@assembly-js/app-foundation 0.0.48 → 0.0.49

package/CHANGELOG.md

@@ -14,6 +14,9 @@ A foundation update reads the sections between an app's version and the target:
 from every bullet except `[guidance]`, agent work from the check scripts those `[action]`
 bullets ship. Write `[fix]`, `[behavior]` and `[action]` bullets for the app's owner.
 
+## 0.0.49
+- [fix] Scheduled-work wiring, proxy, and session-token problems are now caught when the platform updates the app, not only when the app's own change touches them.
+
 ## 0.0.48
 - [guidance] Builds now warn when an app lacks the retry screen for platform outages, calls the child-row batch detached from the database, or imports a PDF library on the server that breaks after publishing, with the exact steps to fix each; nothing in an existing app changes until its code is updated.
 

package/bin/check-crons.mjs

@@ -10,7 +10,8 @@
 // Node are guaranteed.
 //
 // The build fails only for cron wiring the current turn is changing (see
-// cronWiringChangedThisTurn). Everything else — a template clone, a Vercel
+// cronWiringChangedThisTurn), or for any finding with --strict (a platform
+// update turn). Everything else — a template clone, a Vercel
 // build, an update turn that never touched the cron — gets the same findings
 // as warnings: those paths have no agent who can act on a failure, so failing
 // them would only strand an app that already worked. A below-floor schedule
@@ -38,6 +39,10 @@ const ROUTE_FILE = /^route\.(tsx|ts|jsx|js)$/;
 // The turn program exports the SHA the sandbox started this turn at; the files
 // below are the ones whose change since then makes the findings the agent's own.
 const TURN_BASELINE_ENV = 'ASSEMBLY_TURN_BASELINE_SHA';
+// Set by the turn program on a platform update turn, where the update itself is
+// the mandate to fix whatever is wrong, so findings fail the build whether or
+// not the turn touched the cron wiring.
+const STRICT = process.argv.includes('--strict') || process.env.ASSEMBLY_UPDATE_TURN === '1';
 const CRON_WIRING_PATHS = ['vercel.json', 'app/api/cron/'];
 
 function report(lines, { fatal }) {
@@ -312,4 +317,4 @@ if (entries.length > 0) {
 }
 
 if (preexistingIntervals.length > 0) report(preexistingIntervals, { fatal: false });
-if (problems.length > 0) report(problems, { fatal: cronWiringChangedThisTurn() });
+if (problems.length > 0) report(problems, { fatal: STRICT || cronWiringChangedThisTurn() });

package/bin/check-proxy-csrf.mjs

@@ -13,10 +13,11 @@
 // carries a session token, so nothing here needs the network.
 //
 // Like check-crons, a broken proxy fails the build only when the current turn
-// changed it (or with --strict, which the update acceptance passes); otherwise
-// the findings are warnings, since there is no agent to act on them. An app
-// still on the pre-bearer foundation only ever warns outside --strict: the
-// platform security update is what fixes it, not an ordinary turn.
+// changed it (or with --strict, which the update acceptance passes, or on a
+// platform update turn); otherwise the findings are warnings, since there is
+// no agent to act on them. An app still on the pre-bearer foundation only ever
+// warns outside those: the platform security update is what fixes it, not an
+// ordinary turn.
 import { existsSync, readFileSync } from 'node:fs';
 import { spawnSync } from 'node:child_process';
 import { createRequire } from 'node:module';
@@ -25,7 +26,10 @@ import { join } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
 const ROOT = process.cwd();
-const STRICT = process.argv.includes('--strict');
+// Set by the turn program on a platform update turn, where the update itself is
+// the mandate to fix whatever is wrong. Routine updates only reach apps that
+// took the security update, so no pre-bearer app sees this outside it.
+const STRICT = process.argv.includes('--strict') || process.env.ASSEMBLY_UPDATE_TURN === '1';
 const PROXY_FILES = ['proxy.ts', 'middleware.ts'];
 const REEXCHANGE_ROUTE = 'app/api/assembly-reexchange/route.ts';
 const REEXCHANGE_PATH = '/api/assembly-reexchange';

package/bin/check-token-usage.mjs

@@ -19,11 +19,16 @@
 // logic_build.go (mintBearerProbePath / packageWorldProbePath): mint-bearer.ts
 // present -> bearer-capable, fatal; absent + assembly.ts present -> legacy, warn
 // and exit 0; neither present -> package-world app (bearer-capable via
-// @assembly-js/app-foundation in node_modules), fatal as today.
+// @assembly-js/app-foundation in node_modules), fatal as today. With --strict
+// or on a platform update turn it is fatal even in a legacy app.
 import { readFileSync, readdirSync, existsSync } from 'node:fs';
 import { join, relative, sep } from 'node:path';
 
 const ROOT = process.cwd();
+// Set by the turn program on a platform update turn, where the update itself is
+// the mandate to fix whatever is wrong. Routine updates only reach apps that
+// took the security update, so no pre-bearer app sees this outside it.
+const STRICT = process.argv.includes('--strict') || process.env.ASSEMBLY_UPDATE_TURN === '1';
 const APP_DIR = join(ROOT, 'app');
 
 // Mirrors mintBearerProbePath / packageWorldProbePath in logic_build.go.
@@ -129,7 +134,7 @@ for (const file of pageFiles(APP_DIR)) {
 
 if (violations.length > 0) {
   const isLegacy =
-    !existsSync(join(ROOT, MINT_BEARER_PROBE_PATH)) && existsSync(join(ROOT, PACKAGE_WORLD_PROBE_PATH));
+    !STRICT && !existsSync(join(ROOT, MINT_BEARER_PROBE_PATH)) && existsSync(join(ROOT, PACKAGE_WORLD_PROBE_PATH));
 
   console.error('');
   console.error('A page reads the session token from searchParams:');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@assembly-js/app-foundation",
-  "version": "0.0.48",
+  "version": "0.0.49",
   "description": "Versioned foundation helpers and build context for Assembly generated apps",
   "type": "module",
   "files": [