René's URL Explorer Experiment

Title: feat: Cloudflare Workers SSR support — createServerClient + worker-safe analytics by netanelgilad · Pull Request #221 · base44/javascript-sdk · GitHub

Open Graph Title: feat: Cloudflare Workers SSR support — createServerClient + worker-safe analytics by netanelgilad · Pull Request #221 · base44/javascript-sdk

X Title: feat: Cloudflare Workers SSR support — createServerClient + worker-safe analytics by netanelgilad · Pull Request #221 · base44/javascript-sdk

Description: Cloudflare Workers SSR support Motivation Full-stack hosting POC: running app SSR on Cloudflare Workers for Platforms. Today the SDK cannot be safely instantiated inside a Worker request handler: createClient() unconditionally constructs the analytics module, whose heartbeat processor runs a raw setInterval. In Workers, setInterval at global scope throws, and inside a request it leaks past the request lifetime — and there was no config option to disable analytics. axios 1.x adapter auto-detection (xhr → http → fetch) can pick the wrong adapter under workerd. Auth tokens live only in localStorage, so SSR document requests carry no auth at all. Changes Worker-safe analytics (src/modules/analytics.ts): the analytics module is now a no-op outside a browser (typeof window === 'undefined') — no heartbeat interval, no processing timers, track() queues nothing. A new disableAnalytics?: boolean on CreateClientConfig skips analytics explicitly; the server client sets it automatically. Axios adapter passthrough (src/utils/axios-client.ts, src/client.ts): createAxiosClient accepts an optional adapter, exposed as an adapter field on CreateClientConfig and forwarded to all four internal axios clients. The server client forces adapter: 'fetch'. New createServerClient(options) (src/server.ts, exported from the main entry): builds a per-request client for SSR/edge runtimes. Each config value resolves in order: explicit option → env (BASE44_APP_ID, BASE44_API_URL, BASE44_SERVICE_TOKEN, BASE44_FUNCTIONS_VERSION) → the same Base44-* request headers createClientFromRequest reads (so it degrades gracefully behind the existing proxy); the user token resolves option → Authorization: Bearer header → base44_access_token cookie (internal dependency-free cookie parser handles quoted + URL-encoded values). Throws a clear error when no appId resolves or when the serverUrl isn't absolute; forces analytics off, the fetch adapter, and requiresAuth: false — no window/localStorage access anywhere in the path. Also propagates Base44-State like createClientFromRequest. Cookie mirror for browser token storage (src/utils/auth-utils.ts, src/modules/auth.ts): saveAccessToken now also sets a base44_access_token cookie (path=/; SameSite=Lax, plus Secure on https) so subsequent document requests carry the token to SSR; removeAccessToken clears it. auth.setToken() and auth.logout() (which write localStorage inline) mirror/clear the same cookie so login and logout flows stay consistent with SSR. All cookie writes are guarded on typeof document !== 'undefined'; localStorage behavior is byte-for-byte unchanged. Compatibility guarantees Deno backend-functions contract unchanged: createClientFromRequest and its Authorization / Base44-Service-Authorization / Base44-App-Id / Base44-Api-Url / Base44-Functions-Version / Base44-State header handling are untouched. No exports map added to package.json — consumers that deep-import (e.g. @base44/sdk/dist/utils/axios-client) keep working. createServerClient is exported from the main entry only. Browser behavior unchanged when analytics is enabled: same heartbeat, batching, throttling, visibility handling, and initialization event; the no-op path only activates without window or when disableAnalytics is set. Test evidence npm test (typecheck via tsc --noEmit + vitest): 19 files, 197 tests passed (was 15 files / ~171 before this PR). npm run lint (eslint): clean. npm run build (tsc): clean. New coverage: tests/unit/server-client.test.ts: full resolution precedence (options → env → headers), cookie fallback incl. quoted/URL-encoded values, Authorization-over-cookie priority, malformed-header handling, appId-missing throws, non-absolute serverUrl throws, fetch adapter forced on all four axios clients, Base44-State propagation, and a worker simulation proving no timers start and track() is a safe no-op without window. tests/unit/auth-utils-cookie.test.ts: cookie-string builders (attributes, Secure, encoding, custom name, clearing) plus save/remove mirror behavior in a simulated browser and SSR no-op guards. tests/unit/analytics.test.ts: updated to simulate browser globals (analytics is browser-only now) and extended with heartbeat-preserved-in-browser and disableAnalytics no-op tests, plus a no-window worker-safety test. Note: this PR triggers an automatic @base44-preview/sdk npm preview publish for easy testing in the Workers POC. 🤖 Generated with Claude Code https://claude.ai/code/session_01DvhQfqxACcq25XAQRpoSh9 Generated by Claude Code

Open Graph Description: Cloudflare Workers SSR support Motivation Full-stack hosting POC: running app SSR on Cloudflare Workers for Platforms. Today the SDK cannot be safely instantiated inside a Worker request handler: ...

X Description: Cloudflare Workers SSR support Motivation Full-stack hosting POC: running app SSR on Cloudflare Workers for Platforms. Today the SDK cannot be safely instantiated inside a Worker request handler: ...

Opengraph URL: https://github.com/base44/javascript-sdk/pull/221

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width