fintecia 0.1.0 → 1.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fintecia",
-  "version": "0.1.0",
+  "version": "1.0.0",
   "type": "module",
   "description": "MCP local de Fintecia — descarga de CFDI con e-firma, conciliación banco-CFDI, riesgo 69-B/EFOS, deducibilidad fiscal. SAT · CFDI · Conciliación · Seguridad · México · agente AI",
   "license": "MIT",

package/dist/auth/deviceFlow.d.ts

@@ -1,53 +0,0 @@
-/**
- * Device authorization flow client (RFC 8628-style) + Firebase token exchange.
- *
- * The MCP is a PUBLIC client: no client secret. Auth chain:
- *   1. `start()` → Fintecia `/device/start` returns device_code + user_code +
- *      verification_uri.
- *   2. The user opens verification_uri in the browser, signs in with Google+MFA
- *      (the existing Fintecia auth), and enters the user_code.
- *   3. `poll()` → Fintecia `/device/token` returns a Firebase custom token once
- *      the user authorized.
- *   4. `exchange()` → Firebase REST `accounts:signInWithCustomToken` swaps the
- *      custom token for an ID token + refresh token.
- *
- * The custom token is minted server-side (firebase-admin `createCustomToken`)
- * and MUST preserve the MFA step-up claim (see `functions/src/utils/callable.ts`).
- *
- * Contract is documented here for the backend implementation (T3). No secrets
- * live in this client: `firebaseApiKey` is a public Web API key.
- */
-export interface DeviceStartResponse {
-    deviceCode: string;
-    userCode: string;
-    verificationUri: string;
-    expiresIn: number;
-    interval: number;
-}
-export interface DeviceTokenResponse {
-    status: "pending" | "authorized" | "denied" | "expired";
-    customToken?: string;
-}
-export interface AuthSession {
-    idToken: string;
-    refreshToken: string;
-}
-export interface DeviceFlowConfig {
-    /** Fintecia backend base URL (no trailing slash). */
-    baseUrl: string;
-    /** Firebase Web API key (public, used only for the token exchange). */
-    firebaseApiKey: string;
-    /** Injectable fetch for tests. */
-    fetchFn?: typeof fetch;
-}
-export declare class DeviceFlowClient {
-    private readonly config;
-    constructor(config: DeviceFlowConfig);
-    private fetch;
-    start(): Promise<DeviceStartResponse>;
-    poll(deviceCode: string): Promise<DeviceTokenResponse>;
-    /** Exchange a Firebase custom token for an ID token + refresh token. */
-    exchange(customToken: string): Promise<AuthSession>;
-    /** Refresh an expired ID token via the Firebase secure-token endpoint. */
-    refresh(refreshToken: string): Promise<AuthSession>;
-}

package/dist/auth/deviceFlow.js

@@ -1,83 +0,0 @@
-/**
- * Device authorization flow client (RFC 8628-style) + Firebase token exchange.
- *
- * The MCP is a PUBLIC client: no client secret. Auth chain:
- *   1. `start()` → Fintecia `/device/start` returns device_code + user_code +
- *      verification_uri.
- *   2. The user opens verification_uri in the browser, signs in with Google+MFA
- *      (the existing Fintecia auth), and enters the user_code.
- *   3. `poll()` → Fintecia `/device/token` returns a Firebase custom token once
- *      the user authorized.
- *   4. `exchange()` → Firebase REST `accounts:signInWithCustomToken` swaps the
- *      custom token for an ID token + refresh token.
- *
- * The custom token is minted server-side (firebase-admin `createCustomToken`)
- * and MUST preserve the MFA step-up claim (see `functions/src/utils/callable.ts`).
- *
- * Contract is documented here for the backend implementation (T3). No secrets
- * live in this client: `firebaseApiKey` is a public Web API key.
- */
-export class DeviceFlowClient {
-    config;
-    constructor(config) {
-        this.config = config;
-    }
-    fetch(input, init) {
-        const fn = this.config.fetchFn ?? fetch;
-        return fn(input, init);
-    }
-    async start() {
-        const res = await this.fetch(`${this.config.baseUrl}/api/v1/device/start`, {
-            method: "POST",
-        });
-        if (!res.ok) {
-            throw new Error(`device/start failed: ${res.status}`);
-        }
-        return (await res.json());
-    }
-    async poll(deviceCode) {
-        const res = await this.fetch(`${this.config.baseUrl}/api/v1/device/token`, {
-            method: "POST",
-            headers: { "content-type": "application/json" },
-            body: JSON.stringify({ deviceCode }),
-        });
-        if (!res.ok) {
-            throw new Error(`device/token failed: ${res.status}`);
-        }
-        return (await res.json());
-    }
-    /** Exchange a Firebase custom token for an ID token + refresh token. */
-    async exchange(customToken) {
-        const url = `https://identitytoolkit.googleapis.com/v1/accounts:signInWithCustomToken` +
-            `?key=${encodeURIComponent(this.config.firebaseApiKey)}`;
-        const res = await this.fetch(url, {
-            method: "POST",
-            headers: { "content-type": "application/json" },
-            body: JSON.stringify({ token: customToken, returnSecureToken: true }),
-        });
-        if (!res.ok) {
-            throw new Error(`custom token exchange failed: ${res.status}`);
-        }
-        const body = (await res.json());
-        return { idToken: body.idToken, refreshToken: body.refreshToken };
-    }
-    /** Refresh an expired ID token via the Firebase secure-token endpoint. */
-    async refresh(refreshToken) {
-        const url = `https://securetoken.googleapis.com/v1/token` +
-            `?key=${encodeURIComponent(this.config.firebaseApiKey)}`;
-        const res = await this.fetch(url, {
-            method: "POST",
-            headers: { "content-type": "application/x-www-form-urlencoded" },
-            body: new URLSearchParams({
-                grant_type: "refresh_token",
-                refresh_token: refreshToken,
-            }).toString(),
-        });
-        if (!res.ok) {
-            throw new Error(`refresh failed: ${res.status}`);
-        }
-        const body = (await res.json());
-        return { idToken: body.id_token, refreshToken: body.refresh_token };
-    }
-}
-//# sourceMappingURL=deviceFlow.js.map

package/dist/auth/deviceFlow.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"deviceFlow.js","sourceRoot":"","sources":["../../src/auth/deviceFlow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AA6BH,MAAM,OAAO,gBAAgB;IACE;IAA7B,YAA6B,MAAwB;QAAxB,WAAM,GAAN,MAAM,CAAkB;IAAG,CAAC;IAEjD,KAAK,CAAC,KAAa,EAAE,IAAkB;QAC7C,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC;QACxC,OAAO,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,sBAAsB,EAAE;YACzE,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,UAAkB;QAC3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,sBAAsB,EAAE;YACzE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,CAAC;SACrC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAC;IACnD,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,QAAQ,CAAC,WAAmB;QAChC,MAAM,GAAG,GACP,0EAA0E;YAC1E,QAAQ,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QAC3D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA8C,CAAC;QAC7E,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;IACpE,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,OAAO,CAAC,YAAoB;QAChC,MAAM,GAAG,GACP,6CAA6C;YAC7C,QAAQ,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QAC3D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,YAAY;aAC5B,CAAC,CAAC,QAAQ,EAAE;SACd,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAgD,CAAC;QAC/E,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;IACtE,CAAC;CACF"}

package/dist/public/data/debts.fixture.json

@@ -1,4 +0,0 @@
-[
-  { "rfc": "GIM150525L37", "nombre": "GIMORU, S.A. DE C.V.", "situacion": "credito_firme" },
-  { "rfc": "XAXX010101000", "nombre": "PÚBLICO EN GENERAL", "situacion": "credito_firme" }
-]

package/dist/public/data/efos.fixture.json

@@ -1,8 +0,0 @@
-[
-  { "rfc": "AAA080808HL8", "nombre": "ASESORES EN AVALÚOS Y ACTIVOS, S.A. DE C.V.", "situacion": "sentencia_favorable", "oficio": "500-05-2018-16632" },
-  { "rfc": "AAA091014835", "nombre": "AQUAERIS ACUACULTURA Y ARQUITECTURA SUSTENTABLE, S.C.", "situacion": "desvirtuado", "oficio": "500-05-2016-38728" },
-  { "rfc": "AAA100303L51", "nombre": "INGENIOS SANTOS, S.A. DE C.V.", "situacion": "desvirtuado", "oficio": "500-05-2017-38736" },
-  { "rfc": "AAA120730823", "nombre": "ASESORES Y ADMINISTRADORES AGRICOLAS, S. DE R.L. DE C.V.", "situacion": "definitivo", "oficio": "500-05-2016-38728" },
-  { "rfc": "AAC120810NCA", "nombre": "AAA ASESORIA Y CAPACITACION EMPRESARIAL, S.C.", "situacion": "definitivo", "oficio": "500-05-2018-29883" },
-  { "rfc": "AAC1805044A8", "nombre": "ASESORES ACOST, S.C.", "situacion": "presunto", "oficio": "500-05-00-00-00-2026-21664" }
-]

package/dist/public/efos.d.ts

@@ -1,28 +0,0 @@
-/**
- * SAT 69-B (EFOS) lookup — contribuyentes con operaciones presuntamente
- * inexistentes. Public, no auth. The full list is refreshed from the SAT open
- * data (or a mirror); a small fixture is bundled so the tool works out of the
- * box for testing.
- *
- * Correctness-critical: a false "not on the list" is dangerous. Normalize the
- * RFC (uppercase, no whitespace) before lookup.
- */
-export type EfosSituacion = "presunto" | "definitivo" | "desvirtuado" | "sentencia_favorable";
-export interface EfosEntry {
-    rfc: string;
-    nombre: string;
-    situacion: EfosSituacion;
-    /** Oficio de notificación (SAT), si se conoce. */
-    oficio?: string;
-    /** Fecha de publicación (ISO YYYY-MM-DD), si se conoce. */
-    fechaPublicacion?: string;
-}
-export declare function normalizeRfc(rfc: string): string;
-export declare class EfosLookup {
-    private readonly byRfc;
-    constructor(entries: EfosEntry[]);
-    check(rfc: string): EfosEntry | null;
-    get size(): number;
-    /** Build an EfosLookup from raw JSON (array of EfosEntry). */
-    static fromJson(json: unknown): EfosLookup;
-}

package/dist/public/efos.js

@@ -1,45 +0,0 @@
-/**
- * SAT 69-B (EFOS) lookup — contribuyentes con operaciones presuntamente
- * inexistentes. Public, no auth. The full list is refreshed from the SAT open
- * data (or a mirror); a small fixture is bundled so the tool works out of the
- * box for testing.
- *
- * Correctness-critical: a false "not on the list" is dangerous. Normalize the
- * RFC (uppercase, no whitespace) before lookup.
- */
-export function normalizeRfc(rfc) {
-    return rfc.trim().toUpperCase();
-}
-export class EfosLookup {
-    byRfc;
-    constructor(entries) {
-        this.byRfc = new Map(entries.map((e) => [normalizeRfc(e.rfc), e]));
-    }
-    check(rfc) {
-        return this.byRfc.get(normalizeRfc(rfc)) ?? null;
-    }
-    get size() {
-        return this.byRfc.size;
-    }
-    /** Build an EfosLookup from raw JSON (array of EfosEntry). */
-    static fromJson(json) {
-        if (!Array.isArray(json)) {
-            throw new Error("EFOS data must be an array");
-        }
-        const entries = json.map((e) => {
-            const item = e;
-            if (typeof item.rfc !== "string" || typeof item.situacion !== "string") {
-                throw new Error("EFOS entry missing rfc/situacion");
-            }
-            return {
-                rfc: item.rfc,
-                nombre: item.nombre ?? "",
-                situacion: item.situacion,
-                oficio: item.oficio,
-                fechaPublicacion: item.fechaPublicacion,
-            };
-        });
-        return new EfosLookup(entries);
-    }
-}
-//# sourceMappingURL=efos.js.map

package/dist/public/efos.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"efos.js","sourceRoot":"","sources":["../../src/public/efos.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAkBH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,OAAO,UAAU;IACJ,KAAK,CAAyB;IAE/C,YAAY,OAAoB;QAC9B,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,GAAW;QACf,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;IACnD,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACzB,CAAC;IAED,8DAA8D;IAC9D,MAAM,CAAC,QAAQ,CAAC,IAAa;QAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,OAAO,GAAgB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC1C,MAAM,IAAI,GAAG,CAAuB,CAAC;YACrC,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBACvE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACtD,CAAC;YACD,OAAO;gBACL,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;gBACzB,SAAS,EAAE,IAAI,CAAC,SAA0B;gBAC1C,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;aACxC,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;CACF"}