@eva_solutions/auth-sdk 0.0.0-stage → 3.0.0-dev-20261107051125

package/dist/admin-DjvuvuI8.js

@@ -0,0 +1,408 @@
+import { t as ADMIN_ROUTES } from "./routes-F1g5aVqP.js";
+import { t as apiPath } from "./api-path-B-vSkL2H.js";
+import { t as parseErrorResponse, u as validateHttpsUrl } from "./parse-error-response-BM9-kjs0.js";
+import { t as encodePathSegment } from "./path-segment-CyqnaFrP.js";
+import { i as signS2SHeaders } from "./sign-HFtcYwa-.js";
+// src/admin/client.ts
+/**
+* Cliente Admin para provisioning de service clients y gestión de usuarios
+* en el Auth Service.
+*
+* REQ-ADMIN-01, REQ-ADMIN-02, REQ-ADMIN-03, REQ-ADMIN-04, REQ-ADMIN-05 LOCKED.
+* REQ-RESTORE-01 LOCKED: endpoint POST /admin/users/:id/restore.
+*
+* Autenticación: firma HMAC S2S de un service client con la marca `esAdmin` (la superficie
+* `/admin` de Auth es la única, junto con el pedido de token, que conserva la firma). Una persona,
+* un client: el API registra el slug que firmó como `actor`.
+*
+* Endpoints:
+*   POST   /admin/service-clients                       → createServiceClient
+*   GET    /admin/service-clients                       → listServiceClients
+*   GET    /admin/service-clients/:slug                 → getServiceClient
+*   PATCH  /admin/service-clients/:slug                 → updateServiceClient
+*   DELETE /admin/service-clients/:slug                 → deleteServiceClient (204)
+*   POST   /admin/service-clients/:slug/rotate-secret   → rotateServiceClientSecret
+*   GET    /admin/service-clients/:slug/grants          → listServiceClientGrants
+*   PUT    /admin/service-clients/:slug/grants          → setServiceClientGrant
+*   DELETE /admin/service-clients/:slug/grants/:audience → deleteServiceClientGrant (204)
+*   GET    /admin/service-clients/:slug/delegations     → listServiceClientDelegations
+*   PUT    /admin/service-clients/:slug/delegations     → setServiceClientDelegation
+*   DELETE /admin/service-clients/:slug/delegations/:audience → deleteServiceClientDelegation (204)
+*   GET    /admin/productos/:slug/permisos-autorizables → getProductoPermisosAutorizables
+*   PUT    /admin/productos/:slug/permisos-autorizables → setProductoPermisosAutorizables
+*   POST   /admin/empresas/:id/titular                  → reassignEmpresaTitular
+*   POST   /admin/empresas/:id/baja                     → bajaEmpresa
+*   POST   /admin/empresas/:id/reactivar                → reactivarEmpresa
+*   PUT    /admin/empresas/:id/productos/:producto      → setContratacion
+*   GET    /admin/productos                             → listProductos
+*   POST   /admin/productos                             → createProducto (201)
+*   PATCH  /admin/productos/:slug                       → updateProducto
+*   POST   /admin/users/:id/restore                     → restoreUser
+*   POST   /admin/webhooks/republish-pending            → republishPendingWebhooks
+*   POST   /admin/maintenance/cleanup                   → maintenanceCleanup
+*
+* Los paths salen de `ADMIN_ROUTES` (contrato compartido) vía `apiPath`; el slug y el id se
+* codifican como UN segmento con `encodePathSegment` (el mismo helper del cliente S2S) antes de
+* insertarlos. Un slug/id vacío, `.`, `..` o que no sea string devuelve un `Result` de error
+* (`kind: 'sdk'`, `reason: 'malformed'`) sin hacer la request.
+*/
+const encoder = new TextEncoder();
+/**
+* Realiza un fetch autenticado S2S firmando el request con HMAC-SHA-256.
+* Retorna `Result<T>` con la propiedad `data` del body de respuesta.
+*/
+async function adminFetch({ config, method, pathname, rawQuery = "", body }) {
+	try {
+		const bodyBytes = body !== void 0 ? encoder.encode(JSON.stringify(body)) : /* @__PURE__ */ new Uint8Array(0);
+		const url = rawQuery ? `${config.baseUrl}${pathname}?${rawQuery}` : `${config.baseUrl}${pathname}`;
+		const target = new URL(url);
+		const headers = {
+			"content-type": "application/json",
+			...await signS2SHeaders({
+				method,
+				path: target.pathname,
+				rawQuery: target.search.slice(1),
+				bodyBytes,
+				clientId: config.clientId,
+				secretHex: config.secretHex
+			})
+		};
+		const res = await fetch(url, {
+			method,
+			headers,
+			body: bodyBytes.length > 0 ? JSON.stringify(body) : void 0,
+			signal: AbortSignal.timeout(1e4)
+		});
+		if (!res.ok) {
+			const responseBody = await res.json().catch(() => null);
+			return {
+				ok: false,
+				error: parseErrorResponse(res.status, responseBody)
+			};
+		}
+		if (res.status === 204) return {
+			ok: true,
+			data: void 0
+		};
+		return {
+			ok: true,
+			data: (await res.json()).data
+		};
+	} catch (err) {
+		return {
+			ok: false,
+			error: {
+				kind: "sdk",
+				reason: "network",
+				message: err instanceof Error ? err.message : "Network error",
+				status: 0
+			}
+		};
+	}
+}
+/**
+* Result de error para un slug/id que no se puede usar como segmento del path. Se devuelve antes
+* de armar la URL: `apiPath` lanzaría con un param ausente y la promesa se rechazaría.
+*/
+function invalidParamResult(method, param) {
+	return {
+		ok: false,
+		error: {
+			kind: "sdk",
+			reason: "malformed",
+			message: `${method}: ${param} inválido (no puede ser vacío, "." ni "..")`,
+			status: 0
+		}
+	};
+}
+/**
+* Crea un cliente Admin para provisioning del Auth Service.
+*
+* ADVERTENCIA: solo usar desde backends o herramientas de operador seguras — el secret del
+* service client admin nunca debe exponerse en el cliente/browser.
+*
+* @example
+* ```ts
+* const admin = createAdminClient({
+*   clientId: process.env.AUTH_ADMIN_SLUG,
+*   secretHex: process.env.AUTH_ADMIN_SECRET,
+*   baseUrl: 'https://auth.miapp.com',
+* })
+* const result = await admin.createServiceClient({ slug: 'mi-servicio' })
+* if (!result.ok) return handleError(result.error)
+* console.log('Secret (guardar ahora):', result.data.secret)
+* ```
+*/
+function createAdminClient(config) {
+	validateHttpsUrl(config.baseUrl, "AdminClientConfig.baseUrl");
+	return {
+		async createServiceClient(input) {
+			return adminFetch({
+				config,
+				method: "POST",
+				pathname: apiPath(ADMIN_ROUTES.createServiceClient),
+				body: input
+			});
+		},
+		async listServiceClients() {
+			return adminFetch({
+				config,
+				method: "GET",
+				pathname: apiPath(ADMIN_ROUTES.listServiceClients)
+			});
+		},
+		async getServiceClient(slug) {
+			const segment = encodePathSegment(slug);
+			if (segment === null) return invalidParamResult("getServiceClient", "slug");
+			return adminFetch({
+				config,
+				method: "GET",
+				pathname: apiPath(ADMIN_ROUTES.getServiceClient, { slug: segment })
+			});
+		},
+		async updateServiceClient(slug, input) {
+			const segment = encodePathSegment(slug);
+			if (segment === null) return invalidParamResult("updateServiceClient", "slug");
+			return adminFetch({
+				config,
+				method: "PATCH",
+				pathname: apiPath(ADMIN_ROUTES.updateServiceClient, { slug: segment }),
+				body: input
+			});
+		},
+		async deleteServiceClient(slug) {
+			const segment = encodePathSegment(slug);
+			if (segment === null) return invalidParamResult("deleteServiceClient", "slug");
+			return adminFetch({
+				config,
+				method: "DELETE",
+				pathname: apiPath(ADMIN_ROUTES.deleteServiceClient, { slug: segment })
+			});
+		},
+		async rotateServiceClientSecret(slug) {
+			const segment = encodePathSegment(slug);
+			if (segment === null) return invalidParamResult("rotateServiceClientSecret", "slug");
+			return adminFetch({
+				config,
+				method: "POST",
+				pathname: apiPath(ADMIN_ROUTES.rotateServiceClientSecret, { slug: segment })
+			});
+		},
+		async listServiceClientGrants(slug) {
+			const segment = encodePathSegment(slug);
+			if (segment === null) return invalidParamResult("listServiceClientGrants", "slug");
+			return adminFetch({
+				config,
+				method: "GET",
+				pathname: apiPath(ADMIN_ROUTES.listServiceClientGrants, { slug: segment })
+			});
+		},
+		async setServiceClientGrant(slug, input) {
+			const segment = encodePathSegment(slug);
+			if (segment === null) return invalidParamResult("setServiceClientGrant", "slug");
+			return adminFetch({
+				config,
+				method: "PUT",
+				pathname: apiPath(ADMIN_ROUTES.setServiceClientGrant, { slug: segment }),
+				body: input
+			});
+		},
+		async deleteServiceClientGrant(slug, audience) {
+			const segment = encodePathSegment(slug);
+			if (segment === null) return invalidParamResult("deleteServiceClientGrant", "slug");
+			const audienceSegment = encodePathSegment(audience);
+			if (audienceSegment === null) return invalidParamResult("deleteServiceClientGrant", "audience");
+			return adminFetch({
+				config,
+				method: "DELETE",
+				pathname: apiPath(ADMIN_ROUTES.deleteServiceClientGrant, {
+					slug: segment,
+					audience: audienceSegment
+				})
+			});
+		},
+		async listServiceClientDelegations(slug) {
+			const segment = encodePathSegment(slug);
+			if (segment === null) return invalidParamResult("listServiceClientDelegations", "slug");
+			return adminFetch({
+				config,
+				method: "GET",
+				pathname: apiPath(ADMIN_ROUTES.listServiceClientDelegations, { slug: segment })
+			});
+		},
+		async setServiceClientDelegation(slug, input) {
+			const segment = encodePathSegment(slug);
+			if (segment === null) return invalidParamResult("setServiceClientDelegation", "slug");
+			return adminFetch({
+				config,
+				method: "PUT",
+				pathname: apiPath(ADMIN_ROUTES.setServiceClientDelegation, { slug: segment }),
+				body: input
+			});
+		},
+		async deleteServiceClientDelegation(slug, audience) {
+			const segment = encodePathSegment(slug);
+			if (segment === null) return invalidParamResult("deleteServiceClientDelegation", "slug");
+			const audienceSegment = encodePathSegment(audience);
+			if (audienceSegment === null) return invalidParamResult("deleteServiceClientDelegation", "audience");
+			return adminFetch({
+				config,
+				method: "DELETE",
+				pathname: apiPath(ADMIN_ROUTES.deleteServiceClientDelegation, {
+					slug: segment,
+					audience: audienceSegment
+				})
+			});
+		},
+		async getProductoPermisosAutorizables(slug) {
+			const segment = encodePathSegment(slug);
+			if (segment === null) return invalidParamResult("getProductoPermisosAutorizables", "slug");
+			return adminFetch({
+				config,
+				method: "GET",
+				pathname: apiPath(ADMIN_ROUTES.getProductoPermisosAutorizables, { slug: segment })
+			});
+		},
+		async setProductoPermisosAutorizables(slug, input) {
+			const segment = encodePathSegment(slug);
+			if (segment === null) return invalidParamResult("setProductoPermisosAutorizables", "slug");
+			return adminFetch({
+				config,
+				method: "PUT",
+				pathname: apiPath(ADMIN_ROUTES.setProductoPermisosAutorizables, { slug: segment }),
+				body: input
+			});
+		},
+		async reassignEmpresaTitular(empresaId, input) {
+			const segment = encodePathSegment(empresaId);
+			if (segment === null) return invalidParamResult("reassignEmpresaTitular", "empresaId");
+			return adminFetch({
+				config,
+				method: "POST",
+				pathname: apiPath(ADMIN_ROUTES.reassignEmpresaTitular, { id: segment }),
+				body: input
+			});
+		},
+		async bajaEmpresa(empresaId) {
+			const segment = encodePathSegment(empresaId);
+			if (segment === null) return invalidParamResult("bajaEmpresa", "empresaId");
+			return adminFetch({
+				config,
+				method: "POST",
+				pathname: apiPath(ADMIN_ROUTES.bajaEmpresa, { id: segment })
+			});
+		},
+		async reactivarEmpresa(empresaId) {
+			const segment = encodePathSegment(empresaId);
+			if (segment === null) return invalidParamResult("reactivarEmpresa", "empresaId");
+			return adminFetch({
+				config,
+				method: "POST",
+				pathname: apiPath(ADMIN_ROUTES.reactivarEmpresa, { id: segment })
+			});
+		},
+		async setContratacion(empresaId, producto, input) {
+			const segment = encodePathSegment(empresaId);
+			if (segment === null) return invalidParamResult("setContratacion", "empresaId");
+			const productoSegment = encodePathSegment(producto);
+			if (productoSegment === null) return invalidParamResult("setContratacion", "producto");
+			return adminFetch({
+				config,
+				method: "PUT",
+				pathname: apiPath(ADMIN_ROUTES.setContratacion, {
+					id: segment,
+					producto: productoSegment
+				}),
+				body: input
+			});
+		},
+		async listProductos() {
+			return adminFetch({
+				config,
+				method: "GET",
+				pathname: apiPath(ADMIN_ROUTES.listProductos)
+			});
+		},
+		async createProducto(input) {
+			return adminFetch({
+				config,
+				method: "POST",
+				pathname: apiPath(ADMIN_ROUTES.createProducto),
+				body: input
+			});
+		},
+		async updateProducto(slug, input) {
+			const segment = encodePathSegment(slug);
+			if (segment === null) return invalidParamResult("updateProducto", "slug");
+			return adminFetch({
+				config,
+				method: "PATCH",
+				pathname: apiPath(ADMIN_ROUTES.updateProducto, { slug: segment }),
+				body: input
+			});
+		},
+		async restoreUser(userId) {
+			const segment = encodePathSegment(userId);
+			if (segment === null) return invalidParamResult("restoreUser", "userId");
+			return adminFetch({
+				config,
+				method: "POST",
+				pathname: apiPath(ADMIN_ROUTES.restoreUser, { id: segment })
+			});
+		},
+		async republishPendingWebhooks(query) {
+			const params = new URLSearchParams();
+			if (query?.older_than_minutes !== void 0) params.set("older_than_minutes", String(query.older_than_minutes));
+			if (query?.limit !== void 0) params.set("limit", String(query.limit));
+			return adminFetch({
+				config,
+				method: "POST",
+				pathname: apiPath(ADMIN_ROUTES.republishPendingWebhooks),
+				rawQuery: params.toString()
+			});
+		},
+		async maintenanceCleanup(query) {
+			const params = new URLSearchParams();
+			if (query?.limit !== void 0) params.set("limit", String(query.limit));
+			return adminFetch({
+				config,
+				method: "POST",
+				pathname: apiPath(ADMIN_ROUTES.maintenanceCleanup),
+				rawQuery: params.toString()
+			});
+		}
+	};
+}
+// src/admin/error-codes.ts
+/**
+* Códigos de error específicos del módulo Admin.
+*
+* Complementan a `ERROR_CODES` (core) para errores que solo ocurren
+* en operaciones de provisioning de service clients.
+*
+* @example
+* ```ts
+* import { ADMIN_ERROR_CODES } from '@eva_solutions/auth-sdk/admin'
+*
+* if (!result.ok && result.error.code === ADMIN_ERROR_CODES.service_client_already_exists) {
+*   return res.status(409).json({ error: 'El service client ya existe' })
+* }
+* ```
+*/
+const ADMIN_ERROR_CODES = {
+	service_client_already_exists: "service_client_already_exists",
+	service_client_not_found: "service_client_not_found",
+	/**
+	* `rotate-secret` perdió contra otra rotación concurrente del mismo service client (409).
+	* El perdedor no recibe secret; es reintentable.
+	*/
+	service_client_secret_rotation_conflict: "service_client_secret_rotation_conflict",
+	/**
+	* La operación dejaría al sistema sin ningún service client admin habilitado (409): borrar,
+	* deshabilitar o quitarle `esAdmin` al último. No se aplica; habilita o crea otro admin.
+	*/
+	last_admin_client: "last_admin_client"
+};
+export { createAdminClient as n, ADMIN_ERROR_CODES as t };
+
+//# sourceMappingURL=admin-DjvuvuI8.js.map

package/dist/admin-DjvuvuI8.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-DjvuvuI8.js","names":[],"sources":["../src/admin/client.ts","../src/admin/error-codes.ts"],"sourcesContent":["/**\n * Cliente Admin para provisioning de service clients y gestión de usuarios\n * en el Auth Service.\n *\n * REQ-ADMIN-01, REQ-ADMIN-02, REQ-ADMIN-03, REQ-ADMIN-04, REQ-ADMIN-05 LOCKED.\n * REQ-RESTORE-01 LOCKED: endpoint POST /admin/users/:id/restore.\n *\n * Autenticación: firma HMAC S2S de un service client con la marca `esAdmin` (la superficie\n * `/admin` de Auth es la única, junto con el pedido de token, que conserva la firma). Una persona,\n * un client: el API registra el slug que firmó como `actor`.\n *\n * Endpoints:\n *   POST   /admin/service-clients                       → createServiceClient\n *   GET    /admin/service-clients                       → listServiceClients\n *   GET    /admin/service-clients/:slug                 → getServiceClient\n *   PATCH  /admin/service-clients/:slug                 → updateServiceClient\n *   DELETE /admin/service-clients/:slug                 → deleteServiceClient (204)\n *   POST   /admin/service-clients/:slug/rotate-secret   → rotateServiceClientSecret\n *   GET    /admin/service-clients/:slug/grants          → listServiceClientGrants\n *   PUT    /admin/service-clients/:slug/grants          → setServiceClientGrant\n *   DELETE /admin/service-clients/:slug/grants/:audience → deleteServiceClientGrant (204)\n *   GET    /admin/service-clients/:slug/delegations     → listServiceClientDelegations\n *   PUT    /admin/service-clients/:slug/delegations     → setServiceClientDelegation\n *   DELETE /admin/service-clients/:slug/delegations/:audience → deleteServiceClientDelegation (204)\n *   GET    /admin/productos/:slug/permisos-autorizables → getProductoPermisosAutorizables\n *   PUT    /admin/productos/:slug/permisos-autorizables → setProductoPermisosAutorizables\n *   POST   /admin/empresas/:id/titular                  → reassignEmpresaTitular\n *   POST   /admin/empresas/:id/baja                     → bajaEmpresa\n *   POST   /admin/empresas/:id/reactivar                → reactivarEmpresa\n *   PUT    /admin/empresas/:id/productos/:producto      → setContratacion\n *   GET    /admin/productos                             → listProductos\n *   POST   /admin/productos                             → createProducto (201)\n *   PATCH  /admin/productos/:slug                       → updateProducto\n *   POST   /admin/users/:id/restore                     → restoreUser\n *   POST   /admin/webhooks/republish-pending            → republishPendingWebhooks\n *   POST   /admin/maintenance/cleanup                   → maintenanceCleanup\n *\n * Los paths salen de `ADMIN_ROUTES` (contrato compartido) vía `apiPath`; el slug y el id se\n * codifican como UN segmento con `encodePathSegment` (el mismo helper del cliente S2S) antes de\n * insertarlos. Un slug/id vacío, `.`, `..` o que no sea string devuelve un `Result` de error\n * (`kind: 'sdk'`, `reason: 'malformed'`) sin hacer la request.\n */\n\nimport { ADMIN_ROUTES } from '@eva_solutions/auth-contracts'\nimport { apiPath } from '../api-path'\nimport { validateHttpsUrl } from '../config'\nimport { parseErrorResponse } from '../parse-error-response'\nimport { encodePathSegment } from '../path-segment'\nimport { signS2SHeaders } from '../s2s/sign'\nimport type { Result } from '../types'\nimport type {\n  AdminClientConfig,\n  AdminContratacionResult,\n  AdminEmpresaEstadoResult,\n  AdminSetContratacionInput,\n  ListServiceClientDelegationsResult,\n  ProductoPermisosAutorizablesResult,\n  ReassignEmpresaTitularInput,\n  ReassignEmpresaTitularResult,\n  ServiceClientDelegation,\n  SetProductoPermisosAutorizablesInput,\n  SetServiceClientDelegationInput,\n  ServiceClientPublic,\n  CreateServiceClientInput,\n  CreateProductoInput,\n  CreateServiceClientResult,\n  ListProductosResult,\n  ListServiceClientGrantsResult,\n  ProductoResult,\n  UpdateProductoInput,\n  ServiceClientGrant,\n  SetServiceClientGrantInput,\n  UpdateServiceClientInput,\n  UpdateServiceClientResult,\n  RotateSecretResult,\n  RestoreUserResult,\n  MaintenanceCleanupQuery,\n  MaintenanceCleanupResult,\n  RepublishPendingWebhooksQuery,\n  RepublishPendingWebhooksResult,\n} from './types'\n\nconst encoder = new TextEncoder()\n\n/**\n * Tipo del cliente Admin retornado por `createAdminClient`.\n */\nexport type AdminClient = {\n  createServiceClient(\n    input: CreateServiceClientInput,\n  ): Promise<Result<CreateServiceClientResult>>\n  listServiceClients(): Promise<Result<{ clientes: ServiceClientPublic[] }>>\n  getServiceClient(\n    slug: string,\n  ): Promise<Result<{ cliente: ServiceClientPublic }>>\n  updateServiceClient(\n    slug: string,\n    input: UpdateServiceClientInput,\n  ): Promise<Result<UpdateServiceClientResult>>\n  deleteServiceClient(slug: string): Promise<Result<void>>\n  rotateServiceClientSecret(slug: string): Promise<Result<RotateSecretResult>>\n  listServiceClientGrants(\n    slug: string,\n  ): Promise<Result<ListServiceClientGrantsResult>>\n  /** Crea o reemplaza la concesión del client sobre una audiencia. */\n  setServiceClientGrant(\n    slug: string,\n    input: SetServiceClientGrantInput,\n  ): Promise<Result<{ grant: ServiceClientGrant }>>\n  deleteServiceClientGrant(\n    slug: string,\n    audience: string,\n  ): Promise<Result<void>>\n  /** Lista las aristas de delegación del client (token exchange). */\n  listServiceClientDelegations(\n    slug: string,\n  ): Promise<Result<ListServiceClientDelegationsResult>>\n  /** Crea o reemplaza la arista del client hacia una audiencia delegable (`scopes`, `requiere_scope_origen`). */\n  setServiceClientDelegation(\n    slug: string,\n    input: SetServiceClientDelegationInput,\n  ): Promise<Result<{ delegation: ServiceClientDelegation }>>\n  deleteServiceClientDelegation(\n    slug: string,\n    audience: string,\n  ): Promise<Result<void>>\n  /** Permisos entre empresas que el producto puede conceder en nombre de sus empresas. */\n  getProductoPermisosAutorizables(\n    slug: string,\n  ): Promise<Result<ProductoPermisosAutorizablesResult>>\n  /** Reemplaza la lista de permisos autorizables del producto (vacía = ninguno). */\n  setProductoPermisosAutorizables(\n    slug: string,\n    input: SetProductoPermisosAutorizablesInput,\n  ): Promise<Result<ProductoPermisosAutorizablesResult>>\n  /** Reasigna el titular de una empresa (disputa de RUC o empresa sin titular). */\n  reassignEmpresaTitular(\n    empresaId: string,\n    input: ReassignEmpresaTitularInput,\n  ): Promise<Result<ReassignEmpresaTitularResult>>\n  /** Da de baja una empresa (limpia sus sesiones activas; las autorizaciones y contrataciones dejan de valer). */\n  bajaEmpresa(empresaId: string): Promise<Result<AdminEmpresaEstadoResult>>\n  /** Reactiva una empresa de baja. */\n  reactivarEmpresa(empresaId: string): Promise<Result<AdminEmpresaEstadoResult>>\n  /** Escribe el estado y el vencimiento de la contratación de un producto por una empresa (hasta que exista facturación, así se activa a mano). */\n  setContratacion(\n    empresaId: string,\n    producto: string,\n    input: AdminSetContratacionInput,\n  ): Promise<Result<AdminContratacionResult>>\n  /** Lista los productos (la audiencia del access token de usuario). */\n  listProductos(): Promise<Result<ListProductosResult>>\n  /** Crea un producto (201). 409 si el slug existe; 400 si es una audiencia de servicio. */\n  createProducto(input: CreateProductoInput): Promise<Result<ProductoResult>>\n  /** Actualiza `nombre` o `enabled`. 404 si no existe; 400 con body vacío. No hay delete: se deshabilita. */\n  updateProducto(\n    slug: string,\n    input: UpdateProductoInput,\n  ): Promise<Result<ProductoResult>>\n  restoreUser(userId: string): Promise<Result<RestoreUserResult>>\n  republishPendingWebhooks(\n    query?: RepublishPendingWebhooksQuery,\n  ): Promise<Result<RepublishPendingWebhooksResult>>\n  maintenanceCleanup(\n    query?: MaintenanceCleanupQuery,\n  ): Promise<Result<MaintenanceCleanupResult>>\n}\n\n// ---------------------------------------------------------------------------\n// Helper interno\n// ---------------------------------------------------------------------------\n\n/**\n * Realiza un fetch autenticado S2S firmando el request con HMAC-SHA-256.\n * Retorna `Result<T>` con la propiedad `data` del body de respuesta.\n */\nasync function adminFetch<T>({\n  config,\n  method,\n  pathname,\n  rawQuery = '',\n  body,\n}: {\n  config: AdminClientConfig\n  method: string\n  pathname: string\n  rawQuery?: string\n  body?: unknown\n}): Promise<Result<T>> {\n  try {\n    const bodyBytes: Uint8Array =\n      body !== undefined\n        ? encoder.encode(JSON.stringify(body))\n        : new Uint8Array(0)\n\n    const url = rawQuery\n      ? `${config.baseUrl}${pathname}?${rawQuery}`\n      : `${config.baseUrl}${pathname}`\n\n    // Se firma el pathname y el query de la URL FINAL (incluido el prefijo de `baseUrl`), que es\n    // lo que el verificador lee en `request.url`.\n    const target = new URL(url)\n    const authHeaders = await signS2SHeaders({\n      method,\n      path: target.pathname,\n      rawQuery: target.search.slice(1),\n      bodyBytes,\n      clientId: config.clientId,\n      secretHex: config.secretHex,\n    })\n\n    const headers: Record<string, string> = {\n      'content-type': 'application/json',\n      ...authHeaders,\n    }\n\n    const res = await fetch(url, {\n      method,\n      headers,\n      body: bodyBytes.length > 0 ? JSON.stringify(body) : undefined,\n      signal: AbortSignal.timeout(10_000),\n    })\n\n    if (!res.ok) {\n      const responseBody = await res.json().catch(() => null)\n      return { ok: false, error: parseErrorResponse(res.status, responseBody) }\n    }\n\n    // 204 No Content — Result<void>\n    if (res.status === 204) {\n      return { ok: true, data: undefined as T }\n    }\n\n    const json = (await res.json()) as { data: T }\n    return { ok: true, data: json.data }\n  } catch (err) {\n    const message = err instanceof Error ? err.message : 'Network error'\n    return {\n      ok: false,\n      error: {\n        kind: 'sdk',\n        reason: 'network',\n        message,\n        status: 0,\n      },\n    }\n  }\n}\n\n/**\n * Result de error para un slug/id que no se puede usar como segmento del path. Se devuelve antes\n * de armar la URL: `apiPath` lanzaría con un param ausente y la promesa se rechazaría.\n */\nfunction invalidParamResult(method: string, param: string): Result<never> {\n  return {\n    ok: false,\n    error: {\n      kind: 'sdk',\n      reason: 'malformed',\n      message: `${method}: ${param} inválido (no puede ser vacío, \".\" ni \"..\")`,\n      status: 0,\n    },\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Factory\n// ---------------------------------------------------------------------------\n\n/**\n * Crea un cliente Admin para provisioning del Auth Service.\n *\n * ADVERTENCIA: solo usar desde backends o herramientas de operador seguras — el secret del\n * service client admin nunca debe exponerse en el cliente/browser.\n *\n * @example\n * ```ts\n * const admin = createAdminClient({\n *   clientId: process.env.AUTH_ADMIN_SLUG,\n *   secretHex: process.env.AUTH_ADMIN_SECRET,\n *   baseUrl: 'https://auth.miapp.com',\n * })\n * const result = await admin.createServiceClient({ slug: 'mi-servicio' })\n * if (!result.ok) return handleError(result.error)\n * console.log('Secret (guardar ahora):', result.data.secret)\n * ```\n */\nexport function createAdminClient(config: AdminClientConfig): AdminClient {\n  validateHttpsUrl(config.baseUrl, 'AdminClientConfig.baseUrl')\n  return {\n    async createServiceClient(\n      input: CreateServiceClientInput,\n    ): Promise<Result<CreateServiceClientResult>> {\n      return adminFetch<CreateServiceClientResult>({\n        config,\n        method: 'POST',\n        pathname: apiPath(ADMIN_ROUTES.createServiceClient),\n        body: input,\n      })\n    },\n\n    async listServiceClients(): Promise<\n      Result<{ clientes: ServiceClientPublic[] }>\n    > {\n      return adminFetch<{ clientes: ServiceClientPublic[] }>({\n        config,\n        method: 'GET',\n        pathname: apiPath(ADMIN_ROUTES.listServiceClients),\n      })\n    },\n\n    async getServiceClient(\n      slug: string,\n    ): Promise<Result<{ cliente: ServiceClientPublic }>> {\n      const segment = encodePathSegment(slug)\n      if (segment === null)\n        return invalidParamResult('getServiceClient', 'slug')\n      return adminFetch<{ cliente: ServiceClientPublic }>({\n        config,\n        method: 'GET',\n        pathname: apiPath(ADMIN_ROUTES.getServiceClient, { slug: segment }),\n      })\n    },\n\n    async updateServiceClient(\n      slug: string,\n      input: UpdateServiceClientInput,\n    ): Promise<Result<UpdateServiceClientResult>> {\n      const segment = encodePathSegment(slug)\n      if (segment === null) {\n        return invalidParamResult('updateServiceClient', 'slug')\n      }\n      return adminFetch<UpdateServiceClientResult>({\n        config,\n        method: 'PATCH',\n        pathname: apiPath(ADMIN_ROUTES.updateServiceClient, { slug: segment }),\n        body: input,\n      })\n    },\n\n    async deleteServiceClient(slug: string): Promise<Result<void>> {\n      const segment = encodePathSegment(slug)\n      if (segment === null) {\n        return invalidParamResult('deleteServiceClient', 'slug')\n      }\n      return adminFetch<void>({\n        config,\n        method: 'DELETE',\n        pathname: apiPath(ADMIN_ROUTES.deleteServiceClient, { slug: segment }),\n      })\n    },\n\n    async rotateServiceClientSecret(\n      slug: string,\n    ): Promise<Result<RotateSecretResult>> {\n      const segment = encodePathSegment(slug)\n      if (segment === null) {\n        return invalidParamResult('rotateServiceClientSecret', 'slug')\n      }\n      return adminFetch<RotateSecretResult>({\n        config,\n        method: 'POST',\n        pathname: apiPath(ADMIN_ROUTES.rotateServiceClientSecret, {\n          slug: segment,\n        }),\n      })\n    },\n\n    async listServiceClientGrants(\n      slug: string,\n    ): Promise<Result<ListServiceClientGrantsResult>> {\n      const segment = encodePathSegment(slug)\n      if (segment === null) {\n        return invalidParamResult('listServiceClientGrants', 'slug')\n      }\n      return adminFetch<ListServiceClientGrantsResult>({\n        config,\n        method: 'GET',\n        pathname: apiPath(ADMIN_ROUTES.listServiceClientGrants, {\n          slug: segment,\n        }),\n      })\n    },\n\n    async setServiceClientGrant(\n      slug: string,\n      input: SetServiceClientGrantInput,\n    ): Promise<Result<{ grant: ServiceClientGrant }>> {\n      const segment = encodePathSegment(slug)\n      if (segment === null) {\n        return invalidParamResult('setServiceClientGrant', 'slug')\n      }\n      return adminFetch<{ grant: ServiceClientGrant }>({\n        config,\n        method: 'PUT',\n        pathname: apiPath(ADMIN_ROUTES.setServiceClientGrant, {\n          slug: segment,\n        }),\n        body: input,\n      })\n    },\n\n    async deleteServiceClientGrant(\n      slug: string,\n      audience: string,\n    ): Promise<Result<void>> {\n      const segment = encodePathSegment(slug)\n      if (segment === null) {\n        return invalidParamResult('deleteServiceClientGrant', 'slug')\n      }\n      const audienceSegment = encodePathSegment(audience)\n      if (audienceSegment === null) {\n        return invalidParamResult('deleteServiceClientGrant', 'audience')\n      }\n      return adminFetch<void>({\n        config,\n        method: 'DELETE',\n        pathname: apiPath(ADMIN_ROUTES.deleteServiceClientGrant, {\n          slug: segment,\n          audience: audienceSegment,\n        }),\n      })\n    },\n\n    async listServiceClientDelegations(\n      slug: string,\n    ): Promise<Result<ListServiceClientDelegationsResult>> {\n      const segment = encodePathSegment(slug)\n      if (segment === null) {\n        return invalidParamResult('listServiceClientDelegations', 'slug')\n      }\n      return adminFetch<ListServiceClientDelegationsResult>({\n        config,\n        method: 'GET',\n        pathname: apiPath(ADMIN_ROUTES.listServiceClientDelegations, {\n          slug: segment,\n        }),\n      })\n    },\n\n    async setServiceClientDelegation(\n      slug: string,\n      input: SetServiceClientDelegationInput,\n    ): Promise<Result<{ delegation: ServiceClientDelegation }>> {\n      const segment = encodePathSegment(slug)\n      if (segment === null) {\n        return invalidParamResult('setServiceClientDelegation', 'slug')\n      }\n      return adminFetch<{ delegation: ServiceClientDelegation }>({\n        config,\n        method: 'PUT',\n        pathname: apiPath(ADMIN_ROUTES.setServiceClientDelegation, {\n          slug: segment,\n        }),\n        body: input,\n      })\n    },\n\n    async deleteServiceClientDelegation(\n      slug: string,\n      audience: string,\n    ): Promise<Result<void>> {\n      const segment = encodePathSegment(slug)\n      if (segment === null) {\n        return invalidParamResult('deleteServiceClientDelegation', 'slug')\n      }\n      const audienceSegment = encodePathSegment(audience)\n      if (audienceSegment === null) {\n        return invalidParamResult('deleteServiceClientDelegation', 'audience')\n      }\n      return adminFetch<void>({\n        config,\n        method: 'DELETE',\n        pathname: apiPath(ADMIN_ROUTES.deleteServiceClientDelegation, {\n          slug: segment,\n          audience: audienceSegment,\n        }),\n      })\n    },\n\n    async getProductoPermisosAutorizables(\n      slug: string,\n    ): Promise<Result<ProductoPermisosAutorizablesResult>> {\n      const segment = encodePathSegment(slug)\n      if (segment === null) {\n        return invalidParamResult('getProductoPermisosAutorizables', 'slug')\n      }\n      return adminFetch<ProductoPermisosAutorizablesResult>({\n        config,\n        method: 'GET',\n        pathname: apiPath(ADMIN_ROUTES.getProductoPermisosAutorizables, {\n          slug: segment,\n        }),\n      })\n    },\n\n    async setProductoPermisosAutorizables(\n      slug: string,\n      input: SetProductoPermisosAutorizablesInput,\n    ): Promise<Result<ProductoPermisosAutorizablesResult>> {\n      const segment = encodePathSegment(slug)\n      if (segment === null) {\n        return invalidParamResult('setProductoPermisosAutorizables', 'slug')\n      }\n      return adminFetch<ProductoPermisosAutorizablesResult>({\n        config,\n        method: 'PUT',\n        pathname: apiPath(ADMIN_ROUTES.setProductoPermisosAutorizables, {\n          slug: segment,\n        }),\n        body: input,\n      })\n    },\n\n    async reassignEmpresaTitular(\n      empresaId: string,\n      input: ReassignEmpresaTitularInput,\n    ): Promise<Result<ReassignEmpresaTitularResult>> {\n      const segment = encodePathSegment(empresaId)\n      if (segment === null) {\n        return invalidParamResult('reassignEmpresaTitular', 'empresaId')\n      }\n      return adminFetch<ReassignEmpresaTitularResult>({\n        config,\n        method: 'POST',\n        pathname: apiPath(ADMIN_ROUTES.reassignEmpresaTitular, { id: segment }),\n        body: input,\n      })\n    },\n\n    async bajaEmpresa(\n      empresaId: string,\n    ): Promise<Result<AdminEmpresaEstadoResult>> {\n      const segment = encodePathSegment(empresaId)\n      if (segment === null) {\n        return invalidParamResult('bajaEmpresa', 'empresaId')\n      }\n      return adminFetch<AdminEmpresaEstadoResult>({\n        config,\n        method: 'POST',\n        pathname: apiPath(ADMIN_ROUTES.bajaEmpresa, { id: segment }),\n      })\n    },\n\n    async reactivarEmpresa(\n      empresaId: string,\n    ): Promise<Result<AdminEmpresaEstadoResult>> {\n      const segment = encodePathSegment(empresaId)\n      if (segment === null) {\n        return invalidParamResult('reactivarEmpresa', 'empresaId')\n      }\n      return adminFetch<AdminEmpresaEstadoResult>({\n        config,\n        method: 'POST',\n        pathname: apiPath(ADMIN_ROUTES.reactivarEmpresa, { id: segment }),\n      })\n    },\n\n    async setContratacion(\n      empresaId: string,\n      producto: string,\n      input: AdminSetContratacionInput,\n    ): Promise<Result<AdminContratacionResult>> {\n      const segment = encodePathSegment(empresaId)\n      if (segment === null) {\n        return invalidParamResult('setContratacion', 'empresaId')\n      }\n      const productoSegment = encodePathSegment(producto)\n      if (productoSegment === null) {\n        return invalidParamResult('setContratacion', 'producto')\n      }\n      return adminFetch<AdminContratacionResult>({\n        config,\n        method: 'PUT',\n        pathname: apiPath(ADMIN_ROUTES.setContratacion, {\n          id: segment,\n          producto: productoSegment,\n        }),\n        body: input,\n      })\n    },\n\n    async listProductos(): Promise<Result<ListProductosResult>> {\n      return adminFetch<ListProductosResult>({\n        config,\n        method: 'GET',\n        pathname: apiPath(ADMIN_ROUTES.listProductos),\n      })\n    },\n\n    async createProducto(\n      input: CreateProductoInput,\n    ): Promise<Result<ProductoResult>> {\n      return adminFetch<ProductoResult>({\n        config,\n        method: 'POST',\n        pathname: apiPath(ADMIN_ROUTES.createProducto),\n        body: input,\n      })\n    },\n\n    async updateProducto(\n      slug: string,\n      input: UpdateProductoInput,\n    ): Promise<Result<ProductoResult>> {\n      const segment = encodePathSegment(slug)\n      if (segment === null) return invalidParamResult('updateProducto', 'slug')\n      return adminFetch<ProductoResult>({\n        config,\n        method: 'PATCH',\n        pathname: apiPath(ADMIN_ROUTES.updateProducto, { slug: segment }),\n        body: input,\n      })\n    },\n\n    async restoreUser(userId: string): Promise<Result<RestoreUserResult>> {\n      const segment = encodePathSegment(userId)\n      if (segment === null) return invalidParamResult('restoreUser', 'userId')\n      return adminFetch<RestoreUserResult>({\n        config,\n        method: 'POST',\n        pathname: apiPath(ADMIN_ROUTES.restoreUser, { id: segment }),\n      })\n    },\n\n    async republishPendingWebhooks(\n      query?: RepublishPendingWebhooksQuery,\n    ): Promise<Result<RepublishPendingWebhooksResult>> {\n      const params = new URLSearchParams()\n      if (query?.older_than_minutes !== undefined) {\n        params.set('older_than_minutes', String(query.older_than_minutes))\n      }\n      if (query?.limit !== undefined) {\n        params.set('limit', String(query.limit))\n      }\n      return adminFetch<RepublishPendingWebhooksResult>({\n        config,\n        method: 'POST',\n        pathname: apiPath(ADMIN_ROUTES.republishPendingWebhooks),\n        rawQuery: params.toString(),\n      })\n    },\n\n    async maintenanceCleanup(\n      query?: MaintenanceCleanupQuery,\n    ): Promise<Result<MaintenanceCleanupResult>> {\n      const params = new URLSearchParams()\n      if (query?.limit !== undefined) {\n        params.set('limit', String(query.limit))\n      }\n      return adminFetch<MaintenanceCleanupResult>({\n        config,\n        method: 'POST',\n        pathname: apiPath(ADMIN_ROUTES.maintenanceCleanup),\n        rawQuery: params.toString(),\n      })\n    },\n  }\n}\n","/**\n * Códigos de error específicos del módulo Admin.\n *\n * Complementan a `ERROR_CODES` (core) para errores que solo ocurren\n * en operaciones de provisioning de service clients.\n *\n * @example\n * ```ts\n * import { ADMIN_ERROR_CODES } from '@eva_solutions/auth-sdk/admin'\n *\n * if (!result.ok && result.error.code === ADMIN_ERROR_CODES.service_client_already_exists) {\n *   return res.status(409).json({ error: 'El service client ya existe' })\n * }\n * ```\n */\nexport const ADMIN_ERROR_CODES = {\n  service_client_already_exists: 'service_client_already_exists',\n  service_client_not_found: 'service_client_not_found',\n  /**\n   * `rotate-secret` perdió contra otra rotación concurrente del mismo service client (409).\n   * El perdedor no recibe secret; es reintentable.\n   */\n  service_client_secret_rotation_conflict:\n    'service_client_secret_rotation_conflict',\n  /**\n   * La operación dejaría al sistema sin ningún service client admin habilitado (409): borrar,\n   * deshabilitar o quitarle `esAdmin` al último. No se aplica; habilita o crea otro admin.\n   */\n  last_admin_client: 'last_admin_client',\n} as const\n\n/** Unión de literales de los error codes específicos del módulo Admin. */\nexport type AdminErrorCode =\n  (typeof ADMIN_ERROR_CODES)[keyof typeof ADMIN_ERROR_CODES]\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkFA,MAAM,UAAU,IAAI,YAAY;;;;;AA8FhC,eAAe,WAAc,EAC3B,QACA,QACA,UACA,WAAW,IACX,QAOqB;CACrB,IAAI;EACF,MAAM,YACJ,SAAS,KAAA,IACL,QAAQ,OAAO,KAAK,UAAU,IAAI,CAAC,oBACnC,IAAI,WAAW,CAAC;EAEtB,MAAM,MAAM,WACR,GAAG,OAAO,UAAU,SAAS,GAAG,aAChC,GAAG,OAAO,UAAU;EAIxB,MAAM,SAAS,IAAI,IAAI,GAAG;EAU1B,MAAM,UAAkC;GACtC,gBAAgB;GAChB,GAAG,MAXqB,eAAe;IACvC;IACA,MAAM,OAAO;IACb,UAAU,OAAO,OAAO,MAAM,CAAC;IAC/B;IACA,UAAU,OAAO;IACjB,WAAW,OAAO;GACpB,CAAC;EAKD;EAEA,MAAM,MAAM,MAAM,MAAM,KAAK;GAC3B;GACA;GACA,MAAM,UAAU,SAAS,IAAI,KAAK,UAAU,IAAI,IAAI,KAAA;GACpD,QAAQ,YAAY,QAAQ,GAAM;EACpC,CAAC;EAED,IAAI,CAAC,IAAI,IAAI;GACX,MAAM,eAAe,MAAM,IAAI,KAAK,CAAC,CAAC,YAAY,IAAI;GACtD,OAAO;IAAE,IAAI;IAAO,OAAO,mBAAmB,IAAI,QAAQ,YAAY;GAAE;EAC1E;EAGA,IAAI,IAAI,WAAW,KACjB,OAAO;GAAE,IAAI;GAAM,MAAM,KAAA;EAAe;EAI1C,OAAO;GAAE,IAAI;GAAM,OAAM,MADL,IAAI,KAAK,EAAA,CACC;EAAK;CACrC,SAAS,KAAK;EAEZ,OAAO;GACL,IAAI;GACJ,OAAO;IACL,MAAM;IACN,QAAQ;IACR,SANY,eAAe,QAAQ,IAAI,UAAU;IAOjD,QAAQ;GACV;EACF;CACF;AACF;;;;;AAMA,SAAS,mBAAmB,QAAgB,OAA8B;CACxE,OAAO;EACL,IAAI;EACJ,OAAO;GACL,MAAM;GACN,QAAQ;GACR,SAAS,GAAG,OAAO,IAAI,MAAM;GAC7B,QAAQ;EACV;CACF;AACF;;;;;;;;;;;;;;;;;;;AAwBA,SAAgB,kBAAkB,QAAwC;CACxE,iBAAiB,OAAO,SAAS,2BAA2B;CAC5D,OAAO;EACL,MAAM,oBACJ,OAC4C;GAC5C,OAAO,WAAsC;IAC3C;IACA,QAAQ;IACR,UAAU,QAAQ,aAAa,mBAAmB;IAClD,MAAM;GACR,CAAC;EACH;EAEA,MAAM,qBAEJ;GACA,OAAO,WAAgD;IACrD;IACA,QAAQ;IACR,UAAU,QAAQ,aAAa,kBAAkB;GACnD,CAAC;EACH;EAEA,MAAM,iBACJ,MACmD;GACnD,MAAM,UAAU,kBAAkB,IAAI;GACtC,IAAI,YAAY,MACd,OAAO,mBAAmB,oBAAoB,MAAM;GACtD,OAAO,WAA6C;IAClD;IACA,QAAQ;IACR,UAAU,QAAQ,aAAa,kBAAkB,EAAE,MAAM,QAAQ,CAAC;GACpE,CAAC;EACH;EAEA,MAAM,oBACJ,MACA,OAC4C;GAC5C,MAAM,UAAU,kBAAkB,IAAI;GACtC,IAAI,YAAY,MACd,OAAO,mBAAmB,uBAAuB,MAAM;GAEzD,OAAO,WAAsC;IAC3C;IACA,QAAQ;IACR,UAAU,QAAQ,aAAa,qBAAqB,EAAE,MAAM,QAAQ,CAAC;IACrE,MAAM;GACR,CAAC;EACH;EAEA,MAAM,oBAAoB,MAAqC;GAC7D,MAAM,UAAU,kBAAkB,IAAI;GACtC,IAAI,YAAY,MACd,OAAO,mBAAmB,uBAAuB,MAAM;GAEzD,OAAO,WAAiB;IACtB;IACA,QAAQ;IACR,UAAU,QAAQ,aAAa,qBAAqB,EAAE,MAAM,QAAQ,CAAC;GACvE,CAAC;EACH;EAEA,MAAM,0BACJ,MACqC;GACrC,MAAM,UAAU,kBAAkB,IAAI;GACtC,IAAI,YAAY,MACd,OAAO,mBAAmB,6BAA6B,MAAM;GAE/D,OAAO,WAA+B;IACpC;IACA,QAAQ;IACR,UAAU,QAAQ,aAAa,2BAA2B,EACxD,MAAM,QACR,CAAC;GACH,CAAC;EACH;EAEA,MAAM,wBACJ,MACgD;GAChD,MAAM,UAAU,kBAAkB,IAAI;GACtC,IAAI,YAAY,MACd,OAAO,mBAAmB,2BAA2B,MAAM;GAE7D,OAAO,WAA0C;IAC/C;IACA,QAAQ;IACR,UAAU,QAAQ,aAAa,yBAAyB,EACtD,MAAM,QACR,CAAC;GACH,CAAC;EACH;EAEA,MAAM,sBACJ,MACA,OACgD;GAChD,MAAM,UAAU,kBAAkB,IAAI;GACtC,IAAI,YAAY,MACd,OAAO,mBAAmB,yBAAyB,MAAM;GAE3D,OAAO,WAA0C;IAC/C;IACA,QAAQ;IACR,UAAU,QAAQ,aAAa,uBAAuB,EACpD,MAAM,QACR,CAAC;IACD,MAAM;GACR,CAAC;EACH;EAEA,MAAM,yBACJ,MACA,UACuB;GACvB,MAAM,UAAU,kBAAkB,IAAI;GACtC,IAAI,YAAY,MACd,OAAO,mBAAmB,4BAA4B,MAAM;GAE9D,MAAM,kBAAkB,kBAAkB,QAAQ;GAClD,IAAI,oBAAoB,MACtB,OAAO,mBAAmB,4BAA4B,UAAU;GAElE,OAAO,WAAiB;IACtB;IACA,QAAQ;IACR,UAAU,QAAQ,aAAa,0BAA0B;KACvD,MAAM;KACN,UAAU;IACZ,CAAC;GACH,CAAC;EACH;EAEA,MAAM,6BACJ,MACqD;GACrD,MAAM,UAAU,kBAAkB,IAAI;GACtC,IAAI,YAAY,MACd,OAAO,mBAAmB,gCAAgC,MAAM;GAElE,OAAO,WAA+C;IACpD;IACA,QAAQ;IACR,UAAU,QAAQ,aAAa,8BAA8B,EAC3D,MAAM,QACR,CAAC;GACH,CAAC;EACH;EAEA,MAAM,2BACJ,MACA,OAC0D;GAC1D,MAAM,UAAU,kBAAkB,IAAI;GACtC,IAAI,YAAY,MACd,OAAO,mBAAmB,8BAA8B,MAAM;GAEhE,OAAO,WAAoD;IACzD;IACA,QAAQ;IACR,UAAU,QAAQ,aAAa,4BAA4B,EACzD,MAAM,QACR,CAAC;IACD,MAAM;GACR,CAAC;EACH;EAEA,MAAM,8BACJ,MACA,UACuB;GACvB,MAAM,UAAU,kBAAkB,IAAI;GACtC,IAAI,YAAY,MACd,OAAO,mBAAmB,iCAAiC,MAAM;GAEnE,MAAM,kBAAkB,kBAAkB,QAAQ;GAClD,IAAI,oBAAoB,MACtB,OAAO,mBAAmB,iCAAiC,UAAU;GAEvE,OAAO,WAAiB;IACtB;IACA,QAAQ;IACR,UAAU,QAAQ,aAAa,+BAA+B;KAC5D,MAAM;KACN,UAAU;IACZ,CAAC;GACH,CAAC;EACH;EAEA,MAAM,gCACJ,MACqD;GACrD,MAAM,UAAU,kBAAkB,IAAI;GACtC,IAAI,YAAY,MACd,OAAO,mBAAmB,mCAAmC,MAAM;GAErE,OAAO,WAA+C;IACpD;IACA,QAAQ;IACR,UAAU,QAAQ,aAAa,iCAAiC,EAC9D,MAAM,QACR,CAAC;GACH,CAAC;EACH;EAEA,MAAM,gCACJ,MACA,OACqD;GACrD,MAAM,UAAU,kBAAkB,IAAI;GACtC,IAAI,YAAY,MACd,OAAO,mBAAmB,mCAAmC,MAAM;GAErE,OAAO,WAA+C;IACpD;IACA,QAAQ;IACR,UAAU,QAAQ,aAAa,iCAAiC,EAC9D,MAAM,QACR,CAAC;IACD,MAAM;GACR,CAAC;EACH;EAEA,MAAM,uBACJ,WACA,OAC+C;GAC/C,MAAM,UAAU,kBAAkB,SAAS;GAC3C,IAAI,YAAY,MACd,OAAO,mBAAmB,0BAA0B,WAAW;GAEjE,OAAO,WAAyC;IAC9C;IACA,QAAQ;IACR,UAAU,QAAQ,aAAa,wBAAwB,EAAE,IAAI,QAAQ,CAAC;IACtE,MAAM;GACR,CAAC;EACH;EAEA,MAAM,YACJ,WAC2C;GAC3C,MAAM,UAAU,kBAAkB,SAAS;GAC3C,IAAI,YAAY,MACd,OAAO,mBAAmB,eAAe,WAAW;GAEtD,OAAO,WAAqC;IAC1C;IACA,QAAQ;IACR,UAAU,QAAQ,aAAa,aAAa,EAAE,IAAI,QAAQ,CAAC;GAC7D,CAAC;EACH;EAEA,MAAM,iBACJ,WAC2C;GAC3C,MAAM,UAAU,kBAAkB,SAAS;GAC3C,IAAI,YAAY,MACd,OAAO,mBAAmB,oBAAoB,WAAW;GAE3D,OAAO,WAAqC;IAC1C;IACA,QAAQ;IACR,UAAU,QAAQ,aAAa,kBAAkB,EAAE,IAAI,QAAQ,CAAC;GAClE,CAAC;EACH;EAEA,MAAM,gBACJ,WACA,UACA,OAC0C;GAC1C,MAAM,UAAU,kBAAkB,SAAS;GAC3C,IAAI,YAAY,MACd,OAAO,mBAAmB,mBAAmB,WAAW;GAE1D,MAAM,kBAAkB,kBAAkB,QAAQ;GAClD,IAAI,oBAAoB,MACtB,OAAO,mBAAmB,mBAAmB,UAAU;GAEzD,OAAO,WAAoC;IACzC;IACA,QAAQ;IACR,UAAU,QAAQ,aAAa,iBAAiB;KAC9C,IAAI;KACJ,UAAU;IACZ,CAAC;IACD,MAAM;GACR,CAAC;EACH;EAEA,MAAM,gBAAsD;GAC1D,OAAO,WAAgC;IACrC;IACA,QAAQ;IACR,UAAU,QAAQ,aAAa,aAAa;GAC9C,CAAC;EACH;EAEA,MAAM,eACJ,OACiC;GACjC,OAAO,WAA2B;IAChC;IACA,QAAQ;IACR,UAAU,QAAQ,aAAa,cAAc;IAC7C,MAAM;GACR,CAAC;EACH;EAEA,MAAM,eACJ,MACA,OACiC;GACjC,MAAM,UAAU,kBAAkB,IAAI;GACtC,IAAI,YAAY,MAAM,OAAO,mBAAmB,kBAAkB,MAAM;GACxE,OAAO,WAA2B;IAChC;IACA,QAAQ;IACR,UAAU,QAAQ,aAAa,gBAAgB,EAAE,MAAM,QAAQ,CAAC;IAChE,MAAM;GACR,CAAC;EACH;EAEA,MAAM,YAAY,QAAoD;GACpE,MAAM,UAAU,kBAAkB,MAAM;GACxC,IAAI,YAAY,MAAM,OAAO,mBAAmB,eAAe,QAAQ;GACvE,OAAO,WAA8B;IACnC;IACA,QAAQ;IACR,UAAU,QAAQ,aAAa,aAAa,EAAE,IAAI,QAAQ,CAAC;GAC7D,CAAC;EACH;EAEA,MAAM,yBACJ,OACiD;GACjD,MAAM,SAAS,IAAI,gBAAgB;GACnC,IAAI,OAAO,uBAAuB,KAAA,GAChC,OAAO,IAAI,sBAAsB,OAAO,MAAM,kBAAkB,CAAC;GAEnE,IAAI,OAAO,UAAU,KAAA,GACnB,OAAO,IAAI,SAAS,OAAO,MAAM,KAAK,CAAC;GAEzC,OAAO,WAA2C;IAChD;IACA,QAAQ;IACR,UAAU,QAAQ,aAAa,wBAAwB;IACvD,UAAU,OAAO,SAAS;GAC5B,CAAC;EACH;EAEA,MAAM,mBACJ,OAC2C;GAC3C,MAAM,SAAS,IAAI,gBAAgB;GACnC,IAAI,OAAO,UAAU,KAAA,GACnB,OAAO,IAAI,SAAS,OAAO,MAAM,KAAK,CAAC;GAEzC,OAAO,WAAqC;IAC1C;IACA,QAAQ;IACR,UAAU,QAAQ,aAAa,kBAAkB;IACjD,UAAU,OAAO,SAAS;GAC5B,CAAC;EACH;CACF;AACF;;;;;;;;;;;;;;;;;ACnoBA,MAAa,oBAAoB;CAC/B,+BAA+B;CAC/B,0BAA0B;;;;;CAK1B,yCACE;;;;;CAKF,mBAAmB;AACrB"}