facturas 0.4.2 → 0.5.1

package/dist/index.js

@@ -24,10 +24,12 @@ var ArcaInputError = class extends ArcaError {
 var ArcaTransportError = class extends ArcaError {
   name = "ArcaTransportError";
   statusCode;
+  contentType;
   responseBody;
   constructor(message, options) {
     super(message, "ARCA_TRANSPORT_ERROR", options);
     this.statusCode = options?.statusCode;
+    this.contentType = options?.contentType;
     this.responseBody = options?.responseBody;
   }
 };
@@ -41,6 +43,28 @@ var ArcaSoapFaultError = class extends ArcaError {
     this.detail = options?.detail;
   }
 };
+var ArcaInvalidSoapResponseError = class extends ArcaError {
+  name = "ArcaInvalidSoapResponseError";
+  service;
+  operation;
+  endpointUrl;
+  statusCode;
+  contentType;
+  responseBodyLength;
+  responseBodyPreview;
+  parsedDetail;
+  constructor(message, options) {
+    super(message, "ARCA_INVALID_SOAP_RESPONSE", options);
+    this.service = options?.service;
+    this.operation = options?.operation;
+    this.endpointUrl = options?.endpointUrl;
+    this.statusCode = options?.statusCode;
+    this.contentType = options?.contentType;
+    this.responseBodyLength = options?.responseBodyLength;
+    this.responseBodyPreview = options?.responseBodyPreview;
+    this.parsedDetail = options?.parsedDetail;
+  }
+};
 var ArcaServiceError = class extends ArcaError {
   name = "ArcaServiceError";
   serviceCode;
@@ -125,12 +149,33 @@ function assertArcaClientConfig(config) {
   if (normalized.logger?.log !== void 0 && typeof normalized.logger.log !== "function") {
     invalidFields.push("logger.log");
   }
+  invalidFields.push(...getInvalidWsaaSessionStoreFields(normalized));
   if (invalidFields.length > 0) {
     throw new ArcaConfigurationError(
       `Missing or invalid ARCA client config fields: ${invalidFields.join(", ")}`
     );
   }
 }
+function getInvalidWsaaSessionStoreFields(config) {
+  const store = config.wsaaSessionStore;
+  if (store === void 0) {
+    return [];
+  }
+  const invalidFields = [];
+  if (typeof store.get !== "function") {
+    invalidFields.push("wsaaSessionStore.get");
+  }
+  if (typeof store.set !== "function") {
+    invalidFields.push("wsaaSessionStore.set");
+  }
+  if (store.delete !== void 0 && typeof store.delete !== "function") {
+    invalidFields.push("wsaaSessionStore.delete");
+  }
+  if (store.withLock !== void 0 && typeof store.withLock !== "function") {
+    invalidFields.push("wsaaSessionStore.withLock");
+  }
+  return invalidFields;
+}
 var ARCA_WSAA_CONFIG = {
   namespace: "http://wsaa.view.sua.dvadac.desein.afip.gov",
   endpoint: {
@@ -208,7 +253,8 @@ function normalizeArcaClientConfig(config) {
         ...config.logger,
         ...normalizedLoggerLevel === void 0 ? {} : { level: normalizedLoggerLevel }
       }
-    }
+    },
+    ...config.wsaaSessionStore === void 0 ? {} : { wsaaSessionStore: config.wsaaSessionStore }
   };
 }
 function normalizeEnvironmentValue(value) {
@@ -389,7 +435,7 @@ function createWsfeService(options) {
   async function executeWsfeAuthenticatedOperation(operation, input, body = {}) {
     const auth = await options.auth.login("wsfe", {
       representedTaxId: input.representedTaxId,
-      forceRefresh: input.forceAuthRefresh
+      forceRefresh: input.forceRefresh
     });
     const response = await options.soap.execute({
       service: "wsfe",
@@ -417,13 +463,13 @@ function createWsfeService(options) {
     representedTaxId,
     salesPoint,
     voucherType,
-    forceAuthRefresh
+    forceRefresh
   }) {
     const result = await executeWsfeAuthenticatedOperation(
       "FECompUltimoAutorizado",
       {
         representedTaxId,
-        forceAuthRefresh
+        forceRefresh
       },
       {
         PtoVta: salesPoint,
@@ -435,29 +481,35 @@ function createWsfeService(options) {
   async function getWsfeCatalog(operation, resultKey, input) {
     const result = await executeWsfeAuthenticatedOperation(operation, {
       representedTaxId: input.representedTaxId,
-      forceAuthRefresh: input.forceAuthRefresh
+      forceRefresh: input.forceRefresh
     });
     return getWsfeResultEntries(result, resultKey).map(mapWsfeCatalogEntry);
   }
   function authorizeVoucher({
     representedTaxId,
     data,
-    voucherNumber
+    voucherNumber,
+    forceRefresh
   }) {
     const normalizedInput = normalizeWsfeVoucherInput(data);
     return authorizeNormalizedVoucher({
       representedTaxId,
       data: normalizedInput,
-      voucherNumber
+      voucherNumber,
+      forceRefresh
     });
   }
   async function authorizeNormalizedVoucher({
     representedTaxId,
     data: normalizedInput,
-    voucherNumber
+    voucherNumber,
+    forceRefresh
   }) {
     const requestData = mapWsfeVoucherInput(normalizedInput, voucherNumber);
-    const auth = await options.auth.login("wsfe", { representedTaxId });
+    const auth = await options.auth.login("wsfe", {
+      representedTaxId,
+      forceRefresh
+    });
     const response = await options.soap.execute({
       service: "wsfe",
       operation: "FECAESolicitar",
@@ -497,12 +549,13 @@ function createWsfeService(options) {
   }
   return {
     authorizeVoucher,
-    async createNextVoucher({ representedTaxId, data }) {
+    async createNextVoucher({ representedTaxId, data, forceRefresh }) {
       const normalizedInput = normalizeWsfeVoucherInput(data);
       const voucherNumber = await getNextVoucherNumber({
         representedTaxId,
         salesPoint: normalizedInput.salesPoint,
-        voucherType: normalizedInput.voucherType
+        voucherType: normalizedInput.voucherType,
+        forceRefresh
       });
       return authorizeNormalizedVoucher({
         representedTaxId,
@@ -514,12 +567,12 @@ function createWsfeService(options) {
     getLastVoucher(input) {
       return getNextVoucherNumber(input);
     },
-    async getSalesPoints({ representedTaxId, forceAuthRefresh }) {
+    async getSalesPoints({ representedTaxId, forceRefresh }) {
       const result = await executeWsfeAuthenticatedOperation(
         "FEParamGetPtosVenta",
         {
           representedTaxId,
-          forceAuthRefresh
+          forceRefresh
         }
       );
       const rawPoints = result.ResultGet?.PtoVenta;
@@ -538,12 +591,12 @@ function createWsfeService(options) {
     getConceptTypes(input) {
       return getWsfeCatalog("FEParamGetTiposConcepto", "ConceptoTipo", input);
     },
-    async getCurrencyTypes({ representedTaxId, forceAuthRefresh }) {
+    async getCurrencyTypes({ representedTaxId, forceRefresh }) {
       const result = await executeWsfeAuthenticatedOperation(
         "FEParamGetTiposMonedas",
         {
           representedTaxId,
-          forceAuthRefresh
+          forceRefresh
         }
       );
       return getWsfeResultEntries(result, "Moneda").map(mapWsfeCurrencyType);
@@ -557,12 +610,12 @@ function createWsfeService(options) {
     getOptionalTypes(input) {
       return getWsfeCatalog("FEParamGetTiposOpcional", "OpcionalTipo", input);
     },
-    async getActivities({ representedTaxId, forceAuthRefresh }) {
+    async getActivities({ representedTaxId, forceRefresh }) {
       const result = await executeWsfeAuthenticatedOperation(
         "FEParamGetActividades",
         {
           representedTaxId,
-          forceAuthRefresh
+          forceRefresh
         }
       );
       return getWsfeResultEntries(result, "ActividadesTipo").map(
@@ -572,13 +625,13 @@ function createWsfeService(options) {
     async getReceiverVatConditions({
       representedTaxId,
       voucherClass,
-      forceAuthRefresh
+      forceRefresh
     }) {
       const result = await executeWsfeAuthenticatedOperation(
         "FEParamGetCondicionIvaReceptor",
         {
           representedTaxId,
-          forceAuthRefresh
+          forceRefresh
         },
         {
           ...voucherClass === void 0 ? {} : { ClaseCmp: voucherClass }
@@ -592,12 +645,12 @@ function createWsfeService(options) {
       const result = await executeWsfeOperation("FEDummy");
       return mapWsfeServerStatus(result);
     },
-    async getQuotation({ currencyId, representedTaxId, forceAuthRefresh }) {
+    async getQuotation({ currencyId, representedTaxId, forceRefresh }) {
       const result = await executeWsfeAuthenticatedOperation(
         "FEParamGetCotizacion",
         {
           representedTaxId,
-          forceAuthRefresh
+          forceRefresh
         },
         {
           MonId: currencyId
@@ -610,12 +663,14 @@ function createWsfeService(options) {
       representedTaxId,
       number,
       salesPoint,
-      voucherType
+      voucherType,
+      forceRefresh
     }) {
       const result = await executeWsfeAuthenticatedOperation(
         "FECompConsultar",
         {
-          representedTaxId
+          representedTaxId,
+          forceRefresh
         },
         {
           FeCompConsReq: {
@@ -989,8 +1044,11 @@ function getWsfeResultEntries(result, key) {
 // src/services/wsmtxca.ts
 function createWsmtxcaService(options) {
   return {
-    async authorizeVoucher({ representedTaxId, data }) {
-      const auth = await options.auth.login("wsmtxca", { representedTaxId });
+    async authorizeVoucher({ representedTaxId, data, forceRefresh }) {
+      const auth = await options.auth.login("wsmtxca", {
+        representedTaxId,
+        forceRefresh
+      });
       const response = await options.soap.execute({
         service: "wsmtxca",
         operation: "autorizarComprobante",
@@ -1036,9 +1094,13 @@ function createWsmtxcaService(options) {
     async getLastAuthorizedVoucher({
       representedTaxId,
       voucherType,
-      salesPoint
+      salesPoint,
+      forceRefresh
     }) {
-      const auth = await options.auth.login("wsmtxca", { representedTaxId });
+      const auth = await options.auth.login("wsmtxca", {
+        representedTaxId,
+        forceRefresh
+      });
       const response = await options.soap.execute({
         service: "wsmtxca",
         operation: "consultarUltimoComprobanteAutorizado",
@@ -1073,9 +1135,13 @@ function createWsmtxcaService(options) {
       representedTaxId,
       voucherType,
       salesPoint,
-      voucherNumber
+      voucherNumber,
+      forceRefresh
     }) {
-      const auth = await options.auth.login("wsmtxca", { representedTaxId });
+      const auth = await options.auth.login("wsmtxca", {
+        representedTaxId,
+        forceRefresh
+      });
       const response = await options.soap.execute({
         service: "wsmtxca",
         operation: "consultarComprobante",
@@ -1219,7 +1285,7 @@ var legacyTlsAgent = new https.Agent({
   keepAlive: true,
   ciphers: "DEFAULT@SECLEVEL=0"
 });
-async function postXml({
+async function postXmlWithMetadata({
   url,
   body,
   contentType,
@@ -1287,12 +1353,12 @@ async function postXmlOnce({
   const requestBody = Buffer.from(body, "utf8");
   return await new Promise((resolve, reject) => {
     let settled = false;
-    const settleResolve = (responseBody) => {
+    const settleResolve = (response) => {
       if (settled) {
         return;
       }
       settled = true;
-      resolve(responseBody);
+      resolve(response);
     };
     const settleReject = (error) => {
       if (settled) {
@@ -1351,11 +1417,19 @@ async function postXmlOnce({
             response.headers["content-type"]
           ) ? response.headers["content-type"].join("; ") : response.headers["content-type"];
           if (statusCode >= 200 && statusCode < 300) {
-            settleResolve(responseBody);
+            settleResolve({
+              body: responseBody,
+              statusCode,
+              contentType: responseContentType
+            });
             return;
           }
           if (isXmlLikeResponse(responseBody, responseContentType)) {
-            settleResolve(responseBody);
+            settleResolve({
+              body: responseBody,
+              statusCode,
+              contentType: responseContentType
+            });
             return;
           }
           settleReject(
@@ -1363,6 +1437,7 @@ async function postXmlOnce({
               `ARCA HTTP request failed with status ${statusCode}`,
               {
                 statusCode,
+                contentType: responseContentType,
                 responseBody
               }
             )
@@ -1437,14 +1512,26 @@ function buildSoapEnvelope(soapVersion, operation, namespace, body, options) {
   };
   return `<?xml version="1.0" encoding="utf-8"?>${xmlBuilder.build(payload)}`;
 }
-function parseSoapBody(xml) {
-  const parsed = xmlParser.parse(xml);
+function parseSoapBody(xml, context = {}) {
+  let parsed;
+  try {
+    parsed = xmlParser.parse(xml);
+  } catch (error) {
+    throw createInvalidSoapResponseError(
+      "Invalid SOAP response: XML parse failed",
+      context,
+      void 0,
+      error instanceof Error ? error : void 0
+    );
+  }
   const envelope = parsed.Envelope;
   const body = envelope?.Body;
   if (!body) {
-    throw new ArcaSoapFaultError("Invalid SOAP response: missing body", {
-      detail: parsed
-    });
+    throw createInvalidSoapResponseError(
+      "Invalid SOAP response: missing body",
+      context,
+      parsed
+    );
   }
   const fault = body.Fault;
   if (fault) {
@@ -1452,18 +1539,40 @@ function parseSoapBody(xml) {
   }
   return body;
 }
-function getSingleBodyEntry(body) {
+function getSingleBodyEntry(body, context = {}) {
   const entries = Object.entries(body).filter(([key]) => key !== "@_xmlns");
   if (entries.length !== 1) {
-    throw new ArcaSoapFaultError(
+    throw createInvalidSoapResponseError(
       `Invalid SOAP response: expected a single body entry, got ${entries.length}`,
-      {
-        detail: body
-      }
+      context,
+      body
     );
   }
   return entries[0];
 }
+function createInvalidSoapResponseError(message, context, parsedDetail, cause) {
+  const responseBody = context.responseBody ?? "";
+  return new ArcaInvalidSoapResponseError(message, {
+    cause,
+    service: context.service,
+    operation: context.operation,
+    endpointUrl: context.endpointUrl,
+    statusCode: context.statusCode,
+    contentType: context.contentType,
+    responseBodyLength: responseBody.length,
+    responseBodyPreview: sanitizeSoapResponsePreview(
+      responseBody,
+      context.responseBodyPreviewLength
+    ),
+    parsedDetail
+  });
+}
+function sanitizeSoapResponsePreview(responseBody, maxLength = 4096) {
+  return responseBody.replace(
+    /<((?:[A-Za-z_][\w.-]*:)?(?:Token|Sign))\b([^>]*)>[\s\S]*?<\/\1>/gi,
+    (_match, tagName, attributes) => `<${tagName}${attributes}>[REDACTED]</${tagName}>`
+  ).slice(0, maxLength);
+}
 function parseXmlDocument(xml) {
   return xmlParser.parse(xml);
 }
@@ -1522,7 +1631,7 @@ function createSoapTransport(options) {
         url
       });
       try {
-        const responseXml = await postXml({
+        const response = await postXmlWithMetadata({
           url,
           body: xml,
           contentType,
@@ -1540,12 +1649,23 @@ function createSoapTransport(options) {
           operation: request.operation,
           durationMs: Date.now() - startedAt
         });
-        const soapBody = parseSoapBody(responseXml);
-        const [, result] = getSingleBodyEntry(soapBody);
+        const parseContext = {
+          service: request.service,
+          operation: request.operation,
+          endpointUrl: url,
+          statusCode: response.statusCode,
+          contentType: response.contentType,
+          responseBody: response.body
+        };
+        const soapBody = parseSoapBody(response.body, parseContext);
+        const [, result] = getSingleBodyEntry(
+          soapBody,
+          parseContext
+        );
         return {
           service: request.service,
           operation: request.operation,
-          raw: responseXml,
+          raw: response.body,
           result
         };
       } catch (error) {
@@ -1558,6 +1678,17 @@ function createSoapTransport(options) {
             error
           });
         }
+        if (error instanceof ArcaInvalidSoapResponseError) {
+          options.logger?.error("ARCA invalid SOAP response", {
+            service: request.service,
+            operation: request.operation,
+            url,
+            statusCode: error.statusCode,
+            contentType: error.contentType,
+            responseBodyLength: error.responseBodyLength,
+            error
+          });
+        }
         throw error;
       }
     }
@@ -1567,48 +1698,117 @@ function createSoapTransport(options) {
 // src/wsaa/index.ts
 import { createHash } from "crypto";
 import forge from "node-forge";
+
+// src/wsaa/session-store.ts
+var CREDENTIAL_EXPIRY_SAFETY_MARGIN_MS = 6e4;
+function createMemoryWsaaSessionStore() {
+  const sessions = /* @__PURE__ */ new Map();
+  const locks = /* @__PURE__ */ new Map();
+  return {
+    get(key) {
+      const credentials = sessions.get(serializeWsaaSessionKey(key));
+      if (!(credentials && isWsaaCredentialValid(credentials))) {
+        return Promise.resolve(null);
+      }
+      return Promise.resolve({ ...credentials });
+    },
+    set(key, credentials) {
+      sessions.set(serializeWsaaSessionKey(key), { ...credentials });
+      return Promise.resolve();
+    },
+    delete(key) {
+      sessions.delete(serializeWsaaSessionKey(key));
+      return Promise.resolve();
+    },
+    async withLock(key, fn) {
+      const lockKey = serializeWsaaSessionKey(key);
+      const previous = locks.get(lockKey) ?? Promise.resolve();
+      let release = () => void 0;
+      const current = new Promise((resolve) => {
+        release = resolve;
+      });
+      const queued = previous.catch(() => void 0).then(() => current);
+      locks.set(lockKey, queued);
+      await previous.catch(() => void 0);
+      try {
+        return await fn();
+      } finally {
+        release();
+        if (locks.get(lockKey) === queued) {
+          locks.delete(lockKey);
+        }
+      }
+    }
+  };
+}
+function serializeWsaaSessionKey(key) {
+  return [key.environment, key.service, key.certificateFingerprint].join(":");
+}
+function isWsaaCredentialValid(credentials) {
+  return new Date(credentials.expiresAt).getTime() - Date.now() > CREDENTIAL_EXPIRY_SAFETY_MARGIN_MS;
+}
+
+// src/wsaa/index.ts
 function createWsaaAuthModule(options) {
   const cache = /* @__PURE__ */ new Map();
   const inFlight = /* @__PURE__ */ new Map();
   return {
     async login(service, authOptions = {}) {
-      const cacheKey = buildWsaaCacheKey(options.config, service);
+      const sessionKey = buildWsaaSessionKey(options.config, service);
+      const cacheKey = serializeWsaaSessionKey(sessionKey);
       const running = inFlight.get(cacheKey);
       if (running) {
         return running;
       }
       const loginPromise = (async () => {
-        if (!authOptions.forceRefresh) {
-          const cached = getCachedCredentials(cache, cacheKey);
-          if (cached) {
-            options.logger?.debug("Attempting WSAA login", {
-              service,
-              source: "cached"
-            });
-            return cached;
-          }
-        }
-        options.logger?.debug("Attempting WSAA login", {
+        const reuse = await getReusableCredentials({
+          config: options.config,
+          cache,
+          cacheKey,
+          sessionKey,
+          logger: options.logger,
           service,
-          source: "fresh"
-        });
-        const credentials = await requestCredentials(options.config, service, {
-          logger: options.logger
+          allowStore: !authOptions.forceRefresh,
+          allowCache: !authOptions.forceRefresh
         });
-        options.logger?.info("WSAA login succeeded", {
+        if (reuse) {
+          return reuse;
+        }
+        const refresh = () => refreshWsaaCredentials({
+          config: options.config,
+          cache,
+          cacheKey,
+          sessionKey,
+          logger: options.logger,
           service,
-          expiresAt: credentials.expiresAt
+          forceRefresh: authOptions.forceRefresh === true
         });
-        cache.set(cacheKey, credentials);
-        return credentials;
+        if (options.config.wsaaSessionStore?.withLock) {
+          return await withWsaaSessionStoreLock(
+            options.config,
+            sessionKey,
+            service,
+            refresh
+          );
+        }
+        return await refresh();
       })();
       inFlight.set(cacheKey, loginPromise);
       try {
         return await loginPromise;
       } catch (error) {
-        if (!authOptions.forceRefresh && error instanceof ArcaSoapFaultError && error.faultCode === "ns1:coe.alreadyAuthenticated") {
-          const cached = getCachedCredentials(cache, cacheKey);
-          if (cached) {
+        if (error instanceof ArcaSoapFaultError && error.faultCode === "ns1:coe.alreadyAuthenticated") {
+          const recovered = await getReusableCredentials({
+            config: options.config,
+            cache,
+            cacheKey,
+            sessionKey,
+            logger: options.logger,
+            service,
+            allowStore: true,
+            allowCache: true
+          });
+          if (recovered) {
             options.logger?.warn(
               "Recovered WSAA coe.alreadyAuthenticated fault",
               {
@@ -1616,7 +1816,13 @@ function createWsaaAuthModule(options) {
                 faultCode: error.faultCode
               }
             );
-            return cached;
+            return recovered;
+          }
+          if (!options.config.wsaaSessionStore) {
+            throw new ArcaConfigurationError(
+              "WSAA login failed because another process likely owns a valid TA. Configure a durable wsaaSessionStore for multi-process or serverless deployments.",
+              { cause: error }
+            );
           }
         }
         if (error instanceof ArcaSoapFaultError) {
@@ -1647,7 +1853,8 @@ async function requestCredentials(config, service, options) {
     ARCA_WSAA_CONFIG.namespace,
     { in0: signedCms }
   );
-  const responseXml = await postXml({
+  const url = ARCA_WSAA_CONFIG.endpoint[config.environment];
+  const response = await postXmlWithMetadata({
     url: ARCA_WSAA_CONFIG.endpoint[config.environment],
     body: requestXml,
     contentType: 'text/xml; charset="utf-8"',
@@ -1659,9 +1866,20 @@ async function requestCredentials(config, service, options) {
     service: "wsaa",
     operation: "loginCms"
   });
-  const soapBody = parseSoapBody(responseXml);
-  const [, response] = getSingleBodyEntry(soapBody);
-  const loginCmsReturn = response.loginCmsReturn;
+  const parseContext = {
+    service: "wsaa",
+    operation: "loginCms",
+    endpointUrl: url,
+    statusCode: response.statusCode,
+    contentType: response.contentType,
+    responseBody: response.body
+  };
+  const soapBody = parseSoapBody(response.body, parseContext);
+  const [, responseBody] = getSingleBodyEntry(
+    soapBody,
+    parseContext
+  );
+  const loginCmsReturn = responseBody.loginCmsReturn;
   if (typeof loginCmsReturn !== "string" || loginCmsReturn.trim().length < 1) {
     throw new ArcaTransportError(
       "WSAA response did not include loginCmsReturn XML"
@@ -1669,24 +1887,141 @@ async function requestCredentials(config, service, options) {
   }
   return parseLoginTicketResponse(loginCmsReturn);
 }
-function buildWsaaCacheKey(config, service) {
-  return [config.environment, service, getCertificateFingerprint(config)].join(
-    ":"
-  );
+function buildWsaaSessionKey(config, service) {
+  return {
+    environment: config.environment,
+    service,
+    certificateFingerprint: getCertificateFingerprint(config)
+  };
 }
 function getCertificateFingerprint(config) {
   return createHash("sha256").update(config.certificatePem).digest("hex");
 }
-function isCredentialValid(credentials) {
-  return new Date(credentials.expiresAt).getTime() - Date.now() > 6e4;
-}
 function getCachedCredentials(cache, cacheKey) {
   const localCached = cache.get(cacheKey);
-  if (localCached && isCredentialValid(localCached)) {
+  if (localCached && isWsaaCredentialValid(localCached)) {
     return localCached;
   }
   return null;
 }
+async function getReusableCredentials(options) {
+  if (options.allowCache) {
+    const cached = getCachedCredentials(options.cache, options.cacheKey);
+    if (cached) {
+      options.logger?.debug("Attempting WSAA login", {
+        service: options.service,
+        source: "cached"
+      });
+      return cached;
+    }
+  }
+  if (!(options.allowStore && options.config.wsaaSessionStore)) {
+    return null;
+  }
+  const stored = await getStoredCredentials(
+    options.config,
+    options.sessionKey,
+    options.service
+  );
+  if (!stored) {
+    return null;
+  }
+  options.cache.set(options.cacheKey, stored);
+  options.logger?.debug("Attempting WSAA login", {
+    service: options.service,
+    source: "store"
+  });
+  return stored;
+}
+async function refreshWsaaCredentials(options) {
+  if (!options.forceRefresh) {
+    const reuse = await getReusableCredentials({
+      config: options.config,
+      cache: options.cache,
+      cacheKey: options.cacheKey,
+      sessionKey: options.sessionKey,
+      logger: options.logger,
+      service: options.service,
+      allowStore: true,
+      allowCache: true
+    });
+    if (reuse) {
+      return reuse;
+    }
+  }
+  options.logger?.debug("Attempting WSAA login", {
+    service: options.service,
+    source: "fresh"
+  });
+  const credentials = await requestCredentials(
+    options.config,
+    options.service,
+    {
+      logger: options.logger
+    }
+  );
+  options.logger?.info("WSAA login succeeded", {
+    service: options.service,
+    expiresAt: credentials.expiresAt
+  });
+  options.cache.set(options.cacheKey, credentials);
+  await setStoredCredentials(options.config, options.sessionKey, credentials);
+  return credentials;
+}
+async function getStoredCredentials(config, key, service) {
+  if (!config.wsaaSessionStore) {
+    return null;
+  }
+  try {
+    const credentials = await config.wsaaSessionStore.get(key);
+    if (!(credentials && isWsaaCredentialValid(credentials))) {
+      return null;
+    }
+    return credentials;
+  } catch (error) {
+    throw new ArcaConfigurationError(
+      `WSAA session store get failed for service ${service}`,
+      { cause: error instanceof Error ? error : void 0 }
+    );
+  }
+}
+async function setStoredCredentials(config, key, credentials) {
+  if (!config.wsaaSessionStore) {
+    return;
+  }
+  try {
+    await config.wsaaSessionStore.set(key, credentials);
+  } catch (error) {
+    throw new ArcaConfigurationError(
+      `WSAA session store set failed for service ${key.service}`,
+      { cause: error instanceof Error ? error : void 0 }
+    );
+  }
+}
+async function withWsaaSessionStoreLock(config, key, service, fn) {
+  const store = config.wsaaSessionStore;
+  if (!store?.withLock) {
+    return await fn();
+  }
+  let entered = false;
+  try {
+    return await store.withLock(key, async () => {
+      entered = true;
+      return await fn();
+    });
+  } catch (error) {
+    if (entered) {
+      throw error;
+    }
+    if (error instanceof ArcaConfigurationError) {
+      throw error;
+    }
+    throw new ArcaConfigurationError(
+      `WSAA session store lock failed for service ${service}`,
+      { cause: error instanceof Error ? error : void 0 }
+    );
+  }
+}
 function buildLoginTicketRequest(service) {
   const uniqueId = Math.floor(Date.now() / 1e3);
   const generationTime = new Date(Date.now() - 5 * 6e4).toISOString().replace(".000Z", "Z");
@@ -1771,12 +2106,14 @@ export {
   ArcaConfigurationError,
   ArcaError,
   ArcaInputError,
+  ArcaInvalidSoapResponseError,
   ArcaServiceError,
   ArcaSoapFaultError,
   ArcaTransportError,
   assertArcaClientConfig,
   createArcaClient,
   createArcaClientConfigFromEnv,
+  createMemoryWsaaSessionStore,
   createPadronService,
   createWsfeService,
   createWsmtxcaService,