@depup/base44__sdk 0.8.41-depup.1 → 0.8.43-depup.0

package/README.md

@@ -13,8 +13,8 @@ npm install @depup/base44__sdk
 
 | Field | Value |
 |-------|-------|
-| Original | [@base44/sdk](https://www.npmjs.com/package/@base44/sdk) @ 0.8.41 |
-| Processed | 2026-07-30 |
+| Original | [@base44/sdk](https://www.npmjs.com/package/@base44/sdk) @ 0.8.43 |
+| Processed | 2026-08-18 |
 | Smoke test | passed |
 | Deps updated | 3 |
 

package/changes.json

@@ -13,6 +13,6 @@
       "to": "^14.0.1"
     }
   },
-  "timestamp": "2026-07-30T00:36:38.307Z",
+  "timestamp": "2026-08-18T08:10:22.589Z",
   "totalUpdated": 3
 }

package/dist/actor.d.ts

@@ -15,12 +15,9 @@ import type { Base44Client } from "./client";
  */
 export interface Conn<Send = unknown> {
     /** Unique per-connection id (one per socket/tab), the same value the client
-     *  receives from `subscribe()`. Use this — not userId — to identify a distinct
-     *  client, so multiple tabs of the same user are separate connections. */
+     *  receives from `subscribe()`. Identifies a distinct client, so multiple
+     *  tabs are separate connections. */
     id: string;
-    userId: string;
-    appId: string;
-    instanceId: string;
     send(data: Send): void;
     reject(code: number, reason: string): void;
 }
@@ -57,12 +54,26 @@ export declare abstract class Actor<Incoming = unknown, Outgoing = unknown> {
      * connection is handled — safe to load persisted state here.
      */
     handleStart(): void | Promise<void>;
+    /**
+     * Optional handler for scheduled wakes. Runs when a timer armed via
+     * {@link schedule} comes due, receiving the same `key` that was scheduled.
+     * The schedule is one-shot: it fires once and is cleared before this runs.
+     */
+    protected handleWake(_key: string): void | Promise<void>;
+    /**
+     * Arm a one-shot wake at `at` (epoch ms or a `Date`), identified by `key`.
+     * When it comes due the platform calls {@link handleWake} with this `key`.
+     * Scheduling the same `key` again reschedules it.
+     */
+    protected schedule(_key: string, _at: number | Date): Promise<void>;
+    /** Cancel a pending wake previously armed with {@link schedule}. */
+    protected cancelSchedule(_key: string): Promise<void>;
     /**
      * Managed ticker (opt-in). Override {@link shouldTick} and the platform runs
      * {@link handleTick} on a timer of {@link tickIntervalMs} while it returns true,
      * and stops (letting the Durable Object hibernate — no compute cost) when it
      * returns false. The platform owns scheduling, rescheduling, self-heal, and
-     * error-safety — you don't call {@link startLoop}/{@link stopLoop}.
+     * error-safety.
      *
      * Re-evaluated after every connect/message/close and on every tick, so keep it
      * cheap and pure (no async, no side effects). Example: `return this.players >= 2`.
@@ -71,8 +82,6 @@ export declare abstract class Actor<Incoming = unknown, Outgoing = unknown> {
     protected shouldTick?(): boolean;
     protected broadcast(_data: Outgoing): void;
     protected getConnections(): Conn<Outgoing>[];
-    protected startLoop(_ms: number): Promise<void>;
-    protected stopLoop(): Promise<void>;
     protected get instanceId(): string;
     protected get storage(): Storage;
     /**

package/dist/actor.js

@@ -30,7 +30,7 @@ export class Actor {
          * {@link handleTick} on a timer of {@link tickIntervalMs} while it returns true,
          * and stops (letting the Durable Object hibernate — no compute cost) when it
          * returns false. The platform owns scheduling, rescheduling, self-heal, and
-         * error-safety — you don't call {@link startLoop}/{@link stopLoop}.
+         * error-safety.
          *
          * Re-evaluated after every connect/message/close and on every tick, so keep it
          * cheap and pure (no async, no side effects). Example: `return this.players >= 2`.
@@ -42,18 +42,30 @@ export class Actor {
      * connection is handled — safe to load persisted state here.
      */
     handleStart() { }
+    /**
+     * Optional handler for scheduled wakes. Runs when a timer armed via
+     * {@link schedule} comes due, receiving the same `key` that was scheduled.
+     * The schedule is one-shot: it fires once and is cleared before this runs.
+     */
+    handleWake(_key) { }
+    /**
+     * Arm a one-shot wake at `at` (epoch ms or a `Date`), identified by `key`.
+     * When it comes due the platform calls {@link handleWake} with this `key`.
+     * Scheduling the same `key` again reschedules it.
+     */
+    schedule(_key, _at) {
+        throw new Error("Actor.schedule() is only available inside a deployed actor");
+    }
+    /** Cancel a pending wake previously armed with {@link schedule}. */
+    cancelSchedule(_key) {
+        throw new Error("Actor.cancelSchedule() is only available inside a deployed actor");
+    }
     broadcast(_data) {
         throw new Error("Actor.broadcast() is only available inside a deployed actor");
     }
     getConnections() {
         throw new Error("Actor.getConnections() is only available inside a deployed actor");
     }
-    startLoop(_ms) {
-        throw new Error("Actor.startLoop() is only available inside a deployed actor");
-    }
-    stopLoop() {
-        throw new Error("Actor.stopLoop() is only available inside a deployed actor");
-    }
     get instanceId() {
         throw new Error("Actor.instanceId is only available inside a deployed actor");
     }

package/dist/client.js

@@ -113,6 +113,7 @@ export function createClient(config) {
     const userAuthModule = createAuthModule(axiosClient, functionsAxiosClient, appId, {
         appBaseUrl: normalizedAppBaseUrl,
         serverUrl,
+        token,
     });
     // Apply the access token before any module that may issue authenticated
     // requests during construction (notably analytics, which fires an init

package/dist/modules/analytics.d.ts

@@ -1,6 +1,6 @@
 import { AxiosInstance } from "axios";
 import { TrackEventParams, AnalyticsModuleOptions } from "./analytics.types";
-import type { AuthModule } from "./auth.types";
+import type { InternalAuthModule } from "./auth.types";
 export declare const USER_HEARTBEAT_EVENT_NAME = "__user_heartbeat_event__";
 export declare const ANALYTICS_INITIALIZATION_EVENT_NAME = "__initialization_event__";
 export declare const ANALYTICS_SESSION_DURATION_EVENT_NAME = "__session_duration_event__";
@@ -10,11 +10,22 @@ export interface AnalyticsModuleArgs {
     axiosClient: AxiosInstance;
     serverUrl: string;
     appId: string;
-    userAuthModule: AuthModule;
+    userAuthModule: InternalAuthModule;
 }
 export declare const createAnalyticsModule: ({ axiosClient, serverUrl, appId, userAuthModule, }: AnalyticsModuleArgs) => {
     track: (params: TrackEventParams) => void;
     cleanup: () => void;
 };
+/**
+ * Clears the memoized analytics session context.
+ *
+ * The context holds the `user_id` resolved by `auth.me()` and is reused for the
+ * lifetime of the session, so it has to be dropped whenever the identity
+ * changes. Without this, a visitor who loads a page anonymously and then logs in
+ * keeps reporting `user_id: null` on every subsequent event.
+ *
+ * @internal
+ */
+export declare function resetAnalyticsSessionContext(): void;
 export declare function getAnalyticsConfigFromUrlParams(): AnalyticsModuleOptions | undefined;
 export declare function getAnalyticsSessionId(): string;

package/dist/modules/analytics.js

@@ -165,7 +165,12 @@ async function startAnalyticsProcessor(handleTrack, options) {
 }
 function startHeartBeatProcessor(track) {
     var _a;
-    if (analyticsSharedState.isHeartBeatProcessing ||
+    // Browser-only, like the other automatic events here (initialization, session
+    // duration, visibility). Outside a browser this timer fired a `me()` every
+    // interval for the lifetime of a long-lived server-side client, and kept the
+    // Node event loop alive. Explicit `analytics.track()` calls still work.
+    if (typeof window === "undefined" ||
+        analyticsSharedState.isHeartBeatProcessing ||
         ((_a = analyticsSharedState.config.heartBeatInterval) !== null && _a !== void 0 ? _a : 0) < 10) {
         return () => { };
     }
@@ -226,8 +231,29 @@ function transformEventDataToApiRequestData(sessionContext) {
     });
 }
 let sessionContextPromise = null;
+/**
+ * Clears the memoized analytics session context.
+ *
+ * The context holds the `user_id` resolved by `auth.me()` and is reused for the
+ * lifetime of the session, so it has to be dropped whenever the identity
+ * changes. Without this, a visitor who loads a page anonymously and then logs in
+ * keeps reporting `user_id: null` on every subsequent event.
+ *
+ * @internal
+ */
+export function resetAnalyticsSessionContext() {
+    analyticsSharedState.sessionContext = null;
+    sessionContextPromise = null;
+}
 async function getSessionContext(userAuthModule) {
     if (!analyticsSharedState.sessionContext) {
+        // With no token there is no identity to resolve: `me()` can only answer 401,
+        // which the browser logs to the console before any handler here sees it. On
+        // a public page that request is the sole reason an error appears, so skip
+        // it. This is not memoized — a visitor who logs in later must still resolve.
+        if (!userAuthModule.hasToken()) {
+            return { user_id: null, session_id: getAnalyticsSessionId() };
+        }
         if (!sessionContextPromise) {
             const sessionId = getAnalyticsSessionId();
             sessionContextPromise = userAuthModule
@@ -241,7 +267,18 @@ async function getSessionContext(userAuthModule) {
                 session_id: sessionId,
             }));
         }
-        analyticsSharedState.sessionContext = await sessionContextPromise;
+        const pending = sessionContextPromise;
+        const context = await pending;
+        // Publish only if this lookup is still the current one. A reset that lands
+        // while the request is in flight nulls `sessionContextPromise`, and an
+        // unconditional write here would put the pre-reset identity back and pin it
+        // for the rest of the session. The awaited value is still returned: these
+        // events were queued before the identity changed, so that is who they
+        // belong to.
+        if (sessionContextPromise === pending) {
+            analyticsSharedState.sessionContext = context;
+        }
+        return context;
     }
     return analyticsSharedState.sessionContext;
 }

package/dist/modules/auth.d.ts

@@ -1,5 +1,5 @@
 import { AxiosInstance } from "axios";
-import { AuthModule, AuthModuleOptions } from "./auth.types";
+import { AuthModuleOptions, InternalAuthModule } from "./auth.types";
 /**
  * Creates the auth module for the Base44 SDK.
  *
@@ -10,4 +10,4 @@ import { AuthModule, AuthModuleOptions } from "./auth.types";
  * @returns Auth module with authentication and user management methods
  * @internal
  */
-export declare function createAuthModule(axios: AxiosInstance, functionsAxiosClient: AxiosInstance, appId: string, options: AuthModuleOptions): AuthModule;
+export declare function createAuthModule(axios: AxiosInstance, functionsAxiosClient: AxiosInstance, appId: string, options: AuthModuleOptions): InternalAuthModule;

package/dist/modules/auth.js

@@ -1,3 +1,4 @@
+import { resetAnalyticsSessionContext } from "./analytics.js";
 function isInsideIframe() {
     if (typeof window === "undefined")
         return false;
@@ -63,10 +64,40 @@ function loginViaPopup(url, redirectUrl, expectedOrigin) {
  * @internal
  */
 export function createAuthModule(axios, functionsAxiosClient, appId, options) {
+    // In-flight `me()` request, shared by concurrent callers. The analytics
+    // module resolves its session context through `me()` at client construction,
+    // at the same moment most apps issue their own `me()`. Browsers serialize the
+    // two identical GETs, so the second pays the first's full latency on every
+    // cold load.
+    //
+    // This shares the pending promise only — it is cleared as soon as the request
+    // settles, so no resolved user is ever retained. Caching the user across
+    // requests would leave the app rendering a stale identity after logout or a
+    // session swap.
+    let pendingMe = null;
+    const clearPendingMe = () => {
+        pendingMe = null;
+    };
+    // Tracked here rather than read off `axios.defaults` so the answer stays tied
+    // to the identity transitions below (`setToken`, `logout`) instead of to the
+    // header a caller may have set on the instance directly.
+    let hasAccessToken = Boolean(options.token);
     return {
+        hasToken() {
+            return hasAccessToken;
+        },
         // Get current user information
         async me() {
-            return axios.get(`/apps/${appId}/entities/User/me`);
+            const request = pendingMe !== null && pendingMe !== void 0 ? pendingMe : axios.get(`/apps/${appId}/entities/User/me`).finally(() => {
+                // Only retire this request if it is still the shared one. An identity
+                // change mid-flight clears `pendingMe` and the next caller starts a
+                // fresh request; an unconditional clear here would retire that newer
+                // request instead, so a third caller would issue a duplicate.
+                if (pendingMe === request)
+                    pendingMe = null;
+            });
+            pendingMe = request;
+            return request;
         },
         // Update current user data
         async updateMe(data) {
@@ -116,6 +147,11 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
         logout(redirectUrl) {
             // Remove token from axios headers (always do this)
             delete axios.defaults.headers.common["Authorization"];
+            // Drop identity resolved under the previous session: a `me()` already in
+            // flight would otherwise resolve into callers that run after the logout.
+            clearPendingMe();
+            resetAnalyticsSessionContext();
+            hasAccessToken = false;
             // Only do the rest if in a browser environment
             if (typeof window !== "undefined") {
                 // Remove token from localStorage
@@ -140,6 +176,11 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
         setToken(token, saveToStorage = true) {
             if (!token)
                 return;
+            // Same reasoning as in `logout`: the identity changes here, so anything
+            // resolved for the previous one must not be handed to later callers.
+            clearPendingMe();
+            resetAnalyticsSessionContext();
+            hasAccessToken = true;
             // handle token change for axios clients
             axios.defaults.headers.common["Authorization"] = `Bearer ${token}`;
             functionsAxiosClient.defaults.headers.common["Authorization"] = `Bearer ${token}`;

package/dist/modules/auth.types.d.ts

@@ -92,6 +92,12 @@ export interface AuthModuleOptions {
     serverUrl: string;
     /** Base URL for the app (used for login redirects). */
     appBaseUrl: string;
+    /**
+     * Access token the client was constructed with, if any. Seeds the module's
+     * view of whether a session exists before {@link AuthModule.setToken} runs,
+     * which is how the server-side SDK reports a token it never sets explicitly.
+     */
+    token?: string;
 }
 /**
  * Authentication module for managing user authentication and authorization. The module automatically stores tokens in local storage when available and manages authorization headers for API requests.
@@ -515,3 +521,20 @@ export interface AuthModule {
      */
     changePassword(params: ChangePasswordParams): Promise<any>;
 }
+/**
+ * The auth module as constructed internally, before it is narrowed to
+ * {@link AuthModule} on the public client. Not exported from the package
+ * index — SDK consumers see only {@link AuthModule}.
+ *
+ * @internal
+ */
+export interface InternalAuthModule extends AuthModule {
+    /**
+     * Whether an access token is currently set on the client.
+     *
+     * Reports only the presence of a token, never its validity — an expired or
+     * revoked token still reads as `true`. Callers use this to skip requests that
+     * could not succeed without a session, not to decide that one is valid.
+     */
+    hasToken(): boolean;
+}

package/dist/modules/connectors.types.d.ts

@@ -53,11 +53,14 @@ export interface AppUserConnectorConnectionResponse {
  *
  * ## Shared connectors
  *
- * All app users share a single OAuth token. Use this for shared accounts. For example, posting to a company Slack channel or reading from a shared Google Calendar. To use a shared connector:
+ * All app users share a single OAuth token. Use this for shared accounts. For example, posting to a company Slack channel or reading from a shared Google Calendar.
  *
- * 1. Connect the external service account in the app's Integration settings or using the [`connectors push`](/developers/references/cli/commands/connectors-push) CLI command.
- * 2. In a backend function, call {@linkcode getConnection | getConnection()} using the service role client (`base44.asServiceRole.connectors`) with an [integration type](#available-connectors) string to retrieve the shared OAuth token.
- * 3. Use the returned `accessToken` to call the external service's API directly. Some connectors also return a `connectionConfig` with additional values such as a subdomain for building the API URL.
+ * Shared connectors come in two forms, depending on how the connector is set up. Both return the same app-wide token, so they differ only in how you identify the connector in code:
+ *
+ * - **Platform connectors** are connected from the app's Integration settings or with the [`connectors push`](/developers/references/cli/commands/connectors-push) CLI command, and are identified by an [integration type](#available-connectors) string. Retrieve them with {@linkcode getConnection | getConnection()}.
+ * - **Workspace-registered connectors** are backed by your own OAuth app, registered once in Workspace Settings and consented to by the app builder. They are identified by a connector ID instead of an integration type. Retrieve them with {@linkcode getWorkspaceConnection | getWorkspaceConnection()}. Connectors whose OAuth app is specific to your own account, such as Databricks and Snowflake, work this way.
+ *
+ * To use a shared connector, call the matching method on the service role client `base44.asServiceRole.connectors` from a backend function, then use the returned `accessToken` to call the external service's API directly. Some connectors also return a `connectionConfig` with additional values, such as a subdomain, that you need to build the API URL.
  *
  * ## App user connectors
  *
@@ -70,7 +73,7 @@ export interface AppUserConnectorConnectionResponse {
  *
  * ## Available connectors
  *
- * All connectors listed below support both shared and app user connections. For shared connectors, pass the integration type string to {@linkcode getConnection | getConnection()}. For app user connectors, register the connector in Workspace Settings and use the connector ID with {@linkcode getCurrentAppUserConnection | getCurrentAppUserConnection()}.
+ * The connectors below can be used as shared connectors or as app user connectors. For a shared platform connector, pass the integration type string to {@linkcode getConnection | getConnection()}. For a connector you register in Workspace Settings with your own OAuth app, use the connector ID with {@linkcode getWorkspaceConnection | getWorkspaceConnection()} for a shared token, or with {@linkcode getCurrentAppUserConnection | getCurrentAppUserConnection()} for a per-user token.
  *
  * | Service | Type identifier |
  * |---|---|
@@ -204,6 +207,8 @@ export interface ConnectorsModule {
      *
      * Use this when a single shared account is connected and all app users access the same token. For per-user tokens, use [`getCurrentAppUserConnection()`](#getcurrentappuserconnection) instead.
      *
+     * This form is for platform connectors identified by an integration type. Connectors backed by your own OAuth app registered in Workspace Settings, such as Databricks and Snowflake, are retrieved by connector ID with {@linkcode getWorkspaceConnection | getWorkspaceConnection()} instead.
+     *
      * Some connectors require connection-specific parameters to build API calls.
      * In such cases, the returned `connectionConfig` is an object with the additional parameters. If there are no extra parameters needed for the connection, the `connectionConfig` is `null`.
      *
@@ -257,28 +262,27 @@ export interface ConnectorsModule {
      */
     getConnection(integrationType: ConnectorIntegrationType): Promise<ConnectorConnectionResponse>;
     /**
-     * Retrieves the OAuth access token and connection configuration for a **workspace-registered** connector
-     * (a connector backed by an OAuth app registered in the workspace, consented to once by the app builder).
+     * Retrieves the shared OAuth access token and connection configuration for a [workspace-registered connector](#shared-connectors).
      *
-     * Use this method when the app's backend function needs to use a connector identified by its
-     * workspace-connector ID rather than a platform integration type. The token returned represents
-     * the app builder's consent against the workspace's OAuth app and is shared across all app users
-     * of the app — identical semantics to the platform-shared {@link getConnection} form,
-     * differing only in which OAuth app was used to produce the token.
+     * Use this for a connector backed by your own OAuth app that you register in Workspace Settings, such as Databricks or Snowflake. The app builder consents to the connector once, and the returned token is shared across all app users of the app. This is the shared-token counterpart to {@linkcode getCurrentAppUserConnection | getCurrentAppUserConnection()}, which returns a per-user token for the same kind of connector. The semantics match {@linkcode getConnection | getConnection()}, except that you identify the connector by ID rather than by integration type.
      *
-     * @param connectorId - The ID of the workspace connector (the `OrganizationConnector` database ID) as surfaced in the builder chat context.
+     * Some connectors require connection-specific parameters to build API calls. In such cases, the returned `connectionConfig` is an object with those parameters, such as the account subdomain used to construct the API URL. When no extra parameters are needed, `connectionConfig` is `null`.
+     *
+     * @param connectorId - The ID of the workspace connector, not the integration type string. You can find it on the connector's settings page in Workspace Settings.
      * @returns Promise resolving to a {@link ConnectorConnectionResponse} with `accessToken` and `connectionConfig`.
      *
      * @example
      * ```typescript
-     * // Get the connection for a workspace-registered connector
-     * const { accessToken, connectionConfig } = await base44.asServiceRole.connectors.getWorkspaceConnection(
-     *   'abc123def',
+     * // Snowflake connection
+     * // Retrieve the shared token and run a statement against the account
+     * const { accessToken, connectionConfig } = await base44.asServiceRole.connectors.getWorkspaceConnection('abc123def');
+     *
+     * const response = await fetch(
+     *   `https://${connectionConfig?.subdomain}.snowflakecomputing.com/api/v2/statements`,
+     *   { headers: { Authorization: `Bearer ${accessToken}` } }
      * );
      *
-     * const response = await fetch(`https://${connectionConfig?.subdomain}.snowflakecomputing.com/api/v2/statements`, {
-     *   headers: { Authorization: `Bearer ${accessToken}` },
-     * });
+     * const data = await response.json();
      * ```
      */
     getWorkspaceConnection(connectorId: string): Promise<ConnectorConnectionResponse>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@depup/base44__sdk",
-  "version": "0.8.41-depup.1",
+  "version": "0.8.43-depup.0",
   "description": "JavaScript SDK for Base44 API (with updated dependencies)",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -88,8 +88,8 @@
     },
     "depsUpdated": 3,
     "originalPackage": "@base44/sdk",
-    "originalVersion": "0.8.41",
-    "processedAt": "2026-07-30T00:36:51.927Z",
+    "originalVersion": "0.8.43",
+    "processedAt": "2026-08-18T08:10:35.872Z",
     "smokeTest": "passed"
   }
 }