@isomorph.ai/app-sdk 1.11.0 → 1.12.1

package/dist/index.js

@@ -189,7 +189,13 @@ class Transport {
         const response = await this.fetch(`${this.baseUrl}${path}`, {
             credentials: 'same-origin',
             ...init,
-            headers: mergeHeaders({ 'content-type': 'application/json' }, runnerIdentityHeaders(this.identity), init.headers, onProgress ? { accept: PROGRESS_MEDIA_TYPE } : undefined),
+            headers: mergeHeaders(
+            // No content type on a request without a body: a browser GET that
+            // carries one is not a "simple" request, so it costs a CORS preflight
+            // (OPTIONS, one more round trip, on a separate uncredentialed
+            // connection a preconnect cannot warm) before the GET itself. Without
+            // it the identity GET and every other read is one round trip.
+            init.body === undefined && ['GET', 'HEAD'].includes((init.method ?? 'GET').toUpperCase()) ? {} : { 'content-type': 'application/json' }, runnerIdentityHeaders(this.identity), init.headers, onProgress ? { accept: PROGRESS_MEDIA_TYPE } : undefined),
         });
         if (onProgress && response.ok && response.body && response.headers.get('content-type')?.startsWith(PROGRESS_MEDIA_TYPE)) {
             return readProgress(response, onProgress);
@@ -492,6 +498,19 @@ export function createClient(options = {}) {
             },
         };
     }
+    // A kit page on its own API host pays for its first call three times over:
+    // a fresh connection (TCP, TLS, then a CORS preflight), the 401 → context
+    // refresh → resend detour once the context cookie has lapsed, and only then
+    // the call. Sending the identity GET now — the one the API host heals — opens
+    // the connection, renews a lapsed context and caches the user while the page
+    // is still rendering, so the first action rides an open connection with a
+    // live context; a refusal while it is in flight shares it (renew above). A
+    // page-relative base (isomorph dev, a git app on the shared edge) already has
+    // its connection and the edge heals its GETs, so nothing is sent there, and
+    // under Node the identity is a static token. Its outcome is the page's to
+    // read through identity.current() and onChange, never surfaced here.
+    if (transport.separateApiHost)
+        void refreshIdentity().catch(() => undefined);
     const scheduleIdentityRefresh = () => {
         if (refreshTimer !== undefined || authListeners.size === 0 || identityRefreshMs <= 0)
             return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@isomorph.ai/app-sdk",
-  "version": "1.11.0",
+  "version": "1.12.1",
   "type": "module",
   "repository": {
     "type": "git",