@neetru/sdk 3.8.0 → 3.9.0

package/dist/{types-D-9bjlM0.d.cts → types-Bl_4HROd.d.cts}

@@ -1412,9 +1412,42 @@ interface RealtimeClientOptions {
  * Alinhado com `DbSqlLease` do Core (`src/lib/db/lease/types.ts`).
  *
  * - `port` sempre 5433 — o lease aponta pro PgBouncer, nunca à porta crua.
- * - `credentialVersion` — bump indica rotação; o `SqlLeaseManager` reabre
- *   o pool ao detectar versão diferente.
+ * - `credentialVersion` — hoje é um placeholder fixo do Core (ver o campo).
  * - `expiresAt` — ISO string; o SDK renova aos ~80% do TTL (12 min em TTL=15 min).
+ *
+ * ── TLS / mTLS (estado real) ───────────────────────────────────────────────
+ *
+ * **O mTLS de cliente ESTÁ ativo.** O Core emite os três materiais em TODO
+ * lease SQL (emissão e renovação — `buildLease`, ramo `sql`, em
+ * `src/lib/db/lease/issuer-core.ts` do Core):
+ *   - `sslca` — a CA interna do Core (secret `coredb_ca_cert`). A MESMA CA
+ *     assina o cert do servidor PgBouncer (365 dias) e os certs de cliente.
+ *   - `clientCert` — X.509 de cliente emitido por lease: CN = `leaseId`, EKU
+ *     `clientAuth`, validade = TTL do lease (15 min).
+ *   - `clientKey` — chave EC P-256 efêmera, nova a cada emissão/renovação.
+ * Não há flag que desligue isso: sem a CA no Secret Manager a emissão FALHA
+ * (HTTP 500), em vez de devolver esses campos `null`.
+ *
+ * O SDK usa os três ao abrir o `pg.Pool` (`createPgPool` e o `createPool` de
+ * `createSqlClientFromConfig`): com `sslca` presente, `ssl = { ca: sslca,
+ * cert: clientCert, key: clientKey, rejectUnauthorized: true }` — verifica o
+ * servidor (CA + hostname) E apresenta o cert de cliente.
+ *
+ * Do lado da VM, o PgBouncer roda com `client_tls_sslmode = verify-full` e
+ * `client_tls_ca_file` = CA do Core (agente, `src/handlers/db-pgbouncer.ts`):
+ * EXIGE cert de cliente válido. E `auth_type = scram-sha-256` — a conexão
+ * precisa do cert E da senha do lease (o CN não é comparado ao usuário).
+ *
+ * Consequências práticas:
+ *   - o cert de cliente expira junto com o lease (~15 min). Pool que não troca
+ *     de lease passa a levar `certificate expired` (alerta TLS 45 enviado pelo
+ *     PgBouncer) — é o que a renovação proativa (`lease.ts`) e o re-lease
+ *     reativo (`resilient-pool.ts`) curam;
+ *   - se o install da VM não obteve a CA/assinatura, o Core configura o
+ *     PgBouncer SEM TLS (fail-open, com aviso no log). Como o SDK sempre liga
+ *     TLS quando o lease traz `sslca`, a conexão falha com "The server does
+ *     not support SSL connections" — o conserto é reconfigurar o PgBouncer com
+ *     TLS, não desligar TLS no SDK.
  */
 interface DbSqlLease {
     leaseId: string;
@@ -1425,31 +1458,38 @@ interface DbSqlLease {
     /** Plaintext — trafega só sobre HTTPS, NUNCA logado/persistido. */
     password: string;
     /**
-     * CA do servidor PgBouncer, para **TLS de servidor** (verify-full). Quando
-     * presente, o pool valida o certificado do servidor contra esta CA
-     * (`rejectUnauthorized: true`). `null` quando o lease não traz TLS.
+     * CA interna do Core (PEM) — a mesma que assina o cert do servidor PgBouncer
+     * e o `clientCert`. O pool valida o servidor contra ela
+     * (`rejectUnauthorized: true`). O Core sempre manda em lease SQL; `null` só
+     * se o campo vier ausente, e aí o SDK conecta SEM TLS (`ssl: false`), mesmo
+     * que `clientCert` exista.
      */
     sslca: string | null;
     /**
-     * Certificado de **cliente** para mTLS (o SDK apresentar identidade ao
-     * servidor). **mTLS-cliente NÃO está implementado no Core (TODO P0-3):** hoje
-     * este campo é SEMPRE `null`, portanto **não há mTLS ativo** — a conexão usa,
-     * no máximo, TLS de servidor (verify-full via `sslca`). O SDK já envia este
-     * cert ao pool quando/se o lease passar a trazê-lo.
+     * Certificado X.509 de **cliente** (PEM) para mTLS, emitido por lease
+     * (CN = `leaseId`, EKU `clientAuth`, expira com o lease — 15 min). O SDK o
+     * apresenta ao PgBouncer em `ssl.cert`; o PgBouncer o exige
+     * (`client_tls_sslmode = verify-full`). O Core sempre manda em lease SQL —
+     * o `| null` é só tolerância a resposta sem o campo (o pool fica com TLS
+     * só de servidor).
      */
     clientCert: string | null;
     /**
-     * Chave privada de **cliente** para mTLS — par de `clientCert`. Mesma
-     * condição: `null` até o Core emitir material de cliente (mTLS-cliente
-     * pendente, P0-3).
+     * Chave privada de **cliente** (PEM, EC P-256 efêmera, nova a cada
+     * emissão/renovação) — par de `clientCert`, vai em `ssl.key`. Trafega só
+     * sobre HTTPS, NUNCA logada/persistida. Mesma regra de `null` do
+     * `clientCert`.
      */
     clientKey: string | null;
     /**
-     * Versão da credencial no Secret Manager. Bump = rotação de senha.
-     * O manager fecha o pool antigo e abre um novo quando esta versão muda.
+     * Versão da credencial. HOJE o Core manda sempre o placeholder `1` (TODO de
+     * versionamento no `issuer-core.ts` do Core), então ela NÃO sinaliza
+     * rotação. A troca de pool numa rotação é disparada pela mudança de
+     * `password` (ou de qualquer campo de conexão) — ver `hasConnectionChanged`
+     * em `lease.ts`.
      */
     credentialVersion: number;
-    /** Expiração ISO — SDK renova ~2 min antes. */
+    /** Expiração ISO — o SDK renova aos ~80% do TTL (~3 min antes, em 15 min). */
     expiresAt: string;
 }
 /**
@@ -2312,6 +2352,44 @@ interface SignInOptions {
     postLoginRedirect?: string;
 }
 type AuthStateListener = (user: NeetruUser | null) => void;
+/**
+ * 3.9.0 — desfecho da revogação remota no `signOut`.
+ *
+ * - `accepted`  — o `/api/v1/oauth/revoke` respondeu 2xx. É o melhor sinal que
+ *   existe, e ainda assim NÃO é prova de que o token foi destruído: a RFC 7009
+ *   §2.2 manda responder 200 inclusive pra token desconhecido (não vazar
+ *   enumeração). Significa "o servidor aceitou a revogação", não "o token
+ *   existia e morreu".
+ * - `skipped`   — não havia token revogável no storage (sessão já encerrada,
+ *   ou login que nunca gravou `refresh_token`). Nada a fazer.
+ * - `not_configured` — o SDK não conseguiu montar o `client_id` OIDC
+ *   (`oidcClientId`/`apiKey` ausentes). NENHUMA requisição foi feita. É defeito
+ *   de configuração do produto, não falha de rede — e o efeito prático é o
+ *   mesmo de `failed`: a sessão do servidor segue de pé.
+ * - `failed`    — a requisição saiu e o servidor recusou (4xx/5xx) ou a rede
+ *   caiu nas duas tentativas. O `refresh_token` pode seguir válido até expirar
+ *   (30 dias). Em terminal compartilhado isso é falha de segurança: avise.
+ */
+type RemoteRevocationStatus = 'accepted' | 'skipped' | 'not_configured' | 'failed';
+/**
+ * 3.9.0 — resultado de `auth.signOut()`.
+ *
+ * Existe porque até a 3.8.x o `signOut` devolvia `void` e engolia a falha de
+ * revogação num `console.warn`: do ponto de vista do produto, sair com o
+ * servidor fora do ar era indistinguível de sair com a sessão de fato
+ * encerrada. O usuário lia "você saiu" e o `refresh_token` de 30 dias seguia
+ * vivo — num PDV de balcão, isso é a próxima pessoa herdando a sessão.
+ */
+interface SignOutResult {
+    /**
+     * `true` quando todo o material de sessão foi removido do storage local.
+     * Só é `false` se o próprio storage falhou ao apagar (ex.: SecureStore do RN
+     * indisponível) — nesse caso ainda pode haver token NESTE aparelho.
+     */
+    localSessionCleared: boolean;
+    /** Desfecho da revogação no servidor. Ver `RemoteRevocationStatus`. */
+    remoteRevocation: RemoteRevocationStatus;
+}
 /**
  * 3.1.3 — Resultado de `auth.handleRedirectCallback()`: o material que o **backend
  * do produto** (confidential client) usa pra trocar o code por tokens no
@@ -2416,8 +2494,29 @@ interface AuthNamespace {
      * podem omitir. Usado pelo `client.support` antes de desistir num 401.
      */
     refreshTokens?(): Promise<boolean>;
-    /** Limpa session local + revoga refresh token no servidor. */
-    signOut(): Promise<void>;
+    /**
+     * Encerra a sessão: limpa o storage local e revoga o `refresh_token` no
+     * `/api/v1/oauth/revoke` do Core.
+     *
+     * A limpeza local acontece SEMPRE — o usuário pediu pra sair, e deixá-lo
+     * logado na tela porque a rede caiu seria o pior dos mundos. Já a revogação
+     * remota pode falhar, e quando falha ela NÃO é silenciosa: o resultado traz
+     * `remoteRevocation: 'failed'`. Não lança nesse caso — lançar ESCONDERIA o
+     * problema, porque todo caller envolve o signOut em try/catch e redireciona
+     * assim mesmo (inclusive o `<AccountBar>` deste próprio SDK).
+     *
+     * Produto em terminal compartilhado (PDV, balcão) DEVE checar o resultado:
+     * `'failed'` significa que o `refresh_token` de 30 dias pode seguir válido
+     * no servidor — a tela de "você saiu" estaria mentindo por omissão.
+     *
+     * ```ts
+     * const r = await client.auth.signOut();
+     * if (r.remoteRevocation === 'failed') {
+     *   toast.warn('Saímos deste aparelho, mas não deu pra encerrar a sessão no servidor.');
+     * }
+     * ```
+     */
+    signOut(): Promise<SignOutResult>;
     /** Retorna o user atual (do id_token cached) ou `null` se não logado. */
     getUser(): NeetruUser | null;
     /**
@@ -2768,4 +2867,4 @@ interface CatalogListOptions {
     includeDrafts?: boolean;
 }
 
-export { type NeetruDbEngine as $, type AiChatChoice as A, type DbChangeType as B, type CatalogListOptions as C, DEFAULT_BASE_URL as D, type DbCollectionRef$1 as E, type DbDoc as F, type DbDocRef as G, type DbGetResult as H, type DbListResult as I, type DbNamespace as J, type DbQuery$1 as K, type DbSqlLease as L, type DbWhereFilter as M, type DbWhereFilter$1 as N, type EndUserTokenProvider as O, type EntitlementCheck as P, type FieldSentinel as Q, type IncrementSentinel as R, type ListNotificationsOptions as S, MockCheckout as T, MockNotifications as U, MockWebhooks as V, NEETRU_SENTINEL_KEY as W, type NeetruClient as X, type NeetruClientConfig as Y, type NeetruDb as Z, type NeetruDbDocuments as _, type AiChatMessage as a, NeetruDbError as a0, type NeetruDbErrorCode as a1, type NeetruDbOptions as a2, type NeetruDbTransport as a3, type NeetruEnv as a4, type NeetruSqlClient as a5, type NeetruUser as a6, type NotificationScopeOptions as a7, type NotificationsNamespace as a8, type Product as a9, type VerifyTokenOptions as aA, type VerifyWebhookRequestOptions as aB, type VerifyWebhookRequestResult as aC, type WebhookEndpoint as aD, type WebhookEvent as aE, type WebhookScopeOptions as aF, type WebhookTestResult as aG, type WebhooksNamespace as aH, type WithFieldSentinels as aI, __resetDbIdWarningForTests as aJ, createAiNamespace as aK, createCheckoutNamespace as aL, createNeetruDb as aM, createNotificationsNamespace as aN, createRestSyncTransport as aO, createWebhooksNamespace as aP, getWebSocketRealtimeClient as aQ, increment as aR, isFieldSentinel as aS, isIncrementSentinel as aT, isServerTimestampSentinel as aU, serverTimestamp as aV, verifyWebhookRequest as aW, verifyWebhookSignature as aX, type ProductNotification as aa, type ProductNotificationSeverity as ab, type ProductPlan as ac, type ProductStatus as ad, type RealtimeTransport as ae, type RedirectCallbackResult as af, type RegisterWebhookInput as ag, type ResolvedConfig as ah, type SendNotificationInput as ai, type ServerTimestampSentinel as aj, type SignInOptions as ak, type SqlOptions as al, type SupportNamespace as am, type SupportSeverity as an, type SupportStatus as ao, type SupportTicket as ap, type SyncErrorEvent as aq, type SyncState as ar, type TelemetryEventAck as as, type TelemetryEventInput as at, type TelemetryLogAck as au, type TelemetryLogInput as av, type Unsubscribe as aw, type UsageEventInput as ax, type UsageNamespace as ay, type UsageQuota as az, type AiChatOptions as b, type AiChatResult as c, type AiChatUsage as d, type AiContentPart as e, type AiImageUrlPart as f, type AiNamespace as g, type AiResponseFormat as h, type AiStreamHandle as i, type AiStreamMeta as j, type AiTextPart as k, type AuthNamespace as l, type AuthStateListener as m, type CatalogListResponse as n, type CheckoutAuthOpts as o, type CheckoutIntentInfo as p, type CheckoutIntentStatus as q, type CheckoutNamespace as r, type CheckoutStartInput as s, type CheckoutStartResult as t, type CheckoutTenantType as u, type CompleteSignInResult as v, type ConflictRecord as w, type CreateOfflineDocumentsOptions as x, type CreateTicketInput as y, type DbBatchOp as z };
+export { type NeetruDbEngine as $, type AiChatChoice as A, type DbChangeType as B, type CatalogListOptions as C, DEFAULT_BASE_URL as D, type DbCollectionRef$1 as E, type DbDoc as F, type DbDocRef as G, type DbGetResult as H, type DbListResult as I, type DbNamespace as J, type DbQuery$1 as K, type DbSqlLease as L, type DbWhereFilter as M, type DbWhereFilter$1 as N, type EndUserTokenProvider as O, type EntitlementCheck as P, type FieldSentinel as Q, type IncrementSentinel as R, type ListNotificationsOptions as S, MockCheckout as T, MockNotifications as U, MockWebhooks as V, NEETRU_SENTINEL_KEY as W, type NeetruClient as X, type NeetruClientConfig as Y, type NeetruDb as Z, type NeetruDbDocuments as _, type AiChatMessage as a, NeetruDbError as a0, type NeetruDbErrorCode as a1, type NeetruDbOptions as a2, type NeetruDbTransport as a3, type NeetruEnv as a4, type NeetruSqlClient as a5, type NeetruUser as a6, type NotificationScopeOptions as a7, type NotificationsNamespace as a8, type Product as a9, type UsageNamespace as aA, type UsageQuota as aB, type VerifyTokenOptions as aC, type VerifyWebhookRequestOptions as aD, type VerifyWebhookRequestResult as aE, type WebhookEndpoint as aF, type WebhookEvent as aG, type WebhookScopeOptions as aH, type WebhookTestResult as aI, type WebhooksNamespace as aJ, type WithFieldSentinels as aK, __resetDbIdWarningForTests as aL, createAiNamespace as aM, createCheckoutNamespace as aN, createNeetruDb as aO, createNotificationsNamespace as aP, createRestSyncTransport as aQ, createWebhooksNamespace as aR, getWebSocketRealtimeClient as aS, increment as aT, isFieldSentinel as aU, isIncrementSentinel as aV, isServerTimestampSentinel as aW, serverTimestamp as aX, verifyWebhookRequest as aY, verifyWebhookSignature as aZ, type ProductNotification as aa, type ProductNotificationSeverity as ab, type ProductPlan as ac, type ProductStatus as ad, type RealtimeTransport as ae, type RedirectCallbackResult as af, type RegisterWebhookInput as ag, type RemoteRevocationStatus as ah, type ResolvedConfig as ai, type SendNotificationInput as aj, type ServerTimestampSentinel as ak, type SignInOptions as al, type SignOutResult as am, type SqlOptions as an, type SupportNamespace as ao, type SupportSeverity as ap, type SupportStatus as aq, type SupportTicket as ar, type SyncErrorEvent as as, type SyncState as at, type TelemetryEventAck as au, type TelemetryEventInput as av, type TelemetryLogAck as aw, type TelemetryLogInput as ax, type Unsubscribe as ay, type UsageEventInput as az, type AiChatOptions as b, type AiChatResult as c, type AiChatUsage as d, type AiContentPart as e, type AiImageUrlPart as f, type AiNamespace as g, type AiResponseFormat as h, type AiStreamHandle as i, type AiStreamMeta as j, type AiTextPart as k, type AuthNamespace as l, type AuthStateListener as m, type CatalogListResponse as n, type CheckoutAuthOpts as o, type CheckoutIntentInfo as p, type CheckoutIntentStatus as q, type CheckoutNamespace as r, type CheckoutStartInput as s, type CheckoutStartResult as t, type CheckoutTenantType as u, type CompleteSignInResult as v, type ConflictRecord as w, type CreateOfflineDocumentsOptions as x, type CreateTicketInput as y, type DbBatchOp as z };

package/dist/{types-bVztFQTI.d.ts → types-Bqnsqvow.d.ts}

@@ -1412,9 +1412,42 @@ interface RealtimeClientOptions {
  * Alinhado com `DbSqlLease` do Core (`src/lib/db/lease/types.ts`).
  *
  * - `port` sempre 5433 — o lease aponta pro PgBouncer, nunca à porta crua.
- * - `credentialVersion` — bump indica rotação; o `SqlLeaseManager` reabre
- *   o pool ao detectar versão diferente.
+ * - `credentialVersion` — hoje é um placeholder fixo do Core (ver o campo).
  * - `expiresAt` — ISO string; o SDK renova aos ~80% do TTL (12 min em TTL=15 min).
+ *
+ * ── TLS / mTLS (estado real) ───────────────────────────────────────────────
+ *
+ * **O mTLS de cliente ESTÁ ativo.** O Core emite os três materiais em TODO
+ * lease SQL (emissão e renovação — `buildLease`, ramo `sql`, em
+ * `src/lib/db/lease/issuer-core.ts` do Core):
+ *   - `sslca` — a CA interna do Core (secret `coredb_ca_cert`). A MESMA CA
+ *     assina o cert do servidor PgBouncer (365 dias) e os certs de cliente.
+ *   - `clientCert` — X.509 de cliente emitido por lease: CN = `leaseId`, EKU
+ *     `clientAuth`, validade = TTL do lease (15 min).
+ *   - `clientKey` — chave EC P-256 efêmera, nova a cada emissão/renovação.
+ * Não há flag que desligue isso: sem a CA no Secret Manager a emissão FALHA
+ * (HTTP 500), em vez de devolver esses campos `null`.
+ *
+ * O SDK usa os três ao abrir o `pg.Pool` (`createPgPool` e o `createPool` de
+ * `createSqlClientFromConfig`): com `sslca` presente, `ssl = { ca: sslca,
+ * cert: clientCert, key: clientKey, rejectUnauthorized: true }` — verifica o
+ * servidor (CA + hostname) E apresenta o cert de cliente.
+ *
+ * Do lado da VM, o PgBouncer roda com `client_tls_sslmode = verify-full` e
+ * `client_tls_ca_file` = CA do Core (agente, `src/handlers/db-pgbouncer.ts`):
+ * EXIGE cert de cliente válido. E `auth_type = scram-sha-256` — a conexão
+ * precisa do cert E da senha do lease (o CN não é comparado ao usuário).
+ *
+ * Consequências práticas:
+ *   - o cert de cliente expira junto com o lease (~15 min). Pool que não troca
+ *     de lease passa a levar `certificate expired` (alerta TLS 45 enviado pelo
+ *     PgBouncer) — é o que a renovação proativa (`lease.ts`) e o re-lease
+ *     reativo (`resilient-pool.ts`) curam;
+ *   - se o install da VM não obteve a CA/assinatura, o Core configura o
+ *     PgBouncer SEM TLS (fail-open, com aviso no log). Como o SDK sempre liga
+ *     TLS quando o lease traz `sslca`, a conexão falha com "The server does
+ *     not support SSL connections" — o conserto é reconfigurar o PgBouncer com
+ *     TLS, não desligar TLS no SDK.
  */
 interface DbSqlLease {
     leaseId: string;
@@ -1425,31 +1458,38 @@ interface DbSqlLease {
     /** Plaintext — trafega só sobre HTTPS, NUNCA logado/persistido. */
     password: string;
     /**
-     * CA do servidor PgBouncer, para **TLS de servidor** (verify-full). Quando
-     * presente, o pool valida o certificado do servidor contra esta CA
-     * (`rejectUnauthorized: true`). `null` quando o lease não traz TLS.
+     * CA interna do Core (PEM) — a mesma que assina o cert do servidor PgBouncer
+     * e o `clientCert`. O pool valida o servidor contra ela
+     * (`rejectUnauthorized: true`). O Core sempre manda em lease SQL; `null` só
+     * se o campo vier ausente, e aí o SDK conecta SEM TLS (`ssl: false`), mesmo
+     * que `clientCert` exista.
      */
     sslca: string | null;
     /**
-     * Certificado de **cliente** para mTLS (o SDK apresentar identidade ao
-     * servidor). **mTLS-cliente NÃO está implementado no Core (TODO P0-3):** hoje
-     * este campo é SEMPRE `null`, portanto **não há mTLS ativo** — a conexão usa,
-     * no máximo, TLS de servidor (verify-full via `sslca`). O SDK já envia este
-     * cert ao pool quando/se o lease passar a trazê-lo.
+     * Certificado X.509 de **cliente** (PEM) para mTLS, emitido por lease
+     * (CN = `leaseId`, EKU `clientAuth`, expira com o lease — 15 min). O SDK o
+     * apresenta ao PgBouncer em `ssl.cert`; o PgBouncer o exige
+     * (`client_tls_sslmode = verify-full`). O Core sempre manda em lease SQL —
+     * o `| null` é só tolerância a resposta sem o campo (o pool fica com TLS
+     * só de servidor).
      */
     clientCert: string | null;
     /**
-     * Chave privada de **cliente** para mTLS — par de `clientCert`. Mesma
-     * condição: `null` até o Core emitir material de cliente (mTLS-cliente
-     * pendente, P0-3).
+     * Chave privada de **cliente** (PEM, EC P-256 efêmera, nova a cada
+     * emissão/renovação) — par de `clientCert`, vai em `ssl.key`. Trafega só
+     * sobre HTTPS, NUNCA logada/persistida. Mesma regra de `null` do
+     * `clientCert`.
      */
     clientKey: string | null;
     /**
-     * Versão da credencial no Secret Manager. Bump = rotação de senha.
-     * O manager fecha o pool antigo e abre um novo quando esta versão muda.
+     * Versão da credencial. HOJE o Core manda sempre o placeholder `1` (TODO de
+     * versionamento no `issuer-core.ts` do Core), então ela NÃO sinaliza
+     * rotação. A troca de pool numa rotação é disparada pela mudança de
+     * `password` (ou de qualquer campo de conexão) — ver `hasConnectionChanged`
+     * em `lease.ts`.
      */
     credentialVersion: number;
-    /** Expiração ISO — SDK renova ~2 min antes. */
+    /** Expiração ISO — o SDK renova aos ~80% do TTL (~3 min antes, em 15 min). */
     expiresAt: string;
 }
 /**
@@ -2312,6 +2352,44 @@ interface SignInOptions {
     postLoginRedirect?: string;
 }
 type AuthStateListener = (user: NeetruUser | null) => void;
+/**
+ * 3.9.0 — desfecho da revogação remota no `signOut`.
+ *
+ * - `accepted`  — o `/api/v1/oauth/revoke` respondeu 2xx. É o melhor sinal que
+ *   existe, e ainda assim NÃO é prova de que o token foi destruído: a RFC 7009
+ *   §2.2 manda responder 200 inclusive pra token desconhecido (não vazar
+ *   enumeração). Significa "o servidor aceitou a revogação", não "o token
+ *   existia e morreu".
+ * - `skipped`   — não havia token revogável no storage (sessão já encerrada,
+ *   ou login que nunca gravou `refresh_token`). Nada a fazer.
+ * - `not_configured` — o SDK não conseguiu montar o `client_id` OIDC
+ *   (`oidcClientId`/`apiKey` ausentes). NENHUMA requisição foi feita. É defeito
+ *   de configuração do produto, não falha de rede — e o efeito prático é o
+ *   mesmo de `failed`: a sessão do servidor segue de pé.
+ * - `failed`    — a requisição saiu e o servidor recusou (4xx/5xx) ou a rede
+ *   caiu nas duas tentativas. O `refresh_token` pode seguir válido até expirar
+ *   (30 dias). Em terminal compartilhado isso é falha de segurança: avise.
+ */
+type RemoteRevocationStatus = 'accepted' | 'skipped' | 'not_configured' | 'failed';
+/**
+ * 3.9.0 — resultado de `auth.signOut()`.
+ *
+ * Existe porque até a 3.8.x o `signOut` devolvia `void` e engolia a falha de
+ * revogação num `console.warn`: do ponto de vista do produto, sair com o
+ * servidor fora do ar era indistinguível de sair com a sessão de fato
+ * encerrada. O usuário lia "você saiu" e o `refresh_token` de 30 dias seguia
+ * vivo — num PDV de balcão, isso é a próxima pessoa herdando a sessão.
+ */
+interface SignOutResult {
+    /**
+     * `true` quando todo o material de sessão foi removido do storage local.
+     * Só é `false` se o próprio storage falhou ao apagar (ex.: SecureStore do RN
+     * indisponível) — nesse caso ainda pode haver token NESTE aparelho.
+     */
+    localSessionCleared: boolean;
+    /** Desfecho da revogação no servidor. Ver `RemoteRevocationStatus`. */
+    remoteRevocation: RemoteRevocationStatus;
+}
 /**
  * 3.1.3 — Resultado de `auth.handleRedirectCallback()`: o material que o **backend
  * do produto** (confidential client) usa pra trocar o code por tokens no
@@ -2416,8 +2494,29 @@ interface AuthNamespace {
      * podem omitir. Usado pelo `client.support` antes de desistir num 401.
      */
     refreshTokens?(): Promise<boolean>;
-    /** Limpa session local + revoga refresh token no servidor. */
-    signOut(): Promise<void>;
+    /**
+     * Encerra a sessão: limpa o storage local e revoga o `refresh_token` no
+     * `/api/v1/oauth/revoke` do Core.
+     *
+     * A limpeza local acontece SEMPRE — o usuário pediu pra sair, e deixá-lo
+     * logado na tela porque a rede caiu seria o pior dos mundos. Já a revogação
+     * remota pode falhar, e quando falha ela NÃO é silenciosa: o resultado traz
+     * `remoteRevocation: 'failed'`. Não lança nesse caso — lançar ESCONDERIA o
+     * problema, porque todo caller envolve o signOut em try/catch e redireciona
+     * assim mesmo (inclusive o `<AccountBar>` deste próprio SDK).
+     *
+     * Produto em terminal compartilhado (PDV, balcão) DEVE checar o resultado:
+     * `'failed'` significa que o `refresh_token` de 30 dias pode seguir válido
+     * no servidor — a tela de "você saiu" estaria mentindo por omissão.
+     *
+     * ```ts
+     * const r = await client.auth.signOut();
+     * if (r.remoteRevocation === 'failed') {
+     *   toast.warn('Saímos deste aparelho, mas não deu pra encerrar a sessão no servidor.');
+     * }
+     * ```
+     */
+    signOut(): Promise<SignOutResult>;
     /** Retorna o user atual (do id_token cached) ou `null` se não logado. */
     getUser(): NeetruUser | null;
     /**
@@ -2768,4 +2867,4 @@ interface CatalogListOptions {
     includeDrafts?: boolean;
 }
 
-export { type NeetruDbEngine as $, type AiChatChoice as A, type DbChangeType as B, type CatalogListOptions as C, DEFAULT_BASE_URL as D, type DbCollectionRef$1 as E, type DbDoc as F, type DbDocRef as G, type DbGetResult as H, type DbListResult as I, type DbNamespace as J, type DbQuery$1 as K, type DbSqlLease as L, type DbWhereFilter as M, type DbWhereFilter$1 as N, type EndUserTokenProvider as O, type EntitlementCheck as P, type FieldSentinel as Q, type IncrementSentinel as R, type ListNotificationsOptions as S, MockCheckout as T, MockNotifications as U, MockWebhooks as V, NEETRU_SENTINEL_KEY as W, type NeetruClient as X, type NeetruClientConfig as Y, type NeetruDb as Z, type NeetruDbDocuments as _, type AiChatMessage as a, NeetruDbError as a0, type NeetruDbErrorCode as a1, type NeetruDbOptions as a2, type NeetruDbTransport as a3, type NeetruEnv as a4, type NeetruSqlClient as a5, type NeetruUser as a6, type NotificationScopeOptions as a7, type NotificationsNamespace as a8, type Product as a9, type VerifyTokenOptions as aA, type VerifyWebhookRequestOptions as aB, type VerifyWebhookRequestResult as aC, type WebhookEndpoint as aD, type WebhookEvent as aE, type WebhookScopeOptions as aF, type WebhookTestResult as aG, type WebhooksNamespace as aH, type WithFieldSentinels as aI, __resetDbIdWarningForTests as aJ, createAiNamespace as aK, createCheckoutNamespace as aL, createNeetruDb as aM, createNotificationsNamespace as aN, createRestSyncTransport as aO, createWebhooksNamespace as aP, getWebSocketRealtimeClient as aQ, increment as aR, isFieldSentinel as aS, isIncrementSentinel as aT, isServerTimestampSentinel as aU, serverTimestamp as aV, verifyWebhookRequest as aW, verifyWebhookSignature as aX, type ProductNotification as aa, type ProductNotificationSeverity as ab, type ProductPlan as ac, type ProductStatus as ad, type RealtimeTransport as ae, type RedirectCallbackResult as af, type RegisterWebhookInput as ag, type ResolvedConfig as ah, type SendNotificationInput as ai, type ServerTimestampSentinel as aj, type SignInOptions as ak, type SqlOptions as al, type SupportNamespace as am, type SupportSeverity as an, type SupportStatus as ao, type SupportTicket as ap, type SyncErrorEvent as aq, type SyncState as ar, type TelemetryEventAck as as, type TelemetryEventInput as at, type TelemetryLogAck as au, type TelemetryLogInput as av, type Unsubscribe as aw, type UsageEventInput as ax, type UsageNamespace as ay, type UsageQuota as az, type AiChatOptions as b, type AiChatResult as c, type AiChatUsage as d, type AiContentPart as e, type AiImageUrlPart as f, type AiNamespace as g, type AiResponseFormat as h, type AiStreamHandle as i, type AiStreamMeta as j, type AiTextPart as k, type AuthNamespace as l, type AuthStateListener as m, type CatalogListResponse as n, type CheckoutAuthOpts as o, type CheckoutIntentInfo as p, type CheckoutIntentStatus as q, type CheckoutNamespace as r, type CheckoutStartInput as s, type CheckoutStartResult as t, type CheckoutTenantType as u, type CompleteSignInResult as v, type ConflictRecord as w, type CreateOfflineDocumentsOptions as x, type CreateTicketInput as y, type DbBatchOp as z };
+export { type NeetruDbEngine as $, type AiChatChoice as A, type DbChangeType as B, type CatalogListOptions as C, DEFAULT_BASE_URL as D, type DbCollectionRef$1 as E, type DbDoc as F, type DbDocRef as G, type DbGetResult as H, type DbListResult as I, type DbNamespace as J, type DbQuery$1 as K, type DbSqlLease as L, type DbWhereFilter as M, type DbWhereFilter$1 as N, type EndUserTokenProvider as O, type EntitlementCheck as P, type FieldSentinel as Q, type IncrementSentinel as R, type ListNotificationsOptions as S, MockCheckout as T, MockNotifications as U, MockWebhooks as V, NEETRU_SENTINEL_KEY as W, type NeetruClient as X, type NeetruClientConfig as Y, type NeetruDb as Z, type NeetruDbDocuments as _, type AiChatMessage as a, NeetruDbError as a0, type NeetruDbErrorCode as a1, type NeetruDbOptions as a2, type NeetruDbTransport as a3, type NeetruEnv as a4, type NeetruSqlClient as a5, type NeetruUser as a6, type NotificationScopeOptions as a7, type NotificationsNamespace as a8, type Product as a9, type UsageNamespace as aA, type UsageQuota as aB, type VerifyTokenOptions as aC, type VerifyWebhookRequestOptions as aD, type VerifyWebhookRequestResult as aE, type WebhookEndpoint as aF, type WebhookEvent as aG, type WebhookScopeOptions as aH, type WebhookTestResult as aI, type WebhooksNamespace as aJ, type WithFieldSentinels as aK, __resetDbIdWarningForTests as aL, createAiNamespace as aM, createCheckoutNamespace as aN, createNeetruDb as aO, createNotificationsNamespace as aP, createRestSyncTransport as aQ, createWebhooksNamespace as aR, getWebSocketRealtimeClient as aS, increment as aT, isFieldSentinel as aU, isIncrementSentinel as aV, isServerTimestampSentinel as aW, serverTimestamp as aX, verifyWebhookRequest as aY, verifyWebhookSignature as aZ, type ProductNotification as aa, type ProductNotificationSeverity as ab, type ProductPlan as ac, type ProductStatus as ad, type RealtimeTransport as ae, type RedirectCallbackResult as af, type RegisterWebhookInput as ag, type RemoteRevocationStatus as ah, type ResolvedConfig as ai, type SendNotificationInput as aj, type ServerTimestampSentinel as ak, type SignInOptions as al, type SignOutResult as am, type SqlOptions as an, type SupportNamespace as ao, type SupportSeverity as ap, type SupportStatus as aq, type SupportTicket as ar, type SyncErrorEvent as as, type SyncState as at, type TelemetryEventAck as au, type TelemetryEventInput as av, type TelemetryLogAck as aw, type TelemetryLogInput as ax, type Unsubscribe as ay, type UsageEventInput as az, type AiChatOptions as b, type AiChatResult as c, type AiChatUsage as d, type AiContentPart as e, type AiImageUrlPart as f, type AiNamespace as g, type AiResponseFormat as h, type AiStreamHandle as i, type AiStreamMeta as j, type AiTextPart as k, type AuthNamespace as l, type AuthStateListener as m, type CatalogListResponse as n, type CheckoutAuthOpts as o, type CheckoutIntentInfo as p, type CheckoutIntentStatus as q, type CheckoutNamespace as r, type CheckoutStartInput as s, type CheckoutStartResult as t, type CheckoutTenantType as u, type CompleteSignInResult as v, type ConflictRecord as w, type CreateOfflineDocumentsOptions as x, type CreateTicketInput as y, type DbBatchOp as z };

package/dist/usage.cjs

@@ -108,7 +108,7 @@ function V(e, t) {
 }
 function q() {
   try {
-    return "3.8.0";
+    return "3.9.0";
   } catch {
     return;
   }

package/dist/usage.d.cts

@@ -1,4 +1,4 @@
-import { ah as ResolvedConfig, ay as UsageNamespace } from './types-D-9bjlM0.cjs';
+import { ai as ResolvedConfig, aA as UsageNamespace } from './types-Bl_4HROd.cjs';
 import 'drizzle-orm/node-postgres';
 import './errors.cjs';
 

package/dist/usage.d.ts

@@ -1,4 +1,4 @@
-import { ah as ResolvedConfig, ay as UsageNamespace } from './types-bVztFQTI.js';
+import { ai as ResolvedConfig, aA as UsageNamespace } from './types-Bqnsqvow.js';
 import 'drizzle-orm/node-postgres';
 import './errors.js';
 

package/dist/usage.mjs

@@ -106,7 +106,7 @@ function V(e, t) {
 }
 function q() {
   try {
-    return "3.8.0";
+    return "3.9.0";
   } catch {
     return;
   }

package/dist/webhooks.cjs

@@ -108,7 +108,7 @@ function X(t, e) {
 }
 function $() {
   try {
-    return "3.8.0";
+    return "3.9.0";
   } catch {
     return;
   }

package/dist/webhooks.d.cts

@@ -1,3 +1,3 @@
-export { V as MockWebhooks, ag as RegisterWebhookInput, aB as VerifyWebhookRequestOptions, aC as VerifyWebhookRequestResult, aD as WebhookEndpoint, aE as WebhookEvent, aF as WebhookScopeOptions, aG as WebhookTestResult, aH as WebhooksNamespace, aP as createWebhooksNamespace, aW as verifyWebhookRequest, aX as verifyWebhookSignature } from './types-D-9bjlM0.cjs';
+export { V as MockWebhooks, ag as RegisterWebhookInput, aD as VerifyWebhookRequestOptions, aE as VerifyWebhookRequestResult, aF as WebhookEndpoint, aG as WebhookEvent, aH as WebhookScopeOptions, aI as WebhookTestResult, aJ as WebhooksNamespace, aR as createWebhooksNamespace, aY as verifyWebhookRequest, aZ as verifyWebhookSignature } from './types-Bl_4HROd.cjs';
 import 'drizzle-orm/node-postgres';
 import './errors.cjs';

package/dist/webhooks.d.ts

@@ -1,3 +1,3 @@
-export { V as MockWebhooks, ag as RegisterWebhookInput, aB as VerifyWebhookRequestOptions, aC as VerifyWebhookRequestResult, aD as WebhookEndpoint, aE as WebhookEvent, aF as WebhookScopeOptions, aG as WebhookTestResult, aH as WebhooksNamespace, aP as createWebhooksNamespace, aW as verifyWebhookRequest, aX as verifyWebhookSignature } from './types-bVztFQTI.js';
+export { V as MockWebhooks, ag as RegisterWebhookInput, aD as VerifyWebhookRequestOptions, aE as VerifyWebhookRequestResult, aF as WebhookEndpoint, aG as WebhookEvent, aH as WebhookScopeOptions, aI as WebhookTestResult, aJ as WebhooksNamespace, aR as createWebhooksNamespace, aY as verifyWebhookRequest, aZ as verifyWebhookSignature } from './types-Bqnsqvow.js';
 import 'drizzle-orm/node-postgres';
 import './errors.js';

package/dist/webhooks.mjs

@@ -106,7 +106,7 @@ function X(t, e) {
 }
 function $() {
   try {
-    return "3.8.0";
+    return "3.9.0";
   } catch {
     return;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neetru/sdk",
-  "version": "3.8.0",
+  "version": "3.9.0",
   "description": "Neetru SDK 3.0 — biblioteca runtime universal (browser/Node/Edge) para consumir o ecossistema Neetru. Paths canonical /api/sdk/v1/*, productId obrigatório, Idempotency-Key em mutations, WebCrypto signatures, baseUrl allowlist fail-closed.",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -130,6 +130,7 @@
   "sideEffects": false,
   "scripts": {
     "build": "tsup",
+    "postbuild": "node scripts/browser-bundle-guard.mjs",
     "dev": "NEETRU_SDK_DEV=1 tsup --watch --sourcemap",
     "test": "vitest run",
     "test:coverage": "vitest run --coverage",
@@ -138,6 +139,13 @@
     "prepare": "node -e \"try{if(require('fs').existsSync('.git'))require('child_process').execFileSync('git',['config','core.hooksPath','.githooks'],{stdio:'ignore'})}catch{}\"",
     "prepublishOnly": "npm run build"
   },
+  "neetru": {
+    "prePush": [
+      "lint",
+      "build",
+      "test"
+    ]
+  },
   "files": [
     "dist",
     "README.md",