@neetru/sdk 3.7.0 → 3.8.0

package/dist/telemetry.mjs

@@ -1,5 +1,5 @@
 // src/errors.ts
-var a = class e extends Error {
+var d = class e extends Error {
   code;
   status;
   requestId;
@@ -12,183 +12,250 @@ var a = class e extends Error {
    * para um `NeetruDbErrorCode` mais específico (recuperável vs não).
    */
   reason;
-  constructor(r, n, d, m, c) {
-    super(n), this.name = "NeetruError", this.code = r, this.status = d, this.requestId = m, this.reason = c, Object.setPrototypeOf(this, e.prototype);
+  /**
+   * 3.8.0: `x-correlation-id` da requisição que falhou. O SDK gera um UUID por
+   * chamada (ou usa o que o chamador passou) e manda no header; o Core grava o
+   * mesmo id nos logs/auditoria — cite-o ao abrir um ticket de suporte.
+   * `undefined` em erros que acontecem antes de qualquer requisição.
+   */
+  correlationId;
+  constructor(t, n, o, i, u, r) {
+    super(n), this.name = "NeetruError", this.code = t, this.status = o, this.requestId = i, this.reason = u, this.correlationId = r, Object.setPrototypeOf(this, e.prototype);
   }
 };
 
 // src/idempotency.ts
-function R() {
+function I() {
   let e = typeof globalThis < "u" && "crypto" in globalThis ? globalThis.crypto : void 0;
   if (e && typeof e.randomUUID == "function")
     return e.randomUUID();
-  throw new a(
+  throw new d(
     "runtime_unsupported",
     "crypto.randomUUID not available in this runtime. SDK 3.0 requires Node \u226520 or modern browser/Edge."
   );
 }
 
+// src/correlation.ts
+var A = "x-correlation-id";
+var j = /^[A-Za-z0-9._:\-]+$/;
+function S(e) {
+  return typeof e == "string" && e.length > 0 && e.length <= 128 && j.test(e);
+}
+function H() {
+  let e = globalThis.crypto;
+  try {
+    if (e && typeof e.randomUUID == "function") return e.randomUUID();
+  } catch {
+  }
+  let t = new Uint8Array(16), n = false;
+  try {
+    e && typeof e.getRandomValues == "function" && (e.getRandomValues(t), n = !0);
+  } catch {
+    n = false;
+  }
+  if (!n)
+    for (let i = 0; i < t.length; i++) t[i] = Math.floor(Math.random() * 256);
+  t[6] = t[6] & 15 | 64, t[8] = t[8] & 63 | 128;
+  let o = Array.from(t, (i) => i.toString(16).padStart(2, "0")).join("");
+  return `${o.slice(0, 8)}-${o.slice(8, 12)}-${o.slice(12, 16)}-${o.slice(16, 20)}-${o.slice(20)}`;
+}
+function N(e, t) {
+  let n, o = {};
+  for (let [u, r] of Object.entries(e)) {
+    if (u.toLowerCase() === A) {
+      S(r) && (n = r);
+      continue;
+    }
+    o[u] = r;
+  }
+  let i = n ?? (S(t) ? t : void 0) ?? H();
+  return o[A] = i, { headers: o, correlationId: i };
+}
+
+// src/server-only-key.ts
+function x() {
+  try {
+    let e = globalThis.navigator;
+    if (e && e.product === "ReactNative") return "react-native";
+  } catch {
+  }
+  try {
+    let e = globalThis;
+    if (typeof e.window < "u" && typeof e.document < "u") return "browser";
+  } catch {
+  }
+  return null;
+}
+
 // src/http.ts
-var L = {
+var F = {
   // SDK major 3.x requer Core ≥ 2026.05.1 (suporte a X-Neetru-Version header,
   // runTransaction write-after-read, verifyWebhookRequest, webhooks 3.0+)
   3: "2026.05.1"
 };
-function v(e) {
+function R(e) {
   return e.split("+")[0] ?? e;
 }
-function O(e, r) {
-  let n = v(e).split(".").map(Number), d = v(r).split(".").map(Number), m = Math.max(n.length, d.length);
-  for (let c = 0; c < m; c++) {
-    let t = n[c] ?? 0, i = d[c] ?? 0;
-    if (t !== i) return t - i;
+function V(e, t) {
+  let n = R(e).split(".").map(Number), o = R(t).split(".").map(Number), i = Math.max(n.length, o.length);
+  for (let u = 0; u < i; u++) {
+    let r = n[u] ?? 0, a = o[u] ?? 0;
+    if (r !== a) return r - a;
   }
   return 0;
 }
-function D() {
+function L() {
   try {
-    return "3.7.0";
+    return "3.8.0";
   } catch {
     return;
   }
 }
-function U() {
-  let e = D();
+function B() {
+  let e = L();
   return e ? parseInt(e.split(".")[0] ?? "3", 10) : 3;
 }
-var A = /* @__PURE__ */ new Set();
-function j(e) {
+var D = /* @__PURE__ */ new Set();
+function z(e) {
   if (!e) return;
-  let r = U(), n = L[r];
+  let t = B(), n = F[t];
   if (!n) return;
-  let d = v(e);
-  if (O(d, n) < 0) {
-    let m = `${r}:${d}`;
-    A.has(m) || (A.add(m), console.warn(
-      `[Neetru SDK] Aten\xE7\xE3o: Core vers\xE3o "${e}" \xE9 anterior ao m\xEDnimo recomendado "${n}" para SDK major ${r}. Alguns recursos podem n\xE3o funcionar corretamente. Atualize o Core para a vers\xE3o mais recente.`
+  let o = R(e);
+  if (V(o, n) < 0) {
+    let i = `${t}:${o}`;
+    D.has(i) || (D.add(i), console.warn(
+      `[Neetru SDK] Aten\xE7\xE3o: Core vers\xE3o "${e}" \xE9 anterior ao m\xEDnimo recomendado "${n}" para SDK major ${t}. Alguns recursos podem n\xE3o funcionar corretamente. Atualize o Core para a vers\xE3o mais recente.`
     ));
   }
 }
-var $ = 2, K = 0, H = /* @__PURE__ */ new Set(["GET", "HEAD"]), F = /* @__PURE__ */ new Set([
+function G() {
+  let e = "This operation requires an apiKey. Pass it to createNeetruClient({ apiKey }) or set NEETRU_API_KEY env var.";
+  return x() ? "Esta opera\xE7\xE3o exige a credencial nrt_ do produto, que \xE9 S\xD3 DE SERVIDOR. No navegador/app, chame a API do seu produto (ex.: https://<produto>.neetru.com/api/v1) com o token do usu\xE1rio \u2014 o backend do produto faz esta chamada com o SDK e a chave. (" + e + ")" : e;
+}
+var X = 2, Y = 0, J = /* @__PURE__ */ new Set(["GET", "HEAD"]), W = /* @__PURE__ */ new Set([
   "rate_limited",
   "server_error",
   "network_error"
 ]);
-function I(e) {
-  let r = 200 * Math.pow(4, e), n = r * 0.2 * (Math.random() * 2 - 1);
-  return Math.max(50, Math.round(r + n));
+function C(e) {
+  let t = 200 * Math.pow(4, e), n = t * 0.2 * (Math.random() * 2 - 1);
+  return Math.max(50, Math.round(t + n));
 }
-var S = 6e4;
-function V(e) {
+var O = 6e4;
+function Q(e) {
   if (!e) return null;
-  let r = Number(e);
-  if (Number.isFinite(r) && r >= 0) return Math.min(Math.round(r * 1e3), S);
+  let t = Number(e);
+  if (Number.isFinite(t) && t >= 0) return Math.min(Math.round(t * 1e3), O);
   let n = Date.parse(e);
   if (Number.isFinite(n)) {
-    let d = n - Date.now();
-    if (d > 0) return Math.min(d, S);
+    let o = n - Date.now();
+    if (o > 0) return Math.min(o, O);
   }
   return null;
 }
 function q(e) {
-  return new Promise((r) => setTimeout(r, e));
+  return new Promise((t) => setTimeout(t, e));
 }
-function G(e) {
+function Z(e) {
   return e === 401 ? "unauthorized" : e === 403 ? "forbidden" : e === 404 ? "not_found" : e === 409 ? "conflict" : e === 410 ? "gone" : e === 422 || e === 400 ? "validation_failed" : e === 429 ? "rate_limited" : e >= 500 ? "server_error" : "unknown";
 }
-function z(e, r, n) {
-  let d = e.replace(/\/+$/, ""), m = r.startsWith("/") ? r : `/${r}`, c = new URL(`${d}${m}`);
+function ee(e, t, n) {
+  let o = e.replace(/\/+$/, ""), i = t.startsWith("/") ? t : `/${t}`, u = new URL(`${o}${i}`);
   if (n)
-    for (let [t, i] of Object.entries(n))
-      i !== void 0 && c.searchParams.set(t, String(i));
-  return c.toString();
+    for (let [r, a] of Object.entries(n))
+      a !== void 0 && u.searchParams.set(r, String(a));
+  return u.toString();
 }
-async function x(e) {
-  let r = await e.text();
-  if (r)
+async function K(e) {
+  let t = await e.text();
+  if (t)
     try {
-      return JSON.parse(r);
+      return JSON.parse(t);
     } catch {
       return;
     }
 }
-async function _(e, r) {
-  let n = r.method ?? "GET", d = z(e.baseUrl, r.path, r.query), m = H.has(n) ? $ : K, c = r.retries ?? m, t = {
-    accept: "application/json",
-    ...r.headers
-  }, i = D();
-  if (i && (t["x-neetru-sdk-version"] = i), r.requireAuth) {
+async function v(e, t) {
+  let n = t.method ?? "GET", o = ee(e.baseUrl, t.path, t.query), i = J.has(n) ? X : Y, u = t.retries ?? i, { headers: r, correlationId: a } = N(
+    { accept: "application/json", ...t.headers },
+    t.correlationId
+  ), l = L();
+  if (l && (r["x-neetru-sdk-version"] = l), t.requireAuth) {
     if (!e.apiKey)
-      throw new a(
-        "missing_api_key",
-        "This operation requires an apiKey. Pass it to createNeetruClient({ apiKey }) or set NEETRU_API_KEY env var."
-      );
-    t.authorization = `Bearer ${e.apiKey}`;
+      throw new d("missing_api_key", G());
+    r.authorization = `Bearer ${e.apiKey}`;
   }
-  if (r.idempotencyKey) {
-    let f = typeof r.idempotencyKey == "string" ? r.idempotencyKey : R();
-    t["idempotency-key"] = f;
+  if (t.idempotencyKey) {
+    let g = typeof t.idempotencyKey == "string" ? t.idempotencyKey : I();
+    r["idempotency-key"] = g;
   }
-  let l = r.body !== void 0 && n !== "GET" && n !== "DELETE" ? JSON.stringify(r.body) : void 0;
-  l !== void 0 && (t["content-type"] = "application/json");
-  let s = null, u = r.deadlineMs != null ? Date.now() + r.deadlineMs : null;
-  for (let f = 0; f <= c; f++) {
-    if (u != null && Date.now() >= u)
-      throw s ?? new a("network_error", "Deadline excedido antes de completar a request");
-    let y = { method: n, headers: t };
-    l !== void 0 && (y.body = l);
-    let M = u != null ? Math.max(1, Math.min(3e4, u - Date.now())) : 3e4;
-    y.signal = AbortSignal.timeout(M);
+  let c = t.body !== void 0 && n !== "GET" && n !== "DELETE" ? JSON.stringify(t.body) : void 0;
+  c !== void 0 && (r["content-type"] = "application/json");
+  let f = null, m = t.deadlineMs != null ? Date.now() + t.deadlineMs : null;
+  for (let g = 0; g <= u; g++) {
+    if (m != null && Date.now() >= m)
+      throw f ?? new d(
+        "network_error",
+        "Deadline excedido antes de completar a request",
+        void 0,
+        void 0,
+        void 0,
+        a
+      );
+    let b = { method: n, headers: r };
+    c !== void 0 && (b.body = c);
+    let U = m != null ? Math.max(1, Math.min(3e4, m - Date.now())) : 3e4;
+    b.signal = AbortSignal.timeout(U);
     let p;
     try {
-      p = await e.fetch(d, y);
-    } catch (o) {
-      let w = o instanceof DOMException && o.name === "TimeoutError" ? "Network error: timeout after 30s" : `Network error: ${o instanceof Error ? o.message : "fetch failed"}`;
-      if (s = new a("network_error", w), f < c) {
-        let k = I(f);
-        if (u == null || Date.now() + k < u) {
+      p = await e.fetch(o, b);
+    } catch (s) {
+      let _ = s instanceof DOMException && s.name === "TimeoutError" ? "Network error: timeout after 30s" : `Network error: ${s instanceof Error ? s.message : "fetch failed"}`;
+      if (f = new d("network_error", _, void 0, void 0, void 0, a), g < u) {
+        let k = C(g);
+        if (m == null || Date.now() + k < m) {
           await q(k);
           continue;
         }
       }
-      throw s;
+      throw f;
     }
-    let P = p.headers.get("x-request-id") ?? p.headers.get("x-correlation-id") ?? void 0;
+    let $ = p.headers.get("x-request-id") ?? p.headers.get("x-correlation-id") ?? void 0;
     if (p.ok) {
-      let o = p.headers.get("x-neetru-version");
-      return o && j(o), await x(p);
+      let s = p.headers.get("x-neetru-version");
+      return s && z(s), await K(p);
     }
-    let g = await x(p), b = G(p.status), h = `HTTP ${p.status}`, T;
-    if (g && typeof g == "object") {
-      let o = g.error;
-      typeof o == "string" ? h = o : o && typeof o == "object" ? (typeof o.code == "string" && (b = o.code), typeof o.message == "string" && (h = o.message), typeof o.reason == "string" && (T = o.reason)) : (typeof g.code == "string" && (b = g.code), typeof g.message == "string" && (h = g.message)), typeof g.reason == "string" && (T = g.reason);
+    let y = await K(p), w = Z(p.status), h = `HTTP ${p.status}`, E;
+    if (y && typeof y == "object") {
+      let s = y.error;
+      typeof s == "string" ? h = s : s && typeof s == "object" ? (typeof s.code == "string" && (w = s.code), typeof s.message == "string" && (h = s.message), typeof s.reason == "string" && (E = s.reason)) : (typeof y.code == "string" && (w = y.code), typeof y.message == "string" && (h = y.message)), typeof y.reason == "string" && (E = y.reason);
     }
     if (p.status === 410) {
-      let o = p.headers.get("x-neetru-replacement");
-      h === `HTTP ${p.status}` && (h = `Endpoint ${r.path} foi removido do Core (HTTP 410 Gone) \u2014 atualize o @neetru/sdk e migre para a API substituta.`), o && !h.includes(o) && (h += ` Substituto: ${o}.`);
+      let s = p.headers.get("x-neetru-replacement");
+      h === `HTTP ${p.status}` && (h = `Endpoint ${t.path} foi removido do Core (HTTP 410 Gone) \u2014 atualize o @neetru/sdk e migre para a API substituta.`), s && !h.includes(s) && (h += ` Substituto: ${s}.`);
     }
-    let E = new a(b, h, p.status, P, T);
-    if (s = E, F.has(b) && f < c) {
-      let w = V(p.headers.get("retry-after")) ?? I(f);
-      if (u == null || Date.now() + w < u) {
-        await q(w);
+    let T = new d(w, h, p.status, $, E, a);
+    if (f = T, W.has(w) && g < u) {
+      let _ = Q(p.headers.get("retry-after")) ?? C(g);
+      if (m == null || Date.now() + _ < m) {
+        await q(_);
         continue;
       }
     }
-    throw E;
+    throw T;
   }
-  throw s ?? new a("unknown", "unexpected httpRequest exit");
+  throw f ?? new d("unknown", "unexpected httpRequest exit", void 0, void 0, void 0, a);
 }
 
 // src/telemetry.ts
-var N = ["debug", "info", "warn", "error", "fatal"];
-function B() {
+var P = ["debug", "info", "warn", "error", "fatal"];
+function te() {
   return typeof globalThis < "u" && typeof globalThis.window < "u";
 }
-function C() {
-  return B() ? { path: "/api/sdk/v1/telemetry/event/public", requireAuth: false } : { path: "/api/sdk/v1/telemetry/event", requireAuth: true };
+function M() {
+  return te() ? { path: "/api/sdk/v1/telemetry/event/public", requireAuth: false } : { path: "/api/sdk/v1/telemetry/event", requireAuth: true };
 }
-function J(e) {
+function re(e) {
   switch (e) {
     case "debug":
       return console.debug.bind(console);
@@ -204,41 +271,41 @@ function J(e) {
       return console.log.bind(console);
   }
 }
-var X = 500, Y = 50;
-function se(e) {
-  let r = [], n = null, d = null;
-  async function m() {
-    if (r.length === 0) return;
-    let t = r.splice(0, r.length), i = Promise.allSettled(
-      t.map(async (l) => {
+var ne = 500, oe = 50;
+function _e(e) {
+  let t = [], n = null, o = null;
+  async function i() {
+    if (t.length === 0) return;
+    let r = t.splice(0, t.length), a = Promise.allSettled(
+      r.map(async (l) => {
         try {
-          let s = { name: l.name }, u = l.productSlug ?? e.productId;
-          u && (s.productSlug = u), l.properties && typeof l.properties == "object" && (s.properties = l.properties), l.timestamp && (s.timestamp = l.timestamp);
-          let f = C();
-          await _(e, {
+          let c = { name: l.name }, f = l.productSlug ?? e.productId;
+          f && (c.productSlug = f), l.properties && typeof l.properties == "object" && (c.properties = l.properties), l.timestamp && (c.timestamp = l.timestamp);
+          let m = M();
+          await v(e, {
             method: "POST",
-            path: f.path,
-            body: s,
-            requireAuth: f.requireAuth,
+            path: m.path,
+            body: c,
+            requireAuth: m.requireAuth,
             retries: 1,
             // caça-bruxas: retry sem Idempotency-Key duplicava o evento se o
             // servidor já tinha persistido antes da falha transiente. Mesmo
             // padrão do usage.report (key estável por chamada, reusada no retry).
             idempotencyKey: !0
           });
-        } catch (s) {
-          typeof console < "u" && console.warn("[neetru-sdk] telemetry.track flush failed for event", l.name, s);
+        } catch (c) {
+          typeof console < "u" && console.warn("[neetru-sdk] telemetry.track flush failed for event", l.name, c);
         }
       })
     );
-    d = i.then(() => {
-      d = null;
-    }), await i, n = null, r.length > 0 && c();
+    o = a.then(() => {
+      o = null;
+    }), await a, n = null, t.length > 0 && u();
   }
-  function c() {
+  function u() {
     n || (n = setTimeout(() => {
-      m();
-    }, X));
+      i();
+    }, ne));
   }
   return {
     /**
@@ -253,24 +320,24 @@ function se(e) {
      * });
      * ```
      */
-    async event(t) {
-      if (!t || typeof t != "object")
-        throw new a("validation_failed", "event input is required");
-      if (typeof t.name != "string" || t.name.length === 0)
-        throw new a("validation_failed", "event.name is required");
-      if (t.name.length > 128)
-        throw new a("validation_failed", "event.name max 128 chars");
-      let i = { name: t.name }, l = t.productSlug ?? e.productId;
-      l && (i.productSlug = l), t.properties && typeof t.properties == "object" && (i.properties = t.properties), t.timestamp && (i.timestamp = t.timestamp);
-      let s = C(), u = await _(e, {
+    async event(r) {
+      if (!r || typeof r != "object")
+        throw new d("validation_failed", "event input is required");
+      if (typeof r.name != "string" || r.name.length === 0)
+        throw new d("validation_failed", "event.name is required");
+      if (r.name.length > 128)
+        throw new d("validation_failed", "event.name max 128 chars");
+      let a = { name: r.name }, l = r.productSlug ?? e.productId;
+      l && (a.productSlug = l), r.properties && typeof r.properties == "object" && (a.properties = r.properties), r.timestamp && (a.timestamp = r.timestamp);
+      let c = M(), f = await v(e, {
         method: "POST",
-        path: s.path,
-        body: i,
-        requireAuth: s.requireAuth
+        path: c.path,
+        body: a,
+        requireAuth: c.requireAuth
       });
-      if (!u || u.ok !== true || typeof u.eventId != "string")
-        throw new a("invalid_response", "Telemetry response missing eventId");
-      return { ok: true, eventId: u.eventId };
+      if (!f || f.ok !== true || typeof f.eventId != "string")
+        throw new d("invalid_response", "Telemetry response missing eventId");
+      return { ok: true, eventId: f.eventId };
     },
     /**
      * Fire-and-forget: enqueue + flush 500ms debounce. Não retorna `eventId`
@@ -282,15 +349,15 @@ function se(e) {
      * // segue execução; flush async em background
      * ```
      */
-    track(t) {
-      !t || typeof t != "object" || typeof t.name != "string" || t.name.length === 0 || t.name.length > 128 || (r.push(t), r.length >= Y ? (n && (clearTimeout(n), n = null), m()) : c());
+    track(r) {
+      !r || typeof r != "object" || typeof r.name != "string" || r.name.length === 0 || r.name.length > 128 || (t.push(r), t.length >= oe ? (n && (clearTimeout(n), n = null), i()) : u());
     },
     /**
      * Força flush imediato da queue de `track()`. Resolva antes de
      * page unload / SSR boundary pra não perder eventos.
      */
     async flush() {
-      n && (clearTimeout(n), n = null), d && await d, await m();
+      n && (clearTimeout(n), n = null), o && await o, await i();
     },
     /**
      * Registra um log estruturado per-product (Sprint 6).
@@ -307,49 +374,49 @@ function se(e) {
      * });
      * ```
      */
-    async log(t) {
-      if (!t || typeof t != "object")
-        throw new a("validation_failed", "log input is required");
-      if (!N.includes(t.level))
-        throw new a("validation_failed", `level must be one of ${N.join(", ")}`);
-      if (typeof t.message != "string" || t.message.length === 0)
-        throw new a("validation_failed", "message is required");
-      if (t.message.length > 4e3)
-        throw new a("validation_failed", "message max 4000 chars");
+    async log(r) {
+      if (!r || typeof r != "object")
+        throw new d("validation_failed", "log input is required");
+      if (!P.includes(r.level))
+        throw new d("validation_failed", `level must be one of ${P.join(", ")}`);
+      if (typeof r.message != "string" || r.message.length === 0)
+        throw new d("validation_failed", "message is required");
+      if (r.message.length > 4e3)
+        throw new d("validation_failed", "message max 4000 chars");
       if (e.env === "dev")
-        return J(t.level)(`[neetru-sdk] ${t.level}: ${t.message}`, t.metadata ?? {}), { ok: true, mode: "mock" };
-      let i = {
-        level: t.level,
-        message: t.message
+        return re(r.level)(`[neetru-sdk] ${r.level}: ${r.message}`, r.metadata ?? {}), { ok: true, mode: "mock" };
+      let a = {
+        level: r.level,
+        message: r.message
       };
-      t.metadata && (i.metadata = t.metadata);
-      let l = t.productSlug ?? e.productId;
-      l && (i.productSlug = l);
-      let s = t.correlationId;
-      if (!s)
+      r.metadata && (a.metadata = r.metadata);
+      let l = r.productSlug ?? e.productId;
+      l && (a.productSlug = l);
+      let c = r.correlationId;
+      if (!c)
         try {
-          let y = globalThis.NEETRU_CORRELATION_ID;
-          typeof y == "string" && y.length > 0 && (s = y);
+          let g = globalThis.NEETRU_CORRELATION_ID;
+          typeof g == "string" && g.length > 0 && (c = g);
         } catch {
         }
-      let u = {};
-      s && (u["x-correlation-id"] = s);
-      let f = await _(e, {
+      let f = {};
+      c && (f["x-correlation-id"] = c);
+      let m = await v(e, {
         method: "POST",
         path: "/api/sdk/v1/telemetry/log",
-        body: i,
+        body: a,
         requireAuth: true,
-        headers: u
+        headers: f
       });
-      if (!f || f.ok !== true)
-        throw new a("invalid_response", "Telemetry log response missing ok");
+      if (!m || m.ok !== true)
+        throw new d("invalid_response", "Telemetry log response missing ok");
       return {
         ok: true,
-        logId: typeof f.logId == "string" ? f.logId : void 0,
+        logId: typeof m.logId == "string" ? m.logId : void 0,
         mode: "http"
       };
     }
   };
 }
 
-export { se as createTelemetryNamespace };
+export { _e as createTelemetryNamespace };

package/dist/{types-Bx4kTLmk.d.cts → types-D-9bjlM0.d.cts}

@@ -113,6 +113,28 @@ declare class MockCheckout implements CheckoutNamespace {
 }
 declare function createCheckoutNamespace(config: ResolvedConfig): CheckoutNamespace;
 
+/**
+ * 3.8.0 — Provedor de token do USUÁRIO FINAL, síncrono OU assíncrono.
+ *
+ * O namespace `auth` web lê o id_token de `localStorage` (síncrono). Em React
+ * Native o storage é assíncrono (`@neetru/sdk/mobile` → `getIdToken():
+ * Promise`). Antes desta versão `support` e a barra de conta só aceitavam o
+ * contrato síncrono — o módulo mobile ficava solto do `createNeetruClient`.
+ *
+ * Agora `createNeetruClient({ endUserAuth })` aceita qualquer objeto com
+ * `getIdToken()` (sync ou Promise) e, opcionalmente, `refreshTokens()` — o
+ * `MobileAuthNamespace` encaixa direto. O provedor fica registrado por client
+ * (WeakMap, sem mudar o shape público do `NeetruClient`) para a barra de conta
+ * (`fetchNeetruAccountBar`) achá-lo.
+ */
+
+interface EndUserTokenProvider {
+    /** id_token OIDC do usuário logado, ou `null`. Pode ser síncrono ou Promise. */
+    getIdToken(): string | null | undefined | Promise<string | null | undefined>;
+    /** Renova a sessão (refresh_token → id_token novo). `true` se renovou. */
+    refreshTokens?(): Promise<boolean>;
+}
+
 /** Bloco de texto de uma mensagem multimodal (OpenAI-compat). */
 interface AiTextPart {
     type: 'text';
@@ -1975,6 +1997,10 @@ interface NeetruClientConfig {
      *
      * Endpoints públicos (catalog) funcionam sem apiKey. Endpoints autenticados
      * (entitlements, telemetry) lançam `missing_api_key` se ausente.
+     *
+     * **3.8.0: SÓ DE SERVIDOR.** Nunca coloque a chave no navegador ou no app
+     * (`NEXT_PUBLIC_*`/`EXPO_PUBLIC_*`): o site/app chama a API do próprio produto
+     * e o backend usa o SDK com a chave. Ver `strictServerOnlyKey`.
      */
     apiKey?: string;
     /**
@@ -2053,6 +2079,27 @@ interface NeetruClientConfig {
      * Bypass total: `NEETRU_ALLOW_INSECURE_BASEURL=1` no env.
      */
     allowedHosts?: string[];
+    /**
+     * 3.8.0 — a credencial `nrt_` é SÓ DE SERVIDOR. Quando o SDK recebe chave
+     * (via `apiKey` ou `NEETRU_API_KEY`) rodando em navegador ou React Native:
+     *   - `false`/omitido (padrão nesta minor): aviso único no console (PT-BR,
+     *     sem imprimir a chave) e segue funcionando — pra não quebrar produtos
+     *     que ainda estão migrando;
+     *   - `true`: falha FECHADO com `NeetruError('server_only_key')`.
+     *
+     * **Na próxima MAJOR (4.0) a falha fechada vira o padrão.** No servidor
+     * (Node/Edge) a opção não tem efeito.
+     */
+    strictServerOnlyKey?: boolean;
+    /**
+     * 3.8.0 — provedor do token do USUÁRIO FINAL usado pelo `support`
+     * (`X-Neetru-End-User-Token`) e pela barra de conta. Aceita `getIdToken()`
+     * síncrono ou assíncrono (+ `refreshTokens()` opcional). Encaixa direto o
+     * `createMobileAuthNamespace(...)` de `@neetru/sdk/mobile`; no backend do
+     * produto, pode ser `{ getIdToken: () => idTokenQueOAppMandou }`.
+     * Default: `client.auth`.
+     */
+    endUserAuth?: EndUserTokenProvider;
 }
 /**
  * Status do produto no catálogo público.
@@ -2721,4 +2768,4 @@ interface CatalogListOptions {
     includeDrafts?: boolean;
 }
 
-export { NeetruDbError as $, type AiChatChoice as A, type DbChangeType as B, type CatalogListOptions as C, DEFAULT_BASE_URL as D, type DbCollectionRef$1 as E, type DbDoc as F, type DbDocRef as G, type DbGetResult as H, type DbListResult as I, type DbNamespace as J, type DbQuery$1 as K, type DbSqlLease as L, type DbWhereFilter as M, type DbWhereFilter$1 as N, type EntitlementCheck as O, type FieldSentinel as P, type IncrementSentinel as Q, type ListNotificationsOptions as R, MockCheckout as S, MockNotifications as T, MockWebhooks as U, NEETRU_SENTINEL_KEY as V, type NeetruClient as W, type NeetruClientConfig as X, type NeetruDb as Y, type NeetruDbDocuments as Z, type NeetruDbEngine as _, type AiChatMessage as a, type NeetruDbErrorCode as a0, type NeetruDbOptions as a1, type NeetruDbTransport as a2, type NeetruEnv as a3, type NeetruSqlClient as a4, type NeetruUser as a5, type NotificationScopeOptions as a6, type NotificationsNamespace as a7, type Product as a8, type ProductNotification as a9, type VerifyWebhookRequestOptions as aA, type VerifyWebhookRequestResult as aB, type WebhookEndpoint as aC, type WebhookEvent as aD, type WebhookScopeOptions as aE, type WebhookTestResult as aF, type WebhooksNamespace as aG, type WithFieldSentinels as aH, __resetDbIdWarningForTests as aI, createAiNamespace as aJ, createCheckoutNamespace as aK, createNeetruDb as aL, createNotificationsNamespace as aM, createRestSyncTransport as aN, createWebhooksNamespace as aO, getWebSocketRealtimeClient as aP, increment as aQ, isFieldSentinel as aR, isIncrementSentinel as aS, isServerTimestampSentinel as aT, serverTimestamp as aU, verifyWebhookRequest as aV, verifyWebhookSignature as aW, type ProductNotificationSeverity as aa, type ProductPlan as ab, type ProductStatus as ac, type RealtimeTransport as ad, type RedirectCallbackResult as ae, type RegisterWebhookInput as af, type ResolvedConfig as ag, type SendNotificationInput as ah, type ServerTimestampSentinel as ai, type SignInOptions as aj, type SqlOptions as ak, type SupportNamespace as al, type SupportSeverity as am, type SupportStatus as an, type SupportTicket as ao, type SyncErrorEvent as ap, type SyncState as aq, type TelemetryEventAck as ar, type TelemetryEventInput as as, type TelemetryLogAck as at, type TelemetryLogInput as au, type Unsubscribe as av, type UsageEventInput as aw, type UsageNamespace as ax, type UsageQuota as ay, type VerifyTokenOptions as az, type AiChatOptions as b, type AiChatResult as c, type AiChatUsage as d, type AiContentPart as e, type AiImageUrlPart as f, type AiNamespace as g, type AiResponseFormat as h, type AiStreamHandle as i, type AiStreamMeta as j, type AiTextPart as k, type AuthNamespace as l, type AuthStateListener as m, type CatalogListResponse as n, type CheckoutAuthOpts as o, type CheckoutIntentInfo as p, type CheckoutIntentStatus as q, type CheckoutNamespace as r, type CheckoutStartInput as s, type CheckoutStartResult as t, type CheckoutTenantType as u, type CompleteSignInResult as v, type ConflictRecord as w, type CreateOfflineDocumentsOptions as x, type CreateTicketInput as y, type DbBatchOp as z };
+export { type NeetruDbEngine as $, type AiChatChoice as A, type DbChangeType as B, type CatalogListOptions as C, DEFAULT_BASE_URL as D, type DbCollectionRef$1 as E, type DbDoc as F, type DbDocRef as G, type DbGetResult as H, type DbListResult as I, type DbNamespace as J, type DbQuery$1 as K, type DbSqlLease as L, type DbWhereFilter as M, type DbWhereFilter$1 as N, type EndUserTokenProvider as O, type EntitlementCheck as P, type FieldSentinel as Q, type IncrementSentinel as R, type ListNotificationsOptions as S, MockCheckout as T, MockNotifications as U, MockWebhooks as V, NEETRU_SENTINEL_KEY as W, type NeetruClient as X, type NeetruClientConfig as Y, type NeetruDb as Z, type NeetruDbDocuments as _, type AiChatMessage as a, NeetruDbError as a0, type NeetruDbErrorCode as a1, type NeetruDbOptions as a2, type NeetruDbTransport as a3, type NeetruEnv as a4, type NeetruSqlClient as a5, type NeetruUser as a6, type NotificationScopeOptions as a7, type NotificationsNamespace as a8, type Product as a9, type VerifyTokenOptions as aA, type VerifyWebhookRequestOptions as aB, type VerifyWebhookRequestResult as aC, type WebhookEndpoint as aD, type WebhookEvent as aE, type WebhookScopeOptions as aF, type WebhookTestResult as aG, type WebhooksNamespace as aH, type WithFieldSentinels as aI, __resetDbIdWarningForTests as aJ, createAiNamespace as aK, createCheckoutNamespace as aL, createNeetruDb as aM, createNotificationsNamespace as aN, createRestSyncTransport as aO, createWebhooksNamespace as aP, getWebSocketRealtimeClient as aQ, increment as aR, isFieldSentinel as aS, isIncrementSentinel as aT, isServerTimestampSentinel as aU, serverTimestamp as aV, verifyWebhookRequest as aW, verifyWebhookSignature as aX, type ProductNotification as aa, type ProductNotificationSeverity as ab, type ProductPlan as ac, type ProductStatus as ad, type RealtimeTransport as ae, type RedirectCallbackResult as af, type RegisterWebhookInput as ag, type ResolvedConfig as ah, type SendNotificationInput as ai, type ServerTimestampSentinel as aj, type SignInOptions as ak, type SqlOptions as al, type SupportNamespace as am, type SupportSeverity as an, type SupportStatus as ao, type SupportTicket as ap, type SyncErrorEvent as aq, type SyncState as ar, type TelemetryEventAck as as, type TelemetryEventInput as at, type TelemetryLogAck as au, type TelemetryLogInput as av, type Unsubscribe as aw, type UsageEventInput as ax, type UsageNamespace as ay, type UsageQuota as az, type AiChatOptions as b, type AiChatResult as c, type AiChatUsage as d, type AiContentPart as e, type AiImageUrlPart as f, type AiNamespace as g, type AiResponseFormat as h, type AiStreamHandle as i, type AiStreamMeta as j, type AiTextPart as k, type AuthNamespace as l, type AuthStateListener as m, type CatalogListResponse as n, type CheckoutAuthOpts as o, type CheckoutIntentInfo as p, type CheckoutIntentStatus as q, type CheckoutNamespace as r, type CheckoutStartInput as s, type CheckoutStartResult as t, type CheckoutTenantType as u, type CompleteSignInResult as v, type ConflictRecord as w, type CreateOfflineDocumentsOptions as x, type CreateTicketInput as y, type DbBatchOp as z };