@base44-preview/sdk 0.8.41-pr.244.e7d6747 → 0.8.42-pr.254.6a358ec

package/dist/client.js

@@ -5,7 +5,6 @@ import { createAuthModule } from "./modules/auth.js";
 import { createSsoModule } from "./modules/sso.js";
 import { createConnectorsModule, createUserConnectorsModule, } from "./modules/connectors.js";
 import { getAccessToken } from "./utils/auth-utils.js";
-import { redeemSessionHandoffCode } from "./utils/session-handoff.js";
 import { createFunctionsModule } from "./modules/functions.js";
 import { createAgentsModule } from "./modules/agents.js";
 import { createAiGatewayModule } from "./modules/ai-gateway.js";
@@ -119,32 +118,10 @@ export function createClient(config) {
     // requests during construction (notably analytics, which fires an init
     // event whose flush calls auth.me()). Without this, the first User/me
     // request is built before setToken runs and goes out unauthenticated.
-    //
-    // Precedence: an explicit config token wins (legacy behavior); then a PKCE
-    // session-code handoff in the URL (base44-dev/apper#17216 §5.2) — the user
-    // just completed a login, so it outranks any stored token, mirroring how
-    // getAccessToken prefers a URL access_token over localStorage; then the
-    // legacy capture. When the server spoke legacy — including after a backend
-    // rollback — redeemSessionHandoffCode() returns null synchronously and the
-    // legacy capture below runs unchanged.
-    let tokenBootstrap = null;
     if (typeof window !== "undefined") {
-        const sessionExchange = token ? null : redeemSessionHandoffCode();
-        if (sessionExchange) {
-            tokenBootstrap = sessionExchange.then((exchangedToken) => {
-                // On exchange failure, fall back to any stored token rather than
-                // leaving auth state empty (same fallback getAccessToken applies).
-                const accessToken = exchangedToken || getAccessToken();
-                if (accessToken) {
-                    userAuthModule.setToken(accessToken);
-                }
-            });
-        }
-        else {
-            const accessToken = token || getAccessToken();
-            if (accessToken) {
-                userAuthModule.setToken(accessToken);
-            }
+        const accessToken = token || getAccessToken();
+        if (accessToken) {
+            userAuthModule.setToken(accessToken);
         }
     }
     const actorsModule = createActorsModule({
@@ -241,13 +218,6 @@ export function createClient(config) {
         // We perform this check asynchronously to not block client creation
         setTimeout(async () => {
             try {
-                // A pending session-code exchange must settle before the auth probe.
-                // Probing early would see no token, redirect to login, and abandon
-                // the in-flight exchange — minting a fresh code on every round, i.e.
-                // a login loop (the exact BUG-787 failure shape).
-                if (tokenBootstrap) {
-                    await tokenBootstrap;
-                }
                 const isAuthenticated = await userModules.auth.isAuthenticated();
                 if (!isAuthenticated) {
                     userModules.auth.redirectToLogin(window.location.href);

package/dist/modules/analytics.d.ts

@@ -16,5 +16,16 @@ export declare const createAnalyticsModule: ({ axiosClient, serverUrl, appId, us
     track: (params: TrackEventParams) => void;
     cleanup: () => void;
 };
+/**
+ * Clears the memoized analytics session context.
+ *
+ * The context holds the `user_id` resolved by `auth.me()` and is reused for the
+ * lifetime of the session, so it has to be dropped whenever the identity
+ * changes. Without this, a visitor who loads a page anonymously and then logs in
+ * keeps reporting `user_id: null` on every subsequent event.
+ *
+ * @internal
+ */
+export declare function resetAnalyticsSessionContext(): void;
 export declare function getAnalyticsConfigFromUrlParams(): AnalyticsModuleOptions | undefined;
 export declare function getAnalyticsSessionId(): string;

package/dist/modules/analytics.js

@@ -165,7 +165,12 @@ async function startAnalyticsProcessor(handleTrack, options) {
 }
 function startHeartBeatProcessor(track) {
     var _a;
-    if (analyticsSharedState.isHeartBeatProcessing ||
+    // Browser-only, like the other automatic events here (initialization, session
+    // duration, visibility). Outside a browser this timer fired a `me()` every
+    // interval for the lifetime of a long-lived server-side client, and kept the
+    // Node event loop alive. Explicit `analytics.track()` calls still work.
+    if (typeof window === "undefined" ||
+        analyticsSharedState.isHeartBeatProcessing ||
         ((_a = analyticsSharedState.config.heartBeatInterval) !== null && _a !== void 0 ? _a : 0) < 10) {
         return () => { };
     }
@@ -226,6 +231,20 @@ function transformEventDataToApiRequestData(sessionContext) {
     });
 }
 let sessionContextPromise = null;
+/**
+ * Clears the memoized analytics session context.
+ *
+ * The context holds the `user_id` resolved by `auth.me()` and is reused for the
+ * lifetime of the session, so it has to be dropped whenever the identity
+ * changes. Without this, a visitor who loads a page anonymously and then logs in
+ * keeps reporting `user_id: null` on every subsequent event.
+ *
+ * @internal
+ */
+export function resetAnalyticsSessionContext() {
+    analyticsSharedState.sessionContext = null;
+    sessionContextPromise = null;
+}
 async function getSessionContext(userAuthModule) {
     if (!analyticsSharedState.sessionContext) {
         if (!sessionContextPromise) {
@@ -241,7 +260,18 @@ async function getSessionContext(userAuthModule) {
                 session_id: sessionId,
             }));
         }
-        analyticsSharedState.sessionContext = await sessionContextPromise;
+        const pending = sessionContextPromise;
+        const context = await pending;
+        // Publish only if this lookup is still the current one. A reset that lands
+        // while the request is in flight nulls `sessionContextPromise`, and an
+        // unconditional write here would put the pre-reset identity back and pin it
+        // for the rest of the session. The awaited value is still returned: these
+        // events were queued before the identity changed, so that is who they
+        // belong to.
+        if (sessionContextPromise === pending) {
+            analyticsSharedState.sessionContext = context;
+        }
+        return context;
     }
     return analyticsSharedState.sessionContext;
 }

package/dist/modules/auth.js

@@ -1,4 +1,4 @@
-import { prepareSessionHandoffKickoff } from "../utils/session-handoff.js";
+import { resetAnalyticsSessionContext } from "./analytics.js";
 function isInsideIframe() {
     if (typeof window === "undefined")
         return false;
@@ -64,10 +64,33 @@ function loginViaPopup(url, redirectUrl, expectedOrigin) {
  * @internal
  */
 export function createAuthModule(axios, functionsAxiosClient, appId, options) {
+    // In-flight `me()` request, shared by concurrent callers. The analytics
+    // module resolves its session context through `me()` at client construction,
+    // at the same moment most apps issue their own `me()`. Browsers serialize the
+    // two identical GETs, so the second pays the first's full latency on every
+    // cold load.
+    //
+    // This shares the pending promise only — it is cleared as soon as the request
+    // settles, so no resolved user is ever retained. Caching the user across
+    // requests would leave the app rendering a stale identity after logout or a
+    // session swap.
+    let pendingMe = null;
+    const clearPendingMe = () => {
+        pendingMe = null;
+    };
     return {
         // Get current user information
         async me() {
-            return axios.get(`/apps/${appId}/entities/User/me`);
+            const request = pendingMe !== null && pendingMe !== void 0 ? pendingMe : axios.get(`/apps/${appId}/entities/User/me`).finally(() => {
+                // Only retire this request if it is still the shared one. An identity
+                // change mid-flight clears `pendingMe` and the next caller starts a
+                // fresh request; an unconditional clear here would retire that newer
+                // request instead, so a third caller would issue a duplicate.
+                if (pendingMe === request)
+                    pendingMe = null;
+            });
+            pendingMe = request;
+            return request;
         },
         // Update current user data
         async updateMe(data) {
@@ -105,32 +128,11 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
             }
             const loginUrl = `${options.appBaseUrl}/api${authPath}?${queryParams}`;
             // When running inside an iframe, use a popup to avoid OAuth providers
-            // blocking iframe navigation. Popups stay on the exact legacy kickoff:
-            // they deliver the token via postMessage and never redeem a code (the
-            // backend skips the code mint when popup_origin is present).
+            // blocking iframe navigation.
             if (isInsideIframe()) {
                 const popupLoginUrl = `${loginUrl}&popup_origin=${encodeURIComponent(window.location.origin)}`;
                 return loginViaPopup(popupLoginUrl, redirectUrl, window.location.origin);
             }
-            // Full-page SSO redirect: offer the PKCE session-code handoff
-            // (base44-dev/apper#17216 §5.2). The backend decides per request whether
-            // to use it; a server that answers with the legacy ?access_token= —
-            // including after a backend rollback — is honored unchanged at
-            // redemption. If PKCE can't be prepared locally, kick off with the
-            // unmodified legacy URL (version=2 without a valid challenge is a 400
-            // at /login, so it's all-or-nothing).
-            if (provider === "sso") {
-                prepareSessionHandoffKickoff()
-                    .then((pkceQuery) => {
-                    window.location.href = pkceQuery
-                        ? `${loginUrl}${pkceQuery}`
-                        : loginUrl;
-                })
-                    .catch(() => {
-                    window.location.href = loginUrl;
-                });
-                return;
-            }
             // Default: full-page redirect
             window.location.href = loginUrl;
         },
@@ -138,6 +140,10 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
         logout(redirectUrl) {
             // Remove token from axios headers (always do this)
             delete axios.defaults.headers.common["Authorization"];
+            // Drop identity resolved under the previous session: a `me()` already in
+            // flight would otherwise resolve into callers that run after the logout.
+            clearPendingMe();
+            resetAnalyticsSessionContext();
             // Only do the rest if in a browser environment
             if (typeof window !== "undefined") {
                 // Remove token from localStorage
@@ -162,6 +168,10 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
         setToken(token, saveToStorage = true) {
             if (!token)
                 return;
+            // Same reasoning as in `logout`: the identity changes here, so anything
+            // resolved for the previous one must not be handed to later callers.
+            clearPendingMe();
+            resetAnalyticsSessionContext();
             // handle token change for axios clients
             axios.defaults.headers.common["Authorization"] = `Bearer ${token}`;
             functionsAxiosClient.defaults.headers.common["Authorization"] = `Bearer ${token}`;

package/dist/modules/connectors.types.d.ts

@@ -53,11 +53,14 @@ export interface AppUserConnectorConnectionResponse {
  *
  * ## Shared connectors
  *
- * All app users share a single OAuth token. Use this for shared accounts. For example, posting to a company Slack channel or reading from a shared Google Calendar. To use a shared connector:
+ * All app users share a single OAuth token. Use this for shared accounts. For example, posting to a company Slack channel or reading from a shared Google Calendar.
  *
- * 1. Connect the external service account in the app's Integration settings or using the [`connectors push`](/developers/references/cli/commands/connectors-push) CLI command.
- * 2. In a backend function, call {@linkcode getConnection | getConnection()} using the service role client (`base44.asServiceRole.connectors`) with an [integration type](#available-connectors) string to retrieve the shared OAuth token.
- * 3. Use the returned `accessToken` to call the external service's API directly. Some connectors also return a `connectionConfig` with additional values such as a subdomain for building the API URL.
+ * Shared connectors come in two forms, depending on how the connector is set up. Both return the same app-wide token, so they differ only in how you identify the connector in code:
+ *
+ * - **Platform connectors** are connected from the app's Integration settings or with the [`connectors push`](/developers/references/cli/commands/connectors-push) CLI command, and are identified by an [integration type](#available-connectors) string. Retrieve them with {@linkcode getConnection | getConnection()}.
+ * - **Workspace-registered connectors** are backed by your own OAuth app, registered once in Workspace Settings and consented to by the app builder. They are identified by a connector ID instead of an integration type. Retrieve them with {@linkcode getWorkspaceConnection | getWorkspaceConnection()}. Connectors whose OAuth app is specific to your own account, such as Databricks and Snowflake, work this way.
+ *
+ * To use a shared connector, call the matching method on the service role client `base44.asServiceRole.connectors` from a backend function, then use the returned `accessToken` to call the external service's API directly. Some connectors also return a `connectionConfig` with additional values, such as a subdomain, that you need to build the API URL.
  *
  * ## App user connectors
  *
@@ -70,7 +73,7 @@ export interface AppUserConnectorConnectionResponse {
  *
  * ## Available connectors
  *
- * All connectors listed below support both shared and app user connections. For shared connectors, pass the integration type string to {@linkcode getConnection | getConnection()}. For app user connectors, register the connector in Workspace Settings and use the connector ID with {@linkcode getCurrentAppUserConnection | getCurrentAppUserConnection()}.
+ * The connectors below can be used as shared connectors or as app user connectors. For a shared platform connector, pass the integration type string to {@linkcode getConnection | getConnection()}. For a connector you register in Workspace Settings with your own OAuth app, use the connector ID with {@linkcode getWorkspaceConnection | getWorkspaceConnection()} for a shared token, or with {@linkcode getCurrentAppUserConnection | getCurrentAppUserConnection()} for a per-user token.
  *
  * | Service | Type identifier |
  * |---|---|
@@ -204,6 +207,8 @@ export interface ConnectorsModule {
      *
      * Use this when a single shared account is connected and all app users access the same token. For per-user tokens, use [`getCurrentAppUserConnection()`](#getcurrentappuserconnection) instead.
      *
+     * This form is for platform connectors identified by an integration type. Connectors backed by your own OAuth app registered in Workspace Settings, such as Databricks and Snowflake, are retrieved by connector ID with {@linkcode getWorkspaceConnection | getWorkspaceConnection()} instead.
+     *
      * Some connectors require connection-specific parameters to build API calls.
      * In such cases, the returned `connectionConfig` is an object with the additional parameters. If there are no extra parameters needed for the connection, the `connectionConfig` is `null`.
      *
@@ -257,28 +262,27 @@ export interface ConnectorsModule {
      */
     getConnection(integrationType: ConnectorIntegrationType): Promise<ConnectorConnectionResponse>;
     /**
-     * Retrieves the OAuth access token and connection configuration for a **workspace-registered** connector
-     * (a connector backed by an OAuth app registered in the workspace, consented to once by the app builder).
+     * Retrieves the shared OAuth access token and connection configuration for a [workspace-registered connector](#shared-connectors).
      *
-     * Use this method when the app's backend function needs to use a connector identified by its
-     * workspace-connector ID rather than a platform integration type. The token returned represents
-     * the app builder's consent against the workspace's OAuth app and is shared across all app users
-     * of the app — identical semantics to the platform-shared {@link getConnection} form,
-     * differing only in which OAuth app was used to produce the token.
+     * Use this for a connector backed by your own OAuth app that you register in Workspace Settings, such as Databricks or Snowflake. The app builder consents to the connector once, and the returned token is shared across all app users of the app. This is the shared-token counterpart to {@linkcode getCurrentAppUserConnection | getCurrentAppUserConnection()}, which returns a per-user token for the same kind of connector. The semantics match {@linkcode getConnection | getConnection()}, except that you identify the connector by ID rather than by integration type.
      *
-     * @param connectorId - The ID of the workspace connector (the `OrganizationConnector` database ID) as surfaced in the builder chat context.
+     * Some connectors require connection-specific parameters to build API calls. In such cases, the returned `connectionConfig` is an object with those parameters, such as the account subdomain used to construct the API URL. When no extra parameters are needed, `connectionConfig` is `null`.
+     *
+     * @param connectorId - The ID of the workspace connector, not the integration type string. You can find it on the connector's settings page in Workspace Settings.
      * @returns Promise resolving to a {@link ConnectorConnectionResponse} with `accessToken` and `connectionConfig`.
      *
      * @example
      * ```typescript
-     * // Get the connection for a workspace-registered connector
-     * const { accessToken, connectionConfig } = await base44.asServiceRole.connectors.getWorkspaceConnection(
-     *   'abc123def',
+     * // Snowflake connection
+     * // Retrieve the shared token and run a statement against the account
+     * const { accessToken, connectionConfig } = await base44.asServiceRole.connectors.getWorkspaceConnection('abc123def');
+     *
+     * const response = await fetch(
+     *   `https://${connectionConfig?.subdomain}.snowflakecomputing.com/api/v2/statements`,
+     *   { headers: { Authorization: `Bearer ${accessToken}` } }
      * );
      *
-     * const response = await fetch(`https://${connectionConfig?.subdomain}.snowflakecomputing.com/api/v2/statements`, {
-     *   headers: { Authorization: `Bearer ${accessToken}` },
-     * });
+     * const data = await response.json();
      * ```
      */
     getWorkspaceConnection(connectorId: string): Promise<ConnectorConnectionResponse>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@base44-preview/sdk",
-  "version": "0.8.41-pr.244.e7d6747",
+  "version": "0.8.42-pr.254.6a358ec",
   "description": "JavaScript SDK for Base44 API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/dist/utils/session-handoff.d.ts

@@ -1,52 +0,0 @@
-/**
- * PKCE-bound one-time session-code handoff for SSO logins
- * (base44-dev/apper#17216 §5.2).
- *
- * The SDK OFFERS the handoff at login kickoff (`version=2` + S256
- * `code_challenge`) and the backend DECIDES per request: it only emits a
- * `session_code` when every server-side gate holds (verified custom domain,
- * non-private app, feature flag ON). In every other case — older backends,
- * excluded apps, and critically a BACKEND ROLLBACK — the server keeps
- * delivering the legacy `?access_token=` URL param, which the SDK digests
- * exactly as before. This is a negotiation, never a deprecation: the legacy
- * path must keep working here forever.
- *
- * Fail-open rule for kickoff: never send `version=2` unless this browser can
- * actually complete the exchange (WebCrypto, sessionStorage that persists,
- * fetch). The server 400s a `version=2` login without a valid challenge, and
- * an opted-in login whose verifier is lost can never redeem its code — both
- * are avoided by simply not opting in and letting the legacy path run.
- */
-/** sessionStorage key for the PKCE verifier. Per-tab by design (RFC 7636: the
- * verifier never leaves the browser); a login that completes in a different
- * tab loses it — a named, expected failure mode, see redeemSessionHandoffCode. */
-export declare const PKCE_VERIFIER_STORAGE_KEY = "base44_pkce_verifier";
-/**
- * Prepares the PKCE opt-in for an SSO login kickoff.
- *
- * Generates a verifier, persists it in sessionStorage (verified by read-back —
- * a write that doesn't stick means the exchange could never succeed), and
- * returns the query-string suffix to append to the login URL:
- * `&version=2&code_challenge=<S256>&code_challenge_method=S256`.
- *
- * Returns `null` on ANY failure or missing capability, in which case the
- * caller must use the unmodified legacy login URL. Never throws.
- *
- * @internal
- */
-export declare function prepareSessionHandoffKickoff(): Promise<string | null>;
-/**
- * Redeems a PKCE session-code handoff from the current URL, if one is present.
- *
- * Returns `null` synchronously when the URL carries no handoff — including
- * when it carries a legacy `?access_token=` (the legacy capture wins outright;
- * this is what makes a backend rollback safe). Otherwise strips the handoff
- * params from the URL immediately and returns a promise resolving to the
- * exchanged access token, or `null` when the exchange fails. Never rejects,
- * never redirects: a failed exchange leaves the app unauthenticated and lets
- * its normal login flow take over (each retry mints a fresh code, so this
- * self-heals rather than looping).
- *
- * @internal
- */
-export declare function redeemSessionHandoffCode(): Promise<string | null> | null;

package/dist/utils/session-handoff.js

@@ -1,184 +0,0 @@
-/**
- * PKCE-bound one-time session-code handoff for SSO logins
- * (base44-dev/apper#17216 §5.2).
- *
- * The SDK OFFERS the handoff at login kickoff (`version=2` + S256
- * `code_challenge`) and the backend DECIDES per request: it only emits a
- * `session_code` when every server-side gate holds (verified custom domain,
- * non-private app, feature flag ON). In every other case — older backends,
- * excluded apps, and critically a BACKEND ROLLBACK — the server keeps
- * delivering the legacy `?access_token=` URL param, which the SDK digests
- * exactly as before. This is a negotiation, never a deprecation: the legacy
- * path must keep working here forever.
- *
- * Fail-open rule for kickoff: never send `version=2` unless this browser can
- * actually complete the exchange (WebCrypto, sessionStorage that persists,
- * fetch). The server 400s a `version=2` login without a valid challenge, and
- * an opted-in login whose verifier is lost can never redeem its code — both
- * are avoided by simply not opting in and letting the legacy path run.
- */
-/** sessionStorage key for the PKCE verifier. Per-tab by design (RFC 7636: the
- * verifier never leaves the browser); a login that completes in a different
- * tab loses it — a named, expected failure mode, see redeemSessionHandoffCode. */
-export const PKCE_VERIFIER_STORAGE_KEY = "base44_pkce_verifier";
-/** Server-side format for challenge/verifier: base64url of 32 bytes, 43 chars. */
-const BASE64URL_43 = /^[A-Za-z0-9_-]{43}$/;
-function base64UrlEncode(bytes) {
-    let binary = "";
-    for (const byte of bytes) {
-        binary += String.fromCharCode(byte);
-    }
-    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-/**
- * Prepares the PKCE opt-in for an SSO login kickoff.
- *
- * Generates a verifier, persists it in sessionStorage (verified by read-back —
- * a write that doesn't stick means the exchange could never succeed), and
- * returns the query-string suffix to append to the login URL:
- * `&version=2&code_challenge=<S256>&code_challenge_method=S256`.
- *
- * Returns `null` on ANY failure or missing capability, in which case the
- * caller must use the unmodified legacy login URL. Never throws.
- *
- * @internal
- */
-export async function prepareSessionHandoffKickoff() {
-    var _a;
-    try {
-        if (typeof window === "undefined")
-            return null;
-        const crypto = globalThis.crypto;
-        if (!(crypto === null || crypto === void 0 ? void 0 : crypto.getRandomValues) || !((_a = crypto.subtle) === null || _a === void 0 ? void 0 : _a.digest))
-            return null;
-        // The exchange at redemption time needs fetch; don't opt in without it.
-        if (typeof fetch !== "function")
-            return null;
-        const verifier = base64UrlEncode(crypto.getRandomValues(new Uint8Array(32)));
-        const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
-        const challenge = base64UrlEncode(new Uint8Array(digest));
-        // The server rejects a malformed opt-in with a 400 at /login; a malformed
-        // challenge here must therefore mean "don't opt in", never "send anyway".
-        if (!BASE64URL_43.test(challenge))
-            return null;
-        // Store last, after everything else succeeded, and verify the write took
-        // (sandboxed iframes and lockdown modes can throw OR silently drop it).
-        window.sessionStorage.setItem(PKCE_VERIFIER_STORAGE_KEY, verifier);
-        if (window.sessionStorage.getItem(PKCE_VERIFIER_STORAGE_KEY) !== verifier) {
-            return null;
-        }
-        return `&version=2&code_challenge=${challenge}&code_challenge_method=S256`;
-    }
-    catch (_b) {
-        return null;
-    }
-}
-/**
- * Redeems a PKCE session-code handoff from the current URL, if one is present.
- *
- * Returns `null` synchronously when the URL carries no handoff — including
- * when it carries a legacy `?access_token=` (the legacy capture wins outright;
- * this is what makes a backend rollback safe). Otherwise strips the handoff
- * params from the URL immediately and returns a promise resolving to the
- * exchanged access token, or `null` when the exchange fails. Never rejects,
- * never redirects: a failed exchange leaves the app unauthenticated and lets
- * its normal login flow take over (each retry mints a fresh code, so this
- * self-heals rather than looping).
- *
- * @internal
- */
-export function redeemSessionHandoffCode() {
-    if (typeof window === "undefined" || !window.location)
-        return null;
-    let code = null;
-    let exchangePath = null;
-    let urlParams;
-    try {
-        urlParams = new URLSearchParams(window.location.search);
-        code = urlParams.get("session_code");
-        exchangePath = urlParams.get("session_exchange_path");
-        if (!code || !exchangePath)
-            return null;
-        // A server speaking legacy is authoritative: if an access_token is in the
-        // URL (the two are never both sent by a real backend), take the legacy
-        // path and ignore the code entirely.
-        if (urlParams.get("access_token"))
-            return null;
-        // Strip the one-time params right away so the code doesn't linger in the
-        // URL/history or get re-submitted on reload. `is_new_user` stays in the
-        // URL exactly as the legacy flow leaves it.
-        urlParams.delete("session_code");
-        urlParams.delete("session_exchange_path");
-        const newUrl = `${window.location.pathname}${urlParams.toString() ? `?${urlParams.toString()}` : ""}${window.location.hash}`;
-        window.history.replaceState({}, typeof document !== "undefined" ? document.title : "", newUrl);
-    }
-    catch (e) {
-        console.error("Error reading session handoff params from URL:", e);
-        return null;
-    }
-    return exchangeSessionHandoffCode(code, exchangePath);
-}
-async function exchangeSessionHandoffCode(code, exchangePath) {
-    // The verifier is one-shot: take it out of storage no matter how the
-    // exchange ends (a failed PKCE check doesn't burn the code server-side,
-    // but a stale verifier can never match a future login's challenge).
-    let verifier = null;
-    try {
-        verifier = window.sessionStorage.getItem(PKCE_VERIFIER_STORAGE_KEY);
-        if (verifier !== null) {
-            window.sessionStorage.removeItem(PKCE_VERIFIER_STORAGE_KEY);
-        }
-    }
-    catch (_a) {
-        verifier = null;
-    }
-    // SECURITY: the exchange path arrives via the URL, so treat it as tainted.
-    // POSTing the code + verifier to an attacker-chosen origin would hand over
-    // both halves of the PKCE proof — enforce same-origin, path-only semantics.
-    let exchangeUrl;
-    try {
-        exchangeUrl = new URL(exchangePath, window.location.origin);
-    }
-    catch (_b) {
-        console.error("Invalid session_exchange_path; skipping token exchange.");
-        return null;
-    }
-    if (exchangeUrl.origin !== window.location.origin) {
-        console.error("Cross-origin session_exchange_path rejected; skipping token exchange.");
-        return null;
-    }
-    if (typeof fetch !== "function")
-        return null;
-    try {
-        const response = await fetch(exchangeUrl.toString(), {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({
-                code,
-                ...(verifier ? { code_verifier: verifier } : {}),
-            }),
-        });
-        if (!response.ok) {
-            if (!verifier) {
-                // Named failure mode (base44-dev/apper#17216): the login completed in
-                // a different tab/window than it started in, so the per-tab PKCE
-                // verifier is gone and the server fails closed. Logging in again from
-                // this tab works.
-                console.warn("Base44 SDK: SSO login could not be completed because it finished " +
-                    "in a different browser tab than it started in (missing PKCE " +
-                    "verifier). Please log in again.");
-            }
-            else {
-                console.error(`Base44 SDK: SSO session-code exchange failed (HTTP ${response.status}).`);
-            }
-            return null;
-        }
-        const data = await response.json();
-        const accessToken = data === null || data === void 0 ? void 0 : data.access_token;
-        return typeof accessToken === "string" && accessToken ? accessToken : null;
-    }
-    catch (e) {
-        console.error("Base44 SDK: SSO session-code exchange failed:", e);
-        return null;
-    }
-}