@isomorph.ai/app-sdk 1.5.0 → 1.5.1

package/README.md

@@ -61,3 +61,21 @@ App code declares exact HTTPS pages and named click/fill selectors reviewed for
 `isomorph dev` uses canned server-model fixtures. `dev --real` supplies an approved development connection to the action process. Hosted actions resolve their exact ACTIVE version key. The current V2 PLAN is published after LIVE; before key activation, an AI action fails and later actions retry. LIVE alone is not AI acceptance.
 
 Requires compatible SDK/CLI/toolkit publication, gateway protocol fixes, governance connection routes and V2 packaging/version wiring. No deployment is claimed here. Real model/file authorization and hosted Chromium sandbox checks remain release acceptance. Search, company skills, integration/browser writes, video, audio, STT, TTS and realtime audio are deferred.
+
+## Where the browser client sends its calls
+
+`createClient()` with no `baseUrl` picks its base URL like this:
+
+- In Node (the retained-check runner, the kit runtime), `ISOMORPH_GATEWAY_URL`.
+- In a browser, `window.__isomorphApiOrigin` when it is an `http(s)` origin
+  string such as `https://fourier-app-x.api.preview.beta.apps.isomorph.ai`.
+  A deployed kit page carries the platform's credential shim, a `<script>` in
+  `<head>` that sets this global to the app's own API host and wraps
+  `window.fetch` so calls there carry the sign-in cookie; the realtime socket
+  and `files.getPublicUrl` follow the same host. Nothing in the app sets it.
+- Otherwise the page-relative default (`''`, or `/p/<org>.<app>` on the
+  shared edge): a local `isomorph run` and a page without the shim are
+  unchanged.
+
+A value that is not an `http(s)` origin — a path, a trailing slash, another
+scheme, a non-string — is ignored. An explicit `baseUrl` always wins.

package/dist/index.js

@@ -145,6 +145,11 @@ class Transport {
     constructor(options, onUnauthorized) {
         this.onUnauthorized = onUnauthorized;
         this.baseUrl = (options.baseUrl ?? applicationBaseUrl()).replace(/\/$/, '');
+        // Captured here, at createClient() time, not when this module is
+        // evaluated: a kit page's credential shim (a plain <script> in <head>)
+        // wraps window.fetch before any module script runs, so the fetch bound
+        // below is the wrapped one, and a call to the API origin leaves with
+        // credentials: 'include' although the transport asks for 'same-origin'.
         this.fetch = options.fetch ?? globalThis.fetch.bind(globalThis);
         this.identity = options.identity;
     }
@@ -192,9 +197,27 @@ function applicationBaseUrl() {
         const runtime = globalThis.process;
         return (runtime?.env?.ISOMORPH_GATEWAY_URL ?? '').replace(/\/$/, '');
     }
+    // A kit page served from CloudFront talks to its own API host, not to the
+    // page origin: the transform injects the credential shim into the page and
+    // the shim publishes that host as window.__isomorphApiOrigin (an origin,
+    // https://<org>-<app>.api.<zone>, no path). Anything that is not an http(s)
+    // origin is ignored, so a page without the shim (isomorph run, a git app on
+    // the shared edge) keeps the page-relative base URL below.
+    const apiOrigin = globalThis.__isomorphApiOrigin;
+    if (typeof apiOrigin === 'string' && isHttpOrigin(apiOrigin))
+        return apiOrigin;
     const match = /^\/p\/([a-z0-9-]+\.[a-z0-9-]+)(?:\/|$)/.exec(location.pathname);
     return match ? `/p/${match[1]}` : '';
 }
+function isHttpOrigin(value) {
+    try {
+        const url = new URL(value);
+        return (url.protocol === 'https:' || url.protocol === 'http:') && url.origin === value;
+    }
+    catch {
+        return false;
+    }
+}
 // Result is what awaiting the builder resolves to: T[] for a list query, T
 // after .single(), T | null after .maybeSingle(). The gateway applies the
 // cardinality; the type follows it so a reader of these declarations sees the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@isomorph.ai/app-sdk",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "type": "module",
   "repository": {
     "type": "git",