fix(analytics): skip the identity lookup when no token is set

On a public page the analytics module still issued a `User/me` at client
construction: `trackInitializationEvent` queues an event, the processor
flushes the first batch immediately, and `flush` awaits `getSessionContext`,
which calls `auth.me()` unconditionally. With no session that request can
only answer 401, and the browser logs it to the console from the network
layer -- before any handler in the SDK sees the rejection. The existing
`.catch` in `getSessionContext` and the try/catch in `flush` already keep the
rejection from escaping, so no amount of additional catching removes what
users actually see.

Skip the lookup when no access token is set. Anonymous events already
reported `user_id: null` through that same `.catch`, so no analytics data
changes -- the request is dropped only in the case where its sole possible
outcome was a 401.

The dedupe from #245 is unaffected: when a token is present, analytics still
resolves through `auth.me()` and shares the app's in-flight request, so an
authenticated cold load continues to issue exactly one `User/me`.

Token presence is tracked in the auth module rather than read off
`axios.defaults`, so it follows the identity transitions that already exist
there (`setToken`, `logout`) and is seeded from the constructor token, which
is how the server-side SDK carries a session it never sets explicitly. The
skip is deliberately not memoized: a visitor who logs in mid-session must
start resolving an identity again.

This does not cover a stale or expired token, which still 401s. Removing that
one needs `User/me` to answer 200 with a null user instead of 401, which is a
backend change.

Tests: the two analytics tests that exercise identity resolution now build a
token-bearing client; the axios mock gains the `defaults` that `setToken` and
`logout` write through. Three new tests cover the anonymous skip, resolution
resuming after `setToken`, and token presence across identity changes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MtKFfzaVR6nWAi8tNvJqfw

Author: claude

src/client.ts

@@ -150,6 +150,7 @@ export function createClient(config: CreateClientConfig): Base44Client {
     {
       appBaseUrl: normalizedAppBaseUrl,
       serverUrl,
+      token,
     }
   );
 

src/modules/analytics.ts

@@ -332,6 +332,14 @@ async function getSessionContext(
   userAuthModule: AuthModule
 ): Promise<SessionContext> {
   if (!analyticsSharedState.sessionContext) {
+    // With no token there is no identity to resolve: `me()` can only answer 401,
+    // which the browser logs to the console before any handler here sees it. On
+    // a public page that request is the sole reason an error appears, so skip
+    // it. This is not memoized — a visitor who logs in later must still resolve.
+    if (!userAuthModule.hasToken()) {
+      return { user_id: null, session_id: getAnalyticsSessionId() };
+    }
+
     if (!sessionContextPromise) {
       const sessionId = getAnalyticsSessionId();
       sessionContextPromise = userAuthModule

src/modules/auth.ts

@@ -108,7 +108,16 @@ export function createAuthModule(
     pendingMe = null;
   };
 
+  // Tracked here rather than read off `axios.defaults` so the answer stays tied
+  // to the identity transitions below (`setToken`, `logout`) instead of to the
+  // header a caller may have set on the instance directly.
+  let hasAccessToken = Boolean(options.token);
+
   return {
+    hasToken() {
+      return hasAccessToken;
+    },
+
     // Get current user information
     async me() {
       const request: Promise<User> =
@@ -189,6 +198,7 @@ export function createAuthModule(
       // flight would otherwise resolve into callers that run after the logout.
       clearPendingMe();
       resetAnalyticsSessionContext();
+      hasAccessToken = false;
 
       // Only do the rest if in a browser environment
       if (typeof window !== "undefined") {
@@ -220,6 +230,7 @@ export function createAuthModule(
       // resolved for the previous one must not be handed to later callers.
       clearPendingMe();
       resetAnalyticsSessionContext();
+      hasAccessToken = true;
 
       // handle token change for axios clients
       axios.defaults.headers.common["Authorization"] = `Bearer ${token}`;

src/modules/auth.types.ts

@@ -100,6 +100,12 @@ export interface AuthModuleOptions {
   serverUrl: string;
   /** Base URL for the app (used for login redirects). */
   appBaseUrl: string;
+  /**
+   * Access token the client was constructed with, if any. Seeds the module's
+   * view of whether a session exists before {@link AuthModule.setToken} runs,
+   * which is how the server-side SDK reports a token it never sets explicitly.
+   */
+  token?: string;
 }
 
 /**
@@ -120,6 +126,17 @@ export interface AuthModuleOptions {
  * The auth module is only available in user authentication mode (`base44.auth`).
  */
 export interface AuthModule {
+  /**
+   * Whether an access token is currently set on the client.
+   *
+   * Reports only the presence of a token, never its validity — an expired or
+   * revoked token still reads as `true`. Callers use this to skip requests that
+   * could not succeed without a session, not to decide that one is valid.
+   *
+   * @internal
+   */
+  hasToken(): boolean;
+
   /**
    * Gets the current authenticated user's information.
    *

tests/unit/analytics.test.ts

@@ -26,6 +26,9 @@ describe("Analytics Module", () => {
       createAxiosClient: vi.fn().mockImplementation(
         () =>
           ({
+            // `setToken` and `logout` write through to these, so the mock needs
+            // them present per instance.
+            defaults: { headers: { common: {} as Record<string, string> } },
             request: vi.fn().mockResolvedValue({
               status: 200,
               data: {
@@ -54,9 +57,12 @@ describe("Analytics Module", () => {
       heartBeatInterval: undefined,
     };
 
+    // Token-bearing by default: most tests here exercise the flush path that
+    // resolves an identity, and that lookup is skipped without a session.
     base44 = createClient({
       serverUrl,
       appId,
+      token: "test-access-token",
     });
   });
 
@@ -126,6 +132,55 @@ describe("Analytics Module", () => {
     expect(heartBeatState.isHeartBeatProcessing).toBeFalsy();
   });
 
+  test("should not resolve an identity when no token is set", async () => {
+    resetAnalyticsSessionContext();
+
+    const anonymous = createClient({ serverUrl, appId });
+    const me = vi.spyOn(anonymous.auth, "me");
+
+    anonymous.analytics.track({ eventName: "public-page-event" });
+    await vi.waitFor(() => expect(sharedState?.requestsQueue.length).toBe(0));
+
+    // The whole point: on a public page `me()` can only answer 401, and the
+    // browser logs that to the console before any handler here sees it. The
+    // event still flushes -- anonymous events already reported user_id: null.
+    expect(me).not.toHaveBeenCalled();
+
+    anonymous.cleanup();
+  });
+
+  test("should resolve an identity once a token is set", async () => {
+    resetAnalyticsSessionContext();
+
+    const anonymous = createClient({ serverUrl, appId });
+    const me = vi
+      .spyOn(anonymous.auth, "me")
+      .mockResolvedValue({ id: "user-1" } as User);
+
+    // A visitor who logs in mid-session must start reporting their identity, so
+    // the skip above must not be memoized.
+    anonymous.auth.setToken("token-acquired-after-login", false);
+    anonymous.analytics.track({ eventName: "post-login-event" });
+
+    await vi.waitFor(() => expect(me).toHaveBeenCalled());
+
+    anonymous.cleanup();
+  });
+
+  test("should report token presence across identity changes", () => {
+    const client = createClient({ serverUrl, appId });
+
+    expect(client.auth.hasToken()).toBe(false);
+
+    client.auth.setToken("some-token", false);
+    expect(client.auth.hasToken()).toBe(true);
+
+    client.auth.logout();
+    expect(client.auth.hasToken()).toBe(false);
+
+    client.cleanup();
+  });
+
   test("should track multiple events", async () => {
     vi.useFakeTimers();