From f0c3ce483e9108408e54dec58af82f5aa706c57f Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 16 Mar 2026 18:45:22 +0000
Subject: [PATCH 1/3] =?UTF-8?q?feat:=20implementa=20SOE=20Rule=20Engine=20?=
 =?UTF-8?q?+=20Apache=20Superset=20(Arc=C3=A1dia=20Insights)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## SOE — Sistema Operacional Empresarial
- Adiciona 3 tabelas ao schema: soe_regras, soe_eventos, soe_lancamentos
- Cria server/soe/rule-engine/ com motor de regras configuráveis
  - Regras fiscais padrão: CFOP, tributação por regime, validações NCM
  - Regras de negócio: aprovação auto, reserva estoque, alertas
- Cria server/soe/event-bus.ts — dispara automações pós-execução
- Cria handlers: contabil-handler.ts (lançamentos automáticos) e
  financial-handler.ts (contas a P/R automáticas)
- Plugar Rule Engine em 3 rotas críticas do server/erp/routes.ts:
  POST /sales-orders, POST /confirm, POST /generate-nfe
- Redireciona /plus → /soe no frontend (Plus fica invisível)

## Apache Superset (Arcádia Insights)
- Expande docker-compose.yml: volumes, init script, config file
- Cria docker/superset/superset_config.py (embedding + CORS + feature flags)
- Cria docker/superset/init.sh (migração DB + admin + registro banco Arcádia)
- Substitui server/metabase/proxy.ts por server/superset/proxy.ts
- Substitui server/metaset/routes.ts por server/superset/routes.ts
  com Guest Token JWT para embedding nativo em qualquer tela
- Instala @superset-ui/embedded-sdk
- Cria client/src/components/SupersetDashboard.tsx — componente
  reutilizável via Guest Token, fallback para iframe
- Atualiza BiWorkspace.tsx: tab MetaSet → Insights (com seletor de dashboards)
- Atualiza .env.example com variáveis Superset completas

https://claude.ai/code/session_01DinH3VcgbAv1d9MqnNxzdb
---
 .env.example                                |  10 +-
 client/src/App.tsx                          |   6 +-
 client/src/components/SupersetDashboard.tsx | 160 +++++++++++++
 client/src/pages/BiWorkspace.tsx            |  99 +++++---
 docker-compose.yml                          |  27 ++-
 docker/superset/init.sh                     |  82 +++++++
 docker/superset/superset_config.py          |  62 +++++
 package.json                                |   1 +
 server/erp/routes.ts                        |  62 ++++-
 server/routes.ts                            |  12 +-
 server/soe/event-bus.ts                     | 112 +++++++++
 server/soe/handlers/contabil-handler.ts     | 182 +++++++++++++++
 server/soe/handlers/financial-handler.ts    | 128 +++++++++++
 server/soe/rule-engine/business-rules.ts    |  72 ++++++
 server/soe/rule-engine/fiscal-rules.ts      | 150 ++++++++++++
 server/soe/rule-engine/index.ts             | 240 ++++++++++++++++++++
 server/soe/rule-engine/types.ts             |  47 ++++
 server/superset/proxy.ts                    |  39 ++++
 server/superset/routes.ts                   | 108 +++++++++
 shared/schema.ts                            |  67 ++++++
 20 files changed, 1622 insertions(+), 44 deletions(-)
 create mode 100644 client/src/components/SupersetDashboard.tsx
 create mode 100755 docker/superset/init.sh
 create mode 100644 docker/superset/superset_config.py
 create mode 100644 server/soe/event-bus.ts
 create mode 100644 server/soe/handlers/contabil-handler.ts
 create mode 100644 server/soe/handlers/financial-handler.ts
 create mode 100644 server/soe/rule-engine/business-rules.ts
 create mode 100644 server/soe/rule-engine/fiscal-rules.ts
 create mode 100644 server/soe/rule-engine/index.ts
 create mode 100644 server/soe/rule-engine/types.ts
 create mode 100644 server/superset/proxy.ts
 create mode 100644 server/superset/routes.ts

diff --git a/.env.example b/.env.example
index 656b051..bcc19a1 100644
--- a/.env.example
+++ b/.env.example
@@ -68,9 +68,15 @@ PLUS_URL=http://localhost:8080
 PLUS_PORT=8080
 PLUS_API_TOKEN=
 
-# ── Superset (BI avançado) ────────────────────────────────────────────────────
-SUPERSET_SECRET_KEY=troque-por-string-aleatoria-segura
+# ── Superset (BI avançado — Arcádia Insights) ────────────────────────────────
+SUPERSET_HOST=superset
 SUPERSET_PORT=8088
+SUPERSET_SECRET_KEY=troque-por-string-aleatoria-segura  # openssl rand -hex 32
+SUPERSET_ADMIN_USER=admin
+SUPERSET_ADMIN_EMAIL=admin@arcadia.app
+SUPERSET_ADMIN_PASSWORD=troque-senha-forte-em-prod
+# URL do banco Arcádia para o Superset acessar os dados (idealmente read-only)
+ARCADIA_DATABASE_URL=postgresql://arcadia:arcadia123@db:5432/arcadia
 
 # ── Redis ─────────────────────────────────────────────────────────────────────
 REDIS_URL=redis://localhost:6379
diff --git a/client/src/App.tsx b/client/src/App.tsx
index ea75205..f4a16aa 100644
--- a/client/src/App.tsx
+++ b/client/src/App.tsx
@@ -1,5 +1,5 @@
-import { Switch, Route } from "wouter";
-import { lazy, Suspense } from "react";
+import { Switch, Route, useLocation } from "wouter";
+import { lazy, Suspense, useEffect } from "react";
 import { queryClient } from "./lib/queryClient";
 import { QueryClientProvider } from "@tanstack/react-query";
 import { Toaster } from "@/components/ui/toaster";
@@ -121,7 +121,7 @@ function Router() {
       <ProtectedRoute path="/engineering" component={EngineeringHub} />
       <ProtectedRoute path="/development" component={DevelopmentModule} />
       <ProtectedRoute path="/retail" component={ArcadiaRetail} />
-      <ProtectedRoute path="/plus" component={Plus} />
+      <ProtectedRoute path="/plus" component={() => { const [, nav] = useLocation(); useEffect(() => nav("/soe"), []); return null; }} />
       <ProtectedRoute path="/super-admin" component={SuperAdmin} />
       <ProtectedRoute path="/marketplace" component={Marketplace} />
       <ProtectedRoute path="/lms" component={LMS} />
diff --git a/client/src/components/SupersetDashboard.tsx b/client/src/components/SupersetDashboard.tsx
new file mode 100644
index 0000000..c465bce
--- /dev/null
+++ b/client/src/components/SupersetDashboard.tsx
@@ -0,0 +1,160 @@
+import { useEffect, useRef, useState, useCallback } from "react";
+import { Loader2, AlertTriangle, ExternalLink, RefreshCw } from "lucide-react";
+
+interface SupersetDashboardProps {
+  dashboardId: string;
+  height?: string | number;
+  className?: string;
+  showOpenLink?: boolean;
+}
+
+/**
+ * Componente reutilizável para embedar dashboards do Apache Superset (Arcádia Insights)
+ * em QUALQUER tela do Arcádia Suite via Guest Token JWT.
+ *
+ * Uso:
+ *   <SupersetDashboard dashboardId="financial-overview" />
+ *   <SupersetDashboard dashboardId="dre-mensal" height={400} />
+ */
+export function SupersetDashboard({
+  dashboardId,
+  height = "calc(100vh - 320px)",
+  className = "",
+  showOpenLink = true,
+}: SupersetDashboardProps) {
+  const containerRef = useRef<HTMLDivElement>(null);
+  const sdkRef = useRef<any>(null);
+  const [status, setStatus] = useState<"loading" | "ready" | "error" | "unavailable">("loading");
+  const [errorMsg, setErrorMsg] = useState<string>("");
+
+  const fetchGuestToken = useCallback(async (): Promise<string> => {
+    const resp = await fetch("/api/superset/guest-token", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ dashboardId }),
+      credentials: "include",
+    });
+    if (!resp.ok) {
+      const err = await resp.json().catch(() => ({ error: "Erro desconhecido" }));
+      throw new Error(err.error || `HTTP ${resp.status}`);
+    }
+    const { token } = await resp.json();
+    return token;
+  }, [dashboardId]);
+
+  const loadDashboard = useCallback(async () => {
+    if (!containerRef.current) return;
+    setStatus("loading");
+    setErrorMsg("");
+
+    try {
+      // Verifica se Superset está disponível
+      const health = await fetch("/api/superset/health", { credentials: "include" });
+      const healthData = await health.json();
+      if (!healthData.online) {
+        setStatus("unavailable");
+        return;
+      }
+
+      // Importa SDK dinamicamente (só quando necessário)
+      const { embedDashboard } = await import("@superset-ui/embedded-sdk");
+
+      // Limpa embedding anterior se houver
+      if (sdkRef.current) {
+        containerRef.current.innerHTML = "";
+      }
+
+      sdkRef.current = await embedDashboard({
+        id: dashboardId,
+        supersetDomain: window.location.origin + "/superset",
+        mountPoint: containerRef.current,
+        fetchGuestToken,
+        dashboardUiConfig: {
+          hideTitle: true,
+          hideChartControls: false,
+          filters: { visible: true, expanded: false },
+        },
+      });
+
+      setStatus("ready");
+    } catch (err: any) {
+      console.error("[SupersetDashboard] Erro:", err.message);
+      // Se SDK não estiver instalado, usa iframe como fallback
+      if (err.message?.includes("Cannot find module") || err.message?.includes("embedDashboard")) {
+        setStatus("unavailable");
+      } else {
+        setErrorMsg(err.message);
+        setStatus("error");
+      }
+    }
+  }, [dashboardId, fetchGuestToken]);
+
+  useEffect(() => {
+    loadDashboard();
+    return () => {
+      if (containerRef.current) containerRef.current.innerHTML = "";
+    };
+  }, [loadDashboard]);
+
+  const heightStyle = typeof height === "number" ? `${height}px` : height;
+
+  if (status === "unavailable") {
+    return (
+      <div className={`rounded-xl overflow-hidden border border-[#c89b3c]/20 bg-white shadow-sm ${className}`} style={{ height: heightStyle }}>
+        <iframe
+          src="/superset/login"
+          className="w-full h-full border-0"
+          title="Arcádia Insights — Apache Superset"
+          allow="fullscreen"
+        />
+      </div>
+    );
+  }
+
+  if (status === "error") {
+    return (
+      <div className={`flex flex-col items-center justify-center gap-4 rounded-xl border border-red-100 bg-red-50 ${className}`} style={{ height: heightStyle }}>
+        <AlertTriangle className="w-8 h-8 text-red-400" />
+        <div className="text-center">
+          <p className="font-medium text-red-700 text-sm">Erro ao carregar dashboard</p>
+          <p className="text-red-500 text-xs mt-1">{errorMsg}</p>
+        </div>
+        <button
+          onClick={loadDashboard}
+          className="flex items-center gap-2 px-4 py-2 bg-red-600 text-white rounded-lg text-sm hover:bg-red-700 transition-colors"
+        >
+          <RefreshCw className="w-4 h-4" /> Tentar novamente
+        </button>
+      </div>
+    );
+  }
+
+  return (
+    <div className={`relative ${className}`} style={{ height: heightStyle }}>
+      {status === "loading" && (
+        <div className="absolute inset-0 flex items-center justify-center bg-white/90 z-10 rounded-xl">
+          <div className="text-center">
+            <Loader2 className="w-8 h-8 text-[#c89b3c] animate-spin mx-auto mb-3" />
+            <p className="text-sm text-[#1f334d] font-medium">Carregando Arcádia Insights...</p>
+          </div>
+        </div>
+      )}
+
+      {showOpenLink && status === "ready" && (
+        <a
+          href="/superset"
+          target="_blank"
+          rel="noopener noreferrer"
+          className="absolute top-3 right-3 z-10 flex items-center gap-1 px-2 py-1 bg-white/80 backdrop-blur text-[#1f334d] text-xs rounded-lg border border-gray-200 hover:bg-white transition-colors shadow-sm"
+        >
+          <ExternalLink className="w-3 h-3" /> Abrir completo
+        </a>
+      )}
+
+      <div
+        ref={containerRef}
+        className="w-full h-full rounded-xl overflow-hidden border border-[#c89b3c]/20"
+      />
+    </div>
+  );
+}
diff --git a/client/src/pages/BiWorkspace.tsx b/client/src/pages/BiWorkspace.tsx
index af7341d..2a32d3b 100644
--- a/client/src/pages/BiWorkspace.tsx
+++ b/client/src/pages/BiWorkspace.tsx
@@ -1,5 +1,5 @@
 import { BrowserFrame } from "@/components/Browser/BrowserFrame";
-import { useState } from "react";
+import { useState, useEffect } from "react";
 import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
 import { Button } from "@/components/ui/button";
 import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
@@ -49,6 +49,7 @@ import {
   MessageSquare,
 } from "lucide-react";
 import { Textarea } from "@/components/ui/textarea";
+import { SupersetDashboard } from "@/components/SupersetDashboard";
 import {
   Dialog,
   DialogContent,
@@ -81,6 +82,73 @@ import {
   Cell,
 } from "recharts";
 
+// ── Componente da aba Insights (Apache Superset) ──────────────────────────────
+function SupersetAdvancedTab() {
+  const [selectedDashboard, setSelectedDashboard] = useState<string>("");
+  const [dashboards, setDashboards] = useState<Array<{ id: string; title: string }>>([]);
+
+  useEffect(() => {
+    fetch("/api/superset/dashboards", { credentials: "include" })
+      .then(r => r.json())
+      .then(data => {
+        if (Array.isArray(data)) {
+          setDashboards(data.map((d: any) => ({ id: String(d.id), title: d.dashboard_title || d.title })));
+          if (data.length > 0) setSelectedDashboard(String(data[0].id));
+        }
+      })
+      .catch(() => setDashboards([]));
+  }, []);
+
+  return (
+    <div className="space-y-4">
+      <div className="flex items-center justify-between flex-wrap gap-3">
+        <div>
+          <h2 className="text-lg font-semibold text-[#1f334d]">Arcádia Insights — Apache Superset</h2>
+          <p className="text-sm text-gray-500">SQL Lab avançado, 50+ tipos de gráfico, dashboards interativos</p>
+        </div>
+        <div className="flex items-center gap-2">
+          {dashboards.length > 0 && (
+            <select
+              value={selectedDashboard}
+              onChange={e => setSelectedDashboard(e.target.value)}
+              className="text-sm border border-gray-200 rounded-lg px-3 py-2 bg-white text-[#1f334d] focus:outline-none focus:ring-2 focus:ring-[#c89b3c]"
+            >
+              {dashboards.map(d => (
+                <option key={d.id} value={d.id}>{d.title}</option>
+              ))}
+            </select>
+          )}
+          <a
+            href="/superset"
+            target="_blank"
+            rel="noopener noreferrer"
+            className="inline-flex items-center gap-2 px-4 py-2 bg-[#1f334d] text-white rounded-lg hover:bg-[#2a4466] transition-colors text-sm"
+          >
+            <ArrowRight className="w-4 h-4" /> Abrir completo
+          </a>
+        </div>
+      </div>
+
+      {selectedDashboard ? (
+        <SupersetDashboard
+          dashboardId={selectedDashboard}
+          height="calc(100vh - 320px)"
+          showOpenLink={false}
+        />
+      ) : (
+        <div className="rounded-xl overflow-hidden border border-[#c89b3c]/20 bg-white shadow-sm" style={{ height: "calc(100vh - 320px)" }}>
+          <iframe
+            src="/superset"
+            className="w-full h-full border-0"
+            title="Arcádia Insights — Apache Superset"
+            allow="fullscreen"
+          />
+        </div>
+      )}
+    </div>
+  );
+}
+
 interface BiStats {
   dataSources: number;
   datasets: number;
@@ -2890,7 +2958,7 @@ export default function BiWorkspace() {
                 <Layers className="w-4 h-4 mr-2" /> Staging
               </TabsTrigger>
               <TabsTrigger value="advanced" className="data-[state=active]:bg-[#c89b3c] data-[state=active]:text-[#1f334d] text-white/70">
-                <Settings className="w-4 h-4 mr-2" /> MetaSet
+                <Settings className="w-4 h-4 mr-2" /> Insights
               </TabsTrigger>
             </TabsList>
 
@@ -2916,32 +2984,7 @@ export default function BiWorkspace() {
               <StagingTab />
             </TabsContent>
             <TabsContent value="advanced" className="mt-0">
-              <div className="space-y-4">
-                <div className="flex items-center justify-between">
-                  <div>
-                    <h2 className="text-lg font-semibold text-[#1f334d]">MetaSet - Motor de BI</h2>
-                    <p className="text-sm text-gray-500">Acesso completo para criação manual de consultas SQL, gráficos e dashboards</p>
-                  </div>
-                  <a
-                    href="/api/bi/metaset/autologin"
-                    target="_blank"
-                    rel="noopener noreferrer"
-                    className="inline-flex items-center gap-2 px-4 py-2 bg-[#1f334d] text-white rounded-lg hover:bg-[#2a4466] transition-colors text-sm"
-                    data-testid="link-open-metaset-external"
-                  >
-                    <ArrowRight className="w-4 h-4" /> Abrir em Nova Aba
-                  </a>
-                </div>
-                <div className="rounded-xl overflow-hidden border border-[#c89b3c]/20 bg-white shadow-sm" style={{ height: 'calc(100vh - 320px)' }}>
-                  <iframe
-                    src="/api/bi/metaset/autologin"
-                    className="w-full h-full border-0"
-                    title="MetaSet - Arcádia Insights"
-                    data-testid="iframe-metaset-advanced"
-                    allow="fullscreen"
-                  />
-                </div>
-              </div>
+              <SupersetAdvancedTab />
             </TabsContent>
           </Tabs>
         </div>
diff --git a/docker-compose.yml b/docker-compose.yml
index b2d8866..e22222f 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -167,12 +167,32 @@ services:
     restart: unless-stopped
     environment:
       SUPERSET_SECRET_KEY: ${SUPERSET_SECRET_KEY:-superset-secret-change-in-prod}
-      DATABASE_URL: postgresql://arcadia:arcadia123@db:5432/arcadia_superset
+      DATABASE_URL: postgresql://${PGUSER:-arcadia}:${PGPASSWORD:-arcadia123}@db:5432/arcadia_superset
+      ARCADIA_DATABASE_URL: postgresql://${PGUSER:-arcadia}:${PGPASSWORD:-arcadia123}@db:5432/arcadia
+      SUPERSET_ADMIN_USER: ${SUPERSET_ADMIN_USER:-admin}
+      SUPERSET_ADMIN_EMAIL: ${SUPERSET_ADMIN_EMAIL:-admin@arcadia.app}
+      SUPERSET_ADMIN_PASSWORD: ${SUPERSET_ADMIN_PASSWORD:-arcadia2026}
+      SUPERSET_WEBSERVER_PORT: 8088
+      PYTHONPATH: /app/pythonpath
+      FLASK_ENV: production
     ports:
       - "8088:8088"
+    volumes:
+      - ./docker/superset/superset_config.py:/app/pythonpath/superset_config.py:ro
+      - ./docker/superset/init.sh:/app/docker/init.sh:ro
+      - superset_home:/app/superset_home
     depends_on:
       db:
         condition: service_healthy
+    command: ["/bin/bash", "/app/docker/init.sh"]
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8088/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 60s
+    networks:
+      - arcadia
     profiles: [bi]
 
   # ─────────────── PERFIL: ai (Soberania de IA) ────────────────────────────────
@@ -231,3 +251,8 @@ volumes:
   pgdata:
   ollama_models:
   open_webui_data:
+  superset_home:
+
+networks:
+  arcadia:
+    driver: bridge
diff --git a/docker/superset/init.sh b/docker/superset/init.sh
new file mode 100755
index 0000000..4a500c6
--- /dev/null
+++ b/docker/superset/init.sh
@@ -0,0 +1,82 @@
+#!/bin/bash
+# Arcádia Suite — Apache Superset Init Script
+# Executado ao iniciar o container
+set -e
+
+SUPERSET_ADMIN_USER="${SUPERSET_ADMIN_USER:-admin}"
+SUPERSET_ADMIN_EMAIL="${SUPERSET_ADMIN_EMAIL:-admin@arcadia.app}"
+SUPERSET_ADMIN_PASSWORD="${SUPERSET_ADMIN_PASSWORD:-arcadia2026}"
+ARCADIA_DB_URL="${ARCADIA_DATABASE_URL:-postgresql://arcadia:arcadia123@db:5432/arcadia}"
+
+echo "[Superset Init] Aguardando PostgreSQL..."
+until python -c "
+import psycopg2, os, sys
+try:
+    url = os.environ.get('DATABASE_URL', 'postgresql://arcadia:arcadia123@db:5432/arcadia_superset')
+    psycopg2.connect(url)
+    sys.exit(0)
+except: sys.exit(1)
+" 2>/dev/null; do
+  sleep 2
+done
+echo "[Superset Init] PostgreSQL disponível!"
+
+echo "[Superset Init] Rodando migrações do banco..."
+superset db upgrade
+
+echo "[Superset Init] Criando admin..."
+superset fab create-admin \
+  --username "${SUPERSET_ADMIN_USER}" \
+  --firstname "Arcádia" \
+  --lastname "Admin" \
+  --email "${SUPERSET_ADMIN_EMAIL}" \
+  --password "${SUPERSET_ADMIN_PASSWORD}" 2>/dev/null || echo "[Superset Init] Admin já existe."
+
+echo "[Superset Init] Inicializando roles e permissões..."
+superset init
+
+echo "[Superset Init] Registrando banco Arcádia Suite..."
+python - <<PYEOF
+import sys
+try:
+    from superset import create_app
+    from superset.extensions import db as sdb
+    from superset.models.core import Database as SupersetDB
+
+    app = create_app()
+    with app.app_context():
+        existing = sdb.session.query(SupersetDB).filter_by(database_name="Arcádia Suite").first()
+        if not existing:
+            new_db = SupersetDB(
+                database_name="Arcádia Suite",
+                sqlalchemy_uri="${ARCADIA_DB_URL}",
+                expose_in_sqllab=True,
+                allow_run_async=True,
+                allow_csv_upload=False,
+                allow_ctas=False,
+                allow_cvas=False,
+                allow_dml=False,
+                extra='{"metadata_params":{},"engine_params":{},"metadata_cache_timeout":{},"schemas_allowed_for_file_upload":[]}',
+            )
+            sdb.session.add(new_db)
+            sdb.session.commit()
+            print("[Superset Init] Banco 'Arcádia Suite' registrado com sucesso!")
+        else:
+            print("[Superset Init] Banco 'Arcádia Suite' já está registrado.")
+except Exception as e:
+    print(f"[Superset Init] Aviso ao registrar banco: {e}")
+    sys.exit(0)
+PYEOF
+
+echo "[Superset Init] Iniciando servidor Superset..."
+exec gunicorn \
+  --bind "0.0.0.0:${SUPERSET_WEBSERVER_PORT:-8088}" \
+  --access-logfile - \
+  --error-logfile - \
+  --workers "${SUPERSET_WORKERS:-4}" \
+  --worker-class gthread \
+  --threads 2 \
+  --timeout 120 \
+  --limit-request-line 0 \
+  --limit-request-field_size 0 \
+  "superset.app:create_app()"
diff --git a/docker/superset/superset_config.py b/docker/superset/superset_config.py
new file mode 100644
index 0000000..97ad057
--- /dev/null
+++ b/docker/superset/superset_config.py
@@ -0,0 +1,62 @@
+"""
+Arcádia Suite — Apache Superset Configuration
+Habilita embedding nativo via Guest Token JWT
+"""
+import os
+
+# ── Segurança ─────────────────────────────────────────────────────────────────
+SECRET_KEY = os.environ.get("SUPERSET_SECRET_KEY", "change-in-production-use-openssl-rand-hex-32")
+
+# ── Banco de metadados do Superset ────────────────────────────────────────────
+SQLALCHEMY_DATABASE_URI = os.environ.get(
+    "DATABASE_URL",
+    "postgresql://arcadia:arcadia123@db:5432/arcadia_superset"
+)
+
+# ── CORS — permite o gateway Arcádia (:5000) chamar a API ────────────────────
+ENABLE_CORS = True
+CORS_OPTIONS = {
+    "supports_credentials": True,
+    "allow_headers": ["*"],
+    "resources": {r"/api/*": {"origins": "*"}},
+}
+
+# ── Feature Flags ─────────────────────────────────────────────────────────────
+FEATURE_FLAGS = {
+    "EMBEDDED_SUPERSET": True,          # Embedding via Guest Token
+    "ENABLE_TEMPLATE_PROCESSING": True, # Jinja templates em queries
+    "ALERT_REPORTS": True,              # Alertas automáticos
+    "DRILL_TO_DETAIL": True,            # Drill-down em charts
+    "DRILL_BY": True,                   # Drill-by em charts
+    "DASHBOARD_NATIVE_FILTERS": True,   # Filtros nativos em dashboards
+    "DASHBOARD_CROSS_FILTERS": True,    # Cross-filter entre charts
+    "ENABLE_JAVASCRIPT_CONTROLS": False, # Desabilitado por segurança
+}
+
+# ── Cache ─────────────────────────────────────────────────────────────────────
+CACHE_CONFIG = {
+    "CACHE_TYPE": "SimpleCache",
+    "CACHE_DEFAULT_TIMEOUT": 300,  # 5 minutos
+}
+
+# ── Timeout de queries ────────────────────────────────────────────────────────
+SUPERSET_WEBSERVER_TIMEOUT = 300
+SQLLAB_TIMEOUT = 300
+SQLLAB_ASYNC_TIME_LIMIT_SEC = 300
+
+# ── Branding Arcádia ──────────────────────────────────────────────────────────
+APP_NAME = "Arcádia Insights"
+LOGO_TARGET_PATH = "/"
+FAVICONS = [{"href": "/static/assets/images/favicon.png"}]
+
+# ── Segurança de sessão ───────────────────────────────────────────────────────
+SESSION_COOKIE_SAMESITE = "Lax"
+SESSION_COOKIE_SECURE = False   # True em prod com HTTPS
+WTF_CSRF_ENABLED = True
+WTF_CSRF_EXEMPT_LIST = ["superset.views.core.log"]
+
+# ── Guest Token (para embedding) ──────────────────────────────────────────────
+GUEST_TOKEN_JWT_EXP_SECONDS = 300  # 5 minutos — frontend renova automaticamente
+GUEST_ROLE_NAME = "Public"
+GUEST_TOKEN_JWT_ALGO = "HS256"
+GUEST_TOKEN_HEADER_NAME = "X-GuestToken"
diff --git a/package.json b/package.json
index 4779f0c..26b0cb7 100644
--- a/package.json
+++ b/package.json
@@ -43,6 +43,7 @@
     "@radix-ui/react-toggle": "^1.1.10",
     "@radix-ui/react-toggle-group": "^1.1.11",
     "@radix-ui/react-tooltip": "^1.2.8",
+    "@superset-ui/embedded-sdk": "^0.3.0",
     "@tanstack/react-query": "^5.60.5",
     "@tiptap/extension-image": "^3.15.3",
     "@tiptap/extension-link": "^3.15.3",
diff --git a/server/erp/routes.ts b/server/erp/routes.ts
index f8d36ba..15ba715 100644
--- a/server/erp/routes.ts
+++ b/server/erp/routes.ts
@@ -4,6 +4,8 @@ import { db } from "../../db/index";
 import { customers, suppliers, products, salesOrders, purchaseOrders, erpSegments, erpConfig, insertErpSegmentSchema, insertErpConfigSchema, persons, personRoles, mobileDevices, posSales, posSaleItems, finAccountsReceivable } from "@shared/schema";
 import { eq, and, sql, desc } from "drizzle-orm";
 import { z } from "zod";
+import { soeRuleEngine } from "../soe/rule-engine/index";
+import { soeEventBus } from "../soe/event-bus";
 
 export function registerErpRoutes(app: Express): void {
   app.get("/api/erp/connections", async (req: Request, res: Response) => {
@@ -850,12 +852,24 @@ export function registerErpRoutes(app: Express): void {
         return res.status(401).json({ error: "Not authenticated" });
       }
       const tenantId = req.user?.tenantId || 1;
-      const { orderNumber, customerId, orderDate, deliveryDate, status, subtotal, discount, tax, total, paymentMethod, notes } = req.body;
+      const user = req.user as any;
+
+      // SOE Rule Engine — aplica regras fiscais e de negócio antes de criar o pedido
+      const { payload: enriched, validationErrors } = await soeRuleEngine.apply(
+        "pre_sales_order",
+        { ...req.body, _tipo: "venda" },
+        { tenantId, empresaId: req.body.empresaId, userId: user?.id, motor: "local" }
+      );
+      if (validationErrors.length > 0) {
+        return res.status(422).json({ error: "Validação falhou", details: validationErrors });
+      }
+
+      const { orderNumber, customerId, orderDate, deliveryDate, status, subtotal, discount, tax, total, paymentMethod, notes } = enriched;
       const [order] = await db.insert(salesOrders).values({
         tenantId,
         orderNumber, customerId, orderDate, deliveryDate, status, subtotal, discount, tax, total, paymentMethod, notes
       }).returning();
-      res.status(201).json(order);
+      res.status(201).json({ ...order, _rulesApplied: enriched._rulesApplied });
     } catch (error) {
       console.error("Error creating sales order:", error);
       res.status(500).json({ error: "Failed to create sales order" });
@@ -876,7 +890,16 @@ export function registerErpRoutes(app: Express): void {
       if (!updated) {
         return res.status(404).json({ error: "Sales order not found" });
       }
-      res.json({ success: true, order: updated, message: "Pedido confirmado. Lançamentos contábeis gerados." });
+
+      // SOE Event Bus — dispara automações pós-confirmação
+      soeEventBus.emit("venda_confirmada", {
+        tenantId,
+        empresaId: (req.user as any)?.empresaId,
+        motorOrigem: "local",
+        dados: { id, status: "confirmed", ...updated },
+      }).catch((e) => console.error("[SOE] venda_confirmada error:", e.message));
+
+      res.json({ success: true, order: updated, message: "Pedido confirmado. Automações SOE disparadas." });
     } catch (error) {
       console.error("Error confirming sales order:", error);
       res.status(500).json({ error: "Failed to confirm sales order" });
@@ -890,6 +913,18 @@ export function registerErpRoutes(app: Express): void {
       }
       const id = parseInt(req.params.id);
       const tenantId = req.user?.tenantId || 1;
+      const user = req.user as any;
+
+      // SOE Rule Engine — aplica regras fiscais antes de gerar a NF-e
+      const { payload: enriched, validationErrors } = await soeRuleEngine.apply(
+        "pre_nfe_emissao",
+        { ...req.body, tipoDocumento: "nfe", _tipo: "venda" },
+        { tenantId, empresaId: user?.empresaId, userId: user?.id, motor: "local" }
+      );
+      if (validationErrors.length > 0) {
+        return res.status(422).json({ error: "Validação fiscal falhou", details: validationErrors });
+      }
+
       const [updated] = await db.update(salesOrders)
         .set({ status: "invoiced" })
         .where(and(eq(salesOrders.id, id), eq(salesOrders.tenantId, tenantId)))
@@ -897,7 +932,26 @@ export function registerErpRoutes(app: Express): void {
       if (!updated) {
         return res.status(404).json({ error: "Sales order not found" });
       }
-      res.json({ success: true, order: updated, message: "NF-e gerada com sucesso." });
+
+      // SOE Event Bus — dispara lançamentos contábeis automáticos
+      soeEventBus.emit("nfe_emitida", {
+        tenantId,
+        empresaId: user?.empresaId,
+        motorOrigem: "local",
+        dados: {
+          ...enriched,
+          ...updated,
+          valorTotal: updated.total,
+          dataEmissao: new Date().toISOString(),
+        },
+      }).catch((e) => console.error("[SOE] nfe_emitida error:", e.message));
+
+      res.json({
+        success: true,
+        order: updated,
+        tributacao: enriched.tributacao,
+        message: "NF-e gerada. Lançamentos contábeis sendo processados.",
+      });
     } catch (error) {
       console.error("Error generating NF-e:", error);
       res.status(500).json({ error: "Failed to generate NF-e" });
diff --git a/server/routes.ts b/server/routes.ts
index 1b0fe2a..2b52597 100644
--- a/server/routes.ts
+++ b/server/routes.ts
@@ -47,9 +47,9 @@ import lmsRoutes from "./lms/routes";
 import xosRoutes from "./xos/routes";
 import governanceRoutes from "./governance/routes";
 import { setupPlusProxy } from "./plus/proxy";
-import { setupMetabaseProxy } from "./metabase/proxy";
+import { setupSupersetProxy } from "./superset/proxy";
+import { registerSupersetRoutes } from "./superset/routes";
 import { registerEngineRoomRoutes } from "./engine-room/routes";
-import { registerMetaSetRoutes } from "./metaset/routes";
 import plusSsoRoutes from "./plus/sso";
 import migrationRoutes from "./migration/routes";
 import { githubRoutes } from "./integrations/github";
@@ -69,9 +69,10 @@ export async function registerRoutes(
   
   // Arcádia Plus - Proxy registered AFTER session but BEFORE auth-protected routes
   await setupPlusProxy(app);
-  
-  // Metabase BI - Proxy to Metabase instance
-  setupMetabaseProxy(app);
+
+  // Apache Superset - Arcádia Insights (substitui Metabase)
+  setupSupersetProxy(app);
+  registerSupersetRoutes(app);
   
   registerChatRoutes(app);
   registerSoeRoutes(app);
@@ -86,7 +87,6 @@ export async function registerRoutes(
   registerBiRoutes(app);
   app.use("/api/graph", graphRoutes);
   registerBiEngineRoutes(app);
-  registerMetaSetRoutes(app);
   registerCommEngineRoutes(app);
   registerLearningRoutes(app);
   app.use("/api/compass", compassRoutes);
diff --git a/server/soe/event-bus.ts b/server/soe/event-bus.ts
new file mode 100644
index 0000000..bce482f
--- /dev/null
+++ b/server/soe/event-bus.ts
@@ -0,0 +1,112 @@
+// SOE Event Bus — Dispara eventos após execução do motor
+// Permite que lançamentos contábeis, alertas e automações
+// sejam disparados de forma desacoplada após cada operação SOE.
+
+import { db } from "../db/index";
+import { soeEventos } from "@shared/schema";
+import { contabilHandler } from "./handlers/contabil-handler";
+import { financialHandler } from "./handlers/financial-handler";
+
+export type SoeEventType =
+  | "nfe_emitida"
+  | "nfe_cancelada"
+  | "venda_confirmada"
+  | "venda_faturada"
+  | "compra_recebida"
+  | "pagamento_realizado"
+  | "recebimento_realizado"
+  | "estoque_baixo";
+
+export interface SoeEventPayload {
+  tenantId?: number;
+  empresaId?: number;
+  motorOrigem?: "plus" | "erpnext" | "local";
+  dados: Record<string, any>;
+}
+
+type EventHandler = (payload: SoeEventPayload) => Promise<void>;
+
+// Mapa de handlers por evento
+const HANDLERS: Record<SoeEventType, EventHandler[]> = {
+  nfe_emitida: [
+    contabilHandler.lancamentoVenda,
+    financialHandler.criarContaReceber,
+  ],
+  nfe_cancelada: [
+    contabilHandler.estornoLancamentoVenda,
+  ],
+  venda_confirmada: [
+    financialHandler.reservarEstoque,
+  ],
+  venda_faturada: [
+    contabilHandler.lancamentoVenda,
+  ],
+  compra_recebida: [
+    contabilHandler.lancamentoCompra,
+    financialHandler.criarContaPagar,
+  ],
+  pagamento_realizado: [
+    contabilHandler.lancamentoPagamento,
+    financialHandler.baixarContaPagar,
+  ],
+  recebimento_realizado: [
+    contabilHandler.lancamentoRecebimento,
+    financialHandler.baixarContaReceber,
+  ],
+  estoque_baixo: [
+    financialHandler.alertaEstoqueBaixo,
+  ],
+};
+
+export class SoeEventBus {
+  private static instance: SoeEventBus;
+
+  static getInstance(): SoeEventBus {
+    if (!SoeEventBus.instance) SoeEventBus.instance = new SoeEventBus();
+    return SoeEventBus.instance;
+  }
+
+  async emit(evento: SoeEventType, payload: SoeEventPayload): Promise<void> {
+    const start = Date.now();
+
+    // Registra evento no banco
+    let eventoId: string | undefined;
+    try {
+      const [row] = await db
+        .insert(soeEventos)
+        .values({
+          tenantId: payload.tenantId,
+          empresaId: payload.empresaId,
+          evento,
+          motorOrigem: payload.motorOrigem,
+          payloadEntrada: payload.dados,
+          status: "ok",
+        })
+        .returning({ id: soeEventos.id });
+      eventoId = row?.id;
+    } catch (e: any) {
+      console.error("[SoeEventBus] Erro ao registrar evento:", e.message);
+    }
+
+    // Dispara handlers em paralelo (falha isolada — não bloqueia o fluxo)
+    const handlers = HANDLERS[evento] ?? [];
+    const results = await Promise.allSettled(
+      handlers.map((h) => h({ ...payload, dados: { ...payload.dados, _eventoId: eventoId } }))
+    );
+
+    const erros = results
+      .filter((r) => r.status === "rejected")
+      .map((r) => (r as PromiseRejectedResult).reason?.message);
+
+    if (erros.length > 0) {
+      console.warn(`[SoeEventBus] ${evento}: ${erros.length} handler(s) falharam:`, erros);
+    }
+
+    console.log(
+      `[SoeEventBus] ${evento} processado em ${Date.now() - start}ms | ` +
+      `${handlers.length} handlers | ${erros.length} erros`
+    );
+  }
+}
+
+export const soeEventBus = SoeEventBus.getInstance();
diff --git a/server/soe/handlers/contabil-handler.ts b/server/soe/handlers/contabil-handler.ts
new file mode 100644
index 0000000..10cc886
--- /dev/null
+++ b/server/soe/handlers/contabil-handler.ts
@@ -0,0 +1,182 @@
+// SOE — Handler Contábil
+// Gera lançamentos contábeis automáticos a partir de eventos SOE.
+// Os lançamentos são salvos em soe_lancamentos e depois sincronizados
+// com o Motor Contábil Python (:8003).
+
+import { db } from "../../db/index";
+import { soeLancamentos } from "@shared/schema";
+import type { SoeEventPayload } from "../event-bus";
+
+const CONTABIL_ENGINE_URL =
+  `http://${process.env.CONTABIL_ENGINE_HOST || "localhost"}:${process.env.CONTABIL_PORT || "8003"}`;
+
+async function inserirLancamento(
+  tenantId: number | undefined,
+  empresaId: number,
+  data: string,
+  contaDebito: string,
+  contaCredito: string,
+  valor: number,
+  historico: string,
+  origemEvento: string,
+  origemEventoId?: string
+) {
+  if (!valor || valor <= 0) return;
+  try {
+    await db.insert(soeLancamentos).values({
+      tenantId,
+      empresaId,
+      data,
+      contaDebito,
+      contaCredito,
+      valor: String(valor),
+      historico,
+      origemEvento,
+      origemEventoId,
+      periodo: data.substring(0, 7), // 'YYYY-MM'
+      enviado8003: false,
+    });
+  } catch (e: any) {
+    console.error("[ContabilHandler] Erro ao inserir lançamento:", e.message);
+  }
+}
+
+export const contabilHandler = {
+
+  // NF-e de venda emitida → lançamentos de receita + impostos
+  lancamentoVenda: async (payload: SoeEventPayload) => {
+    const { dados, tenantId, empresaId } = payload;
+    if (!empresaId || !dados.valorTotal) return;
+
+    const data = dados.dataEmissao?.substring(0, 10) || new Date().toISOString().substring(0, 10);
+    const numeroNfe = dados.numero || dados.nfeId || "?";
+    const eventoId = dados._eventoId;
+
+    // D: Clientes / C: Receita Bruta de Vendas
+    await inserirLancamento(
+      tenantId, empresaId, data,
+      "1.1.3.01", "3.1.1.01",
+      parseFloat(dados.valorTotal),
+      `Venda NF-e ${numeroNfe}`,
+      "nfe_emitida", eventoId
+    );
+
+    // D: Deduções ICMS / C: ICMS a Recolher
+    if (dados.valorIcms && parseFloat(dados.valorIcms) > 0) {
+      await inserirLancamento(
+        tenantId, empresaId, data,
+        "3.1.2.01", "2.1.2.01",
+        parseFloat(dados.valorIcms),
+        `ICMS s/ Venda NF-e ${numeroNfe}`,
+        "nfe_emitida", eventoId
+      );
+    }
+
+    // D: Deduções PIS / C: PIS a Recolher
+    if (dados.valorPis && parseFloat(dados.valorPis) > 0) {
+      await inserirLancamento(
+        tenantId, empresaId, data,
+        "3.1.2.02", "2.1.2.02",
+        parseFloat(dados.valorPis),
+        `PIS s/ Venda NF-e ${numeroNfe}`,
+        "nfe_emitida", eventoId
+      );
+    }
+
+    // D: Deduções COFINS / C: COFINS a Recolher
+    if (dados.valorCofins && parseFloat(dados.valorCofins) > 0) {
+      await inserirLancamento(
+        tenantId, empresaId, data,
+        "3.1.2.03", "2.1.2.03",
+        parseFloat(dados.valorCofins),
+        `COFINS s/ Venda NF-e ${numeroNfe}`,
+        "nfe_emitida", eventoId
+      );
+    }
+  },
+
+  // Cancelamento de NF-e → estorno dos lançamentos
+  estornoLancamentoVenda: async (payload: SoeEventPayload) => {
+    const { dados, tenantId, empresaId } = payload;
+    if (!empresaId || !dados.valorTotal) return;
+
+    const data = new Date().toISOString().substring(0, 10);
+    const numeroNfe = dados.numero || dados.nfeId || "?";
+
+    // Estorno: inverte débito/crédito
+    await inserirLancamento(
+      tenantId, empresaId, data,
+      "3.1.1.01", "1.1.3.01",
+      parseFloat(dados.valorTotal),
+      `Estorno NF-e ${numeroNfe} (cancelamento)`,
+      "nfe_cancelada"
+    );
+  },
+
+  // Compra recebida (NF-e entrada) → entrada em estoque + fornecedor
+  lancamentoCompra: async (payload: SoeEventPayload) => {
+    const { dados, tenantId, empresaId } = payload;
+    if (!empresaId || !dados.valorMercadorias) return;
+
+    const data = dados.dataEntrada?.substring(0, 10) || new Date().toISOString().substring(0, 10);
+    const numeroNfe = dados.numero || "?";
+    const fornecedor = dados.fornecedor || "Fornecedor";
+
+    await inserirLancamento(
+      tenantId, empresaId, data,
+      "1.1.4.01", "2.1.1.01",
+      parseFloat(dados.valorMercadorias),
+      `Compra NF-e ${numeroNfe} / ${fornecedor}`,
+      "compra_recebida"
+    );
+  },
+
+  // Pagamento de conta a pagar
+  lancamentoPagamento: async (payload: SoeEventPayload) => {
+    const { dados, tenantId, empresaId } = payload;
+    if (!empresaId || !dados.valorPago) return;
+
+    const data = dados.dataPagamento?.substring(0, 10) || new Date().toISOString().substring(0, 10);
+
+    await inserirLancamento(
+      tenantId, empresaId, data,
+      "2.1.1.01", "1.1.1.01",
+      parseFloat(dados.valorPago),
+      `Pagamento: ${dados.descricao || "Conta a pagar"}`,
+      "pagamento_realizado"
+    );
+  },
+
+  // Recebimento de cliente
+  lancamentoRecebimento: async (payload: SoeEventPayload) => {
+    const { dados, tenantId, empresaId } = payload;
+    if (!empresaId || !dados.valorRecebido) return;
+
+    const data = dados.dataRecebimento?.substring(0, 10) || new Date().toISOString().substring(0, 10);
+
+    await inserirLancamento(
+      tenantId, empresaId, data,
+      "1.1.1.01", "1.1.3.01",
+      parseFloat(dados.valorRecebido),
+      `Recebimento: ${dados.descricao || "Conta a receber"}`,
+      "recebimento_realizado"
+    );
+  },
+};
+
+// Sincroniza lançamentos pendentes com Motor Contábil Python (:8003)
+export async function sincronizarComMotorContabil(empresaId: number, periodo: string) {
+  try {
+    const resp = await fetch(`${CONTABIL_ENGINE_URL}/lancamentos/sincronizar`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ empresaId, periodo }),
+      signal: AbortSignal.timeout(30000),
+    });
+    if (!resp.ok) {
+      console.warn("[ContabilHandler] Motor :8003 retornou:", resp.status);
+    }
+  } catch (e: any) {
+    console.warn("[ContabilHandler] Motor :8003 indisponível:", e.message);
+  }
+}
diff --git a/server/soe/handlers/financial-handler.ts b/server/soe/handlers/financial-handler.ts
new file mode 100644
index 0000000..f2eeb35
--- /dev/null
+++ b/server/soe/handlers/financial-handler.ts
@@ -0,0 +1,128 @@
+// SOE — Handler Financeiro
+// Automações financeiras disparadas pelo Event Bus SOE.
+
+import { db } from "../../db/index";
+import { finAccountsReceivable, finAccountsPayable } from "@shared/schema";
+import type { SoeEventPayload } from "../event-bus";
+
+export const financialHandler = {
+
+  // Cria conta a receber automaticamente ao emitir NF-e de venda
+  criarContaReceber: async (payload: SoeEventPayload) => {
+    const { dados, tenantId } = payload;
+    if (!dados.valorTotal || !dados.clienteId) return;
+
+    try {
+      // Verifica se já existe conta a receber para esta NF-e
+      if (dados.nfeId) {
+        const existente = await db.query.finAccountsReceivable?.findFirst?.({
+          where: (t: any, { eq }: any) => eq(t.reference, `nfe:${dados.nfeId}`),
+        });
+        if (existente) return;
+      }
+
+      const vencimento = dados.vencimento
+        || new Date(Date.now() + 30 * 24 * 60 * 60 * 1000).toISOString().substring(0, 10);
+
+      await db.insert(finAccountsReceivable).values({
+        tenantId: tenantId ?? 1,
+        customerId: dados.clienteId,
+        description: `NF-e ${dados.numero || dados.nfeId || "?"} — ${dados.clienteNome || "Cliente"}`,
+        amount: String(dados.valorTotal),
+        dueDate: vencimento,
+        status: "pending",
+        category: "vendas",
+        paymentMethod: dados.formaPagamento || "outros",
+        notes: `Gerado automaticamente pelo SOE ao emitir NF-e`,
+      } as any);
+
+      console.log("[FinancialHandler] Conta a receber criada para NF-e", dados.nfeId || dados.numero);
+    } catch (e: any) {
+      console.error("[FinancialHandler] criarContaReceber error:", e.message);
+    }
+  },
+
+  // Baixa conta a receber após recebimento confirmado
+  baixarContaReceber: async (payload: SoeEventPayload) => {
+    const { dados } = payload;
+    if (!dados.contaReceiverId) return;
+
+    try {
+      await db
+        .update(finAccountsReceivable)
+        .set({
+          status: "received",
+          receivedDate: dados.dataRecebimento || new Date().toISOString().substring(0, 10),
+          paymentMethod: dados.formaPagamento || "outros",
+        } as any)
+        .where((finAccountsReceivable as any).id.eq(dados.contaReceiverId));
+    } catch (e: any) {
+      console.error("[FinancialHandler] baixarContaReceber error:", e.message);
+    }
+  },
+
+  // Cria conta a pagar ao receber mercadoria
+  criarContaPagar: async (payload: SoeEventPayload) => {
+    const { dados, tenantId } = payload;
+    if (!dados.valorTotal || !dados.fornecedorId) return;
+
+    try {
+      const vencimento = dados.vencimento
+        || new Date(Date.now() + 30 * 24 * 60 * 60 * 1000).toISOString().substring(0, 10);
+
+      await db.insert(finAccountsPayable).values({
+        tenantId: tenantId ?? 1,
+        supplierId: dados.fornecedorId,
+        description: `NF-e Entrada ${dados.numero || "?"} — ${dados.fornecedor || "Fornecedor"}`,
+        amount: String(dados.valorTotal),
+        dueDate: vencimento,
+        status: "pending",
+        category: "compras",
+        notes: `Gerado automaticamente pelo SOE ao receber compra`,
+      } as any);
+    } catch (e: any) {
+      console.error("[FinancialHandler] criarContaPagar error:", e.message);
+    }
+  },
+
+  // Baixa conta a pagar após pagamento
+  baixarContaPagar: async (payload: SoeEventPayload) => {
+    const { dados } = payload;
+    if (!dados.contaPayableId) return;
+
+    try {
+      await db
+        .update(finAccountsPayable)
+        .set({
+          status: "paid",
+          paidDate: dados.dataPagamento || new Date().toISOString().substring(0, 10),
+          paymentMethod: dados.formaPagamento || "outros",
+        } as any)
+        .where((finAccountsPayable as any).id.eq(dados.contaPayableId));
+    } catch (e: any) {
+      console.error("[FinancialHandler] baixarContaPagar error:", e.message);
+    }
+  },
+
+  // Reserva estoque ao confirmar venda (notificação — execução no motor)
+  reservarEstoque: async (payload: SoeEventPayload) => {
+    const { dados } = payload;
+    if (!dados.items || dados.motor === "local") return;
+    // Log apenas — a reserva real é feita pelo motor Plus/ERPNext
+    console.log(
+      `[FinancialHandler] Venda ${dados.id} confirmada — ` +
+      `${dados.items?.length || 0} item(s) para reserva de estoque`
+    );
+  },
+
+  // Alerta de estoque baixo (via console/log — webhook futuro)
+  alertaEstoqueBaixo: async (payload: SoeEventPayload) => {
+    const { dados } = payload;
+    console.warn(
+      `[FinancialHandler] ALERTA: Estoque baixo — ` +
+      `Produto ${dados.produtoId} / ${dados.produtoNome} ` +
+      `(atual: ${dados.estoqueAtual}, mínimo: ${dados.estoqueMinimo})`
+    );
+    // TODO Fase 5: enviar via WhatsApp/Email usando Motor Comunicação (:8006)
+  },
+};
diff --git a/server/soe/rule-engine/business-rules.ts b/server/soe/rule-engine/business-rules.ts
new file mode 100644
index 0000000..b3f1c34
--- /dev/null
+++ b/server/soe/rule-engine/business-rules.ts
@@ -0,0 +1,72 @@
+// SOE — Regras de Negócio Padrão
+
+import type { SoeRule } from "./types";
+
+export const BUSINESS_RULES_PADRAO: SoeRule[] = [
+  // ── Aprovação de pedidos ───────────────────────────────────────────────────
+
+  {
+    id: "PEDIDO_APROVACAO_AUTO_BAIXO_VALOR",
+    dominio: "business",
+    trigger: "pre_sales_order_confirm",
+    nome: "Aprovação automática para pedidos de baixo valor",
+    condicao: { "totalAmount": { "_lt": 5000 } },
+    acao: { set: { "_aprovacaoAutomatica": true, "status": "confirmed" } },
+    prioridade: 10,
+    ativo: false, // tenant habilita com seu limite
+    origemPadrao: true,
+  },
+
+  // ── Estoque ────────────────────────────────────────────────────────────────
+
+  {
+    id: "RESERVA_ESTOQUE_AO_CONFIRMAR",
+    dominio: "business",
+    trigger: "post_sales_order_confirm",
+    nome: "Reserva estoque ao confirmar pedido",
+    condicao: { "status": "confirmed" },
+    acao: { set: { "_reservarEstoque": true } },
+    prioridade: 10,
+    ativo: true,
+    origemPadrao: true,
+  },
+
+  // ── Financeiro ─────────────────────────────────────────────────────────────
+
+  {
+    id: "CRIAR_CONTA_RECEBER_AO_FATURAR",
+    dominio: "business",
+    trigger: "post_nfe_emitida",
+    nome: "Cria conta a receber automaticamente ao faturar",
+    condicao: { "_tipoOperacao": "venda" },
+    acao: { set: { "_criarContaReceber": true } },
+    prioridade: 5,
+    ativo: true,
+    origemPadrao: true,
+  },
+  {
+    id: "CRIAR_CONTA_PAGAR_AO_RECEBER_COMPRA",
+    dominio: "business",
+    trigger: "post_purchase_received",
+    nome: "Cria conta a pagar ao receber mercadoria",
+    condicao: {},
+    acao: { set: { "_criarContaPagar": true } },
+    prioridade: 5,
+    ativo: true,
+    origemPadrao: true,
+  },
+
+  // ── Alertas ────────────────────────────────────────────────────────────────
+
+  {
+    id: "ALERTA_ESTOQUE_MINIMO",
+    dominio: "business",
+    trigger: "post_sales_order_confirm",
+    nome: "Alerta quando estoque cai abaixo do mínimo",
+    condicao: { "_estoqueAbaixoMinimo": true },
+    acao: { set: { "_enviarAlertaEstoque": true } },
+    prioridade: 15,
+    ativo: true,
+    origemPadrao: true,
+  },
+];
diff --git a/server/soe/rule-engine/fiscal-rules.ts b/server/soe/rule-engine/fiscal-rules.ts
new file mode 100644
index 0000000..fdf2524
--- /dev/null
+++ b/server/soe/rule-engine/fiscal-rules.ts
@@ -0,0 +1,150 @@
+// SOE — Regras Fiscais Padrão
+// Estas regras enriquecem o payload ANTES de despachar ao motor (Plus/ERPNext)
+// O motor recebe o payload já correto e só executa.
+
+import type { SoeRule } from "./types";
+
+export const FISCAL_RULES_PADRAO: SoeRule[] = [
+  // ── CFOP — Resolução automática por direção da operação ──────────────────
+
+  {
+    id: "CFOP_VENDA_DENTRO_ESTADO",
+    dominio: "fiscal",
+    trigger: "pre_sales_order",
+    nome: "CFOP padrão — venda dentro do estado",
+    condicao: { _cfopNaoDefinido: true, _operacao: "venda" },
+    acao: { set: { "cfopPadrao": "5.102" } },
+    prioridade: 20,
+    ativo: true,
+    origemPadrao: true,
+  },
+  {
+    id: "CFOP_VENDA_OUTRO_ESTADO",
+    dominio: "fiscal",
+    trigger: "pre_sales_order",
+    nome: "CFOP padrão — venda para outro estado",
+    condicao: { _cfopNaoDefinido: true, _operacao: "venda", _interestadual: true },
+    acao: { set: { "cfopPadrao": "6.102" } },
+    prioridade: 19,
+    ativo: true,
+    origemPadrao: true,
+  },
+  {
+    id: "CFOP_COMPRA_DENTRO_ESTADO",
+    dominio: "fiscal",
+    trigger: "pre_purchase_order",
+    nome: "CFOP padrão — compra dentro do estado",
+    condicao: { _cfopNaoDefinido: true },
+    acao: { set: { "cfopPadrao": "1.102" } },
+    prioridade: 20,
+    ativo: true,
+    origemPadrao: true,
+  },
+
+  // ── Tributação por Regime ──────────────────────────────────────────────────
+
+  {
+    id: "TRIBUTACAO_SIMPLES_NACIONAL",
+    dominio: "fiscal",
+    trigger: "pre_nfe_emissao",
+    nome: "Simples Nacional — aplica CSOSN e remove destaque PIS/COFINS",
+    condicao: { regimeTributario: "simples_nacional" },
+    acao: {
+      set: {
+        "tributacao.csosnPadrao": "400",
+        "tributacao.destacarPisCofins": false,
+        "tributacao.aliquotaIcms": 0,
+      },
+    },
+    prioridade: 5,
+    ativo: true,
+    origemPadrao: true,
+  },
+  {
+    id: "TRIBUTACAO_LUCRO_PRESUMIDO",
+    dominio: "fiscal",
+    trigger: "pre_nfe_emissao",
+    nome: "Lucro Presumido — CST 00 com alíquotas padrão",
+    condicao: { regimeTributario: "lucro_presumido" },
+    acao: {
+      set: {
+        "tributacao.cstIcmsPadrao": "00",
+        "tributacao.cstPisPadrao": "01",
+        "tributacao.cstCofinsPadrao": "01",
+        "tributacao.destacarPisCofins": true,
+      },
+    },
+    prioridade: 5,
+    ativo: true,
+    origemPadrao: true,
+  },
+  {
+    id: "TRIBUTACAO_LUCRO_REAL",
+    dominio: "fiscal",
+    trigger: "pre_nfe_emissao",
+    nome: "Lucro Real — CST 00, PIS/COFINS não cumulativo",
+    condicao: { regimeTributario: "lucro_real" },
+    acao: {
+      set: {
+        "tributacao.cstIcmsPadrao": "00",
+        "tributacao.cstPisPadrao": "50",
+        "tributacao.cstCofinsPadrao": "50",
+        "tributacao.destacarPisCofins": true,
+        "tributacao.regimePisCofins": "nao_cumulativo",
+      },
+    },
+    prioridade: 5,
+    ativo: true,
+    origemPadrao: true,
+  },
+
+  // ── Validações obrigatórias ────────────────────────────────────────────────
+
+  {
+    id: "VALIDAR_NCM_NFE",
+    dominio: "fiscal",
+    trigger: "pre_nfe_emissao",
+    nome: "Valida NCM obrigatório em NF-e",
+    condicao: { tipoDocumento: ["nfe", "nfce"] },
+    acao: { validar: { campo: "ncm", obrigatorio: true, formato: "^\\d{8}$" } },
+    prioridade: 1,
+    ativo: true,
+    origemPadrao: true,
+  },
+  {
+    id: "VALIDAR_CFOP_OBRIGATORIO",
+    dominio: "fiscal",
+    trigger: "pre_nfe_emissao",
+    nome: "Valida CFOP obrigatório",
+    condicao: {},
+    acao: { validar: { campo: "cfop", obrigatorio: true, formato: "^\\d\\.\\d{3}$" } },
+    prioridade: 1,
+    ativo: true,
+    origemPadrao: true,
+  },
+  {
+    id: "VALIDAR_CNPJ_CPF_DESTINATARIO",
+    dominio: "fiscal",
+    trigger: "pre_nfe_emissao",
+    nome: "Valida CNPJ/CPF do destinatário",
+    condicao: { tipoDocumento: "nfe" },
+    acao: { validar: { campo: "destinatario.cpfCnpj", obrigatorio: true } },
+    prioridade: 1,
+    ativo: true,
+    origemPadrao: true,
+  },
+
+  // ── Geração automática de NF-e ao faturar ─────────────────────────────────
+
+  {
+    id: "NFE_AUTO_AO_FATURAR",
+    dominio: "fiscal",
+    trigger: "pre_sales_order_confirm",
+    nome: "Gera NF-e automaticamente ao confirmar pedido (se configurado)",
+    condicao: { "config.nfeAutomatica": true },
+    acao: { set: { "_gerarNfe": true } },
+    prioridade: 10,
+    ativo: false, // desativado por padrão — tenant habilita
+    origemPadrao: true,
+  },
+];
diff --git a/server/soe/rule-engine/index.ts b/server/soe/rule-engine/index.ts
new file mode 100644
index 0000000..4f92e30
--- /dev/null
+++ b/server/soe/rule-engine/index.ts
@@ -0,0 +1,240 @@
+// SOE Rule Engine — Motor Central de Regras
+// Intercepta chamadas às rotas SOE antes de despachar ao motor (Plus/ERPNext/local)
+// e aplica regras configuráveis de negócio, fiscal, contábil e financeiro.
+
+import { db } from "../../db/index";
+import { soeRegras, soeEventos } from "@shared/schema";
+import { eq, and, isNull, or } from "drizzle-orm";
+import type { SoeRule, RuleContext, EnrichedPayload, SoeRuleCondition } from "./types";
+import { FISCAL_RULES_PADRAO } from "./fiscal-rules";
+import { BUSINESS_RULES_PADRAO } from "./business-rules";
+
+const DEFAULT_RULES: SoeRule[] = [...FISCAL_RULES_PADRAO, ...BUSINESS_RULES_PADRAO];
+
+export class SoeRuleEngine {
+  private static instance: SoeRuleEngine;
+
+  static getInstance(): SoeRuleEngine {
+    if (!SoeRuleEngine.instance) SoeRuleEngine.instance = new SoeRuleEngine();
+    return SoeRuleEngine.instance;
+  }
+
+  // Aplica todas as regras ativas para um trigger + contexto
+  async apply(
+    trigger: string,
+    payload: Record<string, any>,
+    context: RuleContext
+  ): Promise<EnrichedPayload> {
+    const start = Date.now();
+    const appliedRules: string[] = [];
+    const validationErrors: string[] = [];
+
+    try {
+      // Carrega regras do banco (custom do tenant) + defaults hardcoded
+      const rules = await this.getActiveRules(trigger, context);
+
+      // Enriquece payload com contexto (empresa, regime tributário)
+      let enriched = this.enrichWithContext(payload, context);
+
+      // Aplica cada regra em ordem de prioridade
+      for (const rule of rules.sort((a, b) => a.prioridade - b.prioridade)) {
+        if (!this.avaliarCondicao(rule.condicao, enriched, context)) continue;
+
+        const result = this.aplicarAcao(rule.acao, enriched);
+        if (result.validationError) {
+          validationErrors.push(`[${rule.id}] ${result.validationError}`);
+        } else {
+          enriched = result.payload;
+          appliedRules.push(rule.id);
+        }
+      }
+
+      // Registra evento no banco (async, não bloqueia a response)
+      this.logEvent(trigger, payload, enriched, appliedRules, context, Date.now() - start).catch(
+        (e) => console.error("[SoeRuleEngine] log error:", e.message)
+      );
+
+      return { payload: enriched, appliedRules, validationErrors };
+    } catch (err: any) {
+      console.error("[SoeRuleEngine] apply error:", err.message);
+      return { payload, appliedRules, validationErrors };
+    }
+  }
+
+  private async getActiveRules(trigger: string, context: RuleContext): Promise<SoeRule[]> {
+    // Regras do banco (custom do tenant)
+    let dbRules: SoeRule[] = [];
+    try {
+      const rows = await db
+        .select()
+        .from(soeRegras)
+        .where(
+          and(
+            eq(soeRegras.trigger, trigger),
+            eq(soeRegras.ativo, true),
+            or(
+              isNull(soeRegras.tenantId),
+              eq(soeRegras.tenantId, context.tenantId ?? 0)
+            )
+          )
+        );
+      dbRules = rows.map((r) => ({
+        id: r.id,
+        dominio: r.dominio as any,
+        trigger: r.trigger,
+        nome: r.nome,
+        condicao: r.condicao as any,
+        acao: r.acao as any,
+        prioridade: r.prioridade ?? 10,
+        ativo: r.ativo ?? true,
+      }));
+    } catch {
+      // Banco pode não ter a tabela ainda (antes de migration)
+    }
+
+    // Regras padrão hardcoded (filtradas pelo trigger)
+    const defaults = DEFAULT_RULES.filter((r) => r.trigger === trigger && r.ativo);
+
+    // Merge: regras do banco sobrescrevem defaults com mesmo ID
+    const merged = new Map<string, SoeRule>();
+    for (const r of defaults) merged.set(r.id, r);
+    for (const r of dbRules) merged.set(r.id, r);
+
+    return Array.from(merged.values());
+  }
+
+  private enrichWithContext(
+    payload: Record<string, any>,
+    context: RuleContext
+  ): Record<string, any> {
+    return {
+      ...payload,
+      _contexto: {
+        tenantId: context.tenantId,
+        empresaId: context.empresaId,
+        motor: context.motor,
+        regimeTributario: context.empresa?.regimeTributario,
+        uf: context.empresa?.uf,
+      },
+      // Atalhos para condições
+      regimeTributario: context.empresa?.regimeTributario ?? payload.regimeTributario,
+    };
+  }
+
+  private avaliarCondicao(
+    condicao: SoeRuleCondition,
+    payload: Record<string, any>,
+    _context: RuleContext
+  ): boolean {
+    if (!condicao || Object.keys(condicao).length === 0) return true;
+
+    for (const [key, expected] of Object.entries(condicao)) {
+      // Condições internas (_xxx)
+      if (key === "_cfopNaoDefinido") {
+        if (expected && payload.cfop) return false;
+        continue;
+      }
+      if (key === "_operacao") {
+        // Infere operação pelo tipo (simplificado)
+        if (expected === "venda" && payload._tipo !== "venda") return false;
+        continue;
+      }
+      if (key === "_interestadual") {
+        const interestadual = payload.ufDestinatario && payload.ufEmitente &&
+          payload.ufDestinatario !== payload.ufEmitente;
+        if (expected !== interestadual) return false;
+        continue;
+      }
+
+      const actual = this.getNestedValue(payload, key);
+
+      if (Array.isArray(expected)) {
+        if (!expected.includes(actual)) return false;
+      } else if (typeof expected === "object" && expected !== null) {
+        if ("_lt" in expected && !(actual < expected._lt)) return false;
+        if ("_gt" in expected && !(actual > expected._gt)) return false;
+        if ("_eq" in expected && actual !== expected._eq) return false;
+      } else {
+        if (actual !== expected) return false;
+      }
+    }
+    return true;
+  }
+
+  private aplicarAcao(
+    acao: any,
+    payload: Record<string, any>
+  ): { payload: Record<string, any>; validationError?: string } {
+    let result = { ...payload };
+
+    if (acao.set) {
+      for (const [path, value] of Object.entries(acao.set)) {
+        result = this.setNestedValue(result, path, value);
+      }
+    }
+
+    if (acao.validar) {
+      const { campo, obrigatorio, formato } = acao.validar;
+      const valor = this.getNestedValue(payload, campo);
+      if (obrigatorio && !valor) {
+        return { payload, validationError: `Campo obrigatório ausente: ${campo}` };
+      }
+      if (formato && valor) {
+        const re = typeof formato === "string" ? new RegExp(formato) : formato;
+        if (!re.test(String(valor))) {
+          return { payload, validationError: `Campo ${campo} com formato inválido: ${valor}` };
+        }
+      }
+    }
+
+    return { payload: result };
+  }
+
+  private getNestedValue(obj: Record<string, any>, path: string): any {
+    return path.split(".").reduce((curr, key) => curr?.[key], obj);
+  }
+
+  private setNestedValue(
+    obj: Record<string, any>,
+    path: string,
+    value: any
+  ): Record<string, any> {
+    const result = { ...obj };
+    const keys = path.split(".");
+    let curr: any = result;
+    for (let i = 0; i < keys.length - 1; i++) {
+      if (!curr[keys[i]]) curr[keys[i]] = {};
+      curr = curr[keys[i]];
+    }
+    curr[keys[keys.length - 1]] = value;
+    return result;
+  }
+
+  private async logEvent(
+    trigger: string,
+    payloadEntrada: any,
+    payloadSaida: any,
+    regraIds: string[],
+    context: RuleContext,
+    duracaoMs: number
+  ) {
+    try {
+      await db.insert(soeEventos).values({
+        tenantId: context.tenantId,
+        empresaId: context.empresaId,
+        evento: trigger,
+        motorOrigem: context.motor,
+        regraIds,
+        payloadEntrada,
+        payloadSaida,
+        status: "ok",
+        duracaoMs,
+      });
+    } catch {
+      // Silencia erro de log — não deve quebrar o fluxo principal
+    }
+  }
+}
+
+// Singleton exportado
+export const soeRuleEngine = SoeRuleEngine.getInstance();
diff --git a/server/soe/rule-engine/types.ts b/server/soe/rule-engine/types.ts
new file mode 100644
index 0000000..c38d030
--- /dev/null
+++ b/server/soe/rule-engine/types.ts
@@ -0,0 +1,47 @@
+// SOE Rule Engine — Types
+
+export interface SoeRuleCondition {
+  // Comparações simples: { campo: valor } ou { campo: { op: valor } }
+  [key: string]: any;
+}
+
+export interface SoeRuleAction {
+  // set: sobrescreve campos no payload
+  set?: Record<string, any>;
+  // validar: valida campos obrigatórios/formato
+  validar?: { campo: string; obrigatorio?: boolean; formato?: RegExp | string };
+  // addItem: adiciona item à lista
+  addItem?: { campo: string; valor: any };
+  // calcular: define um campo como resultado de expressão
+  calcular?: { campo: string; expressao: string };
+}
+
+export interface SoeRule {
+  id: string;
+  dominio: "fiscal" | "business" | "accounting" | "financial";
+  trigger: string;
+  nome: string;
+  condicao: SoeRuleCondition;
+  acao: SoeRuleAction;
+  prioridade: number;
+  ativo: boolean;
+  origemPadrao?: boolean;
+}
+
+export interface RuleContext {
+  tenantId?: number;
+  empresaId?: number;
+  userId?: string;
+  motor?: "plus" | "erpnext" | "local";
+  empresa?: {
+    regimeTributario?: "simples_nacional" | "lucro_presumido" | "lucro_real";
+    uf?: string;
+    cnpj?: string;
+  };
+}
+
+export interface EnrichedPayload {
+  payload: Record<string, any>;
+  appliedRules: string[];
+  validationErrors: string[];
+}
diff --git a/server/superset/proxy.ts b/server/superset/proxy.ts
new file mode 100644
index 0000000..c2d33ce
--- /dev/null
+++ b/server/superset/proxy.ts
@@ -0,0 +1,39 @@
+import { Express, Response } from "express";
+import { createProxyMiddleware } from "http-proxy-middleware";
+
+const SUPERSET_HOST = process.env.SUPERSET_HOST || "localhost";
+const SUPERSET_PORT = parseInt(process.env.SUPERSET_PORT || "8088", 10);
+const SUPERSET_TIMEOUT = 60000;
+
+export function setupSupersetProxy(app: Express): void {
+  const target = `http://${SUPERSET_HOST}:${SUPERSET_PORT}`;
+
+  const supersetProxy = createProxyMiddleware({
+    target,
+    changeOrigin: true,
+    timeout: SUPERSET_TIMEOUT,
+    proxyTimeout: SUPERSET_TIMEOUT,
+    pathRewrite: { "^/superset": "" },
+    on: {
+      error: (err, _req, res) => {
+        console.error("[Superset Proxy] Error:", err.message);
+        if (res && typeof (res as Response).status === "function") {
+          (res as Response).status(502).json({
+            error: "Superset indisponível",
+            message: "O Arcádia Insights está iniciando. Tente novamente em alguns segundos.",
+            target,
+          });
+        }
+      },
+      proxyRes: (proxyRes) => {
+        const location = proxyRes.headers["location"];
+        if (location && typeof location === "string" && location.startsWith("/")) {
+          proxyRes.headers["location"] = `/superset${location}`;
+        }
+      },
+    },
+  });
+
+  app.use("/superset", supersetProxy);
+  console.log(`[Superset Proxy] Configurado -> /superset/* => ${target}`);
+}
diff --git a/server/superset/routes.ts b/server/superset/routes.ts
new file mode 100644
index 0000000..729b76e
--- /dev/null
+++ b/server/superset/routes.ts
@@ -0,0 +1,108 @@
+import type { Express, Request, Response } from "express";
+
+const SUPERSET_HOST = process.env.SUPERSET_HOST || "localhost";
+const SUPERSET_PORT = parseInt(process.env.SUPERSET_PORT || "8088", 10);
+const SUPERSET_URL = `http://${SUPERSET_HOST}:${SUPERSET_PORT}`;
+const ADMIN_USER = process.env.SUPERSET_ADMIN_USER || "admin";
+const ADMIN_PASS = process.env.SUPERSET_ADMIN_PASSWORD || "arcadia2026";
+
+// Cache do service token (válido por 50 min)
+let cachedToken: string | null = null;
+let tokenExpiry = 0;
+
+async function getServiceToken(): Promise<string> {
+  if (cachedToken && Date.now() < tokenExpiry) return cachedToken;
+
+  const resp = await fetch(`${SUPERSET_URL}/api/v1/security/login`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ username: ADMIN_USER, password: ADMIN_PASS, provider: "db", refresh: true }),
+  });
+
+  if (!resp.ok) throw new Error(`Falha ao autenticar no Superset (${resp.status})`);
+  const data = await resp.json();
+  cachedToken = data.access_token;
+  tokenExpiry = Date.now() + 50 * 60 * 1000;
+  return cachedToken!;
+}
+
+export function registerSupersetRoutes(app: Express): void {
+
+  // Gera Guest Token para embedding em qualquer tela
+  app.post("/api/superset/guest-token", async (req: Request, res: Response) => {
+    try {
+      if (!req.isAuthenticated()) return res.status(401).json({ error: "Not authenticated" });
+
+      const { dashboardId } = req.body;
+      if (!dashboardId) return res.status(400).json({ error: "dashboardId é obrigatório" });
+
+      const token = await getServiceToken();
+      const user = req.user as any;
+
+      const guestResp = await fetch(`${SUPERSET_URL}/api/v1/security/guest_token/`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "Authorization": `Bearer ${token}`,
+        },
+        body: JSON.stringify({
+          user: {
+            username: `arcadia_${user?.id || "guest"}`,
+            first_name: user?.name?.split(" ")[0] || "Arcádia",
+            last_name: user?.name?.split(" ").slice(1).join(" ") || "User",
+          },
+          resources: [{ type: "dashboard", id: dashboardId }],
+          rls: [],
+        }),
+      });
+
+      if (!guestResp.ok) {
+        const errText = await guestResp.text();
+        return res.status(502).json({ error: "Falha ao gerar guest token", detail: errText });
+      }
+
+      const { token: guestToken } = await guestResp.json();
+      res.json({ token: guestToken, supersetUrl: "/superset" });
+    } catch (err: any) {
+      console.error("[Superset] guest-token error:", err.message);
+      res.status(502).json({ error: err.message });
+    }
+  });
+
+  // Lista dashboards disponíveis (para seletor na UI)
+  app.get("/api/superset/dashboards", async (req: Request, res: Response) => {
+    try {
+      if (!req.isAuthenticated()) return res.status(401).json({ error: "Not authenticated" });
+
+      const token = await getServiceToken();
+      const resp = await fetch(
+        `${SUPERSET_URL}/api/v1/dashboard/?q=(order_column:changed_on_delta_humanized,order_direction:desc,page_size:50)`,
+        { headers: { "Authorization": `Bearer ${token}` } }
+      );
+
+      if (!resp.ok) return res.status(502).json({ error: "Superset indisponível", dashboards: [] });
+      const data = await resp.json();
+      res.json(data.result || []);
+    } catch (err: any) {
+      console.error("[Superset] dashboards error:", err.message);
+      res.status(502).json({ error: err.message, dashboards: [] });
+    }
+  });
+
+  // Health check
+  app.get("/api/superset/health", async (_req: Request, res: Response) => {
+    try {
+      const resp = await fetch(`${SUPERSET_URL}/health`, { signal: AbortSignal.timeout(5000) });
+      const text = await resp.text();
+      res.json({ online: resp.ok && text === "OK", url: SUPERSET_URL, status: text });
+    } catch {
+      res.json({ online: false, url: SUPERSET_URL });
+    }
+  });
+
+  // Autologin (compatibilidade — redireciona para /superset com sessão)
+  app.get("/api/bi/superset/autologin", async (req: Request, res: Response) => {
+    if (!req.isAuthenticated()) return res.status(401).json({ error: "Not authenticated" });
+    res.redirect("/superset/login");
+  });
+}
diff --git a/shared/schema.ts b/shared/schema.ts
index fbccf1c..52179e2 100644
--- a/shared/schema.ts
+++ b/shared/schema.ts
@@ -7315,3 +7315,70 @@ export const commEvents = pgTable("comm_events", {
   processedByAgents: boolean("processed_by_agents").default(false), // consumed by agents?
   createdAt: timestamp("created_at").default(sql`CURRENT_TIMESTAMP`).notNull(),
 });
+
+// ═══════════════════════════════════════════════════════════════════════════════
+// SOE — Sistema Operacional Empresarial (Rule Engine + Event Bus)
+// ═══════════════════════════════════════════════════════════════════════════════
+
+// Regras do SOE — configuráveis por tenant/empresa
+export const soeRegras = pgTable("soe_regras", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  tenantId: integer("tenant_id").references(() => tenants.id, { onDelete: "cascade" }),
+  empresaId: integer("empresa_id"),
+  dominio: varchar("dominio", { length: 50 }).notNull(), // 'fiscal' | 'business' | 'accounting' | 'financial'
+  trigger: varchar("trigger", { length: 100 }).notNull(), // 'pre_sales_order' | 'pre_nfe_emissao' | etc.
+  nome: varchar("nome", { length: 200 }).notNull(),
+  condicao: jsonb("condicao").notNull().$type<Record<string, any>>(),
+  acao: jsonb("acao").notNull().$type<Record<string, any>>(),
+  prioridade: integer("prioridade").default(10),
+  ativo: boolean("ativo").default(true),
+  origemPadrao: boolean("origem_padrao").default(false), // true = regra padrão do sistema
+  createdAt: timestamp("created_at").default(sql`CURRENT_TIMESTAMP`).notNull(),
+  updatedAt: timestamp("updated_at").default(sql`CURRENT_TIMESTAMP`).notNull(),
+});
+
+// Log de todos os eventos SOE (audit trail completo)
+export const soeEventos = pgTable("soe_eventos", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  tenantId: integer("tenant_id").references(() => tenants.id),
+  empresaId: integer("empresa_id"),
+  evento: varchar("evento", { length: 100 }).notNull(), // 'nfe_emitida' | 'venda_confirmada' | etc.
+  motorOrigem: varchar("motor_origem", { length: 50 }), // 'plus' | 'erpnext' | 'local'
+  regraIds: jsonb("regra_ids").$type<string[]>(),         // IDs das regras aplicadas
+  payloadEntrada: jsonb("payload_entrada").$type<Record<string, any>>(),
+  payloadSaida: jsonb("payload_saida").$type<Record<string, any>>(),
+  status: varchar("status", { length: 50 }).notNull().default("ok"), // 'ok' | 'error' | 'skipped'
+  duracaoMs: integer("duracao_ms"),
+  erro: text("erro"),
+  createdAt: timestamp("created_at").default(sql`CURRENT_TIMESTAMP`).notNull(),
+});
+
+// Lançamentos contábeis automáticos gerados pelo SOE Event Bus
+export const soeLancamentos = pgTable("soe_lancamentos", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  tenantId: integer("tenant_id").references(() => tenants.id),
+  empresaId: integer("empresa_id").notNull(),
+  data: date("data").notNull(),
+  contaDebito: varchar("conta_debito", { length: 30 }).notNull(),
+  contaCredito: varchar("conta_credito", { length: 30 }).notNull(),
+  valor: numeric("valor", { precision: 15, scale: 2 }).notNull(),
+  historico: text("historico").notNull(),
+  origemEvento: varchar("origem_evento", { length: 100 }), // 'nfe_emitida' | 'pagamento_realizado' | etc.
+  origemEventoId: uuid("origem_evento_id").references(() => soeEventos.id),
+  periodo: varchar("periodo", { length: 7 }), // '2026-03'
+  enviado8003: boolean("enviado_8003").default(false), // sincronizado com Motor Contábil Python
+  createdAt: timestamp("created_at").default(sql`CURRENT_TIMESTAMP`).notNull(),
+});
+
+// Insert schemas
+export const insertSoeRegraSchema = createInsertSchema(soeRegras);
+export const insertSoeEventoSchema = createInsertSchema(soeEventos);
+export const insertSoeLancamentoSchema = createInsertSchema(soeLancamentos);
+
+// Types
+export type SoeRegra = typeof soeRegras.$inferSelect;
+export type InsertSoeRegra = z.infer<typeof insertSoeRegraSchema>;
+export type SoeEvento = typeof soeEventos.$inferSelect;
+export type InsertSoeEvento = z.infer<typeof insertSoeEventoSchema>;
+export type SoeLancamento = typeof soeLancamentos.$inferSelect;
+export type InsertSoeLancamento = z.infer<typeof insertSoeLancamentoSchema>;

From eb0926704a794b01b7604f16317f277ff2cbc172 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 16 Mar 2026 19:27:26 +0000
Subject: [PATCH 2/3] feat: ERPNext em container Docker + SOE Rule Importer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- docker-compose.yml: adiciona serviços `erpnext` (frappe/erpnext:version-15)
  e `erpnext-db` (MariaDB 10.6) no perfil `erpnext`
  Volumes: erpnext_db, erpnext_sites, erpnext_logs
  Porta exposta: 8090 (→ :8080 interno)

- docker/erpnext/init.sh: script de inicialização que aguarda MariaDB,
  cria o site `erpnext.local` com bench new-site, instala app erpnext
  e sobe o servidor na porta 8080

- server/erpnext/proxy.ts: proxy transparente /erpnext-app/* → container
  (ativo em DOCKER_MODE=true ou ERPNEXT_PROXY_ENABLED=true)
  Reescreve Location headers, forward X-Forwarded-* e X-Site-Name
  Endpoint: GET /api/erpnext/container-status

- server/soe/erpnext-rule-importer.ts: importa regras de negócio do ERPNext
  (campos obrigatórios por DocType + Workflows ativos) e salva em soe_regras
  13 DocTypes mapeados para triggers SOE correspondentes
  Endpoint: POST /api/soe/erpnext/import-rules

- server/routes.ts: registra setupErpNextProxy e endpoint de import-rules
- .env.example: documenta variáveis para modo container e modo externo

Uso: docker compose --profile erpnext up

https://claude.ai/code/session_01DinH3VcgbAv1d9MqnNxzdb
---
 .env.example                        |  16 +-
 docker-compose.yml                  |  56 ++++++
 docker/erpnext/init.sh              |  56 ++++++
 server/erpnext/proxy.ts             | 115 +++++++++++
 server/routes.ts                    |  16 ++
 server/soe/erpnext-rule-importer.ts | 299 ++++++++++++++++++++++++++++
 6 files changed, 556 insertions(+), 2 deletions(-)
 create mode 100644 docker/erpnext/init.sh
 create mode 100644 server/erpnext/proxy.ts
 create mode 100644 server/soe/erpnext-rule-importer.ts

diff --git a/.env.example b/.env.example
index bcc19a1..359d87e 100644
--- a/.env.example
+++ b/.env.example
@@ -84,8 +84,20 @@ REDIS_URL=redis://localhost:6379
 # ── Domínio (produção) ────────────────────────────────────────────────────────
 DOMAIN=seudominio.com.br
 
-# ── Integrações externas (opcional) ──────────────────────────────────────────
-# ERPNext
+# ── ERPNext ────────────────────────────────────────────────────────────────────
+# Modo 1 — ERPNext em container Docker (perfil erpnext)
+# Sobe com: docker compose --profile erpnext up
+# Proxy ativado automaticamente em DOCKER_MODE=true
+ERPNEXT_PROXY_ENABLED=false          # true para forçar proxy mesmo fora do Docker
+ERPNEXT_CONTAINER_HOST=erpnext       # nome do serviço no docker-compose
+ERPNEXT_CONTAINER_PORT=8080
+ERPNEXT_DB_ROOT_PASSWORD=erpnext-root-2026   # senha root do MariaDB
+ERPNEXT_DB_PASSWORD=frappe2026               # senha do usuário frappe
+ERPNEXT_ADMIN_PASSWORD=admin2026             # senha do Administrator no site
+
+# Modo 2 — ERPNext externo (instância existente)
+# Em Docker: ERPNEXT_URL=http://erpnext:8080  (aponta pro container)
+# Externo:   ERPNEXT_URL=https://meuerpnext.com
 ERPNEXT_URL=
 ERPNEXT_API_KEY=
 ERPNEXT_API_SECRET=
diff --git a/docker-compose.yml b/docker-compose.yml
index e22222f..7b7f641 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -247,11 +247,67 @@ services:
       - "4000:4000"
     profiles: [ai]
 
+  # ─────────────── PERFIL: erpnext (ERPNext local) ──────────────────────────────
+
+  # ── MariaDB para ERPNext ─────────────────────────────────────────────────────
+  erpnext-db:
+    image: mariadb:10.6
+    restart: unless-stopped
+    profiles: [erpnext]
+    environment:
+      MYSQL_ROOT_PASSWORD: ${ERPNEXT_DB_ROOT_PASSWORD:-erpnext-root-2026}
+      MYSQL_DATABASE: _frappe
+      MYSQL_USER: frappe
+      MYSQL_PASSWORD: ${ERPNEXT_DB_PASSWORD:-frappe2026}
+    volumes:
+      - erpnext_db:/var/lib/mysql
+    command: >
+      --character-set-server=utf8mb4
+      --collation-server=utf8mb4_unicode_ci
+      --skip-character-set-client-handshake
+      --skip-innodb-read-only-compressed
+    healthcheck:
+      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-u", "root", "--password=${ERPNEXT_DB_ROOT_PASSWORD:-erpnext-root-2026}"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 30s
+
+  # ── ERPNext (Frappe Framework + ERPNext app) ─────────────────────────────────
+  erpnext:
+    image: frappe/erpnext:version-15
+    restart: unless-stopped
+    profiles: [erpnext]
+    environment:
+      FRAPPE_SITE_NAME_HEADER: erpnext.local
+      BACKEND_PORT: 8000
+    volumes:
+      - erpnext_sites:/home/frappe/frappe-bench/sites
+      - erpnext_logs:/home/frappe/frappe-bench/logs
+      - ./docker/erpnext/init.sh:/usr/local/bin/init-erpnext.sh:ro
+    depends_on:
+      erpnext-db:
+        condition: service_healthy
+    ports:
+      - "8090:8080"
+    command: ["/bin/bash", "/usr/local/bin/init-erpnext.sh"]
+    healthcheck:
+      test: ["CMD-SHELL", "curl -sf http://localhost:8080/api/method/frappe.ping || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 10
+      start_period: 120s
+    networks:
+      - arcadia
+
 volumes:
   pgdata:
   ollama_models:
   open_webui_data:
   superset_home:
+  erpnext_db:
+  erpnext_sites:
+  erpnext_logs:
 
 networks:
   arcadia:
diff --git a/docker/erpnext/init.sh b/docker/erpnext/init.sh
new file mode 100644
index 0000000..d845f45
--- /dev/null
+++ b/docker/erpnext/init.sh
@@ -0,0 +1,56 @@
+#!/bin/bash
+# ─── ERPNext init — cria site e instala app se necessário ─────────────────────
+# Executado como entrypoint do container frappe/erpnext:version-15
+
+set -e
+
+SITE_NAME="${FRAPPE_SITE_NAME:-erpnext.local}"
+DB_HOST="${DB_HOST:-erpnext-db}"
+DB_ROOT_PASSWORD="${ERPNEXT_DB_ROOT_PASSWORD:-erpnext-root-2026}"
+ADMIN_PASSWORD="${ERPNEXT_ADMIN_PASSWORD:-admin2026}"
+BENCH_DIR="/home/frappe/frappe-bench"
+
+echo "[ERPNext Init] Aguardando MariaDB em ${DB_HOST}..."
+until mysqladmin ping -h "${DB_HOST}" -u root --password="${DB_ROOT_PASSWORD}" --silent 2>/dev/null; do
+  echo "[ERPNext Init] MariaDB ainda não disponível — aguardando 3s..."
+  sleep 3
+done
+echo "[ERPNext Init] MariaDB disponível."
+
+cd "${BENCH_DIR}"
+
+SITES_DIR="${BENCH_DIR}/sites"
+SITE_DIR="${SITES_DIR}/${SITE_NAME}"
+
+if [ ! -f "${SITE_DIR}/site_config.json" ]; then
+  echo "[ERPNext Init] Criando site ${SITE_NAME}..."
+
+  bench new-site "${SITE_NAME}" \
+    --mariadb-root-password "${DB_ROOT_PASSWORD}" \
+    --admin-password "${ADMIN_PASSWORD}" \
+    --db-host "${DB_HOST}" \
+    --no-mariadb-socket \
+    --verbose || true
+
+  echo "[ERPNext Init] Instalando app erpnext..."
+  bench --site "${SITE_NAME}" install-app erpnext || true
+
+  echo "[ERPNext Init] Ativando modo developer..."
+  bench --site "${SITE_NAME}" set-config developer_mode 1 || true
+
+  echo "[ERPNext Init] Desativando SSL para env local..."
+  bench --site "${SITE_NAME}" set-config ssl_certificate "" || true
+
+  echo "[ERPNext Init] Site criado com sucesso."
+else
+  echo "[ERPNext Init] Site ${SITE_NAME} já existe — pulando criação."
+fi
+
+# Configura common_site_config.json para servir na porta 8080
+if [ ! -f "${SITES_DIR}/common_site_config.json" ]; then
+  echo '{"serve_default_site": true, "socketio_port": 9000, "background_workers": 1}' \
+    > "${SITES_DIR}/common_site_config.json"
+fi
+
+echo "[ERPNext Init] Iniciando servidor Frappe na porta 8080..."
+exec bench serve --port 8080 --site "${SITE_NAME}"
diff --git a/server/erpnext/proxy.ts b/server/erpnext/proxy.ts
new file mode 100644
index 0000000..552b487
--- /dev/null
+++ b/server/erpnext/proxy.ts
@@ -0,0 +1,115 @@
+// ERPNext Proxy — Transparente, igual ao Plus proxy
+// /erpnext-app/* → http://erpnext:8080/*
+
+import { Express, Response } from "express";
+import { createProxyMiddleware } from "http-proxy-middleware";
+
+const ERPNEXT_HOST = process.env.ERPNEXT_CONTAINER_HOST || "erpnext";
+const ERPNEXT_CONTAINER_PORT = parseInt(process.env.ERPNEXT_CONTAINER_PORT || "8080", 10);
+const ERPNEXT_TIMEOUT = parseInt(process.env.ERPNEXT_TIMEOUT || "60000", 10);
+
+export function setupErpNextProxy(app: Express): void {
+  // Só ativa se o container estiver configurado (DOCKER_MODE ou flag explícita)
+  const dockerMode = process.env.DOCKER_MODE === "true";
+  const forceProxy = process.env.ERPNEXT_PROXY_ENABLED === "true";
+
+  if (!dockerMode && !forceProxy) {
+    console.log("[ERPNext Proxy] Modo container desativado — proxy não configurado.");
+    console.log("[ERPNext Proxy] Use ERPNEXT_URL para apontar para instância externa.");
+    return;
+  }
+
+  const erpnextTarget = `http://${ERPNEXT_HOST}:${ERPNEXT_CONTAINER_PORT}`;
+
+  const erpnextProxy = createProxyMiddleware({
+    target: erpnextTarget,
+    changeOrigin: true,
+    timeout: ERPNEXT_TIMEOUT,
+    proxyTimeout: ERPNEXT_TIMEOUT,
+    pathRewrite: {
+      "^/erpnext-app": "",
+    },
+    on: {
+      error: (err, req, res) => {
+        console.error("[ERPNext Proxy] Error:", err.message);
+        if (res && typeof (res as Response).status === "function") {
+          (res as Response).status(502).json({
+            error: "ERPNext não disponível",
+            message: `Frappe não está rodando em ${erpnextTarget}`,
+          });
+        }
+      },
+      proxyReq: (proxyReq, req) => {
+        console.log(`[ERPNext Proxy] ${req.method} ${req.url} -> ${erpnextTarget}`);
+        const forwardedHost = req.headers["x-forwarded-host"];
+        const host = (typeof forwardedHost === "string" ? forwardedHost : req.headers.host) || "localhost";
+        const forwardedProto = req.headers["x-forwarded-proto"];
+        const proto = typeof forwardedProto === "string" ? forwardedProto : "https";
+        proxyReq.setHeader("X-Forwarded-Host", host);
+        proxyReq.setHeader("X-Forwarded-Proto", proto);
+        proxyReq.setHeader("X-Forwarded-Prefix", "/erpnext-app");
+        // Frappe usa este header para resolver URLs absolutas
+        proxyReq.setHeader("X-Site-Name", "erpnext.local");
+      },
+      proxyRes: (proxyRes) => {
+        const location = proxyRes.headers["location"];
+        if (location && typeof location === "string") {
+          let newLocation = location;
+          // Rewrite URLs absolutas do container → /erpnext-app
+          newLocation = newLocation.replace(
+            new RegExp(`http://${ERPNEXT_HOST}:${ERPNEXT_CONTAINER_PORT}`, "g"),
+            "/erpnext-app"
+          );
+          newLocation = newLocation.replace(/http:\/\/erpnext:8080/g, "/erpnext-app");
+          // Se é path relativo sem prefixo, adiciona /erpnext-app
+          if (newLocation.startsWith("/") && !newLocation.startsWith("/erpnext-app")) {
+            newLocation = "/erpnext-app" + newLocation;
+          }
+          proxyRes.headers["location"] = newLocation;
+        }
+      },
+    },
+  });
+
+  app.use("/erpnext-app", erpnextProxy);
+
+  // Status check do container ERPNext
+  app.get("/api/erpnext/container-status", async (_req, res) => {
+    try {
+      const controller = new AbortController();
+      const timeout = setTimeout(() => controller.abort(), 5000);
+
+      const response = await fetch(`${erpnextTarget}/api/method/frappe.ping`, {
+        signal: controller.signal,
+      });
+      clearTimeout(timeout);
+
+      if (response.ok) {
+        const data = await response.json() as any;
+        res.json({
+          status: "online",
+          host: ERPNEXT_HOST,
+          port: ERPNEXT_CONTAINER_PORT,
+          message: data.message,
+          mode: "container",
+        });
+      } else {
+        res.json({
+          status: "error",
+          host: ERPNEXT_HOST,
+          port: ERPNEXT_CONTAINER_PORT,
+          httpStatus: response.status,
+        });
+      }
+    } catch (err: any) {
+      res.json({
+        status: "offline",
+        host: ERPNEXT_HOST,
+        port: ERPNEXT_CONTAINER_PORT,
+        error: err.name === "AbortError" ? "timeout" : err.message,
+      });
+    }
+  });
+
+  console.log(`[ERPNext Proxy] Configurado: /erpnext-app -> ${erpnextTarget}`);
+}
diff --git a/server/routes.ts b/server/routes.ts
index 2b52597..ca0bb24 100644
--- a/server/routes.ts
+++ b/server/routes.ts
@@ -49,6 +49,8 @@ import governanceRoutes from "./governance/routes";
 import { setupPlusProxy } from "./plus/proxy";
 import { setupSupersetProxy } from "./superset/proxy";
 import { registerSupersetRoutes } from "./superset/routes";
+import { setupErpNextProxy } from "./erpnext/proxy";
+import { importErpNextRulesForTenant } from "./soe/erpnext-rule-importer";
 import { registerEngineRoomRoutes } from "./engine-room/routes";
 import plusSsoRoutes from "./plus/sso";
 import migrationRoutes from "./migration/routes";
@@ -73,6 +75,9 @@ export async function registerRoutes(
   // Apache Superset - Arcádia Insights (substitui Metabase)
   setupSupersetProxy(app);
   registerSupersetRoutes(app);
+
+  // ERPNext container proxy (ativo apenas em DOCKER_MODE ou ERPNEXT_PROXY_ENABLED=true)
+  setupErpNextProxy(app);
   
   registerChatRoutes(app);
   registerSoeRoutes(app);
@@ -108,6 +113,17 @@ export async function registerRoutes(
   registerCommunityRoutes(app);
   app.use("/api/para", paraRoutes);
   app.use("/api/erpnext", erpnextRoutes);
+
+  // SOE — Importar regras do ERPNext para soe_regras
+  app.post("/api/soe/erpnext/import-rules", async (req: any, res) => {
+    try {
+      const tenantId = req.user?.tenantId || req.body?.tenantId;
+      const result = await importErpNextRulesForTenant(tenantId);
+      res.json({ ok: true, ...result });
+    } catch (e: any) {
+      res.status(500).json({ ok: false, error: e.message });
+    }
+  });
   app.use("/api/quality", qualityRoutes);
   app.use("/api/lowcode", lowcodeRoutes);
   app.use("/api/dev-agent", devAgentRoutes);
diff --git a/server/soe/erpnext-rule-importer.ts b/server/soe/erpnext-rule-importer.ts
new file mode 100644
index 0000000..fa10800
--- /dev/null
+++ b/server/soe/erpnext-rule-importer.ts
@@ -0,0 +1,299 @@
+// SOE — ERPNext Rule Importer
+// Lê DocTypes e Workflows do ERPNext via API REST e converte
+// em soe_regras para o SOE Rule Engine.
+//
+// Uso:
+//   import { importErpNextRules } from "./erpnext-rule-importer";
+//   await importErpNextRules(tenantId);
+//
+// As regras geradas ficam na tabela soe_regras com origemPadrao=false
+// (origem: "erpnext") e podem ser sobrescritas por regras custom do tenant.
+
+import { db } from "../db/index";
+import { soeRegras } from "@shared/schema";
+import { and, eq } from "drizzle-orm";
+
+// DocTypes de negócio que queremos importar regras
+const DOCTYPES_ALVO = [
+  "Sales Order",
+  "Purchase Order",
+  "Sales Invoice",
+  "Purchase Invoice",
+  "Delivery Note",
+  "Purchase Receipt",
+  "Payment Entry",
+  "Journal Entry",
+  "Item",
+  "Customer",
+  "Supplier",
+  "Stock Entry",
+  "Quotation",
+];
+
+// Mapa DocType → trigger SOE correspondente
+const DOCTYPE_TRIGGER_MAP: Record<string, string> = {
+  "Sales Order": "pre_sales_order",
+  "Purchase Order": "pre_purchase_order",
+  "Sales Invoice": "pre_nfe_emissao",
+  "Purchase Invoice": "pre_compra_recebida",
+  "Delivery Note": "pre_entrega",
+  "Purchase Receipt": "pre_recebimento_mercadoria",
+  "Payment Entry": "pre_pagamento",
+  "Journal Entry": "pre_lancamento_contabil",
+  "Item": "pre_cadastro_produto",
+  "Customer": "pre_cadastro_cliente",
+  "Supplier": "pre_cadastro_fornecedor",
+  "Stock Entry": "pre_movimentacao_estoque",
+  "Quotation": "pre_orcamento",
+};
+
+interface FrappeDocTypeField {
+  fieldname: string;
+  label?: string;
+  fieldtype: string;
+  reqd?: number;
+  options?: string;
+  depends_on?: string;
+}
+
+interface FrappeWorkflowState {
+  state: string;
+  doc_status?: string;
+  allow_edit?: string;
+}
+
+interface FrappeWorkflowTransition {
+  state: string;
+  action: string;
+  next_state: string;
+  allowed?: string;
+}
+
+interface FrappeWorkflow {
+  name: string;
+  document_type: string;
+  is_active: number;
+  states?: FrappeWorkflowState[];
+  transitions?: FrappeWorkflowTransition[];
+}
+
+function getErpNextUrl(): string {
+  // Em modo container, usa o serviço Docker interno
+  const dockerMode = process.env.DOCKER_MODE === "true";
+  if (dockerMode) {
+    const host = process.env.ERPNEXT_CONTAINER_HOST || "erpnext";
+    const port = process.env.ERPNEXT_CONTAINER_PORT || "8080";
+    return `http://${host}:${port}`;
+  }
+  return process.env.ERPNEXT_URL || "";
+}
+
+function getAuthHeader(): Record<string, string> {
+  const key = process.env.ERPNEXT_API_KEY || "";
+  const secret = process.env.ERPNEXT_API_SECRET || "";
+  return {
+    Authorization: `token ${key}:${secret}`,
+    "Content-Type": "application/json",
+  };
+}
+
+async function fetchDocTypeFields(baseUrl: string, doctype: string): Promise<FrappeDocTypeField[]> {
+  try {
+    const resp = await fetch(
+      `${baseUrl}/api/resource/DocType/${encodeURIComponent(doctype)}`,
+      { headers: getAuthHeader(), signal: AbortSignal.timeout(10000) }
+    );
+    if (!resp.ok) return [];
+    const data = await resp.json() as any;
+    return (data?.data?.fields as FrappeDocTypeField[]) || [];
+  } catch {
+    return [];
+  }
+}
+
+async function fetchWorkflows(baseUrl: string, doctype: string): Promise<FrappeWorkflow[]> {
+  try {
+    const resp = await fetch(
+      `${baseUrl}/api/resource/Workflow?filters=[["document_type","=","${doctype}"],["is_active","=",1]]&fields=["name","document_type","is_active"]`,
+      { headers: getAuthHeader(), signal: AbortSignal.timeout(10000) }
+    );
+    if (!resp.ok) return [];
+    const data = await resp.json() as any;
+    const workflows: FrappeWorkflow[] = data?.data || [];
+
+    // Busca detalhes de cada workflow (states/transitions)
+    const detailed: FrappeWorkflow[] = [];
+    for (const wf of workflows) {
+      try {
+        const detResp = await fetch(
+          `${baseUrl}/api/resource/Workflow/${encodeURIComponent(wf.name)}`,
+          { headers: getAuthHeader(), signal: AbortSignal.timeout(10000) }
+        );
+        if (detResp.ok) {
+          const det = await detResp.json() as any;
+          detailed.push(det.data);
+        }
+      } catch {
+        detailed.push(wf);
+      }
+    }
+    return detailed;
+  } catch {
+    return [];
+  }
+}
+
+function campoParaSoe(field: FrappeDocTypeField, doctype: string, trigger: string) {
+  // Mapeamento de nomes de campo Frappe → nomes SOE
+  const fieldMap: Record<string, string> = {
+    customer: "clienteId",
+    supplier: "fornecedorId",
+    item_code: "itemCodigo",
+    qty: "quantidade",
+    rate: "valorUnitario",
+    amount: "valorTotal",
+    posting_date: "dataEmissao",
+    due_date: "vencimento",
+    payment_terms_template: "condicaoPagamento",
+    cost_center: "centroCusto",
+    company: "empresaNome",
+  };
+  return fieldMap[field.fieldname] || field.fieldname;
+}
+
+function gerarRegraObrigatorio(
+  field: FrappeDocTypeField,
+  doctype: string,
+  trigger: string,
+  tenantId: number | undefined
+) {
+  const campoSoe = campoParaSoe(field, doctype, trigger);
+  return {
+    tenantId,
+    dominio: "business" as const,
+    trigger,
+    nome: `ERPNext: ${doctype} — ${field.label || field.fieldname} obrigatório`,
+    condicao: {},
+    acao: {
+      validar: {
+        campo: campoSoe,
+        obrigatorio: true,
+      },
+    },
+    prioridade: 50,
+    ativo: true,
+    origemPadrao: false,
+  };
+}
+
+export async function importErpNextRules(tenantId?: number): Promise<{
+  imported: number;
+  skipped: number;
+  errors: string[];
+}> {
+  const baseUrl = getErpNextUrl();
+
+  if (!baseUrl) {
+    return { imported: 0, skipped: 0, errors: ["ERPNEXT_URL não configurado"] };
+  }
+
+  console.log(`[SOE RuleImporter] Iniciando importação de regras ERPNext de ${baseUrl}...`);
+
+  let imported = 0;
+  let skipped = 0;
+  const errors: string[] = [];
+
+  for (const doctype of DOCTYPES_ALVO) {
+    const trigger = DOCTYPE_TRIGGER_MAP[doctype];
+    if (!trigger) continue;
+
+    try {
+      // 1. Campos obrigatórios do DocType
+      const fields = await fetchDocTypeFields(baseUrl, doctype);
+      const requiredFields = fields.filter((f) => f.reqd === 1 && f.fieldname !== "name");
+
+      for (const field of requiredFields) {
+        const ruleId = `erpnext:${doctype.toLowerCase().replace(/ /g, "_")}:${field.fieldname}:reqd`;
+
+        // Verifica se já existe
+        try {
+          const existing = await db.query.soeRegras?.findFirst?.({
+            where: (t: any, { eq }: any) => eq(t.id, ruleId),
+          });
+          if (existing) { skipped++; continue; }
+        } catch { /* tabela pode não existir ainda */ }
+
+        try {
+          const ruleData = gerarRegraObrigatorio(field, doctype, trigger, tenantId);
+          await db.insert(soeRegras).values({
+            id: ruleId,
+            ...ruleData,
+            condicao: ruleData.condicao,
+            acao: ruleData.acao,
+          } as any);
+          imported++;
+        } catch (e: any) {
+          errors.push(`${doctype}/${field.fieldname}: ${e.message}`);
+        }
+      }
+
+      // 2. Workflows ativos → regras de estado permitido
+      const workflows = await fetchWorkflows(baseUrl, doctype);
+      for (const wf of workflows) {
+        if (!wf.transitions?.length) continue;
+
+        // Extrai ações permitidas por estado → regra de validação de status
+        const allowedActions = wf.transitions.map((t) => t.action).filter(Boolean);
+        if (allowedActions.length === 0) continue;
+
+        const ruleId = `erpnext:wf:${wf.name.toLowerCase().replace(/ /g, "_")}`;
+
+        try {
+          const existing = await db.query.soeRegras?.findFirst?.({
+            where: (t: any, { eq }: any) => eq(t.id, ruleId),
+          });
+          if (existing) { skipped++; continue; }
+        } catch { /* ok */ }
+
+        try {
+          await db.insert(soeRegras).values({
+            id: ruleId,
+            tenantId,
+            dominio: "business",
+            trigger,
+            nome: `ERPNext Workflow: ${wf.name}`,
+            condicao: {},
+            acao: {
+              set: {
+                _erpnextWorkflow: wf.name,
+                _erpnextAllowedActions: allowedActions,
+              },
+            },
+            prioridade: 80,
+            ativo: true,
+            origemPadrao: false,
+          } as any);
+          imported++;
+        } catch (e: any) {
+          errors.push(`Workflow ${wf.name}: ${e.message}`);
+        }
+      }
+
+      console.log(`[SOE RuleImporter] ${doctype}: ${requiredFields.length} campos obrigatórios, ${workflows.length} workflow(s)`);
+    } catch (e: any) {
+      errors.push(`DocType ${doctype}: ${e.message}`);
+    }
+  }
+
+  console.log(`[SOE RuleImporter] Concluído: ${imported} importadas, ${skipped} já existiam, ${errors.length} erros`);
+  return { imported, skipped, errors };
+}
+
+// Endpoint para disparar importação via API
+export async function importErpNextRulesForTenant(tenantId: number): Promise<{
+  imported: number;
+  skipped: number;
+  errors: string[];
+}> {
+  return importErpNextRules(tenantId);
+}

From fc20a0e8b222bb5ad4518715eddecbd3815f0920 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 16 Mar 2026 19:59:38 +0000
Subject: [PATCH 3/3] feat(prod): adiciona Plus, Superset e ERPNext ao
 docker-compose.prod.yml
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Serviços adicionados com profiles opcionais:
- plus-db (MySQL 8.0) + plus (PHP/Laravel) → profile: plus
- superset (Apache Superset 4.1.0) → profile: bi
- erpnext-db (MariaDB 10.6) + erpnext (Frappe v15) → profile: erpnext

App principal recebe novas env vars:
  PLUS_HOST, PLUS_AUTO_START=false, SSO_PLUS_BASE_URL
  SUPERSET_HOST, SUPERSET_ADMIN_*
  ERPNEXT_PROXY_ENABLED, ERPNEXT_URL, ERPNEXT_API_KEY/SECRET

Volumes adicionados: plus_db, plus_storage, superset_home,
  erpnext_db, erpnext_sites, erpnext_logs

https://claude.ai/code/session_01DinH3VcgbAv1d9MqnNxzdb
---
 docker-compose.prod.yml | 152 +++++++++++++++++++++++++++++++++++++++-
 1 file changed, 151 insertions(+), 1 deletion(-)

diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index af01a8c..7cc6df0 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -60,9 +60,23 @@ services:
       LITELLM_API_KEY: ${LITELLM_API_KEY}
       OLLAMA_BASE_URL: ${OLLAMA_BASE_URL:-http://ollama:11434}
       # ── Manus Agent — aponta para LiteLLM como gateway unificado ──────────
-      # LiteLLM roteia para Ollama (local), LLMFit (fine-tuned) ou externo
       AI_INTEGRATIONS_OPENAI_BASE_URL: http://litellm:4000/v1
       AI_INTEGRATIONS_OPENAI_API_KEY: ${LITELLM_API_KEY}
+      # ── Arcádia Plus (Laravel) ─────────────────────────────────────────────
+      PLUS_HOST: plus
+      PLUS_PORT: "8080"
+      PLUS_AUTO_START: "false"   # container separado em prod
+      SSO_PLUS_BASE_URL: http://plus:8080
+      # ── Apache Superset ───────────────────────────────────────────────────
+      SUPERSET_HOST: superset
+      SUPERSET_ADMIN_USER: ${SUPERSET_ADMIN_USER:-admin}
+      SUPERSET_ADMIN_PASSWORD: ${SUPERSET_ADMIN_PASSWORD}
+      # ── ERPNext ───────────────────────────────────────────────────────────
+      ERPNEXT_PROXY_ENABLED: ${ERPNEXT_PROXY_ENABLED:-false}
+      ERPNEXT_CONTAINER_HOST: erpnext
+      ERPNEXT_URL: ${ERPNEXT_URL:-http://erpnext:8080}
+      ERPNEXT_API_KEY: ${ERPNEXT_API_KEY:-}
+      ERPNEXT_API_SECRET: ${ERPNEXT_API_SECRET:-}
     ports:
       - "5000:5000"
     depends_on:
@@ -79,6 +93,136 @@ services:
       - "traefik.http.routers.arcadia.tls=true"
       - "traefik.http.routers.arcadia.tls.certresolver=letsencrypt"
 
+  # ── Arcádia Plus (Laravel + MySQL) ──────────────────────────────────────────
+  # Perfil `plus` — suba com: docker compose --profile plus up
+  plus-db:
+    image: mysql:8.0
+    restart: always
+    profiles: [plus]
+    environment:
+      MYSQL_ROOT_PASSWORD: ${PLUS_DB_ROOT_PASSWORD}
+      MYSQL_DATABASE: ${PLUS_DB_DATABASE:-arcadia_plus}
+      MYSQL_USER: ${PLUS_DB_USER:-plus}
+      MYSQL_PASSWORD: ${PLUS_DB_PASSWORD}
+    volumes:
+      - plus_db:/var/lib/mysql
+    command: --default-authentication-plugin=mysql_native_password
+    healthcheck:
+      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-u", "root", "--password=${PLUS_DB_ROOT_PASSWORD}"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+    networks:
+      - arcadia-internal
+
+  plus:
+    image: ${PLUS_IMAGE:-php:8.3-apache}
+    restart: always
+    profiles: [plus]
+    environment:
+      APP_ENV: production
+      APP_KEY: ${PLUS_APP_KEY}
+      APP_URL: https://${DOMAIN}/plus
+      DB_HOST: plus-db
+      DB_DATABASE: ${PLUS_DB_DATABASE:-arcadia_plus}
+      DB_USERNAME: ${PLUS_DB_USER:-plus}
+      DB_PASSWORD: ${PLUS_DB_PASSWORD}
+      SESSION_DRIVER: redis
+      REDIS_HOST: redis
+      ARCADIA_URL: https://${DOMAIN}
+      ARCADIA_SSO_SECRET: ${SSO_SECRET}
+    volumes:
+      - plus_storage:/var/www/html/storage
+    depends_on:
+      plus-db:
+        condition: service_healthy
+    networks:
+      - arcadia-internal
+
+  # ── Apache Superset (BI) ─────────────────────────────────────────────────────
+  # Perfil `bi` — suba com: docker compose --profile bi up
+  superset:
+    image: apache/superset:4.1.0
+    restart: always
+    profiles: [bi]
+    environment:
+      SUPERSET_SECRET_KEY: ${SUPERSET_SECRET_KEY}
+      DATABASE_URL: postgresql://${PGUSER:-arcadia}:${PGPASSWORD}@db:5432/arcadia_superset
+      ARCADIA_DATABASE_URL: postgresql://${PGUSER:-arcadia}:${PGPASSWORD}@db:5432/${PGDATABASE:-arcadia}
+      SUPERSET_ADMIN_USER: ${SUPERSET_ADMIN_USER:-admin}
+      SUPERSET_ADMIN_EMAIL: ${SUPERSET_ADMIN_EMAIL:-admin@arcadia.app}
+      SUPERSET_ADMIN_PASSWORD: ${SUPERSET_ADMIN_PASSWORD}
+      SUPERSET_WEBSERVER_PORT: "8088"
+      PYTHONPATH: /app/pythonpath
+    volumes:
+      - ./docker/superset/superset_config.py:/app/pythonpath/superset_config.py:ro
+      - ./docker/superset/init.sh:/app/docker/init.sh:ro
+      - superset_home:/app/superset_home
+    depends_on:
+      db:
+        condition: service_healthy
+    command: ["/bin/bash", "/app/docker/init.sh"]
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8088/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 60s
+    networks:
+      - arcadia-internal
+
+  # ── ERPNext (Frappe Framework) ───────────────────────────────────────────────
+  # Perfil `erpnext` — suba com: docker compose --profile erpnext up
+  erpnext-db:
+    image: mariadb:10.6
+    restart: always
+    profiles: [erpnext]
+    environment:
+      MYSQL_ROOT_PASSWORD: ${ERPNEXT_DB_ROOT_PASSWORD}
+      MYSQL_DATABASE: _frappe
+      MYSQL_USER: frappe
+      MYSQL_PASSWORD: ${ERPNEXT_DB_PASSWORD}
+    volumes:
+      - erpnext_db:/var/lib/mysql
+    command: >
+      --character-set-server=utf8mb4
+      --collation-server=utf8mb4_unicode_ci
+      --skip-character-set-client-handshake
+      --skip-innodb-read-only-compressed
+    healthcheck:
+      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-u", "root", "--password=${ERPNEXT_DB_ROOT_PASSWORD}"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 30s
+    networks:
+      - arcadia-internal
+
+  erpnext:
+    image: frappe/erpnext:version-15
+    restart: always
+    profiles: [erpnext]
+    environment:
+      FRAPPE_SITE_NAME_HEADER: erpnext.local
+      ERPNEXT_DB_ROOT_PASSWORD: ${ERPNEXT_DB_ROOT_PASSWORD}
+      ERPNEXT_ADMIN_PASSWORD: ${ERPNEXT_ADMIN_PASSWORD}
+    volumes:
+      - erpnext_sites:/home/frappe/frappe-bench/sites
+      - erpnext_logs:/home/frappe/frappe-bench/logs
+      - ./docker/erpnext/init.sh:/usr/local/bin/init-erpnext.sh:ro
+    depends_on:
+      erpnext-db:
+        condition: service_healthy
+    command: ["/bin/bash", "/usr/local/bin/init-erpnext.sh"]
+    healthcheck:
+      test: ["CMD-SHELL", "curl -sf http://localhost:8080/api/method/frappe.ping || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 10
+      start_period: 120s
+    networks:
+      - arcadia-internal
+
   # ── Microserviços Python ─────────────────────────────────────────────────────
   contabil:
     build:
@@ -235,3 +379,9 @@ volumes:
   redis_data:
   ollama_models:
   open_webui_data:
+  plus_db:
+  plus_storage:
+  superset_home:
+  erpnext_db:
+  erpnext_sites:
+  erpnext_logs: