@fayz-ai/db 0.8.0 → 0.8.1

package/migrations/002_rls_user_tenant_ids.sql

@@ -31,8 +31,9 @@ DECLARE
     -- 004 archetypes (self-governed via 004/006 policies)
     'people', 'categories', 'products', 'services', 'orders', 'order_items',
     'transactions', 'appointments', 'appointment_items', 'schedules',
-    -- core, non-API helper tables
-    'sequences', 'documents', 'fayz_migration_ledger'
+    -- core, non-API helper tables (both ledger names kept for pre/post-rename compat;
+    -- `_migrations` is also covered by the NOT LIKE '\_%' filter below)
+    'sequences', 'documents', 'fayz_migration_ledger', '_migrations'
   ];
 BEGIN
   FOR t IN

package/migrations/010_migration_ledger.sql

@@ -8,9 +8,15 @@
 -- service_role only: no anon/authenticated grants, RLS enabled with NO
 -- policies, so PostgREST (anon/authenticated) is deny-all. Only the service
 -- role (which bypasses RLS) — i.e. the runner — can read/write it.
+--
+-- Naming: the ledger is an internal, non-API table, so it uses the `_`-prefixed
+-- `public._migrations` name (excluded from the project_rls auto-policy pass by
+-- the `NOT LIKE '\_%'` filter). Legacy pools provisioned as `fayz_migration_ledger`
+-- are migrated by 012_rename_migration_ledger.sql (and by the runner's
+-- ensureLedger guard); fresh installs are born as `_migrations` here.
 -- ============================================================================
 
-CREATE TABLE IF NOT EXISTS public.fayz_migration_ledger (
+CREATE TABLE IF NOT EXISTS public._migrations (
   id bigserial PRIMARY KEY,
   plugin_id text NOT NULL,
   file_name text NOT NULL,
@@ -21,10 +27,10 @@ CREATE TABLE IF NOT EXISTS public.fayz_migration_ledger (
   UNIQUE(plugin_id, file_name)
 );
 
-ALTER TABLE public.fayz_migration_ledger ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public._migrations ENABLE ROW LEVEL SECURITY;
 
 -- Deny-all through PostgREST: revoke any inherited grants, grant to nobody but
 -- service_role (which bypasses RLS anyway). No policies = no anon/authenticated access.
-REVOKE ALL ON public.fayz_migration_ledger FROM anon, authenticated;
-GRANT ALL ON public.fayz_migration_ledger TO service_role;
-GRANT USAGE, SELECT ON SEQUENCE public.fayz_migration_ledger_id_seq TO service_role;
+REVOKE ALL ON public._migrations FROM anon, authenticated;
+GRANT ALL ON public._migrations TO service_role;
+GRANT USAGE, SELECT ON SEQUENCE public._migrations_id_seq TO service_role;

package/migrations/012_rename_migration_ledger.sql

@@ -0,0 +1,61 @@
+-- ============================================================================
+-- 012_rename_migration_ledger.sql — rename the migration ledger onto the
+-- internal `_`-prefixed baseline name:
+--
+--   public.fayz_migration_ledger → public._migrations
+--
+-- Legacy-pool remediation ONLY: 010_migration_ledger.sql now creates `_migrations`
+-- directly, so fresh installs never reach a rename branch. The runner's
+-- ensureLedger (cli/src/lib/ledger.ts) performs the same guarded rename at the
+-- START of every apply, so on a real pool the ledger is already `_migrations`
+-- by the time this migration runs — this file is the declarative backstop.
+--
+-- Fully idempotent + guarded: each RENAME fires only when the old object exists
+-- and the new one does not. A table RENAME preserves the rows (the applied-file
+-- history MUST survive), plus RLS state, grants and constraints; re-assert the
+-- deny-all grants afterwards to keep the baseline explicit.
+-- ============================================================================
+
+DO $$
+BEGIN
+  -- Table (carries the applied-migration history — never drop + recreate).
+  IF to_regclass('public.fayz_migration_ledger') IS NOT NULL
+     AND to_regclass('public._migrations') IS NULL THEN
+    ALTER TABLE public.fayz_migration_ledger RENAME TO _migrations;
+  END IF;
+
+  -- bigserial owns fayz_migration_ledger_id_seq — a table rename does not move it.
+  IF to_regclass('public.fayz_migration_ledger_id_seq') IS NOT NULL
+     AND to_regclass('public._migrations_id_seq') IS NULL THEN
+    ALTER SEQUENCE public.fayz_migration_ledger_id_seq RENAME TO _migrations_id_seq;
+  END IF;
+
+  -- Named constraints are auto-named after the old table; rename for parity with
+  -- a fresh install. Guard on the new table existing so this is safe pre-rename.
+  IF to_regclass('public._migrations') IS NOT NULL THEN
+    IF EXISTS (SELECT 1 FROM pg_constraint
+               WHERE conname = 'fayz_migration_ledger_pkey'
+                 AND conrelid = 'public._migrations'::regclass) THEN
+      ALTER TABLE public._migrations RENAME CONSTRAINT fayz_migration_ledger_pkey TO _migrations_pkey;
+    END IF;
+    IF EXISTS (SELECT 1 FROM pg_constraint
+               WHERE conname = 'fayz_migration_ledger_plugin_id_file_name_key'
+                 AND conrelid = 'public._migrations'::regclass) THEN
+      ALTER TABLE public._migrations
+        RENAME CONSTRAINT fayz_migration_ledger_plugin_id_file_name_key
+        TO _migrations_plugin_id_file_name_key;
+    END IF;
+  END IF;
+END $$;
+
+-- Re-assert the deny-all posture (idempotent; RLS/grants survive a rename but the
+-- baseline keeps this explicit so a manually-created ledger converges too).
+DO $$
+BEGIN
+  IF to_regclass('public._migrations') IS NOT NULL THEN
+    EXECUTE 'ALTER TABLE public._migrations ENABLE ROW LEVEL SECURITY';
+    EXECUTE 'REVOKE ALL ON public._migrations FROM anon, authenticated';
+    EXECUTE 'GRANT ALL ON public._migrations TO service_role';
+    EXECUTE 'GRANT USAGE, SELECT ON SEQUENCE public._migrations_id_seq TO service_role';
+  END IF;
+END $$;

package/migrations/013_sequences_rls.sql

@@ -0,0 +1,22 @@
+-- ============================================================================
+-- 013_sequences_rls.sql — close the RLS drift on public.sequences.
+--
+-- public.sequences (the REC-/PAG- numbering counter, created by the financial
+-- plugin's 004_order_to_cash.sql) shipped WITHOUT row-level security on a set of
+-- pools. Baseline = RLS ON, deny-all (no policies), exactly like the salon pool:
+-- the table is written ONLY through the SECURITY DEFINER function
+-- public.next_sequence(), which runs as the table owner and so bypasses RLS.
+-- With RLS on and no policy, the PostgREST anon/authenticated surface is deny-all,
+-- so the counter can never be read or tampered with directly by a tenant.
+--
+-- Legacy-pool remediation: guarded so it is a no-op on pools that never enabled
+-- Payments (sequences absent) and idempotent on pools already at RLS ON. Fresh
+-- installs are born with RLS via the financial plugin's own 004_order_to_cash.sql.
+--
+-- NOTE: next_sequence() MUST be SECURITY DEFINER for the deny-all baseline to
+-- keep working — it is called directly via PostgREST RPC by authenticated users
+-- (plugins/plugin-financial/src/data/supabase.ts → createInvoice). That fix ships
+-- in the financial plugin migration alongside this one.
+-- ============================================================================
+
+ALTER TABLE IF EXISTS public.sequences ENABLE ROW LEVEL SECURITY;

package/migrations/014_plan_entitlements.sql

@@ -0,0 +1,28 @@
+-- ============================================================================
+-- 014_plan_entitlements.sql — plans carry machine-readable entitlements.
+--
+-- public.plans shipped with `features jsonb` as DISPLAY BULLETS only — nothing
+-- in the pool encodes what a plan actually gates. Server-side enforcement (the
+-- agent RPCs' role→plan→limit guard, and eventually RLS defense-in-depth)
+-- needs the SAME `{features: {id: bool}, limits: {key: number}}` structure the
+-- client resolves from `config.billing` (@fayz-ai/core PlanEntitlements; -1 =
+-- unlimited, absent feature = allowed).
+--
+-- Writer: the app's plan catalog is code (billing.ts) → synced into this table
+-- (transitionally by the app seed, then by the Fayz platform on
+-- `fayz manifest sync` — the manifest carries billing.plans verbatim).
+--
+-- `hidden` retires the "qa-free-test plans visible on SubscriptionPage" debt:
+-- QA/internal plans stay selectable by id but are never rendered.
+--
+-- Guarded + idempotent: no-op when the pool predates public.plans (legacy
+-- saas_core pools run their app-local mirror of this ALTER instead).
+-- ============================================================================
+
+DO $$
+BEGIN
+  IF to_regclass('public.plans') IS NOT NULL THEN
+    ALTER TABLE public.plans ADD COLUMN IF NOT EXISTS entitlements jsonb NOT NULL DEFAULT '{}'::jsonb;
+    ALTER TABLE public.plans ADD COLUMN IF NOT EXISTS hidden boolean NOT NULL DEFAULT false;
+  END IF;
+END $$;

package/migrations/015_agent_guard.sql

@@ -0,0 +1,108 @@
+-- ============================================================================
+-- 015_agent_guard.sql — the role→plan→limit gate for agent_* RPCs.
+--
+-- Every server-plane agent write RPC (agent_<domain>_<verb>) calls this FIRST.
+-- It is the SQL mirror of the shared TS engine (@fayz-ai/core/access
+-- resolveAccess/resolveLimit): role first (owner bypasses role, NOT plan;
+-- `manage` satisfies any action; tenant_role_overrides win over role grants),
+-- then plan feature gate (only explicit false denies), then the plan cap for
+-- p_limit_key (absent / -1 = unlimited). The RPC counts its own domain rows
+-- and passes p_used — the guard never runs dynamic SQL.
+--
+-- Returns NULL when allowed, or the AgentDenial jsonb mirror when denied:
+--   {"allowed":false,"reason":"role"|"plan"|"limit",
+--    "limit":{"key":..,"max":..,"used":..},"upgradeUrl":"/settings/subscription"}
+-- A parity test on the app side runs the same scenarios through the TS engine
+-- and through this function — divergence is a bug.
+--
+-- Permission ids use the `category.action` catalog form; grants live in
+-- role_permissions (+ per-tenant tenant_role_overrides with granted boolean).
+-- ============================================================================
+
+CREATE OR REPLACE FUNCTION public.agent_guard(
+  p_tenant_id uuid,
+  p_actor_user_id uuid,
+  p_feature text,
+  p_action text,
+  p_limit_key text DEFAULT NULL,
+  p_used integer DEFAULT NULL,
+  p_n integer DEFAULT 1
+) RETURNS jsonb
+LANGUAGE plpgsql STABLE SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_role text;
+  v_has boolean;
+  v_override boolean;
+  v_plan_id text;
+  v_ent jsonb;
+  v_feature_flag jsonb;
+  v_cap numeric;
+BEGIN
+  -- ── membership + role ────────────────────────────────────────────────────
+  SELECT tm.role INTO v_role
+  FROM tenant_members tm
+  WHERE tm.tenant_id = p_tenant_id AND tm.user_id = p_actor_user_id;
+  IF v_role IS NULL THEN
+    RETURN jsonb_build_object('allowed', false, 'reason', 'role',
+                              'upgradeUrl', '/settings/subscription');
+  END IF;
+
+  IF v_role <> 'owner' THEN
+    -- per-tenant override wins in BOTH directions (grant or deny)
+    SELECT tro.granted INTO v_override
+    FROM tenant_role_overrides tro
+    WHERE tro.tenant_id = p_tenant_id AND tro.role = v_role
+      AND tro.permission_id IN (p_feature || '.' || p_action, p_feature || '.manage')
+    ORDER BY (tro.permission_id = p_feature || '.' || p_action) DESC
+    LIMIT 1;
+
+    IF v_override IS NOT NULL THEN
+      v_has := v_override;
+    ELSE
+      SELECT EXISTS (
+        SELECT 1 FROM role_permissions rp
+        WHERE rp.role = v_role
+          AND rp.permission_id IN (p_feature || '.' || p_action, p_feature || '.manage')
+      ) INTO v_has;
+    END IF;
+
+    IF NOT v_has THEN
+      RETURN jsonb_build_object('allowed', false, 'reason', 'role',
+                                'upgradeUrl', '/settings/subscription');
+    END IF;
+  END IF;
+
+  -- ── plan feature gate (owner does NOT bypass) ────────────────────────────
+  SELECT t.plan INTO v_plan_id FROM tenants t WHERE t.id = p_tenant_id;
+  SELECT p.entitlements INTO v_ent FROM plans p WHERE p.id = v_plan_id;
+
+  IF v_ent IS NOT NULL THEN
+    v_feature_flag := v_ent->'features'->p_feature;
+    -- only an EXPLICIT false denies (additive plans — mirror isEntitledByPlan)
+    IF v_feature_flag IS NOT NULL AND v_feature_flag = to_jsonb(false) THEN
+      RETURN jsonb_build_object('allowed', false, 'reason', 'plan',
+                                'upgradeUrl', '/settings/subscription');
+    END IF;
+
+    -- ── plan cap (mirror resolveLimit: absent / -1 = unlimited) ────────────
+    IF p_limit_key IS NOT NULL AND p_used IS NOT NULL THEN
+      v_cap := (v_ent->'limits'->>p_limit_key)::numeric;
+      IF v_cap IS NOT NULL AND v_cap <> -1 AND (p_used + COALESCE(p_n, 1)) > v_cap THEN
+        RETURN jsonb_build_object('allowed', false, 'reason', 'limit',
+                                  'limit', jsonb_build_object('key', p_limit_key,
+                                                              'max', v_cap,
+                                                              'used', p_used),
+                                  'upgradeUrl', '/settings/subscription');
+      END IF;
+    END IF;
+  END IF;
+
+  RETURN NULL; -- allowed
+END;
+$$;
+
+REVOKE ALL ON FUNCTION public.agent_guard(uuid, uuid, text, text, text, integer, integer) FROM public;
+GRANT EXECUTE ON FUNCTION public.agent_guard(uuid, uuid, text, text, text, integer, integer)
+  TO authenticated, service_role;

package/migrations/016_agent_guard_actor.sql

@@ -0,0 +1,102 @@
+-- ============================================================================
+-- 016_agent_guard_actor.sql — the actor cannot be spoofed by a signed-in caller.
+--
+-- agent_* RPCs receive p_actor_user_id explicitly because the Fayz broker
+-- (service_role, no JWT) injects the verified actor server-side. But the same
+-- functions are EXECUTE-granted to `authenticated` so the surface can call
+-- them client-plane before S4 — and there, p_actor comes from the client. A
+-- signed-in user passing SOMEONE ELSE's id would borrow their role.
+--
+-- Rule added at the top of agent_guard (every write RPC's first call): when
+-- the caller carries a JWT identity (auth.uid() not null), p_actor MUST be
+-- that identity. Service-role/broker calls (auth.uid() null) are unaffected.
+-- New file rather than editing 015 — applied migrations are never edited
+-- (ledger rule); CREATE OR REPLACE supersedes the body.
+-- ============================================================================
+
+CREATE OR REPLACE FUNCTION public.agent_guard(
+  p_tenant_id uuid,
+  p_actor_user_id uuid,
+  p_feature text,
+  p_action text,
+  p_limit_key text DEFAULT NULL,
+  p_used integer DEFAULT NULL,
+  p_n integer DEFAULT 1
+) RETURNS jsonb
+LANGUAGE plpgsql STABLE SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_role text;
+  v_has boolean;
+  v_override boolean;
+  v_plan_id text;
+  v_ent jsonb;
+  v_feature_flag jsonb;
+  v_cap numeric;
+BEGIN
+  -- ── actor integrity: a JWT caller can only act as themselves ─────────────
+  IF auth.uid() IS NOT NULL AND auth.uid() IS DISTINCT FROM p_actor_user_id THEN
+    RETURN jsonb_build_object('allowed', false, 'reason', 'role',
+                              'upgradeUrl', '/settings/subscription');
+  END IF;
+
+  -- ── membership + role ────────────────────────────────────────────────────
+  SELECT tm.role INTO v_role
+  FROM tenant_members tm
+  WHERE tm.tenant_id = p_tenant_id AND tm.user_id = p_actor_user_id;
+  IF v_role IS NULL THEN
+    RETURN jsonb_build_object('allowed', false, 'reason', 'role',
+                              'upgradeUrl', '/settings/subscription');
+  END IF;
+
+  IF v_role <> 'owner' THEN
+    SELECT tro.granted INTO v_override
+    FROM tenant_role_overrides tro
+    WHERE tro.tenant_id = p_tenant_id AND tro.role = v_role
+      AND tro.permission_id IN (p_feature || '.' || p_action, p_feature || '.manage')
+    ORDER BY (tro.permission_id = p_feature || '.' || p_action) DESC
+    LIMIT 1;
+
+    IF v_override IS NOT NULL THEN
+      v_has := v_override;
+    ELSE
+      SELECT EXISTS (
+        SELECT 1 FROM role_permissions rp
+        WHERE rp.role = v_role
+          AND rp.permission_id IN (p_feature || '.' || p_action, p_feature || '.manage')
+      ) INTO v_has;
+    END IF;
+
+    IF NOT v_has THEN
+      RETURN jsonb_build_object('allowed', false, 'reason', 'role',
+                                'upgradeUrl', '/settings/subscription');
+    END IF;
+  END IF;
+
+  -- ── plan feature gate (owner does NOT bypass) ────────────────────────────
+  SELECT t.plan INTO v_plan_id FROM tenants t WHERE t.id = p_tenant_id;
+  SELECT p.entitlements INTO v_ent FROM plans p WHERE p.id = v_plan_id;
+
+  IF v_ent IS NOT NULL THEN
+    v_feature_flag := v_ent->'features'->p_feature;
+    IF v_feature_flag IS NOT NULL AND v_feature_flag = to_jsonb(false) THEN
+      RETURN jsonb_build_object('allowed', false, 'reason', 'plan',
+                                'upgradeUrl', '/settings/subscription');
+    END IF;
+
+    IF p_limit_key IS NOT NULL AND p_used IS NOT NULL THEN
+      v_cap := (v_ent->'limits'->>p_limit_key)::numeric;
+      IF v_cap IS NOT NULL AND v_cap <> -1 AND (p_used + COALESCE(p_n, 1)) > v_cap THEN
+        RETURN jsonb_build_object('allowed', false, 'reason', 'limit',
+                                  'limit', jsonb_build_object('key', p_limit_key,
+                                                              'max', v_cap,
+                                                              'used', p_used),
+                                  'upgradeUrl', '/settings/subscription');
+      END IF;
+    END IF;
+  END IF;
+
+  RETURN NULL;
+END;
+$$;

package/migrations/017_core_addresses.sql

@@ -0,0 +1,115 @@
+-- ============================================================================
+-- 017_core_addresses.sql — public.addresses becomes part of the SPINE.
+-- ----------------------------------------------------------------------------
+-- The address book was already declared "core" by @fayz-ai/shop's 0012
+-- ("move address/payment concepts OUT of the plugin, into core"), but the SQL
+-- physically shipped inside the shop package. Consequence, live today: any app
+-- that does not install @fayz-ai/shop has no addresses table, while the person
+-- archetype's "Endereços" tab (packages/saas AddressesTab) queries it
+-- unconditionally — beauty-saas, dentist-saas, agency-os and every other
+-- non-shop vertical render "Could not find the table 'public.addresses'".
+--
+-- An address is not e-commerce. It is where a client is delivered to, where a
+-- supplier is collected from, where a staff member lives, where a unit of the
+-- business sits. It belongs beside `people` and `locations`, in the spine.
+--
+-- Replay safety (this file runs on pools that already have the table, via shop
+-- 0012, AND on pools that have never seen it):
+--   • CREATE TABLE IF NOT EXISTS + ADD COLUMN IF NOT EXISTS — additive only
+--   • the owner_type CHECK is dropped and rebuilt WIDER, never narrower, so a
+--     pool holding 'shop_customer' rows keeps them valid
+--   • no DROP of data, no DROP of the shop's own policies
+-- Ordering: the spine runs BEFORE plugin migrations (cli buildMigrationPlan
+-- ① spine → ④ plugin), so on a fresh shop pool this file creates the table and
+-- shop 0012's own CREATE ... IF NOT EXISTS degrades to a no-op.
+--
+-- `owner_type` stays text rather than a FK because the owner is polymorphic:
+-- a core `people` row, a `locations` row, the tenant itself, or — until the
+-- shop's customer table is folded into `people` — a plg_shop_customers row.
+-- ============================================================================
+
+-- ----------------------------------------------------------------------------
+-- 1. The table
+-- ----------------------------------------------------------------------------
+CREATE TABLE IF NOT EXISTS public.addresses (
+  id           uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id    uuid NOT NULL,
+  owner_type   text NOT NULL DEFAULT 'person',
+  owner_id     uuid,
+  kind         text NOT NULL DEFAULT 'both',
+  label        text,          -- "Casa", "Trabalho", "Depósito"
+  recipient    text,          -- quem recebe, se não for o próprio dono
+  phone        text,
+  postal_code  text NOT NULL, -- CEP
+  street       text NOT NULL,
+  number       text,
+  complement   text,
+  district     text,          -- bairro
+  city         text NOT NULL,
+  state        text NOT NULL, -- UF
+  country      text NOT NULL DEFAULT 'BR',
+  is_default   boolean NOT NULL DEFAULT false,
+  metadata     jsonb NOT NULL DEFAULT '{}',
+  created_at   timestamptz NOT NULL DEFAULT now(),
+  updated_at   timestamptz NOT NULL DEFAULT now()
+);
+
+COMMENT ON TABLE public.addresses IS
+  'Core address book. N addresses per owner (person, location, tenant), tenant-scoped. Owned by @fayz-ai/db — plugins read it, none of them own it.';
+
+-- Pools provisioned by shop 0012 predate `metadata`/'both' defaults; add what
+-- is missing rather than assuming the 0012 shape.
+ALTER TABLE public.addresses
+  ADD COLUMN IF NOT EXISTS owner_type text NOT NULL DEFAULT 'person',
+  ADD COLUMN IF NOT EXISTS owner_id   uuid,
+  ADD COLUMN IF NOT EXISTS kind       text NOT NULL DEFAULT 'both',
+  ADD COLUMN IF NOT EXISTS label      text,
+  ADD COLUMN IF NOT EXISTS recipient  text,
+  ADD COLUMN IF NOT EXISTS phone      text,
+  ADD COLUMN IF NOT EXISTS number     text,
+  ADD COLUMN IF NOT EXISTS complement text,
+  ADD COLUMN IF NOT EXISTS district   text,
+  ADD COLUMN IF NOT EXISTS metadata   jsonb NOT NULL DEFAULT '{}';
+
+-- ----------------------------------------------------------------------------
+-- 2. Constraints — rebuilt WIDER than shop 0012's.
+--    'staff' and 'partner' are person kinds and already covered by 'person';
+--    what 0012 lacked is nothing — this only re-asserts the same set so a pool
+--    that never ran 0012 gets it, and a pool that did is left unchanged.
+-- ----------------------------------------------------------------------------
+ALTER TABLE public.addresses DROP CONSTRAINT IF EXISTS addresses_owner_type_check;
+ALTER TABLE public.addresses
+  ADD CONSTRAINT addresses_owner_type_check
+  CHECK (owner_type IN ('person', 'shop_customer', 'location', 'tenant'));
+
+ALTER TABLE public.addresses DROP CONSTRAINT IF EXISTS addresses_kind_check;
+ALTER TABLE public.addresses
+  ADD CONSTRAINT addresses_kind_check
+  CHECK (kind IN ('shipping', 'billing', 'both'));
+
+CREATE INDEX IF NOT EXISTS addresses_tenant_idx ON public.addresses (tenant_id);
+CREATE INDEX IF NOT EXISTS addresses_owner_idx  ON public.addresses (owner_type, owner_id);
+-- One default per owner per kind, enforced here rather than trusting every
+-- caller to clear the previous one.
+CREATE UNIQUE INDEX IF NOT EXISTS addresses_one_default_idx
+  ON public.addresses (owner_type, owner_id, kind) WHERE is_default;
+
+DROP TRIGGER IF EXISTS addresses_updated_at ON public.addresses;
+CREATE TRIGGER addresses_updated_at BEFORE UPDATE ON public.addresses
+  FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
+
+-- ----------------------------------------------------------------------------
+-- 3. RLS — tenant members manage their tenant's rows. Anon gets nothing.
+--    The shop's extra `addresses_self_read` policy (a signed-in storefront
+--    customer reading their own rows) is left untouched: it is additive, and
+--    shop 0012 runs after this file.
+-- ----------------------------------------------------------------------------
+ALTER TABLE public.addresses ENABLE ROW LEVEL SECURITY;
+
+DROP POLICY IF EXISTS "addresses_member_all" ON public.addresses;
+CREATE POLICY "addresses_member_all" ON public.addresses FOR ALL TO authenticated
+  USING (tenant_id IN (SELECT public.user_tenant_ids()))
+  WITH CHECK (tenant_id IN (SELECT public.user_tenant_ids()));
+
+GRANT ALL ON public.addresses TO authenticated, service_role;
+REVOKE ALL ON public.addresses FROM anon;

package/package.json

@@ -3,7 +3,7 @@
   "fayz": {
     "status": "beta"
   },
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Fayz SDK database layer — Drizzle schema primitives, spine references, and migration helpers shared across plugins.",
   "type": "module",
   "main": "./dist/index.cjs",