@albertomarturelo/sii-core 0.7.0 → 0.9.0

package/CHANGELOG.md

@@ -4,6 +4,133 @@ All notable changes to `@albertomarturelo/sii-core` are documented here. The for
 loosely based on [Keep a Changelog](https://keepachangelog.com/); the package is
 pre-1.0, so MINOR bumps may carry breaking changes (pin or use `~` downstream).
 
+## 0.9.0 — 2026-09-09
+
+### Breaking (type-level only)
+
+- **`Runtime.secrets` is now a `SecretReader`** (`Pick<SecretStore, 'get'>`), no longer a
+  full `SecretStore`. A consumer that *supplies* one is unaffected — a `SecretStore` is
+  assignable to a `SecretReader`. A consumer that *called* `runtime.secrets.set(…)` or
+  `.delete(…)` from a task no longer compiles, which is the point: storing the Clave is
+  the user's own act with their own tool, so no task can write to the keyring even by
+  mistake (ADR-025). `secrets` was never wired by any default runtime before this release,
+  so no shipped code path changes.
+- **`AuthLoginResult.reason` gains `'keyring_login'`.** An exhaustive `switch` over the
+  union needs the new arm.
+
+### Added
+
+- **`keyringLogin` — the Clave from the OS keyring, for an explicit login only (#101,
+  #105, ADR-025).** Resolves the `SecretStore` backend ADR-006 left open. Exported from
+  the **CLI-only `@albertomarturelo/sii-core/cli` subpath**, never the main barrel — a test
+  pins that neither Clave-handling task (`consoleLogin`, `keyringLogin`) is reachable from
+  `@albertomarturelo/sii-core`, which is all the MCP server imports. Looks the entry up under
+  service `sii` with the RUT as username, tried canonical → dotted → body-only (the keyring
+  is populated by hand, so the code adapts to the human); SII always receives the canonical
+  RUT. Mod-11 runs **before** the keyring is touched. Then it is `consoleLogin`'s flow:
+  **ONE attempt, never retried** (a stale entry must not become a lockout, ADR-004), a
+  cookies-only session, the Clave discarded with the frame. **No automatic re-login** — a
+  task that meets `SessionExpiredError` still says "ejecuta `sii auth login`"; the
+  alternative was considered and rejected in ADR-025 as the shape that turns one stale entry
+  into a locked account.
+- **Read last.** The credentials reach the shared `credentialLoginFlow` as a thunk, so the
+  keyring is consulted only after the live-session probe misses — an already-authenticated
+  user never triggers a keyring-unlock prompt for a value nobody will use. `consoleLogin`
+  passes a resolved thunk; its behaviour is unchanged.
+- **`KeyringSecretStore`** (`./node` subpath) over **`@napi-rs/keyring` `2.0.0`, pinned
+  exactly** — Secret Service on Linux, Keychain on macOS, a prebuilt N-API binding imported
+  LAZILY so composing a runtime loads no native module. It is **not a `createNodeRuntime`
+  default**: the MCP server builds from that same function, so a default would have handed
+  it a live keyring reader. The CLI's composition root wires it explicitly; `createNodeRuntime().secrets`
+  is asserted `undefined`. A failed native import raises its own actionable error (naming
+  `--console`) instead of collapsing into "no entry", which would have sent the user off to
+  re-store a Clave they already stored; entry-level failures (missing, locked, no Secret
+  Service) still read as `null`, so no wording about an entry leaks.
+- **`testing.InMemorySecretStore`** — the keyring stand-in, so a test never reads the real
+  one. **`CredentialNotFoundError`** now carries the exact `secret-tool` (Linux) and
+  `security add-generic-password` (macOS) invocations that store the entry.
+
+### Notes
+
+- The audit receipt for a keyring login records `reason: 'keyring_login'` and the RUT —
+  never the Clave (tested against the serialised receipt). The persisted session is
+  cookies-only, exactly `{rut, cookies, savedAt}` (tested).
+- `SecretReader` is referenced by the public `Runtime` type but not yet re-exported from
+  the main barrel; a consumer typing an override by name should import `SecretStore`, which
+  is assignable. Worth exporting in a follow-up.
+
+## 0.8.0 — 2026-09-09
+
+### Added
+
+- **The Portal MIPYME DTE surface — borradores, preview and emitted documents (#90, #91,
+  ADR-023).** SII's own FREE facturación portal (`Portal001` CGIs), reached with the Clave
+  alone. New tasks: `dteEmpresas`, `dteBorradorList`, `dteBorradorSave`,
+  `dteBorradorDelete`, `dtePreviewPdf`, `dteEmitidos`, `dtePdf`, plus `TIPOS_DTE` and
+  `MAX_ITEMS`. DTE **33** and **34** wired; more types arrive as a `--tipo` parameter, not
+  as new verbs (ADR-024).
+- **BORRADORES ONLY — emission is deliberately out of scope (ADR-023).** Signing on this
+  portal is SERVER-SIDE (`mipeGenXMLFirma.cgi`, no certificado digital required), so a
+  Clave alone would be enough to issue a legally binding factura. `mipeGenXMLFirma.cgi` is
+  never called from this codebase, and a test asserts its absence from the compiled output.
+  Everything needed to *prepare* a document is automated; the one irreversible click stays
+  with a human in SII's own UI, one navigation away from any borrador this writes.
+- **A third authorization mode: EMPRESA-KEYED (ADR-023).** Besides body-RUT (RCV) and
+  session-keyed (F22/F29/BTE), the MIPYME portal keeps its OWN authorized-empresa list
+  (`mipeSelEmpresa.cgi` — the empresas that registered this user as *usuario autorizado*),
+  which is neither the operate pointer's operable set nor the session principal. `empresa`
+  is validated against that LIVE list and re-selected before every operation, since the
+  choice scopes the form, the borrador CRUD and the listing. An unknown RUT fails with the
+  available list.
+- **Single-empresa accounts resolve instead of failing (#95).** Such an account gets no
+  chooser at all — SII answers a JS launcher — so the empresa is read off the form's DTE
+  header box and nothing is POSTed. `parseChooser` returns a `launcher` / `chooser` /
+  `sinAutorizacion` shape rather than assuming a `<select>`.
+- **SII's own validator judges the document, in-page, before anything is POSTed
+  (ADR-023).** The factura form ships `validaFacEx()`; it is run via `evaluate` with
+  `window.alert` captured, and its Spanish refusals surface VERBATIM (ADR-004). It produces
+  exactly the refusals the server would bounce, so an invalid document never costs a round
+  trip — posting past it was observed to redirect back to the form with the same alert.
+- **A draft is a write, but not a destructive one (ADR-023).** `dteBorradorSave` is
+  reversible and legally inert, so it carries no double-entry confirm and no
+  `destructiveHint` — that ceremony (ADR-017) is for the irreversible step. The DELETE is
+  gated instead.
+- **The preview PDF and the emitted document follow the ADR-022 descriptor contract.**
+  `mipePreView.cgi` (stamped "VISTA PREVIA · DOCUMENTO NO VALIDO", no folio) and
+  `mipeDisplayPDF.cgi?DHDR_CODIGO=` are fetched with `requestBinary`, written through
+  `FileSink`, and the task returns `{path, archivo, bytes, …}` — never the bytes. The local
+  filename is composed here: SII's `Content-Disposition` carries only the RUT.
+- **`PortalSession.requestForm`** now backs the borrador CRUD (`mipeGrabaBorrador` /
+  `mipeEliminaBorrador`, `ES_BORR=TRUE`); the borradores listing is a bare JSON array on
+  www4 with no SDI envelope, and the emitted listing is ISO-8859-1 HTML whose rows are
+  MALFORMED — SII never closes the receptor cell — so it is parsed by anchor + `<td` split,
+  never with a strict parser.
+- **PII posture.** Curated rows, **NO `raw`** anywhere on this surface (a row is counterparty
+  identity, ADR-004). The audit records the empresa RUT, the borrador id or folio and row
+  counts — never the counterparty, the amounts or free text.
+
+### Fixed
+
+- **`parseEmitidas` no longer drops blank cells before mapping the row by index (#92).** A
+  `PRV` (vista previa) document has no folio, so its folio cell comes back blank; filtering
+  it slid every later column one place left — fecha into folio
+  (`Number('2026-09-08')` ⇒ `NaN` ⇒ `null` once serialised), monto into fecha, estado into
+  monto — producing a plausible row with the values under the wrong names and raising
+  nothing. Cells now map positionally, a blank one reads as `null`, and a row whose cell
+  count is not EXACTLY the observed seven raises "scraper roto" (exact rather than a
+  minimum: a blank cell *before* the receptor RUT shifts the row just as badly). `cellText`
+  folds `&nbsp;` into whitespace so a spacer-only cell is a blank cell. Shipped unreleased,
+  so no published version carried the mislabelling.
+
+### Changed
+
+- **Surfaces are named by SII artifact (ADR-024).** The MIPYME work landed under a
+  `factura` verb and was folded into `dte` before release: a factura is DTE 33, and the
+  artifact already had a verb. `portal/factura.ts` → `portal/dte-mipyme.ts`,
+  `tasks/factura.ts` → `tasks/dte.ts`. Nothing published ever exposed `factura`, so this
+  breaks no consumer. `ROADMAP.md` § "Where a new surface goes" is now the placement table
+  a new verb is checked against.
+
 ## 0.7.0 — 2026-08-31
 
 ### Breaking

package/dist/adapters/fake/index.d.ts

@@ -1,4 +1,4 @@
-import type { AuditEntry, AuditSink, BinaryRequest, BinaryResponse, Clock, CredentialLoginOptions, FormRequest, InteractiveLoginOptions, JsonRequest, FileSink, KeyValueStore, PortalDriver, PortalSession, PublicRequest, PublicResponse, TextRequest } from '../../seams/index.js';
+import type { AuditEntry, AuditSink, BinaryRequest, BinaryResponse, Clock, CredentialLoginOptions, FormRequest, InteractiveLoginOptions, JsonRequest, FileSink, KeyValueStore, PortalDriver, PortalSession, PublicRequest, PublicResponse, SecretStore, TextRequest } from '../../seams/index.js';
 export declare class FixedClock implements Clock {
     private current;
     /** Each `sleep(ms)` is recorded (not awaited) so a test can assert pacing without
@@ -121,4 +121,14 @@ export declare class InMemoryFileSink implements FileSink {
     readonly files: Map<string, Uint8Array<ArrayBufferLike>>;
     write(dir: string, name: string, bytes: Uint8Array): Promise<string>;
 }
+/** In-memory SecretStore: the keyring stand-in, so a test never reads the real one
+ *  (ADR-003 / ADR-025). `entries` is keyed by account exactly as the keyring's username. */
+export declare class InMemorySecretStore implements SecretStore {
+    readonly entries: Map<string, string>;
+    constructor(entries?: Map<string, string>);
+    readonly reads: string[];
+    get(account: string): Promise<string | null>;
+    set(account: string, secret: string): Promise<void>;
+    delete(account: string): Promise<void>;
+}
 //# sourceMappingURL=index.d.ts.map

package/dist/adapters/fake/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/fake/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,UAAU,EACV,SAAS,EACT,aAAa,EACb,cAAc,EACd,KAAK,EACL,sBAAsB,EACtB,WAAW,EACX,uBAAuB,EACvB,WAAW,EACX,QAAQ,EACR,aAAa,EACb,YAAY,EACZ,aAAa,EACb,aAAa,EACb,cAAc,EACd,WAAW,EACZ,MAAM,sBAAsB,CAAC;AAE9B,qBAAa,UAAW,YAAW,KAAK;IAI1B,OAAO,CAAC,OAAO;IAH3B;4BACwB;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAM;gBACV,OAAO,EAAE,IAAI;IACjC,GAAG,IAAI,IAAI;IAGX,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,IAAI;IAGlB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAIjC;AAED,qBAAa,kBAAmB,YAAW,SAAS;IAClD,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,CAAM;IACpC,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI;CAGhC;AAED,qBAAa,qBAAsB,YAAW,aAAa;IACzD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA6B;IAC5C,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAIvC,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAG9C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGzC;AAED,MAAM,WAAW,iBAAiB;IAChC,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,QAAQ,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;IAC3C,6EAA6E;IAC7E,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC;IAC9D;0FACsF;IACtF,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,KAAK,cAAc,GAAG,MAAM,CAAC;IAC9E;iGAC6F;IAC7F,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,KAAK,cAAc,GAAG,MAAM,CAAC;IAC9E;;0EAEsE;IACtE,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,KAAK,cAAc,GAAG,UAAU,CAAC;IACtF,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,qBAAa,iBAAkB,YAAW,aAAa;IAOzC,OAAO,CAAC,QAAQ,CAAC,MAAM;IANnC,MAAM,UAAS;IACf,+EAA+E;IAC/E,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,IAAI,CAAQ;IAClE;0DACsD;IACtD,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAM;gBACD,MAAM,GAAE,iBAAsB;IACrD,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIlC,QAAQ,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAG3C,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAIvE,uFAAuF;IACvF,eAAe,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,IAAI,CAAQ;IAChE,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC;IAM9E,uFAAuF;IACvF,eAAe,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,IAAI,CAAQ;IAChE,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC;IAM9E,qFAAqF;IACrF,iBAAiB,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,aAAa,CAAA;KAAE,GAAG,IAAI,CAAQ;IACpE,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAM5E,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAG1D,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC;IAGhC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,CAAC,EAAE,iBAAiB,GAAG,CAAC,MAAM,iBAAiB,CAAC,CAAC;IAC7D,iBAAiB,CAAC,EAAE,iBAAiB,GAAG,CAAC,MAAM,iBAAiB,CAAC,CAAC;IAClE,cAAc,CAAC,EAAE,iBAAiB,GAAG,CAAC,MAAM,iBAAiB,CAAC,CAAC;IAC/D,sFAAsF;IACtF,SAAS,CAAC,EAAE,KAAK,CAAC;IAClB,yFAAyF;IACzF,mBAAmB,CAAC,EAAE,KAAK,CAAC;IAC5B;4FACwF;IACxF,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,KAAK,cAAc,GAAG,MAAM,CAAC;IAClF,oFAAoF;IACpF,UAAU,CAAC,EAAE,KAAK,CAAC;CACpB;AAED,qBAAa,gBAAiB,YAAW,YAAY;IAOvC,OAAO,CAAC,QAAQ,CAAC,MAAM;IANnC,qBAAqB,SAAK;IAC1B,oBAAoB,SAAK;IACzB,YAAY,SAAK;IACjB;qFACiF;IACjF,cAAc,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAQ;gBAChC,MAAM,GAAE,gBAAqB;IACpD,gBAAgB,CAAC,QAAQ,EAAE,uBAAuB,GAAG,OAAO,CAAC,aAAa,CAAC;IAS3E,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,aAAa,CAAC;IAUxE,OAAO,CAAC,aAAa,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC;IAQ7D,kBAAkB,SAAK;IACvB,mFAAmF;IACnF,iBAAiB,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,aAAa,CAAA;KAAE,GAAG,IAAI,CAAQ;IACpE,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;CAQnF;AAED;;yBAEyB;AACzB,qBAAa,gBAAiB,YAAW,QAAQ;IAC/C,QAAQ,CAAC,KAAK,2CAAiC;IACzC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;CAK3E"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/fake/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,UAAU,EACV,SAAS,EACT,aAAa,EACb,cAAc,EACd,KAAK,EACL,sBAAsB,EACtB,WAAW,EACX,uBAAuB,EACvB,WAAW,EACX,QAAQ,EACR,aAAa,EACb,YAAY,EACZ,aAAa,EACb,aAAa,EACb,cAAc,EACd,WAAW,EACX,WAAW,EACZ,MAAM,sBAAsB,CAAC;AAE9B,qBAAa,UAAW,YAAW,KAAK;IAI1B,OAAO,CAAC,OAAO;IAH3B;4BACwB;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAM;gBACV,OAAO,EAAE,IAAI;IACjC,GAAG,IAAI,IAAI;IAGX,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,IAAI;IAGlB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAIjC;AAED,qBAAa,kBAAmB,YAAW,SAAS;IAClD,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,CAAM;IACpC,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI;CAGhC;AAED,qBAAa,qBAAsB,YAAW,aAAa;IACzD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA6B;IAC5C,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAIvC,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAG9C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGzC;AAED,MAAM,WAAW,iBAAiB;IAChC,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,QAAQ,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;IAC3C,6EAA6E;IAC7E,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC;IAC9D;0FACsF;IACtF,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,KAAK,cAAc,GAAG,MAAM,CAAC;IAC9E;iGAC6F;IAC7F,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,KAAK,cAAc,GAAG,MAAM,CAAC;IAC9E;;0EAEsE;IACtE,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,KAAK,cAAc,GAAG,UAAU,CAAC;IACtF,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,qBAAa,iBAAkB,YAAW,aAAa;IAOzC,OAAO,CAAC,QAAQ,CAAC,MAAM;IANnC,MAAM,UAAS;IACf,+EAA+E;IAC/E,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,IAAI,CAAQ;IAClE;0DACsD;IACtD,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAM;gBACD,MAAM,GAAE,iBAAsB;IACrD,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIlC,QAAQ,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAG3C,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAIvE,uFAAuF;IACvF,eAAe,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,IAAI,CAAQ;IAChE,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC;IAM9E,uFAAuF;IACvF,eAAe,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,IAAI,CAAQ;IAChE,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC;IAM9E,qFAAqF;IACrF,iBAAiB,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,aAAa,CAAA;KAAE,GAAG,IAAI,CAAQ;IACpE,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAM5E,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAG1D,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC;IAGhC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,CAAC,EAAE,iBAAiB,GAAG,CAAC,MAAM,iBAAiB,CAAC,CAAC;IAC7D,iBAAiB,CAAC,EAAE,iBAAiB,GAAG,CAAC,MAAM,iBAAiB,CAAC,CAAC;IAClE,cAAc,CAAC,EAAE,iBAAiB,GAAG,CAAC,MAAM,iBAAiB,CAAC,CAAC;IAC/D,sFAAsF;IACtF,SAAS,CAAC,EAAE,KAAK,CAAC;IAClB,yFAAyF;IACzF,mBAAmB,CAAC,EAAE,KAAK,CAAC;IAC5B;4FACwF;IACxF,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,KAAK,cAAc,GAAG,MAAM,CAAC;IAClF,oFAAoF;IACpF,UAAU,CAAC,EAAE,KAAK,CAAC;CACpB;AAED,qBAAa,gBAAiB,YAAW,YAAY;IAOvC,OAAO,CAAC,QAAQ,CAAC,MAAM;IANnC,qBAAqB,SAAK;IAC1B,oBAAoB,SAAK;IACzB,YAAY,SAAK;IACjB;qFACiF;IACjF,cAAc,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAQ;gBAChC,MAAM,GAAE,gBAAqB;IACpD,gBAAgB,CAAC,QAAQ,EAAE,uBAAuB,GAAG,OAAO,CAAC,aAAa,CAAC;IAS3E,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,aAAa,CAAC;IAUxE,OAAO,CAAC,aAAa,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC;IAQ7D,kBAAkB,SAAK;IACvB,mFAAmF;IACnF,iBAAiB,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,aAAa,CAAA;KAAE,GAAG,IAAI,CAAQ;IACpE,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;CAQnF;AAED;;yBAEyB;AACzB,qBAAa,gBAAiB,YAAW,QAAQ;IAC/C,QAAQ,CAAC,KAAK,2CAAiC;IACzC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;CAK3E;AAED;4FAC4F;AAC5F,qBAAa,mBAAoB,YAAW,WAAW;IACzC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;gBAA5B,OAAO,GAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAa;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAM;IACxB,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI5C,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAGnD,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAG7C"}

package/dist/adapters/fake/index.js

@@ -157,4 +157,23 @@ export class InMemoryFileSink {
         return path;
     }
 }
+/** In-memory SecretStore: the keyring stand-in, so a test never reads the real one
+ *  (ADR-003 / ADR-025). `entries` is keyed by account exactly as the keyring's username. */
+export class InMemorySecretStore {
+    entries;
+    constructor(entries = new Map()) {
+        this.entries = entries;
+    }
+    reads = [];
+    async get(account) {
+        this.reads.push(account);
+        return this.entries.get(account) ?? null;
+    }
+    async set(account, secret) {
+        this.entries.set(account, secret);
+    }
+    async delete(account) {
+        this.entries.delete(account);
+    }
+}
 //# sourceMappingURL=index.js.map

package/dist/adapters/fake/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/fake/index.ts"],"names":[],"mappings":"AAoBA,MAAM,OAAO,UAAU;IAID;IAHpB;4BACwB;IACf,KAAK,GAAa,EAAE,CAAC;IAC9B,YAAoB,OAAa;QAAb,YAAO,GAAP,OAAO,CAAM;IAAG,CAAC;IACrC,GAAG;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IACD,GAAG,CAAC,CAAO;QACT,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,KAAK,CAAC,EAAU;QACd,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,kBAAkB;IACpB,OAAO,GAAiB,EAAE,CAAC;IACpC,MAAM,CAAC,KAAiB;QACtB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,qBAAqB;IACf,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IAClD,KAAK,CAAC,IAAI,CAAI,GAAW;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAO,CAAC;IAC3D,CAAC;IACD,KAAK,CAAC,KAAK,CAAI,GAAW,EAAE,KAAQ;QAClC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;CACF;AAwBD,MAAM,OAAO,iBAAiB;IAOC;IAN7B,MAAM,GAAG,KAAK,CAAC;IACf,+EAA+E;IAC/E,WAAW,GAAkD,IAAI,CAAC;IAClE;0DACsD;IAC7C,KAAK,GAAa,EAAE,CAAC;IAC9B,YAA6B,SAA4B,EAAE;QAA9B,WAAM,GAAN,MAAM,CAAwB;IAAG,CAAC;IAC/D,KAAK,CAAC,IAAI,CAAC,GAAW;QACpB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC;IACvC,CAAC;IACD,KAAK,CAAC,QAAQ,CAAI,UAAkB;QAClC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,IAAI,IAAI,CAAM,CAAC;IAC3D,CAAC;IACD,KAAK,CAAC,WAAW,CAAC,GAAW,EAAE,OAAqB;QAClD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC;IACzD,CAAC;IACD,uFAAuF;IACvF,eAAe,GAAkD,IAAI,CAAC;IACtE,KAAK,CAAC,WAAW,CAAC,GAAW,EAAE,OAAqB;QAClD,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;QAC5D,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACtD,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,uFAAuF;IACvF,eAAe,GAAkD,IAAI,CAAC;IACtE,KAAK,CAAC,WAAW,CAAC,GAAW,EAAE,OAAqB;QAClD,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;QAC5D,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACtD,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,qFAAqF;IACrF,iBAAiB,GAAoD,IAAI,CAAC;IAC1E,KAAK,CAAC,aAAa,CAAC,GAAW,EAAE,OAAuB;QACtD,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;QAC9D,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,UAAU,EAAE,EAAE,CAAC;QACxF,OAAO,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjG,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,IAAY;QACrC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IAC7C,CAAC;IACD,KAAK,CAAC,YAAY;QAChB,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACrD,CAAC;IACD,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;CACF;AAiBD,MAAM,OAAO,gBAAgB;IAOE;IAN7B,qBAAqB,GAAG,CAAC,CAAC;IAC1B,oBAAoB,GAAG,CAAC,CAAC;IACzB,YAAY,GAAG,CAAC,CAAC;IACjB;qFACiF;IACjF,cAAc,GAA0C,IAAI,CAAC;IAC7D,YAA6B,SAA2B,EAAE;QAA7B,WAAM,GAAN,MAAM,CAAuB;IAAG,CAAC;IAC9D,KAAK,CAAC,gBAAgB,CAAC,QAAiC;QACtD,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QACvD,MAAM,CAAC,GACL,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,UAAU;YAC5C,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE;YAC5B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QAC/B,OAAO,IAAI,iBAAiB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,KAAK,CAAC,eAAe,CAAC,OAA+B;QACnD,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC5B,IAAI,CAAC,cAAc,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QACjE,IAAI,IAAI,CAAC,MAAM,CAAC,mBAAmB;YAAE,MAAM,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAC3E,MAAM,CAAC,GACL,OAAO,IAAI,CAAC,MAAM,CAAC,iBAAiB,KAAK,UAAU;YACjD,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE;YACjC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;QACpC,OAAO,IAAI,iBAAiB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,aAAsB;QAClC,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,MAAM,CAAC,GACL,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,KAAK,UAAU;YAC9C,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE;YAC9B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;QACjC,OAAO,IAAI,iBAAiB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,kBAAkB,GAAG,CAAC,CAAC;IACvB,mFAAmF;IACnF,iBAAiB,GAAoD,IAAI,CAAC;IAC1E,KAAK,CAAC,aAAa,CAAC,GAAW,EAAE,OAAuB;QACtD,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC1B,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;QAC9D,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU;YAAE,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;QACzD,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACtD,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,CAAC;CACF;AAED;;yBAEyB;AACzB,MAAM,OAAO,gBAAgB;IAClB,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC/C,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,IAAY,EAAE,KAAiB;QACtD,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/fake/index.ts"],"names":[],"mappings":"AAqBA,MAAM,OAAO,UAAU;IAID;IAHpB;4BACwB;IACf,KAAK,GAAa,EAAE,CAAC;IAC9B,YAAoB,OAAa;QAAb,YAAO,GAAP,OAAO,CAAM;IAAG,CAAC;IACrC,GAAG;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IACD,GAAG,CAAC,CAAO;QACT,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,KAAK,CAAC,EAAU;QACd,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,kBAAkB;IACpB,OAAO,GAAiB,EAAE,CAAC;IACpC,MAAM,CAAC,KAAiB;QACtB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,qBAAqB;IACf,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IAClD,KAAK,CAAC,IAAI,CAAI,GAAW;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAO,CAAC;IAC3D,CAAC;IACD,KAAK,CAAC,KAAK,CAAI,GAAW,EAAE,KAAQ;QAClC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;CACF;AAwBD,MAAM,OAAO,iBAAiB;IAOC;IAN7B,MAAM,GAAG,KAAK,CAAC;IACf,+EAA+E;IAC/E,WAAW,GAAkD,IAAI,CAAC;IAClE;0DACsD;IAC7C,KAAK,GAAa,EAAE,CAAC;IAC9B,YAA6B,SAA4B,EAAE;QAA9B,WAAM,GAAN,MAAM,CAAwB;IAAG,CAAC;IAC/D,KAAK,CAAC,IAAI,CAAC,GAAW;QACpB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC;IACvC,CAAC;IACD,KAAK,CAAC,QAAQ,CAAI,UAAkB;QAClC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,IAAI,IAAI,CAAM,CAAC;IAC3D,CAAC;IACD,KAAK,CAAC,WAAW,CAAC,GAAW,EAAE,OAAqB;QAClD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC;IACzD,CAAC;IACD,uFAAuF;IACvF,eAAe,GAAkD,IAAI,CAAC;IACtE,KAAK,CAAC,WAAW,CAAC,GAAW,EAAE,OAAqB;QAClD,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;QAC5D,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACtD,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,uFAAuF;IACvF,eAAe,GAAkD,IAAI,CAAC;IACtE,KAAK,CAAC,WAAW,CAAC,GAAW,EAAE,OAAqB;QAClD,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;QAC5D,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACtD,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,qFAAqF;IACrF,iBAAiB,GAAoD,IAAI,CAAC;IAC1E,KAAK,CAAC,aAAa,CAAC,GAAW,EAAE,OAAuB;QACtD,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;QAC9D,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,UAAU,EAAE,EAAE,CAAC;QACxF,OAAO,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjG,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,IAAY;QACrC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IAC7C,CAAC;IACD,KAAK,CAAC,YAAY;QAChB,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACrD,CAAC;IACD,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;CACF;AAiBD,MAAM,OAAO,gBAAgB;IAOE;IAN7B,qBAAqB,GAAG,CAAC,CAAC;IAC1B,oBAAoB,GAAG,CAAC,CAAC;IACzB,YAAY,GAAG,CAAC,CAAC;IACjB;qFACiF;IACjF,cAAc,GAA0C,IAAI,CAAC;IAC7D,YAA6B,SAA2B,EAAE;QAA7B,WAAM,GAAN,MAAM,CAAuB;IAAG,CAAC;IAC9D,KAAK,CAAC,gBAAgB,CAAC,QAAiC;QACtD,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QACvD,MAAM,CAAC,GACL,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,UAAU;YAC5C,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE;YAC5B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QAC/B,OAAO,IAAI,iBAAiB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,KAAK,CAAC,eAAe,CAAC,OAA+B;QACnD,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC5B,IAAI,CAAC,cAAc,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QACjE,IAAI,IAAI,CAAC,MAAM,CAAC,mBAAmB;YAAE,MAAM,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAC3E,MAAM,CAAC,GACL,OAAO,IAAI,CAAC,MAAM,CAAC,iBAAiB,KAAK,UAAU;YACjD,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE;YACjC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;QACpC,OAAO,IAAI,iBAAiB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,aAAsB;QAClC,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,MAAM,CAAC,GACL,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,KAAK,UAAU;YAC9C,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE;YAC9B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;QACjC,OAAO,IAAI,iBAAiB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,kBAAkB,GAAG,CAAC,CAAC;IACvB,mFAAmF;IACnF,iBAAiB,GAAoD,IAAI,CAAC;IAC1E,KAAK,CAAC,aAAa,CAAC,GAAW,EAAE,OAAuB;QACtD,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC1B,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;QAC9D,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU;YAAE,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;QACzD,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACtD,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,CAAC;CACF;AAED;;yBAEyB;AACzB,MAAM,OAAO,gBAAgB;IAClB,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC/C,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,IAAY,EAAE,KAAiB;QACtD,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED;4FAC4F;AAC5F,MAAM,OAAO,mBAAmB;IACT;IAArB,YAAqB,UAA+B,IAAI,GAAG,EAAE;QAAxC,YAAO,GAAP,OAAO,CAAiC;IAAG,CAAC;IACxD,KAAK,GAAa,EAAE,CAAC;IAC9B,KAAK,CAAC,GAAG,CAAC,OAAe;QACvB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;IAC3C,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,OAAe,EAAE,MAAc;QACvC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,OAAe;QAC1B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;CACF"}

package/dist/adapters/node/keyring.d.ts

@@ -0,0 +1,12 @@
+import type { SecretStore } from '../../seams/index.js';
+/** Reads the Clave from the OS keyring. Never used by the MCP surface (ADR-025):
+ *  only the CLI-only `keyringLogin` task consumes it. */
+export declare class KeyringSecretStore implements SecretStore {
+    private readonly service;
+    constructor(service?: string);
+    private entry;
+    get(account: string): Promise<string | null>;
+    set(account: string, secret: string): Promise<void>;
+    delete(account: string): Promise<void>;
+}
+//# sourceMappingURL=keyring.d.ts.map

package/dist/adapters/node/keyring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyring.d.ts","sourceRoot":"","sources":["../../../src/adapters/node/keyring.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AASxD;yDACyD;AACzD,qBAAa,kBAAmB,YAAW,WAAW;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,GAAE,MAAwB;YAEhD,KAAK;IAiBb,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAc5C,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInD,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAO7C"}

package/dist/adapters/node/keyring.js

@@ -0,0 +1,58 @@
+// OS keyring `SecretStore` (ADR-025) — the Clave at rest lives HERE and nowhere else
+// (ADR-006). Backed by `@napi-rs/keyring`, which talks to the platform store directly:
+// the freedesktop Secret Service on Linux (gnome-keyring / kwallet), the Keychain on
+// macOS. It is general-purpose infrastructure, not SII code (ADR-004).
+//
+// The binding is a native module, so it is imported LAZILY: composing a runtime — or
+// running the MCP server, which never reads a secret — must not load it (ADR-016).
+import { KEYRING_SERVICE } from '../../config/index.js';
+import { SiiError } from '../../errors/index.js';
+/** Reads the Clave from the OS keyring. Never used by the MCP surface (ADR-025):
+ *  only the CLI-only `keyringLogin` task consumes it. */
+export class KeyringSecretStore {
+    service;
+    constructor(service = KEYRING_SERVICE) {
+        this.service = service;
+    }
+    async entry(account) {
+        // A plain dynamic import is the whole lazy-load — the module registry is the cache.
+        // A FAILURE HERE IS NOT "no entry": the native binding is missing or unsupported on
+        // this platform, and reporting that as an empty keyring would send the user off to
+        // re-store a Clave they already stored (review of #101).
+        let mod;
+        try {
+            mod = (await import('@napi-rs/keyring'));
+        }
+        catch (err) {
+            throw new SiiError('El binding del llavero (@napi-rs/keyring) no está disponible en esta plataforma. ' +
+                `Usa \`sii auth login --console\`. Detalle: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        return new mod.Entry(this.service, account);
+    }
+    async get(account) {
+        // A missing entry, a locked keyring and an absent Secret Service all mean the same
+        // to the caller: no credential here. The caller turns that into its own actionable
+        // message (which service/username it looked for) — swallowing the platform's own
+        // wording keeps a secret-store error from leaking anything about the entry. A
+        // missing BINDING is different and propagates (see `entry`).
+        const entry = await this.entry(account);
+        try {
+            return entry.getPassword();
+        }
+        catch {
+            return null;
+        }
+    }
+    async set(account, secret) {
+        (await this.entry(account)).setPassword(secret);
+    }
+    async delete(account) {
+        try {
+            (await this.entry(account)).deletePassword();
+        }
+        catch {
+            // already gone / no store — deleting nothing is success
+        }
+    }
+}
+//# sourceMappingURL=keyring.js.map

package/dist/adapters/node/keyring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyring.js","sourceRoot":"","sources":["../../../src/adapters/node/keyring.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,uFAAuF;AACvF,qFAAqF;AACrF,uEAAuE;AACvE,EAAE;AACF,qFAAqF;AACrF,mFAAmF;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAUjD;yDACyD;AACzD,MAAM,OAAO,kBAAkB;IACA;IAA7B,YAA6B,UAAkB,eAAe;QAAjC,YAAO,GAAP,OAAO,CAA0B;IAAG,CAAC;IAE1D,KAAK,CAAC,KAAK,CAAC,OAAe;QACjC,oFAAoF;QACpF,oFAAoF;QACpF,mFAAmF;QACnF,yDAAyD;QACzD,IAAI,GAAkB,CAAC;QACvB,IAAI,CAAC;YACH,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAA6B,CAAC;QACvE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,QAAQ,CAChB,mFAAmF;gBACjF,8CAA8C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACnG,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAe;QACvB,mFAAmF;QACnF,mFAAmF;QACnF,iFAAiF;QACjF,8EAA8E;QAC9E,6DAA6D;QAC7D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC;YACH,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAe,EAAE,MAAc;QACvC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe;QAC1B,IAAI,CAAC;YACH,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;IACH,CAAC;CACF"}

package/dist/auth/auth.d.ts

@@ -1,3 +1,4 @@
+import { Rut } from '../rut/index.js';
 import type { AccountType } from '../identity/index.js';
 import type { Runtime } from '../seams/index.js';
 export interface AuthIdentity {
@@ -24,7 +25,7 @@ export interface AuthStatusLocal {
 export interface AuthLoginResult {
     readonly authenticated: true;
     readonly rut: string;
-    readonly reason: 'browser_login' | 'console_login' | 'already_authenticated';
+    readonly reason: 'browser_login' | 'console_login' | 'keyring_login' | 'already_authenticated';
 }
 export interface AuthLogoutResult {
     readonly loggedOut: boolean;
@@ -44,6 +45,18 @@ export declare function consoleLogin(runtime: Runtime, credentials: {
     rut: string;
     clave: string;
 }): Promise<AuthLoginResult>;
+/** The RUT renderings a human plausibly stored the entry under, in lookup order. The
+ *  keyring is populated BY HAND (`secret-tool`, Seahorse, Keychain Access), so the code
+ *  adapts to the human rather than the reverse (ADR-025). `Rut.parse` already upper-cases
+ *  a `k`, so the canonical form covers that variant. */
+export declare function keyringAccounts(rut: Rut): string[];
+/** CLI-only keyring login (ADR-025): the Clave comes from the OS keyring instead of the
+ *  terminal, and everything else matches `consoleLogin` — ONE attempt, cookies-only
+ *  session, Clave never persisted by us nor audited. Nothing calls this implicitly: an
+ *  expired session still requires the user to run the verb again (ADR-019 lineage). */
+export declare function keyringLogin(runtime: Runtime, args: {
+    rut: string;
+}): Promise<AuthLoginResult>;
 /** Server-side close (best-effort) + wipe local session + operate context. */
 export declare function logout(runtime: Runtime): Promise<AuthLogoutResult>;
 /** Curated identity readback from the portal. Requires a live session (no implicit

package/dist/auth/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/auth/auth.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAiB,MAAM,sBAAsB,CAAC;AAGvE,OAAO,KAAK,EAAiB,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAuBhE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;CACnC;AAED;;uEAEuE;AACvE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,oFAAoF;IACpF,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,eAAe;IAC9B,iFAAiF;IACjF,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC3C;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,GAAG,uBAAuB,CAAC;CAC9E;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAED,wEAAwE;AACxE,wBAAsB,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC,CAKnF;AA+HD;;wDAEwD;AACxD,wBAAsB,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,CAkBtE;AAED;;;6EAG6E;AAC7E,wBAAsB,YAAY,CAChC,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC1C,OAAO,CAAC,eAAe,CAAC,CAoB1B;AAED,8EAA8E;AAC9E,wBAAsB,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAuBxE;AAED;;mFAEmF;AACnF,wBAAsB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CAS3E;AAED;;;;uFAIuF;AACvF,wBAAsB,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAWlE"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/auth/auth.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAGtC,OAAO,KAAK,EAAE,WAAW,EAAiB,MAAM,sBAAsB,CAAC;AAGvE,OAAO,KAAK,EAAiB,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAuBhE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;CACnC;AAED;;uEAEuE;AACvE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,oFAAoF;IACpF,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,eAAe;IAC9B,iFAAiF;IACjF,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC3C;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,GAAG,eAAe,GAAG,uBAAuB,CAAC;CAChG;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAED,wEAAwE;AACxE,wBAAsB,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC,CAKnF;AA+HD;;wDAEwD;AACxD,wBAAsB,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,CAkBtE;AAED;;;6EAG6E;AAC7E,wBAAsB,YAAY,CAChC,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC1C,OAAO,CAAC,eAAe,CAAC,CAE1B;AAmCD;;;wDAGwD;AACxD,wBAAgB,eAAe,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,EAAE,CAElD;AAED;;;uFAGuF;AACvF,wBAAsB,YAAY,CAChC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GACpB,OAAO,CAAC,eAAe,CAAC,CA2B1B;AAED,8EAA8E;AAC9E,wBAAsB,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAuBxE;AAED;;mFAEmF;AACnF,wBAAsB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CAS3E;AAED;;;;uFAIuF;AACvF,wBAAsB,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAWlE"}

package/dist/auth/auth.js

@@ -1,5 +1,5 @@
-import { HOSTS, LOGIN_HOST, LOGOUT_URL } from '../config/index.js';
-import { LoginFailedError, NotAuthenticatedError } from '../errors/index.js';
+import { HOSTS, KEYRING_SERVICE, LOGIN_HOST, LOGOUT_URL } from '../config/index.js';
+import { CredentialNotFoundError, LoginFailedError, NotAuthenticatedError, } from '../errors/index.js';
 import { Rut } from '../rut/index.js';
 import { recordAudit } from '../audit/index.js';
 import { clearOperateState, initOperateState } from '../identity/index.js';
@@ -156,10 +156,20 @@ export async function login(runtime) {
  *  stored, exactly like the browser path. ONE attempt, never retried (ADR-004).
  *  The Clave never reaches MCP (this task is CLI-only) nor the audit log. */
 export async function consoleLogin(runtime, credentials) {
+    return credentialLoginFlow(runtime, () => Promise.resolve(credentials), 'console_login');
+}
+/** The headless fill-and-submit shared by the console (ADR-010) and keyring (ADR-025)
+ *  paths — they differ ONLY in where the Clave came from, so the attempt policy lives
+ *  in one place: ONE attempt, never retried (ADR-004), Clave discarded with the frame.
+ *  The credentials arrive as a THUNK so the Clave is fetched only once the live-session
+ *  probe has missed: an already-authenticated user must not trigger a keyring-unlock
+ *  prompt for a value nobody will use (review of #101). */
+async function credentialLoginFlow(runtime, getCredentials, reason) {
     const start = runtime.clock.now().getTime();
     const warm = await reuseLiveSession(runtime);
     if (warm)
         return warm;
+    const credentials = await getCredentials();
     let session = null;
     try {
         session = await runtime.portal.credentialLogin({
@@ -168,16 +178,48 @@ export async function consoleLogin(runtime, credentials) {
             destination: HOSTS.miSii,
             timeoutMs: CONSOLE_LOGIN_TIMEOUT_MS,
         });
-        return await finalizeFreshSession(runtime, session, 'console_login', start);
+        return await finalizeFreshSession(runtime, session, reason, start);
     }
     catch (err) {
-        recordAudit(runtime, { action: 'auth_login', result: 'failed', reason: 'console_login' });
+        recordAudit(runtime, { action: 'auth_login', result: 'failed', reason });
         throw err;
     }
     finally {
         await session?.close();
     }
 }
+/** The RUT renderings a human plausibly stored the entry under, in lookup order. The
+ *  keyring is populated BY HAND (`secret-tool`, Seahorse, Keychain Access), so the code
+ *  adapts to the human rather than the reverse (ADR-025). `Rut.parse` already upper-cases
+ *  a `k`, so the canonical form covers that variant. */
+export function keyringAccounts(rut) {
+    return [rut.canonical, rut.formatted, String(rut.body)];
+}
+/** CLI-only keyring login (ADR-025): the Clave comes from the OS keyring instead of the
+ *  terminal, and everything else matches `consoleLogin` — ONE attempt, cookies-only
+ *  session, Clave never persisted by us nor audited. Nothing calls this implicitly: an
+ *  expired session still requires the user to run the verb again (ADR-019 lineage). */
+export async function keyringLogin(runtime, args) {
+    // Mod-11 BEFORE anything else: a malformed RUT must never become a wasted SII attempt
+    // (ADR-004), and it must not raise a keyring prompt either.
+    const rut = Rut.parse(args.rut);
+    const secrets = runtime.secrets;
+    if (!secrets) {
+        throw new CredentialNotFoundError('Este runtime no tiene acceso al llavero (SecretStore). Usa `sii auth login --console`.');
+    }
+    return credentialLoginFlow(runtime, async () => {
+        const accounts = keyringAccounts(rut);
+        for (const account of accounts) {
+            const clave = await secrets.get(account);
+            if (clave)
+                return { rut: rut.canonical, clave };
+        }
+        throw new CredentialNotFoundError(`No hay Clave en el llavero para ${rut.canonical} (servicio "${KEYRING_SERVICE}"). ` +
+            `Guárdala con:\n` +
+            `  Linux:  secret-tool store --label='SII' service ${KEYRING_SERVICE} username ${rut.canonical}\n` +
+            `  macOS:  security add-generic-password -s ${KEYRING_SERVICE} -a ${rut.canonical} -w`);
+    }, 'keyring_login');
+}
 /** Server-side close (best-effort) + wipe local session + operate context. */
 export async function logout(runtime) {
     const session = await readSession(runtime.store);

package/dist/auth/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAGvE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAErF,MAAM,wBAAwB,GAAG,OAAO,CAAC;AACzC,gFAAgF;AAChF,mFAAmF;AACnF,MAAM,wBAAwB,GAAG,MAAM,CAAC;AACxC,mFAAmF;AACnF,MAAM,UAAU,GAAG,2DAA2D,CAAC;AAkD/E,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAuB;IACvD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,OAAO;QACZ,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,aAAa,EAAE,QAAQ,EAAE;QACpE,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAuB;IAChD,MAAM,CAAC,GAAG,KAAK,EAAE,aAAa,CAAC;IAC/B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;QACpD,MAAM,IAAI,gBAAgB,CAAC,iEAAiE,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC;IACpD,MAAM,WAAW,GAAgB,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAClG,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;IACjD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC;AACjD,CAAC;AAED;;0FAE0F;AAC1F,KAAK,UAAU,cAAc,CAAC,OAAgB;IAC5C,IAAI,CAAC;QACH,OAAO,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,CACjD,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CACrE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;0EAC0E;AAC1E,KAAK,UAAU,gBAAgB,CAAC,OAAgB;IAC9C,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,GAAG,EAAE,CAAC;QACR,WAAW,CAAC,OAAO,EAAE;YACnB,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,IAAI;YACZ,GAAG;YACH,MAAM,EAAE,uBAAuB;SAChC,CAAC,CAAC;QACH,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;gCAIgC;AAChC,KAAK,UAAU,eAAe,CAC5B,OAAgB,EAChB,OAAsB,EACtB,QAAsB;IAEtB,MAAM,IAAI,GAAkB;QAC1B,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,WAAW,EAAE,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,GAAG;QAC5C,MAAM,EAAE,IAAI;KACb,CAAC;IACF,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC3E,MAAM,OAAO,GAAoB,QAAQ;aACtC,MAAM,CAAC,CAAC,CAAC,EAA4C,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC;aACvE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG;YACnC,MAAM,EAAE,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG;SAC/B,CAAC,CAAC,CAAC;QACN,gFAAgF;QAChF,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,CAAC;QAC9E,WAAW,CAAC,OAAO,EAAE;YACnB,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,IAAI;YACZ,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,KAAK,EAAE,QAAQ,CAAC,MAAM;SACvB,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QACxF,OAAO,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;+EAE+E;AAC/E,KAAK,UAAU,oBAAoB,CACjC,OAAgB,EAChB,OAAsB,EACtB,MAAyC,EACzC,KAAa;IAEb,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,gBAAgB,CAAC,+DAA+D,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAmB,UAAU,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;IAC7C,MAAM,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE;QAChC,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,OAAO;QACP,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;KAC3C,CAAC,CAAC;IAEH,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACnE,MAAM,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE;QACpC,OAAO,EAAE,QAAQ,CAAC,GAAG;QACrB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,QAAQ;KACT,CAAC,CAAC;IAEH,WAAW,CAAC,OAAO,EAAE;QACnB,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,IAAI;QACZ,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,MAAM;QACN,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK;KAClD,CAAC,CAAC;IACH,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC;AAC5D,CAAC;AAED;;wDAEwD;AACxD,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,OAAgB;IAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAEtB,IAAI,OAAO,GAAyB,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC;YAC9C,WAAW,EAAE,KAAK,CAAC,KAAK;YACxB,SAAS,EAAE,wBAAwB;SACpC,CAAC,CAAC;QACH,OAAO,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QAC1F,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED;;;6EAG6E;AAC7E,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAgB,EAChB,WAA2C;IAE3C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAEtB,IAAI,OAAO,GAAyB,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC;YAC7C,GAAG,EAAE,WAAW,CAAC,GAAG;YACpB,KAAK,EAAE,WAAW,CAAC,KAAK;YACxB,WAAW,EAAE,KAAK,CAAC,KAAK;YACxB,SAAS,EAAE,wBAAwB;SACpC,CAAC,CAAC;QACH,OAAO,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QAC1F,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAgB;IAC3C,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IACnD,CAAC;IAED,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,CAAC,GAAyB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxC,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,MAAM,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACvC,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;IACzF,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AAC3C,CAAC;AAED;;mFAEmF;AACnF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAgB;IAClD,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,qBAAqB,CAAC,6CAA6C,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAmB,UAAU,CAAC,CAAC,CAAC;QACnF,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QACzF,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;uFAIuF;AACvF,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAgB;IAC3C,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,qBAAqB,CAAC,6CAA6C,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAmB,UAAU,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;QACjE,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5E,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;IAClG,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAGvE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAErF,MAAM,wBAAwB,GAAG,OAAO,CAAC;AACzC,gFAAgF;AAChF,mFAAmF;AACnF,MAAM,wBAAwB,GAAG,MAAM,CAAC;AACxC,mFAAmF;AACnF,MAAM,UAAU,GAAG,2DAA2D,CAAC;AAkD/E,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAuB;IACvD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,OAAO;QACZ,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,aAAa,EAAE,QAAQ,EAAE;QACpE,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAuB;IAChD,MAAM,CAAC,GAAG,KAAK,EAAE,aAAa,CAAC;IAC/B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;QACpD,MAAM,IAAI,gBAAgB,CAAC,iEAAiE,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC;IACpD,MAAM,WAAW,GAAgB,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAClG,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;IACjD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC;AACjD,CAAC;AAED;;0FAE0F;AAC1F,KAAK,UAAU,cAAc,CAAC,OAAgB;IAC5C,IAAI,CAAC;QACH,OAAO,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,CACjD,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CACrE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;0EAC0E;AAC1E,KAAK,UAAU,gBAAgB,CAAC,OAAgB;IAC9C,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,GAAG,EAAE,CAAC;QACR,WAAW,CAAC,OAAO,EAAE;YACnB,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,IAAI;YACZ,GAAG;YACH,MAAM,EAAE,uBAAuB;SAChC,CAAC,CAAC;QACH,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;gCAIgC;AAChC,KAAK,UAAU,eAAe,CAC5B,OAAgB,EAChB,OAAsB,EACtB,QAAsB;IAEtB,MAAM,IAAI,GAAkB;QAC1B,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,WAAW,EAAE,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,GAAG;QAC5C,MAAM,EAAE,IAAI;KACb,CAAC;IACF,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC3E,MAAM,OAAO,GAAoB,QAAQ;aACtC,MAAM,CAAC,CAAC,CAAC,EAA4C,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC;aACvE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG;YACnC,MAAM,EAAE,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG;SAC/B,CAAC,CAAC,CAAC;QACN,gFAAgF;QAChF,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,CAAC;QAC9E,WAAW,CAAC,OAAO,EAAE;YACnB,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,IAAI;YACZ,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,KAAK,EAAE,QAAQ,CAAC,MAAM;SACvB,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QACxF,OAAO,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;+EAE+E;AAC/E,KAAK,UAAU,oBAAoB,CACjC,OAAgB,EAChB,OAAsB,EACtB,MAA2D,EAC3D,KAAa;IAEb,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,gBAAgB,CAAC,+DAA+D,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAmB,UAAU,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;IAC7C,MAAM,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE;QAChC,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,OAAO;QACP,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;KAC3C,CAAC,CAAC;IAEH,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACnE,MAAM,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE;QACpC,OAAO,EAAE,QAAQ,CAAC,GAAG;QACrB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,QAAQ;KACT,CAAC,CAAC;IAEH,WAAW,CAAC,OAAO,EAAE;QACnB,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,IAAI;QACZ,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,MAAM;QACN,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK;KAClD,CAAC,CAAC;IACH,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC;AAC5D,CAAC;AAED;;wDAEwD;AACxD,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,OAAgB;IAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAEtB,IAAI,OAAO,GAAyB,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC;YAC9C,WAAW,EAAE,KAAK,CAAC,KAAK;YACxB,SAAS,EAAE,wBAAwB;SACpC,CAAC,CAAC;QACH,OAAO,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QAC1F,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED;;;6EAG6E;AAC7E,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAgB,EAChB,WAA2C;IAE3C,OAAO,mBAAmB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;2DAK2D;AAC3D,KAAK,UAAU,mBAAmB,CAChC,OAAgB,EAChB,cAA6D,EAC7D,MAAyC;IAEzC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAEtB,MAAM,WAAW,GAAG,MAAM,cAAc,EAAE,CAAC;IAC3C,IAAI,OAAO,GAAyB,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC;YAC7C,GAAG,EAAE,WAAW,CAAC,GAAG;YACpB,KAAK,EAAE,WAAW,CAAC,KAAK;YACxB,WAAW,EAAE,KAAK,CAAC,KAAK;YACxB,SAAS,EAAE,wBAAwB;SACpC,CAAC,CAAC;QACH,OAAO,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACzE,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED;;;wDAGwD;AACxD,MAAM,UAAU,eAAe,CAAC,GAAQ;IACtC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;uFAGuF;AACvF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAgB,EAChB,IAAqB;IAErB,sFAAsF;IACtF,4DAA4D;IAC5D,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,uBAAuB,CAC/B,wFAAwF,CACzF,CAAC;IACJ,CAAC;IACD,OAAO,mBAAmB,CACxB,OAAO,EACP,KAAK,IAAI,EAAE;QACT,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACtC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,KAAK;gBAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;QAClD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,mCAAmC,GAAG,CAAC,SAAS,eAAe,eAAe,MAAM;YAClF,iBAAiB;YACjB,qDAAqD,eAAe,aAAa,GAAG,CAAC,SAAS,IAAI;YAClG,8CAA8C,eAAe,OAAO,GAAG,CAAC,SAAS,KAAK,CACzF,CAAC;IACJ,CAAC,EACD,eAAe,CAChB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAgB;IAC3C,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IACnD,CAAC;IAED,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,CAAC,GAAyB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxC,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,MAAM,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACvC,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;IACzF,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AAC3C,CAAC;AAED;;mFAEmF;AACnF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAgB;IAClD,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,qBAAqB,CAAC,6CAA6C,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAmB,UAAU,CAAC,CAAC,CAAC;QACnF,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QACzF,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;uFAIuF;AACvF,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAgB;IAC3C,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,qBAAqB,CAAC,6CAA6C,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAmB,UAAU,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;QACjE,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5E,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;IAClG,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cli.d.ts

@@ -1,3 +1,3 @@
-export { consoleLogin } from './tasks/auth.js';
+export { consoleLogin, keyringLogin } from './tasks/auth.js';
 export type { AuthLoginResult } from './tasks/auth.js';
 //# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC7D,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/cli.js

@@ -2,5 +2,7 @@
 // a Clave argument, so it is DELIBERATELY kept out of the main barrel (`@albertomarturelo/sii-core`)
 // — the MCP server imports only the main barrel and must never wire a task that
 // takes a password (ADR-006). The terminal CLI imports this subpath instead.
-export { consoleLogin } from './tasks/auth.js';
+// `keyringLogin` joins it for the same reason: it READS a Clave (from the OS keyring),
+// so it must be unreachable from the MCP server (ADR-025).
+export { consoleLogin, keyringLogin } from './tasks/auth.js';
 //# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,oHAAoH;AACpH,qGAAqG;AACrG,gFAAgF;AAChF,6EAA6E;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,oHAAoH;AACpH,qGAAqG;AACrG,gFAAgF;AAChF,6EAA6E;AAC7E,uFAAuF;AACvF,2DAA2D;AAC3D,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/config/config.d.ts

@@ -15,6 +15,16 @@ export declare const HOSTS: {
      *  the SDI-JSON facade. The `.sii.cl` session cookie SSO-carries here (observed
      *  2026-06-30). Session-keyed (`rut_arrastre` = the principal). (#20 / ADR-004) */
     readonly bheCgi: "https://loa.sii.cl/cgi_IMT";
+    /** MIPYME — the SII's FREE facturación electrónica portal (`Portal001` CGIs). The
+     *  factura form (`mipeGenFacEx.cgi`), the borrador CRUD (`mipeGrabaBorrador.cgi` /
+     *  `mipeEliminaBorrador.cgi`), the preview (`mipeDisplayPreView.cgi`) and the empresa
+     *  chooser (`mipeSelEmpresa.cgi`) all live here. The `.sii.cl` session cookie
+     *  SSO-carries (observed 2026-09-08). EMPRESA-KEYED: the working empresa is chosen by
+     *  POSTing `mipeSelEmpresa.cgi`, not by the operate pointer. (#89 / ADR-023) */
+    readonly mipeCgi: "https://www1.sii.cl/cgi-bin/Portal001";
+    /** Static assets of the same MIPYME portal (`PreViewFrame.html`, the JS). Separate from
+     *  `mipeCgi` because it is NOT under `/cgi-bin`. (#89 / ADR-023) */
+    readonly mipeStatic: "https://www1.sii.cl/Portal001";
     /** SISPAD — peticiones administrativas. A GWT-RPC app: `text/x-gwt-rpc` POST to
      *  `/sispadinternet/peticion` returns a `//OK[…]` object graph; reached via
      *  `PortalSession.requestText` (a cold authenticated POST), NOT the SDI-JSON facade.
@@ -32,6 +42,11 @@ export declare const LOGIN_HOST = "zeusr.sii.cl";
 export declare const LOGIN_URL: string;
 /** Full server-side logout URL (host + path). The close redirects OFF this path. */
 export declare const LOGOUT_URL: string;
+/** The keyring "service" every entry of this tool lives under; the account (`username`
+ *  in keyring terms) is the RUT. Lives here — with the other environment constants —
+ *  because BOTH the pure `keyringLogin` task (for its error message) and the Node
+ *  adapter that reads the store need it (ADR-025). */
+export declare const KEYRING_SERVICE = "sii";
 export interface Settings {
     /** Max requests/second used to pace portal POSTs (sii-py ADR-011). */
     readonly rateLimitRps: number;

package/dist/config/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,KAAK;IAChB,2FAA2F;;IAE3F,+FAA+F;;IAE/F,8FAA8F;;IAE9F,gGAAgG;;;IAGhG,+DAA+D;;IAE/D;;;uFAGmF;;IAEnF;;;;0BAIsB;;IAEtB;6FACyF;;;CAGjF,CAAC;AAEX,+EAA+E;AAC/E,eAAO,MAAM,UAAU,iBAAiB,CAAC;AAEzC,yCAAyC;AACzC,eAAO,MAAM,SAAS,QAAqC,CAAC;AAE5D,oFAAoF;AACpF,eAAO,MAAM,UAAU,QAAsC,CAAC;AAE9D,MAAM,WAAW,QAAQ;IACvB,sEAAsE;IACtE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,8CAA8C;IAC9C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,eAAO,MAAM,gBAAgB,EAAE,QAG9B,CAAC;AAEF,yFAAyF;AACzF,wBAAgB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEpD"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,KAAK;IAChB,2FAA2F;;IAE3F,+FAA+F;;IAE/F,8FAA8F;;IAE9F,gGAAgG;;;IAGhG,+DAA+D;;IAE/D;;;uFAGmF;;IAEnF;;;;;oFAKgF;;IAEhF;wEACoE;;IAEpE;;;;0BAIsB;;IAEtB;6FACyF;;;CAGjF,CAAC;AAEX,+EAA+E;AAC/E,eAAO,MAAM,UAAU,iBAAiB,CAAC;AAEzC,yCAAyC;AACzC,eAAO,MAAM,SAAS,QAAqC,CAAC;AAE5D,oFAAoF;AACpF,eAAO,MAAM,UAAU,QAAsC,CAAC;AAE9D;;;sDAGsD;AACtD,eAAO,MAAM,eAAe,QAAQ,CAAC;AAErC,MAAM,WAAW,QAAQ;IACvB,sEAAsE;IACtE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,8CAA8C;IAC9C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,eAAO,MAAM,gBAAgB,EAAE,QAG9B,CAAC;AAEF,yFAAyF;AACzF,wBAAgB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEpD"}

package/dist/config/config.js

@@ -18,6 +18,16 @@ export const HOSTS = {
      *  the SDI-JSON facade. The `.sii.cl` session cookie SSO-carries here (observed
      *  2026-06-30). Session-keyed (`rut_arrastre` = the principal). (#20 / ADR-004) */
     bheCgi: 'https://loa.sii.cl/cgi_IMT',
+    /** MIPYME — the SII's FREE facturación electrónica portal (`Portal001` CGIs). The
+     *  factura form (`mipeGenFacEx.cgi`), the borrador CRUD (`mipeGrabaBorrador.cgi` /
+     *  `mipeEliminaBorrador.cgi`), the preview (`mipeDisplayPreView.cgi`) and the empresa
+     *  chooser (`mipeSelEmpresa.cgi`) all live here. The `.sii.cl` session cookie
+     *  SSO-carries (observed 2026-09-08). EMPRESA-KEYED: the working empresa is chosen by
+     *  POSTing `mipeSelEmpresa.cgi`, not by the operate pointer. (#89 / ADR-023) */
+    mipeCgi: 'https://www1.sii.cl/cgi-bin/Portal001',
+    /** Static assets of the same MIPYME portal (`PreViewFrame.html`, the JS). Separate from
+     *  `mipeCgi` because it is NOT under `/cgi-bin`. (#89 / ADR-023) */
+    mipeStatic: 'https://www1.sii.cl/Portal001',
     /** SISPAD — peticiones administrativas. A GWT-RPC app: `text/x-gwt-rpc` POST to
      *  `/sispadinternet/peticion` returns a `//OK[…]` object graph; reached via
      *  `PortalSession.requestText` (a cold authenticated POST), NOT the SDI-JSON facade.
@@ -35,6 +45,11 @@ export const LOGIN_HOST = 'zeusr.sii.cl';
 export const LOGIN_URL = `${HOSTS.login}${HOSTS.loginPath}`;
 /** Full server-side logout URL (host + path). The close redirects OFF this path. */
 export const LOGOUT_URL = `${HOSTS.login}${HOSTS.logoutPath}`;
+/** The keyring "service" every entry of this tool lives under; the account (`username`
+ *  in keyring terms) is the RUT. Lives here — with the other environment constants —
+ *  because BOTH the pure `keyringLogin` task (for its error message) and the Node
+ *  adapter that reads the store need it (ADR-025). */
+export const KEYRING_SERVICE = 'sii';
 export const DEFAULT_SETTINGS = {
     rateLimitRps: 1,
     sessionTtlMinutes: 60,

package/dist/config/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,gFAAgF;AAChF,6DAA6D;AAE7D,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,2FAA2F;IAC3F,KAAK,EAAE,sBAAsB;IAC7B,+FAA+F;IAC/F,SAAS,EAAE,mDAAmD;IAC9D,8FAA8F;IAC9F,UAAU,EAAE,6BAA6B;IACzC,gGAAgG;IAChG,KAAK,EAAE,6CAA6C;IACpD,MAAM,EAAE,oBAAoB;IAC5B,+DAA+D;IAC/D,SAAS,EAAE,qBAAqB;IAChC;;;uFAGmF;IACnF,MAAM,EAAE,4BAA4B;IACpC;;;;0BAIsB;IACtB,MAAM,EAAE,oCAAoC;IAC5C;6FACyF;IACzF,KAAK,EAAE,uBAAuB;IAC9B,UAAU,EAAE,sDAAsD;CAC1D,CAAC;AAEX,+EAA+E;AAC/E,MAAM,CAAC,MAAM,UAAU,GAAG,cAAc,CAAC;AAEzC,yCAAyC;AACzC,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;AAE5D,oFAAoF;AACpF,MAAM,CAAC,MAAM,UAAU,GAAG,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;AAS9D,MAAM,CAAC,MAAM,gBAAgB,GAAa;IACxC,YAAY,EAAE,CAAC;IACf,iBAAiB,EAAE,EAAE;CACtB,CAAC;AAEF,yFAAyF;AACzF,MAAM,UAAU,QAAQ,CAAC,WAAmB;IAC1C,OAAO,GAAG,SAAS,IAAI,WAAW,EAAE,CAAC;AACvC,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,gFAAgF;AAChF,6DAA6D;AAE7D,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,2FAA2F;IAC3F,KAAK,EAAE,sBAAsB;IAC7B,+FAA+F;IAC/F,SAAS,EAAE,mDAAmD;IAC9D,8FAA8F;IAC9F,UAAU,EAAE,6BAA6B;IACzC,gGAAgG;IAChG,KAAK,EAAE,6CAA6C;IACpD,MAAM,EAAE,oBAAoB;IAC5B,+DAA+D;IAC/D,SAAS,EAAE,qBAAqB;IAChC;;;uFAGmF;IACnF,MAAM,EAAE,4BAA4B;IACpC;;;;;oFAKgF;IAChF,OAAO,EAAE,uCAAuC;IAChD;wEACoE;IACpE,UAAU,EAAE,+BAA+B;IAC3C;;;;0BAIsB;IACtB,MAAM,EAAE,oCAAoC;IAC5C;6FACyF;IACzF,KAAK,EAAE,uBAAuB;IAC9B,UAAU,EAAE,sDAAsD;CAC1D,CAAC;AAEX,+EAA+E;AAC/E,MAAM,CAAC,MAAM,UAAU,GAAG,cAAc,CAAC;AAEzC,yCAAyC;AACzC,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;AAE5D,oFAAoF;AACpF,MAAM,CAAC,MAAM,UAAU,GAAG,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;AAE9D;;;sDAGsD;AACtD,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC;AASrC,MAAM,CAAC,MAAM,gBAAgB,GAAa;IACxC,YAAY,EAAE,CAAC;IACf,iBAAiB,EAAE,EAAE;CACtB,CAAC;AAEF,yFAAyF;AACzF,MAAM,UAAU,QAAQ,CAAC,WAAmB;IAC1C,OAAO,GAAG,SAAS,IAAI,WAAW,EAAE,CAAC;AACvC,CAAC"}

package/dist/errors/errors.d.ts

@@ -58,7 +58,11 @@ export declare class PeticionesError extends SiiError {
  *  the network/CGI failed, a non-200 came back, or the portal HTML changed shape
  *  ("scraper roto"). A RUT that is simply not a DTE emisor is NOT this error: it is a
  *  clean negative result (`autorizado: false` + SII's verbatim message). Fail loud,
- *  never retry (ADR-004 / ADR-014). */
+ *  never retry (ADR-004 / ADR-014).
+ *  Also the MIPYME portal surface (ADR-023 / ADR-024): SII rejected a borrador operation, its
+ *  own client-side validator refused the document (surfaced VERBATIM), or the portal form
+ *  changed shape. Empresa-keyed. Never retried after a SII error; a `LOGIN_HOST` bounce is
+ *  `SessionExpiredError`, not this. */
 export declare class DteError extends SiiError {
 }
 //# sourceMappingURL=errors.d.ts.map

package/dist/errors/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/errors/errors.ts"],"names":[],"mappings":"AAIA,qBAAa,QAAS,SAAQ,KAAK;gBACrB,OAAO,EAAE,MAAM;CAI5B;AAED,mEAAmE;AACnE,qBAAa,qBAAsB,SAAQ,QAAQ;CAAG;AAEtD;;iEAEiE;AACjE,qBAAa,mBAAoB,SAAQ,qBAAqB;CAAG;AAEjE;+BAC+B;AAC/B,qBAAa,gBAAiB,SAAQ,QAAQ;CAAG;AAEjD,mFAAmF;AACnF,qBAAa,cAAe,SAAQ,QAAQ;CAAG;AAE/C,oFAAoF;AACpF,qBAAa,uBAAwB,SAAQ,QAAQ;CAAG;AAExD,mFAAmF;AACnF,qBAAa,eAAgB,SAAQ,QAAQ;CAAG;AAEhD;8EAC8E;AAC9E,qBAAa,mBAAoB,SAAQ,QAAQ;CAAG;AAEpD;uFACuF;AACvF,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;8EAC8E;AAC9E,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;wFAGwF;AACxF,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;eAGe;AACf,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;;;gFAKgF;AAChF,qBAAa,eAAgB,SAAQ,QAAQ;CAAG;AAEhD;;;;uCAIuC;AACvC,qBAAa,QAAS,SAAQ,QAAQ;CAAG"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/errors/errors.ts"],"names":[],"mappings":"AAIA,qBAAa,QAAS,SAAQ,KAAK;gBACrB,OAAO,EAAE,MAAM;CAI5B;AAED,mEAAmE;AACnE,qBAAa,qBAAsB,SAAQ,QAAQ;CAAG;AAEtD;;iEAEiE;AACjE,qBAAa,mBAAoB,SAAQ,qBAAqB;CAAG;AAEjE;+BAC+B;AAC/B,qBAAa,gBAAiB,SAAQ,QAAQ;CAAG;AAEjD,mFAAmF;AACnF,qBAAa,cAAe,SAAQ,QAAQ;CAAG;AAE/C,oFAAoF;AACpF,qBAAa,uBAAwB,SAAQ,QAAQ;CAAG;AAExD,mFAAmF;AACnF,qBAAa,eAAgB,SAAQ,QAAQ;CAAG;AAEhD;8EAC8E;AAC9E,qBAAa,mBAAoB,SAAQ,QAAQ;CAAG;AAEpD;uFACuF;AACvF,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;8EAC8E;AAC9E,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;wFAGwF;AACxF,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;eAGe;AACf,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;;;gFAKgF;AAChF,qBAAa,eAAgB,SAAQ,QAAQ;CAAG;AAEhD;;;;;;;;uCAQuC;AACvC,qBAAa,QAAS,SAAQ,QAAQ;CAAG"}