@base44-preview/sdk 0.8.35-pr.221.5933e35 → 0.8.36-pr.212.0d64c77

package/dist/client.js

@@ -7,10 +7,12 @@ import { createConnectorsModule, createUserConnectorsModule, } from "./modules/c
 import { getAccessToken } from "./utils/auth-utils.js";
 import { createFunctionsModule } from "./modules/functions.js";
 import { createAgentsModule } from "./modules/agents.js";
+import { createAiGatewayModule } from "./modules/ai-gateway.js";
 import { createAppLogsModule } from "./modules/app-logs.js";
 import { createUsersModule } from "./modules/users.js";
 import { RoomsSocket } from "./utils/socket-utils.js";
 import { createAnalyticsModule } from "./modules/analytics.js";
+import { createRealtimeModule, pushUserTokenToActiveSockets } from "./modules/realtime.js";
 /**
  * Creates a Base44 client.
  *
@@ -50,9 +52,19 @@ import { createAnalyticsModule } from "./modules/analytics.js";
  */
 export function createClient(config) {
     var _a, _b;
-    const { serverUrl = "https://base44.app", appId, token, serviceToken, requiresAuth = false, appBaseUrl, options, functionsVersion, headers: optionalHeaders, disableAnalytics = false, adapter, } = config;
+    const { serverUrl = "https://base44.app", appId, token, serviceToken, requiresAuth = false, appBaseUrl, options, functionsVersion, headers: optionalHeaders, dispatcherWsUrl, webSocketImpl, } = config;
     // Normalize appBaseUrl to always be a string (empty if not provided or invalid)
     const normalizedAppBaseUrl = typeof appBaseUrl === "string" ? appBaseUrl : "";
+    // Derive the dispatcher WebSocket URL from serverUrl if not explicitly provided.
+    // Convert https:// → wss:// (or http:// → ws://) and strip trailing slash.
+    const resolvedDispatcherWsUrl = (() => {
+        if (dispatcherWsUrl)
+            return dispatcherWsUrl.replace(/\/$/, "");
+        return serverUrl
+            .replace(/\/$/, "")
+            .replace(/^https:\/\//, "wss://")
+            .replace(/^http:\/\//, "ws://");
+    })();
     const socketConfig = {
         serverUrl,
         mountPath: "/ws-user-apps/socket.io/",
@@ -84,7 +96,6 @@ export function createClient(config) {
         headers,
         token,
         onError: options === null || options === void 0 ? void 0 : options.onError,
-        adapter,
     });
     const functionsAxiosClient = createAxiosClient({
         baseURL: `${serverUrl}/api`,
@@ -92,7 +103,6 @@ export function createClient(config) {
         token,
         interceptResponses: false,
         onError: options === null || options === void 0 ? void 0 : options.onError,
-        adapter,
     });
     const serviceRoleHeaders = {
         ...headers,
@@ -103,19 +113,32 @@ export function createClient(config) {
         headers: serviceRoleHeaders,
         token: serviceToken,
         onError: options === null || options === void 0 ? void 0 : options.onError,
-        adapter,
     });
     const serviceRoleFunctionsAxiosClient = createAxiosClient({
         baseURL: `${serverUrl}/api`,
         headers: functionHeaders,
         token: serviceToken,
         interceptResponses: false,
-        adapter,
     });
     const userAuthModule = createAuthModule(axiosClient, functionsAxiosClient, appId, {
         appBaseUrl: normalizedAppBaseUrl,
         serverUrl,
     });
+    // Current user session token (axios defaults are the single source of truth —
+    // createClient({token}) and every setToken() land there). Used for in-band
+    // realtime auth; read lazily so refreshes are always picked up.
+    const getUserToken = () => {
+        var _a;
+        const h = (_a = axiosClient.defaults.headers.common) === null || _a === void 0 ? void 0 : _a["Authorization"];
+        return typeof h === "string" && h.startsWith("Bearer ") ? h.slice(7) : null;
+    };
+    // Login / token refresh must reach long-lived realtime sockets too, so the
+    // handler-side credential never goes stale mid-connection.
+    const originalSetToken = userAuthModule.setToken.bind(userAuthModule);
+    userAuthModule.setToken = (newToken, saveToStorage) => {
+        originalSetToken(newToken, saveToStorage);
+        pushUserTokenToActiveSockets(newToken);
+    };
     // Apply the access token before any module that may issue authenticated
     // requests during construction (notably analytics, which fires an init
     // event whose flush calls auth.me()). Without this, the first User/me
@@ -154,6 +177,7 @@ export function createClient(config) {
             serverUrl,
             token,
         }),
+        aiGateway: createAiGatewayModule({ serverUrl, token }),
         appLogs: createAppLogsModule(axiosClient, appId),
         users: createUsersModule(axiosClient, appId),
         analytics: createAnalyticsModule({
@@ -161,7 +185,31 @@ export function createClient(config) {
             serverUrl,
             appId,
             userAuthModule,
-            disabled: disableAnalytics,
+        }),
+        realtime: createRealtimeModule({
+            appId,
+            dispatcherWsUrl: resolvedDispatcherWsUrl,
+            webSocketImpl,
+            getUserToken,
+            getToken: async (handlerName, instanceId, connId) => {
+                // axiosClient interceptors unwrap response.data, so the result is the body directly.
+                // conn_id rides inside the signed token (not a WS query param) so it survives
+                // proxies that strip params; the dispatcher forwards it as the handler's conn.id.
+                // Base44-Functions-Version rides along (like function calls) so live apps get
+                // tokens for the *published* realtime script and previews get the draft.
+                const data = await axiosClient.post(`/apps/${appId}/realtime-token`, {
+                    handler_name: handlerName,
+                    instance_id: instanceId,
+                    conn_id: connId,
+                    // Declares "an __auth message follows right after connect" — the
+                    // handler delays handleConnect until it arrives (signed into the
+                    // token so old SDKs, which never send __auth, are never waited on).
+                    supports_inband_auth: getUserToken() != null,
+                }, functionsVersion
+                    ? { headers: { "Base44-Functions-Version": functionsVersion } }
+                    : undefined);
+                return data.token;
+            },
         }),
         cleanup: () => {
             userModules.analytics.cleanup();
@@ -197,6 +245,7 @@ export function createClient(config) {
             serverUrl,
             token,
         }),
+        aiGateway: createAiGatewayModule({ serverUrl, token: serviceToken }),
         appLogs: createAppLogsModule(serviceRoleAxiosClient, appId),
         cleanup: () => {
             if (socket) {

package/dist/client.types.d.ts

@@ -1,4 +1,3 @@
-import type { AxiosRequestConfig } from "axios";
 import type { EntitiesModule } from "./modules/entities.types.js";
 import type { IntegrationsModule } from "./modules/integrations.types.js";
 import type { AuthModule } from "./modules/auth.types.js";
@@ -6,8 +5,10 @@ import type { SsoModule } from "./modules/sso.types.js";
 import type { ConnectorsModule, UserConnectorsModule } from "./modules/connectors.types.js";
 import type { FunctionsModule } from "./modules/functions.types.js";
 import type { AgentsModule } from "./modules/agents.types.js";
+import type { AiGatewayModule } from "./modules/ai-gateway.types.js";
 import type { AppLogsModule } from "./modules/app-logs.types.js";
 import type { AnalyticsModule } from "./modules/analytics.types.js";
+import type { RealtimeModule } from "./modules/realtime.types.js";
 /**
  * Options for creating a Base44 client.
  */
@@ -70,31 +71,28 @@ export interface CreateClientConfig {
      */
     headers?: Record<string, string>;
     /**
-     * Disables the {@link AnalyticsModule | analytics module} entirely.
-     *
-     * When `true`, `base44.analytics.track()` becomes a no-op and no background
-     * processing or heartbeat timers are started. Set this for server-side
-     * clients (SSR, edge runtimes) where background timers must not run.
-     * {@linkcode createServerClient | createServerClient()} sets this automatically.
-     *
-     * Analytics is also automatically disabled outside a browser environment.
-     *
-     * @defaultValue `false`
+     * Additional client options.
      */
-    disableAnalytics?: boolean;
+    options?: CreateClientOptions;
     /**
-     * Axios adapter override for HTTP requests.
+     * Base WebSocket URL for the Cloudflare Durable Object dispatcher.
      *
-     * By default, axios picks an adapter based on the runtime. Set this to
-     * `'fetch'` in edge runtimes such as Cloudflare Workers, where the default
-     * adapter detection can pick the wrong adapter.
-     * {@linkcode createServerClient | createServerClient()} sets this automatically.
+     * Defaults to the `serverUrl` with `https://` replaced by `wss://` (or `http://` by `ws://`).
+     * Override when the dispatcher lives at a different host than the API.
      */
-    adapter?: AxiosRequestConfig["adapter"];
+    dispatcherWsUrl?: string;
     /**
-     * Additional client options.
+     * WebSocket implementation for realtime subscriptions in environments
+     * without a global `WebSocket` (Node.js < 22). Browsers and Node ≥ 22
+     * don't need this.
+     *
+     * @example
+     * ```typescript
+     * import WS from "ws";
+     * const base44 = createClient({ appId, webSocketImpl: WS });
+     * ```
      */
-    options?: CreateClientOptions;
+    webSocketImpl?: unknown;
 }
 /**
  * The Base44 client instance.
@@ -104,10 +102,14 @@ export interface CreateClientConfig {
 export interface Base44Client {
     /** {@link AgentsModule | Agents module} for managing AI agent conversations. */
     agents: AgentsModule;
+    /** {@link AiGatewayModule | AI Gateway module} for connecting to the Base44 AI Gateway with your own SDK. */
+    aiGateway: AiGatewayModule;
     /** {@link AnalyticsModule | Analytics module} for tracking custom events in your app. */
     analytics: AnalyticsModule;
     /** {@link AppLogsModule | App logs module} for tracking app usage. */
     appLogs: AppLogsModule;
+    /** {@link RealtimeModule | Realtime module} for subscribing to and sending messages via Cloudflare Durable Object-backed RealtimeHandlers. */
+    realtime: RealtimeModule;
     /** {@link AuthModule | Auth module} for user authentication and management. */
     auth: AuthModule;
     /** {@link UserConnectorsModule | Connectors module} for app-user OAuth flows. */
@@ -147,6 +149,8 @@ export interface Base44Client {
     readonly asServiceRole: {
         /** {@link AgentsModule | Agents module} with elevated permissions. */
         agents: AgentsModule;
+        /** {@link AiGatewayModule | AI Gateway module} with the service-role token. */
+        aiGateway: AiGatewayModule;
         /** {@link AppLogsModule | App logs module} with elevated permissions. */
         appLogs: AppLogsModule;
         /** {@link ConnectorsModule | Connectors module} for OAuth token retrieval. */

package/dist/index.d.ts

@@ -1,17 +1,19 @@
 import { createClient, createClientFromRequest, type Base44Client, type CreateClientConfig, type CreateClientOptions } from "./client.js";
-import { createServerClient, type CreateServerClientOptions } from "./server.js";
 import { Base44Error, type Base44ErrorJSON } from "./utils/axios-client.js";
 import { getAccessToken, saveAccessToken, removeAccessToken, getLoginUrl } from "./utils/auth-utils.js";
-export { createClient, createClientFromRequest, createServerClient, Base44Error, getAccessToken, saveAccessToken, removeAccessToken, getLoginUrl, };
-export type { Base44Client, CreateClientConfig, CreateClientOptions, CreateServerClientOptions, Base44ErrorJSON, };
+export { createClient, createClientFromRequest, Base44Error, getAccessToken, saveAccessToken, removeAccessToken, getLoginUrl, };
+export type { Base44Client, CreateClientConfig, CreateClientOptions, Base44ErrorJSON, };
 export * from "./types.js";
 export type { DeleteManyResult, DeleteResult, EntitiesModule, EntityFilterOperators, EntityFilterQuery, EntityFilterValue, EntityHandler, EntityRecord, EntityTypeRegistry, ImportResult, RealtimeEventType, RealtimeEvent, RealtimeCallback, SortField, UpdateManyResult, } from "./modules/entities.types.js";
 export type { AuthModule, LoginResponse, RegisterParams, VerifyOtpParams, ChangePasswordParams, ResetPasswordParams, User, } from "./modules/auth.types.js";
 export type { IntegrationsModule, IntegrationEndpointFunction, CoreIntegrations, InvokeLLMParams, GenerateImageParams, GenerateImageResult, UploadFileParams, UploadFileResult, SendEmailParams, SendEmailResult, ExtractDataFromUploadedFileParams, ExtractDataFromUploadedFileResult, UploadPrivateFileParams, UploadPrivateFileResult, CreateFileSignedUrlParams, CreateFileSignedUrlResult, } from "./modules/integrations.types.js";
 export type { FunctionsModule, FunctionName, FunctionNameRegistry, } from "./modules/functions.types.js";
 export type { AgentsModule, AgentName, AgentNameRegistry, AgentConversation, AgentMessage, AgentMessageReasoning, AgentMessageToolCall, AgentMessageUsage, AgentMessageCustomContext, AgentMessageMetadata, CreateConversationParams, } from "./modules/agents.types.js";
+export type { AiGatewayModule, AiGatewayConnection, } from "./modules/ai-gateway.types.js";
 export type { AppLogsModule } from "./modules/app-logs.types.js";
+export type { RealtimeModule, RealtimeHandlerClient, RealtimeHandlerNameRegistry, RealtimeHandlerRegistry, } from "./modules/realtime.types.js";
 export type { SsoModule, SsoAccessTokenResponse } from "./modules/sso.types.js";
+export { RealtimeHandler, type Conn } from "./realtime-handler.js";
 export type { ConnectorsModule, UserConnectorsModule, } from "./modules/connectors.types.js";
 export type { CustomIntegrationsModule, CustomIntegrationCallParams, CustomIntegrationCallResponse, } from "./modules/custom-integrations.types.js";
 export type { GetAccessTokenOptions, SaveAccessTokenOptions, RemoveAccessTokenOptions, GetLoginUrlOptions, } from "./utils/auth-utils.types.js";

package/dist/index.js

@@ -1,6 +1,6 @@
 import { createClient, createClientFromRequest, } from "./client.js";
-import { createServerClient, } from "./server.js";
 import { Base44Error } from "./utils/axios-client.js";
 import { getAccessToken, saveAccessToken, removeAccessToken, getLoginUrl, } from "./utils/auth-utils.js";
-export { createClient, createClientFromRequest, createServerClient, Base44Error, getAccessToken, saveAccessToken, removeAccessToken, getLoginUrl, };
+export { createClient, createClientFromRequest, Base44Error, getAccessToken, saveAccessToken, removeAccessToken, getLoginUrl, };
 export * from "./types.js";
+export { RealtimeHandler } from "./realtime-handler.js";

package/dist/modules/ai-gateway.d.ts

@@ -0,0 +1,2 @@
+import { AiGatewayModule, AiGatewayModuleConfig } from "./ai-gateway.types.js";
+export declare function createAiGatewayModule({ serverUrl, token, }: AiGatewayModuleConfig): AiGatewayModule;

package/dist/modules/ai-gateway.js

@@ -0,0 +1,13 @@
+import { getAccessToken } from "../utils/auth-utils.js";
+export function createAiGatewayModule({ serverUrl, token, }) {
+    const connection = () => {
+        var _a;
+        return ({
+            baseURL: `${serverUrl}/api/ai/openai/v1`,
+            token: (_a = token !== null && token !== void 0 ? token : getAccessToken()) !== null && _a !== void 0 ? _a : "",
+        });
+    };
+    return {
+        connection,
+    };
+}

package/dist/modules/ai-gateway.types.d.ts

@@ -0,0 +1,101 @@
+/**
+ * A connection to the Base44 AI Gateway.
+ *
+ * Contains the base URL and bearer token to use with any OpenAI-compatible client
+ * (OpenAI SDK, Mastra, Vercel AI SDK, and others) pointed at the Base44 AI
+ * Gateway.
+ */
+export interface AiGatewayConnection {
+    /** Base URL of the gateway's OpenAI-compatible endpoint. */
+    baseURL: string;
+    /** Bearer token used to authenticate requests to the gateway. */
+    token: string;
+}
+/**
+ * Configuration for the AI Gateway module.
+ * @internal
+ */
+export interface AiGatewayModuleConfig {
+    /** Server URL */
+    serverUrl?: string;
+    /** Authentication token */
+    token?: string;
+}
+/**
+ * AI Gateway module for calling Base44's managed AI models from your own code.
+ *
+ * The gateway exposes an OpenAI-compatible Chat Completions endpoint, so any
+ * OpenAI-compatible SDK works against it:
+ * - Build custom AI agents with agent SDKs such as Mastra or the Vercel AI SDK
+ * - Uses your app's models, billing, and credit quota, no API key to manage
+ *
+ * Available in user authentication mode (`base44.aiGateway`) and with the
+ * service-role token via `base44.asServiceRole.aiGateway`.
+ */
+export interface AiGatewayModule {
+    /**
+     * Gets the connection details for the Base44 AI Gateway.
+     *
+     * Returns the `baseURL` and `token` to pass to any OpenAI-compatible client.
+     *
+     * The `token` is the current caller's bearer token: the app user's token for
+     * `base44.aiGateway`, or the service-role token for `base44.asServiceRole.aiGateway`.
+     * When the caller is unauthenticated, `token` is an empty string.
+     *
+     * @returns The gateway {@linkcode AiGatewayConnection | connection} (`baseURL` and `token`).
+     *
+     * @example
+     * ```typescript
+     * // Build an AI agent with Mastra on top of the gateway, inside a backend function
+     * import { createClientFromRequest } from 'npm:@base44/sdk';
+     * import { Agent } from 'npm:@mastra/core/agent';
+     * import { createTool } from 'npm:@mastra/core/tools';
+     * import { createOpenAICompatible } from 'npm:@ai-sdk/openai-compatible';
+     * import { z } from 'npm:zod';
+     *
+     * Deno.serve(async (req) => {
+     *   const base44 = createClientFromRequest(req);
+     *   const { baseURL, token } = base44.aiGateway.connection();
+     *   const models = createOpenAICompatible({ name: 'base44', baseURL, apiKey: token });
+     *
+     *   const agent = new Agent({
+     *     id: 'order-helper',
+     *     name: 'order-helper',
+     *     instructions: 'Help the user with their orders.',
+     *     model: models('claude_sonnet_4_6'),
+     *     tools: {
+     *       lookupOrder: createTool({
+     *         id: 'lookup-order',
+     *         description: 'Fetch an order by id',
+     *         inputSchema: z.object({ orderId: z.string() }),
+     *         execute: async ({ orderId }) => base44.entities.Order.get(orderId),
+     *       }),
+     *     },
+     *   });
+     *
+     *   const { text } = await agent.generate('Where is order 123?');
+     *   return Response.json({ text });
+     * });
+     * ```
+     *
+     * @example
+     * ```typescript
+     * // Call a model directly with the OpenAI SDK
+     * import { createClientFromRequest } from 'npm:@base44/sdk';
+     * import OpenAI from 'npm:openai';
+     *
+     * Deno.serve(async (req) => {
+     *   const base44 = createClientFromRequest(req);
+     *   const { baseURL, token } = base44.aiGateway.connection();
+     *
+     *   const openai = new OpenAI({ baseURL, apiKey: token });
+     *   const res = await openai.chat.completions.create({
+     *     model: 'claude_sonnet_4_6',
+     *     messages: [{ role: 'user', content: 'Hello!' }],
+     *   });
+     *   return Response.json({ text: res.choices[0].message.content });
+     * });
+     * ```
+     */
+    connection(): AiGatewayConnection;
+}

package/dist/modules/ai-gateway.types.js

@@ -0,0 +1 @@
+export {};

package/dist/modules/analytics.d.ts

@@ -11,10 +11,8 @@ export interface AnalyticsModuleArgs {
     serverUrl: string;
     appId: string;
     userAuthModule: AuthModule;
-    /** Skips all analytics processing when true (e.g. for server-side clients). */
-    disabled?: boolean;
 }
-export declare const createAnalyticsModule: ({ axiosClient, serverUrl, appId, userAuthModule, disabled, }: AnalyticsModuleArgs) => {
+export declare const createAnalyticsModule: ({ axiosClient, serverUrl, appId, userAuthModule, }: AnalyticsModuleArgs) => {
     track: (params: TrackEventParams) => void;
     cleanup: () => void;
 };

package/dist/modules/analytics.js

@@ -30,16 +30,11 @@ const analyticsSharedState = getSharedInstance(ANALYTICS_SHARED_STATE_NAME, () =
         ...getAnalyticsConfigFromUrlParams(),
     },
 }));
-export const createAnalyticsModule = ({ axiosClient, serverUrl, appId, userAuthModule, disabled = false, }) => {
+export const createAnalyticsModule = ({ axiosClient, serverUrl, appId, userAuthModule, }) => {
     var _a;
     // prevent overflow of events //
     const { maxQueueSize, throttleTime, batchSize } = analyticsSharedState.config;
-    // Analytics is browser-only. Outside a browser (SSR, Cloudflare Workers,
-    // Node) timers would leak — or throw at global scope in Workers — so the
-    // module becomes a no-op there, and when explicitly disabled.
-    if (disabled ||
-        typeof window === "undefined" ||
-        !((_a = analyticsSharedState.config) === null || _a === void 0 ? void 0 : _a.enabled)) {
+    if (!((_a = analyticsSharedState.config) === null || _a === void 0 ? void 0 : _a.enabled)) {
         return {
             track: () => { },
             cleanup: () => { },

package/dist/modules/auth.js

@@ -1,4 +1,3 @@
-import { setAccessTokenCookie, clearAccessTokenCookie, } from "../utils/auth-utils.js";
 function isInsideIframe() {
     if (typeof window === "undefined")
         return false;
@@ -130,8 +129,6 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
                         console.error("Failed to remove token from localStorage:", e);
                     }
                 }
-                // Clear the cookie that mirrors the token for SSR
-                clearAccessTokenCookie();
                 // Determine the from_url parameter
                 const fromUrl = redirectUrl || window.location.href;
                 // Redirect to server-side logout endpoint to clear HTTP-only cookies
@@ -158,8 +155,6 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
                 catch (e) {
                     console.error("Failed to save token to localStorage:", e);
                 }
-                // Mirror the token into a cookie so document requests carry it to SSR
-                setAccessTokenCookie(token);
             }
         },
         // Login using username and password

package/dist/modules/realtime.d.ts

@@ -0,0 +1,28 @@
+/** Push a (new) user session token to every open realtime socket — called on
+ *  login/refresh so long-lived connections keep a valid credential server-side. */
+export declare function pushUserTokenToActiveSockets(token: string): void;
+export declare function createRealtimeModule(config: {
+    appId: string;
+    getToken(handlerName: string, instanceId: string, connId: string): Promise<string>;
+    /** Current user session token, if signed in. Sent in-band ({type:"__auth"})
+     *  right after every socket open — never in the URL — so the handler can act
+     *  as this user (createUserClient / RLS). */
+    getUserToken?: () => string | null;
+    dispatcherWsUrl: string;
+    /** WebSocket implementation for runtimes without a global one (Node < 22). */
+    webSocketImpl?: unknown;
+}): Record<string, RealtimeHandler>;
+/** Handle for an active realtime subscription. */
+interface RealtimeSubscription {
+    /** This connection's id — the same value the handler receives as `conn.id`. */
+    id: string;
+    /** Close the subscription and its underlying socket. */
+    unsubscribe(): void;
+}
+interface RealtimeHandler {
+    subscribe(instanceId: string, callback: (data: unknown) => void, options?: {
+        id?: string;
+    }): RealtimeSubscription;
+    send(instanceId: string, data: unknown): void;
+}
+export {};

package/dist/modules/realtime.js

@@ -0,0 +1,124 @@
+import PartySocket from "partysocket";
+// Module-level map: "HandlerName:instanceId" → active socket
+const activeSockets = new Map();
+function socketKey(handlerName, instanceId) {
+    return `${handlerName}:${instanceId}`;
+}
+/** Push a (new) user session token to every open realtime socket — called on
+ *  login/refresh so long-lived connections keep a valid credential server-side. */
+export function pushUserTokenToActiveSockets(token) {
+    if (!token)
+        return;
+    const payload = JSON.stringify({ type: "__auth", token });
+    for (const ws of activeSockets.values()) {
+        try {
+            ws.send(payload);
+        }
+        catch ( /* not open — the open handler will send */_a) { /* not open — the open handler will send */ }
+    }
+}
+export function createRealtimeModule(config) {
+    return new Proxy({}, {
+        get(_, handlerName) {
+            return {
+                subscribe(instanceId, callback, options) {
+                    var _a, _b;
+                    const key = socketKey(handlerName, instanceId);
+                    // close existing if any
+                    (_a = activeSockets.get(key)) === null || _a === void 0 ? void 0 : _a.close();
+                    // Connection id: caller-supplied (stable — reuse across reconnects/tabs as
+                    // you see fit) or auto-generated per subscription. It travels INSIDE the
+                    // signed realtime token (never as a WS query param, which proxies strip);
+                    // the dispatcher forwards the verified claim as partyserver's _pk, so the
+                    // handler sees this exact value as conn.id. Reconnects re-mint the token
+                    // with the same id, so conn.id is stable across reconnects.
+                    const connId = (_b = options === null || options === void 0 ? void 0 : options.id) !== null && _b !== void 0 ? _b : crypto.randomUUID();
+                    // query as async fn: called on every (re)connect, fetches a fresh token each time
+                    const ws = new PartySocket({
+                        host: config.dispatcherWsUrl,
+                        party: handlerName,
+                        room: instanceId,
+                        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                        ...(config.webSocketImpl ? { WebSocket: config.webSocketImpl } : {}),
+                        query: () => config.getToken(handlerName, instanceId, connId).then((token) => ({ token })),
+                    });
+                    activeSockets.set(key, ws);
+                    // In-band credential delivery (Supabase-style): the user token rides the
+                    // open socket, never the URL. Sent on every open (incl. reconnects); the
+                    // server may also nudge with {type:"__auth_required"} (e.g. just before
+                    // the held token expires) and we answer with the current one.
+                    const sendAuth = () => {
+                        var _a;
+                        const t = (_a = config.getUserToken) === null || _a === void 0 ? void 0 : _a.call(config);
+                        if (t) {
+                            try {
+                                ws.send(JSON.stringify({ type: "__auth", token: t }));
+                            }
+                            catch ( /* not open */_b) { /* not open */ }
+                        }
+                    };
+                    ws.addEventListener("open", sendAuth);
+                    // Heartbeat / half-open detection. PartySocket only reconnects on a
+                    // browser close/error event, so a silently-dead connection (TCP alive,
+                    // no data — common behind proxies/LBs) hangs until the OS idle timeout
+                    // (~60s). We ping periodically and force a reconnect if nothing comes
+                    // back within DEAD_MS, cutting detection from ~60s to a few seconds.
+                    // Pairs with the handler's setWebSocketAutoResponse("__ping"→"__pong"),
+                    // so idle handlers (no app broadcasts) still keep the connection proven.
+                    const PING_MS = 1000;
+                    const DEAD_MS = 3000;
+                    let lastMsg = Date.now();
+                    const bumpAlive = () => { lastMsg = Date.now(); };
+                    ws.addEventListener("open", bumpAlive);
+                    ws.addEventListener("message", (ev) => {
+                        bumpAlive();
+                        let data;
+                        try {
+                            data = JSON.parse(ev.data);
+                        }
+                        catch (_a) {
+                            return; // ignore malformed
+                        }
+                        // Swallow platform messages — never surface them to the app.
+                        const msgType = data && typeof data === "object" ? data.type : undefined;
+                        if (msgType === "__pong")
+                            return;
+                        if (msgType === "__auth_required") {
+                            sendAuth();
+                            return;
+                        }
+                        callback(data);
+                    });
+                    const heartbeat = setInterval(() => {
+                        if (Date.now() - lastMsg > DEAD_MS) {
+                            bumpAlive(); // avoid a reconnect storm while the new socket comes up
+                            ws.reconnect();
+                            return;
+                        }
+                        try {
+                            ws.send(JSON.stringify({ type: "__ping" }));
+                        }
+                        catch (_a) {
+                            // socket not open; the watchdog above will force a reconnect
+                        }
+                    }, PING_MS);
+                    return {
+                        id: connId, // the connection id (same value the handler sees as conn.id)
+                        unsubscribe() {
+                            clearInterval(heartbeat);
+                            activeSockets.delete(key);
+                            ws.close();
+                        },
+                    };
+                },
+                send(instanceId, data) {
+                    const key = socketKey(handlerName, instanceId);
+                    const ws = activeSockets.get(key);
+                    if (!ws)
+                        throw new Error(`No active subscription for ${handlerName}:${instanceId}`);
+                    ws.send(JSON.stringify(data));
+                },
+            };
+        },
+    });
+}

package/dist/modules/realtime.types.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Extend this interface to add typed `subscribe` callbacks and `send` payloads
+ * for your deployed RealtimeHandlers.
+ *
+ * This is separate from {@link RealtimeHandlerNameRegistry} (which is auto-generated
+ * by `base44 types generate`), so there are no conflicts.
+ *
+ * @example
+ * ```typescript
+ * declare module "@base44/sdk" {
+ *   interface RealtimeHandlerRegistry {
+ *     ChatRoom: {
+ *       toClient: { type: "joined" | "left" | "message"; userId?: string; from?: string; text?: string };
+ *       toServer: { type: "message"; text: string };
+ *     };
+ *   }
+ * }
+ * ```
+ */
+export interface RealtimeHandlerRegistry {
+}
+/**
+ * Auto-populated by `base44 types generate` with the names of your deployed handlers.
+ * Do not edit this interface manually — use {@link RealtimeHandlerRegistry} for message types.
+ */
+export interface RealtimeHandlerNameRegistry {
+}
+type AllHandlerNames = keyof RealtimeHandlerRegistry | keyof RealtimeHandlerNameRegistry;
+type ToClientFor<N extends string> = N extends keyof RealtimeHandlerRegistry ? RealtimeHandlerRegistry[N] extends {
+    toClient: infer I;
+} ? I : unknown : unknown;
+type ToServerFor<N extends string> = N extends keyof RealtimeHandlerRegistry ? RealtimeHandlerRegistry[N] extends {
+    toServer: infer O;
+} ? O : unknown : unknown;
+/**
+ * Client for a single named RealtimeHandler.
+ * Typed automatically when the handler is registered in {@link RealtimeHandlerRegistry}.
+ */
+export interface RealtimeHandlerClient<N extends string = string> {
+    /**
+     * Open a WebSocket subscription. Returns a {@link RealtimeSubscription} with the
+     * connection `id` (same value the handler sees as `conn.id`) and an `unsubscribe()` method.
+     *
+     * Pass `options.id` to control the connection id (e.g. a stable per-tab id so a
+     * reconnect reuses the same server-side connection); omit it for an auto-generated
+     * per-connection id.
+     */
+    subscribe(instanceId: string, callback: (data: ToClientFor<N>) => void, options?: {
+        id?: string;
+    }): RealtimeSubscription;
+    /** Send a message over the open socket. Throws if not subscribed. */
+    send(instanceId: string, data: ToServerFor<N>): void;
+}
+/** Handle for an active realtime subscription. */
+export interface RealtimeSubscription {
+    /** This connection's id — the same value the handler receives as `conn.id`. */
+    id: string;
+    /** Close the subscription and its underlying socket. */
+    unsubscribe(): void;
+}
+/**
+ * The realtime module provides access to Cloudflare Durable Object-backed
+ * RealtimeHandlers deployed by the Base44 platform.
+ *
+ * Handler names are accessed as dynamic properties on this module:
+ * ```typescript
+ * const sub = await base44.realtime.MyHandler.subscribe("room-1", (msg) => {
+ *   console.log(msg); // typed if MyHandler is in RealtimeHandlerRegistry
+ * });
+ * const { id, unsubscribe } = sub;
+ * unsubscribe();
+ * ```
+ */
+export type RealtimeModule = {
+    [K in AllHandlerNames]: K extends keyof RealtimeHandlerRegistry ? RealtimeHandlerClient<string & K> : RealtimeHandlerClient;
+} & Record<string, RealtimeHandlerClient>;
+export {};

package/dist/modules/realtime.types.js

@@ -0,0 +1 @@
+export {};

package/dist/modules/types.d.ts

@@ -1,4 +1,5 @@
 export * from "./app.types.js";
 export * from "./agents.types.js";
+export * from "./ai-gateway.types.js";
 export * from "./connectors.types.js";
 export * from "./analytics.types.js";

package/dist/modules/types.js

@@ -1,4 +1,5 @@
 export * from "./app.types.js";
 export * from "./agents.types.js";
+export * from "./ai-gateway.types.js";
 export * from "./connectors.types.js";
 export * from "./analytics.types.js";

package/dist/realtime-handler.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Type-only base class for Realtime Handlers.
+ *
+ * Import and extend this in your handler files:
+ *   import { RealtimeHandler } from "@base44/sdk";
+ *   export class MyHandler extends RealtimeHandler { ... }
+ *
+ * At deploy time the bundler replaces this import with the compiled
+ * Cloudflare Durable Object implementation — this file provides types only.
+ */
+import type { Base44Client } from "./client.types.js";
+/**
+ * A single client connection. `Send` is the message type this connection accepts
+ * via {@link send} — the handler's *outgoing* (server→client) messages.
+ */
+export interface Conn<Send = unknown> {
+    /** Unique per-connection id (one per socket/tab), the same value the client
+     *  receives from `subscribe()`. Use this — not userId — to identify a distinct
+     *  client, so multiple tabs of the same user are separate connections. */
+    id: string;
+    userId: string;
+    appId: string;
+    instanceId: string;
+    send(data: Send): void;
+    reject(code: number, reason: string): void;
+}
+export interface Storage {
+    get<T>(key: string): Promise<T | undefined>;
+    put(key: string, value: unknown): Promise<void>;
+    delete(key: string): Promise<boolean>;
+}
+/**
+ * Base class for a Realtime Handler.
+ *
+ * @typeParam Incoming - messages this handler *receives* from clients
+ *   (`handleMessage`'s `msg`) — the schema's `toServer` section.
+ * @typeParam Outgoing - messages this handler *sends* to clients
+ *   (`conn.send`/`broadcast`) — the schema's `toClient` section.
+ *
+ * With a generated `schema.jsonc`, wire both from the registry so they can't drift
+ * from the client's types:
+ * ```ts
+ * type Reg = RealtimeHandlerRegistry["MyHandler"];
+ * class MyHandler extends RealtimeHandler<Reg["toServer"], Reg["toClient"]> { ... }
+ * ```
+ */
+export declare abstract class RealtimeHandler<Incoming = unknown, Outgoing = unknown> {
+    abstract handleConnect(conn: Conn<Outgoing>): void | Promise<void>;
+    abstract handleMessage(conn: Conn<Outgoing>, msg: Incoming): void | Promise<void>;
+    abstract handleClose(conn: Conn<Outgoing>): void | Promise<void>;
+    abstract handleTick(): void | Promise<void>;
+    onStart(): void | Promise<void>;
+    /**
+     * Managed ticker (opt-in). Override {@link shouldTick} and the platform runs
+     * {@link handleTick} on a timer of {@link tickIntervalMs} while it returns true,
+     * and stops (letting the Durable Object hibernate — no compute cost) when it
+     * returns false. The platform owns scheduling, rescheduling, self-heal, and
+     * error-safety — you don't call {@link startLoop}/{@link stopLoop}.
+     *
+     * Re-evaluated after every connect/message/close and on every tick, so keep it
+     * cheap and pure (no async, no side effects). Example: `return this.players >= 2`.
+     */
+    protected tickIntervalMs: number;
+    protected shouldTick?(): boolean;
+    protected broadcast(_data: Outgoing): void;
+    protected getConnections(): Conn<Outgoing>[];
+    protected startLoop(_ms: number): Promise<void>;
+    protected stopLoop(): Promise<void>;
+    protected get instanceId(): string;
+    protected get storage(): Storage;
+    /**
+     * SDK client acting **as the connected user** — every entity call respects
+     * the app's row-level security, evaluated as that user at call time. The
+     * default wherever a `conn` is in scope (connect/message/close).
+     *
+     * Throws if the connection carries no user credential (anonymous visitor,
+     * signed-out session, or an app SDK that predates in-band auth).
+     */
+    protected createUserClient(conn: Conn): Base44Client;
+    /**
+     * Service-role SDK client — bypasses RLS. For work with **no user in scope**
+     * (tick, alarm, onStart). Inside handleMessage/handleConnect prefer
+     * `createUserClient(conn)`.
+     */
+    protected createServiceClient(): Base44Client;
+}

package/dist/realtime-handler.js

@@ -0,0 +1,79 @@
+/**
+ * Type-only base class for Realtime Handlers.
+ *
+ * Import and extend this in your handler files:
+ *   import { RealtimeHandler } from "@base44/sdk";
+ *   export class MyHandler extends RealtimeHandler { ... }
+ *
+ * At deploy time the bundler replaces this import with the compiled
+ * Cloudflare Durable Object implementation — this file provides types only.
+ */
+/**
+ * Base class for a Realtime Handler.
+ *
+ * @typeParam Incoming - messages this handler *receives* from clients
+ *   (`handleMessage`'s `msg`) — the schema's `toServer` section.
+ * @typeParam Outgoing - messages this handler *sends* to clients
+ *   (`conn.send`/`broadcast`) — the schema's `toClient` section.
+ *
+ * With a generated `schema.jsonc`, wire both from the registry so they can't drift
+ * from the client's types:
+ * ```ts
+ * type Reg = RealtimeHandlerRegistry["MyHandler"];
+ * class MyHandler extends RealtimeHandler<Reg["toServer"], Reg["toClient"]> { ... }
+ * ```
+ */
+export class RealtimeHandler {
+    constructor() {
+        /**
+         * Managed ticker (opt-in). Override {@link shouldTick} and the platform runs
+         * {@link handleTick} on a timer of {@link tickIntervalMs} while it returns true,
+         * and stops (letting the Durable Object hibernate — no compute cost) when it
+         * returns false. The platform owns scheduling, rescheduling, self-heal, and
+         * error-safety — you don't call {@link startLoop}/{@link stopLoop}.
+         *
+         * Re-evaluated after every connect/message/close and on every tick, so keep it
+         * cheap and pure (no async, no side effects). Example: `return this.players >= 2`.
+         */
+        this.tickIntervalMs = 100;
+    }
+    onStart() { }
+    broadcast(_data) {
+        throw new Error("RealtimeHandler.broadcast() is only available inside a deployed handler");
+    }
+    getConnections() {
+        throw new Error("RealtimeHandler.getConnections() is only available inside a deployed handler");
+    }
+    startLoop(_ms) {
+        throw new Error("RealtimeHandler.startLoop() is only available inside a deployed handler");
+    }
+    stopLoop() {
+        throw new Error("RealtimeHandler.stopLoop() is only available inside a deployed handler");
+    }
+    get instanceId() {
+        throw new Error("RealtimeHandler.instanceId is only available inside a deployed handler");
+    }
+    get storage() {
+        throw new Error("RealtimeHandler.storage is only available inside a deployed handler");
+    }
+    /**
+     * SDK client acting **as the connected user** — every entity call respects
+     * the app's row-level security, evaluated as that user at call time. The
+     * default wherever a `conn` is in scope (connect/message/close).
+     *
+     * Throws if the connection carries no user credential (anonymous visitor,
+     * signed-out session, or an app SDK that predates in-band auth).
+     */
+    createUserClient(conn) {
+        void conn;
+        throw new Error("RealtimeHandler.createUserClient() is only available inside a deployed handler");
+    }
+    /**
+     * Service-role SDK client — bypasses RLS. For work with **no user in scope**
+     * (tick, alarm, onStart). Inside handleMessage/handleConnect prefer
+     * `createUserClient(conn)`.
+     */
+    createServiceClient() {
+        throw new Error("RealtimeHandler.createServiceClient() is only available inside a deployed handler");
+    }
+}

package/dist/utils/auth-utils.d.ts

@@ -1,37 +1,4 @@
 import { GetAccessTokenOptions, SaveAccessTokenOptions, RemoveAccessTokenOptions, GetLoginUrlOptions } from "./auth-utils.types.js";
-/**
- * Builds the cookie string that mirrors the access token so subsequent
- * document requests carry it to server-side rendering (SSR) code.
- *
- * @internal
- */
-export declare function buildAccessTokenCookie(token: string, { name, secure, }?: {
-    name?: string;
-    secure?: boolean;
-}): string;
-/**
- * Builds the cookie string that clears the mirrored access token cookie.
- *
- * @internal
- */
-export declare function buildClearAccessTokenCookie({ name, secure, }?: {
-    name?: string;
-    secure?: boolean;
-}): string;
-/**
- * Mirrors the access token into a cookie (in addition to localStorage) so
- * subsequent document requests carry the token to SSR. No-op outside a
- * browser environment.
- *
- * @internal
- */
-export declare function setAccessTokenCookie(token: string, name?: string): void;
-/**
- * Clears the mirrored access token cookie. No-op outside a browser environment.
- *
- * @internal
- */
-export declare function clearAccessTokenCookie(name?: string): void;
 /**
  * Retrieves an access token from URL parameters or local storage.
  *

package/dist/utils/auth-utils.js

@@ -1,65 +1,3 @@
-const ACCESS_TOKEN_COOKIE_ATTRIBUTES = "path=/; SameSite=Lax";
-/**
- * Builds the cookie string that mirrors the access token so subsequent
- * document requests carry it to server-side rendering (SSR) code.
- *
- * @internal
- */
-export function buildAccessTokenCookie(token, { name = "base44_access_token", secure = false, } = {}) {
-    return `${name}=${encodeURIComponent(token)}; ${ACCESS_TOKEN_COOKIE_ATTRIBUTES}${secure ? "; Secure" : ""}`;
-}
-/**
- * Builds the cookie string that clears the mirrored access token cookie.
- *
- * @internal
- */
-export function buildClearAccessTokenCookie({ name = "base44_access_token", secure = false, } = {}) {
-    return `${name}=; ${ACCESS_TOKEN_COOKIE_ATTRIBUTES}; Max-Age=0${secure ? "; Secure" : ""}`;
-}
-function isHttpsPage() {
-    var _a;
-    return (typeof window !== "undefined" && ((_a = window.location) === null || _a === void 0 ? void 0 : _a.protocol) === "https:");
-}
-/**
- * Mirrors the access token into a cookie (in addition to localStorage) so
- * subsequent document requests carry the token to SSR. No-op outside a
- * browser environment.
- *
- * @internal
- */
-export function setAccessTokenCookie(token, name) {
-    if (typeof document === "undefined" || !token) {
-        return;
-    }
-    try {
-        document.cookie = buildAccessTokenCookie(token, {
-            name,
-            secure: isHttpsPage(),
-        });
-    }
-    catch (e) {
-        console.error("Error saving token cookie:", e);
-    }
-}
-/**
- * Clears the mirrored access token cookie. No-op outside a browser environment.
- *
- * @internal
- */
-export function clearAccessTokenCookie(name) {
-    if (typeof document === "undefined") {
-        return;
-    }
-    try {
-        document.cookie = buildClearAccessTokenCookie({
-            name,
-            secure: isHttpsPage(),
-        });
-    }
-    catch (e) {
-        console.error("Error removing token cookie:", e);
-    }
-}
 /**
  * Retrieves an access token from URL parameters or local storage.
  *
@@ -174,8 +112,6 @@ export function saveAccessToken(token, options) {
         window.localStorage.setItem(storageKey, token);
         // Set "token" that is set by the built-in SDK of platform version 2
         window.localStorage.setItem("token", token);
-        // Mirror the token into a cookie so document requests carry it to SSR
-        setAccessTokenCookie(token, storageKey);
         return true;
     }
     catch (e) {
@@ -214,8 +150,6 @@ export function removeAccessToken(options) {
     }
     try {
         window.localStorage.removeItem(storageKey);
-        // Clear the cookie that mirrors the token for SSR
-        clearAccessTokenCookie(storageKey);
         return true;
     }
     catch (e) {

package/dist/utils/axios-client.d.ts

@@ -1,4 +1,3 @@
-import { AxiosRequestConfig } from "axios";
 import type { Base44ErrorJSON } from "./axios-client.types.js";
 /**
  * Custom error class for Base44 SDK errors.
@@ -91,12 +90,11 @@ export declare class Base44Error extends Error {
  * @returns Configured axios instance
  * @internal
  */
-export declare function createAxiosClient({ baseURL, headers, token, interceptResponses, onError, adapter, }: {
+export declare function createAxiosClient({ baseURL, headers, token, interceptResponses, onError, }: {
     baseURL: string;
     headers?: Record<string, string>;
     token?: string;
     interceptResponses?: boolean;
     onError?: (error: Error) => void;
-    adapter?: AxiosRequestConfig["adapter"];
 }): import("axios").AxiosInstance;
 export type { Base44ErrorJSON } from "./axios-client.types.js";

package/dist/utils/axios-client.js

@@ -115,10 +115,9 @@ function safeErrorLog(prefix, error) {
  * @returns Configured axios instance
  * @internal
  */
-export function createAxiosClient({ baseURL, headers = {}, token, interceptResponses = true, onError, adapter, }) {
+export function createAxiosClient({ baseURL, headers = {}, token, interceptResponses = true, onError, }) {
     const client = axios.create({
         baseURL,
-        ...(adapter !== undefined ? { adapter } : {}),
         headers: {
             "Content-Type": "application/json",
             Accept: "application/json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@base44-preview/sdk",
-  "version": "0.8.35-pr.221.5933e35",
+  "version": "0.8.36-pr.212.0d64c77",
   "description": "JavaScript SDK for Base44 API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -27,6 +27,7 @@
   },
   "dependencies": {
     "axios": "^1.17.0",
+    "partysocket": "^0.0.23",
     "socket.io-client": "^4.8.3",
     "uuid": "^13.0.2"
   },

package/dist/server.d.ts

@@ -1,111 +0,0 @@
-import type { Base44Client } from "./client.types.js";
-/**
- * Options for creating a server-side Base44 client with {@linkcode createServerClient | createServerClient()}.
- */
-export interface CreateServerClientOptions {
-    /**
-     * The incoming Fetch API `Request`.
-     *
-     * Used to resolve configuration from `Base44-*` headers, the user token from
-     * the `Authorization` header, and the `base44_access_token` cookie set by the
-     * browser SDK.
-     */
-    request: Request;
-    /**
-     * Environment variables record, such as a Cloudflare Worker `env` binding or
-     * Node's `process.env`.
-     *
-     * Recognized variables: `BASE44_APP_ID`, `BASE44_API_URL`,
-     * `BASE44_SERVICE_TOKEN`, and `BASE44_FUNCTIONS_VERSION`.
-     */
-    env?: Record<string, string | undefined>;
-    /**
-     * The Base44 app ID. Takes precedence over `env.BASE44_APP_ID` and the
-     * `Base44-App-Id` request header.
-     */
-    appId?: string;
-    /**
-     * The Base44 server URL. Must be an absolute URL. Takes precedence over
-     * `env.BASE44_API_URL` and the `Base44-Api-Url` request header.
-     *
-     * @defaultValue `"https://base44.app"`
-     */
-    serverUrl?: string;
-    /**
-     * User authentication token. Takes precedence over the request's
-     * `Authorization: Bearer` header and the `base44_access_token` cookie.
-     */
-    token?: string;
-    /**
-     * Service role authentication token. Takes precedence over
-     * `env.BASE44_SERVICE_TOKEN` and the `Base44-Service-Authorization` request
-     * header.
-     */
-    serviceToken?: string;
-    /**
-     * Version string for the functions API. Takes precedence over
-     * `env.BASE44_FUNCTIONS_VERSION` and the `Base44-Functions-Version` request
-     * header.
-     * @internal
-     */
-    functionsVersion?: string;
-}
-/**
- * Creates a Base44 client for server-side rendering (SSR) and edge runtimes.
- *
- * Use this function in Cloudflare Workers, framework loaders, and other
- * server environments that handle Fetch API requests. Unlike
- * {@linkcode createClient | createClient()}, the returned client is safe to
- * create per request outside a browser: analytics is fully disabled (no
- * background timers), HTTP requests use the `fetch` adapter, and no browser
- * storage is touched.
- *
- * Each configuration value is resolved in order from: the explicit option,
- * the `env` record (`BASE44_APP_ID`, `BASE44_API_URL`, `BASE44_SERVICE_TOKEN`,
- * `BASE44_FUNCTIONS_VERSION`), and finally the request headers — the same
- * `Base44-*` headers read by
- * {@linkcode createClientFromRequest | createClientFromRequest()}. The user
- * token is resolved from the explicit option, then the request's
- * `Authorization: Bearer` header, then the `base44_access_token` cookie that
- * the browser SDK mirrors from localStorage.
- *
- * @param options - Server client options, including the incoming request and optional environment record.
- * @returns A configured Base44 client instance scoped to the incoming request.
- * @throws {Error} When no app ID can be resolved from the options, environment, or request headers.
- * @throws {Error} When the resolved server URL isn't an absolute URL.
- *
- * @example
- * ```typescript
- * // Cloudflare Worker fetch handler
- * import { createServerClient } from '@base44/sdk';
- *
- * export default {
- *   async fetch(request, env) {
- *     const base44 = createServerClient({ request, env });
- *
- *     // Reads data as the user identified by the request's cookie or
- *     // Authorization header (anonymous when neither is present)
- *     const products = await base44.entities.Products.list();
- *
- *     return Response.json({ products });
- *   }
- * };
- * ```
- *
- * @example
- * ```typescript
- * // Framework loader (React Router, Remix, and similar)
- * import { createServerClient } from '@base44/sdk';
- *
- * export async function loader({ request }) {
- *   const base44 = createServerClient({
- *     request,
- *     appId: 'my-app-id'
- *   });
- *
- *   const user = await base44.auth.me().catch(() => null);
- *   return { user };
- * }
- * ```
- */
-export declare function createServerClient(options: CreateServerClientOptions): Base44Client;

package/dist/server.js

@@ -1,157 +0,0 @@
-import { createClient } from "./client.js";
-const ACCESS_TOKEN_COOKIE_NAME = "base44_access_token";
-/**
- * Returns the first truthy value, treating empty strings the same as unset.
- */
-function firstNonEmpty(...values) {
-    for (const value of values) {
-        if (value) {
-            return value;
-        }
-    }
-    return undefined;
-}
-/**
- * Extracts the token from a `Bearer <token>` authorization header value.
- * Returns undefined when the header is missing or malformed.
- */
-function parseBearerToken(header) {
-    if (!header) {
-        return undefined;
-    }
-    const parts = header.split(" ");
-    if (parts.length === 2 && parts[0] === "Bearer" && parts[1]) {
-        return parts[1];
-    }
-    return undefined;
-}
-/**
- * Minimal cookie parser (no dependency): reads a single cookie value from a
- * `Cookie` request header, handling quoted values and URL-encoding.
- */
-function getCookieValue(cookieHeader, name) {
-    if (!cookieHeader) {
-        return undefined;
-    }
-    for (const part of cookieHeader.split(";")) {
-        const separatorIndex = part.indexOf("=");
-        if (separatorIndex === -1) {
-            continue;
-        }
-        if (part.slice(0, separatorIndex).trim() !== name) {
-            continue;
-        }
-        let value = part.slice(separatorIndex + 1).trim();
-        if (value.length >= 2 && value.startsWith('"') && value.endsWith('"')) {
-            value = value.slice(1, -1);
-        }
-        try {
-            return decodeURIComponent(value);
-        }
-        catch (_a) {
-            return value;
-        }
-    }
-    return undefined;
-}
-function isAbsoluteUrl(url) {
-    try {
-        new URL(url);
-        return true;
-    }
-    catch (_a) {
-        return false;
-    }
-}
-/**
- * Creates a Base44 client for server-side rendering (SSR) and edge runtimes.
- *
- * Use this function in Cloudflare Workers, framework loaders, and other
- * server environments that handle Fetch API requests. Unlike
- * {@linkcode createClient | createClient()}, the returned client is safe to
- * create per request outside a browser: analytics is fully disabled (no
- * background timers), HTTP requests use the `fetch` adapter, and no browser
- * storage is touched.
- *
- * Each configuration value is resolved in order from: the explicit option,
- * the `env` record (`BASE44_APP_ID`, `BASE44_API_URL`, `BASE44_SERVICE_TOKEN`,
- * `BASE44_FUNCTIONS_VERSION`), and finally the request headers — the same
- * `Base44-*` headers read by
- * {@linkcode createClientFromRequest | createClientFromRequest()}. The user
- * token is resolved from the explicit option, then the request's
- * `Authorization: Bearer` header, then the `base44_access_token` cookie that
- * the browser SDK mirrors from localStorage.
- *
- * @param options - Server client options, including the incoming request and optional environment record.
- * @returns A configured Base44 client instance scoped to the incoming request.
- * @throws {Error} When no app ID can be resolved from the options, environment, or request headers.
- * @throws {Error} When the resolved server URL isn't an absolute URL.
- *
- * @example
- * ```typescript
- * // Cloudflare Worker fetch handler
- * import { createServerClient } from '@base44/sdk';
- *
- * export default {
- *   async fetch(request, env) {
- *     const base44 = createServerClient({ request, env });
- *
- *     // Reads data as the user identified by the request's cookie or
- *     // Authorization header (anonymous when neither is present)
- *     const products = await base44.entities.Products.list();
- *
- *     return Response.json({ products });
- *   }
- * };
- * ```
- *
- * @example
- * ```typescript
- * // Framework loader (React Router, Remix, and similar)
- * import { createServerClient } from '@base44/sdk';
- *
- * export async function loader({ request }) {
- *   const base44 = createServerClient({
- *     request,
- *     appId: 'my-app-id'
- *   });
- *
- *   const user = await base44.auth.me().catch(() => null);
- *   return { user };
- * }
- * ```
- */
-export function createServerClient(options) {
-    var _a;
-    const { request, env = {} } = options;
-    const headers = request.headers;
-    const appId = firstNonEmpty(options.appId, env.BASE44_APP_ID, headers.get("Base44-App-Id"));
-    if (!appId) {
-        throw new Error("createServerClient: unable to resolve an app ID. Pass appId explicitly, set the BASE44_APP_ID environment variable, or forward the Base44-App-Id request header.");
-    }
-    const serverUrl = (_a = firstNonEmpty(options.serverUrl, env.BASE44_API_URL, headers.get("Base44-Api-Url"))) !== null && _a !== void 0 ? _a : "https://base44.app";
-    if (!isAbsoluteUrl(serverUrl)) {
-        throw new Error(`createServerClient: serverUrl must be an absolute URL, got "${serverUrl}"`);
-    }
-    const token = firstNonEmpty(options.token, parseBearerToken(headers.get("Authorization")), getCookieValue(headers.get("Cookie"), ACCESS_TOKEN_COOKIE_NAME));
-    const serviceToken = firstNonEmpty(options.serviceToken, env.BASE44_SERVICE_TOKEN, parseBearerToken(headers.get("Base44-Service-Authorization")));
-    const functionsVersion = firstNonEmpty(options.functionsVersion, env.BASE44_FUNCTIONS_VERSION, headers.get("Base44-Functions-Version"));
-    // Propagate Base44-State like createClientFromRequest, so the server client
-    // degrades gracefully behind the existing Base44 proxy
-    const stateHeader = headers.get("Base44-State");
-    const additionalHeaders = {};
-    if (stateHeader) {
-        additionalHeaders["Base44-State"] = stateHeader;
-    }
-    return createClient({
-        serverUrl,
-        appId,
-        token,
-        serviceToken,
-        functionsVersion,
-        headers: additionalHeaders,
-        requiresAuth: false,
-        disableAnalytics: true,
-        adapter: "fetch",
-    });
-}