@eva_solutions/auth-sdk 0.0.0-stage → 3.0.0-dev-20261109133200

package/dist/auth-handlers-CDzGFDTu.cjs

@@ -0,0 +1,404 @@
+const require_rolldown_runtime = require("./rolldown-runtime-CmQyd0Gu.cjs");
+const require_http_client = require("./http-client-BVF3iktR.cjs");
+const require_cookies = require("./cookies-DCIcr7uy.cjs");
+const require_refresh_dedup = require("./refresh-dedup-CLdACQXR.cjs");
+const require_parse_error_response = require("./parse-error-response-6qOQS5y9.cjs");
+const require_auth = require("./auth-DX1N5JA4.cjs");
+let zod = require("zod");
+let bowser = require("bowser");
+bowser = require_rolldown_runtime.__toESM(bowser, 1);
+// src/hono/device-info.ts
+function parseDeviceInfo(request) {
+	const userAgent = request.headers.get("user-agent") || "";
+	const parsed = bowser.default.parse(userAgent);
+	return {
+		deviceType: parsed.platform?.type || "desktop",
+		os: parsed.os?.name || "Unknown",
+		browser: parsed.browser?.name || "Unknown",
+		userAgent: userAgent.slice(0, 500)
+	};
+}
+// src/schemas.ts
+/**
+* Schemas Zod 4 compartidos — fuente canónica (B1 confirmado por T-00 probe).
+* Usados por auth-handlers.ts (validación runtime) y hono-openapi/index.ts (OpenAPI doc).
+* Importar desde aquí evita duplicación y garantiza consistencia entre variantes.
+*
+* `parseErrorResponse` vive en `parse-error-response.ts` (módulo puro, D-35): este archivo no es
+* alcanzable desde `src/react/index.ts`.
+*/
+const GetCodeSchema = zod.z.object({ phone: zod.z.string().min(1) });
+/**
+* Cuerpo de POST /login. `challengeId` es el identificador opaco que devolvió
+* POST /get-code para este código: el navegador lo conserva en memoria y lo
+* reenvía junto con el código. Sin él, /login responde 400 (`malformed`).
+*/
+const LoginSchema = zod.z.object({
+	phone: zod.z.string().min(1),
+	code: zod.z.string().min(1),
+	challengeId: zod.z.string().min(1),
+	empresaId: zod.z.string().min(1).optional()
+});
+/**
+* Cuerpo de POST /empresa-activa: el id de la empresa que queda activa o `null` para ninguna.
+* El campo es obligatorio (un body `{}` es inválido): `null` es una decisión, no un faltante.
+*/
+const ActiveEmpresaSchema = zod.z.object({ empresaId: zod.z.string().min(1).nullable() });
+/**
+* Schema para PATCH /me — record no vacío.
+* Validación extra con .refine() para rechazar body vacío.
+*/
+const UpdateUserSchema = zod.z.record(zod.z.string(), zod.z.unknown()).refine((obj) => Object.keys(obj).length > 0, "Cuerpo de actualización vacío");
+/** Wire de error `{ error: { code, message } }` (componente `ErrorBody`). */
+const ErrorResponseSchema = require_auth.errorResponseSchema;
+/** Wire de POST /login/get-code (200). `challengeId` es opaco; cada get-code nuevo invalida el anterior. */
+const GetCodeResponseSchema = require_auth.getCodeResponseSchema;
+/** Wire de POST /login (200). */
+const LoginResponseSchema = require_auth.loginResponseSchema;
+/** Wire de POST /login/refresh (200): el contrato reutiliza la respuesta de login. */
+const RefreshResponseSchema = require_auth.loginResponseSchema;
+// src/auth-handlers.ts
+const KNOWN_ERROR_STATUSES = /* @__PURE__ */ new Set([
+	400,
+	401,
+	403,
+	404,
+	409,
+	429,
+	500,
+	502,
+	503
+]);
+const REASON_TO_CODE = {
+	auth_required: "unauthorized",
+	token_invalid: "unauthorized",
+	refresh_no_tokens: "unauthorized",
+	verify_failed: "unauthorized",
+	network: "service_unavailable",
+	malformed: "bad_request"
+};
+function resolveCode(evaError) {
+	if (evaError.kind === "api") return evaError.code;
+	return REASON_TO_CODE[evaError.reason];
+}
+function errorResponse(c, evaError, status) {
+	const safeStatus = KNOWN_ERROR_STATUSES.has(status) ? status : 500;
+	if (require_parse_error_response.getErrorWire() === "api") return c.json({ error: {
+		code: resolveCode(evaError),
+		message: evaError.message
+	} }, safeStatus);
+	return c.json({ error: evaError.message }, safeStatus);
+}
+const SAFE_METHODS = /* @__PURE__ */ new Set([
+	"GET",
+	"HEAD",
+	"OPTIONS"
+]);
+/**
+* Origen serializado de un esquema que no es http(s) (`tauri://localhost`, `capacitor://localhost`):
+* `esquema://host[:puerto]` sin userinfo, path, query ni fragmento (una `/` final se tolera).
+*/
+const CUSTOM_SCHEME_ORIGIN = /^([a-z][a-z0-9+.-]*):\/\/([^\s/?#@\\]+)\/?$/i;
+/**
+* `new URL(...).origin` de un esquema no especial es `"null"`, así que http(s) se normaliza con el
+* parser y el resto se compara por su forma serializada en minúsculas (la que manda el navegador).
+*/
+function normalizeAllowedOrigins(origins) {
+	const normalized = /* @__PURE__ */ new Set();
+	for (const entry of origins) {
+		let url;
+		try {
+			url = new URL(entry);
+		} catch {}
+		const custom = url !== void 0 && !/^https?:$/.test(url.protocol) ? CUSTOM_SCHEME_ORIGIN.exec(entry) : null;
+		if (url === void 0 || custom === null && !/^https?:$/.test(url.protocol)) throw new Error(`[eva-auth-sdk] allowedOrigins inválido: ${JSON.stringify(entry)} (se espera un origen serializado esquema://host[:puerto], p. ej. https://app.example.com o tauri://localhost)`);
+		normalized.add(custom === null ? url.origin : `${custom[1].toLowerCase()}://${custom[2].toLowerCase()}`);
+	}
+	return normalized;
+}
+/**
+* Mismo origen = mismo host:puerto que la request; el esquema no cuenta porque tras un proxy que
+* termina TLS el servidor ve `http://` mientras el navegador manda `https://`.
+*/
+function isOriginAllowed(origin, requestUrl, allowed) {
+	let parsed;
+	try {
+		parsed = new URL(origin);
+	} catch {
+		return false;
+	}
+	return allowed.has(parsed.origin) || allowed.has(origin.toLowerCase()) || parsed.host === new URL(requestUrl).host;
+}
+function sdkError(reason, message, status) {
+	return {
+		kind: "sdk",
+		reason,
+		message,
+		status
+	};
+}
+/**
+* Construye los 12 handlers de auth con las opciones provistas.
+* Validación temprana de errorMessages si se proveen (lanza si key inválida o valor no-string).
+*
+* Decisión M2 (ADR-012): messages() se resuelve por-request (closure evalúa
+* getErrorMessages() en cada llamada). Permite que configureEvaAuth() post-factory
+* tome efecto en el siguiente request. Tradeoff: ~3 spreads + 2 fn calls per request.
+*/
+function buildAuthHandlers(opts = {}) {
+	if (opts.errorMessages !== void 0) require_parse_error_response.validateErrorMessagesInput(opts.errorMessages);
+	const allowedOrigins = normalizeAllowedOrigins(opts.allowedOrigins ?? []);
+	const client = require_http_client.createHttpClient();
+	const messages = () => require_parse_error_response.resolveErrorMessages(opts.errorMessages, require_parse_error_response.getErrorMessages());
+	const bodyGuard = (invalidMessage) => ({
+		middleware: async (c, next) => {
+			c.header("Cache-Control", "no-store");
+			try {
+				await c.req.json();
+			} catch {
+				return errorResponse(c, sdkError("malformed", messages().invalidJsonBody, 400), 400);
+			}
+			await next();
+		},
+		onInvalid: (result, c) => {
+			if (result.success) return void 0;
+			c.header("Cache-Control", "no-store");
+			return errorResponse(c, sdkError("malformed", invalidMessage(), 400), 400);
+		}
+	});
+	const originGuard = async (c, next) => {
+		const origin = c.req.header("origin");
+		if (SAFE_METHODS.has(c.req.method) || origin === void 0 || isOriginAllowed(origin, c.req.url, allowedOrigins)) return next();
+		return errorResponse(c, {
+			kind: "api",
+			code: "forbidden",
+			message: messages().originNotAllowed,
+			status: 403
+		}, 403);
+	};
+	return {
+		originGuard,
+		openApiGuards: {
+			getCode: bodyGuard(() => messages().invalidPhone),
+			login: bodyGuard(() => messages().loginFailed)
+		},
+		getCode: async (c) => {
+			c.header("Cache-Control", "no-store");
+			let raw;
+			try {
+				raw = await c.req.json();
+			} catch {
+				return errorResponse(c, sdkError("malformed", messages().invalidJsonBody, 400), 400);
+			}
+			const parsed = GetCodeSchema.safeParse(raw);
+			if (!parsed.success) return errorResponse(c, sdkError("malformed", messages().invalidPhone, 400), 400);
+			const result = await client.getCode(parsed.data);
+			if (!result.ok) return errorResponse(c, result.error, result.error.status);
+			return c.json({ data: result.data });
+		},
+		login: async (c) => {
+			c.header("Cache-Control", "no-store");
+			let raw;
+			try {
+				raw = await c.req.json();
+			} catch {
+				return errorResponse(c, sdkError("malformed", messages().invalidJsonBody, 400), 400);
+			}
+			const parsed = LoginSchema.safeParse(raw);
+			if (!parsed.success) return errorResponse(c, sdkError("malformed", messages().loginFailed, 400), 400);
+			const deviceInfo = parseDeviceInfo(c.req.raw);
+			const result = await client.login({
+				...parsed.data,
+				...deviceInfo
+			});
+			if (!result.ok) return errorResponse(c, result.error, result.error.status);
+			if (result.data.tokens) {
+				const cookieHeaders = require_cookies.setTokenCookies(result.data.tokens);
+				for (const cookie of cookieHeaders) c.header("Set-Cookie", cookie, { append: true });
+			}
+			return c.json({ data: { user: { id: result.data.user.id } } });
+		},
+		refresh: async (c) => {
+			const cookieHeader = c.req.header("cookie") || null;
+			const { refreshToken } = require_cookies.readTokensFromCookies(cookieHeader);
+			if (!refreshToken) return errorResponse(c, sdkError("auth_required", messages().tokenNotFound, 401), 401);
+			const result = await require_refresh_dedup.deduplicateRefresh(refreshToken, () => client.refresh({ refreshToken }));
+			if (!result.ok) return errorResponse(c, result.error, result.error.status);
+			if (result.data.tokens) {
+				const cookieHeaders = require_cookies.setTokenCookies(result.data.tokens);
+				for (const cookie of cookieHeaders) c.header("Set-Cookie", cookie, { append: true });
+			}
+			return c.json({ data: { user: { id: result.data.user.id } } });
+		},
+		logout: async (c) => {
+			const cookieHeader = c.req.header("cookie") || null;
+			const { refreshToken } = require_cookies.readTokensFromCookies(cookieHeader);
+			if (!refreshToken) return errorResponse(c, sdkError("auth_required", messages().tokenNotFound, 401), 401);
+			const result = await client.logout({ refreshToken });
+			if (!result.ok) return errorResponse(c, result.error, result.error.status);
+			const clearHeaders = require_cookies.clearTokenCookies();
+			for (const cookie of clearHeaders) c.header("Set-Cookie", cookie, { append: true });
+			return c.json({ data: result.data });
+		},
+		getMe: async (c) => {
+			const cookieHeader = c.req.header("cookie") || null;
+			const { accessToken } = require_cookies.readTokensFromCookies(cookieHeader);
+			if (!accessToken) return errorResponse(c, sdkError("auth_required", messages().tokenNotFound, 401), 401);
+			const result = await client.getUser({ accessToken });
+			if (!result.ok) return errorResponse(c, result.error, result.error.status);
+			return c.json({ data: result.data });
+		},
+		updateMe: async (c) => {
+			const cookieHeader = c.req.header("cookie") || null;
+			const { accessToken } = require_cookies.readTokensFromCookies(cookieHeader);
+			if (!accessToken) return errorResponse(c, sdkError("auth_required", messages().tokenNotFound, 401), 401);
+			let raw;
+			try {
+				raw = await c.req.json();
+			} catch {
+				return errorResponse(c, sdkError("malformed", messages().invalidJsonBody, 400), 400);
+			}
+			const parsed = UpdateUserSchema.safeParse(raw);
+			if (!parsed.success) return errorResponse(c, sdkError("malformed", messages().invalidUpdateBody, 400), 400);
+			const result = await client.updateUser({
+				accessToken,
+				data: parsed.data
+			});
+			if (!result.ok) return errorResponse(c, result.error, result.error.status);
+			return c.json({ data: result.data });
+		},
+		deleteMe: async (c) => {
+			const cookieHeader = c.req.header("cookie") || null;
+			const { accessToken } = require_cookies.readTokensFromCookies(cookieHeader);
+			if (!accessToken) return errorResponse(c, sdkError("auth_required", messages().tokenNotFound, 401), 401);
+			const result = await client.deleteUser({ accessToken });
+			if (!result.ok) return errorResponse(c, result.error, result.error.status);
+			const clearHeaders = require_cookies.clearTokenCookies();
+			for (const cookie of clearHeaders) c.header("Set-Cookie", cookie, { append: true });
+			return c.json({ data: result.data });
+		},
+		getEmpresas: async (c) => {
+			const cookieHeader = c.req.header("cookie") || null;
+			const { accessToken } = require_cookies.readTokensFromCookies(cookieHeader);
+			if (!accessToken) return errorResponse(c, sdkError("auth_required", messages().tokenNotFound, 401), 401);
+			const result = await client.getUserEmpresas({ accessToken });
+			if (!result.ok) return errorResponse(c, result.error, result.error.status);
+			return c.json({ data: result.data });
+		},
+		setActiveEmpresa: async (c) => {
+			c.header("Cache-Control", "no-store");
+			const cookieHeader = c.req.header("cookie") || null;
+			const { accessToken } = require_cookies.readTokensFromCookies(cookieHeader);
+			if (!accessToken) return errorResponse(c, sdkError("auth_required", messages().tokenNotFound, 401), 401);
+			let raw;
+			try {
+				raw = await c.req.json();
+			} catch {
+				return errorResponse(c, sdkError("malformed", messages().invalidJsonBody, 400), 400);
+			}
+			const parsed = ActiveEmpresaSchema.safeParse(raw);
+			if (!parsed.success) return errorResponse(c, sdkError("malformed", "empresaId inválido: debe ser el id de una empresa o null", 400), 400);
+			const result = await client.setActiveEmpresa({
+				accessToken,
+				empresaId: parsed.data.empresaId
+			});
+			if (!result.ok) return errorResponse(c, result.error, result.error.status);
+			if (!result.data.accessToken) return errorResponse(c, sdkError("malformed", "Respuesta de Auth sin access token reemitido", 502), 502);
+			c.header("Set-Cookie", require_cookies.setAccessTokenCookie(result.data.accessToken), { append: true });
+			return c.json({ data: { empresaId: result.data.empresaId } });
+		},
+		getSessions: async (c) => {
+			const cookieHeader = c.req.header("cookie") || null;
+			const { accessToken } = require_cookies.readTokensFromCookies(cookieHeader);
+			if (!accessToken) return errorResponse(c, sdkError("auth_required", messages().tokenNotFound, 401), 401);
+			const result = await client.getSessions({ accessToken });
+			if (!result.ok) return errorResponse(c, result.error, result.error.status);
+			return c.json({ data: result.data });
+		},
+		deleteSession: async (c) => {
+			const cookieHeader = c.req.header("cookie") || null;
+			const { accessToken } = require_cookies.readTokensFromCookies(cookieHeader);
+			if (!accessToken) return errorResponse(c, sdkError("auth_required", messages().tokenNotFound, 401), 401);
+			const sessionId = c.req.param("id");
+			if (!sessionId || !/^[\w-]+$/.test(sessionId)) return errorResponse(c, sdkError("malformed", messages().sessionInvalid, 400), 400);
+			const result = await client.deleteSession({
+				accessToken,
+				sessionId
+			});
+			if (!result.ok) return errorResponse(c, result.error, result.error.status);
+			return c.json({ data: result.data });
+		},
+		deleteAllSessions: async (c) => {
+			const cookieHeader = c.req.header("cookie") || null;
+			const { refreshToken } = require_cookies.readTokensFromCookies(cookieHeader);
+			if (!refreshToken) return errorResponse(c, sdkError("auth_required", messages().tokenNotFound, 401), 401);
+			const result = await client.deleteAllSessions({ refreshToken });
+			if (!result.ok) return errorResponse(c, result.error, result.error.status);
+			const clearHeaders = require_cookies.clearTokenCookies();
+			for (const cookie of clearHeaders) c.header("Set-Cookie", cookie, { append: true });
+			return c.json({ data: result.data });
+		}
+	};
+}
+Object.defineProperty(exports, "ActiveEmpresaSchema", {
+	enumerable: true,
+	get: function() {
+		return ActiveEmpresaSchema;
+	}
+});
+Object.defineProperty(exports, "ErrorResponseSchema", {
+	enumerable: true,
+	get: function() {
+		return ErrorResponseSchema;
+	}
+});
+Object.defineProperty(exports, "GetCodeResponseSchema", {
+	enumerable: true,
+	get: function() {
+		return GetCodeResponseSchema;
+	}
+});
+Object.defineProperty(exports, "GetCodeSchema", {
+	enumerable: true,
+	get: function() {
+		return GetCodeSchema;
+	}
+});
+Object.defineProperty(exports, "LoginResponseSchema", {
+	enumerable: true,
+	get: function() {
+		return LoginResponseSchema;
+	}
+});
+Object.defineProperty(exports, "LoginSchema", {
+	enumerable: true,
+	get: function() {
+		return LoginSchema;
+	}
+});
+Object.defineProperty(exports, "RefreshResponseSchema", {
+	enumerable: true,
+	get: function() {
+		return RefreshResponseSchema;
+	}
+});
+Object.defineProperty(exports, "UpdateUserSchema", {
+	enumerable: true,
+	get: function() {
+		return UpdateUserSchema;
+	}
+});
+Object.defineProperty(exports, "buildAuthHandlers", {
+	enumerable: true,
+	get: function() {
+		return buildAuthHandlers;
+	}
+});
+Object.defineProperty(exports, "parseDeviceInfo", {
+	enumerable: true,
+	get: function() {
+		return parseDeviceInfo;
+	}
+});
+
+//# sourceMappingURL=auth-handlers-CDzGFDTu.cjs.map

package/dist/auth-handlers-CDzGFDTu.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-handlers-CDzGFDTu.cjs","names":["Bowser","z","errorResponseSchema","getCodeResponseSchema","loginResponseSchema","getErrorWire","createHttpClient","resolveErrorMessages","getErrorMessages","setTokenCookies","readTokensFromCookies","deduplicateRefresh","clearTokenCookies","setAccessTokenCookie"],"sources":["../src/hono/device-info.ts","../src/schemas.ts","../src/auth-handlers.ts"],"sourcesContent":["import Bowser from 'bowser'\nimport type { DeviceInfo } from '../types'\n\nexport function parseDeviceInfo(request: Request): DeviceInfo {\n  const userAgent = request.headers.get('user-agent') || ''\n  const parsed = Bowser.parse(userAgent)\n\n  return {\n    deviceType: parsed.platform?.type || 'desktop',\n    os: parsed.os?.name || 'Unknown',\n    browser: parsed.browser?.name || 'Unknown',\n    userAgent: userAgent.slice(0, 500),\n  }\n}\n","/**\n * Schemas Zod 4 compartidos — fuente canónica (B1 confirmado por T-00 probe).\n * Usados por auth-handlers.ts (validación runtime) y hono-openapi/index.ts (OpenAPI doc).\n * Importar desde aquí evita duplicación y garantiza consistencia entre variantes.\n *\n * `parseErrorResponse` vive en `parse-error-response.ts` (módulo puro, D-35): este archivo no es\n * alcanzable desde `src/react/index.ts`.\n */\nimport { z } from 'zod'\nimport {\n  errorResponseSchema,\n  getCodeResponseSchema,\n  loginResponseSchema,\n} from '@eva_solutions/auth-contracts'\n\n// === Request schemas ===\n\nexport const GetCodeSchema = z.object({\n  phone: z.string().min(1),\n})\n\n/**\n * Cuerpo de POST /login. `challengeId` es el identificador opaco que devolvió\n * POST /get-code para este código: el navegador lo conserva en memoria y lo\n * reenvía junto con el código. Sin él, /login responde 400 (`malformed`).\n */\nexport const LoginSchema = z.object({\n  phone: z.string().min(1),\n  code: z.string().min(1),\n  challengeId: z.string().min(1),\n  // Empresa que queda activa (opcional). El `producto` NO viene del navegador: lo pone el SDK.\n  empresaId: z.string().min(1).optional(),\n})\n\n/**\n * Cuerpo de POST /empresa-activa: el id de la empresa que queda activa o `null` para ninguna.\n * El campo es obligatorio (un body `{}` es inválido): `null` es una decisión, no un faltante.\n */\nexport const ActiveEmpresaSchema = z.object({\n  empresaId: z.string().min(1).nullable(),\n})\n\n/**\n * Schema para PATCH /me — record no vacío.\n * Validación extra con .refine() para rechazar body vacío.\n */\nexport const UpdateUserSchema = z\n  .record(z.string(), z.unknown())\n  .refine((obj) => Object.keys(obj).length > 0, 'Cuerpo de actualización vacío')\n\n// === Response schemas ===\n\n/*\n * Los schemas de respuesta son alias del contrato compartido (D-28: el tipo es idéntico al que\n * este archivo definía antes). Se usan solo para documentar OpenAPI: `http-client` no los parsea en\n * runtime. Este módulo registra metadatos de zod al cargarse, así que NO debe ser alcanzable desde\n * `src/react` (regla D-35: ahí solo se importan valores de módulos puros o `import type`).\n */\n\n/** Wire de error `{ error: { code, message } }` (componente `ErrorBody`). */\nexport const ErrorResponseSchema = errorResponseSchema\n\n/** Wire de POST /login/get-code (200). `challengeId` es opaco; cada get-code nuevo invalida el anterior. */\nexport const GetCodeResponseSchema = getCodeResponseSchema\n\n/** Wire de POST /login (200). */\nexport const LoginResponseSchema = loginResponseSchema\n\n/** Wire de POST /login/refresh (200): el contrato reutiliza la respuesta de login. */\nexport const RefreshResponseSchema = loginResponseSchema\n\n// === Inferred types ===\n\nexport type GetCodeInput = z.infer<typeof GetCodeSchema>\nexport type LoginInput = z.infer<typeof LoginSchema>\nexport type ActiveEmpresaInput = z.infer<typeof ActiveEmpresaSchema>\nexport type UpdateUserInput = z.infer<typeof UpdateUserSchema>\n","/**\n * Factory de handlers de auth — fuente única de verdad para los 12 endpoints.\n * Compartido entre evaAuthRoutes() (Hono plano) y evaAuthOpenAPIRoutes() (OpenAPIHono).\n * Decisión M2: resolución de messages() por-request (closure evalúa global cada vez).\n */\nimport type { Context, MiddlewareHandler } from 'hono'\nimport { createHttpClient } from './http-client'\nimport {\n  readTokensFromCookies,\n  setTokenCookies,\n  setAccessTokenCookie,\n  clearTokenCookies,\n} from './cookies'\nimport { deduplicateRefresh } from './refresh-dedup'\nimport { parseDeviceInfo } from './hono/device-info'\nimport { resolveErrorMessages, type EvaErrorMessages } from './error-messages'\nimport {\n  getErrorMessages,\n  getErrorWire,\n  validateErrorMessagesInput,\n} from './config'\nimport {\n  ActiveEmpresaSchema,\n  GetCodeSchema,\n  LoginSchema,\n  UpdateUserSchema,\n} from './schemas'\nimport type { EvaError, EvaSdkError } from './types'\nimport type { SdkErrorReason } from './error-codes'\n\nexport interface AuthHandlerOptions {\n  errorMessages?: Partial<EvaErrorMessages>\n  /**\n   * Orígenes extra (`https://app.example.com`, sin path) desde los que se aceptan las mutaciones\n   * con cookies, además del propio host de la request. Un `Origin` fuera de esa lista responde 403.\n   * Acepta cualquier origen serializado `esquema://host[:puerto]` (también `tauri://localhost`,\n   * `capacitor://localhost`) por coincidencia exacta. Lanza al construir si una entrada no lo es\n   * (p. ej. `'*'` o `null`).\n   */\n  allowedOrigins?: readonly string[]\n}\n\n/**\n * Guardas para la variante OpenAPI de get-code/login: el validador de\n * @hono/zod-openapi responde el 400 antes que el handler, así que\n * no-store y el wire de error se replican aquí. middleware corre antes del validador\n * (JSON malformado); onInvalid es el hook del validador (body que no cumple el schema).\n */\nexport interface OpenAPIBodyGuard {\n  middleware: MiddlewareHandler\n  onInvalid: (result: { success: boolean }, c: Context) => Response | undefined\n}\n\nexport interface AuthHandlers {\n  /** Middleware CSRF: rechaza con 403 las mutaciones cuyo `Origin` no está permitido. */\n  originGuard: MiddlewareHandler\n  openApiGuards: { getCode: OpenAPIBodyGuard; login: OpenAPIBodyGuard }\n  getCode: (c: Context) => Promise<Response>\n  login: (c: Context) => Promise<Response>\n  refresh: (c: Context) => Promise<Response>\n  logout: (c: Context) => Promise<Response>\n  getMe: (c: Context) => Promise<Response>\n  updateMe: (c: Context) => Promise<Response>\n  deleteMe: (c: Context) => Promise<Response>\n  getEmpresas: (c: Context) => Promise<Response>\n  setActiveEmpresa: (c: Context) => Promise<Response>\n  getSessions: (c: Context) => Promise<Response>\n  deleteSession: (c: Context) => Promise<Response>\n  deleteAllSessions: (c: Context) => Promise<Response>\n}\n\ntype ErrorStatus = 400 | 401 | 403 | 404 | 409 | 429 | 500 | 502 | 503\n\nconst KNOWN_ERROR_STATUSES = new Set<number>([\n  400, 401, 403, 404, 409, 429, 500, 502, 503,\n])\n\nconst REASON_TO_CODE: Record<SdkErrorReason, string> = {\n  auth_required: 'unauthorized',\n  token_invalid: 'unauthorized',\n  refresh_no_tokens: 'unauthorized',\n  verify_failed: 'unauthorized',\n  network: 'service_unavailable',\n  malformed: 'bad_request',\n}\n\nfunction resolveCode(evaError: EvaError): string {\n  if (evaError.kind === 'api') return evaError.code\n  return REASON_TO_CODE[evaError.reason]\n}\n\nfunction errorResponse(\n  c: Context,\n  evaError: EvaError,\n  status: number,\n): Response {\n  const safeStatus = KNOWN_ERROR_STATUSES.has(status)\n    ? (status as ErrorStatus)\n    : 500\n  const wire = getErrorWire()\n  if (wire === 'api') {\n    return c.json(\n      { error: { code: resolveCode(evaError), message: evaError.message } },\n      safeStatus,\n    )\n  }\n  return c.json({ error: evaError.message }, safeStatus)\n}\n\nconst SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS'])\n\n/**\n * Origen serializado de un esquema que no es http(s) (`tauri://localhost`, `capacitor://localhost`):\n * `esquema://host[:puerto]` sin userinfo, path, query ni fragmento (una `/` final se tolera).\n */\nconst CUSTOM_SCHEME_ORIGIN = /^([a-z][a-z0-9+.-]*):\\/\\/([^\\s/?#@\\\\]+)\\/?$/i\n\n/**\n * `new URL(...).origin` de un esquema no especial es `\"null\"`, así que http(s) se normaliza con el\n * parser y el resto se compara por su forma serializada en minúsculas (la que manda el navegador).\n */\nfunction normalizeAllowedOrigins(origins: readonly string[]): Set<string> {\n  const normalized = new Set<string>()\n  for (const entry of origins) {\n    let url: URL | undefined\n    try {\n      url = new URL(entry)\n    } catch {\n      // cae al throw de abajo\n    }\n    const custom =\n      url !== undefined && !/^https?:$/.test(url.protocol)\n        ? CUSTOM_SCHEME_ORIGIN.exec(entry)\n        : null\n    if (\n      url === undefined ||\n      (custom === null && !/^https?:$/.test(url.protocol))\n    ) {\n      throw new Error(\n        `[eva-auth-sdk] allowedOrigins inválido: ${JSON.stringify(entry)} (se espera un origen serializado esquema://host[:puerto], p. ej. https://app.example.com o tauri://localhost)`,\n      )\n    }\n    normalized.add(\n      custom === null\n        ? url.origin\n        : `${(custom[1] as string).toLowerCase()}://${(custom[2] as string).toLowerCase()}`,\n    )\n  }\n  return normalized\n}\n\n/**\n * Mismo origen = mismo host:puerto que la request; el esquema no cuenta porque tras un proxy que\n * termina TLS el servidor ve `http://` mientras el navegador manda `https://`.\n */\nfunction isOriginAllowed(\n  origin: string,\n  requestUrl: string,\n  allowed: ReadonlySet<string>,\n): boolean {\n  let parsed: URL\n  try {\n    parsed = new URL(origin)\n  } catch {\n    return false // `Origin: null` (iframes sandbox, redirects entre orígenes) y basura\n  }\n  return (\n    allowed.has(parsed.origin) ||\n    allowed.has(origin.toLowerCase()) ||\n    parsed.host === new URL(requestUrl).host\n  )\n}\n\nfunction sdkError(\n  reason: SdkErrorReason,\n  message: string,\n  status: number,\n): EvaSdkError {\n  return { kind: 'sdk', reason, message, status }\n}\n\n/**\n * Construye los 12 handlers de auth con las opciones provistas.\n * Validación temprana de errorMessages si se proveen (lanza si key inválida o valor no-string).\n *\n * Decisión M2 (ADR-012): messages() se resuelve por-request (closure evalúa\n * getErrorMessages() en cada llamada). Permite que configureEvaAuth() post-factory\n * tome efecto en el siguiente request. Tradeoff: ~3 spreads + 2 fn calls per request.\n */\nexport function buildAuthHandlers(opts: AuthHandlerOptions = {}): AuthHandlers {\n  if (opts.errorMessages !== undefined) {\n    validateErrorMessagesInput(opts.errorMessages)\n  }\n\n  const allowedOrigins = normalizeAllowedOrigins(opts.allowedOrigins ?? [])\n\n  const client = createHttpClient()\n\n  // Resolución diferida por-request (M2)\n  const messages = () =>\n    resolveErrorMessages(opts.errorMessages, getErrorMessages())\n\n  const bodyGuard = (invalidMessage: () => string): OpenAPIBodyGuard => ({\n    middleware: async (c, next) => {\n      c.header('Cache-Control', 'no-store')\n      try {\n        await c.req.json()\n      } catch {\n        return errorResponse(\n          c,\n          sdkError('malformed', messages().invalidJsonBody, 400),\n          400,\n        )\n      }\n      await next()\n    },\n    onInvalid: (result, c) => {\n      if (result.success) return undefined\n      c.header('Cache-Control', 'no-store')\n      return errorResponse(c, sdkError('malformed', invalidMessage(), 400), 400)\n    },\n  })\n\n  // Sin `Origin` (curl, servidores) se deja pasar: todo navegador lo manda en las mutaciones.\n  const originGuard: MiddlewareHandler = async (c, next) => {\n    const origin = c.req.header('origin')\n    if (\n      SAFE_METHODS.has(c.req.method) ||\n      origin === undefined ||\n      isOriginAllowed(origin, c.req.url, allowedOrigins)\n    ) {\n      return next()\n    }\n    return errorResponse(\n      c,\n      {\n        kind: 'api',\n        code: 'forbidden',\n        message: messages().originNotAllowed,\n        status: 403,\n      },\n      403,\n    )\n  }\n\n  return {\n    originGuard,\n    openApiGuards: {\n      getCode: bodyGuard(() => messages().invalidPhone),\n      login: bodyGuard(() => messages().loginFailed),\n    },\n    // POST /get-code\n    getCode: async (c: Context): Promise<Response> => {\n      // Respuestas con challengeId/cookies: nunca cacheables (paridad con el API).\n      c.header('Cache-Control', 'no-store')\n      let raw: unknown\n      try {\n        raw = await c.req.json()\n      } catch {\n        return errorResponse(\n          c,\n          sdkError('malformed', messages().invalidJsonBody, 400),\n          400,\n        )\n      }\n      const parsed = GetCodeSchema.safeParse(raw)\n      if (!parsed.success) {\n        return errorResponse(\n          c,\n          sdkError('malformed', messages().invalidPhone, 400),\n          400,\n        )\n      }\n      const result = await client.getCode(parsed.data)\n      if (!result.ok) return errorResponse(c, result.error, result.error.status)\n      return c.json({ data: result.data })\n    },\n\n    // POST /login\n    login: async (c: Context): Promise<Response> => {\n      // Respuestas con challengeId/cookies: nunca cacheables (paridad con el API).\n      c.header('Cache-Control', 'no-store')\n      let raw: unknown\n      try {\n        raw = await c.req.json()\n      } catch {\n        return errorResponse(\n          c,\n          sdkError('malformed', messages().invalidJsonBody, 400),\n          400,\n        )\n      }\n      const parsed = LoginSchema.safeParse(raw)\n      if (!parsed.success) {\n        return errorResponse(\n          c,\n          sdkError('malformed', messages().loginFailed, 400),\n          400,\n        )\n      }\n      const deviceInfo = parseDeviceInfo(c.req.raw)\n      const result = await client.login({ ...parsed.data, ...deviceInfo })\n      if (!result.ok) return errorResponse(c, result.error, result.error.status)\n      if (result.data.tokens) {\n        const cookieHeaders = setTokenCookies(result.data.tokens)\n        for (const cookie of cookieHeaders) {\n          c.header('Set-Cookie', cookie, { append: true })\n        }\n      }\n      return c.json({ data: { user: { id: result.data.user.id } } })\n    },\n\n    // POST /refresh\n    refresh: async (c: Context): Promise<Response> => {\n      const cookieHeader = c.req.header('cookie') || null\n      const { refreshToken } = readTokensFromCookies(cookieHeader)\n      if (!refreshToken)\n        return errorResponse(\n          c,\n          sdkError('auth_required', messages().tokenNotFound, 401),\n          401,\n        )\n      const result = await deduplicateRefresh(refreshToken, () =>\n        client.refresh({ refreshToken }),\n      )\n      if (!result.ok) return errorResponse(c, result.error, result.error.status)\n      if (result.data.tokens) {\n        const cookieHeaders = setTokenCookies(result.data.tokens)\n        for (const cookie of cookieHeaders) {\n          c.header('Set-Cookie', cookie, { append: true })\n        }\n      }\n      return c.json({ data: { user: { id: result.data.user.id } } })\n    },\n\n    // POST /logout\n    logout: async (c: Context): Promise<Response> => {\n      const cookieHeader = c.req.header('cookie') || null\n      const { refreshToken } = readTokensFromCookies(cookieHeader)\n      if (!refreshToken)\n        return errorResponse(\n          c,\n          sdkError('auth_required', messages().tokenNotFound, 401),\n          401,\n        )\n      const result = await client.logout({ refreshToken })\n      if (!result.ok) return errorResponse(c, result.error, result.error.status)\n      const clearHeaders = clearTokenCookies()\n      for (const cookie of clearHeaders) {\n        c.header('Set-Cookie', cookie, { append: true })\n      }\n      return c.json({ data: result.data })\n    },\n\n    // GET /me\n    getMe: async (c: Context): Promise<Response> => {\n      const cookieHeader = c.req.header('cookie') || null\n      const { accessToken } = readTokensFromCookies(cookieHeader)\n      if (!accessToken)\n        return errorResponse(\n          c,\n          sdkError('auth_required', messages().tokenNotFound, 401),\n          401,\n        )\n      const result = await client.getUser({ accessToken })\n      if (!result.ok) return errorResponse(c, result.error, result.error.status)\n      return c.json({ data: result.data })\n    },\n\n    // PATCH /me\n    updateMe: async (c: Context): Promise<Response> => {\n      const cookieHeader = c.req.header('cookie') || null\n      const { accessToken } = readTokensFromCookies(cookieHeader)\n      if (!accessToken)\n        return errorResponse(\n          c,\n          sdkError('auth_required', messages().tokenNotFound, 401),\n          401,\n        )\n      let raw: unknown\n      try {\n        raw = await c.req.json()\n      } catch {\n        return errorResponse(\n          c,\n          sdkError('malformed', messages().invalidJsonBody, 400),\n          400,\n        )\n      }\n      const parsed = UpdateUserSchema.safeParse(raw)\n      if (!parsed.success) {\n        return errorResponse(\n          c,\n          sdkError('malformed', messages().invalidUpdateBody, 400),\n          400,\n        )\n      }\n      const result = await client.updateUser({ accessToken, data: parsed.data })\n      if (!result.ok) return errorResponse(c, result.error, result.error.status)\n      return c.json({ data: result.data })\n    },\n\n    // DELETE /me\n    deleteMe: async (c: Context): Promise<Response> => {\n      const cookieHeader = c.req.header('cookie') || null\n      const { accessToken } = readTokensFromCookies(cookieHeader)\n      if (!accessToken)\n        return errorResponse(\n          c,\n          sdkError('auth_required', messages().tokenNotFound, 401),\n          401,\n        )\n      const result = await client.deleteUser({ accessToken })\n      if (!result.ok) return errorResponse(c, result.error, result.error.status)\n      const clearHeaders = clearTokenCookies()\n      for (const cookie of clearHeaders) {\n        c.header('Set-Cookie', cookie, { append: true })\n      }\n      return c.json({ data: result.data })\n    },\n\n    // GET /empresas\n    getEmpresas: async (c: Context): Promise<Response> => {\n      const cookieHeader = c.req.header('cookie') || null\n      const { accessToken } = readTokensFromCookies(cookieHeader)\n      if (!accessToken)\n        return errorResponse(\n          c,\n          sdkError('auth_required', messages().tokenNotFound, 401),\n          401,\n        )\n      const result = await client.getUserEmpresas({ accessToken })\n      if (!result.ok) return errorResponse(c, result.error, result.error.status)\n      return c.json({ data: result.data })\n    },\n\n    // POST /empresa-activa\n    setActiveEmpresa: async (c: Context): Promise<Response> => {\n      // Lleva un access token nuevo en una cookie: nunca cacheable.\n      c.header('Cache-Control', 'no-store')\n      const cookieHeader = c.req.header('cookie') || null\n      const { accessToken } = readTokensFromCookies(cookieHeader)\n      if (!accessToken)\n        return errorResponse(\n          c,\n          sdkError('auth_required', messages().tokenNotFound, 401),\n          401,\n        )\n      let raw: unknown\n      try {\n        raw = await c.req.json()\n      } catch {\n        return errorResponse(\n          c,\n          sdkError('malformed', messages().invalidJsonBody, 400),\n          400,\n        )\n      }\n      const parsed = ActiveEmpresaSchema.safeParse(raw)\n      if (!parsed.success) {\n        return errorResponse(\n          c,\n          sdkError(\n            'malformed',\n            'empresaId inválido: debe ser el id de una empresa o null',\n            400,\n          ),\n          400,\n        )\n      }\n      const result = await client.setActiveEmpresa({\n        accessToken,\n        empresaId: parsed.data.empresaId,\n      })\n      if (!result.ok) return errorResponse(c, result.error, result.error.status)\n      // Auth reemite SOLO el access token; sin él la sesión seguiría con la empresa vieja y no hay\n      // nada que reescribir: es una respuesta inválida de Auth, no un éxito.\n      if (!result.data.accessToken) {\n        return errorResponse(\n          c,\n          sdkError(\n            'malformed',\n            'Respuesta de Auth sin access token reemitido',\n            502,\n          ),\n          502,\n        )\n      }\n      c.header('Set-Cookie', setAccessTokenCookie(result.data.accessToken), {\n        append: true,\n      })\n      return c.json({ data: { empresaId: result.data.empresaId } })\n    },\n\n    // GET /sessions\n    getSessions: async (c: Context): Promise<Response> => {\n      const cookieHeader = c.req.header('cookie') || null\n      const { accessToken } = readTokensFromCookies(cookieHeader)\n      if (!accessToken)\n        return errorResponse(\n          c,\n          sdkError('auth_required', messages().tokenNotFound, 401),\n          401,\n        )\n      const result = await client.getSessions({ accessToken })\n      if (!result.ok) return errorResponse(c, result.error, result.error.status)\n      return c.json({ data: result.data })\n    },\n\n    // DELETE /sessions/:id\n    deleteSession: async (c: Context): Promise<Response> => {\n      const cookieHeader = c.req.header('cookie') || null\n      const { accessToken } = readTokensFromCookies(cookieHeader)\n      if (!accessToken)\n        return errorResponse(\n          c,\n          sdkError('auth_required', messages().tokenNotFound, 401),\n          401,\n        )\n      const sessionId = c.req.param('id')\n      if (!sessionId || !/^[\\w-]+$/.test(sessionId)) {\n        return errorResponse(\n          c,\n          sdkError('malformed', messages().sessionInvalid, 400),\n          400,\n        )\n      }\n      const result = await client.deleteSession({ accessToken, sessionId })\n      if (!result.ok) return errorResponse(c, result.error, result.error.status)\n      return c.json({ data: result.data })\n    },\n\n    // DELETE /sessions\n    deleteAllSessions: async (c: Context): Promise<Response> => {\n      const cookieHeader = c.req.header('cookie') || null\n      const { refreshToken } = readTokensFromCookies(cookieHeader)\n      if (!refreshToken)\n        return errorResponse(\n          c,\n          sdkError('auth_required', messages().tokenNotFound, 401),\n          401,\n        )\n      const result = await client.deleteAllSessions({ refreshToken })\n      if (!result.ok) return errorResponse(c, result.error, result.error.status)\n      const clearHeaders = clearTokenCookies()\n      for (const cookie of clearHeaders) {\n        c.header('Set-Cookie', cookie, { append: true })\n      }\n      return c.json({ data: result.data })\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;AAGA,SAAgB,gBAAgB,SAA8B;CAC5D,MAAM,YAAY,QAAQ,QAAQ,IAAI,YAAY,KAAK;CACvD,MAAM,SAASA,OAAAA,QAAO,MAAM,SAAS;CAErC,OAAO;EACL,YAAY,OAAO,UAAU,QAAQ;EACrC,IAAI,OAAO,IAAI,QAAQ;EACvB,SAAS,OAAO,SAAS,QAAQ;EACjC,WAAW,UAAU,MAAM,GAAG,GAAG;CACnC;AACF;;;;;;;;;;ACIA,MAAa,gBAAgBC,IAAAA,EAAE,OAAO,EACpC,OAAOA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EACzB,CAAC;;;;;;AAOD,MAAa,cAAcA,IAAAA,EAAE,OAAO;CAClC,OAAOA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACvB,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACtB,aAAaA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAE7B,WAAWA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;AACxC,CAAC;;;;;AAMD,MAAa,sBAAsBA,IAAAA,EAAE,OAAO,EAC1C,WAAWA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EACxC,CAAC;;;;;AAMD,MAAa,mBAAmBA,IAAAA,EAC7B,OAAOA,IAAAA,EAAE,OAAO,GAAGA,IAAAA,EAAE,QAAQ,CAAC,CAAC,CAC/B,QAAQ,QAAQ,OAAO,KAAK,GAAG,CAAC,CAAC,SAAS,GAAG,+BAA+B;;AAY/E,MAAa,sBAAsBC,aAAAA;;AAGnC,MAAa,wBAAwBC,aAAAA;;AAGrC,MAAa,sBAAsBC,aAAAA;;AAGnC,MAAa,wBAAwBA,aAAAA;;ACIrC,MAAM,uCAAuB,IAAI,IAAY;CAC3C;CAAK;CAAK;CAAK;CAAK;CAAK;CAAK;CAAK;CAAK;AAC1C,CAAC;AAED,MAAM,iBAAiD;CACrD,eAAe;CACf,eAAe;CACf,mBAAmB;CACnB,eAAe;CACf,SAAS;CACT,WAAW;AACb;AAEA,SAAS,YAAY,UAA4B;CAC/C,IAAI,SAAS,SAAS,OAAO,OAAO,SAAS;CAC7C,OAAO,eAAe,SAAS;AACjC;AAEA,SAAS,cACP,GACA,UACA,QACU;CACV,MAAM,aAAa,qBAAqB,IAAI,MAAM,IAC7C,SACD;CAEJ,IADaC,6BAAAA,aACN,MAAM,OACX,OAAO,EAAE,KACP,EAAE,OAAO;EAAE,MAAM,YAAY,QAAQ;EAAG,SAAS,SAAS;CAAQ,EAAE,GACpE,UACF;CAEF,OAAO,EAAE,KAAK,EAAE,OAAO,SAAS,QAAQ,GAAG,UAAU;AACvD;AAEA,MAAM,+BAAe,IAAI,IAAI;CAAC;CAAO;CAAQ;AAAS,CAAC;;;;;AAMvD,MAAM,uBAAuB;;;;;AAM7B,SAAS,wBAAwB,SAAyC;CACxE,MAAM,6BAAa,IAAI,IAAY;CACnC,KAAK,MAAM,SAAS,SAAS;EAC3B,IAAI;EACJ,IAAI;GACF,MAAM,IAAI,IAAI,KAAK;EACrB,QAAQ,CAER;EACA,MAAM,SACJ,QAAQ,KAAA,KAAa,CAAC,YAAY,KAAK,IAAI,QAAQ,IAC/C,qBAAqB,KAAK,KAAK,IAC/B;EACN,IACE,QAAQ,KAAA,KACP,WAAW,QAAQ,CAAC,YAAY,KAAK,IAAI,QAAQ,GAElD,MAAM,IAAI,MACR,2CAA2C,KAAK,UAAU,KAAK,EAAE,+GACnE;EAEF,WAAW,IACT,WAAW,OACP,IAAI,SACJ,GAAI,OAAO,EAAE,CAAY,YAAY,EAAE,KAAM,OAAO,EAAE,CAAY,YAAY,GACpF;CACF;CACA,OAAO;AACT;;;;;AAMA,SAAS,gBACP,QACA,YACA,SACS;CACT,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,MAAM;CACzB,QAAQ;EACN,OAAO;CACT;CACA,OACE,QAAQ,IAAI,OAAO,MAAM,KACzB,QAAQ,IAAI,OAAO,YAAY,CAAC,KAChC,OAAO,SAAS,IAAI,IAAI,UAAU,CAAC,CAAC;AAExC;AAEA,SAAS,SACP,QACA,SACA,QACa;CACb,OAAO;EAAE,MAAM;EAAO;EAAQ;EAAS;CAAO;AAChD;;;;;;;;;AAUA,SAAgB,kBAAkB,OAA2B,CAAC,GAAiB;CAC7E,IAAI,KAAK,kBAAkB,KAAA,GACzB,6BAAA,2BAA2B,KAAK,aAAa;CAG/C,MAAM,iBAAiB,wBAAwB,KAAK,kBAAkB,CAAC,CAAC;CAExE,MAAM,SAASC,oBAAAA,iBAAiB;CAGhC,MAAM,iBACJC,6BAAAA,qBAAqB,KAAK,eAAeC,6BAAAA,iBAAiB,CAAC;CAE7D,MAAM,aAAa,oBAAoD;EACrE,YAAY,OAAO,GAAG,SAAS;GAC7B,EAAE,OAAO,iBAAiB,UAAU;GACpC,IAAI;IACF,MAAM,EAAE,IAAI,KAAK;GACnB,QAAQ;IACN,OAAO,cACL,GACA,SAAS,aAAa,SAAS,CAAC,CAAC,iBAAiB,GAAG,GACrD,GACF;GACF;GACA,MAAM,KAAK;EACb;EACA,YAAY,QAAQ,MAAM;GACxB,IAAI,OAAO,SAAS,OAAO,KAAA;GAC3B,EAAE,OAAO,iBAAiB,UAAU;GACpC,OAAO,cAAc,GAAG,SAAS,aAAa,eAAe,GAAG,GAAG,GAAG,GAAG;EAC3E;CACF;CAGA,MAAM,cAAiC,OAAO,GAAG,SAAS;EACxD,MAAM,SAAS,EAAE,IAAI,OAAO,QAAQ;EACpC,IACE,aAAa,IAAI,EAAE,IAAI,MAAM,KAC7B,WAAW,KAAA,KACX,gBAAgB,QAAQ,EAAE,IAAI,KAAK,cAAc,GAEjD,OAAO,KAAK;EAEd,OAAO,cACL,GACA;GACE,MAAM;GACN,MAAM;GACN,SAAS,SAAS,CAAC,CAAC;GACpB,QAAQ;EACV,GACA,GACF;CACF;CAEA,OAAO;EACL;EACA,eAAe;GACb,SAAS,gBAAgB,SAAS,CAAC,CAAC,YAAY;GAChD,OAAO,gBAAgB,SAAS,CAAC,CAAC,WAAW;EAC/C;EAEA,SAAS,OAAO,MAAkC;GAEhD,EAAE,OAAO,iBAAiB,UAAU;GACpC,IAAI;GACJ,IAAI;IACF,MAAM,MAAM,EAAE,IAAI,KAAK;GACzB,QAAQ;IACN,OAAO,cACL,GACA,SAAS,aAAa,SAAS,CAAC,CAAC,iBAAiB,GAAG,GACrD,GACF;GACF;GACA,MAAM,SAAS,cAAc,UAAU,GAAG;GAC1C,IAAI,CAAC,OAAO,SACV,OAAO,cACL,GACA,SAAS,aAAa,SAAS,CAAC,CAAC,cAAc,GAAG,GAClD,GACF;GAEF,MAAM,SAAS,MAAM,OAAO,QAAQ,OAAO,IAAI;GAC/C,IAAI,CAAC,OAAO,IAAI,OAAO,cAAc,GAAG,OAAO,OAAO,OAAO,MAAM,MAAM;GACzE,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,KAAK,CAAC;EACrC;EAGA,OAAO,OAAO,MAAkC;GAE9C,EAAE,OAAO,iBAAiB,UAAU;GACpC,IAAI;GACJ,IAAI;IACF,MAAM,MAAM,EAAE,IAAI,KAAK;GACzB,QAAQ;IACN,OAAO,cACL,GACA,SAAS,aAAa,SAAS,CAAC,CAAC,iBAAiB,GAAG,GACrD,GACF;GACF;GACA,MAAM,SAAS,YAAY,UAAU,GAAG;GACxC,IAAI,CAAC,OAAO,SACV,OAAO,cACL,GACA,SAAS,aAAa,SAAS,CAAC,CAAC,aAAa,GAAG,GACjD,GACF;GAEF,MAAM,aAAa,gBAAgB,EAAE,IAAI,GAAG;GAC5C,MAAM,SAAS,MAAM,OAAO,MAAM;IAAE,GAAG,OAAO;IAAM,GAAG;GAAW,CAAC;GACnE,IAAI,CAAC,OAAO,IAAI,OAAO,cAAc,GAAG,OAAO,OAAO,OAAO,MAAM,MAAM;GACzE,IAAI,OAAO,KAAK,QAAQ;IACtB,MAAM,gBAAgBC,gBAAAA,gBAAgB,OAAO,KAAK,MAAM;IACxD,KAAK,MAAM,UAAU,eACnB,EAAE,OAAO,cAAc,QAAQ,EAAE,QAAQ,KAAK,CAAC;GAEnD;GACA,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,OAAO,KAAK,KAAK,GAAG,EAAE,EAAE,CAAC;EAC/D;EAGA,SAAS,OAAO,MAAkC;GAChD,MAAM,eAAe,EAAE,IAAI,OAAO,QAAQ,KAAK;GAC/C,MAAM,EAAE,iBAAiBC,gBAAAA,sBAAsB,YAAY;GAC3D,IAAI,CAAC,cACH,OAAO,cACL,GACA,SAAS,iBAAiB,SAAS,CAAC,CAAC,eAAe,GAAG,GACvD,GACF;GACF,MAAM,SAAS,MAAMC,sBAAAA,mBAAmB,oBACtC,OAAO,QAAQ,EAAE,aAAa,CAAC,CACjC;GACA,IAAI,CAAC,OAAO,IAAI,OAAO,cAAc,GAAG,OAAO,OAAO,OAAO,MAAM,MAAM;GACzE,IAAI,OAAO,KAAK,QAAQ;IACtB,MAAM,gBAAgBF,gBAAAA,gBAAgB,OAAO,KAAK,MAAM;IACxD,KAAK,MAAM,UAAU,eACnB,EAAE,OAAO,cAAc,QAAQ,EAAE,QAAQ,KAAK,CAAC;GAEnD;GACA,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,OAAO,KAAK,KAAK,GAAG,EAAE,EAAE,CAAC;EAC/D;EAGA,QAAQ,OAAO,MAAkC;GAC/C,MAAM,eAAe,EAAE,IAAI,OAAO,QAAQ,KAAK;GAC/C,MAAM,EAAE,iBAAiBC,gBAAAA,sBAAsB,YAAY;GAC3D,IAAI,CAAC,cACH,OAAO,cACL,GACA,SAAS,iBAAiB,SAAS,CAAC,CAAC,eAAe,GAAG,GACvD,GACF;GACF,MAAM,SAAS,MAAM,OAAO,OAAO,EAAE,aAAa,CAAC;GACnD,IAAI,CAAC,OAAO,IAAI,OAAO,cAAc,GAAG,OAAO,OAAO,OAAO,MAAM,MAAM;GACzE,MAAM,eAAeE,gBAAAA,kBAAkB;GACvC,KAAK,MAAM,UAAU,cACnB,EAAE,OAAO,cAAc,QAAQ,EAAE,QAAQ,KAAK,CAAC;GAEjD,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,KAAK,CAAC;EACrC;EAGA,OAAO,OAAO,MAAkC;GAC9C,MAAM,eAAe,EAAE,IAAI,OAAO,QAAQ,KAAK;GAC/C,MAAM,EAAE,gBAAgBF,gBAAAA,sBAAsB,YAAY;GAC1D,IAAI,CAAC,aACH,OAAO,cACL,GACA,SAAS,iBAAiB,SAAS,CAAC,CAAC,eAAe,GAAG,GACvD,GACF;GACF,MAAM,SAAS,MAAM,OAAO,QAAQ,EAAE,YAAY,CAAC;GACnD,IAAI,CAAC,OAAO,IAAI,OAAO,cAAc,GAAG,OAAO,OAAO,OAAO,MAAM,MAAM;GACzE,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,KAAK,CAAC;EACrC;EAGA,UAAU,OAAO,MAAkC;GACjD,MAAM,eAAe,EAAE,IAAI,OAAO,QAAQ,KAAK;GAC/C,MAAM,EAAE,gBAAgBA,gBAAAA,sBAAsB,YAAY;GAC1D,IAAI,CAAC,aACH,OAAO,cACL,GACA,SAAS,iBAAiB,SAAS,CAAC,CAAC,eAAe,GAAG,GACvD,GACF;GACF,IAAI;GACJ,IAAI;IACF,MAAM,MAAM,EAAE,IAAI,KAAK;GACzB,QAAQ;IACN,OAAO,cACL,GACA,SAAS,aAAa,SAAS,CAAC,CAAC,iBAAiB,GAAG,GACrD,GACF;GACF;GACA,MAAM,SAAS,iBAAiB,UAAU,GAAG;GAC7C,IAAI,CAAC,OAAO,SACV,OAAO,cACL,GACA,SAAS,aAAa,SAAS,CAAC,CAAC,mBAAmB,GAAG,GACvD,GACF;GAEF,MAAM,SAAS,MAAM,OAAO,WAAW;IAAE;IAAa,MAAM,OAAO;GAAK,CAAC;GACzE,IAAI,CAAC,OAAO,IAAI,OAAO,cAAc,GAAG,OAAO,OAAO,OAAO,MAAM,MAAM;GACzE,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,KAAK,CAAC;EACrC;EAGA,UAAU,OAAO,MAAkC;GACjD,MAAM,eAAe,EAAE,IAAI,OAAO,QAAQ,KAAK;GAC/C,MAAM,EAAE,gBAAgBA,gBAAAA,sBAAsB,YAAY;GAC1D,IAAI,CAAC,aACH,OAAO,cACL,GACA,SAAS,iBAAiB,SAAS,CAAC,CAAC,eAAe,GAAG,GACvD,GACF;GACF,MAAM,SAAS,MAAM,OAAO,WAAW,EAAE,YAAY,CAAC;GACtD,IAAI,CAAC,OAAO,IAAI,OAAO,cAAc,GAAG,OAAO,OAAO,OAAO,MAAM,MAAM;GACzE,MAAM,eAAeE,gBAAAA,kBAAkB;GACvC,KAAK,MAAM,UAAU,cACnB,EAAE,OAAO,cAAc,QAAQ,EAAE,QAAQ,KAAK,CAAC;GAEjD,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,KAAK,CAAC;EACrC;EAGA,aAAa,OAAO,MAAkC;GACpD,MAAM,eAAe,EAAE,IAAI,OAAO,QAAQ,KAAK;GAC/C,MAAM,EAAE,gBAAgBF,gBAAAA,sBAAsB,YAAY;GAC1D,IAAI,CAAC,aACH,OAAO,cACL,GACA,SAAS,iBAAiB,SAAS,CAAC,CAAC,eAAe,GAAG,GACvD,GACF;GACF,MAAM,SAAS,MAAM,OAAO,gBAAgB,EAAE,YAAY,CAAC;GAC3D,IAAI,CAAC,OAAO,IAAI,OAAO,cAAc,GAAG,OAAO,OAAO,OAAO,MAAM,MAAM;GACzE,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,KAAK,CAAC;EACrC;EAGA,kBAAkB,OAAO,MAAkC;GAEzD,EAAE,OAAO,iBAAiB,UAAU;GACpC,MAAM,eAAe,EAAE,IAAI,OAAO,QAAQ,KAAK;GAC/C,MAAM,EAAE,gBAAgBA,gBAAAA,sBAAsB,YAAY;GAC1D,IAAI,CAAC,aACH,OAAO,cACL,GACA,SAAS,iBAAiB,SAAS,CAAC,CAAC,eAAe,GAAG,GACvD,GACF;GACF,IAAI;GACJ,IAAI;IACF,MAAM,MAAM,EAAE,IAAI,KAAK;GACzB,QAAQ;IACN,OAAO,cACL,GACA,SAAS,aAAa,SAAS,CAAC,CAAC,iBAAiB,GAAG,GACrD,GACF;GACF;GACA,MAAM,SAAS,oBAAoB,UAAU,GAAG;GAChD,IAAI,CAAC,OAAO,SACV,OAAO,cACL,GACA,SACE,aACA,4DACA,GACF,GACA,GACF;GAEF,MAAM,SAAS,MAAM,OAAO,iBAAiB;IAC3C;IACA,WAAW,OAAO,KAAK;GACzB,CAAC;GACD,IAAI,CAAC,OAAO,IAAI,OAAO,cAAc,GAAG,OAAO,OAAO,OAAO,MAAM,MAAM;GAGzE,IAAI,CAAC,OAAO,KAAK,aACf,OAAO,cACL,GACA,SACE,aACA,gDACA,GACF,GACA,GACF;GAEF,EAAE,OAAO,cAAcG,gBAAAA,qBAAqB,OAAO,KAAK,WAAW,GAAG,EACpE,QAAQ,KACV,CAAC;GACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,OAAO,KAAK,UAAU,EAAE,CAAC;EAC9D;EAGA,aAAa,OAAO,MAAkC;GACpD,MAAM,eAAe,EAAE,IAAI,OAAO,QAAQ,KAAK;GAC/C,MAAM,EAAE,gBAAgBH,gBAAAA,sBAAsB,YAAY;GAC1D,IAAI,CAAC,aACH,OAAO,cACL,GACA,SAAS,iBAAiB,SAAS,CAAC,CAAC,eAAe,GAAG,GACvD,GACF;GACF,MAAM,SAAS,MAAM,OAAO,YAAY,EAAE,YAAY,CAAC;GACvD,IAAI,CAAC,OAAO,IAAI,OAAO,cAAc,GAAG,OAAO,OAAO,OAAO,MAAM,MAAM;GACzE,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,KAAK,CAAC;EACrC;EAGA,eAAe,OAAO,MAAkC;GACtD,MAAM,eAAe,EAAE,IAAI,OAAO,QAAQ,KAAK;GAC/C,MAAM,EAAE,gBAAgBA,gBAAAA,sBAAsB,YAAY;GAC1D,IAAI,CAAC,aACH,OAAO,cACL,GACA,SAAS,iBAAiB,SAAS,CAAC,CAAC,eAAe,GAAG,GACvD,GACF;GACF,MAAM,YAAY,EAAE,IAAI,MAAM,IAAI;GAClC,IAAI,CAAC,aAAa,CAAC,WAAW,KAAK,SAAS,GAC1C,OAAO,cACL,GACA,SAAS,aAAa,SAAS,CAAC,CAAC,gBAAgB,GAAG,GACpD,GACF;GAEF,MAAM,SAAS,MAAM,OAAO,cAAc;IAAE;IAAa;GAAU,CAAC;GACpE,IAAI,CAAC,OAAO,IAAI,OAAO,cAAc,GAAG,OAAO,OAAO,OAAO,MAAM,MAAM;GACzE,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,KAAK,CAAC;EACrC;EAGA,mBAAmB,OAAO,MAAkC;GAC1D,MAAM,eAAe,EAAE,IAAI,OAAO,QAAQ,KAAK;GAC/C,MAAM,EAAE,iBAAiBA,gBAAAA,sBAAsB,YAAY;GAC3D,IAAI,CAAC,cACH,OAAO,cACL,GACA,SAAS,iBAAiB,SAAS,CAAC,CAAC,eAAe,GAAG,GACvD,GACF;GACF,MAAM,SAAS,MAAM,OAAO,kBAAkB,EAAE,aAAa,CAAC;GAC9D,IAAI,CAAC,OAAO,IAAI,OAAO,cAAc,GAAG,OAAO,OAAO,OAAO,MAAM,MAAM;GACzE,MAAM,eAAeE,gBAAAA,kBAAkB;GACvC,KAAK,MAAM,UAAU,cACnB,EAAE,OAAO,cAAc,QAAQ,EAAE,QAAQ,KAAK,CAAC;GAEjD,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,KAAK,CAAC;EACrC;CACF;AACF"}

package/dist/auth-handlers-DRUUTEtW.d.cts

@@ -0,0 +1,15 @@
+import { n as EvaErrorMessages } from "./error-messages-CGpW1fsg.cjs";
+import { Context } from "hono";
+interface AuthHandlerOptions {
+  errorMessages?: Partial<EvaErrorMessages>;
+  /**
+   * Orígenes extra (`https://app.example.com`, sin path) desde los que se aceptan las mutaciones
+   * con cookies, además del propio host de la request. Un `Origin` fuera de esa lista responde 403.
+   * Acepta cualquier origen serializado `esquema://host[:puerto]` (también `tauri://localhost`,
+   * `capacitor://localhost`) por coincidencia exacta. Lanza al construir si una entrada no lo es
+   * (p. ej. `'*'` o `null`).
+   */
+  allowedOrigins?: readonly string[];
+}
+export { AuthHandlerOptions as t };
+//# sourceMappingURL=auth-handlers-DRUUTEtW.d.cts.map

package/dist/auth-handlers-DRUUTEtW.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-handlers-DRUUTEtW.d.cts","names":[],"sources":["../src/auth-handlers.ts"],"mappings":";;UA8BiB;EACf,gBAAgB,QAAQ;;;;;;;;EAQxB"}

package/dist/catalog-CHPqldcj.cjs

@@ -0,0 +1,172 @@
+// ../auth-contracts/dist/catalog.js
+/**
+* PURE module: it must never reference `zod` or any schema module of this package (see
+* `constants.ts`). The closed catalog of service audiences and, for each, its permissions.
+*
+* Apart from `tokens.ts` and `constants.ts` on purpose: the SDK `react` entry is size-budgeted and
+* reaches `constants.ts` (header names), so nothing the browser does not need goes there. The SDK
+* `react` closure imports neither this catalog nor the token vocabulary; Auth uses
+* `isServiceAudience` to keep product slugs and service audiences apart.
+*/
+/**
+* Closed catalog of service audiences and, for each one, the permissions a service client can be
+* granted on it. The service token `aud` is one of these keys and its `scope` a subset of the
+* values. Add a permission here only together with the route that requires it.
+*
+* `admin` is NOT a permission of `auth-api`: the Auth admin surface authenticates with the signed
+* request of a service client flagged `esAdmin`, never with a token. It IS a permission of
+* `whatsapp-api`.
+*/
+const SERVICE_AUDIENCE_SCOPES = {
+	"auth-api": [
+		"users:read",
+		"webhooks:read",
+		"webhooks:write",
+		"empresas:leer",
+		"empresas:escribir",
+		"tokens:exchange",
+		"contrataciones:pedir",
+		"contrataciones:escribir",
+		"contrataciones:leer",
+		"empresas:baja",
+		"autorizaciones:escribir",
+		"autorizaciones:leer",
+		"directorio:leer"
+	],
+	"whatsapp-api": [
+		"messages:send:text",
+		"messages:send:media",
+		"admin"
+	]
+};
+/** Service audiences as a tuple, so schemas can build an enum straight from it. */
+const SERVICE_AUDIENCES = ["auth-api", "whatsapp-api"];
+/** True when `value` is an audience of the catalog. */
+function isServiceAudience(value) {
+	return Object.hasOwn(SERVICE_AUDIENCE_SCOPES, value);
+}
+/** True when `scope` is a permission of `audience` in the catalog (an unknown audience is false). */
+function isScopeOfAudience(audience, scope) {
+	return isServiceAudience(audience) && SERVICE_AUDIENCE_SCOPES[audience].includes(scope);
+}
+/**
+* Permissions a service client can DELEGATE on behalf of a user (token exchange), by destination
+* audience. A delegation edge (`service_client_delegations`) can only carry these.
+*
+* Narrower than {@link SERVICE_AUDIENCE_SCOPES} on purpose: `auth-api` is never a destination (Auth
+* is the issuer, so no delegated token talks to it) and `admin` is never delegable. A test pins both
+* and that every value is in the audience catalog.
+*/
+const DELEGABLE_AUDIENCE_SCOPES = { "whatsapp-api": ["messages:send:text", "messages:send:media"] };
+/** Delegable audiences as a tuple, so schemas can build an enum straight from it. */
+const DELEGABLE_AUDIENCES = ["whatsapp-api"];
+/** Every delegable permission of every audience, flat (a scope string names its audience's service). */
+const DELEGABLE_SCOPES = Object.values(DELEGABLE_AUDIENCE_SCOPES).flat();
+/** True when `audience` can be the destination of a delegated token. */
+function isDelegableAudience(value) {
+	return Object.hasOwn(DELEGABLE_AUDIENCE_SCOPES, value);
+}
+/** True when `scope` can be delegated towards `audience` (an unknown or non-delegable audience is false). */
+function isDelegableScope(audience, scope) {
+	return isDelegableAudience(audience) && DELEGABLE_AUDIENCE_SCOPES[audience].includes(scope);
+}
+/**
+* Closed catalog of permissions BETWEEN companies ("company B may do X on the data of company A"),
+* by the service audience that owns the data. Kept apart from {@link SERVICE_AUDIENCE_SCOPES} on
+* purpose: those say what a service CLIENT can do, these say what a COMPANY authorizes another
+* company to do. They are only for private data; public or shared data needs none.
+*
+* Starts minimal and each owning service adds its own (together with the route that checks it).
+* `auth-api` owns none: it only stores and answers the grants.
+*/
+const INTER_EMPRESA_PERMISSIONS = { "whatsapp-api": ["whatsapp:mensajes:leer"] };
+/** Every inter-company permission, flat, so schemas can build an enum straight from it. */
+const INTER_EMPRESA_PERMISSION_LIST = Object.values(INTER_EMPRESA_PERMISSIONS).flat();
+/** True when `value` is a permission of the inter-company catalog. */
+function isInterEmpresaPermission(value) {
+	return INTER_EMPRESA_PERMISSION_LIST.includes(value);
+}
+/** The audience that owns `permission` (the only one that may verify it), or `undefined`. */
+function interEmpresaPermissionOwner(permission) {
+	return Object.keys(INTER_EMPRESA_PERMISSIONS).find((owner) => INTER_EMPRESA_PERMISSIONS[owner].includes(permission));
+}
+Object.defineProperty(exports, "DELEGABLE_AUDIENCES", {
+	enumerable: true,
+	get: function() {
+		return DELEGABLE_AUDIENCES;
+	}
+});
+Object.defineProperty(exports, "DELEGABLE_AUDIENCE_SCOPES", {
+	enumerable: true,
+	get: function() {
+		return DELEGABLE_AUDIENCE_SCOPES;
+	}
+});
+Object.defineProperty(exports, "DELEGABLE_SCOPES", {
+	enumerable: true,
+	get: function() {
+		return DELEGABLE_SCOPES;
+	}
+});
+Object.defineProperty(exports, "INTER_EMPRESA_PERMISSIONS", {
+	enumerable: true,
+	get: function() {
+		return INTER_EMPRESA_PERMISSIONS;
+	}
+});
+Object.defineProperty(exports, "INTER_EMPRESA_PERMISSION_LIST", {
+	enumerable: true,
+	get: function() {
+		return INTER_EMPRESA_PERMISSION_LIST;
+	}
+});
+Object.defineProperty(exports, "SERVICE_AUDIENCES", {
+	enumerable: true,
+	get: function() {
+		return SERVICE_AUDIENCES;
+	}
+});
+Object.defineProperty(exports, "SERVICE_AUDIENCE_SCOPES", {
+	enumerable: true,
+	get: function() {
+		return SERVICE_AUDIENCE_SCOPES;
+	}
+});
+Object.defineProperty(exports, "interEmpresaPermissionOwner", {
+	enumerable: true,
+	get: function() {
+		return interEmpresaPermissionOwner;
+	}
+});
+Object.defineProperty(exports, "isDelegableAudience", {
+	enumerable: true,
+	get: function() {
+		return isDelegableAudience;
+	}
+});
+Object.defineProperty(exports, "isDelegableScope", {
+	enumerable: true,
+	get: function() {
+		return isDelegableScope;
+	}
+});
+Object.defineProperty(exports, "isInterEmpresaPermission", {
+	enumerable: true,
+	get: function() {
+		return isInterEmpresaPermission;
+	}
+});
+Object.defineProperty(exports, "isScopeOfAudience", {
+	enumerable: true,
+	get: function() {
+		return isScopeOfAudience;
+	}
+});
+Object.defineProperty(exports, "isServiceAudience", {
+	enumerable: true,
+	get: function() {
+		return isServiceAudience;
+	}
+});
+
+//# sourceMappingURL=catalog-CHPqldcj.cjs.map