@baruk/core 0.5.0 → 0.6.0

package/dist/fiscal/credentials/onboarding.js

@@ -0,0 +1,259 @@
+import { createHash } from 'node:crypto';
+import { uuidv7 } from '@baruk/shared';
+import { encryptSecret } from '../../vault/crypto.js';
+import { inspectPkcs12, matchIdentity } from './inspect.js';
+/** Impressão digital truncada. 16 hex identificam sem virar um segundo identificador. */
+function shortFingerprint(full) {
+    return full.slice(0, 16);
+}
+/**
+ * Nome determinístico da credencial no cofre.
+ *
+ * Determinístico porque a substituição precisa ENCONTRAR o que já existe: o
+ * índice único do cofre é `(tenant, cliente, lower(nome))`, e um nome novo a
+ * cada upload deixaria uma trilha de chaves privadas órfãs, todas ainda
+ * decifráveis, nenhuma referenciada.
+ */
+export function fiscalCertificateCredentialName(clientId, certType) {
+    return `fiscal:certificate:${certType}:${clientId}`;
+}
+export async function onboardFiscalCertificate(tx, keyring, tenantId, input) {
+    const certType = input.certType ?? 'A1';
+    const clients = await tx `
+    SELECT id, document_number FROM client
+     WHERE id = ${input.clientId} AND deleted_at IS NULL
+  `;
+    const client = clients[0];
+    if (!client)
+        return { status: 'rejected', reason: 'client_not_found' };
+    const inspection = await inspectPkcs12(input.material, input.passphrase);
+    if (inspection.status === 'failed') {
+        return { status: 'rejected', reason: inspection.reason };
+    }
+    const facts = inspection.facts;
+    if (facts.expired)
+        return { status: 'rejected', reason: 'expired' };
+    const identity = matchIdentity(facts.document, client.document_number);
+    if (identity === 'mismatch' && !input.identityOverrideReason) {
+        return { status: 'rejected', reason: 'identity_mismatch', identityMatch: identity };
+    }
+    // O envelope é o MESMO que `material.ts` sabe abrir. Um segundo formato aqui
+    // significaria que o certificado que entra não é o que o transporte usa.
+    const envelope = JSON.stringify({
+        format: 'pkcs12',
+        material: input.material.toString('base64'),
+        ...(input.passphrase ? { passphrase: input.passphrase } : {}),
+    });
+    const credentialName = fiscalCertificateCredentialName(input.clientId, certType);
+    const credentialId = await upsertWriteOnlyCredential(tx, keyring, tenantId, {
+        name: credentialName,
+        clientId: input.clientId,
+        secret: envelope,
+        expiresAt: facts.validTo,
+        actorId: input.actorId,
+        metadata: {
+            // Metadata do cofre é lida por telas e por trilha: só o que é público no
+            // certificado entra aqui.
+            fingerprint: shortFingerprint(facts.fingerprintSha256),
+            certType,
+            subject: facts.subjectCommonName,
+        },
+    });
+    const expiresOn = facts.validTo.slice(0, 10);
+    const issuedAt = facts.validFrom.slice(0, 10);
+    const holderName = facts.subjectCommonName ?? 'Titular não identificado no certificado';
+    const existing = await tx `
+    SELECT id FROM digital_certificate
+     WHERE client_id = ${input.clientId} AND cert_type = ${certType} AND deleted_at IS NULL
+     ORDER BY created_at DESC LIMIT 1
+  `;
+    const override = identity === 'mismatch' ? (input.identityOverrideReason ?? null) : null;
+    const overrideBy = override ? input.actorId : null;
+    let rows;
+    if (existing[0]) {
+        rows = await tx `
+      UPDATE digital_certificate SET
+        holder_name = ${holderName},
+        holder_document = ${facts.document ?? client.document_number},
+        issued_at = ${issuedAt},
+        expires_at = ${expiresOn},
+        vault_credential_id = ${credentialId},
+        status = 'active',
+        fingerprint_sha256 = ${facts.fingerprintSha256},
+        subject_common_name = ${facts.subjectCommonName},
+        issuer_common_name = ${facts.issuerCommonName},
+        serial_tail = ${facts.serialTail},
+        certificate_document = ${facts.document},
+        identity_match = ${identity},
+        identity_override_by = ${overrideBy},
+        identity_override_reason = ${override},
+        uploaded_by = ${input.actorId},
+        uploaded_at = now(),
+        -- O material acabou de ser aberto pela inspeção — o mesmo OpenSSL do
+        -- handshake real. Isso é a validação LOCAL, e ela é fato deste instante:
+        -- senha correta, chave casando com o certificado, titular e datas
+        -- conferidos. Ver 1006.
+        local_validated_at = now(),
+        -- Material novo é uma afirmação nova: o que o ambiente oficial aceitou
+        -- foi o certificado ANTERIOR, e herdar a verificação diria que o novo
+        -- já funcionou. Ver 1004.
+        verified_at = NULL,
+        verified_by = NULL,
+        remote_verification_provider = NULL,
+        remote_verification_last_attempt_at = NULL,
+        last_verification_error = NULL,
+        updated_at = now()
+      WHERE id = ${existing[0].id}
+      RETURNING ${tx.unsafe(CERTIFICATE_COLUMNS)}
+    `;
+    }
+    else {
+        rows = await tx `
+      INSERT INTO digital_certificate (
+        id, tenant_id, client_id, cert_type, holder_name, holder_document,
+        issued_at, expires_at, vault_credential_id, status,
+        fingerprint_sha256, subject_common_name, issuer_common_name, serial_tail,
+        certificate_document, identity_match, identity_override_by, identity_override_reason,
+        uploaded_by, uploaded_at, local_validated_at
+      ) VALUES (
+        ${uuidv7()}, current_setting('app.current_tenant')::uuid, ${input.clientId},
+        ${certType}, ${holderName}, ${facts.document ?? client.document_number},
+        ${issuedAt}, ${expiresOn}, ${credentialId}, 'active',
+        ${facts.fingerprintSha256}, ${facts.subjectCommonName}, ${facts.issuerCommonName},
+        ${facts.serialTail}, ${facts.document}, ${identity}, ${overrideBy}, ${override},
+        -- As duas datas coincidem aqui, e é correto: o material só chega a
+        -- esta linha porque a inspeção passou.
+        ${input.actorId}, now(), now()
+      )
+      RETURNING ${tx.unsafe(CERTIFICATE_COLUMNS)}
+    `;
+    }
+    return {
+        status: 'stored',
+        certificate: mapCertificate(rows[0], { replaced: Boolean(existing[0]) }),
+    };
+}
+/**
+ * Grava (ou rotaciona) o segredo no cofre com `exposure = 'write_only'`.
+ *
+ * Não reutiliza `createCredential`/`rotateSecret` de `vault/repository.ts` por
+ * um motivo específico: aqueles não conhecem `exposure`, e um certificado
+ * gravado por eles nasceria `revealable` — a 0060 recusaria o INSERT, o que
+ * está correto, mas a mensagem de erro seria uma violação de CHECK em vez de
+ * uma decisão explícita. Aqui a classe do segredo é dita na escrita.
+ */
+async function upsertWriteOnlyCredential(tx, keyring, tenantId, input) {
+    const enc = encryptSecret(keyring, tenantId, input.secret);
+    const existing = await tx `
+    SELECT id FROM vault_credential
+     WHERE client_id = ${input.clientId}
+       AND lower(name) = lower(${input.name})
+       AND deleted_at IS NULL
+     LIMIT 1
+  `;
+    if (existing[0]) {
+        await tx `
+      UPDATE vault_credential SET
+        ciphertext = ${enc.ciphertext}, iv = ${enc.iv}, auth_tag = ${enc.authTag},
+        key_version = ${enc.keyVersion}, rotated_at = now(), updated_at = now(),
+        updated_by = ${input.actorId}, version = version + 1,
+        expires_at = ${input.expiresAt},
+        metadata = ${tx.json(input.metadata)},
+        exposure = 'write_only'
+      WHERE id = ${existing[0].id}
+    `;
+        return existing[0].id;
+    }
+    const rows = await tx `
+    INSERT INTO vault_credential (
+      id, tenant_id, client_id, name, category, provider,
+      ciphertext, iv, auth_tag, key_version, metadata, expires_at, created_by, exposure
+    ) VALUES (
+      ${uuidv7()}, current_setting('app.current_tenant')::uuid, ${input.clientId},
+      ${input.name}, 'certificate', 'icp_brasil',
+      ${enc.ciphertext}, ${enc.iv}, ${enc.authTag}, ${enc.keyVersion},
+      ${tx.json(input.metadata)}, ${input.expiresAt}, ${input.actorId}, 'write_only'
+    )
+    RETURNING id
+  `;
+    return rows[0].id;
+}
+const CERTIFICATE_COLUMNS = `
+  id, client_id, cert_type, status, subject_common_name, issuer_common_name,
+  serial_tail, fingerprint_sha256, certificate_document, identity_match,
+  identity_override_reason, issued_at, expires_at, uploaded_at, verified_at,
+  local_validated_at, remote_verification_provider
+`;
+function mapCertificate(r, extra) {
+    return {
+        id: r.id,
+        clientId: r.client_id,
+        certType: r.cert_type === 'A3' ? 'A3' : 'A1',
+        status: r.status,
+        subjectCommonName: r.subject_common_name,
+        issuerCommonName: r.issuer_common_name,
+        serialTail: r.serial_tail,
+        fingerprint: shortFingerprint(r.fingerprint_sha256 ?? ''),
+        certificateDocument: r.certificate_document,
+        identityMatch: r.identity_match ?? 'indeterminate',
+        identityOverrideReason: r.identity_override_reason,
+        issuedAt: r.issued_at ? isoDate(r.issued_at) : null,
+        expiresOn: isoDate(r.expires_at),
+        uploadedAt: r.uploaded_at?.toISOString() ?? null,
+        verifiedAt: r.verified_at?.toISOString() ?? null,
+        replaced: extra.replaced,
+    };
+}
+function isoDate(d) {
+    return d.toISOString().slice(0, 10);
+}
+/** Os certificados de um cliente, só metadata. É o que a tela lê. */
+export async function listFiscalCertificates(tx, clientId) {
+    const rows = await tx `
+    SELECT ${tx.unsafe(CERTIFICATE_COLUMNS)}
+      FROM digital_certificate
+     WHERE client_id = ${clientId} AND deleted_at IS NULL
+     ORDER BY expires_at DESC
+  `;
+    return rows.map((r) => mapCertificate(r, { replaced: false }));
+}
+/**
+ * Revoga o uso do certificado DENTRO deste produto.
+ *
+ * Não toca a ICP-Brasil, e é por isso que a função se chama assim. Revogar de
+ * verdade um certificado é um ato junto à Autoridade Certificadora que o emitiu;
+ * apagar a linha daqui apenas garante que este produto pare de apresentá-lo. A
+ * tela repete a distinção, porque um operador que acredite ter revogado o
+ * certificado do cliente não vai à AC — e o certificado segue válido no mundo.
+ *
+ * O material sai do cofre no mesmo movimento (`deleted_at`), de modo que a
+ * revogação não deixa chave privada decifrável para trás.
+ */
+export async function revokeFiscalCertificate(tx, clientId, certificateId) {
+    const rows = await tx `
+    UPDATE digital_certificate SET status = 'revoked', deleted_at = now(), updated_at = now()
+     WHERE id = ${certificateId} AND client_id = ${clientId} AND deleted_at IS NULL
+    RETURNING vault_credential_id
+  `;
+    if (rows.length === 0)
+        return { revoked: false };
+    const pointer = rows[0]?.vault_credential_id;
+    if (pointer) {
+        await tx `
+      UPDATE vault_credential SET deleted_at = now()
+       WHERE id = ${pointer} AND deleted_at IS NULL
+    `;
+    }
+    return { revoked: true };
+}
+/**
+ * Impressão digital do material recebido, antes de qualquer decisão.
+ *
+ * Serve à trilha do upload recusado: registrar "tentaram subir algo" sem
+ * registrar o quê. É o mesmo cálculo de `material.ts`, e é seguro por
+ * construção — um hash não volta a ser um certificado.
+ */
+export function materialFingerprint(material) {
+    return shortFingerprint(createHash('sha256').update(material).digest('hex'));
+}
+//# sourceMappingURL=onboarding.js.map

package/dist/fiscal/credentials/onboarding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"onboarding.js","sourceRoot":"","sources":["../../../src/fiscal/credentials/onboarding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAGvC,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAsB,MAAM,cAAc,CAAC;AAyFhF,yFAAyF;AACzF,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,+BAA+B,CAAC,QAAgB,EAAE,QAAqB;IACrF,OAAO,sBAAsB,QAAQ,IAAI,QAAQ,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,EAAM,EACN,OAAgB,EAChB,QAAgB,EAChB,KAAiC;IAEjC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC;IAExC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAkD;;kBAE1D,KAAK,CAAC,QAAQ;GAC7B,CAAC;IACF,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAEvE,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACzE,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;IAC3D,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAC/B,IAAI,KAAK,CAAC,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAEpE,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IACvE,IAAI,QAAQ,KAAK,UAAU,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,CAAC;QAC7D,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;IACtF,CAAC;IAED,6EAA6E;IAC7E,yEAAyE;IACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;QAC9B,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC3C,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9D,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,+BAA+B,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjF,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE;QAC1E,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,KAAK,CAAC,OAAO;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE;YACR,yEAAyE;YACzE,0BAA0B;YAC1B,WAAW,EAAE,gBAAgB,CAAC,KAAK,CAAC,iBAAiB,CAAC;YACtD,QAAQ;YACR,OAAO,EAAE,KAAK,CAAC,iBAAiB;SACjC;KACF,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,KAAK,CAAC,iBAAiB,IAAI,yCAAyC,CAAC;IAExF,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAkB;;yBAEpB,KAAK,CAAC,QAAQ,oBAAoB,QAAQ;;GAEhE,CAAC;IAEF,MAAM,QAAQ,GAAG,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,sBAAsB,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,MAAM,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAEnD,IAAI,IAAsB,CAAC;IAC3B,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAChB,IAAI,GAAG,MAAM,EAAE,CAAkB;;wBAEb,UAAU;4BACN,KAAK,CAAC,QAAQ,IAAI,MAAM,CAAC,eAAe;sBAC9C,QAAQ;uBACP,SAAS;gCACA,YAAY;;+BAEb,KAAK,CAAC,iBAAiB;gCACtB,KAAK,CAAC,iBAAiB;+BACxB,KAAK,CAAC,gBAAgB;wBAC7B,KAAK,CAAC,UAAU;iCACP,KAAK,CAAC,QAAQ;2BACpB,QAAQ;iCACF,UAAU;qCACN,QAAQ;wBACrB,KAAK,CAAC,OAAO;;;;;;;;;;;;;;;;mBAgBlB,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;kBACf,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC;KAC3C,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,MAAM,EAAE,CAAkB;;;;;;;;UAQ3B,MAAM,EAAE,kDAAkD,KAAK,CAAC,QAAQ;UACxE,QAAQ,KAAK,UAAU,KAAK,KAAK,CAAC,QAAQ,IAAI,MAAM,CAAC,eAAe;UACpE,QAAQ,KAAK,SAAS,KAAK,YAAY;UACvC,KAAK,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB,KAAK,KAAK,CAAC,gBAAgB;UAC9E,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,QAAQ,KAAK,QAAQ,KAAK,UAAU,KAAK,QAAQ;;;UAG5E,KAAK,CAAC,OAAO;;kBAEL,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC;KAC3C,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,yBAAyB,CACtC,EAAM,EACN,OAAgB,EAChB,QAAgB,EAChB,KAOC;IAED,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAE3D,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAkB;;yBAEpB,KAAK,CAAC,QAAQ;iCACN,KAAK,CAAC,IAAI;;;GAGxC,CAAC;IAEF,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAChB,MAAM,EAAE,CAAA;;uBAEW,GAAG,CAAC,UAAU,UAAU,GAAG,CAAC,EAAE,gBAAgB,GAAG,CAAC,OAAO;wBACxD,GAAG,CAAC,UAAU;uBACf,KAAK,CAAC,OAAO;uBACb,KAAK,CAAC,SAAS;qBACjB,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAiB,CAAC;;mBAElC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;KAC5B,CAAC;QACF,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxB,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAkB;;;;;QAKjC,MAAM,EAAE,kDAAkD,KAAK,CAAC,QAAQ;QACxE,KAAK,CAAC,IAAI;QACV,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,UAAU;QAC5D,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAiB,CAAC,KAAK,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO;;;GAG3E,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;AACrB,CAAC;AAED,MAAM,mBAAmB,GAAG;;;;;CAK3B,CAAC;AAoBF,SAAS,cAAc,CAAC,CAAiB,EAAE,KAA4B;IACrE,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,QAAQ,EAAE,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QAC5C,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,iBAAiB,EAAE,CAAC,CAAC,mBAAmB;QACxC,gBAAgB,EAAE,CAAC,CAAC,kBAAkB;QACtC,UAAU,EAAE,CAAC,CAAC,WAAW;QACzB,WAAW,EAAE,gBAAgB,CAAC,CAAC,CAAC,kBAAkB,IAAI,EAAE,CAAC;QACzD,mBAAmB,EAAE,CAAC,CAAC,oBAAoB;QAC3C,aAAa,EAAG,CAAC,CAAC,cAAuC,IAAI,eAAe;QAC5E,sBAAsB,EAAE,CAAC,CAAC,wBAAwB;QAClD,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;QACnD,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;QAChC,UAAU,EAAE,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,IAAI;QAChD,UAAU,EAAE,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,IAAI;QAChD,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,CAAO;IACtB,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,EAAM,EACN,QAAgB;IAEhB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAkB;aAC5B,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC;;yBAElB,QAAQ;;GAE9B,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,EAAM,EACN,QAAgB,EAChB,aAAqB;IAErB,MAAM,IAAI,GAAG,MAAM,EAAE,CAA0C;;kBAE/C,aAAa,oBAAoB,QAAQ;;GAExD,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAEjD,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,mBAAmB,CAAC;IAC7C,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,EAAE,CAAA;;oBAEQ,OAAO;KACtB,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,OAAO,gBAAgB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/E,CAAC"}

package/dist/fiscal/credentials/readiness.d.ts

@@ -36,15 +36,39 @@ import type { FiscalCredentialKind, FiscalEnvironment } from '../eligibility.js'
  *   `EXPIRED`          venceu. Só a renovação resolve.
  *   `INVALID`          revogada, ou o ponteiro para o cofre não resolve.
  *   `ACCESS_DENIED`    o material serve; o ambiente recusou o TITULAR.
- *   `REQUIRES_REVIEW`  cadastrada e nunca exercida — ou de um tipo que um cron
- *                      não consegue usar (A3 vive em token com PIN presencial).
+ *   `LOCAL_VALID`      o material abre, a chave casa, o titular confere e as
+ *                      datas estão na janela — e NENHUM ambiente oficial o
+ *                      aceitou ainda. É o estado em que todo certificado novo
+ *                      nasce, e o único que o primeiro contato admite.
+ *   `REQUIRES_REVIEW`  cadastrada e sem validação local registrada — ou de um
+ *                      tipo que um cron não consegue usar (A3 vive em token com
+ *                      PIN presencial).
  */
-export type FiscalCredentialState = 'NOT_CONFIGURED' | 'READY' | 'EXPIRED' | 'INVALID' | 'ACCESS_DENIED' | 'REQUIRES_REVIEW';
+export type FiscalCredentialState = 'NOT_CONFIGURED' | 'READY' | 'LOCAL_VALID' | 'EXPIRED' | 'INVALID' | 'ACCESS_DENIED' | 'REQUIRES_REVIEW';
 export interface FiscalCredentialReadiness {
     state: FiscalCredentialState;
     kind: FiscalCredentialKind | null;
     /** Só `READY` autoriza o worker a tentar. Nenhum outro estado, por motivo nenhum. */
     usableByWorker: boolean;
+    /**
+     * O material passou na verificação LOCAL: abriu com a senha, a chave casa com
+     * o certificado, o titular confere e as datas estão na janela.
+     *
+     * Independente de `usableByWorker` de propósito. Foi a fusão dos dois que
+     * produziu o impasse: exigir aceite remoto para executar, quando só executar
+     * produz o aceite.
+     */
+    localValid: boolean;
+    /**
+     * Esta credencial pode ser usada num PRIMEIRO CONTATO — a execução única,
+     * manual e autorizada que existe justamente para obter o aceite remoto.
+     *
+     * `true` exatamente quando o material é válido localmente e nenhum ambiente o
+     * aceitou ainda. Um cron jamais consulta este campo: ele existe para o
+     * executor de primeiro contato, e o banco recusa autorização de primeiro
+     * contato disparada por agendador.
+     */
+    eligibleForFirstContact: boolean;
     /**
      * `true` quando um retry futuro pode mudar o desfecho sem intervenção humana.
      * `EXPIRED`, `INVALID` e `ACCESS_DENIED` são `false` — e é isso que decide se
@@ -52,7 +76,10 @@ export interface FiscalCredentialReadiness {
      */
     selfHealing: boolean;
     expiresOn: string | null;
+    /** Quando o ambiente OFICIAL aceitou. Nunca sai do cadastro. */
     verifiedAt: string | null;
+    /** Quando o material passou na verificação local. */
+    localValidatedAt: string | null;
     /** sha256 truncado do material, quando registrado. Seguro para tela e trilha. */
     fingerprint: string | null;
     /**

package/dist/fiscal/credentials/readiness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"readiness.d.ts","sourceRoot":"","sources":["../../../src/fiscal/credentials/readiness.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEjF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,MAAM,qBAAqB,GAC/B,gBAAgB,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,eAAe,GAAG,iBAAiB,CAAC;AAE3F,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,qBAAqB,CAAC;IAC7B,IAAI,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAClC,qFAAqF;IACrF,cAAc,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,iFAAiF;IACjF,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;OAGG;IACH,qBAAqB,EAAE,SAAS,GAAG,aAAa,CAAC;IACjD,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;CAChB;AAoBD;;;;;;;;;;GAUG;AACH,wBAAsB,6BAA6B,CACjD,EAAE,EAAE,EAAE,EACN,KAAK,EAAE;IACL,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,iBAAiB,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,oBAAoB,CAAC;CAC7B,GACA,OAAO,CAAC,yBAAyB,CAAC,CAuHpC;AAWD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,qBAAqB,GAC3B,qBAAqB,GAAG,qBAAqB,GAAG,eAAe,GAAG,IAAI,CAWxE"}
+{"version":3,"file":"readiness.d.ts","sourceRoot":"","sources":["../../../src/fiscal/credentials/readiness.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEjF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,qBAAqB,GAC7B,gBAAgB,GAChB,OAAO,GACP,aAAa,GACb,SAAS,GACT,SAAS,GACT,eAAe,GACf,iBAAiB,CAAC;AAEtB,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,qBAAqB,CAAC;IAC7B,IAAI,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAClC,qFAAqF;IACrF,cAAc,EAAE,OAAO,CAAC;IACxB;;;;;;;OAOG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;;;;OAQG;IACH,uBAAuB,EAAE,OAAO,CAAC;IACjC;;;;OAIG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gEAAgE;IAChE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,qDAAqD;IACrD,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,iFAAiF;IACjF,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;OAGG;IACH,qBAAqB,EAAE,SAAS,GAAG,aAAa,CAAC;IACjD,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;CAChB;AAsBD;;;;;;;;;;GAUG;AACH,wBAAsB,6BAA6B,CACjD,EAAE,EAAE,EAAE,EACN,KAAK,EAAE;IACL,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,iBAAiB,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,oBAAoB,CAAC;CAC7B,GACA,OAAO,CAAC,yBAAyB,CAAC,CAkJpC;AAWD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,qBAAqB,GAC3B,qBAAqB,GAAG,qBAAqB,GAAG,eAAe,GAAG,IAAI,CAWxE"}

package/dist/fiscal/credentials/readiness.js

@@ -21,9 +21,12 @@ export async function readFiscalCredentialReadiness(tx, input) {
     const base = {
         kind,
         usableByWorker: false,
+        localValid: false,
+        eligibleForFirstContact: false,
         selfHealing: false,
         expiresOn: null,
         verifiedAt: null,
+        localValidatedAt: null,
         fingerprint: null,
         providerAuthorization: 'unknown',
     };
@@ -40,6 +43,7 @@ export async function readFiscalCredentialReadiness(tx, input) {
     try {
         rows = await tx `
       SELECT id, cert_type, status, expires_at, verified_at,
+             local_validated_at, fingerprint_sha256,
              last_verification_error, vault_credential_id
         FROM digital_certificate
        WHERE client_id = ${input.clientId}
@@ -62,7 +66,14 @@ export async function readFiscalCredentialReadiness(tx, input) {
     }
     const expiresOn = cert.expires_at ? isoDate(cert.expires_at) : null;
     const verifiedAt = cert.verified_at?.toISOString() ?? null;
-    const withDates = { ...base, expiresOn, verifiedAt };
+    const localValidatedAt = cert.local_validated_at?.toISOString() ?? null;
+    const withDates = {
+        ...base,
+        expiresOn,
+        verifiedAt,
+        localValidatedAt,
+        fingerprint: cert.fingerprint_sha256 ?? null,
+    };
     if (cert.status === 'revoked') {
         return { ...withDates, state: 'INVALID', detail: 'certificado revogado' };
     }
@@ -101,10 +112,23 @@ export async function readFiscalCredentialReadiness(tx, input) {
         };
     }
     if (!cert.verified_at) {
+        // Aqui estava o impasse. Antes, tudo que não fora aceito remotamente caía
+        // num balde só, e o balde reprovava a execução — inclusive a execução que
+        // produziria o aceite. Agora o material conferido localmente tem estado
+        // próprio, e é ele que o primeiro contato aceita.
+        if (cert.local_validated_at) {
+            return {
+                ...withDates,
+                state: 'LOCAL_VALID',
+                localValid: true,
+                eligibleForFirstContact: true,
+                detail: 'válida localmente; nenhum ambiente oficial a aceitou ainda',
+            };
+        }
         return {
             ...withDates,
             state: 'REQUIRES_REVIEW',
-            detail: 'cadastrado e nunca exercido contra o ambiente oficial',
+            detail: 'cadastrada sem validação local registrada',
         };
     }
     // A autorização do provedor sai de execução OBSERVADA. Um `SELECT` sobre a
@@ -122,6 +146,9 @@ export async function readFiscalCredentialReadiness(tx, input) {
         ...withDates,
         state: 'READY',
         usableByWorker: true,
+        localValid: true,
+        // Já aceita remotamente: não há primeiro contato a fazer.
+        eligibleForFirstContact: false,
         selfHealing: true,
         providerAuthorization: established ? 'established' : 'unknown',
         detail: established

package/dist/fiscal/credentials/readiness.js.map

@@ -1 +1 @@
-{"version":3,"file":"readiness.js","sourceRoot":"","sources":["../../../src/fiscal/credentials/readiness.ts"],"names":[],"mappings":"AAgFA;;;;;GAKG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAE9F;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,EAAM,EACN,KAKC;IAED,MAAM,IAAI,GAAyB,KAAK,CAAC,IAAI,IAAI,gBAAgB,CAAC;IAElE,MAAM,IAAI,GAAG;QACX,IAAI;QACJ,cAAc,EAAE,KAAK;QACrB,WAAW,EAAE,KAAK;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,IAAI;QAChB,WAAW,EAAE,IAAI;QACjB,qBAAqB,EAAE,SAAkB;KAC1C,CAAC;IAEF,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAChC,yEAAyE;QACzE,qEAAqE;QACrE,OAAO;YACL,GAAG,IAAI;YACP,KAAK,EAAE,gBAAgB;YACvB,MAAM,EAAE,iEAAiE;SAC1E,CAAC;IACJ,CAAC;IAED,IAAI,IAAe,CAAC;IACpB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,EAAE,CAAW;;;;2BAIH,KAAK,CAAC,QAAQ;2BACd,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;;;;KAI7D,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAAgC,EAAE,IAAI,CAAC;QACrD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACzC,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;QACxF,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IACvF,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC;IAC3D,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;IAErD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAC5E,CAAC;IACD,2EAA2E;IAC3E,8EAA8E;IAC9E,qBAAqB;IACrB,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,GAAG,QAAQ,EAAE,EAAE,CAAC;QACpD,OAAO,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,SAAS,EAAE,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAC5E,CAAC;IACD,IAAI,IAAI,CAAC,uBAAuB,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,EAAE,CAAC;QACrF,OAAO;YACL,GAAG,SAAS;YACZ,KAAK,EAAE,eAAe;YACtB,MAAM,EAAE,2BAA2B,IAAI,CAAC,uBAAuB,GAAG;SACnE,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC9B,4EAA4E;QAC5E,6EAA6E;QAC7E,OAAO;YACL,GAAG,SAAS;YACZ,KAAK,EAAE,iBAAiB;YACxB,MAAM,EAAE,wDAAwD;SACjE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC9B,qEAAqE;QACrE,mEAAmE;QACnE,OAAO;YACL,GAAG,SAAS;YACZ,KAAK,EAAE,SAAS;YAChB,MAAM,EAAE,8CAA8C;SACvD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,OAAO;YACL,GAAG,SAAS;YACZ,KAAK,EAAE,iBAAiB;YACxB,MAAM,EAAE,uDAAuD;SAChE,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,kDAAkD;IAClD,MAAM,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAiB;;;yBAGf,KAAK,CAAC,QAAQ;sBACjB,KAAK,CAAC,MAAM;2BACP,KAAK,CAAC,WAAW;;GAEzC,CAAC;IACF,MAAM,WAAW,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAErC,OAAO;QACL,GAAG,SAAS;QACZ,KAAK,EAAE,OAAO;QACd,cAAc,EAAE,IAAI;QACpB,WAAW,EAAE,IAAI;QACjB,qBAAqB,EAAE,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;QAC9D,MAAM,EAAE,WAAW;YACjB,CAAC,CAAC,+CAA+C;YACjD,CAAC,CAAC,kEAAkE;KACvE,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ;IACf,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,OAAO,CAAC,CAAO;IACtB,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAA4B;IAE5B,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,SAAS;YACZ,OAAO,qBAAqB,CAAC;QAC/B,KAAK,SAAS;YACZ,OAAO,qBAAqB,CAAC;QAC/B,KAAK,eAAe;YAClB,OAAO,eAAe,CAAC;QACzB;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC"}
+{"version":3,"file":"readiness.js","sourceRoot":"","sources":["../../../src/fiscal/credentials/readiness.ts"],"names":[],"mappings":"AAmHA;;;;;GAKG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAE9F;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,EAAM,EACN,KAKC;IAED,MAAM,IAAI,GAAyB,KAAK,CAAC,IAAI,IAAI,gBAAgB,CAAC;IAElE,MAAM,IAAI,GAAG;QACX,IAAI;QACJ,cAAc,EAAE,KAAK;QACrB,UAAU,EAAE,KAAK;QACjB,uBAAuB,EAAE,KAAK;QAC9B,WAAW,EAAE,KAAK;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,IAAI;QAChB,gBAAgB,EAAE,IAAI;QACtB,WAAW,EAAE,IAAI;QACjB,qBAAqB,EAAE,SAAkB;KAC1C,CAAC;IAEF,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAChC,yEAAyE;QACzE,qEAAqE;QACrE,OAAO;YACL,GAAG,IAAI;YACP,KAAK,EAAE,gBAAgB;YACvB,MAAM,EAAE,iEAAiE;SAC1E,CAAC;IACJ,CAAC;IAED,IAAI,IAAe,CAAC;IACpB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,EAAE,CAAW;;;;;2BAKH,KAAK,CAAC,QAAQ;2BACd,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;;;;KAI7D,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAAgC,EAAE,IAAI,CAAC;QACrD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACzC,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;QACxF,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IACvF,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC;IAC3D,MAAM,gBAAgB,GAAG,IAAI,CAAC,kBAAkB,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC;IACxE,MAAM,SAAS,GAAG;QAChB,GAAG,IAAI;QACP,SAAS;QACT,UAAU;QACV,gBAAgB;QAChB,WAAW,EAAE,IAAI,CAAC,kBAAkB,IAAI,IAAI;KAC7C,CAAC;IAEF,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAC5E,CAAC;IACD,2EAA2E;IAC3E,8EAA8E;IAC9E,qBAAqB;IACrB,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,GAAG,QAAQ,EAAE,EAAE,CAAC;QACpD,OAAO,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,SAAS,EAAE,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAC5E,CAAC;IACD,IAAI,IAAI,CAAC,uBAAuB,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,EAAE,CAAC;QACrF,OAAO;YACL,GAAG,SAAS;YACZ,KAAK,EAAE,eAAe;YACtB,MAAM,EAAE,2BAA2B,IAAI,CAAC,uBAAuB,GAAG;SACnE,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC9B,4EAA4E;QAC5E,6EAA6E;QAC7E,OAAO;YACL,GAAG,SAAS;YACZ,KAAK,EAAE,iBAAiB;YACxB,MAAM,EAAE,wDAAwD;SACjE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC9B,qEAAqE;QACrE,mEAAmE;QACnE,OAAO;YACL,GAAG,SAAS;YACZ,KAAK,EAAE,SAAS;YAChB,MAAM,EAAE,8CAA8C;SACvD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,0EAA0E;QAC1E,0EAA0E;QAC1E,wEAAwE;QACxE,kDAAkD;QAClD,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,OAAO;gBACL,GAAG,SAAS;gBACZ,KAAK,EAAE,aAAa;gBACpB,UAAU,EAAE,IAAI;gBAChB,uBAAuB,EAAE,IAAI;gBAC7B,MAAM,EAAE,4DAA4D;aACrE,CAAC;QACJ,CAAC;QACD,OAAO;YACL,GAAG,SAAS;YACZ,KAAK,EAAE,iBAAiB;YACxB,MAAM,EAAE,2CAA2C;SACpD,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,kDAAkD;IAClD,MAAM,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAiB;;;yBAGf,KAAK,CAAC,QAAQ;sBACjB,KAAK,CAAC,MAAM;2BACP,KAAK,CAAC,WAAW;;GAEzC,CAAC;IACF,MAAM,WAAW,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAErC,OAAO;QACL,GAAG,SAAS;QACZ,KAAK,EAAE,OAAO;QACd,cAAc,EAAE,IAAI;QACpB,UAAU,EAAE,IAAI;QAChB,0DAA0D;QAC1D,uBAAuB,EAAE,KAAK;QAC9B,WAAW,EAAE,IAAI;QACjB,qBAAqB,EAAE,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;QAC9D,MAAM,EAAE,WAAW;YACjB,CAAC,CAAC,+CAA+C;YACjD,CAAC,CAAC,kEAAkE;KACvE,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ;IACf,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,OAAO,CAAC,CAAO;IACtB,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAA4B;IAE5B,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,SAAS;YACZ,OAAO,qBAAqB,CAAC;QAC/B,KAAK,SAAS;YACZ,OAAO,qBAAqB,CAAC;QAC/B,KAAK,eAAe;YAClB,OAAO,eAAe,CAAC;QACzB;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/fiscal/enrollment.d.ts

@@ -0,0 +1,91 @@
+import type { Tx } from '../db/client.js';
+import { type FiscalDocumentType, type FiscalEnvironment, type TenantFiscalAutomation } from './eligibility.js';
+/**
+ * Quem entra na automação fiscal — o escritório, e depois cada cliente.
+ *
+ * ## Duas chaves, e por que não bastava uma
+ *
+ * `tenant_fiscal_automation` diz em QUE AMBIENTE o escritório declarou operar.
+ * É a chave-geral: enquanto ela estiver desligada, nenhum cliente é consultado,
+ * por mais matriculado que esteja.
+ *
+ * `client_fiscal_enrollment` diz QUAIS clientes, e para QUAIS documentos. É a
+ * chave por porta: um cliente pode ter NFS-e habilitada e NF-e não, porque os
+ * dois conectores têm maturidades diferentes e o escritório pode querer
+ * começar por um.
+ *
+ * As duas tabelas existem desde a 0058 e nunca tiveram escritor. Este módulo é
+ * o escritor — e o motivo de ele existir agora é que, sem ele, habilitar
+ * automação fiscal exigia um `INSERT` manual em produção.
+ *
+ * ## Nada aqui liga nada sozinho
+ *
+ * Um certificado cadastrado NÃO habilita ninguém. São atos distintos, com
+ * autores distintos e trilhas distintas: enviar material é uma coisa, declarar
+ * que o escritório opera automação fiscal em produção é outra, e dizer que
+ * ESTE cliente entra é uma terceira.
+ */
+/**
+ * O modo declarado pelo escritório.
+ *
+ * Deriva de `TenantFiscalAutomation` (eligibility.ts) em vez de repetir a lista:
+ * duas cópias do mesmo vocabulário divergem, e a divergência decide quem entra
+ * na automação.
+ */
+export type FiscalAutomationMode = TenantFiscalAutomation['mode'];
+export interface ClientFiscalEnrollment {
+    documentType: FiscalDocumentType;
+    enrolledAt: string;
+    enrolledBy: string | null;
+    revokedAt: string | null;
+    note: string | null;
+    /** Vale agora? Uma matrícula revogada continua no registro, e deve. */
+    active: boolean;
+}
+/** O estado das duas chaves, para a tela e para o portão. */
+export interface FiscalEnrollmentView {
+    automation: TenantFiscalAutomation;
+    enrollments: readonly ClientFiscalEnrollment[];
+}
+/**
+ * Declara em que ambiente o escritório opera automação fiscal.
+ *
+ * `production` é a fronteira entre ensaio e operação real: a partir dela, o
+ * material de um contribuinte pode ser apresentado a um servidor da Receita. Por
+ * isso o ato é auditado com o modo anterior e o novo — "passou a ser produção"
+ * não responde a pergunta que se faz meses depois.
+ */
+export declare function setTenantFiscalAutomation(tx: Tx, input: {
+    mode: FiscalAutomationMode;
+    actorId: string;
+    note?: string | null;
+}): Promise<TenantFiscalAutomation>;
+export declare function listClientFiscalEnrollments(tx: Tx, clientId: string): Promise<ClientFiscalEnrollment[]>;
+/**
+ * Matricula um cliente para UM tipo de documento.
+ *
+ * A granularidade é o ponto: NFS-e e NF-e são conectores diferentes, com
+ * maturidades diferentes. Uma matrícula que valesse "para tudo" habilitaria o
+ * cliente num conector que talvez nem exista.
+ *
+ * Rematricular um cliente revogado o reativa — e o registro guarda as duas
+ * datas, porque quem revogou tinha um motivo e ele não deve sumir.
+ */
+export declare function enrollClientFiscal(tx: Tx, input: {
+    clientId: string;
+    documentType: FiscalDocumentType;
+    actorId: string;
+    note?: string | null;
+}): Promise<ClientFiscalEnrollment[]>;
+/** Tira o cliente da automação. Não apaga o histórico. */
+export declare function revokeClientFiscalEnrollment(tx: Tx, input: {
+    clientId: string;
+    documentType: FiscalDocumentType;
+    actorId: string;
+    reason?: string | null;
+}): Promise<ClientFiscalEnrollment[]>;
+/** As duas chaves numa leitura só, para a tela não fazer duas viagens. */
+export declare function readFiscalEnrollmentView(tx: Tx, clientId: string): Promise<FiscalEnrollmentView>;
+/** O ambiente declarado casa com o pedido? Chave-geral do portão. */
+export declare function automationCovers(automation: TenantFiscalAutomation, environment: FiscalEnvironment): boolean;
+//# sourceMappingURL=enrollment.d.ts.map

package/dist/fiscal/enrollment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enrollment.d.ts","sourceRoot":"","sources":["../../src/fiscal/enrollment.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC5B,MAAM,kBAAkB,CAAC;AAE1B;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;AAElE,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,kBAAkB,CAAC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,uEAAuE;IACvE,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,6DAA6D;AAC7D,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,sBAAsB,CAAC;IACnC,WAAW,EAAE,SAAS,sBAAsB,EAAE,CAAC;CAChD;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,EAAE,EACN,KAAK,EAAE;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC3E,OAAO,CAAC,sBAAsB,CAAC,CA4BjC;AAED,wBAAsB,2BAA2B,CAC/C,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAuBnC;AAED;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,EAAE,EACN,KAAK,EAAE;IACL,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,kBAAkB,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,GACA,OAAO,CAAC,sBAAsB,EAAE,CAAC,CA6BnC;AAED,0DAA0D;AAC1D,wBAAsB,4BAA4B,CAChD,EAAE,EAAE,EAAE,EACN,KAAK,EAAE;IACL,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,kBAAkB,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,GACA,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAuBnC;AAED,0EAA0E;AAC1E,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,oBAAoB,CAAC,CAK/B;AAED,qEAAqE;AACrE,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,sBAAsB,EAClC,WAAW,EAAE,iBAAiB,GAC7B,OAAO,CAET"}

package/dist/fiscal/enrollment.js

@@ -0,0 +1,126 @@
+import { uuidv7 } from '@baruk/shared';
+import { appendAudit } from '../audit/audit.js';
+import { getTenantFiscalAutomation, } from './eligibility.js';
+/**
+ * Declara em que ambiente o escritório opera automação fiscal.
+ *
+ * `production` é a fronteira entre ensaio e operação real: a partir dela, o
+ * material de um contribuinte pode ser apresentado a um servidor da Receita. Por
+ * isso o ato é auditado com o modo anterior e o novo — "passou a ser produção"
+ * não responde a pergunta que se faz meses depois.
+ */
+export async function setTenantFiscalAutomation(tx, input) {
+    const anterior = await getTenantFiscalAutomation(tx);
+    const ligando = input.mode !== 'disabled';
+    await tx `
+    INSERT INTO tenant_fiscal_automation (tenant_id, mode, enabled_at, enabled_by, note, updated_at)
+    VALUES (
+      current_setting('app.current_tenant')::uuid, ${input.mode},
+      ${ligando ? new Date() : null}, ${ligando ? input.actorId : null},
+      ${input.note ?? null}, now()
+    )
+    ON CONFLICT (tenant_id) DO UPDATE SET
+      mode = EXCLUDED.mode,
+      enabled_at = EXCLUDED.enabled_at,
+      enabled_by = EXCLUDED.enabled_by,
+      note = EXCLUDED.note,
+      updated_at = now()
+  `;
+    await appendAudit(tx, {
+        actorId: input.actorId,
+        action: 'fiscal_automation_mode_changed',
+        resourceType: 'tenant_fiscal_automation',
+        resourceId: null,
+        metadata: { from: anterior.mode, to: input.mode, note: input.note ?? null },
+    });
+    return getTenantFiscalAutomation(tx);
+}
+export async function listClientFiscalEnrollments(tx, clientId) {
+    const rows = await tx `
+    SELECT document_type, enrolled_at, enrolled_by, revoked_at, note
+      FROM client_fiscal_enrollment
+     WHERE client_id = ${clientId}
+     ORDER BY document_type, enrolled_at DESC
+  `;
+    return rows.map((r) => ({
+        documentType: r.document_type,
+        enrolledAt: r.enrolled_at.toISOString(),
+        enrolledBy: r.enrolled_by,
+        revokedAt: r.revoked_at?.toISOString() ?? null,
+        note: r.note,
+        active: r.revoked_at === null,
+    }));
+}
+/**
+ * Matricula um cliente para UM tipo de documento.
+ *
+ * A granularidade é o ponto: NFS-e e NF-e são conectores diferentes, com
+ * maturidades diferentes. Uma matrícula que valesse "para tudo" habilitaria o
+ * cliente num conector que talvez nem exista.
+ *
+ * Rematricular um cliente revogado o reativa — e o registro guarda as duas
+ * datas, porque quem revogou tinha um motivo e ele não deve sumir.
+ */
+export async function enrollClientFiscal(tx, input) {
+    await tx `
+    INSERT INTO client_fiscal_enrollment (
+      id, tenant_id, client_id, document_type, enrolled_at, enrolled_by, note
+    ) VALUES (
+      ${uuidv7()}, current_setting('app.current_tenant')::uuid, ${input.clientId},
+      ${input.documentType}, now(), ${input.actorId}, ${input.note ?? null}
+    )
+    -- O índice único é PARCIAL (WHERE revoked_at IS NULL), e o ON CONFLICT
+    -- precisa repetir o predicado: sem ele o Postgres não sabe qual índice usar
+    -- e a instrução falha.
+    --
+    -- E a consequência do índice ser parcial é desejável: rematricular um
+    -- cliente que foi revogado cria uma linha NOVA em vez de reescrever a
+    -- antiga. Quem revogou tinha um motivo, e ele fica no registro.
+    ON CONFLICT (tenant_id, client_id, document_type) WHERE revoked_at IS NULL
+    DO UPDATE SET
+      enrolled_at = now(), enrolled_by = ${input.actorId}, note = ${input.note ?? null}
+  `;
+    await appendAudit(tx, {
+        actorId: input.actorId,
+        action: 'fiscal_enrollment_created',
+        resourceType: 'client_fiscal_enrollment',
+        resourceId: null,
+        metadata: { clientId: input.clientId, documentType: input.documentType },
+    });
+    return listClientFiscalEnrollments(tx, input.clientId);
+}
+/** Tira o cliente da automação. Não apaga o histórico. */
+export async function revokeClientFiscalEnrollment(tx, input) {
+    await tx `
+    UPDATE client_fiscal_enrollment
+       SET revoked_at = now(), revoked_by = ${input.actorId},
+           note = COALESCE(${input.reason ?? null}, note)
+     WHERE client_id = ${input.clientId}
+       AND document_type = ${input.documentType}
+       AND revoked_at IS NULL
+  `;
+    await appendAudit(tx, {
+        actorId: input.actorId,
+        action: 'fiscal_enrollment_revoked',
+        resourceType: 'client_fiscal_enrollment',
+        resourceId: null,
+        metadata: {
+            clientId: input.clientId,
+            documentType: input.documentType,
+            reason: input.reason ?? null,
+        },
+    });
+    return listClientFiscalEnrollments(tx, input.clientId);
+}
+/** As duas chaves numa leitura só, para a tela não fazer duas viagens. */
+export async function readFiscalEnrollmentView(tx, clientId) {
+    return {
+        automation: await getTenantFiscalAutomation(tx),
+        enrollments: await listClientFiscalEnrollments(tx, clientId),
+    };
+}
+/** O ambiente declarado casa com o pedido? Chave-geral do portão. */
+export function automationCovers(automation, environment) {
+    return automation.mode !== 'disabled' && automation.mode === environment;
+}
+//# sourceMappingURL=enrollment.js.map

package/dist/fiscal/enrollment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enrollment.js","sourceRoot":"","sources":["../../src/fiscal/enrollment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EACL,yBAAyB,GAI1B,MAAM,kBAAkB,CAAC;AAqD1B;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,EAAM,EACN,KAA4E;IAE5E,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,EAAE,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC;IAE1C,MAAM,EAAE,CAAA;;;qDAG2C,KAAK,CAAC,IAAI;QACvD,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;QAC9D,KAAK,CAAC,IAAI,IAAI,IAAI;;;;;;;;GAQvB,CAAC;IAEF,MAAM,WAAW,CAAC,EAAE,EAAE;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,gCAAgC;QACxC,YAAY,EAAE,0BAA0B;QACxC,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI,EAAE;KAC5E,CAAC,CAAC;IAEH,OAAO,yBAAyB,CAAC,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,EAAM,EACN,QAAgB;IAEhB,MAAM,IAAI,GAAG,MAAM,EAAE,CAQpB;;;yBAGsB,QAAQ;;GAE9B,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtB,YAAY,EAAE,CAAC,CAAC,aAAmC;QACnD,UAAU,EAAE,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE;QACvC,UAAU,EAAE,CAAC,CAAC,WAAW;QACzB,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,IAAI;QAC9C,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,UAAU,KAAK,IAAI;KAC9B,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAM,EACN,KAKC;IAED,MAAM,EAAE,CAAA;;;;QAIF,MAAM,EAAE,kDAAkD,KAAK,CAAC,QAAQ;QACxE,KAAK,CAAC,YAAY,YAAY,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,IAAI,IAAI,IAAI;;;;;;;;;;;2CAW/B,KAAK,CAAC,OAAO,YAAY,KAAK,CAAC,IAAI,IAAI,IAAI;GACnF,CAAC;IAEF,MAAM,WAAW,CAAC,EAAE,EAAE;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,2BAA2B;QACnC,YAAY,EAAE,0BAA0B;QACxC,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE;KACzE,CAAC,CAAC;IAEH,OAAO,2BAA2B,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;AACzD,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,EAAM,EACN,KAKC;IAED,MAAM,EAAE,CAAA;;8CAEoC,KAAK,CAAC,OAAO;6BAC9B,KAAK,CAAC,MAAM,IAAI,IAAI;yBACxB,KAAK,CAAC,QAAQ;6BACV,KAAK,CAAC,YAAY;;GAE5C,CAAC;IAEF,MAAM,WAAW,CAAC,EAAE,EAAE;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,2BAA2B;QACnC,YAAY,EAAE,0BAA0B;QACxC,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE;YACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;SAC7B;KACF,CAAC,CAAC;IAEH,OAAO,2BAA2B,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;AACzD,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,EAAM,EACN,QAAgB;IAEhB,OAAO;QACL,UAAU,EAAE,MAAM,yBAAyB,CAAC,EAAE,CAAC;QAC/C,WAAW,EAAE,MAAM,2BAA2B,CAAC,EAAE,EAAE,QAAQ,CAAC;KAC7D,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,gBAAgB,CAC9B,UAAkC,EAClC,WAA8B;IAE9B,OAAO,UAAU,CAAC,IAAI,KAAK,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,WAAW,CAAC;AAC3E,CAAC"}