@fayz-ai/plugin-banking-br 0.9.1 → 0.10.1

package/dist/index.js

@@ -1,62 +1,81 @@
 import { useState, useEffect } from 'react';
-import { Download, Loader2, History, CheckCircle2, AlertCircle } from 'lucide-react';
+import { Download, Loader2 } from 'lucide-react';
 import { DatePicker, Button, toast } from '@fayz-ai/ui';
-import { getActiveTenantId, getSupabaseClientOptional } from '@fayz-ai/core';
+import { connectionStatus, createConnectionStore, getSupabaseClientOptional } from '@fayz-ai/core';
 import { jsxs, jsx, Fragment } from 'react/jsx-runtime';
-import { pgTable, timestamps, timestamp, boolean, text, uuid, tenantId, createdAt, integer, date } from '@fayz-ai/db';
 
 // src/connectors/connectorDef.tsx
 var FUNCTION = "plugbank-sync";
+var PLUGBANK_CONNECTOR_ID = "plugbank";
+var SETTINGS_KEYS = ["environment"];
+function storeFor(bankAccountId) {
+  return createConnectionStore(PLUGBANK_CONNECTOR_ID, {
+    settingsKeys: SETTINGS_KEYS,
+    instanceKey: bankAccountId ?? ""
+  });
+}
 function sb() {
   const supabase = getSupabaseClientOptional();
   if (!supabase) throw new Error("Supabase not initialized");
   return supabase;
 }
-function rowToIntegration(r) {
+function toIntegration(connection) {
+  return {
+    id: connection.id ?? "",
+    provider: connection.connectorId,
+    // Back to `undefined` for the default account, so callers that pass this
+    // value straight back into getIntegration() address the same row.
+    bankAccountId: connection.instanceKey || void 0,
+    environment: connection.settings?.environment ?? "production",
+    active: connection.active,
+    lastSyncAt: connection.lastSyncAt ?? void 0
+  };
+}
+function toSyncRun(run) {
+  const stats = run.stats ?? {};
   return {
-    id: r.id,
-    provider: r.provider,
-    bankAccountId: r.bank_account_id ?? void 0,
-    apiToken: r.api_token ?? void 0,
-    cnpj: r.cnpj ?? void 0,
-    environment: r.environment ?? "production",
-    active: r.active ?? true,
-    lastSyncAt: r.last_sync_at ?? void 0
+    ...run,
+    id: run.id,
+    connectionId: run.connectionId,
+    connectorId: run.connectorId,
+    direction: run.direction,
+    triggerKind: run.triggerKind,
+    status: run.status,
+    fetched: run.fetched ?? 0,
+    written: run.written ?? 0,
+    error: run.error ?? void 0,
+    startedAt: run.startedAt,
+    finishedAt: run.finishedAt ?? void 0,
+    periodFrom: stats.period_from ?? void 0,
+    periodTo: stats.period_to ?? void 0,
+    duplicates: Number(stats.duplicates ?? 0),
+    // plg_sync_runs has no created_at: a run is identified by when it STARTED,
+    // which is what the old created_at recorded anyway (the row was inserted at
+    // the end, so the two disagreed by the length of the import).
+    createdAt: run.startedAt ?? ""
   };
 }
 function createOpenBankingProvider() {
   return {
     async getIntegration(bankAccountId) {
-      const supabase = sb();
-      let qb = supabase.from("bank_integrations").select("*").eq("provider", "plugbank");
-      qb = bankAccountId ? qb.eq("bank_account_id", bankAccountId) : qb.is("bank_account_id", null);
-      const { data } = await qb.limit(1).maybeSingle();
-      return data ? rowToIntegration(data) : null;
+      const connection = await storeFor(bankAccountId).get();
+      return connection ? toIntegration(connection) : null;
     },
     async saveIntegration(input) {
-      const supabase = sb();
-      const tenantId2 = getActiveTenantId();
-      const row = {
-        tenant_id: tenantId2,
-        provider: "plugbank",
-        bank_account_id: input.bankAccountId ?? null,
-        api_token: input.apiToken,
-        cnpj: input.cnpj,
-        environment: input.environment ?? "production",
-        active: true,
-        updated_at: (/* @__PURE__ */ new Date()).toISOString()
-      };
-      const { data, error } = await supabase.from("bank_integrations").upsert(input.id ? { id: input.id, ...row } : row, { onConflict: "tenant_id,bank_account_id,provider" }).select().single();
-      if (error) throw error;
-      return rowToIntegration(data);
-    },
-    async testConnection(input) {
-      const supabase = sb();
-      const { data, error } = await supabase.functions.invoke(FUNCTION, {
-        body: { action: "test_connection", apiToken: input.apiToken, cnpj: input.cnpj, environment: input.environment ?? "production" }
+      const saved = await storeFor(input?.bankAccountId).save({
+        settings: { environment: input?.environment ?? "production" },
+        active: true
       });
-      if (error) return { ok: false, message: error.message };
-      return data;
+      return toIntegration(saved);
+    },
+    /**
+     * Scoped to ONE account, where the old provider deleted every plugbank row
+     * of the tenant. That breadth was invisible while the panel only ever drove
+     * the default account; with two accounts it means disconnecting Itaú also
+     * silently kills Banco do Brasil. The narrow verb is the correct one.
+     */
+    async disconnect(bankAccountId) {
+      await storeFor(bankAccountId).disconnect();
     },
     async fetchStatement(input) {
       const supabase = sb();
@@ -71,6 +90,10 @@ function createOpenBankingProvider() {
       const { data, error } = await supabase.functions.invoke(FUNCTION, {
         body: {
           action: "import_transactions",
+          // Still `integrationId` on the wire: it now carries a plg_connections
+          // id, and keeping the key means the deployed function needs no
+          // coordinated release. The RPC takes the tenant AND the bank account
+          // from that row, so neither can be steered from here.
           integrationId: input.integrationId,
           bankAccountId: input.bankAccountId,
           from: input.from,
@@ -81,24 +104,24 @@ function createOpenBankingProvider() {
       if (error) throw new Error(error.message);
       return data;
     },
-    async getSyncLog(integrationId) {
-      const supabase = sb();
-      const { data } = await supabase.from("bank_integration_sync_log").select("*").eq("bank_integration_id", integrationId).order("created_at", { ascending: false }).limit(20);
-      return (data ?? []).map((r) => ({
-        id: r.id,
-        periodFrom: r.period_from ?? void 0,
-        periodTo: r.period_to ?? void 0,
-        transactionsFetched: r.transactions_fetched ?? 0,
-        transactionsImported: r.transactions_imported ?? 0,
-        duplicates: r.duplicates ?? 0,
-        status: r.status,
-        errorMessage: r.error_message ?? void 0,
-        createdAt: r.created_at
-      }));
+    async getSyncRuns(bankAccountId) {
+      const runs = await storeFor(bankAccountId).listRuns({ limit: 20 });
+      return runs.map(toSyncRun);
     }
   };
 }
 var provider = createOpenBankingProvider();
+function day(value) {
+  return typeof value === "string" && value.length >= 10 ? value.slice(8, 10) + "/" + value.slice(5, 7) : void 0;
+}
+function statementLine(run) {
+  const from = day(run.stats?.period_from);
+  const to = day(run.stats?.period_to);
+  const duplicates = Number(run.stats?.duplicates ?? 0);
+  if (!from || !to) return void 0;
+  const imported = `${run.written ?? 0} importadas de ${from} a ${to}`;
+  return duplicates > 0 ? `${imported} \xB7 ${duplicates} j\xE1 estavam aqui` : imported;
+}
 function brl(n) {
   try {
     return new Intl.NumberFormat("pt-BR", { style: "currency", currency: "BRL" }).format(n);
@@ -106,7 +129,7 @@ function brl(n) {
     return `R$ ${n.toFixed(2)}`;
   }
 }
-function OpenBankingExtraPanel() {
+function OpenBankingImport({ onRan }) {
   const [integration, setIntegration] = useState(null);
   const [loaded, setLoaded] = useState(false);
   const [from, setFrom] = useState(() => {
@@ -119,17 +142,14 @@ function OpenBankingExtraPanel() {
   const [selected, setSelected] = useState(/* @__PURE__ */ new Set());
   const [fetching, setFetching] = useState(false);
   const [importing, setImporting] = useState(false);
-  const [log, setLog] = useState([]);
   async function load() {
-    const found = await provider.getIntegration();
-    setIntegration(found);
-    if (found) void provider.getSyncLog(found.id).then(setLog);
+    setIntegration(await provider.getIntegration().catch(() => null));
     setLoaded(true);
   }
   useEffect(() => {
     void load();
   }, []);
-  if (!loaded || !integration) return null;
+  if (!loaded || !integration?.active) return null;
   async function handleFetch() {
     if (!integration) return;
     setFetching(true);
@@ -152,11 +172,17 @@ function OpenBankingExtraPanel() {
     }
     setImporting(true);
     try {
-      const res = await provider.importTransactions({ integrationId: integration.id, from, to, lines: toImport });
+      const res = await provider.importTransactions({
+        integrationId: integration.id,
+        bankAccountId: integration.bankAccountId,
+        from,
+        to,
+        lines: toImport
+      });
       toast.success(`${res.imported} importadas${res.duplicates ? ` \xB7 ${res.duplicates} duplicadas` : ""}`);
       setLines([]);
       setSelected(/* @__PURE__ */ new Set());
-      void provider.getSyncLog(integration.id).then(setLog);
+      onRan?.();
     } catch (e) {
       toast.error(e?.message ?? "Erro ao importar");
     } finally {
@@ -170,7 +196,7 @@ function OpenBankingExtraPanel() {
       return next;
     });
   }
-  return /* @__PURE__ */ jsxs("div", { className: "space-y-4 border-t pt-4", children: [
+  return /* @__PURE__ */ jsxs("div", { className: "space-y-4", children: [
     /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-2", children: [
       /* @__PURE__ */ jsx(Download, { className: "h-4 w-4 text-muted-foreground" }),
       /* @__PURE__ */ jsx("h4", { className: "text-sm font-semibold", children: "Importar extrato" })
@@ -212,81 +238,699 @@ function OpenBankingExtraPanel() {
         ] })
       ] })
     ] }),
-    log.length > 0 && /* @__PURE__ */ jsxs("div", { className: "space-y-2", children: [
-      /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-2", children: [
-        /* @__PURE__ */ jsx(History, { className: "h-4 w-4 text-muted-foreground" }),
-        /* @__PURE__ */ jsx("h4", { className: "text-sm font-semibold", children: "Hist\xF3rico" })
-      ] }),
-      /* @__PURE__ */ jsx("div", { className: "rounded-md border divide-y text-sm", children: log.map((r) => /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-3 px-3 py-2", children: [
-        /* @__PURE__ */ jsx("span", { className: "text-muted-foreground text-xs", children: new Date(r.createdAt).toLocaleString("pt-BR") }),
-        /* @__PURE__ */ jsxs("span", { className: "text-xs text-muted-foreground", children: [
-          r.periodFrom,
-          " \u2192 ",
-          r.periodTo
-        ] }),
-        /* @__PURE__ */ jsxs("span", { className: "ml-auto text-xs", children: [
-          r.transactionsImported,
-          "/",
-          r.transactionsFetched,
-          " importadas",
-          r.duplicates ? ` \xB7 ${r.duplicates} dup` : ""
-        ] }),
-        r.status === "success" ? /* @__PURE__ */ jsx(CheckCircle2, { className: "h-3.5 w-3.5 text-success" }) : /* @__PURE__ */ jsx(AlertCircle, { className: "h-3.5 w-3.5 text-warning" })
-      ] }, r.id)) })
-    ] })
+    /* @__PURE__ */ jsx("p", { className: "text-[11px] text-muted-foreground", children: "O token do PlugBank e o CNPJ da conta ficam guardados na plataforma Fayz, n\xE3o neste aplicativo. Quem importa o extrato \xE9 o servidor, que pede as credenciais na hora da consulta." })
   ] });
 }
 var openBankingConnector = {
   id: "plugbank",
+  // The product is PlugBank, the company in the directory is TecnoSpeed. Same
+  // row, two names — and until this said so, the connector took neither the
+  // catalogue's copy nor its mark.
+  catalogSlug: "tecnospeed",
   hostPluginId: "financial",
   name: "Open Banking \xB7 Tecnospeed PlugBank",
   description: "Importe o extrato banc\xE1rio e concilie em Financeiro \u2192 Concilia\xE7\xE3o.",
   icon: "Landmark",
   authKind: "api-key",
-  fields: [
-    { key: "cnpj", label: "CNPJ", type: "text", placeholder: "00.000.000/0001-00" },
-    { key: "apiToken", label: "Token API PlugBank", type: "password", placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" }
+  // `banking`, not `payments`: reading a statement is not taking a payment, and
+  // the platform catalogue files the provider (slug `tecnospeed`) under banking.
+  category: "banking",
+  // Inbound because WE reach the bank: PlugBank has never heard of Fayz, which
+  // is what makes this the canonical pull connector and why it ships an edge
+  // function at all.
+  direction: "inbound",
+  // Sync only. The statement has to exist INSIDE Fayz to be listed, filtered and
+  // matched against internal movements — reconciliation is not a question the
+  // assistant can answer by asking the bank at the moment it is asked.
+  planes: ["sync"],
+  docsUrl: "https://tecnospeed.com.br/plugbank/",
+  // Write and NOT read, which is unusual enough to be worth saying out loud:
+  // `plugbank_import_movements` (migrations/003) only ever INSERTs, with
+  // `ON CONFLICT (tenant_id, external_source, external_id) DO NOTHING`. It never
+  // SELECTs a movement, so declaring `read` here would be an access the code does
+  // not take — and the whole value of this list is that it is not padded.
+  //
+  // The `emit` is the second half, and it is the one a tenant would not guess:
+  // every imported line fires `financial.movement.imported` through the trigger
+  // in migrations/002, and that payload carries amount, date, description and
+  // bank account to whatever automation is listening. Importing a statement is
+  // therefore also publishing it internally.
+  permissions: [
+    {
+      kind: "data",
+      resource: "movement",
+      actions: ["write"],
+      reason: "Gravar no seu financeiro as linhas do extrato banc\xE1rio \u2014 valor, data, descri\xE7\xE3o e conta. Lan\xE7amentos j\xE1 importados n\xE3o entram de novo.",
+      sensitive: true
+    },
+    {
+      kind: "event",
+      resource: "financial.movement.imported",
+      actions: ["emit"],
+      reason: "Avisar o app a cada lan\xE7amento importado, para que suas automa\xE7\xF5es de concilia\xE7\xE3o possam reagir. O aviso leva valor, data e conta.",
+      sensitive: true
+    }
   ],
-  async getStatus() {
-    const found = await provider.getIntegration();
-    return { connected: !!found?.apiToken };
+  invokedAt: [
+    {
+      key: "financial.statement.import",
+      label: "Voc\xEA escolhe um per\xEDodo aqui e o extrato do banco \xE9 importado",
+      plane: "sync",
+      trigger: "manual",
+      touches: ["movement", "financial.movement.imported"]
+    }
+  ],
+  // No credential field. The token and the CNPJ that identify the account are
+  // registered in the Fayz platform; anything typed here would be stored in a
+  // table every member of the tenant can read.
+  //
+  // `subscribesTo` is deliberately absent, and so is `managedAutomations`.
+  // Nothing that happens inside Fayz should wake this connector: it pulls a
+  // statement, and what makes it pull is the operator picking a period below or
+  // the Fayz SCHEDULE worker (FAY-1347) — never a domain fact. A subscription
+  // written to fill the field would put this connector on the ingress's
+  // delivery list for events it has no reaction to.
+  //
+  // The reconciliation automations ("avise quando entrar um valor acima de X")
+  // are real, but they are the TENANT's: they react to
+  // `financial.movement.imported` and the tenant may delete them without the
+  // connection becoming half-wired. `managedAutomations` is for the wiring the
+  // integration IS, and this integration is the import itself.
+  // Read from the row the list already batched — one request for N connectors.
+  // The account-less default instance (`''`) is the one the panel addresses.
+  ...connectionStatus(PLUGBANK_CONNECTOR_ID, (connection) => {
+    const found = connection ? toIntegration(connection) : null;
+    return { connected: !!found?.active, detail: found?.environment, plane: "sync" };
+  }),
+  // `testConnection` is deleted rather than stubbed: the credential is not in
+  // this app, so there is nothing this side can validate, and ConnectorDetail
+  // renders the button only when the verb exists.
+  saveConnection: async () => {
+    await provider.saveIntegration();
   },
-  testConnection: (values) => provider.testConnection({ apiToken: values.apiToken, cnpj: values.cnpj }),
-  saveConnection: async (values) => {
-    await provider.saveIntegration({ apiToken: values.apiToken, cnpj: values.cnpj });
+  disconnect: () => provider.disconnect(),
+  // Every import files a `plg_sync_runs` row, and the shared surface renders it.
+  // What is connector-specific is not the VIEW, it is the meaning of `stats`:
+  // "de 01/08 a 12/08 · 3 duplicadas" is three keys only this connector can
+  // read, turned here into the one sentence every run carries. Scoped to the
+  // default instance — the account this panel addresses.
+  async listRuns(options) {
+    try {
+      const runs = await createConnectionStore(PLUGBANK_CONNECTOR_ID).listRuns(options);
+      return runs.map((run) => ({ ...run, message: run.message ?? statementLine(run) }));
+    } catch {
+      return [];
+    }
   },
-  ExtraPanel: OpenBankingExtraPanel
+  RunActions: OpenBankingImport
 };
-var bankIntegrations = pgTable("bank_integrations", {
-  id: uuid("id").primaryKey().defaultRandom(),
-  tenantId: tenantId(),
-  provider: text("provider").notNull().default("plugbank"),
-  bankAccountId: uuid("bank_account_id"),
-  // Tecnospeed PlugBank credentials
-  apiToken: text("api_token"),
-  cnpj: text("cnpj"),
-  environment: text("environment").notNull().default("production"),
-  // production | sandbox
-  active: boolean("active").notNull().default(true),
-  lastSyncAt: timestamp("last_sync_at", { withTimezone: true }),
-  ...timestamps
-});
-var bankIntegrationSyncLog = pgTable("bank_integration_sync_log", {
-  id: uuid("id").primaryKey().defaultRandom(),
-  tenantId: tenantId(),
-  bankIntegrationId: uuid("bank_integration_id").notNull().references(() => bankIntegrations.id, { onDelete: "cascade" }),
-  bankAccountId: uuid("bank_account_id"),
-  periodFrom: date("period_from"),
-  periodTo: date("period_to"),
-  transactionsFetched: integer("transactions_fetched").notNull().default(0),
-  transactionsImported: integer("transactions_imported").notNull().default(0),
-  duplicates: integer("duplicates").notNull().default(0),
-  status: text("status").notNull().default("success"),
-  // success | partial | error
-  errorMessage: text("error_message"),
-  triggeredByUserId: uuid("triggered_by_user_id"),
-  ...createdAt
-});
+
+// src/lib/banking-events.ts
+var MOVEMENT_IMPORTED_FIELDS = [
+  { name: "movement_id", label: "ID do lan\xE7amento", type: "id", example: "8f14e45f-\u2026" },
+  { name: "provider", label: "Origem", type: "string", example: "plugbank" },
+  { name: "external_id", label: "Identificador no banco", type: "string", example: "LINE-1" },
+  { name: "direction", label: "Tipo", type: "string", example: "credit" },
+  { name: "amount", label: "Valor", type: "money", example: "R$ 150,00" },
+  { name: "payment_date", label: "Data", type: "date", example: "03/08/2026" },
+  { name: "description", label: "Descri\xE7\xE3o", type: "string", example: "Recebimento PIX" },
+  { name: "bank_account_id", label: "Conta banc\xE1ria", type: "id", example: "3f2a91c4-\u2026" }
+];
+var PAYLOAD_SCHEMA = {
+  type: "object",
+  properties: {
+    movement_id: { type: "string", format: "uuid", description: "Movement id in the tenant ledger" },
+    provider: {
+      type: "string",
+      description: "Which integration imported the line \u2014 'plugbank' today. Reads from plg_financial_movements.external_source, so a second bank connector produces the same fact."
+    },
+    external_id: {
+      type: "string",
+      description: "The bank's own id for the statement line. With `provider` it is the import idempotency key."
+    },
+    direction: { type: "string", enum: ["credit", "debit"], description: "Money in or money out" },
+    amount: { type: "number", description: "Always positive; `direction` carries the sign" },
+    payment_date: { type: "string", format: "date", description: "Date the bank settled the line (YYYY-MM-DD)" },
+    description: { type: ["string", "null"], description: "Statement narrative, as the bank wrote it" },
+    bank_account_id: { type: ["string", "null"], format: "uuid", description: "Account the line landed in, when known" }
+  },
+  required: ["movement_id", "provider", "external_id", "direction", "amount", "payment_date"],
+  additionalProperties: false
+};
+function buildBankingDomainEvents() {
+  return [
+    {
+      name: "financial.movement.imported",
+      title: "Lan\xE7amento banc\xE1rio importado",
+      description: "Uma linha do extrato entrou no financeiro",
+      trigger: "Quando o extrato \xE9 importado \u2014 pelo painel, pelo conector ou por uma carga manual",
+      icon: "Landmark",
+      audit: true,
+      fields: MOVEMENT_IMPORTED_FIELDS,
+      payloadSchema: PAYLOAD_SCHEMA
+    }
+  ];
+}
+
+// src/migrations/index.ts
+var MIGRATION_002_CREDENTIAL_AND_FACTS = `-- ============================================================================
+-- plugin-banking-br 002: the credential leaves the tenant database, the import
+-- gets a door it cannot be routed around, and the import becomes a FACT.
+--
+--   \xA71  credential  drop api_token + cnpj from public.bank_integrations
+--   \xA72  sync runs   bank_integration_sync_log speaks the SyncRun vocabulary
+--   \xA73  import      plugbank_import_movements \u2014 the tenant-safe door
+--   \xA74  facts       financial.movement.imported
+--
+-- Additive and idempotent: no table is created, no policy is rewritten, and the
+-- tenant RLS from 001 already covers every column added here.
+-- ============================================================================
+
+-- \xA71 \u2500\u2500 credential \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- THE EXPOSURE THIS CLOSES: 001 stored \`api_token text\` and \`cnpj text\` on
+-- public.bank_integrations. That table is read from the browser with the
+-- publishable key under tenant RLS, so the bank credential was readable by ANY
+-- authenticated member of the tenant; and a pool is one Supabase project serving
+-- N tenants (beauty-saas and espaco-renova-rio share one), so anything running
+-- there with service_role could read every clinic's bank token at once.
+--
+-- PlugBank differs from RankLayer, which dropped its key with nothing to replace
+-- it: PlugBank is a PULL connector and genuinely needs a credential at fetch
+-- time. It just must not be THIS copy. The destination is the platform's
+-- encrypted ConnectorConnection store, redeemed per call (FAY-1360 + FAY-1389).
+-- NEITHER HAS HAPPENED YET: as of 2026-08-12 the live pool still holds the
+-- token in this column, this migration is unapplied there, and the deployed
+-- plugbank-sync (v6) still reads it. The FAY-1360 rollout must register the
+-- credential at the platform BEFORE this drop runs on that pool \u2014 otherwise
+-- what is removed here is the only copy, and the connection dies.
+--
+-- \`cnpj\` goes with it rather than surviving as a masked remnant. It is not
+-- decoration: paired with the token it is what identifies the account at the
+-- provider (\`/v1/extrato?cnpj=\u2026\`), which makes it half of the credential and
+-- therefore the platform's to hold. And nothing on this side reads it \u2014 the
+-- live connector panel never renders it, and the unified connect form starts
+-- every field empty rather than pre-filling from the row. A masked last-N would
+-- be a column added to serve a screen that does not exist, on data that
+-- identifies a real company.
+--
+-- ROTATE any token a pool already stored. DROP COLUMN is a catalog change: the
+-- old values stay in the heap until the next table rewrite.
+
+DO $$
+BEGIN
+  IF to_regclass('public.bank_integrations') IS NOT NULL THEN
+    ALTER TABLE public.bank_integrations DROP COLUMN IF EXISTS api_token;
+    ALTER TABLE public.bank_integrations DROP COLUMN IF EXISTS cnpj;
+  END IF;
+END $$;
+
+-- \xA72 \u2500\u2500 sync runs \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- bank_integration_sync_log already IS a SyncRun: one row per execution, with
+-- status/fetched/written/error. It gains the four facts the shared vocabulary
+-- has and it lacked, rather than being replaced by a second table beside it \u2014
+-- two audit trails for one import is how "the history is wrong" starts.
+--
+-- The count columns keep their names. \`transactions_fetched\`/\`transactions_
+-- imported\` map to SyncRun's \`fetched\`/\`written\` in the data provider, because
+-- renaming them would break the deployed edge function's INSERT the moment this
+-- migration lands, and a rename that has to be choreographed across two
+-- repositories is not worth a nicer column name.
+DO $$
+BEGIN
+  IF to_regclass('public.bank_integration_sync_log') IS NULL THEN RETURN; END IF;
+
+  -- Which provider produced the run. One row per execution says nothing about
+  -- who ran it once a second bank connector shares the table.
+  ALTER TABLE public.bank_integration_sync_log
+    ADD COLUMN IF NOT EXISTS provider text NOT NULL DEFAULT 'plugbank';
+  -- Inbound: we reach the bank, never the other way round.
+  ALTER TABLE public.bank_integration_sync_log
+    ADD COLUMN IF NOT EXISTS direction text NOT NULL DEFAULT 'inbound';
+  -- \`trigger\` is a reserved word; the column is trigger_kind and the TypeScript
+  -- side reads it as SyncRun.trigger.
+  ALTER TABLE public.bank_integration_sync_log
+    ADD COLUMN IF NOT EXISTS trigger_kind text NOT NULL DEFAULT 'manual';
+  ALTER TABLE public.bank_integration_sync_log
+    ADD COLUMN IF NOT EXISTS started_at timestamptz;
+  ALTER TABLE public.bank_integration_sync_log
+    ADD COLUMN IF NOT EXISTS finished_at timestamptz;
+
+  COMMENT ON COLUMN public.bank_integration_sync_log.trigger_kind IS
+    'SyncRun.trigger \u2014 on-write | scheduled | manual | webhook. Named _kind because trigger is reserved.';
+END $$;
+
+-- \xA73 \u2500\u2500 import \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- The one door the statement import passes through.
+--
+-- Today the edge function inserts into plg_financial_movements directly with
+-- service_role, and takes \`integrationId\` from the request body without ever
+-- comparing it to the caller \u2014 so any authenticated member of ANY tenant in the
+-- pool can name another tenant's integration and write into that tenant's
+-- ledger. A guard in the function would be a guard the next caller routes
+-- around; the database is the only chokepoint that cannot be.
+--
+-- The tenant is taken from the INTEGRATION ROW, never from the payload, and a
+-- caller presenting a user credential must be a member of it. A caller with no
+-- auth.uid() is the server (service_role, a migration, the future tenant-scoped
+-- token) and is exempt \u2014 the same exemption plg_emit_event makes, for the same
+-- reason: it legitimately writes for any tenant. When FAY-1372 mints the
+-- tenant-scoped credential, that exemption stops applying to connector code and
+-- this function needs no change.
+CREATE OR REPLACE FUNCTION public.plugbank_import_movements(p_payload jsonb)
+RETURNS jsonb
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $fn$
+DECLARE
+  v_tenants     uuid[];
+  v_tenant      uuid;
+  v_integration uuid;
+  v_account     uuid;
+  v_provider    text;
+  v_trigger     text;
+  v_from        date;
+  v_to          date;
+  v_started     timestamptz := now();
+  v_line        jsonb;
+  v_external    text;
+  v_amount      numeric(14,2);
+  v_date        date;
+  v_fetched     int := 0;
+  v_imported    int := 0;
+  v_duplicates  int := 0;
+  v_inserted    uuid;
+  v_run         uuid;
+BEGIN
+  v_integration := nullif(btrim(p_payload->>'integration_id'), '')::uuid;
+  IF v_integration IS NULL THEN
+    RAISE EXCEPTION 'plugbank_import_movements: integration_id is required'
+      USING ERRCODE = 'invalid_parameter_value';
+  END IF;
+
+  SELECT bi.tenant_id, bi.bank_account_id, bi.provider
+    INTO v_tenant, v_account, v_provider
+  FROM public.bank_integrations bi
+  WHERE bi.id = v_integration AND bi.active;
+
+  IF v_tenant IS NULL THEN
+    RAISE EXCEPTION 'plugbank_import_movements: no active integration %', v_integration
+      USING ERRCODE = 'no_data_found';
+  END IF;
+
+  -- SECURITY DEFINER bypasses RLS, so the membership check the policy would
+  -- have made has to happen here.
+  SELECT array_agg(t) INTO v_tenants FROM public.user_tenant_ids() AS t;
+  IF auth.uid() IS NOT NULL AND NOT (v_tenant = ANY (COALESCE(v_tenants, '{}'::uuid[]))) THEN
+    RAISE EXCEPTION 'plugbank_import_movements: caller is not a member of tenant %', v_tenant
+      USING ERRCODE = 'insufficient_privilege';
+  END IF;
+
+  -- Refusing beats ignoring: a caller that believes it is importing into
+  -- another tenant must be told, not silently redirected into this one.
+  IF nullif(btrim(p_payload->>'tenant_id'), '') IS NOT NULL
+     AND (p_payload->>'tenant_id')::uuid IS DISTINCT FROM v_tenant THEN
+    RAISE EXCEPTION 'plugbank_import_movements: payload names another tenant; the tenant comes from the integration'
+      USING ERRCODE = 'insufficient_privilege';
+  END IF;
+
+  IF nullif(btrim(p_payload->>'bank_account_id'), '') IS NOT NULL THEN
+    v_account := (p_payload->>'bank_account_id')::uuid;
+  END IF;
+
+  v_from    := nullif(btrim(p_payload->>'period_from'), '')::date;
+  v_to      := nullif(btrim(p_payload->>'period_to'), '')::date;
+  v_trigger := lower(coalesce(nullif(btrim(p_payload->>'trigger'), ''), 'manual'));
+  IF v_trigger NOT IN ('on-write', 'scheduled', 'manual', 'webhook') THEN
+    RAISE EXCEPTION 'plugbank_import_movements: unknown trigger %', v_trigger
+      USING ERRCODE = 'invalid_parameter_value';
+  END IF;
+
+  FOR v_line IN SELECT * FROM jsonb_array_elements(coalesce(p_payload->'lines', '[]'::jsonb))
+  LOOP
+    v_fetched := v_fetched + 1;
+    v_external := nullif(btrim(v_line->>'external_id'), '');
+    v_date     := nullif(btrim(v_line->>'date'), '')::date;
+    v_amount   := abs(coalesce((v_line->>'amount')::numeric, 0));
+
+    -- A line with no provider id cannot be recognised on re-delivery, so it
+    -- would import again on every run. Skipping it is the lesser wrong.
+    IF v_external IS NULL OR v_date IS NULL OR v_amount = 0 THEN
+      CONTINUE;
+    END IF;
+
+    -- Idempotency is the partial unique index from the financial plugin's
+    -- 007_reconciliation.sql, not a SELECT-then-INSERT: two runs of the same
+    -- window racing each other would both find nothing and both write.
+    INSERT INTO public.plg_financial_movements (
+      tenant_id, direction, movement_kind, amount, paid_amount, status,
+      due_date, payment_date, bank_account_id, notes, external_id, external_source)
+    VALUES (
+      v_tenant,
+      CASE WHEN upper(coalesce(v_line->>'type', 'C')) LIKE 'C%' THEN 'credit' ELSE 'debit' END,
+      'payment', v_amount, v_amount, 'paid',
+      v_date, v_date, v_account,
+      nullif(btrim(v_line->>'description'), ''),
+      v_external, coalesce(v_provider, 'plugbank'))
+    ON CONFLICT (tenant_id, external_source, external_id)
+      WHERE external_id IS NOT NULL AND external_source IS NOT NULL
+    DO NOTHING
+    RETURNING id INTO v_inserted;
+
+    IF v_inserted IS NULL THEN
+      v_duplicates := v_duplicates + 1;
+    ELSE
+      v_imported := v_imported + 1;
+    END IF;
+    v_inserted := NULL;
+  END LOOP;
+
+  UPDATE public.bank_integrations SET last_sync_at = now(), updated_at = now()
+  WHERE id = v_integration;
+
+  INSERT INTO public.bank_integration_sync_log (
+    tenant_id, bank_integration_id, bank_account_id, period_from, period_to,
+    transactions_fetched, transactions_imported, duplicates, status,
+    triggered_by_user_id, provider, direction, trigger_kind, started_at, finished_at)
+  VALUES (
+    v_tenant, v_integration, v_account, v_from, v_to,
+    v_fetched, v_imported, v_duplicates, 'success',
+    auth.uid(), coalesce(v_provider, 'plugbank'), 'inbound', v_trigger, v_started, now())
+  RETURNING id INTO v_run;
+
+  RETURN jsonb_build_object(
+    'ok', true,
+    'sync_run_id', v_run,
+    'fetched', v_fetched,
+    'imported', v_imported,
+    'duplicates', v_duplicates);
+END;
+$fn$;
+
+REVOKE ALL ON FUNCTION public.plugbank_import_movements(jsonb) FROM public, anon;
+GRANT EXECUTE ON FUNCTION public.plugbank_import_movements(jsonb) TO authenticated, service_role;
+
+-- \xA74 \u2500\u2500 facts \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- One trigger on the ledger rather than an emit call inside the importer. The
+-- RPC above, the edge function still inserting directly, a future scheduled
+-- pull and a hand-run backfill all end up in the same row \u2014 so the fact exists
+-- for all four without any of them having to remember to say so. That is the
+-- entire reason plg_emit_event exists (packages/db/migrations/027_domain_events.sql).
+--
+-- It fires only when external_source is set, which is exactly what "imported"
+-- means: a movement that came from outside. An app-native movement typed into
+-- the cash register is not an import and must not wake a bank connector.
+--
+-- Provider-agnostic on purpose. \`provider\` is in the payload, so a second bank
+-- connector importing into the same ledger produces the same fact instead of a
+-- second vocabulary for the same event.
+CREATE OR REPLACE FUNCTION public.plg_bank_emit_movement_imported()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $fn$
+DECLARE
+  v_payload jsonb;
+BEGIN
+  IF NEW.external_source IS NULL OR NEW.external_id IS NULL THEN
+    RETURN NULL;
+  END IF;
+
+  -- The contract every consumer reads. Not the row: a whole-row payload would
+  -- put the ledger's internal bookkeeping inside every webhook by default.
+  v_payload := jsonb_build_object(
+    'movement_id',     NEW.id::text,
+    'provider',        NEW.external_source,
+    'external_id',     NEW.external_id,
+    'direction',       NEW.direction,
+    'amount',          NEW.amount,
+    'payment_date',    NEW.payment_date,
+    'description',     NEW.notes,
+    'bank_account_id', NEW.bank_account_id);
+
+  BEGIN
+    PERFORM public.plg_emit_event(
+      'financial.movement.imported', v_payload, 'financial_movement',
+      NEW.id::text, NEW.tenant_id, NULL);
+  EXCEPTION WHEN OTHERS THEN
+    -- Observability must never be able to reject the write that caused it.
+    RAISE WARNING '[plg_bank_emit_movement_imported] % on %: %', TG_OP, TG_TABLE_NAME, SQLERRM;
+  END;
+
+  RETURN NULL;
+END;
+$fn$;
+
+REVOKE ALL ON FUNCTION public.plg_bank_emit_movement_imported() FROM public, anon;
+
+-- Guarded on the COLUMN, not just the table: the financial plugin owns both, and
+-- attaching this to a ledger without 007_reconciliation.sql would make every
+-- movement insert fail on an unknown field \u2014 an addon breaking its own host.
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM information_schema.columns
+    WHERE table_schema = 'public'
+      AND table_name = 'plg_financial_movements'
+      AND column_name = 'external_source'
+  ) THEN
+    DROP TRIGGER IF EXISTS plg_financial_movements_emit_imported ON public.plg_financial_movements;
+    CREATE TRIGGER plg_financial_movements_emit_imported
+      AFTER INSERT ON public.plg_financial_movements
+      FOR EACH ROW EXECUTE FUNCTION public.plg_bank_emit_movement_imported();
+  END IF;
+END $$;
+`;
+var MIGRATION_003_ONTO_CONNECTIONS = `-- ============================================================================
+-- plugin-banking-br 003 \u2014 PlugBank stops owning tables.
+--
+-- Retires public.bank_integrations and public.bank_integration_sync_log. The
+-- connection is now a row of public.plg_connections and each import is a row of
+-- public.plg_sync_runs (packages/db 029). See FAY-1376.
+--
+-- This connector is the one that tests the shape, because it is the only one
+-- whose key was never (tenant, provider): 001 keyed on
+-- UNIQUE (tenant_id, bank_account_id, provider), and the provider filtered by
+-- bank_account_id. Two accounts of one clinic are two connections, and they must
+-- stay two. That is exactly what \`instance_key\` is:
+--
+--   bank_integrations.bank_account_id  \u2192 plg_connections.instance_key
+--                                        (the account uuid as text; '' is the
+--                                         account-less default the panel uses,
+--                                         which is what \`bank_account_id IS NULL\`
+--                                         meant before)
+--   bank_integrations.provider         \u2192 plg_connections.connector_id
+--   bank_integrations.environment      \u2192 plg_connections.settings->>'environment'
+--   bank_integrations.active           \u2192 plg_connections.active
+--   bank_integrations.last_sync_at     \u2192 plg_connections.last_sync_at
+--   UNIQUE (tenant_id, bank_account_id, provider)
+--                                      \u2192 UNIQUE (tenant_id, connector_id, instance_key)
+--
+-- And the run, column by column \u2014 nothing the panel renders is lost:
+--   sync_log.bank_integration_id       \u2192 plg_sync_runs.connection_id
+--   sync_log.transactions_fetched      \u2192 plg_sync_runs.fetched
+--   sync_log.transactions_imported     \u2192 plg_sync_runs.written
+--   sync_log.duplicates                \u2192 plg_sync_runs.stats->>'duplicates'
+--   sync_log.period_from / _to         \u2192 plg_sync_runs.stats->>'period_from' / '_to'
+--   sync_log.triggered_by_user_id      \u2192 plg_sync_runs.stats->>'triggered_by_user_id'
+--   sync_log.error_message             \u2192 plg_sync_runs.error
+--   sync_log.bank_account_id           \u2192 dropped: it is the connection's
+--                                        instance_key, and a second copy is a
+--                                        second thing to disagree
+--   sync_log.provider                  \u2192 plg_sync_runs.connector_id
+--   sync_log.created_at                \u2192 plg_sync_runs.started_at
+--   direction / trigger_kind / status / started_at / finished_at \u2192 same names
+--
+-- The count columns finally get the contract's names. 002 \xA72 kept
+-- transactions_fetched/_imported because renaming them would have broken the
+-- deployed edge function's INSERT \u2014 but the function no longer inserts into a
+-- log at all: it calls plugbank_import_movements, which is the only writer, and
+-- the run is filed here. The choreography 002 was avoiding does not exist.
+--
+-- Nothing is in production, so this is a drop and not a data migration.
+-- ============================================================================
+
+-- \xA71 \u2500\u2500 the door, re-pointed \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- Same name, same payload, same guarantees. \`integration_id\` keeps its key on
+-- the wire so the deployed plugbank-sync function needs no coordinated release;
+-- what changed is that the uuid it carries now names a plg_connections row.
+--
+-- Everything 002 \xA73 established still holds and for the same reasons: the tenant
+-- comes from the CONNECTION ROW and never from the payload, a caller presenting
+-- a user credential must be a member of it, a caller with no auth.uid() is the
+-- server and is exempt, and idempotency is the partial unique index rather than
+-- a SELECT-then-INSERT that two racing runs would both pass.
+--
+-- One thing is new and is the point of the migration: the run is filed against
+-- \`connection_id\`, so a tenant with two bank accounts gets two histories instead
+-- of one interleaved list. plg_sync_runs carries no INSERT grant for
+-- \`authenticated\` \u2014 this SECURITY DEFINER function is the server-side writer the
+-- table's grants assume.
+CREATE OR REPLACE FUNCTION public.plugbank_import_movements(p_payload jsonb)
+RETURNS jsonb
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $fn$
+DECLARE
+  v_tenants     uuid[];
+  v_tenant      uuid;
+  v_connection  uuid;
+  v_instance    text;
+  v_account     uuid;
+  v_connector   text;
+  v_trigger     text;
+  v_from        date;
+  v_to          date;
+  v_started     timestamptz := now();
+  v_line        jsonb;
+  v_external    text;
+  v_amount      numeric(14,2);
+  v_date        date;
+  v_fetched     int := 0;
+  v_imported    int := 0;
+  v_duplicates  int := 0;
+  v_inserted    uuid;
+  v_run         uuid;
+BEGIN
+  v_connection := nullif(btrim(p_payload->>'integration_id'), '')::uuid;
+  IF v_connection IS NULL THEN
+    RAISE EXCEPTION 'plugbank_import_movements: integration_id is required'
+      USING ERRCODE = 'invalid_parameter_value';
+  END IF;
+
+  SELECT c.tenant_id, c.instance_key, c.connector_id
+    INTO v_tenant, v_instance, v_connector
+  FROM public.plg_connections c
+  WHERE c.id = v_connection AND c.active;
+
+  IF v_tenant IS NULL THEN
+    RAISE EXCEPTION 'plugbank_import_movements: no active connection %', v_connection
+      USING ERRCODE = 'no_data_found';
+  END IF;
+
+  -- The account this connection is for. \`instance_key\` is text because it also
+  -- carries things that are not uuids for other connectors (a Bling company, a
+  -- gateway instance); here it is the bank account, and '' is the account-less
+  -- default that \`bank_account_id IS NULL\` used to mean.
+  v_account := nullif(btrim(v_instance), '')::uuid;
+
+  -- SECURITY DEFINER bypasses RLS, so the membership check the policy would
+  -- have made has to happen here.
+  SELECT array_agg(t) INTO v_tenants FROM public.user_tenant_ids() AS t;
+  IF auth.uid() IS NOT NULL AND NOT (v_tenant = ANY (COALESCE(v_tenants, '{}'::uuid[]))) THEN
+    RAISE EXCEPTION 'plugbank_import_movements: caller is not a member of tenant %', v_tenant
+      USING ERRCODE = 'insufficient_privilege';
+  END IF;
+
+  -- Refusing beats ignoring: a caller that believes it is importing into
+  -- another tenant must be told, not silently redirected into this one.
+  IF nullif(btrim(p_payload->>'tenant_id'), '') IS NOT NULL
+     AND (p_payload->>'tenant_id')::uuid IS DISTINCT FROM v_tenant THEN
+    RAISE EXCEPTION 'plugbank_import_movements: payload names another tenant; the tenant comes from the connection'
+      USING ERRCODE = 'insufficient_privilege';
+  END IF;
+
+  -- Same rule as the tenant, one level down: the account is the connection's,
+  -- and a payload naming a different one is a caller importing into the wrong
+  -- ledger account. 002 let the payload override it silently \u2014 with one
+  -- connection per account that override is how two accounts get mixed.
+  IF nullif(btrim(p_payload->>'bank_account_id'), '') IS NOT NULL
+     AND (p_payload->>'bank_account_id')::uuid IS DISTINCT FROM v_account THEN
+    RAISE EXCEPTION 'plugbank_import_movements: payload names another bank account; the account comes from the connection'
+      USING ERRCODE = 'insufficient_privilege';
+  END IF;
+
+  v_from    := nullif(btrim(p_payload->>'period_from'), '')::date;
+  v_to      := nullif(btrim(p_payload->>'period_to'), '')::date;
+  v_trigger := lower(coalesce(nullif(btrim(p_payload->>'trigger'), ''), 'manual'));
+  IF v_trigger NOT IN ('on-write', 'scheduled', 'manual', 'webhook') THEN
+    RAISE EXCEPTION 'plugbank_import_movements: unknown trigger %', v_trigger
+      USING ERRCODE = 'invalid_parameter_value';
+  END IF;
+
+  FOR v_line IN SELECT * FROM jsonb_array_elements(coalesce(p_payload->'lines', '[]'::jsonb))
+  LOOP
+    v_fetched := v_fetched + 1;
+    v_external := nullif(btrim(v_line->>'external_id'), '');
+    v_date     := nullif(btrim(v_line->>'date'), '')::date;
+    v_amount   := abs(coalesce((v_line->>'amount')::numeric, 0));
+
+    -- A line with no provider id cannot be recognised on re-delivery, so it
+    -- would import again on every run. Skipping it is the lesser wrong.
+    IF v_external IS NULL OR v_date IS NULL OR v_amount = 0 THEN
+      CONTINUE;
+    END IF;
+
+    INSERT INTO public.plg_financial_movements (
+      tenant_id, direction, movement_kind, amount, paid_amount, status,
+      due_date, payment_date, bank_account_id, notes, external_id, external_source)
+    VALUES (
+      v_tenant,
+      CASE WHEN upper(coalesce(v_line->>'type', 'C')) LIKE 'C%' THEN 'credit' ELSE 'debit' END,
+      'payment', v_amount, v_amount, 'paid',
+      v_date, v_date, v_account,
+      nullif(btrim(v_line->>'description'), ''),
+      v_external, coalesce(v_connector, 'plugbank'))
+    ON CONFLICT (tenant_id, external_source, external_id)
+      WHERE external_id IS NOT NULL AND external_source IS NOT NULL
+    DO NOTHING
+    RETURNING id INTO v_inserted;
+
+    IF v_inserted IS NULL THEN
+      v_duplicates := v_duplicates + 1;
+    ELSE
+      v_imported := v_imported + 1;
+    END IF;
+    v_inserted := NULL;
+  END LOOP;
+
+  UPDATE public.plg_connections
+     SET last_sync_at = now(), status = 'connected', status_detail = NULL, updated_at = now()
+   WHERE id = v_connection;
+
+  -- \`stats\` is where the three facts a manual statement import has and a generic
+  -- run does not go: the operator picked a period, a re-import of that period is
+  -- mostly duplicates by design, and someone pressed the button. The panel reads
+  -- all three back from here.
+  INSERT INTO public.plg_sync_runs (
+    tenant_id, connection_id, connector_id, direction, trigger_kind, status,
+    stream, fetched, written, stats, started_at, finished_at)
+  VALUES (
+    v_tenant, v_connection, coalesce(v_connector, 'plugbank'), 'inbound', v_trigger, 'success',
+    'statement', v_fetched, v_imported,
+    jsonb_strip_nulls(jsonb_build_object(
+      'duplicates',           v_duplicates,
+      'period_from',          v_from,
+      'period_to',            v_to,
+      'triggered_by_user_id', auth.uid())),
+    v_started, now())
+  RETURNING id INTO v_run;
+
+  RETURN jsonb_build_object(
+    'ok', true,
+    'sync_run_id', v_run,
+    'fetched', v_fetched,
+    'imported', v_imported,
+    'duplicates', v_duplicates);
+END;
+$fn$;
+
+REVOKE ALL ON FUNCTION public.plugbank_import_movements(jsonb) FROM public, anon;
+GRANT EXECUTE ON FUNCTION public.plugbank_import_movements(jsonb) TO authenticated, service_role;
+
+COMMENT ON FUNCTION public.plugbank_import_movements(jsonb) IS
+  'Import bank-statement lines into the financial ledger and file the run in '
+  'plg_sync_runs. The tenant AND the bank account come from the plg_connections '
+  'row named by integration_id, never from the payload.';
+
+-- \xA72 \u2500\u2500 the bespoke tables go \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- After the function above, so a pool is never left with the old door pointing
+-- at a table that no longer exists.
+DROP TABLE IF EXISTS public.bank_integration_sync_log CASCADE;
+DROP TABLE IF EXISTS public.bank_integrations CASCADE;
+`;
 
 // src/index.ts
 function createOpenBankingPlugin() {
@@ -294,16 +938,84 @@ function createOpenBankingPlugin() {
     id: "openbanking",
     name: "Open Banking",
     icon: "Landmark",
-    version: "0.1.0",
+    version: "0.9.1",
+    apiVersion: 1,
     scope: "addon",
     defaultEnabled: true,
     dependencies: ["financial"],
     navigation: [],
     routes: [],
-    connectors: [openBankingConnector]
+    connectors: [openBankingConnector],
+    // The fact the import produces. Declared HERE and not on plugin-financial
+    // because the trigger that emits it ships in this plugin's 002: a host
+    // advertising an event that only exists when an addon is installed is the
+    // same broken promise as an automation the ingress never delivers.
+    events: buildBankingDomainEvents(),
+    // `emitsFrom` is deliberately absent. It generates
+    // `registry.<entity>.<action>` keys for every row change, and "imported" is
+    // not a row action — it is an INSERT carrying an external_source, which only
+    // a purpose-built trigger can tell apart from a sale typed into the till.
+    functions: [
+      {
+        slug: "plugbank-sync",
+        // Invoked from the browser by an authenticated operator picking a
+        // period, so Supabase must check the caller's JWT. It is not reached
+        // through the Fayz ingress — nothing in Fayz wakes a pull connector —
+        // which is what lets verifyJwt stay true.
+        ingress: "none",
+        verifyJwt: true,
+        // NAMES only. PLUGBANK_BASE_URL selects production vs sandbox; the
+        // per-tenant token and account CNPJ are NOT here, because a Supabase
+        // function secret is per-POOL and a pool serves N tenants with N
+        // different bank accounts. Those come from the Fayz platform per call.
+        secrets: ["PLUGBANK_BASE_URL", "SUPABASE_URL", "SUPABASE_SERVICE_ROLE_KEY"],
+        // What this connector's credential may touch. Direct table access is
+        // not on the list on purpose (2026-08-11 ADR): the import goes through
+        // the RPC, which takes the tenant from the integration row instead of
+        // from the request body.
+        grants: ["plugbank_import_movements"]
+      }
+    ],
+    declaredRpcs: [
+      {
+        name: "plugbank_import_movements",
+        kind: "write",
+        description: "Import bank-statement lines into the financial ledger. Idempotent on (tenant, provider, external id); the tenant comes from the integration row, never from the payload.",
+        audits: false
+      }
+    ],
+    // This plugin creates no table. 003 retired the two it had; what is left is
+    // the RPC that is the import's one door, and the trigger that turns an
+    // imported movement into a fact. The connection and its run history are rows
+    // of plg_connections / plg_sync_runs, owned by packages/db.
+    migrations: [
+      {
+        id: "openbanking-002_credential_and_facts",
+        version: "0.9.1",
+        sql: MIGRATION_002_CREDENTIAL_AND_FACTS,
+        description: "Drop bank_integrations.api_token/cnpj (destination: the Fayz platform credential store, FAY-1360 \u2014 register there BEFORE applying this), add plugbank_import_movements and the financial.movement.imported trigger"
+      },
+      {
+        id: "openbanking-003_onto_connections",
+        version: "1.0.0",
+        sql: MIGRATION_003_ONTO_CONNECTIONS,
+        description: "Retire bank_integrations + bank_integration_sync_log \u2014 the connection is a plg_connections row keyed by instance_key (the bank account) and each import a plg_sync_runs row; plugbank_import_movements re-pointed at both"
+      }
+    ],
+    diagnostics: [
+      {
+        id: "openbanking-ledger-ready",
+        description: "The import writes into the financial ledger and needs its reconciliation columns (plugin-financial 007), the generic connection tables (packages/db 029) and the row-level event emitter.",
+        requires: {
+          tables: ["plg_connections", "plg_sync_runs", "plg_financial_movements"],
+          rpcs: ["plugbank_import_movements", "plg_emit_event"]
+        },
+        level: "error"
+      }
+    ]
   };
 }
 
-export { bankIntegrationSyncLog, bankIntegrations, createOpenBankingPlugin, createOpenBankingProvider, openBankingConnector };
+export { MOVEMENT_IMPORTED_FIELDS, buildBankingDomainEvents, createOpenBankingPlugin, createOpenBankingProvider, openBankingConnector };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map