@stackcraftmx/calcita 0.0.0-stage → 0.23.0

package/dist/account/SignInScreen.js

@@ -0,0 +1,101 @@
+"use client";
+import { jsx, jsxs } from "react/jsx-runtime";
+import { useState, useEffect } from "react";
+import Alert from "@mui/material/Alert";
+import { useAccount } from "./AccountProvider.js";
+import DemoTotpCodeButton from "./DemoTotpCodeButton.js";
+import { AuthLayout } from "../appShell/AuthLayout.js";
+import SignInForm from "../forms/auth/SignInForm.js";
+import SecondStepForm, { SECOND_STEP_METHOD } from "../forms/security/SecondStepForm.js";
+import { readRedirectParam } from "../navigation.js";
+import { signWithPasskey, passkeysSupported } from "../security/passkeys.js";
+import { useToolkitNavigation } from "../toolkit/toolkitContext.js";
+import { useToolkitTranslation } from "../toolkit/useToolkitTranslation.js";
+function SignInScreen({ homePath = "/", forgotPasswordPath, logo, brandName, footer, showLanguageToggle = true, showColorSchemeToggle = true }) {
+  const { t } = useToolkitTranslation("auth");
+  const { connector, session, refreshSession } = useAccount();
+  const { useNavigate, useLocation } = useToolkitNavigation();
+  const navigate = useNavigate();
+  const { search } = useLocation();
+  const [secondStep, setSecondStep] = useState(null);
+  const [notice, setNotice] = useState(null);
+  const destination = readRedirectParam(search) ?? homePath;
+  useEffect(() => {
+    if (session) {
+      navigate(destination, { replace: true });
+    }
+  }, [session, destination, navigate]);
+  const signIn = async (credentials) => {
+    setNotice(null);
+    const result = await connector.signIn({ remember: false, ...credentials });
+    if (result?.secondStep) {
+      setSecondStep(result.secondStep);
+      return;
+    }
+    await refreshSession();
+  };
+  const signInFromFooter = async (credentials) => {
+    try {
+      await signIn(credentials);
+    } catch (error) {
+      setNotice(error?.message ?? null);
+    }
+  };
+  const backToPassword = (message) => {
+    setSecondStep(null);
+    setNotice(message);
+  };
+  if (session) {
+    return null;
+  }
+  if (secondStep) {
+    const showsDemoCode = typeof connector.demoTotpCode === "function" && secondStep.methods.includes(SECOND_STEP_METHOD.totp);
+    return /* @__PURE__ */ jsx(
+      AuthLayout,
+      {
+        logo,
+        brandName,
+        title: t("security:twoStep.title"),
+        showLanguageToggle,
+        showColorSchemeToggle,
+        children: /* @__PURE__ */ jsx(
+          SecondStepForm,
+          {
+            methods: secondStep.methods,
+            canUsePasskeys: passkeysSupported(),
+            onUsePasskey: async () => {
+              await connector.signInWithPasskey(await signWithPasskey(await connector.secondStepPasskeyOptions()));
+              await refreshSession();
+            },
+            onSubmitCode: async ({ method, code }) => {
+              await connector.signInSecondStep({ method, code });
+              await refreshSession();
+            },
+            onCancel: backToPassword,
+            footer: showsDemoCode && /* @__PURE__ */ jsx(DemoTotpCodeButton, { loadCode: connector.demoTotpCode })
+          }
+        )
+      }
+    );
+  }
+  return /* @__PURE__ */ jsxs(
+    AuthLayout,
+    {
+      logo,
+      brandName,
+      title: t("signIn.title"),
+      description: t("signIn.subtitle"),
+      showLanguageToggle,
+      showColorSchemeToggle,
+      footer: typeof footer === "function" ? footer({ signIn: signInFromFooter }) : footer,
+      children: [
+        notice && /* @__PURE__ */ jsx(Alert, { severity: "warning", sx: { mb: 2 }, children: notice }),
+        /* @__PURE__ */ jsx(SignInForm, { onSubmit: signIn, forgotPasswordPath })
+      ]
+    }
+  );
+}
+export {
+  SignInScreen as default
+};
+//# sourceMappingURL=SignInScreen.js.map

package/dist/account/SignInScreen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignInScreen.js","sources":["../../src/account/SignInScreen.jsx"],"sourcesContent":["// Entrar, completo: la contraseña (SignInForm) y, si la cuenta tiene verificación en dos pasos, el segundo paso\n// (SecondStepForm: la llave de acceso, el código de la app o uno de recuperación). Al terminar se vuelve a leer la sesión y\n// se va a la pantalla que se quería abrir (readRedirectParam: solo si es de esta app) o al inicio.\n//\n// Lo del servidor sale del conector de la cuenta (useAccount): en el proyecto la pantalla solo se pone en su ruta.\n//\n//   <SignInScreen forgotPasswordPath=\"/forgot-password\" logo={<AppLogo />} />\n//\n// footer va abajo de la tarjeta. Si es una función, recibe signIn para entrar desde un botón propio (p. ej. «Entrar con la\n// cuenta de ejemplo»), con el mismo segundo paso; si falla, el motivo sale arriba del formulario.\n//\n// Genérico del paquete: function (regla de la casa).\nimport {useEffect, useState} from 'react';\nimport Alert from '@mui/material/Alert';\n\nimport {useAccount} from '@/account/AccountProvider.jsx';\nimport DemoTotpCodeButton from '@/account/DemoTotpCodeButton.jsx';\nimport {AuthLayout} from '@/appShell/AuthLayout.jsx';\nimport SignInForm from '@/forms/auth/SignInForm.jsx';\nimport SecondStepForm, {SECOND_STEP_METHOD} from '@/forms/security/SecondStepForm.jsx';\nimport {readRedirectParam} from '@/navigation.js';\nimport {passkeysSupported, signWithPasskey} from '@/security/passkeys.js';\nimport {useToolkitNavigation} from '@/toolkit/toolkitContext.js';\nimport {useToolkitTranslation} from '@/toolkit/useToolkitTranslation.js';\n\n/**\n * @param {object} props\n * @param {string} [props.homePath] a dónde ir si no se quería abrir otra pantalla; por omisión '/'\n * @param {string} [props.forgotPasswordPath] sin ella no sale «¿Olvidó su contraseña?»\n * @param {import('react').ReactNode} [props.logo]\n * @param {string} [props.brandName] por omisión el appName de ToolkitProvider\n * @param {import('react').ReactNode | ((helpers: {signIn: (credentials: {email: string, password: string, remember?: boolean}) => Promise<void>}) => import('react').ReactNode)} [props.footer]\n * @param {boolean} [props.showLanguageToggle] por omisión sí\n * @param {boolean} [props.showColorSchemeToggle] por omisión sí\n */\nexport default function SignInScreen({homePath = '/', forgotPasswordPath, logo, brandName, footer, showLanguageToggle = true, showColorSchemeToggle = true}) {\n    const {t} = useToolkitTranslation('auth');\n    const {connector, session, refreshSession} = useAccount();\n    const {useNavigate, useLocation} = useToolkitNavigation();\n    const navigate = useNavigate();\n    const {search} = useLocation();\n    // con verificación en dos pasos: los métodos del segundo paso (la contraseña ya fue correcta)\n    const [secondStep, setSecondStep] = useState(null);\n    const [notice, setNotice] = useState(null);\n    const destination = readRedirectParam(search) ?? homePath;\n\n    // ya hay sesión (acaba de entrar, o abrió esta pantalla estando dentro): a donde iba\n    useEffect(() => {\n        if (session) {\n            navigate(destination, {replace: true});\n        }\n    }, [session, destination, navigate]);\n\n    // después de la contraseña: el segundo paso si lo pide el servidor; si no, ya está dentro\n    const signIn = async (credentials) => {\n        setNotice(null);\n        const result = await connector.signIn({remember: false, ...credentials});\n        if (result?.secondStep) {\n            setSecondStep(result.secondStep);\n            return;\n        }\n        await refreshSession();\n    };\n    // desde un botón propio del footer: el error no tiene formulario donde salir, sale arriba\n    const signInFromFooter = async (credentials) => {\n        try {\n            await signIn(credentials);\n        } catch (error) {\n            setNotice(error?.message ?? null);\n        }\n    };\n    // se acabaron los intentos o se venció el tiempo: de regreso a la contraseña, con el motivo\n    const backToPassword = (message) => {\n        setSecondStep(null);\n        setNotice(message);\n    };\n\n    if (session) {\n        return null;\n    }\n\n    if (secondStep) {\n        const showsDemoCode = typeof connector.demoTotpCode === 'function' && secondStep.methods.includes(SECOND_STEP_METHOD.totp);\n        return (\n            <AuthLayout logo={logo} brandName={brandName} title={t('security:twoStep.title')}\n                        showLanguageToggle={showLanguageToggle} showColorSchemeToggle={showColorSchemeToggle}>\n                <SecondStepForm methods={secondStep.methods} canUsePasskeys={passkeysSupported()}\n                                onUsePasskey={async () => {\n                                    await connector.signInWithPasskey(await signWithPasskey(await connector.secondStepPasskeyOptions()));\n                                    await refreshSession();\n                                }}\n                                onSubmitCode={async ({method, code}) => {\n                                    await connector.signInSecondStep({method, code});\n                                    await refreshSession();\n                                }}\n                                onCancel={backToPassword}\n                                footer={showsDemoCode && <DemoTotpCodeButton loadCode={connector.demoTotpCode} />} />\n            </AuthLayout>\n        );\n    }\n\n    return (\n        <AuthLayout logo={logo} brandName={brandName} title={t('signIn.title')} description={t('signIn.subtitle')}\n                    showLanguageToggle={showLanguageToggle} showColorSchemeToggle={showColorSchemeToggle}\n                    footer={typeof footer === 'function' ? footer({signIn: signInFromFooter}) : footer}>\n            {notice && <Alert severity=\"warning\" sx={{mb: 2}}>{notice}</Alert>}\n            <SignInForm onSubmit={signIn} forgotPasswordPath={forgotPasswordPath} />\n        </AuthLayout>\n    );\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;AAmCA,SAAwB,aAAa,EAAC,WAAW,KAAK,oBAAoB,MAAM,WAAW,QAAQ,qBAAqB,MAAM,wBAAwB,KAAA,GAAO;AACzJ,QAAM,EAAC,EAAA,IAAK,sBAAsB,MAAM;AACxC,QAAM,EAAC,WAAW,SAAS,eAAA,IAAkB,WAAA;AAC7C,QAAM,EAAC,aAAa,YAAA,IAAe,qBAAA;AACnC,QAAM,WAAW,YAAA;AACjB,QAAM,EAAC,OAAA,IAAU,YAAA;AAEjB,QAAM,CAAC,YAAY,aAAa,IAAI,SAAS,IAAI;AACjD,QAAM,CAAC,QAAQ,SAAS,IAAI,SAAS,IAAI;AACzC,QAAM,cAAc,kBAAkB,MAAM,KAAK;AAGjD,YAAU,MAAM;AACZ,QAAI,SAAS;AACT,eAAS,aAAa,EAAC,SAAS,KAAA,CAAK;AAAA,IACzC;AAAA,EACJ,GAAG,CAAC,SAAS,aAAa,QAAQ,CAAC;AAGnC,QAAM,SAAS,OAAO,gBAAgB;AAClC,cAAU,IAAI;AACd,UAAM,SAAS,MAAM,UAAU,OAAO,EAAC,UAAU,OAAO,GAAG,aAAY;AACvE,QAAI,QAAQ,YAAY;AACpB,oBAAc,OAAO,UAAU;AAC/B;AAAA,IACJ;AACA,UAAM,eAAA;AAAA,EACV;AAEA,QAAM,mBAAmB,OAAO,gBAAgB;AAC5C,QAAI;AACA,YAAM,OAAO,WAAW;AAAA,IAC5B,SAAS,OAAO;AACZ,gBAAU,OAAO,WAAW,IAAI;AAAA,IACpC;AAAA,EACJ;AAEA,QAAM,iBAAiB,CAAC,YAAY;AAChC,kBAAc,IAAI;AAClB,cAAU,OAAO;AAAA,EACrB;AAEA,MAAI,SAAS;AACT,WAAO;AAAA,EACX;AAEA,MAAI,YAAY;AACZ,UAAM,gBAAgB,OAAO,UAAU,iBAAiB,cAAc,WAAW,QAAQ,SAAS,mBAAmB,IAAI;AACzH,WACI;AAAA,MAAC;AAAA,MAAA;AAAA,QAAW;AAAA,QAAY;AAAA,QAAsB,OAAO,EAAE,wBAAwB;AAAA,QACnE;AAAA,QAAwC;AAAA,QAChD,UAAA;AAAA,UAAC;AAAA,UAAA;AAAA,YAAe,SAAS,WAAW;AAAA,YAAS,gBAAgB,kBAAA;AAAA,YAC7C,cAAc,YAAY;AACtB,oBAAM,UAAU,kBAAkB,MAAM,gBAAgB,MAAM,UAAU,yBAAA,CAA0B,CAAC;AACnG,oBAAM,eAAA;AAAA,YACV;AAAA,YACA,cAAc,OAAO,EAAC,QAAQ,WAAU;AACpC,oBAAM,UAAU,iBAAiB,EAAC,QAAQ,MAAK;AAC/C,oBAAM,eAAA;AAAA,YACV;AAAA,YACA,UAAU;AAAA,YACV,QAAQ,iBAAiB,oBAAC,oBAAA,EAAmB,UAAU,UAAU,aAAA,CAAc;AAAA,UAAA;AAAA,QAAA;AAAA,MAAI;AAAA,IAAA;AAAA,EAG/G;AAEA,SACI;AAAA,IAAC;AAAA,IAAA;AAAA,MAAW;AAAA,MAAY;AAAA,MAAsB,OAAO,EAAE,cAAc;AAAA,MAAG,aAAa,EAAE,iBAAiB;AAAA,MAC5F;AAAA,MAAwC;AAAA,MACxC,QAAQ,OAAO,WAAW,aAAa,OAAO,EAAC,QAAQ,iBAAA,CAAiB,IAAI;AAAA,MACnF,UAAA;AAAA,QAAA,UAAU,oBAAC,SAAM,UAAS,WAAU,IAAI,EAAC,IAAI,EAAA,GAAK,UAAA,OAAA,CAAO;AAAA,QAC1D,oBAAC,YAAA,EAAW,UAAU,QAAQ,mBAAA,CAAwC;AAAA,MAAA;AAAA,IAAA;AAAA,EAAA;AAGlF;"}

package/dist/account/accountConnector.js

@@ -0,0 +1,31 @@
+const ACCOUNT_CONNECTOR_FUNCTIONS = Object.freeze([
+  "loadSession",
+  "signIn",
+  "signInSecondStep",
+  "secondStepPasskeyOptions",
+  "signInWithPasskey",
+  "signOut",
+  "requestPasswordReset",
+  "resetPassword",
+  "updateProfile",
+  "changePassword",
+  "loadSecurity",
+  "startTotp",
+  "confirmTotp",
+  "disableTotp",
+  "passkeyRegistrationOptions",
+  "savePasskey",
+  "removePasskey",
+  "regenerateRecoveryCodes",
+  "listSessions",
+  "closeOtherSessions",
+  "listActivity"
+]);
+function missingConnectorFunctionsOf(connector) {
+  return ACCOUNT_CONNECTOR_FUNCTIONS.filter((name) => typeof connector?.[name] !== "function");
+}
+export {
+  ACCOUNT_CONNECTOR_FUNCTIONS,
+  missingConnectorFunctionsOf
+};
+//# sourceMappingURL=accountConnector.js.map

package/dist/account/accountConnector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accountConnector.js","sources":["../../src/account/accountConnector.js"],"sourcesContent":["// El conector de la cuenta: lo ÚNICO que un proyecto escribe para tener entrar (con su segundo paso), «¿Olvidó su\n// contraseña?», elegir una contraseña nueva, Mi perfil y su seguridad (@stackcraftmx/calcita/account). Las pantallas solo\n// llaman estas funciones; cada una habla con el backend del proyecto.\n//\n// Tres formas de tenerlo:\n//   - createRestAccountConnector(apiClient): si el backend sigue el contrato REST (restAccountConnector.js), ya está;\n//   - createDemoAccountConnector() de @stackcraftmx/calcita/account-demo: todo en la memoria del navegador, para arrancar\n//     sin backend;\n//   - uno propio: un objeto con estas funciones, o el REST con las que no coincidan cambiadas ({...rest, signIn: …}).\n//\n// Cada función regresa una promesa y, si el servidor dice que no, truena con un ApiError (RFC 9457): la pantalla enseña su\n// mensaje, y lo de cada campo en su campo. Las llaves van en camelCase: la traducción desde el backend va en el conector.\n//\n// Funciones puras, no renderizan: function (regla de la casa). Pruebas en accountConnector.test.js.\n\n/**\n * Quien está dentro, como lo pintan la barra y Mi perfil.\n *\n * @typedef {object} AccountUser\n * @property {string} id\n * @property {string} name\n * @property {string} email\n * @property {string} [subtitle] el renglón bajo el nombre (puesto · sucursal)\n * @property {string} [phone]\n * @property {string} [avatarUrl]\n */\n\n/**\n * La sesión: quién está dentro y sus permisos (los lee createAccessChecker).\n *\n * @typedef {object} AccountSession\n * @property {AccountUser} user\n * @property {string[]} [roles]\n * @property {string[]} [abilities]\n * @property {string[]} [labels] sus perfiles o etiquetas, ya traducidos (salen como chips en Mi perfil)\n */\n\n/**\n * El estado de la verificación en dos pasos (el que pinta TwoStepVerificationCard).\n *\n * @typedef {object} AccountSecurity\n * @property {boolean} isEnabled\n * @property {string|null} [enabledAt]\n * @property {Array<{id: string, name: string, createdAt: string, lastUsedAt?: string|null}>} passkeys\n * @property {{isEnabled: boolean, enabledAt?: string|null}} totp\n * @property {number} recoveryCodesRemaining\n */\n\n/**\n * Lo que regresa un cambio de seguridad: el estado nuevo y, si se generaron, los códigos de recuperación (se enseñan una\n * sola vez).\n *\n * @typedef {object} AccountSecurityChange\n * @property {AccountSecurity} security\n * @property {string[]} [recoveryCodes]\n */\n\n/**\n * Un equipo donde la cuenta está abierta.\n *\n * @typedef {object} AccountDeviceSession\n * @property {string} id\n * @property {string|null} [browser]\n * @property {string|null} [platform]\n * @property {boolean} [isMobile]\n * @property {string} startedAt instante ISO\n * @property {string|null} [network] a medias (187.190.x.x), nunca la IP completa\n * @property {boolean} [isCurrent]\n */\n\n/**\n * Un renglón de la bitácora de la cuenta.\n *\n * @typedef {object} AccountEvent\n * @property {string} id\n * @property {string} kind uno de ACCOUNT_EVENT_KIND\n * @property {string} occurredAt instante ISO\n * @property {string|null} [device]\n * @property {string|null} [network]\n */\n\n/**\n * El conector completo.\n *\n * @typedef {object} AccountConnector\n * @property {() => Promise<AccountSession|null>} loadSession quién está dentro; null si nadie\n * @property {(credentials: {email: string, password: string, remember: boolean}) => Promise<{secondStep: {methods: string[]}|null}>} signIn\n *     con verificación en dos pasos regresa los métodos del segundo paso (SECOND_STEP_METHOD); sin ella, secondStep null\n *     y ya está dentro\n * @property {(input: {method: string, code: string}) => Promise<void>} signInSecondStep el código de la app (totp) o uno\n *     de recuperación (recoveryCode)\n * @property {() => Promise<object>} secondStepPasskeyOptions las opciones de WebAuthn para firmar (JSON del servidor)\n * @property {(credential: any) => Promise<void>} signInWithPasskey la firma del navegador (JSON de WebAuthn)\n * @property {() => Promise<void>} signOut\n * @property {(input: {email: string}) => Promise<void>} requestPasswordReset contesta igual exista o no el correo\n * @property {(input: {token: string, newPassword: string}) => Promise<void>} resetPassword desde el enlace del correo\n * @property {(input: {name: string, phone: string}) => Promise<{message?: string}|void>} updateProfile\n * @property {(input: {currentPassword?: string, newPassword: string}) => Promise<void>} changePassword\n * @property {() => Promise<AccountSecurity>} loadSecurity\n * @property {() => Promise<{secret: string, qrImageUrl?: string|null}>} startTotp una clave nueva (todavía sin activar)\n * @property {(code: string) => Promise<AccountSecurityChange>} confirmTotp\n * @property {(password: string) => Promise<AccountSecurityChange>} disableTotp\n * @property {() => Promise<object>} passkeyRegistrationOptions las opciones de WebAuthn para crear una llave\n * @property {(input: {name: string, credential: any}) => Promise<AccountSecurityChange>} savePasskey\n * @property {(input: {passkeyId: string, password: string}) => Promise<AccountSecurityChange>} removePasskey\n * @property {(password: string) => Promise<AccountSecurityChange>} regenerateRecoveryCodes\n * @property {() => Promise<AccountDeviceSession[]>} listSessions\n * @property {() => Promise<number>} closeOtherSessions cuántas cerró\n * @property {() => Promise<AccountEvent[]>} listActivity de lo más nuevo a lo más viejo\n * @property {() => Promise<string|null>} [demoTotpCode] SOLO en la demostración: el código que enseñaría la app ahorita\n *     (con él sale el botón «Usar el código de ejemplo»)\n */\n\n/** Las funciones que todo conector trae (demoTotpCode es opcional: solo la demostración). */\nexport const ACCOUNT_CONNECTOR_FUNCTIONS = Object.freeze([\n    'loadSession', 'signIn', 'signInSecondStep', 'secondStepPasskeyOptions', 'signInWithPasskey', 'signOut', 'requestPasswordReset',\n    'resetPassword', 'updateProfile', 'changePassword', 'loadSecurity', 'startTotp', 'confirmTotp', 'disableTotp',\n    'passkeyRegistrationOptions', 'savePasskey', 'removePasskey', 'regenerateRecoveryCodes', 'listSessions', 'closeOtherSessions',\n    'listActivity',\n]);\n\n/**\n * Las funciones que le faltan al conector (un error de quien lo escribió: se avisa al arrancar, no al picar un botón).\n *\n * @param {object|null|undefined} connector\n * @returns {string[]}\n */\nexport function missingConnectorFunctionsOf(connector) {\n    return ACCOUNT_CONNECTOR_FUNCTIONS.filter((name) => typeof connector?.[name] !== 'function');\n}\n"],"names":[],"mappings":"AAkHY,MAAC,8BAA8B,OAAO,OAAO;AAAA,EACrD;AAAA,EAAe;AAAA,EAAU;AAAA,EAAoB;AAAA,EAA4B;AAAA,EAAqB;AAAA,EAAW;AAAA,EACzG;AAAA,EAAiB;AAAA,EAAiB;AAAA,EAAkB;AAAA,EAAgB;AAAA,EAAa;AAAA,EAAe;AAAA,EAChG;AAAA,EAA8B;AAAA,EAAe;AAAA,EAAiB;AAAA,EAA2B;AAAA,EAAgB;AAAA,EACzG;AACJ,CAAC;AAQM,SAAS,4BAA4B,WAAW;AACnD,SAAO,4BAA4B,OAAO,CAAC,SAAS,OAAO,YAAY,IAAI,MAAM,UAAU;AAC/F;"}

package/dist/account/demo/createDemoAccountConnector.js

@@ -0,0 +1,368 @@
+import { ApiError } from "../../api/ApiError.js";
+import { totpCodeAt, newTotpSecret, isValidTotpCode, otpauthUrlOf } from "./totp.js";
+import { translateToolkit } from "../../toolkit/toolkitSettings.js";
+const HTTP_STATUS = Object.freeze({ unauthorized: 401, unprocessable: 422, locked: 423 });
+const DEMO_USER = Object.freeze({ id: "user-demo", name: "Ana Martínez Ruiz", email: "ana.martinez@ejemplo.com", subtitle: "Administración", phone: "" });
+const DEFAULT_STORAGE_KEY = "calcita-demo:session";
+const DEFAULT_DELAY_MILLISECONDS = 400;
+const DEFAULT_ISSUER = "Calcita";
+const RECOVERY_CODE_COUNT = 10;
+const RECOVERY_CODE_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
+const SECOND_STEP_ATTEMPTS = 5;
+const SECOND_STEP_MINUTES = 5;
+const MILLISECONDS_PER_MINUTE = 6e4;
+const MILLISECONDS_PER_HOUR = 60 * MILLISECONDS_PER_MINUTE;
+const PASSKEY_TIMEOUT_MILLISECONDS = 6e4;
+const CHALLENGE_BYTES = 32;
+const ES256 = -7;
+const RS256 = -257;
+const METHOD = Object.freeze({ passkey: "passkey", totp: "totp", recoveryCode: "recoveryCode" });
+const THIS_NETWORK = "187.190.x.x";
+const messageOf = (key, values) => translateToolkit("account", `demo.server.${key}`, values);
+function base64UrlOf(bytes) {
+  return btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function thisDevice() {
+  const userAgent = typeof navigator === "undefined" ? "" : navigator.userAgent;
+  const browser = /Edg\//.test(userAgent) ? "Edge" : /Firefox\//.test(userAgent) ? "Firefox" : /Chrome\//.test(userAgent) ? "Chrome" : /Safari\//.test(userAgent) ? "Safari" : null;
+  const platform = /iPhone|iPad/.test(userAgent) ? "iOS" : /Android/.test(userAgent) ? "Android" : /Mac OS X/.test(userAgent) ? "macOS" : /Windows/.test(userAgent) ? "Windows" : /Linux/.test(userAgent) ? "Linux" : null;
+  return { browser, platform, isMobile: /iPhone|Android.*Mobile/.test(userAgent) };
+}
+function newRecoveryCodes() {
+  return Array.from({ length: RECOVERY_CODE_COUNT }, () => {
+    const characters = Array.from(crypto.getRandomValues(new Uint8Array(10)), (byte) => RECOVERY_CODE_ALPHABET[byte % RECOVERY_CODE_ALPHABET.length]);
+    return `${characters.slice(0, 5).join("")}-${characters.slice(5).join("")}`;
+  });
+}
+function fieldError(field, message) {
+  return new ApiError({
+    status: HTTP_STATUS.unprocessable,
+    problem: { title: messageOf("validationTitle"), detail: messageOf("validationDetail"), errors: { [field]: [message] } }
+  });
+}
+function createDemoAccountConnector({
+  user = DEMO_USER,
+  roles = ["admin"],
+  abilities = [],
+  labels = [],
+  storageKey = DEFAULT_STORAGE_KEY,
+  toQrImageUrl,
+  issuer = DEFAULT_ISSUER,
+  delayMilliseconds = DEFAULT_DELAY_MILLISECONDS
+} = {}) {
+  const profile = { ...user };
+  const security = initialSecurity();
+  let pendingSecondStep = null;
+  const wait = () => new Promise((resolve) => setTimeout(resolve, delayMilliseconds));
+  function initialSecurity() {
+    const now = Date.now();
+    const device = thisDevice();
+    const deviceName = `${device.browser ?? "—"} · ${device.platform ?? "—"}`;
+    return {
+      totp: null,
+      pendingTotpSecret: null,
+      passkeys: [],
+      recoveryCodes: [],
+      enabledAt: null,
+      sessions: [
+        { id: "session-this", ...device, startedAt: new Date(now - 2 * MILLISECONDS_PER_HOUR).toISOString(), network: THIS_NETWORK, isCurrent: true },
+        {
+          id: "session-phone",
+          browser: "Safari",
+          platform: "iOS",
+          isMobile: true,
+          startedAt: new Date(now - 26 * MILLISECONDS_PER_HOUR).toISOString(),
+          network: "201.141.x.x",
+          isCurrent: false
+        }
+      ],
+      // de lo más nuevo a lo más viejo
+      events: [
+        { id: "event-2", kind: "signedIn", occurredAt: new Date(now - 2 * MILLISECONDS_PER_HOUR).toISOString(), device: deviceName, network: THIS_NETWORK },
+        { id: "event-1", kind: "signInFailed", occurredAt: new Date(now - 30 * MILLISECONDS_PER_HOUR).toISOString(), device: "Firefox · Windows", network: "177.230.x.x" }
+      ]
+    };
+  }
+  const isSignedIn = () => {
+    try {
+      return window.localStorage.getItem(storageKey) === profile.id;
+    } catch {
+      return false;
+    }
+  };
+  const rememberSession = (signedIn) => {
+    try {
+      if (signedIn) {
+        window.localStorage.setItem(storageKey, profile.id);
+      } else {
+        window.localStorage.removeItem(storageKey);
+      }
+    } catch {
+    }
+  };
+  const failIfSignedOut = () => {
+    if (!isSignedIn()) {
+      throw new ApiError({ status: HTTP_STATUS.unauthorized, problem: { title: messageOf("noSessionTitle"), detail: messageOf("noSession") } });
+    }
+  };
+  const failWithoutPassword = (password) => {
+    if (!password) {
+      throw fieldError("password", messageOf("passwordRequired"));
+    }
+  };
+  const recordEvent = (kind) => {
+    const device = thisDevice();
+    security.events.unshift({
+      id: `event-${Date.now()}-${security.events.length}`,
+      kind,
+      occurredAt: (/* @__PURE__ */ new Date()).toISOString(),
+      device: `${device.browser ?? "—"} · ${device.platform ?? "—"}`,
+      network: THIS_NETWORK
+    });
+  };
+  const isSecondFactorOn = () => Boolean(security.totp) || security.passkeys.length > 0;
+  const securityNow = () => ({
+    isEnabled: isSecondFactorOn(),
+    enabledAt: security.enabledAt,
+    passkeys: security.passkeys.map(({ id, name, createdAt, lastUsedAt }) => ({ id, name, createdAt, lastUsedAt })),
+    totp: { isEnabled: Boolean(security.totp), enabledAt: security.totp?.enabledAt ?? null },
+    recoveryCodesRemaining: security.recoveryCodes.length
+  });
+  const turnOnIfFirstFactor = (wasOn) => {
+    if (wasOn) {
+      return void 0;
+    }
+    security.enabledAt = (/* @__PURE__ */ new Date()).toISOString();
+    security.recoveryCodes = newRecoveryCodes();
+    recordEvent("twoStepEnabled");
+    return [...security.recoveryCodes];
+  };
+  const turnOffIfNoFactorLeft = () => {
+    if (!isSecondFactorOn()) {
+      security.enabledAt = null;
+      security.recoveryCodes = [];
+      recordEvent("twoStepDisabled");
+    }
+  };
+  const pendingOrFail = () => {
+    if (!pendingSecondStep || Date.now() > pendingSecondStep.expiresAt) {
+      pendingSecondStep = null;
+      throw new ApiError({ status: HTTP_STATUS.unauthorized, problem: { code: "second_step_expired", title: messageOf("expiredTitle"), detail: messageOf("expired") } });
+    }
+  };
+  const failSecondStep = () => {
+    pendingSecondStep.attemptsLeft -= 1;
+    recordEvent("signInFailed");
+    if (pendingSecondStep.attemptsLeft <= 0) {
+      pendingSecondStep = null;
+      throw new ApiError({ status: HTTP_STATUS.locked, problem: { code: "account_locked", title: messageOf("lockedTitle"), detail: messageOf("locked") } });
+    }
+    throw new ApiError({
+      status: HTTP_STATUS.unauthorized,
+      problem: { code: "invalid_code", title: messageOf("wrongCodeTitle"), detail: messageOf("wrongCode"), remaining_attempts: pendingSecondStep.attemptsLeft }
+    });
+  };
+  const finishSignIn = (kind = "signedIn") => {
+    pendingSecondStep = null;
+    rememberSession(true);
+    recordEvent(kind);
+  };
+  const passkeyChallenge = () => base64UrlOf(crypto.getRandomValues(new Uint8Array(CHALLENGE_BYTES)));
+  return {
+    loadSession: async () => {
+      await wait();
+      return isSignedIn() ? { user: { ...profile }, roles: [...roles], abilities: [...abilities], labels: [...labels] } : null;
+    },
+    signIn: async ({ email }) => {
+      await wait();
+      if (email?.trim().toLowerCase() !== profile.email.toLowerCase()) {
+        throw new ApiError({
+          status: HTTP_STATUS.unauthorized,
+          problem: { title: messageOf("wrongCredentialsTitle"), detail: messageOf("wrongCredentials", { email: profile.email }) }
+        });
+      }
+      if (!isSecondFactorOn()) {
+        finishSignIn();
+        return { secondStep: null };
+      }
+      pendingSecondStep = { expiresAt: Date.now() + SECOND_STEP_MINUTES * MILLISECONDS_PER_MINUTE, attemptsLeft: SECOND_STEP_ATTEMPTS };
+      const methods = [
+        ...security.passkeys.length > 0 ? [METHOD.passkey] : [],
+        ...security.totp ? [METHOD.totp] : [],
+        ...security.recoveryCodes.length > 0 ? [METHOD.recoveryCode] : []
+      ];
+      return { secondStep: { methods } };
+    },
+    signInSecondStep: async ({ method, code }) => {
+      await wait();
+      pendingOrFail();
+      if (method === METHOD.recoveryCode) {
+        if (!security.recoveryCodes.includes(code)) {
+          failSecondStep();
+        }
+        security.recoveryCodes = security.recoveryCodes.filter((unusedCode) => unusedCode !== code);
+        finishSignIn("recoveryCodeUsed");
+        return;
+      }
+      if (!security.totp || !await isValidTotpCode(security.totp.secret, code)) {
+        failSecondStep();
+      }
+      finishSignIn();
+    },
+    secondStepPasskeyOptions: async () => {
+      await wait();
+      pendingOrFail();
+      return {
+        challenge: passkeyChallenge(),
+        rpId: window.location.hostname,
+        userVerification: "preferred",
+        timeout: PASSKEY_TIMEOUT_MILLISECONDS,
+        allowCredentials: security.passkeys.map((passkey) => ({ id: passkey.credentialId, type: "public-key" }))
+      };
+    },
+    signInWithPasskey: async (credential) => {
+      await wait();
+      pendingOrFail();
+      const passkey = security.passkeys.find((candidate) => candidate.credentialId === credential?.id);
+      if (!passkey) {
+        failSecondStep();
+      }
+      passkey.lastUsedAt = (/* @__PURE__ */ new Date()).toISOString();
+      finishSignIn();
+    },
+    signOut: async () => {
+      await wait();
+      rememberSession(false);
+    },
+    requestPasswordReset: async () => {
+      await wait();
+    },
+    resetPassword: async () => {
+      await wait();
+      recordEvent("passwordChanged");
+    },
+    updateProfile: async ({ name, phone }) => {
+      await wait();
+      failIfSignedOut();
+      if (!name?.trim()) {
+        throw fieldError("name", messageOf("nameRequired"));
+      }
+      profile.name = name.trim();
+      profile.phone = phone?.trim() ?? "";
+      return { message: messageOf("profileSaved") };
+    },
+    changePassword: async () => {
+      await wait();
+      failIfSignedOut();
+      recordEvent("passwordChanged");
+    },
+    loadSecurity: async () => {
+      await wait();
+      failIfSignedOut();
+      return securityNow();
+    },
+    startTotp: async () => {
+      await wait();
+      failIfSignedOut();
+      security.pendingTotpSecret = newTotpSecret();
+      const otpauthUrl = otpauthUrlOf({ secret: security.pendingTotpSecret, account: profile.email, issuer });
+      return { secret: security.pendingTotpSecret, qrImageUrl: toQrImageUrl ? await toQrImageUrl(otpauthUrl) : null };
+    },
+    confirmTotp: async (code) => {
+      await wait();
+      failIfSignedOut();
+      if (!security.pendingTotpSecret || !await isValidTotpCode(security.pendingTotpSecret, code)) {
+        throw fieldError("code", messageOf("wrongCode"));
+      }
+      const wasOn = isSecondFactorOn();
+      security.totp = { secret: security.pendingTotpSecret, enabledAt: (/* @__PURE__ */ new Date()).toISOString() };
+      security.pendingTotpSecret = null;
+      const recoveryCodes = turnOnIfFirstFactor(wasOn);
+      return { security: securityNow(), recoveryCodes };
+    },
+    disableTotp: async (password) => {
+      await wait();
+      failIfSignedOut();
+      failWithoutPassword(password);
+      security.totp = null;
+      turnOffIfNoFactorLeft();
+      return { security: securityNow() };
+    },
+    passkeyRegistrationOptions: async () => {
+      await wait();
+      failIfSignedOut();
+      return {
+        challenge: passkeyChallenge(),
+        rp: { name: issuer, id: window.location.hostname },
+        user: { id: base64UrlOf(new TextEncoder().encode(profile.id)), name: profile.email, displayName: profile.name },
+        pubKeyCredParams: [{ type: "public-key", alg: ES256 }, { type: "public-key", alg: RS256 }],
+        timeout: PASSKEY_TIMEOUT_MILLISECONDS,
+        attestation: "none",
+        // las que ya tiene: el navegador avisa si la persona intenta registrar la misma otra vez
+        excludeCredentials: security.passkeys.map((passkey) => ({ id: passkey.credentialId, type: "public-key" })),
+        authenticatorSelection: { residentKey: "preferred", userVerification: "preferred" }
+      };
+    },
+    savePasskey: async ({ name, credential }) => {
+      await wait();
+      failIfSignedOut();
+      const wasOn = isSecondFactorOn();
+      security.passkeys.push({
+        id: `passkey-${Date.now()}`,
+        credentialId: credential?.id,
+        name: name?.trim() || messageOf("defaultPasskeyName", { number: security.passkeys.length + 1 }),
+        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+        lastUsedAt: null
+      });
+      recordEvent("passkeyAdded");
+      const recoveryCodes = turnOnIfFirstFactor(wasOn);
+      return { security: securityNow(), recoveryCodes };
+    },
+    removePasskey: async ({ passkeyId, password }) => {
+      await wait();
+      failIfSignedOut();
+      failWithoutPassword(password);
+      security.passkeys = security.passkeys.filter((passkey) => passkey.id !== passkeyId);
+      recordEvent("passkeyRemoved");
+      turnOffIfNoFactorLeft();
+      return { security: securityNow() };
+    },
+    regenerateRecoveryCodes: async (password) => {
+      await wait();
+      failIfSignedOut();
+      failWithoutPassword(password);
+      security.recoveryCodes = newRecoveryCodes();
+      recordEvent("recoveryCodesGenerated");
+      return { security: securityNow(), recoveryCodes: [...security.recoveryCodes] };
+    },
+    listSessions: async () => {
+      await wait();
+      failIfSignedOut();
+      return security.sessions.map((session) => ({ ...session }));
+    },
+    closeOtherSessions: async () => {
+      await wait();
+      failIfSignedOut();
+      const closed = security.sessions.filter((session) => !session.isCurrent).length;
+      security.sessions = security.sessions.filter((session) => session.isCurrent);
+      if (closed > 0) {
+        recordEvent("sessionsClosed");
+      }
+      return closed;
+    },
+    listActivity: async () => {
+      await wait();
+      failIfSignedOut();
+      return security.events.map((event) => ({ ...event }));
+    },
+    // solo de la demostración: el código que enseñaría la app ahorita, con la clave por activar o la ya activa
+    demoTotpCode: async () => {
+      const secret = security.pendingTotpSecret ?? security.totp?.secret;
+      return secret ? totpCodeAt(secret) : null;
+    }
+  };
+}
+export {
+  createDemoAccountConnector
+};
+//# sourceMappingURL=createDemoAccountConnector.js.map

package/dist/account/demo/createDemoAccountConnector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createDemoAccountConnector.js","sources":["../../../src/account/demo/createDemoAccountConnector.js"],"sourcesContent":["// El conector de la cuenta de DEMOSTRACIÓN (@stackcraftmx/calcita/account-demo): todo vive en el navegador, para arrancar\n// un proyecto sin backend y ver las pantallas de la cuenta funcionando. Se cambia por el de verdad sin tocar las pantallas:\n//\n//   export const accountConnector = API_URL ? createRestAccountConnector(apiClient) : createDemoAccountConnector();\n//\n// Lo que hace de verdad: la clave de la app autenticadora es real (con toQrImageUrl sale en un QR que su app escanea) y el\n// código de 6 dígitos se revisa con el mismo cálculo que un servidor (totp.js); las llaves de acceso le hablan al navegador\n// de verdad (Touch ID, Face ID, Windows Hello). Lo que NO hace: revisar contraseñas (entra el correo de la cuenta con\n// cualquiera) ni la firma de las llaves, que un servidor revisa con su librería.\n//\n// La sesión se recuerda en este navegador (localStorage); la seguridad vive en la memoria de la pestaña: al recargar, la\n// verificación en dos pasos vuelve a estar apagada. Los mensajes salen en el idioma de la app, como los mandaría un backend.\n//\n// Funciones del servidor de demostración, sin React: function (regla de la casa). Pruebas en createDemoAccountConnector.test.js.\nimport {ApiError} from '@/api/ApiError.js';\nimport {isValidTotpCode, newTotpSecret, otpauthUrlOf, totpCodeAt} from '@/account/demo/totp.js';\nimport {translateToolkit} from '@/toolkit/toolkitSettings.js';\n\nconst HTTP_STATUS = Object.freeze({unauthorized: 401, unprocessable: 422, locked: 423});\n// la persona de la demostración (datos inventados)\nconst DEMO_USER = Object.freeze({id: 'user-demo', name: 'Ana Martínez Ruiz', email: 'ana.martinez@ejemplo.com', subtitle: 'Administración', phone: ''});\nconst DEFAULT_STORAGE_KEY = 'calcita-demo:session';\n// lo que tarda una respuesta: sin espera no se verían los botones ocupados\nconst DEFAULT_DELAY_MILLISECONDS = 400;\n// quién emite la cuenta en la app autenticadora (lo que se ve arriba del código)\nconst DEFAULT_ISSUER = 'Calcita';\n// los códigos de recuperación: 10, de la forma ABCDE-FGHJK, sin letras que se confunden (I, O, 0, 1)\nconst RECOVERY_CODE_COUNT = 10;\nconst RECOVERY_CODE_ALPHABET = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';\n// el segundo paso: cuántos códigos equivocados se aceptan y cuánto tiempo hay para escribirlo\nconst SECOND_STEP_ATTEMPTS = 5;\nconst SECOND_STEP_MINUTES = 5;\nconst MILLISECONDS_PER_MINUTE = 60_000;\nconst MILLISECONDS_PER_HOUR = 60 * MILLISECONDS_PER_MINUTE;\nconst PASSKEY_TIMEOUT_MILLISECONDS = 60_000;\nconst CHALLENGE_BYTES = 32;\n// los algoritmos de firma que se aceptan para las llaves (los números de COSE: ES256 y RS256)\nconst ES256 = -7;\nconst RS256 = -257;\n// las formas del segundo paso (SECOND_STEP_METHOD de /forms)\nconst METHOD = Object.freeze({passkey: 'passkey', totp: 'totp', recoveryCode: 'recoveryCode'});\n// la red como la enseñaría un servidor: a medias, nunca la IP completa\nconst THIS_NETWORK = '187.190.x.x';\n\n/** Un mensaje del servidor de demostración en el idioma de la app. */\nconst messageOf = (key, values) => translateToolkit('account', `demo.server.${key}`, values);\n\n/** Bytes → base64url (como viajan los retos y los ids de WebAuthn). */\nfunction base64UrlOf(bytes) {\n    return btoa(String.fromCharCode(...bytes)).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\n/** Este equipo según su user agent, como lo resumiría el servidor. */\nfunction thisDevice() {\n    const userAgent = typeof navigator === 'undefined' ? '' : navigator.userAgent;\n    const browser = /Edg\\//.test(userAgent) ? 'Edge' : /Firefox\\//.test(userAgent) ? 'Firefox' : /Chrome\\//.test(userAgent) ? 'Chrome'\n        : /Safari\\//.test(userAgent) ? 'Safari' : null;\n    const platform = /iPhone|iPad/.test(userAgent) ? 'iOS' : /Android/.test(userAgent) ? 'Android' : /Mac OS X/.test(userAgent) ? 'macOS'\n        : /Windows/.test(userAgent) ? 'Windows' : /Linux/.test(userAgent) ? 'Linux' : null;\n    return {browser, platform, isMobile: /iPhone|Android.*Mobile/.test(userAgent)};\n}\n\n/** Diez códigos nuevos, de la forma ABCDE-FGHJK. */\nfunction newRecoveryCodes() {\n    return Array.from({length: RECOVERY_CODE_COUNT}, () => {\n        const characters = Array.from(crypto.getRandomValues(new Uint8Array(10)), (byte) => RECOVERY_CODE_ALPHABET[byte % RECOVERY_CODE_ALPHABET.length]);\n        return `${characters.slice(0, 5).join('')}-${characters.slice(5).join('')}`;\n    });\n}\n\n/** El 422 con el error en su campo. */\nfunction fieldError(field, message) {\n    return new ApiError({\n        status: HTTP_STATUS.unprocessable,\n        problem: {title: messageOf('validationTitle'), detail: messageOf('validationDetail'), errors: {[field]: [message]}},\n    });\n}\n\n/**\n * @param {object} [options]\n * @param {{id: string, name: string, email: string, subtitle?: string, phone?: string}} [options.user] la persona de la\n *     demostración; por omisión una inventada\n * @param {string[]} [options.roles]\n * @param {string[]} [options.abilities]\n * @param {string[]} [options.labels] sus perfiles, ya traducidos (chips en Mi perfil)\n * @param {string} [options.storageKey] dónde se recuerda la sesión en este navegador (con el nombre de la app)\n * @param {(otpauthUrl: string) => Promise<string>} [options.toQrImageUrl] el QR de la clave (p. ej. QRCode.toDataURL de\n *     la librería qrcode); sin él, la persona escribe la clave a mano en su app\n * @param {string} [options.issuer] el nombre que enseña la app autenticadora\n * @param {number} [options.delayMilliseconds] lo que tarda cada respuesta\n * @returns {import('@/account/accountConnector.js').AccountConnector}\n */\nexport function createDemoAccountConnector({\n    user = DEMO_USER, roles = ['admin'], abilities = [], labels = [], storageKey = DEFAULT_STORAGE_KEY, toQrImageUrl,\n    issuer = DEFAULT_ISSUER, delayMilliseconds = DEFAULT_DELAY_MILLISECONDS,\n} = {}) {\n    const profile = {...user};\n    // la seguridad de la cuenta, en la memoria de la pestaña (con su bitácora y sus sesiones de ejemplo)\n    const security = initialSecurity();\n    // la persona ya puso su contraseña y le falta el segundo paso\n    let pendingSecondStep = null;\n\n    const wait = () => new Promise((resolve) => setTimeout(resolve, delayMilliseconds));\n\n    function initialSecurity() {\n        const now = Date.now();\n        const device = thisDevice();\n        const deviceName = `${device.browser ?? '—'} · ${device.platform ?? '—'}`;\n        return {\n            totp: null,\n            pendingTotpSecret: null,\n            passkeys: [],\n            recoveryCodes: [],\n            enabledAt: null,\n            sessions: [\n                {id: 'session-this', ...device, startedAt: new Date(now - 2 * MILLISECONDS_PER_HOUR).toISOString(), network: THIS_NETWORK, isCurrent: true},\n                {id: 'session-phone', browser: 'Safari', platform: 'iOS', isMobile: true,\n                    startedAt: new Date(now - 26 * MILLISECONDS_PER_HOUR).toISOString(), network: '201.141.x.x', isCurrent: false},\n            ],\n            // de lo más nuevo a lo más viejo\n            events: [\n                {id: 'event-2', kind: 'signedIn', occurredAt: new Date(now - 2 * MILLISECONDS_PER_HOUR).toISOString(), device: deviceName, network: THIS_NETWORK},\n                {id: 'event-1', kind: 'signInFailed', occurredAt: new Date(now - 30 * MILLISECONDS_PER_HOUR).toISOString(), device: 'Firefox · Windows', network: '177.230.x.x'},\n            ],\n        };\n    }\n\n    // ─── la sesión en este navegador ───\n\n    const isSignedIn = () => {\n        try {\n            return window.localStorage.getItem(storageKey) === profile.id;\n        } catch {\n            return false;\n        }\n    };\n    const rememberSession = (signedIn) => {\n        try {\n            if (signedIn) {\n                window.localStorage.setItem(storageKey, profile.id);\n            } else {\n                window.localStorage.removeItem(storageKey);\n            }\n        } catch {\n            // almacenamiento bloqueado: la sesión dura lo que dure la pestaña\n        }\n    };\n    const failIfSignedOut = () => {\n        if (!isSignedIn()) {\n            throw new ApiError({status: HTTP_STATUS.unauthorized, problem: {title: messageOf('noSessionTitle'), detail: messageOf('noSession')}});\n        }\n    };\n    // lo que QUITA protección pide la contraseña; en la demostración sirve cualquiera que se escriba\n    const failWithoutPassword = (password) => {\n        if (!password) {\n            throw fieldError('password', messageOf('passwordRequired'));\n        }\n    };\n\n    // ─── la seguridad ───\n\n    const recordEvent = (kind) => {\n        const device = thisDevice();\n        security.events.unshift({\n            id: `event-${Date.now()}-${security.events.length}`, kind, occurredAt: new Date().toISOString(),\n            device: `${device.browser ?? '—'} · ${device.platform ?? '—'}`, network: THIS_NETWORK,\n        });\n    };\n    const isSecondFactorOn = () => Boolean(security.totp) || security.passkeys.length > 0;\n    const securityNow = () => ({\n        isEnabled: isSecondFactorOn(),\n        enabledAt: security.enabledAt,\n        passkeys: security.passkeys.map(({id, name, createdAt, lastUsedAt}) => ({id, name, createdAt, lastUsedAt})),\n        totp: {isEnabled: Boolean(security.totp), enabledAt: security.totp?.enabledAt ?? null},\n        recoveryCodesRemaining: security.recoveryCodes.length,\n    });\n    // la primera protección que se prende activa la verificación y genera los códigos (se enseñan una sola vez)\n    const turnOnIfFirstFactor = (wasOn) => {\n        if (wasOn) {\n            return undefined;\n        }\n        security.enabledAt = new Date().toISOString();\n        security.recoveryCodes = newRecoveryCodes();\n        recordEvent('twoStepEnabled');\n        return [...security.recoveryCodes];\n    };\n    // al quitar la última, la verificación se apaga y los códigos dejan de servir\n    const turnOffIfNoFactorLeft = () => {\n        if (!isSecondFactorOn()) {\n            security.enabledAt = null;\n            security.recoveryCodes = [];\n            recordEvent('twoStepDisabled');\n        }\n    };\n\n    // ─── el segundo paso ───\n\n    const pendingOrFail = () => {\n        if (!pendingSecondStep || Date.now() > pendingSecondStep.expiresAt) {\n            pendingSecondStep = null;\n            throw new ApiError({status: HTTP_STATUS.unauthorized, problem: {code: 'second_step_expired', title: messageOf('expiredTitle'), detail: messageOf('expired')}});\n        }\n    };\n    // un código equivocado resta un intento; sin intentos se bloquea (423) y hay que empezar de nuevo\n    const failSecondStep = () => {\n        pendingSecondStep.attemptsLeft -= 1;\n        recordEvent('signInFailed');\n        if (pendingSecondStep.attemptsLeft <= 0) {\n            pendingSecondStep = null;\n            throw new ApiError({status: HTTP_STATUS.locked, problem: {code: 'account_locked', title: messageOf('lockedTitle'), detail: messageOf('locked')}});\n        }\n        throw new ApiError({\n            status: HTTP_STATUS.unauthorized,\n            problem: {code: 'invalid_code', title: messageOf('wrongCodeTitle'), detail: messageOf('wrongCode'), remaining_attempts: pendingSecondStep.attemptsLeft},\n        });\n    };\n    const finishSignIn = (kind = 'signedIn') => {\n        pendingSecondStep = null;\n        rememberSession(true);\n        recordEvent(kind);\n    };\n    const passkeyChallenge = () => base64UrlOf(crypto.getRandomValues(new Uint8Array(CHALLENGE_BYTES)));\n\n    return {\n        loadSession: async () => {\n            await wait();\n            return isSignedIn() ? {user: {...profile}, roles: [...roles], abilities: [...abilities], labels: [...labels]} : null;\n        },\n        signIn: async ({email}) => {\n            await wait();\n            if (email?.trim().toLowerCase() !== profile.email.toLowerCase()) {\n                throw new ApiError({\n                    status: HTTP_STATUS.unauthorized,\n                    problem: {title: messageOf('wrongCredentialsTitle'), detail: messageOf('wrongCredentials', {email: profile.email})},\n                });\n            }\n            if (!isSecondFactorOn()) {\n                finishSignIn();\n                return {secondStep: null};\n            }\n            pendingSecondStep = {expiresAt: Date.now() + SECOND_STEP_MINUTES * MILLISECONDS_PER_MINUTE, attemptsLeft: SECOND_STEP_ATTEMPTS};\n            const methods = [\n                ...(security.passkeys.length > 0 ? [METHOD.passkey] : []),\n                ...(security.totp ? [METHOD.totp] : []),\n                ...(security.recoveryCodes.length > 0 ? [METHOD.recoveryCode] : []),\n            ];\n            return {secondStep: {methods}};\n        },\n        signInSecondStep: async ({method, code}) => {\n            await wait();\n            pendingOrFail();\n            if (method === METHOD.recoveryCode) {\n                if (!security.recoveryCodes.includes(code)) {\n                    failSecondStep();\n                }\n                // cada código sirve una sola vez\n                security.recoveryCodes = security.recoveryCodes.filter((unusedCode) => unusedCode !== code);\n                finishSignIn('recoveryCodeUsed');\n                return;\n            }\n            if (!security.totp || !(await isValidTotpCode(security.totp.secret, code))) {\n                failSecondStep();\n            }\n            finishSignIn();\n        },\n        secondStepPasskeyOptions: async () => {\n            await wait();\n            pendingOrFail();\n            return {\n                challenge: passkeyChallenge(), rpId: window.location.hostname, userVerification: 'preferred', timeout: PASSKEY_TIMEOUT_MILLISECONDS,\n                allowCredentials: security.passkeys.map((passkey) => ({id: passkey.credentialId, type: 'public-key'})),\n            };\n        },\n        signInWithPasskey: async (credential) => {\n            await wait();\n            pendingOrFail();\n            const passkey = security.passkeys.find((candidate) => candidate.credentialId === credential?.id);\n            if (!passkey) {\n                failSecondStep();\n            }\n            passkey.lastUsedAt = new Date().toISOString();\n            finishSignIn();\n        },\n        signOut: async () => {\n            await wait();\n            rememberSession(false);\n        },\n        requestPasswordReset: async () => {\n            await wait();\n        },\n        resetPassword: async () => {\n            await wait();\n            recordEvent('passwordChanged');\n        },\n        updateProfile: async ({name, phone}) => {\n            await wait();\n            failIfSignedOut();\n            if (!name?.trim()) {\n                throw fieldError('name', messageOf('nameRequired'));\n            }\n            profile.name = name.trim();\n            profile.phone = phone?.trim() ?? '';\n            return {message: messageOf('profileSaved')};\n        },\n        changePassword: async () => {\n            await wait();\n            failIfSignedOut();\n            recordEvent('passwordChanged');\n        },\n        loadSecurity: async () => {\n            await wait();\n            failIfSignedOut();\n            return securityNow();\n        },\n        startTotp: async () => {\n            await wait();\n            failIfSignedOut();\n            security.pendingTotpSecret = newTotpSecret();\n            const otpauthUrl = otpauthUrlOf({secret: security.pendingTotpSecret, account: profile.email, issuer});\n            return {secret: security.pendingTotpSecret, qrImageUrl: toQrImageUrl ? await toQrImageUrl(otpauthUrl) : null};\n        },\n        confirmTotp: async (code) => {\n            await wait();\n            failIfSignedOut();\n            if (!security.pendingTotpSecret || !(await isValidTotpCode(security.pendingTotpSecret, code))) {\n                throw fieldError('code', messageOf('wrongCode'));\n            }\n            const wasOn = isSecondFactorOn();\n            security.totp = {secret: security.pendingTotpSecret, enabledAt: new Date().toISOString()};\n            security.pendingTotpSecret = null;\n            const recoveryCodes = turnOnIfFirstFactor(wasOn);\n            return {security: securityNow(), recoveryCodes};\n        },\n        disableTotp: async (password) => {\n            await wait();\n            failIfSignedOut();\n            failWithoutPassword(password);\n            security.totp = null;\n            turnOffIfNoFactorLeft();\n            return {security: securityNow()};\n        },\n        passkeyRegistrationOptions: async () => {\n            await wait();\n            failIfSignedOut();\n            return {\n                challenge: passkeyChallenge(),\n                rp: {name: issuer, id: window.location.hostname},\n                user: {id: base64UrlOf(new TextEncoder().encode(profile.id)), name: profile.email, displayName: profile.name},\n                pubKeyCredParams: [{type: 'public-key', alg: ES256}, {type: 'public-key', alg: RS256}],\n                timeout: PASSKEY_TIMEOUT_MILLISECONDS,\n                attestation: 'none',\n                // las que ya tiene: el navegador avisa si la persona intenta registrar la misma otra vez\n                excludeCredentials: security.passkeys.map((passkey) => ({id: passkey.credentialId, type: 'public-key'})),\n                authenticatorSelection: {residentKey: 'preferred', userVerification: 'preferred'},\n            };\n        },\n        savePasskey: async ({name, credential}) => {\n            await wait();\n            failIfSignedOut();\n            const wasOn = isSecondFactorOn();\n            security.passkeys.push({\n                id: `passkey-${Date.now()}`, credentialId: credential?.id,\n                name: name?.trim() || messageOf('defaultPasskeyName', {number: security.passkeys.length + 1}),\n                createdAt: new Date().toISOString(), lastUsedAt: null,\n            });\n            recordEvent('passkeyAdded');\n            const recoveryCodes = turnOnIfFirstFactor(wasOn);\n            return {security: securityNow(), recoveryCodes};\n        },\n        removePasskey: async ({passkeyId, password}) => {\n            await wait();\n            failIfSignedOut();\n            failWithoutPassword(password);\n            security.passkeys = security.passkeys.filter((passkey) => passkey.id !== passkeyId);\n            recordEvent('passkeyRemoved');\n            turnOffIfNoFactorLeft();\n            return {security: securityNow()};\n        },\n        regenerateRecoveryCodes: async (password) => {\n            await wait();\n            failIfSignedOut();\n            failWithoutPassword(password);\n            security.recoveryCodes = newRecoveryCodes();\n            recordEvent('recoveryCodesGenerated');\n            return {security: securityNow(), recoveryCodes: [...security.recoveryCodes]};\n        },\n        listSessions: async () => {\n            await wait();\n            failIfSignedOut();\n            return security.sessions.map((session) => ({...session}));\n        },\n        closeOtherSessions: async () => {\n            await wait();\n            failIfSignedOut();\n            const closed = security.sessions.filter((session) => !session.isCurrent).length;\n            security.sessions = security.sessions.filter((session) => session.isCurrent);\n            if (closed > 0) {\n                recordEvent('sessionsClosed');\n            }\n            return closed;\n        },\n        listActivity: async () => {\n            await wait();\n            failIfSignedOut();\n            return security.events.map((event) => ({...event}));\n        },\n        // solo de la demostración: el código que enseñaría la app ahorita, con la clave por activar o la ya activa\n        demoTotpCode: async () => {\n            const secret = security.pendingTotpSecret ?? security.totp?.secret;\n            return secret ? totpCodeAt(secret) : null;\n        },\n    };\n}\n"],"names":[],"mappings":";;;AAkBA,MAAM,cAAc,OAAO,OAAO,EAAC,cAAc,KAAK,eAAe,KAAK,QAAQ,IAAG,CAAC;AAEtF,MAAM,YAAY,OAAO,OAAO,EAAC,IAAI,aAAa,MAAM,qBAAqB,OAAO,4BAA4B,UAAU,kBAAkB,OAAO,GAAE,CAAC;AACtJ,MAAM,sBAAsB;AAE5B,MAAM,6BAA6B;AAEnC,MAAM,iBAAiB;AAEvB,MAAM,sBAAsB;AAC5B,MAAM,yBAAyB;AAE/B,MAAM,uBAAuB;AAC7B,MAAM,sBAAsB;AAC5B,MAAM,0BAA0B;AAChC,MAAM,wBAAwB,KAAK;AACnC,MAAM,+BAA+B;AACrC,MAAM,kBAAkB;AAExB,MAAM,QAAQ;AACd,MAAM,QAAQ;AAEd,MAAM,SAAS,OAAO,OAAO,EAAC,SAAS,WAAW,MAAM,QAAQ,cAAc,eAAc,CAAC;AAE7F,MAAM,eAAe;AAGrB,MAAM,YAAY,CAAC,KAAK,WAAW,iBAAiB,WAAW,eAAe,GAAG,IAAI,MAAM;AAG3F,SAAS,YAAY,OAAO;AACxB,SAAO,KAAK,OAAO,aAAa,GAAG,KAAK,CAAC,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AACxG;AAGA,SAAS,aAAa;AAClB,QAAM,YAAY,OAAO,cAAc,cAAc,KAAK,UAAU;AACpE,QAAM,UAAU,QAAQ,KAAK,SAAS,IAAI,SAAS,YAAY,KAAK,SAAS,IAAI,YAAY,WAAW,KAAK,SAAS,IAAI,WACpH,WAAW,KAAK,SAAS,IAAI,WAAW;AAC9C,QAAM,WAAW,cAAc,KAAK,SAAS,IAAI,QAAQ,UAAU,KAAK,SAAS,IAAI,YAAY,WAAW,KAAK,SAAS,IAAI,UACxH,UAAU,KAAK,SAAS,IAAI,YAAY,QAAQ,KAAK,SAAS,IAAI,UAAU;AAClF,SAAO,EAAC,SAAS,UAAU,UAAU,yBAAyB,KAAK,SAAS,EAAC;AACjF;AAGA,SAAS,mBAAmB;AACxB,SAAO,MAAM,KAAK,EAAC,QAAQ,oBAAmB,GAAG,MAAM;AACnD,UAAM,aAAa,MAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC,GAAG,CAAC,SAAS,uBAAuB,OAAO,uBAAuB,MAAM,CAAC;AAChJ,WAAO,GAAG,WAAW,MAAM,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,WAAW,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;AAAA,EAC7E,CAAC;AACL;AAGA,SAAS,WAAW,OAAO,SAAS;AAChC,SAAO,IAAI,SAAS;AAAA,IAChB,QAAQ,YAAY;AAAA,IACpB,SAAS,EAAC,OAAO,UAAU,iBAAiB,GAAG,QAAQ,UAAU,kBAAkB,GAAG,QAAQ,EAAC,CAAC,KAAK,GAAG,CAAC,OAAO,EAAC,EAAC;AAAA,EAC1H,CAAK;AACL;AAgBO,SAAS,2BAA2B;AAAA,EACvC,OAAO;AAAA,EAAW,QAAQ,CAAC,OAAO;AAAA,EAAG,YAAY,CAAA;AAAA,EAAI,SAAS,CAAA;AAAA,EAAI,aAAa;AAAA,EAAqB;AAAA,EACpG,SAAS;AAAA,EAAgB,oBAAoB;AACjD,IAAI,IAAI;AACJ,QAAM,UAAU,EAAC,GAAG,KAAI;AAExB,QAAM,WAAW,gBAAe;AAEhC,MAAI,oBAAoB;AAExB,QAAM,OAAO,MAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,iBAAiB,CAAC;AAElF,WAAS,kBAAkB;AACvB,UAAM,MAAM,KAAK,IAAG;AACpB,UAAM,SAAS,WAAU;AACzB,UAAM,aAAa,GAAG,OAAO,WAAW,GAAG,MAAM,OAAO,YAAY,GAAG;AACvE,WAAO;AAAA,MACH,MAAM;AAAA,MACN,mBAAmB;AAAA,MACnB,UAAU,CAAA;AAAA,MACV,eAAe,CAAA;AAAA,MACf,WAAW;AAAA,MACX,UAAU;AAAA,QACN,EAAC,IAAI,gBAAgB,GAAG,QAAQ,WAAW,IAAI,KAAK,MAAM,IAAI,qBAAqB,EAAE,YAAW,GAAI,SAAS,cAAc,WAAW,KAAI;AAAA,QAC1I;AAAA,UAAC,IAAI;AAAA,UAAiB,SAAS;AAAA,UAAU,UAAU;AAAA,UAAO,UAAU;AAAA,UAChE,WAAW,IAAI,KAAK,MAAM,KAAK,qBAAqB,EAAE,YAAW;AAAA,UAAI,SAAS;AAAA,UAAe,WAAW;AAAA,QAAK;AAAA,MACjI;AAAA;AAAA,MAEY,QAAQ;AAAA,QACJ,EAAC,IAAI,WAAW,MAAM,YAAY,YAAY,IAAI,KAAK,MAAM,IAAI,qBAAqB,EAAE,YAAW,GAAI,QAAQ,YAAY,SAAS,aAAY;AAAA,QAChJ,EAAC,IAAI,WAAW,MAAM,gBAAgB,YAAY,IAAI,KAAK,MAAM,KAAK,qBAAqB,EAAE,YAAW,GAAI,QAAQ,qBAAqB,SAAS,cAAa;AAAA,MAC/K;AAAA,IACA;AAAA,EACI;AAIA,QAAM,aAAa,MAAM;AACrB,QAAI;AACA,aAAO,OAAO,aAAa,QAAQ,UAAU,MAAM,QAAQ;AAAA,IAC/D,QAAQ;AACJ,aAAO;AAAA,IACX;AAAA,EACJ;AACA,QAAM,kBAAkB,CAAC,aAAa;AAClC,QAAI;AACA,UAAI,UAAU;AACV,eAAO,aAAa,QAAQ,YAAY,QAAQ,EAAE;AAAA,MACtD,OAAO;AACH,eAAO,aAAa,WAAW,UAAU;AAAA,MAC7C;AAAA,IACJ,QAAQ;AAAA,IAER;AAAA,EACJ;AACA,QAAM,kBAAkB,MAAM;AAC1B,QAAI,CAAC,WAAU,GAAI;AACf,YAAM,IAAI,SAAS,EAAC,QAAQ,YAAY,cAAc,SAAS,EAAC,OAAO,UAAU,gBAAgB,GAAG,QAAQ,UAAU,WAAW,EAAC,EAAC,CAAC;AAAA,IACxI;AAAA,EACJ;AAEA,QAAM,sBAAsB,CAAC,aAAa;AACtC,QAAI,CAAC,UAAU;AACX,YAAM,WAAW,YAAY,UAAU,kBAAkB,CAAC;AAAA,IAC9D;AAAA,EACJ;AAIA,QAAM,cAAc,CAAC,SAAS;AAC1B,UAAM,SAAS,WAAU;AACzB,aAAS,OAAO,QAAQ;AAAA,MACpB,IAAI,SAAS,KAAK,IAAG,CAAE,IAAI,SAAS,OAAO,MAAM;AAAA,MAAI;AAAA,MAAM,aAAY,oBAAI,KAAI,GAAG,YAAW;AAAA,MAC7F,QAAQ,GAAG,OAAO,WAAW,GAAG,MAAM,OAAO,YAAY,GAAG;AAAA,MAAI,SAAS;AAAA,IACrF,CAAS;AAAA,EACL;AACA,QAAM,mBAAmB,MAAM,QAAQ,SAAS,IAAI,KAAK,SAAS,SAAS,SAAS;AACpF,QAAM,cAAc,OAAO;AAAA,IACvB,WAAW,iBAAgB;AAAA,IAC3B,WAAW,SAAS;AAAA,IACpB,UAAU,SAAS,SAAS,IAAI,CAAC,EAAC,IAAI,MAAM,WAAW,WAAU,OAAO,EAAC,IAAI,MAAM,WAAW,WAAU,EAAE;AAAA,IAC1G,MAAM,EAAC,WAAW,QAAQ,SAAS,IAAI,GAAG,WAAW,SAAS,MAAM,aAAa,KAAI;AAAA,IACrF,wBAAwB,SAAS,cAAc;AAAA,EACvD;AAEI,QAAM,sBAAsB,CAAC,UAAU;AACnC,QAAI,OAAO;AACP,aAAO;AAAA,IACX;AACA,aAAS,aAAY,oBAAI,KAAI,GAAG,YAAW;AAC3C,aAAS,gBAAgB,iBAAgB;AACzC,gBAAY,gBAAgB;AAC5B,WAAO,CAAC,GAAG,SAAS,aAAa;AAAA,EACrC;AAEA,QAAM,wBAAwB,MAAM;AAChC,QAAI,CAAC,iBAAgB,GAAI;AACrB,eAAS,YAAY;AACrB,eAAS,gBAAgB,CAAA;AACzB,kBAAY,iBAAiB;AAAA,IACjC;AAAA,EACJ;AAIA,QAAM,gBAAgB,MAAM;AACxB,QAAI,CAAC,qBAAqB,KAAK,IAAG,IAAK,kBAAkB,WAAW;AAChE,0BAAoB;AACpB,YAAM,IAAI,SAAS,EAAC,QAAQ,YAAY,cAAc,SAAS,EAAC,MAAM,uBAAuB,OAAO,UAAU,cAAc,GAAG,QAAQ,UAAU,SAAS,EAAC,EAAC,CAAC;AAAA,IACjK;AAAA,EACJ;AAEA,QAAM,iBAAiB,MAAM;AACzB,sBAAkB,gBAAgB;AAClC,gBAAY,cAAc;AAC1B,QAAI,kBAAkB,gBAAgB,GAAG;AACrC,0BAAoB;AACpB,YAAM,IAAI,SAAS,EAAC,QAAQ,YAAY,QAAQ,SAAS,EAAC,MAAM,kBAAkB,OAAO,UAAU,aAAa,GAAG,QAAQ,UAAU,QAAQ,EAAC,EAAC,CAAC;AAAA,IACpJ;AACA,UAAM,IAAI,SAAS;AAAA,MACf,QAAQ,YAAY;AAAA,MACpB,SAAS,EAAC,MAAM,gBAAgB,OAAO,UAAU,gBAAgB,GAAG,QAAQ,UAAU,WAAW,GAAG,oBAAoB,kBAAkB,aAAY;AAAA,IAClK,CAAS;AAAA,EACL;AACA,QAAM,eAAe,CAAC,OAAO,eAAe;AACxC,wBAAoB;AACpB,oBAAgB,IAAI;AACpB,gBAAY,IAAI;AAAA,EACpB;AACA,QAAM,mBAAmB,MAAM,YAAY,OAAO,gBAAgB,IAAI,WAAW,eAAe,CAAC,CAAC;AAElG,SAAO;AAAA,IACH,aAAa,YAAY;AACrB,YAAM,KAAI;AACV,aAAO,WAAU,IAAK,EAAC,MAAM,EAAC,GAAG,QAAO,GAAG,OAAO,CAAC,GAAG,KAAK,GAAG,WAAW,CAAC,GAAG,SAAS,GAAG,QAAQ,CAAC,GAAG,MAAM,EAAC,IAAI;AAAA,IACpH;AAAA,IACA,QAAQ,OAAO,EAAC,MAAK,MAAM;AACvB,YAAM,KAAI;AACV,UAAI,OAAO,OAAO,YAAW,MAAO,QAAQ,MAAM,eAAe;AAC7D,cAAM,IAAI,SAAS;AAAA,UACf,QAAQ,YAAY;AAAA,UACpB,SAAS,EAAC,OAAO,UAAU,uBAAuB,GAAG,QAAQ,UAAU,oBAAoB,EAAC,OAAO,QAAQ,MAAK,CAAC,EAAC;AAAA,QACtI,CAAiB;AAAA,MACL;AACA,UAAI,CAAC,iBAAgB,GAAI;AACrB,qBAAY;AACZ,eAAO,EAAC,YAAY,KAAI;AAAA,MAC5B;AACA,0BAAoB,EAAC,WAAW,KAAK,IAAG,IAAK,sBAAsB,yBAAyB,cAAc,qBAAoB;AAC9H,YAAM,UAAU;AAAA,QACZ,GAAI,SAAS,SAAS,SAAS,IAAI,CAAC,OAAO,OAAO,IAAI;QACtD,GAAI,SAAS,OAAO,CAAC,OAAO,IAAI,IAAI,CAAA;AAAA,QACpC,GAAI,SAAS,cAAc,SAAS,IAAI,CAAC,OAAO,YAAY,IAAI;MAChF;AACY,aAAO,EAAC,YAAY,EAAC,QAAO,EAAC;AAAA,IACjC;AAAA,IACA,kBAAkB,OAAO,EAAC,QAAQ,KAAI,MAAM;AACxC,YAAM,KAAI;AACV,oBAAa;AACb,UAAI,WAAW,OAAO,cAAc;AAChC,YAAI,CAAC,SAAS,cAAc,SAAS,IAAI,GAAG;AACxC,yBAAc;AAAA,QAClB;AAEA,iBAAS,gBAAgB,SAAS,cAAc,OAAO,CAAC,eAAe,eAAe,IAAI;AAC1F,qBAAa,kBAAkB;AAC/B;AAAA,MACJ;AACA,UAAI,CAAC,SAAS,QAAQ,CAAE,MAAM,gBAAgB,SAAS,KAAK,QAAQ,IAAI,GAAI;AACxE,uBAAc;AAAA,MAClB;AACA,mBAAY;AAAA,IAChB;AAAA,IACA,0BAA0B,YAAY;AAClC,YAAM,KAAI;AACV,oBAAa;AACb,aAAO;AAAA,QACH,WAAW;QAAoB,MAAM,OAAO,SAAS;AAAA,QAAU,kBAAkB;AAAA,QAAa,SAAS;AAAA,QACvG,kBAAkB,SAAS,SAAS,IAAI,CAAC,aAAa,EAAC,IAAI,QAAQ,cAAc,MAAM,aAAY,EAAE;AAAA,MACrH;AAAA,IACQ;AAAA,IACA,mBAAmB,OAAO,eAAe;AACrC,YAAM,KAAI;AACV,oBAAa;AACb,YAAM,UAAU,SAAS,SAAS,KAAK,CAAC,cAAc,UAAU,iBAAiB,YAAY,EAAE;AAC/F,UAAI,CAAC,SAAS;AACV,uBAAc;AAAA,MAClB;AACA,cAAQ,cAAa,oBAAI,KAAI,GAAG,YAAW;AAC3C,mBAAY;AAAA,IAChB;AAAA,IACA,SAAS,YAAY;AACjB,YAAM,KAAI;AACV,sBAAgB,KAAK;AAAA,IACzB;AAAA,IACA,sBAAsB,YAAY;AAC9B,YAAM,KAAI;AAAA,IACd;AAAA,IACA,eAAe,YAAY;AACvB,YAAM,KAAI;AACV,kBAAY,iBAAiB;AAAA,IACjC;AAAA,IACA,eAAe,OAAO,EAAC,MAAM,MAAK,MAAM;AACpC,YAAM,KAAI;AACV,sBAAe;AACf,UAAI,CAAC,MAAM,QAAQ;AACf,cAAM,WAAW,QAAQ,UAAU,cAAc,CAAC;AAAA,MACtD;AACA,cAAQ,OAAO,KAAK,KAAI;AACxB,cAAQ,QAAQ,OAAO,KAAI,KAAM;AACjC,aAAO,EAAC,SAAS,UAAU,cAAc,EAAC;AAAA,IAC9C;AAAA,IACA,gBAAgB,YAAY;AACxB,YAAM,KAAI;AACV,sBAAe;AACf,kBAAY,iBAAiB;AAAA,IACjC;AAAA,IACA,cAAc,YAAY;AACtB,YAAM,KAAI;AACV,sBAAe;AACf,aAAO,YAAW;AAAA,IACtB;AAAA,IACA,WAAW,YAAY;AACnB,YAAM,KAAI;AACV,sBAAe;AACf,eAAS,oBAAoB,cAAa;AAC1C,YAAM,aAAa,aAAa,EAAC,QAAQ,SAAS,mBAAmB,SAAS,QAAQ,OAAO,OAAM,CAAC;AACpG,aAAO,EAAC,QAAQ,SAAS,mBAAmB,YAAY,eAAe,MAAM,aAAa,UAAU,IAAI,KAAI;AAAA,IAChH;AAAA,IACA,aAAa,OAAO,SAAS;AACzB,YAAM,KAAI;AACV,sBAAe;AACf,UAAI,CAAC,SAAS,qBAAqB,CAAE,MAAM,gBAAgB,SAAS,mBAAmB,IAAI,GAAI;AAC3F,cAAM,WAAW,QAAQ,UAAU,WAAW,CAAC;AAAA,MACnD;AACA,YAAM,QAAQ,iBAAgB;AAC9B,eAAS,OAAO,EAAC,QAAQ,SAAS,mBAAmB,YAAW,oBAAI,QAAO,cAAa;AACxF,eAAS,oBAAoB;AAC7B,YAAM,gBAAgB,oBAAoB,KAAK;AAC/C,aAAO,EAAC,UAAU,YAAW,GAAI,cAAa;AAAA,IAClD;AAAA,IACA,aAAa,OAAO,aAAa;AAC7B,YAAM,KAAI;AACV,sBAAe;AACf,0BAAoB,QAAQ;AAC5B,eAAS,OAAO;AAChB,4BAAqB;AACrB,aAAO,EAAC,UAAU,cAAa;AAAA,IACnC;AAAA,IACA,4BAA4B,YAAY;AACpC,YAAM,KAAI;AACV,sBAAe;AACf,aAAO;AAAA,QACH,WAAW,iBAAgB;AAAA,QAC3B,IAAI,EAAC,MAAM,QAAQ,IAAI,OAAO,SAAS,SAAQ;AAAA,QAC/C,MAAM,EAAC,IAAI,YAAY,IAAI,YAAW,EAAG,OAAO,QAAQ,EAAE,CAAC,GAAG,MAAM,QAAQ,OAAO,aAAa,QAAQ,KAAI;AAAA,QAC5G,kBAAkB,CAAC,EAAC,MAAM,cAAc,KAAK,MAAK,GAAG,EAAC,MAAM,cAAc,KAAK,MAAK,CAAC;AAAA,QACrF,SAAS;AAAA,QACT,aAAa;AAAA;AAAA,QAEb,oBAAoB,SAAS,SAAS,IAAI,CAAC,aAAa,EAAC,IAAI,QAAQ,cAAc,MAAM,aAAY,EAAE;AAAA,QACvG,wBAAwB,EAAC,aAAa,aAAa,kBAAkB,YAAW;AAAA,MAChG;AAAA,IACQ;AAAA,IACA,aAAa,OAAO,EAAC,MAAM,WAAU,MAAM;AACvC,YAAM,KAAI;AACV,sBAAe;AACf,YAAM,QAAQ,iBAAgB;AAC9B,eAAS,SAAS,KAAK;AAAA,QACnB,IAAI,WAAW,KAAK,IAAG,CAAE;AAAA,QAAI,cAAc,YAAY;AAAA,QACvD,MAAM,MAAM,KAAI,KAAM,UAAU,sBAAsB,EAAC,QAAQ,SAAS,SAAS,SAAS,EAAC,CAAC;AAAA,QAC5F,YAAW,oBAAI,KAAI,GAAG,YAAW;AAAA,QAAI,YAAY;AAAA,MACjE,CAAa;AACD,kBAAY,cAAc;AAC1B,YAAM,gBAAgB,oBAAoB,KAAK;AAC/C,aAAO,EAAC,UAAU,YAAW,GAAI,cAAa;AAAA,IAClD;AAAA,IACA,eAAe,OAAO,EAAC,WAAW,SAAQ,MAAM;AAC5C,YAAM,KAAI;AACV,sBAAe;AACf,0BAAoB,QAAQ;AAC5B,eAAS,WAAW,SAAS,SAAS,OAAO,CAAC,YAAY,QAAQ,OAAO,SAAS;AAClF,kBAAY,gBAAgB;AAC5B,4BAAqB;AACrB,aAAO,EAAC,UAAU,cAAa;AAAA,IACnC;AAAA,IACA,yBAAyB,OAAO,aAAa;AACzC,YAAM,KAAI;AACV,sBAAe;AACf,0BAAoB,QAAQ;AAC5B,eAAS,gBAAgB,iBAAgB;AACzC,kBAAY,wBAAwB;AACpC,aAAO,EAAC,UAAU,YAAW,GAAI,eAAe,CAAC,GAAG,SAAS,aAAa,EAAC;AAAA,IAC/E;AAAA,IACA,cAAc,YAAY;AACtB,YAAM,KAAI;AACV,sBAAe;AACf,aAAO,SAAS,SAAS,IAAI,CAAC,aAAa,EAAC,GAAG,QAAO,EAAE;AAAA,IAC5D;AAAA,IACA,oBAAoB,YAAY;AAC5B,YAAM,KAAI;AACV,sBAAe;AACf,YAAM,SAAS,SAAS,SAAS,OAAO,CAAC,YAAY,CAAC,QAAQ,SAAS,EAAE;AACzE,eAAS,WAAW,SAAS,SAAS,OAAO,CAAC,YAAY,QAAQ,SAAS;AAC3E,UAAI,SAAS,GAAG;AACZ,oBAAY,gBAAgB;AAAA,MAChC;AACA,aAAO;AAAA,IACX;AAAA,IACA,cAAc,YAAY;AACtB,YAAM,KAAI;AACV,sBAAe;AACf,aAAO,SAAS,OAAO,IAAI,CAAC,WAAW,EAAC,GAAG,MAAK,EAAE;AAAA,IACtD;AAAA;AAAA,IAEA,cAAc,YAAY;AACtB,YAAM,SAAS,SAAS,qBAAqB,SAAS,MAAM;AAC5D,aAAO,SAAS,WAAW,MAAM,IAAI;AAAA,IACzC;AAAA,EACR;AACA;"}