@albertomarturelo/sii-core 0.10.0 → 0.11.0

package/dist/auth/login-error.js

@@ -1,18 +1,33 @@
 // Pure parser for SII's failed-login page (rendered on zeusr.sii.cl at
 // /cgi_AUT2000/CAutInicio.cgi). Kept DOM-free so it is unit-testable in Node;
 // the Playwright adapter passes it the page's `innerText` (adapters/node/portal.ts).
-/** Extract SII's verbatim login-error cause from the failed-login page body text.
+/** SII's message código for a wrong Clave Tributaria, observed 2026-06-28
+ *  (docs/sii-contract/auth-login.md). It is the ONLY código classified as
+ *  `'wrong-clave'`; the locked-account página has a DISTINCT código, not yet
+ *  observed (triggering it risks a real lock, ADR-004/ADR-010), so it stays
+ *  `'unknown'` until captured. */
+export const WRONG_CLAVE_CODIGO = '01.01.203.500.720.20';
+/** Parse SII's failed-login page body into {message, codigo, reason}.
  *  Observed 2026-06-28 (docs/sii-contract/auth-login.md): the page renders the
  *  human cause, then a line `El código de este mensaje es <código>`. The line
  *  BEFORE the código line is the cause (e.g. "La Clave Tributaria ingresada no es
- *  correcta…"). Returns `"<causa> (<código line>)"`, or `null` if the shape
- *  changed (the caller falls back to a generic no-retry message). */
-export function parseSiiLoginError(bodyText) {
+ *  correcta…"). A changed shape ⇒ `{message: null, codigo: null, reason: 'unknown'}`
+ *  (the caller falls back to a generic no-retry message). */
+export function parseSiiLoginErrorDetail(bodyText) {
     const lines = bodyText
         .split('\n')
         .map((l) => l.trim())
         .filter(Boolean);
     const i = lines.findIndex((l) => /El c[oó]digo de este mensaje/i.test(l));
-    return i > 0 ? `${lines[i - 1]} (${lines[i]})` : null;
+    if (i <= 0)
+        return { message: null, codigo: null, reason: 'unknown' };
+    const codigoLine = lines[i] ?? '';
+    const codigo = /El c[oó]digo de este mensaje es\s+([0-9][0-9.]*)/i.exec(codigoLine)?.[1] ?? null;
+    const reason = codigo === WRONG_CLAVE_CODIGO ? 'wrong-clave' : 'unknown';
+    return { message: `${lines[i - 1]} (${codigoLine})`, codigo, reason };
+}
+/** Back-compat string view: SII's verbatim cause line, or `null` if the shape changed. */
+export function parseSiiLoginError(bodyText) {
+    return parseSiiLoginErrorDetail(bodyText).message;
 }
 //# sourceMappingURL=login-error.js.map

package/dist/auth/login-error.js.map

@@ -1 +1 @@
-{"version":3,"file":"login-error.js","sourceRoot":"","sources":["../../src/auth/login-error.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,8EAA8E;AAC9E,qFAAqF;AAErF;;;;;qEAKqE;AACrE,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,MAAM,KAAK,GAAG,QAAQ;SACnB,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC"}
+{"version":3,"file":"login-error.js","sourceRoot":"","sources":["../../src/auth/login-error.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,8EAA8E;AAC9E,qFAAqF;AAIrF;;;;kCAIkC;AAClC,MAAM,CAAC,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AAWzD;;;;;6DAK6D;AAC7D,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,MAAM,KAAK,GAAG,QAAQ;SACnB,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACtE,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,mDAAmD,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACjG,MAAM,MAAM,GAAuB,MAAM,KAAK,kBAAkB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,OAAO,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,UAAU,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACxE,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,OAAO,wBAAwB,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;AACpD,CAAC"}

package/dist/auth/session.d.ts

@@ -1,4 +1,8 @@
-import type { KeyValueStore, PortalSession, Runtime } from '../seams/index.js';
+import type { KeyValueStore, PortalDriver, PortalSession, Runtime } from '../seams/index.js';
+/** The runtime's JS engine (Playwright), or an actionable error. The HTTP default `portal`
+ *  cannot run SII's page JS (ADR-027); a surface that needs it (BTE list, MIPYME) asks for the
+ *  `browser` engine, and the MCP's headed / www2 logins use it directly. */
+export declare function requireBrowser(runtime: Runtime): PortalDriver;
 /** The www2 APP-SESSION layer riding in the same cookies-only jar (ADR-026). Present only after
  *  `sii auth login --www2`; `expiresAt` is the `X-SII-STATE-CT` cookie's own expiry (observed
  *  ~100 min), null when the cookie carried none. Metadata only — the cookies themselves live in
@@ -42,5 +46,13 @@ export interface SessionContext {
  *  retries after a SII block (CONVENTIONS). */
 export declare function withSession<T>(runtime: Runtime, fn: (session: PortalSession, ctx: SessionContext) => Promise<T>, options?: {
     rut?: string;
+    engine?: 'browser';
+}): Promise<T>;
+/** `withSession` pinned to the browser engine — for the surfaces that run SII's OWN page JS
+ *  (BTE `list`'s inline maps, MIPYME's `validaFacEx`), ADR-027. Sugar so those call sites read
+ *  intent-first and never need Chromium elsewhere. Raises `BrowserRequiredError` when the
+ *  runtime carries no `browser` engine. */
+export declare function withBrowserSession<T>(runtime: Runtime, fn: (session: PortalSession, ctx: SessionContext) => Promise<T>, options?: {
+    rut?: string;
 }): Promise<T>;
 //# sourceMappingURL=session.d.ts.map

package/dist/auth/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAK/E;;;uCAGuC;AACvC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,aAAa;IAC5B,gFAAgF;IAChF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC;CACjC;AAED,wBAAsB,WAAW,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAErF;AAED,wBAAsB,YAAY,CAAC,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9F;AAED,wBAAsB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvE;AAED;;;;iGAIiG;AACjG,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,CAAC,gBAAgB,EAAE,MAAM,KAAK,KAAK,GACzC,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;mDAE+C;IAC/C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;+CAO+C;AAC/C,wBAAsB,WAAW,CAAC,CAAC,EACjC,OAAO,EAAE,OAAO,EAChB,EAAE,EAAE,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,CAAC,CAAC,EAC/D,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7B,OAAO,CAAC,CAAC,CAAC,CA4BZ"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAE7F;;4EAE4E;AAC5E,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,YAAY,CAS7D;AAKD;;;uCAGuC;AACvC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,aAAa;IAC5B,gFAAgF;IAChF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC;CACjC;AAED,wBAAsB,WAAW,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAErF;AAED,wBAAsB,YAAY,CAAC,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9F;AAED,wBAAsB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvE;AAED;;;;iGAIiG;AACjG,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,CAAC,gBAAgB,EAAE,MAAM,KAAK,KAAK,GACzC,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;mDAE+C;IAC/C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;+CAO+C;AAC/C,wBAAsB,WAAW,CAAC,CAAC,EACjC,OAAO,EAAE,OAAO,EAChB,EAAE,EAAE,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,CAAC,CAAC,EAC/D,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,SAAS,CAAA;CAAO,GACjD,OAAO,CAAC,CAAC,CAAC,CAgCZ;AAED;;;2CAG2C;AAC3C,wBAAgB,kBAAkB,CAAC,CAAC,EAClC,OAAO,EAAE,OAAO,EAChB,EAAE,EAAE,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,CAAC,CAAC,EAC/D,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7B,OAAO,CAAC,CAAC,CAAC,CAEZ"}

package/dist/auth/session.js

@@ -1,6 +1,17 @@
-import { NotAuthenticatedError } from '../errors/index.js';
+import { BrowserRequiredError, NotAuthenticatedError } from '../errors/index.js';
 import { readOperateState, resolveOperableTarget } from '../identity/index.js';
 import { Rut } from '../rut/index.js';
+/** The runtime's JS engine (Playwright), or an actionable error. The HTTP default `portal`
+ *  cannot run SII's page JS (ADR-027); a surface that needs it (BTE list, MIPYME) asks for the
+ *  `browser` engine, and the MCP's headed / www2 logins use it directly. */
+export function requireBrowser(runtime) {
+    if (!runtime.browser) {
+        throw new BrowserRequiredError('Esta operación necesita el motor de navegador (Playwright), que este runtime no tiene ' +
+            'configurado. En el CLI, las superficies que lo requieren (BTE list, factura MIPYME) ' +
+            'necesitan `playwright` instalado; el login con navegador vive en el MCP (ADR-027).');
+    }
+    return runtime.browser;
+}
 // Distinct KeyValueStore key (ADR-007) — never shares a file with `identity`'s 'operate'.
 const SESSION_KEY = 'session';
 export async function readSession(store) {
@@ -52,13 +63,23 @@ export async function withSession(runtime, fn, options = {}) {
     else {
         operatingRut = operateState?.operatingRut ?? stored.rut;
     }
+    // The default engine is the browser-free HTTP driver; a surface that runs SII's page JS
+    // asks for the `browser` engine, restored into the same cookies-only jar (ADR-027).
+    const driver = options.engine === 'browser' ? requireBrowser(runtime) : runtime.portal;
     let s = null;
     try {
-        s = await runtime.portal.restore(stored.cookies);
+        s = await driver.restore(stored.cookies);
         return await fn(s, { sessionRut: stored.rut, operatingRut });
     }
     finally {
         await s?.close();
     }
 }
+/** `withSession` pinned to the browser engine — for the surfaces that run SII's OWN page JS
+ *  (BTE `list`'s inline maps, MIPYME's `validaFacEx`), ADR-027. Sugar so those call sites read
+ *  intent-first and never need Chromium elsewhere. Raises `BrowserRequiredError` when the
+ *  runtime carries no `browser` engine. */
+export function withBrowserSession(runtime, fn, options = {}) {
+    return withSession(runtime, fn, { ...options, engine: 'browser' });
+}
 //# sourceMappingURL=session.js.map

package/dist/auth/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAGtC,0FAA0F;AAC1F,MAAM,WAAW,GAAG,SAAS,CAAC;AAoB9B,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAoB;IACpD,OAAO,KAAK,CAAC,IAAI,CAAgB,WAAW,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAoB,EAAE,OAAsB;IAC7E,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAoB;IACtD,MAAM,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAClC,CAAC;AAED;;;;iGAIiG;AACjG,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAgB,EAChB,KAA0C;IAE1C,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,EAAE,IAAI,EAAE,CAAC,YAAY,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC;QACzC,MAAM,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAWD;;;;;;;+CAO+C;AAC/C,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAgB,EAChB,EAA+D,EAC/D,UAA4B,EAAE;IAE9B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,qBAAqB,CAAC,0CAA0C,CAAC,CAAC;IAC9E,CAAC;IACD,2EAA2E;IAC3E,mFAAmF;IACnF,qFAAqF;IACrF,iFAAiF;IACjF,2EAA2E;IAC3E,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3D,IAAI,YAAoB,CAAC;IACzB,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,qBAAqB,CAAC,0CAA0C,CAAC,CAAC;QAC9E,CAAC;QACD,YAAY,GAAG,qBAAqB,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAClE,CAAC;SAAM,CAAC;QACN,YAAY,GAAG,YAAY,EAAE,YAAY,IAAI,MAAM,CAAC,GAAG,CAAC;IAC1D,CAAC;IAED,IAAI,CAAC,GAAyB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjD,OAAO,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;IAC/D,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC"}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAGtC;;4EAE4E;AAC5E,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC7C,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,oBAAoB,CAC5B,wFAAwF;YACtF,sFAAsF;YACtF,oFAAoF,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CAAC;AACzB,CAAC;AAED,0FAA0F;AAC1F,MAAM,WAAW,GAAG,SAAS,CAAC;AAoB9B,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAoB;IACpD,OAAO,KAAK,CAAC,IAAI,CAAgB,WAAW,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAoB,EAAE,OAAsB;IAC7E,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAoB;IACtD,MAAM,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAClC,CAAC;AAED;;;;iGAIiG;AACjG,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAgB,EAChB,KAA0C;IAE1C,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,EAAE,IAAI,EAAE,CAAC,YAAY,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC;QACzC,MAAM,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAWD;;;;;;;+CAO+C;AAC/C,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAgB,EAChB,EAA+D,EAC/D,UAAgD,EAAE;IAElD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,qBAAqB,CAAC,0CAA0C,CAAC,CAAC;IAC9E,CAAC;IACD,2EAA2E;IAC3E,mFAAmF;IACnF,qFAAqF;IACrF,iFAAiF;IACjF,2EAA2E;IAC3E,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3D,IAAI,YAAoB,CAAC;IACzB,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,qBAAqB,CAAC,0CAA0C,CAAC,CAAC;QAC9E,CAAC;QACD,YAAY,GAAG,qBAAqB,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAClE,CAAC;SAAM,CAAC;QACN,YAAY,GAAG,YAAY,EAAE,YAAY,IAAI,MAAM,CAAC,GAAG,CAAC;IAC1D,CAAC;IAED,wFAAwF;IACxF,oFAAoF;IACpF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAEvF,IAAI,CAAC,GAAyB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,CAAC,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzC,OAAO,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;IAC/D,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;2CAG2C;AAC3C,MAAM,UAAU,kBAAkB,CAChC,OAAgB,EAChB,EAA+D,EAC/D,UAA4B,EAAE;IAE9B,OAAO,WAAW,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;AACrE,CAAC"}

package/dist/cli.d.ts

@@ -1,3 +1,3 @@
-export { consoleLogin, keyringLogin } from './tasks/auth.js';
-export type { AuthLoginResult } from './tasks/auth.js';
+export { consoleLogin, keyringLogin, suppliedClaveLogin, unblockLogin } from './tasks/auth.js';
+export type { AuthLoginResult, LoginSource } from './tasks/auth.js';
 //# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC7D,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/F,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/cli.js

@@ -4,5 +4,8 @@
 // takes a password (ADR-006). The terminal CLI imports this subpath instead.
 // `keyringLogin` joins it for the same reason: it READS a Clave (from the OS keyring),
 // so it must be unreachable from the MCP server (ADR-025).
-export { consoleLogin, keyringLogin } from './tasks/auth.js';
+// `suppliedClaveLogin` takes a Clave the CLI read from a named env var or stdin, and
+// `unblockLogin` lifts the rejection latch that guards it — a human's reset, never the
+// model's (ADR-028).
+export { consoleLogin, keyringLogin, suppliedClaveLogin, unblockLogin } from './tasks/auth.js';
 //# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,oHAAoH;AACpH,qGAAqG;AACrG,gFAAgF;AAChF,6EAA6E;AAC7E,uFAAuF;AACvF,2DAA2D;AAC3D,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,oHAAoH;AACpH,qGAAqG;AACrG,gFAAgF;AAChF,6EAA6E;AAC7E,uFAAuF;AACvF,2DAA2D;AAC3D,qFAAqF;AACrF,uFAAuF;AACvF,qBAAqB;AACrB,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/config/config.d.ts

@@ -48,6 +48,14 @@ export declare const LOGIN_HOST = "zeusr.sii.cl";
 export declare const LOGIN_URL: string;
 /** Full server-side logout URL (host + path). The close redirects OFF this path. */
 export declare const LOGOUT_URL: string;
+/** The login form's POST target (`action=/cgi_AUT2000/CAutInicio.cgi`, observed 2026-06-28 /
+ *  re-confirmed 2026-10-17). The HTTP credential login POSTs the five form fields here after a
+ *  warm-up GET of the login page (ADR-027). */
+export declare const LOGIN_POST_URL: string;
+/** SII's Queue-it waiting-room host (`salaespera.sii.cl`): the peak-load queue SII drops users
+ *  into on heavy days. An HTTP client cannot pass it, so a login redirected here raises
+ *  `LoginQueuedError` — surfaced, never retried (observed in the browser jar, ADR-027). */
+export declare const QUEUE_IT_HOST = "salaespera.sii.cl";
 /** The www2 app page `sii auth login --www2` opens for the user to complete SII's OAuth login
  *  (`/bifurcacion` → `/oauthsii-v1/` → `/app/session/create` → back here), and the `Referer` /
  *  `originalUrl` the Carpeta SPA sends on its own calls. Observed 2026-09-11/12 (#110, ADR-026). */

package/dist/config/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,KAAK;IAChB,2FAA2F;;IAE3F,+FAA+F;;IAE/F,8FAA8F;;IAE9F,gGAAgG;;;IAGhG,+DAA+D;;IAE/D;;;;2CAIuC;;IAEvC;;;uFAGmF;;IAEnF;;;;;oFAKgF;;IAEhF;wEACoE;;IAEpE;;;;0BAIsB;;IAEtB;6FACyF;;;CAGjF,CAAC;AAEX,+EAA+E;AAC/E,eAAO,MAAM,UAAU,iBAAiB,CAAC;AAEzC,yCAAyC;AACzC,eAAO,MAAM,SAAS,QAAqC,CAAC;AAE5D,oFAAoF;AACpF,eAAO,MAAM,UAAU,QAAsC,CAAC;AAE9D;;oGAEoG;AACpG,eAAO,MAAM,gBAAgB,QAA2D,CAAC;AAEzF;gGACgG;AAChG,eAAO,MAAM,sBAAsB,QAAyC,CAAC;AAE7E;;;sDAGsD;AACtD,eAAO,MAAM,eAAe,QAAQ,CAAC;AAErC,MAAM,WAAW,QAAQ;IACvB,sEAAsE;IACtE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,8CAA8C;IAC9C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,eAAO,MAAM,gBAAgB,EAAE,QAG9B,CAAC;AAEF,yFAAyF;AACzF,wBAAgB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEpD"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,KAAK;IAChB,2FAA2F;;IAE3F,+FAA+F;;IAE/F,8FAA8F;;IAE9F,gGAAgG;;;IAGhG,+DAA+D;;IAE/D;;;;2CAIuC;;IAEvC;;;uFAGmF;;IAEnF;;;;;oFAKgF;;IAEhF;wEACoE;;IAEpE;;;;0BAIsB;;IAEtB;6FACyF;;;CAGjF,CAAC;AAEX,+EAA+E;AAC/E,eAAO,MAAM,UAAU,iBAAiB,CAAC;AAEzC,yCAAyC;AACzC,eAAO,MAAM,SAAS,QAAqC,CAAC;AAE5D,oFAAoF;AACpF,eAAO,MAAM,UAAU,QAAsC,CAAC;AAE9D;;+CAE+C;AAC/C,eAAO,MAAM,cAAc,QAA8C,CAAC;AAE1E;;2FAE2F;AAC3F,eAAO,MAAM,aAAa,sBAAsB,CAAC;AAEjD;;oGAEoG;AACpG,eAAO,MAAM,gBAAgB,QAA2D,CAAC;AAEzF;gGACgG;AAChG,eAAO,MAAM,sBAAsB,QAAyC,CAAC;AAE7E;;;sDAGsD;AACtD,eAAO,MAAM,eAAe,QAAQ,CAAC;AAErC,MAAM,WAAW,QAAQ;IACvB,sEAAsE;IACtE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,8CAA8C;IAC9C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,eAAO,MAAM,gBAAgB,EAAE,QAG9B,CAAC;AAEF,yFAAyF;AACzF,wBAAgB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEpD"}

package/dist/config/config.js

@@ -51,6 +51,14 @@ export const LOGIN_HOST = 'zeusr.sii.cl';
 export const LOGIN_URL = `${HOSTS.login}${HOSTS.loginPath}`;
 /** Full server-side logout URL (host + path). The close redirects OFF this path. */
 export const LOGOUT_URL = `${HOSTS.login}${HOSTS.logoutPath}`;
+/** The login form's POST target (`action=/cgi_AUT2000/CAutInicio.cgi`, observed 2026-06-28 /
+ *  re-confirmed 2026-10-17). The HTTP credential login POSTs the five form fields here after a
+ *  warm-up GET of the login page (ADR-027). */
+export const LOGIN_POST_URL = `${HOSTS.login}/cgi_AUT2000/CAutInicio.cgi`;
+/** SII's Queue-it waiting-room host (`salaespera.sii.cl`): the peak-load queue SII drops users
+ *  into on heavy days. An HTTP client cannot pass it, so a login redirected here raises
+ *  `LoginQueuedError` — surfaced, never retried (observed in the browser jar, ADR-027). */
+export const QUEUE_IT_HOST = 'salaespera.sii.cl';
 /** The www2 app page `sii auth login --www2` opens for the user to complete SII's OAuth login
  *  (`/bifurcacion` → `/oauthsii-v1/` → `/app/session/create` → back here), and the `Referer` /
  *  `originalUrl` the Carpeta SPA sends on its own calls. Observed 2026-09-11/12 (#110, ADR-026). */

package/dist/config/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,gFAAgF;AAChF,6DAA6D;AAE7D,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,2FAA2F;IAC3F,KAAK,EAAE,sBAAsB;IAC7B,+FAA+F;IAC/F,SAAS,EAAE,mDAAmD;IAC9D,8FAA8F;IAC9F,UAAU,EAAE,6BAA6B;IACzC,gGAAgG;IAChG,KAAK,EAAE,6CAA6C;IACpD,MAAM,EAAE,oBAAoB;IAC5B,+DAA+D;IAC/D,SAAS,EAAE,qBAAqB;IAChC;;;;2CAIuC;IACvC,SAAS,EAAE,qBAAqB;IAChC;;;uFAGmF;IACnF,MAAM,EAAE,4BAA4B;IACpC;;;;;oFAKgF;IAChF,OAAO,EAAE,uCAAuC;IAChD;wEACoE;IACpE,UAAU,EAAE,+BAA+B;IAC3C;;;;0BAIsB;IACtB,MAAM,EAAE,oCAAoC;IAC5C;6FACyF;IACzF,KAAK,EAAE,uBAAuB;IAC9B,UAAU,EAAE,sDAAsD;CAC1D,CAAC;AAEX,+EAA+E;AAC/E,MAAM,CAAC,MAAM,UAAU,GAAG,cAAc,CAAC;AAEzC,yCAAyC;AACzC,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;AAE5D,oFAAoF;AACpF,MAAM,CAAC,MAAM,UAAU,GAAG,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;AAE9D;;oGAEoG;AACpG,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,KAAK,CAAC,SAAS,sCAAsC,CAAC;AAEzF;gGACgG;AAChG,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,KAAK,CAAC,SAAS,oBAAoB,CAAC;AAE7E;;;sDAGsD;AACtD,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC;AASrC,MAAM,CAAC,MAAM,gBAAgB,GAAa;IACxC,YAAY,EAAE,CAAC;IACf,iBAAiB,EAAE,EAAE;CACtB,CAAC;AAEF,yFAAyF;AACzF,MAAM,UAAU,QAAQ,CAAC,WAAmB;IAC1C,OAAO,GAAG,SAAS,IAAI,WAAW,EAAE,CAAC;AACvC,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,gFAAgF;AAChF,6DAA6D;AAE7D,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,2FAA2F;IAC3F,KAAK,EAAE,sBAAsB;IAC7B,+FAA+F;IAC/F,SAAS,EAAE,mDAAmD;IAC9D,8FAA8F;IAC9F,UAAU,EAAE,6BAA6B;IACzC,gGAAgG;IAChG,KAAK,EAAE,6CAA6C;IACpD,MAAM,EAAE,oBAAoB;IAC5B,+DAA+D;IAC/D,SAAS,EAAE,qBAAqB;IAChC;;;;2CAIuC;IACvC,SAAS,EAAE,qBAAqB;IAChC;;;uFAGmF;IACnF,MAAM,EAAE,4BAA4B;IACpC;;;;;oFAKgF;IAChF,OAAO,EAAE,uCAAuC;IAChD;wEACoE;IACpE,UAAU,EAAE,+BAA+B;IAC3C;;;;0BAIsB;IACtB,MAAM,EAAE,oCAAoC;IAC5C;6FACyF;IACzF,KAAK,EAAE,uBAAuB;IAC9B,UAAU,EAAE,sDAAsD;CAC1D,CAAC;AAEX,+EAA+E;AAC/E,MAAM,CAAC,MAAM,UAAU,GAAG,cAAc,CAAC;AAEzC,yCAAyC;AACzC,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;AAE5D,oFAAoF;AACpF,MAAM,CAAC,MAAM,UAAU,GAAG,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;AAE9D;;+CAE+C;AAC/C,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,KAAK,CAAC,KAAK,6BAA6B,CAAC;AAE1E;;2FAE2F;AAC3F,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAEjD;;oGAEoG;AACpG,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,KAAK,CAAC,SAAS,sCAAsC,CAAC;AAEzF;gGACgG;AAChG,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,KAAK,CAAC,SAAS,oBAAoB,CAAC;AAE7E;;;sDAGsD;AACtD,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC;AASrC,MAAM,CAAC,MAAM,gBAAgB,GAAa;IACxC,YAAY,EAAE,CAAC;IACf,iBAAiB,EAAE,EAAE;CACtB,CAAC;AAEF,yFAAyF;AACzF,MAAM,UAAU,QAAQ,CAAC,WAAmB;IAC1C,OAAO,GAAG,SAAS,IAAI,WAAW,EAAE,CAAC;AACvC,CAAC"}

package/dist/errors/errors.d.ts

@@ -15,13 +15,45 @@ export declare class SessionExpiredError extends NotAuthenticatedError {
  *  DISTINCT from `SessionExpiredError` (the classic Mi SII session may be perfectly alive). */
 export declare class Www2SessionError extends NotAuthenticatedError {
 }
-/** Browser login was not completed (timeout / window closed). No partial
- *  session is ever written. */
+/** Why a login was rejected, as DATA so a downstream consumer never regex-parses the
+ *  message (#124). `'wrong-clave'` ONLY for SII's observed wrong-Clave código; every
+ *  other código, a changed page shape, a timeout or the generic fallback is `'unknown'`
+ *  — the safe direction (a consumer treats unknown as "blocked", never as "retry"). */
+export type LoginFailureReason = 'wrong-clave' | 'unknown';
+/** Browser login was not completed (timeout / window closed) OR SII rejected the Clave.
+ *  No partial session is ever written. Carries the classified `reason` + SII's message
+ *  `codigo` (when the page printed one) alongside the verbatim message, so a consumer
+ *  reads them as data (#124). Both are additive: `new LoginFailedError(msg)` still works
+ *  (`reason: 'unknown'`, `codigo: null`). */
 export declare class LoginFailedError extends SiiError {
+    readonly reason: LoginFailureReason;
+    readonly codigo: string | null;
+    constructor(message: string, opts?: {
+        reason?: LoginFailureReason;
+        codigo?: string | null;
+    });
 }
 /** SII server-side rate limit / block. NEVER retry — surface verbatim and stop. */
 export declare class RateLimitError extends SiiError {
 }
+/** A surface needs a JS engine (SII's own page JS must run — BTE inline maps, MIPYME's
+ *  in-page `validaFacEx`) but the runtime carries no `browser` engine: the default HTTP
+ *  `PortalDriver` cannot `evaluate`/`interactiveLogin` (ADR-027). Actionable — names the
+ *  Playwright install — never a silent fallback. */
+export declare class BrowserRequiredError extends SiiError {
+}
+/** The login POST was redirected into SII's Queue-it waiting room (`salaespera.sii.cl`),
+ *  the peak-load queue an HTTP client cannot pass (observed in the browser jar, ADR-027).
+ *  NOT a credential failure and NOT retryable here — surface it and stop. */
+export declare class LoginQueuedError extends LoginFailedError {
+}
+/** A NON-interactive login (`--clave-env` / `--clave-stdin` / `--keyring`) refused WITHOUT
+ *  contacting SII because the rejection latch is set for that RUT: SII rejected a Clave for
+ *  it earlier, and an unattended retry of the same stale value is how an account gets locked
+ *  (ADR-028). Carries the latched `codigo`/`reason`. Lifted by an interactive login or
+ *  `sii auth unblock`. A LoginFailed subclass, so it keeps that exit code. */
+export declare class LoginBlockedError extends LoginFailedError {
+}
 /** A stored credential was required (e.g. unattended re-mint) but none resolved. */
 export declare class CredentialNotFoundError extends SiiError {
 }

package/dist/errors/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/errors/errors.ts"],"names":[],"mappings":"AAIA,qBAAa,QAAS,SAAQ,KAAK;gBACrB,OAAO,EAAE,MAAM;CAI5B;AAED,mEAAmE;AACnE,qBAAa,qBAAsB,SAAQ,QAAQ;CAAG;AAEtD;;iEAEiE;AACjE,qBAAa,mBAAoB,SAAQ,qBAAqB;CAAG;AAEjE;;;+FAG+F;AAC/F,qBAAa,gBAAiB,SAAQ,qBAAqB;CAAG;AAE9D;+BAC+B;AAC/B,qBAAa,gBAAiB,SAAQ,QAAQ;CAAG;AAEjD,mFAAmF;AACnF,qBAAa,cAAe,SAAQ,QAAQ;CAAG;AAE/C,oFAAoF;AACpF,qBAAa,uBAAwB,SAAQ,QAAQ;CAAG;AAExD,mFAAmF;AACnF,qBAAa,eAAgB,SAAQ,QAAQ;CAAG;AAEhD;;;;;;;;wBAQwB;AACxB,qBAAa,uBAAwB,SAAQ,QAAQ;CAAG;AAExD;8EAC8E;AAC9E,qBAAa,mBAAoB,SAAQ,QAAQ;CAAG;AAEpD;uFACuF;AACvF,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;8EAC8E;AAC9E,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;wFAGwF;AACxF,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;eAGe;AACf,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;;;gFAKgF;AAChF,qBAAa,eAAgB,SAAQ,QAAQ;CAAG;AAEhD;;;;;;;;uCAQuC;AACvC,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;;;mGAKmG;AACnG,qBAAa,YAAa,SAAQ,QAAQ;CAAG"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/errors/errors.ts"],"names":[],"mappings":"AAIA,qBAAa,QAAS,SAAQ,KAAK;gBACrB,OAAO,EAAE,MAAM;CAI5B;AAED,mEAAmE;AACnE,qBAAa,qBAAsB,SAAQ,QAAQ;CAAG;AAEtD;;iEAEiE;AACjE,qBAAa,mBAAoB,SAAQ,qBAAqB;CAAG;AAEjE;;;+FAG+F;AAC/F,qBAAa,gBAAiB,SAAQ,qBAAqB;CAAG;AAE9D;;;uFAGuF;AACvF,MAAM,MAAM,kBAAkB,GAAG,aAAa,GAAG,SAAS,CAAC;AAE3D;;;;6CAI6C;AAC7C,qBAAa,gBAAiB,SAAQ,QAAQ;IAC5C,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;gBACnB,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,kBAAkB,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAK5F;AAED,mFAAmF;AACnF,qBAAa,cAAe,SAAQ,QAAQ;CAAG;AAE/C;;;oDAGoD;AACpD,qBAAa,oBAAqB,SAAQ,QAAQ;CAAG;AAErD;;6EAE6E;AAC7E,qBAAa,gBAAiB,SAAQ,gBAAgB;CAAG;AAEzD;;;;8EAI8E;AAC9E,qBAAa,iBAAkB,SAAQ,gBAAgB;CAAG;AAE1D,oFAAoF;AACpF,qBAAa,uBAAwB,SAAQ,QAAQ;CAAG;AAExD,mFAAmF;AACnF,qBAAa,eAAgB,SAAQ,QAAQ;CAAG;AAEhD;;;;;;;;wBAQwB;AACxB,qBAAa,uBAAwB,SAAQ,QAAQ;CAAG;AAExD;8EAC8E;AAC9E,qBAAa,mBAAoB,SAAQ,QAAQ;CAAG;AAEpD;uFACuF;AACvF,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;8EAC8E;AAC9E,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;wFAGwF;AACxF,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;eAGe;AACf,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;;;gFAKgF;AAChF,qBAAa,eAAgB,SAAQ,QAAQ;CAAG;AAEhD;;;;;;;;uCAQuC;AACvC,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;;;mGAKmG;AACnG,qBAAa,YAAa,SAAQ,QAAQ;CAAG"}

package/dist/errors/errors.js

@@ -21,13 +21,41 @@ export class SessionExpiredError extends NotAuthenticatedError {
  *  DISTINCT from `SessionExpiredError` (the classic Mi SII session may be perfectly alive). */
 export class Www2SessionError extends NotAuthenticatedError {
 }
-/** Browser login was not completed (timeout / window closed). No partial
- *  session is ever written. */
+/** Browser login was not completed (timeout / window closed) OR SII rejected the Clave.
+ *  No partial session is ever written. Carries the classified `reason` + SII's message
+ *  `codigo` (when the page printed one) alongside the verbatim message, so a consumer
+ *  reads them as data (#124). Both are additive: `new LoginFailedError(msg)` still works
+ *  (`reason: 'unknown'`, `codigo: null`). */
 export class LoginFailedError extends SiiError {
+    reason;
+    codigo;
+    constructor(message, opts) {
+        super(message);
+        this.reason = opts?.reason ?? 'unknown';
+        this.codigo = opts?.codigo ?? null;
+    }
 }
 /** SII server-side rate limit / block. NEVER retry — surface verbatim and stop. */
 export class RateLimitError extends SiiError {
 }
+/** A surface needs a JS engine (SII's own page JS must run — BTE inline maps, MIPYME's
+ *  in-page `validaFacEx`) but the runtime carries no `browser` engine: the default HTTP
+ *  `PortalDriver` cannot `evaluate`/`interactiveLogin` (ADR-027). Actionable — names the
+ *  Playwright install — never a silent fallback. */
+export class BrowserRequiredError extends SiiError {
+}
+/** The login POST was redirected into SII's Queue-it waiting room (`salaespera.sii.cl`),
+ *  the peak-load queue an HTTP client cannot pass (observed in the browser jar, ADR-027).
+ *  NOT a credential failure and NOT retryable here — surface it and stop. */
+export class LoginQueuedError extends LoginFailedError {
+}
+/** A NON-interactive login (`--clave-env` / `--clave-stdin` / `--keyring`) refused WITHOUT
+ *  contacting SII because the rejection latch is set for that RUT: SII rejected a Clave for
+ *  it earlier, and an unattended retry of the same stale value is how an account gets locked
+ *  (ADR-028). Carries the latched `codigo`/`reason`. Lifted by an interactive login or
+ *  `sii auth unblock`. A LoginFailed subclass, so it keeps that exit code. */
+export class LoginBlockedError extends LoginFailedError {
+}
 /** A stored credential was required (e.g. unattended re-mint) but none resolved. */
 export class CredentialNotFoundError extends SiiError {
 }

package/dist/errors/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/errors/errors.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,2EAA2E;AAC3E,kEAAkE;AAElE,MAAM,OAAO,QAAS,SAAQ,KAAK;IACjC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;IAC9B,CAAC;CACF;AAED,mEAAmE;AACnE,MAAM,OAAO,qBAAsB,SAAQ,QAAQ;CAAG;AAEtD;;iEAEiE;AACjE,MAAM,OAAO,mBAAoB,SAAQ,qBAAqB;CAAG;AAEjE;;;+FAG+F;AAC/F,MAAM,OAAO,gBAAiB,SAAQ,qBAAqB;CAAG;AAE9D;+BAC+B;AAC/B,MAAM,OAAO,gBAAiB,SAAQ,QAAQ;CAAG;AAEjD,mFAAmF;AACnF,MAAM,OAAO,cAAe,SAAQ,QAAQ;CAAG;AAE/C,oFAAoF;AACpF,MAAM,OAAO,uBAAwB,SAAQ,QAAQ;CAAG;AAExD,mFAAmF;AACnF,MAAM,OAAO,eAAgB,SAAQ,QAAQ;CAAG;AAEhD;;;;;;;;wBAQwB;AACxB,MAAM,OAAO,uBAAwB,SAAQ,QAAQ;CAAG;AAExD;8EAC8E;AAC9E,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;CAAG;AAEpD;uFACuF;AACvF,MAAM,OAAO,QAAS,SAAQ,QAAQ;CAAG;AAEzC;8EAC8E;AAC9E,MAAM,OAAO,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;wFAGwF;AACxF,MAAM,OAAO,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;eAGe;AACf,MAAM,OAAO,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;;;gFAKgF;AAChF,MAAM,OAAO,eAAgB,SAAQ,QAAQ;CAAG;AAEhD;;;;;;;;uCAQuC;AACvC,MAAM,OAAO,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;;;mGAKmG;AACnG,MAAM,OAAO,YAAa,SAAQ,QAAQ;CAAG"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/errors/errors.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,2EAA2E;AAC3E,kEAAkE;AAElE,MAAM,OAAO,QAAS,SAAQ,KAAK;IACjC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;IAC9B,CAAC;CACF;AAED,mEAAmE;AACnE,MAAM,OAAO,qBAAsB,SAAQ,QAAQ;CAAG;AAEtD;;iEAEiE;AACjE,MAAM,OAAO,mBAAoB,SAAQ,qBAAqB;CAAG;AAEjE;;;+FAG+F;AAC/F,MAAM,OAAO,gBAAiB,SAAQ,qBAAqB;CAAG;AAQ9D;;;;6CAI6C;AAC7C,MAAM,OAAO,gBAAiB,SAAQ,QAAQ;IACnC,MAAM,CAAqB;IAC3B,MAAM,CAAgB;IAC/B,YAAY,OAAe,EAAE,IAA8D;QACzF,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,MAAM,IAAI,SAAS,CAAC;QACxC,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,MAAM,IAAI,IAAI,CAAC;IACrC,CAAC;CACF;AAED,mFAAmF;AACnF,MAAM,OAAO,cAAe,SAAQ,QAAQ;CAAG;AAE/C;;;oDAGoD;AACpD,MAAM,OAAO,oBAAqB,SAAQ,QAAQ;CAAG;AAErD;;6EAE6E;AAC7E,MAAM,OAAO,gBAAiB,SAAQ,gBAAgB;CAAG;AAEzD;;;;8EAI8E;AAC9E,MAAM,OAAO,iBAAkB,SAAQ,gBAAgB;CAAG;AAE1D,oFAAoF;AACpF,MAAM,OAAO,uBAAwB,SAAQ,QAAQ;CAAG;AAExD,mFAAmF;AACnF,MAAM,OAAO,eAAgB,SAAQ,QAAQ;CAAG;AAEhD;;;;;;;;wBAQwB;AACxB,MAAM,OAAO,uBAAwB,SAAQ,QAAQ;CAAG;AAExD;8EAC8E;AAC9E,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;CAAG;AAEpD;uFACuF;AACvF,MAAM,OAAO,QAAS,SAAQ,QAAQ;CAAG;AAEzC;8EAC8E;AAC9E,MAAM,OAAO,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;wFAGwF;AACxF,MAAM,OAAO,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;eAGe;AACf,MAAM,OAAO,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;;;gFAKgF;AAChF,MAAM,OAAO,eAAgB,SAAQ,QAAQ;CAAG;AAEhD;;;;;;;;uCAQuC;AACvC,MAAM,OAAO,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;;;mGAKmG;AACnG,MAAM,OAAO,YAAa,SAAQ,QAAQ;CAAG"}

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { login, logout, authStatus, statusRefresh, whoami } from './tasks/auth.js';
-export type { AuthIdentity, AuthIdentityRefresh, AuthLoginResult, AuthLogoutResult, AuthStatusLocal, AuthWhoami, AuthWww2Status, LoginOptions, } from './tasks/auth.js';
+export type { AuthIdentity, AuthIdentityRefresh, AuthLoginResult, AuthLogoutResult, AuthStatusLocal, AuthWhoami, AuthWww2Status, LoginBlockEntry, LoginOptions, } from './tasks/auth.js';
 export { operate, operateSelf, operatingStatus, listOperable } from './tasks/operate.js';
 export type { OperateResult, OperableList } from './tasks/operate.js';
 export { describeOperating, formatOperableEntry } from './identity/index.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACnF,YAAY,EACV,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,UAAU,EACV,cAAc,EACd,YAAY,GACb,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACzF,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC7E,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjE,YAAY,EACV,UAAU,EACV,aAAa,EACb,UAAU,EACV,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,OAAO,GACR,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACxF,YAAY,EACV,SAAS,EACT,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,SAAS,EACT,cAAc,EACd,SAAS,EACT,SAAS,EACT,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,aAAa,EACb,WAAW,EACX,MAAM,EACN,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,aAAa,EACb,WAAW,EACX,eAAe,EACf,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,SAAS,EACT,oBAAoB,EACpB,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,UAAU,EACV,aAAa,GACd,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EACL,aAAa,EACb,WAAW,EACX,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,MAAM,EACN,SAAS,EACT,SAAS,GACV,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,cAAc,EACd,aAAa,EACb,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,aAAa,EACb,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,UAAU,EACV,SAAS,EACT,OAAO,GACR,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,UAAU,EACV,SAAS,EACT,UAAU,EACV,OAAO,EACP,WAAW,EACX,aAAa,EACb,UAAU,EACV,UAAU,EACV,UAAU,EACV,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,YAAY,EAAE,gBAAgB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAK7D,YAAY,EACV,UAAU,EACV,SAAS,EACT,KAAK,EACL,sBAAsB,EACtB,uBAAuB,EACvB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,OAAO,EACP,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACtD,cAAc,mBAAmB,CAAC;AAGlC,OAAO,KAAK,OAAO,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACnF,YAAY,EACV,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,UAAU,EACV,cAAc,EACd,eAAe,EACf,YAAY,GACb,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACzF,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC7E,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjE,YAAY,EACV,UAAU,EACV,aAAa,EACb,UAAU,EACV,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,OAAO,GACR,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACxF,YAAY,EACV,SAAS,EACT,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,SAAS,EACT,cAAc,EACd,SAAS,EACT,SAAS,EACT,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,aAAa,EACb,WAAW,EACX,MAAM,EACN,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,aAAa,EACb,WAAW,EACX,eAAe,EACf,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,SAAS,EACT,oBAAoB,EACpB,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,UAAU,EACV,aAAa,GACd,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EACL,aAAa,EACb,WAAW,EACX,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,MAAM,EACN,SAAS,EACT,SAAS,GACV,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,cAAc,EACd,aAAa,EACb,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,aAAa,EACb,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,UAAU,EACV,SAAS,EACT,OAAO,GACR,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,UAAU,EACV,SAAS,EACT,UAAU,EACV,OAAO,EACP,WAAW,EACX,aAAa,EACb,UAAU,EACV,UAAU,EACV,UAAU,EACV,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,YAAY,EAAE,gBAAgB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAK7D,YAAY,EACV,UAAU,EACV,SAAS,EACT,KAAK,EACL,sBAAsB,EACtB,uBAAuB,EACvB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,OAAO,EACP,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACtD,cAAc,mBAAmB,CAAC;AAGlC,OAAO,KAAK,OAAO,MAAM,0BAA0B,CAAC"}

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,gFAAgF;AAChF,6EAA6E;AAE7E,uCAAuC;AACvC,mFAAmF;AACnF,mGAAmG;AACnG,gDAAgD;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAWnF,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEzF,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE7E,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAUjE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAaxF,OAAO,EACL,aAAa,EACb,WAAW,EACX,MAAM,EACN,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAkBxB,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EACL,aAAa,EACb,WAAW,EACX,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,MAAM,EACN,SAAS,EACT,SAAS,GACV,MAAM,gBAAgB,CAAC;AA+BxB,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAmB1D,4BAA4B;AAC5B,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACtD,cAAc,mBAAmB,CAAC;AAElC,2EAA2E;AAC3E,OAAO,KAAK,OAAO,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,gFAAgF;AAChF,6EAA6E;AAE7E,uCAAuC;AACvC,mFAAmF;AACnF,mGAAmG;AACnG,gDAAgD;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAYnF,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEzF,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE7E,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAUjE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAaxF,OAAO,EACL,aAAa,EACb,WAAW,EACX,MAAM,EACN,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAkBxB,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EACL,aAAa,EACb,WAAW,EACX,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,MAAM,EACN,SAAS,EACT,SAAS,GACV,MAAM,gBAAgB,CAAC;AA+BxB,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAmB1D,4BAA4B;AAC5B,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACtD,cAAc,mBAAmB,CAAC;AAElC,2EAA2E;AAC3E,OAAO,KAAK,OAAO,MAAM,0BAA0B,CAAC"}

package/dist/node.d.ts

@@ -1,11 +1,15 @@
 import type { Runtime } from './seams/index.js';
 export { DOCUMENTOS_DIR, FileAuditSink, FileKeyValueStore, NodeFileSink, SII_DIR, SystemClock, } from './adapters/node/index.js';
 export { KeyringSecretStore } from './adapters/node/keyring.js';
+export { HttpPortalDriver } from './adapters/node/http.js';
 export { PlaywrightPortalDriver } from './adapters/node/portal.js';
 /** Composition root: the Node default adapters, any seam replaceable (ADR-016).
- *  e.g. `createNodeRuntime({ audit: myAuditSink })` keeps the other three defaults.
- *  The default portal is the Playwright driver — its `playwright` OPTIONAL peer is
- *  loaded lazily on first use, so composing (or overriding `portal`) never needs it.
+ *  e.g. `createNodeRuntime({ audit: myAuditSink })` keeps the other defaults.
+ *  The default `portal` is the browser-free HTTP driver (ADR-027); `browser` is the
+ *  Playwright engine, used only where SII's own page JS must run (BTE list, MIPYME) and
+ *  by the MCP's headed / www2 logins. Constructing the Playwright driver is free — its
+ *  `playwright` OPTIONAL peer loads lazily on the first browser call — so a runtime that
+ *  never touches JS never loads Chromium.
  *  `secrets` is DELIBERATELY not defaulted here: the OS keyring is wired by the CLI's
  *  composition root alone (`createNodeRuntime({ secrets: new KeyringSecretStore() })`),
  *  so the MCP server — which builds from this same function — carries no keyring at all

package/dist/node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,EACL,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,OAAO,EACP,WAAW,GACZ,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAEnE;;;;;;;2BAO2B;AAC3B,wBAAgB,iBAAiB,CAAC,SAAS,GAAE,OAAO,CAAC,OAAO,CAAM,GAAG,OAAO,CAS3E"}
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,EACL,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,OAAO,EACP,WAAW,GACZ,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAEnE;;;;;;;;;;2BAU2B;AAC3B,wBAAgB,iBAAiB,CAAC,SAAS,GAAE,OAAO,CAAC,OAAO,CAAM,GAAG,OAAO,CAU3E"}

package/dist/node.js

@@ -3,14 +3,19 @@
 // library's tasks/primitives never evaluates node:* or playwright — a consumer
 // that injects its own seams (ADR-003) stays free of them entirely.
 import { FileAuditSink, FileKeyValueStore, NodeFileSink, SystemClock, } from './adapters/node/index.js';
+import { HttpPortalDriver } from './adapters/node/http.js';
 import { PlaywrightPortalDriver } from './adapters/node/portal.js';
 export { DOCUMENTOS_DIR, FileAuditSink, FileKeyValueStore, NodeFileSink, SII_DIR, SystemClock, } from './adapters/node/index.js';
 export { KeyringSecretStore } from './adapters/node/keyring.js';
+export { HttpPortalDriver } from './adapters/node/http.js';
 export { PlaywrightPortalDriver } from './adapters/node/portal.js';
 /** Composition root: the Node default adapters, any seam replaceable (ADR-016).
- *  e.g. `createNodeRuntime({ audit: myAuditSink })` keeps the other three defaults.
- *  The default portal is the Playwright driver — its `playwright` OPTIONAL peer is
- *  loaded lazily on first use, so composing (or overriding `portal`) never needs it.
+ *  e.g. `createNodeRuntime({ audit: myAuditSink })` keeps the other defaults.
+ *  The default `portal` is the browser-free HTTP driver (ADR-027); `browser` is the
+ *  Playwright engine, used only where SII's own page JS must run (BTE list, MIPYME) and
+ *  by the MCP's headed / www2 logins. Constructing the Playwright driver is free — its
+ *  `playwright` OPTIONAL peer loads lazily on the first browser call — so a runtime that
+ *  never touches JS never loads Chromium.
  *  `secrets` is DELIBERATELY not defaulted here: the OS keyring is wired by the CLI's
  *  composition root alone (`createNodeRuntime({ secrets: new KeyringSecretStore() })`),
  *  so the MCP server — which builds from this same function — carries no keyring at all
@@ -20,7 +25,8 @@ export function createNodeRuntime(overrides = {}) {
         clock: new SystemClock(),
         audit: new FileAuditSink(),
         store: new FileKeyValueStore(),
-        portal: new PlaywrightPortalDriver(),
+        portal: new HttpPortalDriver(),
+        browser: new PlaywrightPortalDriver(),
         files: new NodeFileSink(),
         ...overrides,
     };

package/dist/node.js.map

@@ -1 +1 @@
-{"version":3,"file":"node.js","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,gFAAgF;AAChF,+EAA+E;AAC/E,oEAAoE;AACpE,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,WAAW,GACZ,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAGnE,OAAO,EACL,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,OAAO,EACP,WAAW,GACZ,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAEnE;;;;;;;2BAO2B;AAC3B,MAAM,UAAU,iBAAiB,CAAC,YAA8B,EAAE;IAChE,OAAO;QACL,KAAK,EAAE,IAAI,WAAW,EAAE;QACxB,KAAK,EAAE,IAAI,aAAa,EAAE;QAC1B,KAAK,EAAE,IAAI,iBAAiB,EAAE;QAC9B,MAAM,EAAE,IAAI,sBAAsB,EAAE;QACpC,KAAK,EAAE,IAAI,YAAY,EAAE;QACzB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC"}
+{"version":3,"file":"node.js","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,gFAAgF;AAChF,+EAA+E;AAC/E,oEAAoE;AACpE,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,WAAW,GACZ,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAGnE,OAAO,EACL,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,OAAO,EACP,WAAW,GACZ,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAEnE;;;;;;;;;;2BAU2B;AAC3B,MAAM,UAAU,iBAAiB,CAAC,YAA8B,EAAE;IAChE,OAAO;QACL,KAAK,EAAE,IAAI,WAAW,EAAE;QACxB,KAAK,EAAE,IAAI,aAAa,EAAE;QAC1B,KAAK,EAAE,IAAI,iBAAiB,EAAE;QAC9B,MAAM,EAAE,IAAI,gBAAgB,EAAE;QAC9B,OAAO,EAAE,IAAI,sBAAsB,EAAE;QACrC,KAAK,EAAE,IAAI,YAAY,EAAE;QACzB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC"}

package/dist/seams/index.d.ts

@@ -184,5 +184,12 @@ export interface Runtime {
      *  never by the MCP server's, so that surface has no keyring BY CONSTRUCTION and not
      *  by "no code happens to call it" (ADR-006 / ADR-025). */
     readonly secrets?: SecretReader;
+    /** OPTIONAL JS engine (the lazy Playwright driver). The default `portal` is the browser-free
+     *  HTTP driver (ADR-027); a surface that must run SII's OWN page JS (BTE inline maps, MIPYME
+     *  `validaFacEx`) acquires this via `withSession(…, { engine: 'browser' })`, and the headed /
+     *  www2 logins (MCP-only) use it directly. Absent ⇒ those paths raise `BrowserRequiredError`.
+     *  `createNodeRuntime` wires the Playwright driver here; constructing it is free (it lazy-loads
+     *  Chromium only on first browser call), so a runtime that never needs JS never loads it. */
+    readonly browser?: PortalDriver;
 }
 //# sourceMappingURL=index.d.ts.map

package/dist/seams/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/seams/index.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,KAAK;IACpB,GAAG,IAAI,IAAI,CAAC;IACZ;6EACyE;IACzE,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;AAED,kFAAkF;AAClF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CACnC;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;CACjC;AAED;uEACuE;AACvE,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACxC,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAED;iEACiE;AACjE,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC7C,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC;AAED;;oDAEoD;AACpD,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAEpD;kDACkD;AAClD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,iEAAiE;IACjE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;0EAG0E;AAC1E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAED;;;;wEAIwE;AACxE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,+EAA+E;IAC/E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;qDAGqD;AACrD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,qDAAqD;IACrD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;wEAEoE;IACpE,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC;2CACuC;IACvC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,mFAAmF;IACnF,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,kFAAkF;IAClF,QAAQ,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5C;;;yEAGqE;IACrE,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE;;;;sEAIkE;IAClE,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACzE;;;;4DAIwD;IACxD,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACzE;;;iFAG6E;IAC7E,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7E;mDAC+C;IAC/C,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1D,iDAAiD;IACjD,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;sEACsE;AACtE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,oFAAoF;IACpF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;mFAC+E;IAC/E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,sDAAsD;IACtD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,gFAAgF;IAChF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACrC,mFAAmF;IACnF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,oFAAoF;IACpF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,YAAY;IAC3B;sFACkF;IAClF,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3E;;mFAE+E;IAC/E,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACzE,gFAAgF;IAChF,OAAO,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACvD;;sFAEkF;IAClF,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC9E;AAED,kFAAkF;AAClF;;4EAE4E;AAC5E,MAAM,WAAW,QAAQ;IACvB;yFACqF;IACrF,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACtE;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B;;;+EAG2E;IAC3E,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;IAC1B;;+DAE2D;IAC3D,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;CACjC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/seams/index.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,KAAK;IACpB,GAAG,IAAI,IAAI,CAAC;IACZ;6EACyE;IACzE,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;AAED,kFAAkF;AAClF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CACnC;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;CACjC;AAED;uEACuE;AACvE,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACxC,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAED;iEACiE;AACjE,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC7C,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC;AAED;;oDAEoD;AACpD,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAEpD;kDACkD;AAClD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,iEAAiE;IACjE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;0EAG0E;AAC1E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAED;;;;wEAIwE;AACxE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,+EAA+E;IAC/E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;qDAGqD;AACrD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,qDAAqD;IACrD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;wEAEoE;IACpE,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC;2CACuC;IACvC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,mFAAmF;IACnF,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,kFAAkF;IAClF,QAAQ,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5C;;;yEAGqE;IACrE,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE;;;;sEAIkE;IAClE,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACzE;;;;4DAIwD;IACxD,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACzE;;;iFAG6E;IAC7E,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7E;mDAC+C;IAC/C,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1D,iDAAiD;IACjD,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;sEACsE;AACtE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,oFAAoF;IACpF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;mFAC+E;IAC/E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,sDAAsD;IACtD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,gFAAgF;IAChF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACrC,mFAAmF;IACnF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,oFAAoF;IACpF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,YAAY;IAC3B;sFACkF;IAClF,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3E;;mFAE+E;IAC/E,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACzE,gFAAgF;IAChF,OAAO,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACvD;;sFAEkF;IAClF,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC9E;AAED,kFAAkF;AAClF;;4EAE4E;AAC5E,MAAM,WAAW,QAAQ;IACvB;yFACqF;IACrF,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACtE;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B;;;+EAG2E;IAC3E,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;IAC1B;;+DAE2D;IAC3D,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;IAChC;;;;;iGAK6F;IAC7F,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;CACjC"}

package/dist/tasks/auth.d.ts

@@ -1,4 +1,4 @@
-import type { AuthIdentity, AuthIdentityRefresh, AuthLoginResult, AuthLogoutResult, AuthStatusLocal, AuthWhoami, AuthWww2Status, LoginOptions } from '../auth/index.js';
+import type { AuthIdentity, AuthIdentityRefresh, AuthLoginResult, AuthLogoutResult, AuthStatusLocal, AuthWhoami, AuthWww2Status, LoginBlockEntry, LoginOptions, LoginSource } from '../auth/index.js';
 import type { Runtime } from '../seams/index.js';
 /** Browser login (ADR-006). `www2: true` also mints the www2 app-session layer in the same headed
  *  browser (ADR-026) — the user types the Clave into SII's OAuth page; never a password argument. */
@@ -14,6 +14,20 @@ export declare function consoleLogin(runtime: Runtime, credentials: {
 export declare function keyringLogin(runtime: Runtime, args: {
     rut: string;
 }): Promise<AuthLoginResult>;
+/** CLI-only (ADR-028): the surface read the Clave from a NAMED environment variable or piped
+ *  stdin. ONE attempt; refused without contacting SII while the rejection latch is set for the
+ *  RUT. NEVER over MCP. */
+export declare function suppliedClaveLogin(runtime: Runtime, args: {
+    rut: string;
+    clave: string;
+    source: 'env' | 'stdin';
+}): Promise<AuthLoginResult>;
+/** CLI-only (ADR-028): lift the rejection latch, for one RUT or all. Local only. Kept off the
+ *  MCP on purpose: the latch exists so an unattended caller cannot retry a stale Clave, and
+ *  the reset is a human's act, never the model's. */
+export declare function unblockLogin(runtime: Runtime, args?: {
+    rut?: string;
+}): Promise<string[]>;
 export declare function logout(runtime: Runtime): Promise<AuthLogoutResult>;
 /** Pure local read (no portal call). The www2 layer's `authenticated` is decided by its stored
  *  cookie expiry against the clock. */
@@ -23,5 +37,5 @@ export declare function statusRefresh(runtime: Runtime): Promise<AuthIdentityRef
 /** whoami — the authenticated principal's own razón social/nombre + email (own PII).
  *  Live portal read; session-keyed (ignores the operate pointer). */
 export declare function whoami(runtime: Runtime): Promise<AuthWhoami>;
-export type { AuthIdentity, AuthIdentityRefresh, AuthLoginResult, AuthLogoutResult, AuthStatusLocal, AuthWhoami, AuthWww2Status, LoginOptions, };
+export type { AuthIdentity, AuthIdentityRefresh, AuthLoginResult, AuthLogoutResult, AuthStatusLocal, AuthWhoami, AuthWww2Status, LoginBlockEntry, LoginOptions, LoginSource, };
 //# sourceMappingURL=auth.d.ts.map

package/dist/tasks/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/tasks/auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,UAAU,EACV,cAAc,EACd,YAAY,EACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD;qGACqG;AACrG,wBAAgB,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,eAAe,CAAC,CAE5F;AAED;4EAC4E;AAC5E,wBAAgB,YAAY,CAC1B,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC1C,OAAO,CAAC,eAAe,CAAC,CAE1B;AAED;2FAC2F;AAC3F,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAE9F;AAED,wBAAgB,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAElE;AAED;uCACuC;AACvC,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,CAErE;AAED,mGAAmG;AACnG,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAE5E;AAED;qEACqE;AACrE,wBAAgB,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAE5D;AAED,YAAY,EACV,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,UAAU,EACV,cAAc,EACd,YAAY,GACb,CAAC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/tasks/auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,UAAU,EACV,cAAc,EACd,eAAe,EACf,YAAY,EACZ,WAAW,EACZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD;qGACqG;AACrG,wBAAgB,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,eAAe,CAAC,CAE5F;AAED;4EAC4E;AAC5E,wBAAgB,YAAY,CAC1B,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC1C,OAAO,CAAC,eAAe,CAAC,CAE1B;AAED;2FAC2F;AAC3F,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAE9F;AAED;;2BAE2B;AAC3B,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,KAAK,GAAG,OAAO,CAAA;CAAE,GAC5D,OAAO,CAAC,eAAe,CAAC,CAE1B;AAED;;qDAEqD;AACrD,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAE7F;AAED,wBAAgB,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAElE;AAED;uCACuC;AACvC,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,CAErE;AAED,mGAAmG;AACnG,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAE5E;AAED;qEACqE;AACrE,wBAAgB,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAE5D;AAED,YAAY,EACV,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,UAAU,EACV,cAAc,EACd,eAAe,EACf,YAAY,EACZ,WAAW,GACZ,CAAC"}

package/dist/tasks/auth.js

@@ -15,6 +15,18 @@ export function consoleLogin(runtime, credentials) {
 export function keyringLogin(runtime, args) {
     return auth.keyringLogin(runtime, args);
 }
+/** CLI-only (ADR-028): the surface read the Clave from a NAMED environment variable or piped
+ *  stdin. ONE attempt; refused without contacting SII while the rejection latch is set for the
+ *  RUT. NEVER over MCP. */
+export function suppliedClaveLogin(runtime, args) {
+    return auth.suppliedClaveLogin(runtime, args);
+}
+/** CLI-only (ADR-028): lift the rejection latch, for one RUT or all. Local only. Kept off the
+ *  MCP on purpose: the latch exists so an unattended caller cannot retry a stale Clave, and
+ *  the reset is a human's act, never the model's. */
+export function unblockLogin(runtime, args = {}) {
+    return auth.unblockLogin(runtime, args);
+}
 export function logout(runtime) {
     return auth.logout(runtime);
 }

package/dist/tasks/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/tasks/auth.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,OAAO,KAAK,IAAI,MAAM,kBAAkB,CAAC;AAazC;qGACqG;AACrG,MAAM,UAAU,KAAK,CAAC,OAAgB,EAAE,UAAwB,EAAE;IAChE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AACtC,CAAC;AAED;4EAC4E;AAC5E,MAAM,UAAU,YAAY,CAC1B,OAAgB,EAChB,WAA2C;IAE3C,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;AACjD,CAAC;AAED;2FAC2F;AAC3F,MAAM,UAAU,YAAY,CAAC,OAAgB,EAAE,IAAqB;IAClE,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,OAAgB;IACrC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED;uCACuC;AACvC,MAAM,UAAU,UAAU,CAAC,OAAgB;IACzC,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;qEACqE;AACrE,MAAM,UAAU,MAAM,CAAC,OAAgB;IACrC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/tasks/auth.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,OAAO,KAAK,IAAI,MAAM,kBAAkB,CAAC;AAezC;qGACqG;AACrG,MAAM,UAAU,KAAK,CAAC,OAAgB,EAAE,UAAwB,EAAE;IAChE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AACtC,CAAC;AAED;4EAC4E;AAC5E,MAAM,UAAU,YAAY,CAC1B,OAAgB,EAChB,WAA2C;IAE3C,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;AACjD,CAAC;AAED;2FAC2F;AAC3F,MAAM,UAAU,YAAY,CAAC,OAAgB,EAAE,IAAqB;IAClE,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED;;2BAE2B;AAC3B,MAAM,UAAU,kBAAkB,CAChC,OAAgB,EAChB,IAA6D;IAE7D,OAAO,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAChD,CAAC;AAED;;qDAEqD;AACrD,MAAM,UAAU,YAAY,CAAC,OAAgB,EAAE,OAAyB,EAAE;IACxE,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,OAAgB;IACrC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED;uCACuC;AACvC,MAAM,UAAU,UAAU,CAAC,OAAgB;IACzC,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;qEACqE;AACrE,MAAM,UAAU,MAAM,CAAC,OAAgB;IACrC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC"}

package/dist/tasks/bte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bte.d.ts","sourceRoot":"","sources":["../../src/tasks/bte.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAO5D,OAAO,KAAK,EAEV,UAAU,EAEV,UAAU,EACV,UAAU,EACX,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAc,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAE7D,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnF,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAuBjG;+DAC+D;AAC/D,wBAAsB,OAAO,CAC3B,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACvC,OAAO,CAAC,UAAU,CAAC,CAuBrB;AAID;;mGAEmG;AACnG,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC/E,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvF,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,uEAAuE;IACvE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,mDAAmD;IACnD,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,sFAAsF;AACtF,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAiED;;mDAEmD;AACnD,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAoB7F;AAED;;;;oEAIoE;AACpE,wBAAsB,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,CA2BzF"}
+{"version":3,"file":"bte.d.ts","sourceRoot":"","sources":["../../src/tasks/bte.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAO5D,OAAO,KAAK,EAEV,UAAU,EAEV,UAAU,EACV,UAAU,EACX,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAc,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAE7D,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnF,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAuBjG;+DAC+D;AAC/D,wBAAsB,OAAO,CAC3B,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACvC,OAAO,CAAC,UAAU,CAAC,CAyBrB;AAID;;mGAEmG;AACnG,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC/E,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvF,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,uEAAuE;IACvE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,mDAAmD;IACnD,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,sFAAsF;AACtF,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAiED;;mDAEmD;AACnD,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAoB7F;AAED;;;;oEAIoE;AACpE,wBAAsB,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,CA2BzF"}

package/dist/tasks/bte.js

@@ -7,7 +7,7 @@
 // it ignores the pointer and takes NO `--rut`. The período is validated locally BEFORE any
 // session. Pagination is paced via `Clock.sleep` (ADR-004); the facade reads inline JS maps via
 // `PortalSession.goto`/`evaluate` (not the SDI-JSON path).
-import { withSession } from '../auth/index.js';
+import { withBrowserSession, withSession } from '../auth/index.js';
 import { recordAudit } from '../audit/index.js';
 import { readOperateState } from '../identity/index.js';
 import { Periodo } from '../periodo/index.js';
@@ -39,7 +39,9 @@ export async function bteList(runtime, args) {
     await assertSelfOperating(runtime);
     const start = runtime.clock.now().getTime();
     try {
-        const res = await withSession(runtime, async (session, ctx) => fetchBteMensual(session, { rut: Rut.parse(ctx.sessionRut), periodo, side: args.side }, // session-keyed: the principal
+        // BTE list reads SII's inline JS maps (xml_values / arr_informe_mensual), so it needs the
+        // browser engine — unlike bte emit below, which is HTTP form-POSTs (ADR-027).
+        const res = await withBrowserSession(runtime, async (session, ctx) => fetchBteMensual(session, { rut: Rut.parse(ctx.sessionRut), periodo, side: args.side }, // session-keyed: the principal
         () => runtime.clock.sleep(pacingMs())));
         audit(runtime, 'bte_list', 'ok', {
             rut: res.rut,