@deuriib/better-dgii-ecf 0.0.0-stage → 0.0.0

package/dist/plugin-BVYTmUJU.d.ts

@@ -0,0 +1,1058 @@
+import * as _deuriib_dgii_ecf from '@deuriib/dgii-ecf';
+import { Environment, P12ReaderData, ECF } from '@deuriib/dgii-ecf';
+import * as better_auth from 'better-auth';
+import { User, Session } from 'better-auth';
+import * as zod_v4_core from 'zod/v4/core';
+import { DBFieldAttribute } from '@better-auth/core/db';
+
+/**
+ * Taxpayer id (RNC / cédula) handling for the DGII e-CF services.
+ *
+ * Two things are deliberately kept apart:
+ *
+ * - **Normalization** is unconditional. DGII accepts the identifier with or
+ *   without separators, and a database that stores `1-31-12345-6` while the
+ *   organization field stores `131123456` must not produce a mismatch.
+ * - **Validation** is a policy. The only rule enforced by default is the
+ *   documented shape: 9 digits for an RNC, 11 for a cédula. Anything stricter
+ *   (a check digit, an allow-list of registered taxpayers) is the host's call,
+ *   so it is injected rather than assumed.
+ */
+/** Strip the separators a human types so comparison and storage are stable. */
+declare const normalizeTaxPayerId: (value: string) => string;
+/**
+ * True when the value is a syntactically valid DGII identifier.
+ *
+ * The input is expected to be already normalized; call
+ * {@link normalizeTaxPayerId} first when it comes from user input.
+ */
+declare const isTaxPayerIdShape: (value: string) => boolean;
+/**
+ * Custom validation hook. Return `true` to accept, or a string to accept with
+ * a normalized replacement (for example an alias resolved to its canonical
+ * RNC). Returning `false` rejects.
+ */
+type TaxPayerIdValidator = (taxPayerId: string) => boolean | string | Promise<boolean | string>;
+/** How strictly a resolved taxpayer id is checked. Defaults to `format`. */
+type TaxPayerIdValidation = 'format' | 'off' | TaxPayerIdValidator;
+
+/**
+ * Everything a resolver needs to answer "which credentials / which client /
+ * which environment applies to this call".
+ *
+ * It carries no request body: resolvers run after the taxpayer id and the
+ * organization have been resolved and authorized, so a resolver cannot be used
+ * to widen the scope it is given.
+ */
+interface DgiiEcfScope {
+    /** Canonical taxpayer id (RNC / cédula) the call is acting for. */
+    readonly taxPayerId: string;
+    /** Organization in scope, when the call resolved one. */
+    readonly organizationId: string | null;
+    /** Authenticated user making the call. */
+    readonly userId: string;
+    /** DGII environment the call targets. */
+    readonly environment: Environment;
+}
+/** Resolver for the PKCS#12 key material the DGII SDK signs with. */
+type DgiiEcfCredentialsResolver = (scope: DgiiEcfScope) => P12ReaderData | null | Promise<P12ReaderData | null>;
+/**
+ * Resolver for a fully built DGII client.
+ *
+ * Use it when credentials live in an HSM, a KMS-backed signer or a sidecar, or
+ * when the host already pools clients and wants to keep owning their lifecycle.
+ * When it is provided, the plugin caches nothing.
+ */
+type DgiiEcfClientResolver = (scope: DgiiEcfScope) => ECF | null | Promise<ECF | null>;
+/**
+ * Resolver for the taxpayer id, used when the request does not name one and
+ * the organization has no stored value.
+ *
+ * It receives the session so a single-tenant or user-scoped mapping is possible
+ * (`user -> RNC`), and its result is authorized like any other source.
+ */
+type DgiiEcfTaxPayerIdResolver = (context: {
+    readonly user: User;
+    readonly session: Session;
+    readonly organizationId: string | null;
+}) => string | null | Promise<string | null>;
+/** Custom authorization decision. Returning `true` allows, `false` denies. */
+type DgiiEcfAuthorizer = (context: {
+    readonly user: User;
+    readonly session: Session;
+    readonly taxPayerId: string;
+    readonly organizationId: string | null;
+    /** Organization's stored taxpayer id, when one was resolved. */
+    readonly organizationTaxPayerId: string | null;
+    /** Which source produced the taxpayer id for this call. */
+    readonly source: DgiiEcfTaxPayerIdSource;
+}) => boolean | Promise<boolean>;
+/** Where the taxpayer id for a call came from. */
+type DgiiEcfTaxPayerIdSource = 'request' | 'organization' | 'resolver';
+interface DgiiEcfOrganizationOptions {
+    /**
+     * Organization field holding the taxpayer id. Defaults to `taxPayerId`,
+     * matching the field this package exports for `organization({ schema })`.
+     */
+    field?: string;
+    /**
+     * Register the field on the `organization` model from this plugin (and let
+     * Better Auth's CLI migration create it).
+     *
+     * Defaults to `false`, because the supported way to make the field writable
+     * is the organization plugin's own `additionalFields` — declare it there and
+     * `organization.update` persists it. Enable this only for read-only setups
+     * where the value is written by another system; `organization.update` will
+     * not accept a field it does not know about.
+     */
+    extendSchema?: boolean;
+}
+interface DgiiEcfPersistenceOptions {
+    /**
+     * Persist submissions so retries are replay-safe across restarts and the
+     * audit trail survives. Defaults to `true`; the table is part of the plugin
+     * schema, so the Better Auth CLI creates it with the rest of the schema.
+     */
+    enabled?: boolean;
+    /**
+     * Store the successful DGII response body on the record so an idempotent
+     * replay can return the original answer. Defaults to `true`; disable it when
+     * the response must not be retained.
+     */
+    storeResponses?: boolean;
+    /** Values longer than this are truncated before storage. Defaults to 8192. */
+    maxResponseLength?: number;
+}
+interface DgiiEcfClientCacheOptions {
+    /** Maximum number of cached clients. Defaults to 50. */
+    maxSize?: number;
+    /** How long a cached client is reused. Defaults to 10 minutes. */
+    ttlMs?: number;
+}
+interface DgiiEcfStatusOptions {
+    /**
+     * API key for the DGII status service (`statusecf.dgii.gov.do`). The status
+     * endpoints fail with `DGII_STATUS_API_KEY_REQUIRED` when it is absent.
+     */
+    apiKey?: string;
+}
+interface DgiiEcfOptions {
+    /**
+     * DGII environment, or a function returning one per scope. Defaults to
+     * `Environment.Dev` — the certification environments are opt-in so a
+     * misconfigured deployment cannot issue real fiscal documents.
+     */
+    environment?: Environment | ((scope: Omit<DgiiEcfScope, 'environment'>) => Environment | Promise<Environment>);
+    /**
+     * Resolve the PKCS#12 key material per taxpayer. Required unless `getClient`
+     * is provided. The plugin never accepts key material over HTTP.
+     */
+    credentials?: DgiiEcfCredentialsResolver;
+    /** Provide a ready-made DGII client per scope. Disables the plugin's cache. */
+    getClient?: DgiiEcfClientResolver;
+    /** Fallback taxpayer id mapping when neither the request nor the org has one. */
+    resolveTaxPayerId?: DgiiEcfTaxPayerIdResolver;
+    /** Replace the built-in authorization policy entirely. */
+    authorize?: DgiiEcfAuthorizer;
+    /** Organization integration knobs. */
+    organization?: DgiiEcfOrganizationOptions;
+    /** Roles allowed to perform DGII operations. Defaults to owner and admin. */
+    roles?: string[];
+    /**
+     * Allow a request-supplied taxpayer id when no organization is in scope.
+     *
+     * Only meaningful while the organization plugin is installed: without it there
+     * is no tenant model to check against, so request-supplied ids are accepted
+     * (this is the documented single-tenant mode) and this flag changes nothing.
+     */
+    allowUntrustedTaxPayerId?: boolean;
+    /** Taxpayer id validation policy. Defaults to `format`. */
+    validateTaxPayerId?: TaxPayerIdValidation;
+    /** Submission persistence and idempotency. */
+    persistence?: DgiiEcfPersistenceOptions;
+    /** Client cache sizing. Ignored when `getClient` is provided. */
+    clientCache?: DgiiEcfClientCacheOptions;
+    /** DGII status service configuration. */
+    status?: DgiiEcfStatusOptions;
+    /** Request timeout forwarded to the DGII SDK. Defaults to the SDK's value. */
+    timeoutMs?: number;
+}
+
+/**
+ * Submission persistence: the audit trail and the replay guard.
+ *
+ * Two problems are solved by the same row:
+ *
+ * 1. **Replay safety.** The DGII SDK keeps its idempotency markers in memory, so
+ *    a restart or a second instance loses them and a retried POST can submit the
+ *    same fiscal document twice. The row makes the guard durable.
+ * 2. **Audit.** Who submitted what, under which taxpayer, with which track id
+ *    and what DGII answered. Fiscal operations need that trail.
+ *
+ * Only derived data is stored: the SHA-256 of the signed document, never the
+ * document, and never key material or a bearer token.
+ */
+/** Model key of the table this plugin owns. */
+declare const SUBMISSION_MODEL = "dgiiEcfSubmission";
+type SubmissionStatus = 'pending' | 'succeeded' | 'failed';
+interface SubmissionRecord extends Record<string, unknown> {
+    id: string;
+    organizationId?: string | null;
+    taxPayerId: string;
+    userId: string;
+    environment: string;
+    operation: string;
+    status: SubmissionStatus;
+    idempotencyKey?: string | null;
+    encf?: string | null;
+    trackId?: string | null;
+    documentHash?: string | null;
+    errorCode?: string | null;
+    response?: string | null;
+    createdAt?: Date | string;
+    updatedAt?: Date | string;
+}
+interface BeginSubmissionInput {
+    readonly organizationId: string | null;
+    readonly taxPayerId: string;
+    readonly userId: string;
+    readonly environment: string;
+    readonly operation: string;
+    readonly idempotencyKey: string;
+    readonly encf: string | null;
+    readonly documentHash: string | null;
+}
+interface ListSubmissionsInput {
+    readonly organizationId: string | null;
+    readonly taxPayerId: string | null;
+    readonly limit: number;
+}
+interface DgiiEcfSubmissionStore {
+    readonly enabled: boolean;
+    /**
+     * A previously recorded submission for the same taxpayer and replay key.
+     *
+     * Returns the record whatever its status: the caller decides what a `pending`
+     * or `failed` record means for the attempt it is about to make.
+     */
+    findReplay(taxPayerId: string, idempotencyKey: string): Promise<SubmissionRecord | null>;
+    /** Record the attempt before it is transmitted; `null` when persistence is off. */
+    begin(input: BeginSubmissionInput): Promise<string | null>;
+    /** Finish a recorded attempt, whatever its outcome. */
+    complete(id: string | null, outcome: {
+        status: Exclude<SubmissionStatus, 'pending'>;
+        trackId?: string | null;
+        response?: unknown;
+        errorCode?: string | null;
+    }): Promise<void>;
+    /** Audit listing for the organization (or taxpayer) in scope. */
+    list(input: ListSubmissionsInput): Promise<SubmissionRecord[]>;
+}
+
+/**
+ * Supplies the DGII client for a resolved scope.
+ *
+ * The plugin owns no key material of its own: the host resolves it per
+ * taxpayer, over a callback that never sees the HTTP request. That is the whole
+ * security model — a browser can call these endpoints, but it can never supply,
+ * read or influence which certificate signs a document.
+ */
+interface DgiiEcfClientProvider {
+    /** The client for this scope, or an `APIError` when none can be built. */
+    get(scope: DgiiEcfScope): Promise<ECF>;
+    /** Drop cached clients, all of them or only one taxpayer's. */
+    invalidate(taxPayerId?: string): void;
+    /** Number of cached clients; always 0 when `getClient` is configured. */
+    readonly size: number;
+    /**
+     * True when the plugin builds the `ECF` instances (the `credentials` mode).
+     *
+     * The status endpoints use it to decide whether the plugin's own
+     * `status.apiKey` is the authority: a host that supplies its own client kept
+     * the status key to itself too, so the plugin must not demand one.
+     */
+    readonly constructsClients: boolean;
+}
+
+/**
+ * Fragments to drop into `organization({ schema })`.
+ *
+ * Exported so an application declares the field exactly once, with exactly the
+ * definition this plugin expects. This is the supported way to make the value
+ * *writable*: the organization plugin builds its create/update schemas from its
+ * own `additionalFields`, so a field registered only by this plugin's schema is
+ * readable but not accepted by `organization.update`.
+ *
+ * @example
+ * ```ts
+ * organization({ schema: { organization: dgiiEcfOrganizationSchema() } })
+ * ```
+ */
+declare const dgiiEcfOrganizationSchema: (field?: string) => {
+    additionalFields: Record<string, DBFieldAttribute>;
+};
+/**
+ * Better Auth plugin wiring the DGII e-CF SDK into an authenticated API.
+ *
+ * Three responsibilities, and deliberately no fourth:
+ *
+ * 1. **Identity** — decide *which* taxpayer a call acts for: the request, the
+ *    organization, or a server-side mapping, authorized in that order.
+ * 2. **Credentials** — resolve key material per taxpayer through a server-side
+ *    callback, so no certificate or bearer token ever reaches a browser.
+ * 3. **Durability** — record submissions, so a retry is replay-safe across
+ *    restarts and the fiscal audit trail survives the process.
+ *
+ * Document *content* stays the host's job: the plugin signs and transmits XML,
+ * it does not model invoices.
+ */
+declare const dgiiEcf: (options?: DgiiEcfOptions) => {
+    id: "dgii-ecf";
+    $ERROR_CODES: {
+        DGII_SESSION_REQUIRED: better_auth.RawError<"DGII_SESSION_REQUIRED">;
+        DGII_TAXPAYER_ID_REQUIRED: better_auth.RawError<"DGII_TAXPAYER_ID_REQUIRED">;
+        DGII_TAXPAYER_ID_INVALID: better_auth.RawError<"DGII_TAXPAYER_ID_INVALID">;
+        DGII_TAXPAYER_ID_MISMATCH: better_auth.RawError<"DGII_TAXPAYER_ID_MISMATCH">;
+        DGII_TAXPAYER_ID_FORBIDDEN: better_auth.RawError<"DGII_TAXPAYER_ID_FORBIDDEN">;
+        DGII_ORGANIZATION_NOT_FOUND: better_auth.RawError<"DGII_ORGANIZATION_NOT_FOUND">;
+        DGII_ORGANIZATION_REQUIRED: better_auth.RawError<"DGII_ORGANIZATION_REQUIRED">;
+        DGII_NOT_A_MEMBER: better_auth.RawError<"DGII_NOT_A_MEMBER">;
+        DGII_INSUFFICIENT_ROLE: better_auth.RawError<"DGII_INSUFFICIENT_ROLE">;
+        DGII_CREDENTIALS_UNAVAILABLE: better_auth.RawError<"DGII_CREDENTIALS_UNAVAILABLE">;
+        DGII_CLIENT_NOT_CONFIGURED: better_auth.RawError<"DGII_CLIENT_NOT_CONFIGURED">;
+        DGII_STATUS_API_KEY_REQUIRED: better_auth.RawError<"DGII_STATUS_API_KEY_REQUIRED">;
+        DGII_DOCUMENT_UNREADABLE: better_auth.RawError<"DGII_DOCUMENT_UNREADABLE">;
+        DGII_SIGNING_FAILED: better_auth.RawError<"DGII_SIGNING_FAILED">;
+        DGII_REQUEST_FAILED: better_auth.RawError<"DGII_REQUEST_FAILED">;
+        DGII_SUBMISSION_NOT_FOUND: better_auth.RawError<"DGII_SUBMISSION_NOT_FOUND">;
+        DGII_PERSISTENCE_UNAVAILABLE: better_auth.RawError<"DGII_PERSISTENCE_UNAVAILABLE">;
+        DGII_IDEMPOTENCY_IN_FLIGHT: better_auth.RawError<"DGII_IDEMPOTENCY_IN_FLIGHT">;
+    };
+    schema: better_auth.BetterAuthPluginDBSchema;
+    endpoints: {
+        dgiiEcfResolveTaxPayer: better_auth.StrictEndpoint<"/dgii-ecf/taxpayer", {
+            method: "GET";
+            query: better_auth.ZodObject<{
+                taxPayerId: better_auth.ZodOptional<better_auth.ZodString>;
+                organizationId: better_auth.ZodOptional<better_auth.ZodString>;
+            }, zod_v4_core.$strip>;
+            use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+        }, {
+            taxPayerId: string;
+            organizationId: string | null;
+            organizationTaxPayerId: string | null;
+            source: DgiiEcfTaxPayerIdSource;
+            environment: _deuriib_dgii_ecf.Environment;
+        }>;
+        dgiiEcfAuthenticate: better_auth.StrictEndpoint<"/dgii-ecf/authenticate", {
+            method: "POST";
+            body: better_auth.ZodObject<{
+                buyerHost: better_auth.ZodOptional<better_auth.ZodString>;
+                taxPayerId: better_auth.ZodOptional<better_auth.ZodString>;
+                organizationId: better_auth.ZodOptional<better_auth.ZodString>;
+            }, zod_v4_core.$strip>;
+            use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+        }, {
+            issuedAt: string;
+            expiresAt: string;
+            taxPayerId: string;
+            organizationId: string | null;
+            environment: _deuriib_dgii_ecf.Environment;
+        }>;
+        dgiiEcfSendDocument: better_auth.StrictEndpoint<"/dgii-ecf/documents", {
+            method: "POST";
+            body: better_auth.ZodObject<{
+                buyerHost: better_auth.ZodOptional<better_auth.ZodString>;
+                xml: better_auth.ZodString;
+                fileName: better_auth.ZodOptional<better_auth.ZodString>;
+                sign: better_auth.ZodOptional<better_auth.ZodBoolean>;
+                idempotencyKey: better_auth.ZodOptional<better_auth.ZodString>;
+                taxPayerId: better_auth.ZodOptional<better_auth.ZodString>;
+                organizationId: better_auth.ZodOptional<better_auth.ZodString>;
+            }, zod_v4_core.$strip>;
+            use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+        }, {
+            submissionId: string | null;
+            replayed: boolean;
+            result: _deuriib_dgii_ecf.InvoiceResponse | _deuriib_dgii_ecf.InvoiceSummaryResponse;
+            taxPayerId: string;
+            organizationId: string | null;
+            environment: _deuriib_dgii_ecf.Environment;
+        }>;
+        dgiiEcfSendElectronicDocument: better_auth.StrictEndpoint<"/dgii-ecf/documents/electronic", {
+            method: "POST";
+            body: better_auth.ZodObject<{
+                buyerHost: better_auth.ZodOptional<better_auth.ZodString>;
+                xml: better_auth.ZodString;
+                fileName: better_auth.ZodOptional<better_auth.ZodString>;
+                sign: better_auth.ZodOptional<better_auth.ZodBoolean>;
+                idempotencyKey: better_auth.ZodOptional<better_auth.ZodString>;
+                taxPayerId: better_auth.ZodOptional<better_auth.ZodString>;
+                organizationId: better_auth.ZodOptional<better_auth.ZodString>;
+            }, zod_v4_core.$strip>;
+            use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+        }, {
+            submissionId: string | null;
+            replayed: boolean;
+            result: _deuriib_dgii_ecf.InvoiceResponse;
+            taxPayerId: string;
+            organizationId: string | null;
+            environment: _deuriib_dgii_ecf.Environment;
+        }>;
+        dgiiEcfSendSummary: better_auth.StrictEndpoint<"/dgii-ecf/documents/summary", {
+            method: "POST";
+            body: better_auth.ZodObject<{
+                xml: better_auth.ZodString;
+                fileName: better_auth.ZodOptional<better_auth.ZodString>;
+                sign: better_auth.ZodOptional<better_auth.ZodBoolean>;
+                idempotencyKey: better_auth.ZodOptional<better_auth.ZodString>;
+                taxPayerId: better_auth.ZodOptional<better_auth.ZodString>;
+                organizationId: better_auth.ZodOptional<better_auth.ZodString>;
+            }, zod_v4_core.$strip>;
+            use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+        }, {
+            submissionId: string | null;
+            replayed: boolean;
+            result: _deuriib_dgii_ecf.InvoiceSummaryResponse;
+            taxPayerId: string;
+            organizationId: string | null;
+            environment: _deuriib_dgii_ecf.Environment;
+        }>;
+        dgiiEcfSendCommercialApproval: better_auth.StrictEndpoint<"/dgii-ecf/documents/commercial-approval", {
+            method: "POST";
+            body: better_auth.ZodObject<{
+                buyerHost: better_auth.ZodOptional<better_auth.ZodString>;
+                xml: better_auth.ZodString;
+                fileName: better_auth.ZodOptional<better_auth.ZodString>;
+                sign: better_auth.ZodOptional<better_auth.ZodBoolean>;
+                idempotencyKey: better_auth.ZodOptional<better_auth.ZodString>;
+                taxPayerId: better_auth.ZodOptional<better_auth.ZodString>;
+                organizationId: better_auth.ZodOptional<better_auth.ZodString>;
+            }, zod_v4_core.$strip>;
+            use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+        }, {
+            submissionId: string | null;
+            replayed: boolean;
+            result: _deuriib_dgii_ecf.CommercialApprovalResponse | _deuriib_dgii_ecf.B2BCommercialApprovalResponse;
+            taxPayerId: string;
+            organizationId: string | null;
+            environment: _deuriib_dgii_ecf.Environment;
+        }>;
+        dgiiEcfVoidENCF: better_auth.StrictEndpoint<"/dgii-ecf/documents/void-range", {
+            method: "POST";
+            body: better_auth.ZodObject<{
+                xml: better_auth.ZodString;
+                fileName: better_auth.ZodOptional<better_auth.ZodString>;
+                sign: better_auth.ZodOptional<better_auth.ZodBoolean>;
+                idempotencyKey: better_auth.ZodOptional<better_auth.ZodString>;
+                taxPayerId: better_auth.ZodOptional<better_auth.ZodString>;
+                organizationId: better_auth.ZodOptional<better_auth.ZodString>;
+            }, zod_v4_core.$strip>;
+            use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+        }, {
+            submissionId: string | null;
+            replayed: boolean;
+            result: _deuriib_dgii_ecf.VoidNCFResponse;
+            taxPayerId: string;
+            organizationId: string | null;
+            environment: _deuriib_dgii_ecf.Environment;
+        }>;
+        dgiiEcfReconcileSubmission: better_auth.StrictEndpoint<"/dgii-ecf/documents/reconcile", {
+            method: "POST";
+            body: better_auth.ZodObject<{
+                xml: better_auth.ZodString;
+                taxPayerId: better_auth.ZodOptional<better_auth.ZodString>;
+                organizationId: better_auth.ZodOptional<better_auth.ZodString>;
+            }, zod_v4_core.$strip>;
+            use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+        }, {
+            result: _deuriib_dgii_ecf.ReconciliationResult;
+            taxPayerId: string;
+            organizationId: string | null;
+            environment: _deuriib_dgii_ecf.Environment;
+        }>;
+        dgiiEcfTrackStatus: better_auth.StrictEndpoint<"/dgii-ecf/tracks", {
+            method: "GET";
+            query: better_auth.ZodObject<{
+                trackId: better_auth.ZodString;
+                taxPayerId: better_auth.ZodOptional<better_auth.ZodString>;
+                organizationId: better_auth.ZodOptional<better_auth.ZodString>;
+            }, zod_v4_core.$strip>;
+            use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+        }, {
+            result: _deuriib_dgii_ecf.TrackingStatusResponse;
+            taxPayerId: string;
+            organizationId: string | null;
+            environment: _deuriib_dgii_ecf.Environment;
+        }>;
+        dgiiEcfInquiryStatus: better_auth.StrictEndpoint<"/dgii-ecf/inquiries/status", {
+            method: "POST";
+            body: better_auth.ZodObject<{
+                ncf: better_auth.ZodString;
+                buyerTaxPayerId: better_auth.ZodOptional<better_auth.ZodString>;
+                securityCode: better_auth.ZodOptional<better_auth.ZodString>;
+                taxPayerId: better_auth.ZodOptional<better_auth.ZodString>;
+                organizationId: better_auth.ZodOptional<better_auth.ZodString>;
+            }, zod_v4_core.$strip>;
+            use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+        }, {
+            result: _deuriib_dgii_ecf.InquiryStatusResponse;
+            taxPayerId: string;
+            organizationId: string | null;
+            environment: _deuriib_dgii_ecf.Environment;
+        }>;
+        dgiiEcfTrackStatuses: better_auth.StrictEndpoint<"/dgii-ecf/inquiries/tracks", {
+            method: "POST";
+            body: better_auth.ZodObject<{
+                encf: better_auth.ZodString;
+                taxPayerId: better_auth.ZodOptional<better_auth.ZodString>;
+                organizationId: better_auth.ZodOptional<better_auth.ZodString>;
+            }, zod_v4_core.$strip>;
+            use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+        }, {
+            result: _deuriib_dgii_ecf.SummaryTrackingStatusResponse[];
+            taxPayerId: string;
+            organizationId: string | null;
+            environment: _deuriib_dgii_ecf.Environment;
+        }>;
+        dgiiEcfSummaryInvoiceInquiry: better_auth.StrictEndpoint<"/dgii-ecf/inquiries/summary", {
+            method: "POST";
+            body: better_auth.ZodObject<{
+                encf: better_auth.ZodString;
+                securityCode: better_auth.ZodString;
+                taxPayerId: better_auth.ZodOptional<better_auth.ZodString>;
+                organizationId: better_auth.ZodOptional<better_auth.ZodString>;
+            }, zod_v4_core.$strip>;
+            use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+        }, {
+            result: _deuriib_dgii_ecf.InquiryInvoiceSummary;
+            taxPayerId: string;
+            organizationId: string | null;
+            environment: _deuriib_dgii_ecf.Environment;
+        }>;
+        dgiiEcfCustomerDirectory: better_auth.StrictEndpoint<"/dgii-ecf/directories/customers", {
+            method: "GET";
+            query: better_auth.ZodObject<{
+                rnc: better_auth.ZodOptional<better_auth.ZodString>;
+                taxPayerId: better_auth.ZodOptional<better_auth.ZodString>;
+                organizationId: better_auth.ZodOptional<better_auth.ZodString>;
+            }, zod_v4_core.$strip>;
+            use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+        }, {
+            result: _deuriib_dgii_ecf.ServiceDirectoryResponse[];
+            taxPayerId: string;
+            organizationId: string | null;
+            environment: _deuriib_dgii_ecf.Environment;
+        }>;
+        dgiiEcfDirectoryListing: better_auth.StrictEndpoint<"/dgii-ecf/directories/all", {
+            method: "GET";
+            query: better_auth.ZodObject<{
+                taxPayerId: better_auth.ZodOptional<better_auth.ZodString>;
+                organizationId: better_auth.ZodOptional<better_auth.ZodString>;
+            }, zod_v4_core.$strip>;
+            use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+        }, {
+            result: _deuriib_dgii_ecf.ServiceDirectoryResponse[];
+            taxPayerId: string;
+            organizationId: string | null;
+            environment: _deuriib_dgii_ecf.Environment;
+        }>;
+        dgiiEcfServiceStatus: better_auth.StrictEndpoint<"/dgii-ecf/service-status", {
+            method: "GET";
+            query: better_auth.ZodObject<{
+                taxPayerId: better_auth.ZodOptional<better_auth.ZodString>;
+                organizationId: better_auth.ZodOptional<better_auth.ZodString>;
+            }, zod_v4_core.$strip>;
+            use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+        }, {
+            services: _deuriib_dgii_ecf.ServiceStatusEntry[];
+            taxPayerId: string;
+            organizationId: string | null;
+            environment: _deuriib_dgii_ecf.Environment;
+        }>;
+        dgiiEcfMaintenanceWindows: better_auth.StrictEndpoint<"/dgii-ecf/maintenance-windows", {
+            method: "GET";
+            query: better_auth.ZodObject<{
+                taxPayerId: better_auth.ZodOptional<better_auth.ZodString>;
+                organizationId: better_auth.ZodOptional<better_auth.ZodString>;
+            }, zod_v4_core.$strip>;
+            use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+        }, {
+            windows: _deuriib_dgii_ecf.MaintenanceWindow[];
+            taxPayerId: string;
+            organizationId: string | null;
+            environment: _deuriib_dgii_ecf.Environment;
+        }>;
+        dgiiEcfServiceAvailability: better_auth.StrictEndpoint<"/dgii-ecf/service-availability", {
+            method: "GET";
+            query: better_auth.ZodObject<{
+                environment: better_auth.ZodEnum<{
+                    precertification: "precertification";
+                    production: "production";
+                    certification: "certification";
+                }>;
+                taxPayerId: better_auth.ZodOptional<better_auth.ZodString>;
+                organizationId: better_auth.ZodOptional<better_auth.ZodString>;
+            }, zod_v4_core.$strip>;
+            use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+        }, {
+            environmentChecked: "precertification" | "production" | "certification";
+            estado: _deuriib_dgii_ecf.ServiceAvailability;
+            taxPayerId: string;
+            organizationId: string | null;
+            environment: _deuriib_dgii_ecf.Environment;
+        }>;
+        dgiiEcfListSubmissions: better_auth.StrictEndpoint<"/dgii-ecf/submissions", {
+            method: "GET";
+            query: better_auth.ZodObject<{
+                limit: better_auth.ZodOptional<better_auth.ZodCoercedNumber<unknown>>;
+                status: better_auth.ZodOptional<better_auth.ZodEnum<{
+                    pending: "pending";
+                    succeeded: "succeeded";
+                    failed: "failed";
+                }>>;
+                taxPayerId: better_auth.ZodOptional<better_auth.ZodString>;
+                organizationId: better_auth.ZodOptional<better_auth.ZodString>;
+            }, zod_v4_core.$strip>;
+            use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+        }, {
+            submissions: {
+                id: string;
+                operation: string;
+                status: SubmissionStatus;
+                taxPayerId: string;
+                organizationId: string | null;
+                environment: string;
+                encf: string | null;
+                trackId: string | null;
+                documentHash: string | null;
+                errorCode: string | null;
+                createdAt: string | Date | null;
+            }[];
+            taxPayerId: string;
+            organizationId: string | null;
+            environment: _deuriib_dgii_ecf.Environment;
+        }>;
+    };
+    rateLimit: {
+        window: number;
+        max: number;
+        pathMatcher: (path: string) => boolean;
+    }[];
+} & {
+    clientProvider: DgiiEcfClientProvider;
+};
+/**
+ * Public type of the plugin.
+ *
+ * `ReturnType` rather than an interface on purpose: an explicit interface would
+ * widen `endpoints` to an index signature and destroy the client-side inference
+ * that makes a renamed path a compile error.
+ */
+type DgiiEcfPlugin = ReturnType<typeof dgiiEcf>;
+
+declare module '@better-auth/core' {
+    interface BetterAuthPluginRegistry<AuthOptions, Options> {
+        'dgii-ecf': {
+            creator: typeof dgiiEcf;
+        };
+    }
+}
+
+export { type DgiiEcfPlugin as D, SUBMISSION_MODEL as S, type TaxPayerIdValidation as T, type DgiiEcfAuthorizer as a, type DgiiEcfClientCacheOptions as b, type DgiiEcfClientProvider as c, type DgiiEcfClientResolver as d, type DgiiEcfCredentialsResolver as e, type DgiiEcfOptions as f, type DgiiEcfOrganizationOptions as g, type DgiiEcfPersistenceOptions as h, type DgiiEcfScope as i, type DgiiEcfStatusOptions as j, type DgiiEcfSubmissionStore as k, type DgiiEcfTaxPayerIdResolver as l, type DgiiEcfTaxPayerIdSource as m, type SubmissionRecord as n, type SubmissionStatus as o, type TaxPayerIdValidator as p, dgiiEcf as q, dgiiEcfOrganizationSchema as r, isTaxPayerIdShape as s, normalizeTaxPayerId as t };