@assembly-js/app-foundation 0.6.2 → 0.6.4

package/CHANGELOG.md

@@ -19,6 +19,12 @@ A patch release never changes what an app's build requires; a minor release may
 not by hand; see `changes/README.md`. CI fails a PR that changes a check script without a
 `bump: minor` change file.
 
+## 0.6.4
+- [behavior] An app's sandbox now sends its sandbox grant when minting an app bearer, so the platform can tell its calls from the deployed app's.
+
+## 0.6.3
+- [fix] The client-call scan no longer reports `retrieveCompany` on the viewer client as breaking: the platform now lets a client read its own active company (`GET /v1/companies/{id}`), and refuses any other company. Nothing in the app changes.
+
 ## 0.6.2
 - [guidance] The build agent now returns a failed AI call as `{ ok: false, message }` with the proxy's error instead of throwing, and saves a chat's question and answer together only once the answer has arrived.
 

package/CLAUDE.md

@@ -1196,7 +1196,7 @@ if (id?.internalUserId) {
 }
 ```
 
-Client-side, the same fields come from `useAssembly()` (seeded from the server, no token). If you also need the full record:
+Client-side, the same fields come from `useAssembly()` (seeded from the server, no token). If you also need the full record (a client may read only its own record and its active company, `id.companyId`; any other company id is refused):
 
 ```ts
 const assembly = await getAssembly();

package/bin/client-safe-sdk-methods.mjs

@@ -9,6 +9,7 @@
 // give it a method here when the SDK gains one.
 export const CLIENT_SAFE_ROUTES = Object.freeze([
   { method: 'GET', path: '/v1/clients/{id}', sdkMethod: 'retrieveClient' }, // the client's own record only
+  { method: 'GET', path: '/v1/companies/{id}', sdkMethod: 'retrieveCompany' }, // the viewer's own company only
   { method: 'GET', path: '/v1/me', sdkMethod: 'retrieveMe' },
   { method: 'GET', path: '/v1/notifications', sdkMethod: 'listNotifications' },
   { method: 'POST', path: '/v1/notifications/{id}/read', sdkMethod: 'markNotificationRead' },
@@ -17,8 +18,8 @@ export const CLIENT_SAFE_ROUTES = Object.freeze([
   { method: 'POST', path: '/v1/ai/openai/*proxyPath', sdkMethod: null }, // the AI proxy; reached through `fetch`
 ].map(Object.freeze));
 
-// retrieveClient is allowlisted by name: whether the id is the viewer's own is a runtime
-// fact a static scan cannot see. The notification routes are open to clients, and the
+// retrieveClient and retrieveCompany are allowlisted by name: whether the id is the viewer's
+// own is a runtime fact a static scan cannot see. The notification routes are open to clients, and the
 // platform pins a client caller to their own notifications. Creating, retrieving and
 // deleting a notification stay off the list: those routes are not open to clients.
 export const CLIENT_SAFE_SDK_METHODS = Object.freeze(

package/dist/mint-bearer.js

@@ -171,9 +171,15 @@ export async function mintBearerFromAppKey() {
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), EXCHANGE_TIMEOUT_MS);
     try {
+        // Present only in the app's sandbox (written to .env.local, never to the deployed
+        // env); it lets the platform tell a sandbox call from a deployed one.
+        const sandboxGrant = process.env.ASSEMBLY_SANDBOX_GRANT;
         const resp = await fetch(`${base}/v1/token`, {
             method: 'POST',
-            headers: { 'X-API-Key': apiKey },
+            headers: sandboxGrant
+                ? { 'X-API-Key': apiKey, 'Content-Type': 'application/json' }
+                : { 'X-API-Key': apiKey },
+            ...(sandboxGrant ? { body: JSON.stringify({ sandboxGrant }) } : {}),
             signal: controller.signal,
         });
         if (!resp.ok)

package/dist/scripts.js

@@ -4652,9 +4652,11 @@ async function mintBearerFromAppKey() {
   const controller = new AbortController();
   const timeoutId = setTimeout(() => controller.abort(), EXCHANGE_TIMEOUT_MS);
   try {
+    const sandboxGrant = process.env.ASSEMBLY_SANDBOX_GRANT;
     const resp = await fetch(`${base}/v1/token`, {
       method: "POST",
-      headers: { "X-API-Key": apiKey },
+      headers: sandboxGrant ? { "X-API-Key": apiKey, "Content-Type": "application/json" } : { "X-API-Key": apiKey },
+      ...sandboxGrant ? { body: JSON.stringify({ sandboxGrant }) } : {},
       signal: controller.signal
     });
     if (!resp.ok) return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@assembly-js/app-foundation",
-  "version": "0.6.2",
+  "version": "0.6.4",
   "description": "Versioned foundation helpers and build context for Assembly generated apps",
   "type": "module",
   "files": [