@base44-preview/sdk 0.8.48-pr.282.2b05017 → 0.8.48-pr.282.3c9bac2

package/dist/client.js

@@ -55,37 +55,16 @@ import { createActorsModule, resolveActorsHost, } from "./modules/actors.js";
  */
 export function createClient(config) {
     var _a, _b, _c, _d;
-    const { serverUrl = "https://base44.app", appId, analytics, token, serviceToken, requiresAuth = false, appBaseUrl, options, functionsVersion, headers: optionalHeaders, } = config;
+    const { serverUrl = "https://base44.app", appId, analytics, serviceToken, requiresAuth = false, appBaseUrl, options, functionsVersion, headers: optionalHeaders, } = config;
     // Normalize appBaseUrl to always be a string (empty if not provided or invalid)
     const normalizedAppBaseUrl = typeof appBaseUrl === "string" ? appBaseUrl : "";
-    const inBrowser = typeof window !== "undefined";
-    // A host platform embeds the app with a one-time token on the iframe URL.
-    // It comes off the URL here, before any other code can read it; the
-    // exchange that turns it into a session runs once the modules exist.
-    const embedOtt = inBrowser ? takeEmbedTokenFromUrl() : null;
-    const embedded = embedOtt !== null || (inBrowser && isEmbeddedTab());
+    const embedOtt = takeEmbedTokenFromUrl();
     if (embedOtt) {
         markEmbeddedTab();
     }
-    let currentToken = token !== null && token !== void 0 ? token : null;
-    const socketConfig = {
-        serverUrl,
-        mountPath: "/ws-user-apps/socket.io/",
-        transports: ["websocket"],
-        appId,
-        // null (not undefined): an embedded frame's only identity is the one the
-        // platform minted, so the socket must not fall back to a stored token.
-        token: embedded ? null : token,
-    };
-    let socket = null;
-    const getSocket = () => {
-        if (!socket) {
-            socket = RoomsSocket({
-                config: socketConfig,
-            });
-        }
-        return socket;
-    };
+    const embedded = Boolean(embedOtt) || isEmbeddedTab();
+    // In a frame the passed token is the OTT itself or a stale stored one, not this session.
+    const token = embedded ? undefined : config.token;
     const headers = {
         ...optionalHeaders,
         "X-App-Id": String(appId),
@@ -144,35 +123,34 @@ export function createClient(config) {
     // requests during construction (notably analytics, which fires an init
     // event whose flush calls auth.me()). Without this, the first User/me
     // request is built before setToken runs and goes out unauthenticated.
-    // An embedded load skips this: its session comes from the exchange below,
-    // and a token an earlier visitor left in storage must not become it.
-    if (inBrowser && !embedded) {
+    // Skipped in a frame: the session comes from the exchange below.
+    if (typeof window !== "undefined" && !embedded) {
         const accessToken = token || getAccessToken();
         if (accessToken) {
-            currentToken = accessToken;
             userAuthModule.setToken(accessToken);
         }
     }
-    // The one answer every module reads. Follows setToken and logout; outside an
-    // embedded frame it still falls back to storage, so a login in another tab is
-    // picked up on the next connection, as before.
-    const getToken = () => {
-        if (userAuthModule.hasToken()) {
-            return currentToken;
+    // Live token for every module; outside a frame it still falls back to storage.
+    const getToken = () => { var _a; return (_a = userAuthModule.getToken()) !== null && _a !== void 0 ? _a : (embedded ? null : getAccessToken()); };
+    const socketConfig = {
+        serverUrl,
+        mountPath: "/ws-user-apps/socket.io/",
+        transports: ["websocket"],
+        appId,
+        getToken,
+    };
+    let socket = null;
+    const getSocket = () => {
+        if (!socket) {
+            socket = RoomsSocket({ config: socketConfig });
         }
-        return embedded || !inBrowser ? null : getAccessToken();
+        return socket;
     };
     const applyToken = (newToken, saveToStorage) => {
         userAuthModule.setToken(newToken, saveToStorage);
-        currentToken = newToken;
-        socketConfig.token = newToken;
-        if (socket) {
-            socket.updateConfig({ token: newToken });
-        }
+        socket === null || socket === void 0 ? void 0 : socket.reconnect();
     };
-    // Resolves once the embedded session is in hand (or known not to be coming);
-    // immediately for every other client. The exchanged token is applied without
-    // persisting it: the session must not outlive the frame it was minted for.
+    // Settles once the exchanged session is applied (memory only); at once otherwise.
     const authReady = embedOtt
         ? exchangeEmbedToken({ serverUrl, appId, ott: embedOtt }).then((sessionToken) => {
             if (sessionToken) {
@@ -181,9 +159,8 @@ export function createClient(config) {
         })
         : Promise.resolve();
     if (embedOtt) {
-        // Requests issued while the exchange is in flight wait for it and carry the
-        // session it produces. Registered after createAxiosClient's interceptors,
-        // so it runs first and the anonymous-visitor header sees the Authorization.
+        // Requests issued during the exchange wait for it. Registered after createAxiosClient's
+        // interceptors so it runs first and the anonymous-visitor header sees the Authorization.
         for (const client of [axiosClient, functionsAxiosClient]) {
             client.interceptors.request.use(async (requestConfig) => {
                 await authReady;

package/dist/modules/auth.js

@@ -82,10 +82,13 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
     // Tracked here rather than read off `axios.defaults` so the answer stays tied
     // to the identity transitions below (`setToken`, `logout`) instead of to the
     // header a caller may have set on the instance directly.
-    let hasAccessToken = Boolean(options.token);
+    let accessToken = options.token || null;
     return {
         hasToken() {
-            return hasAccessToken;
+            return accessToken !== null;
+        },
+        getToken() {
+            return accessToken;
         },
         isEmbedded() {
             return Boolean(options.embedded);
@@ -161,7 +164,7 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
             // flight would otherwise resolve into callers that run after the logout.
             clearPendingMe();
             resetAnalyticsSessionContext();
-            hasAccessToken = false;
+            accessToken = null;
             // Only do the rest if in a browser environment
             if (typeof window !== "undefined") {
                 // Remove token from localStorage
@@ -190,7 +193,7 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
             // resolved for the previous one must not be handed to later callers.
             clearPendingMe();
             resetAnalyticsSessionContext();
-            hasAccessToken = true;
+            accessToken = token;
             // handle token change for axios clients
             axios.defaults.headers.common["Authorization"] = `Bearer ${token}`;
             functionsAxiosClient.defaults.headers.common["Authorization"] = `Bearer ${token}`;

package/dist/modules/auth.types.d.ts

@@ -560,4 +560,9 @@ export interface InternalAuthModule extends AuthModule {
      * could not succeed without a session, not to decide that one is valid.
      */
     hasToken(): boolean;
+    /**
+     * The access token currently set on the client, or `null` when there is none.
+     * Follows {@linkcode AuthModule.setToken | setToken} and {@linkcode AuthModule.logout | logout}.
+     */
+    getToken(): string | null;
 }

package/dist/utils/auth-utils.d.ts

@@ -5,6 +5,8 @@ import { GetAccessTokenOptions, SaveAccessTokenOptions, RemoveAccessTokenOptions
  * Low-level utility for manually retrieving tokens. In most cases, the Base44 client handles
  * token management automatically. This function is useful for custom authentication flows or when you need direct access to stored tokens. Requires a browser environment and can't be used in the backend.
  *
+ * When a host platform has embedded the app with a one-time token (`?ott=`), that token is returned as it stands: it is what {@linkcode createClient} trades for the session, so a page that gates on "is there a token?" as it loads sees one. It is neither stored nor removed from the URL here.
+ *
  * @internal
  *
  * @param options - Configuration options for token retrieval.

package/dist/utils/auth-utils.js

@@ -1,9 +1,12 @@
+import { EMBED_TOKEN_PARAM } from "./embed-session.js";
 /**
  * Retrieves an access token from URL parameters or local storage.
  *
  * Low-level utility for manually retrieving tokens. In most cases, the Base44 client handles
  * token management automatically. This function is useful for custom authentication flows or when you need direct access to stored tokens. Requires a browser environment and can't be used in the backend.
  *
+ * When a host platform has embedded the app with a one-time token (`?ott=`), that token is returned as it stands: it is what {@linkcode createClient} trades for the session, so a page that gates on "is there a token?" as it loads sees one. It is neither stored nor removed from the URL here.
+ *
  * @internal
  *
  * @param options - Configuration options for token retrieval.
@@ -56,6 +59,14 @@ export function getAccessToken(options = {}) {
                 }
                 return token;
             }
+            // A platform-embedded load carries a one-time token instead. It is not a
+            // session yet — createClient takes it off the URL and exchanges it — but
+            // it is the identity this load arrives with, and callers that read this
+            // once as the page loads must not conclude there is none.
+            const embedToken = urlParams.get(EMBED_TOKEN_PARAM);
+            if (embedToken) {
+                return embedToken;
+            }
         }
         catch (e) {
             console.error("Error retrieving token from URL:", e);

package/dist/utils/embed-session.d.ts

@@ -9,6 +9,8 @@
  *
  * @internal
  */
+/** The query parameter a host platform puts the one-time token on. @internal */
+export declare const EMBED_TOKEN_PARAM = "ott";
 /**
  * Reads the one-time token off the current URL and strips it, so it is never
  * left in the address bar, in history, or in a shared link.

package/dist/utils/embed-session.js

@@ -9,7 +9,8 @@
  *
  * @internal
  */
-const OTT_PARAM = "ott";
+/** The query parameter a host platform puts the one-time token on. @internal */
+export const EMBED_TOKEN_PARAM = "ott";
 const EMBED_TAB_KEY = "base44_embed_session";
 const GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange";
 const SUBJECT_TOKEN_TYPE = "urn:base44:params:oauth:token-type:embed-ott";
@@ -28,11 +29,11 @@ export function takeEmbedTokenFromUrl() {
     }
     try {
         const url = new URL(window.location.href);
-        const ott = url.searchParams.get(OTT_PARAM);
+        const ott = url.searchParams.get(EMBED_TOKEN_PARAM);
         if (!ott) {
             return null;
         }
-        url.searchParams.delete(OTT_PARAM);
+        url.searchParams.delete(EMBED_TOKEN_PARAM);
         window.history.replaceState(window.history.state, "", url.toString());
         return ott;
     }

package/dist/utils/socket-utils.d.ts

@@ -4,9 +4,8 @@ export interface RoomsSocketConfig {
     mountPath: string;
     transports: string[];
     appId: string;
-    /** `undefined` means unknown — the socket looks in storage; `null` means
-     * known to be anonymous, so storage is never consulted. */
-    token?: string | null;
+    /** Asked on every connect, so the socket always carries the current session. */
+    getToken: () => string | null;
 }
 export type TSocketRoom = string;
 export type TJsonStr = string;
@@ -42,7 +41,7 @@ export declare function RoomsSocket({ config }: {
         leave: (room: string) => void;
     }>;
     subscribeToRoom: (room: TSocketRoom, handlers: Partial<{ [k in TEvent]: THandler<k>; }>) => () => void;
-    updateConfig: (config: Partial<RoomsSocketConfig>) => void;
+    reconnect: () => void;
     updateModel: (room: string, data: any) => Promise<void>;
     disconnect: () => void;
 };

package/dist/utils/socket-utils.js

@@ -1,5 +1,4 @@
 import { io } from "socket.io-client";
-import { getAccessToken } from "./auth-utils.js";
 import { getAnalyticsSessionId } from "../modules/analytics.js";
 const ROOM_LEAVE_GRACE_MS = 250;
 function initializeSocket(config, handlers) {
@@ -7,7 +6,7 @@ function initializeSocket(config, handlers) {
     // handshake so the backend can verify room access for anonymous agent
     // conversations (mirrors the X-Base44-Anonymous-Id HTTP header). Authenticated
     // clients are identified by their token instead.
-    const resolvedToken = config.token === undefined ? getAccessToken() : config.token;
+    const resolvedToken = config.getToken();
     const query = {
         app_id: config.appId,
         token: resolvedToken,
@@ -41,7 +40,6 @@ function initializeSocket(config, handlers) {
     return socket;
 }
 export function RoomsSocket({ config }) {
-    let currentConfig = { ...config };
     const roomsToListeners = {};
     const pendingRoomLeaves = {};
     const handlers = {
@@ -83,13 +81,10 @@ export function RoomsSocket({ config }) {
             socket.disconnect();
         }
     }
-    function updateConfig(config) {
+    /** Drops the connection and opens a new one with the current token. */
+    function reconnect() {
         cleanup();
-        currentConfig = {
-            ...currentConfig,
-            ...config,
-        };
-        socket = initializeSocket(currentConfig, handlers);
+        socket = initializeSocket(config, handlers);
     }
     function joinRoom(room) {
         socket.emit("join", room);
@@ -162,7 +157,7 @@ export function RoomsSocket({ config }) {
     return {
         socket,
         subscribeToRoom,
-        updateConfig,
+        reconnect,
         updateModel,
         disconnect,
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@base44-preview/sdk",
-  "version": "0.8.48-pr.282.2b05017",
+  "version": "0.8.48-pr.282.3c9bac2",
   "description": "JavaScript SDK for Base44 API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",