@assembly-js/app-foundation 0.6.0 → 0.6.1

package/CHANGELOG.md

@@ -19,6 +19,9 @@ A patch release never changes what an app's build requires; a minor release may
 not by hand; see `changes/README.md`. CI fails a PR that changes a check script without a
 `bump: minor` change file.
 
+## 0.6.1
+- [fix] The client-call scan no longer reports a `fetch` to the AI proxy (`POST /v1/ai/openai/...`) as breaking: the platform now admits a client bearer on that route. Nothing in the app changes.
+
 ## 0.6.0
 - [new] `AuthUnavailableError` carries a fixed digest (`AUTH_UNAVAILABLE_DIGEST`), so an app's error boundary can recognise a platform outage after production has redacted the error.
 - [action] A platform outage reaches the retry screen from every page, not only the root layout: `app/error.tsx` renders it on that digest and no helper or route may swallow the error; the renewal limiter earlier updates copied into the app is removed now that the package bounds renewal itself.

package/bin/client-safe-sdk-methods.mjs

@@ -14,6 +14,7 @@ export const CLIENT_SAFE_ROUTES = Object.freeze([
   { method: 'POST', path: '/v1/notifications/{id}/read', sdkMethod: 'markNotificationRead' },
   { method: 'POST', path: '/v1/notifications/{id}/unread', sdkMethod: 'markNotificationUnread' },
   { method: 'GET', path: '/v1/session/flags', sdkMethod: null },
+  { method: 'POST', path: '/v1/ai/openai/*proxyPath', sdkMethod: null }, // the AI proxy; reached through `fetch`
 ].map(Object.freeze));
 
 // retrieveClient is allowlisted by name: whether the id is the viewer's own is a runtime
@@ -27,10 +28,15 @@ export const CLIENT_SAFE_SDK_METHODS = Object.freeze(
 // Marked client-safe routes that no SDK method reaches yet.
 export const CLIENT_SAFE_ROUTES_WITHOUT_SDK_METHOD = CLIENT_SAFE_ROUTES.filter((r) => !r.sdkMethod).length;
 
-// `{id}` stands for exactly one non-empty path segment.
+// `{id}` stands for exactly one non-empty path segment; a trailing `*name` stands for the rest of
+// the path, as the platform's wildcard does.
 // The id segment excludes `.` and `%` so `.`, `..` and `%2e` forms that URL normalisation resolves elsewhere fail closed.
-const routePattern = (route) =>
-  new RegExp(`^${route.path.split('/').map((seg) => (seg === '{id}' ? '[A-Za-z0-9_-]+' : seg.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'))).join('/')}$`);
+const segmentPattern = (seg) => {
+  if (seg === '{id}') return '[A-Za-z0-9_-]+';
+  if (seg.startsWith('*')) return '.+';
+  return seg.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+};
+const routePattern = (route) => new RegExp(`^${route.path.split('/').map(segmentPattern).join('/')}$`);
 const ROUTE_MATCHERS = CLIENT_SAFE_ROUTES.map((route) => ({ method: route.method, pattern: routePattern(route) }));
 
 // Whether `fetch(path, { method })` hits a client-safe route; `path` has no query string.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@assembly-js/app-foundation",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Versioned foundation helpers and build context for Assembly generated apps",
   "type": "module",
   "files": [