@eva_solutions/auth-sdk 0.0.0-stage → 3.0.0-dev-20261109133200

package/dist/hono/index.cjs

@@ -0,0 +1,309 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_constants = require("../constants-CcbhOaAP.cjs");
+const require_jwt = require("../jwt-BBNqk0TV.cjs");
+const require_cookies = require("../cookies-DCIcr7uy.cjs");
+const require_http_client = require("../http-client-BVF3iktR.cjs");
+const require_refresh_dedup = require("../refresh-dedup-CLdACQXR.cjs");
+const require_parse_error_response = require("../parse-error-response-6qOQS5y9.cjs");
+const require_auth_handlers = require("../auth-handlers-CDzGFDTu.cjs");
+const require_constants$1 = require("../constants-BE1_9Tod.cjs");
+const require_delegated_token = require("../delegated-token-DHSK4rHI.cjs");
+let hono_factory = require("hono/factory");
+let hono = require("hono");
+let hono_request = require("hono/request");
+// src/hono/middleware.ts
+const client = require_http_client.createHttpClient();
+function evaAuth(opts = {}) {
+	if (opts.errorMessages !== void 0) require_parse_error_response.validateErrorMessagesInput(opts.errorMessages);
+	return (0, hono_factory.createMiddleware)(async (c, next) => {
+		const cookieHeader = c.req.header("cookie") || null;
+		const { accessToken, refreshToken } = require_cookies.readTokensFromCookies(cookieHeader);
+		if (accessToken) {
+			const result = await require_jwt.verifyAccessToken(accessToken, { extraClaimsSchema: opts.extraClaimsSchema });
+			if (result.ok) {
+				c.set("evaPayload", result.data);
+				await next();
+				return;
+			}
+		}
+		if (refreshToken) {
+			const refreshResult = await require_refresh_dedup.deduplicateRefresh(refreshToken, () => client.refresh({ refreshToken }));
+			if (refreshResult.ok && refreshResult.data.tokens) {
+				const verifyResult = await require_jwt.verifyAccessToken(refreshResult.data.tokens.accessToken, { extraClaimsSchema: opts.extraClaimsSchema });
+				if (verifyResult.ok) {
+					c.set("evaPayload", verifyResult.data);
+					const cookieHeaders = require_cookies.setTokenCookies(refreshResult.data.tokens);
+					for (const cookie of cookieHeaders) c.header("Set-Cookie", cookie, { append: true });
+					await next();
+					return;
+				}
+			}
+			const clearHeaders = require_cookies.clearTokenCookies();
+			for (const cookie of clearHeaders) c.header("Set-Cookie", cookie, { append: true });
+		}
+		const messages = require_parse_error_response.resolveErrorMessages(opts.errorMessages, require_parse_error_response.getErrorMessages());
+		if (require_parse_error_response.getErrorWire() === "api") return c.json({ error: {
+			code: "unauthorized",
+			message: messages.authRequired
+		} }, 401);
+		return c.json({ error: messages.authRequired }, 401);
+	});
+}
+// src/hono/auth-routes.ts
+function evaAuthRoutes(opts = {}) {
+	const app = new hono.Hono();
+	const h = require_auth_handlers.buildAuthHandlers(opts);
+	app.use("*", h.originGuard);
+	app.post("/get-code", h.getCode);
+	app.post("/login", h.login);
+	app.post("/refresh", h.refresh);
+	app.post("/logout", h.logout);
+	app.get("/me", h.getMe);
+	app.patch("/me", h.updateMe);
+	app.delete("/me", h.deleteMe);
+	app.get("/empresas", h.getEmpresas);
+	app.post("/empresa-activa", h.setActiveEmpresa);
+	app.get("/sessions", h.getSessions);
+	app.delete("/sessions/:id", h.deleteSession);
+	app.delete("/sessions", h.deleteAllSessions);
+	return app;
+}
+// src/hono/helpers.ts
+function getEvaPayload(c) {
+	const payload = c.get("evaPayload");
+	if (!payload) throw new Error("Middleware evaAuth no aplicado");
+	return payload;
+}
+function getSessionId(c) {
+	return getEvaPayload(c).sessionId;
+}
+// src/hono/s2s.ts
+/**
+* Hono middlewares for inbound S2S request authentication and scope-based authorization.
+*
+* REQ-HONO-AUTH-*, REQ-HONO-SCOPE-*, REQ-HONO-WIRE-*, REQ-API-02, REQ-API-03, REQ-API-05.
+*
+* Decisión in-flight B3-01: `cloneRawRequest` existe en Hono 4.12.19 bajo el entry point
+* `'hono/request'` (no `'hono/utils/request'` como estimaba el design). Se usa la ruta correcta
+* confirmada en node_modules/hono/package.json exports map: `"./request"` → `dist/request.js`.
+*/
+/**
+* Hono middleware that verifies inbound S2S requests signed with HMAC-SHA-256.
+*
+* On **success**: sets `c.var.s2sClientId` and `c.var.s2sScopes`, then calls `next()`.
+* On **failure**: responds with HTTP 401 `{ error: { code: <S2SVerifyReason>, message } }`.
+*
+* The middleware clones the request before reading the body (using Hono's `cloneRawRequest`),
+* so route handlers can still read the body after authentication — even if a prior middleware
+* already consumed the original stream.
+*
+* @see {@link requireScope} to enforce scope-based authorization after authentication.
+*
+* @example
+* ```ts
+* import { Hono } from 'hono'
+* import { s2sAuth, requireScope } from '@eva_solutions/auth-sdk/hono'
+*
+* const app = new Hono()
+*
+* app.use('/api/*', s2sAuth({
+*   secretStore: async (clientId) => redis.get(`s2s:${clientId}:secret`),
+*   scopesOf: async (clientId) => redis.smembers(`s2s:${clientId}:scopes`),
+*   onAuth: (clientId, scopes) => logger.info({ clientId, scopes }, 's2s authenticated'),
+* }))
+*
+* app.get('/api/resource', (c) => {
+*   const clientId = c.var.s2sClientId   // available after s2sAuth
+*   const scopes   = c.var.s2sScopes
+*   return c.json({ clientId, scopes })
+* })
+* ```
+*/
+function s2sAuth(opts) {
+	return (0, hono_factory.createMiddleware)(async (c, next) => {
+		const clonedRequest = await (0, hono_request.cloneRawRequest)(c.req);
+		const result = await require_delegated_token.verifyS2SRequest(clonedRequest, {
+			secretStore: opts.secretStore,
+			timestampWindowSeconds: opts.timestampWindowSeconds,
+			replayCache: opts.replayCache,
+			messages: opts.messages
+		});
+		if (!result.ok) return c.json({ error: {
+			code: result.error.reason,
+			message: result.error.message
+		} }, 401);
+		const scopes = opts.scopesOf ? await opts.scopesOf(result.data.clientId) : [];
+		c.set("s2sClientId", result.data.clientId);
+		c.set("s2sScopes", scopes);
+		if (opts.onAuth) await opts.onAuth(result.data.clientId, scopes);
+		await next();
+	});
+}
+function requireScope(arg) {
+	if (arg === null || arg === void 0) throw new TypeError("requireScope: scope argument required");
+	if (typeof arg === "object") {
+		const hasAll = "all" in arg && arg.all !== void 0;
+		const hasAny = "any" in arg && arg.any !== void 0;
+		if (hasAll && hasAny) throw new TypeError("requireScope: cannot use both 'all' and 'any'");
+		if (!hasAll && !hasAny) throw new TypeError("requireScope: must specify 'all' or 'any'");
+		if (hasAll && arg.all.length === 0) throw new TypeError("requireScope: 'all' cannot be empty");
+		if (hasAny && arg.any.length === 0) throw new TypeError("requireScope: 'any' cannot be empty");
+	}
+	return (0, hono_factory.createMiddleware)(async (c, next) => {
+		const vars = c.var.s2sScopes ?? c.var.serviceScopes;
+		if (vars === void 0) throw new Error("[eva-auth-sdk] requireScope: no auth middleware applied — apply s2sAuth() or serviceTokenAuth() before requireScope()");
+		if (typeof arg === "string") {
+			if (!vars.includes(arg)) return c.json({ error: {
+				code: "insufficient_scope",
+				required: arg
+			} }, 403);
+		} else if ("all" in arg && arg.all) {
+			const required = arg.all;
+			const missing = required.filter((s) => !vars.includes(s));
+			if (missing.length > 0) return c.json({ error: {
+				code: "insufficient_scope",
+				requiredAll: required,
+				missing
+			} }, 403);
+		} else if ("any" in arg && arg.any) {
+			const required = arg.any;
+			if (!required.some((s) => vars.includes(s))) return c.json({ error: {
+				code: "insufficient_scope",
+				requiredAny: required
+			} }, 403);
+		}
+		await next();
+	});
+}
+const BEARER_REGEX = /^Bearer ([A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)$/i;
+/**
+* Hono middleware that verifies the service token (ES256, `typ: 'svc-at+jwt'`, `kid` `svc-…`, `aud`
+* of this service, `scope`) sent as `Authorization: Bearer`. See `verifyServiceToken` for the
+* token contract.
+*
+* On **success**: sets `c.var.serviceClientId` (`sub`), `c.var.serviceClientSlug` (`client_id`) and
+* `c.var.serviceScopes`, then calls `next()`.
+* On **failure**: HTTP 401 `{ error: { code: <ServiceTokenVerifyReason>, message } }`, or HTTP 403
+* with code `insufficient_scope` when the token is valid but lacks the required scope.
+*
+* JWKS/config failures are not rejections: they propagate and Hono answers 500.
+*
+* With `scopeCheck: 'deferred'` the token is authenticated but no permission is required here; mount
+* `requireScope(...)` per route afterwards (it reads `serviceScopes` when `s2sScopes` is absent).
+*
+* @throws `TypeError` when the middleware is built with options that are not valid for the
+*   catalog (unknown audience, a permission of another audience, no permission rule).
+*
+* @example
+* ```ts
+* app.use(
+*   '/v1/internal/messages/*',
+*   serviceTokenAuth({ audience: 'whatsapp-api', requiredScope: 'messages:send:text' }),
+* )
+* ```
+*/
+function serviceTokenAuth(opts) {
+	require_delegated_token.assertServiceTokenOptions(opts);
+	return (0, hono_factory.createMiddleware)(async (c, next) => {
+		const bearer = c.req.header("authorization")?.match(BEARER_REGEX);
+		const result = bearer ? await require_delegated_token.verifyServiceToken(bearer[1], opts) : {
+			ok: false,
+			error: {
+				reason: "token_missing",
+				message: opts.messages?.token_missing ?? "Bearer token is missing"
+			}
+		};
+		if (!result.ok) {
+			if (result.error.reason === "scope_insufficient") return c.json({ error: {
+				code: "insufficient_scope",
+				message: result.error.message
+			} }, 403);
+			return c.json({ error: {
+				code: result.error.reason,
+				message: result.error.message
+			} }, 401);
+		}
+		c.set("serviceClientId", result.data.serviceClientId);
+		c.set("serviceClientSlug", result.data.serviceClientSlug);
+		c.set("serviceScopes", result.data.scopes);
+		await next();
+	});
+}
+/**
+* Hono middleware that verifies the delegated token (ES256, `typ: 'dlg-at+jwt'`, `kid` `svc-…`, one
+* `aud` = this service, never `auth-api`, mandatory `empresa`) sent as `Authorization: Bearer`. See
+* `verifyDelegatedToken` for the token contract. It accepts NOTHING else: a service token, a user
+* access token and a delegated token are three different types and each verifier takes only its own.
+*
+* On **success**: sets `c.var.userId`, `empresaId`, `producto`, `sessionId`, `actorChain` and
+* `scopes`, then calls `next()`.
+* On **failure**: HTTP 401 `{ error: { code: <reason>, message } }`, or HTTP 403 with code
+* `insufficient_scope` when the token is valid but lacks the required scope.
+*
+* With `scopeCheck: 'deferred'` no permission is required here; check `c.var.scopes` in the route.
+* (`requireScope` reads the scopes of `s2sAuth` / `serviceTokenAuth` and does not apply here.)
+*
+* The receiving service does not see the roles of the product: the product that acted is
+* responsible for having checked the permission of the person before asking for the token.
+*
+* @throws `TypeError` when the middleware is built with options that are not valid for the catalog.
+*
+* @example
+* ```ts
+* app.use(
+*   '/v1/stock/*',
+*   delegatedTokenAuth({ audience: 'whatsapp-api', requiredScope: 'messages:send:text' }),
+* )
+* ```
+*/
+function delegatedTokenAuth(opts) {
+	require_delegated_token.assertDelegatedTokenOptions(opts);
+	return (0, hono_factory.createMiddleware)(async (c, next) => {
+		const bearer = c.req.header("authorization")?.match(BEARER_REGEX);
+		const result = bearer ? await require_delegated_token.verifyDelegatedToken(bearer[1], opts) : {
+			ok: false,
+			error: {
+				reason: "token_missing",
+				message: opts.messages?.token_missing ?? "Bearer token is missing"
+			}
+		};
+		if (!result.ok) {
+			if (result.error.reason === "scope_insufficient") return c.json({ error: {
+				code: "insufficient_scope",
+				message: result.error.message
+			} }, 403);
+			return c.json({ error: {
+				code: result.error.reason,
+				message: result.error.message
+			} }, 401);
+		}
+		c.set("userId", result.data.userId);
+		c.set("empresaId", result.data.empresaId);
+		c.set("producto", result.data.producto);
+		c.set("sessionId", result.data.sessionId);
+		c.set("actorChain", result.data.actorChain);
+		c.set("scopes", result.data.scopes);
+		await next();
+	});
+}
+exports.COOKIE_MAX_AGE = require_constants$1.COOKIE_MAX_AGE;
+exports.DEFAULT_ERROR_MESSAGES = require_parse_error_response.DEFAULT_ERROR_MESSAGES;
+exports.HEADERS = require_constants.HEADERS;
+exports.clearTokenCookies = require_cookies.clearTokenCookies;
+exports.configureEvaAuth = require_parse_error_response.configureEvaAuth;
+exports.delegatedTokenAuth = delegatedTokenAuth;
+exports.evaAuth = evaAuth;
+exports.evaAuthRoutes = evaAuthRoutes;
+exports.getAuthUrl = require_parse_error_response.getAuthUrl;
+exports.getCookieDomain = require_parse_error_response.getCookieDomain;
+exports.getCookieNames = require_constants$1.getCookieNames;
+exports.getEvaPayload = getEvaPayload;
+exports.getSessionId = getSessionId;
+exports.parseDeviceInfo = require_auth_handlers.parseDeviceInfo;
+exports.readTokensFromCookies = require_cookies.readTokensFromCookies;
+exports.requireScope = requireScope;
+exports.s2sAuth = s2sAuth;
+exports.serviceTokenAuth = serviceTokenAuth;
+exports.setTokenCookies = require_cookies.setTokenCookies;
+
+//# sourceMappingURL=index.cjs.map

package/dist/hono/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":["createHttpClient","createMiddleware","readTokensFromCookies","verifyAccessToken","deduplicateRefresh","setTokenCookies","clearTokenCookies","resolveErrorMessages","getErrorMessages","getErrorWire","Hono","buildAuthHandlers","createMiddleware","cloneRawRequest","verifyS2SRequest","verifyServiceToken","verifyDelegatedToken"],"sources":["../../src/hono/middleware.ts","../../src/hono/auth-routes.ts","../../src/hono/helpers.ts","../../src/hono/s2s.ts"],"sourcesContent":["import { createMiddleware } from 'hono/factory'\nimport type { ZodType } from 'zod'\nimport { verifyAccessToken } from '../jwt'\nimport {\n  readTokensFromCookies,\n  setTokenCookies,\n  clearTokenCookies,\n} from '../cookies'\nimport { createHttpClient } from '../http-client'\nimport { deduplicateRefresh } from '../refresh-dedup'\nimport type { EvaTokenPayload } from '../types'\nimport { resolveErrorMessages, type EvaErrorMessages } from '../error-messages'\nimport {\n  getErrorMessages,\n  getErrorWire,\n  validateErrorMessagesInput,\n} from '../config'\n\nconst client = createHttpClient()\n\nexport type EvaAuthOptions<TExtra extends Record<string, unknown>> = {\n  extraClaimsSchema?: ZodType<TExtra>\n  errorMessages?: Partial<EvaErrorMessages>\n}\n\nexport type EvaAuthVariables<TExtra extends Record<string, unknown>> = {\n  evaPayload: EvaTokenPayload<TExtra>\n}\n\nexport function evaAuth<TExtra extends Record<string, unknown> = {}>(\n  opts: EvaAuthOptions<TExtra> = {},\n) {\n  if (opts.errorMessages !== undefined) {\n    validateErrorMessagesInput(opts.errorMessages)\n  }\n  return createMiddleware<{ Variables: EvaAuthVariables<TExtra> }>(\n    async (c, next) => {\n      const cookieHeader = c.req.header('cookie') || null\n      const { accessToken, refreshToken } = readTokensFromCookies(cookieHeader)\n\n      if (accessToken) {\n        const result = await verifyAccessToken<TExtra>(accessToken, {\n          extraClaimsSchema: opts.extraClaimsSchema,\n        })\n        if (result.ok) {\n          c.set('evaPayload', result.data)\n          await next()\n          return\n        }\n      }\n\n      if (refreshToken) {\n        const refreshResult = await deduplicateRefresh(refreshToken, () =>\n          client.refresh({ refreshToken }),\n        )\n        if (refreshResult.ok && refreshResult.data.tokens) {\n          const verifyResult = await verifyAccessToken<TExtra>(\n            refreshResult.data.tokens.accessToken,\n            {\n              extraClaimsSchema: opts.extraClaimsSchema,\n            },\n          )\n          if (verifyResult.ok) {\n            c.set('evaPayload', verifyResult.data)\n            const cookieHeaders = setTokenCookies(refreshResult.data.tokens)\n            for (const cookie of cookieHeaders) {\n              c.header('Set-Cookie', cookie, { append: true })\n            }\n            await next()\n            return\n          }\n        }\n        const clearHeaders = clearTokenCookies()\n        for (const cookie of clearHeaders) {\n          c.header('Set-Cookie', cookie, { append: true })\n        }\n      }\n\n      const messages = resolveErrorMessages(\n        opts.errorMessages,\n        getErrorMessages(),\n      )\n      const wire = getErrorWire()\n      if (wire === 'api') {\n        return c.json(\n          { error: { code: 'unauthorized', message: messages.authRequired } },\n          401,\n        )\n      }\n      return c.json({ error: messages.authRequired }, 401)\n    },\n  )\n}\n","import { Hono } from 'hono'\nimport { buildAuthHandlers, type AuthHandlerOptions } from '../auth-handlers'\n\nexport type EvaAuthRoutesOptions = AuthHandlerOptions\n\nexport function evaAuthRoutes(opts: EvaAuthRoutesOptions = {}): Hono {\n  const app = new Hono()\n  const h = buildAuthHandlers(opts)\n\n  app.use('*', h.originGuard)\n\n  app.post('/get-code', h.getCode)\n  app.post('/login', h.login)\n  app.post('/refresh', h.refresh)\n  app.post('/logout', h.logout)\n  app.get('/me', h.getMe)\n  app.patch('/me', h.updateMe)\n  app.delete('/me', h.deleteMe)\n  app.get('/empresas', h.getEmpresas)\n  app.post('/empresa-activa', h.setActiveEmpresa)\n  app.get('/sessions', h.getSessions)\n  app.delete('/sessions/:id', h.deleteSession)\n  app.delete('/sessions', h.deleteAllSessions)\n\n  return app\n}\n","import type { Context } from 'hono'\nimport type { EvaTokenPayload } from '../types'\nimport type { EvaAuthVariables } from './middleware'\n\nexport function getEvaPayload<TExtra extends Record<string, unknown> = {}>(\n  c: Context<{ Variables: EvaAuthVariables<TExtra> }>,\n): EvaTokenPayload<TExtra> {\n  const payload = c.get('evaPayload')\n  if (!payload) throw new Error('Middleware evaAuth no aplicado')\n  return payload\n}\n\nexport function getSessionId<TExtra extends Record<string, unknown> = {}>(\n  c: Context<{ Variables: EvaAuthVariables<TExtra> }>,\n): string {\n  return getEvaPayload(c).sessionId\n}\n","/**\n * Hono middlewares for inbound S2S request authentication and scope-based authorization.\n *\n * REQ-HONO-AUTH-*, REQ-HONO-SCOPE-*, REQ-HONO-WIRE-*, REQ-API-02, REQ-API-03, REQ-API-05.\n *\n * Decisión in-flight B3-01: `cloneRawRequest` existe en Hono 4.12.19 bajo el entry point\n * `'hono/request'` (no `'hono/utils/request'` como estimaba el design). Se usa la ruta correcta\n * confirmada en node_modules/hono/package.json exports map: `\"./request\"` → `dist/request.js`.\n */\n\nimport { createMiddleware } from 'hono/factory'\nimport { cloneRawRequest } from 'hono/request'\nimport { verifyS2SRequest } from '../s2s/verify'\nimport {\n  assertServiceTokenOptions,\n  verifyServiceToken,\n} from '../s2s/service-token'\nimport type { ServiceTokenVerifyOptions } from '../s2s/service-token'\nimport {\n  assertDelegatedTokenOptions,\n  verifyDelegatedToken,\n} from '../s2s/delegated-token'\nimport type {\n  DelegatedActor,\n  DelegatedTokenVerifyOptions,\n} from '../s2s/delegated-token'\nimport type { S2SVerifyOptions } from '../s2s/types'\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\n/**\n * Options for the `s2sAuth` Hono middleware.\n * Extends `S2SVerifyOptions` (omits `request` — the middleware provides it internally).\n */\nexport type S2sAuthOptions = {\n  /**\n   * Callback that returns the plaintext secret (64 hex chars) for the given clientId,\n   * or null if unknown. Return null — do NOT throw — for unknown clients.\n   * D5 LOCKED: SDK does not assume any storage layer.\n   */\n  secretStore: S2SVerifyOptions['secretStore']\n  /**\n   * Optional callback that returns the scope list for the verified clientId.\n   * If omitted, `c.var.s2sScopes` will be an empty array.\n   */\n  scopesOf?: (clientId: string) => Promise<readonly string[]>\n  /**\n   * Optional hook called after successful authentication and scope lookup, before `next()`.\n   * Useful for audit logging, nonce tracking, or metrics.\n   *\n   * @throws If this hook throws, the middleware propagates the error and Hono returns HTTP 500.\n   *   Catch errors inside the hook if you want different behavior.\n   *\n   * @example\n   * ```ts\n   * onAuth: (clientId, scopes) => logger.info({ clientId, scopes }, 's2s authenticated'),\n   * ```\n   */\n  onAuth?: (clientId: string, scopes: readonly string[]) => void | Promise<void>\n  /**\n   * Override timestamp validation window in seconds.\n   * Default: `S2S_TIMESTAMP_WINDOW_SECONDS` (120).\n   */\n  timestampWindowSeconds?: number\n  /**\n   * Optional replay-protection cache. If provided, each verified request's key\n   * (`${clientId}:${nonce}`) is atomically inserted with a TTL of\n   * `2 * timestampWindowSeconds + 1`; if already present the request is rejected with `replay_detected`.\n   *\n   * @since v1.1.0\n   * @see verifyS2SRequest for the full `setIfAbsent` contract and nonce format.\n   */\n  replayCache?: S2SVerifyOptions['replayCache']\n  /**\n   * Optional message overrides for error reasons (i18n / custom wording).\n   * Any key not overridden falls back to the built-in English default.\n   *\n   * @since v1.1.0\n   * @see verifyS2SRequest for the full `messages` contract and default strings.\n   */\n  messages?: S2SVerifyOptions['messages']\n}\n\n/**\n * Hono context variables set by `s2sAuth`.\n * Declare in your app type for full type inference:\n * ```ts\n * const app = new Hono<{ Variables: S2sAuthVariables }>()\n * ```\n */\nexport type S2sAuthVariables = {\n  s2sClientId: string\n  s2sScopes: readonly string[]\n}\n\n// ---------------------------------------------------------------------------\n// Middlewares\n// ---------------------------------------------------------------------------\n\n/**\n * Hono middleware that verifies inbound S2S requests signed with HMAC-SHA-256.\n *\n * On **success**: sets `c.var.s2sClientId` and `c.var.s2sScopes`, then calls `next()`.\n * On **failure**: responds with HTTP 401 `{ error: { code: <S2SVerifyReason>, message } }`.\n *\n * The middleware clones the request before reading the body (using Hono's `cloneRawRequest`),\n * so route handlers can still read the body after authentication — even if a prior middleware\n * already consumed the original stream.\n *\n * @see {@link requireScope} to enforce scope-based authorization after authentication.\n *\n * @example\n * ```ts\n * import { Hono } from 'hono'\n * import { s2sAuth, requireScope } from '@eva_solutions/auth-sdk/hono'\n *\n * const app = new Hono()\n *\n * app.use('/api/*', s2sAuth({\n *   secretStore: async (clientId) => redis.get(`s2s:${clientId}:secret`),\n *   scopesOf: async (clientId) => redis.smembers(`s2s:${clientId}:scopes`),\n *   onAuth: (clientId, scopes) => logger.info({ clientId, scopes }, 's2s authenticated'),\n * }))\n *\n * app.get('/api/resource', (c) => {\n *   const clientId = c.var.s2sClientId   // available after s2sAuth\n *   const scopes   = c.var.s2sScopes\n *   return c.json({ clientId, scopes })\n * })\n * ```\n */\nexport function s2sAuth(\n  opts: S2sAuthOptions,\n): ReturnType<typeof createMiddleware<{ Variables: S2sAuthVariables }>> {\n  return createMiddleware<{ Variables: S2sAuthVariables }>(async (c, next) => {\n    // Clone the request so route handlers can still read the body.\n    // cloneRawRequest (Hono 4.12.19) handles the case where a prior middleware\n    // already consumed the original ReadableStream by using HonoRequest's body cache.\n    const clonedRequest = await cloneRawRequest(c.req)\n\n    const result = await verifyS2SRequest(clonedRequest, {\n      secretStore: opts.secretStore,\n      timestampWindowSeconds: opts.timestampWindowSeconds,\n      replayCache: opts.replayCache,\n      messages: opts.messages,\n    })\n\n    if (!result.ok) {\n      return c.json(\n        { error: { code: result.error.reason, message: result.error.message } },\n        401,\n      )\n    }\n\n    const scopes: readonly string[] = opts.scopesOf\n      ? await opts.scopesOf(result.data.clientId)\n      : []\n\n    c.set('s2sClientId', result.data.clientId)\n    c.set('s2sScopes', scopes)\n\n    if (opts.onAuth) {\n      await opts.onAuth(result.data.clientId, scopes)\n    }\n\n    await next()\n  })\n}\n\n/**\n * Hono middleware that requires a specific scope to be present in `c.var.s2sScopes`.\n *\n * Must be applied **after** `s2sAuth`. If `s2sAuth` was not applied, this middleware\n * throws a descriptive `Error` (programming error, results in HTTP 500).\n *\n * On **success** (scope present): calls `next()`.\n * On **failure** (scope absent): returns HTTP 403 with `{ error: { code: 'insufficient_scope', ... } }`.\n *\n * @throws `TypeError` at setup-time if the argument is invalid (empty object, empty array,\n *   or both `all` and `any` specified simultaneously).\n * @throws `Error` at runtime if `s2sAuth` was not applied before this middleware.\n *\n * @example\n * ```ts\n * // Single scope (legacy — unchanged)\n * app.use('/admin/*', s2sAuth({ secretStore }), requireScope('admin'))\n *\n * // AND semantics — all scopes must be present\n * app.use('/admin/*', s2sAuth({ secretStore }), requireScope({ all: ['admin', 'audit'] }))\n *\n * // OR semantics — at least one scope must be present\n * app.use('/data/*', s2sAuth({ secretStore }), requireScope({ any: ['data:read', 'data:write'] }))\n * ```\n */\nexport function requireScope(\n  scope: string,\n): ReturnType<typeof createMiddleware<{ Variables: S2sAuthVariables }>>\n/**\n * Hono middleware that requires **all** listed scopes to be present (AND semantics).\n *\n * On failure returns HTTP 403 with `{ error: { code: 'insufficient_scope', requiredAll, missing } }`.\n *\n * @since v1.1.0\n * @throws `TypeError` at setup-time if `all` is an empty array.\n */\nexport function requireScope(spec: {\n  all: readonly string[]\n}): ReturnType<typeof createMiddleware<{ Variables: S2sAuthVariables }>>\n/**\n * Hono middleware that requires **at least one** of the listed scopes to be present (OR semantics).\n *\n * On failure returns HTTP 403 with `{ error: { code: 'insufficient_scope', requiredAny } }`.\n *\n * @since v1.1.0\n * @throws `TypeError` at setup-time if `any` is an empty array.\n */\nexport function requireScope(spec: {\n  any: readonly string[]\n}): ReturnType<typeof createMiddleware<{ Variables: S2sAuthVariables }>>\nexport function requireScope(\n  arg: string | { all?: readonly string[]; any?: readonly string[] },\n): ReturnType<typeof createMiddleware<{ Variables: S2sAuthVariables }>> {\n  // Setup-time guards (D23)\n  if (arg === null || arg === undefined) {\n    throw new TypeError('requireScope: scope argument required')\n  }\n  if (typeof arg === 'object') {\n    const hasAll = 'all' in arg && arg.all !== undefined\n    const hasAny = 'any' in arg && arg.any !== undefined\n    if (hasAll && hasAny) {\n      throw new TypeError(\"requireScope: cannot use both 'all' and 'any'\")\n    }\n    if (!hasAll && !hasAny) {\n      throw new TypeError(\"requireScope: must specify 'all' or 'any'\")\n    }\n    if (hasAll && arg.all!.length === 0) {\n      throw new TypeError(\"requireScope: 'all' cannot be empty\")\n    }\n    if (hasAny && arg.any!.length === 0) {\n      throw new TypeError(\"requireScope: 'any' cannot be empty\")\n    }\n  }\n\n  return createMiddleware<{ Variables: S2sAuthVariables }>(async (c, next) => {\n    // Tras `s2sAuth` (HMAC) vive en `s2sScopes`; tras `serviceTokenAuth` (Bearer), en `serviceScopes`.\n    const vars =\n      c.var.s2sScopes ??\n      (c.var as unknown as { serviceScopes?: readonly string[] }).serviceScopes\n\n    if (vars === undefined) {\n      throw new Error(\n        '[eva-auth-sdk] requireScope: no auth middleware applied — apply s2sAuth() or serviceTokenAuth() before requireScope()',\n      )\n    }\n\n    if (typeof arg === 'string') {\n      // Single scope — legacy wire format preserved (S-LEGACY-01)\n      if (!vars.includes(arg)) {\n        return c.json(\n          { error: { code: 'insufficient_scope', required: arg } },\n          403,\n        )\n      }\n    } else if ('all' in arg && arg.all) {\n      // AND semantics\n      const required = arg.all\n      const missing = required.filter((s) => !vars.includes(s))\n      if (missing.length > 0) {\n        return c.json(\n          {\n            error: {\n              code: 'insufficient_scope',\n              requiredAll: required,\n              missing,\n            },\n          },\n          403,\n        )\n      }\n    } else if ('any' in arg && arg.any) {\n      // OR semantics\n      const required = arg.any\n      const hasAnyScope = required.some((s) => vars.includes(s))\n      if (!hasAnyScope) {\n        return c.json(\n          { error: { code: 'insufficient_scope', requiredAny: required } },\n          403,\n        )\n      }\n    }\n\n    await next()\n  })\n}\n\n// ---------------------------------------------------------------------------\n// Token de servicio (Bearer de otro servicio, o del propio Auth en el OTP)\n// ---------------------------------------------------------------------------\n\n/** Options for `serviceTokenAuth`: those of `verifyServiceToken` (the middleware provides the token). */\nexport type ServiceTokenAuthOptions = ServiceTokenVerifyOptions\n\n/**\n * Hono context variables set by `serviceTokenAuth`.\n */\nexport type ServiceTokenAuthVariables = {\n  /** `sub` del token: id interno estable del service client. Es la identidad. */\n  serviceClientId: string\n  /** `client_id` del token: slug del service client. Dato visible, no identidad. */\n  serviceClientSlug: string\n  serviceScopes: readonly string[]\n}\n\n// El esquema se compara sin distinguir mayúsculas (RFC 9110 §11.1: `bearer` también es válido).\nconst BEARER_REGEX =\n  /^Bearer ([A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+)$/i\n\n/**\n * Hono middleware that verifies the service token (ES256, `typ: 'svc-at+jwt'`, `kid` `svc-…`, `aud`\n * of this service, `scope`) sent as `Authorization: Bearer`. See `verifyServiceToken` for the\n * token contract.\n *\n * On **success**: sets `c.var.serviceClientId` (`sub`), `c.var.serviceClientSlug` (`client_id`) and\n * `c.var.serviceScopes`, then calls `next()`.\n * On **failure**: HTTP 401 `{ error: { code: <ServiceTokenVerifyReason>, message } }`, or HTTP 403\n * with code `insufficient_scope` when the token is valid but lacks the required scope.\n *\n * JWKS/config failures are not rejections: they propagate and Hono answers 500.\n *\n * With `scopeCheck: 'deferred'` the token is authenticated but no permission is required here; mount\n * `requireScope(...)` per route afterwards (it reads `serviceScopes` when `s2sScopes` is absent).\n *\n * @throws `TypeError` when the middleware is built with options that are not valid for the\n *   catalog (unknown audience, a permission of another audience, no permission rule).\n *\n * @example\n * ```ts\n * app.use(\n *   '/v1/internal/messages/*',\n *   serviceTokenAuth({ audience: 'whatsapp-api', requiredScope: 'messages:send:text' }),\n * )\n * ```\n */\nexport function serviceTokenAuth(\n  opts: ServiceTokenAuthOptions,\n): ReturnType<\n  typeof createMiddleware<{ Variables: ServiceTokenAuthVariables }>\n> {\n  // Las opciones se validan al construir el middleware (falla al arrancar), no en cada request.\n  assertServiceTokenOptions(opts)\n  return createMiddleware<{ Variables: ServiceTokenAuthVariables }>(\n    async (c, next) => {\n      const bearer = c.req.header('authorization')?.match(BEARER_REGEX)\n      const result = bearer\n        ? await verifyServiceToken(bearer[1] as string, opts)\n        : ({\n            ok: false,\n            error: {\n              reason: 'token_missing',\n              message:\n                opts.messages?.token_missing ?? 'Bearer token is missing',\n            },\n          } as const)\n\n      if (!result.ok) {\n        if (result.error.reason === 'scope_insufficient') {\n          return c.json(\n            {\n              error: {\n                code: 'insufficient_scope',\n                message: result.error.message,\n              },\n            },\n            403,\n          )\n        }\n        return c.json(\n          {\n            error: { code: result.error.reason, message: result.error.message },\n          },\n          401,\n        )\n      }\n\n      c.set('serviceClientId', result.data.serviceClientId)\n      c.set('serviceClientSlug', result.data.serviceClientSlug)\n      c.set('serviceScopes', result.data.scopes)\n      await next()\n    },\n  )\n}\n\n// ---------------------------------------------------------------------------\n// Token delegado (otro servicio actuando en nombre de un usuario)\n// ---------------------------------------------------------------------------\n\n/** Options for `delegatedTokenAuth`: those of `verifyDelegatedToken` (the middleware provides the token). */\nexport type DelegatedTokenAuthOptions = DelegatedTokenVerifyOptions\n\n/**\n * Hono context variables set by `delegatedTokenAuth`.\n */\nexport type DelegatedTokenAuthVariables = {\n  /** `sub` del token: el usuario en cuyo nombre se actúa. */\n  userId: string\n  /** `empresa`: obligatoria en toda la cadena. */\n  empresaId: string\n  /** `producto` de origen de la cadena. */\n  producto: string\n  /** `sid`: sesión de origen. */\n  sessionId: string\n  /** Cadena de actores, del último (quien llama a este servicio) al primero. */\n  actorChain: readonly DelegatedActor[]\n  /** Permisos del token. */\n  scopes: readonly string[]\n}\n\n/**\n * Hono middleware that verifies the delegated token (ES256, `typ: 'dlg-at+jwt'`, `kid` `svc-…`, one\n * `aud` = this service, never `auth-api`, mandatory `empresa`) sent as `Authorization: Bearer`. See\n * `verifyDelegatedToken` for the token contract. It accepts NOTHING else: a service token, a user\n * access token and a delegated token are three different types and each verifier takes only its own.\n *\n * On **success**: sets `c.var.userId`, `empresaId`, `producto`, `sessionId`, `actorChain` and\n * `scopes`, then calls `next()`.\n * On **failure**: HTTP 401 `{ error: { code: <reason>, message } }`, or HTTP 403 with code\n * `insufficient_scope` when the token is valid but lacks the required scope.\n *\n * With `scopeCheck: 'deferred'` no permission is required here; check `c.var.scopes` in the route.\n * (`requireScope` reads the scopes of `s2sAuth` / `serviceTokenAuth` and does not apply here.)\n *\n * The receiving service does not see the roles of the product: the product that acted is\n * responsible for having checked the permission of the person before asking for the token.\n *\n * @throws `TypeError` when the middleware is built with options that are not valid for the catalog.\n *\n * @example\n * ```ts\n * app.use(\n *   '/v1/stock/*',\n *   delegatedTokenAuth({ audience: 'whatsapp-api', requiredScope: 'messages:send:text' }),\n * )\n * ```\n */\nexport function delegatedTokenAuth(\n  opts: DelegatedTokenAuthOptions,\n): ReturnType<\n  typeof createMiddleware<{ Variables: DelegatedTokenAuthVariables }>\n> {\n  assertDelegatedTokenOptions(opts)\n  return createMiddleware<{ Variables: DelegatedTokenAuthVariables }>(\n    async (c, next) => {\n      const bearer = c.req.header('authorization')?.match(BEARER_REGEX)\n      const result = bearer\n        ? await verifyDelegatedToken(bearer[1] as string, opts)\n        : ({\n            ok: false,\n            error: {\n              reason: 'token_missing',\n              message:\n                opts.messages?.token_missing ?? 'Bearer token is missing',\n            },\n          } as const)\n\n      if (!result.ok) {\n        if (result.error.reason === 'scope_insufficient') {\n          return c.json(\n            {\n              error: {\n                code: 'insufficient_scope',\n                message: result.error.message,\n              },\n            },\n            403,\n          )\n        }\n        return c.json(\n          {\n            error: { code: result.error.reason, message: result.error.message },\n          },\n          401,\n        )\n      }\n\n      c.set('userId', result.data.userId)\n      c.set('empresaId', result.data.empresaId)\n      c.set('producto', result.data.producto)\n      c.set('sessionId', result.data.sessionId)\n      c.set('actorChain', result.data.actorChain)\n      c.set('scopes', result.data.scopes)\n      await next()\n    },\n  )\n}\n"],"mappings":";;;;;;;;;;;;;;AAkBA,MAAM,SAASA,oBAAAA,iBAAiB;AAWhC,SAAgB,QACd,OAA+B,CAAC,GAChC;CACA,IAAI,KAAK,kBAAkB,KAAA,GACzB,6BAAA,2BAA2B,KAAK,aAAa;CAE/C,QAAA,GAAOC,aAAAA,iBAAAA,CACL,OAAO,GAAG,SAAS;EACjB,MAAM,eAAe,EAAE,IAAI,OAAO,QAAQ,KAAK;EAC/C,MAAM,EAAE,aAAa,iBAAiBC,gBAAAA,sBAAsB,YAAY;EAExE,IAAI,aAAa;GACf,MAAM,SAAS,MAAMC,YAAAA,kBAA0B,aAAa,EAC1D,mBAAmB,KAAK,kBAC1B,CAAC;GACD,IAAI,OAAO,IAAI;IACb,EAAE,IAAI,cAAc,OAAO,IAAI;IAC/B,MAAM,KAAK;IACX;GACF;EACF;EAEA,IAAI,cAAc;GAChB,MAAM,gBAAgB,MAAMC,sBAAAA,mBAAmB,oBAC7C,OAAO,QAAQ,EAAE,aAAa,CAAC,CACjC;GACA,IAAI,cAAc,MAAM,cAAc,KAAK,QAAQ;IACjD,MAAM,eAAe,MAAMD,YAAAA,kBACzB,cAAc,KAAK,OAAO,aAC1B,EACE,mBAAmB,KAAK,kBAC1B,CACF;IACA,IAAI,aAAa,IAAI;KACnB,EAAE,IAAI,cAAc,aAAa,IAAI;KACrC,MAAM,gBAAgBE,gBAAAA,gBAAgB,cAAc,KAAK,MAAM;KAC/D,KAAK,MAAM,UAAU,eACnB,EAAE,OAAO,cAAc,QAAQ,EAAE,QAAQ,KAAK,CAAC;KAEjD,MAAM,KAAK;KACX;IACF;GACF;GACA,MAAM,eAAeC,gBAAAA,kBAAkB;GACvC,KAAK,MAAM,UAAU,cACnB,EAAE,OAAO,cAAc,QAAQ,EAAE,QAAQ,KAAK,CAAC;EAEnD;EAEA,MAAM,WAAWC,6BAAAA,qBACf,KAAK,eACLC,6BAAAA,iBAAiB,CACnB;EAEA,IADaC,6BAAAA,aACN,MAAM,OACX,OAAO,EAAE,KACP,EAAE,OAAO;GAAE,MAAM;GAAgB,SAAS,SAAS;EAAa,EAAE,GAClE,GACF;EAEF,OAAO,EAAE,KAAK,EAAE,OAAO,SAAS,aAAa,GAAG,GAAG;CACrD,CACF;AACF;;ACvFA,SAAgB,cAAc,OAA6B,CAAC,GAAS;CACnE,MAAM,MAAM,IAAIC,KAAAA,KAAK;CACrB,MAAM,IAAIC,sBAAAA,kBAAkB,IAAI;CAEhC,IAAI,IAAI,KAAK,EAAE,WAAW;CAE1B,IAAI,KAAK,aAAa,EAAE,OAAO;CAC/B,IAAI,KAAK,UAAU,EAAE,KAAK;CAC1B,IAAI,KAAK,YAAY,EAAE,OAAO;CAC9B,IAAI,KAAK,WAAW,EAAE,MAAM;CAC5B,IAAI,IAAI,OAAO,EAAE,KAAK;CACtB,IAAI,MAAM,OAAO,EAAE,QAAQ;CAC3B,IAAI,OAAO,OAAO,EAAE,QAAQ;CAC5B,IAAI,IAAI,aAAa,EAAE,WAAW;CAClC,IAAI,KAAK,mBAAmB,EAAE,gBAAgB;CAC9C,IAAI,IAAI,aAAa,EAAE,WAAW;CAClC,IAAI,OAAO,iBAAiB,EAAE,aAAa;CAC3C,IAAI,OAAO,aAAa,EAAE,iBAAiB;CAE3C,OAAO;AACT;;ACrBA,SAAgB,cACd,GACyB;CACzB,MAAM,UAAU,EAAE,IAAI,YAAY;CAClC,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,gCAAgC;CAC9D,OAAO;AACT;AAEA,SAAgB,aACd,GACQ;CACR,OAAO,cAAc,CAAC,CAAC,CAAC;AAC1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACqHA,SAAgB,QACd,MACsE;CACtE,QAAA,GAAOC,aAAAA,iBAAAA,CAAkD,OAAO,GAAG,SAAS;EAI1E,MAAM,gBAAgB,OAAA,GAAMC,aAAAA,gBAAAA,CAAgB,EAAE,GAAG;EAEjD,MAAM,SAAS,MAAMC,wBAAAA,iBAAiB,eAAe;GACnD,aAAa,KAAK;GAClB,wBAAwB,KAAK;GAC7B,aAAa,KAAK;GAClB,UAAU,KAAK;EACjB,CAAC;EAED,IAAI,CAAC,OAAO,IACV,OAAO,EAAE,KACP,EAAE,OAAO;GAAE,MAAM,OAAO,MAAM;GAAQ,SAAS,OAAO,MAAM;EAAQ,EAAE,GACtE,GACF;EAGF,MAAM,SAA4B,KAAK,WACnC,MAAM,KAAK,SAAS,OAAO,KAAK,QAAQ,IACxC,CAAC;EAEL,EAAE,IAAI,eAAe,OAAO,KAAK,QAAQ;EACzC,EAAE,IAAI,aAAa,MAAM;EAEzB,IAAI,KAAK,QACP,MAAM,KAAK,OAAO,OAAO,KAAK,UAAU,MAAM;EAGhD,MAAM,KAAK;CACb,CAAC;AACH;AAoDA,SAAgB,aACd,KACsE;CAEtE,IAAI,QAAQ,QAAQ,QAAQ,KAAA,GAC1B,MAAM,IAAI,UAAU,uCAAuC;CAE7D,IAAI,OAAO,QAAQ,UAAU;EAC3B,MAAM,SAAS,SAAS,OAAO,IAAI,QAAQ,KAAA;EAC3C,MAAM,SAAS,SAAS,OAAO,IAAI,QAAQ,KAAA;EAC3C,IAAI,UAAU,QACZ,MAAM,IAAI,UAAU,+CAA+C;EAErE,IAAI,CAAC,UAAU,CAAC,QACd,MAAM,IAAI,UAAU,2CAA2C;EAEjE,IAAI,UAAU,IAAI,IAAK,WAAW,GAChC,MAAM,IAAI,UAAU,qCAAqC;EAE3D,IAAI,UAAU,IAAI,IAAK,WAAW,GAChC,MAAM,IAAI,UAAU,qCAAqC;CAE7D;CAEA,QAAA,GAAOF,aAAAA,iBAAAA,CAAkD,OAAO,GAAG,SAAS;EAE1E,MAAM,OACJ,EAAE,IAAI,aACL,EAAE,IAAyD;EAE9D,IAAI,SAAS,KAAA,GACX,MAAM,IAAI,MACR,uHACF;EAGF,IAAI,OAAO,QAAQ,UAEb;OAAA,CAAC,KAAK,SAAS,GAAG,GACpB,OAAO,EAAE,KACP,EAAE,OAAO;IAAE,MAAM;IAAsB,UAAU;GAAI,EAAE,GACvD,GACF;EAAA,OAEG,IAAI,SAAS,OAAO,IAAI,KAAK;GAElC,MAAM,WAAW,IAAI;GACrB,MAAM,UAAU,SAAS,QAAQ,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC;GACxD,IAAI,QAAQ,SAAS,GACnB,OAAO,EAAE,KACP,EACE,OAAO;IACL,MAAM;IACN,aAAa;IACb;GACF,EACF,GACA,GACF;EAEJ,OAAO,IAAI,SAAS,OAAO,IAAI,KAAK;GAElC,MAAM,WAAW,IAAI;GAErB,IAAI,CADgB,SAAS,MAAM,MAAM,KAAK,SAAS,CAAC,CACzC,GACb,OAAO,EAAE,KACP,EAAE,OAAO;IAAE,MAAM;IAAsB,aAAa;GAAS,EAAE,GAC/D,GACF;EAEJ;EAEA,MAAM,KAAK;CACb,CAAC;AACH;AAqBA,MAAM,eACJ;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BF,SAAgB,iBACd,MAGA;CAEA,wBAAA,0BAA0B,IAAI;CAC9B,QAAA,GAAOA,aAAAA,iBAAAA,CACL,OAAO,GAAG,SAAS;EACjB,MAAM,SAAS,EAAE,IAAI,OAAO,eAAe,CAAC,EAAE,MAAM,YAAY;EAChE,MAAM,SAAS,SACX,MAAMG,wBAAAA,mBAAmB,OAAO,IAAc,IAAI,IACjD;GACC,IAAI;GACJ,OAAO;IACL,QAAQ;IACR,SACE,KAAK,UAAU,iBAAiB;GACpC;EACF;EAEJ,IAAI,CAAC,OAAO,IAAI;GACd,IAAI,OAAO,MAAM,WAAW,sBAC1B,OAAO,EAAE,KACP,EACE,OAAO;IACL,MAAM;IACN,SAAS,OAAO,MAAM;GACxB,EACF,GACA,GACF;GAEF,OAAO,EAAE,KACP,EACE,OAAO;IAAE,MAAM,OAAO,MAAM;IAAQ,SAAS,OAAO,MAAM;GAAQ,EACpE,GACA,GACF;EACF;EAEA,EAAE,IAAI,mBAAmB,OAAO,KAAK,eAAe;EACpD,EAAE,IAAI,qBAAqB,OAAO,KAAK,iBAAiB;EACxD,EAAE,IAAI,iBAAiB,OAAO,KAAK,MAAM;EACzC,MAAM,KAAK;CACb,CACF;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDA,SAAgB,mBACd,MAGA;CACA,wBAAA,4BAA4B,IAAI;CAChC,QAAA,GAAOH,aAAAA,iBAAAA,CACL,OAAO,GAAG,SAAS;EACjB,MAAM,SAAS,EAAE,IAAI,OAAO,eAAe,CAAC,EAAE,MAAM,YAAY;EAChE,MAAM,SAAS,SACX,MAAMI,wBAAAA,qBAAqB,OAAO,IAAc,IAAI,IACnD;GACC,IAAI;GACJ,OAAO;IACL,QAAQ;IACR,SACE,KAAK,UAAU,iBAAiB;GACpC;EACF;EAEJ,IAAI,CAAC,OAAO,IAAI;GACd,IAAI,OAAO,MAAM,WAAW,sBAC1B,OAAO,EAAE,KACP,EACE,OAAO;IACL,MAAM;IACN,SAAS,OAAO,MAAM;GACxB,EACF,GACA,GACF;GAEF,OAAO,EAAE,KACP,EACE,OAAO;IAAE,MAAM,OAAO,MAAM;IAAQ,SAAS,OAAO,MAAM;GAAQ,EACpE,GACA,GACF;EACF;EAEA,EAAE,IAAI,UAAU,OAAO,KAAK,MAAM;EAClC,EAAE,IAAI,aAAa,OAAO,KAAK,SAAS;EACxC,EAAE,IAAI,YAAY,OAAO,KAAK,QAAQ;EACtC,EAAE,IAAI,aAAa,OAAO,KAAK,SAAS;EACxC,EAAE,IAAI,cAAc,OAAO,KAAK,UAAU;EAC1C,EAAE,IAAI,UAAU,OAAO,KAAK,MAAM;EAClC,MAAM,KAAK;CACb,CACF;AACF"}

package/dist/hono/index.d.cts

@@ -0,0 +1,272 @@
+import { xi as HEADERS } from "../index-CZru7c5T.cjs";
+import { c as EvaTokenPayload, n as DeviceInfo } from "../types-Ci0Jq0xB.cjs";
+import { n as EvaErrorMessages, t as DEFAULT_ERROR_MESSAGES } from "../error-messages-CGpW1fsg.cjs";
+import { t as AuthHandlerOptions } from "../auth-handlers-DRUUTEtW.cjs";
+import { a as COOKIE_MAX_AGE, c as clearTokenCookies, i as getCookieDomain, l as readTokensFromCookies, n as configureEvaAuth, r as getAuthUrl, s as getCookieNames, t as ConfigureEvaAuthOptions, u as setTokenCookies } from "../config-3avoUa9e.cjs";
+import { L as S2SVerifyOptions, at as DelegatedTokenVerifyOptions, nt as DelegatedActor, pt as ServiceTokenVerifyOptions } from "../types-Ai3iIFlB.cjs";
+import { ZodType } from "zod";
+import { Context, Hono } from "hono";
+import { createMiddleware } from "hono/factory";
+type EvaAuthOptions<TExtra extends Record<string, unknown>> = {
+  extraClaimsSchema?: ZodType<TExtra>;
+  errorMessages?: Partial<EvaErrorMessages>;
+};
+type EvaAuthVariables<TExtra extends Record<string, unknown>> = {
+  evaPayload: EvaTokenPayload<TExtra>;
+};
+declare function evaAuth<TExtra extends Record<string, unknown> = {}>(opts?: EvaAuthOptions<TExtra>): import("hono").MiddlewareHandler<{
+  Variables: EvaAuthVariables<TExtra>;
+}, string, {}, Response>;
+type EvaAuthRoutesOptions = AuthHandlerOptions;
+declare function evaAuthRoutes(opts?: EvaAuthRoutesOptions): Hono;
+declare function getEvaPayload<TExtra extends Record<string, unknown> = {}>(c: Context<{
+  Variables: EvaAuthVariables<TExtra>;
+}>): EvaTokenPayload<TExtra>;
+declare function getSessionId<TExtra extends Record<string, unknown> = {}>(c: Context<{
+  Variables: EvaAuthVariables<TExtra>;
+}>): string;
+declare function parseDeviceInfo(request: Request): DeviceInfo;
+/**
+ * Options for the `s2sAuth` Hono middleware.
+ * Extends `S2SVerifyOptions` (omits `request` — the middleware provides it internally).
+ */
+type S2sAuthOptions = {
+  /**
+   * Callback that returns the plaintext secret (64 hex chars) for the given clientId,
+   * or null if unknown. Return null — do NOT throw — for unknown clients.
+   * D5 LOCKED: SDK does not assume any storage layer.
+   */
+  secretStore: S2SVerifyOptions['secretStore'];
+  /**
+   * Optional callback that returns the scope list for the verified clientId.
+   * If omitted, `c.var.s2sScopes` will be an empty array.
+   */
+  scopesOf?: (clientId: string) => Promise<readonly string[]>;
+  /**
+   * Optional hook called after successful authentication and scope lookup, before `next()`.
+   * Useful for audit logging, nonce tracking, or metrics.
+   *
+   * @throws If this hook throws, the middleware propagates the error and Hono returns HTTP 500.
+   *   Catch errors inside the hook if you want different behavior.
+   *
+   * @example
+   * ```ts
+   * onAuth: (clientId, scopes) => logger.info({ clientId, scopes }, 's2s authenticated'),
+   * ```
+   */
+  onAuth?: (clientId: string, scopes: readonly string[]) => void | Promise<void>;
+  /**
+   * Override timestamp validation window in seconds.
+   * Default: `S2S_TIMESTAMP_WINDOW_SECONDS` (120).
+   */
+  timestampWindowSeconds?: number;
+  /**
+   * Optional replay-protection cache. If provided, each verified request's key
+   * (`${clientId}:${nonce}`) is atomically inserted with a TTL of
+   * `2 * timestampWindowSeconds + 1`; if already present the request is rejected with `replay_detected`.
+   *
+   * @since v1.1.0
+   * @see verifyS2SRequest for the full `setIfAbsent` contract and nonce format.
+   */
+  replayCache?: S2SVerifyOptions['replayCache'];
+  /**
+   * Optional message overrides for error reasons (i18n / custom wording).
+   * Any key not overridden falls back to the built-in English default.
+   *
+   * @since v1.1.0
+   * @see verifyS2SRequest for the full `messages` contract and default strings.
+   */
+  messages?: S2SVerifyOptions['messages'];
+};
+/**
+ * Hono context variables set by `s2sAuth`.
+ * Declare in your app type for full type inference:
+ * ```ts
+ * const app = new Hono<{ Variables: S2sAuthVariables }>()
+ * ```
+ */
+type S2sAuthVariables = {
+  s2sClientId: string;
+  s2sScopes: readonly string[];
+};
+/**
+ * Hono middleware that verifies inbound S2S requests signed with HMAC-SHA-256.
+ *
+ * On **success**: sets `c.var.s2sClientId` and `c.var.s2sScopes`, then calls `next()`.
+ * On **failure**: responds with HTTP 401 `{ error: { code: <S2SVerifyReason>, message } }`.
+ *
+ * The middleware clones the request before reading the body (using Hono's `cloneRawRequest`),
+ * so route handlers can still read the body after authentication — even if a prior middleware
+ * already consumed the original stream.
+ *
+ * @see {@link requireScope} to enforce scope-based authorization after authentication.
+ *
+ * @example
+ * ```ts
+ * import { Hono } from 'hono'
+ * import { s2sAuth, requireScope } from '@eva_solutions/auth-sdk/hono'
+ *
+ * const app = new Hono()
+ *
+ * app.use('/api/*', s2sAuth({
+ *   secretStore: async (clientId) => redis.get(`s2s:${clientId}:secret`),
+ *   scopesOf: async (clientId) => redis.smembers(`s2s:${clientId}:scopes`),
+ *   onAuth: (clientId, scopes) => logger.info({ clientId, scopes }, 's2s authenticated'),
+ * }))
+ *
+ * app.get('/api/resource', (c) => {
+ *   const clientId = c.var.s2sClientId   // available after s2sAuth
+ *   const scopes   = c.var.s2sScopes
+ *   return c.json({ clientId, scopes })
+ * })
+ * ```
+ */
+declare function s2sAuth(opts: S2sAuthOptions): ReturnType<typeof createMiddleware<{
+  Variables: S2sAuthVariables;
+}>>;
+/**
+ * Hono middleware that requires a specific scope to be present in `c.var.s2sScopes`.
+ *
+ * Must be applied **after** `s2sAuth`. If `s2sAuth` was not applied, this middleware
+ * throws a descriptive `Error` (programming error, results in HTTP 500).
+ *
+ * On **success** (scope present): calls `next()`.
+ * On **failure** (scope absent): returns HTTP 403 with `{ error: { code: 'insufficient_scope', ... } }`.
+ *
+ * @throws `TypeError` at setup-time if the argument is invalid (empty object, empty array,
+ *   or both `all` and `any` specified simultaneously).
+ * @throws `Error` at runtime if `s2sAuth` was not applied before this middleware.
+ *
+ * @example
+ * ```ts
+ * // Single scope (legacy — unchanged)
+ * app.use('/admin/*', s2sAuth({ secretStore }), requireScope('admin'))
+ *
+ * // AND semantics — all scopes must be present
+ * app.use('/admin/*', s2sAuth({ secretStore }), requireScope({ all: ['admin', 'audit'] }))
+ *
+ * // OR semantics — at least one scope must be present
+ * app.use('/data/*', s2sAuth({ secretStore }), requireScope({ any: ['data:read', 'data:write'] }))
+ * ```
+ */
+declare function requireScope(scope: string): ReturnType<typeof createMiddleware<{
+  Variables: S2sAuthVariables;
+}>>;
+/**
+ * Hono middleware that requires **all** listed scopes to be present (AND semantics).
+ *
+ * On failure returns HTTP 403 with `{ error: { code: 'insufficient_scope', requiredAll, missing } }`.
+ *
+ * @since v1.1.0
+ * @throws `TypeError` at setup-time if `all` is an empty array.
+ */
+declare function requireScope(spec: {
+  all: readonly string[];
+}): ReturnType<typeof createMiddleware<{
+  Variables: S2sAuthVariables;
+}>>;
+/**
+ * Hono middleware that requires **at least one** of the listed scopes to be present (OR semantics).
+ *
+ * On failure returns HTTP 403 with `{ error: { code: 'insufficient_scope', requiredAny } }`.
+ *
+ * @since v1.1.0
+ * @throws `TypeError` at setup-time if `any` is an empty array.
+ */
+declare function requireScope(spec: {
+  any: readonly string[];
+}): ReturnType<typeof createMiddleware<{
+  Variables: S2sAuthVariables;
+}>>;
+/** Options for `serviceTokenAuth`: those of `verifyServiceToken` (the middleware provides the token). */
+type ServiceTokenAuthOptions = ServiceTokenVerifyOptions;
+/**
+ * Hono context variables set by `serviceTokenAuth`.
+ */
+type ServiceTokenAuthVariables = {
+  /** `sub` del token: id interno estable del service client. Es la identidad. */
+  serviceClientId: string;
+  /** `client_id` del token: slug del service client. Dato visible, no identidad. */
+  serviceClientSlug: string;
+  serviceScopes: readonly string[];
+};
+/**
+ * Hono middleware that verifies the service token (ES256, `typ: 'svc-at+jwt'`, `kid` `svc-…`, `aud`
+ * of this service, `scope`) sent as `Authorization: Bearer`. See `verifyServiceToken` for the
+ * token contract.
+ *
+ * On **success**: sets `c.var.serviceClientId` (`sub`), `c.var.serviceClientSlug` (`client_id`) and
+ * `c.var.serviceScopes`, then calls `next()`.
+ * On **failure**: HTTP 401 `{ error: { code: <ServiceTokenVerifyReason>, message } }`, or HTTP 403
+ * with code `insufficient_scope` when the token is valid but lacks the required scope.
+ *
+ * JWKS/config failures are not rejections: they propagate and Hono answers 500.
+ *
+ * With `scopeCheck: 'deferred'` the token is authenticated but no permission is required here; mount
+ * `requireScope(...)` per route afterwards (it reads `serviceScopes` when `s2sScopes` is absent).
+ *
+ * @throws `TypeError` when the middleware is built with options that are not valid for the
+ *   catalog (unknown audience, a permission of another audience, no permission rule).
+ *
+ * @example
+ * ```ts
+ * app.use(
+ *   '/v1/internal/messages/*',
+ *   serviceTokenAuth({ audience: 'whatsapp-api', requiredScope: 'messages:send:text' }),
+ * )
+ * ```
+ */
+declare function serviceTokenAuth(opts: ServiceTokenAuthOptions): ReturnType<typeof createMiddleware<{
+  Variables: ServiceTokenAuthVariables;
+}>>;
+/** Options for `delegatedTokenAuth`: those of `verifyDelegatedToken` (the middleware provides the token). */
+type DelegatedTokenAuthOptions = DelegatedTokenVerifyOptions;
+/**
+ * Hono context variables set by `delegatedTokenAuth`.
+ */
+type DelegatedTokenAuthVariables = {
+  /** `sub` del token: el usuario en cuyo nombre se actúa. */
+  userId: string;
+  /** `empresa`: obligatoria en toda la cadena. */
+  empresaId: string;
+  /** `producto` de origen de la cadena. */
+  producto: string;
+  /** `sid`: sesión de origen. */
+  sessionId: string;
+  /** Cadena de actores, del último (quien llama a este servicio) al primero. */
+  actorChain: readonly DelegatedActor[];
+  /** Permisos del token. */
+  scopes: readonly string[];
+};
+/**
+ * Hono middleware that verifies the delegated token (ES256, `typ: 'dlg-at+jwt'`, `kid` `svc-…`, one
+ * `aud` = this service, never `auth-api`, mandatory `empresa`) sent as `Authorization: Bearer`. See
+ * `verifyDelegatedToken` for the token contract. It accepts NOTHING else: a service token, a user
+ * access token and a delegated token are three different types and each verifier takes only its own.
+ *
+ * On **success**: sets `c.var.userId`, `empresaId`, `producto`, `sessionId`, `actorChain` and
+ * `scopes`, then calls `next()`.
+ * On **failure**: HTTP 401 `{ error: { code: <reason>, message } }`, or HTTP 403 with code
+ * `insufficient_scope` when the token is valid but lacks the required scope.
+ *
+ * With `scopeCheck: 'deferred'` no permission is required here; check `c.var.scopes` in the route.
+ * (`requireScope` reads the scopes of `s2sAuth` / `serviceTokenAuth` and does not apply here.)
+ *
+ * The receiving service does not see the roles of the product: the product that acted is
+ * responsible for having checked the permission of the person before asking for the token.
+ *
+ * @throws `TypeError` when the middleware is built with options that are not valid for the catalog.
+ *
+ * @example
+ * ```ts
+ * app.use(
+ *   '/v1/stock/*',
+ *   delegatedTokenAuth({ audience: 'whatsapp-api', requiredScope: 'messages:send:text' }),
+ * )
+ * ```
+ */
+declare function delegatedTokenAuth(opts: DelegatedTokenAuthOptions): ReturnType<typeof createMiddleware<{
+  Variables: DelegatedTokenAuthVariables;
+}>>;
+export { COOKIE_MAX_AGE, type ConfigureEvaAuthOptions, DEFAULT_ERROR_MESSAGES, type DelegatedTokenAuthOptions, type DelegatedTokenAuthVariables, type EvaAuthOptions, type EvaAuthRoutesOptions, type EvaAuthVariables, type EvaErrorMessages, HEADERS, type S2sAuthOptions, type S2sAuthVariables, type ServiceTokenAuthOptions, type ServiceTokenAuthVariables, clearTokenCookies, configureEvaAuth, delegatedTokenAuth, evaAuth, evaAuthRoutes, getAuthUrl, getCookieDomain, getCookieNames, getEvaPayload, getSessionId, parseDeviceInfo, readTokensFromCookies, requireScope, s2sAuth, serviceTokenAuth, setTokenCookies };
+//# sourceMappingURL=index.d.cts.map

package/dist/hono/index.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.cts","names":[],"sources":["../../src/hono/middleware.ts","../../src/hono/auth-routes.ts","../../src/hono/helpers.ts","../../src/hono/device-info.ts","../../src/hono/s2s.ts"],"mappings":";;;;;;;;;KAoBY,eAAe,eAAe;EACxC,oBAAoB,QAAQ;EAC5B,gBAAgB,QAAQ;;KAGd,iBAAiB,eAAe;EAC1C,YAAY,gBAAgB;;iBAGd,QAAQ,eAAe,8BACrC,OAAM,eAAe,yBAAY;EAKI,WAAA,iBAAiB;eAyDvD;KCzFW,uBAAuB;iBAEnB,cAAc,OAAM,uBAA4B;iBCDhD,cAAc,eAAe,8BAC3C,GAAG;EAAU,WAAW,iBAAiB;KACxC,gBAAgB;iBAMH,aAAa,eAAe,8BAC1C,GAAG;EAAU,WAAW,iBAAiB;;iBCV3B,gBAAgB,SAAS,UAAU;;;;;KCiCvC;;;;;;EAMV,aAAa;;;;;EAKb,YAAY,qBAAqB;;;;;;;;;;;;;EAajC,UAAU,kBAAkB,qCAAqC;;;;;EAKjE;;;;;;;;;EASA,cAAc;;;;;;;;EAQd,WAAW;;;;;;;;;KAUD;EACV;EACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuCc,QACd,MAAM,iBACL,kBAAkB;EAAmB,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6DnC,aACd,gBACC,kBAAkB;EAAmB,WAAW;;;;;;;;;;iBASnC,aAAa;EAC3B;IACE,kBAAkB;EAAmB,WAAW;;;;;;;;;;iBASpC,aAAa;EAC3B;IACE,kBAAkB;EAAmB,WAAW;;;KAkFxC,0BAA0B;;;;KAK1B;;EAEV;;EAEA;EACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiCc,iBACd,MAAM,0BACL,kBACM;EAAmB,WAAW;;;KAmD3B,4BAA4B;;;;KAK5B;;EAEV;;EAEA;;EAEA;;EAEA;;EAEA,qBAAqB;;EAErB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8Bc,mBACd,MAAM,4BACL,kBACM;EAAmB,WAAW"}