@base44-preview/cli 0.1.21-pr.642.259f7d0 → 0.1.22-pr.644.053dbd4

package/dist/assets/backend-runtime/exec.ts

@@ -11,6 +11,9 @@
  * - BASE44_APP_BASE_URL: App's published URL / subdomain (used for function calls)
  * - BASE44_PRIVILEGED: When "true", adds the X-Bypass-RLS header (bypass RLS)
  * - BASE44_DATA_ENV: When set, adds the X-Data-Env header (target data environment)
+ * - BASE44_SERVICE_TOKEN: When set, passed as `serviceToken` (enables `base44.asServiceRole`)
+ *
+ * BASE44_SERVICE_TOKEN is removed from the environment before the user script runs.
  */
 
 export {};
@@ -21,6 +24,8 @@ const accessToken = Deno.env.get("BASE44_ACCESS_TOKEN");
 const appBaseUrl = Deno.env.get("BASE44_APP_BASE_URL");
 const isPrivileged = Deno.env.get("BASE44_PRIVILEGED") === "true";
 const dataEnv = Deno.env.get("BASE44_DATA_ENV");
+const serviceToken = Deno.env.get("BASE44_SERVICE_TOKEN");
+Deno.env.delete("BASE44_SERVICE_TOKEN");
 
 if (!scriptPath) {
   console.error("SCRIPT_PATH environment variable is required");
@@ -46,6 +51,7 @@ if (dataEnv) customHeaders["X-Data-Env"] = dataEnv;
 const base44 = createClient({
   appId,
   token: accessToken,
+  ...(serviceToken ? { serviceToken } : {}),
   serverUrl: appBaseUrl,
   headers: customHeaders,
 });

package/dist/cli/index.js

@@ -239265,7 +239265,7 @@ import { join as join13 } from "node:path";
 // package.json
 var package_default = {
   name: "base44",
-  version: "0.1.21",
+  version: "0.1.22",
   description: "Base44 CLI - Unified interface for managing Base44 applications",
   type: "module",
   bin: {
@@ -251495,21 +251495,6 @@ function parseConcurrency(value) {
   return parsed;
 }
 
-// src/cli/dev/append-serve-args.ts
-var SHELL_SAFE = /^[\w@%+=:,./-]+$/;
-function quote(arg, platform) {
-  if (SHELL_SAFE.test(arg)) {
-    return arg;
-  }
-  if (platform === "win32") {
-    return `"${arg.replace(/"/g, "\\\"")}"`;
-  }
-  return `'${arg.replace(/'/g, "'\\''")}'`;
-}
-function appendServeArgs(command, args, platform = process.platform) {
-  return [command, ...args.map((arg) => quote(arg, platform))].join(" ");
-}
-
 // src/cli/dev/createDevLogger.ts
 var colorByType = {
   error: theme.styles.error,
@@ -251688,7 +251673,8 @@ async function siteDevAction(ctx, forwarded) {
   if (!site) {
     throw new InvalidInputError(`This project has no 'site' block in base44/config.jsonc, so there is no frontend to serve. Add one naming its serveCommand; site dev falls back to "npm run dev".`);
   }
-  const command = appendServeArgs(site.serveCommand ?? DEFAULT_SERVE_COMMAND, forwarded);
+  const serveCommand = site.serveCommand ?? DEFAULT_SERVE_COMMAND;
+  const command = [serveCommand, ...forwarded].join(" ");
   const runner = createServeCommandRunner({
     serveCommand: command,
     projectRoot: project.root,
@@ -256177,11 +256163,63 @@ function getDevCommand() {
   return new Base44Command("dev").description("Start the development server").option("-p, --port <number>", "Port for the development server").option("--remote", "Serve the frontend against the production backend instead of a local one").hook("preAction", validateDevOptions).action(devAction);
 }
 
+// src/core/exec/env-target.ts
+var ACCESS_TOKEN_VAR = "BASE44_EXEC_ACCESS_TOKEN";
+var SERVER_URL_VAR = "BASE44_EXEC_SERVER_URL";
+var SERVICE_TOKEN_VAR = "BASE44_EXEC_SERVICE_TOKEN";
+var EXEC_ENV_VARS = [
+  ACCESS_TOKEN_VAR,
+  SERVER_URL_VAR,
+  SERVICE_TOKEN_VAR
+];
+var PRIVILEGED_ENV_VAR = "BASE44_EXEC_PRIVILEGED";
+var DATA_ENV_ENV_VAR = "BASE44_EXEC_DATA_ENV";
+function read3(env, name) {
+  return env[name]?.trim() || undefined;
+}
+function hasExecEnvTarget(env = process.env) {
+  return EXEC_ENV_VARS.some((name) => read3(env, name) !== undefined);
+}
+function readExecEnvTarget(env = process.env) {
+  if (!hasExecEnvTarget(env)) {
+    return;
+  }
+  const token = read3(env, ACCESS_TOKEN_VAR);
+  const serverUrl = read3(env, SERVER_URL_VAR);
+  if (!token || !serverUrl) {
+    const missing = token ? SERVER_URL_VAR : ACCESS_TOKEN_VAR;
+    throw new InvalidInputError(`${missing} is not set. ${ACCESS_TOKEN_VAR} and ${SERVER_URL_VAR} must be set together.`, {
+      hints: [
+        {
+          message: `Set both ${ACCESS_TOKEN_VAR} and ${SERVER_URL_VAR}, or unset all of them to use your login`
+        }
+      ]
+    });
+  }
+  if (!URL.canParse(serverUrl)) {
+    throw new InvalidInputError(`${SERVER_URL_VAR} is not a valid URL.`);
+  }
+  const serviceToken = read3(env, SERVICE_TOKEN_VAR);
+  return { token, serverUrl, ...serviceToken ? { serviceToken } : {} };
+}
 // src/core/exec/run-script.ts
 import { spawn as spawn4 } from "node:child_process";
 import { copyFileSync, writeFileSync as writeFileSync3 } from "node:fs";
+var SERVICE_TOKEN_ENV = "BASE44_SERVICE_TOKEN";
+function inheritedEnv() {
+  const env = { ...process.env };
+  for (const name of [
+    ...EXEC_ENV_VARS,
+    PRIVILEGED_ENV_VAR,
+    DATA_ENV_ENV_VAR,
+    SERVICE_TOKEN_ENV
+  ]) {
+    delete env[name];
+  }
+  return env;
+}
 async function runScript(options) {
-  const { appId, code, local, privileged, dataEnv } = options;
+  const { appId, code, local, privileged, dataEnv, serviceToken } = options;
   verifyDenoInstalled("to run scripts with exec");
   const cleanupFns = [];
   const tempScript = await $file({ postfix: ".ts" });
@@ -256194,9 +256232,10 @@ async function runScript(options) {
   copyFileSync(getExecWrapperPath(), tempWrapper.path);
   try {
     const exitCode = await new Promise((resolvePromise) => {
-      const child = spawn4("deno", ["run", "--allow-all", "--node-modules-dir=auto", tempWrapper.path], {
+      const child = spawn4("deno", ["run", "--allow-all", "--node-modules-dir=none", tempWrapper.path], {
         env: {
-          ...process.env,
+          ...inheritedEnv(),
+          ...serviceToken ? { [SERVICE_TOKEN_ENV]: serviceToken } : {},
           SCRIPT_PATH: scriptPath,
           BASE44_APP_ID: appId,
           BASE44_ACCESS_TOKEN: appUserToken,
@@ -256251,6 +256290,10 @@ async function execAction({ app, isNonInteractive }, options) {
       hints: [{ message: "Usage: base44 exec --local --port <port>" }]
     });
   }
+  const envTarget = readExecEnvTarget();
+  if (envTarget && options.local) {
+    throw new InvalidInputError("--local cannot be used when BASE44_EXEC_ACCESS_TOKEN and BASE44_EXEC_SERVER_URL are set.");
+  }
   const noInputError = new InvalidInputError("No input provided. Pipe a script to stdin.", {
     hints: [
       { message: "File:  cat ./script.ts | base44 exec" },
@@ -256266,13 +256309,14 @@ async function execAction({ app, isNonInteractive }, options) {
   if (!code.trim()) {
     throw noInputError;
   }
-  const local = options.local ? await resolveLocalTarget(options.port !== undefined ? parsePort(options.port) : DEFAULT_DEV_SERVER_PORT) : undefined;
+  const local = envTarget ? { serverUrl: envTarget.serverUrl, token: envTarget.token } : options.local ? await resolveLocalTarget(options.port !== undefined ? parsePort(options.port) : DEFAULT_DEV_SERVER_PORT) : undefined;
   const { exitCode } = await runScript({
     appId: app.id,
     code,
     local,
-    privileged: options.privileged,
-    dataEnv: options.dataEnv
+    privileged: options.privileged || process.env[PRIVILEGED_ENV_VAR] !== undefined,
+    dataEnv: options.dataEnv ?? process.env[DATA_ENV_ENV_VAR],
+    serviceToken: envTarget?.serviceToken
   });
   if (exitCode !== 0) {
     process.exitCode = exitCode;
@@ -256280,7 +256324,7 @@ async function execAction({ app, isNonInteractive }, options) {
   return {};
 }
 function getExecCommand() {
-  return new Base44Command("exec").description("Run a script with the Base44 SDK pre-authenticated as the current user").option("--local", "Run against the local `base44 dev` server instead of the deployed app").option("--port <number>", `Port the local dev server is on (with --local; defaults to ${DEFAULT_DEV_SERVER_PORT})`).option("--privileged", "Run with admin privileges (bypass RLS). Requires app owner/editor role.").option("--data-env <environment>", "Data environment to run against (e.g. dev, prod)").addHelpText("after", `
+  return new Base44Command("exec", { requireAuth: !hasExecEnvTarget() }).description("Run a script with the Base44 SDK pre-authenticated as the current user").option("--local", "Run against the local `base44 dev` server instead of the deployed app").option("--port <number>", `Port the local dev server is on (with --local; defaults to ${DEFAULT_DEV_SERVER_PORT})`).option("--privileged", "Run with admin privileges (bypass RLS). Requires app owner/editor role.").option("--data-env <environment>", "Data environment to run against (e.g. dev, prod)").addHelpText("after", `
 Examples:
   Run a script file:
     $ cat ./script.ts | base44 exec
@@ -260504,4 +260548,4 @@ export {
   runCLI
 };
 
-//# debugId=C9E0B5EF532B747464756E2164756E21
+//# debugId=03B01903A1BCF87864756E2164756E21