@fayz-ai/plugin-conversations 0.23.14 → 0.23.15

package/dist/migrations/main.js

@@ -0,0 +1,2141 @@
+// src/migrations/index.ts
+var MIGRATION_000_BASELINE = `-- ============================================================================
+-- plugins/plugin-conversations/src/migrations/000_baseline.sql \u2014 what installing this provisions, as one file.
+--
+-- GENERATED by scripts/emit-unit-baselines.mjs (#338). Do not edit by hand:
+-- change the schema, regenerate, and let scripts/check-chain-equivalence.mjs
+-- prove the result still matches.
+--
+-- This replaced 9 migration files. They are kept, unapplied, in
+-- migrations.archive/ \u2014 a year of decisions is worth reading even when it is no
+-- longer worth replaying.
+--
+-- Object order is fixed rather than dependency-sorted: schemas, types,
+-- sequences, tables, defaults, functions, constraints, views, indexes, foreign
+-- keys, triggers, row security, policies, grants. Dependencies BETWEEN units
+-- are carried by the order packages/db/chain.json declares.
+-- ============================================================================
+
+-- A LANGUAGE sql function binds its body at CREATE time, and 570 functions
+-- sorted by name are not sorted by who calls whom. This is what lets them load
+-- in any order; every body is still compiled on first call, so a genuinely
+-- broken reference surfaces then rather than never. Session-scoped.
+SET check_function_bodies = false;
+
+
+
+-- \u2500\u2500 default privileges: reset \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- Cleared BEFORE anything is created, so every object below gets the ACL the
+-- dump describes rather than the image's defaults on top of it. Restored at
+-- the end of this file.
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+
+-- \u2500\u2500 table \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE TABLE public.plg_conversation_messages (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    conversation_id uuid NOT NULL,
+    channel text,
+    direction text,
+    body text NOT NULL,
+    author text,
+    at timestamp with time zone DEFAULT now(),
+    provider_message_id text,
+    delivery_status text,
+    sender_kind text,
+    sender_label text,
+    subject_type text,
+    subject_id text,
+    CONSTRAINT plg_conversation_messages_channel_check CHECK (((channel IS NULL) OR (channel = ANY (ARRAY['sms'::text, 'whatsapp'::text, 'instagram'::text, 'email'::text, 'webchat'::text])))),
+    CONSTRAINT plg_conversation_messages_delivery_status_check CHECK (((delivery_status IS NULL) OR (delivery_status = ANY (ARRAY['queued'::text, 'sent'::text, 'delivered'::text, 'read'::text, 'failed'::text, 'expired'::text, 'delivery_timeout'::text, 'cancelled'::text, 'opted_out'::text])))),
+    CONSTRAINT plg_conversation_messages_direction_check CHECK ((direction = ANY (ARRAY['inbound'::text, 'outbound'::text]))),
+    CONSTRAINT plg_conversation_messages_sender_kind_check CHECK (((sender_kind IS NULL) OR (sender_kind = ANY (ARRAY['user'::text, 'system'::text, 'ai'::text, 'automation'::text]))))
+);
+
+CREATE TABLE public.plg_conversations (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    contact_name text NOT NULL,
+    contact_handle text,
+    channel text NOT NULL,
+    last_message_preview text,
+    last_message_at timestamp with time zone DEFAULT now(),
+    unread_count integer DEFAULT 0,
+    status text DEFAULT 'open'::text,
+    assigned_to text,
+    accent text,
+    tags text[],
+    location text,
+    note text,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    contact_person_id uuid,
+    CONSTRAINT plg_conversations_channel_check CHECK ((channel = ANY (ARRAY['sms'::text, 'whatsapp'::text, 'instagram'::text, 'email'::text, 'webchat'::text]))),
+    CONSTRAINT plg_conversations_status_check CHECK ((status = ANY (ARRAY['open'::text, 'snoozed'::text, 'closed'::text])))
+);
+
+CREATE TABLE public.plg_conversations_channels (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid,
+    channel text DEFAULT 'whatsapp'::text NOT NULL,
+    provider text NOT NULL,
+    provider_number_id text NOT NULL,
+    phone_e164 text,
+    kind text DEFAULT 'dedicated'::text NOT NULL,
+    status text DEFAULT 'requested'::text NOT NULL,
+    display_name text,
+    metadata jsonb DEFAULT '{}'::jsonb NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT plg_conversations_channels_channel_check CHECK ((channel = ANY (ARRAY['sms'::text, 'whatsapp'::text, 'instagram'::text, 'email'::text, 'webchat'::text]))),
+    CONSTRAINT plg_conversations_channels_kind_check CHECK ((kind = ANY (ARRAY['fallback'::text, 'dedicated'::text]))),
+    CONSTRAINT plg_conversations_channels_status_check CHECK ((status = ANY (ARRAY['requested'::text, 'provisioning'::text, 'provisioned'::text, 'verifying'::text, 'active'::text, 'failed'::text, 'released'::text, 'disconnected'::text])))
+);
+
+CREATE TABLE public.plg_conversations_optouts (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    channel text DEFAULT 'whatsapp'::text NOT NULL,
+    phone_e164 text NOT NULL,
+    tenant_id uuid,
+    provider text NOT NULL,
+    reason text,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT plg_conversations_optouts_channel_check CHECK ((channel = ANY (ARRAY['sms'::text, 'whatsapp'::text, 'instagram'::text, 'email'::text, 'webchat'::text])))
+);
+
+CREATE TABLE public.plg_conversations_payment_requests (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    conversation_id uuid,
+    message_id uuid,
+    subject_type text,
+    subject_id text,
+    amount_cents integer NOT NULL,
+    currency text DEFAULT 'BRL'::text NOT NULL,
+    description text,
+    provider text NOT NULL,
+    status text DEFAULT 'created'::text NOT NULL,
+    provider_payment_id text,
+    payment_link_url text,
+    pix_copy_paste text,
+    link_delivered_at timestamp with time zone,
+    settled_notified_at timestamp with time zone,
+    settled_at timestamp with time zone,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT plg_conversations_payment_requests_amount_cents_check CHECK ((amount_cents > 0)),
+    CONSTRAINT plg_conversations_payment_requests_status_check CHECK ((status = ANY (ARRAY['created'::text, 'link_generated'::text, 'approval_requested'::text, 'approved'::text, 'paid'::text, 'failed'::text, 'expired'::text, 'cancelled'::text])))
+);
+
+CREATE TABLE public.plg_conversations_webhook_events (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    provider text NOT NULL,
+    event_id text NOT NULL,
+    event_type text NOT NULL,
+    received_at timestamp with time zone DEFAULT now() NOT NULL
+);
+
+
+-- \u2500\u2500 function \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE FUNCTION public.plg_conversations_match_by_phone(p_channel text, p_last10 text, p_last8 text, p_tenant_id uuid DEFAULT NULL::uuid) RETURNS TABLE(id uuid, tenant_id uuid, contact_name text, contact_handle text, contact_person_id uuid)
+    LANGUAGE sql STABLE SECURITY DEFINER
+    SET search_path TO 'public'
+    AS $$
+  WITH candidate AS (
+    SELECT c.id, c.tenant_id, c.contact_name, c.contact_handle, c.contact_person_id,
+           c.last_message_at,
+           regexp_replace(COALESCE(c.contact_handle, ''), '[^0-9]', '', 'g') AS digits
+      FROM public.plg_conversations c
+     WHERE c.channel = p_channel
+       AND (p_tenant_id IS NULL OR c.tenant_id = p_tenant_id)
+  )
+  SELECT id, tenant_id, contact_name, contact_handle, contact_person_id
+    FROM candidate
+   WHERE length(digits) >= 8
+     AND ((p_last10 IS NOT NULL AND right(digits, 10) = p_last10)
+       OR (p_last8  IS NOT NULL AND right(digits, 8)  = p_last8))
+   -- The 10-digit match wins over an 8-digit one even when the 8-digit thread
+   -- is newer: a wrong area code is a different person, and a newer wrong
+   -- answer is still wrong.
+   ORDER BY (p_last10 IS NOT NULL AND right(digits, 10) = p_last10) DESC,
+            last_message_at DESC NULLS LAST
+   LIMIT 1;
+$$;
+
+
+-- \u2500\u2500 constraint \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+ALTER TABLE ONLY public.plg_conversation_messages
+    ADD CONSTRAINT plg_conversation_messages_pkey PRIMARY KEY (id);
+
+ALTER TABLE ONLY public.plg_conversations_channels
+    ADD CONSTRAINT plg_conversations_channels_pkey PRIMARY KEY (id);
+
+ALTER TABLE ONLY public.plg_conversations_optouts
+    ADD CONSTRAINT plg_conversations_optouts_pkey PRIMARY KEY (id);
+
+ALTER TABLE ONLY public.plg_conversations_payment_requests
+    ADD CONSTRAINT plg_conversations_payment_requests_pkey PRIMARY KEY (id);
+
+ALTER TABLE ONLY public.plg_conversations
+    ADD CONSTRAINT plg_conversations_pkey PRIMARY KEY (id);
+
+ALTER TABLE ONLY public.plg_conversations_webhook_events
+    ADD CONSTRAINT plg_conversations_webhook_events_pkey PRIMARY KEY (id);
+
+
+-- \u2500\u2500 index \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE INDEX idx_plg_conversation_messages_by_subject ON public.plg_conversation_messages USING btree (tenant_id, subject_type, subject_id) WHERE (subject_id IS NOT NULL);
+
+CREATE INDEX idx_plg_conversation_messages_subject ON public.plg_conversation_messages USING btree (conversation_id, at DESC) WHERE (subject_id IS NOT NULL);
+
+CREATE INDEX idx_plg_conversation_messages_thread ON public.plg_conversation_messages USING btree (conversation_id, at);
+
+CREATE INDEX idx_plg_conversations_channels_tenant ON public.plg_conversations_channels USING btree (tenant_id, channel, status) WHERE (tenant_id IS NOT NULL);
+
+CREATE INDEX idx_plg_conversations_handle_suffix ON public.plg_conversations USING btree (channel, "right"(regexp_replace(COALESCE(contact_handle, ''::text), '[^0-9]'::text, ''::text, 'g'::text), 8), last_message_at DESC);
+
+CREATE INDEX idx_plg_conversations_optouts_lookup ON public.plg_conversations_optouts USING btree (channel, phone_e164);
+
+CREATE INDEX idx_plg_conversations_payment_requests_subject ON public.plg_conversations_payment_requests USING btree (tenant_id, subject_type, subject_id) WHERE (subject_id IS NOT NULL);
+
+CREATE INDEX idx_plg_conversations_payment_requests_tenant ON public.plg_conversations_payment_requests USING btree (tenant_id, created_at DESC);
+
+CREATE INDEX idx_plg_conversations_person ON public.plg_conversations USING btree (tenant_id, contact_person_id) WHERE (contact_person_id IS NOT NULL);
+
+CREATE INDEX idx_plg_conversations_tenant ON public.plg_conversations USING btree (tenant_id);
+
+CREATE INDEX idx_plg_conversations_tenant_recent ON public.plg_conversations USING btree (tenant_id, last_message_at DESC);
+
+CREATE INDEX idx_plg_conversations_webhook_events_received ON public.plg_conversations_webhook_events USING btree (received_at);
+
+CREATE UNIQUE INDEX uq_plg_conversation_messages_provider_message ON public.plg_conversation_messages USING btree (provider_message_id) WHERE (provider_message_id IS NOT NULL);
+
+CREATE UNIQUE INDEX uq_plg_conversations_channels_fallback ON public.plg_conversations_channels USING btree (channel, provider) WHERE ((tenant_id IS NULL) AND (kind = 'fallback'::text));
+
+CREATE UNIQUE INDEX uq_plg_conversations_channels_number ON public.plg_conversations_channels USING btree (provider, provider_number_id);
+
+CREATE UNIQUE INDEX uq_plg_conversations_optouts_contact ON public.plg_conversations_optouts USING btree (channel, phone_e164, COALESCE(tenant_id, '00000000-0000-0000-0000-000000000000'::uuid));
+
+CREATE UNIQUE INDEX uq_plg_conversations_payment_requests_open_subject ON public.plg_conversations_payment_requests USING btree (tenant_id, subject_type, subject_id) WHERE ((subject_id IS NOT NULL) AND (status = ANY (ARRAY['created'::text, 'link_generated'::text, 'approval_requested'::text, 'approved'::text])));
+
+CREATE UNIQUE INDEX uq_plg_conversations_payment_requests_provider ON public.plg_conversations_payment_requests USING btree (provider, provider_payment_id) WHERE (provider_payment_id IS NOT NULL);
+
+CREATE UNIQUE INDEX uq_plg_conversations_webhook_events_event ON public.plg_conversations_webhook_events USING btree (provider, event_id);
+
+
+-- \u2500\u2500 fk constraint \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+ALTER TABLE ONLY public.plg_conversation_messages
+    ADD CONSTRAINT plg_conversation_messages_conversation_id_fkey FOREIGN KEY (conversation_id) REFERENCES public.plg_conversations(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_conversation_messages
+    ADD CONSTRAINT plg_conversation_messages_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES public.tenants(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_conversations_channels
+    ADD CONSTRAINT plg_conversations_channels_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES public.tenants(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_conversations
+    ADD CONSTRAINT plg_conversations_contact_person_id_fkey FOREIGN KEY (contact_person_id) REFERENCES public.people(id) ON DELETE SET NULL;
+
+ALTER TABLE ONLY public.plg_conversations_optouts
+    ADD CONSTRAINT plg_conversations_optouts_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES public.tenants(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_conversations_payment_requests
+    ADD CONSTRAINT plg_conversations_payment_requests_conversation_id_fkey FOREIGN KEY (conversation_id) REFERENCES public.plg_conversations(id) ON DELETE SET NULL;
+
+ALTER TABLE ONLY public.plg_conversations_payment_requests
+    ADD CONSTRAINT plg_conversations_payment_requests_message_id_fkey FOREIGN KEY (message_id) REFERENCES public.plg_conversation_messages(id) ON DELETE SET NULL;
+
+ALTER TABLE ONLY public.plg_conversations_payment_requests
+    ADD CONSTRAINT plg_conversations_payment_requests_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES public.tenants(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_conversations
+    ADD CONSTRAINT plg_conversations_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES public.tenants(id) ON DELETE CASCADE;
+
+
+-- \u2500\u2500 row security \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+ALTER TABLE public.plg_conversation_messages ENABLE ROW LEVEL SECURITY;
+
+ALTER TABLE public.plg_conversations ENABLE ROW LEVEL SECURITY;
+
+ALTER TABLE public.plg_conversations_channels ENABLE ROW LEVEL SECURITY;
+
+ALTER TABLE public.plg_conversations_optouts ENABLE ROW LEVEL SECURITY;
+
+ALTER TABLE public.plg_conversations_payment_requests ENABLE ROW LEVEL SECURITY;
+
+ALTER TABLE public.plg_conversations_webhook_events ENABLE ROW LEVEL SECURITY;
+
+
+-- \u2500\u2500 policy \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE POLICY plg_conversation_messages_delete ON public.plg_conversation_messages FOR DELETE TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_conversation_messages_insert ON public.plg_conversation_messages FOR INSERT TO authenticated WITH CHECK ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_conversation_messages_select ON public.plg_conversation_messages FOR SELECT TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_conversation_messages_update ON public.plg_conversation_messages FOR UPDATE TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_conversations_channels_select ON public.plg_conversations_channels FOR SELECT TO authenticated USING (((tenant_id IS NULL) OR (tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids))));
+
+CREATE POLICY plg_conversations_delete ON public.plg_conversations FOR DELETE TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_conversations_insert ON public.plg_conversations FOR INSERT TO authenticated WITH CHECK ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_conversations_optouts_select ON public.plg_conversations_optouts FOR SELECT TO authenticated USING (((tenant_id IS NULL) OR (tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids))));
+
+CREATE POLICY plg_conversations_payment_requests_select ON public.plg_conversations_payment_requests FOR SELECT TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_conversations_select ON public.plg_conversations FOR SELECT TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_conversations_update ON public.plg_conversations FOR UPDATE TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+
+-- \u2500\u2500 acl \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+REVOKE ALL ON FUNCTION public.plg_conversations_match_by_phone(p_channel text, p_last10 text, p_last8 text, p_tenant_id uuid) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.plg_conversations_match_by_phone(p_channel text, p_last10 text, p_last8 text, p_tenant_id uuid) TO service_role;
+
+GRANT MAINTAIN ON TABLE public.plg_conversation_messages TO anon;
+GRANT ALL ON TABLE public.plg_conversation_messages TO authenticated;
+GRANT ALL ON TABLE public.plg_conversation_messages TO service_role;
+
+GRANT MAINTAIN ON TABLE public.plg_conversations TO anon;
+GRANT ALL ON TABLE public.plg_conversations TO authenticated;
+GRANT ALL ON TABLE public.plg_conversations TO service_role;
+
+GRANT MAINTAIN ON TABLE public.plg_conversations_channels TO anon;
+GRANT ALL ON TABLE public.plg_conversations_channels TO authenticated;
+GRANT ALL ON TABLE public.plg_conversations_channels TO service_role;
+
+GRANT MAINTAIN ON TABLE public.plg_conversations_optouts TO anon;
+GRANT ALL ON TABLE public.plg_conversations_optouts TO authenticated;
+GRANT ALL ON TABLE public.plg_conversations_optouts TO service_role;
+
+GRANT MAINTAIN ON TABLE public.plg_conversations_payment_requests TO anon;
+GRANT ALL ON TABLE public.plg_conversations_payment_requests TO authenticated;
+GRANT ALL ON TABLE public.plg_conversations_payment_requests TO service_role;
+
+GRANT MAINTAIN ON TABLE public.plg_conversations_webhook_events TO anon;
+GRANT ALL ON TABLE public.plg_conversations_webhook_events TO authenticated;
+GRANT ALL ON TABLE public.plg_conversations_webhook_events TO service_role;
+
+
+-- \u2500\u2500 default privileges: restore \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- Put back, so the NEXT thing installed inherits what the chain had.
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT MAINTAIN ON TABLES TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT MAINTAIN ON TABLES TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$--
+-- PostgreSQL database dump complete
+--$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$--
+-- PostgreSQL database dump complete
+--$stmt$;
+END $dp$;
+`;
+var MIGRATION_001_A_CAIXA_SABE_QUEM_FALOU_POR_ULTIMO = `-- ---------------------------------------------------------------------------
+-- 001_a_caixa_sabe_quem_falou_por_ultimo.sql
+--
+-- A conversa guarda o TEXTO e a HORA da \xFAltima mensagem, e n\xE3o guarda de quem
+-- ela foi. Sem isso, "quem est\xE1 esperando resposta" \u2014 que \xE9 a pergunta com que
+-- este produto abre o dia \u2014 n\xE3o \xE9 respond\xEDvel a partir da lista: seria preciso
+-- carregar as mensagens de cada thread para descobrir quem falou por \xFAltimo.
+--
+-- O painel respondia com \`unread_count > 0\`, que \xE9 a aproxima\xE7\xE3o honesta que o
+-- shape permitia e n\xE3o \xE9 a resposta certa. Ela erra exatamente no caso que mais
+-- d\xF3i: a thread que algu\xE9m ABRIU, leu, decidiu responder depois e esqueceu. O
+-- n\xE3o-lida zera na leitura; o cliente continua esperando.
+--
+-- \u2500\u2500 Por que TRIGGER e n\xE3o mais uma coluna que cada escritor preenche \u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- \`last_message_preview\` e \`last_message_at\` s\xE3o escritos hoje em CINCO lugares:
+-- o provider do navegador (criar conversa, enviar), a fun\xE7\xE3o \`messaging-send\` e
+-- o \`tyxter-webhook\` (duas vezes, contando o handler de pagamento). Uma sexta
+-- coluna com a mesma disciplina \xE9 uma sexta chance de algu\xE9m esquecer \u2014 e o
+-- modo de falhar \xE9 silencioso: a fila simplesmente para de listar algu\xE9m.
+--
+-- O gatilho tem UM escritor e n\xE3o pode ser esquecido pelo pr\xF3ximo chamador. Ele
+-- \xE9 deliberadamente estreito: cuida s\xF3 de \`last_message_direction\`. Trazer o
+-- preview e a hora para c\xE1 seria a corre\xE7\xE3o certa e \xE9 uma mudan\xE7a maior, com
+-- cinco chamadores para reconciliar \u2014 fica anotado, n\xE3o feito aqui.
+-- ---------------------------------------------------------------------------
+
+ALTER TABLE public.plg_conversations
+  ADD COLUMN IF NOT EXISTS last_message_direction text;
+
+DO $$
+BEGIN
+  ALTER TABLE public.plg_conversations
+    ADD CONSTRAINT plg_conversations_last_message_direction_check
+    CHECK (last_message_direction IS NULL
+           OR last_message_direction = ANY (ARRAY['inbound'::text, 'outbound'::text]));
+EXCEPTION WHEN duplicate_object THEN
+  NULL;
+END $$;
+
+COMMENT ON COLUMN public.plg_conversations.last_message_direction IS
+  'Quem falou por \xFAltimo: inbound = o cliente, outbound = a casa (001). Mantida por gatilho em plg_conversation_messages, nunca escrita \xE0 m\xE3o. NULL = thread anterior a esta migration cujo backfill n\xE3o achou mensagem nenhuma.';
+
+-- \u2500\u2500 o \xFAnico escritor \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- AFTER INSERT: a mensagem j\xE1 existe quando a conversa \xE9 atualizada, ent\xE3o uma
+-- falha aqui n\xE3o pode desfazer o recebimento \u2014 e recebimento perdido \xE9 pior que
+-- fila desatualizada.
+--
+-- Sem cl\xE1usula de ordem: a mensagem que acabou de entrar \xC9 a \xFAltima. Comparar
+-- com \`last_message_at\` para decidir seria correto e traria uma corrida com os
+-- cinco escritores daquela coluna, que \xE9 justamente o problema que o gatilho
+-- existe para n\xE3o ter.
+CREATE OR REPLACE FUNCTION public.plg_conversations_stamp_direction()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path TO ''
+AS $function$
+BEGIN
+  IF NEW.direction IS NULL THEN
+    RETURN NULL;
+  END IF;
+
+  UPDATE public.plg_conversations
+     SET last_message_direction = NEW.direction
+   WHERE id = NEW.conversation_id;
+
+  RETURN NULL;
+END $function$;
+
+COMMENT ON FUNCTION public.plg_conversations_stamp_direction() IS
+  'Carimba plg_conversations.last_message_direction a cada mensagem inserida (001). O \xFAnico escritor da coluna.';
+
+DROP TRIGGER IF EXISTS plg_conversation_messages_stamp_direction ON public.plg_conversation_messages;
+CREATE TRIGGER plg_conversation_messages_stamp_direction
+  AFTER INSERT ON public.plg_conversation_messages
+  FOR EACH ROW
+  EXECUTE FUNCTION public.plg_conversations_stamp_direction();
+
+-- \u2500\u2500 backfill \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- DISTINCT ON pega uma linha por conversa, a mais recente. \`at DESC NULLS LAST\`
+-- e depois \`id DESC\` porque \`at\` tem default e n\xE3o NOT NULL: duas mensagens no
+-- mesmo instante (ou ambas sem hora) precisam de um desempate est\xE1vel, ou o
+-- backfill devolve resultado diferente a cada execu\xE7\xE3o.
+UPDATE public.plg_conversations c
+   SET last_message_direction = m.direction
+  FROM (
+    SELECT DISTINCT ON (conversation_id) conversation_id, direction
+      FROM public.plg_conversation_messages
+     WHERE direction IS NOT NULL
+     ORDER BY conversation_id, at DESC NULLS LAST, id DESC
+  ) m
+ WHERE m.conversation_id = c.id
+   AND c.last_message_direction IS DISTINCT FROM m.direction;
+
+-- S\xF3 as threads que interessam \xE0 fila, e s\xF3 quando o cliente falou por \xFAltimo:
+-- \xE9 o \xEDndice que a pergunta "quem est\xE1 esperando" faz, e ele fica pequeno
+-- porque a maioria das conversas de um tenant est\xE1 encerrada.
+CREATE INDEX IF NOT EXISTS idx_plg_conversations_waiting
+  ON public.plg_conversations (tenant_id, last_message_at DESC)
+  WHERE status = 'open' AND last_message_direction = 'inbound';
+`;
+var MIGRATION_002_A_CASA_ESCOLHE_POR_ONDE_O_WHATSAPP_SAI = `-- ---------------------------------------------------------------------------
+-- 002_a_casa_escolhe_por_onde_o_whatsapp_sai.sql \u2014 dois provedores de WhatsApp,
+-- a credencial de cada um, e a escolha de qual est\xE1 valendo.
+--
+-- \u2500\u2500 por que a credencial precisa morar aqui \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- O \`messaging-send\` (WP3) pega a chave assim:
+--
+--     const credential = await redeemConnectorCredential({ connectorSlug: 'tyxter', \u2026 })
+--
+-- Quinze linhas que chamam a PLATAFORMA Fayz. Funciona para o Tyxter porque a
+-- chave \xE9 uma s\xF3, da FayaLabs, e a plataforma a serve para qualquer inquilino
+-- do projeto. N\xE3o funciona para o Evolution, e n\xE3o vai funcionar nunca: o
+-- Evolution \xE9 auto-hospedado, e cada casa tem a pr\xF3pria URL e a pr\xF3pria chave.
+-- Credencial POR INQUILINO n\xE3o \xE9 atalho, \xE9 requisito do segundo provedor.
+--
+-- Um app que n\xE3o est\xE1 ligado a projeto Fayz nenhum \u2014 como o FullControl hoje \u2014
+-- tamb\xE9m n\xE3o resgata nada. Aqui a chave tem onde ficar nos dois casos.
+--
+-- \u2500\u2500 os dois provedores n\xE3o s\xE3o a mesma coisa, e a tabela diz isso \u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- \`tyxter\`     API oficial (Cloud API, via revenda). Iniciar conversa EXIGE
+--              template aprovado pela Meta; texto livre s\xF3 dentro de 24h da
+--              \xFAltima mensagem do cliente. Em troca: entrega confi\xE1vel, sem
+--              risco de banimento, e a Meta responde por n\xFAmero e qualidade.
+-- \`evolution\`  WhatsApp Web, auto-hospedado. N\xE3o tem template nem janela de
+--              24h \u2014 manda o que quiser. Em troca: a sess\xE3o morre, o n\xFAmero
+--              pode ser banido, e ningu\xE9m responde por isso al\xE9m de voc\xEA.
+--
+-- \`capabilities\` guarda essa diferen\xE7a como DADO e n\xE3o como \`if\` espalhado pela
+-- tela. Um bot\xE3o de "submeter template" num provedor que n\xE3o tem template n\xE3o
+-- pode existir; a tela l\xEA daqui para desabilitar em vez de fingir.
+--
+-- \u2500\u2500 o segredo n\xE3o passa pelo navegador \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- A tabela nega SELECT a \`authenticated\`. Quem l\xEA \xE9 o \`service_role\`, do lado
+-- do servidor. A tela sabe se EXISTE credencial e quais s\xE3o os campos n\xE3o
+-- secretos (a URL do Evolution, o nome da inst\xE2ncia) por uma view; o segredo
+-- ela nunca v\xEA, nem para reexibir mascarado.
+-- ---------------------------------------------------------------------------
+
+-- \u2500\u2500 quem est\xE1 valendo, por inquilino \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+CREATE TABLE IF NOT EXISTS public.plg_conversations_providers (
+  tenant_id    uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  provider     text NOT NULL,
+  -- N\xE3o secreto: a URL base do Evolution, o nome da inst\xE2ncia, o id do n\xFAmero.
+  -- \xC9 isto que a tela mostra e deixa editar.
+  config       jsonb NOT NULL DEFAULT '{}'::jsonb,
+  -- Secreto. Nenhuma pol\xEDtica de leitura alcan\xE7a esta coluna.
+  secrets      jsonb NOT NULL DEFAULT '{}'::jsonb,
+  -- O que este provedor SABE fazer. Lido pela tela para desabilitar o que n\xE3o
+  -- existe, em vez de oferecer um bot\xE3o que erra.
+  capabilities jsonb NOT NULL DEFAULT '{}'::jsonb,
+  -- Um s\xF3 por inquilino fica ativo. O outro continua configurado, pronto para
+  -- a troca \u2014 que \xE9 o pedido: poder alternar sem reconfigurar.
+  is_active    boolean NOT NULL DEFAULT false,
+  status       text NOT NULL DEFAULT 'unconfigured',
+  status_detail text,
+  checked_at   timestamptz,
+  created_at   timestamptz NOT NULL DEFAULT now(),
+  updated_at   timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (tenant_id, provider),
+  CONSTRAINT plg_conversations_providers_provider
+    CHECK (provider IN ('tyxter', 'evolution')),
+  CONSTRAINT plg_conversations_providers_status
+    CHECK (status IN ('unconfigured', 'connecting', 'connected', 'error', 'disconnected'))
+);
+
+-- UM ativo por inquilino, garantido pelo banco e n\xE3o pela tela. Duas telas
+-- abertas em abas diferentes s\xE3o o caso comum, e "o \xFAltimo clique vence" s\xF3 \xE9
+-- verdade se algu\xE9m impedir o empate.
+CREATE UNIQUE INDEX IF NOT EXISTS plg_conversations_providers_one_active
+  ON public.plg_conversations_providers (tenant_id)
+  WHERE is_active;
+
+ALTER TABLE public.plg_conversations_providers ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.plg_conversations_providers FORCE ROW LEVEL SECURITY;
+
+-- Nenhuma pol\xEDtica para \`authenticated\`: o segredo mora numa coluna desta
+-- tabela, e uma pol\xEDtica de SELECT aqui entregaria a chave ao navegador.
+--
+-- E o REVOKE expl\xEDcito, porque a aus\xEAncia de pol\xEDtica N\xC3O \xE9 a \xFAnica linha de
+-- defesa. O schema \`public\` deste cluster carrega grants amplos de f\xE1brica \u2014
+-- medido nesta pr\xF3pria tabela logo ap\xF3s cri\xE1-la: sete privil\xE9gios j\xE1
+-- concedidos a \`authenticated\` sem ningu\xE9m ter pedido. A RLS for\xE7ada barra
+-- assim mesmo, mas uma pol\xEDtica escrita errada num dia ruim \xE9 tudo o que
+-- separa a chave do navegador. Duas fechaduras.
+REVOKE ALL ON public.plg_conversations_providers FROM PUBLIC, anon, authenticated;
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.plg_conversations_providers TO service_role;
+
+-- \u2500\u2500 o que a tela pode ver \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- Tudo menos o segredo. \`has_credential\` responde a \xFAnica pergunta que a tela
+-- precisa fazer sobre ele: j\xE1 foi posto?
+-- \u2500\u2500 A \xDANICA VIEW DESTE REPO QUE N\xC3O \xC9 \`security_invoker\` \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- A regra da casa \xE9 \`security_invoker = true\`: a view enxerga o que o leitor
+-- enxerga, e a RLS da tabela continua valendo. Aqui isso se autoderrota.
+--
+-- \`authenticated\` N\xC3O pode ler \`plg_conversations_providers\` \u2014 \xE9 onde o segredo
+-- mora, e o REVOKE logo acima \xE9 deliberado. Uma view invoker sobre uma tabela
+-- que o chamador n\xE3o alcan\xE7a devolve \`42501 permission denied\`, que foi
+-- exatamente o que a tela recebeu no primeiro teste com um JWT de verdade.
+--
+-- Ent\xE3o esta view \xE9 definer POR PROJETO, e paga o pre\xE7o sendo ela mesma a
+-- fronteira: o \`WHERE tenant_id IN (user_tenant_ids())\` abaixo n\xE3o \xE9
+-- decora\xE7\xE3o, \xE9 a RLS desta view. E a coluna do segredo n\xE3o est\xE1 na lista do
+-- SELECT \u2014 o que ela n\xE3o seleciona n\xE3o existe para quem l\xEA.
+DROP VIEW IF EXISTS public.v_conversations_providers;
+CREATE VIEW public.v_conversations_providers AS
+  SELECT p.tenant_id,
+         p.provider,
+         p.config,
+         p.capabilities,
+         p.is_active,
+         p.status,
+         p.status_detail,
+         p.checked_at,
+         -- Nunca o valor. S\xF3 se existe.
+         (p.secrets ? 'api_key') AS has_credential,
+         p.created_at,
+         p.updated_at
+    FROM public.plg_conversations_providers p
+   WHERE p.tenant_id IN (SELECT public.user_tenant_ids());
+
+GRANT SELECT ON public.v_conversations_providers TO authenticated;
+
+COMMENT ON VIEW public.v_conversations_providers IS
+  'Os provedores de WhatsApp da casa, SEM o segredo. \`has_credential\` diz se a chave foi posta; o valor n\xE3o sai daqui (002).';
+
+-- \u2500\u2500 p\xF4r a credencial \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- SECURITY DEFINER porque a tabela nega escrita a \`authenticated\`: \xE9 a \xFAnica
+-- porta, e ela confere o inquilino antes de abrir. \`search_path\` vazio porque
+-- uma fun\xE7\xE3o definer sem isso \xE9 uma fun\xE7\xE3o que o chamador pode redirecionar.
+CREATE OR REPLACE FUNCTION public.conversations_set_provider(
+  p_tenant       uuid,
+  p_provider     text,
+  p_config       jsonb DEFAULT '{}'::jsonb,
+  p_api_key      text  DEFAULT NULL,
+  p_capabilities jsonb DEFAULT NULL
+) RETURNS void
+LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
+AS $$
+DECLARE v_caps jsonb;
+BEGIN
+  IF p_tenant IS NULL OR NOT (p_tenant IN (SELECT public.user_tenant_ids())) THEN
+    RAISE EXCEPTION 'conversations_set_provider: n\xE3o \xE9 uma casa sua';
+  END IF;
+
+  -- O que cada provedor sabe fazer \xE9 conhecimento do produto, n\xE3o do usu\xE1rio.
+  -- Quem chama pode sobrescrever (um Evolution atr\xE1s de proxy pode ganhar
+  -- capacidades), mas o padr\xE3o descreve a verdade de cada um.
+  v_caps := coalesce(p_capabilities, CASE p_provider
+    WHEN 'tyxter' THEN jsonb_build_object(
+      'templates', true,          -- e s\xE3o OBRIGAT\xD3RIOS para iniciar conversa
+      'requires_template', true,
+      'session_window_hours', 24, -- texto livre s\xF3 dentro dela
+      'delivery_receipts', true,
+      'qr_pairing', false,
+      'ban_risk', 'low')
+    WHEN 'evolution' THEN jsonb_build_object(
+      'templates', false,         -- n\xE3o existem: manda texto direto
+      'requires_template', false,
+      'session_window_hours', null,
+      'delivery_receipts', true,
+      'qr_pairing', true,         -- parear \xE9 ler um QR, n\xE3o cadastrar na Meta
+      'ban_risk', 'high')         -- e \xE9 por isso que o aquecimento importa
+    ELSE '{}'::jsonb END);
+
+  INSERT INTO public.plg_conversations_providers AS t
+    (tenant_id, provider, config, capabilities, status,
+     secrets)
+  VALUES
+    (p_tenant, p_provider, coalesce(p_config, '{}'::jsonb), v_caps,
+     CASE WHEN p_api_key IS NULL THEN 'unconfigured' ELSE 'connecting' END,
+     CASE WHEN p_api_key IS NULL THEN '{}'::jsonb
+          ELSE jsonb_build_object('api_key', p_api_key) END)
+  ON CONFLICT (tenant_id, provider) DO UPDATE
+     SET config       = coalesce(p_config, t.config),
+         capabilities = v_caps,
+         -- Chave nula \xE9 "n\xE3o mexe", n\xE3o "apaga". Salvar a URL do Evolution sem
+         -- redigitar a chave \xE9 o gesto comum, e apag\xE1-la aqui seria a surpresa.
+         secrets      = CASE WHEN p_api_key IS NULL THEN t.secrets
+                             ELSE jsonb_set(t.secrets, '{api_key}', to_jsonb(p_api_key)) END,
+         status       = CASE WHEN p_api_key IS NULL THEN t.status ELSE 'connecting' END,
+         updated_at   = now();
+END $$;
+
+REVOKE ALL ON FUNCTION public.conversations_set_provider(uuid, text, jsonb, text, jsonb) FROM PUBLIC, anon;
+GRANT EXECUTE ON FUNCTION public.conversations_set_provider(uuid, text, jsonb, text, jsonb) TO authenticated, service_role;
+
+-- \u2500\u2500 trocar qual est\xE1 valendo \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+CREATE OR REPLACE FUNCTION public.conversations_activate_provider(
+  p_tenant uuid, p_provider text
+) RETURNS void
+LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
+AS $$
+BEGIN
+  IF p_tenant IS NULL OR NOT (p_tenant IN (SELECT public.user_tenant_ids())) THEN
+    RAISE EXCEPTION 'conversations_activate_provider: n\xE3o \xE9 uma casa sua';
+  END IF;
+
+  -- Desligar ANTES de ligar: o \xEDndice \xFAnico parcial recusaria os dois ativos,
+  -- e numa transa\xE7\xE3o s\xF3 a ordem \xE9 o que decide entre trocar e falhar.
+  UPDATE public.plg_conversations_providers
+     SET is_active = false, updated_at = now()
+   WHERE tenant_id = p_tenant AND is_active;
+
+  UPDATE public.plg_conversations_providers
+     SET is_active = true, updated_at = now()
+   WHERE tenant_id = p_tenant AND provider = p_provider;
+
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'conversations_activate_provider: % n\xE3o est\xE1 configurado nesta casa', p_provider;
+  END IF;
+END $$;
+
+REVOKE ALL ON FUNCTION public.conversations_activate_provider(uuid, text) FROM PUBLIC, anon;
+GRANT EXECUTE ON FUNCTION public.conversations_activate_provider(uuid, text) TO authenticated, service_role;
+
+-- \u2500\u2500 o canal aprende de que provedor ele \xE9 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- \`plg_conversations_channels.provider\` j\xE1 existe e j\xE1 guarda 'tyxter'. O que
+-- falta \xE9 a liga\xE7\xE3o com a credencial: um n\xFAmero do Evolution precisa saber de
+-- QUAL inst\xE2ncia ele saiu, porque a mesma casa pode ter mais de uma.
+ALTER TABLE public.plg_conversations_channels
+  ADD COLUMN IF NOT EXISTS instance_key text;
+
+COMMENT ON COLUMN public.plg_conversations_channels.instance_key IS
+  'A inst\xE2ncia do provedor de onde este n\xFAmero sai. Nulo no Tyxter (uma conta por projeto); no Evolution \xE9 o nome da inst\xE2ncia (002).';
+`;
+var MIGRATION_003_A_CAMPANHA_SAI_NO_RITMO_QUE_O_NUMERO_AGUENTA = `-- ---------------------------------------------------------------------------
+-- 003_a_campanha_sai_no_ritmo_que_o_numero_aguenta.sql \u2014 template, campanha,
+-- log de envio e o ritmo que impede o n\xFAmero de ser banido.
+--
+-- O desenho n\xE3o \xE9 inven\xE7\xE3o: saiu de ler Mautic, EspoCRM, Odoo e Twenty, e de
+-- ler a documenta\xE7\xE3o da Meta em vez do folclore que circula sobre ela. Onde os
+-- quatro discordam, este arquivo diz qual escolheu e por qu\xEA.
+--
+-- \u2500\u2500 tr\xEAs coisas que a Meta documenta e que viram REGRA, n\xE3o ajuste \u2500\u2500\u2500\u2500\u2500\u2500
+--
+--   \xB7 131050 (o usu\xE1rio saiu do marketing) NUNCA se repete. Reenviar \xE9 outra
+--     infra\xE7\xE3o, n\xE3o outra tentativa.
+--   \xB7 131048 (bloqueado/marcado como spam) \xE9 parada dura. \xC9 o alarme de
+--     qualidade, n\xE3o um erro de rede.
+--   \xB7 A janela de 24h s\xF3 abre por mensagem OU chamada DO CLIENTE. Template
+--     nosso n\xE3o abre janela nenhuma \u2014 e \xE9 o erro que mais se v\xEA em CRM.
+--
+-- O resto \u2014 a rampa de aquecimento, a faixa de atraso entre mensagens \u2014 \xE9
+-- pr\xE1tica de comunidade, n\xE3o documenta\xE7\xE3o. Vira PADR\xC3O EDIT\xC1VEL: quem opera o
+-- n\xFAmero sabe mais do que uma tabela escrita hoje.
+--
+-- \u2500\u2500 por que o log de envio tem \`rotation\` e \`claim_token\` \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- \`rotation\` \xE9 do Mautic: a chave \xFAnica \xE9 (campanha, contato, rota\xE7\xE3o), e a
+-- rota\xE7\xE3o sobe quando algu\xE9m REINICIA a campanha de prop\xF3sito. Sem ela, a \xFAnica
+-- forma de reenviar \xE9 apagar o hist\xF3rico \u2014 e a\xED ningu\xE9m consegue provar o que
+-- foi mandado.
+--
+-- \`claim_token\` + \`claim_expires_at\` \xE9 do Twenty: quem vai enviar ARRENDA a
+-- linha por cinco minutos. Duas inst\xE2ncias do disparador n\xE3o mandam a mesma
+-- mensagem duas vezes, e um processo que morre no meio devolve a linha sozinho
+-- quando o arrendamento vence. Os quatro CRMs resolvem isso com \xEDndice \xFAnico
+-- mais arrendamento; nenhum usa advisory lock, e nenhum usa outbox.
+-- ---------------------------------------------------------------------------
+
+-- \u2500\u2500 quem nunca mais deve ser contatado \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- A tabela j\xE1 existe e j\xE1 \xE9 chaveada pelo N\xDAMERO e n\xE3o pelo contato \u2014 que \xE9 o
+-- acerto do Odoo e do Twenty, e o erro do Mautic: n\xFAmero \xE9 reatribu\xEDdo, contato
+-- \xE9 duplicado, e a supress\xE3o precisa sobreviver aos dois.
+--
+-- O que falta \xE9 n\xE3o apagar nunca. O EspoCRM apaga a linha ao reinscrever e
+-- perde a prova de que algu\xE9m um dia pediu para sair; o Odoo desliga um
+-- booleano. Seguimos o Odoo.
+ALTER TABLE public.plg_conversations_optouts
+  ADD COLUMN IF NOT EXISTS active     boolean NOT NULL DEFAULT true,
+  ADD COLUMN IF NOT EXISTS revoked_at timestamptz,
+  ADD COLUMN IF NOT EXISTS source     text;
+
+COMMENT ON COLUMN public.plg_conversations_optouts.active IS
+  'Desligar em vez de apagar: a linha \xE9 a prova de que a pessoa pediu para sair, e apag\xE1-la \xE9 perder a prova (003).';
+
+-- \u2500\u2500 o texto que se manda \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- Um template aqui N\xC3O \xE9 um template da Meta. \xC9 o texto da casa, com o espelho
+-- do que o provedor respondeu sobre ele. Assim o mesmo registro serve aos dois:
+-- no Tyxter ele carrega o nome e o status da aprova\xE7\xE3o; no Evolution, que n\xE3o
+-- tem o conceito, ele \xE9 s\xF3 o texto \u2014 e a campanha n\xE3o precisa saber a diferen\xE7a.
+CREATE TABLE IF NOT EXISTS public.plg_conversations_templates (
+  id           uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id    uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  name         text NOT NULL,
+  language     text NOT NULL DEFAULT 'pt_BR',
+  category     text NOT NULL DEFAULT 'MARKETING',
+  body         text NOT NULL,
+  -- Os nomes das vari\xE1veis, na ordem em que {{1}}, {{2}} aparecem. A Meta s\xF3
+  -- entende posi\xE7\xE3o; gente entende nome. Guardar os dois \xE9 o que deixa a tela
+  -- pedir "cargo" em vez de "vari\xE1vel 3".
+  variables    text[] NOT NULL DEFAULT '{}',
+  provider     text,
+  provider_template_id text,
+  -- \`draft\` enquanto \xE9 nosso; depois \xE9 o que o provedor respondeu, verbatim.
+  status       text NOT NULL DEFAULT 'draft',
+  status_detail text,
+  submitted_at timestamptz,
+  approved_at  timestamptz,
+  created_at   timestamptz NOT NULL DEFAULT now(),
+  updated_at   timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS plg_conversations_templates_name_uq
+  ON public.plg_conversations_templates (tenant_id, name, language);
+
+ALTER TABLE public.plg_conversations_templates ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.plg_conversations_templates FORCE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS plg_conversations_templates_rw ON public.plg_conversations_templates;
+CREATE POLICY plg_conversations_templates_rw ON public.plg_conversations_templates
+  FOR ALL TO authenticated
+  USING (tenant_id IN (SELECT public.user_tenant_ids()))
+  WITH CHECK (tenant_id IN (SELECT public.user_tenant_ids()));
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.plg_conversations_templates TO authenticated, service_role;
+
+-- \u2500\u2500 a campanha \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+CREATE TABLE IF NOT EXISTS public.plg_conversations_campaigns (
+  id           uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id    uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  name         text NOT NULL,
+  template_id  uuid REFERENCES public.plg_conversations_templates(id) ON DELETE SET NULL,
+  channel_id   uuid REFERENCES public.plg_conversations_channels(id) ON DELETE SET NULL,
+  provider     text,
+  status       text NOT NULL DEFAULT 'draft',
+  -- O ritmo. Nasce do padr\xE3o do provedor e \xE9 edit\xE1vel: a rampa \xE9 pr\xE1tica de
+  -- comunidade, e quem opera o n\xFAmero sabe mais que esta tabela.
+  pacing       jsonb NOT NULL DEFAULT '{}'::jsonb,
+  -- Por que parou, quando parou sozinha. Ver \`crm\` nenhum: \xE9 o alarme de
+  -- qualidade da Meta chegando na tela de quem disparou.
+  paused_reason text,
+  started_at   timestamptz,
+  finished_at  timestamptz,
+  created_by   uuid,
+  created_at   timestamptz NOT NULL DEFAULT now(),
+  updated_at   timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT plg_conversations_campaigns_status
+    CHECK (status IN ('draft', 'scheduled', 'running', 'paused', 'done', 'cancelled'))
+);
+
+ALTER TABLE public.plg_conversations_campaigns ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.plg_conversations_campaigns FORCE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS plg_conversations_campaigns_rw ON public.plg_conversations_campaigns;
+CREATE POLICY plg_conversations_campaigns_rw ON public.plg_conversations_campaigns
+  FOR ALL TO authenticated
+  USING (tenant_id IN (SELECT public.user_tenant_ids()))
+  WITH CHECK (tenant_id IN (SELECT public.user_tenant_ids()));
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.plg_conversations_campaigns TO authenticated, service_role;
+
+-- \u2500\u2500 uma linha por destinat\xE1rio, para sempre \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- \xC9 o log de envio e a fila ao mesmo tempo. Vale para os dois provedores, e \xE9
+-- o \xFAnico lugar onde se pode PROVAR o que foi mandado, para quem, quando, e
+-- por que algu\xE9m N\xC3O foi contatado.
+CREATE TABLE IF NOT EXISTS public.plg_conversations_campaign_targets (
+  id           uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id    uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  campaign_id  uuid NOT NULL REFERENCES public.plg_conversations_campaigns(id) ON DELETE CASCADE,
+  -- A pessoa do CRM. \`SET NULL\` e n\xE3o \`CASCADE\`: apagar a pessoa n\xE3o pode
+  -- apagar a prova de que uma mensagem foi enviada a ela.
+  person_id    uuid,
+  phone_e164   text NOT NULL,
+  -- Ver o cabe\xE7alho: sobe quando algu\xE9m REINICIA a campanha de prop\xF3sito.
+  rotation     integer NOT NULL DEFAULT 1,
+  state        text NOT NULL DEFAULT 'queued',
+  skip_reason  text,
+  failure_code text,
+  failure_detail text,
+  -- O arrendamento. S\xF3 quem segura o token manda.
+  claim_token  uuid,
+  claim_expires_at timestamptz,
+  provider_message_id text,
+  variables    jsonb NOT NULL DEFAULT '{}'::jsonb,
+  queued_at    timestamptz NOT NULL DEFAULT now(),
+  sent_at      timestamptz,
+  delivered_at timestamptz,
+  read_at      timestamptz,
+  replied_at   timestamptz,
+  failed_at    timestamptz,
+  CONSTRAINT plg_conversations_campaign_targets_state
+    CHECK (state IN ('queued', 'sending', 'sent', 'delivered', 'read', 'replied', 'failed', 'skipped')),
+  -- O arrendamento existe se e s\xF3 se est\xE1 enviando. Duas verifica\xE7\xF5es porque
+  -- um token sem prazo \xE9 um token que nunca volta.
+  CONSTRAINT plg_conversations_campaign_targets_lease
+    CHECK (state <> 'sending' OR claim_expires_at IS NOT NULL),
+  CONSTRAINT plg_conversations_campaign_targets_lease_pair
+    CHECK ((claim_token IS NULL) = (claim_expires_at IS NULL))
+);
+
+-- Uma vez por campanha, por pessoa, por rodada. \xC9 esta linha que impede o
+-- disparo duplo \u2014 n\xE3o um \`if\` no c\xF3digo do disparador.
+CREATE UNIQUE INDEX IF NOT EXISTS plg_conversations_campaign_targets_once
+  ON public.plg_conversations_campaign_targets (campaign_id, phone_e164, rotation);
+
+-- O webhook do provedor chega mais de uma vez, de prop\xF3sito (o Evolution tenta
+-- 10 vezes em ~50 min). A idempot\xEAncia do recebimento \xE9 este \xEDndice.
+CREATE UNIQUE INDEX IF NOT EXISTS plg_conversations_campaign_targets_provider_msg
+  ON public.plg_conversations_campaign_targets (tenant_id, provider_message_id)
+  WHERE provider_message_id IS NOT NULL;
+
+CREATE INDEX IF NOT EXISTS plg_conversations_campaign_targets_pending
+  ON public.plg_conversations_campaign_targets (campaign_id)
+  WHERE state IN ('queued', 'sending');
+
+-- O ceifeiro: linhas cujo arrendamento venceu voltam para a fila.
+CREATE INDEX IF NOT EXISTS plg_conversations_campaign_targets_reaper
+  ON public.plg_conversations_campaign_targets (claim_expires_at)
+  WHERE state = 'sending';
+
+ALTER TABLE public.plg_conversations_campaign_targets ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.plg_conversations_campaign_targets FORCE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS plg_conversations_campaign_targets_rw ON public.plg_conversations_campaign_targets;
+CREATE POLICY plg_conversations_campaign_targets_rw ON public.plg_conversations_campaign_targets
+  FOR ALL TO authenticated
+  USING (tenant_id IN (SELECT public.user_tenant_ids()))
+  WITH CHECK (tenant_id IN (SELECT public.user_tenant_ids()));
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.plg_conversations_campaign_targets TO authenticated, service_role;
+
+-- \u2500\u2500 o ritmo que o n\xFAmero aguenta \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- Mora no canal e n\xE3o na campanha: o limite \xE9 do N\xDAMERO, e duas campanhas no
+-- mesmo n\xFAmero somam. Guardar na campanha deixaria cada uma achar que tem a
+-- cota inteira.
+ALTER TABLE public.plg_conversations_channels
+  ADD COLUMN IF NOT EXISTS pacing      jsonb NOT NULL DEFAULT '{}'::jsonb,
+  ADD COLUMN IF NOT EXISTS warmup_day  integer,
+  ADD COLUMN IF NOT EXISTS warmup_started_at timestamptz,
+  ADD COLUMN IF NOT EXISTS quality     text,
+  ADD COLUMN IF NOT EXISTS quality_at  timestamptz;
+
+COMMENT ON COLUMN public.plg_conversations_channels.pacing IS
+  'Ritmo deste n\xFAmero: por minuto, por hora, por dia, faixa de atraso e janela de hor\xE1rio. Padr\xE3o por provedor, edit\xE1vel \u2014 a rampa \xE9 pr\xE1tica de comunidade, n\xE3o documenta\xE7\xE3o da Meta (003).';
+
+-- Os padr\xF5es, por provedor. N\xFAmeros da pesquisa; o coment\xE1rio diz a
+-- proced\xEAncia de cada um, porque "por que 20?" \xE9 a pergunta que sempre volta.
+CREATE OR REPLACE FUNCTION public.conversations_default_pacing(p_provider text)
+RETURNS jsonb LANGUAGE sql IMMUTABLE AS $$
+  SELECT CASE p_provider
+    -- Oficial. O teto real \xE9 o tier da Meta (250/2.000/10.000/100.000), que a
+    -- pr\xF3pria API informa por n\xFAmero \u2014 ent\xE3o aqui s\xF3 entra o que a Meta N\xC3O
+    -- controla: o ritmo instant\xE2neo. 1 msg / 6 s para o MESMO destinat\xE1rio \xE9
+    -- documentado; 60/min \xE9 75% do teto de 80/s por seguran\xE7a.
+    WHEN 'tyxter' THEN jsonb_build_object(
+      'per_minute', 60, 'per_hour', 1000, 'per_day', null,
+      'delay_seconds', jsonb_build_array(1, 3),
+      'same_recipient_seconds', 6,
+      'hours', jsonb_build_object('start', '09:00', 'end', '18:00', 'weekdays_only', true))
+    -- N\xE3o oficial. Aqui n\xE3o h\xE1 teto do provedor \u2014 h\xE1 banimento. Os n\xFAmeros s\xE3o
+    -- a moda de treze rampas brasileiras publicadas: 10-30/dia na primeira
+    -- semana, 200-300/dia no regime. Atraso ALEAT\xD3RIO entre 15 e 45 s porque
+    -- intervalo fixo \xE9 assinatura de rob\xF4.
+    WHEN 'evolution' THEN jsonb_build_object(
+      'per_minute', 12, 'per_hour', 300, 'per_day', 250,
+      'delay_seconds', jsonb_build_array(15, 45),
+      'same_recipient_seconds', 6,
+      'batch_size', 50, 'batch_cooldown_minutes', 12,
+      'hours', jsonb_build_object('start', '09:00', 'end', '18:00', 'weekdays_only', true))
+    ELSE '{}'::jsonb END
+$$;
+
+COMMENT ON FUNCTION public.conversations_default_pacing(text) IS
+  'O ritmo inicial de cada provedor. Tyxter: o teto \xE9 da Meta, aqui s\xF3 o ritmo instant\xE2neo. Evolution: n\xE3o h\xE1 teto, h\xE1 banimento (003).';
+
+-- A rampa de aquecimento, em dias. Pr\xE1tica de comunidade, edit\xE1vel \u2014 e a
+-- fun\xE7\xE3o existe para que o padr\xE3o seja UM lugar e n\xE3o uma constante copiada.
+CREATE OR REPLACE FUNCTION public.conversations_warmup_allowance(p_day integer)
+RETURNS integer LANGUAGE sql IMMUTABLE AS $$
+  SELECT CASE
+    WHEN p_day IS NULL THEN NULL      -- n\xFAmero sem aquecimento declarado: sem teto extra
+    WHEN p_day <= 3  THEN 20
+    WHEN p_day <= 7  THEN 50
+    WHEN p_day <= 14 THEN 100
+    WHEN p_day <= 21 THEN 200
+    ELSE 300
+  END
+$$;
+
+COMMENT ON FUNCTION public.conversations_warmup_allowance(integer) IS
+  'Quantos destinat\xE1rios NOVOS por dia, por dia de aquecimento. Moda de treze rampas brasileiras publicadas \u2014 comunidade, n\xE3o Meta. Padr\xE3o edit\xE1vel (003).';
+
+-- \u2500\u2500 o que a tela do disparo precisa ver \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+DROP VIEW IF EXISTS public.v_conversations_campaign_progress;
+CREATE VIEW public.v_conversations_campaign_progress
+WITH (security_invoker = true) AS
+  SELECT c.id AS campaign_id,
+         c.tenant_id,
+         c.name,
+         c.status,
+         c.paused_reason,
+         c.provider,
+         count(t.id)                                              AS total,
+         count(*) FILTER (WHERE t.state = 'queued')               AS queued,
+         count(*) FILTER (WHERE t.state = 'sending')              AS sending,
+         count(*) FILTER (WHERE t.state IN ('sent','delivered','read','replied')) AS sent,
+         count(*) FILTER (WHERE t.state = 'delivered')            AS delivered,
+         count(*) FILTER (WHERE t.state = 'read')                 AS read,
+         count(*) FILTER (WHERE t.state = 'replied')              AS replied,
+         count(*) FILTER (WHERE t.state = 'failed')               AS failed,
+         count(*) FILTER (WHERE t.state = 'skipped')              AS skipped,
+         -- A taxa de resposta \xE9 o sinal que decide se o n\xFAmero sobrevive: a
+         -- pr\xE1tica diz que abaixo de 30% o risco de banimento sobe. Fica na
+         -- view porque \xE9 o n\xFAmero que precisa estar na tela, n\xE3o num relat\xF3rio.
+         CASE WHEN count(*) FILTER (WHERE t.state IN ('sent','delivered','read','replied')) > 0
+              THEN round(100.0 * count(*) FILTER (WHERE t.state = 'replied')
+                         / count(*) FILTER (WHERE t.state IN ('sent','delivered','read','replied')), 1)
+         END                                                      AS reply_rate,
+         min(t.sent_at)                                           AS first_sent_at,
+         max(t.sent_at)                                           AS last_sent_at
+    FROM public.plg_conversations_campaigns c
+    LEFT JOIN public.plg_conversations_campaign_targets t ON t.campaign_id = c.id
+   WHERE c.tenant_id IN (SELECT public.user_tenant_ids())
+   GROUP BY c.id, c.tenant_id, c.name, c.status, c.paused_reason, c.provider;
+
+GRANT SELECT ON public.v_conversations_campaign_progress TO authenticated;
+
+-- \u2500\u2500 arrendar o pr\xF3ximo lote \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- \`FOR UPDATE SKIP LOCKED\` \xE9 o que deixa dois disparadores trabalharem a mesma
+-- campanha sem pisar um no outro, e sem advisory lock. O arrendamento de cinco
+-- minutos \xE9 o que devolve a linha quando um deles morre no meio.
+--
+-- A supress\xE3o \xE9 conferida AQUI, na mesma transa\xE7\xE3o que arrenda. Conferir antes
+-- e mandar depois deixa uma janela em que algu\xE9m pede para sair e recebe assim
+-- mesmo \u2014 e \xE9 justamente essa mensagem que vira den\xFAncia.
+CREATE OR REPLACE FUNCTION public.conversations_claim_targets(
+  p_campaign uuid, p_limit integer DEFAULT 10
+) RETURNS TABLE (
+  id uuid, phone_e164 text, person_id uuid, variables jsonb, claim_token uuid
+)
+LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
+AS $$
+DECLARE v_token uuid := gen_random_uuid(); v_tenant uuid;
+BEGIN
+  SELECT c.tenant_id INTO v_tenant
+    FROM public.plg_conversations_campaigns c WHERE c.id = p_campaign;
+  IF v_tenant IS NULL THEN RAISE EXCEPTION 'campanha n\xE3o encontrada'; END IF;
+
+  -- TR\xCAS COMANDOS, E N\xC3O UM. A primeira vers\xE3o fazia o ceifeiro, a supress\xE3o e
+  -- o arrendamento em CTEs do mesmo UPDATE, e isso \xE9 uma armadilha: dentro de
+  -- um comando s\xF3, todas as CTEs enxergam o MESMO instant\xE2neo da tabela, e uma
+  -- linha atualizada por duas delas recebe s\xF3 a primeira \u2014 em sil\xEAncio. O
+  -- suprimido vinha marcado E arrendado, e qual dos dois vencia dependia do
+  -- plano que o Postgres escolhesse naquele dia.
+  --
+  -- Separado, cada passo enxerga o resultado do anterior. \xC9 mais lento por um
+  -- par de milissegundos e \xE9 a diferen\xE7a entre uma regra e uma coincid\xEAncia.
+
+  -- 1. O ceifeiro. Quem venceu o arrendamento volta para a fila, sen\xE3o uma
+  --    campanha inteira fica presa num processo que morreu.
+  UPDATE public.plg_conversations_campaign_targets t
+     SET state = 'queued', claim_token = NULL, claim_expires_at = NULL
+   WHERE t.campaign_id = p_campaign AND t.state = 'sending'
+     AND t.claim_expires_at < now();
+
+  -- 2. Quem pediu para sair NUNCA entra num lote. A linha fica marcada em vez
+  --    de sumir: \xE9 assim que se prova que a decis\xE3o foi deliberada.
+  UPDATE public.plg_conversations_campaign_targets t
+     SET state = 'skipped', skip_reason = 'suppressed'
+   WHERE t.campaign_id = p_campaign AND t.state = 'queued'
+     AND EXISTS (SELECT 1 FROM public.plg_conversations_optouts o
+                  WHERE o.tenant_id = t.tenant_id
+                    AND o.phone_e164 = t.phone_e164
+                    AND o.active);
+
+  -- 3. S\xF3 ent\xE3o arrenda. \`SKIP LOCKED\` deixa dois disparadores trabalharem a
+  --    mesma campanha sem pisar um no outro, e sem advisory lock.
+  RETURN QUERY
+  WITH escolhidos AS (
+    SELECT t.id FROM public.plg_conversations_campaign_targets t
+     WHERE t.campaign_id = p_campaign AND t.state = 'queued'
+     ORDER BY t.queued_at
+     LIMIT greatest(1, least(coalesce(p_limit, 10), 100))
+     FOR UPDATE SKIP LOCKED
+  )
+  UPDATE public.plg_conversations_campaign_targets t
+     SET state = 'sending', claim_token = v_token,
+         claim_expires_at = now() + interval '5 minutes'
+    FROM escolhidos e
+   WHERE t.id = e.id
+  RETURNING t.id, t.phone_e164, t.person_id, t.variables, t.claim_token;
+END $$;
+
+REVOKE ALL ON FUNCTION public.conversations_claim_targets(uuid, integer) FROM PUBLIC, anon;
+GRANT EXECUTE ON FUNCTION public.conversations_claim_targets(uuid, integer) TO service_role;
+`;
+var MIGRATION_004_A_TELA_SABE_SE_PODE_FALAR_ANTES_DE_DEIXAR_ESCREVER = `-- ---------------------------------------------------------------------------
+-- 004_a_tela_sabe_se_pode_falar_antes_de_deixar_escrever.sql \u2014 a janela de 24h,
+-- como DADO, para a tela responder antes de algu\xE9m digitar.
+--
+-- \u2500\u2500 o defeito que isto conserta \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- Na API oficial do WhatsApp, texto livre s\xF3 sai dentro de 24h contadas da
+-- \xFAltima mensagem DO CLIENTE. Fora dela a Meta recusa, e a recusa chega como um
+-- c\xF3digo no log \u2014 n\xE3o na tela de quem escreveu. O atendente digita, aperta
+-- enviar, v\xEA a mensagem aparecer na conversa, e ela nunca chega.
+--
+-- Isso \xE9 pior que um erro: \xE9 uma tela que mente. E some inteiro num provedor
+-- n\xE3o oficial, onde n\xE3o existe janela nenhuma \u2014 ent\xE3o o MESMO campo de texto
+-- funciona ou falha calado dependendo de qual provedor est\xE1 ativo.
+--
+-- A corre\xE7\xE3o n\xE3o \xE9 um aviso depois. \xC9 a tela saber ANTES: janela aberta, texto
+-- livre; janela fechada, s\xF3 template, e o campo diz isso em vez de aceitar.
+--
+-- \u2500\u2500 quem abre a janela \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- O CLIENTE, e s\xF3 ele. Mensagem nossa n\xE3o abre nada \u2014 nem template aprovado.
+-- \xC9 o erro mais comum de quem implementa isso, e \xE9 por isso que o c\xE1lculo
+-- abaixo olha exclusivamente \`direction = 'inbound'\`.
+--
+-- (Origem: developers.facebook.com/documentation/business-messaging/whatsapp \u2014
+-- "The user messages you about the product. This opens a 24 hour customer
+-- service window." Cliques em an\xFAncio Click-to-WhatsApp abrem 72h; n\xE3o
+-- distinguimos ainda, e 24h \xE9 o limite conservador dos dois.)
+-- ---------------------------------------------------------------------------
+
+DROP VIEW IF EXISTS public.v_conversations_window;
+CREATE VIEW public.v_conversations_window
+WITH (security_invoker = true) AS
+  SELECT c.id AS conversation_id,
+         c.tenant_id,
+         c.channel,
+         c.contact_handle,
+         c.contact_person_id,
+         u.last_inbound_at,
+         -- Quando fecha. Nulo = nunca abriu, que \xE9 o caso de todo lead que
+         -- ainda n\xE3o respondeu \u2014 a maioria de uma lista de feira.
+         (u.last_inbound_at + interval '24 hours') AS window_expires_at,
+         (u.last_inbound_at IS NOT NULL
+          AND u.last_inbound_at > now() - interval '24 hours') AS window_open,
+         -- Quanto falta, em minutos. A tela mostra "faltam 3h" e n\xE3o um
+         -- carimbo de data: quem est\xE1 respondendo quer saber se d\xE1 tempo.
+         CASE WHEN u.last_inbound_at IS NOT NULL
+              THEN greatest(0, floor(extract(epoch FROM
+                     (u.last_inbound_at + interval '24 hours') - now()) / 60))::int
+         END AS minutes_left,
+         -- Quem pediu para n\xE3o ser mais contatado. Some da tela antes de
+         -- qualquer janela: n\xE3o importa se est\xE1 aberta.
+         EXISTS (SELECT 1 FROM public.plg_conversations_optouts o
+                  WHERE o.tenant_id = c.tenant_id
+                    AND o.phone_e164 = regexp_replace(coalesce(c.contact_handle,''), '\\D', '', 'g')
+                    AND o.active) AS opted_out
+    FROM public.plg_conversations c
+    LEFT JOIN LATERAL (
+      SELECT max(m.at) AS last_inbound_at
+        FROM public.plg_conversation_messages m
+       WHERE m.conversation_id = c.id
+         AND m.direction = 'inbound'
+    ) u ON true
+   WHERE c.tenant_id IN (SELECT public.user_tenant_ids());
+
+GRANT SELECT ON public.v_conversations_window TO authenticated;
+
+COMMENT ON VIEW public.v_conversations_window IS
+  'Se d\xE1 para mandar texto livre para esta conversa agora. A janela de 24h s\xF3 abre por mensagem DO CLIENTE \u2014 template nosso n\xE3o abre nada (004).';
+
+-- O \xEDndice que a LATERAL usa. Sem ele, cada linha da caixa varre as mensagens
+-- da conversa inteira, e a caixa \xE9 justamente a tela que abre o dia todo.
+CREATE INDEX IF NOT EXISTS plg_conversation_messages_inbound_at
+  ON public.plg_conversation_messages (conversation_id, at DESC)
+  WHERE direction = 'inbound';
+`;
+var MIGRATION_005_A_CONVERSA_CONTA_AO_FUNIL_QUE_HOUVE_CONTATO = `-- ---------------------------------------------------------------------------
+-- 005_a_conversa_conta_ao_funil_que_houve_contato.sql \u2014 a ponte que faltava.
+--
+-- \u2500\u2500 o buraco, medido \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- No cluster: 8 conversas, 42 mensagens trocadas \u2014 incluindo respostas de
+-- gente de verdade \u2014 e 315 neg\xF3cios TODOS parados em "Novo (feira)", com
+-- \`contact_status = 'not_contacted'\`. Zero atividades vindas da caixa.
+--
+-- N\xE3o era defeito: n\xE3o existia liga\xE7\xE3o nenhuma. Nenhum \`INSERT\` em
+-- \`plg_crm_activities\` fora do plugin-crm, nenhuma fonte de linha do tempo
+-- registrada. A caixa de entrada e o funil olhavam para as mesmas pessoas e
+-- n\xE3o se falavam.
+--
+-- O maquin\xE1rio do CRM j\xE1 estava pronto e correto: \`crm_recompute_deal_status\`
+-- (crm/020) l\xEA as atividades, pega o \xDALTIMO \`outcome\` e deriva o status; o
+-- gatilho \`crm_activity_restatus\` dispara a cada atividade inserida. Faltava
+-- algu\xE9m inserir.
+--
+-- \u2500\u2500 por que o \`outcome\` \xE9 o que \xE9 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+--   mensagem RECEBIDA  \u2192 \`replied\`       o lead respondeu. \xC9 o fato mais forte
+--                                        que a caixa produz, e o que mais move
+--                                        o status ("Respondeu").
+--   mensagem ENVIADA   \u2192 \`left_message\`  deixamos recado. Mandar N\xC3O \xE9 ser
+--                                        lido: tratar envio como contato feito
+--                                        encheria o funil de "conectado" sem
+--                                        ningu\xE9m do outro lado. A 020 mapeia
+--                                        este valor para "N\xE3o atendeu", que \xE9
+--                                        literalmente o estado \u2014 ainda sem
+--                                        resposta.
+--
+-- O vocabul\xE1rio \xE9 FECHADO por CHECK (crm/020:49): \`connected, no_answer,
+-- left_message, replied, scheduled\`. Conferido antes de escrever \u2014 a primeira
+-- vers\xE3o desta migration usava \`attempted\`, que a regra da 020 nomeia mas a
+-- restri\xE7\xE3o da coluna N\xC3O aceita, e teria falhado em toda mensagem enviada.
+--
+-- \u2500\u2500 e o \`deal_id\` n\xE3o \xE9 opcional \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- \`crm_recompute_deal_status\` agrega \`WHERE a.deal_id = p_deal_id\`. Uma
+-- atividade s\xF3 com \`lead_id\` n\xE3o entra na conta e n\xE3o move status nenhum \u2014
+-- por isso o gatilho procura o neg\xF3cio do lead e o carimba.
+--
+-- \u2500\u2500 uma atividade por CONVERSA E POR DIA, n\xE3o por mensagem \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- Uma conversa de trinta mensagens n\xE3o s\xE3o trinta contatos: \xE9 um. Registrar
+-- cada mensagem encheria a linha do tempo de ru\xEDdo e afogaria o que importa \u2014
+-- a liga\xE7\xE3o, a visita, a proposta. Ent\xE3o a primeira mensagem do dia abre a
+-- atividade e as seguintes ATUALIZAM a mesma linha (o corpo mais recente, e o
+-- \`outcome\` mais forte do dia).
+--
+-- Atualizar tamb\xE9m dispara o \`crm_activity_restatus\` (o gatilho \xE9 INSERT OR
+-- UPDATE), ent\xE3o uma resposta que chega depois de um envio move o status no
+-- mesmo dia, que \xE9 o comportamento que se quer.
+--
+-- \u2500\u2500 e se o contato n\xE3o for um lead \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- \`contact_person_id\` \xE9 nulo enquanto ningu\xE9m casou o telefone com uma pessoa.
+-- A\xED n\xE3o h\xE1 a quem pendurar o fato e a fun\xE7\xE3o sai calada. N\xE3o inventa lead: a
+-- caixa recebe mensagem de entregador, de banco e de engano, e cada um deles
+-- viraria um card no funil de algu\xE9m.
+-- ---------------------------------------------------------------------------
+
+CREATE OR REPLACE FUNCTION public.conversations_log_crm_activity() RETURNS trigger
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO ''
+    AS $$
+DECLARE
+  v_tenant  uuid;
+  v_person  uuid;
+  v_canal   text;
+  v_deal    uuid;
+  v_outcome text;
+  v_titulo  text;
+  v_corpo   text;
+  v_dia     date := (NEW.at AT TIME ZONE 'UTC')::date;
+  v_ativ    uuid;
+BEGIN
+  -- Sem CRM montado n\xE3o h\xE1 o que escrever. \`to_regclass\` em vez de refer\xEAncia
+  -- direta porque conversas \xE9 plugin OPCIONAL e pode viver num cluster que n\xE3o
+  -- tem funil nenhum.
+  IF to_regclass('public.plg_crm_activities') IS NULL THEN RETURN NULL; END IF;
+
+  SELECT c.tenant_id, c.contact_person_id, c.channel
+    INTO v_tenant, v_person, v_canal
+    FROM public.plg_conversations c WHERE c.id = NEW.conversation_id;
+
+  IF v_person IS NULL THEN RETURN NULL; END IF;
+
+  SELECT d.id INTO v_deal
+    FROM public.plg_crm_deals d
+   WHERE d.tenant_id = v_tenant AND d.lead_id = v_person
+   ORDER BY d.created_at DESC LIMIT 1;
+
+  IF NEW.direction = 'inbound' THEN
+    v_outcome := 'replied';
+    v_titulo  := 'Respondeu no ' || coalesce(v_canal, 'canal');
+  ELSE
+    v_outcome := 'left_message';
+    v_titulo  := 'Mensagem enviada no ' || coalesce(v_canal, 'canal');
+  END IF;
+
+  v_corpo := left(coalesce(NEW.body, ''), 2000);
+
+  -- A atividade do dia, se j\xE1 houver.
+  SELECT a.id INTO v_ativ
+    FROM public.plg_crm_activities a
+   WHERE a.tenant_id = v_tenant
+     AND a.lead_id = v_person
+     AND a.activity_type = 'whatsapp'
+     AND (a.completed_at AT TIME ZONE 'UTC')::date = v_dia
+   ORDER BY a.completed_at DESC LIMIT 1;
+
+  IF v_ativ IS NULL THEN
+    INSERT INTO public.plg_crm_activities (
+      tenant_id, deal_id, lead_id, contact_id, activity_type,
+      title, description, outcome, completed_at, created_by_name
+    ) VALUES (
+      v_tenant, v_deal, v_person, v_person, 'whatsapp',
+      v_titulo, v_corpo, v_outcome, NEW.at,
+      -- Quem fez foi a caixa, n\xE3o uma pessoa: o autor em uuid seria mentira,
+      -- e "(sistema)" \xE9 a resposta honesta para quem l\xEA a linha do tempo.
+      'Caixa de entrada'
+    );
+  ELSE
+    UPDATE public.plg_crm_activities a SET
+      -- \`replied\` NUNCA \xE9 rebaixado por um envio posterior: o lead ter
+      -- respondido \xE9 o fato do dia, e mandar outra mensagem depois n\xE3o o
+      -- desfaz.
+      outcome      = CASE WHEN a.outcome = 'replied' THEN 'replied' ELSE v_outcome END,
+      title        = CASE WHEN a.outcome = 'replied' THEN a.title ELSE v_titulo END,
+      description  = v_corpo,
+      completed_at = NEW.at,
+      deal_id      = coalesce(a.deal_id, v_deal)
+    WHERE a.id = v_ativ;
+  END IF;
+
+  RETURN NULL;
+END $$;
+
+REVOKE ALL ON FUNCTION public.conversations_log_crm_activity() FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION public.conversations_log_crm_activity() TO authenticated, service_role;
+
+COMMENT ON FUNCTION public.conversations_log_crm_activity() IS
+  'Uma mensagem vira contato na linha do tempo do lead e do neg\xF3cio, e o status do card deriva disso pelo gatilho da crm/020. Uma atividade por conversa por dia (005).';
+
+-- AFTER: falhar ao registrar no CRM n\xE3o pode recusar uma mensagem que j\xE1
+-- chegou do provedor. A caixa \xE9 a fonte; o funil \xE9 quem escuta.
+DROP TRIGGER IF EXISTS conversations_log_crm_activity ON public.plg_conversation_messages;
+CREATE TRIGGER conversations_log_crm_activity
+  AFTER INSERT ON public.plg_conversation_messages
+  FOR EACH ROW EXECUTE FUNCTION public.conversations_log_crm_activity();
+
+-- O \xEDndice que a busca da atividade do dia usa. Sem ele, cada mensagem varre
+-- as atividades do inquilino inteiro \u2014 e mensagem \xE9 o que mais chega aqui.
+DO $$
+BEGIN
+  -- Guarda pela mesma raz\xE3o da fun\xE7\xE3o: conversas \xE9 opcional e pode viver sem
+  -- CRM. Um \xEDndice sobre tabela que n\xE3o existe recusa o arquivo inteiro.
+  IF to_regclass('public.plg_crm_activities') IS NULL THEN RETURN; END IF;
+  CREATE INDEX IF NOT EXISTS plg_crm_activities_lead_day
+    ON public.plg_crm_activities (tenant_id, lead_id, activity_type, completed_at DESC);
+END $$;
+`;
+var MIGRATION_006_A_CAIXA_AVISA_QUE_CHEGOU = `-- ---------------------------------------------------------------------------
+-- 006_a_caixa_avisa_que_chegou.sql
+--
+-- \u2500\u2500 o sil\xEAncio, e de onde ele vinha \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- A caixa recebia mensagens e ningu\xE9m era avisado. Sem som, sem contagem no
+-- menu, sem destaque na lista \u2014 e a suspeita natural \xE9 que falta a tela que
+-- avisa. N\xE3o faltava: o evento nunca sa\xEDa do banco.
+--
+-- \`plg_conversation_messages\` e \`plg_conversations\` n\xE3o estavam em
+-- \`supabase_realtime\`. A publica\xE7\xE3o existe (\`puballtables = false\`, ou seja,
+-- cada tabela entra nomeada) e nenhuma das duas fora nomeada. Qualquer cliente
+-- que assinasse \`postgres_changes\` sobre elas ficaria subscrito para sempre a
+-- um canal por onde nada passa \u2014 e subscrever com sucesso a um canal mudo \xE9 o
+-- modo de falhar mais convincente que h\xE1: o c\xF3digo parece certo, o console
+-- fica limpo, e nada acontece.
+--
+-- \u2500\u2500 as duas, e n\xE3o s\xF3 as mensagens \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- A mensagem \xE9 o que dispara o alerta; a CONVERSA \xE9 o que carrega o estado que
+-- a lista pinta (\`status\`, \`unread_count\`, \`last_message_direction\`). Publicar
+-- s\xF3 a primeira daria o som sem o badge parar de mentir depois de algu\xE9m ler.
+--
+-- \u2500\u2500 o RLS continua a valer \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- Publicar n\xE3o abre nada: o Realtime do Supabase aplica as pol\xEDticas da tabela
+-- por assinante, e quem n\xE3o pode ler a linha n\xE3o a recebe. O que a publica\xE7\xE3o
+-- decide \xE9 se o evento EXISTE, n\xE3o quem o v\xEA.
+--
+-- \u2500\u2500 idempotente, e silenciosa onde n\xE3o se aplica \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- \`ALTER PUBLICATION ... ADD TABLE\` rebenta se a tabela j\xE1 l\xE1 est\xE1, e a
+-- publica\xE7\xE3o \`supabase_realtime\` s\xF3 existe num Postgres da Supabase. As duas
+-- condi\xE7\xF5es s\xE3o verificadas antes, porque esta migration tamb\xE9m roda no banco
+-- de teste, que n\xE3o tem nenhuma delas.
+-- ---------------------------------------------------------------------------
+
+DO $$
+DECLARE
+  t text;
+  v_n integer := 0;
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_publication WHERE pubname = 'supabase_realtime') THEN
+    RAISE NOTICE 'conversations/006: sem publica\xE7\xE3o supabase_realtime \u2014 nada a fazer';
+    RETURN;
+  END IF;
+
+  FOREACH t IN ARRAY ARRAY['plg_conversation_messages', 'plg_conversations'] LOOP
+    CONTINUE WHEN to_regclass('public.' || t) IS NULL;
+    CONTINUE WHEN EXISTS (
+      SELECT 1 FROM pg_publication_tables
+       WHERE pubname = 'supabase_realtime' AND schemaname = 'public' AND tablename = t);
+    EXECUTE format('ALTER PUBLICATION supabase_realtime ADD TABLE public.%I', t);
+    v_n := v_n + 1;
+  END LOOP;
+
+  RAISE NOTICE 'conversations/006: % tabela(s) publicada(s) no realtime', v_n;
+END $$;
+
+-- \`REPLICA IDENTITY FULL\` na conversa: sem ela o UPDATE chega com a chave
+-- prim\xE1ria e mais nada, e a tela n\xE3o consegue saber que \`unread_count\` mudou \u2014
+-- que \xE9 exatamente o UPDATE que interessa aqui. Na tabela de mensagens n\xE3o \xE9
+-- preciso: o que importa \xE9 o INSERT, e esse vem inteiro de qualquer forma.
+DO $$
+BEGIN
+  IF to_regclass('public.plg_conversations') IS NOT NULL THEN
+    ALTER TABLE public.plg_conversations REPLICA IDENTITY FULL;
+  END IF;
+END $$;
+
+-- \u2500\u2500 e a conta de n\xE3o lidas, que ningu\xE9m mantinha \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- \`unread_count\` estava em ZERO nas oito conversas do cluster, incluindo as
+-- quatro cuja \xFAltima mensagem \xE9 de entrada. N\xE3o era um zero verdadeiro: n\xE3o h\xE1
+-- (n\xE3o havia) nada que a incremente. A coluna existe desde a baseline, a tela
+-- da lista decide o destaque por ela (\`unreadCount > 0\`) e a RPC de marcar como
+-- lida zera-a \u2014 s\xF3 faltava o lado que soma.
+--
+-- Por isso \`isWaitingOnUs\` recorre a \`lastMessageDirection\` quando a conta \xE9
+-- zero: foi escrita j\xE1 sabendo que a conta n\xE3o era de fiar. Esta migration
+-- torna-a de fiar, e a recorr\xEAncia volta a ser o que devia ser \u2014 uma rede, e
+-- n\xE3o o caminho normal.
+--
+-- S\xF3 o que CHEGA conta. Somar o que n\xF3s enviamos faria a caixa dizer que h\xE1
+-- doze por ler logo depois de algu\xE9m responder doze vezes.
+CREATE OR REPLACE FUNCTION public.plg_conversations_bump_unread() RETURNS trigger
+    LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
+    AS $$
+BEGIN
+  IF NEW.direction IS DISTINCT FROM 'inbound' THEN RETURN NULL; END IF;
+  UPDATE public.plg_conversations
+     SET unread_count = coalesce(unread_count, 0) + 1
+   WHERE id = NEW.conversation_id;
+  RETURN NULL;
+END $$;
+
+REVOKE ALL ON FUNCTION public.plg_conversations_bump_unread() FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION public.plg_conversations_bump_unread() TO authenticated, service_role;
+
+COMMENT ON FUNCTION public.plg_conversations_bump_unread() IS
+  'Soma uma n\xE3o lida por mensagem que CHEGA. A coluna existia e era zerada ao ler, mas nada a incrementava (006).';
+
+-- AFTER, como o irm\xE3o que carimba a dire\xE7\xE3o: falhar a contar n\xE3o pode recusar
+-- uma mensagem que o provedor j\xE1 entregou.
+DROP TRIGGER IF EXISTS plg_conversation_messages_bump_unread ON public.plg_conversation_messages;
+CREATE TRIGGER plg_conversation_messages_bump_unread
+  AFTER INSERT ON public.plg_conversation_messages
+  FOR EACH ROW EXECUTE FUNCTION public.plg_conversations_bump_unread();
+
+-- O retroativo, e o que ele pode e n\xE3o pode saber.
+--
+-- N\xE3o h\xE1 coluna de "lido at\xE9 quando" nesta tabela \u2014 \`markRead\` zera a conta e
+-- mais nada. Ent\xE3o n\xE3o d\xE1 para reconstituir quantas mensagens ficaram por ler:
+-- o que d\xE1 para saber \xE9 que a conversa EST\xC1 \xE0 espera, porque a \xFAltima mensagem
+-- dela \xE9 de entrada.
+--
+-- Nesse caso a conta vira 1. Um n\xFAmero inventado seria pior que um n\xFAmero
+-- modesto: 1 diz "h\xE1 algo aqui", que \xE9 verdade e \xE9 o que faz a linha destacar;
+-- dizer "7" alegaria uma precis\xE3o que esta tabela nunca guardou. A partir de
+-- agora o gatilho conta de verdade.
+UPDATE public.plg_conversations
+   SET unread_count = 1
+ WHERE last_message_direction = 'inbound'
+   AND status = 'open'
+   AND coalesce(unread_count, 0) = 0;
+`;
+var MIGRATION_007_A_CONVERSA_DIZ_DE_QUEM_E_O_LEAD = `-- ---------------------------------------------------------------------------
+-- 007_a_conversa_diz_de_quem_e_o_lead.sql
+--
+-- \u2500\u2500 duas coisas chamadas "respons\xE1vel" \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- A caixa j\xE1 mostra um "Respons\xE1vel", e ele \xE9 \`plg_conversations.assigned_to\`:
+-- quem est\xE1 ATENDENDO aquela conversa. N\xE3o \xE9 o dono do lead.
+--
+-- Os dois convivem e precisam conviver: a Carolina \xE9 dona do lead, e quem
+-- responde a mensagem que chegou \xE0s 2h da manh\xE3 pode ser outra pessoa. Colapsar
+-- num s\xF3 campo faria uma das duas perguntas ficar sem resposta \u2014 e a que
+-- desapareceria \xE9 a do funil, que \xE9 a que decide quem faz o follow-up.
+--
+-- Esta view acrescenta a SEGUNDA, com nome pr\xF3prio (\`lead_owner_*\`), sem tocar
+-- na primeira.
+--
+-- \u2500\u2500 por que view, e n\xE3o uma coluna na conversa \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- O dono do lead muda \u2014 algu\xE9m clica "Assumir" no funil e a carteira troca de
+-- m\xE3os. Uma coluna copiada aqui seria uma segunda verdade que envelhece em
+-- sil\xEAncio: a conversa diria Carolina depois de o lead j\xE1 ser do Julio, e
+-- ningu\xE9m saberia dizer qual das duas telas est\xE1 certa.
+--
+-- \xC9 exatamente o problema que a 047 acabou de resolver do outro lado, onde o
+-- dono estava escrito em dois lugares que n\xE3o se falavam. Derivar \xE9 o que
+-- impede a repeti\xE7\xE3o.
+--
+-- \u2500\u2500 e por que \`v_leads\` e n\xE3o \`plg_crm_deals\` \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- \`v_leads.assigned_to_id\` j\xE1 resolve a preced\xEAncia entre o que a PESSOA
+-- declara (\`metadata.assignedToId\`) e o que o NEG\xD3CIO diz (047). Ir direto ao
+-- neg\xF3cio aqui reimplementaria essa regra, e as duas divergiriam no dia em que
+-- uma mudasse.
+--
+-- \u2500\u2500 o CRM \xE9 opcional \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- \`plugin-conversations\` roda em casa sem funil nenhum. \`v_leads\` \xE9 da espinha
+-- (n\xE3o do CRM), ent\xE3o a depend\xEAncia \xE9 leg\xEDtima \u2014 mas a jun\xE7\xE3o \xE9 LEFT: uma
+-- conversa de quem n\xE3o \xE9 lead continua aparecendo, com o dono nulo.
+-- ---------------------------------------------------------------------------
+
+CREATE OR REPLACE VIEW public.v_conversations WITH (security_invoker = true) AS
+  SELECT c.*,
+         l.assigned_to_id AS lead_owner_id,
+         p.name           AS lead_owner_name
+    FROM public.plg_conversations c
+    -- Pelo contato: \xE9 \`contact_person_id\` que liga a conversa a uma pessoa da
+    -- base. Nulo enquanto ningu\xE9m casou o telefone com algu\xE9m, e a\xED n\xE3o h\xE1
+    -- lead a quem perguntar o dono.
+    LEFT JOIN public.v_leads l
+           ON l.id = c.contact_person_id
+    -- O NOME do dono, que \xE9 o que a tela mostra. O id sozinho obrigaria cada
+    -- tela a resolver o mesmo de-para \u2014 foi o que fez o filtro de leads exibir
+    -- UUID em produ\xE7\xE3o por um dia.
+    LEFT JOIN public.v_team_members m
+           ON m.user_id::text = l.assigned_to_id AND m.tenant_id = c.tenant_id
+    LEFT JOIN public.people p
+           ON p.id = m.person_id;
+
+COMMENT ON VIEW public.v_conversations IS
+  'A conversa com o DONO DO LEAD junto \u2014 diferente de \`assigned_to\`, que \xE9 quem atende a conversa. Derivado de \`v_leads\` para n\xE3o virar uma segunda verdade que envelhece (007).';
+`;
+var MIGRATION_008_DAR_POR_VISTA_E_UMA_DECISAO = `-- ---------------------------------------------------------------------------
+-- 008_dar_por_vista_e_uma_decisao.sql
+--
+-- \u2500\u2500 o buraco \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- A bolinha vermelha da caixa n\xE3o \xE9 "n\xE3o lido": \xE9 \`isWaitingOnUs\`, que olha a
+-- DIRE\xC7\xC3O da \xFAltima mensagem. Se a \xFAltima \xE9 de entrada, a conversa espera
+-- resposta \u2014 e continua esperando por mais que algu\xE9m abra e leia.
+--
+-- Isso est\xE1 certo enquanto a pergunta \xE9 "o que falta responder". Mas deixa sem
+-- sa\xEDda o caso comum: a pessoa leu, decidiu que n\xE3o cabe resposta ("ok",
+-- "obrigado", um \xE1udio que j\xE1 foi tratado por telefone) e n\xE3o tem como tirar a
+-- conversa da fila. \`unread_count = 0\` n\xE3o resolve, porque n\xE3o \xE9 ele que
+-- acende a bolinha.
+--
+-- \u2500\u2500 por que um instante, e n\xE3o um booleano \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- \`lida boolean\` exigiria algu\xE9m lembrar de apag\xE1-la quando chegasse mensagem
+-- nova \u2014 e o dia em que esquecessem, a conversa sumiria da fila com o cliente
+-- esperando. \xC9 o pior defeito poss\xEDvel numa caixa de entrada: silencioso, e do
+-- lado de perder trabalho.
+--
+-- Um INSTANTE se compara com \`last_message_at\` e se invalida sozinho: deu por
+-- vista \xE0s 14h, chegou mensagem \xE0s 15h, a conversa volta \xE0 fila sem ningu\xE9m
+-- fazer nada. A regra \xE9 uma compara\xE7\xE3o, n\xE3o um estado a manter.
+--
+-- \u2500\u2500 o que N\xC3O muda \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- \`unread_count\` continua onde est\xE1. Ele conta mensagens e serve ao contador
+-- do menu; esta coluna responde outra pergunta ("algu\xE9m j\xE1 decidiu sobre
+-- isto?"). Colapsar as duas faria a contagem do menu mentir no dia em que
+-- algu\xE9m desse por vista sem ler.
+--
+-- Idempotente e replay-safe.
+-- ---------------------------------------------------------------------------
+
+ALTER TABLE public.plg_conversations
+  ADD COLUMN IF NOT EXISTS acknowledged_at timestamptz;
+
+COMMENT ON COLUMN public.plg_conversations.acknowledged_at IS
+  'Quando algu\xE9m deu a conversa por vista. Vale enquanto for POSTERIOR a \`last_message_at\` \u2014 mensagem nova devolve a conversa \xE0 fila sozinha (008).';
+
+-- A fila \xE9 lida por \`last_message_at\` e por esta coluna juntas.
+CREATE INDEX IF NOT EXISTS plg_conversations_fila_idx
+  ON public.plg_conversations (tenant_id, status, last_message_at DESC)
+  WHERE status = 'open';
+`;
+var MIGRATION_009_A_MENSAGEM_INTEIRA_ATRAVESSA_O_REALTIME = `-- ---------------------------------------------------------------------------
+-- 009_a_mensagem_inteira_atravessa_o_realtime.sql
+--
+-- \u2500\u2500 o buraco \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- O vigia da caixa assinava \`plg_conversation_messages\`, recebia \`SUBSCRIBED\`
+-- do servidor, e nunca recebia um \xFAnico evento. Nenhum erro, nenhum aviso: a
+-- assinatura dizia que estava tudo bem e n\xE3o chegava nada.
+--
+-- A causa \xE9 a combina\xE7\xE3o de duas coisas que, sozinhas, est\xE3o certas:
+--
+--   1. a tabela tem RLS ligada, como toda tabela desta base;
+--   2. a tabela estava com \`REPLICA IDENTITY\` no padr\xE3o \u2014 s\xF3 a chave prim\xE1ria.
+--
+-- O Realtime do Supabase aplica a POL\xCDTICA DE LEITURA do usu\xE1rio a cada evento
+-- antes de entreg\xE1-lo. Para isso ele precisa da linha inteira: a pol\xEDtica fala
+-- de \`tenant_id\`, e \`tenant_id\` n\xE3o \xE9 a chave prim\xE1ria. Com s\xF3 a PK no WAL, n\xE3o
+-- h\xE1 o que avaliar \u2014 e o evento \xE9 descartado sem ru\xEDdo.
+--
+-- \`plg_conversations\` j\xE1 estava \`FULL\` (006). A tabela de MENSAGENS ficou de
+-- fora daquela migration, e \xE9 justamente ela que o vigia escuta.
+--
+-- \u2500\u2500 por que isso \xE9 caro e ainda assim certo \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- \`FULL\` faz o WAL carregar a linha inteira em cada UPDATE e DELETE, n\xE3o s\xF3 as
+-- colunas mudadas. Numa tabela de mensagens isso \xE9 peso real.
+--
+-- A alternativa \u2014 desligar a RLS para o Realtime enxergar \u2014 trocaria um custo
+-- de disco por um vazamento: as mensagens de uma casa chegariam ao navegador
+-- de outra. Entre pagar WAL e vazar conversa, paga-se o WAL.
+--
+-- Idempotente e replay-safe.
+-- ---------------------------------------------------------------------------
+
+ALTER TABLE public.plg_conversation_messages REPLICA IDENTITY FULL;
+
+-- Garante a publica\xE7\xE3o tamb\xE9m \u2014 uma tabela com identidade cheia e fora da
+-- publica\xE7\xE3o continua sem emitir nada, e o sintoma seria id\xEAntico.
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_publication_tables
+     WHERE pubname = 'supabase_realtime'
+       AND schemaname = 'public'
+       AND tablename = 'plg_conversation_messages'
+  ) THEN
+    EXECUTE 'ALTER PUBLICATION supabase_realtime ADD TABLE public.plg_conversation_messages';
+  END IF;
+END $$;
+`;
+var MIGRATION_010_A_CHEGADA_E_ANUNCIADA_POR_CONTA = `-- ---------------------------------------------------------------------------
+-- 010_a_chegada_e_anunciada_por_conta.sql
+--
+-- \u2500\u2500 por que \`postgres_changes\` nunca funcionou aqui \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- O vigia assinava a TABELA de mensagens e recebia \`SUBSCRIBED\` do servidor.
+-- Nenhum evento chegava. Nenhum erro, nenhum aviso \u2014 a assinatura dizia que
+-- estava tudo bem.
+--
+-- O Realtime aplica a pol\xEDtica de leitura a cada evento antes de entreg\xE1-lo. A
+-- pol\xEDtica desta base resolve o tenant por, nesta ordem:
+--
+--   \u2460 a claim \`tenant_id\` do JWT
+--   \u2461 o CABE\xC7ALHO da requisi\xE7\xE3o (\`app.requested_tenant()\`)
+--   \u2462 a filia\xE7\xE3o \xFAnica, quando a pessoa s\xF3 tem uma
+--
+-- O Realtime manda o JWT e N\xC3O manda cabe\xE7alho. E o JWT desta casa n\xE3o carrega
+-- \`tenant_id\` \u2014 a conta ativa \xE9 escolhida por cabe\xE7alho, porque a mesma pessoa
+-- atende sete contas. Sobra \u2462, que devolve nulo para quem tem mais de uma.
+--
+-- Resultado: a pol\xEDtica recusa, o evento \xE9 descartado em sil\xEAncio, e o defeito
+-- parece "o realtime n\xE3o funciona" quando na verdade \xE9 "o realtime n\xE3o sabe em
+-- que conta voc\xEA est\xE1".
+--
+-- \u2500\u2500 a sa\xEDda: anunciar, em vez de espiar a tabela \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- Broadcast n\xE3o passa pela RLS da tabela: o servidor entrega a quem est\xE1 no
+-- T\xD3PICO. Ent\xE3o o t\xF3pico carrega a conta no nome \u2014 \`conversas:<tenant>\` \u2014 e
+-- quem escuta j\xE1 teve de saber em que conta est\xE1 para montar o nome.
+--
+-- Isso inverte a depend\xEAncia de forma saud\xE1vel: em vez de o banco adivinhar o
+-- contexto do navegador, o navegador declara o contexto que j\xE1 tem.
+--
+-- \u2500\u2500 o que vai no an\xFAncio \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- O M\xCDNIMO para decidir: id da conversa, canal, e um trecho. N\xE3o a mensagem
+-- inteira \u2014 um broadcast \xE9 entregue a todos do t\xF3pico, e mandar o corpo
+-- completo por ali seria espalhar conversa por um caminho que n\xE3o \xE9 o que
+-- guarda conversa. Quem quiser o texto l\xEA a tabela, com RLS, como sempre.
+--
+-- Idempotente e replay-safe.
+-- ---------------------------------------------------------------------------
+
+CREATE OR REPLACE FUNCTION public.plg_conversations_anunciar_chegada()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = ''
+AS $$
+DECLARE
+  v_nome text;
+BEGIN
+  -- S\xF3 o que CHEGA. A resposta que o operador manda tamb\xE9m \xE9 um INSERT, e
+  -- anunci\xE1-la faria o sistema apitar para quem acabou de digitar.
+  IF NEW.direction IS DISTINCT FROM 'inbound' THEN
+    RETURN NEW;
+  END IF;
+
+  SELECT c.contact_name INTO v_nome
+    FROM public.plg_conversations c
+   WHERE c.id = NEW.conversation_id;
+
+  PERFORM realtime.send(
+    jsonb_build_object(
+      'conversationId', NEW.conversation_id,
+      'channel',        NEW.channel,
+      'contactName',    coalesce(v_nome, ''),
+      -- Um trecho, n\xE3o o corpo: o suficiente para a notifica\xE7\xE3o do sistema
+      -- dizer do que se trata sem espalhar a conversa pelo broadcast.
+      'preview',        left(coalesce(NEW.body, ''), 120),
+      'at',             NEW.at
+    ),
+    'inbound',
+    'conversas:' || NEW.tenant_id::text,
+    -- Privado: exige que quem assina esteja autenticado. P\xFAblico deixaria
+    -- qualquer um com o nome do t\xF3pico ouvir a chegada.
+    true
+  );
+  RETURN NEW;
+END $$;
+
+REVOKE ALL ON FUNCTION public.plg_conversations_anunciar_chegada() FROM public, anon, authenticated;
+
+DROP TRIGGER IF EXISTS plg_conversations_anunciar_chegada ON public.plg_conversation_messages;
+CREATE TRIGGER plg_conversations_anunciar_chegada
+  AFTER INSERT ON public.plg_conversation_messages
+  FOR EACH ROW EXECUTE FUNCTION public.plg_conversations_anunciar_chegada();
+
+COMMENT ON FUNCTION public.plg_conversations_anunciar_chegada() IS
+  'Anuncia a chegada no t\xF3pico \`conversas:<tenant>\`. Broadcast e n\xE3o \`postgres_changes\` porque a RLS da tabela resolve o tenant por cabe\xE7alho, e o Realtime n\xE3o manda cabe\xE7alho (010).';
+`;
+var MIGRATION_011_O_ANUNCIO_E_UMA_CAMPAINHA_NAO_UM_RECADO = `-- ---------------------------------------------------------------------------
+-- 011_o_anuncio_e_uma_campainha_nao_um_recado.sql
+--
+-- \u2500\u2500 por que a 010 n\xE3o podia ficar como estava \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- A 010 anunciava num t\xF3pico PRIVADO e mandava, no an\xFAncio, o nome do contato e
+-- um trecho da mensagem. T\xF3pico privado exige pol\xEDtica em \`realtime.messages\` \u2014
+-- e essa tabela \xE9 do Supabase, dona \`supabase_realtime_admin\`, um papel que
+-- esta conex\xE3o n\xE3o pode assumir:
+--
+--   ERROR: 42501: permission denied to set role "supabase_realtime_admin"
+--
+-- Sem a pol\xEDtica, o servidor recusa a assinatura e nada chega. Com o t\xF3pico
+-- p\xFAblico, qualquer um que soubesse o nome do t\xF3pico leria o trecho da
+-- conversa \u2014 o que n\xE3o se faz.
+--
+-- \u2500\u2500 a sa\xEDda: separar o AVISO do CONTE\xDADO \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- O an\xFAncio passa a ser uma campainha: diz que chegou algo e em que conversa,
+-- e mais nada. Nome e texto o navegador busca pela via de sempre \u2014 a tabela,
+-- com RLS, onde o cabe\xE7alho da conta existe e a pol\xEDtica funciona.
+--
+-- O t\xF3pico continua carregando o uuid da conta no nome, que \xE9 o que separa uma
+-- casa da outra. Ele n\xE3o \xE9 adivinh\xE1vel, e mesmo que fosse, o que se ouviria \xE9
+-- "chegou mensagem", sem nome nem texto. O sigilo fica onde sempre esteve: na
+-- leitura da tabela.
+--
+-- \xC9 uma troca deliberada de superf\xEDcie: em vez de tentar proteger um caminho
+-- novo, n\xE3o se p\xF5e nada sens\xEDvel nele.
+--
+-- Idempotente e replay-safe.
+-- ---------------------------------------------------------------------------
+
+CREATE OR REPLACE FUNCTION public.plg_conversations_anunciar_chegada()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = ''
+AS $$
+BEGIN
+  -- S\xF3 o que CHEGA. A resposta que o operador manda tamb\xE9m \xE9 um INSERT, e
+  -- anunci\xE1-la faria o sistema apitar para quem acabou de digitar.
+  IF NEW.direction IS DISTINCT FROM 'inbound' THEN
+    RETURN NEW;
+  END IF;
+
+  PERFORM realtime.send(
+    -- S\xD3 o id da conversa. Nem nome, nem trecho, nem corpo: quem ouve vai
+    -- buscar isso na tabela, com a pol\xEDtica de leitura no meio do caminho.
+    -- Um uuid sozinho n\xE3o conta nada a quem n\xE3o pode ler a conversa.
+    jsonb_build_object('conversationId', NEW.conversation_id),
+    'inbound',
+    'conversas:' || NEW.tenant_id::text,
+    -- P\xDABLICO, e por isso o payload \xE9 vazio de conte\xFAdo. Privado exigiria uma
+    -- pol\xEDtica numa tabela que n\xE3o \xE9 nossa.
+    false
+  );
+  RETURN NEW;
+END $$;
+
+COMMENT ON FUNCTION public.plg_conversations_anunciar_chegada() IS
+  'Toca a campainha no t\xF3pico \`conversas:<tenant>\` \u2014 s\xF3 o id da conversa. O conte\xFAdo \xE9 lido da tabela, com RLS (011).';
+`;
+var MIGRATION_012_A_RICH_MESSAGE_KEEPS_ITS_SHAPE = `-- ---------------------------------------------------------------------------
+-- 012_a_rich_message_keeps_its_shape.sql
+--
+-- \u2500\u2500 what was lost, and how \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- \`plg_conversation_messages\` has exactly one content column: \`body text\`. A
+-- WhatsApp message that is not text therefore arrives flattened to whatever
+-- string the ingest could make of it \u2014 and when the ingest could make none, to
+-- the empty string, which renders as an empty bubble.
+--
+-- On 2026-09-22 a lead sent his finance director's contact card. It stored as
+-- \`body = ''\`. He then sent a screenshot of the same card; that stored as
+-- \`body = ''\` too. The fact the conversation existed to obtain \u2014 a name and a
+-- phone number \u2014 was in the payload both times and in the row neither time.
+--
+-- Recovering it meant going back to the Evolution instance and reading the
+-- provider's own copy. That worked, but it is not a recovery path: Evolution
+-- prunes, the instance is local-only, and a row that needs a second system to
+-- be legible is not a record.
+--
+-- \u2500\u2500 the two columns \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- \`message_type\` names what the provider sent \u2014 text, contact, image, audio,
+-- document, sticker, location, reaction, unknown. The inbox needs it to choose
+-- a bubble, and \`unknown\` is the one that makes the NEXT gap visible in a query
+-- instead of in a complaint.
+--
+-- \`payload\` keeps the part that does not survive flattening: the vCard's parsed
+-- name and numbers, a media mimetype and size, a location's coordinates. Not
+-- the whole provider envelope \u2014 that carries decryption keys and a base64
+-- thumbnail, neither of which belongs in a row that every member of the tenant
+-- can read.
+--
+-- Deliberately NOT stored here: delivery status. It changes after the fact \u2014
+-- sent, delivered, read \u2014 and \`conversations-provider\`'s \`message_detail\` reads
+-- it live for that reason. \`payload\` is the shape of the message, which does
+-- not change once it arrives.
+--
+-- \u2500\u2500 why both are nullable, and nothing is backfilled \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- Every row written before this migration has neither, and no default can
+-- invent them: \`message_type\` would have to guess, and guessing 'text' for the
+-- three empty bubbles already in the table would assert something false about
+-- exactly the rows this exists to fix. A reader that treats NULL as "written
+-- before 012" is correct; a reader that treats '' as text is the bug.
+--
+-- Table-level \`GRANT ALL ... TO authenticated\` already covers new columns, and
+-- the four tenant policies are row-scoped, so neither needs restating.
+--
+-- Idempotent and replay-safe.
+-- ---------------------------------------------------------------------------
+
+ALTER TABLE public.plg_conversation_messages
+  ADD COLUMN IF NOT EXISTS message_type text,
+  ADD COLUMN IF NOT EXISTS payload jsonb;
+
+COMMENT ON COLUMN public.plg_conversation_messages.message_type IS
+  'What the provider sent: text, contact, image, video, audio, document, sticker, location, reaction, unknown. NULL means the row predates 012 (#504).';
+
+COMMENT ON COLUMN public.plg_conversation_messages.payload IS
+  'The structured remainder that \`body\` cannot hold \u2014 parsed vCards, media metadata, coordinates. Never credentials, thumbnails or decryption keys; never delivery status, which is read live (#504).';
+`;
+var MIGRATION_013_A_MIDIA_FICA_CONOSCO = `-- ---------------------------------------------------------------------------
+-- 013_a_midia_fica_conosco.sql
+--
+-- \u2500\u2500 o que a 012 resolveu, e o que ela n\xE3o resolveu \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- A 012 fez a mensagem que n\xE3o \xE9 texto parar de chegar como bolha vazia:
+-- \`message_type\` diz que \xE9 imagem, \`payload\` guarda mimetype, tamanho e
+-- dura\xE7\xE3o. Funcionou \u2014 um \xE1udio de 23 segundos entrou classificado como
+-- \`audio\`, \`ptt: true\`, \`audio/ogg; codecs=opus\`, 55.825 bytes.
+--
+-- E a tela mostra \`[\xE1udio]\`. Porque saber QUE existe um arquivo n\xE3o \xE9 ter o
+-- arquivo. Nada no banco aponta para bytes nenhuns: o WhatsApp entrega m\xEDdia
+-- cifrada num CDN pr\xF3prio, e quem decifra \xE9 o provedor.
+--
+-- \u2500\u2500 por que uma coluna, e n\xE3o um campo no payload \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- A 012 escreveu que \`payload\` \xE9 "a forma da mensagem, que n\xE3o muda depois que
+-- ela chega". Onde o arquivo foi parar \xE9 decidido DEPOIS \u2014 no upload, que pode
+-- falhar, ser refeito, ou ainda n\xE3o ter acontecido. Enfiar isso no \`payload\`
+-- contradiz a \xFAnica frase que diz quando \`payload\` pode ser lido sem medo.
+--
+-- Em coluna, a pergunta que importa vira consulta:
+--
+--   SELECT count(*) FROM plg_conversation_messages
+--    WHERE message_type IN ('image','video','audio','document','sticker')
+--      AND media_path IS NULL;
+--
+-- "quanta m\xEDdia eu recebi e n\xE3o guardei" \u2014 que num campo de JSON seria uma
+-- varredura e aqui \xE9 um \xEDndice.
+--
+-- \u2500\u2500 por que guardar, em vez de buscar no provedor quando algu\xE9m abrir \u2500\u2500\u2500
+--
+-- A Evolution decifra sob demanda, e seria mais barato n\xE3o copiar nada. Mas ela
+-- \xE9 local-only, poda o que \xE9 antigo, e a inst\xE2ncia roda numa m\xE1quina que nem
+-- sempre est\xE1 de p\xE9. Essa era exatamente a obje\xE7\xE3o da 012 contra depender dela
+-- para ler um vCard: uma linha que precisa de um segundo sistema para ser
+-- leg\xEDvel n\xE3o \xE9 registro. Vale igual para os bytes.
+--
+-- O destino \xE9 o balde \`attachments\` \u2014 privado, 25 MB, j\xE1 existente e j\xE1 em uso.
+-- Uma foto que um lead mandou no WhatsApp n\xE3o pode ser p\xFAblica, e um balde novo
+-- seria mais uma lista de mimetypes para algu\xE9m manter desatualizada.
+--
+-- \u2500\u2500 nulo \xE9 um estado leg\xEDtimo, n\xE3o uma falha \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- \`media_path\` \xE9 NULL em tr\xEAs situa\xE7\xF5es diferentes e todas normais: a mensagem
+-- \xE9 texto; a linha \xE9 anterior a esta migra\xE7\xE3o; ou o upload ainda n\xE3o aconteceu.
+-- Quem l\xEA distingue pela combina\xE7\xE3o com \`message_type\`, que \xE9 o que torna a
+-- consulta acima poss\xEDvel. Um default inventaria um caminho para arquivo que
+-- n\xE3o existe.
+--
+-- Idempotente e replay-safe.
+-- ---------------------------------------------------------------------------
+
+ALTER TABLE public.plg_conversation_messages
+  ADD COLUMN IF NOT EXISTS media_path text;
+
+COMMENT ON COLUMN public.plg_conversation_messages.media_path IS
+  'Onde os bytes ficaram no balde \`attachments\`, ou NULL: texto, linha anterior \xE0 013, ou upload que ainda n\xE3o aconteceu. Distingue-se pela combina\xE7\xE3o com \`message_type\` (013).';
+
+-- Parcial: s\xF3 a m\xEDdia sem arquivo interessa, e \xE9 a minoria. O \xEDndice fica do
+-- tamanho do problema em vez do tamanho da tabela.
+CREATE INDEX IF NOT EXISTS plg_conversation_messages_midia_sem_arquivo
+  ON public.plg_conversation_messages (tenant_id, at DESC)
+  WHERE media_path IS NULL
+    AND message_type IN ('image', 'video', 'audio', 'document', 'sticker');
+`;
+var MIGRATION_014_CLAIMING_TARGETS_IS_SERVER_ONLY = `-- 014_claiming_targets_is_server_only.sql
+--
+-- 003 revoked \`conversations_claim_targets\` from PUBLIC and anon but not from
+-- \`authenticated\`, which the pool's default privileges grant on every new
+-- function in public. Live, any signed-in user of any tenant could claim (and
+-- so burn) another tenant's campaign targets by uuid \u2014 SECURITY DEFINER, no
+-- caller check. The only caller is the conversations-provider edge function,
+-- which uses the service-role key.
+
+REVOKE ALL ON FUNCTION public.conversations_claim_targets(uuid, integer) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.conversations_claim_targets(uuid, integer) TO service_role;
+`;
+var MIGRATION_015_THE_SERVICE_DOOR_FOR_MESSAGING = `-- ============================================================================
+-- 015_the_service_door_for_messaging \u2014 the WhatsApp edge functions move to the
+-- integration service (ADR 0003 phase 2, wave 2).
+--
+-- Two kinds of table, two kinds of access:
+--
+--   * tenant tables a member already writes (conversations, messages,
+--     campaigns, templates): the service writes them AS the store's owner or
+--     as the verified caller (core migrations 210/212), under RLS. Nothing
+--     here.
+--   * service tables only a machine writes, which service_role wrote until
+--     now: provider credentials, channels, opt-outs, webhook events, provider
+--     templates, payment requests. fayz_integration gets exactly that, table
+--     by table, with an explicit policy. Panels keep their SELECT policies.
+--
+-- And the three server-only functions the webhooks call get EXECUTE for the
+-- service role (they were service_role only, 014).
+--
+-- Guarded: the role is an operator step. Replay-safe.
+-- ============================================================================
+
+DO $$
+DECLARE
+  t text;
+  f text;
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'fayz_integration') THEN
+    RETURN;
+  END IF;
+
+  FOREACH t IN ARRAY ARRAY[
+    'plg_conversations_providers',
+    'plg_conversations_channels',
+    'plg_conversations_optouts',
+    'plg_conversations_webhook_events',
+    'plg_automations_provider_templates',
+    'plg_conversations_payment_requests'
+  ] LOOP
+    IF to_regclass('public.' || t) IS NULL THEN CONTINUE; END IF;
+    EXECUTE format('GRANT SELECT, INSERT, UPDATE, DELETE ON public.%I TO fayz_integration', t);
+    EXECUTE format('DROP POLICY IF EXISTS %I ON public.%I', t || '_service', t);
+    EXECUTE format('CREATE POLICY %I ON public.%I FOR ALL TO fayz_integration USING (true) WITH CHECK (true)', t || '_service', t);
+  END LOOP;
+
+  FOREACH f IN ARRAY ARRAY[
+    'public.conversations_claim_targets(uuid, integer)',
+    'public.plg_booking_apply_channel_reply(uuid, text, uuid)',
+    'public.plg_conversations_match_by_phone(text, text, text, uuid)'
+  ] LOOP
+    IF to_regprocedure(f) IS NOT NULL THEN
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %s TO fayz_integration', f);
+    END IF;
+  END LOOP;
+END $$;
+`;
+var MIGRATION_016_A_DELIVERY_RECEIPT_FINDS_ITS_TENANT = `-- ============================================================================
+-- 016_a_delivery_receipt_finds_its_tenant \u2014 the Tyxter webhook moves to the
+-- integration service (ADR 0003 phase 2).
+--
+-- A delivery receipt names only the provider's message id. The service writes
+-- the inbox AS the store's owner (core 212), so it must learn the store first:
+-- this answers the tenant of the message that id was sent as, and nothing
+-- else. SECURITY DEFINER, service role only.
+--
+-- Replay-safe: CREATE OR REPLACE; guarded grants.
+-- ============================================================================
+
+CREATE OR REPLACE FUNCTION public.conversations_message_tenant(p_provider_message_id text) RETURNS uuid
+LANGUAGE sql STABLE SECURITY DEFINER SET search_path TO ''
+AS $function$
+  SELECT m.tenant_id
+    FROM public.plg_conversation_messages m
+   WHERE m.provider_message_id = p_provider_message_id
+   ORDER BY m.at DESC NULLS LAST
+   LIMIT 1;
+$function$;
+
+DO $$
+BEGIN
+  REVOKE ALL ON FUNCTION public.conversations_message_tenant(text) FROM PUBLIC;
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'anon') THEN REVOKE ALL ON FUNCTION public.conversations_message_tenant(text) FROM anon; END IF;
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'authenticated') THEN REVOKE ALL ON FUNCTION public.conversations_message_tenant(text) FROM authenticated; END IF;
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'service_role') THEN GRANT EXECUTE ON FUNCTION public.conversations_message_tenant(text) TO service_role; END IF;
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'fayz_integration') THEN GRANT EXECUTE ON FUNCTION public.conversations_message_tenant(text) TO fayz_integration; END IF;
+END $$;
+`;
+var MIGRATIONS = [
+  { id: "000_baseline", sql: MIGRATION_000_BASELINE },
+  { id: "001_a_caixa_sabe_quem_falou_por_ultimo", sql: MIGRATION_001_A_CAIXA_SABE_QUEM_FALOU_POR_ULTIMO },
+  { id: "002_a_casa_escolhe_por_onde_o_whatsapp_sai", sql: MIGRATION_002_A_CASA_ESCOLHE_POR_ONDE_O_WHATSAPP_SAI },
+  { id: "003_a_campanha_sai_no_ritmo_que_o_numero_aguenta", sql: MIGRATION_003_A_CAMPANHA_SAI_NO_RITMO_QUE_O_NUMERO_AGUENTA },
+  { id: "004_a_tela_sabe_se_pode_falar_antes_de_deixar_escrever", sql: MIGRATION_004_A_TELA_SABE_SE_PODE_FALAR_ANTES_DE_DEIXAR_ESCREVER },
+  { id: "005_a_conversa_conta_ao_funil_que_houve_contato", sql: MIGRATION_005_A_CONVERSA_CONTA_AO_FUNIL_QUE_HOUVE_CONTATO },
+  { id: "006_a_caixa_avisa_que_chegou", sql: MIGRATION_006_A_CAIXA_AVISA_QUE_CHEGOU },
+  { id: "007_a_conversa_diz_de_quem_e_o_lead", sql: MIGRATION_007_A_CONVERSA_DIZ_DE_QUEM_E_O_LEAD },
+  { id: "008_dar_por_vista_e_uma_decisao", sql: MIGRATION_008_DAR_POR_VISTA_E_UMA_DECISAO },
+  { id: "009_a_mensagem_inteira_atravessa_o_realtime", sql: MIGRATION_009_A_MENSAGEM_INTEIRA_ATRAVESSA_O_REALTIME },
+  { id: "010_a_chegada_e_anunciada_por_conta", sql: MIGRATION_010_A_CHEGADA_E_ANUNCIADA_POR_CONTA },
+  { id: "011_o_anuncio_e_uma_campainha_nao_um_recado", sql: MIGRATION_011_O_ANUNCIO_E_UMA_CAMPAINHA_NAO_UM_RECADO },
+  { id: "012_a_rich_message_keeps_its_shape", sql: MIGRATION_012_A_RICH_MESSAGE_KEEPS_ITS_SHAPE },
+  { id: "013_a_midia_fica_conosco", sql: MIGRATION_013_A_MIDIA_FICA_CONOSCO },
+  { id: "014_claiming_targets_is_server_only", sql: MIGRATION_014_CLAIMING_TARGETS_IS_SERVER_ONLY },
+  { id: "015_the_service_door_for_messaging", sql: MIGRATION_015_THE_SERVICE_DOOR_FOR_MESSAGING },
+  { id: "016_a_delivery_receipt_finds_its_tenant", sql: MIGRATION_016_A_DELIVERY_RECEIPT_FINDS_ITS_TENANT }
+];
+
+export { MIGRATIONS, MIGRATION_000_BASELINE, MIGRATION_001_A_CAIXA_SABE_QUEM_FALOU_POR_ULTIMO, MIGRATION_002_A_CASA_ESCOLHE_POR_ONDE_O_WHATSAPP_SAI, MIGRATION_003_A_CAMPANHA_SAI_NO_RITMO_QUE_O_NUMERO_AGUENTA, MIGRATION_004_A_TELA_SABE_SE_PODE_FALAR_ANTES_DE_DEIXAR_ESCREVER, MIGRATION_005_A_CONVERSA_CONTA_AO_FUNIL_QUE_HOUVE_CONTATO, MIGRATION_006_A_CAIXA_AVISA_QUE_CHEGOU, MIGRATION_007_A_CONVERSA_DIZ_DE_QUEM_E_O_LEAD, MIGRATION_008_DAR_POR_VISTA_E_UMA_DECISAO, MIGRATION_009_A_MENSAGEM_INTEIRA_ATRAVESSA_O_REALTIME, MIGRATION_010_A_CHEGADA_E_ANUNCIADA_POR_CONTA, MIGRATION_011_O_ANUNCIO_E_UMA_CAMPAINHA_NAO_UM_RECADO, MIGRATION_012_A_RICH_MESSAGE_KEEPS_ITS_SHAPE, MIGRATION_013_A_MIDIA_FICA_CONOSCO, MIGRATION_014_CLAIMING_TARGETS_IS_SERVER_ONLY, MIGRATION_015_THE_SERVICE_DOOR_FOR_MESSAGING, MIGRATION_016_A_DELIVERY_RECEIPT_FINDS_ITS_TENANT };
+//# sourceMappingURL=main.js.map
+//# sourceMappingURL=main.js.map