@stackcraftmx/calcita 0.0.0-stage → 0.23.0

package/dist/account/demo/totp.js

@@ -0,0 +1,61 @@
+const BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+const STEP_SECONDS = 30;
+const CODE_DIGITS = 6;
+const ACCEPTED_DRIFT_STEPS = 1;
+const SECRET_BYTES = 20;
+function base32Of(bytes) {
+  let bits = "";
+  for (const byte of bytes) {
+    bits += byte.toString(2).padStart(8, "0");
+  }
+  let text = "";
+  for (let start = 0; start < bits.length; start += 5) {
+    text += BASE32_ALPHABET[parseInt(bits.slice(start, start + 5).padEnd(5, "0"), 2)];
+  }
+  return text;
+}
+function bytesOfBase32(text) {
+  const bits = text.replace(/[\s=]/g, "").toUpperCase().split("").map((character) => BASE32_ALPHABET.indexOf(character).toString(2).padStart(5, "0")).join("");
+  const bytes = new Uint8Array(Math.floor(bits.length / 8));
+  for (let index = 0; index < bytes.length; index += 1) {
+    bytes[index] = parseInt(bits.slice(index * 8, index * 8 + 8), 2);
+  }
+  return bytes;
+}
+function newTotpSecret() {
+  return base32Of(crypto.getRandomValues(new Uint8Array(SECRET_BYTES)));
+}
+async function codeOfStep(secret, step, digits = CODE_DIGITS) {
+  const counter = new ArrayBuffer(8);
+  new DataView(counter).setBigUint64(0, BigInt(step));
+  const key = await crypto.subtle.importKey("raw", bytesOfBase32(secret), { name: "HMAC", hash: "SHA-1" }, false, ["sign"]);
+  const hmac = new Uint8Array(await crypto.subtle.sign("HMAC", key, counter));
+  const offset = hmac[hmac.length - 1] & 15;
+  const number = (hmac[offset] & 127) << 24 | hmac[offset + 1] << 16 | hmac[offset + 2] << 8 | hmac[offset + 3];
+  return String(number % 10 ** digits).padStart(digits, "0");
+}
+function totpCodeAt(secret, timeMilliseconds = Date.now(), digits = CODE_DIGITS) {
+  return codeOfStep(secret, Math.floor(timeMilliseconds / 1e3 / STEP_SECONDS), digits);
+}
+async function isValidTotpCode(secret, code, timeMilliseconds = Date.now()) {
+  const currentStep = Math.floor(timeMilliseconds / 1e3 / STEP_SECONDS);
+  for (let drift = -ACCEPTED_DRIFT_STEPS; drift <= ACCEPTED_DRIFT_STEPS; drift += 1) {
+    if (await codeOfStep(secret, currentStep + drift) === code) {
+      return true;
+    }
+  }
+  return false;
+}
+function otpauthUrlOf({ secret, account, issuer }) {
+  const label = encodeURIComponent(`${issuer}:${account}`);
+  return `otpauth://totp/${label}?secret=${secret}&issuer=${encodeURIComponent(issuer)}&digits=${CODE_DIGITS}&period=${STEP_SECONDS}`;
+}
+export {
+  base32Of,
+  bytesOfBase32,
+  isValidTotpCode,
+  newTotpSecret,
+  otpauthUrlOf,
+  totpCodeAt
+};
+//# sourceMappingURL=totp.js.map

package/dist/account/demo/totp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.js","sources":["../../../src/account/demo/totp.js"],"sourcesContent":["// Los códigos de 6 dígitos de una app autenticadora (TOTP, RFC 6238): los mismos que calcula Google Authenticator con la\n// clave que se escaneó. En un proyecto real esto lo hace el servidor (pyotp, otplib, spomky-labs/otphp); aquí lo usa el\n// conector de demostración (y el servidor de mentira de los ejemplos) para que la verificación funcione con la app de verdad.\n//\n// El código sale de la clave y de la hora: HMAC-SHA1 de los «pasos» de 30 segundos desde 1970, recortado a 6 dígitos.\n// Al revisar se acepta el paso de antes y el de después: el reloj del teléfono puede ir unos segundos desfasado.\n//\n// Funciones puras con crypto.subtle (navegador y node): function (regla de la casa).\n\nconst BASE32_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';\nconst STEP_SECONDS = 30;\nconst CODE_DIGITS = 6;\n// cuántos pasos de diferencia se aceptan al revisar (el de antes y el de después)\nconst ACCEPTED_DRIFT_STEPS = 1;\nconst SECRET_BYTES = 20;\n\n/**\n * Bytes → base32 (la clave como la escribe la persona en su app).\n *\n * @param {Uint8Array} bytes\n * @returns {string}\n */\nexport function base32Of(bytes) {\n    let bits = '';\n    for (const byte of bytes) {\n        bits += byte.toString(2).padStart(8, '0');\n    }\n    let text = '';\n    for (let start = 0; start < bits.length; start += 5) {\n        text += BASE32_ALPHABET[parseInt(bits.slice(start, start + 5).padEnd(5, '0'), 2)];\n    }\n    return text;\n}\n\n/**\n * Base32 → bytes (sin espacios ni relleno).\n *\n * @param {string} text\n * @returns {Uint8Array}\n */\nexport function bytesOfBase32(text) {\n    const bits = text.replace(/[\\s=]/g, '').toUpperCase().split('')\n        .map((character) => BASE32_ALPHABET.indexOf(character).toString(2).padStart(5, '0')).join('');\n    const bytes = new Uint8Array(Math.floor(bits.length / 8));\n    for (let index = 0; index < bytes.length; index += 1) {\n        bytes[index] = parseInt(bits.slice(index * 8, index * 8 + 8), 2);\n    }\n    return bytes;\n}\n\n/** Una clave nueva al azar, en base32. */\nexport function newTotpSecret() {\n    return base32Of(crypto.getRandomValues(new Uint8Array(SECRET_BYTES)));\n}\n\n/**\n * El código de un paso de 30 segundos.\n *\n * @param {string} secret la clave en base32\n * @param {number} step los pasos de 30 segundos desde 1970\n * @param {number} [digits]\n * @returns {Promise<string>}\n */\nasync function codeOfStep(secret, step, digits = CODE_DIGITS) {\n    const counter = new ArrayBuffer(8);\n    new DataView(counter).setBigUint64(0, BigInt(step));\n    const key = await crypto.subtle.importKey('raw', bytesOfBase32(secret), {name: 'HMAC', hash: 'SHA-1'}, false, ['sign']);\n    const hmac = new Uint8Array(await crypto.subtle.sign('HMAC', key, counter));\n    // el recorte del RFC: 4 bytes desde la posición que dicen los últimos 4 bits\n    const offset = hmac[hmac.length - 1] & 0x0f;\n    const number = ((hmac[offset] & 0x7f) << 24) | (hmac[offset + 1] << 16) | (hmac[offset + 2] << 8) | hmac[offset + 3];\n    return String(number % 10 ** digits).padStart(digits, '0');\n}\n\n/**\n * El código que enseña la app en ese momento.\n *\n * @param {string} secret la clave en base32\n * @param {number} [timeMilliseconds] por omisión, ahora\n * @param {number} [digits]\n * @returns {Promise<string>}\n */\nexport function totpCodeAt(secret, timeMilliseconds = Date.now(), digits = CODE_DIGITS) {\n    return codeOfStep(secret, Math.floor(timeMilliseconds / 1000 / STEP_SECONDS), digits);\n}\n\n/**\n * ¿El código es el de ahora (o el de un paso antes o después)?\n *\n * @param {string} secret\n * @param {string} code los 6 dígitos\n * @param {number} [timeMilliseconds]\n * @returns {Promise<boolean>}\n */\nexport async function isValidTotpCode(secret, code, timeMilliseconds = Date.now()) {\n    const currentStep = Math.floor(timeMilliseconds / 1000 / STEP_SECONDS);\n    for (let drift = -ACCEPTED_DRIFT_STEPS; drift <= ACCEPTED_DRIFT_STEPS; drift += 1) {\n        if (await codeOfStep(secret, currentStep + drift) === code) {\n            return true;\n        }\n    }\n    return false;\n}\n\n/**\n * La dirección otpauth:// que va en el QR: la app la lee y guarda la cuenta con su clave.\n *\n * @param {{secret: string, account: string, issuer: string}} details\n * @returns {string}\n */\nexport function otpauthUrlOf({secret, account, issuer}) {\n    const label = encodeURIComponent(`${issuer}:${account}`);\n    return `otpauth://totp/${label}?secret=${secret}&issuer=${encodeURIComponent(issuer)}&digits=${CODE_DIGITS}&period=${STEP_SECONDS}`;\n}\n"],"names":[],"mappings":"AASA,MAAM,kBAAkB;AACxB,MAAM,eAAe;AACrB,MAAM,cAAc;AAEpB,MAAM,uBAAuB;AAC7B,MAAM,eAAe;AAQd,SAAS,SAAS,OAAO;AAC5B,MAAI,OAAO;AACX,aAAW,QAAQ,OAAO;AACtB,YAAQ,KAAK,SAAS,CAAC,EAAE,SAAS,GAAG,GAAG;AAAA,EAC5C;AACA,MAAI,OAAO;AACX,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AACjD,YAAQ,gBAAgB,SAAS,KAAK,MAAM,OAAO,QAAQ,CAAC,EAAE,OAAO,GAAG,GAAG,GAAG,CAAC,CAAC;AAAA,EACpF;AACA,SAAO;AACX;AAQO,SAAS,cAAc,MAAM;AAChC,QAAM,OAAO,KAAK,QAAQ,UAAU,EAAE,EAAE,cAAc,MAAM,EAAE,EACzD,IAAI,CAAC,cAAc,gBAAgB,QAAQ,SAAS,EAAE,SAAS,CAAC,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAChG,QAAM,QAAQ,IAAI,WAAW,KAAK,MAAM,KAAK,SAAS,CAAC,CAAC;AACxD,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AAClD,UAAM,KAAK,IAAI,SAAS,KAAK,MAAM,QAAQ,GAAG,QAAQ,IAAI,CAAC,GAAG,CAAC;AAAA,EACnE;AACA,SAAO;AACX;AAGO,SAAS,gBAAgB;AAC5B,SAAO,SAAS,OAAO,gBAAgB,IAAI,WAAW,YAAY,CAAC,CAAC;AACxE;AAUA,eAAe,WAAW,QAAQ,MAAM,SAAS,aAAa;AAC1D,QAAM,UAAU,IAAI,YAAY,CAAC;AACjC,MAAI,SAAS,OAAO,EAAE,aAAa,GAAG,OAAO,IAAI,CAAC;AAClD,QAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,cAAc,MAAM,GAAG,EAAC,MAAM,QAAQ,MAAM,QAAO,GAAG,OAAO,CAAC,MAAM,CAAC;AACtH,QAAM,OAAO,IAAI,WAAW,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,OAAO,CAAC;AAE1E,QAAM,SAAS,KAAK,KAAK,SAAS,CAAC,IAAI;AACvC,QAAM,UAAW,KAAK,MAAM,IAAI,QAAS,KAAO,KAAK,SAAS,CAAC,KAAK,KAAO,KAAK,SAAS,CAAC,KAAK,IAAK,KAAK,SAAS,CAAC;AACnH,SAAO,OAAO,SAAS,MAAM,MAAM,EAAE,SAAS,QAAQ,GAAG;AAC7D;AAUO,SAAS,WAAW,QAAQ,mBAAmB,KAAK,IAAG,GAAI,SAAS,aAAa;AACpF,SAAO,WAAW,QAAQ,KAAK,MAAM,mBAAmB,MAAO,YAAY,GAAG,MAAM;AACxF;AAUO,eAAe,gBAAgB,QAAQ,MAAM,mBAAmB,KAAK,IAAG,GAAI;AAC/E,QAAM,cAAc,KAAK,MAAM,mBAAmB,MAAO,YAAY;AACrE,WAAS,QAAQ,CAAC,sBAAsB,SAAS,sBAAsB,SAAS,GAAG;AAC/E,QAAI,MAAM,WAAW,QAAQ,cAAc,KAAK,MAAM,MAAM;AACxD,aAAO;AAAA,IACX;AAAA,EACJ;AACA,SAAO;AACX;AAQO,SAAS,aAAa,EAAC,QAAQ,SAAS,OAAM,GAAG;AACpD,QAAM,QAAQ,mBAAmB,GAAG,MAAM,IAAI,OAAO,EAAE;AACvD,SAAO,kBAAkB,KAAK,WAAW,MAAM,WAAW,mBAAmB,MAAM,CAAC,WAAW,WAAW,WAAW,YAAY;AACrI;"}

package/dist/account/restAccountConnector.js

@@ -0,0 +1,117 @@
+const ACCOUNT_REST_PATHS = Object.freeze({
+  session: "/auth/session",
+  signIn: "/auth/sign-in",
+  secondStep: "/auth/second-step",
+  secondStepPasskeyOptions: "/auth/second-step/passkey-options",
+  secondStepPasskey: "/auth/second-step/passkey",
+  signOut: "/auth/sign-out",
+  forgotPassword: "/auth/forgot-password",
+  resetPassword: "/auth/reset-password",
+  profile: "/account",
+  password: "/account/password",
+  security: "/account/security",
+  totp: "/account/security/totp",
+  totpConfirm: "/account/security/totp/confirm",
+  passkeyRegistrationOptions: "/account/security/passkeys/registration-options",
+  passkeys: "/account/security/passkeys",
+  recoveryCodes: "/account/security/recovery-codes",
+  sessions: "/account/sessions",
+  closeOtherSessions: "/account/sessions/close-others",
+  activity: "/account/activity"
+});
+const SECOND_STEP_METHOD_IN_API = Object.freeze({ passkey: "passkey", totp: "totp", recoveryCode: "recovery_code" });
+const SECOND_STEP_METHOD_FROM_API = Object.freeze({ passkey: "passkey", totp: "totp", recovery_code: "recoveryCode" });
+function securityFromResponse(response) {
+  return {
+    isEnabled: Boolean(response.is_enabled),
+    enabledAt: response.enabled_at ?? null,
+    passkeys: (response.passkeys ?? []).map((passkey) => ({
+      id: passkey.id,
+      name: passkey.name,
+      createdAt: passkey.created_at,
+      lastUsedAt: passkey.last_used_at ?? null
+    })),
+    totp: { isEnabled: Boolean(response.totp?.is_enabled), enabledAt: response.totp?.enabled_at ?? null },
+    recoveryCodesRemaining: response.recovery_codes_remaining ?? 0
+  };
+}
+function securityChangeFromResponse(response) {
+  return { security: securityFromResponse(response.security), recoveryCodes: response.recovery_codes ?? void 0 };
+}
+function createRestAccountConnector(apiClient, { paths = {} } = {}) {
+  const path = { ...ACCOUNT_REST_PATHS, ...paths };
+  return {
+    loadSession: async () => {
+      try {
+        return await apiClient.get(path.session, { skipUnauthenticatedHandler: true });
+      } catch (error) {
+        if (error?.isUnauthenticated) {
+          return null;
+        }
+        throw error;
+      }
+    },
+    signIn: async ({ email, password, remember }) => {
+      const response = await apiClient.post(path.signIn, { email, password, remember }, { skipUnauthenticatedHandler: true });
+      const methods = response?.second_step?.methods;
+      return { secondStep: methods ? { methods: methods.map((method) => SECOND_STEP_METHOD_FROM_API[method] ?? method) } : null };
+    },
+    signInSecondStep: async ({ method, code }) => {
+      await apiClient.post(path.secondStep, { method: SECOND_STEP_METHOD_IN_API[method] ?? method, code }, { skipUnauthenticatedHandler: true });
+    },
+    secondStepPasskeyOptions: () => apiClient.get(path.secondStepPasskeyOptions, { skipUnauthenticatedHandler: true }),
+    signInWithPasskey: async (credential) => {
+      await apiClient.post(path.secondStepPasskey, { credential }, { skipUnauthenticatedHandler: true });
+    },
+    signOut: async () => {
+      await apiClient.post(path.signOut, void 0, { skipUnauthenticatedHandler: true });
+    },
+    requestPasswordReset: async ({ email }) => {
+      await apiClient.post(path.forgotPassword, { email });
+    },
+    resetPassword: async ({ token, newPassword }) => {
+      await apiClient.post(path.resetPassword, { token, new_password: newPassword });
+    },
+    updateProfile: async ({ name, phone }) => await apiClient.put(path.profile, { name, phone }) ?? {},
+    changePassword: async ({ currentPassword, newPassword }) => {
+      await apiClient.put(path.password, { current_password: currentPassword, new_password: newPassword });
+    },
+    loadSecurity: async () => securityFromResponse(await apiClient.get(path.security)),
+    startTotp: async () => {
+      const response = await apiClient.post(path.totp);
+      return { secret: response.secret, qrImageUrl: response.qr_image_url ?? null };
+    },
+    confirmTotp: async (code) => securityChangeFromResponse(await apiClient.post(path.totpConfirm, { code })),
+    disableTotp: async (password) => securityChangeFromResponse(await apiClient.delete(path.totp, { body: { password } })),
+    passkeyRegistrationOptions: () => apiClient.get(path.passkeyRegistrationOptions),
+    savePasskey: async ({ name, credential }) => securityChangeFromResponse(await apiClient.post(path.passkeys, { name, credential })),
+    removePasskey: async ({ passkeyId, password }) => securityChangeFromResponse(
+      await apiClient.delete(`${path.passkeys}/${encodeURIComponent(passkeyId)}`, { body: { password } })
+    ),
+    regenerateRecoveryCodes: async (password) => securityChangeFromResponse(await apiClient.post(path.recoveryCodes, { password })),
+    listSessions: async () => (await apiClient.get(path.sessions)).map((session) => ({
+      id: session.id,
+      browser: session.browser,
+      platform: session.platform,
+      isMobile: Boolean(session.is_mobile),
+      startedAt: session.started_at,
+      network: session.network,
+      isCurrent: Boolean(session.is_current)
+    })),
+    closeOtherSessions: async () => (await apiClient.post(path.closeOtherSessions))?.closed ?? 0,
+    listActivity: async () => (await apiClient.get(path.activity)).map((event) => ({
+      id: event.id,
+      kind: event.kind,
+      occurredAt: event.occurred_at,
+      device: event.device,
+      network: event.network
+    }))
+  };
+}
+export {
+  ACCOUNT_REST_PATHS,
+  createRestAccountConnector,
+  securityChangeFromResponse,
+  securityFromResponse
+};
+//# sourceMappingURL=restAccountConnector.js.map

package/dist/account/restAccountConnector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"restAccountConnector.js","sources":["../../src/account/restAccountConnector.js"],"sourcesContent":["// El conector de la cuenta para un backend REST que sigue este contrato (llaves en snake_case, errores RFC 9457). Si el\n// backend lo sigue, conectar la cuenta es una línea:\n//\n//   export const accountConnector = createRestAccountConnector(apiClient);\n//\n// Si alguna ruta se llama distinto, se cambia en `paths`; si alguna respuesta tiene otra forma, se reemplaza esa función:\n//\n//   export const accountConnector = {...createRestAccountConnector(apiClient), signIn: async (credentials) => …};\n//\n// El contrato (las rutas por omisión, ACCOUNT_REST_PATHS):\n//\n//   GET    /auth/session                          → {user, roles, abilities, labels} | 401 si nadie está dentro\n//   POST   /auth/sign-in        {email, password, remember}   → {second_step: {methods} | null}\n//   POST   /auth/second-step    {method, code}                → 204   (method: totp | recovery_code)\n//   GET    /auth/second-step/passkey-options                  → opciones de WebAuthn para firmar\n//   POST   /auth/second-step/passkey   {credential}           → 204\n//   POST   /auth/sign-out                                     → 204\n//   POST   /auth/forgot-password       {email}                → 204 (igual exista o no el correo)\n//   POST   /auth/reset-password        {token, new_password}  → 204\n//   PUT    /account             {name, phone}                 → {message?}\n//   PUT    /account/password    {current_password, new_password} → 204\n//   GET    /account/security                                  → el estado de la verificación (abajo)\n//   POST   /account/security/totp                             → {secret, qr_image_url}\n//   POST   /account/security/totp/confirm      {code}         → {security, recovery_codes?}\n//   DELETE /account/security/totp             {password}     → {security}\n//   GET    /account/security/passkeys/registration-options    → opciones de WebAuthn para crear\n//   POST   /account/security/passkeys          {name, credential} → {security, recovery_codes?}\n//   DELETE /account/security/passkeys/{id}     {password}     → {security}\n//   POST   /account/security/recovery-codes    {password}     → {security, recovery_codes}\n//   GET    /account/sessions                                  → [{id, browser, platform, is_mobile, started_at, network, is_current}]\n//   POST   /account/sessions/close-others                     → {closed}\n//   GET    /account/activity                                  → [{id, kind, occurred_at, device, network}]\n//\n// El estado de la verificación: {is_enabled, enabled_at, passkeys: [{id, name, created_at, last_used_at}],\n// totp: {is_enabled, enabled_at}, recovery_codes_remaining}. Las opciones y la firma de WebAuthn viajan tal cual (las arma\n// y las revisa la librería del servidor: py_webauthn, @simplewebauthn/server, web-auth/webauthn-lib).\n//\n// Funciones puras, no renderizan: function (regla de la casa). Pruebas en restAccountConnector.test.js.\n\n/** Las rutas del contrato; se pegan a la baseUrl del cliente (/api + /auth/session). */\nexport const ACCOUNT_REST_PATHS = Object.freeze({\n    session: '/auth/session',\n    signIn: '/auth/sign-in',\n    secondStep: '/auth/second-step',\n    secondStepPasskeyOptions: '/auth/second-step/passkey-options',\n    secondStepPasskey: '/auth/second-step/passkey',\n    signOut: '/auth/sign-out',\n    forgotPassword: '/auth/forgot-password',\n    resetPassword: '/auth/reset-password',\n    profile: '/account',\n    password: '/account/password',\n    security: '/account/security',\n    totp: '/account/security/totp',\n    totpConfirm: '/account/security/totp/confirm',\n    passkeyRegistrationOptions: '/account/security/passkeys/registration-options',\n    passkeys: '/account/security/passkeys',\n    recoveryCodes: '/account/security/recovery-codes',\n    sessions: '/account/sessions',\n    closeOtherSessions: '/account/sessions/close-others',\n    activity: '/account/activity',\n});\n\n// cómo se llama cada método del segundo paso en el contrato (snake_case) y en las pantallas (SECOND_STEP_METHOD)\nconst SECOND_STEP_METHOD_IN_API = Object.freeze({passkey: 'passkey', totp: 'totp', recoveryCode: 'recovery_code'});\nconst SECOND_STEP_METHOD_FROM_API = Object.freeze({passkey: 'passkey', totp: 'totp', recovery_code: 'recoveryCode'});\n\n/**\n * El estado de la verificación, del contrato a camelCase.\n *\n * @param {object} response\n * @returns {import('@/account/accountConnector.js').AccountSecurity}\n */\nexport function securityFromResponse(response) {\n    return {\n        isEnabled: Boolean(response.is_enabled),\n        enabledAt: response.enabled_at ?? null,\n        passkeys: (response.passkeys ?? []).map((passkey) => ({\n            id: passkey.id, name: passkey.name, createdAt: passkey.created_at, lastUsedAt: passkey.last_used_at ?? null,\n        })),\n        totp: {isEnabled: Boolean(response.totp?.is_enabled), enabledAt: response.totp?.enabled_at ?? null},\n        recoveryCodesRemaining: response.recovery_codes_remaining ?? 0,\n    };\n}\n\n/**\n * Lo que regresa un cambio de seguridad: {security, recovery_codes?} → {security, recoveryCodes?}.\n *\n * @param {object} response\n * @returns {import('@/account/accountConnector.js').AccountSecurityChange}\n */\nexport function securityChangeFromResponse(response) {\n    return {security: securityFromResponse(response.security), recoveryCodes: response.recovery_codes ?? undefined};\n}\n\n/**\n * @param {{get: Function, post: Function, put: Function, delete: Function}} apiClient el de createApiClient\n * @param {{paths?: Partial<Record<keyof typeof ACCOUNT_REST_PATHS, string>>}} [options] las rutas que se llaman distinto\n * @returns {import('@/account/accountConnector.js').AccountConnector}\n */\nexport function createRestAccountConnector(apiClient, {paths = {}} = {}) {\n    const path = {...ACCOUNT_REST_PATHS, ...paths};\n\n    return {\n        loadSession: async () => {\n            try {\n                // sin el aviso de «sesión vencida»: aquí que no haya sesión es una respuesta normal\n                return await apiClient.get(path.session, {skipUnauthenticatedHandler: true});\n            } catch (error) {\n                if (error?.isUnauthenticated) {\n                    return null;\n                }\n                throw error;\n            }\n        },\n        signIn: async ({email, password, remember}) => {\n            const response = await apiClient.post(path.signIn, {email, password, remember}, {skipUnauthenticatedHandler: true});\n            const methods = response?.second_step?.methods;\n            return {secondStep: methods ? {methods: methods.map((method) => SECOND_STEP_METHOD_FROM_API[method] ?? method)} : null};\n        },\n        signInSecondStep: async ({method, code}) => {\n            await apiClient.post(path.secondStep, {method: SECOND_STEP_METHOD_IN_API[method] ?? method, code}, {skipUnauthenticatedHandler: true});\n        },\n        secondStepPasskeyOptions: () => apiClient.get(path.secondStepPasskeyOptions, {skipUnauthenticatedHandler: true}),\n        signInWithPasskey: async (credential) => {\n            await apiClient.post(path.secondStepPasskey, {credential}, {skipUnauthenticatedHandler: true});\n        },\n        signOut: async () => {\n            await apiClient.post(path.signOut, undefined, {skipUnauthenticatedHandler: true});\n        },\n        requestPasswordReset: async ({email}) => {\n            await apiClient.post(path.forgotPassword, {email});\n        },\n        resetPassword: async ({token, newPassword}) => {\n            await apiClient.post(path.resetPassword, {token, new_password: newPassword});\n        },\n        updateProfile: async ({name, phone}) => (await apiClient.put(path.profile, {name, phone})) ?? {},\n        changePassword: async ({currentPassword, newPassword}) => {\n            await apiClient.put(path.password, {current_password: currentPassword, new_password: newPassword});\n        },\n        loadSecurity: async () => securityFromResponse(await apiClient.get(path.security)),\n        startTotp: async () => {\n            const response = await apiClient.post(path.totp);\n            return {secret: response.secret, qrImageUrl: response.qr_image_url ?? null};\n        },\n        confirmTotp: async (code) => securityChangeFromResponse(await apiClient.post(path.totpConfirm, {code})),\n        disableTotp: async (password) => securityChangeFromResponse(await apiClient.delete(path.totp, {body: {password}})),\n        passkeyRegistrationOptions: () => apiClient.get(path.passkeyRegistrationOptions),\n        savePasskey: async ({name, credential}) => securityChangeFromResponse(await apiClient.post(path.passkeys, {name, credential})),\n        removePasskey: async ({passkeyId, password}) => securityChangeFromResponse(\n            await apiClient.delete(`${path.passkeys}/${encodeURIComponent(passkeyId)}`, {body: {password}}),\n        ),\n        regenerateRecoveryCodes: async (password) => securityChangeFromResponse(await apiClient.post(path.recoveryCodes, {password})),\n        listSessions: async () => (await apiClient.get(path.sessions)).map((session) => ({\n            id: session.id, browser: session.browser, platform: session.platform, isMobile: Boolean(session.is_mobile),\n            startedAt: session.started_at, network: session.network, isCurrent: Boolean(session.is_current),\n        })),\n        closeOtherSessions: async () => (await apiClient.post(path.closeOtherSessions))?.closed ?? 0,\n        listActivity: async () => (await apiClient.get(path.activity)).map((event) => ({\n            id: event.id, kind: event.kind, occurredAt: event.occurred_at, device: event.device, network: event.network,\n        })),\n    };\n}\n"],"names":[],"mappings":"AAwCY,MAAC,qBAAqB,OAAO,OAAO;AAAA,EAC5C,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,0BAA0B;AAAA,EAC1B,mBAAmB;AAAA,EACnB,SAAS;AAAA,EACT,gBAAgB;AAAA,EAChB,eAAe;AAAA,EACf,SAAS;AAAA,EACT,UAAU;AAAA,EACV,UAAU;AAAA,EACV,MAAM;AAAA,EACN,aAAa;AAAA,EACb,4BAA4B;AAAA,EAC5B,UAAU;AAAA,EACV,eAAe;AAAA,EACf,UAAU;AAAA,EACV,oBAAoB;AAAA,EACpB,UAAU;AACd,CAAC;AAGD,MAAM,4BAA4B,OAAO,OAAO,EAAC,SAAS,WAAW,MAAM,QAAQ,cAAc,gBAAe,CAAC;AACjH,MAAM,8BAA8B,OAAO,OAAO,EAAC,SAAS,WAAW,MAAM,QAAQ,eAAe,eAAc,CAAC;AAQ5G,SAAS,qBAAqB,UAAU;AAC3C,SAAO;AAAA,IACH,WAAW,QAAQ,SAAS,UAAU;AAAA,IACtC,WAAW,SAAS,cAAc;AAAA,IAClC,WAAW,SAAS,YAAY,CAAA,GAAI,IAAI,CAAC,aAAa;AAAA,MAClD,IAAI,QAAQ;AAAA,MAAI,MAAM,QAAQ;AAAA,MAAM,WAAW,QAAQ;AAAA,MAAY,YAAY,QAAQ,gBAAgB;AAAA,IACnH,EAAU;AAAA,IACF,MAAM,EAAC,WAAW,QAAQ,SAAS,MAAM,UAAU,GAAG,WAAW,SAAS,MAAM,cAAc,KAAI;AAAA,IAClG,wBAAwB,SAAS,4BAA4B;AAAA,EACrE;AACA;AAQO,SAAS,2BAA2B,UAAU;AACjD,SAAO,EAAC,UAAU,qBAAqB,SAAS,QAAQ,GAAG,eAAe,SAAS,kBAAkB,OAAS;AAClH;AAOO,SAAS,2BAA2B,WAAW,EAAC,QAAQ,CAAA,EAAE,IAAI,CAAA,GAAI;AACrE,QAAM,OAAO,EAAC,GAAG,oBAAoB,GAAG,MAAK;AAE7C,SAAO;AAAA,IACH,aAAa,YAAY;AACrB,UAAI;AAEA,eAAO,MAAM,UAAU,IAAI,KAAK,SAAS,EAAC,4BAA4B,KAAI,CAAC;AAAA,MAC/E,SAAS,OAAO;AACZ,YAAI,OAAO,mBAAmB;AAC1B,iBAAO;AAAA,QACX;AACA,cAAM;AAAA,MACV;AAAA,IACJ;AAAA,IACA,QAAQ,OAAO,EAAC,OAAO,UAAU,SAAQ,MAAM;AAC3C,YAAM,WAAW,MAAM,UAAU,KAAK,KAAK,QAAQ,EAAC,OAAO,UAAU,SAAQ,GAAG,EAAC,4BAA4B,KAAI,CAAC;AAClH,YAAM,UAAU,UAAU,aAAa;AACvC,aAAO,EAAC,YAAY,UAAU,EAAC,SAAS,QAAQ,IAAI,CAAC,WAAW,4BAA4B,MAAM,KAAK,MAAM,EAAC,IAAI,KAAI;AAAA,IAC1H;AAAA,IACA,kBAAkB,OAAO,EAAC,QAAQ,KAAI,MAAM;AACxC,YAAM,UAAU,KAAK,KAAK,YAAY,EAAC,QAAQ,0BAA0B,MAAM,KAAK,QAAQ,KAAI,GAAG,EAAC,4BAA4B,KAAI,CAAC;AAAA,IACzI;AAAA,IACA,0BAA0B,MAAM,UAAU,IAAI,KAAK,0BAA0B,EAAC,4BAA4B,KAAI,CAAC;AAAA,IAC/G,mBAAmB,OAAO,eAAe;AACrC,YAAM,UAAU,KAAK,KAAK,mBAAmB,EAAC,WAAU,GAAG,EAAC,4BAA4B,KAAI,CAAC;AAAA,IACjG;AAAA,IACA,SAAS,YAAY;AACjB,YAAM,UAAU,KAAK,KAAK,SAAS,QAAW,EAAC,4BAA4B,KAAI,CAAC;AAAA,IACpF;AAAA,IACA,sBAAsB,OAAO,EAAC,MAAK,MAAM;AACrC,YAAM,UAAU,KAAK,KAAK,gBAAgB,EAAC,MAAK,CAAC;AAAA,IACrD;AAAA,IACA,eAAe,OAAO,EAAC,OAAO,YAAW,MAAM;AAC3C,YAAM,UAAU,KAAK,KAAK,eAAe,EAAC,OAAO,cAAc,YAAW,CAAC;AAAA,IAC/E;AAAA,IACA,eAAe,OAAO,EAAC,MAAM,MAAK,MAAO,MAAM,UAAU,IAAI,KAAK,SAAS,EAAC,MAAM,MAAK,CAAC,KAAM,CAAA;AAAA,IAC9F,gBAAgB,OAAO,EAAC,iBAAiB,YAAW,MAAM;AACtD,YAAM,UAAU,IAAI,KAAK,UAAU,EAAC,kBAAkB,iBAAiB,cAAc,YAAW,CAAC;AAAA,IACrG;AAAA,IACA,cAAc,YAAY,qBAAqB,MAAM,UAAU,IAAI,KAAK,QAAQ,CAAC;AAAA,IACjF,WAAW,YAAY;AACnB,YAAM,WAAW,MAAM,UAAU,KAAK,KAAK,IAAI;AAC/C,aAAO,EAAC,QAAQ,SAAS,QAAQ,YAAY,SAAS,gBAAgB,KAAI;AAAA,IAC9E;AAAA,IACA,aAAa,OAAO,SAAS,2BAA2B,MAAM,UAAU,KAAK,KAAK,aAAa,EAAC,KAAI,CAAC,CAAC;AAAA,IACtG,aAAa,OAAO,aAAa,2BAA2B,MAAM,UAAU,OAAO,KAAK,MAAM,EAAC,MAAM,EAAC,SAAQ,EAAC,CAAC,CAAC;AAAA,IACjH,4BAA4B,MAAM,UAAU,IAAI,KAAK,0BAA0B;AAAA,IAC/E,aAAa,OAAO,EAAC,MAAM,WAAU,MAAM,2BAA2B,MAAM,UAAU,KAAK,KAAK,UAAU,EAAC,MAAM,WAAU,CAAC,CAAC;AAAA,IAC7H,eAAe,OAAO,EAAC,WAAW,SAAQ,MAAM;AAAA,MAC5C,MAAM,UAAU,OAAO,GAAG,KAAK,QAAQ,IAAI,mBAAmB,SAAS,CAAC,IAAI,EAAC,MAAM,EAAC,SAAQ,EAAC,CAAC;AAAA,IAC1G;AAAA,IACQ,yBAAyB,OAAO,aAAa,2BAA2B,MAAM,UAAU,KAAK,KAAK,eAAe,EAAC,SAAQ,CAAC,CAAC;AAAA,IAC5H,cAAc,aAAa,MAAM,UAAU,IAAI,KAAK,QAAQ,GAAG,IAAI,CAAC,aAAa;AAAA,MAC7E,IAAI,QAAQ;AAAA,MAAI,SAAS,QAAQ;AAAA,MAAS,UAAU,QAAQ;AAAA,MAAU,UAAU,QAAQ,QAAQ,SAAS;AAAA,MACzG,WAAW,QAAQ;AAAA,MAAY,SAAS,QAAQ;AAAA,MAAS,WAAW,QAAQ,QAAQ,UAAU;AAAA,IAC1G,EAAU;AAAA,IACF,oBAAoB,aAAa,MAAM,UAAU,KAAK,KAAK,kBAAkB,IAAI,UAAU;AAAA,IAC3F,cAAc,aAAa,MAAM,UAAU,IAAI,KAAK,QAAQ,GAAG,IAAI,CAAC,WAAW;AAAA,MAC3E,IAAI,MAAM;AAAA,MAAI,MAAM,MAAM;AAAA,MAAM,YAAY,MAAM;AAAA,MAAa,QAAQ,MAAM;AAAA,MAAQ,SAAS,MAAM;AAAA,IAChH,EAAU;AAAA,EACV;AACA;"}

package/dist/account-demo.js

@@ -0,0 +1,12 @@
+import { createDemoAccountConnector } from "./account/demo/createDemoAccountConnector.js";
+import { base32Of, bytesOfBase32, isValidTotpCode, newTotpSecret, otpauthUrlOf, totpCodeAt } from "./account/demo/totp.js";
+export {
+  base32Of,
+  bytesOfBase32,
+  createDemoAccountConnector,
+  isValidTotpCode,
+  newTotpSecret,
+  otpauthUrlOf,
+  totpCodeAt
+};
+//# sourceMappingURL=account-demo.js.map

package/dist/account-demo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-demo.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;"}

package/dist/account.js

@@ -0,0 +1,25 @@
+import { ACCOUNT_CONNECTOR_FUNCTIONS, missingConnectorFunctionsOf } from "./account/accountConnector.js";
+import { ACCOUNT_REST_PATHS, createRestAccountConnector, securityChangeFromResponse, securityFromResponse } from "./account/restAccountConnector.js";
+import { default as default2, useAccount } from "./account/AccountProvider.js";
+import { default as default3 } from "./account/AccountSecuritySection.js";
+import { default as default4 } from "./account/ForgotPasswordScreen.js";
+import { PROFILE_TAB, default as default5 } from "./account/ProfileScreen.js";
+import { default as default6 } from "./account/ResetPasswordScreen.js";
+import { default as default7 } from "./account/SignInScreen.js";
+export {
+  ACCOUNT_CONNECTOR_FUNCTIONS,
+  ACCOUNT_REST_PATHS,
+  default2 as AccountProvider,
+  default3 as AccountSecuritySection,
+  default4 as ForgotPasswordScreen,
+  PROFILE_TAB,
+  default5 as ProfileScreen,
+  default6 as ResetPasswordScreen,
+  default7 as SignInScreen,
+  createRestAccountConnector,
+  missingConnectorFunctionsOf,
+  securityChangeFromResponse,
+  securityFromResponse,
+  useAccount
+};
+//# sourceMappingURL=account.js.map

package/dist/account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;"}

package/dist/adapters/i18next.js

@@ -0,0 +1,7 @@
+function translateWithI18next(i18n) {
+  return (namespace, key, values) => i18n.exists(key, { ns: namespace }) ? i18n.t(key, { ns: namespace, ...values }) : void 0;
+}
+export {
+  translateWithI18next
+};
+//# sourceMappingURL=i18next.js.map

package/dist/adapters/i18next.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"i18next.js","sources":["../../src/adapters/i18next.js"],"sourcesContent":["// Los textos del paquete desde i18next, para un proyecto que ya lo usa: el proyecto escribe sus textos en sus\n// namespaces de siempre (table, common, problems, validation, dictionaries) y lo que no escriba sale del paquete.\n//\n//   <ToolkitProvider language={i18n.resolvedLanguage} onLanguageChange={(language) => i18n.changeLanguage(language)}\n//                    translate={translateWithI18next(i18n)}>\n//\n// No importa i18next: recibe la instancia del proyecto.\n//\n// Funciones puras, no renderizan: function (regla de la casa).\n\n/**\n * El traductor de ToolkitProvider sobre una instancia de i18next: si la llave existe en el proyecto regresa su texto;\n * si no, undefined, y el paquete usa el suyo.\n *\n * @param {{exists: Function, t: Function}} i18n la instancia de i18next del proyecto\n * @returns {(namespace: string, key: string, values?: object) => string|undefined}\n */\nexport function translateWithI18next(i18n) {\n    return (namespace, key, values) => (i18n.exists(key, {ns: namespace}) ? i18n.t(key, {ns: namespace, ...values}) : undefined);\n}\n"],"names":[],"mappings":"AAiBO,SAAS,qBAAqB,MAAM;AACvC,SAAO,CAAC,WAAW,KAAK,WAAY,KAAK,OAAO,KAAK,EAAC,IAAI,UAAS,CAAC,IAAI,KAAK,EAAE,KAAK,EAAC,IAAI,WAAW,GAAG,OAAM,CAAC,IAAI;AACtH;"}

package/dist/adapters/nextNavigation.js

@@ -0,0 +1,36 @@
+"use client";
+import { jsx } from "react/jsx-runtime";
+import { useCallback } from "react";
+import NextLink from "next/link";
+import { usePathname, useRouter } from "next/navigation";
+function useNextNavigate() {
+  const router = useRouter();
+  return useCallback((to, options) => {
+    if (typeof to === "number") {
+      if (to < 0) {
+        router.back();
+      } else {
+        router.forward();
+      }
+      return;
+    }
+    if (options?.replace) {
+      router.replace(to);
+    } else {
+      router.push(to);
+    }
+  }, [router]);
+}
+function useNextLocation() {
+  const pathname = usePathname();
+  const search = typeof window === "undefined" ? "" : window.location.search;
+  return { pathname, search, key: `${pathname}${search}` };
+}
+function NextToLink({ to, href, ...linkProps }) {
+  return /* @__PURE__ */ jsx(NextLink, { href: to ?? href, ...linkProps });
+}
+const nextNavigation = Object.freeze({ useNavigate: useNextNavigate, useLocation: useNextLocation, Link: NextToLink });
+export {
+  nextNavigation
+};
+//# sourceMappingURL=nextNavigation.js.map

package/dist/adapters/nextNavigation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nextNavigation.js","sources":["../../src/adapters/nextNavigation.jsx"],"sourcesContent":["// La navegación de Next.js (App Router) para ToolkitProvider (@stackcraftmx/calcita/next): las tres piezas que piden los\n// componentes del framework, sacadas de next/navigation y next/link.\n//\n//   <ToolkitProvider navigation={nextNavigation}>   (dentro de un componente de cliente: el de los proveedores)\n//\n// Decisiones, con su porqué:\n//   - search se lee del navegador al pintar y NO con useSearchParams: useSearchParams obliga a envolver la página en\n//     <Suspense> (si no, `next build` truena con «Missing Suspense boundary»). En el servidor no hay búsqueda: ''.\n//   - useNavigate(-1) regresa (router.back): BackButton lo usa cuando hay historial.\n//   - Link recibe `to` (como los componentes del framework, y como MUI con component={Link}) y se lo da a next/link como\n//     href.\n// OJO: el «Regresar» que dice a dónde regresa (navigationTrail) lee el índice del historial que pone react-router; con\n// Next no existe, así que BackButton regresa a la última lista anotada o a fallbackTo.\n//\n// Genéricos del paquete: function (regla de la casa).\nimport {useCallback} from 'react';\nimport NextLink from 'next/link';\nimport {usePathname, useRouter} from 'next/navigation';\n\n/**\n * navigate(to) del framework con el router de Next.\n *\n * @returns {(to: string|number, options?: {replace?: boolean}) => void}\n */\nfunction useNextNavigate() {\n    const router = useRouter();\n    return useCallback((to, options) => {\n        if (typeof to === 'number') {\n            if (to < 0) {\n                router.back();\n            } else {\n                router.forward();\n            }\n            return;\n        }\n        if (options?.replace) {\n            router.replace(to);\n        } else {\n            router.push(to);\n        }\n    }, [router]);\n}\n\n/**\n * {pathname, search, key} de la página abierta.\n *\n * @returns {{pathname: string, search: string, key: string}}\n */\nfunction useNextLocation() {\n    const pathname = usePathname();\n    const search = typeof window === 'undefined' ? '' : window.location.search;\n    return {pathname, search, key: `${pathname}${search}`};\n}\n\n/**\n * next/link con la prop `to` del framework.\n *\n * @param {{to?: string, href?: string}} props\n */\nfunction NextToLink({to, href, ...linkProps}) {\n    return <NextLink href={to ?? href} {...linkProps} />;\n}\n\nexport const nextNavigation = Object.freeze({useNavigate: useNextNavigate, useLocation: useNextLocation, Link: NextToLink});\n"],"names":[],"mappings":";;;;;AAwBA,SAAS,kBAAkB;AACvB,QAAM,SAAS,UAAA;AACf,SAAO,YAAY,CAAC,IAAI,YAAY;AAChC,QAAI,OAAO,OAAO,UAAU;AACxB,UAAI,KAAK,GAAG;AACR,eAAO,KAAA;AAAA,MACX,OAAO;AACH,eAAO,QAAA;AAAA,MACX;AACA;AAAA,IACJ;AACA,QAAI,SAAS,SAAS;AAClB,aAAO,QAAQ,EAAE;AAAA,IACrB,OAAO;AACH,aAAO,KAAK,EAAE;AAAA,IAClB;AAAA,EACJ,GAAG,CAAC,MAAM,CAAC;AACf;AAOA,SAAS,kBAAkB;AACvB,QAAM,WAAW,YAAA;AACjB,QAAM,SAAS,OAAO,WAAW,cAAc,KAAK,OAAO,SAAS;AACpE,SAAO,EAAC,UAAU,QAAQ,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAA;AACvD;AAOA,SAAS,WAAW,EAAC,IAAI,MAAM,GAAG,aAAY;AAC1C,6BAAQ,UAAA,EAAS,MAAM,MAAM,MAAO,GAAG,WAAW;AACtD;AAEO,MAAM,iBAAiB,OAAO,OAAO,EAAC,aAAa,iBAAiB,aAAa,iBAAiB,MAAM,WAAA,CAAW;"}

package/dist/adapters/reactRouter.js

@@ -0,0 +1,7 @@
+"use client";
+import { Link, useLocation, useNavigate } from "react-router";
+const reactRouterNavigation = Object.freeze({ useNavigate, useLocation, Link });
+export {
+  reactRouterNavigation
+};
+//# sourceMappingURL=reactRouter.js.map

package/dist/adapters/reactRouter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reactRouter.js","sources":["../../src/adapters/reactRouter.js"],"sourcesContent":["// La navegación de react-router para ToolkitProvider: tiene justo las tres piezas que piden los componentes del paquete.\n//\n//   <ToolkitProvider navigation={reactRouterNavigation}>\n//\n// Va dentro del router (RouterProvider o BrowserRouter), porque sus hooks leen el router.\nimport {Link, useLocation, useNavigate} from 'react-router';\n\nexport const reactRouterNavigation = Object.freeze({useNavigate, useLocation, Link});\n"],"names":[],"mappings":";;AAOY,MAAC,wBAAwB,OAAO,OAAO,EAAC,aAAa,aAAa,KAAI,CAAC;"}

package/dist/adapters/reactRouterRoutes.js

@@ -0,0 +1,48 @@
+"use client";
+import { jsx } from "react/jsx-runtime";
+import { useEffect } from "react";
+import { useRouteError, isRouteErrorResponse, useNavigation, useOutletContext, Outlet } from "react-router";
+import RequireAccess from "../access/RequireAccess.js";
+import { isStaleChunkError, recoverFromStaleChunk } from "../api/staleChunks.js";
+import { createLogger } from "../observability/logger.js";
+import ErrorPage, { ERROR_PAGE_KIND } from "../ui/layout/ErrorPage.js";
+const log = createLogger("navigation");
+const NOT_FOUND_STATUS = 404;
+function AccessOutlet({ access }) {
+  const parentContext = useOutletContext();
+  return /* @__PURE__ */ jsx(RequireAccess, { access, children: /* @__PURE__ */ jsx(Outlet, { context: parentContext }) });
+}
+function withAccess(access, routes) {
+  return { element: /* @__PURE__ */ jsx(AccessOutlet, { access }), children: routes };
+}
+function useIsNavigating() {
+  return useNavigation().state === "loading";
+}
+function withChunkRecovery(routes) {
+  return routes.map((route) => ({
+    ...route,
+    ...typeof route.lazy === "function" && { lazy: () => route.lazy().catch(recoverFromStaleChunk) },
+    ...route.children && { children: withChunkRecovery(route.children) }
+  }));
+}
+function reloadPage() {
+  window.location.reload();
+}
+function RouteErrorScreen() {
+  const error = useRouteError();
+  const isNotFound = isRouteErrorResponse(error) && error.status === NOT_FOUND_STATUS;
+  const kind = isNotFound ? ERROR_PAGE_KIND.notFound : isStaleChunkError(error) ? ERROR_PAGE_KIND.newVersion : ERROR_PAGE_KIND.serverError;
+  useEffect(() => {
+    if (!isNotFound) {
+      log.error("una pantalla no se pudo pintar", { name: error?.name, message: error?.message ?? String(error) });
+    }
+  }, [error, isNotFound]);
+  return /* @__PURE__ */ jsx(ErrorPage, { kind, onRetry: isNotFound ? void 0 : reloadPage });
+}
+export {
+  RouteErrorScreen,
+  useIsNavigating,
+  withAccess,
+  withChunkRecovery
+};
+//# sourceMappingURL=reactRouterRoutes.js.map

package/dist/adapters/reactRouterRoutes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reactRouterRoutes.js","sources":["../../src/adapters/reactRouterRoutes.jsx"],"sourcesContent":["// Lo que conecta los permisos y la barra con react-router (@stackcraftmx/calcita/react-router):\n//\n//   withAccess(access, routes)   un grupo de rutas con la regla del menu.js de su módulo: quien no puede ve la página de\n//                                «sin permiso» en lugar de la pantalla\n//   useIsNavigating()            la pantalla siguiente se está descargando (rutas lazy): para la rayita de AppLayout\n//   withChunkRecovery(routes)    las rutas lazy recargan UNA vez si su archivo es de una versión que ya no existe\n//   RouteErrorScreen             la pantalla de error de una ruta (errorElement / ErrorBoundary del router): «Hay una\n//                                versión nueva» o «Algo falló», con su botón para recargar\n//\n//   import {access} from '@/modules/users/menu.js';\n//   import {routes} from '@/modules/users/routes.js';\n//   children: [withAccess(access, routes)]\n//\n// OJO: useIsNavigating solo funciona con un router de datos (createBrowserRouter); con <BrowserRouter> no hay estado de\n// navegación.\n//\n// Genéricos del paquete: function (regla de la casa).\nimport {useEffect} from 'react';\nimport {Outlet, isRouteErrorResponse, useNavigation, useOutletContext, useRouteError} from 'react-router';\n\nimport RequireAccess from '@/access/RequireAccess.jsx';\nimport {isStaleChunkError, recoverFromStaleChunk} from '@/api/staleChunks.js';\nimport {createLogger} from '@/observability/logger.js';\nimport ErrorPage, {ERROR_PAGE_KIND} from '@/ui/layout/ErrorPage.jsx';\n\nconst log = createLogger('navigation');\nconst NOT_FOUND_STATUS = 404;\n\n/**\n * El grupo con permiso: RequireAccess alrededor de las rutas hijas.\n *\n * OJO, trampa pagada: un <Outlet /> nuevo corta el contexto que la ruta de arriba le pasa a sus hijas (<Outlet\n * context={...} />, useOutletContext); el inicio de los ejemplos tronaba sin el menú. Aquí se pasa tal cual.\n *\n * @param {{access: object|undefined}} props\n */\nfunction AccessOutlet({access}) {\n    const parentContext = useOutletContext();\n    return <RequireAccess access={access}><Outlet context={parentContext} /></RequireAccess>;\n}\n\n/**\n * Un grupo de rutas sin camino propio que pide permiso antes de pintar a sus hijas.\n *\n * @param {object|undefined} access la regla (accessRules.js); sin ella, el grupo es de todos\n * @param {object[]} routes las rutas del módulo\n * @returns {object} la ruta de react-router\n */\nexport function withAccess(access, routes) {\n    return {element: <AccessOutlet access={access} />, children: routes};\n}\n\n/**\n * ¿Se está descargando la pantalla siguiente?\n *\n * @returns {boolean}\n */\nexport function useIsNavigating() {\n    return useNavigation().state === 'loading';\n}\n\n/**\n * Las rutas con la recuperación de archivos viejos (staleChunks.js): cada `lazy`, también la de las hijas, recarga la\n * página UNA vez si el archivo de su pantalla ya no existe porque se publicó otra versión. Lo demás de la ruta no cambia.\n *\n * @param {object[]} routes\n * @returns {object[]}\n */\nexport function withChunkRecovery(routes) {\n    return routes.map((route) => ({\n        ...route,\n        ...(typeof route.lazy === 'function' && {lazy: () => route.lazy().catch(recoverFromStaleChunk)}),\n        ...(route.children && {children: withChunkRecovery(route.children)}),\n    }));\n}\n\n/** Recargar la página: trae la versión publicada. */\nfunction reloadPage() {\n    window.location.reload();\n}\n\n/**\n * La pantalla de error de una ruta (la que el router enseña cuando la pantalla truena o no se pudo descargar): una ruta\n * que no existe es «Esta página no existe»; un archivo de otra versión, «Hay una versión nueva»; lo demás, «Algo falló de\n * nuestro lado». Las dos últimas con su botón para recargar.\n *\n *   createBrowserRouter([{path: '/', element: <App />, ErrorBoundary: RouteErrorScreen, children: [...]}])\n */\nexport function RouteErrorScreen() {\n    const error = useRouteError();\n    const isNotFound = isRouteErrorResponse(error) && error.status === NOT_FOUND_STATUS;\n    const kind = isNotFound ? ERROR_PAGE_KIND.notFound : (isStaleChunkError(error) ? ERROR_PAGE_KIND.newVersion : ERROR_PAGE_KIND.serverError);\n\n    useEffect(() => {\n        if (!isNotFound) {\n            log.error('una pantalla no se pudo pintar', {name: error?.name, message: error?.message ?? String(error)});\n        }\n    }, [error, isNotFound]);\n\n    return <ErrorPage kind={kind} onRetry={isNotFound ? undefined : reloadPage} />;\n}\n"],"names":[],"mappings":";;;;;;;;AAyBA,MAAM,MAAM,aAAa,YAAY;AACrC,MAAM,mBAAmB;AAUzB,SAAS,aAAa,EAAC,UAAS;AAC5B,QAAM,gBAAgB,iBAAA;AACtB,6BAAQ,eAAA,EAAc,QAAgB,8BAAC,QAAA,EAAO,SAAS,eAAe,EAAA,CAAE;AAC5E;AASO,SAAS,WAAW,QAAQ,QAAQ;AACvC,SAAO,EAAC,SAAS,oBAAC,gBAAa,QAAgB,GAAI,UAAU,OAAA;AACjE;AAOO,SAAS,kBAAkB;AAC9B,SAAO,cAAA,EAAgB,UAAU;AACrC;AASO,SAAS,kBAAkB,QAAQ;AACtC,SAAO,OAAO,IAAI,CAAC,WAAW;AAAA,IAC1B,GAAG;AAAA,IACH,GAAI,OAAO,MAAM,SAAS,cAAc,EAAC,MAAM,MAAM,MAAM,KAAA,EAAO,MAAM,qBAAqB,EAAA;AAAA,IAC7F,GAAI,MAAM,YAAY,EAAC,UAAU,kBAAkB,MAAM,QAAQ,EAAA;AAAA,EAAC,EACpE;AACN;AAGA,SAAS,aAAa;AAClB,SAAO,SAAS,OAAA;AACpB;AASO,SAAS,mBAAmB;AAC/B,QAAM,QAAQ,cAAA;AACd,QAAM,aAAa,qBAAqB,KAAK,KAAK,MAAM,WAAW;AACnE,QAAM,OAAO,aAAa,gBAAgB,WAAY,kBAAkB,KAAK,IAAI,gBAAgB,aAAa,gBAAgB;AAE9H,YAAU,MAAM;AACZ,QAAI,CAAC,YAAY;AACb,UAAI,MAAM,kCAAkC,EAAC,MAAM,OAAO,MAAM,SAAS,OAAO,WAAW,OAAO,KAAK,EAAA,CAAE;AAAA,IAC7G;AAAA,EACJ,GAAG,CAAC,OAAO,UAAU,CAAC;AAEtB,6BAAQ,WAAA,EAAU,MAAY,SAAS,aAAa,SAAY,YAAY;AAChF;"}

package/dist/api/ApiError.js

@@ -0,0 +1,58 @@
+import { problemMessage, problemTitle } from "../problems.js";
+const API_ERROR_STATUS = Object.freeze({
+  // no hubo respuesta: red caída, servidor apagado o se acabó el tiempo
+  offline: 0,
+  unauthenticated: 401,
+  forbidden: 403,
+  notFound: 404,
+  // el registro no está en el estado que la acción necesita (p. ej. cerrar un mes que no está completo)
+  conflict: 409,
+  // la liga ya venció, ya se usó o no existe
+  gone: 410,
+  validation: 422,
+  tooManyRequests: 429
+});
+class ApiError extends Error {
+  /**
+   * @param {object} details
+   * @param {number} details.status el status HTTP; 0 si no hubo respuesta
+   * @param {object|null} [details.problem] el cuerpo RFC 9457 del servidor ({title, detail, code, errors, request_id})
+   * @param {boolean} [details.translatedByServer] false si la respuesta llegó en otro idioma que el pedido
+   * @param {number|null} [details.retryAfterSeconds] 429: los segundos del header Retry-After
+   */
+  constructor({ status, problem = null, translatedByServer = true, retryAfterSeconds = null }) {
+    super(problemMessage(problem, status, { translatedByServer }));
+    this.name = "ApiError";
+    this.status = status;
+    this.problem = problem ?? {};
+    this.code = problem?.code ?? (status === API_ERROR_STATUS.offline ? "offline" : null);
+    this.title = problemTitle(problem, status, { translatedByServer });
+    this.requestId = problem?.request_id ?? null;
+    this.retryAfterSeconds = retryAfterSeconds;
+  }
+  /** No hubo respuesta del servidor (red caída, servidor apagado, se acabó el tiempo). */
+  get isOffline() {
+    return this.status === API_ERROR_STATUS.offline;
+  }
+  /** Sin sesión, o se venció mientras se usaba la app. */
+  get isUnauthenticated() {
+    return this.status === API_ERROR_STATUS.unauthenticated;
+  }
+  /** El registro no está en el estado que la acción necesita. */
+  get isConflict() {
+    return this.status === API_ERROR_STATUS.conflict;
+  }
+  /** La liga venció, ya se usó o no existe. */
+  get isGone() {
+    return this.status === API_ERROR_STATUS.gone;
+  }
+  /** Errores de un formulario: los mensajes por campo van en problem.errors (fieldErrorsOf). */
+  get isValidation() {
+    return this.status === API_ERROR_STATUS.validation;
+  }
+}
+export {
+  API_ERROR_STATUS,
+  ApiError
+};
+//# sourceMappingURL=ApiError.js.map

package/dist/api/ApiError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ApiError.js","sources":["../../src/api/ApiError.js"],"sourcesContent":["// El error de cualquier petición al servidor, con la misma forma siempre: un error del servidor (RFC 9457), una red caída\n// o un archivo que llegó cortado. Así la pantalla tiene UNA forma de error que enseñar y no dos.\n//\n// El mensaje ya viene en el idioma de la persona: si el servidor lo mandó traducido (title y detail en el idioma de\n// Accept-Language) se usa tal cual; si no (sin red, un 502 del proxy en HTML, una respuesta en otro idioma), el texto\n// genérico del paquete según el status (problems.js).\n//\n// Lo usan los formularios (applyServerProblem: los errores de un 422 van a su campo), toastProblem, la tabla, las\n// descargas y la subida de archivos.\n//\n// Una clase porque es un Error (trae su pila y `instanceof ApiError` funciona); lo demás del paquete son funciones.\nimport {problemMessage, problemTitle} from '@/problems.js';\n\n/** Los status que la pantalla suele tratar distinto, con su nombre. */\nexport const API_ERROR_STATUS = Object.freeze({\n    // no hubo respuesta: red caída, servidor apagado o se acabó el tiempo\n    offline: 0,\n    unauthenticated: 401,\n    forbidden: 403,\n    notFound: 404,\n    // el registro no está en el estado que la acción necesita (p. ej. cerrar un mes que no está completo)\n    conflict: 409,\n    // la liga ya venció, ya se usó o no existe\n    gone: 410,\n    validation: 422,\n    tooManyRequests: 429,\n});\n\nexport class ApiError extends Error {\n    /**\n     * @param {object} details\n     * @param {number} details.status el status HTTP; 0 si no hubo respuesta\n     * @param {object|null} [details.problem] el cuerpo RFC 9457 del servidor ({title, detail, code, errors, request_id})\n     * @param {boolean} [details.translatedByServer] false si la respuesta llegó en otro idioma que el pedido\n     * @param {number|null} [details.retryAfterSeconds] 429: los segundos del header Retry-After\n     */\n    constructor({status, problem = null, translatedByServer = true, retryAfterSeconds = null}) {\n        super(problemMessage(problem, status, {translatedByServer}));\n        this.name = 'ApiError';\n        this.status = status;\n        this.problem = problem ?? {};\n        this.code = problem?.code ?? (status === API_ERROR_STATUS.offline ? 'offline' : null);\n        this.title = problemTitle(problem, status, {translatedByServer});\n        // el id con que el servidor guardó el error en su bitácora: lo que se le pasa a soporte\n        this.requestId = problem?.request_id ?? null;\n        this.retryAfterSeconds = retryAfterSeconds;\n    }\n\n    /** No hubo respuesta del servidor (red caída, servidor apagado, se acabó el tiempo). */\n    get isOffline() {\n        return this.status === API_ERROR_STATUS.offline;\n    }\n\n    /** Sin sesión, o se venció mientras se usaba la app. */\n    get isUnauthenticated() {\n        return this.status === API_ERROR_STATUS.unauthenticated;\n    }\n\n    /** El registro no está en el estado que la acción necesita. */\n    get isConflict() {\n        return this.status === API_ERROR_STATUS.conflict;\n    }\n\n    /** La liga venció, ya se usó o no existe. */\n    get isGone() {\n        return this.status === API_ERROR_STATUS.gone;\n    }\n\n    /** Errores de un formulario: los mensajes por campo van en problem.errors (fieldErrorsOf). */\n    get isValidation() {\n        return this.status === API_ERROR_STATUS.validation;\n    }\n}\n"],"names":[],"mappings":";AAcY,MAAC,mBAAmB,OAAO,OAAO;AAAA;AAAA,EAE1C,SAAS;AAAA,EACT,iBAAiB;AAAA,EACjB,WAAW;AAAA,EACX,UAAU;AAAA;AAAA,EAEV,UAAU;AAAA;AAAA,EAEV,MAAM;AAAA,EACN,YAAY;AAAA,EACZ,iBAAiB;AACrB,CAAC;AAEM,MAAM,iBAAiB,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQhC,YAAY,EAAC,QAAQ,UAAU,MAAM,qBAAqB,MAAM,oBAAoB,KAAI,GAAG;AACvF,UAAM,eAAe,SAAS,QAAQ,EAAC,mBAAkB,CAAC,CAAC;AAC3D,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,UAAU,WAAW,CAAA;AAC1B,SAAK,OAAO,SAAS,SAAS,WAAW,iBAAiB,UAAU,YAAY;AAChF,SAAK,QAAQ,aAAa,SAAS,QAAQ,EAAC,mBAAkB,CAAC;AAE/D,SAAK,YAAY,SAAS,cAAc;AACxC,SAAK,oBAAoB;AAAA,EAC7B;AAAA;AAAA,EAGA,IAAI,YAAY;AACZ,WAAO,KAAK,WAAW,iBAAiB;AAAA,EAC5C;AAAA;AAAA,EAGA,IAAI,oBAAoB;AACpB,WAAO,KAAK,WAAW,iBAAiB;AAAA,EAC5C;AAAA;AAAA,EAGA,IAAI,aAAa;AACb,WAAO,KAAK,WAAW,iBAAiB;AAAA,EAC5C;AAAA;AAAA,EAGA,IAAI,SAAS;AACT,WAAO,KAAK,WAAW,iBAAiB;AAAA,EAC5C;AAAA;AAAA,EAGA,IAAI,eAAe;AACf,WAAO,KAAK,WAAW,iBAAiB;AAAA,EAC5C;AACJ;"}