@base44-preview/sdk 0.8.48-pr.282.2b05017 → 0.8.48-pr.282.60e9a18

package/dist/client.js

@@ -55,18 +55,22 @@ import { createActorsModule, resolveActorsHost, } from "./modules/actors.js";
  */
 export function createClient(config) {
     var _a, _b, _c, _d;
-    const { serverUrl = "https://base44.app", appId, analytics, token, serviceToken, requiresAuth = false, appBaseUrl, options, functionsVersion, headers: optionalHeaders, } = config;
+    const { serverUrl = "https://base44.app", appId, analytics, serviceToken, requiresAuth = false, appBaseUrl, options, functionsVersion, headers: optionalHeaders, } = config;
     // Normalize appBaseUrl to always be a string (empty if not provided or invalid)
     const normalizedAppBaseUrl = typeof appBaseUrl === "string" ? appBaseUrl : "";
     const inBrowser = typeof window !== "undefined";
     // A host platform embeds the app with a one-time token on the iframe URL.
     // It comes off the URL here, before any other code can read it; the
     // exchange that turns it into a session runs once the modules exist.
-    const embedOtt = inBrowser ? takeEmbedTokenFromUrl() : null;
-    const embedded = embedOtt !== null || (inBrowser && isEmbeddedTab());
+    const embedOtt = takeEmbedTokenFromUrl();
     if (embedOtt) {
         markEmbeddedTab();
     }
+    const embedded = Boolean(embedOtt) || isEmbeddedTab();
+    // What an app passes as `token` is whatever getAccessToken() returned as the
+    // page loaded. In an embedded frame that is the one-time token itself, or a
+    // token an earlier visitor left in storage; neither is this session.
+    const token = embedded ? undefined : config.token;
     let currentToken = token !== null && token !== void 0 ? token : null;
     const socketConfig = {
         serverUrl,
@@ -99,13 +103,13 @@ export function createClient(config) {
     const axiosClient = createAxiosClient({
         baseURL: `${serverUrl}/api`,
         headers,
-        token,
+        token: token,
         onError: options === null || options === void 0 ? void 0 : options.onError,
     });
     const functionsAxiosClient = createAxiosClient({
         baseURL: `${serverUrl}/api`,
         headers: functionHeaders,
-        token,
+        token: token,
         interceptResponses: false,
         onError: options === null || options === void 0 ? void 0 : options.onError,
     });
@@ -137,7 +141,7 @@ export function createClient(config) {
     const userAuthModule = createAuthModule(axiosClient, functionsAxiosClient, appId, {
         appBaseUrl: normalizedAppBaseUrl,
         serverUrl,
-        token,
+        token: token,
         embedded,
     });
     // Apply the access token before any module that may issue authenticated
@@ -160,7 +164,7 @@ export function createClient(config) {
         if (userAuthModule.hasToken()) {
             return currentToken;
         }
-        return embedded || !inBrowser ? null : getAccessToken();
+        return embedded ? null : getAccessToken();
     };
     const applyToken = (newToken, saveToStorage) => {
         userAuthModule.setToken(newToken, saveToStorage);

package/dist/utils/auth-utils.d.ts

@@ -5,6 +5,8 @@ import { GetAccessTokenOptions, SaveAccessTokenOptions, RemoveAccessTokenOptions
  * Low-level utility for manually retrieving tokens. In most cases, the Base44 client handles
  * token management automatically. This function is useful for custom authentication flows or when you need direct access to stored tokens. Requires a browser environment and can't be used in the backend.
  *
+ * When a host platform has embedded the app with a one-time token (`?ott=`), that token is returned as it stands: it is what {@linkcode createClient} trades for the session, so a page that gates on "is there a token?" as it loads sees one. It is neither stored nor removed from the URL here.
+ *
  * @internal
  *
  * @param options - Configuration options for token retrieval.

package/dist/utils/auth-utils.js

@@ -1,9 +1,12 @@
+import { EMBED_TOKEN_PARAM } from "./embed-session.js";
 /**
  * Retrieves an access token from URL parameters or local storage.
  *
  * Low-level utility for manually retrieving tokens. In most cases, the Base44 client handles
  * token management automatically. This function is useful for custom authentication flows or when you need direct access to stored tokens. Requires a browser environment and can't be used in the backend.
  *
+ * When a host platform has embedded the app with a one-time token (`?ott=`), that token is returned as it stands: it is what {@linkcode createClient} trades for the session, so a page that gates on "is there a token?" as it loads sees one. It is neither stored nor removed from the URL here.
+ *
  * @internal
  *
  * @param options - Configuration options for token retrieval.
@@ -56,6 +59,14 @@ export function getAccessToken(options = {}) {
                 }
                 return token;
             }
+            // A platform-embedded load carries a one-time token instead. It is not a
+            // session yet — createClient takes it off the URL and exchanges it — but
+            // it is the identity this load arrives with, and callers that read this
+            // once as the page loads must not conclude there is none.
+            const embedToken = urlParams.get(EMBED_TOKEN_PARAM);
+            if (embedToken) {
+                return embedToken;
+            }
         }
         catch (e) {
             console.error("Error retrieving token from URL:", e);

package/dist/utils/embed-session.d.ts

@@ -9,6 +9,8 @@
  *
  * @internal
  */
+/** The query parameter a host platform puts the one-time token on. @internal */
+export declare const EMBED_TOKEN_PARAM = "ott";
 /**
  * Reads the one-time token off the current URL and strips it, so it is never
  * left in the address bar, in history, or in a shared link.

package/dist/utils/embed-session.js

@@ -9,7 +9,8 @@
  *
  * @internal
  */
-const OTT_PARAM = "ott";
+/** The query parameter a host platform puts the one-time token on. @internal */
+export const EMBED_TOKEN_PARAM = "ott";
 const EMBED_TAB_KEY = "base44_embed_session";
 const GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange";
 const SUBJECT_TOKEN_TYPE = "urn:base44:params:oauth:token-type:embed-ott";
@@ -28,11 +29,11 @@ export function takeEmbedTokenFromUrl() {
     }
     try {
         const url = new URL(window.location.href);
-        const ott = url.searchParams.get(OTT_PARAM);
+        const ott = url.searchParams.get(EMBED_TOKEN_PARAM);
         if (!ott) {
             return null;
         }
-        url.searchParams.delete(OTT_PARAM);
+        url.searchParams.delete(EMBED_TOKEN_PARAM);
         window.history.replaceState(window.history.state, "", url.toString());
         return ott;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@base44-preview/sdk",
-  "version": "0.8.48-pr.282.2b05017",
+  "version": "0.8.48-pr.282.60e9a18",
   "description": "JavaScript SDK for Base44 API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",