@base44-preview/sdk 0.8.36-pr.212.0d64c77 → 0.8.36-pr.212.71a10c2

package/dist/client.js

@@ -12,7 +12,7 @@ import { createAppLogsModule } from "./modules/app-logs.js";
 import { createUsersModule } from "./modules/users.js";
 import { RoomsSocket } from "./utils/socket-utils.js";
 import { createAnalyticsModule } from "./modules/analytics.js";
-import { createRealtimeModule, pushUserTokenToActiveSockets } from "./modules/realtime.js";
+import { createRealtimeModule } from "./modules/realtime.js";
 /**
  * Creates a Base44 client.
  *
@@ -124,21 +124,6 @@ export function createClient(config) {
         appBaseUrl: normalizedAppBaseUrl,
         serverUrl,
     });
-    // Current user session token (axios defaults are the single source of truth —
-    // createClient({token}) and every setToken() land there). Used for in-band
-    // realtime auth; read lazily so refreshes are always picked up.
-    const getUserToken = () => {
-        var _a;
-        const h = (_a = axiosClient.defaults.headers.common) === null || _a === void 0 ? void 0 : _a["Authorization"];
-        return typeof h === "string" && h.startsWith("Bearer ") ? h.slice(7) : null;
-    };
-    // Login / token refresh must reach long-lived realtime sockets too, so the
-    // handler-side credential never goes stale mid-connection.
-    const originalSetToken = userAuthModule.setToken.bind(userAuthModule);
-    userAuthModule.setToken = (newToken, saveToStorage) => {
-        originalSetToken(newToken, saveToStorage);
-        pushUserTokenToActiveSockets(newToken);
-    };
     // Apply the access token before any module that may issue authenticated
     // requests during construction (notably analytics, which fires an init
     // event whose flush calls auth.me()). Without this, the first User/me
@@ -190,22 +175,13 @@ export function createClient(config) {
             appId,
             dispatcherWsUrl: resolvedDispatcherWsUrl,
             webSocketImpl,
-            getUserToken,
             getToken: async (handlerName, instanceId, connId) => {
                 // axiosClient interceptors unwrap response.data, so the result is the body directly.
                 // conn_id rides inside the signed token (not a WS query param) so it survives
                 // proxies that strip params; the dispatcher forwards it as the handler's conn.id.
                 // Base44-Functions-Version rides along (like function calls) so live apps get
                 // tokens for the *published* realtime script and previews get the draft.
-                const data = await axiosClient.post(`/apps/${appId}/realtime-token`, {
-                    handler_name: handlerName,
-                    instance_id: instanceId,
-                    conn_id: connId,
-                    // Declares "an __auth message follows right after connect" — the
-                    // handler delays handleConnect until it arrives (signed into the
-                    // token so old SDKs, which never send __auth, are never waited on).
-                    supports_inband_auth: getUserToken() != null,
-                }, functionsVersion
+                const data = await axiosClient.post(`/apps/${appId}/realtime-token`, { handler_name: handlerName, instance_id: instanceId, conn_id: connId }, functionsVersion
                     ? { headers: { "Base44-Functions-Version": functionsVersion } }
                     : undefined);
                 return data.token;

package/dist/modules/realtime.d.ts

@@ -1,13 +1,6 @@
-/** Push a (new) user session token to every open realtime socket — called on
- *  login/refresh so long-lived connections keep a valid credential server-side. */
-export declare function pushUserTokenToActiveSockets(token: string): void;
 export declare function createRealtimeModule(config: {
     appId: string;
     getToken(handlerName: string, instanceId: string, connId: string): Promise<string>;
-    /** Current user session token, if signed in. Sent in-band ({type:"__auth"})
-     *  right after every socket open — never in the URL — so the handler can act
-     *  as this user (createUserClient / RLS). */
-    getUserToken?: () => string | null;
     dispatcherWsUrl: string;
     /** WebSocket implementation for runtimes without a global one (Node < 22). */
     webSocketImpl?: unknown;

package/dist/modules/realtime.js

@@ -4,19 +4,6 @@ const activeSockets = new Map();
 function socketKey(handlerName, instanceId) {
     return `${handlerName}:${instanceId}`;
 }
-/** Push a (new) user session token to every open realtime socket — called on
- *  login/refresh so long-lived connections keep a valid credential server-side. */
-export function pushUserTokenToActiveSockets(token) {
-    if (!token)
-        return;
-    const payload = JSON.stringify({ type: "__auth", token });
-    for (const ws of activeSockets.values()) {
-        try {
-            ws.send(payload);
-        }
-        catch ( /* not open — the open handler will send */_a) { /* not open — the open handler will send */ }
-    }
-}
 export function createRealtimeModule(config) {
     return new Proxy({}, {
         get(_, handlerName) {
@@ -43,28 +30,11 @@ export function createRealtimeModule(config) {
                         query: () => config.getToken(handlerName, instanceId, connId).then((token) => ({ token })),
                     });
                     activeSockets.set(key, ws);
-                    // In-band credential delivery (Supabase-style): the user token rides the
-                    // open socket, never the URL. Sent on every open (incl. reconnects); the
-                    // server may also nudge with {type:"__auth_required"} (e.g. just before
-                    // the held token expires) and we answer with the current one.
-                    const sendAuth = () => {
-                        var _a;
-                        const t = (_a = config.getUserToken) === null || _a === void 0 ? void 0 : _a.call(config);
-                        if (t) {
-                            try {
-                                ws.send(JSON.stringify({ type: "__auth", token: t }));
-                            }
-                            catch ( /* not open */_b) { /* not open */ }
-                        }
-                    };
-                    ws.addEventListener("open", sendAuth);
                     // Heartbeat / half-open detection. PartySocket only reconnects on a
                     // browser close/error event, so a silently-dead connection (TCP alive,
                     // no data — common behind proxies/LBs) hangs until the OS idle timeout
                     // (~60s). We ping periodically and force a reconnect if nothing comes
                     // back within DEAD_MS, cutting detection from ~60s to a few seconds.
-                    // Pairs with the handler's setWebSocketAutoResponse("__ping"→"__pong"),
-                    // so idle handlers (no app broadcasts) still keep the connection proven.
                     const PING_MS = 1000;
                     const DEAD_MS = 3000;
                     let lastMsg = Date.now();
@@ -83,10 +53,6 @@ export function createRealtimeModule(config) {
                         const msgType = data && typeof data === "object" ? data.type : undefined;
                         if (msgType === "__pong")
                             return;
-                        if (msgType === "__auth_required") {
-                            sendAuth();
-                            return;
-                        }
                         callback(data);
                     });
                     const heartbeat = setInterval(() => {

package/dist/realtime-handler.d.ts

@@ -73,8 +73,7 @@ export declare abstract class RealtimeHandler<Incoming = unknown, Outgoing = unk
      * the app's row-level security, evaluated as that user at call time. The
      * default wherever a `conn` is in scope (connect/message/close).
      *
-     * Throws if the connection carries no user credential (anonymous visitor,
-     * signed-out session, or an app SDK that predates in-band auth).
+     * Throws for anonymous connections (no signed-in user to act as).
      */
     protected createUserClient(conn: Conn): Base44Client;
     /**

package/dist/realtime-handler.js

@@ -61,8 +61,7 @@ export class RealtimeHandler {
      * the app's row-level security, evaluated as that user at call time. The
      * default wherever a `conn` is in scope (connect/message/close).
      *
-     * Throws if the connection carries no user credential (anonymous visitor,
-     * signed-out session, or an app SDK that predates in-band auth).
+     * Throws for anonymous connections (no signed-in user to act as).
      */
     createUserClient(conn) {
         void conn;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@base44-preview/sdk",
-  "version": "0.8.36-pr.212.0d64c77",
+  "version": "0.8.36-pr.212.71a10c2",
   "description": "JavaScript SDK for Base44 API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",