@12-apps/prisma 1.0.0

package/prisma/migrations/20260727120000_payments_webhook_replay_budget/migration.sql

@@ -0,0 +1,37 @@
+-- @12-apps/payments-backend owned migration: give the webhook retry drain its own
+-- retry budget (FUT-341 follow-up).
+--
+-- `attempts` was doing two incompatible jobs at once. It counted every
+-- processing attempt AND it was the cap the drain used to decide a row had had
+-- enough — but the live inbound path increments it too, and how often THAT
+-- happens is the provider's decision, not ours.
+--
+-- The failure that forces this column: a store's order-confirmation handler
+-- throws. The live delivery fails, the endpoint answers 5xx, and the provider
+-- starts redelivering — every ten minutes or so, for hours. Each redelivery
+-- re-enters the pipeline, fails again, and spends one of the ten attempts the
+-- drain was supposed to have. Under two hours later the row is at the cap, drops
+-- out of the drain's work list permanently, and has been replayed zero or one
+-- times. The recovery mechanism disables itself precisely for the rows whose
+-- provider retried hardest, and nothing reports it: a row that is not listed
+-- moves no counter, so the drain looks idle and healthy.
+--
+-- So the two jobs get two columns. `attempts` stays what its name says — every
+-- attempt, from either path, which is what support wants when asking "how many
+-- times has anything tried this". `replay_attempts` is the drain's budget and
+-- only the drain writes it.
+--
+-- Backfilled to 0 rather than to `attempts`. Nothing incremented `attempts`
+-- before the drain existed, so every historical row's real replay count IS
+-- zero; copying `attempts` across would import live-path failures as spent
+-- budget and re-create the exact bug this column removes.
+ALTER TABLE "payment_webhook_events"
+  ADD COLUMN IF NOT EXISTS "replay_attempts" INTEGER NOT NULL DEFAULT 0;
+
+-- The drain's query, exactly: unsettled rows, one branch per eligible
+-- `replay_attempts` count (each with its own `updated_at` backoff cutoff),
+-- ordered by `updated_at`. Leading with `status` is what keeps it away from the
+-- PROCESSED rows, which are the overwhelming majority of this table and grow
+-- without bound while the unsettled set stays small.
+CREATE INDEX IF NOT EXISTS "payment_webhook_events_replay_idx"
+  ON "payment_webhook_events"("status", "replay_attempts", "updated_at");

package/prisma/migrations/20260727190000_sweep_leases/migration.sql

@@ -0,0 +1,13 @@
+-- Named, time-bounded claims on the scheduled sweeps (FUT-343).
+--
+-- One row per sweep. The claim is a conditional UPDATE on `expires_at`, so the
+-- database picks the winner between racing workers; `expires_at` also makes a
+-- crashed holder recoverable with no operator action.
+CREATE TABLE IF NOT EXISTS "sweep_leases" (
+    "name"        TEXT NOT NULL,
+    "holder"      TEXT NOT NULL,
+    "acquired_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "expires_at"  TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "sweep_leases_pkey" PRIMARY KEY ("name")
+);

package/prisma/migrations/20260728120000_add_product_research/migration.sql

@@ -0,0 +1,112 @@
+-- FUT #405: research-to-buy core tables. Owned by @12-apps/product-research (this
+-- migration reaches the host's migrations folder via sync-prisma-plugins).
+-- Deliberately NO foreign key into host tables (self-contained package schema,
+-- entity-lifecycle / payments-backend doctrine): the host repository layer
+-- scopes every read/write by client_id, and the researched catalog item is
+-- named by value via (catalog_ref_type, catalog_ref_id).
+
+CREATE TABLE "price_sources" (
+    "id" TEXT NOT NULL,
+    "client_id" TEXT NOT NULL,
+    "type" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "config" JSONB NOT NULL DEFAULT '{}',
+    "enabled" BOOLEAN NOT NULL DEFAULT true,
+    "status" TEXT NOT NULL DEFAULT 'ACTIVE',
+    "last_error_at" TIMESTAMP(3),
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "price_sources_pkey" PRIMARY KEY ("id"),
+    CONSTRAINT "price_sources_type_check" CHECK (
+        "type" IN ('VTEX', 'MERCADO_LIVRE', 'SERP', 'AMAZON', 'MANUAL')
+    ),
+    CONSTRAINT "price_sources_status_check" CHECK (
+        "status" IN ('ACTIVE', 'DEGRADED')
+    )
+);
+
+CREATE UNIQUE INDEX "price_sources_client_id_name_key" ON "price_sources"("client_id", "name");
+
+CREATE INDEX "price_sources_client_id_enabled_idx" ON "price_sources"("client_id", "enabled");
+
+CREATE TABLE "research_requests" (
+    "id" TEXT NOT NULL,
+    "client_id" TEXT NOT NULL,
+    "catalog_ref_type" TEXT,
+    "catalog_ref_id" TEXT,
+    "term" TEXT NOT NULL,
+    "brand" TEXT,
+    "ean" TEXT,
+    "quantity" INTEGER NOT NULL DEFAULT 1,
+    "region" TEXT,
+    "requested_by" TEXT,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "research_requests_pkey" PRIMARY KEY ("id")
+);
+
+CREATE INDEX "research_requests_client_id_created_at_idx" ON "research_requests"("client_id", "created_at");
+
+CREATE TABLE "research_runs" (
+    "id" TEXT NOT NULL,
+    "client_id" TEXT NOT NULL,
+    "request_id" TEXT NOT NULL,
+    "status" TEXT NOT NULL DEFAULT 'PENDING',
+    "source_stats" JSONB NOT NULL DEFAULT '[]',
+    "error" TEXT,
+    "started_at" TIMESTAMP(3),
+    "finished_at" TIMESTAMP(3),
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "research_runs_pkey" PRIMARY KEY ("id"),
+    CONSTRAINT "research_runs_status_check" CHECK (
+        "status" IN ('PENDING', 'RUNNING', 'COMPLETED', 'FAILED')
+    ),
+    CONSTRAINT "research_runs_request_id_fkey" FOREIGN KEY ("request_id")
+        REFERENCES "research_requests"("id") ON DELETE CASCADE ON UPDATE CASCADE
+);
+
+CREATE INDEX "research_runs_client_id_created_at_idx" ON "research_runs"("client_id", "created_at");
+
+CREATE INDEX "research_runs_request_id_idx" ON "research_runs"("request_id");
+
+CREATE TABLE "supplier_offers" (
+    "id" TEXT NOT NULL,
+    "client_id" TEXT NOT NULL,
+    "run_id" TEXT NOT NULL,
+    "source_id" TEXT,
+    "source_type" TEXT NOT NULL,
+    "supplier_name" TEXT NOT NULL,
+    "title" TEXT NOT NULL,
+    "url" TEXT,
+    "image_url" TEXT,
+    "currency" TEXT NOT NULL DEFAULT 'BRL',
+    "price_cents" INTEGER NOT NULL,
+    "shipping_cents" INTEGER NOT NULL DEFAULT 0,
+    "pack_quantity" INTEGER NOT NULL DEFAULT 1,
+    "unit_price_cents" INTEGER NOT NULL,
+    "total_cents" INTEGER NOT NULL,
+    "availability" TEXT,
+    "eta_days" INTEGER,
+    "relevance_score" DOUBLE PRECISION NOT NULL,
+    "rank" INTEGER,
+    "raw" JSONB,
+    "expires_at" TIMESTAMP(3),
+    "purchased_at" TIMESTAMP(3),
+    "hidden_at" TIMESTAMP(3),
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "supplier_offers_pkey" PRIMARY KEY ("id"),
+    CONSTRAINT "supplier_offers_run_id_fkey" FOREIGN KEY ("run_id")
+        REFERENCES "research_runs"("id") ON DELETE CASCADE ON UPDATE CASCADE,
+    CONSTRAINT "supplier_offers_source_id_fkey" FOREIGN KEY ("source_id")
+        REFERENCES "price_sources"("id") ON DELETE SET NULL ON UPDATE CASCADE
+);
+
+CREATE INDEX "supplier_offers_run_id_rank_idx" ON "supplier_offers"("run_id", "rank");
+
+CREATE INDEX "supplier_offers_client_id_created_at_idx" ON "supplier_offers"("client_id", "created_at");
+
+CREATE INDEX "supplier_offers_client_id_expires_at_idx" ON "supplier_offers"("client_id", "expires_at");

package/prisma/migrations/20260728170000_add_manual_price_entries/migration.sql

@@ -0,0 +1,31 @@
+-- Manual price import (FUT-415): the standing dataset behind MANUAL-type
+-- price sources. Rows come from price-list imports or one-off typed quotes
+-- and are read by the manual connector during research runs; `valid_until`
+-- is the staleness horizon and `batch_id` groups one import so a re-import
+-- replaces the previous list. PGlite-safe (plain DDL).
+
+CREATE TABLE "manual_price_entries" (
+    "id" TEXT NOT NULL,
+    "client_id" TEXT NOT NULL,
+    "source_id" TEXT NOT NULL,
+    "batch_id" TEXT NOT NULL,
+    "supplier_name" TEXT NOT NULL,
+    "title" TEXT NOT NULL,
+    "brand" TEXT,
+    "ean" TEXT,
+    "pack_quantity" INTEGER,
+    "price_cents" INTEGER NOT NULL,
+    "currency" TEXT NOT NULL DEFAULT 'BRL',
+    "url" TEXT,
+    "availability" TEXT,
+    "eta_days" INTEGER,
+    "valid_until" TIMESTAMP(3) NOT NULL,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "manual_price_entries_pkey" PRIMARY KEY ("id"),
+    CONSTRAINT "manual_price_entries_source_id_fkey" FOREIGN KEY ("source_id")
+        REFERENCES "price_sources"("id") ON DELETE CASCADE ON UPDATE CASCADE
+);
+
+CREATE INDEX "manual_price_entries_client_id_source_id_valid_until_idx"
+    ON "manual_price_entries"("client_id", "source_id", "valid_until");

package/prisma/migrations/20260729090000_integration_source_singleton/migration.sql

@@ -0,0 +1,24 @@
+-- FUT-434: paid connectors are singleton integrations — at most ONE source row
+-- per (tenant, type) for the credentialed types, each running on the tenant's
+-- own API key. VTEX and MANUAL stay multi-instance, created by name.
+--
+-- Belt-and-braces order: any duplicates that slipped in while the create
+-- dialog still offered these types are collapsed first (the OLDEST row wins —
+-- deterministic, and its id is the one past runs reference; supplier_offers
+-- survive via ON DELETE SET NULL), then the partial unique index makes the
+-- invariant a database fact. Like the CHECK constraints, the partial index is
+-- migration-only DDL the Prisma schema cannot express. PGlite-safe (plain DDL).
+
+DELETE FROM "price_sources" AS dup
+USING "price_sources" AS keeper
+WHERE dup."type" IN ('SERP', 'AMAZON', 'MERCADO_LIVRE')
+  AND keeper."client_id" = dup."client_id"
+  AND keeper."type" = dup."type"
+  AND (
+    keeper."created_at" < dup."created_at"
+    OR (keeper."created_at" = dup."created_at" AND keeper."id" < dup."id")
+  );
+
+CREATE UNIQUE INDEX "price_sources_client_id_integration_type_key"
+    ON "price_sources"("client_id", "type")
+    WHERE "type" IN ('SERP', 'AMAZON', 'MERCADO_LIVRE');

package/prisma/migrations/20260729120000_price_source_soft_delete/migration.sql

@@ -0,0 +1,24 @@
+-- Price sources become soft-deletable (FUT-433).
+--
+-- Deleting a source must keep past research runs readable: `supplier_offers`
+-- rows point at the source (`source_id`), and a run's report renders the
+-- supplier name / source type it snapshotted by value. A hard DELETE would
+-- SET NULL the FK (the schema's backstop), but soft-delete is strictly better
+-- here — the row survives, so `source_id` keeps resolving, and the roster,
+-- new runs and manual imports simply filter `archived_at IS NULL`. Same
+-- doctrine as the host's Discount model: history-bearing rows are archived,
+-- never removed. There is no restore path.
+ALTER TABLE "price_sources" ADD COLUMN "archived_at" TIMESTAMP(3);
+
+-- The tenant unique on (client_id, name) becomes PARTIAL, binding LIVE rows
+-- only. Unconditional, a deleted "Atacadão" would squat its name forever —
+-- the exact dead-duplicate pile-up this migration exists to clean up. The
+-- index NAME is preserved so a P2002 keeps classifying by constraint name.
+-- Partial indexes are plain PostgreSQL and PGlite runs the real engine, so
+-- this replays identically there; IF EXISTS / IF NOT EXISTS keep the replay
+-- idempotent for suites that apply every migration into a fresh database.
+DROP INDEX IF EXISTS "price_sources_client_id_name_key";
+
+CREATE UNIQUE INDEX IF NOT EXISTS "price_sources_client_id_name_key"
+    ON "price_sources"("client_id", "name")
+    WHERE "archived_at" IS NULL;

package/prisma/migrations/20260729140000_research_term_normalized/migration.sql

@@ -0,0 +1,26 @@
+-- FUT-430: widened widget lookup. `term_normalized` mirrors the package's
+-- normalizeText(term) — lowercased, accents stripped, punctuation runs
+-- collapsed to single spaces — so the best-prices widget finds a product's
+-- research past renames and accent variants. Kept in sync by the host on
+-- write; this migration backfills existing rows.
+--
+-- The backfill folds accents in pure SQL via translate() (no `unaccent`
+-- extension, which PGlite lacks — same doctrine as the FUT-168 search_name
+-- migration) so it runs identically on PostgreSQL + PGlite. Characters
+-- outside the mapped pt-BR set fall through to the punctuation collapse,
+-- matching normalizeText for every term the pt-BR hosts store.
+
+ALTER TABLE "research_requests" ADD COLUMN "term_normalized" TEXT;
+
+UPDATE "research_requests"
+  SET "term_normalized" = btrim(regexp_replace(
+    translate(
+      lower("term"),
+      'áàâãäçéèêëíìîïóòôõöúùûüýÿñ',
+      'aaaaaceeeeiiiiooooouuuuyyn'
+    ),
+    '[^a-z0-9,.]+', ' ', 'g'
+  ));
+
+CREATE INDEX "research_requests_client_id_term_normalized_idx"
+    ON "research_requests"("client_id", "term_normalized");

package/prisma/migrations/20260730120000_offer_outside_delivery_area/migration.sql

@@ -0,0 +1,16 @@
+-- FUT-491: an offer can now carry "this price is the store's DEFAULT region's".
+--
+-- A VTEX store that does not deliver to the researched CEP used to answer with
+-- nothing (FUT-416). It now answers with its default-region catalog, flagged —
+-- information beats silence, as long as the caveat travels with the price. The
+-- flag has to survive the re-read, the cached run and the offers API, so it is
+-- a real column: `raw` is the VERBATIM connector payload kept for offline
+-- replay and must not carry fields of ours.
+--
+-- NOT NULL DEFAULT false: every offer written before this change was priced for
+-- the buyer's own region (the only arms that produced offers were "served" and
+-- "no regional knowledge"), so false is the truthful backfill rather than a
+-- placeholder. IF NOT EXISTS keeps the replay idempotent for suites that apply
+-- every migration into a fresh database.
+ALTER TABLE "supplier_offers"
+    ADD COLUMN IF NOT EXISTS "outside_delivery_area" BOOLEAN NOT NULL DEFAULT false;

package/prisma/migrations/20260730120000_payments_charge_verified_at/migration.sql

@@ -0,0 +1,23 @@
+-- @12-apps/payments-backend owned migration: record when a REAL charge last
+-- succeeded, so activation can be earned instead of asserted (FUT-463).
+--
+-- `last_verified_at` cannot answer this. It is stamped by the credential
+-- PROBE, and the probe only asks "do these keys authenticate" — a PagBank
+-- Connect grant answers yes while refusing every real charge with
+-- `403 ACCESS_DENIED` until the integration is homologated. That is not a
+-- hypothetical: a store showed `VERIFIED`, was switched on by hand, and every
+-- shopper was declined at checkout.
+--
+-- Nullable with NO backfill, deliberately. Backfilling from `last_verified_at`
+-- would grandfather exactly the rows this exists to catch — including the one
+-- that prompted it, which is enabled today and cannot charge. Leaving it null
+-- means "never proven", which is the truth for every pre-existing row.
+--
+-- No row is disabled here either: taking a working store's checkout offline
+-- from a migration is not recoverable by the person it happens to. The
+-- application enforces the rule from both ends instead — enabling REQUIRES a
+-- proven charge, and a failed verification disables — so a connection that
+-- cannot charge switches itself off the next time it is tested, in front of
+-- the owner, rather than silently at deploy time.
+ALTER TABLE "payment_provider_configs"
+    ADD COLUMN "charge_verified_at" TIMESTAMP(3);

package/prisma/migrations/20260730130000_research_runs_created_at_index/migration.sql

@@ -0,0 +1,12 @@
+-- FUT-496: a time-only index on research_runs.
+--
+-- The host's superadmin diagnostics inbox reads recent runs ACROSS EVERY TENANT
+-- ("every failed source in the last 24 h"), i.e. `created_at >= $1` with no
+-- client_id bound. The existing `(client_id, created_at)` index cannot serve
+-- that predicate — its leading column is unbound and PostgreSQL has no btree
+-- skip scan — so the planner falls back to a Parallel Seq Scan over the whole
+-- table. research_runs has no retention/pruning job, so that scan only ever
+-- gets more expensive. A tenant-scoped read is unaffected: it keeps using the
+-- composite index, which is strictly better for it.
+
+CREATE INDEX "research_runs_created_at_idx" ON "research_runs"("created_at");

package/prisma/migrations/20260730210000_add_shifts/migration.sql

@@ -0,0 +1,95 @@
+-- @12-apps/shift (FUT-446): immutable work periods and optional tenant policy.
+CREATE TABLE "shifts" (
+    "id"                     TEXT NOT NULL,
+    "client_id"              TEXT NOT NULL,
+    "user_id"                TEXT NOT NULL,
+    "kind"                   TEXT NOT NULL,
+    "started_at"             TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "ended_at"               TIMESTAMP(3),
+    "ended_reason"           TEXT,
+    "ended_by_user_id"       TEXT,
+    "resource_assignment_id" TEXT,
+    "resource_type"          TEXT,
+    "resource_id"            TEXT,
+
+    CONSTRAINT "shifts_pkey" PRIMARY KEY ("id"),
+    CONSTRAINT "shifts_kind_check"
+      CHECK ("kind" IN ('kitchen', 'service')),
+    CONSTRAINT "shifts_ended_reason_check"
+      CHECK ("ended_reason" IS NULL OR "ended_reason" IN ('user', 'supervisor', 'auto')),
+    CONSTRAINT "shifts_end_state_check"
+      CHECK (
+        ("ended_at" IS NULL AND "ended_reason" IS NULL AND "ended_by_user_id" IS NULL)
+        OR
+        ("ended_at" IS NOT NULL AND "ended_reason" IS NOT NULL
+          AND ("ended_reason" = 'auto' OR "ended_by_user_id" IS NOT NULL))
+      ),
+    CONSTRAINT "shifts_time_order_check"
+      CHECK ("ended_at" IS NULL OR "ended_at" >= "started_at"),
+    CONSTRAINT "shifts_resource_snapshot_check"
+      CHECK (
+        ("resource_assignment_id" IS NULL AND "resource_type" IS NULL AND "resource_id" IS NULL)
+        OR
+        ("resource_assignment_id" IS NOT NULL AND "resource_type" IS NOT NULL AND "resource_id" IS NOT NULL)
+      )
+);
+
+CREATE UNIQUE INDEX "shifts_resource_assignment_id_key"
+  ON "shifts"("resource_assignment_id");
+
+-- Prisma cannot express a partial unique index. This is the concurrency
+-- guarantee: two tabs may race the pre-check, but only one open period commits.
+CREATE UNIQUE INDEX "shifts_open_client_user_key"
+  ON "shifts"("client_id", "user_id")
+  WHERE "ended_at" IS NULL;
+
+CREATE INDEX "shifts_client_id_ended_at_idx"
+  ON "shifts"("client_id", "ended_at");
+
+CREATE INDEX "shifts_client_id_user_id_started_at_idx"
+  ON "shifts"("client_id", "user_id", "started_at");
+
+-- A shift's identity/resource snapshots never change, and a closed row is the
+-- immutable work record. The service exposes no edit/delete API; this trigger
+-- keeps direct SQL and future adapters from creating a back door around it.
+CREATE FUNCTION "guard_shift_immutability"()
+RETURNS TRIGGER
+LANGUAGE plpgsql
+AS $$
+BEGIN
+  IF TG_OP = 'DELETE' THEN
+    RAISE EXCEPTION 'shift records cannot be deleted';
+  END IF;
+
+  IF OLD."ended_at" IS NOT NULL THEN
+    RAISE EXCEPTION 'closed shifts are immutable';
+  END IF;
+
+  IF NEW."client_id" IS DISTINCT FROM OLD."client_id"
+     OR NEW."user_id" IS DISTINCT FROM OLD."user_id"
+     OR NEW."kind" IS DISTINCT FROM OLD."kind"
+     OR NEW."started_at" IS DISTINCT FROM OLD."started_at"
+     OR NEW."resource_assignment_id" IS DISTINCT FROM OLD."resource_assignment_id"
+     OR NEW."resource_type" IS DISTINCT FROM OLD."resource_type"
+     OR NEW."resource_id" IS DISTINCT FROM OLD."resource_id" THEN
+    RAISE EXCEPTION 'shift identity and resource snapshots are immutable';
+  END IF;
+
+  RETURN NEW;
+END;
+$$;
+
+CREATE TRIGGER "shifts_immutable_guard"
+BEFORE UPDATE OR DELETE ON "shifts"
+FOR EACH ROW
+EXECUTE FUNCTION "guard_shift_immutability"();
+
+CREATE TABLE "shift_tenant_configs" (
+    "client_id"        TEXT NOT NULL,
+    "auto_close_hours" INTEGER NOT NULL DEFAULT 16,
+    "updated_at"       TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "shift_tenant_configs_pkey" PRIMARY KEY ("client_id"),
+    CONSTRAINT "shift_tenant_configs_auto_close_hours_check"
+      CHECK ("auto_close_hours" BETWEEN 1 AND 168)
+);

package/prisma/migrations/20260731000000_offer_shipping_unknown/migration.sql

@@ -0,0 +1,34 @@
+-- FUT-518: "the source never said what shipping costs" stops being spelled 0.
+--
+-- `shipping_cents` was NOT NULL DEFAULT 0, so an offer whose freight nobody
+-- knew was stored — and RANKED — as free shipping. That is not a rare corner:
+-- the SERP connector (Google Shopping) never states a shipping cost at all, so
+-- every one of its offers competed on an understated total against Amazon
+-- (which writes 0 only on a real free-shipping signal) and Mercado Livre
+-- (which parses it). Cheapest-first then hands the recommendation to whichever
+-- offer hid its freight best — the same understated-total failure as FUT-497.
+--
+-- After this: NULL = the source never stated a shipping cost, so `total_cents`
+-- is a MINIMUM and every surface caveats it; 0 = the source stated FREE.
+-- The DEFAULT goes too, deliberately: with two writers of this table
+-- (`appendRunOffers` and `insertOffers`, both through `toOfferRow` in
+-- apps/web/lib/repositories/research-store.ts) and no raw SQL insert anywhere,
+-- the column is always stated explicitly. Keeping a default would let a future
+-- writer that forgets the column silently re-introduce the phantom zero.
+--
+-- NO BACKFILL, AND THAT IS THE HONEST ANSWER. Every row written before this
+-- migration holds 0, and 0 now means "the source stated free". Those rows are
+-- indistinguishable from genuinely free-shipping ones — the information to tell
+-- them apart was destroyed at write time and no query can recover it. They are
+-- left as they are: historical runs keep reading as free shipping, which is
+-- wrong for some of them, but rewriting them to NULL would be equally wrong for
+-- the rest and would additionally erase the real free-shipping answers Amazon
+-- and Mercado Livre did give. The distinction starts with the runs from here on.
+--
+-- Idempotent (IF EXISTS / DROP DEFAULT is a no-op when absent) so the replay
+-- suites that apply every migration into a fresh database stay green.
+ALTER TABLE "supplier_offers"
+    ALTER COLUMN "shipping_cents" DROP NOT NULL;
+
+ALTER TABLE "supplier_offers"
+    ALTER COLUMN "shipping_cents" DROP DEFAULT;

package/prisma/migrations/20260731210000_shift_delete_guard/migration.sql

@@ -0,0 +1,43 @@
+-- @12-apps/shift (FUT-446): the immutability guard becomes UPDATE-only.
+--
+-- The original trigger fired `BEFORE UPDATE OR DELETE` and raised
+-- unconditionally on DELETE. `shifts.client_id` is a by-value tenant reference
+-- with no foreign key (that is what keeps the package host-agnostic), so a host
+-- that deletes its tenant row and then sweeps the remaining by-value tables by
+-- `client_id` could never remove a shift: the RAISE aborted the whole
+-- transaction. Future Pay's demo-store reset does exactly that on EVERY deploy,
+-- so a single shift row would have wedged the deploy step.
+--
+-- Deletability is host policy, not a package invariant. What the guard actually
+-- protects — a closed shift is an immutable work record, and a shift's
+-- identity/resource snapshot never changes — is entirely an UPDATE concern and
+-- is preserved verbatim below. The package still exposes no delete API.
+DROP TRIGGER IF EXISTS "shifts_immutable_guard" ON "shifts";
+
+CREATE OR REPLACE FUNCTION "guard_shift_immutability"()
+RETURNS TRIGGER
+LANGUAGE plpgsql
+AS $$
+BEGIN
+  IF OLD."ended_at" IS NOT NULL THEN
+    RAISE EXCEPTION 'closed shifts are immutable';
+  END IF;
+
+  IF NEW."client_id" IS DISTINCT FROM OLD."client_id"
+     OR NEW."user_id" IS DISTINCT FROM OLD."user_id"
+     OR NEW."kind" IS DISTINCT FROM OLD."kind"
+     OR NEW."started_at" IS DISTINCT FROM OLD."started_at"
+     OR NEW."resource_assignment_id" IS DISTINCT FROM OLD."resource_assignment_id"
+     OR NEW."resource_type" IS DISTINCT FROM OLD."resource_type"
+     OR NEW."resource_id" IS DISTINCT FROM OLD."resource_id" THEN
+    RAISE EXCEPTION 'shift identity and resource snapshots are immutable';
+  END IF;
+
+  RETURN NEW;
+END;
+$$;
+
+CREATE TRIGGER "shifts_immutable_guard"
+BEFORE UPDATE ON "shifts"
+FOR EACH ROW
+EXECUTE FUNCTION "guard_shift_immutability"();

package/prisma/migrations/20260810120000_add_report_default_range/migration.sql

@@ -0,0 +1,15 @@
+-- The period a saved report OPENS on (FUT-755). Nullable: NULL means "no
+-- preference", which readers resolve to 30d — the behaviour every existing row
+-- already has, so this migration changes nothing about them.
+ALTER TABLE "saved_reports"
+  ADD COLUMN IF NOT EXISTS "default_range" TEXT;
+
+-- The presets the range API actually supports (REPORT_RANGES). Enforced here as
+-- well as at the wire, because the store is written by MCP authors too and a
+-- value the reader cannot resolve would open the report on nothing.
+ALTER TABLE "saved_reports"
+  DROP CONSTRAINT IF EXISTS "saved_reports_default_range_check";
+
+ALTER TABLE "saved_reports"
+  ADD CONSTRAINT "saved_reports_default_range_check"
+    CHECK ("default_range" IS NULL OR "default_range" IN ('today', '7d', '30d'));

package/prisma/migrations/20260810160000_report_default_range_month/migration.sql

@@ -0,0 +1,15 @@
+-- `Este mês` joins the period toggle (FUT-755), so it joins the periods a saved
+-- report may OPEN on. The CHECK is the third place the list is written — after
+-- `REPORT_DEFAULT_RANGES` and the wire's `z.enum` — and the one an MCP author
+-- writing straight to the store hits, so it has to learn the new value or a
+-- report whose default the toggle offers cannot be saved.
+--
+-- Re-stated rather than altered: Postgres has no `ALTER CONSTRAINT` for a
+-- CHECK's expression, and DROP-then-ADD under `IF EXISTS` is idempotent, so
+-- this replays cleanly onto a database that already ran it.
+ALTER TABLE "saved_reports"
+  DROP CONSTRAINT IF EXISTS "saved_reports_default_range_check";
+
+ALTER TABLE "saved_reports"
+  ADD CONSTRAINT "saved_reports_default_range_check"
+    CHECK ("default_range" IS NULL OR "default_range" IN ('today', '7d', '30d', 'month'));

package/prisma/migrations/20260810180000_add_report_working_copy/migration.sql

@@ -0,0 +1,13 @@
+-- Unpublished changes to a PUBLISHED report (FUT-755).
+--
+-- A report already has `status` ('draft' | 'published' | 'archived'), but that
+-- is the report's LIFECYCLE, not a revision of it: a report with status
+-- 'draft' has never been published. Editing a PUBLISHED report is the case
+-- this column exists for — its readers are looking at it right now, so the
+-- in-progress edit is stored beside the live document and `spec` is left
+-- alone until the author publishes.
+--
+-- NULL means "no unpublished changes", which is every row that predates this
+-- migration, so nothing about existing reports changes.
+ALTER TABLE "saved_reports"
+  ADD COLUMN IF NOT EXISTS "working_copy" JSONB;

package/prisma/plugin-migrations.json

@@ -0,0 +1,28 @@
+{
+  "$comment": "Migrations in prisma/migrations that were COPIED from a plugin package. Generated by scripts/sync-prisma-plugins.mjs — do not edit by hand. Its only job is to let the sync recognise a copy whose owner renamed or deleted it, since a copy is otherwise indistinguishable from a host-owned migration.",
+  "migrations": [
+    "20260725150000_payments_platform_core",
+    "20260725160000_payments_oauth_connections",
+    "20260725170000_add_saved_reports",
+    "20260726090000_payments_multi_provider_failover",
+    "20260726120000_payments_failover_policy",
+    "20260726130000_add_report_lifecycle",
+    "20260727120000_add_report_archived_status",
+    "20260727120000_payments_webhook_replay_budget",
+    "20260727190000_sweep_leases",
+    "20260728120000_add_product_research",
+    "20260728170000_add_manual_price_entries",
+    "20260729090000_integration_source_singleton",
+    "20260729120000_price_source_soft_delete",
+    "20260729140000_research_term_normalized",
+    "20260730120000_offer_outside_delivery_area",
+    "20260730120000_payments_charge_verified_at",
+    "20260730130000_research_runs_created_at_index",
+    "20260730210000_add_shifts",
+    "20260731000000_offer_shipping_unknown",
+    "20260731210000_shift_delete_guard",
+    "20260810120000_add_report_default_range",
+    "20260810160000_report_default_range_month",
+    "20260810180000_add_report_working_copy"
+  ]
+}