@baruk/core 0.3.0 → 0.4.2

package/dist/cjs/users/repository.js

@@ -3,7 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.listTenantMembers = listTenantMembers;
 exports.setUserRole = setUserRole;
 exports.setMembershipStatus = setMembershipStatus;
+exports.inviteUser = inviteUser;
+exports.reissueStaffActivation = reissueStaffActivation;
 const shared_1 = require("@baruk/shared");
+const password_reset_js_1 = require("../auth/password-reset.js");
+const audit_js_1 = require("../audit/audit.js");
 const ADMIN_ROLE_KEYS = ['owner', 'admin'];
 async function listTenantMembers(tx) {
     const rows = await tx `
@@ -43,7 +47,9 @@ async function countActiveAdmins(tx, excludeUserId) {
 async function setUserRole(tx, userId, roleKey) {
     // Guard: não permitir rebaixar o último admin.
     const isAdminTarget = ADMIN_ROLE_KEYS.includes(roleKey);
-    if (!isAdminTarget && (await isUserAdmin(tx, userId)) && (await countActiveAdmins(tx, userId)) === 0) {
+    if (!isAdminTarget &&
+        (await isUserAdmin(tx, userId)) &&
+        (await countActiveAdmins(tx, userId)) === 0) {
         throw new shared_1.ConflictError('Não é possível rebaixar o último administrador do tenant');
     }
     const role = await tx `SELECT id FROM role WHERE key = ${roleKey} AND tenant_id IS NULL`;
@@ -69,7 +75,9 @@ async function isUserAdmin(tx, userId) {
 }
 /** Ativa/desativa (ou revoga) a membership. Bloqueia desativar o último admin. */
 async function setMembershipStatus(tx, userId, status) {
-    if (status !== 'active' && (await isUserAdmin(tx, userId)) && (await countActiveAdmins(tx, userId)) === 0) {
+    if (status !== 'active' &&
+        (await isUserAdmin(tx, userId)) &&
+        (await countActiveAdmins(tx, userId)) === 0) {
         throw new shared_1.ConflictError('Não é possível desativar o último administrador do tenant');
     }
     const rows = await tx `
@@ -80,4 +88,113 @@ async function setMembershipStatus(tx, userId, status) {
   `;
     return rows.count;
 }
+/**
+ * Convida um usuário para o tenant corrente: cria (ou reaproveita, se o
+ * e-mail já existe em outro tenant — identidade é global/SSO) o registro de
+ * `user`, a `membership` em status `invited` e o papel. Para usuário novo,
+ * emite o token de ativação; a camada HTTP compõe o link e envia o e-mail
+ * (core não conhece BARUK_HUB_URL/Resend — mesma separação de
+ * `requestPasswordReset`).
+ */
+async function inviteUser(tx, input) {
+    const tenantId = await currentTenantId(tx);
+    const existing = await tx `
+    SELECT id, full_name, status, user_type FROM "user" WHERE email = ${input.email} AND deleted_at IS NULL
+  `;
+    let userId;
+    let fullName;
+    let isNewUser;
+    if (existing[0]) {
+        // Uma identidade de contribuinte não pode ser promovida para staff por
+        // convite. Os fluxos têm permissões, superfície e ciclo de recuperação
+        // próprios; misturá-los aqui criaria uma conta dual-role insegura.
+        if (existing[0].user_type !== 'staff') {
+            throw new shared_1.ConflictError('Este e-mail já pertence a uma identidade do Portal. Use uma identidade staff distinta.');
+        }
+        userId = existing[0].id;
+        fullName = existing[0].full_name;
+        isNewUser = false;
+        const already = await tx `
+      SELECT id FROM membership WHERE user_id = ${userId} AND tenant_id = ${tenantId} AND deleted_at IS NULL
+    `;
+        if (already[0])
+            throw new shared_1.ConflictError('Usuário já pertence a este tenant');
+    }
+    else {
+        userId = (0, shared_1.uuidv7)();
+        fullName = input.fullName;
+        isNewUser = true;
+        await tx `
+      INSERT INTO "user" (id, email, full_name, user_type, status, auth_provider)
+      VALUES (${userId}, ${input.email}, ${input.fullName}, 'staff', 'invited', 'password')
+    `;
+    }
+    await tx `
+    INSERT INTO membership (id, tenant_id, user_id, status, invited_by)
+    VALUES (${(0, shared_1.uuidv7)()}, ${tenantId}, ${userId}, 'invited', ${input.invitedBy})
+  `;
+    await setUserRole(tx, userId, input.roleKey);
+    let activationToken = null;
+    if (isNewUser) {
+        const activation = await (0, password_reset_js_1.createActivationToken)(tx, { userId, tenantId });
+        activationToken = activation.token;
+    }
+    await (0, audit_js_1.appendAudit)(tx, {
+        actorId: input.invitedBy,
+        action: 'user_invited',
+        resourceType: 'user',
+        resourceId: userId,
+        metadata: { email: input.email, roleKey: input.roleKey, isNewUser },
+    });
+    return { userId, email: input.email, fullName, activationToken };
+}
+/**
+ * Reemite o convite de primeiro acesso exclusivamente para staff que ainda
+ * está pendente neste tenant. A emissão substitui (e invalida) o link anterior
+ * para que um token exposto nunca continue utilizável após o reenvio.
+ */
+async function reissueStaffActivation(tx, input) {
+    const tenantId = await currentTenantId(tx);
+    const rows = await tx `
+    SELECT
+      u.email,
+      u.full_name,
+      u.user_type,
+      u.status AS user_status,
+      m.status AS membership_status
+    FROM membership m
+    JOIN "user" u ON u.id = m.user_id
+    WHERE m.tenant_id = ${tenantId}
+      AND m.user_id = ${input.userId}
+      AND m.deleted_at IS NULL
+      AND u.deleted_at IS NULL
+    LIMIT 1
+  `;
+    const member = rows[0];
+    if (!member)
+        throw new shared_1.NotFoundError('Usuário não encontrado neste tenant');
+    if (member.user_type !== 'staff' ||
+        member.user_status !== 'invited' ||
+        member.membership_status !== 'invited') {
+        throw new shared_1.ConflictError('Convite não pode ser reenviado neste estado');
+    }
+    const activation = await (0, password_reset_js_1.createActivationToken)(tx, { userId: input.userId, tenantId });
+    await (0, audit_js_1.appendAudit)(tx, {
+        actorId: input.invitedBy,
+        action: 'user_invite_reissued',
+        resourceType: 'user',
+        resourceId: input.userId,
+        metadata: { email: member.email },
+    });
+    return {
+        userId: input.userId,
+        email: member.email,
+        fullName: member.full_name,
+        activationToken: activation.token,
+    };
+}
+async function currentTenantId(tx) {
+    const rows = await tx `SELECT current_setting('app.current_tenant')::uuid AS tenant_id`;
+    return rows[0].tenant_id;
+}
 //# sourceMappingURL=repository.js.map

package/dist/cjs/users/repository.js.map

@@ -1 +1 @@
-{"version":3,"file":"repository.js","sourceRoot":"","sources":["../../../src/users/repository.ts"],"names":[],"mappings":";;AAkBA,8CAuBC;AAgBD,kCAiBC;AAYD,kDAeC;AArGD,0CAAsD;AAgBtD,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAEpC,KAAK,UAAU,iBAAiB,CAAC,EAAM;IAC5C,MAAM,IAAI,GAAG,MAAM,EAAE,CAEpB;;;;;;;;;;;GAWA,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtB,MAAM,EAAE,CAAC,CAAC,OAAO;QACjB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,gBAAgB,EAAE,CAAC,CAAC,MAAM;QAC1B,KAAK,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE;KACzB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,EAAM,EAAE,aAAsB;IAC7D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAiB;;;;;;wBAMhB,eAAe;aAC1B,aAAa,IAAI,IAAI,kCAAkC,aAAa,IAAI,IAAI;GACtF,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,kFAAkF;AAC3E,KAAK,UAAU,WAAW,CAAC,EAAM,EAAE,MAAc,EAAE,OAAe;IACvE,+CAA+C;IAC/C,MAAM,aAAa,GAAG,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,aAAa,IAAI,CAAC,MAAM,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,iBAAiB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACrG,MAAM,IAAI,sBAAa,CAAC,0DAA0D,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAkB,mCAAmC,OAAO,wBAAwB,CAAC;IAC1G,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,sBAAa,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC;IACxE,MAAM,EAAE,CAAA;;sBAEY,MAAM;;GAEzB,CAAC;IACF,MAAM,EAAE,CAAA;;cAEI,IAAA,eAAM,GAAE,kDAAkD,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;GAC1F,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,EAAM,EAAE,MAAc;IAC/C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAiB;;;yBAGf,MAAM,8CAA8C,eAAe;GACzF,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,kFAAkF;AAC3E,KAAK,UAAU,mBAAmB,CACvC,EAAM,EACN,MAAc,EACd,MAAwC;IAExC,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,iBAAiB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1G,MAAM,IAAI,sBAAa,CAAC,2DAA2D,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;qCACc,MAAM;sBACrB,MAAM;;;GAGzB,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC"}
+{"version":3,"file":"repository.js","sourceRoot":"","sources":["../../../src/users/repository.ts"],"names":[],"mappings":";;AAoBA,8CA8BC;AAgBD,kCAuBC;AAYD,kDAmBC;AAiCD,gCA0DC;AAOD,wDAqDC;AA/QD,0CAAqE;AAErE,iEAAkE;AAClE,gDAAgD;AAehD,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAEpC,KAAK,UAAU,iBAAiB,CAAC,EAAM;IAC5C,MAAM,IAAI,GAAG,MAAM,EAAE,CASpB;;;;;;;;;;;GAWA,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtB,MAAM,EAAE,CAAC,CAAC,OAAO;QACjB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,gBAAgB,EAAE,CAAC,CAAC,MAAM;QAC1B,KAAK,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE;KACzB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,EAAM,EAAE,aAAsB;IAC7D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAiB;;;;;;wBAMhB,eAAe;aAC1B,aAAa,IAAI,IAAI,kCAAkC,aAAa,IAAI,IAAI;GACtF,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,kFAAkF;AAC3E,KAAK,UAAU,WAAW,CAAC,EAAM,EAAE,MAAc,EAAE,OAAe;IACvE,+CAA+C;IAC/C,MAAM,aAAa,GAAG,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACxD,IACE,CAAC,aAAa;QACd,CAAC,MAAM,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/B,CAAC,MAAM,iBAAiB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,EAC3C,CAAC;QACD,MAAM,IAAI,sBAAa,CAAC,0DAA0D,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,EAAE,CAEpB,mCAAmC,OAAO,wBAAwB,CAAC;IACpE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,sBAAa,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC;IACxE,MAAM,EAAE,CAAA;;sBAEY,MAAM;;GAEzB,CAAC;IACF,MAAM,EAAE,CAAA;;cAEI,IAAA,eAAM,GAAE,kDAAkD,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;GAC1F,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,EAAM,EAAE,MAAc;IAC/C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAiB;;;yBAGf,MAAM,8CAA8C,eAAe;GACzF,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,kFAAkF;AAC3E,KAAK,UAAU,mBAAmB,CACvC,EAAM,EACN,MAAc,EACd,MAAwC;IAExC,IACE,MAAM,KAAK,QAAQ;QACnB,CAAC,MAAM,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/B,CAAC,MAAM,iBAAiB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,EAC3C,CAAC;QACD,MAAM,IAAI,sBAAa,CAAC,2DAA2D,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;qCACc,MAAM;sBACrB,MAAM;;;GAGzB,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAyBD;;;;;;;GAOG;AACI,KAAK,UAAU,UAAU,CAAC,EAAM,EAAE,KAAsB;IAC7D,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,EAAE,CAAC,CAAC;IAE3C,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAwE;wEAC3B,KAAK,CAAC,KAAK;GAChF,CAAC;IAEF,IAAI,MAAc,CAAC;IACnB,IAAI,QAAgB,CAAC;IACrB,IAAI,SAAkB,CAAC;IAEvB,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAChB,uEAAuE;QACvE,uEAAuE;QACvE,mEAAmE;QACnE,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;YACtC,MAAM,IAAI,sBAAa,CACrB,wFAAwF,CACzF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxB,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACjC,SAAS,GAAG,KAAK,CAAC;QAClB,MAAM,OAAO,GAAG,MAAM,EAAE,CAAkB;kDACI,MAAM,oBAAoB,QAAQ;KAC/E,CAAC;QACF,IAAI,OAAO,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,sBAAa,CAAC,mCAAmC,CAAC,CAAC;IAC/E,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,IAAA,eAAM,GAAE,CAAC;QAClB,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAC1B,SAAS,GAAG,IAAI,CAAC;QACjB,MAAM,EAAE,CAAA;;gBAEI,MAAM,KAAK,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,QAAQ;KACpD,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,CAAA;;cAEI,IAAA,eAAM,GAAE,KAAK,QAAQ,KAAK,MAAM,gBAAgB,KAAK,CAAC,SAAS;GAC1E,CAAC;IACF,MAAM,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAE7C,IAAI,eAAe,GAAkB,IAAI,CAAC;IAC1C,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,UAAU,GAAG,MAAM,IAAA,yCAAqB,EAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzE,eAAe,GAAG,UAAU,CAAC,KAAK,CAAC;IACrC,CAAC;IAED,MAAM,IAAA,sBAAW,EAAC,EAAE,EAAE;QACpB,OAAO,EAAE,KAAK,CAAC,SAAS;QACxB,MAAM,EAAE,cAAc;QACtB,YAAY,EAAE,MAAM;QACpB,UAAU,EAAE,MAAM;QAClB,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE;KACpE,CAAC,CAAC;IAEH,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,sBAAsB,CAC1C,EAAM,EACN,KAA4C;IAE5C,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,EAAE,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,MAAM,EAAE,CAQpB;;;;;;;;;0BASuB,QAAQ;wBACV,KAAK,CAAC,MAAM;;;;GAIjC,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,sBAAa,CAAC,qCAAqC,CAAC,CAAC;IAC5E,IACE,MAAM,CAAC,SAAS,KAAK,OAAO;QAC5B,MAAM,CAAC,WAAW,KAAK,SAAS;QAChC,MAAM,CAAC,iBAAiB,KAAK,SAAS,EACtC,CAAC;QACD,MAAM,IAAI,sBAAa,CAAC,6CAA6C,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,IAAA,yCAAqB,EAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACvF,MAAM,IAAA,sBAAW,EAAC,EAAE,EAAE;QACpB,OAAO,EAAE,KAAK,CAAC,SAAS;QACxB,MAAM,EAAE,sBAAsB;QAC9B,YAAY,EAAE,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,MAAM;QACxB,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE;KAClC,CAAC,CAAC;IAEH,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,MAAM,CAAC,SAAS;QAC1B,eAAe,EAAE,UAAU,CAAC,KAAK;KAClC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,EAAM;IACnC,MAAM,IAAI,GAAG,MAAM,EAAE,CAEpB,iEAAiE,CAAC;IACnE,OAAO,IAAI,CAAC,CAAC,CAAE,CAAC,SAAS,CAAC;AAC5B,CAAC"}

package/dist/cjs/vault/repository.js

@@ -4,9 +4,12 @@ exports.createCredential = createCredential;
 exports.listCredentials = listCredentials;
 exports.getCredentialMeta = getCredentialMeta;
 exports.revealSecret = revealSecret;
+exports.revealSecretByName = revealSecretByName;
 exports.rotateSecret = rotateSecret;
 exports.softDeleteCredential = softDeleteCredential;
 exports.listExpiringCredentials = listExpiringCredentials;
+exports.findCredentialExpiryByName = findCredentialExpiryByName;
+exports.findCredentialIdByName = findCredentialIdByName;
 const shared_1 = require("@baruk/shared");
 const crypto_js_1 = require("./crypto.js");
 function mapMeta(r) {
@@ -86,6 +89,38 @@ async function revealSecret(tx, keyring, tenantId, id) {
     });
     return { meta: mapMeta(r), secret };
 }
+/**
+ * Busca e decifra uma credencial de NÍVEL DE TENANT (nunca amarrada a um
+ * `client_id`) pelo nome — o vocabulário que `channel_binding.credential_ref`
+ * usa (`vault://<name>`). Só enxerga o que a RLS permitir: um `tenantId`
+ * incorreto não lança, devolve `null` como se o nome não existisse.
+ *
+ * NUNCA lança por ausência/expiração — a diferença com `revealSecret` (por
+ * `id`), que lança `NotFoundError`, é deliberada: aquele é chamado por uma rota
+ * que já sabe que o `id` deveria existir; este é chamado por um resolvedor de
+ * canal que trata "não configurado" como estado normal.
+ */
+async function revealSecretByName(tx, keyring, tenantId, name) {
+    const rows = await tx `
+    SELECT ${tx.unsafe(META_COLUMNS)}, ciphertext, iv, auth_tag
+    FROM vault_credential
+    WHERE client_id IS NULL AND lower(name) = lower(${name}) AND deleted_at IS NULL
+  `;
+    const r = rows[0];
+    if (!r)
+        return null;
+    const meta = mapMeta(r);
+    if (r.expires_at && r.expires_at.getTime() <= Date.now()) {
+        return { status: 'expired', meta };
+    }
+    const secret = (0, crypto_js_1.decryptSecret)(keyring, tenantId, {
+        ciphertext: r.ciphertext,
+        iv: r.iv,
+        authTag: r.auth_tag,
+        keyVersion: r.key_version,
+    });
+    return { status: 'ok', meta, secret };
+}
 async function rotateSecret(tx, keyring, tenantId, id, newSecret, updatedBy) {
     const enc = (0, crypto_js_1.encryptSecret)(keyring, tenantId, newSecret);
     const rows = await tx `
@@ -117,4 +152,50 @@ async function listExpiringCredentials(tx, days = 30) {
   `;
     return rows.map(mapMeta);
 }
+/**
+ * O `id` da credencial de nível de tenant com este nome, ou `null`.
+ *
+ * Existe para o caminho de **reconexão**: o índice único
+ * `(tenant, client, lower(name))` recusa um segundo `INSERT` com o mesmo nome, e
+ * um onboarding refeito — número reconectado, token revogado e reemitido pelo
+ * cliente — precisa ROTACIONAR a credencial existente, não criar outra.
+ *
+ * Devolve só o identificador. Uma função que devolvesse o metadado inteiro
+ * convidaria quem chama a decidir com base nele; a única pergunta legítima aqui
+ * é "já existe?".
+ */
+/**
+ * Vencimento de uma credencial de nível de tenant, pelo NOME. Sem decifrar.
+ *
+ * Existe porque a tela precisa avisar ANTES: o token que o Embedded Signup emite
+ * na configuração canônica desta casa vive **60 dias**, e o comportamento no
+ * vencimento já é o correto — `revealSecretByName` devolve `expired`, o store
+ * audita e nega, o canal fica indisponível. O que faltava era alguém olhar.
+ *
+ * Descobrir o vencimento por uma cobrança que não saiu é o mesmo modo de falha
+ * do token colado que esta frente existe para eliminar, só que com prazo.
+ *
+ * Devolve `undefined` quando não há credencial com esse nome, e `null` no
+ * `expiresAt` quando ela não vence — os dois casos são diferentes para quem
+ * mostra a tela, e colapsá-los faria "não configurado" parecer "não vence".
+ */
+async function findCredentialExpiryByName(tx, name) {
+    const rows = await tx `
+    SELECT id, expires_at FROM vault_credential
+     WHERE client_id IS NULL AND lower(name) = lower(${name}) AND deleted_at IS NULL
+     LIMIT 1
+  `;
+    const r = rows[0];
+    if (!r)
+        return undefined;
+    return { id: r.id, expiresAt: r.expires_at ? r.expires_at.toISOString() : null };
+}
+async function findCredentialIdByName(tx, name) {
+    const rows = await tx `
+    SELECT id FROM vault_credential
+     WHERE client_id IS NULL AND lower(name) = lower(${name}) AND deleted_at IS NULL
+     LIMIT 1
+  `;
+    return rows[0]?.id ?? null;
+}
 //# sourceMappingURL=repository.js.map

package/dist/cjs/vault/repository.js.map

@@ -1 +1 @@
-{"version":3,"file":"repository.js","sourceRoot":"","sources":["../../../src/vault/repository.ts"],"names":[],"mappings":";;AA2EA,4CA0BC;AAED,0CASC;AAED,8CAOC;AAGD,oCAmBC;AAED,oCAkBC;AAED,oDAOC;AAGD,0DASC;AAxLD,0CAAsD;AAEtD,2CAAyE;AAyCzE,SAAS,OAAO,CAAC,CAAU;IACzB,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,UAAU,EAAE,CAAC,CAAC,WAAW;QACzB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE;QAC1B,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;QAC3D,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;QAC3D,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;QACrC,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,YAAY,GAAG;;;CAGpB,CAAC;AAaK,KAAK,UAAU,gBAAgB,CACpC,EAAM,EACN,OAAgB,EAChB,QAAgB,EAChB,KAA4B;IAE5B,MAAM,GAAG,GAAG,IAAA,yBAAa,EAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAW;;;;;QAK1B,IAAA,eAAM,GAAE;;QAER,KAAK,CAAC,QAAQ,IAAI,IAAI;QACtB,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,QAAQ,IAAI,SAAS;QAC3B,KAAK,CAAC,QAAQ,IAAI,IAAI;QACtB,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,UAAU;QAC5D,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAU,CAAC;QACxC,KAAK,CAAC,SAAS,IAAI,IAAI;QACvB,KAAK,CAAC,SAAS,IAAI,IAAI;;gBAEf,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;GACpC,CAAC;IACF,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;AAC3B,CAAC;AAEM,KAAK,UAAU,eAAe,CAAC,EAAM,EAAE,QAAiB;IAC7D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAW;aACrB,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;;;aAGvB,QAAQ,IAAI,IAAI,gCAAgC,QAAQ,IAAI,IAAI;;GAE1E,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAEM,KAAK,UAAU,iBAAiB,CAAC,EAAM,EAAE,EAAU;IACxD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAW;aACrB,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;uCACG,EAAE;GACtC,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,sBAAa,CAAC,2BAA2B,CAAC,CAAC;IACnE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED,qGAAqG;AAC9F,KAAK,UAAU,YAAY,CAChC,EAAM,EACN,OAAgB,EAChB,QAAgB,EAChB,EAAU;IAEV,MAAM,IAAI,GAAG,MAAM,EAAE,CAAoE;aAC9E,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;uCACG,EAAE;GACtC,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,sBAAa,CAAC,2BAA2B,CAAC,CAAC;IACnE,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,MAAM,MAAM,GAAG,IAAA,yBAAa,EAAC,OAAO,EAAE,QAAQ,EAAE;QAC9C,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,OAAO,EAAE,CAAC,CAAC,QAAQ;QACnB,UAAU,EAAE,CAAC,CAAC,WAAW;KAC1B,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAEM,KAAK,UAAU,YAAY,CAChC,EAAM,EACN,OAAgB,EAChB,QAAgB,EAChB,EAAU,EACV,SAAiB,EACjB,SAAyB;IAEzB,MAAM,GAAG,GAAG,IAAA,yBAAa,EAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;;qBAEF,GAAG,CAAC,UAAU,UAAU,GAAG,CAAC,EAAE,gBAAgB,GAAG,CAAC,OAAO;sBACxD,GAAG,CAAC,UAAU;qBACf,SAAS,IAAI,IAAI;iBACrB,EAAE;;GAEhB,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAEM,KAAK,UAAU,oBAAoB,CAAC,EAAM,EAAE,EAAU;IAC3D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;;iBAEN,EAAE;;GAEhB,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAED,4FAA4F;AACrF,KAAK,UAAU,uBAAuB,CAAC,EAAM,EAAE,IAAI,GAAG,EAAE;IAC7D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAW;aACrB,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;;;mCAGD,IAAI;;GAEpC,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"repository.js","sourceRoot":"","sources":["../../../src/vault/repository.ts"],"names":[],"mappings":";;AAmFA,4CA0BC;AAED,0CASC;AAED,8CAOC;AAGD,oCAmBC;AAiCD,gDA0BC;AAED,oCAkBC;AAED,oDAOC;AAGD,0DASC;AA6BD,gEAYC;AAED,wDAOC;AA7SD,0CAAsD;AAEtD,2CAAyE;AAiDzE,SAAS,OAAO,CAAC,CAAU;IACzB,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,UAAU,EAAE,CAAC,CAAC,WAAW;QACzB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE;QAC1B,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;QAC3D,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;QAC3D,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;QACrC,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,YAAY,GAAG;;;CAGpB,CAAC;AAaK,KAAK,UAAU,gBAAgB,CACpC,EAAM,EACN,OAAgB,EAChB,QAAgB,EAChB,KAA4B;IAE5B,MAAM,GAAG,GAAG,IAAA,yBAAa,EAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAW;;;;;QAK1B,IAAA,eAAM,GAAE;;QAER,KAAK,CAAC,QAAQ,IAAI,IAAI;QACtB,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,QAAQ,IAAI,SAAS;QAC3B,KAAK,CAAC,QAAQ,IAAI,IAAI;QACtB,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,UAAU;QAC5D,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAU,CAAC;QACxC,KAAK,CAAC,SAAS,IAAI,IAAI;QACvB,KAAK,CAAC,SAAS,IAAI,IAAI;;gBAEf,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;GACpC,CAAC;IACF,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;AAC3B,CAAC;AAEM,KAAK,UAAU,eAAe,CAAC,EAAM,EAAE,QAAiB;IAC7D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAW;aACrB,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;;;aAGvB,QAAQ,IAAI,IAAI,gCAAgC,QAAQ,IAAI,IAAI;;GAE1E,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAEM,KAAK,UAAU,iBAAiB,CAAC,EAAM,EAAE,EAAU;IACxD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAW;aACrB,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;uCACG,EAAE;GACtC,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,sBAAa,CAAC,2BAA2B,CAAC,CAAC;IACnE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED,qGAAqG;AAC9F,KAAK,UAAU,YAAY,CAChC,EAAM,EACN,OAAgB,EAChB,QAAgB,EAChB,EAAU;IAEV,MAAM,IAAI,GAAG,MAAM,EAAE,CAAoE;aAC9E,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;uCACG,EAAE;GACtC,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,sBAAa,CAAC,2BAA2B,CAAC,CAAC;IACnE,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,MAAM,MAAM,GAAG,IAAA,yBAAa,EAAC,OAAO,EAAE,QAAQ,EAAE;QAC9C,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,OAAO,EAAE,CAAC,CAAC,QAAQ;QACnB,UAAU,EAAE,CAAC,CAAC,WAAW;KAC1B,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAsBD;;;;;;;;;;GAUG;AACI,KAAK,UAAU,kBAAkB,CACtC,EAAM,EACN,OAAgB,EAChB,QAAgB,EAChB,IAAY;IAEZ,MAAM,IAAI,GAAG,MAAM,EAAE,CAAoE;aAC9E,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;;sDAEkB,IAAI;GACvD,CAAC;IACF,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpB,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACzD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACrC,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,yBAAa,EAAC,OAAO,EAAE,QAAQ,EAAE;QAC9C,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,OAAO,EAAE,CAAC,CAAC,QAAQ;QACnB,UAAU,EAAE,CAAC,CAAC,WAAW;KAC1B,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC;AAEM,KAAK,UAAU,YAAY,CAChC,EAAM,EACN,OAAgB,EAChB,QAAgB,EAChB,EAAU,EACV,SAAiB,EACjB,SAAyB;IAEzB,MAAM,GAAG,GAAG,IAAA,yBAAa,EAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;;qBAEF,GAAG,CAAC,UAAU,UAAU,GAAG,CAAC,EAAE,gBAAgB,GAAG,CAAC,OAAO;sBACxD,GAAG,CAAC,UAAU;qBACf,SAAS,IAAI,IAAI;iBACrB,EAAE;;GAEhB,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAEM,KAAK,UAAU,oBAAoB,CAAC,EAAM,EAAE,EAAU;IAC3D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;;iBAEN,EAAE;;GAEhB,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAED,4FAA4F;AACrF,KAAK,UAAU,uBAAuB,CAAC,EAAM,EAAE,IAAI,GAAG,EAAE;IAC7D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAW;aACrB,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;;;mCAGD,IAAI;;GAEpC,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;GAWG;AACH;;;;;;;;;;;;;;GAcG;AACI,KAAK,UAAU,0BAA0B,CAC9C,EAAM,EACN,IAAY;IAEZ,MAAM,IAAI,GAAG,MAAM,EAAE,CAA2C;;uDAEX,IAAI;;GAExD,CAAC;IACF,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACnF,CAAC;AAEM,KAAK,UAAU,sBAAsB,CAAC,EAAM,EAAE,IAAY;IAC/D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAkB;;uDAEc,IAAI;;GAExD,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC;AAC7B,CAAC"}

package/dist/clients/repository.d.ts

@@ -11,13 +11,48 @@ export interface ClientRecord {
     clientType: 'pf' | 'pj';
     displayName: string;
     documentNumber: string | null;
+    email: string | null;
+    phone: string | null;
     status: string;
     createdAt: string;
+    /**
+     * Por quais canais dá para falar com este cliente.
+     *
+     * Derivado, nunca armazenado: contactabilidade é consequência dos contatos
+     * cadastrados, e guardar uma cópia criaria um segundo lugar para ficar
+     * desatualizado. A régua de cobrança consulta isto ANTES de agendar, em vez de
+     * descobrir a ausência de canal só na hora de enviar.
+     */
+    contactability: Contactability;
 }
+export type ContactChannelState = 'ready' | 'missing';
+export interface Contactability {
+    email: ContactChannelState;
+    phone: ContactChannelState;
+    /** Nenhum canal utilizável — o caso que exige atualização cadastral. */
+    reachable: boolean;
+}
+export declare function contactabilityOf(input: {
+    email?: string | null;
+    phone?: string | null;
+}): Contactability;
+/**
+ * Normalização de contato.
+ *
+ * E-mail vira minúsculo e sem espaços — a coluna é `citext`, mas quem lê o dado
+ * fora do banco não herda essa insensibilidade. Telefone guarda só dígitos e um
+ * `+` inicial: máscara é apresentação, e comparar "(62) 99999-9999" com
+ * "+5562999999999" é o tipo de divergência que só aparece quando a mensagem não
+ * chega.
+ */
+export declare function normalizeEmail(v: string | null | undefined): string | null;
+export declare function normalizePhone(v: string | null | undefined): string | null;
 export interface CreateClientInput {
     displayName: string;
     clientType?: 'pf' | 'pj';
     documentNumber?: string | null;
+    email?: string | null;
+    phone?: string | null;
     createdBy?: string | null;
 }
 export declare function createClient(tx: Tx, input: CreateClientInput): Promise<ClientRecord>;
@@ -44,6 +79,13 @@ export interface UpdateClientInput {
     email?: string | null;
     phone?: string | null;
     status?: string;
+    /**
+     * CPF/CNPJ. Faltava aqui: o cliente nascia com documento e nunca podia
+     * corrigi-lo — e é justamente o campo que todo gateway de pagamento exige
+     * para aceitar um pagador. Um erro de digitação no cadastro bloqueava a
+     * emissão de cobrança para sempre.
+     */
+    documentNumber?: string | null;
     updatedBy?: string | null;
 }
 export declare function updateClient(tx: Tx, id: string, input: UpdateClientInput): Promise<number>;

package/dist/clients/repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../src/clients/repository.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAE1C;;;;;GAKG;AAEH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAsBD,wBAAsB,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,YAAY,CAAC,CAgB1F;AAED,wBAAsB,WAAW,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAQjE;AAED,wBAAsB,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAQzE;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQ3F;AAID,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,EAAE,EACN,MAAM,GAAE,iBAAsB,GAC7B,OAAO,CAAC;IAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBnD;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,wBAAsB,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBhG;AAED,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAOrG;AAED,iFAAiF;AACjF,wBAAsB,sBAAsB,CAAC,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAMnG"}
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../src/clients/repository.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAE1C;;;;;GAKG;AAEH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,cAAc,EAAE,cAAc,CAAC;CAChC;AAED,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,SAAS,CAAC;AAEtD,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,mBAAmB,CAAC;IAC3B,KAAK,EAAE,mBAAmB,CAAC;IAC3B,wEAAwE;IACxE,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,GAAG,cAAc,CAIjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAG1E;AAED,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAO1E;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AA0CD,wBAAsB,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,YAAY,CAAC,CA0B1F;AAED,wBAAsB,WAAW,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAQjE;AAED,wBAAsB,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAQzE;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQ3F;AAID,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,EAAE,EACN,MAAM,GAAE,iBAAsB,GAC7B,OAAO,CAAC;IAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBnD;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,wBAAsB,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAgChG;AAED,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,EAAE,EACN,EAAE,EAAE,MAAM,EACV,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GACxB,OAAO,CAAC,MAAM,CAAC,CAOjB;AAED,iFAAiF;AACjF,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,EAAE,EACN,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAMxB"}

package/dist/clients/repository.js

@@ -1,4 +1,33 @@
-import { NotFoundError, uuidv7 } from '@baruk/shared';
+import { ConflictError, NotFoundError, uuidv7 } from '@baruk/shared';
+import { toE164OrNull } from '../contacts/phone.js';
+export function contactabilityOf(input) {
+    const email = input.email?.trim() ? 'ready' : 'missing';
+    const phone = input.phone?.trim() ? 'ready' : 'missing';
+    return { email, phone, reachable: email === 'ready' || phone === 'ready' };
+}
+/**
+ * Normalização de contato.
+ *
+ * E-mail vira minúsculo e sem espaços — a coluna é `citext`, mas quem lê o dado
+ * fora do banco não herda essa insensibilidade. Telefone guarda só dígitos e um
+ * `+` inicial: máscara é apresentação, e comparar "(62) 99999-9999" com
+ * "+5562999999999" é o tipo de divergência que só aparece quando a mensagem não
+ * chega.
+ */
+export function normalizeEmail(v) {
+    const t = v?.trim().toLowerCase();
+    return t ? t : null;
+}
+export function normalizePhone(v) {
+    if (!v)
+        return null;
+    const trimmed = v.trim();
+    const plus = trimmed.startsWith('+');
+    const digits = trimmed.replace(/\D/g, '');
+    if (!digits)
+        return null;
+    return plus ? `+${digits}` : digits;
+}
 function mapRow(r) {
     return {
         id: r.id,
@@ -6,30 +35,58 @@ function mapRow(r) {
         clientType: r.client_type,
         displayName: r.display_name,
         documentNumber: r.document_number,
+        email: r.email ?? null,
+        phone: r.phone ?? null,
         status: r.status,
         createdAt: r.created_at.toISOString(),
+        contactability: contactabilityOf({ email: r.email, phone: r.phone }),
     };
 }
+/**
+ * Traduz a violação de documento duplicado.
+ *
+ * O banco impede dois clientes com o mesmo CPF/CNPJ no tenant — regra correta,
+ * e o escritório precisa saber que foi ISSO. Sem tradução, a rota devolvia 500
+ * genérico: quem cadastrava via um "erro interno" onde havia um cadastro já
+ * existente, e não tinha como descobrir.
+ */
+function asDuplicateDocument(err) {
+    const e = err;
+    if (e?.code === '23505' && (e.constraint_name ?? '').includes('document')) {
+        throw new ConflictError('Já existe um cliente com este CPF/CNPJ neste escritório.');
+    }
+}
 export async function createClient(tx, input) {
     // tenant_id vem da GUC — nunca do input. A WITH CHECK da RLS recusa qualquer
     // tentativa de gravar fora do tenant corrente.
-    const rows = await tx `
-    INSERT INTO client (id, tenant_id, client_type, display_name, document_number, created_by)
-    VALUES (
-      ${uuidv7()},
-      current_setting('app.current_tenant')::uuid,
-      ${input.clientType ?? 'pj'},
-      ${input.displayName},
-      ${input.documentNumber ?? null},
-      ${input.createdBy ?? null}
-    )
-    RETURNING id, tenant_id, client_type, display_name, document_number, status, created_at
-  `;
-    return mapRow(rows[0]);
+    try {
+        const rows = await tx `
+      INSERT INTO client (id, tenant_id, client_type, display_name, document_number,
+                          email, phone, phone_e164, created_by)
+      VALUES (
+        ${uuidv7()},
+        current_setting('app.current_tenant')::uuid,
+        ${input.clientType ?? 'pj'},
+        ${input.displayName},
+        ${input.documentNumber ?? null},
+        ${normalizeEmail(input.email)},
+        ${normalizePhone(input.phone)},
+        ${toE164OrNull(input.phone)},
+        ${input.createdBy ?? null}
+      )
+      RETURNING id, tenant_id, client_type, display_name, document_number, email, phone,
+                status, created_at
+    `;
+        return mapRow(rows[0]);
+    }
+    catch (err) {
+        asDuplicateDocument(err);
+        throw err;
+    }
 }
 export async function listClients(tx) {
     const rows = await tx `
-    SELECT id, tenant_id, client_type, display_name, document_number, status, created_at
+    SELECT id, tenant_id, client_type, display_name, document_number, email, phone, status, created_at
     FROM client
     WHERE deleted_at IS NULL
     ORDER BY created_at DESC
@@ -38,7 +95,7 @@ export async function listClients(tx) {
 }
 export async function getClient(tx, id) {
     const rows = await tx `
-    SELECT id, tenant_id, client_type, display_name, document_number, status, created_at
+    SELECT id, tenant_id, client_type, display_name, document_number, email, phone, status, created_at
     FROM client
     WHERE id = ${id} AND deleted_at IS NULL
   `;
@@ -64,7 +121,7 @@ export async function listClientsPaged(tx, filter = {}) {
     const offset = filter.offset ?? 0;
     const like = filter.search ? `%${filter.search}%` : null;
     const rows = await tx `
-    SELECT id, tenant_id, client_type, display_name, document_number, status, created_at,
+    SELECT id, tenant_id, client_type, display_name, document_number, email, phone, status, created_at,
            count(*) OVER() AS total
     FROM client
     WHERE deleted_at IS NULL
@@ -77,14 +134,25 @@ export async function listClientsPaged(tx, filter = {}) {
     return { items: rows.map((r) => mapRow(r)), total };
 }
 export async function updateClient(tx, id, input) {
+    // Corrigir um documento para um que já existe cai na mesma violação — e o
+    // escritório precisa da mesma explicação, não de um 500.
     // Casts explícitos: parâmetros NULL sem tipo quebram COALESCE ("could not
     // determine data type of parameter") no PostgreSQL.
-    const rows = await tx `
+    try {
+        const rows = await tx `
     UPDATE client SET
       display_name = COALESCE(${input.displayName ?? null}::text, display_name),
       legal_name   = COALESCE(${input.legalName ?? null}::text, legal_name),
-      email        = COALESCE(${input.email ?? null}::citext, email),
-      phone        = COALESCE(${input.phone ?? null}::text, phone),
+      document_number = COALESCE(${input.documentNumber ?? null}::text, document_number),
+      email        = COALESCE(${normalizeEmail(input.email)}::citext, email),
+      phone        = COALESCE(${normalizePhone(input.phone)}::text, phone),
+      -- Derivado, nunca digitado. A coluna phone guarda o que o operador
+      -- escreveu e continua sendo dele; phone_e164 e a forma que os providers
+      -- exigem. So e recalculado quando o telefone vem no corpo: ausente
+      -- preserva o valor, e um telefone que nao parseia zera o canonico em vez
+      -- de manter um E.164 velho apontando para outro numero.
+      phone_e164   = CASE WHEN ${input.phone ?? null}::text IS NULL THEN phone_e164
+                          ELSE ${toE164OrNull(input.phone)}::text END,
       status       = COALESCE(${input.status ?? null}::text, status),
       updated_by   = ${input.updatedBy ?? null}::uuid,
       updated_at   = now(),
@@ -92,7 +160,12 @@ export async function updateClient(tx, id, input) {
     WHERE id = ${id} AND deleted_at IS NULL
     RETURNING id
   `;
-    return rows.count;
+        return rows.count;
+    }
+    catch (err) {
+        asDuplicateDocument(err);
+        throw err;
+    }
 }
 export async function softDeleteClient(tx, id, deletedBy) {
     const rows = await tx `

package/dist/clients/repository.js.map

@@ -1 +1 @@
-{"version":3,"file":"repository.js","sourceRoot":"","sources":["../../src/clients/repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AA2BtD,SAAS,MAAM,CAAC,CAQf;IACC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,UAAU,EAAE,CAAC,CAAC,WAAW;QACzB,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,cAAc,EAAE,CAAC,CAAC,eAAe;QACjC,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAM,EAAE,KAAwB;IACjE,6EAA6E;IAC7E,+CAA+C;IAC/C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;;;QAGf,MAAM,EAAE;;QAER,KAAK,CAAC,UAAU,IAAI,IAAI;QACxB,KAAK,CAAC,WAAW;QACjB,KAAK,CAAC,cAAc,IAAI,IAAI;QAC5B,KAAK,CAAC,SAAS,IAAI,IAAI;;;GAG5B,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAU,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAM;IACtC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;;;;;GAKpB,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAU,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAM,EAAE,EAAU;IAChD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;;;iBAGN,EAAE;GAChB,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,wBAAwB,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAU,CAAC,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAM,EAAE,EAAU,EAAE,WAAmB;IACxE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;;yBAEE,WAAW;iBACnB,EAAE;;GAEhB,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAM,EACN,SAA4B,EAAE;IAE9B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,MAAM,IAAI,GAAG,MAAM,EAAE,CAA2B;;;;;aAKrC,MAAM,CAAC,MAAM,IAAI,IAAI,8BAA8B,MAAM,CAAC,MAAM,IAAI,IAAI;aACxE,IAAI,wCAAwC,IAAI,6BAA6B,IAAI;;YAElF,KAAK,WAAW,MAAM;GAC/B,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAU,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;AAC/D,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAM,EAAE,EAAU,EAAE,KAAwB;IAC7E,0EAA0E;IAC1E,oDAAoD;IACpD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;;gCAES,KAAK,CAAC,WAAW,IAAI,IAAI;gCACzB,KAAK,CAAC,SAAS,IAAI,IAAI;gCACvB,KAAK,CAAC,KAAK,IAAI,IAAI;gCACnB,KAAK,CAAC,KAAK,IAAI,IAAI;gCACnB,KAAK,CAAC,MAAM,IAAI,IAAI;uBAC7B,KAAK,CAAC,SAAS,IAAI,IAAI;;;iBAG7B,EAAE;;GAEhB,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAM,EAAE,EAAU,EAAE,SAAyB;IAClF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;yDACkC,SAAS,IAAI,IAAI;iBACzD,EAAE;;GAEhB,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAAM,EAAE,cAAsB;IACzE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAkB;;8BAEX,cAAc;GACzC,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"repository.js","sourceRoot":"","sources":["../../src/clients/repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAwCpD,MAAM,UAAU,gBAAgB,CAAC,KAGhC;IACC,MAAM,KAAK,GAAwB,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,MAAM,KAAK,GAAwB,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,CAA4B;IACzD,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,CAA4B;IACzD,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AACtC,CAAC;AAWD,SAAS,MAAM,CAAC,CAUf;IACC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,UAAU,EAAE,CAAC,CAAC,WAAW;QACzB,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,cAAc,EAAE,CAAC,CAAC,eAAe;QACjC,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI;QACtB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI;QACtB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;QACrC,cAAc,EAAE,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;KACrE,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAAC,GAAY;IACvC,MAAM,CAAC,GAAG,GAAkD,CAAC;IAC7D,IAAI,CAAC,EAAE,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,aAAa,CAAC,0DAA0D,CAAC,CAAC;IACtF,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAM,EAAE,KAAwB;IACjE,6EAA6E;IAC7E,+CAA+C;IAC/C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;;;;UAIf,MAAM,EAAE;;UAER,KAAK,CAAC,UAAU,IAAI,IAAI;UACxB,KAAK,CAAC,WAAW;UACjB,KAAK,CAAC,cAAc,IAAI,IAAI;UAC5B,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC;UAC3B,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC;UAC3B,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC;UACzB,KAAK,CAAC,SAAS,IAAI,IAAI;;;;KAI5B,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAU,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAM;IACtC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;;;;;GAKpB,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAU,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAM,EAAE,EAAU;IAChD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;;;iBAGN,EAAE;GAChB,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,wBAAwB,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAU,CAAC,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAM,EAAE,EAAU,EAAE,WAAmB;IACxE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;;yBAEE,WAAW;iBACnB,EAAE;;GAEhB,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAM,EACN,SAA4B,EAAE;IAE9B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,MAAM,IAAI,GAAG,MAAM,EAAE,CAA2B;;;;;aAKrC,MAAM,CAAC,MAAM,IAAI,IAAI,8BAA8B,MAAM,CAAC,MAAM,IAAI,IAAI;aACxE,IAAI,wCAAwC,IAAI,6BAA6B,IAAI;;YAElF,KAAK,WAAW,MAAM;GAC/B,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAU,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;AAC/D,CAAC;AAkBD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAM,EAAE,EAAU,EAAE,KAAwB;IAC7E,0EAA0E;IAC1E,yDAAyD;IACzD,0EAA0E;IAC1E,oDAAoD;IACpD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;;gCAEO,KAAK,CAAC,WAAW,IAAI,IAAI;gCACzB,KAAK,CAAC,SAAS,IAAI,IAAI;mCACpB,KAAK,CAAC,cAAc,IAAI,IAAI;gCAC/B,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC;gCAC3B,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC;;;;;;iCAM1B,KAAK,CAAC,KAAK,IAAI,IAAI;iCACnB,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC;gCAC1B,KAAK,CAAC,MAAM,IAAI,IAAI;uBAC7B,KAAK,CAAC,SAAS,IAAI,IAAI;;;iBAG7B,EAAE;;GAEhB,CAAC;QACA,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAM,EACN,EAAU,EACV,SAAyB;IAEzB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAA;yDACkC,SAAS,IAAI,IAAI;iBACzD,EAAE;;GAEhB,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,EAAM,EACN,cAAsB;IAEtB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAkB;;8BAEX,cAAc;GACzC,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC;AAC7B,CAAC"}

package/dist/collection/branding.d.ts

@@ -0,0 +1,72 @@
+import type { Tx } from '../db/client.js';
+/**
+ * Identidade do escritório para a comunicação transacional.
+ *
+ * Mora em `tenant.settings.branding` (jsonb que já existia) — sem tabela nem
+ * migration. Nenhuma marca está no código: o que aparece no e-mail vem do tenant
+ * que está enviando, e um escritório novo entra por configuração.
+ *
+ * Os valores canônicos de cada marca vivem no **Brand OS**
+ * (`frameworks/brand-os/brands/<marca>/creative-engine/brand-kit.json`), que é a
+ * fonte de verdade da identidade. Este módulo consome; não redefine.
+ */
+/**
+ * O que o asset de logo É, do ponto de vista do manual de marca.
+ *
+ * A distinção não é cosmética: um **lockup** já contém o nome do escritório
+ * desenhado; um **símbolo** não. Renderizar os dois do mesmo jeito ou repete o
+ * nome duas vezes no cabeçalho, ou deixa a mensagem sem nome quando o leitor
+ * bloqueia imagens. O tenant declara qual dos dois enviou.
+ */
+export type LogoKind = 'symbol' | 'lockup';
+export interface TenantBranding {
+    officeName: string;
+    /** Assinatura do rodapé; cai em `officeName` quando não definida. */
+    signatureName: string;
+    /** Frase curta da marca. Só aparece se o tenant configurar. */
+    tagline: string | null;
+    /**
+     * Logomarca para o cabeçalho — ou seja, o asset que fica sobre `primaryColor`.
+     * Um kit de marca sério tem versão clara e escura; o tenant aponta a que
+     * combina com o fundo que ele mesmo escolheu.
+     *
+     * Formato: PNG ou JPG em URL pública. **SVG não serve** — Gmail e Outlook não
+     * o renderizam em e-mail. Ausente é estado válido: o cabeçalho vira
+     * tipográfico, nunca uma marca inventada.
+     */
+    logoUrl: string | null;
+    logoKind: LogoKind;
+    primaryColor: string;
+    /** Usada em detalhes; cai na primária quando ausente. */
+    secondaryColor: string;
+    /** Destaque pontual (valor, borda do card). */
+    accentColor: string;
+    /** Fundo da página do e-mail (fora do cartão branco). */
+    backgroundColor: string;
+    /** Cor do texto corrido. */
+    textColor: string;
+    /** Cor de apoio: rodapé, rótulos, texto secundário. */
+    mutedColor: string;
+    /**
+     * Stack de fontes do corpo. Webfont não carrega no Outlook, então a stack
+     * precisa terminar em famílias que todo cliente tem — quem configurar só o
+     * nome da fonte da marca recebe a queda automática.
+     */
+    fontFamily: string;
+    supportEmail: string | null;
+    supportPhone: string | null;
+    /** Site do escritório. Corresponde ao `websiteUrl` do vocabulário de marca. */
+    website: string | null;
+    locale: 'pt-BR';
+}
+export declare function getTenantBranding(tx: Tx): Promise<TenantBranding>;
+/**
+ * Remetente no formato `Nome <endereço>`.
+ *
+ * O endereço continua sendo o do domínio verificado no provider — trocá-lo
+ * quebraria a entrega. O que muda é o NOME exibido: as mensagens saíam como
+ * "Baruk Contábil" e assinavam "SC Organização Contábil", o que faz o cliente
+ * duvidar de quem está cobrando.
+ */
+export declare function senderFor(branding: TenantBranding, fallbackFrom: string): string;
+//# sourceMappingURL=branding.d.ts.map

package/dist/collection/branding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"branding.d.ts","sourceRoot":"","sources":["../../src/collection/branding.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAE1C;;;;;;;;;;GAUG;AAEH;;;;;;;GAOG;AACH,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE3C,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,aAAa,EAAE,MAAM,CAAC;IACtB,+DAA+D;IAC/D,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB;;;;;;;;OAQG;IACH,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,QAAQ,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,cAAc,EAAE,MAAM,CAAC;IACvB,+CAA+C;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,yDAAyD;IACzD,eAAe,EAAE,MAAM,CAAC;IACxB,4BAA4B;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,+EAA+E;IAC/E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,OAAO,CAAC;CACjB;AA4ED,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAmDvE;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAKhF"}