@fayz-ai/plugin-notifications 0.2.0

package/dist/index.js

@@ -0,0 +1,1138 @@
+import { registerTranslations } from '@fayz-ai/core';
+
+// src/index.ts
+
+// src/locales/en.ts
+var en = {
+  "notifications.title": "Notifications",
+  "notifications.templates": "Templates",
+  "notifications.queue": "Queue",
+  "notifications.preferences": "Preferences",
+  "notifications.blocked": "Blocked",
+  "notifications.abandoned": "Abandoned"
+};
+
+// src/locales/pt-BR.ts
+var ptBR = {
+  "notifications.title": "Notifica\xE7\xF5es",
+  "notifications.templates": "Modelos",
+  "notifications.queue": "Fila",
+  "notifications.preferences": "Prefer\xEAncias",
+  "notifications.blocked": "Bloqueadas",
+  "notifications.abandoned": "Abandonadas"
+};
+
+// src/locales/index.ts
+var notificationsLocales = { en, "pt-BR": ptBR };
+
+// src/migrations/index.ts
+var MIGRATION_000_BASELINE = `-- ============================================================================
+-- plugins/plugin-notifications/src/migrations/000_baseline.sql \u2014 what installing this provisions, as one file.
+--
+-- GENERATED by scripts/emit-unit-baselines.mjs (#338). Do not edit by hand:
+-- change the schema, regenerate, and let scripts/check-chain-equivalence.mjs
+-- prove the result still matches.
+--
+-- This replaced 3 migration files. They are kept, unapplied, in
+-- migrations.archive/ \u2014 a year of decisions is worth reading even when it is no
+-- longer worth replaying.
+--
+-- Object order is fixed rather than dependency-sorted: schemas, types,
+-- sequences, tables, defaults, functions, constraints, views, indexes, foreign
+-- keys, triggers, row security, policies, grants. Dependencies BETWEEN units
+-- are carried by the order packages/db/chain.json declares.
+-- ============================================================================
+
+-- A LANGUAGE sql function binds its body at CREATE time, and 570 functions
+-- sorted by name are not sorted by who calls whom. This is what lets them load
+-- in any order; every body is still compiled on first call, so a genuinely
+-- broken reference surfaces then rather than never. Session-scoped.
+SET check_function_bodies = false;
+
+
+
+-- \u2500\u2500 default privileges: reset \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- Cleared BEFORE anything is created, so every object below gets the ACL the
+-- dump describes rather than the image's defaults on top of it. Restored at
+-- the end of this file.
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+
+-- \u2500\u2500 table \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE TABLE public.plg_notifications_channels (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid,
+    channel text NOT NULL,
+    sender_function text NOT NULL,
+    is_active boolean DEFAULT true NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT plg_notifications_channels_channel_check CHECK ((channel = ANY (ARRAY['email'::text, 'sms'::text, 'whatsapp'::text, 'push'::text, 'in_app'::text])))
+);
+
+CREATE TABLE public.plg_notifications_deliveries (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    unit_id uuid,
+    queue_id uuid NOT NULL,
+    channel text NOT NULL,
+    provider text,
+    provider_ref text,
+    delivered_at timestamp with time zone,
+    failed_at timestamp with time zone,
+    error text,
+    response jsonb DEFAULT '{}'::jsonb NOT NULL,
+    owner_id uuid,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL
+);
+
+ALTER TABLE ONLY public.plg_notifications_deliveries FORCE ROW LEVEL SECURITY;
+
+CREATE TABLE public.plg_notifications_preferences (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    unit_id uuid,
+    person_id uuid NOT NULL,
+    channel text NOT NULL,
+    opted_in boolean DEFAULT true NOT NULL,
+    quiet_hours jsonb,
+    priority integer DEFAULT 100 NOT NULL,
+    owner_id uuid,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT plg_notifications_preferences_channel_check CHECK ((channel = ANY (ARRAY['email'::text, 'sms'::text, 'whatsapp'::text, 'push'::text, 'in_app'::text])))
+);
+
+ALTER TABLE ONLY public.plg_notifications_preferences FORCE ROW LEVEL SECURITY;
+
+CREATE TABLE public.plg_notifications_queue (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    unit_id uuid,
+    template_key text NOT NULL,
+    person_id uuid,
+    channel text NOT NULL,
+    locale text DEFAULT 'pt-BR'::text NOT NULL,
+    purpose text DEFAULT 'transactional'::text NOT NULL,
+    payload jsonb DEFAULT '{}'::jsonb NOT NULL,
+    subject text,
+    body text,
+    scheduled_for timestamp with time zone DEFAULT now() NOT NULL,
+    status text DEFAULT 'pending'::text NOT NULL,
+    attempts integer DEFAULT 0 NOT NULL,
+    max_attempts integer DEFAULT 5 NOT NULL,
+    next_attempt_at timestamp with time zone DEFAULT now() NOT NULL,
+    last_error text,
+    blocked_reason text,
+    dedupe_key text,
+    source_event_id uuid,
+    metadata jsonb DEFAULT '{}'::jsonb NOT NULL,
+    owner_id uuid,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT plg_notifications_queue_max_attempts_check CHECK (((max_attempts >= 1) AND (max_attempts <= 50))),
+    CONSTRAINT plg_notifications_queue_status_check CHECK ((status = ANY (ARRAY['pending'::text, 'sent'::text, 'failed'::text, 'abandoned'::text, 'blocked'::text, 'cancelled'::text])))
+);
+
+ALTER TABLE ONLY public.plg_notifications_queue FORCE ROW LEVEL SECURITY;
+
+CREATE TABLE public.plg_notifications_templates (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    unit_id uuid,
+    key text NOT NULL,
+    channel text NOT NULL,
+    locale text DEFAULT 'pt-BR'::text NOT NULL,
+    purpose text DEFAULT 'transactional'::text NOT NULL,
+    subject text,
+    body text NOT NULL,
+    variables jsonb DEFAULT '[]'::jsonb NOT NULL,
+    is_default boolean DEFAULT false NOT NULL,
+    is_active boolean DEFAULT true NOT NULL,
+    metadata jsonb DEFAULT '{}'::jsonb NOT NULL,
+    created_by uuid,
+    owner_id uuid,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT plg_notifications_templates_channel_check CHECK ((channel = ANY (ARRAY['email'::text, 'sms'::text, 'whatsapp'::text, 'push'::text, 'in_app'::text]))),
+    CONSTRAINT plg_notifications_templates_purpose_check CHECK ((purpose = ANY (ARRAY['transactional'::text, 'marketing'::text])))
+);
+
+ALTER TABLE ONLY public.plg_notifications_templates FORCE ROW LEVEL SECURITY;
+
+
+-- \u2500\u2500 function \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE FUNCTION public.notifications_drain(p_limit integer DEFAULT 100) RETURNS TABLE(claimed integer, sent integer, failed integer, abandoned integer)
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO ''
+    AS $_$
+DECLARE
+  q public.plg_notifications_queue%ROWTYPE;
+  v_fn text; v_res jsonb;
+  v_claimed integer := 0; v_sent integer := 0; v_failed integer := 0; v_abandoned integer := 0;
+BEGIN
+  FOR q IN
+    SELECT * FROM public.plg_notifications_queue
+     WHERE status = 'pending' AND next_attempt_at <= now() AND scheduled_for <= now()
+     ORDER BY scheduled_for
+     LIMIT greatest(p_limit, 0)
+     FOR UPDATE SKIP LOCKED
+  LOOP
+    v_claimed := v_claimed + 1;
+
+    SELECT c.sender_function INTO v_fn
+      FROM public.plg_notifications_channels c
+     WHERE c.channel = q.channel AND c.is_active
+       AND (c.tenant_id = q.tenant_id OR c.tenant_id IS NULL)
+     ORDER BY (c.tenant_id IS NOT NULL) DESC
+     LIMIT 1;
+
+    IF v_fn IS NULL THEN
+      UPDATE public.plg_notifications_queue
+         SET status = 'blocked', blocked_reason = format('no sender registered for channel %s', q.channel)
+       WHERE id = q.id;
+      CONTINUE;
+    END IF;
+
+    BEGIN
+      EXECUTE format('SELECT %s($1)', v_fn) INTO v_res USING q.id;
+      UPDATE public.plg_notifications_queue
+         SET status = 'sent', attempts = q.attempts + 1, last_error = NULL
+       WHERE id = q.id;
+      v_sent := v_sent + 1;
+    EXCEPTION WHEN OTHERS THEN
+      -- Fails alone, with backoff, and is abandoned VISIBLY rather than retried
+      -- forever. Same discipline as the event consumer of spine 149.
+      IF q.attempts + 1 >= q.max_attempts THEN
+        UPDATE public.plg_notifications_queue
+           SET status = 'abandoned', attempts = q.attempts + 1, last_error = SQLERRM
+         WHERE id = q.id;
+        v_abandoned := v_abandoned + 1;
+      ELSE
+        UPDATE public.plg_notifications_queue
+           SET attempts = q.attempts + 1, last_error = SQLERRM,
+               next_attempt_at = now() + least(interval '1 hour', (power(2, q.attempts + 1) || ' seconds')::interval)
+         WHERE id = q.id;
+        v_failed := v_failed + 1;
+      END IF;
+      INSERT INTO public.plg_notifications_deliveries (tenant_id, unit_id, queue_id, channel, provider, failed_at, error)
+      VALUES (q.tenant_id, q.unit_id, q.id, q.channel, v_fn, now(), SQLERRM);
+    END;
+  END LOOP;
+
+  RETURN QUERY SELECT v_claimed, v_sent, v_failed, v_abandoned;
+END $_$;
+
+CREATE FUNCTION public.notifications_enqueue(p_tenant_id uuid, p_template_key text, p_person_id uuid, p_payload jsonb DEFAULT '{}'::jsonb, p_dedupe_key text DEFAULT NULL::text, p_scheduled_for timestamp with time zone DEFAULT now(), p_channel text DEFAULT NULL::text, p_locale text DEFAULT NULL::text, p_unit_id uuid DEFAULT NULL::uuid, p_source_event_id uuid DEFAULT NULL::uuid) RETURNS uuid
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO ''
+    AS $$
+DECLARE
+  v_locale  text := coalesce(p_locale, 'pt-BR');
+  v_channel text;
+  v_blocked text;
+  v_tpl     public.plg_notifications_templates%ROWTYPE;
+  v_id      uuid;
+  v_existing uuid;
+BEGIN
+  IF p_tenant_id IS NULL OR p_template_key IS NULL THEN
+    RAISE EXCEPTION 'notifications_enqueue: tenant and template_key are required' USING ERRCODE = '22023';
+  END IF;
+
+  -- A redelivered event stops here, before anything is written.
+  IF p_dedupe_key IS NOT NULL THEN
+    SELECT q.id INTO v_existing FROM public.plg_notifications_queue q
+     WHERE q.tenant_id = p_tenant_id AND q.dedupe_key = p_dedupe_key;
+    IF v_existing IS NOT NULL THEN RETURN v_existing; END IF;
+  END IF;
+
+  IF NOT EXISTS (SELECT 1 FROM public.plg_notifications_templates t
+                  WHERE t.tenant_id = p_tenant_id AND t.key = p_template_key AND t.is_active) THEN
+    RAISE EXCEPTION 'notifications_enqueue: no active template for key %', p_template_key
+      USING ERRCODE = '23503',
+            HINT = 'Nothing leaves this engine unnamed \u2014 write the template first (plg_notifications_templates).';
+  END IF;
+
+  SELECT r.channel, r.blocked_reason INTO v_channel, v_blocked
+    FROM public.notifications_resolve_channel(p_tenant_id, p_template_key, p_person_id, v_locale, p_channel) r;
+
+  IF v_channel IS NULL THEN
+    -- Blocked messages are RECORDED. An opt-out that produces nothing at all is
+    -- indistinguishable from an engine that quietly stopped working.
+    INSERT INTO public.plg_notifications_queue (
+      tenant_id, unit_id, template_key, person_id, channel, locale, payload,
+      scheduled_for, status, blocked_reason, dedupe_key, source_event_id)
+    VALUES (p_tenant_id, p_unit_id, p_template_key, p_person_id, coalesce(p_channel, 'none'), v_locale,
+            coalesce(p_payload, '{}'::jsonb), coalesce(p_scheduled_for, now()), 'blocked',
+            coalesce(v_blocked, 'no channel available'), p_dedupe_key, p_source_event_id)
+    RETURNING id INTO v_id;
+    RETURN v_id;
+  END IF;
+
+  SELECT * INTO v_tpl FROM public.plg_notifications_templates t
+   WHERE t.tenant_id = p_tenant_id AND t.key = p_template_key
+     AND t.channel = v_channel AND t.locale = v_locale AND t.is_active
+   LIMIT 1;
+
+  IF v_tpl.id IS NULL THEN
+    SELECT * INTO v_tpl FROM public.plg_notifications_templates t
+     WHERE t.tenant_id = p_tenant_id AND t.key = p_template_key AND t.channel = v_channel AND t.is_active
+     ORDER BY (t.locale = v_locale) DESC, t.locale LIMIT 1;
+  END IF;
+
+  IF v_tpl.id IS NULL THEN
+    RAISE EXCEPTION 'notifications_enqueue: no template for key % on channel %', p_template_key, v_channel
+      USING ERRCODE = '23503';
+  END IF;
+
+  INSERT INTO public.plg_notifications_queue (
+    tenant_id, unit_id, template_key, person_id, channel, locale, purpose, payload,
+    subject, body, scheduled_for, status, dedupe_key, source_event_id)
+  VALUES (p_tenant_id, coalesce(p_unit_id, v_tpl.unit_id), p_template_key, p_person_id, v_channel, v_tpl.locale,
+          v_tpl.purpose, coalesce(p_payload, '{}'::jsonb),
+          public.notifications_render(v_tpl.subject, p_payload),
+          public.notifications_render(v_tpl.body, p_payload),
+          coalesce(p_scheduled_for, now()), 'pending', p_dedupe_key, p_source_event_id)
+  ON CONFLICT DO NOTHING
+  RETURNING id INTO v_id;
+
+  IF v_id IS NULL AND p_dedupe_key IS NOT NULL THEN
+    SELECT q.id INTO v_id FROM public.plg_notifications_queue q
+     WHERE q.tenant_id = p_tenant_id AND q.dedupe_key = p_dedupe_key;
+  END IF;
+
+  RETURN v_id;
+END $$;
+
+CREATE FUNCTION public.notifications_render(p_body text, p_payload jsonb) RETURNS text
+    LANGUAGE plpgsql IMMUTABLE
+    SET search_path TO ''
+    AS $$
+DECLARE v_out text := coalesce(p_body, ''); k text; v text;
+BEGIN
+  IF p_payload IS NULL OR jsonb_typeof(p_payload) <> 'object' THEN RETURN v_out; END IF;
+  FOR k, v IN SELECT key, CASE WHEN jsonb_typeof(value) = 'string' THEN value #>> '{}' ELSE value::text END
+                FROM jsonb_each(p_payload) LOOP
+    v_out := replace(v_out, '{{' || k || '}}', coalesce(v, ''));
+  END LOOP;
+  -- A variable the payload did not carry becomes empty rather than shipping
+  -- "{{customer_name}}" to a customer.
+  RETURN regexp_replace(v_out, '\\{\\{[a-zA-Z0-9_.]+\\}\\}', '', 'g');
+END $$;
+
+CREATE FUNCTION public.notifications_resolve_channel(p_tenant_id uuid, p_key text, p_person_id uuid, p_locale text DEFAULT 'pt-BR'::text, p_requested text DEFAULT NULL::text, OUT channel text, OUT blocked_reason text) RETURNS record
+    LANGUAGE plpgsql STABLE SECURITY DEFINER
+    SET search_path TO ''
+    AS $_$
+DECLARE v_pref record; v_default text; v_optout boolean := false;
+BEGIN
+  -- plugin-conversations' opt-out is absolute and is checked first: it is the
+  -- record of the person telling the business to stop, and no template, purpose
+  -- or preference of ours outranks it.
+  IF to_regclass('public.plg_conversations_optouts') IS NOT NULL THEN
+    BEGIN
+      EXECUTE 'SELECT EXISTS (SELECT 1 FROM public.plg_conversations_optouts o
+                               WHERE o.tenant_id = $1 AND o.person_id = $2)'
+        INTO v_optout USING p_tenant_id, p_person_id;
+    EXCEPTION WHEN OTHERS THEN
+      -- The table exists with a shape this version does not know. Not a reason
+      -- to refuse to notify; it IS a reason to say so out loud.
+      v_optout := false;
+      RAISE NOTICE 'notifications_resolve_channel: could not read plg_conversations_optouts (%)', SQLERRM;
+    END;
+  END IF;
+
+  IF v_optout THEN
+    channel := NULL; blocked_reason := 'conversations opt-out'; RETURN;
+  END IF;
+
+  IF p_requested IS NOT NULL THEN
+    IF EXISTS (SELECT 1 FROM public.plg_notifications_preferences p
+                WHERE p.tenant_id = p_tenant_id AND p.person_id = p_person_id
+                  AND p.channel = p_requested AND NOT p.opted_in) THEN
+      channel := NULL; blocked_reason := format('recipient opted out of %s', p_requested); RETURN;
+    END IF;
+    channel := p_requested; blocked_reason := NULL; RETURN;
+  END IF;
+
+  SELECT p.channel INTO v_pref
+    FROM public.plg_notifications_preferences p
+    JOIN public.plg_notifications_templates t
+      ON t.tenant_id = p.tenant_id AND t.key = p_key AND t.channel = p.channel
+     AND t.locale = p_locale AND t.is_active
+   WHERE p.tenant_id = p_tenant_id AND p.person_id = p_person_id AND p.opted_in
+   ORDER BY p.priority, p.channel
+   LIMIT 1;
+
+  IF v_pref.channel IS NOT NULL THEN
+    channel := v_pref.channel; blocked_reason := NULL; RETURN;
+  END IF;
+
+  -- No preference is not "no message": the template declares the fallback.
+  SELECT t.channel INTO v_default
+    FROM public.plg_notifications_templates t
+   WHERE t.tenant_id = p_tenant_id AND t.key = p_key AND t.locale = p_locale
+     AND t.is_active AND t.is_default
+   LIMIT 1;
+
+  IF v_default IS NULL THEN
+    SELECT t.channel INTO v_default
+      FROM public.plg_notifications_templates t
+     WHERE t.tenant_id = p_tenant_id AND t.key = p_key AND t.locale = p_locale AND t.is_active
+     ORDER BY t.channel LIMIT 1;
+  END IF;
+
+  IF v_default IS NOT NULL
+     AND EXISTS (SELECT 1 FROM public.plg_notifications_preferences p
+                  WHERE p.tenant_id = p_tenant_id AND p.person_id = p_person_id
+                    AND p.channel = v_default AND NOT p.opted_in) THEN
+    channel := NULL; blocked_reason := format('recipient opted out of %s', v_default); RETURN;
+  END IF;
+
+  channel := v_default;
+  blocked_reason := CASE WHEN v_default IS NULL THEN 'no active template for this key' END;
+END $_$;
+
+CREATE FUNCTION public.notifications_send_in_app(p_queue_id uuid) RETURNS jsonb
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO ''
+    AS $_$
+DECLARE q public.plg_notifications_queue%ROWTYPE; v_id uuid;
+BEGIN
+  SELECT * INTO q FROM public.plg_notifications_queue WHERE id = p_queue_id;
+  IF to_regclass('public.notifications') IS NULL THEN
+    RETURN public.notifications_send_to_log(p_queue_id);
+  END IF;
+  EXECUTE 'INSERT INTO public.notifications (tenant_id, title, body, metadata)
+           VALUES ($1, $2, $3, $4)'
+    USING q.tenant_id, coalesce(q.subject, q.template_key), q.body,
+          jsonb_build_object('source', 'plugin-notifications', 'queue_id', q.id, 'person_id', q.person_id);
+  INSERT INTO public.plg_notifications_deliveries (tenant_id, unit_id, queue_id, channel, provider, delivered_at)
+  VALUES (q.tenant_id, q.unit_id, q.id, q.channel, 'in_app', now())
+  RETURNING id INTO v_id;
+  RETURN jsonb_build_object('delivered', true, 'provider', 'in_app', 'delivery_id', v_id);
+END $_$;
+
+CREATE FUNCTION public.notifications_send_to_log(p_queue_id uuid) RETURNS jsonb
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO ''
+    AS $$
+DECLARE q public.plg_notifications_queue%ROWTYPE; v_id uuid;
+BEGIN
+  SELECT * INTO q FROM public.plg_notifications_queue WHERE id = p_queue_id;
+  INSERT INTO public.plg_notifications_deliveries (tenant_id, unit_id, queue_id, channel, provider, provider_ref, delivered_at, response)
+  VALUES (q.tenant_id, q.unit_id, q.id, q.channel, 'log', q.id::text || ':' || q.attempts::text, now(),
+          jsonb_build_object('subject', q.subject, 'body', q.body))
+  RETURNING id INTO v_id;
+  RETURN jsonb_build_object('delivered', true, 'provider', 'log', 'delivery_id', v_id);
+END $$;
+
+CREATE FUNCTION public.notifications_send_via_conversations(p_queue_id uuid) RETURNS jsonb
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO ''
+    AS $_$
+DECLARE q public.plg_notifications_queue%ROWTYPE; v_id uuid; v_msg uuid;
+BEGIN
+  SELECT * INTO q FROM public.plg_notifications_queue WHERE id = p_queue_id;
+  IF to_regclass('public.plg_conversation_messages') IS NULL THEN
+    RETURN public.notifications_send_to_log(p_queue_id);
+  END IF;
+  BEGIN
+    EXECUTE 'INSERT INTO public.plg_conversation_messages (tenant_id, direction, body, status, metadata)
+             VALUES ($1, ''outbound'', $2, ''queued'', $3) RETURNING id'
+      INTO v_msg USING q.tenant_id, q.body,
+                       jsonb_build_object('source', 'plugin-notifications', 'queue_id', q.id, 'person_id', q.person_id);
+  EXCEPTION WHEN OTHERS THEN
+    RETURN public.notifications_send_to_log(p_queue_id);
+  END;
+  INSERT INTO public.plg_notifications_deliveries (tenant_id, unit_id, queue_id, channel, provider, provider_ref, delivered_at)
+  VALUES (q.tenant_id, q.unit_id, q.id, q.channel, 'conversations', v_msg::text, now())
+  RETURNING id INTO v_id;
+  RETURN jsonb_build_object('delivered', true, 'provider', 'conversations', 'delivery_id', v_id);
+END $_$;
+
+CREATE FUNCTION public.plg_notifications_on_fulfillment_completed(p_event jsonb) RETURNS jsonb
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO ''
+    AS $$
+DECLARE
+  v_tenant uuid := nullif(p_event ->> 'tenant_id', '')::uuid;
+  v_ful    uuid := nullif(p_event ->> 'subject_id', '')::uuid;
+  v_event  uuid := nullif(p_event ->> 'id', '')::uuid;
+  v_party  uuid; v_unit uuid; v_ref text; v_person text; v_queue uuid;
+BEGIN
+  IF v_tenant IS NULL OR v_ful IS NULL THEN
+    RAISE EXCEPTION 'fulfillment.completed carried no tenant or subject id' USING ERRCODE = '22023';
+  END IF;
+  IF to_regclass('public.fulfillments') IS NULL THEN
+    RETURN jsonb_build_object('skipped', 'fulfillments not on this pool');
+  END IF;
+
+  SELECT o.party_id, f.unit_id, coalesce(o.reference_number, o.id::text)
+    INTO v_party, v_unit, v_ref
+    FROM public.fulfillments f
+    LEFT JOIN public.orders o ON o.id = f.order_id
+   WHERE f.id = v_ful AND f.tenant_id = v_tenant;
+
+  IF v_party IS NULL THEN
+    RETURN jsonb_build_object('skipped', 'delivery has no recipient');
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM public.plg_notifications_templates t
+                  WHERE t.tenant_id = v_tenant AND t.key = 'fulfillment.completed' AND t.is_active) THEN
+    RETURN jsonb_build_object('skipped', 'tenant has no fulfillment.completed template');
+  END IF;
+
+  SELECT p.name INTO v_person FROM public.people p WHERE p.id = v_party;
+
+  v_queue := public.notifications_enqueue(
+    p_tenant_id    => v_tenant,
+    p_template_key => 'fulfillment.completed',
+    p_person_id    => v_party,
+    p_payload      => jsonb_build_object('customer_name', coalesce(v_person, ''), 'order_number', v_ref),
+    p_dedupe_key   => 'fulfillment.completed:' || coalesce(v_event::text, v_ful::text),
+    p_unit_id      => v_unit,
+    p_source_event_id => v_event);
+
+  RETURN jsonb_build_object('queued', v_queue, 'fulfillment_id', v_ful);
+END $$;
+
+CREATE FUNCTION public.plg_notifications_on_invoice_due(p_event jsonb) RETURNS jsonb
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO ''
+    AS $$
+DECLARE
+  v_tenant uuid := nullif(p_event ->> 'tenant_id', '')::uuid;
+  v_inst   uuid := nullif(p_event ->> 'subject_id', '')::uuid;
+  v_event  uuid := nullif(p_event ->> 'id', '')::uuid;
+  v_party  uuid; v_unit uuid; v_amount numeric; v_due date; v_person text; v_queue uuid;
+BEGIN
+  IF v_tenant IS NULL OR v_inst IS NULL THEN
+    RAISE EXCEPTION 'invoice.due_soon carried no tenant or subject id' USING ERRCODE = '22023';
+  END IF;
+  IF to_regclass('public.plg_financial_invoice_installments') IS NULL THEN
+    RETURN jsonb_build_object('skipped', 'financial not on this pool');
+  END IF;
+
+  SELECT f.counterparty_person_id, i.unit_id, i.amount, i.due_date
+    INTO v_party, v_unit, v_amount, v_due
+    FROM public.plg_financial_invoice_installments i
+    JOIN public.plg_financial_invoices f ON f.id = i.invoice_id
+   WHERE i.id = v_inst AND i.tenant_id = v_tenant;
+
+  IF v_party IS NULL THEN
+    RETURN jsonb_build_object('skipped', 'instalment has no counterparty');
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM public.plg_notifications_templates t
+                  WHERE t.tenant_id = v_tenant AND t.key = 'invoice.due_soon' AND t.is_active) THEN
+    RETURN jsonb_build_object('skipped', 'tenant has no invoice.due_soon template');
+  END IF;
+
+  SELECT p.name INTO v_person FROM public.people p WHERE p.id = v_party;
+
+  v_queue := public.notifications_enqueue(
+    p_tenant_id    => v_tenant,
+    p_template_key => 'invoice.due_soon',
+    p_person_id    => v_party,
+    p_payload      => jsonb_build_object('customer_name', coalesce(v_person, ''),
+                                         'amount', coalesce(v_amount, 0)::text,
+                                         'due_date', coalesce(v_due::text, '')),
+    p_dedupe_key   => 'invoice.due_soon:' || coalesce(v_event::text, v_inst::text),
+    p_unit_id      => v_unit,
+    p_source_event_id => v_event);
+
+  RETURN jsonb_build_object('queued', v_queue, 'installment_id', v_inst);
+END $$;
+
+CREATE FUNCTION public.plg_notifications_on_order_completed(p_event jsonb) RETURNS jsonb
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO ''
+    AS $$
+DECLARE
+  v_tenant  uuid := nullif(p_event ->> 'tenant_id', '')::uuid;
+  v_order   uuid := nullif(p_event ->> 'subject_id', '')::uuid;
+  v_event   uuid := nullif(p_event ->> 'id', '')::uuid;
+  v_row     public.orders%ROWTYPE;
+  v_person  text;
+  v_queue   uuid;
+BEGIN
+  IF v_tenant IS NULL OR v_order IS NULL THEN
+    RAISE EXCEPTION 'order.completed carried no tenant or subject id' USING ERRCODE = '22023';
+  END IF;
+
+  SELECT * INTO v_row FROM public.orders o WHERE o.id = v_order AND o.tenant_id = v_tenant;
+  IF v_row.id IS NULL THEN
+    RETURN jsonb_build_object('skipped', 'order not found');
+  END IF;
+  IF v_row.party_id IS NULL THEN
+    -- Nobody to tell is not a failure; it is a fact worth recording once.
+    RETURN jsonb_build_object('skipped', 'order has no party');
+  END IF;
+
+  -- A tenant that has not written the template does not get a message, and does
+  -- not get an error either: the engine is opt-in per tenant, by template.
+  IF NOT EXISTS (SELECT 1 FROM public.plg_notifications_templates t
+                  WHERE t.tenant_id = v_tenant AND t.key = 'order.completed' AND t.is_active) THEN
+    RETURN jsonb_build_object('skipped', 'tenant has no order.completed template');
+  END IF;
+
+  SELECT p.name INTO v_person FROM public.people p WHERE p.id = v_row.party_id;
+
+  v_queue := public.notifications_enqueue(
+    p_tenant_id    => v_tenant,
+    p_template_key => 'order.completed',
+    p_person_id    => v_row.party_id,
+    p_payload      => jsonb_build_object(
+                        'customer_name', coalesce(v_person, ''),
+                        'order_number',  coalesce(v_row.reference_number, v_row.id::text),
+                        'order_total',   coalesce(v_row.total, 0)::text,
+                        'channel',       coalesce(v_row.channel, 'balcao')),
+    p_dedupe_key   => 'order.completed:' || coalesce(v_event::text, v_order::text),
+    p_unit_id      => v_row.unit_id,
+    p_source_event_id => v_event);
+
+  RETURN jsonb_build_object('queued', v_queue, 'order_id', v_order);
+END $$;
+
+
+-- \u2500\u2500 constraint \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+ALTER TABLE ONLY public.plg_notifications_channels
+    ADD CONSTRAINT plg_notifications_channels_pkey PRIMARY KEY (id);
+
+ALTER TABLE ONLY public.plg_notifications_deliveries
+    ADD CONSTRAINT plg_notifications_deliveries_pkey PRIMARY KEY (id);
+
+ALTER TABLE ONLY public.plg_notifications_deliveries
+    ADD CONSTRAINT plg_notifications_deliveries_tenant_id_id_key UNIQUE (tenant_id, id);
+
+ALTER TABLE ONLY public.plg_notifications_preferences
+    ADD CONSTRAINT plg_notifications_preferences_pkey PRIMARY KEY (id);
+
+ALTER TABLE ONLY public.plg_notifications_preferences
+    ADD CONSTRAINT plg_notifications_preferences_tenant_id_id_key UNIQUE (tenant_id, id);
+
+ALTER TABLE ONLY public.plg_notifications_preferences
+    ADD CONSTRAINT plg_notifications_preferences_tenant_id_person_id_channel_key UNIQUE (tenant_id, person_id, channel);
+
+ALTER TABLE ONLY public.plg_notifications_queue
+    ADD CONSTRAINT plg_notifications_queue_pkey PRIMARY KEY (id);
+
+ALTER TABLE ONLY public.plg_notifications_queue
+    ADD CONSTRAINT plg_notifications_queue_tenant_id_id_key UNIQUE (tenant_id, id);
+
+ALTER TABLE ONLY public.plg_notifications_templates
+    ADD CONSTRAINT plg_notifications_templates_pkey PRIMARY KEY (id);
+
+ALTER TABLE ONLY public.plg_notifications_templates
+    ADD CONSTRAINT plg_notifications_templates_tenant_id_id_key UNIQUE (tenant_id, id);
+
+ALTER TABLE ONLY public.plg_notifications_templates
+    ADD CONSTRAINT plg_notifications_templates_tenant_id_key_channel_locale_key UNIQUE (tenant_id, key, channel, locale);
+
+
+-- \u2500\u2500 view \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE VIEW public.v_notification_queue WITH (security_invoker='true') AS
+ SELECT tenant_id,
+    template_key,
+    channel,
+    status,
+    count(*) AS messages,
+    min(scheduled_for) AS oldest,
+    count(*) FILTER (WHERE ((status = 'pending'::text) AND (next_attempt_at < now()))) AS overdue,
+    count(*) FILTER (WHERE (status = 'abandoned'::text)) AS abandoned,
+    count(*) FILTER (WHERE (status = 'blocked'::text)) AS blocked
+   FROM public.plg_notifications_queue q
+  GROUP BY tenant_id, template_key, channel, status;
+
+
+-- \u2500\u2500 index \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE UNIQUE INDEX plg_notifications_channels_uq ON public.plg_notifications_channels USING btree (COALESCE(tenant_id, '00000000-0000-0000-0000-000000000000'::uuid), channel);
+
+CREATE INDEX plg_notifications_deliveries_queue_idx ON public.plg_notifications_deliveries USING btree (queue_id, created_at DESC);
+
+CREATE UNIQUE INDEX plg_notifications_deliveries_ref_uq ON public.plg_notifications_deliveries USING btree (provider, provider_ref) WHERE (provider_ref IS NOT NULL);
+
+CREATE INDEX plg_notifications_deliveries_tenant_owner_idx ON public.plg_notifications_deliveries USING btree (tenant_id, owner_id) WHERE (owner_id IS NOT NULL);
+
+CREATE INDEX plg_notifications_deliveries_tenant_unit_idx ON public.plg_notifications_deliveries USING btree (tenant_id, unit_id);
+
+CREATE INDEX plg_notifications_preferences_tenant_owner_idx ON public.plg_notifications_preferences USING btree (tenant_id, owner_id) WHERE (owner_id IS NOT NULL);
+
+CREATE INDEX plg_notifications_preferences_tenant_unit_idx ON public.plg_notifications_preferences USING btree (tenant_id, unit_id);
+
+CREATE UNIQUE INDEX plg_notifications_queue_dedupe_uq ON public.plg_notifications_queue USING btree (tenant_id, dedupe_key) WHERE (dedupe_key IS NOT NULL);
+
+CREATE INDEX plg_notifications_queue_due_idx ON public.plg_notifications_queue USING btree (next_attempt_at) WHERE (status = 'pending'::text);
+
+CREATE INDEX plg_notifications_queue_person_idx ON public.plg_notifications_queue USING btree (tenant_id, person_id, created_at DESC);
+
+CREATE INDEX plg_notifications_queue_tenant_owner_idx ON public.plg_notifications_queue USING btree (tenant_id, owner_id) WHERE (owner_id IS NOT NULL);
+
+CREATE INDEX plg_notifications_queue_tenant_unit_idx ON public.plg_notifications_queue USING btree (tenant_id, unit_id);
+
+CREATE UNIQUE INDEX plg_notifications_templates_default_uq ON public.plg_notifications_templates USING btree (tenant_id, key, locale) WHERE is_default;
+
+CREATE INDEX plg_notifications_templates_key_idx ON public.plg_notifications_templates USING btree (tenant_id, key) WHERE is_active;
+
+CREATE INDEX plg_notifications_templates_tenant_owner_idx ON public.plg_notifications_templates USING btree (tenant_id, owner_id) WHERE (owner_id IS NOT NULL);
+
+CREATE INDEX plg_notifications_templates_tenant_unit_idx ON public.plg_notifications_templates USING btree (tenant_id, unit_id);
+
+
+-- \u2500\u2500 fk constraint \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+ALTER TABLE ONLY public.plg_notifications_channels
+    ADD CONSTRAINT plg_notifications_channels_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES public.tenants(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_notifications_deliveries
+    ADD CONSTRAINT plg_notifications_deliveries_owner_fk FOREIGN KEY (tenant_id, owner_id) REFERENCES app.memberships(tenant_id, user_id) ON DELETE SET NULL;
+
+ALTER TABLE ONLY public.plg_notifications_deliveries
+    ADD CONSTRAINT plg_notifications_deliveries_queue_id_fkey FOREIGN KEY (queue_id) REFERENCES public.plg_notifications_queue(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_notifications_deliveries
+    ADD CONSTRAINT plg_notifications_deliveries_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES public.tenants(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_notifications_deliveries
+    ADD CONSTRAINT plg_notifications_deliveries_unit_fk FOREIGN KEY (tenant_id, unit_id) REFERENCES app.units(tenant_id, id) ON DELETE SET NULL;
+
+ALTER TABLE ONLY public.plg_notifications_preferences
+    ADD CONSTRAINT plg_notifications_preferences_owner_fk FOREIGN KEY (tenant_id, owner_id) REFERENCES app.memberships(tenant_id, user_id) ON DELETE SET NULL;
+
+ALTER TABLE ONLY public.plg_notifications_preferences
+    ADD CONSTRAINT plg_notifications_preferences_person_id_fkey FOREIGN KEY (person_id) REFERENCES public.people(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_notifications_preferences
+    ADD CONSTRAINT plg_notifications_preferences_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES public.tenants(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_notifications_preferences
+    ADD CONSTRAINT plg_notifications_preferences_unit_fk FOREIGN KEY (tenant_id, unit_id) REFERENCES app.units(tenant_id, id) ON DELETE SET NULL;
+
+ALTER TABLE ONLY public.plg_notifications_queue
+    ADD CONSTRAINT plg_notifications_queue_owner_fk FOREIGN KEY (tenant_id, owner_id) REFERENCES app.memberships(tenant_id, user_id) ON DELETE SET NULL;
+
+ALTER TABLE ONLY public.plg_notifications_queue
+    ADD CONSTRAINT plg_notifications_queue_person_id_fkey FOREIGN KEY (person_id) REFERENCES public.people(id) ON DELETE SET NULL;
+
+ALTER TABLE ONLY public.plg_notifications_queue
+    ADD CONSTRAINT plg_notifications_queue_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES public.tenants(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_notifications_queue
+    ADD CONSTRAINT plg_notifications_queue_unit_fk FOREIGN KEY (tenant_id, unit_id) REFERENCES app.units(tenant_id, id) ON DELETE SET NULL;
+
+ALTER TABLE ONLY public.plg_notifications_templates
+    ADD CONSTRAINT plg_notifications_templates_owner_fk FOREIGN KEY (tenant_id, owner_id) REFERENCES app.memberships(tenant_id, user_id) ON DELETE SET NULL;
+
+ALTER TABLE ONLY public.plg_notifications_templates
+    ADD CONSTRAINT plg_notifications_templates_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES public.tenants(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_notifications_templates
+    ADD CONSTRAINT plg_notifications_templates_unit_fk FOREIGN KEY (tenant_id, unit_id) REFERENCES app.units(tenant_id, id) ON DELETE SET NULL;
+
+
+-- \u2500\u2500 table data \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+COPY public.plg_notifications_channels (id, tenant_id, channel, sender_function, is_active, created_at, updated_at) FROM stdin;
+4b84737c-7e5e-4f25-8936-ebf5b672435e	\\N	in_app	public.notifications_send_in_app	t	2026-09-04 15:03:11.486693+00	2026-09-04 15:03:11.486693+00
+0f2d8139-923b-4085-8e56-61da18fae029	\\N	email	public.notifications_send_to_log	t	2026-09-04 15:03:11.486693+00	2026-09-04 15:03:11.486693+00
+db491856-6402-472b-a88e-8264d1c5f3e6	\\N	sms	public.notifications_send_to_log	t	2026-09-04 15:03:11.486693+00	2026-09-04 15:03:11.486693+00
+d98d6015-8bb6-49eb-943a-7ca384703fa9	\\N	whatsapp	public.notifications_send_via_conversations	t	2026-09-04 15:03:11.486693+00	2026-09-04 15:03:11.486693+00
+c712737e-7edc-48f4-8a0f-5a5455a6c50e	\\N	push	public.notifications_send_to_log	t	2026-09-04 15:03:11.486693+00	2026-09-04 15:03:11.486693+00
+\\.
+
+
+-- \u2500\u2500 trigger \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE TRIGGER plg_notifications_channels_updated_at BEFORE UPDATE ON public.plg_notifications_channels FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
+
+CREATE TRIGGER plg_notifications_deliveries_updated_at BEFORE UPDATE ON public.plg_notifications_deliveries FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
+
+CREATE TRIGGER plg_notifications_preferences_updated_at BEFORE UPDATE ON public.plg_notifications_preferences FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
+
+CREATE TRIGGER plg_notifications_queue_updated_at BEFORE UPDATE ON public.plg_notifications_queue FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
+
+CREATE TRIGGER plg_notifications_templates_updated_at BEFORE UPDATE ON public.plg_notifications_templates FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
+
+
+-- \u2500\u2500 row security \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+ALTER TABLE public.plg_notifications_channels ENABLE ROW LEVEL SECURITY;
+
+ALTER TABLE public.plg_notifications_deliveries ENABLE ROW LEVEL SECURITY;
+
+ALTER TABLE public.plg_notifications_preferences ENABLE ROW LEVEL SECURITY;
+
+ALTER TABLE public.plg_notifications_queue ENABLE ROW LEVEL SECURITY;
+
+ALTER TABLE public.plg_notifications_templates ENABLE ROW LEVEL SECURITY;
+
+
+-- \u2500\u2500 policy \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE POLICY plg_notifications_channels_read ON public.plg_notifications_channels FOR SELECT TO authenticated USING (((tenant_id IS NULL) OR (tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids))));
+
+CREATE POLICY plg_notifications_deliveries_authz_delete ON public.plg_notifications_deliveries FOR DELETE TO authenticated USING (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_notifications_deliveries.unit_id) AS has_unit)) AND ((NOT ( SELECT app.owner_scoped('notifications.delivery'::text) AS owner_scoped)) OR (owner_id IS NULL) OR (owner_id = ( SELECT auth.uid() AS uid)) OR ( SELECT app.has_grant('notifications.delivery'::text, plg_notifications_deliveries.id, ARRAY['shared_with'::text]) AS has_grant) OR ( SELECT app.has_permission('notifications.read_all'::text, plg_notifications_deliveries.unit_id) AS has_permission)) AND ( SELECT app.has_permission('notifications.delete'::text, plg_notifications_deliveries.unit_id) AS has_permission)));
+
+CREATE POLICY plg_notifications_deliveries_authz_insert ON public.plg_notifications_deliveries FOR INSERT TO authenticated WITH CHECK (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_notifications_deliveries.unit_id) AS has_unit)) AND ( SELECT app.has_permission('notifications.create'::text, plg_notifications_deliveries.unit_id) AS has_permission)));
+
+CREATE POLICY plg_notifications_deliveries_authz_select ON public.plg_notifications_deliveries FOR SELECT TO authenticated USING (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_notifications_deliveries.unit_id) AS has_unit)) AND ((NOT ( SELECT app.owner_scoped('notifications.delivery'::text) AS owner_scoped)) OR (owner_id IS NULL) OR (owner_id = ( SELECT auth.uid() AS uid)) OR ( SELECT app.has_grant('notifications.delivery'::text, plg_notifications_deliveries.id, ARRAY['shared_with'::text]) AS has_grant) OR ( SELECT app.has_permission('notifications.read_all'::text, plg_notifications_deliveries.unit_id) AS has_permission)) AND ( SELECT app.has_permission('notifications.read'::text, plg_notifications_deliveries.unit_id) AS has_permission)));
+
+CREATE POLICY plg_notifications_deliveries_authz_update ON public.plg_notifications_deliveries FOR UPDATE TO authenticated USING (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_notifications_deliveries.unit_id) AS has_unit)) AND ((NOT ( SELECT app.owner_scoped('notifications.delivery'::text) AS owner_scoped)) OR (owner_id IS NULL) OR (owner_id = ( SELECT auth.uid() AS uid)) OR ( SELECT app.has_grant('notifications.delivery'::text, plg_notifications_deliveries.id, ARRAY['shared_with'::text]) AS has_grant) OR ( SELECT app.has_permission('notifications.read_all'::text, plg_notifications_deliveries.unit_id) AS has_permission)) AND ( SELECT app.has_permission('notifications.edit'::text, plg_notifications_deliveries.unit_id) AS has_permission))) WITH CHECK (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_notifications_deliveries.unit_id) AS has_unit)) AND ( SELECT app.has_permission('notifications.edit'::text, plg_notifications_deliveries.unit_id) AS has_permission)));
+
+CREATE POLICY plg_notifications_preferences_authz_delete ON public.plg_notifications_preferences FOR DELETE TO authenticated USING (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_notifications_preferences.unit_id) AS has_unit)) AND ((NOT ( SELECT app.owner_scoped('notifications.preference'::text) AS owner_scoped)) OR (owner_id IS NULL) OR (owner_id = ( SELECT auth.uid() AS uid)) OR ( SELECT app.has_grant('notifications.preference'::text, plg_notifications_preferences.id, ARRAY['shared_with'::text]) AS has_grant) OR ( SELECT app.has_permission('notifications.read_all'::text, plg_notifications_preferences.unit_id) AS has_permission)) AND ( SELECT app.has_permission('notifications.delete'::text, plg_notifications_preferences.unit_id) AS has_permission)));
+
+CREATE POLICY plg_notifications_preferences_authz_insert ON public.plg_notifications_preferences FOR INSERT TO authenticated WITH CHECK (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_notifications_preferences.unit_id) AS has_unit)) AND ( SELECT app.has_permission('notifications.create'::text, plg_notifications_preferences.unit_id) AS has_permission)));
+
+CREATE POLICY plg_notifications_preferences_authz_select ON public.plg_notifications_preferences FOR SELECT TO authenticated USING (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_notifications_preferences.unit_id) AS has_unit)) AND ((NOT ( SELECT app.owner_scoped('notifications.preference'::text) AS owner_scoped)) OR (owner_id IS NULL) OR (owner_id = ( SELECT auth.uid() AS uid)) OR ( SELECT app.has_grant('notifications.preference'::text, plg_notifications_preferences.id, ARRAY['shared_with'::text]) AS has_grant) OR ( SELECT app.has_permission('notifications.read_all'::text, plg_notifications_preferences.unit_id) AS has_permission)) AND ( SELECT app.has_permission('notifications.read'::text, plg_notifications_preferences.unit_id) AS has_permission)));
+
+CREATE POLICY plg_notifications_preferences_authz_update ON public.plg_notifications_preferences FOR UPDATE TO authenticated USING (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_notifications_preferences.unit_id) AS has_unit)) AND ((NOT ( SELECT app.owner_scoped('notifications.preference'::text) AS owner_scoped)) OR (owner_id IS NULL) OR (owner_id = ( SELECT auth.uid() AS uid)) OR ( SELECT app.has_grant('notifications.preference'::text, plg_notifications_preferences.id, ARRAY['shared_with'::text]) AS has_grant) OR ( SELECT app.has_permission('notifications.read_all'::text, plg_notifications_preferences.unit_id) AS has_permission)) AND ( SELECT app.has_permission('notifications.edit'::text, plg_notifications_preferences.unit_id) AS has_permission))) WITH CHECK (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_notifications_preferences.unit_id) AS has_unit)) AND ( SELECT app.has_permission('notifications.edit'::text, plg_notifications_preferences.unit_id) AS has_permission)));
+
+CREATE POLICY plg_notifications_queue_authz_delete ON public.plg_notifications_queue FOR DELETE TO authenticated USING (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_notifications_queue.unit_id) AS has_unit)) AND ((NOT ( SELECT app.owner_scoped('notifications.message'::text) AS owner_scoped)) OR (owner_id IS NULL) OR (owner_id = ( SELECT auth.uid() AS uid)) OR ( SELECT app.has_grant('notifications.message'::text, plg_notifications_queue.id, ARRAY['shared_with'::text]) AS has_grant) OR ( SELECT app.has_permission('notifications.read_all'::text, plg_notifications_queue.unit_id) AS has_permission)) AND ( SELECT app.has_permission('notifications.delete'::text, plg_notifications_queue.unit_id) AS has_permission)));
+
+CREATE POLICY plg_notifications_queue_authz_insert ON public.plg_notifications_queue FOR INSERT TO authenticated WITH CHECK (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_notifications_queue.unit_id) AS has_unit)) AND ( SELECT app.has_permission('notifications.create'::text, plg_notifications_queue.unit_id) AS has_permission)));
+
+CREATE POLICY plg_notifications_queue_authz_select ON public.plg_notifications_queue FOR SELECT TO authenticated USING (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_notifications_queue.unit_id) AS has_unit)) AND ((NOT ( SELECT app.owner_scoped('notifications.message'::text) AS owner_scoped)) OR (owner_id IS NULL) OR (owner_id = ( SELECT auth.uid() AS uid)) OR ( SELECT app.has_grant('notifications.message'::text, plg_notifications_queue.id, ARRAY['shared_with'::text]) AS has_grant) OR ( SELECT app.has_permission('notifications.read_all'::text, plg_notifications_queue.unit_id) AS has_permission)) AND ( SELECT app.has_permission('notifications.read'::text, plg_notifications_queue.unit_id) AS has_permission)));
+
+CREATE POLICY plg_notifications_queue_authz_update ON public.plg_notifications_queue FOR UPDATE TO authenticated USING (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_notifications_queue.unit_id) AS has_unit)) AND ((NOT ( SELECT app.owner_scoped('notifications.message'::text) AS owner_scoped)) OR (owner_id IS NULL) OR (owner_id = ( SELECT auth.uid() AS uid)) OR ( SELECT app.has_grant('notifications.message'::text, plg_notifications_queue.id, ARRAY['shared_with'::text]) AS has_grant) OR ( SELECT app.has_permission('notifications.read_all'::text, plg_notifications_queue.unit_id) AS has_permission)) AND ( SELECT app.has_permission('notifications.edit'::text, plg_notifications_queue.unit_id) AS has_permission))) WITH CHECK (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_notifications_queue.unit_id) AS has_unit)) AND ( SELECT app.has_permission('notifications.edit'::text, plg_notifications_queue.unit_id) AS has_permission)));
+
+CREATE POLICY plg_notifications_templates_authz_delete ON public.plg_notifications_templates FOR DELETE TO authenticated USING (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_notifications_templates.unit_id) AS has_unit)) AND ((NOT ( SELECT app.owner_scoped('notifications.template'::text) AS owner_scoped)) OR (owner_id IS NULL) OR (owner_id = ( SELECT auth.uid() AS uid)) OR ( SELECT app.has_grant('notifications.template'::text, plg_notifications_templates.id, ARRAY['shared_with'::text]) AS has_grant) OR ( SELECT app.has_permission('notifications.read_all'::text, plg_notifications_templates.unit_id) AS has_permission)) AND ( SELECT app.has_permission('notifications.delete'::text, plg_notifications_templates.unit_id) AS has_permission)));
+
+CREATE POLICY plg_notifications_templates_authz_insert ON public.plg_notifications_templates FOR INSERT TO authenticated WITH CHECK (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_notifications_templates.unit_id) AS has_unit)) AND ( SELECT app.has_permission('notifications.create'::text, plg_notifications_templates.unit_id) AS has_permission)));
+
+CREATE POLICY plg_notifications_templates_authz_select ON public.plg_notifications_templates FOR SELECT TO authenticated USING (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_notifications_templates.unit_id) AS has_unit)) AND ((NOT ( SELECT app.owner_scoped('notifications.template'::text) AS owner_scoped)) OR (owner_id IS NULL) OR (owner_id = ( SELECT auth.uid() AS uid)) OR ( SELECT app.has_grant('notifications.template'::text, plg_notifications_templates.id, ARRAY['shared_with'::text]) AS has_grant) OR ( SELECT app.has_permission('notifications.read_all'::text, plg_notifications_templates.unit_id) AS has_permission)) AND ( SELECT app.has_permission('notifications.read'::text, plg_notifications_templates.unit_id) AS has_permission)));
+
+CREATE POLICY plg_notifications_templates_authz_update ON public.plg_notifications_templates FOR UPDATE TO authenticated USING (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_notifications_templates.unit_id) AS has_unit)) AND ((NOT ( SELECT app.owner_scoped('notifications.template'::text) AS owner_scoped)) OR (owner_id IS NULL) OR (owner_id = ( SELECT auth.uid() AS uid)) OR ( SELECT app.has_grant('notifications.template'::text, plg_notifications_templates.id, ARRAY['shared_with'::text]) AS has_grant) OR ( SELECT app.has_permission('notifications.read_all'::text, plg_notifications_templates.unit_id) AS has_permission)) AND ( SELECT app.has_permission('notifications.edit'::text, plg_notifications_templates.unit_id) AS has_permission))) WITH CHECK (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_notifications_templates.unit_id) AS has_unit)) AND ( SELECT app.has_permission('notifications.edit'::text, plg_notifications_templates.unit_id) AS has_permission)));
+
+
+-- \u2500\u2500 acl \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+REVOKE ALL ON FUNCTION public.notifications_drain(p_limit integer) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.notifications_drain(p_limit integer) TO service_role;
+
+REVOKE ALL ON FUNCTION public.notifications_enqueue(p_tenant_id uuid, p_template_key text, p_person_id uuid, p_payload jsonb, p_dedupe_key text, p_scheduled_for timestamp with time zone, p_channel text, p_locale text, p_unit_id uuid, p_source_event_id uuid) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.notifications_enqueue(p_tenant_id uuid, p_template_key text, p_person_id uuid, p_payload jsonb, p_dedupe_key text, p_scheduled_for timestamp with time zone, p_channel text, p_locale text, p_unit_id uuid, p_source_event_id uuid) TO authenticated;
+GRANT ALL ON FUNCTION public.notifications_enqueue(p_tenant_id uuid, p_template_key text, p_person_id uuid, p_payload jsonb, p_dedupe_key text, p_scheduled_for timestamp with time zone, p_channel text, p_locale text, p_unit_id uuid, p_source_event_id uuid) TO service_role;
+
+GRANT ALL ON FUNCTION public.notifications_render(p_body text, p_payload jsonb) TO authenticated;
+GRANT ALL ON FUNCTION public.notifications_render(p_body text, p_payload jsonb) TO service_role;
+
+REVOKE ALL ON FUNCTION public.notifications_resolve_channel(p_tenant_id uuid, p_key text, p_person_id uuid, p_locale text, p_requested text, OUT channel text, OUT blocked_reason text) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.notifications_resolve_channel(p_tenant_id uuid, p_key text, p_person_id uuid, p_locale text, p_requested text, OUT channel text, OUT blocked_reason text) TO authenticated;
+GRANT ALL ON FUNCTION public.notifications_resolve_channel(p_tenant_id uuid, p_key text, p_person_id uuid, p_locale text, p_requested text, OUT channel text, OUT blocked_reason text) TO service_role;
+
+REVOKE ALL ON FUNCTION public.notifications_send_in_app(p_queue_id uuid) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.notifications_send_in_app(p_queue_id uuid) TO service_role;
+
+REVOKE ALL ON FUNCTION public.notifications_send_to_log(p_queue_id uuid) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.notifications_send_to_log(p_queue_id uuid) TO service_role;
+
+REVOKE ALL ON FUNCTION public.notifications_send_via_conversations(p_queue_id uuid) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.notifications_send_via_conversations(p_queue_id uuid) TO service_role;
+
+REVOKE ALL ON FUNCTION public.plg_notifications_on_fulfillment_completed(p_event jsonb) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.plg_notifications_on_fulfillment_completed(p_event jsonb) TO service_role;
+
+REVOKE ALL ON FUNCTION public.plg_notifications_on_invoice_due(p_event jsonb) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.plg_notifications_on_invoice_due(p_event jsonb) TO service_role;
+
+REVOKE ALL ON FUNCTION public.plg_notifications_on_order_completed(p_event jsonb) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.plg_notifications_on_order_completed(p_event jsonb) TO service_role;
+
+GRANT MAINTAIN ON TABLE public.plg_notifications_channels TO anon;
+GRANT SELECT,REFERENCES,TRIGGER,TRUNCATE,MAINTAIN ON TABLE public.plg_notifications_channels TO authenticated;
+GRANT ALL ON TABLE public.plg_notifications_channels TO service_role;
+
+GRANT MAINTAIN ON TABLE public.plg_notifications_deliveries TO anon;
+GRANT ALL ON TABLE public.plg_notifications_deliveries TO authenticated;
+GRANT ALL ON TABLE public.plg_notifications_deliveries TO service_role;
+
+GRANT MAINTAIN ON TABLE public.plg_notifications_preferences TO anon;
+GRANT ALL ON TABLE public.plg_notifications_preferences TO authenticated;
+GRANT ALL ON TABLE public.plg_notifications_preferences TO service_role;
+
+GRANT MAINTAIN ON TABLE public.plg_notifications_queue TO anon;
+GRANT ALL ON TABLE public.plg_notifications_queue TO authenticated;
+GRANT ALL ON TABLE public.plg_notifications_queue TO service_role;
+
+GRANT MAINTAIN ON TABLE public.plg_notifications_templates TO anon;
+GRANT ALL ON TABLE public.plg_notifications_templates TO authenticated;
+GRANT ALL ON TABLE public.plg_notifications_templates TO service_role;
+
+GRANT MAINTAIN ON TABLE public.v_notification_queue TO anon;
+GRANT ALL ON TABLE public.v_notification_queue TO authenticated;
+GRANT ALL ON TABLE public.v_notification_queue TO service_role;
+
+
+-- \u2500\u2500 comment \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+COMMENT ON FUNCTION public.notifications_drain(p_limit integer) IS 'Delivers what is due (PRD 03). A separate job from consume_event_log() on purpose: the provider is outside and the queue is ours, so a provider timing out costs a retry here and never holds up the event log.';
+
+COMMENT ON FUNCTION public.notifications_enqueue(p_tenant_id uuid, p_template_key text, p_person_id uuid, p_payload jsonb, p_dedupe_key text, p_scheduled_for timestamp with time zone, p_channel text, p_locale text, p_unit_id uuid, p_source_event_id uuid) IS 'Put a message in the queue (PRD 03). Refuses an unknown template, records a veto as a blocked row with its reason, and returns the EXISTING id when the dedupe key has been seen \u2014 so a redelivered event costs nothing.';
+
+COMMENT ON FUNCTION public.notifications_render(p_body text, p_payload jsonb) IS 'Substitutes {{variable}} from the payload (PRD 03). An unresolved variable becomes empty \u2014 shipping the placeholder itself to a customer is the failure this last line prevents.';
+
+COMMENT ON TABLE public.plg_notifications_channels IS 'Which function delivers a channel, per tenant, with a platform default when tenant_id is NULL (PRD 03). The drain calls it by name, so a provider is swapped by a row rather than by a migration.';
+
+COMMENT ON TABLE public.plg_notifications_deliveries IS 'What the provider said (PRD 03). Separate from the queue because the queue is ours and the provider is not: a provider failing must cost a retry here, never block public.consume_event_log().';
+
+COMMENT ON TABLE public.plg_notifications_preferences IS 'How a person wants to be reached (PRD 03). The recipient picks the channel; the sender only picks the message. \`opted_in = false\` is a veto the engine cannot override \u2014 plugin-conversations'' own opt-out is a second, absolute one.';
+
+COMMENT ON TABLE public.plg_notifications_queue IS 'What is waiting to go out, what went out and what was refused (PRD 03). Filled by event subscribers, never by a direct call \u2014 a notification only ANNOUNCES, so by the phase''s ownership rule it is an event. dedupe_key is what stops a redelivered event sending twice.';
+
+COMMENT ON COLUMN public.plg_notifications_queue.blocked_reason IS 'Why this message was not sent, in words (PRD 03 acceptance). An opt-out that produces no row at all is indistinguishable from a bug.';
+
+COMMENT ON TABLE public.plg_notifications_templates IS 'What a notification says, per key, channel and locale (PRD 03). Enqueuing with a key that has no template is refused \u2014 nothing leaves this system unnamed. \`is_default\` marks the channel used when the recipient has no preference.';
+
+COMMENT ON VIEW public.v_notification_queue IS 'The notification queue at a glance (PRD 03): what is waiting, what is overdue, what was abandoned and what was refused. Visible abandonment is only visible if there is somewhere to look.';
+
+
+-- \u2500\u2500 default privileges: restore \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- Put back, so the NEXT thing installed inherits what the chain had.
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT MAINTAIN ON TABLES TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT MAINTAIN ON TABLES TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$--
+-- PostgreSQL database dump complete
+--$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$--
+-- PostgreSQL database dump complete
+--$stmt$;
+END $dp$;
+`;
+var MIGRATIONS = [
+  { id: "000_baseline", sql: MIGRATION_000_BASELINE }
+];
+
+// src/index.ts
+function createNotificationsPlugin(options) {
+  registerTranslations(notificationsLocales);
+  return {
+    id: "notifications",
+    defaultAgentRole: "operations",
+    name: options?.name ?? "Notifica\xE7\xF5es",
+    icon: "Bell",
+    version: "1.0.0",
+    scope: options?.scope ?? "universal",
+    verticalId: options?.verticalId,
+    defaultEnabled: false,
+    dependencies: [],
+    // No screen yet, and that is the whole shape of this plugin: everything it
+    // does is reachable from SQL and from the subscriptions below. An admin
+    // surface is a follow-up — shipping the engine without one is deliberate,
+    // because a form that cannot send is what this phase exists to stop.
+    navigation: [],
+    routes: [],
+    // A notification only ANNOUNCES — it writes nothing another module owns — so
+    // by the phase's ownership rule it reacts to events rather than being called.
+    subscribesTo: [
+      {
+        event: "order.completed",
+        handler: "plg_notifications_on_order_completed",
+        description: "A completed sale tells the customer, if the tenant wrote the template",
+        maxAttempts: 5
+      },
+      {
+        event: "fulfillment.completed",
+        handler: "plg_notifications_on_fulfillment_completed",
+        description: "A delivery tells the customer it left",
+        maxAttempts: 5
+      },
+      {
+        event: "invoice.due_soon",
+        handler: "plg_notifications_on_invoice_due",
+        description: "The dunning leg: an instalment coming due tells the payer",
+        maxAttempts: 5
+      }
+    ],
+    migrations: MIGRATIONS.map((m) => ({
+      id: `notifications-${m.id}`,
+      version: "1.0.0",
+      sql: m.sql,
+      description: m.id
+    })),
+    declaredFeatures: [{ id: "notifications", label: "Notifica\xE7\xF5es", group: "Notifica\xE7\xF5es" }],
+    locales: notificationsLocales
+  };
+}
+
+export { createNotificationsPlugin };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map