@fayz-ai/db 0.13.0 → 0.15.0

package/migrations/070_permission_catalog.sql

@@ -1,205 +0,0 @@
--- ============================================================================
--- 070_permission_catalog.sql — the RBAC catalog seeded from declaredFeatures (#136).
---
--- GENERATED by scripts/emit-permission-catalog.mjs — do not edit by hand.
---   regenerate:  pnpm emit:permission-catalog
---   verify:      pnpm check:permission-catalog   (CI: fails when out of date)
--- Once this file is recorded in a real database's ledger it is frozen: regenerate
--- into a NEW numbered file (--out …/0NN_permission_catalog_vK.sql), never here.
---
--- One key per {feature}.{action}; app.seed_permissions upserts and never removes
--- (removing a key is a decision, not a build). New keys reach every tenant's
--- system owner role through the permissions_grant_owner trigger (043).
---
--- Sources (plugin id ← manifest: features; [c] = conditional on config, [r] = referenced only):
---   admin ← plugins/plugin-admin/src/index.ts: admin
---   agenda ← plugins/plugin-agenda/src/index.ts: agenda.schedules, appointments
---   automations ← plugins/plugin-automations/src/index.ts: automations
---   blog ← plugins/plugin-blog/src/index.ts: blog
---   conversations ← plugins/plugin-conversations/src/index.ts: conversations
---   courses ← plugins/plugin-courses/src/index.ts: courses, courses.finance, courses.sales
---   crm ← plugins/plugin-crm/src/index.ts: crm.leads, crm.pipeline, crm.quotes, sales
---   dashboard ← plugins/plugin-dashboard/src/index.ts: dashboard
---   financial ← plugins/plugin-financial/src/index.ts: financial, financial.commissions[c], financial.payables[c], financial.receivables[c]
---   custom_forms ← plugins/plugin-forms/src/index.ts: custom_forms
---   inventory ← plugins/plugin-inventory/src/index.ts: inventory, inventory.recipes[c]
---   marketing ← plugins/plugin-marketing/src/index.ts: marketing, marketing.blog[c], marketing.content[c], marketing.landing-pages[c]
---   menu ← plugins/plugin-menu/src/index.ts: menu[r]
---   orders ← plugins/plugin-orders/src/index.ts: orders[r]
---   reports ← plugins/plugin-reports/src/index.ts: reports
---   reputation ← plugins/plugin-reputation/src/index.ts: reputation
---   scribe ← plugins/plugin-scribe/src/index.ts: scribe{read,create,edit,delete}
---   shop ← plugins/plugin-shop/src/index.ts: shop[r]
---   sites ← plugins/plugin-sites/src/index.ts: sites
---   tables ← plugins/plugin-tables/src/index.ts: tables[r]
--- ============================================================================
-
-SELECT app.seed_permissions('[
-  {"key":"admin.create","plugin":"admin"},
-  {"key":"admin.delete","plugin":"admin"},
-  {"key":"admin.edit","plugin":"admin"},
-  {"key":"admin.manage","plugin":"admin"},
-  {"key":"admin.read","plugin":"admin"},
-  {"key":"agenda.schedules.create","plugin":"agenda","description":"Schedule Management: create"},
-  {"key":"agenda.schedules.delete","plugin":"agenda","description":"Schedule Management: delete"},
-  {"key":"agenda.schedules.edit","plugin":"agenda","description":"Schedule Management: edit"},
-  {"key":"agenda.schedules.manage","plugin":"agenda","description":"Schedule Management: manage"},
-  {"key":"agenda.schedules.read","plugin":"agenda","description":"Schedule Management: read"},
-  {"key":"appointments.create","plugin":"agenda"},
-  {"key":"appointments.delete","plugin":"agenda"},
-  {"key":"appointments.edit","plugin":"agenda"},
-  {"key":"appointments.manage","plugin":"agenda"},
-  {"key":"appointments.read","plugin":"agenda"},
-  {"key":"automations.create","plugin":"automations","description":"Automations: create"},
-  {"key":"automations.delete","plugin":"automations","description":"Automations: delete"},
-  {"key":"automations.edit","plugin":"automations","description":"Automations: edit"},
-  {"key":"automations.manage","plugin":"automations","description":"Automations: manage"},
-  {"key":"automations.read","plugin":"automations","description":"Automations: read"},
-  {"key":"blog.create","plugin":"blog","description":"Blog: create"},
-  {"key":"blog.delete","plugin":"blog","description":"Blog: delete"},
-  {"key":"blog.edit","plugin":"blog","description":"Blog: edit"},
-  {"key":"blog.manage","plugin":"blog","description":"Blog: manage"},
-  {"key":"blog.read","plugin":"blog","description":"Blog: read"},
-  {"key":"conversations.create","plugin":"conversations","description":"Conversations: create"},
-  {"key":"conversations.delete","plugin":"conversations","description":"Conversations: delete"},
-  {"key":"conversations.edit","plugin":"conversations","description":"Conversations: edit"},
-  {"key":"conversations.manage","plugin":"conversations","description":"Conversations: manage"},
-  {"key":"conversations.read","plugin":"conversations","description":"Conversations: read"},
-  {"key":"courses.create","plugin":"courses","description":"Courses: create"},
-  {"key":"courses.delete","plugin":"courses","description":"Courses: delete"},
-  {"key":"courses.edit","plugin":"courses","description":"Courses: edit"},
-  {"key":"courses.finance.create","plugin":"courses","description":"Financial: create"},
-  {"key":"courses.finance.delete","plugin":"courses","description":"Financial: delete"},
-  {"key":"courses.finance.edit","plugin":"courses","description":"Financial: edit"},
-  {"key":"courses.finance.manage","plugin":"courses","description":"Financial: manage"},
-  {"key":"courses.finance.read","plugin":"courses","description":"Financial: read"},
-  {"key":"courses.manage","plugin":"courses","description":"Courses: manage"},
-  {"key":"courses.read","plugin":"courses","description":"Courses: read"},
-  {"key":"courses.sales.create","plugin":"courses","description":"Sales: create"},
-  {"key":"courses.sales.delete","plugin":"courses","description":"Sales: delete"},
-  {"key":"courses.sales.edit","plugin":"courses","description":"Sales: edit"},
-  {"key":"courses.sales.manage","plugin":"courses","description":"Sales: manage"},
-  {"key":"courses.sales.read","plugin":"courses","description":"Sales: read"},
-  {"key":"crm.leads.create","plugin":"crm"},
-  {"key":"crm.leads.delete","plugin":"crm"},
-  {"key":"crm.leads.edit","plugin":"crm"},
-  {"key":"crm.leads.manage","plugin":"crm"},
-  {"key":"crm.leads.read","plugin":"crm"},
-  {"key":"crm.pipeline.create","plugin":"crm"},
-  {"key":"crm.pipeline.delete","plugin":"crm"},
-  {"key":"crm.pipeline.edit","plugin":"crm"},
-  {"key":"crm.pipeline.manage","plugin":"crm"},
-  {"key":"crm.pipeline.read","plugin":"crm"},
-  {"key":"crm.quotes.create","plugin":"crm"},
-  {"key":"crm.quotes.delete","plugin":"crm"},
-  {"key":"crm.quotes.edit","plugin":"crm"},
-  {"key":"crm.quotes.manage","plugin":"crm"},
-  {"key":"crm.quotes.read","plugin":"crm"},
-  {"key":"custom_forms.create","plugin":"custom_forms"},
-  {"key":"custom_forms.delete","plugin":"custom_forms"},
-  {"key":"custom_forms.edit","plugin":"custom_forms"},
-  {"key":"custom_forms.manage","plugin":"custom_forms"},
-  {"key":"custom_forms.read","plugin":"custom_forms"},
-  {"key":"dashboard.create","plugin":"dashboard"},
-  {"key":"dashboard.delete","plugin":"dashboard"},
-  {"key":"dashboard.edit","plugin":"dashboard"},
-  {"key":"dashboard.manage","plugin":"dashboard"},
-  {"key":"dashboard.read","plugin":"dashboard"},
-  {"key":"financial.commissions.create","plugin":"financial"},
-  {"key":"financial.commissions.delete","plugin":"financial"},
-  {"key":"financial.commissions.edit","plugin":"financial"},
-  {"key":"financial.commissions.manage","plugin":"financial"},
-  {"key":"financial.commissions.read","plugin":"financial"},
-  {"key":"financial.create","plugin":"financial"},
-  {"key":"financial.delete","plugin":"financial"},
-  {"key":"financial.edit","plugin":"financial"},
-  {"key":"financial.manage","plugin":"financial"},
-  {"key":"financial.payables.create","plugin":"financial"},
-  {"key":"financial.payables.delete","plugin":"financial"},
-  {"key":"financial.payables.edit","plugin":"financial"},
-  {"key":"financial.payables.manage","plugin":"financial"},
-  {"key":"financial.payables.read","plugin":"financial"},
-  {"key":"financial.read","plugin":"financial"},
-  {"key":"financial.read_all","plugin":"financial"},
-  {"key":"financial.receivables.create","plugin":"financial"},
-  {"key":"financial.receivables.delete","plugin":"financial"},
-  {"key":"financial.receivables.edit","plugin":"financial"},
-  {"key":"financial.receivables.manage","plugin":"financial"},
-  {"key":"financial.receivables.read","plugin":"financial"},
-  {"key":"inventory.create","plugin":"inventory"},
-  {"key":"inventory.delete","plugin":"inventory"},
-  {"key":"inventory.edit","plugin":"inventory"},
-  {"key":"inventory.manage","plugin":"inventory"},
-  {"key":"inventory.read","plugin":"inventory"},
-  {"key":"inventory.recipes.create","plugin":"inventory"},
-  {"key":"inventory.recipes.delete","plugin":"inventory"},
-  {"key":"inventory.recipes.edit","plugin":"inventory"},
-  {"key":"inventory.recipes.manage","plugin":"inventory"},
-  {"key":"inventory.recipes.read","plugin":"inventory"},
-  {"key":"marketing.blog.create","plugin":"marketing"},
-  {"key":"marketing.blog.delete","plugin":"marketing"},
-  {"key":"marketing.blog.edit","plugin":"marketing"},
-  {"key":"marketing.blog.manage","plugin":"marketing"},
-  {"key":"marketing.blog.read","plugin":"marketing"},
-  {"key":"marketing.content.create","plugin":"marketing"},
-  {"key":"marketing.content.delete","plugin":"marketing"},
-  {"key":"marketing.content.edit","plugin":"marketing"},
-  {"key":"marketing.content.manage","plugin":"marketing"},
-  {"key":"marketing.content.read","plugin":"marketing"},
-  {"key":"marketing.create","plugin":"marketing"},
-  {"key":"marketing.delete","plugin":"marketing"},
-  {"key":"marketing.edit","plugin":"marketing"},
-  {"key":"marketing.landing-pages.create","plugin":"marketing"},
-  {"key":"marketing.landing-pages.delete","plugin":"marketing"},
-  {"key":"marketing.landing-pages.edit","plugin":"marketing"},
-  {"key":"marketing.landing-pages.manage","plugin":"marketing"},
-  {"key":"marketing.landing-pages.read","plugin":"marketing"},
-  {"key":"marketing.manage","plugin":"marketing"},
-  {"key":"marketing.read","plugin":"marketing"},
-  {"key":"menu.create","plugin":"menu"},
-  {"key":"menu.delete","plugin":"menu"},
-  {"key":"menu.edit","plugin":"menu"},
-  {"key":"menu.manage","plugin":"menu"},
-  {"key":"menu.read","plugin":"menu"},
-  {"key":"orders.create","plugin":"orders"},
-  {"key":"orders.delete","plugin":"orders"},
-  {"key":"orders.edit","plugin":"orders"},
-  {"key":"orders.manage","plugin":"orders"},
-  {"key":"orders.read","plugin":"orders"},
-  {"key":"orders.read_all","plugin":"orders"},
-  {"key":"reports.create","plugin":"reports"},
-  {"key":"reports.delete","plugin":"reports"},
-  {"key":"reports.edit","plugin":"reports"},
-  {"key":"reports.manage","plugin":"reports"},
-  {"key":"reports.read","plugin":"reports"},
-  {"key":"reputation.create","plugin":"reputation","description":"Reputation: create"},
-  {"key":"reputation.delete","plugin":"reputation","description":"Reputation: delete"},
-  {"key":"reputation.edit","plugin":"reputation","description":"Reputation: edit"},
-  {"key":"reputation.manage","plugin":"reputation","description":"Reputation: manage"},
-  {"key":"reputation.read","plugin":"reputation","description":"Reputation: read"},
-  {"key":"sales.create","plugin":"crm"},
-  {"key":"sales.delete","plugin":"crm"},
-  {"key":"sales.edit","plugin":"crm"},
-  {"key":"sales.manage","plugin":"crm"},
-  {"key":"sales.read","plugin":"crm"},
-  {"key":"scribe.create","plugin":"scribe"},
-  {"key":"scribe.delete","plugin":"scribe"},
-  {"key":"scribe.edit","plugin":"scribe"},
-  {"key":"scribe.manage","plugin":"scribe"},
-  {"key":"scribe.read","plugin":"scribe"},
-  {"key":"shop.create","plugin":"shop"},
-  {"key":"shop.delete","plugin":"shop"},
-  {"key":"shop.edit","plugin":"shop"},
-  {"key":"shop.manage","plugin":"shop"},
-  {"key":"shop.read","plugin":"shop"},
-  {"key":"sites.create","plugin":"sites","description":"Sites & Funnels: create"},
-  {"key":"sites.delete","plugin":"sites","description":"Sites & Funnels: delete"},
-  {"key":"sites.edit","plugin":"sites","description":"Sites & Funnels: edit"},
-  {"key":"sites.manage","plugin":"sites","description":"Sites & Funnels: manage"},
-  {"key":"sites.read","plugin":"sites","description":"Sites & Funnels: read"},
-  {"key":"tables.create","plugin":"tables"},
-  {"key":"tables.delete","plugin":"tables"},
-  {"key":"tables.edit","plugin":"tables"},
-  {"key":"tables.manage","plugin":"tables"},
-  {"key":"tables.read","plugin":"tables"}
-]'::jsonb);

package/migrations/071_v1_permission_map.sql

@@ -1,266 +0,0 @@
--- ============================================================================
--- 071_v1_permission_map.sql — the V1 → V2 permission mapping as data (#136).
---
--- V1 (the-chef / beautyplace) had one catalog of snake_case codes × four flags
--- (can_view / can_insert / can_edit / can_delete) per "regra de permissão", an
--- admin/master/owner bypass in code and a per-tenant enforcement flag. V2 has
--- '{plugin}.{action}' keys, roles per tenant and RLS as the only law.
---
--- The mapping was produced by reading the V1 REPO (src/**, supabase/functions/**,
--- supabase/migrations/**; never a data dump): every code seeded by a migration
--- plus every code the code enforces, each decided as
---   mapped   → a V2 feature (the four flags expand to read/create/edit/delete)
---              or one V2 key (any flag grants it), plus optional extra keys
---   backlog  → V2 has no surface for it yet: nothing is granted, nothing is lost
---              in a way anyone can act on today (listed for the roadmap)
---   dropped  → superseded/inactive in V1, or a bypass/flag V2 refuses to carry
--- The prose (why each row) is docs/data/phase-0/01b-v1-permission-mapping.md;
--- this table is what the extractor/ledger slice reads. Rows only, no client data.
---
--- app.v1_permission_keys(code, view, insert, edit, delete) is the one function
--- that turns a V1 rule detail into the V2 keys to grant — the extractor calls
--- it instead of re-implementing the expansion.
--- ============================================================================
-
-CREATE TABLE IF NOT EXISTS app.v1_permission_map (
-  v1_code        text PRIMARY KEY,
-  v1_category    text,
-  v1_name        text,
-  seeded_in_repo boolean NOT NULL DEFAULT true,   -- inserted by a V1 migration (false ⇒ exists only in the live table)
-  active_in_v1   boolean,                          -- catalog `active` at the head of the V1 migrations (null when not seeded)
-  enforced_in_v1 boolean NOT NULL DEFAULT false,   -- appears at an enforcement point (can()/usePermission/<Can>/permissionCode/user_has_permission)
-  status         text NOT NULL CHECK (status IN ('mapped', 'backlog', 'dropped')),
-  kind           text CHECK (kind IN ('feature', 'key')),
-  v2_feature     text,                             -- kind='feature': view→.read, insert→.create, edit→.edit, delete→.delete (fallback .manage)
-  v2_key         text REFERENCES app.permissions(key) ON DELETE SET NULL,   -- kind='key': the key any true flag grants; kind='feature': the .read key
-  v2_extra_keys  text[] NOT NULL DEFAULT '{}',     -- granted alongside whenever any flag is true
-  note           text,
-  updated_at     timestamptz NOT NULL DEFAULT now(),
-  CHECK (status <> 'mapped' OR (kind IS NOT NULL AND v2_key IS NOT NULL)),
-  CHECK (kind IS DISTINCT FROM 'feature' OR v2_feature IS NOT NULL),
-  CHECK (v1_code ~ '^[a-z][a-z0-9_]*$')
-);
-ALTER TABLE app.v1_permission_map ENABLE ROW LEVEL SECURITY;
-GRANT SELECT ON app.v1_permission_map TO authenticated, service_role;
-GRANT ALL ON app.v1_permission_map TO service_role;
-DROP POLICY IF EXISTS v1_permission_map_select ON app.v1_permission_map;
-CREATE POLICY v1_permission_map_select ON app.v1_permission_map FOR SELECT TO authenticated USING (true);
-COMMENT ON TABLE app.v1_permission_map IS
-  'V1 permission code → V2 permission key mapping (#136). Read by the V1 extractor; prose in docs/data/phase-0/01b-v1-permission-mapping.md.';
-
--- ── the rows ────────────────────────────────────────────────────────────
--- Upsert on v1_code so a later file may refine a row (status/target/note)
--- without editing this one; nothing here deletes.
-INSERT INTO app.v1_permission_map
-  (v1_code, v1_category, v1_name, seeded_in_repo, active_in_v1, enforced_in_v1, status, kind, v2_feature, v2_key, v2_extra_keys, note)
-VALUES
-  ('agenda_calendar', 'Agenda', 'Tela de Agendamento', true, true, true, 'mapped', 'feature', 'agenda', 'agenda.read', '{}'::text[], 'The agenda screen. RLS on public.appointments/schedules is keyed on agenda.* (043); plugin-agenda still gates its UI on appointments.* — see the divergence note.'),
-  ('agenda_confirmation', 'Agenda', 'Confirmação de Agendamentos', true, true, true, 'mapped', 'feature', 'agenda', 'agenda.read', '{}'::text[], 'Sub-screen of the agenda (WhatsApp confirmations); coarser: V2 has no finer key yet.'),
-  ('checkin_dashboard', 'Agenda', 'Check-in de Clientes', true, true, true, 'mapped', 'feature', 'agenda', 'agenda.read', '{}'::text[], 'Client check-in is an agenda flow (PRD 07 FieldRules check-in); coarser.'),
-  ('agenda_reservations', 'Agenda', 'Reservas', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Table/slot reservations — plugin-tables (`tables.*`) once it declares features.'),
-  ('agenda_schedules', 'Agenda', 'Escalas', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced in V1. Natural target: agenda.schedules.* (plugin-agenda declares it).'),
-  ('appointments_confirm', 'Agenda', 'Confirmação de Agendamentos', true, false, false, 'dropped', NULL, NULL, NULL, '{}'::text[], 'Inactive since the 2026-05-12 reseed; superseded by agenda_confirmation.'),
-  ('appointments_schedule', 'Agenda', 'Tela de Agendamento', true, false, false, 'dropped', NULL, NULL, NULL, '{}'::text[], 'Inactive since the 2026-05-12 reseed; superseded by agenda_calendar.'),
-  ('clients_list', 'Clientes', 'Listar Clientes', true, true, true, 'mapped', 'feature', 'people', 'people.read', '{}'::text[], 'The client list: view/insert/edit/delete map 1:1 to people.read/create/edit/delete.'),
-  ('clients_create', 'Clientes', 'Cadastrar Cliente', true, true, true, 'mapped', 'key', NULL, 'people.create', '{}'::text[], 'The "new client" screen; any granted flag becomes people.create.'),
-  ('clients_card', 'Clientes', 'Ficha do Cliente', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced. Natural target: people.read (+ people.read_all for the full record of others’ clients).'),
-  ('clients_manage', 'Clientes', 'Gerenciar Clientes', true, false, false, 'dropped', NULL, NULL, NULL, '{}'::text[], 'Inactive since the 2026-05-12 reseed; superseded by clients_list/clients_create.'),
-  ('communication_dashboard', 'Comunicação', 'Comunicação', true, true, true, 'mapped', 'feature', 'automations', 'automations.read', '{}'::text[], 'V1 "Comunicação" (WhatsApp templates, triggers, dispatch log) is plugin-automations in V2 (messaging moved under Automações); coarser.'),
-  ('communication_manual_confirmation', 'Comunicação', 'Confirmação Manual (Mensagem)', true, true, true, 'mapped', 'feature', 'automations', 'automations.read', '{}'::text[], 'Manual confirmation message config; coarser (automations.*).'),
-  ('communication_dispatch_log', 'Comunicação', 'Log de Disparos', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced. Natural target: automations.read.'),
-  ('communication_events', 'Comunicação', 'Eventos / Gatilhos', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced. Natural target: automations.manage.'),
-  ('communication_templates', 'Comunicação', 'Templates de Mensagem', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced. Natural target: automations.manage.'),
-  ('communication_whatsapp', 'Comunicação', 'WhatsApp Config', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced. Natural target: conversations.manage / settings.manage.'),
-  ('config_communication', 'Configurações', 'Comunicação', true, false, false, 'dropped', NULL, NULL, NULL, '{}'::text[], 'Inactive since the 2026-05-12 reseed.'),
-  ('config_hub', 'Configurações', 'Hub de Configurações', true, true, true, 'mapped', 'feature', 'settings', 'settings.read', '{}'::text[], 'The settings hub: view→settings.read, edit→settings.manage.'),
-  ('config_appearance', NULL, NULL, false, NULL, true, 'mapped', 'feature', 'settings', 'settings.read', '{}'::text[], 'Branding (logo/name) — tenant settings (PRD 02 R5). Not seeded by any migration in the V1 repo (exists only in the live table).'),
-  ('config_company', 'Configurações', 'Empresa', true, true, true, 'mapped', 'feature', 'units', 'units.read', '{}'::text[], 'Empresa = the legal entity a unit references (PRD 02 R2, #138): units.read/units.manage.'),
-  ('config_company_type', 'Configurações', 'Tipo de Empresa', true, true, true, 'mapped', 'feature', 'tenant', 'tenant.read', '{}'::text[], 'Franchise mode → tenants.kind (ADR 0002): tenant.read/tenant.manage.'),
-  ('config_cancellation_rules', 'Configurações', 'Regras de Cancelamento', true, true, true, 'mapped', 'feature', 'agenda', 'agenda.read', '{}'::text[], 'Appointment cancellation policy — agenda settings; coarser.'),
-  ('config_holidays', 'Configurações', 'Feriados', true, true, true, 'mapped', 'feature', 'agenda', 'agenda.read', '{}'::text[], 'Holidays feed the agenda availability; coarser.'),
-  ('config_chart_accounts', 'Configurações', 'Plano de Contas', true, true, true, 'mapped', 'feature', 'financial', 'financial.read', '{}'::text[], 'plg_financial_chart_of_accounts is financial data: financial.read/manage.'),
-  ('config_cost_centers', 'Configurações', 'Centros de Custo', true, true, true, 'mapped', 'feature', 'financial', 'financial.read', '{}'::text[], 'plg_financial_cost_centers: financial.read/manage.'),
-  ('config_payment_methods', 'Configurações', 'Formas de Recebimento', true, true, true, 'mapped', 'feature', 'financial', 'financial.read', '{}'::text[], 'plg_financial_payment_methods: financial.read/manage.'),
-  ('config_commission_rules', 'Configurações', 'Regras de Comissão', true, true, true, 'mapped', 'feature', 'financial.commissions', 'financial.commissions.read', '{}'::text[], 'Commission rules live with commissions.'),
-  ('config_discount_rules', 'Configurações', 'Regras de Desconto', true, true, true, 'mapped', 'feature', 'orders', 'orders.read', '{}'::text[], 'Discount rules apply to orders/bills; coarser.'),
-  ('config_cover_charge', 'Configurações', 'Taxas de Ingresso', true, true, true, 'mapped', 'feature', 'orders', 'orders.read', '{}'::text[], 'Cover charge is an order fee (chef); coarser.'),
-  ('config_service_charge', 'Configurações', 'Taxa de Serviço', true, true, true, 'mapped', 'feature', 'orders', 'orders.read', '{}'::text[], 'Service charge is an order fee (chef); coarser.'),
-  ('config_price_tables', 'Configurações', 'Tabelas de Preço', true, true, true, 'mapped', 'feature', 'catalog', 'catalog.read', '{}'::text[], 'Price tables are catalog pricing (PRD 04).'),
-  ('config_price_variations', 'Configurações', 'Variações de Preço', true, true, true, 'mapped', 'feature', 'catalog', 'catalog.read', '{}'::text[], 'Price variations are catalog pricing (PRD 04).'),
-  ('config_field_visibility', 'Configurações', 'Ocultação de Dados', true, true, true, 'mapped', 'feature', 'settings', 'settings.read', '{}'::text[], 'FieldRules (PRD 07): tenant configuration → settings.*.'),
-  ('config_required_fields', 'Configurações', 'Campos Obrigatórios', true, true, true, 'mapped', 'feature', 'settings', 'settings.read', '{}'::text[], 'FieldRules (PRD 07): tenant configuration → settings.*.'),
-  ('config_forms', 'Configurações', 'Formulários', true, true, true, 'mapped', 'feature', 'custom_forms', 'custom_forms.read', '{}'::text[], 'plugin-forms (custom_forms.*).'),
-  ('config_permission_rules', 'Configurações', 'Regras de Permissão', true, true, true, 'mapped', 'feature', 'roles', 'roles.read', '{}'::text[], 'The permission-rules screen becomes the roles editor: roles.read/roles.manage.'),
-  ('config_contracts', 'Configurações', 'Modelos de Contratos', true, true, true, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Contract templates: no V2 surface (plugin-crm has leads/quotes/pipeline, no contracts).'),
-  ('config_qr_access', 'Configurações', 'Acesso por QR Code', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced; QR-code unit access has no V2 surface.'),
-  ('config_software_profile', 'Configurações', 'Perfil de Software', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced; software profiles become tenant plugin configuration (PRD 02 R3), not a permission.'),
-  ('crm_dashboard', 'Marketing', 'CRM', true, true, true, 'mapped', 'feature', 'sales', 'sales.read', '{}'::text[], 'plugin-crm’s main feature id is `sales`.'),
-  ('marketing_dashboard', 'Marketing', 'Marketing', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced. Natural target: marketing.read.'),
-  ('marketing_online_booking', 'Marketing', 'Agendamento Online', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced. Public booking config → agenda settings.'),
-  ('dashboard_alerts', 'Dashboard', 'Alertas e Destaques', true, true, true, 'mapped', 'feature', 'dashboard', 'dashboard.read', '{}'::text[], 'Operational widget → dashboard.read.'),
-  ('dashboard_appointments_status', 'Dashboard', 'Status dos Agendamentos', true, true, true, 'mapped', 'feature', 'dashboard', 'dashboard.read', '{}'::text[], 'Operational widget (V1 also inferred it from agenda_calendar).'),
-  ('dashboard_kpi_operational', 'Dashboard', 'KPIs Operacionais', true, true, true, 'mapped', 'feature', 'dashboard', 'dashboard.read', '{}'::text[], 'Operational widget (V1 also inferred it from agenda_calendar).'),
-  ('dashboard_top_services', 'Dashboard', 'Top Serviços', true, true, true, 'mapped', 'feature', 'dashboard', 'dashboard.read', '{}'::text[], 'Operational widget.'),
-  ('dashboard_units_ranking', 'Dashboard', 'Ranking de Unidades', true, true, true, 'mapped', 'feature', 'dashboard', 'dashboard.read', '{}'::text[], 'Operational widget (unit scope comes from user_unit_access, not from a permission).'),
-  ('dashboard_weekly_trend', 'Dashboard', 'Desempenho 7 Dias', true, true, true, 'mapped', 'feature', 'dashboard', 'dashboard.read', '{}'::text[], 'Operational widget.'),
-  ('dashboard_monthly_trend', 'Dashboard', 'Tendência Mensal', true, true, true, 'mapped', 'feature', 'dashboard', 'dashboard.read', '{}'::text[], 'Operational widget.'),
-  ('dashboard_goals', 'Dashboard', 'Metas de Vendas', true, true, true, 'mapped', 'feature', 'dashboard', 'dashboard.read', '{}'::text[], 'Sales goals widget.'),
-  ('dashboard_kpi_consolidated', 'Dashboard', 'KPIs Consolidados', true, true, true, 'mapped', 'feature', 'financial', 'financial.read', '{}'::text[], 'Money widget: V1 never let it inherit from the agenda; V2 gates money on financial.read.'),
-  ('dashboard_payables', 'Dashboard', 'Contas a Pagar (Dashboard)', true, true, true, 'mapped', 'feature', 'financial.payables', 'financial.payables.read', '{}'::text[], 'Money widget → financial.payables.read.'),
-  ('dashboard_receivables', 'Dashboard', 'Contas a Receber (Dashboard)', true, true, true, 'mapped', 'feature', 'financial.receivables', 'financial.receivables.read', '{}'::text[], 'Money widget → financial.receivables.read.'),
-  ('dashboard_stock_critical', 'Dashboard', 'Estoque Crítico', true, true, true, 'mapped', 'feature', 'inventory', 'inventory.read', '{}'::text[], 'Stock widget → inventory.read.'),
-  ('dashboard_revenue_by_service', 'Dashboard', 'Receita por Serviço', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced. Natural target: financial.read.'),
-  ('financial_dashboard', 'Financeiro', 'Financeiro (Painel)', true, true, true, 'mapped', 'feature', 'financial', 'financial.read', '{}'::text[], 'The financial panel.'),
-  ('financial_payable', 'Financeiro', 'Contas a Pagar', true, true, true, 'mapped', 'feature', 'financial.payables', 'financial.payables.read', '{}'::text[], 'Contas a pagar.'),
-  ('financial_receivable', 'Financeiro', 'Contas a Receber', true, true, true, 'mapped', 'feature', 'financial.receivables', 'financial.receivables.read', '{}'::text[], 'Contas a receber.'),
-  ('financial_cash', 'Financeiro', 'Caixas', true, true, true, 'mapped', 'feature', 'financial', 'financial.read', ARRAY['financial.read_all']::text[], 'Managerial view of every cash register of the units: financial.* plus read_all (sessions are owner-scoped rows).'),
-  ('financial_cash_receipt', 'Financeiro', 'Receber pelo Caixinha', true, true, true, 'mapped', 'key', NULL, 'financial.cash_session', ARRAY['financial.create']::text[], 'Receive through the caixinha: open/operate a session + create movements.'),
-  ('financial_cash_payment', 'Financeiro', 'Pagar pelo Caixinha', true, true, true, 'mapped', 'key', NULL, 'financial.cash_session', ARRAY['financial.create']::text[], 'Pay through the caixinha: open/operate a session + create movements.'),
-  ('financial_cash_review', 'Financeiro', 'Conferência de Caixa', true, true, true, 'mapped', 'feature', 'financial', 'financial.read', ARRAY['financial.read_all']::text[], 'Review/approve closings of other users’ sessions: read_all + edit.'),
-  ('financial_cash_own', 'Financeiro', 'Caixa Próprio', true, false, true, 'dropped', NULL, NULL, NULL, '{}'::text[], 'Deactivated by 20260803150000 (superseded by financial_cash_receipt/payment); still named in one V1 RPC.'),
-  ('financial_bank_statement', 'Financeiro', 'Extrato Bancário', true, true, true, 'mapped', 'feature', 'financial', 'financial.read', '{}'::text[], 'Bank accounts and statements.'),
-  ('financial_reconciliation', NULL, NULL, false, NULL, true, 'mapped', 'feature', 'financial', 'financial.read', '{}'::text[], 'Bank reconciliation. Not seeded by any migration in the V1 repo. plugin-banking-br (openbanking) declares no feature yet; financial.* is the coarser home.'),
-  ('financial_recurring_bills', NULL, NULL, false, NULL, true, 'mapped', 'feature', 'financial.payables', 'financial.payables.read', '{}'::text[], 'Recurring bills are payables. Not seeded by any migration in the V1 repo.'),
-  ('financial_ai_expense', NULL, NULL, false, NULL, true, 'mapped', 'feature', 'financial.payables', 'financial.payables.read', '{}'::text[], 'AI expense extraction creates payables. Not seeded by any migration in the V1 repo.'),
-  ('financial_commissions', 'Financeiro', 'Comissões', true, true, true, 'mapped', 'feature', 'financial.commissions', 'financial.commissions.read', '{}'::text[], 'Commissions.'),
-  ('financial_credit_card', 'Financeiro', 'Cartões de Crédito', true, true, true, 'mapped', 'feature', 'financial', 'financial.read', '{}'::text[], 'Card brands / card fees (plg_financial_card_brands).'),
-  ('financial_payment', 'Financeiro', 'Pagamento (geral)', true, true, true, 'mapped', 'key', NULL, 'financial.payables.edit', '{}'::text[], 'Settle a payable without a cash session (settlement gate).'),
-  ('financial_receipt', 'Financeiro', 'Recebimento (geral)', true, true, true, 'mapped', 'key', NULL, 'financial.receivables.edit', '{}'::text[], 'Settle a receivable without a cash session (settlement gate).'),
-  ('financial_payment_unlink', 'Financeiro', 'Desvincular pagamento de parcela', true, true, true, 'mapped', 'key', NULL, 'financial.edit', '{}'::text[], 'Unlink a payment from an installment; V2 has no finer key — coarser.'),
-  ('financial_gift_cards', 'Financeiro', 'Gift Cards', true, true, true, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Gift cards have no V2 surface.'),
-  ('financial_reports', 'Financeiro', 'Extratos e Relatórios', true, false, false, 'dropped', NULL, NULL, NULL, '{}'::text[], 'Inactive since the 2026-05-12 reseed; reports_* superseded it.'),
-  ('financial_free_transaction', 'Financeiro', 'Transacionar sem Caixa', true, false, false, 'dropped', NULL, NULL, NULL, '{}'::text[], 'Deactivated by 20260803150000 (superseded by financial_payment/receipt).'),
-  ('inventory_dashboard', 'Estoque', 'Estoque (Painel)', true, true, true, 'mapped', 'feature', 'inventory', 'inventory.read', '{}'::text[], 'The stock panel.'),
-  ('inventory_movements', 'Estoque', 'Movimentações', true, true, true, 'mapped', 'feature', 'inventory', 'inventory.read', '{}'::text[], 'Stock movements (plg_inventory_stock_movements).'),
-  ('inventory_products', 'Estoque', 'Produtos', true, true, true, 'mapped', 'feature', 'catalog', 'catalog.read', '{}'::text[], 'Products are catalog items in V2 (public.products, PRD 04).'),
-  ('inventory_categories', NULL, NULL, false, NULL, true, 'mapped', 'feature', 'inventory', 'inventory.read', '{}'::text[], 'plg_inventory_product_categories. Not seeded by any migration in the V1 repo.'),
-  ('inventory_recipes', NULL, NULL, false, NULL, true, 'mapped', 'feature', 'inventory.recipes', 'inventory.recipes.read', '{}'::text[], 'plugin-inventory declares inventory.recipes when the module is on. Not seeded by any migration in the V1 repo.'),
-  ('inventory_stock_locations', NULL, NULL, false, NULL, true, 'mapped', 'feature', 'inventory', 'inventory.read', '{}'::text[], 'plg_inventory_stock_locations. Not seeded by any migration in the V1 repo.'),
-  ('inventory_danfe', 'Estoque', 'Importação DANFE', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced; DANFE import has no V2 key (plg_financial_nfe exists without a permission).'),
-  ('fiscal_dashboard', NULL, NULL, false, NULL, true, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Enforced in V1 (InventorySidebar) but no V2 fiscal surface yet; not seeded by any migration in the V1 repo.'),
-  ('fiscal_dfe_inbox', NULL, NULL, false, NULL, true, 'backlog', NULL, NULL, NULL, '{}'::text[], 'No V2 fiscal surface; not seeded by any migration in the V1 repo.'),
-  ('fiscal_dfe_manifest', NULL, NULL, false, NULL, true, 'backlog', NULL, NULL, NULL, '{}'::text[], 'No V2 fiscal surface; not seeded by any migration in the V1 repo.'),
-  ('fiscal_danfe_import', NULL, NULL, false, NULL, true, 'backlog', NULL, NULL, NULL, '{}'::text[], 'No V2 fiscal surface; not seeded by any migration in the V1 repo.'),
-  ('fiscal_groups', NULL, NULL, false, NULL, true, 'backlog', NULL, NULL, NULL, '{}'::text[], 'No V2 fiscal surface; not seeded by any migration in the V1 repo.'),
-  ('production_dashboard', 'Produção', 'Produção (Painel)', true, true, true, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Enforced in V1 (InventorySidebar) but V2 has no production plugin.'),
-  ('production_orders', 'Produção', 'Ordens de Produção', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced (only mentioned); no V2 production plugin.'),
-  ('production_execution', 'Produção', 'Execução (estação)', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced; no V2 production plugin.'),
-  ('production_planning', 'Produção', 'Planejamento e MRP', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced; no V2 production plugin.'),
-  ('production_traceability', 'Produção', 'Lotes e Rastreabilidade', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced; no V2 production plugin.'),
-  ('operations_dashboard', 'Operação', 'Operação', true, true, true, 'mapped', 'feature', 'orders', 'orders.read', '{}'::text[], 'The chef "Operação" module (POS/bills) is orders in V2; coarser.'),
-  ('restaurant_orders', 'Restaurante', 'Pedidos / Comandas', true, true, true, 'mapped', 'feature', 'orders', 'orders.read', '{}'::text[], 'Bills/comandas are orders (ADR 0004).'),
-  ('restaurant_menu', 'Restaurante', 'Cardápio', true, true, true, 'mapped', 'feature', 'menu', 'menu.read', '{}'::text[], 'plugin-menu gates on menu.* (referenced feature).'),
-  ('restaurant_product_prices', NULL, NULL, false, NULL, true, 'mapped', 'key', NULL, 'menu.edit', '{}'::text[], 'Edit menu product prices. Not seeded by any migration in the V1 repo.'),
-  ('restaurant_product_toggle_active', NULL, NULL, false, NULL, true, 'mapped', 'key', NULL, 'menu.edit', '{}'::text[], 'Toggle a menu product. Not seeded by any migration in the V1 repo.'),
-  ('restaurant_delivery', 'Restaurante', 'Delivery', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced; delivery has no V2 surface.'),
-  ('restaurant_kitchen', 'Restaurante', 'Cozinha / Painéis', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced. Natural target: orders.read (kitchen role template already reads orders).'),
-  ('register_bank_accounts', 'Cadastros', 'Contas Bancárias', true, true, true, 'mapped', 'feature', 'financial', 'financial.read', '{}'::text[], 'plg_financial_bank_accounts.'),
-  ('register_contacts', 'Cadastros', 'Contatos', true, true, true, 'mapped', 'feature', 'people', 'people.read', '{}'::text[], 'Contacts are people (PRD 03).'),
-  ('register_employees', 'Cadastros', 'Funcionários', true, true, true, 'mapped', 'feature', 'people', 'people.read', '{}'::text[], 'Employees are people with a role (ADR 0003); membership itself is members.*.'),
-  ('register_professionals', 'Cadastros', 'Profissionais', true, true, true, 'mapped', 'feature', 'people', 'people.read', '{}'::text[], 'Professionals are people with a role (ADR 0003).'),
-  ('register_suppliers', 'Cadastros', 'Fornecedores', true, true, true, 'mapped', 'feature', 'people', 'people.read', '{}'::text[], 'Suppliers are people (PRD 03).'),
-  ('register_partnerships', 'Cadastros', 'Parcerias', true, true, true, 'mapped', 'feature', 'people', 'people.read', '{}'::text[], 'Partners are people of kind partner (PRD 03); coarser.'),
-  ('register_origins', 'Cadastros', 'Origens', true, true, true, 'mapped', 'feature', 'people', 'people.read', '{}'::text[], 'Client origins are a people attribute registry; coarser.'),
-  ('register_services', 'Cadastros', 'Serviços', true, true, true, 'mapped', 'feature', 'catalog', 'catalog.read', '{}'::text[], 'Services are catalog items (public.services, PRD 04).'),
-  ('register_equipment', 'Cadastros', 'Equipamentos', true, true, true, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Enforced in V1 (Header) but equipment has no V2 surface.'),
-  ('register_locations', 'Cadastros', 'Locais Operacionais', true, true, true, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Enforced in V1 (Header). service_locations are inside a unit, an agenda extension in Phase 2 (PRD 02 R1) — not units.'),
-  ('register_pet_species', NULL, NULL, false, NULL, true, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Pet vertical registry; no V2 surface. Not seeded by any migration in the V1 repo.'),
-  ('sales_quotes', 'Vendas', 'Orçamentos', true, true, true, 'mapped', 'feature', 'crm.quotes', 'crm.quotes.read', '{}'::text[], 'plugin-crm quotes.'),
-  ('sales_packages', 'Vendas', 'Pacotes de Serviço', true, true, true, 'mapped', 'feature', 'catalog', 'catalog.read', '{}'::text[], 'Service packages are catalog items (kits, PRD 04).'),
-  ('sales_contracts', 'Vendas', 'Contratos', true, true, true, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Enforced in V1 (Header) but contracts have no V2 surface.'),
-  ('service_execution_manual', 'Atendimento', 'Execução manual de serviço', true, true, true, 'mapped', 'key', NULL, 'orders.edit', '{}'::text[], 'Register a service as executed outside the agenda flow: an order-item edit (ADR 0004).'),
-  ('reports_dashboard', 'Relatórios', 'Relatórios', true, true, true, 'mapped', 'feature', 'reports', 'reports.read', '{}'::text[], 'The reports home.'),
-  ('reports_panels', 'Relatórios', 'Painéis Customizados', true, true, true, 'mapped', 'feature', 'reports', 'reports.read', '{}'::text[], 'Custom panels; coarser.'),
-  ('reports_agenda', 'Relatórios', 'Relatórios de Agenda', true, true, true, 'mapped', 'feature', 'reports', 'reports.read', '{}'::text[], 'V2 report cards are owned by the domain plugin and gate on reports.read + the domain’s read; coarser.'),
-  ('reports_clientes', 'Relatórios', 'Relatórios de Clientes', true, true, true, 'mapped', 'feature', 'reports', 'reports.read', '{}'::text[], 'See reports_agenda.'),
-  ('reports_estoque', 'Relatórios', 'Relatórios de Estoque', true, true, true, 'mapped', 'feature', 'reports', 'reports.read', '{}'::text[], 'See reports_agenda.'),
-  ('reports_financeiro', 'Relatórios', 'Relatórios Financeiros', true, true, true, 'mapped', 'feature', 'reports', 'reports.read', '{}'::text[], 'See reports_agenda; money reports additionally need financial.read at the card.'),
-  ('reports_gestao', 'Relatórios', 'Relatórios de Gestão', true, true, true, 'mapped', 'feature', 'reports', 'reports.read', '{}'::text[], 'See reports_agenda.'),
-  ('reports_marketing', 'Relatórios', 'Relatórios de Marketing', true, true, true, 'mapped', 'feature', 'reports', 'reports.read', '{}'::text[], 'See reports_agenda.'),
-  ('reports_profissionais', 'Relatórios', 'Relatórios de Profissionais', true, true, true, 'mapped', 'feature', 'reports', 'reports.read', '{}'::text[], 'See reports_agenda.'),
-  ('reports_servicos', 'Relatórios', 'Relatórios de Serviços', true, true, true, 'mapped', 'feature', 'reports', 'reports.read', '{}'::text[], 'See reports_agenda.'),
-  ('reports_view', 'Relatórios', 'Relatórios', true, false, false, 'dropped', NULL, NULL, NULL, '{}'::text[], 'Inactive since the 2026-05-12 reseed; reports_* superseded it.'),
-  ('special_qr_access_issue', 'Ações Especiais', 'Liberar acesso por QR Code', true, true, true, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Enforced in V1 (Header); QR-code unit access has no V2 surface.'),
-  ('special_qr_access_required', 'Ações Especiais', 'Exigir liberação por QR Code', true, true, true, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Enforced in V1 SQL (user_requires_qr_access); no V2 surface.'),
-  ('special_time_clock_adjust', 'Ações Especiais', 'Ajustar Registros de Ponto', true, true, true, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Enforced in V1 (TimeClockRegistry); time clock has no V2 surface.'),
-  ('special_time_clock_launch_payables', 'Ações Especiais', 'Lançar Ponto em Contas a Pagar', true, true, true, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Enforced in V1 (TimeClockRegistry); time clock has no V2 surface.'),
-  ('special_unmatch_reconciled', NULL, NULL, false, NULL, true, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Enforced in V1 (ReconciliationCard); undo-reconciliation has no V2 key. Not seeded by any migration in the V1 repo.'),
-  ('special_approve_quote', 'Ações Especiais', 'Aprovar/Rejeitar Orçamento', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced. Natural target: a crm.quotes custom action.'),
-  ('special_bulk_import', 'Ações Especiais', 'Importação em Massa', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced.'),
-  ('special_cancel_no_pin', 'Ações Especiais', 'Cancelar Item Sem PIN', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced. Natural target: an orders custom action.'),
-  ('special_delete_paid_order_item', 'Ações Especiais', 'Excluir Item de Pedido Pago', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced. Natural target: an orders custom action.'),
-  ('special_discount_no_pin', 'Ações Especiais', 'Aplicar Desconto Sem PIN', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced. Natural target: an orders custom action.'),
-  ('special_edit_paid_financial', 'Ações Especiais', 'Editar Lançamento com Pagamento', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced. Natural target: a financial custom action.'),
-  ('special_edit_payment_history', 'Ações Especiais', 'Editar Histórico de Pagamentos', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced. Natural target: a financial custom action.'),
-  ('special_export_sensitive', 'Ações Especiais', 'Exportar Relatórios Sensíveis', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced. Natural target: a reports custom action.'),
-  ('special_reopen_closed_bill', 'Ações Especiais', 'Reabrir Comanda Fechada', true, true, false, 'backlog', NULL, NULL, NULL, '{}'::text[], 'Never enforced. Natural target: an orders custom action.'),
-  ('special_other_user_cash', 'Ações Especiais', 'Acessar Caixa de Outro Usuário', true, false, false, 'dropped', NULL, NULL, NULL, '{}'::text[], 'Deactivated by 20260803150000; superseded by financial_cash_review / financial.read_all.'),
-  ('special_super_admin', 'Ações Especiais', 'Acessar Super Admin', true, true, false, 'dropped', NULL, NULL, NULL, '{}'::text[], 'Platform super-admin is not a tenant permission in V2 (no bypass in code, R9).'),
-  ('permissions_enforcement_enabled', 'general_settings', NULL, false, NULL, false, 'dropped', NULL, NULL, NULL, '{}'::text[], 'general_settings flag, not a code: RLS is the law (PRD 02 R4). Never migrates.')
-ON CONFLICT (v1_code) DO UPDATE SET
-  v1_category = EXCLUDED.v1_category, v1_name = EXCLUDED.v1_name,
-  seeded_in_repo = EXCLUDED.seeded_in_repo, active_in_v1 = EXCLUDED.active_in_v1, enforced_in_v1 = EXCLUDED.enforced_in_v1,
-  status = EXCLUDED.status, kind = EXCLUDED.kind, v2_feature = EXCLUDED.v2_feature, v2_key = EXCLUDED.v2_key,
-  v2_extra_keys = EXCLUDED.v2_extra_keys, note = EXCLUDED.note, updated_at = now();
-
--- ── every target must exist in the catalog (060 ran first) ──────────────
--- A mapping onto a key the catalog does not have is a typo, not a decision:
--- fail the migration rather than let the extractor grant nothing silently.
-DO $$
-DECLARE v_missing text;
-BEGIN
-  SELECT string_agg(k, ', ' ORDER BY k) INTO v_missing FROM (
-    SELECT m.v2_feature || '.read' AS k FROM app.v1_permission_map m WHERE m.kind = 'feature'
-      AND NOT EXISTS (SELECT 1 FROM app.permissions p WHERE p.key = m.v2_feature || '.read')
-    UNION
-    SELECT unnest(m.v2_extra_keys) FROM app.v1_permission_map m
-    EXCEPT
-    SELECT p.key FROM app.permissions p
-  ) s;
-  IF v_missing IS NOT NULL THEN
-    RAISE EXCEPTION 'v1_permission_map: targets missing from app.permissions: %', v_missing;
-  END IF;
-END $$;
-
--- ── the expansion: one V1 rule detail → the V2 keys to grant ────────────
--- kind='feature': view→F.read, insert→F.create, edit→F.edit, delete→F.delete;
--- when the action key does not exist for that feature (settings/tenant/units/
--- roles have read+manage only) the write flags fall back to F.manage.
--- kind='key': any true flag grants v2_key. Extra keys ride along whenever any
--- flag is true. Unknown/backlog/dropped codes expand to nothing.
-CREATE OR REPLACE FUNCTION app.v1_permission_keys(
-  p_code text, p_view boolean DEFAULT false, p_insert boolean DEFAULT false, p_edit boolean DEFAULT false, p_delete boolean DEFAULT false
-) RETURNS text[]
-LANGUAGE plpgsql STABLE SECURITY DEFINER SET search_path = ''
-AS $$
-DECLARE
-  m   app.v1_permission_map%ROWTYPE;
-  out text[] := '{}';
-  any_flag boolean := coalesce(p_view, false) OR coalesce(p_insert, false) OR coalesce(p_edit, false) OR coalesce(p_delete, false);
-BEGIN
-  SELECT * INTO m FROM app.v1_permission_map WHERE v1_code = p_code;
-  IF NOT FOUND OR m.status <> 'mapped' OR NOT any_flag THEN
-    RETURN '{}';
-  END IF;
-  IF m.kind = 'key' THEN
-    out := ARRAY[m.v2_key];
-  ELSE
-    IF coalesce(p_view, false) THEN out := out || (m.v2_feature || '.read'); END IF;
-    IF coalesce(p_insert, false) THEN out := out || CASE WHEN EXISTS (SELECT 1 FROM app.permissions WHERE key = m.v2_feature || '.create') THEN m.v2_feature || '.create' ELSE m.v2_feature || '.manage' END; END IF;
-    IF coalesce(p_edit, false)   THEN out := out || CASE WHEN EXISTS (SELECT 1 FROM app.permissions WHERE key = m.v2_feature || '.edit')   THEN m.v2_feature || '.edit'   ELSE m.v2_feature || '.manage' END; END IF;
-    IF coalesce(p_delete, false) THEN out := out || CASE WHEN EXISTS (SELECT 1 FROM app.permissions WHERE key = m.v2_feature || '.delete') THEN m.v2_feature || '.delete' ELSE m.v2_feature || '.manage' END; END IF;
-  END IF;
-  out := out || m.v2_extra_keys;
-  -- only keys the catalog knows, deduplicated, stable order
-  SELECT coalesce(array_agg(DISTINCT k ORDER BY k), '{}') INTO out
-    FROM unnest(out) k WHERE EXISTS (SELECT 1 FROM app.permissions p WHERE p.key = k);
-  RETURN out;
-END $$;
-REVOKE ALL ON FUNCTION app.v1_permission_keys(text, boolean, boolean, boolean, boolean) FROM public, anon;
-GRANT EXECUTE ON FUNCTION app.v1_permission_keys(text, boolean, boolean, boolean, boolean) TO authenticated, service_role;
-
--- Read view for tooling/UI (security_invoker; the table is readable by any signed-in user).
-CREATE OR REPLACE VIEW public.v_authz_v1_permission_map WITH (security_invoker = true) AS
-  SELECT v1_code, v1_category, v1_name, seeded_in_repo, active_in_v1, enforced_in_v1, status, kind, v2_feature, v2_key, v2_extra_keys, note
-    FROM app.v1_permission_map;
-GRANT SELECT ON public.v_authz_v1_permission_map TO authenticated, service_role;