@neetru/sdk 3.6.0 → 3.8.0

package/dist/mobile.mjs

@@ -1,5 +1,5 @@
 // src/errors.ts
-var NeetruError = class _NeetruError extends Error {
+var n = class t extends Error {
   code;
   status;
   requestId;
@@ -12,502 +12,617 @@ var NeetruError = class _NeetruError extends Error {
    * para um `NeetruDbErrorCode` mais específico (recuperável vs não).
    */
   reason;
-  constructor(code, message, status, requestId, reason) {
-    super(message);
-    this.name = "NeetruError";
-    this.code = code;
-    this.status = status;
-    this.requestId = requestId;
-    this.reason = reason;
-    Object.setPrototypeOf(this, _NeetruError.prototype);
+  /**
+   * 3.8.0: `x-correlation-id` da requisição que falhou. O SDK gera um UUID por
+   * chamada (ou usa o que o chamador passou) e manda no header; o Core grava o
+   * mesmo id nos logs/auditoria — cite-o ao abrir um ticket de suporte.
+   * `undefined` em erros que acontecem antes de qualquer requisição.
+   */
+  correlationId;
+  constructor(e, o, s, i, p, m) {
+    super(o), this.name = "NeetruError", this.code = e, this.status = s, this.requestId = i, this.reason = p, this.correlationId = m, Object.setPrototypeOf(this, t.prototype);
+  }
+}, v = class t extends n {
+  constructor(e, o, s, i, p) {
+    super("auth_required", e, s, i, o, p), this.name = "NeetruAuthRequiredError", Object.setPrototypeOf(this, t.prototype);
   }
 };
 
 // src/types.ts
-var DEFAULT_BASE_URL = "https://api.neetru.com";
+var H = "https://api.neetru.com";
 
 // src/base-url-allowlist.ts
-var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
-var NEETRU_SUFFIX = ".neetru.com";
-var NEETRU_APEX = "neetru.com";
-var SAFE_DEV_HOST_RE = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?\.(test|localhost)$/;
-function isSafeDevHost(hostname) {
-  return SAFE_DEV_HOST_RE.test(hostname);
+var B = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]), le = ".neetru.com", ue = "neetru.com", de = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?\.(test|localhost)$/;
+function j(t) {
+  return de.test(t);
 }
-function normalizeHostname(hostname) {
-  return hostname.toLowerCase().replace(/\.+$/, "");
+function pe(t) {
+  return t.toLowerCase().replace(/\.+$/, "");
 }
-function validateBaseUrl(baseUrl, allowedHosts = []) {
-  if (typeof baseUrl !== "string" || baseUrl.length === 0) {
-    throw new NeetruError("invalid_config", "baseUrl is required");
-  }
-  let parsed;
+function F(t, e = []) {
+  if (typeof t != "string" || t.length === 0)
+    throw new n("invalid_config", "baseUrl is required");
+  let o;
   try {
-    parsed = new URL(baseUrl);
+    o = new URL(t);
   } catch {
-    throw new NeetruError("invalid_config", `baseUrl is not a valid URL: ${baseUrl}`);
-  }
-  const protocol = parsed.protocol;
-  const hostname = normalizeHostname(parsed.hostname);
-  if (isInsecureBypassActive()) {
-    if (typeof console !== "undefined") {
-      console.warn(
-        `[neetru-sdk] NEETRU_ALLOW_INSECURE_BASEURL=1 ativo. baseUrl=${baseUrl} aceito sem valida\xE7\xE3o.`
-      );
-    }
-    return baseUrl.replace(/\/+$/, "");
+    throw new n("invalid_config", `baseUrl is not a valid URL: ${t}`);
   }
-  if (protocol !== "https:" && protocol !== "http:") {
-    throw new NeetruError(
+  let s = o.protocol, i = pe(o.hostname);
+  if (fe())
+    return typeof console < "u" && console.warn(
+      `[neetru-sdk] NEETRU_ALLOW_INSECURE_BASEURL=1 ativo. baseUrl=${t} aceito sem valida\xE7\xE3o.`
+    ), t.replace(/\/+$/, "");
+  if (s !== "https:" && s !== "http:")
+    throw new n(
       "invalid_config",
-      `baseUrl protocol must be http: or https:, got ${protocol}`
+      `baseUrl protocol must be http: or https:, got ${s}`
     );
-  }
-  if (protocol === "http:") {
-    const isLoopback = LOOPBACK_HOSTS.has(hostname) || isSafeDevHost(hostname);
-    if (!isLoopback) {
-      throw new NeetruError(
+  if (s === "http:") {
+    if (!(B.has(i) || j(i)))
+      throw new n(
         "invalid_config",
-        `baseUrl with http: only allowed for localhost/127.0.0.1/*.test/*.localhost. Got: ${hostname}. Use https: or set NEETRU_ALLOW_INSECURE_BASEURL=1 to bypass.`
+        `baseUrl with http: only allowed for localhost/127.0.0.1/*.test/*.localhost. Got: ${i}. Use https: or set NEETRU_ALLOW_INSECURE_BASEURL=1 to bypass.`
       );
-    }
-    return baseUrl.replace(/\/+$/, "");
+    return t.replace(/\/+$/, "");
   }
-  const isNeetruDomain = hostname === NEETRU_APEX || hostname.endsWith(NEETRU_SUFFIX);
-  const isAllowedHost = allowedHosts.some((allowed) => {
-    const norm = allowed.toLowerCase();
-    return hostname === norm || hostname.endsWith(`.${norm}`);
-  });
-  const isLoopbackHttps = LOOPBACK_HOSTS.has(hostname) || isSafeDevHost(hostname);
-  if (!isNeetruDomain && !isAllowedHost && !isLoopbackHttps) {
-    throw new NeetruError(
+  let p = i === ue || i.endsWith(le), m = e.some((h) => {
+    let w = h.toLowerCase();
+    return i === w || i.endsWith(`.${w}`);
+  }), I = B.has(i) || j(i);
+  if (!p && !m && !I)
+    throw new n(
       "invalid_config",
-      `baseUrl ${hostname} is not in the allowlist. Allowed: *.neetru.com, localhost, or configure { allowedHosts: ['...'] }. Bypass: NEETRU_ALLOW_INSECURE_BASEURL=1.`
+      `baseUrl ${i} is not in the allowlist. Allowed: *.neetru.com, localhost, or configure { allowedHosts: ['...'] }. Bypass: NEETRU_ALLOW_INSECURE_BASEURL=1.`
     );
-  }
-  return baseUrl.replace(/\/+$/, "");
+  return t.replace(/\/+$/, "");
 }
-function isInsecureBypassActive() {
+function fe() {
   try {
-    const proc = globalThis.process;
-    const envVal = proc?.env?.NEETRU_ALLOW_INSECURE_BASEURL;
-    if (envVal === "1" || envVal === "true") return true;
+    let e = globalThis.process?.env?.NEETRU_ALLOW_INSECURE_BASEURL;
+    if (e === "1" || e === "true") return !0;
   } catch {
   }
   try {
-    const g = globalThis.NEETRU_ALLOW_INSECURE_BASEURL;
-    if (g === "1" || g === "true" || g === true) return true;
+    let t = globalThis.NEETRU_ALLOW_INSECURE_BASEURL;
+    if (t === "1" || t === "true" || t === !0) return !0;
   } catch {
   }
   return false;
 }
 
 // src/api-key.ts
-var API_KEY_RE = /^nrt_([A-Za-z0-9]+)_([A-Za-z0-9]+)$/;
-function parseApiKey(apiKey) {
-  if (typeof apiKey !== "string" || apiKey.length === 0) {
-    throw new NeetruError(
+var ge = /^nrt_([A-Za-z0-9]+)_([A-Za-z0-9]+)$/;
+function z(t) {
+  if (typeof t != "string" || t.length === 0)
+    throw new n(
       "invalid_config",
       "apiKey is required (formato nrt_<keyId>_<secret>)"
     );
-  }
-  const match = API_KEY_RE.exec(apiKey);
-  if (!match) {
-    throw new NeetruError(
+  let e = ge.exec(t);
+  if (!e)
+    throw new n(
       "invalid_config",
       "apiKey malformado - esperado formato nrt_<keyId>_<secret>"
     );
-  }
-  return { keyId: match[1], secret: match[2] };
+  return { keyId: e[1], secret: e[2] };
 }
 
 // src/auth-pkce-shared.ts
-function getWebCrypto() {
-  const c = globalThis.crypto;
-  if (!c || typeof c.getRandomValues !== "function" || !c.subtle) {
-    throw new NeetruError(
+function V() {
+  let t = globalThis.crypto;
+  if (!t || typeof t.getRandomValues != "function" || !t.subtle)
+    throw new n(
       "runtime_unsupported",
       "auth.signIn requer WebCrypto (crypto.subtle) \u2014 indispon\xEDvel neste runtime. Use HTTPS (ou http://localhost) num browser moderno, ou instale um polyfill WebCrypto (ex: react-native-quick-crypto) em React Native."
     );
-  }
-  return c;
+  return t;
 }
-function base64UrlFromBytes(bytes) {
-  let str = "";
-  for (const b of bytes) str += String.fromCharCode(b);
-  const b64 = typeof btoa === "function" ? btoa(str) : Buffer.from(str, "binary").toString("base64");
-  return b64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+function W(t) {
+  let e = "";
+  for (let s of t) e += String.fromCharCode(s);
+  return (typeof btoa == "function" ? btoa(e) : Buffer.from(e, "binary").toString("base64")).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
-function randomUrlSafe(crypto, byteLen) {
-  const bytes = new Uint8Array(byteLen);
-  crypto.getRandomValues(bytes);
-  return base64UrlFromBytes(bytes);
+function x(t, e) {
+  let o = new Uint8Array(e);
+  return t.getRandomValues(o), W(o);
 }
-async function pkceChallengeS256(crypto, verifier) {
-  const data = new TextEncoder().encode(verifier);
-  const digest = await crypto.subtle.digest("SHA-256", data);
-  return base64UrlFromBytes(new Uint8Array(digest));
+async function J(t, e) {
+  let o = new TextEncoder().encode(e), s = await t.subtle.digest("SHA-256", o);
+  return W(new Uint8Array(s));
 }
-function resolveIdpOrigin(baseUrl) {
-  const overrideAuthUrl = typeof globalThis.NEETRU_AUTH_URL === "string" ? globalThis.NEETRU_AUTH_URL : null;
-  return overrideAuthUrl ?? baseUrl.replace(/^https?:\/\/api\./, "https://auth.");
+function S(t) {
+  return (typeof globalThis.NEETRU_AUTH_URL == "string" ? globalThis.NEETRU_AUTH_URL : null) ?? t.replace(/^https?:\/\/api\./, "https://auth.");
 }
-function resolveOidcClientId(config) {
-  let clientId = config.oidcClientId;
-  if (!clientId && config.apiKey) {
-    clientId = parseApiKey(config.apiKey).keyId;
-  }
-  if (!clientId) {
-    throw new NeetruError(
+function L(t) {
+  let e = t.oidcClientId;
+  if (!e && t.apiKey && (e = z(t.apiKey).keyId), !e)
+    throw new n(
       "invalid_config",
       "auth OIDC requer `oidcClientId` (ou `apiKey`) configurado para montar o client_id."
     );
-  }
-  return clientId;
+  return e;
 }
-function buildAuthorizeUrl(params) {
-  const url = new URL("/api/v1/oauth/authorize", params.idpOrigin);
-  url.searchParams.set("response_type", "code");
-  url.searchParams.set("client_id", params.clientId);
-  url.searchParams.set("redirect_uri", params.redirectUri);
-  url.searchParams.set("scope", params.scope);
-  url.searchParams.set("state", params.state);
-  url.searchParams.set("nonce", params.nonce);
-  url.searchParams.set("code_challenge", params.codeChallenge);
-  url.searchParams.set("code_challenge_method", "S256");
-  return url;
+function G(t) {
+  let e = new URL("/api/v1/oauth/authorize", t.idpOrigin);
+  return e.searchParams.set("response_type", "code"), e.searchParams.set("client_id", t.clientId), e.searchParams.set("redirect_uri", t.redirectUri), e.searchParams.set("scope", t.scope), e.searchParams.set("state", t.state), e.searchParams.set("nonce", t.nonce), e.searchParams.set("code_challenge", t.codeChallenge), e.searchParams.set("code_challenge_method", "S256"), e;
 }
-var OAUTH_TOKEN_PATH = "/api/v1/oauth/token";
-function decodeJwtPayload(token) {
-  const parts = token.split(".");
-  if (parts.length !== 3) return null;
+var X = "/api/v1/oauth/token";
+function O(t) {
+  let e = t.split(".");
+  if (e.length !== 3) return null;
   try {
-    const b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
-    const pad = "=".repeat((4 - b64.length % 4) % 4);
-    const decoded = typeof atob === "function" ? atob(b64 + pad) : Buffer.from(b64 + pad, "base64").toString("utf-8");
-    return JSON.parse(decoded);
+    let o = e[1].replace(/-/g, "+").replace(/_/g, "/"), s = "=".repeat((4 - o.length % 4) % 4), i = typeof atob == "function" ? atob(o + s) : Buffer.from(o + s, "base64").toString("utf-8");
+    return JSON.parse(i);
   } catch {
     return null;
   }
 }
-function jwtToNeetruUser(token) {
-  const payload = decodeJwtPayload(token);
-  if (!payload || typeof payload.sub !== "string") return null;
-  if (typeof payload.exp === "number" && payload.exp * 1e3 < Date.now()) {
-    return null;
-  }
-  return {
-    uid: payload.sub,
-    email: typeof payload.email === "string" ? payload.email : "",
-    emailVerified: typeof payload.email_verified === "boolean" ? payload.email_verified : void 0,
-    displayName: typeof payload.name === "string" ? payload.name : void 0,
-    photoURL: typeof payload.picture === "string" ? payload.picture : void 0,
-    isStaff: payload.is_staff === true,
-    isCustomer: payload.is_customer === true,
-    tenantId: typeof payload.tenant_id === "string" ? payload.tenant_id : void 0,
-    ...payload
+function T(t) {
+  let e = O(t);
+  return !e || typeof e.sub != "string" || typeof e.exp == "number" && e.exp * 1e3 < Date.now() ? null : {
+    uid: e.sub,
+    email: typeof e.email == "string" ? e.email : "",
+    emailVerified: typeof e.email_verified == "boolean" ? e.email_verified : void 0,
+    displayName: typeof e.name == "string" ? e.name : void 0,
+    photoURL: typeof e.picture == "string" ? e.picture : void 0,
+    isStaff: e.is_staff === true,
+    isCustomer: e.is_customer === true,
+    tenantId: typeof e.tenant_id == "string" ? e.tenant_id : void 0,
+    ...e
   };
 }
+var me = "/api/v1/oauth/revoke";
+async function Y(t, e, o, s) {
+  let i = `${e}${me}`, p = true;
+  for (let m of s) {
+    if (!m.token) continue;
+    let I = new URLSearchParams({
+      token: m.token,
+      token_type_hint: m.hint,
+      client_id: o
+    }).toString(), h = false;
+    for (let w = 0; w < 2 && !h; w++)
+      try {
+        if (h = (await t(i, {
+          method: "POST",
+          headers: { "content-type": "application/x-www-form-urlencoded" },
+          body: I
+        })).ok, !h) break;
+      } catch {
+        w === 0 && await new Promise((_) => setTimeout(_, 500));
+      }
+    h || (p = false);
+  }
+  return p;
+}
+
+// src/server-only-key.ts
+function Z(t) {
+  if (!(t == null || t === ""))
+    throw new n(
+      "server_only_key",
+      "[Neetru SDK] Recusado: @neetru/sdk/mobile n\xE3o aceita apiKey. A credencial nrt_ do produto \xE9 S\xD3 DE SERVIDOR \u2014 dentro do app ela \xE9 extra\xEDvel do pacote (.apk/.ipa). Remova a apiKey (e qualquer EXPO_PUBLIC_*_KEY com ela) do app: fa\xE7a login com oidcClientId (client OIDC p\xFAblico do app) e chame a API do seu produto com o access_token do usu\xE1rio; o backend do produto usa o SDK com a chave.",
+      void 0,
+      void 0,
+      "react-native"
+    );
+}
+
+// src/correlation.ts
+var Q = "x-correlation-id";
+var he = /^[A-Za-z0-9._:\-]+$/;
+function ee(t) {
+  return typeof t == "string" && t.length > 0 && t.length <= 128 && he.test(t);
+}
+function ye() {
+  let t = globalThis.crypto;
+  try {
+    if (t && typeof t.randomUUID == "function") return t.randomUUID();
+  } catch {
+  }
+  let e = new Uint8Array(16), o = false;
+  try {
+    t && typeof t.getRandomValues == "function" && (t.getRandomValues(e), o = !0);
+  } catch {
+    o = false;
+  }
+  if (!o)
+    for (let i = 0; i < e.length; i++) e[i] = Math.floor(Math.random() * 256);
+  e[6] = e[6] & 15 | 64, e[8] = e[8] & 63 | 128;
+  let s = Array.from(e, (i) => i.toString(16).padStart(2, "0")).join("");
+  return `${s.slice(0, 8)}-${s.slice(8, 12)}-${s.slice(12, 16)}-${s.slice(16, 20)}-${s.slice(20)}`;
+}
+function K(t, e) {
+  let o, s = {};
+  for (let [p, m] of Object.entries(t)) {
+    if (p.toLowerCase() === Q) {
+      ee(m) && (o = m);
+      continue;
+    }
+    s[p] = m;
+  }
+  let i = o ?? (ee(e) ? e : void 0) ?? ye();
+  return s[Q] = i, { headers: s, correlationId: i };
+}
+
+// src/http.ts
+function te(t) {
+  return t === 401 ? "unauthorized" : t === 403 ? "forbidden" : t === 404 ? "not_found" : t === 409 ? "conflict" : t === 410 ? "gone" : t === 422 || t === 400 ? "validation_failed" : t === 429 ? "rate_limited" : t >= 500 ? "server_error" : "unknown";
+}
 
 // src/mobile.ts
-var OIDC_TX_KEY = "neetru_oauth_tx";
-var ID_TOKEN_KEY = "neetru_id_token";
-var REFRESH_TOKEN_KEY = "neetru_refresh_token";
-function resolveMobileConfig(config) {
-  if (!config.storage) {
-    throw new NeetruError(
+var k = "neetru_oauth_tx", U = "neetru_id_token", E = "neetru_refresh_token", C = "neetru_access_token", be = 3e4, we = "/api/v1/oauth/userinfo";
+function _e(t) {
+  if (t === void 0 || t === "") return null;
+  let e;
+  try {
+    e = new URL(t);
+  } catch {
+    throw new n("invalid_config", `productApiUrl inv\xE1lida: ${t}`);
+  }
+  let o = e.hostname === "localhost" || e.hostname === "127.0.0.1";
+  if (e.protocol !== "https:" && !(e.protocol === "http:" && o))
+    throw new n(
+      "invalid_config",
+      "productApiUrl precisa ser https:// (http s\xF3 para localhost) \u2014 o access_token n\xE3o pode trafegar sem TLS."
+    );
+  return e;
+}
+function ke(t) {
+  if (Z(t.apiKey), !t.storage)
+    throw new n(
       "invalid_config",
       "createMobileAuthNamespace requer `storage` (MobileAuthStorage) \u2014 ver JSDoc de src/mobile.ts requisito 4."
     );
-  }
-  if (typeof config.openAuthUrl !== "function") {
-    throw new NeetruError(
+  if (typeof t.openAuthUrl != "function")
+    throw new n(
       "invalid_config",
       "createMobileAuthNamespace requer `openAuthUrl` (browser externo, NUNCA WebView embutida) \u2014 ver JSDoc de src/mobile.ts requisito 3."
     );
-  }
-  const fetchImpl = config.fetch ?? globalThis.fetch;
-  if (typeof fetchImpl !== "function") {
-    throw new NeetruError(
+  let e = t.fetch ?? globalThis.fetch;
+  if (typeof e != "function")
+    throw new n(
       "invalid_config",
       "fetch is not available in this runtime. Pass `fetch` explicitly to createMobileAuthNamespace."
     );
-  }
-  const baseUrl = validateBaseUrl(config.baseUrl ?? DEFAULT_BASE_URL, config.allowedHosts ?? []);
+  if (typeof t.oidcClientId != "string" || t.oidcClientId.length === 0)
+    throw new n(
+      "invalid_config",
+      "createMobileAuthNamespace requer `oidcClientId` \u2014 o client OIDC P\xDABLICO do app registrado no Core (a apiKey n\xE3o \xE9 aceita no app; ver requisito 6 no JSDoc de src/mobile.ts)."
+    );
+  let o = F(t.baseUrl ?? H, t.allowedHosts ?? []);
   return {
-    fetchImpl: fetchImpl.bind(globalThis),
-    baseUrl,
-    oidcClientId: config.oidcClientId,
-    apiKey: config.apiKey,
-    storage: config.storage,
-    openAuthUrl: config.openAuthUrl
+    fetchImpl: e.bind(globalThis),
+    baseUrl: o,
+    oidcClientId: t.oidcClientId,
+    productApiUrl: _e(t.productApiUrl),
+    storage: t.storage,
+    openAuthUrl: t.openAuthUrl
   };
 }
-async function postToken(fetchImpl, tokenUrl, form) {
-  let res;
+function ve(t) {
+  let o = O(t)?.exp;
+  return typeof o == "number" ? o * 1e3 : null;
+}
+async function re(t, e, o) {
+  let s;
   try {
-    res = await fetchImpl(tokenUrl, {
+    s = await t(e, {
       method: "POST",
       headers: { "content-type": "application/x-www-form-urlencoded" },
-      body: form.toString()
+      body: o.toString()
     });
-  } catch (err) {
-    throw new NeetruError(
+  } catch (p) {
+    throw new n(
       "network_error",
-      `POST ${tokenUrl} falhou (network): ${err?.message ?? String(err)}`
+      `POST ${e} falhou (network): ${p?.message ?? String(p)}`
     );
   }
-  let payload = null;
+  let i = null;
   try {
-    payload = await res.json();
+    i = await s.json();
   } catch {
-    payload = null;
+    i = null;
   }
-  if (!res.ok || typeof payload?.error === "string") {
-    const desc = typeof payload?.error_description === "string" && payload.error_description || typeof payload?.error === "string" && payload.error || `HTTP ${res.status}`;
-    throw new NeetruError(
+  if (!s.ok || typeof i?.error == "string") {
+    let p = typeof i?.error_description == "string" && i.error_description || typeof i?.error == "string" && i.error || `HTTP ${s.status}`;
+    throw new n(
       "token_exchange_failed",
-      `Troca de tokens falhou no /token: ${desc}`,
-      res.status
+      `Troca de tokens falhou no /token: ${p}`,
+      s.status
     );
   }
-  return payload ?? {};
+  return i ?? {};
 }
-function createMobileAuthNamespace(config) {
-  const resolved = resolveMobileConfig(config);
-  const listeners = /* @__PURE__ */ new Set();
-  function tokenUrl() {
-    return `${resolveIdpOrigin(resolved.baseUrl)}${OAUTH_TOKEN_PATH}`;
+function je(t) {
+  let e = ke(t), o = /* @__PURE__ */ new Set();
+  function s() {
+    return `${S(e.baseUrl)}${X}`;
   }
-  async function notify() {
-    const user = await getUser();
-    for (const l of listeners) {
+  async function i() {
+    let r = await h();
+    for (let a of o)
       try {
-        l(user);
+        a(r);
       } catch {
       }
-    }
   }
-  async function signIn(options) {
-    if (!options?.redirectUri) {
-      throw new NeetruError(
+  async function p(r) {
+    if (!r?.redirectUri)
+      throw new n(
         "invalid_config",
         "mobile auth.signIn requer `redirectUri` (Universal Link/App Link https://... registrado no Core) \u2014 n\xE3o h\xE1 location.origin impl\xEDcito em React Native."
       );
-    }
-    const crypto = getWebCrypto();
-    const scope = options.scope ?? "openid profile email";
-    const clientId = resolveOidcClientId(resolved);
-    const state = randomUrlSafe(crypto, 16);
-    const nonce = randomUrlSafe(crypto, 16);
-    const codeVerifier = randomUrlSafe(crypto, 32);
-    const codeChallenge = await pkceChallengeS256(crypto, codeVerifier);
-    const tx = {
-      state,
-      nonce,
-      codeVerifier,
-      redirectUri: options.redirectUri,
-      postLoginRedirect: options.postLoginRedirect
+    let a = V(), c = r.scope ?? "openid profile email", l = L(e), d = x(a, 16), u = x(a, 16), f = x(a, 32), g = await J(a, f), y = {
+      state: d,
+      nonce: u,
+      codeVerifier: f,
+      redirectUri: r.redirectUri,
+      postLoginRedirect: r.postLoginRedirect
     };
-    await resolved.storage.setItem(OIDC_TX_KEY, JSON.stringify(tx));
-    const idpOrigin = resolveIdpOrigin(resolved.baseUrl);
-    const url = buildAuthorizeUrl({
-      idpOrigin,
-      clientId,
-      redirectUri: options.redirectUri,
-      scope,
-      state,
-      nonce,
-      codeChallenge
+    await e.storage.setItem(k, JSON.stringify(y));
+    let b = S(e.baseUrl), R = G({
+      idpOrigin: b,
+      clientId: l,
+      redirectUri: r.redirectUri,
+      scope: c,
+      state: d,
+      nonce: u,
+      codeChallenge: g
     });
-    await resolved.openAuthUrl(url.toString());
+    await e.openAuthUrl(R.toString());
   }
-  async function completeSignIn(callbackUrl) {
-    if (!callbackUrl || typeof callbackUrl !== "string") {
-      throw new NeetruError(
+  async function m(r) {
+    if (!r || typeof r != "string")
+      throw new n(
         "invalid_config",
         "mobile auth.completeSignIn requer `callbackUrl` (a URL completa do deep link de retorno) \u2014 mobile n\xE3o tem location.href impl\xEDcito."
       );
-    }
-    let parsed;
+    let a;
     try {
-      parsed = new URL(callbackUrl);
+      a = new URL(r);
     } catch {
-      throw new NeetruError("invalid_config", `callbackUrl n\xE3o \xE9 uma URL v\xE1lida: ${callbackUrl}`);
+      throw new n("invalid_config", `callbackUrl n\xE3o \xE9 uma URL v\xE1lida: ${r}`);
     }
-    const params = parsed.searchParams;
-    const idpError = params.get("error");
-    if (idpError) {
-      const desc = params.get("error_description") ?? idpError;
-      await resolved.storage.removeItem(OIDC_TX_KEY);
-      throw new NeetruError(idpError, `OIDC authorize falhou: ${desc}`);
+    let c = a.searchParams, l = c.get("error");
+    if (l) {
+      let ce = c.get("error_description") ?? l;
+      throw await e.storage.removeItem(k), new n(l, `OIDC authorize falhou: ${ce}`);
     }
-    const code = params.get("code");
-    if (!code) {
-      await resolved.storage.removeItem(OIDC_TX_KEY);
-      throw new NeetruError(
+    let d = c.get("code");
+    if (!d)
+      throw await e.storage.removeItem(k), new n(
         "invalid_config",
         "callbackUrl n\xE3o cont\xE9m `?code=` nem `?error=` \u2014 n\xE3o \xE9 um callback OIDC v\xE1lido."
       );
-    }
-    const returnedState = params.get("state");
-    const txRaw = await resolved.storage.getItem(OIDC_TX_KEY);
-    let tx = null;
-    if (txRaw) {
+    let u = c.get("state"), f = await e.storage.getItem(k), g = null;
+    if (f)
       try {
-        tx = JSON.parse(txRaw);
+        g = JSON.parse(f);
       } catch {
-        tx = null;
+        g = null;
       }
-    }
-    if (!tx) {
-      throw new NeetruError(
+    if (!g)
+      throw new n(
         "oidc_state_mismatch",
         "Callback OIDC sem transa\xE7\xE3o pendente \u2014 `signIn` n\xE3o foi iniciado (ou j\xE1 consumido)."
       );
-    }
-    if (!returnedState || returnedState !== tx.state) {
-      await resolved.storage.removeItem(OIDC_TX_KEY);
-      throw new NeetruError(
+    if (!u || u !== g.state)
+      throw await e.storage.removeItem(k), new n(
         "oidc_state_mismatch",
         "state do callback OIDC n\xE3o confere com o da transa\xE7\xE3o (poss\xEDvel CSRF)."
       );
-    }
-    await resolved.storage.removeItem(OIDC_TX_KEY);
-    const clientId = resolveOidcClientId(resolved);
-    const form = new URLSearchParams({
+    await e.storage.removeItem(k);
+    let y = L(e), b = new URLSearchParams({
       grant_type: "authorization_code",
-      code,
-      redirect_uri: tx.redirectUri,
-      client_id: clientId,
-      code_verifier: tx.codeVerifier
-    });
-    const payload = await postToken(resolved.fetchImpl, tokenUrl(), form);
-    const idToken = payload.id_token;
-    if (typeof idToken !== "string" || idToken.length === 0) {
-      throw new NeetruError(
+      code: d,
+      redirect_uri: g.redirectUri,
+      client_id: y,
+      code_verifier: g.codeVerifier
+    }), R = await re(e.fetchImpl, s(), b), A = R.id_token;
+    if (typeof A != "string" || A.length === 0)
+      throw new n(
         "token_exchange_failed",
         "Resposta do /token sem `id_token` \u2014 o login n\xE3o pode ser completado."
       );
-    }
-    const claims = decodeJwtPayload(idToken);
-    if (!claims) {
-      throw new NeetruError(
+    let $ = O(A);
+    if (!$)
+      throw new n(
         "token_exchange_failed",
         "id_token retornado pelo /token \xE9 malformado (payload indecodific\xE1vel)."
       );
-    }
-    if (claims.nonce !== tx.nonce) {
-      throw new NeetruError(
+    if ($.nonce !== g.nonce)
+      throw new n(
         "oidc_nonce_mismatch",
         "nonce do id_token n\xE3o confere com o da transa\xE7\xE3o OIDC (poss\xEDvel replay). Token descartado."
       );
-    }
-    const user = jwtToNeetruUser(idToken);
-    if (!user) {
-      throw new NeetruError(
+    let q = T(A);
+    if (!q)
+      throw new n(
         "token_exchange_failed",
         "id_token retornado pelo /token n\xE3o tem `sub` ou j\xE1 est\xE1 expirado."
       );
-    }
-    await resolved.storage.setItem(ID_TOKEN_KEY, idToken);
-    const refreshToken = payload.refresh_token;
-    if (typeof refreshToken === "string" && refreshToken.length > 0) {
-      await resolved.storage.setItem(REFRESH_TOKEN_KEY, refreshToken);
-    }
-    await notify();
-    return { user, postLoginRedirect: tx.postLoginRedirect };
+    await e.storage.setItem(U, A);
+    let M = R.refresh_token;
+    return typeof M == "string" && M.length > 0 && await e.storage.setItem(E, M), await w(R.access_token), await i(), { user: q, postLoginRedirect: g.postLoginRedirect };
+  }
+  async function I() {
+    let r = await e.storage.getItem(U);
+    return r && T(r) ? r : null;
   }
-  async function getIdToken() {
-    const token = await resolved.storage.getItem(ID_TOKEN_KEY);
-    if (!token) return null;
-    return jwtToNeetruUser(token) ? token : null;
+  async function h() {
+    let r = await e.storage.getItem(U);
+    return r ? T(r) : null;
   }
-  async function getUser() {
-    const token = await resolved.storage.getItem(ID_TOKEN_KEY);
-    if (!token) return null;
-    return jwtToNeetruUser(token);
+  async function w(r) {
+    typeof r == "string" && r.length > 0 ? await e.storage.setItem(C, r) : await e.storage.removeItem(C);
   }
-  async function refreshTokens() {
-    const refreshToken = await resolved.storage.getItem(REFRESH_TOKEN_KEY);
-    if (!refreshToken) return false;
-    let clientId;
+  let _ = null;
+  function N() {
+    return _ || (_ = ne().finally(() => {
+      _ = null;
+    }), _);
+  }
+  async function ne() {
+    let r = await e.storage.getItem(E);
+    if (!r) return false;
+    let a;
     try {
-      clientId = resolveOidcClientId(resolved);
+      a = L(e);
     } catch {
       return false;
     }
-    const form = new URLSearchParams({
+    let c = new URLSearchParams({
       grant_type: "refresh_token",
-      refresh_token: refreshToken,
-      client_id: clientId
-    });
-    let payload;
+      refresh_token: r,
+      client_id: a
+    }), l;
     try {
-      payload = await postToken(resolved.fetchImpl, tokenUrl(), form);
+      l = await re(e.fetchImpl, s(), c);
     } catch {
       return false;
     }
-    const idToken = payload.id_token;
-    if (typeof idToken !== "string" || idToken.length === 0) return false;
-    const user = jwtToNeetruUser(idToken);
-    if (!user) return false;
-    await resolved.storage.setItem(ID_TOKEN_KEY, idToken);
-    const rotated = payload.refresh_token;
-    if (typeof rotated === "string" && rotated.length > 0) {
-      await resolved.storage.setItem(REFRESH_TOKEN_KEY, rotated);
+    let d = l.id_token;
+    if (typeof d != "string" || d.length === 0 || !T(d)) return false;
+    await e.storage.setItem(U, d);
+    let f = l.refresh_token;
+    return typeof f == "string" && f.length > 0 && await e.storage.setItem(E, f), await w(l.access_token), await i(), true;
+  }
+  async function P() {
+    let r = await e.storage.getItem(C);
+    if (!r) return null;
+    let a = ve(r);
+    return a === null || a - be <= Date.now() ? null : r;
+  }
+  async function D() {
+    let r = await P();
+    return r || (await N() ? P() : null);
+  }
+  async function oe() {
+    let r = `${S(e.baseUrl)}${we}`, a = async (f) => {
+      let { headers: g, correlationId: y } = K({
+        accept: "application/json",
+        authorization: `Bearer ${f}`
+      });
+      try {
+        return { res: await e.fetchImpl(r, { method: "GET", headers: g }), correlationId: y };
+      } catch (b) {
+        throw new n(
+          "network_error",
+          `GET ${r} falhou (network): ${b?.message ?? String(b)}`,
+          void 0,
+          void 0,
+          void 0,
+          y
+        );
+      }
+    }, c = await D();
+    if (!c)
+      throw new v(
+        "Sem sess\xE3o: fa\xE7a login (auth.signIn) antes de consultar o userinfo.",
+        "no_signed_in_user"
+      );
+    let { res: l, correlationId: d } = await a(c);
+    if (l.status === 401 && await N() && (c = await P(), c && ({ res: l, correlationId: d } = await a(c))), l.status === 401)
+      throw new v(
+        "O Core recusou a sess\xE3o (token revogado/expirado ou usu\xE1rio inativo). Fa\xE7a login novamente.",
+        "invalid_access_token",
+        401,
+        void 0,
+        d
+      );
+    let u;
+    try {
+      u = await l.json();
+    } catch {
+      u = void 0;
+    }
+    if (!l.ok) {
+      let f = u && typeof u == "object" && typeof u.error_description == "string" ? u.error_description : `HTTP ${l.status}`;
+      throw new n(te(l.status), `userinfo falhou: ${f}`, l.status, void 0, void 0, d);
     }
-    await notify();
-    return true;
+    if (!u || typeof u != "object" || typeof u.sub != "string")
+      throw new n("invalid_response", "userinfo sem `sub`.", l.status, void 0, void 0, d);
+    return u;
   }
-  async function signOut() {
-    const storedToken = await resolved.storage.getItem(ID_TOKEN_KEY);
-    await resolved.storage.removeItem(ID_TOKEN_KEY);
-    await resolved.storage.removeItem(REFRESH_TOKEN_KEY);
-    if (storedToken) {
-      const idpOrigin = resolveIdpOrigin(resolved.baseUrl);
-      const revokeUrl = `${idpOrigin}/api/v1/oauth/revoke`;
+  function ie(r) {
+    let a = e.productApiUrl;
+    if (!a)
+      throw new n(
+        "invalid_config",
+        "auth.authFetch requer `productApiUrl` (URL da API do seu produto) no createMobileAuthNamespace."
+      );
+    let c;
+    if (/^[a-z][a-z0-9+.-]*:/i.test(r))
       try {
-        await resolved.fetchImpl(revokeUrl, {
-          method: "POST",
-          headers: { "content-type": "application/json" },
-          body: JSON.stringify({ token: storedToken })
-        });
-      } catch (err) {
-        if (typeof console !== "undefined") {
-          console.warn(
-            "[neetru-sdk] mobile signOut: server-side revoke falhou. Refresh token pode estar stale.",
-            err
-          );
-        }
+        c = new URL(r);
+      } catch {
+        throw new n("invalid_config", `URL inv\xE1lida: ${r}`);
       }
+    else {
+      let l = a.pathname.replace(/\/+$/, ""), d = r.startsWith("/") ? r : `/${r}`;
+      c = new URL(`${a.origin}${l}${d}`);
     }
-    await notify();
+    if (c.origin !== a.origin)
+      throw new n(
+        "invalid_config",
+        `auth.authFetch s\xF3 envia o access_token para a API do produto (${a.origin}); recusado: ${c.origin}.`
+      );
+    return c.toString();
+  }
+  async function se(r, a = {}) {
+    let c = ie(r), l = {};
+    new Headers(a.headers ?? {}).forEach((y, b) => {
+      l[b] = y;
+    });
+    let d = (y) => {
+      let { headers: b } = K({ ...l, authorization: `Bearer ${y}` });
+      return e.fetchImpl(c, { ...a, headers: b });
+    }, u = await D();
+    if (!u)
+      throw new v(
+        "Sem sess\xE3o: fa\xE7a login (auth.signIn) antes de chamar a API do produto.",
+        "no_signed_in_user"
+      );
+    let f = await d(u), g = a.body === void 0 || a.body === null || typeof a.body == "string";
+    return f.status === 401 && g && await N() && (u = await P(), u && (f = await d(u))), f;
+  }
+  async function ae() {
+    let r = await e.storage.getItem(E), a = await e.storage.getItem(C);
+    await e.storage.removeItem(U), await e.storage.removeItem(E), await e.storage.removeItem(C), await e.storage.removeItem(k);
+    let c = [];
+    r && c.push({ token: r, hint: "refresh_token" }), a && c.push({ token: a, hint: "access_token" }), c.length > 0 && !await Y(
+      e.fetchImpl,
+      S(e.baseUrl),
+      e.oidcClientId,
+      c
+    ) && typeof console < "u" && console.warn(
+      "[neetru-sdk] mobile signOut: a revoga\xE7\xE3o no servidor n\xE3o foi confirmada. A sess\xE3o local foi encerrada, mas o refresh_token pode seguir v\xE1lido at\xE9 expirar."
+    ), await i();
   }
   return {
-    signIn,
-    completeSignIn,
-    getIdToken,
-    getUser,
-    onAuthStateChanged(listener) {
-      listeners.add(listener);
-      void getUser().then((user) => {
-        if (listeners.has(listener)) {
+    signIn: p,
+    completeSignIn: m,
+    getIdToken: I,
+    getAccessToken: D,
+    getUserInfo: oe,
+    authFetch: se,
+    getUser: h,
+    onAuthStateChanged(r) {
+      return o.add(r), h().then((a) => {
+        if (o.has(r))
           try {
-            listener(user);
+            r(a);
           } catch {
           }
-        }
-      });
-      return () => {
-        listeners.delete(listener);
+      }), () => {
+        o.delete(r);
       };
     },
-    refreshTokens,
-    signOut
+    refreshTokens: N,
+    signOut: ae
   };
 }
 
-export { createMobileAuthNamespace };
-//# sourceMappingURL=mobile.mjs.map
-//# sourceMappingURL=mobile.mjs.map
+export { je as createMobileAuthNamespace };