@neetru/sdk 3.4.3 → 3.4.4

package/dist/react.d.cts

@@ -1,5 +1,5 @@
 import * as React from 'react';
-import { W as NeetruClient, t as CheckoutStartResult, l as AuthNamespace, a5 as NeetruUser } from './types-D-QdG502.cjs';
+import { W as NeetruClient, t as CheckoutStartResult, l as AuthNamespace, a5 as NeetruUser } from './types-Dw0fqhHm.cjs';
 import { CollectionReference, Query, DocumentReference } from './firestore-compat.cjs';
 import 'drizzle-orm/node-postgres';
 import './errors.cjs';
@@ -121,8 +121,27 @@ declare function NeetruAccountBar({ client, currentProductSlug, settingsUrl, onS
  */
 
 interface CheckoutLinkProps extends Omit<React.AnchorHTMLAttributes<HTMLAnchorElement>, 'href' | 'onClick' | 'onError'> {
-    /** Cliente SDK Neetru. Passado explicitamente pra evitar context provider. */
-    client: NeetruClient;
+    /**
+     * Cliente SDK Neetru. Passado explicitamente pra evitar context provider.
+     *
+     * **Opcional** quando `startPath` é usado (padrão BFF/cookie recomendado): o
+     * browser não tem token nem client, o start acontece no route BFF do app.
+     * Obrigatório no modo legado (client-side start), quando o browser tem o token.
+     */
+    client?: NeetruClient;
+    /**
+     * **BFF/cookie (padrão recomendado):** path do route do PRÓPRIO app que inicia
+     * o checkout server-side (ex: `/api/checkout/start`). Quando presente, o clique
+     * faz `POST` nesse path (same-origin, `credentials: 'include'` → manda o cookie
+     * httpOnly de sessão), o route lê o id_token do cookie e chama o Core
+     * server-side, devolvendo `{ redirectUrl }`. Assim o **browser nunca precisa do
+     * access_token** — que no padrão BFF é descartado no servidor.
+     *
+     * A resposta esperada do route BFF é `{ redirectUrl, intentId?, status?,
+     * expiresAt?, requiresKyc? }` (ou `{ intent: { redirectUrl, ... } }`). Sem
+     * `startPath`, o componente cai no modo legado `client.checkout.start()`.
+     */
+    startPath?: string;
     /** Slug do produto (ex: `neetru-pulse`). */
     productId: string;
     /** Plan id (ex: `pro_monthly`). */
@@ -144,12 +163,16 @@ interface CheckoutLinkProps extends Omit<React.AnchorHTMLAttributes<HTMLAnchorEl
     href?: string;
 }
 /**
- * Wrapper de `<a>` que dispara `client.checkout.start()` no click.
+ * Wrapper de `<a>` que inicia o checkout no click.
  *
- * Uso típico:
+ * Dois modos:
+ *
+ * **1. BFF/cookie (recomendado)** — passe `startPath`. O browser NÃO precisa de
+ * token; o clique faz `POST` no route do seu app, que inicia o checkout
+ * server-side com o id_token do cookie httpOnly:
  * ```tsx
  * <CheckoutLink
- *   client={client}
+ *   startPath="/api/checkout/start"
  *   productId="meu-saas"
  *   planId="pro_monthly"
  *   callbackUrl="https://meu-saas.com/billing/success"
@@ -158,10 +181,18 @@ interface CheckoutLinkProps extends Omit<React.AnchorHTMLAttributes<HTMLAnchorEl
  * </CheckoutLink>
  * ```
  *
+ * **2. Legado (client-side)** — passe `client`. Só funciona se o browser tiver o
+ * token (SPA não-BFF que guarda o access_token no browser). Chama
+ * `client.checkout.start()` direto:
+ * ```tsx
+ * <CheckoutLink client={client} productId="meu-saas" planId="pro_monthly"
+ *   callbackUrl="https://meu-saas.com/billing/success">Assinar Pro</CheckoutLink>
+ * ```
+ *
  * `href` é stub (`#`) — preventDefault no click. Mantido pra a11y / preview
  * de URL no hover (pode ser sobrescrito via prop spread).
  */
-declare function CheckoutLink({ client, productId, planId, callbackUrl, tenantType, tenantId, children, onIntentCreated, onError, noAutoRedirect, ...rest }: CheckoutLinkProps): React.ReactElement;
+declare function CheckoutLink({ client, startPath, productId, planId, callbackUrl, tenantType, tenantId, children, onIntentCreated, onError, noAutoRedirect, ...rest }: CheckoutLinkProps): React.ReactElement;
 interface NeetruLoginButtonProps extends Omit<React.ButtonHTMLAttributes<HTMLButtonElement>, 'onClick' | 'onError' | 'children' | 'style'> {
     /** Cliente SDK Neetru. Passado explicitamente pra evitar context provider. */
     client: NeetruClient;

package/dist/react.d.ts

@@ -1,5 +1,5 @@
 import * as React from 'react';
-import { W as NeetruClient, t as CheckoutStartResult, l as AuthNamespace, a5 as NeetruUser } from './types-BlOLDMR0.js';
+import { W as NeetruClient, t as CheckoutStartResult, l as AuthNamespace, a5 as NeetruUser } from './types-Bzxb5rlF.js';
 import { CollectionReference, Query, DocumentReference } from './firestore-compat.js';
 import 'drizzle-orm/node-postgres';
 import './errors.js';
@@ -121,8 +121,27 @@ declare function NeetruAccountBar({ client, currentProductSlug, settingsUrl, onS
  */
 
 interface CheckoutLinkProps extends Omit<React.AnchorHTMLAttributes<HTMLAnchorElement>, 'href' | 'onClick' | 'onError'> {
-    /** Cliente SDK Neetru. Passado explicitamente pra evitar context provider. */
-    client: NeetruClient;
+    /**
+     * Cliente SDK Neetru. Passado explicitamente pra evitar context provider.
+     *
+     * **Opcional** quando `startPath` é usado (padrão BFF/cookie recomendado): o
+     * browser não tem token nem client, o start acontece no route BFF do app.
+     * Obrigatório no modo legado (client-side start), quando o browser tem o token.
+     */
+    client?: NeetruClient;
+    /**
+     * **BFF/cookie (padrão recomendado):** path do route do PRÓPRIO app que inicia
+     * o checkout server-side (ex: `/api/checkout/start`). Quando presente, o clique
+     * faz `POST` nesse path (same-origin, `credentials: 'include'` → manda o cookie
+     * httpOnly de sessão), o route lê o id_token do cookie e chama o Core
+     * server-side, devolvendo `{ redirectUrl }`. Assim o **browser nunca precisa do
+     * access_token** — que no padrão BFF é descartado no servidor.
+     *
+     * A resposta esperada do route BFF é `{ redirectUrl, intentId?, status?,
+     * expiresAt?, requiresKyc? }` (ou `{ intent: { redirectUrl, ... } }`). Sem
+     * `startPath`, o componente cai no modo legado `client.checkout.start()`.
+     */
+    startPath?: string;
     /** Slug do produto (ex: `neetru-pulse`). */
     productId: string;
     /** Plan id (ex: `pro_monthly`). */
@@ -144,12 +163,16 @@ interface CheckoutLinkProps extends Omit<React.AnchorHTMLAttributes<HTMLAnchorEl
     href?: string;
 }
 /**
- * Wrapper de `<a>` que dispara `client.checkout.start()` no click.
+ * Wrapper de `<a>` que inicia o checkout no click.
  *
- * Uso típico:
+ * Dois modos:
+ *
+ * **1. BFF/cookie (recomendado)** — passe `startPath`. O browser NÃO precisa de
+ * token; o clique faz `POST` no route do seu app, que inicia o checkout
+ * server-side com o id_token do cookie httpOnly:
  * ```tsx
  * <CheckoutLink
- *   client={client}
+ *   startPath="/api/checkout/start"
  *   productId="meu-saas"
  *   planId="pro_monthly"
  *   callbackUrl="https://meu-saas.com/billing/success"
@@ -158,10 +181,18 @@ interface CheckoutLinkProps extends Omit<React.AnchorHTMLAttributes<HTMLAnchorEl
  * </CheckoutLink>
  * ```
  *
+ * **2. Legado (client-side)** — passe `client`. Só funciona se o browser tiver o
+ * token (SPA não-BFF que guarda o access_token no browser). Chama
+ * `client.checkout.start()` direto:
+ * ```tsx
+ * <CheckoutLink client={client} productId="meu-saas" planId="pro_monthly"
+ *   callbackUrl="https://meu-saas.com/billing/success">Assinar Pro</CheckoutLink>
+ * ```
+ *
  * `href` é stub (`#`) — preventDefault no click. Mantido pra a11y / preview
  * de URL no hover (pode ser sobrescrito via prop spread).
  */
-declare function CheckoutLink({ client, productId, planId, callbackUrl, tenantType, tenantId, children, onIntentCreated, onError, noAutoRedirect, ...rest }: CheckoutLinkProps): React.ReactElement;
+declare function CheckoutLink({ client, startPath, productId, planId, callbackUrl, tenantType, tenantId, children, onIntentCreated, onError, noAutoRedirect, ...rest }: CheckoutLinkProps): React.ReactElement;
 interface NeetruLoginButtonProps extends Omit<React.ButtonHTMLAttributes<HTMLButtonElement>, 'onClick' | 'onError' | 'children' | 'style'> {
     /** Cliente SDK Neetru. Passado explicitamente pra evitar context provider. */
     client: NeetruClient;

package/dist/react.mjs

@@ -588,8 +588,44 @@ function normalizeOp(op) {
 }
 
 // src/react.ts
+async function startCheckoutViaBff(startPath, input) {
+  const res = await fetch(startPath, {
+    method: "POST",
+    headers: { "content-type": "application/json", accept: "application/json" },
+    credentials: "include",
+    body: JSON.stringify(input)
+  });
+  let payload = null;
+  try {
+    payload = await res.json();
+  } catch {
+    payload = null;
+  }
+  if (!res.ok) {
+    const p = payload;
+    const msg = p && (typeof p.error === "object" && p.error?.message || typeof p.error === "string" && p.error || typeof p.message === "string" && p.message) || `Checkout BFF respondeu HTTP ${res.status}`;
+    throw new Error(typeof msg === "string" ? msg : `Checkout BFF respondeu HTTP ${res.status}`);
+  }
+  const intent = payload?.intent ?? payload ?? {};
+  const redirectUrl = payload?.redirectUrl ?? intent.redirectUrl;
+  if (!redirectUrl || typeof redirectUrl !== "string") {
+    throw new Error("Resposta do route BFF de checkout sem `redirectUrl`.");
+  }
+  return {
+    intentId: String(payload?.intentId ?? intent.intentId ?? ""),
+    redirectUrl,
+    status: payload?.status ?? intent.status ?? "pending",
+    expiresAt: typeof payload?.expiresAt === "string" ? payload.expiresAt : typeof intent.expiresAt === "string" ? intent.expiresAt : "",
+    requiresKyc: payload?.requiresKyc === true || intent.requiresKyc === true
+  };
+}
+function checkoutRedirect(url) {
+  const loc = globalThis.location;
+  if (loc && typeof loc.assign === "function") loc.assign(url);
+}
 function CheckoutLink({
   client,
+  startPath,
   productId,
   planId,
   callbackUrl,
@@ -602,13 +638,36 @@ function CheckoutLink({
   ...rest
 }) {
   const [submitting, setSubmitting] = React2.useState(false);
-  const checkout = client.checkout;
+  const checkout = client?.checkout;
   const handleClick = React2.useCallback(
     async (event) => {
       event.preventDefault();
       if (submitting) return;
+      if (startPath) {
+        setSubmitting(true);
+        try {
+          const result = await startCheckoutViaBff(startPath, {
+            productId,
+            planId,
+            callbackUrl,
+            tenantType,
+            tenantId
+          });
+          onIntentCreated?.(result);
+          if (!noAutoRedirect) checkoutRedirect(result.redirectUrl);
+        } catch (err) {
+          onError?.(err instanceof Error ? err : new Error(String(err)));
+        } finally {
+          setSubmitting(false);
+        }
+        return;
+      }
       if (!checkout || typeof checkout.start !== "function") {
-        onError?.(new Error("SDK client missing `checkout` namespace. Upgrade @neetru/sdk to 1.1+."));
+        onError?.(
+          new Error(
+            "CheckoutLink: passe `startPath` (padr\xE3o BFF/cookie recomendado) OU um `client` com o namespace `checkout` (SDK 1.1+)."
+          )
+        );
         return;
       }
       setSubmitting(true);
@@ -628,7 +687,7 @@ function CheckoutLink({
         setSubmitting(false);
       }
     },
-    [submitting, checkout, productId, planId, callbackUrl, tenantType, tenantId, noAutoRedirect, onIntentCreated, onError]
+    [submitting, checkout, startPath, productId, planId, callbackUrl, tenantType, tenantId, noAutoRedirect, onIntentCreated, onError]
   );
   return React2.createElement(
     "a",