@fayz-ai/plugin-support 0.0.0-stage → 0.2.1

package/dist/index.js

@@ -0,0 +1,901 @@
+import { defaultStatusComponents, defaultWhatsNew, defaultFaq, useSupportStore } from './chunk-JJPB2T3Z.js';
+export { useSupportStore } from './chunk-JJPB2T3Z.js';
+import { consoleListRequests } from './chunk-5K7VA5VP.js';
+import { STATUS_LABEL, STATUS_TONE, createRequest, uploadAttachment, listRequests } from './chunk-7NVBUXTX.js';
+export { MAX_ATTACHMENTS, MAX_ATTACHMENT_BYTES, SUPPORT_BUCKET } from './chunk-7NVBUXTX.js';
+import React2 from 'react';
+import { registerTranslations, getRecentActivity, useNavHistoryStore } from '@fayz-ai/core';
+import { Skeleton, Badge } from '@fayz-ai/ui';
+import { jsx, jsxs } from 'react/jsx-runtime';
+
+// src/locales/en.ts
+var en = {
+  "support.title": "Support",
+  "support.nav.requests": "My requests",
+  "support.feature.base": "Support",
+  "support.feature.all": "Whole-company requests"
+};
+
+// src/locales/pt-BR.ts
+var ptBR = {
+  "support.title": "Suporte",
+  "support.nav.requests": "Minhas solicita\xE7\xF5es",
+  "support.feature.base": "Suporte",
+  "support.feature.all": "Solicita\xE7\xF5es de toda a empresa"
+};
+
+// src/locales/index.ts
+var supportLocales = {
+  en,
+  "pt-BR": ptBR
+};
+
+// src/migrations/index.ts
+var MIGRATION_000_BASELINE = `-- plugin-support \u2014 Central de Suporte do Dico: the solicita\xE7\xF5es a tenant files
+-- (problem / improvement / other), their conversation, history, attachments and
+-- the "esperando voc\xEA" notifications. Port of the V1 support_* family.
+--
+-- Idempotent. Canonical RLS form: tenant_id IN (SELECT public.user_tenant_ids()).
+-- "Minhas vs Toda a empresa" is a query-layer filter on created_by, gated by the
+-- support.all feature \u2014 not an RLS distinction (the fleet has no SQL permission
+-- helper, and the cross-member triage read is the 2nd wave with the platform bridge).
+
+SET check_function_bodies = false;
+
+-- \u2500\u2500 tables \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+-- The request itself. Carries, unseen by the person, the screen it was filed
+-- from (route, active unit, a snapshot of what was visible) \u2014 triage reads it first.
+CREATE TABLE IF NOT EXISTS public.plg_support_requests (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  number integer NOT NULL,                 -- per-tenant sequential #; filled by trigger
+  kind text NOT NULL,                      -- problem | improvement | other
+  subject text,                            -- optional; derived from first line when blank
+  description text NOT NULL,
+  status text NOT NULL DEFAULT 'received', -- received|in_service|waiting_you|in_development|resolved_check|closed|cancelled
+  route text,                              -- origin screen hash path
+  unit_id uuid,                            -- active unit when filed (informational snapshot, no FK)
+  screen_snapshot jsonb NOT NULL DEFAULT '{}'::jsonb,
+  origin_conversation_id uuid,             -- the Dico chat that spawned it, when any
+  area text,
+  created_by uuid NOT NULL DEFAULT auth.uid(), -- auth user; the owner of "Minhas". Default so the client cannot spoof it.
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  resolved_at timestamptz,
+  metadata jsonb NOT NULL DEFAULT '{}'::jsonb
+);
+ALTER TABLE public.plg_support_requests ENABLE ROW LEVEL SECURITY;
+CREATE INDEX IF NOT EXISTS idx_plg_support_requests_tenant ON public.plg_support_requests(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_plg_support_requests_tenant_created_by ON public.plg_support_requests(tenant_id, created_by);
+CREATE INDEX IF NOT EXISTS idx_plg_support_requests_tenant_status ON public.plg_support_requests(tenant_id, status);
+CREATE UNIQUE INDEX IF NOT EXISTS uq_plg_support_requests_tenant_number ON public.plg_support_requests(tenant_id, number);
+
+-- The conversation inside the request ("Escreva para a equipe\u2026").
+CREATE TABLE IF NOT EXISTS public.plg_support_request_messages (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  request_id uuid NOT NULL REFERENCES public.plg_support_requests(id) ON DELETE CASCADE,
+  author_kind text NOT NULL DEFAULT 'user', -- user | team
+  author_id uuid DEFAULT auth.uid(),
+  body text NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+ALTER TABLE public.plg_support_request_messages ENABLE ROW LEVEL SECURITY;
+CREATE INDEX IF NOT EXISTS idx_plg_support_request_messages_tenant ON public.plg_support_request_messages(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_plg_support_request_messages_request ON public.plg_support_request_messages(request_id, created_at);
+
+-- The short-sentence history shown in the detail ("Solicita\xE7\xE3o aberta", "Andamento: Cancelada").
+CREATE TABLE IF NOT EXISTS public.plg_support_request_events (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  request_id uuid NOT NULL REFERENCES public.plg_support_requests(id) ON DELETE CASCADE,
+  type text NOT NULL,  -- opened|status_changed|validated_ok|reopened|cancelled|closed_no_reply|merged
+  note text,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+ALTER TABLE public.plg_support_request_events ENABLE ROW LEVEL SECURITY;
+CREATE INDEX IF NOT EXISTS idx_plg_support_request_events_tenant ON public.plg_support_request_events(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_plg_support_request_events_request ON public.plg_support_request_events(request_id, created_at);
+
+-- Attachment pointers; the file itself lives in the support-attachments bucket.
+CREATE TABLE IF NOT EXISTS public.plg_support_request_attachments (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  request_id uuid NOT NULL REFERENCES public.plg_support_requests(id) ON DELETE CASCADE,
+  storage_path text NOT NULL,  -- <tenant_id>/<request_id>/<uuid>/<name>
+  name text NOT NULL,
+  size_bytes bigint,
+  content_type text,
+  created_by uuid DEFAULT auth.uid(),
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+ALTER TABLE public.plg_support_request_attachments ENABLE ROW LEVEL SECURITY;
+CREATE INDEX IF NOT EXISTS idx_plg_support_request_attachments_tenant ON public.plg_support_request_attachments(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_plg_support_request_attachments_request ON public.plg_support_request_attachments(request_id);
+
+-- The orange "Esperando voc\xEA" counter and the bell notice when the team replies.
+CREATE TABLE IF NOT EXISTS public.plg_support_notifications (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  request_id uuid NOT NULL REFERENCES public.plg_support_requests(id) ON DELETE CASCADE,
+  user_id uuid NOT NULL,       -- who should see it
+  kind text,                   -- reply | resolved | waiting_you
+  read_at timestamptz,         -- NULL = unread (counts in the orange badge)
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+ALTER TABLE public.plg_support_notifications ENABLE ROW LEVEL SECURITY;
+CREATE INDEX IF NOT EXISTS idx_plg_support_notifications_tenant ON public.plg_support_notifications(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_plg_support_notifications_user_unread ON public.plg_support_notifications(tenant_id, user_id, read_at);
+
+-- \u2500\u2500 per-tenant sequential number \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- Each account counts its requests from #1. The advisory lock serialises the
+-- read-then-write per tenant so two concurrent opens don't collide on the number.
+CREATE OR REPLACE FUNCTION public.plg_support_assign_number()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $fn$
+BEGIN
+  IF NEW.number IS NULL OR NEW.number = 0 THEN
+    PERFORM pg_advisory_xact_lock(hashtextextended('plg_support_requests:' || NEW.tenant_id::text, 0));
+    SELECT COALESCE(MAX(number), 0) + 1 INTO NEW.number
+    FROM public.plg_support_requests
+    WHERE tenant_id = NEW.tenant_id;
+  END IF;
+  RETURN NEW;
+END;
+$fn$;
+
+DROP TRIGGER IF EXISTS trg_plg_support_assign_number ON public.plg_support_requests;
+CREATE TRIGGER trg_plg_support_assign_number
+  BEFORE INSERT ON public.plg_support_requests
+  FOR EACH ROW EXECUTE FUNCTION public.plg_support_assign_number();
+
+-- \u2500\u2500 touch updated_at \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+CREATE OR REPLACE FUNCTION public.plg_support_touch_updated_at()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $fn$
+BEGIN
+  NEW.updated_at := now();
+  RETURN NEW;
+END;
+$fn$;
+
+DROP TRIGGER IF EXISTS trg_plg_support_requests_touch ON public.plg_support_requests;
+CREATE TRIGGER trg_plg_support_requests_touch
+  BEFORE UPDATE ON public.plg_support_requests
+  FOR EACH ROW EXECUTE FUNCTION public.plg_support_touch_updated_at();
+
+-- \u2500\u2500 row security + grants (idempotent) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+DO $rls$
+DECLARE t text;
+BEGIN
+  FOR t IN SELECT unnest(ARRAY[
+    'plg_support_requests',
+    'plg_support_request_messages',
+    'plg_support_request_events',
+    'plg_support_request_attachments',
+    'plg_support_notifications'
+  ])
+  LOOP
+    EXECUTE format('ALTER TABLE public.%I ENABLE ROW LEVEL SECURITY', t);
+    EXECUTE format('GRANT ALL ON public.%I TO authenticated', t);
+    EXECUTE format('GRANT ALL ON public.%I TO service_role', t);
+    BEGIN
+      EXECUTE format('GRANT MAINTAIN ON public.%I TO anon', t);
+    EXCEPTION WHEN insufficient_privilege OR undefined_object OR feature_not_supported THEN
+      RAISE NOTICE 'plg_support: skipped GRANT MAINTAIN on % (% )', t, SQLERRM;
+    END;
+    IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname='public' AND tablename=t AND policyname=t||'_select') THEN
+      EXECUTE format('CREATE POLICY %I ON public.%I FOR SELECT TO authenticated USING (tenant_id IN (SELECT public.user_tenant_ids()))', t||'_select', t);
+    END IF;
+    IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname='public' AND tablename=t AND policyname=t||'_insert') THEN
+      EXECUTE format('CREATE POLICY %I ON public.%I FOR INSERT TO authenticated WITH CHECK (tenant_id IN (SELECT public.user_tenant_ids()))', t||'_insert', t);
+    END IF;
+    IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname='public' AND tablename=t AND policyname=t||'_update') THEN
+      EXECUTE format('CREATE POLICY %I ON public.%I FOR UPDATE TO authenticated USING (tenant_id IN (SELECT public.user_tenant_ids()))', t||'_update', t);
+    END IF;
+    IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname='public' AND tablename=t AND policyname=t||'_delete') THEN
+      EXECUTE format('CREATE POLICY %I ON public.%I FOR DELETE TO authenticated USING (tenant_id IN (SELECT public.user_tenant_ids()))', t||'_delete', t);
+    END IF;
+  END LOOP;
+END $rls$;
+
+-- \u2500\u2500 attachments bucket (private; read by tenant folder) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- Path convention: <tenant_id>/<request_id>/<uuid>/<name>. A captura de tela
+-- pode ter nome e valor de cliente borrados mas ainda sens\xEDvel \u2014 bucket privado,
+-- servido por URL assinada de curta dura\xE7\xE3o; quem n\xE3o \xE9 do tenant n\xE3o alcan\xE7a.
+INSERT INTO storage.buckets (id, name, public, file_size_limit, allowed_mime_types)
+VALUES ('support-attachments', 'support-attachments', false, 20971520,
+        ARRAY['image/jpeg','image/png','image/webp','image/gif','application/pdf',
+              'text/plain','text/csv','audio/mpeg','audio/webm','video/mp4','video/webm'])
+ON CONFLICT (id) DO UPDATE SET
+  public             = EXCLUDED.public,
+  file_size_limit    = EXCLUDED.file_size_limit,
+  allowed_mime_types = EXCLUDED.allowed_mime_types;
+
+DROP POLICY IF EXISTS plg_support_attachments_read   ON storage.objects;
+DROP POLICY IF EXISTS plg_support_attachments_insert ON storage.objects;
+DROP POLICY IF EXISTS plg_support_attachments_update ON storage.objects;
+DROP POLICY IF EXISTS plg_support_attachments_delete ON storage.objects;
+
+CREATE POLICY plg_support_attachments_read ON storage.objects
+  FOR SELECT TO authenticated
+  USING (bucket_id = 'support-attachments'
+    AND (storage.foldername(name))[1] IN (SELECT public.user_tenant_ids()::text));
+
+CREATE POLICY plg_support_attachments_insert ON storage.objects
+  FOR INSERT TO authenticated
+  WITH CHECK (bucket_id = 'support-attachments'
+    AND (storage.foldername(name))[1] IN (SELECT public.user_tenant_ids()::text));
+
+CREATE POLICY plg_support_attachments_update ON storage.objects
+  FOR UPDATE TO authenticated
+  USING (bucket_id = 'support-attachments'
+    AND (storage.foldername(name))[1] IN (SELECT public.user_tenant_ids()::text))
+  WITH CHECK (bucket_id = 'support-attachments'
+    AND (storage.foldername(name))[1] IN (SELECT public.user_tenant_ids()::text));
+
+CREATE POLICY plg_support_attachments_delete ON storage.objects
+  FOR DELETE TO authenticated
+  USING (bucket_id = 'support-attachments'
+    AND (storage.foldername(name))[1] IN (SELECT public.user_tenant_ids()::text));
+`;
+var MIGRATION_001_HELPDESK = `-- plugin-support \u2014 2nd wave: the cross-tenant helpdesk the baseline foresaw
+-- ("the cross-member triage read is the 2nd wave with the platform bridge").
+--
+-- GoControl is the helpdesk: a small ALLOW-LIST of operators reads and acts on
+-- the support requests of EVERY tenant, through SECURITY DEFINER functions that
+-- carry the tenant boundary themselves. The per-tenant RLS from the baseline is
+-- untouched \u2014 a store still sees only its own requests. Only a seeded operator,
+-- and only through these functions, crosses it.
+--
+-- Idempotent. Additive only (new columns, a new table, new functions).
+
+SET check_function_bodies = false;
+
+-- \u2500\u2500 new columns on the request \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+ALTER TABLE public.plg_support_requests
+  ADD COLUMN IF NOT EXISTS priority text NOT NULL DEFAULT 'normal';  -- low|normal|high|urgent
+ALTER TABLE public.plg_support_requests
+  ADD COLUMN IF NOT EXISTS linked_lead_id uuid;      -- a CRM lead/client the operator tied to it
+ALTER TABLE public.plg_support_requests
+  ADD COLUMN IF NOT EXISTS linked_lead_name text;    -- denormalised: the operator's tenant, not the requester's
+
+-- \u2500\u2500 who may operate the helpdesk \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- The allow-list is the whole security boundary of the cross-tenant read. A row
+-- here is a GoControl support operator. Nobody writes this from the app; it is
+-- seeded by an admin (see agent-provision / seed script).
+CREATE TABLE IF NOT EXISTS public.plg_support_operators (
+  user_id    uuid PRIMARY KEY,
+  note       text,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+ALTER TABLE public.plg_support_operators ENABLE ROW LEVEL SECURITY;
+GRANT SELECT ON public.plg_support_operators TO authenticated;
+GRANT ALL    ON public.plg_support_operators TO service_role;
+-- A user may read ONLY their own row \u2014 enough to answer "am I an operator?" in
+-- the UI, and it reveals no one else.
+DROP POLICY IF EXISTS plg_support_operators_self ON public.plg_support_operators;
+CREATE POLICY plg_support_operators_self ON public.plg_support_operators
+  FOR SELECT TO authenticated USING (user_id = auth.uid());
+
+-- \u2500\u2500 gate \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- Operator = acting IN the helpdesk workspace. The caller's CURRENT tenant
+-- (app.current_tenant_id \u2014 the workspace they have open) must be the one that
+-- runs the helpdesk (support \`console\` facet active) AND they must be a member
+-- of it. So the console is strictly per-WORKSPACE: it works only while you are
+-- inside GoControl, never from a store, whoever you are. The plg_support_operators
+-- allow-list stays as an explicit extra, but it too only counts while you are in
+-- a helpdesk workspace \u2014 it never opens the console from a store.
+CREATE OR REPLACE FUNCTION public.support_is_operator()
+RETURNS boolean
+LANGUAGE sql STABLE SECURITY DEFINER SET search_path TO ''
+AS $fn$
+  SELECT EXISTS (
+    SELECT 1
+    FROM app.tenant_plugins tp
+    WHERE tp.plugin_id = 'support' AND tp.facet = 'console' AND tp.status = 'active'
+      AND tp.tenant_id = app.current_tenant_id()
+      AND (
+        EXISTS (
+          SELECT 1 FROM app.memberships m
+          WHERE m.tenant_id = tp.tenant_id AND m.user_id = auth.uid() AND m.active
+        )
+        OR EXISTS (SELECT 1 FROM public.plg_support_operators o WHERE o.user_id = auth.uid())
+      )
+  );
+$fn$;
+GRANT EXECUTE ON FUNCTION public.support_is_operator() TO authenticated;
+
+-- A guard the write functions share \u2014 raises if the caller is not an operator.
+CREATE OR REPLACE FUNCTION public.support_console_guard()
+RETURNS void
+LANGUAGE plpgsql STABLE SECURITY DEFINER SET search_path TO ''
+AS $fn$
+BEGIN
+  IF NOT public.support_is_operator() THEN
+    RAISE EXCEPTION 'not a support operator' USING ERRCODE = '42501';
+  END IF;
+END;
+$fn$;
+GRANT EXECUTE ON FUNCTION public.support_console_guard() TO authenticated;
+
+-- Resolve the auth user who opened a ticket to a human name: the person record
+-- in that tenant, else the signed-up full name, else the e-mail. So the console
+-- shows "Vini" instead of a uuid.
+CREATE OR REPLACE FUNCTION public._support_user_name(p_user uuid, p_tenant uuid)
+RETURNS text
+LANGUAGE sql STABLE SECURITY DEFINER SET search_path TO ''
+AS $fn$
+  SELECT COALESCE(
+    (SELECT NULLIF(btrim(p.name), '')
+       FROM app.memberships m JOIN public.people p ON p.id = m.person_id
+      WHERE m.user_id = p_user AND m.tenant_id = p_tenant LIMIT 1),
+    (SELECT NULLIF(btrim(u.raw_user_meta_data->>'full_name'), '') FROM auth.users u WHERE u.id = p_user),
+    (SELECT NULLIF(btrim(u.raw_user_meta_data->>'name'), '') FROM auth.users u WHERE u.id = p_user),
+    (SELECT u.email FROM auth.users u WHERE u.id = p_user)
+  );
+$fn$;
+GRANT EXECUTE ON FUNCTION public._support_user_name(uuid, uuid) TO authenticated;
+
+-- \u2500\u2500 read: every tenant's requests, for an operator \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+CREATE OR REPLACE FUNCTION public.support_console_requests(
+  p_statuses text[] DEFAULT NULL,
+  p_search   text   DEFAULT NULL
+)
+RETURNS jsonb
+LANGUAGE plpgsql STABLE SECURITY DEFINER SET search_path TO ''
+AS $fn$
+DECLARE result jsonb;
+BEGIN
+  PERFORM public.support_console_guard();
+  SELECT COALESCE(jsonb_agg(row_to_json(r)), '[]'::jsonb) INTO result
+  FROM (
+    SELECT
+      q.id, q.number, q.kind, q.subject, q.description, q.status, q.priority,
+      q.route, q.created_by, public._support_user_name(q.created_by, q.tenant_id) AS created_by_name,
+      q.created_at, q.updated_at,
+      q.linked_lead_id, q.linked_lead_name,
+      q.tenant_id, t.name AS tenant_name, t.slug AS tenant_slug,
+      (SELECT count(*) FROM public.plg_support_request_messages m WHERE m.request_id = q.id) AS message_count
+    FROM public.plg_support_requests q
+    LEFT JOIN public.tenants t ON t.id = q.tenant_id
+    WHERE (p_statuses IS NULL OR q.status = ANY(p_statuses))
+      AND (p_search IS NULL OR p_search = ''
+           OR q.subject ILIKE '%'||p_search||'%'
+           OR q.description ILIKE '%'||p_search||'%'
+           OR t.name ILIKE '%'||p_search||'%')
+    ORDER BY
+      CASE q.priority WHEN 'urgent' THEN 0 WHEN 'high' THEN 1 WHEN 'normal' THEN 2 ELSE 3 END,
+      q.updated_at DESC
+  ) r;
+  RETURN result;
+END;
+$fn$;
+GRANT EXECUTE ON FUNCTION public.support_console_requests(text[], text) TO authenticated;
+
+-- \u2500\u2500 read: one request in full \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+CREATE OR REPLACE FUNCTION public.support_console_detail(p_request_id uuid)
+RETURNS jsonb
+LANGUAGE plpgsql STABLE SECURITY DEFINER SET search_path TO ''
+AS $fn$
+DECLARE result jsonb;
+BEGIN
+  PERFORM public.support_console_guard();
+  SELECT jsonb_build_object(
+    'request', (SELECT row_to_json(x) FROM (
+        SELECT q.*, t.name AS tenant_name, t.slug AS tenant_slug,
+               public._support_user_name(q.created_by, q.tenant_id) AS created_by_name
+        FROM public.plg_support_requests q
+        LEFT JOIN public.tenants t ON t.id = q.tenant_id
+        WHERE q.id = p_request_id) x),
+    'messages', (SELECT COALESCE(jsonb_agg(row_to_json(m) ORDER BY m.created_at), '[]'::jsonb)
+                 FROM public.plg_support_request_messages m WHERE m.request_id = p_request_id),
+    'events', (SELECT COALESCE(jsonb_agg(row_to_json(e) ORDER BY e.created_at), '[]'::jsonb)
+               FROM public.plg_support_request_events e WHERE e.request_id = p_request_id),
+    'attachments', (SELECT COALESCE(jsonb_agg(row_to_json(a) ORDER BY a.created_at), '[]'::jsonb)
+                    FROM public.plg_support_request_attachments a WHERE a.request_id = p_request_id)
+  ) INTO result;
+  RETURN result;
+END;
+$fn$;
+GRANT EXECUTE ON FUNCTION public.support_console_detail(uuid) TO authenticated;
+
+-- Internal: drop one unread notice to the requester, in their own tenant.
+CREATE OR REPLACE FUNCTION public._support_notify(p_request_id uuid, p_kind text)
+RETURNS void
+LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
+AS $fn$
+DECLARE v_tenant uuid; v_user uuid;
+BEGIN
+  SELECT tenant_id, created_by INTO v_tenant, v_user
+  FROM public.plg_support_requests WHERE id = p_request_id;
+  IF v_user IS NULL THEN RETURN; END IF;
+  INSERT INTO public.plg_support_notifications (tenant_id, request_id, user_id, kind)
+  VALUES (v_tenant, p_request_id, v_user, p_kind);
+END;
+$fn$;
+
+-- \u2500\u2500 write: operator changes status (and the client hears about it) \u2500\u2500\u2500\u2500\u2500\u2500\u2500
+CREATE OR REPLACE FUNCTION public.support_console_set_status(
+  p_request_id uuid, p_status text, p_note text DEFAULT NULL
+)
+RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
+AS $fn$
+DECLARE v_tenant uuid;
+BEGIN
+  PERFORM public.support_console_guard();
+  IF p_status NOT IN ('received','in_service','waiting_you','in_development','resolved_check','closed','cancelled') THEN
+    RAISE EXCEPTION 'invalid status %', p_status USING ERRCODE = '22023';
+  END IF;
+  SELECT tenant_id INTO v_tenant FROM public.plg_support_requests WHERE id = p_request_id;
+  IF v_tenant IS NULL THEN RAISE EXCEPTION 'request not found' USING ERRCODE = 'P0002'; END IF;
+  UPDATE public.plg_support_requests
+    SET status = p_status,
+        resolved_at = CASE WHEN p_status IN ('resolved_check','closed') THEN now() ELSE resolved_at END
+    WHERE id = p_request_id;
+  INSERT INTO public.plg_support_request_events (tenant_id, request_id, type, note)
+    VALUES (v_tenant, p_request_id, 'status_changed', p_status);
+  PERFORM public._support_notify(p_request_id,
+    CASE WHEN p_status IN ('waiting_you','resolved_check') THEN 'waiting_you'
+         WHEN p_status IN ('closed') THEN 'resolved' ELSE 'reply' END);
+  RETURN public.support_console_detail(p_request_id);
+END;
+$fn$;
+GRANT EXECUTE ON FUNCTION public.support_console_set_status(uuid, text, text) TO authenticated;
+
+-- \u2500\u2500 write: operator sets priority \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+CREATE OR REPLACE FUNCTION public.support_console_set_priority(p_request_id uuid, p_priority text)
+RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
+AS $fn$
+BEGIN
+  PERFORM public.support_console_guard();
+  IF p_priority NOT IN ('low','normal','high','urgent') THEN
+    RAISE EXCEPTION 'invalid priority %', p_priority USING ERRCODE = '22023';
+  END IF;
+  UPDATE public.plg_support_requests SET priority = p_priority WHERE id = p_request_id;
+  RETURN public.support_console_detail(p_request_id);
+END;
+$fn$;
+GRANT EXECUTE ON FUNCTION public.support_console_set_priority(uuid, text) TO authenticated;
+
+-- \u2500\u2500 write: operator replies to the requester \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+CREATE OR REPLACE FUNCTION public.support_console_reply(p_request_id uuid, p_body text)
+RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
+AS $fn$
+DECLARE v_tenant uuid;
+BEGIN
+  PERFORM public.support_console_guard();
+  IF p_body IS NULL OR btrim(p_body) = '' THEN RAISE EXCEPTION 'empty message' USING ERRCODE = '22023'; END IF;
+  SELECT tenant_id INTO v_tenant FROM public.plg_support_requests WHERE id = p_request_id;
+  IF v_tenant IS NULL THEN RAISE EXCEPTION 'request not found' USING ERRCODE = 'P0002'; END IF;
+  INSERT INTO public.plg_support_request_messages (tenant_id, request_id, author_kind, author_id, body)
+    VALUES (v_tenant, p_request_id, 'team', auth.uid(), btrim(p_body));
+  PERFORM public._support_notify(p_request_id, 'reply');
+  RETURN public.support_console_detail(p_request_id);
+END;
+$fn$;
+GRANT EXECUTE ON FUNCTION public.support_console_reply(uuid, text) TO authenticated;
+
+-- \u2500\u2500 write: operator links a CRM lead/client \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+CREATE OR REPLACE FUNCTION public.support_console_link_lead(
+  p_request_id uuid, p_lead_id uuid, p_lead_name text DEFAULT NULL
+)
+RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
+AS $fn$
+BEGIN
+  PERFORM public.support_console_guard();
+  UPDATE public.plg_support_requests
+    SET linked_lead_id = p_lead_id, linked_lead_name = p_lead_name
+    WHERE id = p_request_id;
+  RETURN public.support_console_detail(p_request_id);
+END;
+$fn$;
+GRANT EXECUTE ON FUNCTION public.support_console_link_lead(uuid, uuid, text) TO authenticated;
+`;
+var MIGRATION_002_OPERATOR_ATTACHMENT_READ = `-- plugin-support \u2014 let a helpdesk OPERATOR open a chamado's attachments.
+-- Idempotent / replay-safe.
+--
+-- The bucket's read policy (000_baseline) scopes every object to its owning
+-- tenant: (storage.foldername(name))[1] IN user_tenant_ids(). That is right for
+-- the store, but the GoControl operator is in ANOTHER tenant, so the signed URL
+-- never comes back and the console shows "anexo" instead of the image. This adds
+-- a SECOND, permissive SELECT policy (RLS OR-combines them, so the tenant rule is
+-- untouched) that lets an operator read any support-attachments object \u2014 gated by
+-- the same support_is_operator() that guards the whole console. Read only: upload,
+-- update and delete stay tenant-scoped.
+DROP POLICY IF EXISTS plg_support_attachments_operator_read ON storage.objects;
+CREATE POLICY plg_support_attachments_operator_read ON storage.objects
+  FOR SELECT TO authenticated
+  USING (bucket_id = 'support-attachments' AND public.support_is_operator());
+`;
+var MIGRATION_003_OPERATOR_ATTACHMENT_READ_FIX = `-- plugin-support \u2014 make the operator attachment policy actually work from Storage.
+-- Idempotent / replay-safe.
+--
+-- 002 gated the operator read on support_is_operator(), which asks
+-- app.current_tenant_id() \u2014 the OPEN workspace. That GUC is set on the normal
+-- data API, but NOT on a Storage sign request, so inside the bucket policy it is
+-- null and the check fails: the operator still got a 400 and saw "anexo".
+--
+-- This swaps to a context-independent test that leans only on auth.uid() (always
+-- present from the JWT): the user is a seeded cross-tenant operator, OR an active
+-- member of a tenant that runs the console (the facet). Same intent as
+-- support_is_operator(), minus the current-workspace scoping that Storage cannot
+-- answer. SECURITY DEFINER so the lookups bypass RLS, like the original.
+CREATE OR REPLACE FUNCTION public.support_is_operator_global()
+RETURNS boolean
+LANGUAGE sql STABLE SECURITY DEFINER SET search_path TO ''
+AS $fn$
+  SELECT
+    EXISTS (SELECT 1 FROM public.plg_support_operators o WHERE o.user_id = auth.uid())
+    OR EXISTS (
+      SELECT 1
+      FROM app.tenant_plugins tp
+      JOIN app.memberships m
+        ON m.tenant_id = tp.tenant_id AND m.user_id = auth.uid() AND m.active
+      WHERE tp.plugin_id = 'support' AND tp.facet = 'console' AND tp.status = 'active'
+    );
+$fn$;
+GRANT EXECUTE ON FUNCTION public.support_is_operator_global() TO authenticated;
+
+DROP POLICY IF EXISTS plg_support_attachments_operator_read ON storage.objects;
+CREATE POLICY plg_support_attachments_operator_read ON storage.objects
+  FOR SELECT TO authenticated
+  USING (bucket_id = 'support-attachments' AND public.support_is_operator_global());
+`;
+var MIGRATIONS = [
+  { id: "000_baseline", sql: MIGRATION_000_BASELINE },
+  { id: "001_helpdesk", sql: MIGRATION_001_HELPDESK },
+  { id: "002_operator_attachment_read", sql: MIGRATION_002_OPERATOR_ATTACHMENT_READ },
+  { id: "003_operator_attachment_read_fix", sql: MIGRATION_003_OPERATOR_ATTACHMENT_READ_FIX }
+];
+var takeTurnReportFiles = null;
+function normalizeKind(raw) {
+  const s = String(raw ?? "").trim().toLowerCase();
+  if (["improvement", "melhoria", "sugestao", "sugest\xE3o", "suggestion"].some((k) => s.includes(k))) return "improvement";
+  if (["other", "outra", "outras", "outro", "solicitacao", "solicita\xE7\xE3o", "request"].some((k) => s.includes(k))) return "other";
+  return "problem";
+}
+function recentScreens(limit = 10) {
+  try {
+    const stack = useNavHistoryStore.getState().stack;
+    return stack.slice(-limit).reverse().map((e) => ({ path: e.path, label: e.label }));
+  } catch {
+    return [];
+  }
+}
+function currentRoute() {
+  if (typeof location === "undefined") return null;
+  return location.hash || location.pathname || null;
+}
+var supportAITools = [
+  {
+    id: "support.report-issue",
+    name: "reportIssue",
+    description: `REGISTERS a support request (problema, melhoria ou outra solicita\xE7\xE3o) for the Fayz team. Use this the moment the user is REPORTING that something is wrong, asking for a change, or raising a request you cannot resolve from the app itself \u2014 "n\xE3o consigo\u2026", "deu erro", "n\xE3o aparece a op\xE7\xE3o de\u2026", "seria bom se\u2026". This is the ONLY correct action for a report: do NOT call any other tool to investigate or "fix" it (no payable/reconciliation/record tools) \u2014 a complaint is not a work order, and guessing at a fix does nothing the user asked for. Before registering: call findSupportRequests to check the issue is not ALREADY open (if it is, do not duplicate \u2014 point the user to that #number). Then use the recent trail you were given to say what the user was doing, confirm the problem in one short question, and offer (do not require) a print. Then call this with a clear description IN THE USER'S OWN WORDS. It returns the request number \u2014 tell the user "registrei a sua solicita\xE7\xE3o, n\xFAmero #N, a equipe vai acompanhar" and STOP. The route and the recent screens are captured automatically; you do not pass them.`,
+    icon: "LifeBuoy",
+    mode: "persist",
+    // No confirmation card: the user already asked for it and the agent confirms
+    // in prose. The card would just show the technical params.
+    requiresConfirmation: false,
+    parameters: {
+      type: "object",
+      properties: {
+        kind: {
+          type: "string",
+          enum: ["problem", "improvement", "other"],
+          description: "problem = algo n\xE3o funcionou; improvement = sugest\xE3o de melhoria; other = treinamento, acesso, dados, comercial. Default problem."
+        },
+        description: {
+          type: "string",
+          description: "O que aconteceu, na linguagem do usu\xE1rio: o que ele fazia, o que esperava e o que apareceu."
+        },
+        subject: {
+          type: "string",
+          description: "Opcional. Um t\xEDtulo curto para a solicita\xE7\xE3o."
+        }
+      },
+      required: ["description"]
+    },
+    category: "Suporte",
+    suggestions: [
+      { label: "Quero reportar um problema", prompt: "Quero reportar um problema" },
+      { label: "Quero sugerir uma melhoria", prompt: "Quero sugerir uma melhoria" },
+      { label: "Tenho uma d\xFAvida", prompt: "Tenho uma d\xFAvida" },
+      { label: "Outra solicita\xE7\xE3o", prompt: "Tenho outra solicita\xE7\xE3o para a equipe" }
+    ]
+  },
+  {
+    id: "support.find-requests",
+    name: "findSupportRequests",
+    description: "Lists the user's OPEN support requests (solicita\xE7\xF5es em aberto). CALL THIS BEFORE registering a problem or improvement, to check whether the same thing is ALREADY reported. If an open request clearly covers the same issue, do NOT open a duplicate: tell the user it is already registered (give the #number and its status) and offer to add a note to it instead. Optional `query` filters by words from the user's complaint.",
+    icon: "Search",
+    mode: "read",
+    parameters: {
+      type: "object",
+      properties: {
+        query: { type: "string", description: "Palavras do que o usu\xE1rio est\xE1 relatando, para achar uma solicita\xE7\xE3o parecida. Opcional." }
+      }
+    },
+    category: "Suporte"
+  }
+];
+async function executeReportIssue(args) {
+  const description = String(args.description ?? "").trim();
+  if (description.length < 5) {
+    return {
+      ok: false,
+      error: "missing_description",
+      message: "Antes de registrar, pergunte ao usu\xE1rio o que aconteceu e descreva com as palavras dele (m\xEDnimo de uma frase)."
+    };
+  }
+  const kind = normalizeKind(args.kind);
+  const subject = typeof args.subject === "string" && args.subject.trim() ? args.subject.trim() : null;
+  try {
+    const res = await createRequest({
+      kind,
+      description,
+      subject,
+      route: currentRoute(),
+      // What the user was doing travels with the request, so the team reads it
+      // without a second round-trip. `activity` is the rich trail (routes +
+      // buttons pressed); `recentScreens` stays for tickets opened before it.
+      screenSnapshot: { activity: getRecentActivity(10), recentScreens: recentScreens() }
+    });
+    let attached = 0;
+    const files = takeTurnReportFiles ? takeTurnReportFiles() : [];
+    for (const file of files) {
+      const pending = {
+        id: crypto.randomUUID(),
+        file,
+        name: file.name || "anexo",
+        contentType: file.type || "application/octet-stream",
+        sizeBytes: file.size
+      };
+      try {
+        await uploadAttachment(res.id, pending);
+        attached += 1;
+      } catch {
+      }
+    }
+    try {
+      void useSupportStore.getState().loadList();
+    } catch {
+    }
+    return {
+      ok: true,
+      id: res.id,
+      number: res.number,
+      status: "received",
+      attachments: attached,
+      ref: { id: res.id, label: `Solicita\xE7\xE3o #${res.number}`, path: `/support/ticket/${res.id}` },
+      message: `Solicita\xE7\xE3o #${res.number} registrada${attached ? ` com ${attached} anexo(s)` : ""}. Diga ao usu\xE1rio o n\xFAmero e que a equipe vai acompanhar. N\xC3O chame mais nenhuma ferramenta \u2014 o relato est\xE1 registrado.`
+    };
+  } catch (error) {
+    return {
+      ok: false,
+      error: "write_failed",
+      message: error instanceof Error ? error.message : "N\xE3o consegui registrar a solicita\xE7\xE3o."
+    };
+  }
+}
+function isOpen(status) {
+  return status !== "closed" && status !== "cancelled";
+}
+async function executeFindRequests(args) {
+  const query = String(args.query ?? "").trim().toLowerCase();
+  const terms = query.split(/[^\p{L}\p{N}]+/u).filter((w) => w.length > 2);
+  let open;
+  try {
+    open = (await listRequests("mine", "all")).filter((r) => isOpen(r.status));
+  } catch (error) {
+    return { error: "read_failed", message: error instanceof Error ? error.message : "N\xE3o consegui ler as solicita\xE7\xF5es." };
+  }
+  const scored = open.map((r) => {
+    const hay = `${r.subject ?? ""} ${r.description}`.toLowerCase();
+    const score = terms.length ? terms.filter((t) => hay.includes(t)).length : 0;
+    return { r, score };
+  }).sort((a, b) => b.score - a.score || b.r.number - a.r.number);
+  const picked = (terms.length ? scored.filter((s) => s.score > 0) : scored).slice(0, 10);
+  return {
+    total: picked.length,
+    openTotal: open.length,
+    requests: picked.map(({ r }) => ({
+      number: r.number,
+      kind: r.kind,
+      subject: r.subject || r.description.slice(0, 80),
+      status: r.status,
+      createdAt: r.createdAt,
+      ref: { id: r.id, label: `Solicita\xE7\xE3o #${r.number}`, path: `/support/ticket/${r.id}` }
+    })),
+    hint: picked.length ? "If one of these is clearly the SAME issue the user is reporting now, do not open a duplicate \u2014 say it is already registered (#number + status) and offer to add a note." : "Nothing similar is open \u2014 go ahead and register the new request."
+  };
+}
+var registered = false;
+function registerSupportAITools() {
+  if (registered || typeof document === "undefined") return;
+  registered = true;
+  void import('@fayz-ai/admin').then((admin) => {
+    takeTurnReportFiles = admin.takeTurnReportFiles;
+    admin.registerAIToolHandler("reportIssue", (args) => executeReportIssue(args));
+    admin.registerAIToolHandler("findSupportRequests", (args) => executeFindRequests(args));
+  }).catch(() => {
+    registered = false;
+  });
+}
+function go(path) {
+  if (typeof window !== "undefined") window.location.hash = path;
+}
+var STATUS_ORDER = [
+  "received",
+  "in_service",
+  "waiting_you",
+  "in_development",
+  "resolved_check",
+  "closed",
+  "cancelled"
+];
+function HelpdeskStatusPanel({ tenantId } = {}) {
+  const [requests, setRequests] = React2.useState([]);
+  const [loading, setLoading] = React2.useState(true);
+  React2.useEffect(() => {
+    let alive = true;
+    setLoading(true);
+    consoleListRequests(void 0, "").then((r) => {
+      if (alive) setRequests(tenantId ? r.filter((x) => x.tenantId === tenantId) : r);
+    }).catch(() => {
+      if (alive) setRequests([]);
+    }).finally(() => {
+      if (alive) setLoading(false);
+    });
+    return () => {
+      alive = false;
+    };
+  }, [tenantId]);
+  const byStatus = STATUS_ORDER.map((s) => ({ status: s, items: requests.filter((r) => r.status === s) })).filter((g) => g.items.length > 0);
+  if (loading) {
+    return /* @__PURE__ */ jsx("div", { className: "space-y-2 p-1", children: [0, 1].map((i) => /* @__PURE__ */ jsx(Skeleton, { className: "h-14 w-full" }, i)) });
+  }
+  if (requests.length === 0) {
+    return /* @__PURE__ */ jsx("p", { className: "text-xs text-muted-foreground", children: tenantId ? "Esta loja n\xE3o tem chamados." : "Nenhum chamado por aqui." });
+  }
+  return /* @__PURE__ */ jsxs("div", { className: "flex flex-col gap-3", children: [
+    !tenantId && /* @__PURE__ */ jsxs("p", { className: "px-1 text-xs text-muted-foreground", children: [
+      requests.length,
+      " chamado(s) de todas as lojas."
+    ] }),
+    byStatus.map((g) => /* @__PURE__ */ jsxs("div", { className: "flex flex-col gap-1.5", children: [
+      /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-2 px-1", children: [
+        /* @__PURE__ */ jsx(Badge, { variant: STATUS_TONE[g.status], children: STATUS_LABEL[g.status] }),
+        /* @__PURE__ */ jsx("span", { className: "text-[11px] text-muted-foreground", children: g.items.length })
+      ] }),
+      g.items.map((r) => /* @__PURE__ */ jsxs(
+        "button",
+        {
+          onClick: () => go(`/support/console/${r.id}`),
+          className: "flex w-full flex-col gap-0.5 rounded-lg border bg-card p-2 text-left transition-colors hover:border-primary/40 hover:bg-accent",
+          children: [
+            /* @__PURE__ */ jsxs("div", { className: "flex items-center justify-between gap-2 text-[11px] text-muted-foreground", children: [
+              /* @__PURE__ */ jsx("span", { className: "truncate font-medium text-foreground", children: r.tenantName ?? "Loja" }),
+              /* @__PURE__ */ jsxs("span", { children: [
+                "#",
+                r.number
+              ] })
+            ] }),
+            /* @__PURE__ */ jsx("div", { className: "truncate text-xs", children: r.subject || r.description.slice(0, 60) })
+          ]
+        },
+        r.id
+      ))
+    ] }, g.status))
+  ] });
+}
+
+// src/index.ts
+var LazySupportCenter = React2.lazy(() => import('./SupportCenter-Z2HEPJGD.js'));
+var LazyHelpdeskConsole = React2.lazy(() => import('./HelpdeskConsole-7W5IAQIU.js'));
+var HelpdeskConsolePage = () => React2.createElement(
+  React2.Suspense,
+  { fallback: React2.createElement("div", { className: "p-6 text-sm text-muted-foreground" }, "Carregando\u2026") },
+  React2.createElement(LazyHelpdeskConsole, null)
+);
+function createSupportPlugin(options) {
+  const label = options?.label ?? "Suporte";
+  registerTranslations(supportLocales);
+  registerSupportAITools();
+  const content = {
+    faq: options?.faq ?? defaultFaq,
+    whatsNew: options?.whatsNew ?? defaultWhatsNew,
+    statusComponents: options?.statusComponents ?? defaultStatusComponents
+  };
+  const SupportPage = () => React2.createElement(
+    React2.Suspense,
+    { fallback: React2.createElement("div", { className: "p-6 text-sm text-muted-foreground" }, "Carregando\u2026") },
+    React2.createElement(LazySupportCenter, { content })
+  );
+  return {
+    id: "support",
+    name: label,
+    icon: "LifeBuoy",
+    version: "0.1.0",
+    scope: options?.scope ?? "universal",
+    verticalId: options?.verticalId,
+    defaultEnabled: true,
+    dependencies: [],
+    // Support is for everyone, like the V1 support panel ("nasce liberada em
+    // todos os perfis") — so the route is open to any authenticated user rather
+    // than gated by a deny-by-default feature. Only `support.all` is a declared
+    // permission: it unlocks the "Toda a empresa" view, and ships denied (the
+    // admin/owner holds it).
+    declaredFeatures: [
+      { id: "support.all", label: "Solicita\xE7\xF5es de toda a empresa", group: label }
+    ],
+    // The requester reaches Suporte from the user menu. The OPERATOR console line
+    // is gated by the `console` FACET — it shows ONLY in the workspace that runs
+    // the helpdesk (GoControl), where the facet is on. In a store (Pertinho,
+    // Artorius…) the facet is off, so the line is absent no matter who is logged
+    // in. It is a per-TENANT line: you see it when you are IN the GoControl
+    // workspace, not because of who you are.
+    navigation: [
+      {
+        id: "support-console",
+        section: "main",
+        position: 45,
+        label: "Central de Chamados",
+        route: "/support/console",
+        icon: "LifeBuoy",
+        // Sit right below "Clientes": land above the line the rail draws next
+        // after it (AtendeAI, then the CRM/financial block).
+        before: ["/atendeai", "/sales", "/financial"],
+        requiresFacet: "console"
+      }
+    ],
+    // Off for every tenant by default; enabled only for the helpdesk workspace
+    // with scripts/support-enable-console.mjs. A store that turns on Suporte does
+    // NOT get it.
+    facets: [
+      {
+        id: "console",
+        label: "Central de Chamados (operador)",
+        description: "O console cross-tenant do suporte \u2014 s\xF3 no workspace que opera o helpdesk."
+      }
+    ],
+    // "Modo relato": the assistant registers a request instead of improvising a
+    // fix. The executor is wired above (registerSupportAITools); the opener
+    // suggestions ride on the tool (the V1 doors).
+    aiTools: supportAITools,
+    routes: [
+      {
+        path: "/support",
+        component: SupportPage,
+        guard: "authenticated"
+      },
+      {
+        // The helpdesk console. Open to any authenticated user as a route; the
+        // view calls support_is_operator() and shows "acesso restrito" to a
+        // non-operator, and every data call is gated server-side anyway.
+        path: "/support/console",
+        component: HelpdeskConsolePage,
+        guard: "authenticated",
+        title: "Central de Chamados"
+      }
+    ],
+    migrations: MIGRATIONS.map((entry) => ({
+      id: `support-${entry.id}`,
+      version: "0.1.0",
+      sql: entry.sql,
+      description: "Central de Suporte do Dico: the plg_support_* tables (requests, messages, events, attachments, notifications), their RLS, the per-tenant number trigger and the private support-attachments bucket."
+    })),
+    locales: supportLocales
+  };
+}
+
+export { HelpdeskStatusPanel, createSupportPlugin };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map