@neetru/cli 2.10.0 → 2.11.0

package/dist/lib/auth.js

@@ -13,7 +13,7 @@
  * }
  * ```
  */
-import { promises as fs, existsSync } from 'node:fs';
+import { promises as fs, existsSync, readFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { homedir } from 'node:os';
 export function getAuthFilePath() {
@@ -102,6 +102,38 @@ export async function resolveSessionEmail() {
         return null;
     }
 }
+/**
+ * MASTER-HIGH-048 (2.11.0) — leitura sincrona APENAS do `auth.json`.
+ *
+ * Helper interno usado por `getActiveTokenSync()` (em `token-resolver.ts`).
+ * Mantido aqui pra preservar o limite de escopo `auth.ts` = `auth.json`-only.
+ *
+ * Retorna `null` em qualquer falha (arquivo ausente, JSON invalido, token
+ * vazio). Pra erro detalhado, usar `loadToken()` async.
+ */
+export function readAuthJsonSync() {
+    const authPath = getAuthFilePath();
+    if (!existsSync(authPath))
+        return null;
+    try {
+        const raw = readFileSync(authPath, 'utf8');
+        const parsed = JSON.parse(raw);
+        if (parsed &&
+            typeof parsed.token === 'string' &&
+            parsed.token.length > 0 &&
+            typeof parsed.email === 'string') {
+            return {
+                token: parsed.token,
+                email: parsed.email,
+                savedAt: parsed.savedAt ?? '',
+            };
+        }
+    }
+    catch {
+        // ignora — token ausente
+    }
+    return null;
+}
 export async function clearToken() {
     const path = getAuthFilePath();
     if (!existsSync(path))

package/dist/lib/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAQlC,MAAM,UAAU,eAAe;IAC7B,yEAAyE;IACzE,2EAA2E;IAC3E,4CAA4C;IAC5C,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C;QACE,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACnC,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,oBAAoB,CAC5B,gBAAgB,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAClD,CAAC;IACJ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,CAC5B,WAAW,IAAI,qDAAqD,CACrE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAA6B,CAAC;IAC3C,IACE,CAAC,IAAI;QACL,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;QAC9B,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;QAC9B,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAChC,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC5B,WAAW,IAAI,qDAAqD,CACrE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa,EAAE,KAAa;IAC1D,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1B,wEAAwE;IACxE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEtD,MAAM,OAAO,GAAe;QAC1B,KAAK;QACL,KAAK;QACL,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAClC,CAAC;IAEF,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QACzD,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IAEH,4EAA4E;IAC5E,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,kCAAkC;IACpC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,SAAS,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAQlC,MAAM,UAAU,eAAe;IAC7B,yEAAyE;IACzE,2EAA2E;IAC3E,4CAA4C;IAC5C,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C;QACE,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACnC,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,oBAAoB,CAC5B,gBAAgB,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAClD,CAAC;IACJ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,CAC5B,WAAW,IAAI,qDAAqD,CACrE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAA6B,CAAC;IAC3C,IACE,CAAC,IAAI;QACL,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;QAC9B,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;QAC9B,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAChC,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC5B,WAAW,IAAI,qDAAqD,CACrE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa,EAAE,KAAa;IAC1D,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1B,wEAAwE;IACxE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEtD,MAAM,OAAO,GAAe;QAC1B,KAAK;QACL,KAAK;QACL,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAClC,CAAC;IAEF,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QACzD,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IAEH,4EAA4E;IAC5E,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,kCAAkC;IACpC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,SAAS,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwB,CAAC;QACtD,IACE,MAAM;YACN,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAChC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YACvB,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAChC,CAAC;YACD,OAAO;gBACL,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;aAC9B,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yBAAyB;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/cli-read.d.ts

@@ -1,5 +1,8 @@
 /**
  * Resolve o Bearer token corrente. Retorna `null` se não houver sessão.
+ *
+ * MASTER-HIGH-048 (2.11.0): wrapper sobre `getActiveTokenSync()` —
+ * mantem `async` por compat com call-sites que esperam Promise.
  */
 export declare function resolveToken(): Promise<string | null>;
 /**

package/dist/lib/cli-read.js

@@ -9,13 +9,16 @@
  *   1 — não autenticado / não encontrado (4xx semântico do usuário)
  *   2 — token inválido/revogado, erro de rede, erro de servidor
  */
-import { config } from './config.js';
 import { loadToken, AuthFileMissingError, AuthFileInvalidError, } from './auth.js';
+import { getActiveTokenSync } from './token-resolver.js';
 import { CliApiError, CliNetworkError } from './api-client.js';
 import { log } from '../utils/logger.js';
 import { safeExit } from '../utils/safe-exit.js';
 /**
  * Resolve o Bearer token corrente. Retorna `null` se não houver sessão.
+ *
+ * MASTER-HIGH-048 (2.11.0): wrapper sobre `getActiveTokenSync()` —
+ * mantem `async` por compat com call-sites que esperam Promise.
  */
 export async function resolveToken() {
     try {
@@ -25,7 +28,7 @@ export async function resolveToken() {
     catch (err) {
         if (err instanceof AuthFileMissingError) {
             // Fallback: Conf storage (legacy `neetru login --token <nrt_...>`).
-            return config.get('neetruApiKey') ?? null;
+            return getActiveTokenSync();
         }
         if (err instanceof AuthFileInvalidError) {
             log.error(err.message);

package/dist/lib/cli-read.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli-read.js","sourceRoot":"","sources":["../../src/lib/cli-read.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EACL,SAAS,EACT,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEjD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,SAAS,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;YACxC,oEAAoE;YACpE,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC;QAC5C,CAAC;QACD,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;YACxC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAc;IAC/C,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE,CAAC;IACnC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;QACvE,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC3D,CAAC;QACD,QAAQ,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc,EAAE,IAAc;IAC3D,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACjD,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAChG,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,KAAK,CACP,KAAK,CAAC,MAAM,KAAK,GAAG;oBAClB,CAAC,CAAC,mDAAmD;oBACrD,CAAC,CAAC,kBAAkB,KAAK,CAAC,OAAO,EAAE,CACtC,CAAC;YACJ,CAAC;YACD,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACzB,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACzF,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,IAAI,yBAAyB,CAAC,CAAC;YACxD,CAAC;YACD,QAAQ,CAAC,CAAC,CAAC,CAAC;QACd,CAAC;QACD,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAC/F,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,KAAK,CAAC,qBAAqB,KAAK,CAAC,MAAM,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,QAAQ,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;QACrC,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACvF,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QACD,QAAQ,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAClG,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,KAAK,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,QAAQ,CAAC,CAAC,CAAC,CAAC;AACd,CAAC"}
+{"version":3,"file":"cli-read.js","sourceRoot":"","sources":["../../src/lib/cli-read.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EACL,SAAS,EACT,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,SAAS,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;YACxC,oEAAoE;YACpE,OAAO,kBAAkB,EAAE,CAAC;QAC9B,CAAC;QACD,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;YACxC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAc;IAC/C,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE,CAAC;IACnC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;QACvE,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC3D,CAAC;QACD,QAAQ,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc,EAAE,IAAc;IAC3D,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACjD,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAChG,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,KAAK,CACP,KAAK,CAAC,MAAM,KAAK,GAAG;oBAClB,CAAC,CAAC,mDAAmD;oBACrD,CAAC,CAAC,kBAAkB,KAAK,CAAC,OAAO,EAAE,CACtC,CAAC;YACJ,CAAC;YACD,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACzB,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACzF,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,IAAI,yBAAyB,CAAC,CAAC;YACxD,CAAC;YACD,QAAQ,CAAC,CAAC,CAAC,CAAC;QACd,CAAC;QACD,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAC/F,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,KAAK,CAAC,qBAAqB,KAAK,CAAC,MAAM,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,QAAQ,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;QACrC,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACvF,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QACD,QAAQ,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAClG,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,KAAK,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,QAAQ,CAAC,CAAC,CAAC,CAAC;AACd,CAAC"}

package/dist/lib/telemetry.d.ts

@@ -0,0 +1,45 @@
+export interface TelemetryEvent {
+    /** Nome do comando (ex: `db.apply`, `deploy`, `whoami`). */
+    command: string;
+    /** Duracao em ms (best-effort). */
+    durationMs: number;
+    /** Sucesso (exit code 0) ou falha. */
+    ok: boolean;
+    /** Exit code reportado (0..N). */
+    exitCode: number;
+    /** Carimbo ISO do evento. */
+    ts: string;
+}
+export declare function isTelemetryEnabled(): boolean;
+/**
+ * Adiciona um evento ao buffer. Drop silencioso quando opt-in nao foi dado.
+ *
+ * Nao deve falhar — qualquer excecao eh engolida pra nao quebrar o comando.
+ */
+export declare function trackEvent(event: Omit<TelemetryEvent, 'ts'>): void;
+/**
+ * Drena o buffer para o endpoint. Idempotente — chamadas subsequentes
+ * sao no-op apos primeira drenagem.
+ *
+ * **H-01 fix (Opus review 2026-05-27):** `keepalive: true` permite que a
+ * request POST sobreviva o `process.exit()` chamado por safeExit. Antes
+ * o request era abortado quando o event loop morria, e como safeExit
+ * tambem destruia o globalAgent (M-05), o fetch sequer chegava a sair.
+ */
+export declare function flushTelemetry(): Promise<void>;
+/**
+ * Instala hooks de flush:
+ *  - `beforeExit` — drena via event loop natural (sucesso, comandos que retornam)
+ *  - `exit` — best-effort em paths que chamam `process.exit` direto (safeExit)
+ *
+ * **H-01 fix (Opus review 2026-05-27):** chamar no ENTRY-POINT do CLI
+ * (src/index.ts antes do parse), nao dentro de postAction (que nem dispara
+ * pra comandos que falham). Idempotente — subsequente eh no-op.
+ */
+export declare function installTelemetryFlushHook(): void;
+export declare function markCommandStart(commandName: string): void;
+export declare function markCommandEnd(exitCode: number): void;
+/** Para tests — esvazia o estado de comando atual. */
+export declare function _resetCurrentCommandForTests(): void;
+/** Para tests — esvazia o buffer e o flag de flush. */
+export declare function _resetTelemetryForTests(): void;

package/dist/lib/telemetry.js

@@ -0,0 +1,199 @@
+/**
+ * MASTER-HIGH-052 (2.11.0) — emitter de telemetry CLI.
+ *
+ * Pre-2.11 a flag `telemetry.enabled` existia no `config.ts` schema, era
+ * settable via `neetru config set telemetry.enabled true`, mas NENHUM
+ * call-site emitia evento. Comentario placeholder `// Sprint 11` ficou la
+ * por umas seis sprints. (HIGH-10 chefe-CLI HIGH-05.)
+ *
+ * Implementacao 2.11:
+ *   - Buffer in-memory (max 50 eventos) drenado em processo `beforeExit`.
+ *   - Opt-in default-OFF (`config.get('telemetry.enabled') === true`).
+ *   - Anonimo: instalacao identificada por `installId` (UUID gerado uma
+ *     vez em ~/.config/neetru-cli/install-id) — sem email, sem token,
+ *     sem path absoluto, sem env vars, sem arg do usuario.
+ *   - Endpoint: POST /api/sdk/v1/telemetry/log (Core ja tem rota viva).
+ *   - Fire-and-forget: erro de rede NUNCA atrapalha o comando do usuario.
+ *
+ * Override pra dev/CI:
+ *   - `NEETRU_TELEMETRY_DISABLED=1` desliga forcado.
+ *   - `NEETRU_TELEMETRY_URL=...` redireciona (usado em vitest).
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { homedir } from 'node:os';
+import { randomUUID } from 'node:crypto';
+import { config } from './config.js';
+import { CLI_VERSION } from '../version.js';
+const MAX_BUFFER = 50;
+const buffer = [];
+let flushed = false;
+let cachedInstallId = null;
+function getInstallIdPath() {
+    return join(homedir(), '.config', 'neetru-cli', 'install-id');
+}
+function readOrCreateInstallId() {
+    if (cachedInstallId)
+        return cachedInstallId;
+    const filePath = getInstallIdPath();
+    if (existsSync(filePath)) {
+        try {
+            const raw = readFileSync(filePath, 'utf8').trim();
+            if (raw.length >= 8) {
+                cachedInstallId = raw;
+                return raw;
+            }
+        }
+        catch {
+            // re-cria
+        }
+    }
+    const id = randomUUID();
+    try {
+        mkdirSync(dirname(filePath), { recursive: true, mode: 0o700 });
+        writeFileSync(filePath, id, { encoding: 'utf8', mode: 0o600 });
+    }
+    catch {
+        // sem permissao — segue com installId em-memoria, sem persistencia
+    }
+    cachedInstallId = id;
+    return id;
+}
+function getEndpoint() {
+    if (process.env.NEETRU_TELEMETRY_URL)
+        return process.env.NEETRU_TELEMETRY_URL;
+    const base = config.get('neetruApiUrl') ??
+        'https://api.neetru.com';
+    return `${base.replace(/\/+$/, '')}/api/sdk/v1/telemetry/log`;
+}
+export function isTelemetryEnabled() {
+    if (process.env.NEETRU_TELEMETRY_DISABLED === '1')
+        return false;
+    const v = config.get('telemetry.enabled');
+    return v === true;
+}
+/**
+ * Adiciona um evento ao buffer. Drop silencioso quando opt-in nao foi dado.
+ *
+ * Nao deve falhar — qualquer excecao eh engolida pra nao quebrar o comando.
+ */
+export function trackEvent(event) {
+    try {
+        if (!isTelemetryEnabled())
+            return;
+        if (buffer.length >= MAX_BUFFER)
+            return; // soft cap, nao bloqueia comando
+        buffer.push({ ...event, ts: new Date().toISOString() });
+    }
+    catch {
+        // engole
+    }
+}
+/**
+ * Drena o buffer para o endpoint. Idempotente — chamadas subsequentes
+ * sao no-op apos primeira drenagem.
+ *
+ * **H-01 fix (Opus review 2026-05-27):** `keepalive: true` permite que a
+ * request POST sobreviva o `process.exit()` chamado por safeExit. Antes
+ * o request era abortado quando o event loop morria, e como safeExit
+ * tambem destruia o globalAgent (M-05), o fetch sequer chegava a sair.
+ */
+export async function flushTelemetry() {
+    if (flushed)
+        return;
+    flushed = true;
+    if (!isTelemetryEnabled())
+        return;
+    if (buffer.length === 0)
+        return;
+    const envelope = {
+        cliVersion: CLI_VERSION,
+        installId: readOrCreateInstallId(),
+        os: `${process.platform}-${process.arch}`,
+        events: buffer.splice(0, buffer.length),
+    };
+    const endpoint = getEndpoint();
+    // Fire-and-forget com timeout curto (1.5s). Erro de rede engolido.
+    const controller = new AbortController();
+    const tid = setTimeout(() => controller.abort(), 1500);
+    try {
+        await fetch(endpoint, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify(envelope),
+            signal: controller.signal,
+            // H-01 fix: garante que request sobrevive process.exit() do safeExit.
+            // Suportado em Node 18+ (undici) e em todos browsers/Edge runtimes.
+            // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+            // @ts-ignore — RequestInit em Node DOM types nao expoe `keepalive`
+            keepalive: true,
+        });
+    }
+    catch {
+        // engole — falha de telemetry nao afeta o usuario
+    }
+    finally {
+        clearTimeout(tid);
+    }
+}
+let exitHookInstalled = false;
+/**
+ * Instala hooks de flush:
+ *  - `beforeExit` — drena via event loop natural (sucesso, comandos que retornam)
+ *  - `exit` — best-effort em paths que chamam `process.exit` direto (safeExit)
+ *
+ * **H-01 fix (Opus review 2026-05-27):** chamar no ENTRY-POINT do CLI
+ * (src/index.ts antes do parse), nao dentro de postAction (que nem dispara
+ * pra comandos que falham). Idempotente — subsequente eh no-op.
+ */
+export function installTelemetryFlushHook() {
+    if (exitHookInstalled)
+        return;
+    exitHookInstalled = true;
+    process.once('beforeExit', () => {
+        void flushTelemetry();
+    });
+    // exit hook adicional: capa comandos que chamam process.exit() direto
+    // (sem deixar event loop drenar). fetch keepalive:true permite que a
+    // request sobreviva. Note: process.on('exit') eh SINCRONO, void fetch
+    // nao bloqueia — best-effort.
+    process.once('exit', () => {
+        void flushTelemetry();
+    });
+}
+/**
+ * **H-01 fix camada 2 (Opus review):** captura comandos que terminam via
+ * `safeExit(N != 0)` ou `process.exit(N)`. Sem isso, comandos que falham
+ * (a porcao mais importante pra debug UX) NUNCA emitem evento de
+ * telemetria.
+ *
+ * Chamar no `preAction` hook do Commander pra marcar inicio do comando.
+ * O `process.exit` hook captura o exit code real.
+ */
+let currentCommand = null;
+export function markCommandStart(commandName) {
+    currentCommand = { name: commandName, start: Date.now() };
+}
+export function markCommandEnd(exitCode) {
+    if (!currentCommand)
+        return;
+    trackEvent({
+        command: currentCommand.name,
+        durationMs: Date.now() - currentCommand.start,
+        ok: exitCode === 0,
+        exitCode,
+    });
+    currentCommand = null;
+}
+/** Para tests — esvazia o estado de comando atual. */
+export function _resetCurrentCommandForTests() {
+    currentCommand = null;
+}
+/** Para tests — esvazia o buffer e o flag de flush. */
+export function _resetTelemetryForTests() {
+    buffer.length = 0;
+    flushed = false;
+    cachedInstallId = null;
+    exitHookInstalled = false;
+}
+//# sourceMappingURL=telemetry.js.map

package/dist/lib/telemetry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.js","sourceRoot":"","sources":["../../src/lib/telemetry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAsB5C,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,MAAM,GAAqB,EAAE,CAAC;AACpC,IAAI,OAAO,GAAG,KAAK,CAAC;AACpB,IAAI,eAAe,GAAkB,IAAI,CAAC;AAE1C,SAAS,gBAAgB;IACvB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,qBAAqB;IAC5B,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAC5C,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;IACpC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YAClD,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBACpB,eAAe,GAAG,GAAG,CAAC;gBACtB,OAAO,GAAG,CAAC;YACb,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,UAAU;QACZ,CAAC;IACH,CAAC;IACD,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,aAAa,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;IACrE,CAAC;IACD,eAAe,GAAG,EAAE,CAAC;IACrB,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,WAAW;IAClB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAC9E,MAAM,IAAI,GACP,MAAM,CAAC,GAAG,CAAC,cAAc,CAAwB;QAClD,wBAAwB,CAAC;IAC3B,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,2BAA2B,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC1C,OAAO,CAAC,KAAK,IAAI,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,KAAiC;IAC1D,IAAI,CAAC;QACH,IAAI,CAAC,kBAAkB,EAAE;YAAE,OAAO;QAClC,IAAI,MAAM,CAAC,MAAM,IAAI,UAAU;YAAE,OAAO,CAAC,iCAAiC;QAC1E,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,IAAI,OAAO;QAAE,OAAO;IACpB,OAAO,GAAG,IAAI,CAAC;IACf,IAAI,CAAC,kBAAkB,EAAE;QAAE,OAAO;IAClC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEhC,MAAM,QAAQ,GAAsB;QAClC,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,qBAAqB,EAAE;QAClC,EAAE,EAAE,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE;QACzC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;KACxC,CAAC;IAEF,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAE/B,mEAAmE;IACnE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,QAAQ,EAAE;YACpB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YAC9B,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,sEAAsE;YACtE,oEAAoE;YACpE,6DAA6D;YAC7D,mEAAmE;YACnE,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,kDAAkD;IACpD,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,IAAI,iBAAiB,GAAG,KAAK,CAAC;AAC9B;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB;IACvC,IAAI,iBAAiB;QAAE,OAAO;IAC9B,iBAAiB,GAAG,IAAI,CAAC;IACzB,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE;QAC9B,KAAK,cAAc,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IACH,sEAAsE;IACtE,qEAAqE;IACrE,sEAAsE;IACtE,8BAA8B;IAC9B,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;QACxB,KAAK,cAAc,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,IAAI,cAAc,GAA2C,IAAI,CAAC;AAElE,MAAM,UAAU,gBAAgB,CAAC,WAAmB;IAClD,cAAc,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,IAAI,CAAC,cAAc;QAAE,OAAO;IAC5B,UAAU,CAAC;QACT,OAAO,EAAE,cAAc,CAAC,IAAI;QAC5B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC,KAAK;QAC7C,EAAE,EAAE,QAAQ,KAAK,CAAC;QAClB,QAAQ;KACT,CAAC,CAAC;IACH,cAAc,GAAG,IAAI,CAAC;AACxB,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,4BAA4B;IAC1C,cAAc,GAAG,IAAI,CAAC;AACxB,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,uBAAuB;IACrC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAClB,OAAO,GAAG,KAAK,CAAC;IAChB,eAAe,GAAG,IAAI,CAAC;IACvB,iBAAiB,GAAG,KAAK,CAAC;AAC5B,CAAC"}

package/dist/lib/token-resolver.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Resolve o Bearer token corrente. Retorna `null` se nao houver sessao.
+ *
+ * Side effect: na primeira vez que o token vier do Conf (e nao do
+ * auth.json), emite um warning stderr (one-shot por processo) avisando da
+ * deprecacao da rota legacy. Comandos com `--json` ainda assim recebem o
+ * warning em stderr (machine-readable stdout fica limpo).
+ */
+export declare function getActiveTokenSync(): string | null;
+/** Para tests — reseta o flag de warning one-shot. */
+export declare function _resetLegacyWarningForTests(): void;

package/dist/lib/token-resolver.js

@@ -0,0 +1,52 @@
+/**
+ * MASTER-HIGH-048 (2.11.0) — token resolver sincrono.
+ *
+ * Antes da 2.11, `api-client.ts` lia o token APENAS do `Conf` storage. Mas
+ * desde a Sprint 1 (2026-05-04) o storage canonico passou a ser
+ * `~/.config/neetru-cli/auth.json` (chmod 0600, fora do JSON do Conf).
+ * `login` gravava nos DOIS pra compat; comandos como `status`, `validate`,
+ * `db`, `deploy`, `vm`, `logs`, `doctor`, `publish` so conseguiam ler de
+ * Conf — entao copiar `auth.json` pra outra maquina deixava esses 8
+ * comandos "logado mas nao logado". Cause classica de bug de suporte.
+ *
+ * Solucao: resolver sincrono que prefere `auth.json` e usa Conf so como
+ * fallback. Quem chamava `config.get('neetruApiKey')` direto agora chama
+ * `getActiveTokenSync()`.
+ *
+ * Ordem:
+ *   1. `~/.config/neetru-cli/auth.json` (canonico)
+ *   2. Conf `neetruApiKey` (legacy — emite deprecation warning em 2.11; remove em 2.12.0)
+ *   3. null
+ */
+import { readAuthJsonSync } from './auth.js';
+import { config } from './config.js';
+let legacyWarningEmitted = false;
+/**
+ * Resolve o Bearer token corrente. Retorna `null` se nao houver sessao.
+ *
+ * Side effect: na primeira vez que o token vier do Conf (e nao do
+ * auth.json), emite um warning stderr (one-shot por processo) avisando da
+ * deprecacao da rota legacy. Comandos com `--json` ainda assim recebem o
+ * warning em stderr (machine-readable stdout fica limpo).
+ */
+export function getActiveTokenSync() {
+    const auth = readAuthJsonSync();
+    if (auth && auth.token)
+        return auth.token;
+    const legacy = config.get('neetruApiKey');
+    if (typeof legacy === 'string' && legacy.length > 0) {
+        if (!legacyWarningEmitted && !process.env.NEETRU_SUPPRESS_LEGACY_WARNINGS) {
+            legacyWarningEmitted = true;
+            // stderr — preserva pipe-friendly stdout.
+            process.stderr.write('⚠ Aviso: usando token do storage legacy (Conf). Execute `neetru logout && neetru login` pra migrar pra ~/.config/neetru-cli/auth.json.\n' +
+                '  Storage legacy sera removido em @neetru/cli@2.12.\n');
+        }
+        return legacy;
+    }
+    return null;
+}
+/** Para tests — reseta o flag de warning one-shot. */
+export function _resetLegacyWarningForTests() {
+    legacyWarningEmitted = false;
+}
+//# sourceMappingURL=token-resolver.js.map

package/dist/lib/token-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-resolver.js","sourceRoot":"","sources":["../../src/lib/token-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,IAAI,oBAAoB,GAAG,KAAK,CAAC;AAEjC;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IAE1C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC1C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,oBAAoB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,CAAC;YAC1E,oBAAoB,GAAG,IAAI,CAAC;YAC5B,0CAA0C;YAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0IAA0I;gBACxI,uDAAuD,CAC1D,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,2BAA2B;IACzC,oBAAoB,GAAG,KAAK,CAAC;AAC/B,CAAC"}

package/dist/lib/url-allowlist.d.ts

@@ -0,0 +1,30 @@
+/**
+ * MASTER-HIGH-049 (2.11.0) — allowlist de hosts pra `neetruApiUrl`.
+ *
+ * Pre-2.11, `neetru config set neetruApiUrl http://evil.com` era aceito sem
+ * warning. Proxima chamada `neetru whoami` mandava o Bearer
+ * `nrt_<keyId>_<secret>` direto pra `evil.com` — vetor de exfiltracao do
+ * token CLI. (HIGH-10 / chefe-CLI HIGH-02.)
+ *
+ * Politica:
+ *   - Hosts trustred: api.neetru.com, core.neetru.com, *.neetru.com,
+ *     localhost (qualquer porta), 127.0.0.1 (qualquer porta).
+ *   - Hosts NAO trusted: warning vermelho + bloqueio sem
+ *     `--allow-untrusted-url` (ou env `NEETRU_ALLOW_UNTRUSTED_URL=1`).
+ */
+export interface AllowlistResult {
+    trusted: boolean;
+    host: string;
+    reason?: string;
+}
+/**
+ * Classifica a URL alvo. Retorna `trusted=true` quando o host bate na
+ * allowlist; `trusted=false` (com `reason`) caso contrario.
+ */
+export declare function classifyApiUrl(rawUrl: string): AllowlistResult;
+/**
+ * Override por env. Setar `NEETRU_ALLOW_UNTRUSTED_URL=1` pula a checagem
+ * tanto em `config set` quanto em runtime warnings — util pra dev em
+ * ambientes corporativos com proxy.
+ */
+export declare function isOverrideEnabled(): boolean;

package/dist/lib/url-allowlist.js

@@ -0,0 +1,90 @@
+/**
+ * MASTER-HIGH-049 (2.11.0) — allowlist de hosts pra `neetruApiUrl`.
+ *
+ * Pre-2.11, `neetru config set neetruApiUrl http://evil.com` era aceito sem
+ * warning. Proxima chamada `neetru whoami` mandava o Bearer
+ * `nrt_<keyId>_<secret>` direto pra `evil.com` — vetor de exfiltracao do
+ * token CLI. (HIGH-10 / chefe-CLI HIGH-02.)
+ *
+ * Politica:
+ *   - Hosts trustred: api.neetru.com, core.neetru.com, *.neetru.com,
+ *     localhost (qualquer porta), 127.0.0.1 (qualquer porta).
+ *   - Hosts NAO trusted: warning vermelho + bloqueio sem
+ *     `--allow-untrusted-url` (ou env `NEETRU_ALLOW_UNTRUSTED_URL=1`).
+ */
+const TRUSTED_HOSTS_EXACT = new Set([
+    'api.neetru.com',
+    'core.neetru.com',
+    'neetru.com',
+]);
+const TRUSTED_HOST_PATTERNS = [
+    /\.neetru\.com$/i, // qualquer subdominio de neetru.com (auth.neetru.com etc)
+    /^localhost$/i, // dev
+    /^127\.0\.0\.1$/, // dev IPv4 loopback
+    /^\[::1\]$/, // dev IPv6 loopback (URL host com bracket)
+];
+/**
+ * Classifica a URL alvo. Retorna `trusted=true` quando o host bate na
+ * allowlist; `trusted=false` (com `reason`) caso contrario.
+ */
+export function classifyApiUrl(rawUrl) {
+    let parsed;
+    try {
+        parsed = new URL(rawUrl);
+    }
+    catch (err) {
+        return {
+            trusted: false,
+            host: rawUrl,
+            reason: `URL invalida: ${err.message}`,
+        };
+    }
+    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+        return {
+            trusted: false,
+            host: parsed.host,
+            reason: `Protocolo nao suportado: ${parsed.protocol}`,
+        };
+    }
+    // Hostname (sem porta).
+    const hostname = parsed.hostname.toLowerCase();
+    const isLoopback = hostname === 'localhost' ||
+        hostname === '127.0.0.1' ||
+        hostname === '::1';
+    // Match contra allowlist (exact + pattern).
+    let hostnameAllowed = TRUSTED_HOSTS_EXACT.has(hostname);
+    if (!hostnameAllowed) {
+        for (const pattern of TRUSTED_HOST_PATTERNS) {
+            if (pattern.test(hostname)) {
+                hostnameAllowed = true;
+                break;
+            }
+        }
+    }
+    if (!hostnameAllowed) {
+        return {
+            trusted: false,
+            host: parsed.host,
+            reason: 'Host fora da allowlist neetru.com / localhost',
+        };
+    }
+    // Hostname permitido. Para hosts NAO-loopback, exige HTTPS (HTTP em
+    // host de producao expoe Bearer token a sniffing trivial).
+    if (!isLoopback && parsed.protocol === 'http:') {
+        return {
+            trusted: false,
+            host: parsed.host,
+            reason: `HTTP nao-cifrado para host nao-loopback (${hostname}). Use https://`,
+        };
+    }
+    return { trusted: true, host: parsed.host };
+}
+/**
+ * Override por env. Setar `NEETRU_ALLOW_UNTRUSTED_URL=1` pula a checagem
+ * tanto em `config set` quanto em runtime warnings — util pra dev em
+ * ambientes corporativos com proxy.
+ */
+export function isOverrideEnabled() {
+    return process.env.NEETRU_ALLOW_UNTRUSTED_URL === '1';
+}
+//# sourceMappingURL=url-allowlist.js.map

package/dist/lib/url-allowlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-allowlist.js","sourceRoot":"","sources":["../../src/lib/url-allowlist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAQH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,gBAAgB;IAChB,iBAAiB;IACjB,YAAY;CACb,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAA0B;IACnD,iBAAiB,EAAE,0DAA0D;IAC7E,cAAc,EAAE,MAAM;IACtB,gBAAgB,EAAE,oBAAoB;IACtC,WAAW,EAAE,2CAA2C;CACzD,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,iBAAkB,GAAa,CAAC,OAAO,EAAE;SAClD,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChE,OAAO;YACL,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM,EAAE,4BAA4B,MAAM,CAAC,QAAQ,EAAE;SACtD,CAAC;IACJ,CAAC;IAED,wBAAwB;IACxB,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAE/C,MAAM,UAAU,GACd,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,KAAK,CAAC;IAErB,4CAA4C;IAC5C,IAAI,eAAe,GAAG,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;YAC5C,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3B,eAAe,GAAG,IAAI,CAAC;gBACvB,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM,EAAE,+CAA+C;SACxD,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,2DAA2D;IAC3D,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC/C,OAAO;YACL,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM,EAAE,4CAA4C,QAAQ,iBAAiB;SAC9E,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,OAAO,CAAC,GAAG,CAAC,0BAA0B,KAAK,GAAG,CAAC;AACxD,CAAC"}

package/dist/utils/safe-exit.js

@@ -37,21 +37,14 @@ function cleanupHandles() {
         process.stdin.destroy();
     }
     catch { /* já fechado */ }
-    // 3. Destroy http/https keep-alive sockets
-    try {
-        // eslint-disable-next-line @typescript-eslint/no-var-requires
-        const http = require('node:http');
-        if (http?.globalAgent?.destroy)
-            http.globalAgent.destroy();
-    }
-    catch { /* best-effort */ }
-    try {
-        // eslint-disable-next-line @typescript-eslint/no-var-requires
-        const https = require('node:https');
-        if (https?.globalAgent?.destroy)
-            https.globalAgent.destroy();
-    }
-    catch { /* best-effort */ }
+    // 3. M-05 fix (Opus review 2026-05-27): NÃO destruir globalAgent.
+    //    Antes destruíamos http.globalAgent.destroy() + https.globalAgent.destroy()
+    //    pra fechar keep-alive sockets — mas isso quebrava telemetria flush
+    //    e qualquer retry em-flight. fetch() Node 20+ usa undici internamente
+    //    e não depende do http.globalAgent legado. As assertions libuv
+    //    UV_HANDLE_CLOSING em Windows resolvem com stdin.destroy() (acima)
+    //    e o exit imediato — sockets http morrem com o processo de qualquer
+    //    forma. Manter destroy aqui só prejudicava telemetria keepalive:true.
 }
 /**
  * Sai com `code` após cleanup de handles libuv. NEVER returns.

package/dist/utils/safe-exit.js.map

@@ -1 +1 @@
-{"version":3,"file":"safe-exit.js","sourceRoot":"","sources":["../../src/utils/safe-exit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,SAAS,cAAc;IACrB,gEAAgE;IAChE,IAAI,CAAC;QAAC,eAAe,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAEtD,6CAA6C;IAC7C,IAAI,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,gBAAgB,CAAC,CAAC;IAE3D,2CAA2C;IAC3C,IAAI,CAAC;QACH,8DAA8D;QAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;QAClC,IAAI,IAAI,EAAE,WAAW,EAAE,OAAO;YAAE,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC7B,IAAI,CAAC;QACH,8DAA8D;QAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;QACpC,IAAI,KAAK,EAAE,WAAW,EAAE,OAAO;YAAE,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,cAAc,EAAE,CAAC;IACjB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,cAAc,EAAE,CAAC;IACjB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"safe-exit.js","sourceRoot":"","sources":["../../src/utils/safe-exit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,SAAS,cAAc;IACrB,gEAAgE;IAChE,IAAI,CAAC;QAAC,eAAe,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAEtD,6CAA6C;IAC7C,IAAI,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,gBAAgB,CAAC,CAAC;IAE3D,kEAAkE;IAClE,gFAAgF;IAChF,wEAAwE;IACxE,0EAA0E;IAC1E,mEAAmE;IACnE,uEAAuE;IACvE,wEAAwE;IACxE,0EAA0E;AAC5E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,cAAc,EAAE,CAAC;IACjB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,cAAc,EAAE,CAAC;IACjB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;AAC1B,CAAC"}