@base44-preview/sdk 0.8.38-pr.212.896c21a → 0.8.38-pr.228.85deaff

package/dist/client.js

@@ -12,7 +12,6 @@ import { createAppLogsModule } from "./modules/app-logs.js";
 import { createUsersModule } from "./modules/users.js";
 import { RoomsSocket } from "./utils/socket-utils.js";
 import { createAnalyticsModule } from "./modules/analytics.js";
-import { createActorsModule } from "./modules/actors.js";
 /**
  * Creates a Base44 client.
  *
@@ -52,27 +51,9 @@ import { createActorsModule } from "./modules/actors.js";
  */
 export function createClient(config) {
     var _a, _b;
-    const { serverUrl = "https://base44.app", appId, token, serviceToken, requiresAuth = false, appBaseUrl, options, functionsVersion, headers: optionalHeaders, dispatcherWsUrl, webSocketImpl, } = config;
+    const { serverUrl = "https://base44.app", appId, token, serviceToken, requiresAuth = false, appBaseUrl, options, functionsVersion, headers: optionalHeaders, } = config;
     // Normalize appBaseUrl to always be a string (empty if not provided or invalid)
     const normalizedAppBaseUrl = typeof appBaseUrl === "string" ? appBaseUrl : "";
-    // Derive the dispatcher WebSocket URL if not explicitly provided. Default to
-    // the app's OWN origin (the app URL proxies /parties to the backend) so the
-    // socket is same-origin with the running app, not the API host: prefer an
-    // explicit appBaseUrl, then the browser origin, then fall back to serverUrl
-    // (Node/SSR, where there's no window). Convert https:// → wss:// (http → ws)
-    // and strip the trailing slash.
-    const resolvedDispatcherWsUrl = (() => {
-        var _a, _b;
-        if (dispatcherWsUrl)
-            return dispatcherWsUrl.replace(/\/$/, "");
-        const appOrigin = normalizedAppBaseUrl ||
-            // React Native has a bare `window` with no `location`, so guard both.
-            (typeof window !== "undefined" ? (_b = (_a = window.location) === null || _a === void 0 ? void 0 : _a.origin) !== null && _b !== void 0 ? _b : "" : "");
-        return (appOrigin || serverUrl)
-            .replace(/\/$/, "")
-            .replace(/^https:\/\//, "wss://")
-            .replace(/^http:\/\//, "ws://");
-    })();
     const socketConfig = {
         serverUrl,
         mountPath: "/ws-user-apps/socket.io/",
@@ -179,22 +160,6 @@ export function createClient(config) {
             appId,
             userAuthModule,
         }),
-        actors: createActorsModule({
-            appId,
-            dispatcherWsUrl: resolvedDispatcherWsUrl,
-            webSocketImpl,
-            getToken: async (actorName, instanceId, connId) => {
-                // axiosClient interceptors unwrap response.data, so the result is the body directly.
-                // conn_id rides inside the signed token (not a WS query param) so it survives
-                // proxies that strip params; the dispatcher forwards it as the actor's conn.id.
-                // Base44-Functions-Version rides along (like function calls) so live apps get
-                // tokens for the *published* actor script and previews get the draft.
-                const data = await axiosClient.post(`/apps/${appId}/actor-token`, { handler_name: actorName, instance_id: instanceId, conn_id: connId }, functionsVersion
-                    ? { headers: { "Base44-Functions-Version": functionsVersion } }
-                    : undefined);
-                return data.token;
-            },
-        }),
         cleanup: () => {
             userModules.analytics.cleanup();
             if (socket) {
@@ -381,6 +346,7 @@ export function createClientFromRequest(request) {
     const serverUrlHeader = request.headers.get("Base44-Api-Url");
     const functionsVersion = request.headers.get("Base44-Functions-Version");
     const stateHeader = request.headers.get("Base44-State");
+    const dataEnvHeader = request.headers.get("X-Data-Env");
     if (!appId) {
         throw new Error("Base44-App-Id header is required, but is was not found on the request");
     }
@@ -408,6 +374,16 @@ export function createClientFromRequest(request) {
     if (stateHeader) {
         additionalHeaders["Base44-State"] = stateHeader;
     }
+    // Propagate the data environment so entity operations from the function stay
+    // in the same environment (e.g. test data) as the triggering request. This
+    // matters for the user-scoped client: unlike the service token, the user JWT
+    // carries no data-env, so without forwarding this header the callbacks fall
+    // back to production data even when the app runs in test-data mode.
+    // Forward only the known closed set (matches the backend contract) rather
+    // than relaying an arbitrary attacker-supplied header value onward.
+    if (dataEnvHeader === "dev" || dataEnvHeader === "prod") {
+        additionalHeaders["X-Data-Env"] = dataEnvHeader;
+    }
     return createClient({
         serverUrl: serverUrlHeader || "https://base44.app",
         appId,

package/dist/client.types.d.ts

@@ -8,7 +8,6 @@ import type { AgentsModule } from "./modules/agents.types.js";
 import type { AiGatewayModule } from "./modules/ai-gateway.types.js";
 import type { AppLogsModule } from "./modules/app-logs.types.js";
 import type { AnalyticsModule } from "./modules/analytics.types.js";
-import type { ActorsModule } from "./modules/actors.types.js";
 /**
  * Options for creating a Base44 client.
  */
@@ -74,28 +73,6 @@ export interface CreateClientConfig {
      * Additional client options.
      */
     options?: CreateClientOptions;
-    /**
-     * Base WebSocket URL for the Cloudflare Durable Object dispatcher.
-     *
-     * Defaults to the app's own origin (`appBaseUrl`, else the browser's
-     * `window.location.origin`, else `serverUrl`) with `https://` replaced by
-     * `wss://` (or `http://` by `ws://`) — so the realtime socket is same-origin
-     * with the running app, which proxies `/parties` to the backend.
-     * Override when the dispatcher lives at a different host than the app.
-     */
-    dispatcherWsUrl?: string;
-    /**
-     * WebSocket implementation for realtime subscriptions in environments
-     * without a global `WebSocket` (Node.js < 22). Browsers and Node ≥ 22
-     * don't need this.
-     *
-     * @example
-     * ```typescript
-     * import WS from "ws";
-     * const base44 = createClient({ appId, webSocketImpl: WS });
-     * ```
-     */
-    webSocketImpl?: unknown;
 }
 /**
  * The Base44 client instance.
@@ -111,8 +88,6 @@ export interface Base44Client {
     analytics: AnalyticsModule;
     /** {@link AppLogsModule | App logs module} for tracking app usage. */
     appLogs: AppLogsModule;
-    /** {@link ActorsModule | Actors module} for subscribing to and sending messages via Cloudflare Durable Object-backed Actors. */
-    actors: ActorsModule;
     /** {@link AuthModule | Auth module} for user authentication and management. */
     auth: AuthModule;
     /** {@link UserConnectorsModule | Connectors module} for app-user OAuth flows. */

package/dist/index.d.ts

@@ -11,9 +11,7 @@ export type { FunctionsModule, FunctionName, FunctionNameRegistry, } from "./mod
 export type { AgentsModule, AgentName, AgentNameRegistry, AgentConversation, AgentMessage, AgentMessageReasoning, AgentMessageToolCall, AgentMessageUsage, AgentMessageCustomContext, AgentMessageMetadata, CreateConversationParams, } from "./modules/agents.types.js";
 export type { AiGatewayModule, AiGatewayConnection, } from "./modules/ai-gateway.types.js";
 export type { AppLogsModule } from "./modules/app-logs.types.js";
-export type { ActorsModule, ActorClient, ActorNameRegistry, ActorRegistry, } from "./modules/actors.types.js";
 export type { SsoModule, SsoAccessTokenResponse } from "./modules/sso.types.js";
-export { Actor, type Conn } from "./actor.js";
 export type { ConnectorsModule, UserConnectorsModule, } from "./modules/connectors.types.js";
 export type { CustomIntegrationsModule, CustomIntegrationCallParams, CustomIntegrationCallResponse, } from "./modules/custom-integrations.types.js";
 export type { GetAccessTokenOptions, SaveAccessTokenOptions, RemoveAccessTokenOptions, GetLoginUrlOptions, } from "./utils/auth-utils.types.js";

package/dist/index.js

@@ -3,4 +3,3 @@ import { Base44Error } from "./utils/axios-client.js";
 import { getAccessToken, saveAccessToken, removeAccessToken, getLoginUrl, } from "./utils/auth-utils.js";
 export { createClient, createClientFromRequest, Base44Error, getAccessToken, saveAccessToken, removeAccessToken, getLoginUrl, };
 export * from "./types.js";
-export { Actor } from "./actor.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@base44-preview/sdk",
-  "version": "0.8.38-pr.212.896c21a",
+  "version": "0.8.38-pr.228.85deaff",
   "description": "JavaScript SDK for Base44 API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -27,7 +27,6 @@
   },
   "dependencies": {
     "axios": "^1.17.0",
-    "partysocket": "^0.0.23",
     "socket.io-client": "^4.8.3",
     "uuid": "^13.0.2"
   },

package/dist/actor.d.ts

@@ -1,91 +0,0 @@
-/**
- * Type-only base class for Actors.
- *
- * Import and extend this in your actor files:
- *   import { Actor } from "@base44/sdk";
- *   export class MyActor extends Actor { ... }
- *
- * At deploy time the bundler replaces this import with the compiled
- * Cloudflare Durable Object implementation — this file provides types only.
- */
-import type { Base44Client } from "./client.types.js";
-/**
- * A single client connection. `Send` is the message type this connection accepts
- * via {@link send} — the actor's *outgoing* (server→client) messages.
- */
-export interface Conn<Send = unknown> {
-    /** Unique per-connection id (one per socket/tab), the same value the client
-     *  receives from `subscribe()`. Use this — not userId — to identify a distinct
-     *  client, so multiple tabs of the same user are separate connections. */
-    id: string;
-    userId: string;
-    appId: string;
-    instanceId: string;
-    send(data: Send): void;
-    reject(code: number, reason: string): void;
-}
-export interface Storage {
-    get<T>(key: string): Promise<T | undefined>;
-    put(key: string, value: unknown): Promise<void>;
-    delete(key: string): Promise<boolean>;
-}
-/**
- * Base class for an Actor.
- *
- * @typeParam Incoming - messages this actor *receives* from clients
- *   (`handleMessage`'s `msg`) — the schema's `toServer` section.
- * @typeParam Outgoing - messages this actor *sends* to clients
- *   (`conn.send`/`broadcast`) — the schema's `toClient` section.
- *
- * With a generated `schema.jsonc`, wire both from the registry so they can't drift
- * from the client's types:
- * ```ts
- * type Reg = ActorRegistry["MyActor"];
- * class MyActor extends Actor<Reg["toServer"], Reg["toClient"]> { ... }
- * ```
- */
-export declare abstract class Actor<Incoming = unknown, Outgoing = unknown> {
-    abstract handleConnect(conn: Conn<Outgoing>): void | Promise<void>;
-    abstract handleMessage(conn: Conn<Outgoing>, msg: Incoming): void | Promise<void>;
-    abstract handleClose(conn: Conn<Outgoing>): void | Promise<void>;
-    abstract handleTick(): void | Promise<void>;
-    /**
-     * Optional wake hook: runs once when the instance starts, after the
-     * platform's credential setup and before any connection is handled — safe
-     * to use {@link createServiceClient} and load persisted state here.
-     */
-    handleStart(): void | Promise<void>;
-    /**
-     * Managed ticker (opt-in). Override {@link shouldTick} and the platform runs
-     * {@link handleTick} on a timer of {@link tickIntervalMs} while it returns true,
-     * and stops (letting the Durable Object hibernate — no compute cost) when it
-     * returns false. The platform owns scheduling, rescheduling, self-heal, and
-     * error-safety — you don't call {@link startLoop}/{@link stopLoop}.
-     *
-     * Re-evaluated after every connect/message/close and on every tick, so keep it
-     * cheap and pure (no async, no side effects). Example: `return this.players >= 2`.
-     */
-    protected tickIntervalMs: number;
-    protected shouldTick?(): boolean;
-    protected broadcast(_data: Outgoing): void;
-    protected getConnections(): Conn<Outgoing>[];
-    protected startLoop(_ms: number): Promise<void>;
-    protected stopLoop(): Promise<void>;
-    protected get instanceId(): string;
-    protected get storage(): Storage;
-    /**
-     * SDK client acting **as the connected user** — every entity call respects
-     * the app's row-level security, evaluated as that user at call time. The
-     * default wherever a `conn` is in scope (connect/message/close).
-     *
-     * Anonymous connections get an unauthenticated client — entity calls run
-     * under anonymous RLS, just like any public visitor.
-     */
-    protected createClientFromConnection(conn: Conn): Base44Client;
-    /**
-     * Service-role SDK client — bypasses RLS. For work with **no user in scope**
-     * (tick, alarm, handleStart). Inside handleMessage/handleConnect prefer
-     * `createClientFromConnection(conn)`.
-     */
-    protected createServiceClient(): Base44Client;
-}

package/dist/actor.js

@@ -1,84 +0,0 @@
-/**
- * Type-only base class for Actors.
- *
- * Import and extend this in your actor files:
- *   import { Actor } from "@base44/sdk";
- *   export class MyActor extends Actor { ... }
- *
- * At deploy time the bundler replaces this import with the compiled
- * Cloudflare Durable Object implementation — this file provides types only.
- */
-/**
- * Base class for an Actor.
- *
- * @typeParam Incoming - messages this actor *receives* from clients
- *   (`handleMessage`'s `msg`) — the schema's `toServer` section.
- * @typeParam Outgoing - messages this actor *sends* to clients
- *   (`conn.send`/`broadcast`) — the schema's `toClient` section.
- *
- * With a generated `schema.jsonc`, wire both from the registry so they can't drift
- * from the client's types:
- * ```ts
- * type Reg = ActorRegistry["MyActor"];
- * class MyActor extends Actor<Reg["toServer"], Reg["toClient"]> { ... }
- * ```
- */
-export class Actor {
-    constructor() {
-        /**
-         * Managed ticker (opt-in). Override {@link shouldTick} and the platform runs
-         * {@link handleTick} on a timer of {@link tickIntervalMs} while it returns true,
-         * and stops (letting the Durable Object hibernate — no compute cost) when it
-         * returns false. The platform owns scheduling, rescheduling, self-heal, and
-         * error-safety — you don't call {@link startLoop}/{@link stopLoop}.
-         *
-         * Re-evaluated after every connect/message/close and on every tick, so keep it
-         * cheap and pure (no async, no side effects). Example: `return this.players >= 2`.
-         */
-        this.tickIntervalMs = 100;
-    }
-    /**
-     * Optional wake hook: runs once when the instance starts, after the
-     * platform's credential setup and before any connection is handled — safe
-     * to use {@link createServiceClient} and load persisted state here.
-     */
-    handleStart() { }
-    broadcast(_data) {
-        throw new Error("Actor.broadcast() is only available inside a deployed actor");
-    }
-    getConnections() {
-        throw new Error("Actor.getConnections() is only available inside a deployed actor");
-    }
-    startLoop(_ms) {
-        throw new Error("Actor.startLoop() is only available inside a deployed actor");
-    }
-    stopLoop() {
-        throw new Error("Actor.stopLoop() is only available inside a deployed actor");
-    }
-    get instanceId() {
-        throw new Error("Actor.instanceId is only available inside a deployed actor");
-    }
-    get storage() {
-        throw new Error("Actor.storage is only available inside a deployed actor");
-    }
-    /**
-     * SDK client acting **as the connected user** — every entity call respects
-     * the app's row-level security, evaluated as that user at call time. The
-     * default wherever a `conn` is in scope (connect/message/close).
-     *
-     * Anonymous connections get an unauthenticated client — entity calls run
-     * under anonymous RLS, just like any public visitor.
-     */
-    createClientFromConnection(conn) {
-        void conn;
-        throw new Error("Actor.createClientFromConnection() is only available inside a deployed actor");
-    }
-    /**
-     * Service-role SDK client — bypasses RLS. For work with **no user in scope**
-     * (tick, alarm, handleStart). Inside handleMessage/handleConnect prefer
-     * `createClientFromConnection(conn)`.
-     */
-    createServiceClient() {
-        throw new Error("Actor.createServiceClient() is only available inside a deployed actor");
-    }
-}

package/dist/modules/actors.d.ts

@@ -1,21 +0,0 @@
-export declare function createActorsModule(config: {
-    appId: string;
-    getToken(actorName: string, instanceId: string, connId: string): Promise<string>;
-    dispatcherWsUrl: string;
-    /** WebSocket implementation for runtimes without a global one (Node < 22). */
-    webSocketImpl?: unknown;
-}): Record<string, ActorClient>;
-/** Handle for an active actor subscription. */
-interface ActorSubscription {
-    /** This connection's id — the same value the actor receives as `conn.id`. */
-    id: string;
-    /** Close the subscription and its underlying socket. */
-    unsubscribe(): void;
-}
-interface ActorClient {
-    subscribe(instanceId: string, callback: (data: unknown) => void, options?: {
-        id?: string;
-    }): ActorSubscription;
-    send(instanceId: string, data: unknown): void;
-}
-export {};

package/dist/modules/actors.js

@@ -1,89 +0,0 @@
-import PartySocket from "partysocket";
-// Module-level map: "ActorName:instanceId" → active socket
-const activeSockets = new Map();
-function socketKey(actorName, instanceId) {
-    return `${actorName}:${instanceId}`;
-}
-export function createActorsModule(config) {
-    return new Proxy({}, {
-        get(_, actorName) {
-            return {
-                subscribe(instanceId, callback, options) {
-                    var _a, _b;
-                    const key = socketKey(actorName, instanceId);
-                    // close existing if any
-                    (_a = activeSockets.get(key)) === null || _a === void 0 ? void 0 : _a.close();
-                    // Connection id: caller-supplied (stable — reuse across reconnects/tabs as
-                    // you see fit) or auto-generated per subscription. It travels INSIDE the
-                    // signed actor token (never as a WS query param, which proxies strip);
-                    // the dispatcher forwards the verified claim as partyserver's _pk, so the
-                    // actor sees this exact value as conn.id. Reconnects re-mint the token
-                    // with the same id, so conn.id is stable across reconnects.
-                    const connId = (_b = options === null || options === void 0 ? void 0 : options.id) !== null && _b !== void 0 ? _b : crypto.randomUUID();
-                    // query as async fn: called on every (re)connect, fetches a fresh token each time
-                    const ws = new PartySocket({
-                        host: config.dispatcherWsUrl,
-                        party: actorName,
-                        room: instanceId,
-                        ...(config.webSocketImpl ? { WebSocket: config.webSocketImpl } : {}),
-                        query: () => config.getToken(actorName, instanceId, connId).then((token) => ({ token })),
-                    });
-                    activeSockets.set(key, ws);
-                    // Heartbeat / half-open detection. PartySocket only reconnects on a
-                    // browser close/error event, so a silently-dead connection (TCP alive,
-                    // no data — common behind proxies/LBs) hangs until the OS idle timeout
-                    // (~60s). We ping periodically and force a reconnect if nothing comes
-                    // back within DEAD_MS, cutting detection from ~60s to a few seconds.
-                    const PING_MS = 1000;
-                    const DEAD_MS = 3000;
-                    let lastMsg = Date.now();
-                    const bumpAlive = () => { lastMsg = Date.now(); };
-                    ws.addEventListener("open", bumpAlive);
-                    ws.addEventListener("message", (ev) => {
-                        bumpAlive();
-                        let data;
-                        try {
-                            data = JSON.parse(ev.data);
-                        }
-                        catch (_a) {
-                            return; // ignore malformed
-                        }
-                        // Swallow platform messages — never surface them to the app.
-                        const msgType = data && typeof data === "object" ? data.type : undefined;
-                        if (msgType === "__pong")
-                            return;
-                        callback(data);
-                    });
-                    const heartbeat = setInterval(() => {
-                        if (Date.now() - lastMsg > DEAD_MS) {
-                            bumpAlive(); // avoid a reconnect storm while the new socket comes up
-                            ws.reconnect();
-                            return;
-                        }
-                        try {
-                            ws.send(JSON.stringify({ type: "__ping" }));
-                        }
-                        catch (_a) {
-                            // socket not open; the watchdog above will force a reconnect
-                        }
-                    }, PING_MS);
-                    return {
-                        id: connId, // the connection id (same value the actor sees as conn.id)
-                        unsubscribe() {
-                            clearInterval(heartbeat);
-                            activeSockets.delete(key);
-                            ws.close();
-                        },
-                    };
-                },
-                send(instanceId, data) {
-                    const key = socketKey(actorName, instanceId);
-                    const ws = activeSockets.get(key);
-                    if (!ws)
-                        throw new Error(`No active subscription for ${actorName}:${instanceId}`);
-                    ws.send(JSON.stringify(data));
-                },
-            };
-        },
-    });
-}

package/dist/modules/actors.types.d.ts

@@ -1,77 +0,0 @@
-/**
- * Extend this interface to add typed `subscribe` callbacks and `send` payloads
- * for your deployed Actors.
- *
- * This is separate from {@link ActorNameRegistry} (which is auto-generated
- * by `base44 types generate`), so there are no conflicts.
- *
- * @example
- * ```typescript
- * declare module "@base44/sdk" {
- *   interface ActorRegistry {
- *     ChatRoom: {
- *       toClient: { type: "joined" | "left" | "message"; userId?: string; from?: string; text?: string };
- *       toServer: { type: "message"; text: string };
- *     };
- *   }
- * }
- * ```
- */
-export interface ActorRegistry {
-}
-/**
- * Auto-populated by `base44 types generate` with the names of your deployed actors.
- * Do not edit this interface manually — use {@link ActorRegistry} for message types.
- */
-export interface ActorNameRegistry {
-}
-type AllActorNames = keyof ActorRegistry | keyof ActorNameRegistry;
-type ToClientFor<N extends string> = N extends keyof ActorRegistry ? ActorRegistry[N] extends {
-    toClient: infer I;
-} ? I : unknown : unknown;
-type ToServerFor<N extends string> = N extends keyof ActorRegistry ? ActorRegistry[N] extends {
-    toServer: infer O;
-} ? O : unknown : unknown;
-/**
- * Client for a single named Actor.
- * Typed automatically when the actor is registered in {@link ActorRegistry}.
- */
-export interface ActorClient<N extends string = string> {
-    /**
-     * Open a WebSocket subscription. Returns a {@link ActorSubscription} with the
-     * connection `id` (same value the actor sees as `conn.id`) and an `unsubscribe()` method.
-     *
-     * Pass `options.id` to control the connection id (e.g. a stable per-tab id so a
-     * reconnect reuses the same server-side connection); omit it for an auto-generated
-     * per-connection id.
-     */
-    subscribe(instanceId: string, callback: (data: ToClientFor<N>) => void, options?: {
-        id?: string;
-    }): ActorSubscription;
-    /** Send a message over the open socket. Throws if not subscribed. */
-    send(instanceId: string, data: ToServerFor<N>): void;
-}
-/** Handle for an active actor subscription. */
-export interface ActorSubscription {
-    /** This connection's id — the same value the actor receives as `conn.id`. */
-    id: string;
-    /** Close the subscription and its underlying socket. */
-    unsubscribe(): void;
-}
-/**
- * The actors module provides access to Cloudflare Durable Object-backed
- * Actors deployed by the Base44 platform.
- *
- * Actor names are accessed as dynamic properties on this module:
- * ```typescript
- * const sub = await base44.actors.MyActor.subscribe("room-1", (msg) => {
- *   console.log(msg); // typed if MyActor is in ActorRegistry
- * });
- * const { id, unsubscribe } = sub;
- * unsubscribe();
- * ```
- */
-export type ActorsModule = {
-    [K in AllActorNames]: K extends keyof ActorRegistry ? ActorClient<string & K> : ActorClient;
-} & Record<string, ActorClient>;
-export {};

package/dist/modules/actors.types.js

@@ -1 +0,0 @@
-export {};