@base44-preview/cli 0.1.21-pr.642.259f7d0 → 0.1.22-pr.644.4a848b7

package/dist/assets/backend-runtime/exec.ts

@@ -11,6 +11,11 @@
  * - BASE44_APP_BASE_URL: App's published URL / subdomain (used for function calls)
  * - BASE44_PRIVILEGED: When "true", adds the X-Bypass-RLS header (bypass RLS)
  * - BASE44_DATA_ENV: When set, adds the X-Data-Env header (target data environment)
+ * - BASE44_SERVICE_TOKEN: When set, passed as `serviceToken` (enables `base44.asServiceRole`)
+ * - BASE44_EXTRA_HEADERS: When set, a JSON object of extra headers on every SDK request
+ *
+ * BASE44_SERVICE_TOKEN and BASE44_EXTRA_HEADERS are removed from the environment
+ * before the user script runs.
  */
 
 export {};
@@ -21,6 +26,10 @@ const accessToken = Deno.env.get("BASE44_ACCESS_TOKEN");
 const appBaseUrl = Deno.env.get("BASE44_APP_BASE_URL");
 const isPrivileged = Deno.env.get("BASE44_PRIVILEGED") === "true";
 const dataEnv = Deno.env.get("BASE44_DATA_ENV");
+const serviceToken = Deno.env.get("BASE44_SERVICE_TOKEN");
+const extraHeaders = Deno.env.get("BASE44_EXTRA_HEADERS");
+Deno.env.delete("BASE44_SERVICE_TOKEN");
+Deno.env.delete("BASE44_EXTRA_HEADERS");
 
 if (!scriptPath) {
   console.error("SCRIPT_PATH environment variable is required");
@@ -39,13 +48,16 @@ if (!appBaseUrl) {
 
 import { createClient } from "npm:@base44/sdk";
 
-const customHeaders: Record<string, string> = {};
+const customHeaders: Record<string, string> = extraHeaders
+  ? JSON.parse(extraHeaders)
+  : {};
 if (isPrivileged) customHeaders["X-Bypass-RLS"] = "true";
 if (dataEnv) customHeaders["X-Data-Env"] = dataEnv;
 
 const base44 = createClient({
   appId,
   token: accessToken,
+  ...(serviceToken ? { serviceToken } : {}),
   serverUrl: appBaseUrl,
   headers: customHeaders,
 });

package/dist/cli/index.js

@@ -239265,7 +239265,7 @@ import { join as join13 } from "node:path";
 // package.json
 var package_default = {
   name: "base44",
-  version: "0.1.21",
+  version: "0.1.22",
   description: "Base44 CLI - Unified interface for managing Base44 applications",
   type: "module",
   bin: {
@@ -247411,7 +247411,8 @@ class Base44Command extends Command2 {
         if (branch !== undefined && !branch.trim()) {
           throw new InvalidInputError("--branch must not be empty.");
         }
-        if (this._commandOptions.requireAuth) {
+        const { requireAuth } = this._commandOptions;
+        if (typeof requireAuth === "function" ? requireAuth() : requireAuth) {
           await ensureAuth(this.context);
         }
         if (this._commandOptions.requireAppContext) {
@@ -251495,21 +251496,6 @@ function parseConcurrency(value) {
   return parsed;
 }
 
-// src/cli/dev/append-serve-args.ts
-var SHELL_SAFE = /^[\w@%+=:,./-]+$/;
-function quote(arg, platform) {
-  if (SHELL_SAFE.test(arg)) {
-    return arg;
-  }
-  if (platform === "win32") {
-    return `"${arg.replace(/"/g, "\\\"")}"`;
-  }
-  return `'${arg.replace(/'/g, "'\\''")}'`;
-}
-function appendServeArgs(command, args, platform = process.platform) {
-  return [command, ...args.map((arg) => quote(arg, platform))].join(" ");
-}
-
 // src/cli/dev/createDevLogger.ts
 var colorByType = {
   error: theme.styles.error,
@@ -251688,7 +251674,8 @@ async function siteDevAction(ctx, forwarded) {
   if (!site) {
     throw new InvalidInputError(`This project has no 'site' block in base44/config.jsonc, so there is no frontend to serve. Add one naming its serveCommand; site dev falls back to "npm run dev".`);
   }
-  const command = appendServeArgs(site.serveCommand ?? DEFAULT_SERVE_COMMAND, forwarded);
+  const serveCommand = site.serveCommand ?? DEFAULT_SERVE_COMMAND;
+  const command = [serveCommand, ...forwarded].join(" ");
   const runner = createServeCommandRunner({
     serveCommand: command,
     projectRoot: project.root,
@@ -256177,11 +256164,91 @@ function getDevCommand() {
   return new Base44Command("dev").description("Start the development server").option("-p, --port <number>", "Port for the development server").option("--remote", "Serve the frontend against the production backend instead of a local one").hook("preAction", validateDevOptions).action(devAction);
 }
 
+// src/core/exec/env-target.ts
+var ACCESS_TOKEN_VAR = "BASE44_EXEC_ACCESS_TOKEN";
+var SERVER_URL_VAR = "BASE44_EXEC_SERVER_URL";
+var SERVICE_TOKEN_VAR = "BASE44_EXEC_SERVICE_TOKEN";
+var HEADERS_VAR = "BASE44_EXEC_HEADERS";
+var EXEC_ENV_VARS = [
+  ACCESS_TOKEN_VAR,
+  SERVER_URL_VAR,
+  SERVICE_TOKEN_VAR,
+  HEADERS_VAR
+];
+function read3(env, name) {
+  return env[name]?.trim() || undefined;
+}
+function hasExecEnvTarget(env = process.env) {
+  return EXEC_ENV_VARS.some((name) => read3(env, name) !== undefined);
+}
+var HeadersSchema = record(string2(), string2());
+function parseHeaders(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new InvalidInputError(`${HEADERS_VAR} is not valid JSON.`, {
+      hints: [{ message: `Set ${HEADERS_VAR} to e.g. '{"X-Header":"value"}'` }]
+    });
+  }
+  const result = HeadersSchema.safeParse(parsed);
+  if (!result.success) {
+    throw new InvalidInputError(`${HEADERS_VAR} must be a JSON object of string header values.`, {
+      hints: [
+        { message: `Set ${HEADERS_VAR} to e.g. '{"X-Header":"value"}'` }
+      ]
+    });
+  }
+  return result.data;
+}
+function readExecEnvTarget(env = process.env) {
+  if (!hasExecEnvTarget(env)) {
+    return;
+  }
+  const token = read3(env, ACCESS_TOKEN_VAR);
+  const serverUrl = read3(env, SERVER_URL_VAR);
+  if (!token || !serverUrl) {
+    const missing = token ? SERVER_URL_VAR : ACCESS_TOKEN_VAR;
+    throw new InvalidInputError(`${missing} is not set. ${ACCESS_TOKEN_VAR} and ${SERVER_URL_VAR} must be set together.`, {
+      hints: [
+        {
+          message: `Set both ${ACCESS_TOKEN_VAR} and ${SERVER_URL_VAR}, or unset all BASE44_EXEC_* variables to use your login`
+        }
+      ]
+    });
+  }
+  if (!URL.canParse(serverUrl)) {
+    throw new InvalidInputError(`${SERVER_URL_VAR} is not a valid URL.`);
+  }
+  const serviceToken = read3(env, SERVICE_TOKEN_VAR);
+  const rawHeaders = read3(env, HEADERS_VAR);
+  return {
+    token,
+    serverUrl,
+    ...serviceToken ? { serviceToken } : {},
+    ...rawHeaders ? { headers: parseHeaders(rawHeaders) } : {}
+  };
+}
 // src/core/exec/run-script.ts
 import { spawn as spawn4 } from "node:child_process";
 import { copyFileSync, writeFileSync as writeFileSync3 } from "node:fs";
+var SERVICE_TOKEN_ENV = "BASE44_SERVICE_TOKEN";
+var EXTRA_HEADERS_ENV = "BASE44_EXTRA_HEADERS";
+function wrapperOnlyEnv(serviceToken, headers) {
+  return {
+    ...serviceToken ? { [SERVICE_TOKEN_ENV]: serviceToken } : {},
+    ...headers ? { [EXTRA_HEADERS_ENV]: JSON.stringify(headers) } : {}
+  };
+}
+function inheritedEnv() {
+  const env = { ...process.env };
+  for (const name of [...EXEC_ENV_VARS, SERVICE_TOKEN_ENV, EXTRA_HEADERS_ENV]) {
+    delete env[name];
+  }
+  return env;
+}
 async function runScript(options) {
-  const { appId, code, local, privileged, dataEnv } = options;
+  const { appId, code, local, privileged, dataEnv, serviceToken, headers } = options;
   verifyDenoInstalled("to run scripts with exec");
   const cleanupFns = [];
   const tempScript = await $file({ postfix: ".ts" });
@@ -256196,7 +256263,8 @@ async function runScript(options) {
     const exitCode = await new Promise((resolvePromise) => {
       const child = spawn4("deno", ["run", "--allow-all", "--node-modules-dir=auto", tempWrapper.path], {
         env: {
-          ...process.env,
+          ...inheritedEnv(),
+          ...wrapperOnlyEnv(serviceToken, headers),
           SCRIPT_PATH: scriptPath,
           BASE44_APP_ID: appId,
           BASE44_ACCESS_TOKEN: appUserToken,
@@ -256251,6 +256319,10 @@ async function execAction({ app, isNonInteractive }, options) {
       hints: [{ message: "Usage: base44 exec --local --port <port>" }]
     });
   }
+  const envTarget = readExecEnvTarget();
+  if (envTarget && options.local) {
+    throw new InvalidInputError("--local cannot be used when BASE44_EXEC_ACCESS_TOKEN and BASE44_EXEC_SERVER_URL are set.");
+  }
   const noInputError = new InvalidInputError("No input provided. Pipe a script to stdin.", {
     hints: [
       { message: "File:  cat ./script.ts | base44 exec" },
@@ -256266,13 +256338,15 @@ async function execAction({ app, isNonInteractive }, options) {
   if (!code.trim()) {
     throw noInputError;
   }
-  const local = options.local ? await resolveLocalTarget(options.port !== undefined ? parsePort(options.port) : DEFAULT_DEV_SERVER_PORT) : undefined;
+  const local = envTarget ? { serverUrl: envTarget.serverUrl, token: envTarget.token } : options.local ? await resolveLocalTarget(options.port !== undefined ? parsePort(options.port) : DEFAULT_DEV_SERVER_PORT) : undefined;
   const { exitCode } = await runScript({
     appId: app.id,
     code,
     local,
     privileged: options.privileged,
-    dataEnv: options.dataEnv
+    dataEnv: options.dataEnv,
+    serviceToken: envTarget?.serviceToken,
+    headers: envTarget?.headers
   });
   if (exitCode !== 0) {
     process.exitCode = exitCode;
@@ -256280,7 +256354,7 @@ async function execAction({ app, isNonInteractive }, options) {
   return {};
 }
 function getExecCommand() {
-  return new Base44Command("exec").description("Run a script with the Base44 SDK pre-authenticated as the current user").option("--local", "Run against the local `base44 dev` server instead of the deployed app").option("--port <number>", `Port the local dev server is on (with --local; defaults to ${DEFAULT_DEV_SERVER_PORT})`).option("--privileged", "Run with admin privileges (bypass RLS). Requires app owner/editor role.").option("--data-env <environment>", "Data environment to run against (e.g. dev, prod)").addHelpText("after", `
+  return new Base44Command("exec", { requireAuth: () => !hasExecEnvTarget() }).description("Run a script with the Base44 SDK pre-authenticated as the current user").option("--local", "Run against the local `base44 dev` server instead of the deployed app").option("--port <number>", `Port the local dev server is on (with --local; defaults to ${DEFAULT_DEV_SERVER_PORT})`).option("--privileged", "Run with admin privileges (bypass RLS). Requires app owner/editor role.").option("--data-env <environment>", "Data environment to run against (e.g. dev, prod)").addHelpText("after", `
 Examples:
   Run a script file:
     $ cat ./script.ts | base44 exec
@@ -256292,7 +256366,14 @@ Examples:
     $ echo "await base44.entities.Task.create({ title: 'seed' })" | base44 exec --local
 
   With privileged access (bypass RLS):
-    $ echo "const all = await base44.entities.Task.list()" | base44 exec --privileged`).action(execAction);
+    $ echo "const all = await base44.entities.Task.list()" | base44 exec --privileged
+
+Environment (for sandboxes and agents; no login or linked project needed):
+  BASE44_EXEC_ACCESS_TOKEN   App-user token for the SDK (requires BASE44_EXEC_SERVER_URL)
+  BASE44_EXEC_SERVER_URL     SDK server URL (requires BASE44_EXEC_ACCESS_TOKEN)
+  BASE44_EXEC_SERVICE_TOKEN  Optional service token, enables base44.asServiceRole
+  BASE44_EXEC_HEADERS        Optional JSON object of extra request headers
+  The app id comes from --app-id or BASE44_APP_ID.`).action(execAction);
 }
 
 // src/cli/commands/project/eject.ts
@@ -260504,4 +260585,4 @@ export {
   runCLI
 };
 
-//# debugId=C9E0B5EF532B747464756E2164756E21
+//# debugId=FD7BADBA9A7011E864756E2164756E21