# latam-oiv-resolver > Multi-country critical infrastructure operator (OIV) resolver for Latin America. > Unified API and JSON Schema for resolving "Operadores de Importancia Vital" (OIV) > equivalents across LATAM cybersecurity regulatory frameworks. [![License: Apache 2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](LICENSE) [![npm version](https://img.shields.io/badge/npm-v0.1.0--alpha.1-orange.svg)](https://www.npmjs.com/package/latam-oiv-resolver) [![Status](https://img.shields.io/badge/status-alpha-yellow.svg)](#status-v010-alpha1--pilot-scope) [![Node](https://img.shields.io/badge/node-%3E%3D18-brightgreen.svg)](package.json) [![CI](https://github.com/raceksd-source/latam-oiv-resolver/actions/workflows/ci.yml/badge.svg)](https://github.com/raceksd-source/latam-oiv-resolver/actions/workflows/ci.yml) [![CodeQL](https://github.com/raceksd-source/latam-oiv-resolver/actions/workflows/codeql.yml/badge.svg)](https://github.com/raceksd-source/latam-oiv-resolver/actions/workflows/codeql.yml) [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/raceksd-source/latam-oiv-resolver/badge)](https://scorecard.dev/viewer/?uri=github.com/raceksd-source/latam-oiv-resolver) Read this in: **English** · [Español](README.es.md) · [Português (BR)](README.pt-br.md) --- ## Status: `v0.1.0-alpha.1` · pilot scope > **Not production-ready.** This is an intentional alpha skeleton. Only Chile > delegates to a production-tested resolver today. All other countries are > stubs that document official sources and invite in-country contributors. | Country | Status | Coverage source | |---|---|---| | Chile (CL) | Stable (via companion) | [`anci-oiv-resolver`](https://github.com/raceksd-source/anci-oiv-resolver) v0.5.0 | | Argentina (AR) | Stub · pilot | Awaiting contribution | | Brasil (BR) | Stub · pilot (priority) | Awaiting contribution | | Colombia (CO) | Stub · pilot | Awaiting contribution | | Uruguay (UY) | Stub · pilot | Awaiting contribution | | México (MX) | Stub · planned | Awaiting contribution | | Perú (PE) | Stub · planned | Awaiting contribution | | Ecuador (EC) | Stub · planned | Awaiting contribution | | Costa Rica (CR) | Stub · planned | Awaiting contribution | | Panamá (PA) | Stub · planned | Awaiting contribution | --- ## Quick start ```bash npm install latam-oiv-resolver # Optional · enables live Chile (CL) coverage: npm install anci-oiv-resolver ``` ```typescript import { resolveOperator } from 'latam-oiv-resolver'; const operator = await resolveOperator({ country: 'CL', identifier: '97006000-6', razonSocial: 'BANCO DE CRÉDITO E INVERSIONES', }); // → { country: 'CL', domain: 'bci.cl', sector: 'banking_finance', // source: 'companion-package', confidence: 1.0, ... } ``` See [`examples/`](examples/) for runnable scripts. --- ## What it does - **Normalizes national identifiers** across LATAM tax/registry formats (RUT · CNPJ · CPF · RFC · CUIT · NIT · RUC · Cédula Jurídica). - **Resolves operator → canonical domain** per country, with confidence scoring and explicit provenance (`official-registry` · `companion-package` · `community-curated` · `heuristic` · `stub`). - **Exposes a single JSON Schema** so every country dataset validates against the same contract — see [`data/schema.json`](data/schema.json). - **Ships zero findings, CVSS scores, or vulnerability intelligence.** The scope is identifier ↔ operator ↔ domain. Nothing more. --- ## Supported countries | Country | Identifier(s) | Regulatory reference | Status | |---|---|---|---| | Chile (CL) | `RUT` | Ley 21.663 · ANCI | Stable (via companion) | | Brasil (BR) | `CNPJ` · `CPF` | PNSI · LGPD (Lei 13.709) · GSI/PR | Pilot stub | | Argentina (AR) | `CUIT` · `CUIL` | Estrategia Nacional de Ciberseguridad | Pilot stub | | Uruguay (UY) | `RUT` (UY) | Marco AGESIC | Pilot stub | | Colombia (CO) | `NIT` | CONPES 3854 · Ley 2300 · ColCERT | Pilot stub | | México (MX) | `RFC` | LFPDPPP · Sectores Estratégicos | Planned | | Perú (PE) | `RUC` | DLeg 1412 · Política Nac. Ciberseguridad | Planned | | Ecuador (EC) | `RUC` | Política Nacional de Ciberseguridad | Planned | | Costa Rica (CR) | `Cédula Jurídica` | MICITT · Estrategia Nacional | Planned | | Panamá (PA) | `RUC` | AIG · Estrategia Nacional | Planned | Generic mentions of national regulators (ANCI · AGESIC · GSI/PR · ColCERT) do **not** imply endorsement or partnership. Source-of-truth remains each regulator's official publication. --- ## API reference ### `resolveOperator(input, options?)` ```typescript async function resolveOperator( input: OperatorIdentifier, options?: ResolveOptions ): Promise; ``` | Field | Type | Description | |---|---|---| | `input.country` | `LATAMCountry` | ISO 3166-1 alpha-2 (`CL` · `BR` · `MX` · …) | | `input.identifier` | `string` | National identifier in any common formatting | | `input.razonSocial` | `string?` | Legal name (recommended for heuristic fallback) | | `options.verify` | `boolean?` | Request DNS verification where supported | | `options.refresh` | `boolean?` | Force adapter cache reload (rare) | Returns a `ResolvedOperator`: ```typescript interface ResolvedOperator { country: LATAMCountry; identifier: string; // normalized form identifierType: IdentifierType; domain: string | null; razonSocial: string | null; sector: LATAMSector; sectorLocal?: string; source: ResolutionSource; confidence: number; // 0–1 verified: boolean | null; note?: string; } ``` ### `resolveBatch(inputs, options?)` ```typescript async function resolveBatch( inputs: OperatorIdentifier[], options?: ResolveOptions ): Promise; ``` Groups inputs by country so each country adapter is loaded once. ### `normalize(country, identifier)` · `isValidIdentifier(country, identifier)` ```typescript import { normalize, isValidIdentifier } from 'latam-oiv-resolver'; normalize('CL', '76.086.428-5'); // → '76086428-5' normalize('BR', '00000000000191'); // → '00.000.000/0001-91' normalize('MX', 'xaxx010101000'); // → 'XAXX010101000' normalize('AR', '30500001735'); // → '30-50000173-5' isValidIdentifier('CL', '97006000-6'); // → true ``` ### `listCountries()` Returns the array of `LATAMCountry` codes currently exposed by the package (implemented adapters plus pilot stubs). Full surface area: see [`src/types.ts`](src/types.ts). --- ## Methodology `latam-oiv-resolver` operates strictly on **passive OSINT**. Domain resolution uses public DNS (A · AAAA · MX records) and curated mappings from public regulator publications and national registries. No active scanning, no unauthorized access, no proprietary data sources. Coordinated vulnerability disclosure references are framed **conforme a los principios de ISO/IEC 29147:2018** and **ISO/IEC 30111:2019**. These standards are referenced as process frameworks, not as certification claims. Per-country contribution methodology is documented in [`docs/METHODOLOGY-LATAM.md`](docs/METHODOLOGY-LATAM.md). Architecture and adapter contract are documented in [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md). --- ## Companion package Chile (CL) coverage is delegated to [`anci-oiv-resolver`](https://github.com/raceksd-source/anci-oiv-resolver) v0.5.0, a single-country reference implementation for the 915 entities designated under Ley 21.663 (ANCI registry). Install it as an optional peer dependency to enable live CL resolution: ```bash npm install anci-oiv-resolver ``` Without the companion package, CL calls fall back to the stub adapter (the public registry remains available; only the resolution path differs). --- ## Contributing a country Each new country requires: 1. **Legal framework documentation** — `data/countries/{cc}/source.md` 2. **Identifier normalizer** — `src/normalizers/{type}-{cc}.ts` 3. **Country adapter** — `src/adapters/{cc}-{regulator}.ts` 4. **Entity dataset (JSON Schema-validated)** — `data/countries/{cc}/known-domains.json` 5. **Unit tests + per-country documentation** Country datasets are stewarded by contributors resident in (or with verified expertise on) that country's framework. See [`CONTRIBUTING.md`](CONTRIBUTING.md) and the [New Country issue template](.github/ISSUE_TEMPLATE/new-country.yml). --- ## Design principles 1. **One JSON Schema, many countries.** All datasets validate against [`data/schema.json`](data/schema.json). 2. **Public sources only.** Every entry must cite a publicly accessible regulator or registry publication. No scraping of private portals. 3. **Country-stewarded.** A country dataset is maintained by in-country contributors with verified subject-matter expertise. 4. **Versioned data, semantic releases.** Adding a country is a `MINOR` bump, correcting an entity is a `PATCH`, breaking schema changes are `MAJOR`. 5. **Aligned with ISO/IEC 29147:2018 / 30111:2019** as a process reference. Not a certification claim. --- ## Roadmap - **Q3 2026** — 5-country pilot stabilization (CL stable · AR · UY · BR · CO). - **Q4 2026** — Add MX · PE · EC pilot adapters · cut `v1.0.0` stable. - **Q1–Q2 2027** — Extend to CR · PA · DO · PY · BO · VE · GT · SV · NI · HN. - **2028+** — LATAM 95%+ coverage · annual update cadence aligned with each national regulator's revision cycle. Full roadmap: [`docs/ROADMAP.md`](docs/ROADMAP.md). Governance: [`docs/GOVERNANCE.md`](docs/GOVERNANCE.md). --- ## License Apache License 2.0 · see [LICENSE](LICENSE). --- ## Citation Machine-readable citation: [`CITATION.cff`](CITATION.cff). ```bibtex @misc{mellafe2026latam, author = {Mellafe Zuvic, David}, title = {latam-oiv-resolver: Multi-country Critical Infrastructure Operator Resolver for Latin America}, year = {2026}, publisher = {GitHub}, version = {v0.1.0-alpha.1}, howpublished = {\url{https://github.com/raceksd-source/latam-oiv-resolver}} } ``` --- ## Maintained by **Reizan** · independent cybersecurity research company. Operated through **AlmaAI SpA** (RUT 78.387.715-5) · La Serena, Chile. Maintainer: **David Mellafe Zuvic** · [david@reizan.io](mailto:david@reizan.io) ## Security To report a vulnerability privately, see [SECURITY.md](SECURITY.md).