@base44-preview/sdk 0.8.35-pr.220.75109b8 → 0.8.35-pr.221.5933e35

package/dist/client.js

@@ -50,7 +50,7 @@ import { createAnalyticsModule } from "./modules/analytics.js";
  */
 export function createClient(config) {
     var _a, _b;
-    const { serverUrl = "https://base44.app", appId, token, serviceToken, requiresAuth = false, appBaseUrl, options, functionsVersion, headers: optionalHeaders, } = config;
+    const { serverUrl = "https://base44.app", appId, token, serviceToken, requiresAuth = false, appBaseUrl, options, functionsVersion, headers: optionalHeaders, disableAnalytics = false, adapter, } = config;
     // Normalize appBaseUrl to always be a string (empty if not provided or invalid)
     const normalizedAppBaseUrl = typeof appBaseUrl === "string" ? appBaseUrl : "";
     const socketConfig = {
@@ -84,6 +84,7 @@ export function createClient(config) {
         headers,
         token,
         onError: options === null || options === void 0 ? void 0 : options.onError,
+        adapter,
     });
     const functionsAxiosClient = createAxiosClient({
         baseURL: `${serverUrl}/api`,
@@ -91,6 +92,7 @@ export function createClient(config) {
         token,
         interceptResponses: false,
         onError: options === null || options === void 0 ? void 0 : options.onError,
+        adapter,
     });
     const serviceRoleHeaders = {
         ...headers,
@@ -101,12 +103,14 @@ export function createClient(config) {
         headers: serviceRoleHeaders,
         token: serviceToken,
         onError: options === null || options === void 0 ? void 0 : options.onError,
+        adapter,
     });
     const serviceRoleFunctionsAxiosClient = createAxiosClient({
         baseURL: `${serverUrl}/api`,
         headers: functionHeaders,
         token: serviceToken,
         interceptResponses: false,
+        adapter,
     });
     const userAuthModule = createAuthModule(axiosClient, functionsAxiosClient, appId, {
         appBaseUrl: normalizedAppBaseUrl,
@@ -157,6 +161,7 @@ export function createClient(config) {
             serverUrl,
             appId,
             userAuthModule,
+            disabled: disableAnalytics,
         }),
         cleanup: () => {
             userModules.analytics.cleanup();

package/dist/client.types.d.ts

@@ -1,3 +1,4 @@
+import type { AxiosRequestConfig } from "axios";
 import type { EntitiesModule } from "./modules/entities.types.js";
 import type { IntegrationsModule } from "./modules/integrations.types.js";
 import type { AuthModule } from "./modules/auth.types.js";
@@ -68,6 +69,28 @@ export interface CreateClientConfig {
      * @internal
      */
     headers?: Record<string, string>;
+    /**
+     * Disables the {@link AnalyticsModule | analytics module} entirely.
+     *
+     * When `true`, `base44.analytics.track()` becomes a no-op and no background
+     * processing or heartbeat timers are started. Set this for server-side
+     * clients (SSR, edge runtimes) where background timers must not run.
+     * {@linkcode createServerClient | createServerClient()} sets this automatically.
+     *
+     * Analytics is also automatically disabled outside a browser environment.
+     *
+     * @defaultValue `false`
+     */
+    disableAnalytics?: boolean;
+    /**
+     * Axios adapter override for HTTP requests.
+     *
+     * By default, axios picks an adapter based on the runtime. Set this to
+     * `'fetch'` in edge runtimes such as Cloudflare Workers, where the default
+     * adapter detection can pick the wrong adapter.
+     * {@linkcode createServerClient | createServerClient()} sets this automatically.
+     */
+    adapter?: AxiosRequestConfig["adapter"];
     /**
      * Additional client options.
      */

package/dist/index.d.ts

@@ -1,8 +1,9 @@
 import { createClient, createClientFromRequest, type Base44Client, type CreateClientConfig, type CreateClientOptions } from "./client.js";
+import { createServerClient, type CreateServerClientOptions } from "./server.js";
 import { Base44Error, type Base44ErrorJSON } from "./utils/axios-client.js";
 import { getAccessToken, saveAccessToken, removeAccessToken, getLoginUrl } from "./utils/auth-utils.js";
-export { createClient, createClientFromRequest, Base44Error, getAccessToken, saveAccessToken, removeAccessToken, getLoginUrl, };
-export type { Base44Client, CreateClientConfig, CreateClientOptions, Base44ErrorJSON, };
+export { createClient, createClientFromRequest, createServerClient, Base44Error, getAccessToken, saveAccessToken, removeAccessToken, getLoginUrl, };
+export type { Base44Client, CreateClientConfig, CreateClientOptions, CreateServerClientOptions, Base44ErrorJSON, };
 export * from "./types.js";
 export type { DeleteManyResult, DeleteResult, EntitiesModule, EntityFilterOperators, EntityFilterQuery, EntityFilterValue, EntityHandler, EntityRecord, EntityTypeRegistry, ImportResult, RealtimeEventType, RealtimeEvent, RealtimeCallback, SortField, UpdateManyResult, } from "./modules/entities.types.js";
 export type { AuthModule, LoginResponse, RegisterParams, VerifyOtpParams, ChangePasswordParams, ResetPasswordParams, User, } from "./modules/auth.types.js";

package/dist/index.js

@@ -1,5 +1,6 @@
 import { createClient, createClientFromRequest, } from "./client.js";
+import { createServerClient, } from "./server.js";
 import { Base44Error } from "./utils/axios-client.js";
 import { getAccessToken, saveAccessToken, removeAccessToken, getLoginUrl, } from "./utils/auth-utils.js";
-export { createClient, createClientFromRequest, Base44Error, getAccessToken, saveAccessToken, removeAccessToken, getLoginUrl, };
+export { createClient, createClientFromRequest, createServerClient, Base44Error, getAccessToken, saveAccessToken, removeAccessToken, getLoginUrl, };
 export * from "./types.js";

package/dist/modules/analytics.d.ts

@@ -11,8 +11,10 @@ export interface AnalyticsModuleArgs {
     serverUrl: string;
     appId: string;
     userAuthModule: AuthModule;
+    /** Skips all analytics processing when true (e.g. for server-side clients). */
+    disabled?: boolean;
 }
-export declare const createAnalyticsModule: ({ axiosClient, serverUrl, appId, userAuthModule, }: AnalyticsModuleArgs) => {
+export declare const createAnalyticsModule: ({ axiosClient, serverUrl, appId, userAuthModule, disabled, }: AnalyticsModuleArgs) => {
     track: (params: TrackEventParams) => void;
     cleanup: () => void;
 };

package/dist/modules/analytics.js

@@ -30,11 +30,16 @@ const analyticsSharedState = getSharedInstance(ANALYTICS_SHARED_STATE_NAME, () =
         ...getAnalyticsConfigFromUrlParams(),
     },
 }));
-export const createAnalyticsModule = ({ axiosClient, serverUrl, appId, userAuthModule, }) => {
+export const createAnalyticsModule = ({ axiosClient, serverUrl, appId, userAuthModule, disabled = false, }) => {
     var _a;
     // prevent overflow of events //
     const { maxQueueSize, throttleTime, batchSize } = analyticsSharedState.config;
-    if (!((_a = analyticsSharedState.config) === null || _a === void 0 ? void 0 : _a.enabled)) {
+    // Analytics is browser-only. Outside a browser (SSR, Cloudflare Workers,
+    // Node) timers would leak — or throw at global scope in Workers — so the
+    // module becomes a no-op there, and when explicitly disabled.
+    if (disabled ||
+        typeof window === "undefined" ||
+        !((_a = analyticsSharedState.config) === null || _a === void 0 ? void 0 : _a.enabled)) {
         return {
             track: () => { },
             cleanup: () => { },

package/dist/modules/auth.js

@@ -1,3 +1,4 @@
+import { setAccessTokenCookie, clearAccessTokenCookie, } from "../utils/auth-utils.js";
 function isInsideIframe() {
     if (typeof window === "undefined")
         return false;
@@ -129,6 +130,8 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
                         console.error("Failed to remove token from localStorage:", e);
                     }
                 }
+                // Clear the cookie that mirrors the token for SSR
+                clearAccessTokenCookie();
                 // Determine the from_url parameter
                 const fromUrl = redirectUrl || window.location.href;
                 // Redirect to server-side logout endpoint to clear HTTP-only cookies
@@ -155,6 +158,8 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
                 catch (e) {
                     console.error("Failed to save token to localStorage:", e);
                 }
+                // Mirror the token into a cookie so document requests carry it to SSR
+                setAccessTokenCookie(token);
             }
         },
         // Login using username and password

package/dist/server.d.ts

@@ -0,0 +1,111 @@
+import type { Base44Client } from "./client.types.js";
+/**
+ * Options for creating a server-side Base44 client with {@linkcode createServerClient | createServerClient()}.
+ */
+export interface CreateServerClientOptions {
+    /**
+     * The incoming Fetch API `Request`.
+     *
+     * Used to resolve configuration from `Base44-*` headers, the user token from
+     * the `Authorization` header, and the `base44_access_token` cookie set by the
+     * browser SDK.
+     */
+    request: Request;
+    /**
+     * Environment variables record, such as a Cloudflare Worker `env` binding or
+     * Node's `process.env`.
+     *
+     * Recognized variables: `BASE44_APP_ID`, `BASE44_API_URL`,
+     * `BASE44_SERVICE_TOKEN`, and `BASE44_FUNCTIONS_VERSION`.
+     */
+    env?: Record<string, string | undefined>;
+    /**
+     * The Base44 app ID. Takes precedence over `env.BASE44_APP_ID` and the
+     * `Base44-App-Id` request header.
+     */
+    appId?: string;
+    /**
+     * The Base44 server URL. Must be an absolute URL. Takes precedence over
+     * `env.BASE44_API_URL` and the `Base44-Api-Url` request header.
+     *
+     * @defaultValue `"https://base44.app"`
+     */
+    serverUrl?: string;
+    /**
+     * User authentication token. Takes precedence over the request's
+     * `Authorization: Bearer` header and the `base44_access_token` cookie.
+     */
+    token?: string;
+    /**
+     * Service role authentication token. Takes precedence over
+     * `env.BASE44_SERVICE_TOKEN` and the `Base44-Service-Authorization` request
+     * header.
+     */
+    serviceToken?: string;
+    /**
+     * Version string for the functions API. Takes precedence over
+     * `env.BASE44_FUNCTIONS_VERSION` and the `Base44-Functions-Version` request
+     * header.
+     * @internal
+     */
+    functionsVersion?: string;
+}
+/**
+ * Creates a Base44 client for server-side rendering (SSR) and edge runtimes.
+ *
+ * Use this function in Cloudflare Workers, framework loaders, and other
+ * server environments that handle Fetch API requests. Unlike
+ * {@linkcode createClient | createClient()}, the returned client is safe to
+ * create per request outside a browser: analytics is fully disabled (no
+ * background timers), HTTP requests use the `fetch` adapter, and no browser
+ * storage is touched.
+ *
+ * Each configuration value is resolved in order from: the explicit option,
+ * the `env` record (`BASE44_APP_ID`, `BASE44_API_URL`, `BASE44_SERVICE_TOKEN`,
+ * `BASE44_FUNCTIONS_VERSION`), and finally the request headers — the same
+ * `Base44-*` headers read by
+ * {@linkcode createClientFromRequest | createClientFromRequest()}. The user
+ * token is resolved from the explicit option, then the request's
+ * `Authorization: Bearer` header, then the `base44_access_token` cookie that
+ * the browser SDK mirrors from localStorage.
+ *
+ * @param options - Server client options, including the incoming request and optional environment record.
+ * @returns A configured Base44 client instance scoped to the incoming request.
+ * @throws {Error} When no app ID can be resolved from the options, environment, or request headers.
+ * @throws {Error} When the resolved server URL isn't an absolute URL.
+ *
+ * @example
+ * ```typescript
+ * // Cloudflare Worker fetch handler
+ * import { createServerClient } from '@base44/sdk';
+ *
+ * export default {
+ *   async fetch(request, env) {
+ *     const base44 = createServerClient({ request, env });
+ *
+ *     // Reads data as the user identified by the request's cookie or
+ *     // Authorization header (anonymous when neither is present)
+ *     const products = await base44.entities.Products.list();
+ *
+ *     return Response.json({ products });
+ *   }
+ * };
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // Framework loader (React Router, Remix, and similar)
+ * import { createServerClient } from '@base44/sdk';
+ *
+ * export async function loader({ request }) {
+ *   const base44 = createServerClient({
+ *     request,
+ *     appId: 'my-app-id'
+ *   });
+ *
+ *   const user = await base44.auth.me().catch(() => null);
+ *   return { user };
+ * }
+ * ```
+ */
+export declare function createServerClient(options: CreateServerClientOptions): Base44Client;

package/dist/server.js

@@ -0,0 +1,157 @@
+import { createClient } from "./client.js";
+const ACCESS_TOKEN_COOKIE_NAME = "base44_access_token";
+/**
+ * Returns the first truthy value, treating empty strings the same as unset.
+ */
+function firstNonEmpty(...values) {
+    for (const value of values) {
+        if (value) {
+            return value;
+        }
+    }
+    return undefined;
+}
+/**
+ * Extracts the token from a `Bearer <token>` authorization header value.
+ * Returns undefined when the header is missing or malformed.
+ */
+function parseBearerToken(header) {
+    if (!header) {
+        return undefined;
+    }
+    const parts = header.split(" ");
+    if (parts.length === 2 && parts[0] === "Bearer" && parts[1]) {
+        return parts[1];
+    }
+    return undefined;
+}
+/**
+ * Minimal cookie parser (no dependency): reads a single cookie value from a
+ * `Cookie` request header, handling quoted values and URL-encoding.
+ */
+function getCookieValue(cookieHeader, name) {
+    if (!cookieHeader) {
+        return undefined;
+    }
+    for (const part of cookieHeader.split(";")) {
+        const separatorIndex = part.indexOf("=");
+        if (separatorIndex === -1) {
+            continue;
+        }
+        if (part.slice(0, separatorIndex).trim() !== name) {
+            continue;
+        }
+        let value = part.slice(separatorIndex + 1).trim();
+        if (value.length >= 2 && value.startsWith('"') && value.endsWith('"')) {
+            value = value.slice(1, -1);
+        }
+        try {
+            return decodeURIComponent(value);
+        }
+        catch (_a) {
+            return value;
+        }
+    }
+    return undefined;
+}
+function isAbsoluteUrl(url) {
+    try {
+        new URL(url);
+        return true;
+    }
+    catch (_a) {
+        return false;
+    }
+}
+/**
+ * Creates a Base44 client for server-side rendering (SSR) and edge runtimes.
+ *
+ * Use this function in Cloudflare Workers, framework loaders, and other
+ * server environments that handle Fetch API requests. Unlike
+ * {@linkcode createClient | createClient()}, the returned client is safe to
+ * create per request outside a browser: analytics is fully disabled (no
+ * background timers), HTTP requests use the `fetch` adapter, and no browser
+ * storage is touched.
+ *
+ * Each configuration value is resolved in order from: the explicit option,
+ * the `env` record (`BASE44_APP_ID`, `BASE44_API_URL`, `BASE44_SERVICE_TOKEN`,
+ * `BASE44_FUNCTIONS_VERSION`), and finally the request headers — the same
+ * `Base44-*` headers read by
+ * {@linkcode createClientFromRequest | createClientFromRequest()}. The user
+ * token is resolved from the explicit option, then the request's
+ * `Authorization: Bearer` header, then the `base44_access_token` cookie that
+ * the browser SDK mirrors from localStorage.
+ *
+ * @param options - Server client options, including the incoming request and optional environment record.
+ * @returns A configured Base44 client instance scoped to the incoming request.
+ * @throws {Error} When no app ID can be resolved from the options, environment, or request headers.
+ * @throws {Error} When the resolved server URL isn't an absolute URL.
+ *
+ * @example
+ * ```typescript
+ * // Cloudflare Worker fetch handler
+ * import { createServerClient } from '@base44/sdk';
+ *
+ * export default {
+ *   async fetch(request, env) {
+ *     const base44 = createServerClient({ request, env });
+ *
+ *     // Reads data as the user identified by the request's cookie or
+ *     // Authorization header (anonymous when neither is present)
+ *     const products = await base44.entities.Products.list();
+ *
+ *     return Response.json({ products });
+ *   }
+ * };
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // Framework loader (React Router, Remix, and similar)
+ * import { createServerClient } from '@base44/sdk';
+ *
+ * export async function loader({ request }) {
+ *   const base44 = createServerClient({
+ *     request,
+ *     appId: 'my-app-id'
+ *   });
+ *
+ *   const user = await base44.auth.me().catch(() => null);
+ *   return { user };
+ * }
+ * ```
+ */
+export function createServerClient(options) {
+    var _a;
+    const { request, env = {} } = options;
+    const headers = request.headers;
+    const appId = firstNonEmpty(options.appId, env.BASE44_APP_ID, headers.get("Base44-App-Id"));
+    if (!appId) {
+        throw new Error("createServerClient: unable to resolve an app ID. Pass appId explicitly, set the BASE44_APP_ID environment variable, or forward the Base44-App-Id request header.");
+    }
+    const serverUrl = (_a = firstNonEmpty(options.serverUrl, env.BASE44_API_URL, headers.get("Base44-Api-Url"))) !== null && _a !== void 0 ? _a : "https://base44.app";
+    if (!isAbsoluteUrl(serverUrl)) {
+        throw new Error(`createServerClient: serverUrl must be an absolute URL, got "${serverUrl}"`);
+    }
+    const token = firstNonEmpty(options.token, parseBearerToken(headers.get("Authorization")), getCookieValue(headers.get("Cookie"), ACCESS_TOKEN_COOKIE_NAME));
+    const serviceToken = firstNonEmpty(options.serviceToken, env.BASE44_SERVICE_TOKEN, parseBearerToken(headers.get("Base44-Service-Authorization")));
+    const functionsVersion = firstNonEmpty(options.functionsVersion, env.BASE44_FUNCTIONS_VERSION, headers.get("Base44-Functions-Version"));
+    // Propagate Base44-State like createClientFromRequest, so the server client
+    // degrades gracefully behind the existing Base44 proxy
+    const stateHeader = headers.get("Base44-State");
+    const additionalHeaders = {};
+    if (stateHeader) {
+        additionalHeaders["Base44-State"] = stateHeader;
+    }
+    return createClient({
+        serverUrl,
+        appId,
+        token,
+        serviceToken,
+        functionsVersion,
+        headers: additionalHeaders,
+        requiresAuth: false,
+        disableAnalytics: true,
+        adapter: "fetch",
+    });
+}

package/dist/utils/auth-utils.d.ts

@@ -1,4 +1,37 @@
 import { GetAccessTokenOptions, SaveAccessTokenOptions, RemoveAccessTokenOptions, GetLoginUrlOptions } from "./auth-utils.types.js";
+/**
+ * Builds the cookie string that mirrors the access token so subsequent
+ * document requests carry it to server-side rendering (SSR) code.
+ *
+ * @internal
+ */
+export declare function buildAccessTokenCookie(token: string, { name, secure, }?: {
+    name?: string;
+    secure?: boolean;
+}): string;
+/**
+ * Builds the cookie string that clears the mirrored access token cookie.
+ *
+ * @internal
+ */
+export declare function buildClearAccessTokenCookie({ name, secure, }?: {
+    name?: string;
+    secure?: boolean;
+}): string;
+/**
+ * Mirrors the access token into a cookie (in addition to localStorage) so
+ * subsequent document requests carry the token to SSR. No-op outside a
+ * browser environment.
+ *
+ * @internal
+ */
+export declare function setAccessTokenCookie(token: string, name?: string): void;
+/**
+ * Clears the mirrored access token cookie. No-op outside a browser environment.
+ *
+ * @internal
+ */
+export declare function clearAccessTokenCookie(name?: string): void;
 /**
  * Retrieves an access token from URL parameters or local storage.
  *

package/dist/utils/auth-utils.js

@@ -1,3 +1,65 @@
+const ACCESS_TOKEN_COOKIE_ATTRIBUTES = "path=/; SameSite=Lax";
+/**
+ * Builds the cookie string that mirrors the access token so subsequent
+ * document requests carry it to server-side rendering (SSR) code.
+ *
+ * @internal
+ */
+export function buildAccessTokenCookie(token, { name = "base44_access_token", secure = false, } = {}) {
+    return `${name}=${encodeURIComponent(token)}; ${ACCESS_TOKEN_COOKIE_ATTRIBUTES}${secure ? "; Secure" : ""}`;
+}
+/**
+ * Builds the cookie string that clears the mirrored access token cookie.
+ *
+ * @internal
+ */
+export function buildClearAccessTokenCookie({ name = "base44_access_token", secure = false, } = {}) {
+    return `${name}=; ${ACCESS_TOKEN_COOKIE_ATTRIBUTES}; Max-Age=0${secure ? "; Secure" : ""}`;
+}
+function isHttpsPage() {
+    var _a;
+    return (typeof window !== "undefined" && ((_a = window.location) === null || _a === void 0 ? void 0 : _a.protocol) === "https:");
+}
+/**
+ * Mirrors the access token into a cookie (in addition to localStorage) so
+ * subsequent document requests carry the token to SSR. No-op outside a
+ * browser environment.
+ *
+ * @internal
+ */
+export function setAccessTokenCookie(token, name) {
+    if (typeof document === "undefined" || !token) {
+        return;
+    }
+    try {
+        document.cookie = buildAccessTokenCookie(token, {
+            name,
+            secure: isHttpsPage(),
+        });
+    }
+    catch (e) {
+        console.error("Error saving token cookie:", e);
+    }
+}
+/**
+ * Clears the mirrored access token cookie. No-op outside a browser environment.
+ *
+ * @internal
+ */
+export function clearAccessTokenCookie(name) {
+    if (typeof document === "undefined") {
+        return;
+    }
+    try {
+        document.cookie = buildClearAccessTokenCookie({
+            name,
+            secure: isHttpsPage(),
+        });
+    }
+    catch (e) {
+        console.error("Error removing token cookie:", e);
+    }
+}
 /**
  * Retrieves an access token from URL parameters or local storage.
  *
@@ -112,6 +174,8 @@ export function saveAccessToken(token, options) {
         window.localStorage.setItem(storageKey, token);
         // Set "token" that is set by the built-in SDK of platform version 2
         window.localStorage.setItem("token", token);
+        // Mirror the token into a cookie so document requests carry it to SSR
+        setAccessTokenCookie(token, storageKey);
         return true;
     }
     catch (e) {
@@ -150,6 +214,8 @@ export function removeAccessToken(options) {
     }
     try {
         window.localStorage.removeItem(storageKey);
+        // Clear the cookie that mirrors the token for SSR
+        clearAccessTokenCookie(storageKey);
         return true;
     }
     catch (e) {

package/dist/utils/axios-client.d.ts

@@ -1,3 +1,4 @@
+import { AxiosRequestConfig } from "axios";
 import type { Base44ErrorJSON } from "./axios-client.types.js";
 /**
  * Custom error class for Base44 SDK errors.
@@ -90,11 +91,12 @@ export declare class Base44Error extends Error {
  * @returns Configured axios instance
  * @internal
  */
-export declare function createAxiosClient({ baseURL, headers, token, interceptResponses, onError, }: {
+export declare function createAxiosClient({ baseURL, headers, token, interceptResponses, onError, adapter, }: {
     baseURL: string;
     headers?: Record<string, string>;
     token?: string;
     interceptResponses?: boolean;
     onError?: (error: Error) => void;
+    adapter?: AxiosRequestConfig["adapter"];
 }): import("axios").AxiosInstance;
 export type { Base44ErrorJSON } from "./axios-client.types.js";

package/dist/utils/axios-client.js

@@ -115,9 +115,10 @@ function safeErrorLog(prefix, error) {
  * @returns Configured axios instance
  * @internal
  */
-export function createAxiosClient({ baseURL, headers = {}, token, interceptResponses = true, onError, }) {
+export function createAxiosClient({ baseURL, headers = {}, token, interceptResponses = true, onError, adapter, }) {
     const client = axios.create({
         baseURL,
+        ...(adapter !== undefined ? { adapter } : {}),
         headers: {
             "Content-Type": "application/json",
             Accept: "application/json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@base44-preview/sdk",
-  "version": "0.8.35-pr.220.75109b8",
+  "version": "0.8.35-pr.221.5933e35",
   "description": "JavaScript SDK for Base44 API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",