@albertomarturelo/sii-core 0.10.0 → 0.11.0

package/dist/auth/auth.js

@@ -1,10 +1,12 @@
 import { HOSTS, KEYRING_SERVICE, LOGIN_HOST, LOGOUT_URL, WWW2_APP_CARPETA, WWW2_SESSION_CLOSE_URL, } from '../config/index.js';
-import { CredentialNotFoundError, LoginFailedError, NotAuthenticatedError, } from '../errors/index.js';
+import { CredentialNotFoundError, LoginBlockedError, LoginFailedError, NotAuthenticatedError, ValidationError, } from '../errors/index.js';
 import { Rut } from '../rut/index.js';
 import { recordAudit } from '../audit/index.js';
 import { clearOperateState, initOperateState } from '../identity/index.js';
 import { fetchEmpresasAutorizadas } from '../portal/representacion.js';
-import { deleteSession, readSession, withSession, writeSession } from './session.js';
+import { deleteSession, readSession, requireBrowser, withSession, writeSession, } from './session.js';
+import { parseDatosCntrNow } from './datos-cntr.js';
+import { clearLoginBlock, listLoginBlocks, readLoginBlock, reasonForCodigo, siiJudgedClave, tripLoginBlock, } from './login-block.js';
 import { mergeStorageState, waitForWww2Session, www2ExpiresAt } from './www2-login.js';
 import { readWww2Session } from '../portal/www2-session.js';
 import { Www2SessionError } from '../errors/index.js';
@@ -12,8 +14,15 @@ const DEFAULT_LOGIN_TIMEOUT_MS = 180_000;
 // Console login submits machine-fast (no human typing in the browser) and fails
 // fast on a rejected Clave, so it needs a far smaller budget than the headed flow.
 const CONSOLE_LOGIN_TIMEOUT_MS = 60_000;
-// The Mi-SII landing serves this inline JS object with the contribuyente snapshot.
-const DATOS_EXPR = "typeof DatosCntrNow !== 'undefined' ? DatosCntrNow : null";
+/** Read the Mi SII identity. The landing serves `DatosCntrNow` as an inline JS literal, so we
+ *  fetch the HTML and parse it (ADR-027) — engine-agnostic (works over the HTTP driver and the
+ *  browser one), replacing the old `session.evaluate`. `null` ⇒ not present (dead session). */
+async function readDatos(session) {
+    const { body } = await session.requestText(HOSTS.miSii, { method: 'GET' });
+    return parseDatosCntrNow(body);
+}
+/** A human typed the Clave: a fresh login from one of these lifts the rejection latch. */
+const INTERACTIVE_SOURCES = ['browser', 'console'];
 const NO_WWW2 = { authenticated: false, expiresAt: null };
 function www2StatusOf(session, now) {
     const layer = session?.www2;
@@ -26,14 +35,16 @@ function www2StatusOf(session, now) {
  *  stored www2 layer is still within its cookie's own expiry. */
 export async function localStatus(store, now) {
     const session = await readSession(store);
+    const loginBlocked = await listLoginBlocks(store);
     return session
         ? {
             authenticated: true,
             rut: session.rut,
             sessionSource: 'cached',
             www2: www2StatusOf(session, now),
+            loginBlocked,
         }
-        : { authenticated: false, rut: null, sessionSource: 'none', www2: NO_WWW2 };
+        : { authenticated: false, rut: null, sessionSource: 'none', www2: NO_WWW2, loginBlocked };
 }
 function identityFromDatos(datos) {
     const c = datos?.contribuyente;
@@ -69,12 +80,13 @@ async function liveSessionResult(runtime) {
     return rut ? { authenticated: true, rut, reason: 'already_authenticated' } : null;
 }
 /** The receipt for a login that ENDED as "already authenticated". */
-function auditAlreadyAuthenticated(runtime, warm) {
+function auditAlreadyAuthenticated(runtime, warm, source) {
     recordAudit(runtime, {
         action: 'auth_login',
         result: 'ok',
         rut: warm.rut,
         reason: warm.reason,
+        source,
     });
 }
 /** Best-effort operable-set fetch on login (ADR-005). Persona accounts ask SII for
@@ -117,12 +129,13 @@ async function resolveOperable(runtime, session, identity) {
 /** Turn a freshly-minted PortalSession into a persisted cookies-only session:
  *  confirm we landed off the login host, read identity, persist cookies (NO
  *  secret), default operate to self. Shared by the browser + console paths. */
-async function finalizeFreshSession(runtime, session, reason, start) {
+async function finalizeFreshSession(runtime, session, source, start) {
+    const reason = `${source}_login`;
     const landed = await session.goto(HOSTS.miSii);
     if (landedOnLoginHost(landed)) {
         throw new LoginFailedError('Login no completado (seguimos en la página de autenticación).');
     }
-    const datos = await session.evaluate(DATOS_EXPR);
+    const datos = await readDatos(session);
     const identity = identityFromDatos(datos);
     const cookies = await session.storageState();
     await writeSession(runtime.store, {
@@ -137,11 +150,15 @@ async function finalizeFreshSession(runtime, session, reason, start) {
         accountType: identity.accountType,
         operable,
     });
+    // A human just proved a working Clave, which is the reset ADR-028 names for the latch.
+    if (INTERACTIVE_SOURCES.includes(source))
+        await clearLoginBlock(runtime.store, identity.rut);
     recordAudit(runtime, {
         action: 'auth_login',
         result: 'ok',
         rut: identity.rut,
         reason,
+        source,
         durationMs: runtime.clock.now().getTime() - start,
     });
     return { authenticated: true, rut: identity.rut, reason };
@@ -199,7 +216,7 @@ export async function login(runtime, options = {}) {
     const start = runtime.clock.now().getTime();
     const warm = await liveSessionResult(runtime);
     if (warm && (!options.www2 || (await liveWww2(runtime)))) {
-        auditAlreadyAuthenticated(runtime, warm);
+        auditAlreadyAuthenticated(runtime, warm, 'browser');
         if (!options.www2)
             return warm;
         const stored = await readSession(runtime.store);
@@ -207,17 +224,24 @@ export async function login(runtime, options = {}) {
     }
     let session = null;
     try {
-        session = await runtime.portal.interactiveLogin({
+        // The headed login is the browser engine's job (ADR-027): the CLI's default is the HTTP
+        // console login, so only the MCP (which wires the browser) reaches this.
+        session = await requireBrowser(runtime).interactiveLogin({
             destination: HOSTS.miSii,
             timeoutMs: DEFAULT_LOGIN_TIMEOUT_MS,
         });
-        const result = await finalizeFreshSession(runtime, session, 'browser_login', start);
+        const result = await finalizeFreshSession(runtime, session, 'browser', start);
         if (!options.www2)
             return result;
         return { ...result, www2: await mintWww2Layer(runtime, session) };
     }
     catch (err) {
-        recordAudit(runtime, { action: 'auth_login', result: 'failed', reason: 'browser_login' });
+        recordAudit(runtime, {
+            action: 'auth_login',
+            result: 'failed',
+            reason: 'browser_login',
+            source: 'browser',
+        });
         throw err;
     }
     finally {
@@ -229,34 +253,78 @@ export async function login(runtime, options = {}) {
  *  stored, exactly like the browser path. ONE attempt, never retried (ADR-004).
  *  The Clave never reaches MCP (this task is CLI-only) nor the audit log. */
 export async function consoleLogin(runtime, credentials) {
-    return credentialLoginFlow(runtime, () => Promise.resolve(credentials), 'console_login');
+    return credentialLoginFlow(runtime, Rut.parse(credentials.rut), () => Promise.resolve(credentials.clave), 'console');
 }
-/** The headless fill-and-submit shared by the console (ADR-010) and keyring (ADR-025)
- *  paths — they differ ONLY in where the Clave came from, so the attempt policy lives
- *  in one place: ONE attempt, never retried (ADR-004), Clave discarded with the frame.
- *  The credentials arrive as a THUNK so the Clave is fetched only once the live-session
- *  probe has missed: an already-authenticated user must not trigger a keyring-unlock
- *  prompt for a value nobody will use (review of #101). */
-async function credentialLoginFlow(runtime, getCredentials, reason) {
-    const start = runtime.clock.now().getTime();
+/** CLI-only non-interactive login (ADR-028): the SURFACE read the Clave from an environment
+ *  variable it was told to read (`--clave-env <VAR>`) or from piped stdin (`--clave-stdin`),
+ *  and `source` records which. Everything else matches `consoleLogin`, plus the rejection
+ *  latch: no one is at the keyboard to notice a stale Clave, so a latched RUT is refused
+ *  without contacting SII. */
+export async function suppliedClaveLogin(runtime, args) {
+    return credentialLoginFlow(runtime, Rut.parse(args.rut), () => Promise.resolve(args.clave), args.source);
+}
+/** The live session's principal if it is `rut`; `null` if there is no live session. A live
+ *  session for ANOTHER RUT is an error: answering "already authenticated" would hand the
+ *  caller the wrong account, and switching stays an explicit logout→login (ADR-005). */
+async function liveSessionFor(runtime, rut) {
     const warm = await liveSessionResult(runtime);
+    if (warm && Rut.parse(warm.rut).canonical !== rut.canonical) {
+        throw new ValidationError(`Hay una sesión activa como ${warm.rut}, no como ${rut.canonical}. Para cambiar de ` +
+            'cuenta: `sii auth logout` y luego `sii auth login`.');
+    }
+    return warm;
+}
+/** The headless fill-and-submit shared by every Clave source (ADR-010 / ADR-025 / ADR-028) —
+ *  they differ ONLY in where the Clave came from, so the attempt policy lives in one place:
+ *  ONE attempt, never retried (ADR-004), Clave discarded with the frame.
+ *  The Clave arrives as a THUNK so it is fetched only once the live-session probe has missed:
+ *  an already-authenticated user must not trigger a keyring-unlock prompt for a value nobody
+ *  will use (review of #101). The probe runs BEFORE the latch on purpose: a cron whose session
+ *  is still alive keeps working while latched, since nothing is submitted. */
+async function credentialLoginFlow(runtime, rut, getClave, source) {
+    const start = runtime.clock.now().getTime();
+    const warm = await liveSessionFor(runtime, rut);
     if (warm) {
-        auditAlreadyAuthenticated(runtime, warm);
+        auditAlreadyAuthenticated(runtime, warm, source);
         return warm;
     }
-    const credentials = await getCredentials();
+    if (!INTERACTIVE_SOURCES.includes(source)) {
+        const block = await readLoginBlock(runtime.store, rut.canonical);
+        if (block) {
+            recordAudit(runtime, {
+                action: 'auth_login',
+                result: 'blocked',
+                rut: rut.canonical,
+                source,
+            });
+            throw new LoginBlockedError(`Login desatendido bloqueado para ${rut.canonical}: el SII rechazó la Clave el ` +
+                `${block.at}${block.codigo ? ` (código ${block.codigo})` : ''}. No se contactó al ` +
+                'SII. Corrige la Clave y ejecuta `sii auth login --console` (o `sii auth unblock`).', { reason: reasonForCodigo(block.codigo), codigo: block.codigo });
+        }
+    }
+    const clave = await getClave();
     let session = null;
     try {
         session = await runtime.portal.credentialLogin({
-            rut: credentials.rut,
-            clave: credentials.clave,
+            rut: rut.canonical,
+            clave,
             destination: HOSTS.miSii,
             timeoutMs: CONSOLE_LOGIN_TIMEOUT_MS,
         });
-        return await finalizeFreshSession(runtime, session, reason, start);
+        return await finalizeFreshSession(runtime, session, source, start);
     }
     catch (err) {
-        recordAudit(runtime, { action: 'auth_login', result: 'failed', reason });
+        // SII's verbatim rejection is what the user must see (ADR-004), so a failing latch write
+        // must not replace it with a disk error.
+        if (siiJudgedClave(err)) {
+            await tripLoginBlock(runtime, rut.canonical, err.codigo).catch(() => undefined);
+        }
+        recordAudit(runtime, {
+            action: 'auth_login',
+            result: 'failed',
+            reason: `${source}_login`,
+            source,
+        });
         throw err;
     }
     finally {
@@ -282,18 +350,26 @@ export async function keyringLogin(runtime, args) {
     if (!secrets) {
         throw new CredentialNotFoundError('Este runtime no tiene acceso al llavero (SecretStore). Usa `sii auth login --console`.');
     }
-    return credentialLoginFlow(runtime, async () => {
+    return credentialLoginFlow(runtime, rut, async () => {
         const accounts = keyringAccounts(rut);
         for (const account of accounts) {
             const clave = await secrets.get(account);
             if (clave)
-                return { rut: rut.canonical, clave };
+                return clave;
         }
         throw new CredentialNotFoundError(`No hay Clave en el llavero para ${rut.canonical} (servicio "${KEYRING_SERVICE}"). ` +
             `Guárdala con:\n` +
             `  Linux:  secret-tool store --label='SII' service ${KEYRING_SERVICE} username ${rut.canonical}\n` +
             `  macOS:  security add-generic-password -s ${KEYRING_SERVICE} -a ${rut.canonical} -w`);
-    }, 'keyring_login');
+    }, 'keyring');
+}
+/** Lift the rejection latch (ADR-028) for one RUT, or for all when none is given. A local
+ *  wipe: nothing is sent to SII. Returns the RUTs that were latched. */
+export async function unblockLogin(runtime, args = {}) {
+    const rut = args.rut === undefined ? undefined : Rut.parse(args.rut).canonical;
+    const lifted = await clearLoginBlock(runtime.store, rut);
+    recordAudit(runtime, { action: 'auth_unblock', result: 'ok', count: lifted.length });
+    return lifted;
 }
 /** Server-side close (best-effort) + wipe local session + operate context. */
 export async function logout(runtime) {
@@ -347,7 +423,7 @@ export async function statusRefresh(runtime) {
         if (landedOnLoginHost(await s.goto(HOSTS.miSii))) {
             throw new NotAuthenticatedError('La sesión expiró. Ejecuta `sii auth login`.');
         }
-        const identity = identityFromDatos(await s.evaluate(DATOS_EXPR));
+        const identity = identityFromDatos(await readDatos(s));
         // The www2 layer, read live: a missing one is a plain `false` here, not an error — the
         // classic identity is the job; the layer is reported (ADR-026).
         let www2 = NO_WWW2;
@@ -374,7 +450,7 @@ export async function whoami(runtime) {
         if (landedOnLoginHost(await s.goto(HOSTS.miSii))) {
             throw new NotAuthenticatedError('La sesión expiró. Ejecuta `sii auth login`.');
         }
-        const datos = await s.evaluate(DATOS_EXPR);
+        const datos = await readDatos(s);
         const identity = identityFromDatos(datos);
         const email = (datos?.contribuyente?.eMail ?? '').trim() || null;
         recordAudit(runtime, { action: 'whoami', result: 'ok', rut: identity.rut });

package/dist/auth/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,eAAe,EACf,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAGvE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAErF,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,MAAM,wBAAwB,GAAG,OAAO,CAAC;AACzC,gFAAgF;AAChF,mFAAmF;AACnF,MAAM,wBAAwB,GAAG,MAAM,CAAC;AACxC,mFAAmF;AACnF,MAAM,UAAU,GAAG,2DAA2D,CAAC;AAmE/E,MAAM,OAAO,GAAmB,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAE1E,SAAS,YAAY,CAAC,OAA6B,EAAE,GAAS;IAC5D,MAAM,KAAK,GAAG,OAAO,EAAE,IAAI,CAAC;IAC5B,IAAI,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC;IAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAC9F,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;AAC9D,CAAC;AAED;iEACiE;AACjE,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAuB,EAAE,GAAS;IAClE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,OAAO;QACZ,CAAC,CAAC;YACE,aAAa,EAAE,IAAI;YACnB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,aAAa,EAAE,QAAQ;YACvB,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC;SACjC;QACH,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAChF,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAuB;IAChD,MAAM,CAAC,GAAG,KAAK,EAAE,aAAa,CAAC;IAC/B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;QACpD,MAAM,IAAI,gBAAgB,CAAC,iEAAiE,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC;IACpD,MAAM,WAAW,GAAgB,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAClG,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;IACjD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC;AACjD,CAAC;AAED;;0FAE0F;AAC1F,KAAK,UAAU,cAAc,CAAC,OAAgB;IAC5C,IAAI,CAAC;QACH,OAAO,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,CACjD,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CACrE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;sFAGsF;AACtF,KAAK,UAAU,iBAAiB,CAAC,OAAgB;IAC/C,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpF,CAAC;AAED,qEAAqE;AACrE,SAAS,yBAAyB,CAAC,OAAgB,EAAE,IAAqB;IACxE,WAAW,CAAC,OAAO,EAAE;QACnB,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,IAAI;QACZ,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CAAC;AACL,CAAC;AAED;;;;gCAIgC;AAChC,KAAK,UAAU,eAAe,CAC5B,OAAgB,EAChB,OAAsB,EACtB,QAAsB;IAEtB,MAAM,IAAI,GAAkB;QAC1B,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,WAAW,EAAE,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,GAAG;QAC5C,MAAM,EAAE,IAAI;KACb,CAAC;IACF,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC3E,MAAM,OAAO,GAAoB,QAAQ;aACtC,MAAM,CAAC,CAAC,CAAC,EAA4C,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC;aACvE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG;YACnC,MAAM,EAAE,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG;SAC/B,CAAC,CAAC,CAAC;QACN,gFAAgF;QAChF,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,CAAC;QAC9E,WAAW,CAAC,OAAO,EAAE;YACnB,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,IAAI;YACZ,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,KAAK,EAAE,QAAQ,CAAC,MAAM;SACvB,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QACxF,OAAO,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;+EAE+E;AAC/E,KAAK,UAAU,oBAAoB,CACjC,OAAgB,EAChB,OAAsB,EACtB,MAA2D,EAC3D,KAAa;IAEb,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,gBAAgB,CAAC,+DAA+D,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAmB,UAAU,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;IAC7C,MAAM,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE;QAChC,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,OAAO;QACP,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;KAC3C,CAAC,CAAC;IAEH,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACnE,MAAM,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE;QACpC,OAAO,EAAE,QAAQ,CAAC,GAAG;QACrB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,QAAQ;KACT,CAAC,CAAC;IAEH,WAAW,CAAC,OAAO,EAAE;QACnB,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,IAAI;QACZ,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,MAAM;QACN,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK;KAClD,CAAC,CAAC;IACH,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC;AAC5D,CAAC;AAQD;iEACiE;AACjE,KAAK,UAAU,QAAQ,CAAC,OAAgB;IACtC,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;kDAGkD;AAClD,KAAK,UAAU,aAAa,CAAC,OAAgB,EAAE,OAAsB;IACnE,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,qBAAqB,CAAC,0CAA0C,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;QAChD,MAAM,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAClD,MAAM,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE;YAChC,GAAG,MAAM;YACT,OAAO,EAAE,iBAAiB,CAAC,UAAU,EAAE,OAAO,CAAC;YAC/C,IAAI,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE;SAC7B,CAAC,CAAC;QACH,WAAW,CAAC,OAAO,EAAE;YACnB,MAAM,EAAE,iBAAiB;YACzB,MAAM,EAAE,IAAI;YACZ,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK;SAClD,CAAC,CAAC;QACH,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACvF,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;sFAIsF;AACtF,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,OAAgB,EAChB,UAAwB,EAAE;IAE1B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChD,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;IACtE,CAAC;IAED,IAAI,OAAO,GAAyB,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC;YAC9C,WAAW,EAAE,KAAK,CAAC,KAAK;YACxB,SAAS,EAAE,wBAAwB;SACpC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC;QACpF,IAAI,CAAC,OAAO,CAAC,IAAI;YAAE,OAAO,MAAM,CAAC;QACjC,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;IACpE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QAC1F,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED;;;6EAG6E;AAC7E,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAgB,EAChB,WAA2C;IAE3C,OAAO,mBAAmB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;2DAK2D;AAC3D,KAAK,UAAU,mBAAmB,CAChC,OAAgB,EAChB,cAA6D,EAC7D,MAAyC;IAEzC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,IAAI,EAAE,CAAC;QACT,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,cAAc,EAAE,CAAC;IAC3C,IAAI,OAAO,GAAyB,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC;YAC7C,GAAG,EAAE,WAAW,CAAC,GAAG;YACpB,KAAK,EAAE,WAAW,CAAC,KAAK;YACxB,WAAW,EAAE,KAAK,CAAC,KAAK;YACxB,SAAS,EAAE,wBAAwB;SACpC,CAAC,CAAC;QACH,OAAO,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACzE,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED;;;wDAGwD;AACxD,MAAM,UAAU,eAAe,CAAC,GAAQ;IACtC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;uFAGuF;AACvF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAgB,EAChB,IAAqB;IAErB,sFAAsF;IACtF,4DAA4D;IAC5D,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,uBAAuB,CAC/B,wFAAwF,CACzF,CAAC;IACJ,CAAC;IACD,OAAO,mBAAmB,CACxB,OAAO,EACP,KAAK,IAAI,EAAE;QACT,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACtC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,KAAK;gBAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;QAClD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,mCAAmC,GAAG,CAAC,SAAS,eAAe,eAAe,MAAM;YAClF,iBAAiB;YACjB,qDAAqD,eAAe,aAAa,GAAG,CAAC,SAAS,IAAI;YAClG,8CAA8C,eAAe,OAAO,GAAG,CAAC,SAAS,KAAK,CACzF,CAAC;IACJ,CAAC,EACD,eAAe,CAChB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAgB;IAC3C,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACtE,CAAC;IAED,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,CAAC,GAAyB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,uFAAuF;YACvF,gEAAgE;YAChE,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,GAAG,sBAAsB,gBAAgB,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC5F,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACjC,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,IAAI,GAAG,CAAC,sBAAsB,CAAC,CAAC,QAAQ,CAAC;YACrF,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxC,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,MAAM,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACvC,WAAW,CAAC,OAAO,EAAE;QACnB,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,IAAI;QACZ,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,YAAY;QACZ,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC,CAAC;IACH,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;AACvD,CAAC;AAED;;mFAEmF;AACnF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAgB;IAClD,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,qBAAqB,CAAC,6CAA6C,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAmB,UAAU,CAAC,CAAC,CAAC;QACnF,uFAAuF;QACvF,gEAAgE;QAChE,IAAI,IAAI,GAAmB,OAAO,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAChD,IAAI,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,IAAI,IAAI,EAAE,CAAC;QAC7E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,CAAC,CAAC,YAAY,gBAAgB,CAAC;gBAAE,MAAM,CAAC,CAAC;QAChD,CAAC;QACD,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QACzF,OAAO,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;uFAIuF;AACvF,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAgB;IAC3C,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,qBAAqB,CAAC,6CAA6C,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAmB,UAAU,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;QACjE,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5E,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;IAClG,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,eAAe,EACf,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAGvE,OAAO,EACL,aAAa,EACb,WAAW,EACX,cAAc,EACd,WAAW,EACX,YAAY,GACb,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAGpD,OAAO,EACL,eAAe,EACf,eAAe,EACf,cAAc,EACd,eAAe,EACf,cAAc,EACd,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,MAAM,wBAAwB,GAAG,OAAO,CAAC;AACzC,gFAAgF;AAChF,mFAAmF;AACnF,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAExC;;+FAE+F;AAC/F,KAAK,UAAU,SAAS,CAAC,OAAsB;IAC7C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3E,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAiDD,0FAA0F;AAC1F,MAAM,mBAAmB,GAA2B,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AAiB3E,MAAM,OAAO,GAAmB,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAE1E,SAAS,YAAY,CAAC,OAA6B,EAAE,GAAS;IAC5D,MAAM,KAAK,GAAG,OAAO,EAAE,IAAI,CAAC;IAC5B,IAAI,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC;IAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAC9F,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;AAC9D,CAAC;AAED;iEACiE;AACjE,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAuB,EAAE,GAAS;IAClE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;IAClD,OAAO,OAAO;QACZ,CAAC,CAAC;YACE,aAAa,EAAE,IAAI;YACnB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,aAAa,EAAE,QAAQ;YACvB,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC;YAChC,YAAY;SACb;QACH,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;AAC9F,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAuB;IAChD,MAAM,CAAC,GAAG,KAAK,EAAE,aAAa,CAAC;IAC/B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;QACpD,MAAM,IAAI,gBAAgB,CAAC,iEAAiE,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC;IACpD,MAAM,WAAW,GAAgB,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAClG,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;IACjD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC;AACjD,CAAC;AAED;;0FAE0F;AAC1F,KAAK,UAAU,cAAc,CAAC,OAAgB;IAC5C,IAAI,CAAC;QACH,OAAO,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,CACjD,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CACrE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;sFAGsF;AACtF,KAAK,UAAU,iBAAiB,CAAC,OAAgB;IAC/C,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpF,CAAC;AAED,qEAAqE;AACrE,SAAS,yBAAyB,CAChC,OAAgB,EAChB,IAAqB,EACrB,MAAmB;IAEnB,WAAW,CAAC,OAAO,EAAE;QACnB,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,IAAI;QACZ,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAED;;;;gCAIgC;AAChC,KAAK,UAAU,eAAe,CAC5B,OAAgB,EAChB,OAAsB,EACtB,QAAsB;IAEtB,MAAM,IAAI,GAAkB;QAC1B,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,WAAW,EAAE,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,GAAG;QAC5C,MAAM,EAAE,IAAI;KACb,CAAC;IACF,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC3E,MAAM,OAAO,GAAoB,QAAQ;aACtC,MAAM,CAAC,CAAC,CAAC,EAA4C,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC;aACvE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG;YACnC,MAAM,EAAE,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG;SAC/B,CAAC,CAAC,CAAC;QACN,gFAAgF;QAChF,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,CAAC;QAC9E,WAAW,CAAC,OAAO,EAAE;YACnB,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,IAAI;YACZ,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,KAAK,EAAE,QAAQ,CAAC,MAAM;SACvB,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QACxF,OAAO,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;+EAE+E;AAC/E,KAAK,UAAU,oBAAoB,CACjC,OAAgB,EAChB,OAAsB,EACtB,MAAmB,EACnB,KAAa;IAEb,MAAM,MAAM,GAAqB,GAAG,MAAM,QAAQ,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,gBAAgB,CAAC,+DAA+D,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;IAC7C,MAAM,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE;QAChC,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,OAAO;QACP,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;KAC3C,CAAC,CAAC;IAEH,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACnE,MAAM,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE;QACpC,OAAO,EAAE,QAAQ,CAAC,GAAG;QACrB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,QAAQ;KACT,CAAC,CAAC;IAEH,uFAAuF;IACvF,IAAI,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,MAAM,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;IAE7F,WAAW,CAAC,OAAO,EAAE;QACnB,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,IAAI;QACZ,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,MAAM;QACN,MAAM;QACN,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK;KAClD,CAAC,CAAC;IACH,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC;AAC5D,CAAC;AAQD;iEACiE;AACjE,KAAK,UAAU,QAAQ,CAAC,OAAgB;IACtC,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;kDAGkD;AAClD,KAAK,UAAU,aAAa,CAAC,OAAgB,EAAE,OAAsB;IACnE,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,qBAAqB,CAAC,0CAA0C,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;QAChD,MAAM,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAClD,MAAM,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE;YAChC,GAAG,MAAM;YACT,OAAO,EAAE,iBAAiB,CAAC,UAAU,EAAE,OAAO,CAAC;YAC/C,IAAI,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE;SAC7B,CAAC,CAAC;QACH,WAAW,CAAC,OAAO,EAAE;YACnB,MAAM,EAAE,iBAAiB;YACzB,MAAM,EAAE,IAAI;YACZ,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK;SAClD,CAAC,CAAC;QACH,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACvF,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;sFAIsF;AACtF,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,OAAgB,EAChB,UAAwB,EAAE;IAE1B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,yBAAyB,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChD,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;IACtE,CAAC;IAED,IAAI,OAAO,GAAyB,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,wFAAwF;QACxF,yEAAyE;QACzE,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC,gBAAgB,CAAC;YACvD,WAAW,EAAE,KAAK,CAAC,KAAK;YACxB,SAAS,EAAE,wBAAwB;SACpC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAC9E,IAAI,CAAC,OAAO,CAAC,IAAI;YAAE,OAAO,MAAM,CAAC;QACjC,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;IACpE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,OAAO,EAAE;YACnB,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,eAAe;YACvB,MAAM,EAAE,SAAS;SAClB,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED;;;6EAG6E;AAC7E,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAgB,EAChB,WAA2C;IAE3C,OAAO,mBAAmB,CACxB,OAAO,EACP,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,EAC1B,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,EACxC,SAAS,CACV,CAAC;AACJ,CAAC;AAED;;;;8BAI8B;AAC9B,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAgB,EAChB,IAA6D;IAE7D,OAAO,mBAAmB,CACxB,OAAO,EACP,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EACnB,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EACjC,IAAI,CAAC,MAAM,CACZ,CAAC;AACJ,CAAC;AAED;;wFAEwF;AACxF,KAAK,UAAU,cAAc,CAAC,OAAgB,EAAE,GAAQ;IACtD,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,EAAE,CAAC;QAC5D,MAAM,IAAI,eAAe,CACvB,8BAA8B,IAAI,CAAC,GAAG,aAAa,GAAG,CAAC,SAAS,oBAAoB;YAClF,qDAAqD,CACxD,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;8EAM8E;AAC9E,KAAK,UAAU,mBAAmB,CAChC,OAAgB,EAChB,GAAQ,EACR,QAA+B,EAC/B,MAAuC;IAEvC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAChD,IAAI,IAAI,EAAE,CAAC;QACT,yBAAyB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QACjE,IAAI,KAAK,EAAE,CAAC;YACV,WAAW,CAAC,OAAO,EAAE;gBACnB,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,SAAS;gBACjB,GAAG,EAAE,GAAG,CAAC,SAAS;gBAClB,MAAM;aACP,CAAC,CAAC;YACH,MAAM,IAAI,iBAAiB,CACzB,oCAAoC,GAAG,CAAC,SAAS,+BAA+B;gBAC9E,GAAG,KAAK,CAAC,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,sBAAsB;gBACnF,oFAAoF,EACtF,EAAE,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAChE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;IAC/B,IAAI,OAAO,GAAyB,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC;YAC7C,GAAG,EAAE,GAAG,CAAC,SAAS;YAClB,KAAK;YACL,WAAW,EAAE,KAAK,CAAC,KAAK;YACxB,SAAS,EAAE,wBAAwB;SACpC,CAAC,CAAC;QACH,OAAO,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,yFAAyF;QACzF,yCAAyC;QACzC,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAClF,CAAC;QACD,WAAW,CAAC,OAAO,EAAE;YACnB,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,GAAG,MAAM,QAAQ;YACzB,MAAM;SACP,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED;;;wDAGwD;AACxD,MAAM,UAAU,eAAe,CAAC,GAAQ;IACtC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;uFAGuF;AACvF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAgB,EAChB,IAAqB;IAErB,sFAAsF;IACtF,4DAA4D;IAC5D,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,uBAAuB,CAC/B,wFAAwF,CACzF,CAAC;IACJ,CAAC;IACD,OAAO,mBAAmB,CACxB,OAAO,EACP,GAAG,EACH,KAAK,IAAI,EAAE;QACT,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACtC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,mCAAmC,GAAG,CAAC,SAAS,eAAe,eAAe,MAAM;YAClF,iBAAiB;YACjB,qDAAqD,eAAe,aAAa,GAAG,CAAC,SAAS,IAAI;YAClG,8CAA8C,eAAe,OAAO,GAAG,CAAC,SAAS,KAAK,CACzF,CAAC;IACJ,CAAC,EACD,SAAS,CACV,CAAC;AACJ,CAAC;AAED;wEACwE;AACxE,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAgB,EAChB,OAAyB,EAAE;IAE3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC;IAC/E,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACzD,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACrF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAgB;IAC3C,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACtE,CAAC;IAED,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,CAAC,GAAyB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,uFAAuF;YACvF,gEAAgE;YAChE,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,GAAG,sBAAsB,gBAAgB,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC5F,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACjC,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,IAAI,GAAG,CAAC,sBAAsB,CAAC,CAAC,QAAQ,CAAC;YACrF,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxC,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,MAAM,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACvC,WAAW,CAAC,OAAO,EAAE;QACnB,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,IAAI;QACZ,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,YAAY;QACZ,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC,CAAC;IACH,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;AACvD,CAAC;AAED;;mFAEmF;AACnF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAgB;IAClD,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,qBAAqB,CAAC,6CAA6C,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,uFAAuF;QACvF,gEAAgE;QAChE,IAAI,IAAI,GAAmB,OAAO,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAChD,IAAI,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,IAAI,IAAI,EAAE,CAAC;QAC7E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,CAAC,CAAC,YAAY,gBAAgB,CAAC;gBAAE,MAAM,CAAC,CAAC;QAChD,CAAC;QACD,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QACzF,OAAO,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;uFAIuF;AACvF,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAgB;IAC3C,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,qBAAqB,CAAC,6CAA6C,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;QACjE,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5E,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;IAClG,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/datos-cntr.d.ts

@@ -0,0 +1,23 @@
+import { z } from 'zod';
+/** The curated subset of `DatosCntrNow.contribuyente` the auth flows read (identity + email).
+ *  Validated with zod at this boundary (ADR-011); unobserved fields pass through. */
+declare const DatosCntr: z.ZodObject<{
+    contribuyente: z.ZodOptional<z.ZodObject<{
+        rut: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>;
+        dv: z.ZodOptional<z.ZodString>;
+        razonSocial: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        nombres: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        apellidoPaterno: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        apellidoMaterno: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        eMail: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$loose>>;
+}, z.core.$loose>;
+export type DatosCntr = z.infer<typeof DatosCntr>;
+/** Extract, parse and validate the `DatosCntrNow` object from the Mi SII HTML, or `null` when
+ *  it is absent / unparseable (a dead session bounced to the login page has no such object —
+ *  the caller treats `null` as "not authenticated", mirroring the old `evaluate` returning
+ *  null). The object is located by its name, then the first `{` after the `=` is matched to its
+ *  balanced `}` (string-aware), so trailing page script never confuses the boundary. */
+export declare function parseDatosCntrNow(html: string): DatosCntr | null;
+export {};
+//# sourceMappingURL=datos-cntr.d.ts.map

package/dist/auth/datos-cntr.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"datos-cntr.d.ts","sourceRoot":"","sources":["../../src/auth/datos-cntr.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;qFACqF;AACrF,QAAA,MAAM,SAAS;;;;;;;;;;iBAeL,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAIlD;;;;wFAIwF;AACxF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAWhE"}

package/dist/auth/datos-cntr.js

@@ -0,0 +1,81 @@
+// Pure parser for the Mi SII landing's inline `DatosCntrNow` object (ADR-027). The HTTP
+// PortalDriver cannot run page JS, so the identity read moves off `session.evaluate` to an
+// extract-and-parse over the raw HTML — the object ships as an inline JS literal, which a
+// plain `fetch` already receives (observed 2026-10-17; CONVENTIONS "prefer inline structured
+// data over DOM scraping"). DOM-free so it is unit-testable in Node.
+import { z } from 'zod';
+/** The curated subset of `DatosCntrNow.contribuyente` the auth flows read (identity + email).
+ *  Validated with zod at this boundary (ADR-011); unobserved fields pass through. */
+const DatosCntr = z
+    .object({
+    contribuyente: z
+        .object({
+        rut: z.union([z.number(), z.string()]).optional(),
+        dv: z.string().optional(),
+        razonSocial: z.string().nullish(),
+        nombres: z.string().nullish(),
+        apellidoPaterno: z.string().nullish(),
+        apellidoMaterno: z.string().nullish(),
+        eMail: z.string().nullish(),
+    })
+        .loose()
+        .optional(),
+})
+    .loose();
+const MARKER = 'DatosCntrNow';
+/** Extract, parse and validate the `DatosCntrNow` object from the Mi SII HTML, or `null` when
+ *  it is absent / unparseable (a dead session bounced to the login page has no such object —
+ *  the caller treats `null` as "not authenticated", mirroring the old `evaluate` returning
+ *  null). The object is located by its name, then the first `{` after the `=` is matched to its
+ *  balanced `}` (string-aware), so trailing page script never confuses the boundary. */
+export function parseDatosCntrNow(html) {
+    const literal = extractObjectLiteral(html, MARKER);
+    if (literal === null)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(literal);
+    }
+    catch {
+        return null;
+    }
+    const result = DatosCntr.safeParse(parsed);
+    return result.success ? result.data : null;
+}
+/** From the first occurrence of `<name>` followed by `=`, return the balanced `{…}` object
+ *  literal that follows (string- and escape-aware), or null. Only `"`-delimited strings occur
+ *  in SII's JSON-shaped literal; braces inside them are ignored. */
+function extractObjectLiteral(source, name) {
+    const nameAt = source.indexOf(name);
+    if (nameAt < 0)
+        return null;
+    const eq = source.indexOf('=', nameAt + name.length);
+    if (eq < 0)
+        return null;
+    const open = source.indexOf('{', eq);
+    if (open < 0)
+        return null;
+    let depth = 0;
+    let inString = false;
+    for (let i = open; i < source.length; i++) {
+        const ch = source[i];
+        if (inString) {
+            if (ch === '\\')
+                i++; // skip the escaped char
+            else if (ch === '"')
+                inString = false;
+            continue;
+        }
+        if (ch === '"')
+            inString = true;
+        else if (ch === '{')
+            depth++;
+        else if (ch === '}') {
+            depth--;
+            if (depth === 0)
+                return source.slice(open, i + 1);
+        }
+    }
+    return null; // unbalanced — treat as absent
+}
+//# sourceMappingURL=datos-cntr.js.map

package/dist/auth/datos-cntr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"datos-cntr.js","sourceRoot":"","sources":["../../src/auth/datos-cntr.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,2FAA2F;AAC3F,0FAA0F;AAC1F,6FAA6F;AAC7F,qEAAqE;AACrE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;qFACqF;AACrF,MAAM,SAAS,GAAG,CAAC;KAChB,MAAM,CAAC;IACN,aAAa,EAAE,CAAC;SACb,MAAM,CAAC;QACN,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;QACjD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;QACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;QAC7B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;QACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;QACrC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;KAC5B,CAAC;SACD,KAAK,EAAE;SACP,QAAQ,EAAE;CACd,CAAC;KACD,KAAK,EAAE,CAAC;AAIX,MAAM,MAAM,GAAG,cAAc,CAAC;AAE9B;;;;wFAIwF;AACxF,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED;;oEAEoE;AACpE,SAAS,oBAAoB,CAAC,MAAc,EAAE,IAAY;IACxD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACrC,IAAI,IAAI,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,EAAE,KAAK,IAAI;gBACb,CAAC,EAAE,CAAC,CAAC,wBAAwB;iBAC1B,IAAI,EAAE,KAAK,GAAG;gBAAE,QAAQ,GAAG,KAAK,CAAC;YACtC,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG;YAAE,QAAQ,GAAG,IAAI,CAAC;aAC3B,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,EAAE,CAAC;aACxB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACpB,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,KAAK,CAAC;gBAAE,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,+BAA+B;AAC9C,CAAC"}

package/dist/auth/index.d.ts

@@ -1,3 +1,4 @@
 export * from './auth.js';
 export * from './session.js';
+export type { LoginBlockEntry } from './login-block.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/auth/login-block.d.ts

@@ -0,0 +1,23 @@
+import { LoginFailedError } from '../errors/index.js';
+import type { LoginFailureReason } from '../errors/index.js';
+import type { KeyValueStore, Runtime } from '../seams/index.js';
+export interface LoginBlockEntry {
+    readonly rut: string;
+    readonly at: string;
+    readonly codigo: string | null;
+}
+/** Every latched RUT — what `auth status` reports, so a caller sees the block BEFORE it
+ *  decides to log in, instead of discovering it as a refusal. */
+export declare function listLoginBlocks(store: KeyValueStore): Promise<readonly LoginBlockEntry[]>;
+export declare function readLoginBlock(store: KeyValueStore, rut: string): Promise<LoginBlockEntry | null>;
+/** Did SII actually judge the Clave? Only then may the latch trip. SII's error page is the
+ *  one that prints a código (`parseSiiLoginErrorDetail`), so a código is the signal — not
+ *  `reason === 'wrong-clave'` alone: the locked-account página has its own, still unobserved
+ *  código (login-error.ts), and locking out a locked account is the safe direction. Queue-it,
+ *  a WAF refusal, a timeout or a network error carry no código: SII never saw the Clave. */
+export declare function siiJudgedClave(err: unknown): err is LoginFailedError;
+export declare function tripLoginBlock(runtime: Runtime, rut: string, codigo: string | null): Promise<void>;
+/** Lift the latch for one RUT, or for every RUT when none is given. Returns the RUTs lifted. */
+export declare function clearLoginBlock(store: KeyValueStore, rut?: string): Promise<string[]>;
+export declare function reasonForCodigo(codigo: string | null): LoginFailureReason;
+//# sourceMappingURL=login-block.d.ts.map

package/dist/auth/login-block.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-block.d.ts","sourceRoot":"","sources":["../../src/auth/login-block.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,gBAAgB,EAAoB,MAAM,oBAAoB,CAAC;AACxE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAKhE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAiBD;iEACiE;AACjE,wBAAsB,eAAe,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,eAAe,EAAE,CAAC,CAE/F;AAED,wBAAsB,cAAc,CAClC,KAAK,EAAE,aAAa,EACpB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAEjC;AAED;;;;4FAI4F;AAC5F,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,gBAAgB,CAEpE;AAED,wBAAsB,cAAc,CAClC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GAAG,IAAI,GACpB,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,gGAAgG;AAChG,wBAAsB,eAAe,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAU3F;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,kBAAkB,CAEzE"}

package/dist/auth/login-block.js

@@ -0,0 +1,53 @@
+// The rejection latch (ADR-028). After SII rejects a Clave, an unattended login must not
+// try the same stale value again on the next cron tick: repeated failures lock the account
+// (ADR-004). The latch is a local record, `~/.sii/login-blocked.json` through the store seam
+// (0600 like every store file), holding NO secret — only which RUT, when, and SII's código.
+import { LoginFailedError, LoginQueuedError } from '../errors/index.js';
+import { WRONG_CLAVE_CODIGO } from './login-error.js';
+const LOGIN_BLOCK_KEY = 'login-blocked';
+async function readEntries(store) {
+    const file = await store.read(LOGIN_BLOCK_KEY);
+    return Array.isArray(file?.entries) ? file.entries : [];
+}
+async function writeEntries(store, entries) {
+    if (entries.length === 0)
+        await store.delete(LOGIN_BLOCK_KEY);
+    else
+        await store.write(LOGIN_BLOCK_KEY, { entries });
+}
+/** Every latched RUT — what `auth status` reports, so a caller sees the block BEFORE it
+ *  decides to log in, instead of discovering it as a refusal. */
+export async function listLoginBlocks(store) {
+    return readEntries(store);
+}
+export async function readLoginBlock(store, rut) {
+    return (await readEntries(store)).find((e) => e.rut === rut) ?? null;
+}
+/** Did SII actually judge the Clave? Only then may the latch trip. SII's error page is the
+ *  one that prints a código (`parseSiiLoginErrorDetail`), so a código is the signal — not
+ *  `reason === 'wrong-clave'` alone: the locked-account página has its own, still unobserved
+ *  código (login-error.ts), and locking out a locked account is the safe direction. Queue-it,
+ *  a WAF refusal, a timeout or a network error carry no código: SII never saw the Clave. */
+export function siiJudgedClave(err) {
+    return err instanceof LoginFailedError && !(err instanceof LoginQueuedError) && !!err.codigo;
+}
+export async function tripLoginBlock(runtime, rut, codigo) {
+    const rest = (await readEntries(runtime.store)).filter((e) => e.rut !== rut);
+    await writeEntries(runtime.store, [
+        ...rest,
+        { rut, at: runtime.clock.now().toISOString(), codigo },
+    ]);
+}
+/** Lift the latch for one RUT, or for every RUT when none is given. Returns the RUTs lifted. */
+export async function clearLoginBlock(store, rut) {
+    const entries = await readEntries(store);
+    const lifted = entries.filter((e) => rut === undefined || e.rut === rut).map((e) => e.rut);
+    if (lifted.length > 0) {
+        await writeEntries(store, entries.filter((e) => !lifted.includes(e.rut)));
+    }
+    return lifted;
+}
+export function reasonForCodigo(codigo) {
+    return codigo === WRONG_CLAVE_CODIGO ? 'wrong-clave' : 'unknown';
+}
+//# sourceMappingURL=login-block.js.map

package/dist/auth/login-block.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-block.js","sourceRoot":"","sources":["../../src/auth/login-block.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,2FAA2F;AAC3F,6FAA6F;AAC7F,4FAA4F;AAC5F,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAGxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,MAAM,eAAe,GAAG,eAAe,CAAC;AAaxC,KAAK,UAAU,WAAW,CAAC,KAAoB;IAC7C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAiB,eAAe,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,KAAoB,EAAE,OAA0B;IAC1E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;;QACzD,MAAM,KAAK,CAAC,KAAK,CAAiB,eAAe,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;AACvE,CAAC;AAED;iEACiE;AACjE,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAoB;IACxD,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAoB,EACpB,GAAW;IAEX,OAAO,CAAC,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC;AACvE,CAAC;AAED;;;;4FAI4F;AAC5F,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,OAAO,GAAG,YAAY,gBAAgB,IAAI,CAAC,CAAC,GAAG,YAAY,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;AAC/F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAgB,EAChB,GAAW,EACX,MAAqB;IAErB,MAAM,IAAI,GAAG,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAC7E,MAAM,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE;QAChC,GAAG,IAAI;QACP,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE;KACvD,CAAC,CAAC;AACL,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAoB,EAAE,GAAY;IACtE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3F,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,YAAY,CAChB,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAC/C,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAqB;IACnD,OAAO,MAAM,KAAK,kBAAkB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;AACnE,CAAC"}

package/dist/auth/login-error.d.ts

@@ -1,8 +1,25 @@
-/** Extract SII's verbatim login-error cause from the failed-login page body text.
+import type { LoginFailureReason } from '../errors/index.js';
+/** SII's message código for a wrong Clave Tributaria, observed 2026-06-28
+ *  (docs/sii-contract/auth-login.md). It is the ONLY código classified as
+ *  `'wrong-clave'`; the locked-account página has a DISTINCT código, not yet
+ *  observed (triggering it risks a real lock, ADR-004/ADR-010), so it stays
+ *  `'unknown'` until captured. */
+export declare const WRONG_CLAVE_CODIGO = "01.01.203.500.720.20";
+export interface SiiLoginErrorDetail {
+    /** `"<causa> (<código line>)"` verbatim, or `null` if the page shape changed. */
+    message: string | null;
+    /** The código SII printed (e.g. `01.01.203.500.720.20`), or `null` if none. */
+    codigo: string | null;
+    /** Classified from `codigo` — `'wrong-clave'` only for `WRONG_CLAVE_CODIGO`. */
+    reason: LoginFailureReason;
+}
+/** Parse SII's failed-login page body into {message, codigo, reason}.
  *  Observed 2026-06-28 (docs/sii-contract/auth-login.md): the page renders the
  *  human cause, then a line `El código de este mensaje es <código>`. The line
  *  BEFORE the código line is the cause (e.g. "La Clave Tributaria ingresada no es
- *  correcta…"). Returns `"<causa> (<código line>)"`, or `null` if the shape
- *  changed (the caller falls back to a generic no-retry message). */
+ *  correcta…"). A changed shape ⇒ `{message: null, codigo: null, reason: 'unknown'}`
+ *  (the caller falls back to a generic no-retry message). */
+export declare function parseSiiLoginErrorDetail(bodyText: string): SiiLoginErrorDetail;
+/** Back-compat string view: SII's verbatim cause line, or `null` if the shape changed. */
 export declare function parseSiiLoginError(bodyText: string): string | null;
 //# sourceMappingURL=login-error.d.ts.map

package/dist/auth/login-error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login-error.d.ts","sourceRoot":"","sources":["../../src/auth/login-error.ts"],"names":[],"mappings":"AAIA;;;;;qEAKqE;AACrE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOlE"}
+{"version":3,"file":"login-error.d.ts","sourceRoot":"","sources":["../../src/auth/login-error.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE7D;;;;kCAIkC;AAClC,eAAO,MAAM,kBAAkB,yBAAyB,CAAC;AAEzD,MAAM,WAAW,mBAAmB;IAClC,iFAAiF;IACjF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,+EAA+E;IAC/E,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,gFAAgF;IAChF,MAAM,EAAE,kBAAkB,CAAC;CAC5B;AAED;;;;;6DAK6D;AAC7D,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,mBAAmB,CAW9E;AAED,0FAA0F;AAC1F,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAElE"}