@isomorph.ai/app-sdk 2.3.0 → 2.3.1

package/dist/aws.js

@@ -67,7 +67,11 @@ export async function runtimeCredentials(env = process.env, { fetch: fetcher = f
         throw new Error('the runtime has no AWS credentials (AWS_ACCESS_KEY_ID, or AWS_ROLE_ARN with AWS_WEB_IDENTITY_TOKEN_FILE)');
     if (webIdentity?.roleArn === roleArn && webIdentity.expiresAt - now() > 5 * 60_000)
         return webIdentity.credentials;
-    const region = env.AWS_REGION || env.AWS_DEFAULT_REGION || 'us-east-1';
+    // STS is called in the runtime's own region, which the runtime always has (Lambda and the kit chart set
+    // it). No default: a cell outside us-east-1 under a region-pinning policy must never fall back there.
+    const region = env.AWS_REGION || env.AWS_DEFAULT_REGION;
+    if (!region)
+        throw new Error('the runtime has no AWS region (AWS_REGION) for its STS exchange');
     // The token is read on each exchange: the kubelet rotates the file.
     const body = new URLSearchParams({ Action: 'AssumeRoleWithWebIdentity', Version: '2011-06-15', RoleArn: roleArn, RoleSessionName: env.AWS_ROLE_SESSION_NAME || 'isomorph-runtime', WebIdentityToken: (await readFile(tokenFile, 'utf8')).trim() });
     const response = await fetcher(`https://sts.${region}.amazonaws.com/`, { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: body.toString(), signal: AbortSignal.timeout(10_000) });

package/dist/computer-use-api.js

@@ -10,6 +10,8 @@ export function computerUseApi({ env = process.env, fetch } = {}) {
     const base = env.ISOMORPH_COMPUTER_USE_URL?.replace(/\/+$/, '');
     if (!base)
         throw new Error('This app has no computer use API (ISOMORPH_COMPUTER_USE_URL is not set).');
+    // The computer use API is Harbour's own, in Harbour's region: this default names a Harbour-owned endpoint,
+    // not the cell's region, and stays until the call moves behind the app gateway (ADR 0078).
     const region = env.ISOMORPH_COMPUTER_USE_REGION || 'us-east-1';
     const transport = fetch ? { fetch } : {};
     const call = async (path, body) => signedJsonPost({ ...await runtimeCredentials(env, transport), region }, 'execute-api', `${base}${path}`, body, transport);

package/dist/runtime.js

@@ -685,8 +685,13 @@ export class Runtime {
         const abort = () => controller.abort();
         response.once('close', abort);
         const directory = header(request, 'X-Harbour-Verified-Directory');
+        const userId = header(request, 'X-Harbour-Verified-User-ID');
         const user = {
-            id: header(request, 'X-Harbour-Verified-User-ID'),
+            id: userId,
+            // A service credential's call arrives with the credential as the verified user
+            // (`service:<clientId>`, ADR 0101); the action sees it as `kind: 'service'`, the
+            // shape `/_harbour/identity/current` already answers. Anything else is a person.
+            ...(userId.startsWith('service:') ? { kind: 'service' } : {}),
             email: header(request, 'X-Harbour-Verified-User-Email'),
             groups: userGroupsFromHeader(header(request, 'X-Harbour-Verified-User-Groups')),
             role: userRole(header(request, 'X-Harbour-Verified-User-Role')),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@isomorph.ai/app-sdk",
-  "version": "2.3.0",
+  "version": "2.3.1",
   "type": "module",
   "repository": {
     "type": "git",