.env.example

# SIFEN environment.
#   test -> SET's "ambiente de pruebas" (sifen-test.set.gov.py). Default.
#   prod -> live SET (sifen.set.gov.py). Only after SET certifies your KuDE and
#           your outbound egress is proven good. Never start here.
SIFEN_ENV=test

# Emission mode.
#   stub -> no SET calls. The dispatcher and poller simulate the lote lifecycle
#           (accepted -> processing -> approved) so you can run the whole queue,
#           dispatch, poll, and fallback flow with NO certificate and NO CSC.
#           Use this for local dev and CI.
#   live -> real SOAP + mTLS calls to SIFEN_ENV. Requires a digital signature
#           certificate from a provider authorized in Paraguay (e.g. Digito), the
#           CSC, AND a static, known-good egress IP (see README). Without the
#           certificate real emission is impossible; the stub does not need one.
SIFEN_MODE=stub

# ============================================================================
# Issuer (emisor) identity
#
# Every value below lands in gEmis or gTimb, and SET matches it against the RUC's
# registration in Marangatu. An approximation is a rejection, not a cosmetic
# difference, so copy these off the DNIT record rather than off the letterhead.
# In a multi-tenant product this whole block is a database row per merchant, not
# an env var.
# ============================================================================

# RUC of the issuer. The 8-digit base, no check digit.
ISSUER_RUC=80000000

# Check digit (digito verificador) of the RUC. Validated with Modulo 11 at
# startup so an invalid RUC never reaches the CDC builder. For RUC 80000000 the
# Modulo 11 check digit is 5.
ISSUER_DV=5

# dNomEmi: the registered legal name. dNomFanEmi is the trade name and is
# optional; leave it blank if the merchant does not use one.
ISSUER_NAME=Issuer Demo SA
ISSUER_TRADE_NAME=Issuer Demo

# iTipCont: 1 persona fisica, 2 persona juridica.
ISSUER_CONTRIBUTOR_TYPE=2

# Timbrado: DNIT's authorization number for this issuer to emit documents, plus
# the window it is valid for. SET rejects a DE whose timbrado is not yet active
# or already expired, so we check this BEFORE building any XML.
ISSUER_TIMBRADO=12345678
ISSUER_TIMBRADO_START=2026-01-01
ISSUER_TIMBRADO_END=2026-12-31

# Establishment and point-of-expedition codes that make up the document number
# prefix (001-001-NNNNNNN). Assigned per branch in the DNIT portal.
ISSUER_ESTABLISHMENT=001
ISSUER_EXPEDITION_POINT=001

# dDirEmi and dNumCas: street and house number of the establishment.
ISSUER_ADDRESS=Avenida Principal
ISSUER_HOUSE_NUMBER=1234

# Geography. The CODES are what SET validates; the names are what prints on the
# KuDE, and both go in the DE. Departments run 1..19 (1 = CAPITAL). The city
# code comes from SET's distrito/ciudad table, not from an internal id.
ISSUER_DEPARTMENT=1
ISSUER_DEPARTMENT_NAME=CAPITAL
ISSUER_CITY=1
ISSUER_CITY_NAME=ASUNCION

ISSUER_PHONE=021123456
ISSUER_EMAIL=facturacion@example.com

# gActEco: the economic activity the RUC is registered under. Wrong code here is
# a rejection even when every amount is right.
ISSUER_ACTIVITY_CODE=62010
ISSUER_ACTIVITY_NAME=Programacion informatica

# ============================================================================
# Signing material
#
# Two accepted shapes. Use ONE of them.
#   a) SIFEN_P12_BASE64 + SIFEN_P12_PASSWORD: the .p12 the certification
#      authority actually hands the merchant, base64'd. This is the normal case.
#      Generate with: base64 -i certificado.p12 | tr -d '\n'
#   b) SIFEN_CERT_PEM + SIFEN_PRIVATE_KEY_PEM: the already-extracted pair, for
#      when the key lives in a secret manager that stores PEM.
#
# In production the private key is extracted from the .p12 in memory at upload
# time, encrypted at rest with SIFEN_ENCRYPTION_KEY, and the .p12 and its
# password are discarded. NEVER commit real material. In stub mode all of this
# stays blank.
# ============================================================================
SIFEN_P12_BASE64=
SIFEN_P12_PASSWORD=
SIFEN_CERT_PEM=
SIFEN_PRIVATE_KEY_PEM=

# AES-256-GCM key that the private key is encrypted with at rest. 32 bytes,
# base64. Only the worker process (on the known-good egress) ever decrypts it.
# Generate with: openssl rand -base64 32
SIFEN_ENCRYPTION_KEY=

# ============================================================================
# CSC (Codigo de Seguridad del Contribuyente)
#
# The 32-character secret SET issues at enrollment, plus the 4-digit id of the
# one in use. It is the shared secret behind the QR hash and it NEVER appears in
# the QR URL, only in the SHA-256 that closes it. Without it the QR renders and
# then fails validation on ekuatia's consult page, which looks like a rejected
# document to the customer even though SET approved it.
#
# Treat it like a signing key. Anyone holding it can mint a QR that validates.
# ============================================================================
SIFEN_CSC=
SIFEN_CSC_ID=0001

# Postgres connection string. The QUEUE lives here (no Redis needed). The worker
# connects directly (not through PgBouncer) because it uses LISTEN/NOTIFY, which
# a transaction pooler drops. The Next app can use the pooler.
DATABASE_URL=postgresql://postgres:postgres@localhost:5432/sifen_demo

# Worker auto-dispatch switch. This is the production setting.
#   true  -> the dispatcher wakes on NOTIFY and on a sweep timer and sends lotes
#            on its own, unattended. This is how production runs, once your egress
#            is proven good.
#   false -> the reversible circuit breaker. The worker stops auto-sending; you
#            flip to this during a SET outage or an egress regression and drain
#            the backlog by hand with `npm run drain` once the path is healthy.
# Code default when unset is false (fail-safe), so a half-configured deploy never
# fires at SET on its own.
SIFEN_AUTO_DISPATCH=true