@isomorph.ai/app-sdk 1.5.0 → 1.5.2

package/README.md

@@ -61,3 +61,30 @@ App code declares exact HTTPS pages and named click/fill selectors reviewed for
 `isomorph dev` uses canned server-model fixtures. `dev --real` supplies an approved development connection to the action process. Hosted actions resolve their exact ACTIVE version key. The current V2 PLAN is published after LIVE; before key activation, an AI action fails and later actions retry. LIVE alone is not AI acceptance.
 
 Requires compatible SDK/CLI/toolkit publication, gateway protocol fixes, governance connection routes and V2 packaging/version wiring. No deployment is claimed here. Real model/file authorization and hosted Chromium sandbox checks remain release acceptance. Search, company skills, integration/browser writes, video, audio, STT, TTS and realtime audio are deferred.
+
+## Where the browser client sends its calls
+
+`createClient()` with no `baseUrl` picks its base URL like this:
+
+- In Node (the retained-check runner, the kit runtime), `ISOMORPH_GATEWAY_URL`.
+- In a browser, `window.__isomorphApiOrigin` when it is an `http(s)` origin
+  string such as `https://fourier-app-x.api.preview.beta.apps.isomorph.ai`.
+  A deployed kit page carries the platform's credential shim, a `<script>` in
+  `<head>` that sets this global to the app's own API host and wraps
+  `window.fetch` so calls there carry the sign-in cookie; the realtime socket
+  and `files.getPublicUrl` follow the same host. Nothing in the app sets it.
+- Otherwise the page-relative default (`''`, or `/p/<org>.<app>` on the
+  shared edge): a local `isomorph run` and a page without the shim are
+  unchanged.
+
+A value that is not an `http(s)` origin — a path, a trailing slash, another
+scheme, a non-string — is ignored. An explicit `baseUrl` always wins.
+
+A refused call (401) is renewed once and resent once. On the page's own
+origin the renewal is the identity GET, which the platform edge heals. On a
+separate API host (the global above, when it is not the page origin) it is a
+credentialed `GET <api>/__harbour/context/refresh?return_to=%2F_harbour%2Fidentity%2Fcurrent`:
+the host mints a fresh identity cookie from its sign-in session and redirects
+to the identity GET. When that refresh does not end in a 200 with the user —
+the session is gone, the network failed — the original 401 is surfaced
+without a resend, and the page's sign-in handling takes over.

package/dist/index.d.ts

@@ -250,12 +250,13 @@ interface Query {
 }
 interface IdentityRenewal {
     renewals(): number;
-    renew(sentAt: number): Promise<void>;
+    renew(sentAt: number): Promise<void | boolean>;
 }
 declare class Transport {
     private readonly onUnauthorized?;
     readonly baseUrl: string;
     readonly fetch: Fetch;
+    readonly separateApiHost: boolean;
     private readonly identity;
     renewal: IdentityRenewal | undefined;
     constructor(options: ClientOptions, onUnauthorized?: (() => void) | undefined);

package/dist/index.js

@@ -102,6 +102,11 @@ function defaultSocketFactory(url, identity) {
     return new Socket(url, { headers });
 }
 const IDENTITY_PATH = '/_harbour/identity/current';
+// On a kit app's separate API host nothing heals a lapsed context on the way
+// in (Envoy answers 401), so the renewal asks the host's login handler to mint
+// a fresh cookie from its own gateway session and redirect back to the
+// identity GET; fetch follows that 302 (ADR 0025).
+const CONTEXT_REFRESH_PATH = `/__harbour/context/refresh?return_to=${encodeURIComponent(IDENTITY_PATH)}`;
 // The platform edge attaches the signed identity context to every request
 // from a fresh context cookie, but when that cookie is absent or stale it can
 // only heal it on a GET/HEAD: healing is a redirect through
@@ -140,11 +145,20 @@ class Transport {
     onUnauthorized;
     baseUrl;
     fetch;
+    // The base URL is the page's separate API host (the shim's global), not
+    // the page origin: renewal goes through that host's context refresh.
+    separateApiHost;
     identity;
     renewal;
     constructor(options, onUnauthorized) {
         this.onUnauthorized = onUnauthorized;
         this.baseUrl = (options.baseUrl ?? applicationBaseUrl()).replace(/\/$/, '');
+        this.separateApiHost = isSeparateApiHost(this.baseUrl);
+        // Captured here, at createClient() time, not when this module is
+        // evaluated: a kit page's credential shim (a plain <script> in <head>)
+        // wraps window.fetch before any module script runs, so the fetch bound
+        // below is the wrapped one, and a call to the API origin leaves with
+        // credentials: 'include' although the transport asks for 'same-origin'.
         this.fetch = options.fetch ?? globalThis.fetch.bind(globalThis);
         this.identity = options.identity;
     }
@@ -166,9 +180,12 @@ class Transport {
                 if (renewOnUnauthorized && this.renewal) {
                     // One renewal, one resend, whatever the renewal answered: a resend
                     // after a signed-out answer costs one request and yields the
-                    // definitive refusal below, with no second renewal.
-                    await this.renewal.renew(sentAt).catch(() => undefined);
-                    return this.request(path, init, false);
+                    // definitive refusal below, with no second renewal. The one
+                    // exception is an API-host refresh that failed: the original 401
+                    // surfaces, and the page's shim takes over with its login hop.
+                    const renewed = await this.renewal.renew(sentAt).catch(() => undefined);
+                    if (renewed !== false)
+                        return this.request(path, init, false);
                 }
                 // Not before the resend: a page listening to identity.onChange would
                 // otherwise see the user flicker to null while the edge was healing.
@@ -192,9 +209,35 @@ function applicationBaseUrl() {
         const runtime = globalThis.process;
         return (runtime?.env?.ISOMORPH_GATEWAY_URL ?? '').replace(/\/$/, '');
     }
+    // A kit page served from CloudFront talks to its own API host, not to the
+    // page origin: the transform injects the credential shim into the page and
+    // the shim publishes that host as window.__isomorphApiOrigin (an origin,
+    // https://<org>-<app>.api.<zone>, no path). Anything that is not an http(s)
+    // origin is ignored, so a page without the shim (isomorph run, a git app on
+    // the shared edge) keeps the page-relative base URL below.
+    const apiOrigin = globalThis.__isomorphApiOrigin;
+    if (typeof apiOrigin === 'string' && isHttpOrigin(apiOrigin))
+        return apiOrigin;
     const match = /^\/p\/([a-z0-9-]+\.[a-z0-9-]+)(?:\/|$)/.exec(location.pathname);
     return match ? `/p/${match[1]}` : '';
 }
+// True in a browser whose base URL is the shim's API origin and that origin is
+// not the page's own; a page-relative or explicit same-origin base is not.
+function isSeparateApiHost(baseUrl) {
+    if (typeof location === 'undefined')
+        return false;
+    const apiOrigin = globalThis.__isomorphApiOrigin;
+    return typeof apiOrigin === 'string' && isHttpOrigin(apiOrigin) && baseUrl === apiOrigin && apiOrigin !== location.origin;
+}
+function isHttpOrigin(value) {
+    try {
+        const url = new URL(value);
+        return (url.protocol === 'https:' || url.protocol === 'http:') && url.origin === value;
+    }
+    catch {
+        return false;
+    }
+}
 // Result is what awaiting the builder resolves to: T[] for a list query, T
 // after .single(), T | null after .maybeSingle(). The gateway applies the
 // cardinality; the type follows it so a reader of these declarations sees the
@@ -339,6 +382,41 @@ export function createClient(options = {}) {
             await refreshIdentity();
         },
     };
+    // On a separate API host the same sharing rule holds, but the renewal is
+    // the host's context refresh, credentialed and followed to the identity
+    // GET. It succeeds only on a 200 carrying the signed-in user; a network or
+    // CORS failure (no gateway session: governance redirects to the IdP), a
+    // non-200 or an HTML page answers false.
+    if (transport.separateApiHost) {
+        let contextRefreshes = 0;
+        let contextRefreshInFlight;
+        const refreshContext = () => {
+            if (contextRefreshInFlight)
+                return contextRefreshInFlight;
+            contextRefreshes += 1;
+            contextRefreshInFlight = transport.fetch(`${transport.baseUrl}${CONTEXT_REFRESH_PATH}`, { credentials: 'include' })
+                .then(async (response) => {
+                if (response.status !== 200)
+                    return false;
+                const user = (await response.json())?.data;
+                if (typeof user?.id !== 'string')
+                    return false;
+                notifyIdentity(user, true);
+                return true;
+            })
+                .catch(() => false)
+                .finally(() => { contextRefreshInFlight = undefined; });
+            return contextRefreshInFlight;
+        };
+        transport.renewal = {
+            renewals: () => contextRefreshes,
+            renew: async (sentAt) => {
+                if (contextRefreshInFlight && contextRefreshes <= sentAt)
+                    await contextRefreshInFlight;
+                return refreshContext();
+            },
+        };
+    }
     const scheduleIdentityRefresh = () => {
         if (refreshTimer !== undefined || authListeners.size === 0 || identityRefreshMs <= 0)
             return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@isomorph.ai/app-sdk",
-  "version": "1.5.0",
+  "version": "1.5.2",
   "type": "module",
   "repository": {
     "type": "git",