@eva_solutions/auth-sdk 0.0.0-stage → 3.0.0-dev-20261109133200

package/dist/auth-19r-Q6X2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-19r-Q6X2.js","names":[],"sources":["../../auth-contracts/dist/errors.js","../../auth-contracts/dist/auth.js"],"sourcesContent":["import { z } from \"zod\";\n// src/errors.ts\n/**\n* SCHEMA module (it calls `.meta()` at load time): react-reachable SDK code must not import it by\n* value. It holds only the error body; the error codes live in the PURE `constants.ts`.\n*\n* Wire shape `{ error: { code, message } }`. `code` is an open `string`, not an enum: features add\n* their own snake_case codes. Metadata uses only the zod-native metadata API, never the zod-to-openapi extension.\n*/\nconst errorResponseSchema = z.object({ error: z.object({\n\tcode: z.string().meta({ description: \"Código de error enumerado (snake_case ASCII)\" }),\n\tmessage: z.string().meta({ description: \"Mensaje human-readable del error\" })\n}) }).meta({ id: \"ErrorBody\" });\nexport { errorResponseSchema };\n\n//# sourceMappingURL=errors.js.map","import { z } from \"zod\";\n// src/auth.ts\n/**\n* SCHEMA module: wire schemas of the login flow. Body schemas stay plain strict objects (no\n* `.refine`), so the API can plug them into `createRoute` without changing the OpenAPI document.\n* Metadata uses `.meta()` only. Refresh answers with `loginResponseSchema`; logout with the\n* generic message response from `common.ts`. The refresh header schema is API-owned.\n*/\nconst INTERNATIONAL_DIALING_PREFIX = /^00/;\nconst phoneSchema = z.string().min(8).max(22).regex(/^\\d+$/, { error: \"Solo dígitos permitidos\" }).transform((val) => val.replace(INTERNATIONAL_DIALING_PREFIX, \"\")).pipe(z.string().min(8).max(20).regex(/^[1-9]/, { error: \"Formato internacional inválido\" })).meta({\n\tdescription: \"Número de teléfono en formato internacional\",\n\texample: \"5491155551234\"\n});\n/**\n* Product slug: same shape as a service client slug. It never equals a service audience; the API\n* checks that with `isServiceAudience`.\n*/\nconst productoSlugSchema = z.string().regex(/^[a-z][a-z0-9-]{2,63}$/, { error: \"producto debe matchear ^[a-z][a-z0-9-]{2,63}$\" }).meta({\n\tdescription: \"Producto al que entra la persona\",\n\texample: \"whatsapp-panel\"\n});\nconst getCodeRequestSchema = z.object({ phone: phoneSchema }).strict();\n/**\n* The two `challengeId` descriptions (here and in the login request) name no route and no path:\n* route names and prefixes live only in the route descriptors, so a path change never leaves a\n* stale description in the published OpenAPI document.\n*/\nconst getCodeResponseSchema = z.object({ data: z.object({\n\tmessage: z.string().meta({ description: \"Mensaje de confirmación\" }),\n\tchallengeId: z.string().regex(/^[0-9a-f]{32}$/).meta({\n\t\tdescription: \"Identificador opaco del desafío; enviarlo en el login junto con el código. Vence con el código y se invalida con cada get-code nuevo.\",\n\t\texample: \"9f86d081884c7d659a2feaa0c55ad015\"\n\t})\n}) });\n/** Login body. `challengeId` is lowercase hex and is rejected, never normalized. */\nconst loginRequestSchema = z.object({\n\tphone: phoneSchema,\n\tcode: z.string().length(6).regex(/^[0-9A-Za-z]+$/, { error: \"Solo dígitos y letras\" }).transform((val) => val.toUpperCase()).meta({\n\t\tdescription: \"Código OTP de 6 caracteres\",\n\t\texample: \"A1B2C3\"\n\t}),\n\tproducto: productoSlugSchema,\n\tempresaId: z.string().min(1).max(64).optional().meta({ description: \"Empresa que queda activa en la sesión (opcional)\" }),\n\tchallengeId: z.string().regex(/^[0-9a-f]{32}$/, { error: \"Formato de challenge inválido\" }).meta({\n\t\tdescription: \"challengeId devuelto por la solicitud de código (get-code)\",\n\t\texample: \"9f86d081884c7d659a2feaa0c55ad015\"\n\t}),\n\tdeviceType: z.string().min(1).max(50).regex(/^[\\x20-\\x7E\\xA0-\\xFF]*$/, { error: \"Caracteres de control no permitidos\" }).meta({\n\t\tdescription: \"Tipo de dispositivo (mobile, desktop, tablet)\",\n\t\texample: \"mobile\"\n\t}),\n\tos: z.string().min(1).max(100).regex(/^[\\x20-\\x7E\\xA0-\\xFF]*$/, { error: \"Caracteres de control no permitidos\" }).meta({\n\t\tdescription: \"Sistema operativo del dispositivo\",\n\t\texample: \"Android 14\"\n\t}),\n\tbrowser: z.string().min(1).max(100).regex(/^[\\x20-\\x7E\\xA0-\\xFF]*$/, { error: \"Caracteres de control no permitidos\" }).meta({\n\t\tdescription: \"Navegador o aplicación cliente\",\n\t\texample: \"Chrome 120\"\n\t}),\n\tuserAgent: z.string().min(1).max(500).regex(/^[\\x20-\\x7E\\xA0-\\xFF]*$/, { error: \"Caracteres de control no permitidos\" }).meta({\n\t\tdescription: \"User-Agent completo del cliente\",\n\t\texample: \"Mozilla/5.0 ...\"\n\t})\n}).strict();\nconst loginResponseSchema = z.object({ data: z.object({ user: z.object({ id: z.string().meta({ description: \"ID del usuario\" }) }) }) });\n/** Active company switch body: an id, or `null` to leave the session without one. */\nconst setActiveEmpresaRequestSchema = z.object({ empresaId: z.string().min(1).max(64).nullable().meta({ description: \"Empresa que queda activa, o null para ninguna\" }) }).strict();\n/** Active company switch answer. The re-issued access token travels in the `x-eva-new-access-token` header; the refresh token does not rotate. */\nconst setActiveEmpresaResponseSchema = z.object({ data: z.object({ empresaId: z.string().nullable().meta({ description: \"Empresa activa\" }) }) });\nexport { getCodeRequestSchema, getCodeResponseSchema, loginRequestSchema, loginResponseSchema, productoSlugSchema, setActiveEmpresaRequestSchema, setActiveEmpresaResponseSchema };\n\n//# sourceMappingURL=auth.js.map"],"mappings":";;;;;;;;;AASA,MAAM,sBAAsB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO;CACtD,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,EAAE,aAAa,+CAA+C,CAAC;CACrF,SAAS,EAAE,OAAO,CAAC,CAAC,KAAK,EAAE,aAAa,mCAAmC,CAAC;AAC7E,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,YAAY,CAAC;;;;;;;;ACJ9B,MAAM,+BAA+B;AACrC,MAAM,cAAc,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,SAAS,EAAE,OAAO,0BAA0B,CAAC,CAAC,CAAC,WAAW,QAAQ,IAAI,QAAQ,8BAA8B,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,UAAU,EAAE,OAAO,iCAAiC,CAAC,CAAC,CAAC,CAAC,KAAK;CACtQ,aAAa;CACb,SAAS;AACV,CAAC;;;;;AAKD,MAAM,qBAAqB,EAAE,OAAO,CAAC,CAAC,MAAM,0BAA0B,EAAE,OAAO,gDAAgD,CAAC,CAAC,CAAC,KAAK;CACtI,aAAa;CACb,SAAS;AACV,CAAC;AACD,MAAM,uBAAuB,EAAE,OAAO,EAAE,OAAO,YAAY,CAAC,CAAC,CAAC,OAAO;;;;;;AAMrE,MAAM,wBAAwB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO;CACvD,SAAS,EAAE,OAAO,CAAC,CAAC,KAAK,EAAE,aAAa,0BAA0B,CAAC;CACnE,aAAa,EAAE,OAAO,CAAC,CAAC,MAAM,gBAAgB,CAAC,CAAC,KAAK;EACpD,aAAa;EACb,SAAS;CACV,CAAC;AACF,CAAC,EAAE,CAAC;;AAEJ,MAAM,qBAAqB,EAAE,OAAO;CACnC,OAAO;CACP,MAAM,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,kBAAkB,EAAE,OAAO,wBAAwB,CAAC,CAAC,CAAC,WAAW,QAAQ,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK;EACjI,aAAa;EACb,SAAS;CACV,CAAC;CACD,UAAU;CACV,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,aAAa,mDAAmD,CAAC;CACxH,aAAa,EAAE,OAAO,CAAC,CAAC,MAAM,kBAAkB,EAAE,OAAO,gCAAgC,CAAC,CAAC,CAAC,KAAK;EAChG,aAAa;EACb,SAAS;CACV,CAAC;CACD,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,2BAA2B,EAAE,OAAO,sCAAsC,CAAC,CAAC,CAAC,KAAK;EAC7H,aAAa;EACb,SAAS;CACV,CAAC;CACD,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,MAAM,2BAA2B,EAAE,OAAO,sCAAsC,CAAC,CAAC,CAAC,KAAK;EACtH,aAAa;EACb,SAAS;CACV,CAAC;CACD,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,MAAM,2BAA2B,EAAE,OAAO,sCAAsC,CAAC,CAAC,CAAC,KAAK;EAC3H,aAAa;EACb,SAAS;CACV,CAAC;CACD,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,MAAM,2BAA2B,EAAE,OAAO,sCAAsC,CAAC,CAAC,CAAC,KAAK;EAC7H,aAAa;EACb,SAAS;CACV,CAAC;AACF,CAAC,CAAC,CAAC,OAAO;AACV,MAAM,sBAAsB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,EAAE,aAAa,iBAAiB,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;;AAEvI,MAAM,gCAAgC,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,aAAa,gDAAgD,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO;;AAElL,MAAM,iCAAiC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,aAAa,iBAAiB,CAAC,EAAE,CAAC,EAAE,CAAC"}

package/dist/auth-DX1N5JA4.cjs

@@ -0,0 +1,131 @@
+let zod = require("zod");
+// ../auth-contracts/dist/errors.js
+/**
+* SCHEMA module (it calls `.meta()` at load time): react-reachable SDK code must not import it by
+* value. It holds only the error body; the error codes live in the PURE `constants.ts`.
+*
+* Wire shape `{ error: { code, message } }`. `code` is an open `string`, not an enum: features add
+* their own snake_case codes. Metadata uses only the zod-native metadata API, never the zod-to-openapi extension.
+*/
+const errorResponseSchema = zod.z.object({ error: zod.z.object({
+	code: zod.z.string().meta({ description: "Código de error enumerado (snake_case ASCII)" }),
+	message: zod.z.string().meta({ description: "Mensaje human-readable del error" })
+}) }).meta({ id: "ErrorBody" });
+// ../auth-contracts/dist/auth.js
+/**
+* SCHEMA module: wire schemas of the login flow. Body schemas stay plain strict objects (no
+* `.refine`), so the API can plug them into `createRoute` without changing the OpenAPI document.
+* Metadata uses `.meta()` only. Refresh answers with `loginResponseSchema`; logout with the
+* generic message response from `common.ts`. The refresh header schema is API-owned.
+*/
+const INTERNATIONAL_DIALING_PREFIX = /^00/;
+const phoneSchema = zod.z.string().min(8).max(22).regex(/^\d+$/, { error: "Solo dígitos permitidos" }).transform((val) => val.replace(INTERNATIONAL_DIALING_PREFIX, "")).pipe(zod.z.string().min(8).max(20).regex(/^[1-9]/, { error: "Formato internacional inválido" })).meta({
+	description: "Número de teléfono en formato internacional",
+	example: "5491155551234"
+});
+/**
+* Product slug: same shape as a service client slug. It never equals a service audience; the API
+* checks that with `isServiceAudience`.
+*/
+const productoSlugSchema = zod.z.string().regex(/^[a-z][a-z0-9-]{2,63}$/, { error: "producto debe matchear ^[a-z][a-z0-9-]{2,63}$" }).meta({
+	description: "Producto al que entra la persona",
+	example: "whatsapp-panel"
+});
+const getCodeRequestSchema = zod.z.object({ phone: phoneSchema }).strict();
+/**
+* The two `challengeId` descriptions (here and in the login request) name no route and no path:
+* route names and prefixes live only in the route descriptors, so a path change never leaves a
+* stale description in the published OpenAPI document.
+*/
+const getCodeResponseSchema = zod.z.object({ data: zod.z.object({
+	message: zod.z.string().meta({ description: "Mensaje de confirmación" }),
+	challengeId: zod.z.string().regex(/^[0-9a-f]{32}$/).meta({
+		description: "Identificador opaco del desafío; enviarlo en el login junto con el código. Vence con el código y se invalida con cada get-code nuevo.",
+		example: "9f86d081884c7d659a2feaa0c55ad015"
+	})
+}) });
+/** Login body. `challengeId` is lowercase hex and is rejected, never normalized. */
+const loginRequestSchema = zod.z.object({
+	phone: phoneSchema,
+	code: zod.z.string().length(6).regex(/^[0-9A-Za-z]+$/, { error: "Solo dígitos y letras" }).transform((val) => val.toUpperCase()).meta({
+		description: "Código OTP de 6 caracteres",
+		example: "A1B2C3"
+	}),
+	producto: productoSlugSchema,
+	empresaId: zod.z.string().min(1).max(64).optional().meta({ description: "Empresa que queda activa en la sesión (opcional)" }),
+	challengeId: zod.z.string().regex(/^[0-9a-f]{32}$/, { error: "Formato de challenge inválido" }).meta({
+		description: "challengeId devuelto por la solicitud de código (get-code)",
+		example: "9f86d081884c7d659a2feaa0c55ad015"
+	}),
+	deviceType: zod.z.string().min(1).max(50).regex(/^[\x20-\x7E\xA0-\xFF]*$/, { error: "Caracteres de control no permitidos" }).meta({
+		description: "Tipo de dispositivo (mobile, desktop, tablet)",
+		example: "mobile"
+	}),
+	os: zod.z.string().min(1).max(100).regex(/^[\x20-\x7E\xA0-\xFF]*$/, { error: "Caracteres de control no permitidos" }).meta({
+		description: "Sistema operativo del dispositivo",
+		example: "Android 14"
+	}),
+	browser: zod.z.string().min(1).max(100).regex(/^[\x20-\x7E\xA0-\xFF]*$/, { error: "Caracteres de control no permitidos" }).meta({
+		description: "Navegador o aplicación cliente",
+		example: "Chrome 120"
+	}),
+	userAgent: zod.z.string().min(1).max(500).regex(/^[\x20-\x7E\xA0-\xFF]*$/, { error: "Caracteres de control no permitidos" }).meta({
+		description: "User-Agent completo del cliente",
+		example: "Mozilla/5.0 ..."
+	})
+}).strict();
+const loginResponseSchema = zod.z.object({ data: zod.z.object({ user: zod.z.object({ id: zod.z.string().meta({ description: "ID del usuario" }) }) }) });
+/** Active company switch body: an id, or `null` to leave the session without one. */
+const setActiveEmpresaRequestSchema = zod.z.object({ empresaId: zod.z.string().min(1).max(64).nullable().meta({ description: "Empresa que queda activa, o null para ninguna" }) }).strict();
+/** Active company switch answer. The re-issued access token travels in the `x-eva-new-access-token` header; the refresh token does not rotate. */
+const setActiveEmpresaResponseSchema = zod.z.object({ data: zod.z.object({ empresaId: zod.z.string().nullable().meta({ description: "Empresa activa" }) }) });
+Object.defineProperty(exports, "errorResponseSchema", {
+	enumerable: true,
+	get: function() {
+		return errorResponseSchema;
+	}
+});
+Object.defineProperty(exports, "getCodeRequestSchema", {
+	enumerable: true,
+	get: function() {
+		return getCodeRequestSchema;
+	}
+});
+Object.defineProperty(exports, "getCodeResponseSchema", {
+	enumerable: true,
+	get: function() {
+		return getCodeResponseSchema;
+	}
+});
+Object.defineProperty(exports, "loginRequestSchema", {
+	enumerable: true,
+	get: function() {
+		return loginRequestSchema;
+	}
+});
+Object.defineProperty(exports, "loginResponseSchema", {
+	enumerable: true,
+	get: function() {
+		return loginResponseSchema;
+	}
+});
+Object.defineProperty(exports, "productoSlugSchema", {
+	enumerable: true,
+	get: function() {
+		return productoSlugSchema;
+	}
+});
+Object.defineProperty(exports, "setActiveEmpresaRequestSchema", {
+	enumerable: true,
+	get: function() {
+		return setActiveEmpresaRequestSchema;
+	}
+});
+Object.defineProperty(exports, "setActiveEmpresaResponseSchema", {
+	enumerable: true,
+	get: function() {
+		return setActiveEmpresaResponseSchema;
+	}
+});
+
+//# sourceMappingURL=auth-DX1N5JA4.cjs.map

package/dist/auth-DX1N5JA4.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-DX1N5JA4.cjs","names":["z","z"],"sources":["../../auth-contracts/dist/errors.js","../../auth-contracts/dist/auth.js"],"sourcesContent":["import { z } from \"zod\";\n// src/errors.ts\n/**\n* SCHEMA module (it calls `.meta()` at load time): react-reachable SDK code must not import it by\n* value. It holds only the error body; the error codes live in the PURE `constants.ts`.\n*\n* Wire shape `{ error: { code, message } }`. `code` is an open `string`, not an enum: features add\n* their own snake_case codes. Metadata uses only the zod-native metadata API, never the zod-to-openapi extension.\n*/\nconst errorResponseSchema = z.object({ error: z.object({\n\tcode: z.string().meta({ description: \"Código de error enumerado (snake_case ASCII)\" }),\n\tmessage: z.string().meta({ description: \"Mensaje human-readable del error\" })\n}) }).meta({ id: \"ErrorBody\" });\nexport { errorResponseSchema };\n\n//# sourceMappingURL=errors.js.map","import { z } from \"zod\";\n// src/auth.ts\n/**\n* SCHEMA module: wire schemas of the login flow. Body schemas stay plain strict objects (no\n* `.refine`), so the API can plug them into `createRoute` without changing the OpenAPI document.\n* Metadata uses `.meta()` only. Refresh answers with `loginResponseSchema`; logout with the\n* generic message response from `common.ts`. The refresh header schema is API-owned.\n*/\nconst INTERNATIONAL_DIALING_PREFIX = /^00/;\nconst phoneSchema = z.string().min(8).max(22).regex(/^\\d+$/, { error: \"Solo dígitos permitidos\" }).transform((val) => val.replace(INTERNATIONAL_DIALING_PREFIX, \"\")).pipe(z.string().min(8).max(20).regex(/^[1-9]/, { error: \"Formato internacional inválido\" })).meta({\n\tdescription: \"Número de teléfono en formato internacional\",\n\texample: \"5491155551234\"\n});\n/**\n* Product slug: same shape as a service client slug. It never equals a service audience; the API\n* checks that with `isServiceAudience`.\n*/\nconst productoSlugSchema = z.string().regex(/^[a-z][a-z0-9-]{2,63}$/, { error: \"producto debe matchear ^[a-z][a-z0-9-]{2,63}$\" }).meta({\n\tdescription: \"Producto al que entra la persona\",\n\texample: \"whatsapp-panel\"\n});\nconst getCodeRequestSchema = z.object({ phone: phoneSchema }).strict();\n/**\n* The two `challengeId` descriptions (here and in the login request) name no route and no path:\n* route names and prefixes live only in the route descriptors, so a path change never leaves a\n* stale description in the published OpenAPI document.\n*/\nconst getCodeResponseSchema = z.object({ data: z.object({\n\tmessage: z.string().meta({ description: \"Mensaje de confirmación\" }),\n\tchallengeId: z.string().regex(/^[0-9a-f]{32}$/).meta({\n\t\tdescription: \"Identificador opaco del desafío; enviarlo en el login junto con el código. Vence con el código y se invalida con cada get-code nuevo.\",\n\t\texample: \"9f86d081884c7d659a2feaa0c55ad015\"\n\t})\n}) });\n/** Login body. `challengeId` is lowercase hex and is rejected, never normalized. */\nconst loginRequestSchema = z.object({\n\tphone: phoneSchema,\n\tcode: z.string().length(6).regex(/^[0-9A-Za-z]+$/, { error: \"Solo dígitos y letras\" }).transform((val) => val.toUpperCase()).meta({\n\t\tdescription: \"Código OTP de 6 caracteres\",\n\t\texample: \"A1B2C3\"\n\t}),\n\tproducto: productoSlugSchema,\n\tempresaId: z.string().min(1).max(64).optional().meta({ description: \"Empresa que queda activa en la sesión (opcional)\" }),\n\tchallengeId: z.string().regex(/^[0-9a-f]{32}$/, { error: \"Formato de challenge inválido\" }).meta({\n\t\tdescription: \"challengeId devuelto por la solicitud de código (get-code)\",\n\t\texample: \"9f86d081884c7d659a2feaa0c55ad015\"\n\t}),\n\tdeviceType: z.string().min(1).max(50).regex(/^[\\x20-\\x7E\\xA0-\\xFF]*$/, { error: \"Caracteres de control no permitidos\" }).meta({\n\t\tdescription: \"Tipo de dispositivo (mobile, desktop, tablet)\",\n\t\texample: \"mobile\"\n\t}),\n\tos: z.string().min(1).max(100).regex(/^[\\x20-\\x7E\\xA0-\\xFF]*$/, { error: \"Caracteres de control no permitidos\" }).meta({\n\t\tdescription: \"Sistema operativo del dispositivo\",\n\t\texample: \"Android 14\"\n\t}),\n\tbrowser: z.string().min(1).max(100).regex(/^[\\x20-\\x7E\\xA0-\\xFF]*$/, { error: \"Caracteres de control no permitidos\" }).meta({\n\t\tdescription: \"Navegador o aplicación cliente\",\n\t\texample: \"Chrome 120\"\n\t}),\n\tuserAgent: z.string().min(1).max(500).regex(/^[\\x20-\\x7E\\xA0-\\xFF]*$/, { error: \"Caracteres de control no permitidos\" }).meta({\n\t\tdescription: \"User-Agent completo del cliente\",\n\t\texample: \"Mozilla/5.0 ...\"\n\t})\n}).strict();\nconst loginResponseSchema = z.object({ data: z.object({ user: z.object({ id: z.string().meta({ description: \"ID del usuario\" }) }) }) });\n/** Active company switch body: an id, or `null` to leave the session without one. */\nconst setActiveEmpresaRequestSchema = z.object({ empresaId: z.string().min(1).max(64).nullable().meta({ description: \"Empresa que queda activa, o null para ninguna\" }) }).strict();\n/** Active company switch answer. The re-issued access token travels in the `x-eva-new-access-token` header; the refresh token does not rotate. */\nconst setActiveEmpresaResponseSchema = z.object({ data: z.object({ empresaId: z.string().nullable().meta({ description: \"Empresa activa\" }) }) });\nexport { getCodeRequestSchema, getCodeResponseSchema, loginRequestSchema, loginResponseSchema, productoSlugSchema, setActiveEmpresaRequestSchema, setActiveEmpresaResponseSchema };\n\n//# sourceMappingURL=auth.js.map"],"mappings":";;;;;;;;;AASA,MAAM,sBAAsBA,IAAAA,EAAE,OAAO,EAAE,OAAOA,IAAAA,EAAE,OAAO;CACtD,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,KAAK,EAAE,aAAa,+CAA+C,CAAC;CACrF,SAASA,IAAAA,EAAE,OAAO,CAAC,CAAC,KAAK,EAAE,aAAa,mCAAmC,CAAC;AAC7E,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,YAAY,CAAC;;;;;;;;ACJ9B,MAAM,+BAA+B;AACrC,MAAM,cAAcC,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,SAAS,EAAE,OAAO,0BAA0B,CAAC,CAAC,CAAC,WAAW,QAAQ,IAAI,QAAQ,8BAA8B,EAAE,CAAC,CAAC,CAAC,KAAKA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,UAAU,EAAE,OAAO,iCAAiC,CAAC,CAAC,CAAC,CAAC,KAAK;CACtQ,aAAa;CACb,SAAS;AACV,CAAC;;;;;AAKD,MAAM,qBAAqBA,IAAAA,EAAE,OAAO,CAAC,CAAC,MAAM,0BAA0B,EAAE,OAAO,gDAAgD,CAAC,CAAC,CAAC,KAAK;CACtI,aAAa;CACb,SAAS;AACV,CAAC;AACD,MAAM,uBAAuBA,IAAAA,EAAE,OAAO,EAAE,OAAO,YAAY,CAAC,CAAC,CAAC,OAAO;;;;;;AAMrE,MAAM,wBAAwBA,IAAAA,EAAE,OAAO,EAAE,MAAMA,IAAAA,EAAE,OAAO;CACvD,SAASA,IAAAA,EAAE,OAAO,CAAC,CAAC,KAAK,EAAE,aAAa,0BAA0B,CAAC;CACnE,aAAaA,IAAAA,EAAE,OAAO,CAAC,CAAC,MAAM,gBAAgB,CAAC,CAAC,KAAK;EACpD,aAAa;EACb,SAAS;CACV,CAAC;AACF,CAAC,EAAE,CAAC;;AAEJ,MAAM,qBAAqBA,IAAAA,EAAE,OAAO;CACnC,OAAO;CACP,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,kBAAkB,EAAE,OAAO,wBAAwB,CAAC,CAAC,CAAC,WAAW,QAAQ,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK;EACjI,aAAa;EACb,SAAS;CACV,CAAC;CACD,UAAU;CACV,WAAWA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,aAAa,mDAAmD,CAAC;CACxH,aAAaA,IAAAA,EAAE,OAAO,CAAC,CAAC,MAAM,kBAAkB,EAAE,OAAO,gCAAgC,CAAC,CAAC,CAAC,KAAK;EAChG,aAAa;EACb,SAAS;CACV,CAAC;CACD,YAAYA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,2BAA2B,EAAE,OAAO,sCAAsC,CAAC,CAAC,CAAC,KAAK;EAC7H,aAAa;EACb,SAAS;CACV,CAAC;CACD,IAAIA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,MAAM,2BAA2B,EAAE,OAAO,sCAAsC,CAAC,CAAC,CAAC,KAAK;EACtH,aAAa;EACb,SAAS;CACV,CAAC;CACD,SAASA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,MAAM,2BAA2B,EAAE,OAAO,sCAAsC,CAAC,CAAC,CAAC,KAAK;EAC3H,aAAa;EACb,SAAS;CACV,CAAC;CACD,WAAWA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,MAAM,2BAA2B,EAAE,OAAO,sCAAsC,CAAC,CAAC,CAAC,KAAK;EAC7H,aAAa;EACb,SAAS;CACV,CAAC;AACF,CAAC,CAAC,CAAC,OAAO;AACV,MAAM,sBAAsBA,IAAAA,EAAE,OAAO,EAAE,MAAMA,IAAAA,EAAE,OAAO,EAAE,MAAMA,IAAAA,EAAE,OAAO,EAAE,IAAIA,IAAAA,EAAE,OAAO,CAAC,CAAC,KAAK,EAAE,aAAa,iBAAiB,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;;AAEvI,MAAM,gCAAgCA,IAAAA,EAAE,OAAO,EAAE,WAAWA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,aAAa,gDAAgD,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO;;AAElL,MAAM,iCAAiCA,IAAAA,EAAE,OAAO,EAAE,MAAMA,IAAAA,EAAE,OAAO,EAAE,WAAWA,IAAAA,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,aAAa,iBAAiB,CAAC,EAAE,CAAC,EAAE,CAAC"}

package/dist/auth-handlers-B3iJaPln.js

@@ -0,0 +1,343 @@
+import { t as createHttpClient } from "./http-client-Da0-OMfc.js";
+import { i as setTokenCookies, n as readTokensFromCookies, r as setAccessTokenCookie, t as clearTokenCookies } from "./cookies-DKEC7AWv.js";
+import { t as deduplicateRefresh } from "./refresh-dedup-CKaHHe7m.js";
+import { a as getErrorMessages, l as validateErrorMessagesInput, o as getErrorWire, p as resolveErrorMessages } from "./parse-error-response-BM9-kjs0.js";
+import { c as errorResponseSchema, i as loginResponseSchema, n as getCodeResponseSchema } from "./auth-19r-Q6X2.js";
+import { z } from "zod";
+import Bowser from "bowser";
+// src/hono/device-info.ts
+function parseDeviceInfo(request) {
+	const userAgent = request.headers.get("user-agent") || "";
+	const parsed = Bowser.parse(userAgent);
+	return {
+		deviceType: parsed.platform?.type || "desktop",
+		os: parsed.os?.name || "Unknown",
+		browser: parsed.browser?.name || "Unknown",
+		userAgent: userAgent.slice(0, 500)
+	};
+}
+// src/schemas.ts
+/**
+* Schemas Zod 4 compartidos — fuente canónica (B1 confirmado por T-00 probe).
+* Usados por auth-handlers.ts (validación runtime) y hono-openapi/index.ts (OpenAPI doc).
+* Importar desde aquí evita duplicación y garantiza consistencia entre variantes.
+*
+* `parseErrorResponse` vive en `parse-error-response.ts` (módulo puro, D-35): este archivo no es
+* alcanzable desde `src/react/index.ts`.
+*/
+const GetCodeSchema = z.object({ phone: z.string().min(1) });
+/**
+* Cuerpo de POST /login. `challengeId` es el identificador opaco que devolvió
+* POST /get-code para este código: el navegador lo conserva en memoria y lo
+* reenvía junto con el código. Sin él, /login responde 400 (`malformed`).
+*/
+const LoginSchema = z.object({
+	phone: z.string().min(1),
+	code: z.string().min(1),
+	challengeId: z.string().min(1),
+	empresaId: z.string().min(1).optional()
+});
+/**
+* Cuerpo de POST /empresa-activa: el id de la empresa que queda activa o `null` para ninguna.
+* El campo es obligatorio (un body `{}` es inválido): `null` es una decisión, no un faltante.
+*/
+const ActiveEmpresaSchema = z.object({ empresaId: z.string().min(1).nullable() });
+/**
+* Schema para PATCH /me — record no vacío.
+* Validación extra con .refine() para rechazar body vacío.
+*/
+const UpdateUserSchema = z.record(z.string(), z.unknown()).refine((obj) => Object.keys(obj).length > 0, "Cuerpo de actualización vacío");
+/** Wire de error `{ error: { code, message } }` (componente `ErrorBody`). */
+const ErrorResponseSchema = errorResponseSchema;
+/** Wire de POST /login/get-code (200). `challengeId` es opaco; cada get-code nuevo invalida el anterior. */
+const GetCodeResponseSchema = getCodeResponseSchema;
+/** Wire de POST /login (200). */
+const LoginResponseSchema = loginResponseSchema;
+/** Wire de POST /login/refresh (200): el contrato reutiliza la respuesta de login. */
+const RefreshResponseSchema = loginResponseSchema;
+// src/auth-handlers.ts
+const KNOWN_ERROR_STATUSES = /* @__PURE__ */ new Set([
+	400,
+	401,
+	403,
+	404,
+	409,
+	429,
+	500,
+	502,
+	503
+]);
+const REASON_TO_CODE = {
+	auth_required: "unauthorized",
+	token_invalid: "unauthorized",
+	refresh_no_tokens: "unauthorized",
+	verify_failed: "unauthorized",
+	network: "service_unavailable",
+	malformed: "bad_request"
+};
+function resolveCode(evaError) {
+	if (evaError.kind === "api") return evaError.code;
+	return REASON_TO_CODE[evaError.reason];
+}
+function errorResponse(c, evaError, status) {
+	const safeStatus = KNOWN_ERROR_STATUSES.has(status) ? status : 500;
+	if (getErrorWire() === "api") return c.json({ error: {
+		code: resolveCode(evaError),
+		message: evaError.message
+	} }, safeStatus);
+	return c.json({ error: evaError.message }, safeStatus);
+}
+const SAFE_METHODS = /* @__PURE__ */ new Set([
+	"GET",
+	"HEAD",
+	"OPTIONS"
+]);
+/**
+* Origen serializado de un esquema que no es http(s) (`tauri://localhost`, `capacitor://localhost`):
+* `esquema://host[:puerto]` sin userinfo, path, query ni fragmento (una `/` final se tolera).
+*/
+const CUSTOM_SCHEME_ORIGIN = /^([a-z][a-z0-9+.-]*):\/\/([^\s/?#@\\]+)\/?$/i;
+/**
+* `new URL(...).origin` de un esquema no especial es `"null"`, así que http(s) se normaliza con el
+* parser y el resto se compara por su forma serializada en minúsculas (la que manda el navegador).
+*/
+function normalizeAllowedOrigins(origins) {
+	const normalized = /* @__PURE__ */ new Set();
+	for (const entry of origins) {
+		let url;
+		try {
+			url = new URL(entry);
+		} catch {}
+		const custom = url !== void 0 && !/^https?:$/.test(url.protocol) ? CUSTOM_SCHEME_ORIGIN.exec(entry) : null;
+		if (url === void 0 || custom === null && !/^https?:$/.test(url.protocol)) throw new Error(`[eva-auth-sdk] allowedOrigins inválido: ${JSON.stringify(entry)} (se espera un origen serializado esquema://host[:puerto], p. ej. https://app.example.com o tauri://localhost)`);
+		normalized.add(custom === null ? url.origin : `${custom[1].toLowerCase()}://${custom[2].toLowerCase()}`);
+	}
+	return normalized;
+}
+/**
+* Mismo origen = mismo host:puerto que la request; el esquema no cuenta porque tras un proxy que
+* termina TLS el servidor ve `http://` mientras el navegador manda `https://`.
+*/
+function isOriginAllowed(origin, requestUrl, allowed) {
+	let parsed;
+	try {
+		parsed = new URL(origin);
+	} catch {
+		return false;
+	}
+	return allowed.has(parsed.origin) || allowed.has(origin.toLowerCase()) || parsed.host === new URL(requestUrl).host;
+}
+function sdkError(reason, message, status) {
+	return {
+		kind: "sdk",
+		reason,
+		message,
+		status
+	};
+}
+/**
+* Construye los 12 handlers de auth con las opciones provistas.
+* Validación temprana de errorMessages si se proveen (lanza si key inválida o valor no-string).
+*
+* Decisión M2 (ADR-012): messages() se resuelve por-request (closure evalúa
+* getErrorMessages() en cada llamada). Permite que configureEvaAuth() post-factory
+* tome efecto en el siguiente request. Tradeoff: ~3 spreads + 2 fn calls per request.
+*/
+function buildAuthHandlers(opts = {}) {
+	if (opts.errorMessages !== void 0) validateErrorMessagesInput(opts.errorMessages);
+	const allowedOrigins = normalizeAllowedOrigins(opts.allowedOrigins ?? []);
+	const client = createHttpClient();
+	const messages = () => resolveErrorMessages(opts.errorMessages, getErrorMessages());
+	const bodyGuard = (invalidMessage) => ({
+		middleware: async (c, next) => {
+			c.header("Cache-Control", "no-store");
+			try {
+				await c.req.json();
+			} catch {
+				return errorResponse(c, sdkError("malformed", messages().invalidJsonBody, 400), 400);
+			}
+			await next();
+		},
+		onInvalid: (result, c) => {
+			if (result.success) return void 0;
+			c.header("Cache-Control", "no-store");
+			return errorResponse(c, sdkError("malformed", invalidMessage(), 400), 400);
+		}
+	});
+	const originGuard = async (c, next) => {
+		const origin = c.req.header("origin");
+		if (SAFE_METHODS.has(c.req.method) || origin === void 0 || isOriginAllowed(origin, c.req.url, allowedOrigins)) return next();
+		return errorResponse(c, {
+			kind: "api",
+			code: "forbidden",
+			message: messages().originNotAllowed,
+			status: 403
+		}, 403);
+	};
+	return {
+		originGuard,
+		openApiGuards: {
+			getCode: bodyGuard(() => messages().invalidPhone),
+			login: bodyGuard(() => messages().loginFailed)
+		},
+		getCode: async (c) => {
+			c.header("Cache-Control", "no-store");
+			let raw;
+			try {
+				raw = await c.req.json();
+			} catch {
+				return errorResponse(c, sdkError("malformed", messages().invalidJsonBody, 400), 400);
+			}
+			const parsed = GetCodeSchema.safeParse(raw);
+			if (!parsed.success) return errorResponse(c, sdkError("malformed", messages().invalidPhone, 400), 400);
+			const result = await client.getCode(parsed.data);
+			if (!result.ok) return errorResponse(c, result.error, result.error.status);
+			return c.json({ data: result.data });
+		},
+		login: async (c) => {
+			c.header("Cache-Control", "no-store");
+			let raw;
+			try {
+				raw = await c.req.json();
+			} catch {
+				return errorResponse(c, sdkError("malformed", messages().invalidJsonBody, 400), 400);
+			}
+			const parsed = LoginSchema.safeParse(raw);
+			if (!parsed.success) return errorResponse(c, sdkError("malformed", messages().loginFailed, 400), 400);
+			const deviceInfo = parseDeviceInfo(c.req.raw);
+			const result = await client.login({
+				...parsed.data,
+				...deviceInfo
+			});
+			if (!result.ok) return errorResponse(c, result.error, result.error.status);
+			if (result.data.tokens) {
+				const cookieHeaders = setTokenCookies(result.data.tokens);
+				for (const cookie of cookieHeaders) c.header("Set-Cookie", cookie, { append: true });
+			}
+			return c.json({ data: { user: { id: result.data.user.id } } });
+		},
+		refresh: async (c) => {
+			const cookieHeader = c.req.header("cookie") || null;
+			const { refreshToken } = readTokensFromCookies(cookieHeader);
+			if (!refreshToken) return errorResponse(c, sdkError("auth_required", messages().tokenNotFound, 401), 401);
+			const result = await deduplicateRefresh(refreshToken, () => client.refresh({ refreshToken }));
+			if (!result.ok) return errorResponse(c, result.error, result.error.status);
+			if (result.data.tokens) {
+				const cookieHeaders = setTokenCookies(result.data.tokens);
+				for (const cookie of cookieHeaders) c.header("Set-Cookie", cookie, { append: true });
+			}
+			return c.json({ data: { user: { id: result.data.user.id } } });
+		},
+		logout: async (c) => {
+			const cookieHeader = c.req.header("cookie") || null;
+			const { refreshToken } = readTokensFromCookies(cookieHeader);
+			if (!refreshToken) return errorResponse(c, sdkError("auth_required", messages().tokenNotFound, 401), 401);
+			const result = await client.logout({ refreshToken });
+			if (!result.ok) return errorResponse(c, result.error, result.error.status);
+			const clearHeaders = clearTokenCookies();
+			for (const cookie of clearHeaders) c.header("Set-Cookie", cookie, { append: true });
+			return c.json({ data: result.data });
+		},
+		getMe: async (c) => {
+			const cookieHeader = c.req.header("cookie") || null;
+			const { accessToken } = readTokensFromCookies(cookieHeader);
+			if (!accessToken) return errorResponse(c, sdkError("auth_required", messages().tokenNotFound, 401), 401);
+			const result = await client.getUser({ accessToken });
+			if (!result.ok) return errorResponse(c, result.error, result.error.status);
+			return c.json({ data: result.data });
+		},
+		updateMe: async (c) => {
+			const cookieHeader = c.req.header("cookie") || null;
+			const { accessToken } = readTokensFromCookies(cookieHeader);
+			if (!accessToken) return errorResponse(c, sdkError("auth_required", messages().tokenNotFound, 401), 401);
+			let raw;
+			try {
+				raw = await c.req.json();
+			} catch {
+				return errorResponse(c, sdkError("malformed", messages().invalidJsonBody, 400), 400);
+			}
+			const parsed = UpdateUserSchema.safeParse(raw);
+			if (!parsed.success) return errorResponse(c, sdkError("malformed", messages().invalidUpdateBody, 400), 400);
+			const result = await client.updateUser({
+				accessToken,
+				data: parsed.data
+			});
+			if (!result.ok) return errorResponse(c, result.error, result.error.status);
+			return c.json({ data: result.data });
+		},
+		deleteMe: async (c) => {
+			const cookieHeader = c.req.header("cookie") || null;
+			const { accessToken } = readTokensFromCookies(cookieHeader);
+			if (!accessToken) return errorResponse(c, sdkError("auth_required", messages().tokenNotFound, 401), 401);
+			const result = await client.deleteUser({ accessToken });
+			if (!result.ok) return errorResponse(c, result.error, result.error.status);
+			const clearHeaders = clearTokenCookies();
+			for (const cookie of clearHeaders) c.header("Set-Cookie", cookie, { append: true });
+			return c.json({ data: result.data });
+		},
+		getEmpresas: async (c) => {
+			const cookieHeader = c.req.header("cookie") || null;
+			const { accessToken } = readTokensFromCookies(cookieHeader);
+			if (!accessToken) return errorResponse(c, sdkError("auth_required", messages().tokenNotFound, 401), 401);
+			const result = await client.getUserEmpresas({ accessToken });
+			if (!result.ok) return errorResponse(c, result.error, result.error.status);
+			return c.json({ data: result.data });
+		},
+		setActiveEmpresa: async (c) => {
+			c.header("Cache-Control", "no-store");
+			const cookieHeader = c.req.header("cookie") || null;
+			const { accessToken } = readTokensFromCookies(cookieHeader);
+			if (!accessToken) return errorResponse(c, sdkError("auth_required", messages().tokenNotFound, 401), 401);
+			let raw;
+			try {
+				raw = await c.req.json();
+			} catch {
+				return errorResponse(c, sdkError("malformed", messages().invalidJsonBody, 400), 400);
+			}
+			const parsed = ActiveEmpresaSchema.safeParse(raw);
+			if (!parsed.success) return errorResponse(c, sdkError("malformed", "empresaId inválido: debe ser el id de una empresa o null", 400), 400);
+			const result = await client.setActiveEmpresa({
+				accessToken,
+				empresaId: parsed.data.empresaId
+			});
+			if (!result.ok) return errorResponse(c, result.error, result.error.status);
+			if (!result.data.accessToken) return errorResponse(c, sdkError("malformed", "Respuesta de Auth sin access token reemitido", 502), 502);
+			c.header("Set-Cookie", setAccessTokenCookie(result.data.accessToken), { append: true });
+			return c.json({ data: { empresaId: result.data.empresaId } });
+		},
+		getSessions: async (c) => {
+			const cookieHeader = c.req.header("cookie") || null;
+			const { accessToken } = readTokensFromCookies(cookieHeader);
+			if (!accessToken) return errorResponse(c, sdkError("auth_required", messages().tokenNotFound, 401), 401);
+			const result = await client.getSessions({ accessToken });
+			if (!result.ok) return errorResponse(c, result.error, result.error.status);
+			return c.json({ data: result.data });
+		},
+		deleteSession: async (c) => {
+			const cookieHeader = c.req.header("cookie") || null;
+			const { accessToken } = readTokensFromCookies(cookieHeader);
+			if (!accessToken) return errorResponse(c, sdkError("auth_required", messages().tokenNotFound, 401), 401);
+			const sessionId = c.req.param("id");
+			if (!sessionId || !/^[\w-]+$/.test(sessionId)) return errorResponse(c, sdkError("malformed", messages().sessionInvalid, 400), 400);
+			const result = await client.deleteSession({
+				accessToken,
+				sessionId
+			});
+			if (!result.ok) return errorResponse(c, result.error, result.error.status);
+			return c.json({ data: result.data });
+		},
+		deleteAllSessions: async (c) => {
+			const cookieHeader = c.req.header("cookie") || null;
+			const { refreshToken } = readTokensFromCookies(cookieHeader);
+			if (!refreshToken) return errorResponse(c, sdkError("auth_required", messages().tokenNotFound, 401), 401);
+			const result = await client.deleteAllSessions({ refreshToken });
+			if (!result.ok) return errorResponse(c, result.error, result.error.status);
+			const clearHeaders = clearTokenCookies();
+			for (const cookie of clearHeaders) c.header("Set-Cookie", cookie, { append: true });
+			return c.json({ data: result.data });
+		}
+	};
+}
+export { GetCodeSchema as a, RefreshResponseSchema as c, GetCodeResponseSchema as i, UpdateUserSchema as l, ActiveEmpresaSchema as n, LoginResponseSchema as o, ErrorResponseSchema as r, LoginSchema as s, buildAuthHandlers as t, parseDeviceInfo as u };
+
+//# sourceMappingURL=auth-handlers-B3iJaPln.js.map

package/dist/auth-handlers-B3iJaPln.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-handlers-B3iJaPln.js","names":[],"sources":["../src/hono/device-info.ts","../src/schemas.ts","../src/auth-handlers.ts"],"sourcesContent":["import Bowser from 'bowser'\nimport type { DeviceInfo } from '../types'\n\nexport function parseDeviceInfo(request: Request): DeviceInfo {\n  const userAgent = request.headers.get('user-agent') || ''\n  const parsed = Bowser.parse(userAgent)\n\n  return {\n    deviceType: parsed.platform?.type || 'desktop',\n    os: parsed.os?.name || 'Unknown',\n    browser: parsed.browser?.name || 'Unknown',\n    userAgent: userAgent.slice(0, 500),\n  }\n}\n","/**\n * Schemas Zod 4 compartidos — fuente canónica (B1 confirmado por T-00 probe).\n * Usados por auth-handlers.ts (validación runtime) y hono-openapi/index.ts (OpenAPI doc).\n * Importar desde aquí evita duplicación y garantiza consistencia entre variantes.\n *\n * `parseErrorResponse` vive en `parse-error-response.ts` (módulo puro, D-35): este archivo no es\n * alcanzable desde `src/react/index.ts`.\n */\nimport { z } from 'zod'\nimport {\n  errorResponseSchema,\n  getCodeResponseSchema,\n  loginResponseSchema,\n} from '@eva_solutions/auth-contracts'\n\n// === Request schemas ===\n\nexport const GetCodeSchema = z.object({\n  phone: z.string().min(1),\n})\n\n/**\n * Cuerpo de POST /login. `challengeId` es el identificador opaco que devolvió\n * POST /get-code para este código: el navegador lo conserva en memoria y lo\n * reenvía junto con el código. Sin él, /login responde 400 (`malformed`).\n */\nexport const LoginSchema = z.object({\n  phone: z.string().min(1),\n  code: z.string().min(1),\n  challengeId: z.string().min(1),\n  // Empresa que queda activa (opcional). El `producto` NO viene del navegador: lo pone el SDK.\n  empresaId: z.string().min(1).optional(),\n})\n\n/**\n * Cuerpo de POST /empresa-activa: el id de la empresa que queda activa o `null` para ninguna.\n * El campo es obligatorio (un body `{}` es inválido): `null` es una decisión, no un faltante.\n */\nexport const ActiveEmpresaSchema = z.object({\n  empresaId: z.string().min(1).nullable(),\n})\n\n/**\n * Schema para PATCH /me — record no vacío.\n * Validación extra con .refine() para rechazar body vacío.\n */\nexport const UpdateUserSchema = z\n  .record(z.string(), z.unknown())\n  .refine((obj) => Object.keys(obj).length > 0, 'Cuerpo de actualización vacío')\n\n// === Response schemas ===\n\n/*\n * Los schemas de respuesta son alias del contrato compartido (D-28: el tipo es idéntico al que\n * este archivo definía antes). Se usan solo para documentar OpenAPI: `http-client` no los parsea en\n * runtime. Este módulo registra metadatos de zod al cargarse, así que NO debe ser alcanzable desde\n * `src/react` (regla D-35: ahí solo se importan valores de módulos puros o `import type`).\n */\n\n/** Wire de error `{ error: { code, message } }` (componente `ErrorBody`). */\nexport const ErrorResponseSchema = errorResponseSchema\n\n/** Wire de POST /login/get-code (200). `challengeId` es opaco; cada get-code nuevo invalida el anterior. */\nexport const GetCodeResponseSchema = getCodeResponseSchema\n\n/** Wire de POST /login (200). */\nexport const LoginResponseSchema = loginResponseSchema\n\n/** Wire de POST /login/refresh (200): el contrato reutiliza la respuesta de login. */\nexport const RefreshResponseSchema = loginResponseSchema\n\n// === Inferred types ===\n\nexport type GetCodeInput = z.infer<typeof GetCodeSchema>\nexport type LoginInput = z.infer<typeof LoginSchema>\nexport type ActiveEmpresaInput = z.infer<typeof ActiveEmpresaSchema>\nexport type UpdateUserInput = z.infer<typeof UpdateUserSchema>\n","/**\n * Factory de handlers de auth — fuente única de verdad para los 12 endpoints.\n * Compartido entre evaAuthRoutes() (Hono plano) y evaAuthOpenAPIRoutes() (OpenAPIHono).\n * Decisión M2: resolución de messages() por-request (closure evalúa global cada vez).\n */\nimport type { Context, MiddlewareHandler } from 'hono'\nimport { createHttpClient } from './http-client'\nimport {\n  readTokensFromCookies,\n  setTokenCookies,\n  setAccessTokenCookie,\n  clearTokenCookies,\n} from './cookies'\nimport { deduplicateRefresh } from './refresh-dedup'\nimport { parseDeviceInfo } from './hono/device-info'\nimport { resolveErrorMessages, type EvaErrorMessages } from './error-messages'\nimport {\n  getErrorMessages,\n  getErrorWire,\n  validateErrorMessagesInput,\n} from './config'\nimport {\n  ActiveEmpresaSchema,\n  GetCodeSchema,\n  LoginSchema,\n  UpdateUserSchema,\n} from './schemas'\nimport type { EvaError, EvaSdkError } from './types'\nimport type { SdkErrorReason } from './error-codes'\n\nexport interface AuthHandlerOptions {\n  errorMessages?: Partial<EvaErrorMessages>\n  /**\n   * Orígenes extra (`https://app.example.com`, sin path) desde los que se aceptan las mutaciones\n   * con cookies, además del propio host de la request. Un `Origin` fuera de esa lista responde 403.\n   * Acepta cualquier origen serializado `esquema://host[:puerto]` (también `tauri://localhost`,\n   * `capacitor://localhost`) por coincidencia exacta. Lanza al construir si una entrada no lo es\n   * (p. ej. `'*'` o `null`).\n   */\n  allowedOrigins?: readonly string[]\n}\n\n/**\n * Guardas para la variante OpenAPI de get-code/login: el validador de\n * @hono/zod-openapi responde el 400 antes que el handler, así que\n * no-store y el wire de error se replican aquí. middleware corre antes del validador\n * (JSON malformado); onInvalid es el hook del validador (body que no cumple el schema).\n */\nexport interface OpenAPIBodyGuard {\n  middleware: MiddlewareHandler\n  onInvalid: (result: { success: boolean }, c: Context) => Response | undefined\n}\n\nexport interface AuthHandlers {\n  /** Middleware CSRF: rechaza con 403 las mutaciones cuyo `Origin` no está permitido. */\n  originGuard: MiddlewareHandler\n  openApiGuards: { getCode: OpenAPIBodyGuard; login: OpenAPIBodyGuard }\n  getCode: (c: Context) => Promise<Response>\n  login: (c: Context) => Promise<Response>\n  refresh: (c: Context) => Promise<Response>\n  logout: (c: Context) => Promise<Response>\n  getMe: (c: Context) => Promise<Response>\n  updateMe: (c: Context) => Promise<Response>\n  deleteMe: (c: Context) => Promise<Response>\n  getEmpresas: (c: Context) => Promise<Response>\n  setActiveEmpresa: (c: Context) => Promise<Response>\n  getSessions: (c: Context) => Promise<Response>\n  deleteSession: (c: Context) => Promise<Response>\n  deleteAllSessions: (c: Context) => Promise<Response>\n}\n\ntype ErrorStatus = 400 | 401 | 403 | 404 | 409 | 429 | 500 | 502 | 503\n\nconst KNOWN_ERROR_STATUSES = new Set<number>([\n  400, 401, 403, 404, 409, 429, 500, 502, 503,\n])\n\nconst REASON_TO_CODE: Record<SdkErrorReason, string> = {\n  auth_required: 'unauthorized',\n  token_invalid: 'unauthorized',\n  refresh_no_tokens: 'unauthorized',\n  verify_failed: 'unauthorized',\n  network: 'service_unavailable',\n  malformed: 'bad_request',\n}\n\nfunction resolveCode(evaError: EvaError): string {\n  if (evaError.kind === 'api') return evaError.code\n  return REASON_TO_CODE[evaError.reason]\n}\n\nfunction errorResponse(\n  c: Context,\n  evaError: EvaError,\n  status: number,\n): Response {\n  const safeStatus = KNOWN_ERROR_STATUSES.has(status)\n    ? (status as ErrorStatus)\n    : 500\n  const wire = getErrorWire()\n  if (wire === 'api') {\n    return c.json(\n      { error: { code: resolveCode(evaError), message: evaError.message } },\n      safeStatus,\n    )\n  }\n  return c.json({ error: evaError.message }, safeStatus)\n}\n\nconst SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS'])\n\n/**\n * Origen serializado de un esquema que no es http(s) (`tauri://localhost`, `capacitor://localhost`):\n * `esquema://host[:puerto]` sin userinfo, path, query ni fragmento (una `/` final se tolera).\n */\nconst CUSTOM_SCHEME_ORIGIN = /^([a-z][a-z0-9+.-]*):\\/\\/([^\\s/?#@\\\\]+)\\/?$/i\n\n/**\n * `new URL(...).origin` de un esquema no especial es `\"null\"`, así que http(s) se normaliza con el\n * parser y el resto se compara por su forma serializada en minúsculas (la que manda el navegador).\n */\nfunction normalizeAllowedOrigins(origins: readonly string[]): Set<string> {\n  const normalized = new Set<string>()\n  for (const entry of origins) {\n    let url: URL | undefined\n    try {\n      url = new URL(entry)\n    } catch {\n      // cae al throw de abajo\n    }\n    const custom =\n      url !== undefined && !/^https?:$/.test(url.protocol)\n        ? CUSTOM_SCHEME_ORIGIN.exec(entry)\n        : null\n    if (\n      url === undefined ||\n      (custom === null && !/^https?:$/.test(url.protocol))\n    ) {\n      throw new Error(\n        `[eva-auth-sdk] allowedOrigins inválido: ${JSON.stringify(entry)} (se espera un origen serializado esquema://host[:puerto], p. ej. https://app.example.com o tauri://localhost)`,\n      )\n    }\n    normalized.add(\n      custom === null\n        ? url.origin\n        : `${(custom[1] as string).toLowerCase()}://${(custom[2] as string).toLowerCase()}`,\n    )\n  }\n  return normalized\n}\n\n/**\n * Mismo origen = mismo host:puerto que la request; el esquema no cuenta porque tras un proxy que\n * termina TLS el servidor ve `http://` mientras el navegador manda `https://`.\n */\nfunction isOriginAllowed(\n  origin: string,\n  requestUrl: string,\n  allowed: ReadonlySet<string>,\n): boolean {\n  let parsed: URL\n  try {\n    parsed = new URL(origin)\n  } catch {\n    return false // `Origin: null` (iframes sandbox, redirects entre orígenes) y basura\n  }\n  return (\n    allowed.has(parsed.origin) ||\n    allowed.has(origin.toLowerCase()) ||\n    parsed.host === new URL(requestUrl).host\n  )\n}\n\nfunction sdkError(\n  reason: SdkErrorReason,\n  message: string,\n  status: number,\n): EvaSdkError {\n  return { kind: 'sdk', reason, message, status }\n}\n\n/**\n * Construye los 12 handlers de auth con las opciones provistas.\n * Validación temprana de errorMessages si se proveen (lanza si key inválida o valor no-string).\n *\n * Decisión M2 (ADR-012): messages() se resuelve por-request (closure evalúa\n * getErrorMessages() en cada llamada). Permite que configureEvaAuth() post-factory\n * tome efecto en el siguiente request. Tradeoff: ~3 spreads + 2 fn calls per request.\n */\nexport function buildAuthHandlers(opts: AuthHandlerOptions = {}): AuthHandlers {\n  if (opts.errorMessages !== undefined) {\n    validateErrorMessagesInput(opts.errorMessages)\n  }\n\n  const allowedOrigins = normalizeAllowedOrigins(opts.allowedOrigins ?? [])\n\n  const client = createHttpClient()\n\n  // Resolución diferida por-request (M2)\n  const messages = () =>\n    resolveErrorMessages(opts.errorMessages, getErrorMessages())\n\n  const bodyGuard = (invalidMessage: () => string): OpenAPIBodyGuard => ({\n    middleware: async (c, next) => {\n      c.header('Cache-Control', 'no-store')\n      try {\n        await c.req.json()\n      } catch {\n        return errorResponse(\n          c,\n          sdkError('malformed', messages().invalidJsonBody, 400),\n          400,\n        )\n      }\n      await next()\n    },\n    onInvalid: (result, c) => {\n      if (result.success) return undefined\n      c.header('Cache-Control', 'no-store')\n      return errorResponse(c, sdkError('malformed', invalidMessage(), 400), 400)\n    },\n  })\n\n  // Sin `Origin` (curl, servidores) se deja pasar: todo navegador lo manda en las mutaciones.\n  const originGuard: MiddlewareHandler = async (c, next) => {\n    const origin = c.req.header('origin')\n    if (\n      SAFE_METHODS.has(c.req.method) ||\n      origin === undefined ||\n      isOriginAllowed(origin, c.req.url, allowedOrigins)\n    ) {\n      return next()\n    }\n    return errorResponse(\n      c,\n      {\n        kind: 'api',\n        code: 'forbidden',\n        message: messages().originNotAllowed,\n        status: 403,\n      },\n      403,\n    )\n  }\n\n  return {\n    originGuard,\n    openApiGuards: {\n      getCode: bodyGuard(() => messages().invalidPhone),\n      login: bodyGuard(() => messages().loginFailed),\n    },\n    // POST /get-code\n    getCode: async (c: Context): Promise<Response> => {\n      // Respuestas con challengeId/cookies: nunca cacheables (paridad con el API).\n      c.header('Cache-Control', 'no-store')\n      let raw: unknown\n      try {\n        raw = await c.req.json()\n      } catch {\n        return errorResponse(\n          c,\n          sdkError('malformed', messages().invalidJsonBody, 400),\n          400,\n        )\n      }\n      const parsed = GetCodeSchema.safeParse(raw)\n      if (!parsed.success) {\n        return errorResponse(\n          c,\n          sdkError('malformed', messages().invalidPhone, 400),\n          400,\n        )\n      }\n      const result = await client.getCode(parsed.data)\n      if (!result.ok) return errorResponse(c, result.error, result.error.status)\n      return c.json({ data: result.data })\n    },\n\n    // POST /login\n    login: async (c: Context): Promise<Response> => {\n      // Respuestas con challengeId/cookies: nunca cacheables (paridad con el API).\n      c.header('Cache-Control', 'no-store')\n      let raw: unknown\n      try {\n        raw = await c.req.json()\n      } catch {\n        return errorResponse(\n          c,\n          sdkError('malformed', messages().invalidJsonBody, 400),\n          400,\n        )\n      }\n      const parsed = LoginSchema.safeParse(raw)\n      if (!parsed.success) {\n        return errorResponse(\n          c,\n          sdkError('malformed', messages().loginFailed, 400),\n          400,\n        )\n      }\n      const deviceInfo = parseDeviceInfo(c.req.raw)\n      const result = await client.login({ ...parsed.data, ...deviceInfo })\n      if (!result.ok) return errorResponse(c, result.error, result.error.status)\n      if (result.data.tokens) {\n        const cookieHeaders = setTokenCookies(result.data.tokens)\n        for (const cookie of cookieHeaders) {\n          c.header('Set-Cookie', cookie, { append: true })\n        }\n      }\n      return c.json({ data: { user: { id: result.data.user.id } } })\n    },\n\n    // POST /refresh\n    refresh: async (c: Context): Promise<Response> => {\n      const cookieHeader = c.req.header('cookie') || null\n      const { refreshToken } = readTokensFromCookies(cookieHeader)\n      if (!refreshToken)\n        return errorResponse(\n          c,\n          sdkError('auth_required', messages().tokenNotFound, 401),\n          401,\n        )\n      const result = await deduplicateRefresh(refreshToken, () =>\n        client.refresh({ refreshToken }),\n      )\n      if (!result.ok) return errorResponse(c, result.error, result.error.status)\n      if (result.data.tokens) {\n        const cookieHeaders = setTokenCookies(result.data.tokens)\n        for (const cookie of cookieHeaders) {\n          c.header('Set-Cookie', cookie, { append: true })\n        }\n      }\n      return c.json({ data: { user: { id: result.data.user.id } } })\n    },\n\n    // POST /logout\n    logout: async (c: Context): Promise<Response> => {\n      const cookieHeader = c.req.header('cookie') || null\n      const { refreshToken } = readTokensFromCookies(cookieHeader)\n      if (!refreshToken)\n        return errorResponse(\n          c,\n          sdkError('auth_required', messages().tokenNotFound, 401),\n          401,\n        )\n      const result = await client.logout({ refreshToken })\n      if (!result.ok) return errorResponse(c, result.error, result.error.status)\n      const clearHeaders = clearTokenCookies()\n      for (const cookie of clearHeaders) {\n        c.header('Set-Cookie', cookie, { append: true })\n      }\n      return c.json({ data: result.data })\n    },\n\n    // GET /me\n    getMe: async (c: Context): Promise<Response> => {\n      const cookieHeader = c.req.header('cookie') || null\n      const { accessToken } = readTokensFromCookies(cookieHeader)\n      if (!accessToken)\n        return errorResponse(\n          c,\n          sdkError('auth_required', messages().tokenNotFound, 401),\n          401,\n        )\n      const result = await client.getUser({ accessToken })\n      if (!result.ok) return errorResponse(c, result.error, result.error.status)\n      return c.json({ data: result.data })\n    },\n\n    // PATCH /me\n    updateMe: async (c: Context): Promise<Response> => {\n      const cookieHeader = c.req.header('cookie') || null\n      const { accessToken } = readTokensFromCookies(cookieHeader)\n      if (!accessToken)\n        return errorResponse(\n          c,\n          sdkError('auth_required', messages().tokenNotFound, 401),\n          401,\n        )\n      let raw: unknown\n      try {\n        raw = await c.req.json()\n      } catch {\n        return errorResponse(\n          c,\n          sdkError('malformed', messages().invalidJsonBody, 400),\n          400,\n        )\n      }\n      const parsed = UpdateUserSchema.safeParse(raw)\n      if (!parsed.success) {\n        return errorResponse(\n          c,\n          sdkError('malformed', messages().invalidUpdateBody, 400),\n          400,\n        )\n      }\n      const result = await client.updateUser({ accessToken, data: parsed.data })\n      if (!result.ok) return errorResponse(c, result.error, result.error.status)\n      return c.json({ data: result.data })\n    },\n\n    // DELETE /me\n    deleteMe: async (c: Context): Promise<Response> => {\n      const cookieHeader = c.req.header('cookie') || null\n      const { accessToken } = readTokensFromCookies(cookieHeader)\n      if (!accessToken)\n        return errorResponse(\n          c,\n          sdkError('auth_required', messages().tokenNotFound, 401),\n          401,\n        )\n      const result = await client.deleteUser({ accessToken })\n      if (!result.ok) return errorResponse(c, result.error, result.error.status)\n      const clearHeaders = clearTokenCookies()\n      for (const cookie of clearHeaders) {\n        c.header('Set-Cookie', cookie, { append: true })\n      }\n      return c.json({ data: result.data })\n    },\n\n    // GET /empresas\n    getEmpresas: async (c: Context): Promise<Response> => {\n      const cookieHeader = c.req.header('cookie') || null\n      const { accessToken } = readTokensFromCookies(cookieHeader)\n      if (!accessToken)\n        return errorResponse(\n          c,\n          sdkError('auth_required', messages().tokenNotFound, 401),\n          401,\n        )\n      const result = await client.getUserEmpresas({ accessToken })\n      if (!result.ok) return errorResponse(c, result.error, result.error.status)\n      return c.json({ data: result.data })\n    },\n\n    // POST /empresa-activa\n    setActiveEmpresa: async (c: Context): Promise<Response> => {\n      // Lleva un access token nuevo en una cookie: nunca cacheable.\n      c.header('Cache-Control', 'no-store')\n      const cookieHeader = c.req.header('cookie') || null\n      const { accessToken } = readTokensFromCookies(cookieHeader)\n      if (!accessToken)\n        return errorResponse(\n          c,\n          sdkError('auth_required', messages().tokenNotFound, 401),\n          401,\n        )\n      let raw: unknown\n      try {\n        raw = await c.req.json()\n      } catch {\n        return errorResponse(\n          c,\n          sdkError('malformed', messages().invalidJsonBody, 400),\n          400,\n        )\n      }\n      const parsed = ActiveEmpresaSchema.safeParse(raw)\n      if (!parsed.success) {\n        return errorResponse(\n          c,\n          sdkError(\n            'malformed',\n            'empresaId inválido: debe ser el id de una empresa o null',\n            400,\n          ),\n          400,\n        )\n      }\n      const result = await client.setActiveEmpresa({\n        accessToken,\n        empresaId: parsed.data.empresaId,\n      })\n      if (!result.ok) return errorResponse(c, result.error, result.error.status)\n      // Auth reemite SOLO el access token; sin él la sesión seguiría con la empresa vieja y no hay\n      // nada que reescribir: es una respuesta inválida de Auth, no un éxito.\n      if (!result.data.accessToken) {\n        return errorResponse(\n          c,\n          sdkError(\n            'malformed',\n            'Respuesta de Auth sin access token reemitido',\n            502,\n          ),\n          502,\n        )\n      }\n      c.header('Set-Cookie', setAccessTokenCookie(result.data.accessToken), {\n        append: true,\n      })\n      return c.json({ data: { empresaId: result.data.empresaId } })\n    },\n\n    // GET /sessions\n    getSessions: async (c: Context): Promise<Response> => {\n      const cookieHeader = c.req.header('cookie') || null\n      const { accessToken } = readTokensFromCookies(cookieHeader)\n      if (!accessToken)\n        return errorResponse(\n          c,\n          sdkError('auth_required', messages().tokenNotFound, 401),\n          401,\n        )\n      const result = await client.getSessions({ accessToken })\n      if (!result.ok) return errorResponse(c, result.error, result.error.status)\n      return c.json({ data: result.data })\n    },\n\n    // DELETE /sessions/:id\n    deleteSession: async (c: Context): Promise<Response> => {\n      const cookieHeader = c.req.header('cookie') || null\n      const { accessToken } = readTokensFromCookies(cookieHeader)\n      if (!accessToken)\n        return errorResponse(\n          c,\n          sdkError('auth_required', messages().tokenNotFound, 401),\n          401,\n        )\n      const sessionId = c.req.param('id')\n      if (!sessionId || !/^[\\w-]+$/.test(sessionId)) {\n        return errorResponse(\n          c,\n          sdkError('malformed', messages().sessionInvalid, 400),\n          400,\n        )\n      }\n      const result = await client.deleteSession({ accessToken, sessionId })\n      if (!result.ok) return errorResponse(c, result.error, result.error.status)\n      return c.json({ data: result.data })\n    },\n\n    // DELETE /sessions\n    deleteAllSessions: async (c: Context): Promise<Response> => {\n      const cookieHeader = c.req.header('cookie') || null\n      const { refreshToken } = readTokensFromCookies(cookieHeader)\n      if (!refreshToken)\n        return errorResponse(\n          c,\n          sdkError('auth_required', messages().tokenNotFound, 401),\n          401,\n        )\n      const result = await client.deleteAllSessions({ refreshToken })\n      if (!result.ok) return errorResponse(c, result.error, result.error.status)\n      const clearHeaders = clearTokenCookies()\n      for (const cookie of clearHeaders) {\n        c.header('Set-Cookie', cookie, { append: true })\n      }\n      return c.json({ data: result.data })\n    },\n  }\n}\n"],"mappings":";;;;;;;;AAGA,SAAgB,gBAAgB,SAA8B;CAC5D,MAAM,YAAY,QAAQ,QAAQ,IAAI,YAAY,KAAK;CACvD,MAAM,SAAS,OAAO,MAAM,SAAS;CAErC,OAAO;EACL,YAAY,OAAO,UAAU,QAAQ;EACrC,IAAI,OAAO,IAAI,QAAQ;EACvB,SAAS,OAAO,SAAS,QAAQ;EACjC,WAAW,UAAU,MAAM,GAAG,GAAG;CACnC;AACF;;;;;;;;;;ACIA,MAAa,gBAAgB,EAAE,OAAO,EACpC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EACzB,CAAC;;;;;;AAOD,MAAa,cAAc,EAAE,OAAO;CAClC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACvB,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACtB,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAE7B,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;AACxC,CAAC;;;;;AAMD,MAAa,sBAAsB,EAAE,OAAO,EAC1C,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EACxC,CAAC;;;;;AAMD,MAAa,mBAAmB,EAC7B,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC,CAC/B,QAAQ,QAAQ,OAAO,KAAK,GAAG,CAAC,CAAC,SAAS,GAAG,+BAA+B;;AAY/E,MAAa,sBAAsB;;AAGnC,MAAa,wBAAwB;;AAGrC,MAAa,sBAAsB;;AAGnC,MAAa,wBAAwB;;ACIrC,MAAM,uCAAuB,IAAI,IAAY;CAC3C;CAAK;CAAK;CAAK;CAAK;CAAK;CAAK;CAAK;CAAK;AAC1C,CAAC;AAED,MAAM,iBAAiD;CACrD,eAAe;CACf,eAAe;CACf,mBAAmB;CACnB,eAAe;CACf,SAAS;CACT,WAAW;AACb;AAEA,SAAS,YAAY,UAA4B;CAC/C,IAAI,SAAS,SAAS,OAAO,OAAO,SAAS;CAC7C,OAAO,eAAe,SAAS;AACjC;AAEA,SAAS,cACP,GACA,UACA,QACU;CACV,MAAM,aAAa,qBAAqB,IAAI,MAAM,IAC7C,SACD;CAEJ,IADa,aACN,MAAM,OACX,OAAO,EAAE,KACP,EAAE,OAAO;EAAE,MAAM,YAAY,QAAQ;EAAG,SAAS,SAAS;CAAQ,EAAE,GACpE,UACF;CAEF,OAAO,EAAE,KAAK,EAAE,OAAO,SAAS,QAAQ,GAAG,UAAU;AACvD;AAEA,MAAM,+BAAe,IAAI,IAAI;CAAC;CAAO;CAAQ;AAAS,CAAC;;;;;AAMvD,MAAM,uBAAuB;;;;;AAM7B,SAAS,wBAAwB,SAAyC;CACxE,MAAM,6BAAa,IAAI,IAAY;CACnC,KAAK,MAAM,SAAS,SAAS;EAC3B,IAAI;EACJ,IAAI;GACF,MAAM,IAAI,IAAI,KAAK;EACrB,QAAQ,CAER;EACA,MAAM,SACJ,QAAQ,KAAA,KAAa,CAAC,YAAY,KAAK,IAAI,QAAQ,IAC/C,qBAAqB,KAAK,KAAK,IAC/B;EACN,IACE,QAAQ,KAAA,KACP,WAAW,QAAQ,CAAC,YAAY,KAAK,IAAI,QAAQ,GAElD,MAAM,IAAI,MACR,2CAA2C,KAAK,UAAU,KAAK,EAAE,+GACnE;EAEF,WAAW,IACT,WAAW,OACP,IAAI,SACJ,GAAI,OAAO,EAAE,CAAY,YAAY,EAAE,KAAM,OAAO,EAAE,CAAY,YAAY,GACpF;CACF;CACA,OAAO;AACT;;;;;AAMA,SAAS,gBACP,QACA,YACA,SACS;CACT,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,MAAM;CACzB,QAAQ;EACN,OAAO;CACT;CACA,OACE,QAAQ,IAAI,OAAO,MAAM,KACzB,QAAQ,IAAI,OAAO,YAAY,CAAC,KAChC,OAAO,SAAS,IAAI,IAAI,UAAU,CAAC,CAAC;AAExC;AAEA,SAAS,SACP,QACA,SACA,QACa;CACb,OAAO;EAAE,MAAM;EAAO;EAAQ;EAAS;CAAO;AAChD;;;;;;;;;AAUA,SAAgB,kBAAkB,OAA2B,CAAC,GAAiB;CAC7E,IAAI,KAAK,kBAAkB,KAAA,GACzB,2BAA2B,KAAK,aAAa;CAG/C,MAAM,iBAAiB,wBAAwB,KAAK,kBAAkB,CAAC,CAAC;CAExE,MAAM,SAAS,iBAAiB;CAGhC,MAAM,iBACJ,qBAAqB,KAAK,eAAe,iBAAiB,CAAC;CAE7D,MAAM,aAAa,oBAAoD;EACrE,YAAY,OAAO,GAAG,SAAS;GAC7B,EAAE,OAAO,iBAAiB,UAAU;GACpC,IAAI;IACF,MAAM,EAAE,IAAI,KAAK;GACnB,QAAQ;IACN,OAAO,cACL,GACA,SAAS,aAAa,SAAS,CAAC,CAAC,iBAAiB,GAAG,GACrD,GACF;GACF;GACA,MAAM,KAAK;EACb;EACA,YAAY,QAAQ,MAAM;GACxB,IAAI,OAAO,SAAS,OAAO,KAAA;GAC3B,EAAE,OAAO,iBAAiB,UAAU;GACpC,OAAO,cAAc,GAAG,SAAS,aAAa,eAAe,GAAG,GAAG,GAAG,GAAG;EAC3E;CACF;CAGA,MAAM,cAAiC,OAAO,GAAG,SAAS;EACxD,MAAM,SAAS,EAAE,IAAI,OAAO,QAAQ;EACpC,IACE,aAAa,IAAI,EAAE,IAAI,MAAM,KAC7B,WAAW,KAAA,KACX,gBAAgB,QAAQ,EAAE,IAAI,KAAK,cAAc,GAEjD,OAAO,KAAK;EAEd,OAAO,cACL,GACA;GACE,MAAM;GACN,MAAM;GACN,SAAS,SAAS,CAAC,CAAC;GACpB,QAAQ;EACV,GACA,GACF;CACF;CAEA,OAAO;EACL;EACA,eAAe;GACb,SAAS,gBAAgB,SAAS,CAAC,CAAC,YAAY;GAChD,OAAO,gBAAgB,SAAS,CAAC,CAAC,WAAW;EAC/C;EAEA,SAAS,OAAO,MAAkC;GAEhD,EAAE,OAAO,iBAAiB,UAAU;GACpC,IAAI;GACJ,IAAI;IACF,MAAM,MAAM,EAAE,IAAI,KAAK;GACzB,QAAQ;IACN,OAAO,cACL,GACA,SAAS,aAAa,SAAS,CAAC,CAAC,iBAAiB,GAAG,GACrD,GACF;GACF;GACA,MAAM,SAAS,cAAc,UAAU,GAAG;GAC1C,IAAI,CAAC,OAAO,SACV,OAAO,cACL,GACA,SAAS,aAAa,SAAS,CAAC,CAAC,cAAc,GAAG,GAClD,GACF;GAEF,MAAM,SAAS,MAAM,OAAO,QAAQ,OAAO,IAAI;GAC/C,IAAI,CAAC,OAAO,IAAI,OAAO,cAAc,GAAG,OAAO,OAAO,OAAO,MAAM,MAAM;GACzE,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,KAAK,CAAC;EACrC;EAGA,OAAO,OAAO,MAAkC;GAE9C,EAAE,OAAO,iBAAiB,UAAU;GACpC,IAAI;GACJ,IAAI;IACF,MAAM,MAAM,EAAE,IAAI,KAAK;GACzB,QAAQ;IACN,OAAO,cACL,GACA,SAAS,aAAa,SAAS,CAAC,CAAC,iBAAiB,GAAG,GACrD,GACF;GACF;GACA,MAAM,SAAS,YAAY,UAAU,GAAG;GACxC,IAAI,CAAC,OAAO,SACV,OAAO,cACL,GACA,SAAS,aAAa,SAAS,CAAC,CAAC,aAAa,GAAG,GACjD,GACF;GAEF,MAAM,aAAa,gBAAgB,EAAE,IAAI,GAAG;GAC5C,MAAM,SAAS,MAAM,OAAO,MAAM;IAAE,GAAG,OAAO;IAAM,GAAG;GAAW,CAAC;GACnE,IAAI,CAAC,OAAO,IAAI,OAAO,cAAc,GAAG,OAAO,OAAO,OAAO,MAAM,MAAM;GACzE,IAAI,OAAO,KAAK,QAAQ;IACtB,MAAM,gBAAgB,gBAAgB,OAAO,KAAK,MAAM;IACxD,KAAK,MAAM,UAAU,eACnB,EAAE,OAAO,cAAc,QAAQ,EAAE,QAAQ,KAAK,CAAC;GAEnD;GACA,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,OAAO,KAAK,KAAK,GAAG,EAAE,EAAE,CAAC;EAC/D;EAGA,SAAS,OAAO,MAAkC;GAChD,MAAM,eAAe,EAAE,IAAI,OAAO,QAAQ,KAAK;GAC/C,MAAM,EAAE,iBAAiB,sBAAsB,YAAY;GAC3D,IAAI,CAAC,cACH,OAAO,cACL,GACA,SAAS,iBAAiB,SAAS,CAAC,CAAC,eAAe,GAAG,GACvD,GACF;GACF,MAAM,SAAS,MAAM,mBAAmB,oBACtC,OAAO,QAAQ,EAAE,aAAa,CAAC,CACjC;GACA,IAAI,CAAC,OAAO,IAAI,OAAO,cAAc,GAAG,OAAO,OAAO,OAAO,MAAM,MAAM;GACzE,IAAI,OAAO,KAAK,QAAQ;IACtB,MAAM,gBAAgB,gBAAgB,OAAO,KAAK,MAAM;IACxD,KAAK,MAAM,UAAU,eACnB,EAAE,OAAO,cAAc,QAAQ,EAAE,QAAQ,KAAK,CAAC;GAEnD;GACA,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,OAAO,KAAK,KAAK,GAAG,EAAE,EAAE,CAAC;EAC/D;EAGA,QAAQ,OAAO,MAAkC;GAC/C,MAAM,eAAe,EAAE,IAAI,OAAO,QAAQ,KAAK;GAC/C,MAAM,EAAE,iBAAiB,sBAAsB,YAAY;GAC3D,IAAI,CAAC,cACH,OAAO,cACL,GACA,SAAS,iBAAiB,SAAS,CAAC,CAAC,eAAe,GAAG,GACvD,GACF;GACF,MAAM,SAAS,MAAM,OAAO,OAAO,EAAE,aAAa,CAAC;GACnD,IAAI,CAAC,OAAO,IAAI,OAAO,cAAc,GAAG,OAAO,OAAO,OAAO,MAAM,MAAM;GACzE,MAAM,eAAe,kBAAkB;GACvC,KAAK,MAAM,UAAU,cACnB,EAAE,OAAO,cAAc,QAAQ,EAAE,QAAQ,KAAK,CAAC;GAEjD,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,KAAK,CAAC;EACrC;EAGA,OAAO,OAAO,MAAkC;GAC9C,MAAM,eAAe,EAAE,IAAI,OAAO,QAAQ,KAAK;GAC/C,MAAM,EAAE,gBAAgB,sBAAsB,YAAY;GAC1D,IAAI,CAAC,aACH,OAAO,cACL,GACA,SAAS,iBAAiB,SAAS,CAAC,CAAC,eAAe,GAAG,GACvD,GACF;GACF,MAAM,SAAS,MAAM,OAAO,QAAQ,EAAE,YAAY,CAAC;GACnD,IAAI,CAAC,OAAO,IAAI,OAAO,cAAc,GAAG,OAAO,OAAO,OAAO,MAAM,MAAM;GACzE,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,KAAK,CAAC;EACrC;EAGA,UAAU,OAAO,MAAkC;GACjD,MAAM,eAAe,EAAE,IAAI,OAAO,QAAQ,KAAK;GAC/C,MAAM,EAAE,gBAAgB,sBAAsB,YAAY;GAC1D,IAAI,CAAC,aACH,OAAO,cACL,GACA,SAAS,iBAAiB,SAAS,CAAC,CAAC,eAAe,GAAG,GACvD,GACF;GACF,IAAI;GACJ,IAAI;IACF,MAAM,MAAM,EAAE,IAAI,KAAK;GACzB,QAAQ;IACN,OAAO,cACL,GACA,SAAS,aAAa,SAAS,CAAC,CAAC,iBAAiB,GAAG,GACrD,GACF;GACF;GACA,MAAM,SAAS,iBAAiB,UAAU,GAAG;GAC7C,IAAI,CAAC,OAAO,SACV,OAAO,cACL,GACA,SAAS,aAAa,SAAS,CAAC,CAAC,mBAAmB,GAAG,GACvD,GACF;GAEF,MAAM,SAAS,MAAM,OAAO,WAAW;IAAE;IAAa,MAAM,OAAO;GAAK,CAAC;GACzE,IAAI,CAAC,OAAO,IAAI,OAAO,cAAc,GAAG,OAAO,OAAO,OAAO,MAAM,MAAM;GACzE,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,KAAK,CAAC;EACrC;EAGA,UAAU,OAAO,MAAkC;GACjD,MAAM,eAAe,EAAE,IAAI,OAAO,QAAQ,KAAK;GAC/C,MAAM,EAAE,gBAAgB,sBAAsB,YAAY;GAC1D,IAAI,CAAC,aACH,OAAO,cACL,GACA,SAAS,iBAAiB,SAAS,CAAC,CAAC,eAAe,GAAG,GACvD,GACF;GACF,MAAM,SAAS,MAAM,OAAO,WAAW,EAAE,YAAY,CAAC;GACtD,IAAI,CAAC,OAAO,IAAI,OAAO,cAAc,GAAG,OAAO,OAAO,OAAO,MAAM,MAAM;GACzE,MAAM,eAAe,kBAAkB;GACvC,KAAK,MAAM,UAAU,cACnB,EAAE,OAAO,cAAc,QAAQ,EAAE,QAAQ,KAAK,CAAC;GAEjD,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,KAAK,CAAC;EACrC;EAGA,aAAa,OAAO,MAAkC;GACpD,MAAM,eAAe,EAAE,IAAI,OAAO,QAAQ,KAAK;GAC/C,MAAM,EAAE,gBAAgB,sBAAsB,YAAY;GAC1D,IAAI,CAAC,aACH,OAAO,cACL,GACA,SAAS,iBAAiB,SAAS,CAAC,CAAC,eAAe,GAAG,GACvD,GACF;GACF,MAAM,SAAS,MAAM,OAAO,gBAAgB,EAAE,YAAY,CAAC;GAC3D,IAAI,CAAC,OAAO,IAAI,OAAO,cAAc,GAAG,OAAO,OAAO,OAAO,MAAM,MAAM;GACzE,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,KAAK,CAAC;EACrC;EAGA,kBAAkB,OAAO,MAAkC;GAEzD,EAAE,OAAO,iBAAiB,UAAU;GACpC,MAAM,eAAe,EAAE,IAAI,OAAO,QAAQ,KAAK;GAC/C,MAAM,EAAE,gBAAgB,sBAAsB,YAAY;GAC1D,IAAI,CAAC,aACH,OAAO,cACL,GACA,SAAS,iBAAiB,SAAS,CAAC,CAAC,eAAe,GAAG,GACvD,GACF;GACF,IAAI;GACJ,IAAI;IACF,MAAM,MAAM,EAAE,IAAI,KAAK;GACzB,QAAQ;IACN,OAAO,cACL,GACA,SAAS,aAAa,SAAS,CAAC,CAAC,iBAAiB,GAAG,GACrD,GACF;GACF;GACA,MAAM,SAAS,oBAAoB,UAAU,GAAG;GAChD,IAAI,CAAC,OAAO,SACV,OAAO,cACL,GACA,SACE,aACA,4DACA,GACF,GACA,GACF;GAEF,MAAM,SAAS,MAAM,OAAO,iBAAiB;IAC3C;IACA,WAAW,OAAO,KAAK;GACzB,CAAC;GACD,IAAI,CAAC,OAAO,IAAI,OAAO,cAAc,GAAG,OAAO,OAAO,OAAO,MAAM,MAAM;GAGzE,IAAI,CAAC,OAAO,KAAK,aACf,OAAO,cACL,GACA,SACE,aACA,gDACA,GACF,GACA,GACF;GAEF,EAAE,OAAO,cAAc,qBAAqB,OAAO,KAAK,WAAW,GAAG,EACpE,QAAQ,KACV,CAAC;GACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,OAAO,KAAK,UAAU,EAAE,CAAC;EAC9D;EAGA,aAAa,OAAO,MAAkC;GACpD,MAAM,eAAe,EAAE,IAAI,OAAO,QAAQ,KAAK;GAC/C,MAAM,EAAE,gBAAgB,sBAAsB,YAAY;GAC1D,IAAI,CAAC,aACH,OAAO,cACL,GACA,SAAS,iBAAiB,SAAS,CAAC,CAAC,eAAe,GAAG,GACvD,GACF;GACF,MAAM,SAAS,MAAM,OAAO,YAAY,EAAE,YAAY,CAAC;GACvD,IAAI,CAAC,OAAO,IAAI,OAAO,cAAc,GAAG,OAAO,OAAO,OAAO,MAAM,MAAM;GACzE,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,KAAK,CAAC;EACrC;EAGA,eAAe,OAAO,MAAkC;GACtD,MAAM,eAAe,EAAE,IAAI,OAAO,QAAQ,KAAK;GAC/C,MAAM,EAAE,gBAAgB,sBAAsB,YAAY;GAC1D,IAAI,CAAC,aACH,OAAO,cACL,GACA,SAAS,iBAAiB,SAAS,CAAC,CAAC,eAAe,GAAG,GACvD,GACF;GACF,MAAM,YAAY,EAAE,IAAI,MAAM,IAAI;GAClC,IAAI,CAAC,aAAa,CAAC,WAAW,KAAK,SAAS,GAC1C,OAAO,cACL,GACA,SAAS,aAAa,SAAS,CAAC,CAAC,gBAAgB,GAAG,GACpD,GACF;GAEF,MAAM,SAAS,MAAM,OAAO,cAAc;IAAE;IAAa;GAAU,CAAC;GACpE,IAAI,CAAC,OAAO,IAAI,OAAO,cAAc,GAAG,OAAO,OAAO,OAAO,MAAM,MAAM;GACzE,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,KAAK,CAAC;EACrC;EAGA,mBAAmB,OAAO,MAAkC;GAC1D,MAAM,eAAe,EAAE,IAAI,OAAO,QAAQ,KAAK;GAC/C,MAAM,EAAE,iBAAiB,sBAAsB,YAAY;GAC3D,IAAI,CAAC,cACH,OAAO,cACL,GACA,SAAS,iBAAiB,SAAS,CAAC,CAAC,eAAe,GAAG,GACvD,GACF;GACF,MAAM,SAAS,MAAM,OAAO,kBAAkB,EAAE,aAAa,CAAC;GAC9D,IAAI,CAAC,OAAO,IAAI,OAAO,cAAc,GAAG,OAAO,OAAO,OAAO,MAAM,MAAM;GACzE,MAAM,eAAe,kBAAkB;GACvC,KAAK,MAAM,UAAU,cACnB,EAAE,OAAO,cAAc,QAAQ,EAAE,QAAQ,KAAK,CAAC;GAEjD,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,KAAK,CAAC;EACrC;CACF;AACF"}

package/dist/auth-handlers-BTbXKJms.d.ts

@@ -0,0 +1,15 @@
+import { n as EvaErrorMessages } from "./error-messages-CGpW1fsg.js";
+import { Context } from "hono";
+interface AuthHandlerOptions {
+  errorMessages?: Partial<EvaErrorMessages>;
+  /**
+   * Orígenes extra (`https://app.example.com`, sin path) desde los que se aceptan las mutaciones
+   * con cookies, además del propio host de la request. Un `Origin` fuera de esa lista responde 403.
+   * Acepta cualquier origen serializado `esquema://host[:puerto]` (también `tauri://localhost`,
+   * `capacitor://localhost`) por coincidencia exacta. Lanza al construir si una entrada no lo es
+   * (p. ej. `'*'` o `null`).
+   */
+  allowedOrigins?: readonly string[];
+}
+export { AuthHandlerOptions as t };
+//# sourceMappingURL=auth-handlers-BTbXKJms.d.ts.map

package/dist/auth-handlers-BTbXKJms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-handlers-BTbXKJms.d.ts","names":[],"sources":["../src/auth-handlers.ts"],"mappings":";;UA8BiB;EACf,gBAAgB,QAAQ;;;;;;;;EAQxB"}