@tinya-code/gas-admin-ui 0.0.0-stage → 0.1.0-alpha.1

package/README.md

@@ -1,3 +1,64 @@
-# Temporary Holding Version
+# GasAdminUi
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+This project was generated using [Angular CLI](https://github.com/angular/angular-cli) version 22.2.0.
+
+## Code scaffolding
+
+Angular CLI includes powerful code scaffolding tools. To generate a new component, run:
+
+```bash
+ng generate component component-name
+```
+
+For a complete list of available schematics (such as `components`, `directives`, or `pipes`), run:
+
+```bash
+ng generate --help
+```
+
+## Building
+
+To build the library, run:
+
+```bash
+ng build gas-admin-ui
+```
+
+This command will compile your project, and the build artifacts will be placed in the `dist/` directory.
+
+### Publishing the Library
+
+Once the project is built, you can publish your library by following these steps:
+
+1. Navigate to the `dist` directory:
+
+   ```bash
+   cd dist/gas-admin-ui
+   ```
+
+2. Run the `npm publish` command to publish your library to the npm registry:
+   ```bash
+   npm publish
+   ```
+
+## Running unit tests
+
+To execute unit tests with the [Vitest](https://vitest.dev/) test runner, use the following command:
+
+```bash
+ng test
+```
+
+## Running end-to-end tests
+
+For end-to-end (e2e) testing, run:
+
+```bash
+ng e2e
+```
+
+Angular CLI does not come with an end-to-end testing framework by default. You can choose one that suits your needs.
+
+## Additional Resources
+
+For more information on using the Angular CLI, including detailed command references, visit the [Angular CLI Overview and Command Reference](https://angular.dev/tools/cli) page.

package/fesm2022/tinya-code-gas-admin-ui-api.service-CZrUeclM.mjs

@@ -0,0 +1,281 @@
+import * as i0 from "@angular/core";
+import { InjectionToken, Service, computed, inject, signal } from "@angular/core";
+import { HttpClient } from "@angular/common/http";
+import { catchError, map, of, tap, throwError } from "rxjs";
+import { Router } from "@angular/router";
+var ApiError = class extends Error {
+	status;
+	fieldPath;
+	code;
+	issues;
+	constructor(status, message, fieldPath, code, issues = []) {
+		super(message);
+		this.name = "ApiError";
+		this.status = status;
+		this.fieldPath = fieldPath;
+		this.code = code;
+		this.issues = issues;
+	}
+};
+function renewedTokenOf(body) {
+	if (body === null || typeof body !== "object") return null;
+	const meta = body.meta;
+	if (meta === null || typeof meta !== "object") return null;
+	const token = meta.renewedToken;
+	return typeof token === "string" && token !== "" ? token : null;
+}
+const API_URL = new InjectionToken("API_URL");
+const LOGIN_PATH = "/login";
+const SESSION_TOKEN_KEY = "admin.session.token";
+const SESSION_USER_KEY = "admin.session.user";
+var AuthService = class AuthService {
+	http = inject(HttpClient);
+	apiUrl = inject(API_URL);
+	router = inject(Router);
+	storage = sessionStorage;
+	_user = signal(null, ...ngDevMode ? [{ debugName: "_user" }] : /* istanbul ignore next */ []);
+	_token = signal(null, ...ngDevMode ? [{ debugName: "_token" }] : /* istanbul ignore next */ []);
+	_returnUrl = signal(null, ...ngDevMode ? [{ debugName: "_returnUrl" }] : /* istanbul ignore next */ []);
+	user = this._user.asReadonly();
+	token = this._token.asReadonly();
+	returnUrl = this._returnUrl.asReadonly();
+	isAuthenticated = computed(() => this._token() !== null && this._user() !== null, ...ngDevMode ? [{ debugName: "isAuthenticated" }] : /* istanbul ignore next */ []);
+	role = computed(() => this._user()?.role ?? "", ...ngDevMode ? [{ debugName: "role" }] : /* istanbul ignore next */ []);
+	constructor() {
+		const token = this.storage.getItem(SESSION_TOKEN_KEY);
+		if (token !== null && token !== "") this._token.set(token);
+		const raw = this.storage.getItem(SESSION_USER_KEY);
+		if (raw !== null && raw !== "") try {
+			this._user.set(JSON.parse(raw));
+		} catch {
+			this.storage.removeItem(SESSION_USER_KEY);
+			this.storage.removeItem(SESSION_TOKEN_KEY);
+			this._token.set(null);
+		}
+	}
+	login(email, password) {
+		return this.post("/auth/login", {
+			email,
+			password
+		}).pipe(map((res) => {
+			this.open(res.token, res.user);
+			const renewed = renewedTokenOf(res);
+			if (renewed !== null) this.applyRenewedToken(renewed);
+			return res.user;
+		}));
+	}
+	logout() {
+		return this.post("/auth/logout").pipe(tap({
+			next: () => this.clear(),
+			error: () => this.clear()
+		}), map(() => void 0));
+	}
+	logoutAll() {
+		return this.post("/auth/logout-all").pipe(tap(() => {
+			this.clear();
+			this.goLogin();
+		}), map((res) => ({ effectiveWithinSeconds: res.effectiveWithinSeconds })));
+	}
+	restore() {
+		if (this._token() === null) return of(void 0);
+		return this.post("/auth/me").pipe(tap((res) => {
+			this.open(this._token(), res.user);
+		}), catchError(() => of(void 0)), map(() => void 0));
+	}
+	applyRenewedToken(token) {
+		if (token === "" || this._token() === null) return;
+		this._token.set(token);
+		this.storage.setItem(SESSION_TOKEN_KEY, token);
+	}
+	applyAuthCode(code) {
+		switch (code) {
+			case "AUTH_EXPIRED":
+				this._returnUrl.set(this.currentUrl());
+				this.clear();
+				this.goLogin();
+				break;
+			case "AUTH_REQUIRED":
+			case "AUTH_INVALID":
+				this.clear();
+				this.goLogin();
+		}
+	}
+	hasRole(required) {
+		if (required === "" || required === "session") return this.isAuthenticated();
+		const role = this.role();
+		if (role === "admin") return true;
+		return role !== "" && role === required;
+	}
+	canAccess(access) {
+		const requires = access?.requires ?? "session";
+		if (requires === "public") return true;
+		if (!this.isAuthenticated()) return false;
+		const role = requires.startsWith("role:") ? requires.slice(5) : "";
+		const required = role === "" ? access?.roles ?? [] : [role];
+		if (required.length === 0) return true;
+		return required.some((one) => this.hasRole(one));
+	}
+	canDoOperation(schema, operation) {
+		const ops = schema.policies?.access?.operations;
+		if (ops && ops[operation]) return this.meetsLevel(ops[operation]);
+		if (schema.policies?.access) {
+			const groupLevel = operation === "create" || operation === "update" || operation === "remove" ? schema.policies.access.write : schema.policies.access.read;
+			return this.meetsLevel(groupLevel ?? "admin");
+		}
+		const perms = schema.permissions;
+		if (perms) return {
+			list: true,
+			get: true,
+			create: perms.create,
+			update: perms.update,
+			remove: perms.remove
+		}[operation] !== false;
+		return true;
+	}
+	canReadField(field) {
+		if (!field.access || !field.access.read) return true;
+		return this.meetsLevel(field.access.read);
+	}
+	canWriteField(field) {
+		if (!field.access || !field.access.write) return true;
+		return this.meetsLevel(field.access.write);
+	}
+	meetsLevel(level) {
+		if (level === "public") return true;
+		if (level === "session") return this.isAuthenticated();
+		if (level.startsWith("role:")) {
+			const requiredRole = level.slice(5);
+			return this.hasRole(requiredRole);
+		}
+		return this.hasRole("admin");
+	}
+	open(token, user) {
+		if (token !== null && token !== "") this._token.set(token);
+		this._user.set(user);
+		if (token !== null && token !== "") this.storage.setItem(SESSION_TOKEN_KEY, token);
+		if (user !== null) this.storage.setItem(SESSION_USER_KEY, JSON.stringify(user));
+	}
+	consumeReturnUrl() {
+		const url = this._returnUrl();
+		this._returnUrl.set(null);
+		return url;
+	}
+	clear() {
+		this._token.set(null);
+		this._user.set(null);
+		this.storage.removeItem(SESSION_TOKEN_KEY);
+		this.storage.removeItem(SESSION_USER_KEY);
+	}
+	goLogin() {
+		if (this.currentUrl().startsWith("/login")) return;
+		this.router.navigate([LOGIN_PATH]).catch(() => void 0);
+	}
+	currentUrl() {
+		return this.router.url;
+	}
+	envelope(path, payload = {}) {
+		return {
+			token: this._token(),
+			method: "POST",
+			path,
+			payload
+		};
+	}
+	post(path, payload = {}) {
+		return this.http.post(this.apiUrl, this.envelope(path, payload), { headers: { "Content-Type": "text/plain" } });
+	}
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.3",
+		ngImport: i0,
+		type: AuthService,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Service
+	});
+	static ɵprov = i0.ɵɵngDeclareService({
+		minVersion: "22.0.0",
+		version: "22.2.3",
+		ngImport: i0,
+		type: AuthService
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.3",
+	ngImport: i0,
+	type: AuthService,
+	decorators: [{ type: Service }],
+	ctorParameters: () => []
+});
+var ApiService = class ApiService {
+	http = inject(HttpClient);
+	apiUrl = inject(API_URL);
+	auth = inject(AuthService);
+	list(endpoint, payload) {
+		return this.send(endpoint.list, "GET", payload).pipe(map((raw) => unwrapList(raw)));
+	}
+	get(endpoint, key) {
+		return this.send(this.withKey(endpoint.get, key), "GET");
+	}
+	create(endpoint, payload) {
+		return this.send(endpoint.create, "POST", payload);
+	}
+	update(endpoint, key, payload) {
+		return this.send(this.withKey(endpoint.update, key), "PUT", payload);
+	}
+	remove(endpoint, key) {
+		return this.send(this.withKey(endpoint.remove, key), "DELETE");
+	}
+	request(method, path, payload) {
+		return this.send(path, method, payload);
+	}
+	send(path, method, payload) {
+		if (!path) return throwError(() => /* @__PURE__ */ new Error("Operación no disponible para este recurso"));
+		const body = {
+			token: this.auth.token(),
+			method,
+			path,
+			payload: payload ?? {}
+		};
+		return this.http.post(this.apiUrl, body, { headers: { "Content-Type": "text/plain" } }).pipe(tap((res) => {
+			const renewed = renewedTokenOf(res);
+			if (renewed !== null) this.auth.applyRenewedToken(renewed);
+		}));
+	}
+	withKey(path, key) {
+		if (!path) return;
+		return path.includes("{key}") ? path.replace("{key}", encodeURIComponent(key ?? "")) : path;
+	}
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.3",
+		ngImport: i0,
+		type: ApiService,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Service
+	});
+	static ɵprov = i0.ɵɵngDeclareService({
+		minVersion: "22.0.0",
+		version: "22.2.3",
+		ngImport: i0,
+		type: ApiService
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.3",
+	ngImport: i0,
+	type: ApiService,
+	decorators: [{ type: Service }]
+});
+function unwrapList(raw) {
+	if (Array.isArray(raw)) return raw;
+	if (raw !== null && typeof raw === "object") {
+		const items = raw.items;
+		if (Array.isArray(items)) return items;
+	}
+	return [];
+}
+export { SESSION_USER_KEY as a, renewedTokenOf as c, SESSION_TOKEN_KEY as i, AuthService as n, API_URL as o, LOGIN_PATH as r, ApiError as s, ApiService as t };
+
+//# sourceMappingURL=tinya-code-gas-admin-ui-api.service-CZrUeclM.mjs.map

package/fesm2022/tinya-code-gas-admin-ui-api.service-CZrUeclM.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"tinya-code-gas-admin-ui-api.service-CZrUeclM.mjs","names":[],"sources":["../../../projects/gas-admin-ui/src/lib/core/models/api.model.ts","../../../projects/gas-admin-ui/src/lib/core/tokens.ts","../../../projects/gas-admin-ui/src/lib/core/services/auth.service.ts","../../../projects/gas-admin-ui/src/lib/core/services/api.service.ts"],"sourcesContent":["/**\n * Contrato HTTP con el backend (doc/baseapi.md §8 «Errores»).\n *\n * El backend responde SIEMPRE HTTP 200; los errores viajan en el body\n * con `{ error: { status, message, errors?: [{ path, message }] } }`.\n * El interceptor (Fase 3) los convierte en `ApiError`.\n */\n\n/**\n * Un error con ruta del422 (auth.md §6): `path` para pintarlo en el campo y\n * `code` MAYUS_SNAKE (`VALIDATION_MIN_LENGTH`) para mapearlo sin leer texto.\n */\nexport interface ApiIssue {\n  /** Ruta del campo afectado (`faq[2].answer`, `sku`). */\n  path: string;\n  /** Mensaje en español, listo para pintar. */\n  message: string;\n  /** Código estable del validador (B11); el mensaje puede cambiar, el código no. */\n  code?: string;\n}\n\n/** Shape del body de error (doc/baseapi.md §8 «Errores»). */\nexport interface ApiErrorBody {\n  error: {\n    status: number;\n    message: string;\n    /** Ruta del campo afectado cuando el backend la envía (base.md §10). */\n    path?: string;\n    /**\n     * Código de sesión de §4.5 (R2.9): `AUTH_REQUIRED` · `AUTH_INVALID` ·\n     * `AUTH_EXPIRED` · `FORBIDDEN` · `RATE_LIMITED`. Aparece SÓLO en esas\n     * cinco respuestas — el sobre de error es aditivo (O7 / D10-5).\n     */\n    code?: string;\n    /**\n     * Errores de validación con ruta (base.md §5, guía §10): el 422 los manda\n     * ACÁ (`error.errors[]`), no en `path`. Sin modelarlos el form veía\n     * «Errores de validación» genérico y ningún campo se pintaba (D42).\n     */\n    errors?: ApiIssue[];\n  };\n}\n\n/** Error de API estandarizado que lanza el interceptor de errores. */\nexport class ApiError extends Error {\n  readonly status: number;\n  /** Ruta del campo que provocó el error (ej. `faq[2].answer`), si existe. */\n  readonly fieldPath?: string;\n  /** Código de sesión de §4.5 si el backend lo envió; `undefined` en el resto. */\n  readonly code?: string;\n  /** Issues con ruta (422); vacío cuando el error no trae `errors[]`. */\n  readonly issues: readonly ApiIssue[];\n\n  constructor(\n    status: number,\n    message: string,\n    fieldPath?: string,\n    code?: string,\n    issues: readonly ApiIssue[] = [],\n  ) {\n    super(message);\n    this.name = 'ApiError';\n    this.status = status;\n    this.fieldPath = fieldPath;\n    this.code = code;\n    this.issues = issues;\n  }\n}\n\n/**\n * `meta.renewedToken` (auth.md §3.2/§3.4): el back lo adjunta a la respuesta\n * cuando la vida del token bajó del umbral de renovación. Es el ÚNICO modo\n * de que el front se entere — el token nuevo no viaja en cabeceras ni en la\n * URL. Devuelve `null` cuando no hay renovación (que es lo normal).\n *\n * Vive acá y no en el `ApiService` porque lo consumen DOS servicios\n * (`ApiService` y `AuthService`) y éste modelo no importa a ninguno de los\n * dos: sin este archivo no hay ciclo de imports.\n */\nexport function renewedTokenOf(body: unknown): string | null {\n  if (body === null || typeof body !== 'object') return null;\n  const meta = (body as { meta?: unknown }).meta;\n  if (meta === null || typeof meta !== 'object') return null;\n  const token = (meta as { renewedToken?: unknown }).renewedToken;\n  return typeof token === 'string' && token !== '' ? token : null;\n}\n","import { InjectionToken } from '@angular/core';\n\n/**\n * URL base de la API (baseapi §2.3): es la URL directa del Web App de Apps\n * Script; ahí se hace el `POST` del envelope `{ token, method, path, payload }`.\n * OBLIGATORIO proporcionarlo en `app.config.ts`:\n * `{ provide: API_URL, useValue: 'https://…' }` (Fase 3). Vacío = mismo origen.\n */\nexport const API_URL = new InjectionToken<string>('API_URL');\n","import { HttpClient } from '@angular/common/http';\nimport { computed, inject, Service, signal } from '@angular/core';\nimport { Router } from '@angular/router';\nimport { catchError, map, Observable, of, tap } from 'rxjs';\n\nimport type { FieldSchema, ResourceSchema } from '../models/schema.model';\nimport { renewedTokenOf } from '../models/api.model';\nimport { API_URL } from '../tokens';\n\n/**\n * Sesión del admin (auth.md §5.2) — **única dueña** del token y del usuario.\n *\n * Qué vive acá y por qué:\n *\n *  - **Señales** `user` / `token` / `isAuthenticated` / `role`: el único\n *    estado que el resto de la app lee (guards, menú, interceptor).\n *  - **`login()` / `logout()` / `logoutAll()` / `restore()`**: operaciones de sesión.\n *    El `AuthService` NO inyecta `ApiService` — sólo `HttpClient` — porque\n *    `ApiService` inyecta a éste para leer el token, y un ciclo de DI en\n *    Angular es un error en tiempo de arranque, no un warning.\n *  - **`applyAuthCode()` (R2.9): EL único intérprete de la tabla de §4.5.**\n *    Ningún otro archivo decide qué pasa ante `AUTH_*` o `FORBIDDEN`.\n *  - **Almacenamiento (R2.12): `sessionStorage`, siempre.** `rememberMe`\n *    no puede usar `localStorage` porque D10-3 lo negó — ver más abajo.\n *\n * La sesión arranca desde el storage y `restore()` la revalida contra\n * `/auth/me` en el initializer: un usuario desactivado mientras la pestaña\n * estaba abierta cae al primer reload, no en mitad de una edición.\n */\n\n/** Usuario tal y como lo sirve `publicUser_` (lista blanca, R2.17). */\nexport interface SessionUser {\n  id?: string;\n  email?: string;\n  name?: string;\n  role?: string;\n  active?: boolean;\n  last_login_at?: string;\n  created_at?: string;\n}\n\n/** Los cinco códigos de §4.5. El resto de errores no son de sesión. */\nexport type AuthErrorCode =\n  'AUTH_REQUIRED' | 'AUTH_INVALID' | 'AUTH_EXPIRED' | 'FORBIDDEN' | 'RATE_LIMITED';\n\n/** Ruta de login: fuera del shell para que ningún guard la proteja. */\nexport const LOGIN_PATH = '/login';\n\n/**\n * Claves del `sessionStorage`. Exportadas porque **la sesión se restaura\n * desde ahí en el constructor**: un test que quiera una sesión arrancando\n * tiene que sembrarlas antes de inyectar el servicio, y el que las use con\n * otro nombre quebraría el restore en silencio.\n */\nexport const SESSION_TOKEN_KEY = 'admin.session.token';\nexport const SESSION_USER_KEY = 'admin.session.user';\n\ninterface LoginResponse {\n  token: string;\n  user: SessionUser;\n}\ninterface MeResponse {\n  user: SessionUser;\n}\n\n@Service()\nexport class AuthService {\n  private readonly http = inject(HttpClient);\n  private readonly apiUrl = inject(API_URL);\n  private readonly router = inject(Router);\n\n  /**\n   * D10-3: **sólo `sessionStorage`.** La opción «recordarme» con\n   * `localStorage` quedó denegada en §9.3 — muere con la pestaña ⇒ cero\n   * token legible por un XSS futuro. `authSchema.rememberMe` es `false`\n   * por la misma razón: declarar `true` sería prometer un storage que\n   * este servicio no usa.\n   *\n   * Nunca en la URL ni en el cuerpo de un GET (§5.4): el token sólo viaja\n   * dentro del envelope `{ token, method, path, payload }`.\n   */\n  private readonly storage: Storage = sessionStorage;\n\n  private readonly _user = signal<SessionUser | null>(null);\n  private readonly _token = signal<string | null>(null);\n  /** Ruta previa a un `AUTH_EXPIRED`, para volver tras reloguear (§4.5). */\n  private readonly _returnUrl = signal<string | null>(null);\n\n  readonly user = this._user.asReadonly();\n  readonly token = this._token.asReadonly();\n  readonly returnUrl = this._returnUrl.asReadonly();\n  /** Sólo hay sesión con token Y usuario: uno sin el otro es estado corrupto. */\n  readonly isAuthenticated = computed(() => this._token() !== null && this._user() !== null);\n  readonly role = computed(() => this._user()?.role ?? '');\n\n  constructor() {\n    const token = this.storage.getItem(SESSION_TOKEN_KEY);\n    if (token !== null && token !== '') this._token.set(token);\n    const raw = this.storage.getItem(SESSION_USER_KEY);\n    if (raw !== null && raw !== '') {\n      try {\n        this._user.set(JSON.parse(raw) as SessionUser);\n      } catch {\n        // JSON corrupto ⇒ no hay sesión que restaurar; storage sucio.\n        this.storage.removeItem(SESSION_USER_KEY);\n        this.storage.removeItem(SESSION_TOKEN_KEY);\n        this._token.set(null);\n      }\n    }\n  }\n\n  // ── Sesión ───────────────────────────────────────────────────────────────\n\n  login(email: string, password: string): Observable<SessionUser> {\n    return this.post<LoginResponse>('/auth/login', { email, password }).pipe(\n      map((res) => {\n        this.open(res.token, res.user);\n        const renewed = renewedTokenOf(res);\n        if (renewed !== null) this.applyRenewedToken(renewed);\n        return res.user;\n      }),\n    );\n  }\n\n  /**\n   * Revocación best-effort (§9.7): se pide al back que ponga el `sid` en la\n   * lista de revocados, pero **la sesión local se ciere haya o no respuesta**.\n   * Un logout que «falla» por red y deja al usuario dentro es peor que uno\n   * que deja una sesión muerta en el servidor.\n   */\n  logout(): Observable<void> {\n    return this.post<{ loggedOut?: boolean }>('/auth/logout').pipe(\n      tap({\n        next: () => this.clear(),\n        error: () => this.clear(),\n      }),\n      map(() => undefined),\n    );\n  }\n\n  /** Revoca las sesiones del usuario en todos sus dispositivos. */\n  logoutAll(): Observable<{ effectiveWithinSeconds: number }> {\n    return this.post<{ sessionsRevoked: boolean; effectiveWithinSeconds: number }>(\n      '/auth/logout-all',\n    ).pipe(\n      tap(() => {\n        this.clear();\n        this.goLogin();\n      }),\n      map((res) => ({ effectiveWithinSeconds: res.effectiveWithinSeconds })),\n    );\n  }\n\n  /** Revalida la sesión restaurada contra `/auth/me`; sin token ⇒ sin viaje. */\n  restore(): Observable<void> {\n    if (this._token() === null) return of(undefined);\n    return this.post<MeResponse>('/auth/me').pipe(\n      tap((res) => {\n        this.open(this._token(), res.user);\n      }),\n      // El interceptor ya interpretó el `AUTH_*` (R2.9) antes de llegar\n      // acá: esto sólo evita que un fallo rompa el arranque de la app.\n      catchError(() => of(undefined)),\n      map(() => undefined),\n    );\n  }\n\n  /**\n   * Renovación deslizante (§3.2): el back manda `meta.renewedToken` cuando\n   * la vida del token bajó del umbral. Se persiste el MISMO día que el\n   * token original — el `sid` no cambia, sólo se emite una firma nueva.\n   */\n  applyRenewedToken(token: string): void {\n    if (token === '' || this._token() === null) return;\n    this._token.set(token);\n    this.storage.setItem(SESSION_TOKEN_KEY, token);\n  }\n\n  // ── R2.9 · la tabla de §4.5, en un solo sitio ───────────────────────────\n\n  /**\n   * ÚNICO intérprete de los códigos de sesión (auth.md §4.5 / §5.2).\n   * El interceptor `apiErrorInterceptor` lo llama y nada más: cualquier\n   * archivo que decida «si ve AUTH_EXPIRED hago X» está fuera de contrato.\n   *\n   * | Código          | Qué hace                                    |\n   * | --------------- | ------------------------------------------- |\n   * | `AUTH_REQUIRED` | limpia sesión y va a login                  |\n   * | `AUTH_INVALID`  | limpia sesión y va a login                  |\n   * | `AUTH_EXPIRED`  | guarda la ruta previa, limpia, va a login   |\n   * | `FORBIDDEN`     | **no** cierra sesión (el usuario sigue dentro) |\n   * | `RATE_LIMITED`  | no hace nada: lo espera el formulario       |\n   */\n  applyAuthCode(code: string | undefined): void {\n    switch (code) {\n      case 'AUTH_EXPIRED':\n        // La ruta previa se guarda ANTES de borrar: después de limpiar no\n        // queda desde dónde navegar (y `router.url` ya cambió al llegar).\n        this._returnUrl.set(this.currentUrl());\n        this.clear();\n        this.goLogin();\n        break;\n      case 'AUTH_REQUIRED':\n      case 'AUTH_INVALID':\n        // «La sesión terminó» — no hay vuelta atrás que conservar.\n        this.clear();\n        this.goLogin();\n        break;\n      case 'FORBIDDEN':\n      case 'RATE_LIMITED':\n        // Decisión explícita de NO tocar la sesión: §4.5 exige que el\n        // usuario vea «sin permiso» o «espera» **siguiendo dentro**.\n        break;\n      default:\n        // No es un código de sesión: nada que interpretar.\n        break;\n    }\n  }\n\n  // ── Helpers ──────────────────────────────────────────────────────────────\n\n  /** ¿El rol de la sesión cubre `required`? (mínimo: admin ≥ staff, §4.4) */\n  hasRole(required: string): boolean {\n    if (required === '' || required === 'session') return this.isAuthenticated();\n    const role = this.role();\n    if (role === 'admin') return true;\n    return role !== '' && role === required;\n  }\n\n  /**\n   * §5.3 — el ÚNICO criterio de visibilidad del front (menú, rutas y\n   * botones). `requires` viene del vocabulario de §4.4: `public` no pide\n   * sesión; todo lo demás sí; `roles` estrecha.\n   *\n   * Es **pura decisión de UI**. El back re-verifica `accessLevel` en cada\n   * petición (R2.6), así que filtrar acá no protege nada: sólo evita\n   * enseñarle a alguien un botón que le va a devolver 403.\n   */\n  canAccess(access?: { requires?: string; roles?: string[] }): boolean {\n    const requires = access?.requires ?? 'session';\n    if (requires === 'public') return true;\n    if (!this.isAuthenticated()) return false;\n\n    // §4.4 escribe el requerimiento como `role:admin`; §5.3 como\n    // `roles: ['admin']`. Se aceptan las dos formas en lugar de elegir una:\n    // son el mismo dato visto desde el nivel de acceso y desde el recurso.\n    const role = requires.startsWith('role:') ? requires.slice('role:'.length) : '';\n    const required = role === '' ? (access?.roles ?? []) : [role];\n    if (required.length === 0) return true;\n    return required.some((one) => this.hasRole(one));\n  }\n\n  // ── R7.5 · Consumo de políticas en UI (F10) ───────────────────────────────\n\n  /**\n   * Evalúa si el usuario puede ejecutar una operación específica según\n   * `policies.access.operations` del recurso (B8 · R7.4a).\n   *\n   * El override por operación tiene prioridad sobre el umbral del grupo.\n   * Si no hay override, se usa el umbral `policies.access.read` o\n   * `policies.access.write` según la operación.\n   *\n   * Fallback a `permissions` (legacy) si `policies` no existe: mientras\n   * los schemas locales no tengan `policies`, se mantiene compatibilidad.\n   *\n   * Es **pura decisión de UI**. El back vuelve a verificar en cada petición\n   * (24-crud), así que esto sólo evita mostrar botones que darían 403.\n   */\n  canDoOperation(\n    schema: ResourceSchema,\n    operation: 'list' | 'get' | 'create' | 'update' | 'remove',\n  ): boolean {\n    // R7.5: intentar policies primero\n    const ops = schema.policies?.access?.operations;\n    if (ops && ops[operation]) {\n      return this.meetsLevel(ops[operation]);\n    }\n\n    // Sin override en policies: usar el umbral del grupo\n    if (schema.policies?.access) {\n      const isWrite = operation === 'create' || operation === 'update' || operation === 'remove';\n      const groupLevel = isWrite ? schema.policies.access.write : schema.policies.access.read;\n      return this.meetsLevel(groupLevel ?? 'admin');\n    }\n\n    // Fallback a permissions (legacy, R7.5 transición)\n    const perms = schema.permissions;\n    if (perms) {\n      const permMap: Record<string, boolean | undefined> = {\n        list: true, // list no tiene en permissions, siempre true si no hay policies\n        get: true,\n        create: perms.create,\n        update: perms.update,\n        remove: perms.remove,\n      };\n      return permMap[operation] !== false;\n    }\n\n    // Sin policies ni permissions: UX optimista (§5.3 legacy) — el back es\n    // la autoridad y responde 403 si el rol no alcanza.\n    return true;\n  }\n\n  /**\n   * Evalúa si el usuario puede leer un campo según `field.access.read`\n   * (B8 · R7.4b).\n   *\n   * Es **pura decisión de UI**. El back vuelve a filtrar la respuesta en\n   * cada petición (24-crud), así que esto sólo evita mostrar datos que el\n   * usuario no debería ver.\n   */\n  canReadField(field: FieldSchema): boolean {\n    if (!field.access || !field.access.read) return true; // sin restricción ⇒ visible\n    return this.meetsLevel(field.access.read);\n  }\n\n  /**\n   * Evalúa si el usuario puede escribir un campo según `field.access.write`\n   * (B8 · R7.4b).\n   *\n   * Es **pura decisión de UI**. El back rechaza la escritura con 422 si el\n   * usuario no tiene permiso, así que esto sólo pone el campo en\n   * solo-lectura en el frontend.\n   */\n  canWriteField(field: FieldSchema): boolean {\n    if (!field.access || !field.access.write) return true; // sin restricción ⇒ editable\n    return this.meetsLevel(field.access.write);\n  }\n\n  /**\n   * Verifica si el rol actual cumple un nivel de acceso dado.\n   * Usa la misma jerarquía que `ACCESS_ROLE_RANK` del back (11-auth):\n   * admin ≥ staff.\n   */\n  private meetsLevel(level: string): boolean {\n    if (level === 'public') return true;\n    if (level === 'session') return this.isAuthenticated();\n    if (level.startsWith('role:')) {\n      const requiredRole = level.slice('role:'.length);\n      return this.hasRole(requiredRole);\n    }\n    // fallback conservador: nivel desconocido ⇒ sólo admin\n    return this.hasRole('admin');\n  }\n\n  private open(token: string | null, user: SessionUser | null): void {\n    if (token !== null && token !== '') this._token.set(token);\n    this._user.set(user);\n    if (token !== null && token !== '') this.storage.setItem(SESSION_TOKEN_KEY, token);\n    if (user !== null) this.storage.setItem(SESSION_USER_KEY, JSON.stringify(user));\n  }\n\n  /**\n   * Borra token **y** usuario (§5.4) — en ese orden de importancia: un token\n   * sin usuario no autentica, pero un usuario sin token engaña al menú.\n   */\n  /**\n   * Ruta previa guardada por un `AUTH_EXPIRED` (§4.5), **consumida**: se\n   * devuelve una sola vez y se borra. Sin el consume, cada login futuro\n   * volvería a la misma URL vieja aunque el usuario hubiera llegado al\n   * login desde el menú.\n   */\n  consumeReturnUrl(): string | null {\n    const url = this._returnUrl();\n    this._returnUrl.set(null);\n    return url;\n  }\n\n  private clear(): void {\n    this._token.set(null);\n    this._user.set(null);\n    this.storage.removeItem(SESSION_TOKEN_KEY);\n    this.storage.removeItem(SESSION_USER_KEY);\n  }\n\n  private goLogin(): void {\n    if (this.currentUrl().startsWith(LOGIN_PATH)) return;\n    // Angular rechaza la promesa cuando no hay ruta que empate (NG04002).\n    // Navegar es un efecto, no una operación cuyo resultado alguien espere:\n    // el catch evita una rejection sin handler en arranques y en tests.\n    void this.router.navigate([LOGIN_PATH]).catch(() => undefined);\n  }\n\n  private currentUrl(): string {\n    return this.router.url;\n  }\n\n  private envelope(path: string, payload: Record<string, unknown> = {}) {\n    return { token: this._token(), method: 'POST' as const, path, payload };\n  }\n\n  /**\n   * Mismo transporte que `ApiService` (R2.8): cuerpo JSON con\n   * `Content-Type: text/plain` ⇒ **simple request**, sin preflight CORS.\n   * Los tres endpoints de sesión pasan por acá — si alguno se saltara el\n   * header, el navegador añadiría `application/json` y la llamada empezaría\n   * a pedir permiso al servidor con un OPTIONS.\n   */\n  private post<T>(path: string, payload: Record<string, unknown> = {}): Observable<T> {\n    return this.http.post<T>(this.apiUrl, this.envelope(path, payload), {\n      headers: { 'Content-Type': 'text/plain' },\n    });\n  }\n}\n","import { HttpClient } from '@angular/common/http';\nimport { inject, Service } from '@angular/core';\nimport { map, Observable, tap, throwError } from 'rxjs';\n\nimport { renewedTokenOf } from '../models/api.model';\nimport type { ResourceEndpoints } from '../models/schema.model';\nimport { API_URL } from '../tokens';\nimport { AuthService } from './auth.service';\n\n/** Métodos que entiende el envelope del backend (baseapi §2.3). */\nexport type EnvelopeMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';\n\n/**\n * CRUD genérico sobre el contrato v2 (baseapi §2.3): TODA llamada a la API\n * es un `POST` a `API_URL` con cuerpo `text/plain` y el JSON\n * `{ token, method, path, payload }`. `method: 'GET'` también para lecturas;\n * el token viaja en el cuerpo (nunca en cabeceras: criterio 11 de §17).\n *\n * `text/plain` en lugar de `application/json` evita el preflight CORS\n * (simple request) — criterio 11: sin cabeceras custom.\n *\n * **R2.8 — convención sobre el snippet.** `auth.md` §5.2 llama a las claves\n * `{ route, op, token, payload }`, pero el backend (`parseEnvelope_`) lee\n * `path` y `method`: el snippet es un esquema a medias, no un contrato.\n * Mismo precedente que en R2.5 — **la convención del código gana**. Cambiar\n * el nombre ahora rompería el único transporte que existe.\n *\n * **R2.12 — el token sale de `AuthService`, no de configuración.** El\n * `ADMIN_TOKEN` (D21-C) se retiró: no hay credencial fija, hay sesión.\n *\n * Devuelve el JSON plano tal cual, sin transformaciones ocultas\n * (base.md §1, principio 4). Los errores del backend (200 + `{ error: {…} }`)\n * los convierte en `ApiError` el interceptor `apiErrorInterceptor`, que es\n * también quien pasa los `AUTH_*` a `AuthService.applyAuthCode` (R2.9).\n */\n@Service()\nexport class ApiService {\n  private readonly http = inject(HttpClient);\n  private readonly apiUrl = inject(API_URL);\n  private readonly auth = inject(AuthService);\n\n  /**\n   * Listado. El backend envuelve la respuesta cuando la operación declara\n   * `shape.envelope: 'list'` (F5) ⇒ `{ items, nextCursor, total }` (R6.4);\n   * la UI consume `T[]` en todos lados (F7-3) y este es el ÚNICO punto que\n   * habla de listas, así que el desenvolvimiento vive acá. `nextCursor` es\n   * el token de la página siguiente y `null` en la última — éste servicio\n   * lo descarta hoy porque la lista no pagina todavía (backlog-ui-ux).\n   * Un listado sin envelope (arreglo plano, el contrato histórico) pasa\n   * tal cual.\n   *\n   * `payload` sólo lo usa una fuente declarada (F8 · R6.5): `{ view, params }`\n   * pide el listado filtrado por una vista y sus parámetros. Sin él, la\n   * llamada es la de siempre — la lectura llana del recurso.\n   */\n  list<T>(endpoint: ResourceEndpoints, payload?: Record<string, unknown>): Observable<T[]> {\n    return this.send<unknown>(endpoint.list, 'GET', payload).pipe(map((raw) => unwrapList<T>(raw)));\n  }\n\n  /** `key` solo aplica a colecciones (`{key}` en la plantilla); los singleton no la llevan. */\n  get<T>(endpoint: ResourceEndpoints, key?: string): Observable<T> {\n    return this.send<T>(this.withKey(endpoint.get, key), 'GET');\n  }\n\n  create<T>(endpoint: ResourceEndpoints, payload: Record<string, unknown>): Observable<T> {\n    return this.send<T>(endpoint.create, 'POST', payload);\n  }\n\n  update<T>(\n    endpoint: ResourceEndpoints,\n    key: string | undefined,\n    payload: Record<string, unknown>,\n  ): Observable<T> {\n    return this.send<T>(this.withKey(endpoint.update, key), 'PUT', payload);\n  }\n\n  remove(endpoint: ResourceEndpoints, key?: string): Observable<void> {\n    return this.send<void>(this.withKey(endpoint.remove, key), 'DELETE');\n  }\n\n  /**\n   * Operación genérica sobre una ruta ya resuelta: reorder de colección\n   * (`PUT /admin/x` con `{ reorder: … }`), `/admin/schema`,\n   * `/admin/upload-signature`, etc.\n   */\n  request<T>(\n    method: EnvelopeMethod,\n    path: string | undefined,\n    payload?: Record<string, unknown>,\n  ): Observable<T> {\n    return this.send<T>(path, method, payload);\n  }\n\n  private send<T>(\n    path: string | undefined,\n    method: EnvelopeMethod,\n    payload?: Record<string, unknown>,\n  ): Observable<T> {\n    if (!path) {\n      return throwError(() => new Error('Operación no disponible para este recurso'));\n    }\n    // Token de la SESIÓN, leído en cada petición (R2.8): no hay credencial\n    // fija que inyectar en el arranque.\n    const body = { token: this.auth.token(), method, path, payload: payload ?? {} };\n    return this.http.post<T>(this.apiUrl, body, { headers: { 'Content-Type': 'text/plain' } }).pipe(\n      // Renovación deslizante (§3.2): si el back adjuntó `meta.renewedToken`\n      // se adopta YA, con lo que la siguiente petición ya va firmada nueva.\n      tap((res) => {\n        const renewed = renewedTokenOf(res);\n        if (renewed !== null) this.auth.applyRenewedToken(renewed);\n      }),\n    );\n  }\n\n  private withKey(path: string | undefined, key?: string): string | undefined {\n    if (!path) {\n      return undefined;\n    }\n    return path.includes('{key}') ? path.replace('{key}', encodeURIComponent(key ?? '')) : path;\n  }\n}\n\n/** `{ items, nextCursor, total }` (F5/R6.4) → `T[]`; arreglo plano → tal cual; otro ⇒ []. */\nfunction unwrapList<T>(raw: unknown): T[] {\n  if (Array.isArray(raw)) {\n    return raw as T[];\n  }\n  if (raw !== null && typeof raw === 'object') {\n    const items = (raw as { items?: unknown }).items;\n    if (Array.isArray(items)) {\n      return items as T[];\n    }\n  }\n  return [];\n}\n"],"mappings":";;;;;AA4CA,IAAa,WAAb,cAA8B,MAAK;CACxB;CAEA;CAEA;CAEA;CAET,YACE,QACA,SACA,WACA,MACA,SAA8B,CAAA,GAAE;EAEhC,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,YAAY;EACjB,KAAK,OAAO;EACZ,KAAK,SAAS;CAChB;AACD;AAYD,SAAgB,eAAe,MAAa;CAC1C,IAAI,SAAS,QAAQ,OAAO,SAAS,UAAU,OAAO;CACtD,MAAM,OAAQ,KAA4B;CAC1C,IAAI,SAAS,QAAQ,OAAO,SAAS,UAAU,OAAO;CACtD,MAAM,QAAS,KAAoC;CACnD,OAAO,OAAO,UAAU,YAAY,UAAU,KAAK,QAAQ;AAC7D;AC7EA,MAAa,UAAU,IAAI,eAAuB,SAAS;ACsC3D,MAAa,aAAa;AAQ1B,MAAa,oBAAoB;AACjC,MAAa,mBAAmB;AAWhC,IAAa,cAAb,MAAa,YAAW;CACL,OAAO,OAAO,UAAU;CACxB,SAAS,OAAO,OAAO;CACvB,SAAS,OAAO,MAAM;CAYtB,UAAmB;CAEnB,QAAQ,OAA2B,MAAK,GAAA,YAAA,CAAA,EAAA,WAAA,QAAA,CAAA,+BAAA,CAAA,CAAA;CACxC,SAAS,OAAsB,MAAK,GAAA,YAAA,CAAA,EAAA,WAAA,SAAA,CAAA,+BAAA,CAAA,CAAA;CAEpC,aAAa,OAAsB,MAAK,GAAA,YAAA,CAAA,EAAA,WAAA,aAAA,CAAA,+BAAA,CAAA,CAAA;CAEhD,OAAO,KAAK,MAAM,WAAU;CAC5B,QAAQ,KAAK,OAAO,WAAU;CAC9B,YAAY,KAAK,WAAW,WAAU;CAEtC,kBAAkB,eAAe,KAAK,OAAM,MAAO,QAAQ,KAAK,MAAK,MAAO,MAAK,GAAA,YAAA,CAAA,EAAA,WAAA,kBAAA,CAAA,+BAAA,CAAA,CAAA;CACjF,OAAO,eAAe,KAAK,MAAK,CAAE,EAAE,QAAQ,IAAG,GAAA,YAAA,CAAA,EAAA,WAAA,OAAA,CAAA,+BAAA,CAAA,CAAA;CAExD,cAAA;EACE,MAAM,QAAQ,KAAK,QAAQ,QAAQ,iBAAiB;EACpD,IAAI,UAAU,QAAQ,UAAU,IAAI,KAAK,OAAO,IAAI,KAAK;EACzD,MAAM,MAAM,KAAK,QAAQ,QAAQ,gBAAgB;EACjD,IAAI,QAAQ,QAAQ,QAAQ,IAC1B,IAAI;GACF,KAAK,MAAM,IAAI,KAAK,MAAM,GAAG,CAAgB;EAC/C,QAAQ;GAEN,KAAK,QAAQ,WAAW,gBAAgB;GACxC,KAAK,QAAQ,WAAW,iBAAiB;GACzC,KAAK,OAAO,IAAI,IAAI;EACtB;CAEJ;CAIA,MAAM,OAAe,UAAgB;EACnC,OAAO,KAAK,KAAoB,eAAe;GAAE;GAAO;EAAQ,CAAE,CAAC,CAAC,KAClE,KAAK,QAAO;GACV,KAAK,KAAK,IAAI,OAAO,IAAI,IAAI;GAC7B,MAAM,UAAU,eAAe,GAAG;GAClC,IAAI,YAAY,MAAM,KAAK,kBAAkB,OAAO;GACpD,OAAO,IAAI;EACb,CAAC,CAAC;CAEN;CAQA,SAAM;EACJ,OAAO,KAAK,KAA8B,cAAc,CAAC,CAAC,KACxD,IAAI;GACF,YAAY,KAAK,MAAK;GACtB,aAAa,KAAK,MAAK;EACxB,CAAA,GACD,UAAU,MAAS,CAAC;CAExB;CAGA,YAAS;EACP,OAAO,KAAK,KACV,kBAAkB,CACnB,CAAC,KACA,UAAS;GACP,KAAK,MAAK;GACV,KAAK,QAAO;EACd,CAAC,GACD,KAAK,SAAS,EAAE,wBAAwB,IAAI,uBAAsB,EAAG,CAAC;CAE1E;CAGA,UAAO;EACL,IAAI,KAAK,OAAM,MAAO,MAAM,OAAO,GAAG,MAAS;EAC/C,OAAO,KAAK,KAAiB,UAAU,CAAC,CAAC,KACvC,KAAK,QAAO;GACV,KAAK,KAAK,KAAK,OAAM,GAAI,IAAI,IAAI;EACnC,CAAC,GAGD,iBAAiB,GAAG,MAAS,CAAC,GAC9B,UAAU,MAAS,CAAC;CAExB;CAOA,kBAAkB,OAAa;EAC7B,IAAI,UAAU,MAAM,KAAK,OAAM,MAAO,MAAM;EAC5C,KAAK,OAAO,IAAI,KAAK;EACrB,KAAK,QAAQ,QAAQ,mBAAmB,KAAK;CAC/C;CAiBA,cAAc,MAAwB;EACpC,QAAQ,MAAR;GACE,KAAK;IAGH,KAAK,WAAW,IAAI,KAAK,WAAU,CAAE;IACrC,KAAK,MAAK;IACV,KAAK,QAAO;IACZ;GACF,KAAK;GACL,KAAK;IAEH,KAAK,MAAK;IACV,KAAK,QAAO;EAUhB;CACF;CAKA,QAAQ,UAAgB;EACtB,IAAI,aAAa,MAAM,aAAa,WAAW,OAAO,KAAK,gBAAe;EAC1E,MAAM,OAAO,KAAK,KAAI;EACtB,IAAI,SAAS,SAAS,OAAO;EAC7B,OAAO,SAAS,MAAM,SAAS;CACjC;CAWA,UAAU,QAAgD;EACxD,MAAM,WAAW,QAAQ,YAAY;EACrC,IAAI,aAAa,UAAU,OAAO;EAClC,IAAI,CAAC,KAAK,gBAAe,GAAI,OAAO;EAKpC,MAAM,OAAO,SAAS,WAAW,OAAO,IAAI,SAAS,MAAM,CAAc,IAAI;EAC7E,MAAM,WAAW,SAAS,KAAM,QAAQ,SAAS,CAAA,IAAM,CAAC,IAAI;EAC5D,IAAI,SAAS,WAAW,GAAG,OAAO;EAClC,OAAO,SAAS,MAAM,QAAQ,KAAK,QAAQ,GAAG,CAAC;CACjD;CAkBA,eACE,QACA,WAA0D;EAG1D,MAAM,MAAM,OAAO,UAAU,QAAQ;EACrC,IAAI,OAAO,IAAI,YACb,OAAO,KAAK,WAAW,IAAI,UAAU;EAIvC,IAAI,OAAO,UAAU,QAAQ;GAE3B,MAAM,aADU,cAAc,YAAY,cAAc,YAAY,cAAc,WACrD,OAAO,SAAS,OAAO,QAAQ,OAAO,SAAS,OAAO;GACnF,OAAO,KAAK,WAAW,cAAc,OAAO;EAC9C;EAGA,MAAM,QAAQ,OAAO;EACrB,IAAI,OAQF,OAAO;GANL,MAAM;GACN,KAAK;GACL,QAAQ,MAAM;GACd,QAAQ,MAAM;GACd,QAAQ,MAAM;EAET,EAAQ,eAAe;EAKhC,OAAO;CACT;CAUA,aAAa,OAAkB;EAC7B,IAAI,CAAC,MAAM,UAAU,CAAC,MAAM,OAAO,MAAM,OAAO;EAChD,OAAO,KAAK,WAAW,MAAM,OAAO,IAAI;CAC1C;CAUA,cAAc,OAAkB;EAC9B,IAAI,CAAC,MAAM,UAAU,CAAC,MAAM,OAAO,OAAO,OAAO;EACjD,OAAO,KAAK,WAAW,MAAM,OAAO,KAAK;CAC3C;CAOQ,WAAW,OAAa;EAC9B,IAAI,UAAU,UAAU,OAAO;EAC/B,IAAI,UAAU,WAAW,OAAO,KAAK,gBAAe;EACpD,IAAI,MAAM,WAAW,OAAO,GAAG;GAC7B,MAAM,eAAe,MAAM,MAAM,CAAc;GAC/C,OAAO,KAAK,QAAQ,YAAY;EAClC;EAEA,OAAO,KAAK,QAAQ,OAAO;CAC7B;CAEQ,KAAK,OAAsB,MAAwB;EACzD,IAAI,UAAU,QAAQ,UAAU,IAAI,KAAK,OAAO,IAAI,KAAK;EACzD,KAAK,MAAM,IAAI,IAAI;EACnB,IAAI,UAAU,QAAQ,UAAU,IAAI,KAAK,QAAQ,QAAQ,mBAAmB,KAAK;EACjF,IAAI,SAAS,MAAM,KAAK,QAAQ,QAAQ,kBAAkB,KAAK,UAAU,IAAI,CAAC;CAChF;CAYA,mBAAgB;EACd,MAAM,MAAM,KAAK,WAAU;EAC3B,KAAK,WAAW,IAAI,IAAI;EACxB,OAAO;CACT;CAEQ,QAAK;EACX,KAAK,OAAO,IAAI,IAAI;EACpB,KAAK,MAAM,IAAI,IAAI;EACnB,KAAK,QAAQ,WAAW,iBAAiB;EACzC,KAAK,QAAQ,WAAW,gBAAgB;CAC1C;CAEQ,UAAO;EACb,IAAI,KAAK,WAAU,CAAE,CAAC,WAAA,QAAqB,GAAG;EAI9C,AAAK,KAAK,OAAO,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,MAAS;CAC/D;CAEQ,aAAU;EAChB,OAAO,KAAK,OAAO;CACrB;CAEQ,SAAS,MAAc,UAAmC,CAAA,GAAE;EAClE,OAAO;GAAE,OAAO,KAAK,OAAM;GAAI,QAAQ;GAAiB;GAAM;EAAO;CACvE;CASQ,KAAQ,MAAc,UAAmC,CAAA,GAAE;EACjE,OAAO,KAAK,KAAK,KAAQ,KAAK,QAAQ,KAAK,SAAS,MAAM,OAAO,GAAG,EAClE,SAAS,EAAE,gBAAgB,aAAY,EACxC,CAAA;CACH;CAhVW,OAAA,OAAA,GAAA,mBAAA;EAAA,YAAA;EAAA,SAAA;EAAA,UAAA;EAAA,MAAA;EAAW,MAAA,CAAA;EAAA,QAAA,GAAA,gBAAA;CAAA,CAAA;CAAX,OAAA,QAAA,GAAA,mBAAA;EAAA,YAAA;EAAA,SAAA;EAAA,UAAA;EAAA,MAAA;CAAW,CAAA;;AAAX,GAAA,yBAAA;CAAA,YAAA;CAAA,SAAA;CAAA,UAAA;CAAA,MAAA;CAAW,YAAA,CAAA,EADvB,MAAA,QAAA,CAAA;;;AC7BD,IAAa,aAAb,MAAa,WAAU;CACJ,OAAO,OAAO,UAAU;CACxB,SAAS,OAAO,OAAO;CACvB,OAAO,OAAO,WAAW;CAgB1C,KAAQ,UAA6B,SAAiC;EACpE,OAAO,KAAK,KAAc,SAAS,MAAM,OAAO,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,WAAc,GAAG,CAAC,CAAC;CAChG;CAGA,IAAO,UAA6B,KAAY;EAC9C,OAAO,KAAK,KAAQ,KAAK,QAAQ,SAAS,KAAK,GAAG,GAAG,KAAK;CAC5D;CAEA,OAAU,UAA6B,SAAgC;EACrE,OAAO,KAAK,KAAQ,SAAS,QAAQ,QAAQ,OAAO;CACtD;CAEA,OACE,UACA,KACA,SAAgC;EAEhC,OAAO,KAAK,KAAQ,KAAK,QAAQ,SAAS,QAAQ,GAAG,GAAG,OAAO,OAAO;CACxE;CAEA,OAAO,UAA6B,KAAY;EAC9C,OAAO,KAAK,KAAW,KAAK,QAAQ,SAAS,QAAQ,GAAG,GAAG,QAAQ;CACrE;CAOA,QACE,QACA,MACA,SAAiC;EAEjC,OAAO,KAAK,KAAQ,MAAM,QAAQ,OAAO;CAC3C;CAEQ,KACN,MACA,QACA,SAAiC;EAEjC,IAAI,CAAC,MACH,OAAO,iCAAiB,IAAI,MAAM,2CAA2C,CAAC;EAIhF,MAAM,OAAO;GAAE,OAAO,KAAK,KAAK,MAAK;GAAI;GAAQ;GAAM,SAAS,WAAW,CAAA;EAAE;EAC7E,OAAO,KAAK,KAAK,KAAQ,KAAK,QAAQ,MAAM,EAAE,SAAS,EAAE,gBAAgB,aAAY,EAAE,CAAE,CAAC,CAAC,KAGzF,KAAK,QAAO;GACV,MAAM,UAAU,eAAe,GAAG;GAClC,IAAI,YAAY,MAAM,KAAK,KAAK,kBAAkB,OAAO;EAC3D,CAAC,CAAC;CAEN;CAEQ,QAAQ,MAA0B,KAAY;EACpD,IAAI,CAAC,MACH;EAEF,OAAO,KAAK,SAAS,OAAO,IAAI,KAAK,QAAQ,SAAS,mBAAmB,OAAO,EAAE,CAAC,IAAI;CACzF;CAnFW,OAAA,OAAA,GAAA,mBAAA;EAAA,YAAA;EAAA,SAAA;EAAA,UAAA;EAAA,MAAA;EAAU,MAAA,CAAA;EAAA,QAAA,GAAA,gBAAA;CAAA,CAAA;CAAV,OAAA,QAAA,GAAA,mBAAA;EAAA,YAAA;EAAA,SAAA;EAAA,UAAA;EAAA,MAAA;CAAU,CAAA;;AAAV,GAAA,yBAAA;CAAA,YAAA;CAAA,SAAA;CAAA,UAAA;CAAA,MAAA;CAAU,YAAA,CAAA,EADtB,MAAA,QAAA,CAAA;;AAwFD,SAAS,WAAc,KAAY;CACjC,IAAI,MAAM,QAAQ,GAAG,GACnB,OAAO;CAET,IAAI,QAAQ,QAAQ,OAAO,QAAQ,UAAU;EAC3C,MAAM,QAAS,IAA4B;EAC3C,IAAI,MAAM,QAAQ,KAAK,GACrB,OAAO;CAEX;CACA,OAAO,CAAA;AACT"}

package/fesm2022/tinya-code-gas-admin-ui-badge-EeCA_l-o.mjs

@@ -0,0 +1,84 @@
+import * as i0 from "@angular/core";
+import { Component, computed, input } from "@angular/core";
+const KINDS = {
+	success: "bg-success text-surface",
+	danger: "bg-danger text-surface",
+	warning: "bg-accent/20 text-accent-text font-semibold",
+	info: "bg-primary text-surface",
+	neutral: "bg-neutral text-surface"
+};
+var Badge = class Badge {
+	label = input.required(...ngDevMode ? [{ debugName: "label" }] : /* istanbul ignore next */ []);
+	kind = input("neutral", ...ngDevMode ? [{ debugName: "kind" }] : /* istanbul ignore next */ []);
+	classes = computed(() => `inline-flex items-center rounded-full px-2 py-0.5 text-xs font-medium ${KINDS[this.kind()]}`, ...ngDevMode ? [{ debugName: "classes" }] : /* istanbul ignore next */ []);
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.3",
+		ngImport: i0,
+		type: Badge,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Component
+	});
+	static ɵcmp = i0.ɵɵngDeclareComponent({
+		minVersion: "17.1.0",
+		version: "22.2.3",
+		type: Badge,
+		isStandalone: true,
+		selector: "app-badge",
+		inputs: {
+			label: {
+				classPropertyName: "label",
+				publicName: "label",
+				isSignal: true,
+				isRequired: true,
+				transformFunction: null
+			},
+			kind: {
+				classPropertyName: "kind",
+				publicName: "kind",
+				isSignal: true,
+				isRequired: false,
+				transformFunction: null
+			}
+		},
+		host: { properties: { "class": "classes()" } },
+		ngImport: i0,
+		template: `{{ label() }}`,
+		isInline: true
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.3",
+	ngImport: i0,
+	type: Badge,
+	decorators: [{
+		type: Component,
+		args: [{
+			selector: "app-badge",
+			host: { "[class]": "classes()" },
+			template: `{{ label() }}`
+		}]
+	}],
+	propDecorators: {
+		label: [{
+			type: i0.Input,
+			args: [{
+				isSignal: true,
+				alias: "label",
+				required: true
+			}]
+		}],
+		kind: [{
+			type: i0.Input,
+			args: [{
+				isSignal: true,
+				alias: "kind",
+				required: false
+			}]
+		}]
+	}
+});
+export { Badge as t };
+
+//# sourceMappingURL=tinya-code-gas-admin-ui-badge-EeCA_l-o.mjs.map

package/fesm2022/tinya-code-gas-admin-ui-badge-EeCA_l-o.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"tinya-code-gas-admin-ui-badge-EeCA_l-o.mjs","names":[],"sources":["../../../projects/gas-admin-ui/src/lib/shared/components/badge/badge.ts"],"sourcesContent":["import { Component, computed, input } from '@angular/core';\n\nexport type BadgeKind = 'success' | 'danger' | 'warning' | 'info' | 'neutral';\n\nconst KINDS: Record<BadgeKind, string> = {\n  success: 'bg-success text-surface',\n  danger: 'bg-danger text-surface',\n  warning: 'bg-accent/20 text-accent-text font-semibold',\n  info: 'bg-primary text-surface',\n  neutral: 'bg-neutral text-surface',\n};\n\n/**\n * Etiqueta compacta (booleanos, estados).\n *\n * El texto va con `text-surface` y no `text-white` porque el fondo lo da\n * el token y en oscuro se aclara: blanco sobre `--color-danger` oscuro\n * sería 2,8:1. `--color-surface` vale #fff en claro, así que el render\n * actual no cambia, y en oscuro el texto se vuelve oscuro sobre el tono\n * aclarado (6,4–9,2:1).\n */\n@Component({\n  selector: 'app-badge',\n  host: { '[class]': 'classes()' },\n  template: `{{ label() }}`,\n})\nexport class Badge {\n  readonly label = input.required<string>();\n  readonly kind = input<BadgeKind>('neutral');\n\n  readonly classes = computed(\n    () =>\n      `inline-flex items-center rounded-full px-2 py-0.5 text-xs font-medium ${KINDS[this.kind()]}`,\n  );\n}\n"],"mappings":";;AAIA,MAAM,QAAmC;CACvC,SAAS;CACT,QAAQ;CACR,SAAS;CACT,MAAM;CACN,SAAS;AACV;AAgBD,IAAa,QAAb,MAAa,MAAK;CACP,QAAQ,MAAM,SAAkB,GAAA,YAAA,CAAA,EAAA,WAAA,QAAA,CAAA,+BAAA,CAAA,CAAA;CAChC,OAAO,MAAiB,WAAU,GAAA,YAAA,CAAA,EAAA,WAAA,OAAA,CAAA,+BAAA,CAAA,CAAA;CAElC,UAAU,eAEf,yEAAyE,MAAM,KAAK,KAAI,MAC3F,GAAA,YAAA,CAAA,EAAA,WAAA,UAAA,CAAA,+BAAA,CAAA,CAAA;CAPU,OAAA,OAAA,GAAA,mBAAA;EAAA,YAAA;EAAA,SAAA;EAAA,UAAA;EAAA,MAAA;EAAK,MAAA,CAAA;EAAA,QAAA,GAAA,gBAAA;CAAA,CAAA;CAAL,OAAA,OAAA,GAAA,qBAAA;EAAA,YAAA;EAAA,SAAA;EAAA,MAAA;EAAK,cAAA;EAAA,UAAA;EAAA,QAAA;GAAA,OAAA;IAAA,mBAAA;IAAA,YAAA;IAAA,UAAA;IAAA,YAAA;IAAA,mBAAA;GAAA;GAAA,MAAA;IAAA,mBAAA;IAAA,YAAA;IAAA,UAAA;IAAA,YAAA;IAAA,mBAAA;GAAA;EAAA;EAAA,MAAA,EAAA,YAAA,EAAA,SAAA,YAAA,EAAA;EAAA,UAAA;EAAA,UAFN;EAAe,UAAA;CAAA,CAAA;;AAEd,GAAA,yBAAA;CAAA,YAAA;CAAA,SAAA;CAAA,UAAA;CAAA,MAAA;CAAK,YAAA,CAAA;EALjB,MAAA;EAAU,MAAA,CAAA;GACT,UAAU;GACV,MAAM,EAAE,WAAW,YAAW;GAC9B,UAAU;EACX,CAAA"}

package/fesm2022/tinya-code-gas-admin-ui-bar-chart-G7sEMSBY.mjs

@@ -0,0 +1,140 @@
+import * as i0 from "@angular/core";
+import { Component, computed, input } from "@angular/core";
+var BarChart = class BarChart {
+	label = input.required(...ngDevMode ? [{ debugName: "label" }] : /* istanbul ignore next */ []);
+	data = input([], ...ngDevMode ? [{ debugName: "data" }] : /* istanbul ignore next */ []);
+	unit = input("", ...ngDevMode ? [{ debugName: "unit" }] : /* istanbul ignore next */ []);
+	max = computed(() => Math.max(0, ...this.data().map((row) => row.value)), ...ngDevMode ? [{ debugName: "max" }] : /* istanbul ignore next */ []);
+	height(value) {
+		if (value === 0) return 0;
+		const max = this.max();
+		if (max === 0) return 0;
+		return Math.max(2, value / max * 100);
+	}
+	summary = computed(() => {
+		const rows = this.data();
+		if (rows.length === 0) return "Sin datos.";
+		const top = rows.reduce((best, row) => row.value > best.value ? row : best, rows[0]);
+		const unit = this.unit();
+		return `${rows.length} categorías. Mayor: ${top.label} con ${top.value}${unit}. Menor: ${rows.reduce((low, row) => row.value < low.value ? row : low, rows[0]).label}.`;
+	}, ...ngDevMode ? [{ debugName: "summary" }] : /* istanbul ignore next */ []);
+	static ɵfac = i0.ɵɵngDeclareFactory({
+		minVersion: "12.0.0",
+		version: "22.2.3",
+		ngImport: i0,
+		type: BarChart,
+		deps: [],
+		target: i0.ɵɵFactoryTarget.Component
+	});
+	static ɵcmp = i0.ɵɵngDeclareComponent({
+		minVersion: "17.0.0",
+		version: "22.2.3",
+		type: BarChart,
+		isStandalone: true,
+		selector: "app-bar-chart",
+		inputs: {
+			label: {
+				classPropertyName: "label",
+				publicName: "label",
+				isSignal: true,
+				isRequired: true,
+				transformFunction: null
+			},
+			data: {
+				classPropertyName: "data",
+				publicName: "data",
+				isSignal: true,
+				isRequired: false,
+				transformFunction: null
+			},
+			unit: {
+				classPropertyName: "unit",
+				publicName: "unit",
+				isSignal: true,
+				isRequired: false,
+				transformFunction: null
+			}
+		},
+		ngImport: i0,
+		template: `
+    <div class="rounded-lg border border-neutral/20 bg-surface p-4">
+      <p class="mb-3 text-sm text-neutral">{{ label() }}</p>
+
+      @if (data().length === 0) {
+        <p class="text-sm text-neutral/60" data-testid="empty">Sin datos.</p>
+      } @else {
+        <div role="img" [attr.aria-label]="summary()" class="flex h-32 items-end gap-2">
+          @for (row of data(); track row.label) {
+            <div class="flex min-w-0 flex-1 flex-col items-center justify-end gap-1">
+              <span class="text-xs tabular-nums text-neutral"> {{ row.value }}{{ unit() }} </span>
+              <div class="w-full rounded-t bg-primary" [style.height.%]="height(row.value)"></div>
+              <span class="w-full truncate text-center text-xs text-neutral">{{ row.label }}</span>
+            </div>
+          }
+        </div>
+      }
+    </div>
+  `,
+		isInline: true
+	});
+};
+i0.ɵɵngDeclareClassMetadata({
+	minVersion: "12.0.0",
+	version: "22.2.3",
+	ngImport: i0,
+	type: BarChart,
+	decorators: [{
+		type: Component,
+		args: [{
+			selector: "app-bar-chart",
+			template: `
+    <div class="rounded-lg border border-neutral/20 bg-surface p-4">
+      <p class="mb-3 text-sm text-neutral">{{ label() }}</p>
+
+      @if (data().length === 0) {
+        <p class="text-sm text-neutral/60" data-testid="empty">Sin datos.</p>
+      } @else {
+        <div role="img" [attr.aria-label]="summary()" class="flex h-32 items-end gap-2">
+          @for (row of data(); track row.label) {
+            <div class="flex min-w-0 flex-1 flex-col items-center justify-end gap-1">
+              <span class="text-xs tabular-nums text-neutral"> {{ row.value }}{{ unit() }} </span>
+              <div class="w-full rounded-t bg-primary" [style.height.%]="height(row.value)"></div>
+              <span class="w-full truncate text-center text-xs text-neutral">{{ row.label }}</span>
+            </div>
+          }
+        </div>
+      }
+    </div>
+  `
+		}]
+	}],
+	propDecorators: {
+		label: [{
+			type: i0.Input,
+			args: [{
+				isSignal: true,
+				alias: "label",
+				required: true
+			}]
+		}],
+		data: [{
+			type: i0.Input,
+			args: [{
+				isSignal: true,
+				alias: "data",
+				required: false
+			}]
+		}],
+		unit: [{
+			type: i0.Input,
+			args: [{
+				isSignal: true,
+				alias: "unit",
+				required: false
+			}]
+		}]
+	}
+});
+export { BarChart };
+
+//# sourceMappingURL=tinya-code-gas-admin-ui-bar-chart-G7sEMSBY.mjs.map

package/fesm2022/tinya-code-gas-admin-ui-bar-chart-G7sEMSBY.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"tinya-code-gas-admin-ui-bar-chart-G7sEMSBY.mjs","names":[],"sources":["../../../projects/gas-admin-ui/src/lib/widgets/bar-chart/bar-chart.ts"],"sourcesContent":["import { Component, computed, input } from '@angular/core';\n\nexport interface BarDatum {\n  label: string;\n  value: number;\n}\n\n/**\n * Barras por categoría, sin librería: se dibujan con CSS y un `@for` de\n * Angular (~1 K gz frente a los 61,4 K de Chart.js — viabilidad B2.1).\n *\n * Accesibilidad (plan 3.2): la grilla es `role=\"img\"` con un `aria-label`\n * que resume los datos, de modo que un lector de pantalla no recorra cada\n * barra suelta sino que escuche «8 categorías. Mayor: …».\n */\n@Component({\n  selector: 'app-bar-chart',\n  template: `\n    <div class=\"rounded-lg border border-neutral/20 bg-surface p-4\">\n      <p class=\"mb-3 text-sm text-neutral\">{{ label() }}</p>\n\n      @if (data().length === 0) {\n        <p class=\"text-sm text-neutral/60\" data-testid=\"empty\">Sin datos.</p>\n      } @else {\n        <div role=\"img\" [attr.aria-label]=\"summary()\" class=\"flex h-32 items-end gap-2\">\n          @for (row of data(); track row.label) {\n            <div class=\"flex min-w-0 flex-1 flex-col items-center justify-end gap-1\">\n              <span class=\"text-xs tabular-nums text-neutral\"> {{ row.value }}{{ unit() }} </span>\n              <div class=\"w-full rounded-t bg-primary\" [style.height.%]=\"height(row.value)\"></div>\n              <span class=\"w-full truncate text-center text-xs text-neutral\">{{ row.label }}</span>\n            </div>\n          }\n        </div>\n      }\n    </div>\n  `,\n})\nexport class BarChart {\n  /** Título del gráfico. */\n  readonly label = input.required<string>();\n  /** Series a dibujar; vacío ⇒ estado «Sin datos». */\n  readonly data = input<BarDatum[]>([]);\n  /** Sufijo de las cifras del eje («unidades», «S/»). */\n  readonly unit = input('');\n\n  private readonly max = computed(() => Math.max(0, ...this.data().map((row) => row.value)));\n\n  /**\n   * Altura relativa de una barra. `max = 0` ⇒ 0 % (nada de división por\n   * cero); un valor de 0 se queda en 0, y los demás bajan a un 2 % mínimo\n   * para que la barra siga siendo visible.\n   */\n  protected height(value: number): number {\n    if (value === 0) {\n      return 0;\n    }\n    const max = this.max();\n    if (max === 0) {\n      return 0;\n    }\n    return Math.max(2, (value / max) * 100);\n  }\n\n  protected readonly summary = computed(() => {\n    const rows = this.data();\n    if (rows.length === 0) {\n      return 'Sin datos.';\n    }\n    const top = rows.reduce((best, row) => (row.value > best.value ? row : best), rows[0]);\n    const unit = this.unit();\n    return (\n      `${rows.length} categorías. Mayor: ${top.label} con ${top.value}${unit}. ` +\n      `Menor: ${rows.reduce((low, row) => (row.value < low.value ? row : low), rows[0]).label}.`\n    );\n  });\n}\n"],"mappings":";;AAqCA,IAAa,WAAb,MAAa,SAAQ;CAEV,QAAQ,MAAM,SAAkB,GAAA,YAAA,CAAA,EAAA,WAAA,QAAA,CAAA,+BAAA,CAAA,CAAA;CAEhC,OAAO,MAAkB,CAAA,GAAG,GAAA,YAAA,CAAA,EAAA,WAAA,OAAA,CAAA,+BAAA,CAAA,CAAA;CAE5B,OAAO,MAAM,IAAG,GAAA,YAAA,CAAA,EAAA,WAAA,OAAA,CAAA,+BAAA,CAAA,CAAA;CAER,MAAM,eAAe,KAAK,IAAI,GAAG,GAAG,KAAK,KAAI,CAAE,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAE,GAAA,YAAA,CAAA,EAAA,WAAA,MAAA,CAAA,+BAAA,CAAA,CAAA;CAOhF,OAAO,OAAa;EAC5B,IAAI,UAAU,GACZ,OAAO;EAET,MAAM,MAAM,KAAK,IAAG;EACpB,IAAI,QAAQ,GACV,OAAO;EAET,OAAO,KAAK,IAAI,GAAI,QAAQ,MAAO,GAAG;CACxC;CAEmB,UAAU,eAAc;EACzC,MAAM,OAAO,KAAK,KAAI;EACtB,IAAI,KAAK,WAAW,GAClB,OAAO;EAET,MAAM,MAAM,KAAK,QAAQ,MAAM,QAAS,IAAI,QAAQ,KAAK,QAAQ,MAAM,MAAO,KAAK,EAAE;EACrF,MAAM,OAAO,KAAK,KAAI;EACtB,OACE,GAAG,KAAK,OAAM,sBAAuB,IAAI,MAAK,OAAQ,IAAI,QAAQ,KAAI,WAC5D,KAAK,QAAQ,KAAK,QAAS,IAAI,QAAQ,IAAI,QAAQ,MAAM,KAAM,KAAK,EAAE,CAAC,CAAC,MAAK;CAE3F,GAAE,GAAA,YAAA,CAAA,EAAA,WAAA,UAAA,CAAA,+BAAA,CAAA,CAAA;CArCS,OAAA,OAAA,GAAA,mBAAA;EAAA,YAAA;EAAA,SAAA;EAAA,UAAA;EAAA,MAAA;EAAQ,MAAA,CAAA;EAAA,QAAA,GAAA,gBAAA;CAAA,CAAA;CAAR,OAAA,OAAA,GAAA,qBAAA;EAAA,YAAA;EAAA,SAAA;EAAA,MAAA;EAAQ,cAAA;EAAA,UAAA;EAAA,QAAA;GAAA,OAAA;IAAA,mBAAA;IAAA,YAAA;IAAA,UAAA;IAAA,YAAA;IAAA,mBAAA;GAAA;GAAA,MAAA;IAAA,mBAAA;IAAA,YAAA;IAAA,UAAA;IAAA,YAAA;IAAA,mBAAA;GAAA;GAAA,MAAA;IAAA,mBAAA;IAAA,YAAA;IAAA,UAAA;IAAA,YAAA;IAAA,mBAAA;GAAA;EAAA;EAAA,UAAA;EAAA,UApBT;;;;;;;;;;;;;;;;;;;EAkBT,UAAA;CAAA,CAAA;;AAEU,GAAA,yBAAA;CAAA,YAAA;CAAA,SAAA;CAAA,UAAA;CAAA,MAAA;CAAQ,YAAA,CAAA;EAtBpB,MAAA;EAAU,MAAA,CAAA;GACT,UAAU;GACV,UAAU;;;;;;;;;;;;;;;;;;;EAmBX,CAAA"}