@base44-preview/sdk 0.8.48-pr.282.2b05017 → 0.8.48-pr.282.8affbe6

package/dist/client.js

@@ -67,7 +67,11 @@ export function createClient(config) {
     if (embedOtt) {
         markEmbeddedTab();
     }
-    let currentToken = token !== null && token !== void 0 ? token : null;
+    // What an app passes as `token` is whatever getAccessToken() returned as the
+    // page loaded. In an embedded frame that is the one-time token itself, or a
+    // token an earlier visitor left in storage; neither is this session.
+    const configToken = embedded ? undefined : token;
+    let currentToken = configToken !== null && configToken !== void 0 ? configToken : null;
     const socketConfig = {
         serverUrl,
         mountPath: "/ws-user-apps/socket.io/",
@@ -75,7 +79,7 @@ export function createClient(config) {
         appId,
         // null (not undefined): an embedded frame's only identity is the one the
         // platform minted, so the socket must not fall back to a stored token.
-        token: embedded ? null : token,
+        token: embedded ? null : configToken,
     };
     let socket = null;
     const getSocket = () => {
@@ -99,19 +103,19 @@ export function createClient(config) {
     const axiosClient = createAxiosClient({
         baseURL: `${serverUrl}/api`,
         headers,
-        token,
+        token: configToken,
         onError: options === null || options === void 0 ? void 0 : options.onError,
     });
     const functionsAxiosClient = createAxiosClient({
         baseURL: `${serverUrl}/api`,
         headers: functionHeaders,
-        token,
+        token: configToken,
         interceptResponses: false,
         onError: options === null || options === void 0 ? void 0 : options.onError,
     });
     const serviceRoleHeaders = {
         ...headers,
-        ...(token ? { "on-behalf-of": `Bearer ${token}` } : {}),
+        ...(configToken ? { "on-behalf-of": `Bearer ${configToken}` } : {}),
     };
     const serviceRoleAxiosClient = createAxiosClient({
         baseURL: `${serverUrl}/api`,
@@ -137,7 +141,7 @@ export function createClient(config) {
     const userAuthModule = createAuthModule(axiosClient, functionsAxiosClient, appId, {
         appBaseUrl: normalizedAppBaseUrl,
         serverUrl,
-        token,
+        token: configToken,
         embedded,
     });
     // Apply the access token before any module that may issue authenticated
@@ -147,7 +151,7 @@ export function createClient(config) {
     // An embedded load skips this: its session comes from the exchange below,
     // and a token an earlier visitor left in storage must not become it.
     if (inBrowser && !embedded) {
-        const accessToken = token || getAccessToken();
+        const accessToken = configToken || getAccessToken();
         if (accessToken) {
             currentToken = accessToken;
             userAuthModule.setToken(accessToken);

package/dist/utils/auth-utils.d.ts

@@ -5,6 +5,8 @@ import { GetAccessTokenOptions, SaveAccessTokenOptions, RemoveAccessTokenOptions
  * Low-level utility for manually retrieving tokens. In most cases, the Base44 client handles
  * token management automatically. This function is useful for custom authentication flows or when you need direct access to stored tokens. Requires a browser environment and can't be used in the backend.
  *
+ * When a host platform has embedded the app with a one-time token (`?ott=`), that token is returned as it stands: it is what {@linkcode createClient} trades for the session, so a page that gates on "is there a token?" as it loads sees one. It is neither stored nor removed from the URL here.
+ *
  * @internal
  *
  * @param options - Configuration options for token retrieval.

package/dist/utils/auth-utils.js

@@ -1,9 +1,12 @@
+import { EMBED_TOKEN_PARAM } from "./embed-session.js";
 /**
  * Retrieves an access token from URL parameters or local storage.
  *
  * Low-level utility for manually retrieving tokens. In most cases, the Base44 client handles
  * token management automatically. This function is useful for custom authentication flows or when you need direct access to stored tokens. Requires a browser environment and can't be used in the backend.
  *
+ * When a host platform has embedded the app with a one-time token (`?ott=`), that token is returned as it stands: it is what {@linkcode createClient} trades for the session, so a page that gates on "is there a token?" as it loads sees one. It is neither stored nor removed from the URL here.
+ *
  * @internal
  *
  * @param options - Configuration options for token retrieval.
@@ -56,6 +59,14 @@ export function getAccessToken(options = {}) {
                 }
                 return token;
             }
+            // A platform-embedded load carries a one-time token instead. It is not a
+            // session yet — createClient takes it off the URL and exchanges it — but
+            // it is the identity this load arrives with, and callers that read this
+            // once as the page loads must not conclude there is none.
+            const embedToken = urlParams.get(EMBED_TOKEN_PARAM);
+            if (embedToken) {
+                return embedToken;
+            }
         }
         catch (e) {
             console.error("Error retrieving token from URL:", e);

package/dist/utils/embed-session.d.ts

@@ -9,6 +9,8 @@
  *
  * @internal
  */
+/** The query parameter a host platform puts the one-time token on. @internal */
+export declare const EMBED_TOKEN_PARAM = "ott";
 /**
  * Reads the one-time token off the current URL and strips it, so it is never
  * left in the address bar, in history, or in a shared link.

package/dist/utils/embed-session.js

@@ -9,7 +9,8 @@
  *
  * @internal
  */
-const OTT_PARAM = "ott";
+/** The query parameter a host platform puts the one-time token on. @internal */
+export const EMBED_TOKEN_PARAM = "ott";
 const EMBED_TAB_KEY = "base44_embed_session";
 const GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange";
 const SUBJECT_TOKEN_TYPE = "urn:base44:params:oauth:token-type:embed-ott";
@@ -28,11 +29,11 @@ export function takeEmbedTokenFromUrl() {
     }
     try {
         const url = new URL(window.location.href);
-        const ott = url.searchParams.get(OTT_PARAM);
+        const ott = url.searchParams.get(EMBED_TOKEN_PARAM);
         if (!ott) {
             return null;
         }
-        url.searchParams.delete(OTT_PARAM);
+        url.searchParams.delete(EMBED_TOKEN_PARAM);
         window.history.replaceState(window.history.state, "", url.toString());
         return ott;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@base44-preview/sdk",
-  "version": "0.8.48-pr.282.2b05017",
+  "version": "0.8.48-pr.282.8affbe6",
   "description": "JavaScript SDK for Base44 API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",