release: develop → main (v0.9.1 — hosted skill-CORS hotfix)

.changeset/release-notes-v0.9.1.md

@@ -0,0 +1,4 @@
+---
+---
+
+Release prep for v0.9.1 — adds the dated `.github/release-notes-20260530.md` used as the GitHub Release body. Docs/CI-only; no package version impact beyond the CORS hotfix changeset already on develop (#761).

.changeset/skill-cors-credentials-732.md

@@ -0,0 +1,5 @@
+---
+"ornn-web": patch
+---
+
+Fix hosted CORS failure blocking skill save / update / version-deprecation (#732). `skillApi.ts` set `credentials: "include"` on three raw-fetch calls (`createSkill`, `updateSkillPackage`, `setSkillVersionDeprecation`). These authenticate with the `Authorization: Bearer` header, never cookies, so the flag was unnecessary — and fatal: a credentialed request forbids a wildcard `Access-Control-Allow-Origin: *`, which the NyxID proxy returns, so the browser blocked every request at the CORS layer with "Failed to fetch". #528 only removed the dead `X-User-*` headers and #709 cleared the same trap in `activityApi.ts`; the `skillApi.ts` siblings were missed. Dropping `credentials: "include"` restores hosted skill creation, package update, and version deprecation.

.github/release-notes-20260530.md

@@ -0,0 +1,11 @@
+## Fixed
+
+- Saving, updating, or deprecating a skill no longer fails with a CORS error.
+
+## New Feature
+
+- Technical enhancement.
+
+## Changed
+
+- Technical enhancement.

ornn-web/src/services/skillApi.ts

@@ -67,7 +67,6 @@ export async function setSkillVersionDeprecation(
     {
       method: "PATCH",
       headers,
-      credentials: "include",
       body: JSON.stringify(body),
     },
   );
@@ -96,6 +95,15 @@ export async function setSkillVersionDeprecation(
  * CORS error. Same dead code as the `apiClient.createHeaders`
  * cleanup; this was the last unmigrated caller of the ZIP-upload
  * flow.
+ *
+ * #732 / #709 — also drop `credentials: "include"` here (and on the
+ * PUT/PATCH siblings below). These calls authenticate with the
+ * `Authorization: Bearer` header, never cookies. With
+ * `credentials: "include"` the browser rejects the NyxID proxy's
+ * wildcard `Access-Control-Allow-Origin: *` (a credentialed request
+ * forbids wildcard ACAO), blocking the request at the CORS layer
+ * before it leaves the browser — the exact "Failed to fetch" symptom
+ * in #732. Same trap #709 already cleared in activityApi.ts.
  */
 export async function createSkill(zipFile: File, skipValidation = false): Promise<SkillDetail> {
   const token = useAuthStore.getState().accessToken;
@@ -111,7 +119,6 @@ export async function createSkill(zipFile: File, skipValidation = false): Promis
     method: "POST",
     headers,
     body: zipFile,
-    credentials: "include",
   });
 
   if (!response.ok) {
@@ -151,7 +158,6 @@ export async function updateSkillPackage(id: string, zipFile: File, skipValidati
     method: "PUT",
     headers,
     body: zipFile,
-    credentials: "include",
   });
 
   if (!response.ok) {