@eva_solutions/auth-sdk 0.0.0-stage → 3.0.0-dev-20261109133200

package/dist/hono-openapi/index.js

@@ -0,0 +1,307 @@
+import { a as GetCodeSchema, c as RefreshResponseSchema, i as GetCodeResponseSchema, l as UpdateUserSchema, n as ActiveEmpresaSchema, o as LoginResponseSchema, r as ErrorResponseSchema, s as LoginSchema, t as buildAuthHandlers } from "../auth-handlers-B3iJaPln.js";
+import { z } from "zod";
+import { OpenAPIHono, OpenAPIHono as OpenAPIHono$1, createRoute, createRoute as createRoute$1, defineOpenAPIRoute } from "@hono/zod-openapi";
+// src/hono-openapi/index.ts
+/**
+* Variante OpenAPIHono del SDK — entry point `@eva_solutions/auth-sdk/hono-openapi`.
+*
+* Decisión B3 (ADR-012): usa `createRoute` + `app.openapi(route, handler)`.
+* `defineOpenAPIRoute` es para el método `openapiRoutes` (array API) — se eligió
+* `createRoute` como API primaria por compatibilidad con el factory pattern.
+* Los handlers del factory son compatibles con `RouteHandler<R>` cuando se castea
+* via `as RouteHandler<typeof route>` (no `as never` — type assertion específica).
+* Decisión B1 (ADR-012): schemas importados desde src/schemas.ts (canónico — T-00 validó).
+* Decisión CE1 (ADR-012): requiere parent OpenAPIHono (no Hono plano) — ver warning.
+*
+* RISK-04 (T-034): ErrorResponseSchema siempre documenta el shape 'api'
+* `{ error: { code: string, message: string } }` independientemente del errorWire
+* configurado en runtime. En wire='sdk' el runtime devuelve el mismo shape — es correcto.
+* El errorWire controla el código de error (EvaApiError vs EvaSdkError), pero el shape
+* del wire HTTP es siempre `{ error: { code, message } }` en ambos casos.
+*
+* @example
+* ```ts
+* import { OpenAPIHono } from '@hono/zod-openapi'
+* import { evaAuthOpenAPIRoutes } from '@eva_solutions/auth-sdk/hono-openapi'
+*
+* const app = new OpenAPIHono()  // ← CRÍTICO: OpenAPIHono, no Hono
+* app.route('/auth', evaAuthOpenAPIRoutes())
+* app.doc('/doc', { openapi: '3.1.0', info: { title: 'API', version: '1.0' } })
+* ```
+*/
+const tags = ["Auth"];
+const getCodeRoute = createRoute$1({
+	method: "post",
+	path: "/get-code",
+	tags,
+	summary: "Solicitar código de verificación",
+	request: { body: {
+		content: { "application/json": { schema: GetCodeSchema } },
+		required: true
+	} },
+	responses: {
+		200: {
+			description: "Código enviado al teléfono; incluye el challengeId del desafío",
+			content: { "application/json": { schema: GetCodeResponseSchema } }
+		},
+		400: {
+			description: "Teléfono inválido o JSON malformado",
+			content: { "application/json": { schema: ErrorResponseSchema } }
+		}
+	}
+});
+const loginRoute = createRoute$1({
+	method: "post",
+	path: "/login",
+	tags,
+	summary: "Autenticarse con teléfono y código",
+	request: { body: {
+		content: { "application/json": { schema: LoginSchema } },
+		required: true
+	} },
+	responses: {
+		200: {
+			description: "Login exitoso — tokens seteados en cookies",
+			content: { "application/json": { schema: LoginResponseSchema } }
+		},
+		400: {
+			description: "Credenciales inválidas o JSON malformado",
+			content: { "application/json": { schema: ErrorResponseSchema } }
+		},
+		401: {
+			description: "No autorizado",
+			content: { "application/json": { schema: ErrorResponseSchema } }
+		}
+	}
+});
+const refreshRoute = createRoute$1({
+	method: "post",
+	path: "/refresh",
+	tags,
+	summary: "Renovar access token vía refresh token en cookie",
+	responses: {
+		200: {
+			description: "Tokens renovados",
+			content: { "application/json": { schema: RefreshResponseSchema } }
+		},
+		401: {
+			description: "Refresh token ausente o inválido",
+			content: { "application/json": { schema: ErrorResponseSchema } }
+		}
+	}
+});
+const logoutRoute = createRoute$1({
+	method: "post",
+	path: "/logout",
+	tags,
+	summary: "Cerrar sesión y limpiar cookies",
+	responses: {
+		200: {
+			description: "Logout exitoso",
+			content: { "application/json": { schema: z.object({ data: z.unknown() }) } }
+		},
+		401: {
+			description: "Refresh token ausente",
+			content: { "application/json": { schema: ErrorResponseSchema } }
+		}
+	}
+});
+const getMeRoute = createRoute$1({
+	method: "get",
+	path: "/me",
+	tags,
+	summary: "Obtener datos del usuario autenticado",
+	responses: {
+		200: {
+			description: "Usuario",
+			content: { "application/json": { schema: z.object({ data: z.unknown() }) } }
+		},
+		401: {
+			description: "Access token ausente",
+			content: { "application/json": { schema: ErrorResponseSchema } }
+		}
+	}
+});
+const updateMeRoute = createRoute$1({
+	method: "patch",
+	path: "/me",
+	tags,
+	summary: "Actualizar datos del usuario autenticado",
+	request: { body: {
+		content: { "application/json": { schema: UpdateUserSchema } },
+		required: true
+	} },
+	responses: {
+		200: {
+			description: "Usuario actualizado",
+			content: { "application/json": { schema: z.object({ data: z.unknown() }) } }
+		},
+		400: {
+			description: "Body inválido",
+			content: { "application/json": { schema: ErrorResponseSchema } }
+		},
+		401: {
+			description: "Access token ausente",
+			content: { "application/json": { schema: ErrorResponseSchema } }
+		}
+	}
+});
+const deleteMeRoute = createRoute$1({
+	method: "delete",
+	path: "/me",
+	tags,
+	summary: "Eliminar cuenta del usuario autenticado",
+	responses: {
+		200: {
+			description: "Cuenta eliminada",
+			content: { "application/json": { schema: z.object({ data: z.unknown() }) } }
+		},
+		401: {
+			description: "Access token ausente",
+			content: { "application/json": { schema: ErrorResponseSchema } }
+		}
+	}
+});
+const getEmpresasRoute = createRoute$1({
+	method: "get",
+	path: "/empresas",
+	tags,
+	summary: "Listar empresas del usuario autenticado",
+	responses: {
+		200: {
+			description: "Lista de empresas",
+			content: { "application/json": { schema: z.object({ data: z.unknown() }) } }
+		},
+		401: {
+			description: "Access token ausente",
+			content: { "application/json": { schema: ErrorResponseSchema } }
+		}
+	}
+});
+const setActiveEmpresaRoute = createRoute$1({
+	method: "post",
+	path: "/empresa-activa",
+	tags,
+	summary: "Cambiar la empresa activa de la sesión",
+	request: { body: {
+		content: { "application/json": { schema: ActiveEmpresaSchema } },
+		required: true
+	} },
+	responses: {
+		200: {
+			description: "Empresa activa cambiada — access token nuevo seteado en su cookie (el refresh no rota)",
+			content: { "application/json": { schema: z.object({ data: z.unknown() }) } }
+		},
+		400: {
+			description: "Body inválido",
+			content: { "application/json": { schema: ErrorResponseSchema } }
+		},
+		401: {
+			description: "Access token ausente o inválido",
+			content: { "application/json": { schema: ErrorResponseSchema } }
+		},
+		403: {
+			description: "La persona no pertenece a la empresa, o el Origin no está permitido",
+			content: { "application/json": { schema: ErrorResponseSchema } }
+		},
+		429: {
+			description: "Auth limitó los pedidos",
+			content: { "application/json": { schema: ErrorResponseSchema } }
+		},
+		502: {
+			description: "Auth respondió 200 sin reemitir el access token",
+			content: { "application/json": { schema: ErrorResponseSchema } }
+		},
+		503: {
+			description: "Auth no disponible",
+			content: { "application/json": { schema: ErrorResponseSchema } }
+		}
+	}
+});
+const getSessionsRoute = createRoute$1({
+	method: "get",
+	path: "/sessions",
+	tags,
+	summary: "Listar sesiones activas del usuario",
+	responses: {
+		200: {
+			description: "Lista de sesiones",
+			content: { "application/json": { schema: z.object({ data: z.unknown() }) } }
+		},
+		401: {
+			description: "Access token ausente",
+			content: { "application/json": { schema: ErrorResponseSchema } }
+		}
+	}
+});
+const deleteSessionRoute = createRoute$1({
+	method: "delete",
+	path: "/sessions/{id}",
+	tags,
+	summary: "Cerrar una sesión específica por ID",
+	responses: {
+		200: {
+			description: "Sesión cerrada",
+			content: { "application/json": { schema: z.object({ data: z.unknown() }) } }
+		},
+		400: {
+			description: "ID de sesión inválido",
+			content: { "application/json": { schema: ErrorResponseSchema } }
+		},
+		401: {
+			description: "Access token ausente",
+			content: { "application/json": { schema: ErrorResponseSchema } }
+		}
+	}
+});
+const deleteAllSessionsRoute = createRoute$1({
+	method: "delete",
+	path: "/sessions",
+	tags,
+	summary: "Cerrar todas las sesiones activas",
+	responses: {
+		200: {
+			description: "Todas las sesiones cerradas",
+			content: { "application/json": { schema: z.object({ data: z.unknown() }) } }
+		},
+		401: {
+			description: "Refresh token ausente",
+			content: { "application/json": { schema: ErrorResponseSchema } }
+		}
+	}
+});
+/**
+* Retorna una instancia `OpenAPIHono` con los 12 endpoints de auth declarados
+* con schemas Zod 4 para generación automática de documentación OpenAPI 3.1.
+*
+* ⚠ IMPORTANTE: montar en un parent `OpenAPIHono` (no `Hono` plano).
+* Si el parent es `new Hono()`, los paths NO aparecerán en el documento `/doc`.
+* Ver honojs/middleware#952 y docs/configuration.md sección "Variante OpenAPI".
+*/
+function evaAuthOpenAPIRoutes(opts = {}) {
+	const h = buildAuthHandlers(opts);
+	const { getCode: getCodeGuard, login: loginGuard } = h.openApiGuards;
+	const sdkGuards = /* @__PURE__ */ new WeakMap();
+	const app = new OpenAPIHono$1({ defaultHook: (result, c) => sdkGuards.get(c)?.onInvalid(result, c) });
+	app.use("*", h.originGuard);
+	for (const [path, guard] of [["/get-code", getCodeGuard], ["/login", loginGuard]]) app.on("POST", path, (c, next) => {
+		sdkGuards.set(c, guard);
+		return guard.middleware(c, next);
+	});
+	app.openapi(getCodeRoute, h.getCode);
+	app.openapi(loginRoute, h.login);
+	app.openapi(refreshRoute, h.refresh);
+	app.openapi(logoutRoute, h.logout);
+	app.openapi(getMeRoute, h.getMe);
+	app.openapi(updateMeRoute, h.updateMe);
+	app.openapi(deleteMeRoute, h.deleteMe);
+	app.openapi(getEmpresasRoute, h.getEmpresas);
+	app.openapi(setActiveEmpresaRoute, h.setActiveEmpresa);
+	app.openapi(getSessionsRoute, h.getSessions);
+	app.openapi(deleteSessionRoute, h.deleteSession);
+	app.openapi(deleteAllSessionsRoute, h.deleteAllSessions);
+	return app;
+}
+export { OpenAPIHono, createRoute, defineOpenAPIRoute, evaAuthOpenAPIRoutes };
+
+//# sourceMappingURL=index.js.map

package/dist/hono-openapi/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":["createRoute","OpenAPIHono"],"sources":["../../src/hono-openapi/index.ts"],"sourcesContent":["/**\n * Variante OpenAPIHono del SDK — entry point `@eva_solutions/auth-sdk/hono-openapi`.\n *\n * Decisión B3 (ADR-012): usa `createRoute` + `app.openapi(route, handler)`.\n * `defineOpenAPIRoute` es para el método `openapiRoutes` (array API) — se eligió\n * `createRoute` como API primaria por compatibilidad con el factory pattern.\n * Los handlers del factory son compatibles con `RouteHandler<R>` cuando se castea\n * via `as RouteHandler<typeof route>` (no `as never` — type assertion específica).\n * Decisión B1 (ADR-012): schemas importados desde src/schemas.ts (canónico — T-00 validó).\n * Decisión CE1 (ADR-012): requiere parent OpenAPIHono (no Hono plano) — ver warning.\n *\n * RISK-04 (T-034): ErrorResponseSchema siempre documenta el shape 'api'\n * `{ error: { code: string, message: string } }` independientemente del errorWire\n * configurado en runtime. En wire='sdk' el runtime devuelve el mismo shape — es correcto.\n * El errorWire controla el código de error (EvaApiError vs EvaSdkError), pero el shape\n * del wire HTTP es siempre `{ error: { code, message } }` en ambos casos.\n *\n * @example\n * ```ts\n * import { OpenAPIHono } from '@hono/zod-openapi'\n * import { evaAuthOpenAPIRoutes } from '@eva_solutions/auth-sdk/hono-openapi'\n *\n * const app = new OpenAPIHono()  // ← CRÍTICO: OpenAPIHono, no Hono\n * app.route('/auth', evaAuthOpenAPIRoutes())\n * app.doc('/doc', { openapi: '3.1.0', info: { title: 'API', version: '1.0' } })\n * ```\n */\nimport { OpenAPIHono, createRoute } from '@hono/zod-openapi'\nimport { z } from 'zod'\nimport type { RouteHandler } from '@hono/zod-openapi'\nimport type { Context } from 'hono'\nimport {\n  buildAuthHandlers,\n  type AuthHandlerOptions,\n  type OpenAPIBodyGuard,\n} from '../auth-handlers'\nimport {\n  ActiveEmpresaSchema,\n  GetCodeSchema,\n  GetCodeResponseSchema,\n  LoginSchema,\n  UpdateUserSchema,\n  ErrorResponseSchema,\n  LoginResponseSchema,\n  RefreshResponseSchema,\n} from '../schemas'\n\nexport type EvaAuthOpenAPIRoutesOptions = AuthHandlerOptions\n\nconst tags = ['Auth']\n\n// === Route definitions (createRoute — forma canónica de @hono/zod-openapi) ===\n\nconst getCodeRoute = createRoute({\n  method: 'post',\n  path: '/get-code',\n  tags,\n  summary: 'Solicitar código de verificación',\n  request: {\n    body: {\n      content: { 'application/json': { schema: GetCodeSchema } },\n      required: true,\n    },\n  },\n  responses: {\n    200: {\n      description:\n        'Código enviado al teléfono; incluye el challengeId del desafío',\n      content: { 'application/json': { schema: GetCodeResponseSchema } },\n    },\n    400: {\n      description: 'Teléfono inválido o JSON malformado',\n      content: { 'application/json': { schema: ErrorResponseSchema } },\n    },\n  },\n})\n\nconst loginRoute = createRoute({\n  method: 'post',\n  path: '/login',\n  tags,\n  summary: 'Autenticarse con teléfono y código',\n  request: {\n    body: {\n      content: { 'application/json': { schema: LoginSchema } },\n      required: true,\n    },\n  },\n  responses: {\n    200: {\n      description: 'Login exitoso — tokens seteados en cookies',\n      content: { 'application/json': { schema: LoginResponseSchema } },\n    },\n    400: {\n      description: 'Credenciales inválidas o JSON malformado',\n      content: { 'application/json': { schema: ErrorResponseSchema } },\n    },\n    401: {\n      description: 'No autorizado',\n      content: { 'application/json': { schema: ErrorResponseSchema } },\n    },\n  },\n})\n\nconst refreshRoute = createRoute({\n  method: 'post',\n  path: '/refresh',\n  tags,\n  summary: 'Renovar access token vía refresh token en cookie',\n  responses: {\n    200: {\n      description: 'Tokens renovados',\n      content: { 'application/json': { schema: RefreshResponseSchema } },\n    },\n    401: {\n      description: 'Refresh token ausente o inválido',\n      content: { 'application/json': { schema: ErrorResponseSchema } },\n    },\n  },\n})\n\nconst logoutRoute = createRoute({\n  method: 'post',\n  path: '/logout',\n  tags,\n  summary: 'Cerrar sesión y limpiar cookies',\n  responses: {\n    200: {\n      description: 'Logout exitoso',\n      content: {\n        'application/json': { schema: z.object({ data: z.unknown() }) },\n      },\n    },\n    401: {\n      description: 'Refresh token ausente',\n      content: { 'application/json': { schema: ErrorResponseSchema } },\n    },\n  },\n})\n\nconst getMeRoute = createRoute({\n  method: 'get',\n  path: '/me',\n  tags,\n  summary: 'Obtener datos del usuario autenticado',\n  responses: {\n    200: {\n      description: 'Usuario',\n      content: {\n        'application/json': { schema: z.object({ data: z.unknown() }) },\n      },\n    },\n    401: {\n      description: 'Access token ausente',\n      content: { 'application/json': { schema: ErrorResponseSchema } },\n    },\n  },\n})\n\nconst updateMeRoute = createRoute({\n  method: 'patch',\n  path: '/me',\n  tags,\n  summary: 'Actualizar datos del usuario autenticado',\n  request: {\n    body: {\n      content: { 'application/json': { schema: UpdateUserSchema } },\n      required: true,\n    },\n  },\n  responses: {\n    200: {\n      description: 'Usuario actualizado',\n      content: {\n        'application/json': { schema: z.object({ data: z.unknown() }) },\n      },\n    },\n    400: {\n      description: 'Body inválido',\n      content: { 'application/json': { schema: ErrorResponseSchema } },\n    },\n    401: {\n      description: 'Access token ausente',\n      content: { 'application/json': { schema: ErrorResponseSchema } },\n    },\n  },\n})\n\nconst deleteMeRoute = createRoute({\n  method: 'delete',\n  path: '/me',\n  tags,\n  summary: 'Eliminar cuenta del usuario autenticado',\n  responses: {\n    200: {\n      description: 'Cuenta eliminada',\n      content: {\n        'application/json': { schema: z.object({ data: z.unknown() }) },\n      },\n    },\n    401: {\n      description: 'Access token ausente',\n      content: { 'application/json': { schema: ErrorResponseSchema } },\n    },\n  },\n})\n\nconst getEmpresasRoute = createRoute({\n  method: 'get',\n  path: '/empresas',\n  tags,\n  summary: 'Listar empresas del usuario autenticado',\n  responses: {\n    200: {\n      description: 'Lista de empresas',\n      content: {\n        'application/json': { schema: z.object({ data: z.unknown() }) },\n      },\n    },\n    401: {\n      description: 'Access token ausente',\n      content: { 'application/json': { schema: ErrorResponseSchema } },\n    },\n  },\n})\n\nconst setActiveEmpresaRoute = createRoute({\n  method: 'post',\n  path: '/empresa-activa',\n  tags,\n  summary: 'Cambiar la empresa activa de la sesión',\n  request: {\n    body: {\n      content: { 'application/json': { schema: ActiveEmpresaSchema } },\n      required: true,\n    },\n  },\n  responses: {\n    200: {\n      description:\n        'Empresa activa cambiada — access token nuevo seteado en su cookie (el refresh no rota)',\n      content: {\n        'application/json': { schema: z.object({ data: z.unknown() }) },\n      },\n    },\n    400: {\n      description: 'Body inválido',\n      content: { 'application/json': { schema: ErrorResponseSchema } },\n    },\n    401: {\n      description: 'Access token ausente o inválido',\n      content: { 'application/json': { schema: ErrorResponseSchema } },\n    },\n    403: {\n      description:\n        'La persona no pertenece a la empresa, o el Origin no está permitido',\n      content: { 'application/json': { schema: ErrorResponseSchema } },\n    },\n    429: {\n      description: 'Auth limitó los pedidos',\n      content: { 'application/json': { schema: ErrorResponseSchema } },\n    },\n    502: {\n      description: 'Auth respondió 200 sin reemitir el access token',\n      content: { 'application/json': { schema: ErrorResponseSchema } },\n    },\n    503: {\n      description: 'Auth no disponible',\n      content: { 'application/json': { schema: ErrorResponseSchema } },\n    },\n  },\n})\n\nconst getSessionsRoute = createRoute({\n  method: 'get',\n  path: '/sessions',\n  tags,\n  summary: 'Listar sesiones activas del usuario',\n  responses: {\n    200: {\n      description: 'Lista de sesiones',\n      content: {\n        'application/json': { schema: z.object({ data: z.unknown() }) },\n      },\n    },\n    401: {\n      description: 'Access token ausente',\n      content: { 'application/json': { schema: ErrorResponseSchema } },\n    },\n  },\n})\n\nconst deleteSessionRoute = createRoute({\n  method: 'delete',\n  path: '/sessions/{id}',\n  tags,\n  summary: 'Cerrar una sesión específica por ID',\n  responses: {\n    200: {\n      description: 'Sesión cerrada',\n      content: {\n        'application/json': { schema: z.object({ data: z.unknown() }) },\n      },\n    },\n    400: {\n      description: 'ID de sesión inválido',\n      content: { 'application/json': { schema: ErrorResponseSchema } },\n    },\n    401: {\n      description: 'Access token ausente',\n      content: { 'application/json': { schema: ErrorResponseSchema } },\n    },\n  },\n})\n\nconst deleteAllSessionsRoute = createRoute({\n  method: 'delete',\n  path: '/sessions',\n  tags,\n  summary: 'Cerrar todas las sesiones activas',\n  responses: {\n    200: {\n      description: 'Todas las sesiones cerradas',\n      content: {\n        'application/json': { schema: z.object({ data: z.unknown() }) },\n      },\n    },\n    401: {\n      description: 'Refresh token ausente',\n      content: { 'application/json': { schema: ErrorResponseSchema } },\n    },\n  },\n})\n\n// === Factory ===\n\n/**\n * Retorna una instancia `OpenAPIHono` con los 12 endpoints de auth declarados\n * con schemas Zod 4 para generación automática de documentación OpenAPI 3.1.\n *\n * ⚠ IMPORTANTE: montar en un parent `OpenAPIHono` (no `Hono` plano).\n * Si el parent es `new Hono()`, los paths NO aparecerán en el documento `/doc`.\n * Ver honojs/middleware#952 y docs/configuration.md sección \"Variante OpenAPI\".\n */\nexport function evaAuthOpenAPIRoutes(\n  opts: EvaAuthOpenAPIRoutesOptions = {},\n): OpenAPIHono {\n  const h = buildAuthHandlers(opts)\n  const { getCode: getCodeGuard, login: loginGuard } = h.openApiGuards\n  // Hook del validador solo para get-code/login del SDK: sus 400 salen en el wire de la\n  // variante plana en vez del ZodError. El resto de las rutas conserva el default.\n  // Las rutas del SDK se identifican por haber pasado por su guarda (registrada con el\n  // path exacto relativo a esta sub-app), no por el sufijo del path completo: así una\n  // ruta propia del consumidor (/admin/login, /sms/get-code) no hereda los mensajes\n  // y el prefijo de montaje (/auth, basePath, raíz, strict:false) es irrelevante.\n  const sdkGuards = new WeakMap<Context, OpenAPIBodyGuard>()\n  const app = new OpenAPIHono({\n    defaultHook: (result, c) => sdkGuards.get(c)?.onInvalid(result, c),\n  })\n\n  // CSRF por Origin: antes que cualquier otra guarda o validador.\n  app.use('*', h.originGuard)\n\n  // get-code/login: el validador del body responde el 400 antes que el handler;\n  // la guarda aporta no-store y el JSON malformado en el wire de la variante plana.\n  for (const [path, guard] of [\n    ['/get-code', getCodeGuard],\n    ['/login', loginGuard],\n  ] as const) {\n    app.on('POST', path, (c, next) => {\n      sdkGuards.set(c, guard)\n      return guard.middleware(c, next)\n    })\n  }\n\n  // Los handlers del factory retornan Promise<Response> — compatible en runtime con\n  // RouteHandler<R>, pero TS no puede reconciliar el union type RouteConfigToTypedResponse.\n  // Se usa double assertion (as unknown as RouteHandler<R>) documentada en ADR-012:\n  // es una type assertion específica (no as never — mantiene el tipo target concreto).\n  // Justificación: el factory pattern compartido entre variante plana y OpenAPI requiere\n  // handlers genéricos; la inference TS no atraviesa el indirection del factory.\n  app.openapi(\n    getCodeRoute,\n    h.getCode as unknown as RouteHandler<typeof getCodeRoute>,\n  )\n  app.openapi(loginRoute, h.login as unknown as RouteHandler<typeof loginRoute>)\n  app.openapi(\n    refreshRoute,\n    h.refresh as unknown as RouteHandler<typeof refreshRoute>,\n  )\n  app.openapi(\n    logoutRoute,\n    h.logout as unknown as RouteHandler<typeof logoutRoute>,\n  )\n  app.openapi(getMeRoute, h.getMe as unknown as RouteHandler<typeof getMeRoute>)\n  app.openapi(\n    updateMeRoute,\n    h.updateMe as unknown as RouteHandler<typeof updateMeRoute>,\n  )\n  app.openapi(\n    deleteMeRoute,\n    h.deleteMe as unknown as RouteHandler<typeof deleteMeRoute>,\n  )\n  app.openapi(\n    getEmpresasRoute,\n    h.getEmpresas as unknown as RouteHandler<typeof getEmpresasRoute>,\n  )\n  app.openapi(\n    setActiveEmpresaRoute,\n    h.setActiveEmpresa as unknown as RouteHandler<typeof setActiveEmpresaRoute>,\n  )\n  app.openapi(\n    getSessionsRoute,\n    h.getSessions as unknown as RouteHandler<typeof getSessionsRoute>,\n  )\n  app.openapi(\n    deleteSessionRoute,\n    h.deleteSession as unknown as RouteHandler<typeof deleteSessionRoute>,\n  )\n  app.openapi(\n    deleteAllSessionsRoute,\n    h.deleteAllSessions as unknown as RouteHandler<\n      typeof deleteAllSessionsRoute\n    >,\n  )\n\n  return app\n}\n\n// Re-exports de conveniencia\nexport { OpenAPIHono, createRoute, defineOpenAPIRoute } from '@hono/zod-openapi'\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiDA,MAAM,OAAO,CAAC,MAAM;AAIpB,MAAM,eAAeA,cAAY;CAC/B,QAAQ;CACR,MAAM;CACN;CACA,SAAS;CACT,SAAS,EACP,MAAM;EACJ,SAAS,EAAE,oBAAoB,EAAE,QAAQ,cAAc,EAAE;EACzD,UAAU;CACZ,EACF;CACA,WAAW;EACT,KAAK;GACH,aACE;GACF,SAAS,EAAE,oBAAoB,EAAE,QAAQ,sBAAsB,EAAE;EACnE;EACA,KAAK;GACH,aAAa;GACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,oBAAoB,EAAE;EACjE;CACF;AACF,CAAC;AAED,MAAM,aAAaA,cAAY;CAC7B,QAAQ;CACR,MAAM;CACN;CACA,SAAS;CACT,SAAS,EACP,MAAM;EACJ,SAAS,EAAE,oBAAoB,EAAE,QAAQ,YAAY,EAAE;EACvD,UAAU;CACZ,EACF;CACA,WAAW;EACT,KAAK;GACH,aAAa;GACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,oBAAoB,EAAE;EACjE;EACA,KAAK;GACH,aAAa;GACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,oBAAoB,EAAE;EACjE;EACA,KAAK;GACH,aAAa;GACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,oBAAoB,EAAE;EACjE;CACF;AACF,CAAC;AAED,MAAM,eAAeA,cAAY;CAC/B,QAAQ;CACR,MAAM;CACN;CACA,SAAS;CACT,WAAW;EACT,KAAK;GACH,aAAa;GACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,sBAAsB,EAAE;EACnE;EACA,KAAK;GACH,aAAa;GACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,oBAAoB,EAAE;EACjE;CACF;AACF,CAAC;AAED,MAAM,cAAcA,cAAY;CAC9B,QAAQ;CACR,MAAM;CACN;CACA,SAAS;CACT,WAAW;EACT,KAAK;GACH,aAAa;GACb,SAAS,EACP,oBAAoB,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,EAChE;EACF;EACA,KAAK;GACH,aAAa;GACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,oBAAoB,EAAE;EACjE;CACF;AACF,CAAC;AAED,MAAM,aAAaA,cAAY;CAC7B,QAAQ;CACR,MAAM;CACN;CACA,SAAS;CACT,WAAW;EACT,KAAK;GACH,aAAa;GACb,SAAS,EACP,oBAAoB,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,EAChE;EACF;EACA,KAAK;GACH,aAAa;GACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,oBAAoB,EAAE;EACjE;CACF;AACF,CAAC;AAED,MAAM,gBAAgBA,cAAY;CAChC,QAAQ;CACR,MAAM;CACN;CACA,SAAS;CACT,SAAS,EACP,MAAM;EACJ,SAAS,EAAE,oBAAoB,EAAE,QAAQ,iBAAiB,EAAE;EAC5D,UAAU;CACZ,EACF;CACA,WAAW;EACT,KAAK;GACH,aAAa;GACb,SAAS,EACP,oBAAoB,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,EAChE;EACF;EACA,KAAK;GACH,aAAa;GACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,oBAAoB,EAAE;EACjE;EACA,KAAK;GACH,aAAa;GACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,oBAAoB,EAAE;EACjE;CACF;AACF,CAAC;AAED,MAAM,gBAAgBA,cAAY;CAChC,QAAQ;CACR,MAAM;CACN;CACA,SAAS;CACT,WAAW;EACT,KAAK;GACH,aAAa;GACb,SAAS,EACP,oBAAoB,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,EAChE;EACF;EACA,KAAK;GACH,aAAa;GACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,oBAAoB,EAAE;EACjE;CACF;AACF,CAAC;AAED,MAAM,mBAAmBA,cAAY;CACnC,QAAQ;CACR,MAAM;CACN;CACA,SAAS;CACT,WAAW;EACT,KAAK;GACH,aAAa;GACb,SAAS,EACP,oBAAoB,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,EAChE;EACF;EACA,KAAK;GACH,aAAa;GACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,oBAAoB,EAAE;EACjE;CACF;AACF,CAAC;AAED,MAAM,wBAAwBA,cAAY;CACxC,QAAQ;CACR,MAAM;CACN;CACA,SAAS;CACT,SAAS,EACP,MAAM;EACJ,SAAS,EAAE,oBAAoB,EAAE,QAAQ,oBAAoB,EAAE;EAC/D,UAAU;CACZ,EACF;CACA,WAAW;EACT,KAAK;GACH,aACE;GACF,SAAS,EACP,oBAAoB,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,EAChE;EACF;EACA,KAAK;GACH,aAAa;GACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,oBAAoB,EAAE;EACjE;EACA,KAAK;GACH,aAAa;GACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,oBAAoB,EAAE;EACjE;EACA,KAAK;GACH,aACE;GACF,SAAS,EAAE,oBAAoB,EAAE,QAAQ,oBAAoB,EAAE;EACjE;EACA,KAAK;GACH,aAAa;GACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,oBAAoB,EAAE;EACjE;EACA,KAAK;GACH,aAAa;GACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,oBAAoB,EAAE;EACjE;EACA,KAAK;GACH,aAAa;GACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,oBAAoB,EAAE;EACjE;CACF;AACF,CAAC;AAED,MAAM,mBAAmBA,cAAY;CACnC,QAAQ;CACR,MAAM;CACN;CACA,SAAS;CACT,WAAW;EACT,KAAK;GACH,aAAa;GACb,SAAS,EACP,oBAAoB,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,EAChE;EACF;EACA,KAAK;GACH,aAAa;GACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,oBAAoB,EAAE;EACjE;CACF;AACF,CAAC;AAED,MAAM,qBAAqBA,cAAY;CACrC,QAAQ;CACR,MAAM;CACN;CACA,SAAS;CACT,WAAW;EACT,KAAK;GACH,aAAa;GACb,SAAS,EACP,oBAAoB,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,EAChE;EACF;EACA,KAAK;GACH,aAAa;GACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,oBAAoB,EAAE;EACjE;EACA,KAAK;GACH,aAAa;GACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,oBAAoB,EAAE;EACjE;CACF;AACF,CAAC;AAED,MAAM,yBAAyBA,cAAY;CACzC,QAAQ;CACR,MAAM;CACN;CACA,SAAS;CACT,WAAW;EACT,KAAK;GACH,aAAa;GACb,SAAS,EACP,oBAAoB,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,EAChE;EACF;EACA,KAAK;GACH,aAAa;GACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,oBAAoB,EAAE;EACjE;CACF;AACF,CAAC;;;;;;;;;AAYD,SAAgB,qBACd,OAAoC,CAAC,GACxB;CACb,MAAM,IAAI,kBAAkB,IAAI;CAChC,MAAM,EAAE,SAAS,cAAc,OAAO,eAAe,EAAE;CAOvD,MAAM,4BAAY,IAAI,QAAmC;CACzD,MAAM,MAAM,IAAIC,cAAY,EAC1B,cAAc,QAAQ,MAAM,UAAU,IAAI,CAAC,CAAC,EAAE,UAAU,QAAQ,CAAC,EACnE,CAAC;CAGD,IAAI,IAAI,KAAK,EAAE,WAAW;CAI1B,KAAK,MAAM,CAAC,MAAM,UAAU,CAC1B,CAAC,aAAa,YAAY,GAC1B,CAAC,UAAU,UAAU,CACvB,GACE,IAAI,GAAG,QAAQ,OAAO,GAAG,SAAS;EAChC,UAAU,IAAI,GAAG,KAAK;EACtB,OAAO,MAAM,WAAW,GAAG,IAAI;CACjC,CAAC;CASH,IAAI,QACF,cACA,EAAE,OACJ;CACA,IAAI,QAAQ,YAAY,EAAE,KAAmD;CAC7E,IAAI,QACF,cACA,EAAE,OACJ;CACA,IAAI,QACF,aACA,EAAE,MACJ;CACA,IAAI,QAAQ,YAAY,EAAE,KAAmD;CAC7E,IAAI,QACF,eACA,EAAE,QACJ;CACA,IAAI,QACF,eACA,EAAE,QACJ;CACA,IAAI,QACF,kBACA,EAAE,WACJ;CACA,IAAI,QACF,uBACA,EAAE,gBACJ;CACA,IAAI,QACF,kBACA,EAAE,WACJ;CACA,IAAI,QACF,oBACA,EAAE,aACJ;CACA,IAAI,QACF,wBACA,EAAE,iBAGJ;CAEA,OAAO;AACT"}

package/dist/http-client-BVF3iktR.cjs

@@ -0,0 +1,211 @@
+const require_constants = require("./constants-CcbhOaAP.cjs");
+const require_routes = require("./routes-DpAzgY1V.cjs");
+const require_api_path = require("./api-path-2Ulruz7R.cjs");
+const require_parse_error_response = require("./parse-error-response-6qOQS5y9.cjs");
+const require_constants$1 = require("./constants-BE1_9Tod.cjs");
+let zod = require("zod");
+// src/http-client.ts
+const AuthServiceResponseSchema = zod.z.object({ data: zod.z.unknown() });
+const AUTH_SERVICE_TIMEOUT = 1e4;
+const extractTokens = (headers) => {
+	const accessToken = headers.get(require_constants.HEADERS.NEW_ACCESS_TOKEN);
+	const refreshToken = headers.get(require_constants.HEADERS.NEW_REFRESH_TOKEN);
+	if (!accessToken || !refreshToken) return void 0;
+	return {
+		accessToken,
+		refreshToken
+	};
+};
+const authFetch = async (path, options = {}) => {
+	const { method = "GET", accessToken, refreshToken, body } = options;
+	const headers = { "content-type": "application/json" };
+	if (accessToken) headers[require_constants.HEADERS.AUTHORIZATION] = `Bearer ${accessToken}`;
+	if (refreshToken) headers[require_constants.HEADERS.REFRESH_TOKEN] = refreshToken;
+	try {
+		const res = await fetch(`${require_constants$1.getAuthServiceUrl()}${path}`, {
+			method,
+			headers,
+			signal: AbortSignal.timeout(AUTH_SERVICE_TIMEOUT),
+			...body ? { body: JSON.stringify(body) } : {}
+		});
+		if (!res.ok) {
+			const body = await res.json().catch(() => null);
+			return {
+				ok: false,
+				error: require_parse_error_response.parseErrorResponse(res.status, body)
+			};
+		}
+		const json = await res.json();
+		const parsed = AuthServiceResponseSchema.safeParse(json);
+		if (!parsed.success) return {
+			ok: false,
+			error: {
+				kind: "sdk",
+				reason: "malformed",
+				message: "Estructura de respuesta inválida",
+				status: 502
+			}
+		};
+		const data = parsed.data.data;
+		if (Array.isArray(data)) return {
+			ok: true,
+			data
+		};
+		if (options.reissuesAccessTokenOnly) {
+			const accessToken = res.headers.get(require_constants.HEADERS.NEW_ACCESS_TOKEN);
+			return {
+				ok: true,
+				data: {
+					...data,
+					...accessToken ? { accessToken } : {}
+				}
+			};
+		}
+		const tokens = extractTokens(res.headers);
+		return {
+			ok: true,
+			data: {
+				...data,
+				...tokens ? { tokens } : {}
+			}
+		};
+	} catch (err) {
+		if (require_parse_error_response.isEvaAuthConfigError(err)) throw err;
+		return {
+			ok: false,
+			error: {
+				kind: "sdk",
+				reason: "network",
+				message: err instanceof Error ? err.message : "Error de red",
+				status: 0
+			}
+		};
+	}
+};
+/**
+* Solicita un código OTP. En éxito devuelve `{ message, challengeId }`:
+* `challengeId` es opaco, el caller debe conservarlo (en memoria) y enviarlo a
+* `login`; cada `getCode` nuevo invalida el `challengeId` anterior.
+* El tipo es un cast: la respuesta del Auth Service no se parsea en runtime.
+*/
+const getCode = (params) => authFetch(require_api_path.apiPath(require_routes.AUTH_ROUTES.getCode), {
+	method: "POST",
+	body: { phone: params.phone }
+});
+/**
+* Verifica el código OTP. `challengeId` es obligatorio: debe ser el que
+* devolvió el `getCode` que originó el código; sin el desafío vigente el Auth
+* Service responde 401 sin consumir intentos.
+*
+* El `producto` del login sale SIEMPRE de `configureEvaAuth({ product })`, nunca del llamador: el
+* access token queda emitido para ese producto. `empresaId` (opcional) deja esa empresa activa en
+* la sesión si la persona pertenece a ella.
+*
+* @throws Error de configuración (`EvaAuthConfigError`) si falta `configureEvaAuth({ product })`.
+*/
+const login = (params) => {
+	const { phone, code, challengeId, empresaId, deviceType, os, browser, userAgent } = params;
+	return authFetch(require_api_path.apiPath(require_routes.AUTH_ROUTES.login), {
+		method: "POST",
+		body: {
+			phone,
+			code,
+			challengeId,
+			producto: require_parse_error_response.getProduct(),
+			...empresaId !== void 0 && { empresaId },
+			deviceType,
+			os,
+			browser,
+			userAgent
+		}
+	});
+};
+/**
+* Cambia la empresa activa de la sesión (`null` la deja sin empresa). Auth reemite SOLO el access
+* token (`x-eva-new-access-token`; el refresh no rota): llega en `accessToken`. Auth valida la
+* pertenencia; si la persona no pertenece, responde error.
+*/
+const setActiveEmpresa = (params) => authFetch(require_api_path.apiPath(require_routes.AUTH_ROUTES.setActiveEmpresa), {
+	method: "POST",
+	accessToken: params.accessToken,
+	body: { empresaId: params.empresaId },
+	reissuesAccessTokenOnly: true
+});
+const refresh = (params) => authFetch(require_api_path.apiPath(require_routes.AUTH_ROUTES.refresh), {
+	method: "POST",
+	refreshToken: params.refreshToken
+});
+const logout = (params) => authFetch(require_api_path.apiPath(require_routes.AUTH_ROUTES.logout), {
+	method: "POST",
+	refreshToken: params.refreshToken
+});
+const getUser = (params) => authFetch(require_api_path.apiPath(require_routes.USER_ROUTES.get), { accessToken: params.accessToken });
+const updateUser = (params) => authFetch(require_api_path.apiPath(require_routes.USER_ROUTES.update), {
+	method: "PATCH",
+	accessToken: params.accessToken,
+	body: params.data
+});
+const deleteUser = (params) => authFetch(require_api_path.apiPath(require_routes.USER_ROUTES.deactivate), {
+	method: "DELETE",
+	accessToken: params.accessToken
+});
+const getUserEmpresas = (params) => authFetch(require_api_path.apiPath(require_routes.USER_ROUTES.listCompanies), { accessToken: params.accessToken });
+/**
+* Busca en el directorio de empresas (solo las activas que optaron por aparecer; solo campos de
+* perfil público; 50 por página). Basta el access token de usuario de CUALQUIER producto habilitado:
+* Auth limita los pedidos por usuario. La siguiente página se pide con el `nextCursor` recibido.
+*/
+const getDirectorio = (params) => {
+	const { accessToken, ...filters } = params;
+	const query = new URLSearchParams();
+	for (const [key, value] of Object.entries(filters)) if (value !== void 0) query.set(key, String(value));
+	const qs = query.toString();
+	return authFetch(`${require_api_path.apiPath(require_routes.DIRECTORIO_ROUTES.search)}${qs === "" ? "" : `?${qs}`}`, { accessToken });
+};
+const getSessions = (params) => authFetch(require_api_path.apiPath(require_routes.SESSION_ROUTES.list), { accessToken: params.accessToken });
+const deleteSession = (params) => {
+	if (!/^[\w-]+$/.test(params.sessionId)) return Promise.resolve({
+		ok: false,
+		error: {
+			kind: "sdk",
+			reason: "malformed",
+			message: "ID de sesión inválido",
+			status: 400
+		}
+	});
+	return authFetch(require_api_path.apiPath(require_routes.SESSION_ROUTES.deleteOne, { id: params.sessionId }), {
+		method: "DELETE",
+		accessToken: params.accessToken
+	});
+};
+const deleteAllSessions = (params) => authFetch(require_api_path.apiPath(require_routes.SESSION_ROUTES.deleteAll), {
+	method: "DELETE",
+	refreshToken: params.refreshToken
+});
+const health = () => authFetch("/health");
+function createHttpClient() {
+	return {
+		getCode,
+		login,
+		setActiveEmpresa,
+		refresh,
+		logout,
+		getUser,
+		updateUser,
+		deleteUser,
+		getUserEmpresas,
+		getDirectorio,
+		getSessions,
+		deleteSession,
+		deleteAllSessions,
+		health
+	};
+}
+Object.defineProperty(exports, "createHttpClient", {
+	enumerable: true,
+	get: function() {
+		return createHttpClient;
+	}
+});
+
+//# sourceMappingURL=http-client-BVF3iktR.cjs.map

package/dist/http-client-BVF3iktR.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-client-BVF3iktR.cjs","names":["z","HEADERS","getAuthServiceUrl","parseErrorResponse","isEvaAuthConfigError","apiPath","AUTH_ROUTES","getProduct","USER_ROUTES","DIRECTORIO_ROUTES","SESSION_ROUTES"],"sources":["../src/http-client.ts"],"sourcesContent":["import { z } from 'zod'\nimport {\n  AUTH_ROUTES,\n  DIRECTORIO_ROUTES,\n  SESSION_ROUTES,\n  USER_ROUTES,\n} from '@eva_solutions/auth-contracts'\nimport type {\n  DirectorioQuery,\n  DirectorioResponse,\n} from '@eva_solutions/auth-contracts'\nimport { apiPath } from './api-path'\nimport { getProduct, isEvaAuthConfigError } from './config'\nimport { HEADERS, getAuthServiceUrl } from './constants'\nimport { parseErrorResponse } from './parse-error-response'\nimport type {\n  EvaUser,\n  EvaSession,\n  EvaEmpresa,\n  Result,\n  TokenPair,\n  DeviceInfo,\n} from './types'\n\nconst AuthServiceResponseSchema = z.object({\n  data: z.unknown(),\n})\n\nconst AUTH_SERVICE_TIMEOUT = 10_000\n\ntype FetchOptions = {\n  method?: string\n  accessToken?: string\n  refreshToken?: string\n  body?: unknown\n  /** La respuesta reemite solo el access token (`x-eva-new-access-token`); el refresh no rota. */\n  reissuesAccessTokenOnly?: boolean\n}\n\nconst extractTokens = (headers: Headers): TokenPair | undefined => {\n  const accessToken = headers.get(HEADERS.NEW_ACCESS_TOKEN)\n  const refreshToken = headers.get(HEADERS.NEW_REFRESH_TOKEN)\n  if (!accessToken || !refreshToken) return undefined\n  return { accessToken, refreshToken }\n}\n\nconst authFetch = async <T>(\n  path: string,\n  options: FetchOptions = {},\n): Promise<Result<T & { tokens?: TokenPair }>> => {\n  const { method = 'GET', accessToken, refreshToken, body } = options\n\n  const headers: Record<string, string> = {\n    'content-type': 'application/json',\n  }\n\n  if (accessToken) headers[HEADERS.AUTHORIZATION] = `Bearer ${accessToken}`\n  if (refreshToken) headers[HEADERS.REFRESH_TOKEN] = refreshToken\n\n  try {\n    const res = await fetch(`${getAuthServiceUrl()}${path}`, {\n      method,\n      headers,\n      signal: AbortSignal.timeout(AUTH_SERVICE_TIMEOUT),\n      ...(body ? { body: JSON.stringify(body) } : {}),\n    })\n\n    if (!res.ok) {\n      const body = await res.json().catch(() => null)\n      return { ok: false, error: parseErrorResponse(res.status, body) }\n    }\n\n    const json: unknown = await res.json()\n    const parsed = AuthServiceResponseSchema.safeParse(json)\n    if (!parsed.success) {\n      return {\n        ok: false,\n        error: {\n          kind: 'sdk',\n          reason: 'malformed',\n          message: 'Estructura de respuesta inválida',\n          status: 502,\n        },\n      }\n    }\n    const data = parsed.data.data as T\n    // Un array (`/sessions`, `/user/empresas`) se devuelve intacto: esparcirlo en un objeto lo\n    // convertiria en `{ \"0\": …, \"1\": … }`. Esos endpoints se piden solo con access token, asi que\n    // no hay tokens nuevos que adjuntar.\n    if (Array.isArray(data))\n      return { ok: true, data: data as T & { tokens?: TokenPair } }\n\n    if (options.reissuesAccessTokenOnly) {\n      const accessToken = res.headers.get(HEADERS.NEW_ACCESS_TOKEN)\n      return {\n        ok: true,\n        data: { ...data, ...(accessToken ? { accessToken } : {}) },\n      }\n    }\n\n    const tokens = extractTokens(res.headers)\n\n    return { ok: true, data: { ...data, ...(tokens ? { tokens } : {}) } }\n  } catch (err) {\n    // Falta de configuración (authUrl): error del consumidor, no una falla de red.\n    if (isEvaAuthConfigError(err)) throw err\n    const message = err instanceof Error ? err.message : 'Error de red'\n    return {\n      ok: false,\n      error: { kind: 'sdk', reason: 'network', message, status: 0 },\n    }\n  }\n}\n\n/**\n * Solicita un código OTP. En éxito devuelve `{ message, challengeId }`:\n * `challengeId` es opaco, el caller debe conservarlo (en memoria) y enviarlo a\n * `login`; cada `getCode` nuevo invalida el `challengeId` anterior.\n * El tipo es un cast: la respuesta del Auth Service no se parsea en runtime.\n */\nconst getCode = (params: {\n  phone: string\n}): Promise<Result<{ message: string; challengeId: string }>> =>\n  authFetch(apiPath(AUTH_ROUTES.getCode), {\n    method: 'POST',\n    body: { phone: params.phone },\n  })\n\n/**\n * Verifica el código OTP. `challengeId` es obligatorio: debe ser el que\n * devolvió el `getCode` que originó el código; sin el desafío vigente el Auth\n * Service responde 401 sin consumir intentos.\n *\n * El `producto` del login sale SIEMPRE de `configureEvaAuth({ product })`, nunca del llamador: el\n * access token queda emitido para ese producto. `empresaId` (opcional) deja esa empresa activa en\n * la sesión si la persona pertenece a ella.\n *\n * @throws Error de configuración (`EvaAuthConfigError`) si falta `configureEvaAuth({ product })`.\n */\nconst login = (\n  params: {\n    phone: string\n    code: string\n    challengeId: string\n    empresaId?: string\n  } & DeviceInfo,\n): Promise<Result<{ user: { id: string }; tokens?: TokenPair }>> => {\n  const {\n    phone,\n    code,\n    challengeId,\n    empresaId,\n    deviceType,\n    os,\n    browser,\n    userAgent,\n  } = params\n  return authFetch(apiPath(AUTH_ROUTES.login), {\n    method: 'POST',\n    body: {\n      phone,\n      code,\n      challengeId,\n      producto: getProduct(),\n      ...(empresaId !== undefined && { empresaId }),\n      deviceType,\n      os,\n      browser,\n      userAgent,\n    },\n  })\n}\n\n/**\n * Cambia la empresa activa de la sesión (`null` la deja sin empresa). Auth reemite SOLO el access\n * token (`x-eva-new-access-token`; el refresh no rota): llega en `accessToken`. Auth valida la\n * pertenencia; si la persona no pertenece, responde error.\n */\nconst setActiveEmpresa = (params: {\n  accessToken: string\n  empresaId: string | null\n}): Promise<Result<{ empresaId: string | null; accessToken?: string }>> =>\n  authFetch(apiPath(AUTH_ROUTES.setActiveEmpresa), {\n    method: 'POST',\n    accessToken: params.accessToken,\n    body: { empresaId: params.empresaId },\n    reissuesAccessTokenOnly: true,\n  })\n\nconst refresh = (params: {\n  refreshToken: string\n}): Promise<Result<{ user: { id: string }; tokens?: TokenPair }>> =>\n  authFetch(apiPath(AUTH_ROUTES.refresh), {\n    method: 'POST',\n    refreshToken: params.refreshToken,\n  })\n\nconst logout = (params: {\n  refreshToken: string\n}): Promise<Result<{ message: string }>> =>\n  authFetch(apiPath(AUTH_ROUTES.logout), {\n    method: 'POST',\n    refreshToken: params.refreshToken,\n  })\n\nconst getUser = (params: { accessToken: string }): Promise<Result<EvaUser>> =>\n  authFetch(apiPath(USER_ROUTES.get), { accessToken: params.accessToken })\n\nconst updateUser = (params: {\n  accessToken: string\n  data: Record<string, unknown>\n}): Promise<Result<EvaUser>> =>\n  authFetch(apiPath(USER_ROUTES.update), {\n    method: 'PATCH',\n    accessToken: params.accessToken,\n    body: params.data,\n  })\n\nconst deleteUser = (params: {\n  accessToken: string\n}): Promise<Result<{ message: string }>> =>\n  authFetch(apiPath(USER_ROUTES.deactivate), {\n    method: 'DELETE',\n    accessToken: params.accessToken,\n  })\n\nconst getUserEmpresas = (params: {\n  accessToken: string\n}): Promise<Result<EvaEmpresa[]>> =>\n  authFetch(apiPath(USER_ROUTES.listCompanies), {\n    accessToken: params.accessToken,\n  })\n\n/**\n * Busca en el directorio de empresas (solo las activas que optaron por aparecer; solo campos de\n * perfil público; 50 por página). Basta el access token de usuario de CUALQUIER producto habilitado:\n * Auth limita los pedidos por usuario. La siguiente página se pide con el `nextCursor` recibido.\n */\nconst getDirectorio = (\n  params: { accessToken: string } & DirectorioQuery,\n): Promise<Result<DirectorioResponse['data']>> => {\n  const { accessToken, ...filters } = params\n  const query = new URLSearchParams()\n  for (const [key, value] of Object.entries(filters)) {\n    if (value !== undefined) query.set(key, String(value))\n  }\n  const qs = query.toString()\n  return authFetch(\n    `${apiPath(DIRECTORIO_ROUTES.search)}${qs === '' ? '' : `?${qs}`}`,\n    { accessToken },\n  )\n}\n\nconst getSessions = (params: {\n  accessToken: string\n}): Promise<Result<EvaSession[]>> =>\n  authFetch(apiPath(SESSION_ROUTES.list), { accessToken: params.accessToken })\n\nconst deleteSession = (params: {\n  accessToken: string\n  sessionId: string\n}): Promise<Result<{ message: string }>> => {\n  if (!/^[\\w-]+$/.test(params.sessionId)) {\n    return Promise.resolve({\n      ok: false,\n      error: {\n        kind: 'sdk',\n        reason: 'malformed',\n        message: 'ID de sesión inválido',\n        status: 400,\n      },\n    })\n  }\n  return authFetch(\n    apiPath(SESSION_ROUTES.deleteOne, { id: params.sessionId }),\n    {\n      method: 'DELETE',\n      accessToken: params.accessToken,\n    },\n  )\n}\n\nconst deleteAllSessions = (params: {\n  refreshToken: string\n}): Promise<Result<{ message: string; count: number }>> =>\n  authFetch(apiPath(SESSION_ROUTES.deleteAll), {\n    method: 'DELETE',\n    refreshToken: params.refreshToken,\n  })\n\n// Every other route is built with `apiPath` (`API_PREFIX + path`); health is an operational probe\n// that the API serves at the root, outside the versioned prefix.\nconst health = (): Promise<Result<{ status: string }>> => authFetch('/health')\n\nexport function createHttpClient() {\n  return {\n    getCode,\n    login,\n    setActiveEmpresa,\n    refresh,\n    logout,\n    getUser,\n    updateUser,\n    deleteUser,\n    getUserEmpresas,\n    getDirectorio,\n    getSessions,\n    deleteSession,\n    deleteAllSessions,\n    health,\n  }\n}\n\nexport type EvaHttpClient = ReturnType<typeof createHttpClient>\n"],"mappings":";;;;;;;AAwBA,MAAM,4BAA4BA,IAAAA,EAAE,OAAO,EACzC,MAAMA,IAAAA,EAAE,QAAQ,EAClB,CAAC;AAED,MAAM,uBAAuB;AAW7B,MAAM,iBAAiB,YAA4C;CACjE,MAAM,cAAc,QAAQ,IAAIC,kBAAAA,QAAQ,gBAAgB;CACxD,MAAM,eAAe,QAAQ,IAAIA,kBAAAA,QAAQ,iBAAiB;CAC1D,IAAI,CAAC,eAAe,CAAC,cAAc,OAAO,KAAA;CAC1C,OAAO;EAAE;EAAa;CAAa;AACrC;AAEA,MAAM,YAAY,OAChB,MACA,UAAwB,CAAC,MACuB;CAChD,MAAM,EAAE,SAAS,OAAO,aAAa,cAAc,SAAS;CAE5D,MAAM,UAAkC,EACtC,gBAAgB,mBAClB;CAEA,IAAI,aAAa,QAAQA,kBAAAA,QAAQ,iBAAiB,UAAU;CAC5D,IAAI,cAAc,QAAQA,kBAAAA,QAAQ,iBAAiB;CAEnD,IAAI;EACF,MAAM,MAAM,MAAM,MAAM,GAAGC,oBAAAA,kBAAkB,IAAI,QAAQ;GACvD;GACA;GACA,QAAQ,YAAY,QAAQ,oBAAoB;GAChD,GAAI,OAAO,EAAE,MAAM,KAAK,UAAU,IAAI,EAAE,IAAI,CAAC;EAC/C,CAAC;EAED,IAAI,CAAC,IAAI,IAAI;GACX,MAAM,OAAO,MAAM,IAAI,KAAK,CAAC,CAAC,YAAY,IAAI;GAC9C,OAAO;IAAE,IAAI;IAAO,OAAOC,6BAAAA,mBAAmB,IAAI,QAAQ,IAAI;GAAE;EAClE;EAEA,MAAM,OAAgB,MAAM,IAAI,KAAK;EACrC,MAAM,SAAS,0BAA0B,UAAU,IAAI;EACvD,IAAI,CAAC,OAAO,SACV,OAAO;GACL,IAAI;GACJ,OAAO;IACL,MAAM;IACN,QAAQ;IACR,SAAS;IACT,QAAQ;GACV;EACF;EAEF,MAAM,OAAO,OAAO,KAAK;EAIzB,IAAI,MAAM,QAAQ,IAAI,GACpB,OAAO;GAAE,IAAI;GAAY;EAAmC;EAE9D,IAAI,QAAQ,yBAAyB;GACnC,MAAM,cAAc,IAAI,QAAQ,IAAIF,kBAAAA,QAAQ,gBAAgB;GAC5D,OAAO;IACL,IAAI;IACJ,MAAM;KAAE,GAAG;KAAM,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;IAAG;GAC3D;EACF;EAEA,MAAM,SAAS,cAAc,IAAI,OAAO;EAExC,OAAO;GAAE,IAAI;GAAM,MAAM;IAAE,GAAG;IAAM,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;GAAG;EAAE;CACtE,SAAS,KAAK;EAEZ,IAAIG,6BAAAA,qBAAqB,GAAG,GAAG,MAAM;EAErC,OAAO;GACL,IAAI;GACJ,OAAO;IAAE,MAAM;IAAO,QAAQ;IAAW,SAH3B,eAAe,QAAQ,IAAI,UAAU;IAGD,QAAQ;GAAE;EAC9D;CACF;AACF;;;;;;;AAQA,MAAM,WAAW,WAGf,UAAUC,iBAAAA,QAAQC,eAAAA,YAAY,OAAO,GAAG;CACtC,QAAQ;CACR,MAAM,EAAE,OAAO,OAAO,MAAM;AAC9B,CAAC;;;;;;;;;;;;AAaH,MAAM,SACJ,WAMkE;CAClE,MAAM,EACJ,OACA,MACA,aACA,WACA,YACA,IACA,SACA,cACE;CACJ,OAAO,UAAUD,iBAAAA,QAAQC,eAAAA,YAAY,KAAK,GAAG;EAC3C,QAAQ;EACR,MAAM;GACJ;GACA;GACA;GACA,UAAUC,6BAAAA,WAAW;GACrB,GAAI,cAAc,KAAA,KAAa,EAAE,UAAU;GAC3C;GACA;GACA;GACA;EACF;CACF,CAAC;AACH;;;;;;AAOA,MAAM,oBAAoB,WAIxB,UAAUF,iBAAAA,QAAQC,eAAAA,YAAY,gBAAgB,GAAG;CAC/C,QAAQ;CACR,aAAa,OAAO;CACpB,MAAM,EAAE,WAAW,OAAO,UAAU;CACpC,yBAAyB;AAC3B,CAAC;AAEH,MAAM,WAAW,WAGf,UAAUD,iBAAAA,QAAQC,eAAAA,YAAY,OAAO,GAAG;CACtC,QAAQ;CACR,cAAc,OAAO;AACvB,CAAC;AAEH,MAAM,UAAU,WAGd,UAAUD,iBAAAA,QAAQC,eAAAA,YAAY,MAAM,GAAG;CACrC,QAAQ;CACR,cAAc,OAAO;AACvB,CAAC;AAEH,MAAM,WAAW,WACf,UAAUD,iBAAAA,QAAQG,eAAAA,YAAY,GAAG,GAAG,EAAE,aAAa,OAAO,YAAY,CAAC;AAEzE,MAAM,cAAc,WAIlB,UAAUH,iBAAAA,QAAQG,eAAAA,YAAY,MAAM,GAAG;CACrC,QAAQ;CACR,aAAa,OAAO;CACpB,MAAM,OAAO;AACf,CAAC;AAEH,MAAM,cAAc,WAGlB,UAAUH,iBAAAA,QAAQG,eAAAA,YAAY,UAAU,GAAG;CACzC,QAAQ;CACR,aAAa,OAAO;AACtB,CAAC;AAEH,MAAM,mBAAmB,WAGvB,UAAUH,iBAAAA,QAAQG,eAAAA,YAAY,aAAa,GAAG,EAC5C,aAAa,OAAO,YACtB,CAAC;;;;;;AAOH,MAAM,iBACJ,WACgD;CAChD,MAAM,EAAE,aAAa,GAAG,YAAY;CACpC,MAAM,QAAQ,IAAI,gBAAgB;CAClC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAC/C,IAAI,UAAU,KAAA,GAAW,MAAM,IAAI,KAAK,OAAO,KAAK,CAAC;CAEvD,MAAM,KAAK,MAAM,SAAS;CAC1B,OAAO,UACL,GAAGH,iBAAAA,QAAQI,eAAAA,kBAAkB,MAAM,IAAI,OAAO,KAAK,KAAK,IAAI,QAC5D,EAAE,YAAY,CAChB;AACF;AAEA,MAAM,eAAe,WAGnB,UAAUJ,iBAAAA,QAAQK,eAAAA,eAAe,IAAI,GAAG,EAAE,aAAa,OAAO,YAAY,CAAC;AAE7E,MAAM,iBAAiB,WAGqB;CAC1C,IAAI,CAAC,WAAW,KAAK,OAAO,SAAS,GACnC,OAAO,QAAQ,QAAQ;EACrB,IAAI;EACJ,OAAO;GACL,MAAM;GACN,QAAQ;GACR,SAAS;GACT,QAAQ;EACV;CACF,CAAC;CAEH,OAAO,UACLL,iBAAAA,QAAQK,eAAAA,eAAe,WAAW,EAAE,IAAI,OAAO,UAAU,CAAC,GAC1D;EACE,QAAQ;EACR,aAAa,OAAO;CACtB,CACF;AACF;AAEA,MAAM,qBAAqB,WAGzB,UAAUL,iBAAAA,QAAQK,eAAAA,eAAe,SAAS,GAAG;CAC3C,QAAQ;CACR,cAAc,OAAO;AACvB,CAAC;AAIH,MAAM,eAAoD,UAAU,SAAS;AAE7E,SAAgB,mBAAmB;CACjC,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF"}