@neetru/sdk 3.4.7 → 3.6.0

package/dist/index.d.cts

@@ -1,9 +1,37 @@
 export { createNeetruClient, getServerNeetruClient } from './auth.cjs';
 export { NeetruError, NeetruErrorCode } from './errors.cjs';
-export { A as AiChatChoice, a as AiChatMessage, b as AiChatOptions, c as AiChatResult, d as AiChatUsage, e as AiContentPart, f as AiImageUrlPart, g as AiNamespace, h as AiResponseFormat, i as AiStreamHandle, j as AiStreamMeta, k as AiTextPart, l as AuthNamespace, m as AuthStateListener, C as CatalogListOptions, n as CatalogListResponse, p as CheckoutIntentInfo, q as CheckoutIntentStatus, r as CheckoutNamespace, s as CheckoutStartInput, t as CheckoutStartResult, u as CheckoutTenantType, v as CompleteSignInResult, y as CreateTicketInput, D as DEFAULT_BASE_URL, z as DbBatchOp, B as DbChangeType, E as DbCollectionRef, F as DbDoc, G as DbDocRef, H as DbGetResult, I as DbListResult, J as DbNamespace, K as DbQuery, L as DbSqlLease, M as DbWhereFilter, O as EntitlementCheck, P as FieldSentinel, Q as IncrementSentinel, R as ListNotificationsOptions, S as MockCheckout, T as MockNotifications, U as MockWebhooks, V as NEETRU_SENTINEL_KEY, W as NeetruClient, X as NeetruClientConfig, Y as NeetruDb, _ as NeetruDbEngine, $ as NeetruDbError, a0 as NeetruDbErrorCode, a1 as NeetruDbOptions, a2 as NeetruDbTransport, a3 as NeetruEnv, a4 as NeetruSqlClient, a5 as NeetruUser, a6 as NotificationScopeOptions, a7 as NotificationsNamespace, a8 as Product, a9 as ProductNotification, aa as ProductNotificationSeverity, ab as ProductPlan, ac as ProductStatus, ae as RedirectCallbackResult, af as RegisterWebhookInput, ag as ResolvedConfig, ah as SendNotificationInput, ai as ServerTimestampSentinel, aj as SignInOptions, al as SupportNamespace, am as SupportSeverity, an as SupportStatus, ao as SupportTicket, ar as TelemetryEventAck, as as TelemetryEventInput, aw as UsageEventInput, ax as UsageNamespace, ay as UsageQuota, az as VerifyTokenOptions, aA as VerifyWebhookRequestOptions, aB as VerifyWebhookRequestResult, aC as WebhookEndpoint, aD as WebhookEvent, aE as WebhookScopeOptions, aF as WebhookTestResult, aG as WebhooksNamespace, aH as WithFieldSentinels, aJ as createAiNamespace, aK as createCheckoutNamespace, aL as createNeetruDb, aM as createNotificationsNamespace, aO as createWebhooksNamespace, aQ as increment, aR as isFieldSentinel, aS as isIncrementSentinel, aT as isServerTimestampSentinel, aU as serverTimestamp, aV as verifyWebhookRequest, aW as verifyWebhookSignature } from './types-DIVZl7nO.cjs';
+export { A as AiChatChoice, a as AiChatMessage, b as AiChatOptions, c as AiChatResult, d as AiChatUsage, e as AiContentPart, f as AiImageUrlPart, g as AiNamespace, h as AiResponseFormat, i as AiStreamHandle, j as AiStreamMeta, k as AiTextPart, l as AuthNamespace, m as AuthStateListener, C as CatalogListOptions, n as CatalogListResponse, p as CheckoutIntentInfo, q as CheckoutIntentStatus, r as CheckoutNamespace, s as CheckoutStartInput, t as CheckoutStartResult, u as CheckoutTenantType, v as CompleteSignInResult, y as CreateTicketInput, D as DEFAULT_BASE_URL, z as DbBatchOp, B as DbChangeType, E as DbCollectionRef, F as DbDoc, G as DbDocRef, H as DbGetResult, I as DbListResult, J as DbNamespace, K as DbQuery, L as DbSqlLease, M as DbWhereFilter, O as EntitlementCheck, P as FieldSentinel, Q as IncrementSentinel, R as ListNotificationsOptions, S as MockCheckout, T as MockNotifications, U as MockWebhooks, V as NEETRU_SENTINEL_KEY, W as NeetruClient, X as NeetruClientConfig, Y as NeetruDb, _ as NeetruDbEngine, $ as NeetruDbError, a0 as NeetruDbErrorCode, a1 as NeetruDbOptions, a2 as NeetruDbTransport, a3 as NeetruEnv, a4 as NeetruSqlClient, a5 as NeetruUser, a6 as NotificationScopeOptions, a7 as NotificationsNamespace, a8 as Product, a9 as ProductNotification, aa as ProductNotificationSeverity, ab as ProductPlan, ac as ProductStatus, ae as RedirectCallbackResult, af as RegisterWebhookInput, ag as ResolvedConfig, ah as SendNotificationInput, ai as ServerTimestampSentinel, aj as SignInOptions, al as SupportNamespace, am as SupportSeverity, an as SupportStatus, ao as SupportTicket, ar as TelemetryEventAck, as as TelemetryEventInput, aw as UsageEventInput, ax as UsageNamespace, ay as UsageQuota, az as VerifyTokenOptions, aA as VerifyWebhookRequestOptions, aB as VerifyWebhookRequestResult, aC as WebhookEndpoint, aD as WebhookEvent, aE as WebhookScopeOptions, aF as WebhookTestResult, aG as WebhooksNamespace, aH as WithFieldSentinels, aJ as createAiNamespace, aK as createCheckoutNamespace, aL as createNeetruDb, aM as createNotificationsNamespace, aO as createWebhooksNamespace, aQ as increment, aR as isFieldSentinel, aS as isIncrementSentinel, aT as isServerTimestampSentinel, aU as serverTimestamp, aV as verifyWebhookRequest, aW as verifyWebhookSignature } from './types-Du_iioJ7.cjs';
 export { DEV_FIXTURE_USER, MockAi, MockAuth, MockAuthOptions, MockDb, MockEntitlements, MockSupport, MockUsage } from './mocks.cjs';
 import 'drizzle-orm/node-postgres';
 
+/**
+ * HTTP transport interno do SDK.
+ *
+ * Responsabilidades:
+ *   - Construir URL absoluta a partir de `baseUrl` + path
+ *   - Injetar Bearer token quando `requireAuth=true`
+ *   - Mapear status HTTP → `NeetruError` com `code` estável
+ *   - Parse defensivo de JSON (não lança em body vazio em 204)
+ *   - Retry/backoff exponencial em `rate_limited` (429), `server_error` (5xx)
+ *     e `network_error` (timeout/falha de rede). Honra `Retry-After` quando
+ *     presente.
+ *   - **Captura `X-Neetru-Version`** das respostas e emite `console.warn` quando
+ *     o Core está abaixo da versão mínima para a major do SDK.
+ *
+ * Política de retries (mudança breaking 3.0):
+ *   - GET/HEAD: default 2 retries (3 tentativas total) — idempotente, seguro.
+ *   - POST/PUT/PATCH/DELETE: default **0 retries** — mutations podem duplicar
+ *     side effects (ex: `usage.report` incrementa contador). Caller pode
+ *     reativar passando `retries: N` explicitamente ou usar `Idempotency-Key`
+ *     header (gerado automaticamente se `opts.idempotencyKey=true`).
+ *
+ * Idempotency-Key (3.0):
+ *   - `opts.idempotencyKey === true` → SDK gera UUID v4 e injeta header.
+ *   - `opts.idempotencyKey === 'uuid-string'` → usa o valor passado.
+ *   - Caller mantém retentos client-side se quiser; Core dedup serverside
+ *     (vide `docs/CORE_CHANGES_REQUIRED.md` §2).
+ */
+
 /**
  * Verifica se a versão do Core (`X-Neetru-Version`) é compatível com a SDK major.
  * Emite `console.warn` quando incompatível (uma vez por processo por versão detectada).
@@ -42,6 +70,6 @@ declare function checkCoreVersionCompat(coreVersion: string): void;
  */
 
 /** Versão do SDK — exportada explicitamente pra detecção em runtime. */
-declare const VERSION: "3.4.6";
+declare const VERSION: "3.6.0";
 
 export { VERSION, checkCoreVersionCompat };

package/dist/index.d.ts

@@ -1,9 +1,37 @@
 export { createNeetruClient, getServerNeetruClient } from './auth.js';
 export { NeetruError, NeetruErrorCode } from './errors.js';
-export { A as AiChatChoice, a as AiChatMessage, b as AiChatOptions, c as AiChatResult, d as AiChatUsage, e as AiContentPart, f as AiImageUrlPart, g as AiNamespace, h as AiResponseFormat, i as AiStreamHandle, j as AiStreamMeta, k as AiTextPart, l as AuthNamespace, m as AuthStateListener, C as CatalogListOptions, n as CatalogListResponse, p as CheckoutIntentInfo, q as CheckoutIntentStatus, r as CheckoutNamespace, s as CheckoutStartInput, t as CheckoutStartResult, u as CheckoutTenantType, v as CompleteSignInResult, y as CreateTicketInput, D as DEFAULT_BASE_URL, z as DbBatchOp, B as DbChangeType, E as DbCollectionRef, F as DbDoc, G as DbDocRef, H as DbGetResult, I as DbListResult, J as DbNamespace, K as DbQuery, L as DbSqlLease, M as DbWhereFilter, O as EntitlementCheck, P as FieldSentinel, Q as IncrementSentinel, R as ListNotificationsOptions, S as MockCheckout, T as MockNotifications, U as MockWebhooks, V as NEETRU_SENTINEL_KEY, W as NeetruClient, X as NeetruClientConfig, Y as NeetruDb, _ as NeetruDbEngine, $ as NeetruDbError, a0 as NeetruDbErrorCode, a1 as NeetruDbOptions, a2 as NeetruDbTransport, a3 as NeetruEnv, a4 as NeetruSqlClient, a5 as NeetruUser, a6 as NotificationScopeOptions, a7 as NotificationsNamespace, a8 as Product, a9 as ProductNotification, aa as ProductNotificationSeverity, ab as ProductPlan, ac as ProductStatus, ae as RedirectCallbackResult, af as RegisterWebhookInput, ag as ResolvedConfig, ah as SendNotificationInput, ai as ServerTimestampSentinel, aj as SignInOptions, al as SupportNamespace, am as SupportSeverity, an as SupportStatus, ao as SupportTicket, ar as TelemetryEventAck, as as TelemetryEventInput, aw as UsageEventInput, ax as UsageNamespace, ay as UsageQuota, az as VerifyTokenOptions, aA as VerifyWebhookRequestOptions, aB as VerifyWebhookRequestResult, aC as WebhookEndpoint, aD as WebhookEvent, aE as WebhookScopeOptions, aF as WebhookTestResult, aG as WebhooksNamespace, aH as WithFieldSentinels, aJ as createAiNamespace, aK as createCheckoutNamespace, aL as createNeetruDb, aM as createNotificationsNamespace, aO as createWebhooksNamespace, aQ as increment, aR as isFieldSentinel, aS as isIncrementSentinel, aT as isServerTimestampSentinel, aU as serverTimestamp, aV as verifyWebhookRequest, aW as verifyWebhookSignature } from './types-nnztVk7G.js';
+export { A as AiChatChoice, a as AiChatMessage, b as AiChatOptions, c as AiChatResult, d as AiChatUsage, e as AiContentPart, f as AiImageUrlPart, g as AiNamespace, h as AiResponseFormat, i as AiStreamHandle, j as AiStreamMeta, k as AiTextPart, l as AuthNamespace, m as AuthStateListener, C as CatalogListOptions, n as CatalogListResponse, p as CheckoutIntentInfo, q as CheckoutIntentStatus, r as CheckoutNamespace, s as CheckoutStartInput, t as CheckoutStartResult, u as CheckoutTenantType, v as CompleteSignInResult, y as CreateTicketInput, D as DEFAULT_BASE_URL, z as DbBatchOp, B as DbChangeType, E as DbCollectionRef, F as DbDoc, G as DbDocRef, H as DbGetResult, I as DbListResult, J as DbNamespace, K as DbQuery, L as DbSqlLease, M as DbWhereFilter, O as EntitlementCheck, P as FieldSentinel, Q as IncrementSentinel, R as ListNotificationsOptions, S as MockCheckout, T as MockNotifications, U as MockWebhooks, V as NEETRU_SENTINEL_KEY, W as NeetruClient, X as NeetruClientConfig, Y as NeetruDb, _ as NeetruDbEngine, $ as NeetruDbError, a0 as NeetruDbErrorCode, a1 as NeetruDbOptions, a2 as NeetruDbTransport, a3 as NeetruEnv, a4 as NeetruSqlClient, a5 as NeetruUser, a6 as NotificationScopeOptions, a7 as NotificationsNamespace, a8 as Product, a9 as ProductNotification, aa as ProductNotificationSeverity, ab as ProductPlan, ac as ProductStatus, ae as RedirectCallbackResult, af as RegisterWebhookInput, ag as ResolvedConfig, ah as SendNotificationInput, ai as ServerTimestampSentinel, aj as SignInOptions, al as SupportNamespace, am as SupportSeverity, an as SupportStatus, ao as SupportTicket, ar as TelemetryEventAck, as as TelemetryEventInput, aw as UsageEventInput, ax as UsageNamespace, ay as UsageQuota, az as VerifyTokenOptions, aA as VerifyWebhookRequestOptions, aB as VerifyWebhookRequestResult, aC as WebhookEndpoint, aD as WebhookEvent, aE as WebhookScopeOptions, aF as WebhookTestResult, aG as WebhooksNamespace, aH as WithFieldSentinels, aJ as createAiNamespace, aK as createCheckoutNamespace, aL as createNeetruDb, aM as createNotificationsNamespace, aO as createWebhooksNamespace, aQ as increment, aR as isFieldSentinel, aS as isIncrementSentinel, aT as isServerTimestampSentinel, aU as serverTimestamp, aV as verifyWebhookRequest, aW as verifyWebhookSignature } from './types-BPATkXYu.js';
 export { DEV_FIXTURE_USER, MockAi, MockAuth, MockAuthOptions, MockDb, MockEntitlements, MockSupport, MockUsage } from './mocks.js';
 import 'drizzle-orm/node-postgres';
 
+/**
+ * HTTP transport interno do SDK.
+ *
+ * Responsabilidades:
+ *   - Construir URL absoluta a partir de `baseUrl` + path
+ *   - Injetar Bearer token quando `requireAuth=true`
+ *   - Mapear status HTTP → `NeetruError` com `code` estável
+ *   - Parse defensivo de JSON (não lança em body vazio em 204)
+ *   - Retry/backoff exponencial em `rate_limited` (429), `server_error` (5xx)
+ *     e `network_error` (timeout/falha de rede). Honra `Retry-After` quando
+ *     presente.
+ *   - **Captura `X-Neetru-Version`** das respostas e emite `console.warn` quando
+ *     o Core está abaixo da versão mínima para a major do SDK.
+ *
+ * Política de retries (mudança breaking 3.0):
+ *   - GET/HEAD: default 2 retries (3 tentativas total) — idempotente, seguro.
+ *   - POST/PUT/PATCH/DELETE: default **0 retries** — mutations podem duplicar
+ *     side effects (ex: `usage.report` incrementa contador). Caller pode
+ *     reativar passando `retries: N` explicitamente ou usar `Idempotency-Key`
+ *     header (gerado automaticamente se `opts.idempotencyKey=true`).
+ *
+ * Idempotency-Key (3.0):
+ *   - `opts.idempotencyKey === true` → SDK gera UUID v4 e injeta header.
+ *   - `opts.idempotencyKey === 'uuid-string'` → usa o valor passado.
+ *   - Caller mantém retentos client-side se quiser; Core dedup serverside
+ *     (vide `docs/CORE_CHANGES_REQUIRED.md` §2).
+ */
+
 /**
  * Verifica se a versão do Core (`X-Neetru-Version`) é compatível com a SDK major.
  * Emite `console.warn` quando incompatível (uma vez por processo por versão detectada).
@@ -42,6 +70,6 @@ declare function checkCoreVersionCompat(coreVersion: string): void;
  */
 
 /** Versão do SDK — exportada explicitamente pra detecção em runtime. */
-declare const VERSION: "3.4.6";
+declare const VERSION: "3.6.0";
 
 export { VERSION, checkCoreVersionCompat };

package/dist/index.mjs

@@ -62,7 +62,8 @@ var init_idempotency = __esm({
 var http_exports = {};
 __export(http_exports, {
   checkCoreVersionCompat: () => checkCoreVersionCompat,
-  httpRequest: () => httpRequest
+  httpRequest: () => httpRequest,
+  statusToCode: () => statusToCode
 });
 function stripRevision(v) {
   return v.split("+")[0] ?? v;
@@ -78,12 +79,16 @@ function compareCalVer(a, b) {
   }
   return 0;
 }
-function getSdkMajor() {
+function readInjectedSdkVersion() {
   try {
-    const ver = globalThis.__NEETRU_SDK_VERSION__;
-    if (ver) return parseInt(ver.split(".")[0] ?? "3", 10);
+    return "3.6.0";
   } catch {
+    return void 0;
   }
+}
+function getSdkMajor() {
+  const ver = readInjectedSdkVersion();
+  if (ver) return parseInt(ver.split(".")[0] ?? "3", 10);
   return 3;
 }
 function checkCoreVersionCompat(coreVersion) {
@@ -161,6 +166,10 @@ async function httpRequest(config, opts) {
     accept: "application/json",
     ...opts.headers
   };
+  const sdkVersion = readInjectedSdkVersion();
+  if (sdkVersion) {
+    headers["x-neetru-sdk-version"] = sdkVersion;
+  }
   if (opts.requireAuth) {
     if (!config.apiKey) {
       throw new NeetruError(
@@ -525,7 +534,7 @@ var init_lease = __esm({
             void this._doRenew();
           }, MIN_RENEWAL_DELAY_MS);
           console.warn(
-            `[SqlLeaseManager] renova\xE7\xE3o E emiss\xE3o de lease novo falharam; re-tentando em ${MIN_RENEWAL_DELAY_MS}ms (cert mTLS expira ~15min ap\xF3s o \xFAltimo swap):`,
+            `[SqlLeaseManager] renova\xE7\xE3o E emiss\xE3o de lease novo falharam; re-tentando em ${MIN_RENEWAL_DELAY_MS}ms (cert TLS ef\xEAmero do servidor expira ~15min ap\xF3s o \xFAltimo swap):`,
             err instanceof Error ? err.message : err
           );
           return;
@@ -536,8 +545,9 @@ var init_lease = __esm({
       /**
        * Recuperação REATIVA: chamado pelo wrapper resiliente (`resilient-pool.ts`)
        * quando uma query plana falha num erro de ESTABELECIMENTO de conexão (cert
-       * mTLS expirado no meio de uma request, ou timer de renovação que não
-       * disparou). Emite um lease NOVO e faz o swap do pool interno do wrapper com
+       * TLS efêmero do servidor expirado no meio de uma request, ou timer de
+       * renovação que não disparou). Emite um lease NOVO e faz o swap do pool interno
+       * do wrapper com
        * o certificado fresco; o wrapper então re-tenta a query 1x no pool novo.
        *
        * Vai DIRETO ao lease novo (sem `leaseId`) — a conexão falhou porque o
@@ -1137,7 +1147,14 @@ function toProduct(raw) {
   if (Array.isArray(r.plans)) {
     product.plans = r.plans.filter(
       (p) => typeof p === "object" && p !== null && typeof p.id === "string" && typeof p.name === "string"
-    );
+    ).map((p) => {
+      const plan = { id: p.id, name: p.name };
+      if (typeof p.amountCents === "number") plan.amountCents = p.amountCents;
+      if (Array.isArray(p.features) && p.features.every((f) => typeof f === "string")) {
+        plan.features = p.features;
+      }
+      return plan;
+    });
   }
   return product;
 }
@@ -1717,7 +1734,10 @@ function createSupportNamespace(config) {
       await httpRequest(config, {
         method: "POST",
         path: `/api/sdk/v1/support/tickets/${encodeURIComponent(ticketId)}/satisfaction-attempt`,
-        requireAuth: true
+        requireAuth: true,
+        // Incrementa satisfactionAttempts += 1 no Core — sem idempotencyKey,
+        // um retry de rede infla o contador (mesmo padrão de createTicket acima).
+        idempotencyKey: true
       });
     },
     /**
@@ -5919,7 +5939,12 @@ function createWebhooksNamespace(config) {
           events: input.events,
           ...input.secret ? { secret: input.secret } : {}
         },
-        requireAuth: true
+        requireAuth: true,
+        // Sem isso, um retry de rede (app-level; SDK default é 0 retries em
+        // POST) podia registrar o MESMO webhook duas vezes → entrega
+        // duplicada de todo evento futuro pro endpoint do cliente. Core
+        // dedup TTL 24h (mesmo padrão de usage.report/support.createTicket).
+        idempotencyKey: true
       });
       return toEndpoint(raw);
     },
@@ -6472,16 +6497,6 @@ async function safeJson2(res) {
     return void 0;
   }
 }
-function statusToCode2(status) {
-  if (status === 401) return "unauthorized";
-  if (status === 403) return "forbidden";
-  if (status === 404) return "not_found";
-  if (status === 409) return "conflict";
-  if (status === 422 || status === 400) return "validation_failed";
-  if (status === 429) return "rate_limited";
-  if (status >= 500) return "server_error";
-  return "unknown";
-}
 function joinUrl(baseUrl, path) {
   const base = baseUrl.replace(/\/+$/, "");
   const p = path.startsWith("/") ? path : `/${path}`;
@@ -6516,7 +6531,7 @@ async function aiFetch(config, body, signal, stream) {
   const requestId = res.headers.get("x-request-id") ?? res.headers.get("x-correlation-id") ?? void 0;
   if (!res.ok) {
     const parsed = await safeJson2(res);
-    let code = statusToCode2(res.status);
+    let code = statusToCode(res.status);
     let message = `HTTP ${res.status}`;
     if (parsed && typeof parsed === "object" && "error" in parsed) {
       const errField = parsed.error;
@@ -6635,6 +6650,19 @@ function createAiNamespace(config) {
 // src/mocks.ts
 init_db_errors();
 init_errors();
+
+// src/runtime-env.ts
+function isProductionRuntime() {
+  try {
+    if (typeof process !== "undefined" && process.env) {
+      return process.env.NODE_ENV === "production";
+    }
+  } catch {
+  }
+  return false;
+}
+
+// src/mocks.ts
 var DEV_FIXTURE_USER = Object.freeze({
   uid: "dev-fixture-uid-0001",
   email: "dev@neetru.local",
@@ -6651,6 +6679,12 @@ var MockAuth = class {
     this._user = initialUser;
     this._listeners = /* @__PURE__ */ new Set();
     this._allowUnsignedDecode = options?.allowUnsignedDecode ?? false;
+    if (this._allowUnsignedDecode && isProductionRuntime()) {
+      throw new NeetruError(
+        "invalid_config",
+        "MockAuth com allowUnsignedDecode=true \xE9 PROIBIDO em produ\xE7\xE3o (NODE_ENV=production): decodificar JWT sem verificar assinatura \xE9 bypass de autentica\xE7\xE3o. Este modo existe exclusivamente para testes."
+      );
+    }
     if (this._allowUnsignedDecode) {
       const isTestEnv = typeof process !== "undefined" && (process.env?.NODE_ENV === "test" || process.env?.VITEST === "true" || process.env?.VITEST != null);
       if (!isTestEnv && typeof console !== "undefined") {
@@ -7366,6 +7400,94 @@ var MockAi = class {
   }
 };
 
+// src/auth-pkce-shared.ts
+init_errors();
+function getWebCrypto() {
+  const c = globalThis.crypto;
+  if (!c || typeof c.getRandomValues !== "function" || !c.subtle) {
+    throw new NeetruError(
+      "runtime_unsupported",
+      "auth.signIn requer WebCrypto (crypto.subtle) \u2014 indispon\xEDvel neste runtime. Use HTTPS (ou http://localhost) num browser moderno, ou instale um polyfill WebCrypto (ex: react-native-quick-crypto) em React Native."
+    );
+  }
+  return c;
+}
+function base64UrlFromBytes(bytes) {
+  let str = "";
+  for (const b of bytes) str += String.fromCharCode(b);
+  const b64 = typeof btoa === "function" ? btoa(str) : Buffer.from(str, "binary").toString("base64");
+  return b64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+function randomUrlSafe(crypto2, byteLen) {
+  const bytes = new Uint8Array(byteLen);
+  crypto2.getRandomValues(bytes);
+  return base64UrlFromBytes(bytes);
+}
+async function pkceChallengeS256(crypto2, verifier) {
+  const data = new TextEncoder().encode(verifier);
+  const digest = await crypto2.subtle.digest("SHA-256", data);
+  return base64UrlFromBytes(new Uint8Array(digest));
+}
+function resolveIdpOrigin(baseUrl) {
+  const overrideAuthUrl = typeof globalThis.NEETRU_AUTH_URL === "string" ? globalThis.NEETRU_AUTH_URL : null;
+  return overrideAuthUrl ?? baseUrl.replace(/^https?:\/\/api\./, "https://auth.");
+}
+function resolveOidcClientId(config) {
+  let clientId = config.oidcClientId;
+  if (!clientId && config.apiKey) {
+    clientId = parseApiKey(config.apiKey).keyId;
+  }
+  if (!clientId) {
+    throw new NeetruError(
+      "invalid_config",
+      "auth OIDC requer `oidcClientId` (ou `apiKey`) configurado para montar o client_id."
+    );
+  }
+  return clientId;
+}
+function buildAuthorizeUrl(params) {
+  const url = new URL("/api/v1/oauth/authorize", params.idpOrigin);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", params.clientId);
+  url.searchParams.set("redirect_uri", params.redirectUri);
+  url.searchParams.set("scope", params.scope);
+  url.searchParams.set("state", params.state);
+  url.searchParams.set("nonce", params.nonce);
+  url.searchParams.set("code_challenge", params.codeChallenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  return url;
+}
+function decodeJwtPayload(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  try {
+    const b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    const pad = "=".repeat((4 - b64.length % 4) % 4);
+    const decoded = typeof atob === "function" ? atob(b64 + pad) : Buffer.from(b64 + pad, "base64").toString("utf-8");
+    return JSON.parse(decoded);
+  } catch {
+    return null;
+  }
+}
+function jwtToNeetruUser(token) {
+  const payload = decodeJwtPayload(token);
+  if (!payload || typeof payload.sub !== "string") return null;
+  if (typeof payload.exp === "number" && payload.exp * 1e3 < Date.now()) {
+    return null;
+  }
+  return {
+    uid: payload.sub,
+    email: typeof payload.email === "string" ? payload.email : "",
+    emailVerified: typeof payload.email_verified === "boolean" ? payload.email_verified : void 0,
+    displayName: typeof payload.name === "string" ? payload.name : void 0,
+    photoURL: typeof payload.picture === "string" ? payload.picture : void 0,
+    isStaff: payload.is_staff === true,
+    isCustomer: payload.is_customer === true,
+    tenantId: typeof payload.tenant_id === "string" ? payload.tenant_id : void 0,
+    ...payload
+  };
+}
+
 // src/auth.ts
 function readEnvApiKey() {
   try {
@@ -7386,7 +7508,7 @@ function resolveEnv(configEnv) {
   }
   try {
     const g = globalThis.NEETRU_ENV;
-    if (g === "dev" || g === "workspace" || g === "prod") return g;
+    if (g === "workspace" || g === "prod") return g;
   } catch {
   }
   return "prod";
@@ -7420,36 +7542,6 @@ function _jwtPayloadToUser(payload) {
   };
 }
 var OIDC_TX_KEY = "neetru_oauth_tx";
-function resolveIdpOrigin(baseUrl) {
-  const overrideAuthUrl = typeof globalThis.NEETRU_AUTH_URL === "string" ? globalThis.NEETRU_AUTH_URL : null;
-  return overrideAuthUrl ?? baseUrl.replace(/^https?:\/\/api\./, "https://auth.");
-}
-function getWebCrypto() {
-  const c = globalThis.crypto;
-  if (!c || typeof c.getRandomValues !== "function" || !c.subtle) {
-    throw new NeetruError(
-      "runtime_unsupported",
-      "auth.signIn requer WebCrypto (crypto.subtle) \u2014 indispon\xEDvel neste runtime. Use HTTPS (ou http://localhost) num browser moderno."
-    );
-  }
-  return c;
-}
-function base64UrlFromBytes(bytes) {
-  let str = "";
-  for (const b of bytes) str += String.fromCharCode(b);
-  const b64 = typeof btoa === "function" ? btoa(str) : Buffer.from(str, "binary").toString("base64");
-  return b64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-}
-function randomUrlSafe(crypto2, byteLen) {
-  const bytes = new Uint8Array(byteLen);
-  crypto2.getRandomValues(bytes);
-  return base64UrlFromBytes(bytes);
-}
-async function pkceChallengeS256(crypto2, verifier) {
-  const data = new TextEncoder().encode(verifier);
-  const digest = await crypto2.subtle.digest("SHA-256", data);
-  return base64UrlFromBytes(new Uint8Array(digest));
-}
 function cleanCallbackUrl(parsed) {
   try {
     const history = globalThis.history;
@@ -7483,36 +7575,6 @@ function createOidcAuthNamespace(config) {
       return null;
     }
   }
-  function decodeJwtPayload(token) {
-    const parts = token.split(".");
-    if (parts.length !== 3) return null;
-    try {
-      const b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
-      const pad = "=".repeat((4 - b64.length % 4) % 4);
-      const decoded = typeof atob === "function" ? atob(b64 + pad) : Buffer.from(b64 + pad, "base64").toString("utf-8");
-      return JSON.parse(decoded);
-    } catch {
-      return null;
-    }
-  }
-  function tokenToUser(token) {
-    const payload = decodeJwtPayload(token);
-    if (!payload || typeof payload.sub !== "string") return null;
-    if (typeof payload.exp === "number" && payload.exp * 1e3 < Date.now()) {
-      return null;
-    }
-    return {
-      uid: payload.sub,
-      email: typeof payload.email === "string" ? payload.email : "",
-      emailVerified: typeof payload.email_verified === "boolean" ? payload.email_verified : void 0,
-      displayName: typeof payload.name === "string" ? payload.name : void 0,
-      photoURL: typeof payload.picture === "string" ? payload.picture : void 0,
-      isStaff: payload.is_staff === true,
-      isCustomer: payload.is_customer === true,
-      tenantId: typeof payload.tenant_id === "string" ? payload.tenant_id : void 0,
-      ...payload
-    };
-  }
   function loadCachedUser() {
     if (cachedUser) {
       const exp = cachedUser.exp;
@@ -7533,7 +7595,7 @@ function createOidcAuthNamespace(config) {
       attemptSilentRefresh();
       return null;
     }
-    const user = tokenToUser(token);
+    const user = jwtToNeetruUser(token);
     if (!user) {
       storage.removeItem(STORAGE_KEY);
       attemptSilentRefresh();
@@ -7604,7 +7666,7 @@ function createOidcAuthNamespace(config) {
       if (!res.ok || typeof payload?.error === "string") return false;
       const idToken = payload?.id_token;
       if (typeof idToken !== "string" || idToken.length === 0) return false;
-      const user = tokenToUser(idToken);
+      const user = jwtToNeetruUser(idToken);
       if (!user) return false;
       const storage = getStorage();
       storage?.setItem(STORAGE_KEY, idToken);
@@ -7650,17 +7712,7 @@ function createOidcAuthNamespace(config) {
     }, msUntilExpiry + 1);
   }
   function resolveClientId() {
-    let clientId = config.oidcClientId;
-    if (!clientId && config.apiKey) {
-      clientId = parseApiKey(config.apiKey).keyId;
-    }
-    if (!clientId) {
-      throw new NeetruError(
-        "invalid_config",
-        "auth OIDC requer `oidcClientId` (ou `apiKey`) configurado para montar o client_id."
-      );
-    }
-    return clientId;
+    return resolveOidcClientId(config);
   }
   async function handleRedirectCallback(currentUrl) {
     const href = currentUrl ?? (typeof globalThis.location !== "undefined" ? globalThis.location.href : void 0);
@@ -7778,7 +7830,7 @@ function createOidcAuthNamespace(config) {
         "nonce do id_token n\xE3o confere com o da transa\xE7\xE3o OIDC (poss\xEDvel replay). Token descartado."
       );
     }
-    const user = tokenToUser(idToken);
+    const user = jwtToNeetruUser(idToken);
     if (!user) {
       throw new NeetruError(
         "token_exchange_failed",
@@ -7823,15 +7875,15 @@ function createOidcAuthNamespace(config) {
         };
         session.setItem(OIDC_TX_KEY, JSON.stringify(tx));
         const idpOrigin = resolveIdpOrigin(config.baseUrl);
-        const url = new URL("/api/v1/oauth/authorize", idpOrigin);
-        url.searchParams.set("response_type", "code");
-        url.searchParams.set("client_id", clientId);
-        url.searchParams.set("redirect_uri", redirectUri);
-        url.searchParams.set("scope", scope);
-        url.searchParams.set("state", state);
-        url.searchParams.set("nonce", nonce);
-        url.searchParams.set("code_challenge", codeChallenge);
-        url.searchParams.set("code_challenge_method", "S256");
+        const url = buildAuthorizeUrl({
+          idpOrigin,
+          clientId,
+          redirectUri,
+          scope,
+          state,
+          nonce,
+          codeChallenge
+        });
         globalThis.location.assign(url.toString());
         return;
       }
@@ -7846,7 +7898,7 @@ function createOidcAuthNamespace(config) {
       const storage = getStorage();
       const token = storage?.getItem(STORAGE_KEY) ?? null;
       if (!token) return null;
-      return tokenToUser(token) ? token : null;
+      return jwtToNeetruUser(token) ? token : null;
     },
     async signOut() {
       const storage = getStorage();
@@ -7971,7 +8023,7 @@ function createNeetruClient(config = {}) {
     productId: config.productId,
     tenantId: config.tenantId
   });
-  const isDev = env === "dev";
+  const isDev = env === "dev" && !isProductionRuntime();
   const auth = config.mocks?.auth ?? (isDev ? new MockAuth({ ...DEV_FIXTURE_USER }) : createOidcAuthNamespace(resolved));
   const usage = config.mocks?.usage ?? (isDev ? new MockUsage() : createUsageNamespace(resolved));
   const support = config.mocks?.support ?? (isDev ? new MockSupport() : createSupportNamespace(resolved));
@@ -8009,7 +8061,7 @@ function getServerNeetruClient(config = {}) {
 init_errors();
 init_db_errors();
 init_http();
-var VERSION = "3.4.6";
+var VERSION = "3.6.0";
 
 export { DEFAULT_BASE_URL, DEV_FIXTURE_USER, MockAi, MockAuth, MockCheckout, MockDb, MockEntitlements, MockNotifications, MockSupport, MockUsage, MockWebhooks, NEETRU_SENTINEL_KEY, NeetruDbError, NeetruError, VERSION, checkCoreVersionCompat, createAiNamespace, createCheckoutNamespace, createNeetruClient, createNeetruDb, createNotificationsNamespace, createWebhooksNamespace, getServerNeetruClient, increment, isFieldSentinel, isIncrementSentinel, isServerTimestampSentinel, serverTimestamp, verifyWebhookRequest, verifyWebhookSignature };
 //# sourceMappingURL=index.mjs.map