@base44-preview/sdk 0.8.48-pr.282.2b05017 → 0.8.48-pr.282.520fd69

package/dist/client.js

@@ -5,7 +5,7 @@ import { createAuthModule } from "./modules/auth.js";
 import { createSsoModule } from "./modules/sso.js";
 import { createConnectorsModule, createUserConnectorsModule, } from "./modules/connectors.js";
 import { getAccessToken } from "./utils/auth-utils.js";
-import { exchangeEmbedToken, isEmbeddedTab, markEmbeddedTab, takeEmbedTokenFromUrl, } from "./utils/embed-session.js";
+import { exchangeEmbedToken, isEmbeddedTab, isFramed, markEmbeddedTab, takeEmbedTokenFromUrl, } from "./utils/embed-session.js";
 import { createFetchWithAuth } from "./utils/fetch-with-auth.js";
 import { createFunctionsModule } from "./modules/functions.js";
 import { createAgentsModule } from "./modules/agents.js";
@@ -55,37 +55,22 @@ import { createActorsModule, resolveActorsHost, } from "./modules/actors.js";
  */
 export function createClient(config) {
     var _a, _b, _c, _d;
-    const { serverUrl = "https://base44.app", appId, analytics, token, serviceToken, requiresAuth = false, appBaseUrl, options, functionsVersion, headers: optionalHeaders, } = config;
+    const { serverUrl = "https://base44.app", appId, analytics, serviceToken, requiresAuth = false, appBaseUrl, options, functionsVersion, headers: optionalHeaders, } = config;
     // Normalize appBaseUrl to always be a string (empty if not provided or invalid)
     const normalizedAppBaseUrl = typeof appBaseUrl === "string" ? appBaseUrl : "";
-    const inBrowser = typeof window !== "undefined";
-    // A host platform embeds the app with a one-time token on the iframe URL.
-    // It comes off the URL here, before any other code can read it; the
-    // exchange that turns it into a session runs once the modules exist.
-    const embedOtt = inBrowser ? takeEmbedTokenFromUrl() : null;
-    const embedded = embedOtt !== null || (inBrowser && isEmbeddedTab());
+    // Always taken off the URL, even outside a frame: a one-time token must not
+    // be left in the address bar, in history, or in a shared link.
+    const urlOtt = takeEmbedTokenFromUrl();
+    // Only redeemed inside a frame. Opened as a normal tab, the same URL falls
+    // back to the app's own login, which works there and cannot work in a frame.
+    const embedOtt = isFramed() ? urlOtt : null;
     if (embedOtt) {
         markEmbeddedTab();
     }
-    let currentToken = token !== null && token !== void 0 ? token : null;
-    const socketConfig = {
-        serverUrl,
-        mountPath: "/ws-user-apps/socket.io/",
-        transports: ["websocket"],
-        appId,
-        // null (not undefined): an embedded frame's only identity is the one the
-        // platform minted, so the socket must not fall back to a stored token.
-        token: embedded ? null : token,
-    };
-    let socket = null;
-    const getSocket = () => {
-        if (!socket) {
-            socket = RoomsSocket({
-                config: socketConfig,
-            });
-        }
-        return socket;
-    };
+    const embedded = Boolean(embedOtt) || isEmbeddedTab();
+    // The passed token is the OTT itself whenever one came in on the URL, and a
+    // stale stored one in a frame. Neither of those is this session.
+    const token = urlOtt !== null || embedded ? undefined : config.token;
     const headers = {
         ...optionalHeaders,
         "X-App-Id": String(appId),
@@ -144,46 +129,57 @@ export function createClient(config) {
     // requests during construction (notably analytics, which fires an init
     // event whose flush calls auth.me()). Without this, the first User/me
     // request is built before setToken runs and goes out unauthenticated.
-    // An embedded load skips this: its session comes from the exchange below,
-    // and a token an earlier visitor left in storage must not become it.
-    if (inBrowser && !embedded) {
+    // Skipped in a frame: the session comes from the exchange below.
+    if (typeof window !== "undefined" && !embedded) {
         const accessToken = token || getAccessToken();
         if (accessToken) {
-            currentToken = accessToken;
             userAuthModule.setToken(accessToken);
         }
     }
-    // The one answer every module reads. Follows setToken and logout; outside an
-    // embedded frame it still falls back to storage, so a login in another tab is
-    // picked up on the next connection, as before.
-    const getToken = () => {
-        if (userAuthModule.hasToken()) {
-            return currentToken;
+    // Live token for every module; outside a frame it still falls back to storage.
+    const getToken = () => { var _a; return (_a = userAuthModule.getToken()) !== null && _a !== void 0 ? _a : (embedded ? null : getAccessToken()); };
+    const socketConfig = {
+        serverUrl,
+        mountPath: "/ws-user-apps/socket.io/",
+        transports: ["websocket"],
+        appId,
+        getToken,
+    };
+    let socket = null;
+    const getSocket = () => {
+        if (!socket) {
+            socket = RoomsSocket({ config: socketConfig });
         }
-        return embedded || !inBrowser ? null : getAccessToken();
+        return socket;
     };
     const applyToken = (newToken, saveToStorage) => {
         userAuthModule.setToken(newToken, saveToStorage);
-        currentToken = newToken;
-        socketConfig.token = newToken;
-        if (socket) {
-            socket.updateConfig({ token: newToken });
-        }
+        socket === null || socket === void 0 ? void 0 : socket.reconnect();
     };
-    // Resolves once the embedded session is in hand (or known not to be coming);
-    // immediately for every other client. The exchanged token is applied without
-    // persisting it: the session must not outlive the frame it was minted for.
+    // Settles once the exchanged session is applied (memory only); at once
+    // otherwise. Never rejects: every request waits on it, so a failure here
+    // must not turn into a rejection on each of them.
     const authReady = embedOtt
-        ? exchangeEmbedToken({ serverUrl, appId, ott: embedOtt }).then((sessionToken) => {
+        ? exchangeEmbedToken({ serverUrl, appId, ott: embedOtt })
+            .then((sessionToken) => {
+            var _a;
             if (sessionToken) {
                 applyToken(sessionToken, false);
+                return;
             }
+            // The app is about to run anonymous. Say why, once, instead of
+            // leaving only the 401s that follow.
+            const error = new Error("Base44: the embed token was refused, so this app is not signed in.");
+            console.error(error.message);
+            (_a = options === null || options === void 0 ? void 0 : options.onError) === null || _a === void 0 ? void 0 : _a.call(options, error);
+        })
+            .catch((e) => {
+            console.error("Base44: applying the embedded session failed:", e);
         })
         : Promise.resolve();
     if (embedOtt) {
-        // Requests issued while the exchange is in flight wait for it and carry the
-        // session it produces. Registered after createAxiosClient's interceptors,
-        // so it runs first and the anonymous-visitor header sees the Authorization.
+        // Requests issued during the exchange wait for it. Registered after createAxiosClient's
+        // interceptors so it runs first and the anonymous-visitor header sees the Authorization.
         for (const client of [axiosClient, functionsAxiosClient]) {
             client.interceptors.request.use(async (requestConfig) => {
                 await authReady;

package/dist/modules/auth.js

@@ -82,10 +82,13 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
     // Tracked here rather than read off `axios.defaults` so the answer stays tied
     // to the identity transitions below (`setToken`, `logout`) instead of to the
     // header a caller may have set on the instance directly.
-    let hasAccessToken = Boolean(options.token);
+    let accessToken = options.token || null;
     return {
         hasToken() {
-            return hasAccessToken;
+            return accessToken !== null;
+        },
+        getToken() {
+            return accessToken;
         },
         isEmbedded() {
             return Boolean(options.embedded);
@@ -161,7 +164,7 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
             // flight would otherwise resolve into callers that run after the logout.
             clearPendingMe();
             resetAnalyticsSessionContext();
-            hasAccessToken = false;
+            accessToken = null;
             // Only do the rest if in a browser environment
             if (typeof window !== "undefined") {
                 // Remove token from localStorage
@@ -186,18 +189,20 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
         setToken(token, saveToStorage = true) {
             if (!token)
                 return;
+            // An embedded session belongs to the frame the platform minted it for.
+            // Persisting it would let it outlive that frame and be picked up as the
+            // identity on a later top-level visit, so storage is refused outright.
+            const persist = saveToStorage && !options.embedded;
             // Same reasoning as in `logout`: the identity changes here, so anything
             // resolved for the previous one must not be handed to later callers.
             clearPendingMe();
             resetAnalyticsSessionContext();
-            hasAccessToken = true;
+            accessToken = token;
             // handle token change for axios clients
             axios.defaults.headers.common["Authorization"] = `Bearer ${token}`;
             functionsAxiosClient.defaults.headers.common["Authorization"] = `Bearer ${token}`;
             // Save token to localStorage if requested
-            if (saveToStorage &&
-                typeof window !== "undefined" &&
-                window.localStorage) {
+            if (persist && typeof window !== "undefined" && window.localStorage) {
                 try {
                     window.localStorage.setItem("base44_access_token", token);
                     // Set "token" that is set by the built-in SDK of platform version 2

package/dist/modules/auth.types.d.ts

@@ -560,4 +560,9 @@ export interface InternalAuthModule extends AuthModule {
      * could not succeed without a session, not to decide that one is valid.
      */
     hasToken(): boolean;
+    /**
+     * The access token currently set on the client, or `null` when there is none.
+     * Follows {@linkcode AuthModule.setToken | setToken} and {@linkcode AuthModule.logout | logout}.
+     */
+    getToken(): string | null;
 }

package/dist/utils/auth-utils.d.ts

@@ -5,6 +5,8 @@ import { GetAccessTokenOptions, SaveAccessTokenOptions, RemoveAccessTokenOptions
  * Low-level utility for manually retrieving tokens. In most cases, the Base44 client handles
  * token management automatically. This function is useful for custom authentication flows or when you need direct access to stored tokens. Requires a browser environment and can't be used in the backend.
  *
+ * When a host platform has embedded the app with a one-time token (`?ott=`), that token is returned as it stands: it is what {@linkcode createClient} trades for the session, so a page that gates on "is there a token?" as it loads sees one. It is neither stored nor removed from the URL here.
+ *
  * @internal
  *
  * @param options - Configuration options for token retrieval.

package/dist/utils/auth-utils.js

@@ -1,9 +1,12 @@
+import { EMBED_TOKEN_PARAM } from "./embed-session.js";
 /**
  * Retrieves an access token from URL parameters or local storage.
  *
  * Low-level utility for manually retrieving tokens. In most cases, the Base44 client handles
  * token management automatically. This function is useful for custom authentication flows or when you need direct access to stored tokens. Requires a browser environment and can't be used in the backend.
  *
+ * When a host platform has embedded the app with a one-time token (`?ott=`), that token is returned as it stands: it is what {@linkcode createClient} trades for the session, so a page that gates on "is there a token?" as it loads sees one. It is neither stored nor removed from the URL here.
+ *
  * @internal
  *
  * @param options - Configuration options for token retrieval.
@@ -56,6 +59,14 @@ export function getAccessToken(options = {}) {
                 }
                 return token;
             }
+            // A platform-embedded load carries a one-time token instead. It is not a
+            // session yet — createClient takes it off the URL and exchanges it — but
+            // it is the identity this load arrives with, and callers that read this
+            // once as the page loads must not conclude there is none.
+            const embedToken = urlParams.get(EMBED_TOKEN_PARAM);
+            if (embedToken) {
+                return embedToken;
+            }
         }
         catch (e) {
             console.error("Error retrieving token from URL:", e);

package/dist/utils/embed-session.d.ts

@@ -9,6 +9,8 @@
  *
  * @internal
  */
+/** The query parameter a host platform puts the one-time token on. @internal */
+export declare const EMBED_TOKEN_PARAM = "ott";
 /**
  * Reads the one-time token off the current URL and strips it, so it is never
  * left in the address bar, in history, or in a shared link.
@@ -16,6 +18,14 @@
  * @internal
  */
 export declare function takeEmbedTokenFromUrl(): string | null;
+/**
+ * Whether this document is rendered inside a frame. Read at call time, not at
+ * import: a module-level answer would be fixed before a host (or a test) has
+ * set the window up.
+ *
+ * @internal
+ */
+export declare function isFramed(): boolean;
 /**
  * Whether this tab previously redeemed an embed token. Counts only inside a
  * frame: a top-level tab that once carried a token must fall back to the
@@ -40,8 +50,9 @@ export declare function exchangeEmbedToken({ serverUrl, appId, ott, fetchImpl, }
 }): Promise<string | null>;
 /**
  * Covers the page with a plain "session ended" notice. An embedded session can
- * only be renewed by the host platform (by reloading its own page), so this
- * stands in for the login redirect, which cannot complete inside a frame.
+ * only be renewed by the host platform, so this stands in for the login
+ * redirect, which cannot complete inside a frame. The copy points at the host
+ * page: reloading the frame itself carries no token and lands here again.
  *
  * @internal
  */

package/dist/utils/embed-session.js

@@ -9,7 +9,8 @@
  *
  * @internal
  */
-const OTT_PARAM = "ott";
+/** The query parameter a host platform puts the one-time token on. @internal */
+export const EMBED_TOKEN_PARAM = "ott";
 const EMBED_TAB_KEY = "base44_embed_session";
 const GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange";
 const SUBJECT_TOKEN_TYPE = "urn:base44:params:oauth:token-type:embed-ott";
@@ -26,19 +27,43 @@ export function takeEmbedTokenFromUrl() {
     if (typeof window === "undefined" || !window.location) {
         return null;
     }
+    let ott = null;
     try {
         const url = new URL(window.location.href);
-        const ott = url.searchParams.get(OTT_PARAM);
+        ott = url.searchParams.get(EMBED_TOKEN_PARAM);
         if (!ott) {
             return null;
         }
-        url.searchParams.delete(OTT_PARAM);
+        url.searchParams.delete(EMBED_TOKEN_PARAM);
         window.history.replaceState(window.history.state, "", url.toString());
-        return ott;
     }
     catch (e) {
+        // The token was read but the URL could not be rewritten (history blocked,
+        // a sandboxed frame, replaceState rate-limited). Return it anyway: it is
+        // this load's identity, and dropping it here would leave `?ott=` on the
+        // URL for getAccessToken to hand back as if it were a session token.
         console.error("Error retrieving embed token from URL:", e);
-        return null;
+    }
+    return ott;
+}
+/**
+ * Whether this document is rendered inside a frame. Read at call time, not at
+ * import: a module-level answer would be fixed before a host (or a test) has
+ * set the window up.
+ *
+ * @internal
+ */
+export function isFramed() {
+    if (typeof window === "undefined") {
+        return false;
+    }
+    try {
+        return window.self !== window.top;
+    }
+    catch (_a) {
+        // Reaching the top window can be refused outright; if we cannot see it,
+        // we are certainly not it.
+        return true;
     }
 }
 /**
@@ -55,8 +80,7 @@ export function isEmbeddedTab() {
     // A cross-site frame is third-party storage, which some browsers block
     // outright — every access can throw, and the marker is then unavailable.
     try {
-        return (window.self !== window.top &&
-            window.sessionStorage.getItem(EMBED_TAB_KEY) === "1");
+        return isFramed() && window.sessionStorage.getItem(EMBED_TAB_KEY) === "1";
     }
     catch (_a) {
         return false;
@@ -107,8 +131,9 @@ export async function exchangeEmbedToken({ serverUrl, appId, ott, fetchImpl = fe
 }
 /**
  * Covers the page with a plain "session ended" notice. An embedded session can
- * only be renewed by the host platform (by reloading its own page), so this
- * stands in for the login redirect, which cannot complete inside a frame.
+ * only be renewed by the host platform, so this stands in for the login
+ * redirect, which cannot complete inside a frame. The copy points at the host
+ * page: reloading the frame itself carries no token and lands here again.
  *
  * @internal
  */
@@ -130,7 +155,7 @@ export function showEmbedSessionEnded() {
     title.textContent = "Session ended";
     title.style.cssText = "font-size:1.5rem;font-weight:700;margin:0 0 .75rem;";
     const body = document.createElement("p");
-    body.textContent = "Refresh the page to continue.";
+    body.textContent = "Reload this page in your browser to start a new session.";
     body.style.cssText = "margin:0;color:#475569;";
     const card = document.createElement("div");
     card.append(title, body);

package/dist/utils/socket-utils.d.ts

@@ -4,9 +4,8 @@ export interface RoomsSocketConfig {
     mountPath: string;
     transports: string[];
     appId: string;
-    /** `undefined` means unknown — the socket looks in storage; `null` means
-     * known to be anonymous, so storage is never consulted. */
-    token?: string | null;
+    /** Asked on every connect, so the socket always carries the current session. */
+    getToken: () => string | null;
 }
 export type TSocketRoom = string;
 export type TJsonStr = string;
@@ -42,7 +41,7 @@ export declare function RoomsSocket({ config }: {
         leave: (room: string) => void;
     }>;
     subscribeToRoom: (room: TSocketRoom, handlers: Partial<{ [k in TEvent]: THandler<k>; }>) => () => void;
-    updateConfig: (config: Partial<RoomsSocketConfig>) => void;
+    reconnect: () => void;
     updateModel: (room: string, data: any) => Promise<void>;
     disconnect: () => void;
 };

package/dist/utils/socket-utils.js

@@ -1,5 +1,4 @@
 import { io } from "socket.io-client";
-import { getAccessToken } from "./auth-utils.js";
 import { getAnalyticsSessionId } from "../modules/analytics.js";
 const ROOM_LEAVE_GRACE_MS = 250;
 function initializeSocket(config, handlers) {
@@ -7,7 +6,7 @@ function initializeSocket(config, handlers) {
     // handshake so the backend can verify room access for anonymous agent
     // conversations (mirrors the X-Base44-Anonymous-Id HTTP header). Authenticated
     // clients are identified by their token instead.
-    const resolvedToken = config.token === undefined ? getAccessToken() : config.token;
+    const resolvedToken = config.getToken();
     const query = {
         app_id: config.appId,
         token: resolvedToken,
@@ -41,7 +40,6 @@ function initializeSocket(config, handlers) {
     return socket;
 }
 export function RoomsSocket({ config }) {
-    let currentConfig = { ...config };
     const roomsToListeners = {};
     const pendingRoomLeaves = {};
     const handlers = {
@@ -83,13 +81,10 @@ export function RoomsSocket({ config }) {
             socket.disconnect();
         }
     }
-    function updateConfig(config) {
+    /** Drops the connection and opens a new one with the current token. */
+    function reconnect() {
         cleanup();
-        currentConfig = {
-            ...currentConfig,
-            ...config,
-        };
-        socket = initializeSocket(currentConfig, handlers);
+        socket = initializeSocket(config, handlers);
     }
     function joinRoom(room) {
         socket.emit("join", room);
@@ -162,7 +157,7 @@ export function RoomsSocket({ config }) {
     return {
         socket,
         subscribeToRoom,
-        updateConfig,
+        reconnect,
         updateModel,
         disconnect,
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@base44-preview/sdk",
-  "version": "0.8.48-pr.282.2b05017",
+  "version": "0.8.48-pr.282.520fd69",
   "description": "JavaScript SDK for Base44 API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",