@assembly-js/app-foundation 0.0.25-rc.0 → 0.0.25-rc.1

package/dist/lib-client.js

@@ -18,8 +18,8 @@ let renewalInFlight = null;
 // for the freshest session token (the parent keeps it alive) and posts it to the
 // re-exchange route, which mints a new bearer and sets the HttpOnly cookie — no
 // page reload. Returns true iff a fresh bearer was set. This is the only place
-// app code touches the raw session token, and only to re-mint; it is never sent
-// to the platform API.
+// app code touches the raw session token, to re-mint and keep the URL aligned
+// with the cookie; it is never sent to the platform API.
 export function reexchangeBearer() {
     if (renewalInFlight)
         return renewalInFlight;
@@ -30,6 +30,9 @@ export function reexchangeBearer() {
     return renewal;
 }
 async function renewBearer() {
+    const previousUrlToken = typeof window === 'undefined'
+        ? null
+        : new URL(window.location.href).searchParams.get('token');
     let token = AssemblyBridge.sessionToken.getCurrent()?.token ?? '';
     // Proactively refresh: we're recovering from an expiry, so avoid re-minting
     // from a session token that may itself be stale.
@@ -55,6 +58,19 @@ async function renewBearer() {
             bridgeRefreshFailed,
             status: res.status,
         });
+        if (res.ok && previousUrlToken !== null) {
+            try {
+                const url = new URL(window.location.href);
+                // Don't overwrite a new preview session opened while renewal was in flight.
+                if (url.searchParams.get('token') === previousUrlToken) {
+                    url.searchParams.set('token', token);
+                    window.history.replaceState(window.history.state, '', url.href);
+                }
+            }
+            catch {
+                // A history update failure must not invalidate the cookie just renewed.
+            }
+        }
         return res.ok;
     }
     catch {

package/dist/mint-bearer.js

@@ -55,7 +55,13 @@ export async function mintBearerFromSessionToken(token, options) {
     try {
         const resp = await assembly.fetch('/v1/session', {
             method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
+            headers: {
+                'Content-Type': 'application/json',
+                // Let /session validate the token in the body. The SDK's three-part
+                // key makes the authorizer reject expired tokens with a generic 403
+                // before the handler can distinguish a replay from an outage.
+                'X-API-Key': `${payload.workspaceId}/${process.env.ASSEMBLY_API_KEY ?? ''}`,
+            },
             body: JSON.stringify({
                 sessionId: payload.tokenId,
                 ...(options?.cookieSessionId

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@assembly-js/app-foundation",
-  "version": "0.0.25-rc.0",
+  "version": "0.0.25-rc.1",
   "description": "Versioned foundation helpers and build context for Assembly generated apps",
   "type": "module",
   "files": [