@eva_solutions/auth-sdk 0.0.0-stage → 3.0.0-dev-20261109133200

package/dist/admin-Q6lbWqLM.cjs

@@ -0,0 +1,419 @@
+const require_routes = require("./routes-DpAzgY1V.cjs");
+const require_api_path = require("./api-path-2Ulruz7R.cjs");
+const require_parse_error_response = require("./parse-error-response-6qOQS5y9.cjs");
+const require_path_segment = require("./path-segment-C25i6aaH.cjs");
+const require_sign = require("./sign-C7y6xdvT.cjs");
+// src/admin/client.ts
+/**
+* Cliente Admin para provisioning de service clients y gestión de usuarios
+* en el Auth Service.
+*
+* REQ-ADMIN-01, REQ-ADMIN-02, REQ-ADMIN-03, REQ-ADMIN-04, REQ-ADMIN-05 LOCKED.
+* REQ-RESTORE-01 LOCKED: endpoint POST /admin/users/:id/restore.
+*
+* Autenticación: firma HMAC S2S de un service client con la marca `esAdmin` (la superficie
+* `/admin` de Auth es la única, junto con el pedido de token, que conserva la firma). Una persona,
+* un client: el API registra el slug que firmó como `actor`.
+*
+* Endpoints:
+*   POST   /admin/service-clients                       → createServiceClient
+*   GET    /admin/service-clients                       → listServiceClients
+*   GET    /admin/service-clients/:slug                 → getServiceClient
+*   PATCH  /admin/service-clients/:slug                 → updateServiceClient
+*   DELETE /admin/service-clients/:slug                 → deleteServiceClient (204)
+*   POST   /admin/service-clients/:slug/rotate-secret   → rotateServiceClientSecret
+*   GET    /admin/service-clients/:slug/grants          → listServiceClientGrants
+*   PUT    /admin/service-clients/:slug/grants          → setServiceClientGrant
+*   DELETE /admin/service-clients/:slug/grants/:audience → deleteServiceClientGrant (204)
+*   GET    /admin/service-clients/:slug/delegations     → listServiceClientDelegations
+*   PUT    /admin/service-clients/:slug/delegations     → setServiceClientDelegation
+*   DELETE /admin/service-clients/:slug/delegations/:audience → deleteServiceClientDelegation (204)
+*   GET    /admin/productos/:slug/permisos-autorizables → getProductoPermisosAutorizables
+*   PUT    /admin/productos/:slug/permisos-autorizables → setProductoPermisosAutorizables
+*   POST   /admin/empresas/:id/titular                  → reassignEmpresaTitular
+*   POST   /admin/empresas/:id/baja                     → bajaEmpresa
+*   POST   /admin/empresas/:id/reactivar                → reactivarEmpresa
+*   PUT    /admin/empresas/:id/productos/:producto      → setContratacion
+*   GET    /admin/productos                             → listProductos
+*   POST   /admin/productos                             → createProducto (201)
+*   PATCH  /admin/productos/:slug                       → updateProducto
+*   POST   /admin/users/:id/restore                     → restoreUser
+*   POST   /admin/webhooks/republish-pending            → republishPendingWebhooks
+*   POST   /admin/maintenance/cleanup                   → maintenanceCleanup
+*
+* Los paths salen de `ADMIN_ROUTES` (contrato compartido) vía `apiPath`; el slug y el id se
+* codifican como UN segmento con `encodePathSegment` (el mismo helper del cliente S2S) antes de
+* insertarlos. Un slug/id vacío, `.`, `..` o que no sea string devuelve un `Result` de error
+* (`kind: 'sdk'`, `reason: 'malformed'`) sin hacer la request.
+*/
+const encoder = new TextEncoder();
+/**
+* Realiza un fetch autenticado S2S firmando el request con HMAC-SHA-256.
+* Retorna `Result<T>` con la propiedad `data` del body de respuesta.
+*/
+async function adminFetch({ config, method, pathname, rawQuery = "", body }) {
+	try {
+		const bodyBytes = body !== void 0 ? encoder.encode(JSON.stringify(body)) : /* @__PURE__ */ new Uint8Array(0);
+		const url = rawQuery ? `${config.baseUrl}${pathname}?${rawQuery}` : `${config.baseUrl}${pathname}`;
+		const target = new URL(url);
+		const headers = {
+			"content-type": "application/json",
+			...await require_sign.signS2SHeaders({
+				method,
+				path: target.pathname,
+				rawQuery: target.search.slice(1),
+				bodyBytes,
+				clientId: config.clientId,
+				secretHex: config.secretHex
+			})
+		};
+		const res = await fetch(url, {
+			method,
+			headers,
+			body: bodyBytes.length > 0 ? JSON.stringify(body) : void 0,
+			signal: AbortSignal.timeout(1e4)
+		});
+		if (!res.ok) {
+			const responseBody = await res.json().catch(() => null);
+			return {
+				ok: false,
+				error: require_parse_error_response.parseErrorResponse(res.status, responseBody)
+			};
+		}
+		if (res.status === 204) return {
+			ok: true,
+			data: void 0
+		};
+		return {
+			ok: true,
+			data: (await res.json()).data
+		};
+	} catch (err) {
+		return {
+			ok: false,
+			error: {
+				kind: "sdk",
+				reason: "network",
+				message: err instanceof Error ? err.message : "Network error",
+				status: 0
+			}
+		};
+	}
+}
+/**
+* Result de error para un slug/id que no se puede usar como segmento del path. Se devuelve antes
+* de armar la URL: `apiPath` lanzaría con un param ausente y la promesa se rechazaría.
+*/
+function invalidParamResult(method, param) {
+	return {
+		ok: false,
+		error: {
+			kind: "sdk",
+			reason: "malformed",
+			message: `${method}: ${param} inválido (no puede ser vacío, "." ni "..")`,
+			status: 0
+		}
+	};
+}
+/**
+* Crea un cliente Admin para provisioning del Auth Service.
+*
+* ADVERTENCIA: solo usar desde backends o herramientas de operador seguras — el secret del
+* service client admin nunca debe exponerse en el cliente/browser.
+*
+* @example
+* ```ts
+* const admin = createAdminClient({
+*   clientId: process.env.AUTH_ADMIN_SLUG,
+*   secretHex: process.env.AUTH_ADMIN_SECRET,
+*   baseUrl: 'https://auth.miapp.com',
+* })
+* const result = await admin.createServiceClient({ slug: 'mi-servicio' })
+* if (!result.ok) return handleError(result.error)
+* console.log('Secret (guardar ahora):', result.data.secret)
+* ```
+*/
+function createAdminClient(config) {
+	require_parse_error_response.validateHttpsUrl(config.baseUrl, "AdminClientConfig.baseUrl");
+	return {
+		async createServiceClient(input) {
+			return adminFetch({
+				config,
+				method: "POST",
+				pathname: require_api_path.apiPath(require_routes.ADMIN_ROUTES.createServiceClient),
+				body: input
+			});
+		},
+		async listServiceClients() {
+			return adminFetch({
+				config,
+				method: "GET",
+				pathname: require_api_path.apiPath(require_routes.ADMIN_ROUTES.listServiceClients)
+			});
+		},
+		async getServiceClient(slug) {
+			const segment = require_path_segment.encodePathSegment(slug);
+			if (segment === null) return invalidParamResult("getServiceClient", "slug");
+			return adminFetch({
+				config,
+				method: "GET",
+				pathname: require_api_path.apiPath(require_routes.ADMIN_ROUTES.getServiceClient, { slug: segment })
+			});
+		},
+		async updateServiceClient(slug, input) {
+			const segment = require_path_segment.encodePathSegment(slug);
+			if (segment === null) return invalidParamResult("updateServiceClient", "slug");
+			return adminFetch({
+				config,
+				method: "PATCH",
+				pathname: require_api_path.apiPath(require_routes.ADMIN_ROUTES.updateServiceClient, { slug: segment }),
+				body: input
+			});
+		},
+		async deleteServiceClient(slug) {
+			const segment = require_path_segment.encodePathSegment(slug);
+			if (segment === null) return invalidParamResult("deleteServiceClient", "slug");
+			return adminFetch({
+				config,
+				method: "DELETE",
+				pathname: require_api_path.apiPath(require_routes.ADMIN_ROUTES.deleteServiceClient, { slug: segment })
+			});
+		},
+		async rotateServiceClientSecret(slug) {
+			const segment = require_path_segment.encodePathSegment(slug);
+			if (segment === null) return invalidParamResult("rotateServiceClientSecret", "slug");
+			return adminFetch({
+				config,
+				method: "POST",
+				pathname: require_api_path.apiPath(require_routes.ADMIN_ROUTES.rotateServiceClientSecret, { slug: segment })
+			});
+		},
+		async listServiceClientGrants(slug) {
+			const segment = require_path_segment.encodePathSegment(slug);
+			if (segment === null) return invalidParamResult("listServiceClientGrants", "slug");
+			return adminFetch({
+				config,
+				method: "GET",
+				pathname: require_api_path.apiPath(require_routes.ADMIN_ROUTES.listServiceClientGrants, { slug: segment })
+			});
+		},
+		async setServiceClientGrant(slug, input) {
+			const segment = require_path_segment.encodePathSegment(slug);
+			if (segment === null) return invalidParamResult("setServiceClientGrant", "slug");
+			return adminFetch({
+				config,
+				method: "PUT",
+				pathname: require_api_path.apiPath(require_routes.ADMIN_ROUTES.setServiceClientGrant, { slug: segment }),
+				body: input
+			});
+		},
+		async deleteServiceClientGrant(slug, audience) {
+			const segment = require_path_segment.encodePathSegment(slug);
+			if (segment === null) return invalidParamResult("deleteServiceClientGrant", "slug");
+			const audienceSegment = require_path_segment.encodePathSegment(audience);
+			if (audienceSegment === null) return invalidParamResult("deleteServiceClientGrant", "audience");
+			return adminFetch({
+				config,
+				method: "DELETE",
+				pathname: require_api_path.apiPath(require_routes.ADMIN_ROUTES.deleteServiceClientGrant, {
+					slug: segment,
+					audience: audienceSegment
+				})
+			});
+		},
+		async listServiceClientDelegations(slug) {
+			const segment = require_path_segment.encodePathSegment(slug);
+			if (segment === null) return invalidParamResult("listServiceClientDelegations", "slug");
+			return adminFetch({
+				config,
+				method: "GET",
+				pathname: require_api_path.apiPath(require_routes.ADMIN_ROUTES.listServiceClientDelegations, { slug: segment })
+			});
+		},
+		async setServiceClientDelegation(slug, input) {
+			const segment = require_path_segment.encodePathSegment(slug);
+			if (segment === null) return invalidParamResult("setServiceClientDelegation", "slug");
+			return adminFetch({
+				config,
+				method: "PUT",
+				pathname: require_api_path.apiPath(require_routes.ADMIN_ROUTES.setServiceClientDelegation, { slug: segment }),
+				body: input
+			});
+		},
+		async deleteServiceClientDelegation(slug, audience) {
+			const segment = require_path_segment.encodePathSegment(slug);
+			if (segment === null) return invalidParamResult("deleteServiceClientDelegation", "slug");
+			const audienceSegment = require_path_segment.encodePathSegment(audience);
+			if (audienceSegment === null) return invalidParamResult("deleteServiceClientDelegation", "audience");
+			return adminFetch({
+				config,
+				method: "DELETE",
+				pathname: require_api_path.apiPath(require_routes.ADMIN_ROUTES.deleteServiceClientDelegation, {
+					slug: segment,
+					audience: audienceSegment
+				})
+			});
+		},
+		async getProductoPermisosAutorizables(slug) {
+			const segment = require_path_segment.encodePathSegment(slug);
+			if (segment === null) return invalidParamResult("getProductoPermisosAutorizables", "slug");
+			return adminFetch({
+				config,
+				method: "GET",
+				pathname: require_api_path.apiPath(require_routes.ADMIN_ROUTES.getProductoPermisosAutorizables, { slug: segment })
+			});
+		},
+		async setProductoPermisosAutorizables(slug, input) {
+			const segment = require_path_segment.encodePathSegment(slug);
+			if (segment === null) return invalidParamResult("setProductoPermisosAutorizables", "slug");
+			return adminFetch({
+				config,
+				method: "PUT",
+				pathname: require_api_path.apiPath(require_routes.ADMIN_ROUTES.setProductoPermisosAutorizables, { slug: segment }),
+				body: input
+			});
+		},
+		async reassignEmpresaTitular(empresaId, input) {
+			const segment = require_path_segment.encodePathSegment(empresaId);
+			if (segment === null) return invalidParamResult("reassignEmpresaTitular", "empresaId");
+			return adminFetch({
+				config,
+				method: "POST",
+				pathname: require_api_path.apiPath(require_routes.ADMIN_ROUTES.reassignEmpresaTitular, { id: segment }),
+				body: input
+			});
+		},
+		async bajaEmpresa(empresaId) {
+			const segment = require_path_segment.encodePathSegment(empresaId);
+			if (segment === null) return invalidParamResult("bajaEmpresa", "empresaId");
+			return adminFetch({
+				config,
+				method: "POST",
+				pathname: require_api_path.apiPath(require_routes.ADMIN_ROUTES.bajaEmpresa, { id: segment })
+			});
+		},
+		async reactivarEmpresa(empresaId) {
+			const segment = require_path_segment.encodePathSegment(empresaId);
+			if (segment === null) return invalidParamResult("reactivarEmpresa", "empresaId");
+			return adminFetch({
+				config,
+				method: "POST",
+				pathname: require_api_path.apiPath(require_routes.ADMIN_ROUTES.reactivarEmpresa, { id: segment })
+			});
+		},
+		async setContratacion(empresaId, producto, input) {
+			const segment = require_path_segment.encodePathSegment(empresaId);
+			if (segment === null) return invalidParamResult("setContratacion", "empresaId");
+			const productoSegment = require_path_segment.encodePathSegment(producto);
+			if (productoSegment === null) return invalidParamResult("setContratacion", "producto");
+			return adminFetch({
+				config,
+				method: "PUT",
+				pathname: require_api_path.apiPath(require_routes.ADMIN_ROUTES.setContratacion, {
+					id: segment,
+					producto: productoSegment
+				}),
+				body: input
+			});
+		},
+		async listProductos() {
+			return adminFetch({
+				config,
+				method: "GET",
+				pathname: require_api_path.apiPath(require_routes.ADMIN_ROUTES.listProductos)
+			});
+		},
+		async createProducto(input) {
+			return adminFetch({
+				config,
+				method: "POST",
+				pathname: require_api_path.apiPath(require_routes.ADMIN_ROUTES.createProducto),
+				body: input
+			});
+		},
+		async updateProducto(slug, input) {
+			const segment = require_path_segment.encodePathSegment(slug);
+			if (segment === null) return invalidParamResult("updateProducto", "slug");
+			return adminFetch({
+				config,
+				method: "PATCH",
+				pathname: require_api_path.apiPath(require_routes.ADMIN_ROUTES.updateProducto, { slug: segment }),
+				body: input
+			});
+		},
+		async restoreUser(userId) {
+			const segment = require_path_segment.encodePathSegment(userId);
+			if (segment === null) return invalidParamResult("restoreUser", "userId");
+			return adminFetch({
+				config,
+				method: "POST",
+				pathname: require_api_path.apiPath(require_routes.ADMIN_ROUTES.restoreUser, { id: segment })
+			});
+		},
+		async republishPendingWebhooks(query) {
+			const params = new URLSearchParams();
+			if (query?.older_than_minutes !== void 0) params.set("older_than_minutes", String(query.older_than_minutes));
+			if (query?.limit !== void 0) params.set("limit", String(query.limit));
+			return adminFetch({
+				config,
+				method: "POST",
+				pathname: require_api_path.apiPath(require_routes.ADMIN_ROUTES.republishPendingWebhooks),
+				rawQuery: params.toString()
+			});
+		},
+		async maintenanceCleanup(query) {
+			const params = new URLSearchParams();
+			if (query?.limit !== void 0) params.set("limit", String(query.limit));
+			return adminFetch({
+				config,
+				method: "POST",
+				pathname: require_api_path.apiPath(require_routes.ADMIN_ROUTES.maintenanceCleanup),
+				rawQuery: params.toString()
+			});
+		}
+	};
+}
+// src/admin/error-codes.ts
+/**
+* Códigos de error específicos del módulo Admin.
+*
+* Complementan a `ERROR_CODES` (core) para errores que solo ocurren
+* en operaciones de provisioning de service clients.
+*
+* @example
+* ```ts
+* import { ADMIN_ERROR_CODES } from '@eva_solutions/auth-sdk/admin'
+*
+* if (!result.ok && result.error.code === ADMIN_ERROR_CODES.service_client_already_exists) {
+*   return res.status(409).json({ error: 'El service client ya existe' })
+* }
+* ```
+*/
+const ADMIN_ERROR_CODES = {
+	service_client_already_exists: "service_client_already_exists",
+	service_client_not_found: "service_client_not_found",
+	/**
+	* `rotate-secret` perdió contra otra rotación concurrente del mismo service client (409).
+	* El perdedor no recibe secret; es reintentable.
+	*/
+	service_client_secret_rotation_conflict: "service_client_secret_rotation_conflict",
+	/**
+	* La operación dejaría al sistema sin ningún service client admin habilitado (409): borrar,
+	* deshabilitar o quitarle `esAdmin` al último. No se aplica; habilita o crea otro admin.
+	*/
+	last_admin_client: "last_admin_client"
+};
+Object.defineProperty(exports, "ADMIN_ERROR_CODES", {
+	enumerable: true,
+	get: function() {
+		return ADMIN_ERROR_CODES;
+	}
+});
+Object.defineProperty(exports, "createAdminClient", {
+	enumerable: true,
+	get: function() {
+		return createAdminClient;
+	}
+});
+
+//# sourceMappingURL=admin-Q6lbWqLM.cjs.map

package/dist/admin-Q6lbWqLM.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-Q6lbWqLM.cjs","names":["signS2SHeaders","parseErrorResponse","apiPath","ADMIN_ROUTES","encodePathSegment"],"sources":["../src/admin/client.ts","../src/admin/error-codes.ts"],"sourcesContent":["/**\n * Cliente Admin para provisioning de service clients y gestión de usuarios\n * en el Auth Service.\n *\n * REQ-ADMIN-01, REQ-ADMIN-02, REQ-ADMIN-03, REQ-ADMIN-04, REQ-ADMIN-05 LOCKED.\n * REQ-RESTORE-01 LOCKED: endpoint POST /admin/users/:id/restore.\n *\n * Autenticación: firma HMAC S2S de un service client con la marca `esAdmin` (la superficie\n * `/admin` de Auth es la única, junto con el pedido de token, que conserva la firma). Una persona,\n * un client: el API registra el slug que firmó como `actor`.\n *\n * Endpoints:\n *   POST   /admin/service-clients                       → createServiceClient\n *   GET    /admin/service-clients                       → listServiceClients\n *   GET    /admin/service-clients/:slug                 → getServiceClient\n *   PATCH  /admin/service-clients/:slug                 → updateServiceClient\n *   DELETE /admin/service-clients/:slug                 → deleteServiceClient (204)\n *   POST   /admin/service-clients/:slug/rotate-secret   → rotateServiceClientSecret\n *   GET    /admin/service-clients/:slug/grants          → listServiceClientGrants\n *   PUT    /admin/service-clients/:slug/grants          → setServiceClientGrant\n *   DELETE /admin/service-clients/:slug/grants/:audience → deleteServiceClientGrant (204)\n *   GET    /admin/service-clients/:slug/delegations     → listServiceClientDelegations\n *   PUT    /admin/service-clients/:slug/delegations     → setServiceClientDelegation\n *   DELETE /admin/service-clients/:slug/delegations/:audience → deleteServiceClientDelegation (204)\n *   GET    /admin/productos/:slug/permisos-autorizables → getProductoPermisosAutorizables\n *   PUT    /admin/productos/:slug/permisos-autorizables → setProductoPermisosAutorizables\n *   POST   /admin/empresas/:id/titular                  → reassignEmpresaTitular\n *   POST   /admin/empresas/:id/baja                     → bajaEmpresa\n *   POST   /admin/empresas/:id/reactivar                → reactivarEmpresa\n *   PUT    /admin/empresas/:id/productos/:producto      → setContratacion\n *   GET    /admin/productos                             → listProductos\n *   POST   /admin/productos                             → createProducto (201)\n *   PATCH  /admin/productos/:slug                       → updateProducto\n *   POST   /admin/users/:id/restore                     → restoreUser\n *   POST   /admin/webhooks/republish-pending            → republishPendingWebhooks\n *   POST   /admin/maintenance/cleanup                   → maintenanceCleanup\n *\n * Los paths salen de `ADMIN_ROUTES` (contrato compartido) vía `apiPath`; el slug y el id se\n * codifican como UN segmento con `encodePathSegment` (el mismo helper del cliente S2S) antes de\n * insertarlos. Un slug/id vacío, `.`, `..` o que no sea string devuelve un `Result` de error\n * (`kind: 'sdk'`, `reason: 'malformed'`) sin hacer la request.\n */\n\nimport { ADMIN_ROUTES } from '@eva_solutions/auth-contracts'\nimport { apiPath } from '../api-path'\nimport { validateHttpsUrl } from '../config'\nimport { parseErrorResponse } from '../parse-error-response'\nimport { encodePathSegment } from '../path-segment'\nimport { signS2SHeaders } from '../s2s/sign'\nimport type { Result } from '../types'\nimport type {\n  AdminClientConfig,\n  AdminContratacionResult,\n  AdminEmpresaEstadoResult,\n  AdminSetContratacionInput,\n  ListServiceClientDelegationsResult,\n  ProductoPermisosAutorizablesResult,\n  ReassignEmpresaTitularInput,\n  ReassignEmpresaTitularResult,\n  ServiceClientDelegation,\n  SetProductoPermisosAutorizablesInput,\n  SetServiceClientDelegationInput,\n  ServiceClientPublic,\n  CreateServiceClientInput,\n  CreateProductoInput,\n  CreateServiceClientResult,\n  ListProductosResult,\n  ListServiceClientGrantsResult,\n  ProductoResult,\n  UpdateProductoInput,\n  ServiceClientGrant,\n  SetServiceClientGrantInput,\n  UpdateServiceClientInput,\n  UpdateServiceClientResult,\n  RotateSecretResult,\n  RestoreUserResult,\n  MaintenanceCleanupQuery,\n  MaintenanceCleanupResult,\n  RepublishPendingWebhooksQuery,\n  RepublishPendingWebhooksResult,\n} from './types'\n\nconst encoder = new TextEncoder()\n\n/**\n * Tipo del cliente Admin retornado por `createAdminClient`.\n */\nexport type AdminClient = {\n  createServiceClient(\n    input: CreateServiceClientInput,\n  ): Promise<Result<CreateServiceClientResult>>\n  listServiceClients(): Promise<Result<{ clientes: ServiceClientPublic[] }>>\n  getServiceClient(\n    slug: string,\n  ): Promise<Result<{ cliente: ServiceClientPublic }>>\n  updateServiceClient(\n    slug: string,\n    input: UpdateServiceClientInput,\n  ): Promise<Result<UpdateServiceClientResult>>\n  deleteServiceClient(slug: string): Promise<Result<void>>\n  rotateServiceClientSecret(slug: string): Promise<Result<RotateSecretResult>>\n  listServiceClientGrants(\n    slug: string,\n  ): Promise<Result<ListServiceClientGrantsResult>>\n  /** Crea o reemplaza la concesión del client sobre una audiencia. */\n  setServiceClientGrant(\n    slug: string,\n    input: SetServiceClientGrantInput,\n  ): Promise<Result<{ grant: ServiceClientGrant }>>\n  deleteServiceClientGrant(\n    slug: string,\n    audience: string,\n  ): Promise<Result<void>>\n  /** Lista las aristas de delegación del client (token exchange). */\n  listServiceClientDelegations(\n    slug: string,\n  ): Promise<Result<ListServiceClientDelegationsResult>>\n  /** Crea o reemplaza la arista del client hacia una audiencia delegable (`scopes`, `requiere_scope_origen`). */\n  setServiceClientDelegation(\n    slug: string,\n    input: SetServiceClientDelegationInput,\n  ): Promise<Result<{ delegation: ServiceClientDelegation }>>\n  deleteServiceClientDelegation(\n    slug: string,\n    audience: string,\n  ): Promise<Result<void>>\n  /** Permisos entre empresas que el producto puede conceder en nombre de sus empresas. */\n  getProductoPermisosAutorizables(\n    slug: string,\n  ): Promise<Result<ProductoPermisosAutorizablesResult>>\n  /** Reemplaza la lista de permisos autorizables del producto (vacía = ninguno). */\n  setProductoPermisosAutorizables(\n    slug: string,\n    input: SetProductoPermisosAutorizablesInput,\n  ): Promise<Result<ProductoPermisosAutorizablesResult>>\n  /** Reasigna el titular de una empresa (disputa de RUC o empresa sin titular). */\n  reassignEmpresaTitular(\n    empresaId: string,\n    input: ReassignEmpresaTitularInput,\n  ): Promise<Result<ReassignEmpresaTitularResult>>\n  /** Da de baja una empresa (limpia sus sesiones activas; las autorizaciones y contrataciones dejan de valer). */\n  bajaEmpresa(empresaId: string): Promise<Result<AdminEmpresaEstadoResult>>\n  /** Reactiva una empresa de baja. */\n  reactivarEmpresa(empresaId: string): Promise<Result<AdminEmpresaEstadoResult>>\n  /** Escribe el estado y el vencimiento de la contratación de un producto por una empresa (hasta que exista facturación, así se activa a mano). */\n  setContratacion(\n    empresaId: string,\n    producto: string,\n    input: AdminSetContratacionInput,\n  ): Promise<Result<AdminContratacionResult>>\n  /** Lista los productos (la audiencia del access token de usuario). */\n  listProductos(): Promise<Result<ListProductosResult>>\n  /** Crea un producto (201). 409 si el slug existe; 400 si es una audiencia de servicio. */\n  createProducto(input: CreateProductoInput): Promise<Result<ProductoResult>>\n  /** Actualiza `nombre` o `enabled`. 404 si no existe; 400 con body vacío. No hay delete: se deshabilita. */\n  updateProducto(\n    slug: string,\n    input: UpdateProductoInput,\n  ): Promise<Result<ProductoResult>>\n  restoreUser(userId: string): Promise<Result<RestoreUserResult>>\n  republishPendingWebhooks(\n    query?: RepublishPendingWebhooksQuery,\n  ): Promise<Result<RepublishPendingWebhooksResult>>\n  maintenanceCleanup(\n    query?: MaintenanceCleanupQuery,\n  ): Promise<Result<MaintenanceCleanupResult>>\n}\n\n// ---------------------------------------------------------------------------\n// Helper interno\n// ---------------------------------------------------------------------------\n\n/**\n * Realiza un fetch autenticado S2S firmando el request con HMAC-SHA-256.\n * Retorna `Result<T>` con la propiedad `data` del body de respuesta.\n */\nasync function adminFetch<T>({\n  config,\n  method,\n  pathname,\n  rawQuery = '',\n  body,\n}: {\n  config: AdminClientConfig\n  method: string\n  pathname: string\n  rawQuery?: string\n  body?: unknown\n}): Promise<Result<T>> {\n  try {\n    const bodyBytes: Uint8Array =\n      body !== undefined\n        ? encoder.encode(JSON.stringify(body))\n        : new Uint8Array(0)\n\n    const url = rawQuery\n      ? `${config.baseUrl}${pathname}?${rawQuery}`\n      : `${config.baseUrl}${pathname}`\n\n    // Se firma el pathname y el query de la URL FINAL (incluido el prefijo de `baseUrl`), que es\n    // lo que el verificador lee en `request.url`.\n    const target = new URL(url)\n    const authHeaders = await signS2SHeaders({\n      method,\n      path: target.pathname,\n      rawQuery: target.search.slice(1),\n      bodyBytes,\n      clientId: config.clientId,\n      secretHex: config.secretHex,\n    })\n\n    const headers: Record<string, string> = {\n      'content-type': 'application/json',\n      ...authHeaders,\n    }\n\n    const res = await fetch(url, {\n      method,\n      headers,\n      body: bodyBytes.length > 0 ? JSON.stringify(body) : undefined,\n      signal: AbortSignal.timeout(10_000),\n    })\n\n    if (!res.ok) {\n      const responseBody = await res.json().catch(() => null)\n      return { ok: false, error: parseErrorResponse(res.status, responseBody) }\n    }\n\n    // 204 No Content — Result<void>\n    if (res.status === 204) {\n      return { ok: true, data: undefined as T }\n    }\n\n    const json = (await res.json()) as { data: T }\n    return { ok: true, data: json.data }\n  } catch (err) {\n    const message = err instanceof Error ? err.message : 'Network error'\n    return {\n      ok: false,\n      error: {\n        kind: 'sdk',\n        reason: 'network',\n        message,\n        status: 0,\n      },\n    }\n  }\n}\n\n/**\n * Result de error para un slug/id que no se puede usar como segmento del path. Se devuelve antes\n * de armar la URL: `apiPath` lanzaría con un param ausente y la promesa se rechazaría.\n */\nfunction invalidParamResult(method: string, param: string): Result<never> {\n  return {\n    ok: false,\n    error: {\n      kind: 'sdk',\n      reason: 'malformed',\n      message: `${method}: ${param} inválido (no puede ser vacío, \".\" ni \"..\")`,\n      status: 0,\n    },\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Factory\n// ---------------------------------------------------------------------------\n\n/**\n * Crea un cliente Admin para provisioning del Auth Service.\n *\n * ADVERTENCIA: solo usar desde backends o herramientas de operador seguras — el secret del\n * service client admin nunca debe exponerse en el cliente/browser.\n *\n * @example\n * ```ts\n * const admin = createAdminClient({\n *   clientId: process.env.AUTH_ADMIN_SLUG,\n *   secretHex: process.env.AUTH_ADMIN_SECRET,\n *   baseUrl: 'https://auth.miapp.com',\n * })\n * const result = await admin.createServiceClient({ slug: 'mi-servicio' })\n * if (!result.ok) return handleError(result.error)\n * console.log('Secret (guardar ahora):', result.data.secret)\n * ```\n */\nexport function createAdminClient(config: AdminClientConfig): AdminClient {\n  validateHttpsUrl(config.baseUrl, 'AdminClientConfig.baseUrl')\n  return {\n    async createServiceClient(\n      input: CreateServiceClientInput,\n    ): Promise<Result<CreateServiceClientResult>> {\n      return adminFetch<CreateServiceClientResult>({\n        config,\n        method: 'POST',\n        pathname: apiPath(ADMIN_ROUTES.createServiceClient),\n        body: input,\n      })\n    },\n\n    async listServiceClients(): Promise<\n      Result<{ clientes: ServiceClientPublic[] }>\n    > {\n      return adminFetch<{ clientes: ServiceClientPublic[] }>({\n        config,\n        method: 'GET',\n        pathname: apiPath(ADMIN_ROUTES.listServiceClients),\n      })\n    },\n\n    async getServiceClient(\n      slug: string,\n    ): Promise<Result<{ cliente: ServiceClientPublic }>> {\n      const segment = encodePathSegment(slug)\n      if (segment === null)\n        return invalidParamResult('getServiceClient', 'slug')\n      return adminFetch<{ cliente: ServiceClientPublic }>({\n        config,\n        method: 'GET',\n        pathname: apiPath(ADMIN_ROUTES.getServiceClient, { slug: segment }),\n      })\n    },\n\n    async updateServiceClient(\n      slug: string,\n      input: UpdateServiceClientInput,\n    ): Promise<Result<UpdateServiceClientResult>> {\n      const segment = encodePathSegment(slug)\n      if (segment === null) {\n        return invalidParamResult('updateServiceClient', 'slug')\n      }\n      return adminFetch<UpdateServiceClientResult>({\n        config,\n        method: 'PATCH',\n        pathname: apiPath(ADMIN_ROUTES.updateServiceClient, { slug: segment }),\n        body: input,\n      })\n    },\n\n    async deleteServiceClient(slug: string): Promise<Result<void>> {\n      const segment = encodePathSegment(slug)\n      if (segment === null) {\n        return invalidParamResult('deleteServiceClient', 'slug')\n      }\n      return adminFetch<void>({\n        config,\n        method: 'DELETE',\n        pathname: apiPath(ADMIN_ROUTES.deleteServiceClient, { slug: segment }),\n      })\n    },\n\n    async rotateServiceClientSecret(\n      slug: string,\n    ): Promise<Result<RotateSecretResult>> {\n      const segment = encodePathSegment(slug)\n      if (segment === null) {\n        return invalidParamResult('rotateServiceClientSecret', 'slug')\n      }\n      return adminFetch<RotateSecretResult>({\n        config,\n        method: 'POST',\n        pathname: apiPath(ADMIN_ROUTES.rotateServiceClientSecret, {\n          slug: segment,\n        }),\n      })\n    },\n\n    async listServiceClientGrants(\n      slug: string,\n    ): Promise<Result<ListServiceClientGrantsResult>> {\n      const segment = encodePathSegment(slug)\n      if (segment === null) {\n        return invalidParamResult('listServiceClientGrants', 'slug')\n      }\n      return adminFetch<ListServiceClientGrantsResult>({\n        config,\n        method: 'GET',\n        pathname: apiPath(ADMIN_ROUTES.listServiceClientGrants, {\n          slug: segment,\n        }),\n      })\n    },\n\n    async setServiceClientGrant(\n      slug: string,\n      input: SetServiceClientGrantInput,\n    ): Promise<Result<{ grant: ServiceClientGrant }>> {\n      const segment = encodePathSegment(slug)\n      if (segment === null) {\n        return invalidParamResult('setServiceClientGrant', 'slug')\n      }\n      return adminFetch<{ grant: ServiceClientGrant }>({\n        config,\n        method: 'PUT',\n        pathname: apiPath(ADMIN_ROUTES.setServiceClientGrant, {\n          slug: segment,\n        }),\n        body: input,\n      })\n    },\n\n    async deleteServiceClientGrant(\n      slug: string,\n      audience: string,\n    ): Promise<Result<void>> {\n      const segment = encodePathSegment(slug)\n      if (segment === null) {\n        return invalidParamResult('deleteServiceClientGrant', 'slug')\n      }\n      const audienceSegment = encodePathSegment(audience)\n      if (audienceSegment === null) {\n        return invalidParamResult('deleteServiceClientGrant', 'audience')\n      }\n      return adminFetch<void>({\n        config,\n        method: 'DELETE',\n        pathname: apiPath(ADMIN_ROUTES.deleteServiceClientGrant, {\n          slug: segment,\n          audience: audienceSegment,\n        }),\n      })\n    },\n\n    async listServiceClientDelegations(\n      slug: string,\n    ): Promise<Result<ListServiceClientDelegationsResult>> {\n      const segment = encodePathSegment(slug)\n      if (segment === null) {\n        return invalidParamResult('listServiceClientDelegations', 'slug')\n      }\n      return adminFetch<ListServiceClientDelegationsResult>({\n        config,\n        method: 'GET',\n        pathname: apiPath(ADMIN_ROUTES.listServiceClientDelegations, {\n          slug: segment,\n        }),\n      })\n    },\n\n    async setServiceClientDelegation(\n      slug: string,\n      input: SetServiceClientDelegationInput,\n    ): Promise<Result<{ delegation: ServiceClientDelegation }>> {\n      const segment = encodePathSegment(slug)\n      if (segment === null) {\n        return invalidParamResult('setServiceClientDelegation', 'slug')\n      }\n      return adminFetch<{ delegation: ServiceClientDelegation }>({\n        config,\n        method: 'PUT',\n        pathname: apiPath(ADMIN_ROUTES.setServiceClientDelegation, {\n          slug: segment,\n        }),\n        body: input,\n      })\n    },\n\n    async deleteServiceClientDelegation(\n      slug: string,\n      audience: string,\n    ): Promise<Result<void>> {\n      const segment = encodePathSegment(slug)\n      if (segment === null) {\n        return invalidParamResult('deleteServiceClientDelegation', 'slug')\n      }\n      const audienceSegment = encodePathSegment(audience)\n      if (audienceSegment === null) {\n        return invalidParamResult('deleteServiceClientDelegation', 'audience')\n      }\n      return adminFetch<void>({\n        config,\n        method: 'DELETE',\n        pathname: apiPath(ADMIN_ROUTES.deleteServiceClientDelegation, {\n          slug: segment,\n          audience: audienceSegment,\n        }),\n      })\n    },\n\n    async getProductoPermisosAutorizables(\n      slug: string,\n    ): Promise<Result<ProductoPermisosAutorizablesResult>> {\n      const segment = encodePathSegment(slug)\n      if (segment === null) {\n        return invalidParamResult('getProductoPermisosAutorizables', 'slug')\n      }\n      return adminFetch<ProductoPermisosAutorizablesResult>({\n        config,\n        method: 'GET',\n        pathname: apiPath(ADMIN_ROUTES.getProductoPermisosAutorizables, {\n          slug: segment,\n        }),\n      })\n    },\n\n    async setProductoPermisosAutorizables(\n      slug: string,\n      input: SetProductoPermisosAutorizablesInput,\n    ): Promise<Result<ProductoPermisosAutorizablesResult>> {\n      const segment = encodePathSegment(slug)\n      if (segment === null) {\n        return invalidParamResult('setProductoPermisosAutorizables', 'slug')\n      }\n      return adminFetch<ProductoPermisosAutorizablesResult>({\n        config,\n        method: 'PUT',\n        pathname: apiPath(ADMIN_ROUTES.setProductoPermisosAutorizables, {\n          slug: segment,\n        }),\n        body: input,\n      })\n    },\n\n    async reassignEmpresaTitular(\n      empresaId: string,\n      input: ReassignEmpresaTitularInput,\n    ): Promise<Result<ReassignEmpresaTitularResult>> {\n      const segment = encodePathSegment(empresaId)\n      if (segment === null) {\n        return invalidParamResult('reassignEmpresaTitular', 'empresaId')\n      }\n      return adminFetch<ReassignEmpresaTitularResult>({\n        config,\n        method: 'POST',\n        pathname: apiPath(ADMIN_ROUTES.reassignEmpresaTitular, { id: segment }),\n        body: input,\n      })\n    },\n\n    async bajaEmpresa(\n      empresaId: string,\n    ): Promise<Result<AdminEmpresaEstadoResult>> {\n      const segment = encodePathSegment(empresaId)\n      if (segment === null) {\n        return invalidParamResult('bajaEmpresa', 'empresaId')\n      }\n      return adminFetch<AdminEmpresaEstadoResult>({\n        config,\n        method: 'POST',\n        pathname: apiPath(ADMIN_ROUTES.bajaEmpresa, { id: segment }),\n      })\n    },\n\n    async reactivarEmpresa(\n      empresaId: string,\n    ): Promise<Result<AdminEmpresaEstadoResult>> {\n      const segment = encodePathSegment(empresaId)\n      if (segment === null) {\n        return invalidParamResult('reactivarEmpresa', 'empresaId')\n      }\n      return adminFetch<AdminEmpresaEstadoResult>({\n        config,\n        method: 'POST',\n        pathname: apiPath(ADMIN_ROUTES.reactivarEmpresa, { id: segment }),\n      })\n    },\n\n    async setContratacion(\n      empresaId: string,\n      producto: string,\n      input: AdminSetContratacionInput,\n    ): Promise<Result<AdminContratacionResult>> {\n      const segment = encodePathSegment(empresaId)\n      if (segment === null) {\n        return invalidParamResult('setContratacion', 'empresaId')\n      }\n      const productoSegment = encodePathSegment(producto)\n      if (productoSegment === null) {\n        return invalidParamResult('setContratacion', 'producto')\n      }\n      return adminFetch<AdminContratacionResult>({\n        config,\n        method: 'PUT',\n        pathname: apiPath(ADMIN_ROUTES.setContratacion, {\n          id: segment,\n          producto: productoSegment,\n        }),\n        body: input,\n      })\n    },\n\n    async listProductos(): Promise<Result<ListProductosResult>> {\n      return adminFetch<ListProductosResult>({\n        config,\n        method: 'GET',\n        pathname: apiPath(ADMIN_ROUTES.listProductos),\n      })\n    },\n\n    async createProducto(\n      input: CreateProductoInput,\n    ): Promise<Result<ProductoResult>> {\n      return adminFetch<ProductoResult>({\n        config,\n        method: 'POST',\n        pathname: apiPath(ADMIN_ROUTES.createProducto),\n        body: input,\n      })\n    },\n\n    async updateProducto(\n      slug: string,\n      input: UpdateProductoInput,\n    ): Promise<Result<ProductoResult>> {\n      const segment = encodePathSegment(slug)\n      if (segment === null) return invalidParamResult('updateProducto', 'slug')\n      return adminFetch<ProductoResult>({\n        config,\n        method: 'PATCH',\n        pathname: apiPath(ADMIN_ROUTES.updateProducto, { slug: segment }),\n        body: input,\n      })\n    },\n\n    async restoreUser(userId: string): Promise<Result<RestoreUserResult>> {\n      const segment = encodePathSegment(userId)\n      if (segment === null) return invalidParamResult('restoreUser', 'userId')\n      return adminFetch<RestoreUserResult>({\n        config,\n        method: 'POST',\n        pathname: apiPath(ADMIN_ROUTES.restoreUser, { id: segment }),\n      })\n    },\n\n    async republishPendingWebhooks(\n      query?: RepublishPendingWebhooksQuery,\n    ): Promise<Result<RepublishPendingWebhooksResult>> {\n      const params = new URLSearchParams()\n      if (query?.older_than_minutes !== undefined) {\n        params.set('older_than_minutes', String(query.older_than_minutes))\n      }\n      if (query?.limit !== undefined) {\n        params.set('limit', String(query.limit))\n      }\n      return adminFetch<RepublishPendingWebhooksResult>({\n        config,\n        method: 'POST',\n        pathname: apiPath(ADMIN_ROUTES.republishPendingWebhooks),\n        rawQuery: params.toString(),\n      })\n    },\n\n    async maintenanceCleanup(\n      query?: MaintenanceCleanupQuery,\n    ): Promise<Result<MaintenanceCleanupResult>> {\n      const params = new URLSearchParams()\n      if (query?.limit !== undefined) {\n        params.set('limit', String(query.limit))\n      }\n      return adminFetch<MaintenanceCleanupResult>({\n        config,\n        method: 'POST',\n        pathname: apiPath(ADMIN_ROUTES.maintenanceCleanup),\n        rawQuery: params.toString(),\n      })\n    },\n  }\n}\n","/**\n * Códigos de error específicos del módulo Admin.\n *\n * Complementan a `ERROR_CODES` (core) para errores que solo ocurren\n * en operaciones de provisioning de service clients.\n *\n * @example\n * ```ts\n * import { ADMIN_ERROR_CODES } from '@eva_solutions/auth-sdk/admin'\n *\n * if (!result.ok && result.error.code === ADMIN_ERROR_CODES.service_client_already_exists) {\n *   return res.status(409).json({ error: 'El service client ya existe' })\n * }\n * ```\n */\nexport const ADMIN_ERROR_CODES = {\n  service_client_already_exists: 'service_client_already_exists',\n  service_client_not_found: 'service_client_not_found',\n  /**\n   * `rotate-secret` perdió contra otra rotación concurrente del mismo service client (409).\n   * El perdedor no recibe secret; es reintentable.\n   */\n  service_client_secret_rotation_conflict:\n    'service_client_secret_rotation_conflict',\n  /**\n   * La operación dejaría al sistema sin ningún service client admin habilitado (409): borrar,\n   * deshabilitar o quitarle `esAdmin` al último. No se aplica; habilita o crea otro admin.\n   */\n  last_admin_client: 'last_admin_client',\n} as const\n\n/** Unión de literales de los error codes específicos del módulo Admin. */\nexport type AdminErrorCode =\n  (typeof ADMIN_ERROR_CODES)[keyof typeof ADMIN_ERROR_CODES]\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkFA,MAAM,UAAU,IAAI,YAAY;;;;;AA8FhC,eAAe,WAAc,EAC3B,QACA,QACA,UACA,WAAW,IACX,QAOqB;CACrB,IAAI;EACF,MAAM,YACJ,SAAS,KAAA,IACL,QAAQ,OAAO,KAAK,UAAU,IAAI,CAAC,oBACnC,IAAI,WAAW,CAAC;EAEtB,MAAM,MAAM,WACR,GAAG,OAAO,UAAU,SAAS,GAAG,aAChC,GAAG,OAAO,UAAU;EAIxB,MAAM,SAAS,IAAI,IAAI,GAAG;EAU1B,MAAM,UAAkC;GACtC,gBAAgB;GAChB,GAAG,MAXqBA,aAAAA,eAAe;IACvC;IACA,MAAM,OAAO;IACb,UAAU,OAAO,OAAO,MAAM,CAAC;IAC/B;IACA,UAAU,OAAO;IACjB,WAAW,OAAO;GACpB,CAAC;EAKD;EAEA,MAAM,MAAM,MAAM,MAAM,KAAK;GAC3B;GACA;GACA,MAAM,UAAU,SAAS,IAAI,KAAK,UAAU,IAAI,IAAI,KAAA;GACpD,QAAQ,YAAY,QAAQ,GAAM;EACpC,CAAC;EAED,IAAI,CAAC,IAAI,IAAI;GACX,MAAM,eAAe,MAAM,IAAI,KAAK,CAAC,CAAC,YAAY,IAAI;GACtD,OAAO;IAAE,IAAI;IAAO,OAAOC,6BAAAA,mBAAmB,IAAI,QAAQ,YAAY;GAAE;EAC1E;EAGA,IAAI,IAAI,WAAW,KACjB,OAAO;GAAE,IAAI;GAAM,MAAM,KAAA;EAAe;EAI1C,OAAO;GAAE,IAAI;GAAM,OAAM,MADL,IAAI,KAAK,EAAA,CACC;EAAK;CACrC,SAAS,KAAK;EAEZ,OAAO;GACL,IAAI;GACJ,OAAO;IACL,MAAM;IACN,QAAQ;IACR,SANY,eAAe,QAAQ,IAAI,UAAU;IAOjD,QAAQ;GACV;EACF;CACF;AACF;;;;;AAMA,SAAS,mBAAmB,QAAgB,OAA8B;CACxE,OAAO;EACL,IAAI;EACJ,OAAO;GACL,MAAM;GACN,QAAQ;GACR,SAAS,GAAG,OAAO,IAAI,MAAM;GAC7B,QAAQ;EACV;CACF;AACF;;;;;;;;;;;;;;;;;;;AAwBA,SAAgB,kBAAkB,QAAwC;CACxE,6BAAA,iBAAiB,OAAO,SAAS,2BAA2B;CAC5D,OAAO;EACL,MAAM,oBACJ,OAC4C;GAC5C,OAAO,WAAsC;IAC3C;IACA,QAAQ;IACR,UAAUC,iBAAAA,QAAQC,eAAAA,aAAa,mBAAmB;IAClD,MAAM;GACR,CAAC;EACH;EAEA,MAAM,qBAEJ;GACA,OAAO,WAAgD;IACrD;IACA,QAAQ;IACR,UAAUD,iBAAAA,QAAQC,eAAAA,aAAa,kBAAkB;GACnD,CAAC;EACH;EAEA,MAAM,iBACJ,MACmD;GACnD,MAAM,UAAUC,qBAAAA,kBAAkB,IAAI;GACtC,IAAI,YAAY,MACd,OAAO,mBAAmB,oBAAoB,MAAM;GACtD,OAAO,WAA6C;IAClD;IACA,QAAQ;IACR,UAAUF,iBAAAA,QAAQC,eAAAA,aAAa,kBAAkB,EAAE,MAAM,QAAQ,CAAC;GACpE,CAAC;EACH;EAEA,MAAM,oBACJ,MACA,OAC4C;GAC5C,MAAM,UAAUC,qBAAAA,kBAAkB,IAAI;GACtC,IAAI,YAAY,MACd,OAAO,mBAAmB,uBAAuB,MAAM;GAEzD,OAAO,WAAsC;IAC3C;IACA,QAAQ;IACR,UAAUF,iBAAAA,QAAQC,eAAAA,aAAa,qBAAqB,EAAE,MAAM,QAAQ,CAAC;IACrE,MAAM;GACR,CAAC;EACH;EAEA,MAAM,oBAAoB,MAAqC;GAC7D,MAAM,UAAUC,qBAAAA,kBAAkB,IAAI;GACtC,IAAI,YAAY,MACd,OAAO,mBAAmB,uBAAuB,MAAM;GAEzD,OAAO,WAAiB;IACtB;IACA,QAAQ;IACR,UAAUF,iBAAAA,QAAQC,eAAAA,aAAa,qBAAqB,EAAE,MAAM,QAAQ,CAAC;GACvE,CAAC;EACH;EAEA,MAAM,0BACJ,MACqC;GACrC,MAAM,UAAUC,qBAAAA,kBAAkB,IAAI;GACtC,IAAI,YAAY,MACd,OAAO,mBAAmB,6BAA6B,MAAM;GAE/D,OAAO,WAA+B;IACpC;IACA,QAAQ;IACR,UAAUF,iBAAAA,QAAQC,eAAAA,aAAa,2BAA2B,EACxD,MAAM,QACR,CAAC;GACH,CAAC;EACH;EAEA,MAAM,wBACJ,MACgD;GAChD,MAAM,UAAUC,qBAAAA,kBAAkB,IAAI;GACtC,IAAI,YAAY,MACd,OAAO,mBAAmB,2BAA2B,MAAM;GAE7D,OAAO,WAA0C;IAC/C;IACA,QAAQ;IACR,UAAUF,iBAAAA,QAAQC,eAAAA,aAAa,yBAAyB,EACtD,MAAM,QACR,CAAC;GACH,CAAC;EACH;EAEA,MAAM,sBACJ,MACA,OACgD;GAChD,MAAM,UAAUC,qBAAAA,kBAAkB,IAAI;GACtC,IAAI,YAAY,MACd,OAAO,mBAAmB,yBAAyB,MAAM;GAE3D,OAAO,WAA0C;IAC/C;IACA,QAAQ;IACR,UAAUF,iBAAAA,QAAQC,eAAAA,aAAa,uBAAuB,EACpD,MAAM,QACR,CAAC;IACD,MAAM;GACR,CAAC;EACH;EAEA,MAAM,yBACJ,MACA,UACuB;GACvB,MAAM,UAAUC,qBAAAA,kBAAkB,IAAI;GACtC,IAAI,YAAY,MACd,OAAO,mBAAmB,4BAA4B,MAAM;GAE9D,MAAM,kBAAkBA,qBAAAA,kBAAkB,QAAQ;GAClD,IAAI,oBAAoB,MACtB,OAAO,mBAAmB,4BAA4B,UAAU;GAElE,OAAO,WAAiB;IACtB;IACA,QAAQ;IACR,UAAUF,iBAAAA,QAAQC,eAAAA,aAAa,0BAA0B;KACvD,MAAM;KACN,UAAU;IACZ,CAAC;GACH,CAAC;EACH;EAEA,MAAM,6BACJ,MACqD;GACrD,MAAM,UAAUC,qBAAAA,kBAAkB,IAAI;GACtC,IAAI,YAAY,MACd,OAAO,mBAAmB,gCAAgC,MAAM;GAElE,OAAO,WAA+C;IACpD;IACA,QAAQ;IACR,UAAUF,iBAAAA,QAAQC,eAAAA,aAAa,8BAA8B,EAC3D,MAAM,QACR,CAAC;GACH,CAAC;EACH;EAEA,MAAM,2BACJ,MACA,OAC0D;GAC1D,MAAM,UAAUC,qBAAAA,kBAAkB,IAAI;GACtC,IAAI,YAAY,MACd,OAAO,mBAAmB,8BAA8B,MAAM;GAEhE,OAAO,WAAoD;IACzD;IACA,QAAQ;IACR,UAAUF,iBAAAA,QAAQC,eAAAA,aAAa,4BAA4B,EACzD,MAAM,QACR,CAAC;IACD,MAAM;GACR,CAAC;EACH;EAEA,MAAM,8BACJ,MACA,UACuB;GACvB,MAAM,UAAUC,qBAAAA,kBAAkB,IAAI;GACtC,IAAI,YAAY,MACd,OAAO,mBAAmB,iCAAiC,MAAM;GAEnE,MAAM,kBAAkBA,qBAAAA,kBAAkB,QAAQ;GAClD,IAAI,oBAAoB,MACtB,OAAO,mBAAmB,iCAAiC,UAAU;GAEvE,OAAO,WAAiB;IACtB;IACA,QAAQ;IACR,UAAUF,iBAAAA,QAAQC,eAAAA,aAAa,+BAA+B;KAC5D,MAAM;KACN,UAAU;IACZ,CAAC;GACH,CAAC;EACH;EAEA,MAAM,gCACJ,MACqD;GACrD,MAAM,UAAUC,qBAAAA,kBAAkB,IAAI;GACtC,IAAI,YAAY,MACd,OAAO,mBAAmB,mCAAmC,MAAM;GAErE,OAAO,WAA+C;IACpD;IACA,QAAQ;IACR,UAAUF,iBAAAA,QAAQC,eAAAA,aAAa,iCAAiC,EAC9D,MAAM,QACR,CAAC;GACH,CAAC;EACH;EAEA,MAAM,gCACJ,MACA,OACqD;GACrD,MAAM,UAAUC,qBAAAA,kBAAkB,IAAI;GACtC,IAAI,YAAY,MACd,OAAO,mBAAmB,mCAAmC,MAAM;GAErE,OAAO,WAA+C;IACpD;IACA,QAAQ;IACR,UAAUF,iBAAAA,QAAQC,eAAAA,aAAa,iCAAiC,EAC9D,MAAM,QACR,CAAC;IACD,MAAM;GACR,CAAC;EACH;EAEA,MAAM,uBACJ,WACA,OAC+C;GAC/C,MAAM,UAAUC,qBAAAA,kBAAkB,SAAS;GAC3C,IAAI,YAAY,MACd,OAAO,mBAAmB,0BAA0B,WAAW;GAEjE,OAAO,WAAyC;IAC9C;IACA,QAAQ;IACR,UAAUF,iBAAAA,QAAQC,eAAAA,aAAa,wBAAwB,EAAE,IAAI,QAAQ,CAAC;IACtE,MAAM;GACR,CAAC;EACH;EAEA,MAAM,YACJ,WAC2C;GAC3C,MAAM,UAAUC,qBAAAA,kBAAkB,SAAS;GAC3C,IAAI,YAAY,MACd,OAAO,mBAAmB,eAAe,WAAW;GAEtD,OAAO,WAAqC;IAC1C;IACA,QAAQ;IACR,UAAUF,iBAAAA,QAAQC,eAAAA,aAAa,aAAa,EAAE,IAAI,QAAQ,CAAC;GAC7D,CAAC;EACH;EAEA,MAAM,iBACJ,WAC2C;GAC3C,MAAM,UAAUC,qBAAAA,kBAAkB,SAAS;GAC3C,IAAI,YAAY,MACd,OAAO,mBAAmB,oBAAoB,WAAW;GAE3D,OAAO,WAAqC;IAC1C;IACA,QAAQ;IACR,UAAUF,iBAAAA,QAAQC,eAAAA,aAAa,kBAAkB,EAAE,IAAI,QAAQ,CAAC;GAClE,CAAC;EACH;EAEA,MAAM,gBACJ,WACA,UACA,OAC0C;GAC1C,MAAM,UAAUC,qBAAAA,kBAAkB,SAAS;GAC3C,IAAI,YAAY,MACd,OAAO,mBAAmB,mBAAmB,WAAW;GAE1D,MAAM,kBAAkBA,qBAAAA,kBAAkB,QAAQ;GAClD,IAAI,oBAAoB,MACtB,OAAO,mBAAmB,mBAAmB,UAAU;GAEzD,OAAO,WAAoC;IACzC;IACA,QAAQ;IACR,UAAUF,iBAAAA,QAAQC,eAAAA,aAAa,iBAAiB;KAC9C,IAAI;KACJ,UAAU;IACZ,CAAC;IACD,MAAM;GACR,CAAC;EACH;EAEA,MAAM,gBAAsD;GAC1D,OAAO,WAAgC;IACrC;IACA,QAAQ;IACR,UAAUD,iBAAAA,QAAQC,eAAAA,aAAa,aAAa;GAC9C,CAAC;EACH;EAEA,MAAM,eACJ,OACiC;GACjC,OAAO,WAA2B;IAChC;IACA,QAAQ;IACR,UAAUD,iBAAAA,QAAQC,eAAAA,aAAa,cAAc;IAC7C,MAAM;GACR,CAAC;EACH;EAEA,MAAM,eACJ,MACA,OACiC;GACjC,MAAM,UAAUC,qBAAAA,kBAAkB,IAAI;GACtC,IAAI,YAAY,MAAM,OAAO,mBAAmB,kBAAkB,MAAM;GACxE,OAAO,WAA2B;IAChC;IACA,QAAQ;IACR,UAAUF,iBAAAA,QAAQC,eAAAA,aAAa,gBAAgB,EAAE,MAAM,QAAQ,CAAC;IAChE,MAAM;GACR,CAAC;EACH;EAEA,MAAM,YAAY,QAAoD;GACpE,MAAM,UAAUC,qBAAAA,kBAAkB,MAAM;GACxC,IAAI,YAAY,MAAM,OAAO,mBAAmB,eAAe,QAAQ;GACvE,OAAO,WAA8B;IACnC;IACA,QAAQ;IACR,UAAUF,iBAAAA,QAAQC,eAAAA,aAAa,aAAa,EAAE,IAAI,QAAQ,CAAC;GAC7D,CAAC;EACH;EAEA,MAAM,yBACJ,OACiD;GACjD,MAAM,SAAS,IAAI,gBAAgB;GACnC,IAAI,OAAO,uBAAuB,KAAA,GAChC,OAAO,IAAI,sBAAsB,OAAO,MAAM,kBAAkB,CAAC;GAEnE,IAAI,OAAO,UAAU,KAAA,GACnB,OAAO,IAAI,SAAS,OAAO,MAAM,KAAK,CAAC;GAEzC,OAAO,WAA2C;IAChD;IACA,QAAQ;IACR,UAAUD,iBAAAA,QAAQC,eAAAA,aAAa,wBAAwB;IACvD,UAAU,OAAO,SAAS;GAC5B,CAAC;EACH;EAEA,MAAM,mBACJ,OAC2C;GAC3C,MAAM,SAAS,IAAI,gBAAgB;GACnC,IAAI,OAAO,UAAU,KAAA,GACnB,OAAO,IAAI,SAAS,OAAO,MAAM,KAAK,CAAC;GAEzC,OAAO,WAAqC;IAC1C;IACA,QAAQ;IACR,UAAUD,iBAAAA,QAAQC,eAAAA,aAAa,kBAAkB;IACjD,UAAU,OAAO,SAAS;GAC5B,CAAC;EACH;CACF;AACF;;;;;;;;;;;;;;;;;ACnoBA,MAAa,oBAAoB;CAC/B,+BAA+B;CAC/B,0BAA0B;;;;;CAK1B,yCACE;;;;;CAKF,mBAAmB;AACrB"}

package/dist/api-path-2Ulruz7R.cjs

@@ -0,0 +1,34 @@
+const require_routes = require("./routes-DpAzgY1V.cjs");
+// src/api-path.ts
+const PATH_PARAM = /\{(\w+)\}/g;
+/**
+* Builds the request path of a contract route: fills every `{param}` of the descriptor path and
+* returns `API_PREFIX + path`. Throws when a param is missing (a programming error, never a
+* runtime condition).
+*
+* Every versioned route is built here, so the prefix lives in this single place. Routes that stay
+* at the root (`/.well-known/jwks.json` in `jwks.ts`, `/health` in `http-client.ts`) do not go
+* through this helper. Requests to `/internal/*` sign the final URL pathname, which already
+* includes the prefix.
+*
+* Import rule (react closure): only `http-client.ts` and the S2S/admin clients import this module,
+* none of them reachable from `src/react`. The by-value import of `API_PREFIX` is safe because it
+* comes from the PURE `routes` module of the contract (no zod). Keep it that way: never import a
+* schema module by value here.
+*/
+function apiPath(route, params = {}) {
+	const filled = route.path.replace(PATH_PARAM, (_match, key) => {
+		const value = params[key];
+		if (value === void 0) throw new Error(`[eva-auth-sdk] missing path param ${key}`);
+		return value;
+	});
+	return `${require_routes.API_PREFIX}${filled}`;
+}
+Object.defineProperty(exports, "apiPath", {
+	enumerable: true,
+	get: function() {
+		return apiPath;
+	}
+});
+
+//# sourceMappingURL=api-path-2Ulruz7R.cjs.map

package/dist/api-path-2Ulruz7R.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-path-2Ulruz7R.cjs","names":["API_PREFIX"],"sources":["../src/api-path.ts"],"sourcesContent":["import { API_PREFIX } from '@eva_solutions/auth-contracts'\nimport type { RouteDescriptor } from '@eva_solutions/auth-contracts'\n\nconst PATH_PARAM = /\\{(\\w+)\\}/g\n\n/**\n * Builds the request path of a contract route: fills every `{param}` of the descriptor path and\n * returns `API_PREFIX + path`. Throws when a param is missing (a programming error, never a\n * runtime condition).\n *\n * Every versioned route is built here, so the prefix lives in this single place. Routes that stay\n * at the root (`/.well-known/jwks.json` in `jwks.ts`, `/health` in `http-client.ts`) do not go\n * through this helper. Requests to `/internal/*` sign the final URL pathname, which already\n * includes the prefix.\n *\n * Import rule (react closure): only `http-client.ts` and the S2S/admin clients import this module,\n * none of them reachable from `src/react`. The by-value import of `API_PREFIX` is safe because it\n * comes from the PURE `routes` module of the contract (no zod). Keep it that way: never import a\n * schema module by value here.\n */\nexport function apiPath(\n  route: RouteDescriptor,\n  params: Readonly<Record<string, string>> = {},\n): string {\n  const filled = route.path.replace(PATH_PARAM, (_match, key: string) => {\n    const value = params[key]\n    if (value === undefined) {\n      throw new Error(`[eva-auth-sdk] missing path param ${key}`)\n    }\n    return value\n  })\n  return `${API_PREFIX}${filled}`\n}\n"],"mappings":";;AAGA,MAAM,aAAa;;;;;;;;;;;;;;;;AAiBnB,SAAgB,QACd,OACA,SAA2C,CAAC,GACpC;CACR,MAAM,SAAS,MAAM,KAAK,QAAQ,aAAa,QAAQ,QAAgB;EACrE,MAAM,QAAQ,OAAO;EACrB,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,qCAAqC,KAAK;EAE5D,OAAO;CACT,CAAC;CACD,OAAO,GAAGA,eAAAA,aAAa;AACzB"}

package/dist/api-path-B-vSkL2H.js

@@ -0,0 +1,29 @@
+import { n as API_PREFIX } from "./routes-F1g5aVqP.js";
+// src/api-path.ts
+const PATH_PARAM = /\{(\w+)\}/g;
+/**
+* Builds the request path of a contract route: fills every `{param}` of the descriptor path and
+* returns `API_PREFIX + path`. Throws when a param is missing (a programming error, never a
+* runtime condition).
+*
+* Every versioned route is built here, so the prefix lives in this single place. Routes that stay
+* at the root (`/.well-known/jwks.json` in `jwks.ts`, `/health` in `http-client.ts`) do not go
+* through this helper. Requests to `/internal/*` sign the final URL pathname, which already
+* includes the prefix.
+*
+* Import rule (react closure): only `http-client.ts` and the S2S/admin clients import this module,
+* none of them reachable from `src/react`. The by-value import of `API_PREFIX` is safe because it
+* comes from the PURE `routes` module of the contract (no zod). Keep it that way: never import a
+* schema module by value here.
+*/
+function apiPath(route, params = {}) {
+	const filled = route.path.replace(PATH_PARAM, (_match, key) => {
+		const value = params[key];
+		if (value === void 0) throw new Error(`[eva-auth-sdk] missing path param ${key}`);
+		return value;
+	});
+	return `${API_PREFIX}${filled}`;
+}
+export { apiPath as t };
+
+//# sourceMappingURL=api-path-B-vSkL2H.js.map

package/dist/api-path-B-vSkL2H.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-path-B-vSkL2H.js","names":[],"sources":["../src/api-path.ts"],"sourcesContent":["import { API_PREFIX } from '@eva_solutions/auth-contracts'\nimport type { RouteDescriptor } from '@eva_solutions/auth-contracts'\n\nconst PATH_PARAM = /\\{(\\w+)\\}/g\n\n/**\n * Builds the request path of a contract route: fills every `{param}` of the descriptor path and\n * returns `API_PREFIX + path`. Throws when a param is missing (a programming error, never a\n * runtime condition).\n *\n * Every versioned route is built here, so the prefix lives in this single place. Routes that stay\n * at the root (`/.well-known/jwks.json` in `jwks.ts`, `/health` in `http-client.ts`) do not go\n * through this helper. Requests to `/internal/*` sign the final URL pathname, which already\n * includes the prefix.\n *\n * Import rule (react closure): only `http-client.ts` and the S2S/admin clients import this module,\n * none of them reachable from `src/react`. The by-value import of `API_PREFIX` is safe because it\n * comes from the PURE `routes` module of the contract (no zod). Keep it that way: never import a\n * schema module by value here.\n */\nexport function apiPath(\n  route: RouteDescriptor,\n  params: Readonly<Record<string, string>> = {},\n): string {\n  const filled = route.path.replace(PATH_PARAM, (_match, key: string) => {\n    const value = params[key]\n    if (value === undefined) {\n      throw new Error(`[eva-auth-sdk] missing path param ${key}`)\n    }\n    return value\n  })\n  return `${API_PREFIX}${filled}`\n}\n"],"mappings":";;AAGA,MAAM,aAAa;;;;;;;;;;;;;;;;AAiBnB,SAAgB,QACd,OACA,SAA2C,CAAC,GACpC;CACR,MAAM,SAAS,MAAM,KAAK,QAAQ,aAAa,QAAQ,QAAgB;EACrE,MAAM,QAAQ,OAAO;EACrB,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,qCAAqC,KAAK;EAE5D,OAAO;CACT,CAAC;CACD,OAAO,GAAG,aAAa;AACzB"}

package/dist/auth-19r-Q6X2.js

@@ -0,0 +1,84 @@
+import { z } from "zod";
+// ../auth-contracts/dist/errors.js
+/**
+* SCHEMA module (it calls `.meta()` at load time): react-reachable SDK code must not import it by
+* value. It holds only the error body; the error codes live in the PURE `constants.ts`.
+*
+* Wire shape `{ error: { code, message } }`. `code` is an open `string`, not an enum: features add
+* their own snake_case codes. Metadata uses only the zod-native metadata API, never the zod-to-openapi extension.
+*/
+const errorResponseSchema = z.object({ error: z.object({
+	code: z.string().meta({ description: "Código de error enumerado (snake_case ASCII)" }),
+	message: z.string().meta({ description: "Mensaje human-readable del error" })
+}) }).meta({ id: "ErrorBody" });
+// ../auth-contracts/dist/auth.js
+/**
+* SCHEMA module: wire schemas of the login flow. Body schemas stay plain strict objects (no
+* `.refine`), so the API can plug them into `createRoute` without changing the OpenAPI document.
+* Metadata uses `.meta()` only. Refresh answers with `loginResponseSchema`; logout with the
+* generic message response from `common.ts`. The refresh header schema is API-owned.
+*/
+const INTERNATIONAL_DIALING_PREFIX = /^00/;
+const phoneSchema = z.string().min(8).max(22).regex(/^\d+$/, { error: "Solo dígitos permitidos" }).transform((val) => val.replace(INTERNATIONAL_DIALING_PREFIX, "")).pipe(z.string().min(8).max(20).regex(/^[1-9]/, { error: "Formato internacional inválido" })).meta({
+	description: "Número de teléfono en formato internacional",
+	example: "5491155551234"
+});
+/**
+* Product slug: same shape as a service client slug. It never equals a service audience; the API
+* checks that with `isServiceAudience`.
+*/
+const productoSlugSchema = z.string().regex(/^[a-z][a-z0-9-]{2,63}$/, { error: "producto debe matchear ^[a-z][a-z0-9-]{2,63}$" }).meta({
+	description: "Producto al que entra la persona",
+	example: "whatsapp-panel"
+});
+const getCodeRequestSchema = z.object({ phone: phoneSchema }).strict();
+/**
+* The two `challengeId` descriptions (here and in the login request) name no route and no path:
+* route names and prefixes live only in the route descriptors, so a path change never leaves a
+* stale description in the published OpenAPI document.
+*/
+const getCodeResponseSchema = z.object({ data: z.object({
+	message: z.string().meta({ description: "Mensaje de confirmación" }),
+	challengeId: z.string().regex(/^[0-9a-f]{32}$/).meta({
+		description: "Identificador opaco del desafío; enviarlo en el login junto con el código. Vence con el código y se invalida con cada get-code nuevo.",
+		example: "9f86d081884c7d659a2feaa0c55ad015"
+	})
+}) });
+/** Login body. `challengeId` is lowercase hex and is rejected, never normalized. */
+const loginRequestSchema = z.object({
+	phone: phoneSchema,
+	code: z.string().length(6).regex(/^[0-9A-Za-z]+$/, { error: "Solo dígitos y letras" }).transform((val) => val.toUpperCase()).meta({
+		description: "Código OTP de 6 caracteres",
+		example: "A1B2C3"
+	}),
+	producto: productoSlugSchema,
+	empresaId: z.string().min(1).max(64).optional().meta({ description: "Empresa que queda activa en la sesión (opcional)" }),
+	challengeId: z.string().regex(/^[0-9a-f]{32}$/, { error: "Formato de challenge inválido" }).meta({
+		description: "challengeId devuelto por la solicitud de código (get-code)",
+		example: "9f86d081884c7d659a2feaa0c55ad015"
+	}),
+	deviceType: z.string().min(1).max(50).regex(/^[\x20-\x7E\xA0-\xFF]*$/, { error: "Caracteres de control no permitidos" }).meta({
+		description: "Tipo de dispositivo (mobile, desktop, tablet)",
+		example: "mobile"
+	}),
+	os: z.string().min(1).max(100).regex(/^[\x20-\x7E\xA0-\xFF]*$/, { error: "Caracteres de control no permitidos" }).meta({
+		description: "Sistema operativo del dispositivo",
+		example: "Android 14"
+	}),
+	browser: z.string().min(1).max(100).regex(/^[\x20-\x7E\xA0-\xFF]*$/, { error: "Caracteres de control no permitidos" }).meta({
+		description: "Navegador o aplicación cliente",
+		example: "Chrome 120"
+	}),
+	userAgent: z.string().min(1).max(500).regex(/^[\x20-\x7E\xA0-\xFF]*$/, { error: "Caracteres de control no permitidos" }).meta({
+		description: "User-Agent completo del cliente",
+		example: "Mozilla/5.0 ..."
+	})
+}).strict();
+const loginResponseSchema = z.object({ data: z.object({ user: z.object({ id: z.string().meta({ description: "ID del usuario" }) }) }) });
+/** Active company switch body: an id, or `null` to leave the session without one. */
+const setActiveEmpresaRequestSchema = z.object({ empresaId: z.string().min(1).max(64).nullable().meta({ description: "Empresa que queda activa, o null para ninguna" }) }).strict();
+/** Active company switch answer. The re-issued access token travels in the `x-eva-new-access-token` header; the refresh token does not rotate. */
+const setActiveEmpresaResponseSchema = z.object({ data: z.object({ empresaId: z.string().nullable().meta({ description: "Empresa activa" }) }) });
+export { productoSlugSchema as a, errorResponseSchema as c, loginResponseSchema as i, getCodeResponseSchema as n, setActiveEmpresaRequestSchema as o, loginRequestSchema as r, setActiveEmpresaResponseSchema as s, getCodeRequestSchema as t };
+
+//# sourceMappingURL=auth-19r-Q6X2.js.map