@fayz-ai/db 0.24.0 → 0.24.2

package/dist/index.d.ts

@@ -1,4 +1,5 @@
-export * from 'drizzle-orm/pg-core';
+export { Check, CheckBuilder, DefaultViewBuilderCore, ExtraConfigColumn, ForeignKey, ForeignKeyBuilder, Index, IndexBuilder, IndexBuilderOn, IndexedColumn, ManualMaterializedViewBuilder, ManualViewBuilder, MaterializedViewBuilder, MaterializedViewBuilderCore, PgArray, PgArrayBuilder, PgBigInt53, PgBigInt53Builder, PgBigInt64, PgBigInt64Builder, PgBigSerial53, PgBigSerial53Builder, PgBigSerial64, PgBigSerial64Builder, PgBinaryVector, PgBinaryVectorBuilder, PgBoolean, PgBooleanBuilder, PgChar, PgCharBuilder, PgCidr, PgCidrBuilder, PgColumn, PgColumnBuilder, PgCustomColumn, PgCustomColumnBuilder, PgDatabase, PgDate, PgDateBuilder, PgDateString, PgDateStringBuilder, PgDeleteBase, PgDialect, PgDoublePrecision, PgDoublePrecisionBuilder, PgEnumColumn, PgEnumColumnBuilder, PgGeometry, PgGeometryBuilder, PgGeometryObject, PgGeometryObjectBuilder, PgHalfVector, PgHalfVectorBuilder, PgInet, PgInetBuilder, PgInsertBase, PgInsertBuilder, PgIntColumnBaseBuilder, PgInteger, PgIntegerBuilder, PgInterval, PgIntervalBuilder, PgJson, PgJsonBuilder, PgJsonb, PgJsonbBuilder, PgLineABC, PgLineABCBuilder, PgLineBuilder, PgLineTuple, PgMacaddr, PgMacaddr8, PgMacaddr8Builder, PgMacaddrBuilder, PgMaterializedView, PgMaterializedViewConfig, PgNumeric, PgNumericBuilder, PgPointObject, PgPointObjectBuilder, PgPointTuple, PgPointTupleBuilder, PgPolicy, PgPreparedQuery, PgReal, PgRealBuilder, PgRefreshMaterializedView, PgRole, PgSchema, PgSelectBase, PgSelectBuilder, PgSelectQueryBuilderBase, PgSequence, PgSerial, PgSerialBuilder, PgSession, PgSmallInt, PgSmallIntBuilder, PgSmallSerial, PgSmallSerialBuilder, PgSparseVector, PgSparseVectorBuilder, PgTable, PgText, PgTextBuilder, PgTime, PgTimeBuilder, PgTimestamp, PgTimestampBuilder, PgTimestampString, PgTimestampStringBuilder, PgTransaction, PgUUID, PgUUIDBuilder, PgUpdateBase, PgUpdateBuilder, PgVarchar, PgVarcharBuilder, PgVector, PgVectorBuilder, PgView, PgViewConfig, PrimaryKey, PrimaryKeyBuilder, QueryBuilder, UniqueConstraint, UniqueConstraintBuilder, UniqueOnConstraintBuilder, ViewBuilder, alias, bigint, bigserial, bit, boolean, char, check, cidr, customType, date, decimal, doublePrecision, except, exceptAll, foreignKey, geometry, getMaterializedViewConfig, getTableConfig, getViewConfig, halfvec, index, inet, integer, intersect, intersectAll, interval, isPgEnum, isPgMaterializedView, isPgSchema, isPgSequence, isPgView, json, jsonb, line, macaddr, macaddr8, makePgArray, numeric, parsePgArray, parsePgNestedArray, pgEnum, pgMaterializedView, pgPolicy, pgRole, pgSchema, pgSequence, pgTable, pgTableCreator, pgView, point, primaryKey, real, serial, smallint, smallserial, sparsevec, text, time, timestamp, union, unionAll, unique, uniqueIndex, uniqueKeyName, uuid, varchar, vector, withReplicas, } from 'drizzle-orm/pg-core';
+export type { AnyForeignKeyBuilder, AnyIndexBuilder, AnyPgColumn, AnyPgDeleteBase, AnyPgInsert, AnyPgSelect, AnyPgSelectQueryBuilder, AnyPgSetOperatorInterface, AnyPgTable, AnyPgUpdate, BuildAliasTable, ColumnsWithTable, ConvertCustomConfig, CreatePgSelectFromBuilderMode, CustomTypeParams, CustomTypeValues, GetColumnsTableName, GetPgSetOperators, IndexColumn, IndexedExtraConfigType, IntervalConfig, LockConfig, LockStrength, PgBigInt53BuilderInitial, PgBigInt64BuilderInitial, PgBigIntConfig, PgBigSerial53BuilderInitial, PgBigSerial64BuilderInitial, PgBigSerialConfig, PgBinaryVectorBuilderInitial, PgBinaryVectorConfig, PgBooleanBuilderInitial, PgCharBuilderInitial, PgCharConfig, PgCidrBuilderInitial, PgColumnBuilderBase, PgCreateSetOperatorFn, PgCustomColumnInnerConfig, PgDateBuilderInitial, PgDateConfig, PgDateStringBuilderInitial, PgDelete, PgDeleteConfig, PgDeleteDynamic, PgDeletePrepare, PgDeleteReturning, PgDeleteReturningAll, PgDeleteWithout, PgDialectConfig, PgDoublePrecisionBuilderInitial, PgEnum, PgEnumColumnBuilderInitial, PgGeometryBuilderInitial, PgGeometryConfig, PgGeometryObjectBuilderInitial, PgHalfVectorBuilderInitial, PgHalfVectorConfig, PgIndexMethod, PgIndexOpClass, PgInetBuilderInitial, PgInsert, PgInsertConfig, PgInsertDynamic, PgInsertOnConflictDoUpdateConfig, PgInsertPrepare, PgInsertReturning, PgInsertReturningAll, PgInsertSelectQueryBuilder, PgInsertValue, PgInsertWithout, PgIntegerBuilderInitial, PgIntervalBuilderInitial, PgJsonBuilderInitial, PgJsonbBuilderInitial, PgLineABCBuilderInitial, PgLineBuilderInitial, PgLineTypeConfig, PgMacaddr8BuilderInitial, PgMacaddrBuilderInitial, PgMaterializedViewWithConfig, PgMaterializedViewWithSelection, PgNumericBuilderInitial, PgNumericConfig, PgPointConfig, PgPointObjectBuilderInitial, PgPointTupleBuilderInitial, PgPolicyConfig, PgPolicyToOption, PgQueryResultHKT, PgQueryResultKind, PgRealBuilderInitial, PgRoleConfig, PgSelect, PgSelectConfig, PgSelectDynamic, PgSelectHKT, PgSelectHKTBase, PgSelectJoin, PgSelectJoinConfig, PgSelectJoinFn, PgSelectKind, PgSelectPrepare, PgSelectQueryBuilder, PgSelectQueryBuilderHKT, PgSelectWithout, PgSequenceOptions, PgSerialBuilderInitial, PgSetOperator, PgSetOperatorExcludedMethods, PgSetOperatorInterface, PgSetOperatorWithResult, PgSmallIntBuilderInitial, PgSmallSerialBuilderInitial, PgSparseVectorBuilderInitial, PgSparseVectorConfig, PgTableExtraConfig, PgTableExtraConfigValue, PgTableFn, PgTableWithColumns, PgTextConfig, PgTimeBuilderInitial, PgTimestampBuilderInitial, PgTimestampConfig, PgTimestampStringBuilderInitial, PgTransactionConfig, PgUUIDBuilderInitial, PgUpdate, PgUpdateConfig, PgUpdateDynamic, PgUpdateJoin, PgUpdateJoinFn, PgUpdatePrepare, PgUpdateReturning, PgUpdateReturningAll, PgUpdateSetSource, PgUpdateWithJoins, PgUpdateWithout, PgVarcharBuilderInitial, PgVarcharConfig, PgVectorBuilderInitial, PgVectorConfig, PgViewWithSelection, PgWithReplicas, Precision, PreparedQueryConfig, Reference, ReferenceConfig, SelectedFields, SelectedFieldsFlat, SelectedFieldsOrdered, SetOperatorRestSelect, SetOperatorRightSelect, SubqueryWithSelection, TableConfig, TimeConfig, UpdateDeleteAction, ViewWithConfig, WithSubqueryWithSelection, } from 'drizzle-orm/pg-core';
 export { tenants, people, orders, appointments, products, items, plgConnections, plgSyncRuns } from './schema/spine';
 export { tenantId, timestamps, createdAt } from './lib/helpers';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,cAAc,qBAAqB,CAAA;AAEnC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AACpH,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,KAAK,EACL,YAAY,EACZ,sBAAsB,EACtB,iBAAiB,EACjB,UAAU,EACV,iBAAiB,EACjB,KAAK,EACL,YAAY,EACZ,cAAc,EACd,aAAa,EACb,6BAA6B,EAC7B,iBAAiB,EACjB,uBAAuB,EACvB,2BAA2B,EAC3B,OAAO,EACP,cAAc,EACd,UAAU,EACV,iBAAiB,EACjB,UAAU,EACV,iBAAiB,EACjB,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,qBAAqB,EACrB,SAAS,EACT,gBAAgB,EAChB,MAAM,EACN,aAAa,EACb,MAAM,EACN,aAAa,EACb,QAAQ,EACR,eAAe,EACf,cAAc,EACd,qBAAqB,EACrB,UAAU,EACV,MAAM,EACN,aAAa,EACb,YAAY,EACZ,mBAAmB,EACnB,YAAY,EACZ,SAAS,EACT,iBAAiB,EACjB,wBAAwB,EACxB,YAAY,EACZ,mBAAmB,EACnB,UAAU,EACV,iBAAiB,EACjB,gBAAgB,EAChB,uBAAuB,EACvB,YAAY,EACZ,mBAAmB,EACnB,MAAM,EACN,aAAa,EACb,YAAY,EACZ,eAAe,EACf,sBAAsB,EACtB,SAAS,EACT,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,MAAM,EACN,aAAa,EACb,OAAO,EACP,cAAc,EACd,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,SAAS,EACT,UAAU,EACV,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,wBAAwB,EACxB,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,oBAAoB,EACpB,YAAY,EACZ,mBAAmB,EACnB,QAAQ,EACR,eAAe,EACf,MAAM,EACN,aAAa,EACb,yBAAyB,EACzB,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,wBAAwB,EACxB,UAAU,EACV,QAAQ,EACR,eAAe,EACf,SAAS,EACT,UAAU,EACV,iBAAiB,EACjB,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,qBAAqB,EACrB,OAAO,EACP,MAAM,EACN,aAAa,EACb,MAAM,EACN,aAAa,EACb,WAAW,EACX,kBAAkB,EAClB,iBAAiB,EACjB,wBAAwB,EACxB,aAAa,EACb,MAAM,EACN,aAAa,EACb,YAAY,EACZ,eAAe,EACf,SAAS,EACT,gBAAgB,EAChB,QAAQ,EACR,eAAe,EACf,MAAM,EACN,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,YAAY,EACZ,gBAAgB,EAChB,uBAAuB,EACvB,yBAAyB,EACzB,WAAW,EACX,KAAK,EACL,MAAM,EACN,SAAS,EACT,GAAG,EACH,OAAO,EACP,IAAI,EACJ,KAAK,EACL,IAAI,EACJ,UAAU,EACV,IAAI,EACJ,OAAO,EACP,eAAe,EACf,MAAM,EACN,SAAS,EACT,UAAU,EACV,QAAQ,EACR,yBAAyB,EACzB,cAAc,EACd,aAAa,EACb,OAAO,EACP,KAAK,EACL,IAAI,EACJ,OAAO,EACP,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,QAAQ,EACR,oBAAoB,EACpB,UAAU,EACV,YAAY,EACZ,QAAQ,EACR,IAAI,EACJ,KAAK,EACL,IAAI,EACJ,OAAO,EACP,QAAQ,EACR,WAAW,EACX,OAAO,EACP,YAAY,EACZ,kBAAkB,EAClB,MAAM,EACN,kBAAkB,EAClB,QAAQ,EACR,MAAM,EACN,QAAQ,EACR,UAAU,EACV,OAAO,EACP,cAAc,EACd,MAAM,EACN,KAAK,EACL,UAAU,EACV,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,WAAW,EACX,SAAS,EACT,IAAI,EACJ,IAAI,EACJ,SAAS,EACT,KAAK,EACL,QAAQ,EACR,MAAM,EACN,WAAW,EACX,aAAa,EACb,IAAI,EACJ,OAAO,EACP,MAAM,EACN,YAAY,GACb,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,oBAAoB,EACpB,eAAe,EACf,WAAW,EACX,eAAe,EACf,WAAW,EACX,WAAW,EACX,uBAAuB,EACvB,yBAAyB,EACzB,UAAU,EACV,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,6BAA6B,EAC7B,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,WAAW,EACX,sBAAsB,EACtB,cAAc,EACd,UAAU,EACV,YAAY,EACZ,wBAAwB,EACxB,wBAAwB,EACxB,cAAc,EACd,2BAA2B,EAC3B,2BAA2B,EAC3B,iBAAiB,EACjB,4BAA4B,EAC5B,oBAAoB,EACpB,uBAAuB,EACvB,oBAAoB,EACpB,YAAY,EACZ,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,EACrB,yBAAyB,EACzB,oBAAoB,EACpB,YAAY,EACZ,0BAA0B,EAC1B,QAAQ,EACR,cAAc,EACd,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,+BAA+B,EAC/B,MAAM,EACN,0BAA0B,EAC1B,wBAAwB,EACxB,gBAAgB,EAChB,8BAA8B,EAC9B,0BAA0B,EAC1B,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,oBAAoB,EACpB,QAAQ,EACR,cAAc,EACd,eAAe,EACf,gCAAgC,EAChC,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,0BAA0B,EAC1B,aAAa,EACb,eAAe,EACf,uBAAuB,EACvB,wBAAwB,EACxB,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,4BAA4B,EAC5B,+BAA+B,EAC/B,uBAAuB,EACvB,eAAe,EACf,aAAa,EACb,2BAA2B,EAC3B,0BAA0B,EAC1B,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,YAAY,EACZ,QAAQ,EACR,cAAc,EACd,eAAe,EACf,WAAW,EACX,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,uBAAuB,EACvB,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,aAAa,EACb,4BAA4B,EAC5B,sBAAsB,EACtB,uBAAuB,EACvB,wBAAwB,EACxB,2BAA2B,EAC3B,4BAA4B,EAC5B,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,EACvB,SAAS,EACT,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,+BAA+B,EAC/B,mBAAmB,EACnB,oBAAoB,EACpB,QAAQ,EACR,cAAc,EACd,eAAe,EACf,YAAY,EACZ,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACvB,eAAe,EACf,sBAAsB,EACtB,cAAc,EACd,mBAAmB,EACnB,cAAc,EACd,SAAS,EACT,mBAAmB,EACnB,SAAS,EACT,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,WAAW,EACX,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,yBAAyB,GAC1B,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AACpH,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA"}

package/dist/index.js

@@ -1,5 +1,5 @@
 import { pgTable, uuid, timestamp, jsonb, text, boolean, integer } from 'drizzle-orm/pg-core';
-export * from 'drizzle-orm/pg-core';
+export { Check, CheckBuilder, DefaultViewBuilderCore, ExtraConfigColumn, ForeignKey, ForeignKeyBuilder, Index, IndexBuilder, IndexBuilderOn, IndexedColumn, ManualMaterializedViewBuilder, ManualViewBuilder, MaterializedViewBuilder, MaterializedViewBuilderCore, PgArray, PgArrayBuilder, PgBigInt53, PgBigInt53Builder, PgBigInt64, PgBigInt64Builder, PgBigSerial53, PgBigSerial53Builder, PgBigSerial64, PgBigSerial64Builder, PgBinaryVector, PgBinaryVectorBuilder, PgBoolean, PgBooleanBuilder, PgChar, PgCharBuilder, PgCidr, PgCidrBuilder, PgColumn, PgColumnBuilder, PgCustomColumn, PgCustomColumnBuilder, PgDatabase, PgDate, PgDateBuilder, PgDateString, PgDateStringBuilder, PgDeleteBase, PgDialect, PgDoublePrecision, PgDoublePrecisionBuilder, PgEnumColumn, PgEnumColumnBuilder, PgGeometry, PgGeometryBuilder, PgGeometryObject, PgGeometryObjectBuilder, PgHalfVector, PgHalfVectorBuilder, PgInet, PgInetBuilder, PgInsertBase, PgInsertBuilder, PgIntColumnBaseBuilder, PgInteger, PgIntegerBuilder, PgInterval, PgIntervalBuilder, PgJson, PgJsonBuilder, PgJsonb, PgJsonbBuilder, PgLineABC, PgLineABCBuilder, PgLineBuilder, PgLineTuple, PgMacaddr, PgMacaddr8, PgMacaddr8Builder, PgMacaddrBuilder, PgMaterializedView, PgMaterializedViewConfig, PgNumeric, PgNumericBuilder, PgPointObject, PgPointObjectBuilder, PgPointTuple, PgPointTupleBuilder, PgPolicy, PgPreparedQuery, PgReal, PgRealBuilder, PgRefreshMaterializedView, PgRole, PgSchema, PgSelectBase, PgSelectBuilder, PgSelectQueryBuilderBase, PgSequence, PgSerial, PgSerialBuilder, PgSession, PgSmallInt, PgSmallIntBuilder, PgSmallSerial, PgSmallSerialBuilder, PgSparseVector, PgSparseVectorBuilder, PgTable, PgText, PgTextBuilder, PgTime, PgTimeBuilder, PgTimestamp, PgTimestampBuilder, PgTimestampString, PgTimestampStringBuilder, PgTransaction, PgUUID, PgUUIDBuilder, PgUpdateBase, PgUpdateBuilder, PgVarchar, PgVarcharBuilder, PgVector, PgVectorBuilder, PgView, PgViewConfig, PrimaryKey, PrimaryKeyBuilder, QueryBuilder, UniqueConstraint, UniqueConstraintBuilder, UniqueOnConstraintBuilder, ViewBuilder, alias, bigint, bigserial, bit, boolean, char, check, cidr, customType, date, decimal, doublePrecision, except, exceptAll, foreignKey, geometry, getMaterializedViewConfig, getTableConfig, getViewConfig, halfvec, index, inet, integer, intersect, intersectAll, interval, isPgEnum, isPgMaterializedView, isPgSchema, isPgSequence, isPgView, json, jsonb, line, macaddr, macaddr8, makePgArray, numeric, parsePgArray, parsePgNestedArray, pgEnum, pgMaterializedView, pgPolicy, pgRole, pgSchema, pgSequence, pgTable, pgTableCreator, pgView, point, primaryKey, real, serial, smallint, smallserial, sparsevec, text, time, timestamp, union, unionAll, unique, uniqueIndex, uniqueKeyName, uuid, varchar, vector, withReplicas } from 'drizzle-orm/pg-core';
 
 // src/index.ts
 var tenants = pgTable("tenants", {

package/migrations/198_permission_holes_close.sql

@@ -0,0 +1,136 @@
+-- ============================================================================
+-- 198 — permission holes close
+--
+-- Three holes found while mapping V1 permissions onto V2:
+--
+-- 1. `role_set_permissions` checked only `roles.manage`. Admin holds it, so an
+--    admin could hand `billing.*` / `admin.*` (owner_only, 029) to any role,
+--    including their own. Now only the owner may GRANT an owner_only key;
+--    keys a role already holds survive an edit (029: owner_only governs what is
+--    granted from now on, it does not revoke).
+--
+-- 2. `public.rooms` (153) let any tenant member write. The screen is gated by
+--    `services.*` (148), so the table is too. Reading stays open to members:
+--    the agenda needs every room to place an appointment.
+--
+-- 3. Screens gated by keys nobody could hold — the catalog lacked them, so
+--    only the owner (who reads the catalog) saw them, and `role_set_permissions`
+--    refused them as unknown. `workforce.*` mirrors `workforce_hr.*` (same
+--    audience: who runs the team's time); `reservations.*` mirrors `tables.*`
+--    (who runs the floor). Mirroring grants nobody anything new in spirit.
+--
+-- Idempotent.
+-- ============================================================================
+
+CREATE OR REPLACE FUNCTION public.role_set_permissions(p_role_id uuid, p_keys text[]) RETURNS integer
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO ''
+    AS $$
+DECLARE
+  v_tenant   uuid := app.current_tenant_id();
+  v_role     app.roles%ROWTYPE;
+  v_unknown  text;
+  v_reserved text;
+  v_keys     text[] := coalesce(p_keys, '{}');
+  v_n        integer;
+BEGIN
+  IF auth.uid() IS NULL OR v_tenant IS NULL THEN
+    RAISE EXCEPTION 'role_set_permissions: no active tenant for this session' USING ERRCODE = '42501';
+  END IF;
+  IF NOT app.has_permission('roles.manage') THEN
+    RAISE EXCEPTION 'role_set_permissions: roles.manage is required' USING ERRCODE = '42501';
+  END IF;
+  SELECT * INTO v_role FROM app.roles r WHERE r.tenant_id = v_tenant AND r.id = p_role_id;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'role_set_permissions: role not found in the active tenant' USING ERRCODE = 'P0002';
+  END IF;
+  IF v_role.is_system AND v_role.key = 'owner' THEN
+    RAISE EXCEPTION 'role_set_permissions: the owner role is immutable (it always holds the whole catalog)' USING ERRCODE = '42501';
+  END IF;
+  SELECT string_agg(k, ', ' ORDER BY k) INTO v_unknown
+    FROM unnest(v_keys) k WHERE NOT EXISTS (SELECT 1 FROM app.permissions p WHERE p.key = k);
+  IF v_unknown IS NOT NULL THEN
+    RAISE EXCEPTION 'role_set_permissions: unknown permission key(s): %', v_unknown USING ERRCODE = '23503';
+  END IF;
+
+  IF NOT EXISTS (
+    SELECT 1 FROM app.memberships m
+      JOIN app.roles r ON r.id = m.role_id AND r.tenant_id = m.tenant_id
+     WHERE m.tenant_id = v_tenant AND m.user_id = auth.uid() AND m.active AND r.key = 'owner'
+  ) THEN
+    SELECT string_agg(k, ', ' ORDER BY k) INTO v_reserved
+      FROM unnest(v_keys) k
+      JOIN app.permissions p ON p.key = k AND p.owner_only
+     WHERE NOT EXISTS (
+       SELECT 1 FROM app.role_permissions rp
+        WHERE rp.tenant_id = v_tenant AND rp.role_id = p_role_id AND rp.permission = k);
+    IF v_reserved IS NOT NULL THEN
+      RAISE EXCEPTION 'role_set_permissions: only the owner can grant %', v_reserved USING ERRCODE = '42501';
+    END IF;
+  END IF;
+
+  DELETE FROM app.role_permissions rp
+   WHERE rp.tenant_id = v_tenant AND rp.role_id = p_role_id AND rp.permission <> ALL (v_keys);
+  INSERT INTO app.role_permissions (tenant_id, role_id, permission)
+  SELECT v_tenant, p_role_id, k FROM unnest(v_keys) k
+  ON CONFLICT DO NOTHING;
+
+  SELECT count(*) INTO v_n FROM app.role_permissions rp WHERE rp.tenant_id = v_tenant AND rp.role_id = p_role_id;
+  RETURN v_n;
+END $$;
+
+-- ── 2. rooms ────────────────────────────────────────────────────────────────
+DROP POLICY IF EXISTS rooms_member_all ON public.rooms;
+DROP POLICY IF EXISTS rooms_member_read ON public.rooms;
+DROP POLICY IF EXISTS rooms_insert ON public.rooms;
+DROP POLICY IF EXISTS rooms_update ON public.rooms;
+DROP POLICY IF EXISTS rooms_delete ON public.rooms;
+
+CREATE POLICY rooms_member_read ON public.rooms FOR SELECT TO authenticated
+  USING (tenant_id IN (SELECT public.user_tenant_ids()));
+CREATE POLICY rooms_insert ON public.rooms FOR INSERT TO authenticated
+  WITH CHECK (tenant_id IN (SELECT public.user_tenant_ids())
+              AND (SELECT app.has_permission('services.create', unit_id)));
+CREATE POLICY rooms_update ON public.rooms FOR UPDATE TO authenticated
+  USING (tenant_id IN (SELECT public.user_tenant_ids())
+         AND (SELECT app.has_permission('services.edit', unit_id)))
+  WITH CHECK (tenant_id IN (SELECT public.user_tenant_ids())
+              AND (SELECT app.has_permission('services.edit', unit_id)));
+CREATE POLICY rooms_delete ON public.rooms FOR DELETE TO authenticated
+  USING (tenant_id IN (SELECT public.user_tenant_ids())
+         AND (SELECT app.has_permission('services.delete', unit_id)));
+
+-- ── 3. keys the screens already ask for ─────────────────────────────────────
+INSERT INTO app.permissions (key, plugin, description)
+VALUES
+  ('workforce.read',      'workforce',    'Ver escalas, jornadas e batidas de ponto'),
+  ('workforce.create',    'workforce',    'Criar escala, turno ou lançamento de ponto'),
+  ('workforce.edit',      'workforce',    'Alterar escala, turno ou lançamento de ponto'),
+  ('workforce.delete',    'workforce',    'Excluir escala, turno ou lançamento de ponto'),
+  ('workforce.manage',    'workforce',    'Coringa de escalas e ponto'),
+  ('reservations.read',   'reservations', 'Ver reservas'),
+  ('reservations.create', 'reservations', 'Registrar reserva'),
+  ('reservations.edit',   'reservations', 'Alterar ou confirmar reserva'),
+  ('reservations.delete', 'reservations', 'Cancelar ou excluir reserva'),
+  ('reservations.manage', 'reservations', 'Coringa de reservas')
+ON CONFLICT (key) DO NOTHING;
+
+INSERT INTO app.role_permissions (role_id, permission, tenant_id)
+SELECT p.role_id, replace(p.permission, 'workforce_hr.', 'workforce.'), p.tenant_id
+  FROM app.role_permissions p
+ WHERE p.permission IN ('workforce_hr.read', 'workforce_hr.create', 'workforce_hr.edit', 'workforce_hr.delete')
+ON CONFLICT DO NOTHING;
+
+INSERT INTO app.role_permissions (role_id, permission, tenant_id)
+SELECT p.role_id, replace(p.permission, 'tables.', 'reservations.'), p.tenant_id
+  FROM app.role_permissions p
+ WHERE p.permission IN ('tables.read', 'tables.create', 'tables.edit', 'tables.delete', 'tables.manage')
+ON CONFLICT DO NOTHING;
+
+-- Administrator reads the catalog minus owner_only (029): new keys reach it too.
+INSERT INTO app.role_permissions (tenant_id, role_id, permission)
+SELECT r.tenant_id, r.id, p.key
+  FROM app.roles r
+  JOIN app.permissions p ON p.key ~ '^(workforce|reservations)\.(read|create|edit|delete|manage)$'
+ WHERE r.key = 'admin' AND p.owner_only = false
+ON CONFLICT DO NOTHING;

package/migrations/199_field_rules_speak_the_crud_entity.sql

@@ -0,0 +1,82 @@
+-- ============================================================================
+-- 199 — field rules speak the CRUD entity
+--
+-- V1's required_field_rules came across with two errors:
+--   1. the allowlist pinned state='required', so V1 rows that only said
+--      "visible" landed as required (Espaço Facial: 8 required became 12);
+--   2. they kept V1's vocabulary — reference 'clients', field 'cpf' — which no
+--      V2 screen reads. V2 keys a rule by the CRUD entity (archetype:kind,
+--      stored snake: `person_customer`) and the entity's own FieldDef keys.
+--
+-- The writer now takes V1's `visibility` and translates entity and field on
+-- the way in. A V1 field V2 has no place for is skipped with its reason
+-- instead of landing as a rule nothing reads.
+--
+-- Rows already imported are corrected by a re-run of the field-rule import,
+-- not here: the V1 values live in the V1 database.
+--
+-- Idempotent.
+-- ============================================================================
+
+DO $do$
+BEGIN
+  IF to_regprocedure('migration.upsert_field_rule_v1row(uuid, uuid, jsonb, jsonb)') IS NULL THEN
+    ALTER FUNCTION migration.upsert_field_rule(uuid, uuid, jsonb, jsonb) RENAME TO upsert_field_rule_v1row;
+  END IF;
+END $do$;
+
+CREATE OR REPLACE FUNCTION migration.upsert_field_rule(p_tenant uuid, p_id uuid, p_row jsonb, p_args jsonb DEFAULT '{}'::jsonb)
+RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path TO ''
+AS $$
+DECLARE
+  v_entities jsonb := '{"clients":"person_customer","professionals":"person_staff","employees":"person_staff","suppliers":"person_supplier"}';
+  v_fields jsonb := '{
+    "person_customer": {"name":"name","cpf":"documentNumber","rg":"rg","birth_date":"dateOfBirth","gender":"gender",
+                        "phone":"phone","mobile":"mobile","email":"email","social_name":"socialName",
+                        "profession":"profession","origin":"originId","warnings":"warnings","address":"address"},
+    "person_staff":    {"name":"name","cpf":"documentNumber","email":"email","phone":"phone",
+                        "specialty":"profession","commission_rate":"commissionRate"},
+    "person_supplier": {"name":"name","cpf_cnpj":"documentNumber","phone":"phone","mobile":"mobile","email":"email","address":"address"}
+  }';
+  v_ref_in text := lower(nullif(btrim(coalesce(p_row ->> 'reference', '')), ''));
+  v_ref text := coalesce(v_entities ->> v_ref_in, v_ref_in);
+  v_key_in text := nullif(btrim(coalesce(p_row ->> 'field_key', '')), '');
+  v_key text;
+BEGIN
+  IF v_fields ? v_ref THEN
+    v_key := v_fields -> v_ref ->> v_key_in;
+    IF v_key IS NULL THEN
+      RETURN jsonb_build_object('status', 'skipped', 'kind', 'value',
+        'reason', format('V1 field %L of %L has no field in the V2 %s form (V2 keeps the address as one field, ruled by `address`)', v_key_in, v_ref_in, v_ref));
+    END IF;
+  ELSE
+    v_key := v_key_in;
+  END IF;
+  RETURN migration.upsert_field_rule_v1row(
+    p_tenant, p_id,
+    p_row || jsonb_build_object('reference', v_ref, 'field_key', v_key,
+      'state', coalesce(p_row ->> 'visibility', p_row ->> 'state', p_args ->> 'state', p_args ->> 'default_state')),
+    p_args - 'state' - 'default_state');
+END $$;
+
+REVOKE ALL ON FUNCTION migration.upsert_field_rule(uuid, uuid, jsonb, jsonb) FROM PUBLIC;
+GRANT ALL ON FUNCTION migration.upsert_field_rule(uuid, uuid, jsonb, jsonb) TO service_role;
+REVOKE ALL ON FUNCTION migration.upsert_field_rule_v1row(uuid, uuid, jsonb, jsonb) FROM PUBLIC;
+
+DO $unlock$
+BEGIN
+  PERFORM set_config('migration.allowlist_unlock', 'on', true);
+  -- A V1 row with no `visibility` (older exports) still means required.
+  PERFORM migration._allow('required_field_rules', 'public.field_rules', 'config', 'field_rule', '{"default_state":"required"}', '{}',
+    '{"uuid":"id","context":"context","entity":"reference","field_key":"field_key","visibility":"visibility","unit_id":"unit_id@companies"}',
+    '199: V1 `visibility` is carried, not pinned to required; entity and field are translated to the V2 CRUD entity by the writer.');
+END $unlock$;
+
+-- V1's two form contexts. The live cluster already has them (its rules use
+-- them); the chain did not.
+INSERT INTO public.field_rule_contexts (key, plugin, description) VALUES
+  ('main_form', 'base', 'The full registry form (V1 "Cadastro principal")'),
+  ('quick_search', 'base', 'The quick add from a search box (V1 "Busca rápida")')
+ON CONFLICT (key) DO NOTHING;

package/migrations/200_team_members_have_a_name.sql

@@ -0,0 +1,20 @@
+-- ============================================================================
+-- 200 — team members have a name
+--
+-- Choosing "who can authorize" needs a list of logins with names. Memberships
+-- carry the login, people carry the name, and no readable view joined the two:
+-- v_team_members has user_id and person_id but no name.
+--
+-- security_invoker: it reads with the caller's own RLS on people and
+-- memberships, so it shows exactly the members the caller may already see.
+--
+-- Idempotent.
+-- ============================================================================
+CREATE OR REPLACE VIEW public.v_team_member_names
+WITH (security_invoker = true) AS
+SELECT m.tenant_id, m.user_id, m.person_id, coalesce(nullif(p.name, ''), 'Sem nome') AS name
+  FROM app.memberships m
+  LEFT JOIN public.people p ON p.id = m.person_id
+ WHERE m.active;
+
+GRANT SELECT ON public.v_team_member_names TO authenticated;

package/migrations/201_paid_features_are_facets.sql

@@ -0,0 +1,39 @@
+-- 201: features that were an on/off setting become facets a plan sells apart
+-- (time clock, AtendeAI, cashback club, kiosks, waitlist, table tablets, scale,
+-- QR menu). A plan that already lists any grant denies an unlisted facet
+-- (`plan_permits` reads silence per plan, not per facet — see 164), so each
+-- facet is granted as `optional` wherever its plugin is granted: the account
+-- may turn it on in Módulos, and pricing counts it once it does.
+-- Additive and idempotent; plans that do not grant the plugin stay as they are.
+
+DO $$
+DECLARE
+  v record;
+BEGIN
+  IF to_regprocedure('public.register_plan_grant(text,text,text,text,text)') IS NULL THEN
+    RAISE NOTICE '201: register_plan_grant missing — skipped (pool without app.plan_grants)';
+    RETURN;
+  END IF;
+
+  FOR v IN
+    SELECT g.plan_id, f.plugin_id, f.facet
+      FROM (VALUES
+        ('workforce', 'time_clock'),
+        ('conversations', 'atendeai'),
+        ('crm', 'loyalty'),
+        ('agenda', 'kiosk'),
+        ('tables', 'waitlist'),
+        ('tables', 'tablets'),
+        ('orders', 'scale'),
+        ('menu', 'qr_menu')
+      ) AS f(plugin_id, facet)
+      JOIN app.plan_grants g ON g.plugin_id = f.plugin_id AND g.facet = ''
+     WHERE NOT EXISTS (
+       SELECT 1 FROM app.plan_grants x
+        WHERE x.plan_id = g.plan_id AND x.plugin_id = f.plugin_id AND x.facet = f.facet
+     )
+  LOOP
+    PERFORM public.register_plan_grant(v.plan_id, v.plugin_id, v.facet, 'optional',
+      'Was an on/off setting; now a paid part the account turns on in Módulos.');
+  END LOOP;
+END $$;

package/migrations/202_a_unit_switches_off_a_module.sql

@@ -0,0 +1,173 @@
+-- 202: a unit can switch a module off for itself. A network sells at the
+-- counter in three units and not in its services unit: the account has Pedidos,
+-- that unit does not. Absence inherits the account; only an explicit 'disabled' row
+-- narrows, so a unit can never turn on what the account (and its plan) does not
+-- have — which is why the write needs no plan check.
+-- Additive and idempotent. app_config() is re-emitted from the FILE of its last
+-- definition (138) with one more key; nothing else in it changes.
+
+CREATE TABLE IF NOT EXISTS app.unit_plugins (
+  tenant_id  uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  unit_id    uuid NOT NULL,
+  plugin_id  text NOT NULL CHECK (plugin_id ~ '^[a-z][a-z0-9-]*$'),
+  facet      text NOT NULL DEFAULT '' CHECK (facet = '' OR facet ~ '^[a-z][a-z0-9_-]*$'),
+  status     text NOT NULL DEFAULT 'disabled' CHECK (status IN ('active', 'disabled')),
+  updated_by uuid,
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (tenant_id, unit_id, plugin_id, facet),
+  FOREIGN KEY (tenant_id, unit_id) REFERENCES app.units(tenant_id, id) ON DELETE CASCADE
+);
+
+ALTER TABLE app.unit_plugins ENABLE ROW LEVEL SECURITY;
+ALTER TABLE app.unit_plugins FORCE ROW LEVEL SECURITY;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname = 'app' AND tablename = 'unit_plugins' AND policyname = 'unit_plugins_read') THEN
+    -- Same reach as the account's own switches: every member renders the menu
+    -- of whichever unit they stand in. Writes go through unit_plugin_set only.
+    CREATE POLICY unit_plugins_read ON app.unit_plugins FOR SELECT TO authenticated
+      USING (tenant_id IN (SELECT public.user_tenant_ids()));
+  END IF;
+END $$;
+
+REVOKE ALL ON app.unit_plugins FROM PUBLIC, anon;
+GRANT SELECT ON app.unit_plugins TO authenticated;
+GRANT ALL ON app.unit_plugins TO service_role;
+
+-- Whether a module (or one facet of it) may run in a unit of the caller's
+-- account: not switched off by the account, nor by that unit. A plugin the
+-- account never mentions counts as on — the manifest default — exactly as the
+-- shell reads it. Meant for RLS and RPC guards.
+CREATE OR REPLACE FUNCTION app.plugin_enabled_for_unit(p_plugin text, p_unit uuid, p_facet text DEFAULT '')
+RETURNS boolean
+LANGUAGE sql STABLE SECURITY DEFINER
+SET search_path TO ''
+AS $$
+  SELECT NOT EXISTS (
+           SELECT 1 FROM app.tenant_plugins t
+            WHERE t.tenant_id = app.current_tenant_id() AND t.plugin_id = p_plugin
+              AND t.facet IN ('', coalesce(p_facet, ''))
+              AND (t.status = 'disabled' OR (t.expires_at IS NOT NULL AND t.expires_at <= now())))
+     AND NOT EXISTS (
+           SELECT 1 FROM app.unit_plugins u
+            WHERE u.tenant_id = app.current_tenant_id() AND u.unit_id = p_unit AND u.plugin_id = p_plugin
+              AND u.facet IN ('', coalesce(p_facet, '')) AND u.status = 'disabled')
+$$;
+REVOKE ALL ON FUNCTION app.plugin_enabled_for_unit(text, uuid, text) FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION app.plugin_enabled_for_unit(text, uuid, text) TO authenticated, service_role;
+
+-- The only door: switch a module off in one unit, or back to what the account has.
+CREATE OR REPLACE FUNCTION public.unit_plugin_set(p_unit uuid, p_plugin text, p_facet text DEFAULT '', p_status text DEFAULT 'disabled')
+RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path TO ''
+AS $$
+DECLARE
+  v_tenant uuid := app.current_tenant_id();
+BEGIN
+  IF v_tenant IS NULL THEN
+    RAISE EXCEPTION 'no tenant in scope' USING ERRCODE = '42501';
+  END IF;
+  IF NOT app.has_permission('settings.manage') THEN
+    RAISE EXCEPTION 'settings.manage is required to change what a unit has' USING ERRCODE = '42501';
+  END IF;
+  IF p_status NOT IN ('active', 'disabled') THEN
+    RAISE EXCEPTION 'status must be active or disabled' USING ERRCODE = '22023';
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM app.units WHERE tenant_id = v_tenant AND id = p_unit) THEN
+    RAISE EXCEPTION 'unit % is not in this account', p_unit USING ERRCODE = '42501';
+  END IF;
+
+  IF p_status = 'active' THEN
+    -- Back to the account's choice: the row goes, the unit inherits.
+    DELETE FROM app.unit_plugins
+     WHERE tenant_id = v_tenant AND unit_id = p_unit AND plugin_id = p_plugin AND facet = coalesce(p_facet, '');
+  ELSE
+    INSERT INTO app.unit_plugins (tenant_id, unit_id, plugin_id, facet, status, updated_by)
+    VALUES (v_tenant, p_unit, p_plugin, coalesce(p_facet, ''), 'disabled', auth.uid())
+    ON CONFLICT (tenant_id, unit_id, plugin_id, facet)
+      DO UPDATE SET status = 'disabled', updated_by = EXCLUDED.updated_by, updated_at = now();
+  END IF;
+
+  RETURN jsonb_build_object('unit', p_unit, 'plugin', p_plugin, 'facet', nullif(coalesce(p_facet, ''), ''),
+                            'status', CASE WHEN p_status = 'active' THEN 'inherited' ELSE 'disabled' END);
+END $$;
+REVOKE ALL ON FUNCTION public.unit_plugin_set(uuid, text, text, text) FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION public.unit_plugin_set(uuid, text, text, text) TO authenticated, service_role;
+
+CREATE OR REPLACE FUNCTION public.app_config()
+ RETURNS jsonb
+ LANGUAGE plpgsql
+ STABLE SECURITY DEFINER
+ SET search_path TO ''
+AS $function$
+DECLARE
+  v_tenant uuid := app.current_tenant_id();
+  v_staff  text;
+BEGIN
+  -- `platform` é do CLUSTER, não da cadeia canônica: um banco montado do zero
+  -- (o db-from-zero, um pool novo) não tem esse schema, e uma chamada direta
+  -- estoura na inicialização da variável — antes de qualquer linha do corpo.
+  IF pg_catalog.to_regproc('platform.staff_role(uuid)') IS NOT NULL THEN
+    EXECUTE 'SELECT platform.staff_role($1)' INTO v_staff USING (SELECT auth.uid());
+  END IF;
+
+  IF v_tenant IS NULL THEN
+    RETURN jsonb_build_object('tenant_id', NULL, 'plugins', '[]'::jsonb, 'nav', '[]'::jsonb,
+                              'apps', '[]'::jsonb, 'permissions', '[]'::jsonb, 'unit_plugins', '[]'::jsonb, 'generated_at', now());
+  END IF;
+
+  RETURN jsonb_build_object(
+    'tenant_id', v_tenant,
+    'branding',  coalesce(app.brand_of(v_tenant), '{}'::jsonb),
+    'settings',  public.tenant_settings(),
+    'plugins', coalesce((
+      SELECT jsonb_agg(jsonb_build_object('plugin', t.plugin_id, 'facet', nullif(t.facet, ''),
+               'status', CASE WHEN t.expires_at IS NOT NULL AND t.expires_at <= now() THEN 'disabled' ELSE t.status END,
+               'source', t.source, 'config', t.config, 'expires_at', t.expires_at)
+             ORDER BY t.plugin_id, t.facet)
+        FROM app.tenant_plugins t WHERE t.tenant_id = v_tenant), '[]'::jsonb),
+    -- `trade` ordena a lista: quem roda dois aplicativos tem UM ofício, e o
+    -- outro é retaguarda (084). Entre dois SEM ofício, quem declara
+    -- `preset.rail` vence quem não declara (115).
+    --
+    -- O PRIMEIRO desta lista é quem empresta o rail (`useAppPreset`) e agora
+    -- também quem empresta a COR (`useAppTheme`) — as duas leituras têm de ser
+    -- o mesmo aplicativo, senão a casa abre com o menu de um produto e a cara
+    -- de outro.
+    'apps', coalesce((
+      SELECT jsonb_agg(x ORDER BY x ->> 'house',
+                                  (x ->> 'trade')::boolean DESC,
+                                  (x -> 'preset' -> 'rail' IS NOT NULL) DESC,
+                                  x ->> 'name') FROM (
+        SELECT jsonb_build_object('id', a.id, 'name', a.name, 'icon', a.icon, 'accent_color', a.accent_color,
+                 'url', a.url, 'house', false, 'preset', a.preset, 'theme', a.theme, 'vertical_id', a.vertical_id,
+                 'trade', a.vertical_id IS NOT NULL AND a.vertical_id NOT IN ('accounting','generic')) AS x
+          FROM app.tenant_apps ta JOIN app.apps a ON a.id = ta.app_id
+         WHERE ta.tenant_id = v_tenant AND ta.status = 'active' AND a.active
+        UNION ALL
+        SELECT jsonb_build_object('id', a.id, 'name', a.name, 'icon', a.icon, 'accent_color', a.accent_color,
+                 'url', a.url, 'house', true, 'preset', a.preset, 'theme', a.theme, 'vertical_id', a.vertical_id,
+                 'trade', false) AS x
+          FROM app.apps a WHERE v_staff IS NOT NULL AND a.id = 'control-admin' AND a.active AND a.url IS NOT NULL) apps), '[]'::jsonb),
+    'nav', coalesce((
+      SELECT jsonb_agg(jsonb_build_object('key', n.entry_key, 'hidden', n.hidden, 'label', n.label,
+               'section', n.section, 'position', n.position) ORDER BY n.entry_key)
+        FROM app.tenant_nav n WHERE n.tenant_id = v_tenant), '[]'::jsonb),
+    'permissions', coalesce((
+      SELECT jsonb_agg(DISTINCT rp.permission)
+        FROM app.memberships m
+        JOIN app.role_permissions rp ON rp.role_id = m.role_id AND rp.tenant_id = m.tenant_id
+       WHERE m.tenant_id = v_tenant AND m.user_id = (SELECT auth.uid()) AND m.active
+    ), '[]'::jsonb),
+    -- 202: what each unit switched off. Only the 'disabled' rows exist — a unit
+    -- with no row inherits the account — so the shell gets the whole map in
+    -- this same read and never asks per page.
+    'unit_plugins', coalesce((
+      SELECT jsonb_agg(jsonb_build_object('unit_id', u.unit_id, 'plugin', u.plugin_id,
+               'facet', nullif(u.facet, ''), 'status', u.status) ORDER BY u.unit_id, u.plugin_id, u.facet)
+        FROM app.unit_plugins u WHERE u.tenant_id = v_tenant), '[]'::jsonb),
+    'generated_at', now());
+END $function$;
+

package/migrations/203_delivery_is_a_module.sql

@@ -0,0 +1,31 @@
+-- 203: delivery (own fleet + iFood and other marketplaces) becomes the orders
+-- facet `delivery`, turned on in Módulos and priced on its own. Two additive,
+-- idempotent steps so nobody loses what they use today:
+--   1. every plan that grants orders also permits the facet (optional);
+--   2. every account with orders on gets the facet on — the delivery settings
+--      were always there for them, and a new facet defaults to off.
+
+DO $$
+DECLARE
+  v record;
+BEGIN
+  IF to_regprocedure('public.register_plan_grant(text,text,text,text,text)') IS NOT NULL THEN
+    FOR v IN
+      SELECT g.plan_id FROM app.plan_grants g
+       WHERE g.plugin_id = 'orders' AND g.facet = ''
+         AND NOT EXISTS (SELECT 1 FROM app.plan_grants x
+                          WHERE x.plan_id = g.plan_id AND x.plugin_id = 'orders' AND x.facet = 'delivery')
+    LOOP
+      PERFORM public.register_plan_grant(v.plan_id, 'orders', 'delivery', 'optional',
+        'Was always on with orders; now a module the account turns on in Módulos.');
+    END LOOP;
+  END IF;
+
+  IF to_regclass('app.tenant_plugins') IS NOT NULL THEN
+    INSERT INTO app.tenant_plugins (tenant_id, plugin_id, facet, status, config, source)
+    SELECT tp.tenant_id, 'orders', 'delivery', 'active', '{}'::jsonb, 'default'
+      FROM app.tenant_plugins tp
+     WHERE tp.plugin_id = 'orders' AND tp.facet = '' AND tp.status = 'active'
+    ON CONFLICT (tenant_id, plugin_id, facet) DO NOTHING;
+  END IF;
+END $$;

package/migrations/204_a_module_off_in_a_unit_does_not_write_there.sql

@@ -0,0 +1,95 @@
+-- 204: a module switched off in a unit (202) stops WRITING there, not only
+-- showing. One guard, a BEFORE INSERT/UPDATE trigger on each module's
+-- operational tables: a sale, a tab, a booking, a stock move, a time entry in
+-- a unit that has the module off is refused.
+--
+-- Who it binds: a signed-in person (auth.role() = 'authenticated'), including
+-- through SECURITY DEFINER RPCs — those still carry the caller's JWT, so the
+-- sale RPCs are covered without touching them. service_role and direct SQL
+-- (no JWT: migrations, ETL, support) pass, as every other guard here does.
+-- Catalog/config tables are left alone (a price list is shared by the network),
+-- and so are rows one module writes on another's behalf — the stock move, the
+-- fiscal document and the cash line a sale produces: the sale is the act.
+-- Additive and idempotent.
+
+-- Only the UNIT switch (202). The account-level status is the runtime's call:
+-- a module the account turned off can still run because another needs it
+-- (orders keeps inventory moving), and refusing those writes would fail a sale.
+CREATE OR REPLACE FUNCTION app.module_writes_in_unit(p_tenant uuid, p_unit uuid, p_plugin text, p_facet text DEFAULT '')
+RETURNS boolean
+LANGUAGE sql STABLE SECURITY DEFINER
+SET search_path TO ''
+AS $$
+  SELECT NOT EXISTS (
+           SELECT 1 FROM app.unit_plugins u
+            WHERE u.tenant_id = p_tenant AND u.unit_id = p_unit AND u.plugin_id = p_plugin
+              AND u.facet IN ('', coalesce(p_facet, '')) AND u.status = 'disabled')
+$$;
+REVOKE ALL ON FUNCTION app.module_writes_in_unit(uuid, uuid, text, text) FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION app.module_writes_in_unit(uuid, uuid, text, text) TO authenticated, service_role;
+
+-- TG_ARGV[0] = plugin, TG_ARGV[1] = facet (optional).
+CREATE OR REPLACE FUNCTION app.trg_module_unit_guard()
+RETURNS trigger
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path TO ''
+AS $$
+DECLARE
+  v_plugin text := TG_ARGV[0];
+  v_facet  text := coalesce(TG_ARGV[1], '');
+BEGIN
+  IF coalesce(auth.role(), '') <> 'authenticated' OR NEW.unit_id IS NULL THEN
+    RETURN NEW;
+  END IF;
+  -- Sales: the channel says which module sold it.
+  IF TG_TABLE_NAME = 'orders' AND TG_TABLE_SCHEMA = 'public' THEN
+    IF NEW.channel = 'shop' THEN v_plugin := 'shop';
+    ELSIF NEW.channel = 'delivery' THEN v_plugin := 'orders'; v_facet := 'delivery';
+    ELSIF NEW.channel IS NULL OR NEW.channel NOT IN ('balcao', 'dine_in', 'retirada') THEN RETURN NEW;
+    END IF;
+  END IF;
+  IF NOT app.module_writes_in_unit(NEW.tenant_id, NEW.unit_id, v_plugin, v_facet) THEN
+    RAISE EXCEPTION 'module % is switched off in this unit', v_plugin || CASE WHEN v_facet = '' THEN '' ELSE '.' || v_facet END
+      USING ERRCODE = '42501',
+            HINT = 'Ligue o módulo para esta unidade em Configurações › Módulos.';
+  END IF;
+  RETURN NEW;
+END $$;
+REVOKE ALL ON FUNCTION app.trg_module_unit_guard() FROM PUBLIC;
+
+DO $$
+DECLARE
+  r record;
+BEGIN
+  FOR r IN SELECT * FROM (VALUES
+    ('public', 'orders',                       'orders',      ''),
+    ('public', 'plg_tables_order_guests',      'tables',      ''),
+    ('public', 'plg_tables_order_payments',    'tables',      ''),
+    ('public', 'plg_tables_order_transfers',   'tables',      ''),
+    ('public', 'plg_tables_order_cancellations','tables',     ''),
+    ('public', 'plg_tables_order_extensions',  'tables',      ''),
+    ('public', 'plg_tables_order_cover_charges','tables',     ''),
+    ('public', 'plg_tables_courtesy_events',   'tables',      ''),
+    ('public', 'plg_tables_waiter_calls',      'tables',      ''),
+    ('public', 'plg_tables_waitlist',          'tables',      'waitlist'),
+    ('public', 'plg_reservations',             'reservations',''),
+    ('public', 'appointments',                 'agenda',      ''),
+    ('public', 'appointment_items',            'agenda',      ''),
+    ('public', 'plg_agenda_turn_entries',      'agenda',      ''),
+    ('public', 'plg_clinical_sessions',        'clinical',    ''),
+    ('public', 'plg_clinical_session_products','clinical',    ''),
+    ('public', 'plg_inventory_count_sessions', 'inventory',   ''),
+    ('public', 'plg_inventory_production_orders','production',''),
+    ('public', 'plg_workforce_time_entries',   'workforce',   'time_clock'),
+    ('public', 'plg_workforce_time_adjustments','workforce',  ''),
+    ('public', 'plg_workforce_schedule_assignments','workforce','')
+  ) AS t(sch, tbl, plugin, facet)
+  LOOP
+    CONTINUE WHEN to_regclass(format('%I.%I', r.sch, r.tbl)) IS NULL;
+    CONTINUE WHEN NOT EXISTS (SELECT 1 FROM information_schema.columns
+                               WHERE table_schema = r.sch AND table_name = r.tbl AND column_name = 'unit_id');
+    EXECUTE format('DROP TRIGGER IF EXISTS module_unit_guard ON %I.%I', r.sch, r.tbl);
+    EXECUTE format('CREATE TRIGGER module_unit_guard BEFORE INSERT OR UPDATE ON %I.%I
+                    FOR EACH ROW EXECUTE FUNCTION app.trg_module_unit_guard(%L, %L)', r.sch, r.tbl, r.plugin, r.facet);
+  END LOOP;
+END $$;