@albertomarturelo/sii-core 0.9.0 → 0.11.0

package/dist/errors/errors.d.ts

@@ -9,19 +9,68 @@ export declare class NotAuthenticatedError extends SiiError {
  *  so a generic catch still treats it as "not authenticated". */
 export declare class SessionExpiredError extends NotAuthenticatedError {
 }
-/** Browser login was not completed (timeout / window closed). No partial
- *  session is ever written. */
+/** The www2 APP SESSION (the second cookies-only layer `www2.sii.cl/app/*` needs — ADR-026) is
+ *  missing or expired: `/app/session/status` did not answer a session JSON. A subclass of
+ *  NotAuthenticated because the fix is a login (`sii auth login --www2`), never a retry — but
+ *  DISTINCT from `SessionExpiredError` (the classic Mi SII session may be perfectly alive). */
+export declare class Www2SessionError extends NotAuthenticatedError {
+}
+/** Why a login was rejected, as DATA so a downstream consumer never regex-parses the
+ *  message (#124). `'wrong-clave'` ONLY for SII's observed wrong-Clave código; every
+ *  other código, a changed page shape, a timeout or the generic fallback is `'unknown'`
+ *  — the safe direction (a consumer treats unknown as "blocked", never as "retry"). */
+export type LoginFailureReason = 'wrong-clave' | 'unknown';
+/** Browser login was not completed (timeout / window closed) OR SII rejected the Clave.
+ *  No partial session is ever written. Carries the classified `reason` + SII's message
+ *  `codigo` (when the page printed one) alongside the verbatim message, so a consumer
+ *  reads them as data (#124). Both are additive: `new LoginFailedError(msg)` still works
+ *  (`reason: 'unknown'`, `codigo: null`). */
 export declare class LoginFailedError extends SiiError {
+    readonly reason: LoginFailureReason;
+    readonly codigo: string | null;
+    constructor(message: string, opts?: {
+        reason?: LoginFailureReason;
+        codigo?: string | null;
+    });
 }
 /** SII server-side rate limit / block. NEVER retry — surface verbatim and stop. */
 export declare class RateLimitError extends SiiError {
 }
+/** A surface needs a JS engine (SII's own page JS must run — BTE inline maps, MIPYME's
+ *  in-page `validaFacEx`) but the runtime carries no `browser` engine: the default HTTP
+ *  `PortalDriver` cannot `evaluate`/`interactiveLogin` (ADR-027). Actionable — names the
+ *  Playwright install — never a silent fallback. */
+export declare class BrowserRequiredError extends SiiError {
+}
+/** The login POST was redirected into SII's Queue-it waiting room (`salaespera.sii.cl`),
+ *  the peak-load queue an HTTP client cannot pass (observed in the browser jar, ADR-027).
+ *  NOT a credential failure and NOT retryable here — surface it and stop. */
+export declare class LoginQueuedError extends LoginFailedError {
+}
+/** A NON-interactive login (`--clave-env` / `--clave-stdin` / `--keyring`) refused WITHOUT
+ *  contacting SII because the rejection latch is set for that RUT: SII rejected a Clave for
+ *  it earlier, and an unattended retry of the same stale value is how an account gets locked
+ *  (ADR-028). Carries the latched `codigo`/`reason`. Lifted by an interactive login or
+ *  `sii auth unblock`. A LoginFailed subclass, so it keeps that exit code. */
+export declare class LoginBlockedError extends LoginFailedError {
+}
 /** A stored credential was required (e.g. unattended re-mint) but none resolved. */
 export declare class CredentialNotFoundError extends SiiError {
 }
 /** Invalid user input: bad RUT, an operate target not in the operable set, etc. */
 export declare class ValidationError extends SiiError {
 }
+/** An authenticated `requestJson` got a body that is NOT JSON and NOT the login wall —
+ *  the response reached its destination host (no `LOGIN_HOST` bounce, not HTML) but the
+ *  body does not parse. Observed 2026-09-11 (GH-111) on the cte-api
+ *  `obtenerValorParametro` (URL cited in `adapters/node/response.ts`): HTTP 200
+ *  `text/plain;charset=utf-8` with a bare URL — a live session, a wrong endpoint. Carries
+ *  the endpoint, HTTP status, content-type and the first ~80 chars of the body VERBATIM
+ *  (ADR-004), so a facade can tell a SII quirk from a dead session (`SessionExpiredError`)
+ *  without a second round-trip. NOT a subclass of NotAuthenticated on purpose: re-login
+ *  would not fix it. */
+export declare class UnexpectedResponseError extends SiiError {
+}
 /** SII rejected a portal/SDI facade request (error envelope or unparseable
  *  response). Carries SII's message verbatim — never translated (ADR-004). */
 export declare class RepresentacionError extends SiiError {
@@ -65,4 +114,12 @@ export declare class PeticionesError extends SiiError {
  *  `SessionExpiredError`, not this. */
 export declare class DteError extends SiiError {
 }
+/** SII rejected a Carpeta Tributaria (`cte-api`) request, the body was not the observed shape
+ *  ("scraper roto" — e.g. `/instituciones` not serving an array), the operation is invalid for
+ *  its session-keyed contract (a representing pointer, ADR-005), OR the user's `--institucion` is
+ *  not in SII's LIVE list (the message names the valid codes; no round-trip is spent). SII's
+ *  message verbatim where one exists — never translated (ADR-004). Never retried; a missing www2
+ *  app session is `Www2SessionError` and a `LOGIN_HOST` bounce `SessionExpiredError`, not this. */
+export declare class CarpetaError extends SiiError {
+}
 //# sourceMappingURL=errors.d.ts.map

package/dist/errors/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/errors/errors.ts"],"names":[],"mappings":"AAIA,qBAAa,QAAS,SAAQ,KAAK;gBACrB,OAAO,EAAE,MAAM;CAI5B;AAED,mEAAmE;AACnE,qBAAa,qBAAsB,SAAQ,QAAQ;CAAG;AAEtD;;iEAEiE;AACjE,qBAAa,mBAAoB,SAAQ,qBAAqB;CAAG;AAEjE;+BAC+B;AAC/B,qBAAa,gBAAiB,SAAQ,QAAQ;CAAG;AAEjD,mFAAmF;AACnF,qBAAa,cAAe,SAAQ,QAAQ;CAAG;AAE/C,oFAAoF;AACpF,qBAAa,uBAAwB,SAAQ,QAAQ;CAAG;AAExD,mFAAmF;AACnF,qBAAa,eAAgB,SAAQ,QAAQ;CAAG;AAEhD;8EAC8E;AAC9E,qBAAa,mBAAoB,SAAQ,QAAQ;CAAG;AAEpD;uFACuF;AACvF,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;8EAC8E;AAC9E,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;wFAGwF;AACxF,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;eAGe;AACf,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;;;gFAKgF;AAChF,qBAAa,eAAgB,SAAQ,QAAQ;CAAG;AAEhD;;;;;;;;uCAQuC;AACvC,qBAAa,QAAS,SAAQ,QAAQ;CAAG"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/errors/errors.ts"],"names":[],"mappings":"AAIA,qBAAa,QAAS,SAAQ,KAAK;gBACrB,OAAO,EAAE,MAAM;CAI5B;AAED,mEAAmE;AACnE,qBAAa,qBAAsB,SAAQ,QAAQ;CAAG;AAEtD;;iEAEiE;AACjE,qBAAa,mBAAoB,SAAQ,qBAAqB;CAAG;AAEjE;;;+FAG+F;AAC/F,qBAAa,gBAAiB,SAAQ,qBAAqB;CAAG;AAE9D;;;uFAGuF;AACvF,MAAM,MAAM,kBAAkB,GAAG,aAAa,GAAG,SAAS,CAAC;AAE3D;;;;6CAI6C;AAC7C,qBAAa,gBAAiB,SAAQ,QAAQ;IAC5C,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;gBACnB,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,kBAAkB,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;CAK5F;AAED,mFAAmF;AACnF,qBAAa,cAAe,SAAQ,QAAQ;CAAG;AAE/C;;;oDAGoD;AACpD,qBAAa,oBAAqB,SAAQ,QAAQ;CAAG;AAErD;;6EAE6E;AAC7E,qBAAa,gBAAiB,SAAQ,gBAAgB;CAAG;AAEzD;;;;8EAI8E;AAC9E,qBAAa,iBAAkB,SAAQ,gBAAgB;CAAG;AAE1D,oFAAoF;AACpF,qBAAa,uBAAwB,SAAQ,QAAQ;CAAG;AAExD,mFAAmF;AACnF,qBAAa,eAAgB,SAAQ,QAAQ;CAAG;AAEhD;;;;;;;;wBAQwB;AACxB,qBAAa,uBAAwB,SAAQ,QAAQ;CAAG;AAExD;8EAC8E;AAC9E,qBAAa,mBAAoB,SAAQ,QAAQ;CAAG;AAEpD;uFACuF;AACvF,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;8EAC8E;AAC9E,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;wFAGwF;AACxF,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;eAGe;AACf,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;;;gFAKgF;AAChF,qBAAa,eAAgB,SAAQ,QAAQ;CAAG;AAEhD;;;;;;;;uCAQuC;AACvC,qBAAa,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;;;mGAKmG;AACnG,qBAAa,YAAa,SAAQ,QAAQ;CAAG"}

package/dist/errors/errors.js

@@ -15,19 +15,64 @@ export class NotAuthenticatedError extends SiiError {
  *  so a generic catch still treats it as "not authenticated". */
 export class SessionExpiredError extends NotAuthenticatedError {
 }
-/** Browser login was not completed (timeout / window closed). No partial
- *  session is ever written. */
+/** The www2 APP SESSION (the second cookies-only layer `www2.sii.cl/app/*` needs — ADR-026) is
+ *  missing or expired: `/app/session/status` did not answer a session JSON. A subclass of
+ *  NotAuthenticated because the fix is a login (`sii auth login --www2`), never a retry — but
+ *  DISTINCT from `SessionExpiredError` (the classic Mi SII session may be perfectly alive). */
+export class Www2SessionError extends NotAuthenticatedError {
+}
+/** Browser login was not completed (timeout / window closed) OR SII rejected the Clave.
+ *  No partial session is ever written. Carries the classified `reason` + SII's message
+ *  `codigo` (when the page printed one) alongside the verbatim message, so a consumer
+ *  reads them as data (#124). Both are additive: `new LoginFailedError(msg)` still works
+ *  (`reason: 'unknown'`, `codigo: null`). */
 export class LoginFailedError extends SiiError {
+    reason;
+    codigo;
+    constructor(message, opts) {
+        super(message);
+        this.reason = opts?.reason ?? 'unknown';
+        this.codigo = opts?.codigo ?? null;
+    }
 }
 /** SII server-side rate limit / block. NEVER retry — surface verbatim and stop. */
 export class RateLimitError extends SiiError {
 }
+/** A surface needs a JS engine (SII's own page JS must run — BTE inline maps, MIPYME's
+ *  in-page `validaFacEx`) but the runtime carries no `browser` engine: the default HTTP
+ *  `PortalDriver` cannot `evaluate`/`interactiveLogin` (ADR-027). Actionable — names the
+ *  Playwright install — never a silent fallback. */
+export class BrowserRequiredError extends SiiError {
+}
+/** The login POST was redirected into SII's Queue-it waiting room (`salaespera.sii.cl`),
+ *  the peak-load queue an HTTP client cannot pass (observed in the browser jar, ADR-027).
+ *  NOT a credential failure and NOT retryable here — surface it and stop. */
+export class LoginQueuedError extends LoginFailedError {
+}
+/** A NON-interactive login (`--clave-env` / `--clave-stdin` / `--keyring`) refused WITHOUT
+ *  contacting SII because the rejection latch is set for that RUT: SII rejected a Clave for
+ *  it earlier, and an unattended retry of the same stale value is how an account gets locked
+ *  (ADR-028). Carries the latched `codigo`/`reason`. Lifted by an interactive login or
+ *  `sii auth unblock`. A LoginFailed subclass, so it keeps that exit code. */
+export class LoginBlockedError extends LoginFailedError {
+}
 /** A stored credential was required (e.g. unattended re-mint) but none resolved. */
 export class CredentialNotFoundError extends SiiError {
 }
 /** Invalid user input: bad RUT, an operate target not in the operable set, etc. */
 export class ValidationError extends SiiError {
 }
+/** An authenticated `requestJson` got a body that is NOT JSON and NOT the login wall —
+ *  the response reached its destination host (no `LOGIN_HOST` bounce, not HTML) but the
+ *  body does not parse. Observed 2026-09-11 (GH-111) on the cte-api
+ *  `obtenerValorParametro` (URL cited in `adapters/node/response.ts`): HTTP 200
+ *  `text/plain;charset=utf-8` with a bare URL — a live session, a wrong endpoint. Carries
+ *  the endpoint, HTTP status, content-type and the first ~80 chars of the body VERBATIM
+ *  (ADR-004), so a facade can tell a SII quirk from a dead session (`SessionExpiredError`)
+ *  without a second round-trip. NOT a subclass of NotAuthenticated on purpose: re-login
+ *  would not fix it. */
+export class UnexpectedResponseError extends SiiError {
+}
 /** SII rejected a portal/SDI facade request (error envelope or unparseable
  *  response). Carries SII's message verbatim — never translated (ADR-004). */
 export class RepresentacionError extends SiiError {
@@ -71,4 +116,12 @@ export class PeticionesError extends SiiError {
  *  `SessionExpiredError`, not this. */
 export class DteError extends SiiError {
 }
+/** SII rejected a Carpeta Tributaria (`cte-api`) request, the body was not the observed shape
+ *  ("scraper roto" — e.g. `/instituciones` not serving an array), the operation is invalid for
+ *  its session-keyed contract (a representing pointer, ADR-005), OR the user's `--institucion` is
+ *  not in SII's LIVE list (the message names the valid codes; no round-trip is spent). SII's
+ *  message verbatim where one exists — never translated (ADR-004). Never retried; a missing www2
+ *  app session is `Www2SessionError` and a `LOGIN_HOST` bounce `SessionExpiredError`, not this. */
+export class CarpetaError extends SiiError {
+}
 //# sourceMappingURL=errors.js.map

package/dist/errors/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/errors/errors.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,2EAA2E;AAC3E,kEAAkE;AAElE,MAAM,OAAO,QAAS,SAAQ,KAAK;IACjC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;IAC9B,CAAC;CACF;AAED,mEAAmE;AACnE,MAAM,OAAO,qBAAsB,SAAQ,QAAQ;CAAG;AAEtD;;iEAEiE;AACjE,MAAM,OAAO,mBAAoB,SAAQ,qBAAqB;CAAG;AAEjE;+BAC+B;AAC/B,MAAM,OAAO,gBAAiB,SAAQ,QAAQ;CAAG;AAEjD,mFAAmF;AACnF,MAAM,OAAO,cAAe,SAAQ,QAAQ;CAAG;AAE/C,oFAAoF;AACpF,MAAM,OAAO,uBAAwB,SAAQ,QAAQ;CAAG;AAExD,mFAAmF;AACnF,MAAM,OAAO,eAAgB,SAAQ,QAAQ;CAAG;AAEhD;8EAC8E;AAC9E,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;CAAG;AAEpD;uFACuF;AACvF,MAAM,OAAO,QAAS,SAAQ,QAAQ;CAAG;AAEzC;8EAC8E;AAC9E,MAAM,OAAO,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;wFAGwF;AACxF,MAAM,OAAO,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;eAGe;AACf,MAAM,OAAO,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;;;gFAKgF;AAChF,MAAM,OAAO,eAAgB,SAAQ,QAAQ;CAAG;AAEhD;;;;;;;;uCAQuC;AACvC,MAAM,OAAO,QAAS,SAAQ,QAAQ;CAAG"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/errors/errors.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,2EAA2E;AAC3E,kEAAkE;AAElE,MAAM,OAAO,QAAS,SAAQ,KAAK;IACjC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;IAC9B,CAAC;CACF;AAED,mEAAmE;AACnE,MAAM,OAAO,qBAAsB,SAAQ,QAAQ;CAAG;AAEtD;;iEAEiE;AACjE,MAAM,OAAO,mBAAoB,SAAQ,qBAAqB;CAAG;AAEjE;;;+FAG+F;AAC/F,MAAM,OAAO,gBAAiB,SAAQ,qBAAqB;CAAG;AAQ9D;;;;6CAI6C;AAC7C,MAAM,OAAO,gBAAiB,SAAQ,QAAQ;IACnC,MAAM,CAAqB;IAC3B,MAAM,CAAgB;IAC/B,YAAY,OAAe,EAAE,IAA8D;QACzF,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,MAAM,IAAI,SAAS,CAAC;QACxC,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,MAAM,IAAI,IAAI,CAAC;IACrC,CAAC;CACF;AAED,mFAAmF;AACnF,MAAM,OAAO,cAAe,SAAQ,QAAQ;CAAG;AAE/C;;;oDAGoD;AACpD,MAAM,OAAO,oBAAqB,SAAQ,QAAQ;CAAG;AAErD;;6EAE6E;AAC7E,MAAM,OAAO,gBAAiB,SAAQ,gBAAgB;CAAG;AAEzD;;;;8EAI8E;AAC9E,MAAM,OAAO,iBAAkB,SAAQ,gBAAgB;CAAG;AAE1D,oFAAoF;AACpF,MAAM,OAAO,uBAAwB,SAAQ,QAAQ;CAAG;AAExD,mFAAmF;AACnF,MAAM,OAAO,eAAgB,SAAQ,QAAQ;CAAG;AAEhD;;;;;;;;wBAQwB;AACxB,MAAM,OAAO,uBAAwB,SAAQ,QAAQ;CAAG;AAExD;8EAC8E;AAC9E,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;CAAG;AAEpD;uFACuF;AACvF,MAAM,OAAO,QAAS,SAAQ,QAAQ;CAAG;AAEzC;8EAC8E;AAC9E,MAAM,OAAO,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;wFAGwF;AACxF,MAAM,OAAO,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;eAGe;AACf,MAAM,OAAO,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;;;gFAKgF;AAChF,MAAM,OAAO,eAAgB,SAAQ,QAAQ;CAAG;AAEhD;;;;;;;;uCAQuC;AACvC,MAAM,OAAO,QAAS,SAAQ,QAAQ;CAAG;AAEzC;;;;;mGAKmG;AACnG,MAAM,OAAO,YAAa,SAAQ,QAAQ;CAAG"}

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { login, logout, authStatus, statusRefresh, whoami } from './tasks/auth.js';
-export type { AuthIdentity, AuthLoginResult, AuthLogoutResult, AuthStatusLocal, AuthWhoami, } from './tasks/auth.js';
+export type { AuthIdentity, AuthIdentityRefresh, AuthLoginResult, AuthLogoutResult, AuthStatusLocal, AuthWhoami, AuthWww2Status, LoginBlockEntry, LoginOptions, } from './tasks/auth.js';
 export { operate, operateSelf, operatingStatus, listOperable } from './tasks/operate.js';
 export type { OperateResult, OperableList } from './tasks/operate.js';
 export { describeOperating, formatOperableEntry } from './identity/index.js';
@@ -16,6 +16,8 @@ export type { DteAutorizados, DteAutorizado, DteBorradorArgs, DteBorradorRow, Dt
 export type { BteMensual, BteBoleta, BteTotales, BteSide, BteEmitArgs, BteEmitResult, BteEmitida, BtePreview, BteRetiene, BteLineaEmision, } from './tasks/bte.js';
 export { peticionesList } from './tasks/peticiones.js';
 export type { PeticionesResult, Peticion, EstadoPeticion } from './tasks/peticiones.js';
+export { carpetaInstituciones } from './tasks/carpeta.js';
+export type { CarpetaInstitucion } from './tasks/carpeta.js';
 export type { AuditEntry, AuditSink, Clock, CredentialLoginOptions, InteractiveLoginOptions, KeyValueStore, PortalDriver, PortalSession, Runtime, SecretStore, } from './seams/index.js';
 export { Rut } from './rut/index.js';
 export { formatMoney, formatRut } from './format/index.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACnF,YAAY,EACV,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,UAAU,GACX,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACzF,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC7E,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjE,YAAY,EACV,UAAU,EACV,aAAa,EACb,UAAU,EACV,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,OAAO,GACR,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACxF,YAAY,EACV,SAAS,EACT,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,SAAS,EACT,cAAc,EACd,SAAS,EACT,SAAS,EACT,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,aAAa,EACb,WAAW,EACX,MAAM,EACN,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,aAAa,EACb,WAAW,EACX,eAAe,EACf,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,SAAS,EACT,oBAAoB,EACpB,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,UAAU,EACV,aAAa,GACd,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EACL,aAAa,EACb,WAAW,EACX,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,MAAM,EACN,SAAS,EACT,SAAS,GACV,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,cAAc,EACd,aAAa,EACb,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,aAAa,EACb,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,UAAU,EACV,SAAS,EACT,OAAO,GACR,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,UAAU,EACV,SAAS,EACT,UAAU,EACV,OAAO,EACP,WAAW,EACX,aAAa,EACb,UAAU,EACV,UAAU,EACV,UAAU,EACV,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,YAAY,EAAE,gBAAgB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAKxF,YAAY,EACV,UAAU,EACV,SAAS,EACT,KAAK,EACL,sBAAsB,EACtB,uBAAuB,EACvB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,OAAO,EACP,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACtD,cAAc,mBAAmB,CAAC;AAGlC,OAAO,KAAK,OAAO,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACnF,YAAY,EACV,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,UAAU,EACV,cAAc,EACd,eAAe,EACf,YAAY,GACb,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACzF,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC7E,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjE,YAAY,EACV,UAAU,EACV,aAAa,EACb,UAAU,EACV,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,OAAO,GACR,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACxF,YAAY,EACV,SAAS,EACT,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,SAAS,EACT,cAAc,EACd,SAAS,EACT,SAAS,EACT,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,aAAa,EACb,WAAW,EACX,MAAM,EACN,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,aAAa,EACb,WAAW,EACX,eAAe,EACf,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,SAAS,EACT,oBAAoB,EACpB,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,UAAU,EACV,aAAa,GACd,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EACL,aAAa,EACb,WAAW,EACX,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,MAAM,EACN,SAAS,EACT,SAAS,GACV,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,cAAc,EACd,aAAa,EACb,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,aAAa,EACb,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,UAAU,EACV,SAAS,EACT,OAAO,GACR,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,UAAU,EACV,SAAS,EACT,UAAU,EACV,OAAO,EACP,WAAW,EACX,aAAa,EACb,UAAU,EACV,UAAU,EACV,UAAU,EACV,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,YAAY,EAAE,gBAAgB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAK7D,YAAY,EACV,UAAU,EACV,SAAS,EACT,KAAK,EACL,sBAAsB,EACtB,uBAAuB,EACvB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,OAAO,EACP,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACtD,cAAc,mBAAmB,CAAC;AAGlC,OAAO,KAAK,OAAO,MAAM,0BAA0B,CAAC"}

package/dist/index.js

@@ -14,6 +14,7 @@ export { f29Formulario, f29Overview, f29Pdf, f29Status, F29_GRUPO_LABELS, F29_PD
 export { bteList, bteEmitPreview, bteEmit } from './tasks/bte.js';
 export { dteAuthorized, dteEmpresas, dteBorradorList, dteBorradorSave, dteBorradorDelete, dtePreviewPdf, dteEmitidos, dtePdf, TIPOS_DTE, MAX_ITEMS, } from './tasks/dte.js';
 export { peticionesList } from './tasks/peticiones.js';
+export { carpetaInstituciones } from './tasks/carpeta.js';
 // --- shared primitives ---
 export { Rut } from './rut/index.js';
 export { formatMoney, formatRut } from './format/index.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,gFAAgF;AAChF,6EAA6E;AAE7E,uCAAuC;AACvC,mFAAmF;AACnF,mGAAmG;AACnG,gDAAgD;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAQnF,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEzF,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE7E,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAUjE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAaxF,OAAO,EACL,aAAa,EACb,WAAW,EACX,MAAM,EACN,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAkBxB,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EACL,aAAa,EACb,WAAW,EACX,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,MAAM,EACN,SAAS,EACT,SAAS,GACV,MAAM,gBAAgB,CAAC;AA+BxB,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAmBvD,4BAA4B;AAC5B,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACtD,cAAc,mBAAmB,CAAC;AAElC,2EAA2E;AAC3E,OAAO,KAAK,OAAO,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,gFAAgF;AAChF,6EAA6E;AAE7E,uCAAuC;AACvC,mFAAmF;AACnF,mGAAmG;AACnG,gDAAgD;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAYnF,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEzF,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE7E,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAUjE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAaxF,OAAO,EACL,aAAa,EACb,WAAW,EACX,MAAM,EACN,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAkBxB,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EACL,aAAa,EACb,WAAW,EACX,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,MAAM,EACN,SAAS,EACT,SAAS,GACV,MAAM,gBAAgB,CAAC;AA+BxB,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAmB1D,4BAA4B;AAC5B,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACtD,cAAc,mBAAmB,CAAC;AAElC,2EAA2E;AAC3E,OAAO,KAAK,OAAO,MAAM,0BAA0B,CAAC"}

package/dist/node.d.ts

@@ -1,11 +1,15 @@
 import type { Runtime } from './seams/index.js';
 export { DOCUMENTOS_DIR, FileAuditSink, FileKeyValueStore, NodeFileSink, SII_DIR, SystemClock, } from './adapters/node/index.js';
 export { KeyringSecretStore } from './adapters/node/keyring.js';
+export { HttpPortalDriver } from './adapters/node/http.js';
 export { PlaywrightPortalDriver } from './adapters/node/portal.js';
 /** Composition root: the Node default adapters, any seam replaceable (ADR-016).
- *  e.g. `createNodeRuntime({ audit: myAuditSink })` keeps the other three defaults.
- *  The default portal is the Playwright driver — its `playwright` OPTIONAL peer is
- *  loaded lazily on first use, so composing (or overriding `portal`) never needs it.
+ *  e.g. `createNodeRuntime({ audit: myAuditSink })` keeps the other defaults.
+ *  The default `portal` is the browser-free HTTP driver (ADR-027); `browser` is the
+ *  Playwright engine, used only where SII's own page JS must run (BTE list, MIPYME) and
+ *  by the MCP's headed / www2 logins. Constructing the Playwright driver is free — its
+ *  `playwright` OPTIONAL peer loads lazily on the first browser call — so a runtime that
+ *  never touches JS never loads Chromium.
  *  `secrets` is DELIBERATELY not defaulted here: the OS keyring is wired by the CLI's
  *  composition root alone (`createNodeRuntime({ secrets: new KeyringSecretStore() })`),
  *  so the MCP server — which builds from this same function — carries no keyring at all

package/dist/node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,EACL,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,OAAO,EACP,WAAW,GACZ,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAEnE;;;;;;;2BAO2B;AAC3B,wBAAgB,iBAAiB,CAAC,SAAS,GAAE,OAAO,CAAC,OAAO,CAAM,GAAG,OAAO,CAS3E"}
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,EACL,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,OAAO,EACP,WAAW,GACZ,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAEnE;;;;;;;;;;2BAU2B;AAC3B,wBAAgB,iBAAiB,CAAC,SAAS,GAAE,OAAO,CAAC,OAAO,CAAM,GAAG,OAAO,CAU3E"}

package/dist/node.js

@@ -3,14 +3,19 @@
 // library's tasks/primitives never evaluates node:* or playwright — a consumer
 // that injects its own seams (ADR-003) stays free of them entirely.
 import { FileAuditSink, FileKeyValueStore, NodeFileSink, SystemClock, } from './adapters/node/index.js';
+import { HttpPortalDriver } from './adapters/node/http.js';
 import { PlaywrightPortalDriver } from './adapters/node/portal.js';
 export { DOCUMENTOS_DIR, FileAuditSink, FileKeyValueStore, NodeFileSink, SII_DIR, SystemClock, } from './adapters/node/index.js';
 export { KeyringSecretStore } from './adapters/node/keyring.js';
+export { HttpPortalDriver } from './adapters/node/http.js';
 export { PlaywrightPortalDriver } from './adapters/node/portal.js';
 /** Composition root: the Node default adapters, any seam replaceable (ADR-016).
- *  e.g. `createNodeRuntime({ audit: myAuditSink })` keeps the other three defaults.
- *  The default portal is the Playwright driver — its `playwright` OPTIONAL peer is
- *  loaded lazily on first use, so composing (or overriding `portal`) never needs it.
+ *  e.g. `createNodeRuntime({ audit: myAuditSink })` keeps the other defaults.
+ *  The default `portal` is the browser-free HTTP driver (ADR-027); `browser` is the
+ *  Playwright engine, used only where SII's own page JS must run (BTE list, MIPYME) and
+ *  by the MCP's headed / www2 logins. Constructing the Playwright driver is free — its
+ *  `playwright` OPTIONAL peer loads lazily on the first browser call — so a runtime that
+ *  never touches JS never loads Chromium.
  *  `secrets` is DELIBERATELY not defaulted here: the OS keyring is wired by the CLI's
  *  composition root alone (`createNodeRuntime({ secrets: new KeyringSecretStore() })`),
  *  so the MCP server — which builds from this same function — carries no keyring at all
@@ -20,7 +25,8 @@ export function createNodeRuntime(overrides = {}) {
         clock: new SystemClock(),
         audit: new FileAuditSink(),
         store: new FileKeyValueStore(),
-        portal: new PlaywrightPortalDriver(),
+        portal: new HttpPortalDriver(),
+        browser: new PlaywrightPortalDriver(),
         files: new NodeFileSink(),
         ...overrides,
     };

package/dist/node.js.map

@@ -1 +1 @@
-{"version":3,"file":"node.js","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,gFAAgF;AAChF,+EAA+E;AAC/E,oEAAoE;AACpE,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,WAAW,GACZ,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAGnE,OAAO,EACL,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,OAAO,EACP,WAAW,GACZ,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAEnE;;;;;;;2BAO2B;AAC3B,MAAM,UAAU,iBAAiB,CAAC,YAA8B,EAAE;IAChE,OAAO;QACL,KAAK,EAAE,IAAI,WAAW,EAAE;QACxB,KAAK,EAAE,IAAI,aAAa,EAAE;QAC1B,KAAK,EAAE,IAAI,iBAAiB,EAAE;QAC9B,MAAM,EAAE,IAAI,sBAAsB,EAAE;QACpC,KAAK,EAAE,IAAI,YAAY,EAAE;QACzB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC"}
+{"version":3,"file":"node.js","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,gFAAgF;AAChF,+EAA+E;AAC/E,oEAAoE;AACpE,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,WAAW,GACZ,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAGnE,OAAO,EACL,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,OAAO,EACP,WAAW,GACZ,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAEnE;;;;;;;;;;2BAU2B;AAC3B,MAAM,UAAU,iBAAiB,CAAC,YAA8B,EAAE;IAChE,OAAO;QACL,KAAK,EAAE,IAAI,WAAW,EAAE;QACxB,KAAK,EAAE,IAAI,aAAa,EAAE;QAC1B,KAAK,EAAE,IAAI,iBAAiB,EAAE;QAC9B,MAAM,EAAE,IAAI,gBAAgB,EAAE;QAC9B,OAAO,EAAE,IAAI,sBAAsB,EAAE;QACrC,KAAK,EAAE,IAAI,YAAY,EAAE;QACzB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC"}

package/dist/portal/carpeta-tributaria-regular.d.ts

@@ -0,0 +1,30 @@
+import type { Www2Session } from './www2-session.js';
+import type { PortalSession } from '../seams/index.js';
+/** A destination institution the Carpeta can be addressed to — SII's live catalog row, curated
+ *  (all 8 observed keys; a public registry of entities, no taxpayer data). `codigo` is the
+ *  `enfinCodigo` that `/generar` demands (#109); kept as a STRING because SII zero-pads some
+ *  (`"016"`, `"059"`) and not others (`"1005"`) and compares it verbatim. */
+export interface CarpetaInstitucion {
+    readonly codigo: string;
+    readonly descripcion: string | null;
+    readonly abreviacion: string | null;
+    /** SII's institution class (`enfinTipo`, observed 3 = corredora, 4 = otra; catalog-defined). */
+    readonly tipo: number | null;
+    /** The institution's own RUT (canonical), or null. Public entity data. */
+    readonly rut: string | null;
+    readonly vigenteDesde: string | null;
+    /** null = still vigente (observed on every row so far). */
+    readonly vigenteHasta: string | null;
+}
+/** `GET …/{userId}/…/instituciones` — SII's live list of destination institutions. `userId`
+ *  comes from `readWww2Session` (the SPA keys the path by it verbatim). Empty array = a
+ *  legitimate "no rows"; a non-array body = "scraper roto". */
+export declare function fetchInstituciones(session: PortalSession, app: Www2Session): Promise<readonly CarpetaInstitucion[]>;
+/** App-session read + `/instituciones` in one call: the read behind `sii carpeta instituciones`.
+ *  A multi-step flow (#109) reads the session ONCE and calls the `fetch*` steps itself. */
+export declare function listInstituciones(session: PortalSession): Promise<readonly CarpetaInstitucion[]>;
+/** Validate the user's `--institucion` against SII's LIVE list and return the matching row.
+ *  Fails BEFORE any `/generar` POST, naming the valid codes (like `--empresa` vs the MIPYME
+ *  chooser, ADR-023) — a stale code never costs a SII round-trip. The consumer is #109. */
+export declare function resolveInstitucion(codigo: string, instituciones: readonly CarpetaInstitucion[]): CarpetaInstitucion;
+//# sourceMappingURL=carpeta-tributaria-regular.d.ts.map

package/dist/portal/carpeta-tributaria-regular.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"carpeta-tributaria-regular.d.ts","sourceRoot":"","sources":["../../src/portal/carpeta-tributaria-regular.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAavD;;;6EAG6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,gGAAgG;IAChG,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,0EAA0E;IAC1E,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,2DAA2D;IAC3D,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AA+DD;;+DAE+D;AAC/D,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,WAAW,GACf,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CA0BxC;AAED;2FAC2F;AAC3F,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAGxC;AAED;;2FAE2F;AAC3F,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,SAAS,kBAAkB,EAAE,GAC3C,kBAAkB,CAapB"}

package/dist/portal/carpeta-tributaria-regular.js

@@ -0,0 +1,142 @@
+// Carpeta Tributaria Regular — typed facade over the `www2.sii.cl` `cte-api-carpetatributaria`
+// JSON facade (`PortalSession.requestJson`). First-hand-observed, no third-party library
+// (ADR-004); full wire contract + the auth-layer finding in docs/sii-contract/carpeta-tributaria.md.
+//
+// The SPA is `https://www2.sii.cl/carpetatributaria/generarcteregular`; its API lives under
+// `/app/cte-api-carpetatributaria/{userId}/recurso/v2/carpeta-tributaria/…`. Observed 2026-09-11
+// (#110), from the shipped bundles (`carpetatributaria/js/app.c2aeeb0d.js`, the shared session
+// library in `chunk-vendors.659f67b1.js`) and live probes:
+//
+//   1. THE APP SESSION. `www2.sii.cl/app/*` needs the www2 app session, a second cookies-only
+//      layer the classic jar does not carry (ADR-026) — read FIRST via the shared
+//      `portal/www2-session.ts`, whose `userId` keys every path below verbatim. Missing ⇒
+//      `Www2SessionError` (a NotAuthenticated), never a warm-up retry.
+//   2. (The session read and its observations live in `www2-session.ts`.)
+//   3. LIVE CATALOG. `/instituciones` is the ONLY source of a valid `enfinCodigo` (what `/generar`
+//      demands, #109). The codes drift — a hardcoded catalog went stale and SII rejected it — so
+//      this module never ships one: the user's choice is validated against SII's list at call
+//      time, like `--empresa` against the MIPYME chooser (ADR-023).
+//
+// Auth: SESSION-KEYED like F29 (ADR-005): the app session IS the principal; the task rejects a
+// representing pointer up front. PII: the institution rows are a public catalog — curated, no
+// `raw`. Nothing here touches the Carpeta document itself (#109, ADR-022 descriptor).
+import { z } from 'zod';
+import { HOSTS, WWW2_APP_CARPETA } from '../config/index.js';
+import { CarpetaError, NotAuthenticatedError } from '../errors/index.js';
+import { Rut } from '../rut/index.js';
+import { readWww2Session } from './www2-session.js';
+/** The SPA page ("Generar Carpeta Tributaria Regular"): the `Referer` the API expects and the
+ *  `originalUrl` the session read carries (observed 2026-09-11). Also the `--www2` login page. */
+const GENERAR_PAGE = WWW2_APP_CARPETA;
+const API = `${HOSTS.portalApp}/app/cte-api-carpetatributaria`;
+// The SPA's XHR headers (observed 2026-09-11): a JSON Accept + the page as Referer.
+const HEADERS = {
+    Accept: 'application/json, text/plain, */*',
+    Referer: GENERAR_PAGE,
+};
+// --- Wire shapes (zod-at-the-boundary, ADR-011) ---------------------------------------
+// `.loose()` rows: unobserved fields survive; projection is alias-tolerant (observed name
+// first — ADR-004). `/instituciones` answers a BARE JSON ARRAY (no SDI `respEstado` envelope —
+// this is the newer `cte-api`, not the www4 SDI facades).
+const Row = z.record(z.string(), z.unknown());
+const Instituciones = z.array(Row);
+// Observed 2026-09-12 on `/instituciones` (67 rows): `{enfinCodigo, enfinDescripcion,
+// enfinAbreviacion, enfinFechaVigDesde, enfinFechaVigHasta, enfinTipo, enfinRutInstitucion,
+// enfinDvInstitucion}` — the SPA itself reads `e.enfinCodigo` / `e.enfinAbreviacion`.
+const ALIASES = {
+    codigo: ['enfinCodigo', 'codigo'],
+    descripcion: ['enfinDescripcion', 'descripcion'],
+    abreviacion: ['enfinAbreviacion', 'abreviacion'],
+    tipo: ['enfinTipo', 'tipo'],
+    rutDigits: ['enfinRutInstitucion', 'rutInstitucion'],
+    dv: ['enfinDvInstitucion', 'dvInstitucion'],
+    vigenteDesde: ['enfinFechaVigDesde', 'fechaVigDesde'],
+    vigenteHasta: ['enfinFechaVigHasta', 'fechaVigHasta'],
+};
+function aliasGet(row, keys) {
+    for (const k of keys)
+        if (row[k] !== undefined && row[k] !== null)
+            return row[k];
+    return undefined;
+}
+const asStr = (v) => {
+    if (typeof v === 'string')
+        return v.trim() === '' ? null : v.trim();
+    if (typeof v === 'number')
+        return String(v);
+    return null;
+};
+const asInt = (v) => {
+    if (typeof v === 'number' && Number.isInteger(v))
+        return v;
+    if (typeof v === 'string' && /^\d+$/.test(v.trim()))
+        return Number(v.trim());
+    return null;
+};
+// `enfinRutInstitucion` (digits) + `enfinDvInstitucion` → canonical, Mod-11-checked; null if odd.
+const canonicalRutFrom = (digits, dv) => digits === undefined || dv === undefined
+    ? null
+    : (Rut.tryParse(`${String(digits)}-${String(dv).trim()}`)?.canonical ?? null);
+function curate(row) {
+    const codigo = asStr(aliasGet(row, ALIASES.codigo));
+    if (codigo === null) {
+        // A row without its key field means the shape moved: fail loud, never guess (ADR-004).
+        throw new CarpetaError('Scraper roto: una fila de /instituciones (Carpeta Tributaria) no trae `enfinCodigo`; ' +
+            'el SII cambió la forma de la lista.');
+    }
+    return {
+        codigo,
+        descripcion: asStr(aliasGet(row, ALIASES.descripcion)),
+        abreviacion: asStr(aliasGet(row, ALIASES.abreviacion)),
+        tipo: asInt(aliasGet(row, ALIASES.tipo)),
+        rut: canonicalRutFrom(aliasGet(row, ALIASES.rutDigits), aliasGet(row, ALIASES.dv)),
+        vigenteDesde: asStr(aliasGet(row, ALIASES.vigenteDesde)),
+        vigenteHasta: asStr(aliasGet(row, ALIASES.vigenteHasta)),
+    };
+}
+/** `GET …/{userId}/…/instituciones` — SII's live list of destination institutions. `userId`
+ *  comes from `readWww2Session` (the SPA keys the path by it verbatim). Empty array = a
+ *  legitimate "no rows"; a non-array body = "scraper roto". */
+export async function fetchInstituciones(session, app) {
+    let raw;
+    try {
+        raw = await session.requestJson(`${API}/${encodeURIComponent(app.userId)}/recurso/v2/carpeta-tributaria/instituciones`, { method: 'GET', headers: HEADERS });
+    }
+    catch (e) {
+        // A dead session is an ACTIONABLE NotAuthenticated (the seam detects the login wall) — let
+        // it through verbatim. Anything else (a 401 body, the wrong endpoint) is a typed CarpetaError
+        // carrying the seam's verbatim detail (ADR-004), never a raw Playwright error.
+        if (e instanceof NotAuthenticatedError)
+            throw e;
+        throw new CarpetaError(`Respuesta inesperada del SII en /instituciones (Carpeta Tributaria): ${e instanceof Error ? e.message : String(e)}`);
+    }
+    const parsed = Instituciones.safeParse(raw);
+    if (!parsed.success) {
+        throw new CarpetaError('Scraper roto: /instituciones (Carpeta Tributaria) no devolvió un arreglo JSON de ' +
+            'instituciones; el SII cambió la forma de la lista.');
+    }
+    return parsed.data.map(curate);
+}
+/** App-session read + `/instituciones` in one call: the read behind `sii carpeta instituciones`.
+ *  A multi-step flow (#109) reads the session ONCE and calls the `fetch*` steps itself. */
+export async function listInstituciones(session) {
+    const app = await readWww2Session(session, GENERAR_PAGE);
+    return fetchInstituciones(session, app);
+}
+/** Validate the user's `--institucion` against SII's LIVE list and return the matching row.
+ *  Fails BEFORE any `/generar` POST, naming the valid codes (like `--empresa` vs the MIPYME
+ *  chooser, ADR-023) — a stale code never costs a SII round-trip. The consumer is #109. */
+export function resolveInstitucion(codigo, instituciones) {
+    const wanted = codigo.trim();
+    const hit = instituciones.find((i) => i.codigo === wanted);
+    if (hit)
+        return hit;
+    const opciones = instituciones
+        .map((i) => `${i.codigo}${i.abreviacion ? ` (${i.abreviacion})` : ''}`)
+        .join(', ');
+    throw new CarpetaError(`La institución "${wanted}" no está en la lista vigente del SII para la Carpeta Tributaria. ` +
+        (instituciones.length === 0
+            ? 'El SII no devolvió instituciones.'
+            : `Códigos válidos (sii carpeta instituciones): ${opciones}.`));
+}
+//# sourceMappingURL=carpeta-tributaria-regular.js.map

package/dist/portal/carpeta-tributaria-regular.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"carpeta-tributaria-regular.js","sourceRoot":"","sources":["../../src/portal/carpeta-tributaria-regular.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,yFAAyF;AACzF,qGAAqG;AACrG,EAAE;AACF,4FAA4F;AAC5F,iGAAiG;AACjG,+FAA+F;AAC/F,2DAA2D;AAC3D,EAAE;AACF,8FAA8F;AAC9F,kFAAkF;AAClF,0FAA0F;AAC1F,uEAAuE;AACvE,0EAA0E;AAC1E,mGAAmG;AACnG,iGAAiG;AACjG,8FAA8F;AAC9F,oEAAoE;AACpE,EAAE;AACF,+FAA+F;AAC/F,8FAA8F;AAC9F,sFAAsF;AACtF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAIpD;kGACkG;AAClG,MAAM,YAAY,GAAG,gBAAgB,CAAC;AACtC,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,SAAS,gCAAgC,CAAC;AAE/D,oFAAoF;AACpF,MAAM,OAAO,GAA2B;IACtC,MAAM,EAAE,mCAAmC;IAC3C,OAAO,EAAE,YAAY;CACtB,CAAC;AAmBF,yFAAyF;AACzF,0FAA0F;AAC1F,+FAA+F;AAC/F,0DAA0D;AAC1D,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAC9C,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAEnC,sFAAsF;AACtF,4FAA4F;AAC5F,sFAAsF;AACtF,MAAM,OAAO,GAAG;IACd,MAAM,EAAE,CAAC,aAAa,EAAE,QAAQ,CAAC;IACjC,WAAW,EAAE,CAAC,kBAAkB,EAAE,aAAa,CAAC;IAChD,WAAW,EAAE,CAAC,kBAAkB,EAAE,aAAa,CAAC;IAChD,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,CAAC,qBAAqB,EAAE,gBAAgB,CAAC;IACpD,EAAE,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;IAC3C,YAAY,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;IACrD,YAAY,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;CAC7C,CAAC;AAEX,SAAS,QAAQ,CAAC,GAA4B,EAAE,IAAuB;IACrE,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,SAAS,CAAC;AACnB,CAAC;AACD,MAAM,KAAK,GAAG,CAAC,CAAU,EAAiB,EAAE;IAC1C,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpE,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AACF,MAAM,KAAK,GAAG,CAAC,CAAU,EAAiB,EAAE;IAC1C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AACF,kGAAkG;AAClG,MAAM,gBAAgB,GAAG,CAAC,MAAe,EAAE,EAAW,EAAiB,EAAE,CACvE,MAAM,KAAK,SAAS,IAAI,EAAE,KAAK,SAAS;IACtC,CAAC,CAAC,IAAI;IACN,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC;AAElF,SAAS,MAAM,CAAC,GAA4B;IAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,uFAAuF;QACvF,MAAM,IAAI,YAAY,CACpB,uFAAuF;YACrF,qCAAqC,CACxC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM;QACN,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QACtD,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACxC,GAAG,EAAE,gBAAgB,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAClF,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QACxD,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;KACzD,CAAC;AACJ,CAAC;AAED;;+DAE+D;AAC/D,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAsB,EACtB,GAAgB;IAEhB,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,OAAO,CAAC,WAAW,CAC7B,GAAG,GAAG,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,8CAA8C,EACtF,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CACpC,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,2FAA2F;QAC3F,8FAA8F;QAC9F,+EAA+E;QAC/E,IAAI,CAAC,YAAY,qBAAqB;YAAE,MAAM,CAAC,CAAC;QAChD,MAAM,IAAI,YAAY,CACpB,wEACE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAC3C,EAAE,CACH,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,YAAY,CACpB,mFAAmF;YACjF,oDAAoD,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACjC,CAAC;AAED;2FAC2F;AAC3F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAsB;IAEtB,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACzD,OAAO,kBAAkB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED;;2FAE2F;AAC3F,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,aAA4C;IAE5C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAC3D,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IACpB,MAAM,QAAQ,GAAG,aAAa;SAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;SACtE,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,IAAI,YAAY,CACpB,mBAAmB,MAAM,oEAAoE;QAC3F,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;YACzB,CAAC,CAAC,mCAAmC;YACrC,CAAC,CAAC,gDAAgD,QAAQ,GAAG,CAAC,CACnE,CAAC;AACJ,CAAC"}

package/dist/portal/www2-session.d.ts

@@ -0,0 +1,13 @@
+import type { PortalSession } from '../seams/index.js';
+/** The www2 app session as `/app/session/status` describes it. Only `userId` is load-bearing
+ *  (it keys every `/app/<name>-api` path); the rest is kept for diagnostics. */
+export interface Www2Session {
+    readonly userId: string;
+    readonly userAuthType: string | null;
+}
+/** Read the www2 app session (see the header). Resolves `{userId}` when one exists; raises the
+ *  ACTIONABLE `Www2SessionError` (a `NotAuthenticated`) when www2 answers anything but a 200
+ *  session JSON — the classic session alone never reaches this layer. `originalUrl` is the app
+ *  page the SPA would pass (observed optional; the answer is the same without it). Never retried. */
+export declare function readWww2Session(session: PortalSession, originalUrl?: string): Promise<Www2Session>;
+//# sourceMappingURL=www2-session.d.ts.map

package/dist/portal/www2-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"www2-session.d.ts","sourceRoot":"","sources":["../../src/portal/www2-session.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAIvD;gFACgF;AAChF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAKD;;;qGAGqG;AACrG,wBAAsB,eAAe,CACnC,OAAO,EAAE,aAAa,EACtB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,WAAW,CAAC,CAmCtB"}

package/dist/portal/www2-session.js

@@ -0,0 +1,61 @@
+// The www2 APP SESSION — the second cookies-only layer every `www2.sii.cl/app/*` facade needs
+// (ADR-026). Shared by all www2 apps (first: Carpeta Tributaria, `carpeta-tributaria-regular.ts`),
+// so a new app reuses this read instead of inventing a per-app warm-up.
+//
+// Observed 2026-09-11/12 (#110; docs/sii-contract/carpeta-tributaria.md): the classic `.sii.cl`
+// cookies the cookies-only login holds reach www1/www3/www4/loa but NOT `/app/<name>-api/*` — those
+// answer a bare 401 until the OAuth2 flow (`/app/session/login` → `/oauthsii-v1/` → `/app/session/
+// create`) minted the httpOnly `.sii.cl` pair `X-SII-STATE-CT` + `X-SII-STATE-TYPE` (~100 min). The
+// SPA's own liveness read is `GET /app/session/status` (session library `j()`): 200 → JSON
+// `{seconds, userId, userProfiles, userAuthType, authTime, userRte}` committed to vuex; anything
+// else → no session (the SPA then bounces to `/bifurcacion`). Every app keys its API paths by
+// `session.userId` VERBATIM (the canonical `<body>-<dv>` RUT, observed) — so this read is where a
+// facade gets its path key; it never formats a RUT for it.
+//
+// Reached via `requestText`: a non-JSON 401 body is EXPECTED here, and a dead classic jar is still
+// caught URL-based (the `LOGIN_HOST` bounce → `SessionExpiredError`).
+import { z } from 'zod';
+import { HOSTS } from '../config/index.js';
+import { Www2SessionError } from '../errors/index.js';
+const SESSION_STATUS_URL = `${HOSTS.portalApp}/app/session/status`;
+// Observed 2026-09-12 (live app session). `.loose()`: the other fields ride along unvalidated.
+const SessionJson = z.object({ userId: z.union([z.string(), z.number()]) }).loose();
+/** Read the www2 app session (see the header). Resolves `{userId}` when one exists; raises the
+ *  ACTIONABLE `Www2SessionError` (a `NotAuthenticated`) when www2 answers anything but a 200
+ *  session JSON — the classic session alone never reaches this layer. `originalUrl` is the app
+ *  page the SPA would pass (observed optional; the answer is the same without it). Never retried. */
+export async function readWww2Session(session, originalUrl) {
+    const url = originalUrl === undefined
+        ? SESSION_STATUS_URL
+        : `${SESSION_STATUS_URL}?originalUrl=${encodeURIComponent(originalUrl)}`;
+    const res = await session.requestText(url, {
+        method: 'GET',
+        headers: {
+            Accept: 'application/json, text/plain, */*',
+            ...(originalUrl === undefined ? {} : { Referer: originalUrl }),
+        },
+    });
+    let parsed = null;
+    if (res.status === 200) {
+        try {
+            parsed = JSON.parse(res.body);
+        }
+        catch {
+            parsed = null; // the SPA shell HTML (a 200 on a cold hit) is "no session" too
+        }
+    }
+    const app = parsed === null ? null : SessionJson.safeParse(parsed);
+    if (!app || !app.success) {
+        throw new Www2SessionError('No hay sesión en la plataforma www2 del SII (www2.sii.cl/app/*), que autoriza con una ' +
+            'sesión propia (login OAuth) y no con la sesión de Mi SII que esta herramienta guarda ' +
+            `(HTTP ${res.status}${res.status === 200 ? ' sin JSON de sesión' : ''} en ` +
+            '/app/session/status). Iniciarla aún no está soportado — ADR-026 la define como un ' +
+            'segundo login en el navegador (`sii auth login --www2`, pendiente).');
+    }
+    const authType = app.data['userAuthType'];
+    return {
+        userId: String(app.data.userId),
+        userAuthType: typeof authType === 'string' ? authType : null,
+    };
+}
+//# sourceMappingURL=www2-session.js.map

package/dist/portal/www2-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"www2-session.js","sourceRoot":"","sources":["../../src/portal/www2-session.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,mGAAmG;AACnG,wEAAwE;AACxE,EAAE;AACF,gGAAgG;AAChG,oGAAoG;AACpG,mGAAmG;AACnG,oGAAoG;AACpG,2FAA2F;AAC3F,iGAAiG;AACjG,8FAA8F;AAC9F,kGAAkG;AAClG,2DAA2D;AAC3D,EAAE;AACF,mGAAmG;AACnG,sEAAsE;AACtE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAGtD,MAAM,kBAAkB,GAAG,GAAG,KAAK,CAAC,SAAS,qBAAqB,CAAC;AASnE,+FAA+F;AAC/F,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;AAEpF;;;qGAGqG;AACrG,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAsB,EACtB,WAAoB;IAEpB,MAAM,GAAG,GACP,WAAW,KAAK,SAAS;QACvB,CAAC,CAAC,kBAAkB;QACpB,CAAC,CAAC,GAAG,kBAAkB,gBAAgB,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;IAC7E,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE;QACzC,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,MAAM,EAAE,mCAAmC;YAC3C,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;SAC/D;KACF,CAAC,CAAC;IACH,IAAI,MAAM,GAAY,IAAI,CAAC;IAC3B,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAY,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,IAAI,CAAC,CAAC,+DAA+D;QAChF,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACnE,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACzB,MAAM,IAAI,gBAAgB,CACxB,wFAAwF;YACtF,uFAAuF;YACvF,SAAS,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,MAAM;YAC3E,oFAAoF;YACpF,qEAAqE,CACxE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC1C,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;QAC/B,YAAY,EAAE,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;KAC7D,CAAC;AACJ,CAAC"}

package/dist/seams/index.d.ts

@@ -184,5 +184,12 @@ export interface Runtime {
      *  never by the MCP server's, so that surface has no keyring BY CONSTRUCTION and not
      *  by "no code happens to call it" (ADR-006 / ADR-025). */
     readonly secrets?: SecretReader;
+    /** OPTIONAL JS engine (the lazy Playwright driver). The default `portal` is the browser-free
+     *  HTTP driver (ADR-027); a surface that must run SII's OWN page JS (BTE inline maps, MIPYME
+     *  `validaFacEx`) acquires this via `withSession(…, { engine: 'browser' })`, and the headed /
+     *  www2 logins (MCP-only) use it directly. Absent ⇒ those paths raise `BrowserRequiredError`.
+     *  `createNodeRuntime` wires the Playwright driver here; constructing it is free (it lazy-loads
+     *  Chromium only on first browser call), so a runtime that never needs JS never loads it. */
+    readonly browser?: PortalDriver;
 }
 //# sourceMappingURL=index.d.ts.map