@mitralab.io/platform-sdk 1.0.8 → 1.1.0-beta.0

package/dist/index.cjs

@@ -0,0 +1,1835 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  MitraApiError: () => MitraApiError,
+  callIntegrationMitra: () => import_mitra_interactions_sdk14.callIntegrationMitra,
+  configureSdkMitra: () => import_mitra_interactions_sdk3.configureSdkMitra,
+  createClient: () => createClient,
+  createMitraInstance: () => import_mitra_interactions_sdk4.createMitraInstance,
+  createRecordMitra: () => import_mitra_interactions_sdk18.createRecordMitra,
+  createRecordsBatchMitra: () => import_mitra_interactions_sdk19.createRecordsBatchMitra,
+  deleteRecordMitra: () => import_mitra_interactions_sdk22.deleteRecordMitra,
+  exchangeSsoCodeMitra: () => exchangeSsoCodeMitra,
+  executePublicServerFunctionAsyncMitra: () => import_mitra_interactions_sdk11.executePublicServerFunctionAsyncMitra,
+  executePublicServerFunctionMitra: () => import_mitra_interactions_sdk10.executePublicServerFunctionMitra,
+  executeServerFunctionAsyncMitra: () => import_mitra_interactions_sdk9.executeServerFunctionAsyncMitra,
+  executeServerFunctionMitra: () => import_mitra_interactions_sdk8.executeServerFunctionMitra,
+  getAgentTaskMitra: () => import_mitra_interactions_sdk23.getAgentTaskMitra,
+  getConfig: () => import_mitra_interactions_sdk5.getConfig,
+  getPublicServerFunctionExecutionMitra: () => import_mitra_interactions_sdk12.getPublicServerFunctionExecutionMitra,
+  getRecordMitra: () => import_mitra_interactions_sdk17.getRecordMitra,
+  listIntegrationsMitra: () => import_mitra_interactions_sdk15.listIntegrationsMitra,
+  listRecordsMitra: () => import_mitra_interactions_sdk16.listRecordsMitra,
+  loginMitra: () => loginMitra,
+  loginWithGoogleMitra: () => loginWithGoogleMitra,
+  loginWithMicrosoftMitra: () => loginWithMicrosoftMitra,
+  manageAgentChatMitra: () => import_mitra_interactions_sdk24.manageAgentChatMitra,
+  manageAgentCredentialMitra: () => import_mitra_interactions_sdk25.manageAgentCredentialMitra,
+  patchRecordMitra: () => import_mitra_interactions_sdk21.patchRecordMitra,
+  refreshTokenSilently: () => import_mitra_interactions_sdk7.refreshTokenSilently,
+  resolveProjectId: () => import_mitra_interactions_sdk6.resolveProjectId,
+  stopServerFunctionExecutionMitra: () => import_mitra_interactions_sdk13.stopServerFunctionExecutionMitra,
+  updateRecordMitra: () => import_mitra_interactions_sdk20.updateRecordMitra
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/utils/url.ts
+function stripTrailingSlashes(value) {
+  let end = value.length;
+  while (end > 0 && value.codePointAt(end - 1) === 47) end -= 1;
+  return value.slice(0, end);
+}
+
+// src/client.ts
+var import_sdk_core9 = require("@mitralab.io/sdk-core");
+
+// src/utils/http-client.ts
+var bearerCredentialPattern = /(Bearer\s+)\S+/gi;
+var sensitiveDetailKeyPattern = /token|authorization|password|secret|api.?key|credential|private.?key/i;
+function isSensitiveDetailKey(key) {
+  return sensitiveDetailKeyPattern.test(key);
+}
+function redactText(value, currentToken) {
+  const withoutBearerCredentials = value.replace(bearerCredentialPattern, "$1[REDACTED]");
+  return currentToken ? withoutBearerCredentials.split(currentToken).join("[REDACTED]") : withoutBearerCredentials;
+}
+function redactDetails(value, currentToken) {
+  if (typeof value === "string") return redactText(value, currentToken);
+  if (Array.isArray(value)) return value.map((item) => redactDetails(item, currentToken));
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, entry]) => {
+        const redactedKey = redactText(key, currentToken);
+        return [
+          redactedKey,
+          isSensitiveDetailKey(redactedKey) ? "[REDACTED]" : redactDetails(entry, currentToken)
+        ];
+      })
+    );
+  }
+  return value;
+}
+function asErrorPayload(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  return value;
+}
+function optionalString(value) {
+  return typeof value === "string" ? value : void 0;
+}
+function buildRequestUrl(baseUrl, path, params) {
+  const url = `${baseUrl}${path}`;
+  if (!params) return url;
+  const searchParams = new URLSearchParams();
+  Object.entries(params).forEach(([key, value]) => {
+    if (value !== void 0) searchParams.append(key, String(value));
+  });
+  const queryString = searchParams.toString();
+  return queryString ? `${url}?${queryString}` : url;
+}
+var HttpClient = class {
+  baseUrl;
+  tokenGetter;
+  beforeAuthenticatedRequest;
+  onUnauthorized;
+  onError;
+  defaultHeaders;
+  constructor(config) {
+    this.baseUrl = config.baseUrl.replace(/\/$/, "");
+    this.tokenGetter = config.getToken ?? (() => null);
+    this.beforeAuthenticatedRequest = config.beforeAuthenticatedRequest;
+    this.onUnauthorized = config.onUnauthorized;
+    this.onError = config.onError;
+    this.defaultHeaders = config.defaultHeaders ?? {};
+  }
+  /**
+   * Returns the current authentication token.
+   * @returns The JWT token if authenticated, null otherwise
+   */
+  getToken() {
+    return this.tokenGetter();
+  }
+  /**
+   * Makes an HTTP request with automatic JSON handling and authentication.
+   *
+   * @param path - API endpoint path (e.g., '/users')
+   * @param options - Request options including method, body, headers, and params
+   * @returns Promise resolving to the parsed JSON response
+   * @throws {MitraApiError} When the API returns an error response
+   *
+   * @example
+   * ```typescript
+   * const result = await client.request<User>('/users/123', {
+   *   method: 'PUT',
+   *   body: { name: 'Updated Name' },
+   * });
+   * ```
+   */
+  async request(path, options = {}) {
+    const { method = "GET", body, headers = {}, params, isRetry } = options;
+    const url = buildRequestUrl(this.baseUrl, path, params);
+    if (!isRetry && this.tokenGetter() && this.beforeAuthenticatedRequest) {
+      await this.beforeAuthenticatedRequest();
+    }
+    const requestHeaders = {
+      "Content-Type": "application/json",
+      ...this.defaultHeaders,
+      ...headers
+    };
+    const token = this.tokenGetter();
+    if (token) {
+      requestHeaders["Authorization"] = `Bearer ${token}`;
+    }
+    const response = await fetch(url, {
+      method,
+      headers: requestHeaders,
+      body: body ? JSON.stringify(body) : void 0,
+      redirect: "manual"
+    });
+    if (response.redirected || response.type === "opaqueredirect") {
+      const error = new MitraApiError(
+        "Redirected responses are not allowed",
+        response.status,
+        "REDIRECT_NOT_ALLOWED"
+      );
+      this.onError?.(error);
+      throw error;
+    }
+    if (!response.ok) {
+      if (response.status === 401 && !isRetry && this.onUnauthorized) {
+        const refreshed = await this.onUnauthorized(token);
+        if (refreshed) {
+          return this.request(path, { ...options, isRetry: true });
+        }
+      }
+      const error = await this.errorFromResponse(response, token);
+      this.onError?.(error);
+      throw error;
+    }
+    return this.parseResponseBody(response, path);
+  }
+  async errorFromResponse(response, token) {
+    const errorBody = await response.json().catch(() => ({}));
+    const errorPayload = asErrorPayload(errorBody);
+    const rawMessage = optionalString(errorPayload.message);
+    const rawCode = optionalString(errorPayload.error_code);
+    return new MitraApiError(
+      redactText(rawMessage || `Request failed with status ${response.status}`, token),
+      response.status,
+      rawCode === void 0 ? void 0 : redactText(rawCode, token),
+      redactDetails(errorBody, token)
+    );
+  }
+  async parseResponseBody(response, path) {
+    if (response.status === 204) {
+      return void 0;
+    }
+    if (typeof response.text === "function") {
+      const responseText = await response.text();
+      if (responseText.length === 0) {
+        return void 0;
+      }
+      try {
+        return JSON.parse(responseText);
+      } catch {
+        const error = new MitraApiError(
+          `Response from ${path} is not valid JSON`,
+          response.status,
+          "INVALID_RESPONSE"
+        );
+        this.onError?.(error);
+        throw error;
+      }
+    }
+    return response.json();
+  }
+  /**
+   * Makes a GET request.
+   *
+   * @param path - API endpoint path
+   * @param params - Optional query parameters
+   * @returns Promise resolving to the parsed JSON response
+   *
+   * @example
+   * ```typescript
+   * const users = await client.get<User[]>('/users', { limit: 10 });
+   * ```
+   */
+  get(path, params) {
+    return this.request(path, { method: "GET", params });
+  }
+  /**
+   * Makes a POST request.
+   *
+   * @param path - API endpoint path
+   * @param body - Request body (will be JSON stringified)
+   * @returns Promise resolving to the parsed JSON response
+   *
+   * @example
+   * ```typescript
+   * const user = await client.post<User>('/users', { name: 'John', email: 'john@example.com' });
+   * ```
+   */
+  post(path, body) {
+    return this.request(path, { method: "POST", body });
+  }
+  /**
+   * Makes a PUT request.
+   *
+   * @param path - API endpoint path
+   * @param body - Request body (will be JSON stringified)
+   * @returns Promise resolving to the parsed JSON response
+   *
+   * @example
+   * ```typescript
+   * const user = await client.put<User>('/users/123', { name: 'Updated Name' });
+   * ```
+   */
+  put(path, body) {
+    return this.request(path, { method: "PUT", body });
+  }
+  /**
+   * Makes a DELETE request.
+   *
+   * @param path - API endpoint path
+   * @param params - Optional query parameters
+   * @returns Promise resolving to the parsed JSON response (or undefined for 204 responses)
+   *
+   * @example
+   * ```typescript
+   * await client.delete('/users/123');
+   * ```
+   */
+  delete(path, params) {
+    return this.request(path, { method: "DELETE", params });
+  }
+};
+var MitraApiError = class extends Error {
+  constructor(message, status, code, details) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.details = details;
+    this.name = "MitraApiError";
+  }
+};
+
+// src/core-errors.ts
+var coreErrors = {
+  configuration: (message) => new MitraApiError(message, 0, "INVALID_CONFIGURATION"),
+  invalidResponse: (message) => new MitraApiError(message, 200, "INVALID_RESPONSE")
+};
+
+// src/legacy/bridge.ts
+var import_mitra_interactions_sdk = require("mitra-interactions-sdk");
+
+// src/modules/auth-page-url.ts
+function resolveAuthPageUrl(apiUrl, configuredAuthPageUrl, browserWindow = globalThis.window) {
+  const injectedAuthPageUrl = browserWindow?.__mitraEnv?.authPageUrl;
+  try {
+    const candidate = configuredAuthPageUrl ?? (typeof injectedAuthPageUrl === "string" && injectedAuthPageUrl.trim() ? injectedAuthPageUrl : new URL("/sdk-auth.html", apiUrl).toString());
+    const url = new URL(candidate);
+    if (url.protocol !== "https:" && url.protocol !== "http:")
+      throw new Error("authPageUrl must be an absolute HTTP or HTTPS URL.");
+    return url;
+  } catch {
+    throw new Error("authPageUrl must be an absolute HTTP or HTTPS URL.");
+  }
+}
+
+// src/legacy/bridge.ts
+function stripBearer(token) {
+  return token.replace(/^\s*(?:bearer\s+)+/i, "").trim();
+}
+var LegacySessionBridge = class {
+  auth;
+  appId;
+  apiUrl;
+  configuredAuthPageUrl;
+  legacyUrl;
+  unsubscribeFromAuth = null;
+  constructor(auth, appId, apiUrl, authPageUrl) {
+    this.auth = auth;
+    this.appId = appId;
+    this.apiUrl = apiUrl;
+    this.configuredAuthPageUrl = authPageUrl;
+    const gatewayUrl = stripTrailingSlashes(apiUrl);
+    this.legacyUrl = gatewayUrl ? `${gatewayUrl}/legacy` : "";
+  }
+  /**
+   * Configures the legacy SDK and hands it the session this SDK already holds.
+   *
+   * Called once per client. Failures are swallowed: an unusable legacy SDK must
+   * not stop the new client from being created.
+   */
+  connect() {
+    this.disconnect();
+    this.syncToLegacy(this.auth.readSessionTokens());
+    this.unsubscribeFromAuth = this.auth.onSessionChange((session) => {
+      this.syncToLegacy(session);
+    });
+  }
+  /** Stops this bridge from changing the process-wide legacy SDK singleton. */
+  disconnect() {
+    this.unsubscribeFromAuth?.();
+    this.unsubscribeFromAuth = null;
+  }
+  syncToLegacy(session) {
+    try {
+      const authPageUrl = resolveAuthPageUrl(
+        this.apiUrl,
+        this.configuredAuthPageUrl
+      ).toString();
+      (0, import_mitra_interactions_sdk.configureSdkMitra)({
+        baseURL: this.legacyUrl,
+        authUrl: this.legacyUrl,
+        authPageUrl,
+        projectId: this.appId,
+        onTokenRefresh: (session2) => this.adopt(session2),
+        ...session.token ? { token: session.token } : {},
+        ...session.refreshToken ? { refreshToken: session.refreshToken } : {}
+      });
+      const legacyConfig = (0, import_mitra_interactions_sdk.getConfig)();
+      if (!session.token) delete legacyConfig.token;
+      if (!session.refreshToken) delete legacyConfig.refreshToken;
+    } catch {
+    }
+  }
+  /**
+   * Stores a session produced by the legacy SDK. The AuthModule subscription
+   * then writes that session back to the process-wide legacy config and
+   * reinstates the refresh hook removed by legacy login.
+   */
+  adopt(session) {
+    const adopted = this.auth.adoptSession({
+      token: stripBearer(session.token),
+      refreshToken: session.refreshToken ?? null
+    });
+    if (!adopted) this.syncToLegacy(this.auth.readSessionTokens());
+  }
+};
+var activeBridge = null;
+function setActiveBridge(bridge) {
+  activeBridge?.disconnect();
+  activeBridge = bridge;
+}
+function adoptLegacySession(session) {
+  activeBridge?.adopt(session);
+}
+
+// src/modules/auth.ts
+var import_sdk_core2 = require("@mitralab.io/sdk-core");
+
+// src/modules/google-auth.ts
+var import_sdk_core = require("@mitralab.io/sdk-core");
+var RESULT_TYPE = "mitra-oauth-result";
+var PROVIDER_LABELS = {
+  google: "Google",
+  microsoft: "Microsoft"
+};
+var POPUP_WIDTH = 480;
+var POPUP_HEIGHT = 600;
+var POPUP_TIMEOUT_MS = 5 * 60 * 1e3;
+var POPUP_CLOSED_POLL_MS = 500;
+function expectAuthTokenResponse(value) {
+  const response = (0, import_sdk_core.expectObject)(
+    value,
+    "Authentication token response",
+    coreErrors
+  );
+  for (const field of ["accessToken", "refreshToken", "tokenType"]) {
+    if (typeof response[field] !== "string" || !response[field].trim()) {
+      throw coreErrors.invalidResponse(
+        `Authentication token response has an invalid ${field} field`
+      );
+    }
+  }
+  return {
+    accessToken: response.accessToken,
+    refreshToken: response.refreshToken,
+    tokenType: response.tokenType
+  };
+}
+var GoogleAuthFlow = class {
+  appId;
+  apiUrl;
+  configuredAuthPageUrl;
+  client;
+  provider;
+  providerLabel;
+  redirectStorageKey;
+  popupPromise = null;
+  constructor(config) {
+    this.appId = config.appId;
+    this.apiUrl = stripTrailingSlashes(config.apiUrl);
+    this.configuredAuthPageUrl = config.authPageUrl;
+    this.client = config.client;
+    this.provider = config.provider ?? "google";
+    this.providerLabel = PROVIDER_LABELS[this.provider];
+    this.redirectStorageKey = `mitra_${this.provider}_redirect_${config.appId}`;
+  }
+  signIn(options = {}) {
+    const browserWindow = this.requireBrowser();
+    if (options.mode === "redirect") {
+      return this.startRedirect(browserWindow);
+    }
+    if (options.mode !== void 0 && options.mode !== "popup") {
+      return Promise.reject(new Error(`Unsupported ${this.providerLabel} sign-in mode: ${String(options.mode)}`));
+    }
+    if (this.popupPromise) return this.popupPromise;
+    this.popupPromise = this.startPopup(browserWindow).finally(() => {
+      this.popupPromise = null;
+    });
+    return this.popupPromise;
+  }
+  async completeRedirect() {
+    const browserWindow = this.requireBrowser();
+    const params = new URLSearchParams(browserWindow.location.hash.replace(/^#/, ""));
+    const code = params.get("codeMitra");
+    const state = params.get("stateMitra");
+    const error = params.get("errorMitra");
+    if (code === null && state === null && error === null) return null;
+    const context = this.readRedirectContext(browserWindow);
+    if (!state?.trim()) {
+      throw new Error(`${this.providerLabel} sign-in redirect is missing state.`);
+    }
+    if (context?.state !== state) {
+      throw new Error(`Invalid ${this.providerLabel} sign-in state (possible CSRF).`);
+    }
+    const expectedRedirectUri = this.getRedirectUri(
+      resolveAuthPageUrl(this.apiUrl, this.configuredAuthPageUrl, browserWindow)
+    );
+    if (context.redirectUri !== expectedRedirectUri) {
+      throw new Error(`${this.providerLabel} sign-in redirect context is invalid.`);
+    }
+    this.cleanRedirectFragment(browserWindow);
+    this.clearRedirectContext(browserWindow);
+    if (code === "error" || error !== null) {
+      throw new Error(error || `${this.providerLabel} sign-in failed.`);
+    }
+    if (!code?.trim()) {
+      throw new Error(`${this.providerLabel} sign-in redirect is missing code.`);
+    }
+    return this.exchangeCode(code, context.redirectUri);
+  }
+  async startPopup(browserWindow) {
+    const state = this.generateState();
+    const authPageUrl = resolveAuthPageUrl(
+      this.apiUrl,
+      this.configuredAuthPageUrl,
+      browserWindow
+    );
+    const popup = this.openPopup(browserWindow, this.buildStartUrl(browserWindow, authPageUrl, state));
+    const result = await this.waitForPopupResult(browserWindow, popup, authPageUrl.origin, state);
+    if (result.code) return this.exchangeCode(result.code, this.getRedirectUri(authPageUrl));
+    return expectAuthTokenResponse(result.token);
+  }
+  startRedirect(browserWindow) {
+    const state = this.generateState();
+    const authPageUrl = resolveAuthPageUrl(
+      this.apiUrl,
+      this.configuredAuthPageUrl,
+      browserWindow
+    );
+    const context = {
+      state,
+      redirectUri: this.getRedirectUri(authPageUrl)
+    };
+    this.persistRedirectContext(browserWindow, context);
+    const startUrl = this.buildStartUrl(browserWindow, authPageUrl, state);
+    browserWindow.location.assign(startUrl.toString());
+    return new Promise(() => void 0);
+  }
+  async exchangeCode(code, redirectUri) {
+    const response = await this.client.post(`/api/v1/auth/${this.provider}`, {
+      appId: this.appId,
+      code,
+      redirectUri
+    });
+    return expectAuthTokenResponse(response);
+  }
+  buildStartUrl(browserWindow, authPageUrl, state) {
+    const startUrl = new URL(authPageUrl);
+    startUrl.searchParams.set("provider", this.provider);
+    startUrl.searchParams.set("state", state);
+    startUrl.searchParams.set("appId", this.appId);
+    startUrl.searchParams.set("apiUrl", this.apiUrl);
+    startUrl.searchParams.set("origin", browserWindow.location.origin);
+    startUrl.searchParams.set("responseType", "code");
+    return startUrl;
+  }
+  getRedirectUri(authPageUrl) {
+    return `${authPageUrl.origin}${authPageUrl.pathname}`;
+  }
+  generateState() {
+    if (!globalThis.crypto?.getRandomValues) {
+      throw new Error(`${this.providerLabel} sign-in requires crypto.getRandomValues.`);
+    }
+    const bytes = new Uint8Array(16);
+    globalThis.crypto.getRandomValues(bytes);
+    return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+  }
+  openPopup(browserWindow, url) {
+    const outerWidth = browserWindow.outerWidth || browserWindow.screen.width;
+    const outerHeight = browserWindow.outerHeight || browserWindow.screen.height;
+    const left = Math.max(0, (browserWindow.screenX || 0) + (outerWidth - POPUP_WIDTH) / 2);
+    const top = Math.max(0, (browserWindow.screenY || 0) + (outerHeight - POPUP_HEIGHT) / 2);
+    const popup = browserWindow.open(
+      url.toString(),
+      "mitra-google-oauth",
+      `width=${POPUP_WIDTH},height=${POPUP_HEIGHT},left=${left},top=${top},menubar=no,toolbar=no,status=no`
+    );
+    if (!popup) {
+      throw new Error(`${this.providerLabel} sign-in popup was blocked by the browser.`);
+    }
+    return popup;
+  }
+  waitForPopupResult(browserWindow, popup, expectedOrigin, expectedState) {
+    return new Promise((resolve, reject) => {
+      const timeout = globalThis.setTimeout(() => {
+        cleanup();
+        reject(new Error(`${this.providerLabel} sign-in timed out.`));
+      }, POPUP_TIMEOUT_MS);
+      const closedPoll = globalThis.setInterval(() => {
+        if (popup.closed) {
+          cleanup();
+          reject(new Error(`${this.providerLabel} sign-in was cancelled.`));
+        }
+      }, POPUP_CLOSED_POLL_MS);
+      const onMessage = (event) => {
+        if (event.origin !== expectedOrigin || event.source !== popup) return;
+        if (!event.data || typeof event.data !== "object") return;
+        const data = event.data;
+        if (data.type !== RESULT_TYPE) return;
+        if (data.state !== expectedState) {
+          cleanup();
+          reject(new Error(`Invalid ${this.providerLabel} sign-in state (possible CSRF).`));
+          return;
+        }
+        if (data.success !== true) {
+          cleanup();
+          reject(new Error(typeof data.error === "string" && data.error.trim() ? data.error : `${this.providerLabel} sign-in failed.`));
+          return;
+        }
+        const code = typeof data.code === "string" && data.code.trim() ? data.code : void 0;
+        if (!code && data.token === void 0) {
+          cleanup();
+          reject(new Error("Google auth page returned neither code nor token."));
+          return;
+        }
+        cleanup();
+        resolve({ ...code ? { code } : {}, ...data.token !== void 0 ? { token: data.token } : {} });
+      };
+      const cleanup = () => {
+        globalThis.clearTimeout(timeout);
+        globalThis.clearInterval(closedPoll);
+        browserWindow.removeEventListener("message", onMessage);
+        if (!popup.closed) popup.close();
+      };
+      browserWindow.addEventListener("message", onMessage);
+    });
+  }
+  persistRedirectContext(browserWindow, context) {
+    try {
+      browserWindow.sessionStorage.setItem(this.redirectStorageKey, JSON.stringify(context));
+    } catch {
+      throw new Error(`${this.providerLabel} sign-in redirect requires sessionStorage.`);
+    }
+  }
+  readRedirectContext(browserWindow) {
+    try {
+      const raw = browserWindow.sessionStorage.getItem(this.redirectStorageKey);
+      if (!raw) return null;
+      const value = JSON.parse(raw);
+      if (typeof value.state !== "string" || typeof value.redirectUri !== "string") return null;
+      return {
+        state: value.state,
+        redirectUri: value.redirectUri
+      };
+    } catch {
+      return null;
+    }
+  }
+  clearRedirectContext(browserWindow) {
+    try {
+      browserWindow.sessionStorage.removeItem(this.redirectStorageKey);
+    } catch {
+    }
+  }
+  cleanRedirectFragment(browserWindow) {
+    browserWindow.history.replaceState(
+      {},
+      "",
+      `${browserWindow.location.pathname}${browserWindow.location.search}`
+    );
+  }
+  requireBrowser() {
+    if (globalThis.window === void 0) {
+      throw new Error(`${this.providerLabel} sign-in is only available in a browser.`);
+    }
+    return globalThis.window;
+  }
+};
+
+// src/modules/auth.ts
+var DEFAULT_TOKEN_VALIDITY_MS = 3e4;
+var sessionPorts = /* @__PURE__ */ new WeakMap();
+function getAuthSessionPort(auth) {
+  const port = sessionPorts.get(auth);
+  if (!port) throw new Error("Auth session port is unavailable.");
+  return port;
+}
+function decodeJwtPayload(token) {
+  try {
+    const part = token.replace(/^Bearer\s+/i, "").split(".")[1];
+    if (!part || typeof globalThis.atob !== "function") return null;
+    const base64 = part.replaceAll("-", "+").replaceAll("_", "/");
+    const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
+    const value = JSON.parse(globalThis.atob(padded));
+    if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+    return value;
+  } catch {
+    return null;
+  }
+}
+function belongsToApp(token, appId) {
+  const payload = decodeJwtPayload(token);
+  if (!payload) return true;
+  return payload.app_id === appId;
+}
+function isTokenExpiring(token, minValidityMs) {
+  const exp = decodeJwtPayload(token)?.exp;
+  if (typeof exp !== "number" || !Number.isFinite(exp)) return false;
+  return exp * 1e3 - Date.now() < minValidityMs;
+}
+function isDefinitiveRefreshFailure(error) {
+  return error instanceof MitraApiError && error.status >= 400 && error.status < 500 && error.status !== 408 && error.status !== 429;
+}
+var AuthModule = class {
+  appId;
+  _currentUser = null;
+  #accessToken = null;
+  #refreshToken = null;
+  sessionGeneration = 0;
+  refreshFlight = null;
+  transientRefreshFailureGeneration = null;
+  listeners = /* @__PURE__ */ new Set();
+  sessionListeners = /* @__PURE__ */ new Set();
+  storageKey;
+  publicClient;
+  authedClient;
+  currentUserApi;
+  googleAuth;
+  microsoftAuth;
+  constructor(appId, iamBaseUrl, options = {}) {
+    this.appId = appId;
+    const trimmedIamBaseUrl = stripTrailingSlashes(iamBaseUrl);
+    const apiUrl = stripTrailingSlashes(
+      options.apiUrl ?? (trimmedIamBaseUrl.endsWith("/iam") ? trimmedIamBaseUrl.slice(0, -"/iam".length) : trimmedIamBaseUrl)
+    );
+    this.storageKey = `mitra_auth_${appId}`;
+    this.publicClient = new HttpClient({ baseUrl: iamBaseUrl, getToken: () => null });
+    this.authedClient = new HttpClient({
+      baseUrl: iamBaseUrl,
+      getToken: () => this.#accessToken,
+      beforeAuthenticatedRequest: () => this.ensureFreshSession().then(() => void 0),
+      onUnauthorized: (requestToken) => this.handleUnauthorized(requestToken)
+    });
+    this.currentUserApi = (0, import_sdk_core2.createAuthModule)(this.authedClient, coreErrors);
+    this.googleAuth = new GoogleAuthFlow({
+      appId,
+      apiUrl,
+      authPageUrl: options.authPageUrl,
+      client: this.publicClient
+    });
+    this.microsoftAuth = new GoogleAuthFlow({
+      appId,
+      apiUrl,
+      authPageUrl: options.authPageUrl,
+      client: this.publicClient,
+      provider: "microsoft"
+    });
+    this.loadFromStorage();
+    const readAccessToken = () => this.#accessToken;
+    sessionPorts.set(this, {
+      get accessToken() {
+        return readAccessToken();
+      },
+      ensureFreshSession: (minValidityMs) => this.ensureFreshSession(minValidityMs),
+      handleUnauthorized: (requestToken) => this.handleUnauthorized(requestToken),
+      readSessionTokens: () => this.readSessionTokens(),
+      onSessionChange: (callback) => this.onSessionChange(callback),
+      adoptSession: (session) => this.adoptSession(session)
+    });
+  }
+  /** The currently authenticated user, or null. */
+  get currentUser() {
+    return this._currentUser;
+  }
+  /** The current JWT access token, or null. */
+  get accessToken() {
+    return this.#accessToken;
+  }
+  /** Whether a user is currently authenticated (local check, not server-validated). */
+  get isAuthenticated() {
+    return this._currentUser !== null && this.#accessToken !== null;
+  }
+  /** @deprecated Email/password authentication is not implemented by IAM. Use Google or Microsoft SSO. */
+  async signIn(_credentials) {
+    throw new MitraApiError(
+      "Email/password authentication is not available. Use signInWithGoogle() or signInWithMicrosoft().",
+      0,
+      "UNSUPPORTED_AUTH_METHOD"
+    );
+  }
+  /**
+   * Signs in with Google SSO.
+   *
+   * Popup mode is used by default. Redirect mode stores a one-time CSRF context
+   * in `sessionStorage` and navigates to the configured `sdk-auth.html` page.
+   * Call {@link completeGoogleSignInRedirect} during application startup to
+   * finish a redirect response.
+   *
+   * The auth page is resolved from `createClient({ authPageUrl })`, then
+   * `window.__mitraEnv.authPageUrl`, and finally `/sdk-auth.html` on the API
+   * gateway origin.
+   *
+   * @param options - Popup or redirect mode.
+   * @returns The authenticated and hydrated user in popup mode.
+   * @throws {MitraApiError} When IAM rejects the authorization code.
+   * @throws {Error} When the browser blocks or cancels the popup, the flow times
+   * out, or the OAuth response fails origin, source, state, or shape validation.
+   *
+   * @example
+   * ```typescript
+   * const user = await mitra.auth.signInWithGoogle();
+   * ```
+   *
+   * @example
+   * ```typescript
+   * await mitra.auth.signInWithGoogle({ mode: 'redirect' });
+   * ```
+   */
+  async signInWithGoogle(options = {}) {
+    return this.establishSession(await this.googleAuth.signIn(options));
+  }
+  /**
+   * Completes a Google redirect response from `#codeMitra` and `#stateMitra`.
+   *
+   * The method consumes and clears the fragment and stored CSRF context, sends
+   * the single-use code directly to IAM, persists both tokens, calls `auth.me()`,
+   * and notifies auth-state listeners. It returns `null` when the current URL is
+   * not a Google SSO redirect. Redirect errors must carry the same `stateMitra`
+   * stored at the start of the flow before their message is exposed or consumed.
+   *
+   * @returns The authenticated user, or `null` when no redirect result is present.
+   *
+   * @example
+   * ```typescript
+   * const redirectedUser = await mitra.auth.completeGoogleSignInRedirect();
+   * if (redirectedUser) console.log(redirectedUser.email);
+   * ```
+   */
+  async completeGoogleSignInRedirect() {
+    const tokenResponse = await this.googleAuth.completeRedirect();
+    return tokenResponse ? this.establishSession(tokenResponse) : null;
+  }
+  /**
+   * Signs in with Microsoft SSO: the same auth-page handshake as Google, exchanged
+   * at IAM's `/auth/microsoft`. Popup by default; redirect mode navigates away.
+   *
+   * @example
+   * ```typescript
+   * const user = await mitra.auth.signInWithMicrosoft();
+   * ```
+   */
+  async signInWithMicrosoft(options = {}) {
+    return this.establishSession(await this.microsoftAuth.signIn(options));
+  }
+  /**
+   * Completes a Microsoft redirect response from `#codeMitra` and `#stateMitra`.
+   * Mirrors {@link completeGoogleSignInRedirect}; returns `null` when the current
+   * URL is not a Microsoft SSO redirect.
+   */
+  async completeMicrosoftSignInRedirect() {
+    const tokenResponse = await this.microsoftAuth.completeRedirect();
+    return tokenResponse ? this.establishSession(tokenResponse) : null;
+  }
+  /** @deprecated Email/password registration is not implemented by IAM. Use Google or Microsoft SSO. */
+  async signUp(_data) {
+    throw new MitraApiError(
+      "Email/password registration is not available. Use signInWithGoogle() or signInWithMicrosoft().",
+      0,
+      "UNSUPPORTED_AUTH_METHOD"
+    );
+  }
+  /**
+   * Signs out the current user, clearing all auth state and localStorage.
+   *
+   * @param redirectUrl - Optional URL to navigate to after sign-out.
+   *
+   * @example
+   * ```typescript
+   * mitra.auth.signOut();
+   * mitra.auth.signOut('/login');
+   * ```
+   */
+  signOut(redirectUrl) {
+    this.clearAuthState();
+    if (globalThis.window !== void 0 && redirectUrl) {
+      globalThis.window.location.href = redirectUrl;
+    }
+  }
+  /**
+   * Refreshes the session using the stored refresh token.
+   *
+   * Called automatically before requests whose JWT is close to expiry and on
+   * `401` responses. Can also be called manually. Multiple proactive, reactive,
+   * and manual calls are deduplicated into one refresh request.
+   *
+   * @returns `true` if refresh succeeded, `false` otherwise.
+   *
+   * @example
+   * ```typescript
+   * const ok = await mitra.auth.refreshSession();
+   * if (!ok) mitra.auth.redirectToLogin();
+   * ```
+   */
+  async refreshSession() {
+    if (!this.#refreshToken) return false;
+    if (!this.hasValidAppIdentity()) {
+      this.clearAuthState();
+      return false;
+    }
+    const generation = this.sessionGeneration;
+    if (this.refreshFlight?.generation === generation) {
+      return this.refreshFlight.promise;
+    }
+    this.transientRefreshFailureGeneration = null;
+    const flight = {
+      generation,
+      promise: this.doRefresh(generation, this.#refreshToken)
+    };
+    this.refreshFlight = flight;
+    try {
+      return await flight.promise;
+    } finally {
+      if (this.refreshFlight === flight) {
+        this.refreshFlight = null;
+      }
+    }
+  }
+  /**
+   * Resolves a 401 against the credential that actually reached the server.
+   * A newer session is retried as-is instead of being refreshed because of an
+   * older request. A signed-out session is neither refreshed nor retried.
+   *
+   * @param requestToken - Access token attached to the rejected request.
+   * @returns Whether the request should be retried once with the current token.
+   *
+   * @internal
+   */
+  async handleUnauthorized(requestToken) {
+    const currentToken = this.#accessToken;
+    if (!currentToken) return false;
+    if (currentToken !== requestToken) return true;
+    return this.refreshSession();
+  }
+  /**
+   * Fetches the current user from the server and updates local state.
+   *
+   * Clears auth state on a definitive 401. When the request reaches 401 after
+   * IAM refresh failed due to a network error, 408, 429, or 5xx response, the
+   * retained session is preserved and this method returns null.
+   *
+   * @returns The user if authenticated, `null` otherwise.
+   *
+   * @example
+   * ```typescript
+   * const user = await mitra.auth.me();
+   * if (!user) console.log('Not authenticated');
+   * ```
+   */
+  async me() {
+    if (!this.#accessToken) return null;
+    const generation = this.sessionGeneration;
+    try {
+      const user = await this.getCurrentUser();
+      if (generation !== this.sessionGeneration) return null;
+      this._currentUser = user;
+      this.transientRefreshFailureGeneration = null;
+      this.saveToStorage();
+      this.notifyListeners();
+      return user;
+    } catch (error) {
+      if (error instanceof MitraApiError && error.status === 401 && this.#accessToken && generation === this.sessionGeneration && this.transientRefreshFailureGeneration !== this.sessionGeneration) {
+        this.clearAuthState();
+      }
+      return null;
+    }
+  }
+  /**
+   * Validates the current session with the server.
+   *
+   * @returns `true` if the session is valid, `false` otherwise.
+   *
+   * @example
+   * ```typescript
+   * const valid = await mitra.auth.checkAuth();
+   * if (!valid) mitra.auth.redirectToLogin();
+   * ```
+   */
+  async checkAuth() {
+    return await this.me() !== null;
+  }
+  /**
+   * Sets the access token manually (e.g., from SSO/OAuth callback).
+   *
+   * Call `me()` afterwards to fetch the associated user data.
+   *
+   * @param token - JWT access token.
+   * @param saveToStorage - Whether to persist to localStorage (default: true).
+   *
+   * @example
+   * ```typescript
+   * mitra.auth.setToken(tokenFromCallback);
+   * await mitra.auth.me();
+   * ```
+   */
+  setToken(token, saveToStorage = true) {
+    if (!this.belongsToConfiguredApp(token)) {
+      this.clearAuthState();
+      return;
+    }
+    this.invalidatePendingRefreshes();
+    this.#accessToken = token;
+    if (saveToStorage) {
+      this.saveToStorage();
+    }
+    this.notifySessionListeners();
+  }
+  /**
+   * Reads the tokens currently held by this module.
+   *
+   * Used by the legacy session bridge to hand a session persisted by this SDK
+   * over to `mitra-interactions-sdk` on startup.
+   *
+   * @returns The access and refresh tokens, each `null` when absent.
+   *
+   * @internal
+   */
+  readSessionTokens() {
+    return { token: this.#accessToken, refreshToken: this.#refreshToken };
+  }
+  /**
+   * Adopts an app-scoped session received from a trusted platform boundary.
+   *
+   * This preserves the access and refresh tokens together so the normal refresh
+   * lifecycle continues after an embedded preview hands its session to the app.
+   * Call {@link checkAuth} afterward to validate the token and hydrate the user.
+   */
+  setSession(session) {
+    return this.adoptSession({
+      token: session.accessToken,
+      refreshToken: session.refreshToken ?? null
+    });
+  }
+  /**
+   * Ensures the current access token has enough remaining validity.
+   *
+   * JWT decoding is used only as a scheduling heuristic. Opaque tokens and JWTs
+   * without a numeric `exp` claim proceed unchanged and remain server-authoritative.
+   * Multiple proactive and reactive callers share the same refresh request.
+   * Transient refresh failures preserve the current session so the caller can
+   * continue and rely on the normal one-time `401` refresh fallback.
+   *
+   * This method is suitable for authenticated HTTP, WebSocket, and Server-Sent
+   * Events boundaries that need a fresh token before connecting.
+   *
+   * @param minValidityMs - Minimum remaining token lifetime. Defaults to 30 seconds.
+   * @returns `true` when no refresh is needed or refresh succeeds. Returns
+   * `false` when a required refresh fails, even when a transient failure keeps
+   * the current session available for a reactive server-authoritative fallback.
+   */
+  async ensureFreshSession(minValidityMs = DEFAULT_TOKEN_VALIDITY_MS) {
+    if (!Number.isFinite(minValidityMs) || minValidityMs < 0) {
+      throw new RangeError("minValidityMs must be a finite non-negative number");
+    }
+    if (!this.#accessToken) return false;
+    if (!this.hasValidAppIdentity()) {
+      this.clearAuthState();
+      return false;
+    }
+    if (!isTokenExpiring(this.#accessToken, minValidityMs)) return true;
+    return this.refreshSession();
+  }
+  /**
+   * Subscribes an internal boundary to token changes without triggering login
+   * or refresh. Unlike auth-state listeners, this callback is not invoked
+   * immediately and does not depend on the user being hydrated.
+   *
+   * @param callback - Receives the current access and refresh tokens.
+   * @returns A function that removes the callback.
+   *
+   * @internal
+   */
+  onSessionChange(callback) {
+    this.sessionListeners.add(callback);
+    return () => this.sessionListeners.delete(callback);
+  }
+  /**
+   * Adopts a session produced outside this module, such as a legacy SSO login.
+   *
+   * Replaces the in-memory tokens and persists them under the same storage key
+   * the rest of the module uses. The current user is left untouched because the
+   * legacy SDK does not return one; call `me()` to hydrate it.
+   *
+   * @param session - Access token and, when the issuer returned one, refresh token.
+   *
+   * @internal
+   */
+  adoptSession(session) {
+    if (!this.belongsToConfiguredApp(session.token) || typeof session.refreshToken === "string" && !this.belongsToConfiguredApp(session.refreshToken)) {
+      this.clearAuthState();
+      return false;
+    }
+    this.invalidatePendingRefreshes();
+    this.#accessToken = session.token;
+    if (session.refreshToken !== void 0) {
+      this.#refreshToken = session.refreshToken;
+    }
+    this.saveToStorage();
+    this.notifySessionListeners();
+    return true;
+  }
+  /**
+   * Redirects to `/login?returnUrl=...` for unauthenticated users.
+   *
+   * @param returnUrl - URL to return to after login (default: '/').
+   *
+   * @example
+   * ```typescript
+   * if (!mitra.auth.isAuthenticated) {
+   *   mitra.auth.redirectToLogin(window.location.pathname);
+   * }
+   * ```
+   */
+  redirectToLogin(returnUrl = "/") {
+    if (globalThis.window === void 0) return;
+    globalThis.window.location.href = `/login?returnUrl=${encodeURIComponent(returnUrl)}`;
+  }
+  /**
+   * Registers a callback for auth state changes.
+   *
+   * Called immediately with the current state, then on every sign-in/sign-out.
+   *
+   * @param callback - Receives the User on login, null on logout.
+   * @returns Unsubscribe function.
+   *
+   * @example
+   * ```typescript
+   * useEffect(() => {
+   *   const unsub = mitra.auth.onAuthStateChange((user) => {
+   *     setUser(user);
+   *     setLoading(false);
+   *   });
+   *   return unsub;
+   * }, []);
+   * ```
+   */
+  onAuthStateChange(callback) {
+    this.listeners.add(callback);
+    callback(this._currentUser);
+    return () => {
+      this.listeners.delete(callback);
+    };
+  }
+  async doRefresh(generation, refreshToken) {
+    let tokenResponse;
+    try {
+      tokenResponse = expectAuthTokenResponse(
+        await this.publicClient.post(
+          "/api/v1/auth/refresh-token",
+          { refreshToken }
+        )
+      );
+    } catch (error) {
+      if (generation !== this.sessionGeneration) return false;
+      if (isDefinitiveRefreshFailure(error)) {
+        this.clearAuthState();
+      } else {
+        this.transientRefreshFailureGeneration = generation;
+      }
+      return false;
+    }
+    if (generation !== this.sessionGeneration) return false;
+    if (!this.belongsToConfiguredApp(tokenResponse.accessToken) || !this.belongsToConfiguredApp(tokenResponse.refreshToken)) {
+      this.clearAuthState();
+      return false;
+    }
+    this.#accessToken = tokenResponse.accessToken;
+    this.#refreshToken = tokenResponse.refreshToken;
+    this.transientRefreshFailureGeneration = null;
+    this.saveToStorage();
+    this.notifySessionListeners();
+    return true;
+  }
+  async establishSession(tokenResponse) {
+    if (!this.belongsToConfiguredApp(tokenResponse.accessToken) || !this.belongsToConfiguredApp(tokenResponse.refreshToken)) {
+      this.clearAuthState();
+      throw coreErrors.invalidResponse("Authentication returned a token for a different app");
+    }
+    this.invalidatePendingRefreshes();
+    const generation = this.sessionGeneration;
+    this.#accessToken = tokenResponse.accessToken;
+    this.#refreshToken = tokenResponse.refreshToken;
+    try {
+      const user = await this.getCurrentUser();
+      if (generation !== this.sessionGeneration) {
+        throw new Error("Authentication session was superseded");
+      }
+      this.setAuthState(user, this.#accessToken, this.#refreshToken);
+      return user;
+    } catch (error) {
+      if (generation === this.sessionGeneration) {
+        this.clearAuthState();
+      }
+      throw error;
+    }
+  }
+  setAuthState(user, token, refreshToken) {
+    this._currentUser = user;
+    this.#accessToken = token;
+    this.#refreshToken = refreshToken;
+    this.saveToStorage();
+    this.notifySessionListeners();
+    this.notifyListeners();
+  }
+  async getCurrentUser() {
+    const user = await this.currentUserApi.me();
+    return { ...user, tenantId: user.tenant.id };
+  }
+  clearAuthState() {
+    const hadAuthState = this._currentUser !== null || this.#accessToken !== null || this.#refreshToken !== null;
+    this.invalidatePendingRefreshes();
+    this._currentUser = null;
+    this.#accessToken = null;
+    this.#refreshToken = null;
+    this.removeFromStorage();
+    if (hadAuthState) {
+      this.notifySessionListeners();
+      this.notifyListeners();
+    }
+  }
+  invalidatePendingRefreshes() {
+    this.sessionGeneration += 1;
+    this.transientRefreshFailureGeneration = null;
+  }
+  hasValidAppIdentity() {
+    return (!this.#accessToken || this.belongsToConfiguredApp(this.#accessToken)) && (!this.#refreshToken || this.belongsToConfiguredApp(this.#refreshToken));
+  }
+  belongsToConfiguredApp(token) {
+    return belongsToApp(token, this.appId);
+  }
+  notifySessionListeners() {
+    const session = this.readSessionTokens();
+    this.sessionListeners.forEach((callback) => {
+      try {
+        callback(session);
+      } catch {
+      }
+    });
+  }
+  notifyListeners() {
+    this.listeners.forEach((callback) => {
+      try {
+        callback(this._currentUser);
+      } catch (error) {
+        console.error("Auth state change listener error:", error);
+      }
+    });
+  }
+  saveToStorage() {
+    if (typeof localStorage === "undefined") return;
+    try {
+      localStorage.setItem(
+        this.storageKey,
+        JSON.stringify({
+          user: this._currentUser,
+          token: this.#accessToken,
+          refreshToken: this.#refreshToken
+        })
+      );
+    } catch {
+    }
+  }
+  loadFromStorage() {
+    if (typeof localStorage === "undefined") return;
+    try {
+      const stored = localStorage.getItem(this.storageKey);
+      if (stored) {
+        const { user, token, refreshToken } = JSON.parse(stored);
+        if (typeof token !== "string" || refreshToken !== null && refreshToken !== void 0 && typeof refreshToken !== "string" || !this.belongsToConfiguredApp(token) || typeof refreshToken === "string" && !this.belongsToConfiguredApp(refreshToken)) {
+          this.clearAuthState();
+          return;
+        }
+        this._currentUser = user;
+        this.#accessToken = token;
+        this.#refreshToken = refreshToken ?? null;
+        this.invalidatePendingRefreshes();
+      }
+    } catch {
+      this.removeFromStorage();
+    }
+  }
+  removeFromStorage() {
+    if (typeof localStorage === "undefined") return;
+    try {
+      localStorage.removeItem(this.storageKey);
+    } catch {
+    }
+  }
+};
+
+// src/modules/entities.ts
+var import_sdk_core3 = require("@mitralab.io/sdk-core");
+var EntitiesModule = class _EntitiesModule {
+  constructor(httpClient, _dataSourceId) {
+    this.httpClient = httpClient;
+    this.core = (0, import_sdk_core3.createEntitiesModule)(httpClient, coreErrors);
+  }
+  core;
+  static createProxy(httpClient, dataSourceId) {
+    const instance = new _EntitiesModule(httpClient, dataSourceId);
+    return new Proxy(instance, {
+      get(target, property, receiver) {
+        if (typeof property !== "string" || property in target) {
+          return Reflect.get(target, property, receiver);
+        }
+        return target.getTable(property);
+      }
+    });
+  }
+  /**
+   * Preserved for Platform SDK 1.x compatibility.
+   * Records now resolve the app from authenticated context instead of a data source path.
+   */
+  setDataSourceId(_dataSourceId) {
+    this.core = (0, import_sdk_core3.createEntitiesModule)(this.httpClient, coreErrors);
+  }
+  getTable(tableName) {
+    return this.core.getTable(tableName);
+  }
+};
+
+// src/modules/functions.ts
+var import_sdk_core4 = require("@mitralab.io/sdk-core");
+var FunctionsModule = class {
+  core;
+  constructor(httpClient) {
+    this.core = (0, import_sdk_core4.createFunctionsModule)(
+      httpClient,
+      { emptyInput: "omit-body", executeInvocationType: "sync" },
+      coreErrors
+    );
+  }
+  /**
+   * Executes a Function synchronously and waits for its terminal result.
+   */
+  async execute(functionId, input) {
+    return this.core.execute(functionId, input);
+  }
+  /** Queues a Function and returns its initial execution record. */
+  async executeAsync(functionId, input) {
+    return this.core.executeAsync(functionId, input);
+  }
+  /** Reads the current state of an asynchronous Function execution. */
+  async getExecution(executionId) {
+    return this.core.getExecution(executionId);
+  }
+  /** Requests cancellation of a queued or running Function execution. */
+  cancelExecution(executionId) {
+    return this.core.cancelExecution(executionId);
+  }
+};
+
+// src/modules/integration.ts
+var import_sdk_core5 = require("@mitralab.io/sdk-core");
+var IntegrationModule = class {
+  core;
+  configs;
+  constructor(httpClient) {
+    this.core = (0, import_sdk_core5.createIntegrationModule)(httpClient, coreErrors);
+    this.configs = (0, import_sdk_core5.createIntegrationAdminModule)(httpClient, coreErrors);
+  }
+  /** Lists the current app's integration configs without exposing admin mutations. */
+  list(options) {
+    return this.configs.list(options);
+  }
+  executeResource(resourceId, params) {
+    return this.core.executeResource(resourceId, params);
+  }
+  execute(configId, request) {
+    return this.core.execute(configId, request);
+  }
+  /** Executes a saved integration config selected by its app-scoped alias. */
+  executeByAlias(alias, request) {
+    return this.core.executeByAlias(alias, request);
+  }
+};
+
+// src/modules/queries.ts
+var import_sdk_core6 = require("@mitralab.io/sdk-core");
+var QueriesModule = class {
+  core;
+  constructor(httpClient) {
+    this.core = (0, import_sdk_core6.createQueriesModule)(httpClient, coreErrors);
+  }
+  /**
+   * @deprecated Preserved for Platform SDK 1.x source compatibility. Data Manager now resolves
+   * the Data Source from the authenticated app.
+   */
+  setDataSourceId(_dataSourceId) {
+  }
+  async execute(id, parameters) {
+    return this.core.execute(id, parameters);
+  }
+};
+
+// src/modules/agent-tasks.ts
+var import_sdk_core7 = require("@mitralab.io/sdk-core");
+
+// src/modules/agent-session.ts
+var CONNECT_TIMEOUT_MS = 15e3;
+function stripBearer2(token) {
+  return token.replace(/^Bearer\s+/i, "");
+}
+function asObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function expectEvent(value) {
+  const event = asObject(value);
+  if (!event || typeof event.type !== "string" || !event.type) return null;
+  if (typeof event.timestamp !== "number" || !Number.isFinite(event.timestamp)) return null;
+  if (event.sequence !== void 0 && (typeof event.sequence !== "number" || !Number.isSafeInteger(event.sequence) || event.sequence < 0)) return null;
+  return {
+    type: event.type,
+    payload: event.payload,
+    timestamp: event.timestamp,
+    ...typeof event.sequence === "number" ? { sequence: event.sequence } : {}
+  };
+}
+function parseEvent(raw) {
+  if (typeof raw !== "string") return expectEvent(raw);
+  try {
+    return expectEvent(JSON.parse(raw));
+  } catch {
+    return null;
+  }
+}
+function isNormalClose(event) {
+  return event.code === 1e3 || event.code === 4409;
+}
+var BrowserAgentTaskEventSource = class {
+  constructor(auth, apiUrl) {
+    this.auth = auth;
+    this.apiUrl = stripTrailingSlashes(apiUrl);
+  }
+  apiUrl;
+  sseFallbackTasks = /* @__PURE__ */ new Set();
+  async open(taskId, observer, signal, transport = "auto") {
+    if (transport === "http") return this.openSse(taskId, observer, signal);
+    if (transport === "websocket") return this.openWebSocket(taskId, observer, signal);
+    if (this.sseFallbackTasks.has(taskId)) {
+      return this.wrapAutoConnection(taskId, await this.openSse(taskId, observer, signal));
+    }
+    try {
+      const connection = await this.openWebSocket(taskId, {
+        ...observer,
+        onDisconnect: (error) => {
+          this.sseFallbackTasks.add(taskId);
+          observer.onDisconnect(error);
+        }
+      }, signal);
+      return this.wrapAutoConnection(taskId, connection);
+    } catch {
+      this.sseFallbackTasks.add(taskId);
+      return this.wrapAutoConnection(taskId, await this.openSse(taskId, observer, signal));
+    }
+  }
+  wrapAutoConnection(taskId, connection) {
+    return {
+      close: () => {
+        this.sseFallbackTasks.delete(taskId);
+        connection.close();
+      }
+    };
+  }
+  async requireFreshToken() {
+    const fresh = await this.auth.ensureFreshSession();
+    const token = this.auth.accessToken;
+    if (!fresh || !token) {
+      throw new Error("A fresh authenticated app session is required for Agent streaming.");
+    }
+    return token;
+  }
+  async openWebSocket(taskId, observer, signal) {
+    if (typeof globalThis.WebSocket !== "function") {
+      throw new TypeError("WebSocket is not available.");
+    }
+    if (signal?.aborted) throw signal.reason ?? new Error("Agent WebSocket connection aborted.");
+    const token = await this.requireFreshToken();
+    const url = `${this.apiUrl.replace(/^http/i, "ws")}/copilot/ws/tasks/${encodeURIComponent(taskId)}?token=${encodeURIComponent(stripBearer2(token))}`;
+    return new Promise((resolve, reject) => {
+      const socket = new globalThis.WebSocket(url);
+      let opened = false;
+      let intentionalClose = false;
+      let settled = false;
+      const removeAbortListener = () => signal?.removeEventListener("abort", onAbort);
+      const clearHandshake = () => {
+        globalThis.clearTimeout(timer);
+        removeAbortListener();
+      };
+      const rejectHandshake = (error) => {
+        if (settled) return;
+        settled = true;
+        intentionalClose = true;
+        clearHandshake();
+        socket.close();
+        reject(error);
+      };
+      const close = () => {
+        if (intentionalClose) return;
+        intentionalClose = true;
+        removeAbortListener();
+        socket.close(1e3, "Client closed");
+      };
+      const onAbort = () => {
+        if (!opened) {
+          rejectHandshake(signal?.reason instanceof Error ? signal.reason : new Error("Agent WebSocket connection aborted."));
+          return;
+        }
+        close();
+      };
+      const timer = globalThis.setTimeout(() => {
+        rejectHandshake(new Error("Timed out connecting to the Agent WebSocket."));
+      }, CONNECT_TIMEOUT_MS);
+      signal?.addEventListener("abort", onAbort, { once: true });
+      socket.onopen = () => {
+        if (settled) return;
+        opened = true;
+        settled = true;
+        globalThis.clearTimeout(timer);
+        resolve({ close });
+      };
+      socket.onerror = () => {
+        if (!opened) rejectHandshake(new Error("Failed to connect to the Agent WebSocket."));
+      };
+      socket.onmessage = (message) => {
+        const event = parseEvent(message.data);
+        if (event) observer.onEvent(event);
+      };
+      socket.onclose = (event) => {
+        globalThis.clearTimeout(timer);
+        removeAbortListener();
+        if (!opened) {
+          rejectHandshake(new Error(`Agent WebSocket closed during handshake (${event.code}).`));
+          return;
+        }
+        if (!intentionalClose && !isNormalClose(event)) {
+          observer.onDisconnect(new Error(`Agent WebSocket disconnected (${event.code}).`));
+        }
+      };
+    });
+  }
+  async openSse(taskId, observer, signal) {
+    if (signal?.aborted) throw signal.reason ?? new Error("Agent SSE connection aborted.");
+    const requestToken = await this.requireFreshToken();
+    const abort = new AbortController();
+    let intentionalClose = false;
+    let disconnected = false;
+    const url = `${this.apiUrl}/copilot/api/v1/tasks/${encodeURIComponent(taskId)}/events`;
+    const request = (token) => globalThis.fetch(url, {
+      headers: { Accept: "text/event-stream", Authorization: `Bearer ${stripBearer2(token)}` },
+      signal: abort.signal
+    });
+    const onAbort = () => {
+      intentionalClose = true;
+      abort.abort(signal?.reason);
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+    let response = await request(requestToken);
+    if (response.status === 401 && await this.auth.handleUnauthorized(requestToken)) {
+      const currentToken = this.auth.accessToken;
+      if (currentToken) response = await request(currentToken);
+    }
+    if (!response.ok || !response.body) {
+      signal?.removeEventListener("abort", onAbort);
+      abort.abort();
+      throw new Error(`Agent SSE connection failed (${response.status}).`);
+    }
+    const disconnect = (error) => {
+      if (disconnected || intentionalClose || signal?.aborted) return;
+      disconnected = true;
+      observer.onDisconnect(error);
+    };
+    void this.readSse(response.body, observer, abort.signal).then(() => disconnect()).catch((error) => disconnect(error)).finally(() => signal?.removeEventListener("abort", onAbort));
+    return {
+      close: () => {
+        if (intentionalClose) return;
+        intentionalClose = true;
+        signal?.removeEventListener("abort", onAbort);
+        abort.abort();
+      }
+    };
+  }
+  async readSse(body, observer, signal) {
+    const reader = body.getReader();
+    const decoder = new TextDecoder();
+    let buffer = "";
+    try {
+      while (!signal.aborted) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        buffer += decoder.decode(value, { stream: true });
+        let separator = /\r?\n\r?\n/.exec(buffer);
+        while (separator?.index !== void 0) {
+          const block = buffer.slice(0, separator.index);
+          buffer = buffer.slice(separator.index + separator[0].length);
+          const data = block.split(/\r?\n/).filter((line) => line.startsWith("data:")).map((line) => line.slice(5).trimStart()).join("\n");
+          const event = data ? parseEvent(data) : null;
+          if (event) observer.onEvent(event);
+          separator = /\r?\n\r?\n/.exec(buffer);
+        }
+      }
+    } finally {
+      reader.releaseLock();
+    }
+  }
+};
+
+// src/modules/agent-tasks.ts
+function createBrowserAgentTasksModule(httpClient, auth, apiUrl) {
+  const tasks = (0, import_sdk_core7.createAgentTasksModule)(httpClient, coreErrors);
+  const manager = (0, import_sdk_core7.createAgentTaskSessionManager)({
+    tasks,
+    eventSource: new BrowserAgentTaskEventSource(auth, apiUrl)
+  });
+  return (0, import_sdk_core7.withAgentTaskSessions)(tasks, manager);
+}
+
+// src/modules/agent-credentials.ts
+var import_sdk_core8 = require("@mitralab.io/sdk-core");
+function requireProvider(provider, allowed, flow) {
+  if (!allowed.includes(provider)) {
+    throw new TypeError(`${flow} does not support provider ${provider}.`);
+  }
+}
+function createBrowserAgentCredentialsModule(httpClient) {
+  const core = (0, import_sdk_core8.createAgentCredentialsModule)(httpClient, coreErrors);
+  return {
+    list: () => core.list(),
+    listModels: (agentId) => core.listModels(agentId),
+    saveApiKey: (provider, apiKey) => {
+      requireProvider(provider, ["ANTHROPIC", "OPENAI"], "API key authentication");
+      return core.saveApiKey(provider, apiKey);
+    },
+    remove: (provider) => {
+      requireProvider(provider, ["ANTHROPIC", "OPENAI"], "Credential removal");
+      return core.remove(provider);
+    },
+    startOAuth: (provider) => {
+      requireProvider(provider, ["ANTHROPIC"], "OAuth");
+      return core.startOAuth(provider);
+    },
+    exchangeOAuth: (provider, input) => {
+      requireProvider(provider, ["ANTHROPIC"], "OAuth");
+      return core.exchangeOAuth(provider, input);
+    },
+    startDeviceAuthorization: (provider) => {
+      requireProvider(provider, ["OPENAI"], "Device authorization");
+      return core.startDeviceAuthorization(provider);
+    },
+    pollDeviceAuthorization: (provider, deviceAuthId) => {
+      requireProvider(provider, ["OPENAI"], "Device authorization");
+      return core.pollDeviceAuthorization(provider, deviceAuthId);
+    }
+  };
+}
+
+// src/client.ts
+function expectAppInfoResponse(value) {
+  const response = (0, import_sdk_core9.expectObject)(
+    value,
+    "App info response",
+    coreErrors
+  );
+  if (response.dataSourceId !== null && (typeof response.dataSourceId !== "string" || !response.dataSourceId.trim())) {
+    throw coreErrors.invalidResponse(
+      "App info response has an invalid dataSourceId field"
+    );
+  }
+  if (typeof response.allowSignup !== "boolean") {
+    throw coreErrors.invalidResponse(
+      "App info response has an invalid allowSignup field"
+    );
+  }
+  return {
+    dataSourceId: response.dataSourceId,
+    allowSignup: response.allowSignup
+  };
+}
+function createClient(config) {
+  const { appId, apiUrl, authPageUrl, onError } = config;
+  const gatewayUrl = stripTrailingSlashes(apiUrl);
+  const iamUrl = `${gatewayUrl}/iam`;
+  const dataManagerUrl = `${gatewayUrl}/data-manager`;
+  const functionsUrl = `${gatewayUrl}/functions`;
+  const integrationUrl = `${gatewayUrl}/integration`;
+  const codeStudioUrl = `${gatewayUrl}/code-studio`;
+  const copilotUrl = `${gatewayUrl}/copilot`;
+  const authModule = new AuthModule(appId, iamUrl, { apiUrl: gatewayUrl, authPageUrl });
+  const authSession = getAuthSessionPort(authModule);
+  const onUnauthorized = (requestToken) => authSession.handleUnauthorized(requestToken);
+  const beforeAuthenticatedRequest = () => authModule.ensureFreshSession().then(() => void 0);
+  const defaultHeaders = { "X-App-Id": appId };
+  const httpClient = new HttpClient({
+    baseUrl: dataManagerUrl,
+    getToken: () => authModule.accessToken,
+    beforeAuthenticatedRequest,
+    onUnauthorized,
+    onError,
+    defaultHeaders
+  });
+  const entitiesModule = EntitiesModule.createProxy(httpClient, "");
+  const functionsHttpClient = new HttpClient({
+    baseUrl: functionsUrl,
+    getToken: () => authModule.accessToken,
+    beforeAuthenticatedRequest,
+    onUnauthorized,
+    onError,
+    defaultHeaders
+  });
+  const functionsModule = new FunctionsModule(functionsHttpClient);
+  const publicFunctionsModule = (0, import_sdk_core9.createPublicFunctionsModule)(
+    new HttpClient({ baseUrl: functionsUrl, getToken: () => null }),
+    coreErrors
+  );
+  const copilotHttpClient = new HttpClient({
+    baseUrl: copilotUrl,
+    getToken: () => authModule.accessToken,
+    beforeAuthenticatedRequest,
+    onUnauthorized,
+    onError,
+    defaultHeaders
+  });
+  const agentTasksModule = createBrowserAgentTasksModule(
+    copilotHttpClient,
+    authSession,
+    gatewayUrl
+  );
+  const agentCredentialsModule = createBrowserAgentCredentialsModule(copilotHttpClient);
+  const integrationHttpClient = new HttpClient({
+    baseUrl: integrationUrl,
+    getToken: () => authModule.accessToken,
+    beforeAuthenticatedRequest,
+    onUnauthorized,
+    onError,
+    defaultHeaders
+  });
+  const integrationModule = new IntegrationModule(integrationHttpClient);
+  const queriesModule = new QueriesModule(httpClient);
+  const legacyBridge = new LegacySessionBridge(authSession, appId, apiUrl, authPageUrl);
+  setActiveBridge(legacyBridge);
+  legacyBridge.connect();
+  let initialized = false;
+  let allowSignup = true;
+  async function init() {
+    if (initialized) return;
+    const publicClient = new HttpClient({
+      baseUrl: codeStudioUrl,
+      getToken: () => null
+    });
+    const appInfo = expectAppInfoResponse(
+      await publicClient.get(
+        `/api/v1/apps/${(0, import_sdk_core9.encodePathSegment)(appId, "appId", coreErrors)}/info`
+      )
+    );
+    if (appInfo.dataSourceId) {
+      entitiesModule.setDataSourceId(appInfo.dataSourceId);
+    }
+    allowSignup = appInfo.allowSignup;
+    initialized = true;
+  }
+  return {
+    init,
+    auth: authModule,
+    entities: entitiesModule,
+    functions: functionsModule,
+    publicFunctions: publicFunctionsModule,
+    agentTasks: agentTasksModule,
+    agentCredentials: agentCredentialsModule,
+    integration: integrationModule,
+    queries: queriesModule,
+    get allowSignup() {
+      return allowSignup;
+    },
+    config
+  };
+}
+
+// src/legacy/index.ts
+var import_mitra_interactions_sdk2 = require("mitra-interactions-sdk");
+var import_mitra_interactions_sdk3 = require("mitra-interactions-sdk");
+var import_mitra_interactions_sdk4 = require("mitra-interactions-sdk");
+var import_mitra_interactions_sdk5 = require("mitra-interactions-sdk");
+var import_mitra_interactions_sdk6 = require("mitra-interactions-sdk");
+var import_mitra_interactions_sdk7 = require("mitra-interactions-sdk");
+var import_mitra_interactions_sdk8 = require("mitra-interactions-sdk");
+var import_mitra_interactions_sdk9 = require("mitra-interactions-sdk");
+var import_mitra_interactions_sdk10 = require("mitra-interactions-sdk");
+var import_mitra_interactions_sdk11 = require("mitra-interactions-sdk");
+var import_mitra_interactions_sdk12 = require("mitra-interactions-sdk");
+var import_mitra_interactions_sdk13 = require("mitra-interactions-sdk");
+var import_mitra_interactions_sdk14 = require("mitra-interactions-sdk");
+var import_mitra_interactions_sdk15 = require("mitra-interactions-sdk");
+var import_mitra_interactions_sdk16 = require("mitra-interactions-sdk");
+var import_mitra_interactions_sdk17 = require("mitra-interactions-sdk");
+var import_mitra_interactions_sdk18 = require("mitra-interactions-sdk");
+var import_mitra_interactions_sdk19 = require("mitra-interactions-sdk");
+var import_mitra_interactions_sdk20 = require("mitra-interactions-sdk");
+var import_mitra_interactions_sdk21 = require("mitra-interactions-sdk");
+var import_mitra_interactions_sdk22 = require("mitra-interactions-sdk");
+var import_mitra_interactions_sdk23 = require("mitra-interactions-sdk");
+var import_mitra_interactions_sdk24 = require("mitra-interactions-sdk");
+var import_mitra_interactions_sdk25 = require("mitra-interactions-sdk");
+var loginMitra = async (method, options) => {
+  const session = await (0, import_mitra_interactions_sdk2.loginMitra)(method, options);
+  adoptLegacySession(session);
+  return session;
+};
+var loginWithGoogleMitra = async (options) => {
+  const session = await (0, import_mitra_interactions_sdk2.loginWithGoogleMitra)(options);
+  adoptLegacySession(session);
+  return session;
+};
+var loginWithMicrosoftMitra = async (options) => {
+  const session = await (0, import_mitra_interactions_sdk2.loginWithMicrosoftMitra)(options);
+  adoptLegacySession(session);
+  return session;
+};
+var exchangeSsoCodeMitra = async (options) => {
+  const session = await (0, import_mitra_interactions_sdk2.exchangeSsoCodeMitra)(options);
+  adoptLegacySession(session);
+  return session;
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  MitraApiError,
+  callIntegrationMitra,
+  configureSdkMitra,
+  createClient,
+  createMitraInstance,
+  createRecordMitra,
+  createRecordsBatchMitra,
+  deleteRecordMitra,
+  exchangeSsoCodeMitra,
+  executePublicServerFunctionAsyncMitra,
+  executePublicServerFunctionMitra,
+  executeServerFunctionAsyncMitra,
+  executeServerFunctionMitra,
+  getAgentTaskMitra,
+  getConfig,
+  getPublicServerFunctionExecutionMitra,
+  getRecordMitra,
+  listIntegrationsMitra,
+  listRecordsMitra,
+  loginMitra,
+  loginWithGoogleMitra,
+  loginWithMicrosoftMitra,
+  manageAgentChatMitra,
+  manageAgentCredentialMitra,
+  patchRecordMitra,
+  refreshTokenSilently,
+  resolveProjectId,
+  stopServerFunctionExecutionMitra,
+  updateRecordMitra
+});