@eva_solutions/auth-sdk 0.0.0-stage → 3.0.0-dev-20261107051125

package/dist/s2s-B_0SIQzn.js

@@ -0,0 +1,897 @@
+import { a as INTERNAL_AUTORIZACION_ROUTES, c as INTERNAL_TOKEN_EXCHANGE_ROUTES, i as DIRECTORIO_ROUTES, l as INTERNAL_TOKEN_ROUTES, o as INTERNAL_EMPRESA_ROUTES, p as WEBHOOK_ROUTES, s as INTERNAL_GRUPO_ROUTES, u as INTERNAL_USER_ROUTES } from "./routes-F1g5aVqP.js";
+import { _ as TOKEN_EXCHANGE_GRANT_TYPE, f as SUBJECT_TOKEN_HEADER, p as SUBJECT_TOKEN_INVALID_CODE, t as ACCESS_TOKEN_TYPE } from "./tokens-C3Z40qd7.js";
+import "./constants-rNuD5qJn.js";
+import { t as apiPath } from "./api-path-B-vSkL2H.js";
+import { t as parseErrorResponse, u as validateHttpsUrl } from "./parse-error-response-BM9-kjs0.js";
+import { t as encodePathSegment } from "./path-segment-CyqnaFrP.js";
+import { i as signS2SHeaders, s as AUTORIZACION_CACHE_TTL_MS } from "./sign-HFtcYwa-.js";
+import { f as isScopeOfAudience, l as isDelegableAudience, p as isServiceAudience, u as isDelegableScope } from "./catalog-DqPhtCKZ.js";
+// src/s2s/token-provider.ts
+/**
+* Proveedor de tokens de servicio (client credentials) para un servicio que llama a otro.
+*
+* Pide el token a `POST /api/v1/internal/token` autenticándose con la firma HMAC del service client
+* (la única ruta servicio -> servicio que la conserva), lo guarda en memoria y lo entrega a cada
+* llamada como `Authorization: Bearer`. El caché vive en la instancia: crea UN proveedor por
+* (audiencia, scope) y compártelo.
+*/
+/** Cuánto antes del vencimiento se renueva el token, en milisegundos. */
+const SERVICE_TOKEN_RENEW_MARGIN_MS = 3e4;
+const REQUEST_TIMEOUT_MS = 1e4;
+const encoder = new TextEncoder();
+/** El Auth Service rechazó el pedido de token. `code` es el `error` de RFC 6749 (`invalid_client`, …). */
+var ServiceTokenRequestError = class extends Error {
+	code;
+	status;
+	/** Segundos de espera que pidió Auth con `Retry-After` (429 / 503), si los mandó. */
+	retryAfterSeconds;
+	constructor(code, status, description, retryAfterSeconds) {
+		super(description ?? code);
+		this.name = "ServiceTokenRequestError";
+		this.code = code;
+		this.status = status;
+		if (retryAfterSeconds !== void 0) this.retryAfterSeconds = retryAfterSeconds;
+	}
+};
+async function requestToken(config, url, body) {
+	const requestedAtMs = Date.now();
+	const headers = await signS2SHeaders({
+		method: "POST",
+		path: url.pathname,
+		rawQuery: "",
+		bodyBytes: encoder.encode(body),
+		clientId: config.clientId,
+		secretHex: config.secretHex
+	});
+	const res = await fetch(url, {
+		method: "POST",
+		headers: {
+			"content-type": "application/json",
+			...headers
+		},
+		body,
+		signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+	});
+	const json = await res.json().catch(() => null);
+	if (!res.ok) {
+		const code = typeof json?.error === "string" ? json.error : res.status === 429 ? "temporarily_unavailable" : "server_error";
+		const retryAfterHeader = res.headers?.get("retry-after")?.trim();
+		const retryAfter = retryAfterHeader !== void 0 && /^\d+$/.test(retryAfterHeader) ? Number(retryAfterHeader) : void 0;
+		const description = typeof json?.error_description === "string" ? json.error_description : void 0;
+		throw new ServiceTokenRequestError(code, res.status, description, retryAfter);
+	}
+	const token = json?.access_token;
+	const expiresIn = json?.expires_in;
+	if (typeof token !== "string" || token === "" || typeof expiresIn !== "number" || !(expiresIn > 0)) throw new ServiceTokenRequestError("server_error", res.status, "Respuesta de token inválida");
+	return {
+		token,
+		renewAtMs: requestedAtMs + expiresIn * 1e3 - SERVICE_TOKEN_RENEW_MARGIN_MS
+	};
+}
+/** Entries the exchange cache keeps per provider before it drops expired ones and then the oldest. */
+const EXCHANGE_CACHE_MAX_ENTRIES = 500;
+const malformed = (message) => ({
+	ok: false,
+	error: {
+		kind: "sdk",
+		reason: "malformed",
+		message,
+		status: 0
+	}
+});
+/** SHA-256 of the subject token as hex: the cache never keys on claims nobody verified here. */
+async function fingerprint(value) {
+	const digest = await crypto.subtle.digest("SHA-256", encoder.encode(value));
+	return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, "0")).join("");
+}
+/** Validates the exchange input locally (a bad audience or scope is a sure `invalid_target` / `invalid_scope`). */
+function validateExchangeInput(input) {
+	if (typeof input.subjectToken !== "string" || input.subjectToken === "") return malformed("exchangeToken: subjectToken requerido");
+	if (!isDelegableAudience(input.audience)) return malformed(`exchangeToken: "${String(input.audience)}" no es una audiencia delegable del catálogo (auth-api nunca lo es)`);
+	for (const scope of input.scope?.split(" ").filter(Boolean) ?? []) if (!isDelegableScope(input.audience, scope)) return malformed(`exchangeToken: "${scope}" no es un permiso delegable de la audiencia "${input.audience}"`);
+	return null;
+}
+function postExchange(url, bearer, input) {
+	return fetch(url, {
+		method: "POST",
+		headers: {
+			"content-type": "application/json",
+			authorization: `Bearer ${bearer}`
+		},
+		body: JSON.stringify({
+			grant_type: TOKEN_EXCHANGE_GRANT_TYPE,
+			subject_token: input.subjectToken,
+			subject_token_type: ACCESS_TOKEN_TYPE,
+			audience: input.audience,
+			...input.scope !== void 0 && { scope: input.scope }
+		}),
+		signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+	});
+}
+/**
+* Crea un proveedor de tokens de servicio.
+*
+* Deduplica los pedidos simultáneos dentro del mismo proceso (isolate): N llamadas concurrentes a
+* `getToken()` con el caché vacío o vencido hacen UN pedido al Auth Service. Un pedido fallido no
+* se guarda: la siguiente llamada reintenta.
+*
+* Valida su configuración al crearse (audiencia del catálogo, permisos de esa audiencia, clave hex).
+*
+* @example
+* ```ts
+* const provider = createServiceTokenProvider({
+*   authUrl: env.AUTH_URL,
+*   clientId: env.AUTH_CLIENT_ID,
+*   secretHex: env.AUTH_CLIENT_SECRET_HEX,
+*   audience: 'auth-api',
+* })
+* const s2s = createS2SClient({ baseUrl: env.AUTH_URL, tokenProvider: provider })
+* ```
+*/
+function createServiceTokenProvider(config) {
+	validateHttpsUrl(config.authUrl, "ServiceTokenProviderConfig.authUrl");
+	if (!isServiceAudience(config.audience)) throw new TypeError(`[eva-auth-sdk] createServiceTokenProvider: audience "${config.audience}" no es una audiencia de servicio del catálogo`);
+	for (const scope of config.scope?.split(" ").filter(Boolean) ?? []) if (!isScopeOfAudience(config.audience, scope)) throw new TypeError(`[eva-auth-sdk] createServiceTokenProvider: "${scope}" no es un permiso de la audiencia "${config.audience}"`);
+	if (!/^(?:[0-9a-fA-F]{2})+$/.test(config.secretHex)) throw new TypeError("[eva-auth-sdk] createServiceTokenProvider: secretHex inválido (formato hex requerido)");
+	const url = new URL(`${config.authUrl.replace(/\/$/, "")}${apiPath(INTERNAL_TOKEN_ROUTES.issue)}`);
+	const body = JSON.stringify({
+		audience: config.audience,
+		...config.scope !== void 0 && { scope: config.scope }
+	});
+	let cached;
+	let inFlight;
+	const exchangeUrl = new URL(`${config.authUrl.replace(/\/$/, "")}${apiPath(INTERNAL_TOKEN_EXCHANGE_ROUTES.exchange)}`);
+	let exchangeBearer;
+	const exchangeCache = /* @__PURE__ */ new Map();
+	const rememberGrant = (key, entry) => {
+		if (exchangeCache.size >= EXCHANGE_CACHE_MAX_ENTRIES) {
+			const now = Date.now();
+			for (const [k, v] of exchangeCache) if (now >= v.renewAtMs) exchangeCache.delete(k);
+			if (exchangeCache.size >= EXCHANGE_CACHE_MAX_ENTRIES) {
+				const oldest = exchangeCache.keys().next().value;
+				if (oldest !== void 0) exchangeCache.delete(oldest);
+			}
+		}
+		exchangeCache.set(key, entry);
+	};
+	const exchangeInFlight = /* @__PURE__ */ new Map();
+	const requestExchange = async (input, key) => {
+		try {
+			exchangeBearer ??= createServiceTokenProvider({
+				authUrl: config.authUrl,
+				clientId: config.clientId,
+				secretHex: config.secretHex,
+				audience: "auth-api",
+				scope: "tokens:exchange"
+			});
+			const requestedAtMs = Date.now();
+			let bearer = await exchangeBearer.getToken();
+			let res = await postExchange(exchangeUrl, bearer, input);
+			if (res.status === 401) {
+				exchangeBearer.invalidate(bearer);
+				bearer = await exchangeBearer.getToken();
+				res = await postExchange(exchangeUrl, bearer, input);
+			}
+			const json = await res.json().catch(() => null);
+			if (!res.ok) {
+				const code = typeof json?.error === "string" ? json.error : res.status === 429 ? "temporarily_unavailable" : "server_error";
+				return {
+					ok: false,
+					error: {
+						kind: "api",
+						code,
+						message: typeof json?.error_description === "string" ? json.error_description : code,
+						status: res.status
+					}
+				};
+			}
+			const accessToken = json?.access_token;
+			const expiresIn = json?.expires_in;
+			const scope = json?.scope;
+			if (typeof accessToken !== "string" || accessToken === "" || typeof expiresIn !== "number" || !(expiresIn > 0) || typeof scope !== "string" || json?.issued_token_type !== "urn:ietf:params:oauth:token-type:access_token" || json?.token_type !== "Bearer") return {
+				ok: false,
+				error: {
+					kind: "api",
+					code: "server_error",
+					message: "Respuesta de token exchange inválida",
+					status: res.status
+				}
+			};
+			const grant = {
+				accessToken,
+				scope
+			};
+			rememberGrant(key, {
+				grant,
+				renewAtMs: requestedAtMs + expiresIn * 1e3 - SERVICE_TOKEN_RENEW_MARGIN_MS
+			});
+			return {
+				ok: true,
+				data: grant
+			};
+		} catch (err) {
+			if (err instanceof ServiceTokenRequestError) return {
+				ok: false,
+				error: {
+					kind: "api",
+					code: err.code,
+					message: err.message,
+					status: err.status
+				}
+			};
+			return {
+				ok: false,
+				error: {
+					kind: "sdk",
+					reason: "network",
+					message: err instanceof Error ? err.message : "Network error",
+					status: 0
+				}
+			};
+		}
+	};
+	const exchangeToken = async (input) => {
+		const invalid = validateExchangeInput(input);
+		if (invalid !== null) return invalid;
+		const scopeKey = (input.scope ?? "").split(" ").filter(Boolean).sort().join(" ");
+		const key = `${await fingerprint(input.subjectToken)}|${input.audience}|${scopeKey}`;
+		const hit = exchangeCache.get(key);
+		if (hit !== void 0) {
+			if (Date.now() < hit.renewAtMs) return {
+				ok: true,
+				data: hit.grant
+			};
+			exchangeCache.delete(key);
+		}
+		const pending = exchangeInFlight.get(key);
+		if (pending !== void 0) return new Promise((resolve, reject) => {
+			const timer = setTimeout(() => {
+				if (exchangeInFlight.get(key) === pending) exchangeInFlight.delete(key);
+				exchangeToken(input).then(resolve, reject);
+			}, 11e3);
+			pending.then((result) => {
+				clearTimeout(timer);
+				resolve(result);
+			}, (err) => {
+				clearTimeout(timer);
+				reject(err);
+			});
+		});
+		const started = requestExchange(input, key).finally(() => {
+			if (exchangeInFlight.get(key) === started) exchangeInFlight.delete(key);
+		});
+		exchangeInFlight.set(key, started);
+		return started;
+	};
+	const joinWithDeadline = (pending, retry) => new Promise((resolve, reject) => {
+		const timer = setTimeout(() => {
+			if (inFlight === pending) inFlight = void 0;
+			retry().then(resolve, reject);
+		}, 11e3);
+		pending.then((token) => {
+			clearTimeout(timer);
+			resolve(token);
+		}, (err) => {
+			clearTimeout(timer);
+			reject(err);
+		});
+	});
+	const provider = {
+		getToken() {
+			if (cached !== void 0 && Date.now() < cached.renewAtMs) return Promise.resolve(cached.token);
+			if (inFlight !== void 0) return joinWithDeadline(inFlight, () => provider.getToken());
+			const pending = requestToken(config, url, body).then((fresh) => {
+				cached = fresh;
+				return fresh.token;
+			}).finally(() => {
+				if (inFlight === pending) inFlight = void 0;
+			});
+			inFlight = pending;
+			return pending;
+		},
+		invalidate(rejectedToken) {
+			if (rejectedToken === void 0 || cached?.token === rejectedToken) cached = void 0;
+		},
+		exchangeToken
+	};
+	return provider;
+}
+// src/s2s/client.ts
+/**
+* Cliente S2S (service-to-service) para llamar a la API interna del Auth Service desde servicios
+* backend. Autentica cada llamada con `Authorization: Bearer <token de servicio>` (audiencia
+* `auth-api`) que entrega un `ServiceTokenProvider`; ante un 401 invalida el token y reintenta UNA vez.
+*
+* REQ-S2S-01, REQ-S2S-04, REQ-INT-01, REQ-INT-02 LOCKED.
+*
+* Endpoints disponibles:
+*   GET  /internal/users/:id
+*   POST /internal/users/batch
+*   POST /internal/webhooks/subscriptions
+*   GET  /internal/webhooks/subscriptions
+*   GET  /internal/webhooks/subscriptions/:id
+*   PATCH /internal/webhooks/subscriptions/:id
+*   DELETE /internal/webhooks/subscriptions/:id
+*   POST /internal/webhooks/subscriptions/:id/rotate-secret
+*   GET  /internal/webhooks/deliveries
+*   POST /internal/empresas
+*   GET  /internal/empresas/:id
+*   POST /internal/empresas/:id/miembros
+*   DELETE /internal/empresas/:id/miembros/:userId
+*   POST /internal/empresas/:id/sucursales
+*   (fase 2) PATCH /internal/empresas/:id, GET /internal/empresas, POST .../baja|reactivar,
+*   PATCH .../miembros/:userId, PATCH|DELETE .../sucursales/:sucursalId, contratación
+*   (.../productos), grupos (/internal/grupos), directorio (/directorio) y autorizaciones.
+*
+* Los paths salen de `INTERNAL_USER_ROUTES`, `WEBHOOK_ROUTES` e `INTERNAL_EMPRESA_ROUTES`
+* (contrato compartido) vía `apiPath`.
+*/
+/**
+* Construye el query string a partir de un objeto de parámetros.
+* Omite valores undefined.
+*/
+function buildQueryString(params) {
+	const parts = [];
+	for (const [key, value] of Object.entries(params)) if (value !== void 0) parts.push(`${encodeURIComponent(key)}=${encodeURIComponent(String(value))}`);
+	return parts.join("&");
+}
+function invalidIdResult(method) {
+	return {
+		ok: false,
+		error: {
+			kind: "sdk",
+			reason: "malformed",
+			message: `${method}: id inválido (no puede ser vacío, "." ni "..")`,
+			status: 0
+		}
+	};
+}
+/**
+* Codifica cada id como UN segmento del path (`encodePathSegment`). Devuelve los segmentos listos
+* para `apiPath` o, si alguno es vacío, `.` o `..`, el `Result` de error (sin hacer la request).
+*/
+function encodeSegments(method, values) {
+	const out = {};
+	for (const key of Object.keys(values)) {
+		const segment = encodePathSegment(values[key]);
+		if (segment === null) return invalidIdResult(method);
+		out[key] = segment;
+	}
+	return out;
+}
+/** ¿El cuerpo de error es el fallo del token de la persona (`subject_token_invalid`)? */
+const isSubjectTokenFailure = (body) => body?.error?.code === SUBJECT_TOKEN_INVALID_CODE;
+const isInvalid = (value) => "ok" in value;
+/** Entradas que guarda el caché de `checkAutorizacion` antes de soltar las vencidas y luego la más vieja. */
+const AUTORIZACION_CACHE_MAX_ENTRIES = 1e3;
+/**
+* Realiza un fetch autenticado con el token de servicio del proveedor. Un 401 invalida el token y
+* reintenta una sola vez con uno nuevo. Retorna `Result<T>` con la propiedad `data` del body.
+*/
+async function s2sFetch({ config, method, pathname, rawQuery = "", body, headers: extraHeaders }) {
+	try {
+		const bodyText = body !== void 0 ? JSON.stringify(body) : void 0;
+		const url = rawQuery ? `${config.baseUrl}${pathname}?${rawQuery}` : `${config.baseUrl}${pathname}`;
+		let usedToken = "";
+		const send = async () => {
+			const token = await config.tokenProvider.getToken();
+			usedToken = token;
+			return fetch(url, {
+				method,
+				headers: {
+					"content-type": "application/json",
+					...extraHeaders,
+					authorization: `Bearer ${token}`
+				},
+				body: bodyText,
+				signal: AbortSignal.timeout(1e4)
+			});
+		};
+		let res = await send();
+		if (res.status === 401) {
+			const body = await res.json().catch(() => null);
+			if (isSubjectTokenFailure(body)) return {
+				ok: false,
+				error: parseErrorResponse(res.status, body)
+			};
+			config.tokenProvider.invalidate(usedToken);
+			res = await send();
+		}
+		if (!res.ok) {
+			const responseBody = await res.json().catch(() => null);
+			return {
+				ok: false,
+				error: parseErrorResponse(res.status, responseBody)
+			};
+		}
+		if (res.status === 204) return {
+			ok: true,
+			data: void 0
+		};
+		return {
+			ok: true,
+			data: (await res.json()).data
+		};
+	} catch (err) {
+		if (err instanceof ServiceTokenRequestError) return {
+			ok: false,
+			error: {
+				kind: "api",
+				code: err.code,
+				message: err.message,
+				status: err.status
+			}
+		};
+		return {
+			ok: false,
+			error: {
+				kind: "sdk",
+				reason: "network",
+				message: err instanceof Error ? err.message : "Network error",
+				status: 0
+			}
+		};
+	}
+}
+/**
+* Crea un cliente S2S autenticado para comunicarse con la API interna del Auth Service.
+*
+* @example
+* ```ts
+* const tokenProvider = createServiceTokenProvider({
+*   authUrl: 'https://auth.miapp.com',
+*   clientId: 'mi-servicio',
+*   secretHex: env.AUTH_CLIENT_SECRET_HEX,
+*   audience: 'auth-api',
+* })
+* const s2s = createS2SClient({ baseUrl: 'https://auth.miapp.com', tokenProvider })
+* const result = await s2s.getUser(userId)
+* if (!result.ok) return handleError(result.error)
+* return result.data // perfil del usuario
+* ```
+*/
+function createS2SClient(config) {
+	validateHttpsUrl(config.baseUrl, "S2SClientConfig.baseUrl");
+	const autorizacionCache = /* @__PURE__ */ new Map();
+	return {
+		async getUser(userId) {
+			const segment = encodePathSegment(userId);
+			if (segment === null) return invalidIdResult("getUser");
+			return s2sFetch({
+				config,
+				method: "GET",
+				pathname: apiPath(INTERNAL_USER_ROUTES.get, { id: segment })
+			});
+		},
+		/**
+		* Consulta múltiples usuarios por ID en una sola llamada.
+		*
+		* @param input - Input con la lista de IDs a consultar.
+		* @param input.ids - Máximo `USERS_BATCH_MAX_IDS` (100, constante del contrato compartido)
+		*   IDs por llamada. El schema del request no lleva ese tope: lo aplica este cliente.
+		*   Si se superan, retorna error sin hacer fetch al API.
+		*/
+		async batchUsers(input) {
+			if (input.ids.length > 100) return {
+				ok: false,
+				error: {
+					kind: "sdk",
+					reason: "malformed",
+					message: `batchUsers acepta máximo 100 IDs por llamada (recibidos: ${input.ids.length})`,
+					status: 0
+				}
+			};
+			return s2sFetch({
+				config,
+				method: "POST",
+				pathname: apiPath(INTERNAL_USER_ROUTES.batch),
+				body: input
+			});
+		},
+		async createWebhookSubscription(input) {
+			return s2sFetch({
+				config,
+				method: "POST",
+				pathname: apiPath(WEBHOOK_ROUTES.createSubscription),
+				body: input
+			});
+		},
+		async listWebhookSubscriptions() {
+			return s2sFetch({
+				config,
+				method: "GET",
+				pathname: apiPath(WEBHOOK_ROUTES.listSubscriptions)
+			});
+		},
+		async getWebhookSubscription(id) {
+			const segment = encodePathSegment(id);
+			if (segment === null) return invalidIdResult("getWebhookSubscription");
+			return s2sFetch({
+				config,
+				method: "GET",
+				pathname: apiPath(WEBHOOK_ROUTES.getSubscription, { id: segment })
+			});
+		},
+		async updateWebhookSubscription(id, input) {
+			const segment = encodePathSegment(id);
+			if (segment === null) return invalidIdResult("updateWebhookSubscription");
+			return s2sFetch({
+				config,
+				method: "PATCH",
+				pathname: apiPath(WEBHOOK_ROUTES.updateSubscription, { id: segment }),
+				body: input
+			});
+		},
+		async deleteWebhookSubscription(id) {
+			const segment = encodePathSegment(id);
+			if (segment === null) return invalidIdResult("deleteWebhookSubscription");
+			return s2sFetch({
+				config,
+				method: "DELETE",
+				pathname: apiPath(WEBHOOK_ROUTES.deleteSubscription, { id: segment })
+			});
+		},
+		async rotateWebhookSubscriptionSecret(id) {
+			const segment = encodePathSegment(id);
+			if (segment === null) return invalidIdResult("rotateWebhookSubscriptionSecret");
+			return s2sFetch({
+				config,
+				method: "POST",
+				pathname: apiPath(WEBHOOK_ROUTES.rotateSubscriptionSecret, { id: segment })
+			});
+		},
+		async listWebhookDeliveries(query) {
+			if (query?.limit !== void 0 && (query.limit < 1 || query.limit > 100)) return {
+				ok: false,
+				error: {
+					kind: "sdk",
+					reason: "malformed",
+					message: `listWebhookDeliveries: limit debe estar entre 1 y 100 (recibido: ${query.limit})`,
+					status: 0
+				}
+			};
+			if (query?.offset !== void 0 && query.offset < 0) return {
+				ok: false,
+				error: {
+					kind: "sdk",
+					reason: "malformed",
+					message: `listWebhookDeliveries: offset no puede ser negativo (recibido: ${query.offset})`,
+					status: 0
+				}
+			};
+			const rawQuery = query ? buildQueryString(query) : "";
+			return s2sFetch({
+				config,
+				method: "GET",
+				pathname: apiPath(WEBHOOK_ROUTES.listDeliveries),
+				rawQuery
+			});
+		},
+		async createEmpresa(input) {
+			return s2sFetch({
+				config,
+				method: "POST",
+				pathname: apiPath(INTERNAL_EMPRESA_ROUTES.create),
+				body: input
+			});
+		},
+		async updateEmpresa(empresaId, input) {
+			const seg = encodeSegments("updateEmpresa", { id: empresaId });
+			if (isInvalid(seg)) return seg;
+			return s2sFetch({
+				config,
+				method: "PATCH",
+				pathname: apiPath(INTERNAL_EMPRESA_ROUTES.update, seg),
+				body: input
+			});
+		},
+		async listEmpresas(query) {
+			return s2sFetch({
+				config,
+				method: "GET",
+				pathname: apiPath(INTERNAL_EMPRESA_ROUTES.list),
+				rawQuery: query ? buildQueryString({ ...query }) : ""
+			});
+		},
+		async getEmpresa(empresaId) {
+			const seg = encodeSegments("getEmpresa", { id: empresaId });
+			if (isInvalid(seg)) return seg;
+			return s2sFetch({
+				config,
+				method: "GET",
+				pathname: apiPath(INTERNAL_EMPRESA_ROUTES.get, seg)
+			});
+		},
+		async bajaEmpresa(empresaId) {
+			const seg = encodeSegments("bajaEmpresa", { id: empresaId });
+			if (isInvalid(seg)) return seg;
+			return s2sFetch({
+				config,
+				method: "POST",
+				pathname: apiPath(INTERNAL_EMPRESA_ROUTES.baja, seg)
+			});
+		},
+		async reactivarEmpresa(empresaId) {
+			const seg = encodeSegments("reactivarEmpresa", { id: empresaId });
+			if (isInvalid(seg)) return seg;
+			return s2sFetch({
+				config,
+				method: "POST",
+				pathname: apiPath(INTERNAL_EMPRESA_ROUTES.reactivar, seg)
+			});
+		},
+		async addEmpresaMember(empresaId, input) {
+			const seg = encodeSegments("addEmpresaMember", { id: empresaId });
+			if (isInvalid(seg)) return seg;
+			return s2sFetch({
+				config,
+				method: "POST",
+				pathname: apiPath(INTERNAL_EMPRESA_ROUTES.addMember, seg),
+				body: input
+			});
+		},
+		async setEmpresaMemberRole(empresaId, userId, input) {
+			const seg = encodeSegments("setEmpresaMemberRole", {
+				id: empresaId,
+				userId
+			});
+			if (isInvalid(seg)) return seg;
+			return s2sFetch({
+				config,
+				method: "PATCH",
+				pathname: apiPath(INTERNAL_EMPRESA_ROUTES.updateMember, seg),
+				body: input
+			});
+		},
+		async removeEmpresaMember(empresaId, userId, input) {
+			const seg = encodeSegments("removeEmpresaMember", {
+				id: empresaId,
+				userId
+			});
+			if (isInvalid(seg)) return seg;
+			return s2sFetch({
+				config,
+				method: "DELETE",
+				pathname: apiPath(INTERNAL_EMPRESA_ROUTES.removeMember, seg),
+				body: input
+			});
+		},
+		async createSucursal(empresaId, input) {
+			const seg = encodeSegments("createSucursal", { id: empresaId });
+			if (isInvalid(seg)) return seg;
+			return s2sFetch({
+				config,
+				method: "POST",
+				pathname: apiPath(INTERNAL_EMPRESA_ROUTES.createBranch, seg),
+				body: input
+			});
+		},
+		async updateSucursal(empresaId, sucursalId, input) {
+			const seg = encodeSegments("updateSucursal", {
+				id: empresaId,
+				sucursalId
+			});
+			if (isInvalid(seg)) return seg;
+			return s2sFetch({
+				config,
+				method: "PATCH",
+				pathname: apiPath(INTERNAL_EMPRESA_ROUTES.updateBranch, seg),
+				body: input
+			});
+		},
+		async deactivateSucursal(empresaId, sucursalId, input) {
+			const seg = encodeSegments("deactivateSucursal", {
+				id: empresaId,
+				sucursalId
+			});
+			if (isInvalid(seg)) return seg;
+			return s2sFetch({
+				config,
+				method: "DELETE",
+				pathname: apiPath(INTERNAL_EMPRESA_ROUTES.deactivateBranch, seg),
+				body: input
+			});
+		},
+		async requestContratacion(empresaId, input) {
+			const seg = encodeSegments("requestContratacion", { id: empresaId });
+			if (isInvalid(seg)) return seg;
+			return s2sFetch({
+				config,
+				method: "POST",
+				pathname: apiPath(INTERNAL_EMPRESA_ROUTES.requestContratacion, seg),
+				body: input
+			});
+		},
+		async cancelContratacion(empresaId, input) {
+			const seg = encodeSegments("cancelContratacion", { id: empresaId });
+			if (isInvalid(seg)) return seg;
+			return s2sFetch({
+				config,
+				method: "DELETE",
+				pathname: apiPath(INTERNAL_EMPRESA_ROUTES.cancelContratacion, seg),
+				body: input
+			});
+		},
+		async getContratacion(empresaId, producto) {
+			const seg = encodeSegments("getContratacion", {
+				id: empresaId,
+				producto
+			});
+			if (isInvalid(seg)) return seg;
+			return s2sFetch({
+				config,
+				method: "GET",
+				pathname: apiPath(INTERNAL_EMPRESA_ROUTES.getContratacion, seg)
+			});
+		},
+		async setContratacion(empresaId, producto, input) {
+			const seg = encodeSegments("setContratacion", {
+				id: empresaId,
+				producto
+			});
+			if (isInvalid(seg)) return seg;
+			return s2sFetch({
+				config,
+				method: "PUT",
+				pathname: apiPath(INTERNAL_EMPRESA_ROUTES.setContratacion, seg),
+				body: input
+			});
+		},
+		async createGrupo(input) {
+			return s2sFetch({
+				config,
+				method: "POST",
+				pathname: apiPath(INTERNAL_GRUPO_ROUTES.create),
+				body: input
+			});
+		},
+		async renameGrupo(grupoId, input) {
+			const seg = encodeSegments("renameGrupo", { id: grupoId });
+			if (isInvalid(seg)) return seg;
+			return s2sFetch({
+				config,
+				method: "PATCH",
+				pathname: apiPath(INTERNAL_GRUPO_ROUTES.rename, seg),
+				body: input
+			});
+		},
+		async addGrupoEmpresa(grupoId, input) {
+			const seg = encodeSegments("addGrupoEmpresa", { id: grupoId });
+			if (isInvalid(seg)) return seg;
+			return s2sFetch({
+				config,
+				method: "POST",
+				pathname: apiPath(INTERNAL_GRUPO_ROUTES.addEmpresa, seg),
+				body: input
+			});
+		},
+		async removeGrupoEmpresa(grupoId, empresaId, input) {
+			const seg = encodeSegments("removeGrupoEmpresa", {
+				id: grupoId,
+				empresaId
+			});
+			if (isInvalid(seg)) return seg;
+			return s2sFetch({
+				config,
+				method: "DELETE",
+				pathname: apiPath(INTERNAL_GRUPO_ROUTES.removeEmpresa, seg),
+				body: input
+			});
+		},
+		async searchDirectorio(query) {
+			return s2sFetch({
+				config,
+				method: "GET",
+				pathname: apiPath(DIRECTORIO_ROUTES.search),
+				rawQuery: query ? buildQueryString({ ...query }) : ""
+			});
+		},
+		async createAutorizacion(otorganteId, input) {
+			const seg = encodeSegments("createAutorizacion", { id: otorganteId });
+			if (isInvalid(seg)) return seg;
+			return s2sFetch({
+				config,
+				method: "POST",
+				pathname: apiPath(INTERNAL_EMPRESA_ROUTES.createAutorizacion, seg),
+				body: input
+			});
+		},
+		async deleteAutorizacion(empresaId, autorizacionId, input) {
+			const seg = encodeSegments("deleteAutorizacion", {
+				id: empresaId,
+				autorizacionId
+			});
+			if (isInvalid(seg)) return seg;
+			return s2sFetch({
+				config,
+				method: "DELETE",
+				pathname: apiPath(INTERNAL_EMPRESA_ROUTES.deleteAutorizacion, seg),
+				body: input
+			});
+		},
+		async listAutorizaciones(empresaId, input) {
+			const seg = encodeSegments("listAutorizaciones", { id: empresaId });
+			if (isInvalid(seg)) return seg;
+			return s2sFetch({
+				config,
+				method: "GET",
+				pathname: apiPath(INTERNAL_EMPRESA_ROUTES.listAutorizaciones, seg),
+				rawQuery: buildQueryString({ direccion: input.direccion }),
+				headers: { [SUBJECT_TOKEN_HEADER]: input.subjectToken }
+			});
+		},
+		async checkAutorizacion(input) {
+			const key = `${input.otorgante}|${input.beneficiaria}|${input.permiso}`;
+			const hit = autorizacionCache.get(key);
+			if (hit !== void 0) {
+				if (Date.now() < hit.expiresAtMs) return {
+					ok: true,
+					data: { autorizado: hit.autorizado }
+				};
+				autorizacionCache.delete(key);
+			}
+			const result = await s2sFetch({
+				config,
+				method: "GET",
+				pathname: apiPath(INTERNAL_AUTORIZACION_ROUTES.verificar),
+				rawQuery: buildQueryString({
+					otorgante: input.otorgante,
+					beneficiaria: input.beneficiaria,
+					permiso: input.permiso
+				})
+			});
+			if (result.ok) {
+				if (autorizacionCache.size >= AUTORIZACION_CACHE_MAX_ENTRIES) {
+					const now = Date.now();
+					for (const [k, v] of autorizacionCache) if (now >= v.expiresAtMs) autorizacionCache.delete(k);
+					if (autorizacionCache.size >= AUTORIZACION_CACHE_MAX_ENTRIES) {
+						const oldest = autorizacionCache.keys().next().value;
+						if (oldest !== void 0) autorizacionCache.delete(oldest);
+					}
+				}
+				autorizacionCache.set(key, {
+					autorizado: result.data.autorizado,
+					expiresAtMs: Date.now() + AUTORIZACION_CACHE_TTL_MS
+				});
+			}
+			return result;
+		}
+	};
+}
+// src/s2s/error-codes.ts
+/**
+* Códigos de error específicos del módulo S2S.
+*
+* Complementan a `ERROR_CODES` (core) para los errores propios de los endpoints
+* `/api/v1/internal/*` que consume `createS2SClient`: usuarios y subscriptions de webhooks.
+*
+* @example
+* ```ts
+* import { S2S_ERROR_CODES } from '@eva_solutions/auth-sdk/s2s'
+*
+* const r = await s2s.rotateWebhookSubscriptionSecret(id)
+* if (!r.ok && r.error.kind === 'api' && r.error.code === S2S_ERROR_CODES.webhook_secret_rotation_conflict) {
+*   // otra rotación concurrente ganó; esta llamada no recibió clave. Reintenta.
+* }
+* ```
+*/
+const S2S_ERROR_CODES = {
+	/** `GET /internal/users/{id}`: el usuario no existe o está soft-deleted (404). */
+	user_not_found: "user_not_found",
+	/** Ya existe una subscription del mismo service client con la misma URL y los mismos eventCodes (409). */
+	webhook_subscription_duplicate: "webhook_subscription_duplicate",
+	/** La subscription no existe o pertenece a otro service client (404). */
+	webhook_subscription_not_found: "webhook_subscription_not_found",
+	/**
+	* `rotate-secret` perdió contra otra rotación concurrente de la misma subscription (409).
+	* El perdedor no recibe clave; es reintentable.
+	*/
+	webhook_secret_rotation_conflict: "webhook_secret_rotation_conflict",
+	/** URL de webhook inválida: reglas estáticas, IP privada o host sin direcciones (400). */
+	webhook_url_invalid: "webhook_url_invalid",
+	/** `eventCodes` vacío al crear o actualizar (400). */
+	webhook_event_codes_empty: "webhook_event_codes_empty"
+};
+export { createServiceTokenProvider as a, ServiceTokenRequestError as i, createS2SClient as n, SERVICE_TOKEN_RENEW_MARGIN_MS as r, S2S_ERROR_CODES as t };
+
+//# sourceMappingURL=s2s-B_0SIQzn.js.map