@assembly-js/app-foundation 0.0.25-rc.3 → 0.0.25-rc.5

package/dist/client.d.ts

@@ -2,6 +2,7 @@ export * from './session-exchange.js';
 export * from './network-capture.js';
 export * from './paint-beacon.js';
 export * from './origin-bootstrap.js';
+export * from './cookieless-bearer.js';
 export * from './client-companies.js';
 export * from './pagination.js';
 export * from './theme.js';

package/dist/client.js

@@ -12,6 +12,8 @@ export * from './paint-beacon.js';
 // origin with the bridge allowlist, and schedule the post-paint beacon. See
 // each module's comment.
 export * from './origin-bootstrap.js';
+// In-memory bearer for browsers that refuse the cookie; inert everywhere else.
+export * from './cookieless-bearer.js';
 export * from './client-companies.js';
 export * from './pagination.js';
 export * from './theme.js';

package/dist/cookieless-bearer.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Whether the browser is refusing to store the bearer cookie. Either the probe
+ * or the portal-origin cookie being readable proves the jar works — proxies that
+ * predate the probe write only the latter. A false "blocked" costs at most one
+ * mint, since a working cookie keeps authenticating regardless. Off-browser it
+ * returns false: no cookie jar is not the same as a blocked one.
+ */
+export declare function cookiesAreBlocked(cookieString?: string): boolean;
+/** The in-memory bearer, or null when the cookie path is carrying auth. */
+export declare function getCookielessBearer(): string | null;
+/**
+ * Adopt a freshly minted bearer for the cookie-less path and make sure the
+ * fetch patch is live. Called after a re-exchange returns one in its body.
+ */
+export declare function setCookielessBearer(value: string | null): void;
+/**
+ * Headers that ask the re-exchange route to return the bearer in its body.
+ * Shared with the renewal path in lib-client so both describe the cookie-less
+ * request the same way.
+ */
+export declare function cookielessReexchangeHeaders(): Record<string, string>;

package/dist/cookieless-bearer.js

@@ -0,0 +1,93 @@
+'use client';
+// Carries the bearer for browsers that refuse to store it: Safari blocks every
+// cross-site-iframe cookie and has no CHIPS, so the cookie is dropped on write
+// and only the first paint (which gets the bearer as a request header) works.
+//
+// window.fetch is the patch point because Next routes RSC navigations, server
+// actions and app fetches through it alike, and server actions cannot carry a
+// custom header any other way. The bearer stays in memory so it cannot outlive
+// the document or leak into history.
+import { APP_CSRF_HEADER, BEARER_IN_BODY_HEADER, CLIENT_BEARER_HEADER, COOKIE_PROBE_NAME, } from './session-exchange.js';
+import { PORTAL_ORIGIN_COOKIE_NAME, readCookie } from './origin-bootstrap.js';
+let bearer = null;
+let patched = false;
+/**
+ * Whether the browser is refusing to store the bearer cookie. Either the probe
+ * or the portal-origin cookie being readable proves the jar works — proxies that
+ * predate the probe write only the latter. A false "blocked" costs at most one
+ * mint, since a working cookie keeps authenticating regardless. Off-browser it
+ * returns false: no cookie jar is not the same as a blocked one.
+ */
+export function cookiesAreBlocked(cookieString) {
+    if (cookieString === undefined && typeof document === 'undefined') {
+        return false;
+    }
+    return (readCookie(COOKIE_PROBE_NAME, cookieString) === null &&
+        readCookie(PORTAL_ORIGIN_COOKIE_NAME, cookieString) === null);
+}
+/** The in-memory bearer, or null when the cookie path is carrying auth. */
+export function getCookielessBearer() {
+    return bearer;
+}
+/**
+ * Adopt a freshly minted bearer for the cookie-less path and make sure the
+ * fetch patch is live. Called after a re-exchange returns one in its body.
+ */
+export function setCookielessBearer(value) {
+    bearer = value || null;
+    if (bearer)
+        patchFetch();
+}
+// Same-origin only: the bearer must never ride a request to a third party the
+// app happens to call. A relative URL resolves against the document, so it is
+// same-origin by construction.
+function isSameOrigin(input) {
+    if (typeof window === 'undefined')
+        return false;
+    try {
+        const raw = typeof input === 'string'
+            ? input
+            : input instanceof URL
+                ? input.href
+                : input.url;
+        return new URL(raw, window.location.href).origin === window.location.origin;
+    }
+    catch {
+        return false;
+    }
+}
+// Patched once, and only after the cookie has been proven unavailable. A
+// Request argument carries immutable headers, so it is rebuilt rather than
+// mutated. The CSRF header rides along because a patched request may be a
+// server action, which cannot set it itself.
+function patchFetch() {
+    if (patched || typeof window === 'undefined')
+        return;
+    patched = true;
+    const originalFetch = window.fetch.bind(window);
+    window.fetch = function assemblyCookielessFetch(input, init) {
+        if (!bearer || !isSameOrigin(input)) {
+            return originalFetch(input, init);
+        }
+        if (input instanceof Request && !init) {
+            const headers = new Headers(input.headers);
+            headers.set(CLIENT_BEARER_HEADER, bearer);
+            headers.set(APP_CSRF_HEADER, '1');
+            return originalFetch(new Request(input, { headers }));
+        }
+        const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined));
+        headers.set(CLIENT_BEARER_HEADER, bearer);
+        headers.set(APP_CSRF_HEADER, '1');
+        return originalFetch(input, { ...init, headers });
+    };
+}
+/**
+ * Headers that ask the re-exchange route to return the bearer in its body.
+ * Shared with the renewal path in lib-client so both describe the cookie-less
+ * request the same way.
+ */
+export function cookielessReexchangeHeaders() {
+    return bearer
+        ? { [CLIENT_BEARER_HEADER]: bearer, [BEARER_IN_BODY_HEADER]: '1' }
+        : { [BEARER_IN_BODY_HEADER]: '1' };
+}

package/dist/lib-client.d.ts

@@ -1,2 +1,10 @@
 export declare function reexchangeBearer(): Promise<boolean>;
 export declare function authFetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+/**
+ * Mint an in-memory bearer at load when the browser is refusing to store the
+ * cookie, so the first client-side navigation is already authenticated instead
+ * of 404ing its way into a renewal. A no-op wherever the cookie works.
+ *
+ * Exported for tests; runs once at module load in the browser.
+ */
+export declare function bootstrapCookielessBearer(): Promise<boolean>;

package/dist/lib-client.js

@@ -6,6 +6,7 @@
 // (proxy.ts pulls constants from that barrel).
 import { AssemblyBridge } from '@assembly-js/app-bridge';
 import { APP_CSRF_HEADER, logRenewOutcome, TOKEN_EXPIRED_HEADER, } from './session-exchange.js';
+import { cookielessReexchangeHeaders, cookiesAreBlocked, getCookielessBearer, setCookielessBearer, } from './cookieless-bearer.js';
 const REEXCHANGE_PATH = '/api/assembly-reexchange';
 // Single-flight gate for renewals. Session tokens are single-use for exchange:
 // when the 60-minute bearer expires, every in-flight fetch on the page 401s at
@@ -33,6 +34,10 @@ async function renewBearer() {
     const previousUrlToken = typeof window === 'undefined'
         ? null
         : new URL(window.location.href).searchParams.get('token');
+    // Re-read per attempt rather than caching: the first call on a cookie-less
+    // browser is the bootstrap (no bearer yet), and the probe is the only thing
+    // that distinguishes it from a browser whose cookie simply expired.
+    const cookieless = cookiesAreBlocked();
     let token = AssemblyBridge.sessionToken.getCurrent()?.token ?? '';
     // Proactively refresh: we're recovering from an expiry, so avoid re-minting
     // from a session token that may itself be stale.
@@ -46,18 +51,33 @@ async function renewBearer() {
         bridgeRefreshFailed = true;
     }
     if (!token) {
-        logRenewOutcome('no_token', { bridgeRefreshFailed });
+        logRenewOutcome('no_token', { bridgeRefreshFailed, cookieless });
         return false;
     }
     try {
         const res = await fetch(REEXCHANGE_PATH, {
             method: 'POST',
-            headers: { 'x-assembly-token': token, [APP_CSRF_HEADER]: '1' },
+            headers: {
+                'x-assembly-token': token,
+                [APP_CSRF_HEADER]: '1',
+                ...(cookieless ? cookielessReexchangeHeaders() : {}),
+            },
         });
         logRenewOutcome(res.ok ? 'renewed' : 'rejected', {
             bridgeRefreshFailed,
             status: res.status,
+            cookieless,
         });
+        // On the cookie-less path the fresh bearer comes back in the body, because
+        // the Set-Cookie beside it is dropped exactly like the first one was. A body
+        // without one is a route that predates this path answering the ordinary way:
+        // the cookie was renewed if this browser keeps cookies, so the route's own
+        // verdict stands rather than failing a renewal that succeeded.
+        if (res.ok && cookieless) {
+            const body = await res.json().catch(() => null);
+            if (body?.bearer)
+                setCookielessBearer(body.bearer);
+        }
         if (res.ok && previousUrlToken !== null) {
             try {
                 const url = new URL(window.location.href);
@@ -74,7 +94,7 @@ async function renewBearer() {
         return res.ok;
     }
     catch {
-        logRenewOutcome('unavailable', { bridgeRefreshFailed });
+        logRenewOutcome('unavailable', { bridgeRefreshFailed, cookieless });
         return false;
     }
 }
@@ -106,3 +126,21 @@ export async function authFetch(input, init) {
     }
     return fetch(input, { ...init, headers });
 }
+/**
+ * Mint an in-memory bearer at load when the browser is refusing to store the
+ * cookie, so the first client-side navigation is already authenticated instead
+ * of 404ing its way into a renewal. A no-op wherever the cookie works.
+ *
+ * Exported for tests; runs once at module load in the browser.
+ */
+export function bootstrapCookielessBearer() {
+    if (typeof window === 'undefined')
+        return Promise.resolve(false);
+    if (!cookiesAreBlocked() || getCookielessBearer()) {
+        return Promise.resolve(false);
+    }
+    return reexchangeBearer();
+}
+// Self-running, mirroring origin-bootstrap: module evaluation precedes
+// hydration, so the bearer is in hand before any component's first fetch.
+void bootstrapCookielessBearer();

package/dist/paint-beacon.js

@@ -17,9 +17,22 @@ export const PAINTED_BEACON_PATH = '/__assembly/painted';
 export const PAINTED_BEACON_EVENT = 'assembly.painted';
 let scheduled = false;
 let fired = false;
+// Set by the app's error boundaries while they are the document's content.
+// A paint of the error boundary is not a paint of the app, and the parent
+// treats this beacon as proof the app is up — so it stays quiet and releases
+// the schedule latch, so the boundary can re-install it once the app has
+// rendered in its place.
+const ERROR_DOCUMENT_FLAG = '__assemblyErrorDocument';
+function isErrorDocument() {
+    return window[ERROR_DOCUMENT_FLAG] === true;
+}
 function firePaintBeacon() {
     if (fired)
         return;
+    if (isErrorDocument()) {
+        scheduled = false;
+        return;
+    }
     fired = true;
     if (typeof navigator !== 'undefined' && typeof navigator.sendBeacon === 'function') {
         navigator.sendBeacon(PAINTED_BEACON_PATH);

package/dist/session-exchange.d.ts

@@ -5,13 +5,17 @@ export declare function classifyExchangeFailure(status: number): MintFailure;
 export declare function serializeBearerCookie(value: string, maxAgeSeconds: number, partitioned: boolean): string;
 export declare const BEARER_HEADER_NAME = "x-assembly-request-bearer";
 export declare const APP_CSRF_HEADER = "x-assembly-app";
+export declare const CLIENT_BEARER_HEADER = "x-assembly-client-bearer";
+export declare const BEARER_IN_BODY_HEADER = "x-assembly-bearer-in-body";
+export declare const COOKIE_PROBE_NAME = "assembly-cookie-probe";
+export declare function serializeCookieProbe(partitioned: boolean, clear?: boolean): string;
 export declare const TOKEN_EXPIRED_HEADER = "x-assembly-token-expired";
 export declare const EXCHANGE_REJECTION_HEADER = "x-assembly-exchange-rejection";
 export type ExchangeRejectedViewer = 'same_viewer' | 'different_viewer';
 export declare function parseExchangeRejection(value: string | null): ExchangeRejectedViewer | undefined;
 export declare function isSessionExchangeEnabled(): boolean;
 export declare const COOKIE_OUTCOME_EVENT = "assembly.cookie_outcome";
-export type CookieOutcome = 'served_from_cookie' | 'minted' | `fail_closed:${string}`;
+export type CookieOutcome = 'served_from_cookie' | 'served_from_client_bearer' | 'minted' | `fail_closed:${string}`;
 export declare function logCookieOutcome(outcome: CookieOutcome, detail?: {
     rejectedToken?: string;
 }): void;
@@ -20,6 +24,7 @@ export type RenewOutcome = 'renewed' | 'no_token' | 'rejected' | 'unavailable';
 export declare function logRenewOutcome(outcome: RenewOutcome, detail?: {
     bridgeRefreshFailed?: boolean;
     status?: number;
+    cookieless?: boolean;
 }): void;
 export declare function isDocumentRequest(request: {
     method: string;

package/dist/session-exchange.js

@@ -47,6 +47,38 @@ export const BEARER_HEADER_NAME = 'x-assembly-request-bearer';
 // presence is sufficient: a cross-site request physically cannot carry a
 // custom header without a CORS preflight, and this app grants none.
 export const APP_CSRF_HEADER = 'x-assembly-app';
+// Bearer carried by the client instead of the cookie, for browsers that refuse
+// to store it: Safari blocks every cross-site-iframe cookie and does not
+// implement CHIPS, so nothing the proxy sets is ever sent back. Distinct from
+// BEARER_HEADER_NAME so an inbound value can never be mistaken for the one the
+// proxy forwards to the render; both are stripped from every inbound request.
+export const CLIENT_BEARER_HEADER = 'x-assembly-client-bearer';
+// Asks the re-exchange route to return the minted bearer in its response body.
+// Sent only by a client that has proven the cookie is unavailable, so a browser
+// whose cookie works keeps the original response shape and never receives a
+// bearer anywhere a script could read it.
+export const BEARER_IN_BODY_HEADER = 'x-assembly-bearer-in-body';
+// Client-readable twin of the bearer cookie: same attributes, no HttpOnly, no
+// value worth having. The bearer itself is HttpOnly, so its absence is
+// invisible to the client; a browser that dropped this one dropped the bearer
+// beside it, which is what the client tests to detect cookie-less mode.
+export const COOKIE_PROBE_NAME = 'assembly-cookie-probe';
+// The probe answers "can this browser store our cookies at all", which does not
+// stop being true when the bearer expires. Giving it the bearer's TTL would make
+// a cookie-capable browser look cookie-less at every renewal, so it outlives the
+// bearer and is cleared explicitly instead.
+const COOKIE_PROBE_TTL_SECONDS = 24 * 60 * 60;
+// Serialize the probe to accompany a bearer write or clear. Attributes mirror
+// serializeBearerCookie (minus HttpOnly, and minus its TTL) so the two share a
+// fate in any browser that refuses the cookie outright — a probe that survived
+// where the bearer was refused would make the detection lie.
+export function serializeCookieProbe(partitioned, clear = false) {
+    const maxAge = clear ? 0 : COOKIE_PROBE_TTL_SECONDS;
+    let cookie = `${COOKIE_PROBE_NAME}=1; Path=/; Secure; SameSite=None; Max-Age=${maxAge}`;
+    if (partitioned)
+        cookie += '; Partitioned';
+    return cookie;
+}
 // Marker header on 401s that mean "the bearer expired — re-exchange and retry",
 // emitted by requireAuth / getAssemblyForRequest / the re-exchange route. Its
 // absence on a denial is what lets authFetch skip renewal for genuine
@@ -99,12 +131,15 @@ export function logRenewOutcome(outcome,
 // `bridgeRefreshFailed` records that the pre-renewal token refresh threw and
 // we fell back to the token already in hand — on its own that is survivable,
 // but paired with a rejection it names the parent as the failing side.
+// `cookieless` marks a renewal on the header-borne path, so its success rate
+// can be read separately from the cookie population's.
 detail) {
     console.log(JSON.stringify({
         event_type: RENEW_OUTCOME_EVENT,
         outcome,
         ...(detail?.bridgeRefreshFailed ? { bridge_refresh_failed: true } : {}),
         ...(typeof detail?.status === 'number' ? { status: detail.status } : {}),
+        ...(detail?.cookieless ? { cookieless: true } : {}),
     }));
 }
 // Two-tier detection: Sec-Fetch-Dest when the browser sends it (all evergreen

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@assembly-js/app-foundation",
-  "version": "0.0.25-rc.3",
+  "version": "0.0.25-rc.5",
   "description": "Versioned foundation helpers and build context for Assembly generated apps",
   "type": "module",
   "files": [

package/skills/assembly-scheduled-work/SKILL.md

@@ -117,6 +117,9 @@ export const GET = cronRoute(async () => {
       ran++;
     } catch (err) {
       // One failing row must not poison the batch; leave it for the next tick.
+      // The error log is how the platform learns an action failed inside a
+      // tick that still returns 200 — keep it.
+      console.error('scheduled action failed', claimed.action, err);
       await db
         .update(scheduledActions)
         .set({ status: 'pending', claimedAt: null, lastError: err instanceof Error ? err.message : String(err) })