@albertomarturelo/sii-core 0.8.0 → 0.10.0

package/dist/tasks/auth.d.ts

@@ -1,19 +1,27 @@
-import type { AuthIdentity, AuthLoginResult, AuthLogoutResult, AuthStatusLocal, AuthWhoami } from '../auth/index.js';
+import type { AuthIdentity, AuthIdentityRefresh, AuthLoginResult, AuthLogoutResult, AuthStatusLocal, AuthWhoami, AuthWww2Status, LoginOptions } from '../auth/index.js';
 import type { Runtime } from '../seams/index.js';
-export declare function login(runtime: Runtime): Promise<AuthLoginResult>;
+/** Browser login (ADR-006). `www2: true` also mints the www2 app-session layer in the same headed
+ *  browser (ADR-026) — the user types the Clave into SII's OAuth page; never a password argument. */
+export declare function login(runtime: Runtime, options?: LoginOptions): Promise<AuthLoginResult>;
 /** CLI-only (ADR-010): RUT + Clave from the console → headless login → cookies
  *  only. The Clave is used once and never stored. NEVER expose over MCP. */
 export declare function consoleLogin(runtime: Runtime, credentials: {
     rut: string;
     clave: string;
 }): Promise<AuthLoginResult>;
+/** CLI-only (ADR-025): the Clave comes from the OS keyring (service `sii`, username =
+ *  the RUT) instead of the terminal. ONE attempt, no implicit re-login. NEVER over MCP. */
+export declare function keyringLogin(runtime: Runtime, args: {
+    rut: string;
+}): Promise<AuthLoginResult>;
 export declare function logout(runtime: Runtime): Promise<AuthLogoutResult>;
-/** Pure local read (no portal call). */
+/** Pure local read (no portal call). The www2 layer's `authenticated` is decided by its stored
+ *  cookie expiry against the clock. */
 export declare function authStatus(runtime: Runtime): Promise<AuthStatusLocal>;
-/** Curated identity readback from the portal (needs a live session). */
-export declare function statusRefresh(runtime: Runtime): Promise<AuthIdentity>;
+/** Curated identity readback from the portal (needs a live session) + the www2 layer read live. */
+export declare function statusRefresh(runtime: Runtime): Promise<AuthIdentityRefresh>;
 /** whoami — the authenticated principal's own razón social/nombre + email (own PII).
  *  Live portal read; session-keyed (ignores the operate pointer). */
 export declare function whoami(runtime: Runtime): Promise<AuthWhoami>;
-export type { AuthIdentity, AuthLoginResult, AuthLogoutResult, AuthStatusLocal, AuthWhoami };
+export type { AuthIdentity, AuthIdentityRefresh, AuthLoginResult, AuthLogoutResult, AuthStatusLocal, AuthWhoami, AuthWww2Status, LoginOptions, };
 //# sourceMappingURL=auth.d.ts.map

package/dist/tasks/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/tasks/auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,UAAU,EACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD,wBAAgB,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,CAEhE;AAED;4EAC4E;AAC5E,wBAAgB,YAAY,CAC1B,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC1C,OAAO,CAAC,eAAe,CAAC,CAE1B;AAED,wBAAgB,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAElE;AAED,wCAAwC;AACxC,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,CAErE;AAED,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CAErE;AAED;qEACqE;AACrE,wBAAgB,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAE5D;AAED,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/tasks/auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,UAAU,EACV,cAAc,EACd,YAAY,EACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD;qGACqG;AACrG,wBAAgB,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,eAAe,CAAC,CAE5F;AAED;4EAC4E;AAC5E,wBAAgB,YAAY,CAC1B,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC1C,OAAO,CAAC,eAAe,CAAC,CAE1B;AAED;2FAC2F;AAC3F,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAE9F;AAED,wBAAgB,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAElE;AAED;uCACuC;AACvC,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,CAErE;AAED,mGAAmG;AACnG,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAE5E;AAED;qEACqE;AACrE,wBAAgB,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAE5D;AAED,YAAY,EACV,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,UAAU,EACV,cAAc,EACd,YAAY,GACb,CAAC"}

package/dist/tasks/auth.js

@@ -1,21 +1,29 @@
 // Public auth API the surfaces call. Uniform: every operation takes a Runtime.
 import * as auth from '../auth/index.js';
-export function login(runtime) {
-    return auth.login(runtime);
+/** Browser login (ADR-006). `www2: true` also mints the www2 app-session layer in the same headed
+ *  browser (ADR-026) — the user types the Clave into SII's OAuth page; never a password argument. */
+export function login(runtime, options = {}) {
+    return auth.login(runtime, options);
 }
 /** CLI-only (ADR-010): RUT + Clave from the console → headless login → cookies
  *  only. The Clave is used once and never stored. NEVER expose over MCP. */
 export function consoleLogin(runtime, credentials) {
     return auth.consoleLogin(runtime, credentials);
 }
+/** CLI-only (ADR-025): the Clave comes from the OS keyring (service `sii`, username =
+ *  the RUT) instead of the terminal. ONE attempt, no implicit re-login. NEVER over MCP. */
+export function keyringLogin(runtime, args) {
+    return auth.keyringLogin(runtime, args);
+}
 export function logout(runtime) {
     return auth.logout(runtime);
 }
-/** Pure local read (no portal call). */
+/** Pure local read (no portal call). The www2 layer's `authenticated` is decided by its stored
+ *  cookie expiry against the clock. */
 export function authStatus(runtime) {
-    return auth.localStatus(runtime.store);
+    return auth.localStatus(runtime.store, runtime.clock.now());
 }
-/** Curated identity readback from the portal (needs a live session). */
+/** Curated identity readback from the portal (needs a live session) + the www2 layer read live. */
 export function statusRefresh(runtime) {
     return auth.statusRefresh(runtime);
 }

package/dist/tasks/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/tasks/auth.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,OAAO,KAAK,IAAI,MAAM,kBAAkB,CAAC;AAUzC,MAAM,UAAU,KAAK,CAAC,OAAgB;IACpC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAC7B,CAAC;AAED;4EAC4E;AAC5E,MAAM,UAAU,YAAY,CAC1B,OAAgB,EAChB,WAA2C;IAE3C,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,OAAgB;IACrC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,UAAU,CAAC,OAAgB;IACzC,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;qEACqE;AACrE,MAAM,UAAU,MAAM,CAAC,OAAgB;IACrC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/tasks/auth.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,OAAO,KAAK,IAAI,MAAM,kBAAkB,CAAC;AAazC;qGACqG;AACrG,MAAM,UAAU,KAAK,CAAC,OAAgB,EAAE,UAAwB,EAAE;IAChE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AACtC,CAAC;AAED;4EAC4E;AAC5E,MAAM,UAAU,YAAY,CAC1B,OAAgB,EAChB,WAA2C;IAE3C,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;AACjD,CAAC;AAED;2FAC2F;AAC3F,MAAM,UAAU,YAAY,CAAC,OAAgB,EAAE,IAAqB;IAClE,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,OAAgB;IACrC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED;uCACuC;AACvC,MAAM,UAAU,UAAU,CAAC,OAAgB;IACzC,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;qEACqE;AACrE,MAAM,UAAU,MAAM,CAAC,OAAgB;IACrC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC"}

package/dist/tasks/carpeta.d.ts

@@ -0,0 +1,9 @@
+import type { CarpetaInstitucion } from '../portal/carpeta-tributaria-regular.js';
+import type { Runtime } from '../seams/index.js';
+export type { CarpetaInstitucion } from '../portal/carpeta-tributaria-regular.js';
+/** SII's LIVE list of destination institutions for the Carpeta Tributaria Regular — the
+ *  `enfinCodigo` catalog `carpeta regular --institucion` is validated against. Never cached, never
+ *  hardcoded: the codes drift (#110). Public catalog rows (no taxpayer data); the audit records
+ *  the read (rut + count) only. */
+export declare function carpetaInstituciones(runtime: Runtime): Promise<readonly CarpetaInstitucion[]>;
+//# sourceMappingURL=carpeta.d.ts.map

package/dist/tasks/carpeta.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"carpeta.d.ts","sourceRoot":"","sources":["../../src/tasks/carpeta.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,KAAK,EAAc,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAE7D,YAAY,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAkBlF;;;mCAGmC;AACnC,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAoBxC"}

package/dist/tasks/carpeta.js

@@ -0,0 +1,49 @@
+// Public Carpeta Tributaria tasks the surfaces call (ADR-003). Wraps the `cte-api` facade in
+// `withSession` and writes ONE audit receipt per call.
+//
+// Carpeta is SESSION-KEYED (ADR-005): the app serves the principal's own Carpeta, so the tasks
+// read `ctx.sessionRut`, take NO `--rut`, and reject a representing operate pointer up front
+// (same posture as F29). The www2 `cte-api` also needs the www2 APP SESSION (ADR-026): the
+// facade reads it first (`portal/www2-session.ts`) and raises `Www2SessionError` (a
+// NotAuthenticated) when it is missing — minting it is `sii auth login --www2`, pending.
+//
+// #110 ships `carpetaInstituciones` (the live `enfinCodigo` catalog); #109 adds `carpetaRegular`
+// (the PDF, ADR-022 descriptor) on top of the same facade.
+import { assertOperatingSelf, withSession } from '../auth/index.js';
+import { recordAudit } from '../audit/index.js';
+import { CarpetaError } from '../errors/index.js';
+import { listInstituciones } from '../portal/carpeta-tributaria-regular.js';
+function audit(runtime, action, result, extra) {
+    recordAudit(runtime, { action, result, ...extra });
+}
+// Session-keyed (ADR-005): the shared guard, with this surface's own error + wording.
+const assertSelfOperating = (runtime) => assertOperatingSelf(runtime, (empresa) => new CarpetaError(`La Carpeta Tributaria es session-keyed: el SII autoriza por el titular de la sesión, no ` +
+    `por el RUT operado (${empresa}). Para la carpeta de esa empresa, inicia sesión como ` +
+    'ella (`sii auth logout` y luego `sii auth login`).'));
+/** SII's LIVE list of destination institutions for the Carpeta Tributaria Regular — the
+ *  `enfinCodigo` catalog `carpeta regular --institucion` is validated against. Never cached, never
+ *  hardcoded: the codes drift (#110). Public catalog rows (no taxpayer data); the audit records
+ *  the read (rut + count) only. */
+export async function carpetaInstituciones(runtime) {
+    await assertSelfOperating(runtime);
+    const start = runtime.clock.now().getTime();
+    try {
+        const { res, rut } = await withSession(runtime, async (session, ctx) => ({
+            // session-keyed: the www2 app session IS the principal (the facade reads its userId);
+            // the audit records the classic principal we acted for.
+            res: await listInstituciones(session),
+            rut: ctx.sessionRut,
+        }));
+        audit(runtime, 'carpeta_instituciones', 'ok', {
+            rut,
+            count: res.length,
+            durationMs: runtime.clock.now().getTime() - start,
+        });
+        return res;
+    }
+    catch (e) {
+        audit(runtime, 'carpeta_instituciones', 'failed', {});
+        throw e;
+    }
+}
+//# sourceMappingURL=carpeta.js.map

package/dist/tasks/carpeta.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"carpeta.js","sourceRoot":"","sources":["../../src/tasks/carpeta.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,uDAAuD;AACvD,EAAE;AACF,+FAA+F;AAC/F,6FAA6F;AAC7F,2FAA2F;AAC3F,oFAAoF;AACpF,yFAAyF;AACzF,EAAE;AACF,iGAAiG;AACjG,2DAA2D;AAC3D,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAM5E,SAAS,KAAK,CAAC,OAAgB,EAAE,MAAc,EAAE,MAAc,EAAE,KAA0B;IACzF,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,sFAAsF;AACtF,MAAM,mBAAmB,GAAG,CAAC,OAAgB,EAAiB,EAAE,CAC9D,mBAAmB,CACjB,OAAO,EACP,CAAC,OAAO,EAAE,EAAE,CACV,IAAI,YAAY,CACd,0FAA0F;IACxF,uBAAuB,OAAO,wDAAwD;IACtF,oDAAoD,CACvD,CACJ,CAAC;AAEJ;;;mCAGmC;AACnC,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgB;IAEhB,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACvE,sFAAsF;YACtF,wDAAwD;YACxD,GAAG,EAAE,MAAM,iBAAiB,CAAC,OAAO,CAAC;YACrC,GAAG,EAAE,GAAG,CAAC,UAAU;SACpB,CAAC,CAAC,CAAC;QACJ,KAAK,CAAC,OAAO,EAAE,uBAAuB,EAAE,IAAI,EAAE;YAC5C,GAAG;YACH,KAAK,EAAE,GAAG,CAAC,MAAM;YACjB,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK;SAClD,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,KAAK,CAAC,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QACtD,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@albertomarturelo/sii-core",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "type": "module",
   "description": "Shared SII domain core: rut, config (prod hostnames), contracts, tasks, seams. A Node library; external side-effects (portal, secrets, audit, clock) are injected via seams (ADR-003).",
   "license": "MIT",
@@ -46,6 +46,7 @@
     }
   },
   "devDependencies": {
+    "@napi-rs/keyring": "2.0.0",
     "playwright": "^1.49.0"
   },
   "scripts": {