@albertomarturelo/sii-core 0.8.0 → 0.10.0

package/dist/auth/auth.js

@@ -1,22 +1,39 @@
-import { HOSTS, LOGIN_HOST, LOGOUT_URL } from '../config/index.js';
-import { LoginFailedError, NotAuthenticatedError } from '../errors/index.js';
+import { HOSTS, KEYRING_SERVICE, LOGIN_HOST, LOGOUT_URL, WWW2_APP_CARPETA, WWW2_SESSION_CLOSE_URL, } from '../config/index.js';
+import { CredentialNotFoundError, LoginFailedError, NotAuthenticatedError, } from '../errors/index.js';
 import { Rut } from '../rut/index.js';
 import { recordAudit } from '../audit/index.js';
 import { clearOperateState, initOperateState } from '../identity/index.js';
 import { fetchEmpresasAutorizadas } from '../portal/representacion.js';
 import { deleteSession, readSession, withSession, writeSession } from './session.js';
+import { mergeStorageState, waitForWww2Session, www2ExpiresAt } from './www2-login.js';
+import { readWww2Session } from '../portal/www2-session.js';
+import { Www2SessionError } from '../errors/index.js';
 const DEFAULT_LOGIN_TIMEOUT_MS = 180_000;
 // Console login submits machine-fast (no human typing in the browser) and fails
 // fast on a rejected Clave, so it needs a far smaller budget than the headed flow.
 const CONSOLE_LOGIN_TIMEOUT_MS = 60_000;
 // The Mi-SII landing serves this inline JS object with the contribuyente snapshot.
 const DATOS_EXPR = "typeof DatosCntrNow !== 'undefined' ? DatosCntrNow : null";
-/** Pure local read — NO portal call (sii-py "local-only" labelling). */
-export async function localStatus(store) {
+const NO_WWW2 = { authenticated: false, expiresAt: null };
+function www2StatusOf(session, now) {
+    const layer = session?.www2;
+    if (!layer)
+        return NO_WWW2;
+    const alive = layer.expiresAt === null || new Date(layer.expiresAt).getTime() > now.getTime();
+    return { authenticated: alive, expiresAt: layer.expiresAt };
+}
+/** Pure local read — NO portal call (sii-py "local-only" labelling). `now` decides whether the
+ *  stored www2 layer is still within its cookie's own expiry. */
+export async function localStatus(store, now) {
     const session = await readSession(store);
     return session
-        ? { authenticated: true, rut: session.rut, sessionSource: 'cached' }
-        : { authenticated: false, rut: null, sessionSource: 'none' };
+        ? {
+            authenticated: true,
+            rut: session.rut,
+            sessionSource: 'cached',
+            www2: www2StatusOf(session, now),
+        }
+        : { authenticated: false, rut: null, sessionSource: 'none', www2: NO_WWW2 };
 }
 function identityFromDatos(datos) {
     const c = datos?.contribuyente;
@@ -43,20 +60,22 @@ async function liveSessionRut(runtime) {
         return null;
     }
 }
-/** If a cached session is still live, return `already_authenticated` (no mint).
- *  Shared by both login paths so neither re-mints over a warm session. */
-async function reuseLiveSession(runtime) {
+/** If a cached session is still live, the `already_authenticated` result (no mint) — WITHOUT
+ *  auditing it. The receipt is written by the caller that actually RETURNS this outcome: a
+ *  `--www2` login can find the classic session warm and still need the browser (for the www2
+ *  layer), and the audit must record what happened, not what was probed (ADR-004). */
+async function liveSessionResult(runtime) {
     const rut = await liveSessionRut(runtime);
-    if (rut) {
-        recordAudit(runtime, {
-            action: 'auth_login',
-            result: 'ok',
-            rut,
-            reason: 'already_authenticated',
-        });
-        return { authenticated: true, rut, reason: 'already_authenticated' };
-    }
-    return null;
+    return rut ? { authenticated: true, rut, reason: 'already_authenticated' } : null;
+}
+/** The receipt for a login that ENDED as "already authenticated". */
+function auditAlreadyAuthenticated(runtime, warm) {
+    recordAudit(runtime, {
+        action: 'auth_login',
+        result: 'ok',
+        rut: warm.rut,
+        reason: warm.reason,
+    });
 }
 /** Best-effort operable-set fetch on login (ADR-005). Persona accounts ask SII for
  *  the empresas they can operate (getDcvEmpresasAutorizadas); empresa accounts have
@@ -127,21 +146,75 @@ async function finalizeFreshSession(runtime, session, reason, start) {
     });
     return { authenticated: true, rut: identity.rut, reason };
 }
+/** Is the stored www2 layer live on the server? One cheap read via a headless restore; never
+ *  throws (the login path needs "is it warm?", not an error). */
+async function liveWww2(runtime) {
+    try {
+        await withSession(runtime, async (s) => readWww2Session(s, WWW2_APP_CARPETA));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** The www2 step (ADR-026), run on the still-open headed `session` AFTER the classic login has
+ *  been persisted: snapshot the classic jar, let the user log in at SII's OAuth page, then store
+ *  classic + www2 cookies together with the layer's own expiry. On timeout the classic session
+ *  stays saved and `LoginFailedError` says so. */
+async function mintWww2Layer(runtime, session) {
+    const stored = await readSession(runtime.store);
+    if (!stored)
+        throw new NotAuthenticatedError('No hay sesión. Ejecuta `sii auth login`.');
+    const start = runtime.clock.now().getTime();
+    try {
+        const classicJar = await session.storageState();
+        await waitForWww2Session(runtime, session);
+        const www2Jar = await session.storageState();
+        const expiresAt = www2ExpiresAt(www2Jar);
+        const savedAt = runtime.clock.now().toISOString();
+        await writeSession(runtime.store, {
+            ...stored,
+            cookies: mergeStorageState(classicJar, www2Jar),
+            www2: { savedAt, expiresAt },
+        });
+        recordAudit(runtime, {
+            action: 'auth_login_www2',
+            result: 'ok',
+            rut: stored.rut,
+            durationMs: runtime.clock.now().getTime() - start,
+        });
+        return { authenticated: true, expiresAt };
+    }
+    catch (err) {
+        recordAudit(runtime, { action: 'auth_login_www2', result: 'failed', rut: stored.rut });
+        throw err;
+    }
+}
 /** Browser cookies-only login (ADR-006). Only this + `consoleLogin` mint a session
  *  (ADR-019 lineage). Idempotent: a live cached session returns
- *  `already_authenticated` without opening a window. */
-export async function login(runtime) {
+ *  `already_authenticated` without opening a window. With `www2`, both layers must be live
+ *  for that shortcut; otherwise the headed flow runs in full (classic login, then the www2
+ *  step in the same browser — the classic page is what carries the user into SII). */
+export async function login(runtime, options = {}) {
     const start = runtime.clock.now().getTime();
-    const warm = await reuseLiveSession(runtime);
-    if (warm)
-        return warm;
+    const warm = await liveSessionResult(runtime);
+    if (warm && (!options.www2 || (await liveWww2(runtime)))) {
+        auditAlreadyAuthenticated(runtime, warm);
+        if (!options.www2)
+            return warm;
+        const stored = await readSession(runtime.store);
+        return { ...warm, www2: www2StatusOf(stored, runtime.clock.now()) };
+    }
     let session = null;
     try {
         session = await runtime.portal.interactiveLogin({
             destination: HOSTS.miSii,
             timeoutMs: DEFAULT_LOGIN_TIMEOUT_MS,
         });
-        return await finalizeFreshSession(runtime, session, 'browser_login', start);
+        const result = await finalizeFreshSession(runtime, session, 'browser_login', start);
+        if (!options.www2)
+            return result;
+        return { ...result, www2: await mintWww2Layer(runtime, session) };
     }
     catch (err) {
         recordAudit(runtime, { action: 'auth_login', result: 'failed', reason: 'browser_login' });
@@ -156,10 +229,22 @@ export async function login(runtime) {
  *  stored, exactly like the browser path. ONE attempt, never retried (ADR-004).
  *  The Clave never reaches MCP (this task is CLI-only) nor the audit log. */
 export async function consoleLogin(runtime, credentials) {
+    return credentialLoginFlow(runtime, () => Promise.resolve(credentials), 'console_login');
+}
+/** The headless fill-and-submit shared by the console (ADR-010) and keyring (ADR-025)
+ *  paths — they differ ONLY in where the Clave came from, so the attempt policy lives
+ *  in one place: ONE attempt, never retried (ADR-004), Clave discarded with the frame.
+ *  The credentials arrive as a THUNK so the Clave is fetched only once the live-session
+ *  probe has missed: an already-authenticated user must not trigger a keyring-unlock
+ *  prompt for a value nobody will use (review of #101). */
+async function credentialLoginFlow(runtime, getCredentials, reason) {
     const start = runtime.clock.now().getTime();
-    const warm = await reuseLiveSession(runtime);
-    if (warm)
+    const warm = await liveSessionResult(runtime);
+    if (warm) {
+        auditAlreadyAuthenticated(runtime, warm);
         return warm;
+    }
+    const credentials = await getCredentials();
     let session = null;
     try {
         session = await runtime.portal.credentialLogin({
@@ -168,27 +253,72 @@ export async function consoleLogin(runtime, credentials) {
             destination: HOSTS.miSii,
             timeoutMs: CONSOLE_LOGIN_TIMEOUT_MS,
         });
-        return await finalizeFreshSession(runtime, session, 'console_login', start);
+        return await finalizeFreshSession(runtime, session, reason, start);
     }
     catch (err) {
-        recordAudit(runtime, { action: 'auth_login', result: 'failed', reason: 'console_login' });
+        recordAudit(runtime, { action: 'auth_login', result: 'failed', reason });
         throw err;
     }
     finally {
         await session?.close();
     }
 }
+/** The RUT renderings a human plausibly stored the entry under, in lookup order. The
+ *  keyring is populated BY HAND (`secret-tool`, Seahorse, Keychain Access), so the code
+ *  adapts to the human rather than the reverse (ADR-025). `Rut.parse` already upper-cases
+ *  a `k`, so the canonical form covers that variant. */
+export function keyringAccounts(rut) {
+    return [rut.canonical, rut.formatted, String(rut.body)];
+}
+/** CLI-only keyring login (ADR-025): the Clave comes from the OS keyring instead of the
+ *  terminal, and everything else matches `consoleLogin` — ONE attempt, cookies-only
+ *  session, Clave never persisted by us nor audited. Nothing calls this implicitly: an
+ *  expired session still requires the user to run the verb again (ADR-019 lineage). */
+export async function keyringLogin(runtime, args) {
+    // Mod-11 BEFORE anything else: a malformed RUT must never become a wasted SII attempt
+    // (ADR-004), and it must not raise a keyring prompt either.
+    const rut = Rut.parse(args.rut);
+    const secrets = runtime.secrets;
+    if (!secrets) {
+        throw new CredentialNotFoundError('Este runtime no tiene acceso al llavero (SecretStore). Usa `sii auth login --console`.');
+    }
+    return credentialLoginFlow(runtime, async () => {
+        const accounts = keyringAccounts(rut);
+        for (const account of accounts) {
+            const clave = await secrets.get(account);
+            if (clave)
+                return { rut: rut.canonical, clave };
+        }
+        throw new CredentialNotFoundError(`No hay Clave en el llavero para ${rut.canonical} (servicio "${KEYRING_SERVICE}"). ` +
+            `Guárdala con:\n` +
+            `  Linux:  secret-tool store --label='SII' service ${KEYRING_SERVICE} username ${rut.canonical}\n` +
+            `  macOS:  security add-generic-password -s ${KEYRING_SERVICE} -a ${rut.canonical} -w`);
+    }, 'keyring_login');
+}
 /** Server-side close (best-effort) + wipe local session + operate context. */
 export async function logout(runtime) {
     const session = await readSession(runtime.store);
     if (!session) {
         recordAudit(runtime, { action: 'logout', result: 'ok', serverClosed: false });
-        return { loggedOut: false, serverClosed: false };
+        return { loggedOut: false, serverClosed: false, www2Closed: false };
     }
     let serverClosed = false;
+    let www2Closed = false;
     let s = null;
     try {
         s = await runtime.portal.restore(session.cookies);
+        if (session.www2) {
+            // The www2 layer first (ADR-026): its close is the SPA's own `$logout` URL; "closed" =
+            // we came back off that path. Best-effort like the classic one.
+            try {
+                const url = `${WWW2_SESSION_CLOSE_URL}?originalUrl=${encodeURIComponent(WWW2_APP_CARPETA)}`;
+                const landed = await s.goto(url);
+                www2Closed = new URL(landed).pathname !== new URL(WWW2_SESSION_CLOSE_URL).pathname;
+            }
+            catch {
+                // best-effort
+            }
+        }
         const landed = await s.goto(LOGOUT_URL);
         serverClosed = new URL(landed).pathname !== new URL(LOGOUT_URL).pathname;
     }
@@ -200,8 +330,14 @@ export async function logout(runtime) {
     }
     await deleteSession(runtime.store);
     await clearOperateState(runtime.store);
-    recordAudit(runtime, { action: 'logout', result: 'ok', rut: session.rut, serverClosed });
-    return { loggedOut: true, serverClosed };
+    recordAudit(runtime, {
+        action: 'logout',
+        result: 'ok',
+        rut: session.rut,
+        serverClosed,
+        ...(session.www2 ? { www2Closed } : {}),
+    });
+    return { loggedOut: true, serverClosed, www2Closed };
 }
 /** Curated identity readback from the portal. Requires a live session (no implicit
  *  login) — acquired via `withSession`; here an expired jar is an explicit
@@ -212,8 +348,20 @@ export async function statusRefresh(runtime) {
             throw new NotAuthenticatedError('La sesión expiró. Ejecuta `sii auth login`.');
         }
         const identity = identityFromDatos(await s.evaluate(DATOS_EXPR));
+        // The www2 layer, read live: a missing one is a plain `false` here, not an error — the
+        // classic identity is the job; the layer is reported (ADR-026).
+        let www2 = NO_WWW2;
+        try {
+            await readWww2Session(s, WWW2_APP_CARPETA);
+            const stored = await readSession(runtime.store);
+            www2 = { authenticated: true, expiresAt: stored?.www2?.expiresAt ?? null };
+        }
+        catch (e) {
+            if (!(e instanceof Www2SessionError))
+                throw e;
+        }
         recordAudit(runtime, { action: 'auth_status_refresh', result: 'ok', rut: identity.rut });
-        return identity;
+        return { ...identity, www2 };
     });
 }
 /** whoami — the session PRINCIPAL's own razón social/nombre + email, read live from

package/dist/auth/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAGvE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAErF,MAAM,wBAAwB,GAAG,OAAO,CAAC;AACzC,gFAAgF;AAChF,mFAAmF;AACnF,MAAM,wBAAwB,GAAG,MAAM,CAAC;AACxC,mFAAmF;AACnF,MAAM,UAAU,GAAG,2DAA2D,CAAC;AAkD/E,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAuB;IACvD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,OAAO;QACZ,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,aAAa,EAAE,QAAQ,EAAE;QACpE,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAuB;IAChD,MAAM,CAAC,GAAG,KAAK,EAAE,aAAa,CAAC;IAC/B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;QACpD,MAAM,IAAI,gBAAgB,CAAC,iEAAiE,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC;IACpD,MAAM,WAAW,GAAgB,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAClG,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;IACjD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC;AACjD,CAAC;AAED;;0FAE0F;AAC1F,KAAK,UAAU,cAAc,CAAC,OAAgB;IAC5C,IAAI,CAAC;QACH,OAAO,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,CACjD,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CACrE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;0EAC0E;AAC1E,KAAK,UAAU,gBAAgB,CAAC,OAAgB;IAC9C,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,GAAG,EAAE,CAAC;QACR,WAAW,CAAC,OAAO,EAAE;YACnB,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,IAAI;YACZ,GAAG;YACH,MAAM,EAAE,uBAAuB;SAChC,CAAC,CAAC;QACH,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;gCAIgC;AAChC,KAAK,UAAU,eAAe,CAC5B,OAAgB,EAChB,OAAsB,EACtB,QAAsB;IAEtB,MAAM,IAAI,GAAkB;QAC1B,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,WAAW,EAAE,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,GAAG;QAC5C,MAAM,EAAE,IAAI;KACb,CAAC;IACF,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC3E,MAAM,OAAO,GAAoB,QAAQ;aACtC,MAAM,CAAC,CAAC,CAAC,EAA4C,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC;aACvE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG;YACnC,MAAM,EAAE,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG;SAC/B,CAAC,CAAC,CAAC;QACN,gFAAgF;QAChF,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,CAAC;QAC9E,WAAW,CAAC,OAAO,EAAE;YACnB,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,IAAI;YACZ,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,KAAK,EAAE,QAAQ,CAAC,MAAM;SACvB,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QACxF,OAAO,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;+EAE+E;AAC/E,KAAK,UAAU,oBAAoB,CACjC,OAAgB,EAChB,OAAsB,EACtB,MAAyC,EACzC,KAAa;IAEb,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,gBAAgB,CAAC,+DAA+D,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAmB,UAAU,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;IAC7C,MAAM,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE;QAChC,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,OAAO;QACP,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;KAC3C,CAAC,CAAC;IAEH,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACnE,MAAM,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE;QACpC,OAAO,EAAE,QAAQ,CAAC,GAAG;QACrB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,QAAQ;KACT,CAAC,CAAC;IAEH,WAAW,CAAC,OAAO,EAAE;QACnB,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,IAAI;QACZ,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,MAAM;QACN,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK;KAClD,CAAC,CAAC;IACH,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC;AAC5D,CAAC;AAED;;wDAEwD;AACxD,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,OAAgB;IAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAEtB,IAAI,OAAO,GAAyB,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC;YAC9C,WAAW,EAAE,KAAK,CAAC,KAAK;YACxB,SAAS,EAAE,wBAAwB;SACpC,CAAC,CAAC;QACH,OAAO,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QAC1F,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED;;;6EAG6E;AAC7E,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAgB,EAChB,WAA2C;IAE3C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAEtB,IAAI,OAAO,GAAyB,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC;YAC7C,GAAG,EAAE,WAAW,CAAC,GAAG;YACpB,KAAK,EAAE,WAAW,CAAC,KAAK;YACxB,WAAW,EAAE,KAAK,CAAC,KAAK;YACxB,SAAS,EAAE,wBAAwB;SACpC,CAAC,CAAC;QACH,OAAO,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QAC1F,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAgB;IAC3C,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IACnD,CAAC;IAED,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,CAAC,GAAyB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxC,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,MAAM,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACvC,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;IACzF,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AAC3C,CAAC;AAED;;mFAEmF;AACnF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAgB;IAClD,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,qBAAqB,CAAC,6CAA6C,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAmB,UAAU,CAAC,CAAC,CAAC;QACnF,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QACzF,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;uFAIuF;AACvF,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAgB;IAC3C,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,qBAAqB,CAAC,6CAA6C,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAmB,UAAU,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;QACjE,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5E,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;IAClG,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,eAAe,EACf,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAGvE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAErF,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,MAAM,wBAAwB,GAAG,OAAO,CAAC;AACzC,gFAAgF;AAChF,mFAAmF;AACnF,MAAM,wBAAwB,GAAG,MAAM,CAAC;AACxC,mFAAmF;AACnF,MAAM,UAAU,GAAG,2DAA2D,CAAC;AAmE/E,MAAM,OAAO,GAAmB,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAE1E,SAAS,YAAY,CAAC,OAA6B,EAAE,GAAS;IAC5D,MAAM,KAAK,GAAG,OAAO,EAAE,IAAI,CAAC;IAC5B,IAAI,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC;IAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAC9F,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;AAC9D,CAAC;AAED;iEACiE;AACjE,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAuB,EAAE,GAAS;IAClE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,OAAO;QACZ,CAAC,CAAC;YACE,aAAa,EAAE,IAAI;YACnB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,aAAa,EAAE,QAAQ;YACvB,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC;SACjC;QACH,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAChF,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAuB;IAChD,MAAM,CAAC,GAAG,KAAK,EAAE,aAAa,CAAC;IAC/B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;QACpD,MAAM,IAAI,gBAAgB,CAAC,iEAAiE,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC;IACpD,MAAM,WAAW,GAAgB,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAClG,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;IACjD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC;AACjD,CAAC;AAED;;0FAE0F;AAC1F,KAAK,UAAU,cAAc,CAAC,OAAgB;IAC5C,IAAI,CAAC;QACH,OAAO,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,CACjD,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CACrE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;sFAGsF;AACtF,KAAK,UAAU,iBAAiB,CAAC,OAAgB;IAC/C,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpF,CAAC;AAED,qEAAqE;AACrE,SAAS,yBAAyB,CAAC,OAAgB,EAAE,IAAqB;IACxE,WAAW,CAAC,OAAO,EAAE;QACnB,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,IAAI;QACZ,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CAAC;AACL,CAAC;AAED;;;;gCAIgC;AAChC,KAAK,UAAU,eAAe,CAC5B,OAAgB,EAChB,OAAsB,EACtB,QAAsB;IAEtB,MAAM,IAAI,GAAkB;QAC1B,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,WAAW,EAAE,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,GAAG;QAC5C,MAAM,EAAE,IAAI;KACb,CAAC;IACF,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC3E,MAAM,OAAO,GAAoB,QAAQ;aACtC,MAAM,CAAC,CAAC,CAAC,EAA4C,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC;aACvE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG;YACnC,MAAM,EAAE,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG;SAC/B,CAAC,CAAC,CAAC;QACN,gFAAgF;QAChF,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,CAAC;QAC9E,WAAW,CAAC,OAAO,EAAE;YACnB,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,IAAI;YACZ,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,KAAK,EAAE,QAAQ,CAAC,MAAM;SACvB,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QACxF,OAAO,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;+EAE+E;AAC/E,KAAK,UAAU,oBAAoB,CACjC,OAAgB,EAChB,OAAsB,EACtB,MAA2D,EAC3D,KAAa;IAEb,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,gBAAgB,CAAC,+DAA+D,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAmB,UAAU,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;IAC7C,MAAM,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE;QAChC,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,OAAO;QACP,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;KAC3C,CAAC,CAAC;IAEH,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACnE,MAAM,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE;QACpC,OAAO,EAAE,QAAQ,CAAC,GAAG;QACrB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,QAAQ;KACT,CAAC,CAAC;IAEH,WAAW,CAAC,OAAO,EAAE;QACnB,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,IAAI;QACZ,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,MAAM;QACN,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK;KAClD,CAAC,CAAC;IACH,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC;AAC5D,CAAC;AAQD;iEACiE;AACjE,KAAK,UAAU,QAAQ,CAAC,OAAgB;IACtC,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;kDAGkD;AAClD,KAAK,UAAU,aAAa,CAAC,OAAgB,EAAE,OAAsB;IACnE,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,qBAAqB,CAAC,0CAA0C,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;QAChD,MAAM,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAClD,MAAM,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE;YAChC,GAAG,MAAM;YACT,OAAO,EAAE,iBAAiB,CAAC,UAAU,EAAE,OAAO,CAAC;YAC/C,IAAI,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE;SAC7B,CAAC,CAAC;QACH,WAAW,CAAC,OAAO,EAAE;YACnB,MAAM,EAAE,iBAAiB;YACzB,MAAM,EAAE,IAAI;YACZ,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK;SAClD,CAAC,CAAC;QACH,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACvF,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;sFAIsF;AACtF,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,OAAgB,EAChB,UAAwB,EAAE;IAE1B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChD,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;IACtE,CAAC;IAED,IAAI,OAAO,GAAyB,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC;YAC9C,WAAW,EAAE,KAAK,CAAC,KAAK;YACxB,SAAS,EAAE,wBAAwB;SACpC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC;QACpF,IAAI,CAAC,OAAO,CAAC,IAAI;YAAE,OAAO,MAAM,CAAC;QACjC,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;IACpE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QAC1F,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED;;;6EAG6E;AAC7E,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAgB,EAChB,WAA2C;IAE3C,OAAO,mBAAmB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;2DAK2D;AAC3D,KAAK,UAAU,mBAAmB,CAChC,OAAgB,EAChB,cAA6D,EAC7D,MAAyC;IAEzC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,IAAI,EAAE,CAAC;QACT,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,cAAc,EAAE,CAAC;IAC3C,IAAI,OAAO,GAAyB,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC;YAC7C,GAAG,EAAE,WAAW,CAAC,GAAG;YACpB,KAAK,EAAE,WAAW,CAAC,KAAK;YACxB,WAAW,EAAE,KAAK,CAAC,KAAK;YACxB,SAAS,EAAE,wBAAwB;SACpC,CAAC,CAAC;QACH,OAAO,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACzE,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED;;;wDAGwD;AACxD,MAAM,UAAU,eAAe,CAAC,GAAQ;IACtC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;uFAGuF;AACvF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAgB,EAChB,IAAqB;IAErB,sFAAsF;IACtF,4DAA4D;IAC5D,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,uBAAuB,CAC/B,wFAAwF,CACzF,CAAC;IACJ,CAAC;IACD,OAAO,mBAAmB,CACxB,OAAO,EACP,KAAK,IAAI,EAAE;QACT,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACtC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,KAAK;gBAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;QAClD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,mCAAmC,GAAG,CAAC,SAAS,eAAe,eAAe,MAAM;YAClF,iBAAiB;YACjB,qDAAqD,eAAe,aAAa,GAAG,CAAC,SAAS,IAAI;YAClG,8CAA8C,eAAe,OAAO,GAAG,CAAC,SAAS,KAAK,CACzF,CAAC;IACJ,CAAC,EACD,eAAe,CAChB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAgB;IAC3C,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACtE,CAAC;IAED,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,CAAC,GAAyB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,uFAAuF;YACvF,gEAAgE;YAChE,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,GAAG,sBAAsB,gBAAgB,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC5F,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACjC,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,IAAI,GAAG,CAAC,sBAAsB,CAAC,CAAC,QAAQ,CAAC;YACrF,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxC,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,MAAM,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACvC,WAAW,CAAC,OAAO,EAAE;QACnB,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,IAAI;QACZ,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,YAAY;QACZ,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC,CAAC;IACH,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;AACvD,CAAC;AAED;;mFAEmF;AACnF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAgB;IAClD,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,qBAAqB,CAAC,6CAA6C,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAmB,UAAU,CAAC,CAAC,CAAC;QACnF,uFAAuF;QACvF,gEAAgE;QAChE,IAAI,IAAI,GAAmB,OAAO,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAChD,IAAI,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,IAAI,IAAI,EAAE,CAAC;QAC7E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,CAAC,CAAC,YAAY,gBAAgB,CAAC;gBAAE,MAAM,CAAC,CAAC;QAChD,CAAC;QACD,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QACzF,OAAO,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;uFAIuF;AACvF,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAgB;IAC3C,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,qBAAqB,CAAC,6CAA6C,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAmB,UAAU,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;QACjE,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5E,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;IAClG,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/session.d.ts

@@ -1,14 +1,29 @@
 import type { KeyValueStore, PortalSession, Runtime } from '../seams/index.js';
+/** The www2 APP-SESSION layer riding in the same cookies-only jar (ADR-026). Present only after
+ *  `sii auth login --www2`; `expiresAt` is the `X-SII-STATE-CT` cookie's own expiry (observed
+ *  ~100 min), null when the cookie carried none. Metadata only — the cookies themselves live in
+ *  `cookies` like the classic ones. */
+export interface StoredWww2Layer {
+    readonly savedAt: string;
+    readonly expiresAt: string | null;
+}
 export interface StoredSession {
     /** Canonical session-principal RUT (read from the portal, not a credential). */
     readonly rut: string;
-    /** Cookies-only storage state (opaque to the core). */
+    /** Cookies-only storage state (opaque to the core). Holds BOTH layers once `--www2` ran. */
     readonly cookies: unknown;
     readonly savedAt: string;
+    readonly www2?: StoredWww2Layer;
 }
 export declare function readSession(store: KeyValueStore): Promise<StoredSession | null>;
 export declare function writeSession(store: KeyValueStore, session: StoredSession): Promise<void>;
 export declare function deleteSession(store: KeyValueStore): Promise<void>;
+/** Reject a representing operate pointer BEFORE opening a session — the guard every SESSION-KEYED
+ *  surface (F29, BHE, Carpeta…) runs first (ADR-005). `error` builds the surface's own typed error
+ *  from the formatted empresa RUT (already user-visible via `operate --list`, so safe to echo; the
+ *  razón social is PII and is NOT passed). No operate state → resolves; `withSession` then raises
+ *  NotAuthenticated. Single implementation: the third copy (carpeta) turned it into a helper. */
+export declare function assertOperatingSelf(runtime: Runtime, error: (empresaFormatted: string) => Error): Promise<void>;
 export interface SessionContext {
     /** Canonical session-principal RUT (who is logged in). */
     readonly sessionRut: string;

package/dist/auth/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAK/E,MAAM,WAAW,aAAa;IAC5B,gFAAgF;IAChF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAsB,WAAW,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAErF;AAED,wBAAsB,YAAY,CAAC,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9F;AAED,wBAAsB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvE;AAED,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;mDAE+C;IAC/C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;+CAO+C;AAC/C,wBAAsB,WAAW,CAAC,CAAC,EACjC,OAAO,EAAE,OAAO,EAChB,EAAE,EAAE,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,CAAC,CAAC,EAC/D,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7B,OAAO,CAAC,CAAC,CAAC,CA4BZ"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAK/E;;;uCAGuC;AACvC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,aAAa;IAC5B,gFAAgF;IAChF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC;CACjC;AAED,wBAAsB,WAAW,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAErF;AAED,wBAAsB,YAAY,CAAC,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9F;AAED,wBAAsB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvE;AAED;;;;iGAIiG;AACjG,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,CAAC,gBAAgB,EAAE,MAAM,KAAK,KAAK,GACzC,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;mDAE+C;IAC/C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;+CAO+C;AAC/C,wBAAsB,WAAW,CAAC,CAAC,EACjC,OAAO,EAAE,OAAO,EAChB,EAAE,EAAE,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,CAAC,CAAC,EAC/D,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7B,OAAO,CAAC,CAAC,CAAC,CA4BZ"}

package/dist/auth/session.js

@@ -1,5 +1,6 @@
 import { NotAuthenticatedError } from '../errors/index.js';
 import { readOperateState, resolveOperableTarget } from '../identity/index.js';
+import { Rut } from '../rut/index.js';
 // Distinct KeyValueStore key (ADR-007) — never shares a file with `identity`'s 'operate'.
 const SESSION_KEY = 'session';
 export async function readSession(store) {
@@ -11,6 +12,17 @@ export async function writeSession(store, session) {
 export async function deleteSession(store) {
     await store.delete(SESSION_KEY);
 }
+/** Reject a representing operate pointer BEFORE opening a session — the guard every SESSION-KEYED
+ *  surface (F29, BHE, Carpeta…) runs first (ADR-005). `error` builds the surface's own typed error
+ *  from the formatted empresa RUT (already user-visible via `operate --list`, so safe to echo; the
+ *  razón social is PII and is NOT passed). No operate state → resolves; `withSession` then raises
+ *  NotAuthenticated. Single implementation: the third copy (carpeta) turned it into a helper. */
+export async function assertOperatingSelf(runtime, error) {
+    const op = await readOperateState(runtime.store);
+    if (op && op.operatingRut !== op.selfRut) {
+        throw error(Rut.parse(op.operatingRut).formatted);
+    }
+}
 /** Acquire a live `PortalSession` from the stored cookies-only session and run `fn`
  *  against it. This is how DOMAIN TASKS reach SII: they consume a session, they
  *  NEVER mint one (only `login` mints — ADR-006, sii-py ADR-019). The operating/body

package/dist/auth/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAG/E,0FAA0F;AAC1F,MAAM,WAAW,GAAG,SAAS,CAAC;AAU9B,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAoB;IACpD,OAAO,KAAK,CAAC,IAAI,CAAgB,WAAW,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAoB,EAAE,OAAsB;IAC7E,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAoB;IACtD,MAAM,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAClC,CAAC;AAWD;;;;;;;+CAO+C;AAC/C,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAgB,EAChB,EAA+D,EAC/D,UAA4B,EAAE;IAE9B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,qBAAqB,CAAC,0CAA0C,CAAC,CAAC;IAC9E,CAAC;IACD,2EAA2E;IAC3E,mFAAmF;IACnF,qFAAqF;IACrF,iFAAiF;IACjF,2EAA2E;IAC3E,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3D,IAAI,YAAoB,CAAC;IACzB,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,qBAAqB,CAAC,0CAA0C,CAAC,CAAC;QAC9E,CAAC;QACD,YAAY,GAAG,qBAAqB,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAClE,CAAC;SAAM,CAAC;QACN,YAAY,GAAG,YAAY,EAAE,YAAY,IAAI,MAAM,CAAC,GAAG,CAAC;IAC1D,CAAC;IAED,IAAI,CAAC,GAAyB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjD,OAAO,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;IAC/D,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC"}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAGtC,0FAA0F;AAC1F,MAAM,WAAW,GAAG,SAAS,CAAC;AAoB9B,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAoB;IACpD,OAAO,KAAK,CAAC,IAAI,CAAgB,WAAW,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAoB,EAAE,OAAsB;IAC7E,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAoB;IACtD,MAAM,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAClC,CAAC;AAED;;;;iGAIiG;AACjG,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAgB,EAChB,KAA0C;IAE1C,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,EAAE,IAAI,EAAE,CAAC,YAAY,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC;QACzC,MAAM,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAWD;;;;;;;+CAO+C;AAC/C,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAgB,EAChB,EAA+D,EAC/D,UAA4B,EAAE;IAE9B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,qBAAqB,CAAC,0CAA0C,CAAC,CAAC;IAC9E,CAAC;IACD,2EAA2E;IAC3E,mFAAmF;IACnF,qFAAqF;IACrF,iFAAiF;IACjF,2EAA2E;IAC3E,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3D,IAAI,YAAoB,CAAC;IACzB,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,qBAAqB,CAAC,0CAA0C,CAAC,CAAC;QAC9E,CAAC;QACD,YAAY,GAAG,qBAAqB,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAClE,CAAC;SAAM,CAAC;QACN,YAAY,GAAG,YAAY,EAAE,YAAY,IAAI,MAAM,CAAC,GAAG,CAAC;IAC1D,CAAC;IAED,IAAI,CAAC,GAAyB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjD,OAAO,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;IAC/D,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/auth/www2-login.d.ts

@@ -0,0 +1,28 @@
+import type { Www2Session } from '../portal/www2-session.js';
+import type { PortalSession, Runtime } from '../seams/index.js';
+/** Same budget as the classic headed login: a human has to read the chooser, type the Clave and
+ *  pass the reCAPTCHA. */
+export declare const WWW2_LOGIN_TIMEOUT_MS = 300000;
+/** How often the app session is re-read while the user is at the OAuth page. Each read is one
+ *  cheap GET the SPA itself issues on every route change (observed), paced via `Clock.sleep`. */
+export declare const WWW2_POLL_MS = 2000;
+/** The www2 app-session cookies all share this prefix (observed 2026-09-12): a literal
+ *  `X-SII-STATE-TYPE` plus a state cookie whose suffix VARIES (`X-SII-STATE-CT` and
+ *  `X-SII-STATE-CL` both seen — the letter is not stable), and every one carries the SAME
+ *  expiry (~100 min). So the layer's expiry is read from ANY of them, not a fixed name. */
+export declare const WWW2_STATE_COOKIE_PREFIX = "X-SII-STATE-";
+/** Union of the classic jar (snapshotted BEFORE the www2 step) and the jar AFTER it: every classic
+ *  cookie is kept, every www2 cookie is added, and on a same-identity collision the later (www2)
+ *  value wins — a fresher load-balancer/analytics cookie, never a lost classic one. Falls back to
+ *  the www2 state alone only when the classic one is not a cookie list at all. */
+export declare function mergeStorageState(classic: unknown, www2: unknown): unknown;
+/** ISO expiry of the www2 layer, read off any `X-SII-STATE-*` cookie (they share one expiry;
+ *  Playwright carries `expires` as epoch SECONDS, `-1` = session cookie). Null when none is present
+ *  or all are session-scoped. Takes the max, so a session-scoped `-TYPE` never masks a dated pair. */
+export declare function www2ExpiresAt(state: unknown): string | null;
+/** Drive the headed `session` (already past the classic login) to the www2 app page and wait for
+ *  the user to complete SII's OAuth login there, polling the app-session read until it answers or
+ *  the budget runs out. Resolves the session JSON; raises `LoginFailedError` on timeout. Any error
+ *  other than "no app session yet" propagates — never retried (ADR-004). */
+export declare function waitForWww2Session(runtime: Runtime, session: PortalSession, timeoutMs?: number): Promise<Www2Session>;
+//# sourceMappingURL=www2-login.d.ts.map

package/dist/auth/www2-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"www2-login.d.ts","sourceRoot":"","sources":["../../src/auth/www2-login.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEhE;0BAC0B;AAC1B,eAAO,MAAM,qBAAqB,SAAU,CAAC;AAC7C;iGACiG;AACjG,eAAO,MAAM,YAAY,OAAQ,CAAC;AAElC;;;2FAG2F;AAC3F,eAAO,MAAM,wBAAwB,iBAAiB,CAAC;AA8BvD;;;kFAGkF;AAClF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAS1E;AAED;;sGAEsG;AACtG,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAW3D;AAED;;;4EAG4E;AAC5E,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,aAAa,EACtB,SAAS,GAAE,MAA8B,GACxC,OAAO,CAAC,WAAW,CAAC,CAiBtB"}

package/dist/auth/www2-login.js

@@ -0,0 +1,101 @@
+// The www2 APP-SESSION step of `sii auth login --www2` (ADR-026): mint the second cookies-only
+// layer `www2.sii.cl/app/*` needs, the ADR-006 way — the user types the Clave into SII's real
+// OAuth page in the SAME headed browser the classic login used; we keep cookies only.
+//
+// Observed 2026-09-11/12 (#110, docs/sii-contract/auth-login.md § www2): the app page bounces an
+// app-session-less browser to `/bifurcacion` (the chooser) → `/oauthsii-v1/` (Clave + reCAPTCHA
+// Enterprise, hence NEVER automated — a human types) → `/app/session/create` → back to the app,
+// now holding the httpOnly `.sii.cl` pair `X-SII-STATE-CT` + `X-SII-STATE-TYPE` (~100 min). The
+// OAuth page WIPES the classic cookies from the browser context on mount, so the classic jar is
+// snapshotted BEFORE this step and the www2 cookies are ADDED to it — never the reverse.
+import { WWW2_APP_CARPETA } from '../config/index.js';
+import { LoginFailedError, Www2SessionError } from '../errors/index.js';
+import { readWww2Session } from '../portal/www2-session.js';
+/** Same budget as the classic headed login: a human has to read the chooser, type the Clave and
+ *  pass the reCAPTCHA. */
+export const WWW2_LOGIN_TIMEOUT_MS = 300_000;
+/** How often the app session is re-read while the user is at the OAuth page. Each read is one
+ *  cheap GET the SPA itself issues on every route change (observed), paced via `Clock.sleep`. */
+export const WWW2_POLL_MS = 2_000;
+/** The www2 app-session cookies all share this prefix (observed 2026-09-12): a literal
+ *  `X-SII-STATE-TYPE` plus a state cookie whose suffix VARIES (`X-SII-STATE-CT` and
+ *  `X-SII-STATE-CL` both seen — the letter is not stable), and every one carries the SAME
+ *  expiry (~100 min). So the layer's expiry is read from ANY of them, not a fixed name. */
+export const WWW2_STATE_COOKIE_PREFIX = 'X-SII-STATE-';
+const cookiesOf = (state) => {
+    if (state &&
+        typeof state === 'object' &&
+        Array.isArray(state.cookies)) {
+        return state.cookies;
+    }
+    return null;
+};
+// Identity of a cookie for the merge: name + domain + path (a scalar entry — the fakes use plain
+// strings — keys by its own JSON so it survives the union untouched).
+const keyOf = (c) => {
+    if (c && typeof c === 'object') {
+        const k = c;
+        return `${String(k.name)}|${String(k.domain)}|${String(k.path)}`;
+    }
+    return JSON.stringify(c);
+};
+/** Union of the classic jar (snapshotted BEFORE the www2 step) and the jar AFTER it: every classic
+ *  cookie is kept, every www2 cookie is added, and on a same-identity collision the later (www2)
+ *  value wins — a fresher load-balancer/analytics cookie, never a lost classic one. Falls back to
+ *  the www2 state alone only when the classic one is not a cookie list at all. */
+export function mergeStorageState(classic, www2) {
+    const a = cookiesOf(classic);
+    const b = cookiesOf(www2);
+    if (!a)
+        return www2;
+    if (!b)
+        return classic;
+    const merged = new Map();
+    for (const c of a)
+        merged.set(keyOf(c), c);
+    for (const c of b)
+        merged.set(keyOf(c), c);
+    return { ...www2, cookies: [...merged.values()] };
+}
+/** ISO expiry of the www2 layer, read off any `X-SII-STATE-*` cookie (they share one expiry;
+ *  Playwright carries `expires` as epoch SECONDS, `-1` = session cookie). Null when none is present
+ *  or all are session-scoped. Takes the max, so a session-scoped `-TYPE` never masks a dated pair. */
+export function www2ExpiresAt(state) {
+    let best = 0;
+    for (const c of cookiesOf(state) ?? []) {
+        if (!c || typeof c !== 'object')
+            continue;
+        const k = c;
+        if (typeof k.name !== 'string' || !k.name.startsWith(WWW2_STATE_COOKIE_PREFIX))
+            continue;
+        if (typeof k.expires === 'number' && k.expires > best)
+            best = k.expires;
+    }
+    if (best <= 0)
+        return null;
+    const d = new Date(best * 1000);
+    return Number.isNaN(d.getTime()) ? null : d.toISOString();
+}
+/** Drive the headed `session` (already past the classic login) to the www2 app page and wait for
+ *  the user to complete SII's OAuth login there, polling the app-session read until it answers or
+ *  the budget runs out. Resolves the session JSON; raises `LoginFailedError` on timeout. Any error
+ *  other than "no app session yet" propagates — never retried (ADR-004). */
+export async function waitForWww2Session(runtime, session, timeoutMs = WWW2_LOGIN_TIMEOUT_MS) {
+    const start = runtime.clock.now().getTime();
+    await session.goto(WWW2_APP_CARPETA);
+    for (;;) {
+        try {
+            return await readWww2Session(session, WWW2_APP_CARPETA);
+        }
+        catch (e) {
+            if (!(e instanceof Www2SessionError))
+                throw e;
+        }
+        if (runtime.clock.now().getTime() - start >= timeoutMs) {
+            throw new LoginFailedError('Login www2 no completado (tiempo agotado en la página OAuth del SII). La sesión de ' +
+                'Mi SII sí quedó guardada; reintenta `sii auth login --www2` para la capa www2.');
+        }
+        await runtime.clock.sleep(WWW2_POLL_MS);
+    }
+}
+//# sourceMappingURL=www2-login.js.map

package/dist/auth/www2-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"www2-login.js","sourceRoot":"","sources":["../../src/auth/www2-login.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,8FAA8F;AAC9F,sFAAsF;AACtF,EAAE;AACF,iGAAiG;AACjG,gGAAgG;AAChG,gGAAgG;AAChG,gGAAgG;AAChG,gGAAgG;AAChG,yFAAyF;AACzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAI5D;0BAC0B;AAC1B,MAAM,CAAC,MAAM,qBAAqB,GAAG,OAAO,CAAC;AAC7C;iGACiG;AACjG,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,CAAC;AAElC;;;2FAG2F;AAC3F,MAAM,CAAC,MAAM,wBAAwB,GAAG,cAAc,CAAC;AAUvD,MAAM,SAAS,GAAG,CAAC,KAAc,EAAoB,EAAE;IACrD,IACE,KAAK;QACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,OAAO,CAAE,KAA+B,CAAC,OAAO,CAAC,EACvD,CAAC;QACD,OAAQ,KAAgC,CAAC,OAAO,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AACF,iGAAiG;AACjG,sEAAsE;AACtE,MAAM,KAAK,GAAG,CAAC,CAAU,EAAU,EAAE;IACnC,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAe,CAAC;QAC1B,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC,CAAC;AAEF;;;kFAGkF;AAClF,MAAM,UAAU,iBAAiB,CAAC,OAAgB,EAAE,IAAa;IAC/D,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,CAAC,CAAC;QAAE,OAAO,OAAO,CAAC;IACvB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3C,OAAO,EAAE,GAAI,IAAe,EAAE,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;AAChE,CAAC;AAED;;sGAEsG;AACtG,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QAC1C,MAAM,CAAC,GAAG,CAAe,CAAC;QAC1B,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC;YAAE,SAAS;QACzF,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,GAAG,IAAI;YAAE,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC;IAC1E,CAAC;IACD,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAC5D,CAAC;AAED;;;4EAG4E;AAC5E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAgB,EAChB,OAAsB,EACtB,YAAoB,qBAAqB;IAEzC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC5C,MAAM,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACrC,SAAS,CAAC;QACR,IAAI,CAAC;YACH,OAAO,MAAM,eAAe,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,CAAC,CAAC,YAAY,gBAAgB,CAAC;gBAAE,MAAM,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,IAAI,SAAS,EAAE,CAAC;YACvD,MAAM,IAAI,gBAAgB,CACxB,qFAAqF;gBACnF,gFAAgF,CACnF,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC"}

package/dist/cli.d.ts

@@ -1,3 +1,3 @@
-export { consoleLogin } from './tasks/auth.js';
+export { consoleLogin, keyringLogin } from './tasks/auth.js';
 export type { AuthLoginResult } from './tasks/auth.js';
 //# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC7D,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/cli.js

@@ -2,5 +2,7 @@
 // a Clave argument, so it is DELIBERATELY kept out of the main barrel (`@albertomarturelo/sii-core`)
 // — the MCP server imports only the main barrel and must never wire a task that
 // takes a password (ADR-006). The terminal CLI imports this subpath instead.
-export { consoleLogin } from './tasks/auth.js';
+// `keyringLogin` joins it for the same reason: it READS a Clave (from the OS keyring),
+// so it must be unreachable from the MCP server (ADR-025).
+export { consoleLogin, keyringLogin } from './tasks/auth.js';
 //# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,oHAAoH;AACpH,qGAAqG;AACrG,gFAAgF;AAChF,6EAA6E;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,oHAAoH;AACpH,qGAAqG;AACrG,gFAAgF;AAChF,6EAA6E;AAC7E,uFAAuF;AACvF,2DAA2D;AAC3D,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/config/config.d.ts

@@ -10,6 +10,12 @@ export declare const HOSTS: {
     readonly portal: "https://www.sii.cl";
     /** SPA JSON facades (RCV / F29 / F22) live under this host. */
     readonly portalApi: "https://www4.sii.cl";
+    /** The newer SPA apps + their `/app/<name>-api/*` JSON facades — first the Carpeta
+     *  Tributaria (`/carpetatributaria/…` SPA over `/app/cte-api-carpetatributaria/{rut}/…`).
+     *  The `.sii.cl` session cookie SSO-carries, but every `cte-api` call answers 401 until
+     *  the app's own `GET /app/session/status?originalUrl=…` warm-up ran (observed
+     *  2026-09-11, #110). (#109 / #110) */
+    readonly portalApp: "https://www2.sii.cl";
     /** Legacy BHE/BTE consulta CGIs (boletas de honorarios). HTML skeleton filled
      *  client-side from inline JS maps; read via `PortalSession.goto`/`evaluate`, NOT
      *  the SDI-JSON facade. The `.sii.cl` session cookie SSO-carries here (observed
@@ -42,6 +48,18 @@ export declare const LOGIN_HOST = "zeusr.sii.cl";
 export declare const LOGIN_URL: string;
 /** Full server-side logout URL (host + path). The close redirects OFF this path. */
 export declare const LOGOUT_URL: string;
+/** The www2 app page `sii auth login --www2` opens for the user to complete SII's OAuth login
+ *  (`/bifurcacion` → `/oauthsii-v1/` → `/app/session/create` → back here), and the `Referer` /
+ *  `originalUrl` the Carpeta SPA sends on its own calls. Observed 2026-09-11/12 (#110, ADR-026). */
+export declare const WWW2_APP_CARPETA: string;
+/** The www2 app-session close (the SPA's `$logout`: `/app/session/close?originalUrl=…`, from the
+ *  session library `chunk-vendors.659f67b1.js`, observed 2026-09-11). Best-effort on logout. */
+export declare const WWW2_SESSION_CLOSE_URL: string;
+/** The keyring "service" every entry of this tool lives under; the account (`username`
+ *  in keyring terms) is the RUT. Lives here — with the other environment constants —
+ *  because BOTH the pure `keyringLogin` task (for its error message) and the Node
+ *  adapter that reads the store need it (ADR-025). */
+export declare const KEYRING_SERVICE = "sii";
 export interface Settings {
     /** Max requests/second used to pace portal POSTs (sii-py ADR-011). */
     readonly rateLimitRps: number;