@albertomarturelo/sii-core 0.9.0 → 0.11.0

package/dist/auth/login-block.js

@@ -0,0 +1,53 @@
+// The rejection latch (ADR-028). After SII rejects a Clave, an unattended login must not
+// try the same stale value again on the next cron tick: repeated failures lock the account
+// (ADR-004). The latch is a local record, `~/.sii/login-blocked.json` through the store seam
+// (0600 like every store file), holding NO secret — only which RUT, when, and SII's código.
+import { LoginFailedError, LoginQueuedError } from '../errors/index.js';
+import { WRONG_CLAVE_CODIGO } from './login-error.js';
+const LOGIN_BLOCK_KEY = 'login-blocked';
+async function readEntries(store) {
+    const file = await store.read(LOGIN_BLOCK_KEY);
+    return Array.isArray(file?.entries) ? file.entries : [];
+}
+async function writeEntries(store, entries) {
+    if (entries.length === 0)
+        await store.delete(LOGIN_BLOCK_KEY);
+    else
+        await store.write(LOGIN_BLOCK_KEY, { entries });
+}
+/** Every latched RUT — what `auth status` reports, so a caller sees the block BEFORE it
+ *  decides to log in, instead of discovering it as a refusal. */
+export async function listLoginBlocks(store) {
+    return readEntries(store);
+}
+export async function readLoginBlock(store, rut) {
+    return (await readEntries(store)).find((e) => e.rut === rut) ?? null;
+}
+/** Did SII actually judge the Clave? Only then may the latch trip. SII's error page is the
+ *  one that prints a código (`parseSiiLoginErrorDetail`), so a código is the signal — not
+ *  `reason === 'wrong-clave'` alone: the locked-account página has its own, still unobserved
+ *  código (login-error.ts), and locking out a locked account is the safe direction. Queue-it,
+ *  a WAF refusal, a timeout or a network error carry no código: SII never saw the Clave. */
+export function siiJudgedClave(err) {
+    return err instanceof LoginFailedError && !(err instanceof LoginQueuedError) && !!err.codigo;
+}
+export async function tripLoginBlock(runtime, rut, codigo) {
+    const rest = (await readEntries(runtime.store)).filter((e) => e.rut !== rut);
+    await writeEntries(runtime.store, [
+        ...rest,
+        { rut, at: runtime.clock.now().toISOString(), codigo },
+    ]);
+}
+/** Lift the latch for one RUT, or for every RUT when none is given. Returns the RUTs lifted. */
+export async function clearLoginBlock(store, rut) {
+    const entries = await readEntries(store);
+    const lifted = entries.filter((e) => rut === undefined || e.rut === rut).map((e) => e.rut);
+    if (lifted.length > 0) {
+        await writeEntries(store, entries.filter((e) => !lifted.includes(e.rut)));
+    }
+    return lifted;
+}
+export function reasonForCodigo(codigo) {
+    return codigo === WRONG_CLAVE_CODIGO ? 'wrong-clave' : 'unknown';
+}
+//# sourceMappingURL=login-block.js.map

package/dist/auth/login-block.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-block.js","sourceRoot":"","sources":["../../src/auth/login-block.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,2FAA2F;AAC3F,6FAA6F;AAC7F,4FAA4F;AAC5F,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAGxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,MAAM,eAAe,GAAG,eAAe,CAAC;AAaxC,KAAK,UAAU,WAAW,CAAC,KAAoB;IAC7C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAiB,eAAe,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,KAAoB,EAAE,OAA0B;IAC1E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;;QACzD,MAAM,KAAK,CAAC,KAAK,CAAiB,eAAe,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;AACvE,CAAC;AAED;iEACiE;AACjE,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAoB;IACxD,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAoB,EACpB,GAAW;IAEX,OAAO,CAAC,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC;AACvE,CAAC;AAED;;;;4FAI4F;AAC5F,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,OAAO,GAAG,YAAY,gBAAgB,IAAI,CAAC,CAAC,GAAG,YAAY,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;AAC/F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAgB,EAChB,GAAW,EACX,MAAqB;IAErB,MAAM,IAAI,GAAG,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAC7E,MAAM,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE;QAChC,GAAG,IAAI;QACP,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE;KACvD,CAAC,CAAC;AACL,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAoB,EAAE,GAAY;IACtE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3F,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,YAAY,CAChB,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAC/C,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAqB;IACnD,OAAO,MAAM,KAAK,kBAAkB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;AACnE,CAAC"}

package/dist/auth/login-error.d.ts

@@ -1,8 +1,25 @@
-/** Extract SII's verbatim login-error cause from the failed-login page body text.
+import type { LoginFailureReason } from '../errors/index.js';
+/** SII's message código for a wrong Clave Tributaria, observed 2026-06-28
+ *  (docs/sii-contract/auth-login.md). It is the ONLY código classified as
+ *  `'wrong-clave'`; the locked-account página has a DISTINCT código, not yet
+ *  observed (triggering it risks a real lock, ADR-004/ADR-010), so it stays
+ *  `'unknown'` until captured. */
+export declare const WRONG_CLAVE_CODIGO = "01.01.203.500.720.20";
+export interface SiiLoginErrorDetail {
+    /** `"<causa> (<código line>)"` verbatim, or `null` if the page shape changed. */
+    message: string | null;
+    /** The código SII printed (e.g. `01.01.203.500.720.20`), or `null` if none. */
+    codigo: string | null;
+    /** Classified from `codigo` — `'wrong-clave'` only for `WRONG_CLAVE_CODIGO`. */
+    reason: LoginFailureReason;
+}
+/** Parse SII's failed-login page body into {message, codigo, reason}.
  *  Observed 2026-06-28 (docs/sii-contract/auth-login.md): the page renders the
  *  human cause, then a line `El código de este mensaje es <código>`. The line
  *  BEFORE the código line is the cause (e.g. "La Clave Tributaria ingresada no es
- *  correcta…"). Returns `"<causa> (<código line>)"`, or `null` if the shape
- *  changed (the caller falls back to a generic no-retry message). */
+ *  correcta…"). A changed shape ⇒ `{message: null, codigo: null, reason: 'unknown'}`
+ *  (the caller falls back to a generic no-retry message). */
+export declare function parseSiiLoginErrorDetail(bodyText: string): SiiLoginErrorDetail;
+/** Back-compat string view: SII's verbatim cause line, or `null` if the shape changed. */
 export declare function parseSiiLoginError(bodyText: string): string | null;
 //# sourceMappingURL=login-error.d.ts.map

package/dist/auth/login-error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login-error.d.ts","sourceRoot":"","sources":["../../src/auth/login-error.ts"],"names":[],"mappings":"AAIA;;;;;qEAKqE;AACrE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOlE"}
+{"version":3,"file":"login-error.d.ts","sourceRoot":"","sources":["../../src/auth/login-error.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE7D;;;;kCAIkC;AAClC,eAAO,MAAM,kBAAkB,yBAAyB,CAAC;AAEzD,MAAM,WAAW,mBAAmB;IAClC,iFAAiF;IACjF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,+EAA+E;IAC/E,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,gFAAgF;IAChF,MAAM,EAAE,kBAAkB,CAAC;CAC5B;AAED;;;;;6DAK6D;AAC7D,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,mBAAmB,CAW9E;AAED,0FAA0F;AAC1F,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAElE"}

package/dist/auth/login-error.js

@@ -1,18 +1,33 @@
 // Pure parser for SII's failed-login page (rendered on zeusr.sii.cl at
 // /cgi_AUT2000/CAutInicio.cgi). Kept DOM-free so it is unit-testable in Node;
 // the Playwright adapter passes it the page's `innerText` (adapters/node/portal.ts).
-/** Extract SII's verbatim login-error cause from the failed-login page body text.
+/** SII's message código for a wrong Clave Tributaria, observed 2026-06-28
+ *  (docs/sii-contract/auth-login.md). It is the ONLY código classified as
+ *  `'wrong-clave'`; the locked-account página has a DISTINCT código, not yet
+ *  observed (triggering it risks a real lock, ADR-004/ADR-010), so it stays
+ *  `'unknown'` until captured. */
+export const WRONG_CLAVE_CODIGO = '01.01.203.500.720.20';
+/** Parse SII's failed-login page body into {message, codigo, reason}.
  *  Observed 2026-06-28 (docs/sii-contract/auth-login.md): the page renders the
  *  human cause, then a line `El código de este mensaje es <código>`. The line
  *  BEFORE the código line is the cause (e.g. "La Clave Tributaria ingresada no es
- *  correcta…"). Returns `"<causa> (<código line>)"`, or `null` if the shape
- *  changed (the caller falls back to a generic no-retry message). */
-export function parseSiiLoginError(bodyText) {
+ *  correcta…"). A changed shape ⇒ `{message: null, codigo: null, reason: 'unknown'}`
+ *  (the caller falls back to a generic no-retry message). */
+export function parseSiiLoginErrorDetail(bodyText) {
     const lines = bodyText
         .split('\n')
         .map((l) => l.trim())
         .filter(Boolean);
     const i = lines.findIndex((l) => /El c[oó]digo de este mensaje/i.test(l));
-    return i > 0 ? `${lines[i - 1]} (${lines[i]})` : null;
+    if (i <= 0)
+        return { message: null, codigo: null, reason: 'unknown' };
+    const codigoLine = lines[i] ?? '';
+    const codigo = /El c[oó]digo de este mensaje es\s+([0-9][0-9.]*)/i.exec(codigoLine)?.[1] ?? null;
+    const reason = codigo === WRONG_CLAVE_CODIGO ? 'wrong-clave' : 'unknown';
+    return { message: `${lines[i - 1]} (${codigoLine})`, codigo, reason };
+}
+/** Back-compat string view: SII's verbatim cause line, or `null` if the shape changed. */
+export function parseSiiLoginError(bodyText) {
+    return parseSiiLoginErrorDetail(bodyText).message;
 }
 //# sourceMappingURL=login-error.js.map

package/dist/auth/login-error.js.map

@@ -1 +1 @@
-{"version":3,"file":"login-error.js","sourceRoot":"","sources":["../../src/auth/login-error.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,8EAA8E;AAC9E,qFAAqF;AAErF;;;;;qEAKqE;AACrE,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,MAAM,KAAK,GAAG,QAAQ;SACnB,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC"}
+{"version":3,"file":"login-error.js","sourceRoot":"","sources":["../../src/auth/login-error.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,8EAA8E;AAC9E,qFAAqF;AAIrF;;;;kCAIkC;AAClC,MAAM,CAAC,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AAWzD;;;;;6DAK6D;AAC7D,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,MAAM,KAAK,GAAG,QAAQ;SACnB,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACtE,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,mDAAmD,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACjG,MAAM,MAAM,GAAuB,MAAM,KAAK,kBAAkB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,OAAO,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,UAAU,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACxE,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,OAAO,wBAAwB,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;AACpD,CAAC"}

package/dist/auth/session.d.ts

@@ -1,14 +1,33 @@
-import type { KeyValueStore, PortalSession, Runtime } from '../seams/index.js';
+import type { KeyValueStore, PortalDriver, PortalSession, Runtime } from '../seams/index.js';
+/** The runtime's JS engine (Playwright), or an actionable error. The HTTP default `portal`
+ *  cannot run SII's page JS (ADR-027); a surface that needs it (BTE list, MIPYME) asks for the
+ *  `browser` engine, and the MCP's headed / www2 logins use it directly. */
+export declare function requireBrowser(runtime: Runtime): PortalDriver;
+/** The www2 APP-SESSION layer riding in the same cookies-only jar (ADR-026). Present only after
+ *  `sii auth login --www2`; `expiresAt` is the `X-SII-STATE-CT` cookie's own expiry (observed
+ *  ~100 min), null when the cookie carried none. Metadata only — the cookies themselves live in
+ *  `cookies` like the classic ones. */
+export interface StoredWww2Layer {
+    readonly savedAt: string;
+    readonly expiresAt: string | null;
+}
 export interface StoredSession {
     /** Canonical session-principal RUT (read from the portal, not a credential). */
     readonly rut: string;
-    /** Cookies-only storage state (opaque to the core). */
+    /** Cookies-only storage state (opaque to the core). Holds BOTH layers once `--www2` ran. */
     readonly cookies: unknown;
     readonly savedAt: string;
+    readonly www2?: StoredWww2Layer;
 }
 export declare function readSession(store: KeyValueStore): Promise<StoredSession | null>;
 export declare function writeSession(store: KeyValueStore, session: StoredSession): Promise<void>;
 export declare function deleteSession(store: KeyValueStore): Promise<void>;
+/** Reject a representing operate pointer BEFORE opening a session — the guard every SESSION-KEYED
+ *  surface (F29, BHE, Carpeta…) runs first (ADR-005). `error` builds the surface's own typed error
+ *  from the formatted empresa RUT (already user-visible via `operate --list`, so safe to echo; the
+ *  razón social is PII and is NOT passed). No operate state → resolves; `withSession` then raises
+ *  NotAuthenticated. Single implementation: the third copy (carpeta) turned it into a helper. */
+export declare function assertOperatingSelf(runtime: Runtime, error: (empresaFormatted: string) => Error): Promise<void>;
 export interface SessionContext {
     /** Canonical session-principal RUT (who is logged in). */
     readonly sessionRut: string;
@@ -27,5 +46,13 @@ export interface SessionContext {
  *  retries after a SII block (CONVENTIONS). */
 export declare function withSession<T>(runtime: Runtime, fn: (session: PortalSession, ctx: SessionContext) => Promise<T>, options?: {
     rut?: string;
+    engine?: 'browser';
+}): Promise<T>;
+/** `withSession` pinned to the browser engine — for the surfaces that run SII's OWN page JS
+ *  (BTE `list`'s inline maps, MIPYME's `validaFacEx`), ADR-027. Sugar so those call sites read
+ *  intent-first and never need Chromium elsewhere. Raises `BrowserRequiredError` when the
+ *  runtime carries no `browser` engine. */
+export declare function withBrowserSession<T>(runtime: Runtime, fn: (session: PortalSession, ctx: SessionContext) => Promise<T>, options?: {
+    rut?: string;
 }): Promise<T>;
 //# sourceMappingURL=session.d.ts.map

package/dist/auth/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAK/E,MAAM,WAAW,aAAa;IAC5B,gFAAgF;IAChF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAsB,WAAW,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAErF;AAED,wBAAsB,YAAY,CAAC,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9F;AAED,wBAAsB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvE;AAED,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;mDAE+C;IAC/C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;+CAO+C;AAC/C,wBAAsB,WAAW,CAAC,CAAC,EACjC,OAAO,EAAE,OAAO,EAChB,EAAE,EAAE,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,CAAC,CAAC,EAC/D,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7B,OAAO,CAAC,CAAC,CAAC,CA4BZ"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAE7F;;4EAE4E;AAC5E,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,YAAY,CAS7D;AAKD;;;uCAGuC;AACvC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,aAAa;IAC5B,gFAAgF;IAChF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC;CACjC;AAED,wBAAsB,WAAW,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAErF;AAED,wBAAsB,YAAY,CAAC,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9F;AAED,wBAAsB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvE;AAED;;;;iGAIiG;AACjG,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,CAAC,gBAAgB,EAAE,MAAM,KAAK,KAAK,GACzC,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;mDAE+C;IAC/C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;+CAO+C;AAC/C,wBAAsB,WAAW,CAAC,CAAC,EACjC,OAAO,EAAE,OAAO,EAChB,EAAE,EAAE,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,CAAC,CAAC,EAC/D,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,SAAS,CAAA;CAAO,GACjD,OAAO,CAAC,CAAC,CAAC,CAgCZ;AAED;;;2CAG2C;AAC3C,wBAAgB,kBAAkB,CAAC,CAAC,EAClC,OAAO,EAAE,OAAO,EAChB,EAAE,EAAE,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,CAAC,CAAC,EAC/D,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7B,OAAO,CAAC,CAAC,CAAC,CAEZ"}

package/dist/auth/session.js

@@ -1,5 +1,17 @@
-import { NotAuthenticatedError } from '../errors/index.js';
+import { BrowserRequiredError, NotAuthenticatedError } from '../errors/index.js';
 import { readOperateState, resolveOperableTarget } from '../identity/index.js';
+import { Rut } from '../rut/index.js';
+/** The runtime's JS engine (Playwright), or an actionable error. The HTTP default `portal`
+ *  cannot run SII's page JS (ADR-027); a surface that needs it (BTE list, MIPYME) asks for the
+ *  `browser` engine, and the MCP's headed / www2 logins use it directly. */
+export function requireBrowser(runtime) {
+    if (!runtime.browser) {
+        throw new BrowserRequiredError('Esta operación necesita el motor de navegador (Playwright), que este runtime no tiene ' +
+            'configurado. En el CLI, las superficies que lo requieren (BTE list, factura MIPYME) ' +
+            'necesitan `playwright` instalado; el login con navegador vive en el MCP (ADR-027).');
+    }
+    return runtime.browser;
+}
 // Distinct KeyValueStore key (ADR-007) — never shares a file with `identity`'s 'operate'.
 const SESSION_KEY = 'session';
 export async function readSession(store) {
@@ -11,6 +23,17 @@ export async function writeSession(store, session) {
 export async function deleteSession(store) {
     await store.delete(SESSION_KEY);
 }
+/** Reject a representing operate pointer BEFORE opening a session — the guard every SESSION-KEYED
+ *  surface (F29, BHE, Carpeta…) runs first (ADR-005). `error` builds the surface's own typed error
+ *  from the formatted empresa RUT (already user-visible via `operate --list`, so safe to echo; the
+ *  razón social is PII and is NOT passed). No operate state → resolves; `withSession` then raises
+ *  NotAuthenticated. Single implementation: the third copy (carpeta) turned it into a helper. */
+export async function assertOperatingSelf(runtime, error) {
+    const op = await readOperateState(runtime.store);
+    if (op && op.operatingRut !== op.selfRut) {
+        throw error(Rut.parse(op.operatingRut).formatted);
+    }
+}
 /** Acquire a live `PortalSession` from the stored cookies-only session and run `fn`
  *  against it. This is how DOMAIN TASKS reach SII: they consume a session, they
  *  NEVER mint one (only `login` mints — ADR-006, sii-py ADR-019). The operating/body
@@ -40,13 +63,23 @@ export async function withSession(runtime, fn, options = {}) {
     else {
         operatingRut = operateState?.operatingRut ?? stored.rut;
     }
+    // The default engine is the browser-free HTTP driver; a surface that runs SII's page JS
+    // asks for the `browser` engine, restored into the same cookies-only jar (ADR-027).
+    const driver = options.engine === 'browser' ? requireBrowser(runtime) : runtime.portal;
     let s = null;
     try {
-        s = await runtime.portal.restore(stored.cookies);
+        s = await driver.restore(stored.cookies);
         return await fn(s, { sessionRut: stored.rut, operatingRut });
     }
     finally {
         await s?.close();
     }
 }
+/** `withSession` pinned to the browser engine — for the surfaces that run SII's OWN page JS
+ *  (BTE `list`'s inline maps, MIPYME's `validaFacEx`), ADR-027. Sugar so those call sites read
+ *  intent-first and never need Chromium elsewhere. Raises `BrowserRequiredError` when the
+ *  runtime carries no `browser` engine. */
+export function withBrowserSession(runtime, fn, options = {}) {
+    return withSession(runtime, fn, { ...options, engine: 'browser' });
+}
 //# sourceMappingURL=session.js.map

package/dist/auth/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAG/E,0FAA0F;AAC1F,MAAM,WAAW,GAAG,SAAS,CAAC;AAU9B,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAoB;IACpD,OAAO,KAAK,CAAC,IAAI,CAAgB,WAAW,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAoB,EAAE,OAAsB;IAC7E,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAoB;IACtD,MAAM,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAClC,CAAC;AAWD;;;;;;;+CAO+C;AAC/C,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAgB,EAChB,EAA+D,EAC/D,UAA4B,EAAE;IAE9B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,qBAAqB,CAAC,0CAA0C,CAAC,CAAC;IAC9E,CAAC;IACD,2EAA2E;IAC3E,mFAAmF;IACnF,qFAAqF;IACrF,iFAAiF;IACjF,2EAA2E;IAC3E,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3D,IAAI,YAAoB,CAAC;IACzB,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,qBAAqB,CAAC,0CAA0C,CAAC,CAAC;QAC9E,CAAC;QACD,YAAY,GAAG,qBAAqB,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAClE,CAAC;SAAM,CAAC;QACN,YAAY,GAAG,YAAY,EAAE,YAAY,IAAI,MAAM,CAAC,GAAG,CAAC;IAC1D,CAAC;IAED,IAAI,CAAC,GAAyB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjD,OAAO,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;IAC/D,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC"}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAGtC;;4EAE4E;AAC5E,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC7C,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,oBAAoB,CAC5B,wFAAwF;YACtF,sFAAsF;YACtF,oFAAoF,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CAAC;AACzB,CAAC;AAED,0FAA0F;AAC1F,MAAM,WAAW,GAAG,SAAS,CAAC;AAoB9B,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAoB;IACpD,OAAO,KAAK,CAAC,IAAI,CAAgB,WAAW,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAoB,EAAE,OAAsB;IAC7E,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAoB;IACtD,MAAM,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAClC,CAAC;AAED;;;;iGAIiG;AACjG,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAgB,EAChB,KAA0C;IAE1C,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,EAAE,IAAI,EAAE,CAAC,YAAY,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC;QACzC,MAAM,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAWD;;;;;;;+CAO+C;AAC/C,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAgB,EAChB,EAA+D,EAC/D,UAAgD,EAAE;IAElD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,qBAAqB,CAAC,0CAA0C,CAAC,CAAC;IAC9E,CAAC;IACD,2EAA2E;IAC3E,mFAAmF;IACnF,qFAAqF;IACrF,iFAAiF;IACjF,2EAA2E;IAC3E,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3D,IAAI,YAAoB,CAAC;IACzB,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,qBAAqB,CAAC,0CAA0C,CAAC,CAAC;QAC9E,CAAC;QACD,YAAY,GAAG,qBAAqB,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAClE,CAAC;SAAM,CAAC;QACN,YAAY,GAAG,YAAY,EAAE,YAAY,IAAI,MAAM,CAAC,GAAG,CAAC;IAC1D,CAAC;IAED,wFAAwF;IACxF,oFAAoF;IACpF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAEvF,IAAI,CAAC,GAAyB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,CAAC,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzC,OAAO,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;IAC/D,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;2CAG2C;AAC3C,MAAM,UAAU,kBAAkB,CAChC,OAAgB,EAChB,EAA+D,EAC/D,UAA4B,EAAE;IAE9B,OAAO,WAAW,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;AACrE,CAAC"}

package/dist/auth/www2-login.d.ts

@@ -0,0 +1,28 @@
+import type { Www2Session } from '../portal/www2-session.js';
+import type { PortalSession, Runtime } from '../seams/index.js';
+/** Same budget as the classic headed login: a human has to read the chooser, type the Clave and
+ *  pass the reCAPTCHA. */
+export declare const WWW2_LOGIN_TIMEOUT_MS = 300000;
+/** How often the app session is re-read while the user is at the OAuth page. Each read is one
+ *  cheap GET the SPA itself issues on every route change (observed), paced via `Clock.sleep`. */
+export declare const WWW2_POLL_MS = 2000;
+/** The www2 app-session cookies all share this prefix (observed 2026-09-12): a literal
+ *  `X-SII-STATE-TYPE` plus a state cookie whose suffix VARIES (`X-SII-STATE-CT` and
+ *  `X-SII-STATE-CL` both seen — the letter is not stable), and every one carries the SAME
+ *  expiry (~100 min). So the layer's expiry is read from ANY of them, not a fixed name. */
+export declare const WWW2_STATE_COOKIE_PREFIX = "X-SII-STATE-";
+/** Union of the classic jar (snapshotted BEFORE the www2 step) and the jar AFTER it: every classic
+ *  cookie is kept, every www2 cookie is added, and on a same-identity collision the later (www2)
+ *  value wins — a fresher load-balancer/analytics cookie, never a lost classic one. Falls back to
+ *  the www2 state alone only when the classic one is not a cookie list at all. */
+export declare function mergeStorageState(classic: unknown, www2: unknown): unknown;
+/** ISO expiry of the www2 layer, read off any `X-SII-STATE-*` cookie (they share one expiry;
+ *  Playwright carries `expires` as epoch SECONDS, `-1` = session cookie). Null when none is present
+ *  or all are session-scoped. Takes the max, so a session-scoped `-TYPE` never masks a dated pair. */
+export declare function www2ExpiresAt(state: unknown): string | null;
+/** Drive the headed `session` (already past the classic login) to the www2 app page and wait for
+ *  the user to complete SII's OAuth login there, polling the app-session read until it answers or
+ *  the budget runs out. Resolves the session JSON; raises `LoginFailedError` on timeout. Any error
+ *  other than "no app session yet" propagates — never retried (ADR-004). */
+export declare function waitForWww2Session(runtime: Runtime, session: PortalSession, timeoutMs?: number): Promise<Www2Session>;
+//# sourceMappingURL=www2-login.d.ts.map

package/dist/auth/www2-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"www2-login.d.ts","sourceRoot":"","sources":["../../src/auth/www2-login.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEhE;0BAC0B;AAC1B,eAAO,MAAM,qBAAqB,SAAU,CAAC;AAC7C;iGACiG;AACjG,eAAO,MAAM,YAAY,OAAQ,CAAC;AAElC;;;2FAG2F;AAC3F,eAAO,MAAM,wBAAwB,iBAAiB,CAAC;AA8BvD;;;kFAGkF;AAClF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAS1E;AAED;;sGAEsG;AACtG,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAW3D;AAED;;;4EAG4E;AAC5E,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,aAAa,EACtB,SAAS,GAAE,MAA8B,GACxC,OAAO,CAAC,WAAW,CAAC,CAiBtB"}

package/dist/auth/www2-login.js

@@ -0,0 +1,101 @@
+// The www2 APP-SESSION step of `sii auth login --www2` (ADR-026): mint the second cookies-only
+// layer `www2.sii.cl/app/*` needs, the ADR-006 way — the user types the Clave into SII's real
+// OAuth page in the SAME headed browser the classic login used; we keep cookies only.
+//
+// Observed 2026-09-11/12 (#110, docs/sii-contract/auth-login.md § www2): the app page bounces an
+// app-session-less browser to `/bifurcacion` (the chooser) → `/oauthsii-v1/` (Clave + reCAPTCHA
+// Enterprise, hence NEVER automated — a human types) → `/app/session/create` → back to the app,
+// now holding the httpOnly `.sii.cl` pair `X-SII-STATE-CT` + `X-SII-STATE-TYPE` (~100 min). The
+// OAuth page WIPES the classic cookies from the browser context on mount, so the classic jar is
+// snapshotted BEFORE this step and the www2 cookies are ADDED to it — never the reverse.
+import { WWW2_APP_CARPETA } from '../config/index.js';
+import { LoginFailedError, Www2SessionError } from '../errors/index.js';
+import { readWww2Session } from '../portal/www2-session.js';
+/** Same budget as the classic headed login: a human has to read the chooser, type the Clave and
+ *  pass the reCAPTCHA. */
+export const WWW2_LOGIN_TIMEOUT_MS = 300_000;
+/** How often the app session is re-read while the user is at the OAuth page. Each read is one
+ *  cheap GET the SPA itself issues on every route change (observed), paced via `Clock.sleep`. */
+export const WWW2_POLL_MS = 2_000;
+/** The www2 app-session cookies all share this prefix (observed 2026-09-12): a literal
+ *  `X-SII-STATE-TYPE` plus a state cookie whose suffix VARIES (`X-SII-STATE-CT` and
+ *  `X-SII-STATE-CL` both seen — the letter is not stable), and every one carries the SAME
+ *  expiry (~100 min). So the layer's expiry is read from ANY of them, not a fixed name. */
+export const WWW2_STATE_COOKIE_PREFIX = 'X-SII-STATE-';
+const cookiesOf = (state) => {
+    if (state &&
+        typeof state === 'object' &&
+        Array.isArray(state.cookies)) {
+        return state.cookies;
+    }
+    return null;
+};
+// Identity of a cookie for the merge: name + domain + path (a scalar entry — the fakes use plain
+// strings — keys by its own JSON so it survives the union untouched).
+const keyOf = (c) => {
+    if (c && typeof c === 'object') {
+        const k = c;
+        return `${String(k.name)}|${String(k.domain)}|${String(k.path)}`;
+    }
+    return JSON.stringify(c);
+};
+/** Union of the classic jar (snapshotted BEFORE the www2 step) and the jar AFTER it: every classic
+ *  cookie is kept, every www2 cookie is added, and on a same-identity collision the later (www2)
+ *  value wins — a fresher load-balancer/analytics cookie, never a lost classic one. Falls back to
+ *  the www2 state alone only when the classic one is not a cookie list at all. */
+export function mergeStorageState(classic, www2) {
+    const a = cookiesOf(classic);
+    const b = cookiesOf(www2);
+    if (!a)
+        return www2;
+    if (!b)
+        return classic;
+    const merged = new Map();
+    for (const c of a)
+        merged.set(keyOf(c), c);
+    for (const c of b)
+        merged.set(keyOf(c), c);
+    return { ...www2, cookies: [...merged.values()] };
+}
+/** ISO expiry of the www2 layer, read off any `X-SII-STATE-*` cookie (they share one expiry;
+ *  Playwright carries `expires` as epoch SECONDS, `-1` = session cookie). Null when none is present
+ *  or all are session-scoped. Takes the max, so a session-scoped `-TYPE` never masks a dated pair. */
+export function www2ExpiresAt(state) {
+    let best = 0;
+    for (const c of cookiesOf(state) ?? []) {
+        if (!c || typeof c !== 'object')
+            continue;
+        const k = c;
+        if (typeof k.name !== 'string' || !k.name.startsWith(WWW2_STATE_COOKIE_PREFIX))
+            continue;
+        if (typeof k.expires === 'number' && k.expires > best)
+            best = k.expires;
+    }
+    if (best <= 0)
+        return null;
+    const d = new Date(best * 1000);
+    return Number.isNaN(d.getTime()) ? null : d.toISOString();
+}
+/** Drive the headed `session` (already past the classic login) to the www2 app page and wait for
+ *  the user to complete SII's OAuth login there, polling the app-session read until it answers or
+ *  the budget runs out. Resolves the session JSON; raises `LoginFailedError` on timeout. Any error
+ *  other than "no app session yet" propagates — never retried (ADR-004). */
+export async function waitForWww2Session(runtime, session, timeoutMs = WWW2_LOGIN_TIMEOUT_MS) {
+    const start = runtime.clock.now().getTime();
+    await session.goto(WWW2_APP_CARPETA);
+    for (;;) {
+        try {
+            return await readWww2Session(session, WWW2_APP_CARPETA);
+        }
+        catch (e) {
+            if (!(e instanceof Www2SessionError))
+                throw e;
+        }
+        if (runtime.clock.now().getTime() - start >= timeoutMs) {
+            throw new LoginFailedError('Login www2 no completado (tiempo agotado en la página OAuth del SII). La sesión de ' +
+                'Mi SII sí quedó guardada; reintenta `sii auth login --www2` para la capa www2.');
+        }
+        await runtime.clock.sleep(WWW2_POLL_MS);
+    }
+}
+//# sourceMappingURL=www2-login.js.map

package/dist/auth/www2-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"www2-login.js","sourceRoot":"","sources":["../../src/auth/www2-login.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,8FAA8F;AAC9F,sFAAsF;AACtF,EAAE;AACF,iGAAiG;AACjG,gGAAgG;AAChG,gGAAgG;AAChG,gGAAgG;AAChG,gGAAgG;AAChG,yFAAyF;AACzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAI5D;0BAC0B;AAC1B,MAAM,CAAC,MAAM,qBAAqB,GAAG,OAAO,CAAC;AAC7C;iGACiG;AACjG,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,CAAC;AAElC;;;2FAG2F;AAC3F,MAAM,CAAC,MAAM,wBAAwB,GAAG,cAAc,CAAC;AAUvD,MAAM,SAAS,GAAG,CAAC,KAAc,EAAoB,EAAE;IACrD,IACE,KAAK;QACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,OAAO,CAAE,KAA+B,CAAC,OAAO,CAAC,EACvD,CAAC;QACD,OAAQ,KAAgC,CAAC,OAAO,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AACF,iGAAiG;AACjG,sEAAsE;AACtE,MAAM,KAAK,GAAG,CAAC,CAAU,EAAU,EAAE;IACnC,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAe,CAAC;QAC1B,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC,CAAC;AAEF;;;kFAGkF;AAClF,MAAM,UAAU,iBAAiB,CAAC,OAAgB,EAAE,IAAa;IAC/D,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,CAAC,CAAC;QAAE,OAAO,OAAO,CAAC;IACvB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3C,OAAO,EAAE,GAAI,IAAe,EAAE,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;AAChE,CAAC;AAED;;sGAEsG;AACtG,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QAC1C,MAAM,CAAC,GAAG,CAAe,CAAC;QAC1B,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC;YAAE,SAAS;QACzF,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,GAAG,IAAI;YAAE,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC;IAC1E,CAAC;IACD,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAC5D,CAAC;AAED;;;4EAG4E;AAC5E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAgB,EAChB,OAAsB,EACtB,YAAoB,qBAAqB;IAEzC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC5C,MAAM,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACrC,SAAS,CAAC;QACR,IAAI,CAAC;YACH,OAAO,MAAM,eAAe,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,CAAC,CAAC,YAAY,gBAAgB,CAAC;gBAAE,MAAM,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,IAAI,SAAS,EAAE,CAAC;YACvD,MAAM,IAAI,gBAAgB,CACxB,qFAAqF;gBACnF,gFAAgF,CACnF,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC"}

package/dist/cli.d.ts

@@ -1,3 +1,3 @@
-export { consoleLogin, keyringLogin } from './tasks/auth.js';
-export type { AuthLoginResult } from './tasks/auth.js';
+export { consoleLogin, keyringLogin, suppliedClaveLogin, unblockLogin } from './tasks/auth.js';
+export type { AuthLoginResult, LoginSource } from './tasks/auth.js';
 //# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC7D,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/F,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/cli.js

@@ -4,5 +4,8 @@
 // takes a password (ADR-006). The terminal CLI imports this subpath instead.
 // `keyringLogin` joins it for the same reason: it READS a Clave (from the OS keyring),
 // so it must be unreachable from the MCP server (ADR-025).
-export { consoleLogin, keyringLogin } from './tasks/auth.js';
+// `suppliedClaveLogin` takes a Clave the CLI read from a named env var or stdin, and
+// `unblockLogin` lifts the rejection latch that guards it — a human's reset, never the
+// model's (ADR-028).
+export { consoleLogin, keyringLogin, suppliedClaveLogin, unblockLogin } from './tasks/auth.js';
 //# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,oHAAoH;AACpH,qGAAqG;AACrG,gFAAgF;AAChF,6EAA6E;AAC7E,uFAAuF;AACvF,2DAA2D;AAC3D,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,oHAAoH;AACpH,qGAAqG;AACrG,gFAAgF;AAChF,6EAA6E;AAC7E,uFAAuF;AACvF,2DAA2D;AAC3D,qFAAqF;AACrF,uFAAuF;AACvF,qBAAqB;AACrB,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/config/config.d.ts

@@ -10,6 +10,12 @@ export declare const HOSTS: {
     readonly portal: "https://www.sii.cl";
     /** SPA JSON facades (RCV / F29 / F22) live under this host. */
     readonly portalApi: "https://www4.sii.cl";
+    /** The newer SPA apps + their `/app/<name>-api/*` JSON facades — first the Carpeta
+     *  Tributaria (`/carpetatributaria/…` SPA over `/app/cte-api-carpetatributaria/{rut}/…`).
+     *  The `.sii.cl` session cookie SSO-carries, but every `cte-api` call answers 401 until
+     *  the app's own `GET /app/session/status?originalUrl=…` warm-up ran (observed
+     *  2026-09-11, #110). (#109 / #110) */
+    readonly portalApp: "https://www2.sii.cl";
     /** Legacy BHE/BTE consulta CGIs (boletas de honorarios). HTML skeleton filled
      *  client-side from inline JS maps; read via `PortalSession.goto`/`evaluate`, NOT
      *  the SDI-JSON facade. The `.sii.cl` session cookie SSO-carries here (observed
@@ -42,6 +48,21 @@ export declare const LOGIN_HOST = "zeusr.sii.cl";
 export declare const LOGIN_URL: string;
 /** Full server-side logout URL (host + path). The close redirects OFF this path. */
 export declare const LOGOUT_URL: string;
+/** The login form's POST target (`action=/cgi_AUT2000/CAutInicio.cgi`, observed 2026-06-28 /
+ *  re-confirmed 2026-10-17). The HTTP credential login POSTs the five form fields here after a
+ *  warm-up GET of the login page (ADR-027). */
+export declare const LOGIN_POST_URL: string;
+/** SII's Queue-it waiting-room host (`salaespera.sii.cl`): the peak-load queue SII drops users
+ *  into on heavy days. An HTTP client cannot pass it, so a login redirected here raises
+ *  `LoginQueuedError` — surfaced, never retried (observed in the browser jar, ADR-027). */
+export declare const QUEUE_IT_HOST = "salaespera.sii.cl";
+/** The www2 app page `sii auth login --www2` opens for the user to complete SII's OAuth login
+ *  (`/bifurcacion` → `/oauthsii-v1/` → `/app/session/create` → back here), and the `Referer` /
+ *  `originalUrl` the Carpeta SPA sends on its own calls. Observed 2026-09-11/12 (#110, ADR-026). */
+export declare const WWW2_APP_CARPETA: string;
+/** The www2 app-session close (the SPA's `$logout`: `/app/session/close?originalUrl=…`, from the
+ *  session library `chunk-vendors.659f67b1.js`, observed 2026-09-11). Best-effort on logout. */
+export declare const WWW2_SESSION_CLOSE_URL: string;
 /** The keyring "service" every entry of this tool lives under; the account (`username`
  *  in keyring terms) is the RUT. Lives here — with the other environment constants —
  *  because BOTH the pure `keyringLogin` task (for its error message) and the Node

package/dist/config/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,KAAK;IAChB,2FAA2F;;IAE3F,+FAA+F;;IAE/F,8FAA8F;;IAE9F,gGAAgG;;;IAGhG,+DAA+D;;IAE/D;;;uFAGmF;;IAEnF;;;;;oFAKgF;;IAEhF;wEACoE;;IAEpE;;;;0BAIsB;;IAEtB;6FACyF;;;CAGjF,CAAC;AAEX,+EAA+E;AAC/E,eAAO,MAAM,UAAU,iBAAiB,CAAC;AAEzC,yCAAyC;AACzC,eAAO,MAAM,SAAS,QAAqC,CAAC;AAE5D,oFAAoF;AACpF,eAAO,MAAM,UAAU,QAAsC,CAAC;AAE9D;;;sDAGsD;AACtD,eAAO,MAAM,eAAe,QAAQ,CAAC;AAErC,MAAM,WAAW,QAAQ;IACvB,sEAAsE;IACtE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,8CAA8C;IAC9C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,eAAO,MAAM,gBAAgB,EAAE,QAG9B,CAAC;AAEF,yFAAyF;AACzF,wBAAgB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEpD"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,KAAK;IAChB,2FAA2F;;IAE3F,+FAA+F;;IAE/F,8FAA8F;;IAE9F,gGAAgG;;;IAGhG,+DAA+D;;IAE/D;;;;2CAIuC;;IAEvC;;;uFAGmF;;IAEnF;;;;;oFAKgF;;IAEhF;wEACoE;;IAEpE;;;;0BAIsB;;IAEtB;6FACyF;;;CAGjF,CAAC;AAEX,+EAA+E;AAC/E,eAAO,MAAM,UAAU,iBAAiB,CAAC;AAEzC,yCAAyC;AACzC,eAAO,MAAM,SAAS,QAAqC,CAAC;AAE5D,oFAAoF;AACpF,eAAO,MAAM,UAAU,QAAsC,CAAC;AAE9D;;+CAE+C;AAC/C,eAAO,MAAM,cAAc,QAA8C,CAAC;AAE1E;;2FAE2F;AAC3F,eAAO,MAAM,aAAa,sBAAsB,CAAC;AAEjD;;oGAEoG;AACpG,eAAO,MAAM,gBAAgB,QAA2D,CAAC;AAEzF;gGACgG;AAChG,eAAO,MAAM,sBAAsB,QAAyC,CAAC;AAE7E;;;sDAGsD;AACtD,eAAO,MAAM,eAAe,QAAQ,CAAC;AAErC,MAAM,WAAW,QAAQ;IACvB,sEAAsE;IACtE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,8CAA8C;IAC9C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,eAAO,MAAM,gBAAgB,EAAE,QAG9B,CAAC;AAEF,yFAAyF;AACzF,wBAAgB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEpD"}

package/dist/config/config.js

@@ -13,6 +13,12 @@ export const HOSTS = {
     portal: 'https://www.sii.cl',
     /** SPA JSON facades (RCV / F29 / F22) live under this host. */
     portalApi: 'https://www4.sii.cl',
+    /** The newer SPA apps + their `/app/<name>-api/*` JSON facades — first the Carpeta
+     *  Tributaria (`/carpetatributaria/…` SPA over `/app/cte-api-carpetatributaria/{rut}/…`).
+     *  The `.sii.cl` session cookie SSO-carries, but every `cte-api` call answers 401 until
+     *  the app's own `GET /app/session/status?originalUrl=…` warm-up ran (observed
+     *  2026-09-11, #110). (#109 / #110) */
+    portalApp: 'https://www2.sii.cl',
     /** Legacy BHE/BTE consulta CGIs (boletas de honorarios). HTML skeleton filled
      *  client-side from inline JS maps; read via `PortalSession.goto`/`evaluate`, NOT
      *  the SDI-JSON facade. The `.sii.cl` session cookie SSO-carries here (observed
@@ -45,6 +51,21 @@ export const LOGIN_HOST = 'zeusr.sii.cl';
 export const LOGIN_URL = `${HOSTS.login}${HOSTS.loginPath}`;
 /** Full server-side logout URL (host + path). The close redirects OFF this path. */
 export const LOGOUT_URL = `${HOSTS.login}${HOSTS.logoutPath}`;
+/** The login form's POST target (`action=/cgi_AUT2000/CAutInicio.cgi`, observed 2026-06-28 /
+ *  re-confirmed 2026-10-17). The HTTP credential login POSTs the five form fields here after a
+ *  warm-up GET of the login page (ADR-027). */
+export const LOGIN_POST_URL = `${HOSTS.login}/cgi_AUT2000/CAutInicio.cgi`;
+/** SII's Queue-it waiting-room host (`salaespera.sii.cl`): the peak-load queue SII drops users
+ *  into on heavy days. An HTTP client cannot pass it, so a login redirected here raises
+ *  `LoginQueuedError` — surfaced, never retried (observed in the browser jar, ADR-027). */
+export const QUEUE_IT_HOST = 'salaespera.sii.cl';
+/** The www2 app page `sii auth login --www2` opens for the user to complete SII's OAuth login
+ *  (`/bifurcacion` → `/oauthsii-v1/` → `/app/session/create` → back here), and the `Referer` /
+ *  `originalUrl` the Carpeta SPA sends on its own calls. Observed 2026-09-11/12 (#110, ADR-026). */
+export const WWW2_APP_CARPETA = `${HOSTS.portalApp}/carpetatributaria/generarcteregular`;
+/** The www2 app-session close (the SPA's `$logout`: `/app/session/close?originalUrl=…`, from the
+ *  session library `chunk-vendors.659f67b1.js`, observed 2026-09-11). Best-effort on logout. */
+export const WWW2_SESSION_CLOSE_URL = `${HOSTS.portalApp}/app/session/close`;
 /** The keyring "service" every entry of this tool lives under; the account (`username`
  *  in keyring terms) is the RUT. Lives here — with the other environment constants —
  *  because BOTH the pure `keyringLogin` task (for its error message) and the Node

package/dist/config/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,gFAAgF;AAChF,6DAA6D;AAE7D,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,2FAA2F;IAC3F,KAAK,EAAE,sBAAsB;IAC7B,+FAA+F;IAC/F,SAAS,EAAE,mDAAmD;IAC9D,8FAA8F;IAC9F,UAAU,EAAE,6BAA6B;IACzC,gGAAgG;IAChG,KAAK,EAAE,6CAA6C;IACpD,MAAM,EAAE,oBAAoB;IAC5B,+DAA+D;IAC/D,SAAS,EAAE,qBAAqB;IAChC;;;uFAGmF;IACnF,MAAM,EAAE,4BAA4B;IACpC;;;;;oFAKgF;IAChF,OAAO,EAAE,uCAAuC;IAChD;wEACoE;IACpE,UAAU,EAAE,+BAA+B;IAC3C;;;;0BAIsB;IACtB,MAAM,EAAE,oCAAoC;IAC5C;6FACyF;IACzF,KAAK,EAAE,uBAAuB;IAC9B,UAAU,EAAE,sDAAsD;CAC1D,CAAC;AAEX,+EAA+E;AAC/E,MAAM,CAAC,MAAM,UAAU,GAAG,cAAc,CAAC;AAEzC,yCAAyC;AACzC,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;AAE5D,oFAAoF;AACpF,MAAM,CAAC,MAAM,UAAU,GAAG,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;AAE9D;;;sDAGsD;AACtD,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC;AASrC,MAAM,CAAC,MAAM,gBAAgB,GAAa;IACxC,YAAY,EAAE,CAAC;IACf,iBAAiB,EAAE,EAAE;CACtB,CAAC;AAEF,yFAAyF;AACzF,MAAM,UAAU,QAAQ,CAAC,WAAmB;IAC1C,OAAO,GAAG,SAAS,IAAI,WAAW,EAAE,CAAC;AACvC,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,gFAAgF;AAChF,6DAA6D;AAE7D,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,2FAA2F;IAC3F,KAAK,EAAE,sBAAsB;IAC7B,+FAA+F;IAC/F,SAAS,EAAE,mDAAmD;IAC9D,8FAA8F;IAC9F,UAAU,EAAE,6BAA6B;IACzC,gGAAgG;IAChG,KAAK,EAAE,6CAA6C;IACpD,MAAM,EAAE,oBAAoB;IAC5B,+DAA+D;IAC/D,SAAS,EAAE,qBAAqB;IAChC;;;;2CAIuC;IACvC,SAAS,EAAE,qBAAqB;IAChC;;;uFAGmF;IACnF,MAAM,EAAE,4BAA4B;IACpC;;;;;oFAKgF;IAChF,OAAO,EAAE,uCAAuC;IAChD;wEACoE;IACpE,UAAU,EAAE,+BAA+B;IAC3C;;;;0BAIsB;IACtB,MAAM,EAAE,oCAAoC;IAC5C;6FACyF;IACzF,KAAK,EAAE,uBAAuB;IAC9B,UAAU,EAAE,sDAAsD;CAC1D,CAAC;AAEX,+EAA+E;AAC/E,MAAM,CAAC,MAAM,UAAU,GAAG,cAAc,CAAC;AAEzC,yCAAyC;AACzC,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;AAE5D,oFAAoF;AACpF,MAAM,CAAC,MAAM,UAAU,GAAG,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;AAE9D;;+CAE+C;AAC/C,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,KAAK,CAAC,KAAK,6BAA6B,CAAC;AAE1E;;2FAE2F;AAC3F,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAEjD;;oGAEoG;AACpG,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,KAAK,CAAC,SAAS,sCAAsC,CAAC;AAEzF;gGACgG;AAChG,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,KAAK,CAAC,SAAS,oBAAoB,CAAC;AAE7E;;;sDAGsD;AACtD,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC;AASrC,MAAM,CAAC,MAAM,gBAAgB,GAAa;IACxC,YAAY,EAAE,CAAC;IACf,iBAAiB,EAAE,EAAE;CACtB,CAAC;AAEF,yFAAyF;AACzF,MAAM,UAAU,QAAQ,CAAC,WAAmB;IAC1C,OAAO,GAAG,SAAS,IAAI,WAAW,EAAE,CAAC;AACvC,CAAC"}