@neetru/sdk 3.6.0 → 3.7.0

package/dist/mobile.mjs

@@ -1,5 +1,5 @@
 // src/errors.ts
-var NeetruError = class _NeetruError extends Error {
+var r = class t extends Error {
   code;
   status;
   requestId;
@@ -12,502 +12,398 @@ var NeetruError = class _NeetruError extends Error {
    * para um `NeetruDbErrorCode` mais específico (recuperável vs não).
    */
   reason;
-  constructor(code, message, status, requestId, reason) {
-    super(message);
-    this.name = "NeetruError";
-    this.code = code;
-    this.status = status;
-    this.requestId = requestId;
-    this.reason = reason;
-    Object.setPrototypeOf(this, _NeetruError.prototype);
+  constructor(e, i, s, o, l) {
+    super(i), this.name = "NeetruError", this.code = e, this.status = s, this.requestId = o, this.reason = l, Object.setPrototypeOf(this, t.prototype);
   }
 };
 
 // src/types.ts
-var DEFAULT_BASE_URL = "https://api.neetru.com";
+var L = "https://api.neetru.com";
 
 // src/base-url-allowlist.ts
-var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
-var NEETRU_SUFFIX = ".neetru.com";
-var NEETRU_APEX = "neetru.com";
-var SAFE_DEV_HOST_RE = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?\.(test|localhost)$/;
-function isSafeDevHost(hostname) {
-  return SAFE_DEV_HOST_RE.test(hostname);
+var O = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]), F = ".neetru.com", J = "neetru.com", Y = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?\.(test|localhost)$/;
+function D(t) {
+  return Y.test(t);
 }
-function normalizeHostname(hostname) {
-  return hostname.toLowerCase().replace(/\.+$/, "");
+function X(t) {
+  return t.toLowerCase().replace(/\.+$/, "");
 }
-function validateBaseUrl(baseUrl, allowedHosts = []) {
-  if (typeof baseUrl !== "string" || baseUrl.length === 0) {
-    throw new NeetruError("invalid_config", "baseUrl is required");
-  }
-  let parsed;
+function M(t, e = []) {
+  if (typeof t != "string" || t.length === 0)
+    throw new r("invalid_config", "baseUrl is required");
+  let i;
   try {
-    parsed = new URL(baseUrl);
+    i = new URL(t);
   } catch {
-    throw new NeetruError("invalid_config", `baseUrl is not a valid URL: ${baseUrl}`);
+    throw new r("invalid_config", `baseUrl is not a valid URL: ${t}`);
   }
-  const protocol = parsed.protocol;
-  const hostname = normalizeHostname(parsed.hostname);
-  if (isInsecureBypassActive()) {
-    if (typeof console !== "undefined") {
-      console.warn(
-        `[neetru-sdk] NEETRU_ALLOW_INSECURE_BASEURL=1 ativo. baseUrl=${baseUrl} aceito sem valida\xE7\xE3o.`
-      );
-    }
-    return baseUrl.replace(/\/+$/, "");
-  }
-  if (protocol !== "https:" && protocol !== "http:") {
-    throw new NeetruError(
+  let s = i.protocol, o = X(i.hostname);
+  if (Z())
+    return typeof console < "u" && console.warn(
+      `[neetru-sdk] NEETRU_ALLOW_INSECURE_BASEURL=1 ativo. baseUrl=${t} aceito sem valida\xE7\xE3o.`
+    ), t.replace(/\/+$/, "");
+  if (s !== "https:" && s !== "http:")
+    throw new r(
       "invalid_config",
-      `baseUrl protocol must be http: or https:, got ${protocol}`
+      `baseUrl protocol must be http: or https:, got ${s}`
     );
-  }
-  if (protocol === "http:") {
-    const isLoopback = LOOPBACK_HOSTS.has(hostname) || isSafeDevHost(hostname);
-    if (!isLoopback) {
-      throw new NeetruError(
+  if (s === "http:") {
+    if (!(O.has(o) || D(o)))
+      throw new r(
         "invalid_config",
-        `baseUrl with http: only allowed for localhost/127.0.0.1/*.test/*.localhost. Got: ${hostname}. Use https: or set NEETRU_ALLOW_INSECURE_BASEURL=1 to bypass.`
+        `baseUrl with http: only allowed for localhost/127.0.0.1/*.test/*.localhost. Got: ${o}. Use https: or set NEETRU_ALLOW_INSECURE_BASEURL=1 to bypass.`
       );
-    }
-    return baseUrl.replace(/\/+$/, "");
+    return t.replace(/\/+$/, "");
   }
-  const isNeetruDomain = hostname === NEETRU_APEX || hostname.endsWith(NEETRU_SUFFIX);
-  const isAllowedHost = allowedHosts.some((allowed) => {
-    const norm = allowed.toLowerCase();
-    return hostname === norm || hostname.endsWith(`.${norm}`);
-  });
-  const isLoopbackHttps = LOOPBACK_HOSTS.has(hostname) || isSafeDevHost(hostname);
-  if (!isNeetruDomain && !isAllowedHost && !isLoopbackHttps) {
-    throw new NeetruError(
+  let l = o === J || o.endsWith(F), A = e.some((m) => {
+    let k = m.toLowerCase();
+    return o === k || o.endsWith(`.${k}`);
+  }), R = O.has(o) || D(o);
+  if (!l && !A && !R)
+    throw new r(
       "invalid_config",
-      `baseUrl ${hostname} is not in the allowlist. Allowed: *.neetru.com, localhost, or configure { allowedHosts: ['...'] }. Bypass: NEETRU_ALLOW_INSECURE_BASEURL=1.`
+      `baseUrl ${o} is not in the allowlist. Allowed: *.neetru.com, localhost, or configure { allowedHosts: ['...'] }. Bypass: NEETRU_ALLOW_INSECURE_BASEURL=1.`
     );
-  }
-  return baseUrl.replace(/\/+$/, "");
+  return t.replace(/\/+$/, "");
 }
-function isInsecureBypassActive() {
+function Z() {
   try {
-    const proc = globalThis.process;
-    const envVal = proc?.env?.NEETRU_ALLOW_INSECURE_BASEURL;
-    if (envVal === "1" || envVal === "true") return true;
+    let e = globalThis.process?.env?.NEETRU_ALLOW_INSECURE_BASEURL;
+    if (e === "1" || e === "true") return !0;
   } catch {
   }
   try {
-    const g = globalThis.NEETRU_ALLOW_INSECURE_BASEURL;
-    if (g === "1" || g === "true" || g === true) return true;
+    let t = globalThis.NEETRU_ALLOW_INSECURE_BASEURL;
+    if (t === "1" || t === "true" || t === !0) return !0;
   } catch {
   }
   return false;
 }
 
 // src/api-key.ts
-var API_KEY_RE = /^nrt_([A-Za-z0-9]+)_([A-Za-z0-9]+)$/;
-function parseApiKey(apiKey) {
-  if (typeof apiKey !== "string" || apiKey.length === 0) {
-    throw new NeetruError(
+var G = /^nrt_([A-Za-z0-9]+)_([A-Za-z0-9]+)$/;
+function K(t) {
+  if (typeof t != "string" || t.length === 0)
+    throw new r(
       "invalid_config",
       "apiKey is required (formato nrt_<keyId>_<secret>)"
     );
-  }
-  const match = API_KEY_RE.exec(apiKey);
-  if (!match) {
-    throw new NeetruError(
+  let e = G.exec(t);
+  if (!e)
+    throw new r(
       "invalid_config",
       "apiKey malformado - esperado formato nrt_<keyId>_<secret>"
     );
-  }
-  return { keyId: match[1], secret: match[2] };
+  return { keyId: e[1], secret: e[2] };
 }
 
 // src/auth-pkce-shared.ts
-function getWebCrypto() {
-  const c = globalThis.crypto;
-  if (!c || typeof c.getRandomValues !== "function" || !c.subtle) {
-    throw new NeetruError(
+function H() {
+  let t = globalThis.crypto;
+  if (!t || typeof t.getRandomValues != "function" || !t.subtle)
+    throw new r(
       "runtime_unsupported",
       "auth.signIn requer WebCrypto (crypto.subtle) \u2014 indispon\xEDvel neste runtime. Use HTTPS (ou http://localhost) num browser moderno, ou instale um polyfill WebCrypto (ex: react-native-quick-crypto) em React Native."
     );
-  }
-  return c;
+  return t;
 }
-function base64UrlFromBytes(bytes) {
-  let str = "";
-  for (const b of bytes) str += String.fromCharCode(b);
-  const b64 = typeof btoa === "function" ? btoa(str) : Buffer.from(str, "binary").toString("base64");
-  return b64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+function $(t) {
+  let e = "";
+  for (let s of t) e += String.fromCharCode(s);
+  return (typeof btoa == "function" ? btoa(e) : Buffer.from(e, "binary").toString("base64")).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
-function randomUrlSafe(crypto, byteLen) {
-  const bytes = new Uint8Array(byteLen);
-  crypto.getRandomValues(bytes);
-  return base64UrlFromBytes(bytes);
+function v(t, e) {
+  let i = new Uint8Array(e);
+  return t.getRandomValues(i), $(i);
 }
-async function pkceChallengeS256(crypto, verifier) {
-  const data = new TextEncoder().encode(verifier);
-  const digest = await crypto.subtle.digest("SHA-256", data);
-  return base64UrlFromBytes(new Uint8Array(digest));
+async function B(t, e) {
+  let i = new TextEncoder().encode(e), s = await t.subtle.digest("SHA-256", i);
+  return $(new Uint8Array(s));
 }
-function resolveIdpOrigin(baseUrl) {
-  const overrideAuthUrl = typeof globalThis.NEETRU_AUTH_URL === "string" ? globalThis.NEETRU_AUTH_URL : null;
-  return overrideAuthUrl ?? baseUrl.replace(/^https?:\/\/api\./, "https://auth.");
+function U(t) {
+  return (typeof globalThis.NEETRU_AUTH_URL == "string" ? globalThis.NEETRU_AUTH_URL : null) ?? t.replace(/^https?:\/\/api\./, "https://auth.");
 }
-function resolveOidcClientId(config) {
-  let clientId = config.oidcClientId;
-  if (!clientId && config.apiKey) {
-    clientId = parseApiKey(config.apiKey).keyId;
-  }
-  if (!clientId) {
-    throw new NeetruError(
+function I(t) {
+  let e = t.oidcClientId;
+  if (!e && t.apiKey && (e = K(t.apiKey).keyId), !e)
+    throw new r(
       "invalid_config",
       "auth OIDC requer `oidcClientId` (ou `apiKey`) configurado para montar o client_id."
     );
-  }
-  return clientId;
+  return e;
 }
-function buildAuthorizeUrl(params) {
-  const url = new URL("/api/v1/oauth/authorize", params.idpOrigin);
-  url.searchParams.set("response_type", "code");
-  url.searchParams.set("client_id", params.clientId);
-  url.searchParams.set("redirect_uri", params.redirectUri);
-  url.searchParams.set("scope", params.scope);
-  url.searchParams.set("state", params.state);
-  url.searchParams.set("nonce", params.nonce);
-  url.searchParams.set("code_challenge", params.codeChallenge);
-  url.searchParams.set("code_challenge_method", "S256");
-  return url;
+function q(t) {
+  let e = new URL("/api/v1/oauth/authorize", t.idpOrigin);
+  return e.searchParams.set("response_type", "code"), e.searchParams.set("client_id", t.clientId), e.searchParams.set("redirect_uri", t.redirectUri), e.searchParams.set("scope", t.scope), e.searchParams.set("state", t.state), e.searchParams.set("nonce", t.nonce), e.searchParams.set("code_challenge", t.codeChallenge), e.searchParams.set("code_challenge_method", "S256"), e;
 }
-var OAUTH_TOKEN_PATH = "/api/v1/oauth/token";
-function decodeJwtPayload(token) {
-  const parts = token.split(".");
-  if (parts.length !== 3) return null;
+var W = "/api/v1/oauth/token";
+function N(t) {
+  let e = t.split(".");
+  if (e.length !== 3) return null;
   try {
-    const b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
-    const pad = "=".repeat((4 - b64.length % 4) % 4);
-    const decoded = typeof atob === "function" ? atob(b64 + pad) : Buffer.from(b64 + pad, "base64").toString("utf-8");
-    return JSON.parse(decoded);
+    let i = e[1].replace(/-/g, "+").replace(/_/g, "/"), s = "=".repeat((4 - i.length % 4) % 4), o = typeof atob == "function" ? atob(i + s) : Buffer.from(i + s, "base64").toString("utf-8");
+    return JSON.parse(o);
   } catch {
     return null;
   }
 }
-function jwtToNeetruUser(token) {
-  const payload = decodeJwtPayload(token);
-  if (!payload || typeof payload.sub !== "string") return null;
-  if (typeof payload.exp === "number" && payload.exp * 1e3 < Date.now()) {
-    return null;
-  }
-  return {
-    uid: payload.sub,
-    email: typeof payload.email === "string" ? payload.email : "",
-    emailVerified: typeof payload.email_verified === "boolean" ? payload.email_verified : void 0,
-    displayName: typeof payload.name === "string" ? payload.name : void 0,
-    photoURL: typeof payload.picture === "string" ? payload.picture : void 0,
-    isStaff: payload.is_staff === true,
-    isCustomer: payload.is_customer === true,
-    tenantId: typeof payload.tenant_id === "string" ? payload.tenant_id : void 0,
-    ...payload
+function _(t) {
+  let e = N(t);
+  return !e || typeof e.sub != "string" || typeof e.exp == "number" && e.exp * 1e3 < Date.now() ? null : {
+    uid: e.sub,
+    email: typeof e.email == "string" ? e.email : "",
+    emailVerified: typeof e.email_verified == "boolean" ? e.email_verified : void 0,
+    displayName: typeof e.name == "string" ? e.name : void 0,
+    photoURL: typeof e.picture == "string" ? e.picture : void 0,
+    isStaff: e.is_staff === true,
+    isCustomer: e.is_customer === true,
+    tenantId: typeof e.tenant_id == "string" ? e.tenant_id : void 0,
+    ...e
   };
 }
 
 // src/mobile.ts
-var OIDC_TX_KEY = "neetru_oauth_tx";
-var ID_TOKEN_KEY = "neetru_id_token";
-var REFRESH_TOKEN_KEY = "neetru_refresh_token";
-function resolveMobileConfig(config) {
-  if (!config.storage) {
-    throw new NeetruError(
+var h = "neetru_oauth_tx", y = "neetru_id_token", S = "neetru_refresh_token";
+function Q(t) {
+  if (!t.storage)
+    throw new r(
       "invalid_config",
       "createMobileAuthNamespace requer `storage` (MobileAuthStorage) \u2014 ver JSDoc de src/mobile.ts requisito 4."
     );
-  }
-  if (typeof config.openAuthUrl !== "function") {
-    throw new NeetruError(
+  if (typeof t.openAuthUrl != "function")
+    throw new r(
       "invalid_config",
       "createMobileAuthNamespace requer `openAuthUrl` (browser externo, NUNCA WebView embutida) \u2014 ver JSDoc de src/mobile.ts requisito 3."
     );
-  }
-  const fetchImpl = config.fetch ?? globalThis.fetch;
-  if (typeof fetchImpl !== "function") {
-    throw new NeetruError(
+  let e = t.fetch ?? globalThis.fetch;
+  if (typeof e != "function")
+    throw new r(
       "invalid_config",
       "fetch is not available in this runtime. Pass `fetch` explicitly to createMobileAuthNamespace."
     );
-  }
-  const baseUrl = validateBaseUrl(config.baseUrl ?? DEFAULT_BASE_URL, config.allowedHosts ?? []);
+  let i = M(t.baseUrl ?? L, t.allowedHosts ?? []);
   return {
-    fetchImpl: fetchImpl.bind(globalThis),
-    baseUrl,
-    oidcClientId: config.oidcClientId,
-    apiKey: config.apiKey,
-    storage: config.storage,
-    openAuthUrl: config.openAuthUrl
+    fetchImpl: e.bind(globalThis),
+    baseUrl: i,
+    oidcClientId: t.oidcClientId,
+    apiKey: t.apiKey,
+    storage: t.storage,
+    openAuthUrl: t.openAuthUrl
   };
 }
-async function postToken(fetchImpl, tokenUrl, form) {
-  let res;
+async function z(t, e, i) {
+  let s;
   try {
-    res = await fetchImpl(tokenUrl, {
+    s = await t(e, {
       method: "POST",
       headers: { "content-type": "application/x-www-form-urlencoded" },
-      body: form.toString()
+      body: i.toString()
     });
-  } catch (err) {
-    throw new NeetruError(
+  } catch (l) {
+    throw new r(
       "network_error",
-      `POST ${tokenUrl} falhou (network): ${err?.message ?? String(err)}`
+      `POST ${e} falhou (network): ${l?.message ?? String(l)}`
     );
   }
-  let payload = null;
+  let o = null;
   try {
-    payload = await res.json();
+    o = await s.json();
   } catch {
-    payload = null;
+    o = null;
   }
-  if (!res.ok || typeof payload?.error === "string") {
-    const desc = typeof payload?.error_description === "string" && payload.error_description || typeof payload?.error === "string" && payload.error || `HTTP ${res.status}`;
-    throw new NeetruError(
+  if (!s.ok || typeof o?.error == "string") {
+    let l = typeof o?.error_description == "string" && o.error_description || typeof o?.error == "string" && o.error || `HTTP ${s.status}`;
+    throw new r(
       "token_exchange_failed",
-      `Troca de tokens falhou no /token: ${desc}`,
-      res.status
+      `Troca de tokens falhou no /token: ${l}`,
+      s.status
     );
   }
-  return payload ?? {};
+  return o ?? {};
 }
-function createMobileAuthNamespace(config) {
-  const resolved = resolveMobileConfig(config);
-  const listeners = /* @__PURE__ */ new Set();
-  function tokenUrl() {
-    return `${resolveIdpOrigin(resolved.baseUrl)}${OAUTH_TOKEN_PATH}`;
+function ge(t) {
+  let e = Q(t), i = /* @__PURE__ */ new Set();
+  function s() {
+    return `${U(e.baseUrl)}${W}`;
   }
-  async function notify() {
-    const user = await getUser();
-    for (const l of listeners) {
+  async function o() {
+    let n = await m();
+    for (let a of i)
       try {
-        l(user);
+        a(n);
       } catch {
       }
-    }
   }
-  async function signIn(options) {
-    if (!options?.redirectUri) {
-      throw new NeetruError(
+  async function l(n) {
+    if (!n?.redirectUri)
+      throw new r(
         "invalid_config",
         "mobile auth.signIn requer `redirectUri` (Universal Link/App Link https://... registrado no Core) \u2014 n\xE3o h\xE1 location.origin impl\xEDcito em React Native."
       );
-    }
-    const crypto = getWebCrypto();
-    const scope = options.scope ?? "openid profile email";
-    const clientId = resolveOidcClientId(resolved);
-    const state = randomUrlSafe(crypto, 16);
-    const nonce = randomUrlSafe(crypto, 16);
-    const codeVerifier = randomUrlSafe(crypto, 32);
-    const codeChallenge = await pkceChallengeS256(crypto, codeVerifier);
-    const tx = {
-      state,
-      nonce,
-      codeVerifier,
-      redirectUri: options.redirectUri,
-      postLoginRedirect: options.postLoginRedirect
+    let a = H(), u = n.scope ?? "openid profile email", c = I(e), d = v(a, 16), f = v(a, 16), g = v(a, 32), p = await B(a, g), T = {
+      state: d,
+      nonce: f,
+      codeVerifier: g,
+      redirectUri: n.redirectUri,
+      postLoginRedirect: n.postLoginRedirect
     };
-    await resolved.storage.setItem(OIDC_TX_KEY, JSON.stringify(tx));
-    const idpOrigin = resolveIdpOrigin(resolved.baseUrl);
-    const url = buildAuthorizeUrl({
-      idpOrigin,
-      clientId,
-      redirectUri: options.redirectUri,
-      scope,
-      state,
-      nonce,
-      codeChallenge
+    await e.storage.setItem(h, JSON.stringify(T));
+    let C = U(e.baseUrl), w = q({
+      idpOrigin: C,
+      clientId: c,
+      redirectUri: n.redirectUri,
+      scope: u,
+      state: d,
+      nonce: f,
+      codeChallenge: p
     });
-    await resolved.openAuthUrl(url.toString());
+    await e.openAuthUrl(w.toString());
   }
-  async function completeSignIn(callbackUrl) {
-    if (!callbackUrl || typeof callbackUrl !== "string") {
-      throw new NeetruError(
+  async function A(n) {
+    if (!n || typeof n != "string")
+      throw new r(
         "invalid_config",
         "mobile auth.completeSignIn requer `callbackUrl` (a URL completa do deep link de retorno) \u2014 mobile n\xE3o tem location.href impl\xEDcito."
       );
-    }
-    let parsed;
+    let a;
     try {
-      parsed = new URL(callbackUrl);
+      a = new URL(n);
     } catch {
-      throw new NeetruError("invalid_config", `callbackUrl n\xE3o \xE9 uma URL v\xE1lida: ${callbackUrl}`);
+      throw new r("invalid_config", `callbackUrl n\xE3o \xE9 uma URL v\xE1lida: ${n}`);
     }
-    const params = parsed.searchParams;
-    const idpError = params.get("error");
-    if (idpError) {
-      const desc = params.get("error_description") ?? idpError;
-      await resolved.storage.removeItem(OIDC_TX_KEY);
-      throw new NeetruError(idpError, `OIDC authorize falhou: ${desc}`);
+    let u = a.searchParams, c = u.get("error");
+    if (c) {
+      let j = u.get("error_description") ?? c;
+      throw await e.storage.removeItem(h), new r(c, `OIDC authorize falhou: ${j}`);
     }
-    const code = params.get("code");
-    if (!code) {
-      await resolved.storage.removeItem(OIDC_TX_KEY);
-      throw new NeetruError(
+    let d = u.get("code");
+    if (!d)
+      throw await e.storage.removeItem(h), new r(
         "invalid_config",
         "callbackUrl n\xE3o cont\xE9m `?code=` nem `?error=` \u2014 n\xE3o \xE9 um callback OIDC v\xE1lido."
       );
-    }
-    const returnedState = params.get("state");
-    const txRaw = await resolved.storage.getItem(OIDC_TX_KEY);
-    let tx = null;
-    if (txRaw) {
+    let f = u.get("state"), g = await e.storage.getItem(h), p = null;
+    if (g)
       try {
-        tx = JSON.parse(txRaw);
+        p = JSON.parse(g);
       } catch {
-        tx = null;
+        p = null;
       }
-    }
-    if (!tx) {
-      throw new NeetruError(
+    if (!p)
+      throw new r(
         "oidc_state_mismatch",
         "Callback OIDC sem transa\xE7\xE3o pendente \u2014 `signIn` n\xE3o foi iniciado (ou j\xE1 consumido)."
       );
-    }
-    if (!returnedState || returnedState !== tx.state) {
-      await resolved.storage.removeItem(OIDC_TX_KEY);
-      throw new NeetruError(
+    if (!f || f !== p.state)
+      throw await e.storage.removeItem(h), new r(
         "oidc_state_mismatch",
         "state do callback OIDC n\xE3o confere com o da transa\xE7\xE3o (poss\xEDvel CSRF)."
       );
-    }
-    await resolved.storage.removeItem(OIDC_TX_KEY);
-    const clientId = resolveOidcClientId(resolved);
-    const form = new URLSearchParams({
+    await e.storage.removeItem(h);
+    let T = I(e), C = new URLSearchParams({
       grant_type: "authorization_code",
-      code,
-      redirect_uri: tx.redirectUri,
-      client_id: clientId,
-      code_verifier: tx.codeVerifier
-    });
-    const payload = await postToken(resolved.fetchImpl, tokenUrl(), form);
-    const idToken = payload.id_token;
-    if (typeof idToken !== "string" || idToken.length === 0) {
-      throw new NeetruError(
+      code: d,
+      redirect_uri: p.redirectUri,
+      client_id: T,
+      code_verifier: p.codeVerifier
+    }), w = await z(e.fetchImpl, s(), C), b = w.id_token;
+    if (typeof b != "string" || b.length === 0)
+      throw new r(
         "token_exchange_failed",
         "Resposta do /token sem `id_token` \u2014 o login n\xE3o pode ser completado."
       );
-    }
-    const claims = decodeJwtPayload(idToken);
-    if (!claims) {
-      throw new NeetruError(
+    let x = N(b);
+    if (!x)
+      throw new r(
         "token_exchange_failed",
         "id_token retornado pelo /token \xE9 malformado (payload indecodific\xE1vel)."
       );
-    }
-    if (claims.nonce !== tx.nonce) {
-      throw new NeetruError(
+    if (x.nonce !== p.nonce)
+      throw new r(
         "oidc_nonce_mismatch",
         "nonce do id_token n\xE3o confere com o da transa\xE7\xE3o OIDC (poss\xEDvel replay). Token descartado."
       );
-    }
-    const user = jwtToNeetruUser(idToken);
-    if (!user) {
-      throw new NeetruError(
+    let E = _(b);
+    if (!E)
+      throw new r(
         "token_exchange_failed",
         "id_token retornado pelo /token n\xE3o tem `sub` ou j\xE1 est\xE1 expirado."
       );
-    }
-    await resolved.storage.setItem(ID_TOKEN_KEY, idToken);
-    const refreshToken = payload.refresh_token;
-    if (typeof refreshToken === "string" && refreshToken.length > 0) {
-      await resolved.storage.setItem(REFRESH_TOKEN_KEY, refreshToken);
-    }
-    await notify();
-    return { user, postLoginRedirect: tx.postLoginRedirect };
+    await e.storage.setItem(y, b);
+    let P = w.refresh_token;
+    return typeof P == "string" && P.length > 0 && await e.storage.setItem(S, P), await o(), { user: E, postLoginRedirect: p.postLoginRedirect };
   }
-  async function getIdToken() {
-    const token = await resolved.storage.getItem(ID_TOKEN_KEY);
-    if (!token) return null;
-    return jwtToNeetruUser(token) ? token : null;
+  async function R() {
+    let n = await e.storage.getItem(y);
+    return n && _(n) ? n : null;
   }
-  async function getUser() {
-    const token = await resolved.storage.getItem(ID_TOKEN_KEY);
-    if (!token) return null;
-    return jwtToNeetruUser(token);
+  async function m() {
+    let n = await e.storage.getItem(y);
+    return n ? _(n) : null;
   }
-  async function refreshTokens() {
-    const refreshToken = await resolved.storage.getItem(REFRESH_TOKEN_KEY);
-    if (!refreshToken) return false;
-    let clientId;
+  async function k() {
+    let n = await e.storage.getItem(S);
+    if (!n) return false;
+    let a;
     try {
-      clientId = resolveOidcClientId(resolved);
+      a = I(e);
     } catch {
       return false;
     }
-    const form = new URLSearchParams({
+    let u = new URLSearchParams({
       grant_type: "refresh_token",
-      refresh_token: refreshToken,
-      client_id: clientId
-    });
-    let payload;
+      refresh_token: n,
+      client_id: a
+    }), c;
     try {
-      payload = await postToken(resolved.fetchImpl, tokenUrl(), form);
+      c = await z(e.fetchImpl, s(), u);
     } catch {
       return false;
     }
-    const idToken = payload.id_token;
-    if (typeof idToken !== "string" || idToken.length === 0) return false;
-    const user = jwtToNeetruUser(idToken);
-    if (!user) return false;
-    await resolved.storage.setItem(ID_TOKEN_KEY, idToken);
-    const rotated = payload.refresh_token;
-    if (typeof rotated === "string" && rotated.length > 0) {
-      await resolved.storage.setItem(REFRESH_TOKEN_KEY, rotated);
-    }
-    await notify();
-    return true;
+    let d = c.id_token;
+    if (typeof d != "string" || d.length === 0 || !_(d)) return false;
+    await e.storage.setItem(y, d);
+    let g = c.refresh_token;
+    return typeof g == "string" && g.length > 0 && await e.storage.setItem(S, g), await o(), true;
   }
-  async function signOut() {
-    const storedToken = await resolved.storage.getItem(ID_TOKEN_KEY);
-    await resolved.storage.removeItem(ID_TOKEN_KEY);
-    await resolved.storage.removeItem(REFRESH_TOKEN_KEY);
-    if (storedToken) {
-      const idpOrigin = resolveIdpOrigin(resolved.baseUrl);
-      const revokeUrl = `${idpOrigin}/api/v1/oauth/revoke`;
+  async function V() {
+    let n = await e.storage.getItem(y);
+    if (await e.storage.removeItem(y), await e.storage.removeItem(S), n) {
+      let u = `${U(e.baseUrl)}/api/v1/oauth/revoke`;
       try {
-        await resolved.fetchImpl(revokeUrl, {
+        await e.fetchImpl(u, {
           method: "POST",
           headers: { "content-type": "application/json" },
-          body: JSON.stringify({ token: storedToken })
+          body: JSON.stringify({ token: n })
         });
-      } catch (err) {
-        if (typeof console !== "undefined") {
-          console.warn(
-            "[neetru-sdk] mobile signOut: server-side revoke falhou. Refresh token pode estar stale.",
-            err
-          );
-        }
+      } catch (c) {
+        typeof console < "u" && console.warn(
+          "[neetru-sdk] mobile signOut: server-side revoke falhou. Refresh token pode estar stale.",
+          c
+        );
       }
     }
-    await notify();
+    await o();
   }
   return {
-    signIn,
-    completeSignIn,
-    getIdToken,
-    getUser,
-    onAuthStateChanged(listener) {
-      listeners.add(listener);
-      void getUser().then((user) => {
-        if (listeners.has(listener)) {
+    signIn: l,
+    completeSignIn: A,
+    getIdToken: R,
+    getUser: m,
+    onAuthStateChanged(n) {
+      return i.add(n), m().then((a) => {
+        if (i.has(n))
           try {
-            listener(user);
+            n(a);
           } catch {
           }
-        }
-      });
-      return () => {
-        listeners.delete(listener);
+      }), () => {
+        i.delete(n);
       };
     },
-    refreshTokens,
-    signOut
+    refreshTokens: k,
+    signOut: V
   };
 }
 
-export { createMobileAuthNamespace };
-//# sourceMappingURL=mobile.mjs.map
-//# sourceMappingURL=mobile.mjs.map
+export { ge as createMobileAuthNamespace };