@baruk/core 0.3.1 → 0.4.2

package/dist/cjs/portal/provisioning.js

@@ -0,0 +1,144 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.invitePortalUser = invitePortalUser;
+exports.listPortalUsers = listPortalUsers;
+exports.revokePortalAccess = revokePortalAccess;
+const shared_1 = require("@baruk/shared");
+const audit_js_1 = require("../audit/audit.js");
+const password_reset_js_1 = require("../auth/password-reset.js");
+const repository_js_1 = require("../users/repository.js");
+const PORTAL_ROLE_KEY = 'client_titular';
+async function invitePortalUser(tx, input) {
+    const tenantId = await currentTenantId(tx);
+    // O cliente precisa existir NESTE tenant. A RLS já garantiria, mas uma
+    // mensagem clara vale mais que um erro de FK.
+    const client = await tx `
+    SELECT id FROM client WHERE id = ${input.clientId} AND deleted_at IS NULL
+  `;
+    if (!client[0])
+        throw new shared_1.NotFoundError('Cliente não encontrado');
+    const existing = await tx `
+    SELECT id, full_name, user_type, status FROM "user"
+     WHERE email = ${input.email} AND deleted_at IS NULL
+  `;
+    let userId;
+    let fullName;
+    let isNewUser;
+    // Reconvidar quem ainda não ativou precisa emitir um token novo. Sem isto o
+    // usuário fica preso: o primeiro convite não chegou (ou expirou) e nenhum
+    // reenvio produz link, porque só o cadastro inicial emitia token.
+    let isPendingActivation = false;
+    if (existing[0]) {
+        // Um e-mail de staff não vira acesso de portal por convite. Os dois tipos
+        // têm superfícies e escopos distintos, e converter silenciosamente daria a
+        // um colaborador do escritório uma sessão de cliente.
+        if (existing[0].user_type !== 'client_portal') {
+            throw new shared_1.ConflictError('Este e-mail já pertence a um usuário interno. Use um e-mail diferente para o acesso do cliente.');
+        }
+        userId = existing[0].id;
+        fullName = existing[0].full_name;
+        isNewUser = false;
+        // Só quem ainda não ativou recebe token novo. Emitir para um usuário já
+        // ativo transformaria o convite em redefinição de senha à revelia do
+        // cliente — quem convida não pode provocar isso.
+        isPendingActivation = existing[0].status === 'invited';
+    }
+    else {
+        userId = (0, shared_1.uuidv7)();
+        fullName = input.fullName;
+        isNewUser = true;
+        await tx `
+      INSERT INTO "user" (id, email, full_name, user_type, status, auth_provider)
+      VALUES (${userId}, ${input.email}, ${input.fullName}, 'client_portal', 'invited', 'password')
+    `;
+    }
+    // Membership no tenant — sem ela o usuário não resolve tenant no login.
+    const membership = await tx `
+    SELECT id FROM membership
+     WHERE user_id = ${userId} AND tenant_id = ${tenantId} AND deleted_at IS NULL
+  `;
+    if (!membership[0]) {
+        await tx `
+      INSERT INTO membership (id, tenant_id, user_id, status, invited_by)
+      VALUES (${(0, shared_1.uuidv7)()}, ${tenantId}, ${userId}, 'invited', ${input.invitedBy})
+    `;
+        await (0, repository_js_1.setUserRole)(tx, userId, PORTAL_ROLE_KEY);
+    }
+    // O vínculo com o cliente. Idempotente: reconvidar não duplica.
+    const access = await tx `
+    INSERT INTO client_portal_access (id, tenant_id, user_id, client_id, status)
+    VALUES (${(0, shared_1.uuidv7)()}, ${tenantId}, ${userId}, ${input.clientId}, 'active')
+    ON CONFLICT (tenant_id, user_id, client_id) DO UPDATE SET status = 'active'
+    RETURNING id
+  `;
+    let activationToken = null;
+    if (isNewUser || isPendingActivation) {
+        const activation = await (0, password_reset_js_1.createActivationToken)(tx, { userId, tenantId });
+        activationToken = activation.token;
+    }
+    await (0, audit_js_1.appendAudit)(tx, {
+        actorId: input.invitedBy,
+        action: 'portal_user_invited',
+        resourceType: 'client_portal_access',
+        resourceId: access[0].id,
+        // O token nunca entra na auditoria, nem em metadata: o registro é lido por
+        // gente que não deve poder assumir a conta do cliente.
+        metadata: { email: input.email, clientId: input.clientId, isNewUser, isPendingActivation },
+    });
+    return {
+        userId,
+        email: input.email,
+        fullName,
+        clientId: input.clientId,
+        activationToken,
+        alreadyHadAccess: !isNewUser && membership.length > 0,
+        isReinvite: isPendingActivation,
+    };
+}
+async function listPortalUsers(tx, clientId) {
+    const rows = await tx `
+    SELECT u.id AS user_id, u.email, u.full_name, u.status,
+           cpa.status AS access_status, u.last_login_at
+      FROM client_portal_access cpa
+      JOIN "user" u ON u.id = cpa.user_id
+     WHERE cpa.client_id = ${clientId} AND u.deleted_at IS NULL
+     ORDER BY u.full_name
+  `;
+    return rows.map((r) => ({
+        userId: r.user_id,
+        email: r.email,
+        fullName: r.full_name,
+        status: r.status,
+        accessStatus: r.access_status,
+        lastLoginAt: r.last_login_at ? r.last_login_at.toISOString() : null,
+    }));
+}
+/**
+ * Revoga o acesso. Não apaga o usuário nem a trilha: quem enviou um documento
+ * continua identificável depois de perder o acesso — é justamente isso que
+ * torna a prova utilizável meses depois.
+ */
+async function revokePortalAccess(tx, input) {
+    const rows = await tx `
+    UPDATE client_portal_access
+       SET status = 'revoked'
+     WHERE client_id = ${input.clientId} AND user_id = ${input.userId} AND status = 'active'
+    RETURNING id
+  `;
+    if (!rows[0])
+        throw new shared_1.NotFoundError('Acesso ativo não encontrado');
+    await (0, audit_js_1.appendAudit)(tx, {
+        actorId: input.revokedBy,
+        action: 'portal_access_revoked',
+        resourceType: 'client_portal_access',
+        resourceId: rows[0].id,
+        metadata: { clientId: input.clientId, userId: input.userId },
+    });
+}
+async function currentTenantId(tx) {
+    const rows = await tx `
+    SELECT current_setting('app.current_tenant')::uuid AS tenant_id
+  `;
+    return rows[0].tenant_id;
+}
+//# sourceMappingURL=provisioning.js.map

package/dist/cjs/portal/provisioning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioning.js","sourceRoot":"","sources":["../../../src/portal/provisioning.ts"],"names":[],"mappings":";;AA+CA,4CAkGC;AAWD,0CA0BC;AAOD,gDAmBC;AAhND,0CAAqE;AAErE,gDAAgD;AAChD,iEAAkE;AAClE,0DAAqD;AAyCrD,MAAM,eAAe,GAAG,gBAAgB,CAAC;AAElC,KAAK,UAAU,gBAAgB,CACpC,EAAM,EACN,KAA4B;IAE5B,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,EAAE,CAAC,CAAC;IAE3C,uEAAuE;IACvE,8CAA8C;IAC9C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAkB;uCACJ,KAAK,CAAC,QAAQ;GAClD,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,sBAAa,CAAC,wBAAwB,CAAC,CAAC;IAElE,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAwE;;qBAE9E,KAAK,CAAC,KAAK;GAC7B,CAAC;IAEF,IAAI,MAAc,CAAC;IACnB,IAAI,QAAgB,CAAC;IACrB,IAAI,SAAkB,CAAC;IACvB,4EAA4E;IAC5E,0EAA0E;IAC1E,kEAAkE;IAClE,IAAI,mBAAmB,GAAG,KAAK,CAAC;IAEhC,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAChB,0EAA0E;QAC1E,2EAA2E;QAC3E,sDAAsD;QACtD,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;YAC9C,MAAM,IAAI,sBAAa,CACrB,iGAAiG,CAClG,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxB,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACjC,SAAS,GAAG,KAAK,CAAC;QAClB,wEAAwE;QACxE,qEAAqE;QACrE,iDAAiD;QACjD,mBAAmB,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC;IACzD,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,IAAA,eAAM,GAAE,CAAC;QAClB,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAC1B,SAAS,GAAG,IAAI,CAAC;QACjB,MAAM,EAAE,CAAA;;gBAEI,MAAM,KAAK,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,QAAQ;KACpD,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,MAAM,UAAU,GAAG,MAAM,EAAE,CAAkB;;uBAExB,MAAM,oBAAoB,QAAQ;GACtD,CAAC;IACF,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QACnB,MAAM,EAAE,CAAA;;gBAEI,IAAA,eAAM,GAAE,KAAK,QAAQ,KAAK,MAAM,gBAAgB,KAAK,CAAC,SAAS;KAC1E,CAAC;QACF,MAAM,IAAA,2BAAW,EAAC,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;IACjD,CAAC;IAED,gEAAgE;IAChE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAkB;;cAE7B,IAAA,eAAM,GAAE,KAAK,QAAQ,KAAK,MAAM,KAAK,KAAK,CAAC,QAAQ;;;GAG9D,CAAC;IAEF,IAAI,eAAe,GAAkB,IAAI,CAAC;IAC1C,IAAI,SAAS,IAAI,mBAAmB,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,MAAM,IAAA,yCAAqB,EAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzE,eAAe,GAAG,UAAU,CAAC,KAAK,CAAC;IACrC,CAAC;IAED,MAAM,IAAA,sBAAW,EAAC,EAAE,EAAE;QACpB,OAAO,EAAE,KAAK,CAAC,SAAS;QACxB,MAAM,EAAE,qBAAqB;QAC7B,YAAY,EAAE,sBAAsB;QACpC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,EAAE;QACzB,2EAA2E;QAC3E,uDAAuD;QACvD,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,mBAAmB,EAAE;KAC3F,CAAC,CAAC;IAEH,OAAO;QACL,MAAM;QACN,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ;QACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,eAAe;QACf,gBAAgB,EAAE,CAAC,SAAS,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QACrD,UAAU,EAAE,mBAAmB;KAChC,CAAC;AACJ,CAAC;AAWM,KAAK,UAAU,eAAe,CAAC,EAAM,EAAE,QAAgB;IAC5D,MAAM,IAAI,GAAG,MAAM,EAAE,CASpB;;;;;6BAK0B,QAAQ;;GAElC,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtB,MAAM,EAAE,CAAC,CAAC,OAAO;QACjB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,YAAY,EAAE,CAAC,CAAC,aAAa;QAC7B,WAAW,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;KACpE,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,kBAAkB,CACtC,EAAM,EACN,KAA8D;IAE9D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAkB;;;yBAGhB,KAAK,CAAC,QAAQ,kBAAkB,KAAK,CAAC,MAAM;;GAElE,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,sBAAa,CAAC,6BAA6B,CAAC,CAAC;IAErE,MAAM,IAAA,sBAAW,EAAC,EAAE,EAAE;QACpB,OAAO,EAAE,KAAK,CAAC,SAAS;QACxB,MAAM,EAAE,uBAAuB;QAC/B,YAAY,EAAE,sBAAsB;QACpC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;QACtB,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;KAC7D,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,EAAM;IACnC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAyB;;GAE7C,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAE,CAAC,SAAS,CAAC;AAC5B,CAAC"}

package/dist/cjs/pricing-engine/canonical.js

@@ -0,0 +1,42 @@
+"use strict";
+/**
+ * Serialização canônica (RFC-CAPABILITY-PRICING-ENGINE-001 §22.1 F2) — usada
+ * exclusivamente para compor o `fingerprint`/`quoteId` (nunca para persistir
+ * ou transportar dados). `JSON.stringify` cru depende da ordem de inserção
+ * das chaves do objeto — dois `PricingRequest` economicamente idênticos, mas
+ * construídos com `addonQuantities`/Records em ordem de chave diferente,
+ * produziam hashes diferentes antes deste módulo (achado do Design Review,
+ * §22.1). `canonicalize` ordena chaves recursivamente em qualquer nível de
+ * objeto/Record/Map aninhado — arrays preservam ordem (a ordem de array é
+ * semanticamente relevante quando existe; coleções sem ordem própria, como
+ * `bundleRules`, são pré-ordenadas pelo chamador antes de chegar aqui).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canonicalStringify = canonicalStringify;
+function canonicalize(value) {
+    if (value instanceof Map) {
+        const entries = Array.from(value.entries())
+            .map(([k, v]) => [String(k), canonicalize(v)])
+            .sort((a, b) => (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0));
+        const record = {};
+        for (const [k, v] of entries)
+            record[k] = v;
+        return record;
+    }
+    if (Array.isArray(value)) {
+        return value.map(canonicalize);
+    }
+    if (value !== null && typeof value === 'object') {
+        const record = value;
+        const result = {};
+        for (const key of Object.keys(record).sort()) {
+            result[key] = canonicalize(record[key]);
+        }
+        return result;
+    }
+    return value;
+}
+function canonicalStringify(value) {
+    return JSON.stringify(canonicalize(value));
+}
+//# sourceMappingURL=canonical.js.map

package/dist/cjs/pricing-engine/canonical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../../../src/pricing-engine/canonical.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;AAyBH,gDAEC;AAzBD,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,YAAY,GAAG,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;aACxC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAU,CAAC;aACtD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO;YAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC5C,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC7C,MAAM,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,kBAAkB,CAAC,KAAc;IAC/C,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7C,CAAC"}

package/dist/cjs/pricing-engine/errors.js

@@ -41,7 +41,12 @@ class PricingEngineError extends Error {
         this.ruleIds = ruleIds;
     }
     toJSON() {
-        return { code: this.code, errorClass: this.errorClass, message: this.message, ruleIds: this.ruleIds };
+        return {
+            code: this.code,
+            errorClass: this.errorClass,
+            message: this.message,
+            ruleIds: this.ruleIds,
+        };
     }
 }
 exports.PricingEngineError = PricingEngineError;

package/dist/cjs/pricing-engine/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/pricing-engine/errors.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AA6BH,MAAM,WAAW,GAAgD;IAC/D,2BAA2B,EAAE,eAAe;IAC5C,iBAAiB,EAAE,YAAY;IAC/B,kBAAkB,EAAE,YAAY;IAChC,mBAAmB,EAAE,WAAW;IAChC,mBAAmB,EAAE,UAAU;IAC/B,gBAAgB,EAAE,eAAe;IACjC,uBAAuB,EAAE,WAAW;IACpC,gBAAgB,EAAE,YAAY;IAC9B,gBAAgB,EAAE,sBAAsB;IACxC,qBAAqB,EAAE,YAAY;IACnC,mBAAmB,EAAE,UAAU;IAC/B,mBAAmB,EAAE,YAAY;IACjC,6BAA6B,EAAE,eAAe;IAC9C,oBAAoB,EAAE,eAAe;IACrC,qBAAqB,EAAE,WAAW;IAClC,wBAAwB,EAAE,YAAY;CACvC,CAAC;AAEF,MAAa,kBAAmB,SAAQ,KAAK;IAClC,IAAI,CAAmB;IACvB,UAAU,CAAoB;IACvC,2EAA2E;IAClE,OAAO,CAAW;IAE3B,YAAY,IAAsB,EAAE,OAAe,EAAE,UAAoB,EAAE;QACzE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,MAAM;QACJ,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IACxG,CAAC;CACF;AAjBD,gDAiBC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/pricing-engine/errors.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AA8BH,MAAM,WAAW,GAAgD;IAC/D,2BAA2B,EAAE,eAAe;IAC5C,iBAAiB,EAAE,YAAY;IAC/B,kBAAkB,EAAE,YAAY;IAChC,mBAAmB,EAAE,WAAW;IAChC,mBAAmB,EAAE,UAAU;IAC/B,gBAAgB,EAAE,eAAe;IACjC,uBAAuB,EAAE,WAAW;IACpC,gBAAgB,EAAE,YAAY;IAC9B,gBAAgB,EAAE,sBAAsB;IACxC,qBAAqB,EAAE,YAAY;IACnC,mBAAmB,EAAE,UAAU;IAC/B,mBAAmB,EAAE,YAAY;IACjC,6BAA6B,EAAE,eAAe;IAC9C,oBAAoB,EAAE,eAAe;IACrC,qBAAqB,EAAE,WAAW;IAClC,wBAAwB,EAAE,YAAY;CACvC,CAAC;AAEF,MAAa,kBAAmB,SAAQ,KAAK;IAClC,IAAI,CAAmB;IACvB,UAAU,CAAoB;IACvC,2EAA2E;IAClE,OAAO,CAAW;IAE3B,YAAY,IAAsB,EAAE,OAAe,EAAE,UAAoB,EAAE;QACzE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,MAAM;QAMJ,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;IACJ,CAAC;CACF;AA3BD,gDA2BC"}

package/dist/cjs/pricing-engine/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.compareQuotes = exports.normalizeCanonicalQuote = exports.computePricingQuote = exports.computeProration = exports.resolveBundleDiscount = exports.freeModuleCodesForBundle = exports.assertBundleModulesCovered = exports.PRICING_RULE_STEPS_IN_ORDER = exports.PRICING_ENGINE_VERSION = exports.PricingEngineError = exports.clampNonNegative = exports.prorateByDays = exports.applyPercent = exports.multiplyByQuantity = exports.subtractCents = exports.addCents = exports.centsToReais = exports.reaisToCents = exports.roundHalfEven = void 0;
+exports.runShadowComparison = exports.computeShadowMetrics = exports.categorizeDiffs = exports.normalizeLegacyQuote = exports.toPricingRequest = exports.STORAGE_ADDON_TARGET_CODE = exports.compareQuotes = exports.normalizeCanonicalQuote = exports.computePricingQuote = exports.computeProration = exports.resolveBundleDiscount = exports.freeModuleCodesForBundle = exports.assertBundleModulesCovered = exports.PRICING_RULE_STEPS_IN_ORDER = exports.PRICING_ENGINE_VERSION = exports.PricingEngineError = exports.clampNonNegative = exports.prorateByDays = exports.applyPercent = exports.multiplyByQuantity = exports.subtractCents = exports.addCents = exports.centsToReais = exports.reaisToCents = exports.roundHalfEven = void 0;
 var money_js_1 = require("./money.js");
 Object.defineProperty(exports, "roundHalfEven", { enumerable: true, get: function () { return money_js_1.roundHalfEven; } });
 Object.defineProperty(exports, "reaisToCents", { enumerable: true, get: function () { return money_js_1.reaisToCents; } });
@@ -27,4 +27,15 @@ Object.defineProperty(exports, "computePricingQuote", { enumerable: true, get: f
 var shadow_js_1 = require("./shadow.js");
 Object.defineProperty(exports, "normalizeCanonicalQuote", { enumerable: true, get: function () { return shadow_js_1.normalizeCanonicalQuote; } });
 Object.defineProperty(exports, "compareQuotes", { enumerable: true, get: function () { return shadow_js_1.compareQuotes; } });
+var shadow_adapter_js_1 = require("./shadow-adapter.js");
+Object.defineProperty(exports, "STORAGE_ADDON_TARGET_CODE", { enumerable: true, get: function () { return shadow_adapter_js_1.STORAGE_ADDON_TARGET_CODE; } });
+Object.defineProperty(exports, "toPricingRequest", { enumerable: true, get: function () { return shadow_adapter_js_1.toPricingRequest; } });
+var shadow_normalizer_js_1 = require("./shadow-normalizer.js");
+Object.defineProperty(exports, "normalizeLegacyQuote", { enumerable: true, get: function () { return shadow_normalizer_js_1.normalizeLegacyQuote; } });
+var shadow_diff_js_1 = require("./shadow-diff.js");
+Object.defineProperty(exports, "categorizeDiffs", { enumerable: true, get: function () { return shadow_diff_js_1.categorizeDiffs; } });
+var shadow_metrics_js_1 = require("./shadow-metrics.js");
+Object.defineProperty(exports, "computeShadowMetrics", { enumerable: true, get: function () { return shadow_metrics_js_1.computeShadowMetrics; } });
+var shadow_facade_js_1 = require("./shadow-facade.js");
+Object.defineProperty(exports, "runShadowComparison", { enumerable: true, get: function () { return shadow_facade_js_1.runShadowComparison; } });
 //# sourceMappingURL=index.js.map

package/dist/cjs/pricing-engine/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/pricing-engine/index.ts"],"names":[],"mappings":";;;AACA,uCAUoB;AATlB,yGAAA,aAAa,OAAA;AACb,wGAAA,YAAY,OAAA;AACZ,wGAAA,YAAY,OAAA;AACZ,oGAAA,QAAQ,OAAA;AACR,yGAAA,aAAa,OAAA;AACb,8GAAA,kBAAkB,OAAA;AAClB,wGAAA,YAAY,OAAA;AACZ,yGAAA,aAAa,OAAA;AACb,4GAAA,gBAAgB,OAAA;AAIlB,yCAAiD;AAAxC,+GAAA,kBAAkB,OAAA;AAsB3B,uCAAiF;AAAxE,kHAAA,sBAAsB,OAAA;AAAE,uHAAA,2BAA2B,OAAA;AAE5D,yCAA0G;AAAjG,uHAAA,0BAA0B,OAAA;AAAE,qHAAA,wBAAwB,OAAA;AAAE,kHAAA,qBAAqB,OAAA;AACpF,+CAAkD;AAAzC,gHAAA,gBAAgB,OAAA;AACzB,6CAAoD;AAA3C,kHAAA,mBAAmB,OAAA;AAG5B,yCAAqE;AAA5D,oHAAA,uBAAuB,OAAA;AAAE,0GAAA,aAAa,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/pricing-engine/index.ts"],"names":[],"mappings":";;;AACA,uCAUoB;AATlB,yGAAA,aAAa,OAAA;AACb,wGAAA,YAAY,OAAA;AACZ,wGAAA,YAAY,OAAA;AACZ,oGAAA,QAAQ,OAAA;AACR,yGAAA,aAAa,OAAA;AACb,8GAAA,kBAAkB,OAAA;AAClB,wGAAA,YAAY,OAAA;AACZ,yGAAA,aAAa,OAAA;AACb,4GAAA,gBAAgB,OAAA;AAIlB,yCAAiD;AAAxC,+GAAA,kBAAkB,OAAA;AAsB3B,uCAAiF;AAAxE,kHAAA,sBAAsB,OAAA;AAAE,uHAAA,2BAA2B,OAAA;AAE5D,yCAIqB;AAHnB,uHAAA,0BAA0B,OAAA;AAC1B,qHAAA,wBAAwB,OAAA;AACxB,kHAAA,qBAAqB,OAAA;AAEvB,+CAAkD;AAAzC,gHAAA,gBAAgB,OAAA;AACzB,6CAAoD;AAA3C,kHAAA,mBAAmB,OAAA;AAQ5B,yCAAqE;AAA5D,oHAAA,uBAAuB,OAAA;AAAE,0GAAA,aAAa,OAAA;AAgB/C,yDAAkF;AAAzE,8HAAA,yBAAyB,OAAA;AAAE,qHAAA,gBAAgB,OAAA;AACpD,+DAA8D;AAArD,4HAAA,oBAAoB,OAAA;AAE7B,mDAAmD;AAA1C,iHAAA,eAAe,OAAA;AAExB,yDAA2D;AAAlD,yHAAA,oBAAoB,OAAA;AAE7B,uDAAyD;AAAhD,uHAAA,mBAAmB,OAAA"}

package/dist/cjs/pricing-engine/pipeline.js

@@ -5,6 +5,8 @@ const node_crypto_1 = require("node:crypto");
 const money_js_1 = require("./money.js");
 const errors_js_1 = require("./errors.js");
 const bundle_js_1 = require("./bundle.js");
+const canonical_js_1 = require("./canonical.js");
+const proration_js_1 = require("./proration.js");
 const types_js_1 = require("./types.js");
 /**
  * Pipeline determinístico do Pricing Engine (RFC-CAPABILITY-PRICING-ENGINE-001
@@ -24,39 +26,152 @@ const types_js_1 = require("./types.js");
  * internamente usamos `throw PricingEngineError` e capturamos em
  * `computePricingQuote`.
  */
+/**
+ * Base do fingerprint (RFC §22.1 F1) — deve cobrir TODO campo capaz de alterar
+ * o `PricingQuote` resultante (magnitude econômica OU conteúdo devolvido
+ * verbatim no quote, como `trial.endsAt`), nunca só os `code`s. Campos
+ * conscientemente OMITIDOS porque não influenciam a saída (o gate de vigência
+ * do contrato negociado já lança erro ANTES do fingerprint ser calculado, e
+ * `NegotiatedContract.priority`/`freeModuleCodes` não são lidos em nenhum
+ * ponto do pipeline hoje — dead fields, fora do escopo deste micro-sprint):
+ * `negotiatedContract.validFrom`/`validTo`/`priority`/`freeModuleCodes`.
+ * Coleções sem ordem própria (`bundleRules`) são pré-ordenadas por chave
+ * estável antes de entrar no hash — `canonicalStringify` cuida da ordem de
+ * chaves de objeto/Record, não da ordem de arrays.
+ */
 function fingerprintOf(request) {
     const basis = {
         tenantId: request.tenantId,
         productLine: request.productLine,
         offerCode: request.offer.code,
         planCode: request.plan.code,
+        plan: {
+            code: request.plan.code,
+            name: request.plan.name,
+            tier: request.plan.tier,
+            franchises: request.plan.franchises,
+            defaultTrialDays: request.plan.defaultTrialDays,
+            isPublic: request.plan.isPublic,
+            isActive: request.plan.isActive,
+        },
         moduleCodes: [...request.offer.moduleCodes].sort(),
         bundleCodes: [...request.offer.bundleCodes].sort(),
         addonCodes: [...request.offer.addonCodes].sort(),
-        priceTableCode: request.priceTable.code,
-        priceTableVersion: request.priceTable.version,
+        modules: request.modules
+            .map((m) => ({
+            code: m.code,
+            name: m.name,
+            class: m.class,
+            category: m.category ?? null,
+            requiredModuleCodes: [...m.requiredModuleCodes].sort(),
+            marketplaceVisible: m.marketplaceVisible,
+            isActive: m.isActive,
+        }))
+            .sort((a, b) => a.code.localeCompare(b.code)),
+        bundles: request.bundles
+            .map((b) => ({
+            code: b.code,
+            name: b.name,
+            moduleCodes: [...b.moduleCodes].sort(),
+            isActive: b.isActive,
+        }))
+            .sort((a, b) => a.code.localeCompare(b.code)),
+        priceTable: {
+            code: request.priceTable.code,
+            currency: request.priceTable.currency,
+            status: request.priceTable.status,
+            version: request.priceTable.version,
+            effectiveFrom: request.priceTable.effectiveFrom,
+            effectiveTo: request.priceTable.effectiveTo,
+            scopes: [...(request.priceTable.scopes ?? [])]
+                .map((s) => ({
+                scopeType: s.scopeType,
+                matchValue: s.matchValue,
+                priority: s.priority ?? null,
+            }))
+                .sort((a, b) => `${a.scopeType}:${a.matchValue}:${a.priority}`.localeCompare(`${b.scopeType}:${b.matchValue}:${b.priority}`)),
+            items: [...request.priceTable.items]
+                .map((i) => ({
+                targetType: i.targetType,
+                targetCode: i.targetCode,
+                amount: i.amount,
+                interval: i.interval,
+            }))
+                .sort((a, b) => `${a.targetType}:${a.targetCode}:${a.interval}`.localeCompare(`${b.targetType}:${b.targetCode}:${b.interval}`)),
+        },
         billingCycle: request.billingCycle,
         extraSeats: request.extraSeats ?? 0,
         addonQuantities: request.addonQuantities ?? {},
-        couponCode: request.coupon?.code ?? null,
-        campaignCode: request.campaign?.code ?? null,
-        negotiatedContractTenantId: request.negotiatedContract?.tenantId ?? null,
-        negotiatedDiscountPercent: request.negotiatedContract?.discountPercent ?? null,
-        negotiatedFixedTotalCents: request.negotiatedContract?.fixedTotalCents ?? null,
-        trialActive: request.trial?.active ?? false,
+        bundleRules: [...(request.bundleRules ?? [])]
+            .map((r) => ({
+            bundleCode: r.bundleCode,
+            kind: r.kind,
+            value: r.value ?? null,
+            freeModuleCode: r.freeModuleCode ?? null,
+            priority: r.priority ?? null,
+        }))
+            .sort((a, b) => a.bundleCode.localeCompare(b.bundleCode)),
+        coupon: request.coupon
+            ? {
+                code: request.coupon.code,
+                effectType: request.coupon.effectType,
+                percentOff: request.coupon.percentOff ?? null,
+                amountOffCents: request.coupon.amountOffCents ?? null,
+                exclusive: request.coupon.exclusive ?? false,
+                priority: request.coupon.priority ?? null,
+            }
+            : null,
+        campaign: request.campaign
+            ? {
+                code: request.campaign.code,
+                effectType: request.campaign.effectType,
+                percentOff: request.campaign.percentOff ?? null,
+                amountOffCents: request.campaign.amountOffCents ?? null,
+                exclusive: request.campaign.exclusive ?? false,
+                priority: request.campaign.priority ?? null,
+            }
+            : null,
+        negotiatedContract: request.negotiatedContract
+            ? {
+                tenantId: request.negotiatedContract.tenantId,
+                discountPercent: request.negotiatedContract.discountPercent ?? null,
+                fixedTotalCents: request.negotiatedContract.fixedTotalCents ?? null,
+            }
+            : null,
+        trial: request.trial
+            ? {
+                active: request.trial.active,
+                endsAt: request.trial.endsAt,
+                reducedFranchises: request.trial.reducedFranchises ?? {},
+            }
+            : null,
+        proration: request.proration
+            ? {
+                reason: request.proration.reason,
+                cycleStart: request.proration.cycleStart,
+                cycleEnd: request.proration.cycleEnd,
+                now: request.proration.now,
+                oldValueCents: request.proration.oldValueCents,
+                newValueCents: request.proration.newValueCents,
+                timingPolicy: request.proration.timingPolicy ?? null,
+            }
+            : null,
+        quoteValidityHours: request.quoteValidityHours ?? 24,
         now: request.now,
     };
-    return (0, node_crypto_1.createHash)('sha256').update(JSON.stringify(basis)).digest('hex');
+    return (0, node_crypto_1.createHash)('sha256').update((0, canonical_js_1.canonicalStringify)(basis)).digest('hex');
 }
 function catalogFingerprint(plan, modules, bundles) {
     const basis = {
         plan: { code: plan.code, tier: plan.tier, franchises: plan.franchises },
-        modules: modules.map((m) => ({ code: m.code, class: m.class })).sort((a, b) => a.code.localeCompare(b.code)),
+        modules: modules
+            .map((m) => ({ code: m.code, class: m.class }))
+            .sort((a, b) => a.code.localeCompare(b.code)),
         bundles: bundles
             .map((b) => ({ code: b.code, moduleCodes: [...b.moduleCodes].sort() }))
             .sort((a, b) => a.code.localeCompare(b.code)),
     };
-    return (0, node_crypto_1.createHash)('sha256').update(JSON.stringify(basis)).digest('hex');
+    return (0, node_crypto_1.createHash)('sha256').update((0, canonical_js_1.canonicalStringify)(basis)).digest('hex');
 }
 function addHours(iso, hours) {
     const d = /^\d{4}-\d{2}-\d{2}$/.test(iso) ? new Date(`${iso}T00:00:00Z`) : new Date(iso);
@@ -64,7 +179,13 @@ function addHours(iso, hours) {
     return d.toISOString();
 }
 function itemOf(origin, targetCode, quantity, unitPriceCents, subtotalCents) {
-    return { origin, targetCode, quantity, unitPriceCents, subtotalCents: subtotalCents ?? unitPriceCents * quantity };
+    return {
+        origin,
+        targetCode,
+        quantity,
+        unitPriceCents,
+        subtotalCents: subtotalCents ?? unitPriceCents * quantity,
+    };
 }
 /**
  * Busca o preço por `targetType`+`targetCode` **filtrado pelo `billingCycle`**
@@ -125,22 +246,34 @@ function computePricingQuote(request) {
     }
 }
 function computeInternal(request) {
-    const { tenantId, productLine, offer, plan, modules, bundles, priceTable, bundleRules = [], extraSeats = 0, addonQuantities = {}, negotiatedContract, coupon, campaign, trial, now, billingCycle, quoteValidityHours = 24, } = request;
+    const { tenantId, productLine, offer, plan, modules, bundles, priceTable, bundleRules = [], extraSeats = 0, addonQuantities = {}, negotiatedContract, coupon, campaign, trial, proration, now, billingCycle, quoteValidityHours = 24, } = request;
     if (priceTable.code !== offer.priceTableCode) {
         throw new errors_js_1.PricingEngineError('price-rule-missing', `Offer "${offer.code}" referencia a tabela "${offer.priceTableCode}", recebida "${priceTable.code}".`);
     }
     if (priceTable.status !== 'active') {
         throw new errors_js_1.PricingEngineError('catalog-version-not-found', `Tabela "${priceTable.code}" não está ativa (status="${priceTable.status}").`);
     }
-    if (now < priceTable.effectiveFrom || (priceTable.effectiveTo != null && now > priceTable.effectiveTo)) {
+    if (now < priceTable.effectiveFrom ||
+        (priceTable.effectiveTo != null && now > priceTable.effectiveTo)) {
         throw new errors_js_1.PricingEngineError('invalid-effective-date', `Tabela "${priceTable.code}" fora de vigência em ${now}.`);
     }
     if (!isTableApplicable(priceTable, tenantId, productLine)) {
         throw new errors_js_1.PricingEngineError('catalog-version-not-found', `Tabela "${priceTable.code}" não se aplica ao escopo tenant="${tenantId}"/productLine="${productLine}".`);
     }
-    if (negotiatedContract && (now < negotiatedContract.validFrom || (negotiatedContract.validTo != null && now > negotiatedContract.validTo))) {
+    if (negotiatedContract &&
+        (now < negotiatedContract.validFrom ||
+            (negotiatedContract.validTo != null && now > negotiatedContract.validTo))) {
         throw new errors_js_1.PricingEngineError('negotiated-contract-invalid', `Contrato negociado do tenant "${negotiatedContract.tenantId}" fora de vigência em ${now}.`);
     }
+    // F3 (RFC §22.1/§22.5): discountPercent (passo 6, NegotiatedDiscount — cumulativo) e
+    // fixedTotalCents (passo 10, ContractPriceOverride — substitui o total) são estratégias
+    // comerciais mutuamente exclusivas. Coexistindo, `discounts[]` registraria um desconto que
+    // o override ignora — `totalDiscount` divergiria de `Σ discounts` (auditoria quebrada).
+    if (negotiatedContract &&
+        negotiatedContract.discountPercent != null &&
+        negotiatedContract.fixedTotalCents != null) {
+        throw new errors_js_1.PricingEngineError('negotiated-contract-invalid', `Contrato negociado do tenant "${negotiatedContract.tenantId}" não pode ter discountPercent (NegotiatedDiscount) e fixedTotalCents (ContractPriceOverride) simultaneamente — são estratégias comerciais mutuamente exclusivas.`);
+    }
     const warnings = [];
     const appliedRules = [];
     const items = [];
@@ -163,7 +296,9 @@ function computeInternal(request) {
             throw new errors_js_1.PricingEngineError('duplicate-charge-item', `Módulo "${moduleCode}" duplicado na oferta "${offer.code}".`);
         }
         chargedModuleCodes.add(moduleCode);
-        const unitCents = freeModuleCodes.has(moduleCode) ? 0 : (0, money_js_1.reaisToCents)(findPriceItemReais(priceTable, 'MODULE', moduleCode, billingCycle));
+        const unitCents = freeModuleCodes.has(moduleCode)
+            ? 0
+            : (0, money_js_1.reaisToCents)(findPriceItemReais(priceTable, 'MODULE', moduleCode, billingCycle));
         items.push(itemOf('module', moduleCode, 1, unitCents));
     }
     if (offer.moduleCodes.length > 0)
@@ -191,7 +326,11 @@ function computeInternal(request) {
     if (coupon?.exclusive)
         exclusiveCandidates.push({ key: 'coupon', priority: coupon.priority ?? 0, code: coupon.code });
     if (campaign?.exclusive)
-        exclusiveCandidates.push({ key: 'campaign', priority: campaign.priority ?? 0, code: campaign.code });
+        exclusiveCandidates.push({
+            key: 'campaign',
+            priority: campaign.priority ?? 0,
+            code: campaign.code,
+        });
     let suppressBundleAndNegotiated = false;
     let ignoredExclusiveKey = null;
     if (exclusiveCandidates.length === 1) {
@@ -219,7 +358,13 @@ function computeInternal(request) {
             const amount = (0, bundle_js_1.resolveBundleDiscount)(bundle, rule, items);
             if (amount != null && amount > 0) {
                 const applied = Math.min(amount, runningCents);
-                discounts.push({ ruleId: bundleCode, step: 'BUNDLE_DISCOUNT', kind: 'bundle', amountCents: applied, appliesTo: bundle.moduleCodes });
+                discounts.push({
+                    ruleId: bundleCode,
+                    step: 'BUNDLE_DISCOUNT',
+                    kind: 'bundle',
+                    amountCents: applied,
+                    appliesTo: bundle.moduleCodes,
+                });
                 runningCents = (0, money_js_1.subtractCents)(runningCents, applied);
             }
         }
@@ -251,9 +396,17 @@ function computeInternal(request) {
     // Passo 7 — COUPON (sobre o resultado até aqui — RFC §8)
     if (coupon) {
         if (ignoredExclusiveKey !== 'coupon') {
-            const raw = coupon.effectType === 'percent_off' ? (0, money_js_1.applyPercent)(runningCents, coupon.percentOff ?? 0) : (coupon.amountOffCents ?? 0);
+            const raw = coupon.effectType === 'percent_off'
+                ? (0, money_js_1.applyPercent)(runningCents, coupon.percentOff ?? 0)
+                : (coupon.amountOffCents ?? 0);
             const applied = Math.min(Math.max(raw, 0), runningCents);
-            discounts.push({ ruleId: coupon.code, step: 'COUPON', kind: coupon.effectType, amountCents: applied, appliesTo: ['*'] });
+            discounts.push({
+                ruleId: coupon.code,
+                step: 'COUPON',
+                kind: coupon.effectType,
+                amountCents: applied,
+                appliesTo: ['*'],
+            });
             runningCents = (0, money_js_1.subtractCents)(runningCents, applied);
             appliedRules.push('COUPON');
         }
@@ -264,9 +417,17 @@ function computeInternal(request) {
     // Passo 8 — CAMPAIGN
     if (campaign) {
         if (ignoredExclusiveKey !== 'campaign') {
-            const raw = campaign.effectType === 'percent_off' ? (0, money_js_1.applyPercent)(runningCents, campaign.percentOff ?? 0) : (campaign.amountOffCents ?? 0);
+            const raw = campaign.effectType === 'percent_off'
+                ? (0, money_js_1.applyPercent)(runningCents, campaign.percentOff ?? 0)
+                : (campaign.amountOffCents ?? 0);
             const applied = Math.min(Math.max(raw, 0), runningCents);
-            discounts.push({ ruleId: campaign.code, step: 'CAMPAIGN', kind: campaign.effectType, amountCents: applied, appliesTo: ['*'] });
+            discounts.push({
+                ruleId: campaign.code,
+                step: 'CAMPAIGN',
+                kind: campaign.effectType,
+                amountCents: applied,
+                appliesTo: ['*'],
+            });
             runningCents = (0, money_js_1.subtractCents)(runningCents, applied);
             appliedRules.push('CAMPAIGN');
         }
@@ -277,19 +438,32 @@ function computeInternal(request) {
     // Passo 9 — PROMOTIONAL_CREDIT (reservado — só preenchido quando Wallet/Rating existirem, RFC §12)
     const promotionalCreditsCents = 0;
     appliedRules.push('PROMOTIONAL_CREDIT');
+    // `totalDiscountCents` é fixado AQUI, antes do passo 10 — precisa refletir exatamente
+    // Σ discounts[] (passos 5-8), por construção. O override do passo 10 NÃO é um desconto
+    // (RFC §22.1 F3, §22.3: auditado via `appliedRules`, nunca via `discounts[]`); se
+    // calculássemos `totalDiscountCents` depois do override (subtotal − running pós-override),
+    // ele absorveria silenciosamente o efeito do override sempre que `fixedTotalCents` estiver
+    // presente — mesmo isolado, sem `discountPercent` — e `totalDiscountCents` divergiria de
+    // `Σ discounts[]` (achado real da Certification, não coberto pela guarda F3, que só cobre a
+    // coexistência dos dois campos).
+    const totalDiscountCents = (0, money_js_1.clampNonNegative)((0, money_js_1.subtractCents)(subtotalCents, runningCents));
     // Passo 10 — CONTRACT_OVERRIDE_OR_GRANDFATHERING (fixa/sobrepõe o total — nunca um desconto adicional)
+    // O delta econômico do override (positivo = reduz além do computado, negativo = sobretaxa
+    // acima do computado) fica em `auditMetadata` para rastreabilidade total sem virar `Discount`.
+    let contractOverrideDeltaCents = null;
     if (negotiatedContract?.fixedTotalCents != null) {
+        contractOverrideDeltaCents = (0, money_js_1.subtractCents)(runningCents, negotiatedContract.fixedTotalCents);
         runningCents = negotiatedContract.fixedTotalCents;
         appliedRules.push('CONTRACT_OVERRIDE_OR_GRANDFATHERING');
     }
     runningCents = (0, money_js_1.clampNonNegative)(runningCents);
-    const totalDiscountCents = (0, money_js_1.clampNonNegative)((0, money_js_1.subtractCents)(subtotalCents, runningCents));
     // Passo 11 — TAX (MVP: passthrough/zero configurável — política fiscal fora do escopo, RFC §5)
     const taxes = [];
     const totalTaxCents = 0;
     appliedRules.push('TAX');
     // Passo 12 — ROUNDING (cada etapa já arredondou half-even no ponto de uso — nada fracionário resta a arredondar)
-    const totalBeforeTrial = (0, money_js_1.addCents)(runningCents, totalTaxCents);
+    const prorationResult = proration ? (0, proration_js_1.computeProration)(proration) : null;
+    const totalBeforeTrial = (0, money_js_1.clampNonNegative)((0, money_js_1.addCents)(runningCents, totalTaxCents, prorationResult?.netCents ?? 0));
     appliedRules.push('ROUNDING');
     const trialActive = trial?.active ?? false;
     const totalCents = trialActive ? 0 : totalBeforeTrial;
@@ -323,8 +497,8 @@ function computeInternal(request) {
         appliedRules,
         warnings,
         fingerprint,
-        auditMetadata: {},
-        proration: null,
+        auditMetadata: contractOverrideDeltaCents != null ? { contractOverrideDeltaCents } : {},
+        proration: prorationResult,
     };
 }
 //# sourceMappingURL=pipeline.js.map