nfse-br 0.0.0-stage → 2.0.0

package/dist/cli/index.js

@@ -0,0 +1,1355 @@
+#!/usr/bin/env node
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { parseArgs } from "node:util";
+import { loadPortalCredentials, resolveCityCode, } from "../config/index.js";
+import { GissError, NationalError, NfseError, } from "../domain/errors.js";
+import { exportPem } from "../infra/certificate.js";
+import { isoDate } from "../infra/xml.js";
+import { nfseNumberFromKey, parseNationalEvent, parseNationalNfse, } from "../providers/nacional/messages.js";
+import { NfseClient } from "../client.js";
+import { renderDanfse } from "../providers/nacional/danfse/danfse-pdf.js";
+import { lookupParty, lookupZip, } from "../services/lookup-service.js";
+import { buildPortalParty, PortalService, } from "../providers/giss/portal-service.js";
+import { findMunicipalityByCode, MUNICIPALITIES } from "../providers/giss/municipalities.js";
+import { ContactRepository, taxIdOf, } from "../storage/contact-repository.js";
+import { syncFromInvoices } from "../storage/invoice-sync.js";
+import { buildRps, ProfileRepository } from "../storage/profile-repository.js";
+import { SCHEMA_DIRECTORIES, validateAgainstSchema, } from "../validation/schema-validator.js";
+/** `nfse ...` quando instalado (`giss` segue como apelido); `npm run nfse -- ...` no repositório. */
+const INVOCATION = process.env["npm_lifecycle_event"] ? "npm run nfse --" : "nfse";
+const HELP = `
+nfse — Brazilian NFS-e client: GissOnline (ABRASF 2.04) and the Sistema Nacional NFS-e
+
+Usage: ${INVOCATION} <command> [options]
+
+CERTIFICATE
+  cert [--export [--out DIR]]          A1 certificate details; --export writes the PEM files
+
+QUERIES (services provided)
+  latest [--limit N] [--months N]      Most recent invoices (default: 10, last 12 months)
+  issued --from D --to D               Invoices by issue period
+         [--competence]                  use the competence period instead
+         [--number N] [--page N] [--all]
+  range --first N --last N [--page N]  Invoices by number range
+  rps --number N --series S [--type 1] Invoice generated from an RPS
+  batch --protocol P                   Status of an RPS batch
+
+QUERIES (services received)
+  received --from D --to D             Invoices where you are the customer
+           [--competence] [--number N] [--page N] [--all]
+  purchased-batch --protocol P         Invoices declared in a batch (nfsc)
+  purchased-protocol --protocol P      Status of a protocol (nfsc)
+  purchased-number --from D --to D --number N --series S
+
+ISSUING
+  issue --customer X --amount V [--description T]   Issues an invoice
+        [--rps N] [--series S] [--competence D]
+        [--item 01.09] [--cnae N] [--nbs N] [--rate 3.07]
+        [--csll V] [--inss V] [--income-tax V] [--notes T] [--confirm]
+  cancel --number N --reason 1..5 [--confirm]       Cancels an invoice
+  replace --number N --reason 1..5 --customer X --amount V
+          [--description T] [--confirm]             Cancels and reissues
+
+DOCUMENTS (portal REST — the Web Service issues no files)
+  pdf --number N [--out DIR|FILE]                   Downloads the invoice PDF
+  xml --number N [--out DIR|FILE]                   Downloads the invoice XML
+
+LOCAL DIRECTORY
+  customers [--sync --from D --to D]                Lists/updates customers
+  suppliers [--sync --from D --to D]                Lists/updates suppliers
+  customer-add --tax-id D --name N [--alias A] [--registration N] [--email E] [--phone T]
+               [--street L --number N --district B --city IBGE --state UF --zip C]
+               [--complement C] [--trade-name F] [--simples 1|2]
+  supplier-add  (same options as customer-add)
+  customer-rm --tax-id D
+  supplier-rm --tax-id D
+
+PORTAL (REST API — the actual GissOnline directory, via CPF/password login)
+  portal-list [--type 1|2]                          Portal directory (1=customer, 2=supplier)
+  portal-add --tax-id D --name N [--type 1|2]       Registers in the portal
+             [--trade-name F] [--registration N] [--simples] [--mei]
+             [--street L --number N --district B --city IBGE --state UF --zip C]
+             [--complement C] [--street-type Rua] [--confirm]
+  portal-rm --tax-id D [--type 1|2] [--confirm]     Removes from the portal
+  portal-import [--type 1|2]                        Imports the portal directory locally
+
+LOOKUPS (BrasilAPI — convenience, not a source of truth)
+  zip <cep>                            Street, district, city and state for a postal code
+  cnpj <cnpj>                          Company details, address and IBGE code
+
+  Both customer-add and portal-add accept --lookup, which fills the missing
+  fields from the CNPJ before registering. Anything you pass explicitly wins.
+
+MUNICIPALITIES
+  cities [--state SP]                               Cities known to publish the Web Service
+
+PORTAL MESSAGES (Fale Conosco)
+  messages [--id N] [--unread]                      Messages you opened, or one with its reply
+           [--attachment N] [--out DIR]             Downloads an attachment of that message
+  message --subject S --text T [--confirm]          Opens a message to the city hall
+
+NATIONAL ISSUER (Sistema Nacional NFS-e — mandatory for Simples from 2026-11-01)
+  national-status                                   City adhesion and whether issuing is possible
+  national-get --key K                              Invoice by its 50-digit access key
+  national-pdf --key K [--out DIR|FILE]             DANFSe (the national PDF)
+  national-xml --key K [--out DIR|FILE]             Invoice XML
+  national-docs [--from NSU]                        Invoices and events where your CNPJ appears
+  danfse <nfse.xml> [--event FILE]... [--out DIR|FILE]  DANFSe from a saved XML (offline)
+         [--status cancelled|replaced]              Watermark; otherwise taken from the events
+  With NFSE_EMISSOR=nacional (or --issuer nacional), issue and cancel go
+  through the national API: issue takes [--dps N] to make a retry safe, and
+  cancel takes --key K --reason 1|2|9 --text "15 to 255 characters".
+
+MUNICIPAL ACTIVITIES (the source of CodigoTributacaoMunicipio)
+  activities [term] [--item 1.09] [--city IBGE]     City activity table (no login)
+             [--company] [--date YYYY-MM-DD]        Only the ones your company is bound to
+
+TAX PROFILE
+  profile [--save]                     Shows (or writes to data/profile.json) the defaults
+
+Global options:
+  --env producao|homologacao   Environment (default: GISS_ENV from .env)
+  --issuer giss|nacional       Who issues (default: NFSE_EMISSOR; else nacional for issue, by argument for cancel)
+  --json | --xml | --debug     Output format / diagnostics
+`;
+const options = {
+    env: { type: "string" },
+    issuer: { type: "string" },
+    key: { type: "string" },
+    dps: { type: "string" },
+    from: { type: "string" },
+    to: { type: "string" },
+    competence: { type: "string" },
+    number: { type: "string" },
+    series: { type: "string" },
+    type: { type: "string" },
+    page: { type: "string" },
+    limit: { type: "string" },
+    months: { type: "string" },
+    all: { type: "boolean", default: false },
+    first: { type: "string" },
+    last: { type: "string" },
+    protocol: { type: "string" },
+    export: { type: "boolean", default: false },
+    out: { type: "string" },
+    customer: { type: "string" },
+    amount: { type: "string" },
+    description: { type: "string" },
+    notes: { type: "string" },
+    rps: { type: "string" },
+    csll: { type: "string" },
+    rate: { type: "string" },
+    item: { type: "string" },
+    cnae: { type: "string" },
+    nbs: { type: "string" },
+    inss: { type: "string" },
+    "income-tax": { type: "string" },
+    reason: { type: "string" },
+    event: { type: "string", multiple: true },
+    status: { type: "string" },
+    confirm: { type: "boolean", default: false },
+    sync: { type: "boolean", default: false },
+    "tax-id": { type: "string" },
+    name: { type: "string" },
+    "trade-name": { type: "string" },
+    registration: { type: "string" },
+    email: { type: "string" },
+    phone: { type: "string" },
+    alias: { type: "string" },
+    state: { type: "string" },
+    street: { type: "string" },
+    district: { type: "string" },
+    complement: { type: "string" },
+    city: { type: "string" },
+    zip: { type: "string" },
+    simples: { type: "string" },
+    company: { type: "boolean", default: false },
+    date: { type: "string" },
+    id: { type: "string" },
+    attachment: { type: "string" },
+    subject: { type: "string" },
+    text: { type: "string" },
+    unread: { type: "boolean", default: false },
+    save: { type: "boolean", default: false },
+    "street-type": { type: "string" },
+    mei: { type: "boolean", default: false },
+    lookup: { type: "boolean", default: false },
+    json: { type: "boolean", default: false },
+    xml: { type: "boolean", default: false },
+    debug: { type: "boolean", default: false },
+    help: { type: "boolean", default: false },
+};
+/**
+ * Carrega o `.env` do diretório atual quando existe. Instalado como binário
+ * global não há `--env-file`, e as credenciais precisam vir de algum lugar;
+ * variáveis já definidas no ambiente têm precedência e não são sobrescritas.
+ */
+function loadDotEnv() {
+    const file = resolve(process.cwd(), ".env");
+    if (!existsSync(file))
+        return;
+    try {
+        process.loadEnvFile(file);
+    }
+    catch {
+        // Node < 20.12 não tem loadEnvFile; nesse caso o .env é ignorado
+    }
+}
+async function main() {
+    loadDotEnv();
+    const { values, positionals } = parseArgs({
+        args: process.argv.slice(2),
+        options,
+        allowPositionals: true,
+    });
+    const command = positionals[0];
+    if (!command || values.help) {
+        console.log(HELP);
+        return;
+    }
+    // Comandos de cadastro local e perfil não tocam a rede nem o certificado.
+    if (await runLocalCommand(command, values, positionals))
+        return;
+    // A tabela de atividades vem do portal, não do Web Service: pede município,
+    // não certificado. Fica antes do cliente SOAP para não exigir o .pfx.
+    if (command === "activities") {
+        await runActivitiesCommand(values, positionals);
+        return;
+    }
+    // O Fale Conosco também vive no portal; o certificado só entra quando é ele
+    // que abre a sessão.
+    if (command === "messages" || command === "message") {
+        await runMessageCommand(command, values);
+        return;
+    }
+    const client = new NfseClient({
+        environment: values.env,
+        issuer: values.issuer,
+        debug: values.debug,
+    });
+    warnCertificateExpiry(client.certificate);
+    if (await runNationalCommand(command, values, client))
+        return;
+    const asNumber = (v) => (v === undefined ? undefined : Number(v));
+    switch (command) {
+        case "cert": {
+            const { subject, validFrom, validTo } = client.certificate;
+            console.log(`Holder:      ${subject}`);
+            console.log(`Valid from:  ${validFrom.toISOString().slice(0, 10)}`);
+            console.log(`Valid until: ${validTo.toISOString().slice(0, 10)}`);
+            console.log(`Environment: ${client.config.environment}`);
+            console.log(`Host:        ${client.config.host}`);
+            console.log(`Provider:    CNPJ ${client.config.cnpj} / IM ${client.config.municipalRegistration}`);
+            if (values.export) {
+                const target = values.out ?? dirname(client.config.certificatePath);
+                const files = exportPem(client.certificate, target);
+                console.log("\nPEM files written:");
+                console.log(`  certificate: ${files.certificate}`);
+                console.log(`  key:         ${files.key}`);
+                if (files.chain)
+                    console.log(`  chain:       ${files.chain}`);
+                console.log(`  bundle:      ${files.bundle}`);
+                console.log("\nThe key has no passphrase — keep these files out of version control.");
+            }
+            return;
+        }
+        case "latest": {
+            const limit = asNumber(values.limit) ?? 10;
+            const months = asNumber(values.months) ?? 12;
+            const to = new Date();
+            const from = new Date(to);
+            from.setMonth(from.getMonth() - months);
+            const invoices = [];
+            for await (const page of client.paginate((page) => client.nfse.queryProvidedServices({
+                issuePeriod: { from: isoDate(from), to: isoDate(to) },
+                page,
+            }))) {
+                invoices.push(...page.invoices);
+            }
+            // O serviço devolve em ordem crescente; as mais recentes ficam no fim.
+            const latest = invoices.slice(-limit).reverse();
+            printInvoices({ invoices: latest, warnings: [], xml: "" }, values);
+            if (!values.json && !values.xml) {
+                console.log(`\n${latest.length} of ${invoices.length} invoice(s) in the last ${months} months`);
+            }
+            return;
+        }
+        case "issued":
+        case "received": {
+            const taken = command === "received";
+            const filter = values.number
+                ? { nfseNumber: values.number }
+                : dateFilter(values.from, values.to, Boolean(values.competence));
+            const query = (page) => taken
+                ? client.nfse.queryTakenServices({ ...filter, page })
+                : client.nfse.queryProvidedServices({ ...filter, page });
+            if (values.all && !values.number) {
+                let total = 0;
+                for await (const page of client.paginate(query)) {
+                    total += page.invoices.length;
+                    printInvoices(page, values, taken);
+                }
+                if (!values.json && !values.xml)
+                    console.log(`\nTotal: ${total} invoice(s)`);
+                return;
+            }
+            printInvoices(await query(asNumber(values.page) ?? 1), values, taken);
+            return;
+        }
+        case "range": {
+            if (!values.first || !values.last) {
+                throw new Error("Provide --first and --last with the invoice number range");
+            }
+            printInvoices(await client.nfse.queryNfseRange({
+                firstNumber: values.first,
+                lastNumber: values.last,
+                page: asNumber(values.page),
+            }), values);
+            return;
+        }
+        case "rps": {
+            if (!values.number || !values.series) {
+                throw new Error("Provide the RPS --number and --series");
+            }
+            printInvoices(await client.nfse.queryNfseByRps({
+                number: values.number,
+                series: values.series,
+                type: values.type ? Number(values.type) : undefined,
+            }), values);
+            return;
+        }
+        case "batch": {
+            if (!values.protocol)
+                throw new Error("Provide the batch --protocol");
+            const result = await client.nfse.queryRpsBatch(values.protocol);
+            if (values.xml)
+                return void console.log(result.xml);
+            if (values.json)
+                return void console.log(JSON.stringify(result, null, 2));
+            console.log(`Status:   ${result.status} — ${result.statusLabel}`);
+            if (result.batchNumber)
+                console.log(`Batch:    ${result.batchNumber}`);
+            if (result.receivedAt)
+                console.log(`Received: ${result.receivedAt}`);
+            printInvoices(result, values);
+            return;
+        }
+        case "purchased-batch": {
+            if (!values.protocol)
+                throw new Error("Provide the --protocol");
+            printInvoices(await client.nfsc.queryPurchasedByBatch(values.protocol), values);
+            return;
+        }
+        case "purchased-protocol": {
+            if (!values.protocol)
+                throw new Error("Provide the --protocol");
+            const result = await client.nfsc.queryPurchasedByProtocol(values.protocol);
+            if (values.xml)
+                return void console.log(result.xml);
+            console.log(`Status:   ${result.status} — ${result.statusLabel}`);
+            printInvoices(result, values);
+            return;
+        }
+        case "purchased-number": {
+            if (!values.from || !values.to || !values.number || !values.series) {
+                throw new Error("Provide --from, --to, --number and --series");
+            }
+            const range = { from: values.from, to: values.to };
+            printInvoices(await client.nfsc.queryPurchasedByNumber({
+                issuePeriod: range,
+                competencePeriod: range,
+                declaredNumber: values.number,
+                declaredSeries: values.series,
+            }), values, true);
+            return;
+        }
+        case "issue": {
+            const rps = buildRpsFromCli(values);
+            warnSimplesDeadline(rps);
+            if (!values.confirm) {
+                const preview = client.nfse.previewIssueNfse(rps);
+                if (values.xml)
+                    return void console.log(preview);
+                console.log(issueSummary(values, rps));
+                printValidation(preview);
+                console.log("\nNothing was sent. Repeat with --confirm to actually issue.");
+                return;
+            }
+            // GerarNfse e RecepcionarLoteRpsSincrono respondem A01 mesmo com o XML
+            // correto; o lote assíncrono é o único caminho que emite. `issueRps`
+            // cuida do protocolo e da espera, e é ele que garante que repetir o
+            // comando com o mesmo --rps não gere uma segunda nota.
+            const rpsNumber = values.rps ?? String(Date.now() % 100000);
+            if (!values.rps) {
+                console.log(`RPS ${rpsNumber} (generated). Pass --rps to make a retry safe to repeat.`);
+            }
+            const withRps = rps.identification
+                ? rps
+                : {
+                    ...rps,
+                    identification: {
+                        number: rpsNumber,
+                        series: values.series ?? "A",
+                        type: 1,
+                    },
+                    issueDate: new Date(),
+                    status: 1,
+                };
+            const outcome = await client.nfse.issueRps(withRps);
+            if (outcome.status === "already-issued") {
+                console.log("This RPS had already been issued:");
+                printInvoices({ invoices: [outcome.invoice], warnings: [], xml: "" }, values);
+                return;
+            }
+            if (outcome.invoice) {
+                console.log("Invoice issued:");
+                printInvoices({ invoices: [outcome.invoice], warnings: outcome.warnings, xml: "" }, values);
+                return;
+            }
+            for (const warning of outcome.warnings) {
+                console.log(`⚠ [${warning.code}] ${warning.message}`);
+            }
+            console.log(outcome.status === "rejected"
+                ? `Rejected. Protocol: ${outcome.protocol}`
+                : `Still processing. Query it with: ${INVOCATION} batch --protocol ${outcome.protocol}`);
+            console.log(`Repeating with --rps ${rpsNumber} is safe: an already-issued RPS is not issued twice.`);
+            return;
+        }
+        case "cancel": {
+            if (!values.number || !values.reason) {
+                throw new Error("Provide the invoice --number and --reason (1 to 5)");
+            }
+            if (!values.confirm) {
+                console.log(`Would cancel invoice ${values.number}, reason ${values.reason} (${REASONS[values.reason] ?? "?"}).`);
+                console.log("Nothing was sent. Repeat with --confirm.");
+                return;
+            }
+            const result = await client.nfse.cancelNfse({
+                nfseNumber: values.number,
+                cancellationCode: Number(values.reason),
+            });
+            console.log(`Invoice ${values.number} cancelled.`);
+            if (result.cancelledAt)
+                console.log(`Timestamp: ${result.cancelledAt}`);
+            return;
+        }
+        case "replace": {
+            if (!values.number || !values.reason) {
+                throw new Error("Provide the replaced invoice --number and --reason (1 to 5)");
+            }
+            const rps = buildRpsFromCli(values);
+            if (!values.confirm) {
+                console.log(`Would replace invoice ${values.number} (reason ${values.reason}) with:\n`);
+                console.log(issueSummary(values, rps));
+                console.log("\nNothing was sent. Repeat with --confirm.");
+                return;
+            }
+            const result = await client.nfse.replaceNfse({
+                nfseNumber: values.number,
+                cancellationCode: Number(values.reason),
+            }, rps);
+            console.log(`Invoice ${values.number} replaced by:`);
+            printInvoices(result, values);
+            return;
+        }
+        case "pdf":
+        case "xml": {
+            if (!values.number)
+                throw new Error("Provide the invoice --number");
+            // O arquivo é identificado pelo id interno da nota, que só a consulta
+            // conhece — o número impresso não serve na rota do portal.
+            const { invoices } = await client.nfse.queryProvidedServices({
+                nfseNumber: values.number,
+            });
+            const invoice = invoices[0];
+            if (!invoice)
+                throw new Error(`Invoice ${values.number} was not found`);
+            if (!invoice.internalId) {
+                throw new Error(`Invoice ${values.number} has no internal id to download`);
+            }
+            const portal = await PortalService.authenticate(portalCredentials(client.config, client.certificate));
+            const file = await portal.invoiceDocument(invoice.internalId, command);
+            const target = documentTarget(values.out, invoice.number, command);
+            mkdirSync(dirname(target), { recursive: true });
+            writeFileSync(target, file);
+            console.log(`Invoice ${invoice.number}  |  ${invoice.taker?.legalName ?? ""}`);
+            console.log(`${target}  (${(file.length / 1024).toFixed(1)} KB)`);
+            return;
+        }
+        case "portal-list":
+        case "portal-add":
+        case "portal-rm":
+        case "portal-import":
+            await runPortalCommand(command, values, client.config);
+            return;
+        case "customers":
+        case "suppliers": {
+            const role = command === "customers" ? "customer" : "supplier";
+            const repository = new ContactRepository();
+            if (values.sync) {
+                const filter = dateFilter(values.from, values.to, Boolean(values.competence));
+                const invoices = [];
+                const query = (page) => role === "customer"
+                    ? client.nfse.queryProvidedServices({ ...filter, page })
+                    : client.nfse.queryTakenServices({ ...filter, page });
+                for await (const page of client.paginate(query)) {
+                    invoices.push(...page.invoices);
+                }
+                const { saved } = syncFromInvoices(repository, role, invoices);
+                console.log(`${saved} ${roleLabel(role)}(s) synced from ${invoices.length} invoice(s).\n`);
+            }
+            printContacts(repository, role, values);
+            return;
+        }
+        default:
+            throw new Error(`Unknown command: ${command}`);
+    }
+}
+/** Avisa com 30 dias de antecedência: certificado vencido para toda emissão. */
+function warnCertificateExpiry(certificate, now = new Date()) {
+    const days = Math.floor((certificate.validTo.getTime() - now.getTime()) / 86_400_000);
+    if (days < 0 || days > 30)
+        return;
+    console.error(`⚠ The A1 certificate expires in ${days} day(s), on ${isoDate(certificate.validTo)}. ` +
+        "Renew it before then: an expired certificate stops every request.\n");
+}
+/** Data em que o Simples Nacional deixa de emitir pelo sistema municipal. */
+const SIMPLES_NATIONAL_DEADLINE = "2026-11-01";
+/**
+ * A Res. CGSN 191/2026 tira o Simples dos emissores municipais em 01/11/2026.
+ * O aviso não bloqueia: o município pode aceitar por mais tempo, e quem decide
+ * é a resposta do serviço — mas ninguém deveria descobrir isso pela recusa.
+ */
+function warnSimplesDeadline(rps) {
+    if (rps.simplesNacionalOptant !== 1)
+        return;
+    if (isoDate(new Date()) < SIMPLES_NATIONAL_DEADLINE)
+        return;
+    // stderr: o aviso não pode entrar na saída de `--xml`/`--json`, que é para pipe
+    console.error(`⚠ Simples Nacional issues through the national system since ${SIMPLES_NATIONAL_DEADLINE} ` +
+        "(Res. CGSN 191/2026). Set NFSE_EMISSOR=nacional — see docs/national.md.\n");
+}
+/**
+ * Quem emite quando o usuário não disse: `NFSE_EMISSOR` e `--issuer` sempre mandam.
+ * Sem eles, `issue` vai ao nacional — é o padrão do país e o único que o Simples
+ * ainda tem desde 01/11/2026. `cancel` segue o argumento: `--key` é do nacional,
+ * `--number` é do GissOnline. `replace` só existe no GissOnline, salvo para o
+ * optante do Simples, que não tem mais o que substituir lá (o erro explica).
+ */
+function resolveIssuer(config, command, values) {
+    if (config.issuerExplicit)
+        return { issuer: config.issuer, source: "explicit" };
+    if (command === "issue")
+        return { issuer: "nacional", source: "automatic" };
+    if (command === "cancel") {
+        return { issuer: values.key ? "nacional" : "giss", source: "automatic" };
+    }
+    if (command === "replace") {
+        let optant = false;
+        try {
+            optant = new ProfileRepository().load().simplesNacionalOptant === 1;
+        }
+        catch {
+            // sem perfil legível, fica no GissOnline
+        }
+        if (optant && isoDate(new Date()) >= SIMPLES_NATIONAL_DEADLINE) {
+            return { issuer: "nacional", source: "automatic" };
+        }
+    }
+    return { issuer: "giss", source: "automatic" };
+}
+const NATIONAL_REASONS = {
+    "1": "issuing error",
+    "2": "service not provided",
+    "9": "other",
+};
+/**
+ * Comandos do Sistema Nacional NFS-e. `issue` e `cancel` só passam por aqui
+ * quando o emissor configurado é o nacional; os `national-*` sempre.
+ */
+async function runNationalCommand(command, values, client) {
+    const { national, config } = client;
+    const { issuer, source } = resolveIssuer(config, command, values);
+    const viaNational = issuer === "nacional";
+    const key = () => {
+        const value = values.key?.replace(/\D/g, "");
+        if (!value || value.length !== 50)
+            throw new Error("Provide the 50-digit access --key");
+        return value;
+    };
+    switch (command) {
+        case "national-status": {
+            const agreement = await national.agreement();
+            const yes = (v) => (v ? "yes" : "no");
+            console.log(`City (IBGE):             ${config.cityCode}`);
+            console.log(`Environment:             ${config.environment} (${national.hosts.sefin})`);
+            console.log(`Shares with national:    ${yes(agreement.sharesWithNational)}`);
+            console.log(`Accepts national issuer: ${yes(agreement.usesNationalIssuer)}`);
+            const forIssue = resolveIssuer(config, "issue", values);
+            console.log(`Issuer for issue:        ${forIssue.issuer}${forIssue.source === "automatic" ? " (automatic)" : ""}`);
+            if (values.json)
+                console.log(JSON.stringify(agreement.raw, null, 2));
+            if (!agreement.usesNationalIssuer) {
+                console.log("\nThe city has not enabled the national issuer in the ADN: a DPS is refused with E0039 —\n" +
+                    "except for ME/EPP who apportion through the Simples (regApTribSN = 1) with competence on or\n" +
+                    "after 2026-11-01 (RN 239), which issues anyway. See docs/national.md.");
+            }
+            return true;
+        }
+        case "national-get": {
+            printNational(await national.get(key()), values);
+            return true;
+        }
+        case "national-pdf":
+        case "national-xml": {
+            const accessKey = key();
+            const format = command === "national-pdf" ? "pdf" : "xml";
+            const file = format === "pdf"
+                ? await national.pdf(accessKey).catch((error) => {
+                    // O DANFSe do ADN cai com frequência (503). Nota emitida por um
+                    // município do GissOnline tem o PDF da prefeitura como saída.
+                    const city = findMunicipalityByCode(accessKey.slice(0, 7));
+                    if (error instanceof NfseError && error.code === "UNAVAILABLE" && city) {
+                        console.error(`The national PDF is unavailable. This invoice was issued in ${city.name} (GissOnline): ` +
+                            `try \`${INVOCATION} pdf --number ${nfseNumberFromKey(accessKey)}\`.`);
+                    }
+                    throw error;
+                })
+                : Buffer.from((await national.get(accessKey)).xml, "utf8");
+            const target = documentTarget(values.out, accessKey, format);
+            mkdirSync(dirname(target), { recursive: true });
+            writeFileSync(target, file);
+            console.log(`${target}  (${(file.length / 1024).toFixed(1)} KB)`);
+            return true;
+        }
+        case "national-docs": {
+            const documents = await national.distribution(Number(values.from ?? 0));
+            if (values.json) {
+                console.log(JSON.stringify(documents.map(({ xml, ...rest }) => rest), null, 2));
+                return true;
+            }
+            for (const document of documents) {
+                const head = [String(document.nsu).padStart(5), document.type.padEnd(6)];
+                if (document.type !== "NFSE") {
+                    const event = parseNationalEvent(document.xml);
+                    const replaced = event.replacementKey
+                        ? ` → replaced by ${nfseNumberFromKey(event.replacementKey) ?? event.replacementKey}`
+                        : "";
+                    console.log([
+                        ...head,
+                        (event.code ?? "").padEnd(8),
+                        (event.nfseNumber ?? "").padStart(9),
+                        (event.requestedAt ?? event.processedAt)?.slice(0, 10) ?? "",
+                        `${event.description ?? "event"}${replaced}`,
+                    ].join("  "));
+                    console.log(`${"".padStart(15)}key ${event.accessKey ?? document.accessKey}`);
+                    continue;
+                }
+                const nfse = parseNationalNfseSafe(document.xml);
+                const role = nfse?.issuerCnpj === config.cnpj ? "issued" : "received";
+                const party = role === "issued" ? nfse?.takerName : nfse?.issuerName;
+                console.log([
+                    ...head,
+                    nfse ? role.padEnd(8) : "".padEnd(8),
+                    nfse?.number?.padStart(9) ?? "".padStart(9),
+                    nfse?.processedAt?.slice(0, 10) ?? "",
+                    nfse?.serviceAmount?.toFixed(2).padStart(10) ?? "",
+                    `${nfse?.issuingCity ?? ""}${party ? ` · ${party}` : ""}`,
+                ].join("  "));
+                console.log(`${"".padStart(15)}key ${document.accessKey}`);
+            }
+            const last = documents.at(-1);
+            console.log(last
+                ? `\n${documents.length} document(s). Continue with --from ${last.nsu}`
+                : "No documents after this NSU.");
+            return true;
+        }
+        case "issue": {
+            if (!viaNational)
+                return false;
+            const rps = buildRpsFromCli(values);
+            const profile = new ProfileRepository().load();
+            const number = values.dps ?? String(Math.floor(Date.now() / 1000));
+            const issueOptions = {
+                series: values.series ?? profile.nationalSeries ?? "1",
+                number,
+                simplesOption: profile.simplesOption ?? (rps.simplesNacionalOptant === 1 ? 3 : 1),
+                simplesApportionment: profile.simplesApportionment,
+            };
+            if (!values.confirm) {
+                const preview = national.previewDps(rps, issueOptions);
+                if (values.xml)
+                    return void console.log(preview), true;
+                console.log(issueSummary(values, rps));
+                console.log(`DPS:           ${number} series ${issueOptions.series} (national issuer${source === "automatic" ? ", the default; --issuer giss for GissOnline" : ""})`);
+                printValidation(preview, "DPS_v1.01.xsd", SCHEMA_DIRECTORIES.national);
+                console.log("\nNothing was sent. Repeat with --confirm to actually issue.");
+                return true;
+            }
+            if (!values.dps) {
+                console.log(`DPS ${number} (generated). Pass --dps ${number} to retry safely.`);
+            }
+            const outcome = await national.issue(rps, issueOptions);
+            console.log(outcome.status === "already-issued"
+                ? "This DPS had already been issued:"
+                : "Invoice issued:");
+            printNational(outcome.nfse, values);
+            for (const alert of outcome.alerts)
+                console.log(`⚠ [${alert.code}] ${alert.message}`);
+            return true;
+        }
+        case "cancel": {
+            if (!viaNational)
+                return false;
+            const accessKey = key();
+            if (!values.reason || !NATIONAL_REASONS[values.reason]) {
+                throw new Error("Provide --reason 1 (issuing error), 2 (not provided) or 9 (other)");
+            }
+            if (!values.text)
+                throw new Error("Provide the justification in --text (15 to 255 chars)");
+            if (!values.confirm) {
+                console.log(`Would cancel ${accessKey}, reason ${values.reason} (${NATIONAL_REASONS[values.reason]}).`);
+                console.log("Nothing was sent. Repeat with --confirm.");
+                return true;
+            }
+            const event = await national.cancel(accessKey, Number(values.reason), values.text);
+            console.log(`Invoice ${accessKey} cancelled.`);
+            if (values.xml)
+                console.log(event);
+            return true;
+        }
+        case "replace":
+            if (viaNational) {
+                throw new Error("replace is not available on the national issuer yet: cancel, then issue again");
+            }
+            return false;
+        default:
+            return false;
+    }
+}
+function parseNationalNfseSafe(xml) {
+    try {
+        return parseNationalNfse(xml);
+    }
+    catch {
+        return null;
+    }
+}
+function printNational(nfse, values) {
+    if (values.xml)
+        return void console.log(nfse.xml);
+    if (values.json) {
+        const { xml, ...rest } = nfse;
+        return void console.log(JSON.stringify(rest, null, 2));
+    }
+    console.log(`Number:      ${nfse.number ?? "—"}`);
+    console.log(`Access key:  ${nfse.accessKey}`);
+    console.log(`Processed:   ${nfse.processedAt ?? "—"}`);
+    console.log(`Customer:    ${nfse.takerName ?? "—"} (${nfse.takerTaxId ?? "—"})`);
+    console.log(`Amount:      R$ ${nfse.serviceAmount?.toFixed(2) ?? "—"}`);
+    console.log(`Description: ${nfse.description ?? "—"}`);
+}
+/** Rótulo em português para as mensagens ao usuário. */
+const roleLabel = (role) => role === "customer" ? "customer" : "supplier";
+/** Aguarda o processamento do lote, que é assíncrono. */
+const REASONS = {
+    "1": "issuing error",
+    "2": "service not provided",
+    "3": "signature error",
+    "4": "duplicate invoice",
+    "5": "processing error",
+};
+/** Comandos que não precisam de rede nem de certificado. */
+async function runLocalCommand(command, values, positionals) {
+    // eslint-disable-next-line no-param-reassign -- --lookup enriches the input
+    switch (command) {
+        case "customer-add":
+        case "supplier-add": {
+            const role = command === "customer-add" ? "customer" : "supplier";
+            values = await withLookup(values);
+            if (!values["tax-id"] || !values.name) {
+                throw new Error("Provide --tax-id and --name");
+            }
+            const contact = new ContactRepository().save(role, {
+                taxId: values["tax-id"],
+                legalName: values.name,
+                tradeName: values["trade-name"],
+                municipalRegistration: values.registration,
+                email: values.email,
+                phone: values.phone,
+                alias: values.alias,
+                address: buildAddress(values),
+                simplesNacionalOptant: values.simples
+                    ? Number(values.simples)
+                    : undefined,
+            });
+            console.log(`${roleLabel(role)} saved: ${contact.legalName} (${contact.taxId})`);
+            if (!contact.address) {
+                console.log("Warning: no address. Issuing an invoice requires the customer address.");
+            }
+            return true;
+        }
+        case "customer-rm":
+        case "supplier-rm": {
+            const role = command === "customer-rm" ? "customer" : "supplier";
+            if (!values["tax-id"])
+                throw new Error("Provide --tax-id");
+            const removed = new ContactRepository().remove(role, values["tax-id"]);
+            console.log(removed ? `${roleLabel(role)} removed.` : `${roleLabel(role)} not found.`);
+            return true;
+        }
+        case "zip": {
+            const code = positionals[1] ?? values.zip;
+            if (!code)
+                throw new Error(`Provide the postal code: ${INVOCATION} zip 01310-100`);
+            const found = await lookupZip(code);
+            if (values.json)
+                return void console.log(JSON.stringify(found, null, 2)), true;
+            console.log(`  zip:      ${found.zipCode}`);
+            console.log(`  street:   ${found.street ?? "—"}`);
+            console.log(`  district: ${found.district ?? "—"}`);
+            console.log(`  city:     ${found.city}/${found.state}`);
+            return true;
+        }
+        case "cnpj": {
+            const taxId = positionals[1] ?? values["tax-id"];
+            if (!taxId)
+                throw new Error(`Provide the CNPJ: ${INVOCATION} cnpj 00000000000191`);
+            const found = await lookupParty(taxId);
+            if (values.json)
+                return void console.log(JSON.stringify(found, null, 2)), true;
+            console.log(`  name:      ${found.legalName}`);
+            if (found.tradeName)
+                console.log(`  trade:     ${found.tradeName}`);
+            console.log(`  status:    ${found.status ?? "—"}${found.simplesNacionalOptant ? " · Simples Nacional" : ""}`);
+            console.log(`  address:   ${[found.street, found.number].filter(Boolean).join(", ") || "—"}`);
+            if (found.complement)
+                console.log(`  complement:${found.complement}`);
+            console.log(`  district:  ${found.district ?? "—"}`);
+            console.log(`  city:      ${found.city}/${found.state}  IBGE ${found.cityCode ?? "—"}`);
+            console.log(`  zip:       ${found.zipCode ?? "—"}`);
+            if (found.email)
+                console.log(`  email:     ${found.email}`);
+            if (found.phone)
+                console.log(`  phone:     ${found.phone}`);
+            console.log(`\n  ${INVOCATION} customer-add --tax-id ${found.taxId} --lookup`);
+            return true;
+        }
+        case "danfse": {
+            // Offline: o PDF sai do XML que o projeto já guardou, sem certificado.
+            const file = positionals[1];
+            if (!file)
+                throw new Error(`Usage: ${INVOCATION} danfse <nfse.xml> [--event FILE]... [--out DIR|FILE]`);
+            const status = values.status;
+            if (status !== undefined && status !== "cancelled" && status !== "replaced") {
+                throw new Error("--status must be cancelled or replaced");
+            }
+            const xml = readFileSync(file, "utf8");
+            const pdf = Buffer.from(await renderDanfse(xml, { status, events: (values.event ?? []).map((path) => readFileSync(path, "utf8")) }));
+            const accessKey = /Id="NFS(\d{50})"/.exec(xml)?.[1] ?? "danfse";
+            const target = documentTarget(values.out, accessKey, "pdf");
+            mkdirSync(dirname(target), { recursive: true });
+            writeFileSync(target, pdf);
+            console.log(`${target}  (${(pdf.length / 1024).toFixed(1)} KB)`);
+            return true;
+        }
+        case "cities": {
+            const state = values.state?.toUpperCase();
+            const list = state
+                ? MUNICIPALITIES.filter((m) => m.state === state)
+                : MUNICIPALITIES;
+            if (values.json)
+                return void console.log(JSON.stringify(list, null, 2)), true;
+            for (const city of list) {
+                console.log(`${city.slug.padEnd(18)} ${city.cityCode}  ${city.name}/${city.state}`);
+            }
+            console.log(`\n${list.length} municipalit${list.length === 1 ? "y" : "ies"}`);
+            console.log("Set GISS_MUNICIPIO to the first column; the IBGE code follows from it.");
+            return true;
+        }
+        case "profile": {
+            const repository = new ProfileRepository();
+            const profile = repository.load();
+            if (values.save)
+                console.log(`Profile written to ${repository.save(profile)}`);
+            console.log(JSON.stringify(profile, null, 2));
+            return true;
+        }
+        default:
+            return false;
+    }
+}
+/**
+ * Aceita um diretório ou o caminho completo do arquivo em `--out`; sem nada,
+ * grava no diretório atual com o número da nota no nome.
+ */
+function documentTarget(out, number, format) {
+    const name = `nfse-${number}.${format}`;
+    if (!out)
+        return resolve(process.cwd(), name);
+    return out.toLowerCase().endsWith(`.${format}`) ? resolve(out) : resolve(out, name);
+}
+/** Comandos que falam com a API REST do portal, não com o Web Service. */
+/**
+ * Como entrar no portal: CPF e senha quando estão no ambiente, senão o próprio
+ * A1 — o mesmo certificado que assina os RPS também abre o REST, o que dispensa
+ * guardar a senha de uma pessoa física para um processo automatizado.
+ *
+ * A ordem preserva o comportamento de quem já tem `GISS_LOGIN`/`GISS_PASS`
+ * configurados. Passe o certificado já carregado quando houver um: reabrir o
+ * PKCS#12 é a parte cara.
+ */
+function portalCredentials(config, certificate) {
+    if (process.env.GISS_LOGIN && process.env.GISS_PASS) {
+        return loadPortalCredentials(config);
+    }
+    const source = certificate ?? process.env.CERT_PATH;
+    if (!source) {
+        throw new Error("The portal needs GISS_LOGIN and GISS_PASS, or CERT_PATH to log in with the certificate");
+    }
+    return {
+        certificate: source,
+        certificatePassword: process.env.CERT_PASSWORD,
+        cityCode: config.cityCode,
+        cnpj: config.cnpj,
+    };
+}
+/**
+ * Fale Conosco: lista, abre e baixa anexos das mensagens trocadas com a
+ * prefeitura. É o canal de atendimento que a API expõe ao contribuinte — o
+ * módulo de chamados do fisco nega acesso a quem entra como empresa.
+ */
+async function runMessageCommand(command, values) {
+    const cityCode = resolveCityCode(undefined, values.city);
+    const portal = await PortalService.authenticate(portalCredentials({ cityCode, cnpj: process.env.GISS_CNPJ }));
+    if (command === "message") {
+        if (!values.subject || !values.text) {
+            throw new Error("Provide --subject and --text");
+        }
+        if (!values.confirm) {
+            console.log(`Subject: ${values.subject}`);
+            console.log(`Message: ${values.text}`);
+            console.log(`To:      ${portal.session.legalName} → city ${cityCode}`);
+            console.log("\nNothing was sent. Repeat with --confirm to open it.");
+            return;
+        }
+        await portal.sendMessage({ subject: values.subject, body: values.text });
+        console.log("Message sent.");
+        return;
+    }
+    if (values.id) {
+        const message = await portal.getMessage(Number(values.id));
+        // O anexo é uma faceta da mensagem, não um comando à parte: o `--id` já
+        // deu o contexto, e os ids dos arquivos saem na própria listagem dela.
+        if (values.attachment) {
+            const attachment = message.attachments.find((a) => a.id === Number(values.attachment));
+            if (!attachment) {
+                throw new Error(`Message ${message.id} has no attachment ${values.attachment}. Available: ` +
+                    (message.attachments.map((a) => `${a.id} (${a.name})`).join(", ") || "none"));
+            }
+            const file = await portal.messageAttachment(message.id, attachment.id);
+            const target = values.out
+                ? resolve(values.out, attachment.name)
+                : resolve(attachment.name);
+            mkdirSync(dirname(target), { recursive: true });
+            writeFileSync(target, file);
+            console.log(`${target}  (${(file.length / 1024).toFixed(1)} KB)`);
+            return;
+        }
+        if (values.json)
+            return void console.log(JSON.stringify(message, null, 2));
+        printMessage(message);
+        return;
+    }
+    const messages = await portal.listMessages();
+    const shown = values.unread ? messages.filter((m) => m.answered && !m.read) : messages;
+    if (values.json)
+        return void console.log(JSON.stringify(shown, null, 2));
+    for (const message of shown) {
+        const status = message.answered ? (message.read ? "answered" : "NEW REPLY") : "waiting";
+        console.log([
+            String(message.id).padStart(5),
+            message.sentAt.slice(0, 10),
+            status.padEnd(9),
+            message.subject,
+        ].join("  "));
+    }
+    console.log(`\n${shown.length} message(s) — ${await portal.unreadMessages()} unread`);
+    const first = shown[0];
+    if (first)
+        console.log(`See one with: ${INVOCATION} messages --id ${first.id}`);
+}
+/** Uma mensagem inteira, com a resposta do auditor quando existe. */
+function printMessage(message) {
+    console.log(`#${message.id}  ${message.subject}`);
+    console.log(`Sent:  ${message.sentAt.slice(0, 19).replace("T", " ")}`);
+    console.log(`\n${message.body}`);
+    if (message.answer) {
+        console.log(`\n--- reply${message.auditor ? ` from ${message.auditor}` : ""}` +
+            `${message.answeredAt ? ` on ${message.answeredAt.slice(0, 10)}` : ""} ---`);
+        console.log(message.answer);
+    }
+    else {
+        console.log("\n(no reply yet)");
+    }
+    for (const attachment of message.attachments) {
+        console.log(`\nAttachment ${attachment.id}: ${attachment.name}` +
+            `${attachment.fromAuditor ? " (from the auditor)" : ""}` +
+            `\n  ${INVOCATION} messages --id ${message.id} --attachment ${attachment.id}`);
+    }
+}
+/**
+ * Lista a tabela de atividades do município, ou só as da empresa.
+ *
+ * O `CodigoTributacaoMunicipio` não existe no WSDL — nenhuma das 16 operações
+ * devolve tabela de apoio —, então a origem é a API REST do portal. A lista da
+ * cidade é pública; a da empresa exige o login do portal.
+ */
+async function runActivitiesCommand(values, positionals) {
+    const cityCode = resolveCityCode(undefined, values.city);
+    const activities = values.company
+        ? await (await PortalService.authenticate(portalCredentials({ cityCode, cnpj: process.env.GISS_CNPJ }))).companyActivities(values.date ?? new Date())
+        : await PortalService.listActivities(cityCode);
+    // O item da LC 116 muda de forma conforme a cidade: Suzano grava `1.09`,
+    // Guarulhos grava `101` para 1.01. Comparar só os dígitos faz `--item 1.09`
+    // valer nas duas.
+    const digits = (value) => value.replace(/\D/g, "").replace(/^0+/, "");
+    const term = positionals[1]?.toLowerCase();
+    const item = values.item ? digits(values.item) : undefined;
+    const found = activities.filter((activity) => (!term ||
+        activity.code.includes(term) ||
+        activity.description.toLowerCase().includes(term)) &&
+        (!item || digits(activity.serviceListItem) === item));
+    if (values.json)
+        return void console.log(JSON.stringify(found, null, 2));
+    const width = Math.max(4, ...found.map((a) => a.code.length));
+    for (const activity of found) {
+        console.log([
+            activity.code.padEnd(width),
+            activity.serviceListItem.padEnd(6),
+            activity.rate === undefined ? "" : `${activity.rate.toFixed(2)}%`.padStart(7),
+            activity.description,
+        ]
+            .filter(Boolean)
+            .join("  "));
+    }
+    const scope = values.company ? "bound to the company" : `in city ${cityCode}`;
+    console.log(`\n${found.length} of ${activities.length} activity(ies) ${scope}`);
+    console.log("The rate above is the municipal one — under Simples Nacional the annex rate applies.");
+}
+async function runPortalCommand(command, values, config) {
+    // eslint-disable-next-line no-param-reassign -- --lookup enriches the input
+    const role = (values.type ? Number(values.type) : 1);
+    const label = role === 1 ? "customer" : "supplier";
+    const portal = await PortalService.authenticate(portalCredentials(config));
+    if (command === "portal-list") {
+        const parties = await portal.list(role);
+        if (values.json)
+            return void console.log(JSON.stringify(parties, null, 2));
+        for (const party of parties) {
+            console.log([party.documento.padEnd(14), party.razaoSocial, party.nomeFantasia ?? ""]
+                .filter(Boolean)
+                .join("  |  "));
+        }
+        console.log(`\n${parties.length} ${label}(s) — ${portal.session.legalName}`);
+        return;
+    }
+    if (command === "portal-import") {
+        const repository = new ContactRepository();
+        const parties = await portal.list(role);
+        for (const party of parties) {
+            const full = party.endereco ? party : await portal.get(party.id);
+            repository.save(role === 1 ? "customer" : "supplier", {
+                taxId: full.documento,
+                legalName: full.razaoSocial,
+                tradeName: full.nomeFantasia,
+                municipalRegistration: full.inscricaoMunicipal,
+                address: full.endereco
+                    ? {
+                        street: `${full.endereco.tipoLogradouro} ${full.endereco.logradouro}`.trim(),
+                        number: full.endereco.numero,
+                        complement: full.endereco.complemento,
+                        district: full.endereco.bairro,
+                        cityCode: String(full.endereco.idIbge),
+                        state: full.endereco.estado,
+                        zipCode: full.endereco.cep,
+                    }
+                    : undefined,
+                source: "portal",
+            });
+        }
+        console.log(`${parties.length} ${label}(s) imported from the portal.`);
+        return;
+    }
+    if (command === "portal-rm") {
+        if (!values["tax-id"])
+            throw new Error("Provide --tax-id");
+        const existing = await portal.findByTaxId(values["tax-id"], role);
+        if (!existing) {
+            console.log(`${label} ${values["tax-id"]} is not registered in the portal.`);
+            return;
+        }
+        if (!values.confirm) {
+            console.log(`Would remove: ${existing.razaoSocial} (${existing.documento})`);
+            console.log("Nothing was sent. Repeat with --confirm.");
+            return;
+        }
+        await portal.remove(await portal.get(existing.id));
+        console.log(`${label} removed from the portal: ${existing.razaoSocial}`);
+        return;
+    }
+    // portal-add
+    values = await withLookup(values);
+    if (!values["tax-id"] || !values.name) {
+        throw new Error("Provide --tax-id and --name");
+    }
+    const existing = await portal.findByTaxId(values["tax-id"], role);
+    if (existing) {
+        console.log(`Already registered in the portal: ${existing.razaoSocial} (${existing.documento}).`);
+        return;
+    }
+    const address = buildAddress(values);
+    const cityName = address ? await portal.cityName(address.cityCode) : undefined;
+    const party = buildPortalParty(portal.session, {
+        taxId: values["tax-id"],
+        legalName: values.name,
+        tradeName: values["trade-name"],
+        municipalRegistration: values.registration,
+        role,
+        mei: values.mei,
+        simplesNacional: values.simples === "1",
+        email: values.email,
+        phone: values.phone,
+        address: address
+            ? { ...address, streetType: values["street-type"], cityName }
+            : undefined,
+    });
+    if (!values.confirm) {
+        console.log(`Would register in the portal (${portal.session.legalName}):\n`);
+        console.log(JSON.stringify(party, null, 2));
+        console.log("\nNothing was sent. Repeat with --confirm.");
+        return;
+    }
+    const created = await portal.create(party);
+    console.log(`${label} registered in the portal: ${created.razaoSocial} (id ${created.id})`);
+}
+/**
+ * Fills the gaps from the CNPJ registry. Anything passed explicitly wins — the
+ * lookup only supplies what the command line left out.
+ */
+async function withLookup(values) {
+    if (!values.lookup)
+        return values;
+    const taxId = values["tax-id"];
+    if (!taxId)
+        throw new Error("--lookup needs --tax-id");
+    const found = await lookupParty(taxId);
+    console.log(`Looked up ${found.legalName}${found.status ? ` (${found.status})` : ""}`);
+    const filled = { ...values };
+    const fill = (key, value) => {
+        if (value && !filled[key])
+            filled[key] = value;
+    };
+    fill("name", found.legalName);
+    fill("trade-name", found.tradeName);
+    fill("street", found.street);
+    fill("number", found.number);
+    fill("complement", found.complement);
+    fill("district", found.district);
+    fill("city", found.cityCode);
+    fill("state", found.state);
+    fill("zip", found.zipCode);
+    fill("email", found.email);
+    fill("phone", found.phone);
+    if (found.simplesNacionalOptant && !filled["simples"])
+        filled["simples"] = "1";
+    return filled;
+}
+/** Monta o endereço; o XSD exige o grupo completo ou nenhum. */
+function buildAddress(values) {
+    if (!values.street)
+        return undefined;
+    const missing = ["district", "city", "state", "zip"].filter((field) => !values[field]);
+    if (missing.length > 0) {
+        throw new Error(`Incomplete address — missing: ${missing.map((f) => `--${f}`).join(", ")}. ` +
+            "--city takes the 7-digit IBGE code.");
+    }
+    return {
+        street: values.street,
+        number: values.number ?? "S/N",
+        complement: values.complement,
+        district: values.district,
+        cityCode: values.city,
+        state: values.state.toUpperCase(),
+        zipCode: values.zip.replace(/\D/g, ""),
+    };
+}
+function buildRpsFromCli(values) {
+    if (!values.customer || !values.amount) {
+        throw new Error("Provide --customer (tax id or alias) and --amount");
+    }
+    const repository = new ContactRepository();
+    const contact = repository.find("customer", values.customer);
+    if (!contact) {
+        throw new Error(`Customer "${values.customer}" is not in the local directory. Use customer-add, portal-import or customers --sync.`);
+    }
+    return buildRps(new ProfileRepository().load(), {
+        taker: ContactRepository.asServiceTaker(contact),
+        serviceAmount: Number(values.amount),
+        description: values.description,
+        competenceDate: values.competence,
+        rpsNumber: values.rps,
+        series: values.series,
+        rate: values.rate ? Number(values.rate) : undefined,
+        csll: values.csll ? Number(values.csll) : undefined,
+        inss: values.inss ? Number(values.inss) : undefined,
+        incomeTax: values["income-tax"] ? Number(values["income-tax"]) : undefined,
+        additionalInformation: values.notes,
+        profile: {
+            ...(values.item ? { serviceListItem: values.item } : {}),
+            ...(values.cnae ? { cnaeCode: values.cnae, municipalTaxCode: values.cnae } : {}),
+            ...(values.nbs ? { nbsCode: values.nbs } : {}),
+        },
+    });
+}
+function issueSummary(values, rps) {
+    const lines = [
+        `Customer:      ${rps.taker?.legalName} (${rps.taker?.cnpj ?? rps.taker?.cpf})`,
+        `Amount:        R$ ${Number(values.amount).toFixed(2)}`,
+        `Competence:    ${isoDate(rps.competenceDate)}`,
+        `Description:   ${rps.service.description}`,
+        `LC 116 item:   ${rps.service.serviceListItem}`,
+        `CNAE:          ${rps.service.cnaeCode ?? "—"}`,
+        `NBS:           ${rps.service.nbsCode ?? "—"}`,
+        `Rate:          ${rps.service.amounts.rate ?? "—"}%`,
+        `ISS withheld:  ${rps.service.issWithheld === 1 ? "yes" : "no"}`,
+    ];
+    if (rps.identification) {
+        lines.push(`RPS:           ${rps.identification.number} series ${rps.identification.series}`);
+    }
+    return lines.join("\n");
+}
+function printValidation(xml, schema = "gerar-nfse-envio-v2_04.xsd", directory) {
+    const result = validateAgainstSchema(xml, schema, directory);
+    if (result === null) {
+        console.log("\nSchema: not checked (xmllint not installed).");
+    }
+    else if (result.valid) {
+        console.log(`\nSchema: XML valid against ${schema}.`);
+        for (const d of result.knownDivergences) {
+            console.log(`  (known XSD divergence, ignored) ${d.slice(0, 90)}`);
+        }
+    }
+    else {
+        console.log("\nSchema: XML INVALID —");
+        for (const error of result.errors)
+            console.log(`  ${error}`);
+    }
+}
+function dateFilter(from, to, byCompetence) {
+    if (!from || !to) {
+        throw new Error("Provide --from and --to as YYYY-MM-DD (or use --number)");
+    }
+    const range = { from, to };
+    return byCompetence ? { competencePeriod: range } : { issuePeriod: range };
+}
+function printInvoices(result, values, showProvider = false) {
+    if (values.xml)
+        return void console.log(result.xml);
+    if (values.json)
+        return void console.log(JSON.stringify(result.invoices, null, 2));
+    for (const warning of result.warnings) {
+        console.log(`⚠ [${warning.code}] ${warning.message}`);
+    }
+    if (result.invoices.length === 0) {
+        console.log("No invoice found.");
+        return;
+    }
+    for (const invoice of result.invoices) {
+        const party = showProvider ? invoice.provider : invoice.taker;
+        console.log([
+            `NFS-e ${invoice.number}`,
+            invoice.issueDate?.slice(0, 10),
+            party?.legalName ?? party?.taxId ?? "",
+            invoice.serviceAmount ? `R$ ${invoice.serviceAmount}` : "",
+            invoice.verificationCode,
+        ]
+            .filter(Boolean)
+            .join("  |  "));
+    }
+}
+function printContacts(repository, role, values) {
+    const contacts = repository.list(role);
+    if (values.json)
+        return void console.log(JSON.stringify(contacts, null, 2));
+    if (contacts.length === 0) {
+        console.log(`No ${roleLabel(role)} in the local directory (${repository.path}).`);
+        return;
+    }
+    for (const contact of contacts) {
+        const id = taxIdOf(contact.taxId);
+        console.log([
+            (id.cnpj ?? id.cpf ?? "").padEnd(14),
+            contact.legalName,
+            contact.alias ? `(${contact.alias})` : "",
+            contact.email ?? "",
+        ]
+            .filter(Boolean)
+            .join("  |  "));
+    }
+    console.log(`\n${contacts.length} ${roleLabel(role)}(s) — ${repository.path}`);
+}
+/** O que fazer depois de cada tipo de erro — a parte que a mensagem do serviço não diz. */
+const NEXT_STEP = {
+    CONFIG: "Check .env (see .env.example).",
+    CERTIFICATE: `Check the certificate with: ${INVOCATION} cert`,
+    UNAVAILABLE: "The service is unavailable right now. Try again in a few minutes.",
+    TRANSPORT: "Network failure. Try again; check connectivity or a proxy if it persists.",
+    AUTHENTICATION: "The credentials were refused. Check the certificate or the portal login.",
+};
+function printError(error, debug) {
+    if (!(error instanceof NfseError)) {
+        console.error(error instanceof Error ? error.message : error);
+        if (debug && error instanceof Error)
+            console.error(error.stack);
+        return;
+    }
+    const origin = [error.provider, error.operation].filter(Boolean).join(" · ");
+    const messages = error instanceof GissError || error instanceof NationalError ? error.messages : [];
+    if (messages.length > 0) {
+        console.error(`\n${origin} returned an error:`);
+        for (const message of messages) {
+            console.error(`  [${message.code}] ${message.message}${message.correction ? ` — ${message.correction}` : ""}`);
+        }
+    }
+    else {
+        console.error(`\n${error.message}`);
+    }
+    console.error(`\n  code: ${error.code}${origin ? `  (${origin})` : ""}`);
+    if (error.outcomeUnknown) {
+        console.error("\n⚠ The request may have reached the service, and the answer did not come back.");
+        const rps = error.details["rps"];
+        const id = error.details["dpsId"]
+            ? `DPS ${String(error.details["dpsId"])}`
+            : rps
+                ? `RPS ${String(rps.number)} series ${String(rps.series)}`
+                : undefined;
+        console.error(id
+            ? `  Repeat with the same number (${id}): it will not issue twice.`
+            : "  Repeat with the same RPS/DPS number: it will not issue twice.");
+    }
+    else if (NEXT_STEP[error.code]) {
+        console.error(`  ${NEXT_STEP[error.code]}`);
+    }
+    if (messages.some((m) => m.code === "E0039")) {
+        console.error(`\nThe city has not enabled the national issuer for this taxpayer. Check with: ${INVOCATION} national-status — or issue through GissOnline with --issuer giss`);
+    }
+    if (debug && error.cause)
+        console.error("\ncause:", error.cause);
+}
+main().catch((error) => {
+    printError(error, process.argv.includes("--debug"));
+    process.exitCode = 1;
+});
+//# sourceMappingURL=index.js.map