@fusebase/fusebase-gate-sdk 2.11.6-sdk.0 → 2.11.6

package/dist/apis/AppMagicLinksApi.d.ts

@@ -11,7 +11,7 @@ export declare class AppMagicLinksApi {
     constructor(client: Client);
     /**
      * Activate an app magic link
-     * Unauthenticated activation: exchange a magic-link globalId for a session token (used to set the eversessionid cookie on the app subdomain), a Gate feature token, and a Dashboard feature token, all scoped to the magic link's app and target user. Re-evaluates accessPrincipals at activation time so a link issued before access was revoked can no longer be redeemed. Within the 24h TTL the link can be activated more than once.
+     * Unauthenticated activation: exchange a magic-link globalId for a session token (a raw FuseBase session id: forward it to Gate as `EverHelper-Session-ID` when a legacy call needs it, never set it as a cookie on the app host), a Gate feature token, and a Dashboard feature token, all scoped to the magic link's app and target user. Re-evaluates accessPrincipals at activation time so a link issued before access was revoked can no longer be redeemed. Within the 24h TTL the link can be activated more than once.
      */
     activateAppMagicLink(params: {
         path: {

package/dist/apis/AppMagicLinksApi.js

@@ -13,7 +13,7 @@ class AppMagicLinksApi {
     }
     /**
      * Activate an app magic link
-     * Unauthenticated activation: exchange a magic-link globalId for a session token (used to set the eversessionid cookie on the app subdomain), a Gate feature token, and a Dashboard feature token, all scoped to the magic link's app and target user. Re-evaluates accessPrincipals at activation time so a link issued before access was revoked can no longer be redeemed. Within the 24h TTL the link can be activated more than once.
+     * Unauthenticated activation: exchange a magic-link globalId for a session token (a raw FuseBase session id: forward it to Gate as `EverHelper-Session-ID` when a legacy call needs it, never set it as a cookie on the app host), a Gate feature token, and a Dashboard feature token, all scoped to the magic link's app and target user. Re-evaluates accessPrincipals at activation time so a link issued before access was revoked can no longer be redeemed. Within the 24h TTL the link can be activated more than once.
      */
     async activateAppMagicLink(params) {
         return this.client.request({

package/dist/apis/FusebaseAuthApi.d.ts

@@ -21,7 +21,7 @@ export declare class FusebaseAuthApi {
     }): Promise<FusebaseAuthPasswordRestoreKeyResponseContract>;
     /**
      * Complete Fusebase auth challenge
-     * Visitor-safe challenge completion endpoint for CAPTCHA, OTP, mail OTP, and MFA flows returned by register/login.
+     * Visitor-safe challenge completion endpoint for CAPTCHA, OTP, mail OTP, and MFA flows returned by register/login. An authenticated result carries `appAuth`: spend `appAuth.authPath` on the app's own origin, with a same-origin `fetch` sending `Accept: application/json` or a plain navigation, and the platform mints the app runtime token from it.
      */
     completeFusebaseAuthChallenge(params: {
         headers?: Record<string, string>;
@@ -29,7 +29,7 @@ export declare class FusebaseAuthApi {
     }): Promise<FusebaseAuthChallengeResponseContract>;
     /**
      * Login a Fusebase user
-     * Visitor-safe email/password login proxy for AI App auth. Forwards to auth-form `/auth/api/auth` server-side and returns sessionId for the app backend to set as its own cookie. Never provisions org membership.
+     * Visitor-safe email/password login proxy for AI App auth. Forwards to auth-form `/auth/api/auth` server-side. An authenticated result carries `appAuth`: spend `appAuth.authPath` on the app's own origin, with a same-origin `fetch` sending `Accept: application/json` or a plain navigation, and the platform mints the app runtime token from it. Never provisions org membership.
      */
     loginFusebaseUser(params: {
         headers?: Record<string, string>;
@@ -44,7 +44,7 @@ export declare class FusebaseAuthApi {
     }): Promise<FusebaseAuthLogoutResponseContract>;
     /**
      * Register a Fusebase user and add org membership
-     * Protected AI App onboarding flow. Creates a Fusebase account through auth-form, then adds the newly created user to the path org with the requested role. Requires org.members.write and org access. This endpoint is for registration only; do not call it on login because that can overwrite or duplicate existing membership intent. For trusted AI App signup flows, send `autoConfirmEmail=true` to create the account with the email already confirmed and skip the auth-form confirmation message.
+     * Protected AI App onboarding flow. Creates a Fusebase account through auth-form, then adds the newly created user to the path org with the requested role. An authenticated result carries `appAuth`: spend `appAuth.authPath` on the app's own origin, with a same-origin `fetch` sending `Accept: application/json` or a plain navigation, and the platform mints the app runtime token from it. Requires org.members.write and org access. This endpoint is for registration only; do not call it on login because that can overwrite or duplicate existing membership intent. For trusted AI App signup flows, send `autoConfirmEmail=true` to create the account with the email already confirmed and skip the auth-form confirmation message.
      */
     registerFusebaseOrgMember(params: {
         path: {
@@ -55,7 +55,7 @@ export declare class FusebaseAuthApi {
     }): Promise<FusebaseAuthRegisterMemberResponseContract>;
     /**
      * Register a Fusebase user
-     * Visitor-safe email/password Fusebase registration proxy for AI App auth. Forwards to auth-form `/auth/api/register` server-side and returns the Fusebase sessionId for the app backend to set as its own cookie. Does not add org membership. For trusted AI App signup flows, send `autoConfirmEmail=true` to create the account with the email already confirmed and skip the auth-form confirmation message.
+     * Visitor-safe email/password Fusebase registration proxy for AI App auth. Forwards to auth-form `/auth/api/register` server-side. An authenticated result carries `appAuth`: spend `appAuth.authPath` on the app's own origin, with a same-origin `fetch` sending `Accept: application/json` or a plain navigation, and the platform mints the app runtime token from it. Does not add org membership. For trusted AI App signup flows, send `autoConfirmEmail=true` to create the account with the email already confirmed and skip the auth-form confirmation message.
      */
     registerFusebaseUser(params: {
         headers?: Record<string, string>;

package/dist/apis/FusebaseAuthApi.js

@@ -27,7 +27,7 @@ class FusebaseAuthApi {
     }
     /**
      * Complete Fusebase auth challenge
-     * Visitor-safe challenge completion endpoint for CAPTCHA, OTP, mail OTP, and MFA flows returned by register/login.
+     * Visitor-safe challenge completion endpoint for CAPTCHA, OTP, mail OTP, and MFA flows returned by register/login. An authenticated result carries `appAuth`: spend `appAuth.authPath` on the app's own origin, with a same-origin `fetch` sending `Accept: application/json` or a plain navigation, and the platform mints the app runtime token from it.
      */
     async completeFusebaseAuthChallenge(params) {
         return this.client.request({
@@ -41,7 +41,7 @@ class FusebaseAuthApi {
     }
     /**
      * Login a Fusebase user
-     * Visitor-safe email/password login proxy for AI App auth. Forwards to auth-form `/auth/api/auth` server-side and returns sessionId for the app backend to set as its own cookie. Never provisions org membership.
+     * Visitor-safe email/password login proxy for AI App auth. Forwards to auth-form `/auth/api/auth` server-side. An authenticated result carries `appAuth`: spend `appAuth.authPath` on the app's own origin, with a same-origin `fetch` sending `Accept: application/json` or a plain navigation, and the platform mints the app runtime token from it. Never provisions org membership.
      */
     async loginFusebaseUser(params) {
         return this.client.request({
@@ -68,7 +68,7 @@ class FusebaseAuthApi {
     }
     /**
      * Register a Fusebase user and add org membership
-     * Protected AI App onboarding flow. Creates a Fusebase account through auth-form, then adds the newly created user to the path org with the requested role. Requires org.members.write and org access. This endpoint is for registration only; do not call it on login because that can overwrite or duplicate existing membership intent. For trusted AI App signup flows, send `autoConfirmEmail=true` to create the account with the email already confirmed and skip the auth-form confirmation message.
+     * Protected AI App onboarding flow. Creates a Fusebase account through auth-form, then adds the newly created user to the path org with the requested role. An authenticated result carries `appAuth`: spend `appAuth.authPath` on the app's own origin, with a same-origin `fetch` sending `Accept: application/json` or a plain navigation, and the platform mints the app runtime token from it. Requires org.members.write and org access. This endpoint is for registration only; do not call it on login because that can overwrite or duplicate existing membership intent. For trusted AI App signup flows, send `autoConfirmEmail=true` to create the account with the email already confirmed and skip the auth-form confirmation message.
      */
     async registerFusebaseOrgMember(params) {
         return this.client.request({
@@ -83,7 +83,7 @@ class FusebaseAuthApi {
     }
     /**
      * Register a Fusebase user
-     * Visitor-safe email/password Fusebase registration proxy for AI App auth. Forwards to auth-form `/auth/api/register` server-side and returns the Fusebase sessionId for the app backend to set as its own cookie. Does not add org membership. For trusted AI App signup flows, send `autoConfirmEmail=true` to create the account with the email already confirmed and skip the auth-form confirmation message.
+     * Visitor-safe email/password Fusebase registration proxy for AI App auth. Forwards to auth-form `/auth/api/register` server-side. An authenticated result carries `appAuth`: spend `appAuth.authPath` on the app's own origin, with a same-origin `fetch` sending `Accept: application/json` or a plain navigation, and the platform mints the app runtime token from it. Does not add org membership. For trusted AI App signup flows, send `autoConfirmEmail=true` to create the account with the email already confirmed and skip the auth-form confirmation message.
      */
     async registerFusebaseUser(params) {
         return this.client.request({

package/dist/types/app-magic-link/app-magic-link.d.ts

@@ -137,7 +137,10 @@ export interface ActivateAppMagicLinkResponseContract {
      */
     id: string;
     /**
-     * Session id usable as the `eversessionid` cookie value.
+     * Raw FuseBase session id. Do not set it as a cookie on the app host: the
+     * app runtime token (`fbsfeaturetoken`) is the only credential an app host
+     * carries. Forward it to Gate as `EverHelper-Session-ID` when a legacy call
+     * needs it.
      */
     sessionToken: string;
     /**

package/dist/types/fusebase-auth/fusebase-auth.d.ts

@@ -1,7 +1,40 @@
+/**
+ * Deprecated. A raw FuseBase session id, which an app has no business holding:
+ * it is the FuseBase login itself, not an app-scoped credential. Gate omits it
+ * when it runs with the `app_login_no_session_id` feature flag (NIM-43689).
+ * Use `appAuth` instead.
+ *
+ * @deprecated Use `appAuth`.
+ */
 export interface FusebaseAuthSessionContract {
     sessionId: string;
     userId: number;
 }
+/**
+ * Login handoff for an authenticated result (NIM-43689). Spend `authPath` on
+ * the app's own origin — a same-origin `fetch` with `Accept: application/json`
+ * from the running page, or a plain navigation — and the platform resolves
+ * `exchangeToken` there into the app runtime token (`fbsfeaturetoken`).
+ *
+ * The token is not bound to the app it was minted for: the platform takes the
+ * app identity from the request host, so whoever holds it can mint a runtime
+ * token for that user on any app host that user can open.
+ */
+export interface FusebaseAuthAppAuthContract {
+    /**
+     * Session-exchange token. Spend it on `authPath`. It stays valid for the
+     * whole `expiresInSeconds` window and is not invalidated by being spent, so
+     * treat it as a credential: keep it out of logs and out of shared links.
+     */
+    exchangeToken: string;
+    /** Lifetime of `exchangeToken` in seconds, counted from this response. */
+    expiresInSeconds: number;
+    /**
+     * Relative URL on the app's own host, built from the `redirectPath` the app
+     * sent. Pass it through; do not assemble it yourself.
+     */
+    authPath: string;
+}
 export interface FusebaseAuthChallengeContract {
     type: string;
     state: string;
@@ -31,7 +64,17 @@ export interface FusebaseAuthRegisterRequestContract {
 }
 export interface FusebaseAuthRegisterResponseContract {
     status: "authenticated" | "challenge_required";
+    /**
+     * Deprecated. A raw FuseBase session id, which an app has no business
+     * holding: it is the FuseBase login itself, not an app-scoped credential.
+     * Gate stops returning it when it runs with the `app_login_no_session_id`
+     * feature flag (NIM-43689). Use `appAuth` instead.
+     *
+     * @deprecated Use `appAuth`.
+     */
     session?: FusebaseAuthSessionContract;
+    /** Present on an authenticated result, unless the mint failed. */
+    appAuth?: FusebaseAuthAppAuthContract;
     challenge?: FusebaseAuthChallengeContract;
     redirectPath: string;
 }
@@ -83,6 +126,28 @@ export interface FusebaseAuthUnauthorizedErrorBodyContract {
         errorCode: string;
     };
 }
+/**
+ * Body returned with HTTP 422 when gate runs with the `app_login_no_session_id`
+ * feature flag and the `appAuth` mint failed. `data.errorCode` is
+ * `app_auth_exchange_unavailable`.
+ *
+ * The credentials were accepted — only the handoff could not be issued. The
+ * status is 4xx and not 5xx on purpose: the generated SDK retries every 5xx
+ * three times with no method exclusion, and the register ops are not
+ * idempotent, so a retried mint failure would surface as 409
+ * `fusebase_account_already_exists` and this error would never reach the app.
+ * Start a fresh sign-in instead of replaying the call. Never returned without
+ * the flag: there `session` is still a working fallback and the response stays
+ * a 200.
+ */
+export interface FusebaseAuthAppAuthUnavailableErrorBodyContract {
+    success: false;
+    message: string;
+    data: {
+        code: string;
+        errorCode: string;
+    };
+}
 export interface FusebaseAuthLoginRequestContract {
     /**
      * User email. Forwarded to auth-form as `login`.
@@ -95,7 +160,17 @@ export interface FusebaseAuthLoginRequestContract {
 }
 export interface FusebaseAuthLoginResponseContract {
     status: "authenticated" | "challenge_required";
+    /**
+     * Deprecated. A raw FuseBase session id, which an app has no business
+     * holding: it is the FuseBase login itself, not an app-scoped credential.
+     * Gate stops returning it when it runs with the `app_login_no_session_id`
+     * feature flag (NIM-43689). Use `appAuth` instead.
+     *
+     * @deprecated Use `appAuth`.
+     */
     session?: FusebaseAuthSessionContract;
+    /** Present on an authenticated result, unless the mint failed. */
+    appAuth?: FusebaseAuthAppAuthContract;
     challenge?: FusebaseAuthChallengeContract;
     redirectPath: string;
 }
@@ -106,7 +181,17 @@ export interface FusebaseAuthChallengeRequestContract {
 }
 export interface FusebaseAuthChallengeResponseContract {
     status: "authenticated" | "challenge_required";
+    /**
+     * Deprecated. A raw FuseBase session id, which an app has no business
+     * holding: it is the FuseBase login itself, not an app-scoped credential.
+     * Gate stops returning it when it runs with the `app_login_no_session_id`
+     * feature flag (NIM-43689). Use `appAuth` instead.
+     *
+     * @deprecated Use `appAuth`.
+     */
     session?: FusebaseAuthSessionContract;
+    /** Present on an authenticated result, unless the mint failed. */
+    appAuth?: FusebaseAuthAppAuthContract;
     challenge?: FusebaseAuthChallengeContract;
     redirectPath: string;
 }

package/dist/types/index.d.ts

@@ -12,7 +12,7 @@ export type { ActivateAppMagicLinkResponseContract, AppMagicLinkSummaryContract,
 export * from "./billing/billing";
 export type { OrgEmailSendRequestContract, OrgEmailSendResponseContract } from "./email/email";
 export * from "./file/file";
-export type { FusebaseAuthChallengeContract, FusebaseAuthChallengeRequestContract, FusebaseAuthChallengeResponseContract, FusebaseAuthConflictErrorBodyContract, FusebaseAuthLoginRequestContract, FusebaseAuthLoginResponseContract, FusebaseAuthLogoutResponseContract, FusebaseAuthPasswordResetRequestContract, FusebaseAuthPasswordResetResponseContract, FusebaseAuthPasswordRestoreKeyResponseContract, FusebaseAuthPasswordRestoreRequestContract, FusebaseAuthPasswordRestoreResponseContract, FusebaseAuthRegisterMemberRequestContract, FusebaseAuthRegisterMemberResponseContract, FusebaseAuthRegisterRequestContract, FusebaseAuthRegisterResponseContract, FusebaseAuthRestoreKeyRequestContract, FusebaseAuthRestoreKeyResponseContract, FusebaseAuthSessionContract, FusebaseAuthSetInitialPasswordRequestContract, FusebaseAuthSetInitialPasswordResponseContract, FusebaseAuthUnauthorizedErrorBodyContract } from "./fusebase-auth/fusebase-auth";
+export type { FusebaseAuthAppAuthContract, FusebaseAuthAppAuthUnavailableErrorBodyContract, FusebaseAuthChallengeContract, FusebaseAuthChallengeRequestContract, FusebaseAuthChallengeResponseContract, FusebaseAuthConflictErrorBodyContract, FusebaseAuthLoginRequestContract, FusebaseAuthLoginResponseContract, FusebaseAuthLogoutResponseContract, FusebaseAuthPasswordResetRequestContract, FusebaseAuthPasswordResetResponseContract, FusebaseAuthPasswordRestoreKeyResponseContract, FusebaseAuthPasswordRestoreRequestContract, FusebaseAuthPasswordRestoreResponseContract, FusebaseAuthRegisterMemberRequestContract, FusebaseAuthRegisterMemberResponseContract, FusebaseAuthRegisterRequestContract, FusebaseAuthRegisterResponseContract, FusebaseAuthRestoreKeyRequestContract, FusebaseAuthRestoreKeyResponseContract, FusebaseAuthSessionContract, FusebaseAuthSetInitialPasswordRequestContract, FusebaseAuthSetInitialPasswordResponseContract, FusebaseAuthUnauthorizedErrorBodyContract } from "./fusebase-auth/fusebase-auth";
 export * from "./isolated-store/isolated-store";
 export * from "./mcp-manager/mcp-manager";
 export type { MeAuthContract, MeOrgGroupContract, MePreferencesContract, MeResponseContract, MeScopeContract, MeUserContract } from "./me/me";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fusebase/fusebase-gate-sdk",
-  "version": "2.11.6-sdk.0",
+  "version": "2.11.6",
   "description": "TypeScript SDK for Fusebase Gate APIs - Generated from contract introspection",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/release-notes/2.11.6-sdk.0.md

@@ -2,8 +2,60 @@
 
 - Current ref: `HEAD`
 - Previous tag: `v2.11.6-sdk.0`
-- Generated at: 2026-09-07T15:25:08.819Z
+- Generated at: 2026-09-08T12:29:57.106Z
 
 ## Included Drafts
 
-- None
+- `docs/release-notes/2026-09-07-app-auth-handoff.md` - Login handoff for the fusebase-auth ops
+
+## Summary
+
+### Login handoff for the fusebase-auth ops
+
+The four fusebase-auth operations that can end in an authenticated result now
+return an `appAuth` handoff beside `session`, so an app can obtain its own
+runtime token without holding a raw FuseBase session id.
+
+
+## API / SDK Changes
+
+### Login handoff for the fusebase-auth ops
+
+- Added `appAuth` (`exchangeToken`, `expiresInSeconds`, `authPath`) to the
+  authenticated responses of `registerFusebaseUser`,
+  `registerFusebaseOrgMember`, `loginFusebaseUser` and
+  `completeFusebaseAuthChallenge`.
+- `authPath` is a relative URL on the app's own host, built from the
+  `redirectPath` the app sent. Apps pass it through rather than assembling it.
+- Operation descriptions now point at the handoff instead of at
+  `session.sessionId`.
+- `session` is deprecated. Gate omits it from all four responses when it runs
+  with the `app_login_no_session_id` feature flag, which is off everywhere
+  until deployed apps have moved to `appAuth`.
+- With that flag on, a failed handoff mint answers 422 with `data.errorCode` =
+  `app_auth_exchange_unavailable` instead of degrading to the legacy response.
+
+
+## Consumer Impact
+
+### Login handoff for the fusebase-auth ops
+
+Purely additive: `session` is returned exactly as before, so no deployed app
+changes behaviour. Spend `appAuth.authPath` on the app's own origin, either
+with a same-origin `fetch` sending `Accept: application/json` or with a plain
+navigation. `exchangeToken` stays valid for its whole `expiresInSeconds`
+window, is not invalidated by being spent, and is not bound to the app it was
+minted for, so treat it as a credential.
+A challenge result is unchanged. If the mint fails the response is the legacy
+one, without `appAuth` — until the `app_login_no_session_id` flag is turned on,
+where the same failure is a 422 that should be answered with a fresh sign-in
+rather than a replay of the call.
+
+
+## Verification
+
+### Login handoff for the fusebase-auth ops
+
+- Unit tests over all four operations, the handoff URL encoding, the mint
+  failure paths and the relative-path guard.
+- Generated contract/OpenAPI validation and service build.

package/release-notes/2.11.6.md

@@ -0,0 +1,9 @@
+# Release Notes 2.11.6
+
+- Current ref: `HEAD`
+- Previous tag: `v2.11.6`
+- Generated at: 2026-09-09T09:28:57.596Z
+
+## Included Drafts
+
+- None

package/release-notes/latest.md

@@ -1,8 +1,8 @@
-# Release Notes 2.11.6-sdk.0
+# Release Notes 2.11.6
 
 - Current ref: `HEAD`
-- Previous tag: `v2.11.6-sdk.0`
-- Generated at: 2026-09-07T15:25:08.819Z
+- Previous tag: `v2.11.6`
+- Generated at: 2026-09-09T09:28:57.596Z
 
 ## Included Drafts