@neetru/sdk 3.7.0 → 3.8.1

package/dist/{types-Dx0IrOSF.d.ts → types-BYPk_3HR.d.ts}

@@ -113,6 +113,28 @@ declare class MockCheckout implements CheckoutNamespace {
 }
 declare function createCheckoutNamespace(config: ResolvedConfig): CheckoutNamespace;
 
+/**
+ * 3.8.0 — Provedor de token do USUÁRIO FINAL, síncrono OU assíncrono.
+ *
+ * O namespace `auth` web lê o id_token de `localStorage` (síncrono). Em React
+ * Native o storage é assíncrono (`@neetru/sdk/mobile` → `getIdToken():
+ * Promise`). Antes desta versão `support` e a barra de conta só aceitavam o
+ * contrato síncrono — o módulo mobile ficava solto do `createNeetruClient`.
+ *
+ * Agora `createNeetruClient({ endUserAuth })` aceita qualquer objeto com
+ * `getIdToken()` (sync ou Promise) e, opcionalmente, `refreshTokens()` — o
+ * `MobileAuthNamespace` encaixa direto. O provedor fica registrado por client
+ * (WeakMap, sem mudar o shape público do `NeetruClient`) para a barra de conta
+ * (`fetchNeetruAccountBar`) achá-lo.
+ */
+
+interface EndUserTokenProvider {
+    /** id_token OIDC do usuário logado, ou `null`. Pode ser síncrono ou Promise. */
+    getIdToken(): string | null | undefined | Promise<string | null | undefined>;
+    /** Renova a sessão (refresh_token → id_token novo). `true` se renovou. */
+    refreshTokens?(): Promise<boolean>;
+}
+
 /** Bloco de texto de uma mensagem multimodal (OpenAI-compat). */
 interface AiTextPart {
     type: 'text';
@@ -1390,9 +1412,42 @@ interface RealtimeClientOptions {
  * Alinhado com `DbSqlLease` do Core (`src/lib/db/lease/types.ts`).
  *
  * - `port` sempre 5433 — o lease aponta pro PgBouncer, nunca à porta crua.
- * - `credentialVersion` — bump indica rotação; o `SqlLeaseManager` reabre
- *   o pool ao detectar versão diferente.
+ * - `credentialVersion` — hoje é um placeholder fixo do Core (ver o campo).
  * - `expiresAt` — ISO string; o SDK renova aos ~80% do TTL (12 min em TTL=15 min).
+ *
+ * ── TLS / mTLS (estado real) ───────────────────────────────────────────────
+ *
+ * **O mTLS de cliente ESTÁ ativo.** O Core emite os três materiais em TODO
+ * lease SQL (emissão e renovação — `buildLease`, ramo `sql`, em
+ * `src/lib/db/lease/issuer-core.ts` do Core):
+ *   - `sslca` — a CA interna do Core (secret `coredb_ca_cert`). A MESMA CA
+ *     assina o cert do servidor PgBouncer (365 dias) e os certs de cliente.
+ *   - `clientCert` — X.509 de cliente emitido por lease: CN = `leaseId`, EKU
+ *     `clientAuth`, validade = TTL do lease (15 min).
+ *   - `clientKey` — chave EC P-256 efêmera, nova a cada emissão/renovação.
+ * Não há flag que desligue isso: sem a CA no Secret Manager a emissão FALHA
+ * (HTTP 500), em vez de devolver esses campos `null`.
+ *
+ * O SDK usa os três ao abrir o `pg.Pool` (`createPgPool` e o `createPool` de
+ * `createSqlClientFromConfig`): com `sslca` presente, `ssl = { ca: sslca,
+ * cert: clientCert, key: clientKey, rejectUnauthorized: true }` — verifica o
+ * servidor (CA + hostname) E apresenta o cert de cliente.
+ *
+ * Do lado da VM, o PgBouncer roda com `client_tls_sslmode = verify-full` e
+ * `client_tls_ca_file` = CA do Core (agente, `src/handlers/db-pgbouncer.ts`):
+ * EXIGE cert de cliente válido. E `auth_type = scram-sha-256` — a conexão
+ * precisa do cert E da senha do lease (o CN não é comparado ao usuário).
+ *
+ * Consequências práticas:
+ *   - o cert de cliente expira junto com o lease (~15 min). Pool que não troca
+ *     de lease passa a levar `certificate expired` (alerta TLS 45 enviado pelo
+ *     PgBouncer) — é o que a renovação proativa (`lease.ts`) e o re-lease
+ *     reativo (`resilient-pool.ts`) curam;
+ *   - se o install da VM não obteve a CA/assinatura, o Core configura o
+ *     PgBouncer SEM TLS (fail-open, com aviso no log). Como o SDK sempre liga
+ *     TLS quando o lease traz `sslca`, a conexão falha com "The server does
+ *     not support SSL connections" — o conserto é reconfigurar o PgBouncer com
+ *     TLS, não desligar TLS no SDK.
  */
 interface DbSqlLease {
     leaseId: string;
@@ -1403,31 +1458,38 @@ interface DbSqlLease {
     /** Plaintext — trafega só sobre HTTPS, NUNCA logado/persistido. */
     password: string;
     /**
-     * CA do servidor PgBouncer, para **TLS de servidor** (verify-full). Quando
-     * presente, o pool valida o certificado do servidor contra esta CA
-     * (`rejectUnauthorized: true`). `null` quando o lease não traz TLS.
+     * CA interna do Core (PEM) — a mesma que assina o cert do servidor PgBouncer
+     * e o `clientCert`. O pool valida o servidor contra ela
+     * (`rejectUnauthorized: true`). O Core sempre manda em lease SQL; `null` só
+     * se o campo vier ausente, e aí o SDK conecta SEM TLS (`ssl: false`), mesmo
+     * que `clientCert` exista.
      */
     sslca: string | null;
     /**
-     * Certificado de **cliente** para mTLS (o SDK apresentar identidade ao
-     * servidor). **mTLS-cliente NÃO está implementado no Core (TODO P0-3):** hoje
-     * este campo é SEMPRE `null`, portanto **não há mTLS ativo** — a conexão usa,
-     * no máximo, TLS de servidor (verify-full via `sslca`). O SDK já envia este
-     * cert ao pool quando/se o lease passar a trazê-lo.
+     * Certificado X.509 de **cliente** (PEM) para mTLS, emitido por lease
+     * (CN = `leaseId`, EKU `clientAuth`, expira com o lease — 15 min). O SDK o
+     * apresenta ao PgBouncer em `ssl.cert`; o PgBouncer o exige
+     * (`client_tls_sslmode = verify-full`). O Core sempre manda em lease SQL —
+     * o `| null` é só tolerância a resposta sem o campo (o pool fica com TLS
+     * só de servidor).
      */
     clientCert: string | null;
     /**
-     * Chave privada de **cliente** para mTLS — par de `clientCert`. Mesma
-     * condição: `null` até o Core emitir material de cliente (mTLS-cliente
-     * pendente, P0-3).
+     * Chave privada de **cliente** (PEM, EC P-256 efêmera, nova a cada
+     * emissão/renovação) — par de `clientCert`, vai em `ssl.key`. Trafega só
+     * sobre HTTPS, NUNCA logada/persistida. Mesma regra de `null` do
+     * `clientCert`.
      */
     clientKey: string | null;
     /**
-     * Versão da credencial no Secret Manager. Bump = rotação de senha.
-     * O manager fecha o pool antigo e abre um novo quando esta versão muda.
+     * Versão da credencial. HOJE o Core manda sempre o placeholder `1` (TODO de
+     * versionamento no `issuer-core.ts` do Core), então ela NÃO sinaliza
+     * rotação. A troca de pool numa rotação é disparada pela mudança de
+     * `password` (ou de qualquer campo de conexão) — ver `hasConnectionChanged`
+     * em `lease.ts`.
      */
     credentialVersion: number;
-    /** Expiração ISO — SDK renova ~2 min antes. */
+    /** Expiração ISO — o SDK renova aos ~80% do TTL (~3 min antes, em 15 min). */
     expiresAt: string;
 }
 /**
@@ -1975,6 +2037,10 @@ interface NeetruClientConfig {
      *
      * Endpoints públicos (catalog) funcionam sem apiKey. Endpoints autenticados
      * (entitlements, telemetry) lançam `missing_api_key` se ausente.
+     *
+     * **3.8.0: SÓ DE SERVIDOR.** Nunca coloque a chave no navegador ou no app
+     * (`NEXT_PUBLIC_*`/`EXPO_PUBLIC_*`): o site/app chama a API do próprio produto
+     * e o backend usa o SDK com a chave. Ver `strictServerOnlyKey`.
      */
     apiKey?: string;
     /**
@@ -2053,6 +2119,27 @@ interface NeetruClientConfig {
      * Bypass total: `NEETRU_ALLOW_INSECURE_BASEURL=1` no env.
      */
     allowedHosts?: string[];
+    /**
+     * 3.8.0 — a credencial `nrt_` é SÓ DE SERVIDOR. Quando o SDK recebe chave
+     * (via `apiKey` ou `NEETRU_API_KEY`) rodando em navegador ou React Native:
+     *   - `false`/omitido (padrão nesta minor): aviso único no console (PT-BR,
+     *     sem imprimir a chave) e segue funcionando — pra não quebrar produtos
+     *     que ainda estão migrando;
+     *   - `true`: falha FECHADO com `NeetruError('server_only_key')`.
+     *
+     * **Na próxima MAJOR (4.0) a falha fechada vira o padrão.** No servidor
+     * (Node/Edge) a opção não tem efeito.
+     */
+    strictServerOnlyKey?: boolean;
+    /**
+     * 3.8.0 — provedor do token do USUÁRIO FINAL usado pelo `support`
+     * (`X-Neetru-End-User-Token`) e pela barra de conta. Aceita `getIdToken()`
+     * síncrono ou assíncrono (+ `refreshTokens()` opcional). Encaixa direto o
+     * `createMobileAuthNamespace(...)` de `@neetru/sdk/mobile`; no backend do
+     * produto, pode ser `{ getIdToken: () => idTokenQueOAppMandou }`.
+     * Default: `client.auth`.
+     */
+    endUserAuth?: EndUserTokenProvider;
 }
 /**
  * Status do produto no catálogo público.
@@ -2721,4 +2808,4 @@ interface CatalogListOptions {
     includeDrafts?: boolean;
 }
 
-export { NeetruDbError as $, type AiChatChoice as A, type DbChangeType as B, type CatalogListOptions as C, DEFAULT_BASE_URL as D, type DbCollectionRef$1 as E, type DbDoc as F, type DbDocRef as G, type DbGetResult as H, type DbListResult as I, type DbNamespace as J, type DbQuery$1 as K, type DbSqlLease as L, type DbWhereFilter as M, type DbWhereFilter$1 as N, type EntitlementCheck as O, type FieldSentinel as P, type IncrementSentinel as Q, type ListNotificationsOptions as R, MockCheckout as S, MockNotifications as T, MockWebhooks as U, NEETRU_SENTINEL_KEY as V, type NeetruClient as W, type NeetruClientConfig as X, type NeetruDb as Y, type NeetruDbDocuments as Z, type NeetruDbEngine as _, type AiChatMessage as a, type NeetruDbErrorCode as a0, type NeetruDbOptions as a1, type NeetruDbTransport as a2, type NeetruEnv as a3, type NeetruSqlClient as a4, type NeetruUser as a5, type NotificationScopeOptions as a6, type NotificationsNamespace as a7, type Product as a8, type ProductNotification as a9, type VerifyWebhookRequestOptions as aA, type VerifyWebhookRequestResult as aB, type WebhookEndpoint as aC, type WebhookEvent as aD, type WebhookScopeOptions as aE, type WebhookTestResult as aF, type WebhooksNamespace as aG, type WithFieldSentinels as aH, __resetDbIdWarningForTests as aI, createAiNamespace as aJ, createCheckoutNamespace as aK, createNeetruDb as aL, createNotificationsNamespace as aM, createRestSyncTransport as aN, createWebhooksNamespace as aO, getWebSocketRealtimeClient as aP, increment as aQ, isFieldSentinel as aR, isIncrementSentinel as aS, isServerTimestampSentinel as aT, serverTimestamp as aU, verifyWebhookRequest as aV, verifyWebhookSignature as aW, type ProductNotificationSeverity as aa, type ProductPlan as ab, type ProductStatus as ac, type RealtimeTransport as ad, type RedirectCallbackResult as ae, type RegisterWebhookInput as af, type ResolvedConfig as ag, type SendNotificationInput as ah, type ServerTimestampSentinel as ai, type SignInOptions as aj, type SqlOptions as ak, type SupportNamespace as al, type SupportSeverity as am, type SupportStatus as an, type SupportTicket as ao, type SyncErrorEvent as ap, type SyncState as aq, type TelemetryEventAck as ar, type TelemetryEventInput as as, type TelemetryLogAck as at, type TelemetryLogInput as au, type Unsubscribe as av, type UsageEventInput as aw, type UsageNamespace as ax, type UsageQuota as ay, type VerifyTokenOptions as az, type AiChatOptions as b, type AiChatResult as c, type AiChatUsage as d, type AiContentPart as e, type AiImageUrlPart as f, type AiNamespace as g, type AiResponseFormat as h, type AiStreamHandle as i, type AiStreamMeta as j, type AiTextPart as k, type AuthNamespace as l, type AuthStateListener as m, type CatalogListResponse as n, type CheckoutAuthOpts as o, type CheckoutIntentInfo as p, type CheckoutIntentStatus as q, type CheckoutNamespace as r, type CheckoutStartInput as s, type CheckoutStartResult as t, type CheckoutTenantType as u, type CompleteSignInResult as v, type ConflictRecord as w, type CreateOfflineDocumentsOptions as x, type CreateTicketInput as y, type DbBatchOp as z };
+export { type NeetruDbEngine as $, type AiChatChoice as A, type DbChangeType as B, type CatalogListOptions as C, DEFAULT_BASE_URL as D, type DbCollectionRef$1 as E, type DbDoc as F, type DbDocRef as G, type DbGetResult as H, type DbListResult as I, type DbNamespace as J, type DbQuery$1 as K, type DbSqlLease as L, type DbWhereFilter as M, type DbWhereFilter$1 as N, type EndUserTokenProvider as O, type EntitlementCheck as P, type FieldSentinel as Q, type IncrementSentinel as R, type ListNotificationsOptions as S, MockCheckout as T, MockNotifications as U, MockWebhooks as V, NEETRU_SENTINEL_KEY as W, type NeetruClient as X, type NeetruClientConfig as Y, type NeetruDb as Z, type NeetruDbDocuments as _, type AiChatMessage as a, NeetruDbError as a0, type NeetruDbErrorCode as a1, type NeetruDbOptions as a2, type NeetruDbTransport as a3, type NeetruEnv as a4, type NeetruSqlClient as a5, type NeetruUser as a6, type NotificationScopeOptions as a7, type NotificationsNamespace as a8, type Product as a9, type VerifyTokenOptions as aA, type VerifyWebhookRequestOptions as aB, type VerifyWebhookRequestResult as aC, type WebhookEndpoint as aD, type WebhookEvent as aE, type WebhookScopeOptions as aF, type WebhookTestResult as aG, type WebhooksNamespace as aH, type WithFieldSentinels as aI, __resetDbIdWarningForTests as aJ, createAiNamespace as aK, createCheckoutNamespace as aL, createNeetruDb as aM, createNotificationsNamespace as aN, createRestSyncTransport as aO, createWebhooksNamespace as aP, getWebSocketRealtimeClient as aQ, increment as aR, isFieldSentinel as aS, isIncrementSentinel as aT, isServerTimestampSentinel as aU, serverTimestamp as aV, verifyWebhookRequest as aW, verifyWebhookSignature as aX, type ProductNotification as aa, type ProductNotificationSeverity as ab, type ProductPlan as ac, type ProductStatus as ad, type RealtimeTransport as ae, type RedirectCallbackResult as af, type RegisterWebhookInput as ag, type ResolvedConfig as ah, type SendNotificationInput as ai, type ServerTimestampSentinel as aj, type SignInOptions as ak, type SqlOptions as al, type SupportNamespace as am, type SupportSeverity as an, type SupportStatus as ao, type SupportTicket as ap, type SyncErrorEvent as aq, type SyncState as ar, type TelemetryEventAck as as, type TelemetryEventInput as at, type TelemetryLogAck as au, type TelemetryLogInput as av, type Unsubscribe as aw, type UsageEventInput as ax, type UsageNamespace as ay, type UsageQuota as az, type AiChatOptions as b, type AiChatResult as c, type AiChatUsage as d, type AiContentPart as e, type AiImageUrlPart as f, type AiNamespace as g, type AiResponseFormat as h, type AiStreamHandle as i, type AiStreamMeta as j, type AiTextPart as k, type AuthNamespace as l, type AuthStateListener as m, type CatalogListResponse as n, type CheckoutAuthOpts as o, type CheckoutIntentInfo as p, type CheckoutIntentStatus as q, type CheckoutNamespace as r, type CheckoutStartInput as s, type CheckoutStartResult as t, type CheckoutTenantType as u, type CompleteSignInResult as v, type ConflictRecord as w, type CreateOfflineDocumentsOptions as x, type CreateTicketInput as y, type DbBatchOp as z };

package/dist/{types-Bx4kTLmk.d.cts → types-yv3EDKg2.d.cts}

@@ -113,6 +113,28 @@ declare class MockCheckout implements CheckoutNamespace {
 }
 declare function createCheckoutNamespace(config: ResolvedConfig): CheckoutNamespace;
 
+/**
+ * 3.8.0 — Provedor de token do USUÁRIO FINAL, síncrono OU assíncrono.
+ *
+ * O namespace `auth` web lê o id_token de `localStorage` (síncrono). Em React
+ * Native o storage é assíncrono (`@neetru/sdk/mobile` → `getIdToken():
+ * Promise`). Antes desta versão `support` e a barra de conta só aceitavam o
+ * contrato síncrono — o módulo mobile ficava solto do `createNeetruClient`.
+ *
+ * Agora `createNeetruClient({ endUserAuth })` aceita qualquer objeto com
+ * `getIdToken()` (sync ou Promise) e, opcionalmente, `refreshTokens()` — o
+ * `MobileAuthNamespace` encaixa direto. O provedor fica registrado por client
+ * (WeakMap, sem mudar o shape público do `NeetruClient`) para a barra de conta
+ * (`fetchNeetruAccountBar`) achá-lo.
+ */
+
+interface EndUserTokenProvider {
+    /** id_token OIDC do usuário logado, ou `null`. Pode ser síncrono ou Promise. */
+    getIdToken(): string | null | undefined | Promise<string | null | undefined>;
+    /** Renova a sessão (refresh_token → id_token novo). `true` se renovou. */
+    refreshTokens?(): Promise<boolean>;
+}
+
 /** Bloco de texto de uma mensagem multimodal (OpenAI-compat). */
 interface AiTextPart {
     type: 'text';
@@ -1390,9 +1412,42 @@ interface RealtimeClientOptions {
  * Alinhado com `DbSqlLease` do Core (`src/lib/db/lease/types.ts`).
  *
  * - `port` sempre 5433 — o lease aponta pro PgBouncer, nunca à porta crua.
- * - `credentialVersion` — bump indica rotação; o `SqlLeaseManager` reabre
- *   o pool ao detectar versão diferente.
+ * - `credentialVersion` — hoje é um placeholder fixo do Core (ver o campo).
  * - `expiresAt` — ISO string; o SDK renova aos ~80% do TTL (12 min em TTL=15 min).
+ *
+ * ── TLS / mTLS (estado real) ───────────────────────────────────────────────
+ *
+ * **O mTLS de cliente ESTÁ ativo.** O Core emite os três materiais em TODO
+ * lease SQL (emissão e renovação — `buildLease`, ramo `sql`, em
+ * `src/lib/db/lease/issuer-core.ts` do Core):
+ *   - `sslca` — a CA interna do Core (secret `coredb_ca_cert`). A MESMA CA
+ *     assina o cert do servidor PgBouncer (365 dias) e os certs de cliente.
+ *   - `clientCert` — X.509 de cliente emitido por lease: CN = `leaseId`, EKU
+ *     `clientAuth`, validade = TTL do lease (15 min).
+ *   - `clientKey` — chave EC P-256 efêmera, nova a cada emissão/renovação.
+ * Não há flag que desligue isso: sem a CA no Secret Manager a emissão FALHA
+ * (HTTP 500), em vez de devolver esses campos `null`.
+ *
+ * O SDK usa os três ao abrir o `pg.Pool` (`createPgPool` e o `createPool` de
+ * `createSqlClientFromConfig`): com `sslca` presente, `ssl = { ca: sslca,
+ * cert: clientCert, key: clientKey, rejectUnauthorized: true }` — verifica o
+ * servidor (CA + hostname) E apresenta o cert de cliente.
+ *
+ * Do lado da VM, o PgBouncer roda com `client_tls_sslmode = verify-full` e
+ * `client_tls_ca_file` = CA do Core (agente, `src/handlers/db-pgbouncer.ts`):
+ * EXIGE cert de cliente válido. E `auth_type = scram-sha-256` — a conexão
+ * precisa do cert E da senha do lease (o CN não é comparado ao usuário).
+ *
+ * Consequências práticas:
+ *   - o cert de cliente expira junto com o lease (~15 min). Pool que não troca
+ *     de lease passa a levar `certificate expired` (alerta TLS 45 enviado pelo
+ *     PgBouncer) — é o que a renovação proativa (`lease.ts`) e o re-lease
+ *     reativo (`resilient-pool.ts`) curam;
+ *   - se o install da VM não obteve a CA/assinatura, o Core configura o
+ *     PgBouncer SEM TLS (fail-open, com aviso no log). Como o SDK sempre liga
+ *     TLS quando o lease traz `sslca`, a conexão falha com "The server does
+ *     not support SSL connections" — o conserto é reconfigurar o PgBouncer com
+ *     TLS, não desligar TLS no SDK.
  */
 interface DbSqlLease {
     leaseId: string;
@@ -1403,31 +1458,38 @@ interface DbSqlLease {
     /** Plaintext — trafega só sobre HTTPS, NUNCA logado/persistido. */
     password: string;
     /**
-     * CA do servidor PgBouncer, para **TLS de servidor** (verify-full). Quando
-     * presente, o pool valida o certificado do servidor contra esta CA
-     * (`rejectUnauthorized: true`). `null` quando o lease não traz TLS.
+     * CA interna do Core (PEM) — a mesma que assina o cert do servidor PgBouncer
+     * e o `clientCert`. O pool valida o servidor contra ela
+     * (`rejectUnauthorized: true`). O Core sempre manda em lease SQL; `null` só
+     * se o campo vier ausente, e aí o SDK conecta SEM TLS (`ssl: false`), mesmo
+     * que `clientCert` exista.
      */
     sslca: string | null;
     /**
-     * Certificado de **cliente** para mTLS (o SDK apresentar identidade ao
-     * servidor). **mTLS-cliente NÃO está implementado no Core (TODO P0-3):** hoje
-     * este campo é SEMPRE `null`, portanto **não há mTLS ativo** — a conexão usa,
-     * no máximo, TLS de servidor (verify-full via `sslca`). O SDK já envia este
-     * cert ao pool quando/se o lease passar a trazê-lo.
+     * Certificado X.509 de **cliente** (PEM) para mTLS, emitido por lease
+     * (CN = `leaseId`, EKU `clientAuth`, expira com o lease — 15 min). O SDK o
+     * apresenta ao PgBouncer em `ssl.cert`; o PgBouncer o exige
+     * (`client_tls_sslmode = verify-full`). O Core sempre manda em lease SQL —
+     * o `| null` é só tolerância a resposta sem o campo (o pool fica com TLS
+     * só de servidor).
      */
     clientCert: string | null;
     /**
-     * Chave privada de **cliente** para mTLS — par de `clientCert`. Mesma
-     * condição: `null` até o Core emitir material de cliente (mTLS-cliente
-     * pendente, P0-3).
+     * Chave privada de **cliente** (PEM, EC P-256 efêmera, nova a cada
+     * emissão/renovação) — par de `clientCert`, vai em `ssl.key`. Trafega só
+     * sobre HTTPS, NUNCA logada/persistida. Mesma regra de `null` do
+     * `clientCert`.
      */
     clientKey: string | null;
     /**
-     * Versão da credencial no Secret Manager. Bump = rotação de senha.
-     * O manager fecha o pool antigo e abre um novo quando esta versão muda.
+     * Versão da credencial. HOJE o Core manda sempre o placeholder `1` (TODO de
+     * versionamento no `issuer-core.ts` do Core), então ela NÃO sinaliza
+     * rotação. A troca de pool numa rotação é disparada pela mudança de
+     * `password` (ou de qualquer campo de conexão) — ver `hasConnectionChanged`
+     * em `lease.ts`.
      */
     credentialVersion: number;
-    /** Expiração ISO — SDK renova ~2 min antes. */
+    /** Expiração ISO — o SDK renova aos ~80% do TTL (~3 min antes, em 15 min). */
     expiresAt: string;
 }
 /**
@@ -1975,6 +2037,10 @@ interface NeetruClientConfig {
      *
      * Endpoints públicos (catalog) funcionam sem apiKey. Endpoints autenticados
      * (entitlements, telemetry) lançam `missing_api_key` se ausente.
+     *
+     * **3.8.0: SÓ DE SERVIDOR.** Nunca coloque a chave no navegador ou no app
+     * (`NEXT_PUBLIC_*`/`EXPO_PUBLIC_*`): o site/app chama a API do próprio produto
+     * e o backend usa o SDK com a chave. Ver `strictServerOnlyKey`.
      */
     apiKey?: string;
     /**
@@ -2053,6 +2119,27 @@ interface NeetruClientConfig {
      * Bypass total: `NEETRU_ALLOW_INSECURE_BASEURL=1` no env.
      */
     allowedHosts?: string[];
+    /**
+     * 3.8.0 — a credencial `nrt_` é SÓ DE SERVIDOR. Quando o SDK recebe chave
+     * (via `apiKey` ou `NEETRU_API_KEY`) rodando em navegador ou React Native:
+     *   - `false`/omitido (padrão nesta minor): aviso único no console (PT-BR,
+     *     sem imprimir a chave) e segue funcionando — pra não quebrar produtos
+     *     que ainda estão migrando;
+     *   - `true`: falha FECHADO com `NeetruError('server_only_key')`.
+     *
+     * **Na próxima MAJOR (4.0) a falha fechada vira o padrão.** No servidor
+     * (Node/Edge) a opção não tem efeito.
+     */
+    strictServerOnlyKey?: boolean;
+    /**
+     * 3.8.0 — provedor do token do USUÁRIO FINAL usado pelo `support`
+     * (`X-Neetru-End-User-Token`) e pela barra de conta. Aceita `getIdToken()`
+     * síncrono ou assíncrono (+ `refreshTokens()` opcional). Encaixa direto o
+     * `createMobileAuthNamespace(...)` de `@neetru/sdk/mobile`; no backend do
+     * produto, pode ser `{ getIdToken: () => idTokenQueOAppMandou }`.
+     * Default: `client.auth`.
+     */
+    endUserAuth?: EndUserTokenProvider;
 }
 /**
  * Status do produto no catálogo público.
@@ -2721,4 +2808,4 @@ interface CatalogListOptions {
     includeDrafts?: boolean;
 }
 
-export { NeetruDbError as $, type AiChatChoice as A, type DbChangeType as B, type CatalogListOptions as C, DEFAULT_BASE_URL as D, type DbCollectionRef$1 as E, type DbDoc as F, type DbDocRef as G, type DbGetResult as H, type DbListResult as I, type DbNamespace as J, type DbQuery$1 as K, type DbSqlLease as L, type DbWhereFilter as M, type DbWhereFilter$1 as N, type EntitlementCheck as O, type FieldSentinel as P, type IncrementSentinel as Q, type ListNotificationsOptions as R, MockCheckout as S, MockNotifications as T, MockWebhooks as U, NEETRU_SENTINEL_KEY as V, type NeetruClient as W, type NeetruClientConfig as X, type NeetruDb as Y, type NeetruDbDocuments as Z, type NeetruDbEngine as _, type AiChatMessage as a, type NeetruDbErrorCode as a0, type NeetruDbOptions as a1, type NeetruDbTransport as a2, type NeetruEnv as a3, type NeetruSqlClient as a4, type NeetruUser as a5, type NotificationScopeOptions as a6, type NotificationsNamespace as a7, type Product as a8, type ProductNotification as a9, type VerifyWebhookRequestOptions as aA, type VerifyWebhookRequestResult as aB, type WebhookEndpoint as aC, type WebhookEvent as aD, type WebhookScopeOptions as aE, type WebhookTestResult as aF, type WebhooksNamespace as aG, type WithFieldSentinels as aH, __resetDbIdWarningForTests as aI, createAiNamespace as aJ, createCheckoutNamespace as aK, createNeetruDb as aL, createNotificationsNamespace as aM, createRestSyncTransport as aN, createWebhooksNamespace as aO, getWebSocketRealtimeClient as aP, increment as aQ, isFieldSentinel as aR, isIncrementSentinel as aS, isServerTimestampSentinel as aT, serverTimestamp as aU, verifyWebhookRequest as aV, verifyWebhookSignature as aW, type ProductNotificationSeverity as aa, type ProductPlan as ab, type ProductStatus as ac, type RealtimeTransport as ad, type RedirectCallbackResult as ae, type RegisterWebhookInput as af, type ResolvedConfig as ag, type SendNotificationInput as ah, type ServerTimestampSentinel as ai, type SignInOptions as aj, type SqlOptions as ak, type SupportNamespace as al, type SupportSeverity as am, type SupportStatus as an, type SupportTicket as ao, type SyncErrorEvent as ap, type SyncState as aq, type TelemetryEventAck as ar, type TelemetryEventInput as as, type TelemetryLogAck as at, type TelemetryLogInput as au, type Unsubscribe as av, type UsageEventInput as aw, type UsageNamespace as ax, type UsageQuota as ay, type VerifyTokenOptions as az, type AiChatOptions as b, type AiChatResult as c, type AiChatUsage as d, type AiContentPart as e, type AiImageUrlPart as f, type AiNamespace as g, type AiResponseFormat as h, type AiStreamHandle as i, type AiStreamMeta as j, type AiTextPart as k, type AuthNamespace as l, type AuthStateListener as m, type CatalogListResponse as n, type CheckoutAuthOpts as o, type CheckoutIntentInfo as p, type CheckoutIntentStatus as q, type CheckoutNamespace as r, type CheckoutStartInput as s, type CheckoutStartResult as t, type CheckoutTenantType as u, type CompleteSignInResult as v, type ConflictRecord as w, type CreateOfflineDocumentsOptions as x, type CreateTicketInput as y, type DbBatchOp as z };
+export { type NeetruDbEngine as $, type AiChatChoice as A, type DbChangeType as B, type CatalogListOptions as C, DEFAULT_BASE_URL as D, type DbCollectionRef$1 as E, type DbDoc as F, type DbDocRef as G, type DbGetResult as H, type DbListResult as I, type DbNamespace as J, type DbQuery$1 as K, type DbSqlLease as L, type DbWhereFilter as M, type DbWhereFilter$1 as N, type EndUserTokenProvider as O, type EntitlementCheck as P, type FieldSentinel as Q, type IncrementSentinel as R, type ListNotificationsOptions as S, MockCheckout as T, MockNotifications as U, MockWebhooks as V, NEETRU_SENTINEL_KEY as W, type NeetruClient as X, type NeetruClientConfig as Y, type NeetruDb as Z, type NeetruDbDocuments as _, type AiChatMessage as a, NeetruDbError as a0, type NeetruDbErrorCode as a1, type NeetruDbOptions as a2, type NeetruDbTransport as a3, type NeetruEnv as a4, type NeetruSqlClient as a5, type NeetruUser as a6, type NotificationScopeOptions as a7, type NotificationsNamespace as a8, type Product as a9, type VerifyTokenOptions as aA, type VerifyWebhookRequestOptions as aB, type VerifyWebhookRequestResult as aC, type WebhookEndpoint as aD, type WebhookEvent as aE, type WebhookScopeOptions as aF, type WebhookTestResult as aG, type WebhooksNamespace as aH, type WithFieldSentinels as aI, __resetDbIdWarningForTests as aJ, createAiNamespace as aK, createCheckoutNamespace as aL, createNeetruDb as aM, createNotificationsNamespace as aN, createRestSyncTransport as aO, createWebhooksNamespace as aP, getWebSocketRealtimeClient as aQ, increment as aR, isFieldSentinel as aS, isIncrementSentinel as aT, isServerTimestampSentinel as aU, serverTimestamp as aV, verifyWebhookRequest as aW, verifyWebhookSignature as aX, type ProductNotification as aa, type ProductNotificationSeverity as ab, type ProductPlan as ac, type ProductStatus as ad, type RealtimeTransport as ae, type RedirectCallbackResult as af, type RegisterWebhookInput as ag, type ResolvedConfig as ah, type SendNotificationInput as ai, type ServerTimestampSentinel as aj, type SignInOptions as ak, type SqlOptions as al, type SupportNamespace as am, type SupportSeverity as an, type SupportStatus as ao, type SupportTicket as ap, type SyncErrorEvent as aq, type SyncState as ar, type TelemetryEventAck as as, type TelemetryEventInput as at, type TelemetryLogAck as au, type TelemetryLogInput as av, type Unsubscribe as aw, type UsageEventInput as ax, type UsageNamespace as ay, type UsageQuota as az, type AiChatOptions as b, type AiChatResult as c, type AiChatUsage as d, type AiContentPart as e, type AiImageUrlPart as f, type AiNamespace as g, type AiResponseFormat as h, type AiStreamHandle as i, type AiStreamMeta as j, type AiTextPart as k, type AuthNamespace as l, type AuthStateListener as m, type CatalogListResponse as n, type CheckoutAuthOpts as o, type CheckoutIntentInfo as p, type CheckoutIntentStatus as q, type CheckoutNamespace as r, type CheckoutStartInput as s, type CheckoutStartResult as t, type CheckoutTenantType as u, type CompleteSignInResult as v, type ConflictRecord as w, type CreateOfflineDocumentsOptions as x, type CreateTicketInput as y, type DbBatchOp as z };