@fayz-ai/plugin-banking-br 0.10.6 → 0.10.7

package/dist/index.js

@@ -49,7 +49,7 @@ function toSyncRun(run) {
     periodFrom: stats.period_from ?? void 0,
     periodTo: stats.period_to ?? void 0,
     duplicates: Number(stats.duplicates ?? 0),
-    // plg_sync_runs has no created_at: a run is identified by when it STARTED,
+    // sync_runs has no created_at: a run is identified by when it STARTED,
     // which is what the old created_at recorded anyway (the row was inserted at
     // the end, so the two disagreed by the length of the import).
     createdAt: run.startedAt ?? ""
@@ -90,7 +90,7 @@ function createOpenBankingProvider() {
       const { data, error } = await supabase.functions.invoke(FUNCTION, {
         body: {
           action: "import_transactions",
-          // Still `integrationId` on the wire: it now carries a plg_connections
+          // Still `integrationId` on the wire: it now carries a connections
           // id, and keeping the key means the deployed function needs no
           // coordinated release. The RPC takes the tenant AND the bank account
           // from that row, so neither can be steered from here.
@@ -329,7 +329,7 @@ var openBankingConnector = {
     await provider.saveIntegration();
   },
   disconnect: () => provider.disconnect(),
-  // Every import files a `plg_sync_runs` row, and the shared surface renders it.
+  // Every import files a `sync_runs` row, and the shared surface renders it.
   // What is connector-specific is not the VIEW, it is the meaning of `stats`:
   // "de 01/08 a 12/08 · 3 duplicadas" is three keys only this connector can
   // read, turned here into the one sentence every run carries. Scoped to the
@@ -393,121 +393,122 @@ function buildBankingDomainEvents() {
 }
 
 // src/migrations/index.ts
-var MIGRATION_002_CREDENTIAL_AND_FACTS = `-- ============================================================================
--- plugin-banking-br 002: the credential leaves the tenant database, the import
--- gets a door it cannot be routed around, and the import becomes a FACT.
+var MIGRATION_000_BASELINE = `-- ============================================================================
+-- plugins/plugin-banking-br/src/migrations/000_baseline.sql \u2014 what installing this provisions, as one file.
 --
---   \xA71  credential  drop api_token + cnpj from public.bank_integrations
---   \xA72  sync runs   bank_integration_sync_log speaks the SyncRun vocabulary
---   \xA73  import      plugbank_import_movements \u2014 the tenant-safe door
---   \xA74  facts       financial.movement.imported
+-- GENERATED by scripts/emit-unit-baselines.mjs (#338). Do not edit by hand:
+-- change the schema, regenerate, and let scripts/check-chain-equivalence.mjs
+-- prove the result still matches.
 --
--- Additive and idempotent: no table is created, no policy is rewritten, and the
--- tenant RLS from 001 already covers every column added here.
+-- This replaced 2 migration files. They are kept, unapplied, in
+-- migrations.archive/ \u2014 a year of decisions is worth reading even when it is no
+-- longer worth replaying.
+--
+-- Object order is fixed rather than dependency-sorted: schemas, types,
+-- sequences, tables, defaults, functions, constraints, views, indexes, foreign
+-- keys, triggers, row security, policies, grants. Dependencies BETWEEN units
+-- are carried by the order packages/db/chain.json declares.
 -- ============================================================================
 
--- \xA71 \u2500\u2500 credential \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
--- THE EXPOSURE THIS CLOSES: 001 stored \`api_token text\` and \`cnpj text\` on
--- public.bank_integrations. That table is read from the browser with the
--- publishable key under tenant RLS, so the bank credential was readable by ANY
--- authenticated member of the tenant; and a pool is one Supabase project serving
--- N tenants (beauty-saas and espaco-renova-rio share one), so anything running
--- there with service_role could read every clinic's bank token at once.
---
--- PlugBank differs from RankLayer, which dropped its key with nothing to replace
--- it: PlugBank is a PULL connector and genuinely needs a credential at fetch
--- time. It just must not be THIS copy. The destination is the platform's
--- encrypted ConnectorConnection store, redeemed per call (FAY-1360 + FAY-1389).
--- NEITHER HAS HAPPENED YET: as of 2026-08-12 the live pool still holds the
--- token in this column, this migration is unapplied there, and the deployed
--- plugbank-sync (v6) still reads it. The FAY-1360 rollout must register the
--- credential at the platform BEFORE this drop runs on that pool \u2014 otherwise
--- what is removed here is the only copy, and the connection dies.
---
--- \`cnpj\` goes with it rather than surviving as a masked remnant. It is not
--- decoration: paired with the token it is what identifies the account at the
--- provider (\`/v1/extrato?cnpj=\u2026\`), which makes it half of the credential and
--- therefore the platform's to hold. And nothing on this side reads it \u2014 the
--- live connector panel never renders it, and the unified connect form starts
--- every field empty rather than pre-filling from the row. A masked last-N would
--- be a column added to serve a screen that does not exist, on data that
--- identifies a real company.
---
--- ROTATE any token a pool already stored. DROP COLUMN is a catalog change: the
--- old values stay in the heap until the next table rewrite.
+-- A LANGUAGE sql function binds its body at CREATE time, and 570 functions
+-- sorted by name are not sorted by who calls whom. This is what lets them load
+-- in any order; every body is still compiled on first call, so a genuinely
+-- broken reference surfaces then rather than never. Session-scoped.
+SET check_function_bodies = false;
+
+
+
+-- \u2500\u2500 default privileges: reset \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- Cleared BEFORE anything is created, so every object below gets the ACL the
+-- dump describes rather than the image's defaults on top of it. Restored at
+-- the end of this file.
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
 
-DO $$
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+
+-- \u2500\u2500 function \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE FUNCTION public.plg_bank_emit_movement_imported() RETURNS trigger
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO 'public'
+    AS $$
+DECLARE
+  v_payload jsonb;
 BEGIN
-  IF to_regclass('public.bank_integrations') IS NOT NULL THEN
-    ALTER TABLE public.bank_integrations DROP COLUMN IF EXISTS api_token;
-    ALTER TABLE public.bank_integrations DROP COLUMN IF EXISTS cnpj;
+  IF NEW.external_source IS NULL OR NEW.external_id IS NULL THEN
+    RETURN NULL;
   END IF;
-END $$;
 
--- \xA72 \u2500\u2500 sync runs \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
--- bank_integration_sync_log already IS a SyncRun: one row per execution, with
--- status/fetched/written/error. It gains the four facts the shared vocabulary
--- has and it lacked, rather than being replaced by a second table beside it \u2014
--- two audit trails for one import is how "the history is wrong" starts.
---
--- The count columns keep their names. \`transactions_fetched\`/\`transactions_
--- imported\` map to SyncRun's \`fetched\`/\`written\` in the data provider, because
--- renaming them would break the deployed edge function's INSERT the moment this
--- migration lands, and a rename that has to be choreographed across two
--- repositories is not worth a nicer column name.
-DO $$
-BEGIN
-  IF to_regclass('public.bank_integration_sync_log') IS NULL THEN RETURN; END IF;
-
-  -- Which provider produced the run. One row per execution says nothing about
-  -- who ran it once a second bank connector shares the table.
-  ALTER TABLE public.bank_integration_sync_log
-    ADD COLUMN IF NOT EXISTS provider text NOT NULL DEFAULT 'plugbank';
-  -- Inbound: we reach the bank, never the other way round.
-  ALTER TABLE public.bank_integration_sync_log
-    ADD COLUMN IF NOT EXISTS direction text NOT NULL DEFAULT 'inbound';
-  -- \`trigger\` is a reserved word; the column is trigger_kind and the TypeScript
-  -- side reads it as SyncRun.trigger.
-  ALTER TABLE public.bank_integration_sync_log
-    ADD COLUMN IF NOT EXISTS trigger_kind text NOT NULL DEFAULT 'manual';
-  ALTER TABLE public.bank_integration_sync_log
-    ADD COLUMN IF NOT EXISTS started_at timestamptz;
-  ALTER TABLE public.bank_integration_sync_log
-    ADD COLUMN IF NOT EXISTS finished_at timestamptz;
-
-  COMMENT ON COLUMN public.bank_integration_sync_log.trigger_kind IS
-    'SyncRun.trigger \u2014 on-write | scheduled | manual | webhook. Named _kind because trigger is reserved.';
-END $$;
-
--- \xA73 \u2500\u2500 import \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
--- The one door the statement import passes through.
---
--- Today the edge function inserts into plg_financial_movements directly with
--- service_role, and takes \`integrationId\` from the request body without ever
--- comparing it to the caller \u2014 so any authenticated member of ANY tenant in the
--- pool can name another tenant's integration and write into that tenant's
--- ledger. A guard in the function would be a guard the next caller routes
--- around; the database is the only chokepoint that cannot be.
---
--- The tenant is taken from the INTEGRATION ROW, never from the payload, and a
--- caller presenting a user credential must be a member of it. A caller with no
--- auth.uid() is the server (service_role, a migration, the future tenant-scoped
--- token) and is exempt \u2014 the same exemption plg_emit_event makes, for the same
--- reason: it legitimately writes for any tenant. When FAY-1372 mints the
--- tenant-scoped credential, that exemption stops applying to connector code and
--- this function needs no change.
-CREATE OR REPLACE FUNCTION public.plugbank_import_movements(p_payload jsonb)
-RETURNS jsonb
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = public
-AS $fn$
+  -- The contract every consumer reads. Not the row: a whole-row payload would
+  -- put the ledger's internal bookkeeping inside every webhook by default.
+  v_payload := jsonb_build_object(
+    'movement_id',     NEW.id::text,
+    'provider',        NEW.external_source,
+    'external_id',     NEW.external_id,
+    'direction',       NEW.direction,
+    'amount',          NEW.amount,
+    'payment_date',    NEW.payment_date,
+    'description',     NEW.notes,
+    'bank_account_id', NEW.bank_account_id);
+
+  BEGIN
+    PERFORM public.plg_emit_event(
+      'financial.movement.imported', v_payload, 'financial_movement',
+      NEW.id::text, NEW.tenant_id, NULL);
+  EXCEPTION WHEN OTHERS THEN
+    -- Observability must never be able to reject the write that caused it.
+    RAISE WARNING '[plg_bank_emit_movement_imported] % on %: %', TG_OP, TG_TABLE_NAME, SQLERRM;
+  END;
+
+  RETURN NULL;
+END;
+$$;
+
+CREATE FUNCTION public.plugbank_import_movements(p_payload jsonb) RETURNS jsonb
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO 'public'
+    AS $$
 DECLARE
   v_tenants     uuid[];
   v_tenant      uuid;
-  v_integration uuid;
+  v_connection  uuid;
+  v_instance    text;
   v_account     uuid;
-  v_provider    text;
+  v_connector   text;
   v_trigger     text;
   v_from        date;
   v_to          date;
@@ -522,22 +523,28 @@ DECLARE
   v_inserted    uuid;
   v_run         uuid;
 BEGIN
-  v_integration := nullif(btrim(p_payload->>'integration_id'), '')::uuid;
-  IF v_integration IS NULL THEN
+  v_connection := nullif(btrim(p_payload->>'integration_id'), '')::uuid;
+  IF v_connection IS NULL THEN
     RAISE EXCEPTION 'plugbank_import_movements: integration_id is required'
       USING ERRCODE = 'invalid_parameter_value';
   END IF;
 
-  SELECT bi.tenant_id, bi.bank_account_id, bi.provider
-    INTO v_tenant, v_account, v_provider
-  FROM public.bank_integrations bi
-  WHERE bi.id = v_integration AND bi.active;
+  SELECT c.tenant_id, c.instance_key, c.connector_id
+    INTO v_tenant, v_instance, v_connector
+  FROM public.plg_connections c
+  WHERE c.id = v_connection AND c.active;
 
   IF v_tenant IS NULL THEN
-    RAISE EXCEPTION 'plugbank_import_movements: no active integration %', v_integration
+    RAISE EXCEPTION 'plugbank_import_movements: no active connection %', v_connection
       USING ERRCODE = 'no_data_found';
   END IF;
 
+  -- The account this connection is for. \`instance_key\` is text because it also
+  -- carries things that are not uuids for other connectors (a Bling company, a
+  -- gateway instance); here it is the bank account, and '' is the account-less
+  -- default that \`bank_account_id IS NULL\` used to mean.
+  v_account := nullif(btrim(v_instance), '')::uuid;
+
   -- SECURITY DEFINER bypasses RLS, so the membership check the policy would
   -- have made has to happen here.
   SELECT array_agg(t) INTO v_tenants FROM public.user_tenant_ids() AS t;
@@ -550,12 +557,18 @@ BEGIN
   -- another tenant must be told, not silently redirected into this one.
   IF nullif(btrim(p_payload->>'tenant_id'), '') IS NOT NULL
      AND (p_payload->>'tenant_id')::uuid IS DISTINCT FROM v_tenant THEN
-    RAISE EXCEPTION 'plugbank_import_movements: payload names another tenant; the tenant comes from the integration'
+    RAISE EXCEPTION 'plugbank_import_movements: payload names another tenant; the tenant comes from the connection'
       USING ERRCODE = 'insufficient_privilege';
   END IF;
 
-  IF nullif(btrim(p_payload->>'bank_account_id'), '') IS NOT NULL THEN
-    v_account := (p_payload->>'bank_account_id')::uuid;
+  -- Same rule as the tenant, one level down: the account is the connection's,
+  -- and a payload naming a different one is a caller importing into the wrong
+  -- ledger account. 002 let the payload override it silently \u2014 with one
+  -- connection per account that override is how two accounts get mixed.
+  IF nullif(btrim(p_payload->>'bank_account_id'), '') IS NOT NULL
+     AND (p_payload->>'bank_account_id')::uuid IS DISTINCT FROM v_account THEN
+    RAISE EXCEPTION 'plugbank_import_movements: payload names another bank account; the account comes from the connection'
+      USING ERRCODE = 'insufficient_privilege';
   END IF;
 
   v_from    := nullif(btrim(p_payload->>'period_from'), '')::date;
@@ -579,9 +592,6 @@ BEGIN
       CONTINUE;
     END IF;
 
-    -- Idempotency is the partial unique index from the financial plugin's
-    -- 007_reconciliation.sql, not a SELECT-then-INSERT: two runs of the same
-    -- window racing each other would both find nothing and both write.
     INSERT INTO public.plg_financial_movements (
       tenant_id, direction, movement_kind, amount, paid_amount, status,
       due_date, payment_date, bank_account_id, notes, external_id, external_source)
@@ -591,7 +601,7 @@ BEGIN
       'payment', v_amount, v_amount, 'paid',
       v_date, v_date, v_account,
       nullif(btrim(v_line->>'description'), ''),
-      v_external, coalesce(v_provider, 'plugbank'))
+      v_external, coalesce(v_connector, 'plugbank'))
     ON CONFLICT (tenant_id, external_source, external_id)
       WHERE external_id IS NOT NULL AND external_source IS NOT NULL
     DO NOTHING
@@ -605,17 +615,26 @@ BEGIN
     v_inserted := NULL;
   END LOOP;
 
-  UPDATE public.bank_integrations SET last_sync_at = now(), updated_at = now()
-  WHERE id = v_integration;
+  UPDATE public.plg_connections
+     SET last_sync_at = now(), status = 'connected', status_detail = NULL, updated_at = now()
+   WHERE id = v_connection;
 
-  INSERT INTO public.bank_integration_sync_log (
-    tenant_id, bank_integration_id, bank_account_id, period_from, period_to,
-    transactions_fetched, transactions_imported, duplicates, status,
-    triggered_by_user_id, provider, direction, trigger_kind, started_at, finished_at)
+  -- \`stats\` is where the three facts a manual statement import has and a generic
+  -- run does not go: the operator picked a period, a re-import of that period is
+  -- mostly duplicates by design, and someone pressed the button. The panel reads
+  -- all three back from here.
+  INSERT INTO public.plg_sync_runs (
+    tenant_id, connection_id, connector_id, direction, trigger_kind, status,
+    stream, fetched, written, stats, started_at, finished_at)
   VALUES (
-    v_tenant, v_integration, v_account, v_from, v_to,
-    v_fetched, v_imported, v_duplicates, 'success',
-    auth.uid(), coalesce(v_provider, 'plugbank'), 'inbound', v_trigger, v_started, now())
+    v_tenant, v_connection, coalesce(v_connector, 'plugbank'), 'inbound', v_trigger, 'success',
+    'statement', v_fetched, v_imported,
+    jsonb_strip_nulls(jsonb_build_object(
+      'duplicates',           v_duplicates,
+      'period_from',          v_from,
+      'period_to',            v_to,
+      'triggered_by_user_id', auth.uid())),
+    v_started, now())
   RETURNING id INTO v_run;
 
   RETURN jsonb_build_object(
@@ -625,154 +644,209 @@ BEGIN
     'imported', v_imported,
     'duplicates', v_duplicates);
 END;
-$fn$;
+$$;
 
-REVOKE ALL ON FUNCTION public.plugbank_import_movements(jsonb) FROM public, anon;
-GRANT EXECUTE ON FUNCTION public.plugbank_import_movements(jsonb) TO authenticated, service_role;
 
--- \xA74 \u2500\u2500 facts \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
--- One trigger on the ledger rather than an emit call inside the importer. The
--- RPC above, the edge function still inserting directly, a future scheduled
--- pull and a hand-run backfill all end up in the same row \u2014 so the fact exists
--- for all four without any of them having to remember to say so. That is the
--- entire reason plg_emit_event exists (packages/db/migrations/027_domain_events.sql).
---
--- It fires only when external_source is set, which is exactly what "imported"
--- means: a movement that came from outside. An app-native movement typed into
--- the cash register is not an import and must not wake a bank connector.
---
--- Provider-agnostic on purpose. \`provider\` is in the payload, so a second bank
--- connector importing into the same ledger produces the same fact instead of a
--- second vocabulary for the same event.
-CREATE OR REPLACE FUNCTION public.plg_bank_emit_movement_imported()
-RETURNS trigger
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = public
-AS $fn$
-DECLARE
-  v_payload jsonb;
-BEGIN
-  IF NEW.external_source IS NULL OR NEW.external_id IS NULL THEN
-    RETURN NULL;
-  END IF;
+-- \u2500\u2500 trigger \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
 
-  -- The contract every consumer reads. Not the row: a whole-row payload would
-  -- put the ledger's internal bookkeeping inside every webhook by default.
-  v_payload := jsonb_build_object(
-    'movement_id',     NEW.id::text,
-    'provider',        NEW.external_source,
-    'external_id',     NEW.external_id,
-    'direction',       NEW.direction,
-    'amount',          NEW.amount,
-    'payment_date',    NEW.payment_date,
-    'description',     NEW.notes,
-    'bank_account_id', NEW.bank_account_id);
+CREATE TRIGGER plg_financial_movements_emit_imported AFTER INSERT ON public.plg_financial_movements FOR EACH ROW EXECUTE FUNCTION public.plg_bank_emit_movement_imported();
 
-  BEGIN
-    PERFORM public.plg_emit_event(
-      'financial.movement.imported', v_payload, 'financial_movement',
-      NEW.id::text, NEW.tenant_id, NULL);
-  EXCEPTION WHEN OTHERS THEN
-    -- Observability must never be able to reject the write that caused it.
-    RAISE WARNING '[plg_bank_emit_movement_imported] % on %: %', TG_OP, TG_TABLE_NAME, SQLERRM;
-  END;
 
-  RETURN NULL;
-END;
-$fn$;
+-- \u2500\u2500 acl \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
 
-REVOKE ALL ON FUNCTION public.plg_bank_emit_movement_imported() FROM public, anon;
+REVOKE ALL ON FUNCTION public.plg_bank_emit_movement_imported() FROM PUBLIC;
+GRANT ALL ON FUNCTION public.plg_bank_emit_movement_imported() TO authenticated;
+GRANT ALL ON FUNCTION public.plg_bank_emit_movement_imported() TO service_role;
 
--- Guarded on the COLUMN, not just the table: the financial plugin owns both, and
--- attaching this to a ledger without 007_reconciliation.sql would make every
--- movement insert fail on an unknown field \u2014 an addon breaking its own host.
-DO $$
-BEGIN
-  IF EXISTS (
-    SELECT 1 FROM information_schema.columns
-    WHERE table_schema = 'public'
-      AND table_name = 'plg_financial_movements'
-      AND column_name = 'external_source'
-  ) THEN
-    DROP TRIGGER IF EXISTS plg_financial_movements_emit_imported ON public.plg_financial_movements;
-    CREATE TRIGGER plg_financial_movements_emit_imported
-      AFTER INSERT ON public.plg_financial_movements
-      FOR EACH ROW EXECUTE FUNCTION public.plg_bank_emit_movement_imported();
-  END IF;
-END $$;
+REVOKE ALL ON FUNCTION public.plugbank_import_movements(p_payload jsonb) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.plugbank_import_movements(p_payload jsonb) TO authenticated;
+GRANT ALL ON FUNCTION public.plugbank_import_movements(p_payload jsonb) TO service_role;
+
+
+-- \u2500\u2500 comment \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+COMMENT ON FUNCTION public.plugbank_import_movements(p_payload jsonb) IS 'Import bank-statement lines into the financial ledger and file the run in plg_sync_runs. The tenant AND the bank account come from the plg_connections row named by integration_id, never from the payload.';
+
+
+-- \u2500\u2500 default privileges: restore \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- Put back, so the NEXT thing installed inherits what the chain had.
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT MAINTAIN ON TABLES TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT MAINTAIN ON TABLES TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$--
+-- PostgreSQL database dump complete
+--$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$--
+-- PostgreSQL database dump complete
+--$stmt$;
+END $dp$;
 `;
-var MIGRATION_003_ONTO_CONNECTIONS = `-- ============================================================================
--- plugin-banking-br 003 \u2014 PlugBank stops owning tables.
---
--- Retires public.bank_integrations and public.bank_integration_sync_log. The
--- connection is now a row of public.plg_connections and each import is a row of
--- public.plg_sync_runs (packages/db 029). See FAY-1376.
+var MIGRATION_001_THE_IMPORT_RPC_NAMES_REAL_TABLES = `-- ==========================================================================
+-- 001_the_import_rpc_names_real_tables \u2014 plugbank_import_movements
+-- stops reaching through 141's bridge (#352).
 --
--- This connector is the one that tests the shape, because it is the only one
--- whose key was never (tenant, provider): 001 keyed on
--- UNIQUE (tenant_id, bank_account_id, provider), and the provider filtered by
--- bank_account_id. Two accounts of one clinic are two connections, and they must
--- stay two. That is exactly what \`instance_key\` is:
+-- 107 renamed the connector spine out of the \`plg_\` prefix \u2014 the prefix means
+-- "a plugin owns this", and the connector framework's tables are the BASE's.
+-- 141 left \`plg_connections\` and \`plg_sync_runs\` answering as views so callers
+-- could move without a synchronised deploy. This function never moved, and it
+-- is not alone: \`plg_connections\` had 13 callers and \`connections\` had none.
+-- The bridge became the road.
 --
---   bank_integrations.bank_account_id  \u2192 plg_connections.instance_key
---                                        (the account uuid as text; '' is the
---                                         account-less default the panel uses,
---                                         which is what \`bank_account_id IS NULL\`
---                                         meant before)
---   bank_integrations.provider         \u2192 plg_connections.connector_id
---   bank_integrations.environment      \u2192 plg_connections.settings->>'environment'
---   bank_integrations.active           \u2192 plg_connections.active
---   bank_integrations.last_sync_at     \u2192 plg_connections.last_sync_at
---   UNIQUE (tenant_id, bank_account_id, provider)
---                                      \u2192 UNIQUE (tenant_id, connector_id, instance_key)
+-- The body is 000_baseline's, unchanged except for the three names. It is not
+-- an edit of that file \u2014 an applied migration is immutable and the ledger
+-- treats drift as a hard stop \u2014 it is a CREATE OR REPLACE that lands after it.
 --
--- And the run, column by column \u2014 nothing the panel renders is lost:
---   sync_log.bank_integration_id       \u2192 plg_sync_runs.connection_id
---   sync_log.transactions_fetched      \u2192 plg_sync_runs.fetched
---   sync_log.transactions_imported     \u2192 plg_sync_runs.written
---   sync_log.duplicates                \u2192 plg_sync_runs.stats->>'duplicates'
---   sync_log.period_from / _to         \u2192 plg_sync_runs.stats->>'period_from' / '_to'
---   sync_log.triggered_by_user_id      \u2192 plg_sync_runs.stats->>'triggered_by_user_id'
---   sync_log.error_message             \u2192 plg_sync_runs.error
---   sync_log.bank_account_id           \u2192 dropped: it is the connection's
---                                        instance_key, and a second copy is a
---                                        second thing to disagree
---   sync_log.provider                  \u2192 plg_sync_runs.connector_id
---   sync_log.created_at                \u2192 plg_sync_runs.started_at
---   direction / trigger_kind / status / started_at / finished_at \u2192 same names
+-- Why this plugin has to carry its own: the function is banking-br's, and the
+-- views it stops using are the spine's. The spine runs FIRST, so a spine file
+-- cannot drop a view that a plugin applied later still reads. Each package
+-- moves its own callers; the aliases go once nobody is left.
 --
--- The count columns finally get the contract's names. 002 \xA72 kept
--- transactions_fetched/_imported because renaming them would have broken the
--- deployed edge function's INSERT \u2014 but the function no longer inserts into a
--- log at all: it calls plugbank_import_movements, which is the only writer, and
--- the run is filed here. The choreography 002 was avoiding does not exist.
---
--- Nothing is in production, so this is a drop and not a data migration.
--- ============================================================================
+-- Replay-safe: CREATE OR REPLACE, same signature, same grants (which 000 set
+-- and this does not touch).
+-- ==========================================================================
 
--- \xA71 \u2500\u2500 the door, re-pointed \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
--- Same name, same payload, same guarantees. \`integration_id\` keeps its key on
--- the wire so the deployed plugbank-sync function needs no coordinated release;
--- what changed is that the uuid it carries now names a plg_connections row.
---
--- Everything 002 \xA73 established still holds and for the same reasons: the tenant
--- comes from the CONNECTION ROW and never from the payload, a caller presenting
--- a user credential must be a member of it, a caller with no auth.uid() is the
--- server and is exempt, and idempotency is the partial unique index rather than
--- a SELECT-then-INSERT that two racing runs would both pass.
---
--- One thing is new and is the point of the migration: the run is filed against
--- \`connection_id\`, so a tenant with two bank accounts gets two histories instead
--- of one interleaved list. plg_sync_runs carries no INSERT grant for
--- \`authenticated\` \u2014 this SECURITY DEFINER function is the server-side writer the
--- table's grants assume.
-CREATE OR REPLACE FUNCTION public.plugbank_import_movements(p_payload jsonb)
-RETURNS jsonb
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = public
-AS $fn$
+CREATE OR REPLACE FUNCTION public.plugbank_import_movements(p_payload jsonb) RETURNS jsonb
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO 'public'
+    AS $$
 DECLARE
   v_tenants     uuid[];
   v_tenant      uuid;
@@ -802,7 +876,7 @@ BEGIN
 
   SELECT c.tenant_id, c.instance_key, c.connector_id
     INTO v_tenant, v_instance, v_connector
-  FROM public.plg_connections c
+  FROM public.connections c
   WHERE c.id = v_connection AND c.active;
 
   IF v_tenant IS NULL THEN
@@ -886,7 +960,7 @@ BEGIN
     v_inserted := NULL;
   END LOOP;
 
-  UPDATE public.plg_connections
+  UPDATE public.connections
      SET last_sync_at = now(), status = 'connected', status_detail = NULL, updated_at = now()
    WHERE id = v_connection;
 
@@ -894,7 +968,7 @@ BEGIN
   -- run does not go: the operator picked a period, a re-import of that period is
   -- mostly duplicates by design, and someone pressed the button. The panel reads
   -- all three back from here.
-  INSERT INTO public.plg_sync_runs (
+  INSERT INTO public.sync_runs (
     tenant_id, connection_id, connector_id, direction, trigger_kind, status,
     stream, fetched, written, stats, started_at, finished_at)
   VALUES (
@@ -915,22 +989,14 @@ BEGIN
     'imported', v_imported,
     'duplicates', v_duplicates);
 END;
-$fn$;
-
-REVOKE ALL ON FUNCTION public.plugbank_import_movements(jsonb) FROM public, anon;
-GRANT EXECUTE ON FUNCTION public.plugbank_import_movements(jsonb) TO authenticated, service_role;
-
-COMMENT ON FUNCTION public.plugbank_import_movements(jsonb) IS
-  'Import bank-statement lines into the financial ledger and file the run in '
-  'plg_sync_runs. The tenant AND the bank account come from the plg_connections '
-  'row named by integration_id, never from the payload.';
-
--- \xA72 \u2500\u2500 the bespoke tables go \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
--- After the function above, so a pool is never left with the old door pointing
--- at a table that no longer exists.
-DROP TABLE IF EXISTS public.bank_integration_sync_log CASCADE;
-DROP TABLE IF EXISTS public.bank_integrations CASCADE;
+$$;
+COMMENT ON FUNCTION public.plugbank_import_movements(p_payload jsonb) IS
+  'Import bank-statement lines into the financial ledger and file the run in public.sync_runs. The tenant AND the bank account come from the public.connections row named by integration_id, never from the payload.';
 `;
+var MIGRATIONS = [
+  { id: "000_baseline", sql: MIGRATION_000_BASELINE },
+  { id: "001_the_import_rpc_names_real_tables", sql: MIGRATION_001_THE_IMPORT_RPC_NAMES_REAL_TABLES }
+];
 
 // src/index.ts
 function createOpenBankingPlugin() {
@@ -987,27 +1053,22 @@ function createOpenBankingPlugin() {
     // This plugin creates no table. 003 retired the two it had; what is left is
     // the RPC that is the import's one door, and the trigger that turns an
     // imported movement into a fact. The connection and its run history are rows
-    // of plg_connections / plg_sync_runs, owned by packages/db.
-    migrations: [
-      {
-        id: "openbanking-002_credential_and_facts",
-        version: "0.9.1",
-        sql: MIGRATION_002_CREDENTIAL_AND_FACTS,
-        description: "Drop bank_integrations.api_token/cnpj (destination: the Fayz platform credential store, FAY-1360 \u2014 register there BEFORE applying this), add plugbank_import_movements and the financial.movement.imported trigger"
-      },
-      {
-        id: "openbanking-003_onto_connections",
-        version: "1.0.0",
-        sql: MIGRATION_003_ONTO_CONNECTIONS,
-        description: "Retire bank_integrations + bank_integration_sync_log \u2014 the connection is a plg_connections row keyed by instance_key (the bank account) and each import a plg_sync_runs row; plugbank_import_movements re-pointed at both"
-      }
-    ],
+    // of connections / sync_runs, owned by packages/db.
+    // One baseline per unit since #338 — read from the generated barrel
+    // rather than listed here, so regenerating the SQL never needs a
+    // manifest edit to match.
+    migrations: MIGRATIONS.map((entry) => ({
+      id: `openbanking-${entry.id}`,
+      version: "1.0.0",
+      sql: entry.sql,
+      description: "The whole schema this plugin provisions, as one file: every table, view, function, policy and grant, plus the reference rows it seeds. Replaced the per-change chain in the 1.0.0 squash (#338); the files it collapsed are kept, unapplied, in src/migrations.archive/."
+    })),
     diagnostics: [
       {
         id: "openbanking-ledger-ready",
         description: "The import writes into the financial ledger and needs its reconciliation columns (plugin-financial 007), the generic connection tables (packages/db 029) and the row-level event emitter.",
         requires: {
-          tables: ["plg_connections", "plg_sync_runs", "plg_financial_movements"],
+          tables: ["connections", "sync_runs", "plg_financial_movements"],
           rpcs: ["plugbank_import_movements", "plg_emit_event"]
         },
         level: "error"