@albertomarturelo/sii-core 0.9.0 → 0.10.0

package/dist/errors/errors.d.ts

@@ -9,6 +9,12 @@ export declare class NotAuthenticatedError extends SiiError {
  *  so a generic catch still treats it as "not authenticated". */
 export declare class SessionExpiredError extends NotAuthenticatedError {
 }
+/** The www2 APP SESSION (the second cookies-only layer `www2.sii.cl/app/*` needs — ADR-026) is
+ *  missing or expired: `/app/session/status` did not answer a session JSON. A subclass of
+ *  NotAuthenticated because the fix is a login (`sii auth login --www2`), never a retry — but
+ *  DISTINCT from `SessionExpiredError` (the classic Mi SII session may be perfectly alive). */
+export declare class Www2SessionError extends NotAuthenticatedError {
+}
 /** Browser login was not completed (timeout / window closed). No partial
  *  session is ever written. */
 export declare class LoginFailedError extends SiiError {
@@ -22,6 +28,17 @@ export declare class CredentialNotFoundError extends SiiError {
 /** Invalid user input: bad RUT, an operate target not in the operable set, etc. */
 export declare class ValidationError extends SiiError {
 }
+/** An authenticated `requestJson` got a body that is NOT JSON and NOT the login wall —
+ *  the response reached its destination host (no `LOGIN_HOST` bounce, not HTML) but the
+ *  body does not parse. Observed 2026-09-11 (GH-111) on the cte-api
+ *  `obtenerValorParametro` (URL cited in `adapters/node/response.ts`): HTTP 200
+ *  `text/plain;charset=utf-8` with a bare URL — a live session, a wrong endpoint. Carries
+ *  the endpoint, HTTP status, content-type and the first ~80 chars of the body VERBATIM
+ *  (ADR-004), so a facade can tell a SII quirk from a dead session (`SessionExpiredError`)
+ *  without a second round-trip. NOT a subclass of NotAuthenticated on purpose: re-login
+ *  would not fix it. */
+export declare class UnexpectedResponseError extends SiiError {
+}
 /** SII rejected a portal/SDI facade request (error envelope or unparseable
  *  response). Carries SII's message verbatim — never translated (ADR-004). */
 export declare class RepresentacionError extends SiiError {
@@ -65,4 +82,12 @@ export declare class PeticionesError extends SiiError {
  *  `SessionExpiredError`, not this. */
 export declare class DteError extends SiiError {
 }
+/** SII rejected a Carpeta Tributaria (`cte-api`) request, the body was not the observed shape
+ *  ("scraper roto" — e.g. `/instituciones` not serving an array), the operation is invalid for
+ *  its session-keyed contract (a representing pointer, ADR-005), OR the user's `--institucion` is
+ *  not in SII's LIVE list (the message names the valid codes; no round-trip is spent). SII's
+ *  message verbatim where one exists — never translated (ADR-004). Never retried; a missing www2
+ *  app session is `Www2SessionError` and a `LOGIN_HOST` bounce `SessionExpiredError`, not this. */
+export declare class CarpetaError extends SiiError {
+}
 //# sourceMappingURL=errors.d.ts.map

package/dist/errors/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/errors/errors.ts"],"names":[],"mappings":"AAIA,qBAAa,QAAS,SAAQ,KAAK;gBACrB,OAAO,EAAE,MAAM;CAI5B;AAED,mEAAmE;AACnE,qBAAa,qBAAsB,SAAQ,QAAQ;CAAG;AAEtD;;iEAEiE;AACjE,qBAAa,mBAAoB,SAAQ,qBAAqB;CAAG;AAEjE;+BAC+B;AAC/B,qBAAa,gBAAiB,SAAQ,QAAQ;CAAG;AAEjD,mFAAmF;AACnF,qBAAa,cAAe,SAAQ,QAAQ;CAAG;AAE/C,oFAAoF;AACpF,qBAAa,uBAAwB,SAAQ,QAAQ;CAAG;AAExD,mFAAmF;AACnF,qBAAa,eAAgB,SAAQ,QAAQ;CAAG;AAEhD;8EAC8E;AAC9E,qBAAa,mBAAoB,SAAQ,QAAQ;CAAG;AAEpD;uFACuF;AACvF,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;8EAC8E;AAC9E,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;wFAGwF;AACxF,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;eAGe;AACf,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;;;gFAKgF;AAChF,qBAAa,eAAgB,SAAQ,QAAQ;CAAG;AAEhD;;;;;;;;uCAQuC;AACvC,qBAAa,QAAS,SAAQ,QAAQ;CAAG"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/errors/errors.ts"],"names":[],"mappings":"AAIA,qBAAa,QAAS,SAAQ,KAAK;gBACrB,OAAO,EAAE,MAAM;CAI5B;AAED,mEAAmE;AACnE,qBAAa,qBAAsB,SAAQ,QAAQ;CAAG;AAEtD;;iEAEiE;AACjE,qBAAa,mBAAoB,SAAQ,qBAAqB;CAAG;AAEjE;;;+FAG+F;AAC/F,qBAAa,gBAAiB,SAAQ,qBAAqB;CAAG;AAE9D;+BAC+B;AAC/B,qBAAa,gBAAiB,SAAQ,QAAQ;CAAG;AAEjD,mFAAmF;AACnF,qBAAa,cAAe,SAAQ,QAAQ;CAAG;AAE/C,oFAAoF;AACpF,qBAAa,uBAAwB,SAAQ,QAAQ;CAAG;AAExD,mFAAmF;AACnF,qBAAa,eAAgB,SAAQ,QAAQ;CAAG;AAEhD;;;;;;;;wBAQwB;AACxB,qBAAa,uBAAwB,SAAQ,QAAQ;CAAG;AAExD;8EAC8E;AAC9E,qBAAa,mBAAoB,SAAQ,QAAQ;CAAG;AAEpD;uFACuF;AACvF,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;8EAC8E;AAC9E,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;wFAGwF;AACxF,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;eAGe;AACf,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;;;gFAKgF;AAChF,qBAAa,eAAgB,SAAQ,QAAQ;CAAG;AAEhD;;;;;;;;uCAQuC;AACvC,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;;;mGAKmG;AACnG,qBAAa,YAAa,SAAQ,QAAQ;CAAG"}

package/dist/errors/errors.js

@@ -15,6 +15,12 @@ export class NotAuthenticatedError extends SiiError {
  *  so a generic catch still treats it as "not authenticated". */
 export class SessionExpiredError extends NotAuthenticatedError {
 }
+/** The www2 APP SESSION (the second cookies-only layer `www2.sii.cl/app/*` needs — ADR-026) is
+ *  missing or expired: `/app/session/status` did not answer a session JSON. A subclass of
+ *  NotAuthenticated because the fix is a login (`sii auth login --www2`), never a retry — but
+ *  DISTINCT from `SessionExpiredError` (the classic Mi SII session may be perfectly alive). */
+export class Www2SessionError extends NotAuthenticatedError {
+}
 /** Browser login was not completed (timeout / window closed). No partial
  *  session is ever written. */
 export class LoginFailedError extends SiiError {
@@ -28,6 +34,17 @@ export class CredentialNotFoundError extends SiiError {
 /** Invalid user input: bad RUT, an operate target not in the operable set, etc. */
 export class ValidationError extends SiiError {
 }
+/** An authenticated `requestJson` got a body that is NOT JSON and NOT the login wall —
+ *  the response reached its destination host (no `LOGIN_HOST` bounce, not HTML) but the
+ *  body does not parse. Observed 2026-09-11 (GH-111) on the cte-api
+ *  `obtenerValorParametro` (URL cited in `adapters/node/response.ts`): HTTP 200
+ *  `text/plain;charset=utf-8` with a bare URL — a live session, a wrong endpoint. Carries
+ *  the endpoint, HTTP status, content-type and the first ~80 chars of the body VERBATIM
+ *  (ADR-004), so a facade can tell a SII quirk from a dead session (`SessionExpiredError`)
+ *  without a second round-trip. NOT a subclass of NotAuthenticated on purpose: re-login
+ *  would not fix it. */
+export class UnexpectedResponseError extends SiiError {
+}
 /** SII rejected a portal/SDI facade request (error envelope or unparseable
  *  response). Carries SII's message verbatim — never translated (ADR-004). */
 export class RepresentacionError extends SiiError {
@@ -71,4 +88,12 @@ export class PeticionesError extends SiiError {
  *  `SessionExpiredError`, not this. */
 export class DteError extends SiiError {
 }
+/** SII rejected a Carpeta Tributaria (`cte-api`) request, the body was not the observed shape
+ *  ("scraper roto" — e.g. `/instituciones` not serving an array), the operation is invalid for
+ *  its session-keyed contract (a representing pointer, ADR-005), OR the user's `--institucion` is
+ *  not in SII's LIVE list (the message names the valid codes; no round-trip is spent). SII's
+ *  message verbatim where one exists — never translated (ADR-004). Never retried; a missing www2
+ *  app session is `Www2SessionError` and a `LOGIN_HOST` bounce `SessionExpiredError`, not this. */
+export class CarpetaError extends SiiError {
+}
 //# sourceMappingURL=errors.js.map

package/dist/errors/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/errors/errors.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,2EAA2E;AAC3E,kEAAkE;AAElE,MAAM,OAAO,QAAS,SAAQ,KAAK;IACjC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;IAC9B,CAAC;CACF;AAED,mEAAmE;AACnE,MAAM,OAAO,qBAAsB,SAAQ,QAAQ;CAAG;AAEtD;;iEAEiE;AACjE,MAAM,OAAO,mBAAoB,SAAQ,qBAAqB;CAAG;AAEjE;+BAC+B;AAC/B,MAAM,OAAO,gBAAiB,SAAQ,QAAQ;CAAG;AAEjD,mFAAmF;AACnF,MAAM,OAAO,cAAe,SAAQ,QAAQ;CAAG;AAE/C,oFAAoF;AACpF,MAAM,OAAO,uBAAwB,SAAQ,QAAQ;CAAG;AAExD,mFAAmF;AACnF,MAAM,OAAO,eAAgB,SAAQ,QAAQ;CAAG;AAEhD;8EAC8E;AAC9E,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;CAAG;AAEpD;uFACuF;AACvF,MAAM,OAAO,QAAS,SAAQ,QAAQ;CAAG;AAEzC;8EAC8E;AAC9E,MAAM,OAAO,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;wFAGwF;AACxF,MAAM,OAAO,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;eAGe;AACf,MAAM,OAAO,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;;;gFAKgF;AAChF,MAAM,OAAO,eAAgB,SAAQ,QAAQ;CAAG;AAEhD;;;;;;;;uCAQuC;AACvC,MAAM,OAAO,QAAS,SAAQ,QAAQ;CAAG"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/errors/errors.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,2EAA2E;AAC3E,kEAAkE;AAElE,MAAM,OAAO,QAAS,SAAQ,KAAK;IACjC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;IAC9B,CAAC;CACF;AAED,mEAAmE;AACnE,MAAM,OAAO,qBAAsB,SAAQ,QAAQ;CAAG;AAEtD;;iEAEiE;AACjE,MAAM,OAAO,mBAAoB,SAAQ,qBAAqB;CAAG;AAEjE;;;+FAG+F;AAC/F,MAAM,OAAO,gBAAiB,SAAQ,qBAAqB;CAAG;AAE9D;+BAC+B;AAC/B,MAAM,OAAO,gBAAiB,SAAQ,QAAQ;CAAG;AAEjD,mFAAmF;AACnF,MAAM,OAAO,cAAe,SAAQ,QAAQ;CAAG;AAE/C,oFAAoF;AACpF,MAAM,OAAO,uBAAwB,SAAQ,QAAQ;CAAG;AAExD,mFAAmF;AACnF,MAAM,OAAO,eAAgB,SAAQ,QAAQ;CAAG;AAEhD;;;;;;;;wBAQwB;AACxB,MAAM,OAAO,uBAAwB,SAAQ,QAAQ;CAAG;AAExD;8EAC8E;AAC9E,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;CAAG;AAEpD;uFACuF;AACvF,MAAM,OAAO,QAAS,SAAQ,QAAQ;CAAG;AAEzC;8EAC8E;AAC9E,MAAM,OAAO,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;wFAGwF;AACxF,MAAM,OAAO,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;eAGe;AACf,MAAM,OAAO,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;;;gFAKgF;AAChF,MAAM,OAAO,eAAgB,SAAQ,QAAQ;CAAG;AAEhD;;;;;;;;uCAQuC;AACvC,MAAM,OAAO,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;;;mGAKmG;AACnG,MAAM,OAAO,YAAa,SAAQ,QAAQ;CAAG"}

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { login, logout, authStatus, statusRefresh, whoami } from './tasks/auth.js';
-export type { AuthIdentity, AuthLoginResult, AuthLogoutResult, AuthStatusLocal, AuthWhoami, } from './tasks/auth.js';
+export type { AuthIdentity, AuthIdentityRefresh, AuthLoginResult, AuthLogoutResult, AuthStatusLocal, AuthWhoami, AuthWww2Status, LoginOptions, } from './tasks/auth.js';
 export { operate, operateSelf, operatingStatus, listOperable } from './tasks/operate.js';
 export type { OperateResult, OperableList } from './tasks/operate.js';
 export { describeOperating, formatOperableEntry } from './identity/index.js';
@@ -16,6 +16,8 @@ export type { DteAutorizados, DteAutorizado, DteBorradorArgs, DteBorradorRow, Dt
 export type { BteMensual, BteBoleta, BteTotales, BteSide, BteEmitArgs, BteEmitResult, BteEmitida, BtePreview, BteRetiene, BteLineaEmision, } from './tasks/bte.js';
 export { peticionesList } from './tasks/peticiones.js';
 export type { PeticionesResult, Peticion, EstadoPeticion } from './tasks/peticiones.js';
+export { carpetaInstituciones } from './tasks/carpeta.js';
+export type { CarpetaInstitucion } from './tasks/carpeta.js';
 export type { AuditEntry, AuditSink, Clock, CredentialLoginOptions, InteractiveLoginOptions, KeyValueStore, PortalDriver, PortalSession, Runtime, SecretStore, } from './seams/index.js';
 export { Rut } from './rut/index.js';
 export { formatMoney, formatRut } from './format/index.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACnF,YAAY,EACV,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,UAAU,GACX,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACzF,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC7E,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjE,YAAY,EACV,UAAU,EACV,aAAa,EACb,UAAU,EACV,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,OAAO,GACR,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACxF,YAAY,EACV,SAAS,EACT,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,SAAS,EACT,cAAc,EACd,SAAS,EACT,SAAS,EACT,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,aAAa,EACb,WAAW,EACX,MAAM,EACN,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,aAAa,EACb,WAAW,EACX,eAAe,EACf,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,SAAS,EACT,oBAAoB,EACpB,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,UAAU,EACV,aAAa,GACd,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EACL,aAAa,EACb,WAAW,EACX,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,MAAM,EACN,SAAS,EACT,SAAS,GACV,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,cAAc,EACd,aAAa,EACb,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,aAAa,EACb,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,UAAU,EACV,SAAS,EACT,OAAO,GACR,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,UAAU,EACV,SAAS,EACT,UAAU,EACV,OAAO,EACP,WAAW,EACX,aAAa,EACb,UAAU,EACV,UAAU,EACV,UAAU,EACV,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,YAAY,EAAE,gBAAgB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAKxF,YAAY,EACV,UAAU,EACV,SAAS,EACT,KAAK,EACL,sBAAsB,EACtB,uBAAuB,EACvB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,OAAO,EACP,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACtD,cAAc,mBAAmB,CAAC;AAGlC,OAAO,KAAK,OAAO,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACnF,YAAY,EACV,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,UAAU,EACV,cAAc,EACd,YAAY,GACb,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACzF,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC7E,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjE,YAAY,EACV,UAAU,EACV,aAAa,EACb,UAAU,EACV,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,OAAO,GACR,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACxF,YAAY,EACV,SAAS,EACT,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,SAAS,EACT,cAAc,EACd,SAAS,EACT,SAAS,EACT,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,aAAa,EACb,WAAW,EACX,MAAM,EACN,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,aAAa,EACb,WAAW,EACX,eAAe,EACf,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,SAAS,EACT,oBAAoB,EACpB,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,UAAU,EACV,aAAa,GACd,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EACL,aAAa,EACb,WAAW,EACX,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,MAAM,EACN,SAAS,EACT,SAAS,GACV,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,cAAc,EACd,aAAa,EACb,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,aAAa,EACb,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,UAAU,EACV,SAAS,EACT,OAAO,GACR,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,UAAU,EACV,SAAS,EACT,UAAU,EACV,OAAO,EACP,WAAW,EACX,aAAa,EACb,UAAU,EACV,UAAU,EACV,UAAU,EACV,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,YAAY,EAAE,gBAAgB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAK7D,YAAY,EACV,UAAU,EACV,SAAS,EACT,KAAK,EACL,sBAAsB,EACtB,uBAAuB,EACvB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,OAAO,EACP,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACtD,cAAc,mBAAmB,CAAC;AAGlC,OAAO,KAAK,OAAO,MAAM,0BAA0B,CAAC"}

package/dist/index.js

@@ -14,6 +14,7 @@ export { f29Formulario, f29Overview, f29Pdf, f29Status, F29_GRUPO_LABELS, F29_PD
 export { bteList, bteEmitPreview, bteEmit } from './tasks/bte.js';
 export { dteAuthorized, dteEmpresas, dteBorradorList, dteBorradorSave, dteBorradorDelete, dtePreviewPdf, dteEmitidos, dtePdf, TIPOS_DTE, MAX_ITEMS, } from './tasks/dte.js';
 export { peticionesList } from './tasks/peticiones.js';
+export { carpetaInstituciones } from './tasks/carpeta.js';
 // --- shared primitives ---
 export { Rut } from './rut/index.js';
 export { formatMoney, formatRut } from './format/index.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,gFAAgF;AAChF,6EAA6E;AAE7E,uCAAuC;AACvC,mFAAmF;AACnF,mGAAmG;AACnG,gDAAgD;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAQnF,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEzF,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE7E,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAUjE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAaxF,OAAO,EACL,aAAa,EACb,WAAW,EACX,MAAM,EACN,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAkBxB,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EACL,aAAa,EACb,WAAW,EACX,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,MAAM,EACN,SAAS,EACT,SAAS,GACV,MAAM,gBAAgB,CAAC;AA+BxB,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAmBvD,4BAA4B;AAC5B,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACtD,cAAc,mBAAmB,CAAC;AAElC,2EAA2E;AAC3E,OAAO,KAAK,OAAO,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,gFAAgF;AAChF,6EAA6E;AAE7E,uCAAuC;AACvC,mFAAmF;AACnF,mGAAmG;AACnG,gDAAgD;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAWnF,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEzF,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE7E,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAUjE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAaxF,OAAO,EACL,aAAa,EACb,WAAW,EACX,MAAM,EACN,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAkBxB,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EACL,aAAa,EACb,WAAW,EACX,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,MAAM,EACN,SAAS,EACT,SAAS,GACV,MAAM,gBAAgB,CAAC;AA+BxB,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAmB1D,4BAA4B;AAC5B,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACtD,cAAc,mBAAmB,CAAC;AAElC,2EAA2E;AAC3E,OAAO,KAAK,OAAO,MAAM,0BAA0B,CAAC"}

package/dist/portal/carpeta-tributaria-regular.d.ts

@@ -0,0 +1,30 @@
+import type { Www2Session } from './www2-session.js';
+import type { PortalSession } from '../seams/index.js';
+/** A destination institution the Carpeta can be addressed to — SII's live catalog row, curated
+ *  (all 8 observed keys; a public registry of entities, no taxpayer data). `codigo` is the
+ *  `enfinCodigo` that `/generar` demands (#109); kept as a STRING because SII zero-pads some
+ *  (`"016"`, `"059"`) and not others (`"1005"`) and compares it verbatim. */
+export interface CarpetaInstitucion {
+    readonly codigo: string;
+    readonly descripcion: string | null;
+    readonly abreviacion: string | null;
+    /** SII's institution class (`enfinTipo`, observed 3 = corredora, 4 = otra; catalog-defined). */
+    readonly tipo: number | null;
+    /** The institution's own RUT (canonical), or null. Public entity data. */
+    readonly rut: string | null;
+    readonly vigenteDesde: string | null;
+    /** null = still vigente (observed on every row so far). */
+    readonly vigenteHasta: string | null;
+}
+/** `GET …/{userId}/…/instituciones` — SII's live list of destination institutions. `userId`
+ *  comes from `readWww2Session` (the SPA keys the path by it verbatim). Empty array = a
+ *  legitimate "no rows"; a non-array body = "scraper roto". */
+export declare function fetchInstituciones(session: PortalSession, app: Www2Session): Promise<readonly CarpetaInstitucion[]>;
+/** App-session read + `/instituciones` in one call: the read behind `sii carpeta instituciones`.
+ *  A multi-step flow (#109) reads the session ONCE and calls the `fetch*` steps itself. */
+export declare function listInstituciones(session: PortalSession): Promise<readonly CarpetaInstitucion[]>;
+/** Validate the user's `--institucion` against SII's LIVE list and return the matching row.
+ *  Fails BEFORE any `/generar` POST, naming the valid codes (like `--empresa` vs the MIPYME
+ *  chooser, ADR-023) — a stale code never costs a SII round-trip. The consumer is #109. */
+export declare function resolveInstitucion(codigo: string, instituciones: readonly CarpetaInstitucion[]): CarpetaInstitucion;
+//# sourceMappingURL=carpeta-tributaria-regular.d.ts.map

package/dist/portal/carpeta-tributaria-regular.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"carpeta-tributaria-regular.d.ts","sourceRoot":"","sources":["../../src/portal/carpeta-tributaria-regular.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAavD;;;6EAG6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,gGAAgG;IAChG,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,0EAA0E;IAC1E,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,2DAA2D;IAC3D,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AA+DD;;+DAE+D;AAC/D,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,WAAW,GACf,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CA0BxC;AAED;2FAC2F;AAC3F,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAGxC;AAED;;2FAE2F;AAC3F,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,SAAS,kBAAkB,EAAE,GAC3C,kBAAkB,CAapB"}

package/dist/portal/carpeta-tributaria-regular.js

@@ -0,0 +1,142 @@
+// Carpeta Tributaria Regular — typed facade over the `www2.sii.cl` `cte-api-carpetatributaria`
+// JSON facade (`PortalSession.requestJson`). First-hand-observed, no third-party library
+// (ADR-004); full wire contract + the auth-layer finding in docs/sii-contract/carpeta-tributaria.md.
+//
+// The SPA is `https://www2.sii.cl/carpetatributaria/generarcteregular`; its API lives under
+// `/app/cte-api-carpetatributaria/{userId}/recurso/v2/carpeta-tributaria/…`. Observed 2026-09-11
+// (#110), from the shipped bundles (`carpetatributaria/js/app.c2aeeb0d.js`, the shared session
+// library in `chunk-vendors.659f67b1.js`) and live probes:
+//
+//   1. THE APP SESSION. `www2.sii.cl/app/*` needs the www2 app session, a second cookies-only
+//      layer the classic jar does not carry (ADR-026) — read FIRST via the shared
+//      `portal/www2-session.ts`, whose `userId` keys every path below verbatim. Missing ⇒
+//      `Www2SessionError` (a NotAuthenticated), never a warm-up retry.
+//   2. (The session read and its observations live in `www2-session.ts`.)
+//   3. LIVE CATALOG. `/instituciones` is the ONLY source of a valid `enfinCodigo` (what `/generar`
+//      demands, #109). The codes drift — a hardcoded catalog went stale and SII rejected it — so
+//      this module never ships one: the user's choice is validated against SII's list at call
+//      time, like `--empresa` against the MIPYME chooser (ADR-023).
+//
+// Auth: SESSION-KEYED like F29 (ADR-005): the app session IS the principal; the task rejects a
+// representing pointer up front. PII: the institution rows are a public catalog — curated, no
+// `raw`. Nothing here touches the Carpeta document itself (#109, ADR-022 descriptor).
+import { z } from 'zod';
+import { HOSTS, WWW2_APP_CARPETA } from '../config/index.js';
+import { CarpetaError, NotAuthenticatedError } from '../errors/index.js';
+import { Rut } from '../rut/index.js';
+import { readWww2Session } from './www2-session.js';
+/** The SPA page ("Generar Carpeta Tributaria Regular"): the `Referer` the API expects and the
+ *  `originalUrl` the session read carries (observed 2026-09-11). Also the `--www2` login page. */
+const GENERAR_PAGE = WWW2_APP_CARPETA;
+const API = `${HOSTS.portalApp}/app/cte-api-carpetatributaria`;
+// The SPA's XHR headers (observed 2026-09-11): a JSON Accept + the page as Referer.
+const HEADERS = {
+    Accept: 'application/json, text/plain, */*',
+    Referer: GENERAR_PAGE,
+};
+// --- Wire shapes (zod-at-the-boundary, ADR-011) ---------------------------------------
+// `.loose()` rows: unobserved fields survive; projection is alias-tolerant (observed name
+// first — ADR-004). `/instituciones` answers a BARE JSON ARRAY (no SDI `respEstado` envelope —
+// this is the newer `cte-api`, not the www4 SDI facades).
+const Row = z.record(z.string(), z.unknown());
+const Instituciones = z.array(Row);
+// Observed 2026-09-12 on `/instituciones` (67 rows): `{enfinCodigo, enfinDescripcion,
+// enfinAbreviacion, enfinFechaVigDesde, enfinFechaVigHasta, enfinTipo, enfinRutInstitucion,
+// enfinDvInstitucion}` — the SPA itself reads `e.enfinCodigo` / `e.enfinAbreviacion`.
+const ALIASES = {
+    codigo: ['enfinCodigo', 'codigo'],
+    descripcion: ['enfinDescripcion', 'descripcion'],
+    abreviacion: ['enfinAbreviacion', 'abreviacion'],
+    tipo: ['enfinTipo', 'tipo'],
+    rutDigits: ['enfinRutInstitucion', 'rutInstitucion'],
+    dv: ['enfinDvInstitucion', 'dvInstitucion'],
+    vigenteDesde: ['enfinFechaVigDesde', 'fechaVigDesde'],
+    vigenteHasta: ['enfinFechaVigHasta', 'fechaVigHasta'],
+};
+function aliasGet(row, keys) {
+    for (const k of keys)
+        if (row[k] !== undefined && row[k] !== null)
+            return row[k];
+    return undefined;
+}
+const asStr = (v) => {
+    if (typeof v === 'string')
+        return v.trim() === '' ? null : v.trim();
+    if (typeof v === 'number')
+        return String(v);
+    return null;
+};
+const asInt = (v) => {
+    if (typeof v === 'number' && Number.isInteger(v))
+        return v;
+    if (typeof v === 'string' && /^\d+$/.test(v.trim()))
+        return Number(v.trim());
+    return null;
+};
+// `enfinRutInstitucion` (digits) + `enfinDvInstitucion` → canonical, Mod-11-checked; null if odd.
+const canonicalRutFrom = (digits, dv) => digits === undefined || dv === undefined
+    ? null
+    : (Rut.tryParse(`${String(digits)}-${String(dv).trim()}`)?.canonical ?? null);
+function curate(row) {
+    const codigo = asStr(aliasGet(row, ALIASES.codigo));
+    if (codigo === null) {
+        // A row without its key field means the shape moved: fail loud, never guess (ADR-004).
+        throw new CarpetaError('Scraper roto: una fila de /instituciones (Carpeta Tributaria) no trae `enfinCodigo`; ' +
+            'el SII cambió la forma de la lista.');
+    }
+    return {
+        codigo,
+        descripcion: asStr(aliasGet(row, ALIASES.descripcion)),
+        abreviacion: asStr(aliasGet(row, ALIASES.abreviacion)),
+        tipo: asInt(aliasGet(row, ALIASES.tipo)),
+        rut: canonicalRutFrom(aliasGet(row, ALIASES.rutDigits), aliasGet(row, ALIASES.dv)),
+        vigenteDesde: asStr(aliasGet(row, ALIASES.vigenteDesde)),
+        vigenteHasta: asStr(aliasGet(row, ALIASES.vigenteHasta)),
+    };
+}
+/** `GET …/{userId}/…/instituciones` — SII's live list of destination institutions. `userId`
+ *  comes from `readWww2Session` (the SPA keys the path by it verbatim). Empty array = a
+ *  legitimate "no rows"; a non-array body = "scraper roto". */
+export async function fetchInstituciones(session, app) {
+    let raw;
+    try {
+        raw = await session.requestJson(`${API}/${encodeURIComponent(app.userId)}/recurso/v2/carpeta-tributaria/instituciones`, { method: 'GET', headers: HEADERS });
+    }
+    catch (e) {
+        // A dead session is an ACTIONABLE NotAuthenticated (the seam detects the login wall) — let
+        // it through verbatim. Anything else (a 401 body, the wrong endpoint) is a typed CarpetaError
+        // carrying the seam's verbatim detail (ADR-004), never a raw Playwright error.
+        if (e instanceof NotAuthenticatedError)
+            throw e;
+        throw new CarpetaError(`Respuesta inesperada del SII en /instituciones (Carpeta Tributaria): ${e instanceof Error ? e.message : String(e)}`);
+    }
+    const parsed = Instituciones.safeParse(raw);
+    if (!parsed.success) {
+        throw new CarpetaError('Scraper roto: /instituciones (Carpeta Tributaria) no devolvió un arreglo JSON de ' +
+            'instituciones; el SII cambió la forma de la lista.');
+    }
+    return parsed.data.map(curate);
+}
+/** App-session read + `/instituciones` in one call: the read behind `sii carpeta instituciones`.
+ *  A multi-step flow (#109) reads the session ONCE and calls the `fetch*` steps itself. */
+export async function listInstituciones(session) {
+    const app = await readWww2Session(session, GENERAR_PAGE);
+    return fetchInstituciones(session, app);
+}
+/** Validate the user's `--institucion` against SII's LIVE list and return the matching row.
+ *  Fails BEFORE any `/generar` POST, naming the valid codes (like `--empresa` vs the MIPYME
+ *  chooser, ADR-023) — a stale code never costs a SII round-trip. The consumer is #109. */
+export function resolveInstitucion(codigo, instituciones) {
+    const wanted = codigo.trim();
+    const hit = instituciones.find((i) => i.codigo === wanted);
+    if (hit)
+        return hit;
+    const opciones = instituciones
+        .map((i) => `${i.codigo}${i.abreviacion ? ` (${i.abreviacion})` : ''}`)
+        .join(', ');
+    throw new CarpetaError(`La institución "${wanted}" no está en la lista vigente del SII para la Carpeta Tributaria. ` +
+        (instituciones.length === 0
+            ? 'El SII no devolvió instituciones.'
+            : `Códigos válidos (sii carpeta instituciones): ${opciones}.`));
+}
+//# sourceMappingURL=carpeta-tributaria-regular.js.map

package/dist/portal/carpeta-tributaria-regular.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"carpeta-tributaria-regular.js","sourceRoot":"","sources":["../../src/portal/carpeta-tributaria-regular.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,yFAAyF;AACzF,qGAAqG;AACrG,EAAE;AACF,4FAA4F;AAC5F,iGAAiG;AACjG,+FAA+F;AAC/F,2DAA2D;AAC3D,EAAE;AACF,8FAA8F;AAC9F,kFAAkF;AAClF,0FAA0F;AAC1F,uEAAuE;AACvE,0EAA0E;AAC1E,mGAAmG;AACnG,iGAAiG;AACjG,8FAA8F;AAC9F,oEAAoE;AACpE,EAAE;AACF,+FAA+F;AAC/F,8FAA8F;AAC9F,sFAAsF;AACtF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAIpD;kGACkG;AAClG,MAAM,YAAY,GAAG,gBAAgB,CAAC;AACtC,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,SAAS,gCAAgC,CAAC;AAE/D,oFAAoF;AACpF,MAAM,OAAO,GAA2B;IACtC,MAAM,EAAE,mCAAmC;IAC3C,OAAO,EAAE,YAAY;CACtB,CAAC;AAmBF,yFAAyF;AACzF,0FAA0F;AAC1F,+FAA+F;AAC/F,0DAA0D;AAC1D,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAC9C,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAEnC,sFAAsF;AACtF,4FAA4F;AAC5F,sFAAsF;AACtF,MAAM,OAAO,GAAG;IACd,MAAM,EAAE,CAAC,aAAa,EAAE,QAAQ,CAAC;IACjC,WAAW,EAAE,CAAC,kBAAkB,EAAE,aAAa,CAAC;IAChD,WAAW,EAAE,CAAC,kBAAkB,EAAE,aAAa,CAAC;IAChD,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,CAAC,qBAAqB,EAAE,gBAAgB,CAAC;IACpD,EAAE,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;IAC3C,YAAY,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;IACrD,YAAY,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;CAC7C,CAAC;AAEX,SAAS,QAAQ,CAAC,GAA4B,EAAE,IAAuB;IACrE,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,SAAS,CAAC;AACnB,CAAC;AACD,MAAM,KAAK,GAAG,CAAC,CAAU,EAAiB,EAAE;IAC1C,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpE,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AACF,MAAM,KAAK,GAAG,CAAC,CAAU,EAAiB,EAAE;IAC1C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AACF,kGAAkG;AAClG,MAAM,gBAAgB,GAAG,CAAC,MAAe,EAAE,EAAW,EAAiB,EAAE,CACvE,MAAM,KAAK,SAAS,IAAI,EAAE,KAAK,SAAS;IACtC,CAAC,CAAC,IAAI;IACN,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC;AAElF,SAAS,MAAM,CAAC,GAA4B;IAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,uFAAuF;QACvF,MAAM,IAAI,YAAY,CACpB,uFAAuF;YACrF,qCAAqC,CACxC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM;QACN,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QACtD,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACxC,GAAG,EAAE,gBAAgB,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAClF,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QACxD,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;KACzD,CAAC;AACJ,CAAC;AAED;;+DAE+D;AAC/D,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAsB,EACtB,GAAgB;IAEhB,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,OAAO,CAAC,WAAW,CAC7B,GAAG,GAAG,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,8CAA8C,EACtF,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CACpC,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,2FAA2F;QAC3F,8FAA8F;QAC9F,+EAA+E;QAC/E,IAAI,CAAC,YAAY,qBAAqB;YAAE,MAAM,CAAC,CAAC;QAChD,MAAM,IAAI,YAAY,CACpB,wEACE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAC3C,EAAE,CACH,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,YAAY,CACpB,mFAAmF;YACjF,oDAAoD,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACjC,CAAC;AAED;2FAC2F;AAC3F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAsB;IAEtB,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACzD,OAAO,kBAAkB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED;;2FAE2F;AAC3F,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,aAA4C;IAE5C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAC3D,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IACpB,MAAM,QAAQ,GAAG,aAAa;SAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;SACtE,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,IAAI,YAAY,CACpB,mBAAmB,MAAM,oEAAoE;QAC3F,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;YACzB,CAAC,CAAC,mCAAmC;YACrC,CAAC,CAAC,gDAAgD,QAAQ,GAAG,CAAC,CACnE,CAAC;AACJ,CAAC"}

package/dist/portal/www2-session.d.ts

@@ -0,0 +1,13 @@
+import type { PortalSession } from '../seams/index.js';
+/** The www2 app session as `/app/session/status` describes it. Only `userId` is load-bearing
+ *  (it keys every `/app/<name>-api` path); the rest is kept for diagnostics. */
+export interface Www2Session {
+    readonly userId: string;
+    readonly userAuthType: string | null;
+}
+/** Read the www2 app session (see the header). Resolves `{userId}` when one exists; raises the
+ *  ACTIONABLE `Www2SessionError` (a `NotAuthenticated`) when www2 answers anything but a 200
+ *  session JSON — the classic session alone never reaches this layer. `originalUrl` is the app
+ *  page the SPA would pass (observed optional; the answer is the same without it). Never retried. */
+export declare function readWww2Session(session: PortalSession, originalUrl?: string): Promise<Www2Session>;
+//# sourceMappingURL=www2-session.d.ts.map

package/dist/portal/www2-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"www2-session.d.ts","sourceRoot":"","sources":["../../src/portal/www2-session.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAIvD;gFACgF;AAChF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAKD;;;qGAGqG;AACrG,wBAAsB,eAAe,CACnC,OAAO,EAAE,aAAa,EACtB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,WAAW,CAAC,CAmCtB"}

package/dist/portal/www2-session.js

@@ -0,0 +1,61 @@
+// The www2 APP SESSION — the second cookies-only layer every `www2.sii.cl/app/*` facade needs
+// (ADR-026). Shared by all www2 apps (first: Carpeta Tributaria, `carpeta-tributaria-regular.ts`),
+// so a new app reuses this read instead of inventing a per-app warm-up.
+//
+// Observed 2026-09-11/12 (#110; docs/sii-contract/carpeta-tributaria.md): the classic `.sii.cl`
+// cookies the cookies-only login holds reach www1/www3/www4/loa but NOT `/app/<name>-api/*` — those
+// answer a bare 401 until the OAuth2 flow (`/app/session/login` → `/oauthsii-v1/` → `/app/session/
+// create`) minted the httpOnly `.sii.cl` pair `X-SII-STATE-CT` + `X-SII-STATE-TYPE` (~100 min). The
+// SPA's own liveness read is `GET /app/session/status` (session library `j()`): 200 → JSON
+// `{seconds, userId, userProfiles, userAuthType, authTime, userRte}` committed to vuex; anything
+// else → no session (the SPA then bounces to `/bifurcacion`). Every app keys its API paths by
+// `session.userId` VERBATIM (the canonical `<body>-<dv>` RUT, observed) — so this read is where a
+// facade gets its path key; it never formats a RUT for it.
+//
+// Reached via `requestText`: a non-JSON 401 body is EXPECTED here, and a dead classic jar is still
+// caught URL-based (the `LOGIN_HOST` bounce → `SessionExpiredError`).
+import { z } from 'zod';
+import { HOSTS } from '../config/index.js';
+import { Www2SessionError } from '../errors/index.js';
+const SESSION_STATUS_URL = `${HOSTS.portalApp}/app/session/status`;
+// Observed 2026-09-12 (live app session). `.loose()`: the other fields ride along unvalidated.
+const SessionJson = z.object({ userId: z.union([z.string(), z.number()]) }).loose();
+/** Read the www2 app session (see the header). Resolves `{userId}` when one exists; raises the
+ *  ACTIONABLE `Www2SessionError` (a `NotAuthenticated`) when www2 answers anything but a 200
+ *  session JSON — the classic session alone never reaches this layer. `originalUrl` is the app
+ *  page the SPA would pass (observed optional; the answer is the same without it). Never retried. */
+export async function readWww2Session(session, originalUrl) {
+    const url = originalUrl === undefined
+        ? SESSION_STATUS_URL
+        : `${SESSION_STATUS_URL}?originalUrl=${encodeURIComponent(originalUrl)}`;
+    const res = await session.requestText(url, {
+        method: 'GET',
+        headers: {
+            Accept: 'application/json, text/plain, */*',
+            ...(originalUrl === undefined ? {} : { Referer: originalUrl }),
+        },
+    });
+    let parsed = null;
+    if (res.status === 200) {
+        try {
+            parsed = JSON.parse(res.body);
+        }
+        catch {
+            parsed = null; // the SPA shell HTML (a 200 on a cold hit) is "no session" too
+        }
+    }
+    const app = parsed === null ? null : SessionJson.safeParse(parsed);
+    if (!app || !app.success) {
+        throw new Www2SessionError('No hay sesión en la plataforma www2 del SII (www2.sii.cl/app/*), que autoriza con una ' +
+            'sesión propia (login OAuth) y no con la sesión de Mi SII que esta herramienta guarda ' +
+            `(HTTP ${res.status}${res.status === 200 ? ' sin JSON de sesión' : ''} en ` +
+            '/app/session/status). Iniciarla aún no está soportado — ADR-026 la define como un ' +
+            'segundo login en el navegador (`sii auth login --www2`, pendiente).');
+    }
+    const authType = app.data['userAuthType'];
+    return {
+        userId: String(app.data.userId),
+        userAuthType: typeof authType === 'string' ? authType : null,
+    };
+}
+//# sourceMappingURL=www2-session.js.map

package/dist/portal/www2-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"www2-session.js","sourceRoot":"","sources":["../../src/portal/www2-session.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,mGAAmG;AACnG,wEAAwE;AACxE,EAAE;AACF,gGAAgG;AAChG,oGAAoG;AACpG,mGAAmG;AACnG,oGAAoG;AACpG,2FAA2F;AAC3F,iGAAiG;AACjG,8FAA8F;AAC9F,kGAAkG;AAClG,2DAA2D;AAC3D,EAAE;AACF,mGAAmG;AACnG,sEAAsE;AACtE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAGtD,MAAM,kBAAkB,GAAG,GAAG,KAAK,CAAC,SAAS,qBAAqB,CAAC;AASnE,+FAA+F;AAC/F,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;AAEpF;;;qGAGqG;AACrG,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAsB,EACtB,WAAoB;IAEpB,MAAM,GAAG,GACP,WAAW,KAAK,SAAS;QACvB,CAAC,CAAC,kBAAkB;QACpB,CAAC,CAAC,GAAG,kBAAkB,gBAAgB,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;IAC7E,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;QACzC,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,MAAM,EAAE,mCAAmC;YAC3C,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;SAC/D;KACF,CAAC,CAAC;IACH,IAAI,MAAM,GAAY,IAAI,CAAC;IAC3B,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAY,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,IAAI,CAAC,CAAC,+DAA+D;QAChF,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACnE,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACzB,MAAM,IAAI,gBAAgB,CACxB,wFAAwF;YACtF,uFAAuF;YACvF,SAAS,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,MAAM;YAC3E,oFAAoF;YACpF,qEAAqE,CACxE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC1C,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;QAC/B,YAAY,EAAE,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;KAC7D,CAAC;AACJ,CAAC"}

package/dist/tasks/auth.d.ts

@@ -1,6 +1,8 @@
-import type { AuthIdentity, AuthLoginResult, AuthLogoutResult, AuthStatusLocal, AuthWhoami } from '../auth/index.js';
+import type { AuthIdentity, AuthIdentityRefresh, AuthLoginResult, AuthLogoutResult, AuthStatusLocal, AuthWhoami, AuthWww2Status, LoginOptions } from '../auth/index.js';
 import type { Runtime } from '../seams/index.js';
-export declare function login(runtime: Runtime): Promise<AuthLoginResult>;
+/** Browser login (ADR-006). `www2: true` also mints the www2 app-session layer in the same headed
+ *  browser (ADR-026) — the user types the Clave into SII's OAuth page; never a password argument. */
+export declare function login(runtime: Runtime, options?: LoginOptions): Promise<AuthLoginResult>;
 /** CLI-only (ADR-010): RUT + Clave from the console → headless login → cookies
  *  only. The Clave is used once and never stored. NEVER expose over MCP. */
 export declare function consoleLogin(runtime: Runtime, credentials: {
@@ -13,12 +15,13 @@ export declare function keyringLogin(runtime: Runtime, args: {
     rut: string;
 }): Promise<AuthLoginResult>;
 export declare function logout(runtime: Runtime): Promise<AuthLogoutResult>;
-/** Pure local read (no portal call). */
+/** Pure local read (no portal call). The www2 layer's `authenticated` is decided by its stored
+ *  cookie expiry against the clock. */
 export declare function authStatus(runtime: Runtime): Promise<AuthStatusLocal>;
-/** Curated identity readback from the portal (needs a live session). */
-export declare function statusRefresh(runtime: Runtime): Promise<AuthIdentity>;
+/** Curated identity readback from the portal (needs a live session) + the www2 layer read live. */
+export declare function statusRefresh(runtime: Runtime): Promise<AuthIdentityRefresh>;
 /** whoami — the authenticated principal's own razón social/nombre + email (own PII).
  *  Live portal read; session-keyed (ignores the operate pointer). */
 export declare function whoami(runtime: Runtime): Promise<AuthWhoami>;
-export type { AuthIdentity, AuthLoginResult, AuthLogoutResult, AuthStatusLocal, AuthWhoami };
+export type { AuthIdentity, AuthIdentityRefresh, AuthLoginResult, AuthLogoutResult, AuthStatusLocal, AuthWhoami, AuthWww2Status, LoginOptions, };
 //# sourceMappingURL=auth.d.ts.map

package/dist/tasks/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/tasks/auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,UAAU,EACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD,wBAAgB,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,CAEhE;AAED;4EAC4E;AAC5E,wBAAgB,YAAY,CAC1B,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC1C,OAAO,CAAC,eAAe,CAAC,CAE1B;AAED;2FAC2F;AAC3F,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAE9F;AAED,wBAAgB,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAElE;AAED,wCAAwC;AACxC,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,CAErE;AAED,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CAErE;AAED;qEACqE;AACrE,wBAAgB,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAE5D;AAED,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/tasks/auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,UAAU,EACV,cAAc,EACd,YAAY,EACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD;qGACqG;AACrG,wBAAgB,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,eAAe,CAAC,CAE5F;AAED;4EAC4E;AAC5E,wBAAgB,YAAY,CAC1B,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC1C,OAAO,CAAC,eAAe,CAAC,CAE1B;AAED;2FAC2F;AAC3F,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAE9F;AAED,wBAAgB,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAElE;AAED;uCACuC;AACvC,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,CAErE;AAED,mGAAmG;AACnG,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAE5E;AAED;qEACqE;AACrE,wBAAgB,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAE5D;AAED,YAAY,EACV,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,UAAU,EACV,cAAc,EACd,YAAY,GACb,CAAC"}

package/dist/tasks/auth.js

@@ -1,7 +1,9 @@
 // Public auth API the surfaces call. Uniform: every operation takes a Runtime.
 import * as auth from '../auth/index.js';
-export function login(runtime) {
-    return auth.login(runtime);
+/** Browser login (ADR-006). `www2: true` also mints the www2 app-session layer in the same headed
+ *  browser (ADR-026) — the user types the Clave into SII's OAuth page; never a password argument. */
+export function login(runtime, options = {}) {
+    return auth.login(runtime, options);
 }
 /** CLI-only (ADR-010): RUT + Clave from the console → headless login → cookies
  *  only. The Clave is used once and never stored. NEVER expose over MCP. */
@@ -16,11 +18,12 @@ export function keyringLogin(runtime, args) {
 export function logout(runtime) {
     return auth.logout(runtime);
 }
-/** Pure local read (no portal call). */
+/** Pure local read (no portal call). The www2 layer's `authenticated` is decided by its stored
+ *  cookie expiry against the clock. */
 export function authStatus(runtime) {
-    return auth.localStatus(runtime.store);
+    return auth.localStatus(runtime.store, runtime.clock.now());
 }
-/** Curated identity readback from the portal (needs a live session). */
+/** Curated identity readback from the portal (needs a live session) + the www2 layer read live. */
 export function statusRefresh(runtime) {
     return auth.statusRefresh(runtime);
 }

package/dist/tasks/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/tasks/auth.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,OAAO,KAAK,IAAI,MAAM,kBAAkB,CAAC;AAUzC,MAAM,UAAU,KAAK,CAAC,OAAgB;IACpC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAC7B,CAAC;AAED;4EAC4E;AAC5E,MAAM,UAAU,YAAY,CAC1B,OAAgB,EAChB,WAA2C;IAE3C,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;AACjD,CAAC;AAED;2FAC2F;AAC3F,MAAM,UAAU,YAAY,CAAC,OAAgB,EAAE,IAAqB;IAClE,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,OAAgB;IACrC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,UAAU,CAAC,OAAgB;IACzC,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;qEACqE;AACrE,MAAM,UAAU,MAAM,CAAC,OAAgB;IACrC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/tasks/auth.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,OAAO,KAAK,IAAI,MAAM,kBAAkB,CAAC;AAazC;qGACqG;AACrG,MAAM,UAAU,KAAK,CAAC,OAAgB,EAAE,UAAwB,EAAE;IAChE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AACtC,CAAC;AAED;4EAC4E;AAC5E,MAAM,UAAU,YAAY,CAC1B,OAAgB,EAChB,WAA2C;IAE3C,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;AACjD,CAAC;AAED;2FAC2F;AAC3F,MAAM,UAAU,YAAY,CAAC,OAAgB,EAAE,IAAqB;IAClE,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,OAAgB;IACrC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED;uCACuC;AACvC,MAAM,UAAU,UAAU,CAAC,OAAgB;IACzC,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;qEACqE;AACrE,MAAM,UAAU,MAAM,CAAC,OAAgB;IACrC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC"}

package/dist/tasks/carpeta.d.ts

@@ -0,0 +1,9 @@
+import type { CarpetaInstitucion } from '../portal/carpeta-tributaria-regular.js';
+import type { Runtime } from '../seams/index.js';
+export type { CarpetaInstitucion } from '../portal/carpeta-tributaria-regular.js';
+/** SII's LIVE list of destination institutions for the Carpeta Tributaria Regular — the
+ *  `enfinCodigo` catalog `carpeta regular --institucion` is validated against. Never cached, never
+ *  hardcoded: the codes drift (#110). Public catalog rows (no taxpayer data); the audit records
+ *  the read (rut + count) only. */
+export declare function carpetaInstituciones(runtime: Runtime): Promise<readonly CarpetaInstitucion[]>;
+//# sourceMappingURL=carpeta.d.ts.map

package/dist/tasks/carpeta.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"carpeta.d.ts","sourceRoot":"","sources":["../../src/tasks/carpeta.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,KAAK,EAAc,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAE7D,YAAY,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAkBlF;;;mCAGmC;AACnC,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAoBxC"}

package/dist/tasks/carpeta.js

@@ -0,0 +1,49 @@
+// Public Carpeta Tributaria tasks the surfaces call (ADR-003). Wraps the `cte-api` facade in
+// `withSession` and writes ONE audit receipt per call.
+//
+// Carpeta is SESSION-KEYED (ADR-005): the app serves the principal's own Carpeta, so the tasks
+// read `ctx.sessionRut`, take NO `--rut`, and reject a representing operate pointer up front
+// (same posture as F29). The www2 `cte-api` also needs the www2 APP SESSION (ADR-026): the
+// facade reads it first (`portal/www2-session.ts`) and raises `Www2SessionError` (a
+// NotAuthenticated) when it is missing — minting it is `sii auth login --www2`, pending.
+//
+// #110 ships `carpetaInstituciones` (the live `enfinCodigo` catalog); #109 adds `carpetaRegular`
+// (the PDF, ADR-022 descriptor) on top of the same facade.
+import { assertOperatingSelf, withSession } from '../auth/index.js';
+import { recordAudit } from '../audit/index.js';
+import { CarpetaError } from '../errors/index.js';
+import { listInstituciones } from '../portal/carpeta-tributaria-regular.js';
+function audit(runtime, action, result, extra) {
+    recordAudit(runtime, { action, result, ...extra });
+}
+// Session-keyed (ADR-005): the shared guard, with this surface's own error + wording.
+const assertSelfOperating = (runtime) => assertOperatingSelf(runtime, (empresa) => new CarpetaError(`La Carpeta Tributaria es session-keyed: el SII autoriza por el titular de la sesión, no ` +
+    `por el RUT operado (${empresa}). Para la carpeta de esa empresa, inicia sesión como ` +
+    'ella (`sii auth logout` y luego `sii auth login`).'));
+/** SII's LIVE list of destination institutions for the Carpeta Tributaria Regular — the
+ *  `enfinCodigo` catalog `carpeta regular --institucion` is validated against. Never cached, never
+ *  hardcoded: the codes drift (#110). Public catalog rows (no taxpayer data); the audit records
+ *  the read (rut + count) only. */
+export async function carpetaInstituciones(runtime) {
+    await assertSelfOperating(runtime);
+    const start = runtime.clock.now().getTime();
+    try {
+        const { res, rut } = await withSession(runtime, async (session, ctx) => ({
+            // session-keyed: the www2 app session IS the principal (the facade reads its userId);
+            // the audit records the classic principal we acted for.
+            res: await listInstituciones(session),
+            rut: ctx.sessionRut,
+        }));
+        audit(runtime, 'carpeta_instituciones', 'ok', {
+            rut,
+            count: res.length,
+            durationMs: runtime.clock.now().getTime() - start,
+        });
+        return res;
+    }
+    catch (e) {
+        audit(runtime, 'carpeta_instituciones', 'failed', {});
+        throw e;
+    }
+}
+//# sourceMappingURL=carpeta.js.map

package/dist/tasks/carpeta.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"carpeta.js","sourceRoot":"","sources":["../../src/tasks/carpeta.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,uDAAuD;AACvD,EAAE;AACF,+FAA+F;AAC/F,6FAA6F;AAC7F,2FAA2F;AAC3F,oFAAoF;AACpF,yFAAyF;AACzF,EAAE;AACF,iGAAiG;AACjG,2DAA2D;AAC3D,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAM5E,SAAS,KAAK,CAAC,OAAgB,EAAE,MAAc,EAAE,MAAc,EAAE,KAA0B;IACzF,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,sFAAsF;AACtF,MAAM,mBAAmB,GAAG,CAAC,OAAgB,EAAiB,EAAE,CAC9D,mBAAmB,CACjB,OAAO,EACP,CAAC,OAAO,EAAE,EAAE,CACV,IAAI,YAAY,CACd,0FAA0F;IACxF,uBAAuB,OAAO,wDAAwD;IACtF,oDAAoD,CACvD,CACJ,CAAC;AAEJ;;;mCAGmC;AACnC,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgB;IAEhB,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACvE,sFAAsF;YACtF,wDAAwD;YACxD,GAAG,EAAE,MAAM,iBAAiB,CAAC,OAAO,CAAC;YACrC,GAAG,EAAE,GAAG,CAAC,UAAU;SACpB,CAAC,CAAC,CAAC;QACJ,KAAK,CAAC,OAAO,EAAE,uBAAuB,EAAE,IAAI,EAAE;YAC5C,GAAG;YACH,KAAK,EAAE,GAAG,CAAC,MAAM;YACjB,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK;SAClD,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,KAAK,CAAC,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QACtD,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@albertomarturelo/sii-core",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "type": "module",
   "description": "Shared SII domain core: rut, config (prod hostnames), contracts, tasks, seams. A Node library; external side-effects (portal, secrets, audit, clock) are injected via seams (ADR-003).",
   "license": "MIT",