@innvoid/getmarket-sdk 0.1.2 → 0.1.4

package/dist/auth/index.cjs

@@ -0,0 +1,181 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/auth/index.ts
+var auth_exports = {};
+__export(auth_exports, {
+  createAuthMiddleware: () => createAuthMiddleware,
+  readRs256PublicKey: () => readRs256PublicKey,
+  verifyBackendJwtRS256: () => verifyBackendJwtRS256
+});
+module.exports = __toCommonJS(auth_exports);
+
+// src/auth/jwt.ts
+var import_fs = __toESM(require("fs"), 1);
+var import_jsonwebtoken = __toESM(require("jsonwebtoken"), 1);
+function readFileIfExists(path) {
+  if (!path) return null;
+  try {
+    const v = import_fs.default.readFileSync(path, "utf8").trim();
+    return v.length ? v : null;
+  } catch {
+    return null;
+  }
+}
+function readRs256PublicKey() {
+  const fromFile = readFileIfExists(process.env.JWT_PUBLIC_KEY_PATH);
+  if (fromFile) return fromFile;
+  const fromEnv = String(process.env.AUTH_JWT_PUBLIC_KEY || process.env.AUTH_RSA_PUBLIC_KEY || "").replace(/\\n/g, "\n").trim();
+  if (fromEnv) return fromEnv;
+  throw new Error("Missing RS256 public key (JWT_PUBLIC_KEY_PATH / AUTH_JWT_PUBLIC_KEY / AUTH_RSA_PUBLIC_KEY)");
+}
+function verifyBackendJwtRS256(raw) {
+  const publicKey = readRs256PublicKey();
+  const audience = process.env.JWT_AUDIENCE || process.env.AUTH_JWT_AUDIENCE || "getmarket.api";
+  const issuer = process.env.JWT_ISSUER || process.env.AUTH_JWT_ISSUER || "getmarket-auth";
+  return import_jsonwebtoken.default.verify(raw, publicKey, {
+    algorithms: ["RS256"],
+    audience,
+    issuer
+  });
+}
+
+// src/auth/middleware.ts
+function getBearerToken(req) {
+  const auth = String(req.headers?.authorization || "");
+  if (!auth.startsWith("Bearer ")) return null;
+  const token = auth.slice(7).trim();
+  return token.length ? token : null;
+}
+function normalizeUid(v) {
+  const s = String(v ?? "").trim();
+  return s.length ? s : null;
+}
+function createAuthMiddleware(opts) {
+  const {
+    subject,
+    allowFirebaseIdToken = false,
+    requireSubject = true,
+    hydrate
+  } = opts;
+  return async (req, res, next) => {
+    const token = getBearerToken(req);
+    if (!token) {
+      return res.status(401).json({
+        ok: false,
+        code: "AUTH_MISSING_TOKEN",
+        message: "Missing Authorization Bearer token"
+      });
+    }
+    const headerCtx = req.context || {};
+    const company_uid = normalizeUid(headerCtx.company_uid);
+    const branch_uid = normalizeUid(headerCtx.branch_uid);
+    try {
+      const decoded = verifyBackendJwtRS256(token);
+      const baseCtx = {
+        tokenType: "backend",
+        subject,
+        company_uid: company_uid ?? void 0,
+        branch_uid: branch_uid ?? void 0,
+        roles: Array.isArray(decoded?.roles) ? decoded.roles : [],
+        permissions: Array.isArray(decoded?.permissions) ? decoded.permissions : [],
+        denied_permissions: Array.isArray(decoded?.denied_permissions) ? decoded.denied_permissions : [],
+        session: {
+          jti: decoded?.jti,
+          device_id: decoded?.device_id,
+          expires_at: decoded?.exp
+        }
+      };
+      const hydrated = await hydrate({ decoded, req, subject, company_uid, branch_uid });
+      Object.assign(baseCtx, hydrated);
+      if (requireSubject) {
+        if (subject === "employee" && !baseCtx.employee) {
+          return res.status(401).json({
+            ok: false,
+            code: "AUTH_EMPLOYEE_NOT_FOUND",
+            message: "Employee not resolved by hydrator"
+          });
+        }
+        if (subject === "customer" && !baseCtx.customer) {
+          return res.status(401).json({
+            ok: false,
+            code: "AUTH_CUSTOMER_NOT_FOUND",
+            message: "Customer not resolved by hydrator"
+          });
+        }
+      }
+      req.auth = baseCtx;
+      return next();
+    } catch (errJwt) {
+      if (!allowFirebaseIdToken) {
+        return res.status(401).json({
+          ok: false,
+          code: "AUTH_INVALID_TOKEN",
+          message: "Invalid or expired token"
+        });
+      }
+      try {
+        const { default: admin } = await import("firebase-admin");
+        const firebaseDecoded = await admin.auth().verifyIdToken(token);
+        if (firebaseDecoded.email && firebaseDecoded.email_verified === false) {
+          return res.status(401).json({
+            ok: false,
+            code: "AUTH_EMAIL_NOT_VERIFIED",
+            message: "Email not verified"
+          });
+        }
+        req.auth = {
+          tokenType: "backend",
+          subject,
+          firebase: firebaseDecoded,
+          company_uid: company_uid ?? void 0,
+          branch_uid: branch_uid ?? void 0,
+          companies: [],
+          roles: [],
+          permissions: [],
+          denied_permissions: []
+        };
+        return next();
+      } catch {
+        return res.status(401).json({
+          ok: false,
+          code: "AUTH_INVALID_TOKEN",
+          message: "Invalid or expired token"
+        });
+      }
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createAuthMiddleware,
+  readRs256PublicKey,
+  verifyBackendJwtRS256
+});
+//# sourceMappingURL=index.cjs.map

package/dist/auth/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/index.ts","../../src/auth/jwt.ts","../../src/auth/middleware.ts"],"sourcesContent":["export * from \"./types\";\nexport * from \"./jwt\";\nexport * from \"./middleware\";\n","import fs from \"fs\";\nimport jwt, {JwtPayload} from \"jsonwebtoken\";\n\nfunction readFileIfExists(path?: string): string | null {\n    if (!path) return null;\n    try {\n        const v = fs.readFileSync(path, \"utf8\").trim();\n        return v.length ? v : null;\n    } catch {\n        return null;\n    }\n}\n\n/**\n * ✅ Keys viven en getmarket-stack:\n * - JWT_PUBLIC_KEY_PATH=/run/secrets/jwtRS256.key.pub (recomendado)\n * - fallback env AUTH_JWT_PUBLIC_KEY / AUTH_RSA_PUBLIC_KEY\n */\nexport function readRs256PublicKey(): string {\n    const fromFile = readFileIfExists(process.env.JWT_PUBLIC_KEY_PATH);\n    if (fromFile) return fromFile;\n\n    const fromEnv = String(process.env.AUTH_JWT_PUBLIC_KEY || process.env.AUTH_RSA_PUBLIC_KEY || \"\")\n        .replace(/\\\\n/g, \"\\n\")\n        .trim();\n\n    if (fromEnv) return fromEnv;\n\n    throw new Error(\"Missing RS256 public key (JWT_PUBLIC_KEY_PATH / AUTH_JWT_PUBLIC_KEY / AUTH_RSA_PUBLIC_KEY)\");\n}\n\nexport function verifyBackendJwtRS256(raw: string): JwtPayload {\n    const publicKey = readRs256PublicKey();\n\n    const audience = process.env.JWT_AUDIENCE || process.env.AUTH_JWT_AUDIENCE || \"getmarket.api\";\n    const issuer = process.env.JWT_ISSUER || process.env.AUTH_JWT_ISSUER || \"getmarket-auth\";\n\n    // ✅ SOLO RS256\n    return jwt.verify(raw, publicKey, {\n        algorithms: [\"RS256\"],\n        audience,\n        issuer,\n    }) as JwtPayload;\n}\n","import type {NextFunction, Response} from \"express\";\nimport {verifyBackendJwtRS256} from \"./jwt\";\nimport type {AuthContext, AuthMiddlewareOptions} from \"./types\";\n\nfunction getBearerToken(req: any): string | null {\n    const auth = String(req.headers?.authorization || \"\");\n    if (!auth.startsWith(\"Bearer \")) return null;\n    const token = auth.slice(7).trim();\n    return token.length ? token : null;\n}\n\nfunction normalizeUid(v: any): string | null {\n    const s = String(v ?? \"\").trim();\n    return s.length ? s : null;\n}\n\n/**\n * ✅ Middleware estándar:\n * - Solo Authorization: Bearer\n * - Solo RS256\n * - Cero legacy\n * - Hidrata vía hook (OBLIGATORIO) para que cada micro no replique lógica\n */\nexport function createAuthMiddleware(opts: AuthMiddlewareOptions) {\n    const {\n        subject,\n        allowFirebaseIdToken = false,\n        requireSubject = true,\n        hydrate,\n    } = opts;\n\n    return async (req: any, res: Response, next: NextFunction) => {\n        const token = getBearerToken(req);\n        if (!token) {\n            return res.status(401).json({\n                ok: false,\n                code: \"AUTH_MISSING_TOKEN\",\n                message: \"Missing Authorization Bearer token\",\n            });\n        }\n\n        // Contexto desde parseHeaders (SDK) -> req.context\n        const headerCtx = (req as any).context || {};\n        const company_uid = normalizeUid(headerCtx.company_uid);\n        const branch_uid = normalizeUid(headerCtx.branch_uid);\n\n        // 1) RS256 backend JWT\n        try {\n            const decoded: any = verifyBackendJwtRS256(token);\n\n            const baseCtx: AuthContext = {\n                tokenType: \"backend\",\n                subject,\n                company_uid: company_uid ?? undefined,\n                branch_uid: branch_uid ?? undefined,\n                roles: Array.isArray(decoded?.roles) ? decoded.roles : [],\n                permissions: Array.isArray(decoded?.permissions) ? decoded.permissions : [],\n                denied_permissions: Array.isArray(decoded?.denied_permissions) ? decoded.denied_permissions : [],\n                session: {\n                    jti: decoded?.jti,\n                    device_id: decoded?.device_id,\n                    expires_at: decoded?.exp,\n                },\n            };\n\n            // ✅ hydrate obligatorio (cero legacy)\n            const hydrated = await hydrate({decoded, req, subject, company_uid, branch_uid});\n            Object.assign(baseCtx, hydrated);\n\n            if (requireSubject) {\n                if (subject === \"employee\" && !baseCtx.employee) {\n                    return res.status(401).json({\n                        ok: false,\n                        code: \"AUTH_EMPLOYEE_NOT_FOUND\",\n                        message: \"Employee not resolved by hydrator\",\n                    });\n                }\n                if (subject === \"customer\" && !baseCtx.customer) {\n                    return res.status(401).json({\n                        ok: false,\n                        code: \"AUTH_CUSTOMER_NOT_FOUND\",\n                        message: \"Customer not resolved by hydrator\",\n                    });\n                }\n            }\n\n            req.auth = baseCtx;\n            return next();\n        } catch (errJwt) {\n            // 2) Firebase opcional (si está habilitado explícitamente)\n            if (!allowFirebaseIdToken) {\n                return res.status(401).json({\n                    ok: false,\n                    code: \"AUTH_INVALID_TOKEN\",\n                    message: \"Invalid or expired token\",\n                });\n            }\n\n            try {\n                // Import dinámico (pero firebase-admin está en deps del SDK)\n                const {default: admin} = await import(\"firebase-admin\");\n                const firebaseDecoded = await admin.auth().verifyIdToken(token);\n\n                if (firebaseDecoded.email && firebaseDecoded.email_verified === false) {\n                    return res.status(401).json({\n                        ok: false,\n                        code: \"AUTH_EMAIL_NOT_VERIFIED\",\n                        message: \"Email not verified\",\n                    });\n                }\n\n                req.auth = {\n                    tokenType: \"backend\",\n                    subject,\n                    firebase: firebaseDecoded,\n                    company_uid: company_uid ?? undefined,\n                    branch_uid: branch_uid ?? undefined,\n                    companies: [],\n                    roles: [],\n                    permissions: [],\n                    denied_permissions: [],\n                };\n\n                return next();\n            } catch {\n                return res.status(401).json({\n                    ok: false,\n                    code: \"AUTH_INVALID_TOKEN\",\n                    message: \"Invalid or expired token\",\n                });\n            }\n        }\n    };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,gBAAe;AACf,0BAA8B;AAE9B,SAAS,iBAAiB,MAA8B;AACpD,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACA,UAAM,IAAI,UAAAA,QAAG,aAAa,MAAM,MAAM,EAAE,KAAK;AAC7C,WAAO,EAAE,SAAS,IAAI;AAAA,EAC1B,QAAQ;AACJ,WAAO;AAAA,EACX;AACJ;AAOO,SAAS,qBAA6B;AACzC,QAAM,WAAW,iBAAiB,QAAQ,IAAI,mBAAmB;AACjE,MAAI,SAAU,QAAO;AAErB,QAAM,UAAU,OAAO,QAAQ,IAAI,uBAAuB,QAAQ,IAAI,uBAAuB,EAAE,EAC1F,QAAQ,QAAQ,IAAI,EACpB,KAAK;AAEV,MAAI,QAAS,QAAO;AAEpB,QAAM,IAAI,MAAM,4FAA4F;AAChH;AAEO,SAAS,sBAAsB,KAAyB;AAC3D,QAAM,YAAY,mBAAmB;AAErC,QAAM,WAAW,QAAQ,IAAI,gBAAgB,QAAQ,IAAI,qBAAqB;AAC9E,QAAM,SAAS,QAAQ,IAAI,cAAc,QAAQ,IAAI,mBAAmB;AAGxE,SAAO,oBAAAC,QAAI,OAAO,KAAK,WAAW;AAAA,IAC9B,YAAY,CAAC,OAAO;AAAA,IACpB;AAAA,IACA;AAAA,EACJ,CAAC;AACL;;;ACvCA,SAAS,eAAe,KAAyB;AAC7C,QAAM,OAAO,OAAO,IAAI,SAAS,iBAAiB,EAAE;AACpD,MAAI,CAAC,KAAK,WAAW,SAAS,EAAG,QAAO;AACxC,QAAM,QAAQ,KAAK,MAAM,CAAC,EAAE,KAAK;AACjC,SAAO,MAAM,SAAS,QAAQ;AAClC;AAEA,SAAS,aAAa,GAAuB;AACzC,QAAM,IAAI,OAAO,KAAK,EAAE,EAAE,KAAK;AAC/B,SAAO,EAAE,SAAS,IAAI;AAC1B;AASO,SAAS,qBAAqB,MAA6B;AAC9D,QAAM;AAAA,IACF;AAAA,IACA,uBAAuB;AAAA,IACvB,iBAAiB;AAAA,IACjB;AAAA,EACJ,IAAI;AAEJ,SAAO,OAAO,KAAU,KAAe,SAAuB;AAC1D,UAAM,QAAQ,eAAe,GAAG;AAChC,QAAI,CAAC,OAAO;AACR,aAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,QACxB,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,SAAS;AAAA,MACb,CAAC;AAAA,IACL;AAGA,UAAM,YAAa,IAAY,WAAW,CAAC;AAC3C,UAAM,cAAc,aAAa,UAAU,WAAW;AACtD,UAAM,aAAa,aAAa,UAAU,UAAU;AAGpD,QAAI;AACA,YAAM,UAAe,sBAAsB,KAAK;AAEhD,YAAM,UAAuB;AAAA,QACzB,WAAW;AAAA,QACX;AAAA,QACA,aAAa,eAAe;AAAA,QAC5B,YAAY,cAAc;AAAA,QAC1B,OAAO,MAAM,QAAQ,SAAS,KAAK,IAAI,QAAQ,QAAQ,CAAC;AAAA,QACxD,aAAa,MAAM,QAAQ,SAAS,WAAW,IAAI,QAAQ,cAAc,CAAC;AAAA,QAC1E,oBAAoB,MAAM,QAAQ,SAAS,kBAAkB,IAAI,QAAQ,qBAAqB,CAAC;AAAA,QAC/F,SAAS;AAAA,UACL,KAAK,SAAS;AAAA,UACd,WAAW,SAAS;AAAA,UACpB,YAAY,SAAS;AAAA,QACzB;AAAA,MACJ;AAGA,YAAM,WAAW,MAAM,QAAQ,EAAC,SAAS,KAAK,SAAS,aAAa,WAAU,CAAC;AAC/E,aAAO,OAAO,SAAS,QAAQ;AAE/B,UAAI,gBAAgB;AAChB,YAAI,YAAY,cAAc,CAAC,QAAQ,UAAU;AAC7C,iBAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,YACxB,IAAI;AAAA,YACJ,MAAM;AAAA,YACN,SAAS;AAAA,UACb,CAAC;AAAA,QACL;AACA,YAAI,YAAY,cAAc,CAAC,QAAQ,UAAU;AAC7C,iBAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,YACxB,IAAI;AAAA,YACJ,MAAM;AAAA,YACN,SAAS;AAAA,UACb,CAAC;AAAA,QACL;AAAA,MACJ;AAEA,UAAI,OAAO;AACX,aAAO,KAAK;AAAA,IAChB,SAAS,QAAQ;AAEb,UAAI,CAAC,sBAAsB;AACvB,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UACxB,IAAI;AAAA,UACJ,MAAM;AAAA,UACN,SAAS;AAAA,QACb,CAAC;AAAA,MACL;AAEA,UAAI;AAEA,cAAM,EAAC,SAAS,MAAK,IAAI,MAAM,OAAO,gBAAgB;AACtD,cAAM,kBAAkB,MAAM,MAAM,KAAK,EAAE,cAAc,KAAK;AAE9D,YAAI,gBAAgB,SAAS,gBAAgB,mBAAmB,OAAO;AACnE,iBAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,YACxB,IAAI;AAAA,YACJ,MAAM;AAAA,YACN,SAAS;AAAA,UACb,CAAC;AAAA,QACL;AAEA,YAAI,OAAO;AAAA,UACP,WAAW;AAAA,UACX;AAAA,UACA,UAAU;AAAA,UACV,aAAa,eAAe;AAAA,UAC5B,YAAY,cAAc;AAAA,UAC1B,WAAW,CAAC;AAAA,UACZ,OAAO,CAAC;AAAA,UACR,aAAa,CAAC;AAAA,UACd,oBAAoB,CAAC;AAAA,QACzB;AAEA,eAAO,KAAK;AAAA,MAChB,QAAQ;AACJ,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UACxB,IAAI;AAAA,UACJ,MAAM;AAAA,UACN,SAAS;AAAA,QACb,CAAC;AAAA,MACL;AAAA,IACJ;AAAA,EACJ;AACJ;","names":["fs","jwt"]}

package/dist/auth/index.d.cts

@@ -0,0 +1,3 @@
+export { A as AuthContext, a as AuthMiddlewareOptions, b as AuthSession, c as AuthSubject, H as HydrateInput, d as HydrateResult, e as Hydrator, T as TokenType, f as createAuthMiddleware, r as readRs256PublicKey, v as verifyBackendJwtRS256 } from '../index-WbfzvmOt.cjs';
+import 'express';
+import 'jsonwebtoken';

package/dist/auth/index.d.ts

@@ -0,0 +1,3 @@
+export { A as AuthContext, a as AuthMiddlewareOptions, b as AuthSession, c as AuthSubject, H as HydrateInput, d as HydrateResult, e as Hydrator, T as TokenType, f as createAuthMiddleware, r as readRs256PublicKey, v as verifyBackendJwtRS256 } from '../index-WbfzvmOt.js';
+import 'express';
+import 'jsonwebtoken';

package/dist/auth/index.js

@@ -0,0 +1,12 @@
+import {
+  createAuthMiddleware,
+  readRs256PublicKey,
+  verifyBackendJwtRS256
+} from "../chunk-W23UYULS.js";
+import "../chunk-PZ5AY32C.js";
+export {
+  createAuthMiddleware,
+  readRs256PublicKey,
+  verifyBackendJwtRS256
+};
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/cache/index.js

@@ -4,6 +4,7 @@ import {
   getOrSet,
   getTwoLevelCache
 } from "../chunk-IYFWQDHD.js";
+import "../chunk-PZ5AY32C.js";
 export {
   TwoLevelCache,
   closeCache,

package/dist/chunk-PZ5AY32C.js

@@ -0,0 +1,10 @@
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+export {
+  __export
+};
+//# sourceMappingURL=chunk-PZ5AY32C.js.map

package/dist/chunk-PZ5AY32C.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/chunk-W23UYULS.js

@@ -0,0 +1,156 @@
+import {
+  __export
+} from "./chunk-PZ5AY32C.js";
+
+// src/auth/index.ts
+var auth_exports = {};
+__export(auth_exports, {
+  createAuthMiddleware: () => createAuthMiddleware,
+  readRs256PublicKey: () => readRs256PublicKey,
+  verifyBackendJwtRS256: () => verifyBackendJwtRS256
+});
+
+// src/auth/jwt.ts
+import fs from "fs";
+import jwt from "jsonwebtoken";
+function readFileIfExists(path) {
+  if (!path) return null;
+  try {
+    const v = fs.readFileSync(path, "utf8").trim();
+    return v.length ? v : null;
+  } catch {
+    return null;
+  }
+}
+function readRs256PublicKey() {
+  const fromFile = readFileIfExists(process.env.JWT_PUBLIC_KEY_PATH);
+  if (fromFile) return fromFile;
+  const fromEnv = String(process.env.AUTH_JWT_PUBLIC_KEY || process.env.AUTH_RSA_PUBLIC_KEY || "").replace(/\\n/g, "\n").trim();
+  if (fromEnv) return fromEnv;
+  throw new Error("Missing RS256 public key (JWT_PUBLIC_KEY_PATH / AUTH_JWT_PUBLIC_KEY / AUTH_RSA_PUBLIC_KEY)");
+}
+function verifyBackendJwtRS256(raw) {
+  const publicKey = readRs256PublicKey();
+  const audience = process.env.JWT_AUDIENCE || process.env.AUTH_JWT_AUDIENCE || "getmarket.api";
+  const issuer = process.env.JWT_ISSUER || process.env.AUTH_JWT_ISSUER || "getmarket-auth";
+  return jwt.verify(raw, publicKey, {
+    algorithms: ["RS256"],
+    audience,
+    issuer
+  });
+}
+
+// src/auth/middleware.ts
+function getBearerToken(req) {
+  const auth = String(req.headers?.authorization || "");
+  if (!auth.startsWith("Bearer ")) return null;
+  const token = auth.slice(7).trim();
+  return token.length ? token : null;
+}
+function normalizeUid(v) {
+  const s = String(v ?? "").trim();
+  return s.length ? s : null;
+}
+function createAuthMiddleware(opts) {
+  const {
+    subject,
+    allowFirebaseIdToken = false,
+    requireSubject = true,
+    hydrate
+  } = opts;
+  return async (req, res, next) => {
+    const token = getBearerToken(req);
+    if (!token) {
+      return res.status(401).json({
+        ok: false,
+        code: "AUTH_MISSING_TOKEN",
+        message: "Missing Authorization Bearer token"
+      });
+    }
+    const headerCtx = req.context || {};
+    const company_uid = normalizeUid(headerCtx.company_uid);
+    const branch_uid = normalizeUid(headerCtx.branch_uid);
+    try {
+      const decoded = verifyBackendJwtRS256(token);
+      const baseCtx = {
+        tokenType: "backend",
+        subject,
+        company_uid: company_uid ?? void 0,
+        branch_uid: branch_uid ?? void 0,
+        roles: Array.isArray(decoded?.roles) ? decoded.roles : [],
+        permissions: Array.isArray(decoded?.permissions) ? decoded.permissions : [],
+        denied_permissions: Array.isArray(decoded?.denied_permissions) ? decoded.denied_permissions : [],
+        session: {
+          jti: decoded?.jti,
+          device_id: decoded?.device_id,
+          expires_at: decoded?.exp
+        }
+      };
+      const hydrated = await hydrate({ decoded, req, subject, company_uid, branch_uid });
+      Object.assign(baseCtx, hydrated);
+      if (requireSubject) {
+        if (subject === "employee" && !baseCtx.employee) {
+          return res.status(401).json({
+            ok: false,
+            code: "AUTH_EMPLOYEE_NOT_FOUND",
+            message: "Employee not resolved by hydrator"
+          });
+        }
+        if (subject === "customer" && !baseCtx.customer) {
+          return res.status(401).json({
+            ok: false,
+            code: "AUTH_CUSTOMER_NOT_FOUND",
+            message: "Customer not resolved by hydrator"
+          });
+        }
+      }
+      req.auth = baseCtx;
+      return next();
+    } catch (errJwt) {
+      if (!allowFirebaseIdToken) {
+        return res.status(401).json({
+          ok: false,
+          code: "AUTH_INVALID_TOKEN",
+          message: "Invalid or expired token"
+        });
+      }
+      try {
+        const { default: admin } = await import("firebase-admin");
+        const firebaseDecoded = await admin.auth().verifyIdToken(token);
+        if (firebaseDecoded.email && firebaseDecoded.email_verified === false) {
+          return res.status(401).json({
+            ok: false,
+            code: "AUTH_EMAIL_NOT_VERIFIED",
+            message: "Email not verified"
+          });
+        }
+        req.auth = {
+          tokenType: "backend",
+          subject,
+          firebase: firebaseDecoded,
+          company_uid: company_uid ?? void 0,
+          branch_uid: branch_uid ?? void 0,
+          companies: [],
+          roles: [],
+          permissions: [],
+          denied_permissions: []
+        };
+        return next();
+      } catch {
+        return res.status(401).json({
+          ok: false,
+          code: "AUTH_INVALID_TOKEN",
+          message: "Invalid or expired token"
+        });
+      }
+    }
+  };
+}
+
+export {
+  readRs256PublicKey,
+  verifyBackendJwtRS256,
+  createAuthMiddleware,
+  auth_exports
+};
+//# sourceMappingURL=chunk-W23UYULS.js.map

package/dist/chunk-W23UYULS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/auth/index.ts","../src/auth/jwt.ts","../src/auth/middleware.ts"],"sourcesContent":["export * from \"./types\";\nexport * from \"./jwt\";\nexport * from \"./middleware\";\n","import fs from \"fs\";\nimport jwt, {JwtPayload} from \"jsonwebtoken\";\n\nfunction readFileIfExists(path?: string): string | null {\n    if (!path) return null;\n    try {\n        const v = fs.readFileSync(path, \"utf8\").trim();\n        return v.length ? v : null;\n    } catch {\n        return null;\n    }\n}\n\n/**\n * ✅ Keys viven en getmarket-stack:\n * - JWT_PUBLIC_KEY_PATH=/run/secrets/jwtRS256.key.pub (recomendado)\n * - fallback env AUTH_JWT_PUBLIC_KEY / AUTH_RSA_PUBLIC_KEY\n */\nexport function readRs256PublicKey(): string {\n    const fromFile = readFileIfExists(process.env.JWT_PUBLIC_KEY_PATH);\n    if (fromFile) return fromFile;\n\n    const fromEnv = String(process.env.AUTH_JWT_PUBLIC_KEY || process.env.AUTH_RSA_PUBLIC_KEY || \"\")\n        .replace(/\\\\n/g, \"\\n\")\n        .trim();\n\n    if (fromEnv) return fromEnv;\n\n    throw new Error(\"Missing RS256 public key (JWT_PUBLIC_KEY_PATH / AUTH_JWT_PUBLIC_KEY / AUTH_RSA_PUBLIC_KEY)\");\n}\n\nexport function verifyBackendJwtRS256(raw: string): JwtPayload {\n    const publicKey = readRs256PublicKey();\n\n    const audience = process.env.JWT_AUDIENCE || process.env.AUTH_JWT_AUDIENCE || \"getmarket.api\";\n    const issuer = process.env.JWT_ISSUER || process.env.AUTH_JWT_ISSUER || \"getmarket-auth\";\n\n    // ✅ SOLO RS256\n    return jwt.verify(raw, publicKey, {\n        algorithms: [\"RS256\"],\n        audience,\n        issuer,\n    }) as JwtPayload;\n}\n","import type {NextFunction, Response} from \"express\";\nimport {verifyBackendJwtRS256} from \"./jwt\";\nimport type {AuthContext, AuthMiddlewareOptions} from \"./types\";\n\nfunction getBearerToken(req: any): string | null {\n    const auth = String(req.headers?.authorization || \"\");\n    if (!auth.startsWith(\"Bearer \")) return null;\n    const token = auth.slice(7).trim();\n    return token.length ? token : null;\n}\n\nfunction normalizeUid(v: any): string | null {\n    const s = String(v ?? \"\").trim();\n    return s.length ? s : null;\n}\n\n/**\n * ✅ Middleware estándar:\n * - Solo Authorization: Bearer\n * - Solo RS256\n * - Cero legacy\n * - Hidrata vía hook (OBLIGATORIO) para que cada micro no replique lógica\n */\nexport function createAuthMiddleware(opts: AuthMiddlewareOptions) {\n    const {\n        subject,\n        allowFirebaseIdToken = false,\n        requireSubject = true,\n        hydrate,\n    } = opts;\n\n    return async (req: any, res: Response, next: NextFunction) => {\n        const token = getBearerToken(req);\n        if (!token) {\n            return res.status(401).json({\n                ok: false,\n                code: \"AUTH_MISSING_TOKEN\",\n                message: \"Missing Authorization Bearer token\",\n            });\n        }\n\n        // Contexto desde parseHeaders (SDK) -> req.context\n        const headerCtx = (req as any).context || {};\n        const company_uid = normalizeUid(headerCtx.company_uid);\n        const branch_uid = normalizeUid(headerCtx.branch_uid);\n\n        // 1) RS256 backend JWT\n        try {\n            const decoded: any = verifyBackendJwtRS256(token);\n\n            const baseCtx: AuthContext = {\n                tokenType: \"backend\",\n                subject,\n                company_uid: company_uid ?? undefined,\n                branch_uid: branch_uid ?? undefined,\n                roles: Array.isArray(decoded?.roles) ? decoded.roles : [],\n                permissions: Array.isArray(decoded?.permissions) ? decoded.permissions : [],\n                denied_permissions: Array.isArray(decoded?.denied_permissions) ? decoded.denied_permissions : [],\n                session: {\n                    jti: decoded?.jti,\n                    device_id: decoded?.device_id,\n                    expires_at: decoded?.exp,\n                },\n            };\n\n            // ✅ hydrate obligatorio (cero legacy)\n            const hydrated = await hydrate({decoded, req, subject, company_uid, branch_uid});\n            Object.assign(baseCtx, hydrated);\n\n            if (requireSubject) {\n                if (subject === \"employee\" && !baseCtx.employee) {\n                    return res.status(401).json({\n                        ok: false,\n                        code: \"AUTH_EMPLOYEE_NOT_FOUND\",\n                        message: \"Employee not resolved by hydrator\",\n                    });\n                }\n                if (subject === \"customer\" && !baseCtx.customer) {\n                    return res.status(401).json({\n                        ok: false,\n                        code: \"AUTH_CUSTOMER_NOT_FOUND\",\n                        message: \"Customer not resolved by hydrator\",\n                    });\n                }\n            }\n\n            req.auth = baseCtx;\n            return next();\n        } catch (errJwt) {\n            // 2) Firebase opcional (si está habilitado explícitamente)\n            if (!allowFirebaseIdToken) {\n                return res.status(401).json({\n                    ok: false,\n                    code: \"AUTH_INVALID_TOKEN\",\n                    message: \"Invalid or expired token\",\n                });\n            }\n\n            try {\n                // Import dinámico (pero firebase-admin está en deps del SDK)\n                const {default: admin} = await import(\"firebase-admin\");\n                const firebaseDecoded = await admin.auth().verifyIdToken(token);\n\n                if (firebaseDecoded.email && firebaseDecoded.email_verified === false) {\n                    return res.status(401).json({\n                        ok: false,\n                        code: \"AUTH_EMAIL_NOT_VERIFIED\",\n                        message: \"Email not verified\",\n                    });\n                }\n\n                req.auth = {\n                    tokenType: \"backend\",\n                    subject,\n                    firebase: firebaseDecoded,\n                    company_uid: company_uid ?? undefined,\n                    branch_uid: branch_uid ?? undefined,\n                    companies: [],\n                    roles: [],\n                    permissions: [],\n                    denied_permissions: [],\n                };\n\n                return next();\n            } catch {\n                return res.status(401).json({\n                    ok: false,\n                    code: \"AUTH_INVALID_TOKEN\",\n                    message: \"Invalid or expired token\",\n                });\n            }\n        }\n    };\n}\n"],"mappings":";;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,OAAO,QAAQ;AACf,OAAO,SAAuB;AAE9B,SAAS,iBAAiB,MAA8B;AACpD,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACA,UAAM,IAAI,GAAG,aAAa,MAAM,MAAM,EAAE,KAAK;AAC7C,WAAO,EAAE,SAAS,IAAI;AAAA,EAC1B,QAAQ;AACJ,WAAO;AAAA,EACX;AACJ;AAOO,SAAS,qBAA6B;AACzC,QAAM,WAAW,iBAAiB,QAAQ,IAAI,mBAAmB;AACjE,MAAI,SAAU,QAAO;AAErB,QAAM,UAAU,OAAO,QAAQ,IAAI,uBAAuB,QAAQ,IAAI,uBAAuB,EAAE,EAC1F,QAAQ,QAAQ,IAAI,EACpB,KAAK;AAEV,MAAI,QAAS,QAAO;AAEpB,QAAM,IAAI,MAAM,4FAA4F;AAChH;AAEO,SAAS,sBAAsB,KAAyB;AAC3D,QAAM,YAAY,mBAAmB;AAErC,QAAM,WAAW,QAAQ,IAAI,gBAAgB,QAAQ,IAAI,qBAAqB;AAC9E,QAAM,SAAS,QAAQ,IAAI,cAAc,QAAQ,IAAI,mBAAmB;AAGxE,SAAO,IAAI,OAAO,KAAK,WAAW;AAAA,IAC9B,YAAY,CAAC,OAAO;AAAA,IACpB;AAAA,IACA;AAAA,EACJ,CAAC;AACL;;;ACvCA,SAAS,eAAe,KAAyB;AAC7C,QAAM,OAAO,OAAO,IAAI,SAAS,iBAAiB,EAAE;AACpD,MAAI,CAAC,KAAK,WAAW,SAAS,EAAG,QAAO;AACxC,QAAM,QAAQ,KAAK,MAAM,CAAC,EAAE,KAAK;AACjC,SAAO,MAAM,SAAS,QAAQ;AAClC;AAEA,SAAS,aAAa,GAAuB;AACzC,QAAM,IAAI,OAAO,KAAK,EAAE,EAAE,KAAK;AAC/B,SAAO,EAAE,SAAS,IAAI;AAC1B;AASO,SAAS,qBAAqB,MAA6B;AAC9D,QAAM;AAAA,IACF;AAAA,IACA,uBAAuB;AAAA,IACvB,iBAAiB;AAAA,IACjB;AAAA,EACJ,IAAI;AAEJ,SAAO,OAAO,KAAU,KAAe,SAAuB;AAC1D,UAAM,QAAQ,eAAe,GAAG;AAChC,QAAI,CAAC,OAAO;AACR,aAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,QACxB,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,SAAS;AAAA,MACb,CAAC;AAAA,IACL;AAGA,UAAM,YAAa,IAAY,WAAW,CAAC;AAC3C,UAAM,cAAc,aAAa,UAAU,WAAW;AACtD,UAAM,aAAa,aAAa,UAAU,UAAU;AAGpD,QAAI;AACA,YAAM,UAAe,sBAAsB,KAAK;AAEhD,YAAM,UAAuB;AAAA,QACzB,WAAW;AAAA,QACX;AAAA,QACA,aAAa,eAAe;AAAA,QAC5B,YAAY,cAAc;AAAA,QAC1B,OAAO,MAAM,QAAQ,SAAS,KAAK,IAAI,QAAQ,QAAQ,CAAC;AAAA,QACxD,aAAa,MAAM,QAAQ,SAAS,WAAW,IAAI,QAAQ,cAAc,CAAC;AAAA,QAC1E,oBAAoB,MAAM,QAAQ,SAAS,kBAAkB,IAAI,QAAQ,qBAAqB,CAAC;AAAA,QAC/F,SAAS;AAAA,UACL,KAAK,SAAS;AAAA,UACd,WAAW,SAAS;AAAA,UACpB,YAAY,SAAS;AAAA,QACzB;AAAA,MACJ;AAGA,YAAM,WAAW,MAAM,QAAQ,EAAC,SAAS,KAAK,SAAS,aAAa,WAAU,CAAC;AAC/E,aAAO,OAAO,SAAS,QAAQ;AAE/B,UAAI,gBAAgB;AAChB,YAAI,YAAY,cAAc,CAAC,QAAQ,UAAU;AAC7C,iBAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,YACxB,IAAI;AAAA,YACJ,MAAM;AAAA,YACN,SAAS;AAAA,UACb,CAAC;AAAA,QACL;AACA,YAAI,YAAY,cAAc,CAAC,QAAQ,UAAU;AAC7C,iBAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,YACxB,IAAI;AAAA,YACJ,MAAM;AAAA,YACN,SAAS;AAAA,UACb,CAAC;AAAA,QACL;AAAA,MACJ;AAEA,UAAI,OAAO;AACX,aAAO,KAAK;AAAA,IAChB,SAAS,QAAQ;AAEb,UAAI,CAAC,sBAAsB;AACvB,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UACxB,IAAI;AAAA,UACJ,MAAM;AAAA,UACN,SAAS;AAAA,QACb,CAAC;AAAA,MACL;AAEA,UAAI;AAEA,cAAM,EAAC,SAAS,MAAK,IAAI,MAAM,OAAO,gBAAgB;AACtD,cAAM,kBAAkB,MAAM,MAAM,KAAK,EAAE,cAAc,KAAK;AAE9D,YAAI,gBAAgB,SAAS,gBAAgB,mBAAmB,OAAO;AACnE,iBAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,YACxB,IAAI;AAAA,YACJ,MAAM;AAAA,YACN,SAAS;AAAA,UACb,CAAC;AAAA,QACL;AAEA,YAAI,OAAO;AAAA,UACP,WAAW;AAAA,UACX;AAAA,UACA,UAAU;AAAA,UACV,aAAa,eAAe;AAAA,UAC5B,YAAY,cAAc;AAAA,UAC1B,WAAW,CAAC;AAAA,UACZ,OAAO,CAAC;AAAA,UACR,aAAa,CAAC;AAAA,UACd,oBAAoB,CAAC;AAAA,QACzB;AAEA,eAAO,KAAK;AAAA,MAChB,QAAQ;AACJ,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UACxB,IAAI;AAAA,UACJ,MAAM;AAAA,UACN,SAAS;AAAA,QACb,CAAC;AAAA,MACL;AAAA,IACJ;AAAA,EACJ;AACJ;","names":[]}

package/dist/{chunk-HTHX24NK.js → chunk-Y2JJLHAY.js}

@@ -96,11 +96,54 @@ function internalAuth(req, res, next) {
   return next();
 }
 
+// src/middlewares/autorization.ts
+function getAuth(req) {
+  return req.auth ?? {};
+}
+function requireAuthContext() {
+  return (req, res, next) => {
+    if (!req.auth) {
+      return sendError(req, res, 401, "UNAUTHORIZED", "Missing auth context");
+    }
+    return next();
+  };
+}
+function requirePermissions(...perms) {
+  return (req, res, next) => {
+    const auth = getAuth(req);
+    const allow = new Set(auth.permissions ?? []);
+    const deny = new Set(auth.denied_permissions ?? []);
+    for (const p of perms) {
+      if (deny.has(p)) {
+        return sendError(req, res, 403, "FORBIDDEN", `Denied: ${p}`);
+      }
+    }
+    const missing = perms.filter((p) => !allow.has(p));
+    if (missing.length) {
+      return sendError(req, res, 403, "FORBIDDEN", "Missing permissions", { missing });
+    }
+    return next();
+  };
+}
+function requireRoles(...roles) {
+  return (req, res, next) => {
+    const auth = getAuth(req);
+    const have = new Set(auth.roles ?? []);
+    if (!roles.some((r) => have.has(r))) {
+      return sendError(req, res, 403, "FORBIDDEN", "Role not allowed", { required: roles });
+    }
+    return next();
+  };
+}
+
 export {
   requestId,
   parseHeaders,
   sendOk,
   sendError,
-  internalAuth
+  internalAuth,
+  requireAuthContext,
+  requirePermissions,
+  requireRoles
 };
-//# sourceMappingURL=chunk-HTHX24NK.js.map
+//# sourceMappingURL=chunk-Y2JJLHAY.js.map

package/dist/chunk-Y2JJLHAY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/middlewares/requestId.ts","../src/middlewares/parseHeaders.ts","../src/middlewares/internalAuth.ts","../src/middlewares/respond.ts","../src/middlewares/autorization.ts"],"sourcesContent":["// middlewares/requestId.ts\nimport type {Request, Response, NextFunction} from \"express\";\nimport {randomUUID, randomBytes} from \"crypto\";\n\nexport const REQUEST_ID_HEADER = \"x-request-id\";\nexport const REQUEST_ID_HEADER_ALT = \"x-requestid\";\nexport const RESPONSE_REQUEST_ID_HEADER = \"X-Request-Id\";\n\n// Si quieres IDs más cortos (opcional). Por defecto usamos UUID.\nfunction nanoidLike(len = 21) {\n    return randomBytes(16).toString(\"base64url\").slice(0, len);\n}\n\nexport default function requestId(req: Request, res: Response, next: NextFunction) {\n    const headerId = (req.headers[REQUEST_ID_HEADER] || req.headers[REQUEST_ID_HEADER_ALT]) as\n        | string\n        | undefined;\n\n    // ✅ estándar único: usa UUID (o cambia a nanoidLike() si prefieres corto)\n    const id = headerId?.trim() || randomUUID();\n\n    // ✅ estándar único (no legacy)\n    (req as any).requestId = id;\n    res.locals.requestId = id;\n\n    // ✅ respuesta\n    res.setHeader(RESPONSE_REQUEST_ID_HEADER, id);\n\n    next();\n}\n","import type {Request, Response, NextFunction} from \"express\";\nimport {getRequestContextFromHeaders} from \"../headers\";\n\n/**\n * ✅ NO-LEGACY:\n * - solo setea UIDs\n * - no crea objetos company/branch\n * - no copia provider\n */\nexport default function parseHeaders(req: Request, _res: Response, next: NextFunction) {\n    const context = getRequestContextFromHeaders(req.headers as any);\n\n    (req as any).context = context;\n\n    const auth: any = (req as any).auth ?? ((req as any).auth = {});\n    if (context.company_uid) auth.company_uid = context.company_uid;\n    if (context.branch_uid) auth.branch_uid = context.branch_uid;\n    if (context.employee_uid) auth.employee_uid = context.employee_uid;\n\n    next();\n}\n","import type {Request, Response, NextFunction} from \"express\";\nimport fs from \"fs\";\nimport crypto from \"crypto\";\nimport {sendError} from \"./respond\";\nimport {HEADER_INTERNAL_API_KEY} from \"../headers\";\n\nfunction readSecretFile(path?: string): string | null {\n    if (!path) return null;\n    try {\n        const v = fs.readFileSync(path, \"utf8\").trim();\n        return v.length ? v : null;\n    } catch {\n        return null;\n    }\n}\n\nfunction splitKeys(v?: string | null): string[] {\n    if (!v) return [];\n    return v.split(\",\").map((s) => s.trim()).filter(Boolean);\n}\n\nfunction getExpectedKeys(): string[] {\n    const fileKey = readSecretFile(process.env.INTERNAL_API_KEY_FILE);\n    const envKey = (process.env.INTERNAL_API_KEY || \"\").trim();\n    const raw = fileKey || envKey;\n    return splitKeys(raw);\n}\n\nfunction extractToken(req: Request): string | null {\n    const apiKey = (req.header(HEADER_INTERNAL_API_KEY) || \"\").trim();\n    return apiKey || null;\n}\n\nfunction safeEquals(a: string, b: string): boolean {\n    const aa = Buffer.from(a);\n    const bb = Buffer.from(b);\n    if (aa.length !== bb.length) return false;\n    return crypto.timingSafeEqual(aa, bb);\n}\n\nexport default function internalAuth(req: Request, res: Response, next: NextFunction) {\n    const token = extractToken(req);\n\n    if (!token) {\n        return sendError(req, res, 401, \"UNAUTHORIZED\", `Missing internal api key (${HEADER_INTERNAL_API_KEY})`);\n    }\n\n    const expectedKeys = getExpectedKeys();\n    if (expectedKeys.length === 0) {\n        return sendError(\n            req,\n            res,\n            500,\n            \"MISCONFIGURED_INTERNAL_AUTH\",\n            \"Internal api key not configured (INTERNAL_API_KEY or INTERNAL_API_KEY_FILE)\"\n        );\n    }\n\n    const ok = expectedKeys.some((k) => safeEquals(token, k));\n    if (!ok) {\n        return sendError(req, res, 403, \"FORBIDDEN\", \"Invalid internal api key\");\n    }\n\n    return next();\n}\n","import type {Request, Response} from \"express\";\n\nexport function sendOk<T>(_req: Request, res: Response, data: T, statusCode = 200) {\n    return res.status(statusCode).json({ok: true, data, requestId: res.locals?.requestId ?? null});\n}\n\nexport function sendError(\n    _req: Request,\n    res: Response,\n    statusCode: number,\n    code: string,\n    message: string,\n    details?: any\n) {\n    return res.status(statusCode).json({\n        ok: false,\n        error: {code, message, ...(details !== undefined ? {details} : {})},\n        requestId: res.locals?.requestId ?? null,\n    });\n}\n","// packages/sdk/src/middlewares/authorization.ts\nimport type {Request, Response, NextFunction} from \"express\";\nimport {sendError} from \"./respond\";\n\ntype AuthShape = {\n    roles?: string[];\n    permissions?: string[];\n    denied_permissions?: string[];\n};\n\nfunction getAuth(req: Request): AuthShape {\n    return ((req as any).auth ?? {}) as AuthShape;\n}\n\n/**\n * 401 si no existe req.auth (contexto auth).\n * Útil para proteger rutas internas donde SIEMPRE debe existir auth.\n */\nexport function requireAuthContext() {\n    return (req: Request, res: Response, next: NextFunction) => {\n        if (!(req as any).auth) {\n            return sendError(req, res, 401, \"UNAUTHORIZED\", \"Missing auth context\");\n        }\n        return next();\n    };\n}\n\n/**\n * Requiere TODOS los permisos indicados.\n * Regla: denied_permissions siempre gana sobre permissions.\n */\nexport function requirePermissions(...perms: string[]) {\n    return (req: Request, res: Response, next: NextFunction) => {\n        const auth = getAuth(req);\n\n        const allow = new Set<string>(auth.permissions ?? []);\n        const deny = new Set<string>(auth.denied_permissions ?? []);\n\n        // deny gana siempre\n        for (const p of perms) {\n            if (deny.has(p)) {\n                return sendError(req, res, 403, \"FORBIDDEN\", `Denied: ${p}`);\n            }\n        }\n\n        const missing = perms.filter((p) => !allow.has(p));\n        if (missing.length) {\n            return sendError(req, res, 403, \"FORBIDDEN\", \"Missing permissions\", {missing});\n        }\n\n        return next();\n    };\n}\n\n/**\n * Requiere al menos 1 de los roles indicados.\n */\nexport function requireRoles(...roles: string[]) {\n    return (req: Request, res: Response, next: NextFunction) => {\n        const auth = getAuth(req);\n        const have = new Set<string>(auth.roles ?? []);\n\n        if (!roles.some((r) => have.has(r))) {\n            return sendError(req, res, 403, \"FORBIDDEN\", \"Role not allowed\", {required: roles});\n        }\n\n        return next();\n    };\n}\n"],"mappings":";;;;;;AAEA,SAAQ,YAAY,mBAAkB;AAE/B,IAAM,oBAAoB;AAC1B,IAAM,wBAAwB;AAC9B,IAAM,6BAA6B;AAO3B,SAAR,UAA2B,KAAc,KAAe,MAAoB;AAC/E,QAAM,WAAY,IAAI,QAAQ,iBAAiB,KAAK,IAAI,QAAQ,qBAAqB;AAKrF,QAAM,KAAK,UAAU,KAAK,KAAK,WAAW;AAG1C,EAAC,IAAY,YAAY;AACzB,MAAI,OAAO,YAAY;AAGvB,MAAI,UAAU,4BAA4B,EAAE;AAE5C,OAAK;AACT;;;ACpBe,SAAR,aAA8B,KAAc,MAAgB,MAAoB;AACnF,QAAM,UAAU,6BAA6B,IAAI,OAAc;AAE/D,EAAC,IAAY,UAAU;AAEvB,QAAM,OAAa,IAAY,SAAU,IAAY,OAAO,CAAC;AAC7D,MAAI,QAAQ,YAAa,MAAK,cAAc,QAAQ;AACpD,MAAI,QAAQ,WAAY,MAAK,aAAa,QAAQ;AAClD,MAAI,QAAQ,aAAc,MAAK,eAAe,QAAQ;AAEtD,OAAK;AACT;;;ACnBA,OAAO,QAAQ;AACf,OAAO,YAAY;;;ACAZ,SAAS,OAAU,MAAe,KAAe,MAAS,aAAa,KAAK;AAC/E,SAAO,IAAI,OAAO,UAAU,EAAE,KAAK,EAAC,IAAI,MAAM,MAAM,WAAW,IAAI,QAAQ,aAAa,KAAI,CAAC;AACjG;AAEO,SAAS,UACZ,MACA,KACA,YACA,MACA,SACA,SACF;AACE,SAAO,IAAI,OAAO,UAAU,EAAE,KAAK;AAAA,IAC/B,IAAI;AAAA,IACJ,OAAO,EAAC,MAAM,SAAS,GAAI,YAAY,SAAY,EAAC,QAAO,IAAI,CAAC,EAAE;AAAA,IAClE,WAAW,IAAI,QAAQ,aAAa;AAAA,EACxC,CAAC;AACL;;;ADbA,SAAS,eAAe,MAA8B;AAClD,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACA,UAAM,IAAI,GAAG,aAAa,MAAM,MAAM,EAAE,KAAK;AAC7C,WAAO,EAAE,SAAS,IAAI;AAAA,EAC1B,QAAQ;AACJ,WAAO;AAAA,EACX;AACJ;AAEA,SAAS,UAAU,GAA6B;AAC5C,MAAI,CAAC,EAAG,QAAO,CAAC;AAChB,SAAO,EAAE,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO;AAC3D;AAEA,SAAS,kBAA4B;AACjC,QAAM,UAAU,eAAe,QAAQ,IAAI,qBAAqB;AAChE,QAAM,UAAU,QAAQ,IAAI,oBAAoB,IAAI,KAAK;AACzD,QAAM,MAAM,WAAW;AACvB,SAAO,UAAU,GAAG;AACxB;AAEA,SAAS,aAAa,KAA6B;AAC/C,QAAM,UAAU,IAAI,OAAO,uBAAuB,KAAK,IAAI,KAAK;AAChE,SAAO,UAAU;AACrB;AAEA,SAAS,WAAW,GAAW,GAAoB;AAC/C,QAAM,KAAK,OAAO,KAAK,CAAC;AACxB,QAAM,KAAK,OAAO,KAAK,CAAC;AACxB,MAAI,GAAG,WAAW,GAAG,OAAQ,QAAO;AACpC,SAAO,OAAO,gBAAgB,IAAI,EAAE;AACxC;AAEe,SAAR,aAA8B,KAAc,KAAe,MAAoB;AAClF,QAAM,QAAQ,aAAa,GAAG;AAE9B,MAAI,CAAC,OAAO;AACR,WAAO,UAAU,KAAK,KAAK,KAAK,gBAAgB,6BAA6B,uBAAuB,GAAG;AAAA,EAC3G;AAEA,QAAM,eAAe,gBAAgB;AACrC,MAAI,aAAa,WAAW,GAAG;AAC3B,WAAO;AAAA,MACH;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACJ;AAAA,EACJ;AAEA,QAAM,KAAK,aAAa,KAAK,CAAC,MAAM,WAAW,OAAO,CAAC,CAAC;AACxD,MAAI,CAAC,IAAI;AACL,WAAO,UAAU,KAAK,KAAK,KAAK,aAAa,0BAA0B;AAAA,EAC3E;AAEA,SAAO,KAAK;AAChB;;;AEtDA,SAAS,QAAQ,KAAyB;AACtC,SAAS,IAAY,QAAQ,CAAC;AAClC;AAMO,SAAS,qBAAqB;AACjC,SAAO,CAAC,KAAc,KAAe,SAAuB;AACxD,QAAI,CAAE,IAAY,MAAM;AACpB,aAAO,UAAU,KAAK,KAAK,KAAK,gBAAgB,sBAAsB;AAAA,IAC1E;AACA,WAAO,KAAK;AAAA,EAChB;AACJ;AAMO,SAAS,sBAAsB,OAAiB;AACnD,SAAO,CAAC,KAAc,KAAe,SAAuB;AACxD,UAAM,OAAO,QAAQ,GAAG;AAExB,UAAM,QAAQ,IAAI,IAAY,KAAK,eAAe,CAAC,CAAC;AACpD,UAAM,OAAO,IAAI,IAAY,KAAK,sBAAsB,CAAC,CAAC;AAG1D,eAAW,KAAK,OAAO;AACnB,UAAI,KAAK,IAAI,CAAC,GAAG;AACb,eAAO,UAAU,KAAK,KAAK,KAAK,aAAa,WAAW,CAAC,EAAE;AAAA,MAC/D;AAAA,IACJ;AAEA,UAAM,UAAU,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;AACjD,QAAI,QAAQ,QAAQ;AAChB,aAAO,UAAU,KAAK,KAAK,KAAK,aAAa,uBAAuB,EAAC,QAAO,CAAC;AAAA,IACjF;AAEA,WAAO,KAAK;AAAA,EAChB;AACJ;AAKO,SAAS,gBAAgB,OAAiB;AAC7C,SAAO,CAAC,KAAc,KAAe,SAAuB;AACxD,UAAM,OAAO,QAAQ,GAAG;AACxB,UAAM,OAAO,IAAI,IAAY,KAAK,SAAS,CAAC,CAAC;AAE7C,QAAI,CAAC,MAAM,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,GAAG;AACjC,aAAO,UAAU,KAAK,KAAK,KAAK,aAAa,oBAAoB,EAAC,UAAU,MAAK,CAAC;AAAA,IACtF;AAEA,WAAO,KAAK;AAAA,EAChB;AACJ;","names":[]}

package/dist/core/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/index.ts","../../src/core/errors.ts","../../src/core/http.ts","../../src/core/internalHttp.ts"],"sourcesContent":["export * from \"./errors\";\nexport * from \"./http\";\nexport * from \"./internalHttp\";\n","export type ClientErrorCode =\n    | \"UPSTREAM_TIMEOUT\"\n    | \"UPSTREAM_UNAVAILABLE\"\n    | \"UPSTREAM_BAD_RESPONSE\"\n    | \"UPSTREAM_NOT_FOUND\"\n    | \"UPSTREAM_UNAUTHORIZED\"\n    | \"UPSTREAM_FORBIDDEN\"\n    | \"UPSTREAM_UNKNOWN\";\n\nexport class UpstreamError extends Error {\n    public code: ClientErrorCode;\n    public status?: number;\n    public details?: any;\n\n    constructor(message: string, code: ClientErrorCode, status?: number, details?: any) {\n        super(message);\n        this.name = \"UpstreamError\";\n        this.code = code;\n        this.status = status;\n        this.details = details;\n    }\n}\n\nexport function mapAxiosToUpstreamError(err: any, svc: string): UpstreamError {\n    const status = err?.response?.status;\n    const data = err?.response?.data;\n    const isTimeout = err?.code === \"ECONNABORTED\" || String(err?.message || \"\").includes(\"timeout\");\n\n    if (isTimeout) {\n        return new UpstreamError(`[${svc}] timeout`, \"UPSTREAM_TIMEOUT\", 504, {cause: err?.message});\n    }\n    if (!err?.response) {\n        return new UpstreamError(`[${svc}] unavailable`, \"UPSTREAM_UNAVAILABLE\", 503, {cause: err?.message});\n    }\n    if (status === 404) return new UpstreamError(`[${svc}] not found`, \"UPSTREAM_NOT_FOUND\", 404, data);\n    if (status === 401) return new UpstreamError(`[${svc}] unauthorized`, \"UPSTREAM_UNAUTHORIZED\", 401, data);\n    if (status === 403) return new UpstreamError(`[${svc}] forbidden`, \"UPSTREAM_FORBIDDEN\", 403, data);\n    if (status >= 400 && status < 600) {\n        return new UpstreamError(`[${svc}] bad response`, \"UPSTREAM_BAD_RESPONSE\", status, data);\n    }\n    return new UpstreamError(`[${svc}] unknown error`, \"UPSTREAM_UNKNOWN\", status, data);\n}\n","// clients/core/http.ts\nimport axios, {AxiosInstance, AxiosRequestConfig} from \"axios\";\n\nexport const REQUEST_ID_HEADER = \"x-request-id\";\n\nexport type HttpClientOpts = {\n    baseURL: string;\n    timeoutMs?: number;\n};\n\n/**\n * Headers compatibles con múltiples versiones de axios.\n * En axios antiguo, `headers` suele ser `any`, así que mantenemos tolerancia.\n */\nexport type AnyHeaders = NonNullable<AxiosRequestConfig[\"headers\"]> | Record<string, string>;\n\n/**\n * Agrega x-request-id a headers (sin pisar otros headers).\n */\nexport function withRequestId(headers: AnyHeaders | undefined, requestId?: string | null): AnyHeaders {\n    const h: Record<string, any> =\n        headers && typeof headers === \"object\"\n            ? {...(headers as any)}\n            : {};\n\n    const rid = (requestId || \"\").trim();\n    if (rid) h[REQUEST_ID_HEADER] = rid;\n\n    return h as AnyHeaders;\n}\n\n/**\n * Helper para construir config de axios con requestId\n * (SIN genéricos para compat con axios typings antiguos).\n */\nexport function withRequestIdConfig(\n    config: AxiosRequestConfig = {},\n    requestId?: string | null\n): AxiosRequestConfig {\n    return {\n        ...config,\n        headers: withRequestId((config as any).headers, requestId) as any,\n    };\n}\n\nexport function createHttpClient(opts: HttpClientOpts): AxiosInstance {\n    return axios.create({\n        baseURL: opts.baseURL,\n        timeout: opts.timeoutMs ?? 4000,\n        headers: {\"Content-Type\": \"application/json\"},\n    });\n}\n","// clients/internalHttp.ts\n\ntype RetryPolicy = {\n    retries: number;\n    baseDelayMs: number;\n    retryOnStatuses: number[];\n    retryOnNetworkErrors: boolean;\n};\n\ntype InternalHttpOptions = {\n    baseUrl: string;\n    apiKey?: string; // x-internal-api-key\n    timeoutMs?: number;\n    retry?: Partial<RetryPolicy>;\n};\n\nconst DEFAULT_RETRY: RetryPolicy = {\n    retries: 1,\n    baseDelayMs: 150,\n    retryOnStatuses: [429, 502, 503, 504],\n    retryOnNetworkErrors: true,\n};\n\nfunction sleep(ms: number) {\n    return new Promise((r) => setTimeout(r, ms));\n}\n\nfunction safeJsonStringify(v: any) {\n    try {\n        return JSON.stringify(v);\n    } catch {\n        return String(v);\n    }\n}\n\nfunction toHeaders(init?: HeadersInit): Headers {\n    return new Headers(init || {});\n}\n\nfunction isJsonContentType(contentType: string | null): boolean {\n    if (!contentType) return false;\n    const ct = contentType.toLowerCase();\n    return ct.includes(\"application/json\") || ct.includes(\"+json\");\n}\n\nfunction isAbortError(e: any): boolean {\n    return e?.name === \"AbortError\";\n}\n\nfunction withJitter(ms: number): number {\n    // jitter +-20%\n    const jitter = ms * 0.2;\n    const delta = (Math.random() * 2 - 1) * jitter;\n    return Math.max(0, Math.floor(ms + delta));\n}\n\nexport class InternalHttp {\n    private readonly baseUrl: string;\n    private readonly apiKey: string | undefined;\n    private readonly timeoutMs: number;\n    private retry: RetryPolicy;\n\n    constructor(opts: InternalHttpOptions) {\n        this.baseUrl = opts.baseUrl.replace(/\\/+$/, \"\");\n        this.apiKey = opts.apiKey;\n\n        // ✅ Default más seguro para internas (evita cascadas)\n        this.timeoutMs = opts.timeoutMs ?? 4000;\n\n        this.retry = {...DEFAULT_RETRY, ...(opts.retry || {})};\n    }\n\n    async request<T>(\n        path: string,\n        init: RequestInit & {\n            requestId?: string;\n            idempotencyKey?: string;\n            headers?: HeadersInit;\n        } = {}\n    ): Promise<T> {\n        const url = `${this.baseUrl}${path.startsWith(\"/\") ? \"\" : \"/\"}${path}`;\n\n        const baseHeaders = toHeaders(init.headers);\n\n        if (!baseHeaders.has(\"Content-Type\")) baseHeaders.set(\"Content-Type\", \"application/json\");\n        if (this.apiKey) baseHeaders.set(\"x-internal-api-key\", this.apiKey);\n\n        if (init.requestId) baseHeaders.set(\"x-request-id\", init.requestId);\n        if (init.idempotencyKey) baseHeaders.set(\"Idempotency-Key\", init.idempotencyKey);\n\n        const {headers: _ignored, ...restInit} = init;\n\n        const doFetchOnce = async () => {\n            const controller = new AbortController();\n            const timeout = setTimeout(() => controller.abort(), this.timeoutMs);\n\n            try {\n                const res = await fetch(url, {\n                    ...restInit,\n                    headers: baseHeaders,\n                    signal: controller.signal,\n                });\n\n                if (!res.ok) {\n                    const text = await res.text().catch(() => \"\");\n                    const err: any = new Error(\n                        `HTTP ${res.status} ${res.statusText}${text ? ` - ${text}` : \"\"}`\n                    );\n                    err.status = res.status;\n                    err.body = text;\n                    throw err;\n                }\n\n                if (res.status === 204) return undefined as unknown as T;\n\n                const contentType = res.headers.get(\"content-type\");\n                if (isJsonContentType(contentType)) {\n                    return (await res.json()) as T;\n                }\n\n                const text = await res.text().catch(() => \"\");\n                return text as unknown as T;\n            } finally {\n                clearTimeout(timeout);\n            }\n        };\n\n        let attempt = 0;\n\n        while (true) {\n            try {\n                return await doFetchOnce();\n            } catch (e: any) {\n                attempt++;\n\n                const status = e?.status;\n                const retryableStatus = !!status && this.retry.retryOnStatuses.includes(status);\n\n                const retryableNetwork =\n                    this.retry.retryOnNetworkErrors &&\n                    (isAbortError(e) || !status); // sin status suele ser red/dns/timeout\n\n                const isRetryable = retryableStatus || retryableNetwork;\n\n                if (!isRetryable || attempt > this.retry.retries) {\n                    console.error(\n                        `[InternalHttp] request failed: ${url} attempt=${attempt} status=${status ?? \"n/a\"} err=${e?.message\n                        } body=${safeJsonStringify(e?.body)}`\n                    );\n                    throw e;\n                }\n\n                const backoff = withJitter(this.retry.baseDelayMs * attempt);\n                await sleep(backoff);\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACSO,IAAM,gBAAN,cAA4B,MAAM;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EAEP,YAAY,SAAiB,MAAuB,QAAiB,SAAe;AAChF,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,UAAU;AAAA,EACnB;AACJ;AAEO,SAAS,wBAAwB,KAAU,KAA4B;AAC1E,QAAM,SAAS,KAAK,UAAU;AAC9B,QAAM,OAAO,KAAK,UAAU;AAC5B,QAAM,YAAY,KAAK,SAAS,kBAAkB,OAAO,KAAK,WAAW,EAAE,EAAE,SAAS,SAAS;AAE/F,MAAI,WAAW;AACX,WAAO,IAAI,cAAc,IAAI,GAAG,aAAa,oBAAoB,KAAK,EAAC,OAAO,KAAK,QAAO,CAAC;AAAA,EAC/F;AACA,MAAI,CAAC,KAAK,UAAU;AAChB,WAAO,IAAI,cAAc,IAAI,GAAG,iBAAiB,wBAAwB,KAAK,EAAC,OAAO,KAAK,QAAO,CAAC;AAAA,EACvG;AACA,MAAI,WAAW,IAAK,QAAO,IAAI,cAAc,IAAI,GAAG,eAAe,sBAAsB,KAAK,IAAI;AAClG,MAAI,WAAW,IAAK,QAAO,IAAI,cAAc,IAAI,GAAG,kBAAkB,yBAAyB,KAAK,IAAI;AACxG,MAAI,WAAW,IAAK,QAAO,IAAI,cAAc,IAAI,GAAG,eAAe,sBAAsB,KAAK,IAAI;AAClG,MAAI,UAAU,OAAO,SAAS,KAAK;AAC/B,WAAO,IAAI,cAAc,IAAI,GAAG,kBAAkB,yBAAyB,QAAQ,IAAI;AAAA,EAC3F;AACA,SAAO,IAAI,cAAc,IAAI,GAAG,mBAAmB,oBAAoB,QAAQ,IAAI;AACvF;;;ACxCA,mBAAuD;AAEhD,IAAM,oBAAoB;AAgB1B,SAAS,cAAc,SAAiC,WAAuC;AAClG,QAAM,IACF,WAAW,OAAO,YAAY,WACxB,EAAC,GAAI,QAAe,IACpB,CAAC;AAEX,QAAM,OAAO,aAAa,IAAI,KAAK;AACnC,MAAI,IAAK,GAAE,iBAAiB,IAAI;AAEhC,SAAO;AACX;AAMO,SAAS,oBACZ,SAA6B,CAAC,GAC9B,WACkB;AAClB,SAAO;AAAA,IACH,GAAG;AAAA,IACH,SAAS,cAAe,OAAe,SAAS,SAAS;AAAA,EAC7D;AACJ;AAEO,SAAS,iBAAiB,MAAqC;AAClE,SAAO,aAAAA,QAAM,OAAO;AAAA,IAChB,SAAS,KAAK;AAAA,IACd,SAAS,KAAK,aAAa;AAAA,IAC3B,SAAS,EAAC,gBAAgB,mBAAkB;AAAA,EAChD,CAAC;AACL;;;ACnCA,IAAM,gBAA6B;AAAA,EAC/B,SAAS;AAAA,EACT,aAAa;AAAA,EACb,iBAAiB,CAAC,KAAK,KAAK,KAAK,GAAG;AAAA,EACpC,sBAAsB;AAC1B;AAEA,SAAS,MAAM,IAAY;AACvB,SAAO,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAC/C;AAEA,SAAS,kBAAkB,GAAQ;AAC/B,MAAI;AACA,WAAO,KAAK,UAAU,CAAC;AAAA,EAC3B,QAAQ;AACJ,WAAO,OAAO,CAAC;AAAA,EACnB;AACJ;AAEA,SAAS,UAAU,MAA6B;AAC5C,SAAO,IAAI,QAAQ,QAAQ,CAAC,CAAC;AACjC;AAEA,SAAS,kBAAkB,aAAqC;AAC5D,MAAI,CAAC,YAAa,QAAO;AACzB,QAAM,KAAK,YAAY,YAAY;AACnC,SAAO,GAAG,SAAS,kBAAkB,KAAK,GAAG,SAAS,OAAO;AACjE;AAEA,SAAS,aAAa,GAAiB;AACnC,SAAO,GAAG,SAAS;AACvB;AAEA,SAAS,WAAW,IAAoB;AAEpC,QAAM,SAAS,KAAK;AACpB,QAAM,SAAS,KAAK,OAAO,IAAI,IAAI,KAAK;AACxC,SAAO,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,KAAK,CAAC;AAC7C;AAEO,IAAM,eAAN,MAAmB;AAAA,EACL;AAAA,EACA;AAAA,EACA;AAAA,EACT;AAAA,EAER,YAAY,MAA2B;AACnC,SAAK,UAAU,KAAK,QAAQ,QAAQ,QAAQ,EAAE;AAC9C,SAAK,SAAS,KAAK;AAGnB,SAAK,YAAY,KAAK,aAAa;AAEnC,SAAK,QAAQ,EAAC,GAAG,eAAe,GAAI,KAAK,SAAS,CAAC,EAAE;AAAA,EACzD;AAAA,EAEA,MAAM,QACF,MACA,OAII,CAAC,GACK;AACV,UAAM,MAAM,GAAG,KAAK,OAAO,GAAG,KAAK,WAAW,GAAG,IAAI,KAAK,GAAG,GAAG,IAAI;AAEpE,UAAM,cAAc,UAAU,KAAK,OAAO;AAE1C,QAAI,CAAC,YAAY,IAAI,cAAc,EAAG,aAAY,IAAI,gBAAgB,kBAAkB;AACxF,QAAI,KAAK,OAAQ,aAAY,IAAI,sBAAsB,KAAK,MAAM;AAElE,QAAI,KAAK,UAAW,aAAY,IAAI,gBAAgB,KAAK,SAAS;AAClE,QAAI,KAAK,eAAgB,aAAY,IAAI,mBAAmB,KAAK,cAAc;AAE/E,UAAM,EAAC,SAAS,UAAU,GAAG,SAAQ,IAAI;AAEzC,UAAM,cAAc,YAAY;AAC5B,YAAM,aAAa,IAAI,gBAAgB;AACvC,YAAM,UAAU,WAAW,MAAM,WAAW,MAAM,GAAG,KAAK,SAAS;AAEnE,UAAI;AACA,cAAM,MAAM,MAAM,MAAM,KAAK;AAAA,UACzB,GAAG;AAAA,UACH,SAAS;AAAA,UACT,QAAQ,WAAW;AAAA,QACvB,CAAC;AAED,YAAI,CAAC,IAAI,IAAI;AACT,gBAAMC,QAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,gBAAM,MAAW,IAAI;AAAA,YACjB,QAAQ,IAAI,MAAM,IAAI,IAAI,UAAU,GAAGA,QAAO,MAAMA,KAAI,KAAK,EAAE;AAAA,UACnE;AACA,cAAI,SAAS,IAAI;AACjB,cAAI,OAAOA;AACX,gBAAM;AAAA,QACV;AAEA,YAAI,IAAI,WAAW,IAAK,QAAO;AAE/B,cAAM,cAAc,IAAI,QAAQ,IAAI,cAAc;AAClD,YAAI,kBAAkB,WAAW,GAAG;AAChC,iBAAQ,MAAM,IAAI,KAAK;AAAA,QAC3B;AAEA,cAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,eAAO;AAAA,MACX,UAAE;AACE,qBAAa,OAAO;AAAA,MACxB;AAAA,IACJ;AAEA,QAAI,UAAU;AAEd,WAAO,MAAM;AACT,UAAI;AACA,eAAO,MAAM,YAAY;AAAA,MAC7B,SAAS,GAAQ;AACb;AAEA,cAAM,SAAS,GAAG;AAClB,cAAM,kBAAkB,CAAC,CAAC,UAAU,KAAK,MAAM,gBAAgB,SAAS,MAAM;AAE9E,cAAM,mBACF,KAAK,MAAM,yBACV,aAAa,CAAC,KAAK,CAAC;AAEzB,cAAM,cAAc,mBAAmB;AAEvC,YAAI,CAAC,eAAe,UAAU,KAAK,MAAM,SAAS;AAC9C,kBAAQ;AAAA,YACJ,kCAAkC,GAAG,YAAY,OAAO,WAAW,UAAU,KAAK,QAAQ,GAAG,OAC7F,SAAS,kBAAkB,GAAG,IAAI,CAAC;AAAA,UACvC;AACA,gBAAM;AAAA,QACV;AAEA,cAAM,UAAU,WAAW,KAAK,MAAM,cAAc,OAAO;AAC3D,cAAM,MAAM,OAAO;AAAA,MACvB;AAAA,IACJ;AAAA,EACJ;AACJ;","names":["axios","text"]}
+{"version":3,"sources":["../../src/core/index.ts","../../src/core/errors.ts","../../src/core/http.ts","../../src/core/internalHttp.ts"],"sourcesContent":["// sdk/src/core/index.ts\n\nexport * from \"./errors\";\nexport * from \"./http\";\nexport * from \"./internalHttp\";\n","export type ClientErrorCode =\n    | \"UPSTREAM_TIMEOUT\"\n    | \"UPSTREAM_UNAVAILABLE\"\n    | \"UPSTREAM_BAD_RESPONSE\"\n    | \"UPSTREAM_NOT_FOUND\"\n    | \"UPSTREAM_UNAUTHORIZED\"\n    | \"UPSTREAM_FORBIDDEN\"\n    | \"UPSTREAM_UNKNOWN\";\n\nexport class UpstreamError extends Error {\n    public code: ClientErrorCode;\n    public status?: number;\n    public details?: any;\n\n    constructor(message: string, code: ClientErrorCode, status?: number, details?: any) {\n        super(message);\n        this.name = \"UpstreamError\";\n        this.code = code;\n        this.status = status;\n        this.details = details;\n    }\n}\n\nexport function mapAxiosToUpstreamError(err: any, svc: string): UpstreamError {\n    const status = err?.response?.status;\n    const data = err?.response?.data;\n    const isTimeout = err?.code === \"ECONNABORTED\" || String(err?.message || \"\").includes(\"timeout\");\n\n    if (isTimeout) {\n        return new UpstreamError(`[${svc}] timeout`, \"UPSTREAM_TIMEOUT\", 504, {cause: err?.message});\n    }\n    if (!err?.response) {\n        return new UpstreamError(`[${svc}] unavailable`, \"UPSTREAM_UNAVAILABLE\", 503, {cause: err?.message});\n    }\n    if (status === 404) return new UpstreamError(`[${svc}] not found`, \"UPSTREAM_NOT_FOUND\", 404, data);\n    if (status === 401) return new UpstreamError(`[${svc}] unauthorized`, \"UPSTREAM_UNAUTHORIZED\", 401, data);\n    if (status === 403) return new UpstreamError(`[${svc}] forbidden`, \"UPSTREAM_FORBIDDEN\", 403, data);\n    if (status >= 400 && status < 600) {\n        return new UpstreamError(`[${svc}] bad response`, \"UPSTREAM_BAD_RESPONSE\", status, data);\n    }\n    return new UpstreamError(`[${svc}] unknown error`, \"UPSTREAM_UNKNOWN\", status, data);\n}\n","// clients/core/http.ts\nimport axios, {AxiosInstance, AxiosRequestConfig} from \"axios\";\n\nexport const REQUEST_ID_HEADER = \"x-request-id\";\n\nexport type HttpClientOpts = {\n    baseURL: string;\n    timeoutMs?: number;\n};\n\n/**\n * Headers compatibles con múltiples versiones de axios.\n * En axios antiguo, `headers` suele ser `any`, así que mantenemos tolerancia.\n */\nexport type AnyHeaders = NonNullable<AxiosRequestConfig[\"headers\"]> | Record<string, string>;\n\n/**\n * Agrega x-request-id a headers (sin pisar otros headers).\n */\nexport function withRequestId(headers: AnyHeaders | undefined, requestId?: string | null): AnyHeaders {\n    const h: Record<string, any> =\n        headers && typeof headers === \"object\"\n            ? {...(headers as any)}\n            : {};\n\n    const rid = (requestId || \"\").trim();\n    if (rid) h[REQUEST_ID_HEADER] = rid;\n\n    return h as AnyHeaders;\n}\n\n/**\n * Helper para construir config de axios con requestId\n * (SIN genéricos para compat con axios typings antiguos).\n */\nexport function withRequestIdConfig(\n    config: AxiosRequestConfig = {},\n    requestId?: string | null\n): AxiosRequestConfig {\n    return {\n        ...config,\n        headers: withRequestId((config as any).headers, requestId) as any,\n    };\n}\n\nexport function createHttpClient(opts: HttpClientOpts): AxiosInstance {\n    return axios.create({\n        baseURL: opts.baseURL,\n        timeout: opts.timeoutMs ?? 4000,\n        headers: {\"Content-Type\": \"application/json\"},\n    });\n}\n","// clients/internalHttp.ts\n\ntype RetryPolicy = {\n    retries: number;\n    baseDelayMs: number;\n    retryOnStatuses: number[];\n    retryOnNetworkErrors: boolean;\n};\n\ntype InternalHttpOptions = {\n    baseUrl: string;\n    apiKey?: string; // x-internal-api-key\n    timeoutMs?: number;\n    retry?: Partial<RetryPolicy>;\n};\n\nconst DEFAULT_RETRY: RetryPolicy = {\n    retries: 1,\n    baseDelayMs: 150,\n    retryOnStatuses: [429, 502, 503, 504],\n    retryOnNetworkErrors: true,\n};\n\nfunction sleep(ms: number) {\n    return new Promise((r) => setTimeout(r, ms));\n}\n\nfunction safeJsonStringify(v: any) {\n    try {\n        return JSON.stringify(v);\n    } catch {\n        return String(v);\n    }\n}\n\nfunction toHeaders(init?: HeadersInit): Headers {\n    return new Headers(init || {});\n}\n\nfunction isJsonContentType(contentType: string | null): boolean {\n    if (!contentType) return false;\n    const ct = contentType.toLowerCase();\n    return ct.includes(\"application/json\") || ct.includes(\"+json\");\n}\n\nfunction isAbortError(e: any): boolean {\n    return e?.name === \"AbortError\";\n}\n\nfunction withJitter(ms: number): number {\n    // jitter +-20%\n    const jitter = ms * 0.2;\n    const delta = (Math.random() * 2 - 1) * jitter;\n    return Math.max(0, Math.floor(ms + delta));\n}\n\nexport class InternalHttp {\n    private readonly baseUrl: string;\n    private readonly apiKey: string | undefined;\n    private readonly timeoutMs: number;\n    private retry: RetryPolicy;\n\n    constructor(opts: InternalHttpOptions) {\n        this.baseUrl = opts.baseUrl.replace(/\\/+$/, \"\");\n        this.apiKey = opts.apiKey;\n\n        // ✅ Default más seguro para internas (evita cascadas)\n        this.timeoutMs = opts.timeoutMs ?? 4000;\n\n        this.retry = {...DEFAULT_RETRY, ...(opts.retry || {})};\n    }\n\n    async request<T>(\n        path: string,\n        init: RequestInit & {\n            requestId?: string;\n            idempotencyKey?: string;\n            headers?: HeadersInit;\n        } = {}\n    ): Promise<T> {\n        const url = `${this.baseUrl}${path.startsWith(\"/\") ? \"\" : \"/\"}${path}`;\n\n        const baseHeaders = toHeaders(init.headers);\n\n        if (!baseHeaders.has(\"Content-Type\")) baseHeaders.set(\"Content-Type\", \"application/json\");\n        if (this.apiKey) baseHeaders.set(\"x-internal-api-key\", this.apiKey);\n\n        if (init.requestId) baseHeaders.set(\"x-request-id\", init.requestId);\n        if (init.idempotencyKey) baseHeaders.set(\"Idempotency-Key\", init.idempotencyKey);\n\n        const {headers: _ignored, ...restInit} = init;\n\n        const doFetchOnce = async () => {\n            const controller = new AbortController();\n            const timeout = setTimeout(() => controller.abort(), this.timeoutMs);\n\n            try {\n                const res = await fetch(url, {\n                    ...restInit,\n                    headers: baseHeaders,\n                    signal: controller.signal,\n                });\n\n                if (!res.ok) {\n                    const text = await res.text().catch(() => \"\");\n                    const err: any = new Error(\n                        `HTTP ${res.status} ${res.statusText}${text ? ` - ${text}` : \"\"}`\n                    );\n                    err.status = res.status;\n                    err.body = text;\n                    throw err;\n                }\n\n                if (res.status === 204) return undefined as unknown as T;\n\n                const contentType = res.headers.get(\"content-type\");\n                if (isJsonContentType(contentType)) {\n                    return (await res.json()) as T;\n                }\n\n                const text = await res.text().catch(() => \"\");\n                return text as unknown as T;\n            } finally {\n                clearTimeout(timeout);\n            }\n        };\n\n        let attempt = 0;\n\n        while (true) {\n            try {\n                return await doFetchOnce();\n            } catch (e: any) {\n                attempt++;\n\n                const status = e?.status;\n                const retryableStatus = !!status && this.retry.retryOnStatuses.includes(status);\n\n                const retryableNetwork =\n                    this.retry.retryOnNetworkErrors &&\n                    (isAbortError(e) || !status); // sin status suele ser red/dns/timeout\n\n                const isRetryable = retryableStatus || retryableNetwork;\n\n                if (!isRetryable || attempt > this.retry.retries) {\n                    console.error(\n                        `[InternalHttp] request failed: ${url} attempt=${attempt} status=${status ?? \"n/a\"} err=${e?.message\n                        } body=${safeJsonStringify(e?.body)}`\n                    );\n                    throw e;\n                }\n\n                const backoff = withJitter(this.retry.baseDelayMs * attempt);\n                await sleep(backoff);\n            }\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACSO,IAAM,gBAAN,cAA4B,MAAM;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EAEP,YAAY,SAAiB,MAAuB,QAAiB,SAAe;AAChF,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,UAAU;AAAA,EACnB;AACJ;AAEO,SAAS,wBAAwB,KAAU,KAA4B;AAC1E,QAAM,SAAS,KAAK,UAAU;AAC9B,QAAM,OAAO,KAAK,UAAU;AAC5B,QAAM,YAAY,KAAK,SAAS,kBAAkB,OAAO,KAAK,WAAW,EAAE,EAAE,SAAS,SAAS;AAE/F,MAAI,WAAW;AACX,WAAO,IAAI,cAAc,IAAI,GAAG,aAAa,oBAAoB,KAAK,EAAC,OAAO,KAAK,QAAO,CAAC;AAAA,EAC/F;AACA,MAAI,CAAC,KAAK,UAAU;AAChB,WAAO,IAAI,cAAc,IAAI,GAAG,iBAAiB,wBAAwB,KAAK,EAAC,OAAO,KAAK,QAAO,CAAC;AAAA,EACvG;AACA,MAAI,WAAW,IAAK,QAAO,IAAI,cAAc,IAAI,GAAG,eAAe,sBAAsB,KAAK,IAAI;AAClG,MAAI,WAAW,IAAK,QAAO,IAAI,cAAc,IAAI,GAAG,kBAAkB,yBAAyB,KAAK,IAAI;AACxG,MAAI,WAAW,IAAK,QAAO,IAAI,cAAc,IAAI,GAAG,eAAe,sBAAsB,KAAK,IAAI;AAClG,MAAI,UAAU,OAAO,SAAS,KAAK;AAC/B,WAAO,IAAI,cAAc,IAAI,GAAG,kBAAkB,yBAAyB,QAAQ,IAAI;AAAA,EAC3F;AACA,SAAO,IAAI,cAAc,IAAI,GAAG,mBAAmB,oBAAoB,QAAQ,IAAI;AACvF;;;ACxCA,mBAAuD;AAEhD,IAAM,oBAAoB;AAgB1B,SAAS,cAAc,SAAiC,WAAuC;AAClG,QAAM,IACF,WAAW,OAAO,YAAY,WACxB,EAAC,GAAI,QAAe,IACpB,CAAC;AAEX,QAAM,OAAO,aAAa,IAAI,KAAK;AACnC,MAAI,IAAK,GAAE,iBAAiB,IAAI;AAEhC,SAAO;AACX;AAMO,SAAS,oBACZ,SAA6B,CAAC,GAC9B,WACkB;AAClB,SAAO;AAAA,IACH,GAAG;AAAA,IACH,SAAS,cAAe,OAAe,SAAS,SAAS;AAAA,EAC7D;AACJ;AAEO,SAAS,iBAAiB,MAAqC;AAClE,SAAO,aAAAA,QAAM,OAAO;AAAA,IAChB,SAAS,KAAK;AAAA,IACd,SAAS,KAAK,aAAa;AAAA,IAC3B,SAAS,EAAC,gBAAgB,mBAAkB;AAAA,EAChD,CAAC;AACL;;;ACnCA,IAAM,gBAA6B;AAAA,EAC/B,SAAS;AAAA,EACT,aAAa;AAAA,EACb,iBAAiB,CAAC,KAAK,KAAK,KAAK,GAAG;AAAA,EACpC,sBAAsB;AAC1B;AAEA,SAAS,MAAM,IAAY;AACvB,SAAO,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAC/C;AAEA,SAAS,kBAAkB,GAAQ;AAC/B,MAAI;AACA,WAAO,KAAK,UAAU,CAAC;AAAA,EAC3B,QAAQ;AACJ,WAAO,OAAO,CAAC;AAAA,EACnB;AACJ;AAEA,SAAS,UAAU,MAA6B;AAC5C,SAAO,IAAI,QAAQ,QAAQ,CAAC,CAAC;AACjC;AAEA,SAAS,kBAAkB,aAAqC;AAC5D,MAAI,CAAC,YAAa,QAAO;AACzB,QAAM,KAAK,YAAY,YAAY;AACnC,SAAO,GAAG,SAAS,kBAAkB,KAAK,GAAG,SAAS,OAAO;AACjE;AAEA,SAAS,aAAa,GAAiB;AACnC,SAAO,GAAG,SAAS;AACvB;AAEA,SAAS,WAAW,IAAoB;AAEpC,QAAM,SAAS,KAAK;AACpB,QAAM,SAAS,KAAK,OAAO,IAAI,IAAI,KAAK;AACxC,SAAO,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,KAAK,CAAC;AAC7C;AAEO,IAAM,eAAN,MAAmB;AAAA,EACL;AAAA,EACA;AAAA,EACA;AAAA,EACT;AAAA,EAER,YAAY,MAA2B;AACnC,SAAK,UAAU,KAAK,QAAQ,QAAQ,QAAQ,EAAE;AAC9C,SAAK,SAAS,KAAK;AAGnB,SAAK,YAAY,KAAK,aAAa;AAEnC,SAAK,QAAQ,EAAC,GAAG,eAAe,GAAI,KAAK,SAAS,CAAC,EAAE;AAAA,EACzD;AAAA,EAEA,MAAM,QACF,MACA,OAII,CAAC,GACK;AACV,UAAM,MAAM,GAAG,KAAK,OAAO,GAAG,KAAK,WAAW,GAAG,IAAI,KAAK,GAAG,GAAG,IAAI;AAEpE,UAAM,cAAc,UAAU,KAAK,OAAO;AAE1C,QAAI,CAAC,YAAY,IAAI,cAAc,EAAG,aAAY,IAAI,gBAAgB,kBAAkB;AACxF,QAAI,KAAK,OAAQ,aAAY,IAAI,sBAAsB,KAAK,MAAM;AAElE,QAAI,KAAK,UAAW,aAAY,IAAI,gBAAgB,KAAK,SAAS;AAClE,QAAI,KAAK,eAAgB,aAAY,IAAI,mBAAmB,KAAK,cAAc;AAE/E,UAAM,EAAC,SAAS,UAAU,GAAG,SAAQ,IAAI;AAEzC,UAAM,cAAc,YAAY;AAC5B,YAAM,aAAa,IAAI,gBAAgB;AACvC,YAAM,UAAU,WAAW,MAAM,WAAW,MAAM,GAAG,KAAK,SAAS;AAEnE,UAAI;AACA,cAAM,MAAM,MAAM,MAAM,KAAK;AAAA,UACzB,GAAG;AAAA,UACH,SAAS;AAAA,UACT,QAAQ,WAAW;AAAA,QACvB,CAAC;AAED,YAAI,CAAC,IAAI,IAAI;AACT,gBAAMC,QAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,gBAAM,MAAW,IAAI;AAAA,YACjB,QAAQ,IAAI,MAAM,IAAI,IAAI,UAAU,GAAGA,QAAO,MAAMA,KAAI,KAAK,EAAE;AAAA,UACnE;AACA,cAAI,SAAS,IAAI;AACjB,cAAI,OAAOA;AACX,gBAAM;AAAA,QACV;AAEA,YAAI,IAAI,WAAW,IAAK,QAAO;AAE/B,cAAM,cAAc,IAAI,QAAQ,IAAI,cAAc;AAClD,YAAI,kBAAkB,WAAW,GAAG;AAChC,iBAAQ,MAAM,IAAI,KAAK;AAAA,QAC3B;AAEA,cAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,eAAO;AAAA,MACX,UAAE;AACE,qBAAa,OAAO;AAAA,MACxB;AAAA,IACJ;AAEA,QAAI,UAAU;AAEd,WAAO,MAAM;AACT,UAAI;AACA,eAAO,MAAM,YAAY;AAAA,MAC7B,SAAS,GAAQ;AACb;AAEA,cAAM,SAAS,GAAG;AAClB,cAAM,kBAAkB,CAAC,CAAC,UAAU,KAAK,MAAM,gBAAgB,SAAS,MAAM;AAE9E,cAAM,mBACF,KAAK,MAAM,yBACV,aAAa,CAAC,KAAK,CAAC;AAEzB,cAAM,cAAc,mBAAmB;AAEvC,YAAI,CAAC,eAAe,UAAU,KAAK,MAAM,SAAS;AAC9C,kBAAQ;AAAA,YACJ,kCAAkC,GAAG,YAAY,OAAO,WAAW,UAAU,KAAK,QAAQ,GAAG,OAC7F,SAAS,kBAAkB,GAAG,IAAI,CAAC;AAAA,UACvC;AACA,gBAAM;AAAA,QACV;AAEA,cAAM,UAAU,WAAW,KAAK,MAAM,cAAc,OAAO;AAC3D,cAAM,MAAM,OAAO;AAAA,MACvB;AAAA,IACJ;AAAA,EACJ;AACJ;","names":["axios","text"]}

package/dist/core/index.js

@@ -7,6 +7,7 @@ import {
   withRequestId,
   withRequestIdConfig
 } from "../chunk-GG7EI74E.js";
+import "../chunk-PZ5AY32C.js";
 export {
   InternalHttp,
   REQUEST_ID_HEADER,

package/dist/headers/index.js

@@ -7,6 +7,7 @@ import {
   HEADER_REQUEST_ID,
   getRequestContextFromHeaders
 } from "../chunk-65HACONF.js";
+import "../chunk-PZ5AY32C.js";
 export {
   HEADER_AUTHORIZATION,
   HEADER_BRANCH_UID,