@neetru/sdk 3.4.4 → 3.4.5

package/CHANGELOG.md

@@ -5,6 +5,25 @@ All notable changes to `@neetru/sdk` will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.4.5] - 2026-09-12 — **fix(telemetry): event()/track() usáveis no browser (401 silencioso em produção)**
+
+Release **patch** (correção de bug — `client.telemetry.event()`/`.track()` documentados como uso client-side de alta frequência, mas nunca funcionaram de fato no browser).
+
+### Contexto
+
+`event()`/`track()` só chamavam `POST /api/sdk/v1/telemetry/event`, que exige `Bearer` com `cli_api_keys` — credencial de operador que nunca deveria estar no browser. Resultado real em produção (achado 2026-09-09, `pdvagiliza.neetru.com`): 401 silencioso, telemetria de UI nunca persistida. Compondo o problema, `productSlug` nunca era enviado no body de nenhum dos dois métodos (só `log()` já mandava) — o Core exige `productSlug` fail-closed, então mesmo corrigindo a auth o evento seria rejeitado.
+
+### Corrigido
+
+- **`event()`/`track()` agora enviam `productSlug`** no body (`input.productSlug ?? config.productId`, mesmo default de `log()`/`usage.report()`).
+- **Roteamento browser vs server**: em contexto browser (`typeof window !== 'undefined'`), `event()`/`track()` chamam o novo `POST /api/sdk/v1/telemetry/event/public` do Core (sem Bearer — autoriza via `Origin`, não credencial). Server-side continua no endpoint autenticado original, sem mudança de comportamento.
+
+### Adicionado (aditivo, opcional)
+
+- **`TelemetryEventInput.productSlug?: string`** — override explícito, mesmo padrão de `TelemetryLogInput.productSlug`.
+
+Requer Core com a rota `/api/sdk/v1/telemetry/event/public` (PR companion `Neetru/neetru-core#448`) para o caminho browser funcionar; server-side não tem dependência nova.
+
 ## [3.4.4] - 2026-09-07 — **fix(checkout): aceitar id_token no padrão BFF/cookie (desbloqueia checkout PAGO)**
 
 Release **patch** (correção de bug que bloqueava 100% do checkout PAGO no padrão BFF/cookie; aditivos opcionais retrocompatíveis, nenhuma remoção de API, nenhuma mudança de wire além de um header aceito a mais). Bug `bug_72ccf42065304d3384aa3ed09accef8d` (HIGH).

package/dist/ai.d.cts

@@ -1,3 +1,3 @@
-export { A as AiChatChoice, a as AiChatMessage, b as AiChatOptions, c as AiChatResult, d as AiChatUsage, e as AiContentPart, f as AiImageUrlPart, g as AiNamespace, h as AiResponseFormat, i as AiStreamHandle, j as AiStreamMeta, k as AiTextPart, aJ as createAiNamespace } from './types-Dw0fqhHm.cjs';
+export { A as AiChatChoice, a as AiChatMessage, b as AiChatOptions, c as AiChatResult, d as AiChatUsage, e as AiContentPart, f as AiImageUrlPart, g as AiNamespace, h as AiResponseFormat, i as AiStreamHandle, j as AiStreamMeta, k as AiTextPart, aJ as createAiNamespace } from './types-DIVZl7nO.cjs';
 import 'drizzle-orm/node-postgres';
 import './errors.cjs';

package/dist/ai.d.ts

@@ -1,3 +1,3 @@
-export { A as AiChatChoice, a as AiChatMessage, b as AiChatOptions, c as AiChatResult, d as AiChatUsage, e as AiContentPart, f as AiImageUrlPart, g as AiNamespace, h as AiResponseFormat, i as AiStreamHandle, j as AiStreamMeta, k as AiTextPart, aJ as createAiNamespace } from './types-Bzxb5rlF.js';
+export { A as AiChatChoice, a as AiChatMessage, b as AiChatOptions, c as AiChatResult, d as AiChatUsage, e as AiContentPart, f as AiImageUrlPart, g as AiNamespace, h as AiResponseFormat, i as AiStreamHandle, j as AiStreamMeta, k as AiTextPart, aJ as createAiNamespace } from './types-nnztVk7G.js';
 import 'drizzle-orm/node-postgres';
 import './errors.js';

package/dist/auth.cjs

@@ -1273,6 +1273,12 @@ function createEntitlementsNamespace(config) {
 init_errors();
 init_http();
 var VALID_LOG_LEVELS = ["debug", "info", "warn", "error", "fatal"];
+function isBrowserContext() {
+  return typeof globalThis !== "undefined" && typeof globalThis.window !== "undefined";
+}
+function resolveEventTransport() {
+  return isBrowserContext() ? { path: "/api/sdk/v1/telemetry/event/public", requireAuth: false } : { path: "/api/sdk/v1/telemetry/event", requireAuth: true };
+}
 function consoleFor(level) {
   switch (level) {
     case "debug":
@@ -1302,15 +1308,18 @@ function createTelemetryNamespace(config) {
       batch.map(async (ev) => {
         try {
           const body = { name: ev.name };
+          const productSlug = ev.productSlug ?? config.productId;
+          if (productSlug) body.productSlug = productSlug;
           if (ev.properties && typeof ev.properties === "object") {
             body.properties = ev.properties;
           }
           if (ev.timestamp) body.timestamp = ev.timestamp;
+          const transport = resolveEventTransport();
           await httpRequest(config, {
             method: "POST",
-            path: "/api/sdk/v1/telemetry/event",
+            path: transport.path,
             body,
-            requireAuth: true,
+            requireAuth: transport.requireAuth,
             retries: 1,
             // caça-bruxas: retry sem Idempotency-Key duplicava o evento se o
             // servidor já tinha persistido antes da falha transiente. Mesmo
@@ -1363,15 +1372,18 @@ function createTelemetryNamespace(config) {
         throw new NeetruError("validation_failed", "event.name max 128 chars");
       }
       const body = { name: input.name };
+      const productSlug = input.productSlug ?? config.productId;
+      if (productSlug) body.productSlug = productSlug;
       if (input.properties && typeof input.properties === "object") {
         body.properties = input.properties;
       }
       if (input.timestamp) body.timestamp = input.timestamp;
+      const transport = resolveEventTransport();
       const raw = await httpRequest(config, {
         method: "POST",
-        path: "/api/sdk/v1/telemetry/event",
+        path: transport.path,
         body,
-        requireAuth: true
+        requireAuth: transport.requireAuth
       });
       if (!raw || raw.ok !== true || typeof raw.eventId !== "string") {
         throw new NeetruError("invalid_response", "Telemetry response missing eventId");