@fayz-ai/db 0.13.0 → 0.14.0

package/migrations/119_migration_config_writers.sql

@@ -1,193 +0,0 @@
--- 119_migration_config_writers.sql
---
--- FieldRules and holidays get their writers; the QR rows get a decision. #144 / #148.
---
--- 091 pointed both at a `config.*` schema that never shipped — the tables are in
--- `public` — and gave neither a writer, so every rule and every holiday landed
--- `pending`.
---
--- THE THREE qr_access_* ROWS ARE DEFERRED, and the reason is worth stating
--- because the allowlist's own note promised something that cannot be delivered:
--- "V1 issued codes become access_grants on the 'qr' channel with a freshly
--- minted secret". Two problems with that.
---
---   1. `public.access_grants` requires a unit_id, a role_id and an expiry. V1's
---      `qr_access_configs` carries `enabled`, `hours_valid` and
---      `scan_window_minutes` — tenant-level and opaque. The unit and the role a
---      V2 grant is FOR are not in the source, so a migrated row would have to
---      invent them.
---   2. A freshly minted secret invalidates every QR code already printed and
---      stuck to a wall. If the codes stop working either way, importing them
---      creates rows nobody can use rather than preserving access.
---
--- So a tenant re-issues its access grants in V2, which takes a minute per unit
--- and is honest about what changed. Sessions were never going to migrate — they
--- expire — and the allowlist already said so.
---
--- V1 `visibility` -> V2 `state`: `required_field_rules` is a list of fields that
--- ARE required, so its writer_args pin state='required'; `field_visibility_rules`
--- carries the vocabulary and is translated, with anything outside it quarantined
--- rather than defaulted (#148).
---
--- Replay-safe: `_allow` upserts under the documented unlock, writers are
--- CREATE OR REPLACE.
-
-ALTER TABLE migration.allowlist DROP CONSTRAINT IF EXISTS allowlist_writer_check;
-ALTER TABLE migration.allowlist ADD CONSTRAINT allowlist_writer_check
-  CHECK (writer IS NULL OR writer IN ('person', 'unit', 'category', 'product', 'order', 'invoice',
-                                      'price_table', 'price_table_item', 'package', 'package_item',
-                                      'field_rule', 'holiday'));
-
-DO $unlock$
-BEGIN
-  PERFORM set_config('migration.allowlist_unlock', 'on', true);
-
-  PERFORM migration._allow('required_field_rules', 'public.field_rules', 'config', 'field_rule', '{"state":"required"}', '{}',
-    '{"uuid":"id","context":"context","entity":"reference","field_key":"field_key","unit_id":"unit_id@companies"}',
-    'PRD 07 / #144: a row here IS a required field, so the state is the writer''s argument rather than a column (#109).');
-
-  PERFORM migration._allow('field_visibility_rules', 'public.field_rules', 'config', 'field_rule', '{}', '{}',
-    '{"uuid":"id","context":"context","entity":"reference","field_key":"field_key","visibility":"state","unit_id":"unit_id@companies"}',
-    'PRD 07 / #144: folded into FieldRules; `visibility` is translated to the 3-state vocabulary and quarantined when it is outside it (#109).');
-
-  PERFORM migration._allow('holidays', 'public.holidays', 'config', 'holiday', '{}', '{}',
-    '{"uuid":"id","date":"date","name":"name","recurring":"recurring","unit_id":"unit_id@companies","units":"jsonb:units"}',
-    'PRD 07: tenant/unit holidays.');
-
-  PERFORM migration._allow('central_holidays', 'public.holidays', 'config', 'holiday', '{"kind":"national"}', '{}',
-    '{"uuid":"id","date":"date","name":"name"}',
-    'National calendar; platform-level rows land as tenant-wide holidays of kind national (#109).');
-
-  DELETE FROM migration.allowlist WHERE source_table IN ('qr_access_configs', 'qr_access_grants', 'qr_access_sessions');
-END $unlock$;
-
-INSERT INTO migration.excluded_tables (source_table, reason) VALUES
-  ('qr_access_configs',  'Deferred: public.access_grants needs a unit, a role and an expiry; V1 qr_access_configs is tenant-level and opaque (enabled / hours_valid / scan_window_minutes), so a migrated grant would have to invent the unit and role it is FOR. A tenant re-issues its access grants in V2 (#109).'),
-  ('qr_access_grants',   'Deferred: issued codes are credentials. Migrating them means minting a new secret, which invalidates every QR already printed — so the row would be unusable either way, and importing it creates dead rows rather than preserving access (#109).'),
-  ('qr_access_sessions', 'Not migrated: live sessions expire. 091 already said so; this makes it a recorded decision instead of a pending row (#109).')
-ON CONFLICT (source_table) DO UPDATE SET reason = EXCLUDED.reason;
-
--- ── field rules ─────────────────────────────────────────────────────────
-CREATE OR REPLACE FUNCTION migration.upsert_field_rule(p_tenant uuid, p_id uuid, p_row jsonb, p_args jsonb DEFAULT '{}'::jsonb)
-RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$
-DECLARE
-  v_state_raw text := coalesce(p_args ->> 'state', nullif(btrim(lower(coalesce(p_row ->> 'state', ''))), ''));
-  v_state text := CASE v_state_raw
-                    WHEN 'required'  THEN 'required'
-                    WHEN 'visible'   THEN 'visible'
-                    WHEN 'hidden'    THEN 'hidden'
-                    -- the V1 vocabulary, translated
-                    WHEN 'optional'  THEN 'visible'
-                    WHEN 'shown'     THEN 'visible'
-                    WHEN 'visivel'   THEN 'visible'
-                    WHEN 'oculto'    THEN 'hidden'
-                    WHEN 'obrigatorio' THEN 'required'
-                  END;
-  v_context text := nullif(btrim(coalesce(p_row ->> 'context', '')), '');
-  v_ref text := lower(nullif(btrim(coalesce(p_row ->> 'reference', '')), ''));
-  v_key text := nullif(btrim(coalesce(p_row ->> 'field_key', '')), '');
-  v_existing_tenant uuid;
-  v_created boolean := false;
-  v_standalone boolean := migration._standalone();
-BEGIN
-  IF v_standalone THEN PERFORM migration._assert_fence(p_tenant); PERFORM set_config('migration.writer', 'on', true); END IF;
-  IF p_id IS NULL OR v_context IS NULL OR v_ref IS NULL OR v_key IS NULL THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'state', 'reason', 'a field rule needs an id, a context, a reference and a field key');
-  END IF;
-  IF v_state IS NULL THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'value',
-      'reason', format('unknown visibility %L (expected hidden|visible|required)', coalesce(v_state_raw, '<null>')));
-  END IF;
-  -- the context is an FK: an unknown one is a broken reference, not a new context
-  IF NOT EXISTS (SELECT 1 FROM public.field_rule_contexts c WHERE c.key = v_context) THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'fk',
-      'reason', format('context %L is not registered in public.field_rule_contexts', v_context));
-  END IF;
-  -- One rule per (tenant, unit, context, reference, field_key, role). A V1 row
-  -- with a different id for a scope that already has a rule is a genuine
-  -- conflict — two sources disagreeing about the same field — so it quarantines
-  -- with that sentence rather than leaking `duplicate key value violates unique
-  -- constraint "field_rules_one_per_scope"` through the generic handler.
-  IF EXISTS (SELECT 1 FROM public.field_rules r
-              WHERE r.tenant_id = p_tenant AND r.id <> p_id
-                AND r.unit_id IS NOT DISTINCT FROM (p_row ->> 'unit_id')::uuid
-                AND r.context = v_context AND r.reference = v_ref AND r.field_key = v_key
-                AND r.role_key IS NOT DISTINCT FROM nullif(btrim(coalesce(p_row ->> 'role_key', '')), '')) THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'state',
-      'reason', format('a field rule already exists for %s/%s/%s in this scope — two sources disagree about the same field', v_context, v_ref, v_key));
-  END IF;
-  SELECT tenant_id INTO v_existing_tenant FROM public.field_rules WHERE id = p_id;
-  IF v_existing_tenant IS NOT NULL AND v_existing_tenant <> p_tenant THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'tenant', 'reason', format('field rule %s already exists in another tenant', p_id));
-  END IF;
-  IF v_existing_tenant IS NULL THEN
-    INSERT INTO public.field_rules (id, tenant_id, unit_id, context, reference, field_key, state, sort_order)
-    VALUES (p_id, p_tenant, (p_row ->> 'unit_id')::uuid, v_context, v_ref, v_key, v_state,
-            coalesce((p_row ->> 'sort_order')::integer, 0));
-    v_created := true;
-  ELSE
-    UPDATE public.field_rules SET
-      unit_id = CASE WHEN p_row ? 'unit_id' THEN (p_row ->> 'unit_id')::uuid ELSE unit_id END,
-      context = v_context, reference = v_ref, field_key = v_key, state = v_state
-    WHERE id = p_id;
-  END IF;
-  IF v_standalone THEN PERFORM migration._audit(p_tenant, 'public.field_rules', p_id, jsonb_build_object('reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END)); END IF;
-  RETURN jsonb_build_object('status', 'migrated', 'target_id', p_id, 'reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END);
-END $$;
-
--- ── holidays ────────────────────────────────────────────────────────────
-CREATE OR REPLACE FUNCTION migration.upsert_holiday(p_tenant uuid, p_id uuid, p_row jsonb, p_args jsonb DEFAULT '{}'::jsonb)
-RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$
-DECLARE
-  v_meta jsonb := coalesce(p_row -> 'metadata', '{}'::jsonb);
-  v_kind text := coalesce(p_args ->> 'kind', 'company');
-  v_date date;
-  v_name text := nullif(btrim(coalesce(p_row ->> 'name', '')), '');
-  v_existing_tenant uuid;
-  v_created boolean := false;
-  v_standalone boolean := migration._standalone();
-BEGIN
-  IF v_standalone THEN PERFORM migration._assert_fence(p_tenant); PERFORM set_config('migration.writer', 'on', true); END IF;
-  BEGIN
-    v_date := (p_row ->> 'date')::date;
-  EXCEPTION WHEN OTHERS THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'value', 'reason', format('%L is not a date', p_row ->> 'date'));
-  END;
-  IF p_id IS NULL OR v_date IS NULL OR v_name IS NULL THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'state', 'reason', 'a holiday needs an id, a date and a name');
-  END IF;
-  IF v_kind NOT IN ('national', 'state', 'city', 'company') THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'value', 'reason', format('unknown holiday kind %L', v_kind));
-  END IF;
-  SELECT tenant_id INTO v_existing_tenant FROM public.holidays WHERE id = p_id;
-  IF v_existing_tenant IS NOT NULL AND v_existing_tenant <> p_tenant THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'tenant', 'reason', format('holiday %s already exists in another tenant', p_id));
-  END IF;
-  IF v_existing_tenant IS NULL THEN
-    INSERT INTO public.holidays (id, tenant_id, unit_id, date, name, kind, recurring, description, is_active, metadata)
-    VALUES (p_id, p_tenant, (p_row ->> 'unit_id')::uuid, v_date, v_name, v_kind,
-            coalesce((p_row ->> 'recurring')::boolean, false), p_row ->> 'description',
-            coalesce((p_row ->> 'is_active')::boolean, true), v_meta);
-    v_created := true;
-  ELSE
-    UPDATE public.holidays SET
-      unit_id = CASE WHEN p_row ? 'unit_id' THEN (p_row ->> 'unit_id')::uuid ELSE unit_id END,
-      date = v_date, name = v_name, kind = v_kind,
-      recurring = CASE WHEN p_row ? 'recurring' THEN coalesce((p_row ->> 'recurring')::boolean, false) ELSE recurring END,
-      description = CASE WHEN p_row ? 'description' THEN p_row ->> 'description' ELSE description END,
-      metadata = migration._merge_meta(metadata, v_meta)
-    WHERE id = p_id;
-  END IF;
-  IF v_standalone THEN PERFORM migration._audit(p_tenant, 'public.holidays', p_id, jsonb_build_object('reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END)); END IF;
-  RETURN jsonb_build_object('status', 'migrated', 'target_id', p_id, 'reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END);
-END $$;
-
-DO $$
-DECLARE r record;
-BEGIN
-  FOR r IN SELECT p.oid::regprocedure AS sig FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
-            WHERE n.nspname = 'migration' AND p.proname IN ('upsert_field_rule', 'upsert_holiday') LOOP
-    EXECUTE format('REVOKE ALL ON FUNCTION %s FROM public, anon, authenticated', r.sig);
-    EXECUTE format('GRANT EXECUTE ON FUNCTION %s TO service_role', r.sig);
-  END LOOP;
-END $$;

package/migrations/120_migration_facet_writer.sql

@@ -1,139 +0,0 @@
--- 120_migration_facet_writer.sql
---
--- One writer for every facet, instead of twenty that each create nothing. #148.
---
--- A large share of the allowlist is not "a table that becomes a table" — it is a
--- FACET: a V1 side-table that enriches a row which already migrated. Barcodes,
--- sale info, fiscal info, sale channels, asset and ingredient info all hang off
--- `products`; general_settings, modules, software profiles and domains all hang
--- off the tenant. `_upsert_row_impl` had no shape for that, so all of them landed
--- `pending` and each would otherwise need a near-identical writer whose only real
--- job is `metadata = metadata || <mapped jsonb>`.
---
--- `upsert_facet` is that shape, parameterised from the allowlist:
---
---   {"target":"public.products"}                     -- parent id comes from the
---                                                       mapped `id` (an @ref the
---                                                       ledger resolved)
---   {"target":"public.tenants","parent":"tenant",     -- parent IS the batch's
---    "column":"settings"}                                tenant; merge into
---                                                       `settings`, not metadata
---
--- It refuses rather than creates. A facet whose parent is not in the destination
--- is an fk quarantine, not a new row: enriching something that does not exist
--- would mean inventing the thing being enriched, and the parent's own table is
--- what owns its creation. That also makes offer ORDER not matter — a facet
--- offered before its parent quarantines, and the next offer of the same row
--- (after the parent lands) migrates it.
---
--- TWO REFERENCE LISTS ARE DEFERRED. `origins` and `partnerships` are V1 lookup
--- tables that people POINT AT; 091 mapped them onto `public.people` with a
--- `jsonb:customer.origin` path and no person reference at all, which cannot be
--- executed — there is no row to enrich. The values reach V2 inside the person
--- that references them, which `upsert_person` already carries.
---
--- Replay-safe: `_allow` upserts under the documented unlock, writer is
--- CREATE OR REPLACE, and the merge is idempotent by construction.
-
-ALTER TABLE migration.allowlist DROP CONSTRAINT IF EXISTS allowlist_writer_check;
-ALTER TABLE migration.allowlist ADD CONSTRAINT allowlist_writer_check
-  CHECK (writer IS NULL OR writer IN ('person', 'unit', 'category', 'product', 'order', 'invoice',
-                                      'price_table', 'price_table_item', 'package', 'package_item',
-                                      'field_rule', 'holiday', 'facet'));
-
-CREATE OR REPLACE FUNCTION migration.upsert_facet(p_tenant uuid, p_id uuid, p_row jsonb, p_args jsonb DEFAULT '{}'::jsonb)
-RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$
-DECLARE
-  v_target text := p_args ->> 'target';
-  v_column text := coalesce(p_args ->> 'column', 'metadata');
-  v_parent uuid;
-  v_meta jsonb := coalesce(p_row -> 'metadata', '{}'::jsonb);
-  v_found boolean;
-  v_standalone boolean := migration._standalone();
-BEGIN
-  IF v_standalone THEN PERFORM migration._assert_fence(p_tenant); PERFORM set_config('migration.writer', 'on', true); END IF;
-  IF v_target IS NULL OR to_regclass(v_target) IS NULL THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'state',
-      'reason', format('the facet writer needs a target table that exists; got %L', coalesce(v_target, '<null>')));
-  END IF;
-  -- Nothing mapped: the facet carries no column this contract keeps. Every
-  -- migrated row is stamped with its origin (`metadata.migration`), so the test
-  -- is "anything BESIDES the marker" — otherwise a facet that maps nothing would
-  -- report a write that changed nothing but the provenance of its parent.
-  IF (v_meta - 'migration') = '{}'::jsonb THEN
-    RETURN jsonb_build_object('status', 'skipped', 'reason', 'the facet maps no column into the destination');
-  END IF;
-
-  IF coalesce(p_args ->> 'parent', 'row') = 'tenant' THEN
-    v_parent := p_tenant;
-  ELSE
-    BEGIN
-      v_parent := (p_row ->> 'id')::uuid;
-    EXCEPTION WHEN OTHERS THEN v_parent := NULL; END;
-    IF v_parent IS NULL THEN
-      RETURN jsonb_build_object('status', 'quarantined', 'kind', 'fk',
-        'reason', format('a facet of %s needs its parent''s id; the mapped reference did not resolve', v_target));
-    END IF;
-  END IF;
-
-  -- public.tenants has no tenant_id column — its own id IS the tenant — so the
-  -- scope predicate differs by parent kind. Every other target is a tenant-scoped
-  -- business table and must be checked in scope, or a facet could enrich a row of
-  -- another tenant that happens to share an id.
-  IF coalesce(p_args ->> 'parent', 'row') = 'tenant' THEN
-    EXECUTE format('SELECT EXISTS (SELECT 1 FROM %s WHERE id = $1)', v_target) INTO v_found USING v_parent;
-  ELSE
-    EXECUTE format('SELECT EXISTS (SELECT 1 FROM %s WHERE id = $1 AND tenant_id = $2)', v_target)
-      INTO v_found USING v_parent, p_tenant;
-  END IF;
-  IF NOT v_found THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'fk',
-      'reason', format('%s %s is not in this tenant yet — a facet enriches a row, it does not create one', v_target, v_parent));
-  END IF;
-
-  IF coalesce(p_args ->> 'parent', 'row') = 'tenant' THEN
-    EXECUTE format('UPDATE %s SET %I = migration._merge_meta(%I, $1), updated_at = now() WHERE id = $2', v_target, v_column, v_column)
-      USING v_meta, v_parent;
-  ELSE
-    EXECUTE format('UPDATE %s SET %I = migration._merge_meta(%I, $1), updated_at = now() WHERE id = $2 AND tenant_id = $3',
-                   v_target, v_column, v_column)
-      USING v_meta, v_parent, p_tenant;
-  END IF;
-
-  IF v_standalone THEN PERFORM migration._audit(p_tenant, v_target, v_parent, jsonb_build_object('reason', 'facet merged')); END IF;
-  RETURN jsonb_build_object('status', 'migrated', 'target_id', v_parent, 'reason', 'facet merged');
-END $$;
-REVOKE ALL ON FUNCTION migration.upsert_facet(uuid, uuid, jsonb, jsonb) FROM public, anon, authenticated;
-GRANT EXECUTE ON FUNCTION migration.upsert_facet(uuid, uuid, jsonb, jsonb) TO service_role;
-
-DO $unlock$
-DECLARE r record;
-BEGIN
-  PERFORM set_config('migration.allowlist_unlock', 'on', true);
-
-  -- facets of a row: the parent's id is the mapped @ref
-  FOR r IN SELECT * FROM (VALUES
-      ('product_barcodes',        'public.products'),
-      ('product_sale_info',       'public.products'),
-      ('product_sale_channels',   'public.products'),
-      ('product_fiscal_info',     'public.products'),
-      ('product_asset_info',      'public.products'),
-      ('product_ingredient_info', 'public.products')
-    ) AS t(src, tgt)
-  LOOP
-    UPDATE migration.allowlist SET writer = 'facet', writer_args = jsonb_build_object('target', r.tgt)
-     WHERE source_table = r.src;
-  END LOOP;
-
-  -- facets of the tenant: general_settings lands in `settings` (it IS the
-  -- settings registry #138 reads), the rest describe the tenant and land there too
-  UPDATE migration.allowlist SET writer = 'facet', writer_args = jsonb_build_object('target', 'public.tenants', 'parent', 'tenant', 'column', 'settings')
-   WHERE source_table IN ('general_settings', 'modules', 'software_profiles', 'software_profile_modules', 'tenant_domains', 'licenses_admin');
-
-  DELETE FROM migration.allowlist WHERE source_table IN ('origins', 'partnerships');
-END $unlock$;
-
-INSERT INTO migration.excluded_tables (source_table, reason) VALUES
-  ('origins',      'Deferred: a V1 lookup table that clients POINT AT. 091 mapped it onto public.people with a jsonb:customer.origin path and no person reference, which cannot be executed — there is no row to enrich. The value reaches V2 inside the person that references it (#110).'),
-  ('partnerships', 'Deferred: same shape as origins — a reference list, not a row of public.people (#110).')
-ON CONFLICT (source_table) DO UPDATE SET reason = EXCLUDED.reason;

package/migrations/121_migration_financial_writers.sql

@@ -1,294 +0,0 @@
--- 121_migration_financial_writers.sql
---
--- The financial reference tables get their writers. #142 / #148.
---
--- Every financial row in the allowlist had `writer = NULL`, so accounts, payment
--- methods, card brands, the chart of accounts and cost centres all landed
--- `pending`. These are the reference data a tenant's money hangs off — without
--- them no movement can resolve its account, so they come before the ledger
--- itself (112).
---
--- FOUR MAPPINGS NAMED COLUMNS THAT DO NOT EXIST, the same silent-drop shape as
--- #198 and the `counterparty_id` bug. Corrected here rather than left for a
--- writer to ignore:
---
---   chart_of_accounts.account_type -> node_type  (there is no `kind` column)
---   cost_centers.description       -> dropped    (no column; V1's free text has
---                                                 no home and inventing one for
---                                                 a cost centre's description is
---                                                 not worth a JSONB bag)
---   account_central/bank_accounts.account_type -> kind, and VALIDATED: the
---   ledger's eight kinds are a closed vocabulary (bank, cash_physical,
---   cash_session, card_receivable_credit/_debit, card_payable, person, system),
---   and a V1 account_type outside it quarantines rather than defaulting to
---   'bank' — an account posted to the wrong kind puts money in the wrong place
---   and nothing downstream would notice.
---
--- `cash_session_reviewers` becomes a facet of the session (110's writer), which
--- is what 091 already called it.
---
--- Replay-safe: `_allow` upserts under the documented unlock; writers are
--- CREATE OR REPLACE.
-
-ALTER TABLE migration.allowlist DROP CONSTRAINT IF EXISTS allowlist_writer_check;
-ALTER TABLE migration.allowlist ADD CONSTRAINT allowlist_writer_check
-  CHECK (writer IS NULL OR writer IN ('person', 'unit', 'category', 'product', 'order', 'invoice',
-                                      'price_table', 'price_table_item', 'package', 'package_item',
-                                      'field_rule', 'holiday', 'facet',
-                                      'fin_account', 'fin_payment_method_type', 'fin_payment_method',
-                                      'fin_card_brand', 'fin_chart_account', 'fin_cost_center'));
-
-DO $unlock$
-BEGIN
-  PERFORM set_config('migration.allowlist_unlock', 'on', true);
-
-  UPDATE migration.allowlist SET writer = 'fin_account' WHERE source_table IN ('account_central', 'bank_accounts');
-  UPDATE migration.allowlist SET writer = 'fin_payment_method_type' WHERE source_table = 'payment_method_types';
-  UPDATE migration.allowlist SET writer = 'fin_payment_method' WHERE source_table = 'payment_methods';
-  UPDATE migration.allowlist SET writer = 'fin_card_brand' WHERE source_table = 'card_brands';
-
-  -- account_type is node_type here; there is no `kind` column on the chart
-  UPDATE migration.allowlist SET writer = 'fin_chart_account',
-         columns = '{"uuid":"id","code":"code","name":"name","account_type":"node_type","parent_id":"parent_id@chart_of_accounts","active":"is_active"}'::jsonb,
-         notes = 'PRD 05. V1 account_type is the node_type of the chart, not a `kind` — the column named in 091 does not exist (#111).'
-   WHERE source_table = 'chart_of_accounts';
-
-  -- a cost centre has code, name and is_active in V2; the V1 description has no home
-  UPDATE migration.allowlist SET writer = 'fin_cost_center',
-         columns = '{"uuid":"id","code":"code","name":"name","description":"-","active":"is_active"}'::jsonb,
-         notes = 'PRD 05. V1 `description` is explicitly not migrated: public.plg_financial_cost_centers has no column for it and a JSONB bag for one free-text field is not worth the drift (#111).'
-   WHERE source_table = 'cost_centers';
-
-  UPDATE migration.allowlist SET writer = 'facet',
-         writer_args = jsonb_build_object('target', 'public.plg_financial_cash_register_sessions')
-   WHERE source_table = 'cash_session_reviewers';
-END $unlock$;
-
-CREATE OR REPLACE FUNCTION migration.upsert_fin_account(p_tenant uuid, p_id uuid, p_row jsonb, p_args jsonb DEFAULT '{}'::jsonb)
-RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$
-DECLARE
-  v_meta jsonb := coalesce(p_row -> 'metadata', '{}'::jsonb);
-  v_existing_tenant uuid;
-  v_created boolean := false;
-  v_standalone boolean := migration._standalone();
-BEGIN
-  IF v_standalone THEN PERFORM migration._assert_fence(p_tenant); PERFORM set_config('migration.writer', 'on', true); END IF;
-  IF p_id IS NULL OR nullif(btrim(coalesce(p_row ->> 'name', '')), '') IS NULL THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'state', 'reason', 'this row needs an id and a name');
-  END IF;
-  IF coalesce(p_row ->> 'kind', 'bank') NOT IN ('bank', 'cash_physical', 'cash_session', 'card_receivable_credit',
-                                               'card_receivable_debit', 'card_payable', 'person', 'system') THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'value',
-      'reason', format('unknown account kind %L — V1 account_type does not map onto the ledger''s eight', p_row ->> 'kind'));
-  END IF;
-  SELECT tenant_id INTO v_existing_tenant FROM public.plg_financial_accounts WHERE id = p_id;
-  IF v_existing_tenant IS NOT NULL AND v_existing_tenant <> p_tenant THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'tenant', 'reason', format('%s already exists in another tenant', p_id));
-  END IF;
-  IF v_existing_tenant IS NULL THEN
-    INSERT INTO public.plg_financial_accounts (id, tenant_id, unit_id, kind, code, name, bank_name, settlement_days, is_active, metadata)
-    VALUES (p_id, p_tenant,
-            (p_row ->> 'unit_id')::uuid,
-            coalesce(p_row ->> 'kind', 'bank'),
-            p_row ->> 'code',
-            p_row ->> 'name',
-            p_row ->> 'bank_name',
-            (p_row ->> 'settlement_days')::integer,
-            coalesce((p_row ->> 'is_active')::boolean, true),
-            v_meta);
-    v_created := true;
-  ELSE
-    UPDATE public.plg_financial_accounts SET
-      unit_id = CASE WHEN p_row ? 'unit_id' THEN (p_row ->> 'unit_id')::uuid ELSE unit_id END,
-      kind = CASE WHEN p_row ? 'kind' THEN coalesce(p_row ->> 'kind', 'bank') ELSE kind END,
-      code = CASE WHEN p_row ? 'code' THEN p_row ->> 'code' ELSE code END,
-      name = CASE WHEN p_row ? 'name' THEN p_row ->> 'name' ELSE name END,
-      bank_name = CASE WHEN p_row ? 'bank_name' THEN p_row ->> 'bank_name' ELSE bank_name END,
-      settlement_days = CASE WHEN p_row ? 'settlement_days' THEN (p_row ->> 'settlement_days')::integer ELSE settlement_days END,
-      is_active = CASE WHEN p_row ? 'is_active' THEN coalesce((p_row ->> 'is_active')::boolean, true) ELSE is_active END,
-      metadata = migration._merge_meta(metadata, v_meta)
-    WHERE id = p_id;
-  END IF;
-  IF v_standalone THEN PERFORM migration._audit(p_tenant, 'public.plg_financial_accounts', p_id, jsonb_build_object('reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END)); END IF;
-  RETURN jsonb_build_object('status', 'migrated', 'target_id', p_id, 'reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END);
-END $$;
-
-CREATE OR REPLACE FUNCTION migration.upsert_fin_payment_method_type(p_tenant uuid, p_id uuid, p_row jsonb, p_args jsonb DEFAULT '{}'::jsonb)
-RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$
-DECLARE
-  v_meta jsonb := coalesce(p_row -> 'metadata', '{}'::jsonb);
-  v_existing_tenant uuid;
-  v_created boolean := false;
-  v_standalone boolean := migration._standalone();
-BEGIN
-  IF v_standalone THEN PERFORM migration._assert_fence(p_tenant); PERFORM set_config('migration.writer', 'on', true); END IF;
-  IF p_id IS NULL OR nullif(btrim(coalesce(p_row ->> 'name', '')), '') IS NULL THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'state', 'reason', 'this row needs an id and a name');
-  END IF;
-  SELECT tenant_id INTO v_existing_tenant FROM public.plg_financial_payment_method_types WHERE id = p_id;
-  IF v_existing_tenant IS NOT NULL AND v_existing_tenant <> p_tenant THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'tenant', 'reason', format('%s already exists in another tenant', p_id));
-  END IF;
-  IF v_existing_tenant IS NULL THEN
-    INSERT INTO public.plg_financial_payment_method_types (id, tenant_id, name, is_active)
-    VALUES (p_id, p_tenant,
-            p_row ->> 'name',
-            coalesce((p_row ->> 'is_active')::boolean, true));
-    v_created := true;
-  ELSE
-    UPDATE public.plg_financial_payment_method_types SET
-      name = CASE WHEN p_row ? 'name' THEN p_row ->> 'name' ELSE name END,
-      is_active = CASE WHEN p_row ? 'is_active' THEN coalesce((p_row ->> 'is_active')::boolean, true) ELSE is_active END
-    WHERE id = p_id;
-  END IF;
-  IF v_standalone THEN PERFORM migration._audit(p_tenant, 'public.plg_financial_payment_method_types', p_id, jsonb_build_object('reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END)); END IF;
-  RETURN jsonb_build_object('status', 'migrated', 'target_id', p_id, 'reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END);
-END $$;
-
-CREATE OR REPLACE FUNCTION migration.upsert_fin_payment_method(p_tenant uuid, p_id uuid, p_row jsonb, p_args jsonb DEFAULT '{}'::jsonb)
-RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$
-DECLARE
-  v_meta jsonb := coalesce(p_row -> 'metadata', '{}'::jsonb);
-  v_existing_tenant uuid;
-  v_created boolean := false;
-  v_standalone boolean := migration._standalone();
-BEGIN
-  IF v_standalone THEN PERFORM migration._assert_fence(p_tenant); PERFORM set_config('migration.writer', 'on', true); END IF;
-  IF p_id IS NULL OR nullif(btrim(coalesce(p_row ->> 'name', '')), '') IS NULL THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'state', 'reason', 'this row needs an id and a name');
-  END IF;
-  SELECT tenant_id INTO v_existing_tenant FROM public.plg_financial_payment_methods WHERE id = p_id;
-  IF v_existing_tenant IS NOT NULL AND v_existing_tenant <> p_tenant THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'tenant', 'reason', format('%s already exists in another tenant', p_id));
-  END IF;
-  IF v_existing_tenant IS NULL THEN
-    INSERT INTO public.plg_financial_payment_methods (id, tenant_id, name, payment_method_type_id, is_active)
-    VALUES (p_id, p_tenant,
-            p_row ->> 'name',
-            (p_row ->> 'type_id')::uuid,
-            coalesce((p_row ->> 'is_active')::boolean, true));
-    v_created := true;
-  ELSE
-    UPDATE public.plg_financial_payment_methods SET
-      name = CASE WHEN p_row ? 'name' THEN p_row ->> 'name' ELSE name END,
-      payment_method_type_id = CASE WHEN p_row ? 'payment_method_type_id' THEN (p_row ->> 'type_id')::uuid ELSE payment_method_type_id END,
-      is_active = CASE WHEN p_row ? 'is_active' THEN coalesce((p_row ->> 'is_active')::boolean, true) ELSE is_active END
-    WHERE id = p_id;
-  END IF;
-  IF v_standalone THEN PERFORM migration._audit(p_tenant, 'public.plg_financial_payment_methods', p_id, jsonb_build_object('reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END)); END IF;
-  RETURN jsonb_build_object('status', 'migrated', 'target_id', p_id, 'reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END);
-END $$;
-
-CREATE OR REPLACE FUNCTION migration.upsert_fin_card_brand(p_tenant uuid, p_id uuid, p_row jsonb, p_args jsonb DEFAULT '{}'::jsonb)
-RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$
-DECLARE
-  v_meta jsonb := coalesce(p_row -> 'metadata', '{}'::jsonb);
-  v_existing_tenant uuid;
-  v_created boolean := false;
-  v_standalone boolean := migration._standalone();
-BEGIN
-  IF v_standalone THEN PERFORM migration._assert_fence(p_tenant); PERFORM set_config('migration.writer', 'on', true); END IF;
-  IF p_id IS NULL OR nullif(btrim(coalesce(p_row ->> 'name', '')), '') IS NULL THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'state', 'reason', 'this row needs an id and a name');
-  END IF;
-  SELECT tenant_id INTO v_existing_tenant FROM public.plg_financial_card_brands WHERE id = p_id;
-  IF v_existing_tenant IS NOT NULL AND v_existing_tenant <> p_tenant THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'tenant', 'reason', format('%s already exists in another tenant', p_id));
-  END IF;
-  IF v_existing_tenant IS NULL THEN
-    INSERT INTO public.plg_financial_card_brands (id, tenant_id, name, is_active)
-    VALUES (p_id, p_tenant,
-            p_row ->> 'name',
-            coalesce((p_row ->> 'is_active')::boolean, true));
-    v_created := true;
-  ELSE
-    UPDATE public.plg_financial_card_brands SET
-      name = CASE WHEN p_row ? 'name' THEN p_row ->> 'name' ELSE name END,
-      is_active = CASE WHEN p_row ? 'is_active' THEN coalesce((p_row ->> 'is_active')::boolean, true) ELSE is_active END
-    WHERE id = p_id;
-  END IF;
-  IF v_standalone THEN PERFORM migration._audit(p_tenant, 'public.plg_financial_card_brands', p_id, jsonb_build_object('reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END)); END IF;
-  RETURN jsonb_build_object('status', 'migrated', 'target_id', p_id, 'reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END);
-END $$;
-
-CREATE OR REPLACE FUNCTION migration.upsert_fin_chart_account(p_tenant uuid, p_id uuid, p_row jsonb, p_args jsonb DEFAULT '{}'::jsonb)
-RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$
-DECLARE
-  v_meta jsonb := coalesce(p_row -> 'metadata', '{}'::jsonb);
-  v_existing_tenant uuid;
-  v_created boolean := false;
-  v_standalone boolean := migration._standalone();
-BEGIN
-  IF v_standalone THEN PERFORM migration._assert_fence(p_tenant); PERFORM set_config('migration.writer', 'on', true); END IF;
-  IF p_id IS NULL OR nullif(btrim(coalesce(p_row ->> 'name', '')), '') IS NULL THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'state', 'reason', 'this row needs an id and a name');
-  END IF;
-  SELECT tenant_id INTO v_existing_tenant FROM public.plg_financial_chart_of_accounts WHERE id = p_id;
-  IF v_existing_tenant IS NOT NULL AND v_existing_tenant <> p_tenant THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'tenant', 'reason', format('%s already exists in another tenant', p_id));
-  END IF;
-  IF v_existing_tenant IS NULL THEN
-    INSERT INTO public.plg_financial_chart_of_accounts (id, tenant_id, code, name, node_type, parent_id, is_active)
-    VALUES (p_id, p_tenant,
-            p_row ->> 'code',
-            p_row ->> 'name',
-            coalesce(p_row ->> 'node_type', 'account'),
-            (p_row ->> 'parent_id')::uuid,
-            coalesce((p_row ->> 'is_active')::boolean, true));
-    v_created := true;
-  ELSE
-    UPDATE public.plg_financial_chart_of_accounts SET
-      code = CASE WHEN p_row ? 'code' THEN p_row ->> 'code' ELSE code END,
-      name = CASE WHEN p_row ? 'name' THEN p_row ->> 'name' ELSE name END,
-      node_type = CASE WHEN p_row ? 'node_type' THEN coalesce(p_row ->> 'node_type', 'account') ELSE node_type END,
-      parent_id = CASE WHEN p_row ? 'parent_id' THEN (p_row ->> 'parent_id')::uuid ELSE parent_id END,
-      is_active = CASE WHEN p_row ? 'is_active' THEN coalesce((p_row ->> 'is_active')::boolean, true) ELSE is_active END
-    WHERE id = p_id;
-  END IF;
-  IF v_standalone THEN PERFORM migration._audit(p_tenant, 'public.plg_financial_chart_of_accounts', p_id, jsonb_build_object('reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END)); END IF;
-  RETURN jsonb_build_object('status', 'migrated', 'target_id', p_id, 'reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END);
-END $$;
-
-CREATE OR REPLACE FUNCTION migration.upsert_fin_cost_center(p_tenant uuid, p_id uuid, p_row jsonb, p_args jsonb DEFAULT '{}'::jsonb)
-RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$
-DECLARE
-  v_meta jsonb := coalesce(p_row -> 'metadata', '{}'::jsonb);
-  v_existing_tenant uuid;
-  v_created boolean := false;
-  v_standalone boolean := migration._standalone();
-BEGIN
-  IF v_standalone THEN PERFORM migration._assert_fence(p_tenant); PERFORM set_config('migration.writer', 'on', true); END IF;
-  IF p_id IS NULL OR nullif(btrim(coalesce(p_row ->> 'name', '')), '') IS NULL THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'state', 'reason', 'this row needs an id and a name');
-  END IF;
-  SELECT tenant_id INTO v_existing_tenant FROM public.plg_financial_cost_centers WHERE id = p_id;
-  IF v_existing_tenant IS NOT NULL AND v_existing_tenant <> p_tenant THEN
-    RETURN jsonb_build_object('status', 'quarantined', 'kind', 'tenant', 'reason', format('%s already exists in another tenant', p_id));
-  END IF;
-  IF v_existing_tenant IS NULL THEN
-    INSERT INTO public.plg_financial_cost_centers (id, tenant_id, code, name, is_active)
-    VALUES (p_id, p_tenant,
-            p_row ->> 'code',
-            p_row ->> 'name',
-            coalesce((p_row ->> 'is_active')::boolean, true));
-    v_created := true;
-  ELSE
-    UPDATE public.plg_financial_cost_centers SET
-      code = CASE WHEN p_row ? 'code' THEN p_row ->> 'code' ELSE code END,
-      name = CASE WHEN p_row ? 'name' THEN p_row ->> 'name' ELSE name END,
-      is_active = CASE WHEN p_row ? 'is_active' THEN coalesce((p_row ->> 'is_active')::boolean, true) ELSE is_active END
-    WHERE id = p_id;
-  END IF;
-  IF v_standalone THEN PERFORM migration._audit(p_tenant, 'public.plg_financial_cost_centers', p_id, jsonb_build_object('reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END)); END IF;
-  RETURN jsonb_build_object('status', 'migrated', 'target_id', p_id, 'reason', CASE WHEN v_created THEN 'created' ELSE 'updated' END);
-END $$;
-
-DO $$
-DECLARE r record;
-BEGIN
-  FOR r IN SELECT p.oid::regprocedure AS sig FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
-            WHERE n.nspname = 'migration' AND p.proname LIKE 'upsert\_fin\_%' LOOP
-    EXECUTE format('REVOKE ALL ON FUNCTION %s FROM public, anon, authenticated', r.sig);
-    EXECUTE format('GRANT EXECUTE ON FUNCTION %s TO service_role', r.sig);
-  END LOOP;
-END $$;