@base44-preview/sdk 0.8.48-pr.282.c69fdcd → 0.8.48-pr.282.d56486f

package/dist/client.js

@@ -5,7 +5,7 @@ import { createAuthModule } from "./modules/auth.js";
 import { createSsoModule } from "./modules/sso.js";
 import { createConnectorsModule, createUserConnectorsModule, } from "./modules/connectors.js";
 import { getAccessToken } from "./utils/auth-utils.js";
-import { exchangeEmbedToken, isEmbeddedTab, markEmbeddedTab, takeEmbedTokenFromUrl, } from "./utils/embed-session.js";
+import { exchangeEmbedToken, frameSession, isFramed, takeEmbedTokenFromUrl, } from "./utils/embed-session.js";
 import { createFetchWithAuth } from "./utils/fetch-with-auth.js";
 import { createFunctionsModule } from "./modules/functions.js";
 import { createAgentsModule } from "./modules/agents.js";
@@ -58,33 +58,16 @@ export function createClient(config) {
     const { serverUrl = "https://base44.app", appId, analytics, serviceToken, requiresAuth = false, appBaseUrl, options, functionsVersion, headers: optionalHeaders, } = config;
     // Normalize appBaseUrl to always be a string (empty if not provided or invalid)
     const normalizedAppBaseUrl = typeof appBaseUrl === "string" ? appBaseUrl : "";
-    const embedOtt = takeEmbedTokenFromUrl();
-    if (embedOtt) {
-        markEmbeddedTab();
-    }
-    const embedded = Boolean(embedOtt) || isEmbeddedTab();
-    // What an app passes as `token` is whatever getAccessToken() returned as the
-    // page loaded. In an embedded frame that is the one-time token itself, or a
-    // token an earlier visitor left in storage; neither is this session.
-    const token = embedded ? undefined : config.token;
-    const socketConfig = {
-        serverUrl,
-        mountPath: "/ws-user-apps/socket.io/",
-        transports: ["websocket"],
-        appId,
-        // null (not undefined): an embedded frame's only identity is the one the
-        // platform minted, so the socket must not fall back to a stored token.
-        token: embedded ? null : token,
-    };
-    let socket = null;
-    const getSocket = () => {
-        if (!socket) {
-            socket = RoomsSocket({
-                config: socketConfig,
-            });
-        }
-        return socket;
-    };
+    // Always taken off the URL, even outside a frame: a one-time token must not
+    // be left in the address bar, in history, or in a shared link.
+    const urlOtt = takeEmbedTokenFromUrl();
+    // Only redeemed inside a frame. Opened as a normal tab, the same URL falls
+    // back to the app's own login, which works there and cannot work in a frame.
+    const embedOtt = isFramed() ? urlOtt : null;
+    const embedded = Boolean(embedOtt);
+    // The passed token is the OTT itself whenever one came in on the URL. That is
+    // not this session: it is what the exchange below trades for one.
+    const token = urlOtt !== null ? undefined : config.token;
     const headers = {
         ...optionalHeaders,
         "X-App-Id": String(appId),
@@ -133,49 +116,90 @@ export function createClient(config) {
         baseURL: `${serverUrl}/api`,
         headers,
     });
+    // Declared before the auth module so `onSessionChange` can reach it; the
+    // socket itself is still only built on first use, below.
+    let socket = null;
     const userAuthModule = createAuthModule(axiosClient, functionsAxiosClient, appId, {
         appBaseUrl: normalizedAppBaseUrl,
         serverUrl,
         token,
         embedded,
+        // The socket carries its token on the handshake, so an identity change
+        // only reaches it by opening a new connection — or, on logout, by
+        // dropping the one still running as the user who just left.
+        onSessionChange: (hasSession) => hasSession ? socket === null || socket === void 0 ? void 0 : socket.reconnect() : socket === null || socket === void 0 ? void 0 : socket.disconnect(),
     });
     // Apply the access token before any module that may issue authenticated
     // requests during construction (notably analytics, which fires an init
     // event whose flush calls auth.me()). Without this, the first User/me
     // request is built before setToken runs and goes out unauthenticated.
-    // An embedded load skips this: its session comes from the exchange below,
-    // and a token an earlier visitor left in storage must not become it.
+    // Skipped in a frame: the session comes from the exchange below.
     if (typeof window !== "undefined" && !embedded) {
         const accessToken = token || getAccessToken();
         if (accessToken) {
             userAuthModule.setToken(accessToken);
         }
     }
-    // The one answer every module reads. Follows setToken and logout; outside an
-    // embedded frame it still falls back to storage, so a login in another tab is
-    // picked up on the next connection, as before.
+    // Live token for every module; outside a frame it still falls back to storage.
     const getToken = () => { var _a; return (_a = userAuthModule.getToken()) !== null && _a !== void 0 ? _a : (embedded ? null : getAccessToken()); };
-    const applyToken = (newToken, saveToStorage) => {
-        userAuthModule.setToken(newToken, saveToStorage);
-        socketConfig.token = newToken;
-        if (socket) {
-            socket.updateConfig({ token: newToken });
+    const socketConfig = {
+        serverUrl,
+        mountPath: "/ws-user-apps/socket.io/",
+        transports: ["websocket"],
+        appId,
+        getToken,
+    };
+    const getSocket = () => {
+        if (!socket) {
+            socket = RoomsSocket({ config: socketConfig });
         }
+        return socket;
     };
-    // Resolves once the embedded session is in hand (or known not to be coming);
-    // immediately for every other client. The exchanged token is applied without
-    // persisting it: the session must not outlive the frame it was minted for.
-    const authReady = embedOtt
-        ? exchangeEmbedToken({ serverUrl, appId, ott: embedOtt }).then((sessionToken) => {
+    // The exchange belongs to the frame, not to one client: the token is off the
+    // URL after the first `createClient`, so a second one in the same document
+    // joins the session already being negotiated rather than going anonymous.
+    const session = embedOtt
+        ? frameSession(appId, () => exchangeEmbedToken({ serverUrl, appId, ott: embedOtt }))
+        : frameSession(appId);
+    // Settles once the exchanged session is applied (memory only); at once
+    // otherwise. Never rejects: every request waits on it, so a failure here
+    // must not turn into a rejection on each of them.
+    const authReady = session
+        ? session
+            .then((sessionToken) => {
+            var _a;
             if (sessionToken) {
-                applyToken(sessionToken, false);
+                userAuthModule.setToken(sessionToken, false);
+                return;
             }
+            // The app is about to run anonymous. Say why, once, instead of
+            // leaving only the 401s that follow.
+            const error = new Error("Base44: the embed token was refused, so this app is not signed in.");
+            console.error(error.message);
+            (_a = options === null || options === void 0 ? void 0 : options.onError) === null || _a === void 0 ? void 0 : _a.call(options, error);
+        })
+            .catch((e) => {
+            console.error("Base44: applying the embedded session failed:", e);
         })
         : Promise.resolve();
-    if (embedOtt) {
-        // Requests issued while the exchange is in flight wait for it and carry the
-        // session it produces. Registered after createAxiosClient's interceptors,
-        // so it runs first and the anonymous-visitor header sees the Authorization.
+    // Everything that can wait for the session does. `aiGateway.connection()`
+    // and the agents connect URLs cannot: they hand back a value, not a promise,
+    // and a value read now would stay wrong after the session arrives. They warn
+    // instead of failing quietly.
+    let warnedEarlyRead = false;
+    const getTokenNow = () => {
+        const sessionToken = getToken();
+        if (sessionToken === null && session && !warnedEarlyRead) {
+            warnedEarlyRead = true;
+            console.warn("Base44: read a token before the embedded session was ready, so it is " +
+                "empty. Await a call such as base44.auth.me() before building a " +
+                "client or a URL that keeps the token.");
+        }
+        return sessionToken;
+    };
+    if (session) {
+        // Requests issued during the exchange wait for it. Registered after createAxiosClient's
+        // interceptors so it runs first and the anonymous-visitor header sees the Authorization.
         for (const client of [axiosClient, functionsAxiosClient]) {
             client.interceptors.request.use(async (requestConfig) => {
                 await authReady;
@@ -193,7 +217,10 @@ export function createClient(config) {
         // URL needs an absolute host, so fall back to the page origin.
         host: resolveActorsHost(serverUrl, typeof window !== "undefined" ? (_a = window.location) === null || _a === void 0 ? void 0 : _a.origin : undefined),
         functionsVersion,
-        getAuthToken: getToken,
+        getAuthToken: async () => {
+            await authReady;
+            return getToken();
+        },
         mintConnectionToken: async (actorName, room, connectionId) => {
             await authReady;
             const authToken = getToken();
@@ -221,6 +248,7 @@ export function createClient(config) {
         connectors: createUserConnectorsModule(axiosClient, appId),
         auth: userAuthModule,
         functions: createFunctionsModule(functionsAxiosClient, appId, {
+            waitForAuth: () => authReady,
             getAuthHeaders: () => {
                 const headers = {};
                 const sessionToken = getToken();
@@ -236,9 +264,13 @@ export function createClient(config) {
             getSocket,
             appId,
             serverUrl,
-            getToken,
+            getToken: getTokenNow,
+        }),
+        aiGateway: createAiGatewayModule({
+            serverUrl,
+            getToken: getTokenNow,
+            appId,
         }),
-        aiGateway: createAiGatewayModule({ serverUrl, getToken, appId }),
         appLogs: createAppLogsModule(axiosClient, appId),
         app: createAppModule(axiosClient, appId),
         users: createUsersModule(axiosClient, appId),
@@ -283,7 +315,10 @@ export function createClient(config) {
             getSocket,
             appId,
             serverUrl,
-            getToken: () => token,
+            // The user's token, as on the user-scoped module: the only thing this is
+            // read for is the `?token=` on a channel URL handed to that user, which
+            // the app's service credential must never end up in.
+            getToken: getTokenNow,
         }),
         aiGateway: createAiGatewayModule({
             serverUrl,
@@ -324,12 +359,12 @@ export function createClient(config) {
             serverUrl,
             functionsVersion,
             platformHeaders: optionalHeaders,
+            waitForAuth: () => authReady,
         }),
         /**
          * Sets a new authentication token for all subsequent requests.
          *
          * @param newToken - The new authentication token
-         * @param saveToStorage - Whether to also keep the token in local storage. Defaults to `true`.
          *
          * @example
          * ```typescript
@@ -341,8 +376,8 @@ export function createClient(config) {
          * base44.setToken(access_token);
          * ```
          */
-        setToken(newToken, saveToStorage = true) {
-            applyToken(newToken, saveToStorage);
+        setToken(newToken) {
+            userAuthModule.setToken(newToken, true);
         },
         /**
          * Gets the current client configuration.

package/dist/client.types.d.ts

@@ -200,9 +200,8 @@ export interface Base44Client {
      * Updates the token for both HTTP requests and WebSocket connections.
      *
      * @param newToken - The new authentication token.
-     * @param saveToStorage - Whether to also keep the token in local storage so it survives a page load. Defaults to `true`.
      */
-    setToken(newToken: string, saveToStorage?: boolean): void;
+    setToken(newToken: string): void;
     /**
      * Gets the current client configuration.
      * @internal

package/dist/modules/actors.d.ts

@@ -12,7 +12,7 @@ interface ActorsConfig {
     /** Current user access token, if authenticated. Rides the WS query on the
      * proxy-fallback path so the platform proxy can authenticate the connection;
      * anonymous connects omit it. */
-    getAuthToken(): string | null | undefined;
+    getAuthToken(): string | null | undefined | Promise<string | null | undefined>;
     /** Same semantics as function calls: editors with a non-prod version get the
      * draft actor script; everyone else gets the published one. */
     functionsVersion?: string;

package/dist/modules/actors.js

@@ -83,7 +83,7 @@ class Connection {
                 }
             }
             // Rebuilt per attempt so a login/logout is picked up on reconnect.
-            return buildProxyActorUrl(config.host, actorName, instanceId, this.id, config.appId, config.getAuthToken(), config.functionsVersion);
+            return buildProxyActorUrl(config.host, actorName, instanceId, this.id, config.appId, await config.getAuthToken(), config.functionsVersion);
         };
         const ws = new ReconnectingWebSocket(urlProvider);
         this.ws = ws;

package/dist/modules/auth.js

@@ -116,8 +116,11 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
             if (typeof window === "undefined") {
                 throw new Error("Login method can only be used in a browser environment");
             }
-            // An embedded session can only be renewed by the host platform; the
-            // login round trip cannot complete inside its frame.
+            // Only the host platform can sign a platform user in, so there is no
+            // login page to send them to. (The app's own login would work in the
+            // frame — `loginWithProvider` opens a popup — but it would mint a
+            // different, app-level identity.) An app that wants its own notice
+            // checks `isEmbedded()` rather than asking for a login it cannot get.
             if (options.embedded) {
                 showEmbedSessionEnded();
                 return;
@@ -158,13 +161,18 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
         },
         // Logout the current user
         logout(redirectUrl) {
-            // Remove token from axios headers (always do this)
+            var _a;
+            // Remove the token from both axios instances (always do this). Missing
+            // the functions one used to be hidden by the redirect below tearing the
+            // page down; an embedded logout returns instead, so the page lives on.
             delete axios.defaults.headers.common["Authorization"];
+            delete functionsAxiosClient.defaults.headers.common["Authorization"];
             // Drop identity resolved under the previous session: a `me()` already in
             // flight would otherwise resolve into callers that run after the logout.
             clearPendingMe();
             resetAnalyticsSessionContext();
             accessToken = null;
+            (_a = options.onSessionChange) === null || _a === void 0 ? void 0 : _a.call(options, false);
             // Only do the rest if in a browser environment
             if (typeof window !== "undefined") {
                 // Remove token from localStorage
@@ -178,6 +186,13 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
                         console.error("Failed to remove token from localStorage:", e);
                     }
                 }
+                // An embedded session holds no app cookie to clear — it lived in
+                // memory — and navigating a third-party frame to the logout endpoint
+                // would only break the frame. The state above is already cleared.
+                if (options.embedded) {
+                    showEmbedSessionEnded();
+                    return;
+                }
                 // Determine the from_url parameter
                 const fromUrl = redirectUrl || window.location.href;
                 // Redirect to server-side logout endpoint to clear HTTP-only cookies
@@ -187,8 +202,13 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
         },
         // Set authentication token
         setToken(token, saveToStorage = true) {
+            var _a;
             if (!token)
                 return;
+            // An embedded session belongs to the frame the platform minted it for.
+            // Persisting it would let it outlive that frame and be picked up as the
+            // identity on a later top-level visit, so storage is refused outright.
+            const persist = saveToStorage && !options.embedded;
             // Same reasoning as in `logout`: the identity changes here, so anything
             // resolved for the previous one must not be handed to later callers.
             clearPendingMe();
@@ -197,10 +217,9 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
             // handle token change for axios clients
             axios.defaults.headers.common["Authorization"] = `Bearer ${token}`;
             functionsAxiosClient.defaults.headers.common["Authorization"] = `Bearer ${token}`;
+            (_a = options.onSessionChange) === null || _a === void 0 ? void 0 : _a.call(options, true);
             // Save token to localStorage if requested
-            if (saveToStorage &&
-                typeof window !== "undefined" &&
-                window.localStorage) {
+            if (persist && typeof window !== "undefined" && window.localStorage) {
                 try {
                     window.localStorage.setItem("base44_access_token", token);
                     // Set "token" that is set by the built-in SDK of platform version 2

package/dist/modules/auth.types.d.ts

@@ -103,6 +103,13 @@ export interface AuthModuleOptions {
      * session is minted by the platform and cannot be renewed by a login redirect.
      */
     embedded?: boolean;
+    /**
+     * Called whenever the identity changes: `true` when a token is set, `false`
+     * on logout. Lets the client reach what holds its own copy of the identity —
+     * the realtime socket, which carries a token on the handshake and so has to
+     * open a new connection to pick one up, or drop the one it has.
+     */
+    onSessionChange?: (hasSession: boolean) => void;
 }
 /**
  * Authentication module for managing user authentication and authorization. The module automatically stores tokens in local storage when available and manages authorization headers for API requests.
@@ -187,7 +194,9 @@ export interface AuthModule {
     /**
      * Whether the app is running embedded in a host platform.
      *
-     * A platform embeds an app in an iframe and signs its user in by minting a one-time token onto the frame's URL; the SDK trades it for a session as the client is created. That session is held in memory only and can be renewed only by the platform, so when it ends there is no login page to send the user to — {@linkcode AuthModule.redirectToLogin | redirectToLogin()} shows a "session ended" notice instead. Use this to render your own notice or to hide sign-in and sign-out controls that cannot work inside the frame.
+     * A platform embeds an app in an iframe and signs its user in by minting a one-time token onto the frame's URL; the SDK trades it for a session as the client is created. That session is held in memory only and can be renewed only by the platform, so when it ends there is no login page to send the user to — {@linkcode AuthModule.redirectToLogin | redirectToLogin()} and {@linkcode AuthModule.logout | logout()} show a "session ended" notice instead. Use this to render your own notice or to hide sign-in and sign-out controls that cannot work inside the frame.
+     *
+     * Because the session lives in memory, it does not survive a full page load inside the frame: routing within the app keeps it, while a reload or a real navigation ends it and the platform has to embed the app again — and this returns `false` on that load, since nothing about it says it was embedded. Prefer client-side navigation in an embedded app.
      *
      * @returns `true` when the app was embedded by a host platform, `false` otherwise.
      *

package/dist/modules/functions.js

@@ -65,8 +65,12 @@ export function createFunctionsModule(axios, appId, config) {
         },
         // Fetch a backend function endpoint directly.
         async fetch(path, init = {}) {
+            var _a;
             const normalizedPath = path.startsWith("/") ? path : `/${path}`;
             const primaryPath = `/functions${normalizedPath}`;
+            // Headers are read after this: a session still being negotiated must be
+            // in hand before the Authorization is built, not after.
+            await ((_a = config === null || config === void 0 ? void 0 : config.waitForAuth) === null || _a === void 0 ? void 0 : _a.call(config));
             const headers = toHeaders(init.headers);
             const requestInit = {
                 ...init,

package/dist/modules/functions.types.d.ts

@@ -29,6 +29,12 @@ export type FunctionsFetchInit = RequestInit;
 export interface FunctionsModuleConfig {
     getAuthHeaders?: () => Record<string, string>;
     baseURL?: string;
+    /**
+     * Resolves once the client's session is settled. `fetch` builds its headers
+     * by hand rather than through axios, so without this it would miss the gate
+     * every other request goes through.
+     */
+    waitForAuth?: () => Promise<void>;
 }
 /**
  * Functions module for invoking custom backend functions.

package/dist/utils/auth-utils.d.ts

@@ -5,7 +5,7 @@ import { GetAccessTokenOptions, SaveAccessTokenOptions, RemoveAccessTokenOptions
  * Low-level utility for manually retrieving tokens. In most cases, the Base44 client handles
  * token management automatically. This function is useful for custom authentication flows or when you need direct access to stored tokens. Requires a browser environment and can't be used in the backend.
  *
- * When a host platform has embedded the app with a one-time token (`?ott=`), that token is returned as it stands: it is what {@linkcode createClient} trades for the session, so a page that gates on "is there a token?" as it loads sees one. It is neither stored nor removed from the URL here.
+ * When a host platform has embedded the app with a one-time token (`?ott=`), that token is returned as it stands: it is what {@linkcode createClient} trades for the session, so a page that gates on "is there a token?" as it loads sees one. It is neither stored nor removed from the URL here, and it is reported only inside a frame, where such a token is redeemed.
  *
  * @internal
  *

package/dist/utils/auth-utils.js

@@ -1,11 +1,13 @@
-import { EMBED_TOKEN_PARAM } from "./embed-session.js";
+import { EMBED_TOKEN_PARAM, isFramed } from "./embed-session.js";
+/** The URL parameter a Base44 session token arrives on. */
+const DEFAULT_TOKEN_PARAM = "access_token";
 /**
  * Retrieves an access token from URL parameters or local storage.
  *
  * Low-level utility for manually retrieving tokens. In most cases, the Base44 client handles
  * token management automatically. This function is useful for custom authentication flows or when you need direct access to stored tokens. Requires a browser environment and can't be used in the backend.
  *
- * When a host platform has embedded the app with a one-time token (`?ott=`), that token is returned as it stands: it is what {@linkcode createClient} trades for the session, so a page that gates on "is there a token?" as it loads sees one. It is neither stored nor removed from the URL here.
+ * When a host platform has embedded the app with a one-time token (`?ott=`), that token is returned as it stands: it is what {@linkcode createClient} trades for the session, so a page that gates on "is there a token?" as it loads sees one. It is neither stored nor removed from the URL here, and it is reported only inside a frame, where such a token is redeemed.
  *
  * @internal
  *
@@ -38,7 +40,7 @@ import { EMBED_TOKEN_PARAM } from "./embed-session.js";
  * ```
  */
 export function getAccessToken(options = {}) {
-    const { storageKey = "base44_access_token", paramName = "access_token", saveToStorage = true, removeFromUrl = true, } = options;
+    const { storageKey = "base44_access_token", paramName = DEFAULT_TOKEN_PARAM, saveToStorage = true, removeFromUrl = true, } = options;
     let token = null;
     // Try to get token from URL parameters
     if (typeof window !== "undefined" && window.location) {
@@ -63,9 +65,16 @@ export function getAccessToken(options = {}) {
             // session yet — createClient takes it off the URL and exchanges it — but
             // it is the identity this load arrives with, and callers that read this
             // once as the page loads must not conclude there is none.
-            const embedToken = urlParams.get(EMBED_TOKEN_PARAM);
-            if (embedToken) {
-                return embedToken;
+            //
+            // Only in a frame, and only for the parameter a session arrives on: a
+            // one-time token is redeemed nowhere else, so a top-level load still
+            // carrying one (a URL rewrite the browser refused) must not have it
+            // applied as a session — and never saved as one.
+            if (paramName === DEFAULT_TOKEN_PARAM && isFramed()) {
+                const embedToken = urlParams.get(EMBED_TOKEN_PARAM);
+                if (embedToken) {
+                    return embedToken;
+                }
             }
         }
         catch (e) {

package/dist/utils/embed-session.d.ts

@@ -7,44 +7,25 @@
  * grant (RFC 8693), and keeps the result in memory only — never in storage — so
  * the session lives and dies with the frame.
  *
- * @internal
- */
-/** The query parameter a host platform puts the one-time token on. @internal */
-export declare const EMBED_TOKEN_PARAM = "ott";
-/**
- * Reads the one-time token off the current URL and strips it, so it is never
- * left in the address bar, in history, or in a shared link.
+ * The exchange endpoint is rate limited per app, and its limiter refuses before
+ * the one-time token is redeemed — so a 429 leaves the token still valid and is
+ * worth retrying once.
  *
  * @internal
  */
+export declare const EMBED_TOKEN_PARAM = "ott";
+/** @internal */
+export declare function frameSession(appId: string, start?: () => Promise<string | null>): Promise<string | null> | null;
+/** @internal */
 export declare function takeEmbedTokenFromUrl(): string | null;
-/**
- * Whether this tab previously redeemed an embed token. Counts only inside a
- * frame: a top-level tab that once carried a token must fall back to the
- * regular login, or it could never sign in again.
- *
- * @internal
- */
-export declare function isEmbeddedTab(): boolean;
 /** @internal */
-export declare function markEmbeddedTab(): void;
-/**
- * Trades a one-time embed token for an app-user session token. Resolves to
- * `null` when the platform refuses the token; never throws.
- *
- * @internal
- */
+export declare function isFramed(): boolean;
+/** @internal */
 export declare function exchangeEmbedToken({ serverUrl, appId, ott, fetchImpl, }: {
     serverUrl: string;
     appId: string;
     ott: string;
     fetchImpl?: typeof fetch;
 }): Promise<string | null>;
-/**
- * Covers the page with a plain "session ended" notice. An embedded session can
- * only be renewed by the host platform (by reloading its own page), so this
- * stands in for the login redirect, which cannot complete inside a frame.
- *
- * @internal
- */
+/** @internal */
 export declare function showEmbedSessionEnded(): void;

package/dist/utils/embed-session.js

@@ -7,81 +7,63 @@
  * grant (RFC 8693), and keeps the result in memory only — never in storage — so
  * the session lives and dies with the frame.
  *
+ * The exchange endpoint is rate limited per app, and its limiter refuses before
+ * the one-time token is redeemed — so a 429 leaves the token still valid and is
+ * worth retrying once.
+ *
  * @internal
  */
-/** The query parameter a host platform puts the one-time token on. @internal */
 export const EMBED_TOKEN_PARAM = "ott";
-const EMBED_TAB_KEY = "base44_embed_session";
 const GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange";
 const SUBJECT_TOKEN_TYPE = "urn:base44:params:oauth:token-type:embed-ott";
 const RATE_LIMITED = 429;
 const RATE_LIMIT_RETRY_MS = 1000;
+const EXCHANGE_TIMEOUT_MS = 15000;
 const SESSION_ENDED_ELEMENT_ID = "base44-embed-session-ended";
-/**
- * Reads the one-time token off the current URL and strips it, so it is never
- * left in the address bar, in history, or in a shared link.
- *
- * @internal
- */
+const FRAME_SESSIONS_KEY = "__base44EmbedSessions";
+/** @internal */
+export function frameSession(appId, start) {
+    var _a, _b;
+    var _c;
+    if (typeof window === "undefined") {
+        return start ? start() : null;
+    }
+    const sessions = ((_a = (_c = window)[FRAME_SESSIONS_KEY]) !== null && _a !== void 0 ? _a : (_c[FRAME_SESSIONS_KEY] = {}));
+    if (!sessions[appId] && start) {
+        sessions[appId] = start();
+    }
+    return (_b = sessions[appId]) !== null && _b !== void 0 ? _b : null;
+}
+/** @internal */
 export function takeEmbedTokenFromUrl() {
     if (typeof window === "undefined" || !window.location) {
         return null;
     }
+    let ott = null;
     try {
         const url = new URL(window.location.href);
-        const ott = url.searchParams.get(EMBED_TOKEN_PARAM);
+        ott = url.searchParams.get(EMBED_TOKEN_PARAM);
         if (!ott) {
             return null;
         }
         url.searchParams.delete(EMBED_TOKEN_PARAM);
         window.history.replaceState(window.history.state, "", url.toString());
-        return ott;
     }
     catch (e) {
         console.error("Error retrieving embed token from URL:", e);
-        return null;
-    }
-}
-/**
- * Whether this tab previously redeemed an embed token. Counts only inside a
- * frame: a top-level tab that once carried a token must fall back to the
- * regular login, or it could never sign in again.
- *
- * @internal
- */
-export function isEmbeddedTab() {
-    if (typeof window === "undefined") {
-        return false;
-    }
-    // A cross-site frame is third-party storage, which some browsers block
-    // outright — every access can throw, and the marker is then unavailable.
-    try {
-        return (window.self !== window.top &&
-            window.sessionStorage.getItem(EMBED_TAB_KEY) === "1");
-    }
-    catch (_a) {
-        return false;
     }
+    return ott;
 }
 /** @internal */
-export function markEmbeddedTab() {
-    try {
-        window.sessionStorage.setItem(EMBED_TAB_KEY, "1");
-    }
-    catch (_a) {
-        /* storage blocked */
-    }
+export function isFramed() {
+    return typeof window !== "undefined" && window.self !== window.top;
 }
-/**
- * Trades a one-time embed token for an app-user session token. Resolves to
- * `null` when the platform refuses the token; never throws.
- *
- * @internal
- */
+/** @internal */
 export async function exchangeEmbedToken({ serverUrl, appId, ott, fetchImpl = fetch, }) {
     const post = () => fetchImpl(`${serverUrl}/api/apps/${appId}/auth/embed/token`, {
         method: "POST",
         headers: { "X-App-Id": String(appId) },
+        signal: AbortSignal.timeout(EXCHANGE_TIMEOUT_MS),
         body: new URLSearchParams({
             grant_type: GRANT_TYPE,
             subject_token: ott,
@@ -90,7 +72,6 @@ export async function exchangeEmbedToken({ serverUrl, appId, ott, fetchImpl = fe
     });
     try {
         let response = await post();
-        // The limiter refuses before the token is redeemed, so it is still valid.
         if (response.status === RATE_LIMITED) {
             await new Promise((resolve) => setTimeout(resolve, RATE_LIMIT_RETRY_MS));
             response = await post();
@@ -106,13 +87,7 @@ export async function exchangeEmbedToken({ serverUrl, appId, ott, fetchImpl = fe
         return null;
     }
 }
-/**
- * Covers the page with a plain "session ended" notice. An embedded session can
- * only be renewed by the host platform (by reloading its own page), so this
- * stands in for the login redirect, which cannot complete inside a frame.
- *
- * @internal
- */
+/** @internal */
 export function showEmbedSessionEnded() {
     if (typeof document === "undefined" || !document.body) {
         return;
@@ -120,21 +95,26 @@ export function showEmbedSessionEnded() {
     if (document.getElementById(SESSION_ENDED_ELEMENT_ID)) {
         return;
     }
+    const style = document.createElement("style");
+    style.textContent =
+        `#${SESSION_ENDED_ELEMENT_ID}{--b44-bg:#fff;--b44-fg:#0f172a;--b44-muted:#475569;}` +
+            `@media (prefers-color-scheme:dark){#${SESSION_ENDED_ELEMENT_ID}` +
+            `{--b44-bg:#0f172a;--b44-fg:#f8fafc;--b44-muted:#94a3b8;}}`;
     const overlay = document.createElement("div");
     overlay.id = SESSION_ENDED_ELEMENT_ID;
     overlay.setAttribute("role", "alert");
     overlay.style.cssText =
         "position:fixed;inset:0;z-index:2147483647;display:flex;align-items:center;" +
-            "justify-content:center;background:#fff;color:#0f172a;" +
+            "justify-content:center;background:var(--b44-bg);color:var(--b44-fg);" +
             "font-family:ui-sans-serif,system-ui,sans-serif;text-align:center;padding:2rem;";
     const title = document.createElement("h1");
     title.textContent = "Session ended";
     title.style.cssText = "font-size:1.5rem;font-weight:700;margin:0 0 .75rem;";
     const body = document.createElement("p");
-    body.textContent = "Refresh the page to continue.";
-    body.style.cssText = "margin:0;color:#475569;";
+    body.textContent = "Reload this page in your browser to start a new session.";
+    body.style.cssText = "margin:0;color:var(--b44-muted);";
     const card = document.createElement("div");
     card.append(title, body);
-    overlay.append(card);
+    overlay.append(style, card);
     document.body.append(overlay);
 }

package/dist/utils/fetch-with-auth.d.ts

@@ -33,11 +33,13 @@ export interface FetchWithAuthInit extends RequestInit {
  * has none, so nothing is sent.
  * @internal
  */
-export declare function createFetchWithAuth({ axios, serviceRoleAxios, appId, serverUrl, functionsVersion, platformHeaders, }: {
+export declare function createFetchWithAuth({ axios, serviceRoleAxios, appId, serverUrl, functionsVersion, platformHeaders, waitForAuth, }: {
     axios: AxiosInstance;
     serviceRoleAxios: AxiosInstance;
     appId: string;
     serverUrl: string;
     functionsVersion?: string;
     platformHeaders?: Record<string, string>;
+    /** Resolves once the client's session is settled. */
+    waitForAuth?: () => Promise<void>;
 }): (path: string, init?: FetchWithAuthInit) => Promise<Response>;

package/dist/utils/fetch-with-auth.js

@@ -21,7 +21,7 @@
  * has none, so nothing is sent.
  * @internal
  */
-export function createFetchWithAuth({ axios, serviceRoleAxios, appId, serverUrl, functionsVersion, platformHeaders, }) {
+export function createFetchWithAuth({ axios, serviceRoleAxios, appId, serverUrl, functionsVersion, platformHeaders, waitForAuth, }) {
     const inherited = new Headers(platformHeaders);
     const bearer = (client) => {
         const header = client.defaults.headers.common["Authorization"];
@@ -31,6 +31,9 @@ export function createFetchWithAuth({ axios, serviceRoleAxios, appId, serverUrl,
     };
     return async function fetchWithAuth(path, init = {}) {
         assertOwnOriginPath(path);
+        // The Authorization below is read off the axios defaults, which a session
+        // still being negotiated has not written yet.
+        await (waitForAuth === null || waitForAuth === void 0 ? void 0 : waitForAuth());
         const { fetch: transport = fetch, ...requestInit } = init;
         const headers = new Headers(init.headers);
         // A caller-supplied value always wins, so a route can hand the callee a

package/dist/utils/socket-utils.d.ts

@@ -4,9 +4,8 @@ export interface RoomsSocketConfig {
     mountPath: string;
     transports: string[];
     appId: string;
-    /** `undefined` means unknown — the socket looks in storage; `null` means
-     * known to be anonymous, so storage is never consulted. */
-    token?: string | null;
+    /** Asked on every connect, so the socket always carries the current session. */
+    getToken: () => string | null;
 }
 export type TSocketRoom = string;
 export type TJsonStr = string;
@@ -42,7 +41,7 @@ export declare function RoomsSocket({ config }: {
         leave: (room: string) => void;
     }>;
     subscribeToRoom: (room: TSocketRoom, handlers: Partial<{ [k in TEvent]: THandler<k>; }>) => () => void;
-    updateConfig: (config: Partial<RoomsSocketConfig>) => void;
+    reconnect: () => void;
     updateModel: (room: string, data: any) => Promise<void>;
     disconnect: () => void;
 };

package/dist/utils/socket-utils.js

@@ -1,5 +1,4 @@
 import { io } from "socket.io-client";
-import { getAccessToken } from "./auth-utils.js";
 import { getAnalyticsSessionId } from "../modules/analytics.js";
 const ROOM_LEAVE_GRACE_MS = 250;
 function initializeSocket(config, handlers) {
@@ -7,7 +6,7 @@ function initializeSocket(config, handlers) {
     // handshake so the backend can verify room access for anonymous agent
     // conversations (mirrors the X-Base44-Anonymous-Id HTTP header). Authenticated
     // clients are identified by their token instead.
-    const resolvedToken = config.token === undefined ? getAccessToken() : config.token;
+    const resolvedToken = config.getToken();
     const query = {
         app_id: config.appId,
         token: resolvedToken,
@@ -41,7 +40,6 @@ function initializeSocket(config, handlers) {
     return socket;
 }
 export function RoomsSocket({ config }) {
-    let currentConfig = { ...config };
     const roomsToListeners = {};
     const pendingRoomLeaves = {};
     const handlers = {
@@ -83,13 +81,10 @@ export function RoomsSocket({ config }) {
             socket.disconnect();
         }
     }
-    function updateConfig(config) {
+    /** Drops the connection and opens a new one with the current token. */
+    function reconnect() {
         cleanup();
-        currentConfig = {
-            ...currentConfig,
-            ...config,
-        };
-        socket = initializeSocket(currentConfig, handlers);
+        socket = initializeSocket(config, handlers);
     }
     function joinRoom(room) {
         socket.emit("join", room);
@@ -162,7 +157,7 @@ export function RoomsSocket({ config }) {
     return {
         socket,
         subscribeToRoom,
-        updateConfig,
+        reconnect,
         updateModel,
         disconnect,
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@base44-preview/sdk",
-  "version": "0.8.48-pr.282.c69fdcd",
+  "version": "0.8.48-pr.282.d56486f",
   "description": "JavaScript SDK for Base44 API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",