@mitralab.io/platform-sdk 1.0.8 → 1.0.9

package/CHANGELOG.md

@@ -0,0 +1,17 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+## Unreleased
+
+- Make the SonarCloud job wait for the Quality Gate result.
+- Align the public package metadata and ESM, CommonJS, and TypeScript artifacts.
+- Add package shape checks and public tarball smoke coverage.
+- Correct public imports and required configuration in documentation examples.
+- Add the MIT license.
+
+## 1.0.8
+
+- Share environment-neutral API contracts through `@mitralab.io/sdk-core`.
+- Preserve the Platform SDK 1.x browser authentication and entity facade.
+- Validate redirects, API errors, sensitive-value redaction, and package consumers.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Mitra Platform
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -3,197 +3,173 @@
 [![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=mitra-platform-sdk&metric=alert_status&token=28d7be14b66d6f88d706347e2418af5ea39ab3e9)](https://sonarcloud.io/summary/new_code?id=mitra-platform-sdk)
 [![Coverage](https://sonarcloud.io/api/project_badges/measure?project=mitra-platform-sdk&metric=coverage&token=28d7be14b66d6f88d706347e2418af5ea39ab3e9)](https://sonarcloud.io/summary/new_code?id=mitra-platform-sdk)
 
-SDK JavaScript/TypeScript para apps criados na plataforma Mitra. O código gerado pelo Code Studio usa este pacote para autenticar usuários, acessar entidades do Data Manager, executar server functions, rodar custom queries e chamar integrações.
+JavaScript and TypeScript SDK for browser applications built on the Mitra Platform. Applications generated by Code Studio use this package to authenticate users, access Data Manager entities, execute Server Functions and custom queries, and call integrations.
 
-O transporte de browser usa apenas Web APIs padrão (`fetch`, `localStorage`, `URL`, `Proxy`). Os contratos e módulos comuns vêm de `@mitralab.io/sdk-core`, sem trazer autenticação de browser para o core.
+The browser transport uses standard Web APIs only: `fetch`, `localStorage`, `URL`, and `Proxy`. Shared contracts and API modules come from `@mitralab.io/sdk-core`, without bringing browser authentication into the Core package.
 
-## O Que a SDK Entrega
-
-- Client único criado por `createClient`.
-- Auth com login, cadastro, refresh token, logout e estado em `localStorage`.
-- CRUD dinâmico em tabelas via `mitra.entities.<TableName>`.
-- Execução de server functions publicadas.
-- Execução de custom queries.
-- Proxy de integrações e resources com credential injection no servidor.
-- Tipos TypeScript exportados para os contratos principais.
-
-## Instalação
+## Installation
 
 ```bash
 npm install @mitralab.io/platform-sdk
 ```
 
-## Quick Start
+Node.js 18 or newer is required for development and server-side tooling. The runtime application must provide the browser Web APIs used by the SDK.
+
+## Quick start
 
 ```typescript
-import { createClient } from '@mitralab.io/platform-sdk';
+import { createClient } from "@mitralab.io/platform-sdk"
 
 export const mitra = createClient({
   appId: import.meta.env.VITE_MITRA_APP_ID,
   apiUrl: import.meta.env.VITE_MITRA_API_URL,
   onError: (error) => console.error(error.status, error.code, error.message),
-});
+})
 
-await mitra.init();
+await mitra.init()
 ```
 
-`init()` resolve a configuração pública do app no Code Studio, incluindo `dataSourceId` e `allowSignup`. Chame no boot da aplicação antes de usar `entities`, `queries` ou fluxo de cadastro.
+`init()` resolves the application's public Code Studio configuration, including `dataSourceId` and `allowSignup`. Call it during application startup before using entities, custom queries, or sign-up.
 
-## Configuração
+## Configuration
 
-| Campo     | Obrigatório | Uso                                |
-| --------- | ----------- | ---------------------------------- |
-| `appId`   | sim         | ID do app publicado no Code Studio |
-| `apiUrl`  | sim         | URL base do Kong/API da plataforma |
-| `onError` | não         | callback global para erros de API  |
+| Field | Required | Description |
+|---|---|---|
+| `appId` | yes | ID of the published Code Studio application. |
+| `apiUrl` | yes | Base URL of the Mitra API gateway. |
+| `onError` | no | Global callback for API errors. |
 
-O client deriva os endpoints dos serviços a partir de `apiUrl`: `/iam`, `/data-manager`, `/functions`, `/integration` e `/code-studio`.
+The client derives service endpoints from `apiUrl`: `/iam`, `/data-manager`, `/functions`, `/integration`, and `/code-studio`.
 
-## Estrutura de Arquivos
-
-```text
-src/
-├── client.ts          # createClient, composição dos módulos e init
-├── modules/           # auth de browser e fachadas compatíveis com a API 1.x
-├── utils/http-client  # fetch wrapper, auth header, retry 401 e MitraApiError
-└── index.ts           # exports públicos
-```
+## Boundary
 
-`@mitralab.io/sdk-core` concentra entities, queries, Functions, integration, `auth.me`, paths seguros e validação estrutural de respostas. A Platform SDK continua responsável por login, cadastro, refresh, `localStorage`, listeners e o retry único após refresh em resposta `401`.
+The Platform SDK owns:
 
-## Módulos
+- browser login, sign-up, logout, and session refresh
+- session persistence in `localStorage`
+- auth-state listeners
+- one retry after a successful token refresh on a `401` response
+- browser HTTP transport and public application initialization
 
-| Módulo        | Uso                                                                                     |
-| ------------- | --------------------------------------------------------------------------------------- |
-| `auth`        | `signIn`, `signUp`, `signOut`, `refreshSession`, `me`, `checkAuth`, `onAuthStateChange` |
-| `entities`    | CRUD dinâmico por tabela, filtro, paginação, bulk create e deleteMany                   |
-| `functions`   | disparo de server function por ID com a semântica assíncrona da API 1.x                 |
-| `queries`     | execução de custom query por ID com parâmetros                                          |
-| `integration` | execução de integration resource ou proxy direto por config                             |
+`@mitralab.io/sdk-core` owns the shared entities, custom queries, Functions, integrations, `auth.me`, safe paths, and structural response validation. Server Function code should use `@mitralab.io/functions-sdk` instead of this browser SDK.
 
-## Auth
+## Authentication
 
 ```typescript
 const user = await mitra.auth.signIn({
-  email: 'user@example.com',
-  password: 'password123',
-});
+  email: "user@example.com",
+  password: "password123",
+})
 
 const unsubscribe = mitra.auth.onAuthStateChange((currentUser) => {
-  console.log(currentUser?.email);
-});
+  console.log(currentUser?.email)
+})
 
-mitra.auth.signOut('/login');
-unsubscribe();
+mitra.auth.signOut("/login")
+unsubscribe()
 ```
 
-Estado de auth é persistido no `localStorage` com chave `mitra_auth_{appId}`. Em resposta `401`, o SDK tenta `refreshSession()` uma vez e repete a request.
+Authentication state is stored under `mitra_auth_{appId}`. When an API request returns `401`, the SDK attempts `refreshSession()` once and repeats the request only when refresh succeeds.
 
 ## Entities
 
 ```typescript
 type Task = {
-  id: string;
-  title: string;
-  status: 'pending' | 'done';
-};
+  id: string
+  title: string
+  status: "pending" | "done"
+}
 
-const tasks = await mitra.entities.getTable<Task>('Task').list({
-  sort: '-created_at',
+const tasks = await mitra.entities.getTable<Task>("Task").list({
+  sort: "-created_at",
   limit: 10,
-  fields: ['id', 'title', 'status'],
-});
+  fields: ["id", "title", "status"],
+})
 
-const pending = await mitra.entities.Task.filter({ status: 'pending' });
-const created = await mitra.entities.Task.create({ title: 'New task' });
-await mitra.entities.Task.update(created.id, { status: 'done' });
-await mitra.entities.Task.delete(created.id);
+const pending = await mitra.entities.Task.filter({ status: "pending" })
+const created = await mitra.entities.Task.create({ title: "New task" })
+await mitra.entities.Task.update(created.id, { status: "done" })
+await mitra.entities.Task.delete(created.id)
 ```
 
-Table names são case-sensitive e precisam bater com o nome da tabela no Data Manager.
-
-Records usam `/api/v1/tables/{table}/records`. O app e o tenant vêm do contexto autenticado, não do `dataSourceId` no path.
+Table names are case-sensitive and must match the Data Manager table name. Record operations use `/api/v1/tables/{table}/records`. Application and tenant scope come from the authenticated context, not from a data source in the path.
 
-## Functions
+## Server Functions
 
 ```typescript
-const execution = await mitra.functions.execute('function-id', {
-  orderId: 'order-123',
-});
+const execution = await mitra.functions.execute("function-id", {
+  orderId: "order-123",
+})
 
-console.log(execution.id, execution.status);
+console.log(execution.id, execution.status)
 ```
 
-Na API 1.x, `execute` não envia `X-Invocation-Type`. O serviço usa o default assíncrono e devolve a execução criada, normalmente com status `PENDING`; a chamada não espera a Function terminar.
+The Platform SDK 1.x `execute` method keeps the existing asynchronous API behavior. It does not send `X-Invocation-Type`, so the Functions service applies its default and returns the created execution, normally with `PENDING` status.
 
-## Queries
+## Custom queries
 
 ```typescript
-const result = await mitra.queries.execute('query-id', {
-  status: 'active',
-});
+const result = await mitra.queries.execute("query-id", {
+  status: "active",
+})
 
-console.log(result.rows, result.affectedRows);
+console.log(result.rows, result.affectedRows)
 ```
 
-## Integration
+## Integrations
 
-Resource pré-definido:
+Execute a predefined resource:
 
 ```typescript
-const result = await mitra.integration.executeResource('resource-id', {
-  descricao: 'Notebook',
+const result = await mitra.integration.executeResource("resource-id", {
+  description: "Notebook",
   limit: 10,
-});
+})
 ```
 
-Proxy direto por config:
+Or execute an integration config directly:
 
 ```typescript
-const result = await mitra.integration.execute('config-id', {
-  method: 'GET',
-  endpoint: '/users',
-  queryParams: { limit: '10' },
-});
+const result = await mitra.integration.execute("config-id", {
+  method: "GET",
+  endpoint: "/users",
+  queryParams: { limit: "10" },
+})
 
-console.log(result.status, result.body);
+console.log(result.status, result.body)
 ```
 
-## Erros
+Integration credentials are injected by the Integration service. Do not pass provider credentials through browser input.
 
-Erros de API lançam `MitraApiError`:
+## Errors and request behavior
+
+API failures throw `MitraApiError`:
 
 ```typescript
-import { MitraApiError } from '@mitralab.io/platform-sdk';
+import { MitraApiError } from "@mitralab.io/platform-sdk"
 
 try {
-  await mitra.entities.Task.get('missing-id');
+  await mitra.entities.Task.get("missing-id")
 } catch (error) {
   if (error instanceof MitraApiError) {
-    console.error(error.status, error.code, error.message);
+    console.error(error.status, error.code, error.message)
   }
 }
 ```
 
-O transporte não segue redirects HTTP. Respostas 307, 308 ou respostas já
-marcadas como redirecionadas falham sem replay. A única repetição automática é
-a tentativa única após refresh bem-sucedido em resposta 401.
+The transport refuses HTTP redirects. Statuses `307` and `308`, opaque redirects, and responses already marked as redirected fail without replay. The only automatic replay is the single request attempted after a successful session refresh on `401`.
 
-Antes de construir `MitraApiError`, a SDK remove o token usado na tentativa e
-qualquer credencial no formato `Bearer` de `message`, `code` e `details`,
-percorrendo recursivamente valores, arrays e chaves de objetos.
+Before constructing `MitraApiError`, the SDK recursively redacts the token used by the request and credentials in `Bearer` format from the error message, code, details, arrays, values, and object keys.
 
-## Desenvolvimento
+## Development
 
 ```bash
 npm install
-npm run build
-npm run lint
-npm test
+npm run check
 ```
 
-`@mitralab.io/sdk-core@0.1.0` é resolvido pelo registry público do npm e fica
-travado por integridade no `package-lock.json`. Não substitua a dependência por
-`file:` ou tarball local.
+`@mitralab.io/sdk-core@0.1.0` is resolved from the public npm registry and locked by integrity in `package-lock.json`. Do not replace it with a `file:` dependency or a local tarball.
+
+The build produces ESM, CommonJS, `.d.ts`, and `.d.cts` artifacts. Package checks inspect the public tarball with Are The Types Wrong, install it into an isolated consumer, and validate ESM, CommonJS, and TypeScript resolution.
 
-Build gera CommonJS, ESM e tipos TypeScript em `dist/`.
+See [CHANGELOG.md](CHANGELOG.md) for release history and [LICENSE](LICENSE) for license terms.

package/dist/{index.mjs → index.cjs}

@@ -1,5 +1,32 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  MitraApiError: () => MitraApiError,
+  createClient: () => createClient
+});
+module.exports = __toCommonJS(index_exports);
+
 // src/client.ts
-import { encodePathSegment, expectObject } from "@mitralab.io/sdk-core";
+var import_sdk_core6 = require("@mitralab.io/sdk-core");
 
 // src/utils/http-client.ts
 var bearerCredentialPattern = /(Bearer\s+)\S+/gi;
@@ -27,6 +54,16 @@ function asErrorPayload(value) {
 function optionalString(value) {
   return typeof value === "string" ? value : void 0;
 }
+function buildRequestUrl(baseUrl, path, params) {
+  const url = `${baseUrl}${path}`;
+  if (!params) return url;
+  const searchParams = new URLSearchParams();
+  Object.entries(params).forEach(([key, value]) => {
+    if (value !== void 0) searchParams.append(key, String(value));
+  });
+  const queryString = searchParams.toString();
+  return queryString ? `${url}?${queryString}` : url;
+}
 var HttpClient = class {
   baseUrl;
   tokenGetter;
@@ -65,19 +102,7 @@ var HttpClient = class {
    */
   async request(path, options = {}) {
     const { method = "GET", body, headers = {}, params, isRetry } = options;
-    let url = `${this.baseUrl}${path}`;
-    if (params) {
-      const searchParams = new URLSearchParams();
-      Object.entries(params).forEach(([key, value]) => {
-        if (value !== void 0) {
-          searchParams.append(key, String(value));
-        }
-      });
-      const queryString = searchParams.toString();
-      if (queryString) {
-        url += `?${queryString}`;
-      }
-    }
+    const url = buildRequestUrl(this.baseUrl, path, params);
     const requestHeaders = {
       "Content-Type": "application/json",
       ...this.defaultHeaders,
@@ -205,7 +230,7 @@ var coreErrors = {
 };
 
 // src/modules/auth.ts
-import { createAuthModule } from "@mitralab.io/sdk-core";
+var import_sdk_core = require("@mitralab.io/sdk-core");
 var AuthModule = class {
   appId;
   _currentUser = null;
@@ -222,7 +247,7 @@ var AuthModule = class {
     this.storageKey = `mitra_auth_${appId}`;
     this.publicClient = new HttpClient({ baseUrl: iamBaseUrl, getToken: () => null });
     this.authedClient = new HttpClient({ baseUrl: iamBaseUrl, getToken: () => this.#accessToken });
-    this.currentUserApi = createAuthModule(this.authedClient, coreErrors);
+    this.currentUserApi = (0, import_sdk_core.createAuthModule)(this.authedClient, coreErrors);
     this.loadFromStorage();
   }
   /** The currently authenticated user, or null. */
@@ -517,14 +542,11 @@ var AuthModule = class {
 };
 
 // src/modules/entities.ts
-import {
-  createEntitiesModule
-} from "@mitralab.io/sdk-core";
+var import_sdk_core2 = require("@mitralab.io/sdk-core");
 var EntitiesModule = class _EntitiesModule {
-  constructor(httpClient, dataSourceId) {
+  constructor(httpClient, _dataSourceId) {
     this.httpClient = httpClient;
-    void dataSourceId;
-    this.core = createEntitiesModule(httpClient, coreErrors);
+    this.core = (0, import_sdk_core2.createEntitiesModule)(httpClient, coreErrors);
   }
   core;
   static createProxy(httpClient, dataSourceId) {
@@ -542,9 +564,8 @@ var EntitiesModule = class _EntitiesModule {
    * Preserved for Platform SDK 1.x compatibility.
    * Records now resolve the app from authenticated context instead of a data source path.
    */
-  setDataSourceId(dataSourceId) {
-    void dataSourceId;
-    this.core = createEntitiesModule(this.httpClient, coreErrors);
+  setDataSourceId(_dataSourceId) {
+    this.core = (0, import_sdk_core2.createEntitiesModule)(this.httpClient, coreErrors);
   }
   getTable(tableName) {
     return this.core.getTable(tableName);
@@ -552,13 +573,11 @@ var EntitiesModule = class _EntitiesModule {
 };
 
 // src/modules/functions.ts
-import {
-  createFunctionsModule
-} from "@mitralab.io/sdk-core";
+var import_sdk_core3 = require("@mitralab.io/sdk-core");
 var FunctionsModule = class {
   core;
   constructor(httpClient) {
-    this.core = createFunctionsModule(httpClient, { emptyInput: "omit-body" }, coreErrors);
+    this.core = (0, import_sdk_core3.createFunctionsModule)(httpClient, { emptyInput: "omit-body" }, coreErrors);
   }
   /**
    * Executes a Function using the Platform SDK 1.x server-default invocation semantics.
@@ -576,13 +595,11 @@ var FunctionsModule = class {
 };
 
 // src/modules/integration.ts
-import {
-  createIntegrationModule
-} from "@mitralab.io/sdk-core";
+var import_sdk_core4 = require("@mitralab.io/sdk-core");
 var IntegrationModule = class {
   core;
   constructor(httpClient) {
-    this.core = createIntegrationModule(httpClient, coreErrors);
+    this.core = (0, import_sdk_core4.createIntegrationModule)(httpClient, coreErrors);
   }
   executeResource(resourceId, params) {
     return this.core.executeResource(resourceId, params);
@@ -593,14 +610,12 @@ var IntegrationModule = class {
 };
 
 // src/modules/queries.ts
-import {
-  createQueriesModule
-} from "@mitralab.io/sdk-core";
+var import_sdk_core5 = require("@mitralab.io/sdk-core");
 var QueriesModule = class {
   dataSourceId = "";
   core;
   constructor(httpClient) {
-    this.core = createQueriesModule(httpClient, () => this.dataSourceId, coreErrors);
+    this.core = (0, import_sdk_core5.createQueriesModule)(httpClient, () => this.dataSourceId, coreErrors);
   }
   /** Called by `client.init()` to set the app's resolved data source. */
   setDataSourceId(dataSourceId) {
@@ -614,7 +629,7 @@ var QueriesModule = class {
 
 // src/client.ts
 function expectAppInfoResponse(value) {
-  const response = expectObject(
+  const response = (0, import_sdk_core6.expectObject)(
     value,
     "App info response",
     coreErrors
@@ -679,7 +694,7 @@ function createClient(config) {
     });
     const appInfo = expectAppInfoResponse(
       await publicClient.get(
-        `/api/v1/apps/${encodePathSegment(appId, "appId", coreErrors)}/info`
+        `/api/v1/apps/${(0, import_sdk_core6.encodePathSegment)(appId, "appId", coreErrors)}/info`
       )
     );
     entitiesModule.setDataSourceId(appInfo.dataSourceId);
@@ -700,7 +715,8 @@ function createClient(config) {
     config
   };
 }
-export {
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
   MitraApiError,
   createClient
-};
+});

package/dist/{index.d.mts → index.d.cts}

@@ -376,13 +376,13 @@ declare class AuthModule {
 declare class EntitiesModule {
     private readonly httpClient;
     private core;
-    constructor(httpClient: HttpClient, dataSourceId: string);
+    constructor(httpClient: HttpClient, _dataSourceId: string);
     static createProxy(httpClient: HttpClient, dataSourceId: string): EntitiesModule;
     /**
      * Preserved for Platform SDK 1.x compatibility.
      * Records now resolve the app from authenticated context instead of a data source path.
      */
-    setDataSourceId(dataSourceId: string): void;
+    setDataSourceId(_dataSourceId: string): void;
     getTable<T = Record<string, unknown>>(tableName: string): EntityTable<T>;
 }
 type EntitiesProxy = EntitiesModule & {
@@ -496,6 +496,7 @@ interface MitraClientConfig {
      * ```typescript
      * const mitra = createClient({
      *   appId: 'your-app-id',
+     *   apiUrl: 'https://api.example.com',
      *   onError: (error) => toast.error(error.message),
      * });
      * ```
@@ -509,6 +510,7 @@ interface MitraClientConfig {
  * ```typescript
  * const mitra = createClient({
  *   appId: 'your-app-id',
+ *   apiUrl: 'https://api.example.com',
  * });
  *
  * // Initialize (resolves app config automatically)
@@ -535,7 +537,10 @@ interface MitraClient {
      *
      * @example
      * ```typescript
-     * const mitra = createClient({ appId: 'your-app-id' });
+     * const mitra = createClient({
+     *   appId: 'your-app-id',
+     *   apiUrl: 'https://api.example.com',
+     * });
      * await mitra.init();
      * ```
      */
@@ -628,7 +633,7 @@ interface MitraClient {
  *
  * @example
  * ```typescript
- * import { createClient } from 'mitra-platform-sdk';
+ * import { createClient } from '@mitralab.io/platform-sdk';
  *
  * const mitra = createClient({
  *   appId: import.meta.env.VITE_MITRA_APP_ID,
@@ -646,7 +651,7 @@ interface MitraClient {
  * ```typescript
  * // Export as singleton for use throughout your app
  * // src/api/mitraClient.ts
- * import { createClient } from 'mitra-platform-sdk';
+ * import { createClient } from '@mitralab.io/platform-sdk';
  *
  * export const mitra = createClient({
  *   appId: import.meta.env.VITE_MITRA_APP_ID,

package/dist/index.d.ts

@@ -376,13 +376,13 @@ declare class AuthModule {
 declare class EntitiesModule {
     private readonly httpClient;
     private core;
-    constructor(httpClient: HttpClient, dataSourceId: string);
+    constructor(httpClient: HttpClient, _dataSourceId: string);
     static createProxy(httpClient: HttpClient, dataSourceId: string): EntitiesModule;
     /**
      * Preserved for Platform SDK 1.x compatibility.
      * Records now resolve the app from authenticated context instead of a data source path.
      */
-    setDataSourceId(dataSourceId: string): void;
+    setDataSourceId(_dataSourceId: string): void;
     getTable<T = Record<string, unknown>>(tableName: string): EntityTable<T>;
 }
 type EntitiesProxy = EntitiesModule & {
@@ -496,6 +496,7 @@ interface MitraClientConfig {
      * ```typescript
      * const mitra = createClient({
      *   appId: 'your-app-id',
+     *   apiUrl: 'https://api.example.com',
      *   onError: (error) => toast.error(error.message),
      * });
      * ```
@@ -509,6 +510,7 @@ interface MitraClientConfig {
  * ```typescript
  * const mitra = createClient({
  *   appId: 'your-app-id',
+ *   apiUrl: 'https://api.example.com',
  * });
  *
  * // Initialize (resolves app config automatically)
@@ -535,7 +537,10 @@ interface MitraClient {
      *
      * @example
      * ```typescript
-     * const mitra = createClient({ appId: 'your-app-id' });
+     * const mitra = createClient({
+     *   appId: 'your-app-id',
+     *   apiUrl: 'https://api.example.com',
+     * });
      * await mitra.init();
      * ```
      */
@@ -628,7 +633,7 @@ interface MitraClient {
  *
  * @example
  * ```typescript
- * import { createClient } from 'mitra-platform-sdk';
+ * import { createClient } from '@mitralab.io/platform-sdk';
  *
  * const mitra = createClient({
  *   appId: import.meta.env.VITE_MITRA_APP_ID,
@@ -646,7 +651,7 @@ interface MitraClient {
  * ```typescript
  * // Export as singleton for use throughout your app
  * // src/api/mitraClient.ts
- * import { createClient } from 'mitra-platform-sdk';
+ * import { createClient } from '@mitralab.io/platform-sdk';
  *
  * export const mitra = createClient({
  *   appId: import.meta.env.VITE_MITRA_APP_ID,

package/dist/index.js

@@ -1,32 +1,5 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/index.ts
-var index_exports = {};
-__export(index_exports, {
-  MitraApiError: () => MitraApiError,
-  createClient: () => createClient
-});
-module.exports = __toCommonJS(index_exports);
-
 // src/client.ts
-var import_sdk_core6 = require("@mitralab.io/sdk-core");
+import { encodePathSegment, expectObject } from "@mitralab.io/sdk-core";
 
 // src/utils/http-client.ts
 var bearerCredentialPattern = /(Bearer\s+)\S+/gi;
@@ -54,6 +27,16 @@ function asErrorPayload(value) {
 function optionalString(value) {
   return typeof value === "string" ? value : void 0;
 }
+function buildRequestUrl(baseUrl, path, params) {
+  const url = `${baseUrl}${path}`;
+  if (!params) return url;
+  const searchParams = new URLSearchParams();
+  Object.entries(params).forEach(([key, value]) => {
+    if (value !== void 0) searchParams.append(key, String(value));
+  });
+  const queryString = searchParams.toString();
+  return queryString ? `${url}?${queryString}` : url;
+}
 var HttpClient = class {
   baseUrl;
   tokenGetter;
@@ -92,19 +75,7 @@ var HttpClient = class {
    */
   async request(path, options = {}) {
     const { method = "GET", body, headers = {}, params, isRetry } = options;
-    let url = `${this.baseUrl}${path}`;
-    if (params) {
-      const searchParams = new URLSearchParams();
-      Object.entries(params).forEach(([key, value]) => {
-        if (value !== void 0) {
-          searchParams.append(key, String(value));
-        }
-      });
-      const queryString = searchParams.toString();
-      if (queryString) {
-        url += `?${queryString}`;
-      }
-    }
+    const url = buildRequestUrl(this.baseUrl, path, params);
     const requestHeaders = {
       "Content-Type": "application/json",
       ...this.defaultHeaders,
@@ -232,7 +203,7 @@ var coreErrors = {
 };
 
 // src/modules/auth.ts
-var import_sdk_core = require("@mitralab.io/sdk-core");
+import { createAuthModule } from "@mitralab.io/sdk-core";
 var AuthModule = class {
   appId;
   _currentUser = null;
@@ -249,7 +220,7 @@ var AuthModule = class {
     this.storageKey = `mitra_auth_${appId}`;
     this.publicClient = new HttpClient({ baseUrl: iamBaseUrl, getToken: () => null });
     this.authedClient = new HttpClient({ baseUrl: iamBaseUrl, getToken: () => this.#accessToken });
-    this.currentUserApi = (0, import_sdk_core.createAuthModule)(this.authedClient, coreErrors);
+    this.currentUserApi = createAuthModule(this.authedClient, coreErrors);
     this.loadFromStorage();
   }
   /** The currently authenticated user, or null. */
@@ -544,12 +515,13 @@ var AuthModule = class {
 };
 
 // src/modules/entities.ts
-var import_sdk_core2 = require("@mitralab.io/sdk-core");
+import {
+  createEntitiesModule
+} from "@mitralab.io/sdk-core";
 var EntitiesModule = class _EntitiesModule {
-  constructor(httpClient, dataSourceId) {
+  constructor(httpClient, _dataSourceId) {
     this.httpClient = httpClient;
-    void dataSourceId;
-    this.core = (0, import_sdk_core2.createEntitiesModule)(httpClient, coreErrors);
+    this.core = createEntitiesModule(httpClient, coreErrors);
   }
   core;
   static createProxy(httpClient, dataSourceId) {
@@ -567,9 +539,8 @@ var EntitiesModule = class _EntitiesModule {
    * Preserved for Platform SDK 1.x compatibility.
    * Records now resolve the app from authenticated context instead of a data source path.
    */
-  setDataSourceId(dataSourceId) {
-    void dataSourceId;
-    this.core = (0, import_sdk_core2.createEntitiesModule)(this.httpClient, coreErrors);
+  setDataSourceId(_dataSourceId) {
+    this.core = createEntitiesModule(this.httpClient, coreErrors);
   }
   getTable(tableName) {
     return this.core.getTable(tableName);
@@ -577,11 +548,13 @@ var EntitiesModule = class _EntitiesModule {
 };
 
 // src/modules/functions.ts
-var import_sdk_core3 = require("@mitralab.io/sdk-core");
+import {
+  createFunctionsModule
+} from "@mitralab.io/sdk-core";
 var FunctionsModule = class {
   core;
   constructor(httpClient) {
-    this.core = (0, import_sdk_core3.createFunctionsModule)(httpClient, { emptyInput: "omit-body" }, coreErrors);
+    this.core = createFunctionsModule(httpClient, { emptyInput: "omit-body" }, coreErrors);
   }
   /**
    * Executes a Function using the Platform SDK 1.x server-default invocation semantics.
@@ -599,11 +572,13 @@ var FunctionsModule = class {
 };
 
 // src/modules/integration.ts
-var import_sdk_core4 = require("@mitralab.io/sdk-core");
+import {
+  createIntegrationModule
+} from "@mitralab.io/sdk-core";
 var IntegrationModule = class {
   core;
   constructor(httpClient) {
-    this.core = (0, import_sdk_core4.createIntegrationModule)(httpClient, coreErrors);
+    this.core = createIntegrationModule(httpClient, coreErrors);
   }
   executeResource(resourceId, params) {
     return this.core.executeResource(resourceId, params);
@@ -614,12 +589,14 @@ var IntegrationModule = class {
 };
 
 // src/modules/queries.ts
-var import_sdk_core5 = require("@mitralab.io/sdk-core");
+import {
+  createQueriesModule
+} from "@mitralab.io/sdk-core";
 var QueriesModule = class {
   dataSourceId = "";
   core;
   constructor(httpClient) {
-    this.core = (0, import_sdk_core5.createQueriesModule)(httpClient, () => this.dataSourceId, coreErrors);
+    this.core = createQueriesModule(httpClient, () => this.dataSourceId, coreErrors);
   }
   /** Called by `client.init()` to set the app's resolved data source. */
   setDataSourceId(dataSourceId) {
@@ -633,7 +610,7 @@ var QueriesModule = class {
 
 // src/client.ts
 function expectAppInfoResponse(value) {
-  const response = (0, import_sdk_core6.expectObject)(
+  const response = expectObject(
     value,
     "App info response",
     coreErrors
@@ -698,7 +675,7 @@ function createClient(config) {
     });
     const appInfo = expectAppInfoResponse(
       await publicClient.get(
-        `/api/v1/apps/${(0, import_sdk_core6.encodePathSegment)(appId, "appId", coreErrors)}/info`
+        `/api/v1/apps/${encodePathSegment(appId, "appId", coreErrors)}/info`
       )
     );
     entitiesModule.setDataSourceId(appInfo.dataSourceId);
@@ -719,8 +696,7 @@ function createClient(config) {
     config
   };
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
+export {
   MitraApiError,
   createClient
-});
+};

package/package.json

@@ -1,20 +1,34 @@
 {
   "name": "@mitralab.io/platform-sdk",
-  "version": "1.0.8",
+  "version": "1.0.9",
   "description": "JavaScript/TypeScript SDK for building apps on the Mitra Platform",
-  "main": "dist/index.js",
-  "module": "dist/index.mjs",
-  "types": "dist/index.d.ts",
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
   "exports": {
     ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.mjs",
-      "require": "./dist/index.js"
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
     }
   },
   "files": [
-    "dist"
+    "dist",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md"
   ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  },
   "scripts": {
     "build": "tsup src/index.ts --format cjs,esm --dts --clean",
     "dev": "tsup src/index.ts --format cjs,esm --dts --watch",
@@ -22,9 +36,11 @@
     "typecheck": "tsc --noEmit",
     "test": "vitest run --coverage",
     "test:watch": "vitest",
+    "check:package-types": "npx --yes @arethetypeswrong/cli@0.18.5 --pack .",
+    "pack:check": "npm pack --dry-run",
     "smoke:package": "node scripts/smoke-package.mjs",
-    "check": "npm run lint && npm run typecheck && npm test && npm run build && npm run smoke:package",
-    "prepublishOnly": "npm run check"
+    "check": "npm run lint && npm run typecheck && npm test && npm run build && npm run pack:check && npm run smoke:package",
+    "prepublishOnly": "npm run check && npm run check:package-types"
   },
   "keywords": [
     "mitra",
@@ -64,6 +80,7 @@
     "node": ">=18.0.0"
   },
   "overrides": {
+    "esbuild": "^0.25.0",
     "rollup": "^4.59.0",
     "test-exclude": "7.0.1"
   }