@eva_solutions/auth-sdk 0.0.0-stage → 3.0.0-dev-20261107051125

package/dist/sign-HFtcYwa-.js

@@ -0,0 +1,259 @@
+import { o as INTERNAL_HEADERS } from "./constants-rNuD5qJn.js";
+// src/s2s/constants.ts
+/**
+* Constantes del módulo S2S (service-to-service).
+*
+* REQ-S2S-05 LOCKED: la ventana de tiempo para el timestamp S2S es de 120 segundos.
+*/
+/**
+* Ventana máxima (en segundos) para aceptar un request S2S.
+* Si |serverTime - timestamp| > S2S_TIMESTAMP_WINDOW_SECONDS → firma rechazada.
+*/
+const S2S_TIMESTAMP_WINDOW_SECONDS = 120;
+/**
+* Formato canónico del nonce S2S (`x-eva-nonce`): 16 bytes aleatorios como 32 hex en minúsculas.
+* Sin flag `/i`: el verificador rechaza variantes no canónicas en vez de normalizarlas. Es el
+* contrato canónico y defensa en profundidad: una implementación que normalizara el valor
+* podría derivar claves de replay distintas del valor realmente firmado. (Reescribirlo en
+* mayúsculas no evade nada por sí solo: el nonce va en el canonical firmado y rompería el HMAC.)
+* Uso interno: no se exporta desde el barrel.
+*/
+const S2S_NONCE_REGEX = /^[0-9a-f]{32}$/;
+/**
+* Permisos de la audiencia `auth-api`, tal como los concede el Auth Service a un service client.
+*
+* Se mantiene como objeto del SDK (`S2S_SCOPES.USERS_READ`) pero sus valores deben ser miembros del
+* catálogo `SERVICE_AUDIENCE_SCOPES['auth-api']` del contrato: `satisfies` lo comprueba en
+* compilación. `admin` no está: la superficie `/admin` de Auth se firma, no usa tokens.
+*
+* @example
+* ```ts
+* import { S2S_SCOPES } from '@eva_solutions/auth-sdk/s2s'
+*
+* const scope = [S2S_SCOPES.USERS_READ, S2S_SCOPES.EMPRESAS_ESCRIBIR].join(' ')
+* ```
+*/
+const S2S_SCOPES = {
+	USERS_READ: "users:read",
+	WEBHOOKS_READ: "webhooks:read",
+	WEBHOOKS_WRITE: "webhooks:write",
+	EMPRESAS_LEER: "empresas:leer",
+	EMPRESAS_ESCRIBIR: "empresas:escribir",
+	TOKENS_EXCHANGE: "tokens:exchange",
+	CONTRATACIONES_PEDIR: "contrataciones:pedir",
+	CONTRATACIONES_ESCRIBIR: "contrataciones:escribir",
+	CONTRATACIONES_LEER: "contrataciones:leer",
+	EMPRESAS_BAJA: "empresas:baja",
+	AUTORIZACIONES_ESCRIBIR: "autorizaciones:escribir",
+	AUTORIZACIONES_LEER: "autorizaciones:leer",
+	DIRECTORIO_LEER: "directorio:leer"
+};
+/**
+* Header de respuesta que el Auth Service incluye en cada respuesta S2S
+* con la hora del servidor (Unix timestamp en segundos como string).
+*
+* @example
+* ```ts
+* import { S2S_RESPONSE_HEADERS } from '@eva_solutions/auth-sdk/s2s'
+*
+* const serverTime = response.headers.get(S2S_RESPONSE_HEADERS.SERVER_TIME)
+* ```
+*/
+const S2S_RESPONSE_HEADERS = { SERVER_TIME: INTERNAL_HEADERS.X_EVA_SERVER_TIME };
+/**
+* Vida en milisegundos del caché de `checkAutorizacion` en el cliente S2S (30 s). Una revocación o
+* la baja de una empresa tardan como máximo esto en notarse en un servicio que verifica; así
+* está declarado en el diseño.
+*/
+const AUTORIZACION_CACHE_TTL_MS = 3e4;
+// src/s2s/errors.ts
+/**
+* Errores internos del módulo S2S. No se exportan desde el barrel público.
+*/
+/**
+* El query string tiene percent-encoding malformado (p. ej. `%ZZ`) y no se puede
+* canonicalizar. El firmante la deja propagar con su mensaje claro; el verificador es el
+* único que la captura (la trata como `signature_invalid`) y relanza cualquier otro error.
+*/
+var S2SMalformedQueryError = class extends Error {
+	constructor() {
+		super("[eva-auth-sdk] s2s: rawQuery inválido (percent-encoding malformado)");
+		this.name = "S2SMalformedQueryError";
+	}
+};
+// src/s2s/sign.ts
+/**
+* Helpers de firma HMAC-SHA-256 SigV4-style para requests S2S.
+*
+* REQ-S2S-02, REQ-S2S-03 LOCKED.
+*
+* Algoritmo canónico (este SDK es el dueño del contrato; el servidor lo verifica con
+* `verifyS2SRequest`):
+*   canonical = [METHOD, PATH, CANONICAL_QUERY, TIMESTAMP, NONCE, CLIENT_ID, BODY_HASH].join('\n')
+*
+* Usa Web Crypto API (`crypto.subtle`) — isomorfo (browser + worker + Node 20+).
+*
+* D-12 LOCKED: hexToBytes y sha256Hex se duplican aquí (NO se extraen a shared)
+* para que el entry point ./s2s sea completamente tree-shakeable.
+*/
+const encoder = new TextEncoder();
+const HEX_REGEX = /^[0-9a-f]+$/i;
+/**
+* Decodifica hex string a Uint8Array.
+* Retorna null si la longitud es impar o contiene chars no-hex.
+*/
+function hexToBytes(hex) {
+	if (hex.length === 0 || hex.length % 2 !== 0 || !HEX_REGEX.test(hex)) return null;
+	const bytes = new Uint8Array(hex.length / 2);
+	for (let i = 0; i < hex.length; i += 2) bytes[i / 2] = parseInt(hex.slice(i, i + 2), 16);
+	return bytes;
+}
+/**
+* SHA-256 hex lowercase de un string o Uint8Array.
+* Acepta string (encodea como UTF-8) o Uint8Array (bytes raw — preferido para body).
+*/
+async function sha256Hex(data) {
+	const bytes = typeof data === "string" ? encoder.encode(data) : data;
+	const digest = await crypto.subtle.digest("SHA-256", bytes);
+	return Array.from(new Uint8Array(digest)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+/**
+* Encoding RFC 3986 estricto.
+* `encodeURIComponent` no codifica `! * ' ( )` — esta función sí.
+*/
+function uriEncodeRFC3986(input) {
+	return encodeURIComponent(input).replace(/[!*'()]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+/**
+* Canonicaliza el query string:
+*   1. Split por `&`.
+*   2. Decodificar name/value con `decodeURIComponent`.
+*   3. Ordenar por (name, value) alfabético.
+*   4. Re-encodear con `uriEncodeRFC3986`.
+*   5. Join con `=` y `&`.
+* Query vacío → `""`.
+*/
+function canonicalizeQuery(rawQuery) {
+	if (!rawQuery) return "";
+	const pairs = [];
+	for (const pair of rawQuery.split("&")) {
+		if (pair === "") continue;
+		const idx = pair.indexOf("=");
+		if (idx === -1) pairs.push({
+			name: decodeURIComponent(pair),
+			value: ""
+		});
+		else pairs.push({
+			name: decodeURIComponent(pair.slice(0, idx)),
+			value: decodeURIComponent(pair.slice(idx + 1))
+		});
+	}
+	pairs.sort((a, b) => {
+		if (a.name < b.name) return -1;
+		if (a.name > b.name) return 1;
+		if (a.value < b.value) return -1;
+		if (a.value > b.value) return 1;
+		return 0;
+	});
+	return pairs.map(({ name, value }) => `${uriEncodeRFC3986(name)}=${uriEncodeRFC3986(value)}`).join("&");
+}
+/**
+* SHA-256 hex de string vacío (precomputado).
+* Constante usada cuando el body es vacío — evita hash innecesario.
+* Exportado para uso externo (REQ-S2S-02 LOCKED).
+*/
+const EMPTY_BODY_SHA256_HEX = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
+/**
+* Genera un nonce S2S: 16 bytes de `crypto.getRandomValues` como 32 hex en minúsculas.
+* Es el valor del header `x-eva-nonce`; cada request debe llevar uno nuevo.
+*/
+function generateS2SNonce() {
+	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(16));
+	return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+/**
+* Construye el canonical string de 7 líneas (SigV4-style).
+*
+* Formato EXACTO:
+*   {METHOD}\n{PATH}\n{CANONICAL_QUERY}\n{TIMESTAMP}\n{NONCE}\n{CLIENT_ID}\n{BODY_HASH}
+*
+* @param parts - Componentes del request a firmar.
+*/
+async function buildS2SCanonicalString(parts) {
+	const METHOD = parts.method.toUpperCase();
+	const PATH = parts.path;
+	const TIMESTAMP = parts.timestamp;
+	const NONCE = parts.nonce;
+	const CLIENT_ID = parts.clientId;
+	const BODY_HASH = parts.bodyBytes.length === 0 ? EMPTY_BODY_SHA256_HEX : await sha256Hex(parts.bodyBytes);
+	let CANONICAL_QUERY;
+	try {
+		CANONICAL_QUERY = canonicalizeQuery(parts.rawQuery);
+	} catch (err) {
+		if (err instanceof URIError) throw new S2SMalformedQueryError();
+		throw err;
+	}
+	return [
+		METHOD,
+		PATH,
+		CANONICAL_QUERY,
+		TIMESTAMP,
+		NONCE,
+		CLIENT_ID,
+		BODY_HASH
+	].join("\n");
+}
+/**
+* Genera la firma HMAC-SHA-256 del canonical string.
+*
+* @returns String con formato `"sha256=${hexLowercase}"`.
+* @throws Si `secretHex` tiene formato inválido (longitud impar o chars no-hex).
+* @throws Si `parts.nonce` no es un nonce canónico (32 hex en minúsculas).
+*/
+async function signS2SRequest({ parts, secretHex }) {
+	if (!S2S_NONCE_REGEX.test(parts.nonce)) throw new Error("[eva-auth-sdk] s2s: nonce inválido (se requieren 32 hex en minúsculas)");
+	const canonical = await buildS2SCanonicalString(parts);
+	const keyBytes = hexToBytes(secretHex);
+	if (keyBytes === null) throw new Error("[eva-auth-sdk] s2s: secretHex inválido (formato hex requerido)");
+	const cryptoKey = await crypto.subtle.importKey("raw", keyBytes.buffer, {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	const sig = await crypto.subtle.sign("HMAC", cryptoKey, encoder.encode(canonical));
+	return `sha256=${Array.from(new Uint8Array(sig)).map((b) => b.toString(16).padStart(2, "0")).join("")}`;
+}
+/**
+* Genera los 4 headers de autenticación S2S para un request: client id, timestamp (segundos),
+* nonce y firma. Es el único punto que genera timestamp + nonce y firma; `createS2SClient` lo
+* usa y los firmantes manuales deben usarlo en vez de armar los headers a mano.
+*
+* El nonce es nuevo en cada llamada: no reutilices los headers devueltos en otro request.
+*
+* @param rawQuery - Query string crudo sin `?`. Default `''`.
+* @param bodyBytes - Bytes EXACTOS que se enviarán como body. Default: vacío.
+* @throws Si `secretHex` tiene formato inválido.
+*/
+async function signS2SHeaders({ method, path, rawQuery = "", bodyBytes = /* @__PURE__ */ new Uint8Array(0), clientId, secretHex }) {
+	const timestamp = String(Math.floor(Date.now() / 1e3));
+	const nonce = generateS2SNonce();
+	return {
+		"x-eva-client-id": clientId,
+		"x-eva-timestamp": timestamp,
+		"x-eva-nonce": nonce,
+		"x-eva-signature": await signS2SRequest({
+			parts: {
+				method,
+				path,
+				rawQuery,
+				timestamp,
+				nonce,
+				clientId,
+				bodyBytes
+			},
+			secretHex
+		})
+	};
+}
+export { signS2SRequest as a, S2S_NONCE_REGEX as c, S2S_TIMESTAMP_WINDOW_SECONDS as d, signS2SHeaders as i, S2S_RESPONSE_HEADERS as l, buildS2SCanonicalString as n, S2SMalformedQueryError as o, generateS2SNonce as r, AUTORIZACION_CACHE_TTL_MS as s, EMPTY_BODY_SHA256_HEX as t, S2S_SCOPES as u };
+
+//# sourceMappingURL=sign-HFtcYwa-.js.map

package/dist/sign-HFtcYwa-.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-HFtcYwa-.js","names":[],"sources":["../src/s2s/constants.ts","../src/s2s/errors.ts","../src/s2s/sign.ts"],"sourcesContent":["/**\n * Constantes del módulo S2S (service-to-service).\n *\n * REQ-S2S-05 LOCKED: la ventana de tiempo para el timestamp S2S es de 120 segundos.\n */\n\nimport { INTERNAL_HEADERS } from '@eva_solutions/auth-contracts'\nimport type { ServiceScope } from '@eva_solutions/auth-contracts'\n\n/**\n * Ventana máxima (en segundos) para aceptar un request S2S.\n * Si |serverTime - timestamp| > S2S_TIMESTAMP_WINDOW_SECONDS → firma rechazada.\n */\nexport const S2S_TIMESTAMP_WINDOW_SECONDS = 120\n\n/**\n * Formato canónico del nonce S2S (`x-eva-nonce`): 16 bytes aleatorios como 32 hex en minúsculas.\n * Sin flag `/i`: el verificador rechaza variantes no canónicas en vez de normalizarlas. Es el\n * contrato canónico y defensa en profundidad: una implementación que normalizara el valor\n * podría derivar claves de replay distintas del valor realmente firmado. (Reescribirlo en\n * mayúsculas no evade nada por sí solo: el nonce va en el canonical firmado y rompería el HMAC.)\n * Uso interno: no se exporta desde el barrel.\n */\nexport const S2S_NONCE_REGEX = /^[0-9a-f]{32}$/\n\n/**\n * Máximo de IDs permitidos por llamada a `batchUsers`.\n * Si se superan, el cliente retorna un error sin hacer fetch al API.\n *\n * Re-export del contrato compartido: el tope NO está en el schema del request (un máximo ahí\n * cambiaría el documento OpenAPI publicado), lo aplica quien lo consume leyendo esta constante.\n */\nexport { USERS_BATCH_MAX_IDS } from '@eva_solutions/auth-contracts'\n\n/**\n * Permisos de la audiencia `auth-api`, tal como los concede el Auth Service a un service client.\n *\n * Se mantiene como objeto del SDK (`S2S_SCOPES.USERS_READ`) pero sus valores deben ser miembros del\n * catálogo `SERVICE_AUDIENCE_SCOPES['auth-api']` del contrato: `satisfies` lo comprueba en\n * compilación. `admin` no está: la superficie `/admin` de Auth se firma, no usa tokens.\n *\n * @example\n * ```ts\n * import { S2S_SCOPES } from '@eva_solutions/auth-sdk/s2s'\n *\n * const scope = [S2S_SCOPES.USERS_READ, S2S_SCOPES.EMPRESAS_ESCRIBIR].join(' ')\n * ```\n */\nexport const S2S_SCOPES = {\n  USERS_READ: 'users:read',\n  WEBHOOKS_READ: 'webhooks:read',\n  WEBHOOKS_WRITE: 'webhooks:write',\n  EMPRESAS_LEER: 'empresas:leer',\n  EMPRESAS_ESCRIBIR: 'empresas:escribir',\n  TOKENS_EXCHANGE: 'tokens:exchange',\n  CONTRATACIONES_PEDIR: 'contrataciones:pedir',\n  CONTRATACIONES_ESCRIBIR: 'contrataciones:escribir',\n  CONTRATACIONES_LEER: 'contrataciones:leer',\n  EMPRESAS_BAJA: 'empresas:baja',\n  AUTORIZACIONES_ESCRIBIR: 'autorizaciones:escribir',\n  AUTORIZACIONES_LEER: 'autorizaciones:leer',\n  DIRECTORIO_LEER: 'directorio:leer',\n} as const satisfies Record<string, ServiceScope<'auth-api'>>\n\n/** Unión de literales de todos los permisos de la audiencia `auth-api`. */\nexport type S2SScope = (typeof S2S_SCOPES)[keyof typeof S2S_SCOPES]\n\n/**\n * Header de respuesta que el Auth Service incluye en cada respuesta S2S\n * con la hora del servidor (Unix timestamp en segundos como string).\n *\n * @example\n * ```ts\n * import { S2S_RESPONSE_HEADERS } from '@eva_solutions/auth-sdk/s2s'\n *\n * const serverTime = response.headers.get(S2S_RESPONSE_HEADERS.SERVER_TIME)\n * ```\n */\nexport const S2S_RESPONSE_HEADERS = {\n  SERVER_TIME: INTERNAL_HEADERS.X_EVA_SERVER_TIME,\n} as const\n\n/**\n * Vida en milisegundos del caché de `checkAutorizacion` en el cliente S2S (30 s). Una revocación o\n * la baja de una empresa tardan como máximo esto en notarse en un servicio que verifica; así\n * está declarado en el diseño.\n */\nexport const AUTORIZACION_CACHE_TTL_MS = 30_000\n","/**\n * Errores internos del módulo S2S. No se exportan desde el barrel público.\n */\n\n/**\n * El query string tiene percent-encoding malformado (p. ej. `%ZZ`) y no se puede\n * canonicalizar. El firmante la deja propagar con su mensaje claro; el verificador es el\n * único que la captura (la trata como `signature_invalid`) y relanza cualquier otro error.\n */\nexport class S2SMalformedQueryError extends Error {\n  constructor() {\n    super('[eva-auth-sdk] s2s: rawQuery inválido (percent-encoding malformado)')\n    this.name = 'S2SMalformedQueryError'\n  }\n}\n","/**\n * Helpers de firma HMAC-SHA-256 SigV4-style para requests S2S.\n *\n * REQ-S2S-02, REQ-S2S-03 LOCKED.\n *\n * Algoritmo canónico (este SDK es el dueño del contrato; el servidor lo verifica con\n * `verifyS2SRequest`):\n *   canonical = [METHOD, PATH, CANONICAL_QUERY, TIMESTAMP, NONCE, CLIENT_ID, BODY_HASH].join('\\n')\n *\n * Usa Web Crypto API (`crypto.subtle`) — isomorfo (browser + worker + Node 20+).\n *\n * D-12 LOCKED: hexToBytes y sha256Hex se duplican aquí (NO se extraen a shared)\n * para que el entry point ./s2s sea completamente tree-shakeable.\n */\n\nimport { S2S_NONCE_REGEX } from './constants'\nimport { S2SMalformedQueryError } from './errors'\nimport type { S2SCanonicalParts } from './types'\n\n// ---------------------------------------------------------------------------\n// Helpers criptográficos locales (D-12 LOCKED — no exportar, no extraer)\n// ---------------------------------------------------------------------------\n\nconst encoder = new TextEncoder()\nconst HEX_REGEX = /^[0-9a-f]+$/i\n\n/**\n * Decodifica hex string a Uint8Array.\n * Retorna null si la longitud es impar o contiene chars no-hex.\n */\nfunction hexToBytes(hex: string): Uint8Array | null {\n  if (hex.length === 0 || hex.length % 2 !== 0 || !HEX_REGEX.test(hex)) {\n    return null\n  }\n  const bytes = new Uint8Array(hex.length / 2)\n  for (let i = 0; i < hex.length; i += 2) {\n    bytes[i / 2] = parseInt(hex.slice(i, i + 2), 16)\n  }\n  return bytes\n}\n\n/**\n * SHA-256 hex lowercase de un string o Uint8Array.\n * Acepta string (encodea como UTF-8) o Uint8Array (bytes raw — preferido para body).\n */\nasync function sha256Hex(data: string | Uint8Array): Promise<string> {\n  const bytes = typeof data === 'string' ? encoder.encode(data) : data\n  const digest = await crypto.subtle.digest('SHA-256', bytes as BufferSource)\n  return Array.from(new Uint8Array(digest))\n    .map((b) => b.toString(16).padStart(2, '0'))\n    .join('')\n}\n\n/**\n * Encoding RFC 3986 estricto.\n * `encodeURIComponent` no codifica `! * ' ( )` — esta función sí.\n */\nfunction uriEncodeRFC3986(input: string): string {\n  return encodeURIComponent(input).replace(\n    /[!*'()]/g,\n    (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`,\n  )\n}\n\n/**\n * Canonicaliza el query string:\n *   1. Split por `&`.\n *   2. Decodificar name/value con `decodeURIComponent`.\n *   3. Ordenar por (name, value) alfabético.\n *   4. Re-encodear con `uriEncodeRFC3986`.\n *   5. Join con `=` y `&`.\n * Query vacío → `\"\"`.\n */\nfunction canonicalizeQuery(rawQuery: string): string {\n  if (!rawQuery) return ''\n\n  const pairs: Array<{ name: string; value: string }> = []\n  for (const pair of rawQuery.split('&')) {\n    if (pair === '') continue\n    const idx = pair.indexOf('=')\n    if (idx === -1) {\n      pairs.push({ name: decodeURIComponent(pair), value: '' })\n    } else {\n      pairs.push({\n        name: decodeURIComponent(pair.slice(0, idx)),\n        value: decodeURIComponent(pair.slice(idx + 1)),\n      })\n    }\n  }\n\n  pairs.sort((a, b) => {\n    if (a.name < b.name) return -1\n    if (a.name > b.name) return 1\n    if (a.value < b.value) return -1\n    if (a.value > b.value) return 1\n    return 0\n  })\n\n  return pairs\n    .map(\n      ({ name, value }) =>\n        `${uriEncodeRFC3986(name)}=${uriEncodeRFC3986(value)}`,\n    )\n    .join('&')\n}\n\n// ---------------------------------------------------------------------------\n// API pública\n// ---------------------------------------------------------------------------\n\n/**\n * SHA-256 hex de string vacío (precomputado).\n * Constante usada cuando el body es vacío — evita hash innecesario.\n * Exportado para uso externo (REQ-S2S-02 LOCKED).\n */\nexport const EMPTY_BODY_SHA256_HEX =\n  'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'\n\n/**\n * Genera un nonce S2S: 16 bytes de `crypto.getRandomValues` como 32 hex en minúsculas.\n * Es el valor del header `x-eva-nonce`; cada request debe llevar uno nuevo.\n */\nexport function generateS2SNonce(): string {\n  const bytes = crypto.getRandomValues(new Uint8Array(16))\n  return Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('')\n}\n\n/**\n * Construye el canonical string de 7 líneas (SigV4-style).\n *\n * Formato EXACTO:\n *   {METHOD}\\n{PATH}\\n{CANONICAL_QUERY}\\n{TIMESTAMP}\\n{NONCE}\\n{CLIENT_ID}\\n{BODY_HASH}\n *\n * @param parts - Componentes del request a firmar.\n */\nexport async function buildS2SCanonicalString(\n  parts: S2SCanonicalParts,\n): Promise<string> {\n  const METHOD = parts.method.toUpperCase()\n  const PATH = parts.path\n  const TIMESTAMP = parts.timestamp\n  const NONCE = parts.nonce\n  const CLIENT_ID = parts.clientId\n  // El body se hashea ANTES de canonicalizar el query: si el query es inválido, el\n  // verificador ya hizo el mismo trabajo que en una petición válida (tiempo comparable).\n  const BODY_HASH =\n    parts.bodyBytes.length === 0\n      ? EMPTY_BODY_SHA256_HEX\n      : await sha256Hex(parts.bodyBytes)\n  let CANONICAL_QUERY: string\n  try {\n    CANONICAL_QUERY = canonicalizeQuery(parts.rawQuery)\n  } catch (err) {\n    if (err instanceof URIError) {\n      throw new S2SMalformedQueryError()\n    }\n    throw err\n  }\n\n  return [\n    METHOD,\n    PATH,\n    CANONICAL_QUERY,\n    TIMESTAMP,\n    NONCE,\n    CLIENT_ID,\n    BODY_HASH,\n  ].join('\\n')\n}\n\n/**\n * Genera la firma HMAC-SHA-256 del canonical string.\n *\n * @returns String con formato `\"sha256=${hexLowercase}\"`.\n * @throws Si `secretHex` tiene formato inválido (longitud impar o chars no-hex).\n * @throws Si `parts.nonce` no es un nonce canónico (32 hex en minúsculas).\n */\nexport async function signS2SRequest({\n  parts,\n  secretHex,\n}: {\n  parts: S2SCanonicalParts\n  secretHex: string\n}): Promise<string> {\n  if (!S2S_NONCE_REGEX.test(parts.nonce)) {\n    throw new Error(\n      '[eva-auth-sdk] s2s: nonce inválido (se requieren 32 hex en minúsculas)',\n    )\n  }\n\n  const canonical = await buildS2SCanonicalString(parts)\n\n  const keyBytes = hexToBytes(secretHex)\n  if (keyBytes === null) {\n    throw new Error(\n      '[eva-auth-sdk] s2s: secretHex inválido (formato hex requerido)',\n    )\n  }\n\n  const cryptoKey = await crypto.subtle.importKey(\n    'raw',\n    keyBytes.buffer as BufferSource,\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign'],\n  )\n\n  const sig = await crypto.subtle.sign(\n    'HMAC',\n    cryptoKey,\n    encoder.encode(canonical) as BufferSource,\n  )\n\n  const hexSig = Array.from(new Uint8Array(sig))\n    .map((b) => b.toString(16).padStart(2, '0'))\n    .join('')\n\n  return `sha256=${hexSig}`\n}\n\n/**\n * Genera los 4 headers de autenticación S2S para un request: client id, timestamp (segundos),\n * nonce y firma. Es el único punto que genera timestamp + nonce y firma; `createS2SClient` lo\n * usa y los firmantes manuales deben usarlo en vez de armar los headers a mano.\n *\n * El nonce es nuevo en cada llamada: no reutilices los headers devueltos en otro request.\n *\n * @param rawQuery - Query string crudo sin `?`. Default `''`.\n * @param bodyBytes - Bytes EXACTOS que se enviarán como body. Default: vacío.\n * @throws Si `secretHex` tiene formato inválido.\n */\nexport async function signS2SHeaders({\n  method,\n  path,\n  rawQuery = '',\n  bodyBytes = new Uint8Array(0),\n  clientId,\n  secretHex,\n}: {\n  method: string\n  path: string\n  rawQuery?: string\n  bodyBytes?: Uint8Array\n  clientId: string\n  secretHex: string\n}): Promise<Record<string, string>> {\n  const timestamp = String(Math.floor(Date.now() / 1000))\n  const nonce = generateS2SNonce()\n  const signature = await signS2SRequest({\n    parts: { method, path, rawQuery, timestamp, nonce, clientId, bodyBytes },\n    secretHex,\n  })\n\n  return {\n    'x-eva-client-id': clientId,\n    'x-eva-timestamp': timestamp,\n    'x-eva-nonce': nonce,\n    'x-eva-signature': signature,\n  }\n}\n"],"mappings":";;;;;;;;;;;AAaA,MAAa,+BAA+B;;;;;;;;;AAU5C,MAAa,kBAAkB;;;;;;;;;;;;;;;AAyB/B,MAAa,aAAa;CACxB,YAAY;CACZ,eAAe;CACf,gBAAgB;CAChB,eAAe;CACf,mBAAmB;CACnB,iBAAiB;CACjB,sBAAsB;CACtB,yBAAyB;CACzB,qBAAqB;CACrB,eAAe;CACf,yBAAyB;CACzB,qBAAqB;CACrB,iBAAiB;AACnB;;;;;;;;;;;;AAgBA,MAAa,uBAAuB,EAClC,aAAa,iBAAiB,kBAChC;;;;;;AAOA,MAAa,4BAA4B;;;;;;;;;;AC9EzC,IAAa,yBAAb,cAA4C,MAAM;CAChD,cAAc;EACZ,MAAM,qEAAqE;EAC3E,KAAK,OAAO;CACd;AACF;;;;;;;;;;;;;;;;ACSA,MAAM,UAAU,IAAI,YAAY;AAChC,MAAM,YAAY;;;;;AAMlB,SAAS,WAAW,KAAgC;CAClD,IAAI,IAAI,WAAW,KAAK,IAAI,SAAS,MAAM,KAAK,CAAC,UAAU,KAAK,GAAG,GACjE,OAAO;CAET,MAAM,QAAQ,IAAI,WAAW,IAAI,SAAS,CAAC;CAC3C,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK,GACnC,MAAM,IAAI,KAAK,SAAS,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE;CAEjD,OAAO;AACT;;;;;AAMA,eAAe,UAAU,MAA4C;CACnE,MAAM,QAAQ,OAAO,SAAS,WAAW,QAAQ,OAAO,IAAI,IAAI;CAChE,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,KAAqB;CAC1E,OAAO,MAAM,KAAK,IAAI,WAAW,MAAM,CAAC,CAAC,CACtC,KAAK,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAC3C,KAAK,EAAE;AACZ;;;;;AAMA,SAAS,iBAAiB,OAAuB;CAC/C,OAAO,mBAAmB,KAAK,CAAC,CAAC,QAC/B,aACC,MAAM,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,YAAY,GACtD;AACF;;;;;;;;;;AAWA,SAAS,kBAAkB,UAA0B;CACnD,IAAI,CAAC,UAAU,OAAO;CAEtB,MAAM,QAAgD,CAAC;CACvD,KAAK,MAAM,QAAQ,SAAS,MAAM,GAAG,GAAG;EACtC,IAAI,SAAS,IAAI;EACjB,MAAM,MAAM,KAAK,QAAQ,GAAG;EAC5B,IAAI,QAAQ,IACV,MAAM,KAAK;GAAE,MAAM,mBAAmB,IAAI;GAAG,OAAO;EAAG,CAAC;OAExD,MAAM,KAAK;GACT,MAAM,mBAAmB,KAAK,MAAM,GAAG,GAAG,CAAC;GAC3C,OAAO,mBAAmB,KAAK,MAAM,MAAM,CAAC,CAAC;EAC/C,CAAC;CAEL;CAEA,MAAM,MAAM,GAAG,MAAM;EACnB,IAAI,EAAE,OAAO,EAAE,MAAM,OAAO;EAC5B,IAAI,EAAE,OAAO,EAAE,MAAM,OAAO;EAC5B,IAAI,EAAE,QAAQ,EAAE,OAAO,OAAO;EAC9B,IAAI,EAAE,QAAQ,EAAE,OAAO,OAAO;EAC9B,OAAO;CACT,CAAC;CAED,OAAO,MACJ,KACE,EAAE,MAAM,YACP,GAAG,iBAAiB,IAAI,EAAE,GAAG,iBAAiB,KAAK,GACvD,CAAC,CACA,KAAK,GAAG;AACb;;;;;;AAWA,MAAa,wBACX;;;;;AAMF,SAAgB,mBAA2B;CACzC,MAAM,QAAQ,OAAO,gCAAgB,IAAI,WAAW,EAAE,CAAC;CACvD,OAAO,MAAM,KAAK,QAAQ,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;AAC1E;;;;;;;;;AAUA,eAAsB,wBACpB,OACiB;CACjB,MAAM,SAAS,MAAM,OAAO,YAAY;CACxC,MAAM,OAAO,MAAM;CACnB,MAAM,YAAY,MAAM;CACxB,MAAM,QAAQ,MAAM;CACpB,MAAM,YAAY,MAAM;CAGxB,MAAM,YACJ,MAAM,UAAU,WAAW,IACvB,wBACA,MAAM,UAAU,MAAM,SAAS;CACrC,IAAI;CACJ,IAAI;EACF,kBAAkB,kBAAkB,MAAM,QAAQ;CACpD,SAAS,KAAK;EACZ,IAAI,eAAe,UACjB,MAAM,IAAI,uBAAuB;EAEnC,MAAM;CACR;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,CAAC,KAAK,IAAI;AACb;;;;;;;;AASA,eAAsB,eAAe,EACnC,OACA,aAIkB;CAClB,IAAI,CAAC,gBAAgB,KAAK,MAAM,KAAK,GACnC,MAAM,IAAI,MACR,wEACF;CAGF,MAAM,YAAY,MAAM,wBAAwB,KAAK;CAErD,MAAM,WAAW,WAAW,SAAS;CACrC,IAAI,aAAa,MACf,MAAM,IAAI,MACR,gEACF;CAGF,MAAM,YAAY,MAAM,OAAO,OAAO,UACpC,OACA,SAAS,QACT;EAAE,MAAM;EAAQ,MAAM;CAAU,GAChC,OACA,CAAC,MAAM,CACT;CAEA,MAAM,MAAM,MAAM,OAAO,OAAO,KAC9B,QACA,WACA,QAAQ,OAAO,SAAS,CAC1B;CAMA,OAAO,UAJQ,MAAM,KAAK,IAAI,WAAW,GAAG,CAAC,CAAC,CAC3C,KAAK,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAC3C,KAAK,EAEc;AACxB;;;;;;;;;;;;AAaA,eAAsB,eAAe,EACnC,QACA,MACA,WAAW,IACX,4BAAY,IAAI,WAAW,CAAC,GAC5B,UACA,aAQkC;CAClC,MAAM,YAAY,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,CAAC;CACtD,MAAM,QAAQ,iBAAiB;CAM/B,OAAO;EACL,mBAAmB;EACnB,mBAAmB;EACnB,eAAe;EACf,mBAAmB,MATG,eAAe;GACrC,OAAO;IAAE;IAAQ;IAAM;IAAU;IAAW;IAAO;IAAU;GAAU;GACvE;EACF,CAAC;CAOD;AACF"}

package/dist/tokens-C1nzkn21.cjs

@@ -0,0 +1,232 @@
+// ../auth-contracts/dist/tokens.js
+/**
+* PURE module: it must never reference `zod` or any schema module of this package (see
+* `constants.ts`). Token vocabulary shared by the Auth service and every consumer: issuer, token
+* types, key prefixes, lifetimes and the token endpoint error codes.
+*/
+/** Issuer (`iss`) of every token the Auth service signs. */
+const TOKEN_ISSUER = "auth-service";
+/**
+* Service client slugs nobody can create: the token issuer name (an `iss`-like value would let a
+* client pass for the service itself).
+*/
+const RESERVED_SERVICE_CLIENT_SLUGS = [TOKEN_ISSUER];
+/** True when `slug` is reserved and cannot be used as a service client slug. */
+function isReservedServiceClientSlug(slug) {
+	return RESERVED_SERVICE_CLIENT_SLUGS.includes(slug);
+}
+/**
+* Fixed id (`sub`) of the Auth service itself when it mints its own service tokens (the OTP send).
+* Receivers register it like any other service client id.
+*/
+const AUTH_SERVICE_SUB = "00000000-0000-4000-8000-000000000001";
+/** Header `typ` of a user access token (RFC 9068). */
+const USER_TOKEN_TYP = "at+jwt";
+/** Header `typ` of a service access token. Distinct from the user one on purpose (RFC 8725 3.11). */
+const SERVICE_TOKEN_TYP = "svc-at+jwt";
+/** The `kid` of a user signing key starts with this prefix. */
+const USER_KID_PREFIX = "usr-";
+/** The `kid` of a service signing key starts with this prefix. */
+const SERVICE_KID_PREFIX = "svc-";
+/** Lifetime in seconds of a service token obtained from the token endpoint. */
+const SERVICE_TOKEN_LIFETIME_SECONDS = 300;
+/** Lifetime in seconds of the single-use service token Auth mints in-process per OTP send. */
+const INTERNAL_SERVICE_TOKEN_LIFETIME_SECONDS = 60;
+/**
+* Error codes of the token endpoint (RFC 6749 5.2 and RFC 8707 2). Throttling a client has no
+* code of its own: it answers `429` with `temporarily_unavailable` and a `Retry-After` header (the
+* SDK token provider reads both).
+*/
+const SERVICE_TOKEN_ERROR_CODES = [
+	"invalid_request",
+	"invalid_client",
+	"invalid_target",
+	"invalid_scope",
+	"temporarily_unavailable"
+];
+/**
+* Header `typ` of a delegated access token (token exchange, RFC 8693). A third type, distinct from
+* the user and service ones: it is signed with a SERVICE key (`svc-` kid) but no service verifier
+* accepts it, and the delegated verifier accepts nothing else.
+*/
+const DELEGATED_TOKEN_TYP = "dlg-at+jwt";
+/** Lifetime in seconds of a delegated token (`exp` never exceeds the one of the subject token). */
+const DELEGATED_TOKEN_LIFETIME_SECONDS = 120;
+/**
+* Most levels the `act` (actor) chain of a delegated token can have. A delegated token that
+* already has this many levels cannot be exchanged again.
+*/
+const DELEGATED_TOKEN_MAX_DEPTH = 3;
+/** `grant_type` of the token exchange request (RFC 8693 2.1). */
+const TOKEN_EXCHANGE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange";
+/**
+* Token type identifier for `subject_token_type` (what is exchanged) and `issued_token_type` (what
+* comes back): both are JWT access tokens (RFC 8693 3).
+*/
+const ACCESS_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:access_token";
+/**
+* Header with which a service sends the access token of a person on the requests that cannot carry
+* a body (the `GET` that needs a person's role). Every other person-bound request carries it as
+* `subjectToken` in the body.
+*/
+const SUBJECT_TOKEN_HEADER = "x-eva-subject-token";
+/**
+* Error codes of the token exchange endpoint (RFC 6749 5.2, RFC 8693 2.2.2 and RFC 8707 2).
+* `invalid_grant`: the subject token or what it depends on (session, user, membership, company,
+* contract, depth, cycle) is not valid. Throttling answers `429` with `temporarily_unavailable`.
+*/
+const TOKEN_EXCHANGE_ERROR_CODES = [
+	"invalid_request",
+	"invalid_client",
+	"invalid_grant",
+	"invalid_target",
+	"invalid_scope",
+	"temporarily_unavailable"
+];
+/**
+* Failure of the PERSON's token (`subjectToken`) on a person-bound request: invalid, expired, of
+* another product, or its session/user is gone. It answers `403` with this code, never `401`: a
+* `401` on `/internal/*` means the service Bearer was rejected (the S2S client then drops its
+* service token and retries once), and a bad person token must not trigger that.
+*/
+const SUBJECT_TOKEN_INVALID_STATUS = 403;
+const SUBJECT_TOKEN_INVALID_CODE = "subject_token_invalid";
+/**
+* Keys that carry a person or service token in bodies, headers and token endpoint answers. The
+* Auth API redacts them in logs and audit records. It is ADDED to the consumer's own redaction
+* list (which already covers `refresh_token`, `authorization` and the like); it does not replace it.
+*/
+const TOKEN_BEARING_KEYS = [
+	"subjectToken",
+	"subject_token",
+	"x-eva-subject-token",
+	"access_token"
+];
+Object.defineProperty(exports, "ACCESS_TOKEN_TYPE", {
+	enumerable: true,
+	get: function() {
+		return ACCESS_TOKEN_TYPE;
+	}
+});
+Object.defineProperty(exports, "AUTH_SERVICE_SUB", {
+	enumerable: true,
+	get: function() {
+		return AUTH_SERVICE_SUB;
+	}
+});
+Object.defineProperty(exports, "DELEGATED_TOKEN_LIFETIME_SECONDS", {
+	enumerable: true,
+	get: function() {
+		return DELEGATED_TOKEN_LIFETIME_SECONDS;
+	}
+});
+Object.defineProperty(exports, "DELEGATED_TOKEN_MAX_DEPTH", {
+	enumerable: true,
+	get: function() {
+		return DELEGATED_TOKEN_MAX_DEPTH;
+	}
+});
+Object.defineProperty(exports, "DELEGATED_TOKEN_TYP", {
+	enumerable: true,
+	get: function() {
+		return DELEGATED_TOKEN_TYP;
+	}
+});
+Object.defineProperty(exports, "INTERNAL_SERVICE_TOKEN_LIFETIME_SECONDS", {
+	enumerable: true,
+	get: function() {
+		return INTERNAL_SERVICE_TOKEN_LIFETIME_SECONDS;
+	}
+});
+Object.defineProperty(exports, "RESERVED_SERVICE_CLIENT_SLUGS", {
+	enumerable: true,
+	get: function() {
+		return RESERVED_SERVICE_CLIENT_SLUGS;
+	}
+});
+Object.defineProperty(exports, "SERVICE_KID_PREFIX", {
+	enumerable: true,
+	get: function() {
+		return SERVICE_KID_PREFIX;
+	}
+});
+Object.defineProperty(exports, "SERVICE_TOKEN_ERROR_CODES", {
+	enumerable: true,
+	get: function() {
+		return SERVICE_TOKEN_ERROR_CODES;
+	}
+});
+Object.defineProperty(exports, "SERVICE_TOKEN_LIFETIME_SECONDS", {
+	enumerable: true,
+	get: function() {
+		return SERVICE_TOKEN_LIFETIME_SECONDS;
+	}
+});
+Object.defineProperty(exports, "SERVICE_TOKEN_TYP", {
+	enumerable: true,
+	get: function() {
+		return SERVICE_TOKEN_TYP;
+	}
+});
+Object.defineProperty(exports, "SUBJECT_TOKEN_HEADER", {
+	enumerable: true,
+	get: function() {
+		return SUBJECT_TOKEN_HEADER;
+	}
+});
+Object.defineProperty(exports, "SUBJECT_TOKEN_INVALID_CODE", {
+	enumerable: true,
+	get: function() {
+		return SUBJECT_TOKEN_INVALID_CODE;
+	}
+});
+Object.defineProperty(exports, "SUBJECT_TOKEN_INVALID_STATUS", {
+	enumerable: true,
+	get: function() {
+		return SUBJECT_TOKEN_INVALID_STATUS;
+	}
+});
+Object.defineProperty(exports, "TOKEN_BEARING_KEYS", {
+	enumerable: true,
+	get: function() {
+		return TOKEN_BEARING_KEYS;
+	}
+});
+Object.defineProperty(exports, "TOKEN_EXCHANGE_ERROR_CODES", {
+	enumerable: true,
+	get: function() {
+		return TOKEN_EXCHANGE_ERROR_CODES;
+	}
+});
+Object.defineProperty(exports, "TOKEN_EXCHANGE_GRANT_TYPE", {
+	enumerable: true,
+	get: function() {
+		return TOKEN_EXCHANGE_GRANT_TYPE;
+	}
+});
+Object.defineProperty(exports, "TOKEN_ISSUER", {
+	enumerable: true,
+	get: function() {
+		return TOKEN_ISSUER;
+	}
+});
+Object.defineProperty(exports, "USER_KID_PREFIX", {
+	enumerable: true,
+	get: function() {
+		return USER_KID_PREFIX;
+	}
+});
+Object.defineProperty(exports, "USER_TOKEN_TYP", {
+	enumerable: true,
+	get: function() {
+		return USER_TOKEN_TYP;
+	}
+});
+Object.defineProperty(exports, "isReservedServiceClientSlug", {
+	enumerable: true,
+	get: function() {
+		return isReservedServiceClientSlug;
+	}
+});
+
+//# sourceMappingURL=tokens-C1nzkn21.cjs.map

package/dist/tokens-C1nzkn21.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens-C1nzkn21.cjs","names":[],"sources":["../../auth-contracts/dist/tokens.js"],"sourcesContent":["// src/tokens.ts\n/**\n* PURE module: it must never reference `zod` or any schema module of this package (see\n* `constants.ts`). Token vocabulary shared by the Auth service and every consumer: issuer, token\n* types, key prefixes, lifetimes and the token endpoint error codes.\n*/\n/** Issuer (`iss`) of every token the Auth service signs. */\nconst TOKEN_ISSUER = \"auth-service\";\n/**\n* Service client slugs nobody can create: the token issuer name (an `iss`-like value would let a\n* client pass for the service itself).\n*/\nconst RESERVED_SERVICE_CLIENT_SLUGS = [TOKEN_ISSUER];\n/** True when `slug` is reserved and cannot be used as a service client slug. */\nfunction isReservedServiceClientSlug(slug) {\n\treturn RESERVED_SERVICE_CLIENT_SLUGS.includes(slug);\n}\n/**\n* Fixed id (`sub`) of the Auth service itself when it mints its own service tokens (the OTP send).\n* Receivers register it like any other service client id.\n*/\nconst AUTH_SERVICE_SUB = \"00000000-0000-4000-8000-000000000001\";\n/** Header `typ` of a user access token (RFC 9068). */\nconst USER_TOKEN_TYP = \"at+jwt\";\n/** Header `typ` of a service access token. Distinct from the user one on purpose (RFC 8725 3.11). */\nconst SERVICE_TOKEN_TYP = \"svc-at+jwt\";\n/** The `kid` of a user signing key starts with this prefix. */\nconst USER_KID_PREFIX = \"usr-\";\n/** The `kid` of a service signing key starts with this prefix. */\nconst SERVICE_KID_PREFIX = \"svc-\";\n/** Lifetime in seconds of a service token obtained from the token endpoint. */\nconst SERVICE_TOKEN_LIFETIME_SECONDS = 300;\n/** Lifetime in seconds of the single-use service token Auth mints in-process per OTP send. */\nconst INTERNAL_SERVICE_TOKEN_LIFETIME_SECONDS = 60;\n/**\n* Error codes of the token endpoint (RFC 6749 5.2 and RFC 8707 2). Throttling a client has no\n* code of its own: it answers `429` with `temporarily_unavailable` and a `Retry-After` header (the\n* SDK token provider reads both).\n*/\nconst SERVICE_TOKEN_ERROR_CODES = [\n\t\"invalid_request\",\n\t\"invalid_client\",\n\t\"invalid_target\",\n\t\"invalid_scope\",\n\t\"temporarily_unavailable\"\n];\n/**\n* Header `typ` of a delegated access token (token exchange, RFC 8693). A third type, distinct from\n* the user and service ones: it is signed with a SERVICE key (`svc-` kid) but no service verifier\n* accepts it, and the delegated verifier accepts nothing else.\n*/\nconst DELEGATED_TOKEN_TYP = \"dlg-at+jwt\";\n/** Lifetime in seconds of a delegated token (`exp` never exceeds the one of the subject token). */\nconst DELEGATED_TOKEN_LIFETIME_SECONDS = 120;\n/**\n* Most levels the `act` (actor) chain of a delegated token can have. A delegated token that\n* already has this many levels cannot be exchanged again.\n*/\nconst DELEGATED_TOKEN_MAX_DEPTH = 3;\n/** `grant_type` of the token exchange request (RFC 8693 2.1). */\nconst TOKEN_EXCHANGE_GRANT_TYPE = \"urn:ietf:params:oauth:grant-type:token-exchange\";\n/**\n* Token type identifier for `subject_token_type` (what is exchanged) and `issued_token_type` (what\n* comes back): both are JWT access tokens (RFC 8693 3).\n*/\nconst ACCESS_TOKEN_TYPE = \"urn:ietf:params:oauth:token-type:access_token\";\n/**\n* Header with which a service sends the access token of a person on the requests that cannot carry\n* a body (the `GET` that needs a person's role). Every other person-bound request carries it as\n* `subjectToken` in the body.\n*/\nconst SUBJECT_TOKEN_HEADER = \"x-eva-subject-token\";\n/**\n* Error codes of the token exchange endpoint (RFC 6749 5.2, RFC 8693 2.2.2 and RFC 8707 2).\n* `invalid_grant`: the subject token or what it depends on (session, user, membership, company,\n* contract, depth, cycle) is not valid. Throttling answers `429` with `temporarily_unavailable`.\n*/\nconst TOKEN_EXCHANGE_ERROR_CODES = [\n\t\"invalid_request\",\n\t\"invalid_client\",\n\t\"invalid_grant\",\n\t\"invalid_target\",\n\t\"invalid_scope\",\n\t\"temporarily_unavailable\"\n];\n/**\n* Failure of the PERSON's token (`subjectToken`) on a person-bound request: invalid, expired, of\n* another product, or its session/user is gone. It answers `403` with this code, never `401`: a\n* `401` on `/internal/*` means the service Bearer was rejected (the S2S client then drops its\n* service token and retries once), and a bad person token must not trigger that.\n*/\nconst SUBJECT_TOKEN_INVALID_STATUS = 403;\nconst SUBJECT_TOKEN_INVALID_CODE = \"subject_token_invalid\";\n/**\n* Keys that carry a person or service token in bodies, headers and token endpoint answers. The\n* Auth API redacts them in logs and audit records. It is ADDED to the consumer's own redaction\n* list (which already covers `refresh_token`, `authorization` and the like); it does not replace it.\n*/\nconst TOKEN_BEARING_KEYS = [\n\t\"subjectToken\",\n\t\"subject_token\",\n\t\"x-eva-subject-token\",\n\t\"access_token\"\n];\nexport { ACCESS_TOKEN_TYPE, AUTH_SERVICE_SUB, DELEGATED_TOKEN_LIFETIME_SECONDS, DELEGATED_TOKEN_MAX_DEPTH, DELEGATED_TOKEN_TYP, INTERNAL_SERVICE_TOKEN_LIFETIME_SECONDS, RESERVED_SERVICE_CLIENT_SLUGS, SERVICE_KID_PREFIX, SERVICE_TOKEN_ERROR_CODES, SERVICE_TOKEN_LIFETIME_SECONDS, SERVICE_TOKEN_TYP, SUBJECT_TOKEN_HEADER, SUBJECT_TOKEN_INVALID_CODE, SUBJECT_TOKEN_INVALID_STATUS, TOKEN_BEARING_KEYS, TOKEN_EXCHANGE_ERROR_CODES, TOKEN_EXCHANGE_GRANT_TYPE, TOKEN_ISSUER, USER_KID_PREFIX, USER_TOKEN_TYP, isReservedServiceClientSlug };\n\n//# sourceMappingURL=tokens.js.map"],"mappings":";;;;;;;AAOA,MAAM,eAAe;;;;;AAKrB,MAAM,gCAAgC,CAAC,YAAY;;AAEnD,SAAS,4BAA4B,MAAM;CAC1C,OAAO,8BAA8B,SAAS,IAAI;AACnD;;;;;AAKA,MAAM,mBAAmB;;AAEzB,MAAM,iBAAiB;;AAEvB,MAAM,oBAAoB;;AAE1B,MAAM,kBAAkB;;AAExB,MAAM,qBAAqB;;AAE3B,MAAM,iCAAiC;;AAEvC,MAAM,0CAA0C;;;;;;AAMhD,MAAM,4BAA4B;CACjC;CACA;CACA;CACA;CACA;AACD;;;;;;AAMA,MAAM,sBAAsB;;AAE5B,MAAM,mCAAmC;;;;;AAKzC,MAAM,4BAA4B;;AAElC,MAAM,4BAA4B;;;;;AAKlC,MAAM,oBAAoB;;;;;;AAM1B,MAAM,uBAAuB;;;;;;AAM7B,MAAM,6BAA6B;CAClC;CACA;CACA;CACA;CACA;CACA;AACD;;;;;;;AAOA,MAAM,+BAA+B;AACrC,MAAM,6BAA6B;;;;;;AAMnC,MAAM,qBAAqB;CAC1B;CACA;CACA;CACA;AACD"}

package/dist/tokens-C3Z40qd7.js

@@ -0,0 +1,107 @@
+// ../auth-contracts/dist/tokens.js
+/**
+* PURE module: it must never reference `zod` or any schema module of this package (see
+* `constants.ts`). Token vocabulary shared by the Auth service and every consumer: issuer, token
+* types, key prefixes, lifetimes and the token endpoint error codes.
+*/
+/** Issuer (`iss`) of every token the Auth service signs. */
+const TOKEN_ISSUER = "auth-service";
+/**
+* Service client slugs nobody can create: the token issuer name (an `iss`-like value would let a
+* client pass for the service itself).
+*/
+const RESERVED_SERVICE_CLIENT_SLUGS = [TOKEN_ISSUER];
+/** True when `slug` is reserved and cannot be used as a service client slug. */
+function isReservedServiceClientSlug(slug) {
+	return RESERVED_SERVICE_CLIENT_SLUGS.includes(slug);
+}
+/**
+* Fixed id (`sub`) of the Auth service itself when it mints its own service tokens (the OTP send).
+* Receivers register it like any other service client id.
+*/
+const AUTH_SERVICE_SUB = "00000000-0000-4000-8000-000000000001";
+/** Header `typ` of a user access token (RFC 9068). */
+const USER_TOKEN_TYP = "at+jwt";
+/** Header `typ` of a service access token. Distinct from the user one on purpose (RFC 8725 3.11). */
+const SERVICE_TOKEN_TYP = "svc-at+jwt";
+/** The `kid` of a user signing key starts with this prefix. */
+const USER_KID_PREFIX = "usr-";
+/** The `kid` of a service signing key starts with this prefix. */
+const SERVICE_KID_PREFIX = "svc-";
+/** Lifetime in seconds of a service token obtained from the token endpoint. */
+const SERVICE_TOKEN_LIFETIME_SECONDS = 300;
+/** Lifetime in seconds of the single-use service token Auth mints in-process per OTP send. */
+const INTERNAL_SERVICE_TOKEN_LIFETIME_SECONDS = 60;
+/**
+* Error codes of the token endpoint (RFC 6749 5.2 and RFC 8707 2). Throttling a client has no
+* code of its own: it answers `429` with `temporarily_unavailable` and a `Retry-After` header (the
+* SDK token provider reads both).
+*/
+const SERVICE_TOKEN_ERROR_CODES = [
+	"invalid_request",
+	"invalid_client",
+	"invalid_target",
+	"invalid_scope",
+	"temporarily_unavailable"
+];
+/**
+* Header `typ` of a delegated access token (token exchange, RFC 8693). A third type, distinct from
+* the user and service ones: it is signed with a SERVICE key (`svc-` kid) but no service verifier
+* accepts it, and the delegated verifier accepts nothing else.
+*/
+const DELEGATED_TOKEN_TYP = "dlg-at+jwt";
+/** Lifetime in seconds of a delegated token (`exp` never exceeds the one of the subject token). */
+const DELEGATED_TOKEN_LIFETIME_SECONDS = 120;
+/**
+* Most levels the `act` (actor) chain of a delegated token can have. A delegated token that
+* already has this many levels cannot be exchanged again.
+*/
+const DELEGATED_TOKEN_MAX_DEPTH = 3;
+/** `grant_type` of the token exchange request (RFC 8693 2.1). */
+const TOKEN_EXCHANGE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange";
+/**
+* Token type identifier for `subject_token_type` (what is exchanged) and `issued_token_type` (what
+* comes back): both are JWT access tokens (RFC 8693 3).
+*/
+const ACCESS_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:access_token";
+/**
+* Header with which a service sends the access token of a person on the requests that cannot carry
+* a body (the `GET` that needs a person's role). Every other person-bound request carries it as
+* `subjectToken` in the body.
+*/
+const SUBJECT_TOKEN_HEADER = "x-eva-subject-token";
+/**
+* Error codes of the token exchange endpoint (RFC 6749 5.2, RFC 8693 2.2.2 and RFC 8707 2).
+* `invalid_grant`: the subject token or what it depends on (session, user, membership, company,
+* contract, depth, cycle) is not valid. Throttling answers `429` with `temporarily_unavailable`.
+*/
+const TOKEN_EXCHANGE_ERROR_CODES = [
+	"invalid_request",
+	"invalid_client",
+	"invalid_grant",
+	"invalid_target",
+	"invalid_scope",
+	"temporarily_unavailable"
+];
+/**
+* Failure of the PERSON's token (`subjectToken`) on a person-bound request: invalid, expired, of
+* another product, or its session/user is gone. It answers `403` with this code, never `401`: a
+* `401` on `/internal/*` means the service Bearer was rejected (the S2S client then drops its
+* service token and retries once), and a bad person token must not trigger that.
+*/
+const SUBJECT_TOKEN_INVALID_STATUS = 403;
+const SUBJECT_TOKEN_INVALID_CODE = "subject_token_invalid";
+/**
+* Keys that carry a person or service token in bodies, headers and token endpoint answers. The
+* Auth API redacts them in logs and audit records. It is ADDED to the consumer's own redaction
+* list (which already covers `refresh_token`, `authorization` and the like); it does not replace it.
+*/
+const TOKEN_BEARING_KEYS = [
+	"subjectToken",
+	"subject_token",
+	"x-eva-subject-token",
+	"access_token"
+];
+export { TOKEN_EXCHANGE_GRANT_TYPE as _, DELEGATED_TOKEN_TYP as a, USER_TOKEN_TYP as b, SERVICE_KID_PREFIX as c, SERVICE_TOKEN_TYP as d, SUBJECT_TOKEN_HEADER as f, TOKEN_EXCHANGE_ERROR_CODES as g, TOKEN_BEARING_KEYS as h, DELEGATED_TOKEN_MAX_DEPTH as i, SERVICE_TOKEN_ERROR_CODES as l, SUBJECT_TOKEN_INVALID_STATUS as m, AUTH_SERVICE_SUB as n, INTERNAL_SERVICE_TOKEN_LIFETIME_SECONDS as o, SUBJECT_TOKEN_INVALID_CODE as p, DELEGATED_TOKEN_LIFETIME_SECONDS as r, RESERVED_SERVICE_CLIENT_SLUGS as s, ACCESS_TOKEN_TYPE as t, SERVICE_TOKEN_LIFETIME_SECONDS as u, TOKEN_ISSUER as v, isReservedServiceClientSlug as x, USER_KID_PREFIX as y };
+
+//# sourceMappingURL=tokens-C3Z40qd7.js.map

package/dist/tokens-C3Z40qd7.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens-C3Z40qd7.js","names":[],"sources":["../../auth-contracts/dist/tokens.js"],"sourcesContent":["// src/tokens.ts\n/**\n* PURE module: it must never reference `zod` or any schema module of this package (see\n* `constants.ts`). Token vocabulary shared by the Auth service and every consumer: issuer, token\n* types, key prefixes, lifetimes and the token endpoint error codes.\n*/\n/** Issuer (`iss`) of every token the Auth service signs. */\nconst TOKEN_ISSUER = \"auth-service\";\n/**\n* Service client slugs nobody can create: the token issuer name (an `iss`-like value would let a\n* client pass for the service itself).\n*/\nconst RESERVED_SERVICE_CLIENT_SLUGS = [TOKEN_ISSUER];\n/** True when `slug` is reserved and cannot be used as a service client slug. */\nfunction isReservedServiceClientSlug(slug) {\n\treturn RESERVED_SERVICE_CLIENT_SLUGS.includes(slug);\n}\n/**\n* Fixed id (`sub`) of the Auth service itself when it mints its own service tokens (the OTP send).\n* Receivers register it like any other service client id.\n*/\nconst AUTH_SERVICE_SUB = \"00000000-0000-4000-8000-000000000001\";\n/** Header `typ` of a user access token (RFC 9068). */\nconst USER_TOKEN_TYP = \"at+jwt\";\n/** Header `typ` of a service access token. Distinct from the user one on purpose (RFC 8725 3.11). */\nconst SERVICE_TOKEN_TYP = \"svc-at+jwt\";\n/** The `kid` of a user signing key starts with this prefix. */\nconst USER_KID_PREFIX = \"usr-\";\n/** The `kid` of a service signing key starts with this prefix. */\nconst SERVICE_KID_PREFIX = \"svc-\";\n/** Lifetime in seconds of a service token obtained from the token endpoint. */\nconst SERVICE_TOKEN_LIFETIME_SECONDS = 300;\n/** Lifetime in seconds of the single-use service token Auth mints in-process per OTP send. */\nconst INTERNAL_SERVICE_TOKEN_LIFETIME_SECONDS = 60;\n/**\n* Error codes of the token endpoint (RFC 6749 5.2 and RFC 8707 2). Throttling a client has no\n* code of its own: it answers `429` with `temporarily_unavailable` and a `Retry-After` header (the\n* SDK token provider reads both).\n*/\nconst SERVICE_TOKEN_ERROR_CODES = [\n\t\"invalid_request\",\n\t\"invalid_client\",\n\t\"invalid_target\",\n\t\"invalid_scope\",\n\t\"temporarily_unavailable\"\n];\n/**\n* Header `typ` of a delegated access token (token exchange, RFC 8693). A third type, distinct from\n* the user and service ones: it is signed with a SERVICE key (`svc-` kid) but no service verifier\n* accepts it, and the delegated verifier accepts nothing else.\n*/\nconst DELEGATED_TOKEN_TYP = \"dlg-at+jwt\";\n/** Lifetime in seconds of a delegated token (`exp` never exceeds the one of the subject token). */\nconst DELEGATED_TOKEN_LIFETIME_SECONDS = 120;\n/**\n* Most levels the `act` (actor) chain of a delegated token can have. A delegated token that\n* already has this many levels cannot be exchanged again.\n*/\nconst DELEGATED_TOKEN_MAX_DEPTH = 3;\n/** `grant_type` of the token exchange request (RFC 8693 2.1). */\nconst TOKEN_EXCHANGE_GRANT_TYPE = \"urn:ietf:params:oauth:grant-type:token-exchange\";\n/**\n* Token type identifier for `subject_token_type` (what is exchanged) and `issued_token_type` (what\n* comes back): both are JWT access tokens (RFC 8693 3).\n*/\nconst ACCESS_TOKEN_TYPE = \"urn:ietf:params:oauth:token-type:access_token\";\n/**\n* Header with which a service sends the access token of a person on the requests that cannot carry\n* a body (the `GET` that needs a person's role). Every other person-bound request carries it as\n* `subjectToken` in the body.\n*/\nconst SUBJECT_TOKEN_HEADER = \"x-eva-subject-token\";\n/**\n* Error codes of the token exchange endpoint (RFC 6749 5.2, RFC 8693 2.2.2 and RFC 8707 2).\n* `invalid_grant`: the subject token or what it depends on (session, user, membership, company,\n* contract, depth, cycle) is not valid. Throttling answers `429` with `temporarily_unavailable`.\n*/\nconst TOKEN_EXCHANGE_ERROR_CODES = [\n\t\"invalid_request\",\n\t\"invalid_client\",\n\t\"invalid_grant\",\n\t\"invalid_target\",\n\t\"invalid_scope\",\n\t\"temporarily_unavailable\"\n];\n/**\n* Failure of the PERSON's token (`subjectToken`) on a person-bound request: invalid, expired, of\n* another product, or its session/user is gone. It answers `403` with this code, never `401`: a\n* `401` on `/internal/*` means the service Bearer was rejected (the S2S client then drops its\n* service token and retries once), and a bad person token must not trigger that.\n*/\nconst SUBJECT_TOKEN_INVALID_STATUS = 403;\nconst SUBJECT_TOKEN_INVALID_CODE = \"subject_token_invalid\";\n/**\n* Keys that carry a person or service token in bodies, headers and token endpoint answers. The\n* Auth API redacts them in logs and audit records. It is ADDED to the consumer's own redaction\n* list (which already covers `refresh_token`, `authorization` and the like); it does not replace it.\n*/\nconst TOKEN_BEARING_KEYS = [\n\t\"subjectToken\",\n\t\"subject_token\",\n\t\"x-eva-subject-token\",\n\t\"access_token\"\n];\nexport { ACCESS_TOKEN_TYPE, AUTH_SERVICE_SUB, DELEGATED_TOKEN_LIFETIME_SECONDS, DELEGATED_TOKEN_MAX_DEPTH, DELEGATED_TOKEN_TYP, INTERNAL_SERVICE_TOKEN_LIFETIME_SECONDS, RESERVED_SERVICE_CLIENT_SLUGS, SERVICE_KID_PREFIX, SERVICE_TOKEN_ERROR_CODES, SERVICE_TOKEN_LIFETIME_SECONDS, SERVICE_TOKEN_TYP, SUBJECT_TOKEN_HEADER, SUBJECT_TOKEN_INVALID_CODE, SUBJECT_TOKEN_INVALID_STATUS, TOKEN_BEARING_KEYS, TOKEN_EXCHANGE_ERROR_CODES, TOKEN_EXCHANGE_GRANT_TYPE, TOKEN_ISSUER, USER_KID_PREFIX, USER_TOKEN_TYP, isReservedServiceClientSlug };\n\n//# sourceMappingURL=tokens.js.map"],"mappings":";;;;;;;AAOA,MAAM,eAAe;;;;;AAKrB,MAAM,gCAAgC,CAAC,YAAY;;AAEnD,SAAS,4BAA4B,MAAM;CAC1C,OAAO,8BAA8B,SAAS,IAAI;AACnD;;;;;AAKA,MAAM,mBAAmB;;AAEzB,MAAM,iBAAiB;;AAEvB,MAAM,oBAAoB;;AAE1B,MAAM,kBAAkB;;AAExB,MAAM,qBAAqB;;AAE3B,MAAM,iCAAiC;;AAEvC,MAAM,0CAA0C;;;;;;AAMhD,MAAM,4BAA4B;CACjC;CACA;CACA;CACA;CACA;AACD;;;;;;AAMA,MAAM,sBAAsB;;AAE5B,MAAM,mCAAmC;;;;;AAKzC,MAAM,4BAA4B;;AAElC,MAAM,4BAA4B;;;;;AAKlC,MAAM,oBAAoB;;;;;;AAM1B,MAAM,uBAAuB;;;;;;AAM7B,MAAM,6BAA6B;CAClC;CACA;CACA;CACA;CACA;CACA;AACD;;;;;;;AAOA,MAAM,+BAA+B;AACrC,MAAM,6BAA6B;;;;;;AAMnC,MAAM,qBAAqB;CAC1B;CACA;CACA;CACA;AACD"}