@fayz-ai/plugin-scribe 0.14.11 → 0.14.13

package/dist/migrations/main.browser.js

@@ -0,0 +1,7 @@
+// node_modules/.cache/fayz-migration-stubs/main.ts
+var MIGRATION_000_BASELINE = "";
+var MIGRATIONS = [];
+
+export { MIGRATIONS, MIGRATION_000_BASELINE };
+//# sourceMappingURL=main.browser.js.map
+//# sourceMappingURL=main.browser.js.map

package/dist/migrations/main.browser.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../node_modules/.cache/fayz-migration-stubs/main.ts"],"names":[],"mappings":";AAEO,IAAM,sBAAA,GAAyB;AAC/B,IAAM,aAAiD","file":"main.browser.js","sourcesContent":["// GENERATED by scripts/tsup-migrations.mjs — the browser build of a\n// migrations barrel: the same names, no SQL. See that script for why.\nexport const MIGRATION_000_BASELINE = ''\nexport const MIGRATIONS: Array<{ id: string; sql: string }> = []\n"]}

package/dist/migrations/main.js

@@ -0,0 +1,575 @@
+// src/migrations/index.ts
+var MIGRATION_000_BASELINE = `-- ============================================================================
+-- plugins/plugin-scribe/src/migrations/000_baseline.sql \u2014 what installing this provisions, as one file.
+--
+-- GENERATED by scripts/emit-unit-baselines.mjs (#338). Do not edit by hand:
+-- change the schema, regenerate, and let scripts/check-chain-equivalence.mjs
+-- prove the result still matches.
+--
+-- This replaced 3 migration files. They are kept, unapplied, in
+-- migrations.archive/ \u2014 a year of decisions is worth reading even when it is no
+-- longer worth replaying.
+--
+-- Object order is fixed rather than dependency-sorted: schemas, types,
+-- sequences, tables, defaults, functions, constraints, views, indexes, foreign
+-- keys, triggers, row security, policies, grants. Dependencies BETWEEN units
+-- are carried by the order packages/db/chain.json declares.
+-- ============================================================================
+
+-- A LANGUAGE sql function binds its body at CREATE time, and 570 functions
+-- sorted by name are not sorted by who calls whom. This is what lets them load
+-- in any order; every body is still compiled on first call, so a genuinely
+-- broken reference surfaces then rather than never. Session-scoped.
+SET check_function_bodies = false;
+
+
+
+-- \u2500\u2500 default privileges: reset \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- Cleared BEFORE anything is created, so every object below gets the ACL the
+-- dump describes rather than the image's defaults on top of it. Restored at
+-- the end of this file.
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+
+-- \u2500\u2500 table \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE TABLE public.plg_scribe_generations (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    session_id uuid NOT NULL,
+    template_id uuid,
+    template_key text,
+    tab_order integer DEFAULT 0 NOT NULL,
+    title text,
+    status text DEFAULT 'pending'::text NOT NULL,
+    markdown text,
+    markdown_edited text,
+    facts jsonb,
+    model text,
+    prompt_version text,
+    input_tokens integer,
+    output_tokens integer,
+    error text,
+    document_id uuid,
+    created_by uuid,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT plg_scribe_generations_status_check CHECK ((status = ANY (ARRAY['pending'::text, 'running'::text, 'ready'::text, 'failed'::text, 'committed'::text, 'discarded'::text])))
+);
+
+CREATE TABLE public.plg_scribe_segments (
+    session_id uuid NOT NULL,
+    seg_index integer NOT NULL,
+    tenant_id uuid NOT NULL,
+    storage_path text,
+    bytes integer,
+    start_offset_ms integer NOT NULL,
+    duration_ms integer,
+    partial boolean DEFAULT false NOT NULL,
+    gap boolean DEFAULT false NOT NULL,
+    upload_state text DEFAULT 'pending'::text NOT NULL,
+    uploaded_at timestamp with time zone,
+    stt_state text DEFAULT 'pending'::text NOT NULL,
+    stt_provider text,
+    stt_attempts smallint DEFAULT 0 NOT NULL,
+    stt_error text,
+    text text,
+    words jsonb,
+    confidence real,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT plg_scribe_segments_stt_state_check CHECK ((stt_state = ANY (ARRAY['pending'::text, 'running'::text, 'done'::text, 'failed'::text, 'skipped'::text]))),
+    CONSTRAINT plg_scribe_segments_upload_state_check CHECK ((upload_state = ANY (ARRAY['pending'::text, 'uploaded'::text, 'missing'::text])))
+);
+
+CREATE TABLE public.plg_scribe_sessions (
+    id uuid NOT NULL,
+    tenant_id uuid NOT NULL,
+    subject_id uuid,
+    context_kind text DEFAULT 'person'::text NOT NULL,
+    appointment_id uuid,
+    owner_user_id uuid NOT NULL,
+    status text DEFAULT 'recording'::text NOT NULL,
+    locale text DEFAULT 'pt-BR'::text NOT NULL,
+    mime_type text,
+    started_at timestamp with time zone DEFAULT now() NOT NULL,
+    ended_at timestamp with time zone,
+    wall_duration_ms integer DEFAULT 0 NOT NULL,
+    audio_duration_ms integer DEFAULT 0 NOT NULL,
+    segment_count integer DEFAULT 0 NOT NULL,
+    uploaded_segment_count integer DEFAULT 0 NOT NULL,
+    transcribed_segment_count integer DEFAULT 0 NOT NULL,
+    transcript_chars integer DEFAULT 0 NOT NULL,
+    consent_at timestamp with time zone,
+    consent_mode text,
+    retention_until date,
+    audio_deleted_at timestamp with time zone,
+    error text,
+    metadata jsonb DEFAULT '{}'::jsonb NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT plg_scribe_sessions_consent_mode_check CHECK ((consent_mode = ANY (ARRAY['verbal'::text, 'written'::text, 'implied_contract'::text]))),
+    CONSTRAINT plg_scribe_sessions_context_kind_check CHECK ((context_kind = ANY (ARRAY['person'::text, 'appointment'::text, 'standalone'::text]))),
+    CONSTRAINT plg_scribe_sessions_status_check CHECK ((status = ANY (ARRAY['recording'::text, 'paused'::text, 'interrupted'::text, 'uploading'::text, 'transcribing'::text, 'ready'::text, 'generating'::text, 'completed'::text, 'abandoned'::text, 'failed'::text])))
+);
+
+
+-- \u2500\u2500 function \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE FUNCTION public.scribe_audio_path_ok(p_name text) RETURNS boolean
+    LANGUAGE sql STABLE SECURITY DEFINER
+    SET search_path TO 'public'
+    AS $_$
+  SELECT
+    p_name IS NOT NULL
+    AND length(p_name) <= 200
+    AND p_name ~ ('^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}'
+               || '/[0-9]{4}/[0-9]{2}'
+               || '/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}'
+               || '/[0-9]{5}\\.(webm|ogg|m4a|mp3)$')
+    -- compara\xE7\xE3o em texto (nunca \`::uuid\`): entrada malformada devolve falso em
+    -- vez de derrubar a policy com erro de cast.
+    AND EXISTS (
+      SELECT 1 FROM public.tenants t WHERE t.id::text = split_part(p_name, '/', 1)
+    );
+$_$;
+
+CREATE FUNCTION public.scribe_record_segment(p_payload jsonb) RETURNS jsonb
+    LANGUAGE plpgsql
+    SET search_path TO 'public'
+    AS $$
+DECLARE
+  v_session_id uuid;
+  v_seg_index  integer;
+  v_tenant_id  uuid;
+  v_result     jsonb;
+BEGIN
+  v_session_id := (p_payload->>'session_id')::uuid;
+  v_seg_index  := (p_payload->>'seg_index')::integer;
+
+  IF v_session_id IS NULL OR v_seg_index IS NULL THEN
+    RAISE EXCEPTION 'session_id and seg_index are required';
+  END IF;
+
+  -- O tenant vem da SESS\xC3O, nunca do payload. Se o cliente pudesse informar o
+  -- tenant, ele escolheria em que pasta escrever.
+  SELECT s.tenant_id INTO v_tenant_id
+  FROM plg_scribe_sessions s WHERE s.id = v_session_id;
+
+  IF v_tenant_id IS NULL THEN
+    -- Sess\xE3o inexistente OU invis\xEDvel pela RLS: a mesma resposta nos dois
+    -- casos, de prop\xF3sito \u2014 n\xE3o vaza a exist\xEAncia de sess\xE3o de outro tenant.
+    RAISE EXCEPTION 'unknown session';
+  END IF;
+
+  INSERT INTO plg_scribe_segments (
+    session_id, seg_index, tenant_id, storage_path, bytes,
+    start_offset_ms, duration_ms, partial, gap, upload_state, uploaded_at, stt_state
+  ) VALUES (
+    v_session_id, v_seg_index, v_tenant_id,
+    p_payload->>'storage_path',
+    (p_payload->>'bytes')::integer,
+    COALESCE((p_payload->>'start_offset_ms')::integer, 0),
+    (p_payload->>'duration_ms')::integer,
+    COALESCE((p_payload->>'partial')::boolean, false),
+    COALESCE((p_payload->>'gap')::boolean, false),
+    CASE WHEN COALESCE((p_payload->>'gap')::boolean, false) THEN 'missing' ELSE 'uploaded' END,
+    now(),
+    -- Buraco n\xE3o vai para o STT: n\xE3o h\xE1 \xE1udio para transcrever, e mand\xE1-lo
+    -- queimaria uma chamada para receber string vazia.
+    CASE WHEN COALESCE((p_payload->>'gap')::boolean, false) THEN 'skipped' ELSE 'pending' END
+  )
+  ON CONFLICT (session_id, seg_index) DO UPDATE SET
+    storage_path = COALESCE(EXCLUDED.storage_path, plg_scribe_segments.storage_path),
+    bytes        = COALESCE(EXCLUDED.bytes, plg_scribe_segments.bytes),
+    duration_ms  = COALESCE(EXCLUDED.duration_ms, plg_scribe_segments.duration_ms),
+    partial      = EXCLUDED.partial,
+    upload_state = EXCLUDED.upload_state,
+    uploaded_at  = COALESCE(plg_scribe_segments.uploaded_at, EXCLUDED.uploaded_at),
+    updated_at   = now();
+
+  -- Contadores derivados. \`audio_duration_ms\` soma s\xF3 o que tem dura\xE7\xE3o medida,
+  -- ent\xE3o um segmento que ainda n\xE3o voltou do STT n\xE3o infla o total.
+  UPDATE plg_scribe_sessions s SET
+    segment_count             = agg.total,
+    uploaded_segment_count    = agg.uploaded,
+    transcribed_segment_count = agg.transcribed,
+    audio_duration_ms         = agg.audio_ms,
+    transcript_chars          = agg.chars,
+    updated_at                = now()
+  FROM (
+    SELECT
+      count(*)::int                                                  AS total,
+      count(*) FILTER (WHERE upload_state = 'uploaded')::int         AS uploaded,
+      count(*) FILTER (WHERE stt_state = 'done')::int                AS transcribed,
+      COALESCE(sum(duration_ms) FILTER (WHERE NOT gap), 0)::int      AS audio_ms,
+      COALESCE(sum(length(text)), 0)::int                            AS chars
+    FROM plg_scribe_segments WHERE session_id = v_session_id
+  ) agg
+  WHERE s.id = v_session_id;
+
+  SELECT to_jsonb(x) INTO v_result FROM (
+    SELECT s.segment_count, s.uploaded_segment_count,
+           s.transcribed_segment_count, s.audio_duration_ms, s.status
+    FROM plg_scribe_sessions s WHERE s.id = v_session_id
+  ) x;
+
+  RETURN v_result;
+END;
+$$;
+
+
+-- \u2500\u2500 constraint \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+ALTER TABLE ONLY public.plg_scribe_generations
+    ADD CONSTRAINT plg_scribe_generations_pkey PRIMARY KEY (id);
+
+ALTER TABLE ONLY public.plg_scribe_segments
+    ADD CONSTRAINT plg_scribe_segments_pkey PRIMARY KEY (session_id, seg_index);
+
+ALTER TABLE ONLY public.plg_scribe_sessions
+    ADD CONSTRAINT plg_scribe_sessions_pkey PRIMARY KEY (id);
+
+
+-- \u2500\u2500 view \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE VIEW public.v_scribe_generations WITH (security_invoker='true') AS
+ SELECT g.id,
+    g.tenant_id,
+    g.session_id,
+    g.template_id,
+    g.template_key,
+    g.tab_order,
+    g.title,
+    g.status,
+    g.markdown,
+    g.markdown_edited,
+    g.facts,
+    g.model,
+    g.prompt_version,
+    g.input_tokens,
+    g.output_tokens,
+    g.error,
+    g.document_id,
+    g.created_by,
+    g.created_at,
+    g.updated_at,
+    (t.id IS NOT NULL) AS template_exists,
+    t.name AS template_name
+   FROM (public.plg_scribe_generations g
+     LEFT JOIN public.plg_forms_templates t ON ((t.id = g.template_id)));
+
+
+-- \u2500\u2500 index \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE INDEX idx_plg_scribe_generations_session ON public.plg_scribe_generations USING btree (session_id, tab_order);
+
+CREATE INDEX idx_plg_scribe_generations_tenant ON public.plg_scribe_generations USING btree (tenant_id);
+
+CREATE INDEX idx_plg_scribe_segments_stt_queue ON public.plg_scribe_segments USING btree (tenant_id, stt_state, created_at) WHERE ((upload_state = 'uploaded'::text) AND (stt_state = ANY (ARRAY['pending'::text, 'failed'::text])));
+
+CREATE INDEX idx_plg_scribe_segments_tenant ON public.plg_scribe_segments USING btree (tenant_id);
+
+CREATE INDEX idx_plg_scribe_sessions_appointment ON public.plg_scribe_sessions USING btree (appointment_id) WHERE (appointment_id IS NOT NULL);
+
+CREATE INDEX idx_plg_scribe_sessions_open ON public.plg_scribe_sessions USING btree (tenant_id, owner_user_id, status) WHERE (status = ANY (ARRAY['recording'::text, 'paused'::text, 'interrupted'::text, 'uploading'::text, 'transcribing'::text, 'ready'::text, 'generating'::text]));
+
+CREATE INDEX idx_plg_scribe_sessions_retention ON public.plg_scribe_sessions USING btree (retention_until) WHERE ((audio_deleted_at IS NULL) AND (retention_until IS NOT NULL));
+
+CREATE INDEX idx_plg_scribe_sessions_subject ON public.plg_scribe_sessions USING btree (subject_id) WHERE (subject_id IS NOT NULL);
+
+CREATE INDEX idx_plg_scribe_sessions_tenant ON public.plg_scribe_sessions USING btree (tenant_id);
+
+
+-- \u2500\u2500 fk constraint \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+ALTER TABLE ONLY public.plg_scribe_generations
+    ADD CONSTRAINT plg_scribe_generations_document_fk FOREIGN KEY (document_id) REFERENCES public.documents(id) ON DELETE SET NULL;
+
+ALTER TABLE ONLY public.plg_scribe_generations
+    ADD CONSTRAINT plg_scribe_generations_session_id_fkey FOREIGN KEY (session_id) REFERENCES public.plg_scribe_sessions(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_scribe_generations
+    ADD CONSTRAINT plg_scribe_generations_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES public.tenants(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_scribe_segments
+    ADD CONSTRAINT plg_scribe_segments_session_id_fkey FOREIGN KEY (session_id) REFERENCES public.plg_scribe_sessions(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_scribe_segments
+    ADD CONSTRAINT plg_scribe_segments_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES public.tenants(id) ON DELETE CASCADE;
+
+ALTER TABLE ONLY public.plg_scribe_sessions
+    ADD CONSTRAINT plg_scribe_sessions_appointment_id_fkey FOREIGN KEY (appointment_id) REFERENCES public.appointments(id) ON DELETE SET NULL;
+
+ALTER TABLE ONLY public.plg_scribe_sessions
+    ADD CONSTRAINT plg_scribe_sessions_subject_id_fkey FOREIGN KEY (subject_id) REFERENCES public.people(id) ON DELETE SET NULL;
+
+ALTER TABLE ONLY public.plg_scribe_sessions
+    ADD CONSTRAINT plg_scribe_sessions_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES public.tenants(id) ON DELETE CASCADE;
+
+
+-- \u2500\u2500 row security \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+ALTER TABLE public.plg_scribe_generations ENABLE ROW LEVEL SECURITY;
+
+ALTER TABLE public.plg_scribe_segments ENABLE ROW LEVEL SECURITY;
+
+ALTER TABLE public.plg_scribe_sessions ENABLE ROW LEVEL SECURITY;
+
+
+-- \u2500\u2500 policy \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE POLICY plg_scribe_generations_delete ON public.plg_scribe_generations FOR DELETE TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_scribe_generations_insert ON public.plg_scribe_generations FOR INSERT TO authenticated WITH CHECK ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_scribe_generations_select ON public.plg_scribe_generations FOR SELECT TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_scribe_generations_update ON public.plg_scribe_generations FOR UPDATE TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_scribe_segments_delete ON public.plg_scribe_segments FOR DELETE TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_scribe_segments_insert ON public.plg_scribe_segments FOR INSERT TO authenticated WITH CHECK ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_scribe_segments_select ON public.plg_scribe_segments FOR SELECT TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_scribe_segments_update ON public.plg_scribe_segments FOR UPDATE TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_scribe_sessions_delete ON public.plg_scribe_sessions FOR DELETE TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_scribe_sessions_insert ON public.plg_scribe_sessions FOR INSERT TO authenticated WITH CHECK ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_scribe_sessions_select ON public.plg_scribe_sessions FOR SELECT TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+CREATE POLICY plg_scribe_sessions_update ON public.plg_scribe_sessions FOR UPDATE TO authenticated USING ((tenant_id IN ( SELECT public.user_tenant_ids() AS user_tenant_ids)));
+
+
+-- \u2500\u2500 acl \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+GRANT ALL ON FUNCTION public.scribe_audio_path_ok(p_name text) TO authenticated;
+GRANT ALL ON FUNCTION public.scribe_audio_path_ok(p_name text) TO service_role;
+
+GRANT ALL ON FUNCTION public.scribe_record_segment(p_payload jsonb) TO authenticated;
+GRANT ALL ON FUNCTION public.scribe_record_segment(p_payload jsonb) TO service_role;
+
+GRANT MAINTAIN ON TABLE public.plg_scribe_generations TO anon;
+GRANT ALL ON TABLE public.plg_scribe_generations TO authenticated;
+GRANT ALL ON TABLE public.plg_scribe_generations TO service_role;
+
+GRANT MAINTAIN ON TABLE public.plg_scribe_segments TO anon;
+GRANT ALL ON TABLE public.plg_scribe_segments TO authenticated;
+GRANT ALL ON TABLE public.plg_scribe_segments TO service_role;
+
+GRANT MAINTAIN ON TABLE public.plg_scribe_sessions TO anon;
+GRANT ALL ON TABLE public.plg_scribe_sessions TO authenticated;
+GRANT ALL ON TABLE public.plg_scribe_sessions TO service_role;
+
+GRANT MAINTAIN ON TABLE public.v_scribe_generations TO anon;
+GRANT ALL ON TABLE public.v_scribe_generations TO authenticated;
+GRANT ALL ON TABLE public.v_scribe_generations TO service_role;
+
+
+-- \u2500\u2500 comment \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+COMMENT ON FUNCTION public.scribe_audio_path_ok(p_name text) IS 'True when a storage object name follows the scribe-audio grammar {tenant}/{yyyy}/{mm}/{session}/{segIndex}.{ext} and segment 1 is a real tenant. Used by the INSERT policy on that bucket.';
+
+COMMENT ON FUNCTION public.scribe_record_segment(p_payload jsonb) IS 'Idempotent upsert of one audio segment + recomputation of the parent session counters from the segments table. Called by the browser upload pump after each successful Storage write.';
+
+COMMENT ON COLUMN public.plg_scribe_generations.template_id IS 'The forms template this generation came from, by id and not by foreign key (003, ADR 0015). A soft reference on purpose: forms owns that table and must be able to release it without scribe''s permission. A row whose template is gone reads as absent, which is what the old ON DELETE SET NULL was arranging.';
+
+COMMENT ON VIEW public.v_scribe_generations IS 'Generations with their forms template resolved by LEFT JOIN rather than by foreign key (003). \`template_exists\` is the honest answer on a cluster where forms is not installed, or where the template was deleted.';
+
+
+-- \u2500\u2500 default privileges: restore \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- Put back, so the NEXT thing installed inherits what the chain had.
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT MAINTAIN ON TABLES TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT MAINTAIN ON TABLES TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$--
+-- PostgreSQL database dump complete
+--$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$--
+-- PostgreSQL database dump complete
+--$stmt$;
+END $dp$;
+`;
+var MIGRATIONS = [
+  { id: "000_baseline", sql: MIGRATION_000_BASELINE }
+];
+
+export { MIGRATIONS, MIGRATION_000_BASELINE };
+//# sourceMappingURL=main.js.map
+//# sourceMappingURL=main.js.map