@fayz-ai/plugin-banking-br 0.10.42 → 0.10.44

package/dist/index.js

@@ -3,6 +3,7 @@ import { Download, Loader2 } from 'lucide-react';
 import { DatePicker, Button, Checkbox, toast } from '@fayz-ai/ui';
 import { connectionStatus, formatCurrency, createConnectionStore, getSupabaseClientOptional } from '@fayz-ai/core';
 import { jsxs, jsx, Fragment } from 'react/jsx-runtime';
+import { MIGRATIONS } from '#migrations/main';
 
 // src/connectors/connectorDef.tsx
 var FUNCTION = "plugbank-sync";
@@ -384,614 +385,6 @@ function buildBankingDomainEvents() {
     }
   ];
 }
-
-// src/migrations/index.ts
-var MIGRATION_000_BASELINE = `-- ============================================================================
--- plugins/plugin-banking-br/src/migrations/000_baseline.sql \u2014 what installing this provisions, as one file.
---
--- GENERATED by scripts/emit-unit-baselines.mjs (#338). Do not edit by hand:
--- change the schema, regenerate, and let scripts/check-chain-equivalence.mjs
--- prove the result still matches.
---
--- This replaced 2 migration files. They are kept, unapplied, in
--- migrations.archive/ \u2014 a year of decisions is worth reading even when it is no
--- longer worth replaying.
---
--- Object order is fixed rather than dependency-sorted: schemas, types,
--- sequences, tables, defaults, functions, constraints, views, indexes, foreign
--- keys, triggers, row security, policies, grants. Dependencies BETWEEN units
--- are carried by the order packages/db/chain.json declares.
--- ============================================================================
-
--- A LANGUAGE sql function binds its body at CREATE time, and 570 functions
--- sorted by name are not sorted by who calls whom. This is what lets them load
--- in any order; every body is still compiled on first call, so a genuinely
--- broken reference surfaces then rather than never. Session-scoped.
-SET check_function_bodies = false;
-
-
-
--- \u2500\u2500 default privileges: reset \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
--- Cleared BEFORE anything is created, so every object below gets the ACL the
--- dump describes rather than the image's defaults on top of it. Restored at
--- the end of this file.
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
-END $dp$;
-
-
--- \u2500\u2500 function \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-
-CREATE FUNCTION public.plg_bank_emit_movement_imported() RETURNS trigger
-    LANGUAGE plpgsql SECURITY DEFINER
-    SET search_path TO 'public'
-    AS $$
-DECLARE
-  v_payload jsonb;
-BEGIN
-  IF NEW.external_source IS NULL OR NEW.external_id IS NULL THEN
-    RETURN NULL;
-  END IF;
-
-  -- The contract every consumer reads. Not the row: a whole-row payload would
-  -- put the ledger's internal bookkeeping inside every webhook by default.
-  v_payload := jsonb_build_object(
-    'movement_id',     NEW.id::text,
-    'provider',        NEW.external_source,
-    'external_id',     NEW.external_id,
-    'direction',       NEW.direction,
-    'amount',          NEW.amount,
-    'payment_date',    NEW.payment_date,
-    'description',     NEW.notes,
-    'bank_account_id', NEW.bank_account_id);
-
-  BEGIN
-    PERFORM public.plg_emit_event(
-      'financial.movement.imported', v_payload, 'financial_movement',
-      NEW.id::text, NEW.tenant_id, NULL);
-  EXCEPTION WHEN OTHERS THEN
-    -- Observability must never be able to reject the write that caused it.
-    RAISE WARNING '[plg_bank_emit_movement_imported] % on %: %', TG_OP, TG_TABLE_NAME, SQLERRM;
-  END;
-
-  RETURN NULL;
-END;
-$$;
-
-CREATE FUNCTION public.plugbank_import_movements(p_payload jsonb) RETURNS jsonb
-    LANGUAGE plpgsql SECURITY DEFINER
-    SET search_path TO 'public'
-    AS $$
-DECLARE
-  v_tenants     uuid[];
-  v_tenant      uuid;
-  v_connection  uuid;
-  v_instance    text;
-  v_account     uuid;
-  v_connector   text;
-  v_trigger     text;
-  v_from        date;
-  v_to          date;
-  v_started     timestamptz := now();
-  v_line        jsonb;
-  v_external    text;
-  v_amount      numeric(14,2);
-  v_date        date;
-  v_fetched     int := 0;
-  v_imported    int := 0;
-  v_duplicates  int := 0;
-  v_inserted    uuid;
-  v_run         uuid;
-BEGIN
-  v_connection := nullif(btrim(p_payload->>'integration_id'), '')::uuid;
-  IF v_connection IS NULL THEN
-    RAISE EXCEPTION 'plugbank_import_movements: integration_id is required'
-      USING ERRCODE = 'invalid_parameter_value';
-  END IF;
-
-  SELECT c.tenant_id, c.instance_key, c.connector_id
-    INTO v_tenant, v_instance, v_connector
-  FROM public.plg_connections c
-  WHERE c.id = v_connection AND c.active;
-
-  IF v_tenant IS NULL THEN
-    RAISE EXCEPTION 'plugbank_import_movements: no active connection %', v_connection
-      USING ERRCODE = 'no_data_found';
-  END IF;
-
-  -- The account this connection is for. \`instance_key\` is text because it also
-  -- carries things that are not uuids for other connectors (a Bling company, a
-  -- gateway instance); here it is the bank account, and '' is the account-less
-  -- default that \`bank_account_id IS NULL\` used to mean.
-  v_account := nullif(btrim(v_instance), '')::uuid;
-
-  -- SECURITY DEFINER bypasses RLS, so the membership check the policy would
-  -- have made has to happen here.
-  SELECT array_agg(t) INTO v_tenants FROM public.user_tenant_ids() AS t;
-  IF auth.uid() IS NOT NULL AND NOT (v_tenant = ANY (COALESCE(v_tenants, '{}'::uuid[]))) THEN
-    RAISE EXCEPTION 'plugbank_import_movements: caller is not a member of tenant %', v_tenant
-      USING ERRCODE = 'insufficient_privilege';
-  END IF;
-
-  -- Refusing beats ignoring: a caller that believes it is importing into
-  -- another tenant must be told, not silently redirected into this one.
-  IF nullif(btrim(p_payload->>'tenant_id'), '') IS NOT NULL
-     AND (p_payload->>'tenant_id')::uuid IS DISTINCT FROM v_tenant THEN
-    RAISE EXCEPTION 'plugbank_import_movements: payload names another tenant; the tenant comes from the connection'
-      USING ERRCODE = 'insufficient_privilege';
-  END IF;
-
-  -- Same rule as the tenant, one level down: the account is the connection's,
-  -- and a payload naming a different one is a caller importing into the wrong
-  -- ledger account. 002 let the payload override it silently \u2014 with one
-  -- connection per account that override is how two accounts get mixed.
-  IF nullif(btrim(p_payload->>'bank_account_id'), '') IS NOT NULL
-     AND (p_payload->>'bank_account_id')::uuid IS DISTINCT FROM v_account THEN
-    RAISE EXCEPTION 'plugbank_import_movements: payload names another bank account; the account comes from the connection'
-      USING ERRCODE = 'insufficient_privilege';
-  END IF;
-
-  v_from    := nullif(btrim(p_payload->>'period_from'), '')::date;
-  v_to      := nullif(btrim(p_payload->>'period_to'), '')::date;
-  v_trigger := lower(coalesce(nullif(btrim(p_payload->>'trigger'), ''), 'manual'));
-  IF v_trigger NOT IN ('on-write', 'scheduled', 'manual', 'webhook') THEN
-    RAISE EXCEPTION 'plugbank_import_movements: unknown trigger %', v_trigger
-      USING ERRCODE = 'invalid_parameter_value';
-  END IF;
-
-  FOR v_line IN SELECT * FROM jsonb_array_elements(coalesce(p_payload->'lines', '[]'::jsonb))
-  LOOP
-    v_fetched := v_fetched + 1;
-    v_external := nullif(btrim(v_line->>'external_id'), '');
-    v_date     := nullif(btrim(v_line->>'date'), '')::date;
-    v_amount   := abs(coalesce((v_line->>'amount')::numeric, 0));
-
-    -- A line with no provider id cannot be recognised on re-delivery, so it
-    -- would import again on every run. Skipping it is the lesser wrong.
-    IF v_external IS NULL OR v_date IS NULL OR v_amount = 0 THEN
-      CONTINUE;
-    END IF;
-
-    INSERT INTO public.plg_financial_movements (
-      tenant_id, direction, movement_kind, amount, paid_amount, status,
-      due_date, payment_date, bank_account_id, notes, external_id, external_source)
-    VALUES (
-      v_tenant,
-      CASE WHEN upper(coalesce(v_line->>'type', 'C')) LIKE 'C%' THEN 'credit' ELSE 'debit' END,
-      'payment', v_amount, v_amount, 'paid',
-      v_date, v_date, v_account,
-      nullif(btrim(v_line->>'description'), ''),
-      v_external, coalesce(v_connector, 'plugbank'))
-    ON CONFLICT (tenant_id, external_source, external_id)
-      WHERE external_id IS NOT NULL AND external_source IS NOT NULL
-    DO NOTHING
-    RETURNING id INTO v_inserted;
-
-    IF v_inserted IS NULL THEN
-      v_duplicates := v_duplicates + 1;
-    ELSE
-      v_imported := v_imported + 1;
-    END IF;
-    v_inserted := NULL;
-  END LOOP;
-
-  UPDATE public.plg_connections
-     SET last_sync_at = now(), status = 'connected', status_detail = NULL, updated_at = now()
-   WHERE id = v_connection;
-
-  -- \`stats\` is where the three facts a manual statement import has and a generic
-  -- run does not go: the operator picked a period, a re-import of that period is
-  -- mostly duplicates by design, and someone pressed the button. The panel reads
-  -- all three back from here.
-  INSERT INTO public.plg_sync_runs (
-    tenant_id, connection_id, connector_id, direction, trigger_kind, status,
-    stream, fetched, written, stats, started_at, finished_at)
-  VALUES (
-    v_tenant, v_connection, coalesce(v_connector, 'plugbank'), 'inbound', v_trigger, 'success',
-    'statement', v_fetched, v_imported,
-    jsonb_strip_nulls(jsonb_build_object(
-      'duplicates',           v_duplicates,
-      'period_from',          v_from,
-      'period_to',            v_to,
-      'triggered_by_user_id', auth.uid())),
-    v_started, now())
-  RETURNING id INTO v_run;
-
-  RETURN jsonb_build_object(
-    'ok', true,
-    'sync_run_id', v_run,
-    'fetched', v_fetched,
-    'imported', v_imported,
-    'duplicates', v_duplicates);
-END;
-$$;
-
-
--- \u2500\u2500 trigger \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-
-CREATE TRIGGER plg_financial_movements_emit_imported AFTER INSERT ON public.plg_financial_movements FOR EACH ROW EXECUTE FUNCTION public.plg_bank_emit_movement_imported();
-
-
--- \u2500\u2500 acl \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-
-REVOKE ALL ON FUNCTION public.plg_bank_emit_movement_imported() FROM PUBLIC;
-GRANT ALL ON FUNCTION public.plg_bank_emit_movement_imported() TO authenticated;
-GRANT ALL ON FUNCTION public.plg_bank_emit_movement_imported() TO service_role;
-
-REVOKE ALL ON FUNCTION public.plugbank_import_movements(p_payload jsonb) FROM PUBLIC;
-GRANT ALL ON FUNCTION public.plugbank_import_movements(p_payload jsonb) TO authenticated;
-GRANT ALL ON FUNCTION public.plugbank_import_movements(p_payload jsonb) TO service_role;
-
-
--- \u2500\u2500 comment \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-
-COMMENT ON FUNCTION public.plugbank_import_movements(p_payload jsonb) IS 'Import bank-statement lines into the financial ledger and file the run in plg_sync_runs. The tenant AND the bank account come from the plg_connections row named by integration_id, never from the payload.';
-
-
--- \u2500\u2500 default privileges: restore \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
--- Put back, so the NEXT thing installed inherits what the chain had.
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO anon$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO anon$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT MAINTAIN ON TABLES TO anon$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT MAINTAIN ON TABLES TO anon$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO anon$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO anon$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
-END $dp$;
-
-DO $dp$ BEGIN
-  EXECUTE $stmt$--
--- PostgreSQL database dump complete
---$stmt$;
-EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
-  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$--
--- PostgreSQL database dump complete
---$stmt$;
-END $dp$;
-`;
-var MIGRATION_001_THE_IMPORT_RPC_NAMES_REAL_TABLES = `-- ==========================================================================
--- 001_the_import_rpc_names_real_tables \u2014 plugbank_import_movements
--- stops reaching through 141's bridge (#352).
---
--- 107 renamed the connector spine out of the \`plg_\` prefix \u2014 the prefix means
--- "a plugin owns this", and the connector framework's tables are the BASE's.
--- 141 left \`plg_connections\` and \`plg_sync_runs\` answering as views so callers
--- could move without a synchronised deploy. This function never moved, and it
--- is not alone: \`plg_connections\` had 13 callers and \`connections\` had none.
--- The bridge became the road.
---
--- The body is 000_baseline's, unchanged except for the three names. It is not
--- an edit of that file \u2014 an applied migration is immutable and the ledger
--- treats drift as a hard stop \u2014 it is a CREATE OR REPLACE that lands after it.
---
--- Why this plugin has to carry its own: the function is banking-br's, and the
--- views it stops using are the spine's. The spine runs FIRST, so a spine file
--- cannot drop a view that a plugin applied later still reads. Each package
--- moves its own callers; the aliases go once nobody is left.
---
--- Replay-safe: CREATE OR REPLACE, same signature, same grants (which 000 set
--- and this does not touch).
--- ==========================================================================
-
-CREATE OR REPLACE FUNCTION public.plugbank_import_movements(p_payload jsonb) RETURNS jsonb
-    LANGUAGE plpgsql SECURITY DEFINER
-    SET search_path TO 'public'
-    AS $$
-DECLARE
-  v_tenants     uuid[];
-  v_tenant      uuid;
-  v_connection  uuid;
-  v_instance    text;
-  v_account     uuid;
-  v_connector   text;
-  v_trigger     text;
-  v_from        date;
-  v_to          date;
-  v_started     timestamptz := now();
-  v_line        jsonb;
-  v_external    text;
-  v_amount      numeric(14,2);
-  v_date        date;
-  v_fetched     int := 0;
-  v_imported    int := 0;
-  v_duplicates  int := 0;
-  v_inserted    uuid;
-  v_run         uuid;
-BEGIN
-  v_connection := nullif(btrim(p_payload->>'integration_id'), '')::uuid;
-  IF v_connection IS NULL THEN
-    RAISE EXCEPTION 'plugbank_import_movements: integration_id is required'
-      USING ERRCODE = 'invalid_parameter_value';
-  END IF;
-
-  SELECT c.tenant_id, c.instance_key, c.connector_id
-    INTO v_tenant, v_instance, v_connector
-  FROM public.connections c
-  WHERE c.id = v_connection AND c.active;
-
-  IF v_tenant IS NULL THEN
-    RAISE EXCEPTION 'plugbank_import_movements: no active connection %', v_connection
-      USING ERRCODE = 'no_data_found';
-  END IF;
-
-  -- The account this connection is for. \`instance_key\` is text because it also
-  -- carries things that are not uuids for other connectors (a Bling company, a
-  -- gateway instance); here it is the bank account, and '' is the account-less
-  -- default that \`bank_account_id IS NULL\` used to mean.
-  v_account := nullif(btrim(v_instance), '')::uuid;
-
-  -- SECURITY DEFINER bypasses RLS, so the membership check the policy would
-  -- have made has to happen here.
-  SELECT array_agg(t) INTO v_tenants FROM public.user_tenant_ids() AS t;
-  IF auth.uid() IS NOT NULL AND NOT (v_tenant = ANY (COALESCE(v_tenants, '{}'::uuid[]))) THEN
-    RAISE EXCEPTION 'plugbank_import_movements: caller is not a member of tenant %', v_tenant
-      USING ERRCODE = 'insufficient_privilege';
-  END IF;
-
-  -- Refusing beats ignoring: a caller that believes it is importing into
-  -- another tenant must be told, not silently redirected into this one.
-  IF nullif(btrim(p_payload->>'tenant_id'), '') IS NOT NULL
-     AND (p_payload->>'tenant_id')::uuid IS DISTINCT FROM v_tenant THEN
-    RAISE EXCEPTION 'plugbank_import_movements: payload names another tenant; the tenant comes from the connection'
-      USING ERRCODE = 'insufficient_privilege';
-  END IF;
-
-  -- Same rule as the tenant, one level down: the account is the connection's,
-  -- and a payload naming a different one is a caller importing into the wrong
-  -- ledger account. 002 let the payload override it silently \u2014 with one
-  -- connection per account that override is how two accounts get mixed.
-  IF nullif(btrim(p_payload->>'bank_account_id'), '') IS NOT NULL
-     AND (p_payload->>'bank_account_id')::uuid IS DISTINCT FROM v_account THEN
-    RAISE EXCEPTION 'plugbank_import_movements: payload names another bank account; the account comes from the connection'
-      USING ERRCODE = 'insufficient_privilege';
-  END IF;
-
-  v_from    := nullif(btrim(p_payload->>'period_from'), '')::date;
-  v_to      := nullif(btrim(p_payload->>'period_to'), '')::date;
-  v_trigger := lower(coalesce(nullif(btrim(p_payload->>'trigger'), ''), 'manual'));
-  IF v_trigger NOT IN ('on-write', 'scheduled', 'manual', 'webhook') THEN
-    RAISE EXCEPTION 'plugbank_import_movements: unknown trigger %', v_trigger
-      USING ERRCODE = 'invalid_parameter_value';
-  END IF;
-
-  FOR v_line IN SELECT * FROM jsonb_array_elements(coalesce(p_payload->'lines', '[]'::jsonb))
-  LOOP
-    v_fetched := v_fetched + 1;
-    v_external := nullif(btrim(v_line->>'external_id'), '');
-    v_date     := nullif(btrim(v_line->>'date'), '')::date;
-    v_amount   := abs(coalesce((v_line->>'amount')::numeric, 0));
-
-    -- A line with no provider id cannot be recognised on re-delivery, so it
-    -- would import again on every run. Skipping it is the lesser wrong.
-    IF v_external IS NULL OR v_date IS NULL OR v_amount = 0 THEN
-      CONTINUE;
-    END IF;
-
-    INSERT INTO public.plg_financial_movements (
-      tenant_id, direction, movement_kind, amount, paid_amount, status,
-      due_date, payment_date, bank_account_id, notes, external_id, external_source)
-    VALUES (
-      v_tenant,
-      CASE WHEN upper(coalesce(v_line->>'type', 'C')) LIKE 'C%' THEN 'credit' ELSE 'debit' END,
-      'payment', v_amount, v_amount, 'paid',
-      v_date, v_date, v_account,
-      nullif(btrim(v_line->>'description'), ''),
-      v_external, coalesce(v_connector, 'plugbank'))
-    ON CONFLICT (tenant_id, external_source, external_id)
-      WHERE external_id IS NOT NULL AND external_source IS NOT NULL
-    DO NOTHING
-    RETURNING id INTO v_inserted;
-
-    IF v_inserted IS NULL THEN
-      v_duplicates := v_duplicates + 1;
-    ELSE
-      v_imported := v_imported + 1;
-    END IF;
-    v_inserted := NULL;
-  END LOOP;
-
-  UPDATE public.connections
-     SET last_sync_at = now(), status = 'connected', status_detail = NULL, updated_at = now()
-   WHERE id = v_connection;
-
-  -- \`stats\` is where the three facts a manual statement import has and a generic
-  -- run does not go: the operator picked a period, a re-import of that period is
-  -- mostly duplicates by design, and someone pressed the button. The panel reads
-  -- all three back from here.
-  INSERT INTO public.sync_runs (
-    tenant_id, connection_id, connector_id, direction, trigger_kind, status,
-    stream, fetched, written, stats, started_at, finished_at)
-  VALUES (
-    v_tenant, v_connection, coalesce(v_connector, 'plugbank'), 'inbound', v_trigger, 'success',
-    'statement', v_fetched, v_imported,
-    jsonb_strip_nulls(jsonb_build_object(
-      'duplicates',           v_duplicates,
-      'period_from',          v_from,
-      'period_to',            v_to,
-      'triggered_by_user_id', auth.uid())),
-    v_started, now())
-  RETURNING id INTO v_run;
-
-  RETURN jsonb_build_object(
-    'ok', true,
-    'sync_run_id', v_run,
-    'fetched', v_fetched,
-    'imported', v_imported,
-    'duplicates', v_duplicates);
-END;
-$$;
-COMMENT ON FUNCTION public.plugbank_import_movements(p_payload jsonb) IS
-  'Import bank-statement lines into the financial ledger and file the run in public.sync_runs. The tenant AND the bank account come from the public.connections row named by integration_id, never from the payload.';
-`;
-var MIGRATIONS = [
-  { id: "000_baseline", sql: MIGRATION_000_BASELINE },
-  { id: "001_the_import_rpc_names_real_tables", sql: MIGRATION_001_THE_IMPORT_RPC_NAMES_REAL_TABLES }
-];
-
-// src/index.ts
 function createOpenBankingPlugin() {
   return {
     id: "openbanking",