@fayz-ai/db 0.10.0 → 0.12.0

package/migrations/047_tasks.sql

@@ -0,0 +1,266 @@
+-- ============================================================================
+-- 047_tasks.sql — public.tasks: the one table admin work lives in.
+--
+-- WHY THIS IS SPINE AND NOT A PLUGIN TABLE. plugin-tasks has carried
+-- plg_tasks_tasks since its first release, with almost exactly these columns.
+-- But only three of the shipped apps install that plugin, and the shell itself
+-- now writes tasks: the workspace setup wizard turns its "getting started"
+-- checklist into rows, assigned to whoever ran it. A checklist that silently
+-- writes nothing on the apps without the plugin is not a feature. So the table
+-- moves to the spine, where every app has it, and plugin-tasks becomes one of
+-- several UIs over it (plugin migration 002 carries its rows across).
+--
+-- WHY `source` / `source_key` AND NOT A LABEL. plg_tasks_tasks marks a
+-- machine-made task by pushing a string into `labels` (the notes bridge writes
+-- 'note:<id>'). That works only because nothing renders it: TaskLabelBadge
+-- returns null for any id that is not a real label row. A column that says who
+-- put the row here is filterable, indexable and visible, and the unique index
+-- below is what makes seeding idempotent — a wizard run twice writes the same
+-- N rows, not 2N.
+--
+-- Idempotent.
+-- ============================================================================
+
+CREATE TABLE IF NOT EXISTS public.tasks (
+  id               uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id        uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+
+  title            text NOT NULL,
+  description      text,
+
+  status           text NOT NULL DEFAULT 'todo'
+                     CHECK (status IN ('todo', 'in_progress', 'done', 'cancelled')),
+  priority         text NOT NULL DEFAULT 'medium'
+                     CHECK (priority IN ('low', 'medium', 'high', 'urgent')),
+
+  due_date         date,
+  -- When it was closed, as distinct from `status`. The onboarding checklist
+  -- reads it as a latch: a step whose sensor once fired is never re-probed, so
+  -- reopening a task by hand actually sticks.
+  completed_at     timestamptz,
+
+  -- Who answers for it. Kept alongside a denormalised name because the panel
+  -- draws initials for people the reader may not be allowed to look up.
+  assigned_to_id   uuid REFERENCES auth.users(id) ON DELETE SET NULL,
+  assigned_to_name text,
+
+  parent_id        uuid REFERENCES public.tasks(id) ON DELETE CASCADE,
+  labels           jsonb NOT NULL DEFAULT '[]'::jsonb,
+  position         integer NOT NULL DEFAULT 0,
+
+  -- Which feature put the row here ('onboarding', 'agent', …) and its stable
+  -- key within that feature. Both NULL when a person typed the task.
+  source           text,
+  source_key       text,
+
+  created_by       uuid REFERENCES auth.users(id) ON DELETE SET NULL,
+  created_by_name  text,
+
+  -- The 041 signature. See the scoped_resources block at the foot of this file.
+  unit_id          uuid REFERENCES public.locations(id) ON DELETE SET NULL,
+  owner_id         uuid REFERENCES auth.users(id) ON DELETE SET NULL,
+
+  created_at       timestamptz NOT NULL DEFAULT now(),
+  updated_at       timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS tasks_tenant_status_idx ON public.tasks (tenant_id, status);
+CREATE INDEX IF NOT EXISTS tasks_parent_idx        ON public.tasks (parent_id);
+CREATE INDEX IF NOT EXISTS tasks_assignee_idx      ON public.tasks (tenant_id, assigned_to_id);
+CREATE INDEX IF NOT EXISTS tasks_due_idx           ON public.tasks (tenant_id, due_date) WHERE due_date IS NOT NULL;
+CREATE INDEX IF NOT EXISTS tasks_unit_idx          ON public.tasks (tenant_id, unit_id);
+CREATE INDEX IF NOT EXISTS tasks_owner_idx         ON public.tasks (tenant_id, owner_id) WHERE owner_id IS NOT NULL;
+
+-- DELIBERATELY NOT PARTIAL. PostgREST's upsert emits a bare `ON CONFLICT
+-- (tenant_id, source, source_key)` with no index predicate, and a partial
+-- unique index cannot be inferred from that — the seed would fail at runtime
+-- and every wizard run would duplicate the checklist. NULLs are distinct in a
+-- unique index, so hand-typed tasks (source IS NULL) never collide.
+CREATE UNIQUE INDEX IF NOT EXISTS tasks_source_uniq
+  ON public.tasks (tenant_id, source, source_key);
+
+-- ── Stamps ─────────────────────────────────────────────────────────────────
+DROP TRIGGER IF EXISTS tasks_updated_at ON public.tasks;
+CREATE TRIGGER tasks_updated_at BEFORE UPDATE ON public.tasks
+  FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
+
+-- COALESCEs, so the seed's explicit author survives (025).
+--
+-- Checked rather than assumed, for the same reason 041 checks for `created_by`:
+-- a pool assembled by hand may never have run 025, and a migration that fails
+-- on a drifted pool is a migration nobody can apply. Without the trigger a
+-- hand-typed task simply has no author until 025 lands — the seeded rows carry
+-- theirs explicitly, and stamp_scope_tasks below falls back to auth.uid().
+DROP TRIGGER IF EXISTS tasks_created_by ON public.tasks;
+DO $$
+BEGIN
+  IF to_regprocedure('public.handle_created_by()') IS NOT NULL THEN
+    CREATE TRIGGER tasks_created_by BEFORE INSERT ON public.tasks
+      FOR EACH ROW EXECUTE FUNCTION public.handle_created_by();
+  ELSE
+    RAISE NOTICE '047: public.handle_created_by() is missing (025 not applied) — tasks.created_by will not be stamped';
+  END IF;
+END $$;
+
+-- 041 generates one of these per table it knows about, but it is applied and
+-- checksum-frozen: it only ever iterates the list it shipped with. A table
+-- added afterwards brings its own copy. Keep this body in step with the
+-- generator in 041_scoped_columns.sql — including the fact that IT MUST NEVER
+-- RAISE (SECURITY DEFINER RPCs insert here and a complaining BEFORE INSERT
+-- trigger would take them down; validation is 042's WITH CHECK).
+CREATE OR REPLACE FUNCTION public.stamp_scope_tasks() RETURNS trigger
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = public, pg_temp AS $body$
+BEGIN
+  IF NEW.unit_id IS NULL THEN
+    NEW.unit_id := public.requested_unit();
+  END IF;
+  IF NEW.owner_id IS NULL THEN
+    NEW.owner_id := COALESCE(NEW.created_by, auth.uid());
+  END IF;
+  RETURN NEW;
+EXCEPTION WHEN OTHERS THEN
+  RETURN NEW;
+END $body$;
+
+REVOKE ALL ON FUNCTION public.stamp_scope_tasks() FROM public, anon;
+
+DROP TRIGGER IF EXISTS tasks_scope_stamp ON public.tasks;
+-- AFTER tasks_created_by alphabetically is not a guarantee — Postgres fires
+-- BEFORE triggers in name order, and 'tasks_created_by' < 'tasks_scope_stamp',
+-- which is what lets the COALESCE above see the author it just stamped.
+CREATE TRIGGER tasks_scope_stamp BEFORE INSERT ON public.tasks
+  FOR EACH ROW EXECUTE FUNCTION public.stamp_scope_tasks();
+
+-- ── RLS ─────────────────────────────────────────────────────────────────────
+-- 011 closed `anon` on new public tables but not `authenticated`, which is born
+-- with the full grant. Stripped first, granted back deliberately. The blanket
+-- tenant_isolation sweep in 002 ran long before this table existed, so the
+-- policies below are written out rather than inherited.
+REVOKE ALL ON public.tasks FROM anon, authenticated;
+
+ALTER TABLE public.tasks ENABLE ROW LEVEL SECURITY;
+
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.tasks TO authenticated;
+
+DROP POLICY IF EXISTS tasks_member_read ON public.tasks;
+CREATE POLICY tasks_member_read ON public.tasks
+  FOR SELECT TO authenticated
+  USING (tenant_id IN (SELECT public.user_tenant_ids()));
+
+DROP POLICY IF EXISTS tasks_member_insert ON public.tasks;
+CREATE POLICY tasks_member_insert ON public.tasks
+  FOR INSERT TO authenticated
+  WITH CHECK (tenant_id IN (SELECT public.user_tenant_ids()));
+
+-- USING and WITH CHECK both: without the second, a member could move a task
+-- into a tenant they do not belong to.
+DROP POLICY IF EXISTS tasks_member_update ON public.tasks;
+CREATE POLICY tasks_member_update ON public.tasks
+  FOR UPDATE TO authenticated
+  USING (tenant_id IN (SELECT public.user_tenant_ids()))
+  WITH CHECK (tenant_id IN (SELECT public.user_tenant_ids()));
+
+DROP POLICY IF EXISTS tasks_member_delete ON public.tasks;
+CREATE POLICY tasks_member_delete ON public.tasks
+  FOR DELETE TO authenticated
+  USING (tenant_id IN (SELECT public.user_tenant_ids()));
+
+-- ── Unit scoping ────────────────────────────────────────────────────────────
+-- The registry row 042 loops over and the settings screen reads.
+--
+-- 'tenant' visibility, not 'unit': a task is assigned to a person, and a
+-- checklist the owner is working through has to stay visible to the team that
+-- is helping. owner_id is still stamped, so a tenant that switches tasks to
+-- 'owner' in the visibility settings gets private lists without a migration.
+-- Guarded on the registry existing at all: this pool proved drift is real and
+-- not in file order (it had 039-042 but never ran 025), so "the spine applies
+-- in sequence" is not something to bet the migration on.
+DO $$
+BEGIN
+  IF to_regclass('public.scoped_resources') IS NULL THEN
+    RAISE NOTICE '047: scoped_resources is missing (040 not applied) — tasks will not be unit-scoped';
+    RETURN;
+  END IF;
+
+  INSERT INTO public.scoped_resources
+    (resource_table, unit_column, owner_column, shareable, default_visibility, label)
+  VALUES
+    ('tasks', 'unit_id', 'owner_id', true, 'tenant', 'Tarefas')
+  ON CONFLICT (resource_table) DO UPDATE
+    SET unit_column  = EXCLUDED.unit_column,
+        owner_column = EXCLUDED.owner_column,
+        shareable    = EXCLUDED.shareable,
+        label        = EXCLUDED.label;
+  -- default_visibility is NOT updated on conflict — same reason as 041: it is
+  -- the factory setting, and re-running must not walk back an operator's choice.
+END $$;
+
+-- The restrictive policy, from 042's generator. Same reason as the trigger
+-- above: 042 is frozen and only saw the registry as it stood then. The predicate
+-- text is read straight out of the registry so the two stay identical in shape;
+-- if 042 is ever superseded, this block must be revisited with it.
+DO $$
+DECLARE
+  r record;
+  v_read text;
+  v_write text;
+BEGIN
+  IF to_regclass('public.scoped_resources') IS NULL THEN
+    RETURN;  -- no registry, no unit scoping — see the block above
+  END IF;
+
+  FOR r IN SELECT resource_table, unit_column FROM public.scoped_resources
+            WHERE resource_table = 'tasks' LOOP
+    CONTINUE WHEN to_regclass('public.' || r.resource_table) IS NULL;
+
+    v_read := format($p$
+         NOT (SELECT public.unit_scoping_active())
+      OR tenant_id NOT IN (SELECT public.unit_scoped_tenants())
+      OR tenant_id NOT IN (SELECT public.user_tenant_ids())
+      OR tenant_id IN (SELECT public.user_admin_tenant_ids())
+      OR %3$I = (SELECT auth.uid())
+      OR id IN (SELECT public.granted_record_ids(%1$L))
+      OR (
+           tenant_id IN (SELECT public.resource_mode_tenants(%1$L, 'tenant'))
+           AND id NOT IN (SELECT public.restricted_record_ids(%1$L))
+         )
+      OR (
+           (
+                tenant_id IN (SELECT public.resource_mode_tenants(%1$L, 'unit'))
+             OR (%3$I IS NULL AND tenant_id IN (SELECT public.resource_mode_tenants(%1$L, 'owner')))
+           )
+           AND (
+                %2$I IN (SELECT public.user_unit_ids())
+             OR (%2$I IS NULL AND id NOT IN (SELECT public.restricted_record_ids(%1$L)))
+           )
+         )
+    $p$, r.resource_table, r.unit_column, 'owner_id');
+
+    v_write := format($p$
+         NOT (SELECT public.unit_scoping_active())
+      OR tenant_id NOT IN (SELECT public.unit_scoped_tenants())
+      OR tenant_id NOT IN (SELECT public.user_tenant_ids())
+      OR tenant_id IN (SELECT public.user_admin_tenant_ids())
+      OR (
+           (%2$I IS NULL OR %2$I IN (SELECT public.user_unit_ids()))
+           AND (%3$I IS NULL OR %3$I = (SELECT auth.uid()))
+         )
+    $p$, r.resource_table, r.unit_column, 'owner_id');
+
+    EXECUTE format('ALTER TABLE public.%I ENABLE ROW LEVEL SECURITY', r.resource_table);
+    EXECUTE format('DROP POLICY IF EXISTS unit_scope ON public.%I', r.resource_table);
+    -- `AS RESTRICTIVE` is the word this whole block depends on: without it the
+    -- policy ORs with the member policies above and grants MORE access, not
+    -- less. negative-control.sh deletes exactly this line and demands red.
+    EXECUTE format(
+      'CREATE POLICY unit_scope ON public.%I '
+      || ' AS RESTRICTIVE '
+      || ' FOR ALL TO authenticated USING (%s) WITH CHECK (%s)',
+      r.resource_table, v_read, v_write);
+  END LOOP;
+END $$;
+
+COMMENT ON TABLE public.tasks IS
+  'Admin tasks: assignments, status, due date. Spine-owned — the shell''s '
+  'getting-started checklist seeds rows here with source = ''onboarding''. '
+  'plugin-tasks renders this table; it no longer owns one.';

package/migrations/048_every_login_is_a_person.sql

@@ -0,0 +1,190 @@
+-- ============================================================================
+-- 048_every_login_is_a_person.sql — quem entra no sistema é uma pessoa.
+--
+-- A 019 deixou o vínculo opcional nos dois sentidos, e documentou o porquê:
+-- "login-only account (e.g. the owner who signed up) -> person_id NULL". Na
+-- prática isso virou o estado NORMAL, não a exceção — em pool vivo, ZERO
+-- memberships tinham ficha. E a consequência não é cosmética:
+--
+--   * a mesma pessoa existe duas vezes, uma como login e outra como ficha, e
+--     nada no sistema diz que são a mesma;
+--   * a tela de equipe lista as duas como se fossem duas pessoas;
+--   * o perfil de quem entra não tem escala, comissão, documento nem endereço,
+--     porque essas coisas moram na ficha e o login não alcança nenhuma.
+--
+-- O lado opcional continua verdadeiro e é legítimo: metade da equipe de um
+-- salão nunca faz login, e essas fichas seguem sem membership. O que deixa de
+-- ser opcional é o outro lado — **todo login tem ficha**.
+--
+-- POR QUE UM GATILHO, E NÃO CONSERTAR CADA CAMINHO. Membership nasce em pelo
+-- menos três lugares: a criação da conta, a aceitação de convite (022, que
+-- insere sem person_id) e o que cada app fizer por fora. Consertar os três
+-- deixa o quarto para depois. BEFORE INSERT vale para todos, inclusive para o
+-- SQL que alguém rodar à mão daqui a um ano.
+--
+-- POR QUE O GATILHO NUNCA LEVANTA EXCEÇÃO. Ele roda dentro da aceitação de
+-- convite. Uma falha aqui derrubaria a entrada de alguém que acabou de aceitar
+-- um convite legítimo — e ficar sem ficha é chato, ficar sem acesso é o
+-- chamado de sábado. Falhou, a linha entra sem ficha e o backfill pega depois.
+--
+-- POR QUE `person_id` NÃO VIROU NOT NULL. A coluna é `ON DELETE SET NULL`: com
+-- NOT NULL, apagar uma ficha passaria a falhar com erro de chave estrangeira em
+-- cima de quem tem login, e a tela de cadastros não tem o que fazer com isso.
+-- Trocar para CASCADE seria pior — apagar a ficha revogaria o acesso em
+-- silêncio. A garantia fica onde ela é barata e completa: na criação.
+--
+-- Aditiva e idempotente.
+-- ============================================================================
+
+-- Qual `kind` uma ficha criada automaticamente recebe.
+--
+-- Configurável por conta porque cada vertical chama a própria equipe de um
+-- jeito, e uma ficha com kind que o app não lista não aparece no cadastro dele.
+-- 'staff' como padrão: é o que a frota usa. Um palpite adaptativo (olhar o kind
+-- mais comum da conta) foi descartado — esperteza dentro de gatilho falha em
+-- silêncio, e o custo de errar aqui é uma ficha no lugar errado.
+CREATE OR REPLACE FUNCTION public.team_person_kind(p_tenant_id uuid)
+RETURNS text LANGUAGE sql STABLE SECURITY DEFINER
+SET search_path = public, pg_temp AS $$
+  SELECT COALESCE(
+    NULLIF(trim((SELECT t.settings ->> 'team_person_kind' FROM public.tenants t WHERE t.id = p_tenant_id)), ''),
+    'staff'
+  );
+$$;
+
+COMMENT ON FUNCTION public.team_person_kind(uuid) IS
+  'O kind que uma ficha criada para um login recebe. `settings.team_person_kind`, ou staff.';
+
+-- ── A ficha de quem entra ───────────────────────────────────────────────────
+CREATE OR REPLACE FUNCTION public.ensure_member_person()
+RETURNS trigger LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = public, pg_temp AS $$
+DECLARE
+  v_email text;
+  v_name  text;
+  v_kind  text;
+  v_id    uuid;
+BEGIN
+  IF NEW.person_id IS NOT NULL THEN
+    RETURN NEW;
+  END IF;
+
+  SELECT u.email INTO v_email FROM auth.users u WHERE u.id = NEW.user_id;
+  SELECT p.full_name INTO v_name FROM public.profiles p WHERE p.id = NEW.user_id;
+
+  -- O nome que a ficha nasce com. Sem nome no perfil, o pedaço antes do @ é
+  -- melhor do que "Sem nome": ele é reconhecível e a pessoa corrige em um
+  -- clique no próprio perfil.
+  v_name := COALESCE(NULLIF(trim(v_name), ''), NULLIF(split_part(COALESCE(v_email, ''), '@', 1), ''), 'Sem nome');
+  v_kind := public.team_person_kind(NEW.tenant_id);
+
+  -- Primeiro procura: a ficha da pessoa provavelmente já existe, cadastrada
+  -- por quem montou a equipe antes de ela ganhar login. Criar uma segunda seria
+  -- fabricar exatamente a duplicata que este arquivo existe para acabar.
+  --
+  -- `NOT EXISTS` contra memberships porque uma ficha só pertence a um login:
+  -- o índice único de 019 recusaria a segunda, e aí o INSERT inteiro cairia.
+  IF v_email IS NOT NULL AND v_email <> '' THEN
+    SELECT pe.id INTO v_id
+      FROM public.people pe
+     WHERE pe.tenant_id = NEW.tenant_id
+       AND lower(pe.email) = lower(v_email)
+       AND pe.kind = v_kind
+       AND NOT EXISTS (
+         SELECT 1 FROM public.tenant_members tm
+          WHERE tm.tenant_id = NEW.tenant_id AND tm.person_id = pe.id
+       )
+     ORDER BY pe.created_at
+     LIMIT 1;
+  END IF;
+
+  IF v_id IS NULL THEN
+    INSERT INTO public.people (tenant_id, kind, name, email)
+    VALUES (NEW.tenant_id, v_kind, v_name, v_email)
+    RETURNING id INTO v_id;
+  END IF;
+
+  NEW.person_id := v_id;
+  RETURN NEW;
+EXCEPTION WHEN OTHERS THEN
+  -- Ver o cabeçalho: entrar sem ficha é recuperável, não entrar não é.
+  RETURN NEW;
+END $$;
+
+DROP TRIGGER IF EXISTS tenant_members_ensure_person ON public.tenant_members;
+CREATE TRIGGER tenant_members_ensure_person
+  BEFORE INSERT ON public.tenant_members
+  FOR EACH ROW EXECUTE FUNCTION public.ensure_member_person();
+
+-- ── E quem já estava dentro ─────────────────────────────────────────────────
+-- O gatilho só alcança o futuro. Sem isto, todo mundo que já usa o sistema
+-- continuaria sendo duas pessoas — que é o estado que motivou o arquivo.
+--
+-- Em função, e não solto, para poder ser chamado de novo num pool que receber
+-- membership por fora depois. Devolve quantos ligou.
+CREATE OR REPLACE FUNCTION public.backfill_member_persons()
+RETURNS integer LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = public, pg_temp AS $$
+DECLARE
+  r        record;
+  v_email  text;
+  v_name   text;
+  v_kind   text;
+  v_id     uuid;
+  v_count  integer := 0;
+BEGIN
+  FOR r IN
+    SELECT tm.id, tm.tenant_id, tm.user_id
+      FROM public.tenant_members tm
+     WHERE tm.person_id IS NULL
+     ORDER BY tm.created_at
+  LOOP
+    BEGIN
+      SELECT u.email INTO v_email FROM auth.users u WHERE u.id = r.user_id;
+      SELECT p.full_name INTO v_name FROM public.profiles p WHERE p.id = r.user_id;
+      v_name := COALESCE(NULLIF(trim(v_name), ''), NULLIF(split_part(COALESCE(v_email, ''), '@', 1), ''), 'Sem nome');
+      v_kind := public.team_person_kind(r.tenant_id);
+      v_id := NULL;
+
+      IF v_email IS NOT NULL AND v_email <> '' THEN
+        SELECT pe.id INTO v_id
+          FROM public.people pe
+         WHERE pe.tenant_id = r.tenant_id
+           AND lower(pe.email) = lower(v_email)
+           AND pe.kind = v_kind
+           AND NOT EXISTS (
+             SELECT 1 FROM public.tenant_members tm2
+              WHERE tm2.tenant_id = r.tenant_id AND tm2.person_id = pe.id
+           )
+         ORDER BY pe.created_at
+         LIMIT 1;
+      END IF;
+
+      IF v_id IS NULL THEN
+        INSERT INTO public.people (tenant_id, kind, name, email)
+        VALUES (r.tenant_id, v_kind, v_name, v_email)
+        RETURNING id INTO v_id;
+      END IF;
+
+      UPDATE public.tenant_members SET person_id = v_id WHERE id = r.id;
+      v_count := v_count + 1;
+    EXCEPTION WHEN OTHERS THEN
+      -- Uma linha que não dá para ligar não pode impedir as outras.
+      CONTINUE;
+    END;
+  END LOOP;
+  RETURN v_count;
+END $$;
+
+SELECT public.backfill_member_persons();
+
+-- Quem sobrou. Uma conta com número diferente de zero aqui tem gente que a tela
+-- de equipe ainda mostra duas vezes, e é isso que o doctor deve olhar.
+CREATE OR REPLACE FUNCTION public.unlinked_member_count()
+RETURNS integer LANGUAGE sql STABLE SECURITY DEFINER
+SET search_path = public, pg_temp AS $$
+  SELECT count(*)::integer FROM public.tenant_members WHERE person_id IS NULL;
+$$;
+
+GRANT EXECUTE ON FUNCTION public.team_person_kind(uuid) TO authenticated;
+GRANT EXECUTE ON FUNCTION public.unlinked_member_count() TO authenticated;

package/migrations/049_bookable_people.sql

@@ -0,0 +1,126 @@
+-- ============================================================================
+-- 049_bookable_people.sql — trabalhar aqui não é atender cliente.
+--
+-- A 048 passou a criar uma ficha para todo login, e a agenda lista como
+-- profissional toda pessoa de `kind = staff` que esteja ativa. O resultado
+-- apareceu na hora: o contador e o administrador viraram colunas na grade
+-- semanal, com horário livre para alguém marcar em cima.
+--
+-- O sinal que faltava não é o cargo — é uma pergunta só, e ela é binária:
+-- **esta pessoa atende cliente?** Um "tipo de staff" (recepção, profissional,
+-- administrativo) responderia isso e mais coisas, mas exigiria uma taxonomia
+-- por vertical — o que a clínica chama de recepção a escola chama de
+-- secretaria — e uma taxonomia errada é mais difícil de desfazer do que um
+-- campo a mais. Quando o tipo existir, ele deriva esta coluna; enquanto não
+-- existe, esta coluna já responde o que a agenda precisa saber.
+--
+-- O PADRÃO SEGUE COMO A FICHA NASCEU, e é isso que evita as duas regressões
+-- opostas:
+--
+--   * `DEFAULT true` para tudo que já existe — ninguém que já atende some da
+--     agenda quando esta migration sobe;
+--   * `false` para a ficha que a 048 cria — quem só entrou no sistema não vira
+--     profissional por ter feito login.
+--
+-- Aditiva e idempotente.
+-- ============================================================================
+
+ALTER TABLE public.people
+  ADD COLUMN IF NOT EXISTS is_bookable boolean NOT NULL DEFAULT true;
+
+COMMENT ON COLUMN public.people.is_bookable IS
+  'Esta pessoa atende cliente e aparece na agenda. Ficha criada a partir de um login nasce false.';
+
+-- ── A 048, agora sabendo a diferença ────────────────────────────────────────
+-- Reescrita inteira em vez de um ALTER: a função é a mesma da 048 com uma
+-- coluna a mais no INSERT, e duas versões parciais do mesmo corpo espalhadas em
+-- dois arquivos é como uma delas fica para trás.
+CREATE OR REPLACE FUNCTION public.ensure_member_person()
+RETURNS trigger LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = public, pg_temp AS $$
+DECLARE
+  v_email text; v_name text; v_kind text; v_id uuid;
+BEGIN
+  IF NEW.person_id IS NOT NULL THEN RETURN NEW; END IF;
+
+  SELECT u.email INTO v_email FROM auth.users u WHERE u.id = NEW.user_id;
+  SELECT p.full_name INTO v_name FROM public.profiles p WHERE p.id = NEW.user_id;
+  v_name := COALESCE(NULLIF(trim(v_name), ''), NULLIF(split_part(COALESCE(v_email, ''), '@', 1), ''), 'Sem nome');
+  v_kind := public.team_person_kind(NEW.tenant_id);
+
+  IF v_email IS NOT NULL AND v_email <> '' THEN
+    SELECT pe.id INTO v_id FROM public.people pe
+     WHERE pe.tenant_id = NEW.tenant_id AND lower(pe.email) = lower(v_email) AND pe.kind = v_kind
+       AND NOT EXISTS (SELECT 1 FROM public.tenant_members tm
+                        WHERE tm.tenant_id = NEW.tenant_id AND tm.person_id = pe.id)
+     ORDER BY pe.created_at LIMIT 1;
+  END IF;
+
+  IF v_id IS NULL THEN
+    -- `false` aqui é a linha inteira desta migration: entrar no sistema não é
+    -- passar a atender. Quem de fato atende é marcado por quem sabe.
+    INSERT INTO public.people (tenant_id, kind, name, email, is_bookable)
+    VALUES (NEW.tenant_id, v_kind, v_name, v_email, false)
+    RETURNING id INTO v_id;
+  END IF;
+
+  NEW.person_id := v_id;
+  RETURN NEW;
+EXCEPTION WHEN OTHERS THEN
+  RETURN NEW;
+END $$;
+
+CREATE OR REPLACE FUNCTION public.backfill_member_persons()
+RETURNS integer LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = public, pg_temp AS $$
+DECLARE
+  r record; v_email text; v_name text; v_kind text; v_id uuid; v_count integer := 0;
+BEGIN
+  FOR r IN SELECT tm.id, tm.tenant_id, tm.user_id FROM public.tenant_members tm
+            WHERE tm.person_id IS NULL ORDER BY tm.created_at
+  LOOP
+    BEGIN
+      SELECT u.email INTO v_email FROM auth.users u WHERE u.id = r.user_id;
+      SELECT p.full_name INTO v_name FROM public.profiles p WHERE p.id = r.user_id;
+      v_name := COALESCE(NULLIF(trim(v_name), ''), NULLIF(split_part(COALESCE(v_email, ''), '@', 1), ''), 'Sem nome');
+      v_kind := public.team_person_kind(r.tenant_id);
+      v_id := NULL;
+
+      IF v_email IS NOT NULL AND v_email <> '' THEN
+        SELECT pe.id INTO v_id FROM public.people pe
+         WHERE pe.tenant_id = r.tenant_id AND lower(pe.email) = lower(v_email) AND pe.kind = v_kind
+           AND NOT EXISTS (SELECT 1 FROM public.tenant_members tm2
+                            WHERE tm2.tenant_id = r.tenant_id AND tm2.person_id = pe.id)
+         ORDER BY pe.created_at LIMIT 1;
+      END IF;
+
+      IF v_id IS NULL THEN
+        INSERT INTO public.people (tenant_id, kind, name, email, is_bookable)
+        VALUES (r.tenant_id, v_kind, v_name, v_email, false) RETURNING id INTO v_id;
+      END IF;
+
+      UPDATE public.tenant_members SET person_id = v_id WHERE id = r.id;
+      v_count := v_count + 1;
+    EXCEPTION WHEN OTHERS THEN CONTINUE;
+    END;
+  END LOOP;
+  RETURN v_count;
+END $$;
+
+-- ── E as fichas que a 048 já criou antes desta coluna existir ───────────────
+-- Elas nasceram com o DEFAULT true e estão na agenda agora. A correção precisa
+-- alcançar ESSAS e nenhuma outra, então ela não pergunta "quem tem login" — a
+-- profissional dona da clínica também tem — e sim "quem tem login E nunca
+-- apareceu em atendimento nenhum": sem agendamento, sem escala e sem pedido.
+--
+-- Uma profissional de verdade recém-contratada, ainda sem histórico, também cai
+-- aqui e é desmarcada. É o lado certo para errar: ela some de uma grade onde
+-- ainda não tinha nada, e volta com um clique — enquanto o contador marcado
+-- como profissional recebe cliente.
+UPDATE public.people pe
+   SET is_bookable = false
+ WHERE pe.is_bookable
+   AND EXISTS (SELECT 1 FROM public.tenant_members tm WHERE tm.person_id = pe.id)
+   AND NOT EXISTS (SELECT 1 FROM public.appointments a WHERE a.assignee_id = pe.id)
+   AND NOT EXISTS (SELECT 1 FROM public.schedules s WHERE s.assignee_id = pe.id)
+   AND NOT EXISTS (SELECT 1 FROM public.orders o WHERE o.assignee_id = pe.id);

package/package.json

@@ -3,7 +3,7 @@
   "fayz": {
     "status": "beta"
   },
-  "version": "0.10.0",
+  "version": "0.12.0",
   "description": "Fayz SDK database layer — Drizzle schema primitives, spine references, and migration helpers shared across plugins.",
   "type": "module",
   "sideEffects": false,
@@ -38,9 +38,12 @@
   ],
   "peerDependencies": {},
   "scripts": {
-    "build": "tsup && tsc --emitDeclarationOnly --declaration --declarationMap --noEmit false",
+    "build": "tsup && tsc -b --force",
     "dev": "tsup --watch",
-    "typecheck": "tsc --noEmit",
-    "clean": "rm -rf dist"
+    "typecheck": "tsc -b",
+    "test": "bash test/run-migrations.sh",
+    "test:migrations": "bash test/run-migrations.sh",
+    "test:negative-control": "bash test/negative-control.sh",
+    "clean": "rm -rf dist .tsbuildinfo"
   }
 }