@base44-preview/sdk 0.8.48-pr.282.081f33c → 0.8.48-pr.282.094dd5b

package/dist/client.js

@@ -5,7 +5,7 @@ import { createAuthModule } from "./modules/auth.js";
 import { createSsoModule } from "./modules/sso.js";
 import { createConnectorsModule, createUserConnectorsModule, } from "./modules/connectors.js";
 import { getAccessToken } from "./utils/auth-utils.js";
-import { exchangeEmbedToken, isEmbeddedTab, isFramed, markEmbeddedTab, takeEmbedTokenFromUrl, } from "./utils/embed-session.js";
+import { exchangeEmbedToken, takeEmbedTokenFromUrl, } from "./utils/embed-session.js";
 import { createFetchWithAuth } from "./utils/fetch-with-auth.js";
 import { createFunctionsModule } from "./modules/functions.js";
 import { createAgentsModule } from "./modules/agents.js";
@@ -58,19 +58,31 @@ export function createClient(config) {
     const { serverUrl = "https://base44.app", appId, analytics, serviceToken, requiresAuth = false, appBaseUrl, options, functionsVersion, headers: optionalHeaders, } = config;
     // Normalize appBaseUrl to always be a string (empty if not provided or invalid)
     const normalizedAppBaseUrl = typeof appBaseUrl === "string" ? appBaseUrl : "";
-    // Always taken off the URL, even outside a frame: a one-time token must not
-    // be left in the address bar, in history, or in a shared link.
-    const urlOtt = takeEmbedTokenFromUrl();
-    // Only redeemed inside a frame. Opened as a normal tab, the same URL falls
-    // back to the app's own login, which works there and cannot work in a frame.
-    const embedOtt = isFramed() ? urlOtt : null;
-    if (embedOtt) {
-        markEmbeddedTab(appId);
+    const embedOtt = takeEmbedTokenFromUrl();
+    // A declaration, not a const: this block sits above the auth module.
+    function getToken() {
+        var _a;
+        return (_a = userAuthModule.getToken()) !== null && _a !== void 0 ? _a : (embedOtt ? null : getAccessToken());
     }
-    const embedded = Boolean(embedOtt) || isEmbeddedTab(appId);
-    // The passed token is the OTT itself whenever one came in on the URL, and a
-    // stale stored one in a frame. Neither of those is this session.
-    const token = urlOtt !== null || embedded ? undefined : config.token;
+    const socketConfig = {
+        serverUrl,
+        mountPath: "/ws-user-apps/socket.io/",
+        transports: ["websocket"],
+        appId,
+        getToken,
+    };
+    let socket = null;
+    const getSocket = () => {
+        if (!socket) {
+            socket = RoomsSocket({
+                config: socketConfig,
+            });
+        }
+        return socket;
+    };
+    // Apps pass getAccessToken() in as `token`, which in a frame is the OTT —
+    // what the exchange trades for a session, never a bearer itself.
+    const token = embedOtt ? undefined : config.token;
     const headers = {
         ...optionalHeaders,
         "X-App-Id": String(appId),
@@ -123,53 +135,35 @@ export function createClient(config) {
         appBaseUrl: normalizedAppBaseUrl,
         serverUrl,
         token,
-        embedded,
-        onEmbedSessionEnded: options === null || options === void 0 ? void 0 : options.onEmbedSessionEnded,
+        embedded: Boolean(embedOtt),
+        // The socket carries its token on the handshake, so it can only pick a
+        // new one up by redialling — or, on logout, by dropping what it has.
+        onSessionChange: (hasSession) => hasSession ? socket === null || socket === void 0 ? void 0 : socket.reconnect() : socket === null || socket === void 0 ? void 0 : socket.disconnect(),
     });
     // Apply the access token before any module that may issue authenticated
     // requests during construction (notably analytics, which fires an init
     // event whose flush calls auth.me()). Without this, the first User/me
     // request is built before setToken runs and goes out unauthenticated.
-    // Skipped in a frame: the session comes from the exchange below.
-    if (typeof window !== "undefined" && !embedded) {
+    // Not in a frame: a stored token there belongs to an earlier visitor.
+    if (typeof window !== "undefined" && !embedOtt) {
         const accessToken = token || getAccessToken();
         if (accessToken) {
             userAuthModule.setToken(accessToken);
         }
     }
-    // Live token for every module; outside a frame it still falls back to storage.
-    const getToken = () => { var _a; return (_a = userAuthModule.getToken()) !== null && _a !== void 0 ? _a : (embedded ? null : getAccessToken()); };
-    const socketConfig = {
-        serverUrl,
-        mountPath: "/ws-user-apps/socket.io/",
-        transports: ["websocket"],
-        appId,
-        getToken,
-    };
-    let socket = null;
-    const getSocket = () => {
-        if (!socket) {
-            socket = RoomsSocket({ config: socketConfig });
-        }
-        return socket;
-    };
-    const applyToken = (newToken, saveToStorage) => {
-        userAuthModule.setToken(newToken, saveToStorage);
-        socket === null || socket === void 0 ? void 0 : socket.reconnect();
-    };
-    // Settles once the exchanged session is applied (memory only); at once
-    // otherwise. Never rejects: every request waits on it, so a failure here
-    // must not turn into a rejection on each of them.
-    const authReady = embedOtt
+    const session = embedOtt
         ? exchangeEmbedToken({ serverUrl, appId, ott: embedOtt })
+        : null;
+    // Never rejects: every request waits on it, so one failure here must not
+    // become a rejection on each of them.
+    const authReady = session
+        ? session
             .then((sessionToken) => {
             var _a;
             if (sessionToken) {
-                applyToken(sessionToken, false);
+                userAuthModule.setToken(sessionToken, false);
                 return;
             }
-            // The app is about to run anonymous. Say why, once, instead of
-            // leaving only the 401s that follow.
             const error = new Error("Base44: the embed token was refused, so this app is not signed in.");
             console.error(error.message);
             (_a = options === null || options === void 0 ? void 0 : options.onError) === null || _a === void 0 ? void 0 : _a.call(options, error);
@@ -178,24 +172,9 @@ export function createClient(config) {
             console.error("Base44: applying the embedded session failed:", e);
         })
         : Promise.resolve();
-    // Everything that can wait for the session does. `aiGateway.connection()`
-    // and the agents connect URLs cannot: they hand back a value, not a promise,
-    // and a value read now would stay wrong after the session arrives. They warn
-    // instead of failing quietly.
-    let warnedEarlyRead = false;
-    const getTokenNow = () => {
-        const sessionToken = getToken();
-        if (sessionToken === null && embedOtt && !warnedEarlyRead) {
-            warnedEarlyRead = true;
-            console.warn("Base44: read a token before the embedded session was ready, so it is " +
-                "empty. Await a call such as base44.auth.me() before building a " +
-                "client or a URL that keeps the token.");
-        }
-        return sessionToken;
-    };
-    if (embedOtt) {
-        // Requests issued during the exchange wait for it. Registered after createAxiosClient's
-        // interceptors so it runs first and the anonymous-visitor header sees the Authorization.
+    if (session) {
+        // Registered after createAxiosClient's so it runs first (axios unshifts),
+        // letting the anonymous-visitor header see the Authorization we just set.
         for (const client of [axiosClient, functionsAxiosClient]) {
             client.interceptors.request.use(async (requestConfig) => {
                 await authReady;
@@ -260,13 +239,10 @@ export function createClient(config) {
             getSocket,
             appId,
             serverUrl,
-            getToken: getTokenNow,
-        }),
-        aiGateway: createAiGatewayModule({
-            serverUrl,
-            getToken: getTokenNow,
-            appId,
+            // Sync, unlike everything else: these return a URL, not a promise.
+            getToken,
         }),
+        aiGateway: createAiGatewayModule({ serverUrl, getToken, appId }),
         appLogs: createAppLogsModule(axiosClient, appId),
         app: createAppModule(axiosClient, appId),
         users: createUsersModule(axiosClient, appId),
@@ -311,10 +287,9 @@ export function createClient(config) {
             getSocket,
             appId,
             serverUrl,
-            // The user's token, as on the user-scoped module: the only thing this is
-            // read for is the `?token=` on a channel URL handed to that user, which
-            // the app's service credential must never end up in.
-            getToken: getTokenNow,
+            // The user's token, deliberately: this is read only for the `?token=` on
+            // a channel URL handed to that user. Never the service credential.
+            getToken,
         }),
         aiGateway: createAiGatewayModule({
             serverUrl,
@@ -373,7 +348,7 @@ export function createClient(config) {
          * ```
          */
         setToken(newToken) {
-            applyToken(newToken, true);
+            userAuthModule.setToken(newToken, true);
         },
         /**
          * Gets the current client configuration.

package/dist/client.types.d.ts

@@ -22,18 +22,6 @@ export interface CreateClientOptions {
      * are usually {@linkcode Base44Error} instances — check `error.status`.
      */
     onError?: (error: Error) => void;
-    /**
-     * Called when an embedded app's session ends, instead of the SDK's built-in
-     * notice.
-     *
-     * A platform-embedded app holds its session in memory and only the platform
-     * can mint the next one, so there is no login page to send the visitor to.
-     * When {@link AuthModule.redirectToLogin | redirectToLogin()} or
-     * {@link AuthModule.logout | logout()} is reached in that state the SDK
-     * covers the page with a plain "session ended" notice; pass this to render
-     * your own instead. See {@link AuthModule.isEmbedded | auth.isEmbedded()}.
-     */
-    onEmbedSessionEnded?: () => void;
     /**
      * Forces the actors transport. `"auto"` (default) connects directly to the
      * actor and falls back to the platform proxy when the app's actors don't

package/dist/modules/actors.d.ts

@@ -11,8 +11,9 @@ interface ActorsConfig {
     appId: string;
     /** Current user access token, if authenticated. Rides the WS query on the
      * proxy-fallback path so the platform proxy can authenticate the connection;
-     * anonymous connects omit it. */
-    getAuthToken(): string | null | undefined | Promise<string | null | undefined>;
+     * anonymous connects omit it. Awaited per dial, so a session still being
+     * exchanged is in hand before the URL is built. */
+    getAuthToken(): Promise<string | null | undefined>;
     /** Same semantics as function calls: editors with a non-prod version get the
      * draft actor script; everyone else gets the published one. */
     functionsVersion?: string;

package/dist/modules/agents.types.d.ts

@@ -161,7 +161,7 @@ export interface AgentsModuleConfig {
     /** Server URL */
     serverUrl?: string;
     /** Returns the current authentication token, if any */
-    getToken: () => string | null | undefined;
+    getToken: () => string | null;
 }
 /**
  * Agents module for managing AI agent conversations.
@@ -360,7 +360,9 @@ export interface AgentsModule {
      * Gets WhatsApp connection URL for an agent.
      *
      * Generates a URL that users can use to connect with the agent through WhatsApp.
-     * The URL includes authentication if a token is available.
+     * The URL includes authentication if a token is available. In an app a
+     * platform has embedded, that is only once the session has been exchanged —
+     * await a call such as `base44.auth.me()` before building the URL.
      *
      * @param agentName - The name of the agent.
      * @returns WhatsApp connection URL.
@@ -378,7 +380,9 @@ export interface AgentsModule {
      * Gets Telegram connection URL for an agent.
      *
      * Generates a URL that users can use to connect with the agent through Telegram.
-     * The URL includes authentication if a token is available. When the user opens
+     * The URL includes authentication if a token is available. In an app a
+     * platform has embedded, that is only once the session has been exchanged —
+     * await a call such as `base44.auth.me()` before building the URL. When the user opens
      * this URL, they are redirected to the agent's Telegram bot with an activation
      * code that securely links their account.
      *

package/dist/modules/auth.js

@@ -83,17 +83,6 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
     // to the identity transitions below (`setToken`, `logout`) instead of to the
     // header a caller may have set on the instance directly.
     let accessToken = options.token || null;
-    // Where an embedded app goes when it has no session: nowhere. Only the host
-    // platform can mint the next one — a login here would sign the visitor in as
-    // an app user, a different identity from the platform user the frame is for.
-    // The app's own notice wins when it passed one.
-    const endEmbeddedSession = () => {
-        if (options.onEmbedSessionEnded) {
-            options.onEmbedSessionEnded();
-            return;
-        }
-        showEmbedSessionEnded();
-    };
     return {
         hasToken() {
             return accessToken !== null;
@@ -130,9 +119,10 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
             // Only the host platform can sign a platform user in, so there is no
             // login page to send them to. (The app's own login would work in the
             // frame — `loginWithProvider` opens a popup — but it would mint a
-            // different, app-level identity.)
+            // different, app-level identity.) An app that wants its own notice
+            // checks `isEmbedded()` rather than asking for a login it cannot get.
             if (options.embedded) {
-                endEmbeddedSession();
+                showEmbedSessionEnded();
                 return;
             }
             // If nextUrl is not provided, use the current URL
@@ -171,13 +161,18 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
         },
         // Logout the current user
         logout(redirectUrl) {
-            // Remove token from axios headers (always do this)
+            var _a;
+            // Remove the token from both axios instances (always do this). Missing
+            // the functions one used to be hidden by the redirect below tearing the
+            // page down; an embedded logout returns instead, so the page lives on.
             delete axios.defaults.headers.common["Authorization"];
+            delete functionsAxiosClient.defaults.headers.common["Authorization"];
             // Drop identity resolved under the previous session: a `me()` already in
             // flight would otherwise resolve into callers that run after the logout.
             clearPendingMe();
             resetAnalyticsSessionContext();
             accessToken = null;
+            (_a = options.onSessionChange) === null || _a === void 0 ? void 0 : _a.call(options, false);
             // Only do the rest if in a browser environment
             if (typeof window !== "undefined") {
                 // Remove token from localStorage
@@ -195,7 +190,7 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
                 // memory — and navigating a third-party frame to the logout endpoint
                 // would only break the frame. The state above is already cleared.
                 if (options.embedded) {
-                    endEmbeddedSession();
+                    showEmbedSessionEnded();
                     return;
                 }
                 // Determine the from_url parameter
@@ -207,6 +202,7 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
         },
         // Set authentication token
         setToken(token, saveToStorage = true) {
+            var _a;
             if (!token)
                 return;
             // An embedded session belongs to the frame the platform minted it for.
@@ -221,6 +217,7 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
             // handle token change for axios clients
             axios.defaults.headers.common["Authorization"] = `Bearer ${token}`;
             functionsAxiosClient.defaults.headers.common["Authorization"] = `Bearer ${token}`;
+            (_a = options.onSessionChange) === null || _a === void 0 ? void 0 : _a.call(options, true);
             // Save token to localStorage if requested
             if (persist && typeof window !== "undefined" && window.localStorage) {
                 try {

package/dist/modules/auth.types.d.ts

@@ -98,16 +98,13 @@ export interface AuthModuleOptions {
      * which is how the server-side SDK reports a token it never sets explicitly.
      */
     token?: string;
-    /**
-     * Whether this client runs embedded in a host platform's frame, where a
-     * session is minted by the platform and cannot be renewed by a login redirect.
-     */
+    /** Whether a host platform embedded this client in a frame. */
     embedded?: boolean;
     /**
-     * Called instead of the SDK's built-in notice when an embedded session ends.
-     * See {@link CreateClientOptions.onEmbedSessionEnded}.
+     * Called when the identity changes: `true` on `setToken`, `false` on
+     * `logout`. Lets the client redial the socket, which holds its own copy.
      */
-    onEmbedSessionEnded?: () => void;
+    onSessionChange?: (hasSession: boolean) => void;
 }
 /**
  * Authentication module for managing user authentication and authorization. The module automatically stores tokens in local storage when available and manages authorization headers for API requests.
@@ -190,13 +187,13 @@ export interface AuthModule {
      */
     redirectToLogin(nextUrl: string): void;
     /**
-     * Whether the app is running embedded in a host platform.
+     * Whether a host platform embedded this app and signed its user in.
      *
-     * A platform embeds an app in an iframe and signs its user in by minting a one-time token onto the frame's URL; the SDK trades it for a session as the client is created. That session is held in memory only and can be renewed only by the platform, so when it ends there is no login page to send the user to — {@linkcode AuthModule.redirectToLogin | redirectToLogin()} and {@linkcode AuthModule.logout | logout()} show a "session ended" notice instead (pass `options.onEmbedSessionEnded` to {@linkcode createClient} to show your own). Use this to render your own notice or to hide sign-in and sign-out controls that cannot work inside the frame.
+     * Only the platform can renew that session, so {@linkcode AuthModule.redirectToLogin | redirectToLogin()} and {@linkcode AuthModule.logout | logout()} show a "session ended" notice rather than a login page. Use this to render your own notice, or to hide sign-in controls that cannot work in the frame.
      *
-     * Because the session lives in memory, it does not survive a full page load inside the frame: routing within the app keeps it, while a reload or a real navigation ends it and the platform has to embed the app again. Prefer client-side navigation in an embedded app.
+     * The session lives in memory, so a reload inside the frame ends it and returns `false` here. Prefer client-side navigation.
      *
-     * @returns `true` when the app was embedded by a host platform, `false` otherwise.
+     * @returns `true` when a host platform embedded this app.
      *
      * @example
      * ```typescript
@@ -567,9 +564,6 @@ export interface InternalAuthModule extends AuthModule {
      * could not succeed without a session, not to decide that one is valid.
      */
     hasToken(): boolean;
-    /**
-     * The access token currently set on the client, or `null` when there is none.
-     * Follows {@linkcode AuthModule.setToken | setToken} and {@linkcode AuthModule.logout | logout}.
-     */
+    /** The token currently set on the client, or `null`. */
     getToken(): string | null;
 }

package/dist/utils/embed-session.d.ts

@@ -7,57 +7,29 @@
  * grant (RFC 8693), and keeps the result in memory only — never in storage — so
  * the session lives and dies with the frame.
  *
- * @internal
- */
-/** The query parameter a host platform puts the one-time token on. @internal */
-export declare const EMBED_TOKEN_PARAM = "ott";
-/**
- * Reads the one-time token off the current URL and strips it, so it is never
- * left in the address bar, in history, or in a shared link.
+ * Taking the token off the URL is unconditional — a one-time token must not be
+ * left in the address bar, in history, or in a shared link — but it is only
+ * reported back inside a frame, the only place one is redeemed. It is gone once
+ * the first client has taken it, so the session belongs to that client — an app
+ * creates one.
  *
- * @internal
- */
-export declare function takeEmbedTokenFromUrl(): string | null;
-/**
- * Whether this document is rendered inside a frame. Read at call time, not at
- * import: a module-level answer would be fixed before a host (or a test) has
- * set the window up.
+ * The exchange endpoint is rate limited per app, and its limiter refuses before
+ * the one-time token is redeemed — so a 429 leaves the token still valid and is
+ * worth retrying once.
  *
  * @internal
  */
+export declare const EMBED_TOKEN_PARAM = "ott";
+/** @internal */
+export declare function takeEmbedTokenFromUrl(): string | null;
+/** @internal */
 export declare function isFramed(): boolean;
-/**
- * Whether this tab previously redeemed an embed token for this app. Counts only
- * inside a frame: a top-level tab that once carried a token must fall back to
- * the regular login, or it could never sign in again.
- *
- * @internal
- */
-export declare function isEmbeddedTab(appId: string): boolean;
 /** @internal */
-export declare function markEmbeddedTab(appId: string): void;
-/**
- * Trades a one-time embed token for an app-user session token. Resolves to
- * `null` when the platform refuses the token; never throws.
- *
- * @internal
- */
 export declare function exchangeEmbedToken({ serverUrl, appId, ott, fetchImpl, }: {
     serverUrl: string;
     appId: string;
     ott: string;
     fetchImpl?: typeof fetch;
 }): Promise<string | null>;
-/**
- * Covers the page with a plain "session ended" notice. An embedded session can
- * only be renewed by the host platform, so this stands in for the login
- * redirect: only the platform can mint the next session. The copy points at the
- * host page: reloading the frame itself carries no token and lands here again.
- *
- * This is the default an app that predates embedding gets. An app that wants its
- * own can pass `options.onEmbedSessionEnded` to {@linkcode createClient}, or
- * check {@linkcode AuthModule.isEmbedded} before asking for a login.
- *
- * @internal
- */
+/** @internal */
 export declare function showEmbedSessionEnded(): void;

package/dist/utils/embed-session.js

@@ -7,24 +7,26 @@
  * grant (RFC 8693), and keeps the result in memory only — never in storage — so
  * the session lives and dies with the frame.
  *
+ * Taking the token off the URL is unconditional — a one-time token must not be
+ * left in the address bar, in history, or in a shared link — but it is only
+ * reported back inside a frame, the only place one is redeemed. It is gone once
+ * the first client has taken it, so the session belongs to that client — an app
+ * creates one.
+ *
+ * The exchange endpoint is rate limited per app, and its limiter refuses before
+ * the one-time token is redeemed — so a 429 leaves the token still valid and is
+ * worth retrying once.
+ *
  * @internal
  */
-/** The query parameter a host platform puts the one-time token on. @internal */
 export const EMBED_TOKEN_PARAM = "ott";
-const EMBED_TAB_KEY_PREFIX = "base44_embed_session";
-/** Per-app, so a second app framed on the same origin keeps its own answer. */
-const embedTabKey = (appId) => `${EMBED_TAB_KEY_PREFIX}:${appId}`;
 const GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange";
 const SUBJECT_TOKEN_TYPE = "urn:base44:params:oauth:token-type:embed-ott";
 const RATE_LIMITED = 429;
 const RATE_LIMIT_RETRY_MS = 1000;
+const EXCHANGE_TIMEOUT_MS = 15000;
 const SESSION_ENDED_ELEMENT_ID = "base44-embed-session-ended";
-/**
- * Reads the one-time token off the current URL and strips it, so it is never
- * left in the address bar, in history, or in a shared link.
- *
- * @internal
- */
+/** @internal */
 export function takeEmbedTokenFromUrl() {
     if (typeof window === "undefined" || !window.location) {
         return null;
@@ -40,73 +42,20 @@ export function takeEmbedTokenFromUrl() {
         window.history.replaceState(window.history.state, "", url.toString());
     }
     catch (e) {
-        // The token was read but the URL could not be rewritten (history blocked,
-        // a sandboxed frame, replaceState rate-limited). Return it anyway: it is
-        // this load's identity, and dropping it here would leave `?ott=` on the
-        // URL for getAccessToken to hand back as if it were a session token.
         console.error("Error retrieving embed token from URL:", e);
     }
-    return ott;
+    return isFramed() ? ott : null;
 }
-/**
- * Whether this document is rendered inside a frame. Read at call time, not at
- * import: a module-level answer would be fixed before a host (or a test) has
- * set the window up.
- *
- * @internal
- */
+/** @internal */
 export function isFramed() {
-    if (typeof window === "undefined") {
-        return false;
-    }
-    try {
-        return window.self !== window.top;
-    }
-    catch (_a) {
-        // Reaching the top window can be refused outright; if we cannot see it,
-        // we are certainly not it.
-        return true;
-    }
-}
-/**
- * Whether this tab previously redeemed an embed token for this app. Counts only
- * inside a frame: a top-level tab that once carried a token must fall back to
- * the regular login, or it could never sign in again.
- *
- * @internal
- */
-export function isEmbeddedTab(appId) {
-    if (typeof window === "undefined") {
-        return false;
-    }
-    // A cross-site frame is third-party storage, which some browsers block
-    // outright — every access can throw, and the marker is then unavailable.
-    try {
-        return (isFramed() && window.sessionStorage.getItem(embedTabKey(appId)) === "1");
-    }
-    catch (_a) {
-        return false;
-    }
+    return typeof window !== "undefined" && window.self !== window.top;
 }
 /** @internal */
-export function markEmbeddedTab(appId) {
-    try {
-        window.sessionStorage.setItem(embedTabKey(appId), "1");
-    }
-    catch (_a) {
-        /* storage blocked */
-    }
-}
-/**
- * Trades a one-time embed token for an app-user session token. Resolves to
- * `null` when the platform refuses the token; never throws.
- *
- * @internal
- */
 export async function exchangeEmbedToken({ serverUrl, appId, ott, fetchImpl = fetch, }) {
     const post = () => fetchImpl(`${serverUrl}/api/apps/${appId}/auth/embed/token`, {
         method: "POST",
         headers: { "X-App-Id": String(appId) },
+        signal: AbortSignal.timeout(EXCHANGE_TIMEOUT_MS),
         body: new URLSearchParams({
             grant_type: GRANT_TYPE,
             subject_token: ott,
@@ -115,7 +64,6 @@ export async function exchangeEmbedToken({ serverUrl, appId, ott, fetchImpl = fe
     });
     try {
         let response = await post();
-        // The limiter refuses before the token is redeemed, so it is still valid.
         if (response.status === RATE_LIMITED) {
             await new Promise((resolve) => setTimeout(resolve, RATE_LIMIT_RETRY_MS));
             response = await post();
@@ -131,18 +79,7 @@ export async function exchangeEmbedToken({ serverUrl, appId, ott, fetchImpl = fe
         return null;
     }
 }
-/**
- * Covers the page with a plain "session ended" notice. An embedded session can
- * only be renewed by the host platform, so this stands in for the login
- * redirect: only the platform can mint the next session. The copy points at the
- * host page: reloading the frame itself carries no token and lands here again.
- *
- * This is the default an app that predates embedding gets. An app that wants its
- * own can pass `options.onEmbedSessionEnded` to {@linkcode createClient}, or
- * check {@linkcode AuthModule.isEmbedded} before asking for a login.
- *
- * @internal
- */
+/** @internal */
 export function showEmbedSessionEnded() {
     if (typeof document === "undefined" || !document.body) {
         return;
@@ -150,8 +87,6 @@ export function showEmbedSessionEnded() {
     if (document.getElementById(SESSION_ENDED_ELEMENT_ID)) {
         return;
     }
-    // Colors as custom properties in a stylesheet rather than inline, so the
-    // notice follows the reader's theme — including a change made while it is up.
     const style = document.createElement("style");
     style.textContent =
         `#${SESSION_ENDED_ELEMENT_ID}{--b44-bg:#fff;--b44-fg:#0f172a;--b44-muted:#475569;}` +

package/dist/utils/fetch-with-auth.d.ts

@@ -40,6 +40,5 @@ export declare function createFetchWithAuth({ axios, serviceRoleAxios, appId, se
     serverUrl: string;
     functionsVersion?: string;
     platformHeaders?: Record<string, string>;
-    /** Resolves once the client's session is settled. */
     waitForAuth?: () => Promise<void>;
 }): (path: string, init?: FetchWithAuthInit) => Promise<Response>;

package/dist/utils/socket-utils.d.ts

@@ -4,7 +4,6 @@ export interface RoomsSocketConfig {
     mountPath: string;
     transports: string[];
     appId: string;
-    /** Asked on every connect, so the socket always carries the current session. */
     getToken: () => string | null;
 }
 export type TSocketRoom = string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@base44-preview/sdk",
-  "version": "0.8.48-pr.282.081f33c",
+  "version": "0.8.48-pr.282.094dd5b",
   "description": "JavaScript SDK for Base44 API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",