@assembly-js/app-foundation 0.7.0 → 0.7.2

package/CHANGELOG.md

@@ -19,6 +19,12 @@ A patch release never changes what an app's build requires; a minor release may
 not by hand; see `changes/README.md`. CI fails a PR that changes a check script without a
 `bump: minor` change file.
 
+## 0.7.2
+- [guidance] The build agent now sets `allow="autoplay; fullscreen; picture-in-picture; encrypted-media"` and `allowfullscreen` on embedded video player iframes, so Vimeo and YouTube players can go fullscreen, autoplay and use picture-in-picture inside the portal.
+
+## 0.7.1
+- [fix] The location reporter no longer sends the host's embed-session params (`token`, `clientId`, `companyId`) with the app's location, so they never reach the host URL or a copied deep link.
+
 ## 0.7.0
 - [new] `deleteFile(key)` in `@assembly-js/app-foundation/server` permanently deletes a file stored with app-storage.
 - [guidance] The assembly-storage skill documents `deleteFile`: deletion is permanent, so apps that want recovery hide the record first and delete the file later.

package/CLAUDE.md

@@ -474,6 +474,7 @@ Because the app runs in an iframe inside the parent dashboard, several normal Ne
 - **Cookies must be `sameSite: 'none'` and `secure: true`.** Anything else is dropped silently in cross-origin iframes.
 - **No top-level navigation.** Don't use `window.location = '...'` to go to external URLs — it'll either break out of the iframe or be blocked. For external links use `<a target="_blank" rel="noreferrer">`.
 - **No `window.open(..., '_self')`.** Same issue.
+- **Nested video players re-delegate their permissions.** When you embed a Vimeo, YouTube or similar player in an `<iframe>`, set `allow="autoplay; fullscreen; picture-in-picture; encrypted-media"` and `allowfullscreen` on that iframe. Permissions pass down one frame at a time: the portal grants them to your app, but the player only gets them if your iframe grants them again, so without the attribute fullscreen, picture-in-picture and DRM playback fail silently.
 <!-- !feature:app-owned-header -->
 - **The portal owns the chrome (header, sidebar).** Don't render your own breadcrumbs or page titles via DOM. Use `@assembly-js/app-bridge` to set them.
 - **Never put the app name in breadcrumbs.** The parent portal *automatically* prepends the app's name as breadcrumb 0. If you also pass `{ label: 'MyApp' }` as the first entry of `setBreadcrumbs`, it renders twice ("MyApp / MyApp / Reports"). For a flat one-page app pass `[]` (or skip `setBreadcrumbs` entirely). For a multi-level app pass only the sub-pages: `setBreadcrumbs([{ label: 'Reports' }, { label: 'Q4 2026' }])`. Read `.claude/skills/assembly-app-bridge-header/SKILL.md` for full examples.

package/dist/location-prefix.d.ts

@@ -1,3 +1,9 @@
+export declare const HOST_SESSION_PARAMS: string[];
+/**
+ * The app's own query string with the host's embed-session params removed,
+ * as a `?`-prefixed string, or '' when nothing is left.
+ */
+export declare function stripHostSessionParams(searchParams: URLSearchParams): string;
 export declare function getSurfacePrefixes(): string[];
 export declare const SURFACE_PREFIXES: string[];
 /**

package/dist/location-prefix.js

@@ -1,4 +1,19 @@
 const DEFAULT_PREFIXES = ['/c', '/n'];
+// The host puts these on the iframe src to open the embed session. They are
+// not part of the app's location, and reporting them would put the token in
+// the host URL, browser history and every copied deep link.
+export const HOST_SESSION_PARAMS = ['token', 'clientId', 'companyId'];
+/**
+ * The app's own query string with the host's embed-session params removed,
+ * as a `?`-prefixed string, or '' when nothing is left.
+ */
+export function stripHostSessionParams(searchParams) {
+    const own = new URLSearchParams(searchParams);
+    for (const key of HOST_SESSION_PARAMS)
+        own.delete(key);
+    const qs = own.toString();
+    return qs ? `?${qs}` : '';
+}
 // Read surface prefixes from the build-time env value injected by withAssemblyDev.
 // Falls back to the historical /c and /n defaults so apps on an older image
 // continue to work without a rebuild.

package/dist/location-reporter.js

@@ -2,7 +2,7 @@
 import { Suspense, createElement, useEffect, useRef } from 'react';
 import { usePathname, useSearchParams, useRouter } from 'next/navigation';
 import { AssemblyBridge } from '@assembly-js/app-bridge';
-import { getSurfacePrefix, stripPrefix, addPrefix } from './location-prefix.js';
+import { getSurfacePrefix, stripPrefix, addPrefix, stripHostSessionParams } from './location-prefix.js';
 function LocationReporterInner() {
     const pathname = usePathname();
     const searchParams = useSearchParams();
@@ -19,8 +19,7 @@ function LocationReporterInner() {
         if (!bridgeLocation)
             return;
         const path = stripPrefix(pathname, prefix);
-        const qs = searchParams.toString();
-        bridgeLocation.report(path, qs ? `?${qs}` : '');
+        bridgeLocation.report(path, stripHostSessionParams(searchParams));
     }, [bridgeLocation, pathname, searchParams, prefix]);
     // Register the navigate handler once; rely on prefixRef for the current prefix.
     useEffect(() => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@assembly-js/app-foundation",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "description": "Versioned foundation helpers and build context for Assembly generated apps",
   "type": "module",
   "files": [