@stackcraftmx/calcita 0.0.0-stage → 0.25.0

package/dist/account/demo/createDemoAccountConnector.js

@@ -0,0 +1,368 @@
+import { ApiError } from "../../api/ApiError.js";
+import { totpCodeAt, newTotpSecret, isValidTotpCode, otpauthUrlOf } from "./totp.js";
+import { translateToolkit } from "../../toolkit/toolkitSettings.js";
+const HTTP_STATUS = Object.freeze({ unauthorized: 401, unprocessable: 422, locked: 423 });
+const DEMO_USER = Object.freeze({ id: "user-demo", name: "Ana Martínez Ruiz", email: "ana.martinez@ejemplo.com", subtitle: "Administración", phone: "" });
+const DEFAULT_STORAGE_KEY = "calcita-demo:session";
+const DEFAULT_DELAY_MILLISECONDS = 400;
+const DEFAULT_ISSUER = "Calcita";
+const RECOVERY_CODE_COUNT = 10;
+const RECOVERY_CODE_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
+const SECOND_STEP_ATTEMPTS = 5;
+const SECOND_STEP_MINUTES = 5;
+const MILLISECONDS_PER_MINUTE = 6e4;
+const MILLISECONDS_PER_HOUR = 60 * MILLISECONDS_PER_MINUTE;
+const PASSKEY_TIMEOUT_MILLISECONDS = 6e4;
+const CHALLENGE_BYTES = 32;
+const ES256 = -7;
+const RS256 = -257;
+const METHOD = Object.freeze({ passkey: "passkey", totp: "totp", recoveryCode: "recoveryCode" });
+const THIS_NETWORK = "187.190.x.x";
+const messageOf = (key, values) => translateToolkit("account", `demo.server.${key}`, values);
+function base64UrlOf(bytes) {
+  return btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function thisDevice() {
+  const userAgent = typeof navigator === "undefined" ? "" : navigator.userAgent;
+  const browser = /Edg\//.test(userAgent) ? "Edge" : /Firefox\//.test(userAgent) ? "Firefox" : /Chrome\//.test(userAgent) ? "Chrome" : /Safari\//.test(userAgent) ? "Safari" : null;
+  const platform = /iPhone|iPad/.test(userAgent) ? "iOS" : /Android/.test(userAgent) ? "Android" : /Mac OS X/.test(userAgent) ? "macOS" : /Windows/.test(userAgent) ? "Windows" : /Linux/.test(userAgent) ? "Linux" : null;
+  return { browser, platform, isMobile: /iPhone|Android.*Mobile/.test(userAgent) };
+}
+function newRecoveryCodes() {
+  return Array.from({ length: RECOVERY_CODE_COUNT }, () => {
+    const characters = Array.from(crypto.getRandomValues(new Uint8Array(10)), (byte) => RECOVERY_CODE_ALPHABET[byte % RECOVERY_CODE_ALPHABET.length]);
+    return `${characters.slice(0, 5).join("")}-${characters.slice(5).join("")}`;
+  });
+}
+function fieldError(field, message) {
+  return new ApiError({
+    status: HTTP_STATUS.unprocessable,
+    problem: { title: messageOf("validationTitle"), detail: messageOf("validationDetail"), errors: { [field]: [message] } }
+  });
+}
+function createDemoAccountConnector({
+  user = DEMO_USER,
+  roles = ["admin"],
+  abilities = [],
+  labels = [],
+  storageKey = DEFAULT_STORAGE_KEY,
+  toQrImageUrl,
+  issuer = DEFAULT_ISSUER,
+  delayMilliseconds = DEFAULT_DELAY_MILLISECONDS
+} = {}) {
+  const profile = { ...user };
+  const security = initialSecurity();
+  let pendingSecondStep = null;
+  const wait = () => new Promise((resolve) => setTimeout(resolve, delayMilliseconds));
+  function initialSecurity() {
+    const now = Date.now();
+    const device = thisDevice();
+    const deviceName = `${device.browser ?? "—"} · ${device.platform ?? "—"}`;
+    return {
+      totp: null,
+      pendingTotpSecret: null,
+      passkeys: [],
+      recoveryCodes: [],
+      enabledAt: null,
+      sessions: [
+        { id: "session-this", ...device, startedAt: new Date(now - 2 * MILLISECONDS_PER_HOUR).toISOString(), network: THIS_NETWORK, isCurrent: true },
+        {
+          id: "session-phone",
+          browser: "Safari",
+          platform: "iOS",
+          isMobile: true,
+          startedAt: new Date(now - 26 * MILLISECONDS_PER_HOUR).toISOString(),
+          network: "201.141.x.x",
+          isCurrent: false
+        }
+      ],
+      // de lo más nuevo a lo más viejo
+      events: [
+        { id: "event-2", kind: "signedIn", occurredAt: new Date(now - 2 * MILLISECONDS_PER_HOUR).toISOString(), device: deviceName, network: THIS_NETWORK },
+        { id: "event-1", kind: "signInFailed", occurredAt: new Date(now - 30 * MILLISECONDS_PER_HOUR).toISOString(), device: "Firefox · Windows", network: "177.230.x.x" }
+      ]
+    };
+  }
+  const isSignedIn = () => {
+    try {
+      return window.localStorage.getItem(storageKey) === profile.id;
+    } catch {
+      return false;
+    }
+  };
+  const rememberSession = (signedIn) => {
+    try {
+      if (signedIn) {
+        window.localStorage.setItem(storageKey, profile.id);
+      } else {
+        window.localStorage.removeItem(storageKey);
+      }
+    } catch {
+    }
+  };
+  const failIfSignedOut = () => {
+    if (!isSignedIn()) {
+      throw new ApiError({ status: HTTP_STATUS.unauthorized, problem: { title: messageOf("noSessionTitle"), detail: messageOf("noSession") } });
+    }
+  };
+  const failWithoutPassword = (password) => {
+    if (!password) {
+      throw fieldError("password", messageOf("passwordRequired"));
+    }
+  };
+  const recordEvent = (kind) => {
+    const device = thisDevice();
+    security.events.unshift({
+      id: `event-${Date.now()}-${security.events.length}`,
+      kind,
+      occurredAt: (/* @__PURE__ */ new Date()).toISOString(),
+      device: `${device.browser ?? "—"} · ${device.platform ?? "—"}`,
+      network: THIS_NETWORK
+    });
+  };
+  const isSecondFactorOn = () => Boolean(security.totp) || security.passkeys.length > 0;
+  const securityNow = () => ({
+    isEnabled: isSecondFactorOn(),
+    enabledAt: security.enabledAt,
+    passkeys: security.passkeys.map(({ id, name, createdAt, lastUsedAt }) => ({ id, name, createdAt, lastUsedAt })),
+    totp: { isEnabled: Boolean(security.totp), enabledAt: security.totp?.enabledAt ?? null },
+    recoveryCodesRemaining: security.recoveryCodes.length
+  });
+  const turnOnIfFirstFactor = (wasOn) => {
+    if (wasOn) {
+      return void 0;
+    }
+    security.enabledAt = (/* @__PURE__ */ new Date()).toISOString();
+    security.recoveryCodes = newRecoveryCodes();
+    recordEvent("twoStepEnabled");
+    return [...security.recoveryCodes];
+  };
+  const turnOffIfNoFactorLeft = () => {
+    if (!isSecondFactorOn()) {
+      security.enabledAt = null;
+      security.recoveryCodes = [];
+      recordEvent("twoStepDisabled");
+    }
+  };
+  const pendingOrFail = () => {
+    if (!pendingSecondStep || Date.now() > pendingSecondStep.expiresAt) {
+      pendingSecondStep = null;
+      throw new ApiError({ status: HTTP_STATUS.unauthorized, problem: { code: "second_step_expired", title: messageOf("expiredTitle"), detail: messageOf("expired") } });
+    }
+  };
+  const failSecondStep = () => {
+    pendingSecondStep.attemptsLeft -= 1;
+    recordEvent("signInFailed");
+    if (pendingSecondStep.attemptsLeft <= 0) {
+      pendingSecondStep = null;
+      throw new ApiError({ status: HTTP_STATUS.locked, problem: { code: "account_locked", title: messageOf("lockedTitle"), detail: messageOf("locked") } });
+    }
+    throw new ApiError({
+      status: HTTP_STATUS.unauthorized,
+      problem: { code: "invalid_code", title: messageOf("wrongCodeTitle"), detail: messageOf("wrongCode"), remaining_attempts: pendingSecondStep.attemptsLeft }
+    });
+  };
+  const finishSignIn = (kind = "signedIn") => {
+    pendingSecondStep = null;
+    rememberSession(true);
+    recordEvent(kind);
+  };
+  const passkeyChallenge = () => base64UrlOf(crypto.getRandomValues(new Uint8Array(CHALLENGE_BYTES)));
+  return {
+    loadSession: async () => {
+      await wait();
+      return isSignedIn() ? { user: { ...profile }, roles: [...roles], abilities: [...abilities], labels: [...labels] } : null;
+    },
+    signIn: async ({ email }) => {
+      await wait();
+      if (email?.trim().toLowerCase() !== profile.email.toLowerCase()) {
+        throw new ApiError({
+          status: HTTP_STATUS.unauthorized,
+          problem: { title: messageOf("wrongCredentialsTitle"), detail: messageOf("wrongCredentials", { email: profile.email }) }
+        });
+      }
+      if (!isSecondFactorOn()) {
+        finishSignIn();
+        return { secondStep: null };
+      }
+      pendingSecondStep = { expiresAt: Date.now() + SECOND_STEP_MINUTES * MILLISECONDS_PER_MINUTE, attemptsLeft: SECOND_STEP_ATTEMPTS };
+      const methods = [
+        ...security.passkeys.length > 0 ? [METHOD.passkey] : [],
+        ...security.totp ? [METHOD.totp] : [],
+        ...security.recoveryCodes.length > 0 ? [METHOD.recoveryCode] : []
+      ];
+      return { secondStep: { methods } };
+    },
+    signInSecondStep: async ({ method, code }) => {
+      await wait();
+      pendingOrFail();
+      if (method === METHOD.recoveryCode) {
+        if (!security.recoveryCodes.includes(code)) {
+          failSecondStep();
+        }
+        security.recoveryCodes = security.recoveryCodes.filter((unusedCode) => unusedCode !== code);
+        finishSignIn("recoveryCodeUsed");
+        return;
+      }
+      if (!security.totp || !await isValidTotpCode(security.totp.secret, code)) {
+        failSecondStep();
+      }
+      finishSignIn();
+    },
+    secondStepPasskeyOptions: async () => {
+      await wait();
+      pendingOrFail();
+      return {
+        challenge: passkeyChallenge(),
+        rpId: window.location.hostname,
+        userVerification: "preferred",
+        timeout: PASSKEY_TIMEOUT_MILLISECONDS,
+        allowCredentials: security.passkeys.map((passkey) => ({ id: passkey.credentialId, type: "public-key" }))
+      };
+    },
+    signInWithPasskey: async (credential) => {
+      await wait();
+      pendingOrFail();
+      const passkey = security.passkeys.find((candidate) => candidate.credentialId === credential?.id);
+      if (!passkey) {
+        failSecondStep();
+      }
+      passkey.lastUsedAt = (/* @__PURE__ */ new Date()).toISOString();
+      finishSignIn();
+    },
+    signOut: async () => {
+      await wait();
+      rememberSession(false);
+    },
+    requestPasswordReset: async () => {
+      await wait();
+    },
+    resetPassword: async () => {
+      await wait();
+      recordEvent("passwordChanged");
+    },
+    updateProfile: async ({ name, phone }) => {
+      await wait();
+      failIfSignedOut();
+      if (!name?.trim()) {
+        throw fieldError("name", messageOf("nameRequired"));
+      }
+      profile.name = name.trim();
+      profile.phone = phone?.trim() ?? "";
+      return { message: messageOf("profileSaved") };
+    },
+    changePassword: async () => {
+      await wait();
+      failIfSignedOut();
+      recordEvent("passwordChanged");
+    },
+    loadSecurity: async () => {
+      await wait();
+      failIfSignedOut();
+      return securityNow();
+    },
+    startTotp: async () => {
+      await wait();
+      failIfSignedOut();
+      security.pendingTotpSecret = newTotpSecret();
+      const otpauthUrl = otpauthUrlOf({ secret: security.pendingTotpSecret, account: profile.email, issuer });
+      return { secret: security.pendingTotpSecret, qrImageUrl: toQrImageUrl ? await toQrImageUrl(otpauthUrl) : null };
+    },
+    confirmTotp: async (code) => {
+      await wait();
+      failIfSignedOut();
+      if (!security.pendingTotpSecret || !await isValidTotpCode(security.pendingTotpSecret, code)) {
+        throw fieldError("code", messageOf("wrongCode"));
+      }
+      const wasOn = isSecondFactorOn();
+      security.totp = { secret: security.pendingTotpSecret, enabledAt: (/* @__PURE__ */ new Date()).toISOString() };
+      security.pendingTotpSecret = null;
+      const recoveryCodes = turnOnIfFirstFactor(wasOn);
+      return { security: securityNow(), recoveryCodes };
+    },
+    disableTotp: async (password) => {
+      await wait();
+      failIfSignedOut();
+      failWithoutPassword(password);
+      security.totp = null;
+      turnOffIfNoFactorLeft();
+      return { security: securityNow() };
+    },
+    passkeyRegistrationOptions: async () => {
+      await wait();
+      failIfSignedOut();
+      return {
+        challenge: passkeyChallenge(),
+        rp: { name: issuer, id: window.location.hostname },
+        user: { id: base64UrlOf(new TextEncoder().encode(profile.id)), name: profile.email, displayName: profile.name },
+        pubKeyCredParams: [{ type: "public-key", alg: ES256 }, { type: "public-key", alg: RS256 }],
+        timeout: PASSKEY_TIMEOUT_MILLISECONDS,
+        attestation: "none",
+        // las que ya tiene: el navegador avisa si la persona intenta registrar la misma otra vez
+        excludeCredentials: security.passkeys.map((passkey) => ({ id: passkey.credentialId, type: "public-key" })),
+        authenticatorSelection: { residentKey: "preferred", userVerification: "preferred" }
+      };
+    },
+    savePasskey: async ({ name, credential }) => {
+      await wait();
+      failIfSignedOut();
+      const wasOn = isSecondFactorOn();
+      security.passkeys.push({
+        id: `passkey-${Date.now()}`,
+        credentialId: credential?.id,
+        name: name?.trim() || messageOf("defaultPasskeyName", { number: security.passkeys.length + 1 }),
+        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+        lastUsedAt: null
+      });
+      recordEvent("passkeyAdded");
+      const recoveryCodes = turnOnIfFirstFactor(wasOn);
+      return { security: securityNow(), recoveryCodes };
+    },
+    removePasskey: async ({ passkeyId, password }) => {
+      await wait();
+      failIfSignedOut();
+      failWithoutPassword(password);
+      security.passkeys = security.passkeys.filter((passkey) => passkey.id !== passkeyId);
+      recordEvent("passkeyRemoved");
+      turnOffIfNoFactorLeft();
+      return { security: securityNow() };
+    },
+    regenerateRecoveryCodes: async (password) => {
+      await wait();
+      failIfSignedOut();
+      failWithoutPassword(password);
+      security.recoveryCodes = newRecoveryCodes();
+      recordEvent("recoveryCodesGenerated");
+      return { security: securityNow(), recoveryCodes: [...security.recoveryCodes] };
+    },
+    listSessions: async () => {
+      await wait();
+      failIfSignedOut();
+      return security.sessions.map((session) => ({ ...session }));
+    },
+    closeOtherSessions: async () => {
+      await wait();
+      failIfSignedOut();
+      const closed = security.sessions.filter((session) => !session.isCurrent).length;
+      security.sessions = security.sessions.filter((session) => session.isCurrent);
+      if (closed > 0) {
+        recordEvent("sessionsClosed");
+      }
+      return closed;
+    },
+    listActivity: async () => {
+      await wait();
+      failIfSignedOut();
+      return security.events.map((event) => ({ ...event }));
+    },
+    // solo de la demostración: el código que enseñaría la app ahorita, con la clave por activar o la ya activa
+    demoTotpCode: async () => {
+      const secret = security.pendingTotpSecret ?? security.totp?.secret;
+      return secret ? totpCodeAt(secret) : null;
+    }
+  };
+}
+export {
+  createDemoAccountConnector
+};
+//# sourceMappingURL=createDemoAccountConnector.js.map

package/dist/account/demo/createDemoAccountConnector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createDemoAccountConnector.js","sources":["../../../src/account/demo/createDemoAccountConnector.js"],"sourcesContent":["// El conector de la cuenta de DEMOSTRACIÓN (@stackcraftmx/calcita/account-demo): todo vive en el navegador, para arrancar\n// un proyecto sin backend y ver las pantallas de la cuenta funcionando. Se cambia por el de verdad sin tocar las pantallas:\n//\n//   export const accountConnector = API_URL ? createRestAccountConnector(apiClient) : createDemoAccountConnector();\n//\n// Lo que hace de verdad: la clave de la app autenticadora es real (con toQrImageUrl sale en un QR que su app escanea) y el\n// código de 6 dígitos se revisa con el mismo cálculo que un servidor (totp.js); las llaves de acceso le hablan al navegador\n// de verdad (Touch ID, Face ID, Windows Hello). Lo que NO hace: revisar contraseñas (entra el correo de la cuenta con\n// cualquiera) ni la firma de las llaves, que un servidor revisa con su librería.\n//\n// La sesión se recuerda en este navegador (localStorage); la seguridad vive en la memoria de la pestaña: al recargar, la\n// verificación en dos pasos vuelve a estar apagada. Los mensajes salen en el idioma de la app, como los mandaría un backend.\n//\n// Funciones del servidor de demostración, sin React: function (regla de la casa). Pruebas en createDemoAccountConnector.test.js.\nimport {ApiError} from '@/api/ApiError.js';\nimport {isValidTotpCode, newTotpSecret, otpauthUrlOf, totpCodeAt} from '@/account/demo/totp.js';\nimport {translateToolkit} from '@/toolkit/toolkitSettings.js';\n\nconst HTTP_STATUS = Object.freeze({unauthorized: 401, unprocessable: 422, locked: 423});\n// la persona de la demostración (datos inventados)\nconst DEMO_USER = Object.freeze({id: 'user-demo', name: 'Ana Martínez Ruiz', email: 'ana.martinez@ejemplo.com', subtitle: 'Administración', phone: ''});\nconst DEFAULT_STORAGE_KEY = 'calcita-demo:session';\n// lo que tarda una respuesta: sin espera no se verían los botones ocupados\nconst DEFAULT_DELAY_MILLISECONDS = 400;\n// quién emite la cuenta en la app autenticadora (lo que se ve arriba del código)\nconst DEFAULT_ISSUER = 'Calcita';\n// los códigos de recuperación: 10, de la forma ABCDE-FGHJK, sin letras que se confunden (I, O, 0, 1)\nconst RECOVERY_CODE_COUNT = 10;\nconst RECOVERY_CODE_ALPHABET = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';\n// el segundo paso: cuántos códigos equivocados se aceptan y cuánto tiempo hay para escribirlo\nconst SECOND_STEP_ATTEMPTS = 5;\nconst SECOND_STEP_MINUTES = 5;\nconst MILLISECONDS_PER_MINUTE = 60_000;\nconst MILLISECONDS_PER_HOUR = 60 * MILLISECONDS_PER_MINUTE;\nconst PASSKEY_TIMEOUT_MILLISECONDS = 60_000;\nconst CHALLENGE_BYTES = 32;\n// los algoritmos de firma que se aceptan para las llaves (los números de COSE: ES256 y RS256)\nconst ES256 = -7;\nconst RS256 = -257;\n// las formas del segundo paso (SECOND_STEP_METHOD de /forms)\nconst METHOD = Object.freeze({passkey: 'passkey', totp: 'totp', recoveryCode: 'recoveryCode'});\n// la red como la enseñaría un servidor: a medias, nunca la IP completa\nconst THIS_NETWORK = '187.190.x.x';\n\n/** Un mensaje del servidor de demostración en el idioma de la app. */\nconst messageOf = (key, values) => translateToolkit('account', `demo.server.${key}`, values);\n\n/** Bytes → base64url (como viajan los retos y los ids de WebAuthn). */\nfunction base64UrlOf(bytes) {\n    return btoa(String.fromCharCode(...bytes)).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\n/** Este equipo según su user agent, como lo resumiría el servidor. */\nfunction thisDevice() {\n    const userAgent = typeof navigator === 'undefined' ? '' : navigator.userAgent;\n    const browser = /Edg\\//.test(userAgent) ? 'Edge' : /Firefox\\//.test(userAgent) ? 'Firefox' : /Chrome\\//.test(userAgent) ? 'Chrome'\n        : /Safari\\//.test(userAgent) ? 'Safari' : null;\n    const platform = /iPhone|iPad/.test(userAgent) ? 'iOS' : /Android/.test(userAgent) ? 'Android' : /Mac OS X/.test(userAgent) ? 'macOS'\n        : /Windows/.test(userAgent) ? 'Windows' : /Linux/.test(userAgent) ? 'Linux' : null;\n    return {browser, platform, isMobile: /iPhone|Android.*Mobile/.test(userAgent)};\n}\n\n/** Diez códigos nuevos, de la forma ABCDE-FGHJK. */\nfunction newRecoveryCodes() {\n    return Array.from({length: RECOVERY_CODE_COUNT}, () => {\n        const characters = Array.from(crypto.getRandomValues(new Uint8Array(10)), (byte) => RECOVERY_CODE_ALPHABET[byte % RECOVERY_CODE_ALPHABET.length]);\n        return `${characters.slice(0, 5).join('')}-${characters.slice(5).join('')}`;\n    });\n}\n\n/** El 422 con el error en su campo. */\nfunction fieldError(field, message) {\n    return new ApiError({\n        status: HTTP_STATUS.unprocessable,\n        problem: {title: messageOf('validationTitle'), detail: messageOf('validationDetail'), errors: {[field]: [message]}},\n    });\n}\n\n/**\n * @param {object} [options]\n * @param {{id: string, name: string, email: string, subtitle?: string, phone?: string}} [options.user] la persona de la\n *     demostración; por omisión una inventada\n * @param {string[]} [options.roles]\n * @param {string[]} [options.abilities]\n * @param {string[]} [options.labels] sus perfiles, ya traducidos (chips en Mi perfil)\n * @param {string} [options.storageKey] dónde se recuerda la sesión en este navegador (con el nombre de la app)\n * @param {(otpauthUrl: string) => Promise<string>} [options.toQrImageUrl] el QR de la clave (p. ej. QRCode.toDataURL de\n *     la librería qrcode); sin él, la persona escribe la clave a mano en su app\n * @param {string} [options.issuer] el nombre que enseña la app autenticadora\n * @param {number} [options.delayMilliseconds] lo que tarda cada respuesta\n * @returns {import('@/account/accountConnector.js').AccountConnector}\n */\nexport function createDemoAccountConnector({\n    user = DEMO_USER, roles = ['admin'], abilities = [], labels = [], storageKey = DEFAULT_STORAGE_KEY, toQrImageUrl,\n    issuer = DEFAULT_ISSUER, delayMilliseconds = DEFAULT_DELAY_MILLISECONDS,\n} = {}) {\n    const profile = {...user};\n    // la seguridad de la cuenta, en la memoria de la pestaña (con su bitácora y sus sesiones de ejemplo)\n    const security = initialSecurity();\n    // la persona ya puso su contraseña y le falta el segundo paso\n    let pendingSecondStep = null;\n\n    const wait = () => new Promise((resolve) => setTimeout(resolve, delayMilliseconds));\n\n    function initialSecurity() {\n        const now = Date.now();\n        const device = thisDevice();\n        const deviceName = `${device.browser ?? '—'} · ${device.platform ?? '—'}`;\n        return {\n            totp: null,\n            pendingTotpSecret: null,\n            passkeys: [],\n            recoveryCodes: [],\n            enabledAt: null,\n            sessions: [\n                {id: 'session-this', ...device, startedAt: new Date(now - 2 * MILLISECONDS_PER_HOUR).toISOString(), network: THIS_NETWORK, isCurrent: true},\n                {id: 'session-phone', browser: 'Safari', platform: 'iOS', isMobile: true,\n                    startedAt: new Date(now - 26 * MILLISECONDS_PER_HOUR).toISOString(), network: '201.141.x.x', isCurrent: false},\n            ],\n            // de lo más nuevo a lo más viejo\n            events: [\n                {id: 'event-2', kind: 'signedIn', occurredAt: new Date(now - 2 * MILLISECONDS_PER_HOUR).toISOString(), device: deviceName, network: THIS_NETWORK},\n                {id: 'event-1', kind: 'signInFailed', occurredAt: new Date(now - 30 * MILLISECONDS_PER_HOUR).toISOString(), device: 'Firefox · Windows', network: '177.230.x.x'},\n            ],\n        };\n    }\n\n    // ─── la sesión en este navegador ───\n\n    const isSignedIn = () => {\n        try {\n            return window.localStorage.getItem(storageKey) === profile.id;\n        } catch {\n            return false;\n        }\n    };\n    const rememberSession = (signedIn) => {\n        try {\n            if (signedIn) {\n                window.localStorage.setItem(storageKey, profile.id);\n            } else {\n                window.localStorage.removeItem(storageKey);\n            }\n        } catch {\n            // almacenamiento bloqueado: la sesión dura lo que dure la pestaña\n        }\n    };\n    const failIfSignedOut = () => {\n        if (!isSignedIn()) {\n            throw new ApiError({status: HTTP_STATUS.unauthorized, problem: {title: messageOf('noSessionTitle'), detail: messageOf('noSession')}});\n        }\n    };\n    // lo que QUITA protección pide la contraseña; en la demostración sirve cualquiera que se escriba\n    const failWithoutPassword = (password) => {\n        if (!password) {\n            throw fieldError('password', messageOf('passwordRequired'));\n        }\n    };\n\n    // ─── la seguridad ───\n\n    const recordEvent = (kind) => {\n        const device = thisDevice();\n        security.events.unshift({\n            id: `event-${Date.now()}-${security.events.length}`, kind, occurredAt: new Date().toISOString(),\n            device: `${device.browser ?? '—'} · ${device.platform ?? '—'}`, network: THIS_NETWORK,\n        });\n    };\n    const isSecondFactorOn = () => Boolean(security.totp) || security.passkeys.length > 0;\n    const securityNow = () => ({\n        isEnabled: isSecondFactorOn(),\n        enabledAt: security.enabledAt,\n        passkeys: security.passkeys.map(({id, name, createdAt, lastUsedAt}) => ({id, name, createdAt, lastUsedAt})),\n        totp: {isEnabled: Boolean(security.totp), enabledAt: security.totp?.enabledAt ?? null},\n        recoveryCodesRemaining: security.recoveryCodes.length,\n    });\n    // la primera protección que se prende activa la verificación y genera los códigos (se enseñan una sola vez)\n    const turnOnIfFirstFactor = (wasOn) => {\n        if (wasOn) {\n            return undefined;\n        }\n        security.enabledAt = new Date().toISOString();\n        security.recoveryCodes = newRecoveryCodes();\n        recordEvent('twoStepEnabled');\n        return [...security.recoveryCodes];\n    };\n    // al quitar la última, la verificación se apaga y los códigos dejan de servir\n    const turnOffIfNoFactorLeft = () => {\n        if (!isSecondFactorOn()) {\n            security.enabledAt = null;\n            security.recoveryCodes = [];\n            recordEvent('twoStepDisabled');\n        }\n    };\n\n    // ─── el segundo paso ───\n\n    const pendingOrFail = () => {\n        if (!pendingSecondStep || Date.now() > pendingSecondStep.expiresAt) {\n            pendingSecondStep = null;\n            throw new ApiError({status: HTTP_STATUS.unauthorized, problem: {code: 'second_step_expired', title: messageOf('expiredTitle'), detail: messageOf('expired')}});\n        }\n    };\n    // un código equivocado resta un intento; sin intentos se bloquea (423) y hay que empezar de nuevo\n    const failSecondStep = () => {\n        pendingSecondStep.attemptsLeft -= 1;\n        recordEvent('signInFailed');\n        if (pendingSecondStep.attemptsLeft <= 0) {\n            pendingSecondStep = null;\n            throw new ApiError({status: HTTP_STATUS.locked, problem: {code: 'account_locked', title: messageOf('lockedTitle'), detail: messageOf('locked')}});\n        }\n        throw new ApiError({\n            status: HTTP_STATUS.unauthorized,\n            problem: {code: 'invalid_code', title: messageOf('wrongCodeTitle'), detail: messageOf('wrongCode'), remaining_attempts: pendingSecondStep.attemptsLeft},\n        });\n    };\n    const finishSignIn = (kind = 'signedIn') => {\n        pendingSecondStep = null;\n        rememberSession(true);\n        recordEvent(kind);\n    };\n    const passkeyChallenge = () => base64UrlOf(crypto.getRandomValues(new Uint8Array(CHALLENGE_BYTES)));\n\n    return {\n        loadSession: async () => {\n            await wait();\n            return isSignedIn() ? {user: {...profile}, roles: [...roles], abilities: [...abilities], labels: [...labels]} : null;\n        },\n        signIn: async ({email}) => {\n            await wait();\n            if (email?.trim().toLowerCase() !== profile.email.toLowerCase()) {\n                throw new ApiError({\n                    status: HTTP_STATUS.unauthorized,\n                    problem: {title: messageOf('wrongCredentialsTitle'), detail: messageOf('wrongCredentials', {email: profile.email})},\n                });\n            }\n            if (!isSecondFactorOn()) {\n                finishSignIn();\n                return {secondStep: null};\n            }\n            pendingSecondStep = {expiresAt: Date.now() + SECOND_STEP_MINUTES * MILLISECONDS_PER_MINUTE, attemptsLeft: SECOND_STEP_ATTEMPTS};\n            const methods = [\n                ...(security.passkeys.length > 0 ? [METHOD.passkey] : []),\n                ...(security.totp ? [METHOD.totp] : []),\n                ...(security.recoveryCodes.length > 0 ? [METHOD.recoveryCode] : []),\n            ];\n            return {secondStep: {methods}};\n        },\n        signInSecondStep: async ({method, code}) => {\n            await wait();\n            pendingOrFail();\n            if (method === METHOD.recoveryCode) {\n                if (!security.recoveryCodes.includes(code)) {\n                    failSecondStep();\n                }\n                // cada código sirve una sola vez\n                security.recoveryCodes = security.recoveryCodes.filter((unusedCode) => unusedCode !== code);\n                finishSignIn('recoveryCodeUsed');\n                return;\n            }\n            if (!security.totp || !(await isValidTotpCode(security.totp.secret, code))) {\n                failSecondStep();\n            }\n            finishSignIn();\n        },\n        secondStepPasskeyOptions: async () => {\n            await wait();\n            pendingOrFail();\n            return {\n                challenge: passkeyChallenge(), rpId: window.location.hostname, userVerification: 'preferred', timeout: PASSKEY_TIMEOUT_MILLISECONDS,\n                allowCredentials: security.passkeys.map((passkey) => ({id: passkey.credentialId, type: 'public-key'})),\n            };\n        },\n        signInWithPasskey: async (credential) => {\n            await wait();\n            pendingOrFail();\n            const passkey = security.passkeys.find((candidate) => candidate.credentialId === credential?.id);\n            if (!passkey) {\n                failSecondStep();\n            }\n            passkey.lastUsedAt = new Date().toISOString();\n            finishSignIn();\n        },\n        signOut: async () => {\n            await wait();\n            rememberSession(false);\n        },\n        requestPasswordReset: async () => {\n            await wait();\n        },\n        resetPassword: async () => {\n            await wait();\n            recordEvent('passwordChanged');\n        },\n        updateProfile: async ({name, phone}) => {\n            await wait();\n            failIfSignedOut();\n            if (!name?.trim()) {\n                throw fieldError('name', messageOf('nameRequired'));\n            }\n            profile.name = name.trim();\n            profile.phone = phone?.trim() ?? '';\n            return {message: messageOf('profileSaved')};\n        },\n        changePassword: async () => {\n            await wait();\n            failIfSignedOut();\n            recordEvent('passwordChanged');\n        },\n        loadSecurity: async () => {\n            await wait();\n            failIfSignedOut();\n            return securityNow();\n        },\n        startTotp: async () => {\n            await wait();\n            failIfSignedOut();\n            security.pendingTotpSecret = newTotpSecret();\n            const otpauthUrl = otpauthUrlOf({secret: security.pendingTotpSecret, account: profile.email, issuer});\n            return {secret: security.pendingTotpSecret, qrImageUrl: toQrImageUrl ? await toQrImageUrl(otpauthUrl) : null};\n        },\n        confirmTotp: async (code) => {\n            await wait();\n            failIfSignedOut();\n            if (!security.pendingTotpSecret || !(await isValidTotpCode(security.pendingTotpSecret, code))) {\n                throw fieldError('code', messageOf('wrongCode'));\n            }\n            const wasOn = isSecondFactorOn();\n            security.totp = {secret: security.pendingTotpSecret, enabledAt: new Date().toISOString()};\n            security.pendingTotpSecret = null;\n            const recoveryCodes = turnOnIfFirstFactor(wasOn);\n            return {security: securityNow(), recoveryCodes};\n        },\n        disableTotp: async (password) => {\n            await wait();\n            failIfSignedOut();\n            failWithoutPassword(password);\n            security.totp = null;\n            turnOffIfNoFactorLeft();\n            return {security: securityNow()};\n        },\n        passkeyRegistrationOptions: async () => {\n            await wait();\n            failIfSignedOut();\n            return {\n                challenge: passkeyChallenge(),\n                rp: {name: issuer, id: window.location.hostname},\n                user: {id: base64UrlOf(new TextEncoder().encode(profile.id)), name: profile.email, displayName: profile.name},\n                pubKeyCredParams: [{type: 'public-key', alg: ES256}, {type: 'public-key', alg: RS256}],\n                timeout: PASSKEY_TIMEOUT_MILLISECONDS,\n                attestation: 'none',\n                // las que ya tiene: el navegador avisa si la persona intenta registrar la misma otra vez\n                excludeCredentials: security.passkeys.map((passkey) => ({id: passkey.credentialId, type: 'public-key'})),\n                authenticatorSelection: {residentKey: 'preferred', userVerification: 'preferred'},\n            };\n        },\n        savePasskey: async ({name, credential}) => {\n            await wait();\n            failIfSignedOut();\n            const wasOn = isSecondFactorOn();\n            security.passkeys.push({\n                id: `passkey-${Date.now()}`, credentialId: credential?.id,\n                name: name?.trim() || messageOf('defaultPasskeyName', {number: security.passkeys.length + 1}),\n                createdAt: new Date().toISOString(), lastUsedAt: null,\n            });\n            recordEvent('passkeyAdded');\n            const recoveryCodes = turnOnIfFirstFactor(wasOn);\n            return {security: securityNow(), recoveryCodes};\n        },\n        removePasskey: async ({passkeyId, password}) => {\n            await wait();\n            failIfSignedOut();\n            failWithoutPassword(password);\n            security.passkeys = security.passkeys.filter((passkey) => passkey.id !== passkeyId);\n            recordEvent('passkeyRemoved');\n            turnOffIfNoFactorLeft();\n            return {security: securityNow()};\n        },\n        regenerateRecoveryCodes: async (password) => {\n            await wait();\n            failIfSignedOut();\n            failWithoutPassword(password);\n            security.recoveryCodes = newRecoveryCodes();\n            recordEvent('recoveryCodesGenerated');\n            return {security: securityNow(), recoveryCodes: [...security.recoveryCodes]};\n        },\n        listSessions: async () => {\n            await wait();\n            failIfSignedOut();\n            return security.sessions.map((session) => ({...session}));\n        },\n        closeOtherSessions: async () => {\n            await wait();\n            failIfSignedOut();\n            const closed = security.sessions.filter((session) => !session.isCurrent).length;\n            security.sessions = security.sessions.filter((session) => session.isCurrent);\n            if (closed > 0) {\n                recordEvent('sessionsClosed');\n            }\n            return closed;\n        },\n        listActivity: async () => {\n            await wait();\n            failIfSignedOut();\n            return security.events.map((event) => ({...event}));\n        },\n        // solo de la demostración: el código que enseñaría la app ahorita, con la clave por activar o la ya activa\n        demoTotpCode: async () => {\n            const secret = security.pendingTotpSecret ?? security.totp?.secret;\n            return secret ? totpCodeAt(secret) : null;\n        },\n    };\n}\n"],"names":[],"mappings":";;;AAkBA,MAAM,cAAc,OAAO,OAAO,EAAC,cAAc,KAAK,eAAe,KAAK,QAAQ,IAAG,CAAC;AAEtF,MAAM,YAAY,OAAO,OAAO,EAAC,IAAI,aAAa,MAAM,qBAAqB,OAAO,4BAA4B,UAAU,kBAAkB,OAAO,GAAE,CAAC;AACtJ,MAAM,sBAAsB;AAE5B,MAAM,6BAA6B;AAEnC,MAAM,iBAAiB;AAEvB,MAAM,sBAAsB;AAC5B,MAAM,yBAAyB;AAE/B,MAAM,uBAAuB;AAC7B,MAAM,sBAAsB;AAC5B,MAAM,0BAA0B;AAChC,MAAM,wBAAwB,KAAK;AACnC,MAAM,+BAA+B;AACrC,MAAM,kBAAkB;AAExB,MAAM,QAAQ;AACd,MAAM,QAAQ;AAEd,MAAM,SAAS,OAAO,OAAO,EAAC,SAAS,WAAW,MAAM,QAAQ,cAAc,eAAc,CAAC;AAE7F,MAAM,eAAe;AAGrB,MAAM,YAAY,CAAC,KAAK,WAAW,iBAAiB,WAAW,eAAe,GAAG,IAAI,MAAM;AAG3F,SAAS,YAAY,OAAO;AACxB,SAAO,KAAK,OAAO,aAAa,GAAG,KAAK,CAAC,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AACxG;AAGA,SAAS,aAAa;AAClB,QAAM,YAAY,OAAO,cAAc,cAAc,KAAK,UAAU;AACpE,QAAM,UAAU,QAAQ,KAAK,SAAS,IAAI,SAAS,YAAY,KAAK,SAAS,IAAI,YAAY,WAAW,KAAK,SAAS,IAAI,WACpH,WAAW,KAAK,SAAS,IAAI,WAAW;AAC9C,QAAM,WAAW,cAAc,KAAK,SAAS,IAAI,QAAQ,UAAU,KAAK,SAAS,IAAI,YAAY,WAAW,KAAK,SAAS,IAAI,UACxH,UAAU,KAAK,SAAS,IAAI,YAAY,QAAQ,KAAK,SAAS,IAAI,UAAU;AAClF,SAAO,EAAC,SAAS,UAAU,UAAU,yBAAyB,KAAK,SAAS,EAAC;AACjF;AAGA,SAAS,mBAAmB;AACxB,SAAO,MAAM,KAAK,EAAC,QAAQ,oBAAmB,GAAG,MAAM;AACnD,UAAM,aAAa,MAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC,GAAG,CAAC,SAAS,uBAAuB,OAAO,uBAAuB,MAAM,CAAC;AAChJ,WAAO,GAAG,WAAW,MAAM,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,WAAW,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;AAAA,EAC7E,CAAC;AACL;AAGA,SAAS,WAAW,OAAO,SAAS;AAChC,SAAO,IAAI,SAAS;AAAA,IAChB,QAAQ,YAAY;AAAA,IACpB,SAAS,EAAC,OAAO,UAAU,iBAAiB,GAAG,QAAQ,UAAU,kBAAkB,GAAG,QAAQ,EAAC,CAAC,KAAK,GAAG,CAAC,OAAO,EAAC,EAAC;AAAA,EAC1H,CAAK;AACL;AAgBO,SAAS,2BAA2B;AAAA,EACvC,OAAO;AAAA,EAAW,QAAQ,CAAC,OAAO;AAAA,EAAG,YAAY,CAAA;AAAA,EAAI,SAAS,CAAA;AAAA,EAAI,aAAa;AAAA,EAAqB;AAAA,EACpG,SAAS;AAAA,EAAgB,oBAAoB;AACjD,IAAI,IAAI;AACJ,QAAM,UAAU,EAAC,GAAG,KAAI;AAExB,QAAM,WAAW,gBAAe;AAEhC,MAAI,oBAAoB;AAExB,QAAM,OAAO,MAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,iBAAiB,CAAC;AAElF,WAAS,kBAAkB;AACvB,UAAM,MAAM,KAAK,IAAG;AACpB,UAAM,SAAS,WAAU;AACzB,UAAM,aAAa,GAAG,OAAO,WAAW,GAAG,MAAM,OAAO,YAAY,GAAG;AACvE,WAAO;AAAA,MACH,MAAM;AAAA,MACN,mBAAmB;AAAA,MACnB,UAAU,CAAA;AAAA,MACV,eAAe,CAAA;AAAA,MACf,WAAW;AAAA,MACX,UAAU;AAAA,QACN,EAAC,IAAI,gBAAgB,GAAG,QAAQ,WAAW,IAAI,KAAK,MAAM,IAAI,qBAAqB,EAAE,YAAW,GAAI,SAAS,cAAc,WAAW,KAAI;AAAA,QAC1I;AAAA,UAAC,IAAI;AAAA,UAAiB,SAAS;AAAA,UAAU,UAAU;AAAA,UAAO,UAAU;AAAA,UAChE,WAAW,IAAI,KAAK,MAAM,KAAK,qBAAqB,EAAE,YAAW;AAAA,UAAI,SAAS;AAAA,UAAe,WAAW;AAAA,QAAK;AAAA,MACjI;AAAA;AAAA,MAEY,QAAQ;AAAA,QACJ,EAAC,IAAI,WAAW,MAAM,YAAY,YAAY,IAAI,KAAK,MAAM,IAAI,qBAAqB,EAAE,YAAW,GAAI,QAAQ,YAAY,SAAS,aAAY;AAAA,QAChJ,EAAC,IAAI,WAAW,MAAM,gBAAgB,YAAY,IAAI,KAAK,MAAM,KAAK,qBAAqB,EAAE,YAAW,GAAI,QAAQ,qBAAqB,SAAS,cAAa;AAAA,MAC/K;AAAA,IACA;AAAA,EACI;AAIA,QAAM,aAAa,MAAM;AACrB,QAAI;AACA,aAAO,OAAO,aAAa,QAAQ,UAAU,MAAM,QAAQ;AAAA,IAC/D,QAAQ;AACJ,aAAO;AAAA,IACX;AAAA,EACJ;AACA,QAAM,kBAAkB,CAAC,aAAa;AAClC,QAAI;AACA,UAAI,UAAU;AACV,eAAO,aAAa,QAAQ,YAAY,QAAQ,EAAE;AAAA,MACtD,OAAO;AACH,eAAO,aAAa,WAAW,UAAU;AAAA,MAC7C;AAAA,IACJ,QAAQ;AAAA,IAER;AAAA,EACJ;AACA,QAAM,kBAAkB,MAAM;AAC1B,QAAI,CAAC,WAAU,GAAI;AACf,YAAM,IAAI,SAAS,EAAC,QAAQ,YAAY,cAAc,SAAS,EAAC,OAAO,UAAU,gBAAgB,GAAG,QAAQ,UAAU,WAAW,EAAC,EAAC,CAAC;AAAA,IACxI;AAAA,EACJ;AAEA,QAAM,sBAAsB,CAAC,aAAa;AACtC,QAAI,CAAC,UAAU;AACX,YAAM,WAAW,YAAY,UAAU,kBAAkB,CAAC;AAAA,IAC9D;AAAA,EACJ;AAIA,QAAM,cAAc,CAAC,SAAS;AAC1B,UAAM,SAAS,WAAU;AACzB,aAAS,OAAO,QAAQ;AAAA,MACpB,IAAI,SAAS,KAAK,IAAG,CAAE,IAAI,SAAS,OAAO,MAAM;AAAA,MAAI;AAAA,MAAM,aAAY,oBAAI,KAAI,GAAG,YAAW;AAAA,MAC7F,QAAQ,GAAG,OAAO,WAAW,GAAG,MAAM,OAAO,YAAY,GAAG;AAAA,MAAI,SAAS;AAAA,IACrF,CAAS;AAAA,EACL;AACA,QAAM,mBAAmB,MAAM,QAAQ,SAAS,IAAI,KAAK,SAAS,SAAS,SAAS;AACpF,QAAM,cAAc,OAAO;AAAA,IACvB,WAAW,iBAAgB;AAAA,IAC3B,WAAW,SAAS;AAAA,IACpB,UAAU,SAAS,SAAS,IAAI,CAAC,EAAC,IAAI,MAAM,WAAW,WAAU,OAAO,EAAC,IAAI,MAAM,WAAW,WAAU,EAAE;AAAA,IAC1G,MAAM,EAAC,WAAW,QAAQ,SAAS,IAAI,GAAG,WAAW,SAAS,MAAM,aAAa,KAAI;AAAA,IACrF,wBAAwB,SAAS,cAAc;AAAA,EACvD;AAEI,QAAM,sBAAsB,CAAC,UAAU;AACnC,QAAI,OAAO;AACP,aAAO;AAAA,IACX;AACA,aAAS,aAAY,oBAAI,KAAI,GAAG,YAAW;AAC3C,aAAS,gBAAgB,iBAAgB;AACzC,gBAAY,gBAAgB;AAC5B,WAAO,CAAC,GAAG,SAAS,aAAa;AAAA,EACrC;AAEA,QAAM,wBAAwB,MAAM;AAChC,QAAI,CAAC,iBAAgB,GAAI;AACrB,eAAS,YAAY;AACrB,eAAS,gBAAgB,CAAA;AACzB,kBAAY,iBAAiB;AAAA,IACjC;AAAA,EACJ;AAIA,QAAM,gBAAgB,MAAM;AACxB,QAAI,CAAC,qBAAqB,KAAK,IAAG,IAAK,kBAAkB,WAAW;AAChE,0BAAoB;AACpB,YAAM,IAAI,SAAS,EAAC,QAAQ,YAAY,cAAc,SAAS,EAAC,MAAM,uBAAuB,OAAO,UAAU,cAAc,GAAG,QAAQ,UAAU,SAAS,EAAC,EAAC,CAAC;AAAA,IACjK;AAAA,EACJ;AAEA,QAAM,iBAAiB,MAAM;AACzB,sBAAkB,gBAAgB;AAClC,gBAAY,cAAc;AAC1B,QAAI,kBAAkB,gBAAgB,GAAG;AACrC,0BAAoB;AACpB,YAAM,IAAI,SAAS,EAAC,QAAQ,YAAY,QAAQ,SAAS,EAAC,MAAM,kBAAkB,OAAO,UAAU,aAAa,GAAG,QAAQ,UAAU,QAAQ,EAAC,EAAC,CAAC;AAAA,IACpJ;AACA,UAAM,IAAI,SAAS;AAAA,MACf,QAAQ,YAAY;AAAA,MACpB,SAAS,EAAC,MAAM,gBAAgB,OAAO,UAAU,gBAAgB,GAAG,QAAQ,UAAU,WAAW,GAAG,oBAAoB,kBAAkB,aAAY;AAAA,IAClK,CAAS;AAAA,EACL;AACA,QAAM,eAAe,CAAC,OAAO,eAAe;AACxC,wBAAoB;AACpB,oBAAgB,IAAI;AACpB,gBAAY,IAAI;AAAA,EACpB;AACA,QAAM,mBAAmB,MAAM,YAAY,OAAO,gBAAgB,IAAI,WAAW,eAAe,CAAC,CAAC;AAElG,SAAO;AAAA,IACH,aAAa,YAAY;AACrB,YAAM,KAAI;AACV,aAAO,WAAU,IAAK,EAAC,MAAM,EAAC,GAAG,QAAO,GAAG,OAAO,CAAC,GAAG,KAAK,GAAG,WAAW,CAAC,GAAG,SAAS,GAAG,QAAQ,CAAC,GAAG,MAAM,EAAC,IAAI;AAAA,IACpH;AAAA,IACA,QAAQ,OAAO,EAAC,MAAK,MAAM;AACvB,YAAM,KAAI;AACV,UAAI,OAAO,OAAO,YAAW,MAAO,QAAQ,MAAM,eAAe;AAC7D,cAAM,IAAI,SAAS;AAAA,UACf,QAAQ,YAAY;AAAA,UACpB,SAAS,EAAC,OAAO,UAAU,uBAAuB,GAAG,QAAQ,UAAU,oBAAoB,EAAC,OAAO,QAAQ,MAAK,CAAC,EAAC;AAAA,QACtI,CAAiB;AAAA,MACL;AACA,UAAI,CAAC,iBAAgB,GAAI;AACrB,qBAAY;AACZ,eAAO,EAAC,YAAY,KAAI;AAAA,MAC5B;AACA,0BAAoB,EAAC,WAAW,KAAK,IAAG,IAAK,sBAAsB,yBAAyB,cAAc,qBAAoB;AAC9H,YAAM,UAAU;AAAA,QACZ,GAAI,SAAS,SAAS,SAAS,IAAI,CAAC,OAAO,OAAO,IAAI;QACtD,GAAI,SAAS,OAAO,CAAC,OAAO,IAAI,IAAI,CAAA;AAAA,QACpC,GAAI,SAAS,cAAc,SAAS,IAAI,CAAC,OAAO,YAAY,IAAI;MAChF;AACY,aAAO,EAAC,YAAY,EAAC,QAAO,EAAC;AAAA,IACjC;AAAA,IACA,kBAAkB,OAAO,EAAC,QAAQ,KAAI,MAAM;AACxC,YAAM,KAAI;AACV,oBAAa;AACb,UAAI,WAAW,OAAO,cAAc;AAChC,YAAI,CAAC,SAAS,cAAc,SAAS,IAAI,GAAG;AACxC,yBAAc;AAAA,QAClB;AAEA,iBAAS,gBAAgB,SAAS,cAAc,OAAO,CAAC,eAAe,eAAe,IAAI;AAC1F,qBAAa,kBAAkB;AAC/B;AAAA,MACJ;AACA,UAAI,CAAC,SAAS,QAAQ,CAAE,MAAM,gBAAgB,SAAS,KAAK,QAAQ,IAAI,GAAI;AACxE,uBAAc;AAAA,MAClB;AACA,mBAAY;AAAA,IAChB;AAAA,IACA,0BAA0B,YAAY;AAClC,YAAM,KAAI;AACV,oBAAa;AACb,aAAO;AAAA,QACH,WAAW;QAAoB,MAAM,OAAO,SAAS;AAAA,QAAU,kBAAkB;AAAA,QAAa,SAAS;AAAA,QACvG,kBAAkB,SAAS,SAAS,IAAI,CAAC,aAAa,EAAC,IAAI,QAAQ,cAAc,MAAM,aAAY,EAAE;AAAA,MACrH;AAAA,IACQ;AAAA,IACA,mBAAmB,OAAO,eAAe;AACrC,YAAM,KAAI;AACV,oBAAa;AACb,YAAM,UAAU,SAAS,SAAS,KAAK,CAAC,cAAc,UAAU,iBAAiB,YAAY,EAAE;AAC/F,UAAI,CAAC,SAAS;AACV,uBAAc;AAAA,MAClB;AACA,cAAQ,cAAa,oBAAI,KAAI,GAAG,YAAW;AAC3C,mBAAY;AAAA,IAChB;AAAA,IACA,SAAS,YAAY;AACjB,YAAM,KAAI;AACV,sBAAgB,KAAK;AAAA,IACzB;AAAA,IACA,sBAAsB,YAAY;AAC9B,YAAM,KAAI;AAAA,IACd;AAAA,IACA,eAAe,YAAY;AACvB,YAAM,KAAI;AACV,kBAAY,iBAAiB;AAAA,IACjC;AAAA,IACA,eAAe,OAAO,EAAC,MAAM,MAAK,MAAM;AACpC,YAAM,KAAI;AACV,sBAAe;AACf,UAAI,CAAC,MAAM,QAAQ;AACf,cAAM,WAAW,QAAQ,UAAU,cAAc,CAAC;AAAA,MACtD;AACA,cAAQ,OAAO,KAAK,KAAI;AACxB,cAAQ,QAAQ,OAAO,KAAI,KAAM;AACjC,aAAO,EAAC,SAAS,UAAU,cAAc,EAAC;AAAA,IAC9C;AAAA,IACA,gBAAgB,YAAY;AACxB,YAAM,KAAI;AACV,sBAAe;AACf,kBAAY,iBAAiB;AAAA,IACjC;AAAA,IACA,cAAc,YAAY;AACtB,YAAM,KAAI;AACV,sBAAe;AACf,aAAO,YAAW;AAAA,IACtB;AAAA,IACA,WAAW,YAAY;AACnB,YAAM,KAAI;AACV,sBAAe;AACf,eAAS,oBAAoB,cAAa;AAC1C,YAAM,aAAa,aAAa,EAAC,QAAQ,SAAS,mBAAmB,SAAS,QAAQ,OAAO,OAAM,CAAC;AACpG,aAAO,EAAC,QAAQ,SAAS,mBAAmB,YAAY,eAAe,MAAM,aAAa,UAAU,IAAI,KAAI;AAAA,IAChH;AAAA,IACA,aAAa,OAAO,SAAS;AACzB,YAAM,KAAI;AACV,sBAAe;AACf,UAAI,CAAC,SAAS,qBAAqB,CAAE,MAAM,gBAAgB,SAAS,mBAAmB,IAAI,GAAI;AAC3F,cAAM,WAAW,QAAQ,UAAU,WAAW,CAAC;AAAA,MACnD;AACA,YAAM,QAAQ,iBAAgB;AAC9B,eAAS,OAAO,EAAC,QAAQ,SAAS,mBAAmB,YAAW,oBAAI,QAAO,cAAa;AACxF,eAAS,oBAAoB;AAC7B,YAAM,gBAAgB,oBAAoB,KAAK;AAC/C,aAAO,EAAC,UAAU,YAAW,GAAI,cAAa;AAAA,IAClD;AAAA,IACA,aAAa,OAAO,aAAa;AAC7B,YAAM,KAAI;AACV,sBAAe;AACf,0BAAoB,QAAQ;AAC5B,eAAS,OAAO;AAChB,4BAAqB;AACrB,aAAO,EAAC,UAAU,cAAa;AAAA,IACnC;AAAA,IACA,4BAA4B,YAAY;AACpC,YAAM,KAAI;AACV,sBAAe;AACf,aAAO;AAAA,QACH,WAAW,iBAAgB;AAAA,QAC3B,IAAI,EAAC,MAAM,QAAQ,IAAI,OAAO,SAAS,SAAQ;AAAA,QAC/C,MAAM,EAAC,IAAI,YAAY,IAAI,YAAW,EAAG,OAAO,QAAQ,EAAE,CAAC,GAAG,MAAM,QAAQ,OAAO,aAAa,QAAQ,KAAI;AAAA,QAC5G,kBAAkB,CAAC,EAAC,MAAM,cAAc,KAAK,MAAK,GAAG,EAAC,MAAM,cAAc,KAAK,MAAK,CAAC;AAAA,QACrF,SAAS;AAAA,QACT,aAAa;AAAA;AAAA,QAEb,oBAAoB,SAAS,SAAS,IAAI,CAAC,aAAa,EAAC,IAAI,QAAQ,cAAc,MAAM,aAAY,EAAE;AAAA,QACvG,wBAAwB,EAAC,aAAa,aAAa,kBAAkB,YAAW;AAAA,MAChG;AAAA,IACQ;AAAA,IACA,aAAa,OAAO,EAAC,MAAM,WAAU,MAAM;AACvC,YAAM,KAAI;AACV,sBAAe;AACf,YAAM,QAAQ,iBAAgB;AAC9B,eAAS,SAAS,KAAK;AAAA,QACnB,IAAI,WAAW,KAAK,IAAG,CAAE;AAAA,QAAI,cAAc,YAAY;AAAA,QACvD,MAAM,MAAM,KAAI,KAAM,UAAU,sBAAsB,EAAC,QAAQ,SAAS,SAAS,SAAS,EAAC,CAAC;AAAA,QAC5F,YAAW,oBAAI,KAAI,GAAG,YAAW;AAAA,QAAI,YAAY;AAAA,MACjE,CAAa;AACD,kBAAY,cAAc;AAC1B,YAAM,gBAAgB,oBAAoB,KAAK;AAC/C,aAAO,EAAC,UAAU,YAAW,GAAI,cAAa;AAAA,IAClD;AAAA,IACA,eAAe,OAAO,EAAC,WAAW,SAAQ,MAAM;AAC5C,YAAM,KAAI;AACV,sBAAe;AACf,0BAAoB,QAAQ;AAC5B,eAAS,WAAW,SAAS,SAAS,OAAO,CAAC,YAAY,QAAQ,OAAO,SAAS;AAClF,kBAAY,gBAAgB;AAC5B,4BAAqB;AACrB,aAAO,EAAC,UAAU,cAAa;AAAA,IACnC;AAAA,IACA,yBAAyB,OAAO,aAAa;AACzC,YAAM,KAAI;AACV,sBAAe;AACf,0BAAoB,QAAQ;AAC5B,eAAS,gBAAgB,iBAAgB;AACzC,kBAAY,wBAAwB;AACpC,aAAO,EAAC,UAAU,YAAW,GAAI,eAAe,CAAC,GAAG,SAAS,aAAa,EAAC;AAAA,IAC/E;AAAA,IACA,cAAc,YAAY;AACtB,YAAM,KAAI;AACV,sBAAe;AACf,aAAO,SAAS,SAAS,IAAI,CAAC,aAAa,EAAC,GAAG,QAAO,EAAE;AAAA,IAC5D;AAAA,IACA,oBAAoB,YAAY;AAC5B,YAAM,KAAI;AACV,sBAAe;AACf,YAAM,SAAS,SAAS,SAAS,OAAO,CAAC,YAAY,CAAC,QAAQ,SAAS,EAAE;AACzE,eAAS,WAAW,SAAS,SAAS,OAAO,CAAC,YAAY,QAAQ,SAAS;AAC3E,UAAI,SAAS,GAAG;AACZ,oBAAY,gBAAgB;AAAA,MAChC;AACA,aAAO;AAAA,IACX;AAAA,IACA,cAAc,YAAY;AACtB,YAAM,KAAI;AACV,sBAAe;AACf,aAAO,SAAS,OAAO,IAAI,CAAC,WAAW,EAAC,GAAG,MAAK,EAAE;AAAA,IACtD;AAAA;AAAA,IAEA,cAAc,YAAY;AACtB,YAAM,SAAS,SAAS,qBAAqB,SAAS,MAAM;AAC5D,aAAO,SAAS,WAAW,MAAM,IAAI;AAAA,IACzC;AAAA,EACR;AACA;"}

package/dist/account/demo/totp.js

@@ -0,0 +1,61 @@
+const BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+const STEP_SECONDS = 30;
+const CODE_DIGITS = 6;
+const ACCEPTED_DRIFT_STEPS = 1;
+const SECRET_BYTES = 20;
+function base32Of(bytes) {
+  let bits = "";
+  for (const byte of bytes) {
+    bits += byte.toString(2).padStart(8, "0");
+  }
+  let text = "";
+  for (let start = 0; start < bits.length; start += 5) {
+    text += BASE32_ALPHABET[parseInt(bits.slice(start, start + 5).padEnd(5, "0"), 2)];
+  }
+  return text;
+}
+function bytesOfBase32(text) {
+  const bits = text.replace(/[\s=]/g, "").toUpperCase().split("").map((character) => BASE32_ALPHABET.indexOf(character).toString(2).padStart(5, "0")).join("");
+  const bytes = new Uint8Array(Math.floor(bits.length / 8));
+  for (let index = 0; index < bytes.length; index += 1) {
+    bytes[index] = parseInt(bits.slice(index * 8, index * 8 + 8), 2);
+  }
+  return bytes;
+}
+function newTotpSecret() {
+  return base32Of(crypto.getRandomValues(new Uint8Array(SECRET_BYTES)));
+}
+async function codeOfStep(secret, step, digits = CODE_DIGITS) {
+  const counter = new ArrayBuffer(8);
+  new DataView(counter).setBigUint64(0, BigInt(step));
+  const key = await crypto.subtle.importKey("raw", bytesOfBase32(secret), { name: "HMAC", hash: "SHA-1" }, false, ["sign"]);
+  const hmac = new Uint8Array(await crypto.subtle.sign("HMAC", key, counter));
+  const offset = hmac[hmac.length - 1] & 15;
+  const number = (hmac[offset] & 127) << 24 | hmac[offset + 1] << 16 | hmac[offset + 2] << 8 | hmac[offset + 3];
+  return String(number % 10 ** digits).padStart(digits, "0");
+}
+function totpCodeAt(secret, timeMilliseconds = Date.now(), digits = CODE_DIGITS) {
+  return codeOfStep(secret, Math.floor(timeMilliseconds / 1e3 / STEP_SECONDS), digits);
+}
+async function isValidTotpCode(secret, code, timeMilliseconds = Date.now()) {
+  const currentStep = Math.floor(timeMilliseconds / 1e3 / STEP_SECONDS);
+  for (let drift = -ACCEPTED_DRIFT_STEPS; drift <= ACCEPTED_DRIFT_STEPS; drift += 1) {
+    if (await codeOfStep(secret, currentStep + drift) === code) {
+      return true;
+    }
+  }
+  return false;
+}
+function otpauthUrlOf({ secret, account, issuer }) {
+  const label = encodeURIComponent(`${issuer}:${account}`);
+  return `otpauth://totp/${label}?secret=${secret}&issuer=${encodeURIComponent(issuer)}&digits=${CODE_DIGITS}&period=${STEP_SECONDS}`;
+}
+export {
+  base32Of,
+  bytesOfBase32,
+  isValidTotpCode,
+  newTotpSecret,
+  otpauthUrlOf,
+  totpCodeAt
+};
+//# sourceMappingURL=totp.js.map

package/dist/account/demo/totp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.js","sources":["../../../src/account/demo/totp.js"],"sourcesContent":["// Los códigos de 6 dígitos de una app autenticadora (TOTP, RFC 6238): los mismos que calcula Google Authenticator con la\n// clave que se escaneó. En un proyecto real esto lo hace el servidor (pyotp, otplib, spomky-labs/otphp); aquí lo usa el\n// conector de demostración (y el servidor de mentira de los ejemplos) para que la verificación funcione con la app de verdad.\n//\n// El código sale de la clave y de la hora: HMAC-SHA1 de los «pasos» de 30 segundos desde 1970, recortado a 6 dígitos.\n// Al revisar se acepta el paso de antes y el de después: el reloj del teléfono puede ir unos segundos desfasado.\n//\n// Funciones puras con crypto.subtle (navegador y node): function (regla de la casa).\n\nconst BASE32_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';\nconst STEP_SECONDS = 30;\nconst CODE_DIGITS = 6;\n// cuántos pasos de diferencia se aceptan al revisar (el de antes y el de después)\nconst ACCEPTED_DRIFT_STEPS = 1;\nconst SECRET_BYTES = 20;\n\n/**\n * Bytes → base32 (la clave como la escribe la persona en su app).\n *\n * @param {Uint8Array} bytes\n * @returns {string}\n */\nexport function base32Of(bytes) {\n    let bits = '';\n    for (const byte of bytes) {\n        bits += byte.toString(2).padStart(8, '0');\n    }\n    let text = '';\n    for (let start = 0; start < bits.length; start += 5) {\n        text += BASE32_ALPHABET[parseInt(bits.slice(start, start + 5).padEnd(5, '0'), 2)];\n    }\n    return text;\n}\n\n/**\n * Base32 → bytes (sin espacios ni relleno).\n *\n * @param {string} text\n * @returns {Uint8Array}\n */\nexport function bytesOfBase32(text) {\n    const bits = text.replace(/[\\s=]/g, '').toUpperCase().split('')\n        .map((character) => BASE32_ALPHABET.indexOf(character).toString(2).padStart(5, '0')).join('');\n    const bytes = new Uint8Array(Math.floor(bits.length / 8));\n    for (let index = 0; index < bytes.length; index += 1) {\n        bytes[index] = parseInt(bits.slice(index * 8, index * 8 + 8), 2);\n    }\n    return bytes;\n}\n\n/** Una clave nueva al azar, en base32. */\nexport function newTotpSecret() {\n    return base32Of(crypto.getRandomValues(new Uint8Array(SECRET_BYTES)));\n}\n\n/**\n * El código de un paso de 30 segundos.\n *\n * @param {string} secret la clave en base32\n * @param {number} step los pasos de 30 segundos desde 1970\n * @param {number} [digits]\n * @returns {Promise<string>}\n */\nasync function codeOfStep(secret, step, digits = CODE_DIGITS) {\n    const counter = new ArrayBuffer(8);\n    new DataView(counter).setBigUint64(0, BigInt(step));\n    const key = await crypto.subtle.importKey('raw', bytesOfBase32(secret), {name: 'HMAC', hash: 'SHA-1'}, false, ['sign']);\n    const hmac = new Uint8Array(await crypto.subtle.sign('HMAC', key, counter));\n    // el recorte del RFC: 4 bytes desde la posición que dicen los últimos 4 bits\n    const offset = hmac[hmac.length - 1] & 0x0f;\n    const number = ((hmac[offset] & 0x7f) << 24) | (hmac[offset + 1] << 16) | (hmac[offset + 2] << 8) | hmac[offset + 3];\n    return String(number % 10 ** digits).padStart(digits, '0');\n}\n\n/**\n * El código que enseña la app en ese momento.\n *\n * @param {string} secret la clave en base32\n * @param {number} [timeMilliseconds] por omisión, ahora\n * @param {number} [digits]\n * @returns {Promise<string>}\n */\nexport function totpCodeAt(secret, timeMilliseconds = Date.now(), digits = CODE_DIGITS) {\n    return codeOfStep(secret, Math.floor(timeMilliseconds / 1000 / STEP_SECONDS), digits);\n}\n\n/**\n * ¿El código es el de ahora (o el de un paso antes o después)?\n *\n * @param {string} secret\n * @param {string} code los 6 dígitos\n * @param {number} [timeMilliseconds]\n * @returns {Promise<boolean>}\n */\nexport async function isValidTotpCode(secret, code, timeMilliseconds = Date.now()) {\n    const currentStep = Math.floor(timeMilliseconds / 1000 / STEP_SECONDS);\n    for (let drift = -ACCEPTED_DRIFT_STEPS; drift <= ACCEPTED_DRIFT_STEPS; drift += 1) {\n        if (await codeOfStep(secret, currentStep + drift) === code) {\n            return true;\n        }\n    }\n    return false;\n}\n\n/**\n * La dirección otpauth:// que va en el QR: la app la lee y guarda la cuenta con su clave.\n *\n * @param {{secret: string, account: string, issuer: string}} details\n * @returns {string}\n */\nexport function otpauthUrlOf({secret, account, issuer}) {\n    const label = encodeURIComponent(`${issuer}:${account}`);\n    return `otpauth://totp/${label}?secret=${secret}&issuer=${encodeURIComponent(issuer)}&digits=${CODE_DIGITS}&period=${STEP_SECONDS}`;\n}\n"],"names":[],"mappings":"AASA,MAAM,kBAAkB;AACxB,MAAM,eAAe;AACrB,MAAM,cAAc;AAEpB,MAAM,uBAAuB;AAC7B,MAAM,eAAe;AAQd,SAAS,SAAS,OAAO;AAC5B,MAAI,OAAO;AACX,aAAW,QAAQ,OAAO;AACtB,YAAQ,KAAK,SAAS,CAAC,EAAE,SAAS,GAAG,GAAG;AAAA,EAC5C;AACA,MAAI,OAAO;AACX,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AACjD,YAAQ,gBAAgB,SAAS,KAAK,MAAM,OAAO,QAAQ,CAAC,EAAE,OAAO,GAAG,GAAG,GAAG,CAAC,CAAC;AAAA,EACpF;AACA,SAAO;AACX;AAQO,SAAS,cAAc,MAAM;AAChC,QAAM,OAAO,KAAK,QAAQ,UAAU,EAAE,EAAE,cAAc,MAAM,EAAE,EACzD,IAAI,CAAC,cAAc,gBAAgB,QAAQ,SAAS,EAAE,SAAS,CAAC,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAChG,QAAM,QAAQ,IAAI,WAAW,KAAK,MAAM,KAAK,SAAS,CAAC,CAAC;AACxD,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AAClD,UAAM,KAAK,IAAI,SAAS,KAAK,MAAM,QAAQ,GAAG,QAAQ,IAAI,CAAC,GAAG,CAAC;AAAA,EACnE;AACA,SAAO;AACX;AAGO,SAAS,gBAAgB;AAC5B,SAAO,SAAS,OAAO,gBAAgB,IAAI,WAAW,YAAY,CAAC,CAAC;AACxE;AAUA,eAAe,WAAW,QAAQ,MAAM,SAAS,aAAa;AAC1D,QAAM,UAAU,IAAI,YAAY,CAAC;AACjC,MAAI,SAAS,OAAO,EAAE,aAAa,GAAG,OAAO,IAAI,CAAC;AAClD,QAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,cAAc,MAAM,GAAG,EAAC,MAAM,QAAQ,MAAM,QAAO,GAAG,OAAO,CAAC,MAAM,CAAC;AACtH,QAAM,OAAO,IAAI,WAAW,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,OAAO,CAAC;AAE1E,QAAM,SAAS,KAAK,KAAK,SAAS,CAAC,IAAI;AACvC,QAAM,UAAW,KAAK,MAAM,IAAI,QAAS,KAAO,KAAK,SAAS,CAAC,KAAK,KAAO,KAAK,SAAS,CAAC,KAAK,IAAK,KAAK,SAAS,CAAC;AACnH,SAAO,OAAO,SAAS,MAAM,MAAM,EAAE,SAAS,QAAQ,GAAG;AAC7D;AAUO,SAAS,WAAW,QAAQ,mBAAmB,KAAK,IAAG,GAAI,SAAS,aAAa;AACpF,SAAO,WAAW,QAAQ,KAAK,MAAM,mBAAmB,MAAO,YAAY,GAAG,MAAM;AACxF;AAUO,eAAe,gBAAgB,QAAQ,MAAM,mBAAmB,KAAK,IAAG,GAAI;AAC/E,QAAM,cAAc,KAAK,MAAM,mBAAmB,MAAO,YAAY;AACrE,WAAS,QAAQ,CAAC,sBAAsB,SAAS,sBAAsB,SAAS,GAAG;AAC/E,QAAI,MAAM,WAAW,QAAQ,cAAc,KAAK,MAAM,MAAM;AACxD,aAAO;AAAA,IACX;AAAA,EACJ;AACA,SAAO;AACX;AAQO,SAAS,aAAa,EAAC,QAAQ,SAAS,OAAM,GAAG;AACpD,QAAM,QAAQ,mBAAmB,GAAG,MAAM,IAAI,OAAO,EAAE;AACvD,SAAO,kBAAkB,KAAK,WAAW,MAAM,WAAW,mBAAmB,MAAM,CAAC,WAAW,WAAW,WAAW,YAAY;AACrI;"}

package/dist/account/restAccountConnector.js

@@ -0,0 +1,118 @@
+const ACCOUNT_REST_PATHS = Object.freeze({
+  session: "/auth/session",
+  signIn: "/auth/sign-in",
+  secondStep: "/auth/second-step",
+  secondStepPasskeyOptions: "/auth/second-step/passkey-options",
+  secondStepPasskey: "/auth/second-step/passkey",
+  signOut: "/auth/sign-out",
+  forgotPassword: "/auth/forgot-password",
+  resetPassword: "/auth/reset-password",
+  profile: "/account",
+  password: "/account/password",
+  security: "/account/security",
+  totp: "/account/security/totp",
+  totpConfirm: "/account/security/totp/confirm",
+  passkeyRegistrationOptions: "/account/security/passkeys/registration-options",
+  passkeys: "/account/security/passkeys",
+  recoveryCodes: "/account/security/recovery-codes",
+  sessions: "/account/sessions",
+  closeOtherSessions: "/account/sessions/close-others",
+  activity: "/account/activity"
+});
+const SECOND_STEP_METHOD_IN_API = Object.freeze({ passkey: "passkey", totp: "totp", recoveryCode: "recovery_code" });
+const SECOND_STEP_METHOD_FROM_API = Object.freeze({ passkey: "passkey", totp: "totp", recovery_code: "recoveryCode" });
+function securityFromResponse(response) {
+  return {
+    isEnabled: Boolean(response.is_enabled),
+    enabledAt: response.enabled_at ?? null,
+    passkeys: (response.passkeys ?? []).map((passkey) => ({
+      id: passkey.id,
+      name: passkey.name,
+      createdAt: passkey.created_at,
+      lastUsedAt: passkey.last_used_at ?? null
+    })),
+    totp: { isEnabled: Boolean(response.totp?.is_enabled), enabledAt: response.totp?.enabled_at ?? null },
+    recoveryCodesRemaining: response.recovery_codes_remaining ?? 0
+  };
+}
+function securityChangeFromResponse(response) {
+  return { security: securityFromResponse(response.security), recoveryCodes: response.recovery_codes ?? void 0 };
+}
+function createRestAccountConnector(apiClient, { paths = {} } = {}) {
+  const path = { ...ACCOUNT_REST_PATHS, ...paths };
+  return {
+    loadSession: async () => {
+      try {
+        return await apiClient.get(path.session, { skipUnauthenticatedHandler: true });
+      } catch (error) {
+        if (error?.isUnauthenticated) {
+          return null;
+        }
+        throw error;
+      }
+    },
+    signIn: async ({ email, password, remember }) => {
+      const response = await apiClient.post(path.signIn, { email, password, remember }, { skipUnauthenticatedHandler: true });
+      const methods = response?.second_step?.methods;
+      return { secondStep: methods ? { methods: methods.map((method) => SECOND_STEP_METHOD_FROM_API[method] ?? method) } : null };
+    },
+    signInSecondStep: async ({ method, code }) => {
+      await apiClient.post(path.secondStep, { method: SECOND_STEP_METHOD_IN_API[method] ?? method, code }, { skipUnauthenticatedHandler: true });
+    },
+    secondStepPasskeyOptions: () => apiClient.get(path.secondStepPasskeyOptions, { skipUnauthenticatedHandler: true }),
+    signInWithPasskey: async (credential) => {
+      await apiClient.post(path.secondStepPasskey, { credential }, { skipUnauthenticatedHandler: true });
+    },
+    signOut: async () => {
+      await apiClient.post(path.signOut, void 0, { skipUnauthenticatedHandler: true });
+    },
+    requestPasswordReset: async ({ email }) => {
+      await apiClient.post(path.forgotPassword, { email });
+    },
+    resetPassword: async ({ token, newPassword }) => {
+      await apiClient.post(path.resetPassword, { token, new_password: newPassword });
+    },
+    // todo lo del formulario viaja: name, phone y los campos propios de ProfileScreen (extraFields) con sus nombres
+    updateProfile: async (profile) => await apiClient.put(path.profile, profile) ?? {},
+    changePassword: async ({ currentPassword, newPassword }) => {
+      await apiClient.put(path.password, { current_password: currentPassword, new_password: newPassword });
+    },
+    loadSecurity: async () => securityFromResponse(await apiClient.get(path.security)),
+    startTotp: async () => {
+      const response = await apiClient.post(path.totp);
+      return { secret: response.secret, qrImageUrl: response.qr_image_url ?? null };
+    },
+    confirmTotp: async (code) => securityChangeFromResponse(await apiClient.post(path.totpConfirm, { code })),
+    disableTotp: async (password) => securityChangeFromResponse(await apiClient.delete(path.totp, { body: { password } })),
+    passkeyRegistrationOptions: () => apiClient.get(path.passkeyRegistrationOptions),
+    savePasskey: async ({ name, credential }) => securityChangeFromResponse(await apiClient.post(path.passkeys, { name, credential })),
+    removePasskey: async ({ passkeyId, password }) => securityChangeFromResponse(
+      await apiClient.delete(`${path.passkeys}/${encodeURIComponent(passkeyId)}`, { body: { password } })
+    ),
+    regenerateRecoveryCodes: async (password) => securityChangeFromResponse(await apiClient.post(path.recoveryCodes, { password })),
+    listSessions: async () => (await apiClient.get(path.sessions)).map((session) => ({
+      id: session.id,
+      browser: session.browser,
+      platform: session.platform,
+      isMobile: Boolean(session.is_mobile),
+      startedAt: session.started_at,
+      network: session.network,
+      isCurrent: Boolean(session.is_current)
+    })),
+    closeOtherSessions: async () => (await apiClient.post(path.closeOtherSessions))?.closed ?? 0,
+    listActivity: async () => (await apiClient.get(path.activity)).map((event) => ({
+      id: event.id,
+      kind: event.kind,
+      occurredAt: event.occurred_at,
+      device: event.device,
+      network: event.network
+    }))
+  };
+}
+export {
+  ACCOUNT_REST_PATHS,
+  createRestAccountConnector,
+  securityChangeFromResponse,
+  securityFromResponse
+};
+//# sourceMappingURL=restAccountConnector.js.map