@neetru/sdk 3.1.2 → 3.1.6

package/dist/{types-B3XFHD4A.d.ts → types-CQVak2a3.d.ts}

@@ -21,6 +21,20 @@ interface CheckoutStartInput {
      * Passe `false` se quiser controlar o redirect manualmente.
      */
     autoRedirect?: boolean;
+    /**
+     * **C2 (auditoria 2026-06-10):** access_token OIDC do **usuário final** que
+     * está assinando. OBRIGATÓRIO no modo HTTP real — o endpoint de checkout do
+     * Core (`/api/v1/checkout/intents`) autentica a identidade do cliente (Bearer
+     * access_token OIDC ou cookie de sessão), NÃO a chave de API do SDK (`nrt_*`).
+     * Enviar a chave `nrt_*` resultava em 401 sempre. O SDK é BFF-pattern: o app
+     * consumidor gerencia o ciclo OIDC e passa o access_token aqui.
+     */
+    accessToken?: string;
+}
+/** Auth por chamada do checkout — access_token OIDC do usuário final. */
+interface CheckoutAuthOpts {
+    /** access_token OIDC do usuário final (vide CheckoutStartInput.accessToken). */
+    accessToken?: string;
 }
 interface CheckoutStartResult {
     intentId: string;
@@ -54,10 +68,10 @@ interface CheckoutNamespace {
      * Dev mode (`NEETRU_ENV=dev`): retorna URL fake `https://localhost:9003/portal/checkout/mock-XXXX`.
      */
     start(input: CheckoutStartInput): Promise<CheckoutStartResult>;
-    /** Lê estado atual do intent (Core). */
-    get(intentId: string): Promise<CheckoutIntentInfo>;
-    /** Cancela um intent que ainda não virou `stripe_redirected`. */
-    cancel(intentId: string): Promise<{
+    /** Lê estado atual do intent (Core). Requer `opts.accessToken` no HTTP real. */
+    get(intentId: string, opts?: CheckoutAuthOpts): Promise<CheckoutIntentInfo>;
+    /** Cancela um intent que ainda não virou `stripe_redirected`. Requer `opts.accessToken` no HTTP real. */
+    cancel(intentId: string, opts?: CheckoutAuthOpts): Promise<{
         ok: true;
         alreadyCancelled: boolean;
     }>;
@@ -73,8 +87,8 @@ interface CheckoutNamespace {
 declare class MockCheckout implements CheckoutNamespace {
     private readonly intents;
     start(input: CheckoutStartInput): Promise<CheckoutStartResult>;
-    get(intentId: string): Promise<CheckoutIntentInfo>;
-    cancel(intentId: string): Promise<{
+    get(intentId: string, _opts?: CheckoutAuthOpts): Promise<CheckoutIntentInfo>;
+    cancel(intentId: string, _opts?: CheckoutAuthOpts): Promise<{
         ok: true;
         alreadyCancelled: boolean;
     }>;
@@ -228,10 +242,20 @@ interface WebhooksNamespace {
  * Constant-time compare via byte-level XOR accumulator (não usa
  * `timingSafeEqual` do Node porque WebCrypto não tem equivalente direto).
  *
+ * **3.1.3 (auditoria 2026-06-10)**: o Core assina HMAC sobre
+ * `` `${timestamp}.${rawBody}` `` (vide `computeWebhookSignature` em
+ * `functions/src/lib/webhook-delivery-core.ts`) — o `timestamp` é o valor do
+ * header `X-Neetru-Timestamp`. Passe-o no 4º parâmetro; sem ele o HMAC é
+ * computado só sobre o body e NUNCA confere com entregas reais do Core.
+ * Prefira `verifyWebhookRequest`, que lê os headers e já faz tudo.
+ *
  * @param payload Corpo cru da request (string ou Uint8Array). NÃO use o objeto
  *                parseado — JSON.stringify pode diferir do que foi assinado.
  * @param signature Header `X-Neetru-Signature` recebido (formato `sha256=<hex>`).
  * @param secret Secret registrado em `webhooks.register({ secret })`.
+ * @param timestamp Valor do header `X-Neetru-Timestamp` (ms epoch). Quando
+ *                presente, o HMAC cobre `` `${timestamp}.${payload}` ``
+ *                (esquema canônico do Core — replay protection embutida).
  * @returns Promise<boolean> — true se assinatura confere, false caso contrário.
  *
  * @example
@@ -240,7 +264,8 @@ interface WebhooksNamespace {
  * export async function POST(req: Request) {
  *   const raw = await req.text();
  *   const sig = req.headers.get('X-Neetru-Signature');
- *   const ok = await verifyWebhookSignature(raw, sig, process.env.NEETRU_WEBHOOK_SECRET!);
+ *   const ts = req.headers.get('X-Neetru-Timestamp');
+ *   const ok = await verifyWebhookSignature(raw, sig, process.env.NEETRU_WEBHOOK_SECRET!, ts ?? undefined);
  *   if (!ok) return new Response('unauthorized', { status: 401 });
  *   const event = JSON.parse(raw);
  *   // ... handle event
@@ -252,7 +277,7 @@ interface WebhooksNamespace {
  *   Não retorna `false` silencioso — caller precisa distinguir "assinatura
  *   inválida" (return false) de "ambiente não suporta" (throw).
  */
-declare function verifyWebhookSignature(payload: string | Uint8Array, signature: string | null | undefined, secret: string): Promise<boolean>;
+declare function verifyWebhookSignature(payload: string | Uint8Array, signature: string | null | undefined, secret: string, timestamp?: string | number): Promise<boolean>;
 /**
  * Opções de `verifyWebhookRequest`.
  */
@@ -1660,6 +1685,17 @@ interface NeetruClientConfig {
      * (entitlements, telemetry) lançam `missing_api_key` se ausente.
      */
     apiKey?: string;
+    /**
+     * 3.1.3 — `client_id` do client OIDC confidencial do produto, registrado em
+     * `oidc_clients/{id}` no Core (par id + segredo, modelo Firebase/Facebook).
+     *
+     * Usado como `client_id` no fluxo `auth.signIn()` (Authorization Code + PKCE).
+     * É **distinto** do `keyId` embutido na `apiKey` (`nrt_<keyId>_<secret>`), que
+     * identifica a API key de máquina — não um client OIDC. Se ausente, `signIn`
+     * cai no `keyId` por compat, mas o `/authorize` do Core só reconhece um
+     * `oidc_clients` válido, então registre e passe `oidcClientId` em produção.
+     */
+    oidcClientId?: string;
     /**
      * URL base da API Neetru. Default: `https://api.neetru.com`.
      * Útil em testes apontando pra staging ou mock server.
@@ -1803,7 +1839,8 @@ interface TelemetryLogInput {
     metadata?: Record<string, unknown>;
     /** Override correlationId (default: lê dos headers/env automaticamente). */
     correlationId?: string;
-    /** Slug do produto referenciado. Backend infere do escopo do token se ausente. */
+    /** Slug do produto. Se ausente, o SDK usa `config.productId` como default
+     *  (o backend NÃO infere — exige productSlug no body, fail-closed). */
     productSlug?: string;
 }
 interface TelemetryLogAck {
@@ -1914,12 +1951,66 @@ interface SignInOptions {
     postLoginRedirect?: string;
 }
 type AuthStateListener = (user: NeetruUser | null) => void;
+/**
+ * 3.1.3 — Resultado de `auth.handleRedirectCallback()`: o material que o **backend
+ * do produto** (confidential client) usa pra trocar o code por tokens no
+ * endpoint `/api/v1/oauth/token` (POST x-www-form-urlencoded, `grant_type=
+ * authorization_code`, autenticação `Basic base64(clientId:clientSecret)`).
+ *
+ * O SDK nunca faz essa troca no browser (exigiria o `client_secret`). Ele só
+ * gera/valida o PKCE + state e entrega estes campos pro lado servidor.
+ */
+interface RedirectCallbackResult {
+    /** `authorization_code` emitido pelo IdP — single-use, TTL curto. */
+    code: string;
+    /** PKCE `code_verifier` (RFC 7636) — enviar junto do code no `/token`. */
+    codeVerifier: string;
+    /**
+     * `redirect_uri` exato usado no `/authorize`. O `/token` exige reenvio
+     * idêntico (exact match) — passe este valor sem alterar.
+     */
+    redirectUri: string;
+    /**
+     * `nonce` enviado no `/authorize`. O backend deve validar que o claim
+     * `nonce` do `id_token` retornado bate com este valor (anti-replay OIDC).
+     */
+    nonce: string;
+    /** `state` validado (CSRF). Exposto pra logging/correlação. */
+    state: string;
+    /**
+     * Destino pós-login que o app passou em `signIn({ postLoginRedirect })`.
+     * `undefined` se não informado.
+     */
+    postLoginRedirect?: string;
+}
 interface AuthNamespace {
     /**
-     * Inicia fluxo de login OIDC. Em dev (`NEETRU_ENV=dev`) retorna mock user
-     * direto sem redirect. Em prod redireciona pro authorize endpoint.
+     * Inicia fluxo de login OIDC (Authorization Code + PKCE). Em dev
+     * (`NEETRU_ENV=dev`) retorna mock user direto sem redirect. Em browser
+     * gera `state` (CSRF), `nonce` e o par PKCE `code_verifier`/`code_challenge`
+     * (S256), persiste a transação em `sessionStorage` e redireciona pro
+     * `/authorize`. Complete o fluxo no retorno com `handleRedirectCallback()`.
      */
     signIn(options?: SignInOptions): Promise<NeetruUser | void>;
+    /**
+     * 3.1.3 — Processa o retorno do IdP após `signIn`. Lê `code` + `state` da URL
+     * (default `location.href`; passe `currentUrl` pra override), valida o
+     * `state` contra a transação salva em `signIn` (CSRF), consome a transação
+     * (single-use), limpa os params da URL e devolve o material pro backend
+     * trocar por tokens. Retorna `null` se a URL não é um callback (sem `code`).
+     *
+     * @throws {NeetruError} `oidc_state_mismatch` se o `state` não bate ou não há
+     *   transação pendente; ou um erro com `.code` = o `error` do IdP (ex:
+     *   `access_denied`) quando a URL traz `?error=`.
+     */
+    handleRedirectCallback(currentUrl?: string): Promise<RedirectCallbackResult | null>;
+    /**
+     * 3.1.3 — Retorna o `id_token` cru (string JWT) que o app armazenou em
+     * `localStorage['neetru_id_token']`, ou `null` se ausente/expirado. Útil pra
+     * mandar como `Authorization: Bearer` ao BFF do produto. Para os claims
+     * decodificados use `getUser()`; para validar assinatura use `verifyToken()`.
+     */
+    getIdToken(): string | null;
     /** Limpa session local + revoga refresh token no servidor. */
     signOut(): Promise<void>;
     /** Retorna o user atual (do id_token cached) ou `null` se não logado. */
@@ -1973,6 +2064,14 @@ interface VerifyTokenOptions {
      * o tempo de janela após rotação de chaves.
      */
     jwksCacheTtlMs?: number;
+    /**
+     * Audience (`aud`) esperada no token. Se ausente, o SDK tenta derivar do
+     * `apiKey` configurado no client (campo `keyId`). Pelo menos uma das duas
+     * fontes é **obrigatória** — `verifyToken` lança `invalid_config` se nenhuma
+     * audience puder ser resolvida, pois verificar um token sem `aud` permitiria
+     * tokens emitidos para outros clients passarem sem detecção.
+     */
+    audience?: string;
 }
 /**
  * 3.0 BREAKING: `UsageEventInput` mantido só como tipo para tests/legacy
@@ -2138,6 +2237,8 @@ type NeetruEnv = 'dev' | 'workspace' | 'prod';
  */
 interface ResolvedConfig {
     readonly apiKey?: string;
+    /** 3.1.3 — client_id OIDC confidencial do produto (vide NeetruClientConfig). */
+    readonly oidcClientId?: string;
     readonly baseUrl: string;
     readonly fetch: typeof globalThis.fetch;
     /** Resolved env — `dev` | `workspace` | `prod`. Default `prod`. */
@@ -2153,4 +2254,4 @@ interface CatalogListOptions {
     includeDrafts?: boolean;
 }
 
-export { type RealtimeTransport as $, type AuthNamespace as A, type NeetruClientConfig as B, type CatalogListOptions as C, DEFAULT_BASE_URL as D, type EntitlementCheck as E, type FieldSentinel as F, type NeetruDb as G, type NeetruDbDocuments as H, type IncrementSentinel as I, type NeetruDbEngine as J, NeetruDbError as K, type ListNotificationsOptions as L, MockCheckout as M, NEETRU_SENTINEL_KEY as N, type NeetruDbErrorCode as O, type NeetruDbOptions as P, type NeetruDbTransport as Q, type NeetruEnv as R, type NeetruSqlClient as S, type NeetruUser as T, type NotificationScopeOptions as U, type NotificationsNamespace as V, type Product as W, type ProductNotification as X, type ProductNotificationSeverity as Y, type ProductPlan as Z, type ProductStatus as _, type AuthStateListener as a, type RegisterWebhookInput as a0, type ResolvedConfig as a1, type SendNotificationInput as a2, type ServerTimestampSentinel as a3, type SignInOptions as a4, type SqlOptions as a5, type SupportNamespace as a6, type SupportSeverity as a7, type SupportStatus as a8, type SupportTicket as a9, isIncrementSentinel as aA, isServerTimestampSentinel as aB, serverTimestamp as aC, verifyWebhookRequest as aD, verifyWebhookSignature as aE, type SyncState as aa, type TelemetryEventAck as ab, type TelemetryEventInput as ac, type TelemetryLogAck as ad, type TelemetryLogInput as ae, type Unsubscribe as af, type UsageEventInput as ag, type UsageNamespace as ah, type UsageQuota as ai, type VerifyTokenOptions as aj, type VerifyWebhookRequestOptions as ak, type VerifyWebhookRequestResult as al, type WebhookEndpoint as am, type WebhookEvent as an, type WebhookScopeOptions as ao, type WebhookTestResult as ap, type WebhooksNamespace as aq, type WithFieldSentinels as ar, createCheckoutNamespace as as, createNeetruDb as at, createNotificationsNamespace as au, createRestSyncTransport as av, createWebhooksNamespace as aw, getWebSocketRealtimeClient as ax, increment as ay, isFieldSentinel as az, type CatalogListResponse as b, type CheckoutIntentInfo as c, type CheckoutIntentStatus as d, type CheckoutNamespace as e, type CheckoutStartInput as f, type CheckoutStartResult as g, type CheckoutTenantType as h, type ConflictRecord as i, type CreateOfflineDocumentsOptions as j, type CreateTicketInput as k, type DbBatchOp as l, type DbChangeType as m, type DbCollectionRef$1 as n, type DbDoc as o, type DbDocRef as p, type DbGetResult as q, type DbListResult as r, type DbNamespace as s, type DbQuery$1 as t, type DbSqlLease as u, type DbWhereFilter as v, type DbWhereFilter$1 as w, MockNotifications as x, MockWebhooks as y, type NeetruClient as z };
+export { type ProductStatus as $, type AuthNamespace as A, type NeetruClient as B, type CatalogListOptions as C, DEFAULT_BASE_URL as D, type EntitlementCheck as E, type FieldSentinel as F, type NeetruClientConfig as G, type NeetruDb as H, type IncrementSentinel as I, type NeetruDbDocuments as J, type NeetruDbEngine as K, type ListNotificationsOptions as L, MockCheckout as M, NEETRU_SENTINEL_KEY as N, NeetruDbError as O, type NeetruDbErrorCode as P, type NeetruDbOptions as Q, type NeetruDbTransport as R, type NeetruEnv as S, type NeetruSqlClient as T, type NeetruUser as U, type NotificationScopeOptions as V, type NotificationsNamespace as W, type Product as X, type ProductNotification as Y, type ProductNotificationSeverity as Z, type ProductPlan as _, type AuthStateListener as a, type RealtimeTransport as a0, type RedirectCallbackResult as a1, type RegisterWebhookInput as a2, type ResolvedConfig as a3, type SendNotificationInput as a4, type ServerTimestampSentinel as a5, type SignInOptions as a6, type SqlOptions as a7, type SupportNamespace as a8, type SupportSeverity as a9, increment as aA, isFieldSentinel as aB, isIncrementSentinel as aC, isServerTimestampSentinel as aD, serverTimestamp as aE, verifyWebhookRequest as aF, verifyWebhookSignature as aG, type SupportStatus as aa, type SupportTicket as ab, type SyncState as ac, type TelemetryEventAck as ad, type TelemetryEventInput as ae, type TelemetryLogAck as af, type TelemetryLogInput as ag, type Unsubscribe as ah, type UsageEventInput as ai, type UsageNamespace as aj, type UsageQuota as ak, type VerifyTokenOptions as al, type VerifyWebhookRequestOptions as am, type VerifyWebhookRequestResult as an, type WebhookEndpoint as ao, type WebhookEvent as ap, type WebhookScopeOptions as aq, type WebhookTestResult as ar, type WebhooksNamespace as as, type WithFieldSentinels as at, createCheckoutNamespace as au, createNeetruDb as av, createNotificationsNamespace as aw, createRestSyncTransport as ax, createWebhooksNamespace as ay, getWebSocketRealtimeClient as az, type CatalogListResponse as b, type CheckoutAuthOpts as c, type CheckoutIntentInfo as d, type CheckoutIntentStatus as e, type CheckoutNamespace as f, type CheckoutStartInput as g, type CheckoutStartResult as h, type CheckoutTenantType as i, type ConflictRecord as j, type CreateOfflineDocumentsOptions as k, type CreateTicketInput as l, type DbBatchOp as m, type DbChangeType as n, type DbCollectionRef$1 as o, type DbDoc as p, type DbDocRef as q, type DbGetResult as r, type DbListResult as s, type DbNamespace as t, type DbQuery$1 as u, type DbSqlLease as v, type DbWhereFilter as w, type DbWhereFilter$1 as x, MockNotifications as y, MockWebhooks as z };

package/dist/usage.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/errors.ts","../src/idempotency.ts","../src/http.ts","../src/validators.ts","../src/usage.ts"],"names":["err","message"],"mappings":";;;AAwCO,IAAM,WAAA,GAAN,MAAM,YAAA,SAAoB,KAAA,CAAM;AAAA,EACrB,IAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EAEhB,WAAA,CACE,IAAA,EACA,OAAA,EACA,MAAA,EACA,SAAA,EACA;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,aAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAEjB,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,YAAA,CAAY,SAAS,CAAA;AAAA,EACnD;AACF,CAAA;;;ACzBO,SAAS,sBAAA,GAAiC;AAG/C,EAAA,MAAM,YACJ,OAAO,UAAA,KAAe,eAAe,QAAA,IAAY,UAAA,GAC5C,WAA0D,MAAA,GAC3D,MAAA;AACN,EAAA,IAAI,SAAA,IAAa,OAAO,SAAA,CAAU,UAAA,KAAe,UAAA,EAAY;AAC3D,IAAA,OAAO,UAAU,UAAA,EAAW;AAAA,EAC9B;AACA,EAAA,MAAM,IAAI,WAAA;AAAA,IACR,qBAAA;AAAA,IACA;AAAA,GACF;AACF;;;ACJA,IAAM,aAAA,GAAwC;AAAA;AAAA;AAAA,EAG5C,CAAA,EAAG;AACL,CAAA;AAGA,SAAS,cAAc,CAAA,EAAmB;AACxC,EAAA,OAAO,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,CAAA;AAC5B;AAMA,SAAS,aAAA,CAAc,GAAW,CAAA,EAAmB;AACnD,EAAA,MAAM,MAAA,GAAS,cAAc,CAAC,CAAA,CAAE,MAAM,GAAG,CAAA,CAAE,IAAI,MAAM,CAAA;AACrD,EAAA,MAAM,MAAA,GAAS,cAAc,CAAC,CAAA,CAAE,MAAM,GAAG,CAAA,CAAE,IAAI,MAAM,CAAA;AACrD,EAAA,MAAM,MAAM,IAAA,CAAK,GAAA,CAAI,MAAA,CAAO,MAAA,EAAQ,OAAO,MAAM,CAAA;AACjD,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,EAAK,CAAA,EAAA,EAAK;AAC5B,IAAA,MAAM,EAAA,GAAK,MAAA,CAAO,CAAC,CAAA,IAAK,CAAA;AACxB,IAAA,MAAM,EAAA,GAAK,MAAA,CAAO,CAAC,CAAA,IAAK,CAAA;AACxB,IAAA,IAAI,EAAA,KAAO,EAAA,EAAI,OAAO,EAAA,GAAK,EAAA;AAAA,EAC7B;AACA,EAAA,OAAO,CAAA;AACT;AAGA,SAAS,WAAA,GAAsB;AAC7B,EAAA,IAAI;AAIF,IAAA,MAAM,MAAO,UAAA,CAAmB,sBAAA;AAChC,IAAA,IAAI,GAAA,EAAK,OAAO,QAAA,CAAS,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,GAAA,EAAK,EAAE,CAAA;AAAA,EACvD,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,OAAO,CAAA;AACT;AAGA,IAAM,iBAAA,uBAAwB,GAAA,EAAY;AAMnC,SAAS,uBAAuB,WAAA,EAA2B;AAChE,EAAA,IAAI,CAAC,WAAA,EAAa;AAClB,EAAA,MAAM,WAAW,WAAA,EAAY;AAC7B,EAAA,MAAM,OAAA,GAAU,cAAc,QAAQ,CAAA;AACtC,EAAA,IAAI,CAAC,OAAA,EAAS;AACd,EAAA,MAAM,QAAA,GAAW,cAAc,WAAW,CAAA;AAC1C,EAAA,IAAI,aAAA,CAAc,QAAA,EAAU,OAAO,CAAA,GAAI,CAAA,EAAG;AACxC,IAAA,MAAM,GAAA,GAAM,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAA;AACnC,IAAA,IAAI,CAAC,iBAAA,CAAkB,GAAA,CAAI,GAAG,CAAA,EAAG;AAC/B,MAAA,iBAAA,CAAkB,IAAI,GAAG,CAAA;AACzB,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,4CAAA,EAAsC,WAAW,CAAA,0CAAA,EAC1C,OAAO,oBAAoB,QAAQ,CAAA,qGAAA;AAAA,OAE5C;AAAA,IACF;AAAA,EACF;AACF;AAsCA,IAAM,oBAAA,GAAuB,CAAA;AAC7B,IAAM,qBAAA,GAAwB,CAAA;AAC9B,IAAM,+BAAe,IAAI,GAAA,CAAI,CAAC,KAAA,EAAO,MAAM,CAAC,CAAA;AAC5C,IAAM,eAAA,uBAAsB,GAAA,CAAqB;AAAA,EAC/C,cAAA;AAAA,EACA,cAAA;AAAA,EACA;AACF,CAAC,CAAA;AAGD,SAAS,UAAU,OAAA,EAAyB;AAC1C,EAAA,MAAM,IAAA,GAAO,GAAA,GAAM,IAAA,CAAK,GAAA,CAAI,GAAG,OAAO,CAAA;AACtC,EAAA,MAAM,SAAS,IAAA,GAAO,GAAA,IAAO,IAAA,CAAK,MAAA,KAAW,CAAA,GAAI,CAAA,CAAA;AACjD,EAAA,OAAO,KAAK,GAAA,CAAI,EAAA,EAAI,KAAK,KAAA,CAAM,IAAA,GAAO,MAAM,CAAC,CAAA;AAC/C;AAUA,IAAM,kBAAA,GAAqB,GAAA;AAE3B,SAAS,gBAAgB,KAAA,EAAqC;AAC5D,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,MAAM,IAAA,GAAO,OAAO,KAAK,CAAA;AACzB,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,IAAI,CAAA,IAAK,QAAQ,CAAA,EAAG,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,KAAA,CAAM,IAAA,GAAO,GAAI,GAAG,kBAAkB,CAAA;AACnG,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,KAAK,CAAA;AAC/B,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,EAAG;AAC3B,IAAA,MAAM,KAAA,GAAQ,MAAA,GAAS,IAAA,CAAK,GAAA,EAAI;AAChC,IAAA,IAAI,QAAQ,CAAA,EAAG,OAAO,IAAA,CAAK,GAAA,CAAI,OAAO,kBAAkB,CAAA;AAAA,EAC1D;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,MAAM,EAAA,EAA2B;AACxC,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,EAAE,CAAC,CAAA;AACzD;AAGA,SAAS,aAAa,MAAA,EAAiC;AACrD,EAAA,IAAI,MAAA,KAAW,KAAK,OAAO,cAAA;AAC3B,EAAA,IAAI,MAAA,KAAW,KAAK,OAAO,WAAA;AAC3B,EAAA,IAAI,MAAA,KAAW,KAAK,OAAO,WAAA;AAC3B,EAAA,IAAI,MAAA,KAAW,KAAK,OAAO,UAAA;AAC3B,EAAA,IAAI,MAAA,KAAW,GAAA,IAAO,MAAA,KAAW,GAAA,EAAK,OAAO,mBAAA;AAC7C,EAAA,IAAI,MAAA,KAAW,KAAK,OAAO,cAAA;AAC3B,EAAA,IAAI,MAAA,IAAU,KAAK,OAAO,cAAA;AAC1B,EAAA,OAAO,SAAA;AACT;AAEA,SAAS,QAAA,CAAS,OAAA,EAAiB,IAAA,EAAc,KAAA,EAA6C;AAE5F,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AACvC,EAAA,MAAM,IAAI,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,GAAI,IAAA,GAAO,IAAI,IAAI,CAAA,CAAA;AAChD,EAAA,MAAM,MAAM,IAAI,GAAA,CAAI,GAAG,IAAI,CAAA,EAAG,CAAC,CAAA,CAAE,CAAA;AACjC,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC1C,MAAA,IAAI,MAAM,MAAA,EAAW;AACrB,MAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,CAAA,EAAG,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,IACnC;AAAA,EACF;AACA,EAAA,OAAO,IAAI,QAAA,EAAS;AACtB;AAGA,eAAe,SAAS,GAAA,EAAiC;AACvD,EAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,EAAA,IAAI,CAAC,MAAM,OAAO,MAAA;AAClB,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAQA,eAAsB,WAAA,CACpB,QACA,IAAA,EACY;AACZ,EAAA,MAAM,MAAA,GAAS,KAAK,MAAA,IAAU,KAAA;AAC9B,EAAA,MAAM,MAAM,QAAA,CAAS,MAAA,CAAO,SAAS,IAAA,CAAK,IAAA,EAAM,KAAK,KAAK,CAAA;AAE1D,EAAA,MAAM,cAAA,GAAiB,YAAA,CAAa,GAAA,CAAI,MAAM,IAC1C,oBAAA,GACA,qBAAA;AACJ,EAAA,MAAM,UAAA,GAAa,KAAK,OAAA,IAAW,cAAA;AAEnC,EAAA,MAAM,OAAA,GAAkC;AAAA,IACtC,MAAA,EAAQ,kBAAA;AAAA,IACR,GAAG,IAAA,CAAK;AAAA,GACV;AAEA,EAAA,IAAI,KAAK,WAAA,EAAa;AACpB,IAAA,IAAI,CAAC,OAAO,MAAA,EAAQ;AAClB,MAAA,MAAM,IAAI,WAAA;AAAA,QACR,iBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,MAAA,CAAO,MAAM,CAAA,CAAA;AAAA,EACjD;AAGA,EAAA,IAAI,KAAK,cAAA,EAAgB;AACvB,IAAA,MAAM,MACJ,OAAO,IAAA,CAAK,mBAAmB,QAAA,GAC3B,IAAA,CAAK,iBACL,sBAAA,EAAuB;AAC7B,IAAA,OAAA,CAAQ,iBAAiB,CAAA,GAAI,GAAA;AAAA,EAC/B;AAGA,EAAA,MAAM,UAAA,GACJ,IAAA,CAAK,IAAA,KAAS,MAAA,IAAa,MAAA,KAAW,KAAA,IAAS,MAAA,KAAW,QAAA,GACtD,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA,GACxB,MAAA;AACN,EAAA,IAAI,eAAe,MAAA,EAAW;AAC5B,IAAA,OAAA,CAAQ,cAAc,CAAA,GAAI,kBAAA;AAAA,EAC5B;AAEA,EAAA,IAAI,SAAA,GAAgC,IAAA;AAEpC,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,IAAW,UAAA,EAAY,OAAA,EAAA,EAAW;AACtD,IAAA,MAAM,IAAA,GAAoB,EAAE,MAAA,EAAQ,OAAA,EAAQ;AAC5C,IAAA,IAAI,UAAA,KAAe,MAAA,EAAW,IAAA,CAAK,IAAA,GAAO,UAAA;AAG1C,IAAA,IAAA,CAAK,MAAA,GAAS,WAAA,CAAY,OAAA,CAAQ,GAAM,CAAA;AAExC,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAM,MAAA,CAAO,KAAA,CAAM,GAAA,EAAK,IAAI,CAAA;AAAA,IACpC,SAASA,IAAAA,EAAK;AACZ,MAAA,MAAMC,QAAAA,GACJD,IAAAA,YAAe,YAAA,IAAgBA,IAAAA,CAAI,IAAA,KAAS,cAAA,GACxC,kCAAA,GACA,CAAA,eAAA,EAAkBA,IAAAA,YAAe,KAAA,GAAQA,IAAAA,CAAI,OAAA,GAAU,cAAc,CAAA,CAAA;AAC3E,MAAA,SAAA,GAAY,IAAI,WAAA,CAAY,eAAA,EAAiBC,QAAO,CAAA;AACpD,MAAA,IAAI,UAAU,UAAA,EAAY;AACxB,QAAA,MAAM,KAAA,CAAM,SAAA,CAAU,OAAO,CAAC,CAAA;AAC9B,QAAA;AAAA,MACF;AACA,MAAA,MAAM,SAAA;AAAA,IACR;AAEA,IAAA,MAAM,SAAA,GACJ,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,cAAc,KAAK,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,kBAAkB,CAAA,IAAK,MAAA;AAE5E,IAAA,IAAI,IAAI,EAAA,EAAI;AAEV,MAAA,MAAM,WAAA,GAAc,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,kBAAkB,CAAA;AACtD,MAAA,IAAI,WAAA,yBAAoC,WAAW,CAAA;AACnD,MAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,GAAG,CAAA;AACjC,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,GAAG,CAAA;AAGhC,IAAA,IAAI,IAAA,GAAe,YAAA,CAAa,GAAA,CAAI,MAAM,CAAA;AAC1C,IAAA,IAAI,OAAA,GAAU,CAAA,KAAA,EAAQ,GAAA,CAAI,MAAM,CAAA,CAAA;AAChC,IAAA,IAAI,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,IAAY,WAAW,IAAA,EAAM;AACvD,MAAA,MAAM,WAAW,IAAA,CAAK,KAAA;AACtB,MAAA,IAAI,OAAO,aAAa,QAAA,EAAU;AAChC,QAAA,OAAA,GAAU,QAAA;AAAA,MACZ,CAAA,MAAA,IAAW,QAAA,IAAY,OAAO,QAAA,KAAa,QAAA,EAAU;AACnD,QAAA,IAAI,OAAO,QAAA,CAAS,IAAA,KAAS,QAAA,SAAiB,QAAA,CAAS,IAAA;AACvD,QAAA,IAAI,OAAO,QAAA,CAAS,OAAA,KAAY,QAAA,YAAoB,QAAA,CAAS,OAAA;AAAA,MAC/D;AAAA,IACF;AACA,IAAA,MAAM,MAAM,IAAI,WAAA,CAAY,MAAM,OAAA,EAAS,GAAA,CAAI,QAAQ,SAAS,CAAA;AAChE,IAAA,SAAA,GAAY,GAAA;AAEZ,IAAA,MAAM,WAAA,GAAc,eAAA,CAAgB,GAAA,CAAI,IAAuB,CAAA;AAC/D,IAAA,IAAI,WAAA,IAAe,UAAU,UAAA,EAAY;AACvC,MAAA,MAAM,aAAa,eAAA,CAAgB,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAC,CAAA;AACjE,MAAA,MAAM,KAAA,GAAQ,UAAA,IAAc,SAAA,CAAU,OAAO,CAAA;AAC7C,MAAA,MAAM,MAAM,KAAK,CAAA;AACjB,MAAA;AAAA,IACF;AACA,IAAA,MAAM,GAAA;AAAA,EACR;AAGA,EAAA,MAAM,SAAA,IAAa,IAAI,WAAA,CAAY,SAAA,EAAW,6BAA6B,CAAA;AAC7E;;;ACtUO,IAAM,SAAA,GAAY,4BAAA;AAYlB,SAAS,gBAAA,CAAiB,OAAe,KAAA,EAAqB;AACnE,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,SAAA,CAAU,IAAA,CAAK,KAAK,CAAA,EAAG;AACvD,IAAA,MAAM,IAAI,WAAA;AAAA,MACR,mBAAA;AAAA,MACA,CAAA,EAAG,KAAK,CAAA,YAAA,EAAe,SAAA,CAAU,MAAM,CAAA,8EAAA;AAAA,KACzC;AAAA,EACF;AACF;;;ACNO,SAAS,qBAAqB,MAAA,EAAwC;AAC3E,EAAA,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAaL,MAAM,MAAA,CACJ,QAAA,EACA,GAAA,GAAc,GACd,OAAA,EACA;AACA,MAAA,IAAI,CAAC,QAAA,IAAY,OAAO,QAAA,KAAa,QAAA,EAAU;AAC7C,QAAA,MAAM,IAAI,WAAA,CAAY,mBAAA,EAAqB,sBAAsB,CAAA;AAAA,MACnE;AACA,MAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,GAAG,CAAA,IAAK,OAAO,CAAA,EAAG;AACrC,QAAA,MAAM,IAAI,WAAA,CAAY,mBAAA,EAAqB,8BAA8B,CAAA;AAAA,MAC3E;AACA,MAAA,MAAM,SAAA,GAAY,OAAA,EAAS,SAAA,IAAa,MAAA,CAAO,SAAA;AAC/C,MAAA,MAAM,QAAA,GAAW,OAAA,EAAS,QAAA,IAAY,MAAA,CAAO,QAAA;AAC7C,MAAA,IAAI,CAAC,SAAA,EAAW;AACd,QAAA,MAAM,IAAI,WAAA;AAAA,UACR,mBAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA,IAAI,CAAC,QAAA,EAAU;AACb,QAAA,MAAM,IAAI,WAAA;AAAA,UACR,mBAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AAEA,MAAA,gBAAA,CAAiB,aAAa,SAAS,CAAA;AACvC,MAAA,gBAAA,CAAiB,YAAY,QAAQ,CAAA;AAErC,MAAA,MAAM,GAAA,GAAM,MAAM,WAAA,CAOf,MAAA,EAAQ;AAAA,QACT,MAAA,EAAQ,MAAA;AAAA,QACR,IAAA,EAAM,0BAAA;AAAA,QACN,IAAA,EAAM,EAAE,SAAA,EAAW,QAAA,EAAU,UAAU,GAAA,EAAK,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA,EAAE;AAAA,QAC5D,WAAA,EAAa,IAAA;AAAA,QACb,cAAA,EAAgB;AAAA,OACjB,CAAA;AACD,MAAA,IAAI,CAAC,GAAA,IAAO,GAAA,CAAI,EAAA,KAAO,IAAA,EAAM;AAC3B,QAAA,MAAM,IAAI,WAAA,CAAY,kBAAA,EAAoB,kCAAkC,CAAA;AAAA,MAC9E;AACA,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,IAAA;AAAA,QACJ,WAAW,GAAA,CAAI,SAAA;AAAA,QACf,OAAO,GAAA,CAAI,KAAA;AAAA,QACX,OAAO,GAAA,CAAI,KAAA;AAAA,QACX,WAAW,GAAA,CAAI,SAAA;AAAA,QACf,QAAQ,GAAA,CAAI;AAAA,OACd;AAAA,IACF,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQA,MAAM,KAAA,CACJ,QAAA,EACA,OAAA,EACA;AACA,MAAA,IAAI,CAAC,QAAA,IAAY,OAAO,QAAA,KAAa,QAAA,EAAU;AAC7C,QAAA,MAAM,IAAI,WAAA,CAAY,mBAAA,EAAqB,sBAAsB,CAAA;AAAA,MACnE;AACA,MAAA,MAAM,SAAA,GAAY,OAAA,EAAS,SAAA,IAAa,MAAA,CAAO,SAAA;AAC/C,MAAA,MAAM,QAAA,GAAW,OAAA,EAAS,QAAA,IAAY,MAAA,CAAO,QAAA;AAC7C,MAAA,IAAI,CAAC,SAAA,IAAa,CAAC,QAAA,EAAU;AAC3B,QAAA,MAAM,IAAI,WAAA;AAAA,UACR,mBAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AAEA,MAAA,gBAAA,CAAiB,aAAa,SAAS,CAAA;AACvC,MAAA,gBAAA,CAAiB,YAAY,QAAQ,CAAA;AAErC,MAAA,MAAM,GAAA,GAAM,MAAM,WAAA,CAQf,MAAA,EAAQ;AAAA,QACT,MAAA,EAAQ,KAAA;AAAA,QACR,IAAA,EAAM,0BAAA;AAAA,QACN,KAAA,EAAO,EAAE,SAAA,EAAW,QAAA,EAAU,SAAS,QAAA,EAAS;AAAA,QAChD,WAAA,EAAa;AAAA,OACd,CAAA;AACD,MAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,CAAI,YAAY,SAAA,EAAW;AAC5C,QAAA,MAAM,IAAI,WAAA,CAAY,kBAAA,EAAoB,sCAAsC,CAAA;AAAA,MAClF;AAGA,MAAA,MAAM,WACJ,GAAA,CAAI,QAAA,KAAa,GAAA,CAAI,MAAA,KAAW,mBAAmB,UAAA,GAAa,IAAA,CAAA;AAClE,MAAA,OAAO;AAAA,QACL,SAAS,GAAA,CAAI,OAAA;AAAA,QACb,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,WAAW,GAAA,CAAI,SAAA;AAAA,QACf,OAAO,GAAA,CAAI,KAAA;AAAA,QACX,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,cAAc,GAAA,CAAI,YAAA;AAAA,QAClB;AAAA,OACF;AAAA,IACF;AAAA,GACF;AACF","file":"usage.cjs","sourcesContent":["/**\r\n * Erros tipados do SDK.\r\n *\r\n * Todo erro lançado pelo SDK estende `NeetruError` — caller pode discriminar\r\n * por `.code` (string estável) sem parsing de message.\r\n */\r\n\r\n/** Códigos de erro estáveis do SDK. Adicionar aqui requer minor bump. */\r\nexport type NeetruErrorCode =\r\n  | 'invalid_config'\r\n  | 'missing_api_key'\r\n  | 'unauthorized'\r\n  | 'forbidden'\r\n  | 'not_found'\r\n  | 'rate_limited'\r\n  | 'validation_failed'\r\n  | 'network_error'\r\n  | 'invalid_response'\r\n  | 'server_error'\r\n  | 'token_expired'\r\n  | 'token_invalid_signature'\r\n  | 'token_invalid_audience'\r\n  | 'token_invalid_issuer'\r\n  /** 3.0: runtime não expõe API necessária (ex: WebCrypto ausente). */\r\n  | 'runtime_unsupported'\r\n  /** HTTP 409 — colisão de idempotência ou conflito de recurso. */\r\n  | 'conflict'\r\n  | 'unknown';\r\n\r\n/**\r\n * Erro tipado padrão do SDK. Sempre lançado em vez de Error genérico.\r\n *\r\n * @example\r\n * ```ts\r\n * try { await client.catalog.list(); }\r\n * catch (e) {\r\n *   if (e instanceof NeetruError && e.code === 'rate_limited') retry();\r\n * }\r\n * ```\r\n */\r\nexport class NeetruError extends Error {\r\n  public readonly code: NeetruErrorCode | string;\r\n  public readonly status?: number;\r\n  public readonly requestId?: string;\r\n\r\n  constructor(\r\n    code: NeetruErrorCode | string,\r\n    message: string,\r\n    status?: number,\r\n    requestId?: string,\r\n  ) {\r\n    super(message);\r\n    this.name = 'NeetruError';\r\n    this.code = code;\r\n    this.status = status;\r\n    this.requestId = requestId;\r\n    // Preserva o prototype chain ao herdar de Error (downlevel quirk de TS).\r\n    Object.setPrototypeOf(this, NeetruError.prototype);\r\n  }\r\n}\r\n","/**\n * Idempotency-Key helper — gera UUID v4 cripto-seguro para identificar\n * mutations não-idempotentes (`usage.report`, `support.createTicket`,\n * `notifications.send`, `webhooks.test`).\n *\n * Estratégia 3.0:\n *   - SDK gera UUID v4 por chamada via `randomUUID()` (WebCrypto.subtle não\n *     necessário aqui — `crypto.randomUUID()` está em Node 14.17+ e em todos\n *     os browsers/Edge runtimes modernos).\n *   - Header `Idempotency-Key: <uuid>` é injetado pelo `httpRequest` quando\n *     `opts.idempotencyKey === true` OU caller passa explicit `opts.idempotencyKeyValue`.\n *   - Core dedup em coleção `usage_idempotency_keys/{key}` TTL 24h (vide\n *     `docs/CORE_CHANGES_REQUIRED.md` §2). Se Core ainda não dedupa, o header\n *     é benign (ignorado).\n *\n * Defesa em camadas: combinado com `retries: 0` em POSTs (vide http.ts), o\n * risco de double-write em transientes vai pra zero.\n */\nimport { NeetruError } from './errors';\n\n/**\n * Gera UUID v4 criptograficamente seguro. Universal: Node 14.17+, browsers\n * modernos, Edge runtimes (Workers/Vercel Edge/Cloudflare).\n *\n * Fallback puro-JS removido em 3.0 — `crypto.randomUUID()` é ubíquo desde\n * 2022. Se runtime não tem, lança `NeetruError('runtime_unsupported')`\n * (consumer deve polyfillar).\n *\n * **L-01 fix (Opus review 2026-05-27):** antes lançava `Error` cru, que\n * não era pego por `catch (err) { if (err instanceof NeetruError) ... }`\n * dos consumers. Agora throw canonical.\n *\n * @throws NeetruError('runtime_unsupported') se `crypto.randomUUID` não disponível.\n */\nexport function generateIdempotencyKey(): string {\n  // WebCrypto (browser/Edge) e Node 14.17+ expõem `crypto.randomUUID()`.\n  // Node anterior precisa de `node:crypto` mas SDK 3.0 exige Node ≥20 (vide engines).\n  const cryptoObj: { randomUUID?: () => string } | undefined =\n    typeof globalThis !== 'undefined' && 'crypto' in globalThis\n      ? (globalThis as { crypto?: { randomUUID?: () => string } }).crypto\n      : undefined;\n  if (cryptoObj && typeof cryptoObj.randomUUID === 'function') {\n    return cryptoObj.randomUUID();\n  }\n  throw new NeetruError(\n    'runtime_unsupported',\n    'crypto.randomUUID not available in this runtime. SDK 3.0 requires Node ≥20 or modern browser/Edge.',\n  );\n}\n\n/** Regex UUID v4 — validação para uso interno. */\nexport const UUID_V4_RE =\n  /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;\n","/**\r\n * HTTP transport interno do SDK.\r\n *\r\n * Responsabilidades:\r\n *   - Construir URL absoluta a partir de `baseUrl` + path\r\n *   - Injetar Bearer token quando `requireAuth=true`\r\n *   - Mapear status HTTP → `NeetruError` com `code` estável\r\n *   - Parse defensivo de JSON (não lança em body vazio em 204)\r\n *   - Retry/backoff exponencial em `rate_limited` (429), `server_error` (5xx)\r\n *     e `network_error` (timeout/falha de rede). Honra `Retry-After` quando\r\n *     presente.\r\n *   - **Captura `X-Neetru-Version`** das respostas e emite `console.warn` quando\r\n *     o Core está abaixo da versão mínima para a major do SDK.\r\n *\r\n * Política de retries (mudança breaking 3.0):\r\n *   - GET/HEAD: default 2 retries (3 tentativas total) — idempotente, seguro.\r\n *   - POST/PUT/PATCH/DELETE: default **0 retries** — mutations podem duplicar\r\n *     side effects (ex: `usage.report` incrementa contador). Caller pode\r\n *     reativar passando `retries: N` explicitamente ou usar `Idempotency-Key`\r\n *     header (gerado automaticamente se `opts.idempotencyKey=true`).\r\n *\r\n * Idempotency-Key (3.0):\r\n *   - `opts.idempotencyKey === true` → SDK gera UUID v4 e injeta header.\r\n *   - `opts.idempotencyKey === 'uuid-string'` → usa o valor passado.\r\n *   - Caller mantém retentos client-side se quiser; Core dedup serverside\r\n *     (vide `docs/CORE_CHANGES_REQUIRED.md` §2).\r\n */\r\nimport { NeetruError, type NeetruErrorCode } from './errors';\r\nimport { generateIdempotencyKey } from './idempotency';\r\nimport type { ResolvedConfig } from './types';\r\n\r\n// ─── Compat Matrix SDK↔Core ──────────────────────────────────────────────────\r\n\r\n/**\r\n * Matriz de compatibilidade SDK major → versão mínima do Core.\r\n *\r\n * Formato do Core: CalVer `YYYY.MM.patch+revision` (ex: `2026.05.1+neetru-core-00096-79t`).\r\n * A comparação é feita apenas nas partes `YYYY.MM.patch` (prefixo antes de `+`).\r\n *\r\n * Quando o Core reporta `X-Neetru-Version` abaixo do mínimo para a SDK major\r\n * corrente, o SDK emite `console.warn` uma única vez por sessão de processo.\r\n *\r\n * Atualize esta tabela a cada major de SDK.\r\n */\r\nconst COMPAT_MATRIX: Record<number, string> = {\r\n  // SDK major 3.x requer Core ≥ 2026.05.1 (suporte a X-Neetru-Version header,\r\n  // runTransaction write-after-read, verifyWebhookRequest, webhooks 3.0+)\r\n  3: '2026.05.1',\r\n};\r\n\r\n/** CalVer sem sufixo `+revision`. Ex: `2026.05.1+abc` → `2026.05.1`. */\r\nfunction stripRevision(v: string): string {\r\n  return v.split('+')[0] ?? v;\r\n}\r\n\r\n/**\r\n * Compara dois CalVer (`YYYY.MM.patch`). Retorna negativo se `a < b`,\r\n * positivo se `a > b`, 0 se iguais. Partes não numéricas tratadas como 0.\r\n */\r\nfunction compareCalVer(a: string, b: string): number {\r\n  const partsA = stripRevision(a).split('.').map(Number);\r\n  const partsB = stripRevision(b).split('.').map(Number);\r\n  const len = Math.max(partsA.length, partsB.length);\r\n  for (let i = 0; i < len; i++) {\r\n    const pa = partsA[i] ?? 0;\r\n    const pb = partsB[i] ?? 0;\r\n    if (pa !== pb) return pa - pb;\r\n  }\r\n  return 0;\r\n}\r\n\r\n/** Lê a SDK major a partir da string `VERSION` exportada de `./index`. Fallback 3. */\r\nfunction getSdkMajor(): number {\r\n  try {\r\n    // Importação estática não disponível aqui (evita ciclo). Usa variável injetada\r\n    // em tempo de build pela tsup via `define`. Fallback para 3 (current major).\r\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\r\n    const ver = (globalThis as any).__NEETRU_SDK_VERSION__ as string | undefined;\r\n    if (ver) return parseInt(ver.split('.')[0] ?? '3', 10);\r\n  } catch {\r\n    // ignore\r\n  }\r\n  return 3;\r\n}\r\n\r\n/** Aviso emitido no máximo uma vez por major detectada pra não spammar logs. */\r\nconst _warnedCoreTooOld = new Set<string>();\r\n\r\n/**\r\n * Verifica se a versão do Core (`X-Neetru-Version`) é compatível com a SDK major.\r\n * Emite `console.warn` quando incompatível (uma vez por processo por versão detectada).\r\n */\r\nexport function checkCoreVersionCompat(coreVersion: string): void {\r\n  if (!coreVersion) return;\r\n  const sdkMajor = getSdkMajor();\r\n  const minCore = COMPAT_MATRIX[sdkMajor];\r\n  if (!minCore) return; // sem restrição para esta major\r\n  const stripped = stripRevision(coreVersion);\r\n  if (compareCalVer(stripped, minCore) < 0) {\r\n    const key = `${sdkMajor}:${stripped}`;\r\n    if (!_warnedCoreTooOld.has(key)) {\r\n      _warnedCoreTooOld.add(key);\r\n      console.warn(\r\n        `[Neetru SDK] Atenção: Core versão \"${coreVersion}\" é anterior ao mínimo recomendado` +\r\n          ` \"${minCore}\" para SDK major ${sdkMajor}. Alguns recursos podem não funcionar` +\r\n          ` corretamente. Atualize o Core para a versão mais recente.`,\r\n      );\r\n    }\r\n  }\r\n}\r\n\r\n/** Opções da request HTTP. */\r\nexport interface HttpRequestOptions {\r\n  method?: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';\r\n  /** Path relativo (ex: `/api/v1/cli/catalog`). Concatenado a `baseUrl`. */\r\n  path: string;\r\n  /** Query string params (chave → valor primitivo). Valores `undefined` ignorados. */\r\n  query?: Record<string, string | number | boolean | undefined>;\r\n  /** Body JSON-serializável. Ignorado em GET/DELETE. */\r\n  body?: unknown;\r\n  /**\r\n   * Se true, injeta `Authorization: Bearer <apiKey>`. Lança `missing_api_key`\r\n   * se config.apiKey ausente. Default false.\r\n   */\r\n  requireAuth?: boolean;\r\n  /** Cabeçalhos extras. */\r\n  headers?: Record<string, string>;\r\n  /**\r\n   * Número de retries em códigos transientes (`rate_limited`, `server_error`,\r\n   * `network_error`).\r\n   *\r\n   * Default (3.0):\r\n   *   - GET/HEAD: 2 (= 3 tentativas total) — idempotente, seguro.\r\n   *   - POST/PUT/PATCH/DELETE: 0 — mutations podem duplicar side effects.\r\n   *\r\n   * Caller pode reativar passando explicitamente: `retries: 2`.\r\n   */\r\n  retries?: number;\r\n  /**\r\n   * Injeta `Idempotency-Key` header pra dedup serverside (3.0):\r\n   *   - `true` → SDK gera UUID v4 cripto-seguro automaticamente.\r\n   *   - string → usa o valor passado (deve ser UUID v4).\r\n   *   - `undefined`/`false` → sem header.\r\n   */\r\n  idempotencyKey?: boolean | string;\r\n}\r\n\r\nconst DEFAULT_RETRIES_READ = 2;\r\nconst DEFAULT_RETRIES_WRITE = 0;\r\nconst READ_METHODS = new Set(['GET', 'HEAD']);\r\nconst RETRYABLE_CODES = new Set<NeetruErrorCode>([\r\n  'rate_limited',\r\n  'server_error',\r\n  'network_error',\r\n]);\r\n\r\n/** Backoff exponencial com jitter ±20%. attempt: 0=primeira, 1=primeiro retry, ... */\r\nfunction backoffMs(attempt: number): number {\r\n  const base = 200 * Math.pow(4, attempt); // 200ms, 800ms, 3.2s, ...\r\n  const jitter = base * 0.2 * (Math.random() * 2 - 1);\r\n  return Math.max(50, Math.round(base + jitter));\r\n}\r\n\r\n/**\r\n * Honra `Retry-After` header (segundos ou HTTP-date). Retorna ms ou null se\r\n * inválido. RFC 9110 §10.2.3.\r\n *\r\n * Bug fix: sem teto, um servidor hostil/mal-configurado poderia retornar\r\n * `Retry-After: 86400` (24h) ou uma HTTP-date anos no futuro, pendurando o\r\n * processo indefinidamente. Aplica teto de MAX_RETRY_AFTER_MS em ambos os caminhos.\r\n */\r\nconst MAX_RETRY_AFTER_MS = 60_000; // 60s — teto razoável para retry automático\r\n\r\nfunction parseRetryAfter(value: string | null): number | null {\r\n  if (!value) return null;\r\n  const secs = Number(value);\r\n  if (Number.isFinite(secs) && secs >= 0) return Math.min(Math.round(secs * 1000), MAX_RETRY_AFTER_MS);\r\n  const dateMs = Date.parse(value);\r\n  if (Number.isFinite(dateMs)) {\r\n    const delta = dateMs - Date.now();\r\n    if (delta > 0) return Math.min(delta, MAX_RETRY_AFTER_MS);\r\n  }\r\n  return null;\r\n}\r\n\r\nfunction sleep(ms: number): Promise<void> {\r\n  return new Promise((resolve) => setTimeout(resolve, ms));\r\n}\r\n\r\n/** Mapeamento status → code estável do NeetruError. */\r\nfunction statusToCode(status: number): NeetruErrorCode {\r\n  if (status === 401) return 'unauthorized';\r\n  if (status === 403) return 'forbidden';\r\n  if (status === 404) return 'not_found';\r\n  if (status === 409) return 'conflict'; // Bug fix: 409 vira 'conflict' (não 'unknown')\r\n  if (status === 422 || status === 400) return 'validation_failed';\r\n  if (status === 429) return 'rate_limited';\r\n  if (status >= 500) return 'server_error';\r\n  return 'unknown';\r\n}\r\n\r\nfunction buildUrl(baseUrl: string, path: string, query?: HttpRequestOptions['query']): string {\r\n  // Trim trailing slash em base e leading em path pra evitar `//`.\r\n  const base = baseUrl.replace(/\\/+$/, '');\r\n  const p = path.startsWith('/') ? path : `/${path}`;\r\n  const url = new URL(`${base}${p}`);\r\n  if (query) {\r\n    for (const [k, v] of Object.entries(query)) {\r\n      if (v === undefined) continue;\r\n      url.searchParams.set(k, String(v));\r\n    }\r\n  }\r\n  return url.toString();\r\n}\r\n\r\n/** Parse JSON defensivo — retorna `undefined` em body vazio. */\r\nasync function safeJson(res: Response): Promise<unknown> {\r\n  const text = await res.text();\r\n  if (!text) return undefined;\r\n  try {\r\n    return JSON.parse(text);\r\n  } catch {\r\n    return undefined;\r\n  }\r\n}\r\n\r\n/**\r\n * Executa request HTTP. Em sucesso retorna body parseado; em erro lança\r\n * `NeetruError` com `code` derivado do status. Aplica retry/backoff\r\n * automático em códigos transientes (rate_limited/server_error/network_error)\r\n * conforme `opts.retries` (default 2 = 3 tentativas).\r\n */\r\nexport async function httpRequest<T>(\r\n  config: ResolvedConfig,\r\n  opts: HttpRequestOptions,\r\n): Promise<T> {\r\n  const method = opts.method ?? 'GET';\r\n  const url = buildUrl(config.baseUrl, opts.path, opts.query);\r\n  // Default por método: reads tentam 2x, writes 0x. Caller override sempre vence.\r\n  const defaultRetries = READ_METHODS.has(method)\r\n    ? DEFAULT_RETRIES_READ\r\n    : DEFAULT_RETRIES_WRITE;\r\n  const maxRetries = opts.retries ?? defaultRetries;\r\n\r\n  const headers: Record<string, string> = {\r\n    accept: 'application/json',\r\n    ...opts.headers,\r\n  };\r\n\r\n  if (opts.requireAuth) {\r\n    if (!config.apiKey) {\r\n      throw new NeetruError(\r\n        'missing_api_key',\r\n        'This operation requires an apiKey. Pass it to createNeetruClient({ apiKey }) or set NEETRU_API_KEY env var.',\r\n      );\r\n    }\r\n    headers.authorization = `Bearer ${config.apiKey}`;\r\n  }\r\n\r\n  // Idempotency-Key: gerado por chamada se solicitado. UUID v4 cripto-seguro.\r\n  if (opts.idempotencyKey) {\r\n    const key =\r\n      typeof opts.idempotencyKey === 'string'\r\n        ? opts.idempotencyKey\r\n        : generateIdempotencyKey();\r\n    headers['idempotency-key'] = key;\r\n  }\r\n\r\n  // Body só é serializado uma vez — reusado entre tentativas.\r\n  const bodyString =\r\n    opts.body !== undefined && method !== 'GET' && method !== 'DELETE'\r\n      ? JSON.stringify(opts.body)\r\n      : undefined;\r\n  if (bodyString !== undefined) {\r\n    headers['content-type'] = 'application/json';\r\n  }\r\n\r\n  let lastError: NeetruError | null = null;\r\n\r\n  for (let attempt = 0; attempt <= maxRetries; attempt++) {\r\n    const init: RequestInit = { method, headers };\r\n    if (bodyString !== undefined) init.body = bodyString;\r\n    // BUG-020 fix (2026-05-13): timeout default 30s. AbortSignal.timeout\r\n    // requer Node 18+ ou browsers recentes.\r\n    init.signal = AbortSignal.timeout(30_000);\r\n\r\n    let res: Response;\r\n    try {\r\n      res = await config.fetch(url, init);\r\n    } catch (err) {\r\n      const message =\r\n        err instanceof DOMException && err.name === 'TimeoutError'\r\n          ? 'Network error: timeout after 30s'\r\n          : `Network error: ${err instanceof Error ? err.message : 'fetch failed'}`;\r\n      lastError = new NeetruError('network_error', message);\r\n      if (attempt < maxRetries) {\r\n        await sleep(backoffMs(attempt));\r\n        continue;\r\n      }\r\n      throw lastError;\r\n    }\r\n\r\n    const requestId =\r\n      res.headers.get('x-request-id') ?? res.headers.get('x-correlation-id') ?? undefined;\r\n\r\n    if (res.ok) {\r\n      // Captura X-Neetru-Version e verifica compat com a SDK major.\r\n      const coreVersion = res.headers.get('x-neetru-version');\r\n      if (coreVersion) checkCoreVersionCompat(coreVersion);\r\n      const parsed = await safeJson(res);\r\n      return parsed as T;\r\n    }\r\n\r\n    const body = (await safeJson(res)) as\r\n      | { error?: { code?: string; message?: string } | string }\r\n      | undefined;\r\n    let code: string = statusToCode(res.status);\r\n    let message = `HTTP ${res.status}`;\r\n    if (body && typeof body === 'object' && 'error' in body) {\r\n      const errField = body.error;\r\n      if (typeof errField === 'string') {\r\n        message = errField;\r\n      } else if (errField && typeof errField === 'object') {\r\n        if (typeof errField.code === 'string') code = errField.code;\r\n        if (typeof errField.message === 'string') message = errField.message;\r\n      }\r\n    }\r\n    const err = new NeetruError(code, message, res.status, requestId);\r\n    lastError = err;\r\n\r\n    const isRetryable = RETRYABLE_CODES.has(code as NeetruErrorCode);\r\n    if (isRetryable && attempt < maxRetries) {\r\n      const retryAfter = parseRetryAfter(res.headers.get('retry-after'));\r\n      const delay = retryAfter ?? backoffMs(attempt);\r\n      await sleep(delay);\r\n      continue;\r\n    }\r\n    throw err;\r\n  }\r\n\r\n  // Unreachable — loop sempre retorna ou lança. Safety net.\r\n  throw lastError ?? new NeetruError('unknown', 'unexpected httpRequest exit');\r\n}\r\n","/**\n * Validators centralizados pra inputs do SDK que precisam casar com\n * regex do Core.\n *\n * **M-03 fix (Opus review 2026-05-27):** o Core rejeita productId que\n * não bate `/^[a-z0-9][a-z0-9_-]{0,62}$/` com 400 `validation_failed`.\n * O SDK não pré-validava — consumer recebia erro só em runtime de\n * produção, depois do round-trip de rede. Agora SDK throws localmente\n * antes do fetch.\n */\nimport { NeetruError } from './errors';\n\n/**\n * Regex canonical de IDs no Neetru Core (productId, tenantId, etc).\n * Espelha `SDK_ID_RE` em `neetru_core/src/lib/schemas/sdk.ts`.\n */\nexport const SDK_ID_RE = /^[a-z0-9][a-z0-9_-]{0,62}$/;\n\n/**\n * Throws `NeetruError('validation_failed')` se `value` não bater no\n * formato canonical.\n *\n * @example\n * ```ts\n * assertValidSdkId('productId', 'gestovendas');  // ok\n * assertValidSdkId('productId', 'GestoVendas');  // throws\n * ```\n */\nexport function assertValidSdkId(field: string, value: string): void {\n  if (typeof value !== 'string' || !SDK_ID_RE.test(value)) {\n    throw new NeetruError(\n      'validation_failed',\n      `${field} must match ${SDK_ID_RE.source} (lowercase alphanumeric, _, -; first char must be alphanumeric; max 63 chars)`,\n    );\n  }\n}\n","/**\n * Usage namespace — meterar consumo e verificar entitlements (3.0 — breaking).\n *\n * **Mudanças 3.0:**\n *   - Paths canônicos `/api/sdk/v1/*` (eram `/sdk/v1/*` errados).\n *   - `track(event, props)` **REMOVIDO** — Core não aceita esse shape; era\n *     vaporware testado contra mock fetch. Use `report(resource, qty, opts)`.\n *   - `getQuota(metric)` **REMOVIDO** — endpoint `/usage/quota` nunca existiu\n *     no Core. `report()` já devolve `{value, limit, remaining}` em todo POST.\n *   - `report()` e `check()` **agora exigem** `productId` + `tenantId`\n *     (no contexto do client OU passados nas options).\n *   - `report()` envia `Idempotency-Key` automaticamente (anti dup de\n *     incremento em retry transient — Core dedup TTL 24h).\n *\n * Endpoints consumidos:\n *   - `POST /api/sdk/v1/usage/record` — `{productId, tenantId, resource, qty}`.\n *     Incrementa `usage_counters/{tenantId}_{productId}_{resource}_{yyyymm}.value`.\n *   - `GET  /api/sdk/v1/entitlements?productId&tenantId&feature` — read-only\n *     check de plano + remaining (cache HTTP 60s).\n *\n * Comportamento por env:\n *   - `dev` → MockUsage (in-memory, retornado pelo factory).\n *   - `workspace`/`prod` → HTTP real.\n */\nimport { NeetruError } from './errors';\nimport { httpRequest } from './http';\nimport { assertValidSdkId } from './validators';\nimport type { ResolvedConfig, UsageNamespace } from './types';\n\nexport function createUsageNamespace(config: ResolvedConfig): UsageNamespace {\n  return {\n    /**\n     * Reporta consumo metered de um resource. Hit no endpoint canônico\n     * `POST /api/sdk/v1/usage/record`. Idempotency-Key gerado por chamada;\n     * Core dedup serverside TTL 24h.\n     *\n     * @example\n     * ```ts\n     * await client.usage.report('api_call', 1);\n     * // ou explicit:\n     * await client.usage.report('api_call', 5, { productId: 'gestovendas', tenantId: 't-acme' });\n     * ```\n     */\n    async report(\n      resource: string,\n      qty: number = 1,\n      options?: { productId?: string; tenantId?: string },\n    ) {\n      if (!resource || typeof resource !== 'string') {\n        throw new NeetruError('validation_failed', 'resource is required');\n      }\n      if (!Number.isFinite(qty) || qty <= 0) {\n        throw new NeetruError('validation_failed', 'qty must be positive integer');\n      }\n      const productId = options?.productId ?? config.productId;\n      const tenantId = options?.tenantId ?? config.tenantId;\n      if (!productId) {\n        throw new NeetruError(\n          'validation_failed',\n          'productId required (pass to options or set on createNeetruClient)',\n        );\n      }\n      if (!tenantId) {\n        throw new NeetruError(\n          'validation_failed',\n          'tenantId required (pass to options or set on createNeetruClient)',\n        );\n      }\n      // M-03: valida formato canonical (case-insensitive Core já rejeitaria com 400).\n      assertValidSdkId('productId', productId);\n      assertValidSdkId('tenantId', tenantId);\n\n      const raw = await httpRequest<{\n        ok?: boolean;\n        counterId?: string;\n        value?: number;\n        limit?: number;\n        remaining?: number;\n        status?: string;\n      }>(config, {\n        method: 'POST',\n        path: '/api/sdk/v1/usage/record',\n        body: { productId, tenantId, resource, qty: Math.floor(qty) },\n        requireAuth: true,\n        idempotencyKey: true,\n      });\n      if (!raw || raw.ok !== true) {\n        throw new NeetruError('invalid_response', 'usage.report response missing ok');\n      }\n      return {\n        ok: true as const,\n        counterId: raw.counterId,\n        value: raw.value,\n        limit: raw.limit,\n        remaining: raw.remaining,\n        status: raw.status,\n      };\n    },\n\n    /**\n     * Verifica entitlement de um resource via `GET /api/sdk/v1/entitlements`.\n     * Resposta inclui `allowed`, `reason` ('granted' | 'not_subscribed' |\n     * 'subscription_inactive' | 'feature_not_in_plan' | 'limit_exceeded'),\n     * `remaining`, `limit`, `planId`, `planFeatures`.\n     */\n    async check(\n      resource: string,\n      options?: { productId?: string; tenantId?: string },\n    ) {\n      if (!resource || typeof resource !== 'string') {\n        throw new NeetruError('validation_failed', 'resource is required');\n      }\n      const productId = options?.productId ?? config.productId;\n      const tenantId = options?.tenantId ?? config.tenantId;\n      if (!productId || !tenantId) {\n        throw new NeetruError(\n          'validation_failed',\n          'productId and tenantId required (pass to options or set on createNeetruClient)',\n        );\n      }\n      // M-03: valida formato canonical antes do fetch.\n      assertValidSdkId('productId', productId);\n      assertValidSdkId('tenantId', tenantId);\n\n      const raw = await httpRequest<{\n        allowed?: boolean;\n        reason?: string;\n        remaining?: number;\n        limit?: number;\n        planId?: string | null;\n        planFeatures?: string[];\n        behavior?: 'readonly' | null;\n      }>(config, {\n        method: 'GET',\n        path: '/api/sdk/v1/entitlements',\n        query: { productId, tenantId, feature: resource },\n        requireAuth: true,\n      });\n      if (!raw || typeof raw.allowed !== 'boolean') {\n        throw new NeetruError('invalid_response', 'usage.check response missing allowed');\n      }\n      // Infere behavior='readonly' quando reason='limit_exceeded' e Core\n      // ainda não devolve o field explicitamente (vide CORE_CHANGES_REQUIRED §4).\n      const behavior =\n        raw.behavior ?? (raw.reason === 'limit_exceeded' ? 'readonly' : null);\n      return {\n        allowed: raw.allowed,\n        reason: raw.reason,\n        remaining: raw.remaining,\n        limit: raw.limit,\n        planId: raw.planId,\n        planFeatures: raw.planFeatures,\n        behavior,\n      };\n    },\n  };\n}\n"]}
+{"version":3,"sources":["../src/errors.ts","../src/idempotency.ts","../src/http.ts","../src/validators.ts","../src/usage.ts"],"names":["err","message"],"mappings":";;;AA6CO,IAAM,WAAA,GAAN,MAAM,YAAA,SAAoB,KAAA,CAAM;AAAA,EACrB,IAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EAEhB,WAAA,CACE,IAAA,EACA,OAAA,EACA,MAAA,EACA,SAAA,EACA;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,aAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAEjB,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,YAAA,CAAY,SAAS,CAAA;AAAA,EACnD;AACF,CAAA;;;AC9BO,SAAS,sBAAA,GAAiC;AAG/C,EAAA,MAAM,YACJ,OAAO,UAAA,KAAe,eAAe,QAAA,IAAY,UAAA,GAC5C,WAA0D,MAAA,GAC3D,MAAA;AACN,EAAA,IAAI,SAAA,IAAa,OAAO,SAAA,CAAU,UAAA,KAAe,UAAA,EAAY;AAC3D,IAAA,OAAO,UAAU,UAAA,EAAW;AAAA,EAC9B;AACA,EAAA,MAAM,IAAI,WAAA;AAAA,IACR,qBAAA;AAAA,IACA;AAAA,GACF;AACF;;;ACJA,IAAM,aAAA,GAAwC;AAAA;AAAA;AAAA,EAG5C,CAAA,EAAG;AACL,CAAA;AAGA,SAAS,cAAc,CAAA,EAAmB;AACxC,EAAA,OAAO,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,CAAA;AAC5B;AAMA,SAAS,aAAA,CAAc,GAAW,CAAA,EAAmB;AACnD,EAAA,MAAM,MAAA,GAAS,cAAc,CAAC,CAAA,CAAE,MAAM,GAAG,CAAA,CAAE,IAAI,MAAM,CAAA;AACrD,EAAA,MAAM,MAAA,GAAS,cAAc,CAAC,CAAA,CAAE,MAAM,GAAG,CAAA,CAAE,IAAI,MAAM,CAAA;AACrD,EAAA,MAAM,MAAM,IAAA,CAAK,GAAA,CAAI,MAAA,CAAO,MAAA,EAAQ,OAAO,MAAM,CAAA;AACjD,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,EAAK,CAAA,EAAA,EAAK;AAC5B,IAAA,MAAM,EAAA,GAAK,MAAA,CAAO,CAAC,CAAA,IAAK,CAAA;AACxB,IAAA,MAAM,EAAA,GAAK,MAAA,CAAO,CAAC,CAAA,IAAK,CAAA;AACxB,IAAA,IAAI,EAAA,KAAO,EAAA,EAAI,OAAO,EAAA,GAAK,EAAA;AAAA,EAC7B;AACA,EAAA,OAAO,CAAA;AACT;AAGA,SAAS,WAAA,GAAsB;AAC7B,EAAA,IAAI;AAIF,IAAA,MAAM,MAAO,UAAA,CAAmB,sBAAA;AAChC,IAAA,IAAI,GAAA,EAAK,OAAO,QAAA,CAAS,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,GAAA,EAAK,EAAE,CAAA;AAAA,EACvD,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,OAAO,CAAA;AACT;AAGA,IAAM,iBAAA,uBAAwB,GAAA,EAAY;AAMnC,SAAS,uBAAuB,WAAA,EAA2B;AAChE,EAAA,IAAI,CAAC,WAAA,EAAa;AAClB,EAAA,MAAM,WAAW,WAAA,EAAY;AAC7B,EAAA,MAAM,OAAA,GAAU,cAAc,QAAQ,CAAA;AACtC,EAAA,IAAI,CAAC,OAAA,EAAS;AACd,EAAA,MAAM,QAAA,GAAW,cAAc,WAAW,CAAA;AAC1C,EAAA,IAAI,aAAA,CAAc,QAAA,EAAU,OAAO,CAAA,GAAI,CAAA,EAAG;AACxC,IAAA,MAAM,GAAA,GAAM,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAA;AACnC,IAAA,IAAI,CAAC,iBAAA,CAAkB,GAAA,CAAI,GAAG,CAAA,EAAG;AAC/B,MAAA,iBAAA,CAAkB,IAAI,GAAG,CAAA;AACzB,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,4CAAA,EAAsC,WAAW,CAAA,0CAAA,EAC1C,OAAO,oBAAoB,QAAQ,CAAA,qGAAA;AAAA,OAE5C;AAAA,IACF;AAAA,EACF;AACF;AAsCA,IAAM,oBAAA,GAAuB,CAAA;AAC7B,IAAM,qBAAA,GAAwB,CAAA;AAC9B,IAAM,+BAAe,IAAI,GAAA,CAAI,CAAC,KAAA,EAAO,MAAM,CAAC,CAAA;AAC5C,IAAM,eAAA,uBAAsB,GAAA,CAAqB;AAAA,EAC/C,cAAA;AAAA,EACA,cAAA;AAAA,EACA;AACF,CAAC,CAAA;AAGD,SAAS,UAAU,OAAA,EAAyB;AAC1C,EAAA,MAAM,IAAA,GAAO,GAAA,GAAM,IAAA,CAAK,GAAA,CAAI,GAAG,OAAO,CAAA;AACtC,EAAA,MAAM,SAAS,IAAA,GAAO,GAAA,IAAO,IAAA,CAAK,MAAA,KAAW,CAAA,GAAI,CAAA,CAAA;AACjD,EAAA,OAAO,KAAK,GAAA,CAAI,EAAA,EAAI,KAAK,KAAA,CAAM,IAAA,GAAO,MAAM,CAAC,CAAA;AAC/C;AAUA,IAAM,kBAAA,GAAqB,GAAA;AAE3B,SAAS,gBAAgB,KAAA,EAAqC;AAC5D,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,MAAM,IAAA,GAAO,OAAO,KAAK,CAAA;AACzB,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,IAAI,CAAA,IAAK,QAAQ,CAAA,EAAG,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,KAAA,CAAM,IAAA,GAAO,GAAI,GAAG,kBAAkB,CAAA;AACnG,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,KAAK,CAAA;AAC/B,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,EAAG;AAC3B,IAAA,MAAM,KAAA,GAAQ,MAAA,GAAS,IAAA,CAAK,GAAA,EAAI;AAChC,IAAA,IAAI,QAAQ,CAAA,EAAG,OAAO,IAAA,CAAK,GAAA,CAAI,OAAO,kBAAkB,CAAA;AAAA,EAC1D;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,MAAM,EAAA,EAA2B;AACxC,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,EAAE,CAAC,CAAA;AACzD;AAGA,SAAS,aAAa,MAAA,EAAiC;AACrD,EAAA,IAAI,MAAA,KAAW,KAAK,OAAO,cAAA;AAC3B,EAAA,IAAI,MAAA,KAAW,KAAK,OAAO,WAAA;AAC3B,EAAA,IAAI,MAAA,KAAW,KAAK,OAAO,WAAA;AAC3B,EAAA,IAAI,MAAA,KAAW,KAAK,OAAO,UAAA;AAC3B,EAAA,IAAI,MAAA,KAAW,GAAA,IAAO,MAAA,KAAW,GAAA,EAAK,OAAO,mBAAA;AAC7C,EAAA,IAAI,MAAA,KAAW,KAAK,OAAO,cAAA;AAC3B,EAAA,IAAI,MAAA,IAAU,KAAK,OAAO,cAAA;AAC1B,EAAA,OAAO,SAAA;AACT;AAEA,SAAS,QAAA,CAAS,OAAA,EAAiB,IAAA,EAAc,KAAA,EAA6C;AAE5F,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AACvC,EAAA,MAAM,IAAI,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,GAAI,IAAA,GAAO,IAAI,IAAI,CAAA,CAAA;AAChD,EAAA,MAAM,MAAM,IAAI,GAAA,CAAI,GAAG,IAAI,CAAA,EAAG,CAAC,CAAA,CAAE,CAAA;AACjC,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC1C,MAAA,IAAI,MAAM,MAAA,EAAW;AACrB,MAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,CAAA,EAAG,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,IACnC;AAAA,EACF;AACA,EAAA,OAAO,IAAI,QAAA,EAAS;AACtB;AAGA,eAAe,SAAS,GAAA,EAAiC;AACvD,EAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,EAAA,IAAI,CAAC,MAAM,OAAO,MAAA;AAClB,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAQA,eAAsB,WAAA,CACpB,QACA,IAAA,EACY;AACZ,EAAA,MAAM,MAAA,GAAS,KAAK,MAAA,IAAU,KAAA;AAC9B,EAAA,MAAM,MAAM,QAAA,CAAS,MAAA,CAAO,SAAS,IAAA,CAAK,IAAA,EAAM,KAAK,KAAK,CAAA;AAE1D,EAAA,MAAM,cAAA,GAAiB,YAAA,CAAa,GAAA,CAAI,MAAM,IAC1C,oBAAA,GACA,qBAAA;AACJ,EAAA,MAAM,UAAA,GAAa,KAAK,OAAA,IAAW,cAAA;AAEnC,EAAA,MAAM,OAAA,GAAkC;AAAA,IACtC,MAAA,EAAQ,kBAAA;AAAA,IACR,GAAG,IAAA,CAAK;AAAA,GACV;AAEA,EAAA,IAAI,KAAK,WAAA,EAAa;AACpB,IAAA,IAAI,CAAC,OAAO,MAAA,EAAQ;AAClB,MAAA,MAAM,IAAI,WAAA;AAAA,QACR,iBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,MAAA,CAAO,MAAM,CAAA,CAAA;AAAA,EACjD;AAGA,EAAA,IAAI,KAAK,cAAA,EAAgB;AACvB,IAAA,MAAM,MACJ,OAAO,IAAA,CAAK,mBAAmB,QAAA,GAC3B,IAAA,CAAK,iBACL,sBAAA,EAAuB;AAC7B,IAAA,OAAA,CAAQ,iBAAiB,CAAA,GAAI,GAAA;AAAA,EAC/B;AAGA,EAAA,MAAM,UAAA,GACJ,IAAA,CAAK,IAAA,KAAS,MAAA,IAAa,MAAA,KAAW,KAAA,IAAS,MAAA,KAAW,QAAA,GACtD,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA,GACxB,MAAA;AACN,EAAA,IAAI,eAAe,MAAA,EAAW;AAC5B,IAAA,OAAA,CAAQ,cAAc,CAAA,GAAI,kBAAA;AAAA,EAC5B;AAEA,EAAA,IAAI,SAAA,GAAgC,IAAA;AAEpC,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,IAAW,UAAA,EAAY,OAAA,EAAA,EAAW;AACtD,IAAA,MAAM,IAAA,GAAoB,EAAE,MAAA,EAAQ,OAAA,EAAQ;AAC5C,IAAA,IAAI,UAAA,KAAe,MAAA,EAAW,IAAA,CAAK,IAAA,GAAO,UAAA;AAG1C,IAAA,IAAA,CAAK,MAAA,GAAS,WAAA,CAAY,OAAA,CAAQ,GAAM,CAAA;AAExC,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAM,MAAA,CAAO,KAAA,CAAM,GAAA,EAAK,IAAI,CAAA;AAAA,IACpC,SAASA,IAAAA,EAAK;AACZ,MAAA,MAAMC,QAAAA,GACJD,IAAAA,YAAe,YAAA,IAAgBA,IAAAA,CAAI,IAAA,KAAS,cAAA,GACxC,kCAAA,GACA,CAAA,eAAA,EAAkBA,IAAAA,YAAe,KAAA,GAAQA,IAAAA,CAAI,OAAA,GAAU,cAAc,CAAA,CAAA;AAC3E,MAAA,SAAA,GAAY,IAAI,WAAA,CAAY,eAAA,EAAiBC,QAAO,CAAA;AACpD,MAAA,IAAI,UAAU,UAAA,EAAY;AACxB,QAAA,MAAM,KAAA,CAAM,SAAA,CAAU,OAAO,CAAC,CAAA;AAC9B,QAAA;AAAA,MACF;AACA,MAAA,MAAM,SAAA;AAAA,IACR;AAEA,IAAA,MAAM,SAAA,GACJ,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,cAAc,KAAK,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,kBAAkB,CAAA,IAAK,MAAA;AAE5E,IAAA,IAAI,IAAI,EAAA,EAAI;AAEV,MAAA,MAAM,WAAA,GAAc,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,kBAAkB,CAAA;AACtD,MAAA,IAAI,WAAA,yBAAoC,WAAW,CAAA;AACnD,MAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,GAAG,CAAA;AACjC,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,GAAG,CAAA;AAGhC,IAAA,IAAI,IAAA,GAAe,YAAA,CAAa,GAAA,CAAI,MAAM,CAAA;AAC1C,IAAA,IAAI,OAAA,GAAU,CAAA,KAAA,EAAQ,GAAA,CAAI,MAAM,CAAA,CAAA;AAChC,IAAA,IAAI,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,IAAY,WAAW,IAAA,EAAM;AACvD,MAAA,MAAM,WAAW,IAAA,CAAK,KAAA;AACtB,MAAA,IAAI,OAAO,aAAa,QAAA,EAAU;AAChC,QAAA,OAAA,GAAU,QAAA;AAAA,MACZ,CAAA,MAAA,IAAW,QAAA,IAAY,OAAO,QAAA,KAAa,QAAA,EAAU;AACnD,QAAA,IAAI,OAAO,QAAA,CAAS,IAAA,KAAS,QAAA,SAAiB,QAAA,CAAS,IAAA;AACvD,QAAA,IAAI,OAAO,QAAA,CAAS,OAAA,KAAY,QAAA,YAAoB,QAAA,CAAS,OAAA;AAAA,MAC/D;AAAA,IACF;AACA,IAAA,MAAM,MAAM,IAAI,WAAA,CAAY,MAAM,OAAA,EAAS,GAAA,CAAI,QAAQ,SAAS,CAAA;AAChE,IAAA,SAAA,GAAY,GAAA;AAEZ,IAAA,MAAM,WAAA,GAAc,eAAA,CAAgB,GAAA,CAAI,IAAuB,CAAA;AAC/D,IAAA,IAAI,WAAA,IAAe,UAAU,UAAA,EAAY;AACvC,MAAA,MAAM,aAAa,eAAA,CAAgB,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAC,CAAA;AACjE,MAAA,MAAM,KAAA,GAAQ,UAAA,IAAc,SAAA,CAAU,OAAO,CAAA;AAC7C,MAAA,MAAM,MAAM,KAAK,CAAA;AACjB,MAAA;AAAA,IACF;AACA,IAAA,MAAM,GAAA;AAAA,EACR;AAGA,EAAA,MAAM,SAAA,IAAa,IAAI,WAAA,CAAY,SAAA,EAAW,6BAA6B,CAAA;AAC7E;;;ACtUO,IAAM,SAAA,GAAY,4BAAA;AAYlB,SAAS,gBAAA,CAAiB,OAAe,KAAA,EAAqB;AACnE,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,SAAA,CAAU,IAAA,CAAK,KAAK,CAAA,EAAG;AACvD,IAAA,MAAM,IAAI,WAAA;AAAA,MACR,mBAAA;AAAA,MACA,CAAA,EAAG,KAAK,CAAA,YAAA,EAAe,SAAA,CAAU,MAAM,CAAA,8EAAA;AAAA,KACzC;AAAA,EACF;AACF;;;ACNO,SAAS,qBAAqB,MAAA,EAAwC;AAC3E,EAAA,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAaL,MAAM,MAAA,CACJ,QAAA,EACA,GAAA,GAAc,GACd,OAAA,EACA;AACA,MAAA,IAAI,CAAC,QAAA,IAAY,OAAO,QAAA,KAAa,QAAA,EAAU;AAC7C,QAAA,MAAM,IAAI,WAAA,CAAY,mBAAA,EAAqB,sBAAsB,CAAA;AAAA,MACnE;AACA,MAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,GAAG,CAAA,IAAK,OAAO,CAAA,EAAG;AACrC,QAAA,MAAM,IAAI,WAAA,CAAY,mBAAA,EAAqB,8BAA8B,CAAA;AAAA,MAC3E;AACA,MAAA,MAAM,SAAA,GAAY,OAAA,EAAS,SAAA,IAAa,MAAA,CAAO,SAAA;AAC/C,MAAA,MAAM,QAAA,GAAW,OAAA,EAAS,QAAA,IAAY,MAAA,CAAO,QAAA;AAC7C,MAAA,IAAI,CAAC,SAAA,EAAW;AACd,QAAA,MAAM,IAAI,WAAA;AAAA,UACR,mBAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA,IAAI,CAAC,QAAA,EAAU;AACb,QAAA,MAAM,IAAI,WAAA;AAAA,UACR,mBAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AAEA,MAAA,gBAAA,CAAiB,aAAa,SAAS,CAAA;AACvC,MAAA,gBAAA,CAAiB,YAAY,QAAQ,CAAA;AAErC,MAAA,MAAM,GAAA,GAAM,MAAM,WAAA,CAOf,MAAA,EAAQ;AAAA,QACT,MAAA,EAAQ,MAAA;AAAA,QACR,IAAA,EAAM,0BAAA;AAAA,QACN,IAAA,EAAM,EAAE,SAAA,EAAW,QAAA,EAAU,UAAU,GAAA,EAAK,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA,EAAE;AAAA,QAC5D,WAAA,EAAa,IAAA;AAAA,QACb,cAAA,EAAgB;AAAA,OACjB,CAAA;AACD,MAAA,IAAI,CAAC,GAAA,IAAO,GAAA,CAAI,EAAA,KAAO,IAAA,EAAM;AAC3B,QAAA,MAAM,IAAI,WAAA,CAAY,kBAAA,EAAoB,kCAAkC,CAAA;AAAA,MAC9E;AACA,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,IAAA;AAAA,QACJ,WAAW,GAAA,CAAI,SAAA;AAAA,QACf,OAAO,GAAA,CAAI,KAAA;AAAA,QACX,OAAO,GAAA,CAAI,KAAA;AAAA,QACX,WAAW,GAAA,CAAI,SAAA;AAAA,QACf,QAAQ,GAAA,CAAI;AAAA,OACd;AAAA,IACF,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQA,MAAM,KAAA,CACJ,QAAA,EACA,OAAA,EACA;AACA,MAAA,IAAI,CAAC,QAAA,IAAY,OAAO,QAAA,KAAa,QAAA,EAAU;AAC7C,QAAA,MAAM,IAAI,WAAA,CAAY,mBAAA,EAAqB,sBAAsB,CAAA;AAAA,MACnE;AACA,MAAA,MAAM,SAAA,GAAY,OAAA,EAAS,SAAA,IAAa,MAAA,CAAO,SAAA;AAC/C,MAAA,MAAM,QAAA,GAAW,OAAA,EAAS,QAAA,IAAY,MAAA,CAAO,QAAA;AAC7C,MAAA,IAAI,CAAC,SAAA,IAAa,CAAC,QAAA,EAAU;AAC3B,QAAA,MAAM,IAAI,WAAA;AAAA,UACR,mBAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AAEA,MAAA,gBAAA,CAAiB,aAAa,SAAS,CAAA;AACvC,MAAA,gBAAA,CAAiB,YAAY,QAAQ,CAAA;AAErC,MAAA,MAAM,GAAA,GAAM,MAAM,WAAA,CAQf,MAAA,EAAQ;AAAA,QACT,MAAA,EAAQ,KAAA;AAAA,QACR,IAAA,EAAM,0BAAA;AAAA,QACN,KAAA,EAAO,EAAE,SAAA,EAAW,QAAA,EAAU,SAAS,QAAA,EAAS;AAAA,QAChD,WAAA,EAAa;AAAA,OACd,CAAA;AACD,MAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,CAAI,YAAY,SAAA,EAAW;AAC5C,QAAA,MAAM,IAAI,WAAA,CAAY,kBAAA,EAAoB,sCAAsC,CAAA;AAAA,MAClF;AAGA,MAAA,MAAM,WACJ,GAAA,CAAI,QAAA,KAAa,GAAA,CAAI,MAAA,KAAW,mBAAmB,UAAA,GAAa,IAAA,CAAA;AAClE,MAAA,OAAO;AAAA,QACL,SAAS,GAAA,CAAI,OAAA;AAAA,QACb,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,WAAW,GAAA,CAAI,SAAA;AAAA,QACf,OAAO,GAAA,CAAI,KAAA;AAAA,QACX,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,cAAc,GAAA,CAAI,YAAA;AAAA,QAClB;AAAA,OACF;AAAA,IACF;AAAA,GACF;AACF","file":"usage.cjs","sourcesContent":["/**\r\n * Erros tipados do SDK.\r\n *\r\n * Todo erro lançado pelo SDK estende `NeetruError` — caller pode discriminar\r\n * por `.code` (string estável) sem parsing de message.\r\n */\r\n\r\n/** Códigos de erro estáveis do SDK. Adicionar aqui requer minor bump. */\r\nexport type NeetruErrorCode =\r\n  | 'invalid_config'\r\n  | 'missing_api_key'\r\n  | 'unauthorized'\r\n  | 'forbidden'\r\n  | 'not_found'\r\n  | 'rate_limited'\r\n  | 'validation_failed'\r\n  | 'network_error'\r\n  | 'invalid_response'\r\n  | 'server_error'\r\n  | 'token_expired'\r\n  | 'token_invalid_signature'\r\n  | 'token_invalid_audience'\r\n  | 'token_invalid_issuer'\r\n  /** 3.0: runtime não expõe API necessária (ex: WebCrypto ausente). */\r\n  | 'runtime_unsupported'\r\n  /**\r\n   * 3.1.3 (bug_c1c96a00): o `state` retornado pelo IdP no callback OIDC não bate com o gerado em\r\n   * `signIn` (CSRF). Também usado quando não há transação OIDC pendente.\r\n   */\r\n  | 'oidc_state_mismatch'\r\n  /** HTTP 409 — colisão de idempotência ou conflito de recurso. */\r\n  | 'conflict'\r\n  | 'unknown';\r\n\r\n/**\r\n * Erro tipado padrão do SDK. Sempre lançado em vez de Error genérico.\r\n *\r\n * @example\r\n * ```ts\r\n * try { await client.catalog.list(); }\r\n * catch (e) {\r\n *   if (e instanceof NeetruError && e.code === 'rate_limited') retry();\r\n * }\r\n * ```\r\n */\r\nexport class NeetruError extends Error {\r\n  public readonly code: NeetruErrorCode | string;\r\n  public readonly status?: number;\r\n  public readonly requestId?: string;\r\n\r\n  constructor(\r\n    code: NeetruErrorCode | string,\r\n    message: string,\r\n    status?: number,\r\n    requestId?: string,\r\n  ) {\r\n    super(message);\r\n    this.name = 'NeetruError';\r\n    this.code = code;\r\n    this.status = status;\r\n    this.requestId = requestId;\r\n    // Preserva o prototype chain ao herdar de Error (downlevel quirk de TS).\r\n    Object.setPrototypeOf(this, NeetruError.prototype);\r\n  }\r\n}\r\n","/**\n * Idempotency-Key helper — gera UUID v4 cripto-seguro para identificar\n * mutations não-idempotentes (`usage.report`, `support.createTicket`,\n * `notifications.send`, `webhooks.test`).\n *\n * Estratégia 3.0:\n *   - SDK gera UUID v4 por chamada via `randomUUID()` (WebCrypto.subtle não\n *     necessário aqui — `crypto.randomUUID()` está em Node 14.17+ e em todos\n *     os browsers/Edge runtimes modernos).\n *   - Header `Idempotency-Key: <uuid>` é injetado pelo `httpRequest` quando\n *     `opts.idempotencyKey === true` OU caller passa explicit `opts.idempotencyKeyValue`.\n *   - Core dedup em coleção `usage_idempotency_keys/{key}` TTL 24h (vide\n *     `docs/CORE_CHANGES_REQUIRED.md` §2). Se Core ainda não dedupa, o header\n *     é benign (ignorado).\n *\n * Defesa em camadas: combinado com `retries: 0` em POSTs (vide http.ts), o\n * risco de double-write em transientes vai pra zero.\n */\nimport { NeetruError } from './errors';\n\n/**\n * Gera UUID v4 criptograficamente seguro. Universal: Node 14.17+, browsers\n * modernos, Edge runtimes (Workers/Vercel Edge/Cloudflare).\n *\n * Fallback puro-JS removido em 3.0 — `crypto.randomUUID()` é ubíquo desde\n * 2022. Se runtime não tem, lança `NeetruError('runtime_unsupported')`\n * (consumer deve polyfillar).\n *\n * **L-01 fix (Opus review 2026-05-27):** antes lançava `Error` cru, que\n * não era pego por `catch (err) { if (err instanceof NeetruError) ... }`\n * dos consumers. Agora throw canonical.\n *\n * @throws NeetruError('runtime_unsupported') se `crypto.randomUUID` não disponível.\n */\nexport function generateIdempotencyKey(): string {\n  // WebCrypto (browser/Edge) e Node 14.17+ expõem `crypto.randomUUID()`.\n  // Node anterior precisa de `node:crypto` mas SDK 3.0 exige Node ≥20 (vide engines).\n  const cryptoObj: { randomUUID?: () => string } | undefined =\n    typeof globalThis !== 'undefined' && 'crypto' in globalThis\n      ? (globalThis as { crypto?: { randomUUID?: () => string } }).crypto\n      : undefined;\n  if (cryptoObj && typeof cryptoObj.randomUUID === 'function') {\n    return cryptoObj.randomUUID();\n  }\n  throw new NeetruError(\n    'runtime_unsupported',\n    'crypto.randomUUID not available in this runtime. SDK 3.0 requires Node ≥20 or modern browser/Edge.',\n  );\n}\n\n/** Regex UUID v4 — validação para uso interno. */\nexport const UUID_V4_RE =\n  /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;\n","/**\r\n * HTTP transport interno do SDK.\r\n *\r\n * Responsabilidades:\r\n *   - Construir URL absoluta a partir de `baseUrl` + path\r\n *   - Injetar Bearer token quando `requireAuth=true`\r\n *   - Mapear status HTTP → `NeetruError` com `code` estável\r\n *   - Parse defensivo de JSON (não lança em body vazio em 204)\r\n *   - Retry/backoff exponencial em `rate_limited` (429), `server_error` (5xx)\r\n *     e `network_error` (timeout/falha de rede). Honra `Retry-After` quando\r\n *     presente.\r\n *   - **Captura `X-Neetru-Version`** das respostas e emite `console.warn` quando\r\n *     o Core está abaixo da versão mínima para a major do SDK.\r\n *\r\n * Política de retries (mudança breaking 3.0):\r\n *   - GET/HEAD: default 2 retries (3 tentativas total) — idempotente, seguro.\r\n *   - POST/PUT/PATCH/DELETE: default **0 retries** — mutations podem duplicar\r\n *     side effects (ex: `usage.report` incrementa contador). Caller pode\r\n *     reativar passando `retries: N` explicitamente ou usar `Idempotency-Key`\r\n *     header (gerado automaticamente se `opts.idempotencyKey=true`).\r\n *\r\n * Idempotency-Key (3.0):\r\n *   - `opts.idempotencyKey === true` → SDK gera UUID v4 e injeta header.\r\n *   - `opts.idempotencyKey === 'uuid-string'` → usa o valor passado.\r\n *   - Caller mantém retentos client-side se quiser; Core dedup serverside\r\n *     (vide `docs/CORE_CHANGES_REQUIRED.md` §2).\r\n */\r\nimport { NeetruError, type NeetruErrorCode } from './errors';\r\nimport { generateIdempotencyKey } from './idempotency';\r\nimport type { ResolvedConfig } from './types';\r\n\r\n// ─── Compat Matrix SDK↔Core ──────────────────────────────────────────────────\r\n\r\n/**\r\n * Matriz de compatibilidade SDK major → versão mínima do Core.\r\n *\r\n * Formato do Core: CalVer `YYYY.MM.patch+revision` (ex: `2026.05.1+neetru-core-00096-79t`).\r\n * A comparação é feita apenas nas partes `YYYY.MM.patch` (prefixo antes de `+`).\r\n *\r\n * Quando o Core reporta `X-Neetru-Version` abaixo do mínimo para a SDK major\r\n * corrente, o SDK emite `console.warn` uma única vez por sessão de processo.\r\n *\r\n * Atualize esta tabela a cada major de SDK.\r\n */\r\nconst COMPAT_MATRIX: Record<number, string> = {\r\n  // SDK major 3.x requer Core ≥ 2026.05.1 (suporte a X-Neetru-Version header,\r\n  // runTransaction write-after-read, verifyWebhookRequest, webhooks 3.0+)\r\n  3: '2026.05.1',\r\n};\r\n\r\n/** CalVer sem sufixo `+revision`. Ex: `2026.05.1+abc` → `2026.05.1`. */\r\nfunction stripRevision(v: string): string {\r\n  return v.split('+')[0] ?? v;\r\n}\r\n\r\n/**\r\n * Compara dois CalVer (`YYYY.MM.patch`). Retorna negativo se `a < b`,\r\n * positivo se `a > b`, 0 se iguais. Partes não numéricas tratadas como 0.\r\n */\r\nfunction compareCalVer(a: string, b: string): number {\r\n  const partsA = stripRevision(a).split('.').map(Number);\r\n  const partsB = stripRevision(b).split('.').map(Number);\r\n  const len = Math.max(partsA.length, partsB.length);\r\n  for (let i = 0; i < len; i++) {\r\n    const pa = partsA[i] ?? 0;\r\n    const pb = partsB[i] ?? 0;\r\n    if (pa !== pb) return pa - pb;\r\n  }\r\n  return 0;\r\n}\r\n\r\n/** Lê a SDK major a partir da string `VERSION` exportada de `./index`. Fallback 3. */\r\nfunction getSdkMajor(): number {\r\n  try {\r\n    // Importação estática não disponível aqui (evita ciclo). Usa variável injetada\r\n    // em tempo de build pela tsup via `define`. Fallback para 3 (current major).\r\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\r\n    const ver = (globalThis as any).__NEETRU_SDK_VERSION__ as string | undefined;\r\n    if (ver) return parseInt(ver.split('.')[0] ?? '3', 10);\r\n  } catch {\r\n    // ignore\r\n  }\r\n  return 3;\r\n}\r\n\r\n/** Aviso emitido no máximo uma vez por major detectada pra não spammar logs. */\r\nconst _warnedCoreTooOld = new Set<string>();\r\n\r\n/**\r\n * Verifica se a versão do Core (`X-Neetru-Version`) é compatível com a SDK major.\r\n * Emite `console.warn` quando incompatível (uma vez por processo por versão detectada).\r\n */\r\nexport function checkCoreVersionCompat(coreVersion: string): void {\r\n  if (!coreVersion) return;\r\n  const sdkMajor = getSdkMajor();\r\n  const minCore = COMPAT_MATRIX[sdkMajor];\r\n  if (!minCore) return; // sem restrição para esta major\r\n  const stripped = stripRevision(coreVersion);\r\n  if (compareCalVer(stripped, minCore) < 0) {\r\n    const key = `${sdkMajor}:${stripped}`;\r\n    if (!_warnedCoreTooOld.has(key)) {\r\n      _warnedCoreTooOld.add(key);\r\n      console.warn(\r\n        `[Neetru SDK] Atenção: Core versão \"${coreVersion}\" é anterior ao mínimo recomendado` +\r\n          ` \"${minCore}\" para SDK major ${sdkMajor}. Alguns recursos podem não funcionar` +\r\n          ` corretamente. Atualize o Core para a versão mais recente.`,\r\n      );\r\n    }\r\n  }\r\n}\r\n\r\n/** Opções da request HTTP. */\r\nexport interface HttpRequestOptions {\r\n  method?: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';\r\n  /** Path relativo (ex: `/api/v1/cli/catalog`). Concatenado a `baseUrl`. */\r\n  path: string;\r\n  /** Query string params (chave → valor primitivo). Valores `undefined` ignorados. */\r\n  query?: Record<string, string | number | boolean | undefined>;\r\n  /** Body JSON-serializável. Ignorado em GET/DELETE. */\r\n  body?: unknown;\r\n  /**\r\n   * Se true, injeta `Authorization: Bearer <apiKey>`. Lança `missing_api_key`\r\n   * se config.apiKey ausente. Default false.\r\n   */\r\n  requireAuth?: boolean;\r\n  /** Cabeçalhos extras. */\r\n  headers?: Record<string, string>;\r\n  /**\r\n   * Número de retries em códigos transientes (`rate_limited`, `server_error`,\r\n   * `network_error`).\r\n   *\r\n   * Default (3.0):\r\n   *   - GET/HEAD: 2 (= 3 tentativas total) — idempotente, seguro.\r\n   *   - POST/PUT/PATCH/DELETE: 0 — mutations podem duplicar side effects.\r\n   *\r\n   * Caller pode reativar passando explicitamente: `retries: 2`.\r\n   */\r\n  retries?: number;\r\n  /**\r\n   * Injeta `Idempotency-Key` header pra dedup serverside (3.0):\r\n   *   - `true` → SDK gera UUID v4 cripto-seguro automaticamente.\r\n   *   - string → usa o valor passado (deve ser UUID v4).\r\n   *   - `undefined`/`false` → sem header.\r\n   */\r\n  idempotencyKey?: boolean | string;\r\n}\r\n\r\nconst DEFAULT_RETRIES_READ = 2;\r\nconst DEFAULT_RETRIES_WRITE = 0;\r\nconst READ_METHODS = new Set(['GET', 'HEAD']);\r\nconst RETRYABLE_CODES = new Set<NeetruErrorCode>([\r\n  'rate_limited',\r\n  'server_error',\r\n  'network_error',\r\n]);\r\n\r\n/** Backoff exponencial com jitter ±20%. attempt: 0=primeira, 1=primeiro retry, ... */\r\nfunction backoffMs(attempt: number): number {\r\n  const base = 200 * Math.pow(4, attempt); // 200ms, 800ms, 3.2s, ...\r\n  const jitter = base * 0.2 * (Math.random() * 2 - 1);\r\n  return Math.max(50, Math.round(base + jitter));\r\n}\r\n\r\n/**\r\n * Honra `Retry-After` header (segundos ou HTTP-date). Retorna ms ou null se\r\n * inválido. RFC 9110 §10.2.3.\r\n *\r\n * Bug fix: sem teto, um servidor hostil/mal-configurado poderia retornar\r\n * `Retry-After: 86400` (24h) ou uma HTTP-date anos no futuro, pendurando o\r\n * processo indefinidamente. Aplica teto de MAX_RETRY_AFTER_MS em ambos os caminhos.\r\n */\r\nconst MAX_RETRY_AFTER_MS = 60_000; // 60s — teto razoável para retry automático\r\n\r\nfunction parseRetryAfter(value: string | null): number | null {\r\n  if (!value) return null;\r\n  const secs = Number(value);\r\n  if (Number.isFinite(secs) && secs >= 0) return Math.min(Math.round(secs * 1000), MAX_RETRY_AFTER_MS);\r\n  const dateMs = Date.parse(value);\r\n  if (Number.isFinite(dateMs)) {\r\n    const delta = dateMs - Date.now();\r\n    if (delta > 0) return Math.min(delta, MAX_RETRY_AFTER_MS);\r\n  }\r\n  return null;\r\n}\r\n\r\nfunction sleep(ms: number): Promise<void> {\r\n  return new Promise((resolve) => setTimeout(resolve, ms));\r\n}\r\n\r\n/** Mapeamento status → code estável do NeetruError. */\r\nfunction statusToCode(status: number): NeetruErrorCode {\r\n  if (status === 401) return 'unauthorized';\r\n  if (status === 403) return 'forbidden';\r\n  if (status === 404) return 'not_found';\r\n  if (status === 409) return 'conflict'; // Bug fix: 409 vira 'conflict' (não 'unknown')\r\n  if (status === 422 || status === 400) return 'validation_failed';\r\n  if (status === 429) return 'rate_limited';\r\n  if (status >= 500) return 'server_error';\r\n  return 'unknown';\r\n}\r\n\r\nfunction buildUrl(baseUrl: string, path: string, query?: HttpRequestOptions['query']): string {\r\n  // Trim trailing slash em base e leading em path pra evitar `//`.\r\n  const base = baseUrl.replace(/\\/+$/, '');\r\n  const p = path.startsWith('/') ? path : `/${path}`;\r\n  const url = new URL(`${base}${p}`);\r\n  if (query) {\r\n    for (const [k, v] of Object.entries(query)) {\r\n      if (v === undefined) continue;\r\n      url.searchParams.set(k, String(v));\r\n    }\r\n  }\r\n  return url.toString();\r\n}\r\n\r\n/** Parse JSON defensivo — retorna `undefined` em body vazio. */\r\nasync function safeJson(res: Response): Promise<unknown> {\r\n  const text = await res.text();\r\n  if (!text) return undefined;\r\n  try {\r\n    return JSON.parse(text);\r\n  } catch {\r\n    return undefined;\r\n  }\r\n}\r\n\r\n/**\r\n * Executa request HTTP. Em sucesso retorna body parseado; em erro lança\r\n * `NeetruError` com `code` derivado do status. Aplica retry/backoff\r\n * automático em códigos transientes (rate_limited/server_error/network_error)\r\n * conforme `opts.retries` (default 2 = 3 tentativas).\r\n */\r\nexport async function httpRequest<T>(\r\n  config: ResolvedConfig,\r\n  opts: HttpRequestOptions,\r\n): Promise<T> {\r\n  const method = opts.method ?? 'GET';\r\n  const url = buildUrl(config.baseUrl, opts.path, opts.query);\r\n  // Default por método: reads tentam 2x, writes 0x. Caller override sempre vence.\r\n  const defaultRetries = READ_METHODS.has(method)\r\n    ? DEFAULT_RETRIES_READ\r\n    : DEFAULT_RETRIES_WRITE;\r\n  const maxRetries = opts.retries ?? defaultRetries;\r\n\r\n  const headers: Record<string, string> = {\r\n    accept: 'application/json',\r\n    ...opts.headers,\r\n  };\r\n\r\n  if (opts.requireAuth) {\r\n    if (!config.apiKey) {\r\n      throw new NeetruError(\r\n        'missing_api_key',\r\n        'This operation requires an apiKey. Pass it to createNeetruClient({ apiKey }) or set NEETRU_API_KEY env var.',\r\n      );\r\n    }\r\n    headers.authorization = `Bearer ${config.apiKey}`;\r\n  }\r\n\r\n  // Idempotency-Key: gerado por chamada se solicitado. UUID v4 cripto-seguro.\r\n  if (opts.idempotencyKey) {\r\n    const key =\r\n      typeof opts.idempotencyKey === 'string'\r\n        ? opts.idempotencyKey\r\n        : generateIdempotencyKey();\r\n    headers['idempotency-key'] = key;\r\n  }\r\n\r\n  // Body só é serializado uma vez — reusado entre tentativas.\r\n  const bodyString =\r\n    opts.body !== undefined && method !== 'GET' && method !== 'DELETE'\r\n      ? JSON.stringify(opts.body)\r\n      : undefined;\r\n  if (bodyString !== undefined) {\r\n    headers['content-type'] = 'application/json';\r\n  }\r\n\r\n  let lastError: NeetruError | null = null;\r\n\r\n  for (let attempt = 0; attempt <= maxRetries; attempt++) {\r\n    const init: RequestInit = { method, headers };\r\n    if (bodyString !== undefined) init.body = bodyString;\r\n    // BUG-020 fix (2026-05-13): timeout default 30s. AbortSignal.timeout\r\n    // requer Node 18+ ou browsers recentes.\r\n    init.signal = AbortSignal.timeout(30_000);\r\n\r\n    let res: Response;\r\n    try {\r\n      res = await config.fetch(url, init);\r\n    } catch (err) {\r\n      const message =\r\n        err instanceof DOMException && err.name === 'TimeoutError'\r\n          ? 'Network error: timeout after 30s'\r\n          : `Network error: ${err instanceof Error ? err.message : 'fetch failed'}`;\r\n      lastError = new NeetruError('network_error', message);\r\n      if (attempt < maxRetries) {\r\n        await sleep(backoffMs(attempt));\r\n        continue;\r\n      }\r\n      throw lastError;\r\n    }\r\n\r\n    const requestId =\r\n      res.headers.get('x-request-id') ?? res.headers.get('x-correlation-id') ?? undefined;\r\n\r\n    if (res.ok) {\r\n      // Captura X-Neetru-Version e verifica compat com a SDK major.\r\n      const coreVersion = res.headers.get('x-neetru-version');\r\n      if (coreVersion) checkCoreVersionCompat(coreVersion);\r\n      const parsed = await safeJson(res);\r\n      return parsed as T;\r\n    }\r\n\r\n    const body = (await safeJson(res)) as\r\n      | { error?: { code?: string; message?: string } | string }\r\n      | undefined;\r\n    let code: string = statusToCode(res.status);\r\n    let message = `HTTP ${res.status}`;\r\n    if (body && typeof body === 'object' && 'error' in body) {\r\n      const errField = body.error;\r\n      if (typeof errField === 'string') {\r\n        message = errField;\r\n      } else if (errField && typeof errField === 'object') {\r\n        if (typeof errField.code === 'string') code = errField.code;\r\n        if (typeof errField.message === 'string') message = errField.message;\r\n      }\r\n    }\r\n    const err = new NeetruError(code, message, res.status, requestId);\r\n    lastError = err;\r\n\r\n    const isRetryable = RETRYABLE_CODES.has(code as NeetruErrorCode);\r\n    if (isRetryable && attempt < maxRetries) {\r\n      const retryAfter = parseRetryAfter(res.headers.get('retry-after'));\r\n      const delay = retryAfter ?? backoffMs(attempt);\r\n      await sleep(delay);\r\n      continue;\r\n    }\r\n    throw err;\r\n  }\r\n\r\n  // Unreachable — loop sempre retorna ou lança. Safety net.\r\n  throw lastError ?? new NeetruError('unknown', 'unexpected httpRequest exit');\r\n}\r\n","/**\n * Validators centralizados pra inputs do SDK que precisam casar com\n * regex do Core.\n *\n * **M-03 fix (Opus review 2026-05-27):** o Core rejeita productId que\n * não bate `/^[a-z0-9][a-z0-9_-]{0,62}$/` com 400 `validation_failed`.\n * O SDK não pré-validava — consumer recebia erro só em runtime de\n * produção, depois do round-trip de rede. Agora SDK throws localmente\n * antes do fetch.\n */\nimport { NeetruError } from './errors';\n\n/**\n * Regex canonical de IDs no Neetru Core (productId, tenantId, etc).\n * Espelha `SDK_ID_RE` em `neetru_core/src/lib/schemas/sdk.ts`.\n */\nexport const SDK_ID_RE = /^[a-z0-9][a-z0-9_-]{0,62}$/;\n\n/**\n * Throws `NeetruError('validation_failed')` se `value` não bater no\n * formato canonical.\n *\n * @example\n * ```ts\n * assertValidSdkId('productId', 'gestovendas');  // ok\n * assertValidSdkId('productId', 'GestoVendas');  // throws\n * ```\n */\nexport function assertValidSdkId(field: string, value: string): void {\n  if (typeof value !== 'string' || !SDK_ID_RE.test(value)) {\n    throw new NeetruError(\n      'validation_failed',\n      `${field} must match ${SDK_ID_RE.source} (lowercase alphanumeric, _, -; first char must be alphanumeric; max 63 chars)`,\n    );\n  }\n}\n","/**\n * Usage namespace — meterar consumo e verificar entitlements (3.0 — breaking).\n *\n * **Mudanças 3.0:**\n *   - Paths canônicos `/api/sdk/v1/*` (eram `/sdk/v1/*` errados).\n *   - `track(event, props)` **REMOVIDO** — Core não aceita esse shape; era\n *     vaporware testado contra mock fetch. Use `report(resource, qty, opts)`.\n *   - `getQuota(metric)` **REMOVIDO** — endpoint `/usage/quota` nunca existiu\n *     no Core. `report()` já devolve `{value, limit, remaining}` em todo POST.\n *   - `report()` e `check()` **agora exigem** `productId` + `tenantId`\n *     (no contexto do client OU passados nas options).\n *   - `report()` envia `Idempotency-Key` automaticamente (anti dup de\n *     incremento em retry transient — Core dedup TTL 24h).\n *\n * Endpoints consumidos:\n *   - `POST /api/sdk/v1/usage/record` — `{productId, tenantId, resource, qty}`.\n *     Incrementa `usage_counters/{tenantId}_{productId}_{resource}_{yyyymm}.value`.\n *   - `GET  /api/sdk/v1/entitlements?productId&tenantId&feature` — read-only\n *     check de plano + remaining (cache HTTP 60s).\n *\n * Comportamento por env:\n *   - `dev` → MockUsage (in-memory, retornado pelo factory).\n *   - `workspace`/`prod` → HTTP real.\n */\nimport { NeetruError } from './errors';\nimport { httpRequest } from './http';\nimport { assertValidSdkId } from './validators';\nimport type { ResolvedConfig, UsageNamespace } from './types';\n\nexport function createUsageNamespace(config: ResolvedConfig): UsageNamespace {\n  return {\n    /**\n     * Reporta consumo metered de um resource. Hit no endpoint canônico\n     * `POST /api/sdk/v1/usage/record`. Idempotency-Key gerado por chamada;\n     * Core dedup serverside TTL 24h.\n     *\n     * @example\n     * ```ts\n     * await client.usage.report('api_call', 1);\n     * // ou explicit:\n     * await client.usage.report('api_call', 5, { productId: 'gestovendas', tenantId: 't-acme' });\n     * ```\n     */\n    async report(\n      resource: string,\n      qty: number = 1,\n      options?: { productId?: string; tenantId?: string },\n    ) {\n      if (!resource || typeof resource !== 'string') {\n        throw new NeetruError('validation_failed', 'resource is required');\n      }\n      if (!Number.isFinite(qty) || qty <= 0) {\n        throw new NeetruError('validation_failed', 'qty must be positive integer');\n      }\n      const productId = options?.productId ?? config.productId;\n      const tenantId = options?.tenantId ?? config.tenantId;\n      if (!productId) {\n        throw new NeetruError(\n          'validation_failed',\n          'productId required (pass to options or set on createNeetruClient)',\n        );\n      }\n      if (!tenantId) {\n        throw new NeetruError(\n          'validation_failed',\n          'tenantId required (pass to options or set on createNeetruClient)',\n        );\n      }\n      // M-03: valida formato canonical (case-insensitive Core já rejeitaria com 400).\n      assertValidSdkId('productId', productId);\n      assertValidSdkId('tenantId', tenantId);\n\n      const raw = await httpRequest<{\n        ok?: boolean;\n        counterId?: string;\n        value?: number;\n        limit?: number;\n        remaining?: number;\n        status?: string;\n      }>(config, {\n        method: 'POST',\n        path: '/api/sdk/v1/usage/record',\n        body: { productId, tenantId, resource, qty: Math.floor(qty) },\n        requireAuth: true,\n        idempotencyKey: true,\n      });\n      if (!raw || raw.ok !== true) {\n        throw new NeetruError('invalid_response', 'usage.report response missing ok');\n      }\n      return {\n        ok: true as const,\n        counterId: raw.counterId,\n        value: raw.value,\n        limit: raw.limit,\n        remaining: raw.remaining,\n        status: raw.status,\n      };\n    },\n\n    /**\n     * Verifica entitlement de um resource via `GET /api/sdk/v1/entitlements`.\n     * Resposta inclui `allowed`, `reason` ('granted' | 'not_subscribed' |\n     * 'subscription_inactive' | 'feature_not_in_plan' | 'limit_exceeded'),\n     * `remaining`, `limit`, `planId`, `planFeatures`.\n     */\n    async check(\n      resource: string,\n      options?: { productId?: string; tenantId?: string },\n    ) {\n      if (!resource || typeof resource !== 'string') {\n        throw new NeetruError('validation_failed', 'resource is required');\n      }\n      const productId = options?.productId ?? config.productId;\n      const tenantId = options?.tenantId ?? config.tenantId;\n      if (!productId || !tenantId) {\n        throw new NeetruError(\n          'validation_failed',\n          'productId and tenantId required (pass to options or set on createNeetruClient)',\n        );\n      }\n      // M-03: valida formato canonical antes do fetch.\n      assertValidSdkId('productId', productId);\n      assertValidSdkId('tenantId', tenantId);\n\n      const raw = await httpRequest<{\n        allowed?: boolean;\n        reason?: string;\n        remaining?: number;\n        limit?: number;\n        planId?: string | null;\n        planFeatures?: string[];\n        behavior?: 'readonly' | null;\n      }>(config, {\n        method: 'GET',\n        path: '/api/sdk/v1/entitlements',\n        query: { productId, tenantId, feature: resource },\n        requireAuth: true,\n      });\n      if (!raw || typeof raw.allowed !== 'boolean') {\n        throw new NeetruError('invalid_response', 'usage.check response missing allowed');\n      }\n      // Infere behavior='readonly' quando reason='limit_exceeded' e Core\n      // ainda não devolve o field explicitamente (vide CORE_CHANGES_REQUIRED §4).\n      const behavior =\n        raw.behavior ?? (raw.reason === 'limit_exceeded' ? 'readonly' : null);\n      return {\n        allowed: raw.allowed,\n        reason: raw.reason,\n        remaining: raw.remaining,\n        limit: raw.limit,\n        planId: raw.planId,\n        planFeatures: raw.planFeatures,\n        behavior,\n      };\n    },\n  };\n}\n"]}

package/dist/usage.d.cts

@@ -1,4 +1,4 @@
-import { a1 as ResolvedConfig, ah as UsageNamespace } from './types-DePdSU3P.cjs';
+import { a3 as ResolvedConfig, aj as UsageNamespace } from './types-BXvGHppn.cjs';
 import 'drizzle-orm/node-postgres';
 import './errors.cjs';
 

package/dist/usage.d.ts

@@ -1,4 +1,4 @@
-import { a1 as ResolvedConfig, ah as UsageNamespace } from './types-B3XFHD4A.js';
+import { a3 as ResolvedConfig, aj as UsageNamespace } from './types-CQVak2a3.js';
 import 'drizzle-orm/node-postgres';
 import './errors.js';
 

package/dist/usage.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/errors.ts","../src/idempotency.ts","../src/http.ts","../src/validators.ts","../src/usage.ts"],"names":["err","message"],"mappings":";AAwCO,IAAM,WAAA,GAAN,MAAM,YAAA,SAAoB,KAAA,CAAM;AAAA,EACrB,IAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EAEhB,WAAA,CACE,IAAA,EACA,OAAA,EACA,MAAA,EACA,SAAA,EACA;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,aAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAEjB,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,YAAA,CAAY,SAAS,CAAA;AAAA,EACnD;AACF,CAAA;;;ACzBO,SAAS,sBAAA,GAAiC;AAG/C,EAAA,MAAM,YACJ,OAAO,UAAA,KAAe,eAAe,QAAA,IAAY,UAAA,GAC5C,WAA0D,MAAA,GAC3D,MAAA;AACN,EAAA,IAAI,SAAA,IAAa,OAAO,SAAA,CAAU,UAAA,KAAe,UAAA,EAAY;AAC3D,IAAA,OAAO,UAAU,UAAA,EAAW;AAAA,EAC9B;AACA,EAAA,MAAM,IAAI,WAAA;AAAA,IACR,qBAAA;AAAA,IACA;AAAA,GACF;AACF;;;ACJA,IAAM,aAAA,GAAwC;AAAA;AAAA;AAAA,EAG5C,CAAA,EAAG;AACL,CAAA;AAGA,SAAS,cAAc,CAAA,EAAmB;AACxC,EAAA,OAAO,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,CAAA;AAC5B;AAMA,SAAS,aAAA,CAAc,GAAW,CAAA,EAAmB;AACnD,EAAA,MAAM,MAAA,GAAS,cAAc,CAAC,CAAA,CAAE,MAAM,GAAG,CAAA,CAAE,IAAI,MAAM,CAAA;AACrD,EAAA,MAAM,MAAA,GAAS,cAAc,CAAC,CAAA,CAAE,MAAM,GAAG,CAAA,CAAE,IAAI,MAAM,CAAA;AACrD,EAAA,MAAM,MAAM,IAAA,CAAK,GAAA,CAAI,MAAA,CAAO,MAAA,EAAQ,OAAO,MAAM,CAAA;AACjD,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,EAAK,CAAA,EAAA,EAAK;AAC5B,IAAA,MAAM,EAAA,GAAK,MAAA,CAAO,CAAC,CAAA,IAAK,CAAA;AACxB,IAAA,MAAM,EAAA,GAAK,MAAA,CAAO,CAAC,CAAA,IAAK,CAAA;AACxB,IAAA,IAAI,EAAA,KAAO,EAAA,EAAI,OAAO,EAAA,GAAK,EAAA;AAAA,EAC7B;AACA,EAAA,OAAO,CAAA;AACT;AAGA,SAAS,WAAA,GAAsB;AAC7B,EAAA,IAAI;AAIF,IAAA,MAAM,MAAO,UAAA,CAAmB,sBAAA;AAChC,IAAA,IAAI,GAAA,EAAK,OAAO,QAAA,CAAS,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,GAAA,EAAK,EAAE,CAAA;AAAA,EACvD,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,OAAO,CAAA;AACT;AAGA,IAAM,iBAAA,uBAAwB,GAAA,EAAY;AAMnC,SAAS,uBAAuB,WAAA,EAA2B;AAChE,EAAA,IAAI,CAAC,WAAA,EAAa;AAClB,EAAA,MAAM,WAAW,WAAA,EAAY;AAC7B,EAAA,MAAM,OAAA,GAAU,cAAc,QAAQ,CAAA;AACtC,EAAA,IAAI,CAAC,OAAA,EAAS;AACd,EAAA,MAAM,QAAA,GAAW,cAAc,WAAW,CAAA;AAC1C,EAAA,IAAI,aAAA,CAAc,QAAA,EAAU,OAAO,CAAA,GAAI,CAAA,EAAG;AACxC,IAAA,MAAM,GAAA,GAAM,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAA;AACnC,IAAA,IAAI,CAAC,iBAAA,CAAkB,GAAA,CAAI,GAAG,CAAA,EAAG;AAC/B,MAAA,iBAAA,CAAkB,IAAI,GAAG,CAAA;AACzB,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,4CAAA,EAAsC,WAAW,CAAA,0CAAA,EAC1C,OAAO,oBAAoB,QAAQ,CAAA,qGAAA;AAAA,OAE5C;AAAA,IACF;AAAA,EACF;AACF;AAsCA,IAAM,oBAAA,GAAuB,CAAA;AAC7B,IAAM,qBAAA,GAAwB,CAAA;AAC9B,IAAM,+BAAe,IAAI,GAAA,CAAI,CAAC,KAAA,EAAO,MAAM,CAAC,CAAA;AAC5C,IAAM,eAAA,uBAAsB,GAAA,CAAqB;AAAA,EAC/C,cAAA;AAAA,EACA,cAAA;AAAA,EACA;AACF,CAAC,CAAA;AAGD,SAAS,UAAU,OAAA,EAAyB;AAC1C,EAAA,MAAM,IAAA,GAAO,GAAA,GAAM,IAAA,CAAK,GAAA,CAAI,GAAG,OAAO,CAAA;AACtC,EAAA,MAAM,SAAS,IAAA,GAAO,GAAA,IAAO,IAAA,CAAK,MAAA,KAAW,CAAA,GAAI,CAAA,CAAA;AACjD,EAAA,OAAO,KAAK,GAAA,CAAI,EAAA,EAAI,KAAK,KAAA,CAAM,IAAA,GAAO,MAAM,CAAC,CAAA;AAC/C;AAUA,IAAM,kBAAA,GAAqB,GAAA;AAE3B,SAAS,gBAAgB,KAAA,EAAqC;AAC5D,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,MAAM,IAAA,GAAO,OAAO,KAAK,CAAA;AACzB,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,IAAI,CAAA,IAAK,QAAQ,CAAA,EAAG,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,KAAA,CAAM,IAAA,GAAO,GAAI,GAAG,kBAAkB,CAAA;AACnG,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,KAAK,CAAA;AAC/B,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,EAAG;AAC3B,IAAA,MAAM,KAAA,GAAQ,MAAA,GAAS,IAAA,CAAK,GAAA,EAAI;AAChC,IAAA,IAAI,QAAQ,CAAA,EAAG,OAAO,IAAA,CAAK,GAAA,CAAI,OAAO,kBAAkB,CAAA;AAAA,EAC1D;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,MAAM,EAAA,EAA2B;AACxC,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,EAAE,CAAC,CAAA;AACzD;AAGA,SAAS,aAAa,MAAA,EAAiC;AACrD,EAAA,IAAI,MAAA,KAAW,KAAK,OAAO,cAAA;AAC3B,EAAA,IAAI,MAAA,KAAW,KAAK,OAAO,WAAA;AAC3B,EAAA,IAAI,MAAA,KAAW,KAAK,OAAO,WAAA;AAC3B,EAAA,IAAI,MAAA,KAAW,KAAK,OAAO,UAAA;AAC3B,EAAA,IAAI,MAAA,KAAW,GAAA,IAAO,MAAA,KAAW,GAAA,EAAK,OAAO,mBAAA;AAC7C,EAAA,IAAI,MAAA,KAAW,KAAK,OAAO,cAAA;AAC3B,EAAA,IAAI,MAAA,IAAU,KAAK,OAAO,cAAA;AAC1B,EAAA,OAAO,SAAA;AACT;AAEA,SAAS,QAAA,CAAS,OAAA,EAAiB,IAAA,EAAc,KAAA,EAA6C;AAE5F,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AACvC,EAAA,MAAM,IAAI,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,GAAI,IAAA,GAAO,IAAI,IAAI,CAAA,CAAA;AAChD,EAAA,MAAM,MAAM,IAAI,GAAA,CAAI,GAAG,IAAI,CAAA,EAAG,CAAC,CAAA,CAAE,CAAA;AACjC,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC1C,MAAA,IAAI,MAAM,MAAA,EAAW;AACrB,MAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,CAAA,EAAG,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,IACnC;AAAA,EACF;AACA,EAAA,OAAO,IAAI,QAAA,EAAS;AACtB;AAGA,eAAe,SAAS,GAAA,EAAiC;AACvD,EAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,EAAA,IAAI,CAAC,MAAM,OAAO,MAAA;AAClB,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAQA,eAAsB,WAAA,CACpB,QACA,IAAA,EACY;AACZ,EAAA,MAAM,MAAA,GAAS,KAAK,MAAA,IAAU,KAAA;AAC9B,EAAA,MAAM,MAAM,QAAA,CAAS,MAAA,CAAO,SAAS,IAAA,CAAK,IAAA,EAAM,KAAK,KAAK,CAAA;AAE1D,EAAA,MAAM,cAAA,GAAiB,YAAA,CAAa,GAAA,CAAI,MAAM,IAC1C,oBAAA,GACA,qBAAA;AACJ,EAAA,MAAM,UAAA,GAAa,KAAK,OAAA,IAAW,cAAA;AAEnC,EAAA,MAAM,OAAA,GAAkC;AAAA,IACtC,MAAA,EAAQ,kBAAA;AAAA,IACR,GAAG,IAAA,CAAK;AAAA,GACV;AAEA,EAAA,IAAI,KAAK,WAAA,EAAa;AACpB,IAAA,IAAI,CAAC,OAAO,MAAA,EAAQ;AAClB,MAAA,MAAM,IAAI,WAAA;AAAA,QACR,iBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,MAAA,CAAO,MAAM,CAAA,CAAA;AAAA,EACjD;AAGA,EAAA,IAAI,KAAK,cAAA,EAAgB;AACvB,IAAA,MAAM,MACJ,OAAO,IAAA,CAAK,mBAAmB,QAAA,GAC3B,IAAA,CAAK,iBACL,sBAAA,EAAuB;AAC7B,IAAA,OAAA,CAAQ,iBAAiB,CAAA,GAAI,GAAA;AAAA,EAC/B;AAGA,EAAA,MAAM,UAAA,GACJ,IAAA,CAAK,IAAA,KAAS,MAAA,IAAa,MAAA,KAAW,KAAA,IAAS,MAAA,KAAW,QAAA,GACtD,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA,GACxB,MAAA;AACN,EAAA,IAAI,eAAe,MAAA,EAAW;AAC5B,IAAA,OAAA,CAAQ,cAAc,CAAA,GAAI,kBAAA;AAAA,EAC5B;AAEA,EAAA,IAAI,SAAA,GAAgC,IAAA;AAEpC,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,IAAW,UAAA,EAAY,OAAA,EAAA,EAAW;AACtD,IAAA,MAAM,IAAA,GAAoB,EAAE,MAAA,EAAQ,OAAA,EAAQ;AAC5C,IAAA,IAAI,UAAA,KAAe,MAAA,EAAW,IAAA,CAAK,IAAA,GAAO,UAAA;AAG1C,IAAA,IAAA,CAAK,MAAA,GAAS,WAAA,CAAY,OAAA,CAAQ,GAAM,CAAA;AAExC,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAM,MAAA,CAAO,KAAA,CAAM,GAAA,EAAK,IAAI,CAAA;AAAA,IACpC,SAASA,IAAAA,EAAK;AACZ,MAAA,MAAMC,QAAAA,GACJD,IAAAA,YAAe,YAAA,IAAgBA,IAAAA,CAAI,IAAA,KAAS,cAAA,GACxC,kCAAA,GACA,CAAA,eAAA,EAAkBA,IAAAA,YAAe,KAAA,GAAQA,IAAAA,CAAI,OAAA,GAAU,cAAc,CAAA,CAAA;AAC3E,MAAA,SAAA,GAAY,IAAI,WAAA,CAAY,eAAA,EAAiBC,QAAO,CAAA;AACpD,MAAA,IAAI,UAAU,UAAA,EAAY;AACxB,QAAA,MAAM,KAAA,CAAM,SAAA,CAAU,OAAO,CAAC,CAAA;AAC9B,QAAA;AAAA,MACF;AACA,MAAA,MAAM,SAAA;AAAA,IACR;AAEA,IAAA,MAAM,SAAA,GACJ,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,cAAc,KAAK,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,kBAAkB,CAAA,IAAK,MAAA;AAE5E,IAAA,IAAI,IAAI,EAAA,EAAI;AAEV,MAAA,MAAM,WAAA,GAAc,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,kBAAkB,CAAA;AACtD,MAAA,IAAI,WAAA,yBAAoC,WAAW,CAAA;AACnD,MAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,GAAG,CAAA;AACjC,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,GAAG,CAAA;AAGhC,IAAA,IAAI,IAAA,GAAe,YAAA,CAAa,GAAA,CAAI,MAAM,CAAA;AAC1C,IAAA,IAAI,OAAA,GAAU,CAAA,KAAA,EAAQ,GAAA,CAAI,MAAM,CAAA,CAAA;AAChC,IAAA,IAAI,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,IAAY,WAAW,IAAA,EAAM;AACvD,MAAA,MAAM,WAAW,IAAA,CAAK,KAAA;AACtB,MAAA,IAAI,OAAO,aAAa,QAAA,EAAU;AAChC,QAAA,OAAA,GAAU,QAAA;AAAA,MACZ,CAAA,MAAA,IAAW,QAAA,IAAY,OAAO,QAAA,KAAa,QAAA,EAAU;AACnD,QAAA,IAAI,OAAO,QAAA,CAAS,IAAA,KAAS,QAAA,SAAiB,QAAA,CAAS,IAAA;AACvD,QAAA,IAAI,OAAO,QAAA,CAAS,OAAA,KAAY,QAAA,YAAoB,QAAA,CAAS,OAAA;AAAA,MAC/D;AAAA,IACF;AACA,IAAA,MAAM,MAAM,IAAI,WAAA,CAAY,MAAM,OAAA,EAAS,GAAA,CAAI,QAAQ,SAAS,CAAA;AAChE,IAAA,SAAA,GAAY,GAAA;AAEZ,IAAA,MAAM,WAAA,GAAc,eAAA,CAAgB,GAAA,CAAI,IAAuB,CAAA;AAC/D,IAAA,IAAI,WAAA,IAAe,UAAU,UAAA,EAAY;AACvC,MAAA,MAAM,aAAa,eAAA,CAAgB,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAC,CAAA;AACjE,MAAA,MAAM,KAAA,GAAQ,UAAA,IAAc,SAAA,CAAU,OAAO,CAAA;AAC7C,MAAA,MAAM,MAAM,KAAK,CAAA;AACjB,MAAA;AAAA,IACF;AACA,IAAA,MAAM,GAAA;AAAA,EACR;AAGA,EAAA,MAAM,SAAA,IAAa,IAAI,WAAA,CAAY,SAAA,EAAW,6BAA6B,CAAA;AAC7E;;;ACtUO,IAAM,SAAA,GAAY,4BAAA;AAYlB,SAAS,gBAAA,CAAiB,OAAe,KAAA,EAAqB;AACnE,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,SAAA,CAAU,IAAA,CAAK,KAAK,CAAA,EAAG;AACvD,IAAA,MAAM,IAAI,WAAA;AAAA,MACR,mBAAA;AAAA,MACA,CAAA,EAAG,KAAK,CAAA,YAAA,EAAe,SAAA,CAAU,MAAM,CAAA,8EAAA;AAAA,KACzC;AAAA,EACF;AACF;;;ACNO,SAAS,qBAAqB,MAAA,EAAwC;AAC3E,EAAA,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAaL,MAAM,MAAA,CACJ,QAAA,EACA,GAAA,GAAc,GACd,OAAA,EACA;AACA,MAAA,IAAI,CAAC,QAAA,IAAY,OAAO,QAAA,KAAa,QAAA,EAAU;AAC7C,QAAA,MAAM,IAAI,WAAA,CAAY,mBAAA,EAAqB,sBAAsB,CAAA;AAAA,MACnE;AACA,MAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,GAAG,CAAA,IAAK,OAAO,CAAA,EAAG;AACrC,QAAA,MAAM,IAAI,WAAA,CAAY,mBAAA,EAAqB,8BAA8B,CAAA;AAAA,MAC3E;AACA,MAAA,MAAM,SAAA,GAAY,OAAA,EAAS,SAAA,IAAa,MAAA,CAAO,SAAA;AAC/C,MAAA,MAAM,QAAA,GAAW,OAAA,EAAS,QAAA,IAAY,MAAA,CAAO,QAAA;AAC7C,MAAA,IAAI,CAAC,SAAA,EAAW;AACd,QAAA,MAAM,IAAI,WAAA;AAAA,UACR,mBAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA,IAAI,CAAC,QAAA,EAAU;AACb,QAAA,MAAM,IAAI,WAAA;AAAA,UACR,mBAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AAEA,MAAA,gBAAA,CAAiB,aAAa,SAAS,CAAA;AACvC,MAAA,gBAAA,CAAiB,YAAY,QAAQ,CAAA;AAErC,MAAA,MAAM,GAAA,GAAM,MAAM,WAAA,CAOf,MAAA,EAAQ;AAAA,QACT,MAAA,EAAQ,MAAA;AAAA,QACR,IAAA,EAAM,0BAAA;AAAA,QACN,IAAA,EAAM,EAAE,SAAA,EAAW,QAAA,EAAU,UAAU,GAAA,EAAK,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA,EAAE;AAAA,QAC5D,WAAA,EAAa,IAAA;AAAA,QACb,cAAA,EAAgB;AAAA,OACjB,CAAA;AACD,MAAA,IAAI,CAAC,GAAA,IAAO,GAAA,CAAI,EAAA,KAAO,IAAA,EAAM;AAC3B,QAAA,MAAM,IAAI,WAAA,CAAY,kBAAA,EAAoB,kCAAkC,CAAA;AAAA,MAC9E;AACA,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,IAAA;AAAA,QACJ,WAAW,GAAA,CAAI,SAAA;AAAA,QACf,OAAO,GAAA,CAAI,KAAA;AAAA,QACX,OAAO,GAAA,CAAI,KAAA;AAAA,QACX,WAAW,GAAA,CAAI,SAAA;AAAA,QACf,QAAQ,GAAA,CAAI;AAAA,OACd;AAAA,IACF,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQA,MAAM,KAAA,CACJ,QAAA,EACA,OAAA,EACA;AACA,MAAA,IAAI,CAAC,QAAA,IAAY,OAAO,QAAA,KAAa,QAAA,EAAU;AAC7C,QAAA,MAAM,IAAI,WAAA,CAAY,mBAAA,EAAqB,sBAAsB,CAAA;AAAA,MACnE;AACA,MAAA,MAAM,SAAA,GAAY,OAAA,EAAS,SAAA,IAAa,MAAA,CAAO,SAAA;AAC/C,MAAA,MAAM,QAAA,GAAW,OAAA,EAAS,QAAA,IAAY,MAAA,CAAO,QAAA;AAC7C,MAAA,IAAI,CAAC,SAAA,IAAa,CAAC,QAAA,EAAU;AAC3B,QAAA,MAAM,IAAI,WAAA;AAAA,UACR,mBAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AAEA,MAAA,gBAAA,CAAiB,aAAa,SAAS,CAAA;AACvC,MAAA,gBAAA,CAAiB,YAAY,QAAQ,CAAA;AAErC,MAAA,MAAM,GAAA,GAAM,MAAM,WAAA,CAQf,MAAA,EAAQ;AAAA,QACT,MAAA,EAAQ,KAAA;AAAA,QACR,IAAA,EAAM,0BAAA;AAAA,QACN,KAAA,EAAO,EAAE,SAAA,EAAW,QAAA,EAAU,SAAS,QAAA,EAAS;AAAA,QAChD,WAAA,EAAa;AAAA,OACd,CAAA;AACD,MAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,CAAI,YAAY,SAAA,EAAW;AAC5C,QAAA,MAAM,IAAI,WAAA,CAAY,kBAAA,EAAoB,sCAAsC,CAAA;AAAA,MAClF;AAGA,MAAA,MAAM,WACJ,GAAA,CAAI,QAAA,KAAa,GAAA,CAAI,MAAA,KAAW,mBAAmB,UAAA,GAAa,IAAA,CAAA;AAClE,MAAA,OAAO;AAAA,QACL,SAAS,GAAA,CAAI,OAAA;AAAA,QACb,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,WAAW,GAAA,CAAI,SAAA;AAAA,QACf,OAAO,GAAA,CAAI,KAAA;AAAA,QACX,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,cAAc,GAAA,CAAI,YAAA;AAAA,QAClB;AAAA,OACF;AAAA,IACF;AAAA,GACF;AACF","file":"usage.mjs","sourcesContent":["/**\r\n * Erros tipados do SDK.\r\n *\r\n * Todo erro lançado pelo SDK estende `NeetruError` — caller pode discriminar\r\n * por `.code` (string estável) sem parsing de message.\r\n */\r\n\r\n/** Códigos de erro estáveis do SDK. Adicionar aqui requer minor bump. */\r\nexport type NeetruErrorCode =\r\n  | 'invalid_config'\r\n  | 'missing_api_key'\r\n  | 'unauthorized'\r\n  | 'forbidden'\r\n  | 'not_found'\r\n  | 'rate_limited'\r\n  | 'validation_failed'\r\n  | 'network_error'\r\n  | 'invalid_response'\r\n  | 'server_error'\r\n  | 'token_expired'\r\n  | 'token_invalid_signature'\r\n  | 'token_invalid_audience'\r\n  | 'token_invalid_issuer'\r\n  /** 3.0: runtime não expõe API necessária (ex: WebCrypto ausente). */\r\n  | 'runtime_unsupported'\r\n  /** HTTP 409 — colisão de idempotência ou conflito de recurso. */\r\n  | 'conflict'\r\n  | 'unknown';\r\n\r\n/**\r\n * Erro tipado padrão do SDK. Sempre lançado em vez de Error genérico.\r\n *\r\n * @example\r\n * ```ts\r\n * try { await client.catalog.list(); }\r\n * catch (e) {\r\n *   if (e instanceof NeetruError && e.code === 'rate_limited') retry();\r\n * }\r\n * ```\r\n */\r\nexport class NeetruError extends Error {\r\n  public readonly code: NeetruErrorCode | string;\r\n  public readonly status?: number;\r\n  public readonly requestId?: string;\r\n\r\n  constructor(\r\n    code: NeetruErrorCode | string,\r\n    message: string,\r\n    status?: number,\r\n    requestId?: string,\r\n  ) {\r\n    super(message);\r\n    this.name = 'NeetruError';\r\n    this.code = code;\r\n    this.status = status;\r\n    this.requestId = requestId;\r\n    // Preserva o prototype chain ao herdar de Error (downlevel quirk de TS).\r\n    Object.setPrototypeOf(this, NeetruError.prototype);\r\n  }\r\n}\r\n","/**\n * Idempotency-Key helper — gera UUID v4 cripto-seguro para identificar\n * mutations não-idempotentes (`usage.report`, `support.createTicket`,\n * `notifications.send`, `webhooks.test`).\n *\n * Estratégia 3.0:\n *   - SDK gera UUID v4 por chamada via `randomUUID()` (WebCrypto.subtle não\n *     necessário aqui — `crypto.randomUUID()` está em Node 14.17+ e em todos\n *     os browsers/Edge runtimes modernos).\n *   - Header `Idempotency-Key: <uuid>` é injetado pelo `httpRequest` quando\n *     `opts.idempotencyKey === true` OU caller passa explicit `opts.idempotencyKeyValue`.\n *   - Core dedup em coleção `usage_idempotency_keys/{key}` TTL 24h (vide\n *     `docs/CORE_CHANGES_REQUIRED.md` §2). Se Core ainda não dedupa, o header\n *     é benign (ignorado).\n *\n * Defesa em camadas: combinado com `retries: 0` em POSTs (vide http.ts), o\n * risco de double-write em transientes vai pra zero.\n */\nimport { NeetruError } from './errors';\n\n/**\n * Gera UUID v4 criptograficamente seguro. Universal: Node 14.17+, browsers\n * modernos, Edge runtimes (Workers/Vercel Edge/Cloudflare).\n *\n * Fallback puro-JS removido em 3.0 — `crypto.randomUUID()` é ubíquo desde\n * 2022. Se runtime não tem, lança `NeetruError('runtime_unsupported')`\n * (consumer deve polyfillar).\n *\n * **L-01 fix (Opus review 2026-05-27):** antes lançava `Error` cru, que\n * não era pego por `catch (err) { if (err instanceof NeetruError) ... }`\n * dos consumers. Agora throw canonical.\n *\n * @throws NeetruError('runtime_unsupported') se `crypto.randomUUID` não disponível.\n */\nexport function generateIdempotencyKey(): string {\n  // WebCrypto (browser/Edge) e Node 14.17+ expõem `crypto.randomUUID()`.\n  // Node anterior precisa de `node:crypto` mas SDK 3.0 exige Node ≥20 (vide engines).\n  const cryptoObj: { randomUUID?: () => string } | undefined =\n    typeof globalThis !== 'undefined' && 'crypto' in globalThis\n      ? (globalThis as { crypto?: { randomUUID?: () => string } }).crypto\n      : undefined;\n  if (cryptoObj && typeof cryptoObj.randomUUID === 'function') {\n    return cryptoObj.randomUUID();\n  }\n  throw new NeetruError(\n    'runtime_unsupported',\n    'crypto.randomUUID not available in this runtime. SDK 3.0 requires Node ≥20 or modern browser/Edge.',\n  );\n}\n\n/** Regex UUID v4 — validação para uso interno. */\nexport const UUID_V4_RE =\n  /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;\n","/**\r\n * HTTP transport interno do SDK.\r\n *\r\n * Responsabilidades:\r\n *   - Construir URL absoluta a partir de `baseUrl` + path\r\n *   - Injetar Bearer token quando `requireAuth=true`\r\n *   - Mapear status HTTP → `NeetruError` com `code` estável\r\n *   - Parse defensivo de JSON (não lança em body vazio em 204)\r\n *   - Retry/backoff exponencial em `rate_limited` (429), `server_error` (5xx)\r\n *     e `network_error` (timeout/falha de rede). Honra `Retry-After` quando\r\n *     presente.\r\n *   - **Captura `X-Neetru-Version`** das respostas e emite `console.warn` quando\r\n *     o Core está abaixo da versão mínima para a major do SDK.\r\n *\r\n * Política de retries (mudança breaking 3.0):\r\n *   - GET/HEAD: default 2 retries (3 tentativas total) — idempotente, seguro.\r\n *   - POST/PUT/PATCH/DELETE: default **0 retries** — mutations podem duplicar\r\n *     side effects (ex: `usage.report` incrementa contador). Caller pode\r\n *     reativar passando `retries: N` explicitamente ou usar `Idempotency-Key`\r\n *     header (gerado automaticamente se `opts.idempotencyKey=true`).\r\n *\r\n * Idempotency-Key (3.0):\r\n *   - `opts.idempotencyKey === true` → SDK gera UUID v4 e injeta header.\r\n *   - `opts.idempotencyKey === 'uuid-string'` → usa o valor passado.\r\n *   - Caller mantém retentos client-side se quiser; Core dedup serverside\r\n *     (vide `docs/CORE_CHANGES_REQUIRED.md` §2).\r\n */\r\nimport { NeetruError, type NeetruErrorCode } from './errors';\r\nimport { generateIdempotencyKey } from './idempotency';\r\nimport type { ResolvedConfig } from './types';\r\n\r\n// ─── Compat Matrix SDK↔Core ──────────────────────────────────────────────────\r\n\r\n/**\r\n * Matriz de compatibilidade SDK major → versão mínima do Core.\r\n *\r\n * Formato do Core: CalVer `YYYY.MM.patch+revision` (ex: `2026.05.1+neetru-core-00096-79t`).\r\n * A comparação é feita apenas nas partes `YYYY.MM.patch` (prefixo antes de `+`).\r\n *\r\n * Quando o Core reporta `X-Neetru-Version` abaixo do mínimo para a SDK major\r\n * corrente, o SDK emite `console.warn` uma única vez por sessão de processo.\r\n *\r\n * Atualize esta tabela a cada major de SDK.\r\n */\r\nconst COMPAT_MATRIX: Record<number, string> = {\r\n  // SDK major 3.x requer Core ≥ 2026.05.1 (suporte a X-Neetru-Version header,\r\n  // runTransaction write-after-read, verifyWebhookRequest, webhooks 3.0+)\r\n  3: '2026.05.1',\r\n};\r\n\r\n/** CalVer sem sufixo `+revision`. Ex: `2026.05.1+abc` → `2026.05.1`. */\r\nfunction stripRevision(v: string): string {\r\n  return v.split('+')[0] ?? v;\r\n}\r\n\r\n/**\r\n * Compara dois CalVer (`YYYY.MM.patch`). Retorna negativo se `a < b`,\r\n * positivo se `a > b`, 0 se iguais. Partes não numéricas tratadas como 0.\r\n */\r\nfunction compareCalVer(a: string, b: string): number {\r\n  const partsA = stripRevision(a).split('.').map(Number);\r\n  const partsB = stripRevision(b).split('.').map(Number);\r\n  const len = Math.max(partsA.length, partsB.length);\r\n  for (let i = 0; i < len; i++) {\r\n    const pa = partsA[i] ?? 0;\r\n    const pb = partsB[i] ?? 0;\r\n    if (pa !== pb) return pa - pb;\r\n  }\r\n  return 0;\r\n}\r\n\r\n/** Lê a SDK major a partir da string `VERSION` exportada de `./index`. Fallback 3. */\r\nfunction getSdkMajor(): number {\r\n  try {\r\n    // Importação estática não disponível aqui (evita ciclo). Usa variável injetada\r\n    // em tempo de build pela tsup via `define`. Fallback para 3 (current major).\r\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\r\n    const ver = (globalThis as any).__NEETRU_SDK_VERSION__ as string | undefined;\r\n    if (ver) return parseInt(ver.split('.')[0] ?? '3', 10);\r\n  } catch {\r\n    // ignore\r\n  }\r\n  return 3;\r\n}\r\n\r\n/** Aviso emitido no máximo uma vez por major detectada pra não spammar logs. */\r\nconst _warnedCoreTooOld = new Set<string>();\r\n\r\n/**\r\n * Verifica se a versão do Core (`X-Neetru-Version`) é compatível com a SDK major.\r\n * Emite `console.warn` quando incompatível (uma vez por processo por versão detectada).\r\n */\r\nexport function checkCoreVersionCompat(coreVersion: string): void {\r\n  if (!coreVersion) return;\r\n  const sdkMajor = getSdkMajor();\r\n  const minCore = COMPAT_MATRIX[sdkMajor];\r\n  if (!minCore) return; // sem restrição para esta major\r\n  const stripped = stripRevision(coreVersion);\r\n  if (compareCalVer(stripped, minCore) < 0) {\r\n    const key = `${sdkMajor}:${stripped}`;\r\n    if (!_warnedCoreTooOld.has(key)) {\r\n      _warnedCoreTooOld.add(key);\r\n      console.warn(\r\n        `[Neetru SDK] Atenção: Core versão \"${coreVersion}\" é anterior ao mínimo recomendado` +\r\n          ` \"${minCore}\" para SDK major ${sdkMajor}. Alguns recursos podem não funcionar` +\r\n          ` corretamente. Atualize o Core para a versão mais recente.`,\r\n      );\r\n    }\r\n  }\r\n}\r\n\r\n/** Opções da request HTTP. */\r\nexport interface HttpRequestOptions {\r\n  method?: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';\r\n  /** Path relativo (ex: `/api/v1/cli/catalog`). Concatenado a `baseUrl`. */\r\n  path: string;\r\n  /** Query string params (chave → valor primitivo). Valores `undefined` ignorados. */\r\n  query?: Record<string, string | number | boolean | undefined>;\r\n  /** Body JSON-serializável. Ignorado em GET/DELETE. */\r\n  body?: unknown;\r\n  /**\r\n   * Se true, injeta `Authorization: Bearer <apiKey>`. Lança `missing_api_key`\r\n   * se config.apiKey ausente. Default false.\r\n   */\r\n  requireAuth?: boolean;\r\n  /** Cabeçalhos extras. */\r\n  headers?: Record<string, string>;\r\n  /**\r\n   * Número de retries em códigos transientes (`rate_limited`, `server_error`,\r\n   * `network_error`).\r\n   *\r\n   * Default (3.0):\r\n   *   - GET/HEAD: 2 (= 3 tentativas total) — idempotente, seguro.\r\n   *   - POST/PUT/PATCH/DELETE: 0 — mutations podem duplicar side effects.\r\n   *\r\n   * Caller pode reativar passando explicitamente: `retries: 2`.\r\n   */\r\n  retries?: number;\r\n  /**\r\n   * Injeta `Idempotency-Key` header pra dedup serverside (3.0):\r\n   *   - `true` → SDK gera UUID v4 cripto-seguro automaticamente.\r\n   *   - string → usa o valor passado (deve ser UUID v4).\r\n   *   - `undefined`/`false` → sem header.\r\n   */\r\n  idempotencyKey?: boolean | string;\r\n}\r\n\r\nconst DEFAULT_RETRIES_READ = 2;\r\nconst DEFAULT_RETRIES_WRITE = 0;\r\nconst READ_METHODS = new Set(['GET', 'HEAD']);\r\nconst RETRYABLE_CODES = new Set<NeetruErrorCode>([\r\n  'rate_limited',\r\n  'server_error',\r\n  'network_error',\r\n]);\r\n\r\n/** Backoff exponencial com jitter ±20%. attempt: 0=primeira, 1=primeiro retry, ... */\r\nfunction backoffMs(attempt: number): number {\r\n  const base = 200 * Math.pow(4, attempt); // 200ms, 800ms, 3.2s, ...\r\n  const jitter = base * 0.2 * (Math.random() * 2 - 1);\r\n  return Math.max(50, Math.round(base + jitter));\r\n}\r\n\r\n/**\r\n * Honra `Retry-After` header (segundos ou HTTP-date). Retorna ms ou null se\r\n * inválido. RFC 9110 §10.2.3.\r\n *\r\n * Bug fix: sem teto, um servidor hostil/mal-configurado poderia retornar\r\n * `Retry-After: 86400` (24h) ou uma HTTP-date anos no futuro, pendurando o\r\n * processo indefinidamente. Aplica teto de MAX_RETRY_AFTER_MS em ambos os caminhos.\r\n */\r\nconst MAX_RETRY_AFTER_MS = 60_000; // 60s — teto razoável para retry automático\r\n\r\nfunction parseRetryAfter(value: string | null): number | null {\r\n  if (!value) return null;\r\n  const secs = Number(value);\r\n  if (Number.isFinite(secs) && secs >= 0) return Math.min(Math.round(secs * 1000), MAX_RETRY_AFTER_MS);\r\n  const dateMs = Date.parse(value);\r\n  if (Number.isFinite(dateMs)) {\r\n    const delta = dateMs - Date.now();\r\n    if (delta > 0) return Math.min(delta, MAX_RETRY_AFTER_MS);\r\n  }\r\n  return null;\r\n}\r\n\r\nfunction sleep(ms: number): Promise<void> {\r\n  return new Promise((resolve) => setTimeout(resolve, ms));\r\n}\r\n\r\n/** Mapeamento status → code estável do NeetruError. */\r\nfunction statusToCode(status: number): NeetruErrorCode {\r\n  if (status === 401) return 'unauthorized';\r\n  if (status === 403) return 'forbidden';\r\n  if (status === 404) return 'not_found';\r\n  if (status === 409) return 'conflict'; // Bug fix: 409 vira 'conflict' (não 'unknown')\r\n  if (status === 422 || status === 400) return 'validation_failed';\r\n  if (status === 429) return 'rate_limited';\r\n  if (status >= 500) return 'server_error';\r\n  return 'unknown';\r\n}\r\n\r\nfunction buildUrl(baseUrl: string, path: string, query?: HttpRequestOptions['query']): string {\r\n  // Trim trailing slash em base e leading em path pra evitar `//`.\r\n  const base = baseUrl.replace(/\\/+$/, '');\r\n  const p = path.startsWith('/') ? path : `/${path}`;\r\n  const url = new URL(`${base}${p}`);\r\n  if (query) {\r\n    for (const [k, v] of Object.entries(query)) {\r\n      if (v === undefined) continue;\r\n      url.searchParams.set(k, String(v));\r\n    }\r\n  }\r\n  return url.toString();\r\n}\r\n\r\n/** Parse JSON defensivo — retorna `undefined` em body vazio. */\r\nasync function safeJson(res: Response): Promise<unknown> {\r\n  const text = await res.text();\r\n  if (!text) return undefined;\r\n  try {\r\n    return JSON.parse(text);\r\n  } catch {\r\n    return undefined;\r\n  }\r\n}\r\n\r\n/**\r\n * Executa request HTTP. Em sucesso retorna body parseado; em erro lança\r\n * `NeetruError` com `code` derivado do status. Aplica retry/backoff\r\n * automático em códigos transientes (rate_limited/server_error/network_error)\r\n * conforme `opts.retries` (default 2 = 3 tentativas).\r\n */\r\nexport async function httpRequest<T>(\r\n  config: ResolvedConfig,\r\n  opts: HttpRequestOptions,\r\n): Promise<T> {\r\n  const method = opts.method ?? 'GET';\r\n  const url = buildUrl(config.baseUrl, opts.path, opts.query);\r\n  // Default por método: reads tentam 2x, writes 0x. Caller override sempre vence.\r\n  const defaultRetries = READ_METHODS.has(method)\r\n    ? DEFAULT_RETRIES_READ\r\n    : DEFAULT_RETRIES_WRITE;\r\n  const maxRetries = opts.retries ?? defaultRetries;\r\n\r\n  const headers: Record<string, string> = {\r\n    accept: 'application/json',\r\n    ...opts.headers,\r\n  };\r\n\r\n  if (opts.requireAuth) {\r\n    if (!config.apiKey) {\r\n      throw new NeetruError(\r\n        'missing_api_key',\r\n        'This operation requires an apiKey. Pass it to createNeetruClient({ apiKey }) or set NEETRU_API_KEY env var.',\r\n      );\r\n    }\r\n    headers.authorization = `Bearer ${config.apiKey}`;\r\n  }\r\n\r\n  // Idempotency-Key: gerado por chamada se solicitado. UUID v4 cripto-seguro.\r\n  if (opts.idempotencyKey) {\r\n    const key =\r\n      typeof opts.idempotencyKey === 'string'\r\n        ? opts.idempotencyKey\r\n        : generateIdempotencyKey();\r\n    headers['idempotency-key'] = key;\r\n  }\r\n\r\n  // Body só é serializado uma vez — reusado entre tentativas.\r\n  const bodyString =\r\n    opts.body !== undefined && method !== 'GET' && method !== 'DELETE'\r\n      ? JSON.stringify(opts.body)\r\n      : undefined;\r\n  if (bodyString !== undefined) {\r\n    headers['content-type'] = 'application/json';\r\n  }\r\n\r\n  let lastError: NeetruError | null = null;\r\n\r\n  for (let attempt = 0; attempt <= maxRetries; attempt++) {\r\n    const init: RequestInit = { method, headers };\r\n    if (bodyString !== undefined) init.body = bodyString;\r\n    // BUG-020 fix (2026-05-13): timeout default 30s. AbortSignal.timeout\r\n    // requer Node 18+ ou browsers recentes.\r\n    init.signal = AbortSignal.timeout(30_000);\r\n\r\n    let res: Response;\r\n    try {\r\n      res = await config.fetch(url, init);\r\n    } catch (err) {\r\n      const message =\r\n        err instanceof DOMException && err.name === 'TimeoutError'\r\n          ? 'Network error: timeout after 30s'\r\n          : `Network error: ${err instanceof Error ? err.message : 'fetch failed'}`;\r\n      lastError = new NeetruError('network_error', message);\r\n      if (attempt < maxRetries) {\r\n        await sleep(backoffMs(attempt));\r\n        continue;\r\n      }\r\n      throw lastError;\r\n    }\r\n\r\n    const requestId =\r\n      res.headers.get('x-request-id') ?? res.headers.get('x-correlation-id') ?? undefined;\r\n\r\n    if (res.ok) {\r\n      // Captura X-Neetru-Version e verifica compat com a SDK major.\r\n      const coreVersion = res.headers.get('x-neetru-version');\r\n      if (coreVersion) checkCoreVersionCompat(coreVersion);\r\n      const parsed = await safeJson(res);\r\n      return parsed as T;\r\n    }\r\n\r\n    const body = (await safeJson(res)) as\r\n      | { error?: { code?: string; message?: string } | string }\r\n      | undefined;\r\n    let code: string = statusToCode(res.status);\r\n    let message = `HTTP ${res.status}`;\r\n    if (body && typeof body === 'object' && 'error' in body) {\r\n      const errField = body.error;\r\n      if (typeof errField === 'string') {\r\n        message = errField;\r\n      } else if (errField && typeof errField === 'object') {\r\n        if (typeof errField.code === 'string') code = errField.code;\r\n        if (typeof errField.message === 'string') message = errField.message;\r\n      }\r\n    }\r\n    const err = new NeetruError(code, message, res.status, requestId);\r\n    lastError = err;\r\n\r\n    const isRetryable = RETRYABLE_CODES.has(code as NeetruErrorCode);\r\n    if (isRetryable && attempt < maxRetries) {\r\n      const retryAfter = parseRetryAfter(res.headers.get('retry-after'));\r\n      const delay = retryAfter ?? backoffMs(attempt);\r\n      await sleep(delay);\r\n      continue;\r\n    }\r\n    throw err;\r\n  }\r\n\r\n  // Unreachable — loop sempre retorna ou lança. Safety net.\r\n  throw lastError ?? new NeetruError('unknown', 'unexpected httpRequest exit');\r\n}\r\n","/**\n * Validators centralizados pra inputs do SDK que precisam casar com\n * regex do Core.\n *\n * **M-03 fix (Opus review 2026-05-27):** o Core rejeita productId que\n * não bate `/^[a-z0-9][a-z0-9_-]{0,62}$/` com 400 `validation_failed`.\n * O SDK não pré-validava — consumer recebia erro só em runtime de\n * produção, depois do round-trip de rede. Agora SDK throws localmente\n * antes do fetch.\n */\nimport { NeetruError } from './errors';\n\n/**\n * Regex canonical de IDs no Neetru Core (productId, tenantId, etc).\n * Espelha `SDK_ID_RE` em `neetru_core/src/lib/schemas/sdk.ts`.\n */\nexport const SDK_ID_RE = /^[a-z0-9][a-z0-9_-]{0,62}$/;\n\n/**\n * Throws `NeetruError('validation_failed')` se `value` não bater no\n * formato canonical.\n *\n * @example\n * ```ts\n * assertValidSdkId('productId', 'gestovendas');  // ok\n * assertValidSdkId('productId', 'GestoVendas');  // throws\n * ```\n */\nexport function assertValidSdkId(field: string, value: string): void {\n  if (typeof value !== 'string' || !SDK_ID_RE.test(value)) {\n    throw new NeetruError(\n      'validation_failed',\n      `${field} must match ${SDK_ID_RE.source} (lowercase alphanumeric, _, -; first char must be alphanumeric; max 63 chars)`,\n    );\n  }\n}\n","/**\n * Usage namespace — meterar consumo e verificar entitlements (3.0 — breaking).\n *\n * **Mudanças 3.0:**\n *   - Paths canônicos `/api/sdk/v1/*` (eram `/sdk/v1/*` errados).\n *   - `track(event, props)` **REMOVIDO** — Core não aceita esse shape; era\n *     vaporware testado contra mock fetch. Use `report(resource, qty, opts)`.\n *   - `getQuota(metric)` **REMOVIDO** — endpoint `/usage/quota` nunca existiu\n *     no Core. `report()` já devolve `{value, limit, remaining}` em todo POST.\n *   - `report()` e `check()` **agora exigem** `productId` + `tenantId`\n *     (no contexto do client OU passados nas options).\n *   - `report()` envia `Idempotency-Key` automaticamente (anti dup de\n *     incremento em retry transient — Core dedup TTL 24h).\n *\n * Endpoints consumidos:\n *   - `POST /api/sdk/v1/usage/record` — `{productId, tenantId, resource, qty}`.\n *     Incrementa `usage_counters/{tenantId}_{productId}_{resource}_{yyyymm}.value`.\n *   - `GET  /api/sdk/v1/entitlements?productId&tenantId&feature` — read-only\n *     check de plano + remaining (cache HTTP 60s).\n *\n * Comportamento por env:\n *   - `dev` → MockUsage (in-memory, retornado pelo factory).\n *   - `workspace`/`prod` → HTTP real.\n */\nimport { NeetruError } from './errors';\nimport { httpRequest } from './http';\nimport { assertValidSdkId } from './validators';\nimport type { ResolvedConfig, UsageNamespace } from './types';\n\nexport function createUsageNamespace(config: ResolvedConfig): UsageNamespace {\n  return {\n    /**\n     * Reporta consumo metered de um resource. Hit no endpoint canônico\n     * `POST /api/sdk/v1/usage/record`. Idempotency-Key gerado por chamada;\n     * Core dedup serverside TTL 24h.\n     *\n     * @example\n     * ```ts\n     * await client.usage.report('api_call', 1);\n     * // ou explicit:\n     * await client.usage.report('api_call', 5, { productId: 'gestovendas', tenantId: 't-acme' });\n     * ```\n     */\n    async report(\n      resource: string,\n      qty: number = 1,\n      options?: { productId?: string; tenantId?: string },\n    ) {\n      if (!resource || typeof resource !== 'string') {\n        throw new NeetruError('validation_failed', 'resource is required');\n      }\n      if (!Number.isFinite(qty) || qty <= 0) {\n        throw new NeetruError('validation_failed', 'qty must be positive integer');\n      }\n      const productId = options?.productId ?? config.productId;\n      const tenantId = options?.tenantId ?? config.tenantId;\n      if (!productId) {\n        throw new NeetruError(\n          'validation_failed',\n          'productId required (pass to options or set on createNeetruClient)',\n        );\n      }\n      if (!tenantId) {\n        throw new NeetruError(\n          'validation_failed',\n          'tenantId required (pass to options or set on createNeetruClient)',\n        );\n      }\n      // M-03: valida formato canonical (case-insensitive Core já rejeitaria com 400).\n      assertValidSdkId('productId', productId);\n      assertValidSdkId('tenantId', tenantId);\n\n      const raw = await httpRequest<{\n        ok?: boolean;\n        counterId?: string;\n        value?: number;\n        limit?: number;\n        remaining?: number;\n        status?: string;\n      }>(config, {\n        method: 'POST',\n        path: '/api/sdk/v1/usage/record',\n        body: { productId, tenantId, resource, qty: Math.floor(qty) },\n        requireAuth: true,\n        idempotencyKey: true,\n      });\n      if (!raw || raw.ok !== true) {\n        throw new NeetruError('invalid_response', 'usage.report response missing ok');\n      }\n      return {\n        ok: true as const,\n        counterId: raw.counterId,\n        value: raw.value,\n        limit: raw.limit,\n        remaining: raw.remaining,\n        status: raw.status,\n      };\n    },\n\n    /**\n     * Verifica entitlement de um resource via `GET /api/sdk/v1/entitlements`.\n     * Resposta inclui `allowed`, `reason` ('granted' | 'not_subscribed' |\n     * 'subscription_inactive' | 'feature_not_in_plan' | 'limit_exceeded'),\n     * `remaining`, `limit`, `planId`, `planFeatures`.\n     */\n    async check(\n      resource: string,\n      options?: { productId?: string; tenantId?: string },\n    ) {\n      if (!resource || typeof resource !== 'string') {\n        throw new NeetruError('validation_failed', 'resource is required');\n      }\n      const productId = options?.productId ?? config.productId;\n      const tenantId = options?.tenantId ?? config.tenantId;\n      if (!productId || !tenantId) {\n        throw new NeetruError(\n          'validation_failed',\n          'productId and tenantId required (pass to options or set on createNeetruClient)',\n        );\n      }\n      // M-03: valida formato canonical antes do fetch.\n      assertValidSdkId('productId', productId);\n      assertValidSdkId('tenantId', tenantId);\n\n      const raw = await httpRequest<{\n        allowed?: boolean;\n        reason?: string;\n        remaining?: number;\n        limit?: number;\n        planId?: string | null;\n        planFeatures?: string[];\n        behavior?: 'readonly' | null;\n      }>(config, {\n        method: 'GET',\n        path: '/api/sdk/v1/entitlements',\n        query: { productId, tenantId, feature: resource },\n        requireAuth: true,\n      });\n      if (!raw || typeof raw.allowed !== 'boolean') {\n        throw new NeetruError('invalid_response', 'usage.check response missing allowed');\n      }\n      // Infere behavior='readonly' quando reason='limit_exceeded' e Core\n      // ainda não devolve o field explicitamente (vide CORE_CHANGES_REQUIRED §4).\n      const behavior =\n        raw.behavior ?? (raw.reason === 'limit_exceeded' ? 'readonly' : null);\n      return {\n        allowed: raw.allowed,\n        reason: raw.reason,\n        remaining: raw.remaining,\n        limit: raw.limit,\n        planId: raw.planId,\n        planFeatures: raw.planFeatures,\n        behavior,\n      };\n    },\n  };\n}\n"]}
+{"version":3,"sources":["../src/errors.ts","../src/idempotency.ts","../src/http.ts","../src/validators.ts","../src/usage.ts"],"names":["err","message"],"mappings":";AA6CO,IAAM,WAAA,GAAN,MAAM,YAAA,SAAoB,KAAA,CAAM;AAAA,EACrB,IAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EAEhB,WAAA,CACE,IAAA,EACA,OAAA,EACA,MAAA,EACA,SAAA,EACA;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,aAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAEjB,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,YAAA,CAAY,SAAS,CAAA;AAAA,EACnD;AACF,CAAA;;;AC9BO,SAAS,sBAAA,GAAiC;AAG/C,EAAA,MAAM,YACJ,OAAO,UAAA,KAAe,eAAe,QAAA,IAAY,UAAA,GAC5C,WAA0D,MAAA,GAC3D,MAAA;AACN,EAAA,IAAI,SAAA,IAAa,OAAO,SAAA,CAAU,UAAA,KAAe,UAAA,EAAY;AAC3D,IAAA,OAAO,UAAU,UAAA,EAAW;AAAA,EAC9B;AACA,EAAA,MAAM,IAAI,WAAA;AAAA,IACR,qBAAA;AAAA,IACA;AAAA,GACF;AACF;;;ACJA,IAAM,aAAA,GAAwC;AAAA;AAAA;AAAA,EAG5C,CAAA,EAAG;AACL,CAAA;AAGA,SAAS,cAAc,CAAA,EAAmB;AACxC,EAAA,OAAO,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,CAAA;AAC5B;AAMA,SAAS,aAAA,CAAc,GAAW,CAAA,EAAmB;AACnD,EAAA,MAAM,MAAA,GAAS,cAAc,CAAC,CAAA,CAAE,MAAM,GAAG,CAAA,CAAE,IAAI,MAAM,CAAA;AACrD,EAAA,MAAM,MAAA,GAAS,cAAc,CAAC,CAAA,CAAE,MAAM,GAAG,CAAA,CAAE,IAAI,MAAM,CAAA;AACrD,EAAA,MAAM,MAAM,IAAA,CAAK,GAAA,CAAI,MAAA,CAAO,MAAA,EAAQ,OAAO,MAAM,CAAA;AACjD,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,EAAK,CAAA,EAAA,EAAK;AAC5B,IAAA,MAAM,EAAA,GAAK,MAAA,CAAO,CAAC,CAAA,IAAK,CAAA;AACxB,IAAA,MAAM,EAAA,GAAK,MAAA,CAAO,CAAC,CAAA,IAAK,CAAA;AACxB,IAAA,IAAI,EAAA,KAAO,EAAA,EAAI,OAAO,EAAA,GAAK,EAAA;AAAA,EAC7B;AACA,EAAA,OAAO,CAAA;AACT;AAGA,SAAS,WAAA,GAAsB;AAC7B,EAAA,IAAI;AAIF,IAAA,MAAM,MAAO,UAAA,CAAmB,sBAAA;AAChC,IAAA,IAAI,GAAA,EAAK,OAAO,QAAA,CAAS,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,GAAA,EAAK,EAAE,CAAA;AAAA,EACvD,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,OAAO,CAAA;AACT;AAGA,IAAM,iBAAA,uBAAwB,GAAA,EAAY;AAMnC,SAAS,uBAAuB,WAAA,EAA2B;AAChE,EAAA,IAAI,CAAC,WAAA,EAAa;AAClB,EAAA,MAAM,WAAW,WAAA,EAAY;AAC7B,EAAA,MAAM,OAAA,GAAU,cAAc,QAAQ,CAAA;AACtC,EAAA,IAAI,CAAC,OAAA,EAAS;AACd,EAAA,MAAM,QAAA,GAAW,cAAc,WAAW,CAAA;AAC1C,EAAA,IAAI,aAAA,CAAc,QAAA,EAAU,OAAO,CAAA,GAAI,CAAA,EAAG;AACxC,IAAA,MAAM,GAAA,GAAM,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAA;AACnC,IAAA,IAAI,CAAC,iBAAA,CAAkB,GAAA,CAAI,GAAG,CAAA,EAAG;AAC/B,MAAA,iBAAA,CAAkB,IAAI,GAAG,CAAA;AACzB,MAAA,OAAA,CAAQ,IAAA;AAAA,QACN,CAAA,4CAAA,EAAsC,WAAW,CAAA,0CAAA,EAC1C,OAAO,oBAAoB,QAAQ,CAAA,qGAAA;AAAA,OAE5C;AAAA,IACF;AAAA,EACF;AACF;AAsCA,IAAM,oBAAA,GAAuB,CAAA;AAC7B,IAAM,qBAAA,GAAwB,CAAA;AAC9B,IAAM,+BAAe,IAAI,GAAA,CAAI,CAAC,KAAA,EAAO,MAAM,CAAC,CAAA;AAC5C,IAAM,eAAA,uBAAsB,GAAA,CAAqB;AAAA,EAC/C,cAAA;AAAA,EACA,cAAA;AAAA,EACA;AACF,CAAC,CAAA;AAGD,SAAS,UAAU,OAAA,EAAyB;AAC1C,EAAA,MAAM,IAAA,GAAO,GAAA,GAAM,IAAA,CAAK,GAAA,CAAI,GAAG,OAAO,CAAA;AACtC,EAAA,MAAM,SAAS,IAAA,GAAO,GAAA,IAAO,IAAA,CAAK,MAAA,KAAW,CAAA,GAAI,CAAA,CAAA;AACjD,EAAA,OAAO,KAAK,GAAA,CAAI,EAAA,EAAI,KAAK,KAAA,CAAM,IAAA,GAAO,MAAM,CAAC,CAAA;AAC/C;AAUA,IAAM,kBAAA,GAAqB,GAAA;AAE3B,SAAS,gBAAgB,KAAA,EAAqC;AAC5D,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,MAAM,IAAA,GAAO,OAAO,KAAK,CAAA;AACzB,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,IAAI,CAAA,IAAK,QAAQ,CAAA,EAAG,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,KAAA,CAAM,IAAA,GAAO,GAAI,GAAG,kBAAkB,CAAA;AACnG,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,KAAK,CAAA;AAC/B,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,EAAG;AAC3B,IAAA,MAAM,KAAA,GAAQ,MAAA,GAAS,IAAA,CAAK,GAAA,EAAI;AAChC,IAAA,IAAI,QAAQ,CAAA,EAAG,OAAO,IAAA,CAAK,GAAA,CAAI,OAAO,kBAAkB,CAAA;AAAA,EAC1D;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,MAAM,EAAA,EAA2B;AACxC,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,EAAE,CAAC,CAAA;AACzD;AAGA,SAAS,aAAa,MAAA,EAAiC;AACrD,EAAA,IAAI,MAAA,KAAW,KAAK,OAAO,cAAA;AAC3B,EAAA,IAAI,MAAA,KAAW,KAAK,OAAO,WAAA;AAC3B,EAAA,IAAI,MAAA,KAAW,KAAK,OAAO,WAAA;AAC3B,EAAA,IAAI,MAAA,KAAW,KAAK,OAAO,UAAA;AAC3B,EAAA,IAAI,MAAA,KAAW,GAAA,IAAO,MAAA,KAAW,GAAA,EAAK,OAAO,mBAAA;AAC7C,EAAA,IAAI,MAAA,KAAW,KAAK,OAAO,cAAA;AAC3B,EAAA,IAAI,MAAA,IAAU,KAAK,OAAO,cAAA;AAC1B,EAAA,OAAO,SAAA;AACT;AAEA,SAAS,QAAA,CAAS,OAAA,EAAiB,IAAA,EAAc,KAAA,EAA6C;AAE5F,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AACvC,EAAA,MAAM,IAAI,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,GAAI,IAAA,GAAO,IAAI,IAAI,CAAA,CAAA;AAChD,EAAA,MAAM,MAAM,IAAI,GAAA,CAAI,GAAG,IAAI,CAAA,EAAG,CAAC,CAAA,CAAE,CAAA;AACjC,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC1C,MAAA,IAAI,MAAM,MAAA,EAAW;AACrB,MAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,CAAA,EAAG,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,IACnC;AAAA,EACF;AACA,EAAA,OAAO,IAAI,QAAA,EAAS;AACtB;AAGA,eAAe,SAAS,GAAA,EAAiC;AACvD,EAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,EAAA,IAAI,CAAC,MAAM,OAAO,MAAA;AAClB,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAQA,eAAsB,WAAA,CACpB,QACA,IAAA,EACY;AACZ,EAAA,MAAM,MAAA,GAAS,KAAK,MAAA,IAAU,KAAA;AAC9B,EAAA,MAAM,MAAM,QAAA,CAAS,MAAA,CAAO,SAAS,IAAA,CAAK,IAAA,EAAM,KAAK,KAAK,CAAA;AAE1D,EAAA,MAAM,cAAA,GAAiB,YAAA,CAAa,GAAA,CAAI,MAAM,IAC1C,oBAAA,GACA,qBAAA;AACJ,EAAA,MAAM,UAAA,GAAa,KAAK,OAAA,IAAW,cAAA;AAEnC,EAAA,MAAM,OAAA,GAAkC;AAAA,IACtC,MAAA,EAAQ,kBAAA;AAAA,IACR,GAAG,IAAA,CAAK;AAAA,GACV;AAEA,EAAA,IAAI,KAAK,WAAA,EAAa;AACpB,IAAA,IAAI,CAAC,OAAO,MAAA,EAAQ;AAClB,MAAA,MAAM,IAAI,WAAA;AAAA,QACR,iBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,MAAA,CAAO,MAAM,CAAA,CAAA;AAAA,EACjD;AAGA,EAAA,IAAI,KAAK,cAAA,EAAgB;AACvB,IAAA,MAAM,MACJ,OAAO,IAAA,CAAK,mBAAmB,QAAA,GAC3B,IAAA,CAAK,iBACL,sBAAA,EAAuB;AAC7B,IAAA,OAAA,CAAQ,iBAAiB,CAAA,GAAI,GAAA;AAAA,EAC/B;AAGA,EAAA,MAAM,UAAA,GACJ,IAAA,CAAK,IAAA,KAAS,MAAA,IAAa,MAAA,KAAW,KAAA,IAAS,MAAA,KAAW,QAAA,GACtD,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA,GACxB,MAAA;AACN,EAAA,IAAI,eAAe,MAAA,EAAW;AAC5B,IAAA,OAAA,CAAQ,cAAc,CAAA,GAAI,kBAAA;AAAA,EAC5B;AAEA,EAAA,IAAI,SAAA,GAAgC,IAAA;AAEpC,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,IAAW,UAAA,EAAY,OAAA,EAAA,EAAW;AACtD,IAAA,MAAM,IAAA,GAAoB,EAAE,MAAA,EAAQ,OAAA,EAAQ;AAC5C,IAAA,IAAI,UAAA,KAAe,MAAA,EAAW,IAAA,CAAK,IAAA,GAAO,UAAA;AAG1C,IAAA,IAAA,CAAK,MAAA,GAAS,WAAA,CAAY,OAAA,CAAQ,GAAM,CAAA;AAExC,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAM,MAAA,CAAO,KAAA,CAAM,GAAA,EAAK,IAAI,CAAA;AAAA,IACpC,SAASA,IAAAA,EAAK;AACZ,MAAA,MAAMC,QAAAA,GACJD,IAAAA,YAAe,YAAA,IAAgBA,IAAAA,CAAI,IAAA,KAAS,cAAA,GACxC,kCAAA,GACA,CAAA,eAAA,EAAkBA,IAAAA,YAAe,KAAA,GAAQA,IAAAA,CAAI,OAAA,GAAU,cAAc,CAAA,CAAA;AAC3E,MAAA,SAAA,GAAY,IAAI,WAAA,CAAY,eAAA,EAAiBC,QAAO,CAAA;AACpD,MAAA,IAAI,UAAU,UAAA,EAAY;AACxB,QAAA,MAAM,KAAA,CAAM,SAAA,CAAU,OAAO,CAAC,CAAA;AAC9B,QAAA;AAAA,MACF;AACA,MAAA,MAAM,SAAA;AAAA,IACR;AAEA,IAAA,MAAM,SAAA,GACJ,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,cAAc,KAAK,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,kBAAkB,CAAA,IAAK,MAAA;AAE5E,IAAA,IAAI,IAAI,EAAA,EAAI;AAEV,MAAA,MAAM,WAAA,GAAc,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,kBAAkB,CAAA;AACtD,MAAA,IAAI,WAAA,yBAAoC,WAAW,CAAA;AACnD,MAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,GAAG,CAAA;AACjC,MAAA,OAAO,MAAA;AAAA,IACT;AAEA,IAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,GAAG,CAAA;AAGhC,IAAA,IAAI,IAAA,GAAe,YAAA,CAAa,GAAA,CAAI,MAAM,CAAA;AAC1C,IAAA,IAAI,OAAA,GAAU,CAAA,KAAA,EAAQ,GAAA,CAAI,MAAM,CAAA,CAAA;AAChC,IAAA,IAAI,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,IAAY,WAAW,IAAA,EAAM;AACvD,MAAA,MAAM,WAAW,IAAA,CAAK,KAAA;AACtB,MAAA,IAAI,OAAO,aAAa,QAAA,EAAU;AAChC,QAAA,OAAA,GAAU,QAAA;AAAA,MACZ,CAAA,MAAA,IAAW,QAAA,IAAY,OAAO,QAAA,KAAa,QAAA,EAAU;AACnD,QAAA,IAAI,OAAO,QAAA,CAAS,IAAA,KAAS,QAAA,SAAiB,QAAA,CAAS,IAAA;AACvD,QAAA,IAAI,OAAO,QAAA,CAAS,OAAA,KAAY,QAAA,YAAoB,QAAA,CAAS,OAAA;AAAA,MAC/D;AAAA,IACF;AACA,IAAA,MAAM,MAAM,IAAI,WAAA,CAAY,MAAM,OAAA,EAAS,GAAA,CAAI,QAAQ,SAAS,CAAA;AAChE,IAAA,SAAA,GAAY,GAAA;AAEZ,IAAA,MAAM,WAAA,GAAc,eAAA,CAAgB,GAAA,CAAI,IAAuB,CAAA;AAC/D,IAAA,IAAI,WAAA,IAAe,UAAU,UAAA,EAAY;AACvC,MAAA,MAAM,aAAa,eAAA,CAAgB,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAC,CAAA;AACjE,MAAA,MAAM,KAAA,GAAQ,UAAA,IAAc,SAAA,CAAU,OAAO,CAAA;AAC7C,MAAA,MAAM,MAAM,KAAK,CAAA;AACjB,MAAA;AAAA,IACF;AACA,IAAA,MAAM,GAAA;AAAA,EACR;AAGA,EAAA,MAAM,SAAA,IAAa,IAAI,WAAA,CAAY,SAAA,EAAW,6BAA6B,CAAA;AAC7E;;;ACtUO,IAAM,SAAA,GAAY,4BAAA;AAYlB,SAAS,gBAAA,CAAiB,OAAe,KAAA,EAAqB;AACnE,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,SAAA,CAAU,IAAA,CAAK,KAAK,CAAA,EAAG;AACvD,IAAA,MAAM,IAAI,WAAA;AAAA,MACR,mBAAA;AAAA,MACA,CAAA,EAAG,KAAK,CAAA,YAAA,EAAe,SAAA,CAAU,MAAM,CAAA,8EAAA;AAAA,KACzC;AAAA,EACF;AACF;;;ACNO,SAAS,qBAAqB,MAAA,EAAwC;AAC3E,EAAA,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAaL,MAAM,MAAA,CACJ,QAAA,EACA,GAAA,GAAc,GACd,OAAA,EACA;AACA,MAAA,IAAI,CAAC,QAAA,IAAY,OAAO,QAAA,KAAa,QAAA,EAAU;AAC7C,QAAA,MAAM,IAAI,WAAA,CAAY,mBAAA,EAAqB,sBAAsB,CAAA;AAAA,MACnE;AACA,MAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,GAAG,CAAA,IAAK,OAAO,CAAA,EAAG;AACrC,QAAA,MAAM,IAAI,WAAA,CAAY,mBAAA,EAAqB,8BAA8B,CAAA;AAAA,MAC3E;AACA,MAAA,MAAM,SAAA,GAAY,OAAA,EAAS,SAAA,IAAa,MAAA,CAAO,SAAA;AAC/C,MAAA,MAAM,QAAA,GAAW,OAAA,EAAS,QAAA,IAAY,MAAA,CAAO,QAAA;AAC7C,MAAA,IAAI,CAAC,SAAA,EAAW;AACd,QAAA,MAAM,IAAI,WAAA;AAAA,UACR,mBAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA,IAAI,CAAC,QAAA,EAAU;AACb,QAAA,MAAM,IAAI,WAAA;AAAA,UACR,mBAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AAEA,MAAA,gBAAA,CAAiB,aAAa,SAAS,CAAA;AACvC,MAAA,gBAAA,CAAiB,YAAY,QAAQ,CAAA;AAErC,MAAA,MAAM,GAAA,GAAM,MAAM,WAAA,CAOf,MAAA,EAAQ;AAAA,QACT,MAAA,EAAQ,MAAA;AAAA,QACR,IAAA,EAAM,0BAAA;AAAA,QACN,IAAA,EAAM,EAAE,SAAA,EAAW,QAAA,EAAU,UAAU,GAAA,EAAK,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA,EAAE;AAAA,QAC5D,WAAA,EAAa,IAAA;AAAA,QACb,cAAA,EAAgB;AAAA,OACjB,CAAA;AACD,MAAA,IAAI,CAAC,GAAA,IAAO,GAAA,CAAI,EAAA,KAAO,IAAA,EAAM;AAC3B,QAAA,MAAM,IAAI,WAAA,CAAY,kBAAA,EAAoB,kCAAkC,CAAA;AAAA,MAC9E;AACA,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,IAAA;AAAA,QACJ,WAAW,GAAA,CAAI,SAAA;AAAA,QACf,OAAO,GAAA,CAAI,KAAA;AAAA,QACX,OAAO,GAAA,CAAI,KAAA;AAAA,QACX,WAAW,GAAA,CAAI,SAAA;AAAA,QACf,QAAQ,GAAA,CAAI;AAAA,OACd;AAAA,IACF,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQA,MAAM,KAAA,CACJ,QAAA,EACA,OAAA,EACA;AACA,MAAA,IAAI,CAAC,QAAA,IAAY,OAAO,QAAA,KAAa,QAAA,EAAU;AAC7C,QAAA,MAAM,IAAI,WAAA,CAAY,mBAAA,EAAqB,sBAAsB,CAAA;AAAA,MACnE;AACA,MAAA,MAAM,SAAA,GAAY,OAAA,EAAS,SAAA,IAAa,MAAA,CAAO,SAAA;AAC/C,MAAA,MAAM,QAAA,GAAW,OAAA,EAAS,QAAA,IAAY,MAAA,CAAO,QAAA;AAC7C,MAAA,IAAI,CAAC,SAAA,IAAa,CAAC,QAAA,EAAU;AAC3B,QAAA,MAAM,IAAI,WAAA;AAAA,UACR,mBAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AAEA,MAAA,gBAAA,CAAiB,aAAa,SAAS,CAAA;AACvC,MAAA,gBAAA,CAAiB,YAAY,QAAQ,CAAA;AAErC,MAAA,MAAM,GAAA,GAAM,MAAM,WAAA,CAQf,MAAA,EAAQ;AAAA,QACT,MAAA,EAAQ,KAAA;AAAA,QACR,IAAA,EAAM,0BAAA;AAAA,QACN,KAAA,EAAO,EAAE,SAAA,EAAW,QAAA,EAAU,SAAS,QAAA,EAAS;AAAA,QAChD,WAAA,EAAa;AAAA,OACd,CAAA;AACD,MAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,CAAI,YAAY,SAAA,EAAW;AAC5C,QAAA,MAAM,IAAI,WAAA,CAAY,kBAAA,EAAoB,sCAAsC,CAAA;AAAA,MAClF;AAGA,MAAA,MAAM,WACJ,GAAA,CAAI,QAAA,KAAa,GAAA,CAAI,MAAA,KAAW,mBAAmB,UAAA,GAAa,IAAA,CAAA;AAClE,MAAA,OAAO;AAAA,QACL,SAAS,GAAA,CAAI,OAAA;AAAA,QACb,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,WAAW,GAAA,CAAI,SAAA;AAAA,QACf,OAAO,GAAA,CAAI,KAAA;AAAA,QACX,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,cAAc,GAAA,CAAI,YAAA;AAAA,QAClB;AAAA,OACF;AAAA,IACF;AAAA,GACF;AACF","file":"usage.mjs","sourcesContent":["/**\r\n * Erros tipados do SDK.\r\n *\r\n * Todo erro lançado pelo SDK estende `NeetruError` — caller pode discriminar\r\n * por `.code` (string estável) sem parsing de message.\r\n */\r\n\r\n/** Códigos de erro estáveis do SDK. Adicionar aqui requer minor bump. */\r\nexport type NeetruErrorCode =\r\n  | 'invalid_config'\r\n  | 'missing_api_key'\r\n  | 'unauthorized'\r\n  | 'forbidden'\r\n  | 'not_found'\r\n  | 'rate_limited'\r\n  | 'validation_failed'\r\n  | 'network_error'\r\n  | 'invalid_response'\r\n  | 'server_error'\r\n  | 'token_expired'\r\n  | 'token_invalid_signature'\r\n  | 'token_invalid_audience'\r\n  | 'token_invalid_issuer'\r\n  /** 3.0: runtime não expõe API necessária (ex: WebCrypto ausente). */\r\n  | 'runtime_unsupported'\r\n  /**\r\n   * 3.1.3 (bug_c1c96a00): o `state` retornado pelo IdP no callback OIDC não bate com o gerado em\r\n   * `signIn` (CSRF). Também usado quando não há transação OIDC pendente.\r\n   */\r\n  | 'oidc_state_mismatch'\r\n  /** HTTP 409 — colisão de idempotência ou conflito de recurso. */\r\n  | 'conflict'\r\n  | 'unknown';\r\n\r\n/**\r\n * Erro tipado padrão do SDK. Sempre lançado em vez de Error genérico.\r\n *\r\n * @example\r\n * ```ts\r\n * try { await client.catalog.list(); }\r\n * catch (e) {\r\n *   if (e instanceof NeetruError && e.code === 'rate_limited') retry();\r\n * }\r\n * ```\r\n */\r\nexport class NeetruError extends Error {\r\n  public readonly code: NeetruErrorCode | string;\r\n  public readonly status?: number;\r\n  public readonly requestId?: string;\r\n\r\n  constructor(\r\n    code: NeetruErrorCode | string,\r\n    message: string,\r\n    status?: number,\r\n    requestId?: string,\r\n  ) {\r\n    super(message);\r\n    this.name = 'NeetruError';\r\n    this.code = code;\r\n    this.status = status;\r\n    this.requestId = requestId;\r\n    // Preserva o prototype chain ao herdar de Error (downlevel quirk de TS).\r\n    Object.setPrototypeOf(this, NeetruError.prototype);\r\n  }\r\n}\r\n","/**\n * Idempotency-Key helper — gera UUID v4 cripto-seguro para identificar\n * mutations não-idempotentes (`usage.report`, `support.createTicket`,\n * `notifications.send`, `webhooks.test`).\n *\n * Estratégia 3.0:\n *   - SDK gera UUID v4 por chamada via `randomUUID()` (WebCrypto.subtle não\n *     necessário aqui — `crypto.randomUUID()` está em Node 14.17+ e em todos\n *     os browsers/Edge runtimes modernos).\n *   - Header `Idempotency-Key: <uuid>` é injetado pelo `httpRequest` quando\n *     `opts.idempotencyKey === true` OU caller passa explicit `opts.idempotencyKeyValue`.\n *   - Core dedup em coleção `usage_idempotency_keys/{key}` TTL 24h (vide\n *     `docs/CORE_CHANGES_REQUIRED.md` §2). Se Core ainda não dedupa, o header\n *     é benign (ignorado).\n *\n * Defesa em camadas: combinado com `retries: 0` em POSTs (vide http.ts), o\n * risco de double-write em transientes vai pra zero.\n */\nimport { NeetruError } from './errors';\n\n/**\n * Gera UUID v4 criptograficamente seguro. Universal: Node 14.17+, browsers\n * modernos, Edge runtimes (Workers/Vercel Edge/Cloudflare).\n *\n * Fallback puro-JS removido em 3.0 — `crypto.randomUUID()` é ubíquo desde\n * 2022. Se runtime não tem, lança `NeetruError('runtime_unsupported')`\n * (consumer deve polyfillar).\n *\n * **L-01 fix (Opus review 2026-05-27):** antes lançava `Error` cru, que\n * não era pego por `catch (err) { if (err instanceof NeetruError) ... }`\n * dos consumers. Agora throw canonical.\n *\n * @throws NeetruError('runtime_unsupported') se `crypto.randomUUID` não disponível.\n */\nexport function generateIdempotencyKey(): string {\n  // WebCrypto (browser/Edge) e Node 14.17+ expõem `crypto.randomUUID()`.\n  // Node anterior precisa de `node:crypto` mas SDK 3.0 exige Node ≥20 (vide engines).\n  const cryptoObj: { randomUUID?: () => string } | undefined =\n    typeof globalThis !== 'undefined' && 'crypto' in globalThis\n      ? (globalThis as { crypto?: { randomUUID?: () => string } }).crypto\n      : undefined;\n  if (cryptoObj && typeof cryptoObj.randomUUID === 'function') {\n    return cryptoObj.randomUUID();\n  }\n  throw new NeetruError(\n    'runtime_unsupported',\n    'crypto.randomUUID not available in this runtime. SDK 3.0 requires Node ≥20 or modern browser/Edge.',\n  );\n}\n\n/** Regex UUID v4 — validação para uso interno. */\nexport const UUID_V4_RE =\n  /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;\n","/**\r\n * HTTP transport interno do SDK.\r\n *\r\n * Responsabilidades:\r\n *   - Construir URL absoluta a partir de `baseUrl` + path\r\n *   - Injetar Bearer token quando `requireAuth=true`\r\n *   - Mapear status HTTP → `NeetruError` com `code` estável\r\n *   - Parse defensivo de JSON (não lança em body vazio em 204)\r\n *   - Retry/backoff exponencial em `rate_limited` (429), `server_error` (5xx)\r\n *     e `network_error` (timeout/falha de rede). Honra `Retry-After` quando\r\n *     presente.\r\n *   - **Captura `X-Neetru-Version`** das respostas e emite `console.warn` quando\r\n *     o Core está abaixo da versão mínima para a major do SDK.\r\n *\r\n * Política de retries (mudança breaking 3.0):\r\n *   - GET/HEAD: default 2 retries (3 tentativas total) — idempotente, seguro.\r\n *   - POST/PUT/PATCH/DELETE: default **0 retries** — mutations podem duplicar\r\n *     side effects (ex: `usage.report` incrementa contador). Caller pode\r\n *     reativar passando `retries: N` explicitamente ou usar `Idempotency-Key`\r\n *     header (gerado automaticamente se `opts.idempotencyKey=true`).\r\n *\r\n * Idempotency-Key (3.0):\r\n *   - `opts.idempotencyKey === true` → SDK gera UUID v4 e injeta header.\r\n *   - `opts.idempotencyKey === 'uuid-string'` → usa o valor passado.\r\n *   - Caller mantém retentos client-side se quiser; Core dedup serverside\r\n *     (vide `docs/CORE_CHANGES_REQUIRED.md` §2).\r\n */\r\nimport { NeetruError, type NeetruErrorCode } from './errors';\r\nimport { generateIdempotencyKey } from './idempotency';\r\nimport type { ResolvedConfig } from './types';\r\n\r\n// ─── Compat Matrix SDK↔Core ──────────────────────────────────────────────────\r\n\r\n/**\r\n * Matriz de compatibilidade SDK major → versão mínima do Core.\r\n *\r\n * Formato do Core: CalVer `YYYY.MM.patch+revision` (ex: `2026.05.1+neetru-core-00096-79t`).\r\n * A comparação é feita apenas nas partes `YYYY.MM.patch` (prefixo antes de `+`).\r\n *\r\n * Quando o Core reporta `X-Neetru-Version` abaixo do mínimo para a SDK major\r\n * corrente, o SDK emite `console.warn` uma única vez por sessão de processo.\r\n *\r\n * Atualize esta tabela a cada major de SDK.\r\n */\r\nconst COMPAT_MATRIX: Record<number, string> = {\r\n  // SDK major 3.x requer Core ≥ 2026.05.1 (suporte a X-Neetru-Version header,\r\n  // runTransaction write-after-read, verifyWebhookRequest, webhooks 3.0+)\r\n  3: '2026.05.1',\r\n};\r\n\r\n/** CalVer sem sufixo `+revision`. Ex: `2026.05.1+abc` → `2026.05.1`. */\r\nfunction stripRevision(v: string): string {\r\n  return v.split('+')[0] ?? v;\r\n}\r\n\r\n/**\r\n * Compara dois CalVer (`YYYY.MM.patch`). Retorna negativo se `a < b`,\r\n * positivo se `a > b`, 0 se iguais. Partes não numéricas tratadas como 0.\r\n */\r\nfunction compareCalVer(a: string, b: string): number {\r\n  const partsA = stripRevision(a).split('.').map(Number);\r\n  const partsB = stripRevision(b).split('.').map(Number);\r\n  const len = Math.max(partsA.length, partsB.length);\r\n  for (let i = 0; i < len; i++) {\r\n    const pa = partsA[i] ?? 0;\r\n    const pb = partsB[i] ?? 0;\r\n    if (pa !== pb) return pa - pb;\r\n  }\r\n  return 0;\r\n}\r\n\r\n/** Lê a SDK major a partir da string `VERSION` exportada de `./index`. Fallback 3. */\r\nfunction getSdkMajor(): number {\r\n  try {\r\n    // Importação estática não disponível aqui (evita ciclo). Usa variável injetada\r\n    // em tempo de build pela tsup via `define`. Fallback para 3 (current major).\r\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\r\n    const ver = (globalThis as any).__NEETRU_SDK_VERSION__ as string | undefined;\r\n    if (ver) return parseInt(ver.split('.')[0] ?? '3', 10);\r\n  } catch {\r\n    // ignore\r\n  }\r\n  return 3;\r\n}\r\n\r\n/** Aviso emitido no máximo uma vez por major detectada pra não spammar logs. */\r\nconst _warnedCoreTooOld = new Set<string>();\r\n\r\n/**\r\n * Verifica se a versão do Core (`X-Neetru-Version`) é compatível com a SDK major.\r\n * Emite `console.warn` quando incompatível (uma vez por processo por versão detectada).\r\n */\r\nexport function checkCoreVersionCompat(coreVersion: string): void {\r\n  if (!coreVersion) return;\r\n  const sdkMajor = getSdkMajor();\r\n  const minCore = COMPAT_MATRIX[sdkMajor];\r\n  if (!minCore) return; // sem restrição para esta major\r\n  const stripped = stripRevision(coreVersion);\r\n  if (compareCalVer(stripped, minCore) < 0) {\r\n    const key = `${sdkMajor}:${stripped}`;\r\n    if (!_warnedCoreTooOld.has(key)) {\r\n      _warnedCoreTooOld.add(key);\r\n      console.warn(\r\n        `[Neetru SDK] Atenção: Core versão \"${coreVersion}\" é anterior ao mínimo recomendado` +\r\n          ` \"${minCore}\" para SDK major ${sdkMajor}. Alguns recursos podem não funcionar` +\r\n          ` corretamente. Atualize o Core para a versão mais recente.`,\r\n      );\r\n    }\r\n  }\r\n}\r\n\r\n/** Opções da request HTTP. */\r\nexport interface HttpRequestOptions {\r\n  method?: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';\r\n  /** Path relativo (ex: `/api/v1/cli/catalog`). Concatenado a `baseUrl`. */\r\n  path: string;\r\n  /** Query string params (chave → valor primitivo). Valores `undefined` ignorados. */\r\n  query?: Record<string, string | number | boolean | undefined>;\r\n  /** Body JSON-serializável. Ignorado em GET/DELETE. */\r\n  body?: unknown;\r\n  /**\r\n   * Se true, injeta `Authorization: Bearer <apiKey>`. Lança `missing_api_key`\r\n   * se config.apiKey ausente. Default false.\r\n   */\r\n  requireAuth?: boolean;\r\n  /** Cabeçalhos extras. */\r\n  headers?: Record<string, string>;\r\n  /**\r\n   * Número de retries em códigos transientes (`rate_limited`, `server_error`,\r\n   * `network_error`).\r\n   *\r\n   * Default (3.0):\r\n   *   - GET/HEAD: 2 (= 3 tentativas total) — idempotente, seguro.\r\n   *   - POST/PUT/PATCH/DELETE: 0 — mutations podem duplicar side effects.\r\n   *\r\n   * Caller pode reativar passando explicitamente: `retries: 2`.\r\n   */\r\n  retries?: number;\r\n  /**\r\n   * Injeta `Idempotency-Key` header pra dedup serverside (3.0):\r\n   *   - `true` → SDK gera UUID v4 cripto-seguro automaticamente.\r\n   *   - string → usa o valor passado (deve ser UUID v4).\r\n   *   - `undefined`/`false` → sem header.\r\n   */\r\n  idempotencyKey?: boolean | string;\r\n}\r\n\r\nconst DEFAULT_RETRIES_READ = 2;\r\nconst DEFAULT_RETRIES_WRITE = 0;\r\nconst READ_METHODS = new Set(['GET', 'HEAD']);\r\nconst RETRYABLE_CODES = new Set<NeetruErrorCode>([\r\n  'rate_limited',\r\n  'server_error',\r\n  'network_error',\r\n]);\r\n\r\n/** Backoff exponencial com jitter ±20%. attempt: 0=primeira, 1=primeiro retry, ... */\r\nfunction backoffMs(attempt: number): number {\r\n  const base = 200 * Math.pow(4, attempt); // 200ms, 800ms, 3.2s, ...\r\n  const jitter = base * 0.2 * (Math.random() * 2 - 1);\r\n  return Math.max(50, Math.round(base + jitter));\r\n}\r\n\r\n/**\r\n * Honra `Retry-After` header (segundos ou HTTP-date). Retorna ms ou null se\r\n * inválido. RFC 9110 §10.2.3.\r\n *\r\n * Bug fix: sem teto, um servidor hostil/mal-configurado poderia retornar\r\n * `Retry-After: 86400` (24h) ou uma HTTP-date anos no futuro, pendurando o\r\n * processo indefinidamente. Aplica teto de MAX_RETRY_AFTER_MS em ambos os caminhos.\r\n */\r\nconst MAX_RETRY_AFTER_MS = 60_000; // 60s — teto razoável para retry automático\r\n\r\nfunction parseRetryAfter(value: string | null): number | null {\r\n  if (!value) return null;\r\n  const secs = Number(value);\r\n  if (Number.isFinite(secs) && secs >= 0) return Math.min(Math.round(secs * 1000), MAX_RETRY_AFTER_MS);\r\n  const dateMs = Date.parse(value);\r\n  if (Number.isFinite(dateMs)) {\r\n    const delta = dateMs - Date.now();\r\n    if (delta > 0) return Math.min(delta, MAX_RETRY_AFTER_MS);\r\n  }\r\n  return null;\r\n}\r\n\r\nfunction sleep(ms: number): Promise<void> {\r\n  return new Promise((resolve) => setTimeout(resolve, ms));\r\n}\r\n\r\n/** Mapeamento status → code estável do NeetruError. */\r\nfunction statusToCode(status: number): NeetruErrorCode {\r\n  if (status === 401) return 'unauthorized';\r\n  if (status === 403) return 'forbidden';\r\n  if (status === 404) return 'not_found';\r\n  if (status === 409) return 'conflict'; // Bug fix: 409 vira 'conflict' (não 'unknown')\r\n  if (status === 422 || status === 400) return 'validation_failed';\r\n  if (status === 429) return 'rate_limited';\r\n  if (status >= 500) return 'server_error';\r\n  return 'unknown';\r\n}\r\n\r\nfunction buildUrl(baseUrl: string, path: string, query?: HttpRequestOptions['query']): string {\r\n  // Trim trailing slash em base e leading em path pra evitar `//`.\r\n  const base = baseUrl.replace(/\\/+$/, '');\r\n  const p = path.startsWith('/') ? path : `/${path}`;\r\n  const url = new URL(`${base}${p}`);\r\n  if (query) {\r\n    for (const [k, v] of Object.entries(query)) {\r\n      if (v === undefined) continue;\r\n      url.searchParams.set(k, String(v));\r\n    }\r\n  }\r\n  return url.toString();\r\n}\r\n\r\n/** Parse JSON defensivo — retorna `undefined` em body vazio. */\r\nasync function safeJson(res: Response): Promise<unknown> {\r\n  const text = await res.text();\r\n  if (!text) return undefined;\r\n  try {\r\n    return JSON.parse(text);\r\n  } catch {\r\n    return undefined;\r\n  }\r\n}\r\n\r\n/**\r\n * Executa request HTTP. Em sucesso retorna body parseado; em erro lança\r\n * `NeetruError` com `code` derivado do status. Aplica retry/backoff\r\n * automático em códigos transientes (rate_limited/server_error/network_error)\r\n * conforme `opts.retries` (default 2 = 3 tentativas).\r\n */\r\nexport async function httpRequest<T>(\r\n  config: ResolvedConfig,\r\n  opts: HttpRequestOptions,\r\n): Promise<T> {\r\n  const method = opts.method ?? 'GET';\r\n  const url = buildUrl(config.baseUrl, opts.path, opts.query);\r\n  // Default por método: reads tentam 2x, writes 0x. Caller override sempre vence.\r\n  const defaultRetries = READ_METHODS.has(method)\r\n    ? DEFAULT_RETRIES_READ\r\n    : DEFAULT_RETRIES_WRITE;\r\n  const maxRetries = opts.retries ?? defaultRetries;\r\n\r\n  const headers: Record<string, string> = {\r\n    accept: 'application/json',\r\n    ...opts.headers,\r\n  };\r\n\r\n  if (opts.requireAuth) {\r\n    if (!config.apiKey) {\r\n      throw new NeetruError(\r\n        'missing_api_key',\r\n        'This operation requires an apiKey. Pass it to createNeetruClient({ apiKey }) or set NEETRU_API_KEY env var.',\r\n      );\r\n    }\r\n    headers.authorization = `Bearer ${config.apiKey}`;\r\n  }\r\n\r\n  // Idempotency-Key: gerado por chamada se solicitado. UUID v4 cripto-seguro.\r\n  if (opts.idempotencyKey) {\r\n    const key =\r\n      typeof opts.idempotencyKey === 'string'\r\n        ? opts.idempotencyKey\r\n        : generateIdempotencyKey();\r\n    headers['idempotency-key'] = key;\r\n  }\r\n\r\n  // Body só é serializado uma vez — reusado entre tentativas.\r\n  const bodyString =\r\n    opts.body !== undefined && method !== 'GET' && method !== 'DELETE'\r\n      ? JSON.stringify(opts.body)\r\n      : undefined;\r\n  if (bodyString !== undefined) {\r\n    headers['content-type'] = 'application/json';\r\n  }\r\n\r\n  let lastError: NeetruError | null = null;\r\n\r\n  for (let attempt = 0; attempt <= maxRetries; attempt++) {\r\n    const init: RequestInit = { method, headers };\r\n    if (bodyString !== undefined) init.body = bodyString;\r\n    // BUG-020 fix (2026-05-13): timeout default 30s. AbortSignal.timeout\r\n    // requer Node 18+ ou browsers recentes.\r\n    init.signal = AbortSignal.timeout(30_000);\r\n\r\n    let res: Response;\r\n    try {\r\n      res = await config.fetch(url, init);\r\n    } catch (err) {\r\n      const message =\r\n        err instanceof DOMException && err.name === 'TimeoutError'\r\n          ? 'Network error: timeout after 30s'\r\n          : `Network error: ${err instanceof Error ? err.message : 'fetch failed'}`;\r\n      lastError = new NeetruError('network_error', message);\r\n      if (attempt < maxRetries) {\r\n        await sleep(backoffMs(attempt));\r\n        continue;\r\n      }\r\n      throw lastError;\r\n    }\r\n\r\n    const requestId =\r\n      res.headers.get('x-request-id') ?? res.headers.get('x-correlation-id') ?? undefined;\r\n\r\n    if (res.ok) {\r\n      // Captura X-Neetru-Version e verifica compat com a SDK major.\r\n      const coreVersion = res.headers.get('x-neetru-version');\r\n      if (coreVersion) checkCoreVersionCompat(coreVersion);\r\n      const parsed = await safeJson(res);\r\n      return parsed as T;\r\n    }\r\n\r\n    const body = (await safeJson(res)) as\r\n      | { error?: { code?: string; message?: string } | string }\r\n      | undefined;\r\n    let code: string = statusToCode(res.status);\r\n    let message = `HTTP ${res.status}`;\r\n    if (body && typeof body === 'object' && 'error' in body) {\r\n      const errField = body.error;\r\n      if (typeof errField === 'string') {\r\n        message = errField;\r\n      } else if (errField && typeof errField === 'object') {\r\n        if (typeof errField.code === 'string') code = errField.code;\r\n        if (typeof errField.message === 'string') message = errField.message;\r\n      }\r\n    }\r\n    const err = new NeetruError(code, message, res.status, requestId);\r\n    lastError = err;\r\n\r\n    const isRetryable = RETRYABLE_CODES.has(code as NeetruErrorCode);\r\n    if (isRetryable && attempt < maxRetries) {\r\n      const retryAfter = parseRetryAfter(res.headers.get('retry-after'));\r\n      const delay = retryAfter ?? backoffMs(attempt);\r\n      await sleep(delay);\r\n      continue;\r\n    }\r\n    throw err;\r\n  }\r\n\r\n  // Unreachable — loop sempre retorna ou lança. Safety net.\r\n  throw lastError ?? new NeetruError('unknown', 'unexpected httpRequest exit');\r\n}\r\n","/**\n * Validators centralizados pra inputs do SDK que precisam casar com\n * regex do Core.\n *\n * **M-03 fix (Opus review 2026-05-27):** o Core rejeita productId que\n * não bate `/^[a-z0-9][a-z0-9_-]{0,62}$/` com 400 `validation_failed`.\n * O SDK não pré-validava — consumer recebia erro só em runtime de\n * produção, depois do round-trip de rede. Agora SDK throws localmente\n * antes do fetch.\n */\nimport { NeetruError } from './errors';\n\n/**\n * Regex canonical de IDs no Neetru Core (productId, tenantId, etc).\n * Espelha `SDK_ID_RE` em `neetru_core/src/lib/schemas/sdk.ts`.\n */\nexport const SDK_ID_RE = /^[a-z0-9][a-z0-9_-]{0,62}$/;\n\n/**\n * Throws `NeetruError('validation_failed')` se `value` não bater no\n * formato canonical.\n *\n * @example\n * ```ts\n * assertValidSdkId('productId', 'gestovendas');  // ok\n * assertValidSdkId('productId', 'GestoVendas');  // throws\n * ```\n */\nexport function assertValidSdkId(field: string, value: string): void {\n  if (typeof value !== 'string' || !SDK_ID_RE.test(value)) {\n    throw new NeetruError(\n      'validation_failed',\n      `${field} must match ${SDK_ID_RE.source} (lowercase alphanumeric, _, -; first char must be alphanumeric; max 63 chars)`,\n    );\n  }\n}\n","/**\n * Usage namespace — meterar consumo e verificar entitlements (3.0 — breaking).\n *\n * **Mudanças 3.0:**\n *   - Paths canônicos `/api/sdk/v1/*` (eram `/sdk/v1/*` errados).\n *   - `track(event, props)` **REMOVIDO** — Core não aceita esse shape; era\n *     vaporware testado contra mock fetch. Use `report(resource, qty, opts)`.\n *   - `getQuota(metric)` **REMOVIDO** — endpoint `/usage/quota` nunca existiu\n *     no Core. `report()` já devolve `{value, limit, remaining}` em todo POST.\n *   - `report()` e `check()` **agora exigem** `productId` + `tenantId`\n *     (no contexto do client OU passados nas options).\n *   - `report()` envia `Idempotency-Key` automaticamente (anti dup de\n *     incremento em retry transient — Core dedup TTL 24h).\n *\n * Endpoints consumidos:\n *   - `POST /api/sdk/v1/usage/record` — `{productId, tenantId, resource, qty}`.\n *     Incrementa `usage_counters/{tenantId}_{productId}_{resource}_{yyyymm}.value`.\n *   - `GET  /api/sdk/v1/entitlements?productId&tenantId&feature` — read-only\n *     check de plano + remaining (cache HTTP 60s).\n *\n * Comportamento por env:\n *   - `dev` → MockUsage (in-memory, retornado pelo factory).\n *   - `workspace`/`prod` → HTTP real.\n */\nimport { NeetruError } from './errors';\nimport { httpRequest } from './http';\nimport { assertValidSdkId } from './validators';\nimport type { ResolvedConfig, UsageNamespace } from './types';\n\nexport function createUsageNamespace(config: ResolvedConfig): UsageNamespace {\n  return {\n    /**\n     * Reporta consumo metered de um resource. Hit no endpoint canônico\n     * `POST /api/sdk/v1/usage/record`. Idempotency-Key gerado por chamada;\n     * Core dedup serverside TTL 24h.\n     *\n     * @example\n     * ```ts\n     * await client.usage.report('api_call', 1);\n     * // ou explicit:\n     * await client.usage.report('api_call', 5, { productId: 'gestovendas', tenantId: 't-acme' });\n     * ```\n     */\n    async report(\n      resource: string,\n      qty: number = 1,\n      options?: { productId?: string; tenantId?: string },\n    ) {\n      if (!resource || typeof resource !== 'string') {\n        throw new NeetruError('validation_failed', 'resource is required');\n      }\n      if (!Number.isFinite(qty) || qty <= 0) {\n        throw new NeetruError('validation_failed', 'qty must be positive integer');\n      }\n      const productId = options?.productId ?? config.productId;\n      const tenantId = options?.tenantId ?? config.tenantId;\n      if (!productId) {\n        throw new NeetruError(\n          'validation_failed',\n          'productId required (pass to options or set on createNeetruClient)',\n        );\n      }\n      if (!tenantId) {\n        throw new NeetruError(\n          'validation_failed',\n          'tenantId required (pass to options or set on createNeetruClient)',\n        );\n      }\n      // M-03: valida formato canonical (case-insensitive Core já rejeitaria com 400).\n      assertValidSdkId('productId', productId);\n      assertValidSdkId('tenantId', tenantId);\n\n      const raw = await httpRequest<{\n        ok?: boolean;\n        counterId?: string;\n        value?: number;\n        limit?: number;\n        remaining?: number;\n        status?: string;\n      }>(config, {\n        method: 'POST',\n        path: '/api/sdk/v1/usage/record',\n        body: { productId, tenantId, resource, qty: Math.floor(qty) },\n        requireAuth: true,\n        idempotencyKey: true,\n      });\n      if (!raw || raw.ok !== true) {\n        throw new NeetruError('invalid_response', 'usage.report response missing ok');\n      }\n      return {\n        ok: true as const,\n        counterId: raw.counterId,\n        value: raw.value,\n        limit: raw.limit,\n        remaining: raw.remaining,\n        status: raw.status,\n      };\n    },\n\n    /**\n     * Verifica entitlement de um resource via `GET /api/sdk/v1/entitlements`.\n     * Resposta inclui `allowed`, `reason` ('granted' | 'not_subscribed' |\n     * 'subscription_inactive' | 'feature_not_in_plan' | 'limit_exceeded'),\n     * `remaining`, `limit`, `planId`, `planFeatures`.\n     */\n    async check(\n      resource: string,\n      options?: { productId?: string; tenantId?: string },\n    ) {\n      if (!resource || typeof resource !== 'string') {\n        throw new NeetruError('validation_failed', 'resource is required');\n      }\n      const productId = options?.productId ?? config.productId;\n      const tenantId = options?.tenantId ?? config.tenantId;\n      if (!productId || !tenantId) {\n        throw new NeetruError(\n          'validation_failed',\n          'productId and tenantId required (pass to options or set on createNeetruClient)',\n        );\n      }\n      // M-03: valida formato canonical antes do fetch.\n      assertValidSdkId('productId', productId);\n      assertValidSdkId('tenantId', tenantId);\n\n      const raw = await httpRequest<{\n        allowed?: boolean;\n        reason?: string;\n        remaining?: number;\n        limit?: number;\n        planId?: string | null;\n        planFeatures?: string[];\n        behavior?: 'readonly' | null;\n      }>(config, {\n        method: 'GET',\n        path: '/api/sdk/v1/entitlements',\n        query: { productId, tenantId, feature: resource },\n        requireAuth: true,\n      });\n      if (!raw || typeof raw.allowed !== 'boolean') {\n        throw new NeetruError('invalid_response', 'usage.check response missing allowed');\n      }\n      // Infere behavior='readonly' quando reason='limit_exceeded' e Core\n      // ainda não devolve o field explicitamente (vide CORE_CHANGES_REQUIRED §4).\n      const behavior =\n        raw.behavior ?? (raw.reason === 'limit_exceeded' ? 'readonly' : null);\n      return {\n        allowed: raw.allowed,\n        reason: raw.reason,\n        remaining: raw.remaining,\n        limit: raw.limit,\n        planId: raw.planId,\n        planFeatures: raw.planFeatures,\n        behavior,\n      };\n    },\n  };\n}\n"]}