@depup/base44__sdk 0.8.25-depup.0 → 0.8.40-depup.0

package/README.md

@@ -13,17 +13,16 @@ npm install @depup/base44__sdk
 
 | Field | Value |
 |-------|-------|
-| Original | [@base44/sdk](https://www.npmjs.com/package/@base44/sdk) @ 0.8.25 |
-| Processed | 2026-04-12 |
+| Original | [@base44/sdk](https://www.npmjs.com/package/@base44/sdk) @ 0.8.40 |
+| Processed | 2026-07-21 |
 | Smoke test | passed |
-| Deps updated | 2 |
+| Deps updated | 1 |
 
 ## Dependency Changes
 
 | Dependency | From | To |
 |------------|------|-----|
-| axios | ^1.6.2 | ^1.15.0 |
-| socket.io-client | ^4.7.5 | ^4.8.3 |
+| uuid | ^13.0.2 | ^14.0.1 |
 
 ---
 

package/changes.json

@@ -1,14 +1,10 @@
 {
   "bumped": {
-    "axios": {
-      "from": "^1.6.2",
-      "to": "^1.15.0"
-    },
-    "socket.io-client": {
-      "from": "^4.7.5",
-      "to": "^4.8.3"
+    "uuid": {
+      "from": "^13.0.2",
+      "to": "^14.0.1"
     }
   },
-  "timestamp": "2026-04-12T12:17:46.370Z",
-  "totalUpdated": 2
+  "timestamp": "2026-07-21T16:02:37.704Z",
+  "totalUpdated": 1
 }

package/dist/client.d.ts

@@ -12,12 +12,12 @@ export type { Base44Client, CreateClientConfig, CreateClientOptions };
  * The client supports three authentication modes:
  * - **Anonymous**: Access modules without authentication using `base44.moduleName`. Operations are scoped to public data and permissions.
  * - **User authentication**: Access modules with user-level permissions using `base44.moduleName`. Operations are scoped to the authenticated user's data and permissions. Use `base44.auth.loginViaEmailPassword()` or other auth methods to get a token.
- * - **Service role authentication**: Access modules with elevated permissions using `base44.asServiceRole.moduleName`. Operations can access any data available to the app's admin. Only available in Base44-hosted backend functions. Create a client with service role authentication using {@linkcode createClientFromRequest | createClientFromRequest()}.
+ * - **Service role authentication**: Access modules with elevated permissions using `base44.asServiceRole.moduleName`. Operations bypass entity access rules and field-level security, giving full read and write access to all of the app's data. Only available in Base44-hosted backend functions. Create a client with service role authentication using {@linkcode createClientFromRequest | createClientFromRequest()}.
  *
  * For example, when using the {@linkcode EntitiesModule | entities} module:
  * - **Anonymous**: Can only read public data.
  * - **User authentication**: Can access the current user's data.
- * - **Service role authentication**: Can access all data that admins can access.
+ * - **Service role authentication**: Can read and write any record, bypassing access rules.
  *
  * Most modules are available in all three modes, but with different permission levels. However, some modules are only available in specific authentication modes.
  *
@@ -43,7 +43,7 @@ export declare function createClient(config: CreateClientConfig): Base44Client;
  *
  * This function is designed for use in Base44-hosted backend functions. For frontends and external backends, use {@linkcode createClient | createClient()} instead.
  *
- * When used in a Base44-hosted backend function, `createClientFromRequest()` automatically extracts authentication tokens from the request headers that Base44 injects when forwarding requests. The returned client includes service role access using `base44.asServiceRole`, which provides admin-level permissions.
+ * When used in a Base44-hosted backend function, `createClientFromRequest()` automatically extracts authentication tokens from the request headers that Base44 injects when forwarding requests. The returned client includes service role access using `base44.asServiceRole`, which bypasses entity access rules and field-level security.
  *
  * To learn more about the Base44 client, see {@linkcode createClient | createClient()}.
  *
@@ -82,7 +82,7 @@ export declare function createClient(config: CreateClientConfig): Base44Client;
  *   try {
  *     const base44 = createClientFromRequest(req);
  *
- *     // Access admin data with service role permissions
+ *     // Read across all users, bypassing the Orders entity's access rules
  *     const recentOrders = await base44.asServiceRole.entities.Orders.list('-created_at', 50);
  *
  *     return Response.json({ orders: recentOrders });

package/dist/client.js

@@ -7,6 +7,7 @@ import { createConnectorsModule, createUserConnectorsModule, } from "./modules/c
 import { getAccessToken } from "./utils/auth-utils.js";
 import { createFunctionsModule } from "./modules/functions.js";
 import { createAgentsModule } from "./modules/agents.js";
+import { createAiGatewayModule } from "./modules/ai-gateway.js";
 import { createAppLogsModule } from "./modules/app-logs.js";
 import { createUsersModule } from "./modules/users.js";
 import { RoomsSocket } from "./utils/socket-utils.js";
@@ -23,12 +24,12 @@ import { createAnalyticsModule } from "./modules/analytics.js";
  * The client supports three authentication modes:
  * - **Anonymous**: Access modules without authentication using `base44.moduleName`. Operations are scoped to public data and permissions.
  * - **User authentication**: Access modules with user-level permissions using `base44.moduleName`. Operations are scoped to the authenticated user's data and permissions. Use `base44.auth.loginViaEmailPassword()` or other auth methods to get a token.
- * - **Service role authentication**: Access modules with elevated permissions using `base44.asServiceRole.moduleName`. Operations can access any data available to the app's admin. Only available in Base44-hosted backend functions. Create a client with service role authentication using {@linkcode createClientFromRequest | createClientFromRequest()}.
+ * - **Service role authentication**: Access modules with elevated permissions using `base44.asServiceRole.moduleName`. Operations bypass entity access rules and field-level security, giving full read and write access to all of the app's data. Only available in Base44-hosted backend functions. Create a client with service role authentication using {@linkcode createClientFromRequest | createClientFromRequest()}.
  *
  * For example, when using the {@linkcode EntitiesModule | entities} module:
  * - **Anonymous**: Can only read public data.
  * - **User authentication**: Can access the current user's data.
- * - **Service role authentication**: Can access all data that admins can access.
+ * - **Service role authentication**: Can read and write any record, bypassing access rules.
  *
  * Most modules are available in all three modes, but with different permission levels. However, some modules are only available in specific authentication modes.
  *
@@ -112,6 +113,16 @@ export function createClient(config) {
         appBaseUrl: normalizedAppBaseUrl,
         serverUrl,
     });
+    // Apply the access token before any module that may issue authenticated
+    // requests during construction (notably analytics, which fires an init
+    // event whose flush calls auth.me()). Without this, the first User/me
+    // request is built before setToken runs and goes out unauthenticated.
+    if (typeof window !== "undefined") {
+        const accessToken = token || getAccessToken();
+        if (accessToken) {
+            userAuthModule.setToken(accessToken);
+        }
+    }
     const userModules = {
         entities: createEntitiesModule({
             axios: axiosClient,
@@ -140,6 +151,7 @@ export function createClient(config) {
             serverUrl,
             token,
         }),
+        aiGateway: createAiGatewayModule({ serverUrl, token, appId }),
         appLogs: createAppLogsModule(axiosClient, appId),
         users: createUsersModule(axiosClient, appId),
         analytics: createAnalyticsModule({
@@ -182,6 +194,7 @@ export function createClient(config) {
             serverUrl,
             token,
         }),
+        aiGateway: createAiGatewayModule({ serverUrl, token: serviceToken, appId }),
         appLogs: createAppLogsModule(serviceRoleAxiosClient, appId),
         cleanup: () => {
             if (socket) {
@@ -189,14 +202,6 @@ export function createClient(config) {
             }
         },
     };
-    // Always try to get token from localStorage or URL parameters
-    if (typeof window !== "undefined") {
-        // Get token from URL or localStorage
-        const accessToken = token || getAccessToken();
-        if (accessToken) {
-            userModules.auth.setToken(accessToken);
-        }
-    }
     // If authentication is required, verify token and redirect to login if needed
     if (requiresAuth && typeof window !== "undefined") {
         // We perform this check asynchronously to not block client creation
@@ -255,7 +260,7 @@ export function createClient(config) {
         /**
          * Provides access to service role modules.
          *
-         * Service role authentication provides elevated permissions for backend operations. Unlike user authentication, which is scoped to a specific user's permissions, service role authentication has access to the data and operations available to the app's admin.
+         * Service role authentication provides elevated permissions for backend operations. Unlike user authentication, which is scoped to a specific user's permissions, service role authentication bypasses entity access rules and field-level security entirely, giving full read and write access to all of the app's data.
          *
          * @throws {Error} When accessed without providing a serviceToken during client creation.
          *
@@ -266,7 +271,7 @@ export function createClient(config) {
          *   serviceToken: 'service-role-token'
          * });
          *
-         * // Also access a module with elevated permissions
+         * // Read every user record, bypassing the User entity's access rules
          * const allUsers = await base44.asServiceRole.entities.User.list();
          * ```
          */
@@ -284,7 +289,7 @@ export function createClient(config) {
  *
  * This function is designed for use in Base44-hosted backend functions. For frontends and external backends, use {@linkcode createClient | createClient()} instead.
  *
- * When used in a Base44-hosted backend function, `createClientFromRequest()` automatically extracts authentication tokens from the request headers that Base44 injects when forwarding requests. The returned client includes service role access using `base44.asServiceRole`, which provides admin-level permissions.
+ * When used in a Base44-hosted backend function, `createClientFromRequest()` automatically extracts authentication tokens from the request headers that Base44 injects when forwarding requests. The returned client includes service role access using `base44.asServiceRole`, which bypasses entity access rules and field-level security.
  *
  * To learn more about the Base44 client, see {@linkcode createClient | createClient()}.
  *
@@ -323,7 +328,7 @@ export function createClient(config) {
  *   try {
  *     const base44 = createClientFromRequest(req);
  *
- *     // Access admin data with service role permissions
+ *     // Read across all users, bypassing the Orders entity's access rules
  *     const recentOrders = await base44.asServiceRole.entities.Orders.list('-created_at', 50);
  *
  *     return Response.json({ orders: recentOrders });
@@ -341,6 +346,7 @@ export function createClientFromRequest(request) {
     const serverUrlHeader = request.headers.get("Base44-Api-Url");
     const functionsVersion = request.headers.get("Base44-Functions-Version");
     const stateHeader = request.headers.get("Base44-State");
+    const dataEnvHeader = request.headers.get("X-Data-Env");
     if (!appId) {
         throw new Error("Base44-App-Id header is required, but is was not found on the request");
     }
@@ -368,6 +374,16 @@ export function createClientFromRequest(request) {
     if (stateHeader) {
         additionalHeaders["Base44-State"] = stateHeader;
     }
+    // Propagate the data environment so entity operations from the function stay
+    // in the same environment (e.g. test data) as the triggering request. This
+    // matters for the user-scoped client: unlike the service token, the user JWT
+    // carries no data-env, so without forwarding this header the callbacks fall
+    // back to production data even when the app runs in test-data mode.
+    // Forward only the known closed set (matches the backend contract) rather
+    // than relaying an arbitrary attacker-supplied header value onward.
+    if (dataEnvHeader === "dev" || dataEnvHeader === "prod") {
+        additionalHeaders["X-Data-Env"] = dataEnvHeader;
+    }
     return createClient({
         serverUrl: serverUrlHeader || "https://base44.app",
         appId,

package/dist/client.types.d.ts

@@ -5,6 +5,7 @@ import type { SsoModule } from "./modules/sso.types.js";
 import type { ConnectorsModule, UserConnectorsModule } from "./modules/connectors.types.js";
 import type { FunctionsModule } from "./modules/functions.types.js";
 import type { AgentsModule } from "./modules/agents.types.js";
+import type { AiGatewayModule } from "./modules/ai-gateway.types.js";
 import type { AppLogsModule } from "./modules/app-logs.types.js";
 import type { AnalyticsModule } from "./modules/analytics.types.js";
 /**
@@ -49,7 +50,7 @@ export interface CreateClientConfig {
      */
     token?: string;
     /**
-     * Service role authentication token. Provides elevated permissions to access data available to the app's admin. Only available in Base44-hosted backend functions. Automatically added to client's created using {@linkcode createClientFromRequest | createClientFromRequest()}.
+     * Service role authentication token. Provides elevated permissions that bypass entity access rules and field-level security. Only available in Base44-hosted backend functions. Automatically added to clients created using {@linkcode createClientFromRequest | createClientFromRequest()}.
      * @internal
      */
     serviceToken?: string;
@@ -81,6 +82,8 @@ export interface CreateClientConfig {
 export interface Base44Client {
     /** {@link AgentsModule | Agents module} for managing AI agent conversations. */
     agents: AgentsModule;
+    /** {@link AiGatewayModule | AI Gateway module} for connecting to the Base44 AI Gateway with your own SDK. */
+    aiGateway: AiGatewayModule;
     /** {@link AnalyticsModule | Analytics module} for tracking custom events in your app. */
     analytics: AnalyticsModule;
     /** {@link AppLogsModule | App logs module} for tracking app usage. */
@@ -117,13 +120,15 @@ export interface Base44Client {
     /**
      * Provides access to supported modules with elevated permissions.
      *
-     * Service role authentication provides elevated permissions for backend operations. Unlike user authentication, which is scoped to a specific user's permissions, service role authentication has access to the data and operations available to the app's admin.
+     * Service role authentication provides elevated permissions for backend operations. Unlike user authentication, which is scoped to a specific user's permissions, service role authentication bypasses entity access rules and field-level security entirely, giving full read and write access to all of the app's data.
      *
      * @throws {Error} When accessed without providing a serviceToken during client creation
      */
     readonly asServiceRole: {
         /** {@link AgentsModule | Agents module} with elevated permissions. */
         agents: AgentsModule;
+        /** {@link AiGatewayModule | AI Gateway module} with the service-role token. */
+        aiGateway: AiGatewayModule;
         /** {@link AppLogsModule | App logs module} with elevated permissions. */
         appLogs: AppLogsModule;
         /** {@link ConnectorsModule | Connectors module} for OAuth token retrieval. */

package/dist/index.d.ts

@@ -4,11 +4,12 @@ import { getAccessToken, saveAccessToken, removeAccessToken, getLoginUrl } from
 export { createClient, createClientFromRequest, Base44Error, getAccessToken, saveAccessToken, removeAccessToken, getLoginUrl, };
 export type { Base44Client, CreateClientConfig, CreateClientOptions, Base44ErrorJSON, };
 export * from "./types.js";
-export type { DeleteManyResult, DeleteResult, EntitiesModule, EntityHandler, EntityRecord, EntityTypeRegistry, ImportResult, RealtimeEventType, RealtimeEvent, RealtimeCallback, SortField, UpdateManyResult, } from "./modules/entities.types.js";
+export type { DeleteManyResult, DeleteResult, EntitiesModule, EntityFilterOperators, EntityFilterQuery, EntityFilterValue, EntityHandler, EntityRecord, EntityTypeRegistry, ImportResult, RealtimeEventType, RealtimeEvent, RealtimeCallback, SortField, UpdateManyResult, } from "./modules/entities.types.js";
 export type { AuthModule, LoginResponse, RegisterParams, VerifyOtpParams, ChangePasswordParams, ResetPasswordParams, User, } from "./modules/auth.types.js";
 export type { IntegrationsModule, IntegrationEndpointFunction, CoreIntegrations, InvokeLLMParams, GenerateImageParams, GenerateImageResult, UploadFileParams, UploadFileResult, SendEmailParams, SendEmailResult, ExtractDataFromUploadedFileParams, ExtractDataFromUploadedFileResult, UploadPrivateFileParams, UploadPrivateFileResult, CreateFileSignedUrlParams, CreateFileSignedUrlResult, } from "./modules/integrations.types.js";
 export type { FunctionsModule, FunctionName, FunctionNameRegistry, } from "./modules/functions.types.js";
 export type { AgentsModule, AgentName, AgentNameRegistry, AgentConversation, AgentMessage, AgentMessageReasoning, AgentMessageToolCall, AgentMessageUsage, AgentMessageCustomContext, AgentMessageMetadata, CreateConversationParams, } from "./modules/agents.types.js";
+export type { AiGatewayModule, AiGatewayConnection, } from "./modules/ai-gateway.types.js";
 export type { AppLogsModule } from "./modules/app-logs.types.js";
 export type { SsoModule, SsoAccessTokenResponse } from "./modules/sso.types.js";
 export type { ConnectorsModule, UserConnectorsModule, } from "./modules/connectors.types.js";

package/dist/modules/agents.types.d.ts

@@ -43,7 +43,7 @@ export interface AgentMessageToolCall {
     /** Arguments passed to the tool as JSON string. */
     arguments_string: string;
     /** Status of the tool call. */
-    status: "running" | "success" | "error" | "stopped";
+    status: "running" | "success" | "error" | "stopped" | "waiting_for_user_input";
     /** Results from the tool call. */
     results?: string;
 }
@@ -194,7 +194,7 @@ export interface AgentsModuleConfig {
  * This module is available to use with a client in all authentication modes:
  *
  * - **Anonymous or User authentication** (`base44.agents`): Access is scoped to the current user's permissions. Users must be authenticated to create and access conversations.
- * - **Service role authentication** (`base44.asServiceRole.agents`): Operations have elevated admin-level permissions. Can access all conversations that the app's admin role has access to.
+ * - **Service role authentication** (`base44.asServiceRole.agents`): Operations are invoked with the service role for backend code that needs elevated permissions.
  *
  * ## Generated Types
  *

package/dist/modules/ai-gateway.d.ts

@@ -0,0 +1,2 @@
+import { AiGatewayModule, AiGatewayModuleConfig } from "./ai-gateway.types.js";
+export declare function createAiGatewayModule({ serverUrl, token, appId, }: AiGatewayModuleConfig): AiGatewayModule;

package/dist/modules/ai-gateway.js

@@ -0,0 +1,13 @@
+import { getAccessToken } from "../utils/auth-utils.js";
+export function createAiGatewayModule({ serverUrl, token, appId, }) {
+    const connection = () => {
+        var _a;
+        return ({
+            baseURL: `${serverUrl}/api/apps/${appId}/ai/openai/v1`,
+            token: (_a = token !== null && token !== void 0 ? token : getAccessToken()) !== null && _a !== void 0 ? _a : "",
+        });
+    };
+    return {
+        connection,
+    };
+}

package/dist/modules/ai-gateway.types.d.ts

@@ -0,0 +1,88 @@
+/**
+ * A connection to the Base44 AI Gateway.
+ *
+ * Contains the base URL and bearer token to use with any OpenAI-compatible
+ * client pointed at the Base44 AI Gateway.
+ */
+export interface AiGatewayConnection {
+    /** Base URL of the gateway's OpenAI-compatible endpoint. */
+    baseURL: string;
+    /** Bearer token used to authenticate requests to the gateway. */
+    token: string;
+}
+/**
+ * Configuration for the AI Gateway module.
+ * @internal
+ */
+export interface AiGatewayModuleConfig {
+    /** Server URL */
+    serverUrl?: string;
+    /** Authentication token */
+    token?: string;
+    /** Application ID */
+    appId: string;
+}
+/**
+ * AI Gateway module for calling Base44's managed AI models from your own code.
+ *
+ * The gateway exposes an OpenAI-compatible Chat Completions endpoint, so any
+ * OpenAI-compatible SDK works against it:
+ * - Build custom AI agents or call models directly from your backend code
+ * - Uses your app's models, billing, and credit quota, no API key to manage
+ *
+ * Available in user authentication mode (`base44.aiGateway`) and with the
+ * service-role token via `base44.asServiceRole.aiGateway`.
+ */
+export interface AiGatewayModule {
+    /**
+     * Gets the connection details for the Base44 AI Gateway.
+     *
+     * Returns the `baseURL` and `token` to pass to any OpenAI-compatible client.
+     *
+     * The `token` is the current caller's bearer token: the app user's token for
+     * `base44.aiGateway`, or the service-role token for `base44.asServiceRole.aiGateway`.
+     * When the caller is unauthenticated, `token` is an empty string.
+     *
+     * @returns The gateway {@linkcode AiGatewayConnection | connection} (`baseURL` and `token`).
+     *
+     * @example
+     * ```typescript
+     * import { ToolLoopAgent, tool, stepCountIs, hasToolCall } from "ai";
+     * import { createOpenAICompatible } from "@ai-sdk/openai-compatible";
+     * import { z } from "zod";
+     *
+     * const request = await base44.entities.ReturnRequest.get(returnId);
+     * const { baseURL, token } = base44.aiGateway.connection();
+     * // Point any OpenAI-compatible client at `baseURL` with `apiKey: token`.
+     * const models = createOpenAICompatible({ name: "base44", baseURL, apiKey: token });
+     *
+     * const agent = new ToolLoopAgent({
+     *   model: models("automatic"),
+     *   instructions:
+     *     "Decide whether this return looks fine or needs the owner's attention. " +
+     *     "Check the customer's past orders, then submit your verdict.",
+     *   tools: {
+     *     searchOrders: tool({
+     *       description: "This customer's past orders, optionally filtered by status",
+     *       inputSchema: z.object({ status: z.string().optional() }),
+     *       execute: ({ status }) => {
+     *         const query = { customer_email: request.customer_email };
+     *         if (status) query.status = status;
+     *         return base44.entities.Order.filter(query, "-created_date", 50);
+     *       },
+     *     }),
+     *     submitVerdict: tool({
+     *       description: "Record the final verdict",
+     *       inputSchema: z.object({ decision: z.enum(["approved", "flagged"]), reason: z.string() }),
+     *       execute: ({ decision, reason }) =>
+     *         base44.entities.ReturnRequest.update(returnId, { status: decision, review_note: reason }),
+     *     }),
+     *   },
+     *   stopWhen: [stepCountIs(8), hasToolCall("submitVerdict")],
+     * });
+     *
+     * await agent.generate({ prompt: `Review this return request: ${JSON.stringify(request)}` });
+     * ```
+     */
+    connection(): AiGatewayConnection;
+}

package/dist/modules/ai-gateway.types.js

@@ -0,0 +1 @@
+export {};

package/dist/modules/analytics.js

@@ -1,5 +1,5 @@
 import { getSharedInstance } from "../utils/sharedInstance.js";
-import { generateUuid } from "../utils/common.js";
+import { generateUuid, isReactNative } from "../utils/common.js";
 export const USER_HEARTBEAT_EVENT_NAME = "__user_heartbeat_event__";
 export const ANALYTICS_INITIALIZATION_EVENT_NAME = "__initialization_event__";
 export const ANALYTICS_SESSION_DURATION_EVENT_NAME = "__session_duration_event__";
@@ -34,7 +34,11 @@ export const createAnalyticsModule = ({ axiosClient, serverUrl, appId, userAuthM
     var _a;
     // prevent overflow of events //
     const { maxQueueSize, throttleTime, batchSize } = analyticsSharedState.config;
-    if (!((_a = analyticsSharedState.config) === null || _a === void 0 ? void 0 : _a.enabled)) {
+    // Disable analytics on React Native. It defines `window` but not `document`,
+    // so the per-callsite `typeof window` guards below aren't enough to keep it
+    // from touching `document` (e.g. `document.referrer` on init). Node/SSR is
+    // still handled by those `window` guards, so this doesn't affect it.
+    if (!((_a = analyticsSharedState.config) === null || _a === void 0 ? void 0 : _a.enabled) || isReactNative) {
         return {
             track: () => { },
             cleanup: () => { },
@@ -242,7 +246,10 @@ async function getSessionContext(userAuthModule) {
     return analyticsSharedState.sessionContext;
 }
 export function getAnalyticsConfigFromUrlParams() {
-    if (typeof window === "undefined")
+    // `window.location` is absent on React Native. This runs at module load (via
+    // the shared-state factory), so an unguarded `window.location.search` would
+    // throw on import there.
+    if (typeof window === "undefined" || !window.location)
         return undefined;
     const urlParams = new URLSearchParams(window.location.search);
     const analyticsEnable = urlParams.get(ANALYTICS_CONFIG_ENABLE_URL_PARAM_KEY);

package/dist/modules/auth.js

@@ -1,3 +1,57 @@
+function isInsideIframe() {
+    if (typeof window === "undefined")
+        return false;
+    return window !== window.parent;
+}
+/**
+ * Opens a URL in a centered popup and waits for the backend to postMessage
+ * the auth result back. On success, redirects the current window to
+ * redirectUrl with the token params appended, preserving the same behaviour
+ * as a normal full-page redirect flow.
+ *
+ * @param url - The login URL to open in the popup (should include popup_origin).
+ * @param redirectUrl - Where to redirect after auth (the original fromUrl).
+ * @param expectedOrigin - The origin we expect the postMessage to come from.
+ */
+function loginViaPopup(url, redirectUrl, expectedOrigin) {
+    const width = 500;
+    const height = 600;
+    const left = Math.round(window.screenX + (window.outerWidth - width) / 2);
+    const top = Math.round(window.screenY + (window.outerHeight - height) / 2);
+    const popup = window.open(url, "base44_auth", `width=${width},height=${height},left=${left},top=${top},resizable=yes,scrollbars=yes`);
+    if (!popup) {
+        return;
+    }
+    const cleanup = () => {
+        window.removeEventListener("message", onMessage);
+        clearInterval(pollTimer);
+        if (!popup.closed)
+            popup.close();
+    };
+    const onMessage = (event) => {
+        var _a;
+        if (event.origin !== expectedOrigin)
+            return;
+        if (event.source !== popup)
+            return;
+        if (!((_a = event.data) === null || _a === void 0 ? void 0 : _a.access_token))
+            return;
+        cleanup();
+        const callbackUrl = new URL(redirectUrl);
+        const { access_token, is_new_user } = event.data;
+        callbackUrl.searchParams.set("access_token", access_token);
+        if (is_new_user != null) {
+            callbackUrl.searchParams.set("is_new_user", String(is_new_user));
+        }
+        window.location.href = callbackUrl.toString();
+    };
+    // Only used to detect the user closing the popup before auth completes
+    const pollTimer = setInterval(() => {
+        if (popup.closed)
+            cleanup();
+    }, 500);
+    window.addEventListener("message", onMessage);
+}
 /**
  * Creates the auth module for the Base44 SDK.
  *
@@ -49,7 +103,13 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
                 authPath = `/apps/auth${providerPath}/login`;
             }
             const loginUrl = `${options.appBaseUrl}/api${authPath}?${queryParams}`;
-            // Redirect to the provider login page
+            // When running inside an iframe, use a popup to avoid OAuth providers
+            // blocking iframe navigation.
+            if (isInsideIframe()) {
+                const popupLoginUrl = `${loginUrl}&popup_origin=${encodeURIComponent(window.location.origin)}`;
+                return loginViaPopup(popupLoginUrl, redirectUrl, window.location.origin);
+            }
+            // Default: full-page redirect
             window.location.href = loginUrl;
         },
         // Logout the current user