@base44-preview/sdk 0.8.42-pr.256.fb681e4 → 0.8.43-pr.244.b43fd83

package/dist/client.js

@@ -5,6 +5,7 @@ import { createAuthModule } from "./modules/auth.js";
 import { createSsoModule } from "./modules/sso.js";
 import { createConnectorsModule, createUserConnectorsModule, } from "./modules/connectors.js";
 import { getAccessToken } from "./utils/auth-utils.js";
+import { redeemSessionHandoffCode } from "./utils/session-handoff.js";
 import { createFunctionsModule } from "./modules/functions.js";
 import { createAgentsModule } from "./modules/agents.js";
 import { createAiGatewayModule } from "./modules/ai-gateway.js";
@@ -113,15 +114,38 @@ export function createClient(config) {
     const userAuthModule = createAuthModule(axiosClient, functionsAxiosClient, appId, {
         appBaseUrl: normalizedAppBaseUrl,
         serverUrl,
+        token,
     });
     // Apply the access token before any module that may issue authenticated
     // requests during construction (notably analytics, which fires an init
     // event whose flush calls auth.me()). Without this, the first User/me
     // request is built before setToken runs and goes out unauthenticated.
+    //
+    // Precedence: an explicit config token wins (legacy behavior); then a PKCE
+    // session-code handoff in the URL (base44-dev/apper#17216 §5.2) — the user
+    // just completed a login, so it outranks any stored token, mirroring how
+    // getAccessToken prefers a URL access_token over localStorage; then the
+    // legacy capture. When the server spoke legacy — including after a backend
+    // rollback — redeemSessionHandoffCode() returns null synchronously and the
+    // legacy capture below runs unchanged.
+    let tokenBootstrap = null;
     if (typeof window !== "undefined") {
-        const accessToken = token || getAccessToken();
-        if (accessToken) {
-            userAuthModule.setToken(accessToken);
+        const sessionExchange = token ? null : redeemSessionHandoffCode();
+        if (sessionExchange) {
+            tokenBootstrap = sessionExchange.then((exchangedToken) => {
+                // On exchange failure, fall back to any stored token rather than
+                // leaving auth state empty (same fallback getAccessToken applies).
+                const accessToken = exchangedToken || getAccessToken();
+                if (accessToken) {
+                    userAuthModule.setToken(accessToken);
+                }
+            });
+        }
+        else {
+            const accessToken = token || getAccessToken();
+            if (accessToken) {
+                userAuthModule.setToken(accessToken);
+            }
         }
     }
     const actorsModule = createActorsModule({
@@ -218,6 +242,13 @@ export function createClient(config) {
         // We perform this check asynchronously to not block client creation
         setTimeout(async () => {
             try {
+                // A pending session-code exchange must settle before the auth probe.
+                // Probing early would see no token, redirect to login, and abandon
+                // the in-flight exchange — minting a fresh code on every round, i.e.
+                // a login loop (the exact BUG-787 failure shape).
+                if (tokenBootstrap) {
+                    await tokenBootstrap;
+                }
                 const isAuthenticated = await userModules.auth.isAuthenticated();
                 if (!isAuthenticated) {
                     userModules.auth.redirectToLogin(window.location.href);

package/dist/index.d.ts

@@ -14,6 +14,6 @@ export type { AppLogsModule } from "./modules/app-logs.types.js";
 export type { ActorsModule, ActorClient, ActorRef, Connection, ActorSubscription, ActorConnectOptions, ActorNameRegistry, ActorRegistry, } from "./modules/actors.types.js";
 export type { SsoModule, SsoAccessTokenResponse } from "./modules/sso.types.js";
 export { Actor, type Conn } from "./actor.js";
-export type { ConnectorsModule, UserConnectorsModule, ConnectorApiRequest, ConnectorApiResponse, } from "./modules/connectors.types.js";
+export type { ConnectorsModule, UserConnectorsModule, } from "./modules/connectors.types.js";
 export type { CustomIntegrationsModule, CustomIntegrationCallParams, CustomIntegrationCallResponse, } from "./modules/custom-integrations.types.js";
 export type { GetAccessTokenOptions, SaveAccessTokenOptions, RemoveAccessTokenOptions, GetLoginUrlOptions, } from "./utils/auth-utils.types.js";

package/dist/modules/analytics.d.ts

@@ -1,6 +1,6 @@
 import { AxiosInstance } from "axios";
 import { TrackEventParams, AnalyticsModuleOptions } from "./analytics.types";
-import type { AuthModule } from "./auth.types";
+import type { InternalAuthModule } from "./auth.types";
 export declare const USER_HEARTBEAT_EVENT_NAME = "__user_heartbeat_event__";
 export declare const ANALYTICS_INITIALIZATION_EVENT_NAME = "__initialization_event__";
 export declare const ANALYTICS_SESSION_DURATION_EVENT_NAME = "__session_duration_event__";
@@ -10,7 +10,7 @@ export interface AnalyticsModuleArgs {
     axiosClient: AxiosInstance;
     serverUrl: string;
     appId: string;
-    userAuthModule: AuthModule;
+    userAuthModule: InternalAuthModule;
 }
 export declare const createAnalyticsModule: ({ axiosClient, serverUrl, appId, userAuthModule, }: AnalyticsModuleArgs) => {
     track: (params: TrackEventParams) => void;

package/dist/modules/analytics.js

@@ -247,6 +247,13 @@ export function resetAnalyticsSessionContext() {
 }
 async function getSessionContext(userAuthModule) {
     if (!analyticsSharedState.sessionContext) {
+        // With no token there is no identity to resolve: `me()` can only answer 401,
+        // which the browser logs to the console before any handler here sees it. On
+        // a public page that request is the sole reason an error appears, so skip
+        // it. This is not memoized — a visitor who logs in later must still resolve.
+        if (!userAuthModule.hasToken()) {
+            return { user_id: null, session_id: getAnalyticsSessionId() };
+        }
         if (!sessionContextPromise) {
             const sessionId = getAnalyticsSessionId();
             sessionContextPromise = userAuthModule

package/dist/modules/auth.d.ts

@@ -1,5 +1,5 @@
 import { AxiosInstance } from "axios";
-import { AuthModule, AuthModuleOptions } from "./auth.types";
+import { AuthModuleOptions, InternalAuthModule } from "./auth.types";
 /**
  * Creates the auth module for the Base44 SDK.
  *
@@ -10,4 +10,4 @@ import { AuthModule, AuthModuleOptions } from "./auth.types";
  * @returns Auth module with authentication and user management methods
  * @internal
  */
-export declare function createAuthModule(axios: AxiosInstance, functionsAxiosClient: AxiosInstance, appId: string, options: AuthModuleOptions): AuthModule;
+export declare function createAuthModule(axios: AxiosInstance, functionsAxiosClient: AxiosInstance, appId: string, options: AuthModuleOptions): InternalAuthModule;

package/dist/modules/auth.js

@@ -1,4 +1,5 @@
 import { resetAnalyticsSessionContext } from "./analytics.js";
+import { prepareSessionHandoffKickoff } from "../utils/session-handoff.js";
 function isInsideIframe() {
     if (typeof window === "undefined")
         return false;
@@ -78,7 +79,14 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
     const clearPendingMe = () => {
         pendingMe = null;
     };
+    // Tracked here rather than read off `axios.defaults` so the answer stays tied
+    // to the identity transitions below (`setToken`, `logout`) instead of to the
+    // header a caller may have set on the instance directly.
+    let hasAccessToken = Boolean(options.token);
     return {
+        hasToken() {
+            return hasAccessToken;
+        },
         // Get current user information
         async me() {
             const request = pendingMe !== null && pendingMe !== void 0 ? pendingMe : axios.get(`/apps/${appId}/entities/User/me`).finally(() => {
@@ -128,11 +136,32 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
             }
             const loginUrl = `${options.appBaseUrl}/api${authPath}?${queryParams}`;
             // When running inside an iframe, use a popup to avoid OAuth providers
-            // blocking iframe navigation.
+            // blocking iframe navigation. Popups stay on the exact legacy kickoff:
+            // they deliver the token via postMessage and never redeem a code (the
+            // backend skips the code mint when popup_origin is present).
             if (isInsideIframe()) {
                 const popupLoginUrl = `${loginUrl}&popup_origin=${encodeURIComponent(window.location.origin)}`;
                 return loginViaPopup(popupLoginUrl, redirectUrl, window.location.origin);
             }
+            // Full-page SSO redirect: offer the PKCE session-code handoff
+            // (base44-dev/apper#17216 §5.2). The backend decides per request whether
+            // to use it; a server that answers with the legacy ?access_token= —
+            // including after a backend rollback — is honored unchanged at
+            // redemption. If PKCE can't be prepared locally, kick off with the
+            // unmodified legacy URL (version=2 without a valid challenge is a 400
+            // at /login, so it's all-or-nothing).
+            if (provider === "sso") {
+                prepareSessionHandoffKickoff()
+                    .then((pkceQuery) => {
+                    window.location.href = pkceQuery
+                        ? `${loginUrl}${pkceQuery}`
+                        : loginUrl;
+                })
+                    .catch(() => {
+                    window.location.href = loginUrl;
+                });
+                return;
+            }
             // Default: full-page redirect
             window.location.href = loginUrl;
         },
@@ -144,6 +173,7 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
             // flight would otherwise resolve into callers that run after the logout.
             clearPendingMe();
             resetAnalyticsSessionContext();
+            hasAccessToken = false;
             // Only do the rest if in a browser environment
             if (typeof window !== "undefined") {
                 // Remove token from localStorage
@@ -172,6 +202,7 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
             // resolved for the previous one must not be handed to later callers.
             clearPendingMe();
             resetAnalyticsSessionContext();
+            hasAccessToken = true;
             // handle token change for axios clients
             axios.defaults.headers.common["Authorization"] = `Bearer ${token}`;
             functionsAxiosClient.defaults.headers.common["Authorization"] = `Bearer ${token}`;

package/dist/modules/auth.types.d.ts

@@ -92,6 +92,12 @@ export interface AuthModuleOptions {
     serverUrl: string;
     /** Base URL for the app (used for login redirects). */
     appBaseUrl: string;
+    /**
+     * Access token the client was constructed with, if any. Seeds the module's
+     * view of whether a session exists before {@link AuthModule.setToken} runs,
+     * which is how the server-side SDK reports a token it never sets explicitly.
+     */
+    token?: string;
 }
 /**
  * Authentication module for managing user authentication and authorization. The module automatically stores tokens in local storage when available and manages authorization headers for API requests.
@@ -515,3 +521,20 @@ export interface AuthModule {
      */
     changePassword(params: ChangePasswordParams): Promise<any>;
 }
+/**
+ * The auth module as constructed internally, before it is narrowed to
+ * {@link AuthModule} on the public client. Not exported from the package
+ * index — SDK consumers see only {@link AuthModule}.
+ *
+ * @internal
+ */
+export interface InternalAuthModule extends AuthModule {
+    /**
+     * Whether an access token is currently set on the client.
+     *
+     * Reports only the presence of a token, never its validity — an expired or
+     * revoked token still reads as `true`. Callers use this to skip requests that
+     * could not succeed without a session, not to decide that one is valid.
+     */
+    hasToken(): boolean;
+}

package/dist/modules/connectors.js

@@ -68,46 +68,6 @@ export function createConnectorsModule(axios, appId) {
                 connectionConfig: (_a = data.connection_config) !== null && _a !== void 0 ? _a : null,
             };
         },
-        async callApi(integrationType, request) {
-            assertNonEmptyString(integrationType, "Integration type");
-            return proxyCall(axios, `/apps/${appId}/connectors/${integrationType}/call`, request);
-        },
-    };
-}
-function assertNonEmptyString(value, label) {
-    if (!value || typeof value !== "string") {
-        throw new Error(`${label} is required and must be a string`);
-    }
-}
-/**
- * POST a request to the connector proxy and normalize the response.
- *
- * The proxy reports upstream outcomes in the body rather than as HTTP status, so
- * a provider 4xx/5xx arrives here as a resolved response with `success: false` —
- * only Base44-side failures reject through the axios error interceptor.
- *
- * @internal
- */
-async function proxyCall(axios, url, request) {
-    var _a, _b, _c, _d, _e, _f, _g;
-    if (!request || typeof request !== "object") {
-        throw new Error("Request is required and must be an object");
-    }
-    assertNonEmptyString(request.path, "Request path");
-    const response = await axios.post(url, {
-        method: ((_a = request.method) !== null && _a !== void 0 ? _a : "GET").toUpperCase(),
-        path: request.path,
-        query: (_b = request.query) !== null && _b !== void 0 ? _b : {},
-        headers: (_c = request.headers) !== null && _c !== void 0 ? _c : {},
-        body: (_d = request.body) !== null && _d !== void 0 ? _d : null,
-    });
-    const data = response;
-    return {
-        success: data.success,
-        status: (_e = data.status_code) !== null && _e !== void 0 ? _e : null,
-        data: data.data,
-        headers: (_f = data.headers) !== null && _f !== void 0 ? _f : {},
-        creditsCharged: (_g = data.credits_charged) !== null && _g !== void 0 ? _g : 0,
     };
 }
 /**

package/dist/modules/connectors.types.d.ts

@@ -41,52 +41,6 @@ export interface AppUserConnectorConnectionResponse {
     /** Key-value configuration for the connection, or `null` if the connector does not provide one. */
     connectionConfig: Record<string, string> | null;
 }
-/**
- * A request to forward to a metered connector's API through the Base44 proxy.
- */
-export interface ConnectorApiRequest {
-    /** HTTP method for the upstream request. Defaults to `'GET'`. */
-    method?: "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD";
-    /**
-     * Path relative to the connector's API root, starting with `/`, such as `'/2/tweets'`.
-     *
-     * Must not be an absolute URL. Query parameters may be included here or passed
-     * separately as {@link query}; either way they are forwarded and priced identically.
-     */
-    path: string;
-    /** Query parameters. Merged into the request URL alongside any already present in {@link path}. */
-    query?: Record<string, string | number | boolean | Array<string | number>>;
-    /** Extra request headers. Only headers the connector explicitly allows are forwarded; the rest are dropped. */
-    headers?: Record<string, string>;
-    /** JSON request body. Ignored for `GET`, `HEAD`, and `DELETE`. */
-    body?: unknown;
-}
-/**
- * The upstream API's response, as returned by the Base44 connector proxy.
- */
-export interface ConnectorApiResponse<T = unknown> {
-    /** `true` when the upstream API returned a 2xx status. */
-    success: boolean;
-    /** The upstream HTTP status code, or `null` if the request never reached the provider. */
-    status: number | null;
-    /** The parsed upstream response body. */
-    data: T;
-    /** The subset of upstream response headers the connector exposes, typically rate-limit counters. */
-    headers: Record<string, string>;
-    /** Integration credits billed to the workspace for this call. */
-    creditsCharged: number;
-}
-/**
- * Raw proxy response shape. Mapped to {@link ConnectorApiResponse} before being returned.
- * @internal
- */
-export interface ConnectorProxyRawResponse {
-    success: boolean;
-    status_code: number | null;
-    data: unknown;
-    headers: Record<string, string>;
-    credits_charged: number;
-}
 /**
  * Connectors module for managing OAuth tokens for external services.
  *
@@ -117,17 +71,6 @@ export interface ConnectorProxyRawResponse {
  * 3. In a backend function, call {@linkcode getCurrentAppUserConnection | getCurrentAppUserConnection()} using the service role client (`base44.asServiceRole.connectors`) with the connector ID to retrieve the app user's token.
  * 4. Use the returned `accessToken` to call the external service's API directly. Some connectors also return a `connectionConfig` with additional values such as a subdomain for building the API URL.
  *
- * ## Metered connectors
- *
- * A few [platform connectors](#shared-connectors) are backed by paid third-party APIs that charge Base44 per call. For those, the OAuth token is **not** available to your code — {@linkcode getConnection | getConnection()} rejects with a `403`. Call them with {@linkcode callApi | callApi()} instead: Base44 attaches the credential server-side, forwards the request, and bills your workspace's integration credits for the call.
- *
- * This applies to platform connectors only. A workspace-registered or app user connector runs on **your own** OAuth app, so the provider invoices you directly and there is nothing for Base44 to meter — those keep normal token access via {@linkcode getWorkspaceConnection | getWorkspaceConnection()} and {@linkcode getCurrentAppUserConnection | getCurrentAppUserConnection()}.
- *
- * Two things to keep in mind when writing against a metered connector:
- *
- * - **Cost varies by endpoint, sometimes sharply.** The same connector can charge two orders of magnitude more for one endpoint than another, so avoid putting an expensive call inside a loop and batch wherever the provider supports it. Each response reports what it actually cost as `creditsCharged`.
- * - **An upstream error is returned, not thrown.** A `4xx` or `5xx` from the provider comes back as `success: false` with the provider's own `status` and `data`, because it is a normal outcome of a call that Base44 completed. Only Base44-side failures — no connection, credits exhausted, a rejected request — reject the promise.
- *
  * ## Available connectors
  *
  * The connectors below can be used as shared connectors or as app user connectors. For a shared platform connector, pass the integration type string to {@linkcode getConnection | getConnection()}. For a connector you register in Workspace Settings with your own OAuth app, use the connector ID with {@linkcode getWorkspaceConnection | getWorkspaceConnection()} for a shared token, or with {@linkcode getCurrentAppUserConnection | getCurrentAppUserConnection()} for a per-user token.
@@ -385,41 +328,6 @@ export interface ConnectorsModule {
      * ```
      */
     getCurrentAppUserConnection(connectorId: string): Promise<AppUserConnectorConnectionResponse>;
-    /**
-     * Calls a [metered connector's](#metered-connectors) API through the Base44 proxy.
-     *
-     * Use this for a shared platform connector identified by an integration type. Base44 adds the OAuth credential to the outgoing request, forwards it, and bills the workspace for the call, so you never handle the token yourself.
-     *
-     * @param integrationType - The type of integration, such as `'x'`. See [Available connectors](#available-connectors).
-     * @param request - The upstream request to forward. See {@link ConnectorApiRequest}.
-     * @returns Promise resolving to a {@link ConnectorApiResponse}. Note that an upstream error is reported in `success` and `status`, not thrown — only Base44-side failures reject.
-     *
-     * @example
-     * ```typescript
-     * // Post to X
-     * const res = await base44.asServiceRole.connectors.callApi('x', {
-     *   method: 'POST',
-     *   path: '/2/tweets',
-     *   body: { text: 'Shipped!' },
-     * });
-     *
-     * if (!res.success) {
-     *   console.error('X rejected the post', res.status, res.data);
-     * }
-     * ```
-     *
-     * @example
-     * ```typescript
-     * // Read, with query parameters and a look at what the call cost
-     * const res = await base44.asServiceRole.connectors.callApi('x', {
-     *   path: '/2/tweets/search/recent',
-     *   query: { query: 'base44', max_results: 10 },
-     * });
-     *
-     * console.log(`${res.creditsCharged} credits`, res.data);
-     * ```
-     */
-    callApi<T = unknown>(integrationType: ConnectorIntegrationType, request: ConnectorApiRequest): Promise<ConnectorApiResponse<T>>;
 }
 /**
  * User-scoped connectors module for managing app user OAuth connections.

package/dist/utils/session-handoff.d.ts

@@ -0,0 +1,52 @@
+/**
+ * PKCE-bound one-time session-code handoff for SSO logins
+ * (base44-dev/apper#17216 §5.2).
+ *
+ * The SDK OFFERS the handoff at login kickoff (`version=2` + S256
+ * `code_challenge`) and the backend DECIDES per request: it only emits a
+ * `session_code` when every server-side gate holds (verified custom domain,
+ * non-private app, feature flag ON). In every other case — older backends,
+ * excluded apps, and critically a BACKEND ROLLBACK — the server keeps
+ * delivering the legacy `?access_token=` URL param, which the SDK digests
+ * exactly as before. This is a negotiation, never a deprecation: the legacy
+ * path must keep working here forever.
+ *
+ * Fail-open rule for kickoff: never send `version=2` unless this browser can
+ * actually complete the exchange (WebCrypto, sessionStorage that persists,
+ * fetch). The server 400s a `version=2` login without a valid challenge, and
+ * an opted-in login whose verifier is lost can never redeem its code — both
+ * are avoided by simply not opting in and letting the legacy path run.
+ */
+/** sessionStorage key for the PKCE verifier. Per-tab by design (RFC 7636: the
+ * verifier never leaves the browser); a login that completes in a different
+ * tab loses it — a named, expected failure mode, see redeemSessionHandoffCode. */
+export declare const PKCE_VERIFIER_STORAGE_KEY = "base44_pkce_verifier";
+/**
+ * Prepares the PKCE opt-in for an SSO login kickoff.
+ *
+ * Generates a verifier, persists it in sessionStorage (verified by read-back —
+ * a write that doesn't stick means the exchange could never succeed), and
+ * returns the query-string suffix to append to the login URL:
+ * `&version=2&code_challenge=<S256>&code_challenge_method=S256`.
+ *
+ * Returns `null` on ANY failure or missing capability, in which case the
+ * caller must use the unmodified legacy login URL. Never throws.
+ *
+ * @internal
+ */
+export declare function prepareSessionHandoffKickoff(): Promise<string | null>;
+/**
+ * Redeems a PKCE session-code handoff from the current URL, if one is present.
+ *
+ * Returns `null` synchronously when the URL carries no handoff — including
+ * when it carries a legacy `?access_token=` (the legacy capture wins outright;
+ * this is what makes a backend rollback safe). Otherwise strips the handoff
+ * params from the URL immediately and returns a promise resolving to the
+ * exchanged access token, or `null` when the exchange fails. Never rejects,
+ * never redirects: a failed exchange leaves the app unauthenticated and lets
+ * its normal login flow take over (each retry mints a fresh code, so this
+ * self-heals rather than looping).
+ *
+ * @internal
+ */
+export declare function redeemSessionHandoffCode(): Promise<string | null> | null;

package/dist/utils/session-handoff.js

@@ -0,0 +1,184 @@
+/**
+ * PKCE-bound one-time session-code handoff for SSO logins
+ * (base44-dev/apper#17216 §5.2).
+ *
+ * The SDK OFFERS the handoff at login kickoff (`version=2` + S256
+ * `code_challenge`) and the backend DECIDES per request: it only emits a
+ * `session_code` when every server-side gate holds (verified custom domain,
+ * non-private app, feature flag ON). In every other case — older backends,
+ * excluded apps, and critically a BACKEND ROLLBACK — the server keeps
+ * delivering the legacy `?access_token=` URL param, which the SDK digests
+ * exactly as before. This is a negotiation, never a deprecation: the legacy
+ * path must keep working here forever.
+ *
+ * Fail-open rule for kickoff: never send `version=2` unless this browser can
+ * actually complete the exchange (WebCrypto, sessionStorage that persists,
+ * fetch). The server 400s a `version=2` login without a valid challenge, and
+ * an opted-in login whose verifier is lost can never redeem its code — both
+ * are avoided by simply not opting in and letting the legacy path run.
+ */
+/** sessionStorage key for the PKCE verifier. Per-tab by design (RFC 7636: the
+ * verifier never leaves the browser); a login that completes in a different
+ * tab loses it — a named, expected failure mode, see redeemSessionHandoffCode. */
+export const PKCE_VERIFIER_STORAGE_KEY = "base44_pkce_verifier";
+/** Server-side format for challenge/verifier: base64url of 32 bytes, 43 chars. */
+const BASE64URL_43 = /^[A-Za-z0-9_-]{43}$/;
+function base64UrlEncode(bytes) {
+    let binary = "";
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+/**
+ * Prepares the PKCE opt-in for an SSO login kickoff.
+ *
+ * Generates a verifier, persists it in sessionStorage (verified by read-back —
+ * a write that doesn't stick means the exchange could never succeed), and
+ * returns the query-string suffix to append to the login URL:
+ * `&version=2&code_challenge=<S256>&code_challenge_method=S256`.
+ *
+ * Returns `null` on ANY failure or missing capability, in which case the
+ * caller must use the unmodified legacy login URL. Never throws.
+ *
+ * @internal
+ */
+export async function prepareSessionHandoffKickoff() {
+    var _a;
+    try {
+        if (typeof window === "undefined")
+            return null;
+        const crypto = globalThis.crypto;
+        if (!(crypto === null || crypto === void 0 ? void 0 : crypto.getRandomValues) || !((_a = crypto.subtle) === null || _a === void 0 ? void 0 : _a.digest))
+            return null;
+        // The exchange at redemption time needs fetch; don't opt in without it.
+        if (typeof fetch !== "function")
+            return null;
+        const verifier = base64UrlEncode(crypto.getRandomValues(new Uint8Array(32)));
+        const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+        const challenge = base64UrlEncode(new Uint8Array(digest));
+        // The server rejects a malformed opt-in with a 400 at /login; a malformed
+        // challenge here must therefore mean "don't opt in", never "send anyway".
+        if (!BASE64URL_43.test(challenge))
+            return null;
+        // Store last, after everything else succeeded, and verify the write took
+        // (sandboxed iframes and lockdown modes can throw OR silently drop it).
+        window.sessionStorage.setItem(PKCE_VERIFIER_STORAGE_KEY, verifier);
+        if (window.sessionStorage.getItem(PKCE_VERIFIER_STORAGE_KEY) !== verifier) {
+            return null;
+        }
+        return `&version=2&code_challenge=${challenge}&code_challenge_method=S256`;
+    }
+    catch (_b) {
+        return null;
+    }
+}
+/**
+ * Redeems a PKCE session-code handoff from the current URL, if one is present.
+ *
+ * Returns `null` synchronously when the URL carries no handoff — including
+ * when it carries a legacy `?access_token=` (the legacy capture wins outright;
+ * this is what makes a backend rollback safe). Otherwise strips the handoff
+ * params from the URL immediately and returns a promise resolving to the
+ * exchanged access token, or `null` when the exchange fails. Never rejects,
+ * never redirects: a failed exchange leaves the app unauthenticated and lets
+ * its normal login flow take over (each retry mints a fresh code, so this
+ * self-heals rather than looping).
+ *
+ * @internal
+ */
+export function redeemSessionHandoffCode() {
+    if (typeof window === "undefined" || !window.location)
+        return null;
+    let code = null;
+    let exchangePath = null;
+    let urlParams;
+    try {
+        urlParams = new URLSearchParams(window.location.search);
+        code = urlParams.get("session_code");
+        exchangePath = urlParams.get("session_exchange_path");
+        if (!code || !exchangePath)
+            return null;
+        // A server speaking legacy is authoritative: if an access_token is in the
+        // URL (the two are never both sent by a real backend), take the legacy
+        // path and ignore the code entirely.
+        if (urlParams.get("access_token"))
+            return null;
+        // Strip the one-time params right away so the code doesn't linger in the
+        // URL/history or get re-submitted on reload. `is_new_user` stays in the
+        // URL exactly as the legacy flow leaves it.
+        urlParams.delete("session_code");
+        urlParams.delete("session_exchange_path");
+        const newUrl = `${window.location.pathname}${urlParams.toString() ? `?${urlParams.toString()}` : ""}${window.location.hash}`;
+        window.history.replaceState({}, typeof document !== "undefined" ? document.title : "", newUrl);
+    }
+    catch (e) {
+        console.error("Error reading session handoff params from URL:", e);
+        return null;
+    }
+    return exchangeSessionHandoffCode(code, exchangePath);
+}
+async function exchangeSessionHandoffCode(code, exchangePath) {
+    // The verifier is one-shot: take it out of storage no matter how the
+    // exchange ends (a failed PKCE check doesn't burn the code server-side,
+    // but a stale verifier can never match a future login's challenge).
+    let verifier = null;
+    try {
+        verifier = window.sessionStorage.getItem(PKCE_VERIFIER_STORAGE_KEY);
+        if (verifier !== null) {
+            window.sessionStorage.removeItem(PKCE_VERIFIER_STORAGE_KEY);
+        }
+    }
+    catch (_a) {
+        verifier = null;
+    }
+    // SECURITY: the exchange path arrives via the URL, so treat it as tainted.
+    // POSTing the code + verifier to an attacker-chosen origin would hand over
+    // both halves of the PKCE proof — enforce same-origin, path-only semantics.
+    let exchangeUrl;
+    try {
+        exchangeUrl = new URL(exchangePath, window.location.origin);
+    }
+    catch (_b) {
+        console.error("Invalid session_exchange_path; skipping token exchange.");
+        return null;
+    }
+    if (exchangeUrl.origin !== window.location.origin) {
+        console.error("Cross-origin session_exchange_path rejected; skipping token exchange.");
+        return null;
+    }
+    if (typeof fetch !== "function")
+        return null;
+    try {
+        const response = await fetch(exchangeUrl.toString(), {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                code,
+                ...(verifier ? { code_verifier: verifier } : {}),
+            }),
+        });
+        if (!response.ok) {
+            if (!verifier) {
+                // Named failure mode (base44-dev/apper#17216): the login completed in
+                // a different tab/window than it started in, so the per-tab PKCE
+                // verifier is gone and the server fails closed. Logging in again from
+                // this tab works.
+                console.warn("Base44 SDK: SSO login could not be completed because it finished " +
+                    "in a different browser tab than it started in (missing PKCE " +
+                    "verifier). Please log in again.");
+            }
+            else {
+                console.error(`Base44 SDK: SSO session-code exchange failed (HTTP ${response.status}).`);
+            }
+            return null;
+        }
+        const data = await response.json();
+        const accessToken = data === null || data === void 0 ? void 0 : data.access_token;
+        return typeof accessToken === "string" && accessToken ? accessToken : null;
+    }
+    catch (e) {
+        console.error("Base44 SDK: SSO session-code exchange failed:", e);
+        return null;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@base44-preview/sdk",
-  "version": "0.8.42-pr.256.fb681e4",
+  "version": "0.8.43-pr.244.b43fd83",
   "description": "JavaScript SDK for Base44 API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",