resolvemos o problema dos ZEE e ZFI

app/Http/Controllers/InvestmentDiscoveryController.php

@@ -49,13 +49,16 @@ class InvestmentDiscoveryController extends Controller
         if (in_array($filters['dimension'] ?? null, ['cluster', 'corridor'], true)) {
             $query->whereNotNull($filters['dimension'].'_id');
         }
-        foreach (['zee_id', 'zfi_id', 'park_id', 'education', 'facets', 'sector', 'province', 'district', 'geo_location_id', 'min_amount', 'max_amount', 'currency', 'before', 'maturity_level'] as $field) {
+        if (! empty($filters['geo_location_id'])) {
+            app(InvestmentGeography::class)->constrainDossiersToTerritories($query, app(InvestmentGeography::class)->descendants($filters['geo_location_id']));
+        }
+        foreach (['zee_id', 'zfi_id', 'park_id', 'education', 'facets', 'sector', 'province', 'district', 'min_amount', 'max_amount', 'currency', 'before', 'maturity_level'] as $field) {
             if (isset($filters[$field]) && $filters[$field] !== '' && $filters[$field] !== false && $filters[$field] !== []) {
                 return $query->whereRaw('false')->get();
             }
         }
         if (! empty($filters['q'])) {
-            $query->where('title', 'ilike', '%'.$filters['q'].'%');
+            $query->where(fn ($q) => $q->where('title', 'ilike', '%'.$filters['q'].'%')->orWhereRaw('content::text ILIKE ?', ['%'.$filters['q'].'%']));
         }
         foreach (['cluster_id', 'corridor_id', 'project_id'] as $field) {
             if (! empty($filters[$field])) {
@@ -80,7 +83,17 @@ class InvestmentDiscoveryController extends Controller
     {
         $record = Opportunity::published()->with('sector:id,name,slug')->where('slug', $slug)->firstOrFail();
 
-        $data = $request->validate(['zone_id' => ['nullable', 'uuid']]);
+        $data = $request->validate(['zone_id' => ['nullable', 'uuid'], 'from_dossier' => ['nullable', 'uuid']]);
+        $dossierOrigin = isset($data['from_dossier']) ? InvestmentPortfolioController::visible()->whereKey($data['from_dossier'])->firstOrFail() : null;
+        if ($dossierOrigin) {
+            $linked = false;
+            foreach (['projects' => 'project_id', 'clusters' => 'cluster_id', 'corridors' => 'corridor_id'] as $relation => $foreign) {
+                if ($dossierOrigin->$foreign && DB::table('opportunity_'.$relation)->where('opportunity_id', $record->id)->where($foreign, $dossierOrigin->$foreign)->exists()) {
+                    $linked = true;
+                }
+            }
+            abort_unless($linked, 404);
+        }
         $origin = null;
         if (! empty($data['zone_id'])) {
             $origin = app(InvestmentZones::class)->links()->join('investment_item_opportunities as m', 'm.item_id', '=', 'zl.item_id')
@@ -89,9 +102,10 @@ class InvestmentDiscoveryController extends Controller
         }
 
         $returnFilters = $request->query();
-        unset($returnFilters['zone_id']);
+        unset($returnFilters['zone_id'], $returnFilters['from_dossier']);
 
         return Inertia::render('investment/detail', ['record' => $record, 'context' => $catalogue->context($record->id), 'zone_origin' => $origin,
+            'dossierOrigin' => $dossierOrigin ? ['id' => $dossierOrigin->id, 'title' => $dossierOrigin->title] : null,
             'returnUrl' => $returnFilters === [] ? '/oportunidades' : '/oportunidades?'.http_build_query($returnFilters)]);
     }
 

app/Http/Controllers/InvestmentPortfolioController.php

@@ -3,11 +3,12 @@
 namespace App\Http\Controllers;
 
 use App\Models\InvestmentDossier;
+use App\Models\InvestmentSubmission;
 use App\Models\Opportunity;
 use App\Models\Project;
-use App\Models\InvestmentSubmission;
-use App\Services\InvestmentZones;
 use App\Services\InvestmentGeography;
+use App\Services\InvestmentRelations;
+use App\Services\InvestmentZones;
 use App\Services\PortalAudit;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Query\Builder as QueryBuilder;
@@ -21,6 +22,12 @@ class InvestmentPortfolioController extends Controller
 {
     public static function related(InvestmentDossier $first, InvestmentDossier $second): bool
     {
+        foreach ([[$first, $second], [$second, $first]] as [$cluster, $project]) {
+            if ($cluster->cluster_id && $project->project_id && app(InvestmentRelations::class)->memberships()
+                ->where('cp.cluster_id', $cluster->cluster_id)->where('cp.project_id', $project->project_id)->exists()) {
+                return true;
+            }
+        }
         foreach ([['corridor_projects', 'corridor_id', 'project_id'], ['corridor_clusters', 'corridor_id', 'cluster_id'], ['cluster_projects', 'cluster_id', 'project_id']] as [$table, $left, $right]) {
             foreach ([[$first, $second], [$second, $first]] as [$a, $b]) {
                 if ($a->$left && $b->$right && self::currentRelation(DB::table($table)->where($left, $a->$left)->where($right, $b->$right))->exists()) {
@@ -60,7 +67,7 @@ class InvestmentPortfolioController extends Controller
             $query->whereNotNull($filters['kind'].'_id');
         }
         if (! empty($filters['q'])) {
-            $query->where('title', 'ilike', '%'.$filters['q'].'%');
+            $query->where(fn ($q) => $q->where('title', 'ilike', '%'.$filters['q'].'%')->orWhereRaw('content::text ILIKE ?', ['%'.$filters['q'].'%']));
         }
         $territorySelection = app(InvestmentGeography::class)->selection($filters);
         if ($territorySelection !== []) {
@@ -125,6 +132,7 @@ class InvestmentPortfolioController extends Controller
 
         return Inertia::render('portfolio/show', ['record' => $record, 'related' => $related, 'management' => $management, 'zones' => $zones,
             'anchorProject' => $anchorProject, 'existingSubmissions' => $existingSubmissions,
+            'geography' => app(InvestmentRelations::class)->dossier($record, $management),
             'origin' => $origin ? ['id' => $origin->id, 'title' => $origin->title] : null, 'opportunities' => $opportunities, 'chains' => $chains]);
     }
 

app/Http/Controllers/InvestmentRelationshipRepairController.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Services\InvestmentRelationshipRepair;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Inertia\Inertia;
+use Inertia\Response;
+
+class InvestmentRelationshipRepairController extends Controller
+{
+    public function preview(InvestmentRelationshipRepair $repair): Response
+    {
+        return Inertia::render('management/relationship-repair', $repair->preview());
+    }
+
+    public function apply(Request $request, InvestmentRelationshipRepair $repair): RedirectResponse|JsonResponse
+    {
+        $data = $request->validate(['hash' => ['required', 'string', 'size:64'], 'row_id' => ['nullable', 'string', 'size:64'],
+            'validation_hash' => ['required_with:row_id', 'nullable', 'string', 'size:64']]);
+        $result = $repair->apply($data['hash'], $request->user()->id, $data['row_id'] ?? null, $data['validation_hash'] ?? null);
+
+        return $request->expectsJson() ? response()->json($result) : back()->with('success', $result['replayed'] ? 'Este plano já foi aplicado; nenhum duplicado criado.' : 'Associações documentadas aplicadas. Registos de oportunidades permanecem preparados sem publicação automática.');
+    }
+}

app/Http/Controllers/PartnershipExchangeController.php

@@ -0,0 +1,401 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Jobs\ScanDocumentForMalware;
+use App\Models\ExistingBusiness;
+use App\Models\User;
+use App\Services\InvestmentCatalogue;
+use App\Services\InvestmentGeography;
+use App\Services\InvestmentRelations;
+use App\Services\PartnershipExchange;
+use App\Services\PartnershipMatching;
+use App\Services\PartnershipSources;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Gate;
+use Illuminate\Support\Facades\Schema;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Str;
+use Inertia\Inertia;
+use Inertia\Response;
+use Symfony\Component\HttpFoundation\BinaryFileResponse;
+
+class PartnershipExchangeController extends Controller
+{
+    public function source(Request $request, string $type, string $id): JsonResponse
+    {
+        if (! Schema::hasTable('partnership_origins')) {
+            return response()->json(['available' => false, 'items' => []]);
+        }
+        app(PartnershipSources::class)->resolve($type, $id, $request->user());
+
+        return response()->json(['available' => true, 'items' => DB::table('portal_partnerships as p')->join('partnership_origins as origin', 'origin.partnership_id', '=', 'p.id')
+            ->where('origin.type', $type)->where('origin.target_id', $id)->where('p.status', 'published')->orderByDesc('p.id')->get(['p.id', 'p.title'])])->header('Cache-Control', 'private, no-store');
+    }
+
+    public function index(Request $request): Response|JsonResponse
+    {
+        $filters = $request->validate(['q' => 'nullable|string|max:120', 'sector_id' => 'nullable|integer', 'partnership_type' => 'nullable|string|max:40',
+            'kind' => 'nullable|in:offering,seeking', 'territory_id' => 'nullable|uuid', 'origin_type' => 'nullable|string|max:40', 'origin_id' => 'nullable|string|max:100']);
+        $query = DB::table('portal_partnerships as p')->where('p.status', 'published');
+        foreach (['sector_id', 'partnership_type', 'kind'] as $field) {
+            if (! empty($filters[$field])) {
+                $query->where('p.'.$field, $filters[$field]);
+            }
+        }
+        if (! empty($filters['q'])) {
+            $term = '%'.$filters['q'].'%';
+            $query->where(fn ($q) => $q->where('p.title', 'ilike', $term)->orWhere('p.sector', 'ilike', $term)
+                ->orWhereRaw("p.payload->>'summary' ILIKE ?", [$term])->orWhere(fn ($details) => $details->whereRaw("COALESCE(p.payload->>'confidentiality','public')='public'")->where(fn ($body) => $body->where('p.offer', 'ilike', $term)->orWhere('p.seeking', 'ilike', $term))));
+        }
+        if (! empty($filters['origin_type']) && ! empty($filters['origin_id'])) {
+            // Authenticate access to a private master before exposing a backlink query.
+            app(PartnershipSources::class)->resolve($filters['origin_type'], $filters['origin_id'], $request->user());
+            $query->whereExists(fn ($q) => $q->selectRaw('1')->from('partnership_origins')->whereColumn('partnership_id', 'p.id')->where('type', $filters['origin_type'])->where('target_id', $filters['origin_id']));
+        }
+        if (! empty($filters['territory_id'])) {
+            abort_unless(app(InvestmentGeography::class)->publicReferences()->where('id', $filters['territory_id'])->exists(), 422);
+            $ids = app(InvestmentGeography::class)->descendants($filters['territory_id']);
+            $investmentIds = app(InvestmentCatalogue::class)->query(['geo_location_id' => $filters['territory_id']])->pluck('id')->map(fn ($id) => (string) $id)->all();
+            $query->where(fn ($q) => $q->whereExists(fn ($places) => $places->selectRaw('1')->from('partnership_locations')->whereColumn('partnership_id', 'p.id')->whereIn('geo_location_id', $ids))
+                ->orWhereExists(fn ($origins) => $origins->selectRaw('1')->from('partnership_origins as origin')->join('project_locations as pl', DB::raw('pl.project_id::text'), '=', 'origin.target_id')
+                    ->whereColumn('origin.partnership_id', 'p.id')->where('origin.type', 'project')->whereNull('pl.deleted_at')->where('pl.data_classification', 'public')->whereIn('pl.geo_location_id', $ids))
+                ->orWhereExists(fn ($origins) => $origins->selectRaw('1')->from('partnership_origins')->whereColumn('partnership_id', 'p.id')->where('type', 'investment')->whereIn('target_id', $investmentIds))
+                ->orWhereExists(fn ($members) => $members->selectRaw('1')->from('partnership_origins as origin')
+                    ->joinSub(app(InvestmentRelations::class)->memberships()->select(['cp.cluster_id', 'cp.project_id']), 'member', DB::raw('member.cluster_id::text'), '=', 'origin.target_id')
+                    ->join('project_locations as pl', 'pl.project_id', '=', 'member.project_id')->whereColumn('origin.partnership_id', 'p.id')->where('origin.type', 'cluster')
+                    ->whereNull('pl.deleted_at')->where('pl.data_classification', 'public')->whereIn('pl.geo_location_id', $ids))
+                ->orWhereExists(fn ($zones) => $zones->selectRaw('1')->from('partnership_origins as origin')->join('investment_zone_locations as zl', DB::raw('zl.zone_id::text'), '=', 'origin.target_id')
+                    ->join('investment_zones as zone', 'zone.id', '=', 'zl.zone_id')->whereColumn('origin.partnership_id', 'p.id')->where('origin.type', 'zone')->where('zone.publication_status', 'published')
+                    ->whereNull('zone.deleted_at')->where('zl.validation_status', 'validated')->whereIn('zl.geo_location_id', $ids)));
+        }
+        $results = $query->orderByDesc('p.id')->select(['p.id', 'p.title', 'p.sector', 'p.province', 'p.kind', 'p.partnership_type', 'p.sector_id', 'p.deadline', 'p.published_at'])
+            ->selectRaw("p.payload->>'summary' as summary")->paginate(12)->withQueryString();
+        if ($request->expectsJson()) {
+            return response()->json($results);
+        }
+
+        $mapPoints = [];
+        foreach ($results as $partnership) {
+            $locations = app(InvestmentRelations::class)->locations(array_values(DB::table('partnership_locations')->where('partnership_id', $partnership->id)->get()
+                ->map(fn ($location) => ['id' => $location->geo_location_id, 'role' => $location->role, 'source_reference' => $location->source_reference])->all()));
+            foreach ($locations as $location) {
+                if ($location['location_type'] !== 'site') {
+                    continue;
+                }
+                foreach ($location['coordinates'] as $coordinate) {
+                    $mapPoints[] = ['geometry' => $coordinate['geometry'], 'properties' => ['id' => count($mapPoints), 'title' => $partnership->title,
+                        'location' => $location['name'].' · '.$location['role'].' · '.$location['source_reference'], 'url' => '/parcerias/'.$partnership->id]];
+                }
+            }
+            foreach (app(PartnershipSources::class)->forPartnership($partnership->id) as $source) {
+                $context = $source['geography']['locations'] ?? [];
+                foreach ($source['geography']['members'] ?? [] as $member) {
+                    $context = [...$context, ...$member['locations']];
+                }
+                foreach ($context as $location) {
+                    foreach ($location['coordinates'] as $coordinate) {
+                        $mapPoints[] = ['geometry' => $coordinate['geometry'], 'properties' => ['id' => count($mapPoints), 'title' => $partnership->title,
+                            'location' => 'Contexto da origem: '.$location['name'].'; implantação da parceria não confirmada', 'url' => '/parcerias/'.$partnership->id]];
+                    }
+                }
+            }
+        }
+
+        return Inertia::render('partnerships/catalogue', ['results' => $results, 'filters' => $filters, 'mapPoints' => $mapPoints, ...$this->catalogues($request)]);
+    }
+
+    public function dashboard(Request $request): Response
+    {
+        $actor = $request->user();
+        $organizations = DB::table('memberships')->where('user_id', $actor->id)->whereNull('deleted_at')->pluck('organization_id');
+        $mine = DB::table('portal_partnerships')->where(fn ($q) => $q->where(fn ($own) => $own->where('user_id', $actor->id)->whereNull('organization_id'))->orWhereIn('organization_id', $organizations))->latest()->limit(100)->get();
+        $interests = DB::table('partnership_interests as i')->join('portal_partnerships as p', 'p.id', '=', 'i.partnership_id')
+            ->leftJoin('partnership_rooms as room', 'room.interest_id', '=', 'i.id')
+            ->where(fn ($q) => $q->where(fn ($own) => $own->where('i.user_id', $actor->id)->whereNull('i.organization_id'))->orWhereIn('i.organization_id', $organizations))
+            ->select(['i.id', 'i.partnership_id', 'i.status', 'i.decision_reason', 'p.title', 'room.id as room_id'])->orderByDesc('i.id')->limit(100)->get();
+        $moderation = Gate::forUser($actor)->allows('manage-portal') ? DB::table('portal_partnerships')->whereIn('status', ['submitted', 'pending'])->orderBy('updated_at')->get(['id', 'title', 'status', 'version']) : [];
+
+        return Inertia::render('partnerships/dashboard', ['mine' => $mine->map(fn ($p) => ['id' => $p->id, 'title' => $p->title, 'status' => $p->status, 'version' => $p->version]), 'interests' => $interests, 'moderation' => $moderation,
+            'notifications' => DB::table('partnership_notifications')->where('user_id', $actor->id)->orderByDesc('id')->limit(50)->get()]);
+    }
+
+    public function edit(Request $request, ?int $id = null): Response
+    {
+        $record = $id ? app(PartnershipExchange::class)->find($id) : null;
+        abort_if($record && ! app(PartnershipExchange::class)->owns($request->user(), $record), 403);
+        $origins = $record ? DB::table('partnership_origins')->where('partnership_id', $id)->get() : [];
+        if (! $record && $request->filled('origin_type') && $request->filled('origin_id')) {
+            $source = app(PartnershipSources::class)->resolve($request->string('origin_type')->toString(), $request->string('origin_id')->toString(), $request->user());
+            $origins = [['type' => $source['type'], 'target_id' => $source['target_id']]];
+        }
+
+        return Inertia::render('partnerships/editor', ['record' => $record ? [...(array) $record, 'payload' => json_decode($record->payload, true)] : null, 'origins' => $origins,
+            'locations' => $record ? DB::table('partnership_locations')->where('partnership_id', $id)->get() : [], ...$this->catalogues($request)]);
+    }
+
+    public function save(Request $request, ?int $id = null): RedirectResponse|JsonResponse
+    {
+        $record = app(PartnershipExchange::class)->save($request->user(), $request->all(), $id);
+
+        return $request->expectsJson() ? response()->json(['id' => $record->id, 'version' => $record->version, 'status' => $record->status]) : redirect('/parcerias/'.$record->id.'/editar')->with('success', 'Rascunho guardado.');
+    }
+
+    public function show(Request $request, int $id): Response|JsonResponse
+    {
+        $record = app(PartnershipExchange::class)->find($id);
+        $owner = $request->user() && app(PartnershipExchange::class)->owns($request->user(), $record, false);
+        $moderator = $request->user() && Gate::forUser($request->user())->allows('manage-portal');
+        abort_unless($record->status === 'published' || $owner || $moderator, 404);
+        $payload = json_decode($record->payload, true);
+        unset($payload['_creation_hash']);
+        $privateDetails = ($payload['confidentiality'] ?? 'public') === 'private' && ! $owner && ! $moderator;
+        $mine = $request->user() ? DB::table('partnership_interests')->where('partnership_id', $id)->get()->filter(fn ($i) => app(PartnershipExchange::class)->owns($request->user(), $i, false))->values() : collect();
+        $interests = $owner ? DB::table('partnership_interests')->where('partnership_id', $id)->orderBy('id')->get() : $mine;
+        $interestData = $interests->map(function ($interest) use ($record) {
+            return [...(array) $interest, 'payload' => json_decode($interest->payload, true), 'assessment' => json_decode($interest->assessment, true),
+                'match' => app(PartnershipMatching::class)->explain($record, $interest), 'room_id' => DB::table('partnership_rooms')->where('interest_id', $interest->id)->value('id')];
+        });
+        $props = ['record' => ['id' => $record->id, 'title' => $record->title, 'status' => $record->status, 'version' => $record->version, 'kind' => $record->kind,
+            'partnership_type' => $record->partnership_type, 'sector' => $record->sector, 'province' => $record->province, 'sector_id' => $record->sector_id, 'deadline' => $record->deadline,
+            'offer' => $privateDetails ? null : $record->offer, 'seeking' => $privateDetails ? null : $record->seeking, 'payload' => $privateDetails ? ['summary' => $payload['summary'] ?? '', 'confidentiality' => 'private'] : $payload],
+            'owner' => (bool) $owner, 'canEdit' => $request->user() && app(PartnershipExchange::class)->owns($request->user(), $record), 'moderator' => (bool) $moderator,
+            'origins' => app(PartnershipSources::class)->forPartnership($id, $owner ? $request->user() : null), 'interests' => $interestData,
+            'locations' => app(InvestmentRelations::class)->locations(array_values(DB::table('partnership_locations')->where('partnership_id', $id)->get()->map(fn ($l) => ['id' => $l->geo_location_id, 'role' => $l->role, 'source_reference' => $l->source_reference])->all())),
+            'history' => ($owner || $moderator) ? DB::table('partnership_events')->where('partnership_id', $id)->where('event_type', 'like', 'partnership_opportunity.%')->orderBy('occurred_at')->get(['event_type', 'actor_id', 'occurred_at', 'payload']) : [],
+            ...$this->catalogues($request)];
+        if ($request->user()) {
+            Inertia::encryptHistory();
+        }
+
+        return $request->expectsJson() ? response()->json($props)->header('Cache-Control', 'private, no-store') : Inertia::render('partnerships/detail', $props);
+    }
+
+    public function transition(Request $request, int $id): RedirectResponse|JsonResponse
+    {
+        $data = $request->validate(['version' => 'required|integer|min:1', 'action' => 'required|string', 'reason' => 'required|string|max:2000']);
+        $record = app(PartnershipExchange::class)->transition($request->user(), $id, $data['version'], $data['action'], $data['reason']);
+
+        return $request->expectsJson() ? response()->json(['status' => $record->status, 'version' => $record->version]) : back()->with('success', 'Decisão registada.');
+    }
+
+    public function interest(Request $request, int $id): RedirectResponse|JsonResponse
+    {
+        $interest = app(PartnershipExchange::class)->interest($request->user(), $id, $request->all());
+
+        return $request->expectsJson() ? response()->json(['id' => $interest->id, 'version' => $interest->version]) : back()->with('success', 'Interesse guardado.');
+    }
+
+    public function decide(Request $request, int $id): RedirectResponse|JsonResponse
+    {
+        $data = $request->validate(['version' => 'required|integer|min:1', 'action' => 'required|string', 'reason' => 'required|string|max:2000', 'assessment' => 'array|max:7']);
+        $interest = app(PartnershipExchange::class)->decideInterest($request->user(), $id, $data['version'], $data['action'], $data['reason'], $data['assessment'] ?? []);
+
+        return $request->expectsJson() ? response()->json(['status' => $interest->status, 'version' => $interest->version]) : back()->with('success', 'Candidatura atualizada.');
+    }
+
+    public function room(Request $request, int $id): Response|JsonResponse
+    {
+        $context = app(PartnershipExchange::class)->room($request->user(), $id);
+        $props = [...$context, 'room' => [...(array) $context['room'], 'agreement' => $context['room']->agreement ? json_decode($context['room']->agreement, true) : null],
+            'messages' => DB::table('partnership_messages as m')->join('users as u', 'u.id', '=', 'm.author_id')->where('room_id', $id)->orderBy('m.id')->get(['m.id', 'm.body', 'm.created_at', 'm.author_id', 'u.name']),
+            'documents' => DB::table('partnership_documents as link')->join('documents as d', 'd.id', '=', 'link.document_id')->where('room_id', $id)
+                ->where(fn ($q) => $q->where('link.shared', true)->orWhere('link.owner_id', $request->user()->id))
+                ->get(['link.id', 'link.shared', 'link.owner_id', 'd.file_name', 'd.status', 'd.malware_scan_status', 'd.id as document_id']),
+            'milestones' => DB::table('partnership_milestones')->where('room_id', $id)->orderBy('id')->get(),
+            'canWrite' => app(PartnershipExchange::class)->owns($request->user(), $context['partnership']) || app(PartnershipExchange::class)->owns($request->user(), $context['interest'])];
+
+        return $request->expectsJson() ? response()->json($props) : Inertia::render('partnerships/room', $props);
+    }
+
+    public function message(Request $request, int $id): RedirectResponse|JsonResponse
+    {
+        $data = $request->validate(['client_key' => 'required|uuid', 'body' => 'required|string|max:15000']);
+        DB::transaction(function () use ($request, $id, $data) {
+            $context = app(PartnershipExchange::class)->room($request->user(), $id, true);
+            $locked = DB::table('partnership_rooms')->where('id', $id)->lockForUpdate()->first();
+            abort_unless($locked !== null && ! in_array($locked->status, ['closed', 'cancelled'], true), 409, 'Sala encerrada.');
+            $key = ['room_id' => $id, 'author_id' => $request->user()->id, 'client_key' => $data['client_key']];
+            $existing = DB::table('partnership_messages')->where($key)->first();
+            if ($existing) {
+                abort_unless($existing->body === $data['body'], 409, 'Chave já utilizada com outro conteúdo.');
+
+                return;
+            }
+            DB::table('partnership_messages')->insert([...$key, 'body' => $data['body']]);
+            app(PartnershipExchange::class)->event($context['partnership'], $request->user(), 'partnership.message_created.v1', ['room_id' => $id], 'Nova mensagem privada', [$context['partnership']->user_id, $context['interest']->user_id]);
+        });
+
+        return $request->expectsJson() ? response()->json(['sent' => true]) : back()->with('success', 'Mensagem registada.');
+    }
+
+    public function agreement(Request $request, int $id): RedirectResponse|JsonResponse
+    {
+        $data = $request->validate(['version' => 'required|integer|min:1', 'action' => 'required|in:record,confirm,start,complete,cancel,renew', 'title' => 'required_if:action,record|nullable|string|max:200',
+            'terms' => 'required_if:action,record|nullable|string|max:20000', 'reason' => 'required|string|max:2000']);
+        DB::transaction(function () use ($request, $id, $data) {
+            $context = app(PartnershipExchange::class)->room($request->user(), $id, true);
+            $room = DB::table('partnership_rooms')->where('id', $id)->lockForUpdate()->first();
+            abort_unless((int) $room->version === (int) $data['version'], 409, 'Acordo alterado.');
+            $agreement = $room->agreement ? json_decode($room->agreement, true) : null;
+            $status = $room->status;
+            if ($data['action'] === 'record') {
+                abort_unless(in_array($status, ['negotiation', 'agreement_recorded'], true), 409);
+                $previous = $agreement['previous_versions'] ?? [];
+                if ($agreement) {
+                    $previous[] = ['title' => $agreement['title'], 'terms' => $agreement['terms'], 'confirmations' => $agreement['confirmations'], 'recorded_at' => $agreement['recorded_at']];
+                }
+                $agreement = ['title' => $data['title'], 'terms' => $data['terms'], 'recorded_by' => $request->user()->id, 'recorded_at' => now()->toIso8601String(), 'confirmations' => [],
+                    'parties' => [$context['partnership']->user_id, $context['interest']->user_id], 'legal_signature_status' => 'not_verified', 'previous_versions' => $previous];
+                $status = 'agreement_recorded';
+            } elseif ($data['action'] === 'confirm') {
+                abort_unless($status === 'agreement_recorded' && $agreement, 409);
+                $party = app(PartnershipExchange::class)->owns($request->user(), $context['partnership']) ? 'proponent' : 'candidate';
+                $agreement['confirmations'][$party] = ['actor_id' => $request->user()->id, 'date' => now()->toIso8601String(), 'reason' => $data['reason']];
+                if (count($agreement['confirmations']) === 2) {
+                    $status = 'agreed';
+                }
+            } else {
+                $allowed = ['start' => ['agreed'], 'complete' => ['execution'], 'cancel' => ['negotiation', 'agreement_recorded', 'agreed', 'execution'], 'renew' => ['agreed', 'execution']];
+                abort_unless(in_array($status, $allowed[$data['action']] ?? [], true), 409);
+                if ($data['action'] === 'complete') {
+                    abort_if(DB::table('partnership_milestones')->where('room_id', $id)->where('status', '!=', 'completed')->exists(), 409, 'Existem marcos pendentes.');
+                }
+                $status = ['start' => 'execution', 'complete' => 'closed', 'cancel' => 'cancelled', 'renew' => 'negotiation'][$data['action']];
+                if ($data['action'] === 'renew') {
+                    $agreement['previous_versions'][] = ['title' => $agreement['title'], 'terms' => $agreement['terms'], 'confirmations' => $agreement['confirmations']];
+                    $agreement['confirmations'] = [];
+                }
+            }
+            DB::table('partnership_rooms')->where('id', $id)->update(['agreement' => $agreement ? json_encode($agreement) : null, 'status' => $status, 'version' => $room->version + 1, 'updated_at' => now()]);
+            app(PartnershipExchange::class)->event($context['partnership'], $request->user(), 'partnership_agreement.changed.v1', ['room_id' => $id, 'status' => $status, 'version' => $room->version + 1, 'reason' => $data['reason']], 'Acordo: '.$status, [$context['partnership']->user_id, $context['interest']->user_id]);
+        });
+
+        return $request->expectsJson() ? response()->json(['recorded' => true]) : back()->with('success', 'Acordo atualizado; assinatura jurídica não verificada.');
+    }
+
+    public function milestone(Request $request, int $id, ?int $milestone = null): RedirectResponse|JsonResponse
+    {
+        $data = $request->validate(['title' => 'required|string|max:200', 'responsible_id' => 'required|integer', 'due_date' => 'nullable|date_format:Y-m-d', 'status' => 'required|in:pending,progress,completed',
+            'evidence' => 'required_if:status,completed|nullable|string|max:10000', 'version' => ($milestone ? 'required' : 'nullable').'|integer|min:1']);
+        DB::transaction(function () use ($request, $id, $milestone, $data) {
+            $context = app(PartnershipExchange::class)->room($request->user(), $id, true);
+            $locked = DB::table('partnership_rooms')->where('id', $id)->lockForUpdate()->first();
+            abort_unless($locked !== null && in_array($locked->status, ['agreement_recorded', 'agreed', 'execution'], true), 409);
+            $responsible = User::query()->whereKey($data['responsible_id'])->first();
+            abort_unless($responsible !== null && (app(PartnershipExchange::class)->owns($responsible, $context['partnership']) || app(PartnershipExchange::class)->owns($responsible, $context['interest'])), 422, 'Responsável deve ser participante identificado.');
+            if ($milestone) {
+                $existing = DB::table('partnership_milestones')->where('room_id', $id)->where('id', $milestone)->lockForUpdate()->first();
+                abort_unless($existing !== null, 404);
+                abort_unless((int) $existing->version === (int) $data['version'], 409);
+                DB::table('partnership_milestones')->where('id', $milestone)->update([...$data, 'version' => $existing->version + 1, 'updated_at' => now()]);
+            } else {
+                unset($data['version']);
+                $milestone = DB::table('partnership_milestones')->insertGetId([...$data, 'room_id' => $id, 'created_at' => now(), 'updated_at' => now()]);
+            }
+            app(PartnershipExchange::class)->event($context['partnership'], $request->user(), 'partnership_milestone.changed.v1', ['milestone_id' => $milestone, 'status' => $data['status']], 'Marco atualizado', [$context['partnership']->user_id, $context['interest']->user_id]);
+        });
+
+        return $request->expectsJson() ? response()->json(['saved' => true]) : back()->with('success', 'Marco guardado.');
+    }
+
+    public function upload(Request $request, int $id): RedirectResponse|JsonResponse
+    {
+        $data = $request->validate(['file' => 'required|file|mimes:pdf,jpg,jpeg,png|max:10240', 'shared' => 'required|boolean']);
+        $context = app(PartnershipExchange::class)->room($request->user(), $id, true);
+        $file = $request->file('file');
+        $documentId = (string) Str::uuid();
+        $stored = $file->storeAs('partnerships/'.$id, $documentId, 'local');
+        abort_unless(is_string($stored) && $stored !== '', 503);
+        try {
+            DB::transaction(function () use ($request, $id, $data, $file, $documentId, $stored, $context) {
+                app(PartnershipExchange::class)->room($request->user(), $id, true);
+                $locked = DB::table('partnership_rooms')->where('id', $id)->lockForUpdate()->first();
+                abort_unless($locked !== null && ! in_array($locked->status, ['closed', 'cancelled'], true), 409);
+                DB::table('documents')->insert(['id' => $documentId, 'source_system' => 'partnership-exchange', 'data_classification' => 'restricted',
+                    'file_name' => basename($file->getClientOriginalName()), 'media_type' => $file->getMimeType(), 'storage_key' => $stored,
+                    'sha256' => hash_file('sha256', Storage::disk('local')->path($stored)), 'status' => 'quarantined']);
+                DB::table('partnership_documents')->insert(['room_id' => $id, 'document_id' => $documentId, 'owner_id' => $request->user()->id, 'shared' => $data['shared']]);
+                app(PartnershipExchange::class)->event($context['partnership'], $request->user(), 'partnership.document_added.v1', ['room_id' => $id, 'document_id' => $documentId, 'shared' => $data['shared']], 'Documento privado anexado');
+            });
+        } catch (\Throwable $e) {
+            Storage::disk('local')->delete($stored);
+            throw $e;
+        }
+        ScanDocumentForMalware::dispatch($documentId)->afterCommit();
+
+        return $request->expectsJson() ? response()->json(['uploaded' => true]) : back()->with('success', 'Documento privado guardado; análise antimalware pendente.');
+    }
+
+    public function download(Request $request, int $id, int $attachment): BinaryFileResponse
+    {
+        $context = app(PartnershipExchange::class)->room($request->user(), $id);
+        $document = DB::table('partnership_documents as link')->join('documents as d', 'd.id', '=', 'link.document_id')->where('link.room_id', $id)->where('link.id', $attachment)
+            ->where(fn ($q) => $q->where('link.shared', true)->orWhere('link.owner_id', $request->user()->id))->where('d.status', 'active')->whereNull('d.deleted_at')
+            ->where('d.malware_scan_status', 'clean')->whereColumn('d.malware_scanned_sha256', 'd.sha256')->first(['d.storage_key', 'd.file_name', 'd.sha256']);
+        abort_unless($document !== null, 404);
+        $root = realpath(Storage::disk('local')->path(''));
+        $path = realpath(Storage::disk('local')->path($document->storage_key));
+        abort_unless($root && $path && str_starts_with($path, $root.DIRECTORY_SEPARATOR) && is_file($path), 404);
+        $checksum = hash_file('sha256', $path);
+        abort_unless(is_string($checksum) && hash_equals($document->sha256, $checksum), 404);
+        app(PartnershipExchange::class)->event($context['partnership'], $request->user(), 'partnership.document_accessed.v1', ['room_id' => $id, 'attachment_id' => $attachment], 'Documento consultado');
+
+        return response()->download($path, basename($document->file_name), ['Cache-Control' => 'private, no-store', 'X-Content-Type-Options' => 'nosniff']);
+    }
+
+    public function share(Request $request, int $id, int $attachment): RedirectResponse|JsonResponse
+    {
+        $data = $request->validate(['shared' => 'required|boolean']);
+        DB::transaction(function () use ($request, $id, $attachment, $data) {
+            $context = app(PartnershipExchange::class)->room($request->user(), $id, (bool) $data['shared']);
+            $link = DB::table('partnership_documents')->where('room_id', $id)->where('id', $attachment)->lockForUpdate()->first();
+            abort_unless($link !== null && (int) $link->owner_id === $request->user()->id, 403, 'Só o autor pode autorizar ou retirar a partilha.');
+            DB::table('partnership_documents')->where('id', $attachment)->update(['shared' => $data['shared']]);
+            app(PartnershipExchange::class)->event($context['partnership'], $request->user(), 'partnership.document_sharing_changed.v1', ['room_id' => $id, 'attachment_id' => $attachment, 'shared' => $data['shared']], 'Autorização documental atualizada');
+        });
+
+        return $request->expectsJson() ? response()->json(['saved' => true]) : back()->with('success', 'Autorização de partilha atualizada.');
+    }
+
+    public function notification(Request $request, int $id): RedirectResponse
+    {
+        abort_unless(DB::table('partnership_notifications')->where('id', $id)->where('user_id', $request->user()->id)->update(['read_at' => now()]) > 0, 404);
+
+        return back();
+    }
+
+    /** @return array<string,mixed> */
+    private function catalogues(Request $request): array
+    {
+        $sources = [];
+        foreach (InvestmentPortfolioController::visible()->where(fn ($q) => $q->whereNotNull('project_id')->orWhereNotNull('cluster_id'))->get(['id', 'title', 'project_id', 'cluster_id']) as $dossier) {
+            $sources[] = ['type' => $dossier->project_id ? 'project' : 'cluster', 'target_id' => $dossier->project_id ?? $dossier->cluster_id, 'title' => $dossier->title, 'href' => '/carteira/'.$dossier->id];
+        }
+        foreach (DB::table('opportunities')->where('status', 'published')->whereNotNull('published_at')->get(['id', 'title', 'slug']) as $investment) {
+            $sources[] = ['type' => 'investment', 'target_id' => (string) $investment->id, 'title' => $investment->title, 'href' => '/oportunidades/'.$investment->slug];
+        }
+        foreach (DB::table('investment_zones')->where('publication_status', 'published')->whereNull('deleted_at')->get(['id', 'name']) as $zone) {
+            $sources[] = ['type' => 'zone', 'target_id' => $zone->id, 'title' => $zone->name, 'href' => '/zonas/'.$zone->id];
+        }
+        foreach (ExistingBusiness::query()->published()->get(['id', 'public_title', 'public_slug']) as $business) {
+            $sources[] = ['type' => 'business', 'target_id' => $business->id, 'title' => $business->public_title, 'href' => '/negocios/'.$business->public_slug];
+        }
+        if ($request->user()) {
+            foreach (DB::table('investment_company_declarations')->where('user_id', $request->user()->id)->get(['id']) as $company) {
+                $sources[] = ['type' => 'company', 'target_id' => $company->id, 'title' => 'Declaração empresarial existente', 'href' => '/investidor/profile'];
+            }
+            foreach (DB::table('simulation_form_drafts')->where('owner_user_id', $request->user()->id)->whereNull('deleted_at')->get(['id', 'created_at']) as $draft) {
+                $sources[] = ['type' => 'simulation', 'target_id' => $draft->id, 'title' => 'Ficha de projeto · '.$draft->created_at, 'href' => '/simulador-fiscal?draft='.$draft->id];
+            }
+        }
+
+        return ['types' => config('partnerships.types'), 'criteria' => config('partnerships.criteria'), 'sources' => $sources, 'sectors' => DB::table('sectors')->where('is_active', true)->whereNull('deleted_at')->orderBy('name')->get(['id', 'name']),
+            'territories' => app(InvestmentGeography::class)->publicReferences()->orderBy('name')->get(['id', 'name', 'location_type', 'parent_id']),
+            'organizations' => $request->user() ? DB::table('memberships as m')->join('organizations as o', 'o.id', '=', 'm.organization_id')->where('m.user_id', $request->user()->id)
+                ->whereNull('m.deleted_at')->whereNull('o.deleted_at')->whereIn('m.role', ['admin', 'manager', 'officer'])->get(['o.id', 'o.name']) : []];
+    }
+}

app/Http/Controllers/PartnershipInstallationController.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Services\PartnershipInstallation;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Inertia\Inertia;
+use Inertia\Response;
+
+class PartnershipInstallationController extends Controller
+{
+    public function preview(PartnershipInstallation $installation): Response
+    {
+        return Inertia::render('partnerships/installation', $installation->preview());
+    }
+
+    public function apply(Request $request, PartnershipInstallation $installation): RedirectResponse
+    {
+        $data = $request->validate(['hash' => 'required|string|size:64']);
+        $installation->apply($data['hash'], $request->user());
+
+        return back()->with('success', 'Bolsa de Parcerias instalada. Registos antigos preservados.');
+    }
+}

app/Http/Controllers/PortalServicesController.php

@@ -11,6 +11,7 @@ use App\Services\Malware\MalwareScanner;
 use Illuminate\Database\Query\Builder;
 use Illuminate\Database\QueryException;
 use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Schema;
@@ -46,9 +47,12 @@ class PortalServicesController extends Controller
             ->where('d.malware_scan_status', 'clean')->whereColumn('d.malware_scanned_sha256', 'd.sha256');
     }
 
-    public function page(Request $request): Response
+    public function page(Request $request): Response|JsonResponse
     {
         $page = $request->route()->defaults['page'];
+        if ($page === 'partnerships' && Schema::hasColumn('portal_partnerships', 'partnership_type')) {
+            return app(PartnershipExchangeController::class)->index($request);
+        }
         $filters = $request->validate([
             'q' => ['nullable', 'string', 'max:120'], 'category' => ['nullable', 'string', 'max:80'],
             'topic' => ['nullable', 'string', 'max:80'], 'sector' => ['nullable', 'string', 'max:150'], 'province' => ['nullable', 'string', 'max:100'],
@@ -477,6 +481,9 @@ class PortalServicesController extends Controller
 
     public function moderate(Request $request, string $type, int $id): RedirectResponse
     {
+        if ($type === 'partnerships' && Schema::hasColumn('portal_partnerships', 'partnership_type')) {
+            return redirect('/parcerias/'.$id)->with('success', 'Reveja a proposta e registe uma decisão fundamentada na ficha da Bolsa.');
+        }
         $data = $this->validateManagement($request, ['published' => ['required', 'boolean']]);
         $table = $type === 'resources' ? 'portal_resources' : 'portal_partnerships';
         DB::transaction(function () use ($request, $data, $table, $type, $id) {

app/Http/Controllers/VirtualDeskController.php

@@ -0,0 +1,227 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Jobs\ScanDocumentForMalware;
+use App\Models\User;
+use App\Services\VirtualDesk;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Str;
+use Inertia\Inertia;
+
+class VirtualDeskController extends Controller
+{
+    public function catalogue(Request $request, VirtualDesk $desk)
+    {
+        $filters = $request->validate(['q' => 'nullable|string|max:120', 'theme' => 'nullable|string|max:80', 'profile' => 'nullable|string|max:100']);
+        $installed = $desk->installed();
+        $services = $installed ? DB::table('desk_service_versions')->where('status', 'published')->orderBy('code')->orderByDesc('version')->get()->unique('code')->map(fn ($s) => ['id' => $s->id, 'version' => $s->version, 'definition' => json_decode($s->definition, true), 'source' => json_decode($s->source, true)])->values() : collect();
+        $services = $services->filter(fn ($s) => (! ($filters['q'] ?? '') || str_contains(mb_strtolower(json_encode($s['definition'], JSON_UNESCAPED_UNICODE)), mb_strtolower($filters['q'])))
+            && (! ($filters['theme'] ?? '') || $s['definition']['theme'] === $filters['theme']) && (! ($filters['profile'] ?? '') || $s['definition']['profile'] === $filters['profile']))->values();
+        $page = max(1, (int) $request->query('page', 1));
+        $data = ['installed' => $installed, 'services' => $services->slice(($page - 1) * 12, 12)->values(), 'total' => $services->count(), 'page' => $page, 'filters' => $filters,
+            'prepared' => $installed ? [] : config('virtual-desk.services'), 'source' => config('virtual-desk.source'), 'authenticated' => (bool) $request->user(), 'support' => config('portal.support')];
+        return $request->expectsJson() ? response()->json($data) : Inertia::render('desk/catalogue', $data);
+    }
+
+    public function panel(Request $request, VirtualDesk $desk)
+    {
+        $actor = $request->user();
+        $organizations = DB::table('memberships')->where('user_id', $actor->id)->whereNull('deleted_at')->pluck('organization_id');
+        $cases = DB::table('desk_cases')->where(fn ($q) => $q->where(fn ($p) => $p->where('user_id', $actor->id)->whereNull('organization_id'))->orWhereIn('organization_id', $organizations))->orderByDesc('updated_at')->get(['id', 'title', 'version', 'updated_at']);
+        $queue = DB::table('desk_requests as r')->join('desk_cases as c', 'c.id', '=', 'r.case_id')->whereNotIn('r.status', ['draft', 'cancelled'])->when(! $actor->can('manage-portal'), fn ($q) => $q->where('r.analyst_id', $actor->id))
+            ->orderByRaw('r.due_at ASC NULLS LAST')->get(['r.id', 'r.protocol', 'r.status', 'r.version', 'r.analyst_id', 'r.due_at', 'c.title']);
+        $data = ['cases' => $cases, 'queue' => $queue, 'notifications' => DB::table('desk_notifications')->where('user_id', $actor->id)->orderByDesc('id')->limit(100)->get(),
+            'legacyRequests' => DB::table('interest_requests')->where('metadata->portal_user_id', $actor->id)->orderByDesc('created_at')->get(['reference', 'status', 'created_at']),
+            'companies' => DB::table('investment_company_declarations')->where('user_id', $actor->id)->get(['id', 'payload'])->map(fn ($c) => ['id' => $c->id, 'name' => $desk->decode($c->payload)['name'] ?? 'Declaração empresarial']),
+            'submissions' => DB::table('investment_submissions')->where('user_id', $actor->id)->get(['id', 'status']),
+            'organizations' => DB::table('organizations')->whereIn('id', $organizations)->get(['id', 'name']), 'manager' => $actor->can('manage-portal'), 'states' => config('virtual-desk.request_states')];
+        return $request->expectsJson() ? response()->json($data) : Inertia::render('desk/panel', $data);
+    }
+
+    public function createCase(Request $request, VirtualDesk $desk)
+    {
+        $case = $desk->createCase($request->user(), $request->all());
+        return $request->expectsJson() ? response()->json(['id' => $case->id, 'version' => $case->version], 201) : redirect('/balcao-virtual/dossiers/'.$case->id);
+    }
+
+    public function showCase(Request $request, string $id, VirtualDesk $desk)
+    {
+        $case = $desk->case($request->user(), $id); $owner = $desk->owns($request->user(), $case, false);
+        $this->auditRead($request, 'desk_cases', $id);
+        $data = ['case' => [...(array) $case, 'payload' => \Illuminate\Support\Arr::except($desk->decode($case->payload), ['_creation_hash']), 'workflow' => json_decode($case->workflow, true)],
+            'owner' => $owner, 'canWrite' => $desk->owns($request->user(), $case), 'manager' => $request->user()->can('manage-portal'),
+            'requests' => DB::table('desk_requests')->where('case_id', $id)->when(! $owner && ! $request->user()->can('manage-portal'), fn ($q) => $q->where('analyst_id', $request->user()->id))->orderByDesc('updated_at')->get(['id', 'status', 'protocol', 'service_version_id', 'version']),
+            'services' => DB::table('desk_service_versions')->where('status', 'published')->orderByDesc('version')->get(['id', 'code', 'version', 'definition'])->unique('code')->values()->map(fn ($s) => ['id' => $s->id, 'title' => json_decode($s->definition, true)['title'], 'version' => $s->version]),
+            'documents' => $this->documents($id), 'events' => $this->events($id, $desk), 'stepStates' => config('virtual-desk.step_states'), 'states' => config('virtual-desk.request_states'),
+            'links' => DB::table('desk_institutional_links')->where('status', 'active')->whereNotNull('verified_at')->get(['id', 'stage', 'entity', 'purpose', 'contact', 'verified_at']), 'source' => config('virtual-desk.source')];
+        return $request->expectsJson() ? response()->json($data) : Inertia::render('desk/case', $data);
+    }
+
+    private function documents(string $case)
+    {
+        return DB::table('desk_documents as l')->join('documents as d', 'd.id', '=', 'l.document_id')->where('l.case_id', $case)->whereNull('d.deleted_at')
+            ->get(['l.id', 'l.document_id', 'l.request_id', 'l.category', 'l.stage', 'l.source_reference', 'l.valid_until', 'd.file_name', 'd.status', 'd.malware_scan_status', 'd.sha256']);
+    }
+
+    private function events(string $case, VirtualDesk $desk)
+    {
+        return DB::table('desk_events as e')->join('users as u', 'u.id', '=', 'e.actor_id')->where('e.case_id', $case)->orderBy('e.created_at')->get(['e.id', 'e.request_id', 'e.action', 'e.payload', 'e.version', 'e.created_at', 'u.name'])->map(fn ($e) => [...(array) $e, 'payload' => $desk->decode($e->payload)]);
+    }
+
+    public function stage(Request $request, string $id, VirtualDesk $desk)
+    {
+        $case = $desk->stage($request->user(), $id, $request->all());
+        return $request->expectsJson() ? response()->json(['version' => $case->version]) : back()->with('success', 'Etapa e evidência registadas.');
+    }
+
+    public function createRequest(Request $request, string $id, VirtualDesk $desk)
+    {
+        $data = $request->validate(['service_version_id' => 'required|uuid', 'client_key' => 'required|uuid']);
+        $row = $desk->createRequest($request->user(), $id, $data['service_version_id'], $data['client_key']);
+        return $request->expectsJson() ? response()->json(['id' => $row->id, 'version' => $row->version], 201) : redirect('/balcao-virtual/pedidos/'.$row->id);
+    }
+
+    public function showRequest(Request $request, string $id, VirtualDesk $desk)
+    {
+        $row = $desk->request($request->user(), $id); $case = $desk->case($request->user(), $row->case_id); $payload = $desk->decode($row->payload);
+        $this->auditRead($request, 'desk_requests', $id);
+        $data = ['request' => [...(array) $row, 'payload' => $payload, 'submitted_snapshot' => $desk->decode($row->submitted_snapshot), 'editable_fields' => json_decode($row->editable_fields ?? '[]', true)],
+            'case' => ['id' => $case->id, 'title' => $case->title], 'definition' => $desk->definition($row),
+            'serviceSource' => json_decode(DB::table('desk_service_versions')->where('id', $row->service_version_id)->value('source'), true),
+            'owner' => $desk->owns($request->user(), $case), 'manager' => $request->user()->can('manage-portal'), 'analyst' => (int) $row->analyst_id === $request->user()->id,
+            'fieldsEditable' => in_array($row->status, ['draft', 'returned'], true), 'states' => config('virtual-desk.request_states'), 'transitions' => config('virtual-desk.transitions.'.$row->status, []),
+            'findings' => $desk->findings($payload), 'ai' => config('virtual-desk.ai'), 'documents' => $this->documents($case->id)->filter(fn ($d) => ! $d->request_id || $d->request_id === $id)->values(),
+            'messages' => DB::table('desk_messages as m')->join('users as u', 'u.id', '=', 'm.actor_id')->where('request_id', $id)->orderBy('m.created_at')->get(['m.id', 'm.body', 'm.created_at', 'u.name'])->map(fn ($m) => [...(array) $m, 'body' => \Illuminate\Support\Facades\Crypt::decryptString($m->body)]),
+            'events' => $this->events($case->id, $desk)->filter(fn ($e) => $e['request_id'] === $id)->values(),
+            'revisions' => DB::table('desk_revisions')->where('request_id', $id)->orderByDesc('version')->get(['version', 'snapshot', 'created_at'])->map(fn ($r) => [...(array) $r, 'snapshot' => $desk->decode($r->snapshot)]),
+            'payments' => DB::table('desk_payments')->where('request_id', $id)->get(),
+            'analysts' => $request->user()->can('manage-portal') ? User::orderBy('name')->get(['id', 'name']) : [],
+            'territories' => app(\App\Services\InvestmentGeography::class)->publicReferences()->orderBy('name')->get(['id', 'name', 'location_type'])];
+        return $request->expectsJson() ? response()->json($data) : Inertia::render('desk/request', $data);
+    }
+
+    public function save(Request $request, string $id, VirtualDesk $desk)
+    {
+        $row = $desk->save($request->user(), $id, $request->all(), $request->boolean('submit'));
+        return $request->expectsJson() ? response()->json(['id' => $row->id, 'version' => $row->version, 'status' => $row->status, 'protocol' => $row->protocol]) : back()->with('success', $request->boolean('submit') ? 'Pedido submetido; protocolo disponível.' : 'Rascunho guardado.');
+    }
+
+    public function transition(Request $request, string $id, VirtualDesk $desk)
+    {
+        $row = $desk->transition($request->user(), $id, $request->all());
+        return $request->expectsJson() ? response()->json(['version' => $row->version, 'status' => $row->status]) : back()->with('success', 'Decisão interna registada.');
+    }
+
+    public function assign(Request $request, string $id, VirtualDesk $desk)
+    {
+        abort_unless($request->user()->can('manage-portal'), 403);
+        $data = $request->validate(['version' => 'required|integer', 'analyst_id' => 'required|integer|exists:users,id', 'reason' => 'required|string|min:3|max:3000', 'due_at' => 'nullable|date']);
+        DB::transaction(function () use ($request, $id, $desk, $data) {
+            $row = $desk->request($request->user(), $id, false, true); $case = $desk->case($request->user(), $row->case_id);
+            abort_unless((int) $row->version === (int) $data['version'] && ! in_array($row->status, ['draft', 'cancelled', 'closed'], true), 409);
+            $analyst = User::findOrFail($data['analyst_id']); abort_if($desk->owns($analyst, $case, false), 422, 'O proponente não pode ser o analista.');
+            DB::table('desk_requests')->where('id', $id)->update(['analyst_id' => $analyst->id, 'due_at' => $data['due_at'] ?? null, 'version' => $row->version + 1, 'updated_at' => now()]);
+            $desk->event($case, $request->user(), 'analyst_assigned', [...$data, 'deadline_basis' => 'internal_target_not_legal_deadline'], DB::table('desk_requests')->where('id', $id)->first());
+        });
+        return $request->expectsJson() ? response()->json(['ok' => true]) : back()->with('success', 'Analista e meta interna atribuídos.');
+    }
+
+    public function message(Request $request, string $id, VirtualDesk $desk)
+    {
+        $data = $request->validate(['body' => 'required|string|min:1|max:10000', 'client_key' => 'required|uuid']);
+        DB::transaction(function () use ($request, $id, $desk, $data) {
+            $row = $desk->request($request->user(), $id, false, true); $case = $desk->case($request->user(), $row->case_id);
+            abort_if(in_array($row->status, ['closed', 'cancelled'], true), 409, 'Pedido encerrado.');
+            $existing = DB::table('desk_messages')->where('request_id', $id)->where('actor_id', $request->user()->id)->where('client_key', $data['client_key'])->first();
+            if ($existing) { abort_unless(\Illuminate\Support\Facades\Crypt::decryptString($existing->body) === $data['body'], 409); return; }
+            DB::table('desk_messages')->insert(['id' => (string) Str::uuid(), 'request_id' => $id, 'actor_id' => $request->user()->id, 'client_key' => $data['client_key'], 'body' => \Illuminate\Support\Facades\Crypt::encryptString($data['body'])]);
+            $desk->event($case, $request->user(), 'message_added', [], $row);
+        });
+        return $request->expectsJson() ? response()->json(['ok' => true]) : back()->with('success', 'Mensagem privada guardada.');
+    }
+
+    public function receipt(Request $request, string $id, VirtualDesk $desk)
+    {
+        $row = $desk->request($request->user(), $id); abort_unless($row->protocol && $row->submitted_snapshot, 404);
+        $snapshot = $desk->decode($row->submitted_snapshot);
+        $this->auditRead($request, 'desk_requests', $id, 'receipt_downloaded');
+        return response()->streamDownload(function () use ($row, $snapshot) {
+            echo 'Balcão Virtual — recibo de submissão interna'.PHP_EOL.$row->protocol.PHP_EOL.'Data: '.$row->submitted_at.PHP_EOL.'Versão: '.$row->version.PHP_EOL;
+            echo json_encode($snapshot, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_THROW_ON_ERROR);
+        }, $row->protocol.'.txt', ['Content-Type' => 'text/plain; charset=utf-8', 'Cache-Control' => 'private, no-store']);
+    }
+
+    public function attach(Request $request, string $id, VirtualDesk $desk)
+    {
+        $data = $request->validate(['version' => 'required|integer', 'file' => 'nullable|required_without:document_id|file|mimetypes:application/pdf,image/png,image/jpeg,text/plain|max:10240',
+            'document_id' => 'nullable|required_without:file|uuid', 'category' => 'required|string|max:80', 'stage' => 'nullable|string|max:3', 'request_id' => 'nullable|uuid', 'valid_until' => 'nullable|date_format:Y-m-d', 'source_reference' => 'required|string|max:3000', 'consent' => 'accepted']);
+        $key = null; $newId = null;
+        try {
+            DB::transaction(function () use ($request, $id, $desk, $data, &$key, &$newId) {
+                $case = $desk->case($request->user(), $id, true, true); abort_unless((int) $case->version === (int) $data['version'], 409);
+                if ($data['stage'] ?? null) abort_unless(array_key_exists($data['stage'], config('virtual-desk.steps')), 422);
+                if ($data['request_id'] ?? null) {
+                    $row = $desk->request($request->user(), $data['request_id'], true, true);
+                    abort_unless($row->case_id === $id && in_array($row->status, ['draft', 'returned'], true), 409, 'Anexos de pedidos submetidos são imutáveis; use a devolução para corrigir.');
+                }
+                abort_if(DB::table('desk_documents')->where('case_id', $id)->count() >= 100, 422, 'Limite de anexos do dossier atingido.');
+                if ($request->hasFile('file')) {
+                    $file = $request->file('file'); $hash = hash_file('sha256', $file->getRealPath());
+                    $duplicate = DB::table('desk_documents as l')->join('documents as d', 'd.id', '=', 'l.document_id')->where('l.case_id', $id)->where('d.sha256', $hash)->first();
+                    if ($duplicate) return;
+                    $newId = (string) Str::uuid(); $key = $file->storeAs('virtual-desk/'.$id, $newId, 'local'); abort_unless($key, 500);
+                    DB::table('documents')->insert(['id' => $newId, 'source_system' => 'virtual-desk', 'file_name' => basename($file->getClientOriginalName()), 'media_type' => $file->getMimeType(), 'storage_key' => $key,
+                        'sha256' => $hash, 'size_bytes' => $file->getSize(), 'uploaded_by' => $request->user()->id, 'status' => 'quarantined', 'data_classification' => 'confidential']);
+                    $documentId = $newId;
+                } else {
+                    $documentId = $data['document_id'];
+                    $document = DB::table('documents')->where('id', $documentId)->whereNull('deleted_at')->first(); abort_unless($document, 404);
+                    $owned = (int) $document->uploaded_by === $request->user()->id || DB::table('desk_documents as l')->join('desk_cases as c', 'c.id', '=', 'l.case_id')->where('l.document_id', $documentId)->where('c.user_id', $request->user()->id)->whereNull('c.organization_id')->exists();
+                    abort_unless($owned, 403, 'Não há autorização para reutilizar este documento.');
+                    if (DB::table('desk_documents')->where('case_id', $id)->where('document_id', $documentId)->exists()) return;
+                }
+                DB::table('desk_documents')->insert(['id' => (string) Str::uuid(), 'case_id' => $id, 'document_id' => $documentId, 'request_id' => $data['request_id'] ?? null,
+                    'category' => $data['category'], 'stage' => $data['stage'] ?? null, 'valid_until' => $data['valid_until'] ?? null, 'source_reference' => $data['source_reference'], 'linked_by' => $request->user()->id]);
+                DB::table('desk_cases')->where('id', $id)->update(['version' => $case->version + 1, 'updated_at' => now()]);
+                $desk->event(DB::table('desk_cases')->where('id', $id)->first(), $request->user(), 'document_linked', ['document_id' => $documentId, 'source' => $data['source_reference'], 'consent' => true]);
+            });
+        } catch (\Throwable $e) { if ($key) Storage::disk('local')->delete($key); throw $e; }
+        if ($newId) ScanDocumentForMalware::dispatch($newId)->afterCommit();
+        return $request->expectsJson() ? response()->json(['ok' => true]) : back()->with('success', 'Documento privado associado; consulte o estado da análise.');
+    }
+
+    public function download(Request $request, string $id, string $document, VirtualDesk $desk)
+    {
+        $desk->case($request->user(), $id);
+        $doc = DB::table('desk_documents as l')->join('documents as d', 'd.id', '=', 'l.document_id')->where('l.case_id', $id)->where('l.id', $document)->whereNull('d.deleted_at')->first(['d.*']);
+        abort_unless($doc && $doc->status === 'active' && $doc->malware_scan_status === 'clean' && trim($doc->sha256) === $doc->malware_scanned_sha256, 404);
+        $path = realpath(Storage::disk('local')->path($doc->storage_key)); $root = realpath(Storage::disk('local')->path(''));
+        abort_unless($path && $root && str_starts_with($path, $root.DIRECTORY_SEPARATOR) && is_file($path) && hash_equals(trim($doc->sha256), hash_file('sha256', $path)), 404);
+        $this->auditRead($request, 'documents', $doc->id, 'document_downloaded');
+        return response()->download($path, $doc->file_name, ['Cache-Control' => 'private, no-store']);
+    }
+
+    public function notification(Request $request, int $id)
+    {
+        DB::table('desk_notifications')->where('id', $id)->where('user_id', $request->user()->id)->update(['read_at' => now()]);
+        return back();
+    }
+
+    public function redirectLink(Request $request, string $id, VirtualDesk $desk)
+    {
+        $case = $desk->case($request->user(), $request->validate(['case_id' => 'required|uuid'])['case_id']);
+        $link = DB::table('desk_institutional_links')->where('id', $id)->where('status', 'active')->whereNotNull('verified_at')->first(); abort_unless($link, 404);
+        abort_unless(filter_var($link->url, FILTER_VALIDATE_URL) && parse_url($link->url, PHP_URL_SCHEME) === 'https', 422);
+        $desk->event($case, $request->user(), 'institutional_referral', ['link_id' => $id, 'version' => $link->version, 'purpose' => $link->purpose]);
+        // No personal data, case ID or protocol appended to the external URL.
+        return redirect()->away($link->url)->withHeaders(['Referrer-Policy' => 'no-referrer']);
+    }
+
+    private function auditRead(Request $request, string $type, string $id, string $action = 'consulted'): void
+    {
+        DB::table('audit_events')->insert(['source_system' => 'virtual-desk', 'entity_type' => $type, 'entity_id' => $id, 'actor_user_id' => $request->user()->id, 'action' => $action]);
+    }
+}