@base44-preview/sdk 0.8.44-pr.270.91862eb → 0.8.46-pr.272.2f95f82

package/dist/actor.d.ts

@@ -6,12 +6,12 @@
  *   export class MyActor extends Actor { ... }
  *
  * At deploy time the bundler replaces this import with the compiled
- * Cloudflare Durable Object implementation — this file provides types only.
+ * Cloudflare Durable Object implementation. This file provides types only.
  */
 import type { Base44Client } from "./client";
 /**
  * A single client connection. `Send` is the message type this connection accepts
- * via {@link send} — the actor's *outgoing* (server→client) messages.
+ * via {@link send}, the actor's *outgoing* (server→client) messages.
  */
 export interface Conn<Send = unknown> {
     /** Unique per-connection id (one per socket/tab), the same value the client
@@ -33,9 +33,9 @@ export interface Storage {
  * Base class for an Actor.
  *
  * @typeParam Incoming - messages this actor *receives* from clients
- *   (`handleMessage`'s `msg`) — the schema's `toServer` section.
+ *   (`handleMessage`'s `msg`), the schema's `toServer` section.
  * @typeParam Outgoing - messages this actor *sends* to clients
- *   (`conn.send`/`broadcast`) — the schema's `toClient` section.
+ *   (`conn.send`/`broadcast`), the schema's `toClient` section.
  *
  * With a generated `schema.jsonc`, wire both from the registry so they can't drift
  * from the client's types:
@@ -51,7 +51,7 @@ export declare abstract class Actor<Incoming = unknown, Outgoing = unknown> {
     abstract handleTick(): void | Promise<void>;
     /**
      * Optional wake hook: runs once when the instance starts, before any
-     * connection is handled — safe to load persisted state here.
+     * connection is handled. Safe to load persisted state here.
      */
     handleStart(): void | Promise<void>;
     /**
@@ -71,7 +71,7 @@ export declare abstract class Actor<Incoming = unknown, Outgoing = unknown> {
     /**
      * Managed ticker (opt-in). Override {@link shouldTick} and the platform runs
      * {@link handleTick} on a timer of {@link tickIntervalMs} while it returns true,
-     * and stops (letting the Durable Object hibernate — no compute cost) when it
+     * and stops (letting the Durable Object hibernate at no compute cost) when it
      * returns false. The platform owns scheduling, rescheduling, self-heal, and
      * error-safety.
      *
@@ -85,7 +85,7 @@ export declare abstract class Actor<Incoming = unknown, Outgoing = unknown> {
     protected get instanceId(): string;
     protected get storage(): Storage;
     /**
-     * Anonymous Base44 client scoped to this actor instance — no user or service
+     * Anonymous Base44 client scoped to this actor instance, with no user or service
      * auth, so entity access is RLS-gated (same as a logged-out visitor). Always
      * operates on production data: an actor runs server-side with no per-connection
      * identity, so a Test DB preview selected in the editor does not apply here.

package/dist/actor.js

@@ -6,15 +6,15 @@
  *   export class MyActor extends Actor { ... }
  *
  * At deploy time the bundler replaces this import with the compiled
- * Cloudflare Durable Object implementation — this file provides types only.
+ * Cloudflare Durable Object implementation. This file provides types only.
  */
 /**
  * Base class for an Actor.
  *
  * @typeParam Incoming - messages this actor *receives* from clients
- *   (`handleMessage`'s `msg`) — the schema's `toServer` section.
+ *   (`handleMessage`'s `msg`), the schema's `toServer` section.
  * @typeParam Outgoing - messages this actor *sends* to clients
- *   (`conn.send`/`broadcast`) — the schema's `toClient` section.
+ *   (`conn.send`/`broadcast`), the schema's `toClient` section.
  *
  * With a generated `schema.jsonc`, wire both from the registry so they can't drift
  * from the client's types:
@@ -28,7 +28,7 @@ export class Actor {
         /**
          * Managed ticker (opt-in). Override {@link shouldTick} and the platform runs
          * {@link handleTick} on a timer of {@link tickIntervalMs} while it returns true,
-         * and stops (letting the Durable Object hibernate — no compute cost) when it
+         * and stops (letting the Durable Object hibernate at no compute cost) when it
          * returns false. The platform owns scheduling, rescheduling, self-heal, and
          * error-safety.
          *
@@ -39,7 +39,7 @@ export class Actor {
     }
     /**
      * Optional wake hook: runs once when the instance starts, before any
-     * connection is handled — safe to load persisted state here.
+     * connection is handled. Safe to load persisted state here.
      */
     handleStart() { }
     /**
@@ -73,7 +73,7 @@ export class Actor {
         throw new Error("Actor.storage is only available inside a deployed actor");
     }
     /**
-     * Anonymous Base44 client scoped to this actor instance — no user or service
+     * Anonymous Base44 client scoped to this actor instance, with no user or service
      * auth, so entity access is RLS-gated (same as a logged-out visitor). Always
      * operates on production data: an actor runs server-side with no per-connection
      * identity, so a Test DB preview selected in the editor does not apply here.

package/dist/client.d.ts

@@ -1,5 +1,5 @@
-import type { Base44Client, CreateClientConfig, CreateClientOptions } from "./client.types.js";
-export type { Base44Client, CreateClientConfig, CreateClientOptions };
+import type { Base44Client, CreateClientAnalyticsConfig, CreateClientConfig, CreateClientOptions } from "./client.types.js";
+export type { Base44Client, CreateClientAnalyticsConfig, CreateClientConfig, CreateClientOptions, };
 /**
  * Creates a Base44 client.
  *

package/dist/client.js

@@ -9,6 +9,7 @@ import { createFunctionsModule } from "./modules/functions.js";
 import { createAgentsModule } from "./modules/agents.js";
 import { createAiGatewayModule } from "./modules/ai-gateway.js";
 import { createAppLogsModule } from "./modules/app-logs.js";
+import { createAppModule } from "./modules/app.js";
 import { createUsersModule } from "./modules/users.js";
 import { RoomsSocket } from "./utils/socket-utils.js";
 import { createAnalyticsModule } from "./modules/analytics.js";
@@ -51,8 +52,8 @@ import { createActorsModule, resolveActorsHost, } from "./modules/actors.js";
  * ```
  */
 export function createClient(config) {
-    var _a, _b, _c;
-    const { serverUrl = "https://base44.app", appId, token, serviceToken, requiresAuth = false, appBaseUrl, options, analytics: analyticsOptions, functionsVersion, headers: optionalHeaders, } = config;
+    var _a, _b, _c, _d;
+    const { serverUrl = "https://base44.app", appId, analytics, token, serviceToken, requiresAuth = false, appBaseUrl, options, functionsVersion, headers: optionalHeaders, } = config;
     // Normalize appBaseUrl to always be a string (empty if not provided or invalid)
     const normalizedAppBaseUrl = typeof appBaseUrl === "string" ? appBaseUrl : "";
     const socketConfig = {
@@ -112,7 +113,7 @@ export function createClient(config) {
     });
     // Dedicated client for actor connection-token mints: no onError (a legacy
     // actor answers every mint with an expected 409 before the proxy fallback,
-    // which must not reach the app's error handler — the actors module forwards
+    // which must not reach the app's error handler. The actors module forwards
     // genuine failures itself via onMintError) and no constructor token
     // (auth is per-request so a login/logout is picked up on every reconnect).
     const actorsAxiosClient = createAxiosClient({
@@ -187,13 +188,14 @@ export function createClient(config) {
         }),
         aiGateway: createAiGatewayModule({ serverUrl, token, appId }),
         appLogs: createAppLogsModule(axiosClient, appId),
+        app: createAppModule(axiosClient, appId),
         users: createUsersModule(axiosClient, appId),
         analytics: createAnalyticsModule({
             axiosClient,
             serverUrl,
             appId,
             userAuthModule,
-            options: analyticsOptions,
+            enabled: (_c = analytics === null || analytics === void 0 ? void 0 : analytics.enabled) !== null && _c !== void 0 ? _c : true,
         }),
         actors: actorsModule.module,
         cleanup: () => {
@@ -222,7 +224,7 @@ export function createClient(config) {
                 }
                 return headers;
             },
-            baseURL: (_c = serviceRoleFunctionsAxiosClient.defaults) === null || _c === void 0 ? void 0 : _c.baseURL,
+            baseURL: (_d = serviceRoleFunctionsAxiosClient.defaults) === null || _d === void 0 ? void 0 : _d.baseURL,
         }),
         agents: createAgentsModule({
             axios: serviceRoleAxiosClient,

package/dist/client.types.d.ts

@@ -7,7 +7,8 @@ import type { FunctionsModule } from "./modules/functions.types.js";
 import type { AgentsModule } from "./modules/agents.types.js";
 import type { AiGatewayModule } from "./modules/ai-gateway.types.js";
 import type { AppLogsModule } from "./modules/app-logs.types.js";
-import type { AnalyticsModule, CreateClientAnalyticsOptions } from "./modules/analytics.types.js";
+import type { AppModule } from "./modules/app.types.js";
+import type { AnalyticsModule } from "./modules/analytics.types.js";
 import type { ActorsModule } from "./modules/actors.types.js";
 /**
  * Options for creating a Base44 client.
@@ -17,19 +18,34 @@ export interface CreateClientOptions {
      * Optional error handler that will be called whenever an API error occurs.
      *
      * Also receives {@link ActorsModule | actors} connection failures. Errors
-     * are usually {@linkcode Base44Error} instances — check `error.status`.
+     * are usually {@linkcode Base44Error} instances, so check `error.status`.
      */
     onError?: (error: Error) => void;
     /**
      * Forces the actors transport. `"auto"` (default) connects directly to the
      * actor and falls back to the platform proxy when the app's actors don't
      * support direct connections; `"proxy"` always uses the platform proxy
-     * (ops rollback — no connection-token calls); `"direct"` disables the
+     * (ops rollback, with no connection-token calls); `"direct"` disables the
      * fallback (validation environments).
      * @internal
      */
     actorsTransport?: "auto" | "proxy" | "direct";
 }
+/**
+ * Configuration for the SDK's app analytics module.
+ */
+export interface CreateClientAnalyticsConfig {
+    /**
+     * Whether app analytics is enabled for this client.
+     *
+     * When disabled, automatic analytics and calls to `analytics.track()` are
+     * no-ops. The SDK does not create an analytics session identifier, start
+     * heartbeat timers, or send analytics requests.
+     *
+     * @defaultValue `true`
+     */
+    enabled: boolean;
+}
 /**
  * Configuration for creating a Base44 client.
  */
@@ -56,6 +72,12 @@ export interface CreateClientConfig {
      * It's the string between `/apps/` and `/editor/`.
      */
     appId: string;
+    /**
+     * Controls app analytics for this client.
+     *
+     * Omit this option to preserve the default analytics behavior.
+     */
+    analytics?: CreateClientAnalyticsConfig;
     /**
      * User authentication token. Used to authenticate as a specific user.
      *
@@ -82,22 +104,6 @@ export interface CreateClientConfig {
      * @internal
      */
     headers?: Record<string, string>;
-    /**
-     * Analytics configuration for this client.
-     *
-     * By default, analytics is enabled and starts as soon as the client is created: a persistent visitor ID is stored in `localStorage` and automatic events are sent.
-     *
-     * Set `consent: "pending"` to keep analytics dormant until the visitor makes a consent decision, then call {@linkcode AnalyticsModule.optIn | analytics.optIn()} or {@linkcode AnalyticsModule.optOut | analytics.optOut()}. Set `enabled: false` to turn the analytics module off entirely.
-     *
-     * @example
-     * ```typescript
-     * const base44 = createClient({
-     *   appId: 'my-app-id',
-     *   analytics: { consent: 'pending' }
-     * });
-     * ```
-     */
-    analytics?: CreateClientAnalyticsOptions;
     /**
      * Additional client options.
      */
@@ -117,6 +123,8 @@ export interface Base44Client {
     analytics: AnalyticsModule;
     /** {@link AppLogsModule | App logs module} for tracking app usage. */
     appLogs: AppLogsModule;
+    /** {@link AppModule | App module} for reading the app's own public configuration. */
+    app: AppModule;
     /** {@link ActorsModule | Actors module} for subscribing to and sending messages via Cloudflare Durable Object-backed Actors. */
     actors: ActorsModule;
     /** {@link AuthModule | Auth module} for user authentication and management. */

package/dist/index.d.ts

@@ -1,8 +1,8 @@
-import { createClient, createClientFromRequest, type Base44Client, type CreateClientConfig, type CreateClientOptions } from "./client.js";
+import { createClient, createClientFromRequest, type Base44Client, type CreateClientAnalyticsConfig, type CreateClientConfig, type CreateClientOptions } from "./client.js";
 import { Base44Error, type Base44ErrorJSON } from "./utils/axios-client.js";
 import { getAccessToken, saveAccessToken, removeAccessToken, getLoginUrl } from "./utils/auth-utils.js";
 export { createClient, createClientFromRequest, Base44Error, getAccessToken, saveAccessToken, removeAccessToken, getLoginUrl, };
-export type { Base44Client, CreateClientConfig, CreateClientOptions, Base44ErrorJSON, };
+export type { Base44Client, CreateClientAnalyticsConfig, CreateClientConfig, CreateClientOptions, Base44ErrorJSON, };
 export * from "./types.js";
 export type { DeleteManyResult, DeleteResult, EntitiesModule, EntityFilterOperators, EntityFilterQuery, EntityFilterValue, EntityHandler, EntityRecord, EntityTypeRegistry, ImportResult, RealtimeEventType, RealtimeEvent, RealtimeCallback, SortField, UpdateManyResult, } from "./modules/entities.types.js";
 export type { AuthModule, LoginResponse, RegisterParams, VerifyOtpParams, ChangePasswordParams, ResetPasswordParams, User, } from "./modules/auth.types.js";
@@ -11,6 +11,7 @@ export type { FunctionsModule, FunctionName, FunctionNameRegistry, } from "./mod
 export type { AgentsModule, AgentName, AgentNameRegistry, AgentConversation, AgentMessage, AgentMessageReasoning, AgentMessageToolCall, AgentMessageUsage, AgentMessageCustomContext, AgentMessageMetadata, CreateConversationParams, } from "./modules/agents.types.js";
 export type { AiGatewayModule, AiGatewayConnection, } from "./modules/ai-gateway.types.js";
 export type { AppLogsModule } from "./modules/app-logs.types.js";
+export type { AppModule, AppPublicSettings, AppPublicSettingsResponse, } from "./modules/app.types.js";
 export type { ActorsModule, ActorClient, ActorRef, Connection, ActorSubscription, ActorConnectOptions, ActorNameRegistry, ActorRegistry, } from "./modules/actors.types.js";
 export type { SsoModule, SsoAccessTokenResponse } from "./modules/sso.types.js";
 export { Actor, type Conn } from "./actor.js";

package/dist/modules/actors.d.ts

@@ -35,7 +35,7 @@ interface ActorsConfig {
  * The legacy platform-proxy URL, byte-for-byte what PartySocket built before
  * the direct path existed: same scheme swap (including its localhost-needs-a-
  * port quirk), case-preserved party segment, `_pk` first in the query. The
- * `handler` param is load-bearing — the proxy reads it for the actor name.
+ * `handler` param is load-bearing, because the proxy reads it for the actor name.
  */
 export declare function buildProxyActorUrl(rawHost: string, actorName: string, instanceId: string, connectionId: string, appId: string, token: string | null | undefined, functionsVersion?: string): string;
 /**

package/dist/modules/actors.js

@@ -8,12 +8,12 @@ const DEAD_MS = 3000;
 // 422 = no principal (e.g. anonymous outside a browser) or an id/room only the
 // proxy's looser validation accepts, 405 = a backend that predates the mint
 // endpoint (its actor deploy routes catch the path via `{handler_name:path}`
-// but not the POST method — and the real endpoint never 405s a POST). The
+// but not the POST method, and the real endpoint never 405s a POST). The
 // proxy serves migrated actors too, so falling back is always safe.
 const PROXY_FALLBACK_STATUSES = new Set([405, 409, 422, 503]);
 // Mint responses no retry can fix (bad request / forbidden / not found): the
 // connection closes instead of re-minting forever; a fresh connect() re-probes.
-// 401 is deliberately absent — the auth token is re-read on every attempt, so a
+// 401 is deliberately absent. The auth token is re-read on every attempt, so a
 // login recovers on the next retry. Disjoint from PROXY_FALLBACK_STATUSES.
 const TERMINAL_MINT_STATUSES = new Set([400, 403, 404]);
 /** The mint's rejection can be anything; a `Base44Error` carries a numeric
@@ -29,7 +29,7 @@ function toError(err) {
 }
 /**
  * A live connection to an actor instance. Only obtainable from
- * {@link ActorRef.connect}, so `subscribe`/`send` are always valid — the socket
+ * {@link ActorRef.connect}, so `subscribe`/`send` are always valid. The socket
  * exists for this object's whole lifetime.
  */
 class Connection {
@@ -44,7 +44,7 @@ class Connection {
         // mint answers with a fallback status the choice is sticky for this
         // socket's lifetime (a fresh connect() after close() probes direct again,
         // picking up actors migrated in the meantime). Any other mint failure
-        // rejects, which ReconnectingWebSocket retries with backoff — except the
+        // rejects, which ReconnectingWebSocket retries with backoff, except the
         // terminal statuses, which close this connection for good.
         let useProxy = config.transport === "proxy";
         const urlProvider = async () => {
@@ -172,7 +172,7 @@ function makeActorRef(actorName, instanceId, config, connections) {
  * The legacy platform-proxy URL, byte-for-byte what PartySocket built before
  * the direct path existed: same scheme swap (including its localhost-needs-a-
  * port quirk), case-preserved party segment, `_pk` first in the query. The
- * `handler` param is load-bearing — the proxy reads it for the actor name.
+ * `handler` param is load-bearing, because the proxy reads it for the actor name.
  */
 export function buildProxyActorUrl(rawHost, actorName, instanceId, connectionId, appId, token, functionsVersion) {
     let host = rawHost.replace(/^(http|https|ws|wss):\/\//, "");

package/dist/modules/actors.types.d.ts

@@ -21,7 +21,7 @@ export interface ActorRegistry {
 }
 /**
  * Auto-populated by `base44 types generate` with the names of your deployed actors.
- * Do not edit this interface manually — use {@link ActorRegistry} for message types.
+ * Do not edit this interface manually. Use {@link ActorRegistry} for message types.
  */
 export interface ActorNameRegistry {
 }
@@ -35,7 +35,7 @@ type ToServerFor<N extends string> = N extends keyof ActorRegistry ? ActorRegist
 /** Options for {@link ActorRef.connect}. */
 export interface ActorConnectOptions {
     /**
-     * The connection id — becomes the actor's `conn.id`. Supply a stable value
+     * The connection id, which becomes the actor's `conn.id`. Supply a stable value
      * (e.g. persisted per tab) so a reconnect reuses the same server-side
      * identity; omit for an auto-generated per-connection id.
      */
@@ -48,7 +48,7 @@ export interface ActorSubscription {
 }
 /**
  * A live connection to an actor instance, returned by {@link ActorRef.connect}.
- * `subscribe`/`send` are always valid — you only get a `Connection` once the
+ * `subscribe`/`send` are always valid. You only get a `Connection` once the
  * socket has been opened, so there's no pre-connect state to guard against.
  */
 export interface Connection<N extends string = string> {
@@ -61,13 +61,13 @@ export interface Connection<N extends string = string> {
     send(data: ToServerFor<N>): void;
     /**
      * Tear down the socket, heartbeat, and all listeners. Safe to call more
-     * than once. A connection also closes itself when it fails permanently —
+     * than once. A connection also closes itself when it fails permanently.
      * see {@link ActorRef.connect}.
      */
     close(): void;
 }
 /**
- * A handle to one actor instance — `base44.actors.MyActor(id)`. Call
+ * A handle to one actor instance, obtained from `base44.actors.MyActor(id)`. Call
  * {@link connect} to open the socket and get a {@link Connection}.
  */
 export interface ActorRef<N extends string = string> {
@@ -83,7 +83,7 @@ export interface ActorRef<N extends string = string> {
     connect(options?: ActorConnectOptions): Connection<N>;
 }
 /**
- * Client for a single named Actor — call it with an instance id to get an
+ * Client for a single named Actor. Call it with an instance id to get an
  * {@link ActorRef}. Typed automatically when the actor is registered in
  * {@link ActorRegistry}.
  */

package/dist/modules/analytics.d.ts

@@ -1,5 +1,5 @@
 import { AxiosInstance } from "axios";
-import { TrackEventParams, AnalyticsModuleOptions, AnalyticsConsentStatus, CreateClientAnalyticsOptions } from "./analytics.types";
+import { TrackEventParams, AnalyticsModuleOptions } from "./analytics.types";
 import type { InternalAuthModule } from "./auth.types";
 export declare const USER_HEARTBEAT_EVENT_NAME = "__user_heartbeat_event__";
 export declare const ANALYTICS_INITIALIZATION_EVENT_NAME = "__initialization_event__";
@@ -11,20 +11,10 @@ export interface AnalyticsModuleArgs {
     serverUrl: string;
     appId: string;
     userAuthModule: InternalAuthModule;
-    options?: CreateClientAnalyticsOptions;
+    enabled: boolean;
 }
-/**
- * The effective analytics consent status. `"granted"` when no client set one
- * explicitly, preserving the legacy always-on behavior.
- *
- * @internal
- */
-export declare function getAnalyticsConsentStatus(): AnalyticsConsentStatus;
-export declare const createAnalyticsModule: ({ axiosClient, serverUrl, appId, userAuthModule, options, }: AnalyticsModuleArgs) => {
+export declare const createAnalyticsModule: ({ axiosClient, serverUrl, appId, userAuthModule, enabled, }: AnalyticsModuleArgs) => {
     track: (params: TrackEventParams) => void;
-    optIn: () => void;
-    optOut: () => void;
-    getConsentStatus: typeof getAnalyticsConsentStatus;
     cleanup: () => void;
 };
 /**

package/dist/modules/analytics.js

@@ -25,84 +25,25 @@ const analyticsSharedState = getSharedInstance(ANALYTICS_SHARED_STATE_NAME, () =
     wasInitializationTracked: false,
     sessionContext: null,
     sessionStartTime: null,
-    // Memoized session id for when `localStorage` can't persist one — see
+    // Memoized session id for when `localStorage` can't persist one. See
     // getAnalyticsSessionId.
     fallbackSessionId: null,
-    // Consent status shared by every client on the page. `null` means no
-    // client set one explicitly, which keeps the legacy behavior (granted).
-    consent: null,
     config: {
         ...defaultConfiguration,
         ...getAnalyticsConfigFromUrlParams(),
     },
 }));
-// Lower ranks are more restrictive. Used to merge the consent status of
-// multiple clients created on the same page: the shared state (and therefore
-// the shared persistent id) can only honor one status, so the most
-// restrictive explicitly-configured one wins.
-const CONSENT_RESTRICTIVENESS = {
-    denied: 0,
-    pending: 1,
-    granted: 2,
-};
-function applyInitialConsent(consent) {
-    if (!consent)
-        return;
-    const current = analyticsSharedState.consent;
-    if (current === null ||
-        CONSENT_RESTRICTIVENESS[consent] < CONSENT_RESTRICTIVENESS[current]) {
-        analyticsSharedState.consent = consent;
-    }
-}
-/**
- * The effective analytics consent status. `"granted"` when no client set one
- * explicitly, preserving the legacy always-on behavior.
- *
- * @internal
- */
-export function getAnalyticsConsentStatus() {
-    var _a;
-    return (_a = analyticsSharedState.consent) !== null && _a !== void 0 ? _a : "granted";
-}
-function clearPersistedAnalyticsSessionId() {
-    if (typeof window === "undefined")
-        return;
-    try {
-        localStorage.removeItem(ANALYTICS_SESSION_ID_LOCAL_STORAGE_KEY);
-    }
-    catch (_a) {
-        // Storage unavailable — nothing was persisted, so nothing to clear.
-    }
-}
-export const createAnalyticsModule = ({ axiosClient, serverUrl, appId, userAuthModule, options, }) => {
+export const createAnalyticsModule = ({ axiosClient, serverUrl, appId, userAuthModule, enabled, }) => {
     var _a;
-    // Consent gates more than this module: getAnalyticsSessionId() also backs
-    // the anonymous-id HTTP header and the socket handshake, so the client's
-    // consent choice must be recorded even when the early returns below make
-    // the module itself a no-op.
-    applyInitialConsent(options === null || options === void 0 ? void 0 : options.consent);
     // prevent overflow of events //
     const { maxQueueSize, throttleTime, batchSize } = analyticsSharedState.config;
     // Disable analytics on React Native. It defines `window` but not `document`,
     // so the per-callsite `typeof window` guards below aren't enough to keep it
     // from touching `document` (e.g. `document.referrer` on init). Node/SSR is
     // still handled by those `window` guards, so this doesn't affect it.
-    if (!((_a = analyticsSharedState.config) === null || _a === void 0 ? void 0 : _a.enabled) ||
-        (options === null || options === void 0 ? void 0 : options.enabled) === false ||
-        isReactNative) {
+    if (!enabled || !((_a = analyticsSharedState.config) === null || _a === void 0 ? void 0 : _a.enabled) || isReactNative) {
         return {
             track: () => { },
-            // Consent still matters with the event pipeline off: it decides whether
-            // the persistent id may back the anonymous-id header and socket
-            // handshake, so opting in/out has to work here too.
-            optIn: () => {
-                analyticsSharedState.consent = "granted";
-            },
-            optOut: () => {
-                analyticsSharedState.consent = "denied";
-                clearPersistedAnalyticsSessionId();
-            },
-            getConsentStatus: getAnalyticsConsentStatus,
             cleanup: () => { },
         };
     }
@@ -149,12 +90,6 @@ export const createAnalyticsModule = ({ axiosClient, serverUrl, appId, userAuthM
         });
     };
     const track = (params) => {
-        const consent = getAnalyticsConsentStatus();
-        // Denied: drop. Pending: buffer in memory (no network, no storage) so the
-        // events can be delivered if the visitor opts in later.
-        if (consent === "denied") {
-            return;
-        }
         if (analyticsSharedState.requestsQueue.length >= maxQueueSize) {
             return;
         }
@@ -163,9 +98,7 @@ export const createAnalyticsModule = ({ axiosClient, serverUrl, appId, userAuthM
             ...params,
             ...intrinsicData,
         });
-        if (consent === "granted") {
-            startProcessing();
-        }
+        startProcessing();
     };
     const onDocVisible = () => {
         startAnalyticsProcessor(flush, {
@@ -193,66 +126,25 @@ export const createAnalyticsModule = ({ axiosClient, serverUrl, appId, userAuthM
             onDocVisible();
         }
     };
-    // Everything with a side effect beyond this module — the persistent id,
-    // automatic events, timers, network — starts in activate(), so a client
-    // created with consent "pending" or "denied" stays fully dormant until the
-    // visitor opts in.
-    let isActive = false;
-    const activate = () => {
-        if (isActive)
-            return;
-        isActive = true;
-        // start the flusing process ///
-        startProcessing();
-        // start the heart beat processor //
-        clearHeartBeatProcessor = startHeartBeatProcessor(track);
-        // track the referrer event //
-        trackInitializationEvent(track);
-        // start the visibility change listener //
-        if (typeof window !== "undefined") {
-            window.addEventListener("visibilitychange", onVisibilityChange);
-        }
-    };
-    const deactivate = () => {
-        if (!isActive)
-            return;
-        isActive = false;
+    const cleanup = () => {
         stopAnalyticsProcessor();
         clearHeartBeatProcessor === null || clearHeartBeatProcessor === void 0 ? void 0 : clearHeartBeatProcessor();
-        clearHeartBeatProcessor = undefined;
         if (typeof window !== "undefined") {
             window.removeEventListener("visibilitychange", onVisibilityChange);
         }
     };
-    const optIn = () => {
-        analyticsSharedState.consent = "granted";
-        // Persist the id now rather than on the next event: this adopts the
-        // ephemeral pre-consent id (see getAnalyticsSessionId), keeping the
-        // visitor's identity continuous across the consent grant.
-        getAnalyticsSessionId();
-        activate();
-    };
-    const optOut = () => {
-        analyticsSharedState.consent = "denied";
-        deactivate();
-        // Drop anything buffered while consent was pending, and forget the
-        // identity: both the persisted id and the memoized session context.
-        analyticsSharedState.requestsQueue.length = 0;
-        analyticsSharedState.sessionStartTime = null;
-        resetAnalyticsSessionContext();
-        clearPersistedAnalyticsSessionId();
-    };
-    const cleanup = () => {
-        deactivate();
-    };
-    if (getAnalyticsConsentStatus() === "granted") {
-        activate();
+    // start the flusing process ///
+    startProcessing();
+    // start the heart beat processor //
+    clearHeartBeatProcessor = startHeartBeatProcessor(track);
+    // track the referrer event //
+    trackInitializationEvent(track);
+    // start the visibility change listener //
+    if (typeof window !== "undefined") {
+        window.addEventListener("visibilitychange", onVisibilityChange);
     }
     return {
         track,
-        optIn,
-        optOut,
-        getConsentStatus: getAnalyticsConsentStatus,
         cleanup,
     };
 };
@@ -363,7 +255,7 @@ async function getSessionContext(userAuthModule) {
         // With no token there is no identity to resolve: `me()` can only answer 401,
         // which the browser logs to the console before any handler here sees it. On
         // a public page that request is the sole reason an error appears, so skip
-        // it. This is not memoized — a visitor who logs in later must still resolve.
+        // it. This is not memoized, because a visitor who logs in later must still resolve.
         if (!userAuthModule.hasToken()) {
             return { user_id: null, session_id: getAnalyticsSessionId() };
         }
@@ -422,29 +314,19 @@ function getFallbackSessionId() {
     return ((_a = analyticsSharedState.fallbackSessionId) !== null && _a !== void 0 ? _a : (analyticsSharedState.fallbackSessionId = generateUuid()));
 }
 export function getAnalyticsSessionId() {
-    var _a;
     if (typeof window === "undefined") {
         return getFallbackSessionId();
     }
-    // Until consent is granted, never read or write the persistent id — hand out
-    // a per-page-load ephemeral id instead. The anonymous-id HTTP header and the
-    // socket handshake resolve their id through here too, so this single gate
-    // covers every place a persistent identifier could be minted pre-consent.
-    if (getAnalyticsConsentStatus() !== "granted") {
-        return getFallbackSessionId();
-    }
     try {
         const sessionId = localStorage.getItem(ANALYTICS_SESSION_ID_LOCAL_STORAGE_KEY);
         if (!sessionId) {
-            // Adopt the ephemeral pre-consent id when one was handed out, so the
-            // visitor keeps a single identity across the consent grant.
-            const newSessionId = (_a = analyticsSharedState.fallbackSessionId) !== null && _a !== void 0 ? _a : generateUuid();
+            const newSessionId = generateUuid();
             localStorage.setItem(ANALYTICS_SESSION_ID_LOCAL_STORAGE_KEY, newSessionId);
             return newSessionId;
         }
         return sessionId;
     }
-    catch (_b) {
+    catch (_a) {
         return getFallbackSessionId();
     }
 }

package/dist/modules/analytics.types.d.ts

@@ -67,41 +67,6 @@ export type AnalyticsModuleOptions = {
     batchSize?: number;
     heartBeatInterval?: number;
 };
-/**
- * Consent status for analytics tracking.
- *
- * - `"granted"`: Analytics is fully active. The SDK persists a visitor ID in `localStorage`, sends automatic events, and delivers tracked events to the server.
- * - `"pending"`: Analytics is dormant while waiting for a consent decision. No visitor ID is persisted and nothing is sent to the server. Events passed to {@linkcode AnalyticsModule.track | track()} are buffered in memory and delivered if consent is later granted with {@linkcode AnalyticsModule.optIn | optIn()}.
- * - `"denied"`: Analytics is off. No visitor ID is persisted, nothing is sent to the server, and tracked events are discarded.
- */
-export type AnalyticsConsentStatus = "granted" | "denied" | "pending";
-/**
- * Analytics configuration for {@linkcode createClient | createClient()}.
- *
- * Controls whether analytics runs and whether it waits for a consent decision before persisting a visitor ID or sending events.
- */
-export type CreateClientAnalyticsOptions = {
-    /**
-     * Whether the analytics module is enabled.
-     *
-     * When `false`, {@linkcode AnalyticsModule.track | track()} is a no-op and no automatic events are sent, regardless of consent status.
-     *
-     * @defaultValue `true`
-     */
-    enabled?: boolean;
-    /**
-     * Initial consent status for analytics.
-     *
-     * Defaults to `"granted"`, which preserves the SDK's original behavior: analytics starts as soon as the client is created.
-     *
-     * Set to `"pending"` when your app needs a consent decision (for example, from a cookie banner) before tracking starts. The client is still created immediately, but analytics stays dormant — no visitor ID is written to `localStorage`, no automatic events fire, and tracked events are buffered in memory. Call {@linkcode AnalyticsModule.optIn | optIn()} once consent is granted, or {@linkcode AnalyticsModule.optOut | optOut()} if it's refused.
-     *
-     * When multiple clients are created on the same page, the most restrictive explicitly-configured consent status wins (`"denied"` over `"pending"` over `"granted"`).
-     *
-     * @defaultValue `"granted"`
-     */
-    consent?: AnalyticsConsentStatus;
-};
 /**
  * Analytics module for tracking custom events in your app.
  *
@@ -116,10 +81,6 @@ export type CreateClientAnalyticsOptions = {
  * - Choose clear, descriptive event names in snake_case like `signup_button_click` or `purchase_completed` rather than generic names like `click`.
  * - Include relevant context in your properties such as identifiers like `product_id`, measurements like `price`, and flags like `is_first_purchase`.
  *
- * ## Consent
- *
- * Apps that need a consent decision (for example, from a cookie banner) before tracking starts can create the client with `analytics: { consent: 'pending' }` and then call {@linkcode optIn | optIn()} or {@linkcode optOut | optOut()} once the visitor decides. See {@linkcode CreateClientAnalyticsOptions} for details.
- *
  * ## Authentication Modes
  *
  * This module is only available in user authentication mode (`base44.analytics`).
@@ -158,56 +119,4 @@ export interface AnalyticsModule {
      * ```
      */
     track(params: TrackEventParams): void;
-    /**
-     * Grants analytics consent and activates tracking.
-     *
-     * Use this after the visitor accepts analytics in your consent flow (for example, a cookie banner). It sets the consent status to `"granted"`, persists the visitor ID, starts automatic events, and delivers any events buffered while consent was `"pending"`.
-     *
-     * The visitor keeps a single identity across the consent grant: the temporary in-memory ID used before consent is adopted as the persistent ID.
-     *
-     * Calling this when consent is already `"granted"` has no effect.
-     *
-     * @example
-     * ```typescript
-     * // Create the client without tracking, then activate it once the
-     * // visitor accepts analytics in your consent banner.
-     * const base44 = createClient({
-     *   appId: 'my-app-id',
-     *   analytics: { consent: 'pending' }
-     * });
-     *
-     * onConsentBannerAccept(() => {
-     *   base44.analytics.optIn();
-     * });
-     * ```
-     */
-    optIn(): void;
-    /**
-     * Revokes analytics consent and deactivates tracking.
-     *
-     * Use this when the visitor declines analytics in your consent flow, or withdraws consent later. It sets the consent status to `"denied"`, stops automatic events, discards any buffered events, and removes the persistent visitor ID from `localStorage`.
-     *
-     * Tracking can be re-enabled later with {@linkcode optIn | optIn()}.
-     *
-     * @example
-     * ```typescript
-     * onConsentBannerDecline(() => {
-     *   base44.analytics.optOut();
-     * });
-     * ```
-     */
-    optOut(): void;
-    /**
-     * Gets the current analytics consent status.
-     *
-     * @returns The current consent status: `"granted"`, `"denied"`, or `"pending"`.
-     *
-     * @example
-     * ```typescript
-     * if (base44.analytics.getConsentStatus() === 'pending') {
-     *   showConsentBanner();
-     * }
-     * ```
-     */
-    getConsentStatus(): AnalyticsConsentStatus;
 }

package/dist/modules/app.d.ts

@@ -0,0 +1,11 @@
+import { AxiosInstance } from "axios";
+import { AppModule } from "./app.types";
+/**
+ * Creates the app module for the Base44 SDK.
+ *
+ * @param axios - Axios instance
+ * @param appId - Application ID
+ * @returns App module for reading the app's own configuration
+ * @internal
+ */
+export declare function createAppModule(axios: AxiosInstance, appId: string): AppModule;

package/dist/modules/app.js

@@ -0,0 +1,15 @@
+/**
+ * Creates the app module for the Base44 SDK.
+ *
+ * @param axios - Axios instance
+ * @param appId - Application ID
+ * @returns App module for reading the app's own configuration
+ * @internal
+ */
+export function createAppModule(axios, appId) {
+    return {
+        async getPublicSettings() {
+            return axios.get(`/apps/public/prod/public-settings/by-id/${appId}`);
+        },
+    };
+}

package/dist/modules/app.types.d.ts

@@ -1,3 +1,55 @@
+/**
+ * The app's access policy: whether the app is reachable without an account, and
+ * who may sign in.
+ */
+export type AppPublicSettings = "private_with_login" | "public_with_login" | "public_without_login" | "workspace_with_login" | string;
+/**
+ * The app's public configuration, as returned by {@link AppModule.getPublicSettings}.
+ */
+export interface AppPublicSettingsResponse {
+    /** The app's ID. */
+    id: string;
+    /** The app's access policy. */
+    public_settings: AppPublicSettings;
+}
+/**
+ * App module for reading the app's own public configuration.
+ *
+ * Use it to discover how the app is gated before rendering it, so a private app
+ * can send the visitor to login instead of rendering an empty shell.
+ *
+ * ## Authentication Modes
+ *
+ * This module is available to use with a client in all authentication modes. The
+ * client's token, when it has one, is sent with the request, so a signed-in visitor
+ * who has no access to the app is reported differently from an anonymous one.
+ */
+export interface AppModule {
+    /**
+     * Get the app's public configuration.
+     *
+     * Rejects with a {@linkcode Base44Error} when the visitor may not open the app:
+     * `status` is `403` and `data.extra_data.reason` says why. It is
+     * `"auth_required"` when the visitor must sign in, and
+     * `"user_not_registered"` when the signed-in visitor has no access to this app.
+     *
+     * @returns Promise resolving to the app's ID and access policy.
+     *
+     * @example
+     * ```typescript
+     * // Decide what to render before the app boots
+     * try {
+     *   const { public_settings } = await base44.app.getPublicSettings();
+     *   console.log('App access policy:', public_settings);
+     * } catch (error) {
+     *   if (error.status === 403) {
+     *     console.log('Blocked because:', error.data?.extra_data?.reason);
+     *   }
+     * }
+     * ```
+     */
+    getPublicSettings(): Promise<AppPublicSettingsResponse>;
+}
 /**
  * @internal
  */
@@ -62,7 +114,7 @@ export interface AppLike {
     agents?: Record<string, any>;
     logo_url?: string;
     slug?: string;
-    public_settings?: "private_with_login" | "public_with_login" | "public_without_login" | "workspace_with_login" | string;
+    public_settings?: AppPublicSettings;
     is_blocked?: boolean;
     github_repo_url?: string;
     main_page?: string;

package/dist/modules/auth.js

@@ -70,7 +70,7 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
     // two identical GETs, so the second pays the first's full latency on every
     // cold load.
     //
-    // This shares the pending promise only — it is cleared as soon as the request
+    // This shares the pending promise only, and it is cleared as soon as the request
     // settles, so no resolved user is ever retained. Caching the user across
     // requests would leave the app rendering a stale identity after logout or a
     // session swap.

package/dist/modules/auth.types.d.ts

@@ -526,7 +526,7 @@ export interface AuthModule {
 /**
  * The auth module as constructed internally, before it is narrowed to
  * {@link AuthModule} on the public client. Not exported from the package
- * index — SDK consumers see only {@link AuthModule}.
+ * index. SDK consumers see only {@link AuthModule}.
  *
  * @internal
  */
@@ -534,7 +534,7 @@ export interface InternalAuthModule extends AuthModule {
     /**
      * Whether an access token is currently set on the client.
      *
-     * Reports only the presence of a token, never its validity — an expired or
+     * Reports only the presence of a token, never its validity. An expired or
      * revoked token still reads as `true`. Callers use this to skip requests that
      * could not succeed without a session, not to decide that one is valid.
      */

package/dist/modules/connectors.js

@@ -93,8 +93,8 @@ function assertNonEmptyString(value, label) {
  * POST a request to the connector proxy and normalize the response.
  *
  * The proxy reports upstream outcomes in the body rather than as HTTP status, so
- * a provider 4xx/5xx arrives here as a resolved response with `success: false` —
- * only Base44-side failures reject through the axios error interceptor.
+ * a provider 4xx/5xx arrives here as a resolved response with `success: false`.
+ * Only Base44-side failures reject through the axios error interceptor.
  *
  * @internal
  */

package/dist/modules/connectors.types.d.ts

@@ -87,7 +87,7 @@ export interface ConnectorApiResponse<T = unknown> {
     status: number | null;
     /**
      * The parsed upstream response body, or proxy error details when no response
-     * was received. `null` when the response was binary — see {@link dataBase64}.
+     * was received. `null` when the response was binary. See {@link dataBase64}.
      */
     data: T | null;
     /**
@@ -148,9 +148,9 @@ export interface ConnectorProxyRawResponse {
  *
  * ## Metered connectors
  *
- * A few [platform connectors](#shared-connectors) are backed by paid third-party APIs that charge Base44 per call. For those, the OAuth token is **not** available to your code — {@linkcode getConnection | getConnection()} rejects with a `403`. Call them with {@linkcode callApi | callApi()} instead: Base44 attaches the credential server-side, forwards the request, and bills your workspace's integration credits for the call.
+ * A few [platform connectors](#shared-connectors) are backed by paid third-party APIs that charge Base44 per call. For those, the OAuth token is **not** available to your code, and {@linkcode getConnection | getConnection()} rejects with a `403`. Call them with {@linkcode callApi | callApi()} instead: Base44 attaches the credential server-side, forwards the request, and bills your workspace's integration credits for the call.
  *
- * This applies to platform connectors only. A workspace-registered or app user connector runs on **your own** OAuth app, so the provider invoices you directly and there is nothing for Base44 to meter — those keep normal token access via {@linkcode getWorkspaceConnection | getWorkspaceConnection()} and {@linkcode getCurrentAppUserConnection | getCurrentAppUserConnection()}.
+ * This applies to platform connectors only. A workspace-registered or app user connector runs on **your own** OAuth app, so the provider invoices you directly and there is nothing for Base44 to meter, so those keep normal token access via {@linkcode getWorkspaceConnection | getWorkspaceConnection()} and {@linkcode getCurrentAppUserConnection | getCurrentAppUserConnection()}.
  *
  * Two things to keep in mind when writing against a metered connector:
  *
@@ -422,7 +422,7 @@ export interface ConnectorsModule {
      *
      * @param integrationType - The type of integration, such as `'x'`. See [Available connectors](#available-connectors).
      * @param request - The upstream request to forward. See {@link ConnectorApiRequest}.
-     * @returns Promise resolving to a {@link ConnectorApiResponse}. Note that an upstream error is reported in `success` and `status`, not thrown — only Base44-side failures reject.
+     * @returns Promise resolving to a {@link ConnectorApiResponse}. Note that an upstream error is reported in `success` and `status`, not thrown. Only Base44-side failures reject.
      *
      * @example
      * ```typescript

package/dist/modules/entities.js

@@ -143,7 +143,7 @@ function createEntityHandler(axios, appId, entityName, getSocket) {
                     // developer console so they know to fetch the full record on
                     // demand (e.g. a follow-up entities.X.get(id) call) instead of
                     // rendering the slimmed payload directly. Skip on delete events
-                    // — the record no longer exists.
+                    // because the record no longer exists.
                     if (event.type !== "delete" && ((_a = event.data) === null || _a === void 0 ? void 0 : _a._oversize)) {
                         console.error(`[Base44 SDK] Realtime broadcast for ${entityName}#${event.id} was oversize and got slimmed for transport. ` +
                             `Fields >10 KB are empty and the rest of the record may be a stub. ` +

package/dist/utils/common.js

@@ -1,7 +1,7 @@
 export const isNode = typeof window === "undefined";
 export const isInIFrame = !isNode && window.self !== window.top;
 // React Native defines `window` (so `isNode` is false there) but not `document`.
-// Browser-only code paths gated on `window`/`isNode` alone would run — and crash —
+// Browser-only code paths gated on `window`/`isNode` alone would run, and crash,
 // on React Native. Node (no `window`) is already handled by those `window` guards;
 // this flags the window-without-a-DOM case that isn't.
 export const isReactNative = !isNode && typeof document === "undefined";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@base44-preview/sdk",
-  "version": "0.8.44-pr.270.91862eb",
+  "version": "0.8.46-pr.272.2f95f82",
   "description": "JavaScript SDK for Base44 API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",