@fayz-ai/plugin-fiscal-br 0.2.5 → 0.3.1

package/dist/index.js

@@ -950,9 +950,638 @@ BEGIN
   RETURNING j.*;
 END $$;
 `;
+var MIGRATION_002_A_NOTA_QUE_CHEGA_TEM_ONDE_ESPERAR = `-- A nota que chega tem onde esperar.
+--
+-- O V1 recebe NF-e de fornecedor pela SEFAZ e guarda cada uma numa caixa de
+-- entrada antes de algu\xE9m decidir o que fazer com ela: manifestar, importar
+-- para o estoque, ou nada. Essa caixa n\xE3o tinha destino no V2.
+--
+--     dfe_inbox              703   a nota recebida, com o XML inteiro
+--     dfe_inbox_items      3.215   o item da nota, com todo o tributo
+--     dfe_inbox_payments     739   a forma de pagamento declarada
+--     dfe_inbox_duplicatas   830   o vencimento da duplicata
+--     fiscal_groups           11   o grupo fiscal (CFOP, CST, al\xEDquotas)
+--
+-- Os n\xFAmeros somam os dois tenants: Espa\xE7o Facial e Pertinho do C\xE9u. \xC9 o \xFAnico
+-- dom\xEDnio fiscal que os dois usam.
+--
+-- \u2500\u2500 O XML \xE9 arquivo, e arquivo mora em public.documents \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- \`dfe_inbox.xml_content\` \xE9 o XML inteiro numa coluna de texto, e
+-- \`pdf_storage_path\` aponta para o DANFE no storage do V1. Os dois s\xE3o ARQUIVO,
+-- e o V2 j\xE1 tem o arqu\xE9tipo: \`public.documents\`, com kind, checksum, storage_*
+-- e a RLS de arquivo que uma coluna de texto nunca teria.
+--
+-- Ent\xE3o a extens\xE3o guarda um PONTEIRO \u2014 \`document_id\` \u2014 e os bytes v\xE3o para o
+-- arqu\xE9tipo, pelo est\xE1gio de assets (\`make mig-assets\`), que \xE9 quem alcan\xE7a
+-- object storage. Enquanto os bytes n\xE3o chegam, \`document_id\` fica nulo e o
+-- caminho de origem fica em metadata: a linha \xE9 verdadeira nos dois momentos.
+--
+-- \u2500\u2500 O tributo vem inteiro, e de prop\xF3sito \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- 30 colunas de imposto por item (ICMS, ICMS-ST, PIS, COFINS, IPI, com base,
+-- al\xEDquota e valor de cada). \xC9 muita coluna, e a tenta\xE7\xE3o \xE9 jogar tudo num
+-- jsonb. N\xE3o: isto \xE9 documento fiscal recebido, e a pergunta que se faz dele \xE9
+-- "quanto de ICMS entrou neste m\xEAs" \u2014 uma soma, sobre coluna, com \xEDndice. Um
+-- jsonb transformaria toda apura\xE7\xE3o numa varredura.
+--
+-- O que VAI para jsonb \xE9 o \`raw_xml_item\`, que j\xE1 \xE9 jsonb na origem e existe
+-- para confer\xEAncia, n\xE3o para conta.
+--
+-- Idempotente.
+
+CREATE TABLE IF NOT EXISTS public.plg_fiscalbr_inbox_documents (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    unit_id uuid,
+    -- O ponteiro para o arqu\xE9tipo. Nulo enquanto os bytes n\xE3o subiram \u2014 o
+    -- caminho de origem fica em metadata at\xE9 l\xE1.
+    document_id uuid,
+    access_key text,
+    nfe_number text,
+    nfe_series text,
+    nfe_model text,
+    issue_date timestamp with time zone,
+    received_at timestamp with time zone,
+    status text DEFAULT 'received'::text NOT NULL,
+    -- A manifesta\xE7\xE3o do destinat\xE1rio \xE9 outro eixo que o status: uma nota pode
+    -- estar recebida e n\xE3o manifestada, e \xE9 a manifesta\xE7\xE3o que a SEFAZ cobra.
+    manifestation_status text,
+    manifested_at timestamp with time zone,
+    manifestation_attempts integer DEFAULT 0 NOT NULL,
+    manifestation_response jsonb,
+    supplier_party_id uuid,
+    supplier_cnpj text,
+    supplier_name text,
+    supplier_ie text,
+    total_value numeric(14,2),
+    total_products numeric(14,2),
+    total_discount numeric(14,2),
+    total_freight numeric(14,2),
+    total_insurance numeric(14,2),
+    total_other numeric(14,2),
+    total_icms_base numeric(14,2),
+    total_icms_value numeric(14,2),
+    total_icms_st_base numeric(14,2),
+    total_icms_st_value numeric(14,2),
+    total_pis_value numeric(14,2),
+    total_cofins_value numeric(14,2),
+    total_ipi_value numeric(14,2),
+    nfe_protocol text,
+    nfe_authorized_at timestamp with time zone,
+    carrier_name text,
+    carrier_cnpj text,
+    freight_mode_code text,
+    additional_info text,
+    reviewed_at timestamp with time zone,
+    -- O que essa nota virou no estoque, quando virou. Nulo \xE9 nota recebida e
+    -- n\xE3o importada, que \xE9 a maioria.
+    inventory_operation_id uuid,
+    owner_id uuid,
+    metadata jsonb DEFAULT '{}'::jsonb NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL
+);
+
+COMMENT ON TABLE public.plg_fiscalbr_inbox_documents IS
+  'A NF-e de fornecedor recebida da SEFAZ, esperando manifesta\xE7\xE3o ou importa\xE7\xE3o. V1: dfe_inbox.';
+COMMENT ON COLUMN public.plg_fiscalbr_inbox_documents.document_id IS
+  'V1: xml_content + pdf_storage_path. O XML e o DANFE s\xE3o arquivo; os bytes moram em public.documents e aqui fica o ponteiro.';
+
+CREATE TABLE IF NOT EXISTS public.plg_fiscalbr_inbox_items (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    inbox_document_id uuid NOT NULL,
+    item_number integer,
+    supplier_product_code text,
+    ean_barcode text,
+    ean_taxable text,
+    description text,
+    ncm text,
+    cest text,
+    cfop text,
+    unit_commercial text,
+    unit_taxable text,
+    quantity_commercial numeric(18,4),
+    quantity_taxable numeric(18,4),
+    unit_price_commercial numeric(18,6),
+    unit_price_taxable numeric(18,6),
+    total_price numeric(14,2),
+    discount numeric(14,2),
+    freight numeric(14,2),
+    insurance numeric(14,2),
+    other_expenses numeric(14,2),
+    icms_cst text, icms_csosn text, icms_origin text,
+    icms_base numeric(14,2), icms_rate numeric(9,4), icms_value numeric(14,2),
+    icms_st_base numeric(14,2), icms_st_value numeric(14,2),
+    pis_cst text, pis_base numeric(14,2), pis_rate numeric(9,4), pis_value numeric(14,2),
+    cofins_cst text, cofins_base numeric(14,2), cofins_rate numeric(9,4), cofins_value numeric(14,2),
+    ipi_cst text, ipi_rate numeric(9,4), ipi_value numeric(14,2),
+    -- O produto do V2 que esta linha da nota representa. \`reconciled\` \xE9 a
+    -- decis\xE3o de quem conferiu; o id \xE9 o resultado dela.
+    product_id uuid,
+    reconciled boolean DEFAULT false NOT NULL,
+    raw_xml_item jsonb,
+    metadata jsonb DEFAULT '{}'::jsonb NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL
+);
+
+COMMENT ON TABLE public.plg_fiscalbr_inbox_items IS
+  'O item da NF-e recebida, com o tributo em coluna \u2014 a apura\xE7\xE3o soma coluna, n\xE3o varre jsonb. V1: dfe_inbox_items.';
+
+CREATE TABLE IF NOT EXISTS public.plg_fiscalbr_inbox_payments (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    inbox_document_id uuid NOT NULL,
+    payment_index integer,
+    payment_indicator text,
+    payment_type_code text,
+    payment_type_label text,
+    value numeric(14,2),
+    change_given numeric(14,2),
+    card_brand text,
+    card_acquirer_cnpj text,
+    card_auth_code text,
+    metadata jsonb DEFAULT '{}'::jsonb NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS public.plg_fiscalbr_inbox_duplicates (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    inbox_document_id uuid NOT NULL,
+    duplicate_index integer,
+    number text,
+    due_date date,
+    value numeric(14,2),
+    -- O que essa duplicata virou no contas a pagar, se algu\xE9m a lan\xE7ou.
+    installment_id uuid,
+    metadata jsonb DEFAULT '{}'::jsonb NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL
+);
+
+COMMENT ON TABLE public.plg_fiscalbr_inbox_duplicates IS
+  'O vencimento declarado na NF-e recebida. Vira parcela do contas a pagar quando algu\xE9m lan\xE7a a nota. V1: dfe_inbox_duplicatas.';
+
+CREATE TABLE IF NOT EXISTS public.plg_fiscalbr_tax_groups (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    name text NOT NULL,
+    cfop text,
+    csosn text,
+    cst text,
+    icms_origin text,
+    icms_rate numeric(9,4),
+    icms_bc_mode text,
+    pis_situation text,
+    pis_rate numeric(9,4),
+    cofins_situation text,
+    cofins_rate numeric(9,4),
+    -- A reforma tribut\xE1ria j\xE1 est\xE1 no cadastro do V1 e vem junto: deixar de
+    -- fora obrigaria a recadastrar tudo no dia em que IBS/CBS valerem.
+    ibs_cbs_situation text,
+    ibs_cbs_classification text,
+    base_calculation_mode text,
+    benefit_code text,
+    cest text,
+    poverty_fund_rate numeric(9,4),
+    is_active boolean DEFAULT true NOT NULL,
+    metadata jsonb DEFAULT '{}'::jsonb NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL
+);
+
+COMMENT ON TABLE public.plg_fiscalbr_tax_groups IS
+  'O grupo fiscal: CFOP, CST/CSOSN e al\xEDquotas que o produto herda na emiss\xE3o. V1: fiscal_groups. Traz IBS/CBS porque o cadastro do V1 j\xE1 os tem.';
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- As chaves, os \xEDndices e a cerca
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+
+DO $$
+DECLARE t text;
+BEGIN
+  FOREACH t IN ARRAY ARRAY['plg_fiscalbr_inbox_documents', 'plg_fiscalbr_inbox_items',
+                           'plg_fiscalbr_inbox_payments', 'plg_fiscalbr_inbox_duplicates',
+                           'plg_fiscalbr_tax_groups'] LOOP
+    IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conrelid = ('public.' || t)::regclass AND contype = 'p') THEN
+      EXECUTE format('ALTER TABLE ONLY public.%I ADD CONSTRAINT %I PRIMARY KEY (id)', t, t || '_pkey');
+    END IF;
+    IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = t || '_tenant_id_id_key') THEN
+      EXECUTE format('ALTER TABLE ONLY public.%I ADD CONSTRAINT %I UNIQUE (tenant_id, id)', t, t || '_tenant_id_id_key');
+    END IF;
+    IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = t || '_tenant_fkey') THEN
+      EXECUTE format('ALTER TABLE ONLY public.%I ADD CONSTRAINT %I FOREIGN KEY (tenant_id) REFERENCES public.tenants(id) ON DELETE CASCADE', t, t || '_tenant_fkey');
+    END IF;
+  END LOOP;
+END $$;
+
+DO $$ BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_fiscalbr_inbox_documents_unit_fkey') THEN
+    ALTER TABLE ONLY public.plg_fiscalbr_inbox_documents ADD CONSTRAINT plg_fiscalbr_inbox_documents_unit_fkey
+      FOREIGN KEY (tenant_id, unit_id) REFERENCES app.units(tenant_id, id) ON DELETE SET NULL;
+  END IF;
+  -- O arquivo pode ser apagado sem levar a nota junto: a nota fiscal existe
+  -- mesmo sem o XML \xE0 m\xE3o, e \xE9 ela que a SEFAZ conhece.
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_fiscalbr_inbox_documents_document_fkey') THEN
+    ALTER TABLE ONLY public.plg_fiscalbr_inbox_documents ADD CONSTRAINT plg_fiscalbr_inbox_documents_document_fkey
+      FOREIGN KEY (document_id) REFERENCES public.documents(id) ON DELETE SET NULL;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_fiscalbr_inbox_documents_supplier_fkey') THEN
+    ALTER TABLE ONLY public.plg_fiscalbr_inbox_documents ADD CONSTRAINT plg_fiscalbr_inbox_documents_supplier_fkey
+      FOREIGN KEY (supplier_party_id) REFERENCES public.people(id) ON DELETE SET NULL;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_fiscalbr_inbox_documents_operation_fkey') THEN
+    ALTER TABLE ONLY public.plg_fiscalbr_inbox_documents ADD CONSTRAINT plg_fiscalbr_inbox_documents_operation_fkey
+      FOREIGN KEY (inventory_operation_id) REFERENCES public.plg_inventory_operations(id) ON DELETE SET NULL;
+  END IF;
+
+  -- Item, pagamento e duplicata n\xE3o existem fora da nota: CASCADE.
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_fiscalbr_inbox_items_document_fkey') THEN
+    ALTER TABLE ONLY public.plg_fiscalbr_inbox_items ADD CONSTRAINT plg_fiscalbr_inbox_items_document_fkey
+      FOREIGN KEY (tenant_id, inbox_document_id) REFERENCES public.plg_fiscalbr_inbox_documents(tenant_id, id) ON DELETE CASCADE;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_fiscalbr_inbox_items_product_fkey') THEN
+    ALTER TABLE ONLY public.plg_fiscalbr_inbox_items ADD CONSTRAINT plg_fiscalbr_inbox_items_product_fkey
+      FOREIGN KEY (product_id) REFERENCES public.products(id) ON DELETE SET NULL;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_fiscalbr_inbox_payments_document_fkey') THEN
+    ALTER TABLE ONLY public.plg_fiscalbr_inbox_payments ADD CONSTRAINT plg_fiscalbr_inbox_payments_document_fkey
+      FOREIGN KEY (tenant_id, inbox_document_id) REFERENCES public.plg_fiscalbr_inbox_documents(tenant_id, id) ON DELETE CASCADE;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_fiscalbr_inbox_duplicates_document_fkey') THEN
+    ALTER TABLE ONLY public.plg_fiscalbr_inbox_duplicates ADD CONSTRAINT plg_fiscalbr_inbox_duplicates_document_fkey
+      FOREIGN KEY (tenant_id, inbox_document_id) REFERENCES public.plg_fiscalbr_inbox_documents(tenant_id, id) ON DELETE CASCADE;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_fiscalbr_inbox_duplicates_installment_fkey') THEN
+    ALTER TABLE ONLY public.plg_fiscalbr_inbox_duplicates ADD CONSTRAINT plg_fiscalbr_inbox_duplicates_installment_fkey
+      FOREIGN KEY (installment_id) REFERENCES public.plg_financial_invoice_installments(id) ON DELETE SET NULL;
+  END IF;
+END $$;
+
+-- A chave de acesso \xE9 \xFAnica por casa: a mesma nota chegando duas vezes da SEFAZ
+-- \xE9 a mesma nota, e \xE9 isso que impede a importa\xE7\xE3o em dobro.
+CREATE UNIQUE INDEX IF NOT EXISTS plg_fiscalbr_inbox_documents_access_key_uidx
+  ON public.plg_fiscalbr_inbox_documents USING btree (tenant_id, access_key)
+  WHERE access_key IS NOT NULL;
+CREATE INDEX IF NOT EXISTS plg_fiscalbr_inbox_documents_pending_idx
+  ON public.plg_fiscalbr_inbox_documents USING btree (tenant_id, unit_id, issue_date DESC)
+  WHERE inventory_operation_id IS NULL;
+CREATE INDEX IF NOT EXISTS plg_fiscalbr_inbox_items_document_idx
+  ON public.plg_fiscalbr_inbox_items USING btree (tenant_id, inbox_document_id);
+CREATE INDEX IF NOT EXISTS plg_fiscalbr_inbox_items_product_idx
+  ON public.plg_fiscalbr_inbox_items USING btree (tenant_id, product_id) WHERE product_id IS NOT NULL;
+CREATE INDEX IF NOT EXISTS plg_fiscalbr_inbox_payments_document_idx
+  ON public.plg_fiscalbr_inbox_payments USING btree (tenant_id, inbox_document_id);
+CREATE INDEX IF NOT EXISTS plg_fiscalbr_inbox_duplicates_document_idx
+  ON public.plg_fiscalbr_inbox_duplicates USING btree (tenant_id, inbox_document_id);
+CREATE UNIQUE INDEX IF NOT EXISTS plg_fiscalbr_tax_groups_name_uidx
+  ON public.plg_fiscalbr_tax_groups USING btree (tenant_id, lower(name));
+
+DO $$
+DECLARE t text;
+BEGIN
+  FOREACH t IN ARRAY ARRAY['plg_fiscalbr_inbox_documents', 'plg_fiscalbr_inbox_items',
+                           'plg_fiscalbr_inbox_payments', 'plg_fiscalbr_inbox_duplicates',
+                           'plg_fiscalbr_tax_groups'] LOOP
+    EXECUTE format('DROP TRIGGER IF EXISTS %I ON public.%I', t || '_updated_at', t);
+    EXECUTE format('CREATE TRIGGER %I BEFORE UPDATE ON public.%I FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at()', t || '_updated_at', t);
+  END LOOP;
+END $$;
+
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+-- Quem enxerga
+-- \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+--
+-- Nota fiscal \xE9 do FINANCEIRO, e a permiss\xE3o \xE9 a que ele j\xE1 usa. A caixa de
+-- entrada n\xE3o tem unidade nos filhos \u2014 eles herdam a da nota \u2014, ent\xE3o o escopo
+-- de unidade vale s\xF3 no documento; o resto \xE9 do tenant, e \xE9 a CASCADE da FK que
+-- garante que ningu\xE9m veja filho de nota alheia.
+-- RLS, uma a uma e por extenso. O la\xE7o adiante j\xE1 liga tudo isto \u2014 mas ele liga
+-- por \`EXECUTE format(...)\`, e o port\xE3o que revisa plugin l\xEA o ARQUIVO, n\xE3o o
+-- banco: para ele, tabela com tenant_id e sem um ENABLE literal \xE9 tabela
+-- aberta. Uma garantia que o revisor n\xE3o consegue ler \xE9 uma garantia que
+-- ningu\xE9m confere.
+ALTER TABLE public.plg_fiscalbr_inbox_documents ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.plg_fiscalbr_inbox_items ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.plg_fiscalbr_tax_groups ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.plg_fiscalbr_inbox_payments ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.plg_fiscalbr_inbox_duplicates ENABLE ROW LEVEL SECURITY;
+
+DO $$
+DECLARE
+  t text;
+  doc boolean;
+BEGIN
+  FOREACH t IN ARRAY ARRAY['plg_fiscalbr_inbox_documents', 'plg_fiscalbr_inbox_items',
+                           'plg_fiscalbr_inbox_payments', 'plg_fiscalbr_inbox_duplicates',
+                           'plg_fiscalbr_tax_groups'] LOOP
+    doc := t = 'plg_fiscalbr_inbox_documents';
+    EXECUTE format('ALTER TABLE public.%I FORCE ROW LEVEL SECURITY', t);
+    EXECUTE format('ALTER TABLE public.%I ENABLE ROW LEVEL SECURITY', t);
+    EXECUTE format('GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE public.%I TO authenticated', t);
+    EXECUTE format('GRANT ALL ON TABLE public.%I TO service_role', t);
+
+    EXECUTE format('DROP POLICY IF EXISTS %I ON public.%I', t || '_authz_select', t);
+    EXECUTE format($f$CREATE POLICY %I ON public.%I FOR SELECT TO authenticated USING (
+        tenant_id = (SELECT app.current_tenant_id())
+        AND (%s)
+        AND (SELECT app.has_permission('financial.read', %s)))$f$,
+      t || '_authz_select', t,
+      CASE WHEN doc THEN format('unit_id IS NULL OR (SELECT app.has_unit(%I.unit_id))', t) ELSE 'true' END,
+      CASE WHEN doc THEN format('%I.unit_id', t) ELSE 'NULL::uuid' END);
+
+    EXECUTE format('DROP POLICY IF EXISTS %I ON public.%I', t || '_authz_write', t);
+    EXECUTE format($f$CREATE POLICY %I ON public.%I FOR ALL TO authenticated USING (
+        tenant_id = (SELECT app.current_tenant_id())
+        AND (SELECT app.has_permission('financial.edit', %s)))
+      WITH CHECK (
+        tenant_id = (SELECT app.current_tenant_id())
+        AND (SELECT app.has_permission('financial.edit', %s)))$f$,
+      t || '_authz_write', t,
+      CASE WHEN doc THEN format('%I.unit_id', t) ELSE 'NULL::uuid' END,
+      CASE WHEN doc THEN format('%I.unit_id', t) ELSE 'NULL::uuid' END);
+  END LOOP;
+END $$;
+
+INSERT INTO public.scoped_resources (resource_table, unit_column, owner_column, shareable, default_visibility, label)
+VALUES ('plg_fiscalbr_inbox_documents', 'unit_id', 'owner_id', false, 'unit', 'Notas recebidas')
+ON CONFLICT (resource_table) DO UPDATE
+  SET unit_column = EXCLUDED.unit_column, default_visibility = EXCLUDED.default_visibility, label = EXCLUDED.label;
+`;
+var MIGRATION_003_A_CAIXA_DE_ENTRADA_ATRAVESSA = `-- A caixa de entrada atravessa.
+--
+-- A 002 fez as cinco tabelas. Esta escreve o de-para. As cinco usam o writer
+-- gen\xE9rico \`by_shape\` (spine 123): as colunas do destino foram desenhadas
+-- olhando a origem, ent\xE3o o que falta \xE9 dizer qual nome vira qual \u2014 n\xE3o uma
+-- fun\xE7\xE3o de upsert por tabela.
+--
+-- \u2500\u2500 O arquivo n\xE3o vem por aqui \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- \`xml_content\` guarda o XML inteiro e \`pdf_storage_path\` aponta para o DANFE.
+-- Os dois saem do de-para com \`-\`: arquivo atravessa pelo est\xE1gio de assets,
+-- que \xE9 quem alcan\xE7a object storage, e vira linha de \`public.documents\`. O
+-- caminho de origem fica em metadata para o est\xE1gio achar.
+--
+-- \u2500\u2500 O fornecedor fica para a costura \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- \`supplier_party_id\` n\xE3o \xE9 preenchido aqui. A origem guarda CNPJ e nome, n\xE3o
+-- um id de contato, e casar CNPJ com \`public.people\` \xE9 uma decis\xE3o de
+-- identidade \u2014 a mesma que j\xE1 p\xF4s 438 clientes em quarentena. Fica nulo, com o
+-- CNPJ na coluna ao lado, e uma passada de costura resolve quando algu\xE9m
+-- decidir a regra.
+--
+-- Idempotente.
+
+SET LOCAL migration.allowlist_unlock = 'on';
+
+SELECT migration._allow(
+  'fiscal_groups', 'public.plg_fiscalbr_tax_groups', 'fiscal_br', 'by_shape',
+  jsonb_build_object('target', 'public.plg_fiscalbr_tax_groups'),
+  NULL::text[],
+  jsonb_build_object(
+    'uuid',                    'id',
+    'name',                    'name',
+    'cfop',                    'cfop',
+    'csosn',                   'csosn',
+    'cst',                     'cst',
+    'icms_origin',             'icms_origin',
+    'icms_rate',               'icms_rate',
+    'icms_modalidade_bc',      'icms_bc_mode',
+    'pis_situation',           'pis_situation',
+    'pis_rate',                'pis_rate',
+    'cofins_situation',        'cofins_situation',
+    'cofins_rate',             'cofins_rate',
+    'ibs_cbs_situation',       'ibs_cbs_situation',
+    'ibs_cbs_classification',  'ibs_cbs_classification',
+    'base_calculation_mode',   'base_calculation_mode',
+    'cbenef',                  'benefit_code',
+    'cest',                    'cest',
+    'poverty_fund_rate',       'poverty_fund_rate',
+    'active',                  'is_active',
+    'created_at',              'created_at',
+    'updated_at',              'updated_at',
+    'tenant_id',               '-',
+    'id',                      'jsonb:fiscalbr.v1_ref'),
+  'O grupo fiscal: CFOP, CST/CSOSN e al\xEDquotas que o produto herda na emiss\xE3o. '
+  'IBS/CBS v\xEAm junto porque o cadastro do V1 j\xE1 os tem \u2014 deixar de fora '
+  'obrigaria a recadastrar tudo no dia em que a reforma valer.'
+);
+
+SELECT migration._allow(
+  'dfe_inbox', 'public.plg_fiscalbr_inbox_documents', 'fiscal_br', 'by_shape',
+  jsonb_build_object('target', 'public.plg_fiscalbr_inbox_documents'),
+  NULL::text[],
+  jsonb_build_object(
+    'uuid',                    'id',
+    'company_id',              'unit_id@companies',
+    'access_key',              'access_key',
+    'nfe_number',              'nfe_number',
+    'nfe_series',              'nfe_series',
+    'nfe_model',               'nfe_model',
+    'issue_date',              'issue_date',
+    'received_at',             'received_at',
+    'status',                  'status',
+    'manifestation_status',    'manifestation_status',
+    'manifested_at',           'manifested_at',
+    'manifestation_attempts',  'manifestation_attempts',
+    'manifestation_response',  'manifestation_response',
+    'supplier_cnpj',           'supplier_cnpj',
+    'supplier_name',           'supplier_name',
+    'supplier_ie',             'supplier_ie',
+    'total_value',             'total_value',
+    'total_products',          'total_products',
+    'total_discount',          'total_discount',
+    'total_freight',           'total_freight',
+    'total_insurance',         'total_insurance',
+    'total_other',             'total_other',
+    'total_icms_base',         'total_icms_base',
+    'total_icms_value',        'total_icms_value',
+    'total_icms_st_base',      'total_icms_st_base',
+    'total_icms_st_value',     'total_icms_st_value',
+    'total_pis_value',         'total_pis_value',
+    'total_cofins_value',      'total_cofins_value',
+    'total_ipi_value',         'total_ipi_value',
+    'nfe_protocol',            'nfe_protocol') ||
+  -- \`jsonb_build_object\` aceita no m\xE1ximo 100 argumentos, e este de-para tem
+  -- 59 pares. Dois objetos concatenados, e n\xE3o uma tabela a menos.
+  jsonb_build_object(
+    'nfe_authorized_at',       'nfe_authorized_at',
+    'carrier_name',            'carrier_name',
+    'carrier_cnpj',            'carrier_cnpj',
+    'freight_mode_code',       'freight_mode_code',
+    'additional_info',         'additional_info',
+    'reviewed_at',             'reviewed_at',
+    'created_at',              'created_at',
+    'updated_at',              'updated_at',
+    'tenant_id',               '-',
+    'reviewed_by',             '-',
+    'xml_content',             '-',
+    'pdf_storage_path',        'jsonb:fiscalbr.v1_pdf_path',
+    'pdf_fetched_at',          'jsonb:fiscalbr.v1_pdf_fetched_at',
+    'danfe_import_id',         'jsonb:fiscalbr.v1_danfe_import_ref',
+    'plugnotas_payload',       'jsonb:fiscalbr.v1_plugnotas_payload',
+    'plugnotas_received_at',   'jsonb:fiscalbr.v1_plugnotas_received_at',
+    'nfe_cnf',                 'jsonb:fiscalbr.nfe.cnf',
+    'nfe_natureza_operacao',   'jsonb:fiscalbr.nfe.natureza_operacao',
+    'nfe_finalidade',          'jsonb:fiscalbr.nfe.finalidade',
+    'nfe_tipo_operacao',       'jsonb:fiscalbr.nfe.tipo_operacao',
+    'nfe_destination',         'jsonb:fiscalbr.nfe.destination',
+    'supplier_address',        'jsonb:fiscalbr.supplier.street',
+    'supplier_number',         'jsonb:fiscalbr.supplier.number',
+    'supplier_complement',     'jsonb:fiscalbr.supplier.complement',
+    'supplier_neighborhood',   'jsonb:fiscalbr.supplier.neighborhood',
+    'supplier_city',           'jsonb:fiscalbr.supplier.city',
+    'supplier_state',          'jsonb:fiscalbr.supplier.state',
+    'supplier_postal_code',    'jsonb:fiscalbr.supplier.postal_code',
+    'supplier_phone',          'jsonb:fiscalbr.supplier.phone',
+    'supplier_email',          'jsonb:fiscalbr.supplier.email',
+    'id',                      'jsonb:fiscalbr.v1_ref'),
+  'A NF-e de fornecedor recebida da SEFAZ. \`xml_content\` sai com \`-\`: arquivo '
+  'atravessa pelo est\xE1gio de assets e vira public.documents, e o caminho do '
+  'DANFE fica em metadata para o est\xE1gio achar. O endere\xE7o do fornecedor vai '
+  'para metadata porque o fornecedor \xE9 \`public.people\`, e duplic\xE1-lo em coluna '
+  'daria duas respostas para "onde ele fica".'
+);
+
+SELECT migration._allow(
+  'dfe_inbox_items', 'public.plg_fiscalbr_inbox_items', 'fiscal_br', 'by_shape',
+  jsonb_build_object('target', 'public.plg_fiscalbr_inbox_items'),
+  NULL::text[],
+  jsonb_build_object(
+    'uuid',                   'id',
+    'dfe_inbox_id',           'inbox_document_id@dfe_inbox',
+    'item_number',            'item_number',
+    'product_code_supplier',  'supplier_product_code',
+    'ean_barcode',            'ean_barcode',
+    'ean_trib',               'ean_taxable',
+    'description',            'description',
+    'ncm',                    'ncm',
+    'cest',                   'cest',
+    'cfop',                   'cfop',
+    'unit_commercial',        'unit_commercial',
+    'unit_taxable',           'unit_taxable',
+    'quantity_commercial',    'quantity_commercial',
+    'quantity_taxable',       'quantity_taxable',
+    'unit_price_commercial',  'unit_price_commercial',
+    'unit_price_taxable',     'unit_price_taxable',
+    'total_price',            'total_price',
+    'discount',               'discount',
+    'freight',                'freight',
+    'insurance',              'insurance',
+    'other_expenses',         'other_expenses',
+    'icms_cst',               'icms_cst',
+    'icms_csosn',             'icms_csosn',
+    'icms_origin',            'icms_origin',
+    'icms_base',              'icms_base',
+    'icms_rate',              'icms_rate',
+    'icms_value',             'icms_value',
+    'icms_st_base',           'icms_st_base',
+    'icms_st_value',          'icms_st_value',
+    'pis_cst',                'pis_cst',
+    'pis_base',               'pis_base',
+    'pis_rate',               'pis_rate',
+    'pis_value',              'pis_value',
+    'cofins_cst',             'cofins_cst',
+    'cofins_base',            'cofins_base',
+    'cofins_rate',            'cofins_rate',
+    'cofins_value',           'cofins_value',
+    'ipi_cst',                'ipi_cst',
+    'ipi_rate',               'ipi_rate',
+    'ipi_value',              'ipi_value',
+    'linked_product_id',      'product_id@products',
+    'reconciled',             'reconciled',
+    'raw_xml_item',           'raw_xml_item',
+    'created_at',             'created_at',
+    'updated_at',             'updated_at',
+    'tenant_id',              '-',
+    'id',                     'jsonb:fiscalbr.v1_ref'),
+  'O item da nota, com o tributo em COLUNA \u2014 a apura\xE7\xE3o soma coluna, n\xE3o varre '
+  'jsonb. \`raw_xml_item\` \xE9 a exce\xE7\xE3o: j\xE1 \xE9 jsonb na origem e serve para '
+  'confer\xEAncia, n\xE3o para conta.'
+);
+
+SELECT migration._allow(
+  'dfe_inbox_payments', 'public.plg_fiscalbr_inbox_payments', 'fiscal_br', 'by_shape',
+  jsonb_build_object('target', 'public.plg_fiscalbr_inbox_payments'),
+  NULL::text[],
+  jsonb_build_object(
+    'uuid',                 'id',
+    'dfe_inbox_id',         'inbox_document_id@dfe_inbox',
+    'payment_index',        'payment_index',
+    'indicador_pagamento',  'payment_indicator',
+    'tipo_pagamento_code',  'payment_type_code',
+    'tipo_pagamento_label', 'payment_type_label',
+    'value',                'value',
+    'troco',                'change_given',
+    'card_flag',            'card_brand',
+    'card_acquirer_cnpj',   'card_acquirer_cnpj',
+    'card_auth_code',       'card_auth_code',
+    'created_at',           'created_at',
+    'updated_at',           'updated_at',
+    'tenant_id',            '-',
+    'id',                   'jsonb:fiscalbr.v1_ref'),
+  'A forma de pagamento declarada na nota recebida.'
+);
+
+SELECT migration._allow(
+  'dfe_inbox_duplicatas', 'public.plg_fiscalbr_inbox_duplicates', 'fiscal_br', 'by_shape',
+  jsonb_build_object('target', 'public.plg_fiscalbr_inbox_duplicates'),
+  NULL::text[],
+  jsonb_build_object(
+    'uuid',             'id',
+    'dfe_inbox_id',     'inbox_document_id@dfe_inbox',
+    'duplicata_index',  'duplicate_index',
+    'numero',           'number',
+    'vencimento',       'due_date',
+    'valor',            'value',
+    'created_at',       'created_at',
+    'updated_at',       'updated_at',
+    'tenant_id',        '-',
+    'id',               'jsonb:fiscalbr.v1_ref'),
+  'O vencimento declarado na nota. Vira parcela do contas a pagar quando algu\xE9m '
+  'lan\xE7a a nota \u2014 \`installment_id\` fica nulo at\xE9 l\xE1, porque a parcela \xE9 '
+  'decis\xE3o de quem lan\xE7a, n\xE3o da SEFAZ.'
+);
+
+DELETE FROM migration.excluded_tables
+ WHERE source_table IN ('dfe_inbox', 'dfe_inbox_items', 'dfe_inbox_payments',
+                        'dfe_inbox_duplicatas', 'fiscal_groups');
+
+RESET migration.allowlist_unlock;
+`;
+var MIGRATION_004_O_GRUPO_FISCAL_DO_V1_REPETE_NOME = `-- O grupo fiscal do V1 repete nome.
+--
+-- A 002 criou \xEDndice \xDANICO em \`(tenant_id, lower(name))\`. O V1 tem, no tenant
+-- 8, "Bebidas Alco\xF3licas", "Bebidas N\xE3o Alco\xF3licas" e "Vinhos e Espumantes"
+-- DUAS vezes cada \u2014 grupos fiscais diferentes com o mesmo r\xF3tulo, e o V1
+-- permite. Tr\xEAs das onze linhas foram para a quarentena por uma regra que eu
+-- inventei, n\xE3o que a origem tenha.
+--
+-- O \xEDndice vira comum: serve para buscar, n\xE3o para proibir. Quem quiser proibir
+-- decide isso na tela, com o dado j\xE1 dentro \u2014 e sabendo quais tr\xEAs s\xE3o.
+--
+-- Esta corre\xE7\xE3o nasceu dentro de \`financial/083\` e mudou de arquivo: o
+-- financeiro roda ANTES do fiscal_br na corrente, e um arquivo do financeiro
+-- que mexe numa tabela do fiscal_br falha do zero com
+-- \`relation "public.plg_fiscalbr_tax_groups" does not exist\`. Cada plugin mexe
+-- na tabela que \xE9 dele.
+--
+-- Idempotente.
+
+DROP INDEX IF EXISTS public.plg_fiscalbr_tax_groups_name_uidx;
+CREATE INDEX IF NOT EXISTS plg_fiscalbr_tax_groups_name_idx
+  ON public.plg_fiscalbr_tax_groups USING btree (tenant_id, lower(name));
+`;
 var MIGRATIONS = [
   { id: "000_baseline", sql: MIGRATION_000_BASELINE },
-  { id: "001_preserve_terminal_results_and_recover_leases", sql: MIGRATION_001_PRESERVE_TERMINAL_RESULTS_AND_RECOVER_LEASES }
+  { id: "001_preserve_terminal_results_and_recover_leases", sql: MIGRATION_001_PRESERVE_TERMINAL_RESULTS_AND_RECOVER_LEASES },
+  { id: "002_a_nota_que_chega_tem_onde_esperar", sql: MIGRATION_002_A_NOTA_QUE_CHEGA_TEM_ONDE_ESPERAR },
+  { id: "003_a_caixa_de_entrada_atravessa", sql: MIGRATION_003_A_CAIXA_DE_ENTRADA_ATRAVESSA },
+  { id: "004_o_grupo_fiscal_do_v1_repete_nome", sql: MIGRATION_004_O_GRUPO_FISCAL_DO_V1_REPETE_NOME }
 ];
 
 // src/lib/financial-provider.ts