@neetru/cli 2.28.7 → 2.28.10

package/dist/lib/api-client.js

@@ -1,14 +1,23 @@
 import { config } from './config.js';
 import { getActiveTokenSync } from './token-resolver.js';
-import { classifyApiUrl } from './url-allowlist.js';
+import { classifyApiUrl, isOverrideEnabled } from './url-allowlist.js';
+import { CLI_VERSION } from '../version.js';
+import { getCurrentCommandName } from './telemetry.js';
 export class CliApiError extends Error {
     status;
     code;
-    constructor(status, code, message) {
+    /**
+     * `x-correlation-id` carimbado pelo Core na resposta (LABS #6, 2026-09-28).
+     * O Core loga TODA request sob esse id; expor no rodapé do erro fecha o loop
+     * de debug de campo (usuário informa o `ref:` ao suporte).
+     */
+    correlationId;
+    constructor(status, code, message, correlationId) {
         super(message);
         this.name = 'CliApiError';
         this.status = status;
         this.code = code;
+        this.correlationId = correlationId;
     }
 }
 export class CliNetworkError extends Error {
@@ -23,38 +32,47 @@ function buildBaseUrl() {
     const raw = config.get('neetruApiUrl') ?? 'https://api.neetru.com';
     return raw.replace(/\/+$/, '');
 }
-// MASTER-HIGH-049 (2.11.0): warning one-shot quando o host customizado nao
-// bate na allowlist. Nao bloqueia a chamada (a politica de bloqueio fica
-// em `config set`); aqui so chama atencao do owner pra cada `neetru *`
-// rodando com um host estranho.
-let untrustedHostWarningEmitted = false;
-export function maybeWarnUntrustedHost(rawUrl) {
-    if (untrustedHostWarningEmitted)
-        return;
-    if (process.env.NEETRU_SUPPRESS_LEGACY_WARNINGS)
+// MASTER-HIGH-049 → LABS #4/#19 (2026-09-28): FAIL-CLOSED. Antes só emitia um
+// warning one-shot e mandava o Bearer pro host não-confiável assim mesmo — um
+// `config.json` editado/copiado exfiltrava o token `nrt_` com um mero aviso.
+// Agora BLOQUEIA (throw) qualquer host fora da allowlist, salvo override
+// explícito (`NEETRU_ALLOW_UNTRUSTED_URL=1`). O bypass NÃO compartilha mais o
+// kill-switch do nag legado (`NEETRU_SUPPRESS_LEGACY_WARNINGS`) — alerta de
+// segurança não pode morrer junto com ruído de deprecação.
+export function assertTrustedApiHost(rawUrl) {
+    if (isOverrideEnabled())
         return;
     const result = classifyApiUrl(rawUrl);
     if (result.trusted)
         return;
-    untrustedHostWarningEmitted = true;
-    process.stderr.write(`⚠ usando host customizado: ${result.host} (fora da allowlist neetru.com/localhost)\n` +
-        `  Bearer token CLI sera enviado para este host. Verifique se eh confiavel.\n`);
+    throw new CliNetworkError(`Host fora da allowlist (${result.host}): ${result.reason ?? 'não confiável'}. ` +
+        `O Bearer token da CLI NÃO foi enviado. Se este host é confiável, rode com ` +
+        `NEETRU_ALLOW_UNTRUSTED_URL=1.`);
 }
-/** Para tests — reseta o flag one-shot. */
+/** @deprecated Nome legado — agora é fail-closed (throw), não só warning. Use `assertTrustedApiHost`. */
+export const maybeWarnUntrustedHost = assertTrustedApiHost;
+/** @deprecated Sem estado agora (fail-closed não tem flag one-shot). No-op mantido p/ compat de teste. */
 export function _resetUntrustedHostWarningForTests() {
-    untrustedHostWarningEmitted = false;
+    /* no-op */
 }
 export async function apiRequest(path, opts = {}) {
     const baseUrl = buildBaseUrl();
     const url = `${baseUrl}${path.startsWith('/') ? path : `/${path}`}`;
-    // MASTER-HIGH-049 (2.11.0): warning quando host nao-canonico.
-    maybeWarnUntrustedHost(baseUrl);
+    // LABS #4 (2026-09-28): fail-closed — bloqueia host fora da allowlist ANTES
+    // de anexar o Bearer (era só warning que mandava o token assim mesmo).
+    assertTrustedApiHost(baseUrl);
     // MASTER-HIGH-048 (2.11.0): prefere auth.json (canonico) sobre Conf (legacy).
     const token = opts.token ?? getActiveTokenSync();
     const headers = {
         'content-type': 'application/json',
         accept: 'application/json',
     };
+    // LABS #5 (2026-09-28): carimba versão + comando (lineage) do CLI pra o Core
+    // casar erro de campo com o cliente. Só o nome do comando, nunca args (PII).
+    headers['x-neetru-cli-version'] = CLI_VERSION;
+    const cliCommand = getCurrentCommandName();
+    if (cliCommand)
+        headers['x-neetru-cli-command'] = cliCommand;
     if (token)
         headers['authorization'] = `Bearer ${token}`;
     if (opts.headers) {
@@ -132,9 +150,13 @@ export async function apiRequest(path, opts = {}) {
         let message = `Erro HTTP ${response.status}`;
         if (errBody?.error) {
             if (typeof errBody.error === 'string') {
-                // Formato RFC
-                code = errBody.error;
-                message = errBody.error_description ?? errBody.error;
+                // Formato RFC. Auditoria cli/v1 2026-09-29: o 401 do `requireCliAuth`
+                // passou a mandar também `code`/`message` (formato interno) ao lado de
+                // `error`/`error_description` — `code` explícito vence o `error` legado.
+                code = typeof errBody.code === 'string' && errBody.code ? errBody.code : errBody.error;
+                message =
+                    errBody.error_description ??
+                        (typeof errBody.message === 'string' && errBody.message ? errBody.message : errBody.error);
             }
             else {
                 // Formato interno Neetru
@@ -145,7 +167,9 @@ export async function apiRequest(path, opts = {}) {
         else if (typeof parsed === 'string' && parsed.trim() !== '') {
             message = parsed;
         }
-        throw new CliApiError(response.status, code, message);
+        // LABS #6 (2026-09-28): captura o x-correlation-id do Core p/ o rodapé do erro.
+        const correlationId = response.headers.get('x-correlation-id') ?? undefined;
+        throw new CliApiError(response.status, code, message, correlationId);
     }
     return parsed;
 }
@@ -160,13 +184,19 @@ export async function apiRequest(path, opts = {}) {
 export async function* apiStream(path, opts = {}) {
     const baseUrl = buildBaseUrl();
     const url = `${baseUrl}${path.startsWith('/') ? path : `/${path}`}`;
-    maybeWarnUntrustedHost(baseUrl);
+    // LABS #4 (2026-09-28): fail-closed também no stream.
+    assertTrustedApiHost(baseUrl);
     // MASTER-HIGH-048 (2.11.0): mesmo helper aplica ao stream NDJSON.
     const token = opts.token ?? getActiveTokenSync();
     const headers = {
         'content-type': 'application/json',
         accept: 'application/x-ndjson',
     };
+    // LABS #5 (2026-09-28): versão + comando do CLI (sem PII).
+    headers['x-neetru-cli-version'] = CLI_VERSION;
+    const cliCommand = getCurrentCommandName();
+    if (cliCommand)
+        headers['x-neetru-cli-command'] = cliCommand;
     if (token)
         headers['authorization'] = `Bearer ${token}`;
     let response;
@@ -198,7 +228,8 @@ export async function* apiStream(path, opts = {}) {
             if (text.trim())
                 message = text;
         }
-        throw new CliApiError(response.status, code, message);
+        const correlationId = response.headers.get('x-correlation-id') ?? undefined;
+        throw new CliApiError(response.status, code, message, correlationId);
     }
     if (!response.body)
         return;

package/dist/lib/api-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../../src/lib/api-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAOpD,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,MAAM,CAAS;IACf,IAAI,CAAS;IACtB,YAAY,MAAc,EAAE,IAAY,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,KAAK,CAAW;IACzB,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AA2BD,SAAS,YAAY;IACnB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,wBAAwB,CAAC;IACnE,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,2EAA2E;AAC3E,yEAAyE;AACzE,uEAAuE;AACvE,gCAAgC;AAChC,IAAI,2BAA2B,GAAG,KAAK,CAAC;AACxC,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,IAAI,2BAA2B;QAAE,OAAO;IACxC,IAAI,OAAO,CAAC,GAAG,CAAC,+BAA+B;QAAE,OAAO;IACxD,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO;IAC3B,2BAA2B,GAAG,IAAI,CAAC;IACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,8BAA8B,MAAM,CAAC,IAAI,6CAA6C;QACpF,8EAA8E,CACjF,CAAC;AACJ,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,kCAAkC;IAChD,2BAA2B,GAAG,KAAK,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAI,IAAY,EAAE,OAAuB,EAAE;IACzE,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,GAAG,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;IACpE,8DAA8D;IAC9D,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,8EAA8E;IAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,kBAAkB,EAAE,CAAC;IAEjD,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,MAAM,EAAE,kBAAkB;KAC3B,CAAC;IACF,IAAI,KAAK;QAAE,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,KAAK,EAAE,CAAC;IACxD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACpE,CAAC;IAED,iFAAiF;IACjF,mFAAmF;IACnF,kFAAkF;IAClF,mFAAmF;IACnF,iFAAiF;IACjF,uEAAuE;IACvE,EAAE;IACF,8EAA8E;IAC9E,+EAA+E;IAC/E,4EAA4E;IAC5E,wDAAwD;IACxD,EAAE;IACF,6EAA6E;IAC7E,uFAAuF;IACvF,MAAM,kBAAkB,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;IACpD,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAgB,IAAI,CAAC,MAAM;QACrC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC,CAAC,aAAa,CAAC;IAElB,uEAAuE;IACvE,mEAAmE;IACnE,6EAA6E;IAC7E,iEAAiE;IACjE,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEvF,wEAAwE;IACxE,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC1B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;YAC5B,OAAO;YACP,IAAI,EAAE,cAAc;YACpB,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAAc,CAAC;QAC3B,+EAA+E;QAC/E,+EAA+E;QAC/E,MAAM,SAAS,GACb,GAAG,CAAC,IAAI,KAAK,cAAc;YAC3B,CAAC,GAAG,CAAC,IAAI,KAAK,YAAY,IAAK,GAAG,CAAC,KAA2B,EAAE,IAAI,KAAK,cAAc,CAAC;YACxF,CAAC,GAAG,CAAC,IAAI,KAAK,YAAY,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,SAAS;YAC3B,CAAC,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,kBAAkB,GAAG,IAAI,CAAC,mBAAmB,GAAG,EAAE;YAC3E,CAAC,CAAC,sBAAsB,GAAG,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC;QAChD,MAAM,IAAI,eAAe,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IACD,2EAA2E;IAC3E,gEAAgE;IAEhE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,MAAM,GAAY,SAAS,CAAC;IAChC,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;QACtE,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,2DAA2D;QAC3D,mEAAmE;QACnE,MAAM,OAAO,GAAG,MAA+E,CAAC;QAEhG,IAAI,IAAI,GAAG,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrC,IAAI,OAAO,GAAG,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC;QAE7C,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;YACnB,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACtC,cAAc;gBACd,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC;gBACrB,OAAO,GAAG,OAAO,CAAC,iBAAiB,IAAI,OAAO,CAAC,KAAK,CAAC;YACvD,CAAC;iBAAM,CAAC;gBACN,yBAAyB;gBACzB,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC;gBAClC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC;YAC7C,CAAC;QACH,CAAC;aAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC9D,OAAO,GAAG,MAAM,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,MAAW,CAAC;AACrB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,SAAS,CAC9B,IAAY,EACZ,OAAsB,EAAE;IAExB,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,GAAG,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;IACpE,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,kEAAkE;IAClE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,kBAAkB,EAAE,CAAC;IAEjD,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,MAAM,EAAE,sBAAsB;KAC/B,CAAC;IACF,IAAI,KAAK;QAAE,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,KAAK,EAAE,CAAC;IAExD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC1B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;YAC5B,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YACrE,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CACvB,sBAAsB,GAAG,KAAM,KAAe,CAAC,OAAO,EAAE,EACxD,KAAK,CACN,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,IAAI,IAAI,GAAG,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrC,IAAI,OAAO,GAAG,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkC,CAAC;YAClE,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;gBAAE,IAAI,GAAG,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC;iBACjE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBACvB,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC;gBAClC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC;YAC7C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,IAAI,CAAC,IAAI,EAAE;gBAAE,OAAO,GAAG,IAAI,CAAC;QAClC,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO;IAE3B,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;gBACjB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACxC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC9B,IAAI,IAAI,EAAE,CAAC;oBACT,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;oBAC9B,CAAC;oBAAC,MAAM,CAAC;wBACP,2DAA2D;oBAC7D,CAAC;gBACH,CAAC;gBACD,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,4BAA4B;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../../src/lib/api-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAOvD,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,MAAM,CAAS;IACf,IAAI,CAAS;IACtB;;;;OAIG;IACM,aAAa,CAAU;IAChC,YAAY,MAAc,EAAE,IAAY,EAAE,OAAe,EAAE,aAAsB;QAC/E,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;IACrC,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,KAAK,CAAW;IACzB,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AA2BD,SAAS,YAAY;IACnB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,wBAAwB,CAAC;IACnE,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,8EAA8E;AAC9E,8EAA8E;AAC9E,6EAA6E;AAC7E,yEAAyE;AACzE,8EAA8E;AAC9E,4EAA4E;AAC5E,2DAA2D;AAC3D,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,IAAI,iBAAiB,EAAE;QAAE,OAAO;IAChC,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO;IAC3B,MAAM,IAAI,eAAe,CACvB,2BAA2B,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,MAAM,IAAI,eAAe,IAAI;QAC9E,4EAA4E;QAC5E,+BAA+B,CAClC,CAAC;AACJ,CAAC;AAED,yGAAyG;AACzG,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAE3D,0GAA0G;AAC1G,MAAM,UAAU,kCAAkC;IAChD,WAAW;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAI,IAAY,EAAE,OAAuB,EAAE;IACzE,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,GAAG,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;IACpE,4EAA4E;IAC5E,uEAAuE;IACvE,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9B,8EAA8E;IAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,kBAAkB,EAAE,CAAC;IAEjD,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,MAAM,EAAE,kBAAkB;KAC3B,CAAC;IACF,6EAA6E;IAC7E,6EAA6E;IAC7E,OAAO,CAAC,sBAAsB,CAAC,GAAG,WAAW,CAAC;IAC9C,MAAM,UAAU,GAAG,qBAAqB,EAAE,CAAC;IAC3C,IAAI,UAAU;QAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,UAAU,CAAC;IAC7D,IAAI,KAAK;QAAE,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,KAAK,EAAE,CAAC;IACxD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACpE,CAAC;IAED,iFAAiF;IACjF,mFAAmF;IACnF,kFAAkF;IAClF,mFAAmF;IACnF,iFAAiF;IACjF,uEAAuE;IACvE,EAAE;IACF,8EAA8E;IAC9E,+EAA+E;IAC/E,4EAA4E;IAC5E,wDAAwD;IACxD,EAAE;IACF,6EAA6E;IAC7E,uFAAuF;IACvF,MAAM,kBAAkB,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;IACpD,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAgB,IAAI,CAAC,MAAM;QACrC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC,CAAC,aAAa,CAAC;IAElB,uEAAuE;IACvE,mEAAmE;IACnE,6EAA6E;IAC7E,iEAAiE;IACjE,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEvF,wEAAwE;IACxE,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC1B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;YAC5B,OAAO;YACP,IAAI,EAAE,cAAc;YACpB,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAAc,CAAC;QAC3B,+EAA+E;QAC/E,+EAA+E;QAC/E,MAAM,SAAS,GACb,GAAG,CAAC,IAAI,KAAK,cAAc;YAC3B,CAAC,GAAG,CAAC,IAAI,KAAK,YAAY,IAAK,GAAG,CAAC,KAA2B,EAAE,IAAI,KAAK,cAAc,CAAC;YACxF,CAAC,GAAG,CAAC,IAAI,KAAK,YAAY,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,SAAS;YAC3B,CAAC,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,kBAAkB,GAAG,IAAI,CAAC,mBAAmB,GAAG,EAAE;YAC3E,CAAC,CAAC,sBAAsB,GAAG,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC;QAChD,MAAM,IAAI,eAAe,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IACD,2EAA2E;IAC3E,gEAAgE;IAEhE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,MAAM,GAAY,SAAS,CAAC;IAChC,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;QACtE,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,2DAA2D;QAC3D,mEAAmE;QACnE,MAAM,OAAO,GAAG,MAEH,CAAC;QAEd,IAAI,IAAI,GAAG,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrC,IAAI,OAAO,GAAG,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC;QAE7C,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;YACnB,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACtC,sEAAsE;gBACtE,uEAAuE;gBACvE,yEAAyE;gBACzE,IAAI,GAAG,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;gBACvF,OAAO;oBACL,OAAO,CAAC,iBAAiB;wBACzB,CAAC,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC/F,CAAC;iBAAM,CAAC;gBACN,yBAAyB;gBACzB,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC;gBAClC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC;YAC7C,CAAC;QACH,CAAC;aAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC9D,OAAO,GAAG,MAAM,CAAC;QACnB,CAAC;QAED,gFAAgF;QAChF,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,SAAS,CAAC;QAC5E,MAAM,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,MAAW,CAAC;AACrB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,SAAS,CAC9B,IAAY,EACZ,OAAsB,EAAE;IAExB,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,GAAG,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;IACpE,sDAAsD;IACtD,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9B,kEAAkE;IAClE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,kBAAkB,EAAE,CAAC;IAEjD,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,MAAM,EAAE,sBAAsB;KAC/B,CAAC;IACF,2DAA2D;IAC3D,OAAO,CAAC,sBAAsB,CAAC,GAAG,WAAW,CAAC;IAC9C,MAAM,UAAU,GAAG,qBAAqB,EAAE,CAAC;IAC3C,IAAI,UAAU;QAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,UAAU,CAAC;IAC7D,IAAI,KAAK;QAAE,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,KAAK,EAAE,CAAC;IAExD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC1B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;YAC5B,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YACrE,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CACvB,sBAAsB,GAAG,KAAM,KAAe,CAAC,OAAO,EAAE,EACxD,KAAK,CACN,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,IAAI,IAAI,GAAG,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrC,IAAI,OAAO,GAAG,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkC,CAAC;YAClE,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;gBAAE,IAAI,GAAG,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC;iBACjE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBACvB,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC;gBAClC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC;YAC7C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,IAAI,CAAC,IAAI,EAAE;gBAAE,OAAO,GAAG,IAAI,CAAC;QAClC,CAAC;QACD,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,SAAS,CAAC;QAC5E,MAAM,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO;IAE3B,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;gBACjB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACxC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC9B,IAAI,IAAI,EAAE,CAAC;oBACT,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;oBAC9B,CAAC;oBAAC,MAAM,CAAC;wBACP,2DAA2D;oBAC7D,CAAC;gBACH,CAAC;gBACD,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,4BAA4B;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/lib/api-error.js

@@ -33,11 +33,42 @@ function emit(json, payload, text) {
     else
         log.error(text);
 }
+/**
+ * A mensagem do 401 vale ser exibida? O Core legado mandava só
+ * `{ error: 'Unauthorized' }` (o parser vira message='Unauthorized') — aí o
+ * fallback "Execute: neetru login" é mais útil. O Core novo manda
+ * `error_description`/`message` descritivos.
+ */
+function isInformative401Message(message) {
+    const m = (message ?? '').trim();
+    if (!m)
+        return false;
+    return !/^(unauthori[sz]ed|erro http 401)$/i.test(m);
+}
 export function handleApiError(error, json) {
     if (error instanceof CliApiError) {
         const s = error.status;
         if (s === 401) {
-            emit(json, { ok: false, error: 'unauthorized', status: s, message: error.message }, 'Token inválido ou revogado. Execute: neetru login');
+            // Auditoria cli/v1 2026-09-29: o 401 do Core agora carrega `message`/
+            // `error_description` úteis (e o step-up MFA responde `401 mfa_required`).
+            // Antes TODO 401 virava "Token inválido ou revogado" — inclusive o de MFA
+            // faltando, mandando o operador fazer `neetru login` à toa.
+            if (error.code === 'mfa_required') {
+                emit(json, { ok: false, error: 'mfa_required', code: error.code, status: s, message: error.message }, `Step-up MFA exigido: ${error.message}
+` +
+                    '  Passe --mfa-token <código TOTP> ou rode `neetru auth mfa-session` (sessão de 1h).');
+                safeExit(API_ERROR_EXIT.unauthenticated);
+            }
+            const serverMsg = isInformative401Message(error.message) ? error.message : '';
+            emit(json, {
+                ok: false,
+                error: 'unauthorized',
+                ...(error.code && error.code !== 'http_401' ? { code: error.code } : {}),
+                status: s,
+                message: error.message,
+            }, serverMsg
+                ? `Não autenticado: ${serverMsg}${/neetru login/.test(serverMsg) ? '' : ' — execute: neetru login'}`
+                : 'Token inválido ou revogado. Execute: neetru login');
             safeExit(API_ERROR_EXIT.unauthenticated);
         }
         if (s === 403) {

package/dist/lib/api-error.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-error.js","sourceRoot":"","sources":["../../src/lib/api-error.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEjD,+DAA+D;AAC/D,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,MAAM,EAAE,CAAC,EAAE,uBAAuB;IAClC,eAAe,EAAE,CAAC,EAAE,MAAM;IAC1B,SAAS,EAAE,CAAC,EAAE,MAAM;IACpB,MAAM,EAAE,CAAC,EAAE,4BAA4B;CAC/B,CAAC;AAEX,SAAS,IAAI,CAAC,IAAyB,EAAE,OAAgC,EAAE,IAAY;IACrF,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;;QAC1C,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAc,EAAE,IAAc;IAC3D,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;QACvB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,CACF,IAAI,EACJ,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EACvE,mDAAmD,CACpD,CAAC;YACF,QAAQ,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,CACF,IAAI,EACJ,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EACpE,kBAAkB,KAAK,CAAC,OAAO,EAAE,CAClC,CAAC;YACF,QAAQ,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;YACxB,IAAI,CACF,IAAI,EACJ;gBACE,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,cAAc,CAAC;gBAC/D,MAAM,EAAE,CAAC;gBACT,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,EACD,CAAC,KAAK,GAAG;gBACP,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,yBAAyB;gBAC5C,CAAC,CAAC,yBAAyB,CAAC,MAAM,KAAK,CAAC,OAAO,EAAE,CACpD,CAAC;YACF,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QACD,sCAAsC;QACtC,IAAI,CACF,IAAI,EACJ,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,cAAc,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EACrF,qBAAqB,CAAC,MAAM,KAAK,CAAC,OAAO,EAAE,CAC5C,CAAC;QACF,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,kBAAkB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACvG,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;IAC9D,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC"}
+{"version":3,"file":"api-error.js","sourceRoot":"","sources":["../../src/lib/api-error.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEjD,+DAA+D;AAC/D,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,MAAM,EAAE,CAAC,EAAE,uBAAuB;IAClC,eAAe,EAAE,CAAC,EAAE,MAAM;IAC1B,SAAS,EAAE,CAAC,EAAE,MAAM;IACpB,MAAM,EAAE,CAAC,EAAE,4BAA4B;CAC/B,CAAC;AAEX,SAAS,IAAI,CAAC,IAAyB,EAAE,OAAgC,EAAE,IAAY;IACrF,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;;QAC1C,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,OAAe;IAC9C,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,OAAO,CAAC,oCAAoC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAc,EAAE,IAAc;IAC3D,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;QACvB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,sEAAsE;YACtE,2EAA2E;YAC3E,0EAA0E;YAC1E,4DAA4D;YAC5D,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBAClC,IAAI,CACF,IAAI,EACJ,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EACzF,wBAAwB,KAAK,CAAC,OAAO;CAC9C;oBACW,qFAAqF,CACxF,CAAC;gBACF,QAAQ,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,SAAS,GAAG,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,IAAI,CACF,IAAI,EACJ;gBACE,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,cAAc;gBACrB,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxE,MAAM,EAAE,CAAC;gBACT,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,EACD,SAAS;gBACP,CAAC,CAAC,oBAAoB,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,0BAA0B,EAAE;gBACpG,CAAC,CAAC,mDAAmD,CACxD,CAAC;YACF,QAAQ,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,CACF,IAAI,EACJ,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EACpE,kBAAkB,KAAK,CAAC,OAAO,EAAE,CAClC,CAAC;YACF,QAAQ,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;YACxB,IAAI,CACF,IAAI,EACJ;gBACE,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,cAAc,CAAC;gBAC/D,MAAM,EAAE,CAAC;gBACT,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,EACD,CAAC,KAAK,GAAG;gBACP,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,yBAAyB;gBAC5C,CAAC,CAAC,yBAAyB,CAAC,MAAM,KAAK,CAAC,OAAO,EAAE,CACpD,CAAC;YACF,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QACD,sCAAsC;QACtC,IAAI,CACF,IAAI,EACJ,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,cAAc,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EACrF,qBAAqB,CAAC,MAAM,KAAK,CAAC,OAAO,EAAE,CAC5C,CAAC;QACF,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,kBAAkB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACvG,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;IAC9D,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC"}

package/dist/lib/auth.d.ts

@@ -18,14 +18,7 @@ export declare function saveToken(token: string, email: string): Promise<string>
  * Usado para exibir o usuário logado no cabeçalho do CLI.
  */
 export declare function resolveSessionEmail(): Promise<string | null>;
-/**
- * MASTER-HIGH-048 (2.11.0) — leitura sincrona APENAS do `auth.json`.
- *
- * Helper interno usado por `getActiveTokenSync()` (em `token-resolver.ts`).
- * Mantido aqui pra preservar o limite de escopo `auth.ts` = `auth.json`-only.
- *
- * Retorna `null` em qualquer falha (arquivo ausente, JSON invalido, token
- * vazio). Pra erro detalhado, usar `loadToken()` async.
- */
+/** Invalida o cache de auth.json (chamado após escrever/apagar o token). */
+export declare function _invalidateAuthJsonCache(): void;
 export declare function readAuthJsonSync(): NeetruAuth | null;
 export declare function clearToken(): Promise<boolean>;

package/dist/lib/auth.js

@@ -86,6 +86,7 @@ export async function saveToken(token, email) {
         // Em Windows alguns runtimes tratam mode 0600 como read-only flag;
         // ignoramos erro silenciosamente.
     }
+    _invalidateAuthJsonCache(); // LABS #17: token novo → invalida o cache de leitura.
     return path;
 }
 /**
@@ -111,34 +112,49 @@ export async function resolveSessionEmail() {
  * Retorna `null` em qualquer falha (arquivo ausente, JSON invalido, token
  * vazio). Pra erro detalhado, usar `loadToken()` async.
  */
+// LABS #17 (2026-09-28): cache por-processo. `getActiveTokenSync()` chama isto
+// em TODO apiRequest/apiStream; paginação/pickers/watch/`logs -f` reparseavam
+// auth.json N vezes no mesmo processo (existsSync+readFileSync+JSON.parse).
+// Invalidado por saveToken/clearToken — os únicos mutadores dentro do processo.
+// Seguro: o arquivo não muda sob um processo CLI vivo exceto por essas funções.
+let authJsonCache = null;
+/** Invalida o cache de auth.json (chamado após escrever/apagar o token). */
+export function _invalidateAuthJsonCache() {
+    authJsonCache = null;
+}
 export function readAuthJsonSync() {
+    if (authJsonCache)
+        return authJsonCache.value;
     const authPath = getAuthFilePath();
-    if (!existsSync(authPath))
-        return null;
-    try {
-        const raw = readFileSync(authPath, 'utf8');
-        const parsed = JSON.parse(raw);
-        if (parsed &&
-            typeof parsed.token === 'string' &&
-            parsed.token.length > 0 &&
-            typeof parsed.email === 'string') {
-            return {
-                token: parsed.token,
-                email: parsed.email,
-                savedAt: parsed.savedAt ?? '',
-            };
+    let value = null;
+    if (existsSync(authPath)) {
+        try {
+            const raw = readFileSync(authPath, 'utf8');
+            const parsed = JSON.parse(raw);
+            if (parsed &&
+                typeof parsed.token === 'string' &&
+                parsed.token.length > 0 &&
+                typeof parsed.email === 'string') {
+                value = {
+                    token: parsed.token,
+                    email: parsed.email,
+                    savedAt: parsed.savedAt ?? '',
+                };
+            }
+        }
+        catch {
+            // ignora — token ausente/corrompido
         }
     }
-    catch {
-        // ignora — token ausente
-    }
-    return null;
+    authJsonCache = { value };
+    return value;
 }
 export async function clearToken() {
     const path = getAuthFilePath();
     if (!existsSync(path))
         return false;
     await fs.unlink(path);
+    _invalidateAuthJsonCache(); // LABS #17: token removido → invalida o cache.
     return true;
 }
 //# sourceMappingURL=auth.js.map

package/dist/lib/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAQlC,MAAM,UAAU,eAAe;IAC7B,yEAAyE;IACzE,2EAA2E;IAC3E,4CAA4C;IAC5C,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C;QACE,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACnC,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,oBAAoB,CAC5B,gBAAgB,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAClD,CAAC;IACJ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,CAC5B,WAAW,IAAI,qDAAqD,CACrE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAA6B,CAAC;IAC3C,IACE,CAAC,IAAI;QACL,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;QAC9B,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;QAC9B,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAChC,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC5B,WAAW,IAAI,qDAAqD,CACrE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa,EAAE,KAAa;IAC1D,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1B,wEAAwE;IACxE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEtD,MAAM,OAAO,GAAe;QAC1B,KAAK;QACL,KAAK;QACL,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAClC,CAAC;IAEF,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QACzD,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IAEH,4EAA4E;IAC5E,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,kCAAkC;IACpC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,SAAS,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwB,CAAC;QACtD,IACE,MAAM;YACN,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAChC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YACvB,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAChC,CAAC;YACD,OAAO;gBACL,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;aAC9B,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yBAAyB;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAQlC,MAAM,UAAU,eAAe;IAC7B,yEAAyE;IACzE,2EAA2E;IAC3E,4CAA4C;IAC5C,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C;QACE,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACnC,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,oBAAoB,CAC5B,gBAAgB,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAClD,CAAC;IACJ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,CAC5B,WAAW,IAAI,qDAAqD,CACrE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAA6B,CAAC;IAC3C,IACE,CAAC,IAAI;QACL,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;QAC9B,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;QAC9B,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAChC,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC5B,WAAW,IAAI,qDAAqD,CACrE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa,EAAE,KAAa;IAC1D,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1B,wEAAwE;IACxE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEtD,MAAM,OAAO,GAAe;QAC1B,KAAK;QACL,KAAK;QACL,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAClC,CAAC;IAEF,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QACzD,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IAEH,4EAA4E;IAC5E,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,kCAAkC;IACpC,CAAC;IAED,wBAAwB,EAAE,CAAC,CAAC,sDAAsD;IAClF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,SAAS,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,+EAA+E;AAC/E,8EAA8E;AAC9E,4EAA4E;AAC5E,gFAAgF;AAChF,gFAAgF;AAChF,IAAI,aAAa,GAAwC,IAAI,CAAC;AAE9D,4EAA4E;AAC5E,MAAM,UAAU,wBAAwB;IACtC,aAAa,GAAG,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC,KAAK,CAAC;IAC9C,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,IAAI,KAAK,GAAsB,IAAI,CAAC;IACpC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwB,CAAC;YACtD,IACE,MAAM;gBACN,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;gBAChC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;gBACvB,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAChC,CAAC;gBACD,KAAK,GAAG;oBACN,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;iBAC9B,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,oCAAoC;QACtC,CAAC;IACH,CAAC;IACD,aAAa,GAAG,EAAE,KAAK,EAAE,CAAC;IAC1B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,wBAAwB,EAAE,CAAC,CAAC,+CAA+C;IAC3E,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/cli-write.d.ts

@@ -44,6 +44,17 @@ export interface StepUpOptions extends ConfirmOptions {
     mfaToken?: string;
     /** `--dry-run` — servidor valida e retorna o efeito SEM aplicar. */
     dryRun?: boolean;
+    /**
+     * `--non-interactive` (ex.: `neetru deploy` em CI): NUNCA prompta TOTP, mesmo
+     * com TTY — fail-closed com instrução (`--mfa-token` / `neetru auth mfa-session`).
+     */
+    nonInteractive?: boolean;
+    /**
+     * Ignora a sessão de 1h salva localmente e exige TOTP fresco. Usado no retry
+     * após o servidor recusar a sessão com `401 mfa_required` (sessão válida no
+     * disco mas rejeitada no servidor — ex.: segredo HMAC rotacionado).
+     */
+    skipSession?: boolean;
 }
 /**
  * Resolve o que uma operação destrutiva TOP-TIER precisa mandar pro servidor:
@@ -65,6 +76,26 @@ export interface StepUpOptions extends ConfirmOptions {
 export declare function resolveStepUp(opts: StepUpOptions): Promise<{
     headers: Record<string, string>;
 }>;
+/** `true` se o erro é o `401 mfa_required` de `requireCliStepUpMfa` no Core. */
+export declare function isMfaRequiredError(error: unknown): boolean;
+/**
+ * Executa um request cujo step-up MFA é CONDICIONAL no servidor (ex.:
+ * `ops bootstrap-admin` só exige MFA quando já existe admin). Não prompta
+ * antecipadamente:
+ *   1. anexa o que já está disponível sem interação — `--mfa-token` OU a
+ *      sessão de 1h salva;
+ *   2. se o Core responder `401 mfa_required` e ainda não foi enviado um TOTP
+ *      fresco, resolve o step-up (prompt TOTP / fail-closed em --json e
+ *      não-TTY), ignorando a sessão local (o servidor acabou de recusá-la), e
+ *      repete o request UMA vez.
+ * Qualquer outro erro (ou falha no retry) vai pro `onError` do caller
+ * (tipicamente `handleApiError`). O step-up roda FORA do handler de erro, pra
+ * o fail-closed do `resolveStepUp` (safeExit) não ser reprocessado como erro
+ * de API.
+ */
+export declare function withStepUpRetry<T>(opts: StepUpOptions, doRequest: (headers: Record<string, string>) => Promise<T>, onError: (error: unknown) => never, 
+/** Chamado antes do prompt TOTP do retry (ex.: parar o spinner). */
+beforePrompt?: () => void): Promise<T>;
 /**
  * Imprime o resultado de um comando de escrita — JSON cru ou linha humana.
  * Reconhece a resposta de dry-run (`{ dryRun: true }`) e a sinaliza.

package/dist/lib/cli-write.js

@@ -17,6 +17,7 @@ import { promises as fs } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { homedir } from 'node:os';
 import { requireToken, handleApiError } from './cli-read.js';
+import { CliApiError } from './api-client.js';
 import { log } from '../utils/logger.js';
 import { safeExit } from '../utils/safe-exit.js';
 export { requireToken, handleApiError };
@@ -181,7 +182,7 @@ export async function resolveStepUp(opts) {
     }
     // ── Prioridade 2: sessão de 1h salva localmente ─────────────────────────
     // Verifica ANTES de pedir TOTP — se há sessão válida, usa sem interação.
-    const savedSession = loadMfaSession();
+    const savedSession = opts.skipSession ? null : loadMfaSession();
     if (savedSession) {
         headers['X-Neetru-MFA-Session'] = savedSession;
         return { headers };
@@ -193,7 +194,7 @@ export async function resolveStepUp(opts) {
         // rodar NEM com TTY — ele escreveria a pergunta no stdout (corrompe o JSON)
         // e penduraria um consumidor programático. Fail-CLOSED em --json OU sem TTY;
         // só promptar em terminal interativo humano (não-json + TTY).
-        if (opts.json || !process.stdin.isTTY) {
+        if (opts.json || opts.nonInteractive || !process.stdin.isTTY) {
             const msg = 'Operação destrutiva top-tier exige step-up MFA: passe --mfa-token <código TOTP> ' +
                 '(modo --json/não-interativo) ou rode `neetru auth mfa-session` para obter uma sessão de 1h.';
             if (opts.json) {
@@ -214,6 +215,54 @@ export async function resolveStepUp(opts) {
     headers['X-Neetru-MFA-Token'] = code;
     return { headers };
 }
+/** `true` se o erro é o `401 mfa_required` de `requireCliStepUpMfa` no Core. */
+export function isMfaRequiredError(error) {
+    return error instanceof CliApiError && error.status === 401 && error.code === 'mfa_required';
+}
+/**
+ * Executa um request cujo step-up MFA é CONDICIONAL no servidor (ex.:
+ * `ops bootstrap-admin` só exige MFA quando já existe admin). Não prompta
+ * antecipadamente:
+ *   1. anexa o que já está disponível sem interação — `--mfa-token` OU a
+ *      sessão de 1h salva;
+ *   2. se o Core responder `401 mfa_required` e ainda não foi enviado um TOTP
+ *      fresco, resolve o step-up (prompt TOTP / fail-closed em --json e
+ *      não-TTY), ignorando a sessão local (o servidor acabou de recusá-la), e
+ *      repete o request UMA vez.
+ * Qualquer outro erro (ou falha no retry) vai pro `onError` do caller
+ * (tipicamente `handleApiError`). O step-up roda FORA do handler de erro, pra
+ * o fail-closed do `resolveStepUp` (safeExit) não ser reprocessado como erro
+ * de API.
+ */
+export async function withStepUpRetry(opts, doRequest, onError, 
+/** Chamado antes do prompt TOTP do retry (ex.: parar o spinner). */
+beforePrompt) {
+    const first = {};
+    const code = (opts.mfaToken ?? '').trim();
+    const savedSession = code ? null : loadMfaSession();
+    if (code)
+        first['X-Neetru-MFA-Token'] = code;
+    else if (savedSession)
+        first['X-Neetru-MFA-Session'] = savedSession;
+    let firstError;
+    try {
+        return await doRequest(first);
+    }
+    catch (error) {
+        firstError = error;
+    }
+    // Já mandou TOTP fresco e o servidor ainda pediu MFA → não há o que repetir.
+    if (!isMfaRequiredError(firstError) || code)
+        return onError(firstError);
+    beforePrompt?.();
+    const { headers } = await resolveStepUp({ ...opts, dryRun: false, skipSession: true });
+    try {
+        return await doRequest(headers);
+    }
+    catch (error) {
+        return onError(error);
+    }
+}
 /**
  * Imprime o resultado de um comando de escrita — JSON cru ou linha humana.
  * Reconhece a resposta de dry-run (`{ dryRun: true }`) e a sinaliza.

package/dist/lib/cli-write.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli-write.js","sourceRoot":"","sources":["../../src/lib/cli-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEjD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC;AAsBxC,SAAS,qBAAqB;IAC5B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,kBAAkB,CAAC,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QACxD,IAAI,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC7E,0EAA0E;QAC1E,oEAAoE;QACpE,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;QACrD,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,SAAS,GAAG,MAAM;YAAE,OAAO,IAAI,CAAC;QACtE,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,eAAuB,EACvB,SAAiB;IAEjB,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,MAAM,OAAO,GAAmB;YAC9B,eAAe;YACf,SAAS;YACT,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAClC,CAAC;QACF,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;IAC/E,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,oDAAoD;IACtD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,QAAgB;IACnC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7E,EAAE,CAAC,QAAQ,CAAC,KAAK,QAAQ,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE;YAC7C,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAUD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAe,EACf,IAAoB;IAEpB,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,4DAA4D;QAC5D,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC;YACb,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,uBAAuB;YAC9B,OAAO,EAAE,iDAAiD;SAC3D,CAAC,CACH,CAAC;QACF,QAAQ,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACzB,GAAG,CAAC,KAAK,CACP,uFAAuF,CACxF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACjC,CAAC;QACD,QAAQ,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,SAAS,UAAU,CAAC,QAAgB;IAClC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACrD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7E,EAAE,CAAC,QAAQ,CAAC,KAAK,QAAQ,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE;YACvC,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AASD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAmB;IAEnB,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAC;QACrC,OAAO,EAAE,OAAO,EAAE,CAAC;IACrB,CAAC;IAED,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,YAAY,GAAG,cAAc,EAAE,CAAC;IACtC,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,CAAC,sBAAsB,CAAC,GAAG,YAAY,CAAC;QAC/C,OAAO,EAAE,OAAO,EAAE,CAAC;IACrB,CAAC;IAED,0EAA0E;IAC1E,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,2EAA2E;QAC3E,4EAA4E;QAC5E,6EAA6E;QAC7E,8DAA8D;QAC9D,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACtC,MAAM,GAAG,GACP,kFAAkF;gBAClF,6FAA6F,CAAC;YAChG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YAClF,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjB,CAAC;YACD,QAAQ,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,yDAAyD;QAC/E,CAAC;QACD,IAAI,GAAG,MAAM,UAAU,CAAC,mCAAmC,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,GAAG,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC5D,QAAQ,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,OAAO,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAAC;IACrC,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAA+B,EAC/B,YAAoB,EACpB,IAAc;IAEd,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC;IACxC,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;QACrD,OAAO;IACT,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CACN,2DAA2D,IAAI,CAAC,SAAS,CACvE,MAAM,CAAC,UAAU,IAAI,EAAE,CACxB,EAAE,CACJ,CAAC;QACF,OAAO;IACT,CAAC;IACD,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"cli-write.js","sourceRoot":"","sources":["../../src/lib/cli-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEjD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC;AAsBxC,SAAS,qBAAqB;IAC5B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,kBAAkB,CAAC,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QACxD,IAAI,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC7E,0EAA0E;QAC1E,oEAAoE;QACpE,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;QACrD,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,SAAS,GAAG,MAAM;YAAE,OAAO,IAAI,CAAC;QACtE,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,eAAuB,EACvB,SAAiB;IAEjB,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,MAAM,OAAO,GAAmB;YAC9B,eAAe;YACf,SAAS;YACT,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAClC,CAAC;QACF,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;IAC/E,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,oDAAoD;IACtD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,QAAgB;IACnC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7E,EAAE,CAAC,QAAQ,CAAC,KAAK,QAAQ,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE;YAC7C,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAUD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAe,EACf,IAAoB;IAEpB,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,4DAA4D;QAC5D,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CAAC;YACb,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,uBAAuB;YAC9B,OAAO,EAAE,iDAAiD;SAC3D,CAAC,CACH,CAAC;QACF,QAAQ,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACzB,GAAG,CAAC,KAAK,CACP,uFAAuF,CACxF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACjC,CAAC;QACD,QAAQ,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,SAAS,UAAU,CAAC,QAAgB;IAClC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACrD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7E,EAAE,CAAC,QAAQ,CAAC,KAAK,QAAQ,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE;YACvC,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAoBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAmB;IAEnB,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAC;QACrC,OAAO,EAAE,OAAO,EAAE,CAAC;IACrB,CAAC;IAED,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;IAChE,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,CAAC,sBAAsB,CAAC,GAAG,YAAY,CAAC;QAC/C,OAAO,EAAE,OAAO,EAAE,CAAC;IACrB,CAAC;IAED,0EAA0E;IAC1E,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,2EAA2E;QAC3E,4EAA4E;QAC5E,6EAA6E;QAC7E,8DAA8D;QAC9D,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YAC7D,MAAM,GAAG,GACP,kFAAkF;gBAClF,6FAA6F,CAAC;YAChG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YAClF,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjB,CAAC;YACD,QAAQ,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,yDAAyD;QAC/E,CAAC;QACD,IAAI,GAAG,MAAM,UAAU,CAAC,mCAAmC,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,GAAG,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC5D,QAAQ,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,OAAO,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAAC;IACrC,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,KAAK,YAAY,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC;AAC/F,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAmB,EACnB,SAA0D,EAC1D,OAAkC;AAClC,oEAAoE;AACpE,YAAyB;IAEzB,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,MAAM,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;IACpD,IAAI,IAAI;QAAE,KAAK,CAAC,oBAAoB,CAAC,GAAG,IAAI,CAAC;SACxC,IAAI,YAAY;QAAE,KAAK,CAAC,sBAAsB,CAAC,GAAG,YAAY,CAAC;IAEpE,IAAI,UAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,UAAU,GAAG,KAAK,CAAC;IACrB,CAAC;IACD,6EAA6E;IAC7E,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,IAAI,IAAI;QAAE,OAAO,OAAO,CAAC,UAAU,CAAC,CAAC;IAExE,YAAY,EAAE,EAAE,CAAC;IACjB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACvF,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAA+B,EAC/B,YAAoB,EACpB,IAAc;IAEd,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC;IACxC,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;QACrD,OAAO;IACT,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CACN,2DAA2D,IAAI,CAAC,SAAS,CACvE,MAAM,CAAC,UAAU,IAAI,EAAE,CACxB,EAAE,CACJ,CAAC;QACF,OAAO;IACT,CAAC;IACD,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;AAC5B,CAAC"}

package/dist/lib/mobile-local/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * `@neetru/mobile-local` — contrato do registry local `.neetru/mobile.json`.
+ *
+ * Espelha o barrel de `../db-local/index.js`.
+ */
+export { migrateMobileJson, readMobileJson, writeMobileJson, upsertMobileApp, removeMobileApp, } from './mobile-json.js';
+export type { MobileJson, MobileJsonApp, MobilePlatform } from './mobile-json.js';

package/dist/lib/mobile-local/index.js

@@ -0,0 +1,7 @@
+/**
+ * `@neetru/mobile-local` — contrato do registry local `.neetru/mobile.json`.
+ *
+ * Espelha o barrel de `../db-local/index.js`.
+ */
+export { migrateMobileJson, readMobileJson, writeMobileJson, upsertMobileApp, removeMobileApp, } from './mobile-json.js';
+//# sourceMappingURL=index.js.map

package/dist/lib/mobile-local/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/mobile-local/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,eAAe,EACf,eAAe,GAChB,MAAM,kBAAkB,CAAC"}

package/dist/lib/mobile-local/mobile-json.d.ts

@@ -0,0 +1,57 @@
+export type MobilePlatform = 'ios' | 'android';
+/** Uma entrada de app mobile no registry local. */
+export interface MobileJsonApp {
+    /** ID canônico do Core — formato `<slug>__<platform>`. */
+    id: string;
+    platform: MobilePlatform;
+    name?: string;
+    /** Obrigatório no Core quando platform=ios. */
+    bundleId?: string;
+    /** Obrigatório no Core quando platform=ios (Apple Team ID, 10 chars). */
+    teamId?: string;
+    /** Obrigatório no Core quando platform=android. */
+    packageName?: string;
+    /** Obrigatório no Core quando platform=android (SHA-256 hex dos certs de assinatura). */
+    shaCertFingerprints?: string[];
+    redirectUri: string;
+    /** Client ID OIDC público (PKCE, sem secret) emitido pelo Core. */
+    oidcClientId: string;
+    status: string;
+}
+/** O registry `.neetru/mobile.json` — sempre versão 1. */
+export interface MobileJson {
+    version: 1;
+    apps: MobileJsonApp[];
+}
+/**
+ * Migra qualquer entrada para um `MobileJson` v1 estruturalmente válido.
+ *
+ * - v1 válido → normalizado (entradas malformadas reparadas ou descartadas).
+ * - objeto sem `version` → upgrade best-effort (trata como v1).
+ * - `null` / não-objeto / array / garbage → lança.
+ *
+ * NUNCA retorna algo que não seja um `MobileJson` v1 válido.
+ */
+export declare function migrateMobileJson(raw: unknown): MobileJson;
+/**
+ * Lê + parseia + migra um `.neetru/mobile.json`.
+ *
+ * Arquivo ausente → registry v1 vazio (não é erro — é um registry novo).
+ * JSON inválido → lança um `Error` nomeando o path.
+ */
+export declare function readMobileJson(filePath: string): MobileJson;
+/**
+ * Escreve um `MobileJson` de forma ATÔMICA.
+ *
+ * Estratégia: escreve num arquivo temporário no MESMO diretório do destino
+ * (rename só é atômico dentro do mesmo filesystem) e faz `renameSync` —
+ * que sobrescreve o arquivo existente tanto no Windows quanto no POSIX.
+ *
+ * Cria o diretório pai se ausente. Se algo falhar depois do temp ser criado,
+ * tenta remover o temp (best-effort) pra não deixar lixo `.tmp-*`.
+ */
+export declare function writeMobileJson(filePath: string, data: MobileJson): void;
+/** Adiciona (ou substitui por `id`) uma entrada e retorna o `MobileJson` atualizado. */
+export declare function upsertMobileApp(mobileJson: MobileJson, app: MobileJsonApp): MobileJson;
+/** Remove uma entrada por `id` e retorna o `MobileJson` atualizado. */
+export declare function removeMobileApp(mobileJson: MobileJson, id: string): MobileJson;