@depup/base44__sdk 0.8.43-depup.0 → 0.8.45-depup.0

package/README.md

@@ -13,8 +13,8 @@ npm install @depup/base44__sdk
 
 | Field | Value |
 |-------|-------|
-| Original | [@base44/sdk](https://www.npmjs.com/package/@base44/sdk) @ 0.8.43 |
-| Processed | 2026-08-18 |
+| Original | [@base44/sdk](https://www.npmjs.com/package/@base44/sdk) @ 0.8.45 |
+| Processed | 2026-09-02 |
 | Smoke test | passed |
 | Deps updated | 3 |
 
@@ -22,9 +22,9 @@ npm install @depup/base44__sdk
 
 | Dependency | From | To |
 |------------|------|-----|
-| axios | ^1.18.1 | ^1.19.0 |
+| axios | ^1.18.1 | ^1.20.0 |
 | partysocket | ^0.0.23 | ^1.3.0 |
-| uuid | ^13.0.2 | ^14.0.1 |
+| uuid | ^13.0.2 | ^14.0.2 |
 
 ---
 

package/changes.json

@@ -2,7 +2,7 @@
   "bumped": {
     "axios": {
       "from": "^1.18.1",
-      "to": "^1.19.0"
+      "to": "^1.20.0"
     },
     "partysocket": {
       "from": "^0.0.23",
@@ -10,9 +10,9 @@
     },
     "uuid": {
       "from": "^13.0.2",
-      "to": "^14.0.1"
+      "to": "^14.0.2"
     }
   },
-  "timestamp": "2026-08-18T08:10:22.589Z",
+  "timestamp": "2026-09-02T08:12:09.333Z",
   "totalUpdated": 3
 }

package/dist/client.js

@@ -9,10 +9,11 @@ import { createFunctionsModule } from "./modules/functions.js";
 import { createAgentsModule } from "./modules/agents.js";
 import { createAiGatewayModule } from "./modules/ai-gateway.js";
 import { createAppLogsModule } from "./modules/app-logs.js";
+import { createAppModule } from "./modules/app.js";
 import { createUsersModule } from "./modules/users.js";
 import { RoomsSocket } from "./utils/socket-utils.js";
 import { createAnalyticsModule } from "./modules/analytics.js";
-import { createActorsModule, resolveActorsHost } from "./modules/actors.js";
+import { createActorsModule, resolveActorsHost, } from "./modules/actors.js";
 /**
  * Creates a Base44 client.
  *
@@ -110,6 +111,15 @@ export function createClient(config) {
         token: serviceToken,
         interceptResponses: false,
     });
+    // Dedicated client for actor connection-token mints: no onError (a legacy
+    // actor answers every mint with an expected 409 before the proxy fallback,
+    // which must not reach the app's error handler — the actors module forwards
+    // genuine failures itself via onMintError) and no constructor token
+    // (auth is per-request so a login/logout is picked up on every reconnect).
+    const actorsAxiosClient = createAxiosClient({
+        baseURL: `${serverUrl}/api`,
+        headers,
+    });
     const userAuthModule = createAuthModule(axiosClient, functionsAxiosClient, appId, {
         appBaseUrl: normalizedAppBaseUrl,
         serverUrl,
@@ -127,11 +137,26 @@ export function createClient(config) {
     }
     const actorsModule = createActorsModule({
         appId,
-        // serverUrl is often relative/empty (same-origin app); PartySocket needs an
-        // absolute host, so fall back to the page origin.
+        // serverUrl is often relative/empty (same-origin app); the proxy-fallback
+        // URL needs an absolute host, so fall back to the page origin.
         host: resolveActorsHost(serverUrl, typeof window !== "undefined" ? (_a = window.location) === null || _a === void 0 ? void 0 : _a.origin : undefined),
         functionsVersion,
         getAuthToken: () => token || getAccessToken(),
+        mintConnectionToken: async (actorName, room, connectionId) => {
+            const authToken = token || getAccessToken();
+            return await actorsAxiosClient.post(`/apps/${appId}/actors/${encodeURIComponent(actorName)}/connection-token`, { room, connection_id: connectionId }, {
+                headers: {
+                    ...(authToken ? { Authorization: `Bearer ${authToken}` } : {}),
+                    // The mint endpoint resolves draft vs published from this header;
+                    // only the functions axios clients send it by default.
+                    ...(functionsVersion
+                        ? { "Base44-Functions-Version": functionsVersion }
+                        : {}),
+                },
+            });
+        },
+        transport: options === null || options === void 0 ? void 0 : options.actorsTransport,
+        onMintError: options === null || options === void 0 ? void 0 : options.onError,
     });
     const userModules = {
         entities: createEntitiesModule({
@@ -163,6 +188,7 @@ export function createClient(config) {
         }),
         aiGateway: createAiGatewayModule({ serverUrl, token, appId }),
         appLogs: createAppLogsModule(axiosClient, appId),
+        app: createAppModule(axiosClient, appId),
         users: createUsersModule(axiosClient, appId),
         analytics: createAnalyticsModule({
             axiosClient,

package/dist/client.types.d.ts

@@ -7,6 +7,7 @@ import type { FunctionsModule } from "./modules/functions.types.js";
 import type { AgentsModule } from "./modules/agents.types.js";
 import type { AiGatewayModule } from "./modules/ai-gateway.types.js";
 import type { AppLogsModule } from "./modules/app-logs.types.js";
+import type { AppModule } from "./modules/app.types.js";
 import type { AnalyticsModule } from "./modules/analytics.types.js";
 import type { ActorsModule } from "./modules/actors.types.js";
 /**
@@ -15,8 +16,20 @@ import type { ActorsModule } from "./modules/actors.types.js";
 export interface CreateClientOptions {
     /**
      * Optional error handler that will be called whenever an API error occurs.
+     *
+     * Also receives {@link ActorsModule | actors} connection failures. Errors
+     * are usually {@linkcode Base44Error} instances — check `error.status`.
      */
     onError?: (error: Error) => void;
+    /**
+     * Forces the actors transport. `"auto"` (default) connects directly to the
+     * actor and falls back to the platform proxy when the app's actors don't
+     * support direct connections; `"proxy"` always uses the platform proxy
+     * (ops rollback — no connection-token calls); `"direct"` disables the
+     * fallback (validation environments).
+     * @internal
+     */
+    actorsTransport?: "auto" | "proxy" | "direct";
 }
 /**
  * Configuration for creating a Base44 client.
@@ -89,6 +102,8 @@ export interface Base44Client {
     analytics: AnalyticsModule;
     /** {@link AppLogsModule | App logs module} for tracking app usage. */
     appLogs: AppLogsModule;
+    /** {@link AppModule | App module} for reading the app's own public configuration. */
+    app: AppModule;
     /** {@link ActorsModule | Actors module} for subscribing to and sending messages via Cloudflare Durable Object-backed Actors. */
     actors: ActorsModule;
     /** {@link AuthModule | Auth module} for user authentication and management. */

package/dist/index.d.ts

@@ -11,9 +11,10 @@ export type { FunctionsModule, FunctionName, FunctionNameRegistry, } from "./mod
 export type { AgentsModule, AgentName, AgentNameRegistry, AgentConversation, AgentMessage, AgentMessageReasoning, AgentMessageToolCall, AgentMessageUsage, AgentMessageCustomContext, AgentMessageMetadata, CreateConversationParams, } from "./modules/agents.types.js";
 export type { AiGatewayModule, AiGatewayConnection, } from "./modules/ai-gateway.types.js";
 export type { AppLogsModule } from "./modules/app-logs.types.js";
+export type { AppModule, AppPublicSettings, AppPublicSettingsResponse, } from "./modules/app.types.js";
 export type { ActorsModule, ActorClient, ActorRef, Connection, ActorSubscription, ActorConnectOptions, ActorNameRegistry, ActorRegistry, } from "./modules/actors.types.js";
 export type { SsoModule, SsoAccessTokenResponse } from "./modules/sso.types.js";
 export { Actor, type Conn } from "./actor.js";
-export type { ConnectorsModule, UserConnectorsModule, } from "./modules/connectors.types.js";
+export type { ConnectorsModule, UserConnectorsModule, ConnectorApiRequest, ConnectorApiResponse, ConnectorApiResponsePhase, } from "./modules/connectors.types.js";
 export type { CustomIntegrationsModule, CustomIntegrationCallParams, CustomIntegrationCallResponse, } from "./modules/custom-integrations.types.js";
 export type { GetAccessTokenOptions, SaveAccessTokenOptions, RemoveAccessTokenOptions, GetLoginUrlOptions, } from "./utils/auth-utils.types.js";

package/dist/modules/actors.d.ts

@@ -1,21 +1,47 @@
 import type { ActorRef } from "./actors.types.js";
+/** Credentials minted by the platform for one direct actor connection. */
+export interface ActorConnectionCredentials {
+    /** Direct actor endpoint, already carrying `?_pk=<connectionId>`. */
+    websocket_url: string;
+    /** Short-lived JWT bound to (app, actor, room, connectionId); appended to
+     * the URL as `token=` since browsers can't set WebSocket headers. */
+    token: string;
+}
 interface ActorsConfig {
     appId: string;
-    /** Current user access token, if authenticated. Rides the WS query so the
-     * platform proxy can authenticate the connection; anonymous connects omit it. */
+    /** Current user access token, if authenticated. Rides the WS query on the
+     * proxy-fallback path so the platform proxy can authenticate the connection;
+     * anonymous connects omit it. */
     getAuthToken(): string | null | undefined;
     /** Same semantics as function calls: editors with a non-prod version get the
      * draft actor script; everyone else gets the published one. */
     functionsVersion?: string;
-    /** Absolute host PartySocket dials (it strips the scheme and connects wss, ws
+    /** Absolute host for the proxy-fallback URL (scheme is swapped to wss, ws
      * for localhost). Resolved by {@link resolveActorsHost}. */
     host: string;
+    /** Mints a direct-connect credential for one (actor, room, connection).
+     * Called per connection attempt: the token's expiry is checked at upgrade,
+     * so every reconnect needs a fresh one. */
+    mintConnectionToken(actorName: string, room: string, connectionId: string): Promise<ActorConnectionCredentials>;
+    /** @internal Ops escape hatch: "proxy" never mints (legacy path only),
+     * "direct" never falls back. Default "auto". */
+    transport?: "auto" | "proxy" | "direct";
+    /** Called when a mint fails for a reason other than the expected
+     * direct→proxy fallback (which recovers by itself). Wired to the client's
+     * `options.onError`. */
+    onMintError?: (error: Error) => void;
 }
 /**
- * Absolute host for the actor WebSocket. PartySocket needs an absolute host and
- * can't resolve a relative/empty `serverUrl` (same-origin apps use a relative
- * `/api`, so `serverUrl` is often `""`), so fall back to the page origin.
- * PartySocket handles the scheme (https→wss, ws for localhost).
+ * The legacy platform-proxy URL, byte-for-byte what PartySocket built before
+ * the direct path existed: same scheme swap (including its localhost-needs-a-
+ * port quirk), case-preserved party segment, `_pk` first in the query. The
+ * `handler` param is load-bearing — the proxy reads it for the actor name.
+ */
+export declare function buildProxyActorUrl(rawHost: string, actorName: string, instanceId: string, connectionId: string, appId: string, token: string | null | undefined, functionsVersion?: string): string;
+/**
+ * Absolute host for the proxy-fallback actor URL. A relative/empty `serverUrl`
+ * can't be dialed (same-origin apps use a relative `/api`, so `serverUrl` is
+ * often `""`), so fall back to the page origin.
  */
 export declare function resolveActorsHost(serverUrl: string, browserOrigin?: string): string;
 export declare function createActorsModule(config: ActorsConfig): {

package/dist/modules/actors.js

@@ -1,8 +1,32 @@
-import PartySocket from "partysocket";
-// Heartbeat / half-open detection: PartySocket only reconnects on a close/error
+import { WebSocket as ReconnectingWebSocket } from "partysocket";
+// Heartbeat / half-open detection: the socket only reconnects on a close/error
 // event, so ping periodically and force a reconnect if nothing returns in DEAD_MS.
 const PING_MS = 1000;
 const DEAD_MS = 3000;
+// Mint responses that mean "direct can't serve this connection, the proxy can":
+// 409 = legacy-family actor script, 503 = direct connections not provisioned,
+// 422 = no principal (e.g. anonymous outside a browser) or an id/room only the
+// proxy's looser validation accepts, 405 = a backend that predates the mint
+// endpoint (its actor deploy routes catch the path via `{handler_name:path}`
+// but not the POST method — and the real endpoint never 405s a POST). The
+// proxy serves migrated actors too, so falling back is always safe.
+const PROXY_FALLBACK_STATUSES = new Set([405, 409, 422, 503]);
+// Mint responses no retry can fix (bad request / forbidden / not found): the
+// connection closes instead of re-minting forever; a fresh connect() re-probes.
+// 401 is deliberately absent — the auth token is re-read on every attempt, so a
+// login recovers on the next retry. Disjoint from PROXY_FALLBACK_STATUSES.
+const TERMINAL_MINT_STATUSES = new Set([400, 403, 404]);
+/** The mint's rejection can be anything; a `Base44Error` carries a numeric
+ * `.status` (absent for network failures). */
+function mintErrorStatus(err) {
+    const status = err && typeof err === "object"
+        ? err.status
+        : undefined;
+    return typeof status === "number" ? status : undefined;
+}
+function toError(err) {
+    return err instanceof Error ? err : new Error(String(err));
+}
 /**
  * A live connection to an actor instance. Only obtainable from
  * {@link ActorRef.connect}, so `subscribe`/`send` are always valid — the socket
@@ -14,23 +38,54 @@ class Connection {
         this.onClose = onClose;
         this.listeners = new Set();
         this.heartbeat = null;
+        this.closed = false;
         this.id = (_a = options === null || options === void 0 ? void 0 : options.id) !== null && _a !== void 0 ? _a : crypto.randomUUID();
-        const ws = new PartySocket({
-            host: config.host,
-            party: actorName,
-            room: instanceId,
-            id: this.id,
-            // Re-read on every (re)connect so a login/logout is picked up.
-            query: () => {
-                const token = config.getAuthToken();
-                return {
-                    app_id: config.appId,
-                    handler: actorName,
-                    ...(token ? { token } : {}),
-                    ...(config.functionsVersion ? { fv: config.functionsVersion } : {}),
-                };
-            },
-        });
+        // Direct-first with proxy fallback, decided per connection attempt. Once a
+        // mint answers with a fallback status the choice is sticky for this
+        // socket's lifetime (a fresh connect() after close() probes direct again,
+        // picking up actors migrated in the meantime). Any other mint failure
+        // rejects, which ReconnectingWebSocket retries with backoff — except the
+        // terminal statuses, which close this connection for good.
+        let useProxy = config.transport === "proxy";
+        const urlProvider = async () => {
+            var _a;
+            if (this.closed)
+                throw new Error("Actor connection is closed");
+            if (!useProxy) {
+                try {
+                    const { websocket_url, token } = await config.mintConnectionToken(actorName, instanceId, this.id);
+                    const sep = websocket_url.includes("?") ? "&" : "?";
+                    return `${websocket_url}${sep}token=${encodeURIComponent(token)}`;
+                }
+                catch (err) {
+                    const status = mintErrorStatus(err);
+                    const isFallback = config.transport !== "direct" &&
+                        status !== undefined &&
+                        PROXY_FALLBACK_STATUSES.has(status);
+                    if (!isFallback) {
+                        if (status !== undefined && TERMINAL_MINT_STATUSES.has(status)) {
+                            // close() before notifying: ws.close() stops the redial the
+                            // rethrow below would otherwise schedule, and a handler that
+                            // immediately calls connect() gets a clean new connection.
+                            this.close();
+                        }
+                        // Reported from here because the socket's error event only
+                        // preserves `err.message`, never `.status`.
+                        try {
+                            (_a = config.onMintError) === null || _a === void 0 ? void 0 : _a.call(config, toError(err));
+                        }
+                        catch (_b) {
+                            // an app handler must not break the dial loop or mask `err`
+                        }
+                        throw err;
+                    }
+                    useProxy = true;
+                }
+            }
+            // Rebuilt per attempt so a login/logout is picked up on reconnect.
+            return buildProxyActorUrl(config.host, actorName, instanceId, this.id, config.appId, config.getAuthToken(), config.functionsVersion);
+        };
+        const ws = new ReconnectingWebSocket(urlProvider);
         this.ws = ws;
         let lastMsg = Date.now();
         const bumpAlive = () => { lastMsg = Date.now(); };
@@ -53,7 +108,11 @@ class Connection {
         this.heartbeat = setInterval(() => {
             if (Date.now() - lastMsg > DEAD_MS) {
                 bumpAlive(); // avoid a reconnect storm while the new socket comes up
-                ws.reconnect();
+                // Only kick a half-open socket (OPEN but silent). When it isn't open
+                // the socket is already redialing with backoff, and reconnect() would
+                // reset that backoff into a mint call every DEAD_MS.
+                if (ws.readyState === ws.OPEN)
+                    ws.reconnect();
                 return;
             }
             try {
@@ -73,9 +132,15 @@ class Connection {
         };
     }
     send(data) {
+        // after close() the socket would buffer forever (unbounded enqueue)
+        if (this.closed)
+            return;
         this.ws.send(JSON.stringify(data));
     }
     close() {
+        if (this.closed)
+            return;
+        this.closed = true;
         if (this.heartbeat) {
             clearInterval(this.heartbeat);
             this.heartbeat = null;
@@ -104,10 +169,38 @@ function makeActorRef(actorName, instanceId, config, connections) {
     };
 }
 /**
- * Absolute host for the actor WebSocket. PartySocket needs an absolute host and
- * can't resolve a relative/empty `serverUrl` (same-origin apps use a relative
- * `/api`, so `serverUrl` is often `""`), so fall back to the page origin.
- * PartySocket handles the scheme (https→wss, ws for localhost).
+ * The legacy platform-proxy URL, byte-for-byte what PartySocket built before
+ * the direct path existed: same scheme swap (including its localhost-needs-a-
+ * port quirk), case-preserved party segment, `_pk` first in the query. The
+ * `handler` param is load-bearing — the proxy reads it for the actor name.
+ */
+export function buildProxyActorUrl(rawHost, actorName, instanceId, connectionId, appId, token, functionsVersion) {
+    let host = rawHost.replace(/^(http|https|ws|wss):\/\//, "");
+    if (host.endsWith("/"))
+        host = host.slice(0, -1);
+    const insecure = host.startsWith("localhost:") ||
+        host.startsWith("127.0.0.1:") ||
+        host.startsWith("192.168.") ||
+        host.startsWith("10.") ||
+        (host.startsWith("172.") &&
+            host.split(".")[1] >= "16" &&
+            host.split(".")[1] <= "31") ||
+        host.startsWith("[::ffff:7f00:1]:");
+    const query = new URLSearchParams([
+        ["_pk", connectionId],
+        ["app_id", appId],
+        ["handler", actorName],
+    ]);
+    if (token)
+        query.append("token", token);
+    if (functionsVersion)
+        query.append("fv", functionsVersion);
+    return `${insecure ? "ws" : "wss"}://${host}/parties/${actorName}/${instanceId}?${query}`;
+}
+/**
+ * Absolute host for the proxy-fallback actor URL. A relative/empty `serverUrl`
+ * can't be dialed (same-origin apps use a relative `/api`, so `serverUrl` is
+ * often `""`), so fall back to the page origin.
  */
 export function resolveActorsHost(serverUrl, browserOrigin) {
     return serverUrl && !serverUrl.startsWith("/") ? serverUrl : browserOrigin !== null && browserOrigin !== void 0 ? browserOrigin : serverUrl;

package/dist/modules/actors.types.d.ts

@@ -56,9 +56,14 @@ export interface Connection<N extends string = string> {
     readonly id: string;
     /** Register a message listener. Multiple are allowed; returns a per-listener unsubscribe. */
     subscribe(callback: (data: ToClientFor<N>) => void): ActorSubscription;
-    /** Send a message. Buffered by the socket until it's open. */
+    /** Send a message. Buffered by the socket until it's open; dropped after
+     * {@link close}. */
     send(data: ToServerFor<N>): void;
-    /** Tear down the socket, heartbeat, and all listeners. */
+    /**
+     * Tear down the socket, heartbeat, and all listeners. Safe to call more
+     * than once. A connection also closes itself when it fails permanently —
+     * see {@link ActorRef.connect}.
+     */
     close(): void;
 }
 /**
@@ -66,7 +71,15 @@ export interface Connection<N extends string = string> {
  * {@link connect} to open the socket and get a {@link Connection}.
  */
 export interface ActorRef<N extends string = string> {
-    /** Open the WebSocket and return the {@link Connection}. Idempotent. */
+    /**
+     * Open the WebSocket and return the {@link Connection}. Idempotent while the
+     * connection is open.
+     *
+     * A connection that fails permanently (for example, the actor doesn't exist
+     * or the caller isn't allowed to connect) closes itself and reports the
+     * error to the client's `onError` handler. Call `connect()` again after
+     * fixing the cause to get a fresh {@link Connection}, and re-subscribe.
+     */
     connect(options?: ActorConnectOptions): Connection<N>;
 }
 /**

package/dist/modules/analytics.js

@@ -25,6 +25,9 @@ const analyticsSharedState = getSharedInstance(ANALYTICS_SHARED_STATE_NAME, () =
     wasInitializationTracked: false,
     sessionContext: null,
     sessionStartTime: null,
+    // Memoized session id for when `localStorage` can't persist one — see
+    // getAnalyticsSessionId.
+    fallbackSessionId: null,
     config: {
         ...defaultConfiguration,
         ...getAnalyticsConfigFromUrlParams(),
@@ -216,9 +219,11 @@ function trackSessionDurationEvent(track) {
     });
 }
 function getEventIntrinsicData() {
+    var _a, _b;
     return {
         timestamp: new Date().toISOString(),
-        pageUrl: typeof window !== "undefined" ? window.location.pathname : null,
+        // `window.location` is absent on React Native, so read it optionally.
+        pageUrl: typeof window !== "undefined" ? (_b = (_a = window.location) === null || _a === void 0 ? void 0 : _a.pathname) !== null && _b !== void 0 ? _b : null : null,
     };
 }
 function transformEventDataToApiRequestData(sessionContext) {
@@ -302,9 +307,15 @@ export function getAnalyticsConfigFromUrlParams() {
     // return the config object //
     return { enabled: analyticsEnable === "true" };
 }
+// When the id can't be persisted (React Native has no `localStorage`), keep
+// it stable for the process instead of minting a fresh one per call.
+function getFallbackSessionId() {
+    var _a;
+    return ((_a = analyticsSharedState.fallbackSessionId) !== null && _a !== void 0 ? _a : (analyticsSharedState.fallbackSessionId = generateUuid()));
+}
 export function getAnalyticsSessionId() {
     if (typeof window === "undefined") {
-        return generateUuid();
+        return getFallbackSessionId();
     }
     try {
         const sessionId = localStorage.getItem(ANALYTICS_SESSION_ID_LOCAL_STORAGE_KEY);
@@ -316,6 +327,6 @@ export function getAnalyticsSessionId() {
         return sessionId;
     }
     catch (_a) {
-        return generateUuid();
+        return getFallbackSessionId();
     }
 }

package/dist/modules/app.d.ts

@@ -0,0 +1,11 @@
+import { AxiosInstance } from "axios";
+import { AppModule } from "./app.types";
+/**
+ * Creates the app module for the Base44 SDK.
+ *
+ * @param axios - Axios instance
+ * @param appId - Application ID
+ * @returns App module for reading the app's own configuration
+ * @internal
+ */
+export declare function createAppModule(axios: AxiosInstance, appId: string): AppModule;

package/dist/modules/app.js

@@ -0,0 +1,15 @@
+/**
+ * Creates the app module for the Base44 SDK.
+ *
+ * @param axios - Axios instance
+ * @param appId - Application ID
+ * @returns App module for reading the app's own configuration
+ * @internal
+ */
+export function createAppModule(axios, appId) {
+    return {
+        async getPublicSettings() {
+            return axios.get(`/apps/public/prod/public-settings/by-id/${appId}`);
+        },
+    };
+}

package/dist/modules/app.types.d.ts

@@ -1,3 +1,55 @@
+/**
+ * The app's access policy: whether the app is reachable without an account, and
+ * who may sign in.
+ */
+export type AppPublicSettings = "private_with_login" | "public_with_login" | "public_without_login" | "workspace_with_login" | string;
+/**
+ * The app's public configuration, as returned by {@link AppModule.getPublicSettings}.
+ */
+export interface AppPublicSettingsResponse {
+    /** The app's ID. */
+    id: string;
+    /** The app's access policy. */
+    public_settings: AppPublicSettings;
+}
+/**
+ * App module for reading the app's own public configuration.
+ *
+ * Use it to discover how the app is gated before rendering it, so a private app
+ * can send the visitor to login instead of rendering an empty shell.
+ *
+ * ## Authentication Modes
+ *
+ * This module is available to use with a client in all authentication modes. The
+ * client's token, when it has one, is sent with the request — a signed-in visitor
+ * who has no access to the app is reported differently from an anonymous one.
+ */
+export interface AppModule {
+    /**
+     * Get the app's public configuration.
+     *
+     * Rejects with a {@linkcode Base44Error} when the visitor may not open the app:
+     * `status` is `403` and `data.extra_data.reason` says why — `"auth_required"`
+     * when the visitor must sign in, `"user_not_registered"` when the signed-in
+     * visitor has no access to this app.
+     *
+     * @returns Promise resolving to the app's ID and access policy.
+     *
+     * @example
+     * ```typescript
+     * // Decide what to render before the app boots
+     * try {
+     *   const { public_settings } = await base44.app.getPublicSettings();
+     *   console.log('App access policy:', public_settings);
+     * } catch (error) {
+     *   if (error.status === 403) {
+     *     console.log('Blocked because:', error.data?.extra_data?.reason);
+     *   }
+     * }
+     * ```
+     */
+    getPublicSettings(): Promise<AppPublicSettingsResponse>;
+}
 /**
  * @internal
  */
@@ -62,7 +114,7 @@ export interface AppLike {
     agents?: Record<string, any>;
     logo_url?: string;
     slug?: string;
-    public_settings?: "private_with_login" | "public_with_login" | "public_without_login" | "workspace_with_login" | string;
+    public_settings?: AppPublicSettings;
     is_blocked?: boolean;
     github_repo_url?: string;
     main_page?: string;

package/dist/modules/auth.types.d.ts

@@ -134,12 +134,15 @@ export interface AuthModule {
     /**
      * Updates the current authenticated user's information.
      *
-     * You can update `role` and any [custom fields](/developers/backend/resources/entities/user-schema#custom-fields) defined in your
-     * User entity schema.
-     * The `role` value must be either `'user'` or `'admin'`.
+     * You can update any [custom fields](/developers/backend/resources/entities/user-schema#custom-fields)
+     * defined in your User entity schema.
+     *
+     * Updating `role` requires editor access on the app.
+     *
      * <Note>
-     * The following fields are read-only and can't be changed with this method:
-     * `id`, `email`, `full_name`, `created_date`, `updated_date`, and `created_by`.
+     * These fields can't be changed with this method:
+     * `id`, `email`, `full_name`, `created_date`, `updated_date`, `created_by`,
+     * and `collaborator_role`.
      * </Note>
      *
      * @param data - Object containing the fields to update.
@@ -147,9 +150,8 @@ export interface AuthModule {
      *
      * @example
      * ```typescript
-     * // Update role and custom fields defined in your User entity
+     * // Update custom fields defined in your User entity
      * await base44.auth.updateMe({
-     *   role: 'admin',
      *   bio: 'Software developer',
      *   preferences: { theme: 'dark' }
      * });

package/dist/modules/connectors.js

@@ -1,3 +1,11 @@
+const CONNECTOR_API_METHODS = new Set([
+    "GET",
+    "POST",
+    "PUT",
+    "PATCH",
+    "DELETE",
+    "HEAD",
+]);
 /**
  * Creates the Connectors module for the Base44 SDK.
  *
@@ -17,7 +25,7 @@ export function createConnectorsModule(axios, appId) {
             if (!integrationType || typeof integrationType !== "string") {
                 throw new Error("Integration type is required and must be a string");
             }
-            const response = await axios.get(`/apps/${appId}/external-auth/tokens/${integrationType}`);
+            const response = await axios.get(`/apps/${appId}/external-auth/tokens/${encodeURIComponent(integrationType)}`);
             // @ts-expect-error
             return response.access_token;
         },
@@ -26,7 +34,7 @@ export function createConnectorsModule(axios, appId) {
             if (!integrationType || typeof integrationType !== "string") {
                 throw new Error("Integration type is required and must be a string");
             }
-            const response = await axios.get(`/apps/${appId}/external-auth/tokens/${integrationType}`);
+            const response = await axios.get(`/apps/${appId}/external-auth/tokens/${encodeURIComponent(integrationType)}`);
             const data = response;
             return {
                 accessToken: data.access_token,
@@ -38,7 +46,7 @@ export function createConnectorsModule(axios, appId) {
             if (!connectorId || typeof connectorId !== "string") {
                 throw new Error("Connector ID is required and must be a string");
             }
-            const response = await axios.get(`/apps/${appId}/external-auth/tokens/connectors/${connectorId}`);
+            const response = await axios.get(`/apps/${appId}/external-auth/tokens/connectors/${encodeURIComponent(connectorId)}`);
             const data = response;
             return {
                 accessToken: data.access_token,
@@ -52,7 +60,7 @@ export function createConnectorsModule(axios, appId) {
             if (!connectorId || typeof connectorId !== "string") {
                 throw new Error("Connector ID is required and must be a string");
             }
-            const response = await axios.get(`/apps/${appId}/app-user-auth/connectors/${connectorId}/token`);
+            const response = await axios.get(`/apps/${appId}/app-user-auth/connectors/${encodeURIComponent(connectorId)}/token`);
             const data = response;
             return data.access_token;
         },
@@ -61,13 +69,65 @@ export function createConnectorsModule(axios, appId) {
             if (!connectorId || typeof connectorId !== "string") {
                 throw new Error("Connector ID is required and must be a string");
             }
-            const response = await axios.get(`/apps/${appId}/app-user-auth/connectors/${connectorId}/token`);
+            const response = await axios.get(`/apps/${appId}/app-user-auth/connectors/${encodeURIComponent(connectorId)}/token`);
             const data = response;
             return {
                 accessToken: data.access_token,
                 connectionConfig: (_a = data.connection_config) !== null && _a !== void 0 ? _a : null,
             };
         },
+        async callApi(integrationType, request) {
+            assertNonEmptyString(integrationType, "Integration type");
+            // Encoded so a runtime-built identifier can only ever select a
+            // connector, never re-target another route under this token.
+            return proxyCall(axios, `/apps/${appId}/connectors/${encodeURIComponent(integrationType)}/call`, request);
+        },
+    };
+}
+function assertNonEmptyString(value, label) {
+    if (!value || typeof value !== "string") {
+        throw new Error(`${label} is required and must be a string`);
+    }
+}
+/**
+ * POST a request to the connector proxy and normalize the response.
+ *
+ * The proxy reports upstream outcomes in the body rather than as HTTP status, so
+ * a provider 4xx/5xx arrives here as a resolved response with `success: false` —
+ * only Base44-side failures reject through the axios error interceptor.
+ *
+ * @internal
+ */
+async function proxyCall(axios, url, request) {
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+    if (!request || typeof request !== "object") {
+        throw new Error("Request is required and must be an object");
+    }
+    assertNonEmptyString(request.path, "Request path");
+    const method = (_a = request.method) !== null && _a !== void 0 ? _a : "GET";
+    if (!CONNECTOR_API_METHODS.has(method)) {
+        throw new Error("Request method must be one of GET, POST, PUT, PATCH, DELETE, or HEAD");
+    }
+    const response = await axios.post(url, {
+        method,
+        // Omitted when unset (undefined or null, since untyped callers write
+        // either) so the proxy applies the connector's declared default host.
+        ...(request.host == null ? {} : { host: request.host }),
+        path: request.path,
+        query: (_b = request.query) !== null && _b !== void 0 ? _b : {},
+        headers: (_c = request.headers) !== null && _c !== void 0 ? _c : {},
+        body: (_d = request.body) !== null && _d !== void 0 ? _d : null,
+    });
+    const data = response;
+    return {
+        success: data.success,
+        phase: data.phase,
+        status: (_e = data.status_code) !== null && _e !== void 0 ? _e : null,
+        data: data.data,
+        dataBase64: (_f = data.data_base64) !== null && _f !== void 0 ? _f : null,
+        contentType: (_g = data.content_type) !== null && _g !== void 0 ? _g : null,
+        headers: (_h = data.headers) !== null && _h !== void 0 ? _h : {},
+        creditsCharged: (_j = data.credits_charged) !== null && _j !== void 0 ? _j : 0,
     };
 }
 /**
@@ -84,7 +144,7 @@ export function createUserConnectorsModule(axios, appId) {
             if (!connectorId || typeof connectorId !== "string") {
                 throw new Error("Connector ID is required and must be a string");
             }
-            const response = await axios.post(`/apps/${appId}/app-user-auth/connectors/${connectorId}/initiate`);
+            const response = await axios.post(`/apps/${appId}/app-user-auth/connectors/${encodeURIComponent(connectorId)}/initiate`);
             const data = response;
             return data.redirect_url;
         },
@@ -92,7 +152,7 @@ export function createUserConnectorsModule(axios, appId) {
             if (!connectorId || typeof connectorId !== "string") {
                 throw new Error("Connector ID is required and must be a string");
             }
-            await axios.delete(`/apps/${appId}/app-user-auth/connectors/${connectorId}`);
+            await axios.delete(`/apps/${appId}/app-user-auth/connectors/${encodeURIComponent(connectorId)}`);
         },
     };
 }

package/dist/modules/connectors.types.d.ts

@@ -41,6 +41,81 @@ export interface AppUserConnectorConnectionResponse {
     /** Key-value configuration for the connection, or `null` if the connector does not provide one. */
     connectionConfig: Record<string, string> | null;
 }
+/**
+ * How far a metered connector call progressed through the Base44 proxy.
+ *
+ * Only `not_sent` proves that the provider did not execute the request.
+ * `timed_out` and `sent_unconfirmed` may have executed upstream, so do not
+ * automatically retry non-idempotent requests based on those phases.
+ */
+export type ConnectorApiResponsePhase = "not_sent" | "responded" | "timed_out" | "sent_unconfirmed";
+/**
+ * A request to forward to a metered connector's API through the Base44 proxy.
+ */
+export interface ConnectorApiRequest {
+    /** HTTP method for the upstream request. Defaults to `'GET'`. */
+    method?: "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD";
+    /**
+     * Which of the connector's API hosts to call, by the name it declares.
+     * Omit for its default host (the first one declared). Only relevant for
+     * connectors that expose more than one host.
+     */
+    host?: string;
+    /**
+     * Path relative to the connector's API root, starting with `/`, such as `'/2/tweets'`.
+     *
+     * Must not be an absolute URL. Query parameters may be included here or passed
+     * separately as {@link query}; either way they are forwarded and priced identically.
+     */
+    path: string;
+    /** Query parameters. Merged into the request URL alongside any already present in {@link path}. */
+    query?: Record<string, string | number | boolean | Array<string | number>>;
+    /** Extra request headers. Only headers the connector explicitly allows are forwarded; the rest are dropped. */
+    headers?: Record<string, string>;
+    /** JSON request body. Ignored for `GET` and `HEAD`. */
+    body?: unknown;
+}
+/**
+ * The upstream API's response, as returned by the Base44 connector proxy.
+ */
+export interface ConnectorApiResponse<T = unknown> {
+    /** `true` only when the upstream API returned a 2xx status. Proxy and upstream errors are `false`. */
+    success: boolean;
+    /** How far the call progressed. Only `not_sent` proves the provider did not execute it. */
+    phase: ConnectorApiResponsePhase;
+    /** The upstream HTTP status code, or `null` when no response was received. */
+    status: number | null;
+    /**
+     * The parsed upstream response body, or proxy error details when no response
+     * was received. `null` when the response was binary — see {@link dataBase64}.
+     */
+    data: T | null;
+    /**
+     * The response body base64-encoded, for the media types the connector declares
+     * as binary (images, PDFs). Set instead of {@link data}, never alongside it.
+     */
+    dataBase64: string | null;
+    /** The response media type, set only alongside {@link dataBase64}. */
+    contentType: string | null;
+    /** The subset of upstream response headers the connector exposes, typically rate-limit counters. */
+    headers: Record<string, string>;
+    /** Integration credits billed to the workspace for this call. */
+    creditsCharged: number;
+}
+/**
+ * Raw proxy response shape. Mapped to {@link ConnectorApiResponse} before being returned.
+ * @internal
+ */
+export interface ConnectorProxyRawResponse {
+    success: boolean;
+    phase: ConnectorApiResponsePhase;
+    status_code: number | null;
+    data: unknown;
+    data_base64: string | null;
+    content_type: string | null;
+    headers: Record<string, string>;
+    credits_charged: number;
+}
 /**
  * Connectors module for managing OAuth tokens for external services.
  *
@@ -71,6 +146,18 @@ export interface AppUserConnectorConnectionResponse {
  * 3. In a backend function, call {@linkcode getCurrentAppUserConnection | getCurrentAppUserConnection()} using the service role client (`base44.asServiceRole.connectors`) with the connector ID to retrieve the app user's token.
  * 4. Use the returned `accessToken` to call the external service's API directly. Some connectors also return a `connectionConfig` with additional values such as a subdomain for building the API URL.
  *
+ * ## Metered connectors
+ *
+ * A few [platform connectors](#shared-connectors) are backed by paid third-party APIs that charge Base44 per call. For those, the OAuth token is **not** available to your code — {@linkcode getConnection | getConnection()} rejects with a `403`. Call them with {@linkcode callApi | callApi()} instead: Base44 attaches the credential server-side, forwards the request, and bills your workspace's integration credits for the call.
+ *
+ * This applies to platform connectors only. A workspace-registered or app user connector runs on **your own** OAuth app, so the provider invoices you directly and there is nothing for Base44 to meter — those keep normal token access via {@linkcode getWorkspaceConnection | getWorkspaceConnection()} and {@linkcode getCurrentAppUserConnection | getCurrentAppUserConnection()}.
+ *
+ * Two things to keep in mind when writing against a metered connector:
+ *
+ * - **Cost varies by endpoint, sometimes sharply.** The same connector can charge two orders of magnitude more for one endpoint than another, so avoid putting an expensive call inside a loop and batch wherever the provider supports it. Each response reports what it actually cost as `creditsCharged`.
+ * - **Provider and transport outcomes are returned, not thrown.** A provider `4xx`/`5xx` or a connection failure comes back as `success: false` with its `phase`; authorization, quota, and invalid proxy requests reject the promise.
+ * - **Only `phase: 'not_sent'` proves the provider did not execute the request.** A timeout or in-flight failure may have executed upstream, so do not automatically retry a non-idempotent call unless the provider supports an idempotency key.
+ *
  * ## Available connectors
  *
  * The connectors below can be used as shared connectors or as app user connectors. For a shared platform connector, pass the integration type string to {@linkcode getConnection | getConnection()}. For a connector you register in Workspace Settings with your own OAuth app, use the connector ID with {@linkcode getWorkspaceConnection | getWorkspaceConnection()} for a shared token, or with {@linkcode getCurrentAppUserConnection | getCurrentAppUserConnection()} for a per-user token.
@@ -328,6 +415,41 @@ export interface ConnectorsModule {
      * ```
      */
     getCurrentAppUserConnection(connectorId: string): Promise<AppUserConnectorConnectionResponse>;
+    /**
+     * Calls a [metered connector's](#metered-connectors) API through the Base44 proxy.
+     *
+     * Use this for a shared platform connector identified by an integration type. Base44 adds the OAuth credential to the outgoing request, forwards it, and bills the workspace for the call, so you never handle the token yourself.
+     *
+     * @param integrationType - The type of integration, such as `'x'`. See [Available connectors](#available-connectors).
+     * @param request - The upstream request to forward. See {@link ConnectorApiRequest}.
+     * @returns Promise resolving to a {@link ConnectorApiResponse}. Note that an upstream error is reported in `success` and `status`, not thrown — only Base44-side failures reject.
+     *
+     * @example
+     * ```typescript
+     * // Post to X
+     * const res = await base44.asServiceRole.connectors.callApi('x', {
+     *   method: 'POST',
+     *   path: '/2/tweets',
+     *   body: { text: 'Shipped!' },
+     * });
+     *
+     * if (!res.success) {
+     *   console.error('X rejected the post', res.status, res.data);
+     * }
+     * ```
+     *
+     * @example
+     * ```typescript
+     * // Read, with query parameters and a look at what the call cost
+     * const res = await base44.asServiceRole.connectors.callApi('x', {
+     *   path: '/2/tweets/search/recent',
+     *   query: { query: 'base44', max_results: 10 },
+     * });
+     *
+     * console.log(`${res.creditsCharged} credits`, res.data);
+     * ```
+     */
+    callApi<T = unknown>(integrationType: ConnectorIntegrationType, request: ConnectorApiRequest): Promise<ConnectorApiResponse<T>>;
 }
 /**
  * User-scoped connectors module for managing app user OAuth connections.

package/dist/modules/integrations.types.d.ts

@@ -43,9 +43,9 @@ export interface InvokeLLMParams {
     prompt: string;
     /** Optionally specify a model to override the app-level model setting for this specific call.
      *
-     * Options: `"gpt_5_mini"`, `"gemini_3_flash"`, `"gpt_5_4"`, `"gpt_5_5"`, `"gemini_3_1_pro"`, `"claude_sonnet_4_6"`, `"claude_opus_4_6"`, `"claude_opus_4_7"`, `"claude_opus_4_8"`
+     * Options: `"gpt_5_mini"`, `"gemini_3_flash"`, `"gpt_5_4"`, `"gpt_5_6_sol"`, `"gpt_5_6_luna"`, `"gemini_3_1_pro"`, `"claude_sonnet_4_6"`, `"claude_opus_4_6"`, `"claude_opus_4_7"`, `"claude_opus_4_8"`, `"claude-sonnet-5"`
      */
-    model?: 'gpt_5_mini' | 'gemini_3_flash' | 'gpt_5_4' | 'gpt_5_5' | 'gemini_3_1_pro' | 'claude_sonnet_4_6' | 'claude_opus_4_6' | 'claude_opus_4_7' | 'claude_opus_4_8';
+    model?: 'gpt_5_mini' | 'gemini_3_flash' | 'gpt_5_4' | 'gpt_5_6_sol' | 'gpt_5_6_luna' | 'gemini_3_1_pro' | 'claude_sonnet_4_6' | 'claude_opus_4_6' | 'claude_opus_4_7' | 'claude_opus_4_8' | 'claude-sonnet-5';
     /** If set to `true`, the LLM will use Google Search, Maps, and News to gather real-time context before answering.
      * @default false
      */

package/dist/utils/axios-client.js

@@ -132,8 +132,10 @@ export function createAxiosClient({ baseURL, headers = {}, token, interceptRespo
     client.interceptors.request.use((config) => {
         // `window.location` is absent on React Native (where `window` still exists),
         // so guard on it before reading `.href`.
-        if (typeof window !== "undefined" && window.location) {
-            config.headers.set("X-Origin-URL", window.location.href);
+        if (typeof window !== "undefined") {
+            if (window.location) {
+                config.headers.set("X-Origin-URL", window.location.href);
+            }
             // On unauthenticated requests, attach a stable anonymous visitor id so the
             // backend can support anonymous agent access (conversation grouping + ownership).
             // Authenticated requests are identified by their Authorization header instead.
@@ -185,11 +187,11 @@ export function createAxiosClient({ baseURL, headers = {}, token, interceptRespo
             }
             return response.data;
         }, (error) => {
-            var _a, _b, _c, _d, _e, _f, _g, _h;
+            var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q;
             const message = ((_b = (_a = error.response) === null || _a === void 0 ? void 0 : _a.data) === null || _b === void 0 ? void 0 : _b.message) ||
                 ((_d = (_c = error.response) === null || _c === void 0 ? void 0 : _c.data) === null || _d === void 0 ? void 0 : _d.detail) ||
                 error.message;
-            const base44Error = new Base44Error(message, (_e = error.response) === null || _e === void 0 ? void 0 : _e.status, (_g = (_f = error.response) === null || _f === void 0 ? void 0 : _f.data) === null || _g === void 0 ? void 0 : _g.code, (_h = error.response) === null || _h === void 0 ? void 0 : _h.data, error);
+            const base44Error = new Base44Error(message, (_e = error.response) === null || _e === void 0 ? void 0 : _e.status, (_m = (_h = (_g = (_f = error.response) === null || _f === void 0 ? void 0 : _f.data) === null || _g === void 0 ? void 0 : _g.code) !== null && _h !== void 0 ? _h : (_l = (_k = (_j = error.response) === null || _j === void 0 ? void 0 : _j.headers) === null || _k === void 0 ? void 0 : _k.get) === null || _l === void 0 ? void 0 : _l.call(_k, "x-base44-connector-error")) !== null && _m !== void 0 ? _m : (_p = (_o = error.response) === null || _o === void 0 ? void 0 : _o.headers) === null || _p === void 0 ? void 0 : _p["x-base44-connector-error"], (_q = error.response) === null || _q === void 0 ? void 0 : _q.data, error);
             // Log errors in development
             if (process.env.NODE_ENV !== "production") {
                 safeErrorLog("[Base44 SDK Error]", base44Error);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@depup/base44__sdk",
-  "version": "0.8.43-depup.0",
+  "version": "0.8.45-depup.0",
   "description": "JavaScript SDK for Base44 API (with updated dependencies)",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -27,10 +27,10 @@
     "create-docs:process": "node scripts/mintlify-post-processing/file-processing/file-processing.js"
   },
   "dependencies": {
-    "axios": "^1.19.0",
+    "axios": "^1.20.0",
     "partysocket": "^1.3.0",
     "socket.io-client": "^4.8.3",
-    "uuid": "^14.0.1"
+    "uuid": "^14.0.2"
   },
   "devDependencies": {
     "@types/hast": "^3.0.4",
@@ -75,7 +75,7 @@
     "changes": {
       "axios": {
         "from": "^1.18.1",
-        "to": "^1.19.0"
+        "to": "^1.20.0"
       },
       "partysocket": {
         "from": "^0.0.23",
@@ -83,13 +83,13 @@
       },
       "uuid": {
         "from": "^13.0.2",
-        "to": "^14.0.1"
+        "to": "^14.0.2"
       }
     },
     "depsUpdated": 3,
     "originalPackage": "@base44/sdk",
-    "originalVersion": "0.8.43",
-    "processedAt": "2026-08-18T08:10:35.872Z",
+    "originalVersion": "0.8.45",
+    "processedAt": "2026-09-02T08:12:22.602Z",
     "smokeTest": "passed"
   }
 }