@neetru/sdk 2.3.6 → 3.0.0

package/dist/index.cjs

@@ -33,6 +33,23 @@ var init_errors = __esm({
   }
 });
 
+// src/idempotency.ts
+function generateIdempotencyKey() {
+  const cryptoObj = typeof globalThis !== "undefined" && "crypto" in globalThis ? globalThis.crypto : void 0;
+  if (cryptoObj && typeof cryptoObj.randomUUID === "function") {
+    return cryptoObj.randomUUID();
+  }
+  throw new exports.NeetruError(
+    "runtime_unsupported",
+    "crypto.randomUUID not available in this runtime. SDK 3.0 requires Node \u226520 or modern browser/Edge."
+  );
+}
+var init_idempotency = __esm({
+  "src/idempotency.ts"() {
+    init_errors();
+  }
+});
+
 // src/http.ts
 var http_exports = {};
 __export(http_exports, {
@@ -90,7 +107,8 @@ async function safeJson(res) {
 async function httpRequest(config, opts) {
   const method = opts.method ?? "GET";
   const url = buildUrl(config.baseUrl, opts.path, opts.query);
-  const maxRetries = opts.retries ?? DEFAULT_RETRIES;
+  const defaultRetries = READ_METHODS.has(method) ? DEFAULT_RETRIES_READ : DEFAULT_RETRIES_WRITE;
+  const maxRetries = opts.retries ?? defaultRetries;
   const headers = {
     accept: "application/json",
     ...opts.headers
@@ -104,6 +122,10 @@ async function httpRequest(config, opts) {
     }
     headers.authorization = `Bearer ${config.apiKey}`;
   }
+  if (opts.idempotencyKey) {
+    const key = typeof opts.idempotencyKey === "string" ? opts.idempotencyKey : generateIdempotencyKey();
+    headers["idempotency-key"] = key;
+  }
   const bodyString = opts.body !== void 0 && method !== "GET" && method !== "DELETE" ? JSON.stringify(opts.body) : void 0;
   if (bodyString !== void 0) {
     headers["content-type"] = "application/json";
@@ -155,11 +177,14 @@ async function httpRequest(config, opts) {
   }
   throw lastError ?? new exports.NeetruError("unknown", "unexpected httpRequest exit");
 }
-var DEFAULT_RETRIES, RETRYABLE_CODES;
+var DEFAULT_RETRIES_READ, DEFAULT_RETRIES_WRITE, READ_METHODS, RETRYABLE_CODES;
 var init_http = __esm({
   "src/http.ts"() {
     init_errors();
-    DEFAULT_RETRIES = 2;
+    init_idempotency();
+    DEFAULT_RETRIES_READ = 2;
+    DEFAULT_RETRIES_WRITE = 0;
+    READ_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD"]);
     RETRYABLE_CODES = /* @__PURE__ */ new Set([
       "rate_limited",
       "server_error",
@@ -576,6 +601,109 @@ var init_sql_client = __esm({
 // src/auth.ts
 init_errors();
 
+// src/api-key.ts
+init_errors();
+var API_KEY_RE = /^nrt_([A-Za-z0-9]+)_([A-Za-z0-9]+)$/;
+function parseApiKey(apiKey) {
+  if (typeof apiKey !== "string" || apiKey.length === 0) {
+    throw new exports.NeetruError(
+      "invalid_config",
+      "apiKey is required (formato nrt_<keyId>_<secret>)"
+    );
+  }
+  const match = API_KEY_RE.exec(apiKey);
+  if (!match) {
+    throw new exports.NeetruError(
+      "invalid_config",
+      "apiKey malformado - esperado formato nrt_<keyId>_<secret>"
+    );
+  }
+  return { keyId: match[1], secret: match[2] };
+}
+function tryParseApiKey(apiKey) {
+  if (typeof apiKey !== "string" || apiKey.length === 0) return null;
+  const match = API_KEY_RE.exec(apiKey);
+  if (!match) return null;
+  return { keyId: match[1], secret: match[2] };
+}
+
+// src/base-url-allowlist.ts
+init_errors();
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+var NEETRU_SUFFIX = ".neetru.com";
+var NEETRU_APEX = "neetru.com";
+var SAFE_DEV_HOST_RE = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?\.(test|localhost)$/;
+function isSafeDevHost(hostname) {
+  return SAFE_DEV_HOST_RE.test(hostname);
+}
+function normalizeHostname(hostname) {
+  return hostname.toLowerCase().replace(/\.+$/, "");
+}
+function validateBaseUrl(baseUrl, allowedHosts = []) {
+  if (typeof baseUrl !== "string" || baseUrl.length === 0) {
+    throw new exports.NeetruError("invalid_config", "baseUrl is required");
+  }
+  let parsed;
+  try {
+    parsed = new URL(baseUrl);
+  } catch {
+    throw new exports.NeetruError("invalid_config", `baseUrl is not a valid URL: ${baseUrl}`);
+  }
+  const protocol = parsed.protocol;
+  const hostname = normalizeHostname(parsed.hostname);
+  if (isInsecureBypassActive()) {
+    if (typeof console !== "undefined") {
+      console.warn(
+        `[neetru-sdk] NEETRU_ALLOW_INSECURE_BASEURL=1 ativo. baseUrl=${baseUrl} aceito sem valida\xE7\xE3o.`
+      );
+    }
+    return baseUrl.replace(/\/+$/, "");
+  }
+  if (protocol !== "https:" && protocol !== "http:") {
+    throw new exports.NeetruError(
+      "invalid_config",
+      `baseUrl protocol must be http: or https:, got ${protocol}`
+    );
+  }
+  if (protocol === "http:") {
+    const isLoopback = LOOPBACK_HOSTS.has(hostname) || isSafeDevHost(hostname);
+    if (!isLoopback) {
+      throw new exports.NeetruError(
+        "invalid_config",
+        `baseUrl with http: only allowed for localhost/127.0.0.1/*.test/*.localhost. Got: ${hostname}. Use https: or set NEETRU_ALLOW_INSECURE_BASEURL=1 to bypass.`
+      );
+    }
+    return baseUrl.replace(/\/+$/, "");
+  }
+  const isNeetruDomain = hostname === NEETRU_APEX || hostname.endsWith(NEETRU_SUFFIX);
+  const isAllowedHost = allowedHosts.some((allowed) => {
+    const norm = allowed.toLowerCase();
+    return hostname === norm || hostname.endsWith(`.${norm}`);
+  });
+  const isLoopbackHttps = LOOPBACK_HOSTS.has(hostname) || isSafeDevHost(hostname);
+  if (!isNeetruDomain && !isAllowedHost && !isLoopbackHttps) {
+    throw new exports.NeetruError(
+      "invalid_config",
+      `baseUrl ${hostname} is not in the allowlist. Allowed: *.neetru.com, localhost, or configure { allowedHosts: ['...'] }. Bypass: NEETRU_ALLOW_INSECURE_BASEURL=1.`
+    );
+  }
+  return baseUrl.replace(/\/+$/, "");
+}
+function isInsecureBypassActive() {
+  try {
+    const proc = globalThis.process;
+    const envVal = proc?.env?.NEETRU_ALLOW_INSECURE_BASEURL;
+    if (envVal === "1" || envVal === "true") return true;
+  } catch {
+  }
+  try {
+    const g = globalThis.NEETRU_ALLOW_INSECURE_BASEURL;
+    if (g === "1" || g === "true" || g === true) return true;
+  } catch {
+  }
+  return false;
+}
+
 // src/types.ts
 var DEFAULT_BASE_URL = "https://api.neetru.com";
 
@@ -777,7 +905,7 @@ function createTelemetryNamespace(config) {
           if (ev.timestamp) body.timestamp = ev.timestamp;
           await httpRequest(config, {
             method: "POST",
-            path: "/api/v1/sdk/telemetry/event",
+            path: "/api/sdk/v1/telemetry/event",
             body,
             requireAuth: true,
             retries: 1
@@ -826,7 +954,7 @@ function createTelemetryNamespace(config) {
       if (input.timestamp) body.timestamp = input.timestamp;
       const raw = await httpRequest(config, {
         method: "POST",
-        path: "/api/v1/sdk/telemetry/event",
+        path: "/api/sdk/v1/telemetry/event",
         body,
         requireAuth: true
       });
@@ -938,65 +1066,33 @@ function createTelemetryNamespace(config) {
 // src/usage.ts
 init_errors();
 init_http();
-function toQuota(metric, raw) {
-  if (!raw || typeof raw !== "object") {
-    throw new exports.NeetruError("invalid_response", "Quota response is not an object");
-  }
-  const r = raw;
-  if (typeof r.used !== "number" || typeof r.limit !== "number") {
-    throw new exports.NeetruError("invalid_response", "Quota response missing used/limit numbers");
+
+// src/validators.ts
+init_errors();
+var SDK_ID_RE = /^[a-z0-9][a-z0-9_-]{0,62}$/;
+function assertValidSdkId(field, value) {
+  if (typeof value !== "string" || !SDK_ID_RE.test(value)) {
+    throw new exports.NeetruError(
+      "validation_failed",
+      `${field} must match ${SDK_ID_RE.source} (lowercase alphanumeric, _, -; first char must be alphanumeric; max 63 chars)`
+    );
   }
-  return {
-    metric: typeof r.metric === "string" ? r.metric : metric,
-    used: r.used,
-    limit: r.limit,
-    resetsAt: typeof r.resetsAt === "string" ? r.resetsAt : void 0,
-    plan: typeof r.plan === "string" ? r.plan : void 0
-  };
 }
+
+// src/usage.ts
 function createUsageNamespace(config) {
   return {
     /**
-     * Persiste um evento de usage. Em dev (mocks ativos via factory) só loga.
-     * Em workspace/prod chama POST /sdk/v1/usage/record.
-     */
-    async track(event, properties) {
-      if (!event || typeof event !== "string") {
-        throw new exports.NeetruError("validation_failed", "event name is required");
-      }
-      if (event.length > 128) {
-        throw new exports.NeetruError("validation_failed", "event name max 128 chars");
-      }
-      const body = { event };
-      if (properties && typeof properties === "object") body.properties = properties;
-      const raw = await httpRequest(config, {
-        method: "POST",
-        path: "/sdk/v1/usage/record",
-        body,
-        requireAuth: true
-      });
-      if (!raw || raw.ok !== true) {
-        throw new exports.NeetruError("invalid_response", "Usage record response missing ok");
-      }
-      return { ok: true };
-    },
-    /**
-     * Lê quota atual de uma métrica. Cacheável (caller decide), SDK não cacheia.
-     */
-    async getQuota(metric) {
-      if (!metric || typeof metric !== "string") {
-        throw new exports.NeetruError("validation_failed", "metric is required");
-      }
-      const raw = await httpRequest(config, {
-        method: "GET",
-        path: "/sdk/v1/usage/quota",
-        query: { metric },
-        requireAuth: true
-      });
-      return toQuota(metric, raw);
-    },
-    /**
-     * v0.3 — Reporta consumo metered. Hit no endpoint canônico Sprint 7.
+     * Reporta consumo metered de um resource. Hit no endpoint canônico
+     * `POST /api/sdk/v1/usage/record`. Idempotency-Key gerado por chamada;
+     * Core dedup serverside TTL 24h.
+     *
+     * @example
+     * ```ts
+     * await client.usage.report('api_call', 1);
+     * // ou explicit:
+     * await client.usage.report('api_call', 5, { productId: 'gestovendas', tenantId: 't-acme' });
+     * ```
      */
     async report(resource, qty = 1, options) {
       if (!resource || typeof resource !== "string") {
@@ -1019,11 +1115,14 @@ function createUsageNamespace(config) {
           "tenantId required (pass to options or set on createNeetruClient)"
         );
       }
+      assertValidSdkId("productId", productId);
+      assertValidSdkId("tenantId", tenantId);
       const raw = await httpRequest(config, {
         method: "POST",
-        path: "/sdk/v1/usage/record",
+        path: "/api/sdk/v1/usage/record",
         body: { productId, tenantId, resource, qty: Math.floor(qty) },
-        requireAuth: true
+        requireAuth: true,
+        idempotencyKey: true
       });
       if (!raw || raw.ok !== true) {
         throw new exports.NeetruError("invalid_response", "usage.report response missing ok");
@@ -1038,7 +1137,10 @@ function createUsageNamespace(config) {
       };
     },
     /**
-     * v0.3 — Verifica entitlement de um resource via GET /sdk/v1/entitlements.
+     * Verifica entitlement de um resource via `GET /api/sdk/v1/entitlements`.
+     * Resposta inclui `allowed`, `reason` ('granted' | 'not_subscribed' |
+     * 'subscription_inactive' | 'feature_not_in_plan' | 'limit_exceeded'),
+     * `remaining`, `limit`, `planId`, `planFeatures`.
      */
     async check(resource, options) {
       if (!resource || typeof resource !== "string") {
@@ -1049,25 +1151,29 @@ function createUsageNamespace(config) {
       if (!productId || !tenantId) {
         throw new exports.NeetruError(
           "validation_failed",
-          "productId and tenantId required"
+          "productId and tenantId required (pass to options or set on createNeetruClient)"
         );
       }
+      assertValidSdkId("productId", productId);
+      assertValidSdkId("tenantId", tenantId);
       const raw = await httpRequest(config, {
         method: "GET",
-        path: "/sdk/v1/entitlements",
+        path: "/api/sdk/v1/entitlements",
         query: { productId, tenantId, feature: resource },
         requireAuth: true
       });
       if (!raw || typeof raw.allowed !== "boolean") {
         throw new exports.NeetruError("invalid_response", "usage.check response missing allowed");
       }
+      const behavior = raw.behavior ?? (raw.reason === "limit_exceeded" ? "readonly" : null);
       return {
         allowed: raw.allowed,
         reason: raw.reason,
         remaining: raw.remaining,
         limit: raw.limit,
         planId: raw.planId,
-        planFeatures: raw.planFeatures
+        planFeatures: raw.planFeatures,
+        behavior
       };
     }
   };
@@ -1094,14 +1200,32 @@ function toTicket(raw) {
     status: VALID_STATUSES.includes(r.status) ? r.status : "open",
     createdAt: typeof r.createdAt === "string" ? r.createdAt : (/* @__PURE__ */ new Date()).toISOString(),
     updatedAt: typeof r.updatedAt === "string" ? r.updatedAt : void 0,
-    productSlug: typeof r.productSlug === "string" ? r.productSlug : void 0
+    productSlug: typeof r.productId === "string" ? r.productId : typeof r.productSlug === "string" ? r.productSlug : void 0
   };
 }
+function resolveProductId(config, ...candidates) {
+  for (const c of candidates) {
+    if (typeof c === "string" && c.length > 0) {
+      assertValidSdkId("productSlug", c);
+      return c;
+    }
+  }
+  if (config.productId) {
+    assertValidSdkId("productId", config.productId);
+    return config.productId;
+  }
+  throw new exports.NeetruError(
+    "validation_failed",
+    "productId required (pass to input.productSlug or set on createNeetruClient)"
+  );
+}
 function createSupportNamespace(config) {
   return {
     /**
-     * Cria um ticket de suporte. Requer Bearer auth. Se `productSlug` não é
-     * passado, o backend infere do escopo do token.
+     * Cria um ticket de suporte. Requer Bearer auth. `productSlug` no input
+     * (ou `config.productId` default) vai como `productId` no body do Core.
+     *
+     * Endpoint canonical: `POST /api/sdk/v1/support/tickets`.
      */
     async createTicket(input) {
       if (!input || typeof input !== "object") {
@@ -1120,30 +1244,42 @@ function createSupportNamespace(config) {
         throw new exports.NeetruError("validation_failed", "message max 10000 chars");
       }
       if (input.severity && !VALID_SEVERITIES.includes(input.severity)) {
-        throw new exports.NeetruError("validation_failed", `severity must be one of ${VALID_SEVERITIES.join(", ")}`);
+        throw new exports.NeetruError(
+          "validation_failed",
+          `severity must be one of ${VALID_SEVERITIES.join(", ")}`
+        );
       }
-      const slug = input.productSlug ?? "_default";
+      const productId = resolveProductId(config, input.productSlug);
       const body = {
+        productId,
         subject: input.subject,
         message: input.message,
         severity: input.severity ?? "normal"
       };
+      if (input.metadata && typeof input.metadata === "object") {
+        body.metadata = input.metadata;
+      }
       const raw = await httpRequest(config, {
         method: "POST",
-        path: `/api/v1/products/${encodeURIComponent(slug)}/tickets`,
+        path: "/api/sdk/v1/support/tickets",
         body,
-        requireAuth: true
+        requireAuth: true,
+        idempotencyKey: true
       });
       const candidate = raw && typeof raw === "object" && "ticket" in raw ? raw.ticket : raw;
       return toTicket(candidate);
     },
     /**
-     * Lista tickets do customer no produto atual (escopo do token).
+     * Lista tickets do customer no produto atual. `productSlug` no contexto.
+     *
+     * Endpoint canonical: `GET /api/sdk/v1/support/tickets?productId=...`.
      */
-    async listMyTickets() {
+    async listMyTickets(options) {
+      const productId = resolveProductId(config, options?.productSlug);
       const raw = await httpRequest(config, {
         method: "GET",
-        path: "/api/v1/products/_default/tickets",
+        path: "/api/sdk/v1/support/tickets",
+        query: { productId },
         requireAuth: true
       });
       const list = Array.isArray(raw) ? raw : raw && typeof raw === "object" && "tickets" in raw ? raw.tickets ?? [] : [];
@@ -4721,6 +4857,52 @@ function createCheckoutNamespace(config) {
 // src/webhooks.ts
 init_errors();
 init_http();
+async function verifyWebhookSignature(payload, signature, secret) {
+  if (!signature || !secret) return false;
+  const sigHex = signature.startsWith("sha256=") ? signature.slice(7) : signature;
+  if (!/^[0-9a-f]+$/i.test(sigHex)) return false;
+  const subtle = typeof globalThis !== "undefined" && "crypto" in globalThis ? globalThis.crypto?.subtle : void 0;
+  if (!subtle) {
+    throw new exports.NeetruError(
+      "runtime_unsupported",
+      "verifyWebhookSignature requires globalThis.crypto.subtle (Node \u226520, modern browser, or Edge runtime)."
+    );
+  }
+  const encoder = new TextEncoder();
+  const keyBytes = encoder.encode(secret);
+  const payloadBytes = typeof payload === "string" ? encoder.encode(payload) : payload;
+  const key = await subtle.importKey(
+    "raw",
+    keyBytes,
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const macBuffer = await subtle.sign(
+    "HMAC",
+    key,
+    payloadBytes
+  );
+  const macBytes = new Uint8Array(macBuffer);
+  const sigBytes = hexToBytes(sigHex.toLowerCase());
+  if (!sigBytes || sigBytes.length !== macBytes.length) return false;
+  let diff = 0;
+  for (let i = 0; i < macBytes.length; i++) {
+    diff |= macBytes[i] ^ sigBytes[i];
+  }
+  return diff === 0;
+}
+function hexToBytes(hex) {
+  if (hex.length % 2 !== 0) return null;
+  const bytes = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < bytes.length; i++) {
+    const high = parseInt(hex[i * 2], 16);
+    const low = parseInt(hex[i * 2 + 1], 16);
+    if (Number.isNaN(high) || Number.isNaN(low)) return null;
+    bytes[i] = high << 4 | low;
+  }
+  return bytes;
+}
 var VALID_EVENTS = [
   "subscription.activated",
   "subscription.cancelled",
@@ -4776,42 +4958,71 @@ function validateInput(input) {
     throw new exports.NeetruError("validation_failed", "secret deve ter \u226516 chars (recomendado 32+)");
   }
 }
+function resolveProductId2(config, ...candidates) {
+  for (const c of candidates) {
+    if (typeof c === "string" && c.length > 0) {
+      assertValidSdkId("productId", c);
+      return c;
+    }
+  }
+  if (config.productId) {
+    assertValidSdkId("productId", config.productId);
+    return config.productId;
+  }
+  throw new exports.NeetruError(
+    "validation_failed",
+    "productId required (pass to options/input or set on createNeetruClient)"
+  );
+}
 function createWebhooksNamespace(config) {
   return {
     async register(input) {
       validateInput(input);
+      const productId = resolveProductId2(config, input.productId);
       const raw = await httpRequest(config, {
         method: "POST",
         path: "/api/sdk/v1/webhooks",
-        body: input,
+        body: {
+          productId,
+          url: input.url,
+          events: input.events,
+          ...input.secret ? { secret: input.secret } : {}
+        },
         requireAuth: true
       });
       return toEndpoint(raw);
     },
-    async list() {
+    async list(options) {
+      const productId = resolveProductId2(config, options?.productId);
       const raw = await httpRequest(config, {
         method: "GET",
         path: "/api/sdk/v1/webhooks",
+        query: { productId },
         requireAuth: true
       });
       const list = Array.isArray(raw?.endpoints) ? raw.endpoints : [];
       return list.map(toEndpoint);
     },
-    async unregister(id) {
+    async unregister(id, options) {
       if (!id) throw new exports.NeetruError("validation_failed", "id obrigat\xF3rio");
+      const productId = resolveProductId2(config, options?.productId);
       await httpRequest(config, {
         method: "DELETE",
         path: `/api/sdk/v1/webhooks/${encodeURIComponent(id)}`,
+        query: { productId },
         requireAuth: true
       });
       return { ok: true };
     },
-    async test(id) {
+    async test(id, options) {
       if (!id) throw new exports.NeetruError("validation_failed", "id obrigat\xF3rio");
+      const productId = resolveProductId2(config, options?.productId);
       const raw = await httpRequest(config, {
         method: "POST",
         path: `/api/sdk/v1/webhooks/${encodeURIComponent(id)}/test`,
-        requireAuth: true
+        query: { productId },
+        requireAuth: true,
+        idempotencyKey: true
       });
       if (!raw || typeof raw !== "object") {
         return { ok: false, error: "invalid response" };
@@ -4843,17 +5054,17 @@ var MockWebhooks = class {
     this.endpoints.set(id, endpoint);
     return endpoint;
   }
-  async list() {
+  async list(_options) {
     return [...this.endpoints.values()];
   }
-  async unregister(id) {
+  async unregister(id, _options) {
     if (!this.endpoints.has(id)) {
       throw new exports.NeetruError("not_found", `Webhook ${id} n\xE3o encontrado`);
     }
     this.endpoints.delete(id);
     return { ok: true };
   }
-  async test(id) {
+  async test(id, _options) {
     if (!this.endpoints.has(id)) {
       throw new exports.NeetruError("not_found", `Webhook ${id} n\xE3o encontrado`);
     }
@@ -4910,49 +5121,85 @@ function validateInput2(input) {
     throw new exports.NeetruError("validation_failed", "body m\xE1x 2000 chars");
   }
 }
+function resolveProductId3(config, ...candidates) {
+  for (const c of candidates) {
+    if (typeof c === "string" && c.length > 0) {
+      assertValidSdkId("productId", c);
+      return c;
+    }
+  }
+  if (config.productId) {
+    assertValidSdkId("productId", config.productId);
+    return config.productId;
+  }
+  throw new exports.NeetruError(
+    "validation_failed",
+    "productId required (pass to options/input or set on createNeetruClient)"
+  );
+}
 function createNotificationsNamespace(config) {
   return {
     async send(input) {
       validateInput2(input);
+      const productId = resolveProductId3(config, input.productId);
+      const body = {
+        productId,
+        userId: input.userId,
+        kind: input.kind,
+        title: input.title,
+        severity: input.severity ?? "info"
+      };
+      if (input.body !== void 0) body.body = input.body;
+      if (input.link !== void 0) body.link = input.link;
+      if (input.metadata !== void 0) body.metadata = input.metadata;
+      if (input.fingerprint !== void 0) body.fingerprint = input.fingerprint;
       const raw = await httpRequest(config, {
         method: "POST",
         path: "/api/sdk/v1/notifications",
-        body: input,
-        requireAuth: true
+        body,
+        requireAuth: true,
+        idempotencyKey: true
       });
       return toNotification(raw);
     },
     async list(userId, options) {
       if (!userId) throw new exports.NeetruError("validation_failed", "userId obrigat\xF3rio");
-      const params = new URLSearchParams();
-      if (options?.includeDismissed) params.set("includeDismissed", "true");
-      if (options?.onlyUnread) params.set("onlyUnread", "true");
+      const productId = resolveProductId3(config, options?.productId);
+      const query = {
+        productId
+      };
+      if (options?.includeDismissed) query.includeDismissed = true;
+      if (options?.onlyUnread) query.onlyUnread = true;
       if (options?.limit) {
-        params.set("limit", Math.min(Math.max(1, options.limit), 200).toString());
+        query.limit = Math.min(Math.max(1, options.limit), 200);
       }
-      const qs = params.toString();
       const raw = await httpRequest(config, {
         method: "GET",
-        path: `/api/sdk/v1/notifications/user/${encodeURIComponent(userId)}${qs ? `?${qs}` : ""}`,
+        path: `/api/sdk/v1/notifications/user/${encodeURIComponent(userId)}`,
+        query,
         requireAuth: true
       });
       const list = Array.isArray(raw?.notifications) ? raw.notifications : [];
       return list.map(toNotification);
     },
-    async markRead(id) {
+    async markRead(id, options) {
       if (!id) throw new exports.NeetruError("validation_failed", "id obrigat\xF3rio");
+      const productId = resolveProductId3(config, options?.productId);
       await httpRequest(config, {
         method: "POST",
         path: `/api/sdk/v1/notifications/${encodeURIComponent(id)}/read`,
+        query: { productId },
         requireAuth: true
       });
       return { ok: true };
     },
-    async dismiss(id) {
+    async dismiss(id, options) {
       if (!id) throw new exports.NeetruError("validation_failed", "id obrigat\xF3rio");
+      const productId = resolveProductId3(config, options?.productId);
       await httpRequest(config, {
         method: "POST",
         path: `/api/sdk/v1/notifications/${encodeURIComponent(id)}/dismiss`,
+        query: { productId },
         requireAuth: true
       });
       return { ok: true };
@@ -4993,7 +5240,7 @@ var MockNotifications = class {
     const limit = Math.min(Math.max(1, options?.limit ?? 50), 200);
     return [...this.notifications.values()].filter((n) => n.userId === userId).filter((n) => options?.includeDismissed || !n.dismissedAt).filter((n) => !options?.onlyUnread || !n.readAt).sort((a, b) => b.createdAt.localeCompare(a.createdAt)).slice(0, limit);
   }
-  async markRead(id) {
+  async markRead(id, _options) {
     const n = this.notifications.get(id);
     if (!n) throw new exports.NeetruError("not_found", `Notification ${id} n\xE3o encontrada`);
     if (!n.readAt) {
@@ -5002,7 +5249,7 @@ var MockNotifications = class {
     }
     return { ok: true };
   }
-  async dismiss(id) {
+  async dismiss(id, _options) {
     const n = this.notifications.get(id);
     if (!n) throw new exports.NeetruError("not_found", `Notification ${id} n\xE3o encontrada`);
     if (!n.dismissedAt) {
@@ -5015,6 +5262,7 @@ var MockNotifications = class {
 
 // src/mocks.ts
 init_db_errors();
+init_errors();
 var DEV_FIXTURE_USER = Object.freeze({
   uid: "dev-fixture-uid-0001",
   email: "dev@neetru.local",
@@ -5122,39 +5370,25 @@ var MockAuth = class {
   }
 };
 var MockUsage = class {
-  _records = [];
+  _reports = [];
   _quotas;
-  /** v0.3 — counters in-memory pra `report()` / `check()`. */
   _counters = /* @__PURE__ */ new Map();
   constructor(initialQuotas = {}) {
     this._quotas = new Map(Object.entries(initialQuotas));
   }
-  async track(event, properties) {
-    this._records.push({
-      event,
-      properties,
-      timestamp: (/* @__PURE__ */ new Date()).toISOString()
-    });
-    return { ok: true };
-  }
-  async getQuota(metric) {
-    const existing = this._quotas.get(metric);
-    if (existing) return existing;
-    return {
-      metric,
-      used: this._records.filter((r) => r.event === metric).length,
-      limit: -1,
-      // unlimited em mock por default
-      plan: "mock"
-    };
-  }
-  /** v0.3 — Mock report incrementa o counter local. */
-  async report(resource, qty = 1, _options) {
+  async report(resource, qty = 1, options) {
     if (!resource) throw new Error("resource required");
     const safeQty = Number.isFinite(qty) && qty > 0 ? Math.floor(qty) : 1;
     const existing = this._counters.get(resource) ?? 0;
     const next = existing + safeQty;
     this._counters.set(resource, next);
+    this._reports.push({
+      resource,
+      qty: safeQty,
+      productId: options?.productId,
+      tenantId: options?.tenantId,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    });
     const limitFixture = this._quotas.get(resource);
     const limit = limitFixture?.limit ?? -1;
     return {
@@ -5166,12 +5400,11 @@ var MockUsage = class {
       status: limit > 0 && next >= limit ? "read_only_overlimit" : "ok"
     };
   }
-  /** v0.3 — Mock check usa quotas + counters in-memory. */
   async check(resource, _options) {
     const quota = this._quotas.get(resource);
     const used = this._counters.get(resource) ?? 0;
     if (!quota) {
-      return { allowed: true, reason: "granted", limit: -1, remaining: -1 };
+      return { allowed: true, reason: "granted", limit: -1, remaining: -1, behavior: null };
     }
     const remaining = quota.limit < 0 ? -1 : Math.max(0, quota.limit - used);
     if (remaining === 0) {
@@ -5179,19 +5412,25 @@ var MockUsage = class {
         allowed: false,
         reason: "limit_exceeded",
         limit: quota.limit,
-        remaining: 0
+        remaining: 0,
+        behavior: "readonly"
       };
     }
     return {
       allowed: true,
       reason: "granted",
       limit: quota.limit,
-      remaining
+      remaining,
+      behavior: null
     };
   }
-  /** Test helper. */
+  /** Test helper — retorna histórico de `report()` calls. */
+  __getReports() {
+    return [...this._reports];
+  }
+  /** @deprecated Removido em 3.0 (usage.track foi removido). Use `__getReports`. */
   __getRecords() {
-    return [...this._records];
+    return this.__getReports();
   }
   /** Test helper — substitui quota fixture. */
   __setQuota(metric, quota) {
@@ -5199,7 +5438,7 @@ var MockUsage = class {
   }
   /** Test helper — limpa estado. */
   __reset() {
-    this._records = [];
+    this._reports = [];
     this._quotas.clear();
     this._counters.clear();
   }
@@ -5208,8 +5447,14 @@ var MockSupport = class {
   _tickets = [];
   _ticketSeq = 0;
   async createTicket(input) {
-    if (!input?.subject) throw new Error("subject required");
-    if (!input?.message) throw new Error("message required");
+    if (!input?.subject) throw new exports.NeetruError("validation_failed", "subject required");
+    if (!input?.message) throw new exports.NeetruError("validation_failed", "message required");
+    if (!input?.productSlug) {
+      throw new exports.NeetruError(
+        "validation_failed",
+        "productSlug required (3.0 breaking \u2014 pass to input or set on createNeetruClient)"
+      );
+    }
     const ticket = {
       id: `mock-ticket-${++this._ticketSeq}`,
       subject: input.subject,
@@ -5222,7 +5467,10 @@ var MockSupport = class {
     this._tickets.push(ticket);
     return ticket;
   }
-  async listMyTickets() {
+  async listMyTickets(options) {
+    if (options?.productSlug) {
+      return this._tickets.filter((t) => t.productSlug === options.productSlug);
+    }
     return [...this._tickets];
   }
   /** Test helper. */
@@ -5691,8 +5939,8 @@ function createOidcAuthNamespace(config) {
         url.searchParams.set("scope", scope);
         url.searchParams.set("state", state);
         if (config.apiKey) {
-          const clientId = config.apiKey.split("_")[1] ?? config.apiKey;
-          url.searchParams.set("client_id", clientId);
+          const { keyId } = parseApiKey(config.apiKey);
+          url.searchParams.set("client_id", keyId);
         }
         globalThis.location.assign(url.toString());
         return;
@@ -5706,14 +5954,30 @@ function createOidcAuthNamespace(config) {
       const storage = getStorage();
       if (storage) storage.removeItem(STORAGE_KEY);
       cachedUser = null;
-      try {
-        const overrideAuthUrl = typeof globalThis.NEETRU_AUTH_URL === "string" ? globalThis.NEETRU_AUTH_URL : null;
-        const idpOrigin = overrideAuthUrl ?? config.baseUrl.replace(/^https?:\/\/api\./, "https://auth.");
-        await config.fetch(`${idpOrigin}/api/v1/oauth/revoke`, {
-          method: "POST",
-          headers: { "content-type": "application/json" }
-        });
-      } catch {
+      const overrideAuthUrl = typeof globalThis.NEETRU_AUTH_URL === "string" ? globalThis.NEETRU_AUTH_URL : null;
+      const idpOrigin = overrideAuthUrl ?? config.baseUrl.replace(/^https?:\/\/api\./, "https://auth.");
+      const revokeUrl = `${idpOrigin}/api/v1/oauth/revoke`;
+      let revokeError = null;
+      for (let attempt = 0; attempt < 2; attempt++) {
+        try {
+          await config.fetch(revokeUrl, {
+            method: "POST",
+            headers: { "content-type": "application/json" }
+          });
+          revokeError = null;
+          break;
+        } catch (err) {
+          revokeError = err;
+          if (attempt === 0) {
+            await new Promise((resolve) => setTimeout(resolve, 500));
+          }
+        }
+      }
+      if (revokeError && typeof console !== "undefined") {
+        console.warn(
+          "[neetru-sdk] signOut: server-side revoke falhou (2 tentativas). Refresh token pode estar stale.",
+          revokeError
+        );
       }
       notify();
     },
@@ -5739,7 +6003,8 @@ function createOidcAuthNamespace(config) {
       const issuer = idpOrigin;
       const jwksUrl = `${idpOrigin}/api/v1/oauth/.well-known/jwks.json`;
       const cacheTtlMs = options?.jwksCacheTtlMs ?? DEFAULT_JWKS_TTL_MS;
-      const audience = config.apiKey ? config.apiKey.split("_")[1] ?? void 0 : void 0;
+      const parsedKey = tryParseApiKey(config.apiKey);
+      const audience = parsedKey?.keyId;
       const jwks = _getJwks(jwksUrl, cacheTtlMs);
       try {
         const { payload } = await jose.jwtVerify(token, jwks, {
@@ -5779,7 +6044,8 @@ function createNeetruClient(config = {}) {
       "fetch is not available in this runtime. Pass `fetch` explicitly to createNeetruClient."
     );
   }
-  const baseUrl = (config.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
+  const rawBaseUrl = config.baseUrl ?? DEFAULT_BASE_URL;
+  const baseUrl = validateBaseUrl(rawBaseUrl, config.allowedHosts ?? []);
   const apiKey = config.apiKey ?? readEnvApiKey();
   const env = resolveEnv(config.env);
   const resolved = Object.freeze({
@@ -5817,11 +6083,7 @@ function createNeetruClient(config = {}) {
 // src/index.ts
 init_errors();
 init_db_errors();
-var VERSION = "2.0.0";
-function initNeetru(config) {
-  const { apiUrl: _apiUrl, baseUrl, ...rest } = config;
-  return createNeetruClient({ ...rest, baseUrl });
-}
+var VERSION = "3.0.0";
 
 exports.DEFAULT_BASE_URL = DEFAULT_BASE_URL;
 exports.DEV_FIXTURE_USER = DEV_FIXTURE_USER;
@@ -5839,6 +6101,6 @@ exports.createNeetruClient = createNeetruClient;
 exports.createNeetruDb = createNeetruDb;
 exports.createNotificationsNamespace = createNotificationsNamespace;
 exports.createWebhooksNamespace = createWebhooksNamespace;
-exports.initNeetru = initNeetru;
+exports.verifyWebhookSignature = verifyWebhookSignature;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map