@base44-preview/sdk 0.8.40-pr.212.c163c94 → 0.8.40-pr.212.f89ce7f

package/dist/client.js

@@ -12,7 +12,7 @@ import { createAppLogsModule } from "./modules/app-logs.js";
 import { createUsersModule } from "./modules/users.js";
 import { RoomsSocket } from "./utils/socket-utils.js";
 import { createAnalyticsModule } from "./modules/analytics.js";
-import { createActorsModule } from "./modules/actors.js";
+import { createActorsModule, resolveActorsWsUrl } from "./modules/actors.js";
 /**
  * Creates a Base44 client.
  *
@@ -51,28 +51,18 @@ import { createActorsModule } from "./modules/actors.js";
  * ```
  */
 export function createClient(config) {
-    var _a, _b;
-    const { serverUrl = "https://base44.app", appId, token, serviceToken, requiresAuth = false, appBaseUrl, options, functionsVersion, headers: optionalHeaders, dispatcherWsUrl, webSocketImpl, } = config;
+    var _a, _b, _c, _d;
+    const { serverUrl = "https://base44.app", appId, token, serviceToken, requiresAuth = false, appBaseUrl, options, functionsVersion, headers: optionalHeaders, actorsWsUrl, } = config;
     // Normalize appBaseUrl to always be a string (empty if not provided or invalid)
     const normalizedAppBaseUrl = typeof appBaseUrl === "string" ? appBaseUrl : "";
-    // Derive the dispatcher WebSocket URL if not explicitly provided. Default to
-    // the app's OWN origin (the app URL proxies /parties to the backend) so the
-    // socket is same-origin with the running app, not the API host: prefer an
-    // explicit appBaseUrl, then the browser origin, then fall back to serverUrl
-    // (Node/SSR, where there's no window). Convert https:// → wss:// (http → ws)
-    // and strip the trailing slash.
-    const resolvedDispatcherWsUrl = (() => {
-        var _a, _b;
-        if (dispatcherWsUrl)
-            return dispatcherWsUrl.replace(/\/$/, "");
-        const appOrigin = normalizedAppBaseUrl ||
-            // React Native has a bare `window` with no `location`, so guard both.
-            (typeof window !== "undefined" ? (_b = (_a = window.location) === null || _a === void 0 ? void 0 : _a.origin) !== null && _b !== void 0 ? _b : "" : "");
-        return (appOrigin || serverUrl)
-            .replace(/\/$/, "")
-            .replace(/^https:\/\//, "wss://")
-            .replace(/^http:\/\//, "ws://");
-    })();
+    // Same-origin with the running app (it proxies /parties to the backend), not
+    // the API host. React Native has a bare `window` with no `location`, so guard both.
+    const resolvedActorsWsUrl = resolveActorsWsUrl({
+        actorsWsUrl,
+        appBaseUrl: normalizedAppBaseUrl,
+        browserOrigin: typeof window !== "undefined" ? (_b = (_a = window.location) === null || _a === void 0 ? void 0 : _a.origin) !== null && _b !== void 0 ? _b : "" : "",
+        serverUrl,
+    });
     const socketConfig = {
         serverUrl,
         mountPath: "/ws-user-apps/socket.io/",
@@ -142,6 +132,12 @@ export function createClient(config) {
             userAuthModule.setToken(accessToken);
         }
     }
+    const actorsModule = createActorsModule({
+        appId,
+        actorsWsUrl: resolvedActorsWsUrl,
+        functionsVersion,
+        getAuthToken: () => token || getAccessToken(),
+    });
     const userModules = {
         entities: createEntitiesModule({
             axios: axiosClient,
@@ -161,7 +157,7 @@ export function createClient(config) {
                 }
                 return headers;
             },
-            baseURL: (_a = functionsAxiosClient.defaults) === null || _a === void 0 ? void 0 : _a.baseURL,
+            baseURL: (_c = functionsAxiosClient.defaults) === null || _c === void 0 ? void 0 : _c.baseURL,
         }),
         agents: createAgentsModule({
             axios: axiosClient,
@@ -179,17 +175,10 @@ export function createClient(config) {
             appId,
             userAuthModule,
         }),
-        actors: createActorsModule({
-            appId,
-            dispatcherWsUrl: resolvedDispatcherWsUrl,
-            webSocketImpl,
-            functionsVersion,
-            // Same credential as function calls; the platform proxy authenticates the
-            // WS connection with it (anonymous when absent) — no pre-connect token mint.
-            getAuthToken: () => token || getAccessToken(),
-        }),
+        actors: actorsModule.module,
         cleanup: () => {
             userModules.analytics.cleanup();
+            actorsModule.closeAll();
             if (socket) {
                 socket.disconnect();
             }
@@ -213,7 +202,7 @@ export function createClient(config) {
                 }
                 return headers;
             },
-            baseURL: (_b = serviceRoleFunctionsAxiosClient.defaults) === null || _b === void 0 ? void 0 : _b.baseURL,
+            baseURL: (_d = serviceRoleFunctionsAxiosClient.defaults) === null || _d === void 0 ? void 0 : _d.baseURL,
         }),
         agents: createAgentsModule({
             axios: serviceRoleAxiosClient,

package/dist/client.types.d.ts

@@ -75,27 +75,15 @@ export interface CreateClientConfig {
      */
     options?: CreateClientOptions;
     /**
-     * Base WebSocket URL for the Cloudflare Durable Object dispatcher.
+     * Base WebSocket URL for Actor connections.
      *
      * Defaults to the app's own origin (`appBaseUrl`, else the browser's
      * `window.location.origin`, else `serverUrl`) with `https://` replaced by
-     * `wss://` (or `http://` by `ws://`) — so the realtime socket is same-origin
-     * with the running app, which proxies `/parties` to the backend.
-     * Override when the dispatcher lives at a different host than the app.
+     * `wss://` (or `http://` by `ws://`) — so the Actor socket is same-origin
+     * with the running app, which proxies `/parties` to the backend dispatcher.
+     * Override only when the Actor host differs from the app origin.
      */
-    dispatcherWsUrl?: string;
-    /**
-     * WebSocket implementation for realtime subscriptions in environments
-     * without a global `WebSocket` (Node.js < 22). Browsers and Node ≥ 22
-     * don't need this.
-     *
-     * @example
-     * ```typescript
-     * import WS from "ws";
-     * const base44 = createClient({ appId, webSocketImpl: WS });
-     * ```
-     */
-    webSocketImpl?: unknown;
+    actorsWsUrl?: string;
 }
 /**
  * The Base44 client instance.
@@ -164,9 +152,7 @@ export interface Base44Client {
         functions: FunctionsModule;
         /** {@link IntegrationsModule | Integrations module} with elevated permissions. */
         integrations: IntegrationsModule;
-        /** {@link SsoModule | SSO module} for generating SSO tokens.
-         * @internal
-         */
+        /** {@link SsoModule | SSO module} for generating SSO tokens. */
         sso: SsoModule;
         /** Cleanup function to disconnect WebSocket connections. */
         cleanup: () => void;

package/dist/modules/actors.d.ts

@@ -1,27 +1,28 @@
-export declare function createActorsModule(config: {
+import type { ActorRoom } from "./actors.types.js";
+interface ActorsConfig {
     appId: string;
-    /** Current user access token, if authenticated. Rides the WS query (same
-     * pattern as the entities socket) so the platform proxy can authenticate the
-     * connection like a backend-function call; anonymous connects omit it. */
+    /** Current user access token, if authenticated. Rides the WS query so the
+     * platform proxy can authenticate the connection; anonymous connects omit it. */
     getAuthToken(): string | null | undefined;
     /** Same semantics as function calls: editors with a non-prod version get the
      * draft actor script; everyone else gets the published one. */
     functionsVersion?: string;
-    dispatcherWsUrl: string;
-    /** WebSocket implementation for runtimes without a global one (Node < 22). */
-    webSocketImpl?: unknown;
-}): Record<string, ActorClient>;
-/** Handle for an active actor subscription. */
-interface ActorSubscription {
-    /** This connection's id — the same value the actor receives as `conn.id`. */
-    id: string;
-    /** Close the subscription and its underlying socket. */
-    unsubscribe(): void;
-}
-interface ActorClient {
-    subscribe(instanceId: string, callback: (data: unknown) => void, options?: {
-        id?: string;
-    }): ActorSubscription;
-    send(instanceId: string, data: unknown): void;
+    actorsWsUrl: string;
 }
+/**
+ * Base WebSocket URL for Actor connections. An explicit `actorsWsUrl` wins;
+ * otherwise the app's own origin (`appBaseUrl`, else the browser origin, else
+ * `serverUrl`) with `https://`→`wss://` / `http://`→`ws://` and no trailing
+ * slash — the app proxies `/parties` to the backend dispatcher.
+ */
+export declare function resolveActorsWsUrl(opts: {
+    actorsWsUrl?: string;
+    appBaseUrl?: string;
+    browserOrigin?: string;
+    serverUrl: string;
+}): string;
+export declare function createActorsModule(config: ActorsConfig): {
+    module: Record<string, (instanceId: string) => ActorRoom>;
+    closeAll: () => void;
+};
 export {};

package/dist/modules/actors.js

@@ -1,100 +1,149 @@
 import PartySocket from "partysocket";
-// Module-level map: "ActorName:instanceId" → active socket
-const activeSockets = new Map();
-function socketKey(actorName, instanceId) {
-    return `${actorName}:${instanceId}`;
+// Heartbeat / half-open detection: PartySocket only reconnects on a close/error
+// event, so ping periodically and force a reconnect if nothing returns in DEAD_MS.
+const PING_MS = 1000;
+const DEAD_MS = 3000;
+class Room {
+    constructor(actorName, instanceId, config, onClose) {
+        this.actorName = actorName;
+        this.instanceId = instanceId;
+        this.config = config;
+        this.onClose = onClose;
+        this.ws = null;
+        this.listeners = new Set();
+        this.heartbeat = null;
+        this.connId = null;
+    }
+    get id() {
+        if (!this.connId) {
+            throw new Error(`${this.actorName}:${this.instanceId}: connect() before reading id`);
+        }
+        return this.connId;
+    }
+    connect(options) {
+        var _a;
+        if (this.ws)
+            return this;
+        // The client picks its own conn id; it becomes _pk → the actor's conn.id.
+        const connId = (_a = options === null || options === void 0 ? void 0 : options.id) !== null && _a !== void 0 ? _a : crypto.randomUUID();
+        this.connId = connId;
+        const ws = new PartySocket({
+            host: this.config.actorsWsUrl,
+            party: this.actorName,
+            room: this.instanceId,
+            id: connId,
+            // Re-read on every (re)connect so a login/logout is picked up.
+            query: () => {
+                const token = this.config.getAuthToken();
+                return {
+                    app_id: this.config.appId,
+                    handler: this.actorName,
+                    ...(token ? { token } : {}),
+                    ...(this.config.functionsVersion ? { fv: this.config.functionsVersion } : {}),
+                };
+            },
+        });
+        this.ws = ws;
+        let lastMsg = Date.now();
+        const bumpAlive = () => { lastMsg = Date.now(); };
+        ws.addEventListener("open", bumpAlive);
+        ws.addEventListener("message", (ev) => {
+            bumpAlive();
+            let data;
+            try {
+                data = JSON.parse(ev.data);
+            }
+            catch (_a) {
+                return;
+            }
+            const msgType = data && typeof data === "object" ? data.type : undefined;
+            if (msgType === "__pong")
+                return;
+            for (const listener of this.listeners)
+                listener(data);
+        });
+        this.heartbeat = setInterval(() => {
+            if (Date.now() - lastMsg > DEAD_MS) {
+                bumpAlive(); // avoid a reconnect storm while the new socket comes up
+                ws.reconnect();
+                return;
+            }
+            try {
+                // The deployed shim echoes __ping → __pong (base44-userapp-bundler
+                // shim/actor.ts); without that, an idle room reconnects every DEAD_MS.
+                ws.send(JSON.stringify({ type: "__ping" }));
+            }
+            catch (_a) {
+                // not open; the watchdog above will reconnect
+            }
+        }, PING_MS);
+        return this;
+    }
+    subscribe(callback) {
+        if (!this.ws) {
+            throw new Error(`${this.actorName}:${this.instanceId}: connect() before subscribe()`);
+        }
+        this.listeners.add(callback);
+        return {
+            unsubscribe: () => { this.listeners.delete(callback); },
+        };
+    }
+    send(data) {
+        if (!this.ws) {
+            throw new Error(`${this.actorName}:${this.instanceId}: connect() before send()`);
+        }
+        this.ws.send(JSON.stringify(data));
+    }
+    close() {
+        var _a, _b;
+        if (this.heartbeat) {
+            clearInterval(this.heartbeat);
+            this.heartbeat = null;
+        }
+        this.listeners.clear();
+        (_a = this.ws) === null || _a === void 0 ? void 0 : _a.close();
+        this.ws = null;
+        this.connId = null;
+        (_b = this.onClose) === null || _b === void 0 ? void 0 : _b.call(this);
+    }
+}
+/**
+ * Base WebSocket URL for Actor connections. An explicit `actorsWsUrl` wins;
+ * otherwise the app's own origin (`appBaseUrl`, else the browser origin, else
+ * `serverUrl`) with `https://`→`wss://` / `http://`→`ws://` and no trailing
+ * slash — the app proxies `/parties` to the backend dispatcher.
+ */
+export function resolveActorsWsUrl(opts) {
+    if (opts.actorsWsUrl)
+        return opts.actorsWsUrl.replace(/\/$/, "");
+    const appOrigin = opts.appBaseUrl || opts.browserOrigin || "";
+    return (appOrigin || opts.serverUrl)
+        .replace(/\/$/, "")
+        .replace(/^https:\/\//, "wss://")
+        .replace(/^http:\/\//, "ws://");
 }
 export function createActorsModule(config) {
-    return new Proxy({}, {
-        get(_, actorName) {
-            return {
-                subscribe(instanceId, callback, options) {
-                    var _a, _b;
-                    const key = socketKey(actorName, instanceId);
-                    // close existing if any
-                    (_a = activeSockets.get(key)) === null || _a === void 0 ? void 0 : _a.close();
-                    // Connection id: caller-supplied (stable — reuse across reconnects/tabs as
-                    // you see fit) or auto-generated per subscription. PartySocket sends it
-                    // as ?_pk=; the platform proxy validates it and the actor sees this exact
-                    // value as conn.id, stable across reconnects.
-                    const connId = (_b = options === null || options === void 0 ? void 0 : options.id) !== null && _b !== void 0 ? _b : crypto.randomUUID();
-                    // No pre-connect token mint: the platform proxy authenticates the
-                    // connection itself, exactly like a backend-function call. `handler`
-                    // carries the case-preserved actor name (the `party` path segment is
-                    // lowercased by PartySocket). query as fn: re-read on every (re)connect
-                    // so a login/logout between reconnects is picked up.
-                    const ws = new PartySocket({
-                        host: config.dispatcherWsUrl,
-                        party: actorName,
-                        room: instanceId,
-                        id: connId,
-                        ...(config.webSocketImpl ? { WebSocket: config.webSocketImpl } : {}),
-                        query: () => {
-                            const token = config.getAuthToken();
-                            return {
-                                app_id: config.appId,
-                                handler: actorName,
-                                ...(token ? { token } : {}),
-                                ...(config.functionsVersion ? { fv: config.functionsVersion } : {}),
-                            };
-                        },
-                    });
-                    activeSockets.set(key, ws);
-                    // Heartbeat / half-open detection. PartySocket only reconnects on a
-                    // browser close/error event, so a silently-dead connection (TCP alive,
-                    // no data — common behind proxies/LBs) hangs until the OS idle timeout
-                    // (~60s). We ping periodically and force a reconnect if nothing comes
-                    // back within DEAD_MS, cutting detection from ~60s to a few seconds.
-                    const PING_MS = 1000;
-                    const DEAD_MS = 3000;
-                    let lastMsg = Date.now();
-                    const bumpAlive = () => { lastMsg = Date.now(); };
-                    ws.addEventListener("open", bumpAlive);
-                    ws.addEventListener("message", (ev) => {
-                        bumpAlive();
-                        let data;
-                        try {
-                            data = JSON.parse(ev.data);
-                        }
-                        catch (_a) {
-                            return; // ignore malformed
-                        }
-                        // Swallow platform messages — never surface them to the app.
-                        const msgType = data && typeof data === "object" ? data.type : undefined;
-                        if (msgType === "__pong")
-                            return;
-                        callback(data);
-                    });
-                    const heartbeat = setInterval(() => {
-                        if (Date.now() - lastMsg > DEAD_MS) {
-                            bumpAlive(); // avoid a reconnect storm while the new socket comes up
-                            ws.reconnect();
-                            return;
-                        }
-                        try {
-                            ws.send(JSON.stringify({ type: "__ping" }));
-                        }
-                        catch (_a) {
-                            // socket not open; the watchdog above will force a reconnect
-                        }
-                    }, PING_MS);
-                    return {
-                        id: connId, // the connection id (same value the actor sees as conn.id)
-                        unsubscribe() {
-                            clearInterval(heartbeat);
-                            activeSockets.delete(key);
-                            ws.close();
-                        },
-                    };
-                },
-                send(instanceId, data) {
-                    const key = socketKey(actorName, instanceId);
-                    const ws = activeSockets.get(key);
-                    if (!ws)
-                        throw new Error(`No active subscription for ${actorName}:${instanceId}`);
-                    ws.send(JSON.stringify(data));
-                },
+    // Live rooms this client opened, so client.cleanup() can reclaim any the app
+    // forgot to close() (each room removes itself here on close).
+    const rooms = new Set();
+    const module = new Proxy({}, {
+        get(_, key) {
+            // Symbols and `then` resolve to undefined (so the module isn't mistaken
+            // for a thenable when awaited); any string key is an actor name.
+            if (typeof key !== "string" || key === "then")
+                return undefined;
+            return (instanceId) => {
+                const room = new Room(key, instanceId, config, () => rooms.delete(room));
+                rooms.add(room);
+                return room;
             };
         },
     });
+    return {
+        module,
+        closeAll: () => {
+            for (const room of [...rooms])
+                room.close();
+        },
+    };
 }

package/dist/modules/actors.types.d.ts

@@ -32,43 +32,55 @@ type ToClientFor<N extends string> = N extends keyof ActorRegistry ? ActorRegist
 type ToServerFor<N extends string> = N extends keyof ActorRegistry ? ActorRegistry[N] extends {
     toServer: infer O;
 } ? O : unknown : unknown;
-/**
- * Client for a single named Actor.
- * Typed automatically when the actor is registered in {@link ActorRegistry}.
- */
-export interface ActorClient<N extends string = string> {
+/** Options for {@link ActorRoom.connect}. */
+export interface ActorConnectOptions {
     /**
-     * Open a WebSocket subscription. Returns a {@link ActorSubscription} with the
-     * connection `id` (same value the actor sees as `conn.id`) and an `unsubscribe()` method.
-     *
-     * Pass `options.id` to control the connection id (e.g. a stable per-tab id so a
-     * reconnect reuses the same server-side connection); omit it for an auto-generated
-     * per-connection id.
+     * The connection id — becomes the actor's `conn.id`. Supply a stable value
+     * (e.g. persisted per tab) so a reconnect reuses the same server-side
+     * identity; omit for an auto-generated per-connection id.
      */
-    subscribe(instanceId: string, callback: (data: ToClientFor<N>) => void, options?: {
-        id?: string;
-    }): ActorSubscription;
-    /** Send a message over the open socket. Throws if not subscribed. */
-    send(instanceId: string, data: ToServerFor<N>): void;
+    id?: string;
 }
-/** Handle for an active actor subscription. */
+/** Handle for one listener registered via {@link ActorRoom.subscribe}. */
 export interface ActorSubscription {
-    /** This connection's id — the same value the actor receives as `conn.id`. */
-    id: string;
-    /** Close the subscription and its underlying socket. */
+    /** Remove this listener; other listeners and the socket stay live. */
     unsubscribe(): void;
 }
+/**
+ * A single actor room. Obtained from {@link ActorClient} (`actors.MyActor(id)`)
+ * and made live with {@link connect}. The handle IS the connection: one socket,
+ * any number of {@link subscribe} listeners.
+ */
+export interface ActorRoom<N extends string = string> {
+    /** The connection id (the value the actor sees as `conn.id`). Throws before {@link connect}. */
+    readonly id: string;
+    /** Open the WebSocket (required before subscribe/send). Idempotent; returns this. */
+    connect(options?: ActorConnectOptions): this;
+    /** Register a message listener. Multiple are allowed; returns a per-listener unsubscribe. */
+    subscribe(callback: (data: ToClientFor<N>) => void): ActorSubscription;
+    /** Send a message. Throws before {@link connect}; buffered by the socket once connecting. */
+    send(data: ToServerFor<N>): void;
+    /** Tear down the socket, heartbeat, and all listeners. */
+    close(): void;
+}
+/**
+ * Client for a single named Actor — call it with a room id to get an
+ * {@link ActorRoom}. Typed automatically when the actor is registered in
+ * {@link ActorRegistry}.
+ */
+export interface ActorClient<N extends string = string> {
+    (instanceId: string): ActorRoom<N>;
+}
 /**
  * The actors module provides access to Cloudflare Durable Object-backed
  * Actors deployed by the Base44 platform.
  *
- * Actor names are accessed as dynamic properties on this module:
  * ```typescript
- * const sub = await base44.actors.MyActor.subscribe("room-1", (msg) => {
- *   console.log(msg); // typed if MyActor is in ActorRegistry
- * });
- * const { id, unsubscribe } = sub;
- * unsubscribe();
+ * const room = base44.actors.MyActor("room-1").connect();
+ * const sub = room.subscribe((msg) => console.log(msg)); // typed via ActorRegistry
+ * room.send({ type: "message", text: "hi" });
+ * sub.unsubscribe();
+ * room.close();
  * ```
  */
 export type ActorsModule = {

package/dist/modules/ai-gateway.types.d.ts

@@ -1,13 +1,13 @@
 /**
- * A connection to the Base44 AI Gateway.
- *
- * Contains the base URL and bearer token to use with any OpenAI-compatible
- * client pointed at the Base44 AI Gateway.
+ * Connection details for the Base44 AI Gateway.
  */
 export interface AiGatewayConnection {
-    /** Base URL of the gateway's OpenAI-compatible endpoint. */
+    /** Base URL of the gateway's OpenAI-compatible Chat Completions endpoint. */
     baseURL: string;
-    /** Bearer token used to authenticate requests to the gateway. */
+    /**
+     * Bearer token that authenticates the request. Empty string when the caller is
+     * unauthenticated.
+     */
     token: string;
 }
 /**
@@ -25,13 +25,45 @@ export interface AiGatewayModuleConfig {
 /**
  * AI Gateway module for calling Base44's managed AI models from your own code.
  *
- * The gateway exposes an OpenAI-compatible Chat Completions endpoint, so any
- * OpenAI-compatible SDK works against it:
- * - Build custom AI agents or call models directly from your backend code
- * - Uses your app's models, billing, and credit quota, no API key to manage
+ * `connection()` hands you a `baseURL` and `token` that authenticate as your
+ * Base44 app. An OpenAI-compatible client is any library, such as the `openai`
+ * SDK or the Vercel AI SDK, that has the same request and response format
+ * as OpenAI's Chat Completions API and lets you point it at a custom `baseURL`
+ * instead of OpenAI's own servers. Pass `connection()`'s values to one of
+ * these clients and it works against Base44's gateway exactly as it would
+ * against the provider directly, no separate account, API key, or billing
+ * setup with the underlying model provider required.
+ *
+ * Call `connection()` from a backend function rather than the browser. This
+ * keeps your instructions, tools, and business logic server-side, and lets
+ * you enforce your own auth, rate, and spend limits around the call. The
+ * `token` it returns is the caller's regular session token, the same one
+ * used for every other SDK call.
+ *
+ * ## Models
+ *
+ * You can use any of the [models available through `InvokeLLM`](/developers/references/sdk/docs/type-aliases/integrations#invokellm).
+ * Pass `'automatic'` to let Base44 choose one, or pin a specific model such
+ * as `'claude_sonnet_4_6'`, `'gpt_5_5'`, or `'gemini_3_1_pro'`.
+ *
+ * ## Authentication Modes
+ *
+ * There's no permission difference between modes. Both just determine which
+ * token `connection()` returns:
+ *
+ * - **User authentication** (`base44.aiGateway`): Returns the signed-in app user's token.
+ * - **Service role authentication** (`base44.asServiceRole.aiGateway`): Returns the service-role token instead, for calling the gateway when there's no signed-in user, such as from a scheduled automation.
+ *
+ * ## Billing and limits
+ *
+ * Requests are billed to your app's credit quota, which is the same shared
+ * quota your app's built-in AI features use, and isn't split per user. If the
+ * app runs out of credits, the gateway stops working for every user of the
+ * app until the quota resets. A request is rejected before the model runs if
+ * the app is out of credits. If you need to cap usage per user, build that
+ * check yourself, for example by tracking calls per user in your own entity.
  *
- * Available in user authentication mode (`base44.aiGateway`) and with the
- * service-role token via `base44.asServiceRole.aiGateway`.
+ * Streaming responses aren't supported yet, so leave `stream` unset on your requests.
  */
 export interface AiGatewayModule {
     /**
@@ -39,19 +71,38 @@ export interface AiGatewayModule {
      *
      * Returns the `baseURL` and `token` to pass to any OpenAI-compatible client.
      *
-     * The `token` is the current caller's bearer token: the app user's token for
-     * `base44.aiGateway`, or the service-role token for `base44.asServiceRole.aiGateway`.
-     * When the caller is unauthenticated, `token` is an empty string.
-     *
      * @returns The gateway {@linkcode AiGatewayConnection | connection} (`baseURL` and `token`).
      *
      * @example
      * ```typescript
+     * // Call a model directly
+     * import { createClientFromRequest } from "@base44/sdk";
+     * import OpenAI from "openai";
+     *
+     * // Runs inside a backend function
+     * const base44 = createClientFromRequest(request);
+     * const { baseURL, token } = base44.aiGateway.connection();
+     * const openai = new OpenAI({ baseURL, apiKey: token });
+     *
+     * const response = await openai.chat.completions.create({
+     *   model: "automatic",
+     *   messages: [{ role: "user", content: "Summarize this week's top support tickets." }],
+     * });
+     *
+     * console.log(response.choices[0].message.content);
+     * ```
+     *
+     * @example
+     * ```typescript
+     * // Use a tool-calling agent
+     * import { createClientFromRequest } from "@base44/sdk";
      * import { ToolLoopAgent, tool, stepCountIs, hasToolCall } from "ai";
      * import { createOpenAICompatible } from "@ai-sdk/openai-compatible";
      * import { z } from "zod";
      *
-     * const request = await base44.entities.ReturnRequest.get(returnId);
+     * // Runs inside a backend function, reviewing a return request
+     * const base44 = createClientFromRequest(request);
+     * const returnRequest = await base44.entities.ReturnRequest.get(returnId);
      * const { baseURL, token } = base44.aiGateway.connection();
      * // Point any OpenAI-compatible client at `baseURL` with `apiKey: token`.
      * const models = createOpenAICompatible({ name: "base44", baseURL, apiKey: token });
@@ -66,7 +117,7 @@ export interface AiGatewayModule {
      *       description: "This customer's past orders, optionally filtered by status",
      *       inputSchema: z.object({ status: z.string().optional() }),
      *       execute: ({ status }) => {
-     *         const query = { customer_email: request.customer_email };
+     *         const query = { customer_email: returnRequest.customer_email };
      *         if (status) query.status = status;
      *         return base44.entities.Order.filter(query, "-created_date", 50);
      *       },
@@ -81,7 +132,7 @@ export interface AiGatewayModule {
      *   stopWhen: [stepCountIs(8), hasToolCall("submitVerdict")],
      * });
      *
-     * await agent.generate({ prompt: `Review this return request: ${JSON.stringify(request)}` });
+     * await agent.generate({ prompt: `Review this return request: ${JSON.stringify(returnRequest)}` });
      * ```
      */
     connection(): AiGatewayConnection;

package/dist/modules/sso.types.d.ts

@@ -1,6 +1,5 @@
 /**
  * Response from SSO access token endpoint.
- * @internal
  */
 export interface SsoAccessTokenResponse {
     access_token: string;
@@ -13,46 +12,53 @@ export interface SsoAccessTokenResponse {
  * services.
  *
  * This module is only available to use with a client in service role authentication mode, which means it can only be used in backend environments.
- *
- * @internal
- *
- * @example
- * ```typescript
- * // Access SSO module with service role
- * const response = await base44.asServiceRole.sso.getAccessToken('user_123');
- * console.log(response.data.access_token);
- * ```
  */
 export interface SsoModule {
     /**
-     * Gets SSO access token for a specific user.
+     * Gets an SSO access token for the user who made the current request.
      *
-     * Retrieves a Single Sign-On access token that can be used to authenticate
-     * a user with external services or systems.
+     * Use this token to authenticate the user with external systems or services.
+     * This only works for that same user. Create the client with
+     * {@link createClientFromRequest} so it acts on behalf of the request's user,
+     * then pass that user's ID as `userid`. If `userid` is any other user, the
+     * call fails. An expired token is refreshed automatically when a refresh token
+     * is available.
      *
-     * @param userid - The user ID to get the access token for.
+     * @param userid - The ID of the user who made the current request, such as the
+     * `id` returned by {@link AuthModule | base44.auth.me()}.
      * @returns Promise resolving to the SSO access token response.
      *
      * @example
      * ```typescript
-     * // Get SSO access token for a user
-     * const response = await base44.asServiceRole.sso.getAccessToken('user_123');
-     * console.log(response.access_token);
+     * // Get the user's SSO access token to call an external system
+     * import { createClientFromRequest } from 'npm:@base44/sdk';
+     *
+     * Deno.serve(async (req) => {
+     *   const base44 = createClientFromRequest(req);
+     *   const user = await base44.auth.me();
+     *   const { access_token } = await base44.asServiceRole.sso.getAccessToken(user.id);
+     *
+     *   return Response.json({ access_token });
+     * });
      * ```
      */
     getAccessToken(userid: string): Promise<SsoAccessTokenResponse>;
     /**
-     * Gets the stored SSO OIDC ID token for the current app user.
+     * Gets the stored SSO OIDC ID token for the user who made the current request.
      *
-     * The service-role client must include an on-behalf-of token for the same
-     * user specified by `userid`. This method returns the stored token as-is and
-     * does not refresh it.
+     * This only works for that same user, not for arbitrary users. Create the
+     * client with {@link createClientFromRequest} so it acts on behalf of the
+     * request's user, then pass that user's ID as `userid`. If `userid` is any
+     * other user, the call fails. The stored token is returned as-is and is never
+     * refreshed, so the call fails if the token has already expired.
      *
-     * @param userid - The current app user's ID.
+     * @param userid - The ID of the user who made the current request, such as the
+     * `id` returned by {@link AuthModule | base44.auth.me()}.
      * @returns Promise resolving to the raw ID-token string.
      *
      * @example
      * ```typescript
+     * // Get the user's ID token to read identity claims such as email
      * import { createClientFromRequest } from 'npm:@base44/sdk';
      *
      * Deno.serve(async (req) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@base44-preview/sdk",
-  "version": "0.8.40-pr.212.c163c94",
+  "version": "0.8.40-pr.212.f89ce7f",
   "description": "JavaScript SDK for Base44 API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",