@neetru/sdk 3.5.0 → 3.7.0

package/dist/mobile.cjs

@@ -0,0 +1,411 @@
+'use strict';
+
+// src/errors.ts
+var r = class t extends Error {
+  code;
+  status;
+  requestId;
+  /**
+   * Motivo semântico opcional propagado pelo Core no corpo do erro (campo
+   * `reason` no TOPO do body, fora de `error`). Usado principalmente pelo 503
+   * de lease de DB, onde `reason` discrimina o estado do ambiente
+   * (`suspended` | `archived` | `revoked` | `provisioning` | `degraded` |
+   * `no_route` | `expired`). Camadas superiores (ex.: `db/sql`) mapeiam isso
+   * para um `NeetruDbErrorCode` mais específico (recuperável vs não).
+   */
+  reason;
+  constructor(e, i, s, o, l) {
+    super(i), this.name = "NeetruError", this.code = e, this.status = s, this.requestId = o, this.reason = l, Object.setPrototypeOf(this, t.prototype);
+  }
+};
+
+// src/types.ts
+var L = "https://api.neetru.com";
+
+// src/base-url-allowlist.ts
+var O = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]), F = ".neetru.com", J = "neetru.com", Y = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?\.(test|localhost)$/;
+function D(t) {
+  return Y.test(t);
+}
+function X(t) {
+  return t.toLowerCase().replace(/\.+$/, "");
+}
+function M(t, e = []) {
+  if (typeof t != "string" || t.length === 0)
+    throw new r("invalid_config", "baseUrl is required");
+  let i;
+  try {
+    i = new URL(t);
+  } catch {
+    throw new r("invalid_config", `baseUrl is not a valid URL: ${t}`);
+  }
+  let s = i.protocol, o = X(i.hostname);
+  if (Z())
+    return typeof console < "u" && console.warn(
+      `[neetru-sdk] NEETRU_ALLOW_INSECURE_BASEURL=1 ativo. baseUrl=${t} aceito sem valida\xE7\xE3o.`
+    ), t.replace(/\/+$/, "");
+  if (s !== "https:" && s !== "http:")
+    throw new r(
+      "invalid_config",
+      `baseUrl protocol must be http: or https:, got ${s}`
+    );
+  if (s === "http:") {
+    if (!(O.has(o) || D(o)))
+      throw new r(
+        "invalid_config",
+        `baseUrl with http: only allowed for localhost/127.0.0.1/*.test/*.localhost. Got: ${o}. Use https: or set NEETRU_ALLOW_INSECURE_BASEURL=1 to bypass.`
+      );
+    return t.replace(/\/+$/, "");
+  }
+  let l = o === J || o.endsWith(F), A = e.some((m) => {
+    let k = m.toLowerCase();
+    return o === k || o.endsWith(`.${k}`);
+  }), R = O.has(o) || D(o);
+  if (!l && !A && !R)
+    throw new r(
+      "invalid_config",
+      `baseUrl ${o} is not in the allowlist. Allowed: *.neetru.com, localhost, or configure { allowedHosts: ['...'] }. Bypass: NEETRU_ALLOW_INSECURE_BASEURL=1.`
+    );
+  return t.replace(/\/+$/, "");
+}
+function Z() {
+  try {
+    let e = globalThis.process?.env?.NEETRU_ALLOW_INSECURE_BASEURL;
+    if (e === "1" || e === "true") return !0;
+  } catch {
+  }
+  try {
+    let t = globalThis.NEETRU_ALLOW_INSECURE_BASEURL;
+    if (t === "1" || t === "true" || t === !0) return !0;
+  } catch {
+  }
+  return false;
+}
+
+// src/api-key.ts
+var G = /^nrt_([A-Za-z0-9]+)_([A-Za-z0-9]+)$/;
+function K(t) {
+  if (typeof t != "string" || t.length === 0)
+    throw new r(
+      "invalid_config",
+      "apiKey is required (formato nrt_<keyId>_<secret>)"
+    );
+  let e = G.exec(t);
+  if (!e)
+    throw new r(
+      "invalid_config",
+      "apiKey malformado - esperado formato nrt_<keyId>_<secret>"
+    );
+  return { keyId: e[1], secret: e[2] };
+}
+
+// src/auth-pkce-shared.ts
+function H() {
+  let t = globalThis.crypto;
+  if (!t || typeof t.getRandomValues != "function" || !t.subtle)
+    throw new r(
+      "runtime_unsupported",
+      "auth.signIn requer WebCrypto (crypto.subtle) \u2014 indispon\xEDvel neste runtime. Use HTTPS (ou http://localhost) num browser moderno, ou instale um polyfill WebCrypto (ex: react-native-quick-crypto) em React Native."
+    );
+  return t;
+}
+function $(t) {
+  let e = "";
+  for (let s of t) e += String.fromCharCode(s);
+  return (typeof btoa == "function" ? btoa(e) : Buffer.from(e, "binary").toString("base64")).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+function v(t, e) {
+  let i = new Uint8Array(e);
+  return t.getRandomValues(i), $(i);
+}
+async function B(t, e) {
+  let i = new TextEncoder().encode(e), s = await t.subtle.digest("SHA-256", i);
+  return $(new Uint8Array(s));
+}
+function U(t) {
+  return (typeof globalThis.NEETRU_AUTH_URL == "string" ? globalThis.NEETRU_AUTH_URL : null) ?? t.replace(/^https?:\/\/api\./, "https://auth.");
+}
+function I(t) {
+  let e = t.oidcClientId;
+  if (!e && t.apiKey && (e = K(t.apiKey).keyId), !e)
+    throw new r(
+      "invalid_config",
+      "auth OIDC requer `oidcClientId` (ou `apiKey`) configurado para montar o client_id."
+    );
+  return e;
+}
+function q(t) {
+  let e = new URL("/api/v1/oauth/authorize", t.idpOrigin);
+  return e.searchParams.set("response_type", "code"), e.searchParams.set("client_id", t.clientId), e.searchParams.set("redirect_uri", t.redirectUri), e.searchParams.set("scope", t.scope), e.searchParams.set("state", t.state), e.searchParams.set("nonce", t.nonce), e.searchParams.set("code_challenge", t.codeChallenge), e.searchParams.set("code_challenge_method", "S256"), e;
+}
+var W = "/api/v1/oauth/token";
+function N(t) {
+  let e = t.split(".");
+  if (e.length !== 3) return null;
+  try {
+    let i = e[1].replace(/-/g, "+").replace(/_/g, "/"), s = "=".repeat((4 - i.length % 4) % 4), o = typeof atob == "function" ? atob(i + s) : Buffer.from(i + s, "base64").toString("utf-8");
+    return JSON.parse(o);
+  } catch {
+    return null;
+  }
+}
+function _(t) {
+  let e = N(t);
+  return !e || typeof e.sub != "string" || typeof e.exp == "number" && e.exp * 1e3 < Date.now() ? null : {
+    uid: e.sub,
+    email: typeof e.email == "string" ? e.email : "",
+    emailVerified: typeof e.email_verified == "boolean" ? e.email_verified : void 0,
+    displayName: typeof e.name == "string" ? e.name : void 0,
+    photoURL: typeof e.picture == "string" ? e.picture : void 0,
+    isStaff: e.is_staff === true,
+    isCustomer: e.is_customer === true,
+    tenantId: typeof e.tenant_id == "string" ? e.tenant_id : void 0,
+    ...e
+  };
+}
+
+// src/mobile.ts
+var h = "neetru_oauth_tx", y = "neetru_id_token", S = "neetru_refresh_token";
+function Q(t) {
+  if (!t.storage)
+    throw new r(
+      "invalid_config",
+      "createMobileAuthNamespace requer `storage` (MobileAuthStorage) \u2014 ver JSDoc de src/mobile.ts requisito 4."
+    );
+  if (typeof t.openAuthUrl != "function")
+    throw new r(
+      "invalid_config",
+      "createMobileAuthNamespace requer `openAuthUrl` (browser externo, NUNCA WebView embutida) \u2014 ver JSDoc de src/mobile.ts requisito 3."
+    );
+  let e = t.fetch ?? globalThis.fetch;
+  if (typeof e != "function")
+    throw new r(
+      "invalid_config",
+      "fetch is not available in this runtime. Pass `fetch` explicitly to createMobileAuthNamespace."
+    );
+  let i = M(t.baseUrl ?? L, t.allowedHosts ?? []);
+  return {
+    fetchImpl: e.bind(globalThis),
+    baseUrl: i,
+    oidcClientId: t.oidcClientId,
+    apiKey: t.apiKey,
+    storage: t.storage,
+    openAuthUrl: t.openAuthUrl
+  };
+}
+async function z(t, e, i) {
+  let s;
+  try {
+    s = await t(e, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: i.toString()
+    });
+  } catch (l) {
+    throw new r(
+      "network_error",
+      `POST ${e} falhou (network): ${l?.message ?? String(l)}`
+    );
+  }
+  let o = null;
+  try {
+    o = await s.json();
+  } catch {
+    o = null;
+  }
+  if (!s.ok || typeof o?.error == "string") {
+    let l = typeof o?.error_description == "string" && o.error_description || typeof o?.error == "string" && o.error || `HTTP ${s.status}`;
+    throw new r(
+      "token_exchange_failed",
+      `Troca de tokens falhou no /token: ${l}`,
+      s.status
+    );
+  }
+  return o ?? {};
+}
+function ge(t) {
+  let e = Q(t), i = /* @__PURE__ */ new Set();
+  function s() {
+    return `${U(e.baseUrl)}${W}`;
+  }
+  async function o() {
+    let n = await m();
+    for (let a of i)
+      try {
+        a(n);
+      } catch {
+      }
+  }
+  async function l(n) {
+    if (!n?.redirectUri)
+      throw new r(
+        "invalid_config",
+        "mobile auth.signIn requer `redirectUri` (Universal Link/App Link https://... registrado no Core) \u2014 n\xE3o h\xE1 location.origin impl\xEDcito em React Native."
+      );
+    let a = H(), u = n.scope ?? "openid profile email", c = I(e), d = v(a, 16), f = v(a, 16), g = v(a, 32), p = await B(a, g), T = {
+      state: d,
+      nonce: f,
+      codeVerifier: g,
+      redirectUri: n.redirectUri,
+      postLoginRedirect: n.postLoginRedirect
+    };
+    await e.storage.setItem(h, JSON.stringify(T));
+    let C = U(e.baseUrl), w = q({
+      idpOrigin: C,
+      clientId: c,
+      redirectUri: n.redirectUri,
+      scope: u,
+      state: d,
+      nonce: f,
+      codeChallenge: p
+    });
+    await e.openAuthUrl(w.toString());
+  }
+  async function A(n) {
+    if (!n || typeof n != "string")
+      throw new r(
+        "invalid_config",
+        "mobile auth.completeSignIn requer `callbackUrl` (a URL completa do deep link de retorno) \u2014 mobile n\xE3o tem location.href impl\xEDcito."
+      );
+    let a;
+    try {
+      a = new URL(n);
+    } catch {
+      throw new r("invalid_config", `callbackUrl n\xE3o \xE9 uma URL v\xE1lida: ${n}`);
+    }
+    let u = a.searchParams, c = u.get("error");
+    if (c) {
+      let j = u.get("error_description") ?? c;
+      throw await e.storage.removeItem(h), new r(c, `OIDC authorize falhou: ${j}`);
+    }
+    let d = u.get("code");
+    if (!d)
+      throw await e.storage.removeItem(h), new r(
+        "invalid_config",
+        "callbackUrl n\xE3o cont\xE9m `?code=` nem `?error=` \u2014 n\xE3o \xE9 um callback OIDC v\xE1lido."
+      );
+    let f = u.get("state"), g = await e.storage.getItem(h), p = null;
+    if (g)
+      try {
+        p = JSON.parse(g);
+      } catch {
+        p = null;
+      }
+    if (!p)
+      throw new r(
+        "oidc_state_mismatch",
+        "Callback OIDC sem transa\xE7\xE3o pendente \u2014 `signIn` n\xE3o foi iniciado (ou j\xE1 consumido)."
+      );
+    if (!f || f !== p.state)
+      throw await e.storage.removeItem(h), new r(
+        "oidc_state_mismatch",
+        "state do callback OIDC n\xE3o confere com o da transa\xE7\xE3o (poss\xEDvel CSRF)."
+      );
+    await e.storage.removeItem(h);
+    let T = I(e), C = new URLSearchParams({
+      grant_type: "authorization_code",
+      code: d,
+      redirect_uri: p.redirectUri,
+      client_id: T,
+      code_verifier: p.codeVerifier
+    }), w = await z(e.fetchImpl, s(), C), b = w.id_token;
+    if (typeof b != "string" || b.length === 0)
+      throw new r(
+        "token_exchange_failed",
+        "Resposta do /token sem `id_token` \u2014 o login n\xE3o pode ser completado."
+      );
+    let x = N(b);
+    if (!x)
+      throw new r(
+        "token_exchange_failed",
+        "id_token retornado pelo /token \xE9 malformado (payload indecodific\xE1vel)."
+      );
+    if (x.nonce !== p.nonce)
+      throw new r(
+        "oidc_nonce_mismatch",
+        "nonce do id_token n\xE3o confere com o da transa\xE7\xE3o OIDC (poss\xEDvel replay). Token descartado."
+      );
+    let E = _(b);
+    if (!E)
+      throw new r(
+        "token_exchange_failed",
+        "id_token retornado pelo /token n\xE3o tem `sub` ou j\xE1 est\xE1 expirado."
+      );
+    await e.storage.setItem(y, b);
+    let P = w.refresh_token;
+    return typeof P == "string" && P.length > 0 && await e.storage.setItem(S, P), await o(), { user: E, postLoginRedirect: p.postLoginRedirect };
+  }
+  async function R() {
+    let n = await e.storage.getItem(y);
+    return n && _(n) ? n : null;
+  }
+  async function m() {
+    let n = await e.storage.getItem(y);
+    return n ? _(n) : null;
+  }
+  async function k() {
+    let n = await e.storage.getItem(S);
+    if (!n) return false;
+    let a;
+    try {
+      a = I(e);
+    } catch {
+      return false;
+    }
+    let u = new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: n,
+      client_id: a
+    }), c;
+    try {
+      c = await z(e.fetchImpl, s(), u);
+    } catch {
+      return false;
+    }
+    let d = c.id_token;
+    if (typeof d != "string" || d.length === 0 || !_(d)) return false;
+    await e.storage.setItem(y, d);
+    let g = c.refresh_token;
+    return typeof g == "string" && g.length > 0 && await e.storage.setItem(S, g), await o(), true;
+  }
+  async function V() {
+    let n = await e.storage.getItem(y);
+    if (await e.storage.removeItem(y), await e.storage.removeItem(S), n) {
+      let u = `${U(e.baseUrl)}/api/v1/oauth/revoke`;
+      try {
+        await e.fetchImpl(u, {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ token: n })
+        });
+      } catch (c) {
+        typeof console < "u" && console.warn(
+          "[neetru-sdk] mobile signOut: server-side revoke falhou. Refresh token pode estar stale.",
+          c
+        );
+      }
+    }
+    await o();
+  }
+  return {
+    signIn: l,
+    completeSignIn: A,
+    getIdToken: R,
+    getUser: m,
+    onAuthStateChanged(n) {
+      return i.add(n), m().then((a) => {
+        if (i.has(n))
+          try {
+            n(a);
+          } catch {
+          }
+      }), () => {
+        i.delete(n);
+      };
+    },
+    refreshTokens: k,
+    signOut: V
+  };
+}
+
+exports.createMobileAuthNamespace = ge;

package/dist/mobile.d.cts

@@ -0,0 +1,89 @@
+import { X as NeetruClientConfig, v as CompleteSignInResult, a5 as NeetruUser, m as AuthStateListener } from './types-Bx4kTLmk.cjs';
+import 'drizzle-orm/node-postgres';
+import './errors.cjs';
+
+/**
+ * Storage assíncrono chave-valor que o app RN injeta — ex: um wrapper fino
+ * sobre `expo-secure-store` ou `@react-native-async-storage/async-storage`.
+ * O SDK não assume NENHUMA implementação concreta.
+ */
+interface MobileAuthStorage {
+    getItem(key: string): Promise<string | null>;
+    setItem(key: string, value: string): Promise<void>;
+    removeItem(key: string): Promise<void>;
+}
+interface MobileAuthConfig extends NeetruClientConfig {
+    /** Storage persistente (idealmente seguro) — ver requisito 4 no JSDoc do módulo. */
+    storage: MobileAuthStorage;
+    /**
+     * Abre a URL de authorize num browser EXTERNO (nunca WebView embutida) —
+     * ver requisito 3 no JSDoc do módulo. Ex: `WebBrowser.openAuthSessionAsync`
+     * (expo-web-browser) ou `Linking.openURL`.
+     */
+    openAuthUrl: (url: string) => Promise<void>;
+}
+interface MobileSignInOptions {
+    /**
+     * Universal Link / App Link (`https://...`) registrado como `redirect_uri`
+     * do OIDC client mobile no Core. Obrigatório — diferente do namespace web,
+     * não há `location.origin` implícito pra usar como default.
+     */
+    redirectUri: string;
+    /** OIDC scope. Default `openid profile email`. */
+    scope?: string;
+    /** Destino pós-login que o app decide interpretar após `completeSignIn`. */
+    postLoginRedirect?: string;
+}
+interface MobileAuthNamespace {
+    /**
+     * Inicia o fluxo OIDC Authorization Code + PKCE: gera `state`/`nonce`/
+     * `code_verifier`/`code_challenge` (S256), persiste a transação via
+     * `config.storage`, e chama `config.openAuthUrl(url)` — NUNCA navega
+     * sozinho (sem `location` em RN).
+     *
+     * @throws {NeetruError} `runtime_unsupported` se `crypto.subtle` ausente.
+     */
+    signIn(options: MobileSignInOptions): Promise<void>;
+    /**
+     * Completa o login: recebe a URL COMPLETA do deep link de retorno (o app
+     * lê via `Linking.getInitialURL()` / listener `Linking.addEventListener`)
+     * e troca o `code` pelos tokens no mesmo `/api/v1/oauth/token` que o
+     * namespace web usa (POST x-www-form-urlencoded, PKCE puro, sem
+     * client_secret). Valida `state` (CSRF) e `nonce` (anti-replay), grava os
+     * tokens em `config.storage` e notifica `onAuthStateChanged`.
+     *
+     * `callbackUrl` é OBRIGATÓRIO — mobile não tem `location.href` implícito.
+     *
+     * @throws {NeetruError} `oidc_state_mismatch`, `oidc_nonce_mismatch`,
+     *   `token_exchange_failed`, `network_error`, ou `invalid_config` se a URL
+     *   não é um callback OIDC válido (sem `?code=`/`?error=`) ou não há
+     *   transação pendente no storage.
+     */
+    completeSignIn(callbackUrl: string): Promise<CompleteSignInResult>;
+    /** `id_token` cru armazenado, ou `null` se ausente/expirado. */
+    getIdToken(): Promise<string | null>;
+    /** Usuário atual (claims do `id_token` armazenado), ou `null`. */
+    getUser(): Promise<NeetruUser | null>;
+    /**
+     * Subscreve a mudanças de estado de auth. Diferente do namespace web, o
+     * listener inicial é disparado de forma ASSÍNCRONA (a leitura do storage
+     * injetado é sempre `Promise`) — não confie em ordem síncrona de chamada.
+     * Retorna função de unsubscribe (síncrona).
+     */
+    onAuthStateChanged(listener: AuthStateListener): () => void;
+    /**
+     * Renova os tokens via `grant_type=refresh_token`, se houver refresh_token
+     * armazenado. `true` se renovou; `false` em qualquer falha (sem refresh
+     * token, `invalid_grant`, rede) — não lança.
+     */
+    refreshTokens(): Promise<boolean>;
+    /** Limpa a sessão local (storage) + melhor esforço de revoke no servidor. */
+    signOut(): Promise<void>;
+}
+/**
+ * Cria o namespace de auth mobile. Ver JSDoc do módulo pros requisitos do
+ * app consumidor (polyfill WebCrypto, browser externo, storage seguro).
+ */
+declare function createMobileAuthNamespace(config: MobileAuthConfig): MobileAuthNamespace;
+
+export { type MobileAuthConfig, type MobileAuthNamespace, type MobileAuthStorage, type MobileSignInOptions, createMobileAuthNamespace };

package/dist/mobile.d.ts

@@ -0,0 +1,89 @@
+import { X as NeetruClientConfig, v as CompleteSignInResult, a5 as NeetruUser, m as AuthStateListener } from './types-Dx0IrOSF.js';
+import 'drizzle-orm/node-postgres';
+import './errors.js';
+
+/**
+ * Storage assíncrono chave-valor que o app RN injeta — ex: um wrapper fino
+ * sobre `expo-secure-store` ou `@react-native-async-storage/async-storage`.
+ * O SDK não assume NENHUMA implementação concreta.
+ */
+interface MobileAuthStorage {
+    getItem(key: string): Promise<string | null>;
+    setItem(key: string, value: string): Promise<void>;
+    removeItem(key: string): Promise<void>;
+}
+interface MobileAuthConfig extends NeetruClientConfig {
+    /** Storage persistente (idealmente seguro) — ver requisito 4 no JSDoc do módulo. */
+    storage: MobileAuthStorage;
+    /**
+     * Abre a URL de authorize num browser EXTERNO (nunca WebView embutida) —
+     * ver requisito 3 no JSDoc do módulo. Ex: `WebBrowser.openAuthSessionAsync`
+     * (expo-web-browser) ou `Linking.openURL`.
+     */
+    openAuthUrl: (url: string) => Promise<void>;
+}
+interface MobileSignInOptions {
+    /**
+     * Universal Link / App Link (`https://...`) registrado como `redirect_uri`
+     * do OIDC client mobile no Core. Obrigatório — diferente do namespace web,
+     * não há `location.origin` implícito pra usar como default.
+     */
+    redirectUri: string;
+    /** OIDC scope. Default `openid profile email`. */
+    scope?: string;
+    /** Destino pós-login que o app decide interpretar após `completeSignIn`. */
+    postLoginRedirect?: string;
+}
+interface MobileAuthNamespace {
+    /**
+     * Inicia o fluxo OIDC Authorization Code + PKCE: gera `state`/`nonce`/
+     * `code_verifier`/`code_challenge` (S256), persiste a transação via
+     * `config.storage`, e chama `config.openAuthUrl(url)` — NUNCA navega
+     * sozinho (sem `location` em RN).
+     *
+     * @throws {NeetruError} `runtime_unsupported` se `crypto.subtle` ausente.
+     */
+    signIn(options: MobileSignInOptions): Promise<void>;
+    /**
+     * Completa o login: recebe a URL COMPLETA do deep link de retorno (o app
+     * lê via `Linking.getInitialURL()` / listener `Linking.addEventListener`)
+     * e troca o `code` pelos tokens no mesmo `/api/v1/oauth/token` que o
+     * namespace web usa (POST x-www-form-urlencoded, PKCE puro, sem
+     * client_secret). Valida `state` (CSRF) e `nonce` (anti-replay), grava os
+     * tokens em `config.storage` e notifica `onAuthStateChanged`.
+     *
+     * `callbackUrl` é OBRIGATÓRIO — mobile não tem `location.href` implícito.
+     *
+     * @throws {NeetruError} `oidc_state_mismatch`, `oidc_nonce_mismatch`,
+     *   `token_exchange_failed`, `network_error`, ou `invalid_config` se a URL
+     *   não é um callback OIDC válido (sem `?code=`/`?error=`) ou não há
+     *   transação pendente no storage.
+     */
+    completeSignIn(callbackUrl: string): Promise<CompleteSignInResult>;
+    /** `id_token` cru armazenado, ou `null` se ausente/expirado. */
+    getIdToken(): Promise<string | null>;
+    /** Usuário atual (claims do `id_token` armazenado), ou `null`. */
+    getUser(): Promise<NeetruUser | null>;
+    /**
+     * Subscreve a mudanças de estado de auth. Diferente do namespace web, o
+     * listener inicial é disparado de forma ASSÍNCRONA (a leitura do storage
+     * injetado é sempre `Promise`) — não confie em ordem síncrona de chamada.
+     * Retorna função de unsubscribe (síncrona).
+     */
+    onAuthStateChanged(listener: AuthStateListener): () => void;
+    /**
+     * Renova os tokens via `grant_type=refresh_token`, se houver refresh_token
+     * armazenado. `true` se renovou; `false` em qualquer falha (sem refresh
+     * token, `invalid_grant`, rede) — não lança.
+     */
+    refreshTokens(): Promise<boolean>;
+    /** Limpa a sessão local (storage) + melhor esforço de revoke no servidor. */
+    signOut(): Promise<void>;
+}
+/**
+ * Cria o namespace de auth mobile. Ver JSDoc do módulo pros requisitos do
+ * app consumidor (polyfill WebCrypto, browser externo, storage seguro).
+ */
+declare function createMobileAuthNamespace(config: MobileAuthConfig): MobileAuthNamespace;
+
+export { type MobileAuthConfig, type MobileAuthNamespace, type MobileAuthStorage, type MobileSignInOptions, createMobileAuthNamespace };