@eva_solutions/auth-sdk 0.0.0-stage → 3.0.0-dev-20261107051125

package/dist/contracts/index.d.cts

@@ -0,0 +1,488 @@
+import { $ as addGrupoEmpresaRequestSchema, $n as updateServiceClientRequestSchema, $r as LoginRequest, $t as createSucursalRequestSchema, A as autorizacionResponseSchema, An as GetServiceClientResponse, Ar as UsersBatchResponse, At as CreateEmpresaRequest, B as verificarAutorizacionResponseSchema, Bn as UpdateServiceClientResponse, Br as PublicProfile, Bt as ListEmpresasQuery, C as DeleteAutorizacionRequest, Ci as PRIVACY_STATES, Cn as ServiceTokenRequest, Cr as rotateSubscriptionSecretResponseSchema, Ct as UpdateProductoRequest, D as SetProductoPermisosAutorizablesRequest, Dn as serviceTokenResponseSchema, Dr as subscriptionWithSecretResponseSchema, Dt as productoSchema, E as ProductoPermisosAutorizablesResponse, Ei as WEBHOOK_TIMESTAMP_WINDOW_SECONDS, En as serviceTokenRequestSchema, Er as subscriptionSchema, Et as productoResponseSchema, F as listAutorizacionesQuerySchema, Fn as ServiceClientGrant, Fr as sessionListResponseSchema, Ft as EmpresaMemberResponse, G as directorioQuerySchema, Gn as listServiceClientsResponseSchema, Gr as companySchema, Gt as Sucursal, H as DirectorioQuery, Hn as createServiceClientResponseSchema, Hr as UpdateUserRequest, Ht as ReassignTitularRequest, I as listAutorizacionesResponseSchema, In as ServiceClientPublic, Ir as Company, It as EmpresaPerfil, J as CreateGrupoRequest, Jn as serviceClientGrantSchema, Jr as publicProfileSchema, Jt as UpdateEmpresaMemberRequest, K as directorioResponseSchema, Kn as restoreUserResponseSchema, Kr as contractedCompanySchema, Kt as SucursalRecortada, L as productoPermisosAutorizablesResponseSchema, Ln as SetServiceClientGrantRequest, Lr as CompanyListResponse, Lt as EmpresaRecortadaResponse, M as createAutorizacionRequestSchema, Mn as ListServiceClientsResponse, Mr as usersBatchResponseSchema, Mt as DeactivateSucursalRequest, N as deleteAutorizacionRequestSchema, Nn as RestoreUserResponse, Nr as Session, Nt as EmpresaDetailResponse, O as VerificarAutorizacionQuery, On as CreateServiceClientRequest, Or as updateSubscriptionRequestSchema, Ot as updateProductoRequestSchema, P as interEmpresaPermissionSchema, Pn as RotateServiceClientSecretResponse, Pr as SessionListResponse, Pt as EmpresaEstadoResponse, Q as RenameGrupoRequest, Qn as setServiceClientGrantResponseSchema, Qr as GetCodeResponse, Qt as createEmpresaRequestSchema, R as setProductoPermisosAutorizablesRequestSchema, Rn as SetServiceClientGrantResponse, Rr as ContractedCompany, Rt as EmpresaResponse, S as CreateAutorizacionRequest, Si as INTERNAL_HEADERS, Sn as ServiceTokenError, Sr as republishPendingResponseSchema, St as ProductoResponse, T as ListAutorizacionesResponse, Ti as WEBHOOK_HEADERS, Tn as serviceTokenErrorSchema, Tr as subscriptionResponseSchema, Tt as listProductosResponseSchema, U as DirectorioResponse, Un as getServiceClientResponseSchema, Ur as companyGroupSchema, Ut as ReassignTitularResponse, V as DirectorioEmpresa, Vn as createServiceClientRequestSchema, Vr as UncontractedCompany, Vt as ListEmpresasResponse, W as directorioEmpresaSchema, Wn as listServiceClientGrantsResponseSchema, Wr as companyListResponseSchema, Wt as RemoveEmpresaMemberRequest, X as GrupoResponse, Xn as serviceClientSlugSchema, Xr as updateUserRequestSchema, Xt as UpdateSucursalRequest, Y as Grupo, Yn as serviceClientPublicSchema, Yr as uncontractedCompanySchema, Yt as UpdateEmpresaRequest, Z as RemoveGrupoEmpresaRequest, Zn as setServiceClientGrantRequestSchema, Zr as GetCodeRequest, Zt as addEmpresaMemberRequestSchema, _ as serviceClientDelegationSchema, _i as ACTIVITY_STATES, _n as sucursalSchema, _r as createSubscriptionRequestSchema, _t as tokenExchangeRequestSchema, a as empresaBranchEventPayloadSchema, ai as loginRequestSchema, an as empresaRecortadaResponseSchema, ar as CreateSubscriptionRequest, at as Contratacion, b as Autorizacion, bi as ERROR_CODES, bn as updateEmpresaRequestSchema, br as deliverySchema, bt as ListProductosResponse, c as empresaMemberRoleChangedPayloadSchema, ci as setActiveEmpresaRequestSchema, cn as listEmpresasQuerySchema, cr as DeliveryListResponse, ct as SetContratacionRequest, d as grupoMemberEventPayloadSchema, di as MessageWithCountResponse, dn as reassignTitularResponseSchema, dr as RotateSubscriptionSecretResponse, dt as contratadoResponseSchema, ei as LoginResponse, en as deactivateSucursalRequestSchema, er as updateServiceClientResponseSchema, et as createGrupoRequestSchema, f as ListServiceClientDelegationsResponse, fi as messageResponseSchema, fn as removeEmpresaMemberRequestSchema, fr as Subscription, ft as setContratacionRequestSchema, g as listServiceClientDelegationsResponseSchema, gi as ACCOUNT_STATES, gn as sucursalResponseSchema, gr as UpdateSubscriptionRequest, gt as tokenExchangeErrorSchema, h as SetServiceClientDelegationResponse, hi as errorResponseSchema, hn as sucursalRecortadaSchema, hr as SubscriptionWithSecretResponse, ht as TokenExchangeResponse, i as autorizacionEventPayloadSchema, ii as getCodeResponseSchema, in as empresaPerfilSchema, ir as maintenanceCleanupResponseSchema, it as renameGrupoRequestSchema, j as autorizacionSchema, jn as ListServiceClientGrantsResponse, jr as usersBatchRequestSchema, jt as CreateSucursalRequest, k as VerificarAutorizacionResponse, kn as CreateServiceClientResponse, kr as UsersBatchRequest, kt as AddEmpresaMemberRequest, l as empresaProductChangedPayloadSchema, li as setActiveEmpresaResponseSchema, ln as listEmpresasResponseSchema, lr as RepublishPendingQuery, lt as contratacionResponseSchema, m as SetServiceClientDelegationRequest, mi as ErrorResponse, mn as subjectTokenSchema, mr as SubscriptionResponse, mt as TokenExchangeRequest, n as EmpresaProductChangedPayload, ni as SetActiveEmpresaResponse, nn as empresaEstadoResponseSchema, nr as MaintenanceCleanupResponse, nt as grupoSchema, o as empresaEventPayloadSchema, oi as loginResponseSchema, on as empresaResponseSchema, or as DeliveriesQuery, ot as ContratacionResponse, p as ServiceClientDelegation, pi as messageWithCountResponseSchema, pn as subjectTokenRequestSchema, pr as SubscriptionListResponse, pt as TokenExchangeError, q as AddGrupoEmpresaRequest, qn as rotateServiceClientSecretResponseSchema, qr as profileResponseSchema, qt as SucursalResponse, r as IDENTITY_EVENT_PAYLOAD_SCHEMAS, ri as getCodeRequestSchema, rn as empresaMemberResponseSchema, rr as maintenanceCleanupQuerySchema, rt as removeGrupoEmpresaRequestSchema, s as empresaMemberEventPayloadSchema, si as productoSlugSchema, sn as getEmpresaResponseSchema, sr as Delivery, st as ContratadoResponse, t as AutorizacionEventPayload, ti as SetActiveEmpresaRequest, tn as empresaDetailResponseSchema, tr as MaintenanceCleanupQuery, tt as grupoResponseSchema, u as grupoEventPayloadSchema, ui as MessageResponse, un as reassignTitularRequestSchema, ur as RepublishPendingResponse, ut as contratacionSchema, v as setServiceClientDelegationRequestSchema, vi as CoreErrorCode, vn as updateEmpresaMemberRequestSchema, vr as deliveriesQuerySchema, vt as tokenExchangeResponseSchema, w as ListAutorizacionesQuery, wi as USERS_BATCH_MAX_IDS, wn as ServiceTokenResponse, wr as subscriptionListResponseSchema, wt as createProductoRequestSchema, x as AutorizacionResponse, xi as HEADERS, xn as updateSucursalRequestSchema, xr as republishPendingQuerySchema, xt as Producto, y as setServiceClientDelegationResponseSchema, yi as DELIVERY_STATUSES, yn as updateEmpresaPerfilSchema, yr as deliveryListResponseSchema, yt as CreateProductoRequest, z as verificarAutorizacionQuerySchema, zn as UpdateServiceClientRequest, zr as ProfileResponse, zt as GetEmpresaResponse } from "../index-Dold-Ycb.cjs";
+import { n as EventCode, t as EVENT_CODES } from "../event-codes-BgcJWsov.cjs";
+import { _ as isInterEmpresaPermission, a as DelegableScope, c as InterEmpresaOwner, d as SERVICE_AUDIENCE_SCOPES, f as ServiceAudience, g as isDelegableScope, h as isDelegableAudience, i as DelegableAudience, l as InterEmpresaPermission, m as interEmpresaPermissionOwner, n as DELEGABLE_AUDIENCE_SCOPES, o as INTER_EMPRESA_PERMISSIONS, p as ServiceScope, r as DELEGABLE_SCOPES, s as INTER_EMPRESA_PERMISSION_LIST, t as DELEGABLE_AUDIENCES, u as SERVICE_AUDIENCES, v as isScopeOfAudience, y as isServiceAudience } from "../catalog-CIqpzgsM.cjs";
+/**
+ * PURE module: it must never reference `zod` or any schema module of this package (see
+ * `constants.ts`). Token vocabulary shared by the Auth service and every consumer: issuer, token
+ * types, key prefixes, lifetimes and the token endpoint error codes.
+ */
+/** Issuer (`iss`) of every token the Auth service signs. */
+declare const TOKEN_ISSUER = "auth-service";
+/**
+ * Service client slugs nobody can create: the token issuer name (an `iss`-like value would let a
+ * client pass for the service itself).
+ */
+declare const RESERVED_SERVICE_CLIENT_SLUGS: readonly ["auth-service"];
+/** True when `slug` is reserved and cannot be used as a service client slug. */
+declare function isReservedServiceClientSlug(slug: string): boolean;
+/**
+ * Fixed id (`sub`) of the Auth service itself when it mints its own service tokens (the OTP send).
+ * Receivers register it like any other service client id.
+ */
+declare const AUTH_SERVICE_SUB = "00000000-0000-4000-8000-000000000001";
+/** Header `typ` of a user access token (RFC 9068). */
+declare const USER_TOKEN_TYP = "at+jwt";
+/** Header `typ` of a service access token. Distinct from the user one on purpose (RFC 8725 3.11). */
+declare const SERVICE_TOKEN_TYP = "svc-at+jwt";
+/** The `kid` of a user signing key starts with this prefix. */
+declare const USER_KID_PREFIX = "usr-";
+/** The `kid` of a service signing key starts with this prefix. */
+declare const SERVICE_KID_PREFIX = "svc-";
+/** Lifetime in seconds of a service token obtained from the token endpoint. */
+declare const SERVICE_TOKEN_LIFETIME_SECONDS = 300;
+/** Lifetime in seconds of the single-use service token Auth mints in-process per OTP send. */
+declare const INTERNAL_SERVICE_TOKEN_LIFETIME_SECONDS = 60;
+/**
+ * Error codes of the token endpoint (RFC 6749 5.2 and RFC 8707 2). Throttling a client has no
+ * code of its own: it answers `429` with `temporarily_unavailable` and a `Retry-After` header (the
+ * SDK token provider reads both).
+ */
+declare const SERVICE_TOKEN_ERROR_CODES: readonly ["invalid_request", "invalid_client", "invalid_target", "invalid_scope", "temporarily_unavailable"];
+/**
+ * Header `typ` of a delegated access token (token exchange, RFC 8693). A third type, distinct from
+ * the user and service ones: it is signed with a SERVICE key (`svc-` kid) but no service verifier
+ * accepts it, and the delegated verifier accepts nothing else.
+ */
+declare const DELEGATED_TOKEN_TYP = "dlg-at+jwt";
+/** Lifetime in seconds of a delegated token (`exp` never exceeds the one of the subject token). */
+declare const DELEGATED_TOKEN_LIFETIME_SECONDS = 120;
+/**
+ * Most levels the `act` (actor) chain of a delegated token can have. A delegated token that
+ * already has this many levels cannot be exchanged again.
+ */
+declare const DELEGATED_TOKEN_MAX_DEPTH = 3;
+/** `grant_type` of the token exchange request (RFC 8693 2.1). */
+declare const TOKEN_EXCHANGE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange";
+/**
+ * Token type identifier for `subject_token_type` (what is exchanged) and `issued_token_type` (what
+ * comes back): both are JWT access tokens (RFC 8693 3).
+ */
+declare const ACCESS_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:access_token";
+/**
+ * Claims of a delegated token (the `act` claim, RFC 8693 4.1): who acts on behalf of the user.
+ * `act` of the token is the LAST actor; each nested `act` is the previous one.
+ */
+type DelegatedActorClaim = {
+  sub: string;
+  client_id: string;
+  act?: DelegatedActorClaim;
+};
+/**
+ * Header with which a service sends the access token of a person on the requests that cannot carry
+ * a body (the `GET` that needs a person's role). Every other person-bound request carries it as
+ * `subjectToken` in the body.
+ */
+declare const SUBJECT_TOKEN_HEADER = "x-eva-subject-token";
+/**
+ * Error codes of the token exchange endpoint (RFC 6749 5.2, RFC 8693 2.2.2 and RFC 8707 2).
+ * `invalid_grant`: the subject token or what it depends on (session, user, membership, company,
+ * contract, depth, cycle) is not valid. Throttling answers `429` with `temporarily_unavailable`.
+ */
+declare const TOKEN_EXCHANGE_ERROR_CODES: readonly ["invalid_request", "invalid_client", "invalid_grant", "invalid_target", "invalid_scope", "temporarily_unavailable"];
+/**
+ * Failure of the PERSON's token (`subjectToken`) on a person-bound request: invalid, expired, of
+ * another product, or its session/user is gone. It answers `403` with this code, never `401`: a
+ * `401` on `/internal/*` means the service Bearer was rejected (the S2S client then drops its
+ * service token and retries once), and a bad person token must not trigger that.
+ */
+declare const SUBJECT_TOKEN_INVALID_STATUS = 403;
+declare const SUBJECT_TOKEN_INVALID_CODE = "subject_token_invalid";
+/**
+ * Keys that carry a person or service token in bodies, headers and token endpoint answers. The
+ * Auth API redacts them in logs and audit records. It is ADDED to the consumer's own redaction
+ * list (which already covers `refresh_token`, `authorization` and the like); it does not replace it.
+ */
+declare const TOKEN_BEARING_KEYS: readonly ["subjectToken", "subject_token", "x-eva-subject-token", "access_token"];
+/**
+ * PURE module: it must never reference `zod` or any schema module of this package (see
+ * `constants.ts`). Vocabulary of companies shared by the API, the SDK and the products: roles,
+ * company and contract states, directions of an authorization listing.
+ */
+/** Role of a person in a company, from the most to the least powerful. Auth reads it from the DB on every operation. */
+declare const EMPRESA_ROLES: readonly ["titular", "administrador", "miembro"];
+type EmpresaRole = (typeof EMPRESA_ROLES)[number];
+/** True when `role` is at least `minimum` (`titular` > `administrador` > `miembro`). */
+declare function empresaRoleAtLeast(role: EmpresaRole, minimum: EmpresaRole): boolean;
+/** States of a company. A company in `baja` answers 404 to every mutation except `reactivar`. */
+declare const EMPRESA_ESTADOS: readonly ["activa", "baja"];
+type EmpresaEstado = (typeof EMPRESA_ESTADOS)[number];
+/** States of the contract of a product by a company (`empresa_productos.estado`). */
+declare const CONTRATACION_ESTADOS: readonly ["prueba", "pendiente_pago", "activo", "suspendido", "cancelado"];
+type ContratacionEstado = (typeof CONTRATACION_ESTADOS)[number];
+/**
+ * The only states that count as contracted (and only while `hasta` is empty or in the future; Auth
+ * evaluates it on every read, no event fires when `hasta` passes).
+ */
+declare const CONTRATACION_ESTADOS_VIGENTES: readonly ["prueba", "activo"];
+/** States billing or the Auth admin can write on any contract row (a product only asks for `pendiente_pago` or `cancelado`). */
+declare const CONTRATACION_ESTADOS_FACTURACION: readonly ["prueba", "activo", "suspendido", "cancelado"];
+/** True when a contract in `estado` counts as contracted, ignoring `hasta`. */
+declare function isContratacionVigente(estado: ContratacionEstado): boolean;
+/** Directions of the authorizations listing of a company. */
+declare const AUTORIZACION_DIRECCIONES: readonly ["otorgadas", "recibidas"];
+type AutorizacionDireccion = (typeof AUTORIZACION_DIRECCIONES)[number];
+/** What happens to the previous holder when the Auth admin reassigns the holder of a company. */
+declare const TITULAR_ANTERIOR_DESTINOS: readonly ["miembro", "fuera"];
+type TitularAnteriorDestino = (typeof TITULAR_ANTERIOR_DESTINOS)[number];
+/**
+ * PURE module: it must never reference `zod` or any schema module of this package (see
+ * `constants.ts`). Routes are plain data.
+ */
+/** Version prefix of every Auth route except the root ones (JWKS, health, docs UI). */
+declare const API_PREFIX: "/api/v1";
+type HttpMethod = 'get' | 'post' | 'put' | 'patch' | 'delete';
+/**
+ * Route as data: `path` is relative to {@link API_PREFIX} and uses the OpenAPI template form
+ * (`/sessions/{id}`). `createRoute` stays in the API; the contract only describes the route.
+ */
+type RouteDescriptor = {
+  readonly method: HttpMethod;
+  readonly path: `/${string}`;
+};
+/** Routes of the authenticated user profile. Relative to {@link API_PREFIX}. */
+declare const USER_ROUTES: {
+  readonly get: {
+    readonly method: "get";
+    readonly path: "/user";
+  };
+  readonly update: {
+    readonly method: "patch";
+    readonly path: "/user";
+  };
+  readonly deactivate: {
+    readonly method: "delete";
+    readonly path: "/user";
+  };
+  readonly listCompanies: {
+    readonly method: "get";
+    readonly path: "/user/empresas";
+  };
+};
+/** Routes of the authenticated user sessions. Relative to {@link API_PREFIX}. */
+declare const SESSION_ROUTES: {
+  readonly list: {
+    readonly method: "get";
+    readonly path: "/sessions";
+  };
+  readonly deleteOne: {
+    readonly method: "delete";
+    readonly path: "/sessions/{id}";
+  };
+  readonly deleteAll: {
+    readonly method: "delete";
+    readonly path: "/sessions";
+  };
+};
+/** Service-to-service user lookups. Relative to {@link API_PREFIX}. */
+declare const INTERNAL_USER_ROUTES: {
+  readonly get: {
+    readonly method: "get";
+    readonly path: "/internal/users/{id}";
+  };
+  readonly batch: {
+    readonly method: "post";
+    readonly path: "/internal/users/batch";
+  };
+};
+/**
+ * Service token endpoint. The only service-to-service route that authenticates with the signed
+ * request of the service client. Relative to {@link API_PREFIX}.
+ */
+declare const INTERNAL_TOKEN_ROUTES: {
+  readonly issue: {
+    readonly method: "post";
+    readonly path: "/internal/token";
+  };
+};
+/**
+ * Token exchange (RFC 8693). Authenticated with the Bearer service token of the actor
+ * (`aud: auth-api`, permission `tokens:exchange`), not with the signed request. Relative to
+ * {@link API_PREFIX}.
+ */
+declare const INTERNAL_TOKEN_EXCHANGE_ROUTES: {
+  readonly exchange: {
+    readonly method: "post";
+    readonly path: "/internal/token-exchange";
+  };
+};
+/**
+ * Companies, branches, members, contracts and authorizations, service-to-service (Bearer service
+ * token plus, where a person acts, the `subjectToken`). Relative to {@link API_PREFIX}.
+ */
+declare const INTERNAL_EMPRESA_ROUTES: {
+  readonly create: {
+    readonly method: "post";
+    readonly path: "/internal/empresas";
+  };
+  readonly list: {
+    readonly method: "get";
+    readonly path: "/internal/empresas";
+  };
+  readonly get: {
+    readonly method: "get";
+    readonly path: "/internal/empresas/{id}";
+  };
+  readonly update: {
+    readonly method: "patch";
+    readonly path: "/internal/empresas/{id}";
+  };
+  readonly baja: {
+    readonly method: "post";
+    readonly path: "/internal/empresas/{id}/baja";
+  };
+  readonly reactivar: {
+    readonly method: "post";
+    readonly path: "/internal/empresas/{id}/reactivar";
+  };
+  readonly addMember: {
+    readonly method: "post";
+    readonly path: "/internal/empresas/{id}/miembros";
+  };
+  readonly updateMember: {
+    readonly method: "patch";
+    readonly path: "/internal/empresas/{id}/miembros/{userId}";
+  };
+  readonly removeMember: {
+    readonly method: "delete";
+    readonly path: "/internal/empresas/{id}/miembros/{userId}";
+  };
+  readonly createBranch: {
+    readonly method: "post";
+    readonly path: "/internal/empresas/{id}/sucursales";
+  };
+  readonly updateBranch: {
+    readonly method: "patch";
+    readonly path: "/internal/empresas/{id}/sucursales/{sucursalId}";
+  };
+  readonly deactivateBranch: {
+    readonly method: "delete";
+    readonly path: "/internal/empresas/{id}/sucursales/{sucursalId}";
+  };
+  readonly requestContratacion: {
+    readonly method: "post";
+    readonly path: "/internal/empresas/{id}/productos";
+  };
+  readonly cancelContratacion: {
+    readonly method: "delete";
+    readonly path: "/internal/empresas/{id}/productos";
+  };
+  readonly getContratacion: {
+    readonly method: "get";
+    readonly path: "/internal/empresas/{id}/productos/{producto}";
+  };
+  readonly setContratacion: {
+    readonly method: "put";
+    readonly path: "/internal/empresas/{id}/productos/{producto}";
+  };
+  readonly createAutorizacion: {
+    readonly method: "post";
+    readonly path: "/internal/empresas/{id}/autorizaciones";
+  };
+  readonly listAutorizaciones: {
+    readonly method: "get";
+    readonly path: "/internal/empresas/{id}/autorizaciones";
+  };
+  readonly deleteAutorizacion: {
+    readonly method: "delete";
+    readonly path: "/internal/empresas/{id}/autorizaciones/{autorizacionId}";
+  };
+};
+/** Groups of companies, service-to-service. Relative to {@link API_PREFIX}. */
+declare const INTERNAL_GRUPO_ROUTES: {
+  readonly create: {
+    readonly method: "post";
+    readonly path: "/internal/grupos";
+  };
+  readonly rename: {
+    readonly method: "patch";
+    readonly path: "/internal/grupos/{id}";
+  };
+  readonly addEmpresa: {
+    readonly method: "post";
+    readonly path: "/internal/grupos/{id}/empresas";
+  };
+  readonly removeEmpresa: {
+    readonly method: "delete";
+    readonly path: "/internal/grupos/{id}/empresas/{empresaId}";
+  };
+};
+/**
+ * Authorization check, service-to-service: only for actors whose audience owns the permission
+ * (the actor may also have a product). Relative to {@link API_PREFIX}.
+ */
+declare const INTERNAL_AUTORIZACION_ROUTES: {
+  readonly verificar: {
+    readonly method: "get";
+    readonly path: "/internal/autorizaciones/verificar";
+  };
+};
+/**
+ * Directory of companies: users with the access token of any enabled product, and services with
+ * `directorio:leer`. Relative to {@link API_PREFIX}.
+ */
+declare const DIRECTORIO_ROUTES: {
+  readonly search: {
+    readonly method: "get";
+    readonly path: "/directorio";
+  };
+};
+/**
+ * Webhook subscription and delivery routes of the service-to-service surface. Relative to
+ * {@link API_PREFIX}.
+ */
+declare const WEBHOOK_ROUTES: {
+  readonly createSubscription: {
+    readonly method: "post";
+    readonly path: "/internal/webhooks/subscriptions";
+  };
+  readonly listSubscriptions: {
+    readonly method: "get";
+    readonly path: "/internal/webhooks/subscriptions";
+  };
+  readonly getSubscription: {
+    readonly method: "get";
+    readonly path: "/internal/webhooks/subscriptions/{id}";
+  };
+  readonly updateSubscription: {
+    readonly method: "patch";
+    readonly path: "/internal/webhooks/subscriptions/{id}";
+  };
+  readonly deleteSubscription: {
+    readonly method: "delete";
+    readonly path: "/internal/webhooks/subscriptions/{id}";
+  };
+  readonly rotateSubscriptionSecret: {
+    readonly method: "post";
+    readonly path: "/internal/webhooks/subscriptions/{id}/rotate-secret";
+  };
+  readonly listDeliveries: {
+    readonly method: "get";
+    readonly path: "/internal/webhooks/deliveries";
+  };
+};
+/**
+ * Admin routes: service client provisioning (grants, delegations), products, company holder/baja/contract operations, user restore, webhook delivery republish and maintenance cleanup. Relative to {@link API_PREFIX}.
+ */
+declare const ADMIN_ROUTES: {
+  readonly createServiceClient: {
+    readonly method: "post";
+    readonly path: "/admin/service-clients";
+  };
+  readonly listServiceClients: {
+    readonly method: "get";
+    readonly path: "/admin/service-clients";
+  };
+  readonly getServiceClient: {
+    readonly method: "get";
+    readonly path: "/admin/service-clients/{slug}";
+  };
+  readonly updateServiceClient: {
+    readonly method: "patch";
+    readonly path: "/admin/service-clients/{slug}";
+  };
+  readonly deleteServiceClient: {
+    readonly method: "delete";
+    readonly path: "/admin/service-clients/{slug}";
+  };
+  readonly rotateServiceClientSecret: {
+    readonly method: "post";
+    readonly path: "/admin/service-clients/{slug}/rotate-secret";
+  };
+  readonly listServiceClientGrants: {
+    readonly method: "get";
+    readonly path: "/admin/service-clients/{slug}/grants";
+  };
+  readonly setServiceClientGrant: {
+    readonly method: "put";
+    readonly path: "/admin/service-clients/{slug}/grants";
+  };
+  readonly deleteServiceClientGrant: {
+    readonly method: "delete";
+    readonly path: "/admin/service-clients/{slug}/grants/{audience}";
+  };
+  readonly listServiceClientDelegations: {
+    readonly method: "get";
+    readonly path: "/admin/service-clients/{slug}/delegations";
+  };
+  readonly setServiceClientDelegation: {
+    readonly method: "put";
+    readonly path: "/admin/service-clients/{slug}/delegations";
+  };
+  readonly deleteServiceClientDelegation: {
+    readonly method: "delete";
+    readonly path: "/admin/service-clients/{slug}/delegations/{audience}";
+  };
+  readonly listProductos: {
+    readonly method: "get";
+    readonly path: "/admin/productos";
+  };
+  readonly createProducto: {
+    readonly method: "post";
+    readonly path: "/admin/productos";
+  };
+  readonly updateProducto: {
+    readonly method: "patch";
+    readonly path: "/admin/productos/{slug}";
+  };
+  readonly getProductoPermisosAutorizables: {
+    readonly method: "get";
+    readonly path: "/admin/productos/{slug}/permisos-autorizables";
+  };
+  readonly setProductoPermisosAutorizables: {
+    readonly method: "put";
+    readonly path: "/admin/productos/{slug}/permisos-autorizables";
+  };
+  readonly reassignEmpresaTitular: {
+    readonly method: "post";
+    readonly path: "/admin/empresas/{id}/titular";
+  };
+  readonly bajaEmpresa: {
+    readonly method: "post";
+    readonly path: "/admin/empresas/{id}/baja";
+  };
+  readonly reactivarEmpresa: {
+    readonly method: "post";
+    readonly path: "/admin/empresas/{id}/reactivar";
+  };
+  readonly setContratacion: {
+    readonly method: "put";
+    readonly path: "/admin/empresas/{id}/productos/{producto}";
+  };
+  readonly restoreUser: {
+    readonly method: "post";
+    readonly path: "/admin/users/{id}/restore";
+  };
+  readonly republishPendingWebhooks: {
+    readonly method: "post";
+    readonly path: "/admin/webhooks/republish-pending";
+  };
+  readonly maintenanceCleanup: {
+    readonly method: "post";
+    readonly path: "/admin/maintenance/cleanup";
+  };
+};
+/** Login, refresh, logout and active company routes. Relative to {@link API_PREFIX}. */
+declare const AUTH_ROUTES: {
+  readonly getCode: {
+    readonly method: "post";
+    readonly path: "/login/get-code";
+  };
+  readonly login: {
+    readonly method: "post";
+    readonly path: "/login";
+  };
+  readonly refresh: {
+    readonly method: "post";
+    readonly path: "/login/refresh";
+  };
+  readonly logout: {
+    readonly method: "post";
+    readonly path: "/login/logout";
+  };
+  readonly setActiveEmpresa: {
+    readonly method: "post";
+    readonly path: "/auth/empresa-activa";
+  };
+};
+export { ACCESS_TOKEN_TYPE, ACCOUNT_STATES, ACTIVITY_STATES, ADMIN_ROUTES, API_PREFIX, AUTH_ROUTES, AUTH_SERVICE_SUB, AUTORIZACION_DIRECCIONES, AddEmpresaMemberRequest, AddGrupoEmpresaRequest, Autorizacion, AutorizacionDireccion, AutorizacionEventPayload, AutorizacionResponse, CONTRATACION_ESTADOS, CONTRATACION_ESTADOS_FACTURACION, CONTRATACION_ESTADOS_VIGENTES, Company, CompanyListResponse, ContractedCompany, Contratacion, ContratacionEstado, ContratacionResponse, ContratadoResponse, CoreErrorCode, CreateAutorizacionRequest, CreateEmpresaRequest, CreateGrupoRequest, CreateProductoRequest, CreateServiceClientRequest, CreateServiceClientResponse, CreateSubscriptionRequest, CreateSucursalRequest, DELEGABLE_AUDIENCES, DELEGABLE_AUDIENCE_SCOPES, DELEGABLE_SCOPES, DELEGATED_TOKEN_LIFETIME_SECONDS, DELEGATED_TOKEN_MAX_DEPTH, DELEGATED_TOKEN_TYP, DELIVERY_STATUSES, DIRECTORIO_ROUTES, DeactivateSucursalRequest, DelegableAudience, DelegableScope, DelegatedActorClaim, DeleteAutorizacionRequest, DeliveriesQuery, Delivery, DeliveryListResponse, DirectorioEmpresa, DirectorioQuery, DirectorioResponse, EMPRESA_ESTADOS, EMPRESA_ROLES, ERROR_CODES, EVENT_CODES, EmpresaDetailResponse, EmpresaEstado, EmpresaEstadoResponse, EmpresaMemberResponse, EmpresaPerfil, EmpresaProductChangedPayload, EmpresaRecortadaResponse, EmpresaResponse, EmpresaRole, ErrorResponse, EventCode, GetCodeRequest, GetCodeResponse, GetEmpresaResponse, GetServiceClientResponse, Grupo, GrupoResponse, HEADERS, HttpMethod, IDENTITY_EVENT_PAYLOAD_SCHEMAS, INTERNAL_AUTORIZACION_ROUTES, INTERNAL_EMPRESA_ROUTES, INTERNAL_GRUPO_ROUTES, INTERNAL_HEADERS, INTERNAL_SERVICE_TOKEN_LIFETIME_SECONDS, INTERNAL_TOKEN_EXCHANGE_ROUTES, INTERNAL_TOKEN_ROUTES, INTERNAL_USER_ROUTES, INTER_EMPRESA_PERMISSIONS, INTER_EMPRESA_PERMISSION_LIST, InterEmpresaOwner, InterEmpresaPermission, ListAutorizacionesQuery, ListAutorizacionesResponse, ListEmpresasQuery, ListEmpresasResponse, ListProductosResponse, ListServiceClientDelegationsResponse, ListServiceClientGrantsResponse, ListServiceClientsResponse, LoginRequest, LoginResponse, MaintenanceCleanupQuery, MaintenanceCleanupResponse, MessageResponse, MessageWithCountResponse, PRIVACY_STATES, Producto, ProductoPermisosAutorizablesResponse, ProductoResponse, ProfileResponse, PublicProfile, RESERVED_SERVICE_CLIENT_SLUGS, ReassignTitularRequest, ReassignTitularResponse, RemoveEmpresaMemberRequest, RemoveGrupoEmpresaRequest, RenameGrupoRequest, RepublishPendingQuery, RepublishPendingResponse, RestoreUserResponse, RotateServiceClientSecretResponse, RotateSubscriptionSecretResponse, RouteDescriptor, SERVICE_AUDIENCES, SERVICE_AUDIENCE_SCOPES, SERVICE_KID_PREFIX, SERVICE_TOKEN_ERROR_CODES, SERVICE_TOKEN_LIFETIME_SECONDS, SERVICE_TOKEN_TYP, SESSION_ROUTES, SUBJECT_TOKEN_HEADER, SUBJECT_TOKEN_INVALID_CODE, SUBJECT_TOKEN_INVALID_STATUS, ServiceAudience, ServiceClientDelegation, ServiceClientGrant, ServiceClientPublic, ServiceScope, ServiceTokenError, ServiceTokenRequest, ServiceTokenResponse, Session, SessionListResponse, SetActiveEmpresaRequest, SetActiveEmpresaResponse, SetContratacionRequest, SetProductoPermisosAutorizablesRequest, SetServiceClientDelegationRequest, SetServiceClientDelegationResponse, SetServiceClientGrantRequest, SetServiceClientGrantResponse, Subscription, SubscriptionListResponse, SubscriptionResponse, SubscriptionWithSecretResponse, Sucursal, SucursalRecortada, SucursalResponse, TITULAR_ANTERIOR_DESTINOS, TOKEN_BEARING_KEYS, TOKEN_EXCHANGE_ERROR_CODES, TOKEN_EXCHANGE_GRANT_TYPE, TOKEN_ISSUER, TitularAnteriorDestino, TokenExchangeError, TokenExchangeRequest, TokenExchangeResponse, USERS_BATCH_MAX_IDS, USER_KID_PREFIX, USER_ROUTES, USER_TOKEN_TYP, UncontractedCompany, UpdateEmpresaMemberRequest, UpdateEmpresaRequest, UpdateProductoRequest, UpdateServiceClientRequest, UpdateServiceClientResponse, UpdateSubscriptionRequest, UpdateSucursalRequest, UpdateUserRequest, UsersBatchRequest, UsersBatchResponse, VerificarAutorizacionQuery, VerificarAutorizacionResponse, WEBHOOK_HEADERS, WEBHOOK_ROUTES, WEBHOOK_TIMESTAMP_WINDOW_SECONDS, addEmpresaMemberRequestSchema, addGrupoEmpresaRequestSchema, autorizacionEventPayloadSchema, autorizacionResponseSchema, autorizacionSchema, companyGroupSchema, companyListResponseSchema, companySchema, contractedCompanySchema, contratacionResponseSchema, contratacionSchema, contratadoResponseSchema, createAutorizacionRequestSchema, createEmpresaRequestSchema, createGrupoRequestSchema, createProductoRequestSchema, createServiceClientRequestSchema, createServiceClientResponseSchema, createSubscriptionRequestSchema, createSucursalRequestSchema, deactivateSucursalRequestSchema, deleteAutorizacionRequestSchema, deliveriesQuerySchema, deliveryListResponseSchema, deliverySchema, directorioEmpresaSchema, directorioQuerySchema, directorioResponseSchema, empresaBranchEventPayloadSchema, empresaDetailResponseSchema, empresaEstadoResponseSchema, empresaEventPayloadSchema, empresaMemberEventPayloadSchema, empresaMemberResponseSchema, empresaMemberRoleChangedPayloadSchema, empresaPerfilSchema, empresaProductChangedPayloadSchema, empresaRecortadaResponseSchema, empresaResponseSchema, empresaRoleAtLeast, errorResponseSchema, getCodeRequestSchema, getCodeResponseSchema, getEmpresaResponseSchema, getServiceClientResponseSchema, grupoEventPayloadSchema, grupoMemberEventPayloadSchema, grupoResponseSchema, grupoSchema, interEmpresaPermissionOwner, interEmpresaPermissionSchema, isContratacionVigente, isDelegableAudience, isDelegableScope, isInterEmpresaPermission, isReservedServiceClientSlug, isScopeOfAudience, isServiceAudience, listAutorizacionesQuerySchema, listAutorizacionesResponseSchema, listEmpresasQuerySchema, listEmpresasResponseSchema, listProductosResponseSchema, listServiceClientDelegationsResponseSchema, listServiceClientGrantsResponseSchema, listServiceClientsResponseSchema, loginRequestSchema, loginResponseSchema, maintenanceCleanupQuerySchema, maintenanceCleanupResponseSchema, messageResponseSchema, messageWithCountResponseSchema, productoPermisosAutorizablesResponseSchema, productoResponseSchema, productoSchema, productoSlugSchema, profileResponseSchema, publicProfileSchema, reassignTitularRequestSchema, reassignTitularResponseSchema, removeEmpresaMemberRequestSchema, removeGrupoEmpresaRequestSchema, renameGrupoRequestSchema, republishPendingQuerySchema, republishPendingResponseSchema, restoreUserResponseSchema, rotateServiceClientSecretResponseSchema, rotateSubscriptionSecretResponseSchema, serviceClientDelegationSchema, serviceClientGrantSchema, serviceClientPublicSchema, serviceClientSlugSchema, serviceTokenErrorSchema, serviceTokenRequestSchema, serviceTokenResponseSchema, sessionListResponseSchema, setActiveEmpresaRequestSchema, setActiveEmpresaResponseSchema, setContratacionRequestSchema, setProductoPermisosAutorizablesRequestSchema, setServiceClientDelegationRequestSchema, setServiceClientDelegationResponseSchema, setServiceClientGrantRequestSchema, setServiceClientGrantResponseSchema, subjectTokenRequestSchema, subjectTokenSchema, subscriptionListResponseSchema, subscriptionResponseSchema, subscriptionSchema, subscriptionWithSecretResponseSchema, sucursalRecortadaSchema, sucursalResponseSchema, sucursalSchema, tokenExchangeErrorSchema, tokenExchangeRequestSchema, tokenExchangeResponseSchema, uncontractedCompanySchema, updateEmpresaMemberRequestSchema, updateEmpresaPerfilSchema, updateEmpresaRequestSchema, updateProductoRequestSchema, updateServiceClientRequestSchema, updateServiceClientResponseSchema, updateSubscriptionRequestSchema, updateSucursalRequestSchema, updateUserRequestSchema, usersBatchRequestSchema, usersBatchResponseSchema, verificarAutorizacionQuerySchema, verificarAutorizacionResponseSchema };
+//# sourceMappingURL=index.d.cts.map

package/dist/contracts/index.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.cts","names":[],"sources":["../../../auth-contracts/dist/tokens.d.ts","../../../auth-contracts/dist/empresa-vocab.d.ts","../../../auth-contracts/dist/routes.d.ts"],"mappings":";;;;;;;;;cAMc;;;;;cAKA;;iBAEG,4BAA4B;;;;;cAK/B;;cAEA;;cAEA;;cAEA;;cAEA;;cAEA;;cAEA;;;;;;cAMA;;;;;;cAMA;;cAEA;;;;;cAKA;;cAEA;;;;;cAKA;;;;;KAKT;EACH;EACA;EACA,MAAM;;;;;;;cAOM;;;;;;cAMA;;;;;;;cAOA;cACA;;;;;;cAMA;;;;;;;cCrFA;KACT,sBAAsB;;iBAEV,mBAAmB,MAAM,aAAa,SAAS;;cAElD;KACT,wBAAwB;;cAEf;KACT,6BAA6B;;;;;cAKpB;;cAEA;;iBAEG,sBAAsB,QAAQ;;cAEjC;KACT,gCAAgC;;cAEvB;KACT,iCAAiC;;;;;;cCzBxB;KACT;;;;;KAKA;WACM,QAAQ;WACR;;;cAGG;WACH;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;;;cAIC;WACH;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;;;cAIC;WACH;aACE;aACA;;WAEF;aACE;aACA;;;;;;;cAOC;WACH;aACE;aACA;;;;;;;;cAQC;WACH;aACE;aACA;;;;;;;cAOC;WACH;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;;;cAIC;WACH;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;;;;;;cAOC;WACH;aACE;aACA;;;;;;;cAOC;WACH;aACE;aACA;;;;;;;cAOC;WACH;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;;;;;cAMC;WACH;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;;;cAIC;WACH;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA;;WAEF;aACE;aACA"}