigations carry), Accept
+// text/html otherwise. Deliberately NOT matching `*/*`: browser fetch() GETs
+// default to it and image/font Accept headers contain it, which would put the
+// per-document Set-Cookie writes, outcome log line, and flag re-read in the
+// data/subresource path.
+export function isDocumentRequest(request) {
+    if (request.method.toUpperCase() !== 'GET')
+        return false;
+    if (request.headers.has('next-action') || request.headers.has('RSC'))
+        return false;
+    const dest = request.headers.get('sec-fetch-dest');
+    if (dest) {
+        return dest === 'document' || dest === 'iframe' || dest === 'frame';
+    }
+    const accept = request.headers.get('accept') ?? '';
+    return accept.includes('text/html');
+}
 /** Whether a decoded session carries the given flag key. Null-safe so callers
  *  can chain straight off decodeBearer()'s result without a separate guard. */
 export function hasFlag(session, key) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@assembly-js/app-foundation",
-  "version": "0.0.21",
+  "version": "0.0.22",
   "description": "Versioned foundation helpers and build context for Assembly generated apps",
   "type": "module",
   "files": [

package/skills/assembly-dev-server-logs/SKILL.md

@@ -23,4 +23,11 @@ grep -n "Error" /tmp/dev-server.log
 
 Read or grep the file directly — it's a plain text file on the sandbox's own filesystem, not something fetched over a tool call. The file persists across dev server restarts — each restart appends a `=== dev server launch <timestamp> ===` marker, so you can see output from before a restart (earlier crashes, port-bind failures) and tell launches apart. Size is capped automatically, so `tail` always shows recent activity; it does not accumulate forever.
 
+The proxy also appends two structured JSON lines the reporter parses (you do not need to act on them):
+
+- `{"event_type":"assembly.painted"}` — the post-paint beacon (`/__assembly/painted`)
+- `{"event_type":"assembly.cookie_outcome","outcome":"served_from_cookie"|"minted"|"fail_closed:<reason>"}` — one line per document request; a `served_from_cookie` line may also carry `"rejected_token":"<reason>"` when a replayed `?token=` was refused but the warm cookie answered
+
+Leave those lines alone; they are foundation-owned.
+
 If the log doesn't explain the symptom (e.g. a client-side rendering issue), the problem is likely in the browser, not the server — this file only covers the server side.

package/dist/parent-origin.d.ts

@@ -1,17 +0,0 @@
-/**
- * Resolve the origin of the window framing this app.
- *
- * Prefers `location.ancestorOrigins` (browser-attested, immune to referrer
- * policy; Chromium/WebKit) and falls back to `document.referrer` (Firefox).
- * Returns null outside an iframe or when neither source is available —
- * e.g. a restrictive Referrer-Policy on the parent in Firefox.
- */
-export declare function resolveParentOrigin(): string | null;
-/**
- * Add the framing origin to the bridge's postMessage allowlist.
- *
- * Idempotent (the bridge holds origins in a Set) and restricted to https
- * parents — local development origins are already on the default allowlist,
- * so an http parent never needs registering.
- */
-export declare function registerParentOriginWithBridge(): void;

package/dist/parent-origin.js

@@ -1,57 +0,0 @@
-// Registers the app's real framing origin with the app-bridge postMessage
-// allowlist, so the bridge works on workspaces with custom portal domains.
-//
-// The bridge SDK ships a hardcoded origin allowlist (localhost + assembly
-// domains) and silently drops every outgoing and incoming message when the
-// parent origin isn't on it. On a custom-domain portal that kills header CTAs,
-// session-token refresh, and theme sync. Trusting the framing origin here is
-// sound because the proxy already gates who may frame the app at all: its CSP
-// frame-ancestors directive allows only the static assembly domains plus this
-// workspace's own portal URL, and the browser enforces that before any of this
-// bundle runs. Inside the frame, the browser-reported parent origin is
-// therefore always one the platform trusts.
-import { AssemblyBridge } from '@assembly-js/app-bridge';
-/**
- * Resolve the origin of the window framing this app.
- *
- * Prefers `location.ancestorOrigins` (browser-attested, immune to referrer
- * policy; Chromium/WebKit) and falls back to `document.referrer` (Firefox).
- * Returns null outside an iframe or when neither source is available —
- * e.g. a restrictive Referrer-Policy on the parent in Firefox.
- */
-export function resolveParentOrigin() {
-    if (typeof window === 'undefined')
-        return null;
-    if (window.parent === window)
-        return null;
-    const ancestor = window.location.ancestorOrigins?.[0];
-    if (ancestor)
-        return ancestor;
-    try {
-        const referrer = document.referrer;
-        if (referrer)
-            return new URL(referrer).origin;
-    }
-    catch {
-        // Unparseable referrer — fall through to null.
-    }
-    return null;
-}
-/**
- * Add the framing origin to the bridge's postMessage allowlist.
- *
- * Idempotent (the bridge holds origins in a Set) and restricted to https
- * parents — local development origins are already on the default allowlist,
- * so an http parent never needs registering.
- */
-export function registerParentOriginWithBridge() {
-    const origin = resolveParentOrigin();
-    if (!origin || !origin.startsWith('https://'))
-        return;
-    AssemblyBridge.configure({ additionalOrigins: [origin] });
-}
-// Run on module load: every app's client bundle imports this package (authFetch,
-// network capture), and module evaluation precedes hydration — so the origin is
-// registered before any component's first header/session-token call. Baked app
-// files never call this module directly, which is exactly why it self-runs.
-registerParentOriginWithBridge();