@neetru/sdk 3.1.2 → 3.1.6

package/dist/index.d.cts

@@ -1,7 +1,7 @@
 export { createNeetruClient } from './auth.cjs';
 export { NeetruError, NeetruErrorCode } from './errors.cjs';
-export { A as AuthNamespace, a as AuthStateListener, C as CatalogListOptions, b as CatalogListResponse, c as CheckoutIntentInfo, d as CheckoutIntentStatus, e as CheckoutNamespace, f as CheckoutStartInput, g as CheckoutStartResult, h as CheckoutTenantType, k as CreateTicketInput, D as DEFAULT_BASE_URL, l as DbBatchOp, m as DbChangeType, n as DbCollectionRef, o as DbDoc, p as DbDocRef, q as DbGetResult, r as DbListResult, s as DbNamespace, t as DbQuery, u as DbSqlLease, v as DbWhereFilter, E as EntitlementCheck, F as FieldSentinel, I as IncrementSentinel, L as ListNotificationsOptions, M as MockCheckout, x as MockNotifications, y as MockWebhooks, N as NEETRU_SENTINEL_KEY, z as NeetruClient, B as NeetruClientConfig, G as NeetruDb, J as NeetruDbEngine, K as NeetruDbError, O as NeetruDbErrorCode, P as NeetruDbOptions, Q as NeetruDbTransport, R as NeetruEnv, S as NeetruSqlClient, T as NeetruUser, U as NotificationScopeOptions, V as NotificationsNamespace, W as Product, X as ProductNotification, Y as ProductNotificationSeverity, Z as ProductPlan, _ as ProductStatus, a0 as RegisterWebhookInput, a1 as ResolvedConfig, a2 as SendNotificationInput, a3 as ServerTimestampSentinel, a4 as SignInOptions, a6 as SupportNamespace, a7 as SupportSeverity, a8 as SupportStatus, a9 as SupportTicket, ab as TelemetryEventAck, ac as TelemetryEventInput, ag as UsageEventInput, ah as UsageNamespace, ai as UsageQuota, aj as VerifyTokenOptions, ak as VerifyWebhookRequestOptions, al as VerifyWebhookRequestResult, am as WebhookEndpoint, an as WebhookEvent, ao as WebhookScopeOptions, ap as WebhookTestResult, aq as WebhooksNamespace, ar as WithFieldSentinels, as as createCheckoutNamespace, at as createNeetruDb, au as createNotificationsNamespace, aw as createWebhooksNamespace, ay as increment, az as isFieldSentinel, aA as isIncrementSentinel, aB as isServerTimestampSentinel, aC as serverTimestamp, aD as verifyWebhookRequest, aE as verifyWebhookSignature } from './types-DePdSU3P.cjs';
-export { DEV_FIXTURE_USER, MockAuth, MockDb, MockEntitlements, MockSupport, MockUsage } from './mocks.cjs';
+export { A as AuthNamespace, a as AuthStateListener, C as CatalogListOptions, b as CatalogListResponse, d as CheckoutIntentInfo, e as CheckoutIntentStatus, f as CheckoutNamespace, g as CheckoutStartInput, h as CheckoutStartResult, i as CheckoutTenantType, l as CreateTicketInput, D as DEFAULT_BASE_URL, m as DbBatchOp, n as DbChangeType, o as DbCollectionRef, p as DbDoc, q as DbDocRef, r as DbGetResult, s as DbListResult, t as DbNamespace, u as DbQuery, v as DbSqlLease, w as DbWhereFilter, E as EntitlementCheck, F as FieldSentinel, I as IncrementSentinel, L as ListNotificationsOptions, M as MockCheckout, y as MockNotifications, z as MockWebhooks, N as NEETRU_SENTINEL_KEY, B as NeetruClient, G as NeetruClientConfig, H as NeetruDb, K as NeetruDbEngine, O as NeetruDbError, P as NeetruDbErrorCode, Q as NeetruDbOptions, R as NeetruDbTransport, S as NeetruEnv, T as NeetruSqlClient, U as NeetruUser, V as NotificationScopeOptions, W as NotificationsNamespace, X as Product, Y as ProductNotification, Z as ProductNotificationSeverity, _ as ProductPlan, $ as ProductStatus, a1 as RedirectCallbackResult, a2 as RegisterWebhookInput, a3 as ResolvedConfig, a4 as SendNotificationInput, a5 as ServerTimestampSentinel, a6 as SignInOptions, a8 as SupportNamespace, a9 as SupportSeverity, aa as SupportStatus, ab as SupportTicket, ad as TelemetryEventAck, ae as TelemetryEventInput, ai as UsageEventInput, aj as UsageNamespace, ak as UsageQuota, al as VerifyTokenOptions, am as VerifyWebhookRequestOptions, an as VerifyWebhookRequestResult, ao as WebhookEndpoint, ap as WebhookEvent, aq as WebhookScopeOptions, ar as WebhookTestResult, as as WebhooksNamespace, at as WithFieldSentinels, au as createCheckoutNamespace, av as createNeetruDb, aw as createNotificationsNamespace, ay as createWebhooksNamespace, aA as increment, aB as isFieldSentinel, aC as isIncrementSentinel, aD as isServerTimestampSentinel, aE as serverTimestamp, aF as verifyWebhookRequest, aG as verifyWebhookSignature } from './types-BXvGHppn.cjs';
+export { DEV_FIXTURE_USER, MockAuth, MockAuthOptions, MockDb, MockEntitlements, MockSupport, MockUsage } from './mocks.cjs';
 import 'drizzle-orm/node-postgres';
 
 /**
@@ -42,6 +42,6 @@ declare function checkCoreVersionCompat(coreVersion: string): void;
  */
 
 /** Versão do SDK — exportada explicitamente pra detecção em runtime. */
-declare const VERSION: "3.1.1";
+declare const VERSION: "3.1.6";
 
 export { VERSION, checkCoreVersionCompat };

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export { createNeetruClient } from './auth.js';
 export { NeetruError, NeetruErrorCode } from './errors.js';
-export { A as AuthNamespace, a as AuthStateListener, C as CatalogListOptions, b as CatalogListResponse, c as CheckoutIntentInfo, d as CheckoutIntentStatus, e as CheckoutNamespace, f as CheckoutStartInput, g as CheckoutStartResult, h as CheckoutTenantType, k as CreateTicketInput, D as DEFAULT_BASE_URL, l as DbBatchOp, m as DbChangeType, n as DbCollectionRef, o as DbDoc, p as DbDocRef, q as DbGetResult, r as DbListResult, s as DbNamespace, t as DbQuery, u as DbSqlLease, v as DbWhereFilter, E as EntitlementCheck, F as FieldSentinel, I as IncrementSentinel, L as ListNotificationsOptions, M as MockCheckout, x as MockNotifications, y as MockWebhooks, N as NEETRU_SENTINEL_KEY, z as NeetruClient, B as NeetruClientConfig, G as NeetruDb, J as NeetruDbEngine, K as NeetruDbError, O as NeetruDbErrorCode, P as NeetruDbOptions, Q as NeetruDbTransport, R as NeetruEnv, S as NeetruSqlClient, T as NeetruUser, U as NotificationScopeOptions, V as NotificationsNamespace, W as Product, X as ProductNotification, Y as ProductNotificationSeverity, Z as ProductPlan, _ as ProductStatus, a0 as RegisterWebhookInput, a1 as ResolvedConfig, a2 as SendNotificationInput, a3 as ServerTimestampSentinel, a4 as SignInOptions, a6 as SupportNamespace, a7 as SupportSeverity, a8 as SupportStatus, a9 as SupportTicket, ab as TelemetryEventAck, ac as TelemetryEventInput, ag as UsageEventInput, ah as UsageNamespace, ai as UsageQuota, aj as VerifyTokenOptions, ak as VerifyWebhookRequestOptions, al as VerifyWebhookRequestResult, am as WebhookEndpoint, an as WebhookEvent, ao as WebhookScopeOptions, ap as WebhookTestResult, aq as WebhooksNamespace, ar as WithFieldSentinels, as as createCheckoutNamespace, at as createNeetruDb, au as createNotificationsNamespace, aw as createWebhooksNamespace, ay as increment, az as isFieldSentinel, aA as isIncrementSentinel, aB as isServerTimestampSentinel, aC as serverTimestamp, aD as verifyWebhookRequest, aE as verifyWebhookSignature } from './types-B3XFHD4A.js';
-export { DEV_FIXTURE_USER, MockAuth, MockDb, MockEntitlements, MockSupport, MockUsage } from './mocks.js';
+export { A as AuthNamespace, a as AuthStateListener, C as CatalogListOptions, b as CatalogListResponse, d as CheckoutIntentInfo, e as CheckoutIntentStatus, f as CheckoutNamespace, g as CheckoutStartInput, h as CheckoutStartResult, i as CheckoutTenantType, l as CreateTicketInput, D as DEFAULT_BASE_URL, m as DbBatchOp, n as DbChangeType, o as DbCollectionRef, p as DbDoc, q as DbDocRef, r as DbGetResult, s as DbListResult, t as DbNamespace, u as DbQuery, v as DbSqlLease, w as DbWhereFilter, E as EntitlementCheck, F as FieldSentinel, I as IncrementSentinel, L as ListNotificationsOptions, M as MockCheckout, y as MockNotifications, z as MockWebhooks, N as NEETRU_SENTINEL_KEY, B as NeetruClient, G as NeetruClientConfig, H as NeetruDb, K as NeetruDbEngine, O as NeetruDbError, P as NeetruDbErrorCode, Q as NeetruDbOptions, R as NeetruDbTransport, S as NeetruEnv, T as NeetruSqlClient, U as NeetruUser, V as NotificationScopeOptions, W as NotificationsNamespace, X as Product, Y as ProductNotification, Z as ProductNotificationSeverity, _ as ProductPlan, $ as ProductStatus, a1 as RedirectCallbackResult, a2 as RegisterWebhookInput, a3 as ResolvedConfig, a4 as SendNotificationInput, a5 as ServerTimestampSentinel, a6 as SignInOptions, a8 as SupportNamespace, a9 as SupportSeverity, aa as SupportStatus, ab as SupportTicket, ad as TelemetryEventAck, ae as TelemetryEventInput, ai as UsageEventInput, aj as UsageNamespace, ak as UsageQuota, al as VerifyTokenOptions, am as VerifyWebhookRequestOptions, an as VerifyWebhookRequestResult, ao as WebhookEndpoint, ap as WebhookEvent, aq as WebhookScopeOptions, ar as WebhookTestResult, as as WebhooksNamespace, at as WithFieldSentinels, au as createCheckoutNamespace, av as createNeetruDb, aw as createNotificationsNamespace, ay as createWebhooksNamespace, aA as increment, aB as isFieldSentinel, aC as isIncrementSentinel, aD as isServerTimestampSentinel, aE as serverTimestamp, aF as verifyWebhookRequest, aG as verifyWebhookSignature } from './types-CQVak2a3.js';
+export { DEV_FIXTURE_USER, MockAuth, MockAuthOptions, MockDb, MockEntitlements, MockSupport, MockUsage } from './mocks.js';
 import 'drizzle-orm/node-postgres';
 
 /**
@@ -42,6 +42,6 @@ declare function checkCoreVersionCompat(coreVersion: string): void;
  */
 
 /** Versão do SDK — exportada explicitamente pra detecção em runtime. */
-declare const VERSION: "3.1.1";
+declare const VERSION: "3.1.6";
 
 export { VERSION, checkCoreVersionCompat };

package/dist/index.mjs

@@ -1093,7 +1093,8 @@ function createTelemetryNamespace(config) {
         message: input.message
       };
       if (input.metadata) body.metadata = input.metadata;
-      if (input.productSlug) body.productSlug = input.productSlug;
+      const productSlug = input.productSlug ?? config.productId;
+      if (productSlug) body.productSlug = productSlug;
       let cid = input.correlationId;
       if (!cid) {
         try {
@@ -4612,13 +4613,69 @@ function createRestSyncTransport(config) {
       if (!config) {
         return { docs: [], newWatermark: Date.now(), resyncRequired: false };
       }
-      return { docs: [], newWatermark: Date.now(), resyncRequired: false };
+      return { docs: [], newWatermark: Date.now(), resyncRequired: true };
     },
-    async fullResync(_collections) {
+    async fullResync(collections) {
       if (!config) {
         return { docs: [], newWatermark: Date.now() };
       }
-      return { docs: [], newWatermark: Date.now() };
+      const { httpRequest: httpRequest2 } = await Promise.resolve().then(() => (init_http(), http_exports));
+      const tenantScopeId = config.tenantId ?? config.productId;
+      const tenantHeaders = tenantScopeId ? { "x-neetru-tenant": tenantScopeId } : void 0;
+      const now = Date.now();
+      const docs = [];
+      for (const collection of collections) {
+        let raw;
+        try {
+          raw = await httpRequest2(config, {
+            method: "GET",
+            path: DATASTORE_COLLECTION_ENDPOINT(collection),
+            requireAuth: true,
+            retries: 2,
+            headers: tenantHeaders,
+            // Teto do Core é 200. Coleções > 200 docs truncam silenciosamente
+            // aqui (paginação cursor é tarefa Core separada) — a detecção de
+            // deleção-por-ausência do SyncEngine NÃO deve rodar sobre truncamento,
+            // então mantemos o limite no máximo do servidor por ora.
+            query: { limit: 200 }
+          });
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          throw new NeetruDbError(
+            "db_unavailable",
+            `[RestSyncTransport] fullResync falhou na cole\xE7\xE3o "${collection}": ${msg}`
+          );
+        }
+        const resp = raw;
+        const items = Array.isArray(resp?.items) ? resp.items : [];
+        for (const item of items) {
+          if (!item || typeof item !== "object") continue;
+          const record = item;
+          const id = typeof record["id"] === "string" ? record["id"] : null;
+          if (!id) continue;
+          const { id: _inlinedId, ...data } = record;
+          let serverTimestamp2 = now;
+          const updatedAt = data["_updatedAt"];
+          if (typeof updatedAt === "number") {
+            serverTimestamp2 = updatedAt;
+          } else if (updatedAt !== null && typeof updatedAt === "object" && typeof updatedAt["_seconds"] === "number") {
+            serverTimestamp2 = updatedAt["_seconds"] * 1e3;
+          } else if (typeof updatedAt === "string") {
+            const parsed = Date.parse(updatedAt);
+            if (!Number.isNaN(parsed)) serverTimestamp2 = parsed;
+          }
+          const serverVersion = `rest_${id}_${serverTimestamp2}`;
+          docs.push({
+            collection,
+            id,
+            data,
+            serverVersion,
+            serverTimestamp: serverTimestamp2,
+            deleted: false
+          });
+        }
+      }
+      return { docs, newWatermark: now };
     }
   };
 }
@@ -4858,6 +4915,15 @@ function createLazyCollectionRef(name, getDocsPromise) {
 // src/checkout.ts
 init_errors();
 init_http();
+function checkoutAuth(accessToken, method) {
+  if (!accessToken || typeof accessToken !== "string") {
+    throw new NeetruError(
+      "validation_failed",
+      `checkout.${method} requer o access_token OIDC do usu\xE1rio final (passe \`accessToken\`). A chave de API do SDK (nrt_*) N\xC3O \xE9 aceita pelo endpoint de checkout \u2014 ele autentica a identidade do cliente que est\xE1 assinando (Bearer access_token OIDC ou cookie de sess\xE3o).`
+    );
+  }
+  return { requireAuth: false, headers: { authorization: `Bearer ${accessToken}` } };
+}
 function parseStartResponse(raw) {
   if (!raw || typeof raw !== "object") {
     throw new NeetruError("invalid_response", "checkout.start response is not an object");
@@ -4935,11 +5001,13 @@ function createHttpCheckoutNamespace(config) {
       };
       if (input.tenantType) body.targetTenantType = input.tenantType;
       if (input.tenantId) body.targetTenantId = input.tenantId;
+      const { requireAuth, headers } = checkoutAuth(input.accessToken, "start");
       const raw = await httpRequest(config, {
         method: "POST",
         path: "/api/v1/checkout/intents",
         body,
-        requireAuth: true,
+        requireAuth,
+        headers,
         idempotencyKey: true
       });
       const result = parseStartResponse(raw);
@@ -4949,25 +5017,29 @@ function createHttpCheckoutNamespace(config) {
       }
       return result;
     },
-    async get(intentId) {
+    async get(intentId, opts) {
       if (!intentId || typeof intentId !== "string") {
         throw new NeetruError("validation_failed", "checkout.get: intentId is required");
       }
+      const { requireAuth, headers } = checkoutAuth(opts?.accessToken, "get");
       const raw = await httpRequest(config, {
         method: "GET",
         path: `/api/v1/checkout/intents/${encodeURIComponent(intentId)}`,
-        requireAuth: true
+        requireAuth,
+        headers
       });
       return parseGetResponse(raw);
     },
-    async cancel(intentId) {
+    async cancel(intentId, opts) {
       if (!intentId || typeof intentId !== "string") {
         throw new NeetruError("validation_failed", "checkout.cancel: intentId is required");
       }
+      const { requireAuth, headers } = checkoutAuth(opts?.accessToken, "cancel");
       const raw = await httpRequest(config, {
         method: "DELETE",
         path: `/api/v1/checkout/intents/${encodeURIComponent(intentId)}`,
-        requireAuth: true
+        requireAuth,
+        headers
       });
       return {
         ok: true,
@@ -5011,14 +5083,14 @@ var MockCheckout = class {
       requiresKyc: false
     };
   }
-  async get(intentId) {
+  async get(intentId, _opts) {
     const found = this.intents.get(intentId);
     if (!found) {
       throw new NeetruError("not_found", `Mock intent ${intentId} not found`);
     }
     return { ...found };
   }
-  async cancel(intentId) {
+  async cancel(intentId, _opts) {
     const found = this.intents.get(intentId);
     if (!found) {
       throw new NeetruError("not_found", `Mock intent ${intentId} not found`);
@@ -5036,7 +5108,7 @@ function createCheckoutNamespace(config) {
 // src/webhooks.ts
 init_errors();
 init_http();
-async function verifyWebhookSignature(payload, signature, secret) {
+async function verifyWebhookSignature(payload, signature, secret, timestamp) {
   if (!signature || !secret) return false;
   const sigHex = signature.startsWith("sha256=") ? signature.slice(7) : signature;
   if (!/^[0-9a-f]+$/i.test(sigHex)) return false;
@@ -5049,7 +5121,15 @@ async function verifyWebhookSignature(payload, signature, secret) {
   }
   const encoder = new TextEncoder();
   const keyBytes = encoder.encode(secret);
-  const payloadBytes = typeof payload === "string" ? encoder.encode(payload) : payload;
+  const rawBytes = typeof payload === "string" ? encoder.encode(payload) : payload;
+  let payloadBytes = rawBytes;
+  if (timestamp !== void 0) {
+    const prefix = encoder.encode(`${timestamp}.`);
+    const merged = new Uint8Array(prefix.length + rawBytes.length);
+    merged.set(prefix, 0);
+    merged.set(rawBytes, prefix.length);
+    payloadBytes = merged;
+  }
   const key = await subtle.importKey(
     "raw",
     keyBytes,
@@ -5097,7 +5177,7 @@ async function verifyWebhookRequest(payload, headers, secret, options = {}) {
     return { ok: false, reason: "timestamp_expired" };
   }
   const sig = getHeader("x-neetru-signature");
-  const valid = await verifyWebhookSignature(payload, sig, secret);
+  const valid = await verifyWebhookSignature(payload, sig, secret, tsHeader);
   if (!valid) {
     return { ok: false, reason: "invalid_signature" };
   }
@@ -5485,9 +5565,19 @@ var DEV_FIXTURE_USER = Object.freeze({
 var MockAuth = class {
   _user;
   _listeners;
-  constructor(initialUser = null) {
+  _allowUnsignedDecode;
+  constructor(initialUser = null, options) {
     this._user = initialUser;
     this._listeners = /* @__PURE__ */ new Set();
+    this._allowUnsignedDecode = options?.allowUnsignedDecode ?? false;
+    if (this._allowUnsignedDecode) {
+      const isTestEnv = typeof process !== "undefined" && (process.env?.NODE_ENV === "test" || process.env?.VITEST === "true" || process.env?.VITEST != null);
+      if (!isTestEnv && typeof console !== "undefined") {
+        console.warn(
+          "[neetru-sdk] MockAuth.verifyToken est\xE1 em modo allowUnsignedDecode=true: tokens N\xC3O t\xEAm assinatura verificada. Este modo \xE9 exclusivo para testes \u2014 NUNCA use como security boundary em c\xF3digo deployado."
+        );
+      }
+    }
   }
   async signIn(_options) {
     if (!this._user) this._user = { ...DEV_FIXTURE_USER };
@@ -5512,18 +5602,27 @@ var MockAuth = class {
     };
   }
   /**
-   * Mock de `verifyToken` — decodifica o JWT sem verificar assinatura (pra testes).
-   * Em dev, retorna o user atual do mock se já estiver logado. Aceita qualquer token
-   * não-vazio sem chamar rede.
+   * Mock de `verifyToken` — por default lança `unauthorized` pra prevenir uso
+   * acidental como security boundary em código deployado.
    *
-   * Para simular falhas em testes, use `MockAuth.__mockVerifyToken(fn)`.
+   * Para decodificar JWTs sem verificar assinatura em testes, crie a instância
+   * com `new MockAuth(user, { allowUnsignedDecode: true })`. Isso é um opt-in
+   * explícito — nunca acontece silenciosamente.
+   *
+   * Para simular falhas ou resultados customizados, use `__mockVerifyToken(fn)`.
    */
   async verifyToken(token) {
     if (this._verifyTokenOverride) {
       return this._verifyTokenOverride(token);
     }
     if (!token) {
-      throw Object.assign(new Error("Token inv\xE1lido"), { code: "token_invalid_signature" });
+      throw new NeetruError("token_invalid_signature", "Token inv\xE1lido: string vazia");
+    }
+    if (!this._allowUnsignedDecode) {
+      throw new NeetruError(
+        "unauthorized",
+        "MockAuth.verifyToken n\xE3o verifica assinaturas JWT e N\xC3O deve ser usado como security boundary em c\xF3digo deployado. Em testes, use new MockAuth(user, { allowUnsignedDecode: true }) para habilitar decodifica\xE7\xE3o sem assinatura, ou __mockVerifyToken(fn) para injetar resultado customizado."
+      );
     }
     try {
       const parts = token.split(".");
@@ -5550,7 +5649,32 @@ var MockAuth = class {
     } catch {
     }
     if (this._user) return this._user;
-    throw Object.assign(new Error("Nenhum user mock dispon\xEDvel"), { code: "token_invalid_signature" });
+    throw new NeetruError("token_invalid_signature", "Nenhum user mock dispon\xEDvel e JWT sem sub v\xE1lido");
+  }
+  /**
+   * Mock de `handleRedirectCallback` (Bug 2 / 3.1.3) — não há redirect real no
+   * mock, então retorna `null` por default. Use `__setPendingCallback(result)`
+   * em testes pra simular um retorno do IdP.
+   */
+  async handleRedirectCallback(_currentUrl) {
+    return this._pendingCallback;
+  }
+  /**
+   * Mock de `getIdToken` (Bug 2 / 3.1.3). Retorna `null` por default; use
+   * `__setIdToken(token)` pra injetar um token cru em testes.
+   */
+  getIdToken() {
+    return this._idToken;
+  }
+  _pendingCallback = null;
+  _idToken = null;
+  /** Test helper — simula o material devolvido por um callback OIDC. */
+  __setPendingCallback(result) {
+    this._pendingCallback = result;
+  }
+  /** Test helper — injeta o id_token cru retornado por `getIdToken`. */
+  __setIdToken(token) {
+    this._idToken = token;
   }
   _verifyTokenOverride = null;
   /**
@@ -6081,6 +6205,49 @@ function _jwtPayloadToUser(payload) {
     ...payload
   };
 }
+var OIDC_TX_KEY = "neetru_oauth_tx";
+function resolveIdpOrigin(baseUrl) {
+  const overrideAuthUrl = typeof globalThis.NEETRU_AUTH_URL === "string" ? globalThis.NEETRU_AUTH_URL : null;
+  return overrideAuthUrl ?? baseUrl.replace(/^https?:\/\/api\./, "https://auth.");
+}
+function getWebCrypto() {
+  const c = globalThis.crypto;
+  if (!c || typeof c.getRandomValues !== "function" || !c.subtle) {
+    throw new NeetruError(
+      "runtime_unsupported",
+      "auth.signIn requer WebCrypto (crypto.subtle) \u2014 indispon\xEDvel neste runtime. Use HTTPS (ou http://localhost) num browser moderno."
+    );
+  }
+  return c;
+}
+function base64UrlFromBytes(bytes) {
+  let str = "";
+  for (const b of bytes) str += String.fromCharCode(b);
+  const b64 = typeof btoa === "function" ? btoa(str) : Buffer.from(str, "binary").toString("base64");
+  return b64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+function randomUrlSafe(crypto2, byteLen) {
+  const bytes = new Uint8Array(byteLen);
+  crypto2.getRandomValues(bytes);
+  return base64UrlFromBytes(bytes);
+}
+async function pkceChallengeS256(crypto2, verifier) {
+  const data = new TextEncoder().encode(verifier);
+  const digest = await crypto2.subtle.digest("SHA-256", data);
+  return base64UrlFromBytes(new Uint8Array(digest));
+}
+function cleanCallbackUrl(parsed) {
+  try {
+    const history = globalThis.history;
+    if (!history || typeof history.replaceState !== "function") return;
+    const clean = new URL(parsed.toString());
+    for (const p of ["code", "state", "error", "error_description", "iss", "session_state"]) {
+      clean.searchParams.delete(p);
+    }
+    history.replaceState(history.state ?? null, "", clean.pathname + clean.search + clean.hash);
+  } catch {
+  }
+}
 function createOidcAuthNamespace(config) {
   const STORAGE_KEY = "neetru_id_token";
   const listeners = /* @__PURE__ */ new Set();
@@ -6093,6 +6260,13 @@ function createOidcAuthNamespace(config) {
       return null;
     }
   }
+  function getSessionStorage() {
+    try {
+      return typeof globalThis.sessionStorage !== "undefined" ? globalThis.sessionStorage : null;
+    } catch {
+      return null;
+    }
+  }
   function decodeJwtPayload(token) {
     const parts = token.split(".");
     if (parts.length !== 3) return null;
@@ -6176,20 +6350,48 @@ function createOidcAuthNamespace(config) {
   return {
     async signIn(options) {
       if (typeof globalThis.location !== "undefined" && typeof globalThis.location.assign === "function") {
+        const crypto2 = getWebCrypto();
         const redirectUri = options?.redirectUri ?? globalThis.location.origin;
         const scope = options?.scope ?? "openid profile email";
-        const state = options?.postLoginRedirect ?? globalThis.location.href;
-        const overrideAuthUrl = typeof globalThis.NEETRU_AUTH_URL === "string" ? globalThis.NEETRU_AUTH_URL : null;
-        const idpOrigin = overrideAuthUrl ?? config.baseUrl.replace(/^https?:\/\/api\./, "https://auth.");
+        let clientId = config.oidcClientId;
+        if (!clientId && config.apiKey) {
+          clientId = parseApiKey(config.apiKey).keyId;
+        }
+        if (!clientId) {
+          throw new NeetruError(
+            "invalid_config",
+            "auth.signIn requer `oidcClientId` (ou `apiKey`) configurado para montar o client_id."
+          );
+        }
+        const state = randomUrlSafe(crypto2, 16);
+        const nonce = randomUrlSafe(crypto2, 16);
+        const codeVerifier = randomUrlSafe(crypto2, 32);
+        const codeChallenge = await pkceChallengeS256(crypto2, codeVerifier);
+        const session = getSessionStorage();
+        if (!session) {
+          throw new NeetruError(
+            "runtime_unsupported",
+            "auth.signIn requer sessionStorage para guardar a transa\xE7\xE3o PKCE entre o redirect e o callback."
+          );
+        }
+        const tx = {
+          state,
+          nonce,
+          codeVerifier,
+          redirectUri,
+          postLoginRedirect: options?.postLoginRedirect
+        };
+        session.setItem(OIDC_TX_KEY, JSON.stringify(tx));
+        const idpOrigin = resolveIdpOrigin(config.baseUrl);
         const url = new URL("/api/v1/oauth/authorize", idpOrigin);
         url.searchParams.set("response_type", "code");
+        url.searchParams.set("client_id", clientId);
         url.searchParams.set("redirect_uri", redirectUri);
         url.searchParams.set("scope", scope);
         url.searchParams.set("state", state);
-        if (config.apiKey) {
-          const { keyId } = parseApiKey(config.apiKey);
-          url.searchParams.set("client_id", keyId);
-        }
+        url.searchParams.set("nonce", nonce);
+        url.searchParams.set("code_challenge", codeChallenge);
+        url.searchParams.set("code_challenge_method", "S256");
         globalThis.location.assign(url.toString());
         return;
       }
@@ -6198,6 +6400,67 @@ function createOidcAuthNamespace(config) {
         "auth.signIn requires a browser context or mocks. Use NEETRU_ENV=dev or pass mocks.auth."
       );
     },
+    async handleRedirectCallback(currentUrl) {
+      const href = currentUrl ?? (typeof globalThis.location !== "undefined" ? globalThis.location.href : void 0);
+      if (!href) return null;
+      let parsed;
+      try {
+        parsed = new URL(href);
+      } catch {
+        return null;
+      }
+      const params = parsed.searchParams;
+      const idpError = params.get("error");
+      if (idpError) {
+        const desc = params.get("error_description") ?? idpError;
+        getSessionStorage()?.removeItem(OIDC_TX_KEY);
+        cleanCallbackUrl(parsed);
+        throw new NeetruError(idpError, `OIDC authorize falhou: ${desc}`);
+      }
+      const code = params.get("code");
+      if (!code) return null;
+      const returnedState = params.get("state");
+      const session = getSessionStorage();
+      const txRaw = session?.getItem(OIDC_TX_KEY) ?? null;
+      let tx = null;
+      if (txRaw) {
+        try {
+          tx = JSON.parse(txRaw);
+        } catch {
+          tx = null;
+        }
+      }
+      if (!tx) {
+        throw new NeetruError(
+          "oidc_state_mismatch",
+          "Callback OIDC sem transa\xE7\xE3o pendente \u2014 `signIn` n\xE3o foi iniciado nesta sess\xE3o (ou j\xE1 consumido)."
+        );
+      }
+      if (!returnedState || returnedState !== tx.state) {
+        session?.removeItem(OIDC_TX_KEY);
+        cleanCallbackUrl(parsed);
+        throw new NeetruError(
+          "oidc_state_mismatch",
+          "state do callback OIDC n\xE3o confere com o da transa\xE7\xE3o (poss\xEDvel CSRF)."
+        );
+      }
+      session?.removeItem(OIDC_TX_KEY);
+      cleanCallbackUrl(parsed);
+      return {
+        code,
+        codeVerifier: tx.codeVerifier,
+        redirectUri: tx.redirectUri,
+        nonce: tx.nonce,
+        state: tx.state,
+        postLoginRedirect: tx.postLoginRedirect
+      };
+    },
+    getIdToken() {
+      const storage = getStorage();
+      const token = storage?.getItem(STORAGE_KEY) ?? null;
+      if (!token) return null;
+      return tokenToUser(token) ? token : null;
+    },
     async signOut() {
       const storage = getStorage();
       const storedToken = storage?.getItem(STORAGE_KEY) ?? null;
@@ -6257,13 +6520,20 @@ function createOidcAuthNamespace(config) {
       const issuer = idpOrigin;
       const jwksUrl = `${idpOrigin}/api/v1/oauth/.well-known/jwks.json`;
       const cacheTtlMs = options?.jwksCacheTtlMs ?? DEFAULT_JWKS_TTL_MS;
+      const audienceFromOptions = options?.audience;
       const parsedKey = tryParseApiKey(config.apiKey);
-      const audience = parsedKey?.keyId;
+      const audience = audienceFromOptions ?? parsedKey?.keyId;
+      if (!audience) {
+        throw new NeetruError(
+          "invalid_config",
+          "verifyToken requires an audience: provide apiKey on the client or pass options.audience. Calling jwtVerify without an audience allows tokens issued for other OIDC clients to pass."
+        );
+      }
       const jwks = _getJwks(jwksUrl, cacheTtlMs);
       try {
         const { payload } = await jwtVerify(token, jwks, {
           issuer,
-          ...audience ? { audience } : {},
+          audience,
           algorithms: ["RS256"]
         });
         return _jwtPayloadToUser(payload);
@@ -6304,6 +6574,7 @@ function createNeetruClient(config = {}) {
   const env = resolveEnv(config.env);
   const resolved = Object.freeze({
     apiKey,
+    oidcClientId: config.oidcClientId,
     baseUrl,
     fetch: fetchImpl.bind(globalThis),
     env,
@@ -6338,7 +6609,7 @@ function createNeetruClient(config = {}) {
 init_errors();
 init_db_errors();
 init_http();
-var VERSION = "3.1.1";
+var VERSION = "3.1.6";
 
 export { DEFAULT_BASE_URL, DEV_FIXTURE_USER, MockAuth, MockCheckout, MockDb, MockEntitlements, MockNotifications, MockSupport, MockUsage, MockWebhooks, NEETRU_SENTINEL_KEY, NeetruDbError, NeetruError, VERSION, checkCoreVersionCompat, createCheckoutNamespace, createNeetruClient, createNeetruDb, createNotificationsNamespace, createWebhooksNamespace, increment, isFieldSentinel, isIncrementSentinel, isServerTimestampSentinel, serverTimestamp, verifyWebhookRequest, verifyWebhookSignature };
 //# sourceMappingURL=index.mjs.map