@eva_solutions/auth-sdk 0.0.0-stage → 3.0.0-dev-20261107051125

package/dist/index.cjs

@@ -0,0 +1,89 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_http_client = require("./http-client-BVF3iktR.cjs");
+const require_jwt = require("./jwt-BBNqk0TV.cjs");
+const require_parse_error_response = require("./parse-error-response-6qOQS5y9.cjs");
+const require_constants = require("./constants-BE1_9Tod.cjs");
+const require_constants$1 = require("./constants-CcbhOaAP.cjs");
+const require_cookies = require("./cookies-DCIcr7uy.cjs");
+const require_error_helpers = require("./error-helpers-XCh4ZJ-g.cjs");
+const require_webhooks = require("./webhooks-Cx11psg1.cjs");
+const require_event_codes = require("./event-codes-BBJHon-I.cjs");
+const require_admin = require("./admin-Q6lbWqLM.cjs");
+const require_s2s = require("./s2s-6wbotr78.cjs");
+const require_sign = require("./sign-C7y6xdvT.cjs");
+const require_delegated_token = require("./delegated-token-DHSK4rHI.cjs");
+// src/client.ts
+function createEvaAuth() {
+	return { client: require_http_client.createHttpClient() };
+}
+// src/get-message.ts
+/**
+* Retorna el mensaje del EvaError independientemente de su kind.
+* Equivalente a `err.message` — helper para migración gradual desde 0.x.
+*/
+function getMessage(err) {
+	return err.message;
+}
+exports.ACCOUNT_STATES = require_constants$1.ACCOUNT_STATES;
+exports.ADMIN_ERROR_CODES = require_admin.ADMIN_ERROR_CODES;
+exports.AUTORIZACION_CACHE_TTL_MS = require_sign.AUTORIZACION_CACHE_TTL_MS;
+exports.COOKIE_MAX_AGE = require_constants.COOKIE_MAX_AGE;
+exports.DEFAULT_ERROR_MESSAGES = require_parse_error_response.DEFAULT_ERROR_MESSAGES;
+exports.EMPTY_BODY_SHA256_HEX = require_sign.EMPTY_BODY_SHA256_HEX;
+exports.ERROR_CODES = require_constants$1.ERROR_CODES;
+exports.EVENT_CODES = require_event_codes.EVENT_CODES;
+exports.HEADERS = require_constants$1.HEADERS;
+exports.JWT_CONFIG = require_constants.JWT_CONFIG;
+exports.S2S_ERROR_CODES = require_s2s.S2S_ERROR_CODES;
+exports.S2S_RESPONSE_HEADERS = require_sign.S2S_RESPONSE_HEADERS;
+exports.S2S_SCOPES = require_sign.S2S_SCOPES;
+exports.S2S_TIMESTAMP_WINDOW_SECONDS = require_sign.S2S_TIMESTAMP_WINDOW_SECONDS;
+exports.SDK_ERROR_REASONS = require_error_helpers.SDK_ERROR_REASONS;
+exports.ServiceTokenRequestError = require_s2s.ServiceTokenRequestError;
+exports.USERS_BATCH_MAX_IDS = require_constants$1.USERS_BATCH_MAX_IDS;
+exports.WEBHOOK_HEADERS = require_constants$1.WEBHOOK_HEADERS;
+exports.WEBHOOK_TIMESTAMP_WINDOW_SECONDS = require_constants$1.WEBHOOK_TIMESTAMP_WINDOW_SECONDS;
+exports.buildS2SCanonicalString = require_sign.buildS2SCanonicalString;
+exports.configureEvaAuth = require_parse_error_response.configureEvaAuth;
+exports.createAdminClient = require_admin.createAdminClient;
+exports.createEvaAuth = createEvaAuth;
+exports.createHttpClient = require_http_client.createHttpClient;
+exports.createS2SClient = require_s2s.createS2SClient;
+exports.createServiceTokenProvider = require_s2s.createServiceTokenProvider;
+exports.generateS2SNonce = require_sign.generateS2SNonce;
+exports.getAuthUrl = require_parse_error_response.getAuthUrl;
+exports.getCookieDomain = require_parse_error_response.getCookieDomain;
+exports.getCookieNames = require_constants.getCookieNames;
+exports.getMessage = getMessage;
+exports.isAccountStateLocked = require_error_helpers.isAccountStateLocked;
+exports.isApiError = require_error_helpers.isApiError;
+exports.isAuthRequired = require_error_helpers.isAuthRequired;
+exports.isBadRequest = require_error_helpers.isBadRequest;
+exports.isConflict = require_error_helpers.isConflict;
+exports.isForbidden = require_error_helpers.isForbidden;
+exports.isGone = require_error_helpers.isGone;
+exports.isInternalError = require_error_helpers.isInternalError;
+exports.isMalformed = require_error_helpers.isMalformed;
+exports.isNetworkError = require_error_helpers.isNetworkError;
+exports.isNotFound = require_error_helpers.isNotFound;
+exports.isRateLimited = require_error_helpers.isRateLimited;
+exports.isRefreshNoTokens = require_error_helpers.isRefreshNoTokens;
+exports.isSdkError = require_error_helpers.isSdkError;
+exports.isServiceUnavailable = require_error_helpers.isServiceUnavailable;
+exports.isTokenInvalid = require_error_helpers.isTokenInvalid;
+exports.isUnauthorized = require_error_helpers.isUnauthorized;
+exports.isUnprocessableEntity = require_error_helpers.isUnprocessableEntity;
+exports.isValidationError = require_error_helpers.isValidationError;
+exports.isVerifyFailed = require_error_helpers.isVerifyFailed;
+exports.matchError = require_error_helpers.matchError;
+exports.matchSdkReason = require_error_helpers.matchSdkReason;
+exports.readTokensFromCookies = require_cookies.readTokensFromCookies;
+exports.signS2SHeaders = require_sign.signS2SHeaders;
+exports.signS2SRequest = require_sign.signS2SRequest;
+exports.verifyAccessToken = require_jwt.verifyAccessToken;
+exports.verifyDelegatedToken = require_delegated_token.verifyDelegatedToken;
+exports.verifyS2SRequest = require_delegated_token.verifyS2SRequest;
+exports.verifyServiceToken = require_delegated_token.verifyServiceToken;
+exports.verifyWebhookSignature = require_webhooks.verifyWebhookSignature;
+
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":["createHttpClient"],"sources":["../src/client.ts","../src/get-message.ts"],"sourcesContent":["import { createHttpClient, type EvaHttpClient } from './http-client'\n\ntype EvaAuth = {\n  client: EvaHttpClient\n}\n\nexport function createEvaAuth(): EvaAuth {\n  return {\n    client: createHttpClient(),\n  }\n}\n","/**\n * Helper de conveniencia para extraer el mensaje de un EvaError.\n * Útil para migración gradual de 0.x → 1.0.0 donde result.error era string.\n *\n * Uso:\n *   import { getMessage } from '@eva_solutions/auth-sdk'\n *   if (!result.ok) {\n *     console.error(getMessage(result.error))  // equivale a result.error.message\n *   }\n */\nimport type { EvaError } from './types'\n\n/**\n * Retorna el mensaje del EvaError independientemente de su kind.\n * Equivalente a `err.message` — helper para migración gradual desde 0.x.\n */\nexport function getMessage(err: EvaError): string {\n  return err.message\n}\n"],"mappings":";;;;;;;;;;;;;;;AAMA,SAAgB,gBAAyB;CACvC,OAAO,EACL,QAAQA,oBAAAA,iBAAiB,EAC3B;AACF;;;;;;ACMA,SAAgB,WAAW,KAAuB;CAChD,OAAO,IAAI;AACb"}

package/dist/index.d.cts

@@ -0,0 +1,114 @@
+import { Ei as WEBHOOK_TIMESTAMP_WINDOW_SECONDS, H as DirectorioQuery, Ti as WEBHOOK_HEADERS, U as DirectorioResponse, bi as ERROR_CODES, gi as ACCOUNT_STATES, vi as CoreErrorCode, wi as USERS_BATCH_MAX_IDS, xi as HEADERS } from "./index-Dold-Ycb.cjs";
+import { n as EventCode, t as EVENT_CODES } from "./event-codes-BgcJWsov.cjs";
+import { a as EvaError, c as EvaTokenPayload, d as Result, f as TokenPair, h as SdkErrorReason, i as EvaEmpresa, l as EvaUser, m as SDK_ERROR_REASONS, n as DeviceInfo, o as EvaSdkError, p as ErrorCode, r as EvaApiError, s as EvaSession, t as ActivityState, u as PrivacyState } from "./types-qh6ANBCV.cjs";
+import { a as COOKIE_MAX_AGE, i as getCookieDomain, l as readTokensFromCookies, n as configureEvaAuth, o as JWT_CONFIG, r as getAuthUrl, s as getCookieNames, t as ConfigureEvaAuthOptions } from "./config-D6Tr7ev6.cjs";
+import { A as SetServiceClientGrantInput, C as RestoreUserResult, D as ServiceClientPublic, E as ServiceClientGrant, M as UpdateServiceClientInput, N as UpdateServiceClientResult, O as SetProductoPermisosAutorizablesInput, P as AccountState, S as RepublishPendingWebhooksResult, T as ServiceClientDelegation, _ as ProductoPermisosAutorizablesResult, a as AdminClientConfig, b as ReassignEmpresaTitularResult, c as AdminSetContratacionInput, d as CreateServiceClientResult, f as ListProductosResult, g as MaintenanceCleanupResult, h as MaintenanceCleanupQuery, i as createAdminClient, j as UpdateProductoInput, k as SetServiceClientDelegationInput, l as CreateProductoInput, m as ListServiceClientGrantsResult, n as AdminErrorCode, o as AdminContratacionResult, p as ListServiceClientDelegationsResult, r as AdminClient, s as AdminEmpresaEstadoResult, t as ADMIN_ERROR_CODES, u as CreateServiceClientInput, v as ProductoResult, w as RotateSecretResult, x as RepublishPendingWebhooksQuery, y as ReassignEmpresaTitularInput } from "./index-jAO62-OD.cjs";
+import { n as EvaErrorMessages, t as DEFAULT_ERROR_MESSAGES } from "./error-messages-CGpW1fsg.cjs";
+import { $ as ServiceTokenRequestError, A as RenameGrupoInput, B as SearchDirectorioInput, C as ListAutorizacionesInput, D as ListWebhookDeliveriesQuery, E as ListEmpresasResult, F as S2SGetUserResult, G as UpdateEmpresaMemberInput, H as SubjectTokenInput, I as S2SVerifyError, J as DelegatedTokenGrant, K as UpdateSucursalInput, L as S2SVerifyOptions, M as S2SBatchUsersResult, N as S2SCanonicalParts, O as RemoveEmpresaMemberInput, P as S2SClientConfig, Q as ServiceTokenProviderConfig, R as S2SVerifyReason, S as GrupoResult, T as ListEmpresasInput, U as SucursalResult, V as SetContratacionInput, W as UpdateEmpresaInput, Y as ExchangeTokenInput, Z as ServiceTokenProvider, _ as EmpresaEstadoResult, a as CheckAutorizacionResult, at as DelegatedTokenVerifyOptions, b as EmpresaResult, c as CreateAutorizacionInput, ct as verifyDelegatedToken, d as CreateSucursalInput, et as ServiceTokenSource, f as CreateWebhookSubscriptionInput, ft as ServiceTokenVerifyError, g as EmpresaDetailResult, gt as verifyServiceToken, h as DirectorioResult, ht as ServiceTokenVerifyResult, i as CheckAutorizacionInput, it as DelegatedTokenVerifyError, j as S2SBatchUsersInput, k as RemoveGrupoEmpresaInput, l as CreateEmpresaInput, m as DeleteAutorizacionInput, mt as ServiceTokenVerifyReason, n as AddGrupoEmpresaInput, nt as DelegatedActor, o as ContratacionResult, ot as DelegatedTokenVerifyReason, p as DeactivateSucursalInput, pt as ServiceTokenVerifyOptions, q as UpdateWebhookSubscriptionInput, r as AutorizacionResult, rt as DelegatedTokenClaims, s as ContratadoResult, st as DelegatedTokenVerifyResult, t as AddEmpresaMemberInput, tt as createServiceTokenProvider, u as CreateGrupoInput, ut as ServiceTokenClaims, v as EmpresaMemberResult, w as ListAutorizacionesResult, x as GetEmpresaResult, y as EmpresaRecortadaResult, z as S2SVerifyResult } from "./types-DGeQ8j4k.cjs";
+import { a as WebhookSubscriptionWithSecret, i as WebhookSubscription, n as WebhookDelivery, r as WebhookPayload, t as RotateWebhookSecretResult } from "./types-B5sf7kKE.cjs";
+import { S as matchSdkReason, _ as isUnauthorized, a as isConflict, b as isVerifyFailed, c as isInternalError, d as isNotFound, f as isRateLimited, g as isTokenInvalid, h as isServiceUnavailable, i as isBadRequest, l as isMalformed, m as isSdkError, n as isApiError, o as isForbidden, p as isRefreshNoTokens, r as isAuthRequired, s as isGone, t as isAccountStateLocked, u as isNetworkError, v as isUnprocessableEntity, x as matchError, y as isValidationError } from "./error-helpers-KBHUbkOM.cjs";
+import { n as verifyWebhookSignature, t as VerifyWebhookSignatureParams } from "./index-DcvQWByo.cjs";
+import { a as S2SScope, c as S2S_TIMESTAMP_WINDOW_SECONDS, d as generateS2SNonce, f as signS2SHeaders, h as createS2SClient, i as AUTORIZACION_CACHE_TTL_MS, l as EMPTY_BODY_SHA256_HEX, m as S2SClient, n as S2SErrorCode, o as S2S_RESPONSE_HEADERS, p as signS2SRequest, r as S2S_ERROR_CODES, s as S2S_SCOPES, t as verifyS2SRequest, u as buildS2SCanonicalString } from "./index-o7nXcl7z.cjs";
+import { ZodType } from "zod";
+declare function createHttpClient(): {
+  getCode: (params: {
+    phone: string;
+  }) => Promise<Result<{
+    message: string;
+    challengeId: string;
+  }>>;
+  login: (params: {
+    phone: string;
+    code: string;
+    challengeId: string;
+    empresaId?: string;
+  } & DeviceInfo) => Promise<Result<{
+    user: {
+      id: string;
+    };
+    tokens?: TokenPair;
+  }>>;
+  setActiveEmpresa: (params: {
+    accessToken: string;
+    empresaId: string | null;
+  }) => Promise<Result<{
+    empresaId: string | null;
+    accessToken?: string;
+  }>>;
+  refresh: (params: {
+    refreshToken: string;
+  }) => Promise<Result<{
+    user: {
+      id: string;
+    };
+    tokens?: TokenPair;
+  }>>;
+  logout: (params: {
+    refreshToken: string;
+  }) => Promise<Result<{
+    message: string;
+  }>>;
+  getUser: (params: {
+    accessToken: string;
+  }) => Promise<Result<EvaUser>>;
+  updateUser: (params: {
+    accessToken: string;
+    data: Record<string, unknown>;
+  }) => Promise<Result<EvaUser>>;
+  deleteUser: (params: {
+    accessToken: string;
+  }) => Promise<Result<{
+    message: string;
+  }>>;
+  getUserEmpresas: (params: {
+    accessToken: string;
+  }) => Promise<Result<EvaEmpresa[]>>;
+  getDirectorio: (params: {
+    accessToken: string;
+  } & DirectorioQuery) => Promise<Result<DirectorioResponse["data"]>>;
+  getSessions: (params: {
+    accessToken: string;
+  }) => Promise<Result<EvaSession[]>>;
+  deleteSession: (params: {
+    accessToken: string;
+    sessionId: string;
+  }) => Promise<Result<{
+    message: string;
+  }>>;
+  deleteAllSessions: (params: {
+    refreshToken: string;
+  }) => Promise<Result<{
+    message: string;
+    count: number;
+  }>>;
+  health: () => Promise<Result<{
+    status: string;
+  }>>;
+};
+type EvaHttpClient = ReturnType<typeof createHttpClient>;
+type EvaAuth = {
+  client: EvaHttpClient;
+};
+declare function createEvaAuth(): EvaAuth;
+type VerifyAccessTokenOptions<TExtra extends Record<string, unknown>> = {
+  extraClaimsSchema?: ZodType<TExtra>;
+};
+/**
+ * Verifica un access token de usuario: firma ES256 con una clave de usuario del JWKS (`kid` con
+ * prefijo `usr-`; un token sin `kid` o firmado con una clave de servicio se rechaza), `typ: at+jwt`,
+ * issuer, `aud` igual al producto configurado y claims base. Devuelve `id`, `sessionId`, `clientId`
+ * (`client_id`) y `empresaId` (claim `empresa`, ausente si la sesión no tiene empresa activa).
+ * Un token inválido o expirado devuelve `{ ok: false }` (401); no lanza.
+ *
+ * @throws Error de configuración (`name === 'EvaAuthConfigError'`) si `authUrl` o `product` no
+ *   fueron configurados con `configureEvaAuth`: es un error del consumidor, no un token inválido,
+ *   así que se propaga en vez de degradarse a 401. El consumidor ve un 500.
+ */
+declare function verifyAccessToken<TExtra extends Record<string, unknown> = {}>(token: string, opts?: VerifyAccessTokenOptions<TExtra>): Promise<Result<EvaTokenPayload<TExtra>>>;
+/**
+ * Retorna el mensaje del EvaError independientemente de su kind.
+ * Equivalente a `err.message` — helper para migración gradual desde 0.x.
+ */
+declare function getMessage(err: EvaError): string;
+export { ACCOUNT_STATES, ADMIN_ERROR_CODES, AUTORIZACION_CACHE_TTL_MS, type AccountState, type ActivityState, type AddEmpresaMemberInput, type AddGrupoEmpresaInput, type AdminClient, type AdminClientConfig, type AdminContratacionResult, type AdminEmpresaEstadoResult, type AdminErrorCode, type AdminSetContratacionInput, type AutorizacionResult, COOKIE_MAX_AGE, type CheckAutorizacionInput, type CheckAutorizacionResult, type ConfigureEvaAuthOptions, type ContratacionResult, type ContratadoResult, type CoreErrorCode, type CreateAutorizacionInput, type CreateEmpresaInput, type CreateGrupoInput, type CreateProductoInput, type CreateServiceClientInput, type CreateServiceClientResult, type CreateSucursalInput, type CreateWebhookSubscriptionInput, DEFAULT_ERROR_MESSAGES, type DeactivateSucursalInput, type DelegatedActor, type DelegatedTokenClaims, type DelegatedTokenGrant, type DelegatedTokenVerifyError, type DelegatedTokenVerifyOptions, type DelegatedTokenVerifyReason, type DelegatedTokenVerifyResult, type DeleteAutorizacionInput, type DeviceInfo, type DirectorioResult, EMPTY_BODY_SHA256_HEX, ERROR_CODES, EVENT_CODES, type EmpresaDetailResult, type EmpresaEstadoResult, type EmpresaMemberResult, type EmpresaRecortadaResult, type EmpresaResult, type ErrorCode, type EvaApiError, type EvaEmpresa, type EvaError, type EvaErrorMessages, type EvaHttpClient, type EvaSdkError, type EvaSession, type EvaTokenPayload, type EvaUser, type EventCode, type ExchangeTokenInput, type GetEmpresaResult, type GrupoResult, HEADERS, JWT_CONFIG, type ListAutorizacionesInput, type ListAutorizacionesResult, type ListEmpresasInput, type ListEmpresasResult, type ListProductosResult, type ListServiceClientDelegationsResult, type ListServiceClientGrantsResult, type ListWebhookDeliveriesQuery, type MaintenanceCleanupQuery, type MaintenanceCleanupResult, type PrivacyState, type ProductoPermisosAutorizablesResult, type ProductoResult, type ReassignEmpresaTitularInput, type ReassignEmpresaTitularResult, type RemoveEmpresaMemberInput, type RemoveGrupoEmpresaInput, type RenameGrupoInput, type RepublishPendingWebhooksQuery, type RepublishPendingWebhooksResult, type RestoreUserResult, type Result, type RotateSecretResult, type RotateWebhookSecretResult, type S2SBatchUsersInput, type S2SBatchUsersResult, type S2SCanonicalParts, type S2SClient, type S2SClientConfig, type S2SErrorCode, type S2SGetUserResult, type S2SScope, type S2SVerifyError, type S2SVerifyOptions, type S2SVerifyReason, type S2SVerifyResult, S2S_ERROR_CODES, S2S_RESPONSE_HEADERS, S2S_SCOPES, S2S_TIMESTAMP_WINDOW_SECONDS, SDK_ERROR_REASONS, type SdkErrorReason, type SearchDirectorioInput, type ServiceClientDelegation, type ServiceClientGrant, type ServiceClientPublic, type ServiceTokenClaims, type ServiceTokenProvider, type ServiceTokenProviderConfig, ServiceTokenRequestError, type ServiceTokenSource, type ServiceTokenVerifyError, type ServiceTokenVerifyOptions, type ServiceTokenVerifyReason, type ServiceTokenVerifyResult, type SetContratacionInput, type SetProductoPermisosAutorizablesInput, type SetServiceClientDelegationInput, type SetServiceClientGrantInput, type SubjectTokenInput, type SucursalResult, type TokenPair, USERS_BATCH_MAX_IDS, type UpdateEmpresaInput, type UpdateEmpresaMemberInput, type UpdateProductoInput, type UpdateServiceClientInput, type UpdateServiceClientResult, type UpdateSucursalInput, type UpdateWebhookSubscriptionInput, type VerifyAccessTokenOptions, type VerifyWebhookSignatureParams, WEBHOOK_HEADERS, WEBHOOK_TIMESTAMP_WINDOW_SECONDS, type WebhookDelivery, type WebhookPayload, type WebhookSubscription, type WebhookSubscriptionWithSecret, buildS2SCanonicalString, configureEvaAuth, createAdminClient, createEvaAuth, createHttpClient, createS2SClient, createServiceTokenProvider, generateS2SNonce, getAuthUrl, getCookieDomain, getCookieNames, getMessage, isAccountStateLocked, isApiError, isAuthRequired, isBadRequest, isConflict, isForbidden, isGone, isInternalError, isMalformed, isNetworkError, isNotFound, isRateLimited, isRefreshNoTokens, isSdkError, isServiceUnavailable, isTokenInvalid, isUnauthorized, isUnprocessableEntity, isValidationError, isVerifyFailed, matchError, matchSdkReason, readTokensFromCookies, signS2SHeaders, signS2SRequest, verifyAccessToken, verifyDelegatedToken, verifyS2SRequest, verifyServiceToken, verifyWebhookSignature };
+//# sourceMappingURL=index.d.cts.map

package/dist/index.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.cts","names":[],"sources":["../src/http-client.ts","../src/client.ts","../src/jwt.ts","../src/get-message.ts"],"mappings":";;;;;;;;;;;;iBAsSgB;EA9KS,UAAA;IACvB;QACE,QAAQ;IAAS;IAAiB;;EAkB5B,QAAA;IACN;IACA;IACA;IACA;MACE,eACH,QAAQ;IAAS;MAAQ;;IAAc,SAAS;;EAgCjB,mBAAA;IAChC;IACA;QACE,QAAQ;IAAS;IAA0B;;EAQtB,UAAA;IACvB;QACE,QAAQ;IAAS;MAAQ;;IAAc,SAAS;;EAM5B,SAAA;IACtB;QACE,QAAQ;IAAS;;EAMI,UAAA;IAAE;QAAwB,QAAQ,OAAO;EAGtC,aAAA;IAC1B;IACA,MAAM;QACJ,QAAQ,OAAO;EAOS,aAAA;IAC1B;QACE,QAAQ;IAAS;;EAMY,kBAAA;IAC/B;QACE,QAAQ,OAAO;EAWT,gBAAA;IAAE;MAAwB,oBACjC,QAAQ,OAAO;EAaW,cAAA;IAC3B;QACE,QAAQ,OAAO;EAGY,gBAAA;IAC7B;IACA;QACE,QAAQ;IAAS;;EAqBc,oBAAA;IACjC;QACE,QAAQ;IAAS;IAAiB;;EAQnB,cAAA,QAAQ;IAAS;;;KAqBxB,gBAAgB,kBAAkB;KCvTzC;EACH,QAAQ;;iBAGM,iBAAiB;KC4DrB,yBAAyB,eAAe;EAClD,oBAAoB,QAAQ;;;;;;;;;;;;;iBAcR,kBACpB,eAAe,8BAEf,eACA,OAAM,yBAAyB,UAC9B,QAAQ,OAAO,gBAAgB;;;;;iBCtElB,WAAW,KAAK"}

package/dist/index.d.ts

@@ -0,0 +1,114 @@
+import { Ei as WEBHOOK_TIMESTAMP_WINDOW_SECONDS, H as DirectorioQuery, Ti as WEBHOOK_HEADERS, U as DirectorioResponse, bi as ERROR_CODES, gi as ACCOUNT_STATES, vi as CoreErrorCode, wi as USERS_BATCH_MAX_IDS, xi as HEADERS } from "./index-Dold-Ycb.js";
+import { n as EventCode, t as EVENT_CODES } from "./event-codes-BgcJWsov.js";
+import { a as EvaError, c as EvaTokenPayload, d as Result, f as TokenPair, h as SdkErrorReason, i as EvaEmpresa, l as EvaUser, m as SDK_ERROR_REASONS, n as DeviceInfo, o as EvaSdkError, p as ErrorCode, r as EvaApiError, s as EvaSession, t as ActivityState, u as PrivacyState } from "./types-CLOIHzRu.js";
+import { a as COOKIE_MAX_AGE, i as getCookieDomain, l as readTokensFromCookies, n as configureEvaAuth, o as JWT_CONFIG, r as getAuthUrl, s as getCookieNames, t as ConfigureEvaAuthOptions } from "./config-rl4_-VAq.js";
+import { A as SetServiceClientGrantInput, C as RestoreUserResult, D as ServiceClientPublic, E as ServiceClientGrant, M as UpdateServiceClientInput, N as UpdateServiceClientResult, O as SetProductoPermisosAutorizablesInput, P as AccountState, S as RepublishPendingWebhooksResult, T as ServiceClientDelegation, _ as ProductoPermisosAutorizablesResult, a as AdminClientConfig, b as ReassignEmpresaTitularResult, c as AdminSetContratacionInput, d as CreateServiceClientResult, f as ListProductosResult, g as MaintenanceCleanupResult, h as MaintenanceCleanupQuery, i as createAdminClient, j as UpdateProductoInput, k as SetServiceClientDelegationInput, l as CreateProductoInput, m as ListServiceClientGrantsResult, n as AdminErrorCode, o as AdminContratacionResult, p as ListServiceClientDelegationsResult, r as AdminClient, s as AdminEmpresaEstadoResult, t as ADMIN_ERROR_CODES, u as CreateServiceClientInput, v as ProductoResult, w as RotateSecretResult, x as RepublishPendingWebhooksQuery, y as ReassignEmpresaTitularInput } from "./index-DBZoLU4E.js";
+import { n as EvaErrorMessages, t as DEFAULT_ERROR_MESSAGES } from "./error-messages-CGpW1fsg.js";
+import { $ as ServiceTokenRequestError, A as RenameGrupoInput, B as SearchDirectorioInput, C as ListAutorizacionesInput, D as ListWebhookDeliveriesQuery, E as ListEmpresasResult, F as S2SGetUserResult, G as UpdateEmpresaMemberInput, H as SubjectTokenInput, I as S2SVerifyError, J as DelegatedTokenGrant, K as UpdateSucursalInput, L as S2SVerifyOptions, M as S2SBatchUsersResult, N as S2SCanonicalParts, O as RemoveEmpresaMemberInput, P as S2SClientConfig, Q as ServiceTokenProviderConfig, R as S2SVerifyReason, S as GrupoResult, T as ListEmpresasInput, U as SucursalResult, V as SetContratacionInput, W as UpdateEmpresaInput, Y as ExchangeTokenInput, Z as ServiceTokenProvider, _ as EmpresaEstadoResult, a as CheckAutorizacionResult, at as DelegatedTokenVerifyOptions, b as EmpresaResult, c as CreateAutorizacionInput, ct as verifyDelegatedToken, d as CreateSucursalInput, et as ServiceTokenSource, f as CreateWebhookSubscriptionInput, ft as ServiceTokenVerifyError, g as EmpresaDetailResult, gt as verifyServiceToken, h as DirectorioResult, ht as ServiceTokenVerifyResult, i as CheckAutorizacionInput, it as DelegatedTokenVerifyError, j as S2SBatchUsersInput, k as RemoveGrupoEmpresaInput, l as CreateEmpresaInput, m as DeleteAutorizacionInput, mt as ServiceTokenVerifyReason, n as AddGrupoEmpresaInput, nt as DelegatedActor, o as ContratacionResult, ot as DelegatedTokenVerifyReason, p as DeactivateSucursalInput, pt as ServiceTokenVerifyOptions, q as UpdateWebhookSubscriptionInput, r as AutorizacionResult, rt as DelegatedTokenClaims, s as ContratadoResult, st as DelegatedTokenVerifyResult, t as AddEmpresaMemberInput, tt as createServiceTokenProvider, u as CreateGrupoInput, ut as ServiceTokenClaims, v as EmpresaMemberResult, w as ListAutorizacionesResult, x as GetEmpresaResult, y as EmpresaRecortadaResult, z as S2SVerifyResult } from "./types-DIUWza9-.js";
+import { a as WebhookSubscriptionWithSecret, i as WebhookSubscription, n as WebhookDelivery, r as WebhookPayload, t as RotateWebhookSecretResult } from "./types-CQTZdZIF.js";
+import { S as matchSdkReason, _ as isUnauthorized, a as isConflict, b as isVerifyFailed, c as isInternalError, d as isNotFound, f as isRateLimited, g as isTokenInvalid, h as isServiceUnavailable, i as isBadRequest, l as isMalformed, m as isSdkError, n as isApiError, o as isForbidden, p as isRefreshNoTokens, r as isAuthRequired, s as isGone, t as isAccountStateLocked, u as isNetworkError, v as isUnprocessableEntity, x as matchError, y as isValidationError } from "./error-helpers-BenWu-_u.js";
+import { n as verifyWebhookSignature, t as VerifyWebhookSignatureParams } from "./index-CNNMCrdl.js";
+import { a as S2SScope, c as S2S_TIMESTAMP_WINDOW_SECONDS, d as generateS2SNonce, f as signS2SHeaders, h as createS2SClient, i as AUTORIZACION_CACHE_TTL_MS, l as EMPTY_BODY_SHA256_HEX, m as S2SClient, n as S2SErrorCode, o as S2S_RESPONSE_HEADERS, p as signS2SRequest, r as S2S_ERROR_CODES, s as S2S_SCOPES, t as verifyS2SRequest, u as buildS2SCanonicalString } from "./index-BYzDaMR9.js";
+import { ZodType } from "zod";
+declare function createHttpClient(): {
+  getCode: (params: {
+    phone: string;
+  }) => Promise<Result<{
+    message: string;
+    challengeId: string;
+  }>>;
+  login: (params: {
+    phone: string;
+    code: string;
+    challengeId: string;
+    empresaId?: string;
+  } & DeviceInfo) => Promise<Result<{
+    user: {
+      id: string;
+    };
+    tokens?: TokenPair;
+  }>>;
+  setActiveEmpresa: (params: {
+    accessToken: string;
+    empresaId: string | null;
+  }) => Promise<Result<{
+    empresaId: string | null;
+    accessToken?: string;
+  }>>;
+  refresh: (params: {
+    refreshToken: string;
+  }) => Promise<Result<{
+    user: {
+      id: string;
+    };
+    tokens?: TokenPair;
+  }>>;
+  logout: (params: {
+    refreshToken: string;
+  }) => Promise<Result<{
+    message: string;
+  }>>;
+  getUser: (params: {
+    accessToken: string;
+  }) => Promise<Result<EvaUser>>;
+  updateUser: (params: {
+    accessToken: string;
+    data: Record<string, unknown>;
+  }) => Promise<Result<EvaUser>>;
+  deleteUser: (params: {
+    accessToken: string;
+  }) => Promise<Result<{
+    message: string;
+  }>>;
+  getUserEmpresas: (params: {
+    accessToken: string;
+  }) => Promise<Result<EvaEmpresa[]>>;
+  getDirectorio: (params: {
+    accessToken: string;
+  } & DirectorioQuery) => Promise<Result<DirectorioResponse["data"]>>;
+  getSessions: (params: {
+    accessToken: string;
+  }) => Promise<Result<EvaSession[]>>;
+  deleteSession: (params: {
+    accessToken: string;
+    sessionId: string;
+  }) => Promise<Result<{
+    message: string;
+  }>>;
+  deleteAllSessions: (params: {
+    refreshToken: string;
+  }) => Promise<Result<{
+    message: string;
+    count: number;
+  }>>;
+  health: () => Promise<Result<{
+    status: string;
+  }>>;
+};
+type EvaHttpClient = ReturnType<typeof createHttpClient>;
+type EvaAuth = {
+  client: EvaHttpClient;
+};
+declare function createEvaAuth(): EvaAuth;
+type VerifyAccessTokenOptions<TExtra extends Record<string, unknown>> = {
+  extraClaimsSchema?: ZodType<TExtra>;
+};
+/**
+ * Verifica un access token de usuario: firma ES256 con una clave de usuario del JWKS (`kid` con
+ * prefijo `usr-`; un token sin `kid` o firmado con una clave de servicio se rechaza), `typ: at+jwt`,
+ * issuer, `aud` igual al producto configurado y claims base. Devuelve `id`, `sessionId`, `clientId`
+ * (`client_id`) y `empresaId` (claim `empresa`, ausente si la sesión no tiene empresa activa).
+ * Un token inválido o expirado devuelve `{ ok: false }` (401); no lanza.
+ *
+ * @throws Error de configuración (`name === 'EvaAuthConfigError'`) si `authUrl` o `product` no
+ *   fueron configurados con `configureEvaAuth`: es un error del consumidor, no un token inválido,
+ *   así que se propaga en vez de degradarse a 401. El consumidor ve un 500.
+ */
+declare function verifyAccessToken<TExtra extends Record<string, unknown> = {}>(token: string, opts?: VerifyAccessTokenOptions<TExtra>): Promise<Result<EvaTokenPayload<TExtra>>>;
+/**
+ * Retorna el mensaje del EvaError independientemente de su kind.
+ * Equivalente a `err.message` — helper para migración gradual desde 0.x.
+ */
+declare function getMessage(err: EvaError): string;
+export { ACCOUNT_STATES, ADMIN_ERROR_CODES, AUTORIZACION_CACHE_TTL_MS, type AccountState, type ActivityState, type AddEmpresaMemberInput, type AddGrupoEmpresaInput, type AdminClient, type AdminClientConfig, type AdminContratacionResult, type AdminEmpresaEstadoResult, type AdminErrorCode, type AdminSetContratacionInput, type AutorizacionResult, COOKIE_MAX_AGE, type CheckAutorizacionInput, type CheckAutorizacionResult, type ConfigureEvaAuthOptions, type ContratacionResult, type ContratadoResult, type CoreErrorCode, type CreateAutorizacionInput, type CreateEmpresaInput, type CreateGrupoInput, type CreateProductoInput, type CreateServiceClientInput, type CreateServiceClientResult, type CreateSucursalInput, type CreateWebhookSubscriptionInput, DEFAULT_ERROR_MESSAGES, type DeactivateSucursalInput, type DelegatedActor, type DelegatedTokenClaims, type DelegatedTokenGrant, type DelegatedTokenVerifyError, type DelegatedTokenVerifyOptions, type DelegatedTokenVerifyReason, type DelegatedTokenVerifyResult, type DeleteAutorizacionInput, type DeviceInfo, type DirectorioResult, EMPTY_BODY_SHA256_HEX, ERROR_CODES, EVENT_CODES, type EmpresaDetailResult, type EmpresaEstadoResult, type EmpresaMemberResult, type EmpresaRecortadaResult, type EmpresaResult, type ErrorCode, type EvaApiError, type EvaEmpresa, type EvaError, type EvaErrorMessages, type EvaHttpClient, type EvaSdkError, type EvaSession, type EvaTokenPayload, type EvaUser, type EventCode, type ExchangeTokenInput, type GetEmpresaResult, type GrupoResult, HEADERS, JWT_CONFIG, type ListAutorizacionesInput, type ListAutorizacionesResult, type ListEmpresasInput, type ListEmpresasResult, type ListProductosResult, type ListServiceClientDelegationsResult, type ListServiceClientGrantsResult, type ListWebhookDeliveriesQuery, type MaintenanceCleanupQuery, type MaintenanceCleanupResult, type PrivacyState, type ProductoPermisosAutorizablesResult, type ProductoResult, type ReassignEmpresaTitularInput, type ReassignEmpresaTitularResult, type RemoveEmpresaMemberInput, type RemoveGrupoEmpresaInput, type RenameGrupoInput, type RepublishPendingWebhooksQuery, type RepublishPendingWebhooksResult, type RestoreUserResult, type Result, type RotateSecretResult, type RotateWebhookSecretResult, type S2SBatchUsersInput, type S2SBatchUsersResult, type S2SCanonicalParts, type S2SClient, type S2SClientConfig, type S2SErrorCode, type S2SGetUserResult, type S2SScope, type S2SVerifyError, type S2SVerifyOptions, type S2SVerifyReason, type S2SVerifyResult, S2S_ERROR_CODES, S2S_RESPONSE_HEADERS, S2S_SCOPES, S2S_TIMESTAMP_WINDOW_SECONDS, SDK_ERROR_REASONS, type SdkErrorReason, type SearchDirectorioInput, type ServiceClientDelegation, type ServiceClientGrant, type ServiceClientPublic, type ServiceTokenClaims, type ServiceTokenProvider, type ServiceTokenProviderConfig, ServiceTokenRequestError, type ServiceTokenSource, type ServiceTokenVerifyError, type ServiceTokenVerifyOptions, type ServiceTokenVerifyReason, type ServiceTokenVerifyResult, type SetContratacionInput, type SetProductoPermisosAutorizablesInput, type SetServiceClientDelegationInput, type SetServiceClientGrantInput, type SubjectTokenInput, type SucursalResult, type TokenPair, USERS_BATCH_MAX_IDS, type UpdateEmpresaInput, type UpdateEmpresaMemberInput, type UpdateProductoInput, type UpdateServiceClientInput, type UpdateServiceClientResult, type UpdateSucursalInput, type UpdateWebhookSubscriptionInput, type VerifyAccessTokenOptions, type VerifyWebhookSignatureParams, WEBHOOK_HEADERS, WEBHOOK_TIMESTAMP_WINDOW_SECONDS, type WebhookDelivery, type WebhookPayload, type WebhookSubscription, type WebhookSubscriptionWithSecret, buildS2SCanonicalString, configureEvaAuth, createAdminClient, createEvaAuth, createHttpClient, createS2SClient, createServiceTokenProvider, generateS2SNonce, getAuthUrl, getCookieDomain, getCookieNames, getMessage, isAccountStateLocked, isApiError, isAuthRequired, isBadRequest, isConflict, isForbidden, isGone, isInternalError, isMalformed, isNetworkError, isNotFound, isRateLimited, isRefreshNoTokens, isSdkError, isServiceUnavailable, isTokenInvalid, isUnauthorized, isUnprocessableEntity, isValidationError, isVerifyFailed, matchError, matchSdkReason, readTokensFromCookies, signS2SHeaders, signS2SRequest, verifyAccessToken, verifyDelegatedToken, verifyS2SRequest, verifyServiceToken, verifyWebhookSignature };
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/http-client.ts","../src/client.ts","../src/jwt.ts","../src/get-message.ts"],"mappings":";;;;;;;;;;;;iBAsSgB;EA9KS,UAAA;IACvB;QACE,QAAQ;IAAS;IAAiB;;EAkB5B,QAAA;IACN;IACA;IACA;IACA;MACE,eACH,QAAQ;IAAS;MAAQ;;IAAc,SAAS;;EAgCjB,mBAAA;IAChC;IACA;QACE,QAAQ;IAAS;IAA0B;;EAQtB,UAAA;IACvB;QACE,QAAQ;IAAS;MAAQ;;IAAc,SAAS;;EAM5B,SAAA;IACtB;QACE,QAAQ;IAAS;;EAMI,UAAA;IAAE;QAAwB,QAAQ,OAAO;EAGtC,aAAA;IAC1B;IACA,MAAM;QACJ,QAAQ,OAAO;EAOS,aAAA;IAC1B;QACE,QAAQ;IAAS;;EAMY,kBAAA;IAC/B;QACE,QAAQ,OAAO;EAWT,gBAAA;IAAE;MAAwB,oBACjC,QAAQ,OAAO;EAaW,cAAA;IAC3B;QACE,QAAQ,OAAO;EAGY,gBAAA;IAC7B;IACA;QACE,QAAQ;IAAS;;EAqBc,oBAAA;IACjC;QACE,QAAQ;IAAS;IAAiB;;EAQnB,cAAA,QAAQ;IAAS;;;KAqBxB,gBAAgB,kBAAkB;KCvTzC;EACH,QAAQ;;iBAGM,iBAAiB;KC4DrB,yBAAyB,eAAe;EAClD,oBAAoB,QAAQ;;;;;;;;;;;;;iBAcR,kBACpB,eAAe,8BAEf,eACA,OAAM,yBAAyB,UAC9B,QAAQ,OAAO,gBAAgB;;;;;iBCtElB,WAAW,KAAK"}

package/dist/index.js

@@ -0,0 +1,28 @@
+import { t as createHttpClient } from "./http-client-Da0-OMfc.js";
+import { t as verifyAccessToken } from "./jwt-DhqgH94B.js";
+import { d as DEFAULT_ERROR_MESSAGES, i as getCookieDomain, n as configureEvaAuth, r as getAuthUrl } from "./parse-error-response-BM9-kjs0.js";
+import { i as getCookieNames, n as JWT_CONFIG, t as COOKIE_MAX_AGE } from "./constants-BY7QZokc.js";
+import { a as HEADERS, c as USERS_BATCH_MAX_IDS, i as ERROR_CODES, l as WEBHOOK_HEADERS, t as ACCOUNT_STATES, u as WEBHOOK_TIMESTAMP_WINDOW_SECONDS } from "./constants-rNuD5qJn.js";
+import { n as readTokensFromCookies } from "./cookies-DKEC7AWv.js";
+import { C as SDK_ERROR_REASONS, S as matchSdkReason, _ as isUnauthorized, a as isConflict, b as isVerifyFailed, c as isInternalError, d as isNotFound, f as isRateLimited, g as isTokenInvalid, h as isServiceUnavailable, i as isBadRequest, l as isMalformed, m as isSdkError, n as isApiError, o as isForbidden, p as isRefreshNoTokens, r as isAuthRequired, s as isGone, t as isAccountStateLocked, u as isNetworkError, v as isUnprocessableEntity, x as matchError, y as isValidationError } from "./error-helpers-lnwgNOw9.js";
+import { t as verifyWebhookSignature } from "./webhooks-B5sAWC9W.js";
+import { t as EVENT_CODES } from "./event-codes-DR5_VlaR.js";
+import { n as createAdminClient, t as ADMIN_ERROR_CODES } from "./admin-DjvuvuI8.js";
+import { a as createServiceTokenProvider, i as ServiceTokenRequestError, n as createS2SClient, t as S2S_ERROR_CODES } from "./s2s-B_0SIQzn.js";
+import { a as signS2SRequest, d as S2S_TIMESTAMP_WINDOW_SECONDS, i as signS2SHeaders, l as S2S_RESPONSE_HEADERS, n as buildS2SCanonicalString, r as generateS2SNonce, s as AUTORIZACION_CACHE_TTL_MS, t as EMPTY_BODY_SHA256_HEX, u as S2S_SCOPES } from "./sign-HFtcYwa-.js";
+import { a as verifyServiceToken, n as verifyDelegatedToken, o as verifyS2SRequest } from "./delegated-token-CVNbMNfy.js";
+// src/client.ts
+function createEvaAuth() {
+	return { client: createHttpClient() };
+}
+// src/get-message.ts
+/**
+* Retorna el mensaje del EvaError independientemente de su kind.
+* Equivalente a `err.message` — helper para migración gradual desde 0.x.
+*/
+function getMessage(err) {
+	return err.message;
+}
+export { ACCOUNT_STATES, ADMIN_ERROR_CODES, AUTORIZACION_CACHE_TTL_MS, COOKIE_MAX_AGE, DEFAULT_ERROR_MESSAGES, EMPTY_BODY_SHA256_HEX, ERROR_CODES, EVENT_CODES, HEADERS, JWT_CONFIG, S2S_ERROR_CODES, S2S_RESPONSE_HEADERS, S2S_SCOPES, S2S_TIMESTAMP_WINDOW_SECONDS, SDK_ERROR_REASONS, ServiceTokenRequestError, USERS_BATCH_MAX_IDS, WEBHOOK_HEADERS, WEBHOOK_TIMESTAMP_WINDOW_SECONDS, buildS2SCanonicalString, configureEvaAuth, createAdminClient, createEvaAuth, createHttpClient, createS2SClient, createServiceTokenProvider, generateS2SNonce, getAuthUrl, getCookieDomain, getCookieNames, getMessage, isAccountStateLocked, isApiError, isAuthRequired, isBadRequest, isConflict, isForbidden, isGone, isInternalError, isMalformed, isNetworkError, isNotFound, isRateLimited, isRefreshNoTokens, isSdkError, isServiceUnavailable, isTokenInvalid, isUnauthorized, isUnprocessableEntity, isValidationError, isVerifyFailed, matchError, matchSdkReason, readTokensFromCookies, signS2SHeaders, signS2SRequest, verifyAccessToken, verifyDelegatedToken, verifyS2SRequest, verifyServiceToken, verifyWebhookSignature };
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../src/client.ts","../src/get-message.ts"],"sourcesContent":["import { createHttpClient, type EvaHttpClient } from './http-client'\n\ntype EvaAuth = {\n  client: EvaHttpClient\n}\n\nexport function createEvaAuth(): EvaAuth {\n  return {\n    client: createHttpClient(),\n  }\n}\n","/**\n * Helper de conveniencia para extraer el mensaje de un EvaError.\n * Útil para migración gradual de 0.x → 1.0.0 donde result.error era string.\n *\n * Uso:\n *   import { getMessage } from '@eva_solutions/auth-sdk'\n *   if (!result.ok) {\n *     console.error(getMessage(result.error))  // equivale a result.error.message\n *   }\n */\nimport type { EvaError } from './types'\n\n/**\n * Retorna el mensaje del EvaError independientemente de su kind.\n * Equivalente a `err.message` — helper para migración gradual desde 0.x.\n */\nexport function getMessage(err: EvaError): string {\n  return err.message\n}\n"],"mappings":";;;;;;;;;;;;;;AAMA,SAAgB,gBAAyB;CACvC,OAAO,EACL,QAAQ,iBAAiB,EAC3B;AACF;;;;;;ACMA,SAAgB,WAAW,KAAuB;CAChD,OAAO,IAAI;AACb"}

package/dist/jwt-BBNqk0TV.cjs

@@ -0,0 +1,155 @@
+const require_tokens = require("./tokens-C1nzkn21.cjs");
+const require_key_resolver = require("./key-resolver-CESqj4-P.cjs");
+const require_parse_error_response = require("./parse-error-response-6qOQS5y9.cjs");
+const require_constants = require("./constants-BE1_9Tod.cjs");
+let zod = require("zod");
+let jose = require("jose");
+// src/jwt-claims.ts
+/**
+* Claims reservados que el SDK NUNCA expone en EvaTokenPayload,
+* aunque estén presentes en el JWT decodificado.
+*
+* Fuentes:
+* - RFC 7519 §4.1: iss, sub, aud, exp, nbf, iat, jti
+* - OIDC Core 1.0 §2: nonce, auth_time, acr, amr, azp
+*
+* Módulo interno — NO se exporta desde ningún barrel raíz.
+* Uso: src/jwt.ts (filtrado + assertSchemaNoReservedKeys).
+*/
+const RESERVED_JWT_CLAIMS = [
+	"iat",
+	"exp",
+	"iss",
+	"aud",
+	"jti",
+	"sub",
+	"nbf",
+	"nonce",
+	"auth_time",
+	"acr",
+	"amr",
+	"azp"
+];
+// src/jwt.ts
+const BaseClaimsSchema = zod.z.object({
+	sub: zod.z.string(),
+	sessionId: zod.z.string(),
+	client_id: zod.z.string().min(1),
+	empresa: zod.z.string().min(1).optional()
+});
+const EXCLUDED_FROM_EXTRAS = /* @__PURE__ */ new Set([
+	...RESERVED_JWT_CLAIMS,
+	"sub",
+	"sessionId",
+	"id",
+	"client_id",
+	"clientId",
+	"empresa",
+	"empresaId"
+]);
+const _schemaValidationCache = /* @__PURE__ */ new WeakMap();
+/**
+* Valida que el schema no declare claims reservados (RFC 7519 / OIDC Core 1.0)
+* ni claves del shape base (id, sessionId).
+* Lanza Error sincrono con mensaje claro — falla rápido en la primera invocación.
+* Solo se llama dentro del schema branch (zero overhead en path zero-config).
+* Cachea por referencia de schema con WeakMap.
+*/
+function assertSchemaNoReservedKeys(schema) {
+	if (_schemaValidationCache.has(schema)) return;
+	if (schema instanceof zod.ZodObject) {
+		for (const key of Object.keys(schema.shape)) if (EXCLUDED_FROM_EXTRAS.has(key)) throw new Error(`extraClaimsSchema declara un claim reservado o del shape base: "${key}". Claims reservados (RFC 7519/8725 + OIDC Core 1.0 §2): ${RESERVED_JWT_CLAIMS.join(", ")}. Shape base del SDK (no permitidos en extraClaimsSchema): id, sessionId, clientId, empresaId.`);
+	}
+	_schemaValidationCache.set(schema, true);
+}
+/**
+* Verifica un access token de usuario: firma ES256 con una clave de usuario del JWKS (`kid` con
+* prefijo `usr-`; un token sin `kid` o firmado con una clave de servicio se rechaza), `typ: at+jwt`,
+* issuer, `aud` igual al producto configurado y claims base. Devuelve `id`, `sessionId`, `clientId`
+* (`client_id`) y `empresaId` (claim `empresa`, ausente si la sesión no tiene empresa activa).
+* Un token inválido o expirado devuelve `{ ok: false }` (401); no lanza.
+*
+* @throws Error de configuración (`name === 'EvaAuthConfigError'`) si `authUrl` o `product` no
+*   fueron configurados con `configureEvaAuth`: es un error del consumidor, no un token inválido,
+*   así que se propaga en vez de degradarse a 401. El consumidor ve un 500.
+*/
+async function verifyAccessToken(token, opts = {}) {
+	try {
+		const { payload } = await (0, jose.jwtVerify)(token, require_key_resolver.withKidPrefix(require_key_resolver.getJwksKeyFn(), require_tokens.USER_KID_PREFIX), {
+			issuer: require_constants.JWT_CONFIG.ISSUER,
+			audience: require_parse_error_response.getProduct(),
+			algorithms: [require_constants.JWT_CONFIG.ALGORITHM],
+			typ: require_tokens.USER_TOKEN_TYP,
+			requiredClaims: ["exp"]
+		});
+		const base = BaseClaimsSchema.safeParse(payload);
+		if (!base.success) return {
+			ok: false,
+			error: {
+				kind: "sdk",
+				reason: "token_invalid",
+				message: "Payload del token inválido",
+				status: 401
+			}
+		};
+		if (Array.isArray(payload.aud) || base.data.client_id !== require_parse_error_response.getProduct()) return {
+			ok: false,
+			error: {
+				kind: "sdk",
+				reason: "token_invalid",
+				message: "Payload del token inválido",
+				status: 401
+			}
+		};
+		const identity = {
+			id: base.data.sub,
+			sessionId: base.data.sessionId,
+			clientId: base.data.client_id,
+			...base.data.empresa !== void 0 && { empresaId: base.data.empresa }
+		};
+		if (!opts.extraClaimsSchema) return {
+			ok: true,
+			data: identity
+		};
+		assertSchemaNoReservedKeys(opts.extraClaimsSchema);
+		const raw = payload;
+		const extrasCandidate = {};
+		for (const [k, v] of Object.entries(raw)) if (!EXCLUDED_FROM_EXTRAS.has(k)) extrasCandidate[k] = v;
+		const parsed = await opts.extraClaimsSchema.safeParseAsync(extrasCandidate);
+		if (!parsed.success) return {
+			ok: false,
+			error: {
+				kind: "sdk",
+				reason: "token_invalid",
+				message: "Payload del token inválido (claims extra)",
+				status: 401
+			}
+		};
+		return {
+			ok: true,
+			data: {
+				...identity,
+				...parsed.data
+			}
+		};
+	} catch (err) {
+		if (require_parse_error_response.isEvaAuthConfigError(err)) throw err;
+		return {
+			ok: false,
+			error: {
+				kind: "sdk",
+				reason: "token_invalid",
+				message: err instanceof Error ? err.message : "Verificación de token fallida",
+				status: 401
+			}
+		};
+	}
+}
+Object.defineProperty(exports, "verifyAccessToken", {
+	enumerable: true,
+	get: function() {
+		return verifyAccessToken;
+	}
+});
+
+//# sourceMappingURL=jwt-BBNqk0TV.cjs.map

package/dist/jwt-BBNqk0TV.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-BBNqk0TV.cjs","names":["z","ZodObject","jwtVerify","withKidPrefix","getJwksKeyFn","USER_KID_PREFIX","JWT_CONFIG","getProduct","USER_TOKEN_TYP","isEvaAuthConfigError"],"sources":["../src/jwt-claims.ts","../src/jwt.ts"],"sourcesContent":["/**\n * Claims reservados que el SDK NUNCA expone en EvaTokenPayload,\n * aunque estén presentes en el JWT decodificado.\n *\n * Fuentes:\n * - RFC 7519 §4.1: iss, sub, aud, exp, nbf, iat, jti\n * - OIDC Core 1.0 §2: nonce, auth_time, acr, amr, azp\n *\n * Módulo interno — NO se exporta desde ningún barrel raíz.\n * Uso: src/jwt.ts (filtrado + assertSchemaNoReservedKeys).\n */\nexport const RESERVED_JWT_CLAIMS = [\n  'iat',\n  'exp',\n  'iss',\n  'aud',\n  'jti',\n  'sub',\n  'nbf',\n  'nonce',\n  'auth_time',\n  'acr',\n  'amr',\n  'azp',\n] as const\n\nexport type ReservedJwtClaim = (typeof RESERVED_JWT_CLAIMS)[number]\n","import { jwtVerify } from 'jose'\nimport { z, ZodObject } from 'zod'\nimport type { ZodType } from 'zod'\nimport { USER_KID_PREFIX, USER_TOKEN_TYP } from '@eva_solutions/auth-contracts'\nimport { getJwksKeyFn } from './jwks'\nimport { withKidPrefix } from './key-resolver'\nimport { getProduct, isEvaAuthConfigError } from './config'\nimport { JWT_CONFIG } from './constants'\nimport { RESERVED_JWT_CLAIMS } from './jwt-claims'\nimport type { EvaTokenPayload, Result, EvaSdkError } from './types'\n\n// Shape base que SIEMPRE debe estar en el JWT decodificado.\nconst BaseClaimsSchema = z.object({\n  sub: z.string(),\n  sessionId: z.string(),\n  // RFC 9068: el access token lleva `client_id` (el producto).\n  client_id: z.string().min(1),\n  // Empresa activa de la sesión; ausente si no hay.\n  empresa: z.string().min(1).optional(),\n})\n\n// Set de keys excluidas al construir extrasCandidate.\n// Incluye todos los reserved claims RFC/OIDC + las keys del shape base.\n// 'id' se agrega como defensa contra colisión si el JWT trae un claim 'id' distinto a sub.\nconst EXCLUDED_FROM_EXTRAS = new Set<string>([\n  ...RESERVED_JWT_CLAIMS,\n  'sub',\n  'sessionId',\n  'id',\n  'client_id',\n  'clientId',\n  'empresa',\n  'empresaId',\n])\n\n// WeakMap para cachear validación de schema (no re-inspeccionar por request).\nconst _schemaValidationCache = new WeakMap<ZodType<unknown>, true>()\n\n/**\n * Valida que el schema no declare claims reservados (RFC 7519 / OIDC Core 1.0)\n * ni claves del shape base (id, sessionId).\n * Lanza Error sincrono con mensaje claro — falla rápido en la primera invocación.\n * Solo se llama dentro del schema branch (zero overhead en path zero-config).\n * Cachea por referencia de schema con WeakMap.\n */\nfunction assertSchemaNoReservedKeys(schema: ZodType<unknown>): void {\n  if (_schemaValidationCache.has(schema)) return\n\n  if (schema instanceof ZodObject) {\n    for (const key of Object.keys(schema.shape as Record<string, unknown>)) {\n      if (EXCLUDED_FROM_EXTRAS.has(key)) {\n        throw new Error(\n          `extraClaimsSchema declara un claim reservado o del shape base: \"${key}\". ` +\n            `Claims reservados (RFC 7519/8725 + OIDC Core 1.0 §2): ${RESERVED_JWT_CLAIMS.join(', ')}. ` +\n            `Shape base del SDK (no permitidos en extraClaimsSchema): id, sessionId, clientId, empresaId.`,\n        )\n      }\n    }\n  }\n  // Schemas no-ZodObject (refinements, transforms, unions): no se puede inspeccionar\n  // estáticamente. extrasCandidate ya viene filtrado de reservados antes del parse,\n  // así que un schema que requiera 'exp' fallará por ausencia con mensaje claro de Zod.\n\n  _schemaValidationCache.set(schema, true)\n}\n\nexport type VerifyAccessTokenOptions<TExtra extends Record<string, unknown>> = {\n  extraClaimsSchema?: ZodType<TExtra>\n}\n\n/**\n * Verifica un access token de usuario: firma ES256 con una clave de usuario del JWKS (`kid` con\n * prefijo `usr-`; un token sin `kid` o firmado con una clave de servicio se rechaza), `typ: at+jwt`,\n * issuer, `aud` igual al producto configurado y claims base. Devuelve `id`, `sessionId`, `clientId`\n * (`client_id`) y `empresaId` (claim `empresa`, ausente si la sesión no tiene empresa activa).\n * Un token inválido o expirado devuelve `{ ok: false }` (401); no lanza.\n *\n * @throws Error de configuración (`name === 'EvaAuthConfigError'`) si `authUrl` o `product` no\n *   fueron configurados con `configureEvaAuth`: es un error del consumidor, no un token inválido,\n *   así que se propaga en vez de degradarse a 401. El consumidor ve un 500.\n */\nexport async function verifyAccessToken<\n  TExtra extends Record<string, unknown> = {},\n>(\n  token: string,\n  opts: VerifyAccessTokenOptions<TExtra> = {},\n): Promise<Result<EvaTokenPayload<TExtra>>> {\n  try {\n    // 1. Verificar firma + standard claims con jose.\n    const { payload } = await jwtVerify(\n      token,\n      withKidPrefix(getJwksKeyFn(), USER_KID_PREFIX),\n      {\n        issuer: JWT_CONFIG.ISSUER,\n        audience: getProduct(),\n        algorithms: [JWT_CONFIG.ALGORITHM],\n        typ: USER_TOKEN_TYP,\n        requiredClaims: ['exp'],\n      },\n    )\n\n    // 2. Validar shape base (sub + sessionId presentes).\n    const base = BaseClaimsSchema.safeParse(payload)\n    if (!base.success) {\n      return {\n        ok: false,\n        error: {\n          kind: 'sdk',\n          reason: 'token_invalid',\n          message: 'Payload del token inválido',\n          status: 401,\n        } satisfies EvaSdkError,\n      }\n    }\n\n    // Una sola audiencia y `client_id` igual al producto (así los emite Auth): un token con otra\n    // forma no es un access token de este producto aunque jose haya aceptado el `aud`.\n    if (Array.isArray(payload.aud) || base.data.client_id !== getProduct()) {\n      return {\n        ok: false,\n        error: {\n          kind: 'sdk',\n          reason: 'token_invalid',\n          message: 'Payload del token inválido',\n          status: 401,\n        } satisfies EvaSdkError,\n      }\n    }\n\n    const id = base.data.sub\n    const sessionId = base.data.sessionId\n    const identity = {\n      id,\n      sessionId,\n      clientId: base.data.client_id,\n      ...(base.data.empresa !== undefined && {\n        empresaId: base.data.empresa,\n      }),\n    }\n\n    // 3. Path SIN schema → drop everything excepto id/sessionId.\n    //    Defense-in-depth: el SDK NO expone claims que no validó.\n    if (!opts.extraClaimsSchema) {\n      return {\n        ok: true,\n        data: identity as EvaTokenPayload<TExtra>,\n      }\n    }\n\n    // 4. Path CON schema:\n    //    a) fail-fast si schema declara claims reservados o del shape base (cacheado).\n    assertSchemaNoReservedKeys(opts.extraClaimsSchema)\n\n    //    b) construir extrasCandidate: todos los claims del JWT raw EXCEPTO los excluidos.\n    const raw = payload as Record<string, unknown>\n    const extrasCandidate: Record<string, unknown> = {}\n    for (const [k, v] of Object.entries(raw)) {\n      if (!EXCLUDED_FROM_EXTRAS.has(k)) extrasCandidate[k] = v\n    }\n\n    //    c) parse async (cubre refinements/transforms async).\n    const parsed = await opts.extraClaimsSchema.safeParseAsync(extrasCandidate)\n    if (!parsed.success) {\n      return {\n        ok: false,\n        error: {\n          kind: 'sdk',\n          reason: 'token_invalid',\n          message: 'Payload del token inválido (claims extra)',\n          status: 401,\n        } satisfies EvaSdkError,\n      }\n    }\n\n    //    d) merge: base + parsed extras.\n    return {\n      ok: true,\n      data: {\n        ...identity,\n        ...parsed.data,\n      } as EvaTokenPayload<TExtra>,\n    }\n  } catch (err: unknown) {\n    // Falta de configuración (authUrl): no es un token inválido, no debe degradarse a 401.\n    if (isEvaAuthConfigError(err)) throw err\n    const message =\n      err instanceof Error ? err.message : 'Verificación de token fallida'\n    return {\n      ok: false,\n      error: {\n        kind: 'sdk',\n        reason: 'token_invalid',\n        message,\n        status: 401,\n      } satisfies EvaSdkError,\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAWA,MAAa,sBAAsB;CACjC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;ACZA,MAAM,mBAAmBA,IAAAA,EAAE,OAAO;CAChC,KAAKA,IAAAA,EAAE,OAAO;CACd,WAAWA,IAAAA,EAAE,OAAO;CAEpB,WAAWA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAE3B,SAASA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;AACtC,CAAC;AAKD,MAAM,uCAAuB,IAAI,IAAY;CAC3C,GAAG;CACH;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAGD,MAAM,yCAAyB,IAAI,QAAgC;;;;;;;;AASnE,SAAS,2BAA2B,QAAgC;CAClE,IAAI,uBAAuB,IAAI,MAAM,GAAG;CAExC,IAAI,kBAAkBC,IAAAA,WACf;OAAA,MAAM,OAAO,OAAO,KAAK,OAAO,KAAgC,GACnE,IAAI,qBAAqB,IAAI,GAAG,GAC9B,MAAM,IAAI,MACR,mEAAmE,IAAI,2DACZ,oBAAoB,KAAK,IAAI,EAAE,+FAE5F;CAAA;CAQN,uBAAuB,IAAI,QAAQ,IAAI;AACzC;;;;;;;;;;;;AAiBA,eAAsB,kBAGpB,OACA,OAAyC,CAAC,GACA;CAC1C,IAAI;EAEF,MAAM,EAAE,YAAY,OAAA,GAAMC,KAAAA,UAAAA,CACxB,OACAC,qBAAAA,cAAcC,qBAAAA,aAAa,GAAGC,eAAAA,eAAe,GAC7C;GACE,QAAQC,kBAAAA,WAAW;GACnB,UAAUC,6BAAAA,WAAW;GACrB,YAAY,CAACD,kBAAAA,WAAW,SAAS;GACjC,KAAKE,eAAAA;GACL,gBAAgB,CAAC,KAAK;EACxB,CACF;EAGA,MAAM,OAAO,iBAAiB,UAAU,OAAO;EAC/C,IAAI,CAAC,KAAK,SACR,OAAO;GACL,IAAI;GACJ,OAAO;IACL,MAAM;IACN,QAAQ;IACR,SAAS;IACT,QAAQ;GACV;EACF;EAKF,IAAI,MAAM,QAAQ,QAAQ,GAAG,KAAK,KAAK,KAAK,cAAcD,6BAAAA,WAAW,GACnE,OAAO;GACL,IAAI;GACJ,OAAO;IACL,MAAM;IACN,QAAQ;IACR,SAAS;IACT,QAAQ;GACV;EACF;EAKF,MAAM,WAAW;GACf,IAHS,KAAK,KAAK;GAInB,WAHgB,KAAK,KAAK;GAI1B,UAAU,KAAK,KAAK;GACpB,GAAI,KAAK,KAAK,YAAY,KAAA,KAAa,EACrC,WAAW,KAAK,KAAK,QACvB;EACF;EAIA,IAAI,CAAC,KAAK,mBACR,OAAO;GACL,IAAI;GACJ,MAAM;EACR;EAKF,2BAA2B,KAAK,iBAAiB;EAGjD,MAAM,MAAM;EACZ,MAAM,kBAA2C,CAAC;EAClD,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,GAAG,GACrC,IAAI,CAAC,qBAAqB,IAAI,CAAC,GAAG,gBAAgB,KAAK;EAIzD,MAAM,SAAS,MAAM,KAAK,kBAAkB,eAAe,eAAe;EAC1E,IAAI,CAAC,OAAO,SACV,OAAO;GACL,IAAI;GACJ,OAAO;IACL,MAAM;IACN,QAAQ;IACR,SAAS;IACT,QAAQ;GACV;EACF;EAIF,OAAO;GACL,IAAI;GACJ,MAAM;IACJ,GAAG;IACH,GAAG,OAAO;GACZ;EACF;CACF,SAAS,KAAc;EAErB,IAAIE,6BAAAA,qBAAqB,GAAG,GAAG,MAAM;EAGrC,OAAO;GACL,IAAI;GACJ,OAAO;IACL,MAAM;IACN,QAAQ;IACR,SANF,eAAe,QAAQ,IAAI,UAAU;IAOnC,QAAQ;GACV;EACF;CACF;AACF"}