@fayz-ai/db 0.11.0 → 0.13.0

package/migrations/070_permission_catalog.sql

@@ -0,0 +1,205 @@
+-- ============================================================================
+-- 070_permission_catalog.sql — the RBAC catalog seeded from declaredFeatures (#136).
+--
+-- GENERATED by scripts/emit-permission-catalog.mjs — do not edit by hand.
+--   regenerate:  pnpm emit:permission-catalog
+--   verify:      pnpm check:permission-catalog   (CI: fails when out of date)
+-- Once this file is recorded in a real database's ledger it is frozen: regenerate
+-- into a NEW numbered file (--out …/0NN_permission_catalog_vK.sql), never here.
+--
+-- One key per {feature}.{action}; app.seed_permissions upserts and never removes
+-- (removing a key is a decision, not a build). New keys reach every tenant's
+-- system owner role through the permissions_grant_owner trigger (043).
+--
+-- Sources (plugin id ← manifest: features; [c] = conditional on config, [r] = referenced only):
+--   admin ← plugins/plugin-admin/src/index.ts: admin
+--   agenda ← plugins/plugin-agenda/src/index.ts: agenda.schedules, appointments
+--   automations ← plugins/plugin-automations/src/index.ts: automations
+--   blog ← plugins/plugin-blog/src/index.ts: blog
+--   conversations ← plugins/plugin-conversations/src/index.ts: conversations
+--   courses ← plugins/plugin-courses/src/index.ts: courses, courses.finance, courses.sales
+--   crm ← plugins/plugin-crm/src/index.ts: crm.leads, crm.pipeline, crm.quotes, sales
+--   dashboard ← plugins/plugin-dashboard/src/index.ts: dashboard
+--   financial ← plugins/plugin-financial/src/index.ts: financial, financial.commissions[c], financial.payables[c], financial.receivables[c]
+--   custom_forms ← plugins/plugin-forms/src/index.ts: custom_forms
+--   inventory ← plugins/plugin-inventory/src/index.ts: inventory, inventory.recipes[c]
+--   marketing ← plugins/plugin-marketing/src/index.ts: marketing, marketing.blog[c], marketing.content[c], marketing.landing-pages[c]
+--   menu ← plugins/plugin-menu/src/index.ts: menu[r]
+--   orders ← plugins/plugin-orders/src/index.ts: orders[r]
+--   reports ← plugins/plugin-reports/src/index.ts: reports
+--   reputation ← plugins/plugin-reputation/src/index.ts: reputation
+--   scribe ← plugins/plugin-scribe/src/index.ts: scribe{read,create,edit,delete}
+--   shop ← plugins/plugin-shop/src/index.ts: shop[r]
+--   sites ← plugins/plugin-sites/src/index.ts: sites
+--   tables ← plugins/plugin-tables/src/index.ts: tables[r]
+-- ============================================================================
+
+SELECT app.seed_permissions('[
+  {"key":"admin.create","plugin":"admin"},
+  {"key":"admin.delete","plugin":"admin"},
+  {"key":"admin.edit","plugin":"admin"},
+  {"key":"admin.manage","plugin":"admin"},
+  {"key":"admin.read","plugin":"admin"},
+  {"key":"agenda.schedules.create","plugin":"agenda","description":"Schedule Management: create"},
+  {"key":"agenda.schedules.delete","plugin":"agenda","description":"Schedule Management: delete"},
+  {"key":"agenda.schedules.edit","plugin":"agenda","description":"Schedule Management: edit"},
+  {"key":"agenda.schedules.manage","plugin":"agenda","description":"Schedule Management: manage"},
+  {"key":"agenda.schedules.read","plugin":"agenda","description":"Schedule Management: read"},
+  {"key":"appointments.create","plugin":"agenda"},
+  {"key":"appointments.delete","plugin":"agenda"},
+  {"key":"appointments.edit","plugin":"agenda"},
+  {"key":"appointments.manage","plugin":"agenda"},
+  {"key":"appointments.read","plugin":"agenda"},
+  {"key":"automations.create","plugin":"automations","description":"Automations: create"},
+  {"key":"automations.delete","plugin":"automations","description":"Automations: delete"},
+  {"key":"automations.edit","plugin":"automations","description":"Automations: edit"},
+  {"key":"automations.manage","plugin":"automations","description":"Automations: manage"},
+  {"key":"automations.read","plugin":"automations","description":"Automations: read"},
+  {"key":"blog.create","plugin":"blog","description":"Blog: create"},
+  {"key":"blog.delete","plugin":"blog","description":"Blog: delete"},
+  {"key":"blog.edit","plugin":"blog","description":"Blog: edit"},
+  {"key":"blog.manage","plugin":"blog","description":"Blog: manage"},
+  {"key":"blog.read","plugin":"blog","description":"Blog: read"},
+  {"key":"conversations.create","plugin":"conversations","description":"Conversations: create"},
+  {"key":"conversations.delete","plugin":"conversations","description":"Conversations: delete"},
+  {"key":"conversations.edit","plugin":"conversations","description":"Conversations: edit"},
+  {"key":"conversations.manage","plugin":"conversations","description":"Conversations: manage"},
+  {"key":"conversations.read","plugin":"conversations","description":"Conversations: read"},
+  {"key":"courses.create","plugin":"courses","description":"Courses: create"},
+  {"key":"courses.delete","plugin":"courses","description":"Courses: delete"},
+  {"key":"courses.edit","plugin":"courses","description":"Courses: edit"},
+  {"key":"courses.finance.create","plugin":"courses","description":"Financial: create"},
+  {"key":"courses.finance.delete","plugin":"courses","description":"Financial: delete"},
+  {"key":"courses.finance.edit","plugin":"courses","description":"Financial: edit"},
+  {"key":"courses.finance.manage","plugin":"courses","description":"Financial: manage"},
+  {"key":"courses.finance.read","plugin":"courses","description":"Financial: read"},
+  {"key":"courses.manage","plugin":"courses","description":"Courses: manage"},
+  {"key":"courses.read","plugin":"courses","description":"Courses: read"},
+  {"key":"courses.sales.create","plugin":"courses","description":"Sales: create"},
+  {"key":"courses.sales.delete","plugin":"courses","description":"Sales: delete"},
+  {"key":"courses.sales.edit","plugin":"courses","description":"Sales: edit"},
+  {"key":"courses.sales.manage","plugin":"courses","description":"Sales: manage"},
+  {"key":"courses.sales.read","plugin":"courses","description":"Sales: read"},
+  {"key":"crm.leads.create","plugin":"crm"},
+  {"key":"crm.leads.delete","plugin":"crm"},
+  {"key":"crm.leads.edit","plugin":"crm"},
+  {"key":"crm.leads.manage","plugin":"crm"},
+  {"key":"crm.leads.read","plugin":"crm"},
+  {"key":"crm.pipeline.create","plugin":"crm"},
+  {"key":"crm.pipeline.delete","plugin":"crm"},
+  {"key":"crm.pipeline.edit","plugin":"crm"},
+  {"key":"crm.pipeline.manage","plugin":"crm"},
+  {"key":"crm.pipeline.read","plugin":"crm"},
+  {"key":"crm.quotes.create","plugin":"crm"},
+  {"key":"crm.quotes.delete","plugin":"crm"},
+  {"key":"crm.quotes.edit","plugin":"crm"},
+  {"key":"crm.quotes.manage","plugin":"crm"},
+  {"key":"crm.quotes.read","plugin":"crm"},
+  {"key":"custom_forms.create","plugin":"custom_forms"},
+  {"key":"custom_forms.delete","plugin":"custom_forms"},
+  {"key":"custom_forms.edit","plugin":"custom_forms"},
+  {"key":"custom_forms.manage","plugin":"custom_forms"},
+  {"key":"custom_forms.read","plugin":"custom_forms"},
+  {"key":"dashboard.create","plugin":"dashboard"},
+  {"key":"dashboard.delete","plugin":"dashboard"},
+  {"key":"dashboard.edit","plugin":"dashboard"},
+  {"key":"dashboard.manage","plugin":"dashboard"},
+  {"key":"dashboard.read","plugin":"dashboard"},
+  {"key":"financial.commissions.create","plugin":"financial"},
+  {"key":"financial.commissions.delete","plugin":"financial"},
+  {"key":"financial.commissions.edit","plugin":"financial"},
+  {"key":"financial.commissions.manage","plugin":"financial"},
+  {"key":"financial.commissions.read","plugin":"financial"},
+  {"key":"financial.create","plugin":"financial"},
+  {"key":"financial.delete","plugin":"financial"},
+  {"key":"financial.edit","plugin":"financial"},
+  {"key":"financial.manage","plugin":"financial"},
+  {"key":"financial.payables.create","plugin":"financial"},
+  {"key":"financial.payables.delete","plugin":"financial"},
+  {"key":"financial.payables.edit","plugin":"financial"},
+  {"key":"financial.payables.manage","plugin":"financial"},
+  {"key":"financial.payables.read","plugin":"financial"},
+  {"key":"financial.read","plugin":"financial"},
+  {"key":"financial.read_all","plugin":"financial"},
+  {"key":"financial.receivables.create","plugin":"financial"},
+  {"key":"financial.receivables.delete","plugin":"financial"},
+  {"key":"financial.receivables.edit","plugin":"financial"},
+  {"key":"financial.receivables.manage","plugin":"financial"},
+  {"key":"financial.receivables.read","plugin":"financial"},
+  {"key":"inventory.create","plugin":"inventory"},
+  {"key":"inventory.delete","plugin":"inventory"},
+  {"key":"inventory.edit","plugin":"inventory"},
+  {"key":"inventory.manage","plugin":"inventory"},
+  {"key":"inventory.read","plugin":"inventory"},
+  {"key":"inventory.recipes.create","plugin":"inventory"},
+  {"key":"inventory.recipes.delete","plugin":"inventory"},
+  {"key":"inventory.recipes.edit","plugin":"inventory"},
+  {"key":"inventory.recipes.manage","plugin":"inventory"},
+  {"key":"inventory.recipes.read","plugin":"inventory"},
+  {"key":"marketing.blog.create","plugin":"marketing"},
+  {"key":"marketing.blog.delete","plugin":"marketing"},
+  {"key":"marketing.blog.edit","plugin":"marketing"},
+  {"key":"marketing.blog.manage","plugin":"marketing"},
+  {"key":"marketing.blog.read","plugin":"marketing"},
+  {"key":"marketing.content.create","plugin":"marketing"},
+  {"key":"marketing.content.delete","plugin":"marketing"},
+  {"key":"marketing.content.edit","plugin":"marketing"},
+  {"key":"marketing.content.manage","plugin":"marketing"},
+  {"key":"marketing.content.read","plugin":"marketing"},
+  {"key":"marketing.create","plugin":"marketing"},
+  {"key":"marketing.delete","plugin":"marketing"},
+  {"key":"marketing.edit","plugin":"marketing"},
+  {"key":"marketing.landing-pages.create","plugin":"marketing"},
+  {"key":"marketing.landing-pages.delete","plugin":"marketing"},
+  {"key":"marketing.landing-pages.edit","plugin":"marketing"},
+  {"key":"marketing.landing-pages.manage","plugin":"marketing"},
+  {"key":"marketing.landing-pages.read","plugin":"marketing"},
+  {"key":"marketing.manage","plugin":"marketing"},
+  {"key":"marketing.read","plugin":"marketing"},
+  {"key":"menu.create","plugin":"menu"},
+  {"key":"menu.delete","plugin":"menu"},
+  {"key":"menu.edit","plugin":"menu"},
+  {"key":"menu.manage","plugin":"menu"},
+  {"key":"menu.read","plugin":"menu"},
+  {"key":"orders.create","plugin":"orders"},
+  {"key":"orders.delete","plugin":"orders"},
+  {"key":"orders.edit","plugin":"orders"},
+  {"key":"orders.manage","plugin":"orders"},
+  {"key":"orders.read","plugin":"orders"},
+  {"key":"orders.read_all","plugin":"orders"},
+  {"key":"reports.create","plugin":"reports"},
+  {"key":"reports.delete","plugin":"reports"},
+  {"key":"reports.edit","plugin":"reports"},
+  {"key":"reports.manage","plugin":"reports"},
+  {"key":"reports.read","plugin":"reports"},
+  {"key":"reputation.create","plugin":"reputation","description":"Reputation: create"},
+  {"key":"reputation.delete","plugin":"reputation","description":"Reputation: delete"},
+  {"key":"reputation.edit","plugin":"reputation","description":"Reputation: edit"},
+  {"key":"reputation.manage","plugin":"reputation","description":"Reputation: manage"},
+  {"key":"reputation.read","plugin":"reputation","description":"Reputation: read"},
+  {"key":"sales.create","plugin":"crm"},
+  {"key":"sales.delete","plugin":"crm"},
+  {"key":"sales.edit","plugin":"crm"},
+  {"key":"sales.manage","plugin":"crm"},
+  {"key":"sales.read","plugin":"crm"},
+  {"key":"scribe.create","plugin":"scribe"},
+  {"key":"scribe.delete","plugin":"scribe"},
+  {"key":"scribe.edit","plugin":"scribe"},
+  {"key":"scribe.manage","plugin":"scribe"},
+  {"key":"scribe.read","plugin":"scribe"},
+  {"key":"shop.create","plugin":"shop"},
+  {"key":"shop.delete","plugin":"shop"},
+  {"key":"shop.edit","plugin":"shop"},
+  {"key":"shop.manage","plugin":"shop"},
+  {"key":"shop.read","plugin":"shop"},
+  {"key":"sites.create","plugin":"sites","description":"Sites & Funnels: create"},
+  {"key":"sites.delete","plugin":"sites","description":"Sites & Funnels: delete"},
+  {"key":"sites.edit","plugin":"sites","description":"Sites & Funnels: edit"},
+  {"key":"sites.manage","plugin":"sites","description":"Sites & Funnels: manage"},
+  {"key":"sites.read","plugin":"sites","description":"Sites & Funnels: read"},
+  {"key":"tables.create","plugin":"tables"},
+  {"key":"tables.delete","plugin":"tables"},
+  {"key":"tables.edit","plugin":"tables"},
+  {"key":"tables.manage","plugin":"tables"},
+  {"key":"tables.read","plugin":"tables"}
+]'::jsonb);

package/migrations/071_v1_permission_map.sql

@@ -0,0 +1,266 @@
+-- ============================================================================
+-- 071_v1_permission_map.sql — the V1 → V2 permission mapping as data (#136).
+--
+-- V1 (the-chef / beautyplace) had one catalog of snake_case codes × four flags
+-- (can_view / can_insert / can_edit / can_delete) per "regra de permissão", an
+-- admin/master/owner bypass in code and a per-tenant enforcement flag. V2 has
+-- '{plugin}.{action}' keys, roles per tenant and RLS as the only law.
+--
+-- The mapping was produced by reading the V1 REPO (src/**, supabase/functions/**,
+-- supabase/migrations/**; never a data dump): every code seeded by a migration
+-- plus every code the code enforces, each decided as
+--   mapped   → a V2 feature (the four flags expand to read/create/edit/delete)
+--              or one V2 key (any flag grants it), plus optional extra keys
+--   backlog  → V2 has no surface for it yet: nothing is granted, nothing is lost
+--              in a way anyone can act on today (listed for the roadmap)
+--   dropped  → superseded/inactive in V1, or a bypass/flag V2 refuses to carry
+-- The prose (why each row) is docs/data/phase-0/01b-v1-permission-mapping.md;
+-- this table is what the extractor/ledger slice reads. Rows only, no client data.
+--
+-- app.v1_permission_keys(code, view, insert, edit, delete) is the one function
+-- that turns a V1 rule detail into the V2 keys to grant — the extractor calls
+-- it instead of re-implementing the expansion.
+-- ============================================================================
+
+CREATE TABLE IF NOT EXISTS app.v1_permission_map (
+  v1_code        text PRIMARY KEY,
+  v1_category    text,
+  v1_name        text,
+  seeded_in_repo boolean NOT NULL DEFAULT true,   -- inserted by a V1 migration (false ⇒ exists only in the live table)
+  active_in_v1   boolean,                          -- catalog `active` at the head of the V1 migrations (null when not seeded)
+  enforced_in_v1 boolean NOT NULL DEFAULT false,   -- appears at an enforcement point (can()/usePermission/<Can>/permissionCode/user_has_permission)
+  status         text NOT NULL CHECK (status IN ('mapped', 'backlog', 'dropped')),
+  kind           text CHECK (kind IN ('feature', 'key')),
+  v2_feature     text,                             -- kind='feature': view→.read, insert→.create, edit→.edit, delete→.delete (fallback .manage)
+  v2_key         text REFERENCES app.permissions(key) ON DELETE SET NULL,   -- kind='key': the key any true flag grants; kind='feature': the .read key
+  v2_extra_keys  text[] NOT NULL DEFAULT '{}',     -- granted alongside whenever any flag is true
+  note           text,
+  updated_at     timestamptz NOT NULL DEFAULT now(),
+  CHECK (status <> 'mapped' OR (kind IS NOT NULL AND v2_key IS NOT NULL)),
+  CHECK (kind IS DISTINCT FROM 'feature' OR v2_feature IS NOT NULL),
+  CHECK (v1_code ~ '^[a-z][a-z0-9_]*$')
+);
+ALTER TABLE app.v1_permission_map ENABLE ROW LEVEL SECURITY;
+GRANT SELECT ON app.v1_permission_map TO authenticated, service_role;
+GRANT ALL ON app.v1_permission_map TO service_role;
+DROP POLICY IF EXISTS v1_permission_map_select ON app.v1_permission_map;
+CREATE POLICY v1_permission_map_select ON app.v1_permission_map FOR SELECT TO authenticated USING (true);
+COMMENT ON TABLE app.v1_permission_map IS
+  'V1 permission code → V2 permission key mapping (#136). Read by the V1 extractor; prose in docs/data/phase-0/01b-v1-permission-mapping.md.';
+
+-- ── the rows ────────────────────────────────────────────────────────────
+-- Upsert on v1_code so a later file may refine a row (status/target/note)
+-- without editing this one; nothing here deletes.
+INSERT INTO app.v1_permission_map
+  (v1_code, v1_category, v1_name, seeded_in_repo, active_in_v1, enforced_in_v1, status, kind, v2_feature, v2_key, v2_extra_keys, note)
+VALUES
+  ('agenda_calendar', 'Agenda', 'Tela de Agendamento', true, true, true, 'mapped', 'feature', 'agenda', 'agenda.read', '{}'::text[], 'The agenda screen. RLS on public.appointments/schedules is keyed on agenda.* (043); plugin-agenda still gates its UI on appointments.* — see the divergence note.'),
+  ('agenda_confirmation', 'Agenda', 'Confirmação de Agendamentos', true, true, true, 'mapped', 'feature', 'agenda', 'agenda.read', '{}'::text[], 'Sub-screen of the agenda (WhatsApp confirmations); coarser: V2 has no finer key yet.'),
+  ('checkin_dashboard', 'Agenda', 'Check-in de Clientes', true, true, true, 'mapped', 'feature', 'agenda', 'agenda.read', '{}'::text[], 'Client check-in is an agenda flow (PRD 07 FieldRules check-in); coarser.'),
+  ('agenda_reservations', 'Agenda', 'Reservas', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Table/slot reservations — plugin-tables (`tables.*`) once it declares features.'),
+  ('agenda_schedules', 'Agenda', 'Escalas', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced in V1. Natural target: agenda.schedules.* (plugin-agenda declares it).'),
+  ('appointments_confirm', 'Agenda', 'Confirmação de Agendamentos', true, false, false, 'dropped', NULL, NULL, NULL, '{}'::text[], 'Inactive since the 2026-05-12 reseed; superseded by agenda_confirmation.'),
+  ('appointments_schedule', 'Agenda', 'Tela de Agendamento', true, false, false, 'dropped', NULL, NULL, NULL, '{}'::text[], 'Inactive since the 2026-05-12 reseed; superseded by agenda_calendar.'),
+  ('clients_list', 'Clientes', 'Listar Clientes', true, true, true, 'mapped', 'feature', 'people', 'people.read', '{}'::text[], 'The client list: view/insert/edit/delete map 1:1 to people.read/create/edit/delete.'),
+  ('clients_create', 'Clientes', 'Cadastrar Cliente', true, true, true, 'mapped', 'key', NULL, 'people.create', '{}'::text[], 'The "new client" screen; any granted flag becomes people.create.'),
+  ('clients_card', 'Clientes', 'Ficha do Cliente', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced. Natural target: people.read (+ people.read_all for the full record of others’ clients).'),
+  ('clients_manage', 'Clientes', 'Gerenciar Clientes', true, false, false, 'dropped', NULL, NULL, NULL, '{}'::text[], 'Inactive since the 2026-05-12 reseed; superseded by clients_list/clients_create.'),
+  ('communication_dashboard', 'Comunicação', 'Comunicação', true, true, true, 'mapped', 'feature', 'automations', 'automations.read', '{}'::text[], 'V1 "Comunicação" (WhatsApp templates, triggers, dispatch log) is plugin-automations in V2 (messaging moved under Automações); coarser.'),
+  ('communication_manual_confirmation', 'Comunicação', 'Confirmação Manual (Mensagem)', true, true, true, 'mapped', 'feature', 'automations', 'automations.read', '{}'::text[], 'Manual confirmation message config; coarser (automations.*).'),
+  ('communication_dispatch_log', 'Comunicação', 'Log de Disparos', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced. Natural target: automations.read.'),
+  ('communication_events', 'Comunicação', 'Eventos / Gatilhos', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced. Natural target: automations.manage.'),
+  ('communication_templates', 'Comunicação', 'Templates de Mensagem', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced. Natural target: automations.manage.'),
+  ('communication_whatsapp', 'Comunicação', 'WhatsApp Config', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced. Natural target: conversations.manage / settings.manage.'),
+  ('config_communication', 'Configurações', 'Comunicação', true, false, false, 'dropped', NULL, NULL, NULL, '{}'::text[], 'Inactive since the 2026-05-12 reseed.'),
+  ('config_hub', 'Configurações', 'Hub de Configurações', true, true, true, 'mapped', 'feature', 'settings', 'settings.read', '{}'::text[], 'The settings hub: view→settings.read, edit→settings.manage.'),
+  ('config_appearance', NULL, NULL, false, NULL, true, 'mapped', 'feature', 'settings', 'settings.read', '{}'::text[], 'Branding (logo/name) — tenant settings (PRD 02 R5). Not seeded by any migration in the V1 repo (exists only in the live table).'),
+  ('config_company', 'Configurações', 'Empresa', true, true, true, 'mapped', 'feature', 'units', 'units.read', '{}'::text[], 'Empresa = the legal entity a unit references (PRD 02 R2, #138): units.read/units.manage.'),
+  ('config_company_type', 'Configurações', 'Tipo de Empresa', true, true, true, 'mapped', 'feature', 'tenant', 'tenant.read', '{}'::text[], 'Franchise mode → tenants.kind (ADR 0002): tenant.read/tenant.manage.'),
+  ('config_cancellation_rules', 'Configurações', 'Regras de Cancelamento', true, true, true, 'mapped', 'feature', 'agenda', 'agenda.read', '{}'::text[], 'Appointment cancellation policy — agenda settings; coarser.'),
+  ('config_holidays', 'Configurações', 'Feriados', true, true, true, 'mapped', 'feature', 'agenda', 'agenda.read', '{}'::text[], 'Holidays feed the agenda availability; coarser.'),
+  ('config_chart_accounts', 'Configurações', 'Plano de Contas', true, true, true, 'mapped', 'feature', 'financial', 'financial.read', '{}'::text[], 'plg_financial_chart_of_accounts is financial data: financial.read/manage.'),
+  ('config_cost_centers', 'Configurações', 'Centros de Custo', true, true, true, 'mapped', 'feature', 'financial', 'financial.read', '{}'::text[], 'plg_financial_cost_centers: financial.read/manage.'),
+  ('config_payment_methods', 'Configurações', 'Formas de Recebimento', true, true, true, 'mapped', 'feature', 'financial', 'financial.read', '{}'::text[], 'plg_financial_payment_methods: financial.read/manage.'),
+  ('config_commission_rules', 'Configurações', 'Regras de Comissão', true, true, true, 'mapped', 'feature', 'financial.commissions', 'financial.commissions.read', '{}'::text[], 'Commission rules live with commissions.'),
+  ('config_discount_rules', 'Configurações', 'Regras de Desconto', true, true, true, 'mapped', 'feature', 'orders', 'orders.read', '{}'::text[], 'Discount rules apply to orders/bills; coarser.'),
+  ('config_cover_charge', 'Configurações', 'Taxas de Ingresso', true, true, true, 'mapped', 'feature', 'orders', 'orders.read', '{}'::text[], 'Cover charge is an order fee (chef); coarser.'),
+  ('config_service_charge', 'Configurações', 'Taxa de Serviço', true, true, true, 'mapped', 'feature', 'orders', 'orders.read', '{}'::text[], 'Service charge is an order fee (chef); coarser.'),
+  ('config_price_tables', 'Configurações', 'Tabelas de Preço', true, true, true, 'mapped', 'feature', 'catalog', 'catalog.read', '{}'::text[], 'Price tables are catalog pricing (PRD 04).'),
+  ('config_price_variations', 'Configurações', 'Variações de Preço', true, true, true, 'mapped', 'feature', 'catalog', 'catalog.read', '{}'::text[], 'Price variations are catalog pricing (PRD 04).'),
+  ('config_field_visibility', 'Configurações', 'Ocultação de Dados', true, true, true, 'mapped', 'feature', 'settings', 'settings.read', '{}'::text[], 'FieldRules (PRD 07): tenant configuration → settings.*.'),
+  ('config_required_fields', 'Configurações', 'Campos Obrigatórios', true, true, true, 'mapped', 'feature', 'settings', 'settings.read', '{}'::text[], 'FieldRules (PRD 07): tenant configuration → settings.*.'),
+  ('config_forms', 'Configurações', 'Formulários', true, true, true, 'mapped', 'feature', 'custom_forms', 'custom_forms.read', '{}'::text[], 'plugin-forms (custom_forms.*).'),
+  ('config_permission_rules', 'Configurações', 'Regras de Permissão', true, true, true, 'mapped', 'feature', 'roles', 'roles.read', '{}'::text[], 'The permission-rules screen becomes the roles editor: roles.read/roles.manage.'),
+  ('config_contracts', 'Configurações', 'Modelos de Contratos', true, true, true, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Contract templates: no V2 surface (plugin-crm has leads/quotes/pipeline, no contracts).'),
+  ('config_qr_access', 'Configurações', 'Acesso por QR Code', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced; QR-code unit access has no V2 surface.'),
+  ('config_software_profile', 'Configurações', 'Perfil de Software', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced; software profiles become tenant plugin configuration (PRD 02 R3), not a permission.'),
+  ('crm_dashboard', 'Marketing', 'CRM', true, true, true, 'mapped', 'feature', 'sales', 'sales.read', '{}'::text[], 'plugin-crm’s main feature id is `sales`.'),
+  ('marketing_dashboard', 'Marketing', 'Marketing', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced. Natural target: marketing.read.'),
+  ('marketing_online_booking', 'Marketing', 'Agendamento Online', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced. Public booking config → agenda settings.'),
+  ('dashboard_alerts', 'Dashboard', 'Alertas e Destaques', true, true, true, 'mapped', 'feature', 'dashboard', 'dashboard.read', '{}'::text[], 'Operational widget → dashboard.read.'),
+  ('dashboard_appointments_status', 'Dashboard', 'Status dos Agendamentos', true, true, true, 'mapped', 'feature', 'dashboard', 'dashboard.read', '{}'::text[], 'Operational widget (V1 also inferred it from agenda_calendar).'),
+  ('dashboard_kpi_operational', 'Dashboard', 'KPIs Operacionais', true, true, true, 'mapped', 'feature', 'dashboard', 'dashboard.read', '{}'::text[], 'Operational widget (V1 also inferred it from agenda_calendar).'),
+  ('dashboard_top_services', 'Dashboard', 'Top Serviços', true, true, true, 'mapped', 'feature', 'dashboard', 'dashboard.read', '{}'::text[], 'Operational widget.'),
+  ('dashboard_units_ranking', 'Dashboard', 'Ranking de Unidades', true, true, true, 'mapped', 'feature', 'dashboard', 'dashboard.read', '{}'::text[], 'Operational widget (unit scope comes from user_unit_access, not from a permission).'),
+  ('dashboard_weekly_trend', 'Dashboard', 'Desempenho 7 Dias', true, true, true, 'mapped', 'feature', 'dashboard', 'dashboard.read', '{}'::text[], 'Operational widget.'),
+  ('dashboard_monthly_trend', 'Dashboard', 'Tendência Mensal', true, true, true, 'mapped', 'feature', 'dashboard', 'dashboard.read', '{}'::text[], 'Operational widget.'),
+  ('dashboard_goals', 'Dashboard', 'Metas de Vendas', true, true, true, 'mapped', 'feature', 'dashboard', 'dashboard.read', '{}'::text[], 'Sales goals widget.'),
+  ('dashboard_kpi_consolidated', 'Dashboard', 'KPIs Consolidados', true, true, true, 'mapped', 'feature', 'financial', 'financial.read', '{}'::text[], 'Money widget: V1 never let it inherit from the agenda; V2 gates money on financial.read.'),
+  ('dashboard_payables', 'Dashboard', 'Contas a Pagar (Dashboard)', true, true, true, 'mapped', 'feature', 'financial.payables', 'financial.payables.read', '{}'::text[], 'Money widget → financial.payables.read.'),
+  ('dashboard_receivables', 'Dashboard', 'Contas a Receber (Dashboard)', true, true, true, 'mapped', 'feature', 'financial.receivables', 'financial.receivables.read', '{}'::text[], 'Money widget → financial.receivables.read.'),
+  ('dashboard_stock_critical', 'Dashboard', 'Estoque Crítico', true, true, true, 'mapped', 'feature', 'inventory', 'inventory.read', '{}'::text[], 'Stock widget → inventory.read.'),
+  ('dashboard_revenue_by_service', 'Dashboard', 'Receita por Serviço', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced. Natural target: financial.read.'),
+  ('financial_dashboard', 'Financeiro', 'Financeiro (Painel)', true, true, true, 'mapped', 'feature', 'financial', 'financial.read', '{}'::text[], 'The financial panel.'),
+  ('financial_payable', 'Financeiro', 'Contas a Pagar', true, true, true, 'mapped', 'feature', 'financial.payables', 'financial.payables.read', '{}'::text[], 'Contas a pagar.'),
+  ('financial_receivable', 'Financeiro', 'Contas a Receber', true, true, true, 'mapped', 'feature', 'financial.receivables', 'financial.receivables.read', '{}'::text[], 'Contas a receber.'),
+  ('financial_cash', 'Financeiro', 'Caixas', true, true, true, 'mapped', 'feature', 'financial', 'financial.read', ARRAY['financial.read_all']::text[], 'Managerial view of every cash register of the units: financial.* plus read_all (sessions are owner-scoped rows).'),
+  ('financial_cash_receipt', 'Financeiro', 'Receber pelo Caixinha', true, true, true, 'mapped', 'key', NULL, 'financial.cash_session', ARRAY['financial.create']::text[], 'Receive through the caixinha: open/operate a session + create movements.'),
+  ('financial_cash_payment', 'Financeiro', 'Pagar pelo Caixinha', true, true, true, 'mapped', 'key', NULL, 'financial.cash_session', ARRAY['financial.create']::text[], 'Pay through the caixinha: open/operate a session + create movements.'),
+  ('financial_cash_review', 'Financeiro', 'Conferência de Caixa', true, true, true, 'mapped', 'feature', 'financial', 'financial.read', ARRAY['financial.read_all']::text[], 'Review/approve closings of other users’ sessions: read_all + edit.'),
+  ('financial_cash_own', 'Financeiro', 'Caixa Próprio', true, false, true, 'dropped', NULL, NULL, NULL, '{}'::text[], 'Deactivated by 20260803150000 (superseded by financial_cash_receipt/payment); still named in one V1 RPC.'),
+  ('financial_bank_statement', 'Financeiro', 'Extrato Bancário', true, true, true, 'mapped', 'feature', 'financial', 'financial.read', '{}'::text[], 'Bank accounts and statements.'),
+  ('financial_reconciliation', NULL, NULL, false, NULL, true, 'mapped', 'feature', 'financial', 'financial.read', '{}'::text[], 'Bank reconciliation. Not seeded by any migration in the V1 repo. plugin-banking-br (openbanking) declares no feature yet; financial.* is the coarser home.'),
+  ('financial_recurring_bills', NULL, NULL, false, NULL, true, 'mapped', 'feature', 'financial.payables', 'financial.payables.read', '{}'::text[], 'Recurring bills are payables. Not seeded by any migration in the V1 repo.'),
+  ('financial_ai_expense', NULL, NULL, false, NULL, true, 'mapped', 'feature', 'financial.payables', 'financial.payables.read', '{}'::text[], 'AI expense extraction creates payables. Not seeded by any migration in the V1 repo.'),
+  ('financial_commissions', 'Financeiro', 'Comissões', true, true, true, 'mapped', 'feature', 'financial.commissions', 'financial.commissions.read', '{}'::text[], 'Commissions.'),
+  ('financial_credit_card', 'Financeiro', 'Cartões de Crédito', true, true, true, 'mapped', 'feature', 'financial', 'financial.read', '{}'::text[], 'Card brands / card fees (plg_financial_card_brands).'),
+  ('financial_payment', 'Financeiro', 'Pagamento (geral)', true, true, true, 'mapped', 'key', NULL, 'financial.payables.edit', '{}'::text[], 'Settle a payable without a cash session (settlement gate).'),
+  ('financial_receipt', 'Financeiro', 'Recebimento (geral)', true, true, true, 'mapped', 'key', NULL, 'financial.receivables.edit', '{}'::text[], 'Settle a receivable without a cash session (settlement gate).'),
+  ('financial_payment_unlink', 'Financeiro', 'Desvincular pagamento de parcela', true, true, true, 'mapped', 'key', NULL, 'financial.edit', '{}'::text[], 'Unlink a payment from an installment; V2 has no finer key — coarser.'),
+  ('financial_gift_cards', 'Financeiro', 'Gift Cards', true, true, true, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Gift cards have no V2 surface.'),
+  ('financial_reports', 'Financeiro', 'Extratos e Relatórios', true, false, false, 'dropped', NULL, NULL, NULL, '{}'::text[], 'Inactive since the 2026-05-12 reseed; reports_* superseded it.'),
+  ('financial_free_transaction', 'Financeiro', 'Transacionar sem Caixa', true, false, false, 'dropped', NULL, NULL, NULL, '{}'::text[], 'Deactivated by 20260803150000 (superseded by financial_payment/receipt).'),
+  ('inventory_dashboard', 'Estoque', 'Estoque (Painel)', true, true, true, 'mapped', 'feature', 'inventory', 'inventory.read', '{}'::text[], 'The stock panel.'),
+  ('inventory_movements', 'Estoque', 'Movimentações', true, true, true, 'mapped', 'feature', 'inventory', 'inventory.read', '{}'::text[], 'Stock movements (plg_inventory_stock_movements).'),
+  ('inventory_products', 'Estoque', 'Produtos', true, true, true, 'mapped', 'feature', 'catalog', 'catalog.read', '{}'::text[], 'Products are catalog items in V2 (public.products, PRD 04).'),
+  ('inventory_categories', NULL, NULL, false, NULL, true, 'mapped', 'feature', 'inventory', 'inventory.read', '{}'::text[], 'plg_inventory_product_categories. Not seeded by any migration in the V1 repo.'),
+  ('inventory_recipes', NULL, NULL, false, NULL, true, 'mapped', 'feature', 'inventory.recipes', 'inventory.recipes.read', '{}'::text[], 'plugin-inventory declares inventory.recipes when the module is on. Not seeded by any migration in the V1 repo.'),
+  ('inventory_stock_locations', NULL, NULL, false, NULL, true, 'mapped', 'feature', 'inventory', 'inventory.read', '{}'::text[], 'plg_inventory_stock_locations. Not seeded by any migration in the V1 repo.'),
+  ('inventory_danfe', 'Estoque', 'Importação DANFE', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced; DANFE import has no V2 key (plg_financial_nfe exists without a permission).'),
+  ('fiscal_dashboard', NULL, NULL, false, NULL, true, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Enforced in V1 (InventorySidebar) but no V2 fiscal surface yet; not seeded by any migration in the V1 repo.'),
+  ('fiscal_dfe_inbox', NULL, NULL, false, NULL, true, 'backlog', NULL, NULL, NULL, '{}'::text[], 'No V2 fiscal surface; not seeded by any migration in the V1 repo.'),
+  ('fiscal_dfe_manifest', NULL, NULL, false, NULL, true, 'backlog', NULL, NULL, NULL, '{}'::text[], 'No V2 fiscal surface; not seeded by any migration in the V1 repo.'),
+  ('fiscal_danfe_import', NULL, NULL, false, NULL, true, 'backlog', NULL, NULL, NULL, '{}'::text[], 'No V2 fiscal surface; not seeded by any migration in the V1 repo.'),
+  ('fiscal_groups', NULL, NULL, false, NULL, true, 'backlog', NULL, NULL, NULL, '{}'::text[], 'No V2 fiscal surface; not seeded by any migration in the V1 repo.'),
+  ('production_dashboard', 'Produção', 'Produção (Painel)', true, true, true, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Enforced in V1 (InventorySidebar) but V2 has no production plugin.'),
+  ('production_orders', 'Produção', 'Ordens de Produção', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced (only mentioned); no V2 production plugin.'),
+  ('production_execution', 'Produção', 'Execução (estação)', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced; no V2 production plugin.'),
+  ('production_planning', 'Produção', 'Planejamento e MRP', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced; no V2 production plugin.'),
+  ('production_traceability', 'Produção', 'Lotes e Rastreabilidade', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced; no V2 production plugin.'),
+  ('operations_dashboard', 'Operação', 'Operação', true, true, true, 'mapped', 'feature', 'orders', 'orders.read', '{}'::text[], 'The chef "Operação" module (POS/bills) is orders in V2; coarser.'),
+  ('restaurant_orders', 'Restaurante', 'Pedidos / Comandas', true, true, true, 'mapped', 'feature', 'orders', 'orders.read', '{}'::text[], 'Bills/comandas are orders (ADR 0004).'),
+  ('restaurant_menu', 'Restaurante', 'Cardápio', true, true, true, 'mapped', 'feature', 'menu', 'menu.read', '{}'::text[], 'plugin-menu gates on menu.* (referenced feature).'),
+  ('restaurant_product_prices', NULL, NULL, false, NULL, true, 'mapped', 'key', NULL, 'menu.edit', '{}'::text[], 'Edit menu product prices. Not seeded by any migration in the V1 repo.'),
+  ('restaurant_product_toggle_active', NULL, NULL, false, NULL, true, 'mapped', 'key', NULL, 'menu.edit', '{}'::text[], 'Toggle a menu product. Not seeded by any migration in the V1 repo.'),
+  ('restaurant_delivery', 'Restaurante', 'Delivery', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced; delivery has no V2 surface.'),
+  ('restaurant_kitchen', 'Restaurante', 'Cozinha / Painéis', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced. Natural target: orders.read (kitchen role template already reads orders).'),
+  ('register_bank_accounts', 'Cadastros', 'Contas Bancárias', true, true, true, 'mapped', 'feature', 'financial', 'financial.read', '{}'::text[], 'plg_financial_bank_accounts.'),
+  ('register_contacts', 'Cadastros', 'Contatos', true, true, true, 'mapped', 'feature', 'people', 'people.read', '{}'::text[], 'Contacts are people (PRD 03).'),
+  ('register_employees', 'Cadastros', 'Funcionários', true, true, true, 'mapped', 'feature', 'people', 'people.read', '{}'::text[], 'Employees are people with a role (ADR 0003); membership itself is members.*.'),
+  ('register_professionals', 'Cadastros', 'Profissionais', true, true, true, 'mapped', 'feature', 'people', 'people.read', '{}'::text[], 'Professionals are people with a role (ADR 0003).'),
+  ('register_suppliers', 'Cadastros', 'Fornecedores', true, true, true, 'mapped', 'feature', 'people', 'people.read', '{}'::text[], 'Suppliers are people (PRD 03).'),
+  ('register_partnerships', 'Cadastros', 'Parcerias', true, true, true, 'mapped', 'feature', 'people', 'people.read', '{}'::text[], 'Partners are people of kind partner (PRD 03); coarser.'),
+  ('register_origins', 'Cadastros', 'Origens', true, true, true, 'mapped', 'feature', 'people', 'people.read', '{}'::text[], 'Client origins are a people attribute registry; coarser.'),
+  ('register_services', 'Cadastros', 'Serviços', true, true, true, 'mapped', 'feature', 'catalog', 'catalog.read', '{}'::text[], 'Services are catalog items (public.services, PRD 04).'),
+  ('register_equipment', 'Cadastros', 'Equipamentos', true, true, true, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Enforced in V1 (Header) but equipment has no V2 surface.'),
+  ('register_locations', 'Cadastros', 'Locais Operacionais', true, true, true, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Enforced in V1 (Header). service_locations are inside a unit, an agenda extension in Phase 2 (PRD 02 R1) — not units.'),
+  ('register_pet_species', NULL, NULL, false, NULL, true, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Pet vertical registry; no V2 surface. Not seeded by any migration in the V1 repo.'),
+  ('sales_quotes', 'Vendas', 'Orçamentos', true, true, true, 'mapped', 'feature', 'crm.quotes', 'crm.quotes.read', '{}'::text[], 'plugin-crm quotes.'),
+  ('sales_packages', 'Vendas', 'Pacotes de Serviço', true, true, true, 'mapped', 'feature', 'catalog', 'catalog.read', '{}'::text[], 'Service packages are catalog items (kits, PRD 04).'),
+  ('sales_contracts', 'Vendas', 'Contratos', true, true, true, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Enforced in V1 (Header) but contracts have no V2 surface.'),
+  ('service_execution_manual', 'Atendimento', 'Execução manual de serviço', true, true, true, 'mapped', 'key', NULL, 'orders.edit', '{}'::text[], 'Register a service as executed outside the agenda flow: an order-item edit (ADR 0004).'),
+  ('reports_dashboard', 'Relatórios', 'Relatórios', true, true, true, 'mapped', 'feature', 'reports', 'reports.read', '{}'::text[], 'The reports home.'),
+  ('reports_panels', 'Relatórios', 'Painéis Customizados', true, true, true, 'mapped', 'feature', 'reports', 'reports.read', '{}'::text[], 'Custom panels; coarser.'),
+  ('reports_agenda', 'Relatórios', 'Relatórios de Agenda', true, true, true, 'mapped', 'feature', 'reports', 'reports.read', '{}'::text[], 'V2 report cards are owned by the domain plugin and gate on reports.read + the domain’s read; coarser.'),
+  ('reports_clientes', 'Relatórios', 'Relatórios de Clientes', true, true, true, 'mapped', 'feature', 'reports', 'reports.read', '{}'::text[], 'See reports_agenda.'),
+  ('reports_estoque', 'Relatórios', 'Relatórios de Estoque', true, true, true, 'mapped', 'feature', 'reports', 'reports.read', '{}'::text[], 'See reports_agenda.'),
+  ('reports_financeiro', 'Relatórios', 'Relatórios Financeiros', true, true, true, 'mapped', 'feature', 'reports', 'reports.read', '{}'::text[], 'See reports_agenda; money reports additionally need financial.read at the card.'),
+  ('reports_gestao', 'Relatórios', 'Relatórios de Gestão', true, true, true, 'mapped', 'feature', 'reports', 'reports.read', '{}'::text[], 'See reports_agenda.'),
+  ('reports_marketing', 'Relatórios', 'Relatórios de Marketing', true, true, true, 'mapped', 'feature', 'reports', 'reports.read', '{}'::text[], 'See reports_agenda.'),
+  ('reports_profissionais', 'Relatórios', 'Relatórios de Profissionais', true, true, true, 'mapped', 'feature', 'reports', 'reports.read', '{}'::text[], 'See reports_agenda.'),
+  ('reports_servicos', 'Relatórios', 'Relatórios de Serviços', true, true, true, 'mapped', 'feature', 'reports', 'reports.read', '{}'::text[], 'See reports_agenda.'),
+  ('reports_view', 'Relatórios', 'Relatórios', true, false, false, 'dropped', NULL, NULL, NULL, '{}'::text[], 'Inactive since the 2026-05-12 reseed; reports_* superseded it.'),
+  ('special_qr_access_issue', 'Ações Especiais', 'Liberar acesso por QR Code', true, true, true, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Enforced in V1 (Header); QR-code unit access has no V2 surface.'),
+  ('special_qr_access_required', 'Ações Especiais', 'Exigir liberação por QR Code', true, true, true, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Enforced in V1 SQL (user_requires_qr_access); no V2 surface.'),
+  ('special_time_clock_adjust', 'Ações Especiais', 'Ajustar Registros de Ponto', true, true, true, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Enforced in V1 (TimeClockRegistry); time clock has no V2 surface.'),
+  ('special_time_clock_launch_payables', 'Ações Especiais', 'Lançar Ponto em Contas a Pagar', true, true, true, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Enforced in V1 (TimeClockRegistry); time clock has no V2 surface.'),
+  ('special_unmatch_reconciled', NULL, NULL, false, NULL, true, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Enforced in V1 (ReconciliationCard); undo-reconciliation has no V2 key. Not seeded by any migration in the V1 repo.'),
+  ('special_approve_quote', 'Ações Especiais', 'Aprovar/Rejeitar Orçamento', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced. Natural target: a crm.quotes custom action.'),
+  ('special_bulk_import', 'Ações Especiais', 'Importação em Massa', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced.'),
+  ('special_cancel_no_pin', 'Ações Especiais', 'Cancelar Item Sem PIN', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced. Natural target: an orders custom action.'),
+  ('special_delete_paid_order_item', 'Ações Especiais', 'Excluir Item de Pedido Pago', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced. Natural target: an orders custom action.'),
+  ('special_discount_no_pin', 'Ações Especiais', 'Aplicar Desconto Sem PIN', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced. Natural target: an orders custom action.'),
+  ('special_edit_paid_financial', 'Ações Especiais', 'Editar Lançamento com Pagamento', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced. Natural target: a financial custom action.'),
+  ('special_edit_payment_history', 'Ações Especiais', 'Editar Histórico de Pagamentos', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced. Natural target: a financial custom action.'),
+  ('special_export_sensitive', 'Ações Especiais', 'Exportar Relatórios Sensíveis', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced. Natural target: a reports custom action.'),
+  ('special_reopen_closed_bill', 'Ações Especiais', 'Reabrir Comanda Fechada', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced. Natural target: an orders custom action.'),
+  ('special_other_user_cash', 'Ações Especiais', 'Acessar Caixa de Outro Usuário', true, false, false, 'dropped', NULL, NULL, NULL, '{}'::text[], 'Deactivated by 20260803150000; superseded by financial_cash_review / financial.read_all.'),
+  ('special_super_admin', 'Ações Especiais', 'Acessar Super Admin', true, true, false, 'dropped', NULL, NULL, NULL, '{}'::text[], 'Platform super-admin is not a tenant permission in V2 (no bypass in code, R9).'),
+  ('permissions_enforcement_enabled', 'general_settings', NULL, false, NULL, false, 'dropped', NULL, NULL, NULL, '{}'::text[], 'general_settings flag, not a code: RLS is the law (PRD 02 R4). Never migrates.')
+ON CONFLICT (v1_code) DO UPDATE SET
+  v1_category = EXCLUDED.v1_category, v1_name = EXCLUDED.v1_name,
+  seeded_in_repo = EXCLUDED.seeded_in_repo, active_in_v1 = EXCLUDED.active_in_v1, enforced_in_v1 = EXCLUDED.enforced_in_v1,
+  status = EXCLUDED.status, kind = EXCLUDED.kind, v2_feature = EXCLUDED.v2_feature, v2_key = EXCLUDED.v2_key,
+  v2_extra_keys = EXCLUDED.v2_extra_keys, note = EXCLUDED.note, updated_at = now();
+
+-- ── every target must exist in the catalog (060 ran first) ──────────────
+-- A mapping onto a key the catalog does not have is a typo, not a decision:
+-- fail the migration rather than let the extractor grant nothing silently.
+DO $$
+DECLARE v_missing text;
+BEGIN
+  SELECT string_agg(k, ', ' ORDER BY k) INTO v_missing FROM (
+    SELECT m.v2_feature || '.read' AS k FROM app.v1_permission_map m WHERE m.kind = 'feature'
+      AND NOT EXISTS (SELECT 1 FROM app.permissions p WHERE p.key = m.v2_feature || '.read')
+    UNION
+    SELECT unnest(m.v2_extra_keys) FROM app.v1_permission_map m
+    EXCEPT
+    SELECT p.key FROM app.permissions p
+  ) s;
+  IF v_missing IS NOT NULL THEN
+    RAISE EXCEPTION 'v1_permission_map: targets missing from app.permissions: %', v_missing;
+  END IF;
+END $$;
+
+-- ── the expansion: one V1 rule detail → the V2 keys to grant ────────────
+-- kind='feature': view→F.read, insert→F.create, edit→F.edit, delete→F.delete;
+-- when the action key does not exist for that feature (settings/tenant/units/
+-- roles have read+manage only) the write flags fall back to F.manage.
+-- kind='key': any true flag grants v2_key. Extra keys ride along whenever any
+-- flag is true. Unknown/backlog/dropped codes expand to nothing.
+CREATE OR REPLACE FUNCTION app.v1_permission_keys(
+  p_code text, p_view boolean DEFAULT false, p_insert boolean DEFAULT false, p_edit boolean DEFAULT false, p_delete boolean DEFAULT false
+) RETURNS text[]
+LANGUAGE plpgsql STABLE SECURITY DEFINER SET search_path = ''
+AS $$
+DECLARE
+  m   app.v1_permission_map%ROWTYPE;
+  out text[] := '{}';
+  any_flag boolean := coalesce(p_view, false) OR coalesce(p_insert, false) OR coalesce(p_edit, false) OR coalesce(p_delete, false);
+BEGIN
+  SELECT * INTO m FROM app.v1_permission_map WHERE v1_code = p_code;
+  IF NOT FOUND OR m.status <> 'mapped' OR NOT any_flag THEN
+    RETURN '{}';
+  END IF;
+  IF m.kind = 'key' THEN
+    out := ARRAY[m.v2_key];
+  ELSE
+    IF coalesce(p_view, false) THEN out := out || (m.v2_feature || '.read'); END IF;
+    IF coalesce(p_insert, false) THEN out := out || CASE WHEN EXISTS (SELECT 1 FROM app.permissions WHERE key = m.v2_feature || '.create') THEN m.v2_feature || '.create' ELSE m.v2_feature || '.manage' END; END IF;
+    IF coalesce(p_edit, false)   THEN out := out || CASE WHEN EXISTS (SELECT 1 FROM app.permissions WHERE key = m.v2_feature || '.edit')   THEN m.v2_feature || '.edit'   ELSE m.v2_feature || '.manage' END; END IF;
+    IF coalesce(p_delete, false) THEN out := out || CASE WHEN EXISTS (SELECT 1 FROM app.permissions WHERE key = m.v2_feature || '.delete') THEN m.v2_feature || '.delete' ELSE m.v2_feature || '.manage' END; END IF;
+  END IF;
+  out := out || m.v2_extra_keys;
+  -- only keys the catalog knows, deduplicated, stable order
+  SELECT coalesce(array_agg(DISTINCT k ORDER BY k), '{}') INTO out
+    FROM unnest(out) k WHERE EXISTS (SELECT 1 FROM app.permissions p WHERE p.key = k);
+  RETURN out;
+END $$;
+REVOKE ALL ON FUNCTION app.v1_permission_keys(text, boolean, boolean, boolean, boolean) FROM public, anon;
+GRANT EXECUTE ON FUNCTION app.v1_permission_keys(text, boolean, boolean, boolean, boolean) TO authenticated, service_role;
+
+-- Read view for tooling/UI (security_invoker; the table is readable by any signed-in user).
+CREATE OR REPLACE VIEW public.v_authz_v1_permission_map WITH (security_invoker = true) AS
+  SELECT v1_code, v1_category, v1_name, seeded_in_repo, active_in_v1, enforced_in_v1, status, kind, v2_feature, v2_key, v2_extra_keys, note
+    FROM app.v1_permission_map;
+GRANT SELECT ON public.v_authz_v1_permission_map TO authenticated, service_role;