@fayz-ai/plugin-support 0.2.12 → 0.2.14

package/dist/migrations/main.js

@@ -0,0 +1,529 @@
+// src/migrations/index.ts
+var MIGRATION_000_BASELINE = `-- plugin-support \u2014 Central de Suporte do Dico: the solicita\xE7\xF5es a tenant files
+-- (problem / improvement / other), their conversation, history, attachments and
+-- the "esperando voc\xEA" notifications. Port of the V1 support_* family.
+--
+-- Idempotent. Canonical RLS form: tenant_id IN (SELECT public.user_tenant_ids()).
+-- "Minhas vs Toda a empresa" is a query-layer filter on created_by, gated by the
+-- support.all feature \u2014 not an RLS distinction (the fleet has no SQL permission
+-- helper, and the cross-member triage read is the 2nd wave with the platform bridge).
+
+SET check_function_bodies = false;
+
+-- \u2500\u2500 tables \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+-- The request itself. Carries, unseen by the person, the screen it was filed
+-- from (route, active unit, a snapshot of what was visible) \u2014 triage reads it first.
+CREATE TABLE IF NOT EXISTS public.plg_support_requests (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  number integer NOT NULL,                 -- per-tenant sequential #; filled by trigger
+  kind text NOT NULL,                      -- problem | improvement | other
+  subject text,                            -- optional; derived from first line when blank
+  description text NOT NULL,
+  status text NOT NULL DEFAULT 'received', -- received|in_service|waiting_you|in_development|resolved_check|closed|cancelled
+  route text,                              -- origin screen hash path
+  unit_id uuid,                            -- active unit when filed (informational snapshot, no FK)
+  screen_snapshot jsonb NOT NULL DEFAULT '{}'::jsonb,
+  origin_conversation_id uuid,             -- the Dico chat that spawned it, when any
+  area text,
+  created_by uuid NOT NULL DEFAULT auth.uid(), -- auth user; the owner of "Minhas". Default so the client cannot spoof it.
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  resolved_at timestamptz,
+  metadata jsonb NOT NULL DEFAULT '{}'::jsonb
+);
+ALTER TABLE public.plg_support_requests ENABLE ROW LEVEL SECURITY;
+CREATE INDEX IF NOT EXISTS idx_plg_support_requests_tenant ON public.plg_support_requests(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_plg_support_requests_tenant_created_by ON public.plg_support_requests(tenant_id, created_by);
+CREATE INDEX IF NOT EXISTS idx_plg_support_requests_tenant_status ON public.plg_support_requests(tenant_id, status);
+CREATE UNIQUE INDEX IF NOT EXISTS uq_plg_support_requests_tenant_number ON public.plg_support_requests(tenant_id, number);
+
+-- The conversation inside the request ("Escreva para a equipe\u2026").
+CREATE TABLE IF NOT EXISTS public.plg_support_request_messages (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  request_id uuid NOT NULL REFERENCES public.plg_support_requests(id) ON DELETE CASCADE,
+  author_kind text NOT NULL DEFAULT 'user', -- user | team
+  author_id uuid DEFAULT auth.uid(),
+  body text NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+ALTER TABLE public.plg_support_request_messages ENABLE ROW LEVEL SECURITY;
+CREATE INDEX IF NOT EXISTS idx_plg_support_request_messages_tenant ON public.plg_support_request_messages(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_plg_support_request_messages_request ON public.plg_support_request_messages(request_id, created_at);
+
+-- The short-sentence history shown in the detail ("Solicita\xE7\xE3o aberta", "Andamento: Cancelada").
+CREATE TABLE IF NOT EXISTS public.plg_support_request_events (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  request_id uuid NOT NULL REFERENCES public.plg_support_requests(id) ON DELETE CASCADE,
+  type text NOT NULL,  -- opened|status_changed|validated_ok|reopened|cancelled|closed_no_reply|merged
+  note text,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+ALTER TABLE public.plg_support_request_events ENABLE ROW LEVEL SECURITY;
+CREATE INDEX IF NOT EXISTS idx_plg_support_request_events_tenant ON public.plg_support_request_events(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_plg_support_request_events_request ON public.plg_support_request_events(request_id, created_at);
+
+-- Attachment pointers; the file itself lives in the support-attachments bucket.
+CREATE TABLE IF NOT EXISTS public.plg_support_request_attachments (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  request_id uuid NOT NULL REFERENCES public.plg_support_requests(id) ON DELETE CASCADE,
+  storage_path text NOT NULL,  -- <tenant_id>/<request_id>/<uuid>/<name>
+  name text NOT NULL,
+  size_bytes bigint,
+  content_type text,
+  created_by uuid DEFAULT auth.uid(),
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+ALTER TABLE public.plg_support_request_attachments ENABLE ROW LEVEL SECURITY;
+CREATE INDEX IF NOT EXISTS idx_plg_support_request_attachments_tenant ON public.plg_support_request_attachments(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_plg_support_request_attachments_request ON public.plg_support_request_attachments(request_id);
+
+-- The orange "Esperando voc\xEA" counter and the bell notice when the team replies.
+CREATE TABLE IF NOT EXISTS public.plg_support_notifications (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  request_id uuid NOT NULL REFERENCES public.plg_support_requests(id) ON DELETE CASCADE,
+  user_id uuid NOT NULL,       -- who should see it
+  kind text,                   -- reply | resolved | waiting_you
+  read_at timestamptz,         -- NULL = unread (counts in the orange badge)
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+ALTER TABLE public.plg_support_notifications ENABLE ROW LEVEL SECURITY;
+CREATE INDEX IF NOT EXISTS idx_plg_support_notifications_tenant ON public.plg_support_notifications(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_plg_support_notifications_user_unread ON public.plg_support_notifications(tenant_id, user_id, read_at);
+
+-- \u2500\u2500 per-tenant sequential number \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- Each account counts its requests from #1. The advisory lock serialises the
+-- read-then-write per tenant so two concurrent opens don't collide on the number.
+CREATE OR REPLACE FUNCTION public.plg_support_assign_number()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $fn$
+BEGIN
+  IF NEW.number IS NULL OR NEW.number = 0 THEN
+    PERFORM pg_advisory_xact_lock(hashtextextended('plg_support_requests:' || NEW.tenant_id::text, 0));
+    SELECT COALESCE(MAX(number), 0) + 1 INTO NEW.number
+    FROM public.plg_support_requests
+    WHERE tenant_id = NEW.tenant_id;
+  END IF;
+  RETURN NEW;
+END;
+$fn$;
+
+DROP TRIGGER IF EXISTS trg_plg_support_assign_number ON public.plg_support_requests;
+CREATE TRIGGER trg_plg_support_assign_number
+  BEFORE INSERT ON public.plg_support_requests
+  FOR EACH ROW EXECUTE FUNCTION public.plg_support_assign_number();
+
+-- \u2500\u2500 touch updated_at \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+CREATE OR REPLACE FUNCTION public.plg_support_touch_updated_at()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $fn$
+BEGIN
+  NEW.updated_at := now();
+  RETURN NEW;
+END;
+$fn$;
+
+DROP TRIGGER IF EXISTS trg_plg_support_requests_touch ON public.plg_support_requests;
+CREATE TRIGGER trg_plg_support_requests_touch
+  BEFORE UPDATE ON public.plg_support_requests
+  FOR EACH ROW EXECUTE FUNCTION public.plg_support_touch_updated_at();
+
+-- \u2500\u2500 row security + grants (idempotent) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+DO $rls$
+DECLARE t text;
+BEGIN
+  FOR t IN SELECT unnest(ARRAY[
+    'plg_support_requests',
+    'plg_support_request_messages',
+    'plg_support_request_events',
+    'plg_support_request_attachments',
+    'plg_support_notifications'
+  ])
+  LOOP
+    EXECUTE format('ALTER TABLE public.%I ENABLE ROW LEVEL SECURITY', t);
+    EXECUTE format('GRANT ALL ON public.%I TO authenticated', t);
+    EXECUTE format('GRANT ALL ON public.%I TO service_role', t);
+    BEGIN
+      EXECUTE format('GRANT MAINTAIN ON public.%I TO anon', t);
+    EXCEPTION WHEN insufficient_privilege OR undefined_object OR feature_not_supported THEN
+      RAISE NOTICE 'plg_support: skipped GRANT MAINTAIN on % (% )', t, SQLERRM;
+    END;
+    IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname='public' AND tablename=t AND policyname=t||'_select') THEN
+      EXECUTE format('CREATE POLICY %I ON public.%I FOR SELECT TO authenticated USING (tenant_id IN (SELECT public.user_tenant_ids()))', t||'_select', t);
+    END IF;
+    IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname='public' AND tablename=t AND policyname=t||'_insert') THEN
+      EXECUTE format('CREATE POLICY %I ON public.%I FOR INSERT TO authenticated WITH CHECK (tenant_id IN (SELECT public.user_tenant_ids()))', t||'_insert', t);
+    END IF;
+    IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname='public' AND tablename=t AND policyname=t||'_update') THEN
+      EXECUTE format('CREATE POLICY %I ON public.%I FOR UPDATE TO authenticated USING (tenant_id IN (SELECT public.user_tenant_ids()))', t||'_update', t);
+    END IF;
+    IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname='public' AND tablename=t AND policyname=t||'_delete') THEN
+      EXECUTE format('CREATE POLICY %I ON public.%I FOR DELETE TO authenticated USING (tenant_id IN (SELECT public.user_tenant_ids()))', t||'_delete', t);
+    END IF;
+  END LOOP;
+END $rls$;
+
+-- \u2500\u2500 attachments bucket (private; read by tenant folder) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- Path convention: <tenant_id>/<request_id>/<uuid>/<name>. A captura de tela
+-- pode ter nome e valor de cliente borrados mas ainda sens\xEDvel \u2014 bucket privado,
+-- servido por URL assinada de curta dura\xE7\xE3o; quem n\xE3o \xE9 do tenant n\xE3o alcan\xE7a.
+INSERT INTO storage.buckets (id, name, public, file_size_limit, allowed_mime_types)
+VALUES ('support-attachments', 'support-attachments', false, 20971520,
+        ARRAY['image/jpeg','image/png','image/webp','image/gif','application/pdf',
+              'text/plain','text/csv','audio/mpeg','audio/webm','video/mp4','video/webm'])
+ON CONFLICT (id) DO UPDATE SET
+  public             = EXCLUDED.public,
+  file_size_limit    = EXCLUDED.file_size_limit,
+  allowed_mime_types = EXCLUDED.allowed_mime_types;
+
+DROP POLICY IF EXISTS plg_support_attachments_read   ON storage.objects;
+DROP POLICY IF EXISTS plg_support_attachments_insert ON storage.objects;
+DROP POLICY IF EXISTS plg_support_attachments_update ON storage.objects;
+DROP POLICY IF EXISTS plg_support_attachments_delete ON storage.objects;
+
+CREATE POLICY plg_support_attachments_read ON storage.objects
+  FOR SELECT TO authenticated
+  USING (bucket_id = 'support-attachments'
+    AND (storage.foldername(name))[1] IN (SELECT public.user_tenant_ids()::text));
+
+CREATE POLICY plg_support_attachments_insert ON storage.objects
+  FOR INSERT TO authenticated
+  WITH CHECK (bucket_id = 'support-attachments'
+    AND (storage.foldername(name))[1] IN (SELECT public.user_tenant_ids()::text));
+
+CREATE POLICY plg_support_attachments_update ON storage.objects
+  FOR UPDATE TO authenticated
+  USING (bucket_id = 'support-attachments'
+    AND (storage.foldername(name))[1] IN (SELECT public.user_tenant_ids()::text))
+  WITH CHECK (bucket_id = 'support-attachments'
+    AND (storage.foldername(name))[1] IN (SELECT public.user_tenant_ids()::text));
+
+CREATE POLICY plg_support_attachments_delete ON storage.objects
+  FOR DELETE TO authenticated
+  USING (bucket_id = 'support-attachments'
+    AND (storage.foldername(name))[1] IN (SELECT public.user_tenant_ids()::text));
+`;
+var MIGRATION_001_HELPDESK = `-- plugin-support \u2014 2nd wave: the cross-tenant helpdesk the baseline foresaw
+-- ("the cross-member triage read is the 2nd wave with the platform bridge").
+--
+-- GoControl is the helpdesk: a small ALLOW-LIST of operators reads and acts on
+-- the support requests of EVERY tenant, through SECURITY DEFINER functions that
+-- carry the tenant boundary themselves. The per-tenant RLS from the baseline is
+-- untouched \u2014 a store still sees only its own requests. Only a seeded operator,
+-- and only through these functions, crosses it.
+--
+-- Idempotent. Additive only (new columns, a new table, new functions).
+
+SET check_function_bodies = false;
+
+-- \u2500\u2500 new columns on the request \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+ALTER TABLE public.plg_support_requests
+  ADD COLUMN IF NOT EXISTS priority text NOT NULL DEFAULT 'normal';  -- low|normal|high|urgent
+ALTER TABLE public.plg_support_requests
+  ADD COLUMN IF NOT EXISTS linked_lead_id uuid;      -- a CRM lead/client the operator tied to it
+ALTER TABLE public.plg_support_requests
+  ADD COLUMN IF NOT EXISTS linked_lead_name text;    -- denormalised: the operator's tenant, not the requester's
+
+-- \u2500\u2500 who may operate the helpdesk \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- The allow-list is the whole security boundary of the cross-tenant read. A row
+-- here is a GoControl support operator. Nobody writes this from the app; it is
+-- seeded by an admin (see agent-provision / seed script).
+CREATE TABLE IF NOT EXISTS public.plg_support_operators (
+  user_id    uuid PRIMARY KEY,
+  note       text,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+ALTER TABLE public.plg_support_operators ENABLE ROW LEVEL SECURITY;
+GRANT SELECT ON public.plg_support_operators TO authenticated;
+GRANT ALL    ON public.plg_support_operators TO service_role;
+-- A user may read ONLY their own row \u2014 enough to answer "am I an operator?" in
+-- the UI, and it reveals no one else.
+DROP POLICY IF EXISTS plg_support_operators_self ON public.plg_support_operators;
+CREATE POLICY plg_support_operators_self ON public.plg_support_operators
+  FOR SELECT TO authenticated USING (user_id = auth.uid());
+
+-- \u2500\u2500 gate \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- Operator = acting IN the helpdesk workspace. The caller's CURRENT tenant
+-- (app.current_tenant_id \u2014 the workspace they have open) must be the one that
+-- runs the helpdesk (support \`console\` facet active) AND they must be a member
+-- of it. So the console is strictly per-WORKSPACE: it works only while you are
+-- inside GoControl, never from a store, whoever you are. The plg_support_operators
+-- allow-list stays as an explicit extra, but it too only counts while you are in
+-- a helpdesk workspace \u2014 it never opens the console from a store.
+CREATE OR REPLACE FUNCTION public.support_is_operator()
+RETURNS boolean
+LANGUAGE sql STABLE SECURITY DEFINER SET search_path TO ''
+AS $fn$
+  SELECT EXISTS (
+    SELECT 1
+    FROM app.tenant_plugins tp
+    WHERE tp.plugin_id = 'support' AND tp.facet = 'console' AND tp.status = 'active'
+      AND tp.tenant_id = app.current_tenant_id()
+      AND (
+        EXISTS (
+          SELECT 1 FROM app.memberships m
+          WHERE m.tenant_id = tp.tenant_id AND m.user_id = auth.uid() AND m.active
+        )
+        OR EXISTS (SELECT 1 FROM public.plg_support_operators o WHERE o.user_id = auth.uid())
+      )
+  );
+$fn$;
+GRANT EXECUTE ON FUNCTION public.support_is_operator() TO authenticated;
+
+-- A guard the write functions share \u2014 raises if the caller is not an operator.
+CREATE OR REPLACE FUNCTION public.support_console_guard()
+RETURNS void
+LANGUAGE plpgsql STABLE SECURITY DEFINER SET search_path TO ''
+AS $fn$
+BEGIN
+  IF NOT public.support_is_operator() THEN
+    RAISE EXCEPTION 'not a support operator' USING ERRCODE = '42501';
+  END IF;
+END;
+$fn$;
+GRANT EXECUTE ON FUNCTION public.support_console_guard() TO authenticated;
+
+-- Resolve the auth user who opened a ticket to a human name: the person record
+-- in that tenant, else the signed-up full name, else the e-mail. So the console
+-- shows "Vini" instead of a uuid.
+CREATE OR REPLACE FUNCTION public._support_user_name(p_user uuid, p_tenant uuid)
+RETURNS text
+LANGUAGE sql STABLE SECURITY DEFINER SET search_path TO ''
+AS $fn$
+  SELECT COALESCE(
+    (SELECT NULLIF(btrim(p.name), '')
+       FROM app.memberships m JOIN public.people p ON p.id = m.person_id
+      WHERE m.user_id = p_user AND m.tenant_id = p_tenant LIMIT 1),
+    (SELECT NULLIF(btrim(u.raw_user_meta_data->>'full_name'), '') FROM auth.users u WHERE u.id = p_user),
+    (SELECT NULLIF(btrim(u.raw_user_meta_data->>'name'), '') FROM auth.users u WHERE u.id = p_user),
+    (SELECT u.email FROM auth.users u WHERE u.id = p_user)
+  );
+$fn$;
+GRANT EXECUTE ON FUNCTION public._support_user_name(uuid, uuid) TO authenticated;
+
+-- \u2500\u2500 read: every tenant's requests, for an operator \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+CREATE OR REPLACE FUNCTION public.support_console_requests(
+  p_statuses text[] DEFAULT NULL,
+  p_search   text   DEFAULT NULL
+)
+RETURNS jsonb
+LANGUAGE plpgsql STABLE SECURITY DEFINER SET search_path TO ''
+AS $fn$
+DECLARE result jsonb;
+BEGIN
+  PERFORM public.support_console_guard();
+  SELECT COALESCE(jsonb_agg(row_to_json(r)), '[]'::jsonb) INTO result
+  FROM (
+    SELECT
+      q.id, q.number, q.kind, q.subject, q.description, q.status, q.priority,
+      q.route, q.created_by, public._support_user_name(q.created_by, q.tenant_id) AS created_by_name,
+      q.created_at, q.updated_at,
+      q.linked_lead_id, q.linked_lead_name,
+      q.tenant_id, t.name AS tenant_name, t.slug AS tenant_slug,
+      (SELECT count(*) FROM public.plg_support_request_messages m WHERE m.request_id = q.id) AS message_count
+    FROM public.plg_support_requests q
+    LEFT JOIN public.tenants t ON t.id = q.tenant_id
+    WHERE (p_statuses IS NULL OR q.status = ANY(p_statuses))
+      AND (p_search IS NULL OR p_search = ''
+           OR q.subject ILIKE '%'||p_search||'%'
+           OR q.description ILIKE '%'||p_search||'%'
+           OR t.name ILIKE '%'||p_search||'%')
+    ORDER BY
+      CASE q.priority WHEN 'urgent' THEN 0 WHEN 'high' THEN 1 WHEN 'normal' THEN 2 ELSE 3 END,
+      q.updated_at DESC
+  ) r;
+  RETURN result;
+END;
+$fn$;
+GRANT EXECUTE ON FUNCTION public.support_console_requests(text[], text) TO authenticated;
+
+-- \u2500\u2500 read: one request in full \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+CREATE OR REPLACE FUNCTION public.support_console_detail(p_request_id uuid)
+RETURNS jsonb
+LANGUAGE plpgsql STABLE SECURITY DEFINER SET search_path TO ''
+AS $fn$
+DECLARE result jsonb;
+BEGIN
+  PERFORM public.support_console_guard();
+  SELECT jsonb_build_object(
+    'request', (SELECT row_to_json(x) FROM (
+        SELECT q.*, t.name AS tenant_name, t.slug AS tenant_slug,
+               public._support_user_name(q.created_by, q.tenant_id) AS created_by_name
+        FROM public.plg_support_requests q
+        LEFT JOIN public.tenants t ON t.id = q.tenant_id
+        WHERE q.id = p_request_id) x),
+    'messages', (SELECT COALESCE(jsonb_agg(row_to_json(m) ORDER BY m.created_at), '[]'::jsonb)
+                 FROM public.plg_support_request_messages m WHERE m.request_id = p_request_id),
+    'events', (SELECT COALESCE(jsonb_agg(row_to_json(e) ORDER BY e.created_at), '[]'::jsonb)
+               FROM public.plg_support_request_events e WHERE e.request_id = p_request_id),
+    'attachments', (SELECT COALESCE(jsonb_agg(row_to_json(a) ORDER BY a.created_at), '[]'::jsonb)
+                    FROM public.plg_support_request_attachments a WHERE a.request_id = p_request_id)
+  ) INTO result;
+  RETURN result;
+END;
+$fn$;
+GRANT EXECUTE ON FUNCTION public.support_console_detail(uuid) TO authenticated;
+
+-- Internal: drop one unread notice to the requester, in their own tenant.
+CREATE OR REPLACE FUNCTION public._support_notify(p_request_id uuid, p_kind text)
+RETURNS void
+LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
+AS $fn$
+DECLARE v_tenant uuid; v_user uuid;
+BEGIN
+  SELECT tenant_id, created_by INTO v_tenant, v_user
+  FROM public.plg_support_requests WHERE id = p_request_id;
+  IF v_user IS NULL THEN RETURN; END IF;
+  INSERT INTO public.plg_support_notifications (tenant_id, request_id, user_id, kind)
+  VALUES (v_tenant, p_request_id, v_user, p_kind);
+END;
+$fn$;
+
+-- \u2500\u2500 write: operator changes status (and the client hears about it) \u2500\u2500\u2500\u2500\u2500\u2500\u2500
+CREATE OR REPLACE FUNCTION public.support_console_set_status(
+  p_request_id uuid, p_status text, p_note text DEFAULT NULL
+)
+RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
+AS $fn$
+DECLARE v_tenant uuid;
+BEGIN
+  PERFORM public.support_console_guard();
+  IF p_status NOT IN ('received','in_service','waiting_you','in_development','resolved_check','closed','cancelled') THEN
+    RAISE EXCEPTION 'invalid status %', p_status USING ERRCODE = '22023';
+  END IF;
+  SELECT tenant_id INTO v_tenant FROM public.plg_support_requests WHERE id = p_request_id;
+  IF v_tenant IS NULL THEN RAISE EXCEPTION 'request not found' USING ERRCODE = 'P0002'; END IF;
+  UPDATE public.plg_support_requests
+    SET status = p_status,
+        resolved_at = CASE WHEN p_status IN ('resolved_check','closed') THEN now() ELSE resolved_at END
+    WHERE id = p_request_id;
+  INSERT INTO public.plg_support_request_events (tenant_id, request_id, type, note)
+    VALUES (v_tenant, p_request_id, 'status_changed', p_status);
+  PERFORM public._support_notify(p_request_id,
+    CASE WHEN p_status IN ('waiting_you','resolved_check') THEN 'waiting_you'
+         WHEN p_status IN ('closed') THEN 'resolved' ELSE 'reply' END);
+  RETURN public.support_console_detail(p_request_id);
+END;
+$fn$;
+GRANT EXECUTE ON FUNCTION public.support_console_set_status(uuid, text, text) TO authenticated;
+
+-- \u2500\u2500 write: operator sets priority \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+CREATE OR REPLACE FUNCTION public.support_console_set_priority(p_request_id uuid, p_priority text)
+RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
+AS $fn$
+BEGIN
+  PERFORM public.support_console_guard();
+  IF p_priority NOT IN ('low','normal','high','urgent') THEN
+    RAISE EXCEPTION 'invalid priority %', p_priority USING ERRCODE = '22023';
+  END IF;
+  UPDATE public.plg_support_requests SET priority = p_priority WHERE id = p_request_id;
+  RETURN public.support_console_detail(p_request_id);
+END;
+$fn$;
+GRANT EXECUTE ON FUNCTION public.support_console_set_priority(uuid, text) TO authenticated;
+
+-- \u2500\u2500 write: operator replies to the requester \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+CREATE OR REPLACE FUNCTION public.support_console_reply(p_request_id uuid, p_body text)
+RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
+AS $fn$
+DECLARE v_tenant uuid;
+BEGIN
+  PERFORM public.support_console_guard();
+  IF p_body IS NULL OR btrim(p_body) = '' THEN RAISE EXCEPTION 'empty message' USING ERRCODE = '22023'; END IF;
+  SELECT tenant_id INTO v_tenant FROM public.plg_support_requests WHERE id = p_request_id;
+  IF v_tenant IS NULL THEN RAISE EXCEPTION 'request not found' USING ERRCODE = 'P0002'; END IF;
+  INSERT INTO public.plg_support_request_messages (tenant_id, request_id, author_kind, author_id, body)
+    VALUES (v_tenant, p_request_id, 'team', auth.uid(), btrim(p_body));
+  PERFORM public._support_notify(p_request_id, 'reply');
+  RETURN public.support_console_detail(p_request_id);
+END;
+$fn$;
+GRANT EXECUTE ON FUNCTION public.support_console_reply(uuid, text) TO authenticated;
+
+-- \u2500\u2500 write: operator links a CRM lead/client \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+CREATE OR REPLACE FUNCTION public.support_console_link_lead(
+  p_request_id uuid, p_lead_id uuid, p_lead_name text DEFAULT NULL
+)
+RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''
+AS $fn$
+BEGIN
+  PERFORM public.support_console_guard();
+  UPDATE public.plg_support_requests
+    SET linked_lead_id = p_lead_id, linked_lead_name = p_lead_name
+    WHERE id = p_request_id;
+  RETURN public.support_console_detail(p_request_id);
+END;
+$fn$;
+GRANT EXECUTE ON FUNCTION public.support_console_link_lead(uuid, uuid, text) TO authenticated;
+`;
+var MIGRATION_002_OPERATOR_ATTACHMENT_READ = `-- plugin-support \u2014 let a helpdesk OPERATOR open a chamado's attachments.
+-- Idempotent / replay-safe.
+--
+-- The bucket's read policy (000_baseline) scopes every object to its owning
+-- tenant: (storage.foldername(name))[1] IN user_tenant_ids(). That is right for
+-- the store, but the GoControl operator is in ANOTHER tenant, so the signed URL
+-- never comes back and the console shows "anexo" instead of the image. This adds
+-- a SECOND, permissive SELECT policy (RLS OR-combines them, so the tenant rule is
+-- untouched) that lets an operator read any support-attachments object \u2014 gated by
+-- the same support_is_operator() that guards the whole console. Read only: upload,
+-- update and delete stay tenant-scoped.
+DROP POLICY IF EXISTS plg_support_attachments_operator_read ON storage.objects;
+CREATE POLICY plg_support_attachments_operator_read ON storage.objects
+  FOR SELECT TO authenticated
+  USING (bucket_id = 'support-attachments' AND public.support_is_operator());
+`;
+var MIGRATION_003_OPERATOR_ATTACHMENT_READ_FIX = `-- plugin-support \u2014 make the operator attachment policy actually work from Storage.
+-- Idempotent / replay-safe.
+--
+-- 002 gated the operator read on support_is_operator(), which asks
+-- app.current_tenant_id() \u2014 the OPEN workspace. That GUC is set on the normal
+-- data API, but NOT on a Storage sign request, so inside the bucket policy it is
+-- null and the check fails: the operator still got a 400 and saw "anexo".
+--
+-- This swaps to a context-independent test that leans only on auth.uid() (always
+-- present from the JWT): the user is a seeded cross-tenant operator, OR an active
+-- member of a tenant that runs the console (the facet). Same intent as
+-- support_is_operator(), minus the current-workspace scoping that Storage cannot
+-- answer. SECURITY DEFINER so the lookups bypass RLS, like the original.
+CREATE OR REPLACE FUNCTION public.support_is_operator_global()
+RETURNS boolean
+LANGUAGE sql STABLE SECURITY DEFINER SET search_path TO ''
+AS $fn$
+  SELECT
+    EXISTS (SELECT 1 FROM public.plg_support_operators o WHERE o.user_id = auth.uid())
+    OR EXISTS (
+      SELECT 1
+      FROM app.tenant_plugins tp
+      JOIN app.memberships m
+        ON m.tenant_id = tp.tenant_id AND m.user_id = auth.uid() AND m.active
+      WHERE tp.plugin_id = 'support' AND tp.facet = 'console' AND tp.status = 'active'
+    );
+$fn$;
+GRANT EXECUTE ON FUNCTION public.support_is_operator_global() TO authenticated;
+
+DROP POLICY IF EXISTS plg_support_attachments_operator_read ON storage.objects;
+CREATE POLICY plg_support_attachments_operator_read ON storage.objects
+  FOR SELECT TO authenticated
+  USING (bucket_id = 'support-attachments' AND public.support_is_operator_global());
+`;
+var MIGRATIONS = [
+  { id: "000_baseline", sql: MIGRATION_000_BASELINE },
+  { id: "001_helpdesk", sql: MIGRATION_001_HELPDESK },
+  { id: "002_operator_attachment_read", sql: MIGRATION_002_OPERATOR_ATTACHMENT_READ },
+  { id: "003_operator_attachment_read_fix", sql: MIGRATION_003_OPERATOR_ATTACHMENT_READ_FIX }
+];
+
+export { MIGRATIONS, MIGRATION_000_BASELINE, MIGRATION_001_HELPDESK, MIGRATION_002_OPERATOR_ATTACHMENT_READ, MIGRATION_003_OPERATOR_ATTACHMENT_READ_FIX };
+//# sourceMappingURL=main.js.map
+//# sourceMappingURL=main.js.map

package/dist/migrations/main.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/migrations/index.ts"],"names":[],"mappings":";AAIO,IAAM,sBAAA,GAAyB,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAoN/B,IAAM,sBAAA,GAAyB,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAkQ/B,IAAM,sCAAA,GAAyC,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAiB/C,IAAM,0CAAA,GAA6C,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAmCnD,IAAM,UAAA,GAAiD;AAAA,EAC5D,EAAE,EAAA,EAAI,cAAA,EAAgB,GAAA,EAAK,sBAAA,EAAuB;AAAA,EAClD,EAAE,EAAA,EAAI,cAAA,EAAgB,GAAA,EAAK,sBAAA,EAAuB;AAAA,EAClD,EAAE,EAAA,EAAI,8BAAA,EAAgC,GAAA,EAAK,sCAAA,EAAuC;AAAA,EAClF,EAAE,EAAA,EAAI,kCAAA,EAAoC,GAAA,EAAK,0CAAA;AACjD","file":"main.js","sourcesContent":["// AUTO-GENERATED from 000_baseline.sql, 001_helpdesk.sql, 002_operator_attachment_read.sql, 003_operator_attachment_read_fix.sql — regenerate with scripts/embed-migrations.mjs\n// SQL files are the source of truth; this inline copy lets the manifest declare\n// migrations as data. Do not edit by hand — run the embed script instead.\n\nexport const MIGRATION_000_BASELINE = `-- plugin-support — Central de Suporte do Dico: the solicitações a tenant files\n-- (problem / improvement / other), their conversation, history, attachments and\n-- the \"esperando você\" notifications. Port of the V1 support_* family.\n--\n-- Idempotent. Canonical RLS form: tenant_id IN (SELECT public.user_tenant_ids()).\n-- \"Minhas vs Toda a empresa\" is a query-layer filter on created_by, gated by the\n-- support.all feature — not an RLS distinction (the fleet has no SQL permission\n-- helper, and the cross-member triage read is the 2nd wave with the platform bridge).\n\nSET check_function_bodies = false;\n\n-- ── tables ──────────────────────────────────────────────────────────────\n\n-- The request itself. Carries, unseen by the person, the screen it was filed\n-- from (route, active unit, a snapshot of what was visible) — triage reads it first.\nCREATE TABLE IF NOT EXISTS public.plg_support_requests (\n  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),\n  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,\n  number integer NOT NULL,                 -- per-tenant sequential #; filled by trigger\n  kind text NOT NULL,                      -- problem | improvement | other\n  subject text,                            -- optional; derived from first line when blank\n  description text NOT NULL,\n  status text NOT NULL DEFAULT 'received', -- received|in_service|waiting_you|in_development|resolved_check|closed|cancelled\n  route text,                              -- origin screen hash path\n  unit_id uuid,                            -- active unit when filed (informational snapshot, no FK)\n  screen_snapshot jsonb NOT NULL DEFAULT '{}'::jsonb,\n  origin_conversation_id uuid,             -- the Dico chat that spawned it, when any\n  area text,\n  created_by uuid NOT NULL DEFAULT auth.uid(), -- auth user; the owner of \"Minhas\". Default so the client cannot spoof it.\n  created_at timestamptz NOT NULL DEFAULT now(),\n  updated_at timestamptz NOT NULL DEFAULT now(),\n  resolved_at timestamptz,\n  metadata jsonb NOT NULL DEFAULT '{}'::jsonb\n);\nALTER TABLE public.plg_support_requests ENABLE ROW LEVEL SECURITY;\nCREATE INDEX IF NOT EXISTS idx_plg_support_requests_tenant ON public.plg_support_requests(tenant_id);\nCREATE INDEX IF NOT EXISTS idx_plg_support_requests_tenant_created_by ON public.plg_support_requests(tenant_id, created_by);\nCREATE INDEX IF NOT EXISTS idx_plg_support_requests_tenant_status ON public.plg_support_requests(tenant_id, status);\nCREATE UNIQUE INDEX IF NOT EXISTS uq_plg_support_requests_tenant_number ON public.plg_support_requests(tenant_id, number);\n\n-- The conversation inside the request (\"Escreva para a equipe…\").\nCREATE TABLE IF NOT EXISTS public.plg_support_request_messages (\n  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),\n  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,\n  request_id uuid NOT NULL REFERENCES public.plg_support_requests(id) ON DELETE CASCADE,\n  author_kind text NOT NULL DEFAULT 'user', -- user | team\n  author_id uuid DEFAULT auth.uid(),\n  body text NOT NULL,\n  created_at timestamptz NOT NULL DEFAULT now()\n);\nALTER TABLE public.plg_support_request_messages ENABLE ROW LEVEL SECURITY;\nCREATE INDEX IF NOT EXISTS idx_plg_support_request_messages_tenant ON public.plg_support_request_messages(tenant_id);\nCREATE INDEX IF NOT EXISTS idx_plg_support_request_messages_request ON public.plg_support_request_messages(request_id, created_at);\n\n-- The short-sentence history shown in the detail (\"Solicitação aberta\", \"Andamento: Cancelada\").\nCREATE TABLE IF NOT EXISTS public.plg_support_request_events (\n  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),\n  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,\n  request_id uuid NOT NULL REFERENCES public.plg_support_requests(id) ON DELETE CASCADE,\n  type text NOT NULL,  -- opened|status_changed|validated_ok|reopened|cancelled|closed_no_reply|merged\n  note text,\n  created_at timestamptz NOT NULL DEFAULT now()\n);\nALTER TABLE public.plg_support_request_events ENABLE ROW LEVEL SECURITY;\nCREATE INDEX IF NOT EXISTS idx_plg_support_request_events_tenant ON public.plg_support_request_events(tenant_id);\nCREATE INDEX IF NOT EXISTS idx_plg_support_request_events_request ON public.plg_support_request_events(request_id, created_at);\n\n-- Attachment pointers; the file itself lives in the support-attachments bucket.\nCREATE TABLE IF NOT EXISTS public.plg_support_request_attachments (\n  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),\n  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,\n  request_id uuid NOT NULL REFERENCES public.plg_support_requests(id) ON DELETE CASCADE,\n  storage_path text NOT NULL,  -- <tenant_id>/<request_id>/<uuid>/<name>\n  name text NOT NULL,\n  size_bytes bigint,\n  content_type text,\n  created_by uuid DEFAULT auth.uid(),\n  created_at timestamptz NOT NULL DEFAULT now()\n);\nALTER TABLE public.plg_support_request_attachments ENABLE ROW LEVEL SECURITY;\nCREATE INDEX IF NOT EXISTS idx_plg_support_request_attachments_tenant ON public.plg_support_request_attachments(tenant_id);\nCREATE INDEX IF NOT EXISTS idx_plg_support_request_attachments_request ON public.plg_support_request_attachments(request_id);\n\n-- The orange \"Esperando você\" counter and the bell notice when the team replies.\nCREATE TABLE IF NOT EXISTS public.plg_support_notifications (\n  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),\n  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,\n  request_id uuid NOT NULL REFERENCES public.plg_support_requests(id) ON DELETE CASCADE,\n  user_id uuid NOT NULL,       -- who should see it\n  kind text,                   -- reply | resolved | waiting_you\n  read_at timestamptz,         -- NULL = unread (counts in the orange badge)\n  created_at timestamptz NOT NULL DEFAULT now()\n);\nALTER TABLE public.plg_support_notifications ENABLE ROW LEVEL SECURITY;\nCREATE INDEX IF NOT EXISTS idx_plg_support_notifications_tenant ON public.plg_support_notifications(tenant_id);\nCREATE INDEX IF NOT EXISTS idx_plg_support_notifications_user_unread ON public.plg_support_notifications(tenant_id, user_id, read_at);\n\n-- ── per-tenant sequential number ────────────────────────────────────────\n-- Each account counts its requests from #1. The advisory lock serialises the\n-- read-then-write per tenant so two concurrent opens don't collide on the number.\nCREATE OR REPLACE FUNCTION public.plg_support_assign_number()\nRETURNS trigger\nLANGUAGE plpgsql\nAS $fn$\nBEGIN\n  IF NEW.number IS NULL OR NEW.number = 0 THEN\n    PERFORM pg_advisory_xact_lock(hashtextextended('plg_support_requests:' || NEW.tenant_id::text, 0));\n    SELECT COALESCE(MAX(number), 0) + 1 INTO NEW.number\n    FROM public.plg_support_requests\n    WHERE tenant_id = NEW.tenant_id;\n  END IF;\n  RETURN NEW;\nEND;\n$fn$;\n\nDROP TRIGGER IF EXISTS trg_plg_support_assign_number ON public.plg_support_requests;\nCREATE TRIGGER trg_plg_support_assign_number\n  BEFORE INSERT ON public.plg_support_requests\n  FOR EACH ROW EXECUTE FUNCTION public.plg_support_assign_number();\n\n-- ── touch updated_at ────────────────────────────────────────────────────\nCREATE OR REPLACE FUNCTION public.plg_support_touch_updated_at()\nRETURNS trigger\nLANGUAGE plpgsql\nAS $fn$\nBEGIN\n  NEW.updated_at := now();\n  RETURN NEW;\nEND;\n$fn$;\n\nDROP TRIGGER IF EXISTS trg_plg_support_requests_touch ON public.plg_support_requests;\nCREATE TRIGGER trg_plg_support_requests_touch\n  BEFORE UPDATE ON public.plg_support_requests\n  FOR EACH ROW EXECUTE FUNCTION public.plg_support_touch_updated_at();\n\n-- ── row security + grants (idempotent) ──────────────────────────────────\nDO $rls$\nDECLARE t text;\nBEGIN\n  FOR t IN SELECT unnest(ARRAY[\n    'plg_support_requests',\n    'plg_support_request_messages',\n    'plg_support_request_events',\n    'plg_support_request_attachments',\n    'plg_support_notifications'\n  ])\n  LOOP\n    EXECUTE format('ALTER TABLE public.%I ENABLE ROW LEVEL SECURITY', t);\n    EXECUTE format('GRANT ALL ON public.%I TO authenticated', t);\n    EXECUTE format('GRANT ALL ON public.%I TO service_role', t);\n    BEGIN\n      EXECUTE format('GRANT MAINTAIN ON public.%I TO anon', t);\n    EXCEPTION WHEN insufficient_privilege OR undefined_object OR feature_not_supported THEN\n      RAISE NOTICE 'plg_support: skipped GRANT MAINTAIN on % (% )', t, SQLERRM;\n    END;\n    IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname='public' AND tablename=t AND policyname=t||'_select') THEN\n      EXECUTE format('CREATE POLICY %I ON public.%I FOR SELECT TO authenticated USING (tenant_id IN (SELECT public.user_tenant_ids()))', t||'_select', t);\n    END IF;\n    IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname='public' AND tablename=t AND policyname=t||'_insert') THEN\n      EXECUTE format('CREATE POLICY %I ON public.%I FOR INSERT TO authenticated WITH CHECK (tenant_id IN (SELECT public.user_tenant_ids()))', t||'_insert', t);\n    END IF;\n    IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname='public' AND tablename=t AND policyname=t||'_update') THEN\n      EXECUTE format('CREATE POLICY %I ON public.%I FOR UPDATE TO authenticated USING (tenant_id IN (SELECT public.user_tenant_ids()))', t||'_update', t);\n    END IF;\n    IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname='public' AND tablename=t AND policyname=t||'_delete') THEN\n      EXECUTE format('CREATE POLICY %I ON public.%I FOR DELETE TO authenticated USING (tenant_id IN (SELECT public.user_tenant_ids()))', t||'_delete', t);\n    END IF;\n  END LOOP;\nEND $rls$;\n\n-- ── attachments bucket (private; read by tenant folder) ─────────────────\n-- Path convention: <tenant_id>/<request_id>/<uuid>/<name>. A captura de tela\n-- pode ter nome e valor de cliente borrados mas ainda sensível — bucket privado,\n-- servido por URL assinada de curta duração; quem não é do tenant não alcança.\nINSERT INTO storage.buckets (id, name, public, file_size_limit, allowed_mime_types)\nVALUES ('support-attachments', 'support-attachments', false, 20971520,\n        ARRAY['image/jpeg','image/png','image/webp','image/gif','application/pdf',\n              'text/plain','text/csv','audio/mpeg','audio/webm','video/mp4','video/webm'])\nON CONFLICT (id) DO UPDATE SET\n  public             = EXCLUDED.public,\n  file_size_limit    = EXCLUDED.file_size_limit,\n  allowed_mime_types = EXCLUDED.allowed_mime_types;\n\nDROP POLICY IF EXISTS plg_support_attachments_read   ON storage.objects;\nDROP POLICY IF EXISTS plg_support_attachments_insert ON storage.objects;\nDROP POLICY IF EXISTS plg_support_attachments_update ON storage.objects;\nDROP POLICY IF EXISTS plg_support_attachments_delete ON storage.objects;\n\nCREATE POLICY plg_support_attachments_read ON storage.objects\n  FOR SELECT TO authenticated\n  USING (bucket_id = 'support-attachments'\n    AND (storage.foldername(name))[1] IN (SELECT public.user_tenant_ids()::text));\n\nCREATE POLICY plg_support_attachments_insert ON storage.objects\n  FOR INSERT TO authenticated\n  WITH CHECK (bucket_id = 'support-attachments'\n    AND (storage.foldername(name))[1] IN (SELECT public.user_tenant_ids()::text));\n\nCREATE POLICY plg_support_attachments_update ON storage.objects\n  FOR UPDATE TO authenticated\n  USING (bucket_id = 'support-attachments'\n    AND (storage.foldername(name))[1] IN (SELECT public.user_tenant_ids()::text))\n  WITH CHECK (bucket_id = 'support-attachments'\n    AND (storage.foldername(name))[1] IN (SELECT public.user_tenant_ids()::text));\n\nCREATE POLICY plg_support_attachments_delete ON storage.objects\n  FOR DELETE TO authenticated\n  USING (bucket_id = 'support-attachments'\n    AND (storage.foldername(name))[1] IN (SELECT public.user_tenant_ids()::text));\n`\n\nexport const MIGRATION_001_HELPDESK = `-- plugin-support — 2nd wave: the cross-tenant helpdesk the baseline foresaw\n-- (\"the cross-member triage read is the 2nd wave with the platform bridge\").\n--\n-- GoControl is the helpdesk: a small ALLOW-LIST of operators reads and acts on\n-- the support requests of EVERY tenant, through SECURITY DEFINER functions that\n-- carry the tenant boundary themselves. The per-tenant RLS from the baseline is\n-- untouched — a store still sees only its own requests. Only a seeded operator,\n-- and only through these functions, crosses it.\n--\n-- Idempotent. Additive only (new columns, a new table, new functions).\n\nSET check_function_bodies = false;\n\n-- ── new columns on the request ───────────────────────────────────────────\nALTER TABLE public.plg_support_requests\n  ADD COLUMN IF NOT EXISTS priority text NOT NULL DEFAULT 'normal';  -- low|normal|high|urgent\nALTER TABLE public.plg_support_requests\n  ADD COLUMN IF NOT EXISTS linked_lead_id uuid;      -- a CRM lead/client the operator tied to it\nALTER TABLE public.plg_support_requests\n  ADD COLUMN IF NOT EXISTS linked_lead_name text;    -- denormalised: the operator's tenant, not the requester's\n\n-- ── who may operate the helpdesk ─────────────────────────────────────────\n-- The allow-list is the whole security boundary of the cross-tenant read. A row\n-- here is a GoControl support operator. Nobody writes this from the app; it is\n-- seeded by an admin (see agent-provision / seed script).\nCREATE TABLE IF NOT EXISTS public.plg_support_operators (\n  user_id    uuid PRIMARY KEY,\n  note       text,\n  created_at timestamptz NOT NULL DEFAULT now()\n);\nALTER TABLE public.plg_support_operators ENABLE ROW LEVEL SECURITY;\nGRANT SELECT ON public.plg_support_operators TO authenticated;\nGRANT ALL    ON public.plg_support_operators TO service_role;\n-- A user may read ONLY their own row — enough to answer \"am I an operator?\" in\n-- the UI, and it reveals no one else.\nDROP POLICY IF EXISTS plg_support_operators_self ON public.plg_support_operators;\nCREATE POLICY plg_support_operators_self ON public.plg_support_operators\n  FOR SELECT TO authenticated USING (user_id = auth.uid());\n\n-- ── gate ──────────────────────────────────────────────────────────────────\n-- Operator = acting IN the helpdesk workspace. The caller's CURRENT tenant\n-- (app.current_tenant_id — the workspace they have open) must be the one that\n-- runs the helpdesk (support \\`console\\` facet active) AND they must be a member\n-- of it. So the console is strictly per-WORKSPACE: it works only while you are\n-- inside GoControl, never from a store, whoever you are. The plg_support_operators\n-- allow-list stays as an explicit extra, but it too only counts while you are in\n-- a helpdesk workspace — it never opens the console from a store.\nCREATE OR REPLACE FUNCTION public.support_is_operator()\nRETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path TO ''\nAS $fn$\n  SELECT EXISTS (\n    SELECT 1\n    FROM app.tenant_plugins tp\n    WHERE tp.plugin_id = 'support' AND tp.facet = 'console' AND tp.status = 'active'\n      AND tp.tenant_id = app.current_tenant_id()\n      AND (\n        EXISTS (\n          SELECT 1 FROM app.memberships m\n          WHERE m.tenant_id = tp.tenant_id AND m.user_id = auth.uid() AND m.active\n        )\n        OR EXISTS (SELECT 1 FROM public.plg_support_operators o WHERE o.user_id = auth.uid())\n      )\n  );\n$fn$;\nGRANT EXECUTE ON FUNCTION public.support_is_operator() TO authenticated;\n\n-- A guard the write functions share — raises if the caller is not an operator.\nCREATE OR REPLACE FUNCTION public.support_console_guard()\nRETURNS void\nLANGUAGE plpgsql STABLE SECURITY DEFINER SET search_path TO ''\nAS $fn$\nBEGIN\n  IF NOT public.support_is_operator() THEN\n    RAISE EXCEPTION 'not a support operator' USING ERRCODE = '42501';\n  END IF;\nEND;\n$fn$;\nGRANT EXECUTE ON FUNCTION public.support_console_guard() TO authenticated;\n\n-- Resolve the auth user who opened a ticket to a human name: the person record\n-- in that tenant, else the signed-up full name, else the e-mail. So the console\n-- shows \"Vini\" instead of a uuid.\nCREATE OR REPLACE FUNCTION public._support_user_name(p_user uuid, p_tenant uuid)\nRETURNS text\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path TO ''\nAS $fn$\n  SELECT COALESCE(\n    (SELECT NULLIF(btrim(p.name), '')\n       FROM app.memberships m JOIN public.people p ON p.id = m.person_id\n      WHERE m.user_id = p_user AND m.tenant_id = p_tenant LIMIT 1),\n    (SELECT NULLIF(btrim(u.raw_user_meta_data->>'full_name'), '') FROM auth.users u WHERE u.id = p_user),\n    (SELECT NULLIF(btrim(u.raw_user_meta_data->>'name'), '') FROM auth.users u WHERE u.id = p_user),\n    (SELECT u.email FROM auth.users u WHERE u.id = p_user)\n  );\n$fn$;\nGRANT EXECUTE ON FUNCTION public._support_user_name(uuid, uuid) TO authenticated;\n\n-- ── read: every tenant's requests, for an operator ───────────────────────\nCREATE OR REPLACE FUNCTION public.support_console_requests(\n  p_statuses text[] DEFAULT NULL,\n  p_search   text   DEFAULT NULL\n)\nRETURNS jsonb\nLANGUAGE plpgsql STABLE SECURITY DEFINER SET search_path TO ''\nAS $fn$\nDECLARE result jsonb;\nBEGIN\n  PERFORM public.support_console_guard();\n  SELECT COALESCE(jsonb_agg(row_to_json(r)), '[]'::jsonb) INTO result\n  FROM (\n    SELECT\n      q.id, q.number, q.kind, q.subject, q.description, q.status, q.priority,\n      q.route, q.created_by, public._support_user_name(q.created_by, q.tenant_id) AS created_by_name,\n      q.created_at, q.updated_at,\n      q.linked_lead_id, q.linked_lead_name,\n      q.tenant_id, t.name AS tenant_name, t.slug AS tenant_slug,\n      (SELECT count(*) FROM public.plg_support_request_messages m WHERE m.request_id = q.id) AS message_count\n    FROM public.plg_support_requests q\n    LEFT JOIN public.tenants t ON t.id = q.tenant_id\n    WHERE (p_statuses IS NULL OR q.status = ANY(p_statuses))\n      AND (p_search IS NULL OR p_search = ''\n           OR q.subject ILIKE '%'||p_search||'%'\n           OR q.description ILIKE '%'||p_search||'%'\n           OR t.name ILIKE '%'||p_search||'%')\n    ORDER BY\n      CASE q.priority WHEN 'urgent' THEN 0 WHEN 'high' THEN 1 WHEN 'normal' THEN 2 ELSE 3 END,\n      q.updated_at DESC\n  ) r;\n  RETURN result;\nEND;\n$fn$;\nGRANT EXECUTE ON FUNCTION public.support_console_requests(text[], text) TO authenticated;\n\n-- ── read: one request in full ────────────────────────────────────────────\nCREATE OR REPLACE FUNCTION public.support_console_detail(p_request_id uuid)\nRETURNS jsonb\nLANGUAGE plpgsql STABLE SECURITY DEFINER SET search_path TO ''\nAS $fn$\nDECLARE result jsonb;\nBEGIN\n  PERFORM public.support_console_guard();\n  SELECT jsonb_build_object(\n    'request', (SELECT row_to_json(x) FROM (\n        SELECT q.*, t.name AS tenant_name, t.slug AS tenant_slug,\n               public._support_user_name(q.created_by, q.tenant_id) AS created_by_name\n        FROM public.plg_support_requests q\n        LEFT JOIN public.tenants t ON t.id = q.tenant_id\n        WHERE q.id = p_request_id) x),\n    'messages', (SELECT COALESCE(jsonb_agg(row_to_json(m) ORDER BY m.created_at), '[]'::jsonb)\n                 FROM public.plg_support_request_messages m WHERE m.request_id = p_request_id),\n    'events', (SELECT COALESCE(jsonb_agg(row_to_json(e) ORDER BY e.created_at), '[]'::jsonb)\n               FROM public.plg_support_request_events e WHERE e.request_id = p_request_id),\n    'attachments', (SELECT COALESCE(jsonb_agg(row_to_json(a) ORDER BY a.created_at), '[]'::jsonb)\n                    FROM public.plg_support_request_attachments a WHERE a.request_id = p_request_id)\n  ) INTO result;\n  RETURN result;\nEND;\n$fn$;\nGRANT EXECUTE ON FUNCTION public.support_console_detail(uuid) TO authenticated;\n\n-- Internal: drop one unread notice to the requester, in their own tenant.\nCREATE OR REPLACE FUNCTION public._support_notify(p_request_id uuid, p_kind text)\nRETURNS void\nLANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''\nAS $fn$\nDECLARE v_tenant uuid; v_user uuid;\nBEGIN\n  SELECT tenant_id, created_by INTO v_tenant, v_user\n  FROM public.plg_support_requests WHERE id = p_request_id;\n  IF v_user IS NULL THEN RETURN; END IF;\n  INSERT INTO public.plg_support_notifications (tenant_id, request_id, user_id, kind)\n  VALUES (v_tenant, p_request_id, v_user, p_kind);\nEND;\n$fn$;\n\n-- ── write: operator changes status (and the client hears about it) ───────\nCREATE OR REPLACE FUNCTION public.support_console_set_status(\n  p_request_id uuid, p_status text, p_note text DEFAULT NULL\n)\nRETURNS jsonb\nLANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''\nAS $fn$\nDECLARE v_tenant uuid;\nBEGIN\n  PERFORM public.support_console_guard();\n  IF p_status NOT IN ('received','in_service','waiting_you','in_development','resolved_check','closed','cancelled') THEN\n    RAISE EXCEPTION 'invalid status %', p_status USING ERRCODE = '22023';\n  END IF;\n  SELECT tenant_id INTO v_tenant FROM public.plg_support_requests WHERE id = p_request_id;\n  IF v_tenant IS NULL THEN RAISE EXCEPTION 'request not found' USING ERRCODE = 'P0002'; END IF;\n  UPDATE public.plg_support_requests\n    SET status = p_status,\n        resolved_at = CASE WHEN p_status IN ('resolved_check','closed') THEN now() ELSE resolved_at END\n    WHERE id = p_request_id;\n  INSERT INTO public.plg_support_request_events (tenant_id, request_id, type, note)\n    VALUES (v_tenant, p_request_id, 'status_changed', p_status);\n  PERFORM public._support_notify(p_request_id,\n    CASE WHEN p_status IN ('waiting_you','resolved_check') THEN 'waiting_you'\n         WHEN p_status IN ('closed') THEN 'resolved' ELSE 'reply' END);\n  RETURN public.support_console_detail(p_request_id);\nEND;\n$fn$;\nGRANT EXECUTE ON FUNCTION public.support_console_set_status(uuid, text, text) TO authenticated;\n\n-- ── write: operator sets priority ────────────────────────────────────────\nCREATE OR REPLACE FUNCTION public.support_console_set_priority(p_request_id uuid, p_priority text)\nRETURNS jsonb\nLANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''\nAS $fn$\nBEGIN\n  PERFORM public.support_console_guard();\n  IF p_priority NOT IN ('low','normal','high','urgent') THEN\n    RAISE EXCEPTION 'invalid priority %', p_priority USING ERRCODE = '22023';\n  END IF;\n  UPDATE public.plg_support_requests SET priority = p_priority WHERE id = p_request_id;\n  RETURN public.support_console_detail(p_request_id);\nEND;\n$fn$;\nGRANT EXECUTE ON FUNCTION public.support_console_set_priority(uuid, text) TO authenticated;\n\n-- ── write: operator replies to the requester ─────────────────────────────\nCREATE OR REPLACE FUNCTION public.support_console_reply(p_request_id uuid, p_body text)\nRETURNS jsonb\nLANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''\nAS $fn$\nDECLARE v_tenant uuid;\nBEGIN\n  PERFORM public.support_console_guard();\n  IF p_body IS NULL OR btrim(p_body) = '' THEN RAISE EXCEPTION 'empty message' USING ERRCODE = '22023'; END IF;\n  SELECT tenant_id INTO v_tenant FROM public.plg_support_requests WHERE id = p_request_id;\n  IF v_tenant IS NULL THEN RAISE EXCEPTION 'request not found' USING ERRCODE = 'P0002'; END IF;\n  INSERT INTO public.plg_support_request_messages (tenant_id, request_id, author_kind, author_id, body)\n    VALUES (v_tenant, p_request_id, 'team', auth.uid(), btrim(p_body));\n  PERFORM public._support_notify(p_request_id, 'reply');\n  RETURN public.support_console_detail(p_request_id);\nEND;\n$fn$;\nGRANT EXECUTE ON FUNCTION public.support_console_reply(uuid, text) TO authenticated;\n\n-- ── write: operator links a CRM lead/client ──────────────────────────────\nCREATE OR REPLACE FUNCTION public.support_console_link_lead(\n  p_request_id uuid, p_lead_id uuid, p_lead_name text DEFAULT NULL\n)\nRETURNS jsonb\nLANGUAGE plpgsql SECURITY DEFINER SET search_path TO ''\nAS $fn$\nBEGIN\n  PERFORM public.support_console_guard();\n  UPDATE public.plg_support_requests\n    SET linked_lead_id = p_lead_id, linked_lead_name = p_lead_name\n    WHERE id = p_request_id;\n  RETURN public.support_console_detail(p_request_id);\nEND;\n$fn$;\nGRANT EXECUTE ON FUNCTION public.support_console_link_lead(uuid, uuid, text) TO authenticated;\n`\n\nexport const MIGRATION_002_OPERATOR_ATTACHMENT_READ = `-- plugin-support — let a helpdesk OPERATOR open a chamado's attachments.\n-- Idempotent / replay-safe.\n--\n-- The bucket's read policy (000_baseline) scopes every object to its owning\n-- tenant: (storage.foldername(name))[1] IN user_tenant_ids(). That is right for\n-- the store, but the GoControl operator is in ANOTHER tenant, so the signed URL\n-- never comes back and the console shows \"anexo\" instead of the image. This adds\n-- a SECOND, permissive SELECT policy (RLS OR-combines them, so the tenant rule is\n-- untouched) that lets an operator read any support-attachments object — gated by\n-- the same support_is_operator() that guards the whole console. Read only: upload,\n-- update and delete stay tenant-scoped.\nDROP POLICY IF EXISTS plg_support_attachments_operator_read ON storage.objects;\nCREATE POLICY plg_support_attachments_operator_read ON storage.objects\n  FOR SELECT TO authenticated\n  USING (bucket_id = 'support-attachments' AND public.support_is_operator());\n`\n\nexport const MIGRATION_003_OPERATOR_ATTACHMENT_READ_FIX = `-- plugin-support — make the operator attachment policy actually work from Storage.\n-- Idempotent / replay-safe.\n--\n-- 002 gated the operator read on support_is_operator(), which asks\n-- app.current_tenant_id() — the OPEN workspace. That GUC is set on the normal\n-- data API, but NOT on a Storage sign request, so inside the bucket policy it is\n-- null and the check fails: the operator still got a 400 and saw \"anexo\".\n--\n-- This swaps to a context-independent test that leans only on auth.uid() (always\n-- present from the JWT): the user is a seeded cross-tenant operator, OR an active\n-- member of a tenant that runs the console (the facet). Same intent as\n-- support_is_operator(), minus the current-workspace scoping that Storage cannot\n-- answer. SECURITY DEFINER so the lookups bypass RLS, like the original.\nCREATE OR REPLACE FUNCTION public.support_is_operator_global()\nRETURNS boolean\nLANGUAGE sql STABLE SECURITY DEFINER SET search_path TO ''\nAS $fn$\n  SELECT\n    EXISTS (SELECT 1 FROM public.plg_support_operators o WHERE o.user_id = auth.uid())\n    OR EXISTS (\n      SELECT 1\n      FROM app.tenant_plugins tp\n      JOIN app.memberships m\n        ON m.tenant_id = tp.tenant_id AND m.user_id = auth.uid() AND m.active\n      WHERE tp.plugin_id = 'support' AND tp.facet = 'console' AND tp.status = 'active'\n    );\n$fn$;\nGRANT EXECUTE ON FUNCTION public.support_is_operator_global() TO authenticated;\n\nDROP POLICY IF EXISTS plg_support_attachments_operator_read ON storage.objects;\nCREATE POLICY plg_support_attachments_operator_read ON storage.objects\n  FOR SELECT TO authenticated\n  USING (bucket_id = 'support-attachments' AND public.support_is_operator_global());\n`\n\nexport const MIGRATIONS: Array<{ id: string; sql: string }> = [\n  { id: \"000_baseline\", sql: MIGRATION_000_BASELINE },\n  { id: \"001_helpdesk\", sql: MIGRATION_001_HELPDESK },\n  { id: \"002_operator_attachment_read\", sql: MIGRATION_002_OPERATOR_ATTACHMENT_READ },\n  { id: \"003_operator_attachment_read_fix\", sql: MIGRATION_003_OPERATOR_ATTACHMENT_READ_FIX },\n]\n"]}

package/dist/views/SupportCenter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SupportCenter.d.ts","sourceRoot":"","sources":["../../src/views/SupportCenter.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAA;AASzB,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,eAAe,EAAc,MAAM,gBAAgB,CAAA;AAIlG,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,OAAO,EAAE,CAAA;IACd,QAAQ,EAAE,YAAY,EAAE,CAAA;IACxB,gBAAgB,EAAE,eAAe,EAAE,CAAA;CACpC;AAoBD;+EAC+E;AAC/E,wBAAgB,aAAa,CAAC,EAAE,OAAO,EAAE,EAAE;IAAE,OAAO,EAAE,oBAAoB,CAAA;CAAE,qBAG3E;AAkPD,eAAe,aAAa,CAAA"}
+{"version":3,"file":"SupportCenter.d.ts","sourceRoot":"","sources":["../../src/views/SupportCenter.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAA;AASzB,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,eAAe,EAAc,MAAM,gBAAgB,CAAA;AAIlG,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,OAAO,EAAE,CAAA;IACd,QAAQ,EAAE,YAAY,EAAE,CAAA;IACxB,gBAAgB,EAAE,eAAe,EAAE,CAAA;CACpC;AAmBD;+EAC+E;AAC/E,wBAAgB,aAAa,CAAC,EAAE,OAAO,EAAE,EAAE;IAAE,OAAO,EAAE,oBAAoB,CAAA;CAAE,qBAG3E;AAkPD,eAAe,aAAa,CAAA"}

package/dist/views/TicketDetailPage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TicketDetailPage.d.ts","sourceRoot":"","sources":["../../src/views/TicketDetailPage.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAA;AAmBzB;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,EAAE,EAAE;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,qBAqMtD;AAyID,eAAe,gBAAgB,CAAA"}
+{"version":3,"file":"TicketDetailPage.d.ts","sourceRoot":"","sources":["../../src/views/TicketDetailPage.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAA;AAoBzB;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,EAAE,EAAE;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,qBAqMtD;AAyID,eAAe,gBAAgB,CAAA"}

package/package.json

@@ -4,7 +4,7 @@
     "status": "beta",
     "dependencies": []
   },
-  "version": "0.2.12",
+  "version": "0.2.14",
   "description": "Fayz SDK — plugin-support plugin (Central de Suporte do Dico: solicitações)",
   "type": "module",
   "sideEffects": false,
@@ -17,6 +17,12 @@
       "import": "./dist/index.js"
     }
   },
+  "imports": {
+    "#migrations/*": {
+      "browser": "./dist/migrations/*.browser.js",
+      "default": "./dist/migrations/*.js"
+    }
+  },
   "files": [
     "dist"
   ],
@@ -27,9 +33,9 @@
     "lucide-react": ">=0.400.0 <1.0.0"
   },
   "dependencies": {
-    "@fayz-ai/core": "^0.61.0",
-    "@fayz-ai/admin": "^0.61.0",
-    "@fayz-ai/ui": "^0.61.0"
+    "@fayz-ai/core": "^0.63.0",
+    "@fayz-ai/admin": "^0.63.0",
+    "@fayz-ai/ui": "^0.63.0"
   },
   "devDependencies": {
     "@types/react": "^18.3.0",