@crossworks/app-build 0.232.381 → 0.232.385

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crossworks/app-build",
-  "version": "0.232.381",
+  "version": "0.232.385",
   "type": "module",
   "main": "./src/index.ts",
   "types": "./src/index.ts",
@@ -11,7 +11,7 @@
     "src"
   ],
   "dependencies": {
-    "@mantle/share-ui": "npm:@crossworks/share-ui@0.232.381",
+    "@mantle/share-ui": "npm:@crossworks/share-ui@0.232.385",
     "@tailwindcss/oxide": "^4.3.3",
     "esbuild": "^0.28.2",
     "lucide-react": "^1.41.0",

package/src/kit.test.ts

@@ -14,6 +14,29 @@ describe('@host kit ↔ bridge protocol mirror', () => {
     }
   });
 
+  it('exposes host.me(), read from the frame-baked viewer (app identity)', () => {
+    expect(HOST).toContain('window.__mantleHostMe');
+    expect(HOST).toMatch(/export const host = \{\n {2}me,/);
+    // No email anywhere in the answer.
+    expect(HOST).not.toMatch(/email:/);
+  });
+
+  it('host.me() answers the baked viewer, and rejects where none was baked', async () => {
+    const src = HOST.slice(HOST.indexOf('function me() {'));
+    const body = src.slice(0, src.indexOf('\n}\n') + 2);
+    const make = (win: Record<string, unknown>) =>
+      new Function('window', `${body}; return me;`)(win) as () => Promise<unknown>;
+    await expect(
+      make({ __mantleHostMe: { id: 'u_a', name: 'Pat', kind: 'member', email: 'x' } })(),
+    ).resolves.toEqual({ id: 'u_a', name: 'Pat', kind: 'member' });
+    await expect(make({ __mantleHostMe: { kind: 'public' } })()).resolves.toEqual({
+      id: null,
+      name: null,
+      kind: 'public',
+    });
+    await expect(make({})()).rejects.toThrow(/not available/);
+  });
+
   it('exposes the team-hub namespace with the enumerated hub kinds', () => {
     expect(HOST).toContain("kind: 'hub.get'");
     // All nav intents post the SAME event kind with the target shapes the

package/src/kit.ts

@@ -200,7 +200,23 @@ function paintAnnotations(regions) {
   }
 }
 
+// Who runs the app (app identity): { id, name, kind }, for DISPLAY. The
+// frame route bakes it into the frame document from its verified ticket
+// (window.__mantleHostMe), so it needs no round trip and no parent support.
+// id is a per-app pseudonym (null on an open link), name the display name
+// or null, kind 'admin' | 'member' | 'client' | 'contact' | 'public'. There
+// is no email. To RECORD who did something, put :host_me_id / :host_me_name /
+// :host_me_kind in host.db SQL: the server fills those, the browser cannot.
+function me() {
+  const v = window.__mantleHostMe;
+  if (!v || typeof v !== 'object') {
+    return Promise.reject(new Error('host.me() is not available in this frame'));
+  }
+  return Promise.resolve({ id: v.id ?? null, name: v.name ?? null, kind: v.kind });
+}
+
 export const host = {
+  me,
   tools: {
     call: (slug, input) => post({ kind: 'tool.call', slug, input: input ?? {} }),
   },