@fayz-ai/plugin-getting-started 0.0.0-stage → 0.2.0-canary.20261027164140

package/dist/migrations/main.js

@@ -0,0 +1,992 @@
+// src/migrations/index.ts
+var MIGRATION_000_JOURNEY = `-- 000_journey.sql \u2014 the getting-started plugin keeps the journey; tenants.trial_ends_at stays the end of the trial.
+
+-- \u2500\u2500 platform config (one row; only service_role/postgres write) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+CREATE TABLE IF NOT EXISTS public.plg_getting_started_config (
+  id                 boolean PRIMARY KEY DEFAULT true CHECK (id),
+  trial_days         integer NOT NULL DEFAULT 14 CHECK (trial_days BETWEEN 1 AND 90),
+  -- Documents the spine DEFAULT (db 044); never changes it.
+  setup_window_days  integer NOT NULL DEFAULT 30,
+  crm_tenant_slug    text    NOT NULL DEFAULT 'controlgroup',
+  reminder_hour_utc  integer NOT NULL DEFAULT 13 CHECK (reminder_hour_utc BETWEEN 0 AND 23),
+  updated_at         timestamptz NOT NULL DEFAULT now()
+);
+INSERT INTO public.plg_getting_started_config (id) VALUES (true) ON CONFLICT (id) DO NOTHING;
+ALTER TABLE public.plg_getting_started_config ENABLE ROW LEVEL SECURITY;
+REVOKE ALL ON public.plg_getting_started_config FROM PUBLIC, anon, authenticated;
+-- Read by the view and the RPCs; no write policy on purpose.
+GRANT SELECT ON public.plg_getting_started_config TO authenticated;
+DROP POLICY IF EXISTS plg_getting_started_config_read ON public.plg_getting_started_config;
+CREATE POLICY plg_getting_started_config_read ON public.plg_getting_started_config
+  FOR SELECT TO authenticated USING (true);
+
+-- \u2500\u2500 the journey: one row per tenant \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+CREATE TABLE IF NOT EXISTS public.plg_getting_started_journeys (
+  tenant_id          uuid PRIMARY KEY REFERENCES public.tenants(id) ON DELETE CASCADE,
+  ready_at           timestamptz,
+  trial_started_at   timestamptz,
+  trial_days         integer,
+  converted_at       timestamptz,
+  wants_contract_at  timestamptz,
+  source             text,
+  utm                jsonb NOT NULL DEFAULT '{}'::jsonb,
+  answers_snapshot   jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at         timestamptz NOT NULL DEFAULT now(),
+  updated_at         timestamptz NOT NULL DEFAULT now()
+);
+ALTER TABLE public.plg_getting_started_journeys ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.plg_getting_started_journeys FORCE ROW LEVEL SECURITY;
+-- Writes go through the RPCs only.
+GRANT SELECT ON public.plg_getting_started_journeys TO authenticated;
+DROP POLICY IF EXISTS plg_getting_started_journeys_select ON public.plg_getting_started_journeys;
+CREATE POLICY plg_getting_started_journeys_select ON public.plg_getting_started_journeys
+  FOR SELECT TO authenticated USING (tenant_id IN (SELECT public.user_tenant_ids()));
+
+-- \u2500\u2500 timeline + idempotency lock (one row per tenant, kind and day) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+CREATE TABLE IF NOT EXISTS public.plg_getting_started_events (
+  id          uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id   uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  kind        text NOT NULL CHECK (kind ~ '^[a-z][a-z0-9_]*$'),
+  day         date NOT NULL DEFAULT (now() AT TIME ZONE 'UTC')::date,
+  channel     text,
+  payload     jsonb NOT NULL DEFAULT '{}'::jsonb,
+  actor_id    uuid,
+  created_at  timestamptz NOT NULL DEFAULT now()
+);
+CREATE UNIQUE INDEX IF NOT EXISTS plg_getting_started_events_once_a_day
+  ON public.plg_getting_started_events (tenant_id, kind, day);
+CREATE INDEX IF NOT EXISTS plg_getting_started_events_tenant
+  ON public.plg_getting_started_events (tenant_id, created_at DESC);
+ALTER TABLE public.plg_getting_started_events ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.plg_getting_started_events FORCE ROW LEVEL SECURITY;
+GRANT SELECT ON public.plg_getting_started_events TO authenticated;
+DROP POLICY IF EXISTS plg_getting_started_events_select ON public.plg_getting_started_events;
+CREATE POLICY plg_getting_started_events_select ON public.plg_getting_started_events
+  FOR SELECT TO authenticated USING (tenant_id IN (SELECT public.user_tenant_ids()));
+
+-- \u2500\u2500 wizard keys this plugin owns (tech design, decision 5) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+SELECT app.seed_setting_keys($$[
+  { "key": "store.hours", "type": "object", "default": {}, "reader": "plugin:getting-started",
+    "description": "Opening hours per weekday: {\\"mon\\":[{\\"open\\":\\"11:00\\",\\"close\\":\\"23:00\\"}],\u2026}. Empty = not informed." },
+  { "key": "store.payment_methods", "type": "array", "default": [], "reader": "plugin:getting-started",
+    "description": "Payment methods accepted at the counter and on delivery: cash, pix, credit, debit, voucher." },
+  { "key": "store.welcome_article", "type": "string", "default": "a", "reader": "plugin:getting-started",
+    "description": "Article before the store name in greetings: a | o." }
+]$$::jsonb);
+
+-- \u2500\u2500 the phase, derived (decision 1 and \xA73) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- security_invoker: the RLS of tenants decides which rows are visible (same pattern as v_team_members, db 004).
+CREATE OR REPLACE VIEW public.v_getting_started_journey WITH (security_invoker = true) AS
+SELECT t.id AS tenant_id,
+       j.ready_at, j.trial_started_at, j.converted_at, j.wants_contract_at, j.source, j.utm,
+       coalesce(j.trial_days, c.trial_days) AS trial_days,
+       t.trial_ends_at,
+       CASE WHEN j.trial_started_at IS NULL THEN t.trial_ends_at END AS setup_deadline_at,
+       CASE
+         WHEN j.converted_at IS NOT NULL                                   THEN 'converted'
+         WHEN t.trial_ends_at IS NOT NULL AND t.trial_ends_at <= now()      THEN 'expired'
+         WHEN j.trial_started_at IS NOT NULL                                THEN 'trial'
+         ELSE 'setup'
+       END AS phase
+  FROM public.tenants t
+  CROSS JOIN public.plg_getting_started_config c
+  LEFT JOIN public.plg_getting_started_journeys j ON j.tenant_id = t.id;
+GRANT SELECT ON public.v_getting_started_journey TO authenticated;
+
+-- \u2500\u2500 the minimums, one function (used by the start RPC and by the read) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+CREATE OR REPLACE FUNCTION public.getting_started_minimums(p_tenant uuid)
+RETURNS jsonb LANGUAGE plpgsql STABLE SECURITY DEFINER SET search_path TO '' AS $$
+DECLARE
+  v_menu     boolean := false;
+  v_hours    boolean := false;
+  v_order    boolean := false;
+  v_settings jsonb;
+BEGIN
+  SELECT t.settings INTO v_settings FROM public.tenants t WHERE t.id = p_tenant;
+  v_hours := jsonb_typeof(v_settings #> '{store,hours}') = 'object'
+             AND (v_settings #> '{store,hours}') <> '{}'::jsonb;
+  -- A pool without plugin-menu must not break the read.
+  IF to_regclass('public.plg_menu_items') IS NOT NULL THEN
+    EXECUTE $q$SELECT EXISTS (
+                 SELECT 1 FROM public.plg_menu_items mi
+                 JOIN public.products p ON p.id = mi.product_id
+                 WHERE mi.tenant_id = $1 AND mi.status = 'available' AND p.is_active
+                   AND coalesce(p.metadata->>'demo','') <> 'true')$q$
+      INTO v_menu USING p_tenant;
+  END IF;
+  SELECT EXISTS (
+    SELECT 1 FROM public.orders o
+    WHERE o.tenant_id = p_tenant AND o.status = 'completed'
+      AND o.metadata @> '{"test":true}'::jsonb
+  ) INTO v_order;
+  RETURN jsonb_build_object(
+    'menu', v_menu, 'hours', v_hours, 'test_order', v_order,
+    'ready', v_menu AND v_hours AND v_order
+  );
+END $$;
+REVOKE ALL ON FUNCTION public.getting_started_minimums(uuid) FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION public.getting_started_minimums(uuid) TO authenticated, service_role;
+
+-- \u2500\u2500 the read for the client \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+CREATE OR REPLACE FUNCTION public.getting_started_journey()
+RETURNS jsonb LANGUAGE plpgsql STABLE SECURITY DEFINER SET search_path TO '' AS $$
+DECLARE
+  v_tenant uuid := app.current_tenant_id();
+  v_row    record;
+BEGIN
+  IF v_tenant IS NULL THEN
+    RAISE EXCEPTION 'getting_started_journey: no active tenant' USING ERRCODE = '42501';
+  END IF;
+  SELECT * INTO v_row FROM public.v_getting_started_journey v WHERE v.tenant_id = v_tenant;
+  IF NOT FOUND THEN
+    RETURN jsonb_build_object('tenant_id', v_tenant, 'phase', 'setup',
+                              'minimums', public.getting_started_minimums(v_tenant));
+  END IF;
+  RETURN to_jsonb(v_row) || jsonb_build_object('minimums', public.getting_started_minimums(v_tenant));
+END $$;
+REVOKE ALL ON FUNCTION public.getting_started_journey() FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION public.getting_started_journey() TO authenticated, service_role;
+`;
+var MIGRATION_001_TRIAL_CLOCK = `-- 001_trial_clock.sql \u2014 start, end, reminders and the Faya lead. Depends on 000_journey.sql.
+
+-- \u2500\u2500 start the trial \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+CREATE OR REPLACE FUNCTION public.getting_started_start_trial(p_tenant uuid DEFAULT NULL)
+RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO '' AS $$
+DECLARE
+  v_tenant  uuid := coalesce(p_tenant, app.current_tenant_id());
+  v_days    integer;
+  v_min     jsonb;
+  v_started timestamptz;
+  v_ends    timestamptz;
+BEGIN
+  -- Same gate as tenant_setting_set: a session, the tenant in scope, settings.manage.
+  IF auth.uid() IS NULL OR v_tenant IS NULL OR v_tenant IS DISTINCT FROM app.current_tenant_id() THEN
+    RAISE EXCEPTION 'getting_started_start_trial: no session or tenant out of scope' USING ERRCODE = '42501';
+  END IF;
+  IF NOT app.has_permission('settings.manage') THEN
+    RAISE EXCEPTION 'getting_started_start_trial: settings.manage is required' USING ERRCODE = '42501';
+  END IF;
+
+  -- Idempotent: a second call returns the state and leaves the date alone.
+  SELECT j.trial_started_at INTO v_started FROM public.plg_getting_started_journeys j WHERE j.tenant_id = v_tenant;
+  IF v_started IS NOT NULL THEN
+    RETURN jsonb_build_object('ok', true, 'already_started', true, 'trial_started_at', v_started,
+                              'trial_ends_at', (SELECT t.trial_ends_at FROM public.tenants t WHERE t.id = v_tenant));
+  END IF;
+
+  -- Minimums are checked here, not in the button.
+  v_min := public.getting_started_minimums(v_tenant);
+  IF NOT coalesce((v_min ->> 'ready')::boolean, false) THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'minimums_missing', 'minimums', v_min);
+  END IF;
+
+  SELECT c.trial_days INTO v_days FROM public.plg_getting_started_config c;
+  v_days    := coalesce(v_days, 14);
+  v_started := now();
+  v_ends    := v_started + make_interval(days => v_days);
+
+  INSERT INTO public.plg_getting_started_journeys (tenant_id, ready_at, trial_started_at, trial_days)
+  VALUES (v_tenant, v_started, v_started, v_days)
+  ON CONFLICT (tenant_id) DO UPDATE
+    SET ready_at = coalesce(public.plg_getting_started_journeys.ready_at, EXCLUDED.ready_at),
+        trial_started_at = EXCLUDED.trial_started_at,
+        trial_days = EXCLUDED.trial_days,
+        updated_at = now();
+
+  -- The real clock. Passes tenants_trial_is_readonly because SECURITY DEFINER runs as the owner (postgres).
+  UPDATE public.tenants SET trial_ends_at = v_ends WHERE id = v_tenant;
+
+  INSERT INTO public.plg_getting_started_events (tenant_id, kind, actor_id, payload)
+  VALUES (v_tenant, 'trial_started', auth.uid(), jsonb_build_object('trial_days', v_days, 'ends_at', v_ends))
+  ON CONFLICT (tenant_id, kind, day) DO NOTHING;
+
+  PERFORM public.plg_emit_event('getting_started.trial_started',
+    jsonb_build_object('trial_days', v_days, 'trial_ends_at', v_ends), 'tenant', v_tenant::text, v_tenant);
+
+  RETURN jsonb_build_object('ok', true, 'trial_started_at', v_started, 'trial_ends_at', v_ends, 'trial_days', v_days);
+END $$;
+REVOKE ALL ON FUNCTION public.getting_started_start_trial(uuid) FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION public.getting_started_start_trial(uuid) TO authenticated, service_role;
+
+-- Agent executor shape (p_tenant_id, p_actor_user_id, p_payload), as agent_crm_create_lead.
+CREATE OR REPLACE FUNCTION public.agent_getting_started_start_trial(p_tenant_id uuid, p_actor_user_id uuid, p_payload jsonb DEFAULT '{}'::jsonb)
+RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO '' AS $$
+BEGIN
+  IF auth.uid() IS NOT NULL AND auth.uid() IS DISTINCT FROM p_actor_user_id THEN
+    RAISE EXCEPTION 'agent_getting_started_start_trial: actor mismatch' USING ERRCODE = '42501';
+  END IF;
+  RETURN public.getting_started_start_trial(p_tenant_id);
+END $$;
+REVOKE ALL ON FUNCTION public.agent_getting_started_start_trial(uuid, uuid, jsonb) FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION public.agent_getting_started_start_trial(uuid, uuid, jsonb) TO authenticated, service_role;
+
+-- \u2500\u2500 "I want to subscribe" \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+CREATE OR REPLACE FUNCTION public.getting_started_request_contract(p_tenant uuid DEFAULT NULL, p_note text DEFAULT NULL)
+RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO '' AS $$
+DECLARE
+  v_tenant   uuid := coalesce(p_tenant, app.current_tenant_id());
+  v_inserted boolean;
+BEGIN
+  IF auth.uid() IS NULL OR v_tenant IS NULL OR v_tenant IS DISTINCT FROM app.current_tenant_id() THEN
+    RAISE EXCEPTION 'getting_started_request_contract: no session or tenant out of scope' USING ERRCODE = '42501';
+  END IF;
+  IF NOT app.has_permission('settings.manage') THEN
+    RAISE EXCEPTION 'getting_started_request_contract: settings.manage is required' USING ERRCODE = '42501';
+  END IF;
+
+  -- Rate limit: the timeline's one-per-day lock. The V1 had none.
+  INSERT INTO public.plg_getting_started_events (tenant_id, kind, actor_id, payload)
+  VALUES (v_tenant, 'wants_contract', auth.uid(), jsonb_build_object('note', left(coalesce(p_note, ''), 500)))
+  ON CONFLICT (tenant_id, kind, day) DO NOTHING
+  RETURNING true INTO v_inserted;
+  IF NOT coalesce(v_inserted, false) THEN
+    RETURN jsonb_build_object('ok', true, 'already_requested_today', true);
+  END IF;
+
+  INSERT INTO public.plg_getting_started_journeys (tenant_id, wants_contract_at)
+  VALUES (v_tenant, now())
+  ON CONFLICT (tenant_id) DO UPDATE
+    SET wants_contract_at = coalesce(public.plg_getting_started_journeys.wants_contract_at, now()),
+        updated_at = now();
+
+  PERFORM public.plg_emit_event('getting_started.wants_contract',
+    jsonb_build_object('note', left(coalesce(p_note, ''), 500)), 'tenant', v_tenant::text, v_tenant);
+
+  RETURN jsonb_build_object('ok', true);
+END $$;
+REVOKE ALL ON FUNCTION public.getting_started_request_contract(uuid, text) FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION public.getting_started_request_contract(uuid, text) TO authenticated, service_role;
+
+-- \u2500\u2500 reminders D\u22123 / D0 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- A tenant's calendar day. A bad zone name must not take the whole run down.
+CREATE OR REPLACE FUNCTION public.plg_getting_started_local_date(p_at timestamptz, p_tz text)
+RETURNS date LANGUAGE plpgsql STABLE SET search_path TO '' AS $$
+BEGIN
+  RETURN (p_at AT TIME ZONE coalesce(nullif(p_tz, ''), 'UTC'))::date;
+EXCEPTION WHEN OTHERS THEN
+  RETURN (p_at AT TIME ZONE 'UTC')::date;
+END $$;
+
+-- Who is due today. \`p_now\` is injectable so QA can simulate the day without touching the clock.
+-- Due-ness is by the tenant's local day; the once-a-day lock is by the run's UTC day, so a
+-- reminder sent before an extend does not block the one the new end date earns.
+CREATE OR REPLACE FUNCTION public.getting_started_reminders_due(p_now timestamptz DEFAULT now())
+RETURNS TABLE (tenant_id uuid, kind text, trial_ends_at timestamptz)
+LANGUAGE sql STABLE SECURITY DEFINER SET search_path TO '' AS $$
+  WITH due AS (
+    SELECT j.tenant_id, t.trial_ends_at,
+           public.plg_getting_started_local_date(t.trial_ends_at, t.settings ->> 'timezone') AS end_day,
+           public.plg_getting_started_local_date(p_now, t.settings ->> 'timezone')           AS today
+      FROM public.plg_getting_started_journeys j
+      JOIN public.tenants t ON t.id = j.tenant_id
+     WHERE j.trial_started_at IS NOT NULL
+       AND j.converted_at IS NULL
+       AND t.trial_ends_at IS NOT NULL
+  )
+  SELECT d.tenant_id,
+         CASE WHEN d.end_day = d.today + 3 THEN 'reminder_d3' ELSE 'reminder_d0' END AS kind,
+         d.trial_ends_at
+    FROM due d
+   WHERE d.end_day IN (d.today + 3, d.today)
+     AND NOT EXISTS (
+       SELECT 1 FROM public.plg_getting_started_events e
+        WHERE e.tenant_id = d.tenant_id
+          AND e.day = (p_now AT TIME ZONE 'UTC')::date
+          AND e.kind = CASE WHEN d.end_day = d.today + 3 THEN 'reminder_d3' ELSE 'reminder_d0' END
+     );
+$$;
+REVOKE ALL ON FUNCTION public.getting_started_reminders_due(timestamptz) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.getting_started_reminders_due(timestamptz) TO service_role;
+
+-- Templates are per tenant (notifications UNIQUE (tenant_id, key, channel, locale)).
+CREATE OR REPLACE FUNCTION public.getting_started_ensure_templates(p_tenant uuid)
+RETURNS void LANGUAGE plpgsql SECURITY DEFINER SET search_path TO '' AS $$
+BEGIN
+  IF to_regclass('public.plg_notifications_templates') IS NULL THEN RETURN; END IF;
+  INSERT INTO public.plg_notifications_templates (tenant_id, key, channel, locale, subject, body, variables, is_default)
+  VALUES
+    (p_tenant, 'getting_started.reminder_d3', 'in_app', 'pt-BR', 'Seu teste termina em 3 dias',
+     'Faltam 3 dias de teste gr\xE1tis. At\xE9 l\xE1 est\xE1 tudo liberado. Para continuar depois, \xE9 s\xF3 escolher um plano em Configura\xE7\xF5es \u203A Assinatura \u2014 sem fidelidade.',
+     '["trial_ends_at"]'::jsonb, true),
+    (p_tenant, 'getting_started.reminder_d0', 'in_app', 'pt-BR', 'Hoje \xE9 o \xFAltimo dia do seu teste',
+     'Termina hoje. Depois disso a loja continua e seus dados tamb\xE9m; o que \xE9 do plano pago fica fechado at\xE9 voc\xEA assinar.',
+     '["trial_ends_at"]'::jsonb, true)
+  ON CONFLICT (tenant_id, key, channel, locale) DO NOTHING;
+END $$;
+REVOKE ALL ON FUNCTION public.getting_started_ensure_templates(uuid) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.getting_started_ensure_templates(uuid) TO service_role;
+
+-- The job. Writes the event BEFORE enqueueing (the lock), then enqueues through notifications when present.
+CREATE OR REPLACE FUNCTION public.getting_started_reminders_run(p_now timestamptz DEFAULT now())
+RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO '' AS $$
+DECLARE
+  r         record;
+  v_day     date := (p_now AT TIME ZONE 'UTC')::date;
+  v_person  uuid;
+  v_sent    integer := 0;
+  v_skipped integer := 0;
+  v_queue   uuid;
+  v_enqueue boolean := to_regprocedure('public.notifications_enqueue(uuid,text,uuid,jsonb,text,timestamptz,text,text,uuid,uuid)') IS NOT NULL;
+BEGIN
+  IF NOT pg_try_advisory_xact_lock(hashtext('getting_started_reminders')) THEN
+    RETURN jsonb_build_object('skipped', 'another run is active');
+  END IF;
+
+  FOR r IN SELECT * FROM public.getting_started_reminders_due(p_now) LOOP
+    -- The owner: the team person whose e-mail is the first active member's.
+    SELECT pe.id INTO v_person
+      FROM app.memberships m
+      JOIN auth.users u ON u.id = m.user_id
+      JOIN public.people pe ON pe.tenant_id = m.tenant_id AND lower(pe.email) = lower(u.email)
+     WHERE m.tenant_id = r.tenant_id AND m.active
+     ORDER BY m.created_at
+     LIMIT 1;
+
+    INSERT INTO public.plg_getting_started_events (tenant_id, kind, day, channel, payload)
+    VALUES (r.tenant_id, r.kind, v_day, CASE WHEN v_person IS NULL THEN 'none' ELSE 'in_app' END,
+            jsonb_build_object('trial_ends_at', r.trial_ends_at))
+    ON CONFLICT (tenant_id, kind, day) DO NOTHING;
+    IF NOT FOUND THEN v_skipped := v_skipped + 1; CONTINUE; END IF;
+
+    IF v_person IS NULL OR NOT v_enqueue THEN
+      v_skipped := v_skipped + 1; CONTINUE;
+    END IF;
+
+    PERFORM public.getting_started_ensure_templates(r.tenant_id);
+    BEGIN
+      EXECUTE 'SELECT public.notifications_enqueue($1, $2, $3, $4, $5, $6, $7)'
+         INTO v_queue
+        USING r.tenant_id, 'getting_started.' || r.kind, v_person,
+              jsonb_build_object('trial_ends_at', r.trial_ends_at),
+              'getting_started:' || r.kind || ':' || r.tenant_id || ':' || v_day, p_now, 'in_app';
+      v_sent := v_sent + 1;
+    EXCEPTION WHEN OTHERS THEN
+      -- A provider down for one tenant does not stop the others; the event already marked the day.
+      UPDATE public.plg_getting_started_events SET payload = payload || jsonb_build_object('error', SQLERRM)
+       WHERE tenant_id = r.tenant_id AND kind = r.kind AND day = v_day;
+      v_skipped := v_skipped + 1;
+    END;
+  END LOOP;
+
+  RETURN jsonb_build_object('sent', v_sent, 'skipped', v_skipped);
+END $$;
+REVOKE ALL ON FUNCTION public.getting_started_reminders_run(timestamptz) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.getting_started_reminders_run(timestamptz) TO service_role;
+
+-- cron: the spine's guard, plus a row in app.scheduled_jobs so the schedule is visible without pg_cron.
+DO $cron$
+DECLARE v_hour integer;
+BEGIN
+  SELECT reminder_hour_utc INTO v_hour FROM public.plg_getting_started_config;
+  v_hour := coalesce(v_hour, 13);
+  INSERT INTO app.scheduled_jobs (job_name, schedule, command, scheduled, reason)
+  VALUES ('fayz_getting_started_reminders', format('0 %s * * *', v_hour), 'SELECT public.getting_started_reminders_run()', false, 'pending')
+  ON CONFLICT (job_name) DO UPDATE
+    SET schedule = EXCLUDED.schedule, command = EXCLUDED.command, updated_at = now();
+  IF to_regprocedure('cron.schedule(text, text, text)') IS NULL THEN
+    UPDATE app.scheduled_jobs SET scheduled = false, reason = 'pg_cron absent' WHERE job_name = 'fayz_getting_started_reminders';
+    RAISE NOTICE 'getting-started: pg_cron absent \u2014 reminders not scheduled';
+    RETURN;
+  END IF;
+  PERFORM cron.unschedule(jobid) FROM cron.job WHERE jobname = 'fayz_getting_started_reminders';
+  PERFORM cron.schedule('fayz_getting_started_reminders', format('0 %s * * *', v_hour), $job$SELECT public.getting_started_reminders_run()$job$);
+  UPDATE app.scheduled_jobs SET scheduled = true, reason = NULL WHERE job_name = 'fayz_getting_started_reminders';
+END $cron$;
+
+-- \u2500\u2500 the lead in Faya's CRM \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+CREATE OR REPLACE FUNCTION public.plg_getting_started_lead(p_tenant uuid, p_tag text, p_extra jsonb DEFAULT '{}'::jsonb)
+RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO '' AS $$
+DECLARE
+  v_crm   uuid;
+  v_slug  text;
+  v_name  text;
+  v_email text;
+  v_phone text;
+  v_lead  uuid;
+  v_j     record;
+BEGIN
+  IF to_regprocedure('public.create_public_lead(uuid,text,text,text,text,text,jsonb,text,jsonb,text[],jsonb,text)') IS NULL THEN
+    RETURN jsonb_build_object('skipped', 'plugin-crm absent');
+  END IF;
+  SELECT c.crm_tenant_slug INTO v_slug FROM public.plg_getting_started_config c;
+  SELECT t.id INTO v_crm FROM public.tenants t WHERE t.slug = v_slug;
+  IF v_crm IS NULL OR v_crm = p_tenant THEN RETURN jsonb_build_object('skipped', 'crm tenant not found'); END IF;
+
+  SELECT t.name, t.slug INTO v_name, v_slug FROM public.tenants t WHERE t.id = p_tenant;
+  IF v_name IS NULL THEN RETURN jsonb_build_object('skipped', 'tenant not found'); END IF;
+
+  SELECT u.email, pe.phone INTO v_email, v_phone
+    FROM app.memberships m
+    JOIN auth.users u ON u.id = m.user_id
+    LEFT JOIN public.people pe ON pe.tenant_id = m.tenant_id AND lower(pe.email) = lower(u.email)
+   WHERE m.tenant_id = p_tenant AND m.active
+   ORDER BY m.created_at
+   LIMIT 1;
+  -- create_public_lead raises on a phone outside 8\u201315 digits; a bad number is dropped, not fatal.
+  v_phone := nullif(regexp_replace(coalesce(v_phone, ''), '\\D', '', 'g'), '');
+  IF v_phone IS NOT NULL AND length(v_phone) NOT BETWEEN 8 AND 15 THEN v_phone := NULL; END IF;
+  IF v_email IS NULL AND v_phone IS NULL THEN RETURN jsonb_build_object('skipped', 'no contact'); END IF;
+
+  SELECT * INTO v_j FROM public.v_getting_started_journey v WHERE v.tenant_id = p_tenant;
+
+  -- Dedupe by e-mail/phone is create_public_lead's own; the tag says where in the journey this is.
+  SELECT l.lead_id INTO v_lead FROM public.create_public_lead(
+    v_crm, left(rpad(btrim(v_name), 2, '.'), 120), v_phone, v_email,
+    'getting-started', 'Teste gr\xE1tis \u2014 ' || coalesce(v_slug, ''),
+    jsonb_build_object('tenant_id', p_tenant, 'tenant_slug', v_slug, 'phase', v_j.phase,
+                       'trial_started_at', v_j.trial_started_at, 'trial_ends_at', v_j.trial_ends_at)
+      || coalesce(p_extra, '{}'::jsonb),
+    NULL, coalesce(v_j.utm, '{}'::jsonb), ARRAY['trial', p_tag], '[]'::jsonb, NULL) l;
+  RETURN jsonb_build_object('lead_id', v_lead, 'tag', p_tag);
+END $$;
+REVOKE ALL ON FUNCTION public.plg_getting_started_lead(uuid, text, jsonb) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.plg_getting_started_lead(uuid, text, jsonb) TO service_role;
+
+-- Handlers in the shape consume_event_log runs: public.<handler>(jsonb), where the argument is
+-- to_jsonb(event_log row) \u2014 so \`tenant_id\` and \`payload\` are top-level keys.
+CREATE OR REPLACE FUNCTION public.plg_getting_started_on_trial_started(p_event jsonb)
+RETURNS jsonb LANGUAGE sql SECURITY DEFINER SET search_path TO '' AS $$
+  SELECT public.plg_getting_started_lead((p_event ->> 'tenant_id')::uuid, 'trial_started', coalesce(p_event -> 'payload', '{}'::jsonb));
+$$;
+CREATE OR REPLACE FUNCTION public.plg_getting_started_on_wants_contract(p_event jsonb)
+RETURNS jsonb LANGUAGE sql SECURITY DEFINER SET search_path TO '' AS $$
+  SELECT public.plg_getting_started_lead((p_event ->> 'tenant_id')::uuid, 'quer_contratar', coalesce(p_event -> 'payload', '{}'::jsonb));
+$$;
+REVOKE ALL ON FUNCTION public.plg_getting_started_on_trial_started(jsonb) FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.plg_getting_started_on_wants_contract(jsonb) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.plg_getting_started_on_trial_started(jsonb) TO service_role;
+GRANT EXECUTE ON FUNCTION public.plg_getting_started_on_wants_contract(jsonb) TO service_role;
+
+SELECT public.register_event_subscription('getting-started', 'getting_started.trial_started',  'plg_getting_started_on_trial_started',  'Faya lead when the trial starts', 5);
+SELECT public.register_event_subscription('getting-started', 'getting_started.wants_contract', 'plg_getting_started_on_wants_contract', 'Faya lead when the tenant wants to subscribe', 5);
+`;
+var MIGRATION_002_PLATFORM_OPERATOR = `-- 002_platform_operator.sql \u2014 the platform reads every tenant's trial and acts on it.
+-- Functions only; no new table. Depends on 000_journey.sql and 001_trial_clock.sql.
+--
+-- "Platform operator" = an active member of the tenant named by
+-- plg_getting_started_config.crm_tenant_slug, acting INSIDE that tenant
+-- (app.current_tenant_id()), or \u2014 where the live cluster has the platform
+-- schema \u2014 platform.can(auth.uid(), 'tenants.write'). Same shape as
+-- support_is_operator(): the boundary is a SECURITY DEFINER function with a
+-- guard; no RLS policy opens between tenants.
+
+-- \u2500\u2500 who is the platform \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+CREATE OR REPLACE FUNCTION public.getting_started_platform_tenant()
+RETURNS uuid LANGUAGE sql STABLE SECURITY DEFINER SET search_path TO '' AS $$
+  SELECT t.id
+    FROM public.plg_getting_started_config c
+    JOIN public.tenants t ON t.slug = c.crm_tenant_slug
+   LIMIT 1;
+$$;
+REVOKE ALL ON FUNCTION public.getting_started_platform_tenant() FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION public.getting_started_platform_tenant() TO authenticated, service_role;
+
+CREATE OR REPLACE FUNCTION public.getting_started_is_platform_operator()
+RETURNS boolean LANGUAGE plpgsql STABLE SECURITY DEFINER SET search_path TO '' AS $$
+DECLARE
+  v_uid      uuid := auth.uid();
+  v_platform uuid := public.getting_started_platform_tenant();
+  v_can      boolean := false;
+BEGIN
+  IF v_uid IS NULL THEN RETURN false; END IF;
+  IF v_platform IS NOT NULL AND v_platform = app.current_tenant_id() AND EXISTS (
+       SELECT 1 FROM app.memberships m
+        WHERE m.tenant_id = v_platform AND m.user_id = v_uid AND m.active) THEN
+    RETURN true;
+  END IF;
+  -- Optional reinforcement: the platform schema lives only on the live cluster.
+  IF to_regprocedure('platform.can(uuid,text)') IS NOT NULL THEN
+    EXECUTE 'SELECT platform.can($1, $2)' INTO v_can USING v_uid, 'tenants.write';
+  END IF;
+  RETURN coalesce(v_can, false);
+END $$;
+REVOKE ALL ON FUNCTION public.getting_started_is_platform_operator() FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION public.getting_started_is_platform_operator() TO authenticated, service_role;
+
+CREATE OR REPLACE FUNCTION public.getting_started_platform_guard()
+RETURNS void LANGUAGE plpgsql STABLE SECURITY DEFINER SET search_path TO '' AS $$
+BEGIN
+  IF NOT public.getting_started_is_platform_operator() THEN
+    RAISE EXCEPTION 'not a platform operator' USING ERRCODE = '42501';
+  END IF;
+END $$;
+REVOKE ALL ON FUNCTION public.getting_started_platform_guard() FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION public.getting_started_platform_guard() TO authenticated, service_role;
+
+-- \u2500\u2500 timeline note that survives a repeat on the same day \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- plg_getting_started_events is UNIQUE (tenant_id, kind, day). A second
+-- extension on the same day keeps one row and folds the latest payload in,
+-- counting the repeats; the customer-success timeline keeps every action.
+CREATE OR REPLACE FUNCTION public.plg_getting_started_note(p_tenant uuid, p_kind text, p_payload jsonb, p_actor uuid DEFAULT auth.uid())
+RETURNS void LANGUAGE plpgsql SECURITY DEFINER SET search_path TO '' AS $$
+BEGIN
+  INSERT INTO public.plg_getting_started_events (tenant_id, kind, actor_id, payload)
+  VALUES (p_tenant, p_kind, p_actor, coalesce(p_payload, '{}'::jsonb))
+  ON CONFLICT (tenant_id, kind, day) DO UPDATE
+    SET payload  = public.plg_getting_started_events.payload || EXCLUDED.payload
+                   || jsonb_build_object('repeats', coalesce((public.plg_getting_started_events.payload ->> 'repeats')::int, 0) + 1),
+        actor_id = coalesce(EXCLUDED.actor_id, public.plg_getting_started_events.actor_id);
+END $$;
+REVOKE ALL ON FUNCTION public.plg_getting_started_note(uuid, text, jsonb, uuid) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.plg_getting_started_note(uuid, text, jsonb, uuid) TO service_role;
+
+-- \u2500\u2500 every tenant's journey, for the platform \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+CREATE OR REPLACE FUNCTION public.getting_started_platform_journeys(p_search text DEFAULT NULL, p_phase text DEFAULT NULL)
+RETURNS jsonb LANGUAGE plpgsql STABLE SECURITY DEFINER SET search_path TO '' AS $$
+DECLARE
+  v_platform uuid := public.getting_started_platform_tenant();
+  v_search   text := nullif(btrim(coalesce(p_search, '')), '');
+  v_result   jsonb;
+BEGIN
+  PERFORM public.getting_started_platform_guard();
+  SELECT coalesce(jsonb_agg(to_jsonb(r) ORDER BY r.tenant_created_at DESC), '[]'::jsonb) INTO v_result
+  FROM (
+    SELECT t.id                 AS tenant_id,
+           t.name               AS tenant_name,
+           t.slug               AS tenant_slug,
+           t.vertical_id,
+           t.plan               AS pool_plan,
+           t.settings #>> '{billing,plan_id}' AS grants_plan,
+           t.kind,
+           t.created_at         AS tenant_created_at,
+           coalesce((SELECT array_agg(ta.app_id ORDER BY ta.created_at)
+                       FROM app.tenant_apps ta WHERE ta.tenant_id = t.id AND ta.status = 'active'), '{}'::text[]) AS apps,
+           coalesce((SELECT l.state FROM app.tenant_lifecycle l WHERE l.tenant_id = t.id), 'active') AS lifecycle_state,
+           coalesce(j.phase, 'setup') AS phase,
+           j.ready_at, j.trial_started_at, j.trial_ends_at, j.setup_deadline_at, j.converted_at, j.wants_contract_at,
+           coalesce(j.trial_days, c.trial_days) AS trial_days,
+           j.source, coalesce(j.utm, '{}'::jsonb) AS utm,
+           public.getting_started_minimums(t.id) AS minimums,
+           (SELECT jsonb_build_object('email', u.email, 'name', pe.name, 'phone', pe.phone)
+              FROM app.memberships m
+              JOIN auth.users u ON u.id = m.user_id
+              LEFT JOIN public.people pe ON pe.id = m.person_id
+             WHERE m.tenant_id = t.id AND m.active
+             ORDER BY m.created_at LIMIT 1) AS contact,
+           (SELECT jsonb_build_object('kind', e.kind, 'created_at', e.created_at)
+              FROM public.plg_getting_started_events e
+             WHERE e.tenant_id = t.id ORDER BY e.created_at DESC LIMIT 1) AS last_event,
+           (SELECT count(*) FROM public.plg_getting_started_events e WHERE e.tenant_id = t.id) AS events_count
+      FROM public.tenants t
+      CROSS JOIN public.plg_getting_started_config c
+      LEFT JOIN public.v_getting_started_journey j ON j.tenant_id = t.id
+     WHERE (v_platform IS NULL OR t.id <> v_platform)
+       AND (p_phase IS NULL OR coalesce(j.phase, 'setup') = p_phase)
+       AND (v_search IS NULL
+            OR t.name ILIKE '%' || v_search || '%'
+            OR t.slug ILIKE '%' || v_search || '%'
+            OR EXISTS (SELECT 1 FROM app.memberships m JOIN auth.users u ON u.id = m.user_id
+                        WHERE m.tenant_id = t.id AND m.active AND u.email ILIKE '%' || v_search || '%'))
+  ) r;
+  RETURN v_result;
+END $$;
+REVOKE ALL ON FUNCTION public.getting_started_platform_journeys(text, text) FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION public.getting_started_platform_journeys(text, text) TO authenticated, service_role;
+
+-- \u2500\u2500 act on one tenant's trial \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- extend  : adds p_days (1..90) on top of greatest(trial_ends_at, now()) \u2014 V1 \xA76.6.
+-- end_now : trial_ends_at = now(); emits getting_started.expired.
+-- convert : converted_at = coalesce(converted_at, now()); emits getting_started.converted.
+-- remind  : one in_app notice to the first member, template getting_started.reminder_d0.
+-- The operator is not a member of the house, and plg_emit_event refuses a caller outside
+-- the tenant. The guard above already authorised the platform; file the fact directly.
+CREATE OR REPLACE FUNCTION public.plg_getting_started_platform_emit(p_tenant uuid, p_key text, p_payload jsonb)
+RETURNS uuid LANGUAGE plpgsql SECURITY DEFINER SET search_path TO '' AS $$
+DECLARE v_id uuid;
+BEGIN
+  INSERT INTO public.event_log (tenant_id, event_key, payload, actor_id, subject_type, subject_id)
+  VALUES (p_tenant, p_key, coalesce(p_payload, '{}'::jsonb), auth.uid(), 'tenant', p_tenant::text)
+  RETURNING id INTO v_id;
+  RETURN v_id;
+EXCEPTION WHEN OTHERS THEN
+  RAISE WARNING '[getting_started_trial_set] % not recorded: %', p_key, SQLERRM;
+  RETURN NULL;
+END $$;
+REVOKE ALL ON FUNCTION public.plg_getting_started_platform_emit(uuid, text, jsonb) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.plg_getting_started_platform_emit(uuid, text, jsonb) TO service_role;
+
+CREATE OR REPLACE FUNCTION public.getting_started_trial_set(p_tenant uuid, p_action text, p_days integer DEFAULT NULL, p_reason text DEFAULT NULL)
+RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO '' AS $$
+DECLARE
+  v_platform  uuid := public.getting_started_platform_tenant();
+  v_actor     uuid := auth.uid();
+  v_reason    text := nullif(btrim(coalesce(p_reason, '')), '');
+  v_t         record;
+  v_j         record;
+  v_before    jsonb;
+  v_after     jsonb;
+  v_payload   jsonb := '{}'::jsonb;
+  v_ends      timestamptz;
+  v_converted timestamptz;
+  v_person    uuid;
+  v_nonce     text;
+  v_queue     uuid;
+  v_enqueue   boolean := to_regprocedure('public.notifications_enqueue(uuid,text,uuid,jsonb,text,timestamptz,text,text,uuid,uuid)') IS NOT NULL;
+  v_ok        boolean := true;
+BEGIN
+  PERFORM public.getting_started_platform_guard();
+  IF p_action IS NULL OR p_action NOT IN ('extend', 'end_now', 'convert', 'remind') THEN
+    RAISE EXCEPTION 'invalid action %', p_action USING ERRCODE = '22023';
+  END IF;
+  IF p_tenant IS NULL OR p_tenant = v_platform THEN
+    RAISE EXCEPTION 'tenant out of scope' USING ERRCODE = '22023';
+  END IF;
+  SELECT t.id, t.trial_ends_at INTO v_t FROM public.tenants t WHERE t.id = p_tenant FOR UPDATE;
+  IF NOT FOUND THEN RAISE EXCEPTION 'tenant not found' USING ERRCODE = 'P0002'; END IF;
+  SELECT j.trial_started_at, j.converted_at INTO v_j FROM public.plg_getting_started_journeys j WHERE j.tenant_id = p_tenant;
+
+  v_before := jsonb_build_object('trial_ends_at', v_t.trial_ends_at, 'trial_started_at', v_j.trial_started_at, 'converted_at', v_j.converted_at);
+  v_ends := v_t.trial_ends_at;
+  v_converted := v_j.converted_at;
+
+  IF p_action = 'extend' THEN
+    IF p_days IS NULL OR p_days NOT BETWEEN 1 AND 90 THEN
+      RAISE EXCEPTION 'p_days must be between 1 and 90' USING ERRCODE = '22023';
+    END IF;
+    v_ends := greatest(coalesce(v_t.trial_ends_at, now()), now()) + make_interval(days => p_days);
+    INSERT INTO public.plg_getting_started_journeys (tenant_id, trial_started_at, trial_days)
+    VALUES (p_tenant, now(), (SELECT c.trial_days FROM public.plg_getting_started_config c))
+    ON CONFLICT (tenant_id) DO UPDATE
+      SET trial_started_at = coalesce(public.plg_getting_started_journeys.trial_started_at, EXCLUDED.trial_started_at),
+          updated_at = now();
+    -- Passes tenants_trial_is_readonly: SECURITY DEFINER runs as the owner.
+    UPDATE public.tenants SET trial_ends_at = v_ends WHERE id = p_tenant;
+    v_payload := jsonb_build_object('days', p_days, 'ends_at', v_ends, 'reason', v_reason);
+    PERFORM public.plg_getting_started_note(p_tenant, 'trial_extended', v_payload, v_actor);
+
+  ELSIF p_action = 'end_now' THEN
+    IF v_reason IS NULL THEN RAISE EXCEPTION 'a reason is required to end a trial' USING ERRCODE = '22023'; END IF;
+    v_ends := now();
+    UPDATE public.tenants SET trial_ends_at = v_ends WHERE id = p_tenant;
+    v_payload := jsonb_build_object('ends_at', v_ends, 'reason', v_reason);
+    PERFORM public.plg_getting_started_note(p_tenant, 'trial_ended', v_payload, v_actor);
+    PERFORM public.plg_getting_started_platform_emit(p_tenant, 'getting_started.expired',
+      jsonb_build_object('trial_ends_at', v_ends, 'reason', v_reason, 'ended_by', v_actor));
+
+  ELSIF p_action = 'convert' THEN
+    -- Without a proposal the operator writes why; with one, the caller passes 'proposal:<number>'.
+    IF v_reason IS NULL THEN RAISE EXCEPTION 'a reason is required to convert without a proposal' USING ERRCODE = '22023'; END IF;
+    v_converted := coalesce(v_j.converted_at, now());
+    INSERT INTO public.plg_getting_started_journeys (tenant_id, converted_at)
+    VALUES (p_tenant, v_converted)
+    ON CONFLICT (tenant_id) DO UPDATE
+      SET converted_at = coalesce(public.plg_getting_started_journeys.converted_at, EXCLUDED.converted_at),
+          updated_at = now();
+    v_payload := jsonb_build_object('converted_at', v_converted, 'reason', v_reason);
+    IF v_j.converted_at IS NULL THEN
+      PERFORM public.plg_getting_started_note(p_tenant, 'converted', v_payload, v_actor);
+      PERFORM public.plg_getting_started_platform_emit(p_tenant, 'getting_started.converted',
+        jsonb_build_object('converted_at', v_converted, 'reason', v_reason, 'converted_by', v_actor));
+    END IF;
+
+  ELSIF p_action = 'remind' THEN
+    SELECT pe.id INTO v_person
+      FROM app.memberships m
+      JOIN auth.users u ON u.id = m.user_id
+      JOIN public.people pe ON pe.tenant_id = m.tenant_id AND lower(pe.email) = lower(u.email)
+     WHERE m.tenant_id = p_tenant AND m.active
+     ORDER BY m.created_at LIMIT 1;
+    v_nonce := left(md5(random()::text || clock_timestamp()::text), 12);
+    v_payload := jsonb_build_object('trial_ends_at', v_t.trial_ends_at, 'nonce', v_nonce, 'reason', v_reason,
+                                    'channel', CASE WHEN v_person IS NULL OR NOT v_enqueue THEN 'none' ELSE 'in_app' END);
+    IF v_person IS NULL OR NOT v_enqueue THEN
+      v_ok := false;
+      v_payload := v_payload || jsonb_build_object('skipped', CASE WHEN v_person IS NULL THEN 'no contact' ELSE 'plugin-notifications absent' END);
+    ELSE
+      PERFORM public.getting_started_ensure_templates(p_tenant);
+      EXECUTE 'SELECT public.notifications_enqueue($1, $2, $3, $4, $5, $6, $7)'
+         INTO v_queue
+        USING p_tenant, 'getting_started.reminder_d0', v_person,
+              jsonb_build_object('trial_ends_at', v_t.trial_ends_at),
+              'getting_started:reminder_manual:' || p_tenant || ':' || v_nonce, now(), 'in_app';
+      v_payload := v_payload || jsonb_build_object('queue_id', v_queue);
+    END IF;
+    PERFORM public.plg_getting_started_note(p_tenant, 'reminder_manual', v_payload, v_actor);
+  END IF;
+
+  v_after := jsonb_build_object('trial_ends_at', v_ends, 'converted_at', v_converted);
+  -- audit_log derives the tenant from the session for a signed-in caller; the
+  -- customer tenant travels in the metadata. A service_role run names the platform.
+  PERFORM public.audit_log('getting_started.' || p_action, 'tenant', p_tenant, v_reason, v_before, v_after, NULL,
+    v_payload || jsonb_build_object('customer_tenant_id', p_tenant),
+    CASE WHEN v_actor IS NULL THEN v_platform ELSE NULL END);
+
+  RETURN jsonb_build_object('ok', v_ok, 'action', p_action, 'tenant_id', p_tenant,
+                            'trial_ends_at', v_ends, 'converted_at', v_converted);
+END $$;
+REVOKE ALL ON FUNCTION public.getting_started_trial_set(uuid, text, integer, text) FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION public.getting_started_trial_set(uuid, text, integer, text) TO authenticated, service_role;
+`;
+var MIGRATION_003_THE_CLOCK_STARTS_ONCE_AND_ONLY_FOR_WHO_MAY = `-- 003_the_clock_starts_once_and_only_for_who_may.sql \u2014 the gates the audit found open.
+-- Functions and grants only; no new table. Depends on 000, 001 and 002.
+--
+--   * getting_started_start_trial: the tenant row is locked (FOR UPDATE), so two
+--     clicks cannot start twice and emit twice; a tenant with no trial window
+--     (trial_ends_at IS NULL \u2014 legacy or paying, db 044), an already converted
+--     journey or a paid plan is refused instead of being handed a clock that
+--     expires on them.
+--   * getting_started_minimums: a member of the tenant (or the platform
+--     operator of 002, or service_role) \u2014 not any signed-in user probing other
+--     tenants by id.
+--   * plg_getting_started_config: the client reads only the columns it needs;
+--     crm_tenant_slug is the platform's business.
+--   * the event handlers accept only what the RPCs wrote \u2014 plg_emit_event is
+--     open to any member, and a hand-made \`trial_started\` must not create a lead.
+
+-- \u2500\u2500 the minimums: only for who may ask \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+CREATE OR REPLACE FUNCTION public.getting_started_minimums(p_tenant uuid)
+RETURNS jsonb LANGUAGE plpgsql STABLE SECURITY DEFINER SET search_path TO '' AS $$
+DECLARE
+  v_menu     boolean := false;
+  v_hours    boolean := false;
+  v_order    boolean := false;
+  v_settings jsonb;
+  v_operator boolean := false;
+BEGIN
+  IF p_tenant IS NULL THEN
+    RAISE EXCEPTION 'getting_started_minimums: tenant is required' USING ERRCODE = '22023';
+  END IF;
+  -- service_role (jobs), a member of the tenant, or the platform operator (002).
+  IF auth.role() IS DISTINCT FROM 'service_role' AND NOT app.is_member(p_tenant) THEN
+    IF to_regprocedure('public.getting_started_is_platform_operator()') IS NOT NULL THEN
+      EXECUTE 'SELECT public.getting_started_is_platform_operator()' INTO v_operator;
+    END IF;
+    IF NOT coalesce(v_operator, false) THEN
+      RAISE EXCEPTION 'getting_started_minimums: not a member of this tenant' USING ERRCODE = '42501';
+    END IF;
+  END IF;
+
+  SELECT t.settings INTO v_settings FROM public.tenants t WHERE t.id = p_tenant;
+  v_hours := jsonb_typeof(v_settings #> '{store,hours}') = 'object'
+             AND (v_settings #> '{store,hours}') <> '{}'::jsonb;
+  -- A pool without plugin-menu must not break the read.
+  IF to_regclass('public.plg_menu_items') IS NOT NULL THEN
+    EXECUTE $q$SELECT EXISTS (
+                 SELECT 1 FROM public.plg_menu_items mi
+                 JOIN public.products p ON p.id = mi.product_id
+                 WHERE mi.tenant_id = $1 AND mi.status = 'available' AND p.is_active
+                   AND coalesce(p.metadata->>'demo','') <> 'true')$q$
+      INTO v_menu USING p_tenant;
+  END IF;
+  SELECT EXISTS (
+    SELECT 1 FROM public.orders o
+    WHERE o.tenant_id = p_tenant AND o.status = 'completed'
+      AND o.metadata @> '{"test":true}'::jsonb
+  ) INTO v_order;
+  RETURN jsonb_build_object(
+    'menu', v_menu, 'hours', v_hours, 'test_order', v_order,
+    'ready', v_menu AND v_hours AND v_order
+  );
+END $$;
+REVOKE ALL ON FUNCTION public.getting_started_minimums(uuid) FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION public.getting_started_minimums(uuid) TO authenticated, service_role;
+
+-- \u2500\u2500 start the trial: once, locked, and only for a tenant that can be on trial \u2500
+CREATE OR REPLACE FUNCTION public.getting_started_start_trial(p_tenant uuid DEFAULT NULL)
+RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO '' AS $$
+DECLARE
+  v_tenant  uuid := coalesce(p_tenant, app.current_tenant_id());
+  v_days    integer;
+  v_min     jsonb;
+  v_t       record;
+  v_j       record;
+  v_started timestamptz;
+  v_ends    timestamptz;
+BEGIN
+  -- Same gate as tenant_setting_set: a session, the tenant in scope, settings.manage.
+  IF auth.uid() IS NULL OR v_tenant IS NULL OR v_tenant IS DISTINCT FROM app.current_tenant_id() THEN
+    RAISE EXCEPTION 'getting_started_start_trial: no session or tenant out of scope' USING ERRCODE = '42501';
+  END IF;
+  IF NOT app.has_permission('settings.manage') THEN
+    RAISE EXCEPTION 'getting_started_start_trial: settings.manage is required' USING ERRCODE = '42501';
+  END IF;
+
+  -- The lock: a second concurrent call waits here and then sees the start.
+  SELECT t.id, t.trial_ends_at, t.plan INTO v_t FROM public.tenants t WHERE t.id = v_tenant FOR UPDATE;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'getting_started_start_trial: tenant not found' USING ERRCODE = 'P0002';
+  END IF;
+  SELECT j.trial_started_at, j.converted_at INTO v_j
+    FROM public.plg_getting_started_journeys j WHERE j.tenant_id = v_tenant FOR UPDATE;
+
+  -- Idempotent: a second call returns the state and leaves the date alone.
+  IF v_j.trial_started_at IS NOT NULL THEN
+    RETURN jsonb_build_object('ok', true, 'already_started', true, 'trial_started_at', v_j.trial_started_at,
+                              'trial_ends_at', v_t.trial_ends_at);
+  END IF;
+
+  v_min := public.getting_started_minimums(v_tenant);
+
+  -- Who is already converted, or already paying, is not offered a clock that
+  -- would expire on them. \`trial_ends_at IS NULL\` is the legacy/paying tenant
+  -- (db 044): no window, no trial.
+  IF v_j.converted_at IS NOT NULL THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'already_converted', 'minimums', v_min);
+  END IF;
+  IF coalesce(nullif(btrim(v_t.plan), ''), 'free') <> 'free' THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'already_paid', 'minimums', v_min, 'plan', v_t.plan);
+  END IF;
+  IF v_t.trial_ends_at IS NULL THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'no_trial_window', 'minimums', v_min);
+  END IF;
+
+  -- Minimums are checked here, not in the button.
+  IF NOT coalesce((v_min ->> 'ready')::boolean, false) THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'minimums_missing', 'minimums', v_min);
+  END IF;
+
+  SELECT c.trial_days INTO v_days FROM public.plg_getting_started_config c;
+  v_days    := coalesce(v_days, 14);
+  v_started := now();
+  v_ends    := v_started + make_interval(days => v_days);
+
+  INSERT INTO public.plg_getting_started_journeys (tenant_id, ready_at, trial_started_at, trial_days)
+  VALUES (v_tenant, v_started, v_started, v_days)
+  ON CONFLICT (tenant_id) DO UPDATE
+    SET ready_at = coalesce(public.plg_getting_started_journeys.ready_at, EXCLUDED.ready_at),
+        trial_started_at = EXCLUDED.trial_started_at,
+        trial_days = EXCLUDED.trial_days,
+        updated_at = now();
+
+  -- The real clock. Passes tenants_trial_is_readonly (db 221): this DEFINER
+  -- function runs as its owner, which the gate lets through.
+  UPDATE public.tenants SET trial_ends_at = v_ends WHERE id = v_tenant;
+
+  INSERT INTO public.plg_getting_started_events (tenant_id, kind, actor_id, payload)
+  VALUES (v_tenant, 'trial_started', auth.uid(), jsonb_build_object('trial_days', v_days, 'ends_at', v_ends))
+  ON CONFLICT (tenant_id, kind, day) DO NOTHING;
+
+  PERFORM public.plg_emit_event('getting_started.trial_started',
+    jsonb_build_object('trial_days', v_days, 'trial_ends_at', v_ends), 'tenant', v_tenant::text, v_tenant);
+
+  RETURN jsonb_build_object('ok', true, 'trial_started_at', v_started, 'trial_ends_at', v_ends, 'trial_days', v_days);
+END $$;
+REVOKE ALL ON FUNCTION public.getting_started_start_trial(uuid) FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION public.getting_started_start_trial(uuid) TO authenticated, service_role;
+
+-- \u2500\u2500 the platform config: the client reads only what it needs \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- The view (000) reads trial_days; the setup window is documentation of the
+-- spine default. crm_tenant_slug and reminder_hour_utc are read inside the
+-- DEFINER functions only. The policy stays (USING true); the GRANT narrows.
+REVOKE SELECT ON public.plg_getting_started_config FROM authenticated;
+GRANT SELECT (id, trial_days, setup_window_days) ON public.plg_getting_started_config TO authenticated;
+
+-- \u2500\u2500 the handlers accept only what the RPCs wrote \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- plg_emit_event is open to any member of the tenant; the journey row and the
+-- timeline are written by DEFINER RPCs only (no write policy). So a lead is
+-- created only when the mark the RPC leaves is there.
+CREATE OR REPLACE FUNCTION public.plg_getting_started_on_trial_started(p_event jsonb)
+RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO '' AS $$
+DECLARE
+  v_tenant uuid := nullif(p_event ->> 'tenant_id', '')::uuid;
+BEGIN
+  IF v_tenant IS NULL THEN
+    RETURN jsonb_build_object('skipped', 'no tenant');
+  END IF;
+  IF NOT EXISTS (
+       SELECT 1 FROM public.plg_getting_started_journeys j
+        WHERE j.tenant_id = v_tenant AND j.trial_started_at IS NOT NULL)
+     OR NOT EXISTS (
+       SELECT 1 FROM public.plg_getting_started_events e
+        WHERE e.tenant_id = v_tenant AND e.kind = 'trial_started') THEN
+    RETURN jsonb_build_object('skipped', 'trial_started was not written by getting_started_start_trial');
+  END IF;
+  RETURN public.plg_getting_started_lead(v_tenant, 'trial_started', coalesce(p_event -> 'payload', '{}'::jsonb));
+END $$;
+
+CREATE OR REPLACE FUNCTION public.plg_getting_started_on_wants_contract(p_event jsonb)
+RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO '' AS $$
+DECLARE
+  v_tenant uuid := nullif(p_event ->> 'tenant_id', '')::uuid;
+BEGIN
+  IF v_tenant IS NULL THEN
+    RETURN jsonb_build_object('skipped', 'no tenant');
+  END IF;
+  IF NOT EXISTS (
+       SELECT 1 FROM public.plg_getting_started_journeys j
+        WHERE j.tenant_id = v_tenant AND j.wants_contract_at IS NOT NULL)
+     OR NOT EXISTS (
+       SELECT 1 FROM public.plg_getting_started_events e
+        WHERE e.tenant_id = v_tenant AND e.kind = 'wants_contract'
+          AND e.created_at >= now() - interval '2 days') THEN
+    RETURN jsonb_build_object('skipped', 'wants_contract was not written by getting_started_request_contract');
+  END IF;
+  RETURN public.plg_getting_started_lead(v_tenant, 'quer_contratar', coalesce(p_event -> 'payload', '{}'::jsonb));
+END $$;
+REVOKE ALL ON FUNCTION public.plg_getting_started_on_trial_started(jsonb) FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.plg_getting_started_on_wants_contract(jsonb) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.plg_getting_started_on_trial_started(jsonb) TO service_role;
+GRANT EXECUTE ON FUNCTION public.plg_getting_started_on_wants_contract(jsonb) TO service_role;
+`;
+var MIGRATION_004_LEAD_KEEPS_THE_NAME = `-- 004_lead_keeps_the_name.sql \u2014 001 padded the house name with rpad(name, 2), which also CUTS it to 2
+-- characters: every lead in the Faya CRM was born named "Bu". Pad only names shorter than 2.
+
+CREATE OR REPLACE FUNCTION public.plg_getting_started_lead(p_tenant uuid, p_tag text, p_extra jsonb DEFAULT '{}'::jsonb)
+RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path TO '' AS $$
+DECLARE
+  v_crm   uuid;
+  v_slug  text;
+  v_name  text;
+  v_email text;
+  v_phone text;
+  v_lead  uuid;
+  v_j     record;
+BEGIN
+  IF to_regprocedure('public.create_public_lead(uuid,text,text,text,text,text,jsonb,text,jsonb,text[],jsonb,text)') IS NULL THEN
+    RETURN jsonb_build_object('skipped', 'plugin-crm absent');
+  END IF;
+  SELECT c.crm_tenant_slug INTO v_slug FROM public.plg_getting_started_config c;
+  SELECT t.id INTO v_crm FROM public.tenants t WHERE t.slug = v_slug;
+  IF v_crm IS NULL OR v_crm = p_tenant THEN RETURN jsonb_build_object('skipped', 'crm tenant not found'); END IF;
+
+  SELECT t.name, t.slug INTO v_name, v_slug FROM public.tenants t WHERE t.id = p_tenant;
+  IF v_name IS NULL THEN RETURN jsonb_build_object('skipped', 'tenant not found'); END IF;
+
+  SELECT u.email, pe.phone INTO v_email, v_phone
+    FROM app.memberships m
+    JOIN auth.users u ON u.id = m.user_id
+    LEFT JOIN public.people pe ON pe.tenant_id = m.tenant_id AND lower(pe.email) = lower(u.email)
+   WHERE m.tenant_id = p_tenant AND m.active
+   ORDER BY m.created_at
+   LIMIT 1;
+  -- create_public_lead raises on a phone outside 8\u201315 digits; a bad number is dropped, not fatal.
+  v_phone := nullif(regexp_replace(coalesce(v_phone, ''), '\\D', '', 'g'), '');
+  IF v_phone IS NOT NULL AND length(v_phone) NOT BETWEEN 8 AND 15 THEN v_phone := NULL; END IF;
+  IF v_email IS NULL AND v_phone IS NULL THEN RETURN jsonb_build_object('skipped', 'no contact'); END IF;
+
+  SELECT * INTO v_j FROM public.v_getting_started_journey v WHERE v.tenant_id = p_tenant;
+
+  -- Dedupe by e-mail/phone is create_public_lead's own; the tag says where in the journey this is.
+  SELECT l.lead_id INTO v_lead FROM public.create_public_lead(
+    v_crm, left(CASE WHEN length(btrim(v_name)) < 2 THEN rpad(btrim(v_name), 2, '.') ELSE btrim(v_name) END, 120), v_phone, v_email,
+    'getting-started', 'Teste gr\xE1tis \u2014 ' || coalesce(v_slug, ''),
+    jsonb_build_object('tenant_id', p_tenant, 'tenant_slug', v_slug, 'phase', v_j.phase,
+                       'trial_started_at', v_j.trial_started_at, 'trial_ends_at', v_j.trial_ends_at)
+      || coalesce(p_extra, '{}'::jsonb),
+    NULL, coalesce(v_j.utm, '{}'::jsonb), ARRAY['trial', p_tag], '[]'::jsonb, NULL) l;
+  RETURN jsonb_build_object('lead_id', v_lead, 'tag', p_tag);
+END $$;
+REVOKE ALL ON FUNCTION public.plg_getting_started_lead(uuid, text, jsonb) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.plg_getting_started_lead(uuid, text, jsonb) TO service_role;
+
+-- Handlers in the shape consume_event_log runs: public.<handler>(jsonb), where the argument is
+-- to_jsonb(event_log row) \u2014 so \`tenant_id\` and \`payload\` are top-level keys.
+CREATE OR REPLACE FUNCTION public.plg_getting_started_on_trial_started(p_event jsonb)
+RETURNS jsonb LANGUAGE sql SECURITY DEFINER SET search_path TO '' AS $$
+  SELECT public.plg_getting_started_lead((p_event ->> 'tenant_id')::uuid, 'trial_started', coalesce(p_event -> 'payload', '{}'::jsonb));
+$$;
+
+REVOKE ALL ON FUNCTION public.plg_getting_started_lead(uuid, text, jsonb) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.plg_getting_started_lead(uuid, text, jsonb) TO service_role;
+`;
+var MIGRATIONS = [
+  { id: "000_journey", sql: MIGRATION_000_JOURNEY },
+  { id: "001_trial_clock", sql: MIGRATION_001_TRIAL_CLOCK },
+  { id: "002_platform_operator", sql: MIGRATION_002_PLATFORM_OPERATOR },
+  { id: "003_the_clock_starts_once_and_only_for_who_may", sql: MIGRATION_003_THE_CLOCK_STARTS_ONCE_AND_ONLY_FOR_WHO_MAY },
+  { id: "004_lead_keeps_the_name", sql: MIGRATION_004_LEAD_KEEPS_THE_NAME }
+];
+
+export { MIGRATIONS, MIGRATION_000_JOURNEY, MIGRATION_001_TRIAL_CLOCK, MIGRATION_002_PLATFORM_OPERATOR, MIGRATION_003_THE_CLOCK_STARTS_ONCE_AND_ONLY_FOR_WHO_MAY, MIGRATION_004_LEAD_KEEPS_THE_NAME };
+//# sourceMappingURL=main.js.map
+//# sourceMappingURL=main.js.map