@mitralab.io/platform-sdk 1.0.8 → 1.1.0-beta.0

package/dist/index.js

@@ -1,35 +1,23 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/index.ts
-var index_exports = {};
-__export(index_exports, {
-  MitraApiError: () => MitraApiError,
-  createClient: () => createClient
-});
-module.exports = __toCommonJS(index_exports);
+// src/utils/url.ts
+function stripTrailingSlashes(value) {
+  let end = value.length;
+  while (end > 0 && value.codePointAt(end - 1) === 47) end -= 1;
+  return value.slice(0, end);
+}
 
 // src/client.ts
-var import_sdk_core6 = require("@mitralab.io/sdk-core");
+import {
+  createPublicFunctionsModule,
+  encodePathSegment,
+  expectObject as expectObject2
+} from "@mitralab.io/sdk-core";
 
 // src/utils/http-client.ts
 var bearerCredentialPattern = /(Bearer\s+)\S+/gi;
+var sensitiveDetailKeyPattern = /token|authorization|password|secret|api.?key|credential|private.?key/i;
+function isSensitiveDetailKey(key) {
+  return sensitiveDetailKeyPattern.test(key);
+}
 function redactText(value, currentToken) {
   const withoutBearerCredentials = value.replace(bearerCredentialPattern, "$1[REDACTED]");
   return currentToken ? withoutBearerCredentials.split(currentToken).join("[REDACTED]") : withoutBearerCredentials;
@@ -39,10 +27,13 @@ function redactDetails(value, currentToken) {
   if (Array.isArray(value)) return value.map((item) => redactDetails(item, currentToken));
   if (value && typeof value === "object") {
     return Object.fromEntries(
-      Object.entries(value).map(([key, entry]) => [
-        redactText(key, currentToken),
-        redactDetails(entry, currentToken)
-      ])
+      Object.entries(value).map(([key, entry]) => {
+        const redactedKey = redactText(key, currentToken);
+        return [
+          redactedKey,
+          isSensitiveDetailKey(redactedKey) ? "[REDACTED]" : redactDetails(entry, currentToken)
+        ];
+      })
     );
   }
   return value;
@@ -54,15 +45,27 @@ function asErrorPayload(value) {
 function optionalString(value) {
   return typeof value === "string" ? value : void 0;
 }
+function buildRequestUrl(baseUrl, path, params) {
+  const url = `${baseUrl}${path}`;
+  if (!params) return url;
+  const searchParams = new URLSearchParams();
+  Object.entries(params).forEach(([key, value]) => {
+    if (value !== void 0) searchParams.append(key, String(value));
+  });
+  const queryString = searchParams.toString();
+  return queryString ? `${url}?${queryString}` : url;
+}
 var HttpClient = class {
   baseUrl;
   tokenGetter;
+  beforeAuthenticatedRequest;
   onUnauthorized;
   onError;
   defaultHeaders;
   constructor(config) {
     this.baseUrl = config.baseUrl.replace(/\/$/, "");
     this.tokenGetter = config.getToken ?? (() => null);
+    this.beforeAuthenticatedRequest = config.beforeAuthenticatedRequest;
     this.onUnauthorized = config.onUnauthorized;
     this.onError = config.onError;
     this.defaultHeaders = config.defaultHeaders ?? {};
@@ -92,18 +95,9 @@ var HttpClient = class {
    */
   async request(path, options = {}) {
     const { method = "GET", body, headers = {}, params, isRetry } = options;
-    let url = `${this.baseUrl}${path}`;
-    if (params) {
-      const searchParams = new URLSearchParams();
-      Object.entries(params).forEach(([key, value]) => {
-        if (value !== void 0) {
-          searchParams.append(key, String(value));
-        }
-      });
-      const queryString = searchParams.toString();
-      if (queryString) {
-        url += `?${queryString}`;
-      }
+    const url = buildRequestUrl(this.baseUrl, path, params);
+    if (!isRetry && this.tokenGetter() && this.beforeAuthenticatedRequest) {
+      await this.beforeAuthenticatedRequest();
     }
     const requestHeaders = {
       "Content-Type": "application/json",
@@ -131,27 +125,50 @@ var HttpClient = class {
     }
     if (!response.ok) {
       if (response.status === 401 && !isRetry && this.onUnauthorized) {
-        const refreshed = await this.onUnauthorized();
+        const refreshed = await this.onUnauthorized(token);
         if (refreshed) {
           return this.request(path, { ...options, isRetry: true });
         }
       }
-      const errorBody = await response.json().catch(() => ({}));
-      const errorPayload = asErrorPayload(errorBody);
-      const rawMessage = optionalString(errorPayload.message);
-      const rawCode = optionalString(errorPayload.error_code);
-      const error = new MitraApiError(
-        redactText(rawMessage || `Request failed with status ${response.status}`, token),
-        response.status,
-        rawCode === void 0 ? void 0 : redactText(rawCode, token),
-        redactDetails(errorBody, token)
-      );
+      const error = await this.errorFromResponse(response, token);
       this.onError?.(error);
       throw error;
     }
+    return this.parseResponseBody(response, path);
+  }
+  async errorFromResponse(response, token) {
+    const errorBody = await response.json().catch(() => ({}));
+    const errorPayload = asErrorPayload(errorBody);
+    const rawMessage = optionalString(errorPayload.message);
+    const rawCode = optionalString(errorPayload.error_code);
+    return new MitraApiError(
+      redactText(rawMessage || `Request failed with status ${response.status}`, token),
+      response.status,
+      rawCode === void 0 ? void 0 : redactText(rawCode, token),
+      redactDetails(errorBody, token)
+    );
+  }
+  async parseResponseBody(response, path) {
     if (response.status === 204) {
       return void 0;
     }
+    if (typeof response.text === "function") {
+      const responseText = await response.text();
+      if (responseText.length === 0) {
+        return void 0;
+      }
+      try {
+        return JSON.parse(responseText);
+      } catch {
+        const error = new MitraApiError(
+          `Response from ${path} is not valid JSON`,
+          response.status,
+          "INVALID_RESPONSE"
+        );
+        this.onError?.(error);
+        throw error;
+      }
+    }
     return response.json();
   }
   /**
@@ -231,26 +248,447 @@ var coreErrors = {
   invalidResponse: (message) => new MitraApiError(message, 200, "INVALID_RESPONSE")
 };
 
+// src/legacy/bridge.ts
+import { configureSdkMitra, getConfig } from "mitra-interactions-sdk";
+
+// src/modules/auth-page-url.ts
+function resolveAuthPageUrl(apiUrl, configuredAuthPageUrl, browserWindow = globalThis.window) {
+  const injectedAuthPageUrl = browserWindow?.__mitraEnv?.authPageUrl;
+  try {
+    const candidate = configuredAuthPageUrl ?? (typeof injectedAuthPageUrl === "string" && injectedAuthPageUrl.trim() ? injectedAuthPageUrl : new URL("/sdk-auth.html", apiUrl).toString());
+    const url = new URL(candidate);
+    if (url.protocol !== "https:" && url.protocol !== "http:")
+      throw new Error("authPageUrl must be an absolute HTTP or HTTPS URL.");
+    return url;
+  } catch {
+    throw new Error("authPageUrl must be an absolute HTTP or HTTPS URL.");
+  }
+}
+
+// src/legacy/bridge.ts
+function stripBearer(token) {
+  return token.replace(/^\s*(?:bearer\s+)+/i, "").trim();
+}
+var LegacySessionBridge = class {
+  auth;
+  appId;
+  apiUrl;
+  configuredAuthPageUrl;
+  legacyUrl;
+  unsubscribeFromAuth = null;
+  constructor(auth, appId, apiUrl, authPageUrl) {
+    this.auth = auth;
+    this.appId = appId;
+    this.apiUrl = apiUrl;
+    this.configuredAuthPageUrl = authPageUrl;
+    const gatewayUrl = stripTrailingSlashes(apiUrl);
+    this.legacyUrl = gatewayUrl ? `${gatewayUrl}/legacy` : "";
+  }
+  /**
+   * Configures the legacy SDK and hands it the session this SDK already holds.
+   *
+   * Called once per client. Failures are swallowed: an unusable legacy SDK must
+   * not stop the new client from being created.
+   */
+  connect() {
+    this.disconnect();
+    this.syncToLegacy(this.auth.readSessionTokens());
+    this.unsubscribeFromAuth = this.auth.onSessionChange((session) => {
+      this.syncToLegacy(session);
+    });
+  }
+  /** Stops this bridge from changing the process-wide legacy SDK singleton. */
+  disconnect() {
+    this.unsubscribeFromAuth?.();
+    this.unsubscribeFromAuth = null;
+  }
+  syncToLegacy(session) {
+    try {
+      const authPageUrl = resolveAuthPageUrl(
+        this.apiUrl,
+        this.configuredAuthPageUrl
+      ).toString();
+      configureSdkMitra({
+        baseURL: this.legacyUrl,
+        authUrl: this.legacyUrl,
+        authPageUrl,
+        projectId: this.appId,
+        onTokenRefresh: (session2) => this.adopt(session2),
+        ...session.token ? { token: session.token } : {},
+        ...session.refreshToken ? { refreshToken: session.refreshToken } : {}
+      });
+      const legacyConfig = getConfig();
+      if (!session.token) delete legacyConfig.token;
+      if (!session.refreshToken) delete legacyConfig.refreshToken;
+    } catch {
+    }
+  }
+  /**
+   * Stores a session produced by the legacy SDK. The AuthModule subscription
+   * then writes that session back to the process-wide legacy config and
+   * reinstates the refresh hook removed by legacy login.
+   */
+  adopt(session) {
+    const adopted = this.auth.adoptSession({
+      token: stripBearer(session.token),
+      refreshToken: session.refreshToken ?? null
+    });
+    if (!adopted) this.syncToLegacy(this.auth.readSessionTokens());
+  }
+};
+var activeBridge = null;
+function setActiveBridge(bridge) {
+  activeBridge?.disconnect();
+  activeBridge = bridge;
+}
+function adoptLegacySession(session) {
+  activeBridge?.adopt(session);
+}
+
+// src/modules/auth.ts
+import { createAuthModule } from "@mitralab.io/sdk-core";
+
+// src/modules/google-auth.ts
+import { expectObject } from "@mitralab.io/sdk-core";
+var RESULT_TYPE = "mitra-oauth-result";
+var PROVIDER_LABELS = {
+  google: "Google",
+  microsoft: "Microsoft"
+};
+var POPUP_WIDTH = 480;
+var POPUP_HEIGHT = 600;
+var POPUP_TIMEOUT_MS = 5 * 60 * 1e3;
+var POPUP_CLOSED_POLL_MS = 500;
+function expectAuthTokenResponse(value) {
+  const response = expectObject(
+    value,
+    "Authentication token response",
+    coreErrors
+  );
+  for (const field of ["accessToken", "refreshToken", "tokenType"]) {
+    if (typeof response[field] !== "string" || !response[field].trim()) {
+      throw coreErrors.invalidResponse(
+        `Authentication token response has an invalid ${field} field`
+      );
+    }
+  }
+  return {
+    accessToken: response.accessToken,
+    refreshToken: response.refreshToken,
+    tokenType: response.tokenType
+  };
+}
+var GoogleAuthFlow = class {
+  appId;
+  apiUrl;
+  configuredAuthPageUrl;
+  client;
+  provider;
+  providerLabel;
+  redirectStorageKey;
+  popupPromise = null;
+  constructor(config) {
+    this.appId = config.appId;
+    this.apiUrl = stripTrailingSlashes(config.apiUrl);
+    this.configuredAuthPageUrl = config.authPageUrl;
+    this.client = config.client;
+    this.provider = config.provider ?? "google";
+    this.providerLabel = PROVIDER_LABELS[this.provider];
+    this.redirectStorageKey = `mitra_${this.provider}_redirect_${config.appId}`;
+  }
+  signIn(options = {}) {
+    const browserWindow = this.requireBrowser();
+    if (options.mode === "redirect") {
+      return this.startRedirect(browserWindow);
+    }
+    if (options.mode !== void 0 && options.mode !== "popup") {
+      return Promise.reject(new Error(`Unsupported ${this.providerLabel} sign-in mode: ${String(options.mode)}`));
+    }
+    if (this.popupPromise) return this.popupPromise;
+    this.popupPromise = this.startPopup(browserWindow).finally(() => {
+      this.popupPromise = null;
+    });
+    return this.popupPromise;
+  }
+  async completeRedirect() {
+    const browserWindow = this.requireBrowser();
+    const params = new URLSearchParams(browserWindow.location.hash.replace(/^#/, ""));
+    const code = params.get("codeMitra");
+    const state = params.get("stateMitra");
+    const error = params.get("errorMitra");
+    if (code === null && state === null && error === null) return null;
+    const context = this.readRedirectContext(browserWindow);
+    if (!state?.trim()) {
+      throw new Error(`${this.providerLabel} sign-in redirect is missing state.`);
+    }
+    if (context?.state !== state) {
+      throw new Error(`Invalid ${this.providerLabel} sign-in state (possible CSRF).`);
+    }
+    const expectedRedirectUri = this.getRedirectUri(
+      resolveAuthPageUrl(this.apiUrl, this.configuredAuthPageUrl, browserWindow)
+    );
+    if (context.redirectUri !== expectedRedirectUri) {
+      throw new Error(`${this.providerLabel} sign-in redirect context is invalid.`);
+    }
+    this.cleanRedirectFragment(browserWindow);
+    this.clearRedirectContext(browserWindow);
+    if (code === "error" || error !== null) {
+      throw new Error(error || `${this.providerLabel} sign-in failed.`);
+    }
+    if (!code?.trim()) {
+      throw new Error(`${this.providerLabel} sign-in redirect is missing code.`);
+    }
+    return this.exchangeCode(code, context.redirectUri);
+  }
+  async startPopup(browserWindow) {
+    const state = this.generateState();
+    const authPageUrl = resolveAuthPageUrl(
+      this.apiUrl,
+      this.configuredAuthPageUrl,
+      browserWindow
+    );
+    const popup = this.openPopup(browserWindow, this.buildStartUrl(browserWindow, authPageUrl, state));
+    const result = await this.waitForPopupResult(browserWindow, popup, authPageUrl.origin, state);
+    if (result.code) return this.exchangeCode(result.code, this.getRedirectUri(authPageUrl));
+    return expectAuthTokenResponse(result.token);
+  }
+  startRedirect(browserWindow) {
+    const state = this.generateState();
+    const authPageUrl = resolveAuthPageUrl(
+      this.apiUrl,
+      this.configuredAuthPageUrl,
+      browserWindow
+    );
+    const context = {
+      state,
+      redirectUri: this.getRedirectUri(authPageUrl)
+    };
+    this.persistRedirectContext(browserWindow, context);
+    const startUrl = this.buildStartUrl(browserWindow, authPageUrl, state);
+    browserWindow.location.assign(startUrl.toString());
+    return new Promise(() => void 0);
+  }
+  async exchangeCode(code, redirectUri) {
+    const response = await this.client.post(`/api/v1/auth/${this.provider}`, {
+      appId: this.appId,
+      code,
+      redirectUri
+    });
+    return expectAuthTokenResponse(response);
+  }
+  buildStartUrl(browserWindow, authPageUrl, state) {
+    const startUrl = new URL(authPageUrl);
+    startUrl.searchParams.set("provider", this.provider);
+    startUrl.searchParams.set("state", state);
+    startUrl.searchParams.set("appId", this.appId);
+    startUrl.searchParams.set("apiUrl", this.apiUrl);
+    startUrl.searchParams.set("origin", browserWindow.location.origin);
+    startUrl.searchParams.set("responseType", "code");
+    return startUrl;
+  }
+  getRedirectUri(authPageUrl) {
+    return `${authPageUrl.origin}${authPageUrl.pathname}`;
+  }
+  generateState() {
+    if (!globalThis.crypto?.getRandomValues) {
+      throw new Error(`${this.providerLabel} sign-in requires crypto.getRandomValues.`);
+    }
+    const bytes = new Uint8Array(16);
+    globalThis.crypto.getRandomValues(bytes);
+    return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+  }
+  openPopup(browserWindow, url) {
+    const outerWidth = browserWindow.outerWidth || browserWindow.screen.width;
+    const outerHeight = browserWindow.outerHeight || browserWindow.screen.height;
+    const left = Math.max(0, (browserWindow.screenX || 0) + (outerWidth - POPUP_WIDTH) / 2);
+    const top = Math.max(0, (browserWindow.screenY || 0) + (outerHeight - POPUP_HEIGHT) / 2);
+    const popup = browserWindow.open(
+      url.toString(),
+      "mitra-google-oauth",
+      `width=${POPUP_WIDTH},height=${POPUP_HEIGHT},left=${left},top=${top},menubar=no,toolbar=no,status=no`
+    );
+    if (!popup) {
+      throw new Error(`${this.providerLabel} sign-in popup was blocked by the browser.`);
+    }
+    return popup;
+  }
+  waitForPopupResult(browserWindow, popup, expectedOrigin, expectedState) {
+    return new Promise((resolve, reject) => {
+      const timeout = globalThis.setTimeout(() => {
+        cleanup();
+        reject(new Error(`${this.providerLabel} sign-in timed out.`));
+      }, POPUP_TIMEOUT_MS);
+      const closedPoll = globalThis.setInterval(() => {
+        if (popup.closed) {
+          cleanup();
+          reject(new Error(`${this.providerLabel} sign-in was cancelled.`));
+        }
+      }, POPUP_CLOSED_POLL_MS);
+      const onMessage = (event) => {
+        if (event.origin !== expectedOrigin || event.source !== popup) return;
+        if (!event.data || typeof event.data !== "object") return;
+        const data = event.data;
+        if (data.type !== RESULT_TYPE) return;
+        if (data.state !== expectedState) {
+          cleanup();
+          reject(new Error(`Invalid ${this.providerLabel} sign-in state (possible CSRF).`));
+          return;
+        }
+        if (data.success !== true) {
+          cleanup();
+          reject(new Error(typeof data.error === "string" && data.error.trim() ? data.error : `${this.providerLabel} sign-in failed.`));
+          return;
+        }
+        const code = typeof data.code === "string" && data.code.trim() ? data.code : void 0;
+        if (!code && data.token === void 0) {
+          cleanup();
+          reject(new Error("Google auth page returned neither code nor token."));
+          return;
+        }
+        cleanup();
+        resolve({ ...code ? { code } : {}, ...data.token !== void 0 ? { token: data.token } : {} });
+      };
+      const cleanup = () => {
+        globalThis.clearTimeout(timeout);
+        globalThis.clearInterval(closedPoll);
+        browserWindow.removeEventListener("message", onMessage);
+        if (!popup.closed) popup.close();
+      };
+      browserWindow.addEventListener("message", onMessage);
+    });
+  }
+  persistRedirectContext(browserWindow, context) {
+    try {
+      browserWindow.sessionStorage.setItem(this.redirectStorageKey, JSON.stringify(context));
+    } catch {
+      throw new Error(`${this.providerLabel} sign-in redirect requires sessionStorage.`);
+    }
+  }
+  readRedirectContext(browserWindow) {
+    try {
+      const raw = browserWindow.sessionStorage.getItem(this.redirectStorageKey);
+      if (!raw) return null;
+      const value = JSON.parse(raw);
+      if (typeof value.state !== "string" || typeof value.redirectUri !== "string") return null;
+      return {
+        state: value.state,
+        redirectUri: value.redirectUri
+      };
+    } catch {
+      return null;
+    }
+  }
+  clearRedirectContext(browserWindow) {
+    try {
+      browserWindow.sessionStorage.removeItem(this.redirectStorageKey);
+    } catch {
+    }
+  }
+  cleanRedirectFragment(browserWindow) {
+    browserWindow.history.replaceState(
+      {},
+      "",
+      `${browserWindow.location.pathname}${browserWindow.location.search}`
+    );
+  }
+  requireBrowser() {
+    if (globalThis.window === void 0) {
+      throw new Error(`${this.providerLabel} sign-in is only available in a browser.`);
+    }
+    return globalThis.window;
+  }
+};
+
 // src/modules/auth.ts
-var import_sdk_core = require("@mitralab.io/sdk-core");
+var DEFAULT_TOKEN_VALIDITY_MS = 3e4;
+var sessionPorts = /* @__PURE__ */ new WeakMap();
+function getAuthSessionPort(auth) {
+  const port = sessionPorts.get(auth);
+  if (!port) throw new Error("Auth session port is unavailable.");
+  return port;
+}
+function decodeJwtPayload(token) {
+  try {
+    const part = token.replace(/^Bearer\s+/i, "").split(".")[1];
+    if (!part || typeof globalThis.atob !== "function") return null;
+    const base64 = part.replaceAll("-", "+").replaceAll("_", "/");
+    const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
+    const value = JSON.parse(globalThis.atob(padded));
+    if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+    return value;
+  } catch {
+    return null;
+  }
+}
+function belongsToApp(token, appId) {
+  const payload = decodeJwtPayload(token);
+  if (!payload) return true;
+  return payload.app_id === appId;
+}
+function isTokenExpiring(token, minValidityMs) {
+  const exp = decodeJwtPayload(token)?.exp;
+  if (typeof exp !== "number" || !Number.isFinite(exp)) return false;
+  return exp * 1e3 - Date.now() < minValidityMs;
+}
+function isDefinitiveRefreshFailure(error) {
+  return error instanceof MitraApiError && error.status >= 400 && error.status < 500 && error.status !== 408 && error.status !== 429;
+}
 var AuthModule = class {
   appId;
   _currentUser = null;
   #accessToken = null;
   #refreshToken = null;
-  refreshPromise = null;
+  sessionGeneration = 0;
+  refreshFlight = null;
+  transientRefreshFailureGeneration = null;
   listeners = /* @__PURE__ */ new Set();
+  sessionListeners = /* @__PURE__ */ new Set();
   storageKey;
   publicClient;
   authedClient;
   currentUserApi;
-  constructor(appId, iamBaseUrl) {
+  googleAuth;
+  microsoftAuth;
+  constructor(appId, iamBaseUrl, options = {}) {
     this.appId = appId;
+    const trimmedIamBaseUrl = stripTrailingSlashes(iamBaseUrl);
+    const apiUrl = stripTrailingSlashes(
+      options.apiUrl ?? (trimmedIamBaseUrl.endsWith("/iam") ? trimmedIamBaseUrl.slice(0, -"/iam".length) : trimmedIamBaseUrl)
+    );
     this.storageKey = `mitra_auth_${appId}`;
     this.publicClient = new HttpClient({ baseUrl: iamBaseUrl, getToken: () => null });
-    this.authedClient = new HttpClient({ baseUrl: iamBaseUrl, getToken: () => this.#accessToken });
-    this.currentUserApi = (0, import_sdk_core.createAuthModule)(this.authedClient, coreErrors);
+    this.authedClient = new HttpClient({
+      baseUrl: iamBaseUrl,
+      getToken: () => this.#accessToken,
+      beforeAuthenticatedRequest: () => this.ensureFreshSession().then(() => void 0),
+      onUnauthorized: (requestToken) => this.handleUnauthorized(requestToken)
+    });
+    this.currentUserApi = createAuthModule(this.authedClient, coreErrors);
+    this.googleAuth = new GoogleAuthFlow({
+      appId,
+      apiUrl,
+      authPageUrl: options.authPageUrl,
+      client: this.publicClient
+    });
+    this.microsoftAuth = new GoogleAuthFlow({
+      appId,
+      apiUrl,
+      authPageUrl: options.authPageUrl,
+      client: this.publicClient,
+      provider: "microsoft"
+    });
     this.loadFromStorage();
+    const readAccessToken = () => this.#accessToken;
+    sessionPorts.set(this, {
+      get accessToken() {
+        return readAccessToken();
+      },
+      ensureFreshSession: (minValidityMs) => this.ensureFreshSession(minValidityMs),
+      handleUnauthorized: (requestToken) => this.handleUnauthorized(requestToken),
+      readSessionTokens: () => this.readSessionTokens(),
+      onSessionChange: (callback) => this.onSessionChange(callback),
+      adoptSession: (session) => this.adoptSession(session)
+    });
   }
   /** The currently authenticated user, or null. */
   get currentUser() {
@@ -264,57 +702,94 @@ var AuthModule = class {
   get isAuthenticated() {
     return this._currentUser !== null && this.#accessToken !== null;
   }
+  /** @deprecated Email/password authentication is not implemented by IAM. Use Google or Microsoft SSO. */
+  async signIn(_credentials) {
+    throw new MitraApiError(
+      "Email/password authentication is not available. Use signInWithGoogle() or signInWithMicrosoft().",
+      0,
+      "UNSUPPORTED_AUTH_METHOD"
+    );
+  }
   /**
-   * Signs in a user with email and password.
+   * Signs in with Google SSO.
+   *
+   * Popup mode is used by default. Redirect mode stores a one-time CSRF context
+   * in `sessionStorage` and navigates to the configured `sdk-auth.html` page.
+   * Call {@link completeGoogleSignInRedirect} during application startup to
+   * finish a redirect response.
    *
-   * On success, stores access token, refresh token, and user data.
-   * Subsequent API requests use the token automatically.
+   * The auth page is resolved from `createClient({ authPageUrl })`, then
+   * `window.__mitraEnv.authPageUrl`, and finally `/sdk-auth.html` on the API
+   * gateway origin.
    *
-   * @param credentials - Email and password.
-   * @returns The authenticated user.
-   * @throws {MitraApiError} On invalid credentials (401).
+   * @param options - Popup or redirect mode.
+   * @returns The authenticated and hydrated user in popup mode.
+   * @throws {MitraApiError} When IAM rejects the authorization code.
+   * @throws {Error} When the browser blocks or cancels the popup, the flow times
+   * out, or the OAuth response fails origin, source, state, or shape validation.
    *
    * @example
    * ```typescript
-   * const user = await mitra.auth.signIn({
-   *   email: 'user@example.com',
-   *   password: 'password123',
-   * });
+   * const user = await mitra.auth.signInWithGoogle();
+   * ```
+   *
+   * @example
+   * ```typescript
+   * await mitra.auth.signInWithGoogle({ mode: 'redirect' });
    * ```
    */
-  async signIn(credentials) {
-    const tokenResponse = await this.publicClient.post(
-      "/api/v1/auth/login",
-      { ...credentials, appId: this.appId }
-    );
-    this.#accessToken = tokenResponse.accessToken;
-    this.#refreshToken = tokenResponse.refreshToken;
-    const user = await this.getCurrentUser();
-    this.setAuthState(user, tokenResponse.accessToken, tokenResponse.refreshToken);
-    return user;
+  async signInWithGoogle(options = {}) {
+    return this.establishSession(await this.googleAuth.signIn(options));
   }
   /**
-   * Registers a new user and signs them in automatically.
+   * Completes a Google redirect response from `#codeMitra` and `#stateMitra`.
+   *
+   * The method consumes and clears the fragment and stored CSRF context, sends
+   * the single-use code directly to IAM, persists both tokens, calls `auth.me()`,
+   * and notifies auth-state listeners. It returns `null` when the current URL is
+   * not a Google SSO redirect. Redirect errors must carry the same `stateMitra`
+   * stored at the start of the flow before their message is exposed or consumed.
    *
-   * @param data - Email, password, and optional name.
-   * @returns The newly created and authenticated user.
-   * @throws {MitraApiError} On duplicate email (409) or validation error (400).
+   * @returns The authenticated user, or `null` when no redirect result is present.
    *
    * @example
    * ```typescript
-   * const user = await mitra.auth.signUp({
-   *   email: 'new@example.com',
-   *   password: 'securepassword',
-   *   name: 'Jane Doe',
-   * });
+   * const redirectedUser = await mitra.auth.completeGoogleSignInRedirect();
+   * if (redirectedUser) console.log(redirectedUser.email);
    * ```
    */
-  async signUp(data) {
-    await this.publicClient.post("/api/v1/auth/register", {
-      ...data,
-      appId: this.appId
-    });
-    return this.signIn({ email: data.email, password: data.password });
+  async completeGoogleSignInRedirect() {
+    const tokenResponse = await this.googleAuth.completeRedirect();
+    return tokenResponse ? this.establishSession(tokenResponse) : null;
+  }
+  /**
+   * Signs in with Microsoft SSO: the same auth-page handshake as Google, exchanged
+   * at IAM's `/auth/microsoft`. Popup by default; redirect mode navigates away.
+   *
+   * @example
+   * ```typescript
+   * const user = await mitra.auth.signInWithMicrosoft();
+   * ```
+   */
+  async signInWithMicrosoft(options = {}) {
+    return this.establishSession(await this.microsoftAuth.signIn(options));
+  }
+  /**
+   * Completes a Microsoft redirect response from `#codeMitra` and `#stateMitra`.
+   * Mirrors {@link completeGoogleSignInRedirect}; returns `null` when the current
+   * URL is not a Microsoft SSO redirect.
+   */
+  async completeMicrosoftSignInRedirect() {
+    const tokenResponse = await this.microsoftAuth.completeRedirect();
+    return tokenResponse ? this.establishSession(tokenResponse) : null;
+  }
+  /** @deprecated Email/password registration is not implemented by IAM. Use Google or Microsoft SSO. */
+  async signUp(_data) {
+    throw new MitraApiError(
+      "Email/password registration is not available. Use signInWithGoogle() or signInWithMicrosoft().",
+      0,
+      "UNSUPPORTED_AUTH_METHOD"
+    );
   }
   /**
    * Signs out the current user, clearing all auth state and localStorage.
@@ -336,9 +811,9 @@ var AuthModule = class {
   /**
    * Refreshes the session using the stored refresh token.
    *
-   * Called automatically by the SDK on 401 responses. Can also be called
-   * manually. Multiple concurrent calls are deduplicated (only one refresh
-   * request is made).
+   * Called automatically before requests whose JWT is close to expiry and on
+   * `401` responses. Can also be called manually. Multiple proactive, reactive,
+   * and manual calls are deduplicated into one refresh request.
    *
    * @returns `true` if refresh succeeded, `false` otherwise.
    *
@@ -350,19 +825,50 @@ var AuthModule = class {
    */
   async refreshSession() {
     if (!this.#refreshToken) return false;
-    if (this.refreshPromise) return this.refreshPromise;
-    this.refreshPromise = this.doRefresh();
+    if (!this.hasValidAppIdentity()) {
+      this.clearAuthState();
+      return false;
+    }
+    const generation = this.sessionGeneration;
+    if (this.refreshFlight?.generation === generation) {
+      return this.refreshFlight.promise;
+    }
+    this.transientRefreshFailureGeneration = null;
+    const flight = {
+      generation,
+      promise: this.doRefresh(generation, this.#refreshToken)
+    };
+    this.refreshFlight = flight;
     try {
-      return await this.refreshPromise;
+      return await flight.promise;
     } finally {
-      this.refreshPromise = null;
+      if (this.refreshFlight === flight) {
+        this.refreshFlight = null;
+      }
     }
   }
+  /**
+   * Resolves a 401 against the credential that actually reached the server.
+   * A newer session is retried as-is instead of being refreshed because of an
+   * older request. A signed-out session is neither refreshed nor retried.
+   *
+   * @param requestToken - Access token attached to the rejected request.
+   * @returns Whether the request should be retried once with the current token.
+   *
+   * @internal
+   */
+  async handleUnauthorized(requestToken) {
+    const currentToken = this.#accessToken;
+    if (!currentToken) return false;
+    if (currentToken !== requestToken) return true;
+    return this.refreshSession();
+  }
   /**
    * Fetches the current user from the server and updates local state.
    *
-   * Only clears auth state on 401 (expired/invalid token).
-   * Transient errors (500, network) return null without clearing the session.
+   * Clears auth state on a definitive 401. When the request reaches 401 after
+   * IAM refresh failed due to a network error, 408, 429, or 5xx response, the
+   * retained session is preserved and this method returns null.
    *
    * @returns The user if authenticated, `null` otherwise.
    *
@@ -374,14 +880,17 @@ var AuthModule = class {
    */
   async me() {
     if (!this.#accessToken) return null;
+    const generation = this.sessionGeneration;
     try {
       const user = await this.getCurrentUser();
+      if (generation !== this.sessionGeneration) return null;
       this._currentUser = user;
+      this.transientRefreshFailureGeneration = null;
       this.saveToStorage();
       this.notifyListeners();
       return user;
     } catch (error) {
-      if (error instanceof MitraApiError && error.status === 401) {
+      if (error instanceof MitraApiError && error.status === 401 && this.#accessToken && generation === this.sessionGeneration && this.transientRefreshFailureGeneration !== this.sessionGeneration) {
         this.clearAuthState();
       }
       return null;
@@ -416,10 +925,110 @@ var AuthModule = class {
    * ```
    */
   setToken(token, saveToStorage = true) {
+    if (!this.belongsToConfiguredApp(token)) {
+      this.clearAuthState();
+      return;
+    }
+    this.invalidatePendingRefreshes();
     this.#accessToken = token;
     if (saveToStorage) {
       this.saveToStorage();
     }
+    this.notifySessionListeners();
+  }
+  /**
+   * Reads the tokens currently held by this module.
+   *
+   * Used by the legacy session bridge to hand a session persisted by this SDK
+   * over to `mitra-interactions-sdk` on startup.
+   *
+   * @returns The access and refresh tokens, each `null` when absent.
+   *
+   * @internal
+   */
+  readSessionTokens() {
+    return { token: this.#accessToken, refreshToken: this.#refreshToken };
+  }
+  /**
+   * Adopts an app-scoped session received from a trusted platform boundary.
+   *
+   * This preserves the access and refresh tokens together so the normal refresh
+   * lifecycle continues after an embedded preview hands its session to the app.
+   * Call {@link checkAuth} afterward to validate the token and hydrate the user.
+   */
+  setSession(session) {
+    return this.adoptSession({
+      token: session.accessToken,
+      refreshToken: session.refreshToken ?? null
+    });
+  }
+  /**
+   * Ensures the current access token has enough remaining validity.
+   *
+   * JWT decoding is used only as a scheduling heuristic. Opaque tokens and JWTs
+   * without a numeric `exp` claim proceed unchanged and remain server-authoritative.
+   * Multiple proactive and reactive callers share the same refresh request.
+   * Transient refresh failures preserve the current session so the caller can
+   * continue and rely on the normal one-time `401` refresh fallback.
+   *
+   * This method is suitable for authenticated HTTP, WebSocket, and Server-Sent
+   * Events boundaries that need a fresh token before connecting.
+   *
+   * @param minValidityMs - Minimum remaining token lifetime. Defaults to 30 seconds.
+   * @returns `true` when no refresh is needed or refresh succeeds. Returns
+   * `false` when a required refresh fails, even when a transient failure keeps
+   * the current session available for a reactive server-authoritative fallback.
+   */
+  async ensureFreshSession(minValidityMs = DEFAULT_TOKEN_VALIDITY_MS) {
+    if (!Number.isFinite(minValidityMs) || minValidityMs < 0) {
+      throw new RangeError("minValidityMs must be a finite non-negative number");
+    }
+    if (!this.#accessToken) return false;
+    if (!this.hasValidAppIdentity()) {
+      this.clearAuthState();
+      return false;
+    }
+    if (!isTokenExpiring(this.#accessToken, minValidityMs)) return true;
+    return this.refreshSession();
+  }
+  /**
+   * Subscribes an internal boundary to token changes without triggering login
+   * or refresh. Unlike auth-state listeners, this callback is not invoked
+   * immediately and does not depend on the user being hydrated.
+   *
+   * @param callback - Receives the current access and refresh tokens.
+   * @returns A function that removes the callback.
+   *
+   * @internal
+   */
+  onSessionChange(callback) {
+    this.sessionListeners.add(callback);
+    return () => this.sessionListeners.delete(callback);
+  }
+  /**
+   * Adopts a session produced outside this module, such as a legacy SSO login.
+   *
+   * Replaces the in-memory tokens and persists them under the same storage key
+   * the rest of the module uses. The current user is left untouched because the
+   * legacy SDK does not return one; call `me()` to hydrate it.
+   *
+   * @param session - Access token and, when the issuer returned one, refresh token.
+   *
+   * @internal
+   */
+  adoptSession(session) {
+    if (!this.belongsToConfiguredApp(session.token) || typeof session.refreshToken === "string" && !this.belongsToConfiguredApp(session.refreshToken)) {
+      this.clearAuthState();
+      return false;
+    }
+    this.invalidatePendingRefreshes();
+    this.#accessToken = session.token;
+    if (session.refreshToken !== void 0) {
+      this.#refreshToken = session.refreshToken;
+    }
+    this.saveToStorage();
+    this.notifySessionListeners();
+    return true;
   }
   /**
    * Redirects to `/login?returnUrl=...` for unauthenticated users.
@@ -463,27 +1072,65 @@ var AuthModule = class {
       this.listeners.delete(callback);
     };
   }
-  async doRefresh() {
+  async doRefresh(generation, refreshToken) {
+    let tokenResponse;
     try {
-      const tokenResponse = await this.publicClient.post(
-        "/api/v1/auth/refresh-token",
-        { refreshToken: this.#refreshToken }
+      tokenResponse = expectAuthTokenResponse(
+        await this.publicClient.post(
+          "/api/v1/auth/refresh-token",
+          { refreshToken }
+        )
       );
-      this.#accessToken = tokenResponse.accessToken;
-      this.#refreshToken = tokenResponse.refreshToken;
-      const user = await this.getCurrentUser();
-      this.setAuthState(user, tokenResponse.accessToken, tokenResponse.refreshToken);
-      return true;
-    } catch {
+    } catch (error) {
+      if (generation !== this.sessionGeneration) return false;
+      if (isDefinitiveRefreshFailure(error)) {
+        this.clearAuthState();
+      } else {
+        this.transientRefreshFailureGeneration = generation;
+      }
+      return false;
+    }
+    if (generation !== this.sessionGeneration) return false;
+    if (!this.belongsToConfiguredApp(tokenResponse.accessToken) || !this.belongsToConfiguredApp(tokenResponse.refreshToken)) {
       this.clearAuthState();
       return false;
     }
+    this.#accessToken = tokenResponse.accessToken;
+    this.#refreshToken = tokenResponse.refreshToken;
+    this.transientRefreshFailureGeneration = null;
+    this.saveToStorage();
+    this.notifySessionListeners();
+    return true;
+  }
+  async establishSession(tokenResponse) {
+    if (!this.belongsToConfiguredApp(tokenResponse.accessToken) || !this.belongsToConfiguredApp(tokenResponse.refreshToken)) {
+      this.clearAuthState();
+      throw coreErrors.invalidResponse("Authentication returned a token for a different app");
+    }
+    this.invalidatePendingRefreshes();
+    const generation = this.sessionGeneration;
+    this.#accessToken = tokenResponse.accessToken;
+    this.#refreshToken = tokenResponse.refreshToken;
+    try {
+      const user = await this.getCurrentUser();
+      if (generation !== this.sessionGeneration) {
+        throw new Error("Authentication session was superseded");
+      }
+      this.setAuthState(user, this.#accessToken, this.#refreshToken);
+      return user;
+    } catch (error) {
+      if (generation === this.sessionGeneration) {
+        this.clearAuthState();
+      }
+      throw error;
+    }
   }
   setAuthState(user, token, refreshToken) {
     this._currentUser = user;
     this.#accessToken = token;
     this.#refreshToken = refreshToken;
     this.saveToStorage();
+    this.notifySessionListeners();
     this.notifyListeners();
   }
   async getCurrentUser() {
@@ -491,11 +1138,35 @@ var AuthModule = class {
     return { ...user, tenantId: user.tenant.id };
   }
   clearAuthState() {
+    const hadAuthState = this._currentUser !== null || this.#accessToken !== null || this.#refreshToken !== null;
+    this.invalidatePendingRefreshes();
     this._currentUser = null;
     this.#accessToken = null;
     this.#refreshToken = null;
     this.removeFromStorage();
-    this.notifyListeners();
+    if (hadAuthState) {
+      this.notifySessionListeners();
+      this.notifyListeners();
+    }
+  }
+  invalidatePendingRefreshes() {
+    this.sessionGeneration += 1;
+    this.transientRefreshFailureGeneration = null;
+  }
+  hasValidAppIdentity() {
+    return (!this.#accessToken || this.belongsToConfiguredApp(this.#accessToken)) && (!this.#refreshToken || this.belongsToConfiguredApp(this.#refreshToken));
+  }
+  belongsToConfiguredApp(token) {
+    return belongsToApp(token, this.appId);
+  }
+  notifySessionListeners() {
+    const session = this.readSessionTokens();
+    this.sessionListeners.forEach((callback) => {
+      try {
+        callback(session);
+      } catch {
+      }
+    });
   }
   notifyListeners() {
     this.listeners.forEach((callback) => {
@@ -526,9 +1197,14 @@ var AuthModule = class {
       const stored = localStorage.getItem(this.storageKey);
       if (stored) {
         const { user, token, refreshToken } = JSON.parse(stored);
+        if (typeof token !== "string" || refreshToken !== null && refreshToken !== void 0 && typeof refreshToken !== "string" || !this.belongsToConfiguredApp(token) || typeof refreshToken === "string" && !this.belongsToConfiguredApp(refreshToken)) {
+          this.clearAuthState();
+          return;
+        }
         this._currentUser = user;
         this.#accessToken = token;
         this.#refreshToken = refreshToken ?? null;
+        this.invalidatePendingRefreshes();
       }
     } catch {
       this.removeFromStorage();
@@ -544,12 +1220,13 @@ var AuthModule = class {
 };
 
 // src/modules/entities.ts
-var import_sdk_core2 = require("@mitralab.io/sdk-core");
+import {
+  createEntitiesModule
+} from "@mitralab.io/sdk-core";
 var EntitiesModule = class _EntitiesModule {
-  constructor(httpClient, dataSourceId) {
+  constructor(httpClient, _dataSourceId) {
     this.httpClient = httpClient;
-    void dataSourceId;
-    this.core = (0, import_sdk_core2.createEntitiesModule)(httpClient, coreErrors);
+    this.core = createEntitiesModule(httpClient, coreErrors);
   }
   core;
   static createProxy(httpClient, dataSourceId) {
@@ -567,9 +1244,8 @@ var EntitiesModule = class _EntitiesModule {
    * Preserved for Platform SDK 1.x compatibility.
    * Records now resolve the app from authenticated context instead of a data source path.
    */
-  setDataSourceId(dataSourceId) {
-    void dataSourceId;
-    this.core = (0, import_sdk_core2.createEntitiesModule)(this.httpClient, coreErrors);
+  setDataSourceId(_dataSourceId) {
+    this.core = createEntitiesModule(this.httpClient, coreErrors);
   }
   getTable(tableName) {
     return this.core.getTable(tableName);
@@ -577,33 +1253,53 @@ var EntitiesModule = class _EntitiesModule {
 };
 
 // src/modules/functions.ts
-var import_sdk_core3 = require("@mitralab.io/sdk-core");
+import {
+  createFunctionsModule
+} from "@mitralab.io/sdk-core";
 var FunctionsModule = class {
   core;
   constructor(httpClient) {
-    this.core = (0, import_sdk_core3.createFunctionsModule)(httpClient, { emptyInput: "omit-body" }, coreErrors);
+    this.core = createFunctionsModule(
+      httpClient,
+      { emptyInput: "omit-body", executeInvocationType: "sync" },
+      coreErrors
+    );
   }
   /**
-   * Executes a Function using the Platform SDK 1.x server-default invocation semantics.
-   * The runtime SDK uses an explicit invocation header instead.
+   * Executes a Function synchronously and waits for its terminal result.
    */
   async execute(functionId, input) {
-    const execution = await this.core.execute(functionId, input);
-    if (execution.input === null) {
-      throw coreErrors.invalidResponse(
-        "Function execution response has an invalid input field"
-      );
-    }
-    return { ...execution, input: execution.input };
+    return this.core.execute(functionId, input);
+  }
+  /** Queues a Function and returns its initial execution record. */
+  async executeAsync(functionId, input) {
+    return this.core.executeAsync(functionId, input);
+  }
+  /** Reads the current state of an asynchronous Function execution. */
+  async getExecution(executionId) {
+    return this.core.getExecution(executionId);
+  }
+  /** Requests cancellation of a queued or running Function execution. */
+  cancelExecution(executionId) {
+    return this.core.cancelExecution(executionId);
   }
 };
 
 // src/modules/integration.ts
-var import_sdk_core4 = require("@mitralab.io/sdk-core");
+import {
+  createIntegrationAdminModule,
+  createIntegrationModule
+} from "@mitralab.io/sdk-core";
 var IntegrationModule = class {
   core;
+  configs;
   constructor(httpClient) {
-    this.core = (0, import_sdk_core4.createIntegrationModule)(httpClient, coreErrors);
+    this.core = createIntegrationModule(httpClient, coreErrors);
+    this.configs = createIntegrationAdminModule(httpClient, coreErrors);
+  }
+  /** Lists the current app's integration configs without exposing admin mutations. */
+  list(options) {
+    return this.configs.list(options);
   }
   executeResource(resourceId, params) {
     return this.core.executeResource(resourceId, params);
@@ -611,34 +1307,307 @@ var IntegrationModule = class {
   execute(configId, request) {
     return this.core.execute(configId, request);
   }
+  /** Executes a saved integration config selected by its app-scoped alias. */
+  executeByAlias(alias, request) {
+    return this.core.executeByAlias(alias, request);
+  }
 };
 
 // src/modules/queries.ts
-var import_sdk_core5 = require("@mitralab.io/sdk-core");
+import {
+  createQueriesModule
+} from "@mitralab.io/sdk-core";
 var QueriesModule = class {
-  dataSourceId = "";
   core;
   constructor(httpClient) {
-    this.core = (0, import_sdk_core5.createQueriesModule)(httpClient, () => this.dataSourceId, coreErrors);
+    this.core = createQueriesModule(httpClient, coreErrors);
   }
-  /** Called by `client.init()` to set the app's resolved data source. */
-  setDataSourceId(dataSourceId) {
-    this.dataSourceId = dataSourceId;
+  /**
+   * @deprecated Preserved for Platform SDK 1.x source compatibility. Data Manager now resolves
+   * the Data Source from the authenticated app.
+   */
+  setDataSourceId(_dataSourceId) {
   }
   async execute(id, parameters) {
-    const result = await this.core.execute(id, parameters);
-    return { ...result, affectedRows: result.affectedRows ?? null };
+    return this.core.execute(id, parameters);
+  }
+};
+
+// src/modules/agent-tasks.ts
+import {
+  createAgentTaskSessionManager,
+  createAgentTasksModule,
+  withAgentTaskSessions
+} from "@mitralab.io/sdk-core";
+
+// src/modules/agent-session.ts
+var CONNECT_TIMEOUT_MS = 15e3;
+function stripBearer2(token) {
+  return token.replace(/^Bearer\s+/i, "");
+}
+function asObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function expectEvent(value) {
+  const event = asObject(value);
+  if (!event || typeof event.type !== "string" || !event.type) return null;
+  if (typeof event.timestamp !== "number" || !Number.isFinite(event.timestamp)) return null;
+  if (event.sequence !== void 0 && (typeof event.sequence !== "number" || !Number.isSafeInteger(event.sequence) || event.sequence < 0)) return null;
+  return {
+    type: event.type,
+    payload: event.payload,
+    timestamp: event.timestamp,
+    ...typeof event.sequence === "number" ? { sequence: event.sequence } : {}
+  };
+}
+function parseEvent(raw) {
+  if (typeof raw !== "string") return expectEvent(raw);
+  try {
+    return expectEvent(JSON.parse(raw));
+  } catch {
+    return null;
+  }
+}
+function isNormalClose(event) {
+  return event.code === 1e3 || event.code === 4409;
+}
+var BrowserAgentTaskEventSource = class {
+  constructor(auth, apiUrl) {
+    this.auth = auth;
+    this.apiUrl = stripTrailingSlashes(apiUrl);
+  }
+  apiUrl;
+  sseFallbackTasks = /* @__PURE__ */ new Set();
+  async open(taskId, observer, signal, transport = "auto") {
+    if (transport === "http") return this.openSse(taskId, observer, signal);
+    if (transport === "websocket") return this.openWebSocket(taskId, observer, signal);
+    if (this.sseFallbackTasks.has(taskId)) {
+      return this.wrapAutoConnection(taskId, await this.openSse(taskId, observer, signal));
+    }
+    try {
+      const connection = await this.openWebSocket(taskId, {
+        ...observer,
+        onDisconnect: (error) => {
+          this.sseFallbackTasks.add(taskId);
+          observer.onDisconnect(error);
+        }
+      }, signal);
+      return this.wrapAutoConnection(taskId, connection);
+    } catch {
+      this.sseFallbackTasks.add(taskId);
+      return this.wrapAutoConnection(taskId, await this.openSse(taskId, observer, signal));
+    }
+  }
+  wrapAutoConnection(taskId, connection) {
+    return {
+      close: () => {
+        this.sseFallbackTasks.delete(taskId);
+        connection.close();
+      }
+    };
+  }
+  async requireFreshToken() {
+    const fresh = await this.auth.ensureFreshSession();
+    const token = this.auth.accessToken;
+    if (!fresh || !token) {
+      throw new Error("A fresh authenticated app session is required for Agent streaming.");
+    }
+    return token;
+  }
+  async openWebSocket(taskId, observer, signal) {
+    if (typeof globalThis.WebSocket !== "function") {
+      throw new TypeError("WebSocket is not available.");
+    }
+    if (signal?.aborted) throw signal.reason ?? new Error("Agent WebSocket connection aborted.");
+    const token = await this.requireFreshToken();
+    const url = `${this.apiUrl.replace(/^http/i, "ws")}/copilot/ws/tasks/${encodeURIComponent(taskId)}?token=${encodeURIComponent(stripBearer2(token))}`;
+    return new Promise((resolve, reject) => {
+      const socket = new globalThis.WebSocket(url);
+      let opened = false;
+      let intentionalClose = false;
+      let settled = false;
+      const removeAbortListener = () => signal?.removeEventListener("abort", onAbort);
+      const clearHandshake = () => {
+        globalThis.clearTimeout(timer);
+        removeAbortListener();
+      };
+      const rejectHandshake = (error) => {
+        if (settled) return;
+        settled = true;
+        intentionalClose = true;
+        clearHandshake();
+        socket.close();
+        reject(error);
+      };
+      const close = () => {
+        if (intentionalClose) return;
+        intentionalClose = true;
+        removeAbortListener();
+        socket.close(1e3, "Client closed");
+      };
+      const onAbort = () => {
+        if (!opened) {
+          rejectHandshake(signal?.reason instanceof Error ? signal.reason : new Error("Agent WebSocket connection aborted."));
+          return;
+        }
+        close();
+      };
+      const timer = globalThis.setTimeout(() => {
+        rejectHandshake(new Error("Timed out connecting to the Agent WebSocket."));
+      }, CONNECT_TIMEOUT_MS);
+      signal?.addEventListener("abort", onAbort, { once: true });
+      socket.onopen = () => {
+        if (settled) return;
+        opened = true;
+        settled = true;
+        globalThis.clearTimeout(timer);
+        resolve({ close });
+      };
+      socket.onerror = () => {
+        if (!opened) rejectHandshake(new Error("Failed to connect to the Agent WebSocket."));
+      };
+      socket.onmessage = (message) => {
+        const event = parseEvent(message.data);
+        if (event) observer.onEvent(event);
+      };
+      socket.onclose = (event) => {
+        globalThis.clearTimeout(timer);
+        removeAbortListener();
+        if (!opened) {
+          rejectHandshake(new Error(`Agent WebSocket closed during handshake (${event.code}).`));
+          return;
+        }
+        if (!intentionalClose && !isNormalClose(event)) {
+          observer.onDisconnect(new Error(`Agent WebSocket disconnected (${event.code}).`));
+        }
+      };
+    });
+  }
+  async openSse(taskId, observer, signal) {
+    if (signal?.aborted) throw signal.reason ?? new Error("Agent SSE connection aborted.");
+    const requestToken = await this.requireFreshToken();
+    const abort = new AbortController();
+    let intentionalClose = false;
+    let disconnected = false;
+    const url = `${this.apiUrl}/copilot/api/v1/tasks/${encodeURIComponent(taskId)}/events`;
+    const request = (token) => globalThis.fetch(url, {
+      headers: { Accept: "text/event-stream", Authorization: `Bearer ${stripBearer2(token)}` },
+      signal: abort.signal
+    });
+    const onAbort = () => {
+      intentionalClose = true;
+      abort.abort(signal?.reason);
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+    let response = await request(requestToken);
+    if (response.status === 401 && await this.auth.handleUnauthorized(requestToken)) {
+      const currentToken = this.auth.accessToken;
+      if (currentToken) response = await request(currentToken);
+    }
+    if (!response.ok || !response.body) {
+      signal?.removeEventListener("abort", onAbort);
+      abort.abort();
+      throw new Error(`Agent SSE connection failed (${response.status}).`);
+    }
+    const disconnect = (error) => {
+      if (disconnected || intentionalClose || signal?.aborted) return;
+      disconnected = true;
+      observer.onDisconnect(error);
+    };
+    void this.readSse(response.body, observer, abort.signal).then(() => disconnect()).catch((error) => disconnect(error)).finally(() => signal?.removeEventListener("abort", onAbort));
+    return {
+      close: () => {
+        if (intentionalClose) return;
+        intentionalClose = true;
+        signal?.removeEventListener("abort", onAbort);
+        abort.abort();
+      }
+    };
+  }
+  async readSse(body, observer, signal) {
+    const reader = body.getReader();
+    const decoder = new TextDecoder();
+    let buffer = "";
+    try {
+      while (!signal.aborted) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        buffer += decoder.decode(value, { stream: true });
+        let separator = /\r?\n\r?\n/.exec(buffer);
+        while (separator?.index !== void 0) {
+          const block = buffer.slice(0, separator.index);
+          buffer = buffer.slice(separator.index + separator[0].length);
+          const data = block.split(/\r?\n/).filter((line) => line.startsWith("data:")).map((line) => line.slice(5).trimStart()).join("\n");
+          const event = data ? parseEvent(data) : null;
+          if (event) observer.onEvent(event);
+          separator = /\r?\n\r?\n/.exec(buffer);
+        }
+      }
+    } finally {
+      reader.releaseLock();
+    }
   }
 };
 
+// src/modules/agent-tasks.ts
+function createBrowserAgentTasksModule(httpClient, auth, apiUrl) {
+  const tasks = createAgentTasksModule(httpClient, coreErrors);
+  const manager = createAgentTaskSessionManager({
+    tasks,
+    eventSource: new BrowserAgentTaskEventSource(auth, apiUrl)
+  });
+  return withAgentTaskSessions(tasks, manager);
+}
+
+// src/modules/agent-credentials.ts
+import {
+  createAgentCredentialsModule
+} from "@mitralab.io/sdk-core";
+function requireProvider(provider, allowed, flow) {
+  if (!allowed.includes(provider)) {
+    throw new TypeError(`${flow} does not support provider ${provider}.`);
+  }
+}
+function createBrowserAgentCredentialsModule(httpClient) {
+  const core = createAgentCredentialsModule(httpClient, coreErrors);
+  return {
+    list: () => core.list(),
+    listModels: (agentId) => core.listModels(agentId),
+    saveApiKey: (provider, apiKey) => {
+      requireProvider(provider, ["ANTHROPIC", "OPENAI"], "API key authentication");
+      return core.saveApiKey(provider, apiKey);
+    },
+    remove: (provider) => {
+      requireProvider(provider, ["ANTHROPIC", "OPENAI"], "Credential removal");
+      return core.remove(provider);
+    },
+    startOAuth: (provider) => {
+      requireProvider(provider, ["ANTHROPIC"], "OAuth");
+      return core.startOAuth(provider);
+    },
+    exchangeOAuth: (provider, input) => {
+      requireProvider(provider, ["ANTHROPIC"], "OAuth");
+      return core.exchangeOAuth(provider, input);
+    },
+    startDeviceAuthorization: (provider) => {
+      requireProvider(provider, ["OPENAI"], "Device authorization");
+      return core.startDeviceAuthorization(provider);
+    },
+    pollDeviceAuthorization: (provider, deviceAuthId) => {
+      requireProvider(provider, ["OPENAI"], "Device authorization");
+      return core.pollDeviceAuthorization(provider, deviceAuthId);
+    }
+  };
+}
+
 // src/client.ts
 function expectAppInfoResponse(value) {
-  const response = (0, import_sdk_core6.expectObject)(
+  const response = expectObject2(
     value,
     "App info response",
     coreErrors
   );
-  if (typeof response.dataSourceId !== "string" || !response.dataSourceId.trim()) {
+  if (response.dataSourceId !== null && (typeof response.dataSourceId !== "string" || !response.dataSourceId.trim())) {
     throw coreErrors.invalidResponse(
       "App info response has an invalid dataSourceId field"
     );
@@ -654,18 +1623,23 @@ function expectAppInfoResponse(value) {
   };
 }
 function createClient(config) {
-  const { appId, apiUrl, onError } = config;
-  const iamUrl = `${apiUrl}/iam`;
-  const dataManagerUrl = `${apiUrl}/data-manager`;
-  const functionsUrl = `${apiUrl}/functions`;
-  const integrationUrl = `${apiUrl}/integration`;
-  const codeStudioUrl = `${apiUrl}/code-studio`;
-  const authModule = new AuthModule(appId, iamUrl);
-  const onUnauthorized = () => authModule.refreshSession();
+  const { appId, apiUrl, authPageUrl, onError } = config;
+  const gatewayUrl = stripTrailingSlashes(apiUrl);
+  const iamUrl = `${gatewayUrl}/iam`;
+  const dataManagerUrl = `${gatewayUrl}/data-manager`;
+  const functionsUrl = `${gatewayUrl}/functions`;
+  const integrationUrl = `${gatewayUrl}/integration`;
+  const codeStudioUrl = `${gatewayUrl}/code-studio`;
+  const copilotUrl = `${gatewayUrl}/copilot`;
+  const authModule = new AuthModule(appId, iamUrl, { apiUrl: gatewayUrl, authPageUrl });
+  const authSession = getAuthSessionPort(authModule);
+  const onUnauthorized = (requestToken) => authSession.handleUnauthorized(requestToken);
+  const beforeAuthenticatedRequest = () => authModule.ensureFreshSession().then(() => void 0);
   const defaultHeaders = { "X-App-Id": appId };
   const httpClient = new HttpClient({
     baseUrl: dataManagerUrl,
     getToken: () => authModule.accessToken,
+    beforeAuthenticatedRequest,
     onUnauthorized,
     onError,
     defaultHeaders
@@ -674,20 +1648,43 @@ function createClient(config) {
   const functionsHttpClient = new HttpClient({
     baseUrl: functionsUrl,
     getToken: () => authModule.accessToken,
+    beforeAuthenticatedRequest,
     onUnauthorized,
     onError,
     defaultHeaders
   });
   const functionsModule = new FunctionsModule(functionsHttpClient);
+  const publicFunctionsModule = createPublicFunctionsModule(
+    new HttpClient({ baseUrl: functionsUrl, getToken: () => null }),
+    coreErrors
+  );
+  const copilotHttpClient = new HttpClient({
+    baseUrl: copilotUrl,
+    getToken: () => authModule.accessToken,
+    beforeAuthenticatedRequest,
+    onUnauthorized,
+    onError,
+    defaultHeaders
+  });
+  const agentTasksModule = createBrowserAgentTasksModule(
+    copilotHttpClient,
+    authSession,
+    gatewayUrl
+  );
+  const agentCredentialsModule = createBrowserAgentCredentialsModule(copilotHttpClient);
   const integrationHttpClient = new HttpClient({
     baseUrl: integrationUrl,
     getToken: () => authModule.accessToken,
+    beforeAuthenticatedRequest,
     onUnauthorized,
     onError,
     defaultHeaders
   });
   const integrationModule = new IntegrationModule(integrationHttpClient);
   const queriesModule = new QueriesModule(httpClient);
+  const legacyBridge = new LegacySessionBridge(authSession, appId, apiUrl, authPageUrl);
+  setActiveBridge(legacyBridge);
+  legacyBridge.connect();
   let initialized = false;
   let allowSignup = true;
   async function init() {
@@ -698,11 +1695,12 @@ function createClient(config) {
     });
     const appInfo = expectAppInfoResponse(
       await publicClient.get(
-        `/api/v1/apps/${(0, import_sdk_core6.encodePathSegment)(appId, "appId", coreErrors)}/info`
+        `/api/v1/apps/${encodePathSegment(appId, "appId", coreErrors)}/info`
       )
     );
-    entitiesModule.setDataSourceId(appInfo.dataSourceId);
-    queriesModule.setDataSourceId(appInfo.dataSourceId);
+    if (appInfo.dataSourceId) {
+      entitiesModule.setDataSourceId(appInfo.dataSourceId);
+    }
     allowSignup = appInfo.allowSignup;
     initialized = true;
   }
@@ -711,6 +1709,9 @@ function createClient(config) {
     auth: authModule,
     entities: entitiesModule,
     functions: functionsModule,
+    publicFunctions: publicFunctionsModule,
+    agentTasks: agentTasksModule,
+    agentCredentials: agentCredentialsModule,
     integration: integrationModule,
     queries: queriesModule,
     get allowSignup() {
@@ -719,8 +1720,85 @@ function createClient(config) {
     config
   };
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
+
+// src/legacy/index.ts
+import {
+  exchangeSsoCodeMitra as legacyExchangeSsoCodeMitra,
+  loginMitra as legacyLoginMitra,
+  loginWithGoogleMitra as legacyLoginWithGoogleMitra,
+  loginWithMicrosoftMitra as legacyLoginWithMicrosoftMitra
+} from "mitra-interactions-sdk";
+import { configureSdkMitra as configureSdkMitra2 } from "mitra-interactions-sdk";
+import { createMitraInstance } from "mitra-interactions-sdk";
+import { getConfig as getConfig2 } from "mitra-interactions-sdk";
+import { resolveProjectId } from "mitra-interactions-sdk";
+import { refreshTokenSilently } from "mitra-interactions-sdk";
+import { executeServerFunctionMitra } from "mitra-interactions-sdk";
+import { executeServerFunctionAsyncMitra } from "mitra-interactions-sdk";
+import { executePublicServerFunctionMitra } from "mitra-interactions-sdk";
+import { executePublicServerFunctionAsyncMitra } from "mitra-interactions-sdk";
+import { getPublicServerFunctionExecutionMitra } from "mitra-interactions-sdk";
+import { stopServerFunctionExecutionMitra } from "mitra-interactions-sdk";
+import { callIntegrationMitra } from "mitra-interactions-sdk";
+import { listIntegrationsMitra } from "mitra-interactions-sdk";
+import { listRecordsMitra } from "mitra-interactions-sdk";
+import { getRecordMitra } from "mitra-interactions-sdk";
+import { createRecordMitra } from "mitra-interactions-sdk";
+import { createRecordsBatchMitra } from "mitra-interactions-sdk";
+import { updateRecordMitra } from "mitra-interactions-sdk";
+import { patchRecordMitra } from "mitra-interactions-sdk";
+import { deleteRecordMitra } from "mitra-interactions-sdk";
+import { getAgentTaskMitra } from "mitra-interactions-sdk";
+import { manageAgentChatMitra } from "mitra-interactions-sdk";
+import { manageAgentCredentialMitra } from "mitra-interactions-sdk";
+var loginMitra = async (method, options) => {
+  const session = await legacyLoginMitra(method, options);
+  adoptLegacySession(session);
+  return session;
+};
+var loginWithGoogleMitra = async (options) => {
+  const session = await legacyLoginWithGoogleMitra(options);
+  adoptLegacySession(session);
+  return session;
+};
+var loginWithMicrosoftMitra = async (options) => {
+  const session = await legacyLoginWithMicrosoftMitra(options);
+  adoptLegacySession(session);
+  return session;
+};
+var exchangeSsoCodeMitra = async (options) => {
+  const session = await legacyExchangeSsoCodeMitra(options);
+  adoptLegacySession(session);
+  return session;
+};
+export {
   MitraApiError,
-  createClient
-});
+  callIntegrationMitra,
+  configureSdkMitra2 as configureSdkMitra,
+  createClient,
+  createMitraInstance,
+  createRecordMitra,
+  createRecordsBatchMitra,
+  deleteRecordMitra,
+  exchangeSsoCodeMitra,
+  executePublicServerFunctionAsyncMitra,
+  executePublicServerFunctionMitra,
+  executeServerFunctionAsyncMitra,
+  executeServerFunctionMitra,
+  getAgentTaskMitra,
+  getConfig2 as getConfig,
+  getPublicServerFunctionExecutionMitra,
+  getRecordMitra,
+  listIntegrationsMitra,
+  listRecordsMitra,
+  loginMitra,
+  loginWithGoogleMitra,
+  loginWithMicrosoftMitra,
+  manageAgentChatMitra,
+  manageAgentCredentialMitra,
+  patchRecordMitra,
+  refreshTokenSilently,
+  resolveProjectId,
+  stopServerFunctionExecutionMitra,
+  updateRecordMitra
+};