facturas 0.9.0 → 0.11.0

package/dist/cli.mjs

@@ -0,0 +1,2316 @@
+import {
+  ARCA_ENVIRONMENTS,
+  ARCA_WSAA_CONFIG,
+  assertArcaClientConfig,
+  createArcaClient,
+  createFileStore,
+  createWsaaAuthModule,
+  createWsaaStoreAdapter,
+  discoverArcaClientConfig
+} from "./chunk-LOWV7IF6.mjs";
+import "./chunk-7LEKQ4P7.mjs";
+import "./chunk-5KCTRQJX.mjs";
+import "./chunk-GX5ERXT6.mjs";
+import "./chunk-ALH5IPSY.mjs";
+import "./chunk-UDX6HLAU.mjs";
+import {
+  ArcaConfigurationError,
+  ArcaServiceError,
+  ArcaSoapFaultError,
+  ArcaTransportError,
+  isArcaAuthenticationError,
+  toArcaSafeErrorMetadata
+} from "./chunk-ZOSNASXB.mjs";
+
+// src/cli/main.ts
+import { tmpdir } from "os";
+import { join as join2 } from "path";
+import { parseArgs } from "util";
+
+// src/cli/cert.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { isAbsolute, resolve as resolve2 } from "path";
+
+// src/cli/csr.ts
+import forge from "node-forge";
+var RSA_MODULUS_BITS = 2048;
+var RSA_PUBLIC_EXPONENT = 65537;
+var SUBJECT_TAX_ID = /^CUIT\s+(\d{11})$/;
+function buildArcaCsrSubject(subject) {
+  return [
+    { name: "countryName", value: "AR" },
+    { name: "organizationName", value: subject.organization },
+    { name: "commonName", value: subject.commonName },
+    { name: "serialNumber", value: `CUIT ${subject.taxId}` }
+  ];
+}
+function createArcaCsrMaterial(subject) {
+  const keyPair = forge.pki.rsa.generateKeyPair({
+    bits: RSA_MODULUS_BITS,
+    e: RSA_PUBLIC_EXPONENT
+  });
+  const privateKeyPem = toPkcs8Pem(keyPair.privateKey);
+  const request = forge.pki.createCertificationRequest();
+  request.publicKey = keyPair.publicKey;
+  request.setSubject(buildArcaCsrSubject(subject));
+  request.sign(keyPair.privateKey, forge.md.sha256.create());
+  return {
+    privateKeyPem,
+    csrPem: forge.pki.certificationRequestToPem(request)
+  };
+}
+function toPkcs8Pem(privateKey) {
+  return forge.pki.privateKeyInfoToPem(
+    forge.pki.wrapRsaPrivateKey(forge.pki.privateKeyToAsn1(privateKey))
+  );
+}
+function readCertificateFacts(certificatePem) {
+  const certificate = forge.pki.certificateFromPem(certificatePem);
+  const taxId = readSubjectTaxId(certificate);
+  return {
+    notBefore: certificate.validity.notBefore,
+    notAfter: certificate.validity.notAfter,
+    ...taxId === void 0 ? {} : { taxId }
+  };
+}
+function readCsrTaxId(csrPem) {
+  return readSubjectTaxId(forge.pki.certificationRequestFromPem(csrPem));
+}
+function readSubjectTaxId(source) {
+  const field = source.subject.getField({ name: "serialNumber" });
+  if (typeof field?.value !== "string") {
+    return void 0;
+  }
+  return SUBJECT_TAX_ID.exec(field.value.trim())?.[1];
+}
+function privateKeyMatchesCertificate(certificatePem, privateKeyPem) {
+  const certificate = forge.pki.certificateFromPem(certificatePem);
+  const privateKey = forge.pki.privateKeyFromPem(privateKeyPem);
+  const certificateKey = certificate.publicKey;
+  if (certificateKey?.n === void 0 || certificateKey.e === void 0) {
+    return false;
+  }
+  return certificateKey.n.compareTo(privateKey.n) === 0 && certificateKey.e.compareTo(privateKey.e) === 0;
+}
+
+// src/cli/discover.ts
+import { existsSync, readFileSync } from "fs";
+import { resolve } from "path";
+var DISCOVERY_ORDER = [
+  "test",
+  "production"
+];
+function toEnvironment(value) {
+  return ARCA_ENVIRONMENTS.includes(value) ? value : void 0;
+}
+function certificateFileName(environment) {
+  return `arca-${environment}.crt`;
+}
+function privateKeyFileName(environment) {
+  return `arca-${environment}.key`;
+}
+function discoverCredentials(directory, environment) {
+  const candidates = (environment === void 0 ? DISCOVERY_ORDER : [environment]).map((candidate) => {
+    const certificateFile = certificateFileName(candidate);
+    const keyFile = privateKeyFileName(candidate);
+    return {
+      environment: candidate,
+      certificateFile,
+      keyFile,
+      hasCertificate: existsSync(resolve(directory, certificateFile)),
+      hasKey: existsSync(resolve(directory, keyFile))
+    };
+  });
+  const complete = candidates.filter(
+    (candidate) => candidate.hasCertificate && candidate.hasKey
+  );
+  if (complete.length > 1) {
+    return {
+      kind: "ambiguous",
+      files: complete.map((candidate) => candidate.certificateFile)
+    };
+  }
+  const [pair] = complete;
+  if (pair !== void 0) {
+    return {
+      kind: "found",
+      credentials: {
+        environment: pair.environment,
+        certificateFile: pair.certificateFile,
+        keyFile: pair.keyFile,
+        certificatePem: read(directory, pair.certificateFile),
+        privateKeyPem: read(directory, pair.keyFile)
+      }
+    };
+  }
+  const half = candidates.find(
+    (candidate) => candidate.hasCertificate || candidate.hasKey
+  );
+  if (half === void 0) {
+    return { kind: "none" };
+  }
+  return half.hasCertificate ? {
+    kind: "incomplete",
+    present: half.certificateFile,
+    missing: half.keyFile,
+    missingKind: "key"
+  } : {
+    kind: "incomplete",
+    present: half.keyFile,
+    missing: half.certificateFile,
+    missingKind: "certificate"
+  };
+}
+function read(directory, file) {
+  return readFileSync(resolve(directory, file), "utf8").trim();
+}
+
+// src/cli/output.ts
+var CLI_EXIT = {
+  ok: 0,
+  failed: 1,
+  usage: 2
+};
+var GREEN = "\x1B[32m";
+var RED = "\x1B[31m";
+var YELLOW = "\x1B[33m";
+var CYAN = "\x1B[36m";
+var BOLD = "\x1B[1m";
+var DIM = "\x1B[2m";
+var RESET = "\x1B[0m";
+var LABEL_WIDTH = 22;
+var INDENT = "  ";
+function createPainter(color) {
+  const paint = (code) => (text2) => color ? `${code}${text2}${RESET}` : text2;
+  return {
+    green: paint(GREEN),
+    red: paint(RED),
+    yellow: paint(YELLOW),
+    cyan: paint(CYAN),
+    bold: paint(BOLD),
+    dim: paint(DIM)
+  };
+}
+function shouldUseColor(stream, env, noColorFlag = false) {
+  if (noColorFlag || env.NO_COLOR !== void 0) {
+    return false;
+  }
+  if (env.FORCE_COLOR !== void 0) {
+    return env.FORCE_COLOR !== "0";
+  }
+  return stream.isTTY === true;
+}
+function createWriter(stream, options) {
+  const painter = createPainter(options.color);
+  const mark = (symbol, label, detail) => {
+    const body = detail === void 0 ? label : `${label.padEnd(LABEL_WIDTH)} ${detail}`;
+    stream.write(`${symbol} ${body}
+`);
+  };
+  return {
+    painter,
+    ok(label, detail) {
+      mark(painter.green("\u2713"), label, detail);
+    },
+    fail(label, detail) {
+      mark(painter.red("\u2717"), label, detail);
+    },
+    warn(label, detail) {
+      mark(painter.yellow("!"), label, detail);
+    },
+    note(text2) {
+      stream.write(`${INDENT}${text2}
+`);
+    },
+    line(text2) {
+      stream.write(`${text2}
+`);
+    },
+    dim(text2) {
+      stream.write(`${painter.dim(text2)}
+`);
+    },
+    command(text2) {
+      stream.write(`${INDENT}${painter.dim("$")} ${painter.cyan(text2)}
+`);
+    },
+    blank() {
+      stream.write("\n");
+    },
+    json(value) {
+      stream.write(`${JSON.stringify(value, null, 2)}
+`);
+    }
+  };
+}
+
+// src/cli/prompt.ts
+import { createInterface } from "readline/promises";
+function isInteractive(io) {
+  return io.stdin.isTTY === true;
+}
+async function ask(io, question) {
+  const rl = createInterface({
+    input: io.stdin,
+    output: io.stdout
+  });
+  try {
+    const answer = await rl.question(question);
+    return answer.trim();
+  } finally {
+    rl.close();
+  }
+}
+async function askBlock(io, prompt, endsAt) {
+  io.stdout.write(prompt);
+  const rl = createInterface({
+    input: io.stdin,
+    output: io.stdout
+  });
+  const lines = [];
+  let complete = false;
+  rl.on("SIGINT", () => rl.close());
+  try {
+    for await (const raw of rl) {
+      const line = raw.trim();
+      if (lines.length === 0 && line === "") {
+        continue;
+      }
+      lines.push(line);
+      if (endsAt(line)) {
+        complete = true;
+        break;
+      }
+    }
+  } finally {
+    rl.close();
+  }
+  return complete ? lines : void 0;
+}
+
+// src/cli/cert.ts
+var BEGIN = "-----BEGIN CERTIFICATE-----";
+var END = "-----END CERTIFICATE-----";
+var PROMPT = "> ";
+var PASTE_ATTEMPTS = 3;
+var NOT_A_CERTIFICATE = [
+  "Eso no parece un certificado PEM. Tiene que ir de",
+  `${BEGIN} a ${END}.`
+];
+async function pasteCertificate(io, writer, request) {
+  const interactive = isInteractive(io);
+  if (request.intro.length > 0) {
+    writer.blank();
+    for (const line of request.intro) {
+      writer.line(line);
+    }
+    writer.blank();
+  }
+  for (let attempt = 1; attempt <= PASTE_ATTEMPTS; attempt += 1) {
+    const lines = await askBlock(
+      io,
+      interactive ? PROMPT : "",
+      (line) => line === END
+    );
+    if (lines === void 0) {
+      return "cancelled";
+    }
+    const pem = toCertificatePem(lines);
+    const facts = readFacts(pem);
+    if (facts === void 0) {
+      for (const line of NOT_A_CERTIFICATE) {
+        io.stderr.write(`${line}
+`);
+      }
+      if (interactive && attempt < PASTE_ATTEMPTS) {
+        writer.blank();
+      }
+      continue;
+    }
+    const refusal = refuse(pem, facts, request);
+    if (refusal !== void 0) {
+      io.stderr.write(`${refusal}
+`);
+      return "refused";
+    }
+    writeFileSync(request.certificatePath, pem);
+    writer.ok(
+      request.certificateName,
+      `certificado guardado, vence ${isoDate(facts.notAfter)}`
+    );
+    return "saved";
+  }
+  return "exhausted";
+}
+function writeManualHint(writer, certificateName) {
+  writer.blank();
+  writer.line(
+    `Cuando tengas el certificado, guardalo ac\xE1 como ${certificateName},`
+  );
+  writer.line("o pegalo con npx facturas cert, y corr\xE9:");
+  writer.blank();
+  writer.command("npx facturas check");
+}
+async function runCert(io, flags, writer) {
+  const directory = isAbsolute(flags.dir ?? "") ? flags.dir : resolve2(io.cwd, flags.dir ?? ".");
+  const asked = flags.env?.trim().toLowerCase();
+  const environment = asked === void 0 || asked === "" ? void 0 : toEnvironment(asked);
+  if (asked !== void 0 && asked !== "" && environment === void 0) {
+    io.stderr.write("Falta el entorno. Pas\xE1 --env test o --env production.\n");
+    return CLI_EXIT.usage;
+  }
+  const found = findKeys(directory, environment);
+  if (found.length > 1) {
+    io.stderr.write(
+      `Est\xE1n ${found.map((candidate) => candidate.keyName).join(" y ")} en este directorio
+`
+    );
+    io.stderr.write(
+      "y no s\xE9 cu\xE1l quer\xE9s. Eleg\xED con --env test o --env production.\n"
+    );
+    return CLI_EXIT.failed;
+  }
+  const [target] = found;
+  if (target === void 0) {
+    const names = (environment === void 0 ? DISCOVERY_ORDER : [environment]).map((candidate) => privateKeyFileName(candidate)).join(" ni ");
+    io.stderr.write(`No encontr\xE9 ${names} en este directorio.
+`);
+    io.stderr.write("Gener\xE1 la clave y el CSR con npx facturas init.\n");
+    return CLI_EXIT.failed;
+  }
+  const certificatePath = resolve2(directory, target.certificateName);
+  if (existsSync2(certificatePath) && flags.force !== true) {
+    io.stderr.write(
+      `Ya existe ${target.certificateName}. Us\xE1 --force para sobrescribir.
+`
+    );
+    return CLI_EXIT.failed;
+  }
+  const taxId = readCsrTaxIdOf(directory, target.environment);
+  const outcome = await pasteCertificate(io, writer, {
+    intro: isInteractive(io) ? [
+      "Peg\xE1 el certificado que te dio ARCA. Termina solo al ver",
+      `${END}. Ctrl-C para salir.`
+    ] : [],
+    certificatePath,
+    certificateName: target.certificateName,
+    keyName: target.keyName,
+    privateKeyPem: readFileSync2(resolve2(directory, target.keyName), "utf8"),
+    ...taxId === void 0 ? {} : { taxId }
+  });
+  if (outcome === "saved") {
+    writer.blank();
+    writer.dim("Despu\xE9s:");
+    writer.blank();
+    writer.command("npx facturas check");
+    return CLI_EXIT.ok;
+  }
+  if (outcome === "cancelled") {
+    writer.blank();
+    writer.line("Cuando lo tengas, volv\xE9 a correr npx facturas cert, o");
+    writer.line(`guardalo ac\xE1 como ${target.certificateName}.`);
+    return CLI_EXIT.ok;
+  }
+  if (outcome === "exhausted") {
+    writeManualHint(writer, target.certificateName);
+  }
+  return CLI_EXIT.failed;
+}
+function findKeys(directory, environment) {
+  return (environment === void 0 ? DISCOVERY_ORDER : [environment]).map((candidate) => ({
+    environment: candidate,
+    keyName: privateKeyFileName(candidate),
+    certificateName: certificateFileName(candidate)
+  })).filter((candidate) => existsSync2(resolve2(directory, candidate.keyName)));
+}
+function readCsrTaxIdOf(directory, environment) {
+  const path = resolve2(directory, `arca-${environment}.csr`);
+  if (!existsSync2(path)) {
+    return void 0;
+  }
+  try {
+    return readCsrTaxId(readFileSync2(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+function toCertificatePem(lines) {
+  const start = lines.indexOf(BEGIN);
+  const body = start === -1 ? lines : lines.slice(start);
+  return `${body.join("\n")}
+`;
+}
+function readFacts(pem) {
+  try {
+    return readCertificateFacts(pem);
+  } catch {
+    return void 0;
+  }
+}
+function refuse(pem, facts, request) {
+  if (request.taxId !== void 0 && facts.taxId !== void 0 && facts.taxId !== request.taxId) {
+    return `El certificado es de otro CUIT: ${facts.taxId}.`;
+  }
+  let matches;
+  try {
+    matches = privateKeyMatchesCertificate(pem, request.privateKeyPem);
+  } catch {
+    return `No pude leer ${request.keyName} como clave PEM.`;
+  }
+  return matches ? void 0 : `El certificado no corresponde a ${request.keyName}. \xBFSubiste otro CSR?`;
+}
+function isoDate(value) {
+  return value.toISOString().slice(0, 10);
+}
+
+// src/cli/check.ts
+import { readFileSync as readFileSync3 } from "fs";
+import { isAbsolute as isAbsolute2, resolve as resolve3 } from "path";
+
+// src/cli/cuit.ts
+var CHECK_DIGIT_WEIGHTS = [5, 4, 3, 2, 7, 6, 5, 4, 3, 2];
+var TAX_ID_LENGTH = 11;
+var MODULUS = 11;
+var SEPARATORS = /[\s.-]/g;
+var TAX_ID_FIX = "Son 11 d\xEDgitos y el \xFAltimo es el verificador; pod\xE9s escribirlo con guiones.";
+function normalizeTaxId(raw) {
+  return raw.trim().replace(SEPARATORS, "");
+}
+function describeTaxIdProblem(raw) {
+  const digits = normalizeTaxId(raw);
+  if (!/^\d*$/.test(digits)) {
+    return `CUIT inv\xE1lido: ${raw.trim()} tiene caracteres que no son d\xEDgitos.`;
+  }
+  if (digits.length !== TAX_ID_LENGTH) {
+    const plural = digits.length === 1 ? "d\xEDgito" : "d\xEDgitos";
+    return `CUIT inv\xE1lido: ${digits} tiene ${digits.length} ${plural} y necesita ${TAX_ID_LENGTH}.`;
+  }
+  if (!hasValidCheckDigit(digits)) {
+    return `CUIT inv\xE1lido: ${digits} no pasa el d\xEDgito verificador.`;
+  }
+  return void 0;
+}
+function hasValidCheckDigit(digits) {
+  const sum = CHECK_DIGIT_WEIGHTS.reduce(
+    (total, weight, index) => total + weight * Number(digits[index]),
+    0
+  );
+  const remainder = sum % MODULUS;
+  if (remainder === 1) {
+    return false;
+  }
+  const expected = remainder === 0 ? 0 : MODULUS - remainder;
+  return expected === Number(digits[TAX_ID_LENGTH - 1]);
+}
+
+// src/cli/arca-steps.ts
+var ARCA_PAGES = {
+  login: "https://auth.afip.gob.ar/contribuyente_/login.xhtml",
+  wsassService: "WSASS - Autogesti\xF3n Certificados Homologaci\xF3n",
+  wsassNewCertificate: "Nuevo Certificado",
+  wsassNewCertificateButton: "Crear DN y Obtener Certificado",
+  wsassAuthorizeService: "Crear autorizaci\xF3n a servicio",
+  wsassAuthorizeButton: "Crear Autorizaci\xF3n de Acceso",
+  wsassDnField: "Nombre simb\xF3lico del DN",
+  wsassCsrField: "Solicitud de certificado",
+  wsassAuthorizeDnField: "Nombre simb\xF3lico del DN a autorizar",
+  wsassRepresentedField: "CUIT representado",
+  wsassServiceField: "Servicio al que desea acceder",
+  wsfeService: "wsfe - Facturaci\xF3n Electr\xF3nica",
+  certificates: "Administraci\xF3n de Certificados Digitales",
+  certificatesAddAlias: "Agregar alias",
+  relationships: "Administrador de Relaciones",
+  relationshipsNew: "Nueva Relaci\xF3n",
+  relationshipsAdhere: "Adherir Servicio",
+  relationshipsPath: "Nueva Relaci\xF3n \u2192 Webservices \u2192 Facturaci\xF3n Electr\xF3nica",
+  salesPoints: "Administraci\xF3n de Puntos de Venta y Domicilios",
+  salesPointsSystem: "RECE para aplicativo y Web Services",
+  salesPointsSystemMonotributo: "Factura Electr\xF3nica \u2013 Monotributo \u2013 Web Services"
+};
+var STEP_INDENT = "  ";
+var WRAP_INDENT = "     ";
+var FIELD_INDENT = "       ";
+var COLUMN_GAP = 3;
+function buildArcaPlan(environment, context, painter) {
+  return environment === "test" ? buildTestPlan(context, painter) : buildProductionPlan(context, painter);
+}
+function buildTestPlan(context, painter) {
+  const name = (text2) => painter.bold(`"${text2}"`);
+  return {
+    heading: "Listo. Ahora en ARCA, para homologaci\xF3n:",
+    lines: [
+      ...step(1, ["Entr\xE1 con clave fiscal en", ARCA_PAGES.login]),
+      ...step(2, [
+        `Abr\xED ${name(ARCA_PAGES.wsassService)} en Mis Servicios.`,
+        `Si no est\xE1, agregalo en ${ARCA_PAGES.relationships} \u2192 ${ARCA_PAGES.relationshipsAdhere}`,
+        "\u2192 ARCA \u2192 Servicios Interactivos \u2192 WSASS, y volv\xE9 a entrar. Va con tu",
+        "clave fiscal de persona f\xEDsica, nivel 2 o superior: no es delegable."
+      ]),
+      ...step(
+        3,
+        [`En el men\xFA, ${name(ARCA_PAGES.wsassNewCertificate)}:`],
+        [
+          { label: ARCA_PAGES.wsassDnField, value: context.alias },
+          csrField(context)
+        ],
+        [`Apret\xE1 ${name(ARCA_PAGES.wsassNewCertificateButton)}.`]
+      ),
+      ...step(4, [
+        "El certificado sale en el cuadro de resultado, de",
+        "-----BEGIN CERTIFICATE----- a -----END CERTIFICATE-----.",
+        context.paste ? "Copialo entero y pegalo ac\xE1 abajo." : `Copialo entero y guardalo ac\xE1 como ${context.certificateName}.`
+      ]),
+      ...step(
+        5,
+        [`En el men\xFA, ${name(ARCA_PAGES.wsassAuthorizeService)}:`],
+        [
+          { label: ARCA_PAGES.wsassAuthorizeDnField, value: context.alias },
+          { label: ARCA_PAGES.wsassRepresentedField, value: context.taxId },
+          {
+            label: ARCA_PAGES.wsassServiceField,
+            value: ARCA_PAGES.wsfeService
+          }
+        ],
+        [`Apret\xE1 ${name(ARCA_PAGES.wsassAuthorizeButton)}.`]
+      )
+    ]
+  };
+}
+function buildProductionPlan(context, painter) {
+  const name = (text2) => painter.bold(`"${text2}"`);
+  return {
+    heading: "Listo. Ahora en ARCA, para producci\xF3n:",
+    lines: [
+      ...step(1, ["Entr\xE1 con clave fiscal en", ARCA_PAGES.login]),
+      ...step(2, [
+        `Abr\xED ${name(ARCA_PAGES.certificates)} en Mis Servicios.`,
+        `Si no est\xE1, agregalo en ${ARCA_PAGES.relationships} \u2192 ${ARCA_PAGES.relationshipsNew}`,
+        "\u2192 BUSCAR \u2192 Servicios Interactivos \u2192 Administraci\xF3n de Certificados",
+        "Digitales \u2192 Confirmar, y volv\xE9 a entrar."
+      ]),
+      ...step(
+        3,
+        [`Apret\xE1 ${name(ARCA_PAGES.certificatesAddAlias)}:`],
+        [
+          { label: "Alias", value: context.alias },
+          { label: "Seleccionar archivo", value: context.csrName }
+        ],
+        [`Apret\xE1 ${name(ARCA_PAGES.certificatesAddAlias)} para subirlo.`]
+      ),
+      ...step(4, [
+        `En la lista, entr\xE1 con ${name("Ver")} y us\xE1 el icono ${name("Descargar")}`,
+        "para bajar el certificado (archivo CRT).",
+        context.paste ? `Guardalo ac\xE1 como ${context.certificateName}, o abrilo y pegalo abajo.` : `Guardalo ac\xE1 como ${context.certificateName}.`
+      ]),
+      ...step(
+        5,
+        [
+          `Volv\xE9 a ${ARCA_PAGES.relationships}, ${name(ARCA_PAGES.relationshipsNew)}:`
+        ],
+        [
+          {
+            label: "Servicio",
+            value: "BUSCAR \u2192 Webservices \u2192 Facturaci\xF3n Electr\xF3nica"
+          },
+          {
+            label: "Representante",
+            value: `BUSCAR \u2192 el computador fiscal ${context.alias}`
+          }
+        ],
+        [
+          `Apret\xE1 ${name("Confirmar")}, revis\xE1 y volv\xE9 a apretar ${name("Confirmar")}.`
+        ]
+      )
+    ]
+  };
+}
+function step(number, text2, fields = [], after = []) {
+  const [first, ...rest] = text2;
+  const lines = [{ text: `${STEP_INDENT}${number}. ${first}` }];
+  for (const line of rest) {
+    lines.push({ text: `${WRAP_INDENT}${line}` });
+  }
+  const width = columnWidth(fields);
+  for (const field of fields) {
+    const padding = " ".repeat(width - field.label.length);
+    lines.push({
+      text: `${FIELD_INDENT}${field.label}:${padding}${field.value}`
+    });
+    for (const line of field.lines ?? []) {
+      lines.push({ text: `${FIELD_INDENT}${line}` });
+    }
+  }
+  for (const line of after) {
+    lines.push({ text: `${WRAP_INDENT}${line}` });
+  }
+  return lines;
+}
+function csrField(context) {
+  if (context.clipboard) {
+    return {
+      label: ARCA_PAGES.wsassCsrField,
+      value: "peg\xE1 (ya est\xE1 en tu portapapeles)"
+    };
+  }
+  return {
+    label: ARCA_PAGES.wsassCsrField,
+    value: "copi\xE1 esto entero:",
+    lines: context.csrPem.split("\n").map((line) => line.trim()).filter((line) => line !== "")
+  };
+}
+function columnWidth(fields) {
+  const widest = fields.reduce(
+    (longest, field) => Math.max(longest, field.label.length),
+    0
+  );
+  return widest + COLUMN_GAP;
+}
+
+// src/cli/diagnose.ts
+var CLI_DIAGNOSES = {
+  "config.taxId": {
+    diagnosis: "Falta el CUIT.",
+    fix: "export ARCA_TAX_ID=20123456786"
+  },
+  "config.taxIdUnknown": {
+    diagnosis: "El certificado no dice de qu\xE9 CUIT es.",
+    fix: "Pas\xE1 --tax-id 20123456786 o defin\xED ARCA_TAX_ID."
+  },
+  "config.environment": {
+    diagnosis: "Falta el entorno.",
+    fix: "export ARCA_ENVIRONMENT=test"
+  },
+  "config.pem": {
+    diagnosis: "Falta el certificado o la clave.",
+    fix: "Guard\xE1 arca-<entorno>.crt y arca-<entorno>.key ac\xE1, o pas\xE1 --cert y --key, o defin\xED las variables ARCA_*_PEM."
+  },
+  "config.files.ambiguous": {
+    diagnosis: "Est\xE1n {files} en este directorio y no s\xE9 cu\xE1l quer\xE9s.",
+    fix: "Eleg\xED con --env test o --env production."
+  },
+  "config.files.missingCertificate": {
+    diagnosis: "Est\xE1 {file} pero falta {missingFile}.",
+    fix: "Descarg\xE1 el certificado de ARCA y guardalo ac\xE1 como {missingFile}."
+  },
+  "config.files.missingKey": {
+    diagnosis: "Est\xE1 {file} pero falta {missingFile}.",
+    fix: "Pon\xE9 ac\xE1 la clave con la que generaste el CSR, o pas\xE1 --key."
+  },
+  "cert.invalid": {
+    diagnosis: "El archivo no es un PEM v\xE1lido.",
+    fix: "Revis\xE1 que copiaste el bloque completo, con BEGIN y END."
+  },
+  "cert.taxIdMismatch": {
+    diagnosis: "El certificado es del CUIT {certificateTaxId} y el configurado es {taxId}.",
+    fix: "Us\xE1 el certificado de ese CUIT, o correg\xED --tax-id o ARCA_TAX_ID."
+  },
+  "cert.mismatch": {
+    diagnosis: "La clave privada no corresponde a este certificado.",
+    fix: "Us\xE1 la clave con la que generaste el CSR (arca-<entorno>.key)."
+  },
+  "cert.expired": {
+    diagnosis: "El certificado venci\xF3 el {date}.",
+    fix: "Gener\xE1 un CSR nuevo con npx facturas init y renovalo en ARCA."
+  },
+  "wsaa.certExpired": {
+    diagnosis: "El certificado venci\xF3.",
+    fix: "Gener\xE1 un CSR nuevo con npx facturas init y renovalo en ARCA."
+  },
+  "wsaa.certUntrusted": {
+    diagnosis: "ARCA no reconoce este certificado en este entorno.",
+    fix: "Homologaci\xF3n y producci\xF3n tienen certificados propios; revis\xE1 ARCA_ENVIRONMENT."
+  },
+  "wsaa.signInvalid": {
+    diagnosis: "La firma del pedido no es v\xE1lida.",
+    fix: "La clave no corresponde al certificado, o el PEM est\xE1 truncado."
+  },
+  "wsaa.notAuthorized": {
+    diagnosis: "El certificado no est\xE1 autorizado para wsfe.",
+    fix: `${ARCA_PAGES.wsassService} \u2192 ${ARCA_PAGES.wsassAuthorizeService} (homologaci\xF3n) / ${ARCA_PAGES.relationships} (producci\xF3n).`
+  },
+  "wsaa.alreadyAuthenticated": {
+    diagnosis: "Ya hay un ticket vigente para este certificado.",
+    fix: "Otro proceso o m\xE1quina tiene el ticket vigente. Esper\xE1 hasta 12 horas, o corr\xE9 check desde donde lo pediste."
+  },
+  "wsaa.clockSkew": {
+    diagnosis: "La hora de tu m\xE1quina difiere de la de ARCA.",
+    fix: "Sincroniz\xE1 el reloj (NTP) y volv\xE9 a probar."
+  },
+  "wsaa.transport": {
+    diagnosis: "No se pudo conectar con {host}.",
+    fix: "Revis\xE1 red, proxy o firewall; ARCA homologaci\xF3n suele caerse los fines de semana."
+  },
+  "wsfe.missing_relationship": {
+    diagnosis: "El certificado no tiene la relaci\xF3n con Facturaci\xF3n Electr\xF3nica.",
+    fix: `${ARCA_PAGES.relationships} \u2192 ${ARCA_PAGES.relationshipsPath}.`
+  },
+  "wsfe.unauthorized_computer": {
+    diagnosis: "El certificado o computador no est\xE1 autorizado.",
+    fix: "Verific\xE1 que el alias est\xE9 asociado al servicio en este entorno."
+  },
+  "wsfe.invalid_token": {
+    diagnosis: "El ticket fue rechazado.",
+    fix: "Volv\xE9 a ejecutar check; si persiste, revis\xE1 el reloj."
+  },
+  "wsfe.authentication_rejected": {
+    diagnosis: "ARCA deneg\xF3 el acceso al servicio.",
+    fix: "Revis\xE1 entorno y relaci\xF3n del certificado."
+  },
+  "wsfe.serviceError": {
+    diagnosis: "ARCA respondi\xF3 con un error: {message}."
+  },
+  "salesPoint.missing": {
+    diagnosis: "El punto de venta {salesPoint} no est\xE1 habilitado para web services.",
+    fix: `ARCA \u2192 ${ARCA_PAGES.salesPoints} \u2192 Nuevo \u2192 el sistema de web services de tu condici\xF3n ("${ARCA_PAGES.salesPointsSystem}" para responsable inscripto).`
+  },
+  "salesPoint.none": {
+    diagnosis: "ARCA no informa ning\xFAn punto de venta para web services.",
+    fix: `ARCA \u2192 ${ARCA_PAGES.salesPoints} \u2192 Nuevo \u2192 "${ARCA_PAGES.salesPointsSystem}" para responsable inscripto, "${ARCA_PAGES.salesPointsSystemMonotributo}" para monotributo.`
+  },
+  "salesPoint.blocked": {
+    diagnosis: "El punto de venta {salesPoint} est\xE1 bloqueado.",
+    fix: "Revisalo en ARCA."
+  }
+};
+function diagnose(key, values = {}) {
+  const row = CLI_DIAGNOSES[key];
+  return {
+    diagnosis: fill(row.diagnosis, values),
+    ...row.fix === void 0 ? {} : { fix: fill(row.fix, values) }
+  };
+}
+function diagnoseAuthenticationReason(reason) {
+  return diagnose(`wsfe.${reason}`);
+}
+var WSAA_FAULT_ROWS = {
+  "cms.cert.expired": "wsaa.certExpired",
+  "cms.cert.untrusted": "wsaa.certUntrusted",
+  "cms.cert.invalid": "wsaa.certUntrusted",
+  "cms.cert.notfound": "wsaa.certUntrusted",
+  "cms.bad": "wsaa.signInvalid",
+  "cms.sign.invalid": "wsaa.signInvalid",
+  "coe.notauthorized": "wsaa.notAuthorized",
+  "coe.alreadyauthenticated": "wsaa.alreadyAuthenticated",
+  "xml.generationtime.invalid": "wsaa.clockSkew",
+  "xml.expirationtime.invalid": "wsaa.clockSkew",
+  "xml.expirationtime.expired": "wsaa.clockSkew"
+};
+function diagnoseWsaaFaultCode(faultCode) {
+  if (faultCode === void 0) {
+    return void 0;
+  }
+  const bare = faultCode.slice(faultCode.indexOf(":") + 1).toLowerCase();
+  const exact = WSAA_FAULT_ROWS[bare];
+  if (exact) {
+    return exact;
+  }
+  return bare.startsWith("xml.expirationtime.") ? "wsaa.clockSkew" : void 0;
+}
+function findSoapFault(error) {
+  if (error instanceof ArcaSoapFaultError) {
+    return error;
+  }
+  const cause = error instanceof Error ? error.cause : void 0;
+  return cause instanceof ArcaSoapFaultError ? cause : void 0;
+}
+function findTransportError(error) {
+  if (error instanceof ArcaTransportError) {
+    return error;
+  }
+  const cause = error instanceof Error ? error.cause : void 0;
+  return cause instanceof ArcaTransportError ? cause : void 0;
+}
+function describeUnknownError(error) {
+  const safe = toArcaSafeErrorMetadata(error);
+  return {
+    diagnosis: safe.message,
+    ...safe.code === void 0 ? {} : { code: safe.code }
+  };
+}
+function fill(text2, values) {
+  return text2.replace(
+    /\{(certificateTaxId|date|file|files|host|message|missingFile|salesPoint|taxId)\}/g,
+    (match, key) => {
+      const value = values[key];
+      return value === void 0 ? match : String(value);
+    }
+  );
+}
+
+// src/cli/check.ts
+var EXPIRY_WARNING_DAYS = 30;
+var EMPTY_IN_TEST_WARNING = "en homologaci\xF3n ARCA suele no informarlos; prob\xE1 igual con issue";
+var MILLISECONDS_PER_DAY = 864e5;
+var LAYER_LABELS = {
+  config: "configuraci\xF3n",
+  certificate: "certificado y clave",
+  wsaa: "WSAA",
+  wsfe: "WSFE",
+  salesPoints: "puntos de venta"
+};
+var SALES_POINT_MIN = 1;
+var SALES_POINT_MAX = 99999;
+function parseSalesPoint(value) {
+  if (!/^\d+$/.test(value)) {
+    return void 0;
+  }
+  const parsed = Number(value);
+  return parsed >= SALES_POINT_MIN && parsed <= SALES_POINT_MAX ? parsed : void 0;
+}
+function describeSalesPointProblem(value) {
+  const reason = /^\d+$/.test(value) ? `Tiene que estar entre ${SALES_POINT_MIN} y ${SALES_POINT_MAX}` : "Tiene que ser un n\xFAmero entero";
+  return `Punto de venta inv\xE1lido: ${value}. ${reason}, por ejemplo --sales-point 3.`;
+}
+async function runCheck(io, flags, writer, json) {
+  const { report } = await runCheckLayers(io, flags);
+  if (json) {
+    writer.json(report);
+  } else {
+    writeCheckReport(writer, report);
+  }
+  return report.ok ? CLI_EXIT.ok : CLI_EXIT.failed;
+}
+async function runCheckLayers(io, flags) {
+  const layers = [];
+  const resolved = resolveConfigLayer(io, flags);
+  layers.push(resolved.layer);
+  if (!(resolved.layer.ok && resolved.config)) {
+    return { report: { ok: false, layers } };
+  }
+  const config = resolved.config;
+  const report = {
+    ok: false,
+    environment: config.environment,
+    taxId: config.taxId,
+    layers
+  };
+  const certificate = checkCertificate(config, io.now());
+  layers.push(certificate);
+  if (!certificate.ok) {
+    return { report };
+  }
+  const cache = flags.noCache === true ? void 0 : createTicketCache(io.cacheDir);
+  const wsaa = await checkWsaa(io, config, cache);
+  layers.push(wsaa.layer);
+  if (!(wsaa.layer.ok && wsaa.credentials)) {
+    return { report };
+  }
+  const client = io.createClient({
+    ...config,
+    wsaaSessionStore: cache?.sessionStore ?? createEphemeralSessionStore(wsaa.credentials)
+  });
+  const wsfe = await checkWsfe(client);
+  layers.push(wsfe.layer);
+  if (!wsfe.layer.ok) {
+    return { report, client };
+  }
+  const salesPoints = wsfe.salesPoints ?? [];
+  report.salesPoints = salesPoints.map(toSalesPointReport);
+  const layer = checkSalesPoints(
+    report.salesPoints,
+    config.environment,
+    flags.salesPoint
+  );
+  layers.push(layer);
+  report.ok = layer.ok;
+  return { report, client };
+}
+function writeCheckReport(writer, report) {
+  for (const layer of report.layers) {
+    const label = LAYER_LABELS[layer.name];
+    if (layer.ok) {
+      writer.ok(label, layer.detail);
+    } else {
+      writer.fail(label);
+      if (layer.diagnosis !== void 0) {
+        writer.note(layer.diagnosis);
+      }
+      if (layer.fix !== void 0) {
+        writer.note(layer.fix);
+      }
+    }
+    if (layer.name === "salesPoints") {
+      for (const point of report.salesPoints ?? []) {
+        writer.note(describeSalesPoint(point));
+      }
+    }
+    if (layer.warning !== void 0) {
+      writer.warn(label, layer.warning);
+    }
+  }
+}
+function resolveCheckEnvironment(io, flags) {
+  const chosen = flags.env?.trim().toLowerCase() || io.env.ARCA_ENVIRONMENT?.trim();
+  if (chosen) {
+    return chosen;
+  }
+  if (flags.cert?.trim() || io.env.ARCA_CERTIFICATE_PEM?.trim()) {
+    return void 0;
+  }
+  try {
+    const discovery = discoverCredentials(resolveDirectory(io, flags.dir));
+    return discovery.kind === "found" ? discovery.credentials.environment : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function resolveConfigLayer(io, flags) {
+  const chosenEnvironment = flags.env?.trim().toLowerCase() || io.env.ARCA_ENVIRONMENT?.trim();
+  let certificatePem;
+  let privateKeyPem;
+  let discovery = { kind: "none" };
+  try {
+    certificatePem = readPem(io, flags.cert, io.env.ARCA_CERTIFICATE_PEM);
+    privateKeyPem = readPem(io, flags.key, io.env.ARCA_PRIVATE_KEY_PEM);
+    if (!(certificatePem && privateKeyPem)) {
+      discovery = discoverCredentials(
+        resolveDirectory(io, flags.dir),
+        toEnvironment2(chosenEnvironment)
+      );
+    }
+  } catch (error) {
+    const unknown = describeUnknownError(error);
+    return {
+      layer: failedLayer(
+        "config",
+        { diagnosis: unknown.diagnosis },
+        unknown.code
+      )
+    };
+  }
+  const failure = describeDiscoveryFailure(discovery);
+  if (failure) {
+    return { layer: failedLayer("config", failure) };
+  }
+  const found = discovery.kind === "found" ? discovery.credentials : void 0;
+  const certificate = certificatePem || found?.certificatePem;
+  const privateKey = privateKeyPem || found?.privateKeyPem;
+  const taxId = resolveTaxId(io, flags, certificate);
+  if ("layer" in taxId) {
+    return { layer: taxId.layer };
+  }
+  const environment = chosenEnvironment || found?.environment;
+  if (!environment) {
+    return { layer: failedLayer("config", diagnose("config.environment")) };
+  }
+  if (!(certificate && privateKey)) {
+    return { layer: failedLayer("config", diagnose("config.pem")) };
+  }
+  try {
+    const config = discoverArcaClientConfig({
+      taxId: taxId.taxId,
+      certificatePem: certificate,
+      privateKeyPem: privateKey,
+      environment
+    });
+    assertArcaClientConfig(config);
+    return {
+      layer: {
+        name: "config",
+        ok: true,
+        detail: describeSources({
+          ...describeCredentialSource(flags, found),
+          taxId: taxId.source,
+          ...describeEnvironmentSource(io, flags, config.environment)
+        })
+      },
+      config
+    };
+  } catch (error) {
+    return { layer: failedLayer("config", toConfigDiagnosis(error)) };
+  }
+}
+function resolveTaxId(io, flags, certificatePem) {
+  const given = flags.taxId?.trim() || io.env.ARCA_TAX_ID?.trim();
+  if (given) {
+    const problem = describeTaxIdProblem(given);
+    if (problem !== void 0) {
+      return {
+        layer: failedLayer("config", { diagnosis: problem, fix: TAX_ID_FIX })
+      };
+    }
+    return {
+      taxId: normalizeTaxId(given),
+      source: flags.taxId?.trim() ? "--tax-id" : "ARCA_TAX_ID"
+    };
+  }
+  if (certificatePem === void 0) {
+    return { layer: failedLayer("config", diagnose("config.taxId")) };
+  }
+  const fromCertificate = readCertificateTaxId(certificatePem);
+  if (fromCertificate === void 0) {
+    return { layer: failedLayer("config", diagnose("config.taxIdUnknown")) };
+  }
+  return {
+    taxId: fromCertificate,
+    source: `CUIT ${fromCertificate} del certificado`
+  };
+}
+function readCertificateTaxId(certificatePem) {
+  try {
+    return readCertificateFacts(certificatePem).taxId;
+  } catch {
+    return void 0;
+  }
+}
+function describeDiscoveryFailure(discovery) {
+  if (discovery.kind === "ambiguous") {
+    return diagnose("config.files.ambiguous", {
+      files: discovery.files.join(" y ")
+    });
+  }
+  if (discovery.kind === "incomplete") {
+    return diagnose(
+      discovery.missingKind === "certificate" ? "config.files.missingCertificate" : "config.files.missingKey",
+      { file: discovery.present, missingFile: discovery.missing }
+    );
+  }
+  return void 0;
+}
+function resolveDirectory(io, directory) {
+  return isAbsolute2(directory ?? "") ? directory : resolve3(io.cwd, directory ?? ".");
+}
+function toEnvironment2(value) {
+  return value === "test" || value === "production" ? value : void 0;
+}
+function readPem(io, file, fromEnv) {
+  if (file === void 0 || file === "") {
+    return fromEnv?.trim() || void 0;
+  }
+  const path = isAbsolute2(file) ? file : resolve3(io.cwd, file);
+  return readFileSync3(path, "utf8").trim();
+}
+function describeCredentialSource(flags, found) {
+  if (found !== void 0) {
+    return { credentials: `${found.certificateFile} en este directorio` };
+  }
+  const named = [
+    ...flags.cert?.trim() ? ["--cert"] : [],
+    ...flags.key?.trim() ? ["--key"] : []
+  ];
+  return named.length === 0 ? {} : { credentials: named.join(" y ") };
+}
+function describeEnvironmentSource(io, flags, environment) {
+  if (flags.env?.trim()) {
+    return { environment: `--env=${environment}` };
+  }
+  if (io.env.ARCA_ENVIRONMENT?.trim()) {
+    return { environment: `ARCA_ENVIRONMENT=${environment}` };
+  }
+  return {};
+}
+function describeSources(origin) {
+  return [origin.credentials, origin.taxId, origin.environment].filter((part) => part !== void 0).join(", ");
+}
+function toConfigDiagnosis(error) {
+  if (!(error instanceof ArcaConfigurationError)) {
+    return { diagnosis: describeUnknownError(error).diagnosis };
+  }
+  if (error.message.includes("taxId")) {
+    return diagnose("config.taxId");
+  }
+  if (error.message.includes("environment")) {
+    return diagnose("config.environment");
+  }
+  if (error.message.includes("certificatePem") || error.message.includes("privateKeyPem") || error.message.includes("Encrypted private keys")) {
+    return diagnose("cert.invalid");
+  }
+  return { diagnosis: error.message };
+}
+function checkCertificate(config, now) {
+  let facts;
+  let matches;
+  try {
+    facts = readCertificateFacts(config.certificatePem);
+    matches = privateKeyMatchesCertificate(
+      config.certificatePem,
+      config.privateKeyPem
+    );
+  } catch {
+    return failedLayer("certificate", diagnose("cert.invalid"));
+  }
+  if (facts.taxId !== void 0 && facts.taxId !== config.taxId) {
+    return failedLayer(
+      "certificate",
+      diagnose("cert.taxIdMismatch", {
+        certificateTaxId: facts.taxId,
+        taxId: config.taxId
+      })
+    );
+  }
+  const expiresAt = toIsoDate(facts.notAfter);
+  if (facts.notAfter.getTime() <= now.getTime()) {
+    return failedLayer(
+      "certificate",
+      diagnose("cert.expired", { date: expiresAt })
+    );
+  }
+  if (!matches) {
+    return failedLayer("certificate", diagnose("cert.mismatch"));
+  }
+  const daysLeft = Math.floor(
+    (facts.notAfter.getTime() - now.getTime()) / MILLISECONDS_PER_DAY
+  );
+  return {
+    name: "certificate",
+    ok: true,
+    detail: `coinciden, vence ${expiresAt}`,
+    expiresAt,
+    ...daysLeft < EXPIRY_WARNING_DAYS ? { warning: `vence en ${daysLeft} ${daysLeft === 1 ? "d\xEDa" : "d\xEDas"}` } : {}
+  };
+}
+async function checkWsaa(io, config, cache) {
+  try {
+    const auth = io.createAuth({
+      ...config,
+      ...cache === void 0 ? {} : { wsaaSessionStore: cache.sessionStore }
+    });
+    const credentials = await auth.login("wsfe", {
+      forceRefresh: cache === void 0
+    });
+    return {
+      layer: {
+        name: "wsaa",
+        ok: true,
+        detail: cache?.wasReused() === true ? "ticket vigente" : "ticket obtenido"
+      },
+      credentials
+    };
+  } catch (error) {
+    return { layer: toWsaaFailure(error, config.environment) };
+  }
+}
+function toWsaaFailure(error, environment) {
+  const fault = findSoapFault(error);
+  const key = diagnoseWsaaFaultCode(fault?.faultCode);
+  if (key !== void 0) {
+    return failedLayer("wsaa", diagnose(key), fault?.code);
+  }
+  const transport = findTransportError(error);
+  if (transport) {
+    const host = new URL(ARCA_WSAA_CONFIG.endpoint[environment]).host;
+    return failedLayer(
+      "wsaa",
+      diagnose("wsaa.transport", { host }),
+      transport.code
+    );
+  }
+  const unknown = describeUnknownError(error);
+  return failedLayer("wsaa", { diagnosis: unknown.diagnosis }, unknown.code);
+}
+async function checkWsfe(client) {
+  try {
+    const status = await client.wsfe.getServerStatus();
+    const down = [
+      ["appServer", status.appServer],
+      ["dbServer", status.dbServer],
+      ["authServer", status.authServer]
+    ].filter(([, value]) => value.toUpperCase() !== "OK");
+    if (down.length > 0) {
+      const message = down.map(([name, value]) => `${name}=${value}`).join(", ");
+      return {
+        layer: failedLayer("wsfe", diagnose("wsfe.serviceError", { message }))
+      };
+    }
+    const salesPoints = await client.wsfe.getSalesPoints({});
+    return {
+      layer: { name: "wsfe", ok: true, detail: "servidor ok" },
+      salesPoints
+    };
+  } catch (error) {
+    return { layer: toWsfeFailure(error) };
+  }
+}
+function toWsfeFailure(error) {
+  if (isArcaAuthenticationError(error)) {
+    return {
+      ...failedLayer(
+        "wsfe",
+        diagnoseAuthenticationReason(error.reason),
+        error.code
+      ),
+      reason: error.reason
+    };
+  }
+  if (error instanceof ArcaServiceError || error instanceof ArcaSoapFaultError) {
+    return failedLayer(
+      "wsfe",
+      diagnose("wsfe.serviceError", { message: error.message }),
+      error.code
+    );
+  }
+  const unknown = describeUnknownError(error);
+  return failedLayer("wsfe", { diagnosis: unknown.diagnosis }, unknown.code);
+}
+function checkSalesPoints(points, environment, requested) {
+  if (requested !== void 0) {
+    const found = points.find((point) => point.number === requested);
+    if (!found) {
+      if (points.length === 0 && environment === "test") {
+        return {
+          name: "salesPoints",
+          ok: true,
+          detail: `${requested} (no informado)`,
+          warning: EMPTY_IN_TEST_WARNING
+        };
+      }
+      return failedLayer(
+        "salesPoints",
+        diagnose("salesPoint.missing", { salesPoint: requested })
+      );
+    }
+    if (found.blocked) {
+      return failedLayer(
+        "salesPoints",
+        diagnose("salesPoint.blocked", { salesPoint: requested })
+      );
+    }
+    return {
+      name: "salesPoints",
+      ok: true,
+      detail: describeSalesPoint(found)
+    };
+  }
+  if (points.length === 0) {
+    if (environment === "test") {
+      return {
+        name: "salesPoints",
+        ok: true,
+        detail: "ninguno informado",
+        warning: EMPTY_IN_TEST_WARNING
+      };
+    }
+    return failedLayer("salesPoints", diagnose("salesPoint.none"));
+  }
+  return {
+    name: "salesPoints",
+    ok: true,
+    detail: `${points.length} ${points.length === 1 ? "informado" : "informados"}`
+  };
+}
+function createTicketCache(directory) {
+  const store = createWsaaStoreAdapter(createFileStore(directory));
+  let reused = false;
+  const remove = store.delete?.bind(store);
+  return {
+    sessionStore: {
+      get: async (key) => {
+        const credentials = await store.get(key);
+        if (credentials) {
+          reused = true;
+        }
+        return credentials;
+      },
+      set: (key, credentials) => store.set(key, credentials),
+      ...remove === void 0 ? {} : { delete: remove }
+    },
+    wasReused: () => reused
+  };
+}
+function createEphemeralSessionStore(credentials) {
+  return {
+    get: () => Promise.resolve(credentials),
+    set: () => Promise.resolve()
+  };
+}
+function toSalesPointReport(point) {
+  return {
+    number: point.number,
+    blocked: (point.blocked ?? "N").trim().toUpperCase().startsWith("S"),
+    ...point.emissionType === void 0 ? {} : { system: point.emissionType }
+  };
+}
+function describeSalesPoint(point) {
+  const state = point.blocked ? "bloqueado" : "habilitado";
+  return point.system === void 0 ? `${point.number} (${state})` : `${point.number} (${state}, ${point.system})`;
+}
+function failedLayer(name, row, code) {
+  return {
+    name,
+    ok: false,
+    diagnosis: row.diagnosis,
+    ...row.fix === void 0 ? {} : { fix: row.fix },
+    ...code === void 0 ? {} : { code }
+  };
+}
+function toIsoDate(value) {
+  return value.toISOString().slice(0, 10);
+}
+
+// src/cli/clipboard.ts
+import { spawn as spawnProcess } from "child_process";
+var TIMEOUT_MS = 2e3;
+function clipboardCommands(platform, env) {
+  if (env.SSH_CONNECTION !== void 0 || env.SSH_TTY !== void 0) {
+    return [];
+  }
+  if (platform === "darwin") {
+    return [{ command: "pbcopy", args: [] }];
+  }
+  if (platform === "win32") {
+    return [{ command: "clip", args: [] }];
+  }
+  const commands = [];
+  if (env.WAYLAND_DISPLAY !== void 0) {
+    commands.push({ command: "wl-copy", args: [] });
+  }
+  if (env.DISPLAY !== void 0) {
+    commands.push(
+      { command: "xclip", args: ["-selection", "clipboard"] },
+      { command: "xsel", args: ["--clipboard", "--input"] }
+    );
+  }
+  return commands;
+}
+async function copyToClipboard(text2, options = {}) {
+  const spawn = options.spawn ?? ((command, args) => spawnProcess(command, [...args], {
+    stdio: ["pipe", "ignore", "ignore"]
+  }));
+  const commands = clipboardCommands(
+    options.platform ?? process.platform,
+    options.env ?? process.env
+  );
+  for (const candidate of commands) {
+    const copied = await feed(
+      spawn,
+      candidate,
+      text2,
+      options.timeoutMs ?? TIMEOUT_MS
+    );
+    if (copied) {
+      return true;
+    }
+  }
+  return false;
+}
+function feed(spawn, candidate, text2, timeoutMs) {
+  return new Promise((done) => {
+    let settled = false;
+    let timer;
+    const finish = (copied) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      if (timer !== void 0) {
+        clearTimeout(timer);
+      }
+      done(copied);
+    };
+    let child;
+    try {
+      child = spawn(candidate.command, candidate.args);
+    } catch {
+      finish(false);
+      return;
+    }
+    timer = setTimeout(() => {
+      child.kill();
+      finish(false);
+    }, timeoutMs);
+    child.on("error", () => finish(false));
+    child.on("close", (code) => finish(code === 0));
+    const stdin = child.stdin;
+    if (stdin === null) {
+      finish(false);
+      return;
+    }
+    stdin.on("error", () => finish(false));
+    try {
+      stdin.write(text2);
+      stdin.end();
+    } catch {
+      finish(false);
+    }
+  });
+}
+
+// src/cli/version.ts
+import { readFileSync as readFileSync4 } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+var MAX_DEPTH = 5;
+function readCliVersion() {
+  let directory = dirname(fileURLToPath(import.meta.url));
+  for (let depth = 0; depth < MAX_DEPTH; depth += 1) {
+    try {
+      const raw = readFileSync4(join(directory, "package.json"), "utf8");
+      const parsed = JSON.parse(raw);
+      if (typeof parsed.version === "string") {
+        return parsed.version;
+      }
+    } catch {
+    }
+    directory = dirname(directory);
+  }
+  return "0.0.0";
+}
+
+// src/cli/help.ts
+var INDENT2 = "  ";
+var COLUMN_GAP2 = 3;
+var CLI_COMMAND_SUMMARIES = {
+  init: "clave privada y CSR, m\xE1s los pasos exactos en ARCA",
+  cert: "pega el certificado que te dio ARCA y lo guarda",
+  check: "prueba cada capa en orden y nombra la que falla",
+  issue: "una factura de ARS 1 en homologaci\xF3n, solo a pedido"
+};
+var HELP_PAGES = {
+  root: {
+    usage: "npx facturas <comando> [opciones]",
+    sections: [
+      {
+        title: "Comandos:",
+        bold: true,
+        rows: [
+          { name: "init", description: CLI_COMMAND_SUMMARIES.init },
+          { name: "cert", description: CLI_COMMAND_SUMMARIES.cert },
+          { name: "check", description: CLI_COMMAND_SUMMARIES.check },
+          { name: "issue", description: CLI_COMMAND_SUMMARIES.issue }
+        ]
+      },
+      {
+        title: "Opciones globales:",
+        rows: [
+          { name: "--json", description: "salida JSON (check e issue)" },
+          { name: "--no-color", description: "sin colores" },
+          {
+            name: "-h, --help",
+            description: "ayuda de un comando: npx facturas check --help"
+          },
+          { name: "-v, --version" }
+        ]
+      }
+    ],
+    examples: [
+      "npx facturas init --cuit 20123456786 --env test",
+      "npx facturas check",
+      "npx facturas issue --sales-point 3 --issuer monotributo"
+    ]
+  },
+  init: {
+    summary: CLI_COMMAND_SUMMARIES.init,
+    usage: "npx facturas init [opciones]",
+    sections: [
+      {
+        title: "Opciones:",
+        rows: [
+          {
+            name: "--cuit <cuit>",
+            description: "CUIT de 11 d\xEDgitos, con o sin guiones"
+          },
+          {
+            name: "--env <test|production>",
+            description: "entorno de destino"
+          },
+          {
+            name: "--name <alias>",
+            description: "common name del CSR (por defecto: facturas)"
+          },
+          {
+            name: "--org <raz\xF3n social>",
+            description: "organizaci\xF3n del CSR (por defecto: el CUIT)"
+          },
+          {
+            name: "--dir <directorio>",
+            description: "d\xF3nde escribir los archivos (por defecto: el actual)"
+          },
+          {
+            name: "--force",
+            description: "sobrescribe los archivos existentes"
+          },
+          {
+            name: "--no-clipboard",
+            description: "no copia el CSR al portapapeles"
+          },
+          {
+            name: "--no-paste",
+            description: "no pregunta por el certificado al final"
+          },
+          { name: "--no-color", description: "sin colores" },
+          { name: "-h, --help", description: "esta ayuda" }
+        ]
+      }
+    ],
+    examples: [
+      "npx facturas init --cuit 20123456786 --env test",
+      "npx facturas init --cuit 20-12345678-6 --env production --name mi-sistema"
+    ],
+    notes: [
+      "Escribe arca-<entorno>.key con permisos 0600 y arca-<entorno>.csr, y",
+      "nunca escribe en ARCA. En homologaci\xF3n copia el CSR al portapapeles, y",
+      "si no puede lo imprime para copiarlo de la terminal. Al final pide el",
+      "certificado y lo guarda como arca-<entorno>.crt; con Ctrl-C, --no-paste",
+      "o sin terminal, lo guard\xE1s vos o lo peg\xE1s despu\xE9s con cert. En una",
+      "terminal pregunta el CUIT y el entorno; sin terminal, --cuit y --env",
+      "son obligatorios."
+    ]
+  },
+  cert: {
+    summary: CLI_COMMAND_SUMMARIES.cert,
+    usage: "npx facturas cert [opciones]",
+    sections: [
+      {
+        title: "Opciones:",
+        rows: [
+          {
+            name: "--env <test|production>",
+            description: "cu\xE1l par usar si est\xE1n los dos"
+          },
+          {
+            name: "--dir <directorio>",
+            description: "d\xF3nde est\xE1n los archivos (por defecto: el actual)"
+          },
+          {
+            name: "--force",
+            description: "sobrescribe el certificado existente"
+          },
+          { name: "--no-color", description: "sin colores" },
+          { name: "-h, --help", description: "esta ayuda" }
+        ]
+      }
+    ],
+    examples: [
+      "npx facturas cert",
+      "npx facturas cert --env production",
+      "npx facturas cert --dir credenciales --force"
+    ],
+    notes: [
+      "Peg\xE1s el certificado que te dio ARCA, de -----BEGIN CERTIFICATE----- a",
+      "-----END CERTIFICATE-----, y lo guarda como arca-<entorno>.crt junto a",
+      "la clave que gener\xF3 init. Antes verifica que sea el certificado de esa",
+      "clave y de ese CUIT, y si no, no escribe nada. Es lo mismo que init",
+      "pregunta al final: cert est\xE1 para cuando lo dejaste para despu\xE9s."
+    ]
+  },
+  check: {
+    summary: CLI_COMMAND_SUMMARIES.check,
+    usage: "npx facturas check [opciones]",
+    sections: [
+      {
+        title: "Opciones:",
+        rows: [
+          {
+            name: "--cert <archivo>",
+            description: "certificado PEM desde un archivo"
+          },
+          {
+            name: "--key <archivo>",
+            description: "clave privada PEM desde un archivo"
+          },
+          {
+            name: "--tax-id <cuit>",
+            description: "CUIT, en lugar de ARCA_TAX_ID"
+          },
+          {
+            name: "--env <test|production>",
+            description: "entorno, en lugar de ARCA_ENVIRONMENT"
+          },
+          {
+            name: "--dir <directorio>",
+            description: "d\xF3nde buscar los archivos (por defecto: el actual)"
+          },
+          {
+            name: "--sales-point <n>",
+            description: "punto de venta a verificar"
+          },
+          {
+            name: "--no-cache",
+            description: "no reusa ni guarda el ticket WSAA"
+          },
+          { name: "--json", description: "salida JSON" },
+          { name: "--no-color", description: "sin colores" },
+          { name: "-h, --help", description: "esta ayuda" }
+        ]
+      }
+    ],
+    examples: [
+      "npx facturas check",
+      "npx facturas check --sales-point 3",
+      "npx facturas check --cert arca-test.crt --key arca-test.key"
+    ],
+    notes: [
+      "Busca cada valor en este orden: los flags, las variables de entorno y,",
+      "por \xFAltimo, arca-<entorno>.crt y arca-<entorno>.key en el directorio; de",
+      "ah\xED sale tambi\xE9n el CUIT y el entorno. Nunca escribe en ARCA: solo lee.",
+      "Guarda el ticket WSAA en el directorio temporal del sistema para poder",
+      "repetirse, porque ARCA rechaza un segundo login mientras hay uno",
+      "vigente; --no-cache no lo lee ni lo escribe."
+    ]
+  },
+  issue: {
+    summary: CLI_COMMAND_SUMMARIES.issue,
+    usage: "npx facturas issue [opciones]",
+    sections: [
+      {
+        title: "Opciones:",
+        rows: [
+          { name: "--sales-point <n>", description: "punto de venta a usar" },
+          { name: "--issuer <condici\xF3n>", description: "condici\xF3n del emisor" },
+          {
+            name: "--cert <archivo>",
+            description: "certificado PEM desde un archivo"
+          },
+          {
+            name: "--key <archivo>",
+            description: "clave privada PEM desde un archivo"
+          },
+          {
+            name: "--tax-id <cuit>",
+            description: "CUIT, en lugar de ARCA_TAX_ID"
+          },
+          {
+            name: "--env <test|production>",
+            description: "entorno, en lugar de ARCA_ENVIRONMENT"
+          },
+          {
+            name: "--dir <directorio>",
+            description: "d\xF3nde buscar los archivos (por defecto: el actual)"
+          },
+          {
+            name: "--no-cache",
+            description: "no reusa ni guarda el ticket WSAA"
+          },
+          { name: "--json", description: "salida JSON" },
+          { name: "--no-color", description: "sin colores" },
+          { name: "-h, --help", description: "esta ayuda" }
+        ]
+      }
+    ],
+    examples: [
+      "npx facturas issue --sales-point 3 --issuer monotributo",
+      "npx facturas issue --sales-point 3 --issuer responsable_inscripto --json"
+    ],
+    notes: [
+      "Las condiciones de emisor son monotributo, responsable_inscripto,",
+      "exento y no_alcanzado. Emite un comprobante real de homologaci\xF3n y se",
+      "niega fuera de test: corre antes las capas de check, con la misma",
+      "b\xFAsqueda de configuraci\xF3n, y no sigue si alguna falla. En una terminal",
+      "pregunta el punto de venta y el emisor."
+    ]
+  }
+};
+function renderHelp(topic, options) {
+  const painter = createPainter(options.color);
+  const page = HELP_PAGES[topic];
+  const lines = [`facturas ${readCliVersion()}`, ""];
+  if (page.summary !== void 0) {
+    lines.push(`${INDENT2}${page.summary}`, "");
+  }
+  lines.push(`${INDENT2}${page.usage}`, "");
+  for (const section of page.sections) {
+    lines.push(painter.dim(section.title), "");
+    const width = columnWidth2(section.rows);
+    for (const row of section.rows) {
+      const name = section.bold === true ? painter.bold(row.name) : row.name;
+      lines.push(
+        row.description === void 0 ? `${INDENT2}${name}` : `${INDENT2}${name}${" ".repeat(width - row.name.length)}${row.description}`
+      );
+    }
+    lines.push("");
+  }
+  lines.push(painter.dim("Ejemplos:"), "");
+  for (const example of page.examples) {
+    lines.push(`${INDENT2}${painter.dim("$")} ${painter.cyan(example)}`);
+  }
+  if (page.notes !== void 0) {
+    lines.push("", painter.dim("Notas:"), "");
+    for (const note of page.notes) {
+      lines.push(`${INDENT2}${note}`);
+    }
+  }
+  return `${lines.join("\n")}
+`;
+}
+function columnWidth2(rows) {
+  const widest = rows.filter((row) => row.description !== void 0).reduce((longest, row) => Math.max(longest, row.name.length), 0);
+  return widest + COLUMN_GAP2;
+}
+
+// src/cli/init.ts
+import {
+  chmodSync,
+  existsSync as existsSync3,
+  mkdirSync,
+  readFileSync as readFileSync5,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { isAbsolute as isAbsolute3, resolve as resolve4 } from "path";
+var KEY_FILE_MODE = 384;
+var TAX_ID_ATTEMPTS = 3;
+var MISSING_TAX_ID = "Falta el CUIT. Pas\xE1 --cuit 20123456786 o ejecut\xE1 init en una terminal.";
+var MISSING_ENVIRONMENT = "Falta el entorno. Pas\xE1 --env test o --env production.";
+var GITIGNORE_PATTERNS = ["arca-*.key", "arca-*.crt"];
+async function runInit(io, flags, writer) {
+  const resolved = await resolveInitInput(io, flags);
+  if (resolved === void 0) {
+    return CLI_EXIT.usage;
+  }
+  const { taxId, environment } = resolved;
+  const directory = isAbsolute3(flags.dir ?? "") ? flags.dir : resolve4(io.cwd, flags.dir ?? ".");
+  const commonName = flags.name?.trim() || "facturas";
+  const alias = `${commonName.replace(/[^A-Za-z0-9]/g, "")}${environment === "test" ? "Test" : "Production"}`;
+  const keyName = `arca-${environment}.key`;
+  const csrName = `arca-${environment}.csr`;
+  const certificateName = `arca-${environment}.crt`;
+  const keyPath = resolve4(directory, keyName);
+  const csrPath = resolve4(directory, csrName);
+  const existing = [keyPath, csrPath].filter((path) => existsSync3(path));
+  if (existing.length > 0 && flags.force !== true) {
+    io.stderr.write(
+      `Ya existe ${existing.map((path) => path).join(" y ")}. Us\xE1 --force para sobrescribir.
+`
+    );
+    return CLI_EXIT.failed;
+  }
+  const material = createArcaCsrMaterial({
+    taxId,
+    commonName,
+    organization: flags.org?.trim() || taxId
+  });
+  mkdirSync(directory, { recursive: true });
+  writeFileSync2(keyPath, material.privateKeyPem, { mode: KEY_FILE_MODE });
+  chmodSync(keyPath, KEY_FILE_MODE);
+  writeFileSync2(csrPath, material.csrPem);
+  const clipboard = environment === "test" && flags.noClipboard !== true && await io.copyToClipboard(material.csrPem);
+  writer.ok(keyName, "clave privada RSA 2048, permisos 0600");
+  writer.ok(csrName, `CSR para ARCA, CN=${commonName}`);
+  if (clipboard) {
+    writer.ok("portapapeles", `${csrName} copiado, pegalo en el paso 3`);
+  }
+  const ignored = appendToGitignore(directory);
+  if (ignored.length > 0) {
+    writer.ok(".gitignore", `agregu\xE9 ${ignored.join(" y ")}`);
+  }
+  const paste = flags.noPaste !== true && isInteractive(io);
+  writePlan(writer, {
+    alias,
+    certificateName,
+    clipboard,
+    csrName,
+    csrPem: material.csrPem,
+    environment,
+    paste,
+    taxId
+  });
+  const code = paste ? await askForCertificate(io, writer, {
+    certificatePath: resolve4(directory, certificateName),
+    certificateName,
+    keyName,
+    privateKeyPem: material.privateKeyPem,
+    taxId
+  }) : manualCertificate(writer, certificateName);
+  writer.blank();
+  writer.dim("Para tu app las variables son ARCA_TAX_ID, ARCA_ENVIRONMENT,");
+  writer.dim(
+    "ARCA_CERTIFICATE_PEM y ARCA_PRIVATE_KEY_PEM; ver docs/inicio-rapido.md."
+  );
+  return code;
+}
+async function askForCertificate(io, writer, request) {
+  const outcome = await pasteCertificate(io, writer, {
+    intro: [
+      "Cuando tengas el certificado (paso 4), pegalo ac\xE1. Termina solo al ver",
+      "-----END CERTIFICATE-----. Ctrl-C para hacerlo despu\xE9s con",
+      "npx facturas cert."
+    ],
+    ...request
+  });
+  if (outcome === "saved") {
+    writer.blank();
+    writer.line("Falta el paso 5 (la autorizaci\xF3n a wsfe). Cuando est\xE9:");
+    writer.blank();
+    writer.command("npx facturas check");
+    return CLI_EXIT.ok;
+  }
+  if (outcome === "refused") {
+    return CLI_EXIT.failed;
+  }
+  writeManualHint(writer, request.certificateName);
+  return outcome === "cancelled" ? CLI_EXIT.ok : CLI_EXIT.failed;
+}
+function manualCertificate(writer, certificateName) {
+  writeManualHint(writer, certificateName);
+  return CLI_EXIT.ok;
+}
+async function resolveInitInput(io, flags) {
+  const interactive = isInteractive(io);
+  const taxId = await resolveTaxId2(io, flags, interactive);
+  if ("error" in taxId) {
+    io.stderr.write(`${taxId.error}
+`);
+    return void 0;
+  }
+  const environment = await resolveEnvironment(io, flags, interactive);
+  if (environment === void 0) {
+    io.stderr.write(`${MISSING_ENVIRONMENT}
+`);
+    return void 0;
+  }
+  return { taxId: taxId.taxId, environment };
+}
+async function resolveTaxId2(io, flags, interactive) {
+  const fromFlag = flags.cuit?.trim();
+  if (fromFlag !== void 0 && fromFlag !== "") {
+    const problem2 = describeTaxIdProblem(fromFlag);
+    return problem2 === void 0 ? { taxId: normalizeTaxId(fromFlag) } : { error: problem2 };
+  }
+  if (!interactive) {
+    return { error: MISSING_TAX_ID };
+  }
+  let problem = MISSING_TAX_ID;
+  for (let attempt = 1; attempt <= TAX_ID_ATTEMPTS; attempt += 1) {
+    const answer = await ask(io, "CUIT: ");
+    if (answer === "") {
+      problem = MISSING_TAX_ID;
+    } else {
+      const invalid = describeTaxIdProblem(answer);
+      if (invalid === void 0) {
+        return { taxId: normalizeTaxId(answer) };
+      }
+      problem = invalid;
+    }
+    if (attempt < TAX_ID_ATTEMPTS) {
+      io.stderr.write(`${problem}
+`);
+    }
+  }
+  return { error: problem };
+}
+async function resolveEnvironment(io, flags, interactive) {
+  const fromFlag = flags.env?.trim().toLowerCase();
+  if (fromFlag !== void 0 && fromFlag !== "") {
+    return toEnvironment(fromFlag);
+  }
+  if (!interactive) {
+    return void 0;
+  }
+  const answer = await ask(io, "Entorno [test/production]: ");
+  return toEnvironment(answer.trim().toLowerCase());
+}
+function appendToGitignore(directory) {
+  const path = resolve4(directory, ".gitignore");
+  if (!existsSync3(path)) {
+    return [];
+  }
+  const current = readFileSync5(path, "utf8");
+  const lines = new Set(current.split("\n").map((line) => line.trim()));
+  const missing = GITIGNORE_PATTERNS.filter((pattern) => !lines.has(pattern));
+  if (missing.length === 0) {
+    return [];
+  }
+  const prefix = current.length > 0 && !current.endsWith("\n") ? "\n" : "";
+  writeFileSync2(path, `${current}${prefix}${missing.join("\n")}
+`);
+  return [...missing];
+}
+function writePlan(writer, context) {
+  const plan = buildArcaPlan(context.environment, context, writer.painter);
+  writer.blank();
+  writer.line(plan.heading);
+  writer.blank();
+  for (const line of plan.lines) {
+    writer.line(line.text);
+  }
+}
+
+// src/cli/issue.ts
+var SMOKE_TEST_MINOR_UNITS = 100;
+var SMOKE_TEST_VAT_RATE = 21;
+var SALES_POINT_DIGITS = 5;
+var VOUCHER_NUMBER_DIGITS = 8;
+var ISSUER_CONDITIONS = [
+  "monotributo",
+  "responsable_inscripto",
+  "exento",
+  "no_alcanzado"
+];
+async function runIssue(io, flags, writer, json) {
+  const environment = resolveCheckEnvironment(io, flags);
+  if (environment !== void 0 && environment !== "test") {
+    return refuse2(io);
+  }
+  const parameters = await resolveIssueInput(io, flags);
+  if (parameters === void 0) {
+    return CLI_EXIT.usage;
+  }
+  const { report, client } = await runCheckLayers(io, flags);
+  if (!(report.ok && client)) {
+    if (json) {
+      writer.json(report);
+    } else {
+      writeCheckReport(writer, report);
+    }
+    return CLI_EXIT.failed;
+  }
+  if (report.environment !== "test") {
+    return refuse2(io);
+  }
+  const input = buildSmokeTestInput(parameters.issuer, parameters.salesPoint);
+  let outcome;
+  try {
+    outcome = await client.issue(input);
+  } catch (error) {
+    return writeIssueError(writer, report, error, json);
+  }
+  if (json) {
+    writer.json(outcome);
+    return outcome.kind === "authorized" ? CLI_EXIT.ok : CLI_EXIT.failed;
+  }
+  return writeOutcome(writer, outcome, input);
+}
+function writeIssueError(writer, report, error, json) {
+  const unknown = describeUnknownError(error);
+  if (json) {
+    writer.json({
+      ok: false,
+      ...report.environment === void 0 ? {} : { environment: report.environment },
+      ...report.taxId === void 0 ? {} : { taxId: report.taxId },
+      error: {
+        ...unknown.code === void 0 ? {} : { code: unknown.code },
+        message: unknown.diagnosis
+      }
+    });
+    return CLI_EXIT.failed;
+  }
+  writer.fail("emisi\xF3n");
+  writer.note(unknown.diagnosis);
+  writer.note(
+    "No sabemos si ARCA lleg\xF3 a autorizar; consult\xE1 el punto de venta antes de repetir."
+  );
+  return CLI_EXIT.failed;
+}
+function refuse2(io) {
+  io.stderr.write(
+    "issue solo emite en homologaci\xF3n. Cambi\xE1 ARCA_ENVIRONMENT=test.\n"
+  );
+  return CLI_EXIT.failed;
+}
+async function resolveIssueInput(io, flags) {
+  const interactive = isInteractive(io);
+  const salesPoint = await resolveSalesPoint(io, flags, interactive);
+  if (salesPoint === void 0) {
+    io.stderr.write("Falta el punto de venta. Pas\xE1 --sales-point 3.\n");
+    return void 0;
+  }
+  const issuer = await resolveIssuer(io, flags, interactive);
+  if (issuer === void 0) {
+    io.stderr.write(
+      `Falta la condici\xF3n del emisor. Pas\xE1 --issuer ${ISSUER_CONDITIONS.join("|")}.
+`
+    );
+    return void 0;
+  }
+  return { issuer, salesPoint };
+}
+async function resolveSalesPoint(io, flags, interactive) {
+  if (flags.salesPoint !== void 0) {
+    return flags.salesPoint;
+  }
+  if (!interactive) {
+    return void 0;
+  }
+  return parseSalesPoint((await ask(io, "Punto de venta: ")).trim());
+}
+async function resolveIssuer(io, flags, interactive) {
+  const fromFlag = flags.issuer?.trim();
+  if (fromFlag) {
+    return toIssuerCondition(fromFlag);
+  }
+  if (!interactive) {
+    return void 0;
+  }
+  const answer = await ask(io, `Emisor [${ISSUER_CONDITIONS.join("/")}]: `);
+  return toIssuerCondition(answer.trim());
+}
+function toIssuerCondition(value) {
+  return ISSUER_CONDITIONS.includes(value) ? value : void 0;
+}
+function buildSmokeTestInput(issuer, salesPoint) {
+  if (issuer === "responsable_inscripto") {
+    return {
+      issuer,
+      salesPoint,
+      to: { condition: "consumidor_final" },
+      items: [{ gross: SMOKE_TEST_MINOR_UNITS, vat: SMOKE_TEST_VAT_RATE }]
+    };
+  }
+  return {
+    issuer,
+    salesPoint,
+    to: { condition: "consumidor_final" },
+    items: [{ amount: SMOKE_TEST_MINOR_UNITS }]
+  };
+}
+function writeOutcome(writer, outcome, input) {
+  if (outcome.kind === "authorized") {
+    writer.ok(describeVoucher(outcome.voucher));
+    writeIssueCall(writer, input);
+    return CLI_EXIT.ok;
+  }
+  if (outcome.kind === "rejected") {
+    writer.fail(
+      `Factura rechazada - ${describeCoordinates(outcome.attempted)}`
+    );
+    for (const issue of outcome.issues) {
+      writer.note(
+        issue.code === void 0 ? issue.message : `${issue.code} ${issue.message}`
+      );
+    }
+    return CLI_EXIT.failed;
+  }
+  if (outcome.kind === "conflict") {
+    writer.fail(`conflicto en ${describeCoordinates(outcome.attempted)}`);
+    writer.note(outcome.reason);
+    writer.note(
+      "Hay otro comprobante en ese n\xFAmero; deten\xE9 el flujo e investig\xE1."
+    );
+    return CLI_EXIT.failed;
+  }
+  writer.fail(`indeterminado ${describeCoordinates(outcome.attempted)}`);
+  writer.note(`${outcome.attempt.reason}, consulta ${outcome.lookup.kind}`);
+  writer.note(
+    "Conserv\xE1 el n\xFAmero y la evidencia; concili\xE1 o repet\xED el mismo input con su clave."
+  );
+  return CLI_EXIT.failed;
+}
+function describeVoucher(voucher) {
+  return [
+    `Factura ${voucher.voucherClass} emitida - ${describeCoordinates(voucher)}`,
+    `CAE ${voucher.cae}`,
+    `Vto. CAE ${formatArcaDate(voucher.caeExpiry)}`,
+    `ARS ${formatMinorUnits(voucher.amounts.sentTotal)}`
+  ].join("   ");
+}
+function describeCoordinates(coordinates) {
+  return `${String(coordinates.salesPoint).padStart(SALES_POINT_DIGITS, "0")}-${String(
+    coordinates.number
+  ).padStart(VOUCHER_NUMBER_DIGITS, "0")}`;
+}
+function formatArcaDate(value) {
+  return /^\d{8}$/.test(value) ? `${value.slice(0, 4)}-${value.slice(4, 6)}-${value.slice(6, 8)}` : value;
+}
+function formatMinorUnits(minorUnits) {
+  const negative = minorUnits < 0;
+  const digits = String(Math.abs(minorUnits)).padStart(3, "0");
+  const whole = digits.slice(0, -2);
+  const cents = digits.slice(-2);
+  const grouped = whole.replace(/\B(?=(\d{3})+(?!\d))/g, ".");
+  return `${negative ? "-" : ""}${grouped},${cents}`;
+}
+function writeIssueCall(writer, input) {
+  writer.blank();
+  writer.line("Esta es la llamada que hizo el CLI. Pegala en tu aplicaci\xF3n:");
+  writer.blank();
+  writer.line("  const factura = await arca.issue({");
+  writer.line(`    issuer: "${input.issuer}",`);
+  writer.line(`    salesPoint: ${input.salesPoint},`);
+  writer.line('    to: { condition: "consumidor_final" },');
+  writer.line(`    items: [${input.items.map(formatItem).join(", ")}],`);
+  writer.line("  });");
+}
+function formatItem(item) {
+  const fields = Object.entries(item).filter(([, value]) => value !== void 0).map(([key, value]) => `${key}: ${String(value)}`);
+  return `{ ${fields.join(", ")} }`;
+}
+
+// src/cli/main.ts
+var COMMANDS = ["init", "cert", "check", "issue"];
+var GLOBAL_OPTIONS = {
+  help: { type: "boolean", short: "h" },
+  version: { type: "boolean", short: "v" },
+  json: { type: "boolean" },
+  "no-color": { type: "boolean" }
+};
+var COMMAND_OPTIONS = {
+  init: {
+    ...GLOBAL_OPTIONS,
+    cuit: { type: "string" },
+    env: { type: "string" },
+    name: { type: "string" },
+    org: { type: "string" },
+    dir: { type: "string" },
+    force: { type: "boolean" },
+    "no-clipboard": { type: "boolean" },
+    "no-paste": { type: "boolean" }
+  },
+  cert: {
+    ...GLOBAL_OPTIONS,
+    env: { type: "string" },
+    dir: { type: "string" },
+    force: { type: "boolean" }
+  },
+  check: {
+    ...GLOBAL_OPTIONS,
+    cert: { type: "string" },
+    key: { type: "string" },
+    "tax-id": { type: "string" },
+    env: { type: "string" },
+    dir: { type: "string" },
+    "sales-point": { type: "string" },
+    "no-cache": { type: "boolean" }
+  },
+  issue: {
+    ...GLOBAL_OPTIONS,
+    cert: { type: "string" },
+    key: { type: "string" },
+    "tax-id": { type: "string" },
+    env: { type: "string" },
+    dir: { type: "string" },
+    "sales-point": { type: "string" },
+    "no-cache": { type: "boolean" },
+    issuer: { type: "string" }
+  }
+};
+async function run(argv, io) {
+  const command = argv.find((token) => !token.startsWith("-"));
+  const wantsHelp = argv.includes("--help") || argv.includes("-h");
+  const wantsVersion = argv.includes("--version") || argv.includes("-v");
+  const noColor = argv.includes("--no-color");
+  const help = (stream, topic) => renderHelp(topic, {
+    color: shouldUseColor(stream, io.env, noColor)
+  });
+  if (wantsVersion) {
+    io.stdout.write(`${readCliVersion()}
+`);
+    return CLI_EXIT.ok;
+  }
+  if (wantsHelp) {
+    io.stdout.write(help(io.stdout, isCommand(command) ? command : "root"));
+    return CLI_EXIT.ok;
+  }
+  if (command === void 0) {
+    io.stderr.write(help(io.stderr, "root"));
+    return CLI_EXIT.usage;
+  }
+  if (!isCommand(command)) {
+    io.stderr.write(
+      `Comando desconocido: ${command}
+
+${help(io.stderr, "root")}`
+    );
+    return CLI_EXIT.usage;
+  }
+  let values;
+  try {
+    ({ values } = parseArgs({
+      args: [...argv],
+      options: COMMAND_OPTIONS[command],
+      allowPositionals: true,
+      strict: true
+    }));
+  } catch (error) {
+    io.stderr.write(
+      `${describeParseError(error)}
+
+${help(io.stderr, command)}`
+    );
+    return CLI_EXIT.usage;
+  }
+  const json = values.json === true;
+  const writer = createWriter(io.stdout, {
+    color: shouldUseColor(io.stdout, io.env, noColor)
+  });
+  if (command === "init") {
+    return await runInit(io, toInitFlags(values), writer);
+  }
+  if (command === "cert") {
+    return await runCert(io, toCertFlags(values), writer);
+  }
+  const given = values["sales-point"];
+  const salesPoint = typeof given === "string" ? parseSalesPoint(given) : void 0;
+  if (typeof given === "string" && salesPoint === void 0) {
+    io.stderr.write(`${describeSalesPointProblem(given)}
+`);
+    return CLI_EXIT.usage;
+  }
+  const shared = toCheckFlags(values, salesPoint);
+  if (command === "check") {
+    return await runCheck(io, shared, writer, json);
+  }
+  return await runIssue(io, toIssueFlags(values, shared), writer, json);
+}
+async function main(argv = process.argv.slice(2), io = createDefaultIo()) {
+  try {
+    process.exitCode = await run(argv, io);
+  } catch (error) {
+    io.stderr.write(`${describeUnknownError(error).diagnosis}
+`);
+    process.exitCode = CLI_EXIT.failed;
+  }
+}
+function createDefaultIo() {
+  return {
+    stdout: process.stdout,
+    stderr: process.stderr,
+    stdin: process.stdin,
+    env: process.env,
+    cwd: process.cwd(),
+    cacheDir: join2(tmpdir(), "facturas-cli"),
+    now: () => /* @__PURE__ */ new Date(),
+    copyToClipboard: (text2) => copyToClipboard(text2, {
+      env: process.env,
+      platform: process.platform
+    }),
+    createClient: (options) => createArcaClient(options),
+    createAuth: (config) => createWsaaAuthModule({ config })
+  };
+}
+function describeParseError(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  const unknownOption = /Unknown option '([^']+)'/.exec(message)?.[1];
+  if (unknownOption !== void 0) {
+    return `Opci\xF3n desconocida: ${unknownOption}`;
+  }
+  const missingValue = /Option '([^']+)' argument missing/.exec(message)?.[1];
+  if (missingValue !== void 0) {
+    return `Falta el valor de ${missingValue}`;
+  }
+  return "Argumentos inv\xE1lidos.";
+}
+function isCommand(value) {
+  return COMMANDS.includes(value);
+}
+function toInitFlags(values) {
+  return {
+    ...text(values, "cuit", "cuit"),
+    ...text(values, "env", "env"),
+    ...text(values, "name", "name"),
+    ...text(values, "org", "org"),
+    ...text(values, "dir", "dir"),
+    ...values.force === true ? { force: true } : {},
+    ...values["no-clipboard"] === true ? { noClipboard: true } : {},
+    ...values["no-paste"] === true ? { noPaste: true } : {}
+  };
+}
+function toCertFlags(values) {
+  return {
+    ...text(values, "env", "env"),
+    ...text(values, "dir", "dir"),
+    ...values.force === true ? { force: true } : {}
+  };
+}
+function toCheckFlags(values, salesPoint) {
+  return {
+    ...text(values, "cert", "cert"),
+    ...text(values, "key", "key"),
+    ...text(values, "tax-id", "taxId"),
+    ...text(values, "env", "env"),
+    ...text(values, "dir", "dir"),
+    ...salesPoint === void 0 ? {} : { salesPoint },
+    ...values["no-cache"] === true ? { noCache: true } : {}
+  };
+}
+function toIssueFlags(values, shared) {
+  return { ...shared, ...text(values, "issuer", "issuer") };
+}
+function text(values, from, to) {
+  const value = values[from];
+  return typeof value === "string" ? { [to]: value } : {};
+}
+export {
+  createDefaultIo,
+  main,
+  run
+};
+//# sourceMappingURL=cli.mjs.map