@assembly-js/app-foundation 0.2.5 → 0.2.6

package/CHANGELOG.md

@@ -19,6 +19,9 @@ A patch release never changes what an app's build requires; a minor release may
 not by hand; see `changes/README.md`. CI fails a PR that changes a check script without a
 `bump: minor` change file.
 
+## 0.2.6
+- [fix] The app keeps connecting to a portal on a custom domain, and keeps telling the editor when it has loaded, without relying on a platform setting that is being retired. Nothing visible changes.
+
 ## 0.2.5
 - [new] The client-call scan no longer reports reading the session's token details, a client's allowed fetch routes, or a harmless local namespace import as breaking; nothing in the app changes.
 

package/bin/foundation-exports.mjs

@@ -30,7 +30,7 @@ export const NON_CLIENT_EXPORTS = new Set([
   'InternalUserAccess', 'LEGACY_APP_IDS', 'MintFailure', 'MintOutcome', 'MintSessionOptions', 'MintedAppBearer',
   'MintedBearer', 'NETWORK_CAPTURE_MESSAGE_TYPE', 'NetworkCaptureHeaderFingerprint',
   'NetworkCaptureRecord', 'PAINTED_BEACON_EVENT', 'PAINTED_BEACON_PATH',
-  'PORTAL_ORIGIN_COOKIE_NAME', 'PREVIEW_V2_FLAG', 'PdfText', 'PrincipalAllow', 'PrincipalKind',
+  'PORTAL_ORIGIN_COOKIE_NAME', 'PdfText', 'PrincipalAllow', 'PrincipalKind',
   'Provider', 'ProxyOpts', 'RENEW_OUTCOME_EVENT', 'RenewOutcome', 'ReplaceChildRowsResult',
   'RequestSource', 'ResolveResourceOpts', 'ResourceError', 'ResourceFieldMap',
   'ResourceOption', 'ResourcePage', 'ScheduleCadence', 'SlackChannel',

package/dist/origin-bootstrap.d.ts

@@ -1,6 +1,5 @@
 export declare const PORTAL_ORIGIN_COOKIE_NAME = "assembly-portal-origin";
 export declare const CLIENT_FLAGS_COOKIE_NAME = "assembly-flags";
-export declare const PREVIEW_V2_FLAG = "app-builder-preview-v2";
 /**
  * Reads a single cookie by name from a cookie string (defaults to
  * `document.cookie`). Shared by every module that reads a proxy-mirrored
@@ -9,14 +8,13 @@ export declare const PREVIEW_V2_FLAG = "app-builder-preview-v2";
 export declare function readCookie(name: string, cookieString?: string): string | null;
 /**
  * Whether the given flag key is present in the proxy-mirrored flags cookie.
- * Exported for other vNext modules (e.g. the paint beacon) to check the same
- * cookie without re-parsing it themselves.
+ * Exported so client modules can gate on a flag without re-parsing the cookie.
  */
 export declare function hasClientFlag(key: string, cookieString?: string): boolean;
 /**
  * Register the workspace's portal origin with the bridge allowlist — from the
- * proxy-set cookie when the preview-v2 flag is on, from the legacy framing
- * origin otherwise. Returns the origin it registered, or null when there was
- * nothing to do. Exported for tests; runs once at module load in the browser.
+ * proxy-set cookie when it is readable, from the framing origin otherwise.
+ * Returns the origin it registered, or null when there was nothing to do.
+ * Exported for tests; runs once at module load in the browser.
  */
 export declare function bootstrapPortalOrigin(cookieString?: string): string | null;

package/dist/origin-bootstrap.js

@@ -2,20 +2,18 @@
 // evaluation precedes hydration — so the workspace's portal origin joins the
 // bridge allowlist before any component's first header/session-token call.
 //
-// The preview-v2 flag selects WHICH trust source registers the origin — it
-// never selects whether anything registers at all (flag-off must keep custom
-// portal domains working exactly as pre-vNext package versions did):
+// Two trust sources, in order:
 //
-//  - flag ON: the proxy-set cookie. The value is platform-resolved, never
-//    inferred client-side — the proxy already fetches workspace.portalUrl for
-//    its CSP frame-ancestors header and mirrors it into this client-readable
-//    cookie. Immune to the navigation-state poisoning below.
-//  - flag OFF (or flags cookie unreadable): the legacy browser-reported
-//    framing origin (ancestorOrigins, referrer fallback). Trusting it is
-//    sound because the proxy's CSP frame-ancestors already gates who may
-//    frame the app, but it rides navigation state — strip-able by privacy
-//    modes and poisoned by in-iframe reloads — which is why the cookie path
-//    replaces it.
+//  - the proxy-set cookie. The value is platform-resolved, never inferred
+//    client-side — the proxy already fetches workspace.portalUrl for its CSP
+//    frame-ancestors header and mirrors it into this client-readable cookie.
+//    Immune to the navigation-state poisoning below.
+//  - when that cookie is unreadable (a browser blocking the app's cookies):
+//    the browser-reported framing origin (ancestorOrigins, referrer
+//    fallback). Trusting it is sound because the proxy's CSP frame-ancestors
+//    already gates who may frame the app, but it rides navigation state —
+//    strip-able by privacy modes and poisoned by in-iframe reloads — which is
+//    why the cookie comes first.
 //
 // The bridge has no trust bypass, so one of these registrations is the only
 // way a custom portal domain becomes a valid parent (dashboard/platform
@@ -29,7 +27,6 @@ export const PORTAL_ORIGIN_COOKIE_NAME = 'assembly-portal-origin';
 // plain, comma-separated cookie on every request (set or cleared, never
 // left stale).
 export const CLIENT_FLAGS_COOKIE_NAME = 'assembly-flags';
-export const PREVIEW_V2_FLAG = 'app-builder-preview-v2';
 /**
  * Reads a single cookie by name from a cookie string (defaults to
  * `document.cookie`). Shared by every module that reads a proxy-mirrored
@@ -51,8 +48,7 @@ export function readCookie(name, cookieString) {
 }
 /**
  * Whether the given flag key is present in the proxy-mirrored flags cookie.
- * Exported for other vNext modules (e.g. the paint beacon) to check the same
- * cookie without re-parsing it themselves.
+ * Exported so client modules can gate on a flag without re-parsing the cookie.
  */
 export function hasClientFlag(key, cookieString) {
     const raw = readCookie(CLIENT_FLAGS_COOKIE_NAME, cookieString);
@@ -61,11 +57,11 @@ export function hasClientFlag(key, cookieString) {
     return raw.split(',').includes(key);
 }
 /**
- * Legacy (pre-vNext) framing-origin resolution: `location.ancestorOrigins`
+ * Framing-origin resolution for when the portal-origin cookie is unreadable: `location.ancestorOrigins`
  * (browser-attested; Chromium/WebKit), falling back to `document.referrer`
  * (Firefox). Null outside an iframe or when neither source is available.
  */
-function resolveLegacyParentOrigin() {
+function resolveFramingOrigin() {
     if (typeof window === 'undefined')
         return null;
     if (window.parent === window)
@@ -85,25 +81,20 @@ function resolveLegacyParentOrigin() {
 }
 /**
  * Register the workspace's portal origin with the bridge allowlist — from the
- * proxy-set cookie when the preview-v2 flag is on, from the legacy framing
- * origin otherwise. Returns the origin it registered, or null when there was
- * nothing to do. Exported for tests; runs once at module load in the browser.
+ * proxy-set cookie when it is readable, from the framing origin otherwise.
+ * Returns the origin it registered, or null when there was nothing to do.
+ * Exported for tests; runs once at module load in the browser.
  */
 export function bootstrapPortalOrigin(cookieString) {
-    if (!hasClientFlag(PREVIEW_V2_FLAG, cookieString)) {
-        // Flag off: behave exactly like pre-vNext package versions so custom
-        // portal domains keep a working bridge — and so turning the flag OFF is
-        // a true rollback, not a third state. Https-only: local dev origins are
-        // already on the default allowlist.
-        const origin = resolveLegacyParentOrigin();
+    const record = readCookie(PORTAL_ORIGIN_COOKIE_NAME, cookieString);
+    if (!record) {
+        // Https-only: local dev origins are already on the default allowlist.
+        const origin = resolveFramingOrigin();
         if (!origin || !origin.startsWith('https://'))
             return null;
         AssemblyBridge.configure({ additionalOrigins: [origin] });
         return origin;
     }
-    const record = readCookie(PORTAL_ORIGIN_COOKIE_NAME, cookieString);
-    if (!record)
-        return null;
     // Accept only a bare https origin — anything else (paths, http, garbage)
     // is not a value the proxy writes and must not reach the allowlist.
     try {

package/dist/paint-beacon.js

@@ -6,13 +6,7 @@
 // The HTTP route is handled in proxy.ts via the helpers below (same
 // package-delegation pattern as session-exchange). The bridge post rides
 // buffer-until-learned, so a paint that beats the parent's hello is not lost.
-//
-// Gated on the preview-v2 flag (see origin-bootstrap.ts's hasClientFlag):
-// installPaintBeacon() no-ops for a flag-off workspace, so the client never
-// calls sendBeacon and the proxy's route never sees a request — no need to
-// separately gate handlePaintedBeacon() below.
 import { AssemblyBridge } from '@assembly-js/app-bridge';
-import { hasClientFlag, PREVIEW_V2_FLAG } from './origin-bootstrap.js';
 export const PAINTED_BEACON_PATH = '/__assembly/painted';
 export const PAINTED_BEACON_EVENT = 'assembly.painted';
 let scheduled = false;
@@ -46,9 +40,7 @@ function firePaintBeacon() {
  * hydration + rAF wins. Does nothing on the server.
  */
 export function installPaintBeacon() {
-    if (typeof window === 'undefined' || scheduled)
-        return;
-    if (!hasClientFlag(PREVIEW_V2_FLAG))
+    if (typeof window === 'undefined' || typeof document === 'undefined' || scheduled)
         return;
     scheduled = true;
     const afterPaint = () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@assembly-js/app-foundation",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "description": "Versioned foundation helpers and build context for Assembly generated apps",
   "type": "module",
   "files": [