@neetru/sdk 3.7.0 → 3.8.0

package/dist/mobile.mjs

@@ -1,5 +1,5 @@
 // src/errors.ts
-var r = class t extends Error {
+var n = class t extends Error {
   code;
   status;
   requestId;
@@ -12,61 +12,72 @@ var r = class t extends Error {
    * para um `NeetruDbErrorCode` mais específico (recuperável vs não).
    */
   reason;
-  constructor(e, i, s, o, l) {
-    super(i), this.name = "NeetruError", this.code = e, this.status = s, this.requestId = o, this.reason = l, Object.setPrototypeOf(this, t.prototype);
+  /**
+   * 3.8.0: `x-correlation-id` da requisição que falhou. O SDK gera um UUID por
+   * chamada (ou usa o que o chamador passou) e manda no header; o Core grava o
+   * mesmo id nos logs/auditoria — cite-o ao abrir um ticket de suporte.
+   * `undefined` em erros que acontecem antes de qualquer requisição.
+   */
+  correlationId;
+  constructor(e, o, s, i, p, m) {
+    super(o), this.name = "NeetruError", this.code = e, this.status = s, this.requestId = i, this.reason = p, this.correlationId = m, Object.setPrototypeOf(this, t.prototype);
+  }
+}, v = class t extends n {
+  constructor(e, o, s, i, p) {
+    super("auth_required", e, s, i, o, p), this.name = "NeetruAuthRequiredError", Object.setPrototypeOf(this, t.prototype);
   }
 };
 
 // src/types.ts
-var L = "https://api.neetru.com";
+var H = "https://api.neetru.com";
 
 // src/base-url-allowlist.ts
-var O = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]), F = ".neetru.com", J = "neetru.com", Y = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?\.(test|localhost)$/;
-function D(t) {
-  return Y.test(t);
+var B = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]), le = ".neetru.com", ue = "neetru.com", de = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?\.(test|localhost)$/;
+function j(t) {
+  return de.test(t);
 }
-function X(t) {
+function pe(t) {
   return t.toLowerCase().replace(/\.+$/, "");
 }
-function M(t, e = []) {
+function F(t, e = []) {
   if (typeof t != "string" || t.length === 0)
-    throw new r("invalid_config", "baseUrl is required");
-  let i;
+    throw new n("invalid_config", "baseUrl is required");
+  let o;
   try {
-    i = new URL(t);
+    o = new URL(t);
   } catch {
-    throw new r("invalid_config", `baseUrl is not a valid URL: ${t}`);
+    throw new n("invalid_config", `baseUrl is not a valid URL: ${t}`);
   }
-  let s = i.protocol, o = X(i.hostname);
-  if (Z())
+  let s = o.protocol, i = pe(o.hostname);
+  if (fe())
     return typeof console < "u" && console.warn(
       `[neetru-sdk] NEETRU_ALLOW_INSECURE_BASEURL=1 ativo. baseUrl=${t} aceito sem valida\xE7\xE3o.`
     ), t.replace(/\/+$/, "");
   if (s !== "https:" && s !== "http:")
-    throw new r(
+    throw new n(
       "invalid_config",
       `baseUrl protocol must be http: or https:, got ${s}`
     );
   if (s === "http:") {
-    if (!(O.has(o) || D(o)))
-      throw new r(
+    if (!(B.has(i) || j(i)))
+      throw new n(
         "invalid_config",
-        `baseUrl with http: only allowed for localhost/127.0.0.1/*.test/*.localhost. Got: ${o}. Use https: or set NEETRU_ALLOW_INSECURE_BASEURL=1 to bypass.`
+        `baseUrl with http: only allowed for localhost/127.0.0.1/*.test/*.localhost. Got: ${i}. Use https: or set NEETRU_ALLOW_INSECURE_BASEURL=1 to bypass.`
       );
     return t.replace(/\/+$/, "");
   }
-  let l = o === J || o.endsWith(F), A = e.some((m) => {
-    let k = m.toLowerCase();
-    return o === k || o.endsWith(`.${k}`);
-  }), R = O.has(o) || D(o);
-  if (!l && !A && !R)
-    throw new r(
+  let p = i === ue || i.endsWith(le), m = e.some((h) => {
+    let w = h.toLowerCase();
+    return i === w || i.endsWith(`.${w}`);
+  }), I = B.has(i) || j(i);
+  if (!p && !m && !I)
+    throw new n(
       "invalid_config",
-      `baseUrl ${o} is not in the allowlist. Allowed: *.neetru.com, localhost, or configure { allowedHosts: ['...'] }. Bypass: NEETRU_ALLOW_INSECURE_BASEURL=1.`
+      `baseUrl ${i} is not in the allowlist. Allowed: *.neetru.com, localhost, or configure { allowedHosts: ['...'] }. Bypass: NEETRU_ALLOW_INSECURE_BASEURL=1.`
     );
   return t.replace(/\/+$/, "");
 }
-function Z() {
+function fe() {
   try {
     let e = globalThis.process?.env?.NEETRU_ALLOW_INSECURE_BASEURL;
     if (e === "1" || e === "true") return !0;
@@ -81,16 +92,16 @@ function Z() {
 }
 
 // src/api-key.ts
-var G = /^nrt_([A-Za-z0-9]+)_([A-Za-z0-9]+)$/;
-function K(t) {
+var ge = /^nrt_([A-Za-z0-9]+)_([A-Za-z0-9]+)$/;
+function z(t) {
   if (typeof t != "string" || t.length === 0)
-    throw new r(
+    throw new n(
       "invalid_config",
       "apiKey is required (formato nrt_<keyId>_<secret>)"
     );
-  let e = G.exec(t);
+  let e = ge.exec(t);
   if (!e)
-    throw new r(
+    throw new n(
       "invalid_config",
       "apiKey malformado - esperado formato nrt_<keyId>_<secret>"
     );
@@ -98,57 +109,57 @@ function K(t) {
 }
 
 // src/auth-pkce-shared.ts
-function H() {
+function V() {
   let t = globalThis.crypto;
   if (!t || typeof t.getRandomValues != "function" || !t.subtle)
-    throw new r(
+    throw new n(
       "runtime_unsupported",
       "auth.signIn requer WebCrypto (crypto.subtle) \u2014 indispon\xEDvel neste runtime. Use HTTPS (ou http://localhost) num browser moderno, ou instale um polyfill WebCrypto (ex: react-native-quick-crypto) em React Native."
     );
   return t;
 }
-function $(t) {
+function W(t) {
   let e = "";
   for (let s of t) e += String.fromCharCode(s);
   return (typeof btoa == "function" ? btoa(e) : Buffer.from(e, "binary").toString("base64")).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
-function v(t, e) {
-  let i = new Uint8Array(e);
-  return t.getRandomValues(i), $(i);
+function x(t, e) {
+  let o = new Uint8Array(e);
+  return t.getRandomValues(o), W(o);
 }
-async function B(t, e) {
-  let i = new TextEncoder().encode(e), s = await t.subtle.digest("SHA-256", i);
-  return $(new Uint8Array(s));
+async function J(t, e) {
+  let o = new TextEncoder().encode(e), s = await t.subtle.digest("SHA-256", o);
+  return W(new Uint8Array(s));
 }
-function U(t) {
+function S(t) {
   return (typeof globalThis.NEETRU_AUTH_URL == "string" ? globalThis.NEETRU_AUTH_URL : null) ?? t.replace(/^https?:\/\/api\./, "https://auth.");
 }
-function I(t) {
+function L(t) {
   let e = t.oidcClientId;
-  if (!e && t.apiKey && (e = K(t.apiKey).keyId), !e)
-    throw new r(
+  if (!e && t.apiKey && (e = z(t.apiKey).keyId), !e)
+    throw new n(
       "invalid_config",
       "auth OIDC requer `oidcClientId` (ou `apiKey`) configurado para montar o client_id."
     );
   return e;
 }
-function q(t) {
+function G(t) {
   let e = new URL("/api/v1/oauth/authorize", t.idpOrigin);
   return e.searchParams.set("response_type", "code"), e.searchParams.set("client_id", t.clientId), e.searchParams.set("redirect_uri", t.redirectUri), e.searchParams.set("scope", t.scope), e.searchParams.set("state", t.state), e.searchParams.set("nonce", t.nonce), e.searchParams.set("code_challenge", t.codeChallenge), e.searchParams.set("code_challenge_method", "S256"), e;
 }
-var W = "/api/v1/oauth/token";
-function N(t) {
+var X = "/api/v1/oauth/token";
+function O(t) {
   let e = t.split(".");
   if (e.length !== 3) return null;
   try {
-    let i = e[1].replace(/-/g, "+").replace(/_/g, "/"), s = "=".repeat((4 - i.length % 4) % 4), o = typeof atob == "function" ? atob(i + s) : Buffer.from(i + s, "base64").toString("utf-8");
-    return JSON.parse(o);
+    let o = e[1].replace(/-/g, "+").replace(/_/g, "/"), s = "=".repeat((4 - o.length % 4) % 4), i = typeof atob == "function" ? atob(o + s) : Buffer.from(o + s, "base64").toString("utf-8");
+    return JSON.parse(i);
   } catch {
     return null;
   }
 }
-function _(t) {
-  let e = N(t);
+function T(t) {
+  let e = O(t);
   return !e || typeof e.sub != "string" || typeof e.exp == "number" && e.exp * 1e3 < Date.now() ? null : {
     uid: e.sub,
     email: typeof e.email == "string" ? e.email : "",
@@ -161,249 +172,457 @@ function _(t) {
     ...e
   };
 }
+var me = "/api/v1/oauth/revoke";
+async function Y(t, e, o, s) {
+  let i = `${e}${me}`, p = true;
+  for (let m of s) {
+    if (!m.token) continue;
+    let I = new URLSearchParams({
+      token: m.token,
+      token_type_hint: m.hint,
+      client_id: o
+    }).toString(), h = false;
+    for (let w = 0; w < 2 && !h; w++)
+      try {
+        if (h = (await t(i, {
+          method: "POST",
+          headers: { "content-type": "application/x-www-form-urlencoded" },
+          body: I
+        })).ok, !h) break;
+      } catch {
+        w === 0 && await new Promise((_) => setTimeout(_, 500));
+      }
+    h || (p = false);
+  }
+  return p;
+}
+
+// src/server-only-key.ts
+function Z(t) {
+  if (!(t == null || t === ""))
+    throw new n(
+      "server_only_key",
+      "[Neetru SDK] Recusado: @neetru/sdk/mobile n\xE3o aceita apiKey. A credencial nrt_ do produto \xE9 S\xD3 DE SERVIDOR \u2014 dentro do app ela \xE9 extra\xEDvel do pacote (.apk/.ipa). Remova a apiKey (e qualquer EXPO_PUBLIC_*_KEY com ela) do app: fa\xE7a login com oidcClientId (client OIDC p\xFAblico do app) e chame a API do seu produto com o access_token do usu\xE1rio; o backend do produto usa o SDK com a chave.",
+      void 0,
+      void 0,
+      "react-native"
+    );
+}
+
+// src/correlation.ts
+var Q = "x-correlation-id";
+var he = /^[A-Za-z0-9._:\-]+$/;
+function ee(t) {
+  return typeof t == "string" && t.length > 0 && t.length <= 128 && he.test(t);
+}
+function ye() {
+  let t = globalThis.crypto;
+  try {
+    if (t && typeof t.randomUUID == "function") return t.randomUUID();
+  } catch {
+  }
+  let e = new Uint8Array(16), o = false;
+  try {
+    t && typeof t.getRandomValues == "function" && (t.getRandomValues(e), o = !0);
+  } catch {
+    o = false;
+  }
+  if (!o)
+    for (let i = 0; i < e.length; i++) e[i] = Math.floor(Math.random() * 256);
+  e[6] = e[6] & 15 | 64, e[8] = e[8] & 63 | 128;
+  let s = Array.from(e, (i) => i.toString(16).padStart(2, "0")).join("");
+  return `${s.slice(0, 8)}-${s.slice(8, 12)}-${s.slice(12, 16)}-${s.slice(16, 20)}-${s.slice(20)}`;
+}
+function K(t, e) {
+  let o, s = {};
+  for (let [p, m] of Object.entries(t)) {
+    if (p.toLowerCase() === Q) {
+      ee(m) && (o = m);
+      continue;
+    }
+    s[p] = m;
+  }
+  let i = o ?? (ee(e) ? e : void 0) ?? ye();
+  return s[Q] = i, { headers: s, correlationId: i };
+}
+
+// src/http.ts
+function te(t) {
+  return t === 401 ? "unauthorized" : t === 403 ? "forbidden" : t === 404 ? "not_found" : t === 409 ? "conflict" : t === 410 ? "gone" : t === 422 || t === 400 ? "validation_failed" : t === 429 ? "rate_limited" : t >= 500 ? "server_error" : "unknown";
+}
 
 // src/mobile.ts
-var h = "neetru_oauth_tx", y = "neetru_id_token", S = "neetru_refresh_token";
-function Q(t) {
-  if (!t.storage)
-    throw new r(
+var k = "neetru_oauth_tx", U = "neetru_id_token", E = "neetru_refresh_token", C = "neetru_access_token", be = 3e4, we = "/api/v1/oauth/userinfo";
+function _e(t) {
+  if (t === void 0 || t === "") return null;
+  let e;
+  try {
+    e = new URL(t);
+  } catch {
+    throw new n("invalid_config", `productApiUrl inv\xE1lida: ${t}`);
+  }
+  let o = e.hostname === "localhost" || e.hostname === "127.0.0.1";
+  if (e.protocol !== "https:" && !(e.protocol === "http:" && o))
+    throw new n(
+      "invalid_config",
+      "productApiUrl precisa ser https:// (http s\xF3 para localhost) \u2014 o access_token n\xE3o pode trafegar sem TLS."
+    );
+  return e;
+}
+function ke(t) {
+  if (Z(t.apiKey), !t.storage)
+    throw new n(
       "invalid_config",
       "createMobileAuthNamespace requer `storage` (MobileAuthStorage) \u2014 ver JSDoc de src/mobile.ts requisito 4."
     );
   if (typeof t.openAuthUrl != "function")
-    throw new r(
+    throw new n(
       "invalid_config",
       "createMobileAuthNamespace requer `openAuthUrl` (browser externo, NUNCA WebView embutida) \u2014 ver JSDoc de src/mobile.ts requisito 3."
     );
   let e = t.fetch ?? globalThis.fetch;
   if (typeof e != "function")
-    throw new r(
+    throw new n(
       "invalid_config",
       "fetch is not available in this runtime. Pass `fetch` explicitly to createMobileAuthNamespace."
     );
-  let i = M(t.baseUrl ?? L, t.allowedHosts ?? []);
+  if (typeof t.oidcClientId != "string" || t.oidcClientId.length === 0)
+    throw new n(
+      "invalid_config",
+      "createMobileAuthNamespace requer `oidcClientId` \u2014 o client OIDC P\xDABLICO do app registrado no Core (a apiKey n\xE3o \xE9 aceita no app; ver requisito 6 no JSDoc de src/mobile.ts)."
+    );
+  let o = F(t.baseUrl ?? H, t.allowedHosts ?? []);
   return {
     fetchImpl: e.bind(globalThis),
-    baseUrl: i,
+    baseUrl: o,
     oidcClientId: t.oidcClientId,
-    apiKey: t.apiKey,
+    productApiUrl: _e(t.productApiUrl),
     storage: t.storage,
     openAuthUrl: t.openAuthUrl
   };
 }
-async function z(t, e, i) {
+function ve(t) {
+  let o = O(t)?.exp;
+  return typeof o == "number" ? o * 1e3 : null;
+}
+async function re(t, e, o) {
   let s;
   try {
     s = await t(e, {
       method: "POST",
       headers: { "content-type": "application/x-www-form-urlencoded" },
-      body: i.toString()
+      body: o.toString()
     });
-  } catch (l) {
-    throw new r(
+  } catch (p) {
+    throw new n(
       "network_error",
-      `POST ${e} falhou (network): ${l?.message ?? String(l)}`
+      `POST ${e} falhou (network): ${p?.message ?? String(p)}`
     );
   }
-  let o = null;
+  let i = null;
   try {
-    o = await s.json();
+    i = await s.json();
   } catch {
-    o = null;
+    i = null;
   }
-  if (!s.ok || typeof o?.error == "string") {
-    let l = typeof o?.error_description == "string" && o.error_description || typeof o?.error == "string" && o.error || `HTTP ${s.status}`;
-    throw new r(
+  if (!s.ok || typeof i?.error == "string") {
+    let p = typeof i?.error_description == "string" && i.error_description || typeof i?.error == "string" && i.error || `HTTP ${s.status}`;
+    throw new n(
       "token_exchange_failed",
-      `Troca de tokens falhou no /token: ${l}`,
+      `Troca de tokens falhou no /token: ${p}`,
       s.status
     );
   }
-  return o ?? {};
+  return i ?? {};
 }
-function ge(t) {
-  let e = Q(t), i = /* @__PURE__ */ new Set();
+function je(t) {
+  let e = ke(t), o = /* @__PURE__ */ new Set();
   function s() {
-    return `${U(e.baseUrl)}${W}`;
+    return `${S(e.baseUrl)}${X}`;
   }
-  async function o() {
-    let n = await m();
-    for (let a of i)
+  async function i() {
+    let r = await h();
+    for (let a of o)
       try {
-        a(n);
+        a(r);
       } catch {
       }
   }
-  async function l(n) {
-    if (!n?.redirectUri)
-      throw new r(
+  async function p(r) {
+    if (!r?.redirectUri)
+      throw new n(
         "invalid_config",
         "mobile auth.signIn requer `redirectUri` (Universal Link/App Link https://... registrado no Core) \u2014 n\xE3o h\xE1 location.origin impl\xEDcito em React Native."
       );
-    let a = H(), u = n.scope ?? "openid profile email", c = I(e), d = v(a, 16), f = v(a, 16), g = v(a, 32), p = await B(a, g), T = {
+    let a = V(), c = r.scope ?? "openid profile email", l = L(e), d = x(a, 16), u = x(a, 16), f = x(a, 32), g = await J(a, f), y = {
       state: d,
-      nonce: f,
-      codeVerifier: g,
-      redirectUri: n.redirectUri,
-      postLoginRedirect: n.postLoginRedirect
+      nonce: u,
+      codeVerifier: f,
+      redirectUri: r.redirectUri,
+      postLoginRedirect: r.postLoginRedirect
     };
-    await e.storage.setItem(h, JSON.stringify(T));
-    let C = U(e.baseUrl), w = q({
-      idpOrigin: C,
-      clientId: c,
-      redirectUri: n.redirectUri,
-      scope: u,
+    await e.storage.setItem(k, JSON.stringify(y));
+    let b = S(e.baseUrl), R = G({
+      idpOrigin: b,
+      clientId: l,
+      redirectUri: r.redirectUri,
+      scope: c,
       state: d,
-      nonce: f,
-      codeChallenge: p
+      nonce: u,
+      codeChallenge: g
     });
-    await e.openAuthUrl(w.toString());
+    await e.openAuthUrl(R.toString());
   }
-  async function A(n) {
-    if (!n || typeof n != "string")
-      throw new r(
+  async function m(r) {
+    if (!r || typeof r != "string")
+      throw new n(
         "invalid_config",
         "mobile auth.completeSignIn requer `callbackUrl` (a URL completa do deep link de retorno) \u2014 mobile n\xE3o tem location.href impl\xEDcito."
       );
     let a;
     try {
-      a = new URL(n);
+      a = new URL(r);
     } catch {
-      throw new r("invalid_config", `callbackUrl n\xE3o \xE9 uma URL v\xE1lida: ${n}`);
+      throw new n("invalid_config", `callbackUrl n\xE3o \xE9 uma URL v\xE1lida: ${r}`);
     }
-    let u = a.searchParams, c = u.get("error");
-    if (c) {
-      let j = u.get("error_description") ?? c;
-      throw await e.storage.removeItem(h), new r(c, `OIDC authorize falhou: ${j}`);
+    let c = a.searchParams, l = c.get("error");
+    if (l) {
+      let ce = c.get("error_description") ?? l;
+      throw await e.storage.removeItem(k), new n(l, `OIDC authorize falhou: ${ce}`);
     }
-    let d = u.get("code");
+    let d = c.get("code");
     if (!d)
-      throw await e.storage.removeItem(h), new r(
+      throw await e.storage.removeItem(k), new n(
         "invalid_config",
         "callbackUrl n\xE3o cont\xE9m `?code=` nem `?error=` \u2014 n\xE3o \xE9 um callback OIDC v\xE1lido."
       );
-    let f = u.get("state"), g = await e.storage.getItem(h), p = null;
-    if (g)
+    let u = c.get("state"), f = await e.storage.getItem(k), g = null;
+    if (f)
       try {
-        p = JSON.parse(g);
+        g = JSON.parse(f);
       } catch {
-        p = null;
+        g = null;
       }
-    if (!p)
-      throw new r(
+    if (!g)
+      throw new n(
         "oidc_state_mismatch",
         "Callback OIDC sem transa\xE7\xE3o pendente \u2014 `signIn` n\xE3o foi iniciado (ou j\xE1 consumido)."
       );
-    if (!f || f !== p.state)
-      throw await e.storage.removeItem(h), new r(
+    if (!u || u !== g.state)
+      throw await e.storage.removeItem(k), new n(
         "oidc_state_mismatch",
         "state do callback OIDC n\xE3o confere com o da transa\xE7\xE3o (poss\xEDvel CSRF)."
       );
-    await e.storage.removeItem(h);
-    let T = I(e), C = new URLSearchParams({
+    await e.storage.removeItem(k);
+    let y = L(e), b = new URLSearchParams({
       grant_type: "authorization_code",
       code: d,
-      redirect_uri: p.redirectUri,
-      client_id: T,
-      code_verifier: p.codeVerifier
-    }), w = await z(e.fetchImpl, s(), C), b = w.id_token;
-    if (typeof b != "string" || b.length === 0)
-      throw new r(
+      redirect_uri: g.redirectUri,
+      client_id: y,
+      code_verifier: g.codeVerifier
+    }), R = await re(e.fetchImpl, s(), b), A = R.id_token;
+    if (typeof A != "string" || A.length === 0)
+      throw new n(
         "token_exchange_failed",
         "Resposta do /token sem `id_token` \u2014 o login n\xE3o pode ser completado."
       );
-    let x = N(b);
-    if (!x)
-      throw new r(
+    let $ = O(A);
+    if (!$)
+      throw new n(
         "token_exchange_failed",
         "id_token retornado pelo /token \xE9 malformado (payload indecodific\xE1vel)."
       );
-    if (x.nonce !== p.nonce)
-      throw new r(
+    if ($.nonce !== g.nonce)
+      throw new n(
         "oidc_nonce_mismatch",
         "nonce do id_token n\xE3o confere com o da transa\xE7\xE3o OIDC (poss\xEDvel replay). Token descartado."
       );
-    let E = _(b);
-    if (!E)
-      throw new r(
+    let q = T(A);
+    if (!q)
+      throw new n(
         "token_exchange_failed",
         "id_token retornado pelo /token n\xE3o tem `sub` ou j\xE1 est\xE1 expirado."
       );
-    await e.storage.setItem(y, b);
-    let P = w.refresh_token;
-    return typeof P == "string" && P.length > 0 && await e.storage.setItem(S, P), await o(), { user: E, postLoginRedirect: p.postLoginRedirect };
+    await e.storage.setItem(U, A);
+    let M = R.refresh_token;
+    return typeof M == "string" && M.length > 0 && await e.storage.setItem(E, M), await w(R.access_token), await i(), { user: q, postLoginRedirect: g.postLoginRedirect };
+  }
+  async function I() {
+    let r = await e.storage.getItem(U);
+    return r && T(r) ? r : null;
   }
-  async function R() {
-    let n = await e.storage.getItem(y);
-    return n && _(n) ? n : null;
+  async function h() {
+    let r = await e.storage.getItem(U);
+    return r ? T(r) : null;
   }
-  async function m() {
-    let n = await e.storage.getItem(y);
-    return n ? _(n) : null;
+  async function w(r) {
+    typeof r == "string" && r.length > 0 ? await e.storage.setItem(C, r) : await e.storage.removeItem(C);
   }
-  async function k() {
-    let n = await e.storage.getItem(S);
-    if (!n) return false;
+  let _ = null;
+  function N() {
+    return _ || (_ = ne().finally(() => {
+      _ = null;
+    }), _);
+  }
+  async function ne() {
+    let r = await e.storage.getItem(E);
+    if (!r) return false;
     let a;
     try {
-      a = I(e);
+      a = L(e);
     } catch {
       return false;
     }
-    let u = new URLSearchParams({
+    let c = new URLSearchParams({
       grant_type: "refresh_token",
-      refresh_token: n,
+      refresh_token: r,
       client_id: a
-    }), c;
+    }), l;
     try {
-      c = await z(e.fetchImpl, s(), u);
+      l = await re(e.fetchImpl, s(), c);
     } catch {
       return false;
     }
-    let d = c.id_token;
-    if (typeof d != "string" || d.length === 0 || !_(d)) return false;
-    await e.storage.setItem(y, d);
-    let g = c.refresh_token;
-    return typeof g == "string" && g.length > 0 && await e.storage.setItem(S, g), await o(), true;
+    let d = l.id_token;
+    if (typeof d != "string" || d.length === 0 || !T(d)) return false;
+    await e.storage.setItem(U, d);
+    let f = l.refresh_token;
+    return typeof f == "string" && f.length > 0 && await e.storage.setItem(E, f), await w(l.access_token), await i(), true;
+  }
+  async function P() {
+    let r = await e.storage.getItem(C);
+    if (!r) return null;
+    let a = ve(r);
+    return a === null || a - be <= Date.now() ? null : r;
   }
-  async function V() {
-    let n = await e.storage.getItem(y);
-    if (await e.storage.removeItem(y), await e.storage.removeItem(S), n) {
-      let u = `${U(e.baseUrl)}/api/v1/oauth/revoke`;
+  async function D() {
+    let r = await P();
+    return r || (await N() ? P() : null);
+  }
+  async function oe() {
+    let r = `${S(e.baseUrl)}${we}`, a = async (f) => {
+      let { headers: g, correlationId: y } = K({
+        accept: "application/json",
+        authorization: `Bearer ${f}`
+      });
       try {
-        await e.fetchImpl(u, {
-          method: "POST",
-          headers: { "content-type": "application/json" },
-          body: JSON.stringify({ token: n })
-        });
-      } catch (c) {
-        typeof console < "u" && console.warn(
-          "[neetru-sdk] mobile signOut: server-side revoke falhou. Refresh token pode estar stale.",
-          c
+        return { res: await e.fetchImpl(r, { method: "GET", headers: g }), correlationId: y };
+      } catch (b) {
+        throw new n(
+          "network_error",
+          `GET ${r} falhou (network): ${b?.message ?? String(b)}`,
+          void 0,
+          void 0,
+          void 0,
+          y
         );
       }
+    }, c = await D();
+    if (!c)
+      throw new v(
+        "Sem sess\xE3o: fa\xE7a login (auth.signIn) antes de consultar o userinfo.",
+        "no_signed_in_user"
+      );
+    let { res: l, correlationId: d } = await a(c);
+    if (l.status === 401 && await N() && (c = await P(), c && ({ res: l, correlationId: d } = await a(c))), l.status === 401)
+      throw new v(
+        "O Core recusou a sess\xE3o (token revogado/expirado ou usu\xE1rio inativo). Fa\xE7a login novamente.",
+        "invalid_access_token",
+        401,
+        void 0,
+        d
+      );
+    let u;
+    try {
+      u = await l.json();
+    } catch {
+      u = void 0;
+    }
+    if (!l.ok) {
+      let f = u && typeof u == "object" && typeof u.error_description == "string" ? u.error_description : `HTTP ${l.status}`;
+      throw new n(te(l.status), `userinfo falhou: ${f}`, l.status, void 0, void 0, d);
+    }
+    if (!u || typeof u != "object" || typeof u.sub != "string")
+      throw new n("invalid_response", "userinfo sem `sub`.", l.status, void 0, void 0, d);
+    return u;
+  }
+  function ie(r) {
+    let a = e.productApiUrl;
+    if (!a)
+      throw new n(
+        "invalid_config",
+        "auth.authFetch requer `productApiUrl` (URL da API do seu produto) no createMobileAuthNamespace."
+      );
+    let c;
+    if (/^[a-z][a-z0-9+.-]*:/i.test(r))
+      try {
+        c = new URL(r);
+      } catch {
+        throw new n("invalid_config", `URL inv\xE1lida: ${r}`);
+      }
+    else {
+      let l = a.pathname.replace(/\/+$/, ""), d = r.startsWith("/") ? r : `/${r}`;
+      c = new URL(`${a.origin}${l}${d}`);
     }
-    await o();
+    if (c.origin !== a.origin)
+      throw new n(
+        "invalid_config",
+        `auth.authFetch s\xF3 envia o access_token para a API do produto (${a.origin}); recusado: ${c.origin}.`
+      );
+    return c.toString();
+  }
+  async function se(r, a = {}) {
+    let c = ie(r), l = {};
+    new Headers(a.headers ?? {}).forEach((y, b) => {
+      l[b] = y;
+    });
+    let d = (y) => {
+      let { headers: b } = K({ ...l, authorization: `Bearer ${y}` });
+      return e.fetchImpl(c, { ...a, headers: b });
+    }, u = await D();
+    if (!u)
+      throw new v(
+        "Sem sess\xE3o: fa\xE7a login (auth.signIn) antes de chamar a API do produto.",
+        "no_signed_in_user"
+      );
+    let f = await d(u), g = a.body === void 0 || a.body === null || typeof a.body == "string";
+    return f.status === 401 && g && await N() && (u = await P(), u && (f = await d(u))), f;
+  }
+  async function ae() {
+    let r = await e.storage.getItem(E), a = await e.storage.getItem(C);
+    await e.storage.removeItem(U), await e.storage.removeItem(E), await e.storage.removeItem(C), await e.storage.removeItem(k);
+    let c = [];
+    r && c.push({ token: r, hint: "refresh_token" }), a && c.push({ token: a, hint: "access_token" }), c.length > 0 && !await Y(
+      e.fetchImpl,
+      S(e.baseUrl),
+      e.oidcClientId,
+      c
+    ) && typeof console < "u" && console.warn(
+      "[neetru-sdk] mobile signOut: a revoga\xE7\xE3o no servidor n\xE3o foi confirmada. A sess\xE3o local foi encerrada, mas o refresh_token pode seguir v\xE1lido at\xE9 expirar."
+    ), await i();
   }
   return {
-    signIn: l,
-    completeSignIn: A,
-    getIdToken: R,
-    getUser: m,
-    onAuthStateChanged(n) {
-      return i.add(n), m().then((a) => {
-        if (i.has(n))
+    signIn: p,
+    completeSignIn: m,
+    getIdToken: I,
+    getAccessToken: D,
+    getUserInfo: oe,
+    authFetch: se,
+    getUser: h,
+    onAuthStateChanged(r) {
+      return o.add(r), h().then((a) => {
+        if (o.has(r))
           try {
-            n(a);
+            r(a);
           } catch {
           }
       }), () => {
-        i.delete(n);
+        o.delete(r);
       };
     },
-    refreshTokens: k,
-    signOut: V
+    refreshTokens: N,
+    signOut: ae
   };
 }
 
-export { ge as createMobileAuthNamespace };
+export { je as createMobileAuthNamespace };