@fayz-ai/plugin-reports 0.12.3 → 0.13.1

package/dist/index.js

@@ -1,7 +1,11 @@
-import { expandBagColumns, reportColumnsToTanstack, formatValuePlain } from './chunk-4QIHTUXD.js';
+import { exportToExcel } from './chunk-VQJKOO2B.js';
+export { exportToExcel } from './chunk-VQJKOO2B.js';
+import { exportToPdf } from './chunk-BPTKNPXQ.js';
+export { exportToPdf } from './chunk-BPTKNPXQ.js';
+import { expandBagColumns, formatValuePlain, reportColumnsToTanstack } from './chunk-4QIHTUXD.js';
 import * as React10 from 'react';
 import React10__default, { useState, useEffect } from 'react';
-import { usePluginRuntime, getAnalyticsCards, useTranslation, registerTranslations, createSafeDataProvider, getSupabaseClientOptional, hashRouterAdapter, exportCSV } from '@fayz-ai/core';
+import { usePluginRuntime, getAnalyticsCards, exportCSV, useTranslation, registerTranslations, createSafeDataProvider, getSupabaseClientOptional, hashRouterAdapter } from '@fayz-ai/core';
 import { useOrganizationStore, useShellRailAvailable, useContextualNav, askAI, useAgentSurface, QuickActionsButton, AssistantInvite, RightRailPage } from '@fayz-ai/admin';
 import { AnalyticsContextProvider, useModuleLayout, ModulePage, collectFilters, AnalyticsControls, AnalyticsGrid, Card, FilterChip, DataTable, Button, SubpageHeader, useAnalyticsCard, useAnalyticsCardRows, ToolbarAction, PageHeaderActions, Select, SelectTrigger, SelectValue, SelectContent, SelectItem, useAnalyticsContext, AnalyticsCard, Dropdown, DropdownTrigger, DropdownContent, DropdownItem, Badge, getLucideIcon, Input, Checkbox } from '@fayz-ai/ui';
 import { jsx, jsxs, Fragment } from 'react/jsx-runtime';
@@ -170,10 +174,10 @@ function searchColumns(card) {
 function camelToSnake(s) {
   return s.replace(/[A-Z]/g, (c) => `_${c.toLowerCase()}`);
 }
-async function selectFromView(card, state, db, tenantId, reserved) {
+async function selectFromView(card, state, db2, tenantId, reserved) {
   const { source } = card.query;
   const size = state.pageSize || 50;
-  let q = db.from(source.name).select("*", { count: "exact" });
+  let q = db2.from(source.name).select("*", { count: "exact" });
   if (tenantId) q = q.eq(source.tenantColumn ?? "tenant_id", tenantId);
   const snapshot = card.query.dateColumn === null;
   const dateCol = card.query.dateColumn ?? "created_at";
@@ -669,6 +673,695 @@ var reportsLocales = {
   "pt-BR": ptBR
 };
 
+// src/migrations/index.ts
+var MIGRATION_000_BASELINE = `-- ============================================================================
+-- plugins/plugin-reports/src/migrations/000_baseline.sql \u2014 what installing this provisions, as one file.
+--
+-- GENERATED by scripts/emit-unit-baselines.mjs (#338). Do not edit by hand:
+-- change the schema, regenerate, and let scripts/check-chain-equivalence.mjs
+-- prove the result still matches.
+--
+-- This replaced 3 migration files. They are kept, unapplied, in
+-- migrations.archive/ \u2014 a year of decisions is worth reading even when it is no
+-- longer worth replaying.
+--
+-- Object order is fixed rather than dependency-sorted: schemas, types,
+-- sequences, tables, defaults, functions, constraints, views, indexes, foreign
+-- keys, triggers, row security, policies, grants. Dependencies BETWEEN units
+-- are carried by the order packages/db/chain.json declares.
+-- ============================================================================
+
+-- A LANGUAGE sql function binds its body at CREATE time, and 570 functions
+-- sorted by name are not sorted by who calls whom. This is what lets them load
+-- in any order; every body is still compiled on first call, so a genuinely
+-- broken reference surfaces then rather than never. Session-scoped.
+SET check_function_bodies = false;
+
+
+
+-- \u2500\u2500 default privileges: reset \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- Cleared BEFORE anything is created, so every object below gets the ACL the
+-- dump describes rather than the image's defaults on top of it. Restored at
+-- the end of this file.
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+
+-- \u2500\u2500 table \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE TABLE public.plg_reports_definitions (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid,
+    unit_id uuid,
+    key text NOT NULL,
+    version integer DEFAULT 1 NOT NULL,
+    title text NOT NULL,
+    description text,
+    module text NOT NULL,
+    source_view text NOT NULL,
+    params jsonb DEFAULT '[]'::jsonb NOT NULL,
+    columns jsonb DEFAULT '[]'::jsonb NOT NULL,
+    default_order_by text,
+    required_permission text NOT NULL,
+    is_active boolean DEFAULT true NOT NULL,
+    metadata jsonb DEFAULT '{}'::jsonb NOT NULL,
+    created_by uuid,
+    owner_id uuid,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT plg_reports_definitions_required_permission_check CHECK ((btrim(required_permission) <> ''::text)),
+    CONSTRAINT plg_reports_definitions_version_check CHECK ((version >= 1))
+);
+
+ALTER TABLE ONLY public.plg_reports_definitions FORCE ROW LEVEL SECURITY;
+
+CREATE TABLE public.plg_reports_runs (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    unit_id uuid,
+    definition_key text NOT NULL,
+    definition_version integer DEFAULT 1 NOT NULL,
+    params jsonb DEFAULT '{}'::jsonb NOT NULL,
+    requested_by uuid,
+    row_count bigint,
+    duration_ms integer,
+    status text DEFAULT 'ok'::text NOT NULL,
+    error text,
+    format text,
+    owner_id uuid,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT plg_reports_runs_status_check CHECK ((status = ANY (ARRAY['ok'::text, 'refused'::text, 'error'::text])))
+);
+
+ALTER TABLE ONLY public.plg_reports_runs FORCE ROW LEVEL SECURITY;
+
+CREATE TABLE public.plg_reports_schedules (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    unit_id uuid,
+    definition_key text NOT NULL,
+    cron text NOT NULL,
+    params jsonb DEFAULT '{}'::jsonb NOT NULL,
+    recipients jsonb DEFAULT '[]'::jsonb NOT NULL,
+    format text DEFAULT 'csv'::text NOT NULL,
+    template_key text DEFAULT 'report.delivered'::text NOT NULL,
+    is_active boolean DEFAULT true NOT NULL,
+    last_run_at timestamp with time zone,
+    next_run_at timestamp with time zone,
+    owner_id uuid,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT plg_reports_schedules_format_check CHECK ((format = ANY (ARRAY['csv'::text, 'xlsx'::text, 'pdf'::text])))
+);
+
+ALTER TABLE ONLY public.plg_reports_schedules FORCE ROW LEVEL SECURITY;
+
+
+-- \u2500\u2500 function \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE FUNCTION public.reports_definition(p_key text, p_tenant uuid DEFAULT NULL::uuid) RETURNS public.plg_reports_definitions
+    LANGUAGE sql STABLE SECURITY DEFINER
+    SET search_path TO ''
+    AS $$
+  SELECT d.* FROM public.plg_reports_definitions d
+   WHERE d.key = p_key AND d.is_active
+     AND (d.tenant_id = coalesce(p_tenant, app.current_tenant_id()) OR d.tenant_id IS NULL)
+   -- A tenant's own definition beats the platform one, and the newest version
+   -- beats an older one.
+   ORDER BY (d.tenant_id IS NOT NULL) DESC, d.version DESC
+   LIMIT 1
+$$;
+
+CREATE FUNCTION public.reports_deliver_due(p_limit integer DEFAULT 50) RETURNS jsonb
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO ''
+    AS $$
+DECLARE
+  s public.plg_reports_schedules%ROWTYPE;
+  v_recipient jsonb;
+  v_res jsonb;
+  v_sent integer := 0;
+  v_runs integer := 0;
+BEGIN
+  IF to_regprocedure('public.notifications_enqueue(uuid, text, uuid, jsonb, text, timestamptz, text, text, uuid, uuid)') IS NULL THEN
+    RETURN jsonb_build_object('skipped', 'plugin-notifications is not installed');
+  END IF;
+
+  FOR s IN
+    SELECT * FROM public.plg_reports_schedules
+     WHERE is_active AND (next_run_at IS NULL OR next_run_at <= now())
+     ORDER BY next_run_at NULLS FIRST
+     LIMIT greatest(p_limit, 0)
+     FOR UPDATE SKIP LOCKED
+  LOOP
+    v_runs := v_runs + 1;
+    FOR v_recipient IN SELECT * FROM jsonb_array_elements(coalesce(s.recipients, '[]'::jsonb)) LOOP
+      -- The campaign rule applies to a report too: this ENQUEUES, it does not
+      -- send. One engine, one queue, one place a delivery can be retried.
+      v_res := to_jsonb(public.notifications_enqueue(
+        p_tenant_id    => s.tenant_id,
+        p_template_key => s.template_key,
+        p_person_id    => nullif(v_recipient ->> 'person_id', '')::uuid,
+        p_payload      => jsonb_build_object('report_key', s.definition_key, 'format', s.format),
+        p_dedupe_key   => 'report:' || s.id::text || ':' || to_char(now(), 'YYYY-MM-DD') || ':' || coalesce(v_recipient ->> 'person_id', ''),
+        p_unit_id      => s.unit_id));
+      v_sent := v_sent + 1;
+    END LOOP;
+
+    UPDATE public.plg_reports_schedules
+       SET last_run_at = now(),
+           next_run_at = now() + interval '1 day'
+     WHERE id = s.id;
+  END LOOP;
+
+  RETURN jsonb_build_object('schedules', v_runs, 'queued', v_sent);
+END $$;
+
+CREATE FUNCTION public.reports_ensure_delivery_template(p_tenant uuid, p_channel text DEFAULT 'email'::text) RETURNS uuid
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO ''
+    AS $$
+DECLARE v_id uuid;
+BEGIN
+  IF to_regclass('public.plg_notifications_templates') IS NULL THEN
+    RAISE EXCEPTION 'reports_ensure_delivery_template: plugin-notifications is not installed' USING ERRCODE = '0A000';
+  END IF;
+  INSERT INTO public.plg_notifications_templates (tenant_id, key, channel, locale, subject, body, is_default, purpose)
+  VALUES (p_tenant, 'report.delivered', p_channel, 'pt-BR',
+          'Seu relat\xF3rio est\xE1 pronto',
+          'O relat\xF3rio {{report_key}} foi gerado em {{format}} e est\xE1 dispon\xEDvel.', true, 'transactional')
+  ON CONFLICT (tenant_id, key, channel, locale) DO UPDATE SET is_active = true
+  RETURNING id INTO v_id;
+  RETURN v_id;
+END $$;
+
+CREATE FUNCTION public.reports_run(p_key text, p_params jsonb DEFAULT '{}'::jsonb, p_limit integer DEFAULT 1000, p_offset integer DEFAULT 0, p_format text DEFAULT NULL::text) RETURNS jsonb
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO ''
+    AS $$
+DECLARE
+  v_tenant  uuid := app.current_tenant_id();
+  v_def     public.plg_reports_definitions%ROWTYPE;
+  v_sql     text;
+  v_where   text := '';
+  v_param   jsonb;
+  v_name    text;
+  v_value   text;
+  v_rows    jsonb;
+  v_count   bigint := 0;
+  v_start   timestamptz := clock_timestamp();
+  v_has_unit boolean;
+BEGIN
+  IF v_tenant IS NULL THEN
+    RAISE EXCEPTION 'reports_run: no active tenant' USING ERRCODE = '42501';
+  END IF;
+
+  v_def := public.reports_definition(p_key, v_tenant);
+  IF v_def.id IS NULL THEN
+    RAISE EXCEPTION 'reports_run: no active report called %', p_key USING ERRCODE = 'P0002';
+  END IF;
+
+  -- \u2500\u2500 refuse BEFORE the query, not after the rows \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  --
+  -- The refusal is RETURNED rather than raised, and the reason is mechanical:
+  -- raising rolls the statement back, taking the run record with it, and a
+  -- refusal nobody can see afterwards is the thing this history exists for.
+  -- No rows are read either way \u2014 which is what "refuse before the query" means
+  -- \u2014 and a caller that ignores \`status\` still gets nothing.
+  IF NOT (select app.has_permission(v_def.required_permission, NULL)) THEN
+    INSERT INTO public.plg_reports_runs (tenant_id, definition_key, definition_version, params, requested_by, status, error)
+    VALUES (v_tenant, p_key, v_def.version, coalesce(p_params, '{}'::jsonb), auth.uid(), 'refused',
+            format('%s is required', v_def.required_permission));
+    RETURN jsonb_build_object(
+      'key', p_key, 'version', v_def.version, 'title', v_def.title,
+      'status', 'refused', 'required_permission', v_def.required_permission,
+      'columns', '[]'::jsonb, 'rows', '[]'::jsonb, 'row_count', 0);
+  END IF;
+
+  -- \u2500\u2500 scope the engine injects, and no definition can switch off \u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  v_where := format('%I = %L', 'tenant_id', v_tenant);
+
+  SELECT EXISTS (
+    SELECT 1 FROM information_schema.columns
+     WHERE table_schema = 'public' AND table_name = v_def.source_view AND column_name = 'unit_id')
+    INTO v_has_unit;
+  IF v_has_unit THEN
+    v_where := v_where || ' AND (unit_id IS NULL OR (select app.has_unit(unit_id)))';
+  END IF;
+
+  -- \u2500\u2500 the declared parameters, and only those \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  FOR v_param IN SELECT * FROM jsonb_array_elements(coalesce(v_def.params, '[]'::jsonb)) LOOP
+    v_name  := v_param ->> 'name';
+    v_value := coalesce(p_params ->> v_name, v_param ->> 'default');
+    IF v_value IS NULL THEN
+      IF coalesce((v_param ->> 'required')::boolean, false) THEN
+        RAISE EXCEPTION 'reports_run: % requires the parameter %', p_key, v_name USING ERRCODE = '22023';
+      END IF;
+      CONTINUE;
+    END IF;
+    IF NOT EXISTS (SELECT 1 FROM information_schema.columns
+                    WHERE table_schema = 'public' AND table_name = v_def.source_view
+                      AND column_name = coalesce(v_param ->> 'column', v_name)) THEN
+      RAISE EXCEPTION 'reports_run: parameter % has no column on %', v_name, v_def.source_view USING ERRCODE = '42703';
+    END IF;
+    v_where := v_where || format(' AND %I %s %L',
+      coalesce(v_param ->> 'column', v_name),
+      CASE v_param ->> 'operator' WHEN '>=' THEN '>=' WHEN '<=' THEN '<=' WHEN '>' THEN '>' WHEN '<' THEN '<' WHEN 'ilike' THEN 'ILIKE' ELSE '=' END,
+      v_value);
+  END LOOP;
+
+  -- A parameter the caller sent that the definition never declared is refused
+  -- rather than ignored: silently dropping a filter shows the wrong number.
+  IF p_params IS NOT NULL AND jsonb_typeof(p_params) = 'object' THEN
+    FOR v_name IN SELECT key FROM jsonb_each_text(p_params) LOOP
+      IF NOT EXISTS (SELECT 1 FROM jsonb_array_elements(coalesce(v_def.params, '[]'::jsonb)) d WHERE d ->> 'name' = v_name) THEN
+        RAISE EXCEPTION 'reports_run: % does not declare a parameter called %', p_key, v_name USING ERRCODE = '22023';
+      END IF;
+    END LOOP;
+  END IF;
+
+  v_sql := format('SELECT coalesce(jsonb_agg(t), ''[]''::jsonb), count(*) FROM (SELECT * FROM public.%I WHERE %s %s LIMIT %s OFFSET %s) t',
+                  v_def.source_view, v_where,
+                  CASE WHEN v_def.default_order_by IS NULL THEN '' ELSE 'ORDER BY ' || quote_ident(v_def.default_order_by) END,
+                  greatest(coalesce(p_limit, 1000), 0), greatest(coalesce(p_offset, 0), 0));
+
+  EXECUTE v_sql INTO v_rows, v_count;
+
+  INSERT INTO public.plg_reports_runs (tenant_id, definition_key, definition_version, params, requested_by,
+                                       row_count, duration_ms, status, format)
+  VALUES (v_tenant, p_key, v_def.version, coalesce(p_params, '{}'::jsonb), auth.uid(),
+          v_count, (extract(epoch FROM clock_timestamp() - v_start) * 1000)::integer, 'ok', p_format);
+
+  RETURN jsonb_build_object(
+    'key', p_key, 'version', v_def.version, 'title', v_def.title,
+    'status', 'ok', 'columns', v_def.columns, 'rows', v_rows, 'row_count', v_count);
+END $$;
+
+CREATE FUNCTION public.trg_plg_reports_definitions_source() RETURNS trigger
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO ''
+    AS $_$
+DECLARE v_kind char;
+BEGIN
+  IF NEW.source_view !~ '^[a-z_][a-z0-9_]*$' THEN
+    RAISE EXCEPTION 'plg_reports_definitions: source_view % is not a bare relation name in public', NEW.source_view
+      USING ERRCODE = '22023';
+  END IF;
+
+  SELECT c.relkind INTO v_kind
+    FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace
+   WHERE n.nspname = 'public' AND c.relname = NEW.source_view;
+
+  IF v_kind IS NULL THEN
+    RAISE EXCEPTION 'plg_reports_definitions: public.% does not exist', NEW.source_view USING ERRCODE = '42P01';
+  END IF;
+
+  -- A view or a materialized view is a read model by construction. A TABLE is
+  -- only allowed when its name says so \u2014 that is the \`plg_<x>_rep_*\` convention
+  -- Phase 1 established, and it is checked rather than trusted.
+  IF v_kind NOT IN ('v', 'm') AND NEW.source_view !~ '^plg_[a-z0-9_]+_rep_' THEN
+    RAISE EXCEPTION 'plg_reports_definitions: public.% is a business table, not a read model', NEW.source_view
+      USING ERRCODE = '23514',
+            HINT = 'Point the definition at a view or at a plg_<plugin>_rep_* read model. Reporting off a business table is how a report starts holding a schema still.';
+  END IF;
+  RETURN NEW;
+END $_$;
+
+
+-- \u2500\u2500 constraint \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+ALTER TABLE ONLY public.plg_reports_definitions
+    ADD CONSTRAINT plg_reports_definitions_pkey PRIMARY KEY (id);
+
+ALTER TABLE ONLY public.plg_reports_definitions
+    ADD CONSTRAINT plg_reports_definitions_tenant_id_id_key UNIQUE (tenant_id, id);
+
+ALTER TABLE ONLY public.plg_reports_runs
+    ADD CONSTRAINT plg_reports_runs_pkey PRIMARY KEY (id);
+
+ALTER TABLE ONLY public.plg_reports_runs
+    ADD CONSTRAINT plg_reports_runs_tenant_id_id_key UNIQUE (tenant_id, id);
+
+ALTER TABLE ONLY public.plg_reports_schedules
+    ADD CONSTRAINT plg_reports_schedules_pkey PRIMARY KEY (id);
+
+ALTER TABLE ONLY public.plg_reports_schedules
+    ADD CONSTRAINT plg_reports_schedules_tenant_id_id_key UNIQUE (tenant_id, id);
+
+
+-- \u2500\u2500 index \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE UNIQUE INDEX plg_reports_definitions_key_uq ON public.plg_reports_definitions USING btree (COALESCE(tenant_id, '00000000-0000-0000-0000-000000000000'::uuid), key, version);
+
+CREATE INDEX plg_reports_definitions_module_idx ON public.plg_reports_definitions USING btree (module) WHERE is_active;
+
+CREATE INDEX plg_reports_definitions_tenant_owner_idx ON public.plg_reports_definitions USING btree (tenant_id, owner_id) WHERE (owner_id IS NOT NULL);
+
+CREATE INDEX plg_reports_definitions_tenant_unit_idx ON public.plg_reports_definitions USING btree (tenant_id, unit_id);
+
+CREATE INDEX plg_reports_runs_key_idx ON public.plg_reports_runs USING btree (tenant_id, definition_key, created_at DESC);
+
+CREATE INDEX plg_reports_runs_tenant_owner_idx ON public.plg_reports_runs USING btree (tenant_id, owner_id) WHERE (owner_id IS NOT NULL);
+
+CREATE INDEX plg_reports_runs_tenant_unit_idx ON public.plg_reports_runs USING btree (tenant_id, unit_id);
+
+CREATE INDEX plg_reports_schedules_due_idx ON public.plg_reports_schedules USING btree (next_run_at) WHERE is_active;
+
+CREATE INDEX plg_reports_schedules_tenant_owner_idx ON public.plg_reports_schedules USING btree (tenant_id, owner_id) WHERE (owner_id IS NOT NULL);
+
+CREATE INDEX plg_reports_schedules_tenant_unit_idx ON public.plg_reports_schedules USING btree (tenant_id, unit_id);
+
+
+-- \u2500\u2500 fk constraint \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+ALTER TABLE ONLY public.plg_reports_definitions
+    ADD CONSTRAINT plg_reports_definitions_owner_fk FOREIGN KEY (tenant_id, owner_id) REFERENCES app.memberships(tenant_id, user_id) ON DELETE SET NULL;
+
+ALTER TABLE ONLY public.plg_reports_definitions
+    ADD CONSTRAINT plg_reports_definitions_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES public.tenants(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_reports_definitions
+    ADD CONSTRAINT plg_reports_definitions_unit_fk FOREIGN KEY (tenant_id, unit_id) REFERENCES app.units(tenant_id, id) ON DELETE SET NULL;
+
+ALTER TABLE ONLY public.plg_reports_runs
+    ADD CONSTRAINT plg_reports_runs_owner_fk FOREIGN KEY (tenant_id, owner_id) REFERENCES app.memberships(tenant_id, user_id) ON DELETE SET NULL;
+
+ALTER TABLE ONLY public.plg_reports_runs
+    ADD CONSTRAINT plg_reports_runs_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES public.tenants(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_reports_runs
+    ADD CONSTRAINT plg_reports_runs_unit_fk FOREIGN KEY (tenant_id, unit_id) REFERENCES app.units(tenant_id, id) ON DELETE SET NULL;
+
+ALTER TABLE ONLY public.plg_reports_schedules
+    ADD CONSTRAINT plg_reports_schedules_owner_fk FOREIGN KEY (tenant_id, owner_id) REFERENCES app.memberships(tenant_id, user_id) ON DELETE SET NULL;
+
+ALTER TABLE ONLY public.plg_reports_schedules
+    ADD CONSTRAINT plg_reports_schedules_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES public.tenants(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_reports_schedules
+    ADD CONSTRAINT plg_reports_schedules_unit_fk FOREIGN KEY (tenant_id, unit_id) REFERENCES app.units(tenant_id, id) ON DELETE SET NULL;
+
+
+-- \u2500\u2500 table data \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+COPY public.plg_reports_definitions (id, tenant_id, unit_id, key, version, title, description, module, source_view, params, columns, default_order_by, required_permission, is_active, metadata, created_by, owner_id, created_at, updated_at) FROM stdin;
+b9bdb96e-2219-4bea-a83d-be54e28c4bda	\\N	\\N	orders.sales	1	Vendas	Every sale, whichever door it came through \u2014 the query the order vocabulary made possible.	orders	v_sales	[{"name": "channel", "column": "channel"}, {"name": "status", "column": "status"}, {"name": "from", "column": "created_at", "operator": ">="}, {"name": "to", "column": "created_at", "operator": "<="}]	[]	created_at	orders.read	t	{}	\\N	\\N	2026-09-04 15:03:27.267053+00	2026-09-04 15:03:27.267053+00
+706d0d78-193c-4abe-8828-5e00d719d155	\\N	\\N	orders.fulfillment	1	Entregas pendentes	Ordered against delivered, per line. A positive pending is what a boolean could never describe.	orders	v_order_fulfillment	[{"name": "state", "column": "state"}]	[]	\\N	orders.read	t	{}	\\N	\\N	2026-09-04 15:03:27.267053+00	2026-09-04 15:03:27.267053+00
+6e27d897-55d8-4f39-b963-b5cb3121069d	\\N	\\N	financial.receivables	1	Contas a receber	Instalments and what is still owed on them, straight from the allocations.	financial	v_financial_installment_balances	[{"name": "status", "column": "status"}, {"name": "due_from", "column": "due_date", "operator": ">="}, {"name": "due_to", "column": "due_date", "operator": "<="}]	[]	due_date	financial.read	t	{}	\\N	\\N	2026-09-04 15:03:27.267053+00	2026-09-04 15:03:27.267053+00
+66d7f336-fff1-40ea-b754-6b158f1b0dea	\\N	\\N	financial.uninvoiced	1	Vendas sem t\xEDtulo	Sales that produced no invoice. Empty is the bar this phase closes on.	financial	v_orders_sem_invoice	[{"name": "kind", "column": "kind"}]	[]	created_at	financial.read	t	{}	\\N	\\N	2026-09-04 15:03:27.267053+00	2026-09-04 15:03:27.267053+00
+a5a3ffab-e6e1-46ad-942f-f36582b4e126	\\N	\\N	inventory.balances	1	Saldo de estoque	The balance, from the one ledger that owns it.	inventory	v_inventory_balances	[]	[]	\\N	inventory.read	t	{}	\\N	\\N	2026-09-04 15:03:27.267053+00	2026-09-04 15:03:27.267053+00
+a2d3191e-5a8d-4e03-892f-0c9573675ea5	\\N	\\N	notifications.queue	1	Fila de notifica\xE7\xF5es	What is waiting, what is overdue, what was abandoned and what was refused.	notifications	v_notification_queue	[{"name": "status", "column": "status"}, {"name": "channel", "column": "channel"}]	[]	\\N	notifications.read	t	{}	\\N	\\N	2026-09-04 15:03:27.267053+00	2026-09-04 15:03:27.267053+00
+c616ae83-b861-41fb-959a-bbb85431ed77	\\N	\\N	agenda.appointments	1	Agendamentos	The calendar as a table, with the Venda and the payment state each booking carries.	agenda	v_appointments	[{"name": "status", "column": "status"}, {"name": "from", "column": "starts_at", "operator": ">="}, {"name": "to", "column": "starts_at", "operator": "<="}]	[]	starts_at	agenda.read	t	{}	\\N	\\N	2026-09-04 15:03:27.267053+00	2026-09-04 15:03:27.267053+00
+5af4a8c8-903b-4ea6-8829-98877b017883	\\N	\\N	crm.funnel	1	Funil	The funnel over plg_crm_deals, with won_at and lost_at \u2014 which is what makes a cycle length measurable.	crm	v_deals	[{"name": "status", "column": "status"}, {"name": "stage", "column": "stage_name"}]	[]	created_at	crm.pipeline.read	t	{}	\\N	\\N	2026-09-04 15:03:27.267053+00	2026-09-04 15:03:27.267053+00
+9143ce67-ecaa-46a3-8028-7c354c34f301	\\N	\\N	marketing.campaigns	1	Campanhas	Reach, delivery and conversion per campaign \u2014 the metric comes from here, never from a counter on the campaign.	marketing	v_marketing_campaign_metrics	[{"name": "status", "column": "status"}]	[]	\\N	marketing.read	t	{}	\\N	\\N	2026-09-04 15:03:27.267053+00	2026-09-04 15:03:27.267053+00
+\\.
+
+
+-- \u2500\u2500 trigger \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE TRIGGER plg_reports_definitions_source BEFORE INSERT OR UPDATE OF source_view ON public.plg_reports_definitions FOR EACH ROW EXECUTE FUNCTION public.trg_plg_reports_definitions_source();
+
+CREATE TRIGGER plg_reports_definitions_updated_at BEFORE UPDATE ON public.plg_reports_definitions FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
+
+CREATE TRIGGER plg_reports_runs_updated_at BEFORE UPDATE ON public.plg_reports_runs FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
+
+CREATE TRIGGER plg_reports_schedules_updated_at BEFORE UPDATE ON public.plg_reports_schedules FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
+
+
+-- \u2500\u2500 row security \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+ALTER TABLE public.plg_reports_definitions ENABLE ROW LEVEL SECURITY;
+
+ALTER TABLE public.plg_reports_runs ENABLE ROW LEVEL SECURITY;
+
+ALTER TABLE public.plg_reports_schedules ENABLE ROW LEVEL SECURITY;
+
+
+-- \u2500\u2500 policy \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE POLICY plg_reports_definitions_authz_delete ON public.plg_reports_definitions FOR DELETE TO authenticated USING (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_reports_definitions.unit_id) AS has_unit)) AND ((NOT ( SELECT app.owner_scoped('reports.definition'::text) AS owner_scoped)) OR (owner_id IS NULL) OR (owner_id = ( SELECT auth.uid() AS uid)) OR ( SELECT app.has_grant('reports.definition'::text, plg_reports_definitions.id, ARRAY['shared_with'::text]) AS has_grant) OR ( SELECT app.has_permission('reports.read_all'::text, plg_reports_definitions.unit_id) AS has_permission)) AND ( SELECT app.has_permission('reports.delete'::text, plg_reports_definitions.unit_id) AS has_permission)));
+
+CREATE POLICY plg_reports_definitions_authz_insert ON public.plg_reports_definitions FOR INSERT TO authenticated WITH CHECK (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_reports_definitions.unit_id) AS has_unit)) AND ( SELECT app.has_permission('reports.create'::text, plg_reports_definitions.unit_id) AS has_permission)));
+
+CREATE POLICY plg_reports_definitions_authz_select ON public.plg_reports_definitions FOR SELECT TO authenticated USING (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_reports_definitions.unit_id) AS has_unit)) AND ((NOT ( SELECT app.owner_scoped('reports.definition'::text) AS owner_scoped)) OR (owner_id IS NULL) OR (owner_id = ( SELECT auth.uid() AS uid)) OR ( SELECT app.has_grant('reports.definition'::text, plg_reports_definitions.id, ARRAY['shared_with'::text]) AS has_grant) OR ( SELECT app.has_permission('reports.read_all'::text, plg_reports_definitions.unit_id) AS has_permission)) AND ( SELECT app.has_permission('reports.read'::text, plg_reports_definitions.unit_id) AS has_permission)));
+
+CREATE POLICY plg_reports_definitions_authz_update ON public.plg_reports_definitions FOR UPDATE TO authenticated USING (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_reports_definitions.unit_id) AS has_unit)) AND ((NOT ( SELECT app.owner_scoped('reports.definition'::text) AS owner_scoped)) OR (owner_id IS NULL) OR (owner_id = ( SELECT auth.uid() AS uid)) OR ( SELECT app.has_grant('reports.definition'::text, plg_reports_definitions.id, ARRAY['shared_with'::text]) AS has_grant) OR ( SELECT app.has_permission('reports.read_all'::text, plg_reports_definitions.unit_id) AS has_permission)) AND ( SELECT app.has_permission('reports.edit'::text, plg_reports_definitions.unit_id) AS has_permission))) WITH CHECK (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_reports_definitions.unit_id) AS has_unit)) AND ( SELECT app.has_permission('reports.edit'::text, plg_reports_definitions.unit_id) AS has_permission)));
+
+CREATE POLICY plg_reports_definitions_platform_read ON public.plg_reports_definitions FOR SELECT TO authenticated USING (((tenant_id IS NULL) AND is_active));
+
+CREATE POLICY plg_reports_runs_authz_delete ON public.plg_reports_runs FOR DELETE TO authenticated USING (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_reports_runs.unit_id) AS has_unit)) AND ((NOT ( SELECT app.owner_scoped('reports.run'::text) AS owner_scoped)) OR (owner_id IS NULL) OR (owner_id = ( SELECT auth.uid() AS uid)) OR ( SELECT app.has_grant('reports.run'::text, plg_reports_runs.id, ARRAY['shared_with'::text]) AS has_grant) OR ( SELECT app.has_permission('reports.read_all'::text, plg_reports_runs.unit_id) AS has_permission)) AND ( SELECT app.has_permission('reports.delete'::text, plg_reports_runs.unit_id) AS has_permission)));
+
+CREATE POLICY plg_reports_runs_authz_insert ON public.plg_reports_runs FOR INSERT TO authenticated WITH CHECK (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_reports_runs.unit_id) AS has_unit)) AND ( SELECT app.has_permission('reports.create'::text, plg_reports_runs.unit_id) AS has_permission)));
+
+CREATE POLICY plg_reports_runs_authz_select ON public.plg_reports_runs FOR SELECT TO authenticated USING (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_reports_runs.unit_id) AS has_unit)) AND ((NOT ( SELECT app.owner_scoped('reports.run'::text) AS owner_scoped)) OR (owner_id IS NULL) OR (owner_id = ( SELECT auth.uid() AS uid)) OR ( SELECT app.has_grant('reports.run'::text, plg_reports_runs.id, ARRAY['shared_with'::text]) AS has_grant) OR ( SELECT app.has_permission('reports.read_all'::text, plg_reports_runs.unit_id) AS has_permission)) AND ( SELECT app.has_permission('reports.read'::text, plg_reports_runs.unit_id) AS has_permission)));
+
+CREATE POLICY plg_reports_runs_authz_update ON public.plg_reports_runs FOR UPDATE TO authenticated USING (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_reports_runs.unit_id) AS has_unit)) AND ((NOT ( SELECT app.owner_scoped('reports.run'::text) AS owner_scoped)) OR (owner_id IS NULL) OR (owner_id = ( SELECT auth.uid() AS uid)) OR ( SELECT app.has_grant('reports.run'::text, plg_reports_runs.id, ARRAY['shared_with'::text]) AS has_grant) OR ( SELECT app.has_permission('reports.read_all'::text, plg_reports_runs.unit_id) AS has_permission)) AND ( SELECT app.has_permission('reports.edit'::text, plg_reports_runs.unit_id) AS has_permission))) WITH CHECK (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_reports_runs.unit_id) AS has_unit)) AND ( SELECT app.has_permission('reports.edit'::text, plg_reports_runs.unit_id) AS has_permission)));
+
+CREATE POLICY plg_reports_schedules_authz_delete ON public.plg_reports_schedules FOR DELETE TO authenticated USING (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_reports_schedules.unit_id) AS has_unit)) AND ((NOT ( SELECT app.owner_scoped('reports.schedule'::text) AS owner_scoped)) OR (owner_id IS NULL) OR (owner_id = ( SELECT auth.uid() AS uid)) OR ( SELECT app.has_grant('reports.schedule'::text, plg_reports_schedules.id, ARRAY['shared_with'::text]) AS has_grant) OR ( SELECT app.has_permission('reports.read_all'::text, plg_reports_schedules.unit_id) AS has_permission)) AND ( SELECT app.has_permission('reports.delete'::text, plg_reports_schedules.unit_id) AS has_permission)));
+
+CREATE POLICY plg_reports_schedules_authz_insert ON public.plg_reports_schedules FOR INSERT TO authenticated WITH CHECK (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_reports_schedules.unit_id) AS has_unit)) AND ( SELECT app.has_permission('reports.create'::text, plg_reports_schedules.unit_id) AS has_permission)));
+
+CREATE POLICY plg_reports_schedules_authz_select ON public.plg_reports_schedules FOR SELECT TO authenticated USING (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_reports_schedules.unit_id) AS has_unit)) AND ((NOT ( SELECT app.owner_scoped('reports.schedule'::text) AS owner_scoped)) OR (owner_id IS NULL) OR (owner_id = ( SELECT auth.uid() AS uid)) OR ( SELECT app.has_grant('reports.schedule'::text, plg_reports_schedules.id, ARRAY['shared_with'::text]) AS has_grant) OR ( SELECT app.has_permission('reports.read_all'::text, plg_reports_schedules.unit_id) AS has_permission)) AND ( SELECT app.has_permission('reports.read'::text, plg_reports_schedules.unit_id) AS has_permission)));
+
+CREATE POLICY plg_reports_schedules_authz_update ON public.plg_reports_schedules FOR UPDATE TO authenticated USING (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_reports_schedules.unit_id) AS has_unit)) AND ((NOT ( SELECT app.owner_scoped('reports.schedule'::text) AS owner_scoped)) OR (owner_id IS NULL) OR (owner_id = ( SELECT auth.uid() AS uid)) OR ( SELECT app.has_grant('reports.schedule'::text, plg_reports_schedules.id, ARRAY['shared_with'::text]) AS has_grant) OR ( SELECT app.has_permission('reports.read_all'::text, plg_reports_schedules.unit_id) AS has_permission)) AND ( SELECT app.has_permission('reports.edit'::text, plg_reports_schedules.unit_id) AS has_permission))) WITH CHECK (((tenant_id = ( SELECT app.current_tenant_id() AS current_tenant_id)) AND ((unit_id IS NULL) OR ( SELECT app.has_unit(plg_reports_schedules.unit_id) AS has_unit)) AND ( SELECT app.has_permission('reports.edit'::text, plg_reports_schedules.unit_id) AS has_permission)));
+
+
+-- \u2500\u2500 acl \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+GRANT MAINTAIN ON TABLE public.plg_reports_definitions TO anon;
+GRANT ALL ON TABLE public.plg_reports_definitions TO authenticated;
+GRANT ALL ON TABLE public.plg_reports_definitions TO service_role;
+
+REVOKE ALL ON FUNCTION public.reports_definition(p_key text, p_tenant uuid) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.reports_definition(p_key text, p_tenant uuid) TO authenticated;
+GRANT ALL ON FUNCTION public.reports_definition(p_key text, p_tenant uuid) TO service_role;
+
+REVOKE ALL ON FUNCTION public.reports_deliver_due(p_limit integer) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.reports_deliver_due(p_limit integer) TO service_role;
+
+REVOKE ALL ON FUNCTION public.reports_ensure_delivery_template(p_tenant uuid, p_channel text) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.reports_ensure_delivery_template(p_tenant uuid, p_channel text) TO authenticated;
+GRANT ALL ON FUNCTION public.reports_ensure_delivery_template(p_tenant uuid, p_channel text) TO service_role;
+
+REVOKE ALL ON FUNCTION public.reports_run(p_key text, p_params jsonb, p_limit integer, p_offset integer, p_format text) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.reports_run(p_key text, p_params jsonb, p_limit integer, p_offset integer, p_format text) TO authenticated;
+GRANT ALL ON FUNCTION public.reports_run(p_key text, p_params jsonb, p_limit integer, p_offset integer, p_format text) TO service_role;
+
+REVOKE ALL ON FUNCTION public.trg_plg_reports_definitions_source() FROM PUBLIC;
+GRANT ALL ON FUNCTION public.trg_plg_reports_definitions_source() TO service_role;
+
+GRANT MAINTAIN ON TABLE public.plg_reports_runs TO anon;
+GRANT ALL ON TABLE public.plg_reports_runs TO authenticated;
+GRANT ALL ON TABLE public.plg_reports_runs TO service_role;
+
+GRANT MAINTAIN ON TABLE public.plg_reports_schedules TO anon;
+GRANT ALL ON TABLE public.plg_reports_schedules TO authenticated;
+GRANT ALL ON TABLE public.plg_reports_schedules TO service_role;
+
+
+-- \u2500\u2500 comment \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+COMMENT ON TABLE public.plg_reports_definitions IS 'The report catalogue (PRD 08). Versioned, so changing a report does not rewrite the history of everyone who ran the previous one; and \`required_permission\` is declared HERE rather than on a screen, so the engine can refuse before it queries.';
+
+COMMENT ON FUNCTION public.reports_deliver_due(p_limit integer) IS 'Queue the scheduled reports that are due (PRD 08). It enqueues through the notification engine rather than sending \u2014 the same mechanism as dunning and as a campaign, which is what made building that engine first worth doing.';
+
+COMMENT ON FUNCTION public.reports_run(p_key text, p_params jsonb, p_limit integer, p_offset integer, p_format text) IS 'Run a report from the catalogue (PRD 08). The permission is checked BEFORE the query is built \u2014 a refusal reads no rows and comes back as status=refused, recorded in plg_reports_runs \u2014 the tenant and unit predicates are injected by the engine and cannot be switched off by a definition, and an undeclared parameter is refused rather than ignored.';
+
+COMMENT ON TABLE public.plg_reports_runs IS 'Who ran what, with which parameters, against which VERSION of the definition (PRD 08). A refusal is recorded too \u2014 "the report is empty" and "you were not allowed to see it" are different answers and the history has to keep them apart.';
+
+COMMENT ON TABLE public.plg_reports_schedules IS 'A report on a schedule (PRD 08). Delivery is the notification engine''s job (PRD 03) \u2014 the same queue, retry and opt-out that carry a receipt carry a report, which is the whole reason that engine was built first.';
+
+
+-- \u2500\u2500 default privileges: restore \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- Put back, so the NEXT thing installed inherits what the chain had.
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT MAINTAIN ON TABLES TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT MAINTAIN ON TABLES TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$--
+-- PostgreSQL database dump complete
+--$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$--
+-- PostgreSQL database dump complete
+--$stmt$;
+END $dp$;
+`;
+var MIGRATIONS = [
+  { id: "000_baseline", sql: MIGRATION_000_BASELINE }
+];
+
 // src/lib/legacy.ts
 function reportDefToCard(report, createdBy) {
   return {
@@ -1336,9 +2029,9 @@ function ExportDropdown({ columns, data, filename, currency, title, fetchAll })
   const [pdfAvailable, setPdfAvailable] = useState(false);
   const [busy, setBusy] = useState(false);
   useEffect(() => {
-    import('./excel-DSORXL4O.js').then((m) => m.isExcelAvailable()).then(setExcelAvailable).catch(() => {
+    import('./excel-NKWJ2AMC.js').then((m) => m.isExcelAvailable()).then(setExcelAvailable).catch(() => {
     });
-    import('./pdf-DH4CJMV5.js').then((m) => m.isPdfAvailable()).then(setPdfAvailable).catch(() => {
+    import('./pdf-H73MJGB6.js').then((m) => m.isPdfAvailable()).then(setPdfAvailable).catch(() => {
     });
   }, []);
   const withRows = async (write3) => {
@@ -1353,12 +2046,12 @@ function ExportDropdown({ columns, data, filename, currency, title, fetchAll })
   };
   const handleCsv = () => withRows((rows) => exportToCsv(columns, rows, filename, currency));
   const handleExcel = () => withRows(async (rows) => {
-    const { exportToExcel } = await import('./excel-DSORXL4O.js');
-    await exportToExcel(columns, rows, filename, currency);
+    const { exportToExcel: exportToExcel2 } = await import('./excel-NKWJ2AMC.js');
+    await exportToExcel2(columns, rows, filename, currency);
   });
   const handlePdf = () => withRows(async (rows) => {
-    const { exportToPdf } = await import('./pdf-DH4CJMV5.js');
-    await exportToPdf(columns, rows, filename, { title, currency });
+    const { exportToPdf: exportToPdf2 } = await import('./pdf-H73MJGB6.js');
+    await exportToPdf2(columns, rows, filename, { title, currency });
   });
   return /* @__PURE__ */ jsxs(Dropdown, { children: [
     /* @__PURE__ */ jsx(DropdownTrigger, { asChild: true, children: /* @__PURE__ */ jsx(ToolbarAction, { icon: Download, caret: true, disabled: busy, children: t("reports.export") }) }),
@@ -2110,6 +2803,42 @@ function AnalyticsSettingsPage() {
     creating ? /* @__PURE__ */ jsx(NewReportPanel, { sources, categories, onClose: () => setCreating(false) }) : null
   ] });
 }
+function db() {
+  const client = getSupabaseClientOptional();
+  if (!client) throw new Error("Supabase client is not configured");
+  return client;
+}
+async function runReport(key, params = {}, options) {
+  const { data, error } = await db().rpc("reports_run", {
+    p_key: key,
+    p_params: params,
+    p_limit: options?.limit ?? 1e3,
+    p_offset: options?.offset ?? 0,
+    p_format: options?.format ?? null
+  });
+  if (error) throw new Error(error.message);
+  const r = data ?? {};
+  return {
+    key: r.key ?? key,
+    version: Number(r.version) || 1,
+    title: r.title ?? key,
+    status: r.status === "refused" ? "refused" : "ok",
+    requiredPermission: r.required_permission ?? void 0,
+    columns: r.columns ?? [],
+    rows: r.rows ?? [],
+    rowCount: Number(r.row_count) || 0
+  };
+}
+async function runAndExportReport(key, format, params = {}, options) {
+  const result = await runReport(key, params, { limit: options?.limit ?? 5e3, format });
+  if (result.status === "refused") return result;
+  const filename = options?.filename ?? `${result.key}-${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}`;
+  const columns = result.columns.length > 0 ? result.columns : Object.keys(result.rows[0] ?? {}).map((key2) => ({ key: key2, label: key2 }));
+  if (format === "csv") exportToCsv(columns, result.rows, filename, options?.currency);
+  else if (format === "xlsx") await exportToExcel(columns, result.rows, filename, options?.currency);
+  else await exportToPdf(columns, result.rows, filename, { title: result.title, currency: options?.currency });
+  return result;
+}
 function camelToSnake2(str) {
   return str.replace(/[A-Z]/g, (c) => "_" + c.toLowerCase());
 }
@@ -2347,6 +3076,18 @@ function createAnalyticsPlugin(options = {}) {
     // Measurement, not acquisition — what the Fayz plugin page lists for
     // Analytics.
     integrations: ["google-analytics", "hotjar"],
+    // The engine, at last (Phase 2, PRD 08). This package shipped ZERO
+    // migrations until now: a package and a screen, never a catalogue of
+    // versioned definitions with a declared permission, a run history and an
+    // export. Without them "report" meant "a query somebody wrote into a
+    // screen", which is how a report ships with no authorization rule by simple
+    // forgetfulness.
+    migrations: MIGRATIONS.map((m) => ({
+      id: `reports-${m.id}`,
+      version: "1.0.0",
+      sql: m.sql,
+      description: m.id
+    })),
     locales: reportsLocales
   };
 }
@@ -2367,6 +3108,6 @@ function createReportsPlugin(options) {
   });
 }
 
-export { ANALYTICS_BASE, AnalyticsModule, AnalyticsOverview, AnalyticsReportViewer, AnalyticsSettingsPage, AnalyticsSurface, REPORTS_BASE, ReportsListPage, SETTINGS_ROUTE, aggregateRows, cardColumns, clearCardPref, createAnalyticsPlugin, createMockAnalyticsProvider, createMockReportProvider, createReportsPlugin, createSupabaseAnalyticsProvider, createSupabaseReportProvider, deleteCustomReport, fieldPalette, getReportsTenantId, markViewed, reportDefToCard, reportDefsToCards, resetAnalyticsPrefs, resolveCards, resolveCustomReport, saveCustomReport, setCardPref, setOverviewOrder, setReportsTenantId, sourceKey, useAnalyticsCards, useAnalyticsCatalogue, useAnalyticsConfig, useAnalyticsPrefs, useLastViewed, useOverviewCards };
+export { ANALYTICS_BASE, AnalyticsModule, AnalyticsOverview, AnalyticsReportViewer, AnalyticsSettingsPage, AnalyticsSurface, REPORTS_BASE, ReportsListPage, SETTINGS_ROUTE, aggregateRows, cardColumns, clearCardPref, createAnalyticsPlugin, createMockAnalyticsProvider, createMockReportProvider, createReportsPlugin, createSupabaseAnalyticsProvider, createSupabaseReportProvider, deleteCustomReport, exportToCsv, fieldPalette, getReportsTenantId, markViewed, reportDefToCard, reportDefsToCards, resetAnalyticsPrefs, resolveCards, resolveCustomReport, runAndExportReport, runReport, saveCustomReport, setCardPref, setOverviewOrder, setReportsTenantId, sourceKey, useAnalyticsCards, useAnalyticsCatalogue, useAnalyticsConfig, useAnalyticsPrefs, useLastViewed, useOverviewCards };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map