@albertomarturelo/sii-core 0.3.0

package/dist/auth/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAGvE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAErF,MAAM,wBAAwB,GAAG,OAAO,CAAC;AACzC,gFAAgF;AAChF,mFAAmF;AACnF,MAAM,wBAAwB,GAAG,MAAM,CAAC;AACxC,mFAAmF;AACnF,MAAM,UAAU,GAAG,2DAA2D,CAAC;AAsC/E,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAuB;IACvD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,OAAO;QACZ,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,aAAa,EAAE,QAAQ,EAAE;QACpE,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAuB;IAChD,MAAM,CAAC,GAAG,KAAK,EAAE,aAAa,CAAC;IAC/B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;QACpD,MAAM,IAAI,gBAAgB,CAAC,iEAAiE,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC;IACpD,MAAM,WAAW,GAAgB,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAClG,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;IACjD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC;AACjD,CAAC;AAED;;0FAE0F;AAC1F,KAAK,UAAU,cAAc,CAAC,OAAgB;IAC5C,IAAI,CAAC;QACH,OAAO,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,CACjD,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CACrE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;0EAC0E;AAC1E,KAAK,UAAU,gBAAgB,CAAC,OAAgB;IAC9C,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,GAAG,EAAE,CAAC;QACR,WAAW,CAAC,OAAO,EAAE;YACnB,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,IAAI;YACZ,GAAG;YACH,MAAM,EAAE,uBAAuB;SAChC,CAAC,CAAC;QACH,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;gCAIgC;AAChC,KAAK,UAAU,eAAe,CAC5B,OAAgB,EAChB,OAAsB,EACtB,QAAsB;IAEtB,MAAM,IAAI,GAAkB;QAC1B,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,WAAW,EAAE,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,GAAG;QAC5C,MAAM,EAAE,IAAI;KACb,CAAC;IACF,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC3E,MAAM,OAAO,GAAoB,QAAQ;aACtC,MAAM,CAAC,CAAC,CAAC,EAA4C,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC;aACvE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG;YACnC,MAAM,EAAE,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG;SAC/B,CAAC,CAAC,CAAC;QACN,gFAAgF;QAChF,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,CAAC;QAC9E,WAAW,CAAC,OAAO,EAAE;YACnB,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,IAAI;YACZ,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,KAAK,EAAE,QAAQ,CAAC,MAAM;SACvB,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QACxF,OAAO,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;+EAE+E;AAC/E,KAAK,UAAU,oBAAoB,CACjC,OAAgB,EAChB,OAAsB,EACtB,MAAyC,EACzC,KAAa;IAEb,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,gBAAgB,CAAC,+DAA+D,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAmB,UAAU,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;IAC7C,MAAM,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE;QAChC,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,OAAO;QACP,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;KAC3C,CAAC,CAAC;IAEH,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACnE,MAAM,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE;QACpC,OAAO,EAAE,QAAQ,CAAC,GAAG;QACrB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,QAAQ;KACT,CAAC,CAAC;IAEH,WAAW,CAAC,OAAO,EAAE;QACnB,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,IAAI;QACZ,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,MAAM;QACN,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK;KAClD,CAAC,CAAC;IACH,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC;AAC5D,CAAC;AAED;;wDAEwD;AACxD,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,OAAgB;IAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAEtB,IAAI,OAAO,GAAyB,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC;YAC9C,WAAW,EAAE,KAAK,CAAC,KAAK;YACxB,SAAS,EAAE,wBAAwB;SACpC,CAAC,CAAC;QACH,OAAO,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QAC1F,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED;;;6EAG6E;AAC7E,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAgB,EAChB,WAA2C;IAE3C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAEtB,IAAI,OAAO,GAAyB,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC;YAC7C,GAAG,EAAE,WAAW,CAAC,GAAG;YACpB,KAAK,EAAE,WAAW,CAAC,KAAK;YACxB,WAAW,EAAE,KAAK,CAAC,KAAK;YACxB,SAAS,EAAE,wBAAwB;SACpC,CAAC,CAAC;QACH,OAAO,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QAC1F,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAgB;IAC3C,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IACnD,CAAC;IAED,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,CAAC,GAAyB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxC,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,MAAM,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACvC,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;IACzF,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AAC3C,CAAC;AAED;;mFAEmF;AACnF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAgB;IAClD,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,qBAAqB,CAAC,6CAA6C,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAmB,UAAU,CAAC,CAAC,CAAC;QACnF,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QACzF,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,3 @@
+export * from './auth.js';
+export * from './session.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC"}

package/dist/auth/index.js

@@ -0,0 +1,3 @@
+export * from './auth.js';
+export * from './session.js';
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC"}

package/dist/auth/login-error.d.ts

@@ -0,0 +1,8 @@
+/** Extract SII's verbatim login-error cause from the failed-login page body text.
+ *  Observed 2026-06-28 (docs/sii-contract/auth-login.md): the page renders the
+ *  human cause, then a line `El código de este mensaje es <código>`. The line
+ *  BEFORE the código line is the cause (e.g. "La Clave Tributaria ingresada no es
+ *  correcta…"). Returns `"<causa> (<código line>)"`, or `null` if the shape
+ *  changed (the caller falls back to a generic no-retry message). */
+export declare function parseSiiLoginError(bodyText: string): string | null;
+//# sourceMappingURL=login-error.d.ts.map

package/dist/auth/login-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-error.d.ts","sourceRoot":"","sources":["../../src/auth/login-error.ts"],"names":[],"mappings":"AAIA;;;;;qEAKqE;AACrE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOlE"}

package/dist/auth/login-error.js

@@ -0,0 +1,18 @@
+// Pure parser for SII's failed-login page (rendered on zeusr.sii.cl at
+// /cgi_AUT2000/CAutInicio.cgi). Kept DOM-free so it is unit-testable in Node;
+// the Playwright adapter passes it the page's `innerText` (adapters/node/portal.ts).
+/** Extract SII's verbatim login-error cause from the failed-login page body text.
+ *  Observed 2026-06-28 (docs/sii-contract/auth-login.md): the page renders the
+ *  human cause, then a line `El código de este mensaje es <código>`. The line
+ *  BEFORE the código line is the cause (e.g. "La Clave Tributaria ingresada no es
+ *  correcta…"). Returns `"<causa> (<código line>)"`, or `null` if the shape
+ *  changed (the caller falls back to a generic no-retry message). */
+export function parseSiiLoginError(bodyText) {
+    const lines = bodyText
+        .split('\n')
+        .map((l) => l.trim())
+        .filter(Boolean);
+    const i = lines.findIndex((l) => /El c[oó]digo de este mensaje/i.test(l));
+    return i > 0 ? `${lines[i - 1]} (${lines[i]})` : null;
+}
+//# sourceMappingURL=login-error.js.map

package/dist/auth/login-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-error.js","sourceRoot":"","sources":["../../src/auth/login-error.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,8EAA8E;AAC9E,qFAAqF;AAErF;;;;;qEAKqE;AACrE,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,MAAM,KAAK,GAAG,QAAQ;SACnB,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC"}

package/dist/auth/session.d.ts

@@ -0,0 +1,31 @@
+import type { KeyValueStore, PortalSession, Runtime } from '../seams/index.js';
+export interface StoredSession {
+    /** Canonical session-principal RUT (read from the portal, not a credential). */
+    readonly rut: string;
+    /** Cookies-only storage state (opaque to the core). */
+    readonly cookies: unknown;
+    readonly savedAt: string;
+}
+export declare function readSession(store: KeyValueStore): Promise<StoredSession | null>;
+export declare function writeSession(store: KeyValueStore, session: StoredSession): Promise<void>;
+export declare function deleteSession(store: KeyValueStore): Promise<void>;
+export interface SessionContext {
+    /** Canonical session-principal RUT (who is logged in). */
+    readonly sessionRut: string;
+    /** Canonical RUT this operation acts as: `--rut` override > operate pointer > self
+     *  (ADR-005). Body-RUT facades put this in the request; session-keyed surfaces
+     *  ignore it and authorize by `sessionRut`. */
+    readonly operatingRut: string;
+}
+/** Acquire a live `PortalSession` from the stored cookies-only session and run `fn`
+ *  against it. This is how DOMAIN TASKS reach SII: they consume a session, they
+ *  NEVER mint one (only `login` mints — ADR-006, sii-py ADR-019). The operating/body
+ *  RUT is resolved by precedence (override > pointer > self — ADR-005) and handed to
+ *  `fn`. The session is ALWAYS closed; a missing local session raises
+ *  `NotAuthenticated`. It does NOT eagerly probe liveness — an expired cookie jar
+ *  surfaces as the facade's own typed error (representacion.ts) — and it NEVER
+ *  retries after a SII block (CONVENTIONS). */
+export declare function withSession<T>(runtime: Runtime, fn: (session: PortalSession, ctx: SessionContext) => Promise<T>, options?: {
+    rut?: string;
+}): Promise<T>;
+//# sourceMappingURL=session.d.ts.map

package/dist/auth/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAK/E,MAAM,WAAW,aAAa;IAC5B,gFAAgF;IAChF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAsB,WAAW,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAErF;AAED,wBAAsB,YAAY,CAAC,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9F;AAED,wBAAsB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvE;AAED,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;mDAE+C;IAC/C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;+CAO+C;AAC/C,wBAAsB,WAAW,CAAC,CAAC,EACjC,OAAO,EAAE,OAAO,EAChB,EAAE,EAAE,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,CAAC,CAAC,EAC/D,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7B,OAAO,CAAC,CAAC,CAAC,CA4BZ"}

package/dist/auth/session.js

@@ -0,0 +1,52 @@
+import { NotAuthenticatedError } from '../errors/index.js';
+import { readOperateState, resolveOperableTarget } from '../identity/index.js';
+// Distinct KeyValueStore key (ADR-007) — never shares a file with `identity`'s 'operate'.
+const SESSION_KEY = 'session';
+export async function readSession(store) {
+    return store.read(SESSION_KEY);
+}
+export async function writeSession(store, session) {
+    await store.write(SESSION_KEY, session);
+}
+export async function deleteSession(store) {
+    await store.delete(SESSION_KEY);
+}
+/** Acquire a live `PortalSession` from the stored cookies-only session and run `fn`
+ *  against it. This is how DOMAIN TASKS reach SII: they consume a session, they
+ *  NEVER mint one (only `login` mints — ADR-006, sii-py ADR-019). The operating/body
+ *  RUT is resolved by precedence (override > pointer > self — ADR-005) and handed to
+ *  `fn`. The session is ALWAYS closed; a missing local session raises
+ *  `NotAuthenticated`. It does NOT eagerly probe liveness — an expired cookie jar
+ *  surfaces as the facade's own typed error (representacion.ts) — and it NEVER
+ *  retries after a SII block (CONVENTIONS). */
+export async function withSession(runtime, fn, options = {}) {
+    const stored = await readSession(runtime.store);
+    if (!stored) {
+        throw new NotAuthenticatedError('No hay sesión. Ejecuta `sii auth login`.');
+    }
+    // Resolve the operating/body RUT (ADR-005). A `--rut` override is the same
+    // value-domain as the operate pointer, so it is validated against the operable set
+    // HERE (empresa account / out-of-set RUT rejected locally, not round-tripped to SII)
+    // — the single enforcement point for per-call `--rut`. No override → the operate
+    // pointer; missing operate state alongside a session is broken → re-login.
+    const operateState = await readOperateState(runtime.store);
+    let operatingRut;
+    if (options.rut !== undefined) {
+        if (!operateState) {
+            throw new NotAuthenticatedError('No hay sesión. Ejecuta `sii auth login`.');
+        }
+        operatingRut = resolveOperableTarget(operateState, options.rut);
+    }
+    else {
+        operatingRut = operateState?.operatingRut ?? stored.rut;
+    }
+    let s = null;
+    try {
+        s = await runtime.portal.restore(stored.cookies);
+        return await fn(s, { sessionRut: stored.rut, operatingRut });
+    }
+    finally {
+        await s?.close();
+    }
+}
+//# sourceMappingURL=session.js.map

package/dist/auth/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAG/E,0FAA0F;AAC1F,MAAM,WAAW,GAAG,SAAS,CAAC;AAU9B,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAoB;IACpD,OAAO,KAAK,CAAC,IAAI,CAAgB,WAAW,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAoB,EAAE,OAAsB;IAC7E,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAoB;IACtD,MAAM,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAClC,CAAC;AAWD;;;;;;;+CAO+C;AAC/C,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAgB,EAChB,EAA+D,EAC/D,UAA4B,EAAE;IAE9B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,qBAAqB,CAAC,0CAA0C,CAAC,CAAC;IAC9E,CAAC;IACD,2EAA2E;IAC3E,mFAAmF;IACnF,qFAAqF;IACrF,iFAAiF;IACjF,2EAA2E;IAC3E,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3D,IAAI,YAAoB,CAAC;IACzB,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,qBAAqB,CAAC,0CAA0C,CAAC,CAAC;QAC9E,CAAC;QACD,YAAY,GAAG,qBAAqB,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAClE,CAAC;SAAM,CAAC;QACN,YAAY,GAAG,YAAY,EAAE,YAAY,IAAI,MAAM,CAAC,GAAG,CAAC;IAC1D,CAAC;IAED,IAAI,CAAC,GAAyB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjD,OAAO,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;IAC/D,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+export { consoleLogin } from './tasks/auth.js';
+export type { AuthLoginResult } from './tasks/auth.js';
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/cli.js

@@ -0,0 +1,6 @@
+// CLI-ONLY surface of @albertomarturelo/sii-core (subpath `@albertomarturelo/sii-core/cli`). `consoleLogin` accepts
+// a Clave argument, so it is DELIBERATELY kept out of the main barrel (`@albertomarturelo/sii-core`)
+// — the MCP server imports only the main barrel and must never wire a task that
+// takes a password (ADR-006). The terminal CLI imports this subpath instead.
+export { consoleLogin } from './tasks/auth.js';
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,oHAAoH;AACpH,qGAAqG;AACrG,gFAAgF;AAChF,6EAA6E;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/config/config.d.ts

@@ -0,0 +1,38 @@
+export declare const HOSTS: {
+    /** Clave Tributaria login host. Landing here ⇒ NOT authenticated (URL-based detection). */
+    readonly login: "https://zeusr.sii.cl";
+    /** Login page path; takes the post-login destination as an UNKEYED query string (observed). */
+    readonly loginPath: "/AUT2000/InicioAutenticacion/IngresoRutClave.html";
+    /** Server-side logout endpoint path; the close redirects OFF this path (sii-py, observed). */
+    readonly logoutPath: "/cgi_AUT2000/autTermino.cgi";
+    /** Mi SII landing — serves the inline `DatosCntrNow` object with the contribuyente snapshot. */
+    readonly miSii: "https://misiir.sii.cl/cgi_misii/siihome.cgi";
+    readonly portal: "https://www.sii.cl";
+    /** SPA JSON facades (RCV / F29 / F22) live under this host. */
+    readonly portalApi: "https://www4.sii.cl";
+    /** Legacy BHE/BTE consulta CGIs (boletas de honorarios). HTML skeleton filled
+     *  client-side from inline JS maps; read via `PortalSession.goto`/`evaluate`, NOT
+     *  the SDI-JSON facade. The `.sii.cl` session cookie SSO-carries here (observed
+     *  2026-06-30). Session-keyed (`rut_arrastre` = the principal). (#20 / ADR-004) */
+    readonly bheCgi: "https://loa.sii.cl/cgi_IMT";
+    /** Palena: DTE SOAP web services AND the public, login-free consulta CGIs
+     *  (e.g. `/cvc_cgi/dte/ee_empresa_rut` — empresas autorizadas a emitir DTE, ADR-014). */
+    readonly dteWs: "https://palena.sii.cl";
+    readonly claveUnica: "https://accounts.claveunica.gob.cl/openid/authorize/";
+};
+/** URL hostname that indicates an unauthenticated session (sii-py ADR-009). */
+export declare const LOGIN_HOST = "zeusr.sii.cl";
+/** Full login page URL (host + path). */
+export declare const LOGIN_URL: string;
+/** Full server-side logout URL (host + path). The close redirects OFF this path. */
+export declare const LOGOUT_URL: string;
+export interface Settings {
+    /** Max requests/second used to pace portal POSTs (sii-py ADR-011). */
+    readonly rateLimitRps: number;
+    /** Cookies-only session TTL hint, minutes. */
+    readonly sessionTtlMinutes: number;
+}
+export declare const DEFAULT_SETTINGS: Settings;
+/** Build the login URL: `<LOGIN_URL>?<destination>` — unkeyed query, observed format. */
+export declare function loginUrl(destination: string): string;
+//# sourceMappingURL=config.d.ts.map

package/dist/config/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,KAAK;IAChB,2FAA2F;;IAE3F,+FAA+F;;IAE/F,8FAA8F;;IAE9F,gGAAgG;;;IAGhG,+DAA+D;;IAE/D;;;uFAGmF;;IAEnF;6FACyF;;;CAGjF,CAAC;AAEX,+EAA+E;AAC/E,eAAO,MAAM,UAAU,iBAAiB,CAAC;AAEzC,yCAAyC;AACzC,eAAO,MAAM,SAAS,QAAqC,CAAC;AAE5D,oFAAoF;AACpF,eAAO,MAAM,UAAU,QAAsC,CAAC;AAE9D,MAAM,WAAW,QAAQ;IACvB,sEAAsE;IACtE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,8CAA8C;IAC9C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,eAAO,MAAM,gBAAgB,EAAE,QAG9B,CAAC;AAEF,yFAAyF;AACzF,wBAAgB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEpD"}

package/dist/config/config.js

@@ -0,0 +1,40 @@
+// SII production hostnames — the single source of truth (ADR-004). Never
+// hard-code a SII host anywhere else. Ported from first-hand observation in the
+// Python sii-cli; prod-only, no env switch (sii-py ADR-016).
+export const HOSTS = {
+    /** Clave Tributaria login host. Landing here ⇒ NOT authenticated (URL-based detection). */
+    login: 'https://zeusr.sii.cl',
+    /** Login page path; takes the post-login destination as an UNKEYED query string (observed). */
+    loginPath: '/AUT2000/InicioAutenticacion/IngresoRutClave.html',
+    /** Server-side logout endpoint path; the close redirects OFF this path (sii-py, observed). */
+    logoutPath: '/cgi_AUT2000/autTermino.cgi',
+    /** Mi SII landing — serves the inline `DatosCntrNow` object with the contribuyente snapshot. */
+    miSii: 'https://misiir.sii.cl/cgi_misii/siihome.cgi',
+    portal: 'https://www.sii.cl',
+    /** SPA JSON facades (RCV / F29 / F22) live under this host. */
+    portalApi: 'https://www4.sii.cl',
+    /** Legacy BHE/BTE consulta CGIs (boletas de honorarios). HTML skeleton filled
+     *  client-side from inline JS maps; read via `PortalSession.goto`/`evaluate`, NOT
+     *  the SDI-JSON facade. The `.sii.cl` session cookie SSO-carries here (observed
+     *  2026-06-30). Session-keyed (`rut_arrastre` = the principal). (#20 / ADR-004) */
+    bheCgi: 'https://loa.sii.cl/cgi_IMT',
+    /** Palena: DTE SOAP web services AND the public, login-free consulta CGIs
+     *  (e.g. `/cvc_cgi/dte/ee_empresa_rut` — empresas autorizadas a emitir DTE, ADR-014). */
+    dteWs: 'https://palena.sii.cl',
+    claveUnica: 'https://accounts.claveunica.gob.cl/openid/authorize/',
+};
+/** URL hostname that indicates an unauthenticated session (sii-py ADR-009). */
+export const LOGIN_HOST = 'zeusr.sii.cl';
+/** Full login page URL (host + path). */
+export const LOGIN_URL = `${HOSTS.login}${HOSTS.loginPath}`;
+/** Full server-side logout URL (host + path). The close redirects OFF this path. */
+export const LOGOUT_URL = `${HOSTS.login}${HOSTS.logoutPath}`;
+export const DEFAULT_SETTINGS = {
+    rateLimitRps: 1,
+    sessionTtlMinutes: 60,
+};
+/** Build the login URL: `<LOGIN_URL>?<destination>` — unkeyed query, observed format. */
+export function loginUrl(destination) {
+    return `${LOGIN_URL}?${destination}`;
+}
+//# sourceMappingURL=config.js.map

package/dist/config/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,gFAAgF;AAChF,6DAA6D;AAE7D,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,2FAA2F;IAC3F,KAAK,EAAE,sBAAsB;IAC7B,+FAA+F;IAC/F,SAAS,EAAE,mDAAmD;IAC9D,8FAA8F;IAC9F,UAAU,EAAE,6BAA6B;IACzC,gGAAgG;IAChG,KAAK,EAAE,6CAA6C;IACpD,MAAM,EAAE,oBAAoB;IAC5B,+DAA+D;IAC/D,SAAS,EAAE,qBAAqB;IAChC;;;uFAGmF;IACnF,MAAM,EAAE,4BAA4B;IACpC;6FACyF;IACzF,KAAK,EAAE,uBAAuB;IAC9B,UAAU,EAAE,sDAAsD;CAC1D,CAAC;AAEX,+EAA+E;AAC/E,MAAM,CAAC,MAAM,UAAU,GAAG,cAAc,CAAC;AAEzC,yCAAyC;AACzC,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;AAE5D,oFAAoF;AACpF,MAAM,CAAC,MAAM,UAAU,GAAG,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;AAS9D,MAAM,CAAC,MAAM,gBAAgB,GAAa;IACxC,YAAY,EAAE,CAAC;IACf,iBAAiB,EAAE,EAAE;CACtB,CAAC;AAEF,yFAAyF;AACzF,MAAM,UAAU,QAAQ,CAAC,WAAmB;IAC1C,OAAO,GAAG,SAAS,IAAI,WAAW,EAAE,CAAC;AACvC,CAAC"}

package/dist/config/index.d.ts

@@ -0,0 +1,2 @@
+export * from './config.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/config/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC"}

package/dist/config/index.js

@@ -0,0 +1,2 @@
+export * from './config.js';
+//# sourceMappingURL=index.js.map

package/dist/config/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC"}

package/dist/errors/errors.d.ts

@@ -0,0 +1,56 @@
+export declare class SiiError extends Error {
+    constructor(message: string);
+}
+/** No valid cached session; the user must run `sii auth login`. */
+export declare class NotAuthenticatedError extends SiiError {
+}
+/** A cached session existed but the cookies are dead. Carries an actionable
+ *  recovery message (e.g. re-run the browser login). Subclass of NotAuthenticated
+ *  so a generic catch still treats it as "not authenticated". */
+export declare class SessionExpiredError extends NotAuthenticatedError {
+}
+/** Browser login was not completed (timeout / window closed). No partial
+ *  session is ever written. */
+export declare class LoginFailedError extends SiiError {
+}
+/** SII server-side rate limit / block. NEVER retry — surface verbatim and stop. */
+export declare class RateLimitError extends SiiError {
+}
+/** A stored credential was required (e.g. unattended re-mint) but none resolved. */
+export declare class CredentialNotFoundError extends SiiError {
+}
+/** Invalid user input: bad RUT, an operate target not in the operable set, etc. */
+export declare class ValidationError extends SiiError {
+}
+/** SII rejected a portal/SDI facade request (error envelope or unparseable
+ *  response). Carries SII's message verbatim — never translated (ADR-004). */
+export declare class RepresentacionError extends SiiError {
+}
+/** SII rejected an RCV (Registro de Compras y Ventas) facade request, or the
+ *  response was not parseable. SII's message verbatim — never translated (ADR-004). */
+export declare class RcvError extends SiiError {
+}
+/** SII rejected an F22 (Declaración Anual de Renta) facade request, or the response
+ *  was not parseable. SII's message verbatim — never translated (ADR-004). */
+export declare class F22Error extends SiiError {
+}
+/** SII rejected an F29 (Declaración Mensual de IVA) facade request, the response was
+ *  not parseable, OR the operation is invalid for F29's session-keyed contract — F29
+ *  authorizes by the session principal, so operating as a represented empresa is
+ *  rejected up front (ADR-005). SII's message verbatim — never translated (ADR-004). */
+export declare class F29Error extends SiiError {
+}
+/** SII rejected a BTE/BHE (boletas de honorarios) consulta, or the inline report map was
+ *  absent / unparseable (a non-report or cross-RUT page). SII's message verbatim where one
+ *  exists — never translated (ADR-004). NOT raised for an empty month (a clean 0-boletas
+ *  result). */
+export declare class BteError extends SiiError {
+}
+/** The public DTE-authorized consulta could not be completed for a non-user reason —
+ *  the network/CGI failed, a non-200 came back, or the portal HTML changed shape
+ *  ("scraper roto"). A RUT that is simply not a DTE emisor is NOT this error: it is a
+ *  clean negative result (`autorizado: false` + SII's verbatim message). Fail loud,
+ *  never retry (ADR-004 / ADR-014). */
+export declare class DteError extends SiiError {
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/errors/errors.ts"],"names":[],"mappings":"AAIA,qBAAa,QAAS,SAAQ,KAAK;gBACrB,OAAO,EAAE,MAAM;CAI5B;AAED,mEAAmE;AACnE,qBAAa,qBAAsB,SAAQ,QAAQ;CAAG;AAEtD;;iEAEiE;AACjE,qBAAa,mBAAoB,SAAQ,qBAAqB;CAAG;AAEjE;+BAC+B;AAC/B,qBAAa,gBAAiB,SAAQ,QAAQ;CAAG;AAEjD,mFAAmF;AACnF,qBAAa,cAAe,SAAQ,QAAQ;CAAG;AAE/C,oFAAoF;AACpF,qBAAa,uBAAwB,SAAQ,QAAQ;CAAG;AAExD,mFAAmF;AACnF,qBAAa,eAAgB,SAAQ,QAAQ;CAAG;AAEhD;8EAC8E;AAC9E,qBAAa,mBAAoB,SAAQ,QAAQ;CAAG;AAEpD;uFACuF;AACvF,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;8EAC8E;AAC9E,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;wFAGwF;AACxF,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;eAGe;AACf,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;;uCAIuC;AACvC,qBAAa,QAAS,SAAQ,QAAQ;CAAG"}

package/dist/errors/errors.js

@@ -0,0 +1,62 @@
+// Domain error hierarchy. The CLI maps these to exit codes (in @sii/cli):
+// NotAuthenticated → 2, LoginFailed → 3, RateLimit → 4. Pass SII's Spanish
+// messages through unchanged (sii-py error-surfacing convention).
+export class SiiError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = new.target.name;
+    }
+}
+/** No valid cached session; the user must run `sii auth login`. */
+export class NotAuthenticatedError extends SiiError {
+}
+/** A cached session existed but the cookies are dead. Carries an actionable
+ *  recovery message (e.g. re-run the browser login). Subclass of NotAuthenticated
+ *  so a generic catch still treats it as "not authenticated". */
+export class SessionExpiredError extends NotAuthenticatedError {
+}
+/** Browser login was not completed (timeout / window closed). No partial
+ *  session is ever written. */
+export class LoginFailedError extends SiiError {
+}
+/** SII server-side rate limit / block. NEVER retry — surface verbatim and stop. */
+export class RateLimitError extends SiiError {
+}
+/** A stored credential was required (e.g. unattended re-mint) but none resolved. */
+export class CredentialNotFoundError extends SiiError {
+}
+/** Invalid user input: bad RUT, an operate target not in the operable set, etc. */
+export class ValidationError extends SiiError {
+}
+/** SII rejected a portal/SDI facade request (error envelope or unparseable
+ *  response). Carries SII's message verbatim — never translated (ADR-004). */
+export class RepresentacionError extends SiiError {
+}
+/** SII rejected an RCV (Registro de Compras y Ventas) facade request, or the
+ *  response was not parseable. SII's message verbatim — never translated (ADR-004). */
+export class RcvError extends SiiError {
+}
+/** SII rejected an F22 (Declaración Anual de Renta) facade request, or the response
+ *  was not parseable. SII's message verbatim — never translated (ADR-004). */
+export class F22Error extends SiiError {
+}
+/** SII rejected an F29 (Declaración Mensual de IVA) facade request, the response was
+ *  not parseable, OR the operation is invalid for F29's session-keyed contract — F29
+ *  authorizes by the session principal, so operating as a represented empresa is
+ *  rejected up front (ADR-005). SII's message verbatim — never translated (ADR-004). */
+export class F29Error extends SiiError {
+}
+/** SII rejected a BTE/BHE (boletas de honorarios) consulta, or the inline report map was
+ *  absent / unparseable (a non-report or cross-RUT page). SII's message verbatim where one
+ *  exists — never translated (ADR-004). NOT raised for an empty month (a clean 0-boletas
+ *  result). */
+export class BteError extends SiiError {
+}
+/** The public DTE-authorized consulta could not be completed for a non-user reason —
+ *  the network/CGI failed, a non-200 came back, or the portal HTML changed shape
+ *  ("scraper roto"). A RUT that is simply not a DTE emisor is NOT this error: it is a
+ *  clean negative result (`autorizado: false` + SII's verbatim message). Fail loud,
+ *  never retry (ADR-004 / ADR-014). */
+export class DteError extends SiiError {
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/errors/errors.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,2EAA2E;AAC3E,kEAAkE;AAElE,MAAM,OAAO,QAAS,SAAQ,KAAK;IACjC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;IAC9B,CAAC;CACF;AAED,mEAAmE;AACnE,MAAM,OAAO,qBAAsB,SAAQ,QAAQ;CAAG;AAEtD;;iEAEiE;AACjE,MAAM,OAAO,mBAAoB,SAAQ,qBAAqB;CAAG;AAEjE;+BAC+B;AAC/B,MAAM,OAAO,gBAAiB,SAAQ,QAAQ;CAAG;AAEjD,mFAAmF;AACnF,MAAM,OAAO,cAAe,SAAQ,QAAQ;CAAG;AAE/C,oFAAoF;AACpF,MAAM,OAAO,uBAAwB,SAAQ,QAAQ;CAAG;AAExD,mFAAmF;AACnF,MAAM,OAAO,eAAgB,SAAQ,QAAQ;CAAG;AAEhD;8EAC8E;AAC9E,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;CAAG;AAEpD;uFACuF;AACvF,MAAM,OAAO,QAAS,SAAQ,QAAQ;CAAG;AAEzC;8EAC8E;AAC9E,MAAM,OAAO,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;wFAGwF;AACxF,MAAM,OAAO,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;eAGe;AACf,MAAM,OAAO,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;;uCAIuC;AACvC,MAAM,OAAO,QAAS,SAAQ,QAAQ;CAAG"}

package/dist/errors/index.d.ts

@@ -0,0 +1,2 @@
+export * from './errors.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/errors/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/errors/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC"}

package/dist/errors/index.js

@@ -0,0 +1,2 @@
+export * from './errors.js';
+//# sourceMappingURL=index.js.map

package/dist/errors/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/errors/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC"}

package/dist/format/format.d.ts

@@ -0,0 +1,5 @@
+/** es-CL money rendering: thousands-grouped (`12.345.678`), `—` for a missing value. */
+export declare function formatMoney(value: number | null): string;
+/** Canonical RUT (`76192083-9`) → display form with dots + DV (`76.192.083-9`). */
+export declare function formatRut(canonical: string): string;
+//# sourceMappingURL=format.d.ts.map

package/dist/format/format.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"format.d.ts","sourceRoot":"","sources":["../../src/format/format.ts"],"names":[],"mappings":"AAMA,wFAAwF;AACxF,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAExD;AAED,mFAAmF;AACnF,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEnD"}

package/dist/format/format.js

@@ -0,0 +1,14 @@
+// Shared es-CL presentation helpers for the HUMAN renderings (CLI `--human`,
+// MCP resource/tool text). Presentation only — tasks keep returning raw
+// JSON-serializable values; that contract is untouched (ADR-012). Hoisted here
+// after the same one-liners were copy-pasted across both surfaces.
+import { Rut } from '../rut/index.js';
+/** es-CL money rendering: thousands-grouped (`12.345.678`), `—` for a missing value. */
+export function formatMoney(value) {
+    return value === null ? '—' : value.toLocaleString('es-CL');
+}
+/** Canonical RUT (`76192083-9`) → display form with dots + DV (`76.192.083-9`). */
+export function formatRut(canonical) {
+    return Rut.parse(canonical).formatted;
+}
+//# sourceMappingURL=format.js.map

package/dist/format/format.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"format.js","sourceRoot":"","sources":["../../src/format/format.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,wEAAwE;AACxE,+EAA+E;AAC/E,mEAAmE;AACnE,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAEtC,wFAAwF;AACxF,MAAM,UAAU,WAAW,CAAC,KAAoB;IAC9C,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,SAAS,CAAC,SAAiB;IACzC,OAAO,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC;AACxC,CAAC"}

package/dist/format/index.d.ts

@@ -0,0 +1,2 @@
+export * from './format.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/format/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/format/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC"}

package/dist/format/index.js

@@ -0,0 +1,2 @@
+export * from './format.js';
+//# sourceMappingURL=index.js.map

package/dist/format/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/format/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC"}

package/dist/identity/identity.d.ts

@@ -0,0 +1,56 @@
+import type { KeyValueStore } from '../seams/index.js';
+export type AccountType = 'persona' | 'empresa';
+export interface OperableEntry {
+    /** Canonical RUT (`<body>-<DV>`). */
+    readonly rut: string;
+    /** Razón social / nombre — PII: never audited, never chatted. */
+    readonly razonSocial: string;
+    readonly isSelf: boolean;
+}
+export interface OperateState {
+    /** The session principal (who is logged in), canonical. */
+    readonly selfRut: string;
+    readonly accountType: AccountType;
+    /** Currently operating AS this RUT (defaults to selfRut), canonical. */
+    readonly operatingRut: string;
+    /** Empresas this account can operate. For an empresa account: just self. */
+    readonly operable: readonly OperableEntry[];
+}
+export declare function readOperateState(store: KeyValueStore): Promise<OperateState | null>;
+/** Initialise on login: operatingRut defaults to self, operable cached. */
+export declare function initOperateState(store: KeyValueStore, input: {
+    selfRut: string;
+    accountType: AccountType;
+    operable: readonly OperableEntry[];
+}): Promise<OperateState>;
+export declare function clearOperateState(store: KeyValueStore): Promise<void>;
+/** Validate + canonicalise an operate target against the cached operable set —
+ *  SELECTS, never mints (ADR-005). Throws `ValidationError` for an empresa account
+ *  (no operate capability) or a RUT outside the operable set. Shared by the
+ *  persistent `operate` command AND the per-call `--rut` override so both enforce the
+ *  same value-domain (CONVENTIONS: `--rut` is the operable set, not a separate concept). */
+export declare function resolveOperableTarget(state: OperateState, target: string): string;
+/** Set the operating RUT, validated against the cached operable set. SELECTS,
+ *  never mints (ADR-005). Accepts any RUT format. */
+export declare function setOperatingRut(store: KeyValueStore, target: string): Promise<OperateState>;
+/** Reset the operating RUT back to self. */
+export declare function clearOperatingRut(store: KeyValueStore): Promise<OperateState>;
+export interface OperatingContext {
+    readonly operatingRut: string;
+    readonly selfRut: string;
+    readonly isSelf: boolean;
+    readonly razonSocial: string | null;
+}
+export declare function operatingContext(state: OperateState): OperatingContext;
+/** Render the operating context as the shared `Operando como …` display line
+ *  (the CLI STDERR header / `operate` output and the MCP `sii://operating`
+ *  resource + `operate` tool used to carry verbatim copies of this). The razón
+ *  social only appears for a represented empresa — never for self (own-name PII
+ *  stays off the line). */
+export declare function describeOperating(ctx: OperatingContext): string;
+/** Render one operable entry as a single display line (shared by CLI `operate --list`
+ *  and the MCP `operate list=true` tool, so the format stays in one place):
+ *  `<rut>[ <razón social>][ (tú mismo, operando ahora)]`. Razón social falls back to
+ *  the RUT when SII returned no name — omit it then so the RUT isn't repeated. */
+export declare function formatOperableEntry(entry: OperableEntry, operatingRut: string): string;
+//# sourceMappingURL=identity.d.ts.map

package/dist/identity/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/identity/identity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAIvD,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;AAEhD,MAAM,WAAW,aAAa;IAC5B,qCAAqC;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,iEAAiE;IACjE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,wEAAwE;IACxE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;CAC7C;AAKD,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAEzF;AAED,2EAA2E;AAC3E,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,aAAa,EACpB,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAA;CAAE,GACvF,OAAO,CAAC,YAAY,CAAC,CASvB;AAED,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3E;AAED;;;;4FAI4F;AAC5F,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAWjF;AAED;qDACqD;AACrD,wBAAsB,eAAe,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAQjG;AAED,4CAA4C;AAC5C,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAQnF;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,gBAAgB,CAStE;AAED;;;;2BAI2B;AAC3B,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAI/D;AAED;;;kFAGkF;AAClF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAStF"}