@base44-preview/sdk 0.8.52-pr.298.d08e0ba → 0.8.52-pr.299.9f7108e

package/README.md

@@ -151,5 +151,3 @@ npm run create-docs
 cd docs
 mintlify dev
 ```
-
-See [experimental app-user MFA](MFA.md) for challenge handling and managed continuation.

package/dist/client.js

@@ -11,6 +11,7 @@ import { createAgentsModule } from "./modules/agents.js";
 import { createAiGatewayModule } from "./modules/ai-gateway.js";
 import { createAppLogsModule } from "./modules/app-logs.js";
 import { createAppModule } from "./modules/app.js";
+import { createMcpModule } from "./modules/mcp.js";
 import { createUsersModule } from "./modules/users.js";
 import { RoomsSocket } from "./utils/socket-utils.js";
 import { createAnalyticsModule } from "./modules/analytics.js";
@@ -201,6 +202,7 @@ export function createClient(config) {
         }),
         appLogs: createAppLogsModule(axiosClient, appId),
         app: createAppModule(axiosClient, appId),
+        mcp: createMcpModule(axiosClient, appId),
         users: createUsersModule(axiosClient, appId),
         analytics: createAnalyticsModule({
             axiosClient,

package/dist/client.types.d.ts

@@ -8,6 +8,7 @@ import type { AgentsModule } from "./modules/agents.types.js";
 import type { AiGatewayModule } from "./modules/ai-gateway.types.js";
 import type { AppLogsModule } from "./modules/app-logs.types.js";
 import type { AppModule } from "./modules/app.types.js";
+import type { McpModule } from "./modules/mcp.types.js";
 import type { AnalyticsModule } from "./modules/analytics.types.js";
 import type { ActorsModule } from "./modules/actors.types.js";
 import type { FetchWithAuthInit } from "./utils/fetch-with-auth.js";
@@ -138,6 +139,8 @@ export interface Base44Client {
     functions: FunctionsModule;
     /** {@link IntegrationsModule | Integrations module} for calling pre-built integration endpoints. */
     integrations: IntegrationsModule;
+    /** {@link McpModule | MCP module} for the app's MCP consent page. */
+    mcp: McpModule;
     /** Cleanup function to disconnect WebSocket connections. Call when you're done with the client. */
     cleanup: () => void;
     /**

package/dist/index.d.ts

@@ -12,10 +12,10 @@ export type { AgentsModule, AgentName, AgentNameRegistry, AgentConversation, Age
 export type { AiGatewayModule, AiGatewayConnection, AiGatewayConnectionOptions, } from "./modules/ai-gateway.types.js";
 export type { AppLogsModule } from "./modules/app-logs.types.js";
 export type { AppModule, AppPublicSettings, AppPublicSettingsResponse, } from "./modules/app.types.js";
+export type { McpModule, McpConsentInfo, McpConsentTool, McpConsentAction, McpAuthorizeGrantResponse, } from "./modules/mcp.types.js";
 export type { ActorsModule, ActorClient, ActorRef, Connection, ActorSubscription, ActorConnectOptions, ActorNameRegistry, ActorRegistry, } from "./modules/actors.types.js";
 export type { SsoModule, SsoAccessTokenResponse } from "./modules/sso.types.js";
 export { Actor, type Conn } from "./actor.js";
 export type { ConnectorsModule, UserConnectorsModule, ConnectorApiRequest, ConnectorApiResponse, ConnectorApiResponsePhase, } from "./modules/connectors.types.js";
 export type { CustomIntegrationsModule, CustomIntegrationCallParams, CustomIntegrationCallResponse, } from "./modules/custom-integrations.types.js";
 export type { GetAccessTokenOptions, SaveAccessTokenOptions, RemoveAccessTokenOptions, GetLoginUrlOptions, } from "./utils/auth-utils.types.js";
-export type { MfaChallenge, MfaModule, MfaProof, LoginResult, MfaEnrollmentResult } from "./modules/mfa.js";

package/dist/modules/auth.js

@@ -1,4 +1,3 @@
-import { createMfaModule, prepareMfaPkce } from "./mfa.js";
 import { resetAnalyticsSessionContext } from "./analytics.js";
 function isInsideIframe() {
     if (typeof window === "undefined")
@@ -20,9 +19,9 @@ function loginViaPopup(url, redirectUrl, expectedOrigin) {
     const height = 600;
     const left = Math.round(window.screenX + (window.outerWidth - width) / 2);
     const top = Math.round(window.screenY + (window.outerHeight - height) / 2);
-    const popup = window.open("about:blank", "base44_auth", `width=${width},height=${height},left=${left},top=${top},resizable=yes,scrollbars=yes`);
+    const popup = window.open(url, "base44_auth", `width=${width},height=${height},left=${left},top=${top},resizable=yes,scrollbars=yes`);
     if (!popup) {
-        return Promise.resolve();
+        return;
     }
     const cleanup = () => {
         window.removeEventListener("message", onMessage);
@@ -53,7 +52,6 @@ function loginViaPopup(url, redirectUrl, expectedOrigin) {
             cleanup();
     }, 500);
     window.addEventListener("message", onMessage);
-    return url.then(value => { popup.location.href = value; }, error => { cleanup(); throw error; });
 }
 /**
  * Creates the auth module for the Base44 SDK.
@@ -84,8 +82,7 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
     // to the identity transitions below (`setToken`, `logout`) instead of to the
     // header a caller may have set on the instance directly.
     let hasAccessToken = Boolean(options.token);
-    const module = {
-        mfa: createMfaModule(axios, appId, token => module.setToken(token)),
+    return {
         hasToken() {
             return hasAccessToken;
         },
@@ -122,10 +119,9 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
             window.location.href = loginUrl;
         },
         // Redirects the user to a provider's login page
-        async loginWithProvider(provider, fromUrl = "/") {
+        loginWithProvider(provider, fromUrl = "/") {
             // Build the full redirect URL
             const redirectUrl = new URL(fromUrl, window.location.origin).toString();
-            const mfaPkce = provider === "sso" ? Promise.resolve("") : prepareMfaPkce(appId).then(value => `&app_mfa_code_challenge=${value}`);
             const queryParams = `app_id=${appId}&from_url=${encodeURIComponent(redirectUrl)}`;
             // SSO uses a different URL structure with appId in the path
             let authPath;
@@ -141,11 +137,11 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
             // When running inside an iframe, use a popup to avoid OAuth providers
             // blocking iframe navigation.
             if (isInsideIframe()) {
-                const popupLoginUrl = mfaPkce.then(pkce => `${loginUrl}${pkce}&popup_origin=${encodeURIComponent(window.location.origin)}`);
+                const popupLoginUrl = `${loginUrl}&popup_origin=${encodeURIComponent(window.location.origin)}`;
                 return loginViaPopup(popupLoginUrl, redirectUrl, window.location.origin);
             }
             // Default: full-page redirect
-            window.location.href = loginUrl + await mfaPkce;
+            window.location.href = loginUrl;
         },
         // Logout the current user
         logout(redirectUrl) {
@@ -211,8 +207,6 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
                     password,
                     ...(turnstileToken && { turnstile_token: turnstileToken }),
                 });
-                if (response.mfa_required)
-                    return response;
                 const { access_token, user } = response;
                 if (access_token) {
                     this.setToken(access_token);
@@ -284,5 +278,4 @@ export function createAuthModule(axios, functionsAxiosClient, appId, options) {
             });
         },
     };
-    return module;
 }

package/dist/modules/auth.types.d.ts

@@ -1,4 +1,3 @@
-import type { LoginResult, MfaModule } from "./mfa.js";
 /**
  * An authenticated user.
  */
@@ -38,7 +37,6 @@ export interface User {
  * Response from login endpoints containing user information and access token.
  */
 export interface LoginResponse {
-    mfa_required?: false;
     /** JWT access token for authentication. */
     access_token: string;
     /** User information. */
@@ -119,8 +117,6 @@ export interface AuthModuleOptions {
  * The auth module is only available in user authentication mode (`base44.auth`).
  */
 export interface AuthModule {
-    /** Multi-factor enrollment and login for this app. */
-    mfa: MfaModule;
     /**
      * Gets the current authenticated user's information.
      *
@@ -223,7 +219,7 @@ export interface AuthModule {
      * ```
      *
      */
-    loginWithProvider(provider: string, fromUrl?: string): Promise<void>;
+    loginWithProvider(provider: string, fromUrl?: string): void;
     /**
      * Logs out the current user.
      *
@@ -306,7 +302,7 @@ export interface AuthModule {
      * );
      * ```
      */
-    loginViaEmailPassword(email: string, password: string, turnstileToken?: string): Promise<LoginResult>;
+    loginViaEmailPassword(email: string, password: string, turnstileToken?: string): Promise<LoginResponse>;
     /**
      * Checks if the current user is authenticated.
      *
@@ -431,7 +427,7 @@ export interface AuthModule {
      * );
      * ```
      */
-    verifyOtp(params: VerifyOtpParams): Promise<LoginResult>;
+    verifyOtp(params: VerifyOtpParams): Promise<any>;
     /**
      * Resends an OTP code to the user's email address.
      *

package/dist/modules/mcp.d.ts

@@ -0,0 +1,11 @@
+import { AxiosInstance } from "axios";
+import { McpModule } from "./mcp.types";
+/**
+ * Creates the MCP module for the Base44 SDK.
+ *
+ * @param axios - Axios instance
+ * @param appId - Application ID
+ * @returns MCP module for the app's MCP consent page
+ * @internal
+ */
+export declare function createMcpModule(axios: AxiosInstance, appId: string): McpModule;

package/dist/modules/mcp.js

@@ -0,0 +1,20 @@
+/**
+ * Creates the MCP module for the Base44 SDK.
+ *
+ * @param axios - Axios instance
+ * @param appId - Application ID
+ * @returns MCP module for the app's MCP consent page
+ * @internal
+ */
+export function createMcpModule(axios, appId) {
+    return {
+        async getConsentInfo(ctx) {
+            return axios.get(`/apps/${appId}/mcp/consent-info`, {
+                params: { handle: ctx },
+            });
+        },
+        async authorizeGrant(ctx, action) {
+            return axios.post(`/apps/${appId}/mcp/authorize-grant`, { ctx, action });
+        },
+    };
+}

package/dist/modules/mcp.types.d.ts

@@ -0,0 +1,101 @@
+/**
+ * One tool shown on the MCP consent page.
+ */
+export interface McpConsentTool {
+    /** The tool's MCP name. */
+    name: string;
+    /** Human-readable title, when the tool has one. */
+    title?: string | null;
+    /** What the tool does. */
+    description?: string | null;
+    /** Whether the tool only reads data. */
+    read_only_hint?: boolean | null;
+}
+/**
+ * Display details for a pending MCP authorization request, as returned by
+ * {@link McpModule.getConsentInfo}.
+ */
+export interface McpConsentInfo {
+    /** The app's display name. */
+    app_name: string;
+    /** The name of the AI client asking for access. */
+    client_name: string;
+    /**
+     * Whether the request came from a signed-in user of this app. When `false`,
+     * send the user to `login_path` before showing approve and deny.
+     */
+    authenticated: boolean;
+    /** The tools the client will be able to use. Empty unless `authenticated` is `true`. */
+    tools: McpConsentTool[];
+    /** The app's login route for a signed-out user, such as `/login`. */
+    login_path: string;
+}
+/**
+ * The user's decision on an MCP authorization request.
+ */
+export type McpConsentAction = "approve" | "deny";
+/**
+ * Result of {@link McpModule.authorizeGrant}.
+ */
+export interface McpAuthorizeGrantResponse {
+    /**
+     * Where to send the browser next: the AI client's redirect URI, carrying the
+     * authorization code on approve or an `access_denied` error on deny. It may
+     * use a custom scheme such as `cursor://`.
+     */
+    redirect_url: string;
+}
+/**
+ * MCP module for the app's MCP consent page.
+ *
+ * When an AI client connects to the app's MCP server, Base44 sends the user to
+ * the app's consent page with an opaque `ctx` query parameter. The page reads
+ * the request's details with {@link McpModule.getConsentInfo | getConsentInfo()}
+ * and records the user's decision with {@link McpModule.authorizeGrant | authorizeGrant()}.
+ *
+ * ## Authentication Modes
+ *
+ * This module is available to use with a client in user authentication mode. The
+ * signed-in user's token is sent when the client has one; otherwise the app's
+ * session cookie identifies the user.
+ */
+export interface McpModule {
+    /**
+     * Gets the display details for a pending MCP authorization request.
+     *
+     * Rejects with a {@linkcode Base44Error} with `status` `404` when the `ctx`
+     * handle is unknown or expired.
+     *
+     * @param ctx - The `ctx` query parameter the consent page was opened with.
+     * @returns Promise resolving to the request's display details.
+     *
+     * @example
+     * ```typescript
+     * const ctx = new URLSearchParams(window.location.search).get('ctx');
+     * const info = await base44.mcp.getConsentInfo(ctx);
+     * if (!info.authenticated) {
+     *   window.location.href = info.login_path;
+     * }
+     * ```
+     */
+    getConsentInfo(ctx: string): Promise<McpConsentInfo>;
+    /**
+     * Records the signed-in user's decision on an MCP authorization request.
+     *
+     * The `ctx` handle is single-use. Rejects with a {@linkcode Base44Error}:
+     * `status` `401` when the user must sign in again (the handle is still valid),
+     * and `400`, `403`, `404` or `409` when the request can no longer be
+     * completed and the user must reconnect from the AI client.
+     *
+     * @param ctx - The `ctx` query parameter the consent page was opened with.
+     * @param action - `"approve"` to grant access, `"deny"` to refuse it.
+     * @returns Promise resolving to the URL to send the browser to.
+     *
+     * @example
+     * ```typescript
+     * const { redirect_url } = await base44.mcp.authorizeGrant(ctx, 'approve');
+     * window.location.href = redirect_url;
+     * ```
+     */
+    authorizeGrant(ctx: string, action: McpConsentAction): Promise<McpAuthorizeGrantResponse>;
+}

package/dist/modules/mcp.types.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@base44-preview/sdk",
-  "version": "0.8.52-pr.298.d08e0ba",
+  "version": "0.8.52-pr.299.9f7108e",
   "description": "JavaScript SDK for Base44 API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/dist/modules/mfa.d.ts

@@ -1,52 +0,0 @@
-import type { AxiosInstance } from 'axios';
-import type { LoginResponse } from './auth.types.js';
-/** A restricted, short-lived login outcome. It is never an access token. */
-export interface MfaChallenge {
-    mfa_required: true;
-    next_step: 'enroll' | 'verify';
-    mfa_methods: ('totp' | 'sms')[];
-    mfa_session_token: string;
-    expires_in_seconds: number;
-    phone_hint?: string;
-    access_token?: never;
-    user?: never;
-}
-export type LoginResult = LoginResponse | MfaChallenge;
-export interface MfaEnrollmentResult extends LoginResponse {
-    backup_codes?: string[];
-}
-export interface MfaProof {
-    code: string;
-    method: 'totp' | 'sms';
-    remember_device?: boolean;
-}
-/** App-scoped MFA. Pass the challenge credential explicitly; do not set it as the SDK token. */
-export interface MfaModule {
-    getStatus(): Promise<{
-        mfa_enabled: boolean;
-        methods: ('totp' | 'sms')[];
-        backup_codes_remaining: number;
-        policy: 'off' | 'required';
-    }>;
-    /** Requires an app admin session; resets a user in this app only. */
-    resetForUser(appUserId: string): Promise<{
-        success: true;
-    }>;
-    /** Open managed settings with fresh primary authentication and factor verification. */
-    openSecurity(returnTo?: string): void;
-    setupTotp(challenge: MfaChallenge): Promise<{
-        secret: string;
-        secret_formatted: string;
-        qr_code: string;
-    }>;
-    sendSms(challenge: MfaChallenge, phoneNumber: string): Promise<unknown>;
-    enrollTotp(challenge: MfaChallenge, code: string, rememberDevice?: boolean): Promise<MfaEnrollmentResult>;
-    enrollSms(challenge: MfaChallenge, code: string, rememberDevice?: boolean): Promise<MfaEnrollmentResult>;
-    verify(challenge: MfaChallenge, proof: MfaProof): Promise<LoginResponse>;
-    verifyRecoveryCode(challenge: MfaChallenge, code: string, rememberDevice?: boolean): Promise<LoginResponse>;
-    resendSms(challenge: MfaChallenge): Promise<unknown>;
-    /** Open Base44's managed MFA flow on this app's origin. */
-    continueLogin(challenge: MfaChallenge, returnTo?: string): Promise<void>;
-}
-export declare function prepareMfaPkce(appId: string): Promise<string>;
-export declare function createMfaModule(axios: AxiosInstance, appId: string, setToken: (token: string) => void): MfaModule;

package/dist/modules/mfa.js

@@ -1,43 +0,0 @@
-export async function prepareMfaPkce(appId) {
-    const encode = (value) => btoa(String.fromCharCode(...value)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
-    const verifier = encode(crypto.getRandomValues(new Uint8Array(32)));
-    sessionStorage.setItem(`app-mfa-pkce:${appId}`, verifier);
-    return encode(new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier))));
-}
-export function createMfaModule(axios, appId, setToken) {
-    const post = async (challenge, path, payload = {}) => {
-        const response = await axios.post(`/apps/${appId}/auth/mfa${path}`, payload, {
-            headers: { Authorization: `Bearer ${challenge.mfa_session_token}` }, withCredentials: true,
-        });
-        const token = response.access_token;
-        if (token)
-            setToken(token);
-        return response;
-    };
-    return {
-        getStatus: () => axios.get(`/apps/${appId}/auth/mfa/status`),
-        resetForUser: appUserId => axios.post(`/apps/${appId}/auth/mfa/reset`, { app_user_id: appUserId }),
-        openSecurity(returnTo = '/') {
-            const target = new URL(returnTo, window.location.origin);
-            if (target.origin !== window.location.origin)
-                throw new Error('MFA must return to this app.');
-            window.location.href = `/auth/mfa?${new URLSearchParams({ security: '1', from_url: target.pathname + target.search + target.hash })}`;
-        },
-        setupTotp: challenge => post(challenge, '/totp/setup'),
-        sendSms: (challenge, phoneNumber) => post(challenge, '/sms/send-code', { phone_number: phoneNumber }),
-        enrollTotp: (challenge, code, rememberDevice = false) => post(challenge, '/totp/verify', { code, remember_device: rememberDevice }),
-        enrollSms: (challenge, code, rememberDevice = false) => post(challenge, '/sms/verify', { code, remember_device: rememberDevice }),
-        verify: (challenge, proof) => post(challenge, '/verify', proof),
-        verifyRecoveryCode: (challenge, code, rememberDevice = false) => post(challenge, '/verify-backup', { backup_code: code, remember_device: rememberDevice }),
-        resendSms: challenge => post(challenge, '/resend'),
-        async continueLogin(challenge, returnTo = '/') {
-            const target = new URL(returnTo, window.location.origin);
-            if (target.origin !== window.location.origin)
-                throw new Error('MFA must return to this app.');
-            const codeChallenge = await prepareMfaPkce(appId);
-            const handoff = await post(challenge, '/handoff', { code_challenge: codeChallenge });
-            const query = new URLSearchParams({ app_id: appId, mfa_code: handoff.code, from_url: target.pathname + target.search + target.hash });
-            window.location.href = `/auth/mfa?${query}`;
-        },
-    };
-}