cosmemilton-acbr-node 0.1.2 → 0.2.1

package/dist/cli.js

@@ -82,8 +82,8 @@ function parseConfig(input, configPath) {
     }
   };
 }
-async function loadConfig(path4 = "acbr.config.json") {
-  const configPath = resolve(path4);
+async function loadConfig(path5 = "acbr.config.json") {
+  const configPath = resolve(path5);
   let contents;
   try {
     contents = await readFile2(configPath, "utf8");
@@ -98,8 +98,8 @@ async function loadConfig(path4 = "acbr.config.json") {
   }
   return parseConfig(value, configPath);
 }
-async function initializeConfig(path4 = "acbr.config.json", revision2 = "HEAD", assetRoot) {
-  const configPath = resolve(path4);
+async function initializeConfig(path5 = "acbr.config.json", revision2 = "HEAD", assetRoot) {
+  const configPath = resolve(path5);
   const config = defaultConfig();
   config.source.revision = revision2;
   parseConfig(config, configPath);
@@ -182,7 +182,7 @@ import { createReadStream } from "node:fs";
 import { access as access2, mkdir as mkdir2, readdir as readdir2, readFile as readFile3, rename, rm, stat, writeFile as writeFile2 } from "node:fs/promises";
 import { dirname as dirname2, join, relative, resolve as resolve2, sep } from "node:path";
 async function runCommand(command, args, options = {}) {
-  return new Promise((done, fail3) => {
+  return new Promise((done, fail4) => {
     const child = spawn(command, args, { cwd: options.cwd, env: options.env ?? process.env, stdio: ["ignore", "pipe", "pipe"], windowsHide: true, shell: false });
     let stdout = "";
     let stderr = "";
@@ -199,20 +199,20 @@ async function runCommand(command, args, options = {}) {
     };
     child.stdout.on("data", (data) => append("stdout", data));
     child.stderr.on("data", (data) => append("stderr", data));
-    child.on("error", (error) => fail3(new Error(`N\xE3o foi poss\xEDvel executar ${command}: ${error.message}`, { cause: error })));
+    child.on("error", (error) => fail4(new Error(`N\xE3o foi poss\xEDvel executar ${command}: ${error.message}`, { cause: error })));
     child.on("close", (code) => {
-      if (overflow) fail3(new Error(`Sa\xEDda de ${command} excedeu o limite de ${maximum} bytes.`));
+      if (overflow) fail4(new Error(`Sa\xEDda de ${command} excedeu o limite de ${maximum} bytes.`));
       else if (code !== 0) {
         const diagnostic = (stderr || stdout).split("\n").slice(-80).join("\n").slice(-16e3);
-        fail3(Object.assign(new Error(`${command} terminou com c\xF3digo ${code}:
+        fail4(Object.assign(new Error(`${command} terminou com c\xF3digo ${code}:
 ${diagnostic}`), { stdout, stderr }));
       } else done({ stdout, stderr });
     });
   });
 }
-async function fileHash(path4) {
+async function fileHash(path5) {
   const hash2 = createHash2("sha256");
-  for await (const chunk of createReadStream(path4)) hash2.update(chunk);
+  for await (const chunk of createReadStream(path5)) hash2.update(chunk);
   return hash2.digest("hex");
 }
 async function snapshotSource(directory) {
@@ -221,11 +221,11 @@ async function snapshotSource(directory) {
     const entries = (await readdir2(current, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name, "en"));
     for (const entry of entries) {
       if (entry.name === ".svn") continue;
-      const path4 = join(current, entry.name);
-      if (entry.isSymbolicLink()) throw new Error(`Fonte ACBr cont\xE9m link simb\xF3lico: ${path4}.`);
-      if (entry.isDirectory()) await scan(path4);
-      else if (entry.isFile()) files[relative(directory, path4).split(sep).join("/")] = await fileHash(path4);
-      else throw new Error(`Fonte ACBr cont\xE9m arquivo especial: ${path4}.`);
+      const path5 = join(current, entry.name);
+      if (entry.isSymbolicLink()) throw new Error(`Fonte ACBr cont\xE9m link simb\xF3lico: ${path5}.`);
+      if (entry.isDirectory()) await scan(path5);
+      else if (entry.isFile()) files[relative(directory, path5).split(sep).join("/")] = await fileHash(path5);
+      else throw new Error(`Fonte ACBr cont\xE9m arquivo especial: ${path5}.`);
     }
   }
   await scan(resolve2(directory));
@@ -237,8 +237,8 @@ function validateLock(value) {
   if (!value || typeof value !== "object") throw new Error("Lock ACBr inv\xE1lido.");
   const lock = value;
   if (lock.formatVersion !== 1 || !lock.source || !Number.isSafeInteger(lock.source.revision) || lock.source.revision < 1 || !Array.isArray(lock.source.parts) || !lock.source.files || typeof lock.source.files !== "object" || Array.isArray(lock.source.files) || !/^[a-f0-9]{64}$/.test(lock.source.treeHash)) throw new Error("Formato inv\xE1lido em acbr.lock.json.");
-  for (const [path4, hash2] of Object.entries(lock.source.files)) {
-    if (path4.startsWith("/") || path4.includes("\\") || path4.split("/").includes("..") || !/^[a-f0-9]{64}$/.test(hash2)) throw new Error("Caminho ou hash inv\xE1lido no lock ACBr.");
+  for (const [path5, hash2] of Object.entries(lock.source.files)) {
+    if (path5.startsWith("/") || path5.includes("\\") || path5.split("/").includes("..") || !/^[a-f0-9]{64}$/.test(hash2)) throw new Error("Caminho ou hash inv\xE1lido no lock ACBr.");
   }
   if (lock.source.parts.join("\n") !== SOURCE_PARTS.join("\n")) throw new Error("Partes ACBr divergentes no lock.");
   return lock;
@@ -268,7 +268,7 @@ async function verifySourceContents(config) {
   const snapshot = await snapshotSource(config.source.directory);
   if (snapshot.treeHash !== lock.source.treeHash) {
     const names = /* @__PURE__ */ new Set([...Object.keys(snapshot.files), ...Object.keys(lock.source.files)]);
-    const changed = [...names].filter((path4) => snapshot.files[path4] !== lock.source.files[path4]);
+    const changed = [...names].filter((path5) => snapshot.files[path5] !== lock.source.files[path5]);
     throw new Error(`Fontes ACBr divergem do lock (${changed.length} arquivo(s)): ${changed.slice(0, 10).join(", ")}. Preserve as altera\xE7\xF5es antes de atualizar.`);
   }
   return lock;
@@ -396,6 +396,175 @@ var init_source = __esm({
   }
 });
 
+// scripts/runtime-license-inventory.mjs
+import { createHash as createHash3 } from "node:crypto";
+import { lstat, mkdir as mkdir3, readFile as readFile4, readdir as readdir3, writeFile as writeFile3 } from "node:fs/promises";
+import path2 from "node:path";
+import { fileURLToPath } from "node:url";
+async function regularFile(root, name) {
+  if (!name || path2.posix.isAbsolute(name) || name.includes("\\") || name.split("/").some((p) => !p || p === "." || p === "..")) fail2("caminho inv\xE1lido.");
+  const parts = name.split("/");
+  let file = root;
+  for (let i = 0; i < parts.length; i++) {
+    file = path2.join(file, parts[i]);
+    const info = await lstat(file);
+    if (info.isSymbolicLink() || (i < parts.length - 1 ? !info.isDirectory() : !info.isFile())) fail2("arquivo n\xE3o regular: " + name);
+    if (i === parts.length - 1 && info.size > MAX_TEXT_BYTES) fail2("texto excede o limite: " + name);
+  }
+  return readFile4(file);
+}
+function references(bytes, notice) {
+  const names = /* @__PURE__ */ new Set();
+  for (const match of bytes.toString("utf8").matchAll(/\/usr\/share\/common-licenses\/([^\s"'<>`\u2018\u2019\u201c\u201d]+)/g)) {
+    const name = match[1].replace(/[.,;:)\]}]+$/, "");
+    if (!NAME.test(name)) fail2("refer\xEAncia common-licenses inv\xE1lida em " + notice);
+    names.add(name);
+  }
+  return [...names].sort();
+}
+async function policyAt(directory) {
+  const raw = await regularFile(directory, "ORIGIN.json");
+  let policy;
+  try {
+    policy = JSON.parse(raw.toString("utf8"));
+  } catch {
+    fail2("ORIGIN.json inv\xE1lido.");
+  }
+  if (policy.formatVersion !== 1 || !object(policy.files) || !Object.hasOwn(policy.files, "Apache-2.0")) fail2("pol\xEDtica can\xF4nica incompleta.");
+  const files = /* @__PURE__ */ new Map();
+  for (const name of Object.keys(policy.files).sort()) {
+    const entry = policy.files[name];
+    if (!NAME.test(name) || !object(entry) || entry.file !== name + ".txt" || !HASH.test(entry.sha256) || !Number.isSafeInteger(entry.bytes) || entry.bytes <= 0 || entry.bytes > MAX_TEXT_BYTES) fail2("registro can\xF4nico inv\xE1lido: " + name);
+    const bytes = await regularFile(directory, entry.file);
+    if (bytes.length !== entry.bytes || digest(bytes) !== entry.sha256) fail2("texto can\xF4nico diverge da origem aprovada: " + name);
+    files.set(name, { entry, bytes });
+  }
+  return { sha256: digest(raw), files };
+}
+async function noticesAt(runtime) {
+  const notices = [];
+  async function visit(prefix) {
+    for (const entry of (await readdir3(path2.join(runtime, prefix), { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name))) {
+      const name = prefix + "/" + entry.name;
+      if (entry.isSymbolicLink()) fail2("link em avisos: " + name);
+      if (entry.isDirectory()) {
+        if (name !== "licenses/common") await visit(name);
+      } else if (entry.isFile()) notices.push({ name, bytes: await regularFile(runtime, name) });
+      else fail2("aviso n\xE3o regular: " + name);
+    }
+  }
+  await visit("licenses");
+  return notices;
+}
+async function expectedInventory(runtime, policyDirectory) {
+  const policy = await policyAt(policyDirectory);
+  const notices = await noticesAt(runtime);
+  const required = /* @__PURE__ */ new Map([["Apache-2.0", /* @__PURE__ */ new Set(["policy:OpenSSL"])]]);
+  const add = (name, source) => {
+    if (!policy.files.has(name)) fail2("refer\xEAncia common-licenses n\xE3o aprovada: " + name);
+    if (!required.has(name)) required.set(name, /* @__PURE__ */ new Set());
+    required.get(name).add(source);
+  };
+  for (const notice of notices) for (const name of references(notice.bytes, notice.name)) add(name, notice.name);
+  const scanned = /* @__PURE__ */ new Set();
+  while (scanned.size < required.size) {
+    const name = [...required.keys()].find((name2) => !scanned.has(name2));
+    scanned.add(name);
+    const aliasOf = policy.files.get(name).entry.aliasOf;
+    if (aliasOf !== void 0) {
+      if (typeof aliasOf !== "string") fail2("alias can\xF4nico inv\xE1lido: " + name);
+      add(aliasOf, COMMON + name + ".txt");
+      if (policy.files.get(aliasOf).entry.sha256 !== policy.files.get(name).entry.sha256) fail2("alias diverge do texto can\xF4nico: " + name);
+    }
+    for (const referenced of references(policy.files.get(name).bytes, COMMON + name + ".txt")) add(referenced, COMMON + name + ".txt");
+  }
+  const files = {};
+  for (const name of [...required.keys()].sort()) {
+    const { entry } = policy.files.get(name);
+    files[name] = { file: COMMON + entry.file, sha256: entry.sha256, bytes: entry.bytes, requiredBy: [...required.get(name)].sort(), origin: entry };
+  }
+  return { inventory: { formatVersion: 1, policySha256: policy.sha256, files }, policy, notices };
+}
+async function writeExact(file, bytes) {
+  try {
+    await writeFile3(file, bytes, { flag: "wx" });
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+    const info = await lstat(file);
+    if (!info.isFile() || info.isSymbolicLink() || !(await readFile4(file)).equals(bytes)) fail2("recusa substituir material existente divergente.");
+  }
+}
+async function completeRuntimeLicenses(runtime, { policyDirectory = defaultPolicy } = {}) {
+  const { inventory, policy } = await expectedInventory(runtime, policyDirectory);
+  const directory = path2.join(runtime, "licenses/common");
+  try {
+    if (!(await lstat(directory)).isDirectory() || (await lstat(directory)).isSymbolicLink()) fail2("diret\xF3rio common n\xE3o regular.");
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+    await mkdir3(directory);
+  }
+  for (const [name, entry] of Object.entries(inventory.files)) await writeExact(path2.join(runtime, entry.file), policy.files.get(name).bytes);
+  await writeExact(path2.join(runtime, INVENTORY), Buffer.from(JSON.stringify(inventory, null, 2) + "\n"));
+  return inventory;
+}
+async function auditRuntimeLicenses(runtime, manifest, { policyDirectory = defaultPolicy } = {}) {
+  const { inventory, notices } = await expectedInventory(runtime, policyDirectory);
+  if (!object(manifest?.files)) fail2("manifesto sem invent\xE1rio.");
+  const dependencyFiles = [];
+  if (manifest.platform === "linux") {
+    const source = "sources/native-dependencies.json";
+    let dependencies;
+    try {
+      dependencies = JSON.parse((await regularFile(runtime, source)).toString("utf8"));
+    } catch {
+      fail2("proveni\xEAncia Linux ausente ou inv\xE1lida.");
+    }
+    if (!object(dependencies) || Object.keys(dependencies).length === 0) fail2("proveni\xEAncia Linux sem depend\xEAncias.");
+    dependencyFiles.push(source);
+    for (const dependency of Object.values(dependencies)) {
+      const name = dependency?.copyright;
+      if (typeof name !== "string" || !name.startsWith("licenses/") || name.startsWith(COMMON)) fail2("aviso de depend\xEAncia Linux ausente da proveni\xEAncia.");
+      dependencyFiles.push(name);
+    }
+  }
+  let actual;
+  try {
+    actual = JSON.parse((await regularFile(runtime, INVENTORY)).toString("utf8"));
+  } catch {
+    fail2("invent\xE1rio common-licenses ausente ou inv\xE1lido.");
+  }
+  if (JSON.stringify(actual) !== JSON.stringify(inventory)) fail2("invent\xE1rio common-licenses diverge da pol\xEDtica e dos avisos.");
+  const expectedFiles = [INVENTORY, ...Object.values(inventory.files).map((entry) => entry.file)].sort();
+  const commonFiles = (await readdir3(path2.join(runtime, "licenses/common"))).map((name) => COMMON + name).sort();
+  if (JSON.stringify(commonFiles) !== JSON.stringify(expectedFiles)) fail2("invent\xE1rio common-licenses incompleto ou com arquivos extras.");
+  for (const name of [...notices.map((notice) => notice.name), ...dependencyFiles, ...expectedFiles]) {
+    const bytes = await regularFile(runtime, name);
+    if (!Object.hasOwn(manifest.files, name) || manifest.files[name] !== digest(bytes)) fail2("material de licen\xE7a ausente do manifesto ou hash divergente: " + name);
+  }
+  for (const entry of Object.values(inventory.files)) {
+    const bytes = await regularFile(runtime, entry.file);
+    if (bytes.length !== entry.bytes || digest(bytes) !== entry.sha256) fail2("texto integral diverge da origem aprovada: " + entry.file);
+  }
+  return inventory;
+}
+var HASH, NAME, MAX_TEXT_BYTES, COMMON, INVENTORY, defaultPolicy, digest, fail2, object;
+var init_runtime_license_inventory = __esm({
+  "scripts/runtime-license-inventory.mjs"() {
+    "use strict";
+    HASH = /^[a-f0-9]{64}$/;
+    NAME = /^[A-Za-z0-9][A-Za-z0-9.+_-]*$/;
+    MAX_TEXT_BYTES = 4 * 1024 * 1024;
+    COMMON = "licenses/common/";
+    INVENTORY = COMMON + "INVENTORY.json";
+    defaultPolicy = fileURLToPath(new URL("../docs/licenses/common/", import.meta.url));
+    digest = (bytes) => createHash3("sha256").update(bytes).digest("hex");
+    fail2 = (message) => {
+      throw Error("Licen\xE7as do runtime: " + message);
+    };
+    object = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+  }
+});
+
 // src/native-build.ts
 var native_build_exports = {};
 __export(native_build_exports, {
@@ -405,31 +574,31 @@ __export(native_build_exports, {
   findLazarus: () => findLazarus,
   runtimeDirectory: () => runtimeDirectory
 });
-import { copyFile as copyFile2, mkdir as mkdir3, readdir as readdir3, readFile as readFile4, rename as rename2, rm as rm2, stat as stat2, chmod, realpath, access as access3, writeFile as writeFile3 } from "node:fs/promises";
+import { copyFile as copyFile2, mkdir as mkdir4, readdir as readdir4, readFile as readFile5, rename as rename2, rm as rm2, stat as stat2, chmod, realpath, access as access3, writeFile as writeFile4 } from "node:fs/promises";
 import { basename, dirname as dirname3, join as join2, relative as relative2, resolve as resolve3, sep as sep2 } from "node:path";
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 function runtimeDirectory(config) {
   return join2(config.native.outputDir, `${process.platform}-${process.arch}`);
 }
-async function exists(path4) {
+async function exists(path5) {
   try {
-    await access3(path4);
+    await access3(path5);
     return true;
   } catch {
     return false;
   }
 }
 async function findLazarus(config) {
-  const candidates = config.native.lazarusRoot ? [config.native.lazarusRoot] : [process.env.LAZARUS_ROOT, "/usr/lib/lazarus/default", "/usr/lib/lazarus/3.0", "C:\\lazarus"].filter((path4) => Boolean(path4));
+  const candidates = config.native.lazarusRoot ? [config.native.lazarusRoot] : [process.env.LAZARUS_ROOT, "/usr/lib/lazarus/default", "/usr/lib/lazarus/3.0", "C:\\lazarus"].filter((path5) => Boolean(path5));
   for (const candidate of candidates) if (await exists(join2(candidate, "components/lazutils"))) return realpath(candidate);
   throw new Error("Lazarus n\xE3o encontrado. Defina native.lazarusRoot em acbr.config.json ou LAZARUS_ROOT.");
 }
 async function generatedManifest(config) {
-  const path4 = join2(config.generator.outputDir, ".acbr/generated/manifest.json");
+  const path5 = join2(config.generator.outputDir, ".acbr/generated/manifest.json");
   let value;
   try {
-    value = JSON.parse(await readFile4(path4, "utf8"));
+    value = JSON.parse(await readFile5(path5, "utf8"));
   } catch (error) {
     throw new Error("Contrato gerado ausente ou inv\xE1lido. Execute acbr-node generate.", { cause: error });
   }
@@ -443,10 +612,10 @@ async function generatedManifest(config) {
   }
   return value;
 }
-async function subdirectories(path4) {
-  const result = [path4];
-  for (const entry of (await readdir3(path4, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name))) {
-    if (entry.isDirectory()) result.push(...await subdirectories(join2(path4, entry.name)));
+async function subdirectories(path5) {
+  const result = [path5];
+  for (const entry of (await readdir4(path5, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name))) {
+    if (entry.isDirectory()) result.push(...await subdirectories(join2(path5, entry.name)));
   }
   return result;
 }
@@ -455,9 +624,9 @@ async function copyLinuxLibraries(stage) {
   const libraries = /* @__PURE__ */ new Map();
   for (const name of REQUIRED_DYNAMIC) {
     const line = stdout.split("\n").find((value) => value.trim().startsWith(`${name} `) && value.includes("x86-64"));
-    const path4 = line?.split("=>")[1]?.trim();
-    if (!path4) throw new Error(`Depend\xEAncia din\xE2mica ausente: ${name}. Instale OpenSSL 3 e libxml2 compat\xEDveis.`);
-    libraries.set(name, await realpath(path4));
+    const path5 = line?.split("=>")[1]?.trim();
+    if (!path5) throw new Error(`Depend\xEAncia din\xE2mica ausente: ${name}. Instale OpenSSL 3 e libxml2 compat\xEDveis.`);
+    libraries.set(name, await realpath(path5));
   }
   const modules = "/usr/lib/x86_64-linux-gnu/ossl-modules";
   if (!await exists(join2(modules, "legacy.so"))) throw new Error("Provider legacy OpenSSL 3 ausente. Instale o pacote libssl3/libssl3t64 completo.");
@@ -465,9 +634,9 @@ async function copyLinuxLibraries(stage) {
   const systemDependencies = /* @__PURE__ */ new Set();
   const inspected = /* @__PURE__ */ new Set();
   while (inspected.size < libraries.size) {
-    const [name, path4] = [...libraries].find(([name2]) => !inspected.has(name2));
+    const [name, path5] = [...libraries].find(([name2]) => !inspected.has(name2));
     inspected.add(name);
-    const dependencies = await runCommand("ldd", [path4]);
+    const dependencies = await runCommand("ldd", [path5]);
     for (const line of dependencies.stdout.split("\n")) {
       if (line.includes("not found")) throw new Error(`Depend\xEAncia transitiva ausente: ${line.trim()}.`);
       const match = /^\s*(\S+)\s+=>\s+(\S+)/.exec(line);
@@ -483,19 +652,19 @@ async function copyLinuxLibraries(stage) {
     }
   }
   const licenseDir = join2(stage, "licenses");
-  await mkdir3(licenseDir, { recursive: true });
+  await mkdir4(licenseDir, { recursive: true });
   const provenance = {};
-  for (const [name, path4] of libraries) {
+  for (const [name, path5] of libraries) {
     const destination = name.startsWith("ossl-modules/") ? join2(stage, name) : join2(stage, "lib", name);
-    await mkdir3(dirname3(destination), { recursive: true });
-    await copyFile2(path4, destination);
+    await mkdir4(dirname3(destination), { recursive: true });
+    await copyFile2(path5, destination);
     const aliases = name === "libssl.so.3" ? ["libssl.so"] : name === "libcrypto.so.3" ? ["libcrypto.so"] : name === "libxml2.so.2" ? ["libxml2.so"] : [];
-    for (const alias of aliases) await copyFile2(path4, join2(stage, "lib", alias));
+    for (const alias of aliases) await copyFile2(path5, join2(stage, "lib", alias));
     let owner;
     try {
-      owner = (await runCommand("dpkg-query", ["-S", path4])).stdout.split("\n")[0].split(": ")[0];
+      owner = (await runCommand("dpkg-query", ["-S", path5])).stdout.split("\n")[0].split(": ")[0];
     } catch (error) {
-      throw new Error(`N\xE3o foi poss\xEDvel identificar pacote/licen\xE7a de ${path4}. Build requer Debian/Ubuntu com depend\xEAncias registradas pelo dpkg.`, { cause: error });
+      throw new Error(`N\xE3o foi poss\xEDvel identificar pacote/licen\xE7a de ${path5}. Build requer Debian/Ubuntu com depend\xEAncias registradas pelo dpkg.`, { cause: error });
     }
     const pkg = owner.split(":")[0];
     const copyright = `/usr/share/doc/${pkg}/copyright`;
@@ -511,40 +680,40 @@ async function copyLinuxLibraries(stage) {
       copyright: `licenses/${name.replaceAll("/", "-")}.txt`
     };
   }
-  await mkdir3(join2(stage, "sources"), { recursive: true });
-  await writeFile3(join2(stage, "sources/native-dependencies.json"), `${JSON.stringify(provenance, null, 2)}
+  await mkdir4(join2(stage, "sources"), { recursive: true });
+  await writeFile4(join2(stage, "sources/native-dependencies.json"), `${JSON.stringify(provenance, null, 2)}
 `);
-  await writeFile3(join2(stage, "openssl.cnf"), "openssl_conf = openssl_init\n[openssl_init]\nproviders = provider_sect\n[provider_sect]\ndefault = default_sect\nlegacy = legacy_sect\n[default_sect]\nactivate = 1\n[legacy_sect]\nactivate = 1\n");
+  await writeFile4(join2(stage, "openssl.cnf"), "openssl_conf = openssl_init\n[openssl_init]\nproviders = provider_sect\n[provider_sect]\ndefault = default_sect\nlegacy = legacy_sect\n[default_sect]\nactivate = 1\n[legacy_sect]\nactivate = 1\n");
   return [...systemDependencies].sort();
 }
 async function copyExplicitLibraries(config, stage) {
   if (!config.native.libraryFiles?.length) throw new Error("Windows exige native.libraryFiles com DLLs OpenSSL 3/libxml2 e arquivos .LICENSE adjacentes.");
-  await mkdir3(join2(stage, "lib"), { recursive: true });
-  await mkdir3(join2(stage, "licenses"), { recursive: true });
+  await mkdir4(join2(stage, "lib"), { recursive: true });
+  await mkdir4(join2(stage, "licenses"), { recursive: true });
   const sources = {};
   const dependencyDirectories = new Set([...config.native.libraryFiles ?? [], ...config.native.providerFiles ?? []].map(dirname3));
   for (const directory of dependencyDirectories) {
-    for (const entry of await readdir3(directory)) {
+    for (const entry of await readdir4(directory)) {
       if (entry.endsWith(".LICENSE")) await copyFile2(join2(directory, entry), join2(stage, "licenses", entry));
       else if (entry === "SOURCE.json") {
-        await mkdir3(join2(stage, "sources"), { recursive: true });
+        await mkdir4(join2(stage, "sources"), { recursive: true });
         await copyFile2(join2(directory, entry), join2(stage, "sources", `${basename(directory)}-SOURCE.json`));
       }
     }
   }
   for (const [directory, files] of [["lib", config.native.libraryFiles], ["ossl-modules", config.native.providerFiles ?? []]]) {
-    await mkdir3(join2(stage, directory), { recursive: true });
+    await mkdir4(join2(stage, directory), { recursive: true });
     for (const source of files) {
       await copyFile2(source, join2(stage, directory, basename(source)));
       await copyFile2(`${source}.LICENSE`, join2(stage, "licenses", `${basename(source)}.txt`));
-      if (await exists(`${source}.SOURCE.json`)) sources[`${directory}/${basename(source)}`] = JSON.parse(await readFile4(`${source}.SOURCE.json`, "utf8"));
+      if (await exists(`${source}.SOURCE.json`)) sources[`${directory}/${basename(source)}`] = JSON.parse(await readFile5(`${source}.SOURCE.json`, "utf8"));
     }
   }
-  if (!config.native.providerFiles?.some((path4) => basename(path4).toLowerCase() === "legacy.dll")) throw new Error("Windows requer native.providerFiles com o provider legacy.dll de OpenSSL 3 e licen\xE7a adjacente.");
-  await mkdir3(join2(stage, "sources"), { recursive: true });
-  await writeFile3(join2(stage, "sources/native-dependencies.json"), `${JSON.stringify(sources, null, 2)}
+  if (!config.native.providerFiles?.some((path5) => basename(path5).toLowerCase() === "legacy.dll")) throw new Error("Windows requer native.providerFiles com o provider legacy.dll de OpenSSL 3 e licen\xE7a adjacente.");
+  await mkdir4(join2(stage, "sources"), { recursive: true });
+  await writeFile4(join2(stage, "sources/native-dependencies.json"), `${JSON.stringify(sources, null, 2)}
 `);
-  await writeFile3(join2(stage, "openssl.cnf"), "openssl_conf = openssl_init\n[openssl_init]\nproviders = provider_sect\n[provider_sect]\ndefault = default_sect\nlegacy = legacy_sect\n[default_sect]\nactivate = 1\n[legacy_sect]\nactivate = 1\n");
+  await writeFile4(join2(stage, "openssl.cnf"), "openssl_conf = openssl_init\n[openssl_init]\nproviders = provider_sect\n[provider_sect]\ndefault = default_sect\nlegacy = legacy_sect\n[default_sect]\nactivate = 1\n[legacy_sect]\nactivate = 1\n");
 }
 async function buildNative(config, options = {}) {
   if (!["linux", "win32"].includes(process.platform) || process.arch !== "x64") throw new Error("Build inicial suporta Linux x64 e Windows x64.");
@@ -556,7 +725,7 @@ async function buildNative(config, options = {}) {
   const target = options.testOnly ? join2(config.projectRoot, ".acbr/test-runtime", `${process.platform}-${process.arch}`) : runtimeDirectory(config);
   const stage = join2(dirname3(target), `.runtime-stage-${randomUUID2()}`);
   const units = join2(stage, ".units");
-  await mkdir3(units, { recursive: true });
+  await mkdir4(units, { recursive: true });
   const executable = process.platform === "win32" ? "acbr-worker.exe" : "acbr-worker";
   try {
     const cpu = (await runCommand(config.native.fpc, ["-iTP"])).stdout.trim();
@@ -577,20 +746,20 @@ async function buildNative(config, options = {}) {
       `-FU${units}`,
       `-FE${stage}`,
       `-o${executable}`,
-      ...searchPaths.map((path4) => `-Fu${path4}`),
-      ...fontPaths.map((path4) => `-Fi${path4}`),
+      ...searchPaths.map((path5) => `-Fu${path5}`),
+      ...fontPaths.map((path5) => `-Fi${path5}`),
       config.native.project
     ];
     const responseFile = join2(stage, ".compiler.rsp");
     if (args.some((arg) => /[\"\r\n]/.test(arg))) throw new Error("Caminhos do build n\xE3o podem conter aspas ou quebras de linha.");
-    await writeFile3(responseFile, args.slice(0, -1).join("\n") + "\n");
+    await writeFile4(responseFile, args.slice(0, -1).join("\n") + "\n");
     const logPath = join2(config.projectRoot, ".acbr/build.log");
     try {
       const compilation = await runCommand(config.native.fpc, [`@${responseFile}`, config.native.project], { cwd: config.projectRoot, maxOutputBytes: 32 * 1024 * 1024 });
-      await writeFile3(logPath, compilation.stdout + compilation.stderr);
+      await writeFile4(logPath, compilation.stdout + compilation.stderr);
     } catch (error) {
       const compilation = error;
-      await writeFile3(logPath, (compilation.stdout ?? "") + (compilation.stderr ?? compilation.message));
+      await writeFile4(logPath, (compilation.stdout ?? "") + (compilation.stderr ?? compilation.message));
       throw new Error(`${compilation.message}
 Log completo: ${logPath}`, { cause: compilation });
     }
@@ -599,9 +768,9 @@ Log completo: ${logPath}`, { cause: compilation });
     await copyTree(schemas, join2(stage, "schemas"));
     const services = join2(source, "Fontes/ACBrDFe/ACBrNFe/ACBrNFeServicos.ini");
     await copyFile2(services, join2(stage, "ACBrNFeServicos.ini"));
-    await mkdir3(join2(stage, "licenses"), { recursive: true });
+    await mkdir4(join2(stage, "licenses"), { recursive: true });
     await copyFile2(join2(source, "Doctos/LICENSE.TXT"), join2(stage, "licenses/ACBr-LICENSE.TXT"));
-    await mkdir3(join2(stage, "sources/native"), { recursive: true });
+    await mkdir4(join2(stage, "sources/native"), { recursive: true });
     await copyNativeSources(dirname3(config.native.project), join2(stage, "sources/native"));
     await copyFile2(join2(config.generator.outputDir, "native/generated/AcbrModels.pas"), join2(stage, "sources/native/AcbrModels.pas"));
     for (const name of ["fp-compiler-3.2.2", "fp-units-rtl-3.2.2", "fpc"]) {
@@ -615,7 +784,7 @@ Log completo: ${logPath}`, { cause: compilation });
     const archive = join2(stage, "sources/acbr-source.tar.gz");
     const tarArgs = process.platform === "linux" ? ["--sort=name", "--mtime=@0", "--owner=0", "--group=0", "--numeric-owner", "-I", "gzip -n"] : [];
     await runCommand("tar", [...tarArgs, process.platform === "linux" ? "-cf" : "-czf", archive, "-C", source, "Fontes", "Exemplos/ACBrDFe/Schemas/NFe", "Doctos/LICENSE.TXT"]);
-    await writeFile3(join2(stage, "sources/build.json"), `${JSON.stringify({
+    await writeFile4(join2(stage, "sources/build.json"), `${JSON.stringify({
       sourceRevision: lock.source.revision,
       sourceUrl: lock.source.url,
       sourceTreeHash: lock.source.treeHash,
@@ -637,6 +806,7 @@ Log completo: ${logPath}`, { cause: compilation });
     if (currentGenerated.contractHash !== contract.contractHash || currentGenerated.sourceHash !== contract.sourceHash || Object.entries(contract.fileHashes).some(([name, hash2]) => currentGenerated.fileHashes[name] !== hash2)) throw new Error("Arquivos gerados mudaram durante a compila\xE7\xE3o. Execute build novamente.");
     const currentSource = await verifySource(config);
     if (currentSource.source.revision !== lock.source.revision || currentSource.source.treeHash !== lock.source.treeHash) throw new Error("Fontes ACBr foram atualizadas durante a compila\xE7\xE3o. Execute generate e build novamente.");
+    await completeRuntimeLicenses(stage);
     const files = (await snapshotSource(stage)).files;
     const manifest = {
       formatVersion: 1,
@@ -647,10 +817,12 @@ Log completo: ${logPath}`, { cause: compilation });
       executable,
       files,
       generatedFileHashes: contract.fileHashes,
+      capabilities: ["recuperarXml"],
       systemDependencies,
       ...options.testOnly ? { testOnly: true } : {}
     };
-    await writeFile3(join2(stage, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
+    await auditRuntimeLicenses(stage, manifest);
+    await writeFile4(join2(stage, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
 `);
     await replaceRuntime(stage, target);
     return manifest;
@@ -659,15 +831,15 @@ Log completo: ${logPath}`, { cause: compilation });
   }
 }
 async function copyNativeSources(source, target) {
-  await mkdir3(target, { recursive: true });
-  for (const entry of await readdir3(source, { withFileTypes: true })) {
+  await mkdir4(target, { recursive: true });
+  for (const entry of await readdir4(source, { withFileTypes: true })) {
     if (entry.isDirectory() && !entry.name.startsWith(".")) await copyNativeSources(join2(source, entry.name), join2(target, entry.name));
     else if (entry.isFile() && /\.(pas|lpr|inc|lpi)$/i.test(entry.name)) await copyFile2(join2(source, entry.name), join2(target, entry.name));
   }
 }
 async function copyTree(source, target) {
-  await mkdir3(target, { recursive: true });
-  for (const entry of await readdir3(source, { withFileTypes: true })) {
+  await mkdir4(target, { recursive: true });
+  for (const entry of await readdir4(source, { withFileTypes: true })) {
     if (entry.isSymbolicLink()) throw new Error(`Arquivo de distribui\xE7\xE3o n\xE3o pode ser link: ${entry.name}.`);
     if (entry.isDirectory()) await copyTree(join2(source, entry.name), join2(target, entry.name));
     else if (entry.isFile()) await copyFile2(join2(source, entry.name), join2(target, entry.name));
@@ -689,12 +861,13 @@ async function checkBuild(config) {
   const lock = await verifySource(config);
   const generated = await generatedManifest(config);
   const directory = runtimeDirectory(config);
-  const manifest = JSON.parse(await readFile4(join2(directory, "manifest.json"), "utf8"));
-  if (manifest.formatVersion !== 1 || manifest.platform !== process.platform || manifest.arch !== process.arch || manifest.sourceRevision !== lock.source.revision || generated.sourceHash !== lock.source.treeHash || manifest.contractHash !== generated.contractHash || !manifest.generatedFileHashes || Object.entries(generated.fileHashes).some(([name, hash2]) => manifest.generatedFileHashes[name] !== hash2) || typeof manifest.executable !== "string" || !manifest.files || !Object.hasOwn(manifest.files, manifest.executable)) throw new Error("Runtime diverge das fontes ou contrato. Execute build.");
-  for (const [path4, expected] of Object.entries(manifest.files)) {
-    if (path4.startsWith("/") || path4.includes("\\") || path4.split("/").includes("..") || !/^[a-f0-9]{64}$/.test(expected)) throw new Error(`Caminho/hash inv\xE1lido no runtime: ${path4}.`);
-    if (await fileHash(join2(directory, path4)) !== expected) throw new Error(`Hash inv\xE1lido no runtime: ${path4}.`);
+  const manifest = JSON.parse(await readFile5(join2(directory, "manifest.json"), "utf8"));
+  if (manifest.formatVersion !== 1 || manifest.platform !== process.platform || manifest.arch !== process.arch || manifest.sourceRevision !== lock.source.revision || generated.sourceHash !== lock.source.treeHash || manifest.contractHash !== generated.contractHash || !manifest.generatedFileHashes || Object.entries(generated.fileHashes).some(([name, hash2]) => manifest.generatedFileHashes[name] !== hash2) || !Array.isArray(manifest.capabilities) || !manifest.capabilities.includes("recuperarXml") || typeof manifest.executable !== "string" || !manifest.files || !Object.hasOwn(manifest.files, manifest.executable)) throw new Error("Runtime diverge das fontes ou contrato. Execute build.");
+  for (const [path5, expected] of Object.entries(manifest.files)) {
+    if (path5.startsWith("/") || path5.includes("\\") || path5.split("/").includes("..") || !/^[a-f0-9]{64}$/.test(expected)) throw new Error(`Caminho/hash inv\xE1lido no runtime: ${path5}.`);
+    if (await fileHash(join2(directory, path5)) !== expected) throw new Error(`Hash inv\xE1lido no runtime: ${path5}.`);
   }
+  await auditRuntimeLicenses(directory, manifest);
   return manifest;
 }
 async function doctor(config) {
@@ -732,8 +905,8 @@ async function doctor(config) {
   return items;
 }
 async function copyCompilerLicenses(config, stage, lazarus) {
-  const packagedLazarus = fileURLToPath(new URL("../docs/licenses/lazarus/", import.meta.url));
-  const packagedFpc = fileURLToPath(new URL("../docs/licenses/fpc/", import.meta.url));
+  const packagedLazarus = fileURLToPath2(new URL("../docs/licenses/lazarus/", import.meta.url));
+  const packagedFpc = fileURLToPath2(new URL("../docs/licenses/fpc/", import.meta.url));
   const notices = {};
   async function copyNotice(name, candidates2) {
     for (const source of candidates2) if (await exists(source)) {
@@ -756,11 +929,11 @@ async function copyCompilerLicenses(config, stage, lazarus) {
   const candidates = [join2(fpcRoot, "doc"), fpcRoot, join2(lazarus, "fpc"), "/usr/share/doc/fp-compiler-3.2.2", "/usr/share/doc/fp-units-rtl-3.2.2"];
   for (const directory of candidates) {
     if (!await exists(directory)) continue;
-    for (const name of await readdir3(directory)) {
+    for (const name of await readdir4(directory)) {
       if (/^(?:copying|license|copyright)/i.test(name) && (await stat2(join2(directory, name))).isFile()) await copyFile2(join2(directory, name), join2(stage, "licenses", `FPC-${basename(directory)}-${name}`));
     }
   }
-  await writeFile3(join2(stage, "licenses/toolchain-notices.json"), `${JSON.stringify(notices, null, 2)}
+  await writeFile4(join2(stage, "licenses/toolchain-notices.json"), `${JSON.stringify(notices, null, 2)}
 `);
 }
 var REQUIRED_DYNAMIC, CORE_SYSTEM;
@@ -768,6 +941,7 @@ var init_native_build = __esm({
   "src/native-build.ts"() {
     "use strict";
     init_source();
+    init_runtime_license_inventory();
     REQUIRED_DYNAMIC = ["libssl.so.3", "libcrypto.so.3", "libxml2.so.2"];
     CORE_SYSTEM = /^(?:lib(?:c|m|pthread|dl|rt|resolv|anl|util)\.so(?:\.|$)|ld-linux|linux-vdso)/;
   }
@@ -785,12 +959,12 @@ __export(generator_exports, {
   renderPascal: () => renderPascal,
   renderTypeScript: () => renderTypeScript
 });
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
-import { mkdir as mkdir4, readFile as readFile5, writeFile as writeFile4, readdir as readdir4 } from "node:fs/promises";
-import path2 from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { mkdir as mkdir5, readFile as readFile6, writeFile as writeFile5, readdir as readdir5 } from "node:fs/promises";
+import path3 from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 function buildModelIR(raw) {
   const declarations = /* @__PURE__ */ new Map();
   for (const unit of raw.units) for (const type of unit.types) declarations.set((unit.name + "." + type.name).toLowerCase(), { unit, type });
@@ -1086,54 +1260,54 @@ function renderClientIndex() {
 async function fingerprint(dir) {
   const files = [];
   async function walk(d) {
-    for (const entry of await readdir4(d, { withFileTypes: true })) {
-      const f = path2.join(d, entry.name);
+    for (const entry of await readdir5(d, { withFileTypes: true })) {
+      const f = path3.join(d, entry.name);
       if (entry.isDirectory()) await walk(f);
       else if (/\.(pas|pp|inc|xsd)$/i.test(entry.name)) files.push(f);
     }
   }
   await walk(dir);
-  const digest = createHash3("sha256");
+  const digest2 = createHash4("sha256");
   for (const f of files.sort()) {
-    digest.update(path2.relative(dir, f).replaceAll("\\", "/"));
-    digest.update(await readFile5(f));
+    digest2.update(path3.relative(dir, f).replaceAll("\\", "/"));
+    digest2.update(await readFile6(f));
   }
-  return digest.digest("hex");
+  return digest2.digest("hex");
 }
 async function generateModel(options) {
-  const root = path2.resolve(options.outputDir), cache = path2.join(root, ".acbr/generated"), bin = path2.join(root, ".acbr/bin");
-  const models = path2.resolve(root, options.modelOutputDir ?? "generated/acbr"), native = path2.resolve(root, options.nativeOutputDir ?? "native/generated");
-  await Promise.all([mkdir4(cache, { recursive: true }), mkdir4(bin, { recursive: true }), mkdir4(models, { recursive: true }), mkdir4(native, { recursive: true })]);
-  const extractor = options.extractorPath ?? fileURLToPath2(new URL("../tools/extract-model.lpr", import.meta.url));
-  const executable = path2.join(bin, "extract-model" + (process.platform === "win32" ? ".exe" : ""));
+  const root = path3.resolve(options.outputDir), cache = path3.join(root, ".acbr/generated"), bin = path3.join(root, ".acbr/bin");
+  const models = path3.resolve(root, options.modelOutputDir ?? "generated/acbr"), native = path3.resolve(root, options.nativeOutputDir ?? "native/generated");
+  await Promise.all([mkdir5(cache, { recursive: true }), mkdir5(bin, { recursive: true }), mkdir5(models, { recursive: true }), mkdir5(native, { recursive: true })]);
+  const extractor = options.extractorPath ?? fileURLToPath3(new URL("../tools/extract-model.lpr", import.meta.url));
+  const executable = path3.join(bin, "extract-model" + (process.platform === "win32" ? ".exe" : ""));
   try {
     await execute(options.fpcPath ?? "fpc", ["-Mobjfpc", "-Sh", "-FU" + bin, "-FE" + bin, extractor], { cwd: root, maxBuffer: 8 * 1024 * 1024 });
-    await execute(executable, [path2.resolve(options.acbrRoot), path2.join(cache, "raw-model.json"), process.platform === "win32" ? "win64" : "linux"], { cwd: root, maxBuffer: 8 * 1024 * 1024 });
+    await execute(executable, [path3.resolve(options.acbrRoot), path3.join(cache, "raw-model.json"), process.platform === "win32" ? "win64" : "linux"], { cwd: root, maxBuffer: 8 * 1024 * 1024 });
   } catch (error) {
     const e = error;
     throw new Error("Extra\xE7\xE3o FCL-passrc falhou: " + (e.stderr ?? "") + (e.stdout ?? "") + e.message);
   }
-  const raw = JSON.parse(await readFile5(path2.join(cache, "raw-model.json"), "utf8"));
+  const raw = JSON.parse(await readFile6(path3.join(cache, "raw-model.json"), "utf8"));
   const ir = buildModelIR(raw), sourceRevision = Number(options.revision);
   if (!Number.isSafeInteger(sourceRevision) || sourceRevision < 1) throw new Error("Revis\xE3o SVN inv\xE1lida");
   const sourceHash = options.sourceHash ?? await fingerprint(options.acbrRoot), contractHash = hash(stable({ sourceRevision, sourceHash, ir }));
   let previous;
   try {
-    previous = JSON.parse(await readFile5(path2.join(cache, "model.ir.json"), "utf8"));
+    previous = JSON.parse(await readFile6(path3.join(cache, "model.ir.json"), "utf8"));
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
   }
-  const report = compareContracts(previous, ir), reportPath = path2.join(cache, "changes.json"), manifestPath = path2.join(cache, "manifest.json");
-  const files = [path2.relative(root, path2.join(models, "models.ts")), path2.relative(root, path2.join(models, "index.ts")), path2.relative(root, path2.join(native, "AcbrModels.pas"))].map((f) => f.replaceAll("\\", "/"));
+  const report = compareContracts(previous, ir), reportPath = path3.join(cache, "changes.json"), manifestPath = path3.join(cache, "manifest.json");
+  const files = [path3.relative(root, path3.join(models, "models.ts")), path3.relative(root, path3.join(models, "index.ts")), path3.relative(root, path3.join(native, "AcbrModels.pas"))].map((f) => f.replaceAll("\\", "/"));
   const content = [renderTypeScript(ir, sourceRevision, contractHash), renderClientIndex(), renderPascal(ir, sourceRevision, contractHash)];
   const fileHashes = Object.fromEntries(files.map((file, index) => [file, hash(content[index])]));
-  const metadataPath = path2.join(models, "contract.json"), metadataContent = renderContractMetadata(ir, sourceRevision, sourceHash, contractHash);
+  const metadataPath = path3.join(models, "contract.json"), metadataContent = renderContractMetadata(ir, sourceRevision, sourceHash, contractHash);
   await Promise.all([
-    ...files.map((file, index) => writeFile4(path2.resolve(root, file), content[index], "utf8")),
-    writeFile4(path2.join(cache, "model.ir.json"), JSON.stringify(ir, null, 2) + "\n", "utf8"),
-    writeFile4(metadataPath, metadataContent, "utf8"),
-    writeFile4(reportPath, JSON.stringify(report, null, 2) + "\n", "utf8"),
-    writeFile4(manifestPath, JSON.stringify({ schemaVersion: 1, sourceRevision, sourceHash, contractHash, root: ir.root, models: ir.types.length, files, fileHashes, metadata: { file: path2.relative(root, metadataPath).replaceAll("\\", "/"), sha256: hash(metadataContent) } }, null, 2) + "\n", "utf8")
+    ...files.map((file, index) => writeFile5(path3.resolve(root, file), content[index], "utf8")),
+    writeFile5(path3.join(cache, "model.ir.json"), JSON.stringify(ir, null, 2) + "\n", "utf8"),
+    writeFile5(metadataPath, metadataContent, "utf8"),
+    writeFile5(reportPath, JSON.stringify(report, null, 2) + "\n", "utf8"),
+    writeFile5(manifestPath, JSON.stringify({ schemaVersion: 1, sourceRevision, sourceHash, contractHash, root: ir.root, models: ir.types.length, files, fileHashes, metadata: { file: path3.relative(root, metadataPath).replaceAll("\\", "/"), sha256: hash(metadataContent) } }, null, 2) + "\n", "utf8")
   ]);
   return { contractHash, sourceHash, models: ir.types.length, reportPath, manifestPath, metadataPath };
 }
@@ -1168,14 +1342,19 @@ var init_generator = __esm({
       ttime: { kind: "datetime" }
     };
     stable = (value) => JSON.stringify(value);
-    hash = (value) => createHash3("sha256").update(value).digest("hex");
+    hash = (value) => createHash4("sha256").update(value).digest("hex");
     tsType = (p) => p.kind === "object" ? p.ref + "Input" : p.kind === "list" ? p.ref + "Input" : p.kind === "enum" ? p.ref : p.kind === "integer" ? "number" : p.kind === "boolean" ? "boolean" : "string";
   }
 });
 
 // src/diagnostics.ts
+function base64XmlRecuperadoValido(value) {
+  if (typeof value !== "string" || value.length === 0 || value.length > Math.ceil(MAX_RECOVERED_XML_BYTES / 3) * 4) return false;
+  const bytes = Buffer.from(value, "base64");
+  return bytes.length > 0 && bytes.length <= MAX_RECOVERED_XML_BYTES && bytes.toString("base64") === value;
+}
 function etapaDaOperacao(comando) {
-  return { gerarXml: "geracao", validar: "validacao", assinar: "assinatura", transmitir: "transmissao", consultar: "consulta", cancelar: "cancelamento", cartaCorrecao: "carta_correcao", inutilizar: "inutilizacao" }[comando] ?? "operacao";
+  return { gerarXml: "geracao", validar: "validacao", assinar: "assinatura", transmitir: "transmissao", consultar: "consulta", recuperarXml: "consulta", cancelar: "cancelamento", cartaCorrecao: "carta_correcao", inutilizar: "inutilizacao" }[comando] ?? "operacao";
 }
 function criarDiagnosticoErro(codigo, desconhecido = false, detalhes = {}) {
   const safeCode = Object.hasOwn(CATALOGO, codigo) ? codigo : "FALHA_LOCAL";
@@ -1212,18 +1391,30 @@ function diagnosticarResultado(resultado, comando) {
   const protocolo = typeof resultado.protocolo === "string" && /^\d{15}$/.test(resultado.protocolo);
   const chave = typeof resultado.chave === "string" && /^\d{44}$/.test(resultado.chave);
   const autorizacao = (comando === "transmitir" || comando === "consultar") && resultado.estado === "AUTORIZADO" && [100, 150].includes(resultado.cStat) && protocolo && chave && (comando === "consultar" || resultado.envioIniciado !== false);
+  const xmlRecuperado = comando === "recuperarXml" && base64XmlRecuperadoValido(resultado.xmlBase64);
+  const recuperacao = comando === "recuperarXml" && resultado.estado === "XML_RECUPERADO" && resultado.cStat === 100 && protocolo && chave && semEvento && xmlRecuperado;
   const evento = comando === "cancelar" && resultado.estado === "CANCELADO" && [135, 136].includes(resultado.cStat) && chave || comando === "cartaCorrecao" && resultado.estado === "EVENTO_REGISTRADO" && resultado.cStat === 135 && chave || comando === "inutilizar" && resultado.estado === "INUTILIZADO" && resultado.cStat === 102;
   if (local && resultado.sucesso === true && semEvento) {
     statusEnvio = "nao_enviado";
     codigo = "ETAPA_LOCAL_CONCLUIDA";
     mensagem = "A etapa local foi conclu\xEDda; esta opera\xE7\xE3o n\xE3o transmitiu a nota.";
     acao = "Confira o resultado antes de seguir para a pr\xF3xima etapa.";
+  } else if (resultado.sucesso === true && recuperacao) {
+    statusEnvio = "autorizado";
+    codigo = "XML_RECUPERADO";
+    mensagem = "O XML autorizado foi recuperado por consulta; esta opera\xE7\xE3o n\xE3o transmitiu a nota.";
+    acao = "Guarde o XML recuperado com o protocolo de autoriza\xE7\xE3o.";
+  } else if (comando === "recuperarXml" && resultado.sucesso === false && resultado.codigo === "RECUPERACAO_NAO_COMPROVADA" && ["CONSULTADO", "ERRO"].includes(resultado.estado) && semEvento) {
+    statusEnvio = "nao_enviado";
+    codigo = "RECUPERACAO_NAO_COMPROVADA";
+    mensagem = CATALOGO.RECUPERACAO_NAO_COMPROVADA[1];
+    acao = CATALOGO.RECUPERACAO_NAO_COMPROVADA[2];
   } else if (resultado.sucesso === true && (autorizacao || evento && protocolo && resultado.envioIniciado !== false)) {
     statusEnvio = "autorizado";
     codigo = "OPERACAO_CONFIRMADA";
     mensagem = { AUTORIZADO: "A nota foi autorizada.", CANCELADO: "O cancelamento foi confirmado.", EVENTO_REGISTRADO: "O evento foi registrado.", INUTILIZADO: "A faixa foi inutilizada." }[resultado.estado];
     acao = "Guarde o resultado fiscal. N\xE3o repita esta opera\xE7\xE3o.";
-  } else if (resultado.sucesso === false && (comando === "consultar" || resultado.envioIniciado !== false) && ["transmitir", "consultar", "cancelar", "cartaCorrecao", "inutilizar"].includes(comando) && Number.isInteger(resultado.cStat) && Number(resultado.cStat) > 0 && Number(resultado.cStat) <= 9999 && (resultado.estado === "DENEGADO" && [110, 301, 302].includes(resultado.cStat) || resultado.estado === "REJEITADO" && ![100, 150, 110, 301, 302, 101, 151, 155, 103, 104, 105, 108, 109, 204, 539, 573, 135, 136, 102, 217].includes(resultado.cStat))) {
+  } else if (resultado.sucesso === false && (comando === "consultar" || comando === "recuperarXml" || resultado.envioIniciado !== false) && ["transmitir", "consultar", "recuperarXml", "cancelar", "cartaCorrecao", "inutilizar"].includes(comando) && Number.isInteger(resultado.cStat) && Number(resultado.cStat) > 0 && Number(resultado.cStat) <= 9999 && (resultado.estado === "DENEGADO" && [110, 301, 302].includes(resultado.cStat) || resultado.estado === "REJEITADO" && ![100, 150, 110, 301, 302, 101, 151, 155, 103, 104, 105, 108, 109, 204, 539, 573, 135, 136, 102, 217].includes(resultado.cStat))) {
     statusEnvio = "rejeitado";
     codigo = resultado.estado === "DENEGADO" ? "NOTA_DENEGADA" : "OPERACAO_REJEITADA";
     mensagem = resultado.estado === "DENEGADO" ? "A nota foi denegada." : "A opera\xE7\xE3o foi rejeitada.";
@@ -1238,13 +1429,14 @@ function diagnosticarResultado(resultado, comando) {
   const cStat = Number.isInteger(resultado.cStat) && Number(resultado.cStat) > 0 && Number(resultado.cStat) <= 9999 ? resultado.cStat : void 0;
   return Object.freeze({ codigo, etapa, mensagem, acao, statusEnvio, ...cStat !== void 0 ? { cStat } : {} });
 }
-var ETAPAS, CAMPOS, CATALOGO;
+var ETAPAS, CAMPOS, MAX_RECOVERED_XML_BYTES, CATALOGO;
 var init_diagnostics = __esm({
   "src/diagnostics.ts"() {
     "use strict";
     init_types();
     ETAPAS = /* @__PURE__ */ new Set(["configuracao", "documento", "runtime", "geracao", "validacao", "assinatura", "transmissao", "consulta", "cancelamento", "carta_correcao", "inutilizacao", "operacao", "limpeza"]);
     CAMPOS = /* @__PURE__ */ new Set(["cnpj", "uf", "modelo", "ambiente", "contrato", "certificado", "certificado.senha", "certificado.pfx", "certificado.arquivo", "csc", "csc.id", "csc.valor", "timeoutMs", "limiteFila", "limiteBytes", "runtimeDirectory", "documento", "xml", "consulta", "chave", "recibo", "cancelamento", "protocolo", "justificativa", "cartaCorrecao", "correcao", "sequenciaEvento", "inutilizacao", "ano", "serie", "numeroInicial", "numeroFinal", "operacao", "signal"]);
+    MAX_RECOVERED_XML_BYTES = 4 * 1024 * 1024;
     CATALOGO = {
       CONFIGURACAO_INVALIDA: ["configuracao", "A configura\xE7\xE3o cont\xE9m um campo inv\xE1lido.", "Confira o campo indicado e seu tipo antes de continuar."],
       CONTRATO_INVALIDO: ["configuracao", "O contrato do cliente \xE9 inv\xE1lido.", "Use o contrato gerado junto com o cliente."],
@@ -1260,6 +1452,7 @@ var init_diagnostics = __esm({
       XML_NAO_ASSINADO: ["assinatura", "A opera\xE7\xE3o exige XML previamente assinado.", "Conclua a assinatura e a valida\xE7\xE3o antes de transmitir."],
       XML_ALTERADO: ["assinatura", "O XML assinado foi alterado.", "Use exatamente o XML assinado e persistido; n\xE3o edite seu conte\xFAdo."],
       RETORNO_INVALIDO: ["transmissao", "A identidade ou o protocolo do retorno fiscal \xE9 inv\xE1lido.", "Consulte a situa\xE7\xE3o fiscal antes de decidir repetir a opera\xE7\xE3o."],
+      RECUPERACAO_NAO_COMPROVADA: ["consulta", "A consulta n\xE3o comprovou a recupera\xE7\xE3o do XML autorizado.", "Preserve o XML assinado original e confira a situa\xE7\xE3o fiscal. N\xE3o transmita a nota para tentar recuperar o protocolo."],
       OPERACAO_FISCAL_FALHOU: ["operacao", "O motor n\xE3o conseguiu concluir a etapa fiscal.", "Confira a configura\xE7\xE3o da etapa, os dados do XML e as depend\xEAncias do runtime."],
       TLS_SERVIDOR_INVALIDO: ["transmissao", "A verifica\xE7\xE3o TLS do servi\xE7o fiscal falhou.", "Confira o servi\xE7o e a cadeia de confian\xE7a; mantenha a verifica\xE7\xE3o TLS habilitada."],
       CSC_INVALIDO: ["configuracao", "A configura\xE7\xE3o do CSC \xE9 inv\xE1lida.", "Confira id e valor do CSC sem registrar seu conte\xFAdo."],
@@ -1268,6 +1461,7 @@ var init_diagnostics = __esm({
       RUNTIME_INVALIDO: ["runtime", "O runtime fiscal \xE9 inv\xE1lido.", "Use um runtime distribu\xEDdo e compat\xEDvel com a plataforma."],
       RUNTIME_INCOMPLETO: ["runtime", "Falta um arquivo do runtime fiscal.", "Reinstale o runtime da plataforma."],
       RUNTIME_ALTERADO: ["runtime", "A integridade do runtime fiscal n\xE3o foi confirmada.", "Reinstale o runtime; n\xE3o desative a verifica\xE7\xE3o dos hashes."],
+      RUNTIME_SEM_CAPACIDADE: ["runtime", "O runtime instalado n\xE3o oferece esta opera\xE7\xE3o.", "Atualize o pacote principal e o runtime da plataforma para vers\xF5es compat\xEDveis com a opera\xE7\xE3o solicitada."],
       CONTRATO_DIVERGENTE: ["runtime", "Cliente e motor usam contratos diferentes.", "Use vers\xF5es compat\xEDveis ou regenere e recompile ambos."],
       DOCUMENTO_INVALIDO: ["documento", "O documento cont\xE9m dados incompat\xEDveis com o modelo.", "Valide os campos e tipos do documento antes de gerar o XML."],
       OPERACAO_INVALIDA: ["operacao", "Os par\xE2metros da opera\xE7\xE3o s\xE3o inv\xE1lidos.", "Informe um objeto com os campos exigidos pela opera\xE7\xE3o."],
@@ -1330,68 +1524,69 @@ var init_types = __esm({
 
 // src/runtime.ts
 import { spawn as spawn2 } from "node:child_process";
-import { readFile as readFile6, stat as stat3 } from "node:fs/promises";
-import path3 from "node:path";
+import { readFile as readFile7, stat as stat3 } from "node:fs/promises";
+import path4 from "node:path";
 import { createRequire } from "node:module";
-import { createHash as createHash4, randomUUID as randomUUID3 } from "node:crypto";
+import { createHash as createHash5, randomUUID as randomUUID3 } from "node:crypto";
 import { TextDecoder } from "node:util";
 function confined(root, relative3) {
-  const file = path3.resolve(root, relative3), part = path3.relative(root, file);
-  if (!relative3 || path3.isAbsolute(relative3) || part === ".." || part.startsWith(".." + path3.sep)) throw fail2("RUNTIME_INVALIDO", "Caminho inv\xE1lido no runtime.");
+  const file = path4.resolve(root, relative3), part = path4.relative(root, file);
+  if (!relative3 || path4.isAbsolute(relative3) || part === ".." || part.startsWith(".." + path4.sep)) throw fail3("RUNTIME_INVALIDO", "Caminho inv\xE1lido no runtime.");
   return file;
 }
 async function resolveRuntime(directory, contract) {
-  if (!validContract(contract)) throw fail2("CONTRATO_INVALIDO", "Contrato gerado inv\xE1lido.");
+  if (!validContract(contract)) throw fail3("CONTRATO_INVALIDO", "Contrato gerado inv\xE1lido.");
   let root = directory;
   if (!root) {
-    if (!["linux", "win32"].includes(process.platform) || process.arch !== "x64") throw fail2("PLATAFORMA_NAO_SUPORTADA", "Esta vers\xE3o exige Linux ou Windows x64.");
+    if (!["linux", "win32"].includes(process.platform) || process.arch !== "x64") throw fail3("PLATAFORMA_NAO_SUPORTADA", "Esta vers\xE3o exige Linux ou Windows x64.");
     try {
       const require2 = createRequire(typeof __filename !== "undefined" ? __filename : import.meta.url);
-      root = path3.join(path3.dirname(require2.resolve("cosmemilton-acbr-node-" + process.platform + "-x64/package.json")), "runtime");
+      root = path4.join(path4.dirname(require2.resolve("cosmemilton-acbr-node-" + process.platform + "-x64/package.json")), "runtime");
     } catch {
-      throw fail2("RUNTIME_AUSENTE", "Instale o pacote de runtime da plataforma ou informe runtimeDirectory.");
+      throw fail3("RUNTIME_AUSENTE", "Instale o pacote de runtime da plataforma ou informe runtimeDirectory.");
     }
   }
-  root = path3.resolve(root);
+  root = path4.resolve(root);
   let m;
   try {
-    m = JSON.parse(await readFile6(path3.join(root, "manifest.json"), "utf8"));
+    m = JSON.parse(await readFile7(path4.join(root, "manifest.json"), "utf8"));
   } catch {
-    throw fail2("RUNTIME_AUSENTE", "Manifesto do runtime n\xE3o encontrado.");
+    throw fail3("RUNTIME_AUSENTE", "Manifesto do runtime n\xE3o encontrado.");
   }
-  if (!validContract(m) || m.formatVersion !== 1 || !plain(m.files) || typeof m.executable !== "string" || m.platform !== process.platform || m.arch !== process.arch) throw fail2("RUNTIME_INVALIDO", "Manifesto ou plataforma do runtime inv\xE1lidos.");
-  if (m.sourceRevision !== contract.sourceRevision || m.contractHash !== contract.contractHash) throw fail2("CONTRATO_DIVERGENTE", "Cliente e motor foram gerados de contratos diferentes; regenere e recompile.");
+  if (!validContract(m) || m.formatVersion !== 1 || !plain(m.files) || typeof m.executable !== "string" || m.platform !== process.platform || m.arch !== process.arch) throw fail3("RUNTIME_INVALIDO", "Manifesto ou plataforma do runtime inv\xE1lidos.");
+  if (m.capabilities !== void 0 && (!Array.isArray(m.capabilities) || !m.capabilities.every((value) => typeof value === "string" && /^[A-Za-z][A-Za-z0-9_]{0,63}$/.test(value)))) throw fail3("RUNTIME_INVALIDO", "Capacidades do runtime inv\xE1lidas.");
+  if (m.sourceRevision !== contract.sourceRevision || m.contractHash !== contract.contractHash) throw fail3("CONTRATO_DIVERGENTE", "Cliente e motor foram gerados de contratos diferentes; regenere e recompile.");
   for (const [name, hash2] of Object.entries(m.files)) {
-    if (typeof hash2 !== "string" || !/^[a-f0-9]{64}$/.test(hash2)) throw fail2("RUNTIME_INVALIDO", "Hash inv\xE1lido no runtime.");
+    if (typeof hash2 !== "string" || !/^[a-f0-9]{64}$/.test(hash2)) throw fail3("RUNTIME_INVALIDO", "Hash inv\xE1lido no runtime.");
     const file = confined(root, name);
     let data;
     try {
       if (!(await stat3(file)).isFile()) throw Error();
-      data = await readFile6(file);
+      data = await readFile7(file);
     } catch {
-      throw fail2("RUNTIME_INCOMPLETO", "Arquivo do runtime ausente.");
+      throw fail3("RUNTIME_INCOMPLETO", "Arquivo do runtime ausente.");
     }
-    if (createHash4("sha256").update(data).digest("hex") !== hash2) throw fail2("RUNTIME_ALTERADO", "O runtime n\xE3o corresponde ao manifesto distribu\xEDdo.");
+    if (createHash5("sha256").update(data).digest("hex") !== hash2) throw fail3("RUNTIME_ALTERADO", "O runtime n\xE3o corresponde ao manifesto distribu\xEDdo.");
   }
-  if (!m.files[m.executable]) throw fail2("RUNTIME_INVALIDO", "O execut\xE1vel n\xE3o consta no invent\xE1rio.");
-  return { directory: root, executable: confined(root, m.executable) };
+  if (!m.files[m.executable]) throw fail3("RUNTIME_INVALIDO", "O execut\xE1vel n\xE3o consta no invent\xE1rio.");
+  return { directory: root, executable: confined(root, m.executable), capabilities: new Set(m.capabilities ?? []) };
 }
 function criarEmissor(options) {
-  const configFail = (campo) => fail2("CONFIGURACAO_INVALIDA", "Informe campos e tipos v\xE1lidos na configura\xE7\xE3o.", void 0, false, { etapa: "configuracao", campo });
+  const configFail = (campo) => fail3("CONFIGURACAO_INVALIDA", "Informe campos e tipos v\xE1lidos na configura\xE7\xE3o.", void 0, false, { etapa: "configuracao", campo });
   if (!plain(options)) throw configFail();
   if (typeof options.cnpj !== "string" || !/^\d{14}$/.test(options.cnpj)) throw configFail("cnpj");
   if (typeof options.uf !== "string" || !UFS.has(options.uf)) throw configFail("uf");
   if (![55, 65].includes(options.modelo)) throw configFail("modelo");
   if (![1, 2].includes(options.ambiente)) throw configFail("ambiente");
-  if (!validContract(options.contrato)) throw fail2("CONTRATO_INVALIDO", "Contrato gerado inv\xE1lido.");
+  if (!validContract(options.contrato)) throw fail3("CONTRATO_INVALIDO", "Contrato gerado inv\xE1lido.");
   const cert = options.certificado;
-  if (cert !== void 0 && (!plain(cert) || typeof cert.senha !== "string" || !!cert.pfx === !!cert.arquivo || cert.pfx !== void 0 && !(cert.pfx instanceof Uint8Array) || cert.arquivo !== void 0 && (typeof cert.arquivo !== "string" || !cert.arquivo))) throw fail2("CERTIFICADO_INVALIDO", "Informe A1 em pfx ou arquivo e sua senha.", void 0, false, { campo: "certificado" });
-  if (options.csc !== void 0 && (!plain(options.csc) || typeof options.csc.id !== "string" || !/^\d{1,6}$/.test(options.csc.id) || typeof options.csc.valor !== "string" || !options.csc.valor || options.csc.valor.length > 256)) throw fail2("CSC_INVALIDO", "CSC inv\xE1lido.", void 0, false, { campo: "csc" });
+  if (cert !== void 0 && (!plain(cert) || typeof cert.senha !== "string" || !!cert.pfx === !!cert.arquivo || cert.pfx !== void 0 && !(cert.pfx instanceof Uint8Array) || cert.arquivo !== void 0 && (typeof cert.arquivo !== "string" || !cert.arquivo))) throw fail3("CERTIFICADO_INVALIDO", "Informe A1 em pfx ou arquivo e sua senha.", void 0, false, { campo: "certificado" });
+  if (options.csc !== void 0 && (!plain(options.csc) || typeof options.csc.id !== "string" || !/^\d{1,6}$/.test(options.csc.id) || typeof options.csc.valor !== "string" || !options.csc.valor || options.csc.valor.length > 256)) throw fail3("CSC_INVALIDO", "CSC inv\xE1lido.", void 0, false, { campo: "csc" });
   if (options.runtimeDirectory !== void 0 && (typeof options.runtimeDirectory !== "string" || !options.runtimeDirectory)) throw configFail("runtimeDirectory");
   if (options.validaDocumento !== void 0 && typeof options.validaDocumento !== "function" || options.criaProcesso !== void 0 && typeof options.criaProcesso !== "function") throw configFail();
   const cfg = { cnpj: options.cnpj, uf: options.uf, modelo: options.modelo, ambiente: options.ambiente, csc: options.csc ? { ...options.csc } : void 0 };
   const certificate = cert ? { ...cert, pfx: cert.pfx ? Buffer.from(cert.pfx) : void 0 } : void 0;
-  const contract = { ...options.contrato };
+  const contract = { sourceRevision: options.contrato.sourceRevision, contractHash: options.contrato.contractHash };
   const timeout = options.timeoutMs ?? 12e4, capacity = options.limiteFila ?? 32, bytesLimit = options.limiteBytes ?? MAX_BYTES;
   if (!Number.isInteger(timeout) || timeout < 1 || timeout > 12e4) throw configFail("timeoutMs");
   if (!Number.isInteger(capacity) || capacity < 0 || capacity > 1e3) throw configFail("limiteFila");
@@ -1400,7 +1595,7 @@ function criarEmissor(options) {
   let runtimePromise, closed = false, teardownFailed = false, current;
   const queue = [];
   const closedError = () => {
-    const error = fail2("EMISSOR_FECHADO", "Emissor encerrado.");
+    const error = fail3("EMISSOR_FECHADO", "Emissor encerrado.");
     if (teardownFailed) error.anotarFalhaLimpeza();
     return error;
   };
@@ -1412,9 +1607,10 @@ function criarEmissor(options) {
     }
   };
   async function execute2(item) {
-    if (closed || item.signal?.aborted) throw fail2("OPERACAO_CANCELADA", "Opera\xE7\xE3o cancelada antes da execu\xE7\xE3o.");
+    if (closed || item.signal?.aborted) throw fail3("OPERACAO_CANCELADA", "Opera\xE7\xE3o cancelada antes da execu\xE7\xE3o.");
     const runtime = await (runtimePromise ??= resolveRuntime(options.runtimeDirectory, contract));
-    if (closed || item.signal?.aborted) throw fail2("OPERACAO_CANCELADA", "Opera\xE7\xE3o cancelada antes da execu\xE7\xE3o.");
+    if (item.req.comando === "recuperarXml" && !runtime.capabilities.has("recuperarXml")) throw fail3("RUNTIME_SEM_CAPACIDADE", "O runtime n\xE3o oferece recupera\xE7\xE3o de XML; atualize o pacote e o runtime compat\xEDvel.", item.req, false, { etapa: "runtime" });
+    if (closed || item.signal?.aborted) throw fail3("OPERACAO_CANCELADA", "Opera\xE7\xE3o cancelada antes da execu\xE7\xE3o.");
     return await new Promise((done, rejectExecution) => {
       let stopError;
       let child, finished = false, started = false, sending = false, total = 0, rest = Buffer.alloc(0), result;
@@ -1453,7 +1649,7 @@ function criarEmissor(options) {
       };
       const teardownFallback = () => {
         if (finished) return;
-        stopError ??= fail2("FALHA_MOTOR", "O motor n\xE3o foi encerrado.", item.req, uncertain());
+        stopError ??= fail3("FALHA_MOTOR", "O motor n\xE3o foi encerrado.", item.req, uncertain());
         stopError.anotarFalhaLimpeza();
         teardownFailed = true;
         closed = true;
@@ -1464,7 +1660,7 @@ function criarEmissor(options) {
       };
       const stop = (code, message) => {
         if (finished || stopError) return;
-        stopError = fail2(code, message, item.req, uncertain());
+        stopError = fail3(code, message, item.req, uncertain());
         if (!child?.pid) {
           finish(stopError);
           detachOwnedChild();
@@ -1482,20 +1678,20 @@ function criarEmissor(options) {
       current = { stop: () => stop("EMISSOR_FECHADO", "Emissor encerrado."), done: doneCurrent };
       const env = {};
       for (const key of ["PATH", "Path", "SystemRoot", "WINDIR", "TEMP", "TMP", "HOME", "LANG", "LC_ALL"]) if (process.env[key] !== void 0) env[key] = process.env[key];
-      if (process.platform === "linux") env.LD_LIBRARY_PATH = path3.join(runtime.directory, "lib");
+      if (process.platform === "linux") env.LD_LIBRARY_PATH = path4.join(runtime.directory, "lib");
       if (process.platform === "win32") {
         const inheritedPath = env.Path ?? env.PATH ?? "";
         delete env.Path;
-        env.PATH = path3.join(runtime.directory, "lib") + ";" + runtime.directory + ";" + inheritedPath;
+        env.PATH = path4.join(runtime.directory, "lib") + ";" + runtime.directory + ";" + inheritedPath;
       }
-      const modules = path3.join(runtime.directory, "ossl-modules");
+      const modules = path4.join(runtime.directory, "ossl-modules");
       env.OPENSSL_MODULES = modules;
-      env.OPENSSL_CONF = path3.join(runtime.directory, "openssl.cnf");
+      env.OPENSSL_CONF = path4.join(runtime.directory, "openssl.cnf");
       try {
         child = launch(runtime.executable, ["--parent-pid", String(process.pid)], { cwd: runtime.directory, env, windowsHide: true, shell: false, stdio: ["pipe", "pipe", "pipe"] });
         started = typeof child.pid === "number";
       } catch {
-        finish(fail2("FALHA_INICIAR_MOTOR", "N\xE3o foi poss\xEDvel iniciar o motor.", item.req));
+        finish(fail3("FALHA_INICIAR_MOTOR", "N\xE3o foi poss\xEDvel iniciar o motor.", item.req));
         return;
       }
       item.signal?.addEventListener("abort", abort, { once: true });
@@ -1536,9 +1732,11 @@ function criarEmissor(options) {
               continue;
             }
             if (result || frame.versao !== 1 || frame.sourceRevision !== contract.sourceRevision || frame.contractHash !== contract.contractHash || typeof frame.sucesso !== "boolean" || !STATES.has(String(frame.estado))) throw Error();
-            if (frame.xmlBase64 !== void 0 && (typeof frame.xmlBase64 !== "string" || !frame.xmlBase64.length || Buffer.from(frame.xmlBase64, "base64").toString("base64") !== frame.xmlBase64)) throw Error();
+            if (frame.xmlBase64 !== void 0 && (item.req.comando === "recuperarXml" ? !base64XmlRecuperadoValido(frame.xmlBase64) : typeof frame.xmlBase64 !== "string" || !frame.xmlBase64.length || Buffer.from(frame.xmlBase64, "base64").toString("base64") !== frame.xmlBase64)) throw Error();
             if (frame.cStat !== void 0 && (!Number.isInteger(frame.cStat) || Number(frame.cStat) < 1 || Number(frame.cStat) > 9999)) throw Error();
             if (frame.envioIniciado !== void 0 && typeof frame.envioIniciado !== "boolean" || sending && frame.envioIniciado === false) throw Error();
+            if (frame.estado === "XML_RECUPERADO" && item.req.comando !== "recuperarXml") throw Error();
+            if (item.req.comando === "recuperarXml" && (frame.sucesso === true || frame.estado === "XML_RECUPERADO") && (frame.sucesso !== true || frame.estado !== "XML_RECUPERADO" || frame.cStat !== 100 || typeof frame.chave !== "string" || !/^\d{44}$/.test(frame.chave) || typeof frame.protocolo !== "string" || !/^\d{15}$/.test(frame.protocolo) || typeof frame.xmlBase64 !== "string" || frame.envioIniciado === true || sending)) throw Error();
             const fiscal = frame;
             result = { ...fiscal, diagnostico: diagnosticarResultado(sending ? { ...fiscal, envioIniciado: true } : fiscal, item.req.comando) };
           } catch {
@@ -1554,7 +1752,7 @@ function criarEmissor(options) {
           return;
         }
         if (code !== 0 || rest.length || !result) {
-          finish(fail2("FALHA_MOTOR", "O motor encerrou sem resposta fiscal v\xE1lida.", item.req, uncertain()));
+          finish(fail3("FALHA_MOTOR", "O motor encerrou sem resposta fiscal v\xE1lida.", item.req, uncertain()));
           return;
         }
         finish();
@@ -1583,31 +1781,31 @@ function criarEmissor(options) {
   }
   async function request(command, data, operation = {}) {
     const rawOperation = operation;
-    if (!plain(rawOperation)) throw fail2("OPERACAO_INVALIDA", "Informe op\xE7\xF5es v\xE1lidas para a opera\xE7\xE3o.", void 0, false, { etapa: etapaDaOperacao(command), campo: "operacao" });
+    if (!plain(rawOperation)) throw fail3("OPERACAO_INVALIDA", "Informe op\xE7\xF5es v\xE1lidas para a opera\xE7\xE3o.", void 0, false, { etapa: etapaDaOperacao(command), campo: "operacao" });
     const signal = operation.signal;
-    if (signal !== void 0 && (!plain(signal) || typeof signal.aborted !== "boolean" || typeof signal.addEventListener !== "function" || typeof signal.removeEventListener !== "function")) throw fail2("OPERACAO_INVALIDA", "Informe op\xE7\xF5es v\xE1lidas para a opera\xE7\xE3o.", void 0, false, { etapa: etapaDaOperacao(command), campo: "signal" });
+    if (signal !== void 0 && (!plain(signal) || typeof signal.aborted !== "boolean" || typeof signal.addEventListener !== "function" || typeof signal.removeEventListener !== "function")) throw fail3("OPERACAO_INVALIDA", "Informe op\xE7\xF5es v\xE1lidas para a opera\xE7\xE3o.", void 0, false, { etapa: etapaDaOperacao(command), campo: "signal" });
     if (closed) throw closedError();
-    if (operation.signal?.aborted) throw fail2("OPERACAO_CANCELADA", "Opera\xE7\xE3o cancelada antes da execu\xE7\xE3o.");
-    if (["assinar", "transmitir", "consultar", "cancelar", "cartaCorrecao", "inutilizar"].includes(command) && !certificate) throw fail2("CERTIFICADO_AUSENTE", "A opera\xE7\xE3o exige um certificado A1.");
+    if (operation.signal?.aborted) throw fail3("OPERACAO_CANCELADA", "Opera\xE7\xE3o cancelada antes da execu\xE7\xE3o.");
+    if (["assinar", "transmitir", "consultar", "recuperarXml", "cancelar", "cartaCorrecao", "inutilizar"].includes(command) && !certificate) throw fail3("CERTIFICADO_AUSENTE", "A opera\xE7\xE3o exige um certificado A1.", void 0, false, { etapa: etapaDaOperacao(command) });
     if (command === "gerarXml") options.validaDocumento?.(data.documento);
     const config = { ...cfg };
     if (certificate) {
       let pfx;
       try {
-        pfx = certificate.pfx ?? await readFile6(certificate.arquivo);
+        pfx = certificate.pfx ?? await readFile7(certificate.arquivo);
       } catch {
-        throw fail2("CERTIFICADO_AUSENTE", "N\xE3o foi poss\xEDvel ler o A1 configurado.");
+        throw fail3("CERTIFICADO_AUSENTE", "N\xE3o foi poss\xEDvel ler o A1 configurado.");
       }
-      if (pfx.length > 2 * 1024 * 1024) throw fail2("CERTIFICADO_EXCESSIVO", "Certificado excede o limite.");
+      if (pfx.length > 2 * 1024 * 1024) throw fail3("CERTIFICADO_EXCESSIVO", "Certificado excede o limite.");
       config.certificado = { pfxBase64: pfx.toString("base64"), senha: certificate.senha };
     }
     let bytes, req;
     try {
-      bytes = Buffer.from(JSON.stringify({ versao: 1, id: randomUUID3(), ...contract, comando: command, config, ...data }) + "\n", "utf8");
+      bytes = Buffer.from(JSON.stringify({ ...data, ...contract, versao: 1, id: randomUUID3(), comando: command, config }) + "\n", "utf8");
       if (bytes.length > bytesLimit) throw Error();
       req = JSON.parse(bytes.toString("utf8"));
     } catch {
-      throw fail2("REQUISICAO_INVALIDA", "Dados da opera\xE7\xE3o inv\xE1lidos ou acima do limite.");
+      throw fail3("REQUISICAO_INVALIDA", "Dados da opera\xE7\xE3o inv\xE1lidos ou acima do limite.");
     }
     return new Promise((resolve5, reject) => {
       if (closed) {
@@ -1617,7 +1815,7 @@ function criarEmissor(options) {
       }
       if (busy && queue.length >= capacity) {
         bytes.fill(0);
-        reject(fail2("FILA_CHEIA", "A fila fiscal est\xE1 cheia."));
+        reject(fail3("FILA_CHEIA", "A fila fiscal est\xE1 cheia."));
         return;
       }
       const item = { req, bytes, signal: operation.signal, resolve: resolve5, reject };
@@ -1627,7 +1825,7 @@ function criarEmissor(options) {
           queue.splice(i, 1);
           bytes.fill(0);
           operation.signal?.removeEventListener("abort", item.abort);
-          reject(fail2("OPERACAO_CANCELADA", "Opera\xE7\xE3o cancelada antes da execu\xE7\xE3o."));
+          reject(fail3("OPERACAO_CANCELADA", "Opera\xE7\xE3o cancelada antes da execu\xE7\xE3o."));
         }
       };
       operation.signal?.addEventListener("abort", item.abort, { once: true });
@@ -1637,47 +1835,48 @@ function criarEmissor(options) {
     });
   }
   const xmlData = (xml) => {
-    if (typeof xml !== "string" || !xml.trim() || Buffer.byteLength(xml, "utf8") > 2 * 1024 * 1024) throw fail2("XML_INVALIDO", "XML vazio ou acima do limite.", void 0, false, { campo: "xml" });
+    if (typeof xml !== "string" || !xml.trim() || Buffer.byteLength(xml, "utf8") > 2 * 1024 * 1024) throw fail3("XML_INVALIDO", "XML vazio ou acima do limite.", void 0, false, { campo: "xml" });
     return { xmlBase64: Buffer.from(xml, "utf8").toString("base64") };
   };
   const checkKey = (key) => {
-    if (typeof key !== "string" || !/^\d{44}$/.test(key)) throw fail2("CHAVE_INVALIDA", "Chave fiscal inv\xE1lida.", void 0, false, { campo: "chave" });
+    if (typeof key !== "string" || !/^\d{44}$/.test(key)) throw fail3("CHAVE_INVALIDA", "Chave fiscal inv\xE1lida.", void 0, false, { campo: "chave" });
   };
   const reason = (value) => {
-    if (typeof value !== "string" || value.length < 15 || value.length > 255) throw fail2("JUSTIFICATIVA_INVALIDA", "Justificativa deve ter de 15 a 255 caracteres.", void 0, false, { campo: "justificativa" });
+    if (typeof value !== "string" || value.length < 15 || value.length > 255) throw fail3("JUSTIFICATIVA_INVALIDA", "Justificativa deve ter de 15 a 255 caracteres.", void 0, false, { campo: "justificativa" });
   };
   const checkObject = (data, campo) => {
-    if (!plain(data)) throw fail2("OPERACAO_INVALIDA", "Informe os par\xE2metros da opera\xE7\xE3o como objeto.", void 0, false, { campo });
+    if (!plain(data)) throw fail3("OPERACAO_INVALIDA", "Informe os par\xE2metros da opera\xE7\xE3o como objeto.", void 0, false, { campo });
   };
   return {
     gerarXml: (documento, op) => request("gerarXml", { documento }, op),
     validar: (xml, op) => request("validar", xmlData(xml), op),
     assinar: (xml, op) => request("assinar", xmlData(xml), op),
     transmitir: (xml, op) => request("transmitir", xmlData(xml), op),
+    recuperarXml: (xmlAssinado, opcoes) => request("recuperarXml", xmlData(xmlAssinado), opcoes),
     consultar: (consulta, op) => {
       checkObject(consulta, "consulta");
       checkKey(consulta.chave);
-      if (consulta.recibo !== void 0 && (typeof consulta.recibo !== "string" || !/^\d{15}$/.test(consulta.recibo))) throw fail2("RECIBO_INVALIDO", "Recibo inv\xE1lido.", void 0, false, { campo: "recibo" });
-      return request("consultar", consulta, op);
+      if (consulta.recibo !== void 0 && (typeof consulta.recibo !== "string" || !/^\d{15}$/.test(consulta.recibo))) throw fail3("RECIBO_INVALIDO", "Recibo inv\xE1lido.", void 0, false, { campo: "recibo" });
+      return request("consultar", { chave: consulta.chave, ...consulta.recibo !== void 0 ? { recibo: consulta.recibo } : {} }, op);
     },
     cancelar: (data, op) => {
       checkObject(data, "cancelamento");
       checkKey(data.chave);
       reason(data.justificativa);
-      if (typeof data.protocolo !== "string" || !/^\d{15}$/.test(data.protocolo)) throw fail2("PROTOCOLO_INVALIDO", "Protocolo inv\xE1lido.", void 0, false, { campo: "protocolo" });
-      return request("cancelar", data, op);
+      if (typeof data.protocolo !== "string" || !/^\d{15}$/.test(data.protocolo)) throw fail3("PROTOCOLO_INVALIDO", "Protocolo inv\xE1lido.", void 0, false, { campo: "protocolo" });
+      return request("cancelar", { chave: data.chave, protocolo: data.protocolo, justificativa: data.justificativa }, op);
     },
     cartaCorrecao: (data, op) => {
       checkObject(data, "cartaCorrecao");
-      if (cfg.modelo !== 55) throw fail2("OPERACAO_NAO_SUPORTADA", "Carta de corre\xE7\xE3o exige NF-e modelo 55.");
+      if (cfg.modelo !== 55) throw fail3("OPERACAO_NAO_SUPORTADA", "Carta de corre\xE7\xE3o exige NF-e modelo 55.");
       checkKey(data.chave);
-      if (typeof data.correcao !== "string" || data.correcao.length < 15 || data.correcao.length > 1e3 || !Number.isInteger(data.sequenciaEvento ?? 1) || (data.sequenciaEvento ?? 1) < 1 || (data.sequenciaEvento ?? 1) > 20) throw fail2("CORRECAO_INVALIDA", "Dados da carta de corre\xE7\xE3o inv\xE1lidos.", void 0, false, { campo: "cartaCorrecao" });
-      return request("cartaCorrecao", { ...data, sequenciaEvento: data.sequenciaEvento ?? 1 }, op);
+      if (typeof data.correcao !== "string" || data.correcao.length < 15 || data.correcao.length > 1e3 || !Number.isInteger(data.sequenciaEvento ?? 1) || (data.sequenciaEvento ?? 1) < 1 || (data.sequenciaEvento ?? 1) > 20) throw fail3("CORRECAO_INVALIDA", "Dados da carta de corre\xE7\xE3o inv\xE1lidos.", void 0, false, { campo: "cartaCorrecao" });
+      return request("cartaCorrecao", { chave: data.chave, correcao: data.correcao, sequenciaEvento: data.sequenciaEvento ?? 1 }, op);
     },
     inutilizar: (data, op) => {
       checkObject(data, "inutilizacao");
       reason(data.justificativa);
-      if (!Number.isInteger(data.ano) || data.ano < 0 || data.ano > 99 || !Number.isInteger(data.serie) || data.serie < 0 || data.serie > 999 || !Number.isInteger(data.numeroInicial) || data.numeroInicial < 1 || !Number.isInteger(data.numeroFinal) || data.numeroFinal < data.numeroInicial || data.numeroFinal > 999999999) throw fail2("INUTILIZACAO_INVALIDA", "Faixa de inutiliza\xE7\xE3o inv\xE1lida.", void 0, false, { campo: "inutilizacao" });
+      if (!Number.isInteger(data.ano) || data.ano < 0 || data.ano > 99 || !Number.isInteger(data.serie) || data.serie < 0 || data.serie > 999 || !Number.isInteger(data.numeroInicial) || data.numeroInicial < 1 || !Number.isInteger(data.numeroFinal) || data.numeroFinal < data.numeroInicial || data.numeroFinal > 999999999) throw fail3("INUTILIZACAO_INVALIDA", "Faixa de inutiliza\xE7\xE3o inv\xE1lida.", void 0, false, { campo: "inutilizacao" });
       return request("inutilizar", { inutilizacao: { ano: data.ano, serie: data.serie, numeroInicial: data.numeroInicial, numeroFinal: data.numeroFinal }, justificativa: data.justificativa }, op);
     },
     async fechar() {
@@ -1695,7 +1894,7 @@ function criarEmissor(options) {
     }
   };
 }
-var STATES, UFS, MAX_BYTES, MAX_TEARDOWN_MS, plain, validContract, fail2;
+var STATES, UFS, MAX_BYTES, MAX_TEARDOWN_MS, plain, validContract, fail3;
 var init_runtime = __esm({
   "src/runtime.ts"() {
     "use strict";
@@ -1703,13 +1902,13 @@ var init_runtime = __esm({
     init_diagnostics();
     init_types();
     init_diagnostics();
-    STATES = /* @__PURE__ */ new Set(["DENEGADO", "XML_GERADO", "VALIDADO", "ASSINADO", "AUTORIZADO", "REJEITADO", "PENDENTE", "INDETERMINADO", "CONSULTADO", "CANCELADO", "EVENTO_REGISTRADO", "INUTILIZADO", "ERRO"]);
+    STATES = /* @__PURE__ */ new Set(["DENEGADO", "XML_GERADO", "VALIDADO", "ASSINADO", "XML_RECUPERADO", "AUTORIZADO", "REJEITADO", "PENDENTE", "INDETERMINADO", "CONSULTADO", "CANCELADO", "EVENTO_REGISTRADO", "INUTILIZADO", "ERRO"]);
     UFS = new Set("AC AL AP AM BA CE DF ES GO MA MT MS MG PA PB PR PE PI RJ RN RS RO RR SC SP SE TO".split(" "));
     MAX_BYTES = 8 * 1024 * 1024;
     MAX_TEARDOWN_MS = 1e3;
     plain = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
     validContract = (v) => plain(v) && Number.isInteger(v.sourceRevision) && Number(v.sourceRevision) > 0 && typeof v.contractHash === "string" && /^[a-f0-9]{64}$/.test(v.contractHash);
-    fail2 = (code, message, req, unknown = false, detalhes) => new ErroAcbrNode(code, message, unknown, req?.comando === "transmitir" ? req.xmlBase64 : void 0, { ...req ? { etapa: etapaDaOperacao(req.comando) } : {}, ...detalhes });
+    fail3 = (code, message, req, unknown = false, detalhes) => new ErroAcbrNode(code, message, unknown, req?.comando === "transmitir" ? req.xmlBase64 : void 0, { ...req ? { etapa: etapaDaOperacao(req.comando) } : {}, ...detalhes });
   }
 });
 
@@ -1881,7 +2080,7 @@ var init_offline_check = __esm({
 import { realpathSync } from "node:fs";
 import { access as access4 } from "node:fs/promises";
 import { resolve as resolve4 } from "node:path";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // src/contract-help.ts
 import { createHash } from "node:crypto";
@@ -1966,8 +2165,8 @@ var fail = (message = "Os metadados do contrato s\xE3o inv\xE1lidos.") => {
 function validateContractMetadata(value) {
   const metadata = value;
   if (!metadata || metadata.formatVersion !== 1 || !Number.isSafeInteger(metadata.sourceRevision) || metadata.sourceRevision < 1 || !sha256.test(metadata.sourceHash ?? "") || !sha256.test(metadata.contractHash ?? "") || metadata.ir?.schemaVersion !== 1 || !identifier.test(metadata.ir.root ?? "") || !Array.isArray(metadata.ir.types) || metadata.ir.types.length === 0) fail();
-  const digest = createHash("sha256").update(JSON.stringify({ sourceRevision: metadata.sourceRevision, sourceHash: metadata.sourceHash, ir: metadata.ir })).digest("hex");
-  if (digest !== metadata.contractHash) fail("O hash dos metadados diverge do contrato gerado.");
+  const digest2 = createHash("sha256").update(JSON.stringify({ sourceRevision: metadata.sourceRevision, sourceHash: metadata.sourceHash, ir: metadata.ir })).digest("hex");
+  if (digest2 !== metadata.contractHash) fail("O hash dos metadados diverge do contrato gerado.");
   const types = /* @__PURE__ */ new Map();
   for (const node of metadata.ir.types) {
     if (!node || typeof node.name !== "string" || !identifier.test(node.name) || types.has(node.name) || !["object", "list", "enum"].includes(node.kind)) fail();
@@ -2172,13 +2371,13 @@ async function main(args = process.argv.slice(2), io = process, dependencies = {
       jsonTag = options.json;
       if (options.command.length !== 3) throw new FieldHelpError("USO_INVALIDO", "Use acbr-node help TAG caminho [--json].");
       if (options.revision !== void 0 || args.includes("--config")) throw new FieldHelpError("USO_INVALIDO", "help TAG usa o contrato instalado e n\xE3o aceita --config ou --revision.");
-      const description = await describeInstalledField(options.command[2], dependencies.contractRoot ?? fileURLToPath3(new URL("../", import.meta.url)));
+      const description = await describeInstalledField(options.command[2], dependencies.contractRoot ?? fileURLToPath4(new URL("../", import.meta.url)));
       output(description, formatFieldDescription(description));
       return 0;
     }
     if (command === "init") {
       const { initializeConfig: initializeConfig2 } = await Promise.resolve().then(() => (init_config(), config_exports));
-      const config2 = await initializeConfig2(options.config, options.revision, fileURLToPath3(new URL("../", import.meta.url)));
+      const config2 = await initializeConfig2(options.config, options.revision, fileURLToPath4(new URL("../", import.meta.url)));
       output({ configPath: config2.configPath }, `Configura\xE7\xE3o criada: ${config2.configPath}
 Pr\xF3ximo passo: acbr-node source update.`);
       return 0;
@@ -2250,7 +2449,7 @@ function isDirectInvocation() {
   const entry = process.argv[1];
   if (!entry) return false;
   try {
-    return realpathSync(resolve4(entry)) === realpathSync(fileURLToPath3(import.meta.url));
+    return realpathSync(resolve4(entry)) === realpathSync(fileURLToPath4(import.meta.url));
   } catch {
     return false;
   }