mitra-interactions-sdk 1.0.60-beta.12 → 1.0.60-beta.14

package/dist/index.d.mts

@@ -881,6 +881,16 @@ declare function emailLoginMitra(options: EmailLoginOptions): Promise<LoginRespo
 declare function emailVerifyCodeMitra(options: EmailVerifyCodeOptions): Promise<LoginResponse>;
 declare function emailResendCodeMitra(options: EmailResendCodeOptions): Promise<void>;
 declare function refreshTokenSilently(authUrl: string, projectId: number | string): Promise<LoginResponse>;
+/**
+ * Gera o JWT a partir do code do SSO (novo Mitra). O app lê codeMitra/stateMitra
+ * do fragment (lógica de template) e chama aqui pra validar o nonce e trocar o
+ * code por token no BFF. Exclusivo do novo mundo — no legacy o token já vem
+ * pronto no fragment (tokenMitra).
+ */
+declare function exchangeSsoCodeMitra(options: {
+    code: string;
+    state: string;
+}): Promise<LoginResponse>;
 
 /**
  * Mitra Interactions SDK - Password Reset (legacy backend)
@@ -1127,4 +1137,4 @@ declare function setProfileScreensMitra(options: SetProfileScreensOptions): Prom
  */
 declare function setProfileServerFunctionsMitra(options: SetProfileServerFunctionsOptions): Promise<SetProfilePermissionResponse>;
 
-export { type AgentApiKeyTarget, type AgentAttachment, type AgentAttachmentType, type AgentAuthMeta, type AgentChat, type AgentDeltaEvent, type AgentErrorEvent, type AgentMessage, type AgentModelGroup, type AgentModelOption, type AgentProviderListItem, type AgentQueueChangeEvent, type AgentStatusChangeEvent, type AgentSubscriptionAccount, type AgentSubscriptionTarget, type AgentTaskCreatedEvent, type AgentTaskEventMap, type AgentTaskEventName, type AgentTaskSession, type AgentTaskStatus, type AgentToolEvent, type AgentTurnEndEvent, type AgentType, type AuthAgentCredentialOptions, type AuthAgentCredentialResult, type AuthClaudeResult, type AuthCodexResult, type AuthMethod, type CallIntegrationOptions, type CallIntegrationResponse, type ChatManageAction, type ConnectAgentCredentialOptions, type ConnectAgentSubscriptionResult, type ConnectableSubscriptionTarget, type CreateProfileOptions, type CreateProfileResponse, type CreateRecordOptions, type CreateRecordsBatchOptions, type CredentialAccessType, type CredentialAction, type CredentialTarget, type DeleteAgentChatResult, type DeleteProfileOptions, type DeleteProfileResponse, type DeleteRecordOptions, type EmailLoginOptions, type EmailResendCodeOptions, type EmailSignupOptions, type EmailVerifyCodeOptions, type ExecuteDataLoaderOptions, type ExecuteDataLoaderResponse, type ExecutePublicServerFunctionAsyncResponse, type ExecutePublicServerFunctionOptions, type ExecutePublicServerFunctionResponse, type ExecuteServerFunctionAsyncOptions, type ExecuteServerFunctionAsyncResponse, type ExecuteServerFunctionOptions, type ExecuteServerFunctionResponse, type GetAgentTaskCreateOptions, type GetAgentTaskOpenOptions, type GetAgentTaskOptions, type GetProfileDetailsOptions, type GetProfileDetailsResponse, type GetPublicServerFunctionExecutionOptions, type GetPublicServerFunctionExecutionResponse, type GetRecordOptions, type IntegrationResponse, type ListAgentModelsResult, type ListAgentProvidersResult, type ListIntegrationsOptions, type ListProfilesOptions, type ListProfilesResponse, type ListRecordsOptions, type ListRecordsResponse, type LoginOptions, type LoginResponse, type ManageAgentChatDeleteOptions, type ManageAgentChatListOptions, type ManageAgentChatOptions, type ManageAgentChatRenameOptions, type ManageAgentCredentialOptions, type ManageAgentCredentialResult, type MitraConfig, type MitraInstance, type PatchRecordOptions, type ProfileTableRef, type QueuedItem, type RenameAgentChatResult, type ResetPasswordOptions, type SendOptions, type SendPasswordResetCodeOptions, type SetFileStatusOptions, type SetFileStatusResponse, type SetProfileActionsOptions, type SetProfileDmlTablesOptions, type SetProfilePermissionResponse, type SetProfileScreensOptions, type SetProfileSelectTablesOptions, type SetProfileServerFunctionsOptions, type SetProfileUsersOptions, type StopServerFunctionExecutionOptions, type StopServerFunctionExecutionResponse, type UpdateProfileOptions, type UpdateProfileResponse, type UpdateRecordOptions, type UploadFileOptions, type UploadFileResponse, type ValidatePasswordResetCodeOptions, callIntegrationMitra, configureSdkMitra, createMitraInstance, createProfileMitra, createRecordMitra, createRecordsBatchMitra, deleteProfileMitra, deleteRecordMitra, emailLoginMitra, emailResendCodeMitra, emailSignupMitra, emailVerifyCodeMitra, executeDataLoaderMitra, executePublicServerFunctionAsyncMitra, executePublicServerFunctionMitra, executeServerFunctionAsyncMitra, executeServerFunctionMitra, getAgentTaskMitra, getConfig, getProfileDetailsMitra, getPublicServerFunctionExecutionMitra, getRecordMitra, listIntegrationsMitra, listProfilesMitra, listRecordsMitra, loginMitra, loginWithEmailMitra, loginWithGoogleMitra, loginWithMicrosoftMitra, manageAgentChatMitra, manageAgentCredentialMitra, patchRecordMitra, refreshTokenSilently, resetPasswordMitra, resolveProjectId, sendPasswordResetCodeMitra, setFileStatusMitra, setProfileActionsMitra, setProfileDmlTablesMitra, setProfileScreensMitra, setProfileSelectTablesMitra, setProfileServerFunctionsMitra, setProfileUsersMitra, stopServerFunctionExecutionMitra, updateProfileMitra, updateRecordMitra, uploadFileLoadableMitra, uploadFilePublicMitra, validatePasswordResetCodeMitra };
+export { type AgentApiKeyTarget, type AgentAttachment, type AgentAttachmentType, type AgentAuthMeta, type AgentChat, type AgentDeltaEvent, type AgentErrorEvent, type AgentMessage, type AgentModelGroup, type AgentModelOption, type AgentProviderListItem, type AgentQueueChangeEvent, type AgentStatusChangeEvent, type AgentSubscriptionAccount, type AgentSubscriptionTarget, type AgentTaskCreatedEvent, type AgentTaskEventMap, type AgentTaskEventName, type AgentTaskSession, type AgentTaskStatus, type AgentToolEvent, type AgentTurnEndEvent, type AgentType, type AuthAgentCredentialOptions, type AuthAgentCredentialResult, type AuthClaudeResult, type AuthCodexResult, type AuthMethod, type CallIntegrationOptions, type CallIntegrationResponse, type ChatManageAction, type ConnectAgentCredentialOptions, type ConnectAgentSubscriptionResult, type ConnectableSubscriptionTarget, type CreateProfileOptions, type CreateProfileResponse, type CreateRecordOptions, type CreateRecordsBatchOptions, type CredentialAccessType, type CredentialAction, type CredentialTarget, type DeleteAgentChatResult, type DeleteProfileOptions, type DeleteProfileResponse, type DeleteRecordOptions, type EmailLoginOptions, type EmailResendCodeOptions, type EmailSignupOptions, type EmailVerifyCodeOptions, type ExecuteDataLoaderOptions, type ExecuteDataLoaderResponse, type ExecutePublicServerFunctionAsyncResponse, type ExecutePublicServerFunctionOptions, type ExecutePublicServerFunctionResponse, type ExecuteServerFunctionAsyncOptions, type ExecuteServerFunctionAsyncResponse, type ExecuteServerFunctionOptions, type ExecuteServerFunctionResponse, type GetAgentTaskCreateOptions, type GetAgentTaskOpenOptions, type GetAgentTaskOptions, type GetProfileDetailsOptions, type GetProfileDetailsResponse, type GetPublicServerFunctionExecutionOptions, type GetPublicServerFunctionExecutionResponse, type GetRecordOptions, type IntegrationResponse, type ListAgentModelsResult, type ListAgentProvidersResult, type ListIntegrationsOptions, type ListProfilesOptions, type ListProfilesResponse, type ListRecordsOptions, type ListRecordsResponse, type LoginOptions, type LoginResponse, type ManageAgentChatDeleteOptions, type ManageAgentChatListOptions, type ManageAgentChatOptions, type ManageAgentChatRenameOptions, type ManageAgentCredentialOptions, type ManageAgentCredentialResult, type MitraConfig, type MitraInstance, type PatchRecordOptions, type ProfileTableRef, type QueuedItem, type RenameAgentChatResult, type ResetPasswordOptions, type SendOptions, type SendPasswordResetCodeOptions, type SetFileStatusOptions, type SetFileStatusResponse, type SetProfileActionsOptions, type SetProfileDmlTablesOptions, type SetProfilePermissionResponse, type SetProfileScreensOptions, type SetProfileSelectTablesOptions, type SetProfileServerFunctionsOptions, type SetProfileUsersOptions, type StopServerFunctionExecutionOptions, type StopServerFunctionExecutionResponse, type UpdateProfileOptions, type UpdateProfileResponse, type UpdateRecordOptions, type UploadFileOptions, type UploadFileResponse, type ValidatePasswordResetCodeOptions, callIntegrationMitra, configureSdkMitra, createMitraInstance, createProfileMitra, createRecordMitra, createRecordsBatchMitra, deleteProfileMitra, deleteRecordMitra, emailLoginMitra, emailResendCodeMitra, emailSignupMitra, emailVerifyCodeMitra, exchangeSsoCodeMitra, executeDataLoaderMitra, executePublicServerFunctionAsyncMitra, executePublicServerFunctionMitra, executeServerFunctionAsyncMitra, executeServerFunctionMitra, getAgentTaskMitra, getConfig, getProfileDetailsMitra, getPublicServerFunctionExecutionMitra, getRecordMitra, listIntegrationsMitra, listProfilesMitra, listRecordsMitra, loginMitra, loginWithEmailMitra, loginWithGoogleMitra, loginWithMicrosoftMitra, manageAgentChatMitra, manageAgentCredentialMitra, patchRecordMitra, refreshTokenSilently, resetPasswordMitra, resolveProjectId, sendPasswordResetCodeMitra, setFileStatusMitra, setProfileActionsMitra, setProfileDmlTablesMitra, setProfileScreensMitra, setProfileSelectTablesMitra, setProfileServerFunctionsMitra, setProfileUsersMitra, stopServerFunctionExecutionMitra, updateProfileMitra, updateRecordMitra, uploadFileLoadableMitra, uploadFilePublicMitra, validatePasswordResetCodeMitra };

package/dist/index.d.ts

@@ -881,6 +881,16 @@ declare function emailLoginMitra(options: EmailLoginOptions): Promise<LoginRespo
 declare function emailVerifyCodeMitra(options: EmailVerifyCodeOptions): Promise<LoginResponse>;
 declare function emailResendCodeMitra(options: EmailResendCodeOptions): Promise<void>;
 declare function refreshTokenSilently(authUrl: string, projectId: number | string): Promise<LoginResponse>;
+/**
+ * Gera o JWT a partir do code do SSO (novo Mitra). O app lê codeMitra/stateMitra
+ * do fragment (lógica de template) e chama aqui pra validar o nonce e trocar o
+ * code por token no BFF. Exclusivo do novo mundo — no legacy o token já vem
+ * pronto no fragment (tokenMitra).
+ */
+declare function exchangeSsoCodeMitra(options: {
+    code: string;
+    state: string;
+}): Promise<LoginResponse>;
 
 /**
  * Mitra Interactions SDK - Password Reset (legacy backend)
@@ -1127,4 +1137,4 @@ declare function setProfileScreensMitra(options: SetProfileScreensOptions): Prom
  */
 declare function setProfileServerFunctionsMitra(options: SetProfileServerFunctionsOptions): Promise<SetProfilePermissionResponse>;
 
-export { type AgentApiKeyTarget, type AgentAttachment, type AgentAttachmentType, type AgentAuthMeta, type AgentChat, type AgentDeltaEvent, type AgentErrorEvent, type AgentMessage, type AgentModelGroup, type AgentModelOption, type AgentProviderListItem, type AgentQueueChangeEvent, type AgentStatusChangeEvent, type AgentSubscriptionAccount, type AgentSubscriptionTarget, type AgentTaskCreatedEvent, type AgentTaskEventMap, type AgentTaskEventName, type AgentTaskSession, type AgentTaskStatus, type AgentToolEvent, type AgentTurnEndEvent, type AgentType, type AuthAgentCredentialOptions, type AuthAgentCredentialResult, type AuthClaudeResult, type AuthCodexResult, type AuthMethod, type CallIntegrationOptions, type CallIntegrationResponse, type ChatManageAction, type ConnectAgentCredentialOptions, type ConnectAgentSubscriptionResult, type ConnectableSubscriptionTarget, type CreateProfileOptions, type CreateProfileResponse, type CreateRecordOptions, type CreateRecordsBatchOptions, type CredentialAccessType, type CredentialAction, type CredentialTarget, type DeleteAgentChatResult, type DeleteProfileOptions, type DeleteProfileResponse, type DeleteRecordOptions, type EmailLoginOptions, type EmailResendCodeOptions, type EmailSignupOptions, type EmailVerifyCodeOptions, type ExecuteDataLoaderOptions, type ExecuteDataLoaderResponse, type ExecutePublicServerFunctionAsyncResponse, type ExecutePublicServerFunctionOptions, type ExecutePublicServerFunctionResponse, type ExecuteServerFunctionAsyncOptions, type ExecuteServerFunctionAsyncResponse, type ExecuteServerFunctionOptions, type ExecuteServerFunctionResponse, type GetAgentTaskCreateOptions, type GetAgentTaskOpenOptions, type GetAgentTaskOptions, type GetProfileDetailsOptions, type GetProfileDetailsResponse, type GetPublicServerFunctionExecutionOptions, type GetPublicServerFunctionExecutionResponse, type GetRecordOptions, type IntegrationResponse, type ListAgentModelsResult, type ListAgentProvidersResult, type ListIntegrationsOptions, type ListProfilesOptions, type ListProfilesResponse, type ListRecordsOptions, type ListRecordsResponse, type LoginOptions, type LoginResponse, type ManageAgentChatDeleteOptions, type ManageAgentChatListOptions, type ManageAgentChatOptions, type ManageAgentChatRenameOptions, type ManageAgentCredentialOptions, type ManageAgentCredentialResult, type MitraConfig, type MitraInstance, type PatchRecordOptions, type ProfileTableRef, type QueuedItem, type RenameAgentChatResult, type ResetPasswordOptions, type SendOptions, type SendPasswordResetCodeOptions, type SetFileStatusOptions, type SetFileStatusResponse, type SetProfileActionsOptions, type SetProfileDmlTablesOptions, type SetProfilePermissionResponse, type SetProfileScreensOptions, type SetProfileSelectTablesOptions, type SetProfileServerFunctionsOptions, type SetProfileUsersOptions, type StopServerFunctionExecutionOptions, type StopServerFunctionExecutionResponse, type UpdateProfileOptions, type UpdateProfileResponse, type UpdateRecordOptions, type UploadFileOptions, type UploadFileResponse, type ValidatePasswordResetCodeOptions, callIntegrationMitra, configureSdkMitra, createMitraInstance, createProfileMitra, createRecordMitra, createRecordsBatchMitra, deleteProfileMitra, deleteRecordMitra, emailLoginMitra, emailResendCodeMitra, emailSignupMitra, emailVerifyCodeMitra, executeDataLoaderMitra, executePublicServerFunctionAsyncMitra, executePublicServerFunctionMitra, executeServerFunctionAsyncMitra, executeServerFunctionMitra, getAgentTaskMitra, getConfig, getProfileDetailsMitra, getPublicServerFunctionExecutionMitra, getRecordMitra, listIntegrationsMitra, listProfilesMitra, listRecordsMitra, loginMitra, loginWithEmailMitra, loginWithGoogleMitra, loginWithMicrosoftMitra, manageAgentChatMitra, manageAgentCredentialMitra, patchRecordMitra, refreshTokenSilently, resetPasswordMitra, resolveProjectId, sendPasswordResetCodeMitra, setFileStatusMitra, setProfileActionsMitra, setProfileDmlTablesMitra, setProfileScreensMitra, setProfileSelectTablesMitra, setProfileServerFunctionsMitra, setProfileUsersMitra, stopServerFunctionExecutionMitra, updateProfileMitra, updateRecordMitra, uploadFileLoadableMitra, uploadFilePublicMitra, validatePasswordResetCodeMitra };
+export { type AgentApiKeyTarget, type AgentAttachment, type AgentAttachmentType, type AgentAuthMeta, type AgentChat, type AgentDeltaEvent, type AgentErrorEvent, type AgentMessage, type AgentModelGroup, type AgentModelOption, type AgentProviderListItem, type AgentQueueChangeEvent, type AgentStatusChangeEvent, type AgentSubscriptionAccount, type AgentSubscriptionTarget, type AgentTaskCreatedEvent, type AgentTaskEventMap, type AgentTaskEventName, type AgentTaskSession, type AgentTaskStatus, type AgentToolEvent, type AgentTurnEndEvent, type AgentType, type AuthAgentCredentialOptions, type AuthAgentCredentialResult, type AuthClaudeResult, type AuthCodexResult, type AuthMethod, type CallIntegrationOptions, type CallIntegrationResponse, type ChatManageAction, type ConnectAgentCredentialOptions, type ConnectAgentSubscriptionResult, type ConnectableSubscriptionTarget, type CreateProfileOptions, type CreateProfileResponse, type CreateRecordOptions, type CreateRecordsBatchOptions, type CredentialAccessType, type CredentialAction, type CredentialTarget, type DeleteAgentChatResult, type DeleteProfileOptions, type DeleteProfileResponse, type DeleteRecordOptions, type EmailLoginOptions, type EmailResendCodeOptions, type EmailSignupOptions, type EmailVerifyCodeOptions, type ExecuteDataLoaderOptions, type ExecuteDataLoaderResponse, type ExecutePublicServerFunctionAsyncResponse, type ExecutePublicServerFunctionOptions, type ExecutePublicServerFunctionResponse, type ExecuteServerFunctionAsyncOptions, type ExecuteServerFunctionAsyncResponse, type ExecuteServerFunctionOptions, type ExecuteServerFunctionResponse, type GetAgentTaskCreateOptions, type GetAgentTaskOpenOptions, type GetAgentTaskOptions, type GetProfileDetailsOptions, type GetProfileDetailsResponse, type GetPublicServerFunctionExecutionOptions, type GetPublicServerFunctionExecutionResponse, type GetRecordOptions, type IntegrationResponse, type ListAgentModelsResult, type ListAgentProvidersResult, type ListIntegrationsOptions, type ListProfilesOptions, type ListProfilesResponse, type ListRecordsOptions, type ListRecordsResponse, type LoginOptions, type LoginResponse, type ManageAgentChatDeleteOptions, type ManageAgentChatListOptions, type ManageAgentChatOptions, type ManageAgentChatRenameOptions, type ManageAgentCredentialOptions, type ManageAgentCredentialResult, type MitraConfig, type MitraInstance, type PatchRecordOptions, type ProfileTableRef, type QueuedItem, type RenameAgentChatResult, type ResetPasswordOptions, type SendOptions, type SendPasswordResetCodeOptions, type SetFileStatusOptions, type SetFileStatusResponse, type SetProfileActionsOptions, type SetProfileDmlTablesOptions, type SetProfilePermissionResponse, type SetProfileScreensOptions, type SetProfileSelectTablesOptions, type SetProfileServerFunctionsOptions, type SetProfileUsersOptions, type StopServerFunctionExecutionOptions, type StopServerFunctionExecutionResponse, type UpdateProfileOptions, type UpdateProfileResponse, type UpdateRecordOptions, type UploadFileOptions, type UploadFileResponse, type ValidatePasswordResetCodeOptions, callIntegrationMitra, configureSdkMitra, createMitraInstance, createProfileMitra, createRecordMitra, createRecordsBatchMitra, deleteProfileMitra, deleteRecordMitra, emailLoginMitra, emailResendCodeMitra, emailSignupMitra, emailVerifyCodeMitra, exchangeSsoCodeMitra, executeDataLoaderMitra, executePublicServerFunctionAsyncMitra, executePublicServerFunctionMitra, executeServerFunctionAsyncMitra, executeServerFunctionMitra, getAgentTaskMitra, getConfig, getProfileDetailsMitra, getPublicServerFunctionExecutionMitra, getRecordMitra, listIntegrationsMitra, listProfilesMitra, listRecordsMitra, loginMitra, loginWithEmailMitra, loginWithGoogleMitra, loginWithMicrosoftMitra, manageAgentChatMitra, manageAgentCredentialMitra, patchRecordMitra, refreshTokenSilently, resetPasswordMitra, resolveProjectId, sendPasswordResetCodeMitra, setFileStatusMitra, setProfileActionsMitra, setProfileDmlTablesMitra, setProfileScreensMitra, setProfileSelectTablesMitra, setProfileServerFunctionsMitra, setProfileUsersMitra, stopServerFunctionExecutionMitra, updateProfileMitra, updateRecordMitra, uploadFileLoadableMitra, uploadFilePublicMitra, validatePasswordResetCodeMitra };

package/dist/index.js

@@ -309,18 +309,82 @@ function normalizeResponse(tokens, authUrl) {
 var NOT_SUPPORTED_POPUP = 'Login via popup (loginWithEmailMitra/loginMitra com method "email" ou "mitra") ainda n\xE3o suportado no novo Mitra. Use emailLoginMitra({ email, password }).';
 var NOT_SUPPORTED_VERIFY = "emailVerifyCodeMitra n\xE3o existe no novo Mitra (signup \xE9 direto, sem c\xF3digo de verifica\xE7\xE3o).";
 var NOT_SUPPORTED_RESEND = "emailResendCodeMitra n\xE3o existe no novo Mitra.";
-var NOT_SUPPORTED_REDIRECT = 'mode "redirect" ainda n\xE3o suportado no novo Mitra para SSO. Use mode "popup" (default).';
 var OAUTH_RESULT_TYPE = "mitra-oauth-result";
 var POPUP_W = 480;
 var POPUP_H = 600;
 var POPUP_TIMEOUT_MS = 5 * 60 * 1e3;
-var SSO_AUTH_PAGE_URL = "https://d2by6yrxhbu2rl.cloudfront.net/sdk-auth.html";
+var SSO_AUTH_PAGE_URL = "https://stg.mitralab.io/sdk-auth.html";
 async function fetchSsoAuthPageUrl(_baseURL) {
   return SSO_AUTH_PAGE_URL;
 }
-function buildStartUrl(authPageUrl, provider, state, appId, apiUrl) {
+var SSO_ENABLED_PROVIDERS = ["google"];
+function providerLabel(provider) {
+  return provider === "microsoft" ? "Microsoft" : provider === "google" ? "Google" : provider;
+}
+function assertProviderAvailable(provider) {
+  if (!SSO_ENABLED_PROVIDERS.includes(provider)) {
+    throw new Error(`Login com ${providerLabel(provider)} ainda n\xE3o dispon\xEDvel no novo Mitra.`);
+  }
+}
+function stripToOriginPath(url) {
+  try {
+    const u = new URL(url);
+    return u.origin + u.pathname;
+  } catch (e) {
+    return url.split("?")[0].split("#")[0];
+  }
+}
+async function exchangeSsoCode(authUrl, provider, code, redirectUri, projectId) {
+  const data = await postBffAuth(buildBffAuthEndpoint(authUrl, `/${provider}`), {
+    appId: String(projectId),
+    code,
+    redirectUri
+  });
+  const response = {
+    token: data.token,
+    // baseURL = authUrl (gateway); o BFF não devolve URLs de bootstrap.
+    baseURL: authUrl,
+    ...data.refreshToken ? { refreshToken: data.refreshToken } : {}
+  };
+  autoConfigureFromLogin2(response, authUrl, projectId);
+  return response;
+}
+var SSO_REDIRECT_STORE_KEY = "mitra_sso_redirect";
+function persistRedirectContext(ctx) {
+  try {
+    sessionStorage.setItem(SSO_REDIRECT_STORE_KEY, JSON.stringify(ctx));
+  } catch (e) {
+  }
+}
+function readRedirectContext() {
+  try {
+    const raw = sessionStorage.getItem(SSO_REDIRECT_STORE_KEY);
+    return raw ? JSON.parse(raw) : null;
+  } catch (e) {
+    return null;
+  }
+}
+function clearRedirectContext() {
+  try {
+    sessionStorage.removeItem(SSO_REDIRECT_STORE_KEY);
+  } catch (e) {
+  }
+}
+function buildStartUrl(authPageUrl, provider, state, appId, apiUrl, returnTo) {
   const sep = authPageUrl.includes("?") ? "&" : "?";
-  return authPageUrl + sep + new URLSearchParams({ provider, state, appId, apiUrl, origin: window.location.origin }).toString();
+  const query = {
+    provider,
+    state,
+    appId,
+    apiUrl,
+    // origin = origin desta SDK; a página trava o postMessage do result nela.
+    origin: window.location.origin,
+    // Contrato novo: a página NÃO troca mais o code — devolve o code cru (popup
+    // via postMessage, redirect via #codeMitra). A SDK troca no BFF /auth/{provider}.
+    responseType: "code"
+  };
+  if (returnTo) query.returnTo = returnTo;
+  return authPageUrl + sep + new URLSearchParams(query).toString();
 }
 function getOriginFromUrl2(url) {
   try {
@@ -377,11 +441,11 @@ function openOAuthPopup(providerUrl, expectedOrigin, expectedState) {
         reject(new Error(data.error || "Erro na autentica\xE7\xE3o OAuth."));
         return;
       }
-      if (!data.token) {
-        reject(new Error("Resposta OAuth sem token."));
+      if (!data.code && !data.token) {
+        reject(new Error("Resposta OAuth sem code nem token."));
         return;
       }
-      resolve({ token: data.token });
+      resolve({ code: data.code, token: data.token });
     }
     function cleanup() {
       clearTimeout(timer);
@@ -394,13 +458,14 @@ function openOAuthPopup(providerUrl, expectedOrigin, expectedState) {
 }
 var _oauthInFlight = null;
 async function loginWithProvider(provider, options) {
-  if (_oauthInFlight) return _oauthInFlight;
+  assertProviderAvailable(provider);
   if (typeof window === "undefined") {
     throw new Error("SSO s\xF3 funciona em ambiente browser.");
   }
   if ((options == null ? void 0 : options.mode) === "redirect") {
-    throw new Error(NOT_SUPPORTED_REDIRECT);
+    return startSsoRedirect(provider, options);
   }
+  if (_oauthInFlight) return _oauthInFlight;
   _oauthInFlight = (async () => {
     try {
       const { authUrl, projectId } = resolveLoginOptions2(options);
@@ -408,8 +473,12 @@ async function loginWithProvider(provider, options) {
       const appId = String(projectId);
       const authPageUrl = await fetchSsoAuthPageUrl(authUrl);
       const pageOrigin = getOriginFromUrl2(authPageUrl);
+      const redirectUri = stripToOriginPath(authPageUrl);
       const startUrl = buildStartUrl(authPageUrl, provider, state, appId, authUrl);
-      const { token } = await openOAuthPopup(startUrl, pageOrigin, state);
+      const { code, token } = await openOAuthPopup(startUrl, pageOrigin, state);
+      if (code) {
+        return await exchangeSsoCode(authUrl, provider, code, redirectUri, projectId);
+      }
       const response = normalizeResponse(token, authUrl);
       autoConfigureFromLogin2(response, authUrl, projectId);
       return response;
@@ -419,6 +488,26 @@ async function loginWithProvider(provider, options) {
   })();
   return _oauthInFlight;
 }
+async function startSsoRedirect(provider, options) {
+  const { authUrl, projectId } = resolveLoginOptions2(options);
+  const state = generateState();
+  const appId = String(projectId);
+  const authPageUrl = await fetchSsoAuthPageUrl();
+  const redirectUri = stripToOriginPath(authPageUrl);
+  persistRedirectContext({ state, provider, authUrl, projectId: appId, redirectUri });
+  const startUrl = buildStartUrl(authPageUrl, provider, state, appId, authUrl, window.location.href);
+  window.location.assign(startUrl);
+  return new Promise(() => {
+  });
+}
+async function exchangeSsoCodeMitra(options) {
+  const ctx = readRedirectContext();
+  clearRedirectContext();
+  if (!ctx || ctx.state !== options.state) {
+    throw new Error("State inv\xE1lido no retorno do SSO (poss\xEDvel CSRF).");
+  }
+  return exchangeSsoCode(ctx.authUrl, ctx.provider, options.code, ctx.redirectUri, ctx.projectId);
+}
 async function loginWithEmailMitra2(_options) {
   throw new Error(NOT_SUPPORTED_POPUP);
 }
@@ -548,6 +637,9 @@ async function emailResendCodeMitra3(options) {
 async function refreshTokenSilently3(authUrl, projectId) {
   return isLegacyAuthUrl(authUrl) ? refreshTokenSilently(authUrl, projectId) : refreshTokenSilently2(authUrl);
 }
+async function exchangeSsoCodeMitra2(options) {
+  return exchangeSsoCodeMitra(options);
+}
 
 // src/password-reset.ts
 var AUTH_API_BY_AUTH_URL = {
@@ -2366,6 +2458,7 @@ exports.emailLoginMitra = emailLoginMitra3;
 exports.emailResendCodeMitra = emailResendCodeMitra3;
 exports.emailSignupMitra = emailSignupMitra3;
 exports.emailVerifyCodeMitra = emailVerifyCodeMitra3;
+exports.exchangeSsoCodeMitra = exchangeSsoCodeMitra2;
 exports.executeDataLoaderMitra = executeDataLoaderMitra;
 exports.executePublicServerFunctionAsyncMitra = executePublicServerFunctionAsyncMitra;
 exports.executePublicServerFunctionMitra = executePublicServerFunctionMitra;