@deuriib/better-dgii-ecf 0.0.0-stage → 0.0.0

package/dist/index.cjs

@@ -0,0 +1,1337 @@
+'use strict';
+
+var api = require('better-auth/api');
+var error = require('@better-auth/core/error');
+var dgiiEcf$1 = require('@deuriib/dgii-ecf');
+var errorCodes = require('@better-auth/core/utils/error-codes');
+var crypto = require('crypto');
+var z = require('zod');
+
+function _interopNamespace(e) {
+  if (e && e.__esModule) return e;
+  var n = Object.create(null);
+  if (e) {
+    Object.keys(e).forEach(function (k) {
+      if (k !== 'default') {
+        var d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: function () { return e[k]; }
+        });
+      }
+    });
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
+
+var z__namespace = /*#__PURE__*/_interopNamespace(z);
+
+// src/client-provider.ts
+var DGII_ECF_ERROR_CODES = errorCodes.defineErrorCodes({
+  DGII_SESSION_REQUIRED: "A session is required to call a DGII e-CF endpoint",
+  DGII_TAXPAYER_ID_REQUIRED: "No taxpayer id (RNC) could be resolved: send `taxPayerId`, set the organization field, or configure `resolveTaxPayerId`",
+  DGII_TAXPAYER_ID_INVALID: "The taxpayer id is not a valid DGII RNC (9 digits) or c\xE9dula (11 digits)",
+  DGII_TAXPAYER_ID_MISMATCH: "The signed document was issued under a taxpayer id other than the one resolved for this request",
+  DGII_TAXPAYER_ID_FORBIDDEN: "This session is not allowed to act on behalf of the requested taxpayer id",
+  DGII_ORGANIZATION_NOT_FOUND: "The organization in scope was not found",
+  DGII_ORGANIZATION_REQUIRED: "This request needs an organization: send `organizationId` or select an active organization",
+  DGII_NOT_A_MEMBER: "The session user is not a member of the organization in scope",
+  DGII_INSUFFICIENT_ROLE: "The session user does not hold a role allowed to perform this DGII operation",
+  DGII_CREDENTIALS_UNAVAILABLE: "No DGII credentials could be resolved for this taxpayer id",
+  DGII_CLIENT_NOT_CONFIGURED: "The plugin was configured without `credentials` or `getClient`, so it cannot reach DGII",
+  DGII_STATUS_API_KEY_REQUIRED: "The DGII status service needs an API key: configure `status.apiKey`",
+  DGII_DOCUMENT_UNREADABLE: "The signed document carries no issuer taxpayer id (RNCEmisor / RncEmisor)",
+  DGII_SIGNING_FAILED: "The document could not be signed with the organization key",
+  DGII_REQUEST_FAILED: "The DGII request failed",
+  DGII_SUBMISSION_NOT_FOUND: "No stored submission matches this id",
+  DGII_PERSISTENCE_UNAVAILABLE: "Submission persistence is disabled, so this operation is unavailable",
+  DGII_IDEMPOTENCY_IN_FLIGHT: "A submission with this idempotency key is still in flight or has an unknown outcome; reconcile it before retrying"
+});
+var STATUS_BY_DGII_CODE = {
+  INVALID_XML: "BAD_REQUEST",
+  SIGNING: "BAD_REQUEST",
+  VALIDATION: "BAD_REQUEST",
+  CERTIFICATE: "INTERNAL_SERVER_ERROR",
+  IDEMPOTENCY: "CONFLICT",
+  AUTH: "BAD_GATEWAY",
+  HTTP: "BAD_GATEWAY",
+  TIMEOUT: "BAD_GATEWAY",
+  CIRCUIT_OPEN: "BAD_GATEWAY",
+  UNKNOWN: "BAD_GATEWAY"
+};
+var toFailureDetail = (error) => ({
+  code: error.code,
+  status: error.status,
+  statusText: error.statusText,
+  resource: error.resource,
+  method: error.method,
+  mensajes: error.mensajes
+});
+var badRequest = (error, message) => new api.APIError("BAD_REQUEST", {
+  message: message ?? error.message,
+  code: error.code
+});
+var forbidden = (error, message) => new api.APIError("FORBIDDEN", {
+  message: message ?? error.message,
+  code: error.code
+});
+var conflict = (error, message) => new api.APIError("CONFLICT", {
+  message: message ?? error.message,
+  code: error.code
+});
+var serverError = (error, message) => new api.APIError("INTERNAL_SERVER_ERROR", {
+  message: message ?? error.message,
+  code: error.code
+});
+var toApiError = (error) => new api.APIError(STATUS_BY_DGII_CODE[error.code], {
+  message: error.message,
+  code: DGII_ECF_ERROR_CODES.DGII_REQUEST_FAILED.code,
+  dgii: toFailureDetail(error)
+});
+
+// src/client-provider.ts
+var DEFAULT_MAX_SIZE = 50;
+var DEFAULT_TTL_MS = 10 * 60 * 1e3;
+var cacheKey = (scope) => `${scope.environment}\0${scope.taxPayerId}`;
+var unavailable = (taxPayerId) => new api.APIError("INTERNAL_SERVER_ERROR", {
+  message: `No DGII credentials were resolved for taxpayer ${taxPayerId}`,
+  code: DGII_ECF_ERROR_CODES.DGII_CREDENTIALS_UNAVAILABLE.code
+});
+var createClientProvider = (options, now = Date.now) => {
+  const getClient = options.getClient;
+  if (getClient !== void 0) {
+    return {
+      async get(scope) {
+        const client = await getClient(scope);
+        if (client === null) {
+          throw unavailable(scope.taxPayerId);
+        }
+        return client;
+      },
+      invalidate() {
+      },
+      size: 0,
+      constructsClients: false
+    };
+  }
+  const resolveCredentials = options.credentials;
+  if (resolveCredentials === void 0) {
+    throw new error.BetterAuthError(
+      "[better-dgii-ecf] Configure `credentials` or `getClient` \u2014 the plugin cannot reach DGII without one of them."
+    );
+  }
+  const maxSize = Math.max(1, options.clientCache?.maxSize ?? DEFAULT_MAX_SIZE);
+  const ttlMs = Math.max(0, options.clientCache?.ttlMs ?? DEFAULT_TTL_MS);
+  const cache = /* @__PURE__ */ new Map();
+  const evictExpired = (at) => {
+    for (const [key, entry] of cache) {
+      if (entry.expiresAt <= at) {
+        cache.delete(key);
+      }
+    }
+  };
+  return {
+    async get(scope) {
+      const at = now();
+      evictExpired(at);
+      const key = cacheKey(scope);
+      const cached = cache.get(key);
+      if (cached !== void 0 && cached.expiresAt > at) {
+        cache.delete(key);
+        cache.set(key, cached);
+        return cached.client;
+      }
+      const material = await resolveCredentials(scope);
+      if (material === null) {
+        throw unavailable(scope.taxPayerId);
+      }
+      if (material.key === void 0 || material.cert === void 0) {
+        throw new api.APIError("INTERNAL_SERVER_ERROR", {
+          message: `The credentials resolved for taxpayer ${scope.taxPayerId} carry no key/cert PEM pair`,
+          code: DGII_ECF_ERROR_CODES.DGII_CREDENTIALS_UNAVAILABLE.code
+        });
+      }
+      const statusApiKey = options.status?.apiKey;
+      const client = new dgiiEcf$1.ECF(material, scope.environment, {
+        ...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs },
+        ...statusApiKey === void 0 ? {} : { statusApiKey }
+      });
+      if (ttlMs > 0) {
+        while (cache.size >= maxSize) {
+          const oldest = cache.keys().next();
+          if (oldest.done === true) {
+            break;
+          }
+          cache.delete(oldest.value);
+        }
+        cache.set(key, { client, expiresAt: at + ttlMs });
+      }
+      return client;
+    },
+    invalidate(taxPayerId) {
+      if (taxPayerId === void 0) {
+        cache.clear();
+        return;
+      }
+      for (const key of cache.keys()) {
+        if (key.endsWith(`\0${taxPayerId}`)) {
+          cache.delete(key);
+        }
+      }
+    },
+    get size() {
+      return cache.size;
+    },
+    constructsClients: true
+  };
+};
+var SUBMISSION_MODEL = "dgiiEcfSubmission";
+var DEFAULT_MAX_RESPONSE_LENGTH = 8192;
+var hashDocument = (xml) => crypto.createHash("sha256").update(xml, "utf8").digest("hex");
+var serializeResponse = (value, maxLength) => {
+  if (value === void 0 || value === null) {
+    return null;
+  }
+  let serialized;
+  try {
+    serialized = JSON.stringify(value);
+  } catch {
+    return null;
+  }
+  if (serialized === void 0) {
+    return null;
+  }
+  return serialized.length > maxLength ? serialized.slice(0, maxLength) : serialized;
+};
+var disabledStore = {
+  enabled: false,
+  async findReplay() {
+    return null;
+  },
+  async begin() {
+    return null;
+  },
+  async complete() {
+  },
+  async list() {
+    throw new api.APIError("NOT_IMPLEMENTED", {
+      message: DGII_ECF_ERROR_CODES.DGII_PERSISTENCE_UNAVAILABLE.message,
+      code: DGII_ECF_ERROR_CODES.DGII_PERSISTENCE_UNAVAILABLE.code
+    });
+  }
+};
+var createSubmissionStore = (ctx, options) => {
+  if (options?.enabled === false) {
+    return disabledStore;
+  }
+  const adapter = ctx.context.adapter;
+  const storeResponses = options?.storeResponses ?? true;
+  const maxResponseLength = options?.maxResponseLength ?? DEFAULT_MAX_RESPONSE_LENGTH;
+  return {
+    enabled: true,
+    async findReplay(taxPayerId, idempotencyKey) {
+      const rows = await adapter.findMany({
+        model: SUBMISSION_MODEL,
+        where: [
+          { field: "taxPayerId", value: taxPayerId },
+          { field: "idempotencyKey", value: idempotencyKey }
+        ],
+        limit: 1,
+        sortBy: { field: "createdAt", direction: "desc" }
+      });
+      return rows[0] ?? null;
+    },
+    async begin(input) {
+      const created = await adapter.create({
+        model: SUBMISSION_MODEL,
+        data: {
+          organizationId: input.organizationId,
+          taxPayerId: input.taxPayerId,
+          userId: input.userId,
+          environment: input.environment,
+          operation: input.operation,
+          status: "pending",
+          idempotencyKey: input.idempotencyKey,
+          encf: input.encf,
+          trackId: null,
+          documentHash: input.documentHash,
+          errorCode: null,
+          response: null
+        }
+      });
+      return created.id;
+    },
+    async complete(id, outcome) {
+      if (id === null) {
+        return;
+      }
+      await adapter.update({
+        model: SUBMISSION_MODEL,
+        where: [{ field: "id", value: id }],
+        update: {
+          status: outcome.status,
+          trackId: outcome.trackId ?? null,
+          errorCode: outcome.errorCode ?? null,
+          response: storeResponses ? serializeResponse(outcome.response, maxResponseLength) : null
+        }
+      });
+    },
+    async list({ organizationId, taxPayerId, limit }) {
+      const where = [];
+      if (organizationId !== null) {
+        where.push({ field: "organizationId", value: organizationId });
+      }
+      if (taxPayerId !== null) {
+        where.push({ field: "taxPayerId", value: taxPayerId });
+      }
+      return adapter.findMany({
+        model: SUBMISSION_MODEL,
+        ...where.length > 0 ? { where } : {},
+        limit,
+        sortBy: { field: "createdAt", direction: "desc" }
+      });
+    }
+  };
+};
+var planReplay = (record) => {
+  if (record === null) {
+    return { kind: "proceed" };
+  }
+  if (record.status === "succeeded") {
+    return { kind: "replay", record };
+  }
+  if (record.status === "pending") {
+    return { kind: "conflict" };
+  }
+  return { kind: "proceed" };
+};
+var parseStoredResponse = (record) => {
+  const raw = record.response;
+  if (typeof raw !== "string" || raw === "") {
+    return null;
+  }
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+};
+
+// src/tax-payer.ts
+var SEPARATORS = /[\s.\-–—]/g;
+var SHAPE = /^(?:\d{9}|\d{11})$/;
+var normalizeTaxPayerId = (value) => value.replace(SEPARATORS, "").trim();
+var isTaxPayerIdShape = (value) => SHAPE.test(value);
+var TaxPayerIdError = class extends Error {
+  reason;
+  constructor(reason, message) {
+    super(message);
+    this.name = "TaxPayerIdError";
+    this.reason = reason;
+  }
+};
+var applyTaxPayerIdValidation = async (raw, validation) => {
+  const normalized = normalizeTaxPayerId(raw);
+  if (normalized === "") {
+    throw new TaxPayerIdError("shape", "The taxpayer id is empty");
+  }
+  if (validation === "off") {
+    return normalized;
+  }
+  if (validation === "format") {
+    if (!isTaxPayerIdShape(normalized)) {
+      throw new TaxPayerIdError(
+        "shape",
+        `"${raw}" is not a DGII RNC (9 digits) or c\xE9dula (11 digits)`
+      );
+    }
+    return normalized;
+  }
+  const verdict = await validation(normalized);
+  if (verdict === false) {
+    throw new TaxPayerIdError("custom", `"${raw}" was rejected by the validator`);
+  }
+  if (typeof verdict === "string") {
+    return normalizeTaxPayerId(verdict);
+  }
+  return normalized;
+};
+
+// src/resolution.ts
+var ORGANIZATION_MODEL = "organization";
+var MEMBER_MODEL = "member";
+var DEFAULT_ROLES = ["owner", "admin"];
+var hasOrganizationPlugin = (ctx) => (ctx.context.options.plugins ?? []).some((plugin) => plugin.id === "organization");
+var readOrganizationField = (row, field) => {
+  const raw = row[field] ?? row.taxPayerId ?? row.tax_payer_id;
+  if (typeof raw !== "string") {
+    return null;
+  }
+  const normalized = normalizeTaxPayerId(raw);
+  return normalized === "" ? null : normalized;
+};
+var readActiveOrganizationId = (session) => {
+  const raw = session.activeOrganizationId;
+  return typeof raw === "string" && raw !== "" ? raw : null;
+};
+var rolesOf = (member) => String(member.role ?? "").split(",").map((role) => role.trim()).filter((role) => role !== "");
+var environmentOf = async (options, scope) => {
+  const configured = options.environment ?? dgiiEcf$1.Environment.Dev;
+  if (typeof configured === "function") {
+    return configured({
+      taxPayerId: scope.taxPayerId,
+      organizationId: scope.organizationId,
+      userId: scope.user.id
+    });
+  }
+  return configured;
+};
+var resolveRequestScope = async ({
+  ctx,
+  options,
+  input
+}) => {
+  const authenticated = ctx.context.session;
+  if (authenticated === null) {
+    throw new api.APIError("UNAUTHORIZED", {
+      message: DGII_ECF_ERROR_CODES.DGII_SESSION_REQUIRED.message,
+      code: DGII_ECF_ERROR_CODES.DGII_SESSION_REQUIRED.code
+    });
+  }
+  const { user, session } = authenticated;
+  const withOrganization = hasOrganizationPlugin(ctx);
+  const organizationId = input.organizationId ?? (withOrganization ? readActiveOrganizationId(session) : null);
+  let organization = null;
+  let organizationTaxPayerId = null;
+  if (withOrganization && organizationId !== null) {
+    organization = await ctx.context.adapter.findOne({
+      model: ORGANIZATION_MODEL,
+      where: [{ field: "id", value: organizationId }]
+    });
+    if (organization === null) {
+      throw new api.APIError("NOT_FOUND", {
+        message: DGII_ECF_ERROR_CODES.DGII_ORGANIZATION_NOT_FOUND.message,
+        code: DGII_ECF_ERROR_CODES.DGII_ORGANIZATION_NOT_FOUND.code
+      });
+    }
+    organizationTaxPayerId = readOrganizationField(
+      organization,
+      options.organization?.field ?? "taxPayerId"
+    );
+  }
+  const validation = options.validateTaxPayerId ?? "format";
+  const toCanonical = async (raw) => {
+    try {
+      return await applyTaxPayerIdValidation(raw, validation);
+    } catch (error) {
+      if (error instanceof TaxPayerIdError) {
+        throw badRequest(DGII_ECF_ERROR_CODES.DGII_TAXPAYER_ID_INVALID, error.message);
+      }
+      throw error;
+    }
+  };
+  let taxPayerId = null;
+  let source = "request";
+  if (input.taxPayerId !== void 0) {
+    taxPayerId = await toCanonical(input.taxPayerId);
+  } else if (organizationTaxPayerId !== null) {
+    taxPayerId = await toCanonical(organizationTaxPayerId);
+    source = "organization";
+  } else {
+    const resolver = options.resolveTaxPayerId;
+    const fromResolver = resolver === void 0 ? null : await resolver({ user, session, organizationId });
+    if (fromResolver !== null) {
+      taxPayerId = await toCanonical(fromResolver);
+      source = "resolver";
+    }
+  }
+  if (taxPayerId === null) {
+    throw badRequest(DGII_ECF_ERROR_CODES.DGII_TAXPAYER_ID_REQUIRED);
+  }
+  await authorize({
+    ctx,
+    options,
+    user,
+    session,
+    taxPayerId,
+    organizationId: withOrganization ? organizationId : null,
+    organization,
+    organizationTaxPayerId,
+    source,
+    withOrganization
+  });
+  const resolved = {
+    taxPayerId,
+    organizationId: withOrganization ? organizationId : null,
+    organizationTaxPayerId,
+    source,
+    userId: user.id,
+    user,
+    session
+  };
+  return { ...resolved, environment: await environmentOf(options, resolved) };
+};
+var authorize = async (input) => {
+  const custom = input.options.authorize;
+  if (custom !== void 0) {
+    const allowed = await custom({
+      user: input.user,
+      session: input.session,
+      taxPayerId: input.taxPayerId,
+      organizationId: input.organizationId,
+      organizationTaxPayerId: input.organizationTaxPayerId,
+      source: input.source
+    });
+    if (!allowed) {
+      throw forbidden(DGII_ECF_ERROR_CODES.DGII_TAXPAYER_ID_FORBIDDEN);
+    }
+    return;
+  }
+  if (!input.withOrganization) {
+    return;
+  }
+  if (input.organizationId === null || input.organization === null) {
+    if (input.source === "request" && input.options.allowUntrustedTaxPayerId === true) {
+      return;
+    }
+    if (input.source === "resolver") {
+      return;
+    }
+    throw badRequest(DGII_ECF_ERROR_CODES.DGII_ORGANIZATION_REQUIRED);
+  }
+  const member = await input.ctx.context.adapter.findOne({
+    model: MEMBER_MODEL,
+    where: [
+      { field: "organizationId", value: input.organizationId },
+      { field: "userId", value: input.user.id }
+    ]
+  });
+  if (member === null) {
+    throw forbidden(DGII_ECF_ERROR_CODES.DGII_NOT_A_MEMBER);
+  }
+  const allowedRoles = input.options.roles ?? DEFAULT_ROLES;
+  const memberRoles = rolesOf(member);
+  if (!memberRoles.some((role) => allowedRoles.includes(role))) {
+    throw forbidden(
+      DGII_ECF_ERROR_CODES.DGII_INSUFFICIENT_ROLE,
+      `${DGII_ECF_ERROR_CODES.DGII_INSUFFICIENT_ROLE.message} (required one of: ${allowedRoles.join(", ")})`
+    );
+  }
+  if (input.organizationTaxPayerId !== null && input.organizationTaxPayerId !== input.taxPayerId) {
+    throw forbidden(
+      DGII_ECF_ERROR_CODES.DGII_TAXPAYER_ID_FORBIDDEN,
+      `Organization ${input.organizationId} issues under ${input.organizationTaxPayerId}, not ${input.taxPayerId}`
+    );
+  }
+};
+
+// src/xml.ts
+var PATTERN_CACHE = /* @__PURE__ */ new Map();
+var ATTRIBUTE_SPAN = `(?:[^>"']|"[^"]*"|'[^']*')*`;
+var escapeRegExp = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+var elementPattern = (tag) => {
+  const cached = PATTERN_CACHE.get(tag);
+  if (cached !== void 0) {
+    return cached;
+  }
+  const name = escapeRegExp(tag);
+  const prefix = "(?:[\\w.-]+:)?";
+  const pattern = new RegExp(
+    `<${prefix}${name}${ATTRIBUTE_SPAN}>([\\s\\S]*?)<\\/${prefix}${name}\\s*>`
+  );
+  PATTERN_CACHE.set(tag, pattern);
+  return pattern;
+};
+var skipNonElement = (xml, open) => {
+  if (xml.startsWith("<!--", open)) {
+    const end = xml.indexOf("-->", open + 4);
+    return end === -1 ? xml.length : end + 3;
+  }
+  if (xml.startsWith("<?", open)) {
+    const end = xml.indexOf("?>", open + 2);
+    return end === -1 ? xml.length : end + 2;
+  }
+  if (xml.startsWith("<!", open)) {
+    let depth = 0;
+    for (let cursor = open + 2; cursor < xml.length; cursor += 1) {
+      const character = xml[cursor];
+      if (character === "[") {
+        depth += 1;
+      } else if (character === "]") {
+        depth = Math.max(0, depth - 1);
+      } else if (character === ">" && depth === 0) {
+        return cursor + 1;
+      }
+    }
+    return xml.length;
+  }
+  return -1;
+};
+var withoutNonElementMarkup = (xml) => {
+  const parts = [];
+  let index = 0;
+  for (; ; ) {
+    const open = xml.indexOf("<", index);
+    if (open === -1) {
+      parts.push(xml.slice(index));
+      return parts.join("");
+    }
+    parts.push(xml.slice(index, open));
+    const end = skipNonElement(xml, open);
+    if (end === -1) {
+      parts.push("<");
+      index = open + 1;
+      continue;
+    }
+    index = end;
+  }
+};
+var elementText = (xml, tag) => {
+  const text = elementPattern(tag).exec(withoutNonElementMarkup(xml))?.[1]?.trim();
+  return text === void 0 || text === "" ? void 0 : text;
+};
+var ROOT_PATTERN = /<\s*(?:[A-Za-z_][\w.-]*:)?([A-Za-z_][\w.-]*)[\s/>]/;
+var rootElementName = (xml) => ROOT_PATTERN.exec(withoutNonElementMarkup(xml))?.[1];
+var ISSUER_TAGS = ["RNCEmisor", "RncEmisor"];
+var issuerTaxPayerId = (xml) => {
+  for (const tag of ISSUER_TAGS) {
+    const value = elementText(xml, tag);
+    if (value !== void 0) {
+      return value;
+    }
+  }
+  return void 0;
+};
+
+// src/endpoints/shared.ts
+var prepare = async (deps, ctx, input) => {
+  const scope = await resolveRequestScope({ ctx, options: deps.options, input });
+  const client = await deps.provider.get(scope);
+  return { scope, client };
+};
+var unwrap = (result) => {
+  if (result.isErr()) {
+    throw toApiError(result.error);
+  }
+  return result.value;
+};
+var assertIssuer = (xml, taxPayerId) => {
+  const issuer = issuerTaxPayerId(xml);
+  if (issuer === void 0) {
+    throw badRequest(DGII_ECF_ERROR_CODES.DGII_DOCUMENT_UNREADABLE);
+  }
+  if (normalizeTaxPayerId(issuer) !== taxPayerId) {
+    throw forbidden(
+      DGII_ECF_ERROR_CODES.DGII_TAXPAYER_ID_MISMATCH,
+      `The document is issued by ${issuer} but this request acts for ${taxPayerId}`
+    );
+  }
+};
+var signDocument = async (deps, scope, xml) => {
+  const resolver = deps.options.credentials;
+  if (resolver === void 0) {
+    throw serverError(
+      DGII_ECF_ERROR_CODES.DGII_CREDENTIALS_UNAVAILABLE,
+      "Server-side signing needs the `credentials` resolver; `getClient` hands the key to the host."
+    );
+  }
+  const material = await resolver(scope);
+  if (material === null) {
+    throw serverError(
+      DGII_ECF_ERROR_CODES.DGII_CREDENTIALS_UNAVAILABLE,
+      `No credentials were resolved for taxpayer ${scope.taxPayerId}`
+    );
+  }
+  const { key, cert } = material;
+  if (key === void 0 || cert === void 0) {
+    throw serverError(
+      DGII_ECF_ERROR_CODES.DGII_CREDENTIALS_UNAVAILABLE,
+      "The resolved credentials carry no `key`/`cert` PEM pair, so the document cannot be signed"
+    );
+  }
+  const signature = new dgiiEcf$1.Signature(key, cert);
+  const root = rootElementName(xml);
+  const signed = root === void 0 ? signature.signXml(xml) : signature.signXml(xml, root);
+  if (signed.isErr()) {
+    throw new api.APIError("BAD_REQUEST", {
+      message: signed.error.message,
+      code: DGII_ECF_ERROR_CODES.DGII_SIGNING_FAILED.code,
+      dgii: { code: signed.error.code }
+    });
+  }
+  return signed.value;
+};
+var documentEncf = (xml) => elementText(xml, "eNCF") ?? elementText(xml, "SecuenciaeNCFDesde") ?? elementText(xml, "RangoNCF") ?? null;
+var trackIdOf = (value) => {
+  if (typeof value !== "object" || value === null) {
+    return null;
+  }
+  const candidate = value.trackId;
+  return typeof candidate === "string" && candidate !== "" ? candidate : null;
+};
+var runSubmission = async ({
+  ctx,
+  deps,
+  scope,
+  operation,
+  xml,
+  idempotencyKey,
+  send
+}) => {
+  const store = createSubmissionStore(ctx, deps.options.persistence);
+  const documentHash = hashDocument(xml);
+  const replayKey = idempotencyKey ?? documentHash;
+  if (store.enabled) {
+    const existing = await store.findReplay(scope.taxPayerId, replayKey);
+    const decision = planReplay(existing);
+    if (decision.kind === "conflict") {
+      throw conflict(
+        DGII_ECF_ERROR_CODES.DGII_IDEMPOTENCY_IN_FLIGHT,
+        `A submission for this document is still in flight (record ${existing?.id ?? "unknown"}). Reconcile it by e-NCF before retrying.`
+      );
+    }
+    if (decision.kind === "replay") {
+      return {
+        result: parseStoredResponse(decision.record),
+        replayed: true,
+        submissionId: decision.record.id
+      };
+    }
+  }
+  const submissionId = await store.begin({
+    organizationId: scope.organizationId,
+    taxPayerId: scope.taxPayerId,
+    userId: scope.userId,
+    environment: scope.environment,
+    operation,
+    idempotencyKey: replayKey,
+    encf: documentEncf(xml),
+    documentHash
+  });
+  let result;
+  try {
+    result = unwrap(await send());
+  } catch (error) {
+    const errorCode = error instanceof api.APIError ? String(error.body?.code ?? error.status) : error instanceof Error ? error.name : "UNKNOWN";
+    await store.complete(submissionId, { status: "failed", errorCode });
+    throw error;
+  }
+  await store.complete(submissionId, {
+    status: "succeeded",
+    trackId: trackIdOf(result),
+    response: result
+  });
+  return { result, replayed: false, submissionId };
+};
+var scopeEcho = (scope) => ({
+  taxPayerId: scope.taxPayerId,
+  organizationId: scope.organizationId,
+  environment: scope.environment
+});
+
+// src/endpoints/documents.ts
+var scopeShape = {
+  taxPayerId: z__namespace.string().min(1).optional().meta({
+    description: "Taxpayer id (RNC / c\xE9dula) to act for. Overrides the organization field for this request only."
+  }),
+  organizationId: z__namespace.string().min(1).optional().meta({
+    description: "Organization to act for. Defaults to the session active organization."
+  })
+};
+var documentShape = {
+  ...scopeShape,
+  xml: z__namespace.string().min(1).meta({ description: "The DGII document, as XML." }),
+  fileName: z__namespace.string().min(1).max(255).optional().meta({
+    description: "Multipart file name sent to DGII. Defaults to the document e-NCF."
+  }),
+  sign: z__namespace.boolean().optional().meta({
+    description: "Sign the XML server-side with the organization key before transmitting. Requires the `credentials` resolver."
+  }),
+  idempotencyKey: z__namespace.string().min(1).max(200).optional().meta({
+    description: "Replay guard key. Defaults to the SHA-256 of the document, so retrying the same document never double-issues."
+  })
+};
+var fileNameFor = (xml, fallback) => {
+  const encf = documentEncf(xml);
+  return encf === null ? `${fallback}.xml` : `${encf}.xml`;
+};
+var sendDocument = (deps) => api.createAuthEndpoint(
+  "/dgii-ecf/documents",
+  {
+    method: "POST",
+    body: z__namespace.object({
+      ...documentShape,
+      buyerHost: z__namespace.string().url().optional().meta({
+        description: "Deliver directly to the buyer Sender\u2194Receiver host instead of DGII."
+      })
+    }),
+    use: [api.sessionMiddleware]
+  },
+  async (ctx) => {
+    const { scope, client } = await prepare(deps, ctx, ctx.body);
+    const xml = ctx.body.sign === true ? await signDocument(deps, scope, ctx.body.xml) : ctx.body.xml;
+    assertIssuer(xml, scope.taxPayerId);
+    const outcome = await runSubmission({
+      ctx,
+      deps,
+      scope,
+      operation: "sendDocument",
+      xml,
+      idempotencyKey: ctx.body.idempotencyKey,
+      send: () => client.sendDocument(
+        xml,
+        ctx.body.fileName ?? fileNameFor(xml, "document"),
+        ctx.body.buyerHost
+      )
+    });
+    return ctx.json({
+      ...scopeEcho(scope),
+      submissionId: outcome.submissionId,
+      replayed: outcome.replayed,
+      result: outcome.result
+    });
+  }
+);
+var sendElectronicDocument = (deps) => api.createAuthEndpoint(
+  "/dgii-ecf/documents/electronic",
+  {
+    method: "POST",
+    body: z__namespace.object({
+      ...documentShape,
+      buyerHost: z__namespace.string().url().optional()
+    }),
+    use: [api.sessionMiddleware]
+  },
+  async (ctx) => {
+    const { scope, client } = await prepare(deps, ctx, ctx.body);
+    const xml = ctx.body.sign === true ? await signDocument(deps, scope, ctx.body.xml) : ctx.body.xml;
+    assertIssuer(xml, scope.taxPayerId);
+    const outcome = await runSubmission({
+      ctx,
+      deps,
+      scope,
+      operation: "sendElectronicDocument",
+      xml,
+      idempotencyKey: ctx.body.idempotencyKey,
+      send: () => client.sendElectronicDocument(
+        xml,
+        ctx.body.fileName ?? fileNameFor(xml, "ecf"),
+        ctx.body.buyerHost
+      )
+    });
+    return ctx.json({
+      ...scopeEcho(scope),
+      submissionId: outcome.submissionId,
+      replayed: outcome.replayed,
+      result: outcome.result
+    });
+  }
+);
+var sendSummary = (deps) => api.createAuthEndpoint(
+  "/dgii-ecf/documents/summary",
+  {
+    method: "POST",
+    body: z__namespace.object(documentShape),
+    use: [api.sessionMiddleware]
+  },
+  async (ctx) => {
+    const { scope, client } = await prepare(deps, ctx, ctx.body);
+    const xml = ctx.body.sign === true ? await signDocument(deps, scope, ctx.body.xml) : ctx.body.xml;
+    assertIssuer(xml, scope.taxPayerId);
+    const outcome = await runSubmission({
+      ctx,
+      deps,
+      scope,
+      operation: "sendSummary",
+      xml,
+      idempotencyKey: ctx.body.idempotencyKey,
+      send: () => client.sendSummary(xml, ctx.body.fileName ?? fileNameFor(xml, "summary"))
+    });
+    return ctx.json({
+      ...scopeEcho(scope),
+      submissionId: outcome.submissionId,
+      replayed: outcome.replayed,
+      result: outcome.result
+    });
+  }
+);
+var sendCommercialApproval = (deps) => api.createAuthEndpoint(
+  "/dgii-ecf/documents/commercial-approval",
+  {
+    method: "POST",
+    body: z__namespace.object({
+      ...documentShape,
+      buyerHost: z__namespace.string().url().optional().meta({
+        description: "Deliver the approval directly to the issuer host."
+      })
+    }),
+    use: [api.sessionMiddleware]
+  },
+  async (ctx) => {
+    const { scope, client } = await prepare(deps, ctx, ctx.body);
+    const xml = ctx.body.sign === true ? await signDocument(deps, scope, ctx.body.xml) : ctx.body.xml;
+    assertIssuer(xml, scope.taxPayerId);
+    const buyerHost = ctx.body.buyerHost;
+    const outcome = await runSubmission({
+      ctx,
+      deps,
+      scope,
+      operation: "sendCommercialApproval",
+      xml,
+      idempotencyKey: ctx.body.idempotencyKey,
+      send: () => {
+        const fileName = ctx.body.fileName ?? fileNameFor(xml, "approval");
+        return buyerHost === void 0 ? client.sendCommercialApproval(xml, fileName) : client.sendCommercialApproval(xml, fileName, buyerHost);
+      }
+    });
+    return ctx.json({
+      ...scopeEcho(scope),
+      submissionId: outcome.submissionId,
+      replayed: outcome.replayed,
+      result: outcome.result
+    });
+  }
+);
+var voidENCF = (deps) => api.createAuthEndpoint(
+  "/dgii-ecf/documents/void-range",
+  {
+    method: "POST",
+    body: z__namespace.object(documentShape),
+    use: [api.sessionMiddleware]
+  },
+  async (ctx) => {
+    const { scope, client } = await prepare(deps, ctx, ctx.body);
+    const xml = ctx.body.sign === true ? await signDocument(deps, scope, ctx.body.xml) : ctx.body.xml;
+    assertIssuer(xml, scope.taxPayerId);
+    const outcome = await runSubmission({
+      ctx,
+      deps,
+      scope,
+      operation: "voidENCF",
+      xml,
+      idempotencyKey: ctx.body.idempotencyKey,
+      send: () => client.voidENCF(xml, ctx.body.fileName ?? fileNameFor(xml, "void-range"))
+    });
+    return ctx.json({
+      ...scopeEcho(scope),
+      submissionId: outcome.submissionId,
+      replayed: outcome.replayed,
+      result: outcome.result
+    });
+  }
+);
+var reconcileSubmission = (deps) => api.createAuthEndpoint(
+  "/dgii-ecf/documents/reconcile",
+  {
+    method: "POST",
+    body: z__namespace.object({
+      ...scopeShape,
+      xml: z__namespace.string().min(1).meta({ description: "The signed document, as XML." })
+    }),
+    use: [api.sessionMiddleware]
+  },
+  async (ctx) => {
+    const { scope, client } = await prepare(deps, ctx, ctx.body);
+    assertIssuer(ctx.body.xml, scope.taxPayerId);
+    const result = unwrap(await client.reconcileSubmission(ctx.body.xml));
+    return ctx.json({ ...scopeEcho(scope), result });
+  }
+);
+var scopeShape2 = {
+  taxPayerId: z__namespace.string().min(1).optional().meta({
+    description: "Taxpayer id (RNC / c\xE9dula) to act for. Overrides the organization field."
+  }),
+  organizationId: z__namespace.string().min(1).optional().meta({
+    description: "Organization to act for. Defaults to the session active organization."
+  })
+};
+var trackStatus = (deps) => api.createAuthEndpoint(
+  "/dgii-ecf/tracks",
+  {
+    method: "GET",
+    query: z__namespace.object({
+      ...scopeShape2,
+      trackId: z__namespace.string().min(1).meta({ description: "DGII track id." })
+    }),
+    use: [api.sessionMiddleware]
+  },
+  async (ctx) => {
+    const { scope, client } = await prepare(deps, ctx, ctx.query);
+    const result = unwrap(await client.statusTrackId(ctx.query.trackId));
+    return ctx.json({ ...scopeEcho(scope), result });
+  }
+);
+var inquiryStatus = (deps) => api.createAuthEndpoint(
+  "/dgii-ecf/inquiries/status",
+  {
+    method: "POST",
+    body: z__namespace.object({
+      ...scopeShape2,
+      ncf: z__namespace.string().min(1).meta({ description: "The e-NCF to look up." }),
+      buyerTaxPayerId: z__namespace.string().min(1).optional().meta({ description: "Buyer RNC, when DGII needs it to disambiguate." }),
+      securityCode: z__namespace.string().min(1).optional().meta({ description: "Six-digit security code of the document." })
+    }),
+    use: [api.sessionMiddleware]
+  },
+  async (ctx) => {
+    const { scope, client } = await prepare(deps, ctx, ctx.body);
+    const result = unwrap(
+      await client.inquiryStatus(
+        scope.taxPayerId,
+        ctx.body.ncf,
+        ctx.body.buyerTaxPayerId,
+        ctx.body.securityCode
+      )
+    );
+    return ctx.json({ ...scopeEcho(scope), result });
+  }
+);
+var trackStatuses = (deps) => api.createAuthEndpoint(
+  "/dgii-ecf/inquiries/tracks",
+  {
+    method: "POST",
+    body: z__namespace.object({
+      ...scopeShape2,
+      encf: z__namespace.string().min(1).meta({ description: "The e-NCF to list tracks for." })
+    }),
+    use: [api.sessionMiddleware]
+  },
+  async (ctx) => {
+    const { scope, client } = await prepare(deps, ctx, ctx.body);
+    const result = unwrap(
+      await client.trackStatuses(scope.taxPayerId, ctx.body.encf)
+    );
+    return ctx.json({ ...scopeEcho(scope), result });
+  }
+);
+var summaryInvoiceInquiry = (deps) => api.createAuthEndpoint(
+  "/dgii-ecf/inquiries/summary",
+  {
+    method: "POST",
+    body: z__namespace.object({
+      ...scopeShape2,
+      encf: z__namespace.string().min(1).meta({ description: "The RFCE e-NCF to look up." }),
+      securityCode: z__namespace.string().min(1).meta({ description: "Six-digit security code of the summary invoice." })
+    }),
+    use: [api.sessionMiddleware]
+  },
+  async (ctx) => {
+    const { scope, client } = await prepare(deps, ctx, ctx.body);
+    const result = unwrap(
+      await client.getSummaryInvoiceInquiry(
+        scope.taxPayerId,
+        ctx.body.encf,
+        ctx.body.securityCode
+      )
+    );
+    return ctx.json({ ...scopeEcho(scope), result });
+  }
+);
+var customerDirectory = (deps) => api.createAuthEndpoint(
+  "/dgii-ecf/directories/customers",
+  {
+    method: "GET",
+    query: z__namespace.object({
+      ...scopeShape2,
+      rnc: z__namespace.string().min(1).optional().meta({
+        description: "RNC to look up. Defaults to the taxpayer this request acts for."
+      })
+    }),
+    use: [api.sessionMiddleware]
+  },
+  async (ctx) => {
+    const { scope, client } = await prepare(deps, ctx, ctx.query);
+    const result = unwrap(
+      await client.getCustomerDirectory(ctx.query.rnc ?? scope.taxPayerId)
+    );
+    return ctx.json({ ...scopeEcho(scope), result: result ?? [] });
+  }
+);
+var directoryListing = (deps) => api.createAuthEndpoint(
+  "/dgii-ecf/directories/all",
+  {
+    method: "GET",
+    query: z__namespace.object(scopeShape2),
+    use: [api.sessionMiddleware]
+  },
+  async (ctx) => {
+    const { scope, client } = await prepare(deps, ctx, ctx.query);
+    const result = unwrap(await client.getDirectoryListing());
+    return ctx.json({ ...scopeEcho(scope), result });
+  }
+);
+var scopeShape3 = {
+  taxPayerId: z__namespace.string().min(1).optional().meta({
+    description: "Taxpayer id (RNC / c\xE9dula) to act for. Overrides the organization field."
+  }),
+  organizationId: z__namespace.string().min(1).optional().meta({
+    description: "Organization to act for. Defaults to the session active organization."
+  })
+};
+var STATUS_ENVIRONMENTS = {
+  precertification: dgiiEcf$1.StatusEnvironment.PreCertification,
+  production: dgiiEcf$1.StatusEnvironment.Production,
+  certification: dgiiEcf$1.StatusEnvironment.Certification
+};
+var requireStatusKey = (deps) => {
+  if (deps.provider.constructsClients && deps.options.status?.apiKey === void 0) {
+    throw serverError(DGII_ECF_ERROR_CODES.DGII_STATUS_API_KEY_REQUIRED);
+  }
+};
+var authenticate = (deps) => api.createAuthEndpoint(
+  "/dgii-ecf/authenticate",
+  {
+    method: "POST",
+    body: z__namespace.object({
+      ...scopeShape3,
+      buyerHost: z__namespace.string().url().optional().meta({ description: "Authenticate against a buyer Sender\u2194Receiver host." })
+    }),
+    use: [api.sessionMiddleware]
+  },
+  async (ctx) => {
+    const { scope, client } = await prepare(deps, ctx, ctx.body);
+    const token = unwrap(await client.authenticate(ctx.body.buyerHost));
+    return ctx.json({
+      ...scopeEcho(scope),
+      issuedAt: token.expedido,
+      expiresAt: token.expira
+    });
+  }
+);
+var serviceStatus = (deps) => api.createAuthEndpoint(
+  "/dgii-ecf/service-status",
+  {
+    method: "GET",
+    query: z__namespace.object(scopeShape3),
+    use: [api.sessionMiddleware]
+  },
+  async (ctx) => {
+    requireStatusKey(deps);
+    const { scope, client } = await prepare(deps, ctx, ctx.query);
+    const services = unwrap(await client.getServiceStatus());
+    return ctx.json({ ...scopeEcho(scope), services });
+  }
+);
+var maintenanceWindows = (deps) => api.createAuthEndpoint(
+  "/dgii-ecf/maintenance-windows",
+  {
+    method: "GET",
+    query: z__namespace.object(scopeShape3),
+    use: [api.sessionMiddleware]
+  },
+  async (ctx) => {
+    requireStatusKey(deps);
+    const { scope, client } = await prepare(deps, ctx, ctx.query);
+    const windows = unwrap(await client.getMaintenanceWindows());
+    return ctx.json({ ...scopeEcho(scope), windows });
+  }
+);
+var serviceAvailability = (deps) => api.createAuthEndpoint(
+  "/dgii-ecf/service-availability",
+  {
+    method: "GET",
+    query: z__namespace.object({
+      ...scopeShape3,
+      environment: z__namespace.enum(["precertification", "production", "certification"]).meta({ description: "DGII environment to query." })
+    }),
+    use: [api.sessionMiddleware]
+  },
+  async (ctx) => {
+    requireStatusKey(deps);
+    const { scope, client } = await prepare(deps, ctx, ctx.query);
+    const result = unwrap(
+      await client.checkServiceAvailability(
+        STATUS_ENVIRONMENTS[ctx.query.environment]
+      )
+    );
+    return ctx.json({
+      ...scopeEcho(scope),
+      environmentChecked: ctx.query.environment,
+      estado: result.estado
+    });
+  }
+);
+var scopeShape4 = {
+  taxPayerId: z__namespace.string().min(1).optional().meta({
+    description: "Taxpayer id (RNC / c\xE9dula) to act for. Overrides the organization field."
+  }),
+  organizationId: z__namespace.string().min(1).optional().meta({
+    description: "Organization to act for. Defaults to the session active organization."
+  })
+};
+var resolveTaxPayer = (deps) => api.createAuthEndpoint(
+  "/dgii-ecf/taxpayer",
+  {
+    method: "GET",
+    query: z__namespace.object(scopeShape4),
+    use: [api.sessionMiddleware]
+  },
+  async (ctx) => {
+    const { scope } = await prepare(deps, ctx, ctx.query);
+    return ctx.json({
+      taxPayerId: scope.taxPayerId,
+      organizationId: scope.organizationId,
+      organizationTaxPayerId: scope.organizationTaxPayerId,
+      source: scope.source,
+      environment: scope.environment
+    });
+  }
+);
+var listSubmissions = (deps) => api.createAuthEndpoint(
+  "/dgii-ecf/submissions",
+  {
+    method: "GET",
+    query: z__namespace.object({
+      ...scopeShape4,
+      limit: z__namespace.coerce.number().int().min(1).max(100).optional().meta({
+        description: "Maximum number of records to return. Defaults to 20."
+      }),
+      status: z__namespace.enum(["pending", "succeeded", "failed"]).optional().meta({ description: "Filter by record status." })
+    }),
+    use: [api.sessionMiddleware]
+  },
+  async (ctx) => {
+    const { scope } = await prepare(deps, ctx, ctx.query);
+    const store = createSubmissionStore(ctx, deps.options.persistence);
+    const records = await store.list({
+      organizationId: scope.organizationId,
+      taxPayerId: scope.organizationId === null ? scope.taxPayerId : null,
+      limit: Math.min(ctx.query.limit ?? 20, 100)
+    });
+    const filtered = ctx.query.status === void 0 ? records : records.filter((record) => record.status === ctx.query.status);
+    return ctx.json({
+      ...scopeEcho(scope),
+      submissions: filtered.map((record) => ({
+        id: record.id,
+        operation: record.operation,
+        status: record.status,
+        taxPayerId: record.taxPayerId,
+        organizationId: record.organizationId ?? null,
+        environment: record.environment,
+        encf: record.encf ?? null,
+        trackId: record.trackId ?? null,
+        documentHash: record.documentHash ?? null,
+        errorCode: record.errorCode ?? null,
+        createdAt: record.createdAt ?? null
+      }))
+    });
+  }
+);
+
+// src/plugin.ts
+var readonlyTaxPayerIdField = () => ({
+  type: "string",
+  required: false,
+  input: false,
+  returned: true,
+  unique: false
+});
+var dgiiEcfOrganizationSchema = (field = "taxPayerId") => ({
+  additionalFields: {
+    [field]: {
+      type: "string",
+      required: false,
+      // Writable: this fragment is declared by the organization plugin, which
+      // is what makes `organization.create` / `organization.update` accept it.
+      input: true,
+      returned: true,
+      unique: false
+    }
+  }
+});
+var dgiiEcf = (options = {}) => {
+  const provider = createClientProvider(options);
+  const deps = { options, provider };
+  const schema = {
+    [SUBMISSION_MODEL]: {
+      modelName: SUBMISSION_MODEL,
+      fields: {
+        organizationId: { type: "string", required: false },
+        taxPayerId: { type: "string", required: true },
+        userId: { type: "string", required: true },
+        environment: { type: "string", required: true },
+        operation: { type: "string", required: true },
+        status: { type: "string", required: true },
+        idempotencyKey: { type: "string", required: false },
+        encf: { type: "string", required: false },
+        trackId: { type: "string", required: false },
+        documentHash: { type: "string", required: false },
+        errorCode: { type: "string", required: false },
+        response: { type: "string", required: false },
+        // Better Auth does not add timestamps implicitly: a plugin table that
+        // wants them declares them. `createdAt` orders the replay lookup and the
+        // audit listing; `updatedAt` records when a submission was closed.
+        createdAt: { type: "date", required: true, defaultValue: () => /* @__PURE__ */ new Date() },
+        updatedAt: { type: "date", required: false, onUpdate: () => /* @__PURE__ */ new Date() }
+      },
+      indexes: [
+        // The replay lookup: taxpayer + key must be a cheap read.
+        { fields: ["taxPayerId", "idempotencyKey"] },
+        // The audit listing: "everything this organization submitted".
+        { fields: ["organizationId", "createdAt"] }
+      ]
+    }
+  };
+  if (options.organization?.extendSchema === true) {
+    schema.organization = {
+      fields: {
+        [options.organization.field ?? "taxPayerId"]: readonlyTaxPayerIdField()
+      }
+    };
+  }
+  const plugin = {
+    id: "dgii-ecf",
+    $ERROR_CODES: DGII_ECF_ERROR_CODES,
+    schema,
+    endpoints: {
+      // Identity
+      dgiiEcfResolveTaxPayer: resolveTaxPayer(deps),
+      // Session / token
+      dgiiEcfAuthenticate: authenticate(deps),
+      // Documents
+      dgiiEcfSendDocument: sendDocument(deps),
+      dgiiEcfSendElectronicDocument: sendElectronicDocument(deps),
+      dgiiEcfSendSummary: sendSummary(deps),
+      dgiiEcfSendCommercialApproval: sendCommercialApproval(deps),
+      dgiiEcfVoidENCF: voidENCF(deps),
+      dgiiEcfReconcileSubmission: reconcileSubmission(deps),
+      // Queries
+      dgiiEcfTrackStatus: trackStatus(deps),
+      dgiiEcfInquiryStatus: inquiryStatus(deps),
+      dgiiEcfTrackStatuses: trackStatuses(deps),
+      dgiiEcfSummaryInvoiceInquiry: summaryInvoiceInquiry(deps),
+      dgiiEcfCustomerDirectory: customerDirectory(deps),
+      dgiiEcfDirectoryListing: directoryListing(deps),
+      // DGII operations
+      dgiiEcfServiceStatus: serviceStatus(deps),
+      dgiiEcfMaintenanceWindows: maintenanceWindows(deps),
+      dgiiEcfServiceAvailability: serviceAvailability(deps),
+      // Audit
+      dgiiEcfListSubmissions: listSubmissions(deps)
+    },
+    rateLimit: [
+      {
+        // Fiscal transmissions are metered by DGII and expensive to retry, so
+        // the whole surface gets a conservative per-window budget.
+        window: 60,
+        max: 60,
+        pathMatcher: (path) => path.startsWith("/dgii-ecf")
+      }
+    ]
+  };
+  return Object.assign(plugin, { clientProvider: provider });
+};
+
+Object.defineProperty(exports, "Environment", {
+  enumerable: true,
+  get: function () { return dgiiEcf$1.Environment; }
+});
+exports.DGII_ECF_ERROR_CODES = DGII_ECF_ERROR_CODES;
+exports.SUBMISSION_MODEL = SUBMISSION_MODEL;
+exports.dgiiEcf = dgiiEcf;
+exports.dgiiEcfOrganizationSchema = dgiiEcfOrganizationSchema;
+exports.isTaxPayerIdShape = isTaxPayerIdShape;
+exports.normalizeTaxPayerId = normalizeTaxPayerId;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map