@assembly-js/app-foundation 0.3.7 → 0.3.9

package/CHANGELOG.md

@@ -19,6 +19,12 @@ A patch release never changes what an app's build requires; a minor release may
 not by hand; see `changes/README.md`. CI fails a PR that changes a check script without a
 `bump: minor` change file.
 
+## 0.3.9
+- [fix] `getOfflineAssembly` from `@assembly-js/app-foundation/scripts` now refuses to run inside Next, so a route under `app/` can no longer use it to act with the installer's access. The entry shipped in 0.2.1 for standalone scripts only and nothing the build agent is taught imports it from a route, so no existing app's code needs to change.
+
+## 0.3.8
+- [behavior] An app that calls a provider's inferred route now lists that provider in `.assembly/app-deps.json`.
+
 ## 0.3.7
 - [guidance] The `assembly-api-contract` skill now tells the build agent that every documented route must admit an app caller, so other apps' calls are not refused with a 403.
 

package/bin/scan-app-deps.mjs

@@ -28,6 +28,9 @@ const VIA_CLIENT = 'client';
 // Lets a reader tell a file from a scanner that sees client calls from an older one that
 // would omit them, since both look the same when an app has none.
 const DETECTS = [VIA_PROXY_PATH, VIA_CLIENT];
+const DETECTS_INFERRED_ROUTES = 'inferred-routes';
+// `via` only ever names a detector that finds calls, so it stays on DETECTS.
+const EMITTED_DETECTS = [...DETECTS, DETECTS_INFERRED_ROUTES];
 const CLIENT_SPECIFIER = /(?:^|\/)generated\/apps\/([^/]+)\/client(?:\.[jt]s)?$/;
 // The generated client's exports that make calls; its other exports (APP_ID, types) do not.
 const CLIENT_EXPORTS = new Set(['installerClient', 'viewerClient']);
@@ -237,7 +240,8 @@ function opsFor(provider, { template, method }) {
   const matched = (provider ?? []).filter((op) => templateMatches(op, template)).sort(bySpecificity(template));
   if (matched.length === 0) return (method ? [method] : PROXY_METHODS).map((m) => `${m} ${template}`);
   const winner = matched.filter((op) => op.template === matched[0].template);
-  if (winner.every((op) => op.method === INFERRED_METHOD)) return [];
+  // An inferred route accepts any method, so the template is the dependency whether or not the call states one.
+  if (winner.every((op) => op.method === INFERRED_METHOD)) return [`${INFERRED_METHOD} ${winner[0].template}`];
   if (method) return [`${method} ${winner[0].template}`];
   return winner.filter((op) => op.method !== INFERRED_METHOD).map((op) => `${op.method} ${op.template}`);
 }
@@ -269,7 +273,7 @@ export function scanAppDeps(root, { loadTs = loadTypeScript } = {}) {
     apps[appId] = { ops: [...ops.get(appId)].sort(byteCompare), via: DETECTS.filter((v) => via.get(appId).has(v)) };
   }
   const hashes = hashFiles(root, files, contents);
-  return { apps, detects: DETECTS, files: Object.fromEntries(files.map((f) => [f, hashes.get(f)])) };
+  return { apps, detects: EMITTED_DETECTS, files: Object.fromEntries(files.map((f) => [f, hashes.get(f)])) };
 }
 
 export const serializeAppDeps = (result) => JSON.stringify(result, null, 2) + '\n';

package/dist/scripts.d.ts

@@ -3,6 +3,6 @@ import { type AssemblyAPI } from '@assembly-js/node-sdk';
  * The script-side counterpart of `getOfflineAssembly` from `/server`: mints a
  * short-lived app-scoped bearer from `ASSEMBLY_API_KEY` and returns a bearer-only
  * client. There is no request here, so the viewer-identity guard `/server` applies
- * does not exist; use this only from scripts, never from code under `app/`.
+ * does not exist, so it refuses to run inside Next instead; use this only from scripts.
  */
 export declare function getOfflineAssembly(): Promise<AssemblyAPI>;

package/dist/scripts.js

@@ -4676,6 +4676,11 @@ async function mintBearerFromAppKey() {
 
 // src/scripts.ts
 async function getOfflineAssembly() {
+  if (process.env.NEXT_RUNTIME) {
+    throw new Error(
+      "getOfflineAssembly from '/scripts' must not run inside Next: its app-scoped bearer acts as the installer. Use getAssembly() or getAssemblyForRequest() from '/server' in user-facing routes, or getOfflineAssembly() from '/server' for cron and webhook routes"
+    );
+  }
   if (!process.env.ASSEMBLY_API_KEY) {
     throw new Error(
       "getOfflineAssembly: ASSEMBLY_API_KEY is not set \u2014 cannot mint an app-scoped bearer"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@assembly-js/app-foundation",
-  "version": "0.3.7",
+  "version": "0.3.9",
   "description": "Versioned foundation helpers and build context for Assembly generated apps",
   "type": "module",
   "files": [