@fayz-ai/db 0.12.0 → 0.13.0

package/migrations/101_migration_allowlist.sql

@@ -0,0 +1,202 @@
+-- ============================================================================
+-- 101_migration_allowlist.sql — the frozen core-A extraction allowlist
+-- (core-beauty-chef.md §3.1) and the tables the extractor must never send.
+--
+-- Data every destination needs, so it is a migration, not a seed. Rows are
+-- frozen: changing one is a new migration file, not an UPDATE (the trigger of
+-- 090 refuses writes unless the session unlocks, as this file does).
+--
+-- Column maps: "target_col" copies, "target_col@source_table" resolves a V1
+-- reference through the ledger (unresolved ⇒ quarantine 'fk'), "jsonb:a.b"
+-- lands in the destination row's metadata (vertical data, ADR 0009), "-" is
+-- dropped on purpose (documented minimisation, PRD 03 R7). Maps for tables
+-- without a writer are coarse: the notable columns and where they go; the
+-- domain slice that ships the destination completes them with its writer.
+-- ============================================================================
+
+SELECT set_config('migration.allowlist_unlock', 'on', false);
+
+CREATE OR REPLACE FUNCTION migration._allow(
+  p_source text, p_target text, p_domain text, p_writer text, p_writer_args jsonb,
+  p_financial text[], p_columns jsonb, p_notes text
+) RETURNS void LANGUAGE sql SECURITY DEFINER SET search_path = '' AS $$
+  INSERT INTO migration.allowlist (source_table, target_table, layer, domain, columns, writer, writer_args, financial_columns, frozen, notes)
+  VALUES (p_source, p_target, 'core-A', p_domain, coalesce(p_columns, '{}'::jsonb), p_writer, coalesce(p_writer_args, '{}'::jsonb), coalesce(p_financial, '{}'), true, p_notes)
+  ON CONFLICT (source_table) DO UPDATE
+    SET target_table = EXCLUDED.target_table, layer = EXCLUDED.layer, domain = EXCLUDED.domain, columns = EXCLUDED.columns,
+        writer = EXCLUDED.writer, writer_args = EXCLUDED.writer_args, financial_columns = EXCLUDED.financial_columns,
+        frozen = true, notes = EXCLUDED.notes;
+$$;
+REVOKE ALL ON FUNCTION migration._allow(text, text, text, text, jsonb, text[], jsonb, text) FROM public, anon, authenticated;
+
+-- ── licence / tenant / unit ─────────────────────────────────────────────
+SELECT migration._allow('licenses', 'public.tenants', 'tenancy', NULL, '{}',
+  '{}', '{"uuid":"id","name":"name","slug":"slug","plan":"jsonb:migration.v1_plan","active":"jsonb:migration.v1_active","max_users":"jsonb:migration.v1_max_users","software_profile_id":"jsonb:migration.v1_software_profile_id","time_clock_enabled":"-"}',
+  'ADR 0002: a licence is a tenant (kind business; network when general_settings.company_type = franquia). The tenant is provisioned by a human before batch_open; this row documents the map, the destination does not create tenants.');
+SELECT migration._allow('licenses_admin', 'public.tenants', 'tenancy', NULL, '{}', '{}', '{"license_id":"jsonb:migration.license_id"}',
+  'Platform-admin view of licences: tenant settings/plan metadata; no writer.');
+SELECT migration._allow('license_users', 'app.memberships', 'tenancy', NULL, '{}', '{}',
+  '{"uuid":"id","license_id":"tenant_id","user_id":"user_id","role":"role_id","email":"-","active":"active"}',
+  'A membership needs an auth.users row the destination cannot mint for a real login: the human invites (transactional invite RPC, #134); role mapped via the permission catalog (#136).');
+SELECT migration._allow('profiles', 'public.people', 'tenancy', NULL, '{}', '{}', '{"id":"-","full_name":"name","email":"email","avatar_url":"avatar_url"}',
+  'Login profile: folded into the Person of the member (memberships.person_id, PRD 03 R3); no writer.');
+SELECT migration._allow('modules', 'public.tenants', 'tenancy', NULL, '{}', '{}', '{"code":"jsonb:modules"}', 'PRD 02 R3: modules become tenant configuration (enabled plugins), not a table.');
+SELECT migration._allow('software_profiles', 'public.tenants', 'tenancy', NULL, '{}', '{}', '{"name":"jsonb:software_profile"}', 'PRD 02 R3: software profile → tenant configuration.');
+SELECT migration._allow('software_profile_modules', 'public.tenants', 'tenancy', NULL, '{}', '{}', '{}', 'PRD 02 R3: profile × module → tenant configuration.');
+SELECT migration._allow('tenant_domains', 'public.tenants', 'tenancy', NULL, '{}', '{}', '{"domain":"jsonb:branding.domain","logo_url":"jsonb:branding.logo_url"}', 'PRD 02 R5: branding/domain into tenant settings; login must survive a branding failure.');
+SELECT migration._allow('companies', 'app.units', 'tenancy', 'unit', '{"default_kind":"branch"}', '{}',
+  '{"uuid":"id","tenant_id":"-","legal_name":"name","trade_name":"jsonb:trade_name","abbreviation":"jsonb:abbreviation","is_headquarters":"kind","active":"active","cnpj":"jsonb:legal.cnpj","location_group_id":"parent_unit_id@location_groups","address":"jsonb:address.street","address_number":"jsonb:address.number","address_complement":"jsonb:address.complement","neighborhood":"jsonb:address.neighborhood","city":"jsonb:address.city","state":"jsonb:address.state","postal_code":"jsonb:address.postal_code","phone_1":"jsonb:contact.phone_1","phone_2":"jsonb:contact.phone_2","mobile_1":"jsonb:contact.mobile_1","email_1":"jsonb:contact.email_1","whatsapp_number":"jsonb:contact.whatsapp","timezone":"jsonb:timezone","logo_url":"jsonb:branding.logo_url","brand_colors":"jsonb:branding.colors","certificate_cn":"-","certificate_plugnotas_id":"-","dfe_sync_cursor":"-","dfe_last_sync_at":"-"}',
+  'ADR 0002 / PRD 02 R1: a company is a unit (is_headquarters → hq, else branch). CNPJ/legal data go to the legal entity (Empresa, #138) — kept in metadata.legal until that writer exists. A second hq in a tenant is a state quarantine, never a silent demotion.');
+SELECT migration._allow('service_locations', 'app.units', 'tenancy', NULL, '{}', '{}', '{"uuid":"id","company_id":"unit_id@companies","name":"jsonb:name"}',
+  'PRD 02 R1: a service location is a place INSIDE a unit, not a unit — extension of the owning plugin in Phase 2; recorded pending until then.');
+SELECT migration._allow('location_groups', 'app.units', 'tenancy', 'unit', '{"default_kind":"branch","grouping":true}', '{}',
+  '{"uuid":"id","tenant_id":"-","name":"name","description":"jsonb:description","active":"active"}',
+  'PRD 02 R1: a location group is a parent unit (franchisee/region); companies point at it through parent_unit_id.');
+
+-- ── permissions ─────────────────────────────────────────────────────────
+SELECT migration._allow('system_permissions', 'app.permissions', 'authz', NULL, '{}', '{}', '{"code":"key"}', '#136: only the 83 enforced codes map to {plugin}.{action} keys; the catalog is seeded by migrations, not migrated row by row.');
+SELECT migration._allow('permission_rules', 'app.roles', 'authz', NULL, '{}', '{}', '{"uuid":"id","name":"name"}', '#136: a rule is a tenant role.');
+SELECT migration._allow('permission_rule_details', 'app.role_permissions', 'authz', NULL, '{}', '{}', '{"rule_id":"role_id@permission_rules","permission_code":"permission"}', '#136: rule × permission → role_permissions.');
+SELECT migration._allow('employee_permission_rules', 'app.memberships', 'authz', NULL, '{}', '{}', '{"employee_id":"person_id@employees","rule_id":"role_id@permission_rules"}', 'Role of the employee member; through the Person of the employee (PRD 03 R3).');
+SELECT migration._allow('professional_permission_rules', 'app.memberships', 'authz', NULL, '{}', '{}', '{"professional_id":"person_id@professionals","rule_id":"role_id@permission_rules"}', 'Role of the professional member; through the Person of the professional.');
+
+-- ── base configuration ──────────────────────────────────────────────────
+SELECT migration._allow('general_settings', 'public.tenants', 'config', NULL,
+  '{"by_key":true,"never":["permissions_enforcement_enabled"],"later_phase":["attendance_step_order","pos_stock_deduction_enabled","client_menu_config"]}', '{}',
+  '{"setting_key":"jsonb:settings.<key>","setting_value":"jsonb:settings.<key>","category":"-","display_name":"-","options":"-"}',
+  'PRD 02 R4 (default g): migrated BY KEY, never as a table. Core keys → tenants.settings; vertical keys → the owning plugin; permissions_enforcement_enabled never (RLS is the law); beauty/chef keys wait for phases 3/4.');
+SELECT migration._allow('required_field_rules', 'config.field_rules', 'config', NULL, '{}', '{}', '{"context":"context","entity":"entity","field_key":"field_key","visibility":"state"}', 'PRD 07 / #144: 3-state FieldRules per context; the config slice owns the destination table name.');
+SELECT migration._allow('field_visibility_rules', 'config.field_rules', 'config', NULL, '{}', '{}', '{}', 'PRD 07 / #144: folded into FieldRules.');
+SELECT migration._allow('holidays', 'config.holidays', 'config', NULL, '{}', '{}', '{"uuid":"id","date":"date","name":"name","recurring":"recurring","unit_id":"unit_id@companies","units":"jsonb:units"}', 'PRD 07: tenant/unit holidays.');
+SELECT migration._allow('central_holidays', 'config.holidays', 'config', NULL, '{}', '{}', '{"date":"date","name":"name"}', 'National calendar; platform-level rows.');
+-- The three source names below are V1 spelling and stay as V1 wrote them; V2 calls
+-- the destination `access_grants` (the QR is one delivery channel, not the concept).
+SELECT migration._allow('qr_access_configs', 'config.access_grant', 'config', NULL, '{}', '{}', '{"enabled":"enabled","hours_valid":"hours_valid","scan_window_minutes":"scan_window_minutes"}', 'PRD 07 / #144: the V1 config is opaque; it becomes one grant per (unit, role) with channel ''qr''.');
+SELECT migration._allow('qr_access_grants', 'config.access_grant', 'config', NULL, '{}', '{}', '{}', 'PRD 07 / #144: V1 issued codes become access_grants on the ''qr'' channel with a freshly minted secret.');
+SELECT migration._allow('qr_access_sessions', 'config.access_grant', 'config', NULL, '{}', '{}', '{}', 'PRD 07 / #144: live sessions are not migrated (they expire); documented for completeness.');
+
+-- ── people ──────────────────────────────────────────────────────────────
+SELECT migration._allow('clients', 'public.people', 'people', 'person', '{"role":"customer"}', '{}',
+  '{"uuid":"id","tenant_id":"-","name":"name","social_name":"jsonb:social_name","cpf":"document_number","rg":"jsonb:documents.rg","email":"email","phone":"phone","mobile":"jsonb:contact.mobile","birth_date":"date_of_birth","gender":"jsonb:profile.gender","marital_status":"jsonb:profile.marital_status","profession":"jsonb:profile.profession","education":"jsonb:profile.education","nationality":"jsonb:profile.nationality","avatar_url":"avatar_url","address":"address","address_number":"jsonb:address.number","address_complement":"jsonb:address.complement","neighborhood":"jsonb:address.neighborhood","city":"city","state":"state","country":"country","postal_code":"postal_code","notes":"notes","origin":"jsonb:customer.origin","lead_source":"jsonb:customer.lead_source","lead_source_ref":"jsonb:customer.lead_source_ref","referral":"jsonb:customer.referral","origin_referrer_client_id":"jsonb:customer.referrer_client_ref","responsible_client_id":"jsonb:customer.responsible_client_ref","customer_since":"jsonb:customer.since","first_contact_at":"jsonb:customer.first_contact_at","last_contact_at":"jsonb:customer.last_contact_at","last_visit":"jsonb:customer.last_visit","total_visits":"jsonb:customer.total_visits","stage":"jsonb:customer.stage","stage_changed_at":"jsonb:customer.stage_changed_at","identification_color":"jsonb:customer.color","skin_color":"jsonb:beauty.skin_color","hair_color":"jsonb:beauty.hair_color","hair_type":"jsonb:beauty.hair_type","warnings":"jsonb:beauty.warnings","search_text":"-","stage_changed_by":"-"}',
+  'ADR 0003 / PRD 03: a client is a Person with the customer role. Dedup by exact CPF (merge), no CPF ⇒ new Person unless someone already shares email+phone (identity quarantine). Clinical columns → metadata.beauty (ADR 0009).');
+SELECT migration._allow('professionals', 'public.people', 'people', 'person', '{"role":"professional"}', '{}',
+  '{"uuid":"id","tenant_id":"-","name":"name","social_name":"jsonb:social_name","cpf":"document_number","rg":"jsonb:documents.rg","email":"email","phone":"phone","birth_date":"date_of_birth","gender":"jsonb:profile.gender","avatar_url":"avatar_url","avatar_color":"jsonb:profile.avatar_color","active":"is_active","specialty":"jsonb:professional.specialty","job_title":"jsonb:professional.job_title","cbo_code":"jsonb:professional.cbo_code","cbo_description":"jsonb:professional.cbo_description","commission_rate":"jsonb:professional.commission_rate","is_salesperson":"jsonb:professional.is_salesperson","service_ids":"jsonb:professional.v1_service_refs","units":"jsonb:professional.v1_unit_refs","agenda_notes":"jsonb:professional.agenda_notes","user_id":"jsonb:migration.v1_user_id","street":"address","number":"jsonb:address.number","complement":"jsonb:address.complement","neighborhood":"jsonb:address.neighborhood","city":"city","state":"state","cep":"postal_code","base_salary":"-","bank_account":"-","bank_agency":"-","bank_code":"-","pix_key":"-","ctps_number":"-","pis_pasep":"-","esocial_registration":"-","health_plan_value":"-","dental_plan_value":"-","food_voucher_value":"-","meal_voucher_value":"-","transport_voucher_value":"-","dismissal_reason":"-","mother_name":"-","father_name":"-","voter_id":"-","cnh_number":"-","passport_number":"-","reservist_number":"-","search_text":"-"}',
+  'ADR 0003: a professional is a role of a Person (same human as an employee/client merges by CPF). HR-sensitive data (salary, bank, CTPS, PIS, eSocial, family) does NOT migrate in Phase 0 (PRD 03 R4/R7 — Phase 2 hr).');
+SELECT migration._allow('employees', 'public.people', 'people', 'person', '{"role":"employee"}', '{}',
+  '{"uuid":"id","tenant_id":"-","name":"name","social_name":"jsonb:social_name","cpf":"document_number","rg":"jsonb:documents.rg","email":"email","phone":"phone","mobile":"jsonb:contact.mobile","birth_date":"date_of_birth","gender":"jsonb:profile.gender","avatar_url":"avatar_url","active":"is_active","job_title":"jsonb:employee.job_title","department":"jsonb:employee.department","units":"jsonb:employee.v1_unit_refs","professional_access":"jsonb:employee.v1_professional_access","user_id":"jsonb:migration.v1_user_id","address":"address","city":"city","state":"state","country":"country","postal_code":"postal_code","observations":"notes","base_salary":"-","bank_account":"-","bank_agency":"-","bank_code":"-","pix_key":"-","ctps_number":"-","pis_pasep":"-","esocial_registration":"-","health_plan_value":"-","dental_plan_value":"-","food_voucher_value":"-","meal_voucher_value":"-","transport_voucher_value":"-","dismissal_reason":"-","mother_name":"-","father_name":"-","voter_id":"-","cnh_number":"-","passport_number":"-","reservist_number":"-"}',
+  'ADR 0003: employee role of a Person; email/phone/mobile are arrays in V1 (the extractor sends the first). HR-sensitive data does NOT migrate in Phase 0.');
+SELECT migration._allow('contacts', 'public.people', 'people', 'person', '{"role":"contact","role_by":"contact_type"}', '{}',
+  '{"uuid":"id","tenant_id":"-","name":"name","cpf_cnpj":"document_number","document":"jsonb:documents.other","email":"email","email_2":"jsonb:contact.email_2","phone":"phone","phone_2":"jsonb:contact.phone_2","mobile":"jsonb:contact.mobile","mobile_2":"jsonb:contact.mobile_2","contact_type":"jsonb:contact.type","service_provider_type":"jsonb:contact.service_provider_type","group_name":"jsonb:contact.group","gender":"jsonb:profile.gender","active":"is_active","address":"address","address_number":"jsonb:address.number","address_complement":"jsonb:address.complement","neighborhood":"jsonb:address.neighborhood","city":"city","state":"state","postal_code":"postal_code","observations":"notes","unit_id":"jsonb:contact.v1_unit_ref","units":"jsonb:contact.v1_unit_refs","municipal_state_registration":"jsonb:legal.state_registration","default_chart_account_id":"jsonb:financial.v1_default_chart_account_ref","cost_center_id":"jsonb:financial.v1_cost_center_ref","allowed_chart_accounts":"jsonb:financial.v1_allowed_chart_accounts","limit_chart_accounts":"jsonb:financial.limit_chart_accounts","add_items_automatically":"jsonb:financial.add_items_automatically","bank_account":"-","bank_agency":"-","bank_code":"-","pix_key":"-","search_text":"-"}',
+  'ADR 0003: contact role (contact_type supplier ⇒ supplier role). CNPJ contacts are legal-entity counterparties (Pessoa como Conta, ADR 0005).');
+SELECT migration._allow('suppliers', 'public.people', 'people', 'person', '{"role":"supplier"}', '{}',
+  '{"uuid":"id","name":"name","document":"document_number","email":"email","phone":"phone"}',
+  'Listed in §3.1; in the V1 schema of 2026-08 suppliers are contacts with contact_type = supplier — the extractor sends whichever exists, the destination writes the supplier role either way.');
+SELECT migration._allow('client_registrations', 'public.people', 'people', NULL, '{}', '{}', '{"uuid":"id","name":"name","cpf":"document_number","email":"email","phone":"phone"}', 'PRD 03 R6: pre-registration → Person creation queue with dedup; contract only in Phase 0.');
+SELECT migration._allow('client_access_tokens', 'public.people', 'people', NULL, '{}', '{}', '{"client_id":"person_id@clients","token":"-"}', 'PRD 03 R6: opaque portal tokens; the token value never migrates (re-issued in V2).');
+SELECT migration._allow('professions', 'public.people', 'people', NULL, '{}', '{}', '{"name":"jsonb:professional.profession"}', 'Reference list folded into the professional role JSONB.');
+SELECT migration._allow('origins', 'public.people', 'people', NULL, '{}', '{}', '{"name":"jsonb:customer.origin"}', 'Reference list of the customer role.');
+SELECT migration._allow('partnerships', 'public.people', 'people', NULL, '{}', '{}', '{"name":"jsonb:customer.partnership"}', 'Reference list of the customer role (price variations reference it).');
+
+-- ── catalog ─────────────────────────────────────────────────────────────
+SELECT migration._allow('product_categories', 'public.categories', 'catalog', 'category', '{"kind":"product"}', '{}',
+  '{"uuid":"id","tenant_id":"-","name":"name","description":"jsonb:description","active":"is_active","menu_order":"sort_order","image_url":"icon","show_in_menu":"jsonb:chef.show_in_menu","delivery_available":"jsonb:chef.delivery_available","pdv_available":"jsonb:chef.pdv_available","prep_time":"jsonb:chef.prep_time"}',
+  'PRD 04 R2: shared categories(kind). Chef-only flags → metadata.chef.');
+SELECT migration._allow('service_categories', 'public.categories', 'catalog', 'category', '{"kind":"service"}', '{}',
+  '{"uuid":"id","tenant_id":"-","name":"name","description":"jsonb:description","color":"color","active":"is_active","numeric_id":"-"}', 'PRD 04 R2.');
+SELECT migration._allow('products', 'public.products', 'catalog', 'product', '{"kind":"good"}', '{}',
+  '{"uuid":"id","tenant_id":"-","name":"name","description":"description","internal_code":"sku","barcode":"jsonb:catalog.barcode","brand":"jsonb:catalog.brand","category_id":"category_id@product_categories","sale_price":"price","cost_price":"cost","avg_purchase_price":"jsonb:inventory.avg_purchase_price","active":"is_active","is_for_sale":"jsonb:catalog.is_for_sale","is_resale":"jsonb:catalog.is_resale","is_asset":"jsonb:catalog.is_asset","is_ingredient":"jsonb:chef.is_ingredient","is_intermediate":"jsonb:chef.is_intermediate","is_produced":"jsonb:chef.is_produced","product_type":"jsonb:catalog.v1_product_type","purpose":"jsonb:catalog.v1_purpose","image_url":"image_url","measurement_unit_id":"jsonb:inventory.v1_measurement_unit_ref","content_per_unit":"jsonb:inventory.content_per_unit","content_unit_id":"jsonb:inventory.v1_content_unit_ref","conversion_factor":"jsonb:inventory.conversion_factor","commission_percent":"jsonb:catalog.commission_percent","professional_resale_price":"jsonb:catalog.professional_resale_price","menu_available":"jsonb:chef.menu_available","menu_order":"jsonb:chef.menu_order","delivery_available":"jsonb:chef.delivery_available","delivery_price":"jsonb:chef.delivery_price","pdv_available":"jsonb:chef.pdv_available","current_quantity":"-","minimum_quantity":"-","maximum_quantity":"-","default_stock_location_id":"-","default_stock_unit_id":"-","supplier_id":"jsonb:inventory.v1_supplier_ref","allowed_supplier_ids":"jsonb:inventory.v1_allowed_supplier_refs","search_text":"-","numeric_id":"-"}',
+  'PRD 04 R1/R5: a product is a catalog item kind=good; quantities are NOT catalog (stock_positions, PRD 06) and are dropped here.');
+SELECT migration._allow('services', 'public.products', 'catalog', 'product', '{"kind":"service"}', '{}',
+  '{"uuid":"id","tenant_id":"-","name":"name","description":"description","internal_code":"sku","category_id":"category_id@service_categories","price":"price","active":"is_active","duration_minutes":"jsonb:catalog.duration_minutes","color":"jsonb:catalog.color","service_kind":"jsonb:beauty.service_kind","revision_count":"jsonb:beauty.revision_count","revision_price":"jsonb:beauty.revision_price","revision_deadline_days":"jsonb:beauty.revision_deadline_days","validity_days":"jsonb:catalog.validity_days","contract_text":"jsonb:beauty.contract_text","post_service_text":"jsonb:beauty.post_service_text","reminder_text":"jsonb:beauty.reminder_text","scheduling_alert_text":"jsonb:beauty.scheduling_alert_text","always_ask_used_products":"jsonb:beauty.always_ask_used_products","suggest_quote_on_execution":"jsonb:beauty.suggest_quote_on_execution","category":"-","search_text":"-"}',
+  'PRD 04 R1: a service is a catalog item kind=service (public.services is drift, folded by #139). service_kind is beauty semantics on a core column → metadata.beauty until #139 promotes it (R6).');
+SELECT migration._allow('product_barcodes', 'public.products', 'catalog', NULL, '{}', '{}', '{"product_id":"id@products","barcode":"jsonb:catalog.barcodes[]"}', 'Facet of the product (Matriz D7).');
+SELECT migration._allow('product_sale_info', 'public.products', 'catalog', NULL, '{}', '{}', '{"product_id":"id@products"}', 'Facet of the product.');
+SELECT migration._allow('product_sale_channels', 'public.products', 'catalog', NULL, '{}', '{}', '{"product_id":"id@products"}', 'Facet of the product.');
+SELECT migration._allow('product_fiscal_info', 'public.products', 'catalog', NULL, '{}', '{}', '{"product_id":"id@products"}', 'Facet of the product (fiscal; NF is core-B).');
+SELECT migration._allow('product_asset_info', 'public.products', 'catalog', NULL, '{}', '{}', '{"product_id":"id@products"}', 'Facet of the product.');
+SELECT migration._allow('product_ingredient_info', 'public.products', 'catalog', NULL, '{}', '{}', '{"product_id":"id@products"}', 'Facet of the product (chef).');
+SELECT migration._allow('product_intermediate_info', 'public.products', 'catalog', NULL, '{}', '{}', '{"product_id":"id@products"}', 'Facet of the product (chef).');
+SELECT migration._allow('measurement_units', 'public.plg_inventory_measurement_units', 'catalog', NULL, '{}', '{}', '{"uuid":"id","name":"name","abbreviation":"abbreviation","active":"is_active"}', 'PRD 06 R2: units of measure live in the inventory core.');
+SELECT migration._allow('unit_conversions', 'public.plg_inventory_unit_conversions', 'catalog', NULL, '{}', '{}', '{"from_unit_id":"from_unit_id@measurement_units","to_unit_id":"to_unit_id@measurement_units","conversion_factor":"factor"}', 'PRD 06 R2.');
+SELECT migration._allow('price_tables', 'catalog.price_tables', 'catalog', NULL, '{}', '{}', '{"uuid":"id","description":"name","type":"kind","valid_from":"valid_from","valid_until":"valid_until","unit_ids":"jsonb:scope.v1_unit_refs","category_ids":"jsonb:scope.v1_category_refs","professional_ids":"jsonb:scope.v1_professional_refs","partnership_ids":"jsonb:scope.v1_partnership_refs","active":"is_active"}', 'PRD 04 R3 / #139 owns the destination.');
+SELECT migration._allow('price_table_items', 'catalog.price_table_items', 'catalog', NULL, '{}', '{}', '{"uuid":"id","price_table_id":"price_table_id@price_tables","service_id":"product_id@services","table_price":"price"}', 'PRD 04 R3.');
+SELECT migration._allow('price_variations', 'catalog.price_variations', 'catalog', NULL, '{}', '{}', '{"uuid":"id","variation_type":"kind","value_type":"value_type","value":"value","first_appointment_only":"jsonb:rules.first_appointment_only","active":"is_active"}', 'PRD 04 R3.');
+SELECT migration._allow('service_packages', 'catalog.packages', 'catalog', NULL, '{}', '{}', '{"uuid":"id","name":"name","description":"description","total_price":"price","status":"status","validity_days":"jsonb:validity.days","validity_months":"jsonb:validity.months","validity_enabled":"jsonb:validity.enabled","replaces_uuid":"jsonb:v1_replaces","replaced_by_uuid":"jsonb:v1_replaced_by","active":"is_active"}', 'PRD 04 R4: packages facet — contract only, Phase 3 uses.');
+SELECT migration._allow('service_package_items', 'catalog.package_items', 'catalog', NULL, '{}', '{}', '{"uuid":"id","package_id":"package_id@service_packages","service_id":"product_id@services","product_id":"product_id@products","item_type":"item_type","quantity":"quantity","unit_price":"unit_price","package_price":"price"}', 'PRD 04 R4.');
+SELECT migration._allow('package_settings', 'catalog.packages', 'catalog', NULL, '{}', '{}', '{}', 'PRD 04 R4: tenant-level package settings → configuration.');
+SELECT migration._allow('package_unit_shares', 'catalog.packages', 'catalog', NULL, '{}', '{}', '{}', 'PRD 04 R4: package revenue share by unit → facet.');
+SELECT migration._allow('discount_reasons', 'config.orders', 'catalog', NULL, '{}', '{}', '{"uuid":"id","name":"name"}', 'PRD 04 R7: configuration of the owning plugin (orders/financial), not catalog.');
+SELECT migration._allow('discount_users', 'config.orders', 'catalog', NULL, '{}', '{}', '{}', 'PRD 04 R7.');
+SELECT migration._allow('cancellation_reasons', 'config.orders', 'catalog', NULL, '{}', '{}', '{"uuid":"id","name":"name"}', 'PRD 04 R7.');
+SELECT migration._allow('cancellation_users', 'config.orders', 'catalog', NULL, '{}', '{}', '{}', 'PRD 04 R7.');
+
+-- ── financial base ──────────────────────────────────────────────────────
+SELECT migration._allow('invoices', 'public.orders', 'financial', 'order',
+  '{"kind":"sale","status_map":{"draft":"draft","canceled":"cancelled","cancelled":"cancelled","*":"completed"},"split_invoice":true}',
+  ARRAY['subtotal', 'discount', 'tax', 'total'],
+  '{"uuid":"id","tenant_id":"-","type":"jsonb:financial.v1_type","status":"status","invoice_date":"completed_at","total_amount":"total","paid_amount":"jsonb:financial.v1_paid_amount","total_installments":"jsonb:financial.v1_total_installments","client_id":"party_id@clients","unit_id":"unit_id@companies","cash_session_id":"jsonb:financial.v1_cash_session_ref","account_central_id":"jsonb:financial.v1_account_central_ref","opportunity_id":"jsonb:crm.v1_opportunity_ref","fiscal_number":"reference_number","observations":"notes","cancel_reason":"jsonb:cancellation.reason","cancel_reason_id":"jsonb:cancellation.v1_reason_ref","canceled_at":"jsonb:cancellation.at","canceled_by":"-"}',
+  'ADR 0004 / PRD 05 R1+R13: an invoice of type service/receivable is a Venda (orders) + a receivable invoice (plg_financial_invoices, second ledger row, split); payable/purchase is an invoice only. Financial columns are never overwritten once written (value quarantine). V1 status is kept in metadata.migration.source_status.');
+SELECT migration._allow('invoice_items', 'public.order_items', 'financial', NULL, '{}', ARRAY['unit_price', 'discount', 'total'],
+  '{"uuid":"id","invoice_id":"order_id@invoices","item_type":"jsonb:item_type","service_id":"product_id@services","product_id":"product_id@products","service_package_id":"jsonb:v1_package_ref","description":"name","quantity":"quantity","unit_price":"unit_price","discount":"discount","additional":"jsonb:financial.additional","total_amount":"total","is_executed":"jsonb:execution.is_executed","execution_date":"jsonb:execution.date","execution_start_time":"jsonb:execution.start_time","execution_end_time":"jsonb:execution.end_time","executed_by_professional_id":"jsonb:execution.v1_professional_ref","execution_photos":"-","appointment_id":"jsonb:agenda.v1_appointment_ref","gift_card_id":"jsonb:v1_gift_card_ref","canceled_at":"jsonb:cancellation.at","cancel_reason":"jsonb:cancellation.reason","account_id":"jsonb:financial.v1_account_ref","cost_center_id":"jsonb:financial.v1_cost_center_ref"}',
+  'PRD 05 R3 / #140: order_items with scaffold columns; execution state → column when the vertical uses it (ADR 0009); execution status must follow the EF lesson #1 (antecipated-sale item status > procedure status), never "has a procedure id".');
+SELECT migration._allow('invoice_items_discounted', 'public.order_items', 'financial', NULL, '{}', '{}', '{}', 'Facet of the item.');
+SELECT migration._allow('invoice_item_adjustments', 'public.order_items', 'financial', NULL, '{}', '{}', '{}', 'Facet of the item.');
+SELECT migration._allow('invoice_item_participants', 'public.order_items', 'financial', NULL, '{}', '{}', '{}', 'Facet of the item (commission participants).');
+SELECT migration._allow('invoice_cancellation_logs', 'public.audit_logs', 'financial', NULL, '{}', '{}', '{}', 'Append-only history → audit.');
+SELECT migration._allow('invoice_item_cancellation_logs', 'public.audit_logs', 'financial', NULL, '{}', '{}', '{}', 'Append-only history → audit.');
+SELECT migration._allow('account_central', 'public.plg_financial_accounts', 'financial', NULL, '{}', '{}', '{"uuid":"id","name":"name","account_type":"kind"}', 'PRD 05 R6: an account of the two-leg ledger (#142).');
+SELECT migration._allow('bank_accounts', 'public.plg_financial_accounts', 'financial', NULL, '{}', ARRAY['initial_balance'],
+  '{"uuid":"id","name":"name","account_type":"kind","bank_code":"jsonb:bank.code","bank_name":"jsonb:bank.name","agency_number":"jsonb:bank.agency","account_number":"jsonb:bank.account","holder":"jsonb:bank.holder","document":"jsonb:bank.document","initial_balance":"initial_balance","current_balance":"-","credit_limit":"jsonb:card.credit_limit","closing_day":"jsonb:card.closing_day","due_day":"jsonb:card.due_day","card_brand_id":"jsonb:card.v1_brand_ref","default_fee_rate":"jsonb:card.default_fee_rate","days_to_credit":"jsonb:card.days_to_credit","unit_id":"unit_id@companies","active":"is_active","integration_password":"-","cnab_agreement_code":"-","cnab_company_code":"-","cnab_next_sequence":"-"}',
+  'PRD 05 R6/R13: bank_accounts by account_type → accounts (bank, cofre, cartão crédito/débito). Balances are views; current_balance is dropped and reconciled instead. Integration secrets never migrate.');
+SELECT migration._allow('card_brands', 'public.plg_financial_card_brands', 'financial', NULL, '{}', '{}', '{"uuid":"id","name":"name"}', 'PRD 05 R11.');
+SELECT migration._allow('cc_receiving_fee_configs', 'public.plg_financial_card_fee_configs', 'financial', NULL, '{}', '{}', '{}', 'PRD 05 R11: brand × installment range × fee per receiving account (#142).');
+SELECT migration._allow('payment_methods', 'public.plg_financial_payment_methods', 'financial', NULL, '{}', '{}', '{"uuid":"id","name":"name","payment_method_type_id":"type_id@payment_method_types","max_installments":"jsonb:installments.max","min_installments":"jsonb:installments.min","discount":"jsonb:pricing.discount","interest":"jsonb:pricing.interest","active":"is_active"}', 'PRD 05.');
+SELECT migration._allow('payment_method_types', 'public.plg_financial_payment_method_types', 'financial', NULL, '{}', '{}', '{"uuid":"id","name":"name"}', 'PRD 05.');
+SELECT migration._allow('chart_of_accounts', 'public.plg_financial_chart_of_accounts', 'financial', NULL, '{}', '{}', '{"uuid":"id","code":"code","name":"name","account_type":"kind","parent_id":"parent_id@chart_of_accounts","active":"is_active"}', 'PRD 05.');
+SELECT migration._allow('cost_centers', 'public.plg_financial_cost_centers', 'financial', NULL, '{}', '{}', '{"uuid":"id","code":"code","name":"name","description":"description","active":"is_active"}', 'PRD 05.');
+SELECT migration._allow('financial_movements', 'public.plg_financial_movements', 'financial', NULL, '{}', ARRAY['amount', 'paid_amount'],
+  '{"uuid":"id","invoice_id":"financial_invoice_id@invoices","type":"movement_kind","movement_type":"jsonb:v1_movement_type","amount":"amount","paid_amount":"paid_amount","status":"status","due_date":"due_date","payment_date":"paid_at","installment_number":"installment_number","debit_account_id":"debit_account_id@account_central","credit_account_id":"credit_account_id@account_central","bank_account_id":"jsonb:v1_bank_account_ref","payment_method_id":"payment_method_id@payment_methods","payment_method_type_id":"payment_method_type_id@payment_method_types","card_brand":"jsonb:card.brand","card_installments":"jsonb:card.installments","cash_session_id":"cash_session_id@cash_register_sessions","parent_movement_id":"parent_movement_id@financial_movements","external_id":"external_id","external_source":"external_source","is_confirmed":"jsonb:confirmed","confirmed_at":"confirmed_at","barcode":"jsonb:barcode","notes":"notes","order_guest_id":"-"}',
+  'PRD 05 R7/R13: append-only two-leg movements (debit + credit account). Never overwritten. Paid invoices without movements receive an identifiable synthetic payment (Crédito Legado, R14) — the extractor emits it, the destination records it as a normal row.');
+SELECT migration._allow('payment_allocations', 'public.plg_financial_allocations', 'financial', NULL, '{}', ARRAY['allocated_amount'],
+  '{"uuid":"id","payment_movement_id":"payment_movement_id@financial_movements","bill_movement_id":"installment_id@financial_movements","allocated_amount":"allocated_amount","origin":"origin"}', 'PRD 05 R8.');
+SELECT migration._allow('payment_deletion_logs', 'public.audit_logs', 'financial', NULL, '{}', '{}', '{}', 'Append-only history → audit.');
+SELECT migration._allow('payment_unlink_logs', 'public.audit_logs', 'financial', NULL, '{}', '{}', '{}', 'Append-only history → audit.');
+SELECT migration._allow('cash_register_sessions', 'public.plg_financial_cash_register_sessions', 'financial', NULL, '{}', ARRAY['opening_balance', 'closing_balance', 'counted_cash', 'counted_card'],
+  '{"uuid":"id","unit_id":"unit_id@companies","bank_account_id":"account_id@bank_accounts","opened_at":"opened_at","opened_by_user_id":"jsonb:v1_opened_by","closed_at":"closed_at","closed_by_user_id":"jsonb:v1_closed_by","opening_balance":"opening_balance","closing_balance":"closing_balance","expected_cash":"expected_cash","expected_card":"expected_card","counted_cash":"counted_cash","counted_card":"counted_card","difference_cash":"difference_cash","difference_card":"difference_card","status":"status","review_status":"jsonb:review.status","notes":"notes"}',
+  'PRD 05 R10: caixinha per user and unit.');
+SELECT migration._allow('cash_session_reviewers', 'public.plg_financial_cash_register_sessions', 'financial', NULL, '{}', '{}', '{}', 'PRD 05 R10: optional reviewers → facet.');
+SELECT migration._allow('client_credits', 'derived', 'financial', NULL, '{"verify_only":true}', ARRAY['amount'], '{"client_id":"party_id@clients","amount":"amount"}', 'PRD 05 R9/R13: customer credit is the balance of the Person account (view) — not written, VERIFIED by the reconciliation.');
+SELECT migration._allow('client_credit_wallets', 'derived', 'financial', NULL, '{"verify_only":true}', ARRAY['balance'], '{}', 'PRD 05 R13: derived; verified, not written.');
+SELECT migration._allow('client_credit_ledger', 'derived', 'financial', NULL, '{"verify_only":true}', ARRAY['amount'], '{}', 'PRD 05 R13: derived; verified, not written.');
+SELECT migration._allow('bill_attachments', 'storage', 'financial', NULL, '{}', '{}', '{}', 'D13 minimum: invoice attachments into the classified bucket; files move out of band.');
+SELECT migration._allow('recurring_bills', 'public.plg_financial_recurring_bills', 'financial', NULL, '{}', ARRAY['amount'], '{}', 'PRD 05: recurring payables (#141/#142 own the destination).');
+SELECT migration._allow('recurring_bill_items', 'public.plg_financial_recurring_bills', 'financial', NULL, '{}', '{}', '{}', 'PRD 05.');
+SELECT migration._allow('recurring_bill_occurrences', 'public.plg_financial_recurring_bills', 'financial', NULL, '{}', '{}', '{}', 'PRD 05.');
+
+-- ── inventory base ──────────────────────────────────────────────────────
+SELECT migration._allow('stock_locations', 'public.plg_inventory_stock_locations', 'inventory', NULL, '{}', '{}', '{"uuid":"id","name":"name","description":"description","unit_id":"unit_id@companies","active":"is_active"}', 'PRD 06 R1: locations per unit (unit_id mandatory).');
+SELECT migration._allow('stock_positions', 'public.plg_inventory_stock_positions', 'inventory', NULL, '{}', ARRAY['quantity', 'unit_cost'],
+  '{"uuid":"id","product_id":"product_id@products","stock_location_id":"location_id@stock_locations","unit_id":"unit_id@companies","batch_number":"batch","expiration_date":"expires_at","quantity":"quantity","unit_cost":"unit_cost","unit_type":"jsonb:unit_type","location":"jsonb:v1_location_label"}', 'PRD 06 R1: position per lot/location/cost.');
+SELECT migration._allow('stock_movements', 'public.plg_inventory_stock_movements', 'inventory', NULL, '{}', ARRAY['quantity', 'unit_cost', 'total_cost'],
+  '{"uuid":"id","product_id":"product_id@products","stock_location_id":"from_location_id@stock_locations","destination_stock_location_id":"to_location_id@stock_locations","stock_position_id":"position_id@stock_positions","unit_id":"unit_id@companies","destination_unit_id":"to_unit_id@companies","movement_type":"kind","quantity":"quantity","original_quantity":"jsonb:original_quantity","unit_cost":"unit_cost","total_cost":"total_cost","movement_date":"moved_at","document_number":"document_number","reason":"reason","notes":"notes","supplier_id":"jsonb:v1_supplier_ref","appointment_id":"jsonb:agenda.v1_appointment_ref","danfe_import_item_id":"-","unit_label_id":"jsonb:v1_unit_label_ref","user_id":"jsonb:v1_user_id"}', 'PRD 06 R1: append-only movements with reversal.');
+SELECT migration._allow('stock_unit_labels', 'public.plg_inventory_stock_unit_labels', 'inventory', NULL, '{}', '{}', '{}', 'PRD 06 R5.');
+SELECT migration._allow('supplier_product_mappings', 'public.plg_inventory_supplier_products', 'inventory', NULL, '{}', '{}', '{"product_id":"product_id@products","supplier_id":"supplier_person_id@contacts"}', 'PRD 06 R5: supplier reference = Person.');
+
+-- ── never sent ──────────────────────────────────────────────────────────
+INSERT INTO migration.excluded_tables (source_table, reason) VALUES
+  ('orders',                         'V1 legacy table without app use (references only in CRM); the V2 orders table is a different thing (Venda). Confirm empty in production.'),
+  ('guests',                         'V1 legacy table without app use.'),
+  ('payments',                       'V1 legacy table without app use; money lives in financial_movements.'),
+  ('financial_accounts',             'V1 legacy table without app use; superseded by account_central/bank_accounts.'),
+  ('financial_transactions',         'V1 legacy table without app use; superseded by financial_movements.'),
+  ('transaction_categories',         'V1 legacy table without app use.'),
+  ('transaction_category_relations', 'V1 legacy table without app use.'),
+  ('sales_journey',                  'V1 legacy table without app use.'),
+  ('pending_appointments',           'V1 legacy table without app use.'),
+  ('for',                            'V1 legacy table without app use (accidental name).'),
+  ('to',                             'V1 legacy table without app use (accidental name).'),
+  ('user_roles',                     'Legacy role model without use in the V1 engine (core-beauty-chef §3.1); RBAC comes from the permission catalog (#136).'),
+  ('import_ef_*',                    'The previous vendor''s one-off import for one specific network: never ported (core-beauty-chef §3.3). Any source_table starting with import_ef_ is refused.')
+ON CONFLICT (source_table) DO UPDATE SET reason = EXCLUDED.reason;
+
+SELECT set_config('migration.allowlist_unlock', 'off', false);