Use builder sockets in the minimal white-label example

[ozsay]

Summary

Replace periodic chat polling in examples/white-label-minimal with the platform SDK builder socket. The browser subscribes before loading its initial conversation, applies streamed message replacements and image resolutions, and lets the SDK resume from applied cursors after transport reconnects. There is no periodic app/conversation timer.

const client = new Base44PlatformClient({ serverUrl, refreshToken });
const builder = client.builder.init({ onError });
builder.subscribe(appId, { onJoined, onEvent, onError });
await builder.connect();

• Keep the getting-started flow in small files: a React hook for lifecycle, a stream coordinator, connection setup, and message helpers.
• Keep HTTP writes on the partner backend. Initial history, explicit recovery, invalidation events and completed mutations use HTTP reconciliation. Question forms still use the existing authorized HTTP projection because the socket intentionally omits their arguments.
• Add a same-origin, authenticated, app-ownership-checked token exchange with no-store/private responses. Per the explicit integration decision, it currently returns the existing service-user access token. API keys and refresh tokens stay server-side; the browser sends the access token only in CONNECT auth and does not persist it.
• Replace “Resume polling” with “Reconnect live updates”; errors stop delivery, while app changes/unmounts abort reads and close the session.
• Pin @base44/sdk to the published preview alias npm:@base44-preview/sdk@0.8.48-pr.286.7d59d14 from Add platform browser client for white-label sockets javascript-sdk#286, verified to contain builder.init and refreshToken.

Validation

• npm run minimal:test: 37 server, identity, stream, conversation and question tests passed.
• npm run minimal:typecheck and npm run minimal:build: passed.
• 24 Playwright browser tests passed against the local fixture, using installed Chrome through a temporary local configuration. Includes streamed replacement with zero periodic HTTP reads, question answers/retries, recovery, preview and publishing.
• Changed implementation files pass ESLint; git diff --check passes.
• Dependency/lockfile review: adds the exact SDK preview and its dependencies; no pre-existing locked package version changed. Installation used the configured npm embargo proxy.

Rollout limitations

The current service-user token also authorizes HTTP operations. The read-only socket and token-route ownership check do not narrow the token itself to one app or to socket-only access. Replace this temporary exchange when the browser-specific credential solution lands.

The backend must accept this token on the white-label endpoint and enable the workspace flag. The pending verifier still prevents real deployed connections until integrated. Verification here uses fixture sockets and mocked credentials, not a deployed backend. A fresh snapshot plus buffered events is not an atomic history API and may briefly reapply state already present in the snapshot. Queue/task events are consumed for cursor continuity; this minimal UI renders progress from app/message updates.

Intent (for reviewers & PR Autofix)

What this PR does

Use the new platform client SDK's builder module for minimal-example chat updates, preserving existing HTTP mutations and the readable getting-started structure.

Key decisions & why

• Subscribe before initial HTTP history so live updates are buffered while loading; ordinary reconnects retain SDK cursors instead of replacing history.
• Keep event-driven reads for existing question forms and app metadata; the public socket does not carry raw question arguments.
• Use the current service-user access token per the explicit product decision, behind existing session/origin/ownership checks. Do not expose API keys or refresh tokens. Document its broad permissions honestly.

What NOT to touch

The SDK preview pin is intentional until its client entry point is released. Do not restore periodic polling or silently fall back to the legacy socket. Keep the existing app-ownership and same-origin checks for token retrieval and HTTP actions.

Tradeoffs / follow-ups

Integrate the dedicated browser credential and verify the real backend before rollout. This PR changes only the minimal example, not the main starter app or the SDK/backend PRs.

[netlify]

✅ Deploy Preview for sunny44-builder ready!

Name	Link
🔨 Latest commit	ac058fd
🔍 Latest deploy log	https://app.netlify.com/projects/sunny44-builder/deploys/6aabc4b3748764000712c70a
😎 Deploy Preview	https://deploy-preview-31--sunny44-builder.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[netlify]

✅ Deploy Preview for base44-platform-starter ready!

Name	Link
🔨 Latest commit	ac058fd
🔍 Latest deploy log	https://app.netlify.com/projects/base44-platform-starter/deploys/6aabc4b3e8977d000806ba1a
😎 Deploy Preview	https://deploy-preview-31--base44-platform-starter.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.