@base44-preview/sdk 0.8.48-pr.282.6dd99a0 → 0.8.48-pr.282.6ea0687

package/dist/client.js

@@ -59,9 +59,7 @@ export function createClient(config) {
     // Normalize appBaseUrl to always be a string (empty if not provided or invalid)
     const normalizedAppBaseUrl = typeof appBaseUrl === "string" ? appBaseUrl : "";
     const embedOtt = takeEmbedTokenFromUrl();
-    // Asked again on every use, so a session that arrives later — from the
-    // exchange, or from a login — reaches the socket and every other module.
-    // A declaration, not a const, so this block can stay above the auth module.
+    // A declaration, not a const: this block sits above the auth module.
     function getToken() {
         var _a;
         return (_a = userAuthModule.getToken()) !== null && _a !== void 0 ? _a : (embedOtt ? null : getAccessToken());
@@ -82,9 +80,8 @@ export function createClient(config) {
         }
         return socket;
     };
-    // Apps read getAccessToken() as they load and pass the result in as `token`,
-    // so on an embedded load this is the OTT: proof of an identity, not one to
-    // send as a bearer. The exchange below is what turns it into a session.
+    // Apps pass getAccessToken() in as `token`, which in a frame is the OTT —
+    // what the exchange trades for a session, never a bearer itself.
     const token = embedOtt ? undefined : config.token;
     const headers = {
         ...optionalHeaders,
@@ -139,17 +136,15 @@ export function createClient(config) {
         serverUrl,
         token,
         embedded: Boolean(embedOtt),
-        // The socket carries its token on the handshake, so an identity change
-        // only reaches it by opening a new connection — or, on logout, by
-        // dropping the one still running as the user who just left.
+        // The socket carries its token on the handshake, so it can only pick a
+        // new one up by redialling — or, on logout, by dropping what it has.
         onSessionChange: (hasSession) => hasSession ? socket === null || socket === void 0 ? void 0 : socket.reconnect() : socket === null || socket === void 0 ? void 0 : socket.disconnect(),
     });
     // Apply the access token before any module that may issue authenticated
     // requests during construction (notably analytics, which fires an init
     // event whose flush calls auth.me()). Without this, the first User/me
     // request is built before setToken runs and goes out unauthenticated.
-    // Not in a frame: a stored token there belongs to an earlier visitor, not to
-    // this session, which only the exchange below can produce.
+    // Not in a frame: a stored token there belongs to an earlier visitor.
     if (typeof window !== "undefined" && !embedOtt) {
         const accessToken = token || getAccessToken();
         if (accessToken) {
@@ -159,9 +154,8 @@ export function createClient(config) {
     const session = embedOtt
         ? exchangeEmbedToken({ serverUrl, appId, ott: embedOtt })
         : null;
-    // Settles once the exchanged session is applied (memory only); at once
-    // otherwise. Never rejects: every request waits on it, so a failure here
-    // must not turn into a rejection on each of them.
+    // Never rejects: every request waits on it, so one failure here must not
+    // become a rejection on each of them.
     const authReady = session
         ? session
             .then((sessionToken) => {
@@ -170,8 +164,6 @@ export function createClient(config) {
                 userAuthModule.setToken(sessionToken, false);
                 return;
             }
-            // The app is about to run anonymous. Say why, once, instead of
-            // leaving only the 401s that follow.
             const error = new Error("Base44: the embed token was refused, so this app is not signed in.");
             console.error(error.message);
             (_a = options === null || options === void 0 ? void 0 : options.onError) === null || _a === void 0 ? void 0 : _a.call(options, error);
@@ -181,8 +173,8 @@ export function createClient(config) {
         })
         : Promise.resolve();
     if (session) {
-        // Requests issued during the exchange wait for it. Registered after createAxiosClient's
-        // interceptors so it runs first and the anonymous-visitor header sees the Authorization.
+        // Registered after createAxiosClient's so it runs first (axios unshifts),
+        // letting the anonymous-visitor header see the Authorization we just set.
         for (const client of [axiosClient, functionsAxiosClient]) {
             client.interceptors.request.use(async (requestConfig) => {
                 await authReady;
@@ -247,8 +239,7 @@ export function createClient(config) {
             getSocket,
             appId,
             serverUrl,
-            // Read synchronously, unlike everything else: these build a URL rather
-            // than issue a request, so during the exchange they see no token.
+            // Sync, unlike everything else: these return a URL, not a promise.
             getToken,
         }),
         aiGateway: createAiGatewayModule({ serverUrl, getToken, appId }),
@@ -296,9 +287,8 @@ export function createClient(config) {
             getSocket,
             appId,
             serverUrl,
-            // The user's token, as on the user-scoped module: the only thing this is
-            // read for is the `?token=` on a channel URL handed to that user, which
-            // the app's service credential must never end up in.
+            // The user's token, deliberately: this is read only for the `?token=` on
+            // a channel URL handed to that user. Never the service credential.
             getToken,
         }),
         aiGateway: createAiGatewayModule({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@base44-preview/sdk",
-  "version": "0.8.48-pr.282.6dd99a0",
+  "version": "0.8.48-pr.282.6ea0687",
   "description": "JavaScript SDK for Base44 API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",