docs: fixed documentation

Author: artur-oliveira-carvalho

CONDUCT.md

@@ -443,7 +443,7 @@ Must follow Conventional Commits:
 - Auth is RS256-only. JWT `sub` claim is the ctech user ID. There is no `SECRET_KEY` — do not add HS256.
 - JWKS keys are cached in Redis/Valkey (TTL 1h). Falls back to in-memory when `VALKEY_URL` is unset.
 - NF-e numbering uses `transact_write` for atomicity — never replace with separate read/write.
-- Organization context is passed via `PyDfe-Organization-Pk` header — never path parameters.
+- Organization context is passed via `Dfe-Organization-Pk` header — never path parameters.
 - All route errors go through `sendProblem(c, err)` — never return raw errors or `fiber.NewError`.
 - Services return `*problem.Problem` via `problem.BadRequest/NotFound/InternalServer` helpers.
 - **Every mutating endpoint binds a typed request DTO and validates it before persistence.**

DOCS.md

@@ -336,7 +336,7 @@ ctech-dfe-api/
 │   ├── problem/                # RFC 7807 Problem type + helpers
 │   ├── middleware/
 │   │   ├── auth.go             # RS256 JWT validation, JWKS cached in Redis
-│   │   ├── tenant.go           # PyDfe-Organization-Pk header → org context
+│   │   ├── tenant.go           # Dfe-Organization-Pk header → org context
 │   │   └── perm.go             # RBAC permission checker (OWNER/ADMIN bypass)
 │   ├── cache/                  # Redis + in-memory backends
 │   ├── ws/                     # WebSocket registry (Redis pub/sub)
@@ -507,7 +507,7 @@ response / link; DynamoDB stores only its SHA-256.
 
 #### Products
 
-Use the `PyDfe-Organization-Pk` header for org context.
+Use the `Dfe-Organization-Pk` header for org context.
 
 | Method | Endpoint              | Description                    |
 |--------|-----------------------|--------------------------------|
@@ -665,7 +665,7 @@ When `emit_uf='RJ'` and `cst='40'` without a configured `icms_mot_des`, the syst
 
 #### Vehicles
 
-Organization is always resolved from the `PyDfe-Organization-Pk` header, not a path parameter.
+Organization is always resolved from the `Dfe-Organization-Pk` header, not a path parameter.
 Only `plate`/`plate_uf`/`role` are required to create a vehicle — every other field is optional
 and is gated per doc-type/role at emission time via the requirements endpoint below. Trailers
 are ordinary vehicle rows with `role=trailer`, independently selectable — not nested under a
@@ -1093,7 +1093,7 @@ app/
 ### ApiClient (`lib/api/client.ts`)
 
 Type-safe Axios wrapper. Holds `access_token` in module-level memory (never localStorage). Injects
-`Authorization: Bearer {token}` and `PyDfe-Organization-Pk` headers on every request. On 401, calls the registered
+`Authorization: Bearer {token}` and `Dfe-Organization-Pk` headers on every request. On 401, calls the registered
 `_refreshFn` to silently refresh via ctech-account before retrying once. The request interceptor also strips null
 fields from POST (create) payloads (`stripNulls`/`isStrippableBody`) — see "DynamoDB storage policy — null omission".
 

MIGRATION.md

@@ -134,7 +134,7 @@ SQS Event → Lambda handler
 
 - `transact_write` for NF-e numbering
 - DynamoDB PK format: `CNPJ_...` / `CPF_...`
-- `PyDfe-Organization-Pk` header name
+- `Dfe-Organization-Pk` header name
 - RS256 JWKS validation via `CTECH_JWKS_URL`
 - WebSocket: Redis pub/sub keyed by `org_pk`
 

README.md

@@ -17,8 +17,18 @@ comunicação direta à SEFAZ.
 
 ## Subprojetos
 
+| Diretório | Papel | README |
+|-----------|-------|--------|
+| `py-dfe/` | Biblioteca Python core — Lambda + SEFAZ SOAP (mTLS) | [py-dfe/README.md](py-dfe/README.md) |
+| `go-dfe/` | Cliente Go SEFAZ (mTLS, in-process) | [go-dfe/README.md](go-dfe/README.md) |
+| `api/`    | Backend REST — Go (Fiber v3), multi-tenant | [api/README.md](api/README.md) |
+| `ui/`     | Frontend SaaS — Next.js + TypeScript + ShadCN | [ui/README.md](ui/README.md) |
+| `worker/` | Workers assíncronos — Go Lambda (SQS consumers) | [worker/README.md](worker/README.md) |
+| `cdk/`    | Infraestrutura AWS — CDK TypeScript | [cdk/README.md](cdk/README.md) |
+
 ```
 py-dfe/     # Biblioteca Python core — Lambda + SEFAZ SOAP (mTLS)
+go-dfe/     # Cliente Go SEFAZ (mTLS, in-process) — primário; py-dfe é fallback
 api/        # Backend REST — Go (Fiber v3), multi-tenant
 ui/         # Frontend SaaS — Next.js + TypeScript + ShadCN
 worker/     # Workers assíncronos — Go Lambda (SQS consumers)

api/AGENTS.md

@@ -59,8 +59,12 @@ api/
 
 - All string keys, status codes, table name suffixes, header names, cache key prefixes, and env
   strings MUST be defined as named constants or config fields.
-- The `PyDfe-Organization-Pk` header name is defined once in `middleware/tenant.go` — never
-  hardcoded in route files.
+- The `Dfe-Organization-Pk` header name is defined once as `OrgHeader` in
+  `middleware/rbac.go:22` — never hardcoded in route files. It MUST stay in sync with the UI
+  constant `ORG_HEADER` in `ui/src/lib/api/client.ts:50`.
+- **Never call the deprecated `GET /v1.0/distributions/nfe`** — it does not exist; use
+  `GET /v1.0/distributions/{doc_type}/history` (`internal/api/v1/distributions.go:18-29`).
+- Endpoint reference: [`README.md`](README.md).
 
 ### Error Handling (MUST follow)
 
@@ -132,7 +136,7 @@ Run: `go test ./... -race` from `api/`.
 - `InMemoryCache` TTL=300s — not shared across replicas. Redis/Valkey is authoritative for JWKS and WebSocket pub/sub.
 - Lambda invocation for doc issuance is async: API enqueues to SQS FIFO, returns 202, worker processes and pushes
   WebSocket update.
-- Organization context is always via `PyDfe-Organization-Pk` header — never path parameters (except org creation
+- Organization context is always via `Dfe-Organization-Pk` header — never path parameters (except org creation
   endpoints).
 - Profile/password management endpoints do not exist here — those belong to ctech-account.
 - JWKS keys cached in Redis (TTL 1h), falls back to in-memory when `VALKEY_URL` is unset.

api/CLAUDE.md

@@ -146,6 +146,8 @@ Run: `go test ./... -race` from `api/`.
   `azp` (client identity).
 - KID rotation in ctech-account flushes JWKS cache — Redis TTL is 1h; force-flush by restarting or clearing the
   `ctech:jwks` key.
+- `CORS_ALLOWED_ORIGINS` is configured in env but the CORS middleware is NOT wired in `app.go` (browser is
+  same-origin, so no production impact today). Treat CORS as inactive until the middleware is added.
 
 ---