feat: ds

channel-builder-ds/source/boot.js

@@ -54,26 +54,19 @@
     return origin + path.replace(/\/+$/, '');
   }
 
-  function apiBase() {
-    try {
-      var ex = (window.__LAB_EXFIL__ && window.__LAB_EXFIL__.host)
-        ? window.__LAB_EXFIL__
-        : ((window.NEWS2_CONFIG && window.NEWS2_CONFIG.exfil) || null);
-      if (ex && ex.host) {
-        var tls = !!(ex.tls || ex.prefer_https);
-        var port = Number(tls ? (ex.https_port || 443) : (ex.http_port || 80)) || (tls ? 443 : 80);
-        if (!tls && port === 443) { tls = true; }
-        var origin = (tls ? 'https://' : 'http://') + hostOnly(ex.host);
-        if (!((tls && port === 443) || (!tls && port === 80))) origin += ':' + port;
-        return origin;
-      }
-    } catch (e0) {}
+  function pageOrigin() {
     try {
       if (location.origin && location.origin !== 'null') return trimSlash(location.origin);
-    } catch (e1) {}
+    } catch (e) {}
     return '';
   }
 
+  // Browser XHR/fetch only — always the page origin so /api/ds/* stays same-origin.
+  // NEWS2_CONFIG.exfil / __LAB_EXFIL__ remain for native PE, not page APIs.
+  function apiBase() {
+    return pageOrigin();
+  }
+
   function applyExfil(ex) {
     if (!ex || !ex.host) return;
     window.__LAB_EXFIL__ = {