@base44-preview/sdk 0.8.48-pr.282.7c5a459 → 0.8.48-pr.282.86ef42a

package/dist/client.js

@@ -5,7 +5,7 @@ import { createAuthModule } from "./modules/auth.js";
 import { createSsoModule } from "./modules/sso.js";
 import { createConnectorsModule, createUserConnectorsModule, } from "./modules/connectors.js";
 import { getAccessToken } from "./utils/auth-utils.js";
-import { exchangeEmbedToken, frameSession, takeEmbedTokenFromUrl, } from "./utils/embed-session.js";
+import { exchangeEmbedToken, takeEmbedTokenFromUrl, } from "./utils/embed-session.js";
 import { createFetchWithAuth } from "./utils/fetch-with-auth.js";
 import { createFunctionsModule } from "./modules/functions.js";
 import { createAgentsModule } from "./modules/agents.js";
@@ -59,7 +59,32 @@ export function createClient(config) {
     // Normalize appBaseUrl to always be a string (empty if not provided or invalid)
     const normalizedAppBaseUrl = typeof appBaseUrl === "string" ? appBaseUrl : "";
     const embedOtt = takeEmbedTokenFromUrl();
-    // In a frame the caller's token is the OTT itself, which is not a session.
+    // Asked again on every use, so a session that arrives later — from the
+    // exchange, or from a login — reaches the socket and every other module.
+    // A declaration, not a const, so this block can stay above the auth module.
+    function getToken() {
+        var _a;
+        return (_a = userAuthModule.getToken()) !== null && _a !== void 0 ? _a : (embedOtt ? null : getAccessToken());
+    }
+    const socketConfig = {
+        serverUrl,
+        mountPath: "/ws-user-apps/socket.io/",
+        transports: ["websocket"],
+        appId,
+        getToken,
+    };
+    let socket = null;
+    const getSocket = () => {
+        if (!socket) {
+            socket = RoomsSocket({
+                config: socketConfig,
+            });
+        }
+        return socket;
+    };
+    // Apps read getAccessToken() as they load and pass the result in as `token`,
+    // so on an embedded load this is the OTT: proof of an identity, not one to
+    // send as a bearer. The exchange below is what turns it into a session.
     const token = embedOtt ? undefined : config.token;
     const headers = {
         ...optionalHeaders,
@@ -109,9 +134,6 @@ export function createClient(config) {
         baseURL: `${serverUrl}/api`,
         headers,
     });
-    // Declared before the auth module so `onSessionChange` can reach it; the
-    // socket itself is still only built on first use, below.
-    let socket = null;
     const userAuthModule = createAuthModule(axiosClient, functionsAxiosClient, appId, {
         appBaseUrl: normalizedAppBaseUrl,
         serverUrl,
@@ -134,27 +156,9 @@ export function createClient(config) {
             userAuthModule.setToken(accessToken);
         }
     }
-    // Live token for every module; outside a frame it still falls back to storage.
-    const getToken = () => { var _a; return (_a = userAuthModule.getToken()) !== null && _a !== void 0 ? _a : (embedOtt ? null : getAccessToken()); };
-    const socketConfig = {
-        serverUrl,
-        mountPath: "/ws-user-apps/socket.io/",
-        transports: ["websocket"],
-        appId,
-        getToken,
-    };
-    const getSocket = () => {
-        if (!socket) {
-            socket = RoomsSocket({ config: socketConfig });
-        }
-        return socket;
-    };
-    // The exchange belongs to the frame, not to one client: the token is off the
-    // URL after the first `createClient`, so a second one in the same document
-    // joins the session already being negotiated rather than going anonymous.
     const session = embedOtt
-        ? frameSession(appId, () => exchangeEmbedToken({ serverUrl, appId, ott: embedOtt }))
-        : frameSession(appId);
+        ? exchangeEmbedToken({ serverUrl, appId, ott: embedOtt })
+        : null;
     // Settles once the exchanged session is applied (memory only); at once
     // otherwise. Never rejects: every request waits on it, so a failure here
     // must not turn into a rejection on each of them.

package/dist/modules/actors.d.ts

@@ -11,8 +11,9 @@ interface ActorsConfig {
     appId: string;
     /** Current user access token, if authenticated. Rides the WS query on the
      * proxy-fallback path so the platform proxy can authenticate the connection;
-     * anonymous connects omit it. */
-    getAuthToken(): string | null | undefined | Promise<string | null | undefined>;
+     * anonymous connects omit it. Awaited per dial, so a session still being
+     * exchanged is in hand before the URL is built. */
+    getAuthToken(): Promise<string | null | undefined>;
     /** Same semantics as function calls: editors with a non-prod version get the
      * draft actor script; everyone else gets the published one. */
     functionsVersion?: string;

package/dist/modules/agents.types.d.ts

@@ -161,7 +161,7 @@ export interface AgentsModuleConfig {
     /** Server URL */
     serverUrl?: string;
     /** Returns the current authentication token, if any */
-    getToken: () => string | null | undefined;
+    getToken: () => string | null;
 }
 /**
  * Agents module for managing AI agent conversations.
@@ -360,7 +360,9 @@ export interface AgentsModule {
      * Gets WhatsApp connection URL for an agent.
      *
      * Generates a URL that users can use to connect with the agent through WhatsApp.
-     * The URL includes authentication if a token is available.
+     * The URL includes authentication if a token is available. In an app a
+     * platform has embedded, that is only once the session has been exchanged —
+     * await a call such as `base44.auth.me()` before building the URL.
      *
      * @param agentName - The name of the agent.
      * @returns WhatsApp connection URL.
@@ -378,7 +380,9 @@ export interface AgentsModule {
      * Gets Telegram connection URL for an agent.
      *
      * Generates a URL that users can use to connect with the agent through Telegram.
-     * The URL includes authentication if a token is available. When the user opens
+     * The URL includes authentication if a token is available. In an app a
+     * platform has embedded, that is only once the session has been exchanged —
+     * await a call such as `base44.auth.me()` before building the URL. When the user opens
      * this URL, they are redirected to the agent's Telegram bot with an activation
      * code that securely links their account.
      *

package/dist/utils/embed-session.d.ts

@@ -9,7 +9,9 @@
  *
  * Taking the token off the URL is unconditional — a one-time token must not be
  * left in the address bar, in history, or in a shared link — but it is only
- * reported back inside a frame, the only place one is redeemed.
+ * reported back inside a frame, the only place one is redeemed. It is gone once
+ * the first client has taken it, so the session belongs to that client — an app
+ * creates one.
  *
  * The exchange endpoint is rate limited per app, and its limiter refuses before
  * the one-time token is redeemed — so a 429 leaves the token still valid and is
@@ -19,8 +21,6 @@
  */
 export declare const EMBED_TOKEN_PARAM = "ott";
 /** @internal */
-export declare function frameSession(appId: string, start?: () => Promise<string | null>): Promise<string | null> | null;
-/** @internal */
 export declare function takeEmbedTokenFromUrl(): string | null;
 /** @internal */
 export declare function isFramed(): boolean;

package/dist/utils/embed-session.js

@@ -9,7 +9,9 @@
  *
  * Taking the token off the URL is unconditional — a one-time token must not be
  * left in the address bar, in history, or in a shared link — but it is only
- * reported back inside a frame, the only place one is redeemed.
+ * reported back inside a frame, the only place one is redeemed. It is gone once
+ * the first client has taken it, so the session belongs to that client — an app
+ * creates one.
  *
  * The exchange endpoint is rate limited per app, and its limiter refuses before
  * the one-time token is redeemed — so a 429 leaves the token still valid and is
@@ -24,20 +26,6 @@ const RATE_LIMITED = 429;
 const RATE_LIMIT_RETRY_MS = 1000;
 const EXCHANGE_TIMEOUT_MS = 15000;
 const SESSION_ENDED_ELEMENT_ID = "base44-embed-session-ended";
-const FRAME_SESSIONS_KEY = "__base44EmbedSessions";
-/** @internal */
-export function frameSession(appId, start) {
-    var _a, _b;
-    var _c;
-    if (typeof window === "undefined") {
-        return start ? start() : null;
-    }
-    const sessions = ((_a = (_c = window)[FRAME_SESSIONS_KEY]) !== null && _a !== void 0 ? _a : (_c[FRAME_SESSIONS_KEY] = {}));
-    if (!sessions[appId] && start) {
-        sessions[appId] = start();
-    }
-    return (_b = sessions[appId]) !== null && _b !== void 0 ? _b : null;
-}
 /** @internal */
 export function takeEmbedTokenFromUrl() {
     if (typeof window === "undefined" || !window.location) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@base44-preview/sdk",
-  "version": "0.8.48-pr.282.7c5a459",
+  "version": "0.8.48-pr.282.86ef42a",
   "description": "JavaScript SDK for Base44 API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",