@fayz-ai/db 0.12.0 → 0.14.0

package/migrations/034_custom_fields.sql

@@ -1,55 +0,0 @@
--- ============================================================================
--- 034 — custom_fields: the tenant's own fields, on every core record.
---
--- The rule this exists to make true: customization lives in DATA, never in
--- schema. Every tenant in a pool shares one identical schema — no per-tenant
--- DDL, no schema branch. A merchant asking for "tipo de pele on the client
--- record" gets an INSERT into plg_entity_fields (035), not a migration.
---
--- Why a column and not `metadata`: metadata is the system's bag (a block's
--- title, an order's direction, Google's etag). custom_fields is the merchant's
--- content, and only it is governed by the registry. Keeping them apart is what
--- lets a future connector ship "this tenant's fields" as one predictable
--- payload instead of guessing which keys are internal.
---
--- All eleven archetypes at once. A partial rollout produces "works on the
--- entities somebody remembered", which is the failure mode 026 refused when it
--- declined to put an audit trigger on one table at a time.
---
--- Idempotent.
--- ============================================================================
-
-ALTER TABLE public.people            ADD COLUMN IF NOT EXISTS custom_fields jsonb NOT NULL DEFAULT '{}'::jsonb;
-ALTER TABLE public.categories        ADD COLUMN IF NOT EXISTS custom_fields jsonb NOT NULL DEFAULT '{}'::jsonb;
-ALTER TABLE public.products          ADD COLUMN IF NOT EXISTS custom_fields jsonb NOT NULL DEFAULT '{}'::jsonb;
-ALTER TABLE public.services          ADD COLUMN IF NOT EXISTS custom_fields jsonb NOT NULL DEFAULT '{}'::jsonb;
-ALTER TABLE public.orders            ADD COLUMN IF NOT EXISTS custom_fields jsonb NOT NULL DEFAULT '{}'::jsonb;
-ALTER TABLE public.order_items       ADD COLUMN IF NOT EXISTS custom_fields jsonb NOT NULL DEFAULT '{}'::jsonb;
-ALTER TABLE public.transactions      ADD COLUMN IF NOT EXISTS custom_fields jsonb NOT NULL DEFAULT '{}'::jsonb;
-ALTER TABLE public.appointments      ADD COLUMN IF NOT EXISTS custom_fields jsonb NOT NULL DEFAULT '{}'::jsonb;
-ALTER TABLE public.appointment_items ADD COLUMN IF NOT EXISTS custom_fields jsonb NOT NULL DEFAULT '{}'::jsonb;
-ALTER TABLE public.schedules         ADD COLUMN IF NOT EXISTS custom_fields jsonb NOT NULL DEFAULT '{}'::jsonb;
-ALTER TABLE public.locations         ADD COLUMN IF NOT EXISTS custom_fields jsonb NOT NULL DEFAULT '{}'::jsonb;
-
-COMMENT ON COLUMN public.people.custom_fields IS
-  'Fields this tenant declared for its own records. Keys are governed by '
-  'plg_entity_fields (035) and validated on write; never free-form. Distinct '
-  'from metadata, which is the system''s own bag.';
-
--- ---------------------------------------------------------------------------
--- Indexes: only where there is use, and only by platform decision.
---
--- The reason `metadata` became unfilterable is not jsonb — it is that no
--- metadata column in this tree has ever had an index (128 references, zero).
--- jsonb_path_ops because the filter path compiles to containment (@>), the same
--- choice and same reason as plg_entity_records_data_gin.
---
--- The other eight archetypes carry the column and no index until something
--- actually queries them. Promoting one is a migration, deliberately.
--- ---------------------------------------------------------------------------
-CREATE INDEX IF NOT EXISTS people_custom_fields_gin
-  ON public.people USING gin (custom_fields jsonb_path_ops);
-CREATE INDEX IF NOT EXISTS appointments_custom_fields_gin
-  ON public.appointments USING gin (custom_fields jsonb_path_ops);
-CREATE INDEX IF NOT EXISTS products_custom_fields_gin
-  ON public.products USING gin (custom_fields jsonb_path_ops);

package/migrations/035_field_registry.sql

@@ -1,148 +0,0 @@
--- ============================================================================
--- 035 — plg_entity_fields: which fields exist, for whom, and what they accept.
---
--- The half of 034 that makes custom_fields governed instead of free-form. A key
--- that is not declared here is refused on write; UI, validation and reports are
--- generated from these rows, not hardcoded.
---
--- tenant_id NULL is the vertical's own vocabulary (the salon anamnesis a pool
--- ships with); non-null is what ONE merchant defined. Same convention, and the
--- same reason, as plg_shop_rule_attributes: widening the vocabulary is an
--- INSERT. Two partial unique indexes keep the halves from colliding.
---
--- This is also the AI builder's whole surface for extra fields: a row here, no
--- DDL, no migration. The column it fills already exists everywhere (034), which
--- is what makes that boundary enforceable rather than merely stated.
---
--- Idempotent.
--- ============================================================================
-
-CREATE TABLE IF NOT EXISTS public.plg_entity_fields (
-  id            uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-
-  -- NULL = the vertical's vocabulary, readable by every tenant in the pool and
-  -- writable by none of them. Non-null = this tenant's own field.
-  tenant_id     uuid REFERENCES public.tenants(id) ON DELETE CASCADE,
-
-  -- The record kind this field lives on: 'person', 'appointment', 'product'…
-  -- No CHECK — the next archetype is a value, not a migration. The closed set
-  -- lives in TS, where it can throw a useful error naming the valid ones.
-  reference     text NOT NULL CHECK (reference ~ '^[a-z][a-z0-9_]*$'),
-
-  -- The key inside custom_fields. IMMUTABLE once written — see the trigger.
-  key           text NOT NULL CHECK (key ~ '^[a-z][a-zA-Z0-9_]*$'),
-
-  -- A closed vocabulary on purpose: a type is a MODEL change (this CHECK, the
-  -- TS union, and every renderer), not an insert. Mirrors ENTITY_FIELD_TYPES.
-  type          text NOT NULL CHECK (type IN (
-                  'text', 'richtext', 'number', 'boolean', 'json',
-                  'image', 'url', 'ref', 'point', 'date', 'datetime', 'select'
-                )),
-
-  label         text,
-  help          text,
-  required      boolean NOT NULL DEFAULT false,
-  default_value jsonb,
-  -- min/max/pattern/enum — read by validateEntityRecordData, not by Postgres.
-  validation    jsonb NOT NULL DEFAULT '{}'::jsonb,
-  -- The choices, when type = 'select'.
-  options       jsonb,
-  position      integer NOT NULL DEFAULT 0,
-
-  -- 'declared' came from code and is re-asserted on every deploy; 'merchant'
-  -- came from the admin with no deploy. A deploy never deletes a merchant row —
-  -- a declared key ADOPTS a colliding merchant key instead.
-  origin        text NOT NULL DEFAULT 'merchant' CHECK (origin IN ('declared', 'merchant')),
-  owner         text,
-
-  -- Soft: a value already written to custom_fields must stay readable after the
-  -- field leaves the form.
-  archived_at   timestamptz,
-
-  created_at    timestamptz NOT NULL DEFAULT now(),
-  updated_at    timestamptz NOT NULL DEFAULT now()
-);
-
-CREATE UNIQUE INDEX IF NOT EXISTS plg_entity_fields_core_key
-  ON public.plg_entity_fields (reference, key) WHERE tenant_id IS NULL;
-CREATE UNIQUE INDEX IF NOT EXISTS plg_entity_fields_tenant_key
-  ON public.plg_entity_fields (tenant_id, reference, key) WHERE tenant_id IS NOT NULL;
-CREATE INDEX IF NOT EXISTS plg_entity_fields_lookup
-  ON public.plg_entity_fields (tenant_id, reference, position) WHERE archived_at IS NULL;
-
--- ---------------------------------------------------------------------------
--- The machine key does not move.
---
--- The label is the merchant's to rename whenever they like. The key is the name
--- of data already written into custom_fields on every record, and the thing an
--- integration maps to. Renaming it silently orphans every value ever stored.
--- ---------------------------------------------------------------------------
-CREATE OR REPLACE FUNCTION public.plg_entity_fields_key_is_immutable()
-RETURNS trigger
-LANGUAGE plpgsql
-SET search_path = public
-AS $fn$
-BEGIN
-  IF NEW.key IS DISTINCT FROM OLD.key OR NEW.reference IS DISTINCT FROM OLD.reference THEN
-    RAISE EXCEPTION
-      'A chave de máquina de um campo não muda (%.% → %.%). O rótulo é livre; a '
-      'chave é o nome do dado já gravado em custom_fields e o que uma integração '
-      'mapeia. Para trocar, arquive este campo e crie outro.',
-      OLD.reference, OLD.key, NEW.reference, NEW.key;
-  END IF;
-  RETURN NEW;
-END;
-$fn$;
-
-DROP TRIGGER IF EXISTS plg_entity_fields_immutable_key ON public.plg_entity_fields;
-CREATE TRIGGER plg_entity_fields_immutable_key
-  BEFORE UPDATE ON public.plg_entity_fields
-  FOR EACH ROW EXECUTE FUNCTION public.plg_entity_fields_key_is_immutable();
-
-DROP TRIGGER IF EXISTS plg_entity_fields_updated_at ON public.plg_entity_fields;
-CREATE TRIGGER plg_entity_fields_updated_at
-  BEFORE UPDATE ON public.plg_entity_fields
-  FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
-
--- ---------------------------------------------------------------------------
--- RLS and the default-privilege trap.
---
--- 011 closed `anon` on every table and on future ones. It did NOT close
--- `authenticated`, which is still born with the full set on any new public
--- table — here that would be every tenant editing every other tenant's field
--- definitions. Stripped first, granted back only what is needed (029's block).
--- ---------------------------------------------------------------------------
-REVOKE ALL ON public.plg_entity_fields FROM anon, authenticated;
-
-ALTER TABLE public.plg_entity_fields ENABLE ROW LEVEL SECURITY;
-
-GRANT SELECT, INSERT, UPDATE, DELETE ON public.plg_entity_fields TO authenticated;
-
--- Reads the vertical's vocabulary AND its own. The NULL half is what a pool
--- ships with, and a tenant has to see it to render a form from it.
-DROP POLICY IF EXISTS plg_entity_fields_member_read ON public.plg_entity_fields;
-CREATE POLICY plg_entity_fields_member_read ON public.plg_entity_fields
-  FOR SELECT TO authenticated
-  USING (tenant_id IS NULL OR tenant_id IN (SELECT public.user_tenant_ids()));
-
--- Writes only its own. `tenant_id IS NULL` fails these three by construction —
--- NULL IN (…) is never true — so no merchant can edit the pool's vocabulary.
-DROP POLICY IF EXISTS plg_entity_fields_member_insert ON public.plg_entity_fields;
-CREATE POLICY plg_entity_fields_member_insert ON public.plg_entity_fields
-  FOR INSERT TO authenticated
-  WITH CHECK (tenant_id IN (SELECT public.user_tenant_ids()));
-
-DROP POLICY IF EXISTS plg_entity_fields_member_update ON public.plg_entity_fields;
-CREATE POLICY plg_entity_fields_member_update ON public.plg_entity_fields
-  FOR UPDATE TO authenticated
-  USING (tenant_id IN (SELECT public.user_tenant_ids()))
-  WITH CHECK (tenant_id IN (SELECT public.user_tenant_ids()));
-
-DROP POLICY IF EXISTS plg_entity_fields_member_delete ON public.plg_entity_fields;
-CREATE POLICY plg_entity_fields_member_delete ON public.plg_entity_fields
-  FOR DELETE TO authenticated
-  USING (tenant_id IN (SELECT public.user_tenant_ids()));
-
-COMMENT ON TABLE public.plg_entity_fields IS
-  'Per-tenant field registry for custom_fields (034). tenant_id NULL is the '
-  'vertical vocabulary — readable by every tenant, writable by none.';

package/migrations/036_analytics_run_batch.sql

@@ -1,84 +0,0 @@
--- ============================================================================
--- analytics_run_batch — one round trip for a whole dashboard
--- ----------------------------------------------------------------------------
--- A card fetches itself. That is the right ownership (a tile added to a pack
--- must not require editing a page-level query), and it is why opening
--- /analytics fired FORTY-ONE requests: twenty-two cards, most of them also
--- asking for the comparison window, each its own POST. Change the date range
--- and all forty-one go again.
---
--- Nothing about the ownership needs to change — only the transport. This takes
--- an ARRAY of the exact same arguments analytics_run already accepts and
--- returns the answers in order, so a dashboard is one call and a card is still
--- the thing that declares its own query.
---
--- The engine itself is untouched: every element goes through analytics_run,
--- which means the allowlist, the identifier guard, the fixed aggregate
--- vocabulary and SECURITY INVOKER still decide what any of this can read. A
--- batch cannot reach a row a single call could not.
---
--- Per-element failure is contained. One card naming a column that does not
--- exist must not blank the other twenty-one, so each iteration runs in its own
--- subtransaction and a failure is RETURNED as {"error", "code"} at that index
--- rather than raised — which is also what lets the client render one broken
--- tile beside twenty-one live ones.
---
--- Requires 024_analytics_engine.sql. Idempotent.
--- ============================================================================
-
-CREATE OR REPLACE FUNCTION public.analytics_run_batch(p_requests jsonb)
-RETURNS jsonb
-LANGUAGE plpgsql
-STABLE
-AS $$
-DECLARE
-  v_req     jsonb;
-  v_result  jsonb;
-  v_out     jsonb := '[]'::jsonb;
-BEGIN
-  IF p_requests IS NULL OR jsonb_typeof(p_requests) <> 'array' THEN
-    RAISE EXCEPTION 'analytics: batch expects an array of requests' USING ERRCODE = '22023';
-  END IF;
-
-  -- A cap, not a convenience: this is a caller-supplied loop over a function
-  -- that reads tables, and an unbounded array is a way to ask one request to do
-  -- unbounded work. The largest pack in the product is ~30 cards.
-  IF jsonb_array_length(p_requests) > 100 THEN
-    RAISE EXCEPTION 'analytics: batch of % exceeds the limit of 100',
-      jsonb_array_length(p_requests) USING ERRCODE = '22023';
-  END IF;
-
-  FOR v_req IN SELECT * FROM jsonb_array_elements(p_requests)
-  LOOP
-    BEGIN
-      v_result := public.analytics_run(
-        p_source         => v_req ->> 'source',
-        p_tenant_id      => NULLIF(v_req ->> 'tenant_id', '')::uuid,
-        p_from           => NULLIF(v_req ->> 'from', '')::timestamptz,
-        p_to             => NULLIF(v_req ->> 'to', '')::timestamptz,
-        p_dimensions     => COALESCE(v_req -> 'dimensions', '[]'::jsonb),
-        p_measures       => COALESCE(v_req -> 'measures', '[]'::jsonb),
-        p_filters        => COALESCE(v_req -> 'filters', '{}'::jsonb),
-        p_search         => NULLIF(v_req ->> 'search', ''),
-        p_search_columns => CASE
-                              WHEN jsonb_typeof(v_req -> 'search_columns') = 'array'
-                              THEN ARRAY(SELECT jsonb_array_elements_text(v_req -> 'search_columns'))
-                            END,
-        p_sort           => NULLIF(v_req ->> 'sort', ''),
-        p_dir            => COALESCE(NULLIF(v_req ->> 'dir', ''), 'desc'),
-        p_limit          => COALESCE((v_req ->> 'limit')::int, 500),
-        p_offset         => COALESCE((v_req ->> 'offset')::int, 0)
-      );
-    EXCEPTION WHEN OTHERS THEN
-      v_result := jsonb_build_object('error', SQLERRM, 'code', SQLSTATE);
-    END;
-
-    v_out := v_out || jsonb_build_array(v_result);
-  END LOOP;
-
-  RETURN v_out;
-END;
-$$;
-
-REVOKE ALL     ON FUNCTION public.analytics_run_batch(jsonb) FROM public;
-GRANT  EXECUTE ON FUNCTION public.analytics_run_batch(jsonb) TO authenticated, service_role;

package/migrations/037_sync_tick_one_at_a_time.sql

@@ -1,256 +0,0 @@
--- ============================================================================
--- 037_sync_tick_one_at_a_time.sql — a connection with a dispatch in flight is
--- not due.
---
--- 033 selects what to dispatch by ONE test: `next_attempt_at <= now()`. It never
--- asks whether the previous dispatch came back. In the ordinary case that is
--- invisible — the advance pushes the row a whole interval into the future in the
--- same statement that dispatches it, so nothing is due again for an hour.
---
--- It stops being invisible the moment anything else writes `next_attempt_at`.
--- The shop's wake trigger (packages/shop 0064) sets it to `now()` whenever an
--- order, a customer or a product changes — which is exactly what a catalogue
--- pull DOES, by the thousand, while it is still running. Measured on the
--- ecommerce pool: bling-sync dispatched, pulled, wrote products, each write
--- moved its own next attempt to now(), the next tick dispatched it again on top
--- of itself, and the merchant's history filled with an hourly connector running
--- every sixty seconds. The cadence was never wrong; nothing enforced it.
---
--- ── The guard ────────────────────────────────────────────────────────────────
--- `last_run_id IS NOT NULL` already means "dispatched, no verdict yet" — the
--- fold and the reaper both key off it. This file makes the selection honour the
--- same fact: one dispatch per connection per kind at a time, and the reaper
--- (timeout_seconds) is what ends it if a function never answers. A wake that
--- lands mid-run is not lost, it is served by the tick after the verdict.
---
--- This is a ceiling nobody could opt out of, which is the point: rate limits,
--- the provider's daily quota and the connector's own cursor all assume its
--- previous call finished. `max_per_tick` bounds a connector across connections;
--- nothing bounded ONE connection against itself.
---
--- ── And the orphan ───────────────────────────────────────────────────────────
--- A guard on a pointer needs the pointer to be honest. If the run a schedule
--- points at no longer exists, the fold cannot fold it and the reaper cannot reap
--- it, and under the new guard that connection would never be dispatched again.
--- Cleared before the fold, so a vanished run costs one tick instead of forever.
---
--- CREATE OR REPLACE of plg_sync_tick, and nothing else: no table, no grant, no
--- cron job changes. Idempotent, and safe to re-run — `fayz db apply` re-applies
--- a file whose checksum moved.
--- ============================================================================
-
-CREATE OR REPLACE FUNCTION public.plg_sync_tick(p_kind text)
-RETURNS integer
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = public, extensions, net, vault
-AS $fn$
-DECLARE
-  v_base       text;
-  v_secret     text;
-  v_have_net   boolean;
-  v_row        record;
-  v_run_id     uuid;
-  v_next       timestamptz;
-  v_expires    timestamptz;
-  v_offset     integer;
-  v_dispatched integer := 0;
-  v_reason     text;
-BEGIN
-  IF p_kind NOT IN ('reconcile', 'renew') THEN
-    RAISE EXCEPTION 'plg_sync_tick: unknown kind %', p_kind;
-  END IF;
-
-  IF NOT pg_try_advisory_xact_lock(hashtext('plg_sync_tick:' || p_kind)) THEN
-    RETURN 0;
-  END IF;
-
-  v_have_net := to_regprocedure('net.http_post(text, jsonb, jsonb, jsonb, integer)') IS NOT NULL;
-
-  BEGIN
-    SELECT decrypted_secret INTO v_base
-      FROM vault.decrypted_secrets WHERE name = 'fayz_functions_url'
-      ORDER BY created_at DESC LIMIT 1;
-    SELECT decrypted_secret INTO v_secret
-      FROM vault.decrypted_secrets WHERE name = 'fayz_scheduler_secret'
-      ORDER BY created_at DESC LIMIT 1;
-  EXCEPTION WHEN OTHERS THEN
-    v_base := NULL;
-    v_secret := NULL;
-  END;
-
-  -- ── orphan ────────────────────────────────────────────────────────────────
-  -- Before anything reads `last_run_id` as "in flight": a pointer at a run that
-  -- no longer exists is not a dispatch in flight, it is a dead end that would
-  -- park this connection permanently.
-  UPDATE public.plg_sync_schedule s
-     SET last_run_id = NULL
-   WHERE s.kind = p_kind
-     AND s.last_run_id IS NOT NULL
-     AND NOT EXISTS (SELECT 1 FROM public.plg_sync_runs r WHERE r.id = s.last_run_id);
-
-  -- ── reap ──────────────────────────────────────────────────────────────────
-  UPDATE public.plg_sync_runs r
-     SET status      = 'error',
-         finished_at = now(),
-         error       = COALESCE(r.error, 'the connector function returned no verdict within the schedule timeout')
-    FROM public.plg_sync_schedule s
-    JOIN public.plg_connections c ON c.id = s.connection_id
-    JOIN public.plg_connector_schedules d
-      ON d.connector_id = c.connector_id AND d.kind = s.kind
-   WHERE s.kind = p_kind
-     AND r.id = s.last_run_id
-     AND r.status = 'running'
-     AND r.started_at < now() - make_interval(secs => d.timeout_seconds);
-
-  -- ── fold ──────────────────────────────────────────────────────────────────
-  UPDATE public.plg_sync_schedule s
-     SET failures = CASE WHEN r.status IN ('success', 'partial') THEN 0 ELSE s.failures + 1 END,
-         last_run_id = NULL,
-         next_attempt_at = CASE
-           WHEN r.status IN ('success', 'partial') THEN s.next_attempt_at
-           ELSE GREATEST(
-                  s.next_attempt_at,
-                  now() + make_interval(secs => LEAST(
-                    d.interval_seconds::bigint * (2 ^ LEAST(s.failures + 1, 6))::bigint,
-                    86400)::double precision)
-                )
-         END
-    FROM public.plg_sync_runs r,
-         public.plg_connections c,
-         public.plg_connector_schedules d
-   WHERE s.kind = p_kind
-     AND r.id = s.last_run_id
-     AND r.finished_at IS NOT NULL
-     AND c.id = s.connection_id
-     AND d.connector_id = c.connector_id
-     AND d.kind = s.kind;
-
-  -- ── enroll ────────────────────────────────────────────────────────────────
-  INSERT INTO public.plg_sync_schedule (connection_id, kind, next_attempt_at)
-  SELECT q.id, p_kind,
-         now() + make_interval(secs => mod(abs(hashtext(q.id::text)::bigint), GREATEST(q.jitter_seconds, 1))::double precision)
-    FROM (
-      SELECT c.id, d.jitter_seconds
-        FROM public.plg_connections c
-        JOIN public.plg_connector_schedules d
-          ON d.connector_id = c.connector_id AND d.kind = p_kind AND d.enabled
-        LEFT JOIN public.plg_sync_schedule s
-          ON s.connection_id = c.id AND s.kind = p_kind
-       WHERE s.connection_id IS NULL
-         AND c.active
-       LIMIT 500
-    ) q
-  ON CONFLICT (connection_id, kind) DO NOTHING;
-
-  -- ── dispatch ──────────────────────────────────────────────────────────────
-  FOR v_row IN
-    SELECT *
-      FROM (
-        SELECT s.connection_id, s.failures, c.tenant_id, c.connector_id, c.provider_state,
-               d.function_name, d.action, d.interval_seconds, d.jitter_seconds,
-               d.floor_seconds, d.lead_seconds, d.timeout_seconds, d.max_per_tick,
-               row_number() OVER (PARTITION BY c.connector_id ORDER BY s.next_attempt_at, s.connection_id) AS rn
-          FROM (
-            SELECT s2.*
-              FROM public.plg_sync_schedule s2
-             WHERE s2.kind = p_kind AND s2.next_attempt_at <= now()
-               -- THE GUARD. Due is not enough: a connection whose last dispatch
-               -- has no verdict is already being served. Cleared by the fold on
-               -- a verdict, or by the reaper at timeout_seconds.
-               AND s2.last_run_id IS NULL
-             ORDER BY s2.next_attempt_at
-             LIMIT 2000
-          ) s
-          JOIN public.plg_connections c ON c.id = s.connection_id
-          JOIN public.plg_connector_schedules d
-            ON d.connector_id = c.connector_id AND d.kind = s.kind
-         WHERE d.enabled
-           AND c.active
-           AND c.status IN ('connected', 'error')
-      ) ranked
-     WHERE ranked.rn <= ranked.max_per_tick
-  LOOP
-    INSERT INTO public.plg_sync_runs
-      (tenant_id, connection_id, connector_id, direction, trigger_kind, status, stats)
-    VALUES
-      (v_row.tenant_id, v_row.connection_id, v_row.connector_id,
-       CASE WHEN p_kind = 'renew' THEN 'outbound' ELSE 'inbound' END,
-       'scheduled', 'running',
-       jsonb_build_object('schedule_kind', p_kind, 'attempt', v_row.failures + 1))
-    RETURNING id INTO v_run_id;
-
-    v_reason := NULL;
-    IF NOT v_have_net THEN
-      v_reason := 'pg_net is not installed on this pool, so the scheduler cannot call the connector function';
-    ELSIF COALESCE(v_base, '') = '' OR COALESCE(v_secret, '') = '' THEN
-      v_reason := 'the scheduler endpoint is not configured: run plg_set_scheduler_endpoint on this pool';
-    ELSE
-      BEGIN
-        PERFORM net.http_post(
-          url := v_base || '/' || v_row.function_name,
-          headers := jsonb_build_object(
-            'Content-Type', 'application/json',
-            'Authorization', 'Bearer ' || v_secret,
-            'X-Fayz-Scheduler', '1'
-          ),
-          body := jsonb_build_object(
-            'action', v_row.action,
-            'kind', p_kind,
-            'connectionId', v_row.connection_id,
-            'tenantId', v_row.tenant_id,
-            'connectorId', v_row.connector_id,
-            'runId', v_run_id,
-            'attempt', v_row.failures + 1,
-            'scheduledAt', to_char(now() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS"Z"')
-          ),
-          timeout_milliseconds := v_row.timeout_seconds * 1000
-        );
-      EXCEPTION WHEN OTHERS THEN
-        v_reason := 'the scheduler could not post to the connector function: ' || SQLERRM;
-      END;
-    END IF;
-
-    IF v_reason IS NOT NULL THEN
-      UPDATE public.plg_sync_runs
-         SET status = 'error', error = v_reason, finished_at = now()
-       WHERE id = v_run_id;
-    END IF;
-
-    -- ── advance ─────────────────────────────────────────────────────────────
-    v_offset := mod(abs(hashtext(v_row.connection_id::text)::bigint),
-                    GREATEST(v_row.jitter_seconds, 1))::integer;
-    v_next := now() + make_interval(secs => (v_row.interval_seconds + v_offset)::double precision);
-
-    IF p_kind = 'renew' THEN
-      BEGIN
-        v_expires := (v_row.provider_state ->> 'expiresAt')::timestamptz;
-      EXCEPTION WHEN OTHERS THEN
-        v_expires := NULL;
-      END;
-      IF v_expires IS NOT NULL THEN
-        v_next := LEAST(v_next, v_expires - make_interval(secs => v_row.lead_seconds::double precision));
-      END IF;
-    END IF;
-
-    v_next := GREATEST(v_next, now() + make_interval(secs => v_row.floor_seconds::double precision));
-
-    UPDATE public.plg_sync_schedule
-       SET next_attempt_at = v_next,
-           last_attempt_at = now(),
-           last_run_id     = v_run_id
-     WHERE connection_id = v_row.connection_id AND kind = p_kind;
-
-    v_dispatched := v_dispatched + 1;
-  END LOOP;
-
-  RETURN v_dispatched;
-END;
-$fn$;
-
-COMMENT ON FUNCTION public.plg_sync_tick(text) IS
-  'One tick of the sync clock: clear orphaned pointers, reap dead dispatches, '
-  'fold verdicts into backoff, enrol new connections with a deterministic '
-  'offset, dispatch what is due AND has no dispatch in flight, up to '
-  'max_per_tick per connector. Files a plg_sync_runs row for EVERY attempt, '
-  'including one that never reached the function. service_role and cron only.';

package/migrations/038_onboarding_responses.sql

@@ -1,103 +0,0 @@
--- ============================================================================
--- 038 — plg_onboarding_responses: what the owner told us while creating the
--- workspace, and tenant_slug_available: can this handle still be taken.
---
--- The setup wizard asks things no table has a column for — whether they already
--- run another system, how many chairs, how they hear about us — and the answers
--- are worth keeping BECAUSE they are not settings: they are how we decide what
--- to configure for this merchant and what kind of merchant they are.
---
--- The answers live in ONE jsonb keyed by question id, not in typed columns. That
--- is the point: the questionnaire gets reworded every time we learn something
--- about a vertical, and rewording must never be a migration. The two things we
--- will actually filter and group by — the vertical and where they came from —
--- are lifted out as columns, because those are the queries we know we want.
---
--- One row per completed run. Nothing is written before the tenant exists: the
--- wizard holds its draft in localStorage until the org is created, so a fully
--- abandoned flow leaves no orphan rows to reconcile.
---
--- Idempotent.
--- ============================================================================
-
-CREATE TABLE IF NOT EXISTS public.plg_onboarding_responses (
-  id            uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-
-  tenant_id     uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
-  -- Who answered. Not the same as the tenant owner forever — an owner can be
-  -- transferred, and it stays true that THIS account filled the form.
-  user_id       uuid NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
-
-  -- Which questionnaire, and which revision of it. Answers from flow_version 1
-  -- are not comparable to version 3 once questions are dropped or rescaled, and
-  -- the stamp is what lets a report say so instead of silently averaging both.
-  flow_id       text NOT NULL,
-  flow_version  integer NOT NULL DEFAULT 1,
-
-  -- Copied from the tenant at answer time on purpose: a merchant who later
-  -- switches vertical must not retro-relabel the answers they gave as a salon.
-  vertical_id   text,
-  -- Where the flow was opened from: first workspace after signup, or an extra
-  -- one from the switcher. Same questions, very different intent.
-  source        text CHECK (source IS NULL OR source IN ('signup', 'switcher')),
-  -- Lifted out of `answers` because acquisition is the one question we will
-  -- group by across every tenant, and reaching into jsonb for it every time is
-  -- how a "how did they find us" report ends up not being written.
-  heard_from    text,
-
-  -- { "<question id>": <answer> }. Scalars for single choice, arrays for multi.
-  answers       jsonb NOT NULL DEFAULT '{}'::jsonb,
-
-  created_at    timestamptz NOT NULL DEFAULT now()
-);
-
--- The tenant's own answers, newest first — the read the admin does.
-CREATE INDEX IF NOT EXISTS plg_onboarding_responses_tenant
-  ON public.plg_onboarding_responses (tenant_id, created_at DESC);
--- The cross-tenant read: "what did restaurants say", "where did they come from".
-CREATE INDEX IF NOT EXISTS plg_onboarding_responses_segment
-  ON public.plg_onboarding_responses (vertical_id, heard_from);
-
--- ---------------------------------------------------------------------------
--- RLS. 011 closed `anon` on new public tables but not `authenticated`, which is
--- still born with the full grant — here that would be every tenant reading every
--- other tenant's answers. Stripped first, granted back deliberately.
--- ---------------------------------------------------------------------------
-REVOKE ALL ON public.plg_onboarding_responses FROM anon, authenticated;
-
-ALTER TABLE public.plg_onboarding_responses ENABLE ROW LEVEL SECURITY;
-
--- No UPDATE, no DELETE: this is a record of what someone said at a moment, and
--- an answer that can be rewritten later is not evidence of anything.
-GRANT SELECT, INSERT ON public.plg_onboarding_responses TO authenticated;
-
-DROP POLICY IF EXISTS plg_onboarding_responses_member_read ON public.plg_onboarding_responses;
-CREATE POLICY plg_onboarding_responses_member_read ON public.plg_onboarding_responses
-  FOR SELECT TO authenticated
-  USING (tenant_id IN (SELECT public.user_tenant_ids()));
-
-DROP POLICY IF EXISTS plg_onboarding_responses_member_insert ON public.plg_onboarding_responses;
-CREATE POLICY plg_onboarding_responses_member_insert ON public.plg_onboarding_responses
-  FOR INSERT TO authenticated
-  WITH CHECK (tenant_id IN (SELECT public.user_tenant_ids()) AND user_id = auth.uid());
-
--- ---------------------------------------------------------------------------
--- tenant_slug_available — is this handle free?
---
--- `tenants.slug` is UNIQUE, and RLS keeps a signed-in user from reading tenants
--- they do not belong to. Without this the wizard cannot tell someone their
--- handle is taken until the final submit fails, four questions after they chose
--- it. SECURITY DEFINER, returning only a boolean: it answers "is it free", never
--- "who has it".
--- ---------------------------------------------------------------------------
-CREATE OR REPLACE FUNCTION public.tenant_slug_available(p_slug text)
-RETURNS boolean
-LANGUAGE sql STABLE SECURITY DEFINER
-SET search_path = public, pg_temp
-AS $$
-  SELECT p_slug ~ '^[a-z0-9][a-z0-9-]{1,38}[a-z0-9]$'
-     AND NOT EXISTS (SELECT 1 FROM public.tenants t WHERE t.slug = lower(p_slug));
-$$;
-
-REVOKE ALL ON FUNCTION public.tenant_slug_available(text) FROM PUBLIC, anon;
-GRANT EXECUTE ON FUNCTION public.tenant_slug_available(text) TO authenticated, service_role;