@frontera-sdk/core 1.45.14 → 1.46.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontera-sdk/core",
-  "version": "1.45.14",
+  "version": "1.46.0",
   "description": "Frontera app runtime: the platform bridge client, app bootstrap and typed platform client.",
   "keywords": [
     "frontera",

package/src/app-session.ts

@@ -4,11 +4,24 @@ import type { FronteraRuntimeGlobal } from './config'
 
 export type FronteraAppMode = 'embedded' | 'standalone' | 'local'
 
+/**
+ * Which transport this App should use.
+ *
+ * `framed` alone decides embedding — it is the only fact that answers "is there
+ * a parent to talk to". `platformOrigin` is an INPUT to that conversation, not
+ * evidence of it: `connectToHost` resolves the origin itself and falls back to
+ * `document.referrer` when the host injected nothing.
+ *
+ * Requiring `platformOrigin` here made a framed App fall through to `null` and
+ * report "not configured" — while the deployment was fine and only its
+ * `CORS_ORIGIN` was `*`, which is the default. The App then hung before issuing
+ * a single request, so nothing in the browser named the cause.
+ */
 export function detectAppMode(
   runtime: FronteraRuntimeGlobal,
   framed: boolean,
 ): FronteraAppMode | null {
-  if (framed && runtime.platformOrigin) return 'embedded'
+  if (framed) return 'embedded'
   if (runtime.sessionEndpoint) return 'standalone'
   if (runtime.devSessionEndpoint) return 'local'
   return null

package/src/bridge-client.ts

@@ -38,10 +38,14 @@ export interface ConnectOptions {
  * Who is framing us.
  *
  * The injected runtime config comes FIRST and `document.referrer` is only a
- * fallback, which is the opposite of the original order and the reason the
- * handshake could not complete in production: app responses are served with
- * `referrer-policy: no-referrer`, so the referrer is empty exactly where it
- * mattered. `platformOrigin` exists in the injected config for this purpose.
+ * fallback. The injected value is preferred because it is exact and, when it
+ * comes from the signed per-mount claim, unforgeable — not because the
+ * referrer is empty. (An earlier version of this comment blamed the
+ * `referrer-policy: no-referrer` these responses carry; that header governs
+ * the referrer this document SENDS on its own requests, not the
+ * `document.referrer` its parent handed it, which is set by the embedding
+ * page's policy — the platform frame does populate it, and pre-1.45 Apps
+ * mounted through exactly this fallback for months.)
  */
 function resolveParentOrigin(explicit?: string): string | null {
   if (explicit) return explicit

package/src/create-frontera-app.tsx

@@ -232,6 +232,10 @@ export function FronteraAppProvider({
     const framed = typeof window !== 'undefined' && window.parent !== window
     const mode = detectAppMode(runtime, framed)
     if (!mode) {
+      // Reachable only when NOT framed: `detectAppMode` returns 'embedded' for
+      // any framed document, so a null mode means there is no parent and no
+      // session endpoint either. A framed App that cannot resolve a parent
+      // origin fails later and more precisely, inside `connectToHost`.
       setError(
         new Error(
           'Frontera App is not configured: no embedded host, standalone session endpoint, or local development session endpoint was provided.',