@fayz-ai/plugin-marketing 0.13.33 → 0.13.35

package/dist/migrations/main.js

@@ -0,0 +1,1660 @@
+// src/migrations/index.ts
+var MIGRATION_000_BASELINE = `-- ============================================================================
+-- plugins/plugin-marketing/src/migrations/000_baseline.sql \u2014 what installing this provisions, as one file.
+--
+-- GENERATED by scripts/emit-unit-baselines.mjs (#338). Do not edit by hand:
+-- change the schema, regenerate, and let scripts/check-chain-equivalence.mjs
+-- prove the result still matches.
+--
+-- This replaced 12 migration files. They are kept, unapplied, in
+-- migrations.archive/ \u2014 a year of decisions is worth reading even when it is no
+-- longer worth replaying.
+--
+-- Object order is fixed rather than dependency-sorted: schemas, types,
+-- sequences, tables, defaults, functions, constraints, views, indexes, foreign
+-- keys, triggers, row security, policies, grants. Dependencies BETWEEN units
+-- are carried by the order packages/db/chain.json declares.
+-- ============================================================================
+
+-- A LANGUAGE sql function binds its body at CREATE time, and 570 functions
+-- sorted by name are not sorted by who calls whom. This is what lets them load
+-- in any order; every body is still compiled on first call, so a genuinely
+-- broken reference surfaces then rather than never. Session-scoped.
+SET check_function_bodies = false;
+
+
+
+-- \u2500\u2500 default privileges: reset \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- Cleared BEFORE anything is created, so every object below gets the ACL the
+-- dump describes rather than the image's defaults on top of it. Restored at
+-- the end of this file.
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+
+-- \u2500\u2500 table \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE TABLE public.plg_marketing_audiences (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    unit_id uuid,
+    campaign_id uuid NOT NULL,
+    person_id uuid NOT NULL,
+    state text DEFAULT 'entered'::text NOT NULL,
+    entered_at timestamp with time zone DEFAULT now() NOT NULL,
+    queued_at timestamp with time zone,
+    converted_at timestamp with time zone,
+    left_at timestamp with time zone,
+    reason text,
+    queue_id uuid,
+    owner_id uuid,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT plg_marketing_audiences_state_check CHECK ((state = ANY (ARRAY['entered'::text, 'queued'::text, 'sent'::text, 'converted'::text, 'left'::text, 'blocked'::text])))
+);
+
+ALTER TABLE ONLY public.plg_marketing_audiences FORCE ROW LEVEL SECURITY;
+
+CREATE TABLE public.plg_marketing_campaigns (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    name text NOT NULL,
+    channel_key text NOT NULL,
+    status text DEFAULT 'draft'::text NOT NULL,
+    starts_at timestamp with time zone,
+    ends_at timestamp with time zone,
+    spend numeric DEFAULT 0 NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    unit_id uuid,
+    owner_id uuid,
+    kind text DEFAULT 'ad_spend'::text NOT NULL,
+    key text,
+    template_key text,
+    audience_query jsonb DEFAULT '{}'::jsonb NOT NULL,
+    purpose text DEFAULT 'promotion'::text NOT NULL,
+    schedule text,
+    last_run_at timestamp with time zone,
+    next_run_at timestamp with time zone,
+    metadata jsonb DEFAULT '{}'::jsonb NOT NULL,
+    CONSTRAINT plg_marketing_campaigns_kind_check CHECK ((kind = ANY (ARRAY['ad_spend'::text, 'outbound'::text]))),
+    CONSTRAINT plg_marketing_campaigns_outbound_shape CHECK (((kind <> 'outbound'::text) OR ((template_key IS NOT NULL) AND (key IS NOT NULL)))),
+    CONSTRAINT plg_marketing_campaigns_purpose_check CHECK ((purpose = ANY (ARRAY['promotion'::text, 'survey'::text, 'newsletter'::text, 'transactional'::text]))),
+    CONSTRAINT plg_marketing_campaigns_status_check CHECK ((status = ANY (ARRAY['active'::text, 'paused'::text, 'ended'::text, 'draft'::text])))
+);
+
+ALTER TABLE ONLY public.plg_marketing_campaigns FORCE ROW LEVEL SECURITY;
+
+CREATE TABLE public.plg_marketing_channels (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    channel_key text NOT NULL,
+    label text NOT NULL,
+    icon text,
+    kind text DEFAULT 'organic'::text NOT NULL,
+    is_active boolean DEFAULT true NOT NULL,
+    monthly_spend numeric DEFAULT 0 NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    unit_id uuid,
+    owner_id uuid,
+    CONSTRAINT plg_marketing_channels_kind_check CHECK ((kind = ANY (ARRAY['paid'::text, 'organic'::text, 'social'::text, 'referral'::text, 'direct'::text, 'outbound'::text])))
+);
+
+ALTER TABLE ONLY public.plg_marketing_channels FORCE ROW LEVEL SECURITY;
+
+CREATE TABLE public.plg_marketing_consents (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    unit_id uuid,
+    person_id uuid NOT NULL,
+    purpose text NOT NULL,
+    granted_at timestamp with time zone,
+    revoked_at timestamp with time zone,
+    source text,
+    evidence jsonb DEFAULT '{}'::jsonb NOT NULL,
+    owner_id uuid,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT plg_marketing_consents_purpose_check CHECK ((purpose = ANY (ARRAY['promotion'::text, 'survey'::text, 'newsletter'::text, 'transactional'::text])))
+);
+
+ALTER TABLE ONLY public.plg_marketing_consents FORCE ROW LEVEL SECURITY;
+
+CREATE TABLE public.plg_marketing_content_plans (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    account_id uuid NOT NULL,
+    name text NOT NULL,
+    status text DEFAULT 'active'::text NOT NULL,
+    weeks_count integer DEFAULT 8 NOT NULL,
+    start_date date,
+    objective text,
+    tone text,
+    pillars jsonb DEFAULT '[]'::jsonb NOT NULL,
+    formats jsonb DEFAULT '[]'::jsonb NOT NULL,
+    weekly_frequency integer DEFAULT 3 NOT NULL,
+    brief_md text DEFAULT ''::text NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT plg_marketing_content_plans_status_check CHECK ((status = ANY (ARRAY['draft'::text, 'active'::text, 'archived'::text])))
+);
+
+CREATE TABLE public.plg_marketing_content_posts (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    plan_id uuid NOT NULL,
+    week_number integer DEFAULT 1 NOT NULL,
+    "position" integer DEFAULT 0 NOT NULL,
+    title text NOT NULL,
+    format text DEFAULT 'reel'::text NOT NULL,
+    status text DEFAULT 'idea'::text NOT NULL,
+    scheduled_date date,
+    hook text,
+    cta text,
+    content_md text DEFAULT ''::text NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    platforms text[] DEFAULT '{}'::text[] NOT NULL,
+    checklist jsonb DEFAULT '[]'::jsonb NOT NULL,
+    media_url text,
+    CONSTRAINT plg_marketing_content_posts_format_check CHECK ((format = ANY (ARRAY['reel'::text, 'static'::text, 'carousel'::text, 'story'::text]))),
+    CONSTRAINT plg_marketing_content_posts_status_check CHECK ((status = ANY (ARRAY['idea'::text, 'script'::text, 'recording'::text, 'editing'::text, 'scheduled'::text, 'published'::text])))
+);
+
+CREATE TABLE public.plg_marketing_landing_pages (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    site_id uuid NOT NULL,
+    name text NOT NULL,
+    route text NOT NULL,
+    lead_tags text[] DEFAULT '{}'::text[] NOT NULL,
+    status text DEFAULT 'live'::text NOT NULL,
+    prompt text,
+    is_active boolean DEFAULT true NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    unit_id uuid,
+    owner_id uuid,
+    CONSTRAINT plg_marketing_landing_pages_status_check CHECK ((status = ANY (ARRAY['live'::text, 'planned'::text])))
+);
+
+ALTER TABLE ONLY public.plg_marketing_landing_pages FORCE ROW LEVEL SECURITY;
+
+CREATE TABLE public.plg_marketing_social_accounts (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    name text NOT NULL,
+    handle text,
+    is_active boolean DEFAULT true NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    platforms text[] DEFAULT '{instagram}'::text[] NOT NULL
+);
+
+
+-- \u2500\u2500 function \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE FUNCTION public.agent_marketing_create_campaign(p_tenant_id uuid, p_actor_user_id uuid, p_payload jsonb) RETURNS jsonb
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO 'public'
+    AS $$
+DECLARE
+  v_denial jsonb;
+  v_used int;
+  v_name text;
+  v_channel_raw text;
+  v_channel_key text;
+  v_status text;
+  v_starts timestamptz;
+  v_ends timestamptz;
+  v_spend numeric;
+  v_has_channels boolean;
+  v_id uuid;
+BEGIN
+  -- \u2500\u2500 payload \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  v_name := left(trim(p_payload->>'name'), 200);
+  v_channel_raw := trim(p_payload->>'channel_key');
+  v_status := COALESCE(NULLIF(trim(p_payload->>'status'), ''), 'draft');
+  v_spend := COALESCE(NULLIF(p_payload->>'spend', '')::numeric, 0);
+  BEGIN
+    v_starts := NULLIF(p_payload->>'starts_at', '')::timestamptz;
+    v_ends := NULLIF(p_payload->>'ends_at', '')::timestamptz;
+  EXCEPTION WHEN OTHERS THEN
+    RETURN jsonb_build_object('ok', false, 'error', 'invalid payload: ' || SQLERRM);
+  END;
+  IF v_name IS NULL OR v_name = '' OR v_channel_raw IS NULL OR v_channel_raw = '' THEN
+    RETURN jsonb_build_object('ok', false, 'error', 'name and channel_key are required');
+  END IF;
+  IF v_status NOT IN ('active', 'paused', 'ended', 'draft') THEN
+    RETURN jsonb_build_object('ok', false, 'error', 'status must be one of active|paused|ended|draft');
+  END IF;
+
+  -- \u2500\u2500 authorization: role \u2192 plan \u2192 campaigns_active cap \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  SELECT count(*) INTO v_used FROM plg_marketing_campaigns c
+  WHERE c.tenant_id = p_tenant_id AND c.status = 'active';
+  v_denial := agent_guard(p_tenant_id, p_actor_user_id,
+                          'marketing', 'create', 'campaigns_active', v_used,
+                          CASE WHEN v_status = 'active' THEN 1 ELSE 0 END);
+  IF v_denial IS NOT NULL THEN
+    RETURN jsonb_build_object('ok', false, 'denial', v_denial);
+  END IF;
+
+  -- \u2500\u2500 channel resolution (key or label, normalized) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  SELECT EXISTS (SELECT 1 FROM plg_marketing_channels ch WHERE ch.tenant_id = p_tenant_id)
+    INTO v_has_channels;
+  IF v_has_channels THEN
+    SELECT ch.channel_key INTO v_channel_key
+    FROM plg_marketing_channels ch
+    WHERE ch.tenant_id = p_tenant_id
+      AND (
+        regexp_replace(lower(ch.channel_key), '[^a-z0-9]', '', 'g')
+          = regexp_replace(lower(v_channel_raw), '[^a-z0-9]', '', 'g')
+        OR regexp_replace(lower(ch.label), '[^a-z0-9]', '', 'g')
+          = regexp_replace(lower(v_channel_raw), '[^a-z0-9]', '', 'g')
+      )
+    LIMIT 1;
+    IF v_channel_key IS NULL THEN
+      RETURN jsonb_build_object('ok', false, 'error',
+        'unknown channel "' || v_channel_raw || '" \u2014 valid channels: ' ||
+        COALESCE((SELECT string_agg(ch.channel_key, ', ' ORDER BY ch.channel_key)
+                  FROM plg_marketing_channels ch WHERE ch.tenant_id = p_tenant_id), ''));
+    END IF;
+  ELSE
+    v_channel_key := v_channel_raw;
+  END IF;
+
+  -- \u2500\u2500 write + audit \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  INSERT INTO plg_marketing_campaigns (tenant_id, name, channel_key, status, starts_at, ends_at, spend)
+  VALUES (p_tenant_id, v_name, v_channel_key, v_status, COALESCE(v_starts, now()), v_ends, v_spend)
+  RETURNING id INTO v_id;
+
+  INSERT INTO audit_logs (tenant_id, user_id, action, entity_type, entity_id, metadata)
+  VALUES (p_tenant_id, p_actor_user_id, 'agent.createCampaign', 'marketing_campaign', v_id::text,
+          jsonb_build_object('payload', p_payload));
+
+  RETURN jsonb_build_object(
+    'ok', true,
+    'id', v_id,
+    'record', jsonb_build_object(
+      'id', v_id,
+      'name', v_name,
+      'channel_key', v_channel_key,
+      'status', v_status,
+      'starts_at', COALESCE(v_starts, now()),
+      'spend', v_spend
+    )
+  );
+END;
+$$;
+
+CREATE FUNCTION public.marketing_campaign_run(p_campaign_id uuid, p_limit integer DEFAULT 1000) RETURNS jsonb
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO ''
+    AS $$
+DECLARE
+  c         public.plg_marketing_campaigns%ROWTYPE;
+  v_person  uuid;
+  v_queue   uuid;
+  v_entered integer := 0;
+  v_queued  integer := 0;
+  v_left    integer := 0;
+BEGIN
+  SELECT * INTO c FROM public.plg_marketing_campaigns WHERE id = p_campaign_id;
+  IF c.id IS NULL THEN
+    RAISE EXCEPTION 'marketing_campaign_run: campaign % not found', p_campaign_id USING ERRCODE = 'P0002';
+  END IF;
+  IF c.kind <> 'outbound' THEN
+    RETURN jsonb_build_object('skipped', 'not an outbound campaign');
+  END IF;
+  IF to_regprocedure('public.notifications_enqueue(uuid, text, uuid, jsonb, text, timestamptz, text, text, uuid, uuid)') IS NULL THEN
+    RAISE EXCEPTION 'marketing_campaign_run: plugin-notifications is not installed' USING ERRCODE = '0A000';
+  END IF;
+
+  -- Whoever no longer qualifies LEAVES, and the moment is recorded. Revoking
+  -- consent has to show up as an act, not as an absence.
+  UPDATE public.plg_marketing_audiences a
+     SET state = 'left', left_at = now(), reason = 'no longer in the audience'
+   WHERE a.campaign_id = c.id
+     AND a.state IN ('entered', 'queued')
+     AND NOT EXISTS (SELECT 1 FROM public.marketing_resolve_audience(c.id) r WHERE r.person_id = a.person_id);
+  GET DIAGNOSTICS v_left = ROW_COUNT;
+
+  FOR v_person IN
+    SELECT r.person_id FROM public.marketing_resolve_audience(c.id) r
+     LIMIT greatest(p_limit, 0)
+  LOOP
+    INSERT INTO public.plg_marketing_audiences (tenant_id, unit_id, campaign_id, person_id, state)
+    VALUES (c.tenant_id, c.unit_id, c.id, v_person, 'entered')
+    ON CONFLICT (campaign_id, person_id) DO NOTHING;
+    IF FOUND THEN v_entered := v_entered + 1; END IF;
+
+    -- Enqueue once per (campaign, person). The dedupe key is what makes a second
+    -- run of the same campaign harmless, exactly as a redelivered event is.
+    IF EXISTS (SELECT 1 FROM public.plg_marketing_audiences a
+                WHERE a.campaign_id = c.id AND a.person_id = v_person AND a.state = 'entered') THEN
+      v_queue := public.notifications_enqueue(
+        p_tenant_id    => c.tenant_id,
+        p_template_key => c.template_key,
+        p_person_id    => v_person,
+        p_payload      => jsonb_build_object('campaign', c.name, 'campaign_key', c.key),
+        p_dedupe_key   => 'campaign:' || c.id::text || ':' || v_person::text,
+        p_unit_id      => c.unit_id);
+
+      UPDATE public.plg_marketing_audiences
+         SET state = 'queued', queued_at = now(), queue_id = v_queue
+       WHERE campaign_id = c.id AND person_id = v_person;
+      v_queued := v_queued + 1;
+    END IF;
+  END LOOP;
+
+  UPDATE public.plg_marketing_campaigns
+     SET last_run_at = now(), next_run_at = now() + interval '1 day'
+   WHERE id = c.id;
+
+  RETURN jsonb_build_object('campaign_id', c.id, 'entered', v_entered, 'queued', v_queued, 'left', v_left);
+END $$;
+
+CREATE FUNCTION public.marketing_has_consent(p_tenant uuid, p_person uuid, p_purpose text) RETURNS boolean
+    LANGUAGE sql STABLE SECURITY DEFINER
+    SET search_path TO ''
+    AS $$
+  SELECT CASE
+    -- The carve-out, named rather than assumed: a message about something the
+    -- person already bought is not marketing. It is still subject to the channel
+    -- opt-out, which the notification engine applies on its own.
+    WHEN p_purpose = 'transactional' THEN true
+    ELSE EXISTS (
+      SELECT 1 FROM public.plg_marketing_consents c
+       WHERE c.tenant_id = p_tenant AND c.person_id = p_person AND c.purpose = p_purpose
+         AND c.granted_at IS NOT NULL AND c.revoked_at IS NULL)
+  END
+$$;
+
+CREATE FUNCTION public.marketing_resolve_audience(p_campaign_id uuid) RETURNS TABLE(person_id uuid)
+    LANGUAGE plpgsql STABLE SECURITY DEFINER
+    SET search_path TO ''
+    AS $_$
+DECLARE
+  c        public.plg_marketing_campaigns%ROWTYPE;
+  v_source text;
+  v_where  text := '';
+  v_clause jsonb;
+  v_kind   char;
+BEGIN
+  SELECT * INTO c FROM public.plg_marketing_campaigns WHERE id = p_campaign_id;
+  IF c.id IS NULL THEN
+    RAISE EXCEPTION 'marketing_resolve_audience: campaign % not found', p_campaign_id USING ERRCODE = 'P0002';
+  END IF;
+
+  v_source := coalesce(c.audience_query ->> 'source_view', 'people');
+  IF v_source !~ '^[a-z_][a-z0-9_]*$' THEN
+    RAISE EXCEPTION 'marketing_resolve_audience: % is not a bare relation name', v_source USING ERRCODE = '22023';
+  END IF;
+  SELECT cl.relkind INTO v_kind FROM pg_class cl JOIN pg_namespace n ON n.oid = cl.relnamespace
+   WHERE n.nspname = 'public' AND cl.relname = v_source;
+  IF v_kind IS NULL THEN
+    RAISE EXCEPTION 'marketing_resolve_audience: public.% does not exist', v_source USING ERRCODE = '42P01';
+  END IF;
+
+  v_where := format('tenant_id = %L', c.tenant_id);
+
+  FOR v_clause IN SELECT * FROM jsonb_array_elements(coalesce(c.audience_query -> 'where', '[]'::jsonb)) LOOP
+    IF NOT EXISTS (SELECT 1 FROM information_schema.columns
+                    WHERE table_schema = 'public' AND table_name = v_source
+                      AND column_name = v_clause ->> 'column') THEN
+      RAISE EXCEPTION 'marketing_resolve_audience: public.% has no column %', v_source, v_clause ->> 'column'
+        USING ERRCODE = '42703';
+    END IF;
+    -- The operator comes from a fixed set and the value is quoted as a literal:
+    -- the audience is declarative on purpose, so a campaign can never become a
+    -- way to run arbitrary SQL.
+    v_where := v_where || format(' AND %I %s %L',
+      v_clause ->> 'column',
+      CASE v_clause ->> 'op' WHEN '>=' THEN '>=' WHEN '<=' THEN '<=' WHEN '>' THEN '>' WHEN '<' THEN '<'
+                             WHEN '<>' THEN '<>' WHEN 'ilike' THEN 'ILIKE' ELSE '=' END,
+      v_clause ->> 'value');
+  END LOOP;
+
+  RETURN QUERY EXECUTE format(
+    'SELECT s.id FROM public.%I s WHERE %s AND public.marketing_has_consent(%L, s.id, %L)',
+    v_source, v_where, c.tenant_id, c.purpose);
+END $_$;
+
+CREATE FUNCTION public.marketing_run_due(p_limit integer DEFAULT 20) RETURNS jsonb
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO ''
+    AS $$
+DECLARE c record; v_n integer := 0; v_out jsonb := '[]'::jsonb;
+BEGIN
+  FOR c IN
+    SELECT id FROM public.plg_marketing_campaigns
+     WHERE kind = 'outbound' AND status = 'active'
+       AND (next_run_at IS NULL OR next_run_at <= now())
+       AND (starts_at IS NULL OR starts_at <= now())
+       AND (ends_at IS NULL OR ends_at >= now())
+     ORDER BY next_run_at NULLS FIRST
+     LIMIT greatest(p_limit, 0)
+     FOR UPDATE SKIP LOCKED
+  LOOP
+    v_out := v_out || public.marketing_campaign_run(c.id);
+    v_n := v_n + 1;
+  END LOOP;
+  RETURN jsonb_build_object('campaigns', v_n, 'results', v_out);
+END $$;
+
+
+-- \u2500\u2500 constraint \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+ALTER TABLE ONLY public.plg_marketing_audiences
+    ADD CONSTRAINT plg_marketing_audiences_campaign_id_person_id_key UNIQUE (campaign_id, person_id);
+
+ALTER TABLE ONLY public.plg_marketing_audiences
+    ADD CONSTRAINT plg_marketing_audiences_pkey PRIMARY KEY (id);
+
+ALTER TABLE ONLY public.plg_marketing_audiences
+    ADD CONSTRAINT plg_marketing_audiences_tenant_id_id_key UNIQUE (tenant_id, id);
+
+ALTER TABLE ONLY public.plg_marketing_campaigns
+    ADD CONSTRAINT plg_marketing_campaigns_pkey PRIMARY KEY (id);
+
+ALTER TABLE ONLY public.plg_marketing_campaigns
+    ADD CONSTRAINT plg_marketing_campaigns_tenant_id_id_key UNIQUE (tenant_id, id);
+
+ALTER TABLE ONLY public.plg_marketing_channels
+    ADD CONSTRAINT plg_marketing_channels_pkey PRIMARY KEY (id);
+
+ALTER TABLE ONLY public.plg_marketing_channels
+    ADD CONSTRAINT plg_marketing_channels_tenant_id_id_key UNIQUE (tenant_id, id);
+
+ALTER TABLE ONLY public.plg_marketing_consents
+    ADD CONSTRAINT plg_marketing_consents_pkey PRIMARY KEY (id);
+
+ALTER TABLE ONLY public.plg_marketing_consents
+    ADD CONSTRAINT plg_marketing_consents_tenant_id_id_key UNIQUE (tenant_id, id);
+
+ALTER TABLE ONLY public.plg_marketing_consents
+    ADD CONSTRAINT plg_marketing_consents_tenant_id_person_id_purpose_key UNIQUE (tenant_id, person_id, purpose);
+
+ALTER TABLE ONLY public.plg_marketing_content_plans
+    ADD CONSTRAINT plg_marketing_content_plans_pkey PRIMARY KEY (id);
+
+ALTER TABLE ONLY public.plg_marketing_content_posts
+    ADD CONSTRAINT plg_marketing_content_posts_pkey PRIMARY KEY (id);
+
+ALTER TABLE ONLY public.plg_marketing_landing_pages
+    ADD CONSTRAINT plg_marketing_landing_pages_pkey PRIMARY KEY (id);
+
+ALTER TABLE ONLY public.plg_marketing_landing_pages
+    ADD CONSTRAINT plg_marketing_landing_pages_tenant_id_id_key UNIQUE (tenant_id, id);
+
+ALTER TABLE ONLY public.plg_marketing_social_accounts
+    ADD CONSTRAINT plg_marketing_social_accounts_pkey PRIMARY KEY (id);
+
+
+-- \u2500\u2500 view \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE VIEW public.v_marketing_attribution WITH (security_invoker='true') AS
+ SELECT p.tenant_id,
+    'lead'::text AS kind,
+    'crm'::text AS source,
+    COALESCE((p.metadata ->> 'sourceId'::text), (p.metadata ->> 'sourceName'::text), (p.metadata ->> 'origin'::text)) AS channel_raw,
+    p.created_at AS occurred_at,
+    (NULLIF((p.metadata ->> 'value'::text), ''::text))::numeric AS value
+   FROM public.people p
+  WHERE (p.kind = 'lead'::text)
+UNION ALL
+ SELECT b.tenant_id,
+    'conversion'::text AS kind,
+    'agenda'::text AS source,
+    COALESCE((b.metadata ->> 'origin'::text), (pc.metadata ->> 'origin'::text), (pc.metadata ->> 'sourceId'::text), (pc.metadata ->> 'sourceName'::text)) AS channel_raw,
+    b.starts_at AS occurred_at,
+    o.total AS value
+   FROM ((public.appointments b
+     LEFT JOIN public.people pc ON ((pc.id = b.party_id)))
+     LEFT JOIN public.orders o ON ((o.id = b.order_id)))
+  WHERE (b.status <> ALL (ARRAY['cancelled'::text, 'no_show'::text]))
+UNION ALL
+ SELECT o.tenant_id,
+    'conversion'::text AS kind,
+    'orders'::text AS source,
+    COALESCE((o.metadata ->> 'origin'::text), (pp.metadata ->> 'origin'::text), (pp.metadata ->> 'sourceId'::text)) AS channel_raw,
+    o.created_at AS occurred_at,
+    o.total AS value
+   FROM (public.orders o
+     LEFT JOIN public.people pp ON ((pp.id = o.party_id)))
+  WHERE ((o.kind <> ALL (ARRAY['appointment'::text, 'deal'::text])) AND (o.status <> ALL (ARRAY['cancelled'::text, 'draft'::text])))
+UNION ALL
+ SELECT o.tenant_id,
+    'conversion'::text AS kind,
+    'crm'::text AS source,
+    COALESCE((pp.metadata ->> 'sourceId'::text), (pp.metadata ->> 'sourceName'::text), (o.metadata ->> 'origin'::text)) AS channel_raw,
+    o.updated_at AS occurred_at,
+    o.total AS value
+   FROM (public.orders o
+     LEFT JOIN public.people pp ON ((pp.id = o.party_id)))
+  WHERE ((o.kind = 'deal'::text) AND (o.status = 'won'::text));
+
+CREATE VIEW public.v_marketing_campaign_metrics WITH (security_invoker='true') AS
+ SELECT c.id AS campaign_id,
+    c.tenant_id,
+    c.unit_id,
+    c.key,
+    c.name,
+    c.status,
+    c.purpose,
+    c.template_key,
+    c.last_run_at,
+    count(a.id) AS audience,
+    count(a.id) FILTER (WHERE (a.state = 'queued'::text)) AS queued,
+    count(a.id) FILTER (WHERE (a.state = 'sent'::text)) AS sent,
+    count(a.id) FILTER (WHERE (a.state = 'converted'::text)) AS converted,
+    count(a.id) FILTER (WHERE (a.state = 'left'::text)) AS left_audience,
+    count(a.id) FILTER (WHERE (a.state = 'blocked'::text)) AS blocked,
+    count(q.id) FILTER (WHERE (q.status = 'sent'::text)) AS delivered,
+    count(q.id) FILTER (WHERE (q.status = 'blocked'::text)) AS refused
+   FROM ((public.plg_marketing_campaigns c
+     LEFT JOIN public.plg_marketing_audiences a ON ((a.campaign_id = c.id)))
+     LEFT JOIN public.plg_notifications_queue q ON ((q.id = a.queue_id)))
+  WHERE (c.kind = 'outbound'::text)
+  GROUP BY c.id, c.tenant_id, c.unit_id, c.key, c.name, c.status, c.purpose, c.template_key, c.last_run_at;
+
+CREATE VIEW public.v_marketing_campaigns WITH (security_invoker='true') AS
+ SELECT g.id,
+    g.tenant_id,
+    g.name,
+    g.channel_key,
+    ch.label AS channel_label,
+    g.status,
+    g.starts_at,
+    g.ends_at,
+    g.spend,
+    g.created_at,
+    g.updated_at
+   FROM (public.plg_marketing_campaigns g
+     LEFT JOIN public.plg_marketing_channels ch ON (((ch.tenant_id = g.tenant_id) AND (ch.channel_key = g.channel_key))));
+
+CREATE VIEW public.v_marketing_channels WITH (security_invoker='true') AS
+ SELECT id,
+    tenant_id,
+    channel_key,
+    label,
+    icon,
+    kind,
+    is_active,
+    monthly_spend,
+    created_at,
+    updated_at
+   FROM public.plg_marketing_channels c;
+
+CREATE VIEW public.v_marketing_landing_pages WITH (security_invoker='true') AS
+ SELECT lp.id,
+    lp.tenant_id,
+    lp.site_id,
+    lp.name,
+    lp.route,
+    lp.lead_tags,
+    lp.status,
+    lp.prompt,
+    lp.is_active,
+    s.name AS site_name,
+    s.preview_url AS site_url,
+    s.app_id,
+    s.fayz_project_id,
+    s.editor_url,
+    lp.created_at,
+    lp.updated_at
+   FROM (public.plg_marketing_landing_pages lp
+     JOIN public.fayz_projects s ON ((s.id = lp.site_id)));
+
+CREATE VIEW public.v_marketing_lead_tag_events WITH (security_invoker='true') AS
+ SELECT p.tenant_id,
+    tag.tag,
+    p.id AS person_id,
+    p.created_at AS occurred_at,
+    (NULLIF((p.metadata ->> 'value'::text), ''::text))::numeric AS value
+   FROM (public.people p
+     CROSS JOIN LATERAL unnest(COALESCE(p.tags, '{}'::text[])) tag(tag))
+  WHERE ((p.kind = 'lead'::text) AND COALESCE(p.is_active, true));
+
+
+-- \u2500\u2500 index \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE INDEX idx_plg_marketing_campaigns_channel ON public.plg_marketing_campaigns USING btree (tenant_id, channel_key);
+
+CREATE INDEX idx_plg_marketing_campaigns_tenant ON public.plg_marketing_campaigns USING btree (tenant_id);
+
+CREATE INDEX idx_plg_marketing_channels_tenant ON public.plg_marketing_channels USING btree (tenant_id);
+
+CREATE INDEX idx_plg_marketing_content_plans_account ON public.plg_marketing_content_plans USING btree (account_id);
+
+CREATE INDEX idx_plg_marketing_content_plans_tenant ON public.plg_marketing_content_plans USING btree (tenant_id);
+
+CREATE INDEX idx_plg_marketing_content_posts_plan ON public.plg_marketing_content_posts USING btree (plan_id, week_number, "position");
+
+CREATE INDEX idx_plg_marketing_content_posts_status ON public.plg_marketing_content_posts USING btree (tenant_id, status);
+
+CREATE INDEX idx_plg_marketing_content_posts_tenant ON public.plg_marketing_content_posts USING btree (tenant_id);
+
+CREATE INDEX idx_plg_marketing_landing_pages_site ON public.plg_marketing_landing_pages USING btree (site_id);
+
+CREATE INDEX idx_plg_marketing_landing_pages_tenant ON public.plg_marketing_landing_pages USING btree (tenant_id);
+
+CREATE INDEX idx_plg_marketing_social_accounts_tenant ON public.plg_marketing_social_accounts USING btree (tenant_id);
+
+CREATE INDEX plg_marketing_audiences_state_idx ON public.plg_marketing_audiences USING btree (campaign_id, state);
+
+CREATE INDEX plg_marketing_audiences_tenant_owner_idx ON public.plg_marketing_audiences USING btree (tenant_id, owner_id) WHERE (owner_id IS NOT NULL);
+
+CREATE INDEX plg_marketing_audiences_tenant_unit_idx ON public.plg_marketing_audiences USING btree (tenant_id, unit_id);
+
+CREATE INDEX plg_marketing_campaigns_due_idx ON public.plg_marketing_campaigns USING btree (next_run_at) WHERE ((kind = 'outbound'::text) AND (status = 'active'::text));
+
+CREATE UNIQUE INDEX plg_marketing_campaigns_key_uq ON public.plg_marketing_campaigns USING btree (tenant_id, key) WHERE (key IS NOT NULL);
+
+CREATE INDEX plg_marketing_campaigns_tenant_owner_idx ON public.plg_marketing_campaigns USING btree (tenant_id, owner_id) WHERE (owner_id IS NOT NULL);
+
+CREATE INDEX plg_marketing_campaigns_tenant_unit_idx ON public.plg_marketing_campaigns USING btree (tenant_id, unit_id);
+
+CREATE INDEX plg_marketing_channels_tenant_owner_idx ON public.plg_marketing_channels USING btree (tenant_id, owner_id) WHERE (owner_id IS NOT NULL);
+
+CREATE INDEX plg_marketing_channels_tenant_unit_idx ON public.plg_marketing_channels USING btree (tenant_id, unit_id);
+
+CREATE INDEX plg_marketing_consents_person_idx ON public.plg_marketing_consents USING btree (tenant_id, person_id);
+
+CREATE INDEX plg_marketing_consents_tenant_owner_idx ON public.plg_marketing_consents USING btree (tenant_id, owner_id) WHERE (owner_id IS NOT NULL);
+
+CREATE INDEX plg_marketing_consents_tenant_unit_idx ON public.plg_marketing_consents USING btree (tenant_id, unit_id);
+
+CREATE INDEX plg_marketing_landing_pages_tenant_owner_idx ON public.plg_marketing_landing_pages USING btree (tenant_id, owner_id) WHERE (owner_id IS NOT NULL);
+
+CREATE INDEX plg_marketing_landing_pages_tenant_unit_idx ON public.plg_marketing_landing_pages USING btree (tenant_id, unit_id);
+
+CREATE UNIQUE INDEX u_plg_marketing_channels_tenant_key ON public.plg_marketing_channels USING btree (tenant_id, channel_key);
+
+CREATE UNIQUE INDEX u_plg_marketing_landing_pages_site_route ON public.plg_marketing_landing_pages USING btree (site_id, route);
+
+
+-- \u2500\u2500 fk constraint \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+ALTER TABLE ONLY public.plg_marketing_audiences
+    ADD CONSTRAINT plg_marketing_audiences_campaign_id_fkey FOREIGN KEY (campaign_id) REFERENCES public.plg_marketing_campaigns(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_marketing_audiences
+    ADD CONSTRAINT plg_marketing_audiences_owner_fk FOREIGN KEY (tenant_id, owner_id) REFERENCES app.memberships(tenant_id, user_id) ON DELETE SET NULL;
+
+ALTER TABLE ONLY public.plg_marketing_audiences
+    ADD CONSTRAINT plg_marketing_audiences_person_id_fkey FOREIGN KEY (person_id) REFERENCES public.people(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_marketing_audiences
+    ADD CONSTRAINT plg_marketing_audiences_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES public.tenants(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_marketing_audiences
+    ADD CONSTRAINT plg_marketing_audiences_unit_fk FOREIGN KEY (tenant_id, unit_id) REFERENCES app.units(tenant_id, id) ON DELETE SET NULL;
+
+ALTER TABLE ONLY public.plg_marketing_campaigns
+    ADD CONSTRAINT plg_marketing_campaigns_owner_fk FOREIGN KEY (tenant_id, owner_id) REFERENCES app.memberships(tenant_id, user_id) ON DELETE SET NULL;
+
+ALTER TABLE ONLY public.plg_marketing_campaigns
+    ADD CONSTRAINT plg_marketing_campaigns_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES public.tenants(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_marketing_campaigns
+    ADD CONSTRAINT plg_marketing_campaigns_unit_fk FOREIGN KEY (tenant_id, unit_id) REFERENCES app.units(tenant_id, id) ON DELETE SET NULL;
+
+ALTER TABLE ONLY public.plg_marketing_channels
+    ADD CONSTRAINT plg_marketing_channels_owner_fk FOREIGN KEY (tenant_id, owner_id) REFERENCES app.memberships(tenant_id, user_id) ON DELETE SET NULL;
+
+ALTER TABLE ONLY public.plg_marketing_channels
+    ADD CONSTRAINT plg_marketing_channels_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES public.tenants(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_marketing_channels
+    ADD CONSTRAINT plg_marketing_channels_unit_fk FOREIGN KEY (tenant_id, unit_id) REFERENCES app.units(tenant_id, id) ON DELETE SET NULL;
+
+ALTER TABLE ONLY public.plg_marketing_consents
+    ADD CONSTRAINT plg_marketing_consents_owner_fk FOREIGN KEY (tenant_id, owner_id) REFERENCES app.memberships(tenant_id, user_id) ON DELETE SET NULL;
+
+ALTER TABLE ONLY public.plg_marketing_consents
+    ADD CONSTRAINT plg_marketing_consents_person_id_fkey FOREIGN KEY (person_id) REFERENCES public.people(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_marketing_consents
+    ADD CONSTRAINT plg_marketing_consents_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES public.tenants(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_marketing_consents
+    ADD CONSTRAINT plg_marketing_consents_unit_fk FOREIGN KEY (tenant_id, unit_id) REFERENCES app.units(tenant_id, id) ON DELETE SET NULL;
+
+ALTER TABLE ONLY public.plg_marketing_content_plans
+    ADD CONSTRAINT plg_marketing_content_plans_account_id_fkey FOREIGN KEY (account_id) REFERENCES public.plg_marketing_social_accounts(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_marketing_content_plans
+    ADD CONSTRAINT plg_marketing_content_plans_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES public.tenants(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_marketing_content_posts
+    ADD CONSTRAINT plg_marketing_content_posts_plan_id_fkey FOREIGN KEY (plan_id) REFERENCES public.plg_marketing_content_plans(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_marketing_content_posts
+    ADD CONSTRAINT plg_marketing_content_posts_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES public.tenants(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_marketing_landing_pages
+    ADD CONSTRAINT plg_marketing_landing_pages_owner_fk FOREIGN KEY (tenant_id, owner_id) REFERENCES app.memberships(tenant_id, user_id) ON DELETE SET NULL;
+
+ALTER TABLE ONLY public.plg_marketing_landing_pages
+    ADD CONSTRAINT plg_marketing_landing_pages_site_fk FOREIGN KEY (site_id) REFERENCES public.published_sites(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_marketing_landing_pages
+    ADD CONSTRAINT plg_marketing_landing_pages_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES public.tenants(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_marketing_landing_pages
+    ADD CONSTRAINT plg_marketing_landing_pages_unit_fk FOREIGN KEY (tenant_id, unit_id) REFERENCES app.units(tenant_id, id) ON DELETE SET NULL;
+
+ALTER TABLE ONLY public.plg_marketing_social_accounts
+    ADD CONSTRAINT plg_marketing_social_accounts_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES public.tenants(id) ON DELETE CASCADE;
+
+
+-- \u2500\u2500 trigger \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE TRIGGER plg_marketing_audiences_updated_at BEFORE UPDATE ON public.plg_marketing_audiences FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
+
+CREATE TRIGGER plg_marketing_campaigns_updated_at BEFORE UPDATE ON public.plg_marketing_campaigns FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
+
+CREATE TRIGGER plg_marketing_channels_updated_at BEFORE UPDATE ON public.plg_marketing_channels FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
+
+CREATE TRIGGER plg_marketing_consents_updated_at BEFORE UPDATE ON public.plg_marketing_consents FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
+
+CREATE TRIGGER plg_marketing_landing_pages_updated_at BEFORE UPDATE ON public.plg_marketing_landing_pages FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
+
+
+-- \u2500\u2500 row security \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+ALTER TABLE public.plg_marketing_audiences ENABLE ROW LEVEL SECURITY;
+
+ALTER TABLE public.plg_marketing_campaigns ENABLE ROW LEVEL SECURITY;
+
+ALTER TABLE public.plg_marketing_channels ENABLE ROW LEVEL SECURITY;
+
+ALTER TABLE public.plg_marketing_consents ENABLE ROW LEVEL SECURITY;
+
+ALTER TABLE public.plg_marketing_content_plans ENABLE ROW LEVEL SECURITY;
+
+ALTER TABLE public.plg_marketing_content_posts ENABLE ROW LEVEL SECURITY;
+
+ALTER TABLE public.plg_marketing_landing_pages ENABLE ROW LEVEL SECURITY;
+
+ALTER TABLE public.plg_marketing_social_accounts ENABLE ROW LEVEL SECURITY;
+
+
+-- \u2500\u2500 policy \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE POLICY plg_marketing_audiences_authz_delete ON public.plg_marketing_audiences FOR DELETE TO authenticated USING (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_marketing_audiences.unit_id) AS has_unit)) AND ((NOT ( SELECT app.owner_scoped('marketing.audience'::text) AS owner_scoped)) OR (owner_id IS NULL) OR (owner_id = ( SELECT auth.uid() AS uid)) OR ( SELECT app.has_grant('marketing.audience'::text, plg_marketing_audiences.id, ARRAY['shared_with'::text]) AS has_grant) OR ( SELECT app.has_permission('marketing.read_all'::text, plg_marketing_audiences.unit_id) AS has_permission)) AND ( SELECT app.has_permission('marketing.delete'::text, plg_marketing_audiences.unit_id) AS has_permission)));
+
+CREATE POLICY plg_marketing_audiences_authz_insert ON public.plg_marketing_audiences FOR INSERT TO authenticated WITH CHECK (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_marketing_audiences.unit_id) AS has_unit)) AND ( SELECT app.has_permission('marketing.create'::text, plg_marketing_audiences.unit_id) AS has_permission)));
+
+CREATE POLICY plg_marketing_audiences_authz_select ON public.plg_marketing_audiences FOR SELECT TO authenticated USING (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_marketing_audiences.unit_id) AS has_unit)) AND ((NOT ( SELECT app.owner_scoped('marketing.audience'::text) AS owner_scoped)) OR (owner_id IS NULL) OR (owner_id = ( SELECT auth.uid() AS uid)) OR ( SELECT app.has_grant('marketing.audience'::text, plg_marketing_audiences.id, ARRAY['shared_with'::text]) AS has_grant) OR ( SELECT app.has_permission('marketing.read_all'::text, plg_marketing_audiences.unit_id) AS has_permission)) AND ( SELECT app.has_permission('marketing.read'::text, plg_marketing_audiences.unit_id) AS has_permission)));
+
+CREATE POLICY plg_marketing_audiences_authz_update ON public.plg_marketing_audiences FOR UPDATE TO authenticated USING (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_marketing_audiences.unit_id) AS has_unit)) AND ((NOT ( SELECT app.owner_scoped('marketing.audience'::text) AS owner_scoped)) OR (owner_id IS NULL) OR (owner_id = ( SELECT auth.uid() AS uid)) OR ( SELECT app.has_grant('marketing.audience'::text, plg_marketing_audiences.id, ARRAY['shared_with'::text]) AS has_grant) OR ( SELECT app.has_permission('marketing.read_all'::text, plg_marketing_audiences.unit_id) AS has_permission)) AND ( SELECT app.has_permission('marketing.edit'::text, plg_marketing_audiences.unit_id) AS has_permission))) WITH CHECK (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_marketing_audiences.unit_id) AS has_unit)) AND ( SELECT app.has_permission('marketing.edit'::text, plg_marketing_audiences.unit_id) AS has_permission)));
+
+CREATE POLICY plg_marketing_campaigns_authz_delete ON public.plg_marketing_campaigns FOR DELETE TO authenticated USING (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_marketing_campaigns.unit_id) AS has_unit)) AND ((NOT ( SELECT app.owner_scoped('marketing.campaign'::text) AS owner_scoped)) OR (owner_id IS NULL) OR (owner_id = ( SELECT auth.uid() AS uid)) OR ( SELECT app.has_grant('marketing.campaign'::text, plg_marketing_campaigns.id, ARRAY['shared_with'::text]) AS has_grant) OR ( SELECT app.has_permission('marketing.read_all'::text, plg_marketing_campaigns.unit_id) AS has_permission)) AND ( SELECT app.has_permission('marketing.delete'::text, plg_marketing_campaigns.unit_id) AS has_permission)));
+
+CREATE POLICY plg_marketing_campaigns_authz_insert ON public.plg_marketing_campaigns FOR INSERT TO authenticated WITH CHECK (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_marketing_campaigns.unit_id) AS has_unit)) AND ( SELECT app.has_permission('marketing.create'::text, plg_marketing_campaigns.unit_id) AS has_permission)));
+
+CREATE POLICY plg_marketing_campaigns_authz_select ON public.plg_marketing_campaigns FOR SELECT TO authenticated USING (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_marketing_campaigns.unit_id) AS has_unit)) AND ((NOT ( SELECT app.owner_scoped('marketing.campaign'::text) AS owner_scoped)) OR (owner_id IS NULL) OR (owner_id = ( SELECT auth.uid() AS uid)) OR ( SELECT app.has_grant('marketing.campaign'::text, plg_marketing_campaigns.id, ARRAY['shared_with'::text]) AS has_grant) OR ( SELECT app.has_permission('marketing.read_all'::text, plg_marketing_campaigns.unit_id) AS has_permission)) AND ( SELECT app.has_permission('marketing.read'::text, plg_marketing_campaigns.unit_id) AS has_permission)));
+
+CREATE POLICY plg_marketing_campaigns_authz_update ON public.plg_marketing_campaigns FOR UPDATE TO authenticated USING (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_marketing_campaigns.unit_id) AS has_unit)) AND ((NOT ( SELECT app.owner_scoped('marketing.campaign'::text) AS owner_scoped)) OR (owner_id IS NULL) OR (owner_id = ( SELECT auth.uid() AS uid)) OR ( SELECT app.has_grant('marketing.campaign'::text, plg_marketing_campaigns.id, ARRAY['shared_with'::text]) AS has_grant) OR ( SELECT app.has_permission('marketing.read_all'::text, plg_marketing_campaigns.unit_id) AS has_permission)) AND ( SELECT app.has_permission('marketing.edit'::text, plg_marketing_campaigns.unit_id) AS has_permission))) WITH CHECK (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_marketing_campaigns.unit_id) AS has_unit)) AND ( SELECT app.has_permission('marketing.edit'::text, plg_marketing_campaigns.unit_id) AS has_permission)));
+
+CREATE POLICY plg_marketing_channels_authz_delete ON public.plg_marketing_channels FOR DELETE TO authenticated USING (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_marketing_channels.unit_id) AS has_unit)) AND ((NOT ( SELECT app.owner_scoped('marketing.channel'::text) AS owner_scoped)) OR (owner_id IS NULL) OR (owner_id = ( SELECT auth.uid() AS uid)) OR ( SELECT app.has_grant('marketing.channel'::text, plg_marketing_channels.id, ARRAY['shared_with'::text]) AS has_grant) OR ( SELECT app.has_permission('marketing.read_all'::text, plg_marketing_channels.unit_id) AS has_permission)) AND ( SELECT app.has_permission('marketing.delete'::text, plg_marketing_channels.unit_id) AS has_permission)));
+
+CREATE POLICY plg_marketing_channels_authz_insert ON public.plg_marketing_channels FOR INSERT TO authenticated WITH CHECK (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_marketing_channels.unit_id) AS has_unit)) AND ( SELECT app.has_permission('marketing.create'::text, plg_marketing_channels.unit_id) AS has_permission)));
+
+CREATE POLICY plg_marketing_channels_authz_select ON public.plg_marketing_channels FOR SELECT TO authenticated USING (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_marketing_channels.unit_id) AS has_unit)) AND ((NOT ( SELECT app.owner_scoped('marketing.channel'::text) AS owner_scoped)) OR (owner_id IS NULL) OR (owner_id = ( SELECT auth.uid() AS uid)) OR ( SELECT app.has_grant('marketing.channel'::text, plg_marketing_channels.id, ARRAY['shared_with'::text]) AS has_grant) OR ( SELECT app.has_permission('marketing.read_all'::text, plg_marketing_channels.unit_id) AS has_permission)) AND ( SELECT app.has_permission('marketing.read'::text, plg_marketing_channels.unit_id) AS has_permission)));
+
+CREATE POLICY plg_marketing_channels_authz_update ON public.plg_marketing_channels FOR UPDATE TO authenticated USING (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_marketing_channels.unit_id) AS has_unit)) AND ((NOT ( SELECT app.owner_scoped('marketing.channel'::text) AS owner_scoped)) OR (owner_id IS NULL) OR (owner_id = ( SELECT auth.uid() AS uid)) OR ( SELECT app.has_grant('marketing.channel'::text, plg_marketing_channels.id, ARRAY['shared_with'::text]) AS has_grant) OR ( SELECT app.has_permission('marketing.read_all'::text, plg_marketing_channels.unit_id) AS has_permission)) AND ( SELECT app.has_permission('marketing.edit'::text, plg_marketing_channels.unit_id) AS has_permission))) WITH CHECK (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_marketing_channels.unit_id) AS has_unit)) AND ( SELECT app.has_permission('marketing.edit'::text, plg_marketing_channels.unit_id) AS has_permission)));
+
+CREATE POLICY plg_marketing_consents_authz_delete ON public.plg_marketing_consents FOR DELETE TO authenticated USING (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_marketing_consents.unit_id) AS has_unit)) AND ((NOT ( SELECT app.owner_scoped('marketing.consent'::text) AS owner_scoped)) OR (owner_id IS NULL) OR (owner_id = ( SELECT auth.uid() AS uid)) OR ( SELECT app.has_grant('marketing.consent'::text, plg_marketing_consents.id, ARRAY['shared_with'::text]) AS has_grant) OR ( SELECT app.has_permission('marketing.read_all'::text, plg_marketing_consents.unit_id) AS has_permission)) AND ( SELECT app.has_permission('marketing.delete'::text, plg_marketing_consents.unit_id) AS has_permission)));
+
+CREATE POLICY plg_marketing_consents_authz_insert ON public.plg_marketing_consents FOR INSERT TO authenticated WITH CHECK (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_marketing_consents.unit_id) AS has_unit)) AND ( SELECT app.has_permission('marketing.create'::text, plg_marketing_consents.unit_id) AS has_permission)));
+
+CREATE POLICY plg_marketing_consents_authz_select ON public.plg_marketing_consents FOR SELECT TO authenticated USING (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_marketing_consents.unit_id) AS has_unit)) AND ((NOT ( SELECT app.owner_scoped('marketing.consent'::text) AS owner_scoped)) OR (owner_id IS NULL) OR (owner_id = ( SELECT auth.uid() AS uid)) OR ( SELECT app.has_grant('marketing.consent'::text, plg_marketing_consents.id, ARRAY['shared_with'::text]) AS has_grant) OR ( SELECT app.has_permission('marketing.read_all'::text, plg_marketing_consents.unit_id) AS has_permission)) AND ( SELECT app.has_permission('marketing.read'::text, plg_marketing_consents.unit_id) AS has_permission)));
+
+CREATE POLICY plg_marketing_consents_authz_update ON public.plg_marketing_consents FOR UPDATE TO authenticated USING (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_marketing_consents.unit_id) AS has_unit)) AND ((NOT ( SELECT app.owner_scoped('marketing.consent'::text) AS owner_scoped)) OR (owner_id IS NULL) OR (owner_id = ( SELECT auth.uid() AS uid)) OR ( SELECT app.has_grant('marketing.consent'::text, plg_marketing_consents.id, ARRAY['shared_with'::text]) AS has_grant) OR ( SELECT app.has_permission('marketing.read_all'::text, plg_marketing_consents.unit_id) AS has_permission)) AND ( SELECT app.has_permission('marketing.edit'::text, plg_marketing_consents.unit_id) AS has_permission))) WITH CHECK (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_marketing_consents.unit_id) AS has_unit)) AND ( SELECT app.has_permission('marketing.edit'::text, plg_marketing_consents.unit_id) AS has_permission)));
+
+CREATE POLICY plg_marketing_content_plans_delete ON public.plg_marketing_content_plans FOR DELETE TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_marketing_content_plans_insert ON public.plg_marketing_content_plans FOR INSERT TO authenticated WITH CHECK ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_marketing_content_plans_select ON public.plg_marketing_content_plans FOR SELECT TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_marketing_content_plans_update ON public.plg_marketing_content_plans FOR UPDATE TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_marketing_content_posts_delete ON public.plg_marketing_content_posts FOR DELETE TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_marketing_content_posts_insert ON public.plg_marketing_content_posts FOR INSERT TO authenticated WITH CHECK ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_marketing_content_posts_select ON public.plg_marketing_content_posts FOR SELECT TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_marketing_content_posts_update ON public.plg_marketing_content_posts FOR UPDATE TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_marketing_landing_pages_authz_delete ON public.plg_marketing_landing_pages FOR DELETE TO authenticated USING (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_marketing_landing_pages.unit_id) AS has_unit)) AND ((NOT ( SELECT app.owner_scoped('marketing.landing_page'::text) AS owner_scoped)) OR (owner_id IS NULL) OR (owner_id = ( SELECT auth.uid() AS uid)) OR ( SELECT app.has_grant('marketing.landing_page'::text, plg_marketing_landing_pages.id, ARRAY['shared_with'::text]) AS has_grant) OR ( SELECT app.has_permission('marketing.read_all'::text, plg_marketing_landing_pages.unit_id) AS has_permission)) AND ( SELECT app.has_permission('marketing.delete'::text, plg_marketing_landing_pages.unit_id) AS has_permission)));
+
+CREATE POLICY plg_marketing_landing_pages_authz_insert ON public.plg_marketing_landing_pages FOR INSERT TO authenticated WITH CHECK (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_marketing_landing_pages.unit_id) AS has_unit)) AND ( SELECT app.has_permission('marketing.create'::text, plg_marketing_landing_pages.unit_id) AS has_permission)));
+
+CREATE POLICY plg_marketing_landing_pages_authz_select ON public.plg_marketing_landing_pages FOR SELECT TO authenticated USING (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_marketing_landing_pages.unit_id) AS has_unit)) AND ((NOT ( SELECT app.owner_scoped('marketing.landing_page'::text) AS owner_scoped)) OR (owner_id IS NULL) OR (owner_id = ( SELECT auth.uid() AS uid)) OR ( SELECT app.has_grant('marketing.landing_page'::text, plg_marketing_landing_pages.id, ARRAY['shared_with'::text]) AS has_grant) OR ( SELECT app.has_permission('marketing.read_all'::text, plg_marketing_landing_pages.unit_id) AS has_permission)) AND ( SELECT app.has_permission('marketing.read'::text, plg_marketing_landing_pages.unit_id) AS has_permission)));
+
+CREATE POLICY plg_marketing_landing_pages_authz_update ON public.plg_marketing_landing_pages FOR UPDATE TO authenticated USING (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_marketing_landing_pages.unit_id) AS has_unit)) AND ((NOT ( SELECT app.owner_scoped('marketing.landing_page'::text) AS owner_scoped)) OR (owner_id IS NULL) OR (owner_id = ( SELECT auth.uid() AS uid)) OR ( SELECT app.has_grant('marketing.landing_page'::text, plg_marketing_landing_pages.id, ARRAY['shared_with'::text]) AS has_grant) OR ( SELECT app.has_permission('marketing.read_all'::text, plg_marketing_landing_pages.unit_id) AS has_permission)) AND ( SELECT app.has_permission('marketing.edit'::text, plg_marketing_landing_pages.unit_id) AS has_permission))) WITH CHECK (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_marketing_landing_pages.unit_id) AS has_unit)) AND ( SELECT app.has_permission('marketing.edit'::text, plg_marketing_landing_pages.unit_id) AS has_permission)));
+
+CREATE POLICY plg_marketing_social_accounts_delete ON public.plg_marketing_social_accounts FOR DELETE TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_marketing_social_accounts_insert ON public.plg_marketing_social_accounts FOR INSERT TO authenticated WITH CHECK ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_marketing_social_accounts_select ON public.plg_marketing_social_accounts FOR SELECT TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_marketing_social_accounts_update ON public.plg_marketing_social_accounts FOR UPDATE TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+
+-- \u2500\u2500 acl \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+REVOKE ALL ON FUNCTION public.agent_marketing_create_campaign(p_tenant_id uuid, p_actor_user_id uuid, p_payload jsonb) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.agent_marketing_create_campaign(p_tenant_id uuid, p_actor_user_id uuid, p_payload jsonb) TO authenticated;
+GRANT ALL ON FUNCTION public.agent_marketing_create_campaign(p_tenant_id uuid, p_actor_user_id uuid, p_payload jsonb) TO service_role;
+
+REVOKE ALL ON FUNCTION public.marketing_campaign_run(p_campaign_id uuid, p_limit integer) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.marketing_campaign_run(p_campaign_id uuid, p_limit integer) TO authenticated;
+GRANT ALL ON FUNCTION public.marketing_campaign_run(p_campaign_id uuid, p_limit integer) TO service_role;
+
+REVOKE ALL ON FUNCTION public.marketing_has_consent(p_tenant uuid, p_person uuid, p_purpose text) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.marketing_has_consent(p_tenant uuid, p_person uuid, p_purpose text) TO authenticated;
+GRANT ALL ON FUNCTION public.marketing_has_consent(p_tenant uuid, p_person uuid, p_purpose text) TO service_role;
+
+REVOKE ALL ON FUNCTION public.marketing_resolve_audience(p_campaign_id uuid) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.marketing_resolve_audience(p_campaign_id uuid) TO authenticated;
+GRANT ALL ON FUNCTION public.marketing_resolve_audience(p_campaign_id uuid) TO service_role;
+
+REVOKE ALL ON FUNCTION public.marketing_run_due(p_limit integer) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.marketing_run_due(p_limit integer) TO service_role;
+
+GRANT MAINTAIN ON TABLE public.plg_marketing_audiences TO anon;
+GRANT ALL ON TABLE public.plg_marketing_audiences TO authenticated;
+GRANT ALL ON TABLE public.plg_marketing_audiences TO service_role;
+
+GRANT MAINTAIN ON TABLE public.plg_marketing_campaigns TO anon;
+GRANT ALL ON TABLE public.plg_marketing_campaigns TO authenticated;
+GRANT ALL ON TABLE public.plg_marketing_campaigns TO service_role;
+
+GRANT MAINTAIN ON TABLE public.plg_marketing_channels TO anon;
+GRANT ALL ON TABLE public.plg_marketing_channels TO authenticated;
+GRANT ALL ON TABLE public.plg_marketing_channels TO service_role;
+
+GRANT MAINTAIN ON TABLE public.plg_marketing_consents TO anon;
+GRANT ALL ON TABLE public.plg_marketing_consents TO authenticated;
+GRANT ALL ON TABLE public.plg_marketing_consents TO service_role;
+
+GRANT MAINTAIN ON TABLE public.plg_marketing_content_plans TO anon;
+GRANT ALL ON TABLE public.plg_marketing_content_plans TO authenticated;
+GRANT ALL ON TABLE public.plg_marketing_content_plans TO service_role;
+
+GRANT MAINTAIN ON TABLE public.plg_marketing_content_posts TO anon;
+GRANT ALL ON TABLE public.plg_marketing_content_posts TO authenticated;
+GRANT ALL ON TABLE public.plg_marketing_content_posts TO service_role;
+
+GRANT MAINTAIN ON TABLE public.plg_marketing_landing_pages TO anon;
+GRANT ALL ON TABLE public.plg_marketing_landing_pages TO authenticated;
+GRANT ALL ON TABLE public.plg_marketing_landing_pages TO service_role;
+
+GRANT MAINTAIN ON TABLE public.plg_marketing_social_accounts TO anon;
+GRANT ALL ON TABLE public.plg_marketing_social_accounts TO authenticated;
+GRANT ALL ON TABLE public.plg_marketing_social_accounts TO service_role;
+
+GRANT MAINTAIN ON TABLE public.v_marketing_attribution TO anon;
+GRANT ALL ON TABLE public.v_marketing_attribution TO authenticated;
+GRANT ALL ON TABLE public.v_marketing_attribution TO service_role;
+
+GRANT MAINTAIN ON TABLE public.v_marketing_campaign_metrics TO anon;
+GRANT ALL ON TABLE public.v_marketing_campaign_metrics TO authenticated;
+GRANT ALL ON TABLE public.v_marketing_campaign_metrics TO service_role;
+
+GRANT MAINTAIN ON TABLE public.v_marketing_campaigns TO anon;
+GRANT ALL ON TABLE public.v_marketing_campaigns TO authenticated;
+GRANT ALL ON TABLE public.v_marketing_campaigns TO service_role;
+
+GRANT MAINTAIN ON TABLE public.v_marketing_channels TO anon;
+GRANT ALL ON TABLE public.v_marketing_channels TO authenticated;
+GRANT ALL ON TABLE public.v_marketing_channels TO service_role;
+
+GRANT MAINTAIN ON TABLE public.v_marketing_landing_pages TO anon;
+GRANT ALL ON TABLE public.v_marketing_landing_pages TO authenticated;
+GRANT ALL ON TABLE public.v_marketing_landing_pages TO service_role;
+
+GRANT MAINTAIN ON TABLE public.v_marketing_lead_tag_events TO anon;
+GRANT ALL ON TABLE public.v_marketing_lead_tag_events TO authenticated;
+GRANT ALL ON TABLE public.v_marketing_lead_tag_events TO service_role;
+
+
+-- \u2500\u2500 comment \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+COMMENT ON FUNCTION public.marketing_campaign_run(p_campaign_id uuid, p_limit integer) IS 'Run a campaign (PRD 09): re-resolve the audience, drop whoever no longer qualifies, and ENQUEUE the rest through the notification engine. It never sends \u2014 that is what makes a promotion and a dunning reminder the same machine.';
+
+COMMENT ON FUNCTION public.marketing_resolve_audience(p_campaign_id uuid) IS 'Who is in a campaign''s audience right now (PRD 09). Declarative filters over a read model, with consent for the campaign''s purpose applied AT THE SOURCE \u2014 someone who revoked never appears here, rather than appearing and being dropped later.';
+
+COMMENT ON TABLE public.plg_marketing_audiences IS 'Who a campaign reached and what happened (PRD 09). The audience is a QUERY re-evaluated on every run, not a frozen list: whoever qualifies later enters later, and whoever revokes consent leaves on the next run. This table is the record of that, not its definition.';
+
+COMMENT ON COLUMN public.plg_marketing_campaigns.kind IS 'ad_spend (the imported numbers of an external campaign) or outbound (a campaign this system fires). Same noun, two animals \u2014 a species rather than a second table called almost the same thing.';
+
+COMMENT ON COLUMN public.plg_marketing_campaigns.audience_query IS 'A DECLARATIVE audience: {"source_view": "...", "where": [{"column","op","value"}]}. Not SQL \u2014 a stored query string would make every campaign an injection surface, and a frozen list would answer yesterday''s question.';
+
+COMMENT ON TABLE public.plg_marketing_consents IS 'Consent per PURPOSE (PRD 09), separate from the channel opt-out: a customer may accept a payment reminder and refuse a promotion. Revoking is a timestamp, never a delete \u2014 the record that consent once existed is itself the evidence LGPD asks for.';
+
+COMMENT ON VIEW public.v_marketing_campaign_metrics IS 'Reach, delivery and conversion per campaign (PRD 09), computed from the audience and the notification queue. The campaign keeps no counter of its own \u2014 two tallies of the same fact is how a dashboard starts disagreeing with the queue.';
+
+
+-- \u2500\u2500 default privileges: restore \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- Put back, so the NEXT thing installed inherits what the chain had.
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT MAINTAIN ON TABLES TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT MAINTAIN ON TABLES TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$--
+-- PostgreSQL database dump complete
+--$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$--
+-- PostgreSQL database dump complete
+--$stmt$;
+END $dp$;
+`;
+var MIGRATION_001_THE_LANDING_PAGE_NAMES_THE_SITE = `-- ============================================================================
+-- 001_the_landing_page_names_the_site \u2014 the last caller of fayz_projects, and
+-- then the name itself (#352).
+--
+-- 137 renamed the vendor out of the spine: \`fayz_projects\` became
+-- \`published_sites\`, because a table should say what it holds and not who
+-- built it. 141 left the old name answering as a view until callers moved.
+-- This view is the last one that did not, and it is the reason the name could
+-- not be dropped by the spine: a CREATE VIEW is a HARD dependency, so the
+-- spine \u2014 which runs first \u2014 would be dropping a name this file then joins.
+--
+-- So the drop lives here, with the last reader. The view body is
+-- 000_baseline's with one name changed.
+-- ============================================================================
+
+-- DROP, not CREATE OR REPLACE: this renames a COLUMN (fayz_project_id ->
+-- provider_site_id) and Postgres refuses that in a replace, which is the same
+-- wall 0084 and 0086 hit. Dropping takes the grants with it, so they are
+-- restored below exactly as 000_baseline set them.
+DROP VIEW IF EXISTS public.v_marketing_landing_pages;
+
+CREATE VIEW public.v_marketing_landing_pages WITH (security_invoker='true') AS
+ SELECT lp.id,
+    lp.tenant_id,
+    lp.site_id,
+    lp.name,
+    lp.route,
+    lp.lead_tags,
+    lp.status,
+    lp.prompt,
+    lp.is_active,
+    s.name AS site_name,
+    s.preview_url AS site_url,
+    s.app_id,
+    s.provider_site_id,
+    s.editor_url,
+    lp.created_at,
+    lp.updated_at
+   FROM (public.plg_marketing_landing_pages lp
+     JOIN public.published_sites s ON ((s.id = lp.site_id)));
+GRANT MAINTAIN ON TABLE public.v_marketing_landing_pages TO anon;
+GRANT ALL ON TABLE public.v_marketing_landing_pages TO authenticated;
+GRANT ALL ON TABLE public.v_marketing_landing_pages TO service_role;
+
+DROP VIEW IF EXISTS public.fayz_projects;
+`;
+var MIGRATION_003_A_PORTA_PUBLICA_E_A_PAGINA = `-- 003_a_porta_publica_e_a_pagina.sql
+--
+-- Havia DUAS portas p\xFAblicas para a mesma coisa.
+--
+-- A landing page \xE9 uma p\xE1gina com endere\xE7o p\xFAblico que existe para capturar
+-- gente. A "p\xE1gina de captura" (crm/007) \xE9 um endere\xE7o p\xFAblico que existe para
+-- capturar gente. A diferen\xE7a que eu tinha em mente \u2014 uma \xE9 conte\xFAdo, a outra \xE9
+-- regra \u2014 n\xE3o \xE9 uma diferen\xE7a que o lojista faz: ele quer UMA porta, com o
+-- texto e as regras dela no mesmo lugar.
+--
+-- Ent\xE3o a regra entra na p\xE1gina. A landing page ganha o que s\xF3 a captura tinha:
+-- a chave opaca, o destino, os campos obrigat\xF3rios e a janela de anteced\xEAncia.
+-- E as duas fun\xE7\xF5es que \`anon\` executa passam a ler daqui.
+--
+-- POR QUE AS FUN\xC7\xD5ES MUDAM DE PLUGIN: a corrente aplica \`crm\` ANTES de
+-- \`marketing\`, ent\xE3o uma fun\xE7\xE3o do CRM n\xE3o pode ler uma tabela de marketing \u2014
+-- num replay do zero ela apontaria para algo que ainda n\xE3o existe. Captura
+-- passou a ser assunto de marketing, e a fun\xE7\xE3o vai junto.
+
+ALTER TABLE public.plg_marketing_landing_pages
+  -- O identificador P\xDABLICO e opaco. Continua sendo o que vai na URL; um slug
+  -- adivinh\xE1vel deixaria achar a p\xE1gina de outra casa escrevendo o nome dela.
+  ADD COLUMN IF NOT EXISTS capture_key text,
+  -- Em que sala a porta d\xE1. "Agendamento" \xE9 palavra de sal\xE3o; num restaurante a
+  -- mesma p\xE1gina marca MESA, e numa loja s\xF3 captura contato.
+  ADD COLUMN IF NOT EXISTS capture_destination text DEFAULT 'lead' NOT NULL,
+  ADD COLUMN IF NOT EXISTS capture_required_fields text[] DEFAULT '{}'::text[] NOT NULL,
+  -- A janela \xE9 dupla: piso em horas contra "daqui a dez minutos", teto em dias
+  -- contra "o ano que vem". Nulas quando o destino n\xE3o marca nada.
+  ADD COLUMN IF NOT EXISTS min_advance_hours integer,
+  ADD COLUMN IF NOT EXISTS max_advance_days integer;
+
+DO $$ BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_marketing_landing_pages_capture_key_key') THEN
+    ALTER TABLE ONLY public.plg_marketing_landing_pages
+      ADD CONSTRAINT plg_marketing_landing_pages_capture_key_key UNIQUE (capture_key);
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_marketing_landing_pages_destination') THEN
+    ALTER TABLE public.plg_marketing_landing_pages
+      ADD CONSTRAINT plg_marketing_landing_pages_destination
+      CHECK (capture_destination = ANY (ARRAY['lead'::text, 'booking'::text, 'reservation'::text]));
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_marketing_landing_pages_window') THEN
+    ALTER TABLE public.plg_marketing_landing_pages
+      ADD CONSTRAINT plg_marketing_landing_pages_window CHECK (
+        min_advance_hours IS NULL OR max_advance_days IS NULL
+        OR (min_advance_hours >= 0 AND max_advance_days >= 1
+            AND min_advance_hours <= max_advance_days * 24));
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'plg_marketing_landing_pages_fields') THEN
+    ALTER TABLE public.plg_marketing_landing_pages
+      ADD CONSTRAINT plg_marketing_landing_pages_fields CHECK (
+        capture_required_fields <@ ARRAY['name','phone','email','document','notes']::text[]);
+  END IF;
+END $$;
+
+COMMENT ON COLUMN public.plg_marketing_landing_pages.capture_key IS
+  'A chave P\xDABLICA e opaca da p\xE1gina. Uma porta s\xF3: conte\xFAdo e regra no mesmo lugar (marketing/003).';
+
+-- A chave nasce sozinha, com o mesmo auxiliar do token de convite (crm/003),
+-- que resolve o pgcrypto em tempo de execu\xE7\xE3o.
+CREATE OR REPLACE FUNCTION public.trg_marketing_capture_key()
+RETURNS trigger LANGUAGE plpgsql SET search_path TO '' AS $$
+BEGIN
+  IF NEW.capture_key IS NULL OR btrim(NEW.capture_key) = '' THEN
+    NEW.capture_key := public.crm_url_token(18);
+  END IF;
+  RETURN NEW;
+END $$;
+
+DROP TRIGGER IF EXISTS plg_marketing_capture_key ON public.plg_marketing_landing_pages;
+CREATE TRIGGER plg_marketing_capture_key
+  BEFORE INSERT ON public.plg_marketing_landing_pages
+  FOR EACH ROW EXECUTE FUNCTION public.trg_marketing_capture_key();
+
+UPDATE public.plg_marketing_landing_pages
+   SET capture_key = public.crm_url_token(18)
+ WHERE capture_key IS NULL;
+
+-- \u2500\u2500 abrir a porta (quem est\xE1 de fora) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- \`anon\` executa: devolve o m\xEDnimo para desenhar a p\xE1gina e NADA que sirva para
+-- descobrir outra coisa. N\xE3o lista p\xE1ginas, n\xE3o aceita id (s\xF3 a chave), n\xE3o
+-- devolve tenant_id. P\xE1gina inativa responde \`closed\` e continua existindo \u2014 um
+-- 404 num endere\xE7o que o cliente tem salvo parece site fora do ar.
+CREATE OR REPLACE FUNCTION public.marketing_capture_load(p_key text)
+RETURNS jsonb
+  LANGUAGE plpgsql SECURITY DEFINER STABLE SET search_path TO ''
+AS $$
+DECLARE v record;
+BEGIN
+  IF p_key IS NULL OR length(p_key) < 8 THEN
+    RETURN jsonb_build_object('status', 'not_found');
+  END IF;
+  SELECT * INTO v FROM public.plg_marketing_landing_pages WHERE capture_key = p_key;
+  IF v.id IS NULL THEN RETURN jsonb_build_object('status', 'not_found'); END IF;
+
+  RETURN jsonb_build_object(
+    'status', CASE WHEN v.is_active AND v.status = 'live' THEN 'ok' ELSE 'closed' END,
+    'name', v.name,
+    'route', v.route,
+    'destination', v.capture_destination,
+    'requiredFields', to_jsonb(v.capture_required_fields),
+    'leadTags', to_jsonb(v.lead_tags),
+    -- A janela vai junto para a p\xE1gina APAGAR os hor\xE1rios imposs\xEDveis, em vez
+    -- de deixar o cliente escolher um e levar um "n\xE3o" depois.
+    'minAdvanceHours', v.min_advance_hours,
+    'maxAdvanceDays', v.max_advance_days
+  );
+END $$;
+
+REVOKE ALL ON FUNCTION public.marketing_capture_load(text) FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION public.marketing_capture_load(text) TO anon, authenticated, service_role;
+
+-- \u2500\u2500 a janela, aplicada no servidor \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- Uma janela que s\xF3 existe na tela \xE9 decora\xE7\xE3o: quem manda um POST direto passa
+-- por cima. Devolve o MOTIVO porque "cedo demais" e "longe demais" pedem
+-- corre\xE7\xF5es opostas, e uma recusa gen\xE9rica faz o cliente tentar de novo errado.
+CREATE OR REPLACE FUNCTION public.marketing_capture_window_check(p_key text, p_starts_at timestamp with time zone)
+RETURNS jsonb
+  LANGUAGE plpgsql SECURITY DEFINER STABLE SET search_path TO ''
+AS $$
+DECLARE v record;
+BEGIN
+  SELECT * INTO v FROM public.plg_marketing_landing_pages WHERE capture_key = p_key;
+  IF v.id IS NULL THEN RETURN jsonb_build_object('ok', false, 'reason', 'not_found'); END IF;
+  IF NOT (v.is_active AND v.status = 'live') THEN RETURN jsonb_build_object('ok', false, 'reason', 'closed'); END IF;
+  IF p_starts_at IS NULL THEN RETURN jsonb_build_object('ok', true); END IF;
+
+  IF v.min_advance_hours IS NOT NULL
+     AND p_starts_at < now() + make_interval(hours => v.min_advance_hours) THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'too_soon', 'minAdvanceHours', v.min_advance_hours);
+  END IF;
+  IF v.max_advance_days IS NOT NULL
+     AND p_starts_at > now() + make_interval(days => v.max_advance_days) THEN
+    RETURN jsonb_build_object('ok', false, 'reason', 'too_far', 'maxAdvanceDays', v.max_advance_days);
+  END IF;
+  RETURN jsonb_build_object('ok', true);
+END $$;
+
+REVOKE ALL ON FUNCTION public.marketing_capture_window_check(text, timestamp with time zone) FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION public.marketing_capture_window_check(text, timestamp with time zone) TO anon, authenticated, service_role;
+
+-- \u2500\u2500 a porta antiga vem para a p\xE1gina \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- Cada \`plg_crm_capture_pages\` vira uma landing page \`planned\` com a mesma
+-- chave \u2014 a chave \xE9 o endere\xE7o que o cliente pode ter salvo, e troc\xE1-la
+-- quebraria todo link j\xE1 colado num site. Nasce como \`planned\` e n\xE3o \`live\`
+-- porque a p\xE1gina ainda n\xE3o tem conte\xFAdo: publicar automaticamente poria no ar
+-- um endere\xE7o em branco.
+DO $$
+DECLARE r record; v_site uuid; v_n integer := 0;
+BEGIN
+  IF to_regclass('public.plg_crm_capture_pages') IS NULL THEN RETURN; END IF;
+
+  FOR r IN SELECT * FROM public.plg_crm_capture_pages LOOP
+    SELECT s.id INTO v_site FROM public.published_sites s
+     WHERE s.tenant_id = r.tenant_id ORDER BY s.created_at LIMIT 1;
+    -- Sem site n\xE3o h\xE1 onde a p\xE1gina morar. A porta \xE9 preservada no aviso, n\xE3o
+    -- apagada em sil\xEAncio.
+    IF v_site IS NULL THEN
+      RAISE WARNING '003: tenant % tem porta de captura "%" e nenhum site \u2014 a porta n\xE3o foi migrada', r.tenant_id, r.name;
+      CONTINUE;
+    END IF;
+
+    INSERT INTO public.plg_marketing_landing_pages
+      (tenant_id, site_id, name, route, status, is_active, lead_tags, unit_id,
+       capture_key, capture_destination, capture_required_fields, min_advance_hours, max_advance_days)
+    VALUES
+      (r.tenant_id, v_site, r.name,
+       '/' || coalesce(public.crm_slug(r.name), 'captura'),
+       'planned', r.is_active, r.lead_tags, r.unit_id,
+       r.key, r.destination, r.required_fields, r.min_advance_hours, r.max_advance_days)
+    ON CONFLICT DO NOTHING;
+    v_n := v_n + 1;
+  END LOOP;
+
+  RAISE NOTICE '003: % porta(s) de captura viraram landing page', v_n;
+END $$;
+
+DROP TABLE IF EXISTS public.plg_crm_capture_pages;
+DELETE FROM app.scaffold_registry WHERE table_name = 'plg_crm_capture_pages';
+DROP FUNCTION IF EXISTS public.crm_capture_page_load(text);
+DROP FUNCTION IF EXISTS public.crm_capture_window_check(text, timestamp with time zone);
+DROP FUNCTION IF EXISTS public.trg_crm_capture_page_key();
+`;
+var MIGRATION_004_A_CAMPANHA_APONTA_PARA_UM_RECORTE = `-- 004_a_campanha_aponta_para_um_recorte.sql
+--
+-- A CAMPANHA N\xC3O CONSEGUIA APONTAR PARA UM SEGMENTO, QUE \xC9 PARA O QUE O
+-- SEGMENTO FOI FEITO.
+--
+-- O coment\xE1rio da 004 do CRM diz textualmente por que \`plg_crm_segments\`
+-- existe: "a campanha aponta para ele em vez de carregar a pr\xF3pria c\xF3pia do
+-- filtro". S\xF3 que \`marketing_resolve_audience\` nunca aprendeu a ler um
+-- segmento \u2014 ela resolve \`audience_query = {source_view, where[]}\`, a c\xF3pia do
+-- filtro. Ent\xE3o havia duas verdades sobre quem \xE9 "cliente ativo": a da tela de
+-- segmentos e a da campanha, e elas divergiam no dia em que algu\xE9m corrigisse
+-- uma.
+--
+-- E O VOCABUL\xC1RIO DELA \xC9 MENOR, que \xE9 o problema mais grave dos dois. A
+-- campanha aceita seis operadores de compara\xE7\xE3o e mais nada: sem \`within_days\`,
+-- sem \`has_tag\`, sem \`is_null\`. Copiar a regra do segmento para dentro da
+-- campanha, al\xE9m de duplicar, QUEBRA \u2014 "comprou nos \xFAltimos 30 dias" n\xE3o tem
+-- como ser expresso, e "anivers\xE1rio este m\xEAs" tamb\xE9m n\xE3o.
+--
+-- \u2500\u2500 as duas decis\xF5es \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- 1. A CAMPANHA GUARDA UM PONTEIRO, N\xC3O UMA C\xD3PIA. \`{"segment_id": "..."}\` no
+--    \`audience_query\`. Editar o recorte muda para quem a campanha vai \u2014 que \xE9
+--    a expectativa de quem acabou de editar o recorte. Quem quiser a foto
+--    congelada usa um segmento do tipo \`list\`, que \xE9 exatamente o que ele \xE9.
+--
+-- 2. O CONJUNTO DE OPERADORES PASSA A SER O MESMO DO CRM, ponteiro ou n\xE3o.
+--    Uma campanha que aponta direto (sem segmento) ganha \`within_days\`,
+--    \`has_tag\` e companhia pela mesma tabela de CASE. Duas linguagens de
+--    filtro no mesmo produto \xE9 como se chega a duas respostas diferentes para
+--    a mesma pergunta.
+--
+-- O QUE N\xC3O MUDA, E \xC9 O MAIS IMPORTANTE: o filtro de consentimento continua na
+-- sa\xEDda. \`marketing_has_consent(tenant, pessoa, purpose)\` \xE9 a \xFAltima cl\xE1usula,
+-- sempre \u2014 um p\xFAblico resolvido por segmento n\xE3o atravessa o opt-out s\xF3 porque
+-- veio do CRM. A \`purpose\` da campanha \xE9 o que d\xE1 sentido a ele, e \xE9 por isso
+-- que "criar campanha com uma finalidade espec\xEDfica" \xE9 uma funcionalidade e
+-- n\xE3o um campo de texto: a finalidade DECIDE quem pode receber.
+--
+-- Sem depend\xEAncia dura de plugin: se \`plg_crm_segments\` n\xE3o existe neste app,
+-- um \`segment_id\` \xE9 recusado com mensagem clara em vez de estourar 42P01.
+
+SET check_function_bodies = false;
+
+CREATE OR REPLACE FUNCTION public.marketing_resolve_audience(p_campaign_id uuid)
+RETURNS TABLE(person_id uuid)
+  LANGUAGE plpgsql STABLE SECURITY DEFINER
+  SET search_path TO ''
+AS $_$
+DECLARE
+  c        public.plg_marketing_campaigns%ROWTYPE;
+  v_source text;
+  v_rules  jsonb;
+  v_where  text := '';
+  v_clause jsonb;
+  v_col    text;
+  v_op     text;
+  v_kind   char;
+  v_seg_id uuid;
+  v_seg    record;
+BEGIN
+  SELECT * INTO c FROM public.plg_marketing_campaigns WHERE id = p_campaign_id;
+  IF c.id IS NULL THEN
+    RAISE EXCEPTION 'marketing_resolve_audience: campaign % not found', p_campaign_id USING ERRCODE = 'P0002';
+  END IF;
+
+  -- \u2500\u2500 o ponteiro \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  IF c.audience_query ? 'segment_id' THEN
+    IF to_regclass('public.plg_crm_segments') IS NULL THEN
+      RAISE EXCEPTION 'marketing_resolve_audience: campanha aponta para um segmento, mas o CRM n\xE3o est\xE1 instalado neste app'
+        USING ERRCODE = '42P01';
+    END IF;
+    BEGIN
+      v_seg_id := (c.audience_query ->> 'segment_id')::uuid;
+    EXCEPTION WHEN OTHERS THEN
+      RAISE EXCEPTION 'marketing_resolve_audience: segment_id inv\xE1lido' USING ERRCODE = '22023';
+    END;
+
+    -- Mesmo tenant, sempre. Um p\xFAblico que atravessasse inquilino seria a pior
+    -- falha poss\xEDvel deste arquivo.
+    SELECT s.source_view, s.rules, s.kind INTO v_seg
+      FROM public.plg_crm_segments s
+     WHERE s.id = v_seg_id AND s.tenant_id = c.tenant_id;
+    IF NOT FOUND THEN
+      RAISE EXCEPTION 'marketing_resolve_audience: segmento % n\xE3o \xE9 deste tenant', v_seg_id USING ERRCODE = 'P0002';
+    END IF;
+
+    -- A lista escolhida a dedo \xC9 a resposta \u2014 e mesmo ela passa pelo consentimento.
+    IF v_seg.kind = 'list' THEN
+      RETURN QUERY
+        SELECT m.person_id FROM public.plg_crm_segment_members m
+         WHERE m.segment_id = v_seg_id AND m.tenant_id = c.tenant_id
+           AND public.marketing_has_consent(c.tenant_id, m.person_id, c.purpose);
+      RETURN;
+    END IF;
+
+    v_source := coalesce(v_seg.source_view, 'people');
+    v_rules  := coalesce(v_seg.rules -> 'where', '[]'::jsonb);
+  ELSE
+    v_source := coalesce(c.audience_query ->> 'source_view', 'people');
+    v_rules  := coalesce(c.audience_query -> 'where', '[]'::jsonb);
+  END IF;
+
+  IF v_source !~ '^[a-z_][a-z0-9_]*$' THEN
+    RAISE EXCEPTION 'marketing_resolve_audience: % is not a bare relation name', v_source USING ERRCODE = '22023';
+  END IF;
+  SELECT cl.relkind INTO v_kind FROM pg_catalog.pg_class cl
+    JOIN pg_catalog.pg_namespace n ON n.oid = cl.relnamespace
+   WHERE n.nspname = 'public' AND cl.relname = v_source;
+  IF v_kind IS NULL THEN
+    RAISE EXCEPTION 'marketing_resolve_audience: public.% does not exist', v_source USING ERRCODE = '42P01';
+  END IF;
+
+  v_where := format('tenant_id = %L', c.tenant_id);
+
+  -- Unidade da campanha estreita o p\xFAblico, quando a leitura tem a coluna.
+  IF c.unit_id IS NOT NULL AND EXISTS (
+    SELECT 1 FROM information_schema.columns
+     WHERE table_schema = 'public' AND table_name = v_source AND column_name = 'unit_id'
+  ) THEN
+    v_where := v_where || format(' AND unit_id = %L', c.unit_id);
+  END IF;
+
+  -- \u2500\u2500 o mesmo CASE do CRM, operador por operador \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  FOR v_clause IN SELECT * FROM jsonb_array_elements(v_rules) LOOP
+    v_col := v_clause ->> 'column';
+    v_op  := coalesce(v_clause ->> 'op', '=');
+
+    IF NOT EXISTS (SELECT 1 FROM information_schema.columns
+                    WHERE table_schema = 'public' AND table_name = v_source AND column_name = v_col) THEN
+      RAISE EXCEPTION 'marketing_resolve_audience: public.% has no column %', v_source, v_col USING ERRCODE = '42703';
+    END IF;
+
+    v_where := v_where || CASE
+      WHEN v_op IN ('=', '<>', '>', '<', '>=', '<=') THEN
+        format(' AND %I %s %L', v_col,
+               CASE v_op WHEN '<>' THEN '<>' WHEN '>' THEN '>' WHEN '<' THEN '<'
+                         WHEN '>=' THEN '>=' WHEN '<=' THEN '<=' ELSE '=' END,
+               v_clause ->> 'value')
+
+      WHEN v_op = 'ilike' THEN
+        format(' AND %I ILIKE %L', v_col, '%' || coalesce(v_clause ->> 'value', '') || '%')
+
+      WHEN v_op IN ('in', 'not_in') THEN (
+        SELECT format(' AND %I %s (%s)', v_col,
+                      CASE WHEN v_op = 'not_in' THEN 'NOT IN' ELSE 'IN' END,
+                      coalesce(string_agg(quote_literal(e), ','), 'NULL'))
+          FROM jsonb_array_elements_text(coalesce(v_clause -> 'value', '[]'::jsonb)) AS e)
+
+      WHEN v_op = 'is_null'  THEN format(' AND %I IS NULL', v_col)
+      WHEN v_op = 'not_null' THEN format(' AND %I IS NOT NULL', v_col)
+
+      WHEN v_op = 'has_tag' THEN
+        format(' AND %L = ANY(%I)', v_clause ->> 'value', v_col)
+
+      WHEN v_op IN ('within_days', 'older_than_days') THEN (
+        SELECT format(' AND %I %s now() - make_interval(days => %s)', v_col,
+                      CASE WHEN v_op = 'within_days' THEN '>=' ELSE '<' END,
+                      (coalesce(v_clause ->> 'value', '0'))::integer))
+
+      WHEN v_op = 'birthday_within_days' THEN (
+        SELECT format(
+          ' AND %I IS NOT NULL AND ((EXTRACT(doy FROM %I::date)::int - EXTRACT(doy FROM now())::int + 366) %% 366) <= %s',
+          v_col, v_col, (coalesce(v_clause ->> 'value', '0'))::integer))
+
+      ELSE
+        -- Operador desconhecido ALARGA o p\xFAblico se for ignorado \u2014 e um p\xFAblico
+        -- alargado em sil\xEAncio \xE9 a mensagem indo para quem n\xE3o devia.
+        NULL
+    END;
+
+    IF v_where IS NULL THEN
+      RAISE EXCEPTION 'marketing_resolve_audience: operador % n\xE3o \xE9 reconhecido', v_op USING ERRCODE = '22023';
+    END IF;
+  END LOOP;
+
+  -- O consentimento \xE9 a \xDALTIMA cl\xE1usula, e continua sendo, venha o p\xFAblico de
+  -- onde vier.
+  RETURN QUERY EXECUTE format(
+    'SELECT s.id FROM public.%I s WHERE %s AND public.marketing_has_consent(%L, s.id, %L)',
+    v_source, v_where, c.tenant_id, c.purpose);
+END $_$;
+
+COMMENT ON FUNCTION public.marketing_resolve_audience(uuid) IS
+  'Quem a campanha alcan\xE7a. Aponta para um segmento do CRM (segment_id) ou carrega a pr\xF3pria regra; mesmo conjunto de operadores do CRM; consentimento sempre na sa\xEDda (004).';
+`;
+var MIGRATION_005_A_ATRIBUICAO_DO_LEAD_ATRAVESSA_A_ORIGEM_ATE_O_CANAL = `-- ---------------------------------------------------------------------------
+-- 005_a_atribuicao_do_lead_atravessa_a_origem_ate_o_canal.sql \u2014 os tr\xEAs n\xEDveis
+-- de atribui\xE7\xE3o num lugar s\xF3, e o conserto de uma tela que contava zero.
+--
+-- \u2500\u2500 por que este arquivo est\xE1 no marketing e n\xE3o no CRM \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- A view junta tr\xEAs tabelas de duas casas: \`plg_crm_lead_sources\` (CRM) com
+-- \`plg_marketing_channels\` e \`plg_marketing_campaigns\` (aqui). Na ordem da
+-- chain o CRM roda ANTES do marketing, ent\xE3o do lado de l\xE1 as tabelas deste
+-- plugin ainda n\xE3o existem. Do lado de c\xE1 as do CRM j\xE1 existem.
+--
+-- A regra que isso ensina: quem cria uma view que atravessa plugins \xE9 o \xDALTIMO
+-- dos seus dependentes. \`crm/038\` tentou o contr\xE1rio e o \`db-from-zero\` pegou
+-- na primeira passada.
+--
+-- \u2500\u2500 as tr\xEAs perguntas \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+--   CANAL (medium)    COMO a gente se encontrou.  "Evento presencial"
+--   ORIGEM (source)   ONDE, especificamente.      "Sal\xE3o Abrasel"
+--   CAMPANHA          QUAL esfor\xE7o, com custo.    "ABRASEL 2026"
+--
+-- Salesforce separa \`LeadSource\` de \`Campaign\`; HubSpot separa "Original
+-- source" do drill-down; Odoo e Mautic usam o trio UTM. Nenhum junta os tr\xEAs
+-- num campo s\xF3: "quanto custou este lead" s\xF3 existe na campanha, e "que tipo
+-- de esfor\xE7o traz gente melhor" s\xF3 existe no canal.
+--
+-- \u2500\u2500 o defeito que isto conserta \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+--
+-- \`v_marketing_attribution\` lia \`metadata.sourceId\` e chamava aquilo de
+-- \`channel_raw\` \u2014 a ORIGEM ocupando o lugar do CANAL. Com isso a tela de
+-- Canais contava zero para todos, porque nenhum \`channel_key\` jamais bate com
+-- um uuid de origem. Esta view atravessa a origem at\xE9 o canal, que \xE9 o salto
+-- que faltava. A antiga fica: outras telas dependem da forma dela.
+-- ---------------------------------------------------------------------------
+
+DROP VIEW IF EXISTS public.v_marketing_lead_attribution;
+CREATE VIEW public.v_marketing_lead_attribution
+WITH (security_invoker = true) AS
+  SELECT p.id            AS lead_id,
+         p.tenant_id,
+         p.created_at,
+         s.id            AS source_id,
+         s.name          AS source_name,
+         -- O canal vem da ORIGEM; quando ela n\xE3o declara, o lead n\xE3o \xE9
+         -- atribu\xEDdo a canal nenhum. Nulo \xE9 honesto: for\xE7ar 'direct' faria a
+         -- tela afirmar uma proced\xEAncia que ningu\xE9m mediu.
+         s.channel_key,
+         ch.label        AS channel_label,
+         ch.kind         AS channel_kind,
+         (p.metadata ->> 'campaignId')  AS campaign_id,
+         mc.name                        AS campaign_name,
+         mc.spend                       AS campaign_spend
+    FROM public.people p
+    LEFT JOIN public.plg_crm_lead_sources s
+           ON s.tenant_id = p.tenant_id
+          AND s.id::text = (p.metadata ->> 'sourceId')
+    LEFT JOIN public.plg_marketing_channels ch
+           ON ch.tenant_id = p.tenant_id
+          AND ch.channel_key = s.channel_key
+    LEFT JOIN public.plg_marketing_campaigns mc
+           ON mc.tenant_id = p.tenant_id
+          AND mc.id::text = (p.metadata ->> 'campaignId')
+   WHERE p.kind = 'lead'
+     AND p.merged_into_id IS NULL
+     AND p.tenant_id IN (SELECT public.user_tenant_ids());
+
+GRANT SELECT ON public.v_marketing_lead_attribution TO authenticated;
+
+COMMENT ON VIEW public.v_marketing_lead_attribution IS
+  'Cada lead com seus tr\xEAs n\xEDveis: canal (COMO), origem (ONDE) e campanha (QUAL esfor\xE7o, com custo). A origem resolve o canal \u2014 o lead n\xE3o o carrega (marketing/005).';
+`;
+var MIGRATION_006_THE_CAMPAIGN_ENGINE_IS_SERVER_ONLY = `-- 006_the_campaign_engine_is_server_only.sql
+--
+-- \`marketing_campaign_run\`, \`marketing_resolve_audience\` and
+-- \`marketing_has_consent\` are SECURITY DEFINER and look a campaign or a tenant
+-- up by id without asking who is calling. Granted to \`authenticated\`, any
+-- logged-in user of any tenant could fire another tenant's campaign or list
+-- its audience by guessing a uuid.
+--
+-- No screen, edge function or agent tool calls them: the only caller is
+-- \`marketing_run_due\` on the minute tick (via \`event_runner_tick\`, as postgres)
+-- and the functions themselves. So the fix is to take the door away, not to
+-- guard it. A future "send now" button gets a tenant-checked wrapper.
+--
+-- \`REVOKE ... FROM PUBLIC\` alone is not enough here: the pool's default
+-- privileges grant EXECUTE to \`authenticated\` on every new function in public.
+
+REVOKE ALL ON FUNCTION public.marketing_campaign_run(uuid, integer) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.marketing_campaign_run(uuid, integer) TO service_role;
+
+REVOKE ALL ON FUNCTION public.marketing_resolve_audience(uuid) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.marketing_resolve_audience(uuid) TO service_role;
+
+REVOKE ALL ON FUNCTION public.marketing_has_consent(uuid, uuid, text) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.marketing_has_consent(uuid, uuid, text) TO service_role;
+
+REVOKE ALL ON FUNCTION public.marketing_run_due(integer) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.marketing_run_due(integer) TO service_role;
+`;
+var MIGRATIONS = [
+  { id: "000_baseline", sql: MIGRATION_000_BASELINE },
+  { id: "001_the_landing_page_names_the_site", sql: MIGRATION_001_THE_LANDING_PAGE_NAMES_THE_SITE },
+  { id: "003_a_porta_publica_e_a_pagina", sql: MIGRATION_003_A_PORTA_PUBLICA_E_A_PAGINA },
+  { id: "004_a_campanha_aponta_para_um_recorte", sql: MIGRATION_004_A_CAMPANHA_APONTA_PARA_UM_RECORTE },
+  { id: "005_a_atribuicao_do_lead_atravessa_a_origem_ate_o_canal", sql: MIGRATION_005_A_ATRIBUICAO_DO_LEAD_ATRAVESSA_A_ORIGEM_ATE_O_CANAL },
+  { id: "006_the_campaign_engine_is_server_only", sql: MIGRATION_006_THE_CAMPAIGN_ENGINE_IS_SERVER_ONLY }
+];
+
+export { MIGRATIONS, MIGRATION_000_BASELINE, MIGRATION_001_THE_LANDING_PAGE_NAMES_THE_SITE, MIGRATION_003_A_PORTA_PUBLICA_E_A_PAGINA, MIGRATION_004_A_CAMPANHA_APONTA_PARA_UM_RECORTE, MIGRATION_005_A_ATRIBUICAO_DO_LEAD_ATRAVESSA_A_ORIGEM_ATE_O_CANAL, MIGRATION_006_THE_CAMPAIGN_ENGINE_IS_SERVER_ONLY };
+//# sourceMappingURL=main.js.map
+//# sourceMappingURL=main.js.map