Blame for frontend/src/lib/api.js

/** Set when the frontend and API aren't same-origin (e.g. a standalone Azure Function App
 * backend) — empty string keeps existing relative-path behavior (HF Spaces, local dev). */
const API_BASE_URL = (import.meta.env.VITE_API_BASE_URL || '').replace(/\/$/, '');

export function apiUrl(path) {
    return API_BASE_URL && path.startsWith('/api') ? `${API_BASE_URL}${path}` : path;
}

/** Browser cookie session + tenant APIs require credentials on same-origin / proxied /api calls. */
export function apiFetch(input, init = {}) {
    const url = typeof input === 'string' ? apiUrl(input) : input;
    return fetch(url, { credentials: 'include', ...init });
}