@eva_solutions/auth-sdk 0.0.0-stage → 3.0.0-dev-20261107051125

package/dist/catalog-CHPqldcj.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog-CHPqldcj.cjs","names":[],"sources":["../../auth-contracts/dist/catalog.js"],"sourcesContent":["// src/catalog.ts\n/**\n* PURE module: it must never reference `zod` or any schema module of this package (see\n* `constants.ts`). The closed catalog of service audiences and, for each, its permissions.\n*\n* Apart from `tokens.ts` and `constants.ts` on purpose: the SDK `react` entry is size-budgeted and\n* reaches `constants.ts` (header names), so nothing the browser does not need goes there. The SDK\n* `react` closure imports neither this catalog nor the token vocabulary; Auth uses\n* `isServiceAudience` to keep product slugs and service audiences apart.\n*/\n/**\n* Closed catalog of service audiences and, for each one, the permissions a service client can be\n* granted on it. The service token `aud` is one of these keys and its `scope` a subset of the\n* values. Add a permission here only together with the route that requires it.\n*\n* `admin` is NOT a permission of `auth-api`: the Auth admin surface authenticates with the signed\n* request of a service client flagged `esAdmin`, never with a token. It IS a permission of\n* `whatsapp-api`.\n*/\nconst SERVICE_AUDIENCE_SCOPES = {\n\t\"auth-api\": [\n\t\t\"users:read\",\n\t\t\"webhooks:read\",\n\t\t\"webhooks:write\",\n\t\t\"empresas:leer\",\n\t\t\"empresas:escribir\",\n\t\t\"tokens:exchange\",\n\t\t\"contrataciones:pedir\",\n\t\t\"contrataciones:escribir\",\n\t\t\"contrataciones:leer\",\n\t\t\"empresas:baja\",\n\t\t\"autorizaciones:escribir\",\n\t\t\"autorizaciones:leer\",\n\t\t\"directorio:leer\"\n\t],\n\t\"whatsapp-api\": [\n\t\t\"messages:send:text\",\n\t\t\"messages:send:media\",\n\t\t\"admin\"\n\t]\n};\n/** Service audiences as a tuple, so schemas can build an enum straight from it. */\nconst SERVICE_AUDIENCES = [\"auth-api\", \"whatsapp-api\"];\n/** True when `value` is an audience of the catalog. */\nfunction isServiceAudience(value) {\n\treturn Object.hasOwn(SERVICE_AUDIENCE_SCOPES, value);\n}\n/** True when `scope` is a permission of `audience` in the catalog (an unknown audience is false). */\nfunction isScopeOfAudience(audience, scope) {\n\treturn isServiceAudience(audience) && SERVICE_AUDIENCE_SCOPES[audience].includes(scope);\n}\n/**\n* Permissions a service client can DELEGATE on behalf of a user (token exchange), by destination\n* audience. A delegation edge (`service_client_delegations`) can only carry these.\n*\n* Narrower than {@link SERVICE_AUDIENCE_SCOPES} on purpose: `auth-api` is never a destination (Auth\n* is the issuer, so no delegated token talks to it) and `admin` is never delegable. A test pins both\n* and that every value is in the audience catalog.\n*/\nconst DELEGABLE_AUDIENCE_SCOPES = { \"whatsapp-api\": [\"messages:send:text\", \"messages:send:media\"] };\n/** Delegable audiences as a tuple, so schemas can build an enum straight from it. */\nconst DELEGABLE_AUDIENCES = [\"whatsapp-api\"];\n/** Every delegable permission of every audience, flat (a scope string names its audience's service). */\nconst DELEGABLE_SCOPES = Object.values(DELEGABLE_AUDIENCE_SCOPES).flat();\n/** True when `audience` can be the destination of a delegated token. */\nfunction isDelegableAudience(value) {\n\treturn Object.hasOwn(DELEGABLE_AUDIENCE_SCOPES, value);\n}\n/** True when `scope` can be delegated towards `audience` (an unknown or non-delegable audience is false). */\nfunction isDelegableScope(audience, scope) {\n\treturn isDelegableAudience(audience) && DELEGABLE_AUDIENCE_SCOPES[audience].includes(scope);\n}\n/**\n* Closed catalog of permissions BETWEEN companies (\"company B may do X on the data of company A\"),\n* by the service audience that owns the data. Kept apart from {@link SERVICE_AUDIENCE_SCOPES} on\n* purpose: those say what a service CLIENT can do, these say what a COMPANY authorizes another\n* company to do. They are only for private data; public or shared data needs none.\n*\n* Starts minimal and each owning service adds its own (together with the route that checks it).\n* `auth-api` owns none: it only stores and answers the grants.\n*/\nconst INTER_EMPRESA_PERMISSIONS = { \"whatsapp-api\": [\"whatsapp:mensajes:leer\"] };\n/** Every inter-company permission, flat, so schemas can build an enum straight from it. */\nconst INTER_EMPRESA_PERMISSION_LIST = Object.values(INTER_EMPRESA_PERMISSIONS).flat();\n/** True when `value` is a permission of the inter-company catalog. */\nfunction isInterEmpresaPermission(value) {\n\treturn INTER_EMPRESA_PERMISSION_LIST.includes(value);\n}\n/** The audience that owns `permission` (the only one that may verify it), or `undefined`. */\nfunction interEmpresaPermissionOwner(permission) {\n\treturn Object.keys(INTER_EMPRESA_PERMISSIONS).find((owner) => INTER_EMPRESA_PERMISSIONS[owner].includes(permission));\n}\nexport { DELEGABLE_AUDIENCES, DELEGABLE_AUDIENCE_SCOPES, DELEGABLE_SCOPES, INTER_EMPRESA_PERMISSIONS, INTER_EMPRESA_PERMISSION_LIST, SERVICE_AUDIENCES, SERVICE_AUDIENCE_SCOPES, interEmpresaPermissionOwner, isDelegableAudience, isDelegableScope, isInterEmpresaPermission, isScopeOfAudience, isServiceAudience };\n\n//# sourceMappingURL=catalog.js.map"],"mappings":";;;;;;;;;;;;;;;;;;;AAmBA,MAAM,0BAA0B;CAC/B,YAAY;EACX;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACD;CACA,gBAAgB;EACf;EACA;EACA;CACD;AACD;;AAEA,MAAM,oBAAoB,CAAC,YAAY,cAAc;;AAErD,SAAS,kBAAkB,OAAO;CACjC,OAAO,OAAO,OAAO,yBAAyB,KAAK;AACpD;;AAEA,SAAS,kBAAkB,UAAU,OAAO;CAC3C,OAAO,kBAAkB,QAAQ,KAAK,wBAAwB,SAAS,CAAC,SAAS,KAAK;AACvF;;;;;;;;;AASA,MAAM,4BAA4B,EAAE,gBAAgB,CAAC,sBAAsB,qBAAqB,EAAE;;AAElG,MAAM,sBAAsB,CAAC,cAAc;;AAE3C,MAAM,mBAAmB,OAAO,OAAO,yBAAyB,CAAC,CAAC,KAAK;;AAEvE,SAAS,oBAAoB,OAAO;CACnC,OAAO,OAAO,OAAO,2BAA2B,KAAK;AACtD;;AAEA,SAAS,iBAAiB,UAAU,OAAO;CAC1C,OAAO,oBAAoB,QAAQ,KAAK,0BAA0B,SAAS,CAAC,SAAS,KAAK;AAC3F;;;;;;;;;;AAUA,MAAM,4BAA4B,EAAE,gBAAgB,CAAC,wBAAwB,EAAE;;AAE/E,MAAM,gCAAgC,OAAO,OAAO,yBAAyB,CAAC,CAAC,KAAK;;AAEpF,SAAS,yBAAyB,OAAO;CACxC,OAAO,8BAA8B,SAAS,KAAK;AACpD;;AAEA,SAAS,4BAA4B,YAAY;CAChD,OAAO,OAAO,KAAK,yBAAyB,CAAC,CAAC,MAAM,UAAU,0BAA0B,MAAM,CAAC,SAAS,UAAU,CAAC;AACpH"}

package/dist/catalog-CIqpzgsM.d.cts

@@ -0,0 +1,75 @@
+/**
+ * PURE module: it must never reference `zod` or any schema module of this package (see
+ * `constants.ts`). The closed catalog of service audiences and, for each, its permissions.
+ *
+ * Apart from `tokens.ts` and `constants.ts` on purpose: the SDK `react` entry is size-budgeted and
+ * reaches `constants.ts` (header names), so nothing the browser does not need goes there. The SDK
+ * `react` closure imports neither this catalog nor the token vocabulary; Auth uses
+ * `isServiceAudience` to keep product slugs and service audiences apart.
+ */
+/**
+ * Closed catalog of service audiences and, for each one, the permissions a service client can be
+ * granted on it. The service token `aud` is one of these keys and its `scope` a subset of the
+ * values. Add a permission here only together with the route that requires it.
+ *
+ * `admin` is NOT a permission of `auth-api`: the Auth admin surface authenticates with the signed
+ * request of a service client flagged `esAdmin`, never with a token. It IS a permission of
+ * `whatsapp-api`.
+ */
+declare const SERVICE_AUDIENCE_SCOPES: {
+  readonly 'auth-api': readonly ["users:read", "webhooks:read", "webhooks:write", "empresas:leer", "empresas:escribir", "tokens:exchange", "contrataciones:pedir", "contrataciones:escribir", "contrataciones:leer", "empresas:baja", "autorizaciones:escribir", "autorizaciones:leer", "directorio:leer"];
+  readonly 'whatsapp-api': readonly ["messages:send:text", "messages:send:media", "admin"];
+};
+type ServiceAudience = keyof typeof SERVICE_AUDIENCE_SCOPES;
+/** Service audiences as a tuple, so schemas can build an enum straight from it. */
+declare const SERVICE_AUDIENCES: readonly ["auth-api", "whatsapp-api"];
+type ServiceScope<A extends ServiceAudience = ServiceAudience> = (typeof SERVICE_AUDIENCE_SCOPES)[A][number];
+/** True when `value` is an audience of the catalog. */
+declare function isServiceAudience(value: string): value is ServiceAudience;
+/** True when `scope` is a permission of `audience` in the catalog (an unknown audience is false). */
+declare function isScopeOfAudience(audience: string, scope: string): boolean;
+/**
+ * Permissions a service client can DELEGATE on behalf of a user (token exchange), by destination
+ * audience. A delegation edge (`service_client_delegations`) can only carry these.
+ *
+ * Narrower than {@link SERVICE_AUDIENCE_SCOPES} on purpose: `auth-api` is never a destination (Auth
+ * is the issuer, so no delegated token talks to it) and `admin` is never delegable. A test pins both
+ * and that every value is in the audience catalog.
+ */
+declare const DELEGABLE_AUDIENCE_SCOPES: {
+  readonly 'whatsapp-api': readonly ["messages:send:text", "messages:send:media"];
+};
+/** Audiences that can be the destination of a delegated token. */
+type DelegableAudience = keyof typeof DELEGABLE_AUDIENCE_SCOPES;
+/** Delegable audiences as a tuple, so schemas can build an enum straight from it. */
+declare const DELEGABLE_AUDIENCES: readonly ["whatsapp-api"];
+type DelegableScope<A extends DelegableAudience = DelegableAudience> = (typeof DELEGABLE_AUDIENCE_SCOPES)[A][number];
+/** Every delegable permission of every audience, flat (a scope string names its audience's service). */
+declare const DELEGABLE_SCOPES: readonly [DelegableScope, ...DelegableScope[]];
+/** True when `audience` can be the destination of a delegated token. */
+declare function isDelegableAudience(value: string): value is DelegableAudience;
+/** True when `scope` can be delegated towards `audience` (an unknown or non-delegable audience is false). */
+declare function isDelegableScope(audience: string, scope: string): boolean;
+/**
+ * Closed catalog of permissions BETWEEN companies ("company B may do X on the data of company A"),
+ * by the service audience that owns the data. Kept apart from {@link SERVICE_AUDIENCE_SCOPES} on
+ * purpose: those say what a service CLIENT can do, these say what a COMPANY authorizes another
+ * company to do. They are only for private data; public or shared data needs none.
+ *
+ * Starts minimal and each owning service adds its own (together with the route that checks it).
+ * `auth-api` owns none: it only stores and answers the grants.
+ */
+declare const INTER_EMPRESA_PERMISSIONS: {
+  readonly 'whatsapp-api': readonly ["whatsapp:mensajes:leer"];
+};
+/** Audience that owns a block of inter-company permissions. */
+type InterEmpresaOwner = keyof typeof INTER_EMPRESA_PERMISSIONS;
+type InterEmpresaPermission = (typeof INTER_EMPRESA_PERMISSIONS)[InterEmpresaOwner][number];
+/** Every inter-company permission, flat, so schemas can build an enum straight from it. */
+declare const INTER_EMPRESA_PERMISSION_LIST: readonly [InterEmpresaPermission, ...InterEmpresaPermission[]];
+/** True when `value` is a permission of the inter-company catalog. */
+declare function isInterEmpresaPermission(value: string): value is InterEmpresaPermission;
+/** The audience that owns `permission` (the only one that may verify it), or `undefined`. */
+declare function interEmpresaPermissionOwner(permission: string): InterEmpresaOwner | undefined;
+export { isInterEmpresaPermission as _, DelegableScope as a, InterEmpresaOwner as c, SERVICE_AUDIENCE_SCOPES as d, ServiceAudience as f, isDelegableScope as g, isDelegableAudience as h, DelegableAudience as i, InterEmpresaPermission as l, interEmpresaPermissionOwner as m, DELEGABLE_AUDIENCE_SCOPES as n, INTER_EMPRESA_PERMISSIONS as o, ServiceScope as p, DELEGABLE_SCOPES as r, INTER_EMPRESA_PERMISSION_LIST as s, DELEGABLE_AUDIENCES as t, SERVICE_AUDIENCES as u, isScopeOfAudience as v, isServiceAudience as y };
+//# sourceMappingURL=catalog-CIqpzgsM.d.cts.map

package/dist/catalog-CIqpzgsM.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog-CIqpzgsM.d.cts","names":[],"sources":["../../auth-contracts/dist/catalog.d.ts"],"mappings":";;;;;;;;;;;;;;;;;;cAkBc;WACH;WACA;;KAEN,+BAA+B;;cAEtB;KACT,aAAa,UAAU,kBAAkB,2BAA2B,yBAAyB;;iBAEjF,kBAAkB,gBAAgB,SAAS;;iBAE3C,kBAAkB,kBAAkB;;;;;;;;;cASvC;WACH;;;KAGN,iCAAiC;;cAExB;KACT,eAAe,UAAU,oBAAoB,6BAA6B,2BAA2B;;cAE5F,4BAA4B,mBAAmB;;iBAE5C,oBAAoB,gBAAgB,SAAS;;iBAE7C,iBAAiB,kBAAkB;;;;;;;;;;cAUtC;WACH;;;KAGN,iCAAiC;KACjC,iCAAiC,2BAA2B;;cAEnD,yCAAyC,2BAA2B;;iBAEjE,yBAAyB,gBAAgB,SAAS;;iBAElD,4BAA4B,qBAAqB"}

package/dist/catalog-CIqpzgsM.d.ts

@@ -0,0 +1,75 @@
+/**
+ * PURE module: it must never reference `zod` or any schema module of this package (see
+ * `constants.ts`). The closed catalog of service audiences and, for each, its permissions.
+ *
+ * Apart from `tokens.ts` and `constants.ts` on purpose: the SDK `react` entry is size-budgeted and
+ * reaches `constants.ts` (header names), so nothing the browser does not need goes there. The SDK
+ * `react` closure imports neither this catalog nor the token vocabulary; Auth uses
+ * `isServiceAudience` to keep product slugs and service audiences apart.
+ */
+/**
+ * Closed catalog of service audiences and, for each one, the permissions a service client can be
+ * granted on it. The service token `aud` is one of these keys and its `scope` a subset of the
+ * values. Add a permission here only together with the route that requires it.
+ *
+ * `admin` is NOT a permission of `auth-api`: the Auth admin surface authenticates with the signed
+ * request of a service client flagged `esAdmin`, never with a token. It IS a permission of
+ * `whatsapp-api`.
+ */
+declare const SERVICE_AUDIENCE_SCOPES: {
+  readonly 'auth-api': readonly ["users:read", "webhooks:read", "webhooks:write", "empresas:leer", "empresas:escribir", "tokens:exchange", "contrataciones:pedir", "contrataciones:escribir", "contrataciones:leer", "empresas:baja", "autorizaciones:escribir", "autorizaciones:leer", "directorio:leer"];
+  readonly 'whatsapp-api': readonly ["messages:send:text", "messages:send:media", "admin"];
+};
+type ServiceAudience = keyof typeof SERVICE_AUDIENCE_SCOPES;
+/** Service audiences as a tuple, so schemas can build an enum straight from it. */
+declare const SERVICE_AUDIENCES: readonly ["auth-api", "whatsapp-api"];
+type ServiceScope<A extends ServiceAudience = ServiceAudience> = (typeof SERVICE_AUDIENCE_SCOPES)[A][number];
+/** True when `value` is an audience of the catalog. */
+declare function isServiceAudience(value: string): value is ServiceAudience;
+/** True when `scope` is a permission of `audience` in the catalog (an unknown audience is false). */
+declare function isScopeOfAudience(audience: string, scope: string): boolean;
+/**
+ * Permissions a service client can DELEGATE on behalf of a user (token exchange), by destination
+ * audience. A delegation edge (`service_client_delegations`) can only carry these.
+ *
+ * Narrower than {@link SERVICE_AUDIENCE_SCOPES} on purpose: `auth-api` is never a destination (Auth
+ * is the issuer, so no delegated token talks to it) and `admin` is never delegable. A test pins both
+ * and that every value is in the audience catalog.
+ */
+declare const DELEGABLE_AUDIENCE_SCOPES: {
+  readonly 'whatsapp-api': readonly ["messages:send:text", "messages:send:media"];
+};
+/** Audiences that can be the destination of a delegated token. */
+type DelegableAudience = keyof typeof DELEGABLE_AUDIENCE_SCOPES;
+/** Delegable audiences as a tuple, so schemas can build an enum straight from it. */
+declare const DELEGABLE_AUDIENCES: readonly ["whatsapp-api"];
+type DelegableScope<A extends DelegableAudience = DelegableAudience> = (typeof DELEGABLE_AUDIENCE_SCOPES)[A][number];
+/** Every delegable permission of every audience, flat (a scope string names its audience's service). */
+declare const DELEGABLE_SCOPES: readonly [DelegableScope, ...DelegableScope[]];
+/** True when `audience` can be the destination of a delegated token. */
+declare function isDelegableAudience(value: string): value is DelegableAudience;
+/** True when `scope` can be delegated towards `audience` (an unknown or non-delegable audience is false). */
+declare function isDelegableScope(audience: string, scope: string): boolean;
+/**
+ * Closed catalog of permissions BETWEEN companies ("company B may do X on the data of company A"),
+ * by the service audience that owns the data. Kept apart from {@link SERVICE_AUDIENCE_SCOPES} on
+ * purpose: those say what a service CLIENT can do, these say what a COMPANY authorizes another
+ * company to do. They are only for private data; public or shared data needs none.
+ *
+ * Starts minimal and each owning service adds its own (together with the route that checks it).
+ * `auth-api` owns none: it only stores and answers the grants.
+ */
+declare const INTER_EMPRESA_PERMISSIONS: {
+  readonly 'whatsapp-api': readonly ["whatsapp:mensajes:leer"];
+};
+/** Audience that owns a block of inter-company permissions. */
+type InterEmpresaOwner = keyof typeof INTER_EMPRESA_PERMISSIONS;
+type InterEmpresaPermission = (typeof INTER_EMPRESA_PERMISSIONS)[InterEmpresaOwner][number];
+/** Every inter-company permission, flat, so schemas can build an enum straight from it. */
+declare const INTER_EMPRESA_PERMISSION_LIST: readonly [InterEmpresaPermission, ...InterEmpresaPermission[]];
+/** True when `value` is a permission of the inter-company catalog. */
+declare function isInterEmpresaPermission(value: string): value is InterEmpresaPermission;
+/** The audience that owns `permission` (the only one that may verify it), or `undefined`. */
+declare function interEmpresaPermissionOwner(permission: string): InterEmpresaOwner | undefined;
+export { isInterEmpresaPermission as _, DelegableScope as a, InterEmpresaOwner as c, SERVICE_AUDIENCE_SCOPES as d, ServiceAudience as f, isDelegableScope as g, isDelegableAudience as h, DelegableAudience as i, InterEmpresaPermission as l, interEmpresaPermissionOwner as m, DELEGABLE_AUDIENCE_SCOPES as n, INTER_EMPRESA_PERMISSIONS as o, ServiceScope as p, DELEGABLE_SCOPES as r, INTER_EMPRESA_PERMISSION_LIST as s, DELEGABLE_AUDIENCES as t, SERVICE_AUDIENCES as u, isScopeOfAudience as v, isServiceAudience as y };
+//# sourceMappingURL=catalog-CIqpzgsM.d.ts.map

package/dist/catalog-CIqpzgsM.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog-CIqpzgsM.d.ts","names":[],"sources":["../../auth-contracts/dist/catalog.d.ts"],"mappings":";;;;;;;;;;;;;;;;;;cAkBc;WACH;WACA;;KAEN,+BAA+B;;cAEtB;KACT,aAAa,UAAU,kBAAkB,2BAA2B,yBAAyB;;iBAEjF,kBAAkB,gBAAgB,SAAS;;iBAE3C,kBAAkB,kBAAkB;;;;;;;;;cASvC;WACH;;;KAGN,iCAAiC;;cAExB;KACT,eAAe,UAAU,oBAAoB,6BAA6B,2BAA2B;;cAE5F,4BAA4B,mBAAmB;;iBAE5C,oBAAoB,gBAAgB,SAAS;;iBAE7C,iBAAiB,kBAAkB;;;;;;;;;;cAUtC;WACH;;;KAGN,iCAAiC;KACjC,iCAAiC,2BAA2B;;cAEnD,yCAAyC,2BAA2B;;iBAEjE,yBAAyB,gBAAgB,SAAS;;iBAElD,4BAA4B,qBAAqB"}

package/dist/catalog-DqPhtCKZ.js

@@ -0,0 +1,95 @@
+// ../auth-contracts/dist/catalog.js
+/**
+* PURE module: it must never reference `zod` or any schema module of this package (see
+* `constants.ts`). The closed catalog of service audiences and, for each, its permissions.
+*
+* Apart from `tokens.ts` and `constants.ts` on purpose: the SDK `react` entry is size-budgeted and
+* reaches `constants.ts` (header names), so nothing the browser does not need goes there. The SDK
+* `react` closure imports neither this catalog nor the token vocabulary; Auth uses
+* `isServiceAudience` to keep product slugs and service audiences apart.
+*/
+/**
+* Closed catalog of service audiences and, for each one, the permissions a service client can be
+* granted on it. The service token `aud` is one of these keys and its `scope` a subset of the
+* values. Add a permission here only together with the route that requires it.
+*
+* `admin` is NOT a permission of `auth-api`: the Auth admin surface authenticates with the signed
+* request of a service client flagged `esAdmin`, never with a token. It IS a permission of
+* `whatsapp-api`.
+*/
+const SERVICE_AUDIENCE_SCOPES = {
+	"auth-api": [
+		"users:read",
+		"webhooks:read",
+		"webhooks:write",
+		"empresas:leer",
+		"empresas:escribir",
+		"tokens:exchange",
+		"contrataciones:pedir",
+		"contrataciones:escribir",
+		"contrataciones:leer",
+		"empresas:baja",
+		"autorizaciones:escribir",
+		"autorizaciones:leer",
+		"directorio:leer"
+	],
+	"whatsapp-api": [
+		"messages:send:text",
+		"messages:send:media",
+		"admin"
+	]
+};
+/** Service audiences as a tuple, so schemas can build an enum straight from it. */
+const SERVICE_AUDIENCES = ["auth-api", "whatsapp-api"];
+/** True when `value` is an audience of the catalog. */
+function isServiceAudience(value) {
+	return Object.hasOwn(SERVICE_AUDIENCE_SCOPES, value);
+}
+/** True when `scope` is a permission of `audience` in the catalog (an unknown audience is false). */
+function isScopeOfAudience(audience, scope) {
+	return isServiceAudience(audience) && SERVICE_AUDIENCE_SCOPES[audience].includes(scope);
+}
+/**
+* Permissions a service client can DELEGATE on behalf of a user (token exchange), by destination
+* audience. A delegation edge (`service_client_delegations`) can only carry these.
+*
+* Narrower than {@link SERVICE_AUDIENCE_SCOPES} on purpose: `auth-api` is never a destination (Auth
+* is the issuer, so no delegated token talks to it) and `admin` is never delegable. A test pins both
+* and that every value is in the audience catalog.
+*/
+const DELEGABLE_AUDIENCE_SCOPES = { "whatsapp-api": ["messages:send:text", "messages:send:media"] };
+/** Delegable audiences as a tuple, so schemas can build an enum straight from it. */
+const DELEGABLE_AUDIENCES = ["whatsapp-api"];
+/** Every delegable permission of every audience, flat (a scope string names its audience's service). */
+const DELEGABLE_SCOPES = Object.values(DELEGABLE_AUDIENCE_SCOPES).flat();
+/** True when `audience` can be the destination of a delegated token. */
+function isDelegableAudience(value) {
+	return Object.hasOwn(DELEGABLE_AUDIENCE_SCOPES, value);
+}
+/** True when `scope` can be delegated towards `audience` (an unknown or non-delegable audience is false). */
+function isDelegableScope(audience, scope) {
+	return isDelegableAudience(audience) && DELEGABLE_AUDIENCE_SCOPES[audience].includes(scope);
+}
+/**
+* Closed catalog of permissions BETWEEN companies ("company B may do X on the data of company A"),
+* by the service audience that owns the data. Kept apart from {@link SERVICE_AUDIENCE_SCOPES} on
+* purpose: those say what a service CLIENT can do, these say what a COMPANY authorizes another
+* company to do. They are only for private data; public or shared data needs none.
+*
+* Starts minimal and each owning service adds its own (together with the route that checks it).
+* `auth-api` owns none: it only stores and answers the grants.
+*/
+const INTER_EMPRESA_PERMISSIONS = { "whatsapp-api": ["whatsapp:mensajes:leer"] };
+/** Every inter-company permission, flat, so schemas can build an enum straight from it. */
+const INTER_EMPRESA_PERMISSION_LIST = Object.values(INTER_EMPRESA_PERMISSIONS).flat();
+/** True when `value` is a permission of the inter-company catalog. */
+function isInterEmpresaPermission(value) {
+	return INTER_EMPRESA_PERMISSION_LIST.includes(value);
+}
+/** The audience that owns `permission` (the only one that may verify it), or `undefined`. */
+function interEmpresaPermissionOwner(permission) {
+	return Object.keys(INTER_EMPRESA_PERMISSIONS).find((owner) => INTER_EMPRESA_PERMISSIONS[owner].includes(permission));
+}
+export { INTER_EMPRESA_PERMISSION_LIST as a, interEmpresaPermissionOwner as c, isInterEmpresaPermission as d, isScopeOfAudience as f, INTER_EMPRESA_PERMISSIONS as i, isDelegableAudience as l, DELEGABLE_AUDIENCE_SCOPES as n, SERVICE_AUDIENCES as o, isServiceAudience as p, DELEGABLE_SCOPES as r, SERVICE_AUDIENCE_SCOPES as s, DELEGABLE_AUDIENCES as t, isDelegableScope as u };
+
+//# sourceMappingURL=catalog-DqPhtCKZ.js.map

package/dist/catalog-DqPhtCKZ.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog-DqPhtCKZ.js","names":[],"sources":["../../auth-contracts/dist/catalog.js"],"sourcesContent":["// src/catalog.ts\n/**\n* PURE module: it must never reference `zod` or any schema module of this package (see\n* `constants.ts`). The closed catalog of service audiences and, for each, its permissions.\n*\n* Apart from `tokens.ts` and `constants.ts` on purpose: the SDK `react` entry is size-budgeted and\n* reaches `constants.ts` (header names), so nothing the browser does not need goes there. The SDK\n* `react` closure imports neither this catalog nor the token vocabulary; Auth uses\n* `isServiceAudience` to keep product slugs and service audiences apart.\n*/\n/**\n* Closed catalog of service audiences and, for each one, the permissions a service client can be\n* granted on it. The service token `aud` is one of these keys and its `scope` a subset of the\n* values. Add a permission here only together with the route that requires it.\n*\n* `admin` is NOT a permission of `auth-api`: the Auth admin surface authenticates with the signed\n* request of a service client flagged `esAdmin`, never with a token. It IS a permission of\n* `whatsapp-api`.\n*/\nconst SERVICE_AUDIENCE_SCOPES = {\n\t\"auth-api\": [\n\t\t\"users:read\",\n\t\t\"webhooks:read\",\n\t\t\"webhooks:write\",\n\t\t\"empresas:leer\",\n\t\t\"empresas:escribir\",\n\t\t\"tokens:exchange\",\n\t\t\"contrataciones:pedir\",\n\t\t\"contrataciones:escribir\",\n\t\t\"contrataciones:leer\",\n\t\t\"empresas:baja\",\n\t\t\"autorizaciones:escribir\",\n\t\t\"autorizaciones:leer\",\n\t\t\"directorio:leer\"\n\t],\n\t\"whatsapp-api\": [\n\t\t\"messages:send:text\",\n\t\t\"messages:send:media\",\n\t\t\"admin\"\n\t]\n};\n/** Service audiences as a tuple, so schemas can build an enum straight from it. */\nconst SERVICE_AUDIENCES = [\"auth-api\", \"whatsapp-api\"];\n/** True when `value` is an audience of the catalog. */\nfunction isServiceAudience(value) {\n\treturn Object.hasOwn(SERVICE_AUDIENCE_SCOPES, value);\n}\n/** True when `scope` is a permission of `audience` in the catalog (an unknown audience is false). */\nfunction isScopeOfAudience(audience, scope) {\n\treturn isServiceAudience(audience) && SERVICE_AUDIENCE_SCOPES[audience].includes(scope);\n}\n/**\n* Permissions a service client can DELEGATE on behalf of a user (token exchange), by destination\n* audience. A delegation edge (`service_client_delegations`) can only carry these.\n*\n* Narrower than {@link SERVICE_AUDIENCE_SCOPES} on purpose: `auth-api` is never a destination (Auth\n* is the issuer, so no delegated token talks to it) and `admin` is never delegable. A test pins both\n* and that every value is in the audience catalog.\n*/\nconst DELEGABLE_AUDIENCE_SCOPES = { \"whatsapp-api\": [\"messages:send:text\", \"messages:send:media\"] };\n/** Delegable audiences as a tuple, so schemas can build an enum straight from it. */\nconst DELEGABLE_AUDIENCES = [\"whatsapp-api\"];\n/** Every delegable permission of every audience, flat (a scope string names its audience's service). */\nconst DELEGABLE_SCOPES = Object.values(DELEGABLE_AUDIENCE_SCOPES).flat();\n/** True when `audience` can be the destination of a delegated token. */\nfunction isDelegableAudience(value) {\n\treturn Object.hasOwn(DELEGABLE_AUDIENCE_SCOPES, value);\n}\n/** True when `scope` can be delegated towards `audience` (an unknown or non-delegable audience is false). */\nfunction isDelegableScope(audience, scope) {\n\treturn isDelegableAudience(audience) && DELEGABLE_AUDIENCE_SCOPES[audience].includes(scope);\n}\n/**\n* Closed catalog of permissions BETWEEN companies (\"company B may do X on the data of company A\"),\n* by the service audience that owns the data. Kept apart from {@link SERVICE_AUDIENCE_SCOPES} on\n* purpose: those say what a service CLIENT can do, these say what a COMPANY authorizes another\n* company to do. They are only for private data; public or shared data needs none.\n*\n* Starts minimal and each owning service adds its own (together with the route that checks it).\n* `auth-api` owns none: it only stores and answers the grants.\n*/\nconst INTER_EMPRESA_PERMISSIONS = { \"whatsapp-api\": [\"whatsapp:mensajes:leer\"] };\n/** Every inter-company permission, flat, so schemas can build an enum straight from it. */\nconst INTER_EMPRESA_PERMISSION_LIST = Object.values(INTER_EMPRESA_PERMISSIONS).flat();\n/** True when `value` is a permission of the inter-company catalog. */\nfunction isInterEmpresaPermission(value) {\n\treturn INTER_EMPRESA_PERMISSION_LIST.includes(value);\n}\n/** The audience that owns `permission` (the only one that may verify it), or `undefined`. */\nfunction interEmpresaPermissionOwner(permission) {\n\treturn Object.keys(INTER_EMPRESA_PERMISSIONS).find((owner) => INTER_EMPRESA_PERMISSIONS[owner].includes(permission));\n}\nexport { DELEGABLE_AUDIENCES, DELEGABLE_AUDIENCE_SCOPES, DELEGABLE_SCOPES, INTER_EMPRESA_PERMISSIONS, INTER_EMPRESA_PERMISSION_LIST, SERVICE_AUDIENCES, SERVICE_AUDIENCE_SCOPES, interEmpresaPermissionOwner, isDelegableAudience, isDelegableScope, isInterEmpresaPermission, isScopeOfAudience, isServiceAudience };\n\n//# sourceMappingURL=catalog.js.map"],"mappings":";;;;;;;;;;;;;;;;;;;AAmBA,MAAM,0BAA0B;CAC/B,YAAY;EACX;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACD;CACA,gBAAgB;EACf;EACA;EACA;CACD;AACD;;AAEA,MAAM,oBAAoB,CAAC,YAAY,cAAc;;AAErD,SAAS,kBAAkB,OAAO;CACjC,OAAO,OAAO,OAAO,yBAAyB,KAAK;AACpD;;AAEA,SAAS,kBAAkB,UAAU,OAAO;CAC3C,OAAO,kBAAkB,QAAQ,KAAK,wBAAwB,SAAS,CAAC,SAAS,KAAK;AACvF;;;;;;;;;AASA,MAAM,4BAA4B,EAAE,gBAAgB,CAAC,sBAAsB,qBAAqB,EAAE;;AAElG,MAAM,sBAAsB,CAAC,cAAc;;AAE3C,MAAM,mBAAmB,OAAO,OAAO,yBAAyB,CAAC,CAAC,KAAK;;AAEvE,SAAS,oBAAoB,OAAO;CACnC,OAAO,OAAO,OAAO,2BAA2B,KAAK;AACtD;;AAEA,SAAS,iBAAiB,UAAU,OAAO;CAC1C,OAAO,oBAAoB,QAAQ,KAAK,0BAA0B,SAAS,CAAC,SAAS,KAAK;AAC3F;;;;;;;;;;AAUA,MAAM,4BAA4B,EAAE,gBAAgB,CAAC,wBAAwB,EAAE;;AAE/E,MAAM,gCAAgC,OAAO,OAAO,yBAAyB,CAAC,CAAC,KAAK;;AAEpF,SAAS,yBAAyB,OAAO;CACxC,OAAO,8BAA8B,SAAS,KAAK;AACpD;;AAEA,SAAS,4BAA4B,YAAY;CAChD,OAAO,OAAO,KAAK,yBAAyB,CAAC,CAAC,MAAM,UAAU,0BAA0B,MAAM,CAAC,SAAS,UAAU,CAAC;AACpH"}

package/dist/config-D6Tr7ev6.d.cts

@@ -0,0 +1,95 @@
+import "./index-Dold-Ycb.cjs";
+import { f as TokenPair } from "./types-qh6ANBCV.cjs";
+import { n as EvaErrorMessages } from "./error-messages-CGpW1fsg.cjs";
+declare function readTokensFromCookies(cookieHeader: string | null): Partial<TokenPair>;
+declare function setTokenCookies(tokens: TokenPair): string[];
+declare function clearTokenCookies(): string[];
+/**
+ * Nombres de las cookies de sesión del producto configurado: `eva_<producto>_access_token` y
+ * `eva_<producto>_refresh_token`. Dos productos bajo el mismo dominio padre no se pisan.
+ * @throws Error de configuración (`EvaAuthConfigError`) si falta `configureEvaAuth({ product })`.
+ */
+declare const getCookieNames: () => {
+  readonly ACCESS_TOKEN: string;
+  readonly REFRESH_TOKEN: string;
+};
+declare const COOKIE_MAX_AGE: {
+  readonly ACCESS_TOKEN: number;
+  readonly REFRESH_TOKEN: number;
+};
+/** Issuer y algoritmo de los tokens. La audiencia de usuario es el producto configurado. */
+declare const JWT_CONFIG: {
+  readonly ISSUER: "auth-service";
+  readonly ALGORITHM: "ES256";
+};
+interface ConfigureEvaAuthOptions {
+  /**
+   * URL base del Auth Service. Obligatoria antes del primer uso que la necesite
+   * (`authFetch`, JWKS): si falta, esos usos lanzan `EvaAuthConfigError`.
+   * Acepta https, o http solo en loopback (localhost, 127.0.0.1, [::1]); admite path
+   * (`https://host/auth`). Rechaza userinfo, query y fragmento (incluidos `?` y `#` solitarios).
+   * Se normaliza (host en minúsculas, sin `/` final) y es inmutable: reconfigurar con el mismo
+   * valor normalizado es no-op; con otro valor lanza Error.
+   * Si se omite (undefined), no valida ni modifica el valor previo.
+   * @throws Error si la URL es inválida o difiere de la ya configurada.
+   */
+  authUrl?: string;
+  /**
+   * Slug del producto de este consumidor (`whatsapp-panel`). Obligatorio **solo** si se usan las
+   * rutas de login, las cookies de sesión o `verifyAccessToken`: da el nombre de las cookies
+   * (`eva_<producto>_access_token`), la audiencia (`aud`) que exige `verifyAccessToken` y el
+   * `producto` que viaja en el login. Un servicio que solo verifica tokens de servicio no lo necesita.
+   * Debe ser un slug (`^[a-z][a-z0-9-]{2,63}$`).
+   * Es inmutable: reconfigurar el mismo valor es no-op; con otro valor lanza Error.
+   * Si se omite (undefined), no valida ni modifica el valor previo.
+   * @throws Error si el slug es inválido o difiere del ya configurado.
+   */
+  product?: string;
+  /**
+   * Domain para Set-Cookie. Validada contra header injection (;, \r, \n).
+   * Si se omite (undefined), NO resetea el valor previo.
+   * Recomendado: '.miempresa.com' para compartir entre subdominios.
+   */
+  cookieDomain?: string;
+  /**
+   * Mensajes de error que el SDK escribe en respuestas 4xx.
+   * Override granular: keys no provistas mantienen el default.
+   * Si se omite (undefined), NO resetea el valor previo.
+   * `""` se respeta como override explícito (no cae al default).
+   * @throws Error si alguna key es desconocida o si algún valor no es string.
+   */
+  errorMessages?: Partial<EvaErrorMessages>;
+  /**
+   * Shape del wire HTTP que el SDK Hono emite cuando rechaza un request.
+   * - 'api' (default): { error: { code: string, message: string } } — consistente con el API.
+   * - 'string': { error: string } — legacy, para consumers que esperan mensaje plano.
+   * D-13 v2 LOCKED: default='api', configurable para compat con consumers 0.x.
+   * @throws Error si se pasa un valor distinto de 'api' o 'string'.
+   */
+  errorWire?: 'api' | 'string';
+}
+/**
+ * Configura el SDK en runtime. Llamar al boot del consumidor, antes del primer request;
+ * importar el SDK o crear `evaAuth()` no lee la configuración ni lanza.
+ *
+ * Es atómica: valida todos los campos y recién entonces los confirma; si uno falla, ninguno cambia.
+ * `authUrl` es inmutable (re-configurar el mismo valor normalizado es no-op). El resto de los
+ * campos provistos sobrescriben el valor previo; los omitidos (undefined) no lo resetean.
+ *
+ * @throws Error si `authUrl` o `product` son inválidos o distintos de los ya configurados, si cookieDomain contiene
+ *   caracteres de header injection (;, \r, \n), o si errorMessages / errorWire son inválidos.
+ */
+declare function configureEvaAuth(opts: ConfigureEvaAuthOptions): void;
+/**
+ * Retorna la URL del Auth Service configurada vía `configureEvaAuth({ authUrl })`
+ * (normalizada, sin `/` final).
+ * @throws Error de configuración (`name === 'EvaAuthConfigError'`) si aún no se configuró.
+ *   `authFetch` y `verifyAccessToken` lo propagan: el consumidor ve un 500, nunca un 401 o un error de red.
+ */
+declare function getAuthUrl(): string;
+/**
+ * Retorna el cookieDomain configurado vía configureEvaAuth, o undefined si no se configuró.
+ */
+declare function getCookieDomain(): string | undefined;
+export { COOKIE_MAX_AGE as a, clearTokenCookies as c, getCookieDomain as i, readTokensFromCookies as l, configureEvaAuth as n, JWT_CONFIG as o, getAuthUrl as r, getCookieNames as s, ConfigureEvaAuthOptions as t, setTokenCookies as u };
+//# sourceMappingURL=config-D6Tr7ev6.d.cts.map

package/dist/config-D6Tr7ev6.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-D6Tr7ev6.d.cts","names":[],"sources":["../src/cookies.ts","../src/constants.ts","../src/config.ts"],"mappings":";;;iBAiDgB,sBACd,8BACC,QAAQ;iBA0BK,gBAAgB,QAAQ;iBA4BxB;;;;;;cC3FH;WACF;WACA;;cASE;;;;;cAMA;;;;UCyGI;;;;;;;;;;;EAWf;;;;;;;;;;;EAWA;;;;;;EAMA;;;;;;;;EAQA,gBAAgB,QAAQ;;;;;;;;EAQxB;;;;;;;;;;;;;iBA4Ec,iBAAiB,MAAM;;;;;;;iBAWvB;;;;iBA0BA"}

package/dist/config-rl4_-VAq.d.ts

@@ -0,0 +1,95 @@
+import "./index-Dold-Ycb.js";
+import { f as TokenPair } from "./types-CLOIHzRu.js";
+import { n as EvaErrorMessages } from "./error-messages-CGpW1fsg.js";
+declare function readTokensFromCookies(cookieHeader: string | null): Partial<TokenPair>;
+declare function setTokenCookies(tokens: TokenPair): string[];
+declare function clearTokenCookies(): string[];
+/**
+ * Nombres de las cookies de sesión del producto configurado: `eva_<producto>_access_token` y
+ * `eva_<producto>_refresh_token`. Dos productos bajo el mismo dominio padre no se pisan.
+ * @throws Error de configuración (`EvaAuthConfigError`) si falta `configureEvaAuth({ product })`.
+ */
+declare const getCookieNames: () => {
+  readonly ACCESS_TOKEN: string;
+  readonly REFRESH_TOKEN: string;
+};
+declare const COOKIE_MAX_AGE: {
+  readonly ACCESS_TOKEN: number;
+  readonly REFRESH_TOKEN: number;
+};
+/** Issuer y algoritmo de los tokens. La audiencia de usuario es el producto configurado. */
+declare const JWT_CONFIG: {
+  readonly ISSUER: "auth-service";
+  readonly ALGORITHM: "ES256";
+};
+interface ConfigureEvaAuthOptions {
+  /**
+   * URL base del Auth Service. Obligatoria antes del primer uso que la necesite
+   * (`authFetch`, JWKS): si falta, esos usos lanzan `EvaAuthConfigError`.
+   * Acepta https, o http solo en loopback (localhost, 127.0.0.1, [::1]); admite path
+   * (`https://host/auth`). Rechaza userinfo, query y fragmento (incluidos `?` y `#` solitarios).
+   * Se normaliza (host en minúsculas, sin `/` final) y es inmutable: reconfigurar con el mismo
+   * valor normalizado es no-op; con otro valor lanza Error.
+   * Si se omite (undefined), no valida ni modifica el valor previo.
+   * @throws Error si la URL es inválida o difiere de la ya configurada.
+   */
+  authUrl?: string;
+  /**
+   * Slug del producto de este consumidor (`whatsapp-panel`). Obligatorio **solo** si se usan las
+   * rutas de login, las cookies de sesión o `verifyAccessToken`: da el nombre de las cookies
+   * (`eva_<producto>_access_token`), la audiencia (`aud`) que exige `verifyAccessToken` y el
+   * `producto` que viaja en el login. Un servicio que solo verifica tokens de servicio no lo necesita.
+   * Debe ser un slug (`^[a-z][a-z0-9-]{2,63}$`).
+   * Es inmutable: reconfigurar el mismo valor es no-op; con otro valor lanza Error.
+   * Si se omite (undefined), no valida ni modifica el valor previo.
+   * @throws Error si el slug es inválido o difiere del ya configurado.
+   */
+  product?: string;
+  /**
+   * Domain para Set-Cookie. Validada contra header injection (;, \r, \n).
+   * Si se omite (undefined), NO resetea el valor previo.
+   * Recomendado: '.miempresa.com' para compartir entre subdominios.
+   */
+  cookieDomain?: string;
+  /**
+   * Mensajes de error que el SDK escribe en respuestas 4xx.
+   * Override granular: keys no provistas mantienen el default.
+   * Si se omite (undefined), NO resetea el valor previo.
+   * `""` se respeta como override explícito (no cae al default).
+   * @throws Error si alguna key es desconocida o si algún valor no es string.
+   */
+  errorMessages?: Partial<EvaErrorMessages>;
+  /**
+   * Shape del wire HTTP que el SDK Hono emite cuando rechaza un request.
+   * - 'api' (default): { error: { code: string, message: string } } — consistente con el API.
+   * - 'string': { error: string } — legacy, para consumers que esperan mensaje plano.
+   * D-13 v2 LOCKED: default='api', configurable para compat con consumers 0.x.
+   * @throws Error si se pasa un valor distinto de 'api' o 'string'.
+   */
+  errorWire?: 'api' | 'string';
+}
+/**
+ * Configura el SDK en runtime. Llamar al boot del consumidor, antes del primer request;
+ * importar el SDK o crear `evaAuth()` no lee la configuración ni lanza.
+ *
+ * Es atómica: valida todos los campos y recién entonces los confirma; si uno falla, ninguno cambia.
+ * `authUrl` es inmutable (re-configurar el mismo valor normalizado es no-op). El resto de los
+ * campos provistos sobrescriben el valor previo; los omitidos (undefined) no lo resetean.
+ *
+ * @throws Error si `authUrl` o `product` son inválidos o distintos de los ya configurados, si cookieDomain contiene
+ *   caracteres de header injection (;, \r, \n), o si errorMessages / errorWire son inválidos.
+ */
+declare function configureEvaAuth(opts: ConfigureEvaAuthOptions): void;
+/**
+ * Retorna la URL del Auth Service configurada vía `configureEvaAuth({ authUrl })`
+ * (normalizada, sin `/` final).
+ * @throws Error de configuración (`name === 'EvaAuthConfigError'`) si aún no se configuró.
+ *   `authFetch` y `verifyAccessToken` lo propagan: el consumidor ve un 500, nunca un 401 o un error de red.
+ */
+declare function getAuthUrl(): string;
+/**
+ * Retorna el cookieDomain configurado vía configureEvaAuth, o undefined si no se configuró.
+ */
+declare function getCookieDomain(): string | undefined;
+export { COOKIE_MAX_AGE as a, clearTokenCookies as c, getCookieDomain as i, readTokensFromCookies as l, configureEvaAuth as n, JWT_CONFIG as o, getAuthUrl as r, getCookieNames as s, ConfigureEvaAuthOptions as t, setTokenCookies as u };
+//# sourceMappingURL=config-rl4_-VAq.d.ts.map

package/dist/config-rl4_-VAq.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-rl4_-VAq.d.ts","names":[],"sources":["../src/cookies.ts","../src/constants.ts","../src/config.ts"],"mappings":";;;iBAiDgB,sBACd,8BACC,QAAQ;iBA0BK,gBAAgB,QAAQ;iBA4BxB;;;;;;cC3FH;WACF;WACA;;cASE;;;;;cAMA;;;;UCyGI;;;;;;;;;;;EAWf;;;;;;;;;;;EAWA;;;;;;EAMA;;;;;;;;EAQA,gBAAgB,QAAQ;;;;;;;;EAQxB;;;;;;;;;;;;;iBA4Ec,iBAAiB,MAAM;;;;;;;iBAWvB;;;;iBA0BA"}

package/dist/constants-BE1_9Tod.cjs

@@ -0,0 +1,52 @@
+const require_parse_error_response = require("./parse-error-response-6qOQS5y9.cjs");
+// src/constants.ts
+/**
+* Nombres de las cookies de sesión del producto configurado: `eva_<producto>_access_token` y
+* `eva_<producto>_refresh_token`. Dos productos bajo el mismo dominio padre no se pisan.
+* @throws Error de configuración (`EvaAuthConfigError`) si falta `configureEvaAuth({ product })`.
+*/
+const getCookieNames = () => {
+	const product = require_parse_error_response.getProduct();
+	return {
+		ACCESS_TOKEN: `eva_${product}_access_token`,
+		REFRESH_TOKEN: `eva_${product}_refresh_token`
+	};
+};
+const COOKIE_MAX_AGE = {
+	ACCESS_TOKEN: 900,
+	REFRESH_TOKEN: 2592e3
+};
+/** Issuer y algoritmo de los tokens. La audiencia de usuario es el producto configurado. */
+const JWT_CONFIG = {
+	ISSUER: "auth-service",
+	ALGORITHM: "ES256"
+};
+const getAuthServiceUrl = () => {
+	return require_parse_error_response.getAuthUrl().replace(/\/$/, "");
+};
+Object.defineProperty(exports, "COOKIE_MAX_AGE", {
+	enumerable: true,
+	get: function() {
+		return COOKIE_MAX_AGE;
+	}
+});
+Object.defineProperty(exports, "JWT_CONFIG", {
+	enumerable: true,
+	get: function() {
+		return JWT_CONFIG;
+	}
+});
+Object.defineProperty(exports, "getAuthServiceUrl", {
+	enumerable: true,
+	get: function() {
+		return getAuthServiceUrl;
+	}
+});
+Object.defineProperty(exports, "getCookieNames", {
+	enumerable: true,
+	get: function() {
+		return getCookieNames;
+	}
+});
+
+//# sourceMappingURL=constants-BE1_9Tod.cjs.map

package/dist/constants-BE1_9Tod.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants-BE1_9Tod.cjs","names":["getProduct","getAuthUrl"],"sources":["../src/constants.ts"],"sourcesContent":["import { getAuthUrl, getProduct } from './config'\n\n/*\n * `HEADERS` es un re-export del contrato. Este módulo es alcanzable desde `src/react`: de la\n * barrel del contrato solo se importan VALORES de módulos puros (`constants.ts`, `routes.ts`) o\n * `import type`. Un schema importado por valor aquí arrastraría su código al bundle de react.\n */\nexport { HEADERS } from '@eva_solutions/auth-contracts'\n\n/**\n * Nombres de las cookies de sesión del producto configurado: `eva_<producto>_access_token` y\n * `eva_<producto>_refresh_token`. Dos productos bajo el mismo dominio padre no se pisan.\n * @throws Error de configuración (`EvaAuthConfigError`) si falta `configureEvaAuth({ product })`.\n */\nexport const getCookieNames = (): {\n  readonly ACCESS_TOKEN: string\n  readonly REFRESH_TOKEN: string\n} => {\n  const product = getProduct()\n  return {\n    ACCESS_TOKEN: `eva_${product}_access_token`,\n    REFRESH_TOKEN: `eva_${product}_refresh_token`,\n  }\n}\n\nexport const COOKIE_MAX_AGE = {\n  ACCESS_TOKEN: 15 * 60, // 15 min\n  REFRESH_TOKEN: 30 * 24 * 60 * 60, // 30 días\n} as const\n\n/** Issuer y algoritmo de los tokens. La audiencia de usuario es el producto configurado. */\nexport const JWT_CONFIG = {\n  // Igual a `TOKEN_ISSUER` del contrato (un test lo fija); literal aquí para no arrastrar el\n  // módulo de identidad al bundle de react, que importa este archivo.\n  ISSUER: 'auth-service',\n  ALGORITHM: 'ES256',\n} as const\n\nexport const getAuthServiceUrl = (): string => {\n  return getAuthUrl().replace(/\\/$/, '')\n}\n"],"mappings":";;;;;;;AAcA,MAAa,uBAGR;CACH,MAAM,UAAUA,6BAAAA,WAAW;CAC3B,OAAO;EACL,cAAc,OAAO,QAAQ;EAC7B,eAAe,OAAO,QAAQ;CAChC;AACF;AAEA,MAAa,iBAAiB;CAC5B,cAAc;CACd,eAAe;AACjB;;AAGA,MAAa,aAAa;CAGxB,QAAQ;CACR,WAAW;AACb;AAEA,MAAa,0BAAkC;CAC7C,OAAOC,6BAAAA,WAAW,CAAC,CAAC,QAAQ,OAAO,EAAE;AACvC"}

package/dist/constants-BY7QZokc.js

@@ -0,0 +1,29 @@
+import { r as getAuthUrl, s as getProduct } from "./parse-error-response-BM9-kjs0.js";
+// src/constants.ts
+/**
+* Nombres de las cookies de sesión del producto configurado: `eva_<producto>_access_token` y
+* `eva_<producto>_refresh_token`. Dos productos bajo el mismo dominio padre no se pisan.
+* @throws Error de configuración (`EvaAuthConfigError`) si falta `configureEvaAuth({ product })`.
+*/
+const getCookieNames = () => {
+	const product = getProduct();
+	return {
+		ACCESS_TOKEN: `eva_${product}_access_token`,
+		REFRESH_TOKEN: `eva_${product}_refresh_token`
+	};
+};
+const COOKIE_MAX_AGE = {
+	ACCESS_TOKEN: 900,
+	REFRESH_TOKEN: 2592e3
+};
+/** Issuer y algoritmo de los tokens. La audiencia de usuario es el producto configurado. */
+const JWT_CONFIG = {
+	ISSUER: "auth-service",
+	ALGORITHM: "ES256"
+};
+const getAuthServiceUrl = () => {
+	return getAuthUrl().replace(/\/$/, "");
+};
+export { getCookieNames as i, JWT_CONFIG as n, getAuthServiceUrl as r, COOKIE_MAX_AGE as t };
+
+//# sourceMappingURL=constants-BY7QZokc.js.map

package/dist/constants-BY7QZokc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants-BY7QZokc.js","names":[],"sources":["../src/constants.ts"],"sourcesContent":["import { getAuthUrl, getProduct } from './config'\n\n/*\n * `HEADERS` es un re-export del contrato. Este módulo es alcanzable desde `src/react`: de la\n * barrel del contrato solo se importan VALORES de módulos puros (`constants.ts`, `routes.ts`) o\n * `import type`. Un schema importado por valor aquí arrastraría su código al bundle de react.\n */\nexport { HEADERS } from '@eva_solutions/auth-contracts'\n\n/**\n * Nombres de las cookies de sesión del producto configurado: `eva_<producto>_access_token` y\n * `eva_<producto>_refresh_token`. Dos productos bajo el mismo dominio padre no se pisan.\n * @throws Error de configuración (`EvaAuthConfigError`) si falta `configureEvaAuth({ product })`.\n */\nexport const getCookieNames = (): {\n  readonly ACCESS_TOKEN: string\n  readonly REFRESH_TOKEN: string\n} => {\n  const product = getProduct()\n  return {\n    ACCESS_TOKEN: `eva_${product}_access_token`,\n    REFRESH_TOKEN: `eva_${product}_refresh_token`,\n  }\n}\n\nexport const COOKIE_MAX_AGE = {\n  ACCESS_TOKEN: 15 * 60, // 15 min\n  REFRESH_TOKEN: 30 * 24 * 60 * 60, // 30 días\n} as const\n\n/** Issuer y algoritmo de los tokens. La audiencia de usuario es el producto configurado. */\nexport const JWT_CONFIG = {\n  // Igual a `TOKEN_ISSUER` del contrato (un test lo fija); literal aquí para no arrastrar el\n  // módulo de identidad al bundle de react, que importa este archivo.\n  ISSUER: 'auth-service',\n  ALGORITHM: 'ES256',\n} as const\n\nexport const getAuthServiceUrl = (): string => {\n  return getAuthUrl().replace(/\\/$/, '')\n}\n"],"mappings":";;;;;;;AAcA,MAAa,uBAGR;CACH,MAAM,UAAU,WAAW;CAC3B,OAAO;EACL,cAAc,OAAO,QAAQ;EAC7B,eAAe,OAAO,QAAQ;CAChC;AACF;AAEA,MAAa,iBAAiB;CAC5B,cAAc;CACd,eAAe;AACjB;;AAGA,MAAa,aAAa;CAGxB,QAAQ;CACR,WAAW;AACb;AAEA,MAAa,0BAAkC;CAC7C,OAAO,WAAW,CAAC,CAAC,QAAQ,OAAO,EAAE;AACvC"}