@neetru/sdk 3.4.7 → 3.6.0

package/dist/auth.cjs

@@ -64,7 +64,8 @@ var init_idempotency = __esm({
 var http_exports = {};
 __export(http_exports, {
   checkCoreVersionCompat: () => checkCoreVersionCompat,
-  httpRequest: () => httpRequest
+  httpRequest: () => httpRequest,
+  statusToCode: () => statusToCode
 });
 function stripRevision(v) {
   return v.split("+")[0] ?? v;
@@ -80,12 +81,16 @@ function compareCalVer(a, b) {
   }
   return 0;
 }
-function getSdkMajor() {
+function readInjectedSdkVersion() {
   try {
-    const ver = globalThis.__NEETRU_SDK_VERSION__;
-    if (ver) return parseInt(ver.split(".")[0] ?? "3", 10);
+    return "3.6.0";
   } catch {
+    return void 0;
   }
+}
+function getSdkMajor() {
+  const ver = readInjectedSdkVersion();
+  if (ver) return parseInt(ver.split(".")[0] ?? "3", 10);
   return 3;
 }
 function checkCoreVersionCompat(coreVersion) {
@@ -163,6 +168,10 @@ async function httpRequest(config, opts) {
     accept: "application/json",
     ...opts.headers
   };
+  const sdkVersion = readInjectedSdkVersion();
+  if (sdkVersion) {
+    headers["x-neetru-sdk-version"] = sdkVersion;
+  }
   if (opts.requireAuth) {
     if (!config.apiKey) {
       throw new NeetruError(
@@ -527,7 +536,7 @@ var init_lease = __esm({
             void this._doRenew();
           }, MIN_RENEWAL_DELAY_MS);
           console.warn(
-            `[SqlLeaseManager] renova\xE7\xE3o E emiss\xE3o de lease novo falharam; re-tentando em ${MIN_RENEWAL_DELAY_MS}ms (cert mTLS expira ~15min ap\xF3s o \xFAltimo swap):`,
+            `[SqlLeaseManager] renova\xE7\xE3o E emiss\xE3o de lease novo falharam; re-tentando em ${MIN_RENEWAL_DELAY_MS}ms (cert TLS ef\xEAmero do servidor expira ~15min ap\xF3s o \xFAltimo swap):`,
             err instanceof Error ? err.message : err
           );
           return;
@@ -538,8 +547,9 @@ var init_lease = __esm({
       /**
        * Recuperação REATIVA: chamado pelo wrapper resiliente (`resilient-pool.ts`)
        * quando uma query plana falha num erro de ESTABELECIMENTO de conexão (cert
-       * mTLS expirado no meio de uma request, ou timer de renovação que não
-       * disparou). Emite um lease NOVO e faz o swap do pool interno do wrapper com
+       * TLS efêmero do servidor expirado no meio de uma request, ou timer de
+       * renovação que não disparou). Emite um lease NOVO e faz o swap do pool interno
+       * do wrapper com
        * o certificado fresco; o wrapper então re-tenta a query 1x no pool novo.
        *
        * Vai DIRETO ao lease novo (sem `leaseId`) — a conexão falhou porque o
@@ -1139,7 +1149,14 @@ function toProduct(raw) {
   if (Array.isArray(r.plans)) {
     product.plans = r.plans.filter(
       (p) => typeof p === "object" && p !== null && typeof p.id === "string" && typeof p.name === "string"
-    );
+    ).map((p) => {
+      const plan = { id: p.id, name: p.name };
+      if (typeof p.amountCents === "number") plan.amountCents = p.amountCents;
+      if (Array.isArray(p.features) && p.features.every((f) => typeof f === "string")) {
+        plan.features = p.features;
+      }
+      return plan;
+    });
   }
   return product;
 }
@@ -1719,7 +1736,10 @@ function createSupportNamespace(config) {
       await httpRequest(config, {
         method: "POST",
         path: `/api/sdk/v1/support/tickets/${encodeURIComponent(ticketId)}/satisfaction-attempt`,
-        requireAuth: true
+        requireAuth: true,
+        // Incrementa satisfactionAttempts += 1 no Core — sem idempotencyKey,
+        // um retry de rede infla o contador (mesmo padrão de createTicket acima).
+        idempotencyKey: true
       });
     },
     /**
@@ -5824,7 +5844,12 @@ function createWebhooksNamespace(config) {
           events: input.events,
           ...input.secret ? { secret: input.secret } : {}
         },
-        requireAuth: true
+        requireAuth: true,
+        // Sem isso, um retry de rede (app-level; SDK default é 0 retries em
+        // POST) podia registrar o MESMO webhook duas vezes → entrega
+        // duplicada de todo evento futuro pro endpoint do cliente. Core
+        // dedup TTL 24h (mesmo padrão de usage.report/support.createTicket).
+        idempotencyKey: true
       });
       return toEndpoint(raw);
     },
@@ -6377,16 +6402,6 @@ async function safeJson2(res) {
     return void 0;
   }
 }
-function statusToCode2(status) {
-  if (status === 401) return "unauthorized";
-  if (status === 403) return "forbidden";
-  if (status === 404) return "not_found";
-  if (status === 409) return "conflict";
-  if (status === 422 || status === 400) return "validation_failed";
-  if (status === 429) return "rate_limited";
-  if (status >= 500) return "server_error";
-  return "unknown";
-}
 function joinUrl(baseUrl, path) {
   const base = baseUrl.replace(/\/+$/, "");
   const p = path.startsWith("/") ? path : `/${path}`;
@@ -6421,7 +6436,7 @@ async function aiFetch(config, body, signal, stream) {
   const requestId = res.headers.get("x-request-id") ?? res.headers.get("x-correlation-id") ?? void 0;
   if (!res.ok) {
     const parsed = await safeJson2(res);
-    let code = statusToCode2(res.status);
+    let code = statusToCode(res.status);
     let message = `HTTP ${res.status}`;
     if (parsed && typeof parsed === "object" && "error" in parsed) {
       const errField = parsed.error;
@@ -6539,6 +6554,19 @@ function createAiNamespace(config) {
 
 // src/mocks.ts
 init_errors();
+
+// src/runtime-env.ts
+function isProductionRuntime() {
+  try {
+    if (typeof process !== "undefined" && process.env) {
+      return process.env.NODE_ENV === "production";
+    }
+  } catch {
+  }
+  return false;
+}
+
+// src/mocks.ts
 var DEV_FIXTURE_USER = Object.freeze({
   uid: "dev-fixture-uid-0001",
   email: "dev@neetru.local",
@@ -6555,6 +6583,12 @@ var MockAuth = class {
     this._user = initialUser;
     this._listeners = /* @__PURE__ */ new Set();
     this._allowUnsignedDecode = options?.allowUnsignedDecode ?? false;
+    if (this._allowUnsignedDecode && isProductionRuntime()) {
+      throw new NeetruError(
+        "invalid_config",
+        "MockAuth com allowUnsignedDecode=true \xE9 PROIBIDO em produ\xE7\xE3o (NODE_ENV=production): decodificar JWT sem verificar assinatura \xE9 bypass de autentica\xE7\xE3o. Este modo existe exclusivamente para testes."
+      );
+    }
     if (this._allowUnsignedDecode) {
       const isTestEnv = typeof process !== "undefined" && (process.env?.NODE_ENV === "test" || process.env?.VITEST === "true" || process.env?.VITEST != null);
       if (!isTestEnv && typeof console !== "undefined") {
@@ -6956,6 +6990,94 @@ var MockAi = class {
   }
 };
 
+// src/auth-pkce-shared.ts
+init_errors();
+function getWebCrypto() {
+  const c = globalThis.crypto;
+  if (!c || typeof c.getRandomValues !== "function" || !c.subtle) {
+    throw new NeetruError(
+      "runtime_unsupported",
+      "auth.signIn requer WebCrypto (crypto.subtle) \u2014 indispon\xEDvel neste runtime. Use HTTPS (ou http://localhost) num browser moderno, ou instale um polyfill WebCrypto (ex: react-native-quick-crypto) em React Native."
+    );
+  }
+  return c;
+}
+function base64UrlFromBytes(bytes) {
+  let str = "";
+  for (const b of bytes) str += String.fromCharCode(b);
+  const b64 = typeof btoa === "function" ? btoa(str) : Buffer.from(str, "binary").toString("base64");
+  return b64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+function randomUrlSafe(crypto2, byteLen) {
+  const bytes = new Uint8Array(byteLen);
+  crypto2.getRandomValues(bytes);
+  return base64UrlFromBytes(bytes);
+}
+async function pkceChallengeS256(crypto2, verifier) {
+  const data = new TextEncoder().encode(verifier);
+  const digest = await crypto2.subtle.digest("SHA-256", data);
+  return base64UrlFromBytes(new Uint8Array(digest));
+}
+function resolveIdpOrigin(baseUrl) {
+  const overrideAuthUrl = typeof globalThis.NEETRU_AUTH_URL === "string" ? globalThis.NEETRU_AUTH_URL : null;
+  return overrideAuthUrl ?? baseUrl.replace(/^https?:\/\/api\./, "https://auth.");
+}
+function resolveOidcClientId(config) {
+  let clientId = config.oidcClientId;
+  if (!clientId && config.apiKey) {
+    clientId = parseApiKey(config.apiKey).keyId;
+  }
+  if (!clientId) {
+    throw new NeetruError(
+      "invalid_config",
+      "auth OIDC requer `oidcClientId` (ou `apiKey`) configurado para montar o client_id."
+    );
+  }
+  return clientId;
+}
+function buildAuthorizeUrl(params) {
+  const url = new URL("/api/v1/oauth/authorize", params.idpOrigin);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", params.clientId);
+  url.searchParams.set("redirect_uri", params.redirectUri);
+  url.searchParams.set("scope", params.scope);
+  url.searchParams.set("state", params.state);
+  url.searchParams.set("nonce", params.nonce);
+  url.searchParams.set("code_challenge", params.codeChallenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  return url;
+}
+function decodeJwtPayload(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  try {
+    const b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    const pad = "=".repeat((4 - b64.length % 4) % 4);
+    const decoded = typeof atob === "function" ? atob(b64 + pad) : Buffer.from(b64 + pad, "base64").toString("utf-8");
+    return JSON.parse(decoded);
+  } catch {
+    return null;
+  }
+}
+function jwtToNeetruUser(token) {
+  const payload = decodeJwtPayload(token);
+  if (!payload || typeof payload.sub !== "string") return null;
+  if (typeof payload.exp === "number" && payload.exp * 1e3 < Date.now()) {
+    return null;
+  }
+  return {
+    uid: payload.sub,
+    email: typeof payload.email === "string" ? payload.email : "",
+    emailVerified: typeof payload.email_verified === "boolean" ? payload.email_verified : void 0,
+    displayName: typeof payload.name === "string" ? payload.name : void 0,
+    photoURL: typeof payload.picture === "string" ? payload.picture : void 0,
+    isStaff: payload.is_staff === true,
+    isCustomer: payload.is_customer === true,
+    tenantId: typeof payload.tenant_id === "string" ? payload.tenant_id : void 0,
+    ...payload
+  };
+}
+
 // src/auth.ts
 function readEnvApiKey() {
   try {
@@ -6976,7 +7098,7 @@ function resolveEnv(configEnv) {
   }
   try {
     const g = globalThis.NEETRU_ENV;
-    if (g === "dev" || g === "workspace" || g === "prod") return g;
+    if (g === "workspace" || g === "prod") return g;
   } catch {
   }
   return "prod";
@@ -7013,36 +7135,6 @@ function _jwtPayloadToUser(payload) {
   };
 }
 var OIDC_TX_KEY = "neetru_oauth_tx";
-function resolveIdpOrigin(baseUrl) {
-  const overrideAuthUrl = typeof globalThis.NEETRU_AUTH_URL === "string" ? globalThis.NEETRU_AUTH_URL : null;
-  return overrideAuthUrl ?? baseUrl.replace(/^https?:\/\/api\./, "https://auth.");
-}
-function getWebCrypto() {
-  const c = globalThis.crypto;
-  if (!c || typeof c.getRandomValues !== "function" || !c.subtle) {
-    throw new NeetruError(
-      "runtime_unsupported",
-      "auth.signIn requer WebCrypto (crypto.subtle) \u2014 indispon\xEDvel neste runtime. Use HTTPS (ou http://localhost) num browser moderno."
-    );
-  }
-  return c;
-}
-function base64UrlFromBytes(bytes) {
-  let str = "";
-  for (const b of bytes) str += String.fromCharCode(b);
-  const b64 = typeof btoa === "function" ? btoa(str) : Buffer.from(str, "binary").toString("base64");
-  return b64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-}
-function randomUrlSafe(crypto2, byteLen) {
-  const bytes = new Uint8Array(byteLen);
-  crypto2.getRandomValues(bytes);
-  return base64UrlFromBytes(bytes);
-}
-async function pkceChallengeS256(crypto2, verifier) {
-  const data = new TextEncoder().encode(verifier);
-  const digest = await crypto2.subtle.digest("SHA-256", data);
-  return base64UrlFromBytes(new Uint8Array(digest));
-}
 function cleanCallbackUrl(parsed) {
   try {
     const history = globalThis.history;
@@ -7076,36 +7168,6 @@ function createOidcAuthNamespace(config) {
       return null;
     }
   }
-  function decodeJwtPayload(token) {
-    const parts = token.split(".");
-    if (parts.length !== 3) return null;
-    try {
-      const b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
-      const pad = "=".repeat((4 - b64.length % 4) % 4);
-      const decoded = typeof atob === "function" ? atob(b64 + pad) : Buffer.from(b64 + pad, "base64").toString("utf-8");
-      return JSON.parse(decoded);
-    } catch {
-      return null;
-    }
-  }
-  function tokenToUser(token) {
-    const payload = decodeJwtPayload(token);
-    if (!payload || typeof payload.sub !== "string") return null;
-    if (typeof payload.exp === "number" && payload.exp * 1e3 < Date.now()) {
-      return null;
-    }
-    return {
-      uid: payload.sub,
-      email: typeof payload.email === "string" ? payload.email : "",
-      emailVerified: typeof payload.email_verified === "boolean" ? payload.email_verified : void 0,
-      displayName: typeof payload.name === "string" ? payload.name : void 0,
-      photoURL: typeof payload.picture === "string" ? payload.picture : void 0,
-      isStaff: payload.is_staff === true,
-      isCustomer: payload.is_customer === true,
-      tenantId: typeof payload.tenant_id === "string" ? payload.tenant_id : void 0,
-      ...payload
-    };
-  }
   function loadCachedUser() {
     if (cachedUser) {
       const exp = cachedUser.exp;
@@ -7126,7 +7188,7 @@ function createOidcAuthNamespace(config) {
       attemptSilentRefresh();
       return null;
     }
-    const user = tokenToUser(token);
+    const user = jwtToNeetruUser(token);
     if (!user) {
       storage.removeItem(STORAGE_KEY);
       attemptSilentRefresh();
@@ -7197,7 +7259,7 @@ function createOidcAuthNamespace(config) {
       if (!res.ok || typeof payload?.error === "string") return false;
       const idToken = payload?.id_token;
       if (typeof idToken !== "string" || idToken.length === 0) return false;
-      const user = tokenToUser(idToken);
+      const user = jwtToNeetruUser(idToken);
       if (!user) return false;
       const storage = getStorage();
       storage?.setItem(STORAGE_KEY, idToken);
@@ -7243,17 +7305,7 @@ function createOidcAuthNamespace(config) {
     }, msUntilExpiry + 1);
   }
   function resolveClientId() {
-    let clientId = config.oidcClientId;
-    if (!clientId && config.apiKey) {
-      clientId = parseApiKey(config.apiKey).keyId;
-    }
-    if (!clientId) {
-      throw new NeetruError(
-        "invalid_config",
-        "auth OIDC requer `oidcClientId` (ou `apiKey`) configurado para montar o client_id."
-      );
-    }
-    return clientId;
+    return resolveOidcClientId(config);
   }
   async function handleRedirectCallback(currentUrl) {
     const href = currentUrl ?? (typeof globalThis.location !== "undefined" ? globalThis.location.href : void 0);
@@ -7371,7 +7423,7 @@ function createOidcAuthNamespace(config) {
         "nonce do id_token n\xE3o confere com o da transa\xE7\xE3o OIDC (poss\xEDvel replay). Token descartado."
       );
     }
-    const user = tokenToUser(idToken);
+    const user = jwtToNeetruUser(idToken);
     if (!user) {
       throw new NeetruError(
         "token_exchange_failed",
@@ -7416,15 +7468,15 @@ function createOidcAuthNamespace(config) {
         };
         session.setItem(OIDC_TX_KEY, JSON.stringify(tx));
         const idpOrigin = resolveIdpOrigin(config.baseUrl);
-        const url = new URL("/api/v1/oauth/authorize", idpOrigin);
-        url.searchParams.set("response_type", "code");
-        url.searchParams.set("client_id", clientId);
-        url.searchParams.set("redirect_uri", redirectUri);
-        url.searchParams.set("scope", scope);
-        url.searchParams.set("state", state);
-        url.searchParams.set("nonce", nonce);
-        url.searchParams.set("code_challenge", codeChallenge);
-        url.searchParams.set("code_challenge_method", "S256");
+        const url = buildAuthorizeUrl({
+          idpOrigin,
+          clientId,
+          redirectUri,
+          scope,
+          state,
+          nonce,
+          codeChallenge
+        });
         globalThis.location.assign(url.toString());
         return;
       }
@@ -7439,7 +7491,7 @@ function createOidcAuthNamespace(config) {
       const storage = getStorage();
       const token = storage?.getItem(STORAGE_KEY) ?? null;
       if (!token) return null;
-      return tokenToUser(token) ? token : null;
+      return jwtToNeetruUser(token) ? token : null;
     },
     async signOut() {
       const storage = getStorage();
@@ -7564,7 +7616,7 @@ function createNeetruClient(config = {}) {
     productId: config.productId,
     tenantId: config.tenantId
   });
-  const isDev = env === "dev";
+  const isDev = env === "dev" && !isProductionRuntime();
   const auth = config.mocks?.auth ?? (isDev ? new MockAuth({ ...DEV_FIXTURE_USER }) : createOidcAuthNamespace(resolved));
   const usage = config.mocks?.usage ?? (isDev ? new MockUsage() : createUsageNamespace(resolved));
   const support = config.mocks?.support ?? (isDev ? new MockSupport() : createSupportNamespace(resolved));