@neetru/sdk 3.8.0 → 3.9.0

package/dist/mobile.cjs

@@ -1,7 +1,7 @@
 'use strict';
 
 // src/errors.ts
-var n = class t extends Error {
+var o = class t extends Error {
   code;
   status;
   requestId;
@@ -21,65 +21,65 @@ var n = class t extends Error {
    * `undefined` em erros que acontecem antes de qualquer requisição.
    */
   correlationId;
-  constructor(e, o, s, i, p, m) {
-    super(o), this.name = "NeetruError", this.code = e, this.status = s, this.requestId = i, this.reason = p, this.correlationId = m, Object.setPrototypeOf(this, t.prototype);
+  constructor(e, n, i, a, f, p) {
+    super(n), this.name = "NeetruError", this.code = e, this.status = i, this.requestId = a, this.reason = f, this.correlationId = p, Object.setPrototypeOf(this, t.prototype);
   }
-}, v = class t extends n {
-  constructor(e, o, s, i, p) {
-    super("auth_required", e, s, i, o, p), this.name = "NeetruAuthRequiredError", Object.setPrototypeOf(this, t.prototype);
+}, R = class t extends o {
+  constructor(e, n, i, a, f) {
+    super("auth_required", e, i, a, n, f), this.name = "NeetruAuthRequiredError", Object.setPrototypeOf(this, t.prototype);
   }
 };
 
 // src/types.ts
-var H = "https://api.neetru.com";
+var B = "https://api.neetru.com";
 
 // src/base-url-allowlist.ts
-var B = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]), le = ".neetru.com", ue = "neetru.com", de = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?\.(test|localhost)$/;
+var F = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]), fe = ".neetru.com", ge = "neetru.com", me = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?\.(test|localhost)$/;
 function j(t) {
-  return de.test(t);
+  return me.test(t);
 }
-function pe(t) {
+function he(t) {
   return t.toLowerCase().replace(/\.+$/, "");
 }
-function F(t, e = []) {
+function z(t, e = []) {
   if (typeof t != "string" || t.length === 0)
-    throw new n("invalid_config", "baseUrl is required");
-  let o;
+    throw new o("invalid_config", "baseUrl is required");
+  let n;
   try {
-    o = new URL(t);
+    n = new URL(t);
   } catch {
-    throw new n("invalid_config", `baseUrl is not a valid URL: ${t}`);
+    throw new o("invalid_config", `baseUrl is not a valid URL: ${t}`);
   }
-  let s = o.protocol, i = pe(o.hostname);
-  if (fe())
+  let i = n.protocol, a = he(n.hostname);
+  if (ye())
     return typeof console < "u" && console.warn(
       `[neetru-sdk] NEETRU_ALLOW_INSECURE_BASEURL=1 ativo. baseUrl=${t} aceito sem valida\xE7\xE3o.`
     ), t.replace(/\/+$/, "");
-  if (s !== "https:" && s !== "http:")
-    throw new n(
+  if (i !== "https:" && i !== "http:")
+    throw new o(
       "invalid_config",
-      `baseUrl protocol must be http: or https:, got ${s}`
+      `baseUrl protocol must be http: or https:, got ${i}`
     );
-  if (s === "http:") {
-    if (!(B.has(i) || j(i)))
-      throw new n(
+  if (i === "http:") {
+    if (!(F.has(a) || j(a)))
+      throw new o(
         "invalid_config",
-        `baseUrl with http: only allowed for localhost/127.0.0.1/*.test/*.localhost. Got: ${i}. Use https: or set NEETRU_ALLOW_INSECURE_BASEURL=1 to bypass.`
+        `baseUrl with http: only allowed for localhost/127.0.0.1/*.test/*.localhost. Got: ${a}. Use https: or set NEETRU_ALLOW_INSECURE_BASEURL=1 to bypass.`
       );
     return t.replace(/\/+$/, "");
   }
-  let p = i === ue || i.endsWith(le), m = e.some((h) => {
+  let f = a === ge || a.endsWith(fe), p = e.some((h) => {
     let w = h.toLowerCase();
-    return i === w || i.endsWith(`.${w}`);
-  }), I = B.has(i) || j(i);
-  if (!p && !m && !I)
-    throw new n(
+    return a === w || a.endsWith(`.${w}`);
+  }), y = F.has(a) || j(a);
+  if (!f && !p && !y)
+    throw new o(
       "invalid_config",
-      `baseUrl ${i} is not in the allowlist. Allowed: *.neetru.com, localhost, or configure { allowedHosts: ['...'] }. Bypass: NEETRU_ALLOW_INSECURE_BASEURL=1.`
+      `baseUrl ${a} is not in the allowlist. Allowed: *.neetru.com, localhost, or configure { allowedHosts: ['...'] }. Bypass: NEETRU_ALLOW_INSECURE_BASEURL=1.`
     );
   return t.replace(/\/+$/, "");
 }
-function fe() {
+function ye() {
   try {
     let e = globalThis.process?.env?.NEETRU_ALLOW_INSECURE_BASEURL;
     if (e === "1" || e === "true") return !0;
@@ -94,16 +94,16 @@ function fe() {
 }
 
 // src/api-key.ts
-var ge = /^nrt_([A-Za-z0-9]+)_([A-Za-z0-9]+)$/;
-function z(t) {
+var be = /^nrt_([A-Za-z0-9]+)_([A-Za-z0-9]+)$/;
+function V(t) {
   if (typeof t != "string" || t.length === 0)
-    throw new n(
+    throw new o(
       "invalid_config",
       "apiKey is required (formato nrt_<keyId>_<secret>)"
     );
-  let e = ge.exec(t);
+  let e = be.exec(t);
   if (!e)
-    throw new n(
+    throw new o(
       "invalid_config",
       "apiKey malformado - esperado formato nrt_<keyId>_<secret>"
     );
@@ -111,57 +111,57 @@ function z(t) {
 }
 
 // src/auth-pkce-shared.ts
-function V() {
+function W() {
   let t = globalThis.crypto;
   if (!t || typeof t.getRandomValues != "function" || !t.subtle)
-    throw new n(
+    throw new o(
       "runtime_unsupported",
       "auth.signIn requer WebCrypto (crypto.subtle) \u2014 indispon\xEDvel neste runtime. Use HTTPS (ou http://localhost) num browser moderno, ou instale um polyfill WebCrypto (ex: react-native-quick-crypto) em React Native."
     );
   return t;
 }
-function W(t) {
+function J(t) {
   let e = "";
-  for (let s of t) e += String.fromCharCode(s);
+  for (let i of t) e += String.fromCharCode(i);
   return (typeof btoa == "function" ? btoa(e) : Buffer.from(e, "binary").toString("base64")).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
 function x(t, e) {
-  let o = new Uint8Array(e);
-  return t.getRandomValues(o), W(o);
+  let n = new Uint8Array(e);
+  return t.getRandomValues(n), J(n);
 }
-async function J(t, e) {
-  let o = new TextEncoder().encode(e), s = await t.subtle.digest("SHA-256", o);
-  return W(new Uint8Array(s));
+async function G(t, e) {
+  let n = new TextEncoder().encode(e), i = await t.subtle.digest("SHA-256", n);
+  return J(new Uint8Array(i));
 }
-function S(t) {
+function I(t) {
   return (typeof globalThis.NEETRU_AUTH_URL == "string" ? globalThis.NEETRU_AUTH_URL : null) ?? t.replace(/^https?:\/\/api\./, "https://auth.");
 }
-function L(t) {
+function O(t) {
   let e = t.oidcClientId;
-  if (!e && t.apiKey && (e = z(t.apiKey).keyId), !e)
-    throw new n(
+  if (!e && t.apiKey && (e = V(t.apiKey).keyId), !e)
+    throw new o(
       "invalid_config",
       "auth OIDC requer `oidcClientId` (ou `apiKey`) configurado para montar o client_id."
     );
   return e;
 }
-function G(t) {
+function X(t) {
   let e = new URL("/api/v1/oauth/authorize", t.idpOrigin);
   return e.searchParams.set("response_type", "code"), e.searchParams.set("client_id", t.clientId), e.searchParams.set("redirect_uri", t.redirectUri), e.searchParams.set("scope", t.scope), e.searchParams.set("state", t.state), e.searchParams.set("nonce", t.nonce), e.searchParams.set("code_challenge", t.codeChallenge), e.searchParams.set("code_challenge_method", "S256"), e;
 }
-var X = "/api/v1/oauth/token";
-function O(t) {
+var Y = "/api/v1/oauth/token";
+function L(t) {
   let e = t.split(".");
   if (e.length !== 3) return null;
   try {
-    let o = e[1].replace(/-/g, "+").replace(/_/g, "/"), s = "=".repeat((4 - o.length % 4) % 4), i = typeof atob == "function" ? atob(o + s) : Buffer.from(o + s, "base64").toString("utf-8");
-    return JSON.parse(i);
+    let n = e[1].replace(/-/g, "+").replace(/_/g, "/"), i = "=".repeat((4 - n.length % 4) % 4), a = typeof atob == "function" ? atob(n + i) : Buffer.from(n + i, "base64").toString("utf-8");
+    return JSON.parse(a);
   } catch {
     return null;
   }
 }
-function T(t) {
-  let e = O(t);
+function A(t) {
+  let e = L(t);
   return !e || typeof e.sub != "string" || typeof e.exp == "number" && e.exp * 1e3 < Date.now() ? null : {
     uid: e.sub,
     email: typeof e.email == "string" ? e.email : "",
@@ -174,35 +174,35 @@ function T(t) {
     ...e
   };
 }
-var me = "/api/v1/oauth/revoke";
-async function Y(t, e, o, s) {
-  let i = `${e}${me}`, p = true;
-  for (let m of s) {
-    if (!m.token) continue;
-    let I = new URLSearchParams({
-      token: m.token,
-      token_type_hint: m.hint,
-      client_id: o
+var _e = "/api/v1/oauth/revoke";
+async function Q(t, e, n, i) {
+  let a = `${e}${_e}`, f = true;
+  for (let p of i) {
+    if (!p.token) continue;
+    let y = new URLSearchParams({
+      token: p.token,
+      token_type_hint: p.hint,
+      client_id: n
     }).toString(), h = false;
     for (let w = 0; w < 2 && !h; w++)
       try {
-        if (h = (await t(i, {
+        if (h = (await t(a, {
           method: "POST",
           headers: { "content-type": "application/x-www-form-urlencoded" },
-          body: I
+          body: y
         })).ok, !h) break;
       } catch {
-        w === 0 && await new Promise((_) => setTimeout(_, 500));
+        w === 0 && await new Promise((k) => setTimeout(k, 500));
       }
-    h || (p = false);
+    h || (f = false);
   }
-  return p;
+  return f;
 }
 
 // src/server-only-key.ts
 function Z(t) {
   if (!(t == null || t === ""))
-    throw new n(
+    throw new o(
       "server_only_key",
       "[Neetru SDK] Recusado: @neetru/sdk/mobile n\xE3o aceita apiKey. A credencial nrt_ do produto \xE9 S\xD3 DE SERVIDOR \u2014 dentro do app ela \xE9 extra\xEDvel do pacote (.apk/.ipa). Remova a apiKey (e qualquer EXPO_PUBLIC_*_KEY com ela) do app: fa\xE7a login com oidcClientId (client OIDC p\xFAblico do app) e chame a API do seu produto com o access_token do usu\xE1rio; o backend do produto usa o SDK com a chave.",
       void 0,
@@ -212,419 +212,471 @@ function Z(t) {
 }
 
 // src/correlation.ts
-var Q = "x-correlation-id";
-var he = /^[A-Za-z0-9._:\-]+$/;
-function ee(t) {
-  return typeof t == "string" && t.length > 0 && t.length <= 128 && he.test(t);
+var ee = "x-correlation-id";
+var we = /^[A-Za-z0-9._:\-]+$/;
+function te(t) {
+  return typeof t == "string" && t.length > 0 && t.length <= 128 && we.test(t);
 }
-function ye() {
+function ke() {
   let t = globalThis.crypto;
   try {
     if (t && typeof t.randomUUID == "function") return t.randomUUID();
   } catch {
   }
-  let e = new Uint8Array(16), o = false;
+  let e = new Uint8Array(16), n = false;
   try {
-    t && typeof t.getRandomValues == "function" && (t.getRandomValues(e), o = !0);
+    t && typeof t.getRandomValues == "function" && (t.getRandomValues(e), n = !0);
   } catch {
-    o = false;
+    n = false;
   }
-  if (!o)
-    for (let i = 0; i < e.length; i++) e[i] = Math.floor(Math.random() * 256);
+  if (!n)
+    for (let a = 0; a < e.length; a++) e[a] = Math.floor(Math.random() * 256);
   e[6] = e[6] & 15 | 64, e[8] = e[8] & 63 | 128;
-  let s = Array.from(e, (i) => i.toString(16).padStart(2, "0")).join("");
-  return `${s.slice(0, 8)}-${s.slice(8, 12)}-${s.slice(12, 16)}-${s.slice(16, 20)}-${s.slice(20)}`;
+  let i = Array.from(e, (a) => a.toString(16).padStart(2, "0")).join("");
+  return `${i.slice(0, 8)}-${i.slice(8, 12)}-${i.slice(12, 16)}-${i.slice(16, 20)}-${i.slice(20)}`;
 }
 function K(t, e) {
-  let o, s = {};
-  for (let [p, m] of Object.entries(t)) {
-    if (p.toLowerCase() === Q) {
-      ee(m) && (o = m);
+  let n, i = {};
+  for (let [f, p] of Object.entries(t)) {
+    if (f.toLowerCase() === ee) {
+      te(p) && (n = p);
       continue;
     }
-    s[p] = m;
+    i[f] = p;
   }
-  let i = o ?? (ee(e) ? e : void 0) ?? ye();
-  return s[Q] = i, { headers: s, correlationId: i };
+  let a = n ?? (te(e) ? e : void 0) ?? ke();
+  return i[ee] = a, { headers: i, correlationId: a };
 }
 
 // src/http.ts
-function te(t) {
+function re(t) {
   return t === 401 ? "unauthorized" : t === 403 ? "forbidden" : t === 404 ? "not_found" : t === 409 ? "conflict" : t === 410 ? "gone" : t === 422 || t === 400 ? "validation_failed" : t === 429 ? "rate_limited" : t >= 500 ? "server_error" : "unknown";
 }
 
+// src/timeout.ts
+function ne(t) {
+  let e = globalThis.AbortSignal;
+  if (typeof e?.timeout == "function")
+    return { signal: e.timeout(t), clear: () => {
+    } };
+  if (typeof globalThis.AbortController != "function")
+    return { signal: void 0, clear: () => {
+    } };
+  let n = new AbortController(), i = setTimeout(() => n.abort(), t);
+  return i.unref?.(), { signal: n.signal, clear: () => clearTimeout(i) };
+}
+function oe(t, e, n) {
+  let i, a = new Promise((f) => {
+    i = setTimeout(() => f(n()), e), i.unref?.();
+  });
+  return Promise.race([t, a]).finally(() => {
+    i !== void 0 && clearTimeout(i);
+  });
+}
+
 // src/mobile.ts
-var k = "neetru_oauth_tx", U = "neetru_id_token", E = "neetru_refresh_token", C = "neetru_access_token", be = 3e4, we = "/api/v1/oauth/userinfo";
-function _e(t) {
+var v = "neetru_oauth_tx", E = "neetru_id_token", U = "neetru_refresh_token", C = "neetru_access_token", ve = 3e4, Re = "/api/v1/oauth/userinfo";
+function Se(t) {
   if (t === void 0 || t === "") return null;
   let e;
   try {
     e = new URL(t);
   } catch {
-    throw new n("invalid_config", `productApiUrl inv\xE1lida: ${t}`);
+    throw new o("invalid_config", `productApiUrl inv\xE1lida: ${t}`);
   }
-  let o = e.hostname === "localhost" || e.hostname === "127.0.0.1";
-  if (e.protocol !== "https:" && !(e.protocol === "http:" && o))
-    throw new n(
+  let n = e.hostname === "localhost" || e.hostname === "127.0.0.1";
+  if (e.protocol !== "https:" && !(e.protocol === "http:" && n))
+    throw new o(
       "invalid_config",
       "productApiUrl precisa ser https:// (http s\xF3 para localhost) \u2014 o access_token n\xE3o pode trafegar sem TLS."
     );
   return e;
 }
-function ke(t) {
+function Te(t) {
   if (Z(t.apiKey), !t.storage)
-    throw new n(
+    throw new o(
       "invalid_config",
       "createMobileAuthNamespace requer `storage` (MobileAuthStorage) \u2014 ver JSDoc de src/mobile.ts requisito 4."
     );
   if (typeof t.openAuthUrl != "function")
-    throw new n(
+    throw new o(
       "invalid_config",
       "createMobileAuthNamespace requer `openAuthUrl` (browser externo, NUNCA WebView embutida) \u2014 ver JSDoc de src/mobile.ts requisito 3."
     );
   let e = t.fetch ?? globalThis.fetch;
   if (typeof e != "function")
-    throw new n(
+    throw new o(
       "invalid_config",
       "fetch is not available in this runtime. Pass `fetch` explicitly to createMobileAuthNamespace."
     );
   if (typeof t.oidcClientId != "string" || t.oidcClientId.length === 0)
-    throw new n(
+    throw new o(
       "invalid_config",
       "createMobileAuthNamespace requer `oidcClientId` \u2014 o client OIDC P\xDABLICO do app registrado no Core (a apiKey n\xE3o \xE9 aceita no app; ver requisito 6 no JSDoc de src/mobile.ts)."
     );
-  let o = F(t.baseUrl ?? H, t.allowedHosts ?? []);
+  let n = z(t.baseUrl ?? B, t.allowedHosts ?? []);
   return {
     fetchImpl: e.bind(globalThis),
-    baseUrl: o,
+    baseUrl: n,
     oidcClientId: t.oidcClientId,
-    productApiUrl: _e(t.productApiUrl),
+    productApiUrl: Se(t.productApiUrl),
     storage: t.storage,
     openAuthUrl: t.openAuthUrl
   };
 }
-function ve(t) {
-  let o = O(t)?.exp;
-  return typeof o == "number" ? o * 1e3 : null;
+function Ie(t) {
+  let n = L(t)?.exp;
+  return typeof n == "number" ? n * 1e3 : null;
 }
-async function re(t, e, o) {
-  let s;
+async function ie(t, e, n) {
+  let { signal: i, clear: a } = ne(15e3), f;
   try {
-    s = await t(e, {
+    f = await t(e, {
       method: "POST",
       headers: { "content-type": "application/x-www-form-urlencoded" },
-      body: o.toString()
+      body: n.toString(),
+      signal: i
     });
-  } catch (p) {
-    throw new n(
+  } catch (y) {
+    throw new o(
       "network_error",
-      `POST ${e} falhou (network): ${p?.message ?? String(p)}`
+      `POST ${e} falhou (network): ${y?.message ?? String(y)}`
     );
+  } finally {
+    a();
   }
-  let i = null;
+  let p = null;
   try {
-    i = await s.json();
+    p = await f.json();
   } catch {
-    i = null;
+    p = null;
   }
-  if (!s.ok || typeof i?.error == "string") {
-    let p = typeof i?.error_description == "string" && i.error_description || typeof i?.error == "string" && i.error || `HTTP ${s.status}`;
-    throw new n(
+  if (!f.ok || typeof p?.error == "string") {
+    let y = typeof p?.error_description == "string" && p.error_description || typeof p?.error == "string" && p.error || `HTTP ${f.status}`;
+    throw new o(
       "token_exchange_failed",
-      `Troca de tokens falhou no /token: ${p}`,
-      s.status
+      `Troca de tokens falhou no /token: ${y}`,
+      f.status
     );
   }
-  return i ?? {};
+  return p ?? {};
 }
-function je(t) {
-  let e = ke(t), o = /* @__PURE__ */ new Set();
-  function s() {
-    return `${S(e.baseUrl)}${X}`;
+function Ge(t) {
+  let e = Te(t), n = /* @__PURE__ */ new Set();
+  function i() {
+    return `${I(e.baseUrl)}${Y}`;
   }
-  async function i() {
-    let r = await h();
-    for (let a of o)
+  async function a(r) {
+    let s = null;
+    if (r !== void 0)
+      s = r;
+    else
       try {
-        a(r);
+        s = await h();
+      } catch {
+        s = null;
+      }
+    for (let l of n)
+      try {
+        l(s);
       } catch {
       }
   }
-  async function p(r) {
+  async function f(r) {
     if (!r?.redirectUri)
-      throw new n(
+      throw new o(
         "invalid_config",
         "mobile auth.signIn requer `redirectUri` (Universal Link/App Link https://... registrado no Core) \u2014 n\xE3o h\xE1 location.origin impl\xEDcito em React Native."
       );
-    let a = V(), c = r.scope ?? "openid profile email", l = L(e), d = x(a, 16), u = x(a, 16), f = x(a, 32), g = await J(a, f), y = {
+    let s = W(), l = r.scope ?? "openid profile email", u = O(e), d = x(s, 16), c = x(s, 16), m = x(s, 32), g = await G(s, m), b = {
       state: d,
-      nonce: u,
-      codeVerifier: f,
+      nonce: c,
+      codeVerifier: m,
       redirectUri: r.redirectUri,
       postLoginRedirect: r.postLoginRedirect
     };
-    await e.storage.setItem(k, JSON.stringify(y));
-    let b = S(e.baseUrl), R = G({
-      idpOrigin: b,
-      clientId: l,
+    await e.storage.setItem(v, JSON.stringify(b));
+    let _ = I(e.baseUrl), S = X({
+      idpOrigin: _,
+      clientId: u,
       redirectUri: r.redirectUri,
-      scope: c,
+      scope: l,
       state: d,
-      nonce: u,
+      nonce: c,
       codeChallenge: g
     });
-    await e.openAuthUrl(R.toString());
+    await e.openAuthUrl(S.toString());
   }
-  async function m(r) {
+  async function p(r) {
     if (!r || typeof r != "string")
-      throw new n(
+      throw new o(
         "invalid_config",
         "mobile auth.completeSignIn requer `callbackUrl` (a URL completa do deep link de retorno) \u2014 mobile n\xE3o tem location.href impl\xEDcito."
       );
-    let a;
+    let s;
     try {
-      a = new URL(r);
+      s = new URL(r);
     } catch {
-      throw new n("invalid_config", `callbackUrl n\xE3o \xE9 uma URL v\xE1lida: ${r}`);
+      throw new o("invalid_config", `callbackUrl n\xE3o \xE9 uma URL v\xE1lida: ${r}`);
     }
-    let c = a.searchParams, l = c.get("error");
-    if (l) {
-      let ce = c.get("error_description") ?? l;
-      throw await e.storage.removeItem(k), new n(l, `OIDC authorize falhou: ${ce}`);
+    let l = s.searchParams, u = l.get("error");
+    if (u) {
+      let pe = l.get("error_description") ?? u;
+      throw await e.storage.removeItem(v), new o(u, `OIDC authorize falhou: ${pe}`);
     }
-    let d = c.get("code");
+    let d = l.get("code");
     if (!d)
-      throw await e.storage.removeItem(k), new n(
+      throw await e.storage.removeItem(v), new o(
         "invalid_config",
         "callbackUrl n\xE3o cont\xE9m `?code=` nem `?error=` \u2014 n\xE3o \xE9 um callback OIDC v\xE1lido."
       );
-    let u = c.get("state"), f = await e.storage.getItem(k), g = null;
-    if (f)
+    let c = l.get("state"), m = await e.storage.getItem(v), g = null;
+    if (m)
       try {
-        g = JSON.parse(f);
+        g = JSON.parse(m);
       } catch {
         g = null;
       }
     if (!g)
-      throw new n(
+      throw new o(
         "oidc_state_mismatch",
         "Callback OIDC sem transa\xE7\xE3o pendente \u2014 `signIn` n\xE3o foi iniciado (ou j\xE1 consumido)."
       );
-    if (!u || u !== g.state)
-      throw await e.storage.removeItem(k), new n(
+    if (!c || c !== g.state)
+      throw await e.storage.removeItem(v), new o(
         "oidc_state_mismatch",
         "state do callback OIDC n\xE3o confere com o da transa\xE7\xE3o (poss\xEDvel CSRF)."
       );
-    await e.storage.removeItem(k);
-    let y = L(e), b = new URLSearchParams({
+    await e.storage.removeItem(v);
+    let b = O(e), _ = new URLSearchParams({
       grant_type: "authorization_code",
       code: d,
       redirect_uri: g.redirectUri,
-      client_id: y,
+      client_id: b,
       code_verifier: g.codeVerifier
-    }), R = await re(e.fetchImpl, s(), b), A = R.id_token;
-    if (typeof A != "string" || A.length === 0)
-      throw new n(
+    }), S = await ie(e.fetchImpl, i(), _), T = S.id_token;
+    if (typeof T != "string" || T.length === 0)
+      throw new o(
         "token_exchange_failed",
         "Resposta do /token sem `id_token` \u2014 o login n\xE3o pode ser completado."
       );
-    let $ = O(A);
-    if (!$)
-      throw new n(
+    let q = L(T);
+    if (!q)
+      throw new o(
         "token_exchange_failed",
         "id_token retornado pelo /token \xE9 malformado (payload indecodific\xE1vel)."
       );
-    if ($.nonce !== g.nonce)
-      throw new n(
+    if (q.nonce !== g.nonce)
+      throw new o(
         "oidc_nonce_mismatch",
         "nonce do id_token n\xE3o confere com o da transa\xE7\xE3o OIDC (poss\xEDvel replay). Token descartado."
       );
-    let q = T(A);
-    if (!q)
-      throw new n(
+    let H = A(T);
+    if (!H)
+      throw new o(
         "token_exchange_failed",
         "id_token retornado pelo /token n\xE3o tem `sub` ou j\xE1 est\xE1 expirado."
       );
-    await e.storage.setItem(U, A);
-    let M = R.refresh_token;
-    return typeof M == "string" && M.length > 0 && await e.storage.setItem(E, M), await w(R.access_token), await i(), { user: q, postLoginRedirect: g.postLoginRedirect };
+    await e.storage.setItem(E, T);
+    let M = S.refresh_token;
+    return typeof M == "string" && M.length > 0 && await e.storage.setItem(U, M), await w(S.access_token), await a(), { user: H, postLoginRedirect: g.postLoginRedirect };
   }
-  async function I() {
-    let r = await e.storage.getItem(U);
-    return r && T(r) ? r : null;
+  async function y() {
+    let r = await e.storage.getItem(E);
+    return r && A(r) ? r : null;
   }
   async function h() {
-    let r = await e.storage.getItem(U);
-    return r ? T(r) : null;
+    let r = await e.storage.getItem(E);
+    return r ? A(r) : null;
   }
   async function w(r) {
     typeof r == "string" && r.length > 0 ? await e.storage.setItem(C, r) : await e.storage.removeItem(C);
   }
-  let _ = null;
+  let k = null;
   function N() {
-    return _ || (_ = ne().finally(() => {
-      _ = null;
-    }), _);
+    if (k) return k;
+    let r = { abandoned: false };
+    return k = oe(ae(r), 15e3, () => (r.abandoned = true, false)).finally(() => {
+      k = null;
+    }), k;
   }
-  async function ne() {
-    let r = await e.storage.getItem(E);
-    if (!r) return false;
-    let a;
+  async function ae(r = { abandoned: false }) {
+    let s = await e.storage.getItem(U);
+    if (!s) return false;
+    let l;
     try {
-      a = L(e);
+      l = O(e);
     } catch {
       return false;
     }
-    let c = new URLSearchParams({
+    let u = new URLSearchParams({
       grant_type: "refresh_token",
-      refresh_token: r,
-      client_id: a
-    }), l;
+      refresh_token: s,
+      client_id: l
+    }), d;
     try {
-      l = await re(e.fetchImpl, s(), c);
+      d = await ie(e.fetchImpl, i(), u);
     } catch {
       return false;
     }
-    let d = l.id_token;
-    if (typeof d != "string" || d.length === 0 || !T(d)) return false;
-    await e.storage.setItem(U, d);
-    let f = l.refresh_token;
-    return typeof f == "string" && f.length > 0 && await e.storage.setItem(E, f), await w(l.access_token), await i(), true;
+    let c = d.id_token;
+    if (typeof c != "string" || c.length === 0 || !A(c) || r.abandoned) return false;
+    await e.storage.setItem(E, c);
+    let g = d.refresh_token;
+    return typeof g == "string" && g.length > 0 && await e.storage.setItem(U, g), await w(d.access_token), await a(), true;
   }
   async function P() {
     let r = await e.storage.getItem(C);
     if (!r) return null;
-    let a = ve(r);
-    return a === null || a - be <= Date.now() ? null : r;
+    let s = Ie(r);
+    return s === null || s - ve <= Date.now() ? null : r;
   }
   async function D() {
     let r = await P();
     return r || (await N() ? P() : null);
   }
-  async function oe() {
-    let r = `${S(e.baseUrl)}${we}`, a = async (f) => {
-      let { headers: g, correlationId: y } = K({
+  async function ce() {
+    let r = `${I(e.baseUrl)}${Re}`, s = async (m) => {
+      let { headers: g, correlationId: b } = K({
         accept: "application/json",
-        authorization: `Bearer ${f}`
+        authorization: `Bearer ${m}`
       });
       try {
-        return { res: await e.fetchImpl(r, { method: "GET", headers: g }), correlationId: y };
-      } catch (b) {
-        throw new n(
+        return { res: await e.fetchImpl(r, { method: "GET", headers: g }), correlationId: b };
+      } catch (_) {
+        throw new o(
           "network_error",
-          `GET ${r} falhou (network): ${b?.message ?? String(b)}`,
+          `GET ${r} falhou (network): ${_?.message ?? String(_)}`,
           void 0,
           void 0,
           void 0,
-          y
+          b
         );
       }
-    }, c = await D();
-    if (!c)
-      throw new v(
+    }, l = await D();
+    if (!l)
+      throw new R(
         "Sem sess\xE3o: fa\xE7a login (auth.signIn) antes de consultar o userinfo.",
         "no_signed_in_user"
       );
-    let { res: l, correlationId: d } = await a(c);
-    if (l.status === 401 && await N() && (c = await P(), c && ({ res: l, correlationId: d } = await a(c))), l.status === 401)
-      throw new v(
+    let { res: u, correlationId: d } = await s(l);
+    if (u.status === 401 && await N() && (l = await P(), l && ({ res: u, correlationId: d } = await s(l))), u.status === 401)
+      throw new R(
         "O Core recusou a sess\xE3o (token revogado/expirado ou usu\xE1rio inativo). Fa\xE7a login novamente.",
         "invalid_access_token",
         401,
         void 0,
         d
       );
-    let u;
+    let c;
     try {
-      u = await l.json();
+      c = await u.json();
     } catch {
-      u = void 0;
+      c = void 0;
     }
-    if (!l.ok) {
-      let f = u && typeof u == "object" && typeof u.error_description == "string" ? u.error_description : `HTTP ${l.status}`;
-      throw new n(te(l.status), `userinfo falhou: ${f}`, l.status, void 0, void 0, d);
+    if (!u.ok) {
+      let m = c && typeof c == "object" && typeof c.error_description == "string" ? c.error_description : `HTTP ${u.status}`;
+      throw new o(re(u.status), `userinfo falhou: ${m}`, u.status, void 0, void 0, d);
     }
-    if (!u || typeof u != "object" || typeof u.sub != "string")
-      throw new n("invalid_response", "userinfo sem `sub`.", l.status, void 0, void 0, d);
-    return u;
+    if (!c || typeof c != "object" || typeof c.sub != "string")
+      throw new o("invalid_response", "userinfo sem `sub`.", u.status, void 0, void 0, d);
+    return c;
   }
-  function ie(r) {
-    let a = e.productApiUrl;
-    if (!a)
-      throw new n(
+  function le(r) {
+    let s = e.productApiUrl;
+    if (!s)
+      throw new o(
         "invalid_config",
         "auth.authFetch requer `productApiUrl` (URL da API do seu produto) no createMobileAuthNamespace."
       );
-    let c;
+    let l;
     if (/^[a-z][a-z0-9+.-]*:/i.test(r))
       try {
-        c = new URL(r);
+        l = new URL(r);
       } catch {
-        throw new n("invalid_config", `URL inv\xE1lida: ${r}`);
+        throw new o("invalid_config", `URL inv\xE1lida: ${r}`);
       }
     else {
-      let l = a.pathname.replace(/\/+$/, ""), d = r.startsWith("/") ? r : `/${r}`;
-      c = new URL(`${a.origin}${l}${d}`);
+      let u = s.pathname.replace(/\/+$/, ""), d = r.startsWith("/") ? r : `/${r}`;
+      l = new URL(`${s.origin}${u}${d}`);
     }
-    if (c.origin !== a.origin)
-      throw new n(
+    if (l.origin !== s.origin)
+      throw new o(
         "invalid_config",
-        `auth.authFetch s\xF3 envia o access_token para a API do produto (${a.origin}); recusado: ${c.origin}.`
+        `auth.authFetch s\xF3 envia o access_token para a API do produto (${s.origin}); recusado: ${l.origin}.`
       );
-    return c.toString();
+    return l.toString();
   }
-  async function se(r, a = {}) {
-    let c = ie(r), l = {};
-    new Headers(a.headers ?? {}).forEach((y, b) => {
-      l[b] = y;
+  async function ue(r, s = {}) {
+    let l = le(r), u = {};
+    new Headers(s.headers ?? {}).forEach((b, _) => {
+      u[_] = b;
     });
-    let d = (y) => {
-      let { headers: b } = K({ ...l, authorization: `Bearer ${y}` });
-      return e.fetchImpl(c, { ...a, headers: b });
-    }, u = await D();
-    if (!u)
-      throw new v(
+    let d = (b) => {
+      let { headers: _ } = K({ ...u, authorization: `Bearer ${b}` });
+      return e.fetchImpl(l, { ...s, headers: _ });
+    }, c = await D();
+    if (!c)
+      throw new R(
         "Sem sess\xE3o: fa\xE7a login (auth.signIn) antes de chamar a API do produto.",
         "no_signed_in_user"
       );
-    let f = await d(u), g = a.body === void 0 || a.body === null || typeof a.body == "string";
-    return f.status === 401 && g && await N() && (u = await P(), u && (f = await d(u))), f;
+    let m = await d(c), g = s.body === void 0 || s.body === null || typeof s.body == "string";
+    return m.status === 401 && g && await N() && (c = await P(), c && (m = await d(c))), m;
+  }
+  async function $(r) {
+    try {
+      return await e.storage.getItem(r);
+    } catch {
+      return null;
+    }
   }
-  async function ae() {
-    let r = await e.storage.getItem(E), a = await e.storage.getItem(C);
-    await e.storage.removeItem(U), await e.storage.removeItem(E), await e.storage.removeItem(C), await e.storage.removeItem(k);
-    let c = [];
-    r && c.push({ token: r, hint: "refresh_token" }), a && c.push({ token: a, hint: "access_token" }), c.length > 0 && !await Y(
-      e.fetchImpl,
-      S(e.baseUrl),
-      e.oidcClientId,
-      c
-    ) && typeof console < "u" && console.warn(
-      "[neetru-sdk] mobile signOut: a revoga\xE7\xE3o no servidor n\xE3o foi confirmada. A sess\xE3o local foi encerrada, mas o refresh_token pode seguir v\xE1lido at\xE9 expirar."
-    ), await i();
+  async function de() {
+    let r = await $(U), s = await $(C), l = true;
+    for (let c of [E, U, C, v])
+      try {
+        await e.storage.removeItem(c);
+      } catch {
+        l = false;
+      }
+    let u = [];
+    r && u.push({ token: r, hint: "refresh_token" }), s && u.push({ token: s, hint: "access_token" });
+    let d = "skipped";
+    if (u.length > 0) {
+      let c = await Q(
+        e.fetchImpl,
+        I(e.baseUrl),
+        e.oidcClientId,
+        u
+      );
+      d = c ? "accepted" : "failed", !c && typeof console < "u" && console.warn(
+        "[neetru-sdk] mobile signOut: a revoga\xE7\xE3o no servidor n\xE3o foi confirmada. A sess\xE3o local foi encerrada, mas o refresh_token pode seguir v\xE1lido at\xE9 expirar. Trate o campo remoteRevocation do SignOutResult no produto."
+      );
+    }
+    return await a(null), { localSessionCleared: l, remoteRevocation: d };
   }
   return {
-    signIn: p,
-    completeSignIn: m,
-    getIdToken: I,
+    signIn: f,
+    completeSignIn: p,
+    getIdToken: y,
     getAccessToken: D,
-    getUserInfo: oe,
-    authFetch: se,
+    getUserInfo: ce,
+    authFetch: ue,
     getUser: h,
     onAuthStateChanged(r) {
-      return o.add(r), h().then((a) => {
-        if (o.has(r))
+      return n.add(r), h().then((s) => {
+        if (n.has(r))
           try {
-            r(a);
+            r(s);
           } catch {
           }
       }), () => {
-        o.delete(r);
+        n.delete(r);
       };
     },
     refreshTokens: N,
-    signOut: ae
+    signOut: de
   };
 }
 
-exports.createMobileAuthNamespace = je;
+exports.createMobileAuthNamespace = Ge;