@neetru/sdk 3.7.0 → 3.8.0

package/dist/checkout.cjs

@@ -1,7 +1,7 @@
 'use strict';
 
 // src/errors.ts
-var o = class t extends Error {
+var i = class t extends Error {
   code;
   status;
   requestId;
@@ -14,8 +14,15 @@ var o = class t extends Error {
    * para um `NeetruDbErrorCode` mais específico (recuperável vs não).
    */
   reason;
-  constructor(e, n, r, s, a) {
-    super(n), this.name = "NeetruError", this.code = e, this.status = r, this.requestId = s, this.reason = a, Object.setPrototypeOf(this, t.prototype);
+  /**
+   * 3.8.0: `x-correlation-id` da requisição que falhou. O SDK gera um UUID por
+   * chamada (ou usa o que o chamador passou) e manda no header; o Core grava o
+   * mesmo id nos logs/auditoria — cite-o ao abrir um ticket de suporte.
+   * `undefined` em erros que acontecem antes de qualquer requisição.
+   */
+  correlationId;
+  constructor(e, n, r, o, a, c) {
+    super(n), this.name = "NeetruError", this.code = e, this.status = r, this.requestId = o, this.reason = a, this.correlationId = c, Object.setPrototypeOf(this, t.prototype);
   }
 };
 
@@ -24,14 +31,66 @@ function E() {
   let t = typeof globalThis < "u" && "crypto" in globalThis ? globalThis.crypto : void 0;
   if (t && typeof t.randomUUID == "function")
     return t.randomUUID();
-  throw new o(
+  throw new i(
     "runtime_unsupported",
     "crypto.randomUUID not available in this runtime. SDK 3.0 requires Node \u226520 or modern browser/Edge."
   );
 }
 
+// src/correlation.ts
+var A = "x-correlation-id";
+var L = /^[A-Za-z0-9._:\-]+$/;
+function x(t) {
+  return typeof t == "string" && t.length > 0 && t.length <= 128 && L.test(t);
+}
+function H() {
+  let t = globalThis.crypto;
+  try {
+    if (t && typeof t.randomUUID == "function") return t.randomUUID();
+  } catch {
+  }
+  let e = new Uint8Array(16), n = false;
+  try {
+    t && typeof t.getRandomValues == "function" && (t.getRandomValues(e), n = !0);
+  } catch {
+    n = false;
+  }
+  if (!n)
+    for (let o = 0; o < e.length; o++) e[o] = Math.floor(Math.random() * 256);
+  e[6] = e[6] & 15 | 64, e[8] = e[8] & 63 | 128;
+  let r = Array.from(e, (o) => o.toString(16).padStart(2, "0")).join("");
+  return `${r.slice(0, 8)}-${r.slice(8, 12)}-${r.slice(12, 16)}-${r.slice(16, 20)}-${r.slice(20)}`;
+}
+function N(t, e) {
+  let n, r = {};
+  for (let [a, c] of Object.entries(t)) {
+    if (a.toLowerCase() === A) {
+      x(c) && (n = c);
+      continue;
+    }
+    r[a] = c;
+  }
+  let o = n ?? (x(e) ? e : void 0) ?? H();
+  return r[A] = o, { headers: r, correlationId: o };
+}
+
+// src/server-only-key.ts
+function D() {
+  try {
+    let t = globalThis.navigator;
+    if (t && t.product === "ReactNative") return "react-native";
+  } catch {
+  }
+  try {
+    let t = globalThis;
+    if (typeof t.window < "u" && typeof t.document < "u") return "browser";
+  } catch {
+  }
+  return null;
+}
+
 // src/http.ts
-var P = {
+var B = {
   // SDK major 3.x requer Core ≥ 2026.05.1 (suporte a X-Neetru-Version header,
   // runTransaction write-after-read, verifyWebhookRequest, webhooks 3.0+)
   3: "2026.05.1"
@@ -39,73 +98,77 @@ var P = {
 function b(t) {
   return t.split("+")[0] ?? t;
 }
-function M(t, e) {
-  let n = b(t).split(".").map(Number), r = b(e).split(".").map(Number), s = Math.max(n.length, r.length);
-  for (let a = 0; a < s; a++) {
-    let d = n[a] ?? 0, u = r[a] ?? 0;
-    if (d !== u) return d - u;
+function G(t, e) {
+  let n = b(t).split(".").map(Number), r = b(e).split(".").map(Number), o = Math.max(n.length, r.length);
+  for (let a = 0; a < o; a++) {
+    let c = n[a] ?? 0, u = r[a] ?? 0;
+    if (c !== u) return c - u;
   }
   return 0;
 }
-function D() {
+function M() {
   try {
-    return "3.7.0";
+    return "3.8.0";
   } catch {
     return;
   }
 }
-function $() {
-  let t = D();
+function F() {
+  let t = M();
   return t ? parseInt(t.split(".")[0] ?? "3", 10) : 3;
 }
-var v = /* @__PURE__ */ new Set();
-function K(t) {
+var U = /* @__PURE__ */ new Set();
+function V(t) {
   if (!t) return;
-  let e = $(), n = P[e];
+  let e = F(), n = B[e];
   if (!n) return;
   let r = b(t);
-  if (M(r, n) < 0) {
-    let s = `${e}:${r}`;
-    v.has(s) || (v.add(s), console.warn(
+  if (G(r, n) < 0) {
+    let o = `${e}:${r}`;
+    U.has(o) || (U.add(o), console.warn(
       `[Neetru SDK] Aten\xE7\xE3o: Core vers\xE3o "${t}" \xE9 anterior ao m\xEDnimo recomendado "${n}" para SDK major ${e}. Alguns recursos podem n\xE3o funcionar corretamente. Atualize o Core para a vers\xE3o mais recente.`
     ));
   }
 }
-var j = 2, G = 0, H = /* @__PURE__ */ new Set(["GET", "HEAD"]), F = /* @__PURE__ */ new Set([
+function z() {
+  let t = "This operation requires an apiKey. Pass it to createNeetruClient({ apiKey }) or set NEETRU_API_KEY env var.";
+  return D() ? "Esta opera\xE7\xE3o exige a credencial nrt_ do produto, que \xE9 S\xD3 DE SERVIDOR. No navegador/app, chame a API do seu produto (ex.: https://<produto>.neetru.com/api/v1) com o token do usu\xE1rio \u2014 o backend do produto faz esta chamada com o SDK e a chave. (" + t + ")" : t;
+}
+var X = 2, Y = 0, J = /* @__PURE__ */ new Set(["GET", "HEAD"]), W = /* @__PURE__ */ new Set([
   "rate_limited",
   "server_error",
   "network_error"
 ]);
-function x(t) {
+function O(t) {
   let e = 200 * Math.pow(4, t), n = e * 0.2 * (Math.random() * 2 - 1);
   return Math.max(50, Math.round(e + n));
 }
-var A = 6e4;
-function B(t) {
+var q = 6e4;
+function Z(t) {
   if (!t) return null;
   let e = Number(t);
-  if (Number.isFinite(e) && e >= 0) return Math.min(Math.round(e * 1e3), A);
+  if (Number.isFinite(e) && e >= 0) return Math.min(Math.round(e * 1e3), q);
   let n = Date.parse(t);
   if (Number.isFinite(n)) {
     let r = n - Date.now();
-    if (r > 0) return Math.min(r, A);
+    if (r > 0) return Math.min(r, q);
   }
   return null;
 }
-function U(t) {
+function K(t) {
   return new Promise((e) => setTimeout(e, t));
 }
-function L(t) {
+function Q(t) {
   return t === 401 ? "unauthorized" : t === 403 ? "forbidden" : t === 404 ? "not_found" : t === 409 ? "conflict" : t === 410 ? "gone" : t === 422 || t === 400 ? "validation_failed" : t === 429 ? "rate_limited" : t >= 500 ? "server_error" : "unknown";
 }
-function z(t, e, n) {
-  let r = t.replace(/\/+$/, ""), s = e.startsWith("/") ? e : `/${e}`, a = new URL(`${r}${s}`);
+function ee(t, e, n) {
+  let r = t.replace(/\/+$/, ""), o = e.startsWith("/") ? e : `/${e}`, a = new URL(`${r}${o}`);
   if (n)
-    for (let [d, u] of Object.entries(n))
-      u !== void 0 && a.searchParams.set(d, String(u));
+    for (let [c, u] of Object.entries(n))
+      u !== void 0 && a.searchParams.set(c, String(u));
   return a.toString();
 }
-async function q(t) {
+async function P(t) {
   let e = await t.text();
   if (e)
     try {
@@ -115,91 +178,95 @@ async function q(t) {
     }
 }
 async function y(t, e) {
-  let n = e.method ?? "GET", r = z(t.baseUrl, e.path, e.query), s = H.has(n) ? j : G, a = e.retries ?? s, d = {
-    accept: "application/json",
-    ...e.headers
-  }, u = D();
-  if (u && (d["x-neetru-sdk-version"] = u), e.requireAuth) {
+  let n = e.method ?? "GET", r = ee(t.baseUrl, e.path, e.query), o = J.has(n) ? X : Y, a = e.retries ?? o, { headers: c, correlationId: u } = N(
+    { accept: "application/json", ...e.headers },
+    e.correlationId
+  ), C = M();
+  if (C && (c["x-neetru-sdk-version"] = C), e.requireAuth) {
     if (!t.apiKey)
-      throw new o(
-        "missing_api_key",
-        "This operation requires an apiKey. Pass it to createNeetruClient({ apiKey }) or set NEETRU_API_KEY env var."
-      );
-    d.authorization = `Bearer ${t.apiKey}`;
+      throw new i("missing_api_key", z());
+    c.authorization = `Bearer ${t.apiKey}`;
   }
   if (e.idempotencyKey) {
     let f = typeof e.idempotencyKey == "string" ? e.idempotencyKey : E();
-    d["idempotency-key"] = f;
+    c["idempotency-key"] = f;
   }
   let I = e.body !== void 0 && n !== "GET" && n !== "DELETE" ? JSON.stringify(e.body) : void 0;
-  I !== void 0 && (d["content-type"] = "application/json");
+  I !== void 0 && (c["content-type"] = "application/json");
   let g = null, p = e.deadlineMs != null ? Date.now() + e.deadlineMs : null;
   for (let f = 0; f <= a; f++) {
     if (p != null && Date.now() >= p)
-      throw g ?? new o("network_error", "Deadline excedido antes de completar a request");
-    let w = { method: n, headers: d };
-    I !== void 0 && (w.body = I);
-    let N = p != null ? Math.max(1, Math.min(3e4, p - Date.now())) : 3e4;
-    w.signal = AbortSignal.timeout(N);
-    let c;
+      throw g ?? new i(
+        "network_error",
+        "Deadline excedido antes de completar a request",
+        void 0,
+        void 0,
+        void 0,
+        u
+      );
+    let _ = { method: n, headers: c };
+    I !== void 0 && (_.body = I);
+    let $ = p != null ? Math.max(1, Math.min(3e4, p - Date.now())) : 3e4;
+    _.signal = AbortSignal.timeout($);
+    let d;
     try {
-      c = await t.fetch(r, w);
-    } catch (i) {
-      let k = i instanceof DOMException && i.name === "TimeoutError" ? "Network error: timeout after 30s" : `Network error: ${i instanceof Error ? i.message : "fetch failed"}`;
-      if (g = new o("network_error", k), f < a) {
-        let S = x(f);
+      d = await t.fetch(r, _);
+    } catch (s) {
+      let m = s instanceof DOMException && s.name === "TimeoutError" ? "Network error: timeout after 30s" : `Network error: ${s instanceof Error ? s.message : "fetch failed"}`;
+      if (g = new i("network_error", m, void 0, void 0, void 0, u), f < a) {
+        let S = O(f);
         if (p == null || Date.now() + S < p) {
-          await U(S);
+          await K(S);
           continue;
         }
       }
       throw g;
     }
-    let O = c.headers.get("x-request-id") ?? c.headers.get("x-correlation-id") ?? void 0;
-    if (c.ok) {
-      let i = c.headers.get("x-neetru-version");
-      return i && K(i), await q(c);
+    let j = d.headers.get("x-request-id") ?? d.headers.get("x-correlation-id") ?? void 0;
+    if (d.ok) {
+      let s = d.headers.get("x-neetru-version");
+      return s && V(s), await P(d);
     }
-    let l = await q(c), m = L(c.status), h = `HTTP ${c.status}`, T;
+    let l = await P(d), k = Q(d.status), h = `HTTP ${d.status}`, w;
     if (l && typeof l == "object") {
-      let i = l.error;
-      typeof i == "string" ? h = i : i && typeof i == "object" ? (typeof i.code == "string" && (m = i.code), typeof i.message == "string" && (h = i.message), typeof i.reason == "string" && (T = i.reason)) : (typeof l.code == "string" && (m = l.code), typeof l.message == "string" && (h = l.message)), typeof l.reason == "string" && (T = l.reason);
+      let s = l.error;
+      typeof s == "string" ? h = s : s && typeof s == "object" ? (typeof s.code == "string" && (k = s.code), typeof s.message == "string" && (h = s.message), typeof s.reason == "string" && (w = s.reason)) : (typeof l.code == "string" && (k = l.code), typeof l.message == "string" && (h = l.message)), typeof l.reason == "string" && (w = l.reason);
     }
-    if (c.status === 410) {
-      let i = c.headers.get("x-neetru-replacement");
-      h === `HTTP ${c.status}` && (h = `Endpoint ${e.path} foi removido do Core (HTTP 410 Gone) \u2014 atualize o @neetru/sdk e migre para a API substituta.`), i && !h.includes(i) && (h += ` Substituto: ${i}.`);
+    if (d.status === 410) {
+      let s = d.headers.get("x-neetru-replacement");
+      h === `HTTP ${d.status}` && (h = `Endpoint ${e.path} foi removido do Core (HTTP 410 Gone) \u2014 atualize o @neetru/sdk e migre para a API substituta.`), s && !h.includes(s) && (h += ` Substituto: ${s}.`);
     }
-    let R = new o(m, h, c.status, O, T);
-    if (g = R, F.has(m) && f < a) {
-      let k = B(c.headers.get("retry-after")) ?? x(f);
-      if (p == null || Date.now() + k < p) {
-        await U(k);
+    let v = new i(k, h, d.status, j, w, u);
+    if (g = v, W.has(k) && f < a) {
+      let m = Z(d.headers.get("retry-after")) ?? O(f);
+      if (p == null || Date.now() + m < p) {
+        await K(m);
         continue;
       }
     }
-    throw R;
+    throw v;
   }
-  throw g ?? new o("unknown", "unexpected httpRequest exit");
+  throw g ?? new i("unknown", "unexpected httpRequest exit", void 0, void 0, void 0, u);
 }
 
 // src/checkout.ts
-function _(t, e) {
+function T(t, e) {
   let n = t?.accessToken || t?.idToken;
   if (!n || typeof n != "string")
-    throw new o(
+    throw new i(
       "validation_failed",
       `checkout.${e} requer o access_token OU o id_token OIDC do usu\xE1rio final (passe \`accessToken\` ou \`idToken\`). A chave de API do SDK (nrt_*) N\xC3O \xE9 aceita pelo endpoint de checkout \u2014 ele autentica a identidade do cliente que est\xE1 assinando (Bearer access_token/id_token OIDC ou cookie de sess\xE3o). No padr\xE3o BFF/cookie, passe o \`idToken\` que seu servidor guardou no cookie httpOnly.`
     );
   return { requireAuth: false, headers: { authorization: `Bearer ${n}` } };
 }
-function V(t) {
+function te(t) {
   if (!t || typeof t != "object")
-    throw new o("invalid_response", "checkout.start response is not an object");
+    throw new i("invalid_response", "checkout.start response is not an object");
   let e = t;
   if (typeof e.intentId != "string" || !e.intentId)
-    throw new o("invalid_response", "checkout.start response missing intentId");
+    throw new i("invalid_response", "checkout.start response missing intentId");
   if (typeof e.redirectUrl != "string" || !e.redirectUrl)
-    throw new o("invalid_response", "checkout.start response missing redirectUrl");
+    throw new i("invalid_response", "checkout.start response missing redirectUrl");
   return {
     intentId: e.intentId,
     redirectUrl: e.redirectUrl,
@@ -208,14 +275,14 @@ function V(t) {
     requiresKyc: e.requiresKyc === true
   };
 }
-function J(t) {
+function ne(t) {
   if (!t || typeof t != "object")
-    throw new o("invalid_response", "checkout.get response is not an object");
+    throw new i("invalid_response", "checkout.get response is not an object");
   let e = t, n = e.intent;
   if (!n || typeof n != "object")
-    throw new o("invalid_response", "checkout.get response missing intent");
+    throw new i("invalid_response", "checkout.get response missing intent");
   if (typeof n.intentId != "string")
-    throw new o("invalid_response", "checkout.get response missing intentId");
+    throw new i("invalid_response", "checkout.get response missing intentId");
   return {
     intentId: n.intentId,
     uid: n.uid ?? "",
@@ -230,35 +297,35 @@ function J(t) {
     isStale: e.isStale === true
   };
 }
-function Y() {
+function re() {
   try {
     return typeof globalThis < "u" && typeof globalThis.window < "u" && typeof globalThis.location < "u" && typeof globalThis.location.assign == "function";
   } catch {
     return false;
   }
 }
-function W(t) {
+function oe(t) {
   try {
     globalThis.location.assign(t);
   } catch {
   }
 }
-function X(t) {
+function ie(t) {
   return {
     async start(e) {
       if (!e?.productId)
-        throw new o("validation_failed", "checkout.start: productId is required");
+        throw new i("validation_failed", "checkout.start: productId is required");
       if (!e?.planId)
-        throw new o("validation_failed", "checkout.start: planId is required");
+        throw new i("validation_failed", "checkout.start: planId is required");
       if (!e?.callbackUrl)
-        throw new o("validation_failed", "checkout.start: callbackUrl is required");
+        throw new i("validation_failed", "checkout.start: callbackUrl is required");
       let n = {
         productId: e.productId,
         planId: e.planId,
         callbackUrl: e.callbackUrl
       };
       e.tenantType && (n.targetTenantType = e.tenantType), e.tenantId && (n.targetTenantId = e.tenantId);
-      let { requireAuth: r, headers: s } = _(
+      let { requireAuth: r, headers: o } = T(
         { accessToken: e.accessToken, idToken: e.idToken },
         "start"
       ), a = await y(t, {
@@ -266,29 +333,29 @@ function X(t) {
         path: "/api/v1/checkout/intents",
         body: n,
         requireAuth: r,
-        headers: s,
+        headers: o,
         idempotencyKey: true
-      }), d = V(a);
-      return e.autoRedirect !== false && Y() && W(d.redirectUrl), d;
+      }), c = te(a);
+      return e.autoRedirect !== false && re() && oe(c.redirectUrl), c;
     },
     async get(e, n) {
       if (!e || typeof e != "string")
-        throw new o("validation_failed", "checkout.get: intentId is required");
-      let { requireAuth: r, headers: s } = _(
+        throw new i("validation_failed", "checkout.get: intentId is required");
+      let { requireAuth: r, headers: o } = T(
         { accessToken: n?.accessToken, idToken: n?.idToken },
         "get"
       ), a = await y(t, {
         method: "GET",
         path: `/api/v1/checkout/intents/${encodeURIComponent(e)}`,
         requireAuth: r,
-        headers: s
+        headers: o
       });
-      return J(a);
+      return ne(a);
     },
     async cancel(e, n) {
       if (!e || typeof e != "string")
-        throw new o("validation_failed", "checkout.cancel: intentId is required");
-      let { requireAuth: r, headers: s } = _(
+        throw new i("validation_failed", "checkout.cancel: intentId is required");
+      let { requireAuth: r, headers: o } = T(
         { accessToken: n?.accessToken, idToken: n?.idToken },
         "cancel"
       );
@@ -298,22 +365,22 @@ function X(t) {
           method: "DELETE",
           path: `/api/v1/checkout/intents/${encodeURIComponent(e)}`,
           requireAuth: r,
-          headers: s
+          headers: o
         }))?.alreadyCancelled === true
       };
     }
   };
 }
-var C = class {
+var R = class {
   intents = /* @__PURE__ */ new Map();
   async start(e) {
     if (!e?.productId)
-      throw new o("validation_failed", "checkout.start: productId is required");
+      throw new i("validation_failed", "checkout.start: productId is required");
     if (!e?.planId)
-      throw new o("validation_failed", "checkout.start: planId is required");
+      throw new i("validation_failed", "checkout.start: planId is required");
     if (!e?.callbackUrl)
-      throw new o("validation_failed", "checkout.start: callbackUrl is required");
-    let n = `chk_mock_${Math.random().toString(36).slice(2, 10)}`, r = new Date(Date.now() + 900 * 1e3).toISOString(), s = `https://localhost:9003/portal/checkout/${n}`;
+      throw new i("validation_failed", "checkout.start: callbackUrl is required");
+    let n = `chk_mock_${Math.random().toString(36).slice(2, 10)}`, r = new Date(Date.now() + 900 * 1e3).toISOString(), o = `https://localhost:9003/portal/checkout/${n}`;
     return this.intents.set(n, {
       intentId: n,
       uid: "dev-fixture-uid",
@@ -327,7 +394,7 @@ var C = class {
       expiresAt: r
     }), {
       intentId: n,
-      redirectUrl: s,
+      redirectUrl: o,
       status: "pending",
       expiresAt: r,
       requiresKyc: false
@@ -336,20 +403,20 @@ var C = class {
   async get(e, n) {
     let r = this.intents.get(e);
     if (!r)
-      throw new o("not_found", `Mock intent ${e} not found`);
+      throw new i("not_found", `Mock intent ${e} not found`);
     return { ...r };
   }
   async cancel(e, n) {
     let r = this.intents.get(e);
     if (!r)
-      throw new o("not_found", `Mock intent ${e} not found`);
-    let s = r.status === "cancelled";
-    return this.intents.set(e, { ...r, status: "cancelled" }), { ok: true, alreadyCancelled: s };
+      throw new i("not_found", `Mock intent ${e} not found`);
+    let o = r.status === "cancelled";
+    return this.intents.set(e, { ...r, status: "cancelled" }), { ok: true, alreadyCancelled: o };
   }
 };
-function ae(t) {
-  return t.env === "dev" ? new C() : X(t);
+function Ie(t) {
+  return t.env === "dev" ? new R() : ie(t);
 }
 
-exports.MockCheckout = C;
-exports.createCheckoutNamespace = ae;
+exports.MockCheckout = R;
+exports.createCheckoutNamespace = Ie;

package/dist/checkout.d.cts

@@ -1,3 +1,3 @@
-export { o as CheckoutAuthOpts, p as CheckoutIntentInfo, q as CheckoutIntentStatus, r as CheckoutNamespace, s as CheckoutStartInput, t as CheckoutStartResult, u as CheckoutTenantType, S as MockCheckout, aK as createCheckoutNamespace } from './types-Bx4kTLmk.cjs';
+export { o as CheckoutAuthOpts, p as CheckoutIntentInfo, q as CheckoutIntentStatus, r as CheckoutNamespace, s as CheckoutStartInput, t as CheckoutStartResult, u as CheckoutTenantType, T as MockCheckout, aL as createCheckoutNamespace } from './types-D-9bjlM0.cjs';
 import 'drizzle-orm/node-postgres';
 import './errors.cjs';

package/dist/checkout.d.ts

@@ -1,3 +1,3 @@
-export { o as CheckoutAuthOpts, p as CheckoutIntentInfo, q as CheckoutIntentStatus, r as CheckoutNamespace, s as CheckoutStartInput, t as CheckoutStartResult, u as CheckoutTenantType, S as MockCheckout, aK as createCheckoutNamespace } from './types-Dx0IrOSF.js';
+export { o as CheckoutAuthOpts, p as CheckoutIntentInfo, q as CheckoutIntentStatus, r as CheckoutNamespace, s as CheckoutStartInput, t as CheckoutStartResult, u as CheckoutTenantType, T as MockCheckout, aL as createCheckoutNamespace } from './types-bVztFQTI.js';
 import 'drizzle-orm/node-postgres';
 import './errors.js';