@albertomarturelo/sii-core 0.3.0

package/dist/adapters/node/portal.js

@@ -0,0 +1,222 @@
+import { LOGIN_HOST, loginUrl } from '../../config/index.js';
+import { LoginFailedError } from '../../errors/index.js';
+import { parseSiiLoginError } from '../../auth/login-error.js';
+import { charsetOf, formLoginWallError, nonJsonResponseError } from './response.js';
+/** Lazy-load playwright — an OPTIONAL peer since ADR-016. Only the launch paths of
+ *  this default driver need it, so a consumer that injects its own PortalDriver (or
+ *  only uses the pure barrel) never pays the module. A missing install fails HERE,
+ *  at first actual use, with an actionable message — never at library import time.
+ *  Only the not-found case for 'playwright' itself is translated; any other failure
+ *  (a broken transitive import, etc.) propagates untouched. */
+async function loadChromium() {
+    try {
+        return (await import('playwright')).chromium;
+    }
+    catch (err) {
+        const code = err.code;
+        const notFound = code === 'ERR_MODULE_NOT_FOUND' || code === 'MODULE_NOT_FOUND';
+        if (notFound && err instanceof Error && err.message.includes('playwright')) {
+            throw new Error('El PortalDriver por defecto necesita `playwright` (peer opcional, ADR-016). ' +
+                'Instálalo en el proyecto consumidor: `npm i playwright` y luego ' +
+                '`npx playwright install chromium`.');
+        }
+        throw err;
+    }
+}
+/** Extract SII's verbatim login-error message from the failed-login page (rendered
+ *  on zeusr.sii.cl at /cgi_AUT2000/CAutInicio.cgi). Observed 2026-06-28: the page
+ *  shows "<causa>" then "El código de este mensaje es <código>" — the line BEFORE
+ *  the código line is the human cause (e.g. "La Clave Tributaria ingresada no es
+ *  correcta…"). Pass it through unchanged (CONVENTIONS); fall back to a clear,
+ *  no-retry message if the page shape changed. */
+async function readLoginError(page) {
+    const fallback = 'El SII rechazó el login (Clave incorrecta o cuenta bloqueada). NO reintentes a ciegas: ' +
+        'varios intentos fallidos bloquean la cuenta. Verifica tu Clave o usa `sii auth login`.';
+    try {
+        // Pull the rendered body text and parse in Node (testable; keeps the DOM out
+        // of core). The string expr returns a string, so the boundary cast is safe.
+        const body = (await page.evaluate('(document.body && document.body.innerText) || ""'));
+        return parseSiiLoginError(body) ?? fallback;
+    }
+    catch {
+        return fallback;
+    }
+}
+/** A session owns its browser; close() tears the whole instance down. */
+class PlaywrightPortalSession {
+    browser;
+    context;
+    page;
+    constructor(browser, context, page) {
+        this.browser = browser;
+        this.context = context;
+        this.page = page;
+    }
+    async goto(url) {
+        // domcontentloaded is enough: SII serves its state as inline scripts
+        // (e.g. DatosCntrNow), which have executed by this point.
+        await this.page.goto(url, { waitUntil: 'domcontentloaded' });
+        return this.page.url();
+    }
+    async evaluate(expression) {
+        return (await this.page.evaluate(expression));
+    }
+    async requestJson(url, options = {}) {
+        // Issue from the browser's APIRequestContext so the session cookies ride along
+        // (the SDI facades on www4.sii.cl authorize by the SPA session). domcontentloaded
+        // is irrelevant here — this is a raw XHR-equivalent, not a navigation.
+        const response = await this.context.request.fetch(url, {
+            method: options.method ?? 'POST',
+            ...(options.headers ? { headers: options.headers } : {}),
+            ...(options.body !== undefined ? { data: JSON.stringify(options.body) } : {}),
+        });
+        try {
+            return await response.json();
+        }
+        catch {
+            // A non-JSON body from an authenticated SDI POST means the dead session was
+            // bounced to SII's login wall — surface an actionable SessionExpiredError, not a
+            // parse error. No extra round-trip: this first SDI POST IS the liveness test.
+            // Classification is a pure helper so it is unit-tested (nonJsonResponseError).
+            throw nonJsonResponseError(response.url(), response.headers()['content-type'] ?? '', response.status());
+        }
+    }
+    async requestForm(url, options = {}) {
+        // Authenticated x-www-form-urlencoded POST from the browser's APIRequestContext,
+        // so the session cookies ride along (the legacy TMBECN_* emit CGIs on loa.sii.cl
+        // authorize by the SSO cookie). The response is HTML by design, so — unlike
+        // requestJson — a non-JSON body is NOT a login wall; a dead session is detected
+        // URL-based (the request bounced to LOGIN_HOST). `form` sets the urlencoded body
+        // + content-type automatically (Playwright).
+        const response = await this.context.request.fetch(url, {
+            method: options.method ?? 'POST',
+            ...(options.headers ? { headers: options.headers } : {}),
+            ...(options.form ? { form: options.form } : {}),
+        });
+        const wall = formLoginWallError(response.url());
+        if (wall)
+            throw wall;
+        const buffer = await response.body();
+        const text = new TextDecoder(charsetOf(response.headers()['content-type'])).decode(buffer);
+        return { status: response.status(), body: text };
+    }
+    async cookie(url, name) {
+        const cookies = await this.context.cookies(url);
+        return cookies.find((c) => c.name === name)?.value ?? null;
+    }
+    async storageState() {
+        // Cookies-only (ADR-006): drop localStorage/origins before persisting so no
+        // page-scoped data ever lands on disk.
+        const state = await this.context.storageState();
+        return { cookies: state.cookies };
+    }
+    async close() {
+        await this.browser.close();
+    }
+}
+export class PlaywrightPortalDriver {
+    async interactiveLogin(options) {
+        // HEADED: the user must see and type into SII's real Clave Tributaria page.
+        const chromium = await loadChromium();
+        const browser = await chromium.launch({ headless: false });
+        try {
+            const context = await browser.newContext();
+            const page = await context.newPage();
+            await page.goto(loginUrl(options.destination), { waitUntil: 'domcontentloaded' });
+            // Login completes when the browser redirects OFF the login host. Window
+            // close or timeout rejects (no partial session is ever written).
+            await page.waitForURL((url) => url.hostname !== LOGIN_HOST, {
+                timeout: options.timeoutMs,
+            });
+            return new PlaywrightPortalSession(browser, context, page);
+        }
+        catch {
+            // Close the whole browser on ANY failure so a launched instance never leaks.
+            await browser.close();
+            throw new LoginFailedError('Login no completado (tiempo agotado o ventana cerrada). Reintenta `sii auth login`.');
+        }
+    }
+    async credentialLogin(options) {
+        // HEADLESS (ADR-010): the user typed the Clave into the TERMINAL; we fill SII's
+        // real login form and let its own JS derive the hidden rut/dv + referencia and
+        // POST. We never hand-build the POST. The Clave is used only here — only cookies
+        // are persisted by the caller. ONE attempt, never retried (account-lock safety,
+        // ADR-004). Selectors observed 2026-06-28 (docs/sii-contract/auth-login.md):
+        //   #rutcntr (full RUT, text) · #clave (password) · #bt_ingresar (submit).
+        const chromium = await loadChromium();
+        const browser = await chromium.launch({ headless: true });
+        try {
+            const context = await browser.newContext();
+            const page = await context.newPage();
+            await page.goto(loginUrl(options.destination), { waitUntil: 'domcontentloaded' });
+            await page.fill('#rutcntr', options.rut);
+            await page.fill('#clave', options.clave);
+            // The submit POSTs to /cgi_AUT2000/CAutInicio.cgi (observed 2026-06-28). BOTH
+            // outcomes are a navigation that settles into a document: success redirects OFF
+            // the login host (→ Mi-SII); a rejected Clave / locked account stays ON
+            // zeusr.sii.cl and RENDERS the error page there. Wait for the settled document
+            // and decide by host — so a failure fails in seconds, never hanging to timeout.
+            await Promise.all([
+                page.waitForNavigation({ waitUntil: 'domcontentloaded', timeout: options.timeoutMs }),
+                page.click('#bt_ingresar'),
+            ]);
+            if (new URL(page.url()).hostname === LOGIN_HOST) {
+                // Rejected — surface SII's verbatim message (CONVENTIONS); do NOT retry.
+                throw new LoginFailedError(await readLoginError(page));
+            }
+            return new PlaywrightPortalSession(browser, context, page);
+        }
+        catch (err) {
+            await browser.close();
+            if (err instanceof LoginFailedError)
+                throw err; // already carries SII's message
+            throw new LoginFailedError('Login con Clave por consola no completado (el formulario del SII no respondió ' +
+                'o cambió). NO reintentes; usa `sii auth login` (navegador).');
+        }
+    }
+    async restore(storageState) {
+        // HEADLESS: cookies-only readback for liveness / portal reads. No UI.
+        const chromium = await loadChromium();
+        const browser = await chromium.launch({ headless: true });
+        try {
+            const context = await browser.newContext({
+                storageState: storageState,
+            });
+            const page = await context.newPage();
+            return new PlaywrightPortalSession(browser, context, page);
+        }
+        catch (err) {
+            // Don't leak the launched browser; surface the original error to the caller
+            // (probeLive / statusRefresh treat a failed restore as "not live").
+            await browser.close();
+            throw err;
+        }
+    }
+    async requestPublic(url, options = {}) {
+        // UNAUTHENTICATED public consulta (ADR-014): a cold HTTP request — no browser, no
+        // cookies, no session. Node's global fetch (undici) is the right tool; a public SII
+        // CGI needs nothing Chromium provides (the Python original used a plain httpx POST,
+        // and the endpoint requires no cookie / Referer / User-Agent — observed). Decode the
+        // body per the response's DECLARED charset so Latin-1 accents survive (the palena
+        // DTE report is ISO-8859-1, which a default UTF-8 decode would corrupt).
+        const headers = { ...options.headers };
+        let body;
+        if (options.form) {
+            body = new URLSearchParams(options.form).toString();
+            headers['Content-Type'] ??= 'application/x-www-form-urlencoded';
+        }
+        // Bound the request so a hung CGI fails loud instead of blocking the surface
+        // indefinitely (ADR-004 "never hang"); 30s mirrors the ported Python timeout. On
+        // timeout fetch rejects → the facade wraps it as DteError (no retry, ADR-004).
+        const response = await fetch(url, {
+            method: options.method ?? 'POST',
+            headers,
+            signal: AbortSignal.timeout(30_000),
+            ...(body !== undefined ? { body } : {}),
+        });
+        const buffer = await response.arrayBuffer();
+        const text = new TextDecoder(charsetOf(response.headers.get('content-type'))).decode(buffer);
+        return { status: response.status, body: text };
+    }
+}
+//# sourceMappingURL=portal.js.map

package/dist/adapters/node/portal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"portal.js","sourceRoot":"","sources":["../../../src/adapters/node/portal.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAYpF;;;;;+DAK+D;AAC/D,KAAK,UAAU,YAAY;IACzB,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;QACjD,MAAM,QAAQ,GAAG,IAAI,KAAK,sBAAsB,IAAI,IAAI,KAAK,kBAAkB,CAAC;QAChF,IAAI,QAAQ,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,KAAK,CACb,8EAA8E;gBAC5E,kEAAkE;gBAClE,oCAAoC,CACvC,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;kDAKkD;AAClD,KAAK,UAAU,cAAc,CAAC,IAAU;IACtC,MAAM,QAAQ,GACZ,yFAAyF;QACzF,wFAAwF,CAAC;IAC3F,IAAI,CAAC;QACH,6EAA6E;QAC7E,4EAA4E;QAC5E,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAC/B,kDAAkD,CACnD,CAAW,CAAC;QACb,OAAO,kBAAkB,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,uBAAuB;IAER;IACA;IACA;IAHnB,YACmB,OAAgB,EAChB,OAAuB,EACvB,IAAU;QAFV,YAAO,GAAP,OAAO,CAAS;QAChB,YAAO,GAAP,OAAO,CAAgB;QACvB,SAAI,GAAJ,IAAI,CAAM;IAC1B,CAAC;IAEJ,KAAK,CAAC,IAAI,CAAC,GAAW;QACpB,qEAAqE;QACrE,0DAA0D;QAC1D,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAI,UAAkB;QAClC,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAM,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAW,EAAE,UAAuB,EAAE;QACtD,+EAA+E;QAC/E,kFAAkF;QAClF,uEAAuE;QACvE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;YACrD,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,MAAM;YAChC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9E,CAAC,CAAC;QACH,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;YAC5E,iFAAiF;YACjF,8EAA8E;YAC9E,+EAA+E;YAC/E,MAAM,oBAAoB,CACxB,QAAQ,CAAC,GAAG,EAAE,EACd,QAAQ,CAAC,OAAO,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,EACxC,QAAQ,CAAC,MAAM,EAAE,CAClB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAW,EAAE,UAAuB,EAAE;QACtD,iFAAiF;QACjF,iFAAiF;QACjF,4EAA4E;QAC5E,gFAAgF;QAChF,iFAAiF;QACjF,6CAA6C;QAC7C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;YACrD,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,MAAM;YAChC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,kBAAkB,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QAChD,IAAI,IAAI;YAAE,MAAM,IAAI,CAAC;QACrB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3F,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,IAAY;QACpC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,4EAA4E;QAC5E,uCAAuC;QACvC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QAChD,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,OAAO,sBAAsB;IACjC,KAAK,CAAC,gBAAgB,CAAC,OAAgC;QACrD,4EAA4E;QAC5E,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAClF,wEAAwE;YACxE,iEAAiE;YACjE,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,UAAU,EAAE;gBAC1D,OAAO,EAAE,OAAO,CAAC,SAAS;aAC3B,CAAC,CAAC;YACH,OAAO,IAAI,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,6EAA6E;YAC7E,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;YACtB,MAAM,IAAI,gBAAgB,CACxB,qFAAqF,CACtF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,OAA+B;QACnD,gFAAgF;QAChF,+EAA+E;QAC/E,iFAAiF;QACjF,gFAAgF;QAChF,6EAA6E;QAC7E,2EAA2E;QAC3E,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAClF,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YACzC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACzC,8EAA8E;YAC9E,gFAAgF;YAChF,wEAAwE;YACxE,+EAA+E;YAC/E,gFAAgF;YAChF,MAAM,OAAO,CAAC,GAAG,CAAC;gBAChB,IAAI,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;gBACrF,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;aAC3B,CAAC,CAAC;YACH,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBAChD,yEAAyE;gBACzE,MAAM,IAAI,gBAAgB,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,IAAI,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;YACtB,IAAI,GAAG,YAAY,gBAAgB;gBAAE,MAAM,GAAG,CAAC,CAAC,gCAAgC;YAChF,MAAM,IAAI,gBAAgB,CACxB,gFAAgF;gBAC9E,6DAA6D,CAChE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,YAAqB;QACjC,sEAAsE;QACtE,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;gBACvC,YAAY,EAAE,YAAkE;aACjF,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;YACrC,OAAO,IAAI,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,4EAA4E;YAC5E,oEAAoE;YACpE,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;YACtB,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,GAAW,EAAE,UAAyB,EAAE;QAC1D,kFAAkF;QAClF,oFAAoF;QACpF,oFAAoF;QACpF,qFAAqF;QACrF,kFAAkF;QAClF,yEAAyE;QACzE,MAAM,OAAO,GAA2B,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;QAC/D,IAAI,IAAwB,CAAC;QAC7B,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,GAAG,IAAI,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YACpD,OAAO,CAAC,cAAc,CAAC,KAAK,mCAAmC,CAAC;QAClE,CAAC;QACD,6EAA6E;QAC7E,iFAAiF;QACjF,+EAA+E;QAC/E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,MAAM;YAChC,OAAO;YACP,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;YACnC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7F,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;CACF"}

package/dist/adapters/node/response.d.ts

@@ -0,0 +1,21 @@
+/** Classify a non-JSON SDI response. A dead/expired session makes an authenticated
+ *  SDI POST get bounced to SII's login wall (HTML) instead of JSON; detect it the same
+ *  URL-based way the rest of the auth flow does — landing on `LOGIN_HOST`, with an
+ *  HTML content-type fallback for a same-host wall (ADR-009) — and return an ACTIONABLE
+ *  `SessionExpiredError`. Anything else is a genuinely unexpected response → a generic
+ *  Error (the facade maps it to its own typed error). Pure, so it is unit-tested
+ *  without launching Playwright. */
+export declare function nonJsonResponseError(finalUrl: string, contentType: string, status: number): Error;
+/** Login-wall detection for an authenticated FORM POST (ADR-017). Unlike `requestJson`,
+ *  an HTML body is EXPECTED (the `TMBECN_*` emit CGIs render HTML), so the content-type
+ *  heuristic can't apply — a dead session is detected purely by the response landing on
+ *  `LOGIN_HOST` (URL-based, ADR-009). Returns an actionable `SessionExpiredError`, else
+ *  null. Pure → unit-tested without a browser. */
+export declare function formLoginWallError(finalUrl: string): Error | null;
+/** Extract the charset label from a `Content-Type` header for decoding a public
+ *  (unauthenticated) response body (ADR-014). SII's palena reports declare
+ *  `text/html; charset=ISO-8859-1`, so a UTF-8 decode would mangle accents (ó, é,
+ *  °) — we honour the DECLARED charset and fall back to UTF-8 when it is absent or
+ *  not a label `TextDecoder` accepts. Pure → unit-tested without launching fetch. */
+export declare function charsetOf(contentType: string | null | undefined): string;
+//# sourceMappingURL=response.d.ts.map

package/dist/adapters/node/response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"response.d.ts","sourceRoot":"","sources":["../../../src/adapters/node/response.ts"],"names":[],"mappings":"AAGA;;;;;;oCAMoC;AACpC,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,KAAK,CAOjG;AAED;;;;kDAIkD;AAClD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG,IAAI,CAIjE;AAED;;;;qFAIqF;AACrF,wBAAgB,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAYxE"}

package/dist/adapters/node/response.js

@@ -0,0 +1,48 @@
+import { LOGIN_HOST } from '../../config/index.js';
+import { SessionExpiredError } from '../../errors/index.js';
+/** Classify a non-JSON SDI response. A dead/expired session makes an authenticated
+ *  SDI POST get bounced to SII's login wall (HTML) instead of JSON; detect it the same
+ *  URL-based way the rest of the auth flow does — landing on `LOGIN_HOST`, with an
+ *  HTML content-type fallback for a same-host wall (ADR-009) — and return an ACTIONABLE
+ *  `SessionExpiredError`. Anything else is a genuinely unexpected response → a generic
+ *  Error (the facade maps it to its own typed error). Pure, so it is unit-tested
+ *  without launching Playwright. */
+export function nonJsonResponseError(finalUrl, contentType, status) {
+    const ct = contentType.toLowerCase();
+    const bouncedToLogin = new URL(finalUrl).hostname === LOGIN_HOST;
+    if (bouncedToLogin || ct.includes('text/html')) {
+        return new SessionExpiredError('La sesión expiró. Ejecuta `sii auth login`.');
+    }
+    return new Error(`Respuesta no-JSON de SII (HTTP ${status}, ${ct || 'sin content-type'}).`);
+}
+/** Login-wall detection for an authenticated FORM POST (ADR-017). Unlike `requestJson`,
+ *  an HTML body is EXPECTED (the `TMBECN_*` emit CGIs render HTML), so the content-type
+ *  heuristic can't apply — a dead session is detected purely by the response landing on
+ *  `LOGIN_HOST` (URL-based, ADR-009). Returns an actionable `SessionExpiredError`, else
+ *  null. Pure → unit-tested without a browser. */
+export function formLoginWallError(finalUrl) {
+    return new URL(finalUrl).hostname === LOGIN_HOST
+        ? new SessionExpiredError('La sesión expiró. Ejecuta `sii auth login`.')
+        : null;
+}
+/** Extract the charset label from a `Content-Type` header for decoding a public
+ *  (unauthenticated) response body (ADR-014). SII's palena reports declare
+ *  `text/html; charset=ISO-8859-1`, so a UTF-8 decode would mangle accents (ó, é,
+ *  °) — we honour the DECLARED charset and fall back to UTF-8 when it is absent or
+ *  not a label `TextDecoder` accepts. Pure → unit-tested without launching fetch. */
+export function charsetOf(contentType) {
+    const label = /charset=([^;]+)/i
+        .exec(contentType ?? '')?.[1]
+        ?.trim()
+        .replace(/^["']|["']$/g, '');
+    if (!label)
+        return 'utf-8';
+    try {
+        new TextDecoder(label); // validate the label; an unknown one throws RangeError
+        return label;
+    }
+    catch {
+        return 'utf-8';
+    }
+}
+//# sourceMappingURL=response.js.map

package/dist/adapters/node/response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response.js","sourceRoot":"","sources":["../../../src/adapters/node/response.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D;;;;;;oCAMoC;AACpC,MAAM,UAAU,oBAAoB,CAAC,QAAgB,EAAE,WAAmB,EAAE,MAAc;IACxF,MAAM,EAAE,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC;IACjE,IAAI,cAAc,IAAI,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,mBAAmB,CAAC,6CAA6C,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,kCAAkC,MAAM,KAAK,EAAE,IAAI,kBAAkB,IAAI,CAAC,CAAC;AAC9F,CAAC;AAED;;;;kDAIkD;AAClD,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,QAAQ,KAAK,UAAU;QAC9C,CAAC,CAAC,IAAI,mBAAmB,CAAC,6CAA6C,CAAC;QACxE,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;;qFAIqF;AACrF,MAAM,UAAU,SAAS,CAAC,WAAsC;IAC9D,MAAM,KAAK,GAAG,kBAAkB;SAC7B,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7B,EAAE,IAAI,EAAE;SACP,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC;IAC3B,IAAI,CAAC;QACH,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,uDAAuD;QAC/E,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC"}

package/dist/audit/audit.d.ts

@@ -0,0 +1,8 @@
+import type { AuditEntry, AuditSink, Clock } from '../seams/index.js';
+/** Compose the final receipt: stamp `ts` from the clock, drop secret-substring
+ *  keys, hand it to the sink. Never throws (the sink is best-effort). (ADR-004) */
+export declare function recordAudit(deps: {
+    clock: Clock;
+    audit: AuditSink;
+}, entry: AuditEntry): void;
+//# sourceMappingURL=audit.d.ts.map

package/dist/audit/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/audit/audit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAMtE;mFACmF;AACnF,wBAAgB,WAAW,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,SAAS,CAAA;CAAE,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAO7F"}

package/dist/audit/audit.js

@@ -0,0 +1,15 @@
+/** Keys whose presence (substring, case-insensitive) means "secret" — dropped
+ *  before the line hits the sink. RUTs are NOT secrets and pass through. */
+const SECRET_KEY = /password|clave|cookie|secret|token/i;
+/** Compose the final receipt: stamp `ts` from the clock, drop secret-substring
+ *  keys, hand it to the sink. Never throws (the sink is best-effort). (ADR-004) */
+export function recordAudit(deps, entry) {
+    const safe = { ts: deps.clock.now().toISOString() };
+    for (const [k, v] of Object.entries(entry)) {
+        if (SECRET_KEY.test(k))
+            continue;
+        safe[k] = v;
+    }
+    deps.audit.record(safe);
+}
+//# sourceMappingURL=audit.js.map

package/dist/audit/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/audit/audit.ts"],"names":[],"mappings":"AAEA;4EAC4E;AAC5E,MAAM,UAAU,GAAG,qCAAqC,CAAC;AAEzD;mFACmF;AACnF,MAAM,UAAU,WAAW,CAAC,IAAwC,EAAE,KAAiB;IACrF,MAAM,IAAI,GAA4B,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IAC7E,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,SAAS;QACjC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAkB,CAAC,CAAC;AACxC,CAAC"}

package/dist/audit/index.d.ts

@@ -0,0 +1,2 @@
+export * from './audit.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/audit/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC"}

package/dist/audit/index.js

@@ -0,0 +1,2 @@
+export * from './audit.js';
+//# sourceMappingURL=index.js.map

package/dist/audit/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC"}

package/dist/auth/auth.d.ts

@@ -0,0 +1,43 @@
+import type { AccountType } from '../identity/index.js';
+import type { Runtime } from '../seams/index.js';
+export interface AuthIdentity {
+    readonly rut: string;
+    readonly nombre: string | null;
+    readonly accountType: AccountType;
+}
+export interface AuthStatusLocal {
+    /** LOCAL-only: a cookie jar exists on disk. NOT a server-side liveness claim. */
+    readonly authenticated: boolean;
+    readonly rut: string | null;
+    readonly sessionSource: 'cached' | 'none';
+}
+export interface AuthLoginResult {
+    readonly authenticated: true;
+    readonly rut: string;
+    readonly reason: 'browser_login' | 'console_login' | 'already_authenticated';
+}
+export interface AuthLogoutResult {
+    readonly loggedOut: boolean;
+    readonly serverClosed: boolean;
+}
+/** Pure local read — NO portal call (sii-py "local-only" labelling). */
+export declare function localStatus(store: Runtime['store']): Promise<AuthStatusLocal>;
+/** Browser cookies-only login (ADR-006). Only this + `consoleLogin` mint a session
+ *  (ADR-019 lineage). Idempotent: a live cached session returns
+ *  `already_authenticated` without opening a window. */
+export declare function login(runtime: Runtime): Promise<AuthLoginResult>;
+/** CLI-only console login (ADR-010): the Clave is typed into the TERMINAL, used
+ *  once to fill SII's real form headless, and never persisted — only cookies are
+ *  stored, exactly like the browser path. ONE attempt, never retried (ADR-004).
+ *  The Clave never reaches MCP (this task is CLI-only) nor the audit log. */
+export declare function consoleLogin(runtime: Runtime, credentials: {
+    rut: string;
+    clave: string;
+}): Promise<AuthLoginResult>;
+/** Server-side close (best-effort) + wipe local session + operate context. */
+export declare function logout(runtime: Runtime): Promise<AuthLogoutResult>;
+/** Curated identity readback from the portal. Requires a live session (no implicit
+ *  login) — acquired via `withSession`; here an expired jar is an explicit
+ *  NotAuthenticated (URL-based detection), since the whole job is the readback. */
+export declare function statusRefresh(runtime: Runtime): Promise<AuthIdentity>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/auth/auth.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAiB,MAAM,sBAAsB,CAAC;AAGvE,OAAO,KAAK,EAAiB,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAsBhE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;CACnC;AAED,MAAM,WAAW,eAAe;IAC9B,iFAAiF;IACjF,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC3C;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,GAAG,uBAAuB,CAAC;CAC9E;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAED,wEAAwE;AACxE,wBAAsB,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC,CAKnF;AA+HD;;wDAEwD;AACxD,wBAAsB,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,CAkBtE;AAED;;;6EAG6E;AAC7E,wBAAsB,YAAY,CAChC,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC1C,OAAO,CAAC,eAAe,CAAC,CAoB1B;AAED,8EAA8E;AAC9E,wBAAsB,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAuBxE;AAED;;mFAEmF;AACnF,wBAAsB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CAS3E"}

package/dist/auth/auth.js

@@ -0,0 +1,219 @@
+import { HOSTS, LOGIN_HOST, LOGOUT_URL } from '../config/index.js';
+import { LoginFailedError, NotAuthenticatedError } from '../errors/index.js';
+import { Rut } from '../rut/index.js';
+import { recordAudit } from '../audit/index.js';
+import { clearOperateState, initOperateState } from '../identity/index.js';
+import { fetchEmpresasAutorizadas } from '../portal/representacion.js';
+import { deleteSession, readSession, withSession, writeSession } from './session.js';
+const DEFAULT_LOGIN_TIMEOUT_MS = 180_000;
+// Console login submits machine-fast (no human typing in the browser) and fails
+// fast on a rejected Clave, so it needs a far smaller budget than the headed flow.
+const CONSOLE_LOGIN_TIMEOUT_MS = 60_000;
+// The Mi-SII landing serves this inline JS object with the contribuyente snapshot.
+const DATOS_EXPR = "typeof DatosCntrNow !== 'undefined' ? DatosCntrNow : null";
+/** Pure local read — NO portal call (sii-py "local-only" labelling). */
+export async function localStatus(store) {
+    const session = await readSession(store);
+    return session
+        ? { authenticated: true, rut: session.rut, sessionSource: 'cached' }
+        : { authenticated: false, rut: null, sessionSource: 'none' };
+}
+function identityFromDatos(datos) {
+    const c = datos?.contribuyente;
+    if (!c || c.rut === undefined || c.dv === undefined) {
+        throw new LoginFailedError('No se pudo leer la identidad del portal (DatosCntrNow ausente).');
+    }
+    const rut = Rut.parse(`${c.rut}-${c.dv}`).canonical;
+    const accountType = c.razonSocial ? 'empresa' : 'persona';
+    const joined = [c.nombres, c.apellidoPaterno, c.apellidoMaterno].filter(Boolean).join(' ').trim();
+    const nombre = c.razonSocial ?? (joined || null);
+    return { rut, nombre, accountType };
+}
+function landedOnLoginHost(landed) {
+    return new URL(landed).hostname === LOGIN_HOST;
+}
+/** The session-principal RUT if the cached session is still live on the portal, else
+ *  null — never throws (the login path needs "is it warm?", not an error). A single
+ *  `withSession` acquisition (no separate pre-read); a missing/expired session → null. */
+async function liveSessionRut(runtime) {
+    try {
+        return await withSession(runtime, async (s, ctx) => landedOnLoginHost(await s.goto(HOSTS.miSii)) ? null : ctx.sessionRut);
+    }
+    catch {
+        return null;
+    }
+}
+/** If a cached session is still live, return `already_authenticated` (no mint).
+ *  Shared by both login paths so neither re-mints over a warm session. */
+async function reuseLiveSession(runtime) {
+    const rut = await liveSessionRut(runtime);
+    if (rut) {
+        recordAudit(runtime, {
+            action: 'auth_login',
+            result: 'ok',
+            rut,
+            reason: 'already_authenticated',
+        });
+        return { authenticated: true, rut, reason: 'already_authenticated' };
+    }
+    return null;
+}
+/** Best-effort operable-set fetch on login (ADR-005). Persona accounts ask SII for
+ *  the empresas they can operate (getDcvEmpresasAutorizadas); empresa accounts have
+ *  no representación, so operable = [self]. ANY failure degrades to [self] — a login
+ *  must never fail because the operable lookup did. Razón social is PII → never
+ *  audited (only the count). */
+async function resolveOperable(runtime, session, identity) {
+    const self = {
+        rut: identity.rut,
+        razonSocial: identity.nombre ?? identity.rut,
+        isSelf: true,
+    };
+    if (identity.accountType === 'empresa')
+        return [self];
+    try {
+        const { empresas } = await fetchEmpresasAutorizadas(session, identity.rut);
+        const entries = empresas
+            .filter((e) => e.rut !== null)
+            .map((e) => ({
+            rut: e.rut,
+            razonSocial: e.razonSocial ?? e.rut,
+            isSelf: e.rut === identity.rut,
+        }));
+        // The endpoint includes self, but be defensive: guarantee exactly one self row.
+        const operable = entries.some((e) => e.isSelf) ? entries : [self, ...entries];
+        recordAudit(runtime, {
+            action: 'operable_fetch',
+            result: 'ok',
+            rut: identity.rut,
+            count: operable.length,
+        });
+        return operable;
+    }
+    catch {
+        recordAudit(runtime, { action: 'operable_fetch', result: 'failed', rut: identity.rut });
+        return [self];
+    }
+}
+/** Turn a freshly-minted PortalSession into a persisted cookies-only session:
+ *  confirm we landed off the login host, read identity, persist cookies (NO
+ *  secret), default operate to self. Shared by the browser + console paths. */
+async function finalizeFreshSession(runtime, session, reason, start) {
+    const landed = await session.goto(HOSTS.miSii);
+    if (landedOnLoginHost(landed)) {
+        throw new LoginFailedError('Login no completado (seguimos en la página de autenticación).');
+    }
+    const datos = await session.evaluate(DATOS_EXPR);
+    const identity = identityFromDatos(datos);
+    const cookies = await session.storageState();
+    await writeSession(runtime.store, {
+        rut: identity.rut,
+        cookies,
+        savedAt: runtime.clock.now().toISOString(),
+    });
+    // Operate defaults to self; the operable set is fetched best-effort (ADR-005).
+    const operable = await resolveOperable(runtime, session, identity);
+    await initOperateState(runtime.store, {
+        selfRut: identity.rut,
+        accountType: identity.accountType,
+        operable,
+    });
+    recordAudit(runtime, {
+        action: 'auth_login',
+        result: 'ok',
+        rut: identity.rut,
+        reason,
+        durationMs: runtime.clock.now().getTime() - start,
+    });
+    return { authenticated: true, rut: identity.rut, reason };
+}
+/** Browser cookies-only login (ADR-006). Only this + `consoleLogin` mint a session
+ *  (ADR-019 lineage). Idempotent: a live cached session returns
+ *  `already_authenticated` without opening a window. */
+export async function login(runtime) {
+    const start = runtime.clock.now().getTime();
+    const warm = await reuseLiveSession(runtime);
+    if (warm)
+        return warm;
+    let session = null;
+    try {
+        session = await runtime.portal.interactiveLogin({
+            destination: HOSTS.miSii,
+            timeoutMs: DEFAULT_LOGIN_TIMEOUT_MS,
+        });
+        return await finalizeFreshSession(runtime, session, 'browser_login', start);
+    }
+    catch (err) {
+        recordAudit(runtime, { action: 'auth_login', result: 'failed', reason: 'browser_login' });
+        throw err;
+    }
+    finally {
+        await session?.close();
+    }
+}
+/** CLI-only console login (ADR-010): the Clave is typed into the TERMINAL, used
+ *  once to fill SII's real form headless, and never persisted — only cookies are
+ *  stored, exactly like the browser path. ONE attempt, never retried (ADR-004).
+ *  The Clave never reaches MCP (this task is CLI-only) nor the audit log. */
+export async function consoleLogin(runtime, credentials) {
+    const start = runtime.clock.now().getTime();
+    const warm = await reuseLiveSession(runtime);
+    if (warm)
+        return warm;
+    let session = null;
+    try {
+        session = await runtime.portal.credentialLogin({
+            rut: credentials.rut,
+            clave: credentials.clave,
+            destination: HOSTS.miSii,
+            timeoutMs: CONSOLE_LOGIN_TIMEOUT_MS,
+        });
+        return await finalizeFreshSession(runtime, session, 'console_login', start);
+    }
+    catch (err) {
+        recordAudit(runtime, { action: 'auth_login', result: 'failed', reason: 'console_login' });
+        throw err;
+    }
+    finally {
+        await session?.close();
+    }
+}
+/** Server-side close (best-effort) + wipe local session + operate context. */
+export async function logout(runtime) {
+    const session = await readSession(runtime.store);
+    if (!session) {
+        recordAudit(runtime, { action: 'logout', result: 'ok', serverClosed: false });
+        return { loggedOut: false, serverClosed: false };
+    }
+    let serverClosed = false;
+    let s = null;
+    try {
+        s = await runtime.portal.restore(session.cookies);
+        const landed = await s.goto(LOGOUT_URL);
+        serverClosed = new URL(landed).pathname !== new URL(LOGOUT_URL).pathname;
+    }
+    catch {
+        // best-effort server close; the local wipe still runs
+    }
+    finally {
+        await s?.close();
+    }
+    await deleteSession(runtime.store);
+    await clearOperateState(runtime.store);
+    recordAudit(runtime, { action: 'logout', result: 'ok', rut: session.rut, serverClosed });
+    return { loggedOut: true, serverClosed };
+}
+/** Curated identity readback from the portal. Requires a live session (no implicit
+ *  login) — acquired via `withSession`; here an expired jar is an explicit
+ *  NotAuthenticated (URL-based detection), since the whole job is the readback. */
+export async function statusRefresh(runtime) {
+    return withSession(runtime, async (s) => {
+        if (landedOnLoginHost(await s.goto(HOSTS.miSii))) {
+            throw new NotAuthenticatedError('La sesión expiró. Ejecuta `sii auth login`.');
+        }
+        const identity = identityFromDatos(await s.evaluate(DATOS_EXPR));
+        recordAudit(runtime, { action: 'auth_status_refresh', result: 'ok', rut: identity.rut });
+        return identity;
+    });
+}
+//# sourceMappingURL=auth.js.map