@fayz-ai/plugin-fiscal-br 0.2.0

package/dist/index.js

@@ -0,0 +1,1136 @@
+import { connectionSettings, connectionStatus, definePlugin, createConnectionStore, settingsStatus } from '@fayz-ai/core';
+
+// src/index.ts
+var PLUGNOTAS_CONNECTOR_ID = "plugnotas";
+var PLUGNOTAS_MARK = "data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='32' height='32' viewBox='0 0 32 32'%3E%3Crect width='32' height='32' rx='8' fill='%230F766E'/%3E%3Cpath d='M10 7h12v18l-2-1.5-2 1.5-2-1.5-2 1.5-2-1.5-2 1.5V7Z' fill='white'/%3E%3Cpath d='M13 12h6M13 16h6M13 20h4' stroke='%230F766E' stroke-width='1.8' stroke-linecap='round'/%3E%3C/svg%3E";
+var PLUGNOTAS_FIELDS = [
+  {
+    key: "emitterCnpj",
+    label: "CNPJ do emitente",
+    type: "text",
+    placeholder: "00.000.000/0000-00"
+  }
+];
+var PLUGNOTAS_SETTINGS = [{
+  key: "environment",
+  label: "Ambiente fiscal",
+  description: "Sandbox simula o emissor. Homologa\xE7\xE3o envia para a SEFAZ sem valor fiscal.",
+  type: "select",
+  options: [
+    { value: "sandbox", label: "Sandbox simulado" },
+    { value: "homologation", label: "Homologa\xE7\xE3o SEFAZ" }
+  ],
+  requiredToOperate: true,
+  defaultValue: "sandbox"
+}];
+var INTERNAL_SETTINGS = [
+  "certificateReady",
+  "cscReady",
+  "providerEmitterId",
+  "certificateExpiresAt",
+  "certificateFingerprint",
+  // Non-secret operational data written by the host's server-side setup flow.
+  // Declaring these keys keeps the shared connection store authoritative while
+  // credentials (API key, A1 bytes/password, CSC) remain outside public JSON.
+  "stateRegistration",
+  "corporateName",
+  "tradeName",
+  "email",
+  "taxRegime",
+  "address",
+  "series",
+  "paymentMethod"
+];
+var DAY_MS = 24 * 60 * 60 * 1e3;
+function digits(value) {
+  return value.replace(/\D/g, "");
+}
+function isValidCnpj(value) {
+  const normalized = digits(value);
+  if (!/^\d{14}$/.test(normalized) || /^(\d)\1{13}$/.test(normalized)) return false;
+  const digit = (base, weights) => {
+    const sum = weights.reduce((total, weight, index) => total + Number(base[index]) * weight, 0);
+    const remainder = sum % 11;
+    return remainder < 2 ? 0 : 11 - remainder;
+  };
+  const first = digit(normalized.slice(0, 12), [5, 4, 3, 2, 9, 8, 7, 6, 5, 4, 3, 2]);
+  const second = digit(`${normalized.slice(0, 12)}${first}`, [6, 5, 4, 3, 2, 9, 8, 7, 6, 5, 4, 3, 2]);
+  return normalized.endsWith(`${first}${second}`);
+}
+function environment(value) {
+  if (value === void 0 || value === null || value === "" || value === "sandbox") return "sandbox";
+  if (value === "homologation") return value;
+  throw new Error("Produ\xE7\xE3o n\xE3o est\xE1 dispon\xEDvel neste conector preview.");
+}
+function store() {
+  return createConnectionStore(PLUGNOTAS_CONNECTOR_ID, {
+    fields: [...PLUGNOTAS_FIELDS],
+    settings: [...PLUGNOTAS_SETTINGS],
+    settingsKeys: INTERNAL_SETTINGS
+  });
+}
+function deriveStatus(connection) {
+  if (!connection?.active) return { connected: false };
+  const readiness = settingsStatus([...PLUGNOTAS_SETTINGS], connection);
+  const certificateReady = connection.settings.certificateReady === true;
+  const cscReady = connection.settings.cscReady === true;
+  const expiry = typeof connection.settings.certificateExpiresAt === "string" ? Date.parse(connection.settings.certificateExpiresAt) : Number.NaN;
+  const daysUntilExpiry = Number.isFinite(expiry) ? Math.ceil((expiry - Date.now()) / DAY_MS) : null;
+  const expired = daysUntilExpiry !== null && daysUntilExpiry <= 0;
+  const expiringSoon = daysUntilExpiry !== null && daysUntilExpiry > 0 && daysUntilExpiry <= 30;
+  const missingSettings = [.../* @__PURE__ */ new Set([
+    ...readiness.missingSettings ?? [],
+    ...!certificateReady || expired ? ["certificate"] : [],
+    ...!cscReady ? ["csc"] : []
+  ])];
+  return {
+    connected: true,
+    needsSetup: missingSettings.length > 0,
+    ...missingSettings.length ? { missingSettings } : {},
+    detail: expired ? "Certificado A1 vencido" : !certificateReady ? "Envie o certificado A1 do emitente." : !cscReady ? "Confirme o CSC e o ID Token do emitente." : connection.settings.environment === "homologation" ? "Emitente pronto em homologa\xE7\xE3o" : "Emitente pronto no sandbox",
+    ...expiringSoon ? { issues: [`O certificado A1 vence em ${daysUntilExpiry} dia${daysUntilExpiry === 1 ? "" : "s"}.`] } : {},
+    plane: "sync"
+  };
+}
+function createPlugNotasConnector(options = {}) {
+  const connectionStore = store();
+  return {
+    id: PLUGNOTAS_CONNECTOR_ID,
+    // PlugBank and PlugNotas are different products from the same vendor. The
+    // directory key names the product, otherwise one silently replaces the
+    // other in the generated connector map.
+    catalogSlug: "plugnotas",
+    hostPluginId: "financial",
+    name: "PlugNotas \xB7 NFC-e",
+    description: "Emita NFC-e pela TecnoSpeed sem expor certificado, senha ou API key no navegador.",
+    icon: "ReceiptText",
+    logoUrl: PLUGNOTAS_MARK,
+    authKind: "api-key",
+    category: "erp",
+    direction: "outbound",
+    planes: ["sync"],
+    docsUrl: "https://docs.plugnotas.com.br/",
+    fields: [...PLUGNOTAS_FIELDS],
+    settings: [...PLUGNOTAS_SETTINGS],
+    permissions: [{
+      kind: "data",
+      resource: "fiscal-document",
+      actions: ["read", "write"],
+      reason: "Enviar a NFC-e e reconciliar situa\xE7\xE3o, chave de acesso e artefatos no Financeiro.",
+      sensitive: true
+    }],
+    invokedAt: [{
+      key: "financial.nfce.issue",
+      label: "Quando um operador confirma a emiss\xE3o da NFC-e de um pedido conclu\xEDdo",
+      plane: "sync",
+      trigger: "manual",
+      touches: ["fiscal-document"]
+    }],
+    howItSyncs: [
+      "A emiss\xE3o cria primeiro um comando dur\xE1vel e s\xF3 depois chama o provedor.",
+      "Webhook e recupera\xE7\xE3o consultiva convergem o mesmo comando, sem reenviar no escuro."
+    ],
+    ...connectionStatus(PLUGNOTAS_CONNECTOR_ID, deriveStatus, { store }),
+    ...connectionSettings(connectionStore),
+    async testConnection(values) {
+      const emitterCnpj = digits(values.emitterCnpj ?? "");
+      if (!isValidCnpj(emitterCnpj)) return { ok: false, message: "Informe um CNPJ v\xE1lido." };
+      let selected;
+      try {
+        selected = environment(values.environment);
+      } catch (error) {
+        return { ok: false, message: error instanceof Error ? error.message : "Ambiente inv\xE1lido." };
+      }
+      return options.client?.testEmitter ? options.client.testEmitter({ emitterCnpj, environment: selected }) : { ok: true };
+    },
+    async saveConnection(values) {
+      const emitterCnpj = digits(values.emitterCnpj ?? "");
+      if (!isValidCnpj(emitterCnpj)) throw new Error("Informe um CNPJ v\xE1lido.");
+      await connectionStore.save({
+        active: true,
+        displayName: `Emitente ${emitterCnpj.slice(-6)}`,
+        providerAccountKey: emitterCnpj,
+        settings: {
+          emitterCnpj,
+          environment: environment(values.environment),
+          certificateReady: false,
+          cscReady: false
+        }
+      });
+    },
+    ...options.client?.disconnectEmitter ? { disconnect: () => options.client.disconnectEmitter() } : {},
+    disconnectNote: "As notas existentes permanecem no Financeiro; somente novas emiss\xF5es s\xE3o interrompidas.",
+    ExtraPanel: options.SetupPanel
+  };
+}
+async function markPlugNotasEmitterReady(input) {
+  const emitterCnpj = digits(input.emitterCnpj);
+  if (!isValidCnpj(emitterCnpj)) throw new Error("Informe um CNPJ v\xE1lido.");
+  await store().save({
+    active: true,
+    providerAccountKey: emitterCnpj,
+    settings: {
+      emitterCnpj,
+      environment: environment(input.environment),
+      certificateReady: input.certificateReady,
+      cscReady: input.cscReady,
+      providerEmitterId: input.providerEmitterId,
+      certificateExpiresAt: input.certificateExpiresAt,
+      certificateFingerprint: input.certificateFingerprint
+    }
+  });
+}
+
+// src/migrations/index.ts
+var MIGRATION_000_BASELINE = `-- Fiscal Brasil / PlugNotas baseline.
+--
+-- This addon does not create a second fiscal ledger. \`plg_financial_nfe\`
+-- remains the authoritative document owned by plugin-financial. The tables
+-- below describe delivery to an external issuer: durable commands, attempts,
+-- webhooks and emitter ownership.
+--
+-- The file is additive and idempotent because the current restaurant pool is
+-- live. Applying it is deliberately outside this draft PR.
+
+CREATE TABLE IF NOT EXISTS public.plg_fiscalbr_nfce_jobs (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  -- Logical reference to plugin-financial's fiscal ledger. Cross-plugin
+  -- physical foreign keys are intentionally forbidden: installation and
+  -- removal of this addon must never rewrite another plugin's schema.
+  nota_id uuid NOT NULL,
+  order_id uuid NOT NULL REFERENCES public.orders(id) ON DELETE RESTRICT,
+  connection_id uuid NOT NULL REFERENCES public.connections(id) ON DELETE RESTRICT,
+  operation text NOT NULL CHECK (operation IN ('issue', 'cancel')),
+  status text NOT NULL DEFAULT 'queued'
+    CHECK (status IN ('queued', 'running', 'waiting', 'succeeded', 'failed', 'manual_review')),
+  idempotency_key text NOT NULL,
+  provider_document_id text,
+  integration_id text,
+  request_snapshot jsonb NOT NULL DEFAULT '{}'::jsonb,
+  provider_response jsonb NOT NULL DEFAULT '{}'::jsonb,
+  attempts integer NOT NULL DEFAULT 0 CHECK (attempts >= 0),
+  next_attempt_at timestamptz,
+  locked_until timestamptz,
+  last_error text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE (tenant_id, idempotency_key)
+);
+
+CREATE INDEX IF NOT EXISTS plg_fiscalbr_nfce_jobs_recovery_idx
+  ON public.plg_fiscalbr_nfce_jobs (status, next_attempt_at, locked_until)
+  WHERE status IN ('queued', 'waiting');
+
+CREATE TABLE IF NOT EXISTS public.plg_fiscalbr_nfce_events (
+  id bigint GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  nota_id uuid NOT NULL,
+  job_id uuid REFERENCES public.plg_fiscalbr_nfce_jobs(id) ON DELETE SET NULL,
+  event_type text NOT NULL,
+  payload jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS plg_fiscalbr_nfce_events_document_idx
+  ON public.plg_fiscalbr_nfce_events (tenant_id, nota_id, created_at DESC);
+
+CREATE TABLE IF NOT EXISTS public.plg_fiscalbr_webhook_receipts (
+  id bigint GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+  provider text NOT NULL DEFAULT 'plugnotas',
+  provider_event_id text NOT NULL,
+  tenant_id uuid REFERENCES public.tenants(id) ON DELETE SET NULL,
+  nota_id uuid,
+  payload_sha256 text NOT NULL,
+  received_at timestamptz NOT NULL DEFAULT now(),
+  processed_at timestamptz,
+  processing_error text,
+  UNIQUE (provider, provider_event_id)
+);
+
+CREATE TABLE IF NOT EXISTS public.plg_fiscalbr_emitter_ownership (
+  emitter_cnpj text PRIMARY KEY CHECK (emitter_cnpj ~ '^[0-9]{14}$'),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  connection_id uuid NOT NULL REFERENCES public.connections(id) ON DELETE CASCADE,
+  environment text NOT NULL CHECK (environment IN ('sandbox', 'homologation')),
+  provider_emitter_id text,
+  certificate_expires_at timestamptz,
+  certificate_fingerprint text,
+  csc_ready boolean NOT NULL DEFAULT false,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE (tenant_id, connection_id)
+);
+
+ALTER TABLE public.plg_fiscalbr_nfce_jobs ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.plg_fiscalbr_nfce_events ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.plg_fiscalbr_webhook_receipts ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.plg_fiscalbr_emitter_ownership ENABLE ROW LEVEL SECURITY;
+
+DROP POLICY IF EXISTS plg_fiscalbr_nfce_jobs_read ON public.plg_fiscalbr_nfce_jobs;
+CREATE POLICY plg_fiscalbr_nfce_jobs_read ON public.plg_fiscalbr_nfce_jobs
+  FOR SELECT TO authenticated
+  USING (
+    tenant_id = (SELECT app.current_tenant_id())
+    AND (SELECT app.has_permission('financial.read', NULL))
+  );
+
+DROP POLICY IF EXISTS plg_fiscalbr_nfce_events_read ON public.plg_fiscalbr_nfce_events;
+CREATE POLICY plg_fiscalbr_nfce_events_read ON public.plg_fiscalbr_nfce_events
+  FOR SELECT TO authenticated
+  USING (
+    tenant_id = (SELECT app.current_tenant_id())
+    AND (SELECT app.has_permission('financial.read', NULL))
+  );
+
+DROP POLICY IF EXISTS plg_fiscalbr_emitter_ownership_read ON public.plg_fiscalbr_emitter_ownership;
+CREATE POLICY plg_fiscalbr_emitter_ownership_read ON public.plg_fiscalbr_emitter_ownership
+  FOR SELECT TO authenticated
+  USING (
+    tenant_id = (SELECT app.current_tenant_id())
+    AND (SELECT app.has_permission('financial.read', NULL))
+  );
+
+REVOKE ALL ON public.plg_fiscalbr_nfce_jobs FROM anon, authenticated;
+REVOKE ALL ON public.plg_fiscalbr_nfce_events FROM anon, authenticated;
+REVOKE ALL ON public.plg_fiscalbr_webhook_receipts FROM anon, authenticated;
+REVOKE ALL ON public.plg_fiscalbr_emitter_ownership FROM anon, authenticated;
+GRANT SELECT ON public.plg_fiscalbr_nfce_jobs TO authenticated;
+GRANT SELECT ON public.plg_fiscalbr_nfce_events TO authenticated;
+GRANT SELECT ON public.plg_fiscalbr_emitter_ownership TO authenticated;
+GRANT ALL ON public.plg_fiscalbr_nfce_jobs TO service_role;
+GRANT ALL ON public.plg_fiscalbr_nfce_events TO service_role;
+GRANT ALL ON public.plg_fiscalbr_webhook_receipts TO service_role;
+GRANT ALL ON public.plg_fiscalbr_emitter_ownership TO service_role;
+
+CREATE OR REPLACE FUNCTION public.plugnotas_register_emitter(
+  p_tenant_id uuid,
+  p_connection_id uuid,
+  p_emitter_cnpj text,
+  p_environment text,
+  p_provider_emitter_id text DEFAULT NULL,
+  p_certificate_expires_at timestamptz DEFAULT NULL,
+  p_certificate_fingerprint text DEFAULT NULL,
+  p_csc_ready boolean DEFAULT false
+) RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$
+DECLARE
+  v_cnpj text := regexp_replace(coalesce(p_emitter_cnpj, ''), '[^0-9]', '', 'g');
+BEGIN
+  IF v_cnpj !~ '^[0-9]{14}$' THEN
+    RAISE EXCEPTION 'plugnotas_register_emitter: invalid CNPJ' USING ERRCODE = '22023';
+  END IF;
+  IF p_environment NOT IN ('sandbox', 'homologation') THEN
+    RAISE EXCEPTION 'plugnotas_register_emitter: production is not enabled' USING ERRCODE = '22023';
+  END IF;
+  IF NOT EXISTS (
+    SELECT 1 FROM public.connections c
+     WHERE c.id = p_connection_id
+       AND c.tenant_id = p_tenant_id
+       AND c.connector_id = 'plugnotas'
+       AND c.active
+  ) THEN
+    RAISE EXCEPTION 'plugnotas_register_emitter: active connection not found' USING ERRCODE = 'P0002';
+  END IF;
+
+  INSERT INTO public.plg_fiscalbr_emitter_ownership
+    (emitter_cnpj, tenant_id, connection_id, environment, provider_emitter_id,
+     certificate_expires_at, certificate_fingerprint, csc_ready, updated_at)
+  VALUES
+    (v_cnpj, p_tenant_id, p_connection_id, p_environment, p_provider_emitter_id,
+     p_certificate_expires_at, p_certificate_fingerprint, p_csc_ready, now())
+  ON CONFLICT (emitter_cnpj) DO UPDATE SET
+    tenant_id = EXCLUDED.tenant_id,
+    connection_id = EXCLUDED.connection_id,
+    environment = EXCLUDED.environment,
+    provider_emitter_id = EXCLUDED.provider_emitter_id,
+    certificate_expires_at = EXCLUDED.certificate_expires_at,
+    certificate_fingerprint = EXCLUDED.certificate_fingerprint,
+    csc_ready = EXCLUDED.csc_ready,
+    updated_at = now()
+  WHERE public.plg_fiscalbr_emitter_ownership.tenant_id = EXCLUDED.tenant_id;
+
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'plugnotas_register_emitter: CNPJ belongs to another tenant' USING ERRCODE = '23505';
+  END IF;
+
+  UPDATE public.connections
+     SET provider_account_key = v_cnpj,
+         settings = settings || jsonb_build_object(
+           'environment', p_environment,
+           'certificateReady', p_certificate_expires_at IS NOT NULL,
+           'certificateExpiresAt', p_certificate_expires_at,
+           'certificateFingerprint', p_certificate_fingerprint,
+           'providerEmitterId', p_provider_emitter_id,
+           'cscReady', p_csc_ready
+         ),
+         status = CASE WHEN p_certificate_expires_at IS NOT NULL AND p_csc_ready THEN 'connected' ELSE 'pending' END,
+         updated_at = now()
+   WHERE id = p_connection_id AND tenant_id = p_tenant_id;
+
+  RETURN jsonb_build_object('emitterCnpj', v_cnpj, 'environment', p_environment);
+END $$;
+
+CREATE OR REPLACE FUNCTION public.plugnotas_disconnect_emitter(
+  p_tenant_id uuid,
+  p_connection_id uuid
+) RETURNS void
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$
+BEGIN
+  DELETE FROM public.plg_fiscalbr_emitter_ownership
+   WHERE tenant_id = p_tenant_id AND connection_id = p_connection_id;
+  UPDATE public.connections
+     SET active = false, status = 'revoked', settings = '{}'::jsonb,
+         provider_state = '{}'::jsonb, updated_at = now()
+   WHERE tenant_id = p_tenant_id AND id = p_connection_id AND connector_id = 'plugnotas';
+END $$;
+
+CREATE OR REPLACE FUNCTION public.plugnotas_create_nfce_draft_for_order(
+  p_tenant_id uuid,
+  p_order_id uuid
+) RETURNS uuid
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$
+DECLARE
+  v_order public.orders%ROWTYPE;
+  v_nota_id uuid;
+BEGIN
+  -- Serialize draft creation per tenant/order without adding a column or
+  -- index to the financial plugin's table. The order itself remains the
+  -- stable idempotency boundary for one NFC-e draft.
+  PERFORM pg_advisory_xact_lock(hashtextextended(p_tenant_id::text || ':' || p_order_id::text, 0));
+
+  SELECT * INTO v_order FROM public.orders
+   WHERE tenant_id = p_tenant_id AND id = p_order_id;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'plugnotas_create_nfce_draft_for_order: order not found' USING ERRCODE = 'P0002';
+  END IF;
+  IF v_order.status NOT IN ('completed', 'paid', 'invoiced') THEN
+    RAISE EXCEPTION 'plugnotas_create_nfce_draft_for_order: order is not closed' USING ERRCODE = '23514';
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM public.items i WHERE i.tenant_id = p_tenant_id AND i.order_id = p_order_id) THEN
+    RAISE EXCEPTION 'plugnotas_create_nfce_draft_for_order: order has no items' USING ERRCODE = '23514';
+  END IF;
+
+  SELECT n.id INTO v_nota_id FROM public.plg_financial_nfe n
+   WHERE n.tenant_id = p_tenant_id AND n.order_id = p_order_id AND n.model = 'nfce'
+   ORDER BY n.created_at DESC LIMIT 1;
+  IF v_nota_id IS NOT NULL THEN RETURN v_nota_id; END IF;
+
+  INSERT INTO public.plg_financial_nfe
+    (tenant_id, unit_id, model, status, order_id, contact_id, total_amount,
+     emissor, metadata)
+  VALUES
+    (p_tenant_id, v_order.unit_id, 'nfce', 'draft', p_order_id, v_order.party_id,
+     coalesce(v_order.total, 0), 'plugnotas',
+     jsonb_build_object('source', 'order', 'orderKind', v_order.kind, 'orderChannel', v_order.channel))
+  RETURNING id INTO v_nota_id;
+  RETURN v_nota_id;
+END $$;
+
+CREATE OR REPLACE FUNCTION public.plugnotas_prepare_nfce(
+  p_tenant_id uuid,
+  p_nota_id uuid,
+  p_connection_id uuid,
+  p_idempotency_key text
+) RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$
+DECLARE
+  v_nota public.plg_financial_nfe%ROWTYPE;
+  v_job public.plg_fiscalbr_nfce_jobs%ROWTYPE;
+  v_snapshot jsonb;
+BEGIN
+  SELECT * INTO v_nota FROM public.plg_financial_nfe
+   WHERE tenant_id = p_tenant_id AND id = p_nota_id FOR UPDATE;
+  IF NOT FOUND OR v_nota.model <> 'nfce' OR v_nota.order_id IS NULL THEN
+    RAISE EXCEPTION 'plugnotas_prepare_nfce: order-backed NFC-e not found' USING ERRCODE = 'P0002';
+  END IF;
+  IF v_nota.status NOT IN ('draft', 'error', 'processing') THEN
+    RAISE EXCEPTION 'plugnotas_prepare_nfce: invalid document status %', v_nota.status USING ERRCODE = '23514';
+  END IF;
+  IF NOT EXISTS (
+    SELECT 1 FROM public.plg_fiscalbr_emitter_ownership e
+     WHERE e.tenant_id = p_tenant_id AND e.connection_id = p_connection_id
+       AND e.csc_ready AND e.certificate_expires_at > now()
+  ) THEN
+    RAISE EXCEPTION 'plugnotas_prepare_nfce: emitter is not ready' USING ERRCODE = '23514';
+  END IF;
+
+  SELECT jsonb_build_object(
+    'nota', to_jsonb(v_nota),
+    'order', to_jsonb(o),
+    'items', coalesce((
+      SELECT jsonb_agg(to_jsonb(i) ORDER BY i.sort_order, i.id)
+        FROM public.items i
+       WHERE i.tenant_id = p_tenant_id AND i.order_id = v_nota.order_id
+    ), '[]'::jsonb),
+    -- Product tax metadata must be frozen in the same transaction as the order
+    -- lines. Looking products up in the Edge Function would let a retry emit
+    -- with NCM/CFOP changed after the operator confirmed the document.
+    'products', coalesce((
+      SELECT jsonb_agg(to_jsonb(p) ORDER BY p.id)
+        FROM public.products p
+       WHERE p.tenant_id = p_tenant_id
+         AND p.id IN (
+           SELECT i.product_id FROM public.items i
+            WHERE i.tenant_id = p_tenant_id
+              AND i.order_id = v_nota.order_id
+              AND i.product_id IS NOT NULL
+         )
+    ), '[]'::jsonb)
+  ) INTO v_snapshot
+  FROM public.orders o
+  WHERE o.tenant_id = p_tenant_id AND o.id = v_nota.order_id;
+
+  IF jsonb_array_length(v_snapshot->'items') = 0 THEN
+    RAISE EXCEPTION 'plugnotas_prepare_nfce: order has no items' USING ERRCODE = '23514';
+  END IF;
+
+  INSERT INTO public.plg_fiscalbr_nfce_jobs
+    (tenant_id, nota_id, order_id, connection_id, operation, status,
+     idempotency_key, request_snapshot, next_attempt_at, updated_at)
+  VALUES
+    (p_tenant_id, p_nota_id, v_nota.order_id, p_connection_id, 'issue', 'queued',
+     p_idempotency_key, v_snapshot, now(), now())
+  ON CONFLICT (tenant_id, idempotency_key) DO UPDATE
+    SET updated_at = now()
+  RETURNING * INTO v_job;
+
+  UPDATE public.plg_financial_nfe
+     SET status = 'processing', error_message = NULL,
+         metadata = metadata || jsonb_build_object('plugnotas', jsonb_build_object(
+           'jobId', v_job.id, 'jobStatus', v_job.status, 'operation', 'issue'
+         )), updated_at = now()
+   WHERE id = p_nota_id AND tenant_id = p_tenant_id;
+
+  INSERT INTO public.plg_fiscalbr_nfce_events (tenant_id, nota_id, job_id, event_type, payload)
+  VALUES (p_tenant_id, p_nota_id, v_job.id, 'issue.queued', '{}'::jsonb);
+  RETURN jsonb_build_object('jobId', v_job.id, 'snapshot', v_job.request_snapshot, 'replayed', v_job.attempts > 0);
+END $$;
+
+CREATE OR REPLACE FUNCTION public.plugnotas_prepare_nfce_cancel(
+  p_tenant_id uuid,
+  p_nota_id uuid,
+  p_connection_id uuid,
+  p_reason text
+) RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$
+DECLARE
+  v_nota public.plg_financial_nfe%ROWTYPE;
+  v_job_id uuid;
+  v_reason text := btrim(coalesce(p_reason, ''));
+BEGIN
+  IF char_length(v_reason) NOT BETWEEN 15 AND 255 THEN
+    RAISE EXCEPTION 'plugnotas_prepare_nfce_cancel: reason must contain 15 to 255 characters' USING ERRCODE = '22023';
+  END IF;
+  SELECT * INTO v_nota FROM public.plg_financial_nfe
+   WHERE tenant_id = p_tenant_id AND id = p_nota_id FOR UPDATE;
+  IF NOT FOUND OR v_nota.status <> 'issued' OR v_nota.access_key IS NULL THEN
+    RAISE EXCEPTION 'plugnotas_prepare_nfce_cancel: authorized NFC-e not found' USING ERRCODE = '23514';
+  END IF;
+
+  INSERT INTO public.plg_fiscalbr_nfce_jobs
+    (tenant_id, nota_id, order_id, connection_id, operation, status,
+     idempotency_key, provider_document_id, integration_id,
+     request_snapshot, next_attempt_at)
+  VALUES
+    (p_tenant_id, p_nota_id, v_nota.order_id, p_connection_id, 'cancel', 'queued',
+     'nfce-cancel:' || p_nota_id::text,
+     v_nota.metadata #>> '{plugnotas,providerDocumentId}',
+     v_nota.metadata #>> '{plugnotas,integrationId}',
+     jsonb_build_object('reason', v_reason), now())
+  ON CONFLICT (tenant_id, idempotency_key) DO UPDATE SET
+    provider_document_id = coalesce(
+      public.plg_fiscalbr_nfce_jobs.provider_document_id,
+      EXCLUDED.provider_document_id
+    ),
+    integration_id = coalesce(
+      public.plg_fiscalbr_nfce_jobs.integration_id,
+      EXCLUDED.integration_id
+    ),
+    updated_at = now()
+  RETURNING id INTO v_job_id;
+
+  UPDATE public.plg_financial_nfe
+     SET metadata = metadata || jsonb_build_object('plugnotas', jsonb_build_object(
+       'jobId', v_job_id, 'jobStatus', 'queued', 'operation', 'cancel', 'cancellationPending', true
+     )), updated_at = now()
+   WHERE id = p_nota_id AND tenant_id = p_tenant_id;
+  RETURN jsonb_build_object('jobId', v_job_id, 'reason', v_reason);
+END $$;
+
+CREATE OR REPLACE FUNCTION public.plugnotas_record_nfce_attempt(
+  p_tenant_id uuid,
+  p_job_id uuid,
+  p_status text,
+  p_provider_response jsonb DEFAULT '{}'::jsonb,
+  p_error text DEFAULT NULL,
+  p_next_attempt_at timestamptz DEFAULT NULL
+) RETURNS void
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$
+BEGIN
+  IF p_status NOT IN ('running', 'waiting', 'failed', 'manual_review') THEN
+    RAISE EXCEPTION 'plugnotas_record_nfce_attempt: invalid status' USING ERRCODE = '22023';
+  END IF;
+  UPDATE public.plg_fiscalbr_nfce_jobs
+     SET status = p_status,
+         -- One provider dispatch is one attempt. Moving that same attempt from
+         -- running to waiting/failed must not count it a second time.
+         attempts = attempts + CASE WHEN p_status = 'running' THEN 1 ELSE 0 END,
+         provider_response = coalesce(p_provider_response, '{}'::jsonb),
+         last_error = p_error, next_attempt_at = p_next_attempt_at,
+         locked_until = NULL, updated_at = now()
+   WHERE tenant_id = p_tenant_id AND id = p_job_id;
+END $$;
+
+CREATE OR REPLACE FUNCTION public.plugnotas_apply_nfce_result(
+  p_tenant_id uuid,
+  p_job_id uuid,
+  p_status text,
+  p_provider_document_id text DEFAULT NULL,
+  p_integration_id text DEFAULT NULL,
+  p_number text DEFAULT NULL,
+  p_series text DEFAULT NULL,
+  p_access_key text DEFAULT NULL,
+  p_message text DEFAULT NULL,
+  p_provider_response jsonb DEFAULT '{}'::jsonb
+) RETURNS uuid
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$
+DECLARE
+  v_job public.plg_fiscalbr_nfce_jobs%ROWTYPE;
+  v_document_status text;
+BEGIN
+  SELECT * INTO v_job FROM public.plg_fiscalbr_nfce_jobs
+   WHERE tenant_id = p_tenant_id AND id = p_job_id FOR UPDATE;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'plugnotas_apply_nfce_result: job not found' USING ERRCODE = 'P0002';
+  END IF;
+  IF p_status NOT IN ('processing', 'issued', 'cancelled', 'error') THEN
+    RAISE EXCEPTION 'plugnotas_apply_nfce_result: invalid status' USING ERRCODE = '22023';
+  END IF;
+
+  v_document_status := CASE
+    WHEN v_job.operation = 'cancel' AND p_status = 'processing' THEN 'issued'
+    ELSE p_status
+  END;
+  UPDATE public.plg_fiscalbr_nfce_jobs
+     SET status = CASE
+           WHEN p_status IN ('issued', 'cancelled') THEN 'succeeded'
+           WHEN p_status = 'error' THEN 'failed'
+           ELSE 'waiting'
+         END,
+         provider_document_id = coalesce(p_provider_document_id, provider_document_id),
+         integration_id = coalesce(p_integration_id, integration_id),
+         provider_response = coalesce(p_provider_response, '{}'::jsonb),
+         last_error = CASE WHEN p_status = 'error' THEN p_message ELSE NULL END,
+         next_attempt_at = CASE WHEN p_status = 'processing' THEN now() + interval '2 minutes' ELSE NULL END,
+         locked_until = NULL, updated_at = now()
+   WHERE id = p_job_id;
+
+  UPDATE public.plg_financial_nfe
+     SET status = v_document_status,
+         number = coalesce(p_number, number),
+         series = coalesce(p_series, series),
+         access_key = coalesce(p_access_key, access_key),
+         issued_at = CASE WHEN p_status = 'issued' THEN coalesce(issued_at, now()) ELSE issued_at END,
+         error_message = CASE WHEN p_status = 'error' THEN p_message ELSE NULL END,
+         metadata = metadata || jsonb_build_object('plugnotas', jsonb_strip_nulls(jsonb_build_object(
+           'jobId', p_job_id,
+           'jobStatus', CASE WHEN p_status IN ('issued', 'cancelled') THEN 'succeeded' WHEN p_status = 'error' THEN 'failed' ELSE 'waiting' END,
+           'operation', v_job.operation,
+           'providerDocumentId', coalesce(p_provider_document_id, v_job.provider_document_id),
+           'integrationId', coalesce(p_integration_id, v_job.integration_id),
+           'cancellationPending', v_job.operation = 'cancel' AND p_status = 'processing'
+         ))),
+         updated_at = now()
+   WHERE tenant_id = p_tenant_id AND id = v_job.nota_id;
+
+  INSERT INTO public.plg_fiscalbr_nfce_events (tenant_id, nota_id, job_id, event_type, payload)
+  VALUES (p_tenant_id, v_job.nota_id, p_job_id, v_job.operation || '.' || p_status,
+          coalesce(p_provider_response, '{}'::jsonb));
+  RETURN v_job.nota_id;
+END $$;
+
+CREATE OR REPLACE FUNCTION public.plugnotas_apply_nfce_webhook(
+  p_provider_event_id text,
+  p_payload_sha256 text,
+  p_provider_document_id text,
+  p_status text,
+  p_integration_id text DEFAULT NULL,
+  p_number text DEFAULT NULL,
+  p_series text DEFAULT NULL,
+  p_access_key text DEFAULT NULL,
+  p_message text DEFAULT NULL,
+  p_payload jsonb DEFAULT '{}'::jsonb
+) RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$
+DECLARE
+  v_job public.plg_fiscalbr_nfce_jobs%ROWTYPE;
+  v_receipt_id bigint;
+BEGIN
+  INSERT INTO public.plg_fiscalbr_webhook_receipts
+    (provider_event_id, payload_sha256)
+  VALUES (p_provider_event_id, p_payload_sha256)
+  ON CONFLICT (provider, provider_event_id) DO NOTHING
+  RETURNING id INTO v_receipt_id;
+  IF v_receipt_id IS NULL THEN RETURN jsonb_build_object('duplicate', true); END IF;
+
+  SELECT * INTO v_job FROM public.plg_fiscalbr_nfce_jobs
+   WHERE provider_document_id = p_provider_document_id
+   ORDER BY created_at DESC LIMIT 1;
+  IF NOT FOUND THEN
+    UPDATE public.plg_fiscalbr_webhook_receipts
+       SET processed_at = now(), processing_error = 'job_not_found'
+     WHERE id = v_receipt_id;
+    RETURN jsonb_build_object('duplicate', false, 'matched', false);
+  END IF;
+
+  UPDATE public.plg_fiscalbr_webhook_receipts
+     SET tenant_id = v_job.tenant_id, nota_id = v_job.nota_id, processed_at = now()
+   WHERE id = v_receipt_id;
+  PERFORM public.plugnotas_apply_nfce_result(
+    v_job.tenant_id, v_job.id, p_status, p_provider_document_id,
+    coalesce(p_integration_id, v_job.integration_id), p_number, p_series,
+    p_access_key, p_message, p_payload
+  );
+  RETURN jsonb_build_object('duplicate', false, 'matched', true, 'jobId', v_job.id);
+END $$;
+
+CREATE OR REPLACE FUNCTION public.plugnotas_get_artifact_locator(
+  p_tenant_id uuid,
+  p_nota_id uuid
+) RETURNS jsonb
+LANGUAGE sql SECURITY DEFINER SET search_path = '' STABLE AS $$
+  SELECT jsonb_build_object(
+    'notaId', n.id,
+    'status', n.status,
+    'providerDocumentId', n.metadata #>> '{plugnotas,providerDocumentId}',
+    'integrationId', n.metadata #>> '{plugnotas,integrationId}'
+  )
+  FROM public.plg_financial_nfe n
+  WHERE n.tenant_id = p_tenant_id AND n.id = p_nota_id
+    AND n.status IN ('issued', 'cancelled');
+$$;
+
+CREATE OR REPLACE FUNCTION public.plugnotas_claim_nfce_recovery(
+  p_limit integer DEFAULT 20
+) RETURNS SETOF public.plg_fiscalbr_nfce_jobs
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$
+BEGIN
+  RETURN QUERY
+  WITH candidates AS (
+    SELECT j.id FROM public.plg_fiscalbr_nfce_jobs j
+     WHERE j.status IN ('queued', 'waiting')
+       AND coalesce(j.next_attempt_at, j.created_at) <= now()
+       AND coalesce(j.locked_until, '-infinity'::timestamptz) < now()
+     ORDER BY coalesce(j.next_attempt_at, j.created_at), j.created_at
+     FOR UPDATE SKIP LOCKED
+     LIMIT greatest(1, least(coalesce(p_limit, 20), 100))
+  )
+  UPDATE public.plg_fiscalbr_nfce_jobs j
+     SET status = 'running', locked_until = now() + interval '2 minutes', updated_at = now()
+    FROM candidates c WHERE j.id = c.id
+  RETURNING j.*;
+END $$;
+
+REVOKE ALL ON FUNCTION public.plugnotas_register_emitter(uuid, uuid, text, text, text, timestamptz, text, boolean) FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.plugnotas_disconnect_emitter(uuid, uuid) FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.plugnotas_create_nfce_draft_for_order(uuid, uuid) FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.plugnotas_prepare_nfce(uuid, uuid, uuid, text) FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.plugnotas_prepare_nfce_cancel(uuid, uuid, uuid, text) FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.plugnotas_record_nfce_attempt(uuid, uuid, text, jsonb, text, timestamptz) FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.plugnotas_apply_nfce_result(uuid, uuid, text, text, text, text, text, text, text, jsonb) FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.plugnotas_apply_nfce_webhook(text, text, text, text, text, text, text, text, text, jsonb) FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.plugnotas_get_artifact_locator(uuid, uuid) FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.plugnotas_claim_nfce_recovery(integer) FROM PUBLIC, anon, authenticated;
+
+GRANT EXECUTE ON FUNCTION public.plugnotas_register_emitter(uuid, uuid, text, text, text, timestamptz, text, boolean) TO service_role;
+GRANT EXECUTE ON FUNCTION public.plugnotas_disconnect_emitter(uuid, uuid) TO service_role;
+GRANT EXECUTE ON FUNCTION public.plugnotas_create_nfce_draft_for_order(uuid, uuid) TO service_role;
+GRANT EXECUTE ON FUNCTION public.plugnotas_prepare_nfce(uuid, uuid, uuid, text) TO service_role;
+GRANT EXECUTE ON FUNCTION public.plugnotas_prepare_nfce_cancel(uuid, uuid, uuid, text) TO service_role;
+GRANT EXECUTE ON FUNCTION public.plugnotas_record_nfce_attempt(uuid, uuid, text, jsonb, text, timestamptz) TO service_role;
+GRANT EXECUTE ON FUNCTION public.plugnotas_apply_nfce_result(uuid, uuid, text, text, text, text, text, text, text, jsonb) TO service_role;
+GRANT EXECUTE ON FUNCTION public.plugnotas_apply_nfce_webhook(text, text, text, text, text, text, text, text, text, jsonb) TO service_role;
+GRANT EXECUTE ON FUNCTION public.plugnotas_get_artifact_locator(uuid, uuid) TO service_role;
+GRANT EXECUTE ON FUNCTION public.plugnotas_claim_nfce_recovery(integer) TO service_role;
+`;
+var MIGRATION_001_PRESERVE_TERMINAL_RESULTS_AND_RECOVER_LEASES = `-- Incremental recovery fix. Preserve 000_baseline.sql and its recorded checksum.
+-- Only existing fiscal functions change; no parallel ledger/schema or backfill.
+-- CREATE OR REPLACE retains the service-role-only ACL from the baseline.
+
+CREATE OR REPLACE FUNCTION public.plugnotas_record_nfce_attempt(
+  p_tenant_id uuid,
+  p_job_id uuid,
+  p_status text,
+  p_provider_response jsonb DEFAULT '{}'::jsonb,
+  p_error text DEFAULT NULL,
+  p_next_attempt_at timestamptz DEFAULT NULL
+) RETURNS void
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$
+BEGIN
+  IF p_status NOT IN ('running', 'waiting', 'failed', 'manual_review') THEN
+    RAISE EXCEPTION 'plugnotas_record_nfce_attempt: invalid status' USING ERRCODE = '22023';
+  END IF;
+  UPDATE public.plg_fiscalbr_nfce_jobs
+     SET status = p_status,
+         -- One provider dispatch is one attempt. Moving that same attempt from
+         -- running to waiting/failed must not count it a second time.
+         attempts = attempts + CASE WHEN p_status = 'running' THEN 1 ELSE 0 END,
+         provider_response = coalesce(p_provider_response, '{}'::jsonb),
+         last_error = p_error, next_attempt_at = p_next_attempt_at,
+         locked_until = CASE WHEN p_status = 'running'
+           THEN greatest(coalesce(locked_until, now()), now() + interval '2 minutes') ELSE NULL END,
+         updated_at = now()
+   WHERE tenant_id = p_tenant_id AND id = p_job_id AND status <> 'succeeded';
+END $$;
+
+CREATE OR REPLACE FUNCTION public.plugnotas_apply_nfce_result(
+  p_tenant_id uuid,
+  p_job_id uuid,
+  p_status text,
+  p_provider_document_id text DEFAULT NULL,
+  p_integration_id text DEFAULT NULL,
+  p_number text DEFAULT NULL,
+  p_series text DEFAULT NULL,
+  p_access_key text DEFAULT NULL,
+  p_message text DEFAULT NULL,
+  p_provider_response jsonb DEFAULT '{}'::jsonb
+) RETURNS uuid
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$
+DECLARE
+  v_job public.plg_fiscalbr_nfce_jobs%ROWTYPE;
+  v_document_status text;
+  v_existing_status text;
+  v_job_status text;
+BEGIN
+  SELECT * INTO v_job FROM public.plg_fiscalbr_nfce_jobs
+   WHERE tenant_id = p_tenant_id AND id = p_job_id;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'plugnotas_apply_nfce_result: job not found' USING ERRCODE = 'P0002';
+  END IF;
+  IF p_status NOT IN ('processing', 'issued', 'cancelled', 'error') THEN
+    RAISE EXCEPTION 'plugnotas_apply_nfce_result: invalid status' USING ERRCODE = '22023';
+  END IF;
+
+  -- Match prepare/cancel's lock order: document, then job.
+  SELECT status INTO v_existing_status FROM public.plg_financial_nfe
+   WHERE tenant_id = p_tenant_id AND id = v_job.nota_id FOR UPDATE;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'plugnotas_apply_nfce_result: document not found' USING ERRCODE = 'P0002';
+  END IF;
+  SELECT * INTO v_job FROM public.plg_fiscalbr_nfce_jobs
+   WHERE tenant_id = p_tenant_id AND id = p_job_id FOR UPDATE;
+
+  -- Late polling must not regress a concluded document or an active cancellation.
+  IF v_existing_status = 'cancelled'
+     OR (v_job.operation = 'issue' AND v_existing_status = 'issued' AND p_status <> 'cancelled')
+     OR (v_job.status = 'succeeded' AND p_status IN ('processing', 'error')) THEN
+    -- Old/interrupted jobs may still be running after the document concluded.
+    -- Settle their lease too, otherwise recovery would claim them forever.
+    UPDATE public.plg_fiscalbr_nfce_jobs
+       SET status = 'succeeded', locked_until = NULL, next_attempt_at = NULL, updated_at = now()
+     WHERE tenant_id = p_tenant_id AND id = p_job_id;
+    RETURN v_job.nota_id;
+  END IF;
+
+  v_job_status := CASE
+    WHEN p_status = 'cancelled' OR (v_job.operation = 'issue' AND p_status = 'issued') THEN 'succeeded'
+    WHEN p_status = 'error' THEN 'failed'
+    ELSE 'waiting' END;
+  v_document_status := CASE
+    WHEN v_job.operation = 'cancel' AND p_status <> 'cancelled' THEN v_existing_status
+    ELSE p_status
+  END;
+  UPDATE public.plg_fiscalbr_nfce_jobs
+     SET status = v_job_status,
+         provider_document_id = coalesce(p_provider_document_id, provider_document_id),
+         integration_id = coalesce(p_integration_id, integration_id),
+         provider_response = coalesce(p_provider_response, '{}'::jsonb),
+         last_error = CASE WHEN p_status = 'error' THEN p_message ELSE NULL END,
+         next_attempt_at = CASE WHEN v_job_status = 'waiting' THEN now() + interval '2 minutes' ELSE NULL END,
+         locked_until = NULL, updated_at = now()
+   WHERE id = p_job_id;
+
+  UPDATE public.plg_financial_nfe
+     SET status = v_document_status,
+         number = coalesce(p_number, number),
+         series = coalesce(p_series, series),
+         access_key = coalesce(p_access_key, access_key),
+         issued_at = CASE WHEN p_status = 'issued' THEN coalesce(issued_at, now()) ELSE issued_at END,
+         error_message = CASE WHEN v_document_status = 'error' THEN p_message ELSE NULL END,
+         metadata = metadata || jsonb_build_object('plugnotas', jsonb_strip_nulls(jsonb_build_object(
+           'jobId', p_job_id,
+           'jobStatus', v_job_status,
+           'operation', v_job.operation,
+           'providerDocumentId', coalesce(p_provider_document_id, v_job.provider_document_id),
+           'integrationId', coalesce(p_integration_id, v_job.integration_id),
+           'cancellationPending', v_job.operation = 'cancel' AND v_job_status = 'waiting'
+         ))),
+         updated_at = now()
+   WHERE tenant_id = p_tenant_id AND id = v_job.nota_id;
+
+  INSERT INTO public.plg_fiscalbr_nfce_events (tenant_id, nota_id, job_id, event_type, payload)
+  VALUES (p_tenant_id, v_job.nota_id, p_job_id, v_job.operation || '.' || p_status,
+          coalesce(p_provider_response, '{}'::jsonb));
+  RETURN v_job.nota_id;
+END $$;
+
+CREATE OR REPLACE FUNCTION public.plugnotas_apply_nfce_webhook(
+  p_provider_event_id text,
+  p_payload_sha256 text,
+  p_provider_document_id text,
+  p_status text,
+  p_integration_id text DEFAULT NULL,
+  p_number text DEFAULT NULL,
+  p_series text DEFAULT NULL,
+  p_access_key text DEFAULT NULL,
+  p_message text DEFAULT NULL,
+  p_payload jsonb DEFAULT '{}'::jsonb
+) RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$
+DECLARE
+  v_job public.plg_fiscalbr_nfce_jobs%ROWTYPE;
+  v_receipt_id bigint;
+  v_receipt public.plg_fiscalbr_webhook_receipts%ROWTYPE;
+BEGIN
+  INSERT INTO public.plg_fiscalbr_webhook_receipts
+    (provider_event_id, payload_sha256)
+  VALUES (p_provider_event_id, p_payload_sha256)
+  ON CONFLICT (provider, provider_event_id) DO NOTHING
+  RETURNING id INTO v_receipt_id;
+  SELECT * INTO v_receipt FROM public.plg_fiscalbr_webhook_receipts
+   WHERE provider = 'plugnotas' AND provider_event_id = p_provider_event_id FOR UPDATE;
+  v_receipt_id := v_receipt.id;
+  IF v_receipt.payload_sha256 IS DISTINCT FROM p_payload_sha256 THEN
+    RAISE EXCEPTION 'plugnotas_apply_nfce_webhook: conflicting event payload' USING ERRCODE = '22023';
+  END IF;
+  IF v_receipt.processed_at IS NOT NULL AND v_receipt.processing_error IS NULL THEN
+    RETURN jsonb_build_object('duplicate', true, 'matched', true);
+  END IF;
+
+  SELECT * INTO v_job FROM public.plg_fiscalbr_nfce_jobs
+   WHERE provider_document_id = p_provider_document_id
+   ORDER BY created_at DESC LIMIT 1;
+  IF NOT FOUND THEN
+    UPDATE public.plg_fiscalbr_webhook_receipts
+       SET processed_at = NULL, processing_error = 'job_not_found'
+     WHERE id = v_receipt_id;
+    RETURN jsonb_build_object('duplicate', false, 'matched', false);
+  END IF;
+
+  UPDATE public.plg_fiscalbr_webhook_receipts
+     SET tenant_id = v_job.tenant_id, nota_id = v_job.nota_id, processed_at = now(), processing_error = NULL
+   WHERE id = v_receipt_id;
+  PERFORM public.plugnotas_apply_nfce_result(
+    v_job.tenant_id, v_job.id, p_status, p_provider_document_id,
+    coalesce(p_integration_id, v_job.integration_id), p_number, p_series,
+    p_access_key, p_message, p_payload
+  );
+  RETURN jsonb_build_object('duplicate', false, 'matched', true, 'jobId', v_job.id);
+END $$;
+
+CREATE OR REPLACE FUNCTION public.plugnotas_claim_nfce_recovery(
+  p_limit integer DEFAULT 20
+) RETURNS SETOF public.plg_fiscalbr_nfce_jobs
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$
+BEGIN
+  RETURN QUERY
+  WITH candidates AS (
+    SELECT j.id FROM public.plg_fiscalbr_nfce_jobs j
+     WHERE j.status IN ('queued', 'waiting', 'running')
+       AND coalesce(j.next_attempt_at, j.created_at) <= now()
+       AND coalesce(j.locked_until, '-infinity'::timestamptz) < now()
+     ORDER BY coalesce(j.next_attempt_at, j.created_at), j.created_at
+     FOR UPDATE SKIP LOCKED
+     LIMIT greatest(1, least(coalesce(p_limit, 20), 100))
+  )
+  UPDATE public.plg_fiscalbr_nfce_jobs j
+     SET status = 'running', locked_until = now() + interval '2 minutes', updated_at = now()
+    FROM candidates c WHERE j.id = c.id
+  RETURNING j.*;
+END $$;
+`;
+var MIGRATIONS = [
+  { id: "000_baseline", sql: MIGRATION_000_BASELINE },
+  { id: "001_preserve_terminal_results_and_recover_leases", sql: MIGRATION_001_PRESERVE_TERMINAL_RESULTS_AND_RECOVER_LEASES }
+];
+
+// src/lib/financial-provider.ts
+function fiscalReader(provider) {
+  if (!provider.getNotaById) throw new Error("PlugNotas requires fiscal document reads from Financial.");
+  return provider.getNotaById.bind(provider);
+}
+async function committed(read, id) {
+  const document = await read(id);
+  if (!document) throw new Error("Fiscal document was not found after the server operation.");
+  return document;
+}
+function resultError(result, document, fallback) {
+  if (result.status !== "error") return;
+  throw new Error(result.message?.trim() || document.errorMessage?.trim() || fallback);
+}
+function cancellationPending(metadata) {
+  const provider = metadata?.plugnotas;
+  if (!provider || typeof provider !== "object" || Array.isArray(provider)) return false;
+  return provider.cancellationPending === true;
+}
+function artifactUrl(value) {
+  if (typeof value !== "string" || !value.trim()) throw new Error("PlugNotas returned an invalid artifact URL.");
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw new Error("PlugNotas returned an invalid artifact URL.");
+  }
+  if (!["http:", "https:"].includes(parsed.protocol)) throw new Error("PlugNotas returned an invalid artifact URL.");
+  return parsed.toString();
+}
+function createPlugNotasFinancialProvider(options) {
+  const { base, gateway } = options;
+  const issueNota = async (id) => {
+    const read = fiscalReader(base);
+    const document = await read(id);
+    if (!document) throw new Error("Fiscal document not found.");
+    if (document.model !== "nfce") throw new Error("PlugNotas currently authorizes NFC-e only.");
+    if (!document.orderId?.trim()) throw new Error("PlugNotas NFC-e must be created from an order.");
+    if (!["draft", "error"].includes(document.status)) return document;
+    const result = await gateway.issue({ notaId: id, idempotencyKey: `nfce:${id}` });
+    const saved = await committed(read, id);
+    resultError(result, saved, "PlugNotas could not issue this NFC-e.");
+    return saved;
+  };
+  const refreshNota = async (id) => {
+    const read = fiscalReader(base);
+    const document = await read(id);
+    if (!document) throw new Error("Fiscal document not found.");
+    if (!["processing", "error"].includes(document.status) && !cancellationPending(document.metadata)) return document;
+    const result = await gateway.refresh({ notaId: id });
+    const saved = await committed(read, id);
+    resultError(result, saved, "PlugNotas could not refresh this NFC-e.");
+    return saved;
+  };
+  const cancelNota = async (id, reason) => {
+    const read = fiscalReader(base);
+    const document = await read(id);
+    if (!document) throw new Error("Fiscal document not found.");
+    if (document.status !== "issued") throw new Error("Only an issued NFC-e can be cancelled.");
+    if (cancellationPending(document.metadata)) throw new Error("NFC-e cancellation is already in progress.");
+    const normalized = reason?.trim() ?? "";
+    if (normalized.length < 15 || normalized.length > 255) {
+      throw new Error("Cancellation reason must contain between 15 and 255 characters.");
+    }
+    const result = await gateway.cancel({ notaId: id, reason: normalized });
+    const saved = await committed(read, id);
+    resultError(result, saved, "PlugNotas could not cancel this NFC-e.");
+    return saved;
+  };
+  const getNotaArtifactUrl = async (id, kind) => {
+    const read = fiscalReader(base);
+    const document = await read(id);
+    if (!document) throw new Error("Fiscal document not found.");
+    if (!["issued", "cancelled"].includes(document.status)) {
+      throw new Error("Fiscal artifacts are available only after authorization.");
+    }
+    if (kind === "cancellation_xml" && document.status !== "cancelled") {
+      throw new Error("Cancellation XML is available only after cancellation.");
+    }
+    return artifactUrl((await gateway.artifact({ notaId: id, kind })).url);
+  };
+  return new Proxy(base, {
+    get(target, property, receiver) {
+      if (property === "issueNota") return issueNota;
+      if (property === "refreshNota") return refreshNota;
+      if (property === "cancelNota") return cancelNota;
+      if (property === "getNotaArtifactUrl") return getNotaArtifactUrl;
+      return Reflect.get(target, property, receiver);
+    }
+  });
+}
+
+// src/index.ts
+function createPlugNotasPlugin(options = {}) {
+  return definePlugin({
+    id: "fiscal-br",
+    name: "Fiscal Brasil",
+    icon: "ReceiptText",
+    version: "0.1.0",
+    apiVersion: 1,
+    scope: "addon",
+    defaultEnabled: true,
+    dependencies: ["financial"],
+    navigation: [],
+    routes: [],
+    connectors: [createPlugNotasConnector(options)],
+    functions: [{
+      slug: "plugnotas-bridge",
+      ingress: "none",
+      verifyJwt: false,
+      secrets: [
+        "PLUGNOTAS_API_KEY",
+        "PLUGNOTAS_BASE_URL",
+        "PLUGNOTAS_ENVIRONMENT",
+        "PLUGNOTAS_WEBHOOK_SECRET",
+        "PLUGNOTAS_ARTIFACT_SIGNING_KEY",
+        "PLUGNOTAS_ALLOWED_ORIGINS",
+        "PLUGNOTAS_WORKER_SECRET",
+        "SUPABASE_URL",
+        "SUPABASE_ANON_KEY",
+        "SUPABASE_SERVICE_ROLE_KEY"
+      ],
+      grants: [
+        "plugnotas_register_emitter",
+        "plugnotas_disconnect_emitter",
+        "plugnotas_create_nfce_draft_for_order",
+        "plugnotas_prepare_nfce",
+        "plugnotas_prepare_nfce_cancel",
+        "plugnotas_apply_nfce_result",
+        "plugnotas_apply_nfce_webhook",
+        "plugnotas_get_artifact_locator",
+        "plugnotas_claim_nfce_recovery",
+        "plugnotas_record_nfce_attempt"
+      ]
+    }],
+    migrations: MIGRATIONS.map((entry) => ({
+      id: `fiscal-br-${entry.id}`,
+      version: "1.0.0",
+      sql: entry.sql,
+      description: "Durable PlugNotas delivery, recovery, webhook and emitter-registration boundary."
+    })),
+    diagnostics: [{
+      id: "plugnotas-nfce-ready",
+      description: "NFC-e requires the shared connection, order, item and financial fiscal-document contracts.",
+      requires: {
+        tables: [
+          "connections",
+          "orders",
+          "items",
+          "plg_financial_nfe",
+          "plg_fiscalbr_nfce_jobs",
+          "plg_fiscalbr_nfce_events",
+          "plg_fiscalbr_webhook_receipts"
+        ],
+        rpcs: [
+          "plugnotas_create_nfce_draft_for_order",
+          "plugnotas_prepare_nfce",
+          "plugnotas_apply_nfce_result",
+          "plugnotas_apply_nfce_webhook",
+          "plugnotas_claim_nfce_recovery"
+        ],
+        env: [
+          "PLUGNOTAS_API_KEY",
+          "PLUGNOTAS_BASE_URL",
+          "PLUGNOTAS_ENVIRONMENT",
+          "PLUGNOTAS_WEBHOOK_SECRET",
+          "PLUGNOTAS_ARTIFACT_SIGNING_KEY",
+          "PLUGNOTAS_ALLOWED_ORIGINS",
+          "PLUGNOTAS_WORKER_SECRET"
+        ]
+      },
+      level: "error"
+    }]
+  });
+}
+
+export { PLUGNOTAS_CONNECTOR_ID, PLUGNOTAS_FIELDS, PLUGNOTAS_SETTINGS, createPlugNotasConnector, createPlugNotasFinancialProvider, createPlugNotasPlugin, isValidCnpj, markPlugNotasEmitterReady };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map