@fayz-ai/plugin-agenda 0.10.2 → 0.12.0

package/dist/lib/booking-events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"booking-events.d.ts","sourceRoot":"","sources":["../../src/lib/booking-events.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAW/C,uEAAuE;AACvE,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAExE;AAeD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,IAAI,CAK5E"}
+{"version":3,"file":"booking-events.d.ts","sourceRoot":"","sources":["../../src/lib/booking-events.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAW/C,uEAAuE;AACvE,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAExE;AAqBD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,IAAI,CAK5E"}

package/dist/lib/message-events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"message-events.d.ts","sourceRoot":"","sources":["../../src/lib/message-events.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,kBAAkB,EAAc,MAAM,eAAe,CAAA;AAyB1F;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,IAAI,qBAAqB,EAAE,CA2BjE;AAED,wBAAgB,0BAA0B,IAAI,kBAAkB,EAAE,CA0FjE"}
+{"version":3,"file":"message-events.d.ts","sourceRoot":"","sources":["../../src/lib/message-events.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,qBAAqB,EAAE,kBAAkB,EAC1C,MAAM,eAAe,CAAA;AAkCtB;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,IAAI,qBAAqB,EAAE,CA2BjE;AAgBD,wBAAgB,0BAA0B,IAAI,kBAAkB,EAAE,CAwGjE"}

package/dist/locales/en.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"en.d.ts","sourceRoot":"","sources":["../../src/locales/en.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAyNrC,CAAA"}
+{"version":3,"file":"en.d.ts","sourceRoot":"","sources":["../../src/locales/en.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CA2NrC,CAAA"}

package/dist/locales/pt-BR.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pt-BR.d.ts","sourceRoot":"","sources":["../../src/locales/pt-BR.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAyNvC,CAAA"}
+{"version":3,"file":"pt-BR.d.ts","sourceRoot":"","sources":["../../src/locales/pt-BR.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CA2NvC,CAAA"}

package/dist/migrations/index.d.ts

@@ -1,6 +1,6 @@
 export declare const MIGRATION_000B_V_BOOKINGS_RENAME = "-- Salon-only unblock: the pre-pools beauty deployment built rep_* report\n-- views on top of its (wider) v_bookings view, so 001's cleanup DROP cannot\n-- run there. Renaming keeps the dependents attached (they track the OID) and\n-- frees the name for 001; 002_v_bookings_compat re-creates v_bookings as a\n-- thin alias for live pre-M5 clients. No-op on fresh pools and on pools whose\n-- v_bookings has no dependents (001's DROP handles those).\n\nDO $rename$\nBEGIN\n  IF to_regclass('public.v_bookings') IS NOT NULL\n     AND to_regclass('public.v_bookings_legacy_beauty') IS NULL\n     AND EXISTS (\n       SELECT 1 FROM pg_depend d\n       JOIN pg_rewrite rw ON rw.oid = d.objid\n       JOIN pg_class dep ON dep.oid = rw.ev_class\n       JOIN pg_class ref ON ref.oid = d.refobjid\n       WHERE ref.relname = 'v_bookings' AND dep.relname <> 'v_bookings'\n     ) THEN\n    EXECUTE 'ALTER VIEW public.v_bookings RENAME TO v_bookings_legacy_beauty';\n  END IF;\nEND $rename$;\n";
 export declare const MIGRATION_000C_DEDUPE_CUSTOMER_PHONES = "-- 001 needs the customer-phone upsert key UNIQUE(tenant_id, phone). Converted\n-- pools can carry duplicates (found live on salon: 9 dogfood test records all\n-- sharing the founder's phone). Non-destructive dedupe: per (tenant_id, phone)\n-- customer group keep the row with most appointments (tie: oldest), NULL the\n-- phone on the rest and stash the original in metadata->'dedupedPhone'.\n-- Idempotent: reruns find no groups > 1.\n\nDO $dedupe$\nDECLARE\n  r record;\nBEGIN\n  IF to_regclass('public.people') IS NULL THEN\n    RETURN;\n  END IF;\n\n  FOR r IN\n    SELECT p.id, p.phone\n    FROM public.people p\n    JOIN LATERAL (\n      SELECT count(*) AS appts\n      FROM public.appointments a WHERE a.party_id = p.id\n    ) ac ON true\n    WHERE p.kind = 'customer' AND p.phone IS NOT NULL\n      AND p.id NOT IN (\n        SELECT DISTINCT ON (p2.tenant_id, p2.phone) p2.id\n        FROM public.people p2\n        WHERE p2.kind = 'customer' AND p2.phone IS NOT NULL\n        ORDER BY p2.tenant_id, p2.phone,\n          (SELECT count(*) FROM public.appointments a2 WHERE a2.party_id = p2.id) DESC,\n          p2.created_at ASC\n      )\n      AND (p.tenant_id, p.phone) IN (\n        SELECT tenant_id, phone FROM public.people\n        WHERE kind = 'customer' AND phone IS NOT NULL\n        GROUP BY tenant_id, phone HAVING count(*) > 1\n      )\n  LOOP\n    UPDATE public.people\n    SET metadata = COALESCE(metadata, '{}'::jsonb) || jsonb_build_object('dedupedPhone', r.phone),\n        phone = NULL\n    WHERE id = r.id;\n  END LOOP;\nEND $dedupe$;\n";
-export declare const MIGRATION_001_PUBLIC_BOOKING = "-- ============================================================================\n-- plugin-agenda 001: booking read model + public (anon) booking surface\n--\n-- Ships the objects the agenda providers reference but the spine (packages/db\n-- migrations 001\u2013010) does not define:\n--   \u00A70  converted-pool cleanup \u2014 drop the pre-rename v_bookings view / indexes\n--   \u00A71  order_items columns the admin provider writes (duration/assignee)\n--   \u00A72  public.v_appointments    \u2014 admin read model (authenticated, RLS applies)\n--   \u00A73  public.v_public_services \u2014 anon-readable service catalog\n--   \u00A74  public.get_available_slots      \u2014 anon RPC (mirrors the mock algorithm)\n--   \u00A75  public.create_public_booking    \u2014 anon RPC (validated, race-safe write)\n--\n-- Core v1 lives directly in PUBLIC (no separate core schema): people (was\n-- persons), appointments (was bookings). This migration is written against public\n-- names and is idempotent + safe on both fresh and converted pools.\n--\n-- Anon-access design: public booking pages run with the publishable key and no\n-- session, so the canonical tenant RLS yields nothing. Anon access is granted\n-- ONLY via the column-whitelisted view (\u00A73) and SECURITY DEFINER RPCs (\u00A74, \u00A75)\n-- with tight input validation and hardcoded statuses.\n-- ============================================================================\n\n-- \u00A70 \u2014 converted-pool cleanup. The pre-industry-pool shape shipped a v_bookings\n-- view and persons_/bookings_-named indexes; drop them so this file re-emits the\n-- canonical v_appointments view + people_/appointments_ indexes without leaving\n-- duplicates. All guarded with IF EXISTS \u2192 no-ops on a fresh pool.\nDROP VIEW IF EXISTS public.v_bookings;\nDROP INDEX IF EXISTS public.persons_tenant_customer_phone;\nDROP INDEX IF EXISTS public.bookings_assignee_time;\n\n-- \u00A71 \u2014 columns the agenda provider writes but 004_archetypes lacks\nALTER TABLE public.order_items\n  ADD COLUMN IF NOT EXISTS duration_minutes integer,\n  ADD COLUMN IF NOT EXISTS assignee_id uuid REFERENCES public.people(id) ON DELETE SET NULL;\n\n-- Upsert key for public customers (per tenant, by normalized phone)\nCREATE UNIQUE INDEX IF NOT EXISTS people_tenant_customer_phone\n  ON public.people(tenant_id, phone)\n  WHERE kind = 'customer' AND phone IS NOT NULL;\n\n-- Slot-conflict scan\nCREATE INDEX IF NOT EXISTS appointments_assignee_time\n  ON public.appointments(assignee_id, starts_at, ends_at)\n  WHERE status NOT IN ('cancelled', 'no_show');\n\n-- \u00A72 \u2014 admin read model (security_invoker \u2192 underlying RLS applies; anon sees 0 rows)\n-- DROP first: 013 widens this view and CREATE OR REPLACE cannot narrow a live\n-- view on replay (\"cannot drop columns from view\"). 013 replays right after.\nDROP VIEW IF EXISTS public.v_appointments;\nCREATE VIEW public.v_appointments\nWITH (security_invoker = true) AS\nSELECT\n  b.id, b.tenant_id, b.kind, b.starts_at, b.ends_at, b.status, b.notes,\n  b.order_id, b.location_id, b.metadata, b.created_at, b.updated_at,\n  b.party_id                              AS client_id,\n  COALESCE(pc.name, b.metadata->>'title') AS client_name,\n  pc.phone                                AS client_phone,\n  pc.email                                AS client_email,\n  pc.avatar_url                           AS client_avatar_url,\n  b.assignee_id                           AS professional_id,\n  ps.name                                 AS professional_name,\n  ps.avatar_url                           AS professional_avatar_url,\n  l.name                                  AS location_name,\n  o.total                                 AS order_total,\n  o.status                                AS order_status,\n  (EXTRACT(EPOCH FROM (COALESCE(b.ends_at, b.starts_at) - b.starts_at))::int / 60)\n                                          AS total_duration_minutes\nFROM public.appointments b\nLEFT JOIN public.people    pc ON pc.id = b.party_id\nLEFT JOIN public.people    ps ON ps.id = b.assignee_id\nLEFT JOIN public.locations l  ON l.id  = b.location_id\nLEFT JOIN public.orders    o  ON o.id  = b.order_id;\n\nGRANT SELECT ON public.v_appointments TO authenticated, service_role;\nREVOKE SELECT ON public.v_appointments FROM anon;\n\n-- \u00A73 \u2014 anon-readable public catalog (owner-rights view = deliberate, whitelisted)\n-- DROP first: 010 widens this view (curation columns) \u2014 same replay rule as \u00A72.\nDROP VIEW IF EXISTS public.v_public_services;\nCREATE VIEW public.v_public_services AS\nSELECT\n  s.id, s.tenant_id, s.name, s.description, s.price, s.currency,\n  COALESCE(s.duration_minutes, 30)                AS duration_minutes,\n  s.image_url,\n  COALESCE((s.metadata->>'sort_order')::int, 0)   AS sort_order\nFROM public.services s\nWHERE s.is_active AND s.status = 'active';\n\nGRANT SELECT ON public.v_public_services TO anon, authenticated, service_role;\n\n-- \u00A74 \u2014 availability RPC (mirrors plugin-agenda/src/data/mock.ts getAvailableSlots)\nCREATE OR REPLACE FUNCTION public.get_available_slots(\n  p_tenant_id uuid,\n  p_date date,\n  p_duration_minutes integer,\n  p_assignee_id uuid DEFAULT NULL,\n  p_slot_interval integer DEFAULT 30\n) RETURNS TABLE (slot_start timestamptz, slot_end timestamptz)\nLANGUAGE plpgsql STABLE SECURITY DEFINER\nSET search_path = public\nAS $$\nDECLARE\n  v_tz text;\nBEGIN\n  -- tight validation: this function is anon-callable\n  IF p_duration_minutes IS NULL OR p_duration_minutes NOT BETWEEN 5 AND 480 THEN\n    RAISE EXCEPTION 'invalid duration';\n  END IF;\n  IF p_slot_interval IS NULL OR p_slot_interval NOT BETWEEN 5 AND 240 THEN\n    RAISE EXCEPTION 'invalid interval';\n  END IF;\n  IF p_date IS NULL OR p_date < current_date OR p_date > current_date + 90 THEN\n    RETURN;\n  END IF;\n\n  SELECT COALESCE(t.settings->>'timezone', 'America/Sao_Paulo') INTO v_tz\n  FROM tenants t WHERE t.id = p_tenant_id;\n  IF v_tz IS NULL THEN RETURN; END IF;  -- unknown tenant \u2192 empty, not an error\n\n  RETURN QUERY\n  WITH day_schedules AS (\n    SELECT sc.assignee_id, sc.starts_at AS win_start, sc.ends_at AS win_end\n    FROM schedules sc\n    WHERE sc.tenant_id = p_tenant_id\n      AND sc.kind = 'working_hours'\n      AND sc.is_active\n      AND (p_assignee_id IS NULL OR sc.assignee_id = p_assignee_id)\n      AND (\n        sc.specific_date = p_date\n        OR (sc.specific_date IS NULL AND sc.day_of_week = EXTRACT(dow FROM p_date)::smallint)\n      )\n  ),\n  candidate AS (\n    SELECT\n      ds.assignee_id,\n      gs                                              AS s_start,\n      gs + make_interval(mins => p_duration_minutes)  AS s_end\n    FROM day_schedules ds\n    CROSS JOIN LATERAL generate_series(\n      (p_date + ds.win_start) AT TIME ZONE v_tz,\n      ((p_date + ds.win_end) AT TIME ZONE v_tz) - make_interval(mins => p_duration_minutes),\n      make_interval(mins => p_slot_interval)\n    ) AS gs\n  )\n  SELECT DISTINCT c.s_start, c.s_end\n  FROM candidate c\n  WHERE NOT EXISTS (\n    SELECT 1 FROM appointments b\n    WHERE b.tenant_id = p_tenant_id\n      AND b.assignee_id = c.assignee_id\n      AND b.status NOT IN ('cancelled', 'no_show')\n      AND b.starts_at < c.s_end\n      AND COALESCE(b.ends_at, b.starts_at) > c.s_start\n  )\n  ORDER BY 1;\nEND;\n$$;\n\nREVOKE ALL ON FUNCTION public.get_available_slots(uuid, date, integer, uuid, integer) FROM public;\nGRANT EXECUTE ON FUNCTION public.get_available_slots(uuid, date, integer, uuid, integer)\n  TO anon, authenticated, service_role;\n\n-- \u00A75 \u2014 public booking write RPC (validated, race-safe, hardcoded statuses)\nCREATE OR REPLACE FUNCTION public.create_public_booking(\n  p_tenant_id uuid,\n  p_service_id uuid,\n  p_starts_at timestamptz,\n  p_name text,\n  p_phone text,\n  p_email text DEFAULT NULL,\n  p_notes text DEFAULT NULL\n) RETURNS TABLE (booking_id uuid, starts_at timestamptz, ends_at timestamptz)\nLANGUAGE plpgsql SECURITY DEFINER\nSET search_path = public\nAS $$\nDECLARE\n  v_service record;\n  v_person_id uuid;\n  v_assignee uuid;\n  v_ends timestamptz;\n  v_order uuid;\n  v_booking uuid;\n  v_phone text;\n  v_tz text;\n  v_notes text;\nBEGIN\n  -- validation: anon-callable, everything tight\n  IF p_name IS NULL OR length(trim(p_name)) NOT BETWEEN 2 AND 120 THEN\n    RAISE EXCEPTION 'invalid name';\n  END IF;\n  v_phone := regexp_replace(COALESCE(p_phone, ''), '\\D', '', 'g');\n  IF length(v_phone) NOT BETWEEN 8 AND 15 THEN\n    RAISE EXCEPTION 'invalid phone';\n  END IF;\n  IF p_email IS NOT NULL AND (length(p_email) > 254 OR p_email !~ '^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$') THEN\n    RAISE EXCEPTION 'invalid email';\n  END IF;\n  v_notes := left(p_notes, 500);\n  IF p_starts_at IS NULL OR p_starts_at <= now() OR p_starts_at > now() + interval '90 days' THEN\n    RAISE EXCEPTION 'invalid start';\n  END IF;\n\n  SELECT s.id, s.name, s.price, COALESCE(s.duration_minutes, 30) AS duration_minutes\n    INTO v_service\n  FROM services s\n  WHERE s.id = p_service_id AND s.tenant_id = p_tenant_id\n    AND s.is_active AND s.status = 'active';\n  IF NOT FOUND THEN RAISE EXCEPTION 'unknown service'; END IF;\n\n  v_ends := p_starts_at + make_interval(mins => v_service.duration_minutes);\n  SELECT COALESCE(t.settings->>'timezone', 'America/Sao_Paulo') INTO v_tz\n  FROM tenants t WHERE t.id = p_tenant_id;\n  IF v_tz IS NULL THEN RAISE EXCEPTION 'unknown tenant'; END IF;\n\n  -- pick the assignee whose working hours cover the slot\n  SELECT sc.assignee_id INTO v_assignee\n  FROM schedules sc\n  WHERE sc.tenant_id = p_tenant_id\n    AND sc.kind = 'working_hours'\n    AND sc.is_active\n    AND (\n      sc.specific_date = (p_starts_at AT TIME ZONE v_tz)::date\n      OR (sc.specific_date IS NULL\n          AND sc.day_of_week = EXTRACT(dow FROM p_starts_at AT TIME ZONE v_tz)::smallint)\n    )\n    AND (p_starts_at AT TIME ZONE v_tz)::time >= sc.starts_at\n    AND (v_ends AT TIME ZONE v_tz)::time <= sc.ends_at\n  ORDER BY sc.assignee_id\n  LIMIT 1;\n  IF v_assignee IS NULL THEN RAISE EXCEPTION 'slot outside working hours'; END IF;\n\n  -- serialize per (tenant, assignee) to kill the double-book race\n  PERFORM pg_advisory_xact_lock(hashtextextended(p_tenant_id::text || v_assignee::text, 0));\n\n  IF EXISTS (\n    SELECT 1 FROM appointments b\n    WHERE b.tenant_id = p_tenant_id\n      AND b.assignee_id = v_assignee\n      AND b.status NOT IN ('cancelled', 'no_show')\n      AND b.starts_at < v_ends\n      AND COALESCE(b.ends_at, b.starts_at) > p_starts_at\n  ) THEN\n    RAISE EXCEPTION 'slot no longer available';\n  END IF;\n\n  -- anti-spam: cap open future public bookings per phone per tenant\n  IF (\n    SELECT count(*) FROM appointments b\n    JOIN people p ON p.id = b.party_id\n    WHERE b.tenant_id = p_tenant_id\n      AND p.phone = v_phone\n      AND b.starts_at > now()\n      AND b.status = 'scheduled'\n  ) >= 3 THEN\n    RAISE EXCEPTION 'too many open bookings for this phone';\n  END IF;\n\n  -- upsert the customer by (tenant, phone) \u2014 matches people_tenant_customer_phone\n  INSERT INTO people (tenant_id, kind, name, phone, email, metadata)\n  VALUES (p_tenant_id, 'customer', trim(p_name), v_phone, p_email,\n          jsonb_build_object('source', 'public_booking'))\n  ON CONFLICT (tenant_id, phone) WHERE kind = 'customer' AND phone IS NOT NULL\n  DO UPDATE SET\n    name = EXCLUDED.name,\n    email = COALESCE(EXCLUDED.email, people.email),\n    updated_at = now()\n  RETURNING id INTO v_person_id;\n\n  -- order + booking + order_item (statuses hardcoded \u2014 caller cannot set)\n  INSERT INTO orders (tenant_id, kind, status, party_id, assignee_id, subtotal, total, notes, metadata)\n  VALUES (p_tenant_id, 'appointment', 'scheduled', v_person_id, v_assignee,\n          v_service.price, v_service.price, v_notes,\n          jsonb_build_object('source', 'public_booking',\n                             'serviceNames', v_service.name,\n                             'contactName', trim(p_name)))\n  RETURNING id INTO v_order;\n\n  INSERT INTO appointments (tenant_id, kind, party_id, assignee_id, order_id,\n                        starts_at, ends_at, status, notes, metadata)\n  VALUES (p_tenant_id, 'appointment', v_person_id, v_assignee, v_order,\n          p_starts_at, v_ends, 'scheduled', v_notes,\n          jsonb_build_object('source', 'public_booking', 'serviceNames', v_service.name))\n  RETURNING id INTO v_booking;\n\n  INSERT INTO order_items (order_id, service_id, name, quantity, unit_price, total,\n                           sort_order, duration_minutes, assignee_id)\n  VALUES (v_order, v_service.id, v_service.name, 1, v_service.price, v_service.price,\n          0, v_service.duration_minutes, v_assignee);\n\n  RETURN QUERY SELECT v_booking, p_starts_at, v_ends;\nEND;\n$$;\n\nREVOKE ALL ON FUNCTION public.create_public_booking(uuid, uuid, timestamptz, text, text, text, text) FROM public;\nGRANT EXECUTE ON FUNCTION public.create_public_booking(uuid, uuid, timestamptz, text, text, text, text)\n  TO anon, authenticated, service_role;\n";
+export declare const MIGRATION_001_PUBLIC_BOOKING = "-- ============================================================================\n-- plugin-agenda 001: booking read model + public (anon) booking surface\n--\n-- Ships the objects the agenda providers reference but the spine (packages/db\n-- migrations 001\u2013010) does not define:\n--   \u00A70  converted-pool cleanup \u2014 drop the pre-rename v_bookings view / indexes\n--   \u00A71  order_items columns the admin provider writes (duration/assignee)\n--   \u00A72  public.v_appointments    \u2014 admin read model (authenticated, RLS applies)\n--   \u00A73  public.v_public_services \u2014 anon-readable service catalog\n--   \u00A74  public.get_available_slots      \u2014 anon RPC (mirrors the mock algorithm)\n--   \u00A75  public.create_public_booking    \u2014 anon RPC (validated, race-safe write)\n--\n-- Core v1 lives directly in PUBLIC (no separate core schema): people (was\n-- persons), appointments (was bookings). This migration is written against public\n-- names and is idempotent + safe on both fresh and converted pools.\n--\n-- Anon-access design: public booking pages run with the publishable key and no\n-- session, so the canonical tenant RLS yields nothing. Anon access is granted\n-- ONLY via the column-whitelisted view (\u00A73) and SECURITY DEFINER RPCs (\u00A74, \u00A75)\n-- with tight input validation and hardcoded statuses.\n-- ============================================================================\n\n-- \u00A70 \u2014 converted-pool cleanup. The pre-industry-pool shape shipped a v_bookings\n-- view and persons_/bookings_-named indexes; drop them so this file re-emits the\n-- canonical v_appointments view + people_/appointments_ indexes without leaving\n-- duplicates. All guarded with IF EXISTS \u2192 no-ops on a fresh pool.\nDROP VIEW IF EXISTS public.v_bookings;\nDROP INDEX IF EXISTS public.persons_tenant_customer_phone;\nDROP INDEX IF EXISTS public.bookings_assignee_time;\n\n-- \u00A71 \u2014 columns the agenda provider writes but 004_archetypes lacks\nALTER TABLE public.order_items\n  ADD COLUMN IF NOT EXISTS duration_minutes integer,\n  ADD COLUMN IF NOT EXISTS assignee_id uuid REFERENCES public.people(id) ON DELETE SET NULL;\n\n-- Lookup key for public customers (per tenant, by normalized phone).\n-- NOT UNIQUE. It was, and spine/110 says why it cannot be: `kind` became a\n-- derived column, so an imported 'client' turns into a 'customer' and a\n-- placeholder phone shared by eight real people lands under one key. The upsert\n-- that used to lean on it takes a per-(tenant, phone) advisory lock instead\n-- (003, 009) \u2014 the index is here for the lookup that lock guards.\nDROP INDEX IF EXISTS public.people_tenant_customer_phone;\nCREATE INDEX IF NOT EXISTS people_tenant_customer_phone\n  ON public.people(tenant_id, phone)\n  WHERE kind = 'customer' AND phone IS NOT NULL;\n\n-- Slot-conflict scan\nCREATE INDEX IF NOT EXISTS appointments_assignee_time\n  ON public.appointments(assignee_id, starts_at, ends_at)\n  WHERE status NOT IN ('cancelled', 'no_show');\n\n-- \u00A72 \u2014 admin read model (security_invoker \u2192 underlying RLS applies; anon sees 0 rows)\n-- DROP first: 013 widens this view and CREATE OR REPLACE cannot narrow a live\n-- view on replay (\"cannot drop columns from view\"). 013 replays right after.\n-- 013 builds on this one, so the drop needs its dependents out and back (143).\nSELECT app.detach_view_dependents('public.v_appointments');\nDROP VIEW IF EXISTS public.v_appointments;\nCREATE VIEW public.v_appointments\nWITH (security_invoker = true) AS\nSELECT\n  b.id, b.tenant_id, b.kind, b.starts_at, b.ends_at, b.status, b.notes,\n  b.order_id, b.location_id, b.metadata, b.created_at, b.updated_at,\n  b.party_id                              AS client_id,\n  COALESCE(pc.name, b.metadata->>'title') AS client_name,\n  pc.phone                                AS client_phone,\n  pc.email                                AS client_email,\n  pc.avatar_url                           AS client_avatar_url,\n  b.assignee_id                           AS professional_id,\n  ps.name                                 AS professional_name,\n  ps.avatar_url                           AS professional_avatar_url,\n  l.name                                  AS location_name,\n  o.total                                 AS order_total,\n  o.status                                AS order_status,\n  (EXTRACT(EPOCH FROM (COALESCE(b.ends_at, b.starts_at) - b.starts_at))::int / 60)\n                                          AS total_duration_minutes\nFROM public.appointments b\nLEFT JOIN public.people    pc ON pc.id = b.party_id\nLEFT JOIN public.people    ps ON ps.id = b.assignee_id\nLEFT JOIN public.locations l  ON l.id  = b.location_id\nLEFT JOIN public.orders    o  ON o.id  = b.order_id;\n\nGRANT SELECT ON public.v_appointments TO authenticated, service_role;\nREVOKE SELECT ON public.v_appointments FROM anon;\n\n-- \u00A73 \u2014 anon-readable public catalog (owner-rights view = deliberate, whitelisted)\n-- DROP first: 010 widens this view (curation columns) \u2014 same replay rule as \u00A72.\nDROP VIEW IF EXISTS public.v_public_services;\nCREATE VIEW public.v_public_services AS\nSELECT\n  s.id, s.tenant_id, s.name, s.description, s.price, s.currency,\n  COALESCE(s.duration_minutes, 30)                AS duration_minutes,\n  s.image_url,\n  COALESCE((s.metadata->>'sort_order')::int, 0)   AS sort_order\nFROM public.services s\nWHERE s.is_active AND s.status = 'active';\n\nGRANT SELECT ON public.v_public_services TO anon, authenticated, service_role;\n\n-- \u00A74 \u2014 availability RPC (mirrors plugin-agenda/src/data/mock.ts getAvailableSlots)\nCREATE OR REPLACE FUNCTION public.get_available_slots(\n  p_tenant_id uuid,\n  p_date date,\n  p_duration_minutes integer,\n  p_assignee_id uuid DEFAULT NULL,\n  p_slot_interval integer DEFAULT 30\n) RETURNS TABLE (slot_start timestamptz, slot_end timestamptz)\nLANGUAGE plpgsql STABLE SECURITY DEFINER\nSET search_path = public\nAS $$\nDECLARE\n  v_tz text;\nBEGIN\n  -- tight validation: this function is anon-callable\n  IF p_duration_minutes IS NULL OR p_duration_minutes NOT BETWEEN 5 AND 480 THEN\n    RAISE EXCEPTION 'invalid duration';\n  END IF;\n  IF p_slot_interval IS NULL OR p_slot_interval NOT BETWEEN 5 AND 240 THEN\n    RAISE EXCEPTION 'invalid interval';\n  END IF;\n  IF p_date IS NULL OR p_date < current_date OR p_date > current_date + 90 THEN\n    RETURN;\n  END IF;\n\n  SELECT COALESCE(t.settings->>'timezone', 'America/Sao_Paulo') INTO v_tz\n  FROM tenants t WHERE t.id = p_tenant_id;\n  IF v_tz IS NULL THEN RETURN; END IF;  -- unknown tenant \u2192 empty, not an error\n\n  RETURN QUERY\n  WITH day_schedules AS (\n    SELECT sc.assignee_id, sc.starts_at AS win_start, sc.ends_at AS win_end\n    FROM schedules sc\n    WHERE sc.tenant_id = p_tenant_id\n      AND sc.kind = 'working_hours'\n      AND sc.is_active\n      AND (p_assignee_id IS NULL OR sc.assignee_id = p_assignee_id)\n      AND (\n        sc.specific_date = p_date\n        OR (sc.specific_date IS NULL AND sc.day_of_week = EXTRACT(dow FROM p_date)::smallint)\n      )\n  ),\n  candidate AS (\n    SELECT\n      ds.assignee_id,\n      gs                                              AS s_start,\n      gs + make_interval(mins => p_duration_minutes)  AS s_end\n    FROM day_schedules ds\n    CROSS JOIN LATERAL generate_series(\n      (p_date + ds.win_start) AT TIME ZONE v_tz,\n      ((p_date + ds.win_end) AT TIME ZONE v_tz) - make_interval(mins => p_duration_minutes),\n      make_interval(mins => p_slot_interval)\n    ) AS gs\n  )\n  SELECT DISTINCT c.s_start, c.s_end\n  FROM candidate c\n  WHERE NOT EXISTS (\n    SELECT 1 FROM appointments b\n    WHERE b.tenant_id = p_tenant_id\n      AND b.assignee_id = c.assignee_id\n      AND b.status NOT IN ('cancelled', 'no_show')\n      AND b.starts_at < c.s_end\n      AND COALESCE(b.ends_at, b.starts_at) > c.s_start\n  )\n  ORDER BY 1;\nEND;\n$$;\n\nREVOKE ALL ON FUNCTION public.get_available_slots(uuid, date, integer, uuid, integer) FROM public;\nGRANT EXECUTE ON FUNCTION public.get_available_slots(uuid, date, integer, uuid, integer)\n  TO anon, authenticated, service_role;\n\n-- \u00A75 \u2014 public booking write RPC (validated, race-safe, hardcoded statuses)\nCREATE OR REPLACE FUNCTION public.create_public_booking(\n  p_tenant_id uuid,\n  p_service_id uuid,\n  p_starts_at timestamptz,\n  p_name text,\n  p_phone text,\n  p_email text DEFAULT NULL,\n  p_notes text DEFAULT NULL\n) RETURNS TABLE (booking_id uuid, starts_at timestamptz, ends_at timestamptz)\nLANGUAGE plpgsql SECURITY DEFINER\nSET search_path = public\nAS $$\nDECLARE\n  v_service record;\n  v_person_id uuid;\n  v_assignee uuid;\n  v_ends timestamptz;\n  v_order uuid;\n  v_booking uuid;\n  v_phone text;\n  v_tz text;\n  v_notes text;\nBEGIN\n  -- validation: anon-callable, everything tight\n  IF p_name IS NULL OR length(trim(p_name)) NOT BETWEEN 2 AND 120 THEN\n    RAISE EXCEPTION 'invalid name';\n  END IF;\n  v_phone := regexp_replace(COALESCE(p_phone, ''), '\\D', '', 'g');\n  IF length(v_phone) NOT BETWEEN 8 AND 15 THEN\n    RAISE EXCEPTION 'invalid phone';\n  END IF;\n  IF p_email IS NOT NULL AND (length(p_email) > 254 OR p_email !~ '^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$') THEN\n    RAISE EXCEPTION 'invalid email';\n  END IF;\n  v_notes := left(p_notes, 500);\n  IF p_starts_at IS NULL OR p_starts_at <= now() OR p_starts_at > now() + interval '90 days' THEN\n    RAISE EXCEPTION 'invalid start';\n  END IF;\n\n  SELECT s.id, s.name, s.price, COALESCE(s.duration_minutes, 30) AS duration_minutes\n    INTO v_service\n  FROM services s\n  WHERE s.id = p_service_id AND s.tenant_id = p_tenant_id\n    AND s.is_active AND s.status = 'active';\n  IF NOT FOUND THEN RAISE EXCEPTION 'unknown service'; END IF;\n\n  v_ends := p_starts_at + make_interval(mins => v_service.duration_minutes);\n  SELECT COALESCE(t.settings->>'timezone', 'America/Sao_Paulo') INTO v_tz\n  FROM tenants t WHERE t.id = p_tenant_id;\n  IF v_tz IS NULL THEN RAISE EXCEPTION 'unknown tenant'; END IF;\n\n  -- pick the assignee whose working hours cover the slot\n  SELECT sc.assignee_id INTO v_assignee\n  FROM schedules sc\n  WHERE sc.tenant_id = p_tenant_id\n    AND sc.kind = 'working_hours'\n    AND sc.is_active\n    AND (\n      sc.specific_date = (p_starts_at AT TIME ZONE v_tz)::date\n      OR (sc.specific_date IS NULL\n          AND sc.day_of_week = EXTRACT(dow FROM p_starts_at AT TIME ZONE v_tz)::smallint)\n    )\n    AND (p_starts_at AT TIME ZONE v_tz)::time >= sc.starts_at\n    AND (v_ends AT TIME ZONE v_tz)::time <= sc.ends_at\n  ORDER BY sc.assignee_id\n  LIMIT 1;\n  IF v_assignee IS NULL THEN RAISE EXCEPTION 'slot outside working hours'; END IF;\n\n  -- serialize per (tenant, assignee) to kill the double-book race\n  PERFORM pg_advisory_xact_lock(hashtextextended(p_tenant_id::text || v_assignee::text, 0));\n\n  IF EXISTS (\n    SELECT 1 FROM appointments b\n    WHERE b.tenant_id = p_tenant_id\n      AND b.assignee_id = v_assignee\n      AND b.status NOT IN ('cancelled', 'no_show')\n      AND b.starts_at < v_ends\n      AND COALESCE(b.ends_at, b.starts_at) > p_starts_at\n  ) THEN\n    RAISE EXCEPTION 'slot no longer available';\n  END IF;\n\n  -- anti-spam: cap open future public bookings per phone per tenant\n  IF (\n    SELECT count(*) FROM appointments b\n    JOIN people p ON p.id = b.party_id\n    WHERE b.tenant_id = p_tenant_id\n      AND p.phone = v_phone\n      AND b.starts_at > now()\n      AND b.status = 'scheduled'\n  ) >= 3 THEN\n    RAISE EXCEPTION 'too many open bookings for this phone';\n  END IF;\n\n  -- Upsert the customer by (tenant, phone). NOT ON CONFLICT: the partial unique\n  -- index this used to infer is gone (spine/110 \u2014 a placeholder phone is shared\n  -- by real, distinct people). 003 already settled the replacement: take a\n  -- per-(tenant, phone) advisory lock so two first-bookings serialise, then look\n  -- before inserting. Oldest match wins, so a returning caller keeps the record\n  -- that carries their history.\n  PERFORM pg_advisory_xact_lock(hashtextextended(p_tenant_id::text || ':' || v_phone, 1));\n\n  SELECT p.id INTO v_person_id\n    FROM people p\n   WHERE p.tenant_id = p_tenant_id AND p.kind = 'customer' AND p.phone = v_phone\n   ORDER BY p.created_at\n   LIMIT 1;\n\n  IF v_person_id IS NOT NULL THEN\n    UPDATE people SET\n      name = trim(p_name),\n      email = COALESCE(p_email, people.email),\n      updated_at = now()\n    WHERE id = v_person_id;\n  ELSE\n    INSERT INTO people (tenant_id, kind, name, phone, email, metadata)\n    VALUES (p_tenant_id, 'customer', trim(p_name), v_phone, p_email,\n            jsonb_build_object('source', 'public_booking'))\n    RETURNING id INTO v_person_id;\n  END IF;\n\n  -- order + booking + order_item (statuses hardcoded \u2014 caller cannot set)\n  INSERT INTO orders (tenant_id, kind, status, party_id, assignee_id, subtotal, total, notes, metadata)\n  VALUES (p_tenant_id, 'appointment', 'scheduled', v_person_id, v_assignee,\n          v_service.price, v_service.price, v_notes,\n          jsonb_build_object('source', 'public_booking',\n                             'serviceNames', v_service.name,\n                             'contactName', trim(p_name)))\n  RETURNING id INTO v_order;\n\n  INSERT INTO appointments (tenant_id, kind, party_id, assignee_id, order_id,\n                        starts_at, ends_at, status, notes, metadata)\n  VALUES (p_tenant_id, 'appointment', v_person_id, v_assignee, v_order,\n          p_starts_at, v_ends, 'scheduled', v_notes,\n          jsonb_build_object('source', 'public_booking', 'serviceNames', v_service.name))\n  RETURNING id INTO v_booking;\n\n  INSERT INTO order_items (order_id, service_id, name, quantity, unit_price, total,\n                           sort_order, duration_minutes, assignee_id)\n  VALUES (v_order, v_service.id, v_service.name, 1, v_service.price, v_service.price,\n          0, v_service.duration_minutes, v_assignee);\n\n  RETURN QUERY SELECT v_booking, p_starts_at, v_ends;\nEND;\n$$;\n\nREVOKE ALL ON FUNCTION public.create_public_booking(uuid, uuid, timestamptz, text, text, text, text) FROM public;\nGRANT EXECUTE ON FUNCTION public.create_public_booking(uuid, uuid, timestamptz, text, text, text, text)\n  TO anon, authenticated, service_role;\n\nSELECT app.reattach_view_dependents();\n";
 export declare const MIGRATION_002_V_BOOKINGS_COMPAT = "-- Where 000b preserved the legacy beauty view, re-create v_bookings as a\n-- thin alias over it so live pre-M5 clients that SELECT v_bookings by name\n-- keep their full legacy column set. Dropped for good once the beauty app\n-- ships on v_appointments (M5 follow-up).\n\nDO $compat$\nBEGIN\n  IF to_regclass('public.v_bookings_legacy_beauty') IS NOT NULL\n     AND to_regclass('public.v_bookings') IS NULL THEN\n    EXECUTE 'CREATE VIEW public.v_bookings WITH (security_invoker = true) AS SELECT * FROM public.v_bookings_legacy_beauty';\n    EXECUTE 'GRANT SELECT ON public.v_bookings TO authenticated, service_role';\n    EXECUTE 'REVOKE SELECT ON public.v_bookings FROM anon';\n  END IF;\nEND $compat$;\n";
 export declare const MIGRATION_003_PUBLIC_CLIENT_KIND = "-- ---------------------------------------------------------------------------\n-- Public booking \u2014 tenant-configurable client kind\n-- ---------------------------------------------------------------------------\n-- 001 hardcoded kind='customer' for people created by create_public_booking.\n-- Verticals whose client archetype uses another kind (school \u2192 'student',\n-- clinic \u2192 whatever the app registers) ended up with people invisible to the\n-- app's own pages/lookups and with entity links resolving to unregistered\n-- routes (#/customers/:id \u2192 not found).\n--\n-- The client kind now comes from TENANT SETTINGS (admin-controlled \u2014 never\n-- from the anon caller):   tenants.settings.booking.client_kind\n-- Default remains 'customer', so existing pools/tenants are unaffected until\n-- they opt in:\n--   UPDATE tenants SET settings = jsonb_set(COALESCE(settings,'{}'::jsonb),\n--     '{booking,client_kind}', '\"student\"') WHERE id = '<tenant>';\n--\n-- The upsert no longer relies on the kind-specific partial unique index\n-- (people_tenant_customer_phone) \u2014 a per-(tenant, phone) advisory lock\n-- serializes concurrent first-bookings for any kind. The 001 index stays in\n-- place (harmless, still guards direct customer writes).\n--\n-- Idempotent: CREATE OR REPLACE, same signature as 001.\n-- ---------------------------------------------------------------------------\nCREATE OR REPLACE FUNCTION public.create_public_booking(\n  p_tenant_id uuid,\n  p_service_id uuid,\n  p_starts_at timestamptz,\n  p_name text,\n  p_phone text,\n  p_email text DEFAULT NULL,\n  p_notes text DEFAULT NULL\n) RETURNS TABLE (booking_id uuid, starts_at timestamptz, ends_at timestamptz)\nLANGUAGE plpgsql SECURITY DEFINER\nSET search_path = public\nAS $$\nDECLARE\n  v_service record;\n  v_person_id uuid;\n  v_assignee uuid;\n  v_ends timestamptz;\n  v_order uuid;\n  v_booking uuid;\n  v_phone text;\n  v_tz text;\n  v_notes text;\n  v_client_kind text;\nBEGIN\n  -- validation: anon-callable, everything tight\n  IF p_name IS NULL OR length(trim(p_name)) NOT BETWEEN 2 AND 120 THEN\n    RAISE EXCEPTION 'invalid name';\n  END IF;\n  v_phone := regexp_replace(COALESCE(p_phone, ''), '\\D', '', 'g');\n  IF length(v_phone) NOT BETWEEN 8 AND 15 THEN\n    RAISE EXCEPTION 'invalid phone';\n  END IF;\n  IF p_email IS NOT NULL AND (length(p_email) > 254 OR p_email !~ '^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$') THEN\n    RAISE EXCEPTION 'invalid email';\n  END IF;\n  v_notes := left(p_notes, 500);\n  IF p_starts_at IS NULL OR p_starts_at <= now() OR p_starts_at > now() + interval '90 days' THEN\n    RAISE EXCEPTION 'invalid start';\n  END IF;\n\n  SELECT s.id, s.name, s.price, COALESCE(s.duration_minutes, 30) AS duration_minutes\n    INTO v_service\n  FROM services s\n  WHERE s.id = p_service_id AND s.tenant_id = p_tenant_id\n    AND s.is_active AND s.status = 'active';\n  IF NOT FOUND THEN RAISE EXCEPTION 'unknown service'; END IF;\n\n  v_ends := p_starts_at + make_interval(mins => v_service.duration_minutes);\n\n  -- tenant config: timezone + client kind (admin-set; sanitized, never caller input)\n  SELECT COALESCE(t.settings->>'timezone', 'America/Sao_Paulo'),\n         COALESCE(NULLIF(trim(t.settings->'booking'->>'client_kind'), ''), 'customer')\n    INTO v_tz, v_client_kind\n  FROM tenants t WHERE t.id = p_tenant_id;\n  IF v_tz IS NULL THEN RAISE EXCEPTION 'unknown tenant'; END IF;\n  IF v_client_kind !~ '^[a-z_]{2,32}$' THEN v_client_kind := 'customer'; END IF;\n\n  -- pick the assignee whose working hours cover the slot\n  SELECT sc.assignee_id INTO v_assignee\n  FROM schedules sc\n  WHERE sc.tenant_id = p_tenant_id\n    AND sc.kind = 'working_hours'\n    AND sc.is_active\n    AND (\n      sc.specific_date = (p_starts_at AT TIME ZONE v_tz)::date\n      OR (sc.specific_date IS NULL\n          AND sc.day_of_week = EXTRACT(dow FROM p_starts_at AT TIME ZONE v_tz)::smallint)\n    )\n    AND (p_starts_at AT TIME ZONE v_tz)::time >= sc.starts_at\n    AND (v_ends AT TIME ZONE v_tz)::time <= sc.ends_at\n  ORDER BY sc.assignee_id\n  LIMIT 1;\n  IF v_assignee IS NULL THEN RAISE EXCEPTION 'slot outside working hours'; END IF;\n\n  -- serialize per (tenant, assignee) to kill the double-book race\n  PERFORM pg_advisory_xact_lock(hashtextextended(p_tenant_id::text || v_assignee::text, 0));\n\n  IF EXISTS (\n    SELECT 1 FROM appointments b\n    WHERE b.tenant_id = p_tenant_id\n      AND b.assignee_id = v_assignee\n      AND b.status NOT IN ('cancelled', 'no_show')\n      AND b.starts_at < v_ends\n      AND COALESCE(b.ends_at, b.starts_at) > p_starts_at\n  ) THEN\n    RAISE EXCEPTION 'slot no longer available';\n  END IF;\n\n  -- anti-spam: cap open future public bookings per phone per tenant\n  IF (\n    SELECT count(*) FROM appointments b\n    JOIN people p ON p.id = b.party_id\n    WHERE b.tenant_id = p_tenant_id\n      AND p.phone = v_phone\n      AND b.starts_at > now()\n      AND b.status = 'scheduled'\n  ) >= 3 THEN\n    RAISE EXCEPTION 'too many open bookings for this phone';\n  END IF;\n\n  -- upsert the client by (tenant, kind, phone). Kind is tenant-configured, so\n  -- the 001 customer-only partial index can't arbitrate \u2014 a per-(tenant,\n  -- phone) advisory lock serializes concurrent first-bookings instead.\n  PERFORM pg_advisory_xact_lock(hashtextextended(p_tenant_id::text || ':' || v_phone, 1));\n\n  SELECT p.id INTO v_person_id\n  FROM people p\n  WHERE p.tenant_id = p_tenant_id AND p.kind = v_client_kind AND p.phone = v_phone\n  ORDER BY p.created_at\n  LIMIT 1;\n\n  IF v_person_id IS NOT NULL THEN\n    UPDATE people SET\n      name = trim(p_name),\n      email = COALESCE(p_email, people.email),\n      updated_at = now()\n    WHERE id = v_person_id;\n  ELSE\n    INSERT INTO people (tenant_id, kind, name, phone, email, metadata)\n    VALUES (p_tenant_id, v_client_kind, trim(p_name), v_phone, p_email,\n            jsonb_build_object('source', 'public_booking'))\n    RETURNING id INTO v_person_id;\n  END IF;\n\n  -- order + booking + order_item (statuses hardcoded \u2014 caller cannot set)\n  INSERT INTO orders (tenant_id, kind, status, party_id, assignee_id, subtotal, total, notes, metadata)\n  VALUES (p_tenant_id, 'appointment', 'scheduled', v_person_id, v_assignee,\n          v_service.price, v_service.price, v_notes,\n          jsonb_build_object('source', 'public_booking',\n                             'serviceNames', v_service.name,\n                             'contactName', trim(p_name)))\n  RETURNING id INTO v_order;\n\n  INSERT INTO appointments (tenant_id, kind, party_id, assignee_id, order_id,\n                        starts_at, ends_at, status, notes, metadata)\n  VALUES (p_tenant_id, 'appointment', v_person_id, v_assignee, v_order,\n          p_starts_at, v_ends, 'scheduled', v_notes,\n          jsonb_build_object('source', 'public_booking', 'serviceNames', v_service.name))\n  RETURNING id INTO v_booking;\n\n  INSERT INTO order_items (order_id, service_id, name, quantity, unit_price, total,\n                           sort_order, duration_minutes, assignee_id)\n  VALUES (v_order, v_service.id, v_service.name, 1, v_service.price, v_service.price,\n          0, v_service.duration_minutes, v_assignee);\n\n  RETURN QUERY SELECT v_booking, p_starts_at, v_ends;\nEND;\n$$;\n\nREVOKE ALL ON FUNCTION public.create_public_booking(uuid, uuid, timestamptz, text, text, text, text) FROM public;\nGRANT EXECUTE ON FUNCTION public.create_public_booking(uuid, uuid, timestamptz, text, text, text, text)\n  TO anon, authenticated, service_role;\n";
 export declare const MIGRATION_004_PUBLIC_BOOKING_ASSIGNEE = "-- ---------------------------------------------------------------------------\n-- Public booking \u2014 respect the professional the visitor saw\n-- ---------------------------------------------------------------------------\n-- Until now create_public_booking IGNORED which professional the site showed\n-- availability for and re-picked by working hours (ORDER BY assignee_id\n-- LIMIT 1). With several professionals covering the same slot the booking\n-- landed on someone else than displayed (\"Equipe Great DJs\" on the site,\n-- \"Rafa Groove\" in the agenda). New optional p_assignee_id:\n--   * provided \u2192 validate THAT professional's working hours cover the slot and\n--     book them \u2014 never silently reassign (mismatch becomes an explicit error);\n--   * NULL \u2192 auto-pick as before (sites that don't pin a professional).\n-- Conflict check + advisory lock already run against the resolved assignee, so\n-- the double-book guard follows whichever path resolves.\n--\n-- Signature change (8th arg): the old 7-arg function is DROPPED first \u2014\n-- CREATE OR REPLACE with a different signature would create an ambiguous\n-- PostgREST overload instead of replacing.\n-- Includes 003's tenant-configurable client kind. Idempotent.\n-- ---------------------------------------------------------------------------\nDROP FUNCTION IF EXISTS public.create_public_booking(uuid, uuid, timestamptz, text, text, text, text);\n\nCREATE OR REPLACE FUNCTION public.create_public_booking(\n  p_tenant_id uuid,\n  p_service_id uuid,\n  p_starts_at timestamptz,\n  p_name text,\n  p_phone text,\n  p_email text DEFAULT NULL,\n  p_notes text DEFAULT NULL,\n  p_assignee_id uuid DEFAULT NULL\n) RETURNS TABLE (booking_id uuid, starts_at timestamptz, ends_at timestamptz)\nLANGUAGE plpgsql SECURITY DEFINER\nSET search_path = public\nAS $$\nDECLARE\n  v_service record;\n  v_person_id uuid;\n  v_assignee uuid;\n  v_ends timestamptz;\n  v_order uuid;\n  v_booking uuid;\n  v_phone text;\n  v_tz text;\n  v_notes text;\n  v_client_kind text;\nBEGIN\n  -- validation: anon-callable, everything tight\n  IF p_name IS NULL OR length(trim(p_name)) NOT BETWEEN 2 AND 120 THEN\n    RAISE EXCEPTION 'invalid name';\n  END IF;\n  v_phone := regexp_replace(COALESCE(p_phone, ''), '\\D', '', 'g');\n  IF length(v_phone) NOT BETWEEN 8 AND 15 THEN\n    RAISE EXCEPTION 'invalid phone';\n  END IF;\n  IF p_email IS NOT NULL AND (length(p_email) > 254 OR p_email !~ '^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$') THEN\n    RAISE EXCEPTION 'invalid email';\n  END IF;\n  v_notes := left(p_notes, 500);\n  IF p_starts_at IS NULL OR p_starts_at <= now() OR p_starts_at > now() + interval '90 days' THEN\n    RAISE EXCEPTION 'invalid start';\n  END IF;\n\n  SELECT s.id, s.name, s.price, COALESCE(s.duration_minutes, 30) AS duration_minutes\n    INTO v_service\n  FROM services s\n  WHERE s.id = p_service_id AND s.tenant_id = p_tenant_id\n    AND s.is_active AND s.status = 'active';\n  IF NOT FOUND THEN RAISE EXCEPTION 'unknown service'; END IF;\n\n  v_ends := p_starts_at + make_interval(mins => v_service.duration_minutes);\n\n  -- tenant config: timezone + client kind (admin-set; sanitized, never caller input)\n  SELECT COALESCE(t.settings->>'timezone', 'America/Sao_Paulo'),\n         COALESCE(NULLIF(trim(t.settings->'booking'->>'client_kind'), ''), 'customer')\n    INTO v_tz, v_client_kind\n  FROM tenants t WHERE t.id = p_tenant_id;\n  IF v_tz IS NULL THEN RAISE EXCEPTION 'unknown tenant'; END IF;\n  IF v_client_kind !~ '^[a-z_]{2,32}$' THEN v_client_kind := 'customer'; END IF;\n\n  -- resolve the professional: the one the visitor saw (validated), else the\n  -- first whose working hours cover the slot\n  SELECT sc.assignee_id INTO v_assignee\n  FROM schedules sc\n  WHERE sc.tenant_id = p_tenant_id\n    AND sc.kind = 'working_hours'\n    AND sc.is_active\n    AND (p_assignee_id IS NULL OR sc.assignee_id = p_assignee_id)\n    AND (\n      sc.specific_date = (p_starts_at AT TIME ZONE v_tz)::date\n      OR (sc.specific_date IS NULL\n          AND sc.day_of_week = EXTRACT(dow FROM p_starts_at AT TIME ZONE v_tz)::smallint)\n    )\n    AND (p_starts_at AT TIME ZONE v_tz)::time >= sc.starts_at\n    AND (v_ends AT TIME ZONE v_tz)::time <= sc.ends_at\n  ORDER BY sc.assignee_id\n  LIMIT 1;\n  IF v_assignee IS NULL THEN RAISE EXCEPTION 'slot outside working hours'; END IF;\n\n  -- serialize per (tenant, assignee) to kill the double-book race\n  PERFORM pg_advisory_xact_lock(hashtextextended(p_tenant_id::text || v_assignee::text, 0));\n\n  IF EXISTS (\n    SELECT 1 FROM appointments b\n    WHERE b.tenant_id = p_tenant_id\n      AND b.assignee_id = v_assignee\n      AND b.status NOT IN ('cancelled', 'no_show')\n      AND b.starts_at < v_ends\n      AND COALESCE(b.ends_at, b.starts_at) > p_starts_at\n  ) THEN\n    RAISE EXCEPTION 'slot no longer available';\n  END IF;\n\n  -- anti-spam: cap open future public bookings per phone per tenant\n  IF (\n    SELECT count(*) FROM appointments b\n    JOIN people p ON p.id = b.party_id\n    WHERE b.tenant_id = p_tenant_id\n      AND p.phone = v_phone\n      AND b.starts_at > now()\n      AND b.status = 'scheduled'\n  ) >= 3 THEN\n    RAISE EXCEPTION 'too many open bookings for this phone';\n  END IF;\n\n  -- upsert the client by (tenant, kind, phone), serialized by advisory lock\n  -- (kind is tenant-configured, so the customer-only partial index can't\n  -- arbitrate)\n  PERFORM pg_advisory_xact_lock(hashtextextended(p_tenant_id::text || ':' || v_phone, 1));\n\n  SELECT p.id INTO v_person_id\n  FROM people p\n  WHERE p.tenant_id = p_tenant_id AND p.kind = v_client_kind AND p.phone = v_phone\n  ORDER BY p.created_at\n  LIMIT 1;\n\n  IF v_person_id IS NOT NULL THEN\n    UPDATE people SET\n      name = trim(p_name),\n      email = COALESCE(p_email, people.email),\n      updated_at = now()\n    WHERE id = v_person_id;\n  ELSE\n    INSERT INTO people (tenant_id, kind, name, phone, email, metadata)\n    VALUES (p_tenant_id, v_client_kind, trim(p_name), v_phone, p_email,\n            jsonb_build_object('source', 'public_booking'))\n    RETURNING id INTO v_person_id;\n  END IF;\n\n  -- order + booking + order_item (statuses hardcoded \u2014 caller cannot set)\n  INSERT INTO orders (tenant_id, kind, status, party_id, assignee_id, subtotal, total, notes, metadata)\n  VALUES (p_tenant_id, 'appointment', 'scheduled', v_person_id, v_assignee,\n          v_service.price, v_service.price, v_notes,\n          jsonb_build_object('source', 'public_booking',\n                             'serviceNames', v_service.name,\n                             'contactName', trim(p_name)))\n  RETURNING id INTO v_order;\n\n  INSERT INTO appointments (tenant_id, kind, party_id, assignee_id, order_id,\n                        starts_at, ends_at, status, notes, metadata)\n  VALUES (p_tenant_id, 'appointment', v_person_id, v_assignee, v_order,\n          p_starts_at, v_ends, 'scheduled', v_notes,\n          jsonb_build_object('source', 'public_booking', 'serviceNames', v_service.name))\n  RETURNING id INTO v_booking;\n\n  INSERT INTO order_items (order_id, service_id, name, quantity, unit_price, total,\n                           sort_order, duration_minutes, assignee_id)\n  VALUES (v_order, v_service.id, v_service.name, 1, v_service.price, v_service.price,\n          0, v_service.duration_minutes, v_assignee);\n\n  RETURN QUERY SELECT v_booking, p_starts_at, v_ends;\nEND;\n$$;\n\nREVOKE ALL ON FUNCTION public.create_public_booking(uuid, uuid, timestamptz, text, text, text, text, uuid) FROM public;\nGRANT EXECUTE ON FUNCTION public.create_public_booking(uuid, uuid, timestamptz, text, text, text, text, uuid)\n  TO anon, authenticated, service_role;\n";
@@ -8,12 +8,17 @@ export declare const MIGRATION_005_AGENT_RPCS = "-- ============================
 export declare const MIGRATION_006_AGENT_RPC_LOCALTIME = "-- ============================================================================\n-- plugin-agenda 006: agent_agenda_create_appointment speaks LOCAL time.\n--\n-- Models reliably mangle UTC\u2194local offsets (\"10h\" became 13:00 BRT via a\n-- wrong sign). The RPC knows the tenant's timezone \u2014 so stop asking the model\n-- to convert: `starts_at` WITHOUT an offset (2026-07-27T10:00) is interpreted\n-- in the tenant tz; an explicit offset still works. The result now carries\n-- starts_at_local/ends_at_local strings so the reply echoes the truth in the\n-- user's own clock. Supersedes 005's function body (new file \u2014 applied\n-- migrations are never edited).\n-- ============================================================================\n\nCREATE OR REPLACE FUNCTION public.agent_agenda_create_appointment(\n  p_tenant_id uuid,\n  p_actor_user_id uuid,\n  p_payload jsonb\n) RETURNS jsonb\nLANGUAGE plpgsql SECURITY DEFINER\nSET search_path = public\nAS $$\nDECLARE\n  v_denial jsonb;\n  v_used int;\n  v_client_id uuid;\n  v_service_id uuid;\n  v_professional uuid;\n  v_starts timestamptz;\n  v_starts_raw text;\n  v_notes text;\n  v_service record;\n  v_client record;\n  v_ends timestamptz;\n  v_tz text;\n  v_order uuid;\n  v_booking uuid;\nBEGIN\n  SELECT COALESCE(t.settings->>'timezone', 'America/Sao_Paulo') INTO v_tz\n  FROM tenants t WHERE t.id = p_tenant_id;\n  IF v_tz IS NULL THEN\n    RETURN jsonb_build_object('ok', false, 'error', 'unknown tenant');\n  END IF;\n\n  -- \u2500\u2500 payload \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  BEGIN\n    v_client_id    := (p_payload->>'client_id')::uuid;\n    v_service_id   := (p_payload->>'service_id')::uuid;\n    v_professional := (p_payload->>'professional_id')::uuid;\n    v_starts_raw   := p_payload->>'starts_at';\n    IF v_starts_raw ~ '(Z|[+-][0-9]{2}:?[0-9]{2})$' THEN\n      v_starts := v_starts_raw::timestamptz;              -- explicit offset\n    ELSE\n      v_starts := (v_starts_raw::timestamp) AT TIME ZONE v_tz;  -- tenant-local\n    END IF;\n  EXCEPTION WHEN OTHERS THEN\n    RETURN jsonb_build_object('ok', false, 'error', 'invalid payload: ' || SQLERRM);\n  END;\n  v_notes := left(p_payload->>'notes', 500);\n  IF v_client_id IS NULL OR v_service_id IS NULL OR v_starts IS NULL THEN\n    RETURN jsonb_build_object('ok', false, 'error', 'client_id, service_id and starts_at are required');\n  END IF;\n  IF v_starts <= now() OR v_starts > now() + interval '365 days' THEN\n    RETURN jsonb_build_object('ok', false, 'error', 'starts_at must be in the future (max 1 year)');\n  END IF;\n\n  -- \u2500\u2500 authorization: role \u2192 plan \u2192 bookings_month cap \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  SELECT count(*) INTO v_used FROM appointments b\n  WHERE b.tenant_id = p_tenant_id\n    AND b.created_at >= date_trunc('month', now());\n  v_denial := agent_guard(p_tenant_id, p_actor_user_id,\n                          'appointments', 'create', 'bookings_month', v_used, 1);\n  IF v_denial IS NOT NULL THEN\n    RETURN jsonb_build_object('ok', false, 'denial', v_denial);\n  END IF;\n\n  -- \u2500\u2500 invariants \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  SELECT p.id, p.name INTO v_client\n  FROM people p\n  WHERE p.id = v_client_id AND p.tenant_id = p_tenant_id;\n  IF NOT FOUND THEN\n    RETURN jsonb_build_object('ok', false, 'error', 'unknown client for this tenant');\n  END IF;\n\n  SELECT s.id, s.name, s.price, COALESCE(s.duration_minutes, 30) AS duration_minutes\n    INTO v_service\n  FROM services s\n  WHERE s.id = v_service_id AND s.tenant_id = p_tenant_id\n    AND s.is_active AND s.status = 'active';\n  IF NOT FOUND THEN\n    RETURN jsonb_build_object('ok', false, 'error', 'unknown or inactive service');\n  END IF;\n\n  v_ends := v_starts + make_interval(mins => v_service.duration_minutes);\n\n  SELECT sc.assignee_id INTO v_professional\n  FROM schedules sc\n  WHERE sc.tenant_id = p_tenant_id\n    AND sc.kind = 'working_hours'\n    AND sc.is_active\n    AND (v_professional IS NULL OR sc.assignee_id = v_professional)\n    AND (\n      sc.specific_date = (v_starts AT TIME ZONE v_tz)::date\n      OR (sc.specific_date IS NULL\n          AND sc.day_of_week = EXTRACT(dow FROM v_starts AT TIME ZONE v_tz)::smallint)\n    )\n    AND (v_starts AT TIME ZONE v_tz)::time >= sc.starts_at\n    AND (v_ends AT TIME ZONE v_tz)::time <= sc.ends_at\n    -- prefer a professional who is actually FREE at the slot (when the user\n    -- did not name one, the first busy professional must not block the booking)\n    AND NOT EXISTS (\n      SELECT 1 FROM appointments b\n      WHERE b.tenant_id = p_tenant_id\n        AND b.assignee_id = sc.assignee_id\n        AND b.status NOT IN ('cancelled', 'no_show')\n        AND b.starts_at < v_ends\n        AND COALESCE(b.ends_at, b.starts_at) > v_starts\n    )\n  ORDER BY sc.assignee_id\n  LIMIT 1;\n  IF v_professional IS NULL THEN\n    RETURN jsonb_build_object('ok', false, 'error',\n      'no professional is available at that slot (outside working hours or already booked). Suggest a different time. Times are tenant-local, tz ' || v_tz);\n  END IF;\n\n  PERFORM pg_advisory_xact_lock(hashtextextended(p_tenant_id::text || v_professional::text, 0));\n  IF EXISTS (\n    SELECT 1 FROM appointments b\n    WHERE b.tenant_id = p_tenant_id\n      AND b.assignee_id = v_professional\n      AND b.status NOT IN ('cancelled', 'no_show')\n      AND b.starts_at < v_ends\n      AND COALESCE(b.ends_at, b.starts_at) > v_starts\n  ) THEN\n    RETURN jsonb_build_object('ok', false, 'error', 'slot no longer available');\n  END IF;\n\n  -- \u2500\u2500 write + audit \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  INSERT INTO orders (tenant_id, kind, status, party_id, assignee_id, subtotal, total, notes, metadata)\n  VALUES (p_tenant_id, 'appointment', 'scheduled', v_client_id, v_professional,\n          v_service.price, v_service.price, v_notes,\n          jsonb_build_object('source', 'agent', 'serviceNames', v_service.name))\n  RETURNING id INTO v_order;\n\n  INSERT INTO appointments (tenant_id, kind, party_id, assignee_id, order_id,\n                            starts_at, ends_at, status, notes, metadata)\n  VALUES (p_tenant_id, 'appointment', v_client_id, v_professional, v_order,\n          v_starts, v_ends, 'scheduled', v_notes,\n          jsonb_build_object('source', 'agent', 'serviceNames', v_service.name))\n  RETURNING id INTO v_booking;\n\n  INSERT INTO order_items (order_id, service_id, name, quantity, unit_price, total,\n                           sort_order, duration_minutes, assignee_id)\n  VALUES (v_order, v_service.id, v_service.name, 1, v_service.price, v_service.price,\n          0, v_service.duration_minutes, v_professional);\n\n  INSERT INTO audit_logs (tenant_id, user_id, action, entity_type, entity_id, metadata)\n  VALUES (p_tenant_id, p_actor_user_id, 'agent.createAppointment', 'appointment', v_booking::text,\n          jsonb_build_object('payload', p_payload, 'order_id', v_order));\n\n  RETURN jsonb_build_object(\n    'ok', true,\n    'id', v_booking,\n    'record', jsonb_build_object(\n      'ref', jsonb_build_object('id', v_booking, 'resource', 'appointments',\n                                'archetype', 'schedule:appointment'),\n      'starts_at', v_starts,\n      'ends_at', v_ends,\n      'starts_at_local', to_char(v_starts AT TIME ZONE v_tz, 'YYYY-MM-DD (Dy) HH24:MI') || ' ' || v_tz,\n      'ends_at_local', to_char(v_ends AT TIME ZONE v_tz, 'HH24:MI'),\n      'client_name', v_client.name,\n      'service_name', v_service.name,\n      'price', v_service.price,\n      'status', 'scheduled'\n    )\n  );\nEND;\n$$;\n\nREVOKE ALL ON FUNCTION public.agent_agenda_create_appointment(uuid, uuid, jsonb) FROM public;\nREVOKE EXECUTE ON FUNCTION public.agent_agenda_create_appointment(uuid, uuid, jsonb) FROM anon;\nGRANT EXECUTE ON FUNCTION public.agent_agenda_create_appointment(uuid, uuid, jsonb)\n  TO authenticated, service_role;\n";
 export declare const MIGRATION_007_SCHEDULE_EXCEPTION_PRECEDENCE = "-- ============================================================================\n-- plugin-agenda 007: specific-date exceptions take PRECEDENCE over weekly hours.\n--\n-- The admin ScheduleEditor (saveException) writes two kinds of specific-date\n-- rows: 'available' = active rows with custom windows for the date; day off\n-- ('unavailable') = ONE inactive 00:00\u201300:00 sentinel. Until now every reader\n-- treated schedules as a flat union filtered by is_active, so:\n--   \u2022 a day off was INVISIBLE (inactive sentinel filtered out, weekly rows\n--     still matched) \u2014 the public site kept selling a day the admin closed;\n--   \u2022 an 'available' exception ADDED to the weekly hours instead of replacing\n--     them (\"hor\u00E1rio especial\" should define the date's hours).\n--\n-- Fix: one helper \u2014 agenda_working_windows(tenant, date, assignee) \u2014 is now the\n-- single source of a day's windows: if ANY specific-date row exists for an\n-- assignee (active or sentinel), only the ACTIVE specific-date rows count for\n-- that assignee; otherwise the weekly (day_of_week) rows apply. Both readers\n-- are redefined on top of it:\n--   \u2022 get_available_slots \u2014 body otherwise identical to the latest version\n--     (google-calendar/002_smart_sync \u00A75, tenant-wide 'block' clause KEPT);\n--   \u2022 create_public_booking \u2014 body otherwise identical to 004.\n--\n-- ORDERING: on pools with the Google Calendar connector this file must run\n-- AFTER integrations/google-calendar/migrations/002_smart_sync.sql (both\n-- redefine get_available_slots; 007 is the superset and must win). Re-running\n-- 007 last is always safe \u2014 it preserves 002's block semantics.\n-- ============================================================================\n\n-- ----------------------------------------------------------------------------\n-- \u00A71  agenda_working_windows \u2014 the day's working windows, exception-aware.\n-- ----------------------------------------------------------------------------\nCREATE OR REPLACE FUNCTION public.agenda_working_windows(\n  p_tenant_id uuid,\n  p_date date,\n  p_assignee_id uuid DEFAULT NULL\n) RETURNS TABLE (assignee_id uuid, win_start time, win_end time)\nLANGUAGE sql STABLE\nSET search_path = public\nAS $$\n  WITH exc AS (\n    -- Every specific-date row for the date, ACTIVE OR NOT: the inactive day-off\n    -- sentinel must still suppress the weekly rows below.\n    SELECT sc.assignee_id, sc.starts_at, sc.ends_at, sc.is_active\n    FROM schedules sc\n    WHERE sc.tenant_id = p_tenant_id\n      AND sc.kind = 'working_hours'\n      AND sc.specific_date = p_date\n      AND (p_assignee_id IS NULL OR sc.assignee_id = p_assignee_id)\n  )\n  SELECT e.assignee_id, e.starts_at, e.ends_at\n  FROM exc e\n  WHERE e.is_active\n  UNION ALL\n  SELECT sc.assignee_id, sc.starts_at, sc.ends_at\n  FROM schedules sc\n  WHERE sc.tenant_id = p_tenant_id\n    AND sc.kind = 'working_hours'\n    AND sc.is_active\n    AND sc.specific_date IS NULL\n    AND sc.day_of_week = EXTRACT(dow FROM p_date)::smallint\n    AND (p_assignee_id IS NULL OR sc.assignee_id = p_assignee_id)\n    AND NOT EXISTS (SELECT 1 FROM exc e WHERE e.assignee_id = sc.assignee_id)\n$$;\n\nREVOKE ALL ON FUNCTION public.agenda_working_windows(uuid, date, uuid) FROM public;\nREVOKE EXECUTE ON FUNCTION public.agenda_working_windows(uuid, date, uuid) FROM anon;\nGRANT EXECUTE ON FUNCTION public.agenda_working_windows(uuid, date, uuid)\n  TO authenticated, service_role;\n\n-- ----------------------------------------------------------------------------\n-- \u00A72  get_available_slots \u2014 day_schedules now comes from the helper.\n--     Everything else is byte-identical to google-calendar/002_smart_sync \u00A75.\n-- ----------------------------------------------------------------------------\nCREATE OR REPLACE FUNCTION public.get_available_slots(\n  p_tenant_id uuid,\n  p_date date,\n  p_duration_minutes integer,\n  p_assignee_id uuid DEFAULT NULL,\n  p_slot_interval integer DEFAULT 30\n) RETURNS TABLE (slot_start timestamptz, slot_end timestamptz)\nLANGUAGE plpgsql STABLE SECURITY DEFINER\nSET search_path = public\nAS $$\nDECLARE\n  v_tz text;\nBEGIN\n  -- tight validation: this function is anon-callable\n  IF p_duration_minutes IS NULL OR p_duration_minutes NOT BETWEEN 5 AND 480 THEN\n    RAISE EXCEPTION 'invalid duration';\n  END IF;\n  IF p_slot_interval IS NULL OR p_slot_interval NOT BETWEEN 5 AND 240 THEN\n    RAISE EXCEPTION 'invalid interval';\n  END IF;\n  IF p_date IS NULL OR p_date < current_date OR p_date > current_date + 90 THEN\n    RETURN;\n  END IF;\n\n  SELECT COALESCE(t.settings->>'timezone', 'America/Sao_Paulo') INTO v_tz\n  FROM tenants t WHERE t.id = p_tenant_id;\n  IF v_tz IS NULL THEN RETURN; END IF;  -- unknown tenant \u2192 empty, not an error\n\n  RETURN QUERY\n  WITH day_schedules AS (\n    SELECT w.assignee_id, w.win_start, w.win_end\n    FROM agenda_working_windows(p_tenant_id, p_date, p_assignee_id) w\n  ),\n  candidate AS (\n    SELECT\n      ds.assignee_id,\n      gs                                              AS s_start,\n      gs + make_interval(mins => p_duration_minutes)  AS s_end\n    FROM day_schedules ds\n    CROSS JOIN LATERAL generate_series(\n      (p_date + ds.win_start) AT TIME ZONE v_tz,\n      ((p_date + ds.win_end) AT TIME ZONE v_tz) - make_interval(mins => p_duration_minutes),\n      make_interval(mins => p_slot_interval)\n    ) AS gs\n  )\n  SELECT DISTINCT c.s_start, c.s_end\n  FROM candidate c\n  WHERE NOT EXISTS (\n    SELECT 1 FROM appointments b\n    WHERE b.tenant_id = p_tenant_id\n      -- SMART SYNC (gcal 002): this professional's own bookings OR any\n      -- tenant-wide BLOCK (assignee_id IS NULL AND kind='block') busy the slot.\n      AND (b.assignee_id = c.assignee_id\n           OR (b.assignee_id IS NULL AND b.kind = 'block'))\n      AND b.status NOT IN ('cancelled', 'no_show')\n      AND b.starts_at < c.s_end\n      AND COALESCE(b.ends_at, b.starts_at) > c.s_start\n  )\n  ORDER BY 1;\nEND;\n$$;\n\nREVOKE ALL ON FUNCTION public.get_available_slots(uuid, date, integer, uuid, integer) FROM public;\nGRANT EXECUTE ON FUNCTION public.get_available_slots(uuid, date, integer, uuid, integer)\n  TO anon, authenticated, service_role;\n\n-- ----------------------------------------------------------------------------\n-- \u00A73  create_public_booking \u2014 professional resolution goes through the helper\n--     (a booking on a closed date now fails 'slot outside working hours').\n--     Everything else is byte-identical to 004.\n-- ----------------------------------------------------------------------------\nCREATE OR REPLACE FUNCTION public.create_public_booking(\n  p_tenant_id uuid,\n  p_service_id uuid,\n  p_starts_at timestamptz,\n  p_name text,\n  p_phone text,\n  p_email text DEFAULT NULL,\n  p_notes text DEFAULT NULL,\n  p_assignee_id uuid DEFAULT NULL\n) RETURNS TABLE (booking_id uuid, starts_at timestamptz, ends_at timestamptz)\nLANGUAGE plpgsql SECURITY DEFINER\nSET search_path = public\nAS $$\nDECLARE\n  v_service record;\n  v_person_id uuid;\n  v_assignee uuid;\n  v_ends timestamptz;\n  v_order uuid;\n  v_booking uuid;\n  v_phone text;\n  v_tz text;\n  v_notes text;\n  v_client_kind text;\nBEGIN\n  -- validation: anon-callable, everything tight\n  IF p_name IS NULL OR length(trim(p_name)) NOT BETWEEN 2 AND 120 THEN\n    RAISE EXCEPTION 'invalid name';\n  END IF;\n  v_phone := regexp_replace(COALESCE(p_phone, ''), '\\D', '', 'g');\n  IF length(v_phone) NOT BETWEEN 8 AND 15 THEN\n    RAISE EXCEPTION 'invalid phone';\n  END IF;\n  IF p_email IS NOT NULL AND (length(p_email) > 254 OR p_email !~ '^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$') THEN\n    RAISE EXCEPTION 'invalid email';\n  END IF;\n  v_notes := left(p_notes, 500);\n  IF p_starts_at IS NULL OR p_starts_at <= now() OR p_starts_at > now() + interval '90 days' THEN\n    RAISE EXCEPTION 'invalid start';\n  END IF;\n\n  SELECT s.id, s.name, s.price, COALESCE(s.duration_minutes, 30) AS duration_minutes\n    INTO v_service\n  FROM services s\n  WHERE s.id = p_service_id AND s.tenant_id = p_tenant_id\n    AND s.is_active AND s.status = 'active';\n  IF NOT FOUND THEN RAISE EXCEPTION 'unknown service'; END IF;\n\n  v_ends := p_starts_at + make_interval(mins => v_service.duration_minutes);\n\n  -- tenant config: timezone + client kind (admin-set; sanitized, never caller input)\n  SELECT COALESCE(t.settings->>'timezone', 'America/Sao_Paulo'),\n         COALESCE(NULLIF(trim(t.settings->'booking'->>'client_kind'), ''), 'customer')\n    INTO v_tz, v_client_kind\n  FROM tenants t WHERE t.id = p_tenant_id;\n  IF v_tz IS NULL THEN RAISE EXCEPTION 'unknown tenant'; END IF;\n  IF v_client_kind !~ '^[a-z_]{2,32}$' THEN v_client_kind := 'customer'; END IF;\n\n  -- resolve the professional: the one the visitor saw (validated), else the\n  -- first whose EXCEPTION-AWARE working hours cover the slot (007)\n  SELECT w.assignee_id INTO v_assignee\n  FROM agenda_working_windows(\n         p_tenant_id, (p_starts_at AT TIME ZONE v_tz)::date, p_assignee_id) w\n  WHERE (p_starts_at AT TIME ZONE v_tz)::time >= w.win_start\n    AND (v_ends AT TIME ZONE v_tz)::time <= w.win_end\n  ORDER BY w.assignee_id\n  LIMIT 1;\n  IF v_assignee IS NULL THEN RAISE EXCEPTION 'slot outside working hours'; END IF;\n\n  -- serialize per (tenant, assignee) to kill the double-book race\n  PERFORM pg_advisory_xact_lock(hashtextextended(p_tenant_id::text || v_assignee::text, 0));\n\n  IF EXISTS (\n    SELECT 1 FROM appointments b\n    WHERE b.tenant_id = p_tenant_id\n      AND b.assignee_id = v_assignee\n      AND b.status NOT IN ('cancelled', 'no_show')\n      AND b.starts_at < v_ends\n      AND COALESCE(b.ends_at, b.starts_at) > p_starts_at\n  ) THEN\n    RAISE EXCEPTION 'slot no longer available';\n  END IF;\n\n  -- anti-spam: cap open future public bookings per phone per tenant\n  IF (\n    SELECT count(*) FROM appointments b\n    JOIN people p ON p.id = b.party_id\n    WHERE b.tenant_id = p_tenant_id\n      AND p.phone = v_phone\n      AND b.starts_at > now()\n      AND b.status = 'scheduled'\n  ) >= 3 THEN\n    RAISE EXCEPTION 'too many open bookings for this phone';\n  END IF;\n\n  -- upsert the client by (tenant, kind, phone), serialized by advisory lock\n  -- (kind is tenant-configured, so the customer-only partial index can't\n  -- arbitrate)\n  PERFORM pg_advisory_xact_lock(hashtextextended(p_tenant_id::text || ':' || v_phone, 1));\n\n  SELECT p.id INTO v_person_id\n  FROM people p\n  WHERE p.tenant_id = p_tenant_id AND p.kind = v_client_kind AND p.phone = v_phone\n  ORDER BY p.created_at\n  LIMIT 1;\n\n  IF v_person_id IS NOT NULL THEN\n    UPDATE people SET\n      name = trim(p_name),\n      email = COALESCE(p_email, people.email),\n      updated_at = now()\n    WHERE id = v_person_id;\n  ELSE\n    INSERT INTO people (tenant_id, kind, name, phone, email, metadata)\n    VALUES (p_tenant_id, v_client_kind, trim(p_name), v_phone, p_email,\n            jsonb_build_object('source', 'public_booking'))\n    RETURNING id INTO v_person_id;\n  END IF;\n\n  -- order + booking + order_item (statuses hardcoded \u2014 caller cannot set)\n  INSERT INTO orders (tenant_id, kind, status, party_id, assignee_id, subtotal, total, notes, metadata)\n  VALUES (p_tenant_id, 'appointment', 'scheduled', v_person_id, v_assignee,\n          v_service.price, v_service.price, v_notes,\n          jsonb_build_object('source', 'public_booking',\n                             'serviceNames', v_service.name,\n                             'contactName', trim(p_name)))\n  RETURNING id INTO v_order;\n\n  INSERT INTO appointments (tenant_id, kind, party_id, assignee_id, order_id,\n                        starts_at, ends_at, status, notes, metadata)\n  VALUES (p_tenant_id, 'appointment', v_person_id, v_assignee, v_order,\n          p_starts_at, v_ends, 'scheduled', v_notes,\n          jsonb_build_object('source', 'public_booking', 'serviceNames', v_service.name))\n  RETURNING id INTO v_booking;\n\n  INSERT INTO order_items (order_id, service_id, name, quantity, unit_price, total,\n                           sort_order, duration_minutes, assignee_id)\n  VALUES (v_order, v_service.id, v_service.name, 1, v_service.price, v_service.price,\n          0, v_service.duration_minutes, v_assignee);\n\n  RETURN QUERY SELECT v_booking, p_starts_at, v_ends;\nEND;\n$$;\n\nREVOKE ALL ON FUNCTION public.create_public_booking(uuid, uuid, timestamptz, text, text, text, text, uuid) FROM public;\nGRANT EXECUTE ON FUNCTION public.create_public_booking(uuid, uuid, timestamptz, text, text, text, text, uuid)\n  TO anon, authenticated, service_role;\n";
 export declare const MIGRATION_008_AGENT_RPC_EXCEPTION_PRECEDENCE = "-- ============================================================================\n-- plugin-agenda 008: agent_agenda_create_appointment honors schedule exceptions.\n--\n-- Same precedence fix as 007, applied to the agent write path: professional\n-- resolution now goes through agenda_working_windows (007 \u00A71), so a date the\n-- admin closed (day-off sentinel) or re-opened with custom hours (\"hor\u00E1rio\n-- especial\") binds the agent exactly like it binds the public site. Everything\n-- else is byte-identical to 006 (LOCAL-time input, free-professional pick,\n-- advisory lock, audit). Requires 007. Supersedes 006's function body.\n-- ============================================================================\n\nCREATE OR REPLACE FUNCTION public.agent_agenda_create_appointment(\n  p_tenant_id uuid,\n  p_actor_user_id uuid,\n  p_payload jsonb\n) RETURNS jsonb\nLANGUAGE plpgsql SECURITY DEFINER\nSET search_path = public\nAS $$\nDECLARE\n  v_denial jsonb;\n  v_used int;\n  v_client_id uuid;\n  v_service_id uuid;\n  v_professional uuid;\n  v_starts timestamptz;\n  v_starts_raw text;\n  v_notes text;\n  v_service record;\n  v_client record;\n  v_ends timestamptz;\n  v_tz text;\n  v_order uuid;\n  v_booking uuid;\nBEGIN\n  SELECT COALESCE(t.settings->>'timezone', 'America/Sao_Paulo') INTO v_tz\n  FROM tenants t WHERE t.id = p_tenant_id;\n  IF v_tz IS NULL THEN\n    RETURN jsonb_build_object('ok', false, 'error', 'unknown tenant');\n  END IF;\n\n  -- \u2500\u2500 payload \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  BEGIN\n    v_client_id    := (p_payload->>'client_id')::uuid;\n    v_service_id   := (p_payload->>'service_id')::uuid;\n    v_professional := (p_payload->>'professional_id')::uuid;\n    v_starts_raw   := p_payload->>'starts_at';\n    IF v_starts_raw ~ '(Z|[+-][0-9]{2}:?[0-9]{2})$' THEN\n      v_starts := v_starts_raw::timestamptz;              -- explicit offset\n    ELSE\n      v_starts := (v_starts_raw::timestamp) AT TIME ZONE v_tz;  -- tenant-local\n    END IF;\n  EXCEPTION WHEN OTHERS THEN\n    RETURN jsonb_build_object('ok', false, 'error', 'invalid payload: ' || SQLERRM);\n  END;\n  v_notes := left(p_payload->>'notes', 500);\n  IF v_client_id IS NULL OR v_service_id IS NULL OR v_starts IS NULL THEN\n    RETURN jsonb_build_object('ok', false, 'error', 'client_id, service_id and starts_at are required');\n  END IF;\n  IF v_starts <= now() OR v_starts > now() + interval '365 days' THEN\n    RETURN jsonb_build_object('ok', false, 'error', 'starts_at must be in the future (max 1 year)');\n  END IF;\n\n  -- \u2500\u2500 authorization: role \u2192 plan \u2192 bookings_month cap \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  SELECT count(*) INTO v_used FROM appointments b\n  WHERE b.tenant_id = p_tenant_id\n    AND b.created_at >= date_trunc('month', now());\n  v_denial := agent_guard(p_tenant_id, p_actor_user_id,\n                          'appointments', 'create', 'bookings_month', v_used, 1);\n  IF v_denial IS NOT NULL THEN\n    RETURN jsonb_build_object('ok', false, 'denial', v_denial);\n  END IF;\n\n  -- \u2500\u2500 invariants \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  SELECT p.id, p.name INTO v_client\n  FROM people p\n  WHERE p.id = v_client_id AND p.tenant_id = p_tenant_id;\n  IF NOT FOUND THEN\n    RETURN jsonb_build_object('ok', false, 'error', 'unknown client for this tenant');\n  END IF;\n\n  SELECT s.id, s.name, s.price, COALESCE(s.duration_minutes, 30) AS duration_minutes\n    INTO v_service\n  FROM services s\n  WHERE s.id = v_service_id AND s.tenant_id = p_tenant_id\n    AND s.is_active AND s.status = 'active';\n  IF NOT FOUND THEN\n    RETURN jsonb_build_object('ok', false, 'error', 'unknown or inactive service');\n  END IF;\n\n  v_ends := v_starts + make_interval(mins => v_service.duration_minutes);\n\n  -- exception-aware windows (007); still prefer a professional who is FREE at\n  -- the slot when the user did not name one\n  SELECT w.assignee_id INTO v_professional\n  FROM agenda_working_windows(\n         p_tenant_id, (v_starts AT TIME ZONE v_tz)::date, v_professional) w\n  WHERE (v_starts AT TIME ZONE v_tz)::time >= w.win_start\n    AND (v_ends AT TIME ZONE v_tz)::time <= w.win_end\n    AND NOT EXISTS (\n      SELECT 1 FROM appointments b\n      WHERE b.tenant_id = p_tenant_id\n        AND b.assignee_id = w.assignee_id\n        AND b.status NOT IN ('cancelled', 'no_show')\n        AND b.starts_at < v_ends\n        AND COALESCE(b.ends_at, b.starts_at) > v_starts\n    )\n  ORDER BY w.assignee_id\n  LIMIT 1;\n  IF v_professional IS NULL THEN\n    RETURN jsonb_build_object('ok', false, 'error',\n      'no professional is available at that slot (outside working hours or already booked). Suggest a different time. Times are tenant-local, tz ' || v_tz);\n  END IF;\n\n  PERFORM pg_advisory_xact_lock(hashtextextended(p_tenant_id::text || v_professional::text, 0));\n  IF EXISTS (\n    SELECT 1 FROM appointments b\n    WHERE b.tenant_id = p_tenant_id\n      AND b.assignee_id = v_professional\n      AND b.status NOT IN ('cancelled', 'no_show')\n      AND b.starts_at < v_ends\n      AND COALESCE(b.ends_at, b.starts_at) > v_starts\n  ) THEN\n    RETURN jsonb_build_object('ok', false, 'error', 'slot no longer available');\n  END IF;\n\n  -- \u2500\u2500 write + audit \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  INSERT INTO orders (tenant_id, kind, status, party_id, assignee_id, subtotal, total, notes, metadata)\n  VALUES (p_tenant_id, 'appointment', 'scheduled', v_client_id, v_professional,\n          v_service.price, v_service.price, v_notes,\n          jsonb_build_object('source', 'agent', 'serviceNames', v_service.name))\n  RETURNING id INTO v_order;\n\n  INSERT INTO appointments (tenant_id, kind, party_id, assignee_id, order_id,\n                            starts_at, ends_at, status, notes, metadata)\n  VALUES (p_tenant_id, 'appointment', v_client_id, v_professional, v_order,\n          v_starts, v_ends, 'scheduled', v_notes,\n          jsonb_build_object('source', 'agent', 'serviceNames', v_service.name))\n  RETURNING id INTO v_booking;\n\n  INSERT INTO order_items (order_id, service_id, name, quantity, unit_price, total,\n                           sort_order, duration_minutes, assignee_id)\n  VALUES (v_order, v_service.id, v_service.name, 1, v_service.price, v_service.price,\n          0, v_service.duration_minutes, v_professional);\n\n  INSERT INTO audit_logs (tenant_id, user_id, action, entity_type, entity_id, metadata)\n  VALUES (p_tenant_id, p_actor_user_id, 'agent.createAppointment', 'appointment', v_booking::text,\n          jsonb_build_object('payload', p_payload, 'order_id', v_order));\n\n  RETURN jsonb_build_object(\n    'ok', true,\n    'id', v_booking,\n    'record', jsonb_build_object(\n      'ref', jsonb_build_object('id', v_booking, 'resource', 'appointments',\n                                'archetype', 'schedule:appointment'),\n      'starts_at', v_starts,\n      'ends_at', v_ends,\n      'starts_at_local', to_char(v_starts AT TIME ZONE v_tz, 'YYYY-MM-DD (Dy) HH24:MI') || ' ' || v_tz,\n      'ends_at_local', to_char(v_ends AT TIME ZONE v_tz, 'HH24:MI'),\n      'client_name', v_client.name,\n      'service_name', v_service.name,\n      'price', v_service.price,\n      'status', 'scheduled'\n    )\n  );\nEND;\n$$;\n\nREVOKE ALL ON FUNCTION public.agent_agenda_create_appointment(uuid, uuid, jsonb) FROM public;\nREVOKE EXECUTE ON FUNCTION public.agent_agenda_create_appointment(uuid, uuid, jsonb) FROM anon;\nGRANT EXECUTE ON FUNCTION public.agent_agenda_create_appointment(uuid, uuid, jsonb)\n  TO authenticated, service_role;\n";
-export declare const MIGRATION_009_PUBLIC_BOOKING_LOCATION = "-- Public bookings were written with location_id = NULL. The agenda's location\n-- filter is optional (default \"all\"), so they still rendered \u2014 but the moment\n-- an operator filtered by their unit, every booking taken from the website\n-- disappeared from the calendar. Single-location tenants are the common case\n-- and have an unambiguous answer, so default to it; multi-location tenants\n-- stay NULL (there is no correct guess) until the public flow asks.\n--\n-- Only the assignment is new; the rest of the body is unchanged from 004.\n\nCREATE OR REPLACE FUNCTION public.create_public_booking(\n  p_tenant_id uuid,\n  p_service_id uuid,\n  p_starts_at timestamptz,\n  p_name text,\n  p_phone text,\n  p_email text DEFAULT NULL,\n  p_notes text DEFAULT NULL\n)\nRETURNS TABLE(booking_id uuid, starts_at timestamptz, ends_at timestamptz)\nLANGUAGE plpgsql\nSECURITY DEFINER\nSET search_path TO 'public'\nAS $function$\nDECLARE\n  v_service record;\n  v_person_id uuid;\n  v_assignee uuid;\n  v_ends timestamptz;\n  v_order uuid;\n  v_booking uuid;\n  v_phone text;\n  v_tz text;\n  v_notes text;\n  v_location uuid;\nBEGIN\n  -- validation: anon-callable, everything tight\n  IF p_name IS NULL OR length(trim(p_name)) NOT BETWEEN 2 AND 120 THEN\n    RAISE EXCEPTION 'invalid name';\n  END IF;\n  v_phone := regexp_replace(COALESCE(p_phone, ''), '\\D', '', 'g');\n  IF length(v_phone) NOT BETWEEN 8 AND 15 THEN\n    RAISE EXCEPTION 'invalid phone';\n  END IF;\n  IF p_email IS NOT NULL AND (length(p_email) > 254 OR p_email !~ '^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$') THEN\n    RAISE EXCEPTION 'invalid email';\n  END IF;\n  v_notes := left(p_notes, 500);\n  IF p_starts_at IS NULL OR p_starts_at <= now() OR p_starts_at > now() + interval '90 days' THEN\n    RAISE EXCEPTION 'invalid start';\n  END IF;\n\n  SELECT s.id, s.name, s.price, COALESCE(s.duration_minutes, 30) AS duration_minutes\n    INTO v_service\n  FROM services s\n  WHERE s.id = p_service_id AND s.tenant_id = p_tenant_id\n    AND s.is_active AND s.status = 'active';\n  IF NOT FOUND THEN RAISE EXCEPTION 'unknown service'; END IF;\n\n  v_ends := p_starts_at + make_interval(mins => v_service.duration_minutes);\n  SELECT COALESCE(t.settings->>'timezone', 'America/Sao_Paulo') INTO v_tz\n  FROM tenants t WHERE t.id = p_tenant_id;\n  IF v_tz IS NULL THEN RAISE EXCEPTION 'unknown tenant'; END IF;\n\n  -- pick the assignee whose working hours cover the slot\n  SELECT sc.assignee_id INTO v_assignee\n  FROM schedules sc\n  WHERE sc.tenant_id = p_tenant_id\n    AND sc.kind = 'working_hours'\n    AND sc.is_active\n    AND (\n      sc.specific_date = (p_starts_at AT TIME ZONE v_tz)::date\n      OR (sc.specific_date IS NULL\n          AND sc.day_of_week = EXTRACT(dow FROM p_starts_at AT TIME ZONE v_tz)::smallint)\n    )\n    AND (p_starts_at AT TIME ZONE v_tz)::time >= sc.starts_at\n    AND (v_ends AT TIME ZONE v_tz)::time <= sc.ends_at\n  ORDER BY sc.assignee_id\n  LIMIT 1;\n  IF v_assignee IS NULL THEN RAISE EXCEPTION 'slot outside working hours'; END IF;\n\n  -- NEW: stamp the unit so the calendar's location filter keeps these visible.\n  -- Prefer the schedule's own location; else the tenant's only location.\n  SELECT sc.location_id INTO v_location\n  FROM schedules sc\n  WHERE sc.tenant_id = p_tenant_id\n    AND sc.kind = 'working_hours'\n    AND sc.is_active\n    AND sc.assignee_id = v_assignee\n    AND sc.location_id IS NOT NULL\n  LIMIT 1;\n\n  IF v_location IS NULL THEN\n    SELECT l.id INTO v_location\n    FROM locations l\n    WHERE l.tenant_id = p_tenant_id\n    HAVING count(*) = 1;  -- unambiguous only\n  END IF;\n\n  -- serialize per (tenant, assignee) to kill the double-book race\n  PERFORM pg_advisory_xact_lock(hashtextextended(p_tenant_id::text || v_assignee::text, 0));\n\n  IF EXISTS (\n    SELECT 1 FROM appointments b\n    WHERE b.tenant_id = p_tenant_id\n      AND b.assignee_id = v_assignee\n      AND b.status NOT IN ('cancelled', 'no_show')\n      AND b.starts_at < v_ends\n      AND COALESCE(b.ends_at, b.starts_at) > p_starts_at\n  ) THEN\n    RAISE EXCEPTION 'slot no longer available';\n  END IF;\n\n  -- anti-spam: cap open future public bookings per phone per tenant\n  IF (\n    SELECT count(*) FROM appointments b\n    JOIN people p ON p.id = b.party_id\n    WHERE b.tenant_id = p_tenant_id\n      AND p.phone = v_phone\n      AND b.starts_at > now()\n      AND b.status = 'scheduled'\n  ) >= 3 THEN\n    RAISE EXCEPTION 'too many open bookings for this phone';\n  END IF;\n\n  -- upsert the customer by (tenant, phone) \u2014 matches people_tenant_customer_phone\n  INSERT INTO people (tenant_id, kind, name, phone, email, metadata)\n  VALUES (p_tenant_id, 'customer', trim(p_name), v_phone, p_email,\n          jsonb_build_object('source', 'public_booking'))\n  ON CONFLICT (tenant_id, phone) WHERE kind = 'customer' AND phone IS NOT NULL\n  DO UPDATE SET\n    name = EXCLUDED.name,\n    email = COALESCE(EXCLUDED.email, people.email),\n    updated_at = now()\n  RETURNING id INTO v_person_id;\n\n  -- order + booking + order_item (statuses hardcoded \u2014 caller cannot set)\n  INSERT INTO orders (tenant_id, kind, status, party_id, assignee_id, location_id,\n                      subtotal, total, notes, metadata)\n  VALUES (p_tenant_id, 'appointment', 'scheduled', v_person_id, v_assignee, v_location,\n          v_service.price, v_service.price, v_notes,\n          jsonb_build_object('source', 'public_booking',\n                             'serviceNames', v_service.name,\n                             'contactName', trim(p_name)))\n  RETURNING id INTO v_order;\n\n  INSERT INTO appointments (tenant_id, kind, party_id, assignee_id, order_id, location_id,\n                        starts_at, ends_at, status, notes, metadata)\n  VALUES (p_tenant_id, 'appointment', v_person_id, v_assignee, v_order, v_location,\n          p_starts_at, v_ends, 'scheduled', v_notes,\n          jsonb_build_object('source', 'public_booking', 'serviceNames', v_service.name))\n  RETURNING id INTO v_booking;\n\n  INSERT INTO order_items (order_id, service_id, name, quantity, unit_price, total,\n                           sort_order, duration_minutes, assignee_id)\n  VALUES (v_order, v_service.id, v_service.name, 1, v_service.price, v_service.price,\n          0, v_service.duration_minutes, v_assignee);\n\n  RETURN QUERY SELECT v_booking, p_starts_at, v_ends;\nEND;\n$function$;\n\nGRANT EXECUTE ON FUNCTION public.create_public_booking(uuid, uuid, timestamptz, text, text, text, text) TO anon, authenticated;\n";
+export declare const MIGRATION_009_PUBLIC_BOOKING_LOCATION = "-- Public bookings were written with location_id = NULL. The agenda's location\n-- filter is optional (default \"all\"), so they still rendered \u2014 but the moment\n-- an operator filtered by their unit, every booking taken from the website\n-- disappeared from the calendar. Single-location tenants are the common case\n-- and have an unambiguous answer, so default to it; multi-location tenants\n-- stay NULL (there is no correct guess) until the public flow asks.\n--\n-- Only the assignment is new; the rest of the body is unchanged from 004.\n\nCREATE OR REPLACE FUNCTION public.create_public_booking(\n  p_tenant_id uuid,\n  p_service_id uuid,\n  p_starts_at timestamptz,\n  p_name text,\n  p_phone text,\n  p_email text DEFAULT NULL,\n  p_notes text DEFAULT NULL\n)\nRETURNS TABLE(booking_id uuid, starts_at timestamptz, ends_at timestamptz)\nLANGUAGE plpgsql\nSECURITY DEFINER\nSET search_path TO 'public'\nAS $function$\nDECLARE\n  v_service record;\n  v_person_id uuid;\n  v_assignee uuid;\n  v_ends timestamptz;\n  v_order uuid;\n  v_booking uuid;\n  v_phone text;\n  v_tz text;\n  v_notes text;\n  v_location uuid;\nBEGIN\n  -- validation: anon-callable, everything tight\n  IF p_name IS NULL OR length(trim(p_name)) NOT BETWEEN 2 AND 120 THEN\n    RAISE EXCEPTION 'invalid name';\n  END IF;\n  v_phone := regexp_replace(COALESCE(p_phone, ''), '\\D', '', 'g');\n  IF length(v_phone) NOT BETWEEN 8 AND 15 THEN\n    RAISE EXCEPTION 'invalid phone';\n  END IF;\n  IF p_email IS NOT NULL AND (length(p_email) > 254 OR p_email !~ '^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$') THEN\n    RAISE EXCEPTION 'invalid email';\n  END IF;\n  v_notes := left(p_notes, 500);\n  IF p_starts_at IS NULL OR p_starts_at <= now() OR p_starts_at > now() + interval '90 days' THEN\n    RAISE EXCEPTION 'invalid start';\n  END IF;\n\n  SELECT s.id, s.name, s.price, COALESCE(s.duration_minutes, 30) AS duration_minutes\n    INTO v_service\n  FROM services s\n  WHERE s.id = p_service_id AND s.tenant_id = p_tenant_id\n    AND s.is_active AND s.status = 'active';\n  IF NOT FOUND THEN RAISE EXCEPTION 'unknown service'; END IF;\n\n  v_ends := p_starts_at + make_interval(mins => v_service.duration_minutes);\n  SELECT COALESCE(t.settings->>'timezone', 'America/Sao_Paulo') INTO v_tz\n  FROM tenants t WHERE t.id = p_tenant_id;\n  IF v_tz IS NULL THEN RAISE EXCEPTION 'unknown tenant'; END IF;\n\n  -- pick the assignee whose working hours cover the slot\n  SELECT sc.assignee_id INTO v_assignee\n  FROM schedules sc\n  WHERE sc.tenant_id = p_tenant_id\n    AND sc.kind = 'working_hours'\n    AND sc.is_active\n    AND (\n      sc.specific_date = (p_starts_at AT TIME ZONE v_tz)::date\n      OR (sc.specific_date IS NULL\n          AND sc.day_of_week = EXTRACT(dow FROM p_starts_at AT TIME ZONE v_tz)::smallint)\n    )\n    AND (p_starts_at AT TIME ZONE v_tz)::time >= sc.starts_at\n    AND (v_ends AT TIME ZONE v_tz)::time <= sc.ends_at\n  ORDER BY sc.assignee_id\n  LIMIT 1;\n  IF v_assignee IS NULL THEN RAISE EXCEPTION 'slot outside working hours'; END IF;\n\n  -- NEW: stamp the unit so the calendar's location filter keeps these visible.\n  -- Prefer the schedule's own location; else the tenant's only location.\n  SELECT sc.location_id INTO v_location\n  FROM schedules sc\n  WHERE sc.tenant_id = p_tenant_id\n    AND sc.kind = 'working_hours'\n    AND sc.is_active\n    AND sc.assignee_id = v_assignee\n    AND sc.location_id IS NOT NULL\n  LIMIT 1;\n\n  IF v_location IS NULL THEN\n    SELECT l.id INTO v_location\n    FROM locations l\n    WHERE l.tenant_id = p_tenant_id\n    HAVING count(*) = 1;  -- unambiguous only\n  END IF;\n\n  -- serialize per (tenant, assignee) to kill the double-book race\n  PERFORM pg_advisory_xact_lock(hashtextextended(p_tenant_id::text || v_assignee::text, 0));\n\n  IF EXISTS (\n    SELECT 1 FROM appointments b\n    WHERE b.tenant_id = p_tenant_id\n      AND b.assignee_id = v_assignee\n      AND b.status NOT IN ('cancelled', 'no_show')\n      AND b.starts_at < v_ends\n      AND COALESCE(b.ends_at, b.starts_at) > p_starts_at\n  ) THEN\n    RAISE EXCEPTION 'slot no longer available';\n  END IF;\n\n  -- anti-spam: cap open future public bookings per phone per tenant\n  IF (\n    SELECT count(*) FROM appointments b\n    JOIN people p ON p.id = b.party_id\n    WHERE b.tenant_id = p_tenant_id\n      AND p.phone = v_phone\n      AND b.starts_at > now()\n      AND b.status = 'scheduled'\n  ) >= 3 THEN\n    RAISE EXCEPTION 'too many open bookings for this phone';\n  END IF;\n\n  -- Upsert the customer by (tenant, phone). NOT ON CONFLICT: the partial unique\n  -- index this used to infer is gone (spine/110 \u2014 a placeholder phone is shared\n  -- by real, distinct people). 003 already settled the replacement: take a\n  -- per-(tenant, phone) advisory lock so two first-bookings serialise, then look\n  -- before inserting. Oldest match wins, so a returning caller keeps the record\n  -- that carries their history.\n  PERFORM pg_advisory_xact_lock(hashtextextended(p_tenant_id::text || ':' || v_phone, 1));\n\n  SELECT p.id INTO v_person_id\n    FROM people p\n   WHERE p.tenant_id = p_tenant_id AND p.kind = 'customer' AND p.phone = v_phone\n   ORDER BY p.created_at\n   LIMIT 1;\n\n  IF v_person_id IS NOT NULL THEN\n    UPDATE people SET\n      name = trim(p_name),\n      email = COALESCE(p_email, people.email),\n      updated_at = now()\n    WHERE id = v_person_id;\n  ELSE\n    INSERT INTO people (tenant_id, kind, name, phone, email, metadata)\n    VALUES (p_tenant_id, 'customer', trim(p_name), v_phone, p_email,\n            jsonb_build_object('source', 'public_booking'))\n    RETURNING id INTO v_person_id;\n  END IF;\n\n  -- order + booking + order_item (statuses hardcoded \u2014 caller cannot set)\n  INSERT INTO orders (tenant_id, kind, status, party_id, assignee_id, location_id,\n                      subtotal, total, notes, metadata)\n  VALUES (p_tenant_id, 'appointment', 'scheduled', v_person_id, v_assignee, v_location,\n          v_service.price, v_service.price, v_notes,\n          jsonb_build_object('source', 'public_booking',\n                             'serviceNames', v_service.name,\n                             'contactName', trim(p_name)))\n  RETURNING id INTO v_order;\n\n  INSERT INTO appointments (tenant_id, kind, party_id, assignee_id, order_id, location_id,\n                        starts_at, ends_at, status, notes, metadata)\n  VALUES (p_tenant_id, 'appointment', v_person_id, v_assignee, v_order, v_location,\n          p_starts_at, v_ends, 'scheduled', v_notes,\n          jsonb_build_object('source', 'public_booking', 'serviceNames', v_service.name))\n  RETURNING id INTO v_booking;\n\n  INSERT INTO order_items (order_id, service_id, name, quantity, unit_price, total,\n                           sort_order, duration_minutes, assignee_id)\n  VALUES (v_order, v_service.id, v_service.name, 1, v_service.price, v_service.price,\n          0, v_service.duration_minutes, v_assignee);\n\n  RETURN QUERY SELECT v_booking, p_starts_at, v_ends;\nEND;\n$function$;\n\nGRANT EXECUTE ON FUNCTION public.create_public_booking(uuid, uuid, timestamptz, text, text, text, text) TO anon, authenticated;\n";
 export declare const MIGRATION_010_PUBLIC_SERVICE_CURATION = "-- plugin-agenda 010: curate what the PUBLIC booking page sells.\n--\n-- v_public_services published every active service, so the website catalog was\n-- \"whatever exists in the system\". That conflates two different questions:\n--\n--   \u2022 is this service usable at all?          \u2192 services.is_active / status\n--   \u2022 should a stranger be able to book it?   \u2192 this flag\n--\n-- Without the split, hiding something from the site means deactivating it \u2014\n-- which also removes it from the internal agenda and orphans its history. The\n-- case that forced this: a school whose public page listed 7 services when it\n-- sells 3, and one of the 4 extras already had real bookings attached.\n--\n-- OPT-OUT on purpose: a service is public unless explicitly marked otherwise.\n-- Opt-in would silently empty every live catalog the moment this ships.\n\nCREATE OR REPLACE VIEW public.v_public_services AS\nSELECT id,\n    tenant_id,\n    name,\n    description,\n    price,\n    currency,\n    COALESCE(duration_minutes, 30) AS duration_minutes,\n    image_url,\n    COALESCE(((metadata ->> 'sort_order'::text))::integer, 0) AS sort_order\n   FROM services s\n  WHERE is_active\n    AND status = 'active'::text\n    -- absent \u2192 public (back-compat). Only an explicit false hides it.\n    AND COALESCE((metadata ->> 'bookableOnline'::text)::boolean, true);\n";
 export declare const MIGRATION_011_DEFAULT_ASSIGNEE = "-- plugin-agenda 011: honour a tenant's default professional.\n--\n-- create_public_booking picks the assignee from whoever's working hours cover\n-- the slot, ordered by assignee_id \u2014 i.e. the lowest UUID wins. That is fine\n-- when the caller names the professional, and wrong when it does not: the\n-- public page confirms \"Equipe Great DJs\" while the booking silently lands on\n-- an unrelated instructor whose UUID happened to sort first.\n--\n-- Clients shipped before p_assignee_id existed still call this with 7 named\n-- args, so the parameter defaults to NULL and every live booking on those sites\n-- is mis-assigned today. Republishing the SDK fixes the caller, but the sites\n-- already deployed cannot be fixed that way \u2014 this can, from the database.\n--\n-- Precedence: explicit arg > tenant default > first covering schedule.\n-- Tenants without the setting keep exactly the previous behaviour.\n\nCREATE OR REPLACE FUNCTION public.create_public_booking(p_tenant_id uuid, p_service_id uuid, p_starts_at timestamp with time zone, p_name text, p_phone text, p_email text DEFAULT NULL::text, p_notes text DEFAULT NULL::text, p_assignee_id uuid DEFAULT NULL::uuid)\n RETURNS TABLE(booking_id uuid, starts_at timestamp with time zone, ends_at timestamp with time zone)\n LANGUAGE plpgsql\n SECURITY DEFINER\n SET search_path TO 'public'\nAS $function$\nDECLARE\n  v_service record;\n  v_person_id uuid;\n  v_assignee uuid;\n  v_requested uuid;\n  v_ends timestamptz;\n  v_order uuid;\n  v_booking uuid;\n  v_phone text;\n  v_tz text;\n  v_notes text;\n  v_client_kind text;\nBEGIN\n  -- validation: anon-callable, everything tight\n  IF p_name IS NULL OR length(trim(p_name)) NOT BETWEEN 2 AND 120 THEN\n    RAISE EXCEPTION 'invalid name';\n  END IF;\n  v_phone := regexp_replace(COALESCE(p_phone, ''), '\\D', '', 'g');\n  IF length(v_phone) NOT BETWEEN 8 AND 15 THEN\n    RAISE EXCEPTION 'invalid phone';\n  END IF;\n  IF p_email IS NOT NULL AND (length(p_email) > 254 OR p_email !~ '^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$') THEN\n    RAISE EXCEPTION 'invalid email';\n  END IF;\n  v_notes := left(p_notes, 500);\n  IF p_starts_at IS NULL OR p_starts_at <= now() OR p_starts_at > now() + interval '90 days' THEN\n    RAISE EXCEPTION 'invalid start';\n  END IF;\n\n  SELECT s.id, s.name, s.price, COALESCE(s.duration_minutes, 30) AS duration_minutes\n    INTO v_service\n  FROM services s\n  WHERE s.id = p_service_id AND s.tenant_id = p_tenant_id\n    AND s.is_active AND s.status = 'active';\n  IF NOT FOUND THEN RAISE EXCEPTION 'unknown service'; END IF;\n\n  v_ends := p_starts_at + make_interval(mins => v_service.duration_minutes);\n\n  -- tenant config: timezone + client kind (admin-set; sanitized, never caller input)\n  SELECT COALESCE(t.settings->>'timezone', 'America/Sao_Paulo'),\n         COALESCE(NULLIF(trim(t.settings->'booking'->>'client_kind'), ''), 'customer')\n    INTO v_tz, v_client_kind\n  FROM tenants t WHERE t.id = p_tenant_id;\n  IF v_tz IS NULL THEN RAISE EXCEPTION 'unknown tenant'; END IF;\n  IF v_client_kind !~ '^[a-z_]{2,32}$' THEN v_client_kind := 'customer'; END IF;\n\n  -- resolve the professional, in order of trust:\n  --   1. the id the caller sent (the one the visitor actually saw)\n  --   2. the tenant's configured default (settings->>'defaultAssigneeId')\n  --   3. whoever's working hours cover the slot\n  --\n  -- Step 2 is why this migration exists. Older published clients call this with\n  -- 7 named args, leaving p_assignee_id NULL, and step 3 then resolved to\n  -- \"lowest assignee UUID\" \u2014 an arbitrary instructor who had nothing to do with\n  -- the name the site displayed on the confirmation screen. The default gives\n  -- those clients a correct answer without waiting for a redeploy.\n  v_requested := COALESCE(\n    p_assignee_id,\n    (SELECT NULLIF(t.settings ->> 'defaultAssigneeId', '')::uuid\n       FROM tenants t WHERE t.id = p_tenant_id)\n  );\n\n  SELECT w.assignee_id INTO v_assignee\n  FROM agenda_working_windows(\n         p_tenant_id, (p_starts_at AT TIME ZONE v_tz)::date, v_requested) w\n  WHERE (p_starts_at AT TIME ZONE v_tz)::time >= w.win_start\n    AND (v_ends AT TIME ZONE v_tz)::time <= w.win_end\n  ORDER BY w.assignee_id\n  LIMIT 1;\n  IF v_assignee IS NULL THEN RAISE EXCEPTION 'slot outside working hours'; END IF;\n\n  -- serialize per (tenant, assignee) to kill the double-book race\n  PERFORM pg_advisory_xact_lock(hashtextextended(p_tenant_id::text || v_assignee::text, 0));\n\n  IF EXISTS (\n    SELECT 1 FROM appointments b\n    WHERE b.tenant_id = p_tenant_id\n      AND b.assignee_id = v_assignee\n      AND b.status NOT IN ('cancelled', 'no_show')\n      AND b.starts_at < v_ends\n      AND COALESCE(b.ends_at, b.starts_at) > p_starts_at\n  ) THEN\n    RAISE EXCEPTION 'slot no longer available';\n  END IF;\n\n  -- anti-spam: cap open future public bookings per phone per tenant\n  IF (\n    SELECT count(*) FROM appointments b\n    JOIN people p ON p.id = b.party_id\n    WHERE b.tenant_id = p_tenant_id\n      AND p.phone = v_phone\n      AND b.starts_at > now()\n      AND b.status = 'scheduled'\n  ) >= 3 THEN\n    RAISE EXCEPTION 'too many open bookings for this phone';\n  END IF;\n\n  -- upsert the client by (tenant, kind, phone), serialized by advisory lock\n  -- (kind is tenant-configured, so the customer-only partial index can't\n  -- arbitrate)\n  PERFORM pg_advisory_xact_lock(hashtextextended(p_tenant_id::text || ':' || v_phone, 1));\n\n  SELECT p.id INTO v_person_id\n  FROM people p\n  WHERE p.tenant_id = p_tenant_id AND p.kind = v_client_kind AND p.phone = v_phone\n  ORDER BY p.created_at\n  LIMIT 1;\n\n  IF v_person_id IS NOT NULL THEN\n    UPDATE people SET\n      name = trim(p_name),\n      email = COALESCE(p_email, people.email),\n      updated_at = now()\n    WHERE id = v_person_id;\n  ELSE\n    INSERT INTO people (tenant_id, kind, name, phone, email, metadata)\n    VALUES (p_tenant_id, v_client_kind, trim(p_name), v_phone, p_email,\n            jsonb_build_object('source', 'public_booking'))\n    RETURNING id INTO v_person_id;\n  END IF;\n\n  -- order + booking + order_item (statuses hardcoded \u2014 caller cannot set)\n  INSERT INTO orders (tenant_id, kind, status, party_id, assignee_id, subtotal, total, notes, metadata)\n  VALUES (p_tenant_id, 'appointment', 'scheduled', v_person_id, v_assignee,\n          v_service.price, v_service.price, v_notes,\n          jsonb_build_object('source', 'public_booking',\n                             'serviceNames', v_service.name,\n                             'contactName', trim(p_name)))\n  RETURNING id INTO v_order;\n\n  INSERT INTO appointments (tenant_id, kind, party_id, assignee_id, order_id,\n                        starts_at, ends_at, status, notes, metadata)\n  VALUES (p_tenant_id, 'appointment', v_person_id, v_assignee, v_order,\n          p_starts_at, v_ends, 'scheduled', v_notes,\n          jsonb_build_object('source', 'public_booking', 'serviceNames', v_service.name))\n  RETURNING id INTO v_booking;\n\n  INSERT INTO order_items (order_id, service_id, name, quantity, unit_price, total,\n                           sort_order, duration_minutes, assignee_id)\n  VALUES (v_order, v_service.id, v_service.name, 1, v_service.price, v_service.price,\n          0, v_service.duration_minutes, v_assignee);\n\n  RETURN QUERY SELECT v_booking, p_starts_at, v_ends;\nEND;\n$function$;\n";
 export declare const MIGRATION_012_DROP_LEGACY_BOOKING_OVERLOAD = "-- plugin-agenda 012: retire the pre-assignee create_public_booking overload.\n--\n-- \u26A0\uFE0F  DO NOT APPLY UNTIL @fayz-ai/plugin-agenda IS REPUBLISHED *AND* EVERY LIVE\n--     SITE HAS BEEN REDEPLOYED. Applying early breaks public booking on any\n--     site still serving a bundle that calls the 7-argument signature \u2014 the\n--     call stops resolving and every submission fails.\n--\n-- Some pools carry two overloads side by side:\n--     create_public_booking(uuid,uuid,timestamptz,text,text,text,text)\n--     create_public_booking(uuid,uuid,timestamptz,text,text,text,text,uuid)\n--\n-- Nothing errors when both exist, which is exactly the problem: a stale client\n-- silently resolves to the 7-arg one, which cannot know which professional the\n-- visitor was shown and falls back to \"lowest assignee UUID\". The site confirms\n-- one name, the agenda records another, and no one finds out until someone\n-- compares the two screens.\n--\n-- 011 makes that fallback survivable (tenant default). This makes it\n-- impossible \u2014 but only once no caller needs the old signature.\n--\n-- Verify before running:\n--   1. npm view @fayz-ai/plugin-agenda version   \u2192 the republished version\n--   2. every deployed bundle greps for p_assignee_id:\n--        curl -s https://<site>/assets/index-*.js | grep -c p_assignee_id\n--      Each must be \u2265 2 (slots + booking). Zero means that site still needs it.\n\nDROP FUNCTION IF EXISTS public.create_public_booking(\n  uuid, uuid, timestamptz, text, text, text, text\n);\n";
 export declare const MIGRATION_013_NORMALIZE_V_APPOINTMENTS = "-- plugin-agenda 013: one booking read model \u2014 v_appointments.\n--\n-- Three views described the same 34 rows:\n--\n--   v_bookings                 \u2192 thin alias over the legacy view (002 compat shim)\n--   v_bookings_legacy_beauty   \u2192 the pre-pools shape, still feeding 5 rep_* views\n--   v_appointments             \u2192 the canonical name, and the only one the SDK reads\n--\n-- The school pool already had only v_appointments; the salon pool carried all\n-- three. Same data, three names, and reports quietly wired to the oldest one.\n--\n-- v_appointments was a strict SUBSET, so it could not simply absorb them. It\n-- gains the 7 columns it lacked \u2014 most importantly `services`, the order_items\n-- aggregate that 4 of the 5 reports depend on. That also retires a documented\n-- N+1: getBookingById fetches order_items in a second round-trip precisely\n-- because this view had no line items (see plugin-agenda/src/data/supabase.ts).\n--\n-- Deliberately NOT copied from the legacy view:\n--   \u2022 total_duration_minutes \u2014 legacy sums order_items durations, the canonical\n--     measures the slot. They disagree, no report reads it, and the SDK relies\n--     on the canonical meaning. Kept as-is.\n--   \u2022 client_name \u2014 the canonical COALESCEs with metadata->>'title' so blocks\n--     and personal events show a label instead of NULL. Kept as-is (an\n--     improvement the legacy shape never had).\n\n-- 1. v_appointments becomes the superset. Columns are APPENDED: CREATE OR\n--    REPLACE VIEW cannot reorder or drop, and the SDK selects '*'.\nCREATE OR REPLACE VIEW public.v_appointments\nWITH (security_invoker = true) AS\n SELECT b.id,\n    b.tenant_id,\n    b.kind,\n    b.starts_at,\n    b.ends_at,\n    b.status,\n    b.notes,\n    b.order_id,\n    b.location_id,\n    b.metadata,\n    b.created_at,\n    b.updated_at,\n    b.party_id AS client_id,\n    COALESCE(pc.name, (b.metadata ->> 'title'::text)) AS client_name,\n    pc.phone AS client_phone,\n    pc.email AS client_email,\n    pc.avatar_url AS client_avatar_url,\n    b.assignee_id AS professional_id,\n    ps.name AS professional_name,\n    ps.avatar_url AS professional_avatar_url,\n    l.name AS location_name,\n    o.total AS order_total,\n    o.status AS order_status,\n    ((EXTRACT(epoch FROM (COALESCE(b.ends_at, b.starts_at) - b.starts_at)))::integer / 60) AS total_duration_minutes,\n    -- appended:\n    o.reference_number,\n    o.status AS stage,\n    (o.metadata ->> 'direction'::text) AS direction,\n    ( SELECT json_agg(json_build_object('id', oi.id, 'serviceId', oi.service_id,\n                                        'name', oi.name, 'durationMinutes', oi.duration_minutes,\n                                        'price', oi.unit_price, 'assigneeId', oi.assignee_id)\n                      ORDER BY oi.sort_order)\n        FROM order_items oi\n       WHERE (oi.order_id = b.order_id)) AS services,\n    inv.status AS payment_status,\n    inv.paid AS order_paid,\n    inv.balance AS order_balance\n   FROM (((((appointments b\n     LEFT JOIN people pc ON ((pc.id = b.party_id)))\n     LEFT JOIN people ps ON ((ps.id = b.assignee_id)))\n     LEFT JOIN locations l ON ((l.id = b.location_id)))\n     LEFT JOIN orders o ON ((o.id = b.order_id)))\n     LEFT JOIN v_invoice_balances inv ON ((inv.invoice_id = b.order_id)));\n\n-- 2. Repoint the reports off the legacy view. Bodies are unchanged\n--    except for the source relation.\n\nCREATE OR REPLACE VIEW public.rep_appointments_by_period AS\nSELECT tenant_id,\n    id AS booking_id,\n    (starts_at)::date AS date,\n    starts_at,\n    client_id,\n    client_name,\n    professional_id,\n    professional_name,\n    COALESCE(((services -> 0) ->> 'name'::text), ((services -> 0) ->> 'serviceName'::text)) AS service_name,\n    status,\n    order_total AS revenue,\n    created_at,\n    updated_at\n   FROM v_appointments b;\n\n-- legacy_pre_pools only exists on pools migrated from the pre-pool era; fresh\n-- pools get the same shape with confirmation columns defaulting to pending/NULL.\nDO $$\nBEGIN\n  IF to_regclass('legacy_pre_pools.appointments') IS NOT NULL THEN\n    EXECUTE $v$\n      CREATE OR REPLACE VIEW public.rep_confirmation_queue AS\n      SELECT b.tenant_id,\n          b.id AS booking_id,\n          (b.starts_at)::date AS date,\n          b.starts_at,\n          b.client_id,\n          b.client_name,\n          b.professional_id,\n          b.professional_name,\n          COALESCE(((b.services -> 0) ->> 'name'::text), ((b.services -> 0) ->> 'serviceName'::text)) AS service_name,\n          COALESCE(a.confirmation_status, 'pending'::text) AS confirmation_status,\n          a.confirmation_channel,\n          a.confirmation_sent_at,\n          a.confirmed_at,\n          b.created_at,\n          b.updated_at\n         FROM (v_appointments b\n           LEFT JOIN legacy_pre_pools.appointments a ON ((a.booking_id = b.id)))\n        WHERE ((b.status <> ALL (ARRAY['cancelled'::text, 'no_show'::text])) AND (b.starts_at >= (now() - '1 day'::interval)))\n    $v$;\n  ELSE\n    EXECUTE $v$\n      CREATE OR REPLACE VIEW public.rep_confirmation_queue AS\n      SELECT b.tenant_id,\n          b.id AS booking_id,\n          (b.starts_at)::date AS date,\n          b.starts_at,\n          b.client_id,\n          b.client_name,\n          b.professional_id,\n          b.professional_name,\n          COALESCE(((b.services -> 0) ->> 'name'::text), ((b.services -> 0) ->> 'serviceName'::text)) AS service_name,\n          'pending'::text AS confirmation_status,\n          NULL::text AS confirmation_channel,\n          NULL::timestamptz AS confirmation_sent_at,\n          NULL::timestamptz AS confirmed_at,\n          b.created_at,\n          b.updated_at\n         FROM v_appointments b\n        WHERE ((b.status <> ALL (ARRAY['cancelled'::text, 'no_show'::text])) AND (b.starts_at >= (now() - '1 day'::interval)))\n    $v$;\n  END IF;\nEND $$;\n\n-- v_clients (beauty Ring-2 extension) may not exist on non-salon pools \u2014 the\n-- report only makes sense where it does.\nDO $$\nBEGIN\n  IF to_regclass('public.v_clients') IS NULL THEN RETURN; END IF;\n  EXECUTE $v$\n    CREATE OR REPLACE VIEW public.rep_new_clients AS\n    SELECT c.tenant_id,\n        c.id AS client_id,\n        (c.created_at)::date AS date,\n        c.name AS client_name,\n        c.origin,\n        first_booking.service_name AS first_service,\n        c.created_at,\n        c.updated_at\n       FROM (v_clients c\n         LEFT JOIN LATERAL ( SELECT COALESCE(((b.services -> 0) ->> 'name'::text), ((b.services -> 0) ->> 'serviceName'::text)) AS service_name\n               FROM v_appointments b\n              WHERE (b.client_id = c.id)\n              ORDER BY b.starts_at\n             LIMIT 1) first_booking ON (true))\n  $v$;\nEND $$;\n\nCREATE OR REPLACE VIEW public.rep_revenue_by_professional AS\nSELECT tenant_id,\n    (starts_at)::date AS date,\n    professional_id,\n    COALESCE(professional_name, 'Sem profissional'::text) AS professional_name,\n    (count(*))::integer AS appointment_count,\n    (COALESCE(sum(NULLIF(order_total, (0)::numeric)), (0)::numeric))::numeric(14,2) AS total_revenue,\n    (COALESCE(avg(NULLIF(order_total, (0)::numeric)), (0)::numeric))::numeric(14,2) AS avg_ticket,\n    (0)::numeric(14,2) AS commission,\n    max(updated_at) AS updated_at\n   FROM v_appointments b\n  WHERE (status <> ALL (ARRAY['cancelled'::text, 'no_show'::text]))\n  GROUP BY tenant_id, ((starts_at)::date), professional_id, COALESCE(professional_name, 'Sem profissional'::text);\n\nCREATE OR REPLACE VIEW public.rep_revenue_by_service AS\nSELECT b.tenant_id,\n    (b.starts_at)::date AS date,\n    NULLIF((service_item.value ->> 'serviceId'::text), ''::text) AS service_id,\n    COALESCE((service_item.value ->> 'name'::text), (service_item.value ->> 'serviceName'::text), 'Sem servico'::text) AS service_name,\n    (count(DISTINCT b.id))::integer AS quantity,\n    (COALESCE(sum((NULLIF((service_item.value ->> 'price'::text), ''::text))::numeric), (0)::numeric))::numeric(14,2) AS total_revenue,\n    (COALESCE(avg((NULLIF((service_item.value ->> 'price'::text), ''::text))::numeric), (0)::numeric))::numeric(14,2) AS avg_ticket,\n    max(b.updated_at) AS updated_at\n   FROM (v_appointments b\n     CROSS JOIN LATERAL jsonb_array_elements(COALESCE((b.services)::jsonb, '[]'::jsonb)) service_item(value))\n  WHERE (b.status <> ALL (ARRAY['cancelled'::text, 'no_show'::text]))\n  GROUP BY b.tenant_id, ((b.starts_at)::date), NULLIF((service_item.value ->> 'serviceId'::text), ''::text), COALESCE((service_item.value ->> 'name'::text), (service_item.value ->> 'serviceName'::text), 'Sem servico'::text);\n\n-- 3. Retire the duplicates. v_bookings goes first: it reads the legacy view.\n--    Nothing in the SDK references either name (checked: only migrations and a\n--    README mention v_bookings).\nDROP VIEW IF EXISTS public.v_bookings;\nDROP VIEW IF EXISTS public.v_bookings_legacy_beauty;\n";
 export declare const MIGRATION_014_AGENT_RPC_UPDATE_APPOINTMENT = "-- ============================================================================\n-- plugin-agenda 014: agent_agenda_update_appointment \u2014 remarcar / reatribuir /\n-- cancelar um agendamento existente.\n--\n-- Lacuna que isso fecha: o agente sabia CRIAR e n\u00E3o sabia MEXER. Pedido real\n-- (\"remarca esse paciente pra 16:30\") ca\u00EDa no updateRecord gen\u00E9rico, que bate\n-- em v_appointments \u2014 uma view \u2014 e devolve read_only; o modelo ent\u00E3o \"resolvia\"\n-- abrindo um agendamento NOVO, deixando o antigo de p\u00E9. Duplicar a agenda de um\n-- sal\u00E3o \u00E9 pior do que n\u00E3o fazer nada.\n--\n-- Mesma cadeia de guardas do 008 (agent_guard \u2192 janela de trabalho com exce\u00E7\u00F5es\n-- \u2192 lock advisory \u2192 checagem de conflito \u2192 auditoria), com tr\u00EAs diferen\u00E7as:\n--   \u2022 a\u00E7\u00E3o 'edit', sem cota (remarcar n\u00E3o consome bookings_month);\n--   \u2022 o pr\u00F3prio agendamento \u00E9 exclu\u00EDdo da checagem de conflito consigo mesmo;\n--   \u2022 cancelar n\u00E3o precisa de hor\u00E1rio livre \u2014 s\u00F3 o guard.\n-- Requer 007 (agenda_working_windows). Idempotente.\n-- ============================================================================\n\nCREATE OR REPLACE FUNCTION public.agent_agenda_update_appointment(\n  p_tenant_id uuid,\n  p_actor_user_id uuid,\n  p_payload jsonb\n) RETURNS jsonb\nLANGUAGE plpgsql SECURITY DEFINER\nSET search_path = public\nAS $$\nDECLARE\n  v_denial jsonb;\n  v_id uuid;\n  v_tz text;\n  v_row record;\n  v_starts_raw text;\n  v_starts timestamptz;\n  v_ends timestamptz;\n  v_duration int;\n  v_professional uuid;\n  v_status text;\n  v_notes text;\n  v_wants_move boolean;\n  v_wants_status boolean;\nBEGIN\n  SELECT COALESCE(t.settings->>'timezone', 'America/Sao_Paulo') INTO v_tz\n  FROM tenants t WHERE t.id = p_tenant_id;\n  IF v_tz IS NULL THEN\n    RETURN jsonb_build_object('ok', false, 'error', 'unknown tenant');\n  END IF;\n\n  -- \u2500\u2500 payload \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  BEGIN\n    v_id           := (p_payload->>'appointment_id')::uuid;\n    v_professional := (p_payload->>'professional_id')::uuid;\n    v_starts_raw   := p_payload->>'starts_at';\n  EXCEPTION WHEN OTHERS THEN\n    RETURN jsonb_build_object('ok', false, 'error', 'invalid payload: ' || SQLERRM);\n  END;\n  v_status := nullif(trim(lower(p_payload->>'status')), '');\n  v_notes  := left(p_payload->>'notes', 500);\n  v_wants_move   := v_starts_raw IS NOT NULL OR v_professional IS NOT NULL;\n  v_wants_status := v_status IS NOT NULL;\n\n  IF v_id IS NULL THEN\n    RETURN jsonb_build_object('ok', false, 'error',\n      'appointment_id is required \u2014 search the agenda first and reuse the id of the appointment to change');\n  END IF;\n  IF NOT v_wants_move AND NOT v_wants_status AND v_notes IS NULL THEN\n    RETURN jsonb_build_object('ok', false, 'error',\n      'nothing to change: send starts_at, professional_id, status or notes');\n  END IF;\n  IF v_status IS NOT NULL\n     AND v_status NOT IN ('scheduled', 'confirmed', 'in_progress', 'completed', 'cancelled', 'no_show') THEN\n    RETURN jsonb_build_object('ok', false, 'error',\n      'status must be one of scheduled, confirmed, in_progress, completed, cancelled, no_show');\n  END IF;\n\n  -- \u2500\u2500 the appointment must exist, in THIS tenant \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  SELECT b.id, b.starts_at, b.ends_at, b.assignee_id, b.status, b.party_id, b.order_id\n    INTO v_row\n  FROM appointments b\n  WHERE b.id = v_id AND b.tenant_id = p_tenant_id;\n  IF NOT FOUND THEN\n    RETURN jsonb_build_object('ok', false, 'error', 'unknown appointment for this tenant');\n  END IF;\n\n  -- \u2500\u2500 authorization: role \u2192 plan. No cap: editing frees nothing and buys\n  --    nothing, so charging bookings_month for a reschedule would be wrong.\n  v_denial := agent_guard(p_tenant_id, p_actor_user_id, 'appointments', 'edit');\n  IF v_denial IS NOT NULL THEN\n    RETURN jsonb_build_object('ok', false, 'denial', v_denial);\n  END IF;\n\n  -- Duration is preserved across a move \u2014 a 60-minute appointment stays 60.\n  v_duration := GREATEST(\n    COALESCE(EXTRACT(EPOCH FROM (v_row.ends_at - v_row.starts_at)) / 60, 30)::int, 5);\n  v_professional := COALESCE(v_professional, v_row.assignee_id);\n\n  IF v_wants_move THEN\n    IF v_starts_raw IS NOT NULL THEN\n      BEGIN\n        IF v_starts_raw ~ '(Z|[+-][0-9]{2}:?[0-9]{2})$' THEN\n          v_starts := v_starts_raw::timestamptz;               -- explicit offset\n        ELSE\n          v_starts := (v_starts_raw::timestamp) AT TIME ZONE v_tz;  -- tenant-local\n        END IF;\n      EXCEPTION WHEN OTHERS THEN\n        RETURN jsonb_build_object('ok', false, 'error', 'invalid starts_at: ' || SQLERRM);\n      END;\n    ELSE\n      v_starts := v_row.starts_at;\n    END IF;\n    v_ends := v_starts + make_interval(mins => v_duration);\n\n    IF v_starts > now() + interval '365 days' THEN\n      RETURN jsonb_build_object('ok', false, 'error', 'starts_at must be within the next year');\n    END IF;\n\n    -- Working window (exception-aware, 007) for the target professional.\n    IF NOT EXISTS (\n      SELECT 1\n      FROM agenda_working_windows(\n             p_tenant_id, (v_starts AT TIME ZONE v_tz)::date, v_professional) w\n      WHERE w.assignee_id = v_professional\n        AND (v_starts AT TIME ZONE v_tz)::time >= w.win_start\n        AND (v_ends   AT TIME ZONE v_tz)::time <= w.win_end\n    ) THEN\n      RETURN jsonb_build_object('ok', false, 'error',\n        'that slot is outside the professional''s working hours. Suggest a different time. Times are tenant-local, tz ' || v_tz);\n    END IF;\n\n    PERFORM pg_advisory_xact_lock(hashtextextended(p_tenant_id::text || v_professional::text, 0));\n    IF EXISTS (\n      SELECT 1 FROM appointments b\n      WHERE b.tenant_id = p_tenant_id\n        AND b.assignee_id = v_professional\n        AND b.id <> v_id                     -- never conflicts with itself\n        AND b.status NOT IN ('cancelled', 'no_show')\n        AND b.starts_at < v_ends\n        AND COALESCE(b.ends_at, b.starts_at) > v_starts\n    ) THEN\n      RETURN jsonb_build_object('ok', false, 'error',\n        'that slot is already taken. Suggest a different time.');\n    END IF;\n  END IF;\n\n  -- \u2500\u2500 write + audit \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  UPDATE appointments b SET\n    starts_at   = COALESCE(v_starts, b.starts_at),\n    ends_at     = COALESCE(v_ends, b.ends_at),\n    assignee_id = v_professional,\n    status      = COALESCE(v_status, b.status),\n    notes       = COALESCE(v_notes, b.notes),\n    metadata    = COALESCE(b.metadata, '{}'::jsonb) || jsonb_build_object('lastAgentEdit', now()),\n    updated_at  = now()\n  WHERE b.id = v_id AND b.tenant_id = p_tenant_id;\n\n  -- The order mirrors the appointment's assignee/status so the financial side\n  -- does not drift from the calendar.\n  IF v_row.order_id IS NOT NULL THEN\n    UPDATE orders o SET\n      assignee_id = v_professional,\n      status      = CASE WHEN v_status = 'cancelled' THEN 'cancelled' ELSE o.status END,\n      updated_at  = now()\n    WHERE o.id = v_row.order_id AND o.tenant_id = p_tenant_id;\n  END IF;\n\n  INSERT INTO audit_logs (tenant_id, user_id, action, entity_type, entity_id, metadata)\n  VALUES (p_tenant_id, p_actor_user_id, 'agent.updateAppointment', 'appointment', v_id::text,\n          jsonb_build_object('payload', p_payload,\n                             'previous', jsonb_build_object(\n                               'starts_at', v_row.starts_at,\n                               'ends_at', v_row.ends_at,\n                               'assignee_id', v_row.assignee_id,\n                               'status', v_row.status)));\n\n  SELECT a.id, a.starts_at, a.ends_at, a.status, a.client_name, a.professional_name\n    INTO v_row\n  FROM v_appointments a WHERE a.id = v_id;\n\n  RETURN jsonb_build_object(\n    'ok', true,\n    'id', v_id,\n    'record', jsonb_build_object(\n      'ref', jsonb_build_object('id', v_id, 'resource', 'appointments',\n                                'archetype', 'schedule:appointment'),\n      'starts_at', v_row.starts_at,\n      'ends_at', v_row.ends_at,\n      'starts_at_local', to_char(v_row.starts_at AT TIME ZONE v_tz, 'YYYY-MM-DD (Dy) HH24:MI') || ' ' || v_tz,\n      'ends_at_local', to_char(v_row.ends_at AT TIME ZONE v_tz, 'HH24:MI'),\n      'client_name', v_row.client_name,\n      'professional_name', v_row.professional_name,\n      'status', v_row.status\n    )\n  );\nEND;\n$$;\n\nREVOKE ALL ON FUNCTION public.agent_agenda_update_appointment(uuid, uuid, jsonb) FROM public;\nREVOKE EXECUTE ON FUNCTION public.agent_agenda_update_appointment(uuid, uuid, jsonb) FROM anon;\nGRANT EXECUTE ON FUNCTION public.agent_agenda_update_appointment(uuid, uuid, jsonb)\n  TO authenticated, service_role;\n";
+export declare const MIGRATION_015_ANALYTICS_READ_MODELS = "-- ============================================================================\n-- @fayz-ai/plugin-agenda \u2014 read model for the analytics engine, and the\n-- security_invoker the report views never got.\n--\n-- TWO THINGS, and the first one is a hole, not a feature.\n--\n-- 1. rep_appointments_by_period, rep_revenue_by_service and\n--    rep_revenue_by_professional were created without\n--    `WITH (security_invoker = true)`. A view runs as its OWNER, migrations are\n--    applied as `postgres`, and a table owner is exempt from that table's RLS \u2014\n--    so on a shared industry pool any signed-in user of ANY tenant could read\n--    every tenant's agenda revenue. The spine's 044_view_invoker.sql closes it\n--    everywhere at once; this carries the fix home to the plugin that owns the\n--    views, as that file asks. ALTER VIEW ... SET is additive and idempotent,\n--    so the two agree wherever both land.\n--\n--    Registering a leaky view in the analytics allowlist would have WIDENED it:\n--    analytics_run takes the tenant id as a PARAMETER, so without invoker\n--    semantics a client could simply pass somebody else's. The tenant predicate\n--    is defence in depth; RLS is the lock.\n--\n-- 2. plg_agenda_rep_bookings \u2014 rep_appointments_by_period plus the 0/1 flags.\n--    The engine has no conditional aggregate (see 024), so \"no-show rate\" and\n--    \"revenue actually earned\" cannot be expressed by a card over the raw view:\n--    its `revenue` is order_total on EVERY row, which bills the school for the\n--    lesson the student skipped. The flags put the condition in the read model,\n--    where it can be read once and audited.\n--\n-- Idempotent. Guarded per object, so a pool without the agenda skips it.\n-- ============================================================================\n\n-- ----------------------------------------------------------------------------\n-- 1. Close the leak on the existing report views.\n-- ----------------------------------------------------------------------------\nDO $$\nDECLARE\n  v text;\n  leaky text[] := ARRAY[\n    'rep_appointments_by_period',\n    'rep_revenue_by_service',\n    'rep_revenue_by_professional',\n    'rep_confirmation_queue'\n  ];\nBEGIN\n  FOREACH v IN ARRAY leaky LOOP\n    IF to_regclass('public.' || v) IS NOT NULL THEN\n      EXECUTE format('ALTER VIEW public.%I SET (security_invoker = true)', v);\n    END IF;\n  END LOOP;\nEND $$;\n\n-- ----------------------------------------------------------------------------\n-- 2. The analytics read model.\n--\n--    `date` is the spine, not created_at: a booking is measured by when it\n--    HAPPENS, so a range that reads \"this month\" must return this month's\n--    lessons and not the ones typed into the system this month.\n-- ----------------------------------------------------------------------------\nDO $$\nBEGIN\n  IF to_regclass('public.rep_appointments_by_period') IS NULL THEN\n    RAISE NOTICE 'agenda: rep_appointments_by_period missing \u2014 read model skipped';\n    RETURN;\n  END IF;\n\n  EXECUTE $v$\n    CREATE OR REPLACE VIEW public.plg_agenda_rep_bookings\n    WITH (security_invoker = true) AS\n    SELECT\n      b.tenant_id,\n      b.booking_id,\n      b.date,\n      b.starts_at,\n      b.client_id,\n      b.client_name,\n      b.professional_id,\n      b.professional_name,\n      b.service_name,\n      b.status,\n      b.revenue AS booked_revenue,\n      -- What the chair actually earned, and what it did not.\n      CASE WHEN b.status IN ('cancelled', 'no_show') THEN 0 ELSE COALESCE(b.revenue, 0) END AS effective_revenue,\n      CASE WHEN b.status IN ('cancelled', 'no_show') THEN COALESCE(b.revenue, 0) ELSE 0 END AS lost_revenue,\n      CASE WHEN b.status = 'completed'  THEN 1 ELSE 0 END AS is_completed,\n      CASE WHEN b.status = 'cancelled'  THEN 1 ELSE 0 END AS is_cancelled,\n      CASE WHEN b.status = 'no_show'    THEN 1 ELSE 0 END AS is_no_show,\n      b.created_at,\n      b.updated_at\n    FROM public.rep_appointments_by_period b\n  $v$;\n\n  GRANT SELECT ON public.plg_agenda_rep_bookings TO authenticated;\nEND $$;\n\n-- ----------------------------------------------------------------------------\n-- 3. Register.\n-- ----------------------------------------------------------------------------\nDO $$\nBEGIN\n  IF to_regclass('public.plg_analytics_read_models') IS NULL THEN\n    RAISE NOTICE 'agenda: analytics engine not installed \u2014 read models not registered';\n    RETURN;\n  END IF;\n\n  IF to_regclass('public.plg_agenda_rep_bookings') IS NOT NULL THEN\n    INSERT INTO public.plg_analytics_read_models (name, date_column, tenant_column, description) VALUES\n      ('plg_agenda_rep_bookings', 'date', 'tenant_id',\n       'One row per booking, dated by when it happens, with status flags and earned/lost revenue')\n    ON CONFLICT (name) DO UPDATE\n      SET date_column   = EXCLUDED.date_column,\n          tenant_column = EXCLUDED.tenant_column,\n          description   = EXCLUDED.description;\n  END IF;\n\n  IF to_regclass('public.rep_revenue_by_service') IS NOT NULL THEN\n    INSERT INTO public.plg_analytics_read_models (name, date_column, tenant_column, description) VALUES\n      ('rep_revenue_by_service', 'date', 'tenant_id',\n       'Revenue per service per day; cancellations and no-shows already excluded')\n    ON CONFLICT (name) DO UPDATE\n      SET date_column   = EXCLUDED.date_column,\n          tenant_column = EXCLUDED.tenant_column,\n          description   = EXCLUDED.description;\n  END IF;\n\n  IF to_regclass('public.rep_revenue_by_professional') IS NOT NULL THEN\n    INSERT INTO public.plg_analytics_read_models (name, date_column, tenant_column, description) VALUES\n      ('rep_revenue_by_professional', 'date', 'tenant_id',\n       'Revenue per professional per day; cancellations and no-shows already excluded')\n    ON CONFLICT (name) DO UPDATE\n      SET date_column   = EXCLUDED.date_column,\n          tenant_column = EXCLUDED.tenant_column,\n          description   = EXCLUDED.description;\n  END IF;\nEND $$;\n";
+export declare const MIGRATION_016_PUBLIC_SERVICES_RELEASE = "-- 016_public_services_release.sql\n--\n-- A service released only to one unit was bookable by anyone. Fix for #201.\n--\n-- `v_public_services` is the anonymous booking catalog. It runs with owner\n-- rights on purpose \u2014 anon holds no membership and no tenant claim, so under\n-- `security_invoker` the RLS on products/services would return nothing and the\n-- public page would go blank. That is the right call, but it means the release\n-- rule #139 put on the internal path never applied here:\n--\n--   products_available_in (075:77) is RESTRICTIVE \u2026 TO authenticated\n--\n-- so `available_in` governed every logged-in reader and nobody else. A service\n-- released to branch B1 alone was listed, and bookable, to the whole internet.\n--\n-- The public catalog is TENANT-wide: create_public_booking takes p_tenant_id and\n-- no unit, so there is no unit context in which \"released to B1\" could be\n-- honoured. A unit-restricted service is therefore not a public offering, and\n-- the view says so \u2014 the same rule the internal path uses (\"no available_in\n-- tuple \u21D2 everywhere\"), read from the anonymous side where \"everywhere\" is the\n-- only scope that exists.\n--\n-- Consequence worth stating plainly: a service released per unit disappears from\n-- the public page. That is the fix, not a side effect \u2014 until the public path\n-- carries a unit, listing it publicly is the bug. The booking RPC refuses it too,\n-- so a stale service id cannot walk in through the back door.\n--\n-- Replay-safe: CREATE OR REPLACE on both objects, no DDL, no data touched.\n\nCREATE OR REPLACE VIEW public.v_public_services AS\nSELECT s.id,\n    s.tenant_id,\n    s.name,\n    s.description,\n    s.price,\n    s.currency,\n    COALESCE(s.duration_minutes, 30) AS duration_minutes,\n    s.image_url,\n    COALESCE(((s.metadata ->> 'sort_order'::text))::integer, 0) AS sort_order\n   FROM services s\n  WHERE s.is_active\n    AND s.status = 'active'::text\n    -- absent \u2192 public (back-compat). Only an explicit false hides it.\n    AND COALESCE((s.metadata ->> 'bookableOnline'::text)::boolean, true)\n    -- \u2026and released to everywhere, not to particular units (#201). A tuple here\n    -- means \"these units only\", which the tenant-wide public page cannot honour.\n    AND NOT EXISTS (\n      SELECT 1 FROM app.resource_grants g\n       WHERE g.tenant_id = s.tenant_id\n         AND g.resource_type = 'catalog.product'\n         AND g.resource_id = s.id\n         AND g.relation = 'available_in');\n\nCOMMENT ON VIEW public.v_public_services IS\n  'Anonymous booking catalog. Owner-rights on purpose (anon has no tenant claim), so the release rule is written into the body: only services with no available_in tuple are public \u2014 see #201.';\n\n-- The RPC must agree with the view, or the id from a cached page still books.\nCREATE OR REPLACE FUNCTION public.agenda_assert_service_is_public(p_tenant_id uuid, p_service_id uuid)\nRETURNS void LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$\nBEGIN\n  IF EXISTS (SELECT 1 FROM app.resource_grants g\n              WHERE g.tenant_id = p_tenant_id\n                AND g.resource_type = 'catalog.product'\n                AND g.resource_id = p_service_id\n                AND g.relation = 'available_in') THEN\n    RAISE EXCEPTION 'este servi\u00E7o n\u00E3o est\u00E1 dispon\u00EDvel para agendamento online'\n      USING ERRCODE = '42501',\n            HINT = 'The service is released to specific units; the public booking path is tenant-wide and cannot honour a unit release (#201).';\n  END IF;\nEND $$;\nREVOKE ALL ON FUNCTION public.agenda_assert_service_is_public(uuid, uuid) FROM public, anon, authenticated;\n\n-- create_public_booking re-emitted from 011 with exactly one line added: the\n-- assert above, right after the service is resolved. Everything else is 011's\n-- body verbatim, so this is a guard, not a rewrite.\nCREATE OR REPLACE FUNCTION public.create_public_booking(p_tenant_id uuid, p_service_id uuid, p_starts_at timestamp with time zone, p_name text, p_phone text, p_email text DEFAULT NULL::text, p_notes text DEFAULT NULL::text, p_assignee_id uuid DEFAULT NULL::uuid)\n RETURNS TABLE(booking_id uuid, starts_at timestamp with time zone, ends_at timestamp with time zone)\n LANGUAGE plpgsql\n SECURITY DEFINER\n SET search_path TO 'public'\nAS $function$\nDECLARE\n  v_service record;\n  v_person_id uuid;\n  v_assignee uuid;\n  v_requested uuid;\n  v_ends timestamptz;\n  v_order uuid;\n  v_booking uuid;\n  v_phone text;\n  v_tz text;\n  v_notes text;\n  v_client_kind text;\nBEGIN\n  -- validation: anon-callable, everything tight\n  IF p_name IS NULL OR length(trim(p_name)) NOT BETWEEN 2 AND 120 THEN\n    RAISE EXCEPTION 'invalid name';\n  END IF;\n  v_phone := regexp_replace(COALESCE(p_phone, ''), '\\D', '', 'g');\n  IF length(v_phone) NOT BETWEEN 8 AND 15 THEN\n    RAISE EXCEPTION 'invalid phone';\n  END IF;\n  IF p_email IS NOT NULL AND (length(p_email) > 254 OR p_email !~ '^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$') THEN\n    RAISE EXCEPTION 'invalid email';\n  END IF;\n  v_notes := left(p_notes, 500);\n  IF p_starts_at IS NULL OR p_starts_at <= now() OR p_starts_at > now() + interval '90 days' THEN\n    RAISE EXCEPTION 'invalid start';\n  END IF;\n\n  SELECT s.id, s.name, s.price, COALESCE(s.duration_minutes, 30) AS duration_minutes\n    INTO v_service\n  FROM services s\n  WHERE s.id = p_service_id AND s.tenant_id = p_tenant_id\n    AND s.is_active AND s.status = 'active';\n  IF NOT FOUND THEN RAISE EXCEPTION 'unknown service'; END IF;\n  -- \u2026and it must be a PUBLIC service, not merely an existing one. A service\n  -- released to particular units is not a tenant-wide offering, and this path has\n  -- no unit to honour the release in; without this an id from a cached page still\n  -- booked what the catalog no longer lists (#201).\n  PERFORM public.agenda_assert_service_is_public(p_tenant_id, p_service_id);\n\n  v_ends := p_starts_at + make_interval(mins => v_service.duration_minutes);\n\n  -- tenant config: timezone + client kind (admin-set; sanitized, never caller input)\n  SELECT COALESCE(t.settings->>'timezone', 'America/Sao_Paulo'),\n         COALESCE(NULLIF(trim(t.settings->'booking'->>'client_kind'), ''), 'customer')\n    INTO v_tz, v_client_kind\n  FROM tenants t WHERE t.id = p_tenant_id;\n  IF v_tz IS NULL THEN RAISE EXCEPTION 'unknown tenant'; END IF;\n  IF v_client_kind !~ '^[a-z_]{2,32}$' THEN v_client_kind := 'customer'; END IF;\n\n  -- resolve the professional, in order of trust:\n  --   1. the id the caller sent (the one the visitor actually saw)\n  --   2. the tenant's configured default (settings->>'defaultAssigneeId')\n  --   3. whoever's working hours cover the slot\n  --\n  -- Step 2 is why this migration exists. Older published clients call this with\n  -- 7 named args, leaving p_assignee_id NULL, and step 3 then resolved to\n  -- \"lowest assignee UUID\" \u2014 an arbitrary instructor who had nothing to do with\n  -- the name the site displayed on the confirmation screen. The default gives\n  -- those clients a correct answer without waiting for a redeploy.\n  v_requested := COALESCE(\n    p_assignee_id,\n    (SELECT NULLIF(t.settings ->> 'defaultAssigneeId', '')::uuid\n       FROM tenants t WHERE t.id = p_tenant_id)\n  );\n\n  SELECT w.assignee_id INTO v_assignee\n  FROM agenda_working_windows(\n         p_tenant_id, (p_starts_at AT TIME ZONE v_tz)::date, v_requested) w\n  WHERE (p_starts_at AT TIME ZONE v_tz)::time >= w.win_start\n    AND (v_ends AT TIME ZONE v_tz)::time <= w.win_end\n  ORDER BY w.assignee_id\n  LIMIT 1;\n  IF v_assignee IS NULL THEN RAISE EXCEPTION 'slot outside working hours'; END IF;\n\n  -- serialize per (tenant, assignee) to kill the double-book race\n  PERFORM pg_advisory_xact_lock(hashtextextended(p_tenant_id::text || v_assignee::text, 0));\n\n  IF EXISTS (\n    SELECT 1 FROM appointments b\n    WHERE b.tenant_id = p_tenant_id\n      AND b.assignee_id = v_assignee\n      AND b.status NOT IN ('cancelled', 'no_show')\n      AND b.starts_at < v_ends\n      AND COALESCE(b.ends_at, b.starts_at) > p_starts_at\n  ) THEN\n    RAISE EXCEPTION 'slot no longer available';\n  END IF;\n\n  -- anti-spam: cap open future public bookings per phone per tenant\n  IF (\n    SELECT count(*) FROM appointments b\n    JOIN people p ON p.id = b.party_id\n    WHERE b.tenant_id = p_tenant_id\n      AND p.phone = v_phone\n      AND b.starts_at > now()\n      AND b.status = 'scheduled'\n  ) >= 3 THEN\n    RAISE EXCEPTION 'too many open bookings for this phone';\n  END IF;\n\n  -- upsert the client by (tenant, kind, phone), serialized by advisory lock\n  -- (kind is tenant-configured, so the customer-only partial index can't\n  -- arbitrate)\n  PERFORM pg_advisory_xact_lock(hashtextextended(p_tenant_id::text || ':' || v_phone, 1));\n\n  SELECT p.id INTO v_person_id\n  FROM people p\n  WHERE p.tenant_id = p_tenant_id AND p.kind = v_client_kind AND p.phone = v_phone\n  ORDER BY p.created_at\n  LIMIT 1;\n\n  IF v_person_id IS NOT NULL THEN\n    UPDATE people SET\n      name = trim(p_name),\n      email = COALESCE(p_email, people.email),\n      updated_at = now()\n    WHERE id = v_person_id;\n  ELSE\n    INSERT INTO people (tenant_id, kind, name, phone, email, metadata)\n    VALUES (p_tenant_id, v_client_kind, trim(p_name), v_phone, p_email,\n            jsonb_build_object('source', 'public_booking'))\n    RETURNING id INTO v_person_id;\n  END IF;\n\n  -- order + booking + order_item (statuses hardcoded \u2014 caller cannot set)\n  INSERT INTO orders (tenant_id, kind, status, party_id, assignee_id, subtotal, total, notes, metadata)\n  VALUES (p_tenant_id, 'appointment', 'scheduled', v_person_id, v_assignee,\n          v_service.price, v_service.price, v_notes,\n          jsonb_build_object('source', 'public_booking',\n                             'serviceNames', v_service.name,\n                             'contactName', trim(p_name)))\n  RETURNING id INTO v_order;\n\n  INSERT INTO appointments (tenant_id, kind, party_id, assignee_id, order_id,\n                        starts_at, ends_at, status, notes, metadata)\n  VALUES (p_tenant_id, 'appointment', v_person_id, v_assignee, v_order,\n          p_starts_at, v_ends, 'scheduled', v_notes,\n          jsonb_build_object('source', 'public_booking', 'serviceNames', v_service.name))\n  RETURNING id INTO v_booking;\n\n  INSERT INTO order_items (order_id, service_id, name, quantity, unit_price, total,\n                           sort_order, duration_minutes, assignee_id)\n  VALUES (v_order, v_service.id, v_service.name, 1, v_service.price, v_service.price,\n          0, v_service.duration_minutes, v_assignee);\n\n  RETURN QUERY SELECT v_booking, p_starts_at, v_ends;\nEND;\n$function$;\n";
+export declare const MIGRATION_017_BOOKING_CHANNEL_REPLY = "-- ============================================================================\n-- plugin-agenda 016: plg_booking_apply_channel_reply \u2014 the customer tapped\n-- Confirmar, and the hor\u00E1rio actually changes.\n--\n-- This is the whole point of the WhatsApp wave. Legacy beautyplace matched the\n-- WORD the customer typed (\"sim\", \"confirmo\"), which had no way to know WHICH\n-- appointment was meant and so confirmed every future one they had; the\n-- workaround was a 48-hour re-enrichment subsystem that existed only to guess.\n-- The button carries the appointment id in its payload, so there is nothing to\n-- guess \u2014 and this function is the other half: the id arrives, the state\n-- machine is checked, one row changes.\n--\n-- SERVICE-ROLE ONLY. The caller is the tyxter-webhook edge function, acting on\n-- a signed delivery from the provider \u2014 there is no session and no auth.uid().\n-- That is also why the tenant is not a parameter: it is READ from the\n-- appointment. A tenant id in the signature would be a tenant id the caller\n-- could get wrong, and the caller is code reacting to the outside world.\n--\n-- Idempotent by design, not by luck: re-applying an action that already\n-- happened returns the current state with `changed: false` and emits NOTHING.\n-- Tyxter delivers at least once, so the same tap arrives twice as a matter of\n-- routine, and a second `agenda.booking_cancelled` would send the customer a\n-- second cancellation message for one cancellation.\n-- Idempotent + safe to re-run.\n-- ============================================================================\n\n-- `p_expect_tenant_id` is the caller saying which tenant it BELIEVES this\n-- booking belongs to, and it is the difference between a safe function and a\n-- way to confirm any appointment in the pool by guessing a uuid. The button\n-- payload arrives from a customer's phone; WhatsApp echoes back the id we put\n-- on the button, and nothing stops a crafted client from echoing a different\n-- one. The webhook knows which tenant the CONVERSATION belongs to, and that is\n-- the claim checked here \u2014 before the update, not after it.\n--\n-- A mismatch answers `not_found` and not `not_allowed`, deliberately: the two\n-- would let a prober tell \"this uuid is somebody's appointment\" from \"this uuid\n-- is nothing\", which is a booking-id oracle.\nCREATE OR REPLACE FUNCTION public.plg_booking_apply_channel_reply(\n  p_booking_id      uuid,\n  p_action          text,\n  p_expect_tenant_id uuid DEFAULT NULL\n) RETURNS jsonb\nLANGUAGE plpgsql\nSECURITY DEFINER\nSET search_path = public\nAS $fn$\nDECLARE\n  v_action  text := nullif(trim(lower(p_action)), '');\n  v_target  text;\n  v_row     record;\n  v_tz      text;\n  v_starts  timestamptz;\n  v_event   text;\n  v_payload jsonb;\nBEGIN\n  IF v_action IS NULL OR v_action NOT IN ('confirm', 'cancel') THEN\n    RETURN jsonb_build_object('result', 'not_allowed', 'reason', 'unknown_action');\n  END IF;\n  IF p_booking_id IS NULL THEN\n    RETURN jsonb_build_object('result', 'not_found', 'reason', 'no_booking_id');\n  END IF;\n\n  v_target := CASE WHEN v_action = 'confirm' THEN 'confirmed' ELSE 'cancelled' END;\n\n  -- FOR UPDATE, because two deliveries of the same tap race each other and the\n  -- loser must read the state the winner wrote, not the state both started from.\n  SELECT b.id, b.tenant_id, b.status, b.starts_at\n    INTO v_row\n    FROM public.appointments b\n   WHERE b.id = p_booking_id\n     FOR UPDATE;\n  IF NOT FOUND THEN\n    RETURN jsonb_build_object('result', 'not_found', 'booking_id', p_booking_id);\n  END IF;\n\n  IF p_expect_tenant_id IS NOT NULL AND v_row.tenant_id <> p_expect_tenant_id THEN\n    RETURN jsonb_build_object('result', 'not_found', 'booking_id', p_booking_id);\n  END IF;\n\n  -- Already there. The answer is the outcome, not an error: the customer sees\n  -- \"confirmado\" either way, and a webhook that 500s on a duplicate is a\n  -- webhook Tyxter retries eight times over a day and a half.\n  IF v_row.status = v_target THEN\n    RETURN jsonb_build_object(\n      'result', v_target, 'changed', false,\n      'booking_id', v_row.id, 'tenant_id', v_row.tenant_id, 'status', v_row.status);\n  END IF;\n\n  -- Confirming is only meaningful from the two states that mean \"not settled\n  -- yet\". 'pending' is the table's own DEFAULT and 'scheduled' is what every\n  -- write path sets, so both are live appointments awaiting the customer.\n  -- Confirming a completed or cancelled one would rewrite history.\n  IF v_action = 'confirm' AND v_row.status NOT IN ('pending', 'scheduled') THEN\n    RETURN jsonb_build_object(\n      'result', 'not_allowed', 'changed', false,\n      'booking_id', v_row.id, 'tenant_id', v_row.tenant_id, 'status', v_row.status);\n  END IF;\n\n  -- Cancelling is allowed from anything that has not already ENDED. A confirmed\n  -- appointment can still be cancelled \u2014 that is the ordinary case \u2014 but one\n  -- already cancelled or already completed cannot.\n  IF v_action = 'cancel' AND v_row.status IN ('cancelled', 'completed') THEN\n    RETURN jsonb_build_object(\n      'result', 'not_allowed', 'changed', false,\n      'booking_id', v_row.id, 'tenant_id', v_row.tenant_id, 'status', v_row.status);\n  END IF;\n\n  UPDATE public.appointments\n     SET status = v_target, updated_at = now()\n   WHERE id = v_row.id;\n\n  -- \u2500\u2500 the fact \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  -- Emitted HERE and not by the caller. The write happened in the database, so\n  -- the browser emitter never sees it (packages/db/migrations/027 is the whole\n  -- argument), and a webhook that updated the row and then failed to post the\n  -- event would leave a confirmed appointment nobody was told about.\n  --\n  -- The payload is BOOKING_FIELDS from plugin-agenda's message-events.ts, field\n  -- for field, so an automation reacting to a WhatsApp confirmation renders the\n  -- same message as one reacting to a confirmation made in the app.\n  SELECT COALESCE(t.settings->>'timezone', 'America/Sao_Paulo') INTO v_tz\n    FROM public.tenants t WHERE t.id = v_row.tenant_id;\n  v_tz := COALESCE(v_tz, 'America/Sao_Paulo');\n  v_starts := v_row.starts_at;\n\n  SELECT jsonb_build_object(\n      'customer_name',     COALESCE(a.client_name, ''),\n      'service_name',      COALESCE((\n        SELECT string_agg(s->>'name', ' + ')\n          FROM jsonb_array_elements(COALESCE(a.services::jsonb, '[]'::jsonb)) AS s), ''),\n      'professional_name', COALESCE(a.professional_name, ''),\n      'booking_date',      to_char(v_starts AT TIME ZONE v_tz, 'DD/MM/YYYY'),\n      'booking_time',      to_char(v_starts AT TIME ZONE v_tz, 'HH24:MI'),\n      'location_name',     COALESCE(a.location_name, ''),\n      'customer_phone',    COALESCE(a.client_phone, ''),\n      'source',            'channel_reply')\n    INTO v_payload\n    FROM public.v_appointments a\n   WHERE a.id = v_row.id;\n\n  v_event := CASE WHEN v_action = 'confirm'\n                  THEN 'agenda.booking_confirmed'\n                  ELSE 'agenda.booking_cancelled' END;\n\n  PERFORM public.plg_emit_event(\n    v_event,\n    COALESCE(v_payload, '{}'::jsonb),\n    'booking',\n    v_row.id::text,\n    v_row.tenant_id,\n    NULL);\n\n  RETURN jsonb_build_object(\n    'result', v_target, 'changed', true, 'event_key', v_event,\n    'booking_id', v_row.id, 'tenant_id', v_row.tenant_id,\n    'status', v_target, 'previous_status', v_row.status);\nEND;\n$fn$;\n\n-- The webhook has the service-role key and no session; nothing else may move an\n-- appointment without one. Granting `authenticated` here would be a way to\n-- confirm any appointment in the pool by id, with no tenant check anywhere in\n-- the body \u2014 the check this function deliberately does not make, because its\n-- only caller cannot present a tenant to check against.\nREVOKE ALL ON FUNCTION public.plg_booking_apply_channel_reply(uuid, text, uuid) FROM public;\nREVOKE ALL ON FUNCTION public.plg_booking_apply_channel_reply(uuid, text, uuid) FROM anon;\nREVOKE ALL ON FUNCTION public.plg_booking_apply_channel_reply(uuid, text, uuid) FROM authenticated;\nGRANT EXECUTE ON FUNCTION public.plg_booking_apply_channel_reply(uuid, text, uuid) TO service_role;\n";
+export declare const MIGRATION_018_THE_AGENDA_DECLARES_ITS_SPECIES = "-- ---------------------------------------------------------------------------\n-- 020_the_agenda_declares_its_species.sql \u2014 the agenda owns the species of the\n-- Compromisso and of the Agenda, and says so in a row (#274, ADR 0017).\n--\n-- The base owns the FORM: `public.appointments` and `public.schedules` are\n-- archetypes, with their columns, their RLS and their screens. What KIND of\n-- appointment exists is the plugin's, and since 147 that is a row in a registry\n-- with a real foreign key behind it \u2014 not a literal a plugin hopes nobody else\n-- also chose.\n--\n-- \u2500\u2500 This closes a break, not a formality \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n-- 147 created `appointment_kinds` and `schedule_kinds` empty, and adopted only\n-- what a live pool already held. Three of the four pools have appointments, so\n-- adoption covered them and nothing looked wrong. A FRESH cluster has neither \u2014\n-- so the first booking on a brand-new pool would have been refused by the FK,\n-- with a message about a constraint rather than about a missing declaration.\n-- Found by the anchoring rule the same week it was written (#283), which is the\n-- argument for having it: the alternative was finding it in a customer's first\n-- five minutes.\n--\n-- \u2500\u2500 Why the plugin and not the base \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n-- Registering these in 147 would have been quicker and wrong. `working_hours`\n-- is not a fact about scheduling in general; it is how THIS plugin models a\n-- professional's week, and a vertical that models availability differently must\n-- be able to register its own without editing the base. The rule the registry\n-- exists to make enforceable is exactly this one, so the agenda goes first.\n-- ---------------------------------------------------------------------------\n\nDO $$\nBEGIN\n  IF to_regprocedure('public.register_kind(text, text, text, text[], jsonb, text)') IS NULL THEN\n    RAISE NOTICE 'plugin-agenda 020: register_kind missing (spine < 147) \u2014 skipped';\n    RETURN;\n  END IF;\n\n  -- \u2500\u2500 the Compromisso \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  -- Statuses are the agenda's own lifecycle, the same vocabulary 090 gave the\n  -- commercial document that accompanies an appointment. Transitions are left\n  -- NULL: the plugin's RPCs own the machine, and a second one in the registry\n  -- would be a second opinion about the same fact.\n  PERFORM public.register_kind(\n    'appointment', 'appointment', 'agenda',\n    ARRAY['scheduled', 'confirmed', 'in_progress', 'completed', 'cancelled', 'no_show'],\n    NULL,\n    'A booked appointment \u2014 the Compromisso the agenda schedules, confirms and closes.');\n\n  PERFORM public.register_kind(\n    'appointment', 'block', 'agenda',\n    ARRAY['scheduled', 'cancelled'],\n    NULL,\n    'Time deliberately taken off the calendar: a break, a meeting, an absence. Occupies a slot and is never billed.');\n\n  -- \u2500\u2500 the Agenda itself \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  PERFORM public.register_kind(\n    'schedule', 'working_hours', 'agenda', NULL, NULL,\n    'A professional''s recurring availability \u2014 the week that says when a slot can exist at all.');\n\n  PERFORM public.register_kind(\n    'schedule', 'exception', 'agenda', NULL, NULL,\n    'A dated override of the working week: a holiday, a half-day, a one-off extension. Beats the recurring rule for its date (007).');\n\n  PERFORM public.register_kind(\n    'schedule', 'block', 'agenda', NULL, NULL,\n    'A closed period on the calendar, independent of any one professional.');\nEND $$;\n";
+export declare const MIGRATION_019_THE_DEFINER_FUNCTIONS_STOP_TRUSTING_THE_PATH = "-- ---------------------------------------------------------------------------\n-- 019_the_definer_functions_stop_trusting_the_path \u2014 every SECURITY DEFINER function this plugin\n-- owns stops resolving names the caller's way (#283).\n--\n-- The shape being closed: a definer function runs as its OWNER but resolves\n-- unqualified names using the CALLER's `search_path`. Anyone who can put an\n-- object earlier in that path gets it executed with the owner's rights. 157\n-- removed the ability to plant one in `public`; this removes the other half,\n-- which is the function trusting the path at all.\n--\n-- \u2500\u2500 Why ALTER and not a re-emitted CREATE \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n-- These functions are live in pools. Re-emitting each body to add one clause\n-- would copy hundreds of lines for a one-word change, and every copy is a\n-- chance to alter behaviour by accident. `ALTER FUNCTION \u2026 SET search_path`\n-- changes exactly the property in question and nothing else.\n--\n-- \u2500\u2500 Why `public, pg_catalog` and not '' \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n-- The empty path is stricter and demands every name be schema-qualified \u2014 the\n-- right shape for something written today, and a rewrite of bodies written\n-- before the rule. What closes the hole is that the path is FIXED rather than\n-- inherited; these bodies already read `public` objects by bare name, so\n-- pinning to what they were written against keeps them correct and stops the\n-- caller having any say. The booking path is called by an anonymous shopper, which is exactly the caller whose path should count for nothing.\n-- ---------------------------------------------------------------------------\n\nDO $pin$\nDECLARE\n  v_fn record;\n  v_pinned integer := 0;\nBEGIN\n  FOR v_fn IN\n    SELECT p.oid, p.proname, pg_get_function_identity_arguments(p.oid) AS args\n      FROM pg_proc p\n      JOIN pg_namespace n ON n.oid = p.pronamespace\n     WHERE n.nspname = 'public'\n       AND p.prosecdef\n       AND p.proname = ANY (ARRAY['create_public_booking', 'fn_gcal_push_booking'])\n       AND NOT EXISTS (\n         SELECT 1 FROM unnest(coalesce(p.proconfig, ARRAY[]::text[])) AS cfg\n          WHERE cfg LIKE 'search\\_path=%'\n       )\n  LOOP\n    EXECUTE format('ALTER FUNCTION public.%I(%s) SET search_path = public, pg_catalog',\n                   v_fn.proname, v_fn.args);\n    v_pinned := v_pinned + 1;\n  END LOOP;\n  IF v_pinned > 0 THEN\n    RAISE NOTICE 'plugin-agenda: pinned search_path on % definer function(s)', v_pinned;\n  END IF;\nEND $pin$;\n";
 export declare const MIGRATIONS: Array<{
     id: string;
     sql: string;

package/dist/migrations/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,gCAAgC,09BAqB5C,CAAA;AAED,eAAO,MAAM,qCAAqC,giDA2CjD,CAAA;AAED,eAAO,MAAM,4BAA4B,q0ZAwSxC,CAAA;AAED,eAAO,MAAM,+BAA+B,0sBAc3C,CAAA;AAED,eAAO,MAAM,gCAAgC,q5OA+K5C,CAAA;AAED,eAAO,MAAM,qCAAqC,oiPAgLjD,CAAA;AAED,eAAO,MAAM,wBAAwB,uzQAwKpC,CAAA;AAED,eAAO,MAAM,iCAAiC,0xRAqL7C,CAAA;AAED,eAAO,MAAM,2CAA2C,i5YAkSvD,CAAA;AAED,eAAO,MAAM,4CAA4C,i8QA4KxD,CAAA;AAED,eAAO,MAAM,qCAAqC,04MAkKjD,CAAA;AAED,eAAO,MAAM,qCAAqC,y2CA+BjD,CAAA;AAED,eAAO,MAAM,8BAA8B,ivOAuK1C,CAAA;AAED,eAAO,MAAM,0CAA0C,6gDA6BtD,CAAA;AAED,eAAO,MAAM,sCAAsC,2yRAuMlD,CAAA;AAED,eAAO,MAAM,0CAA0C,o7SAuMtD,CAAA;AAED,eAAO,MAAM,UAAU,EAAE,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAiBzD,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,gCAAgC,09BAqB5C,CAAA;AAED,eAAO,MAAM,qCAAqC,giDA2CjD,CAAA;AAED,eAAO,MAAM,4BAA4B,ijcAkUxC,CAAA;AAED,eAAO,MAAM,+BAA+B,0sBAc3C,CAAA;AAED,eAAO,MAAM,gCAAgC,q5OA+K5C,CAAA;AAED,eAAO,MAAM,qCAAqC,oiPAgLjD,CAAA;AAED,eAAO,MAAM,wBAAwB,uzQAwKpC,CAAA;AAED,eAAO,MAAM,iCAAiC,0xRAqL7C,CAAA;AAED,eAAO,MAAM,2CAA2C,i5YAkSvD,CAAA;AAED,eAAO,MAAM,4CAA4C,i8QA4KxD,CAAA;AAED,eAAO,MAAM,qCAAqC,ygOAkLjD,CAAA;AAED,eAAO,MAAM,qCAAqC,y2CA+BjD,CAAA;AAED,eAAO,MAAM,8BAA8B,ivOAuK1C,CAAA;AAED,eAAO,MAAM,0CAA0C,6gDA6BtD,CAAA;AAED,eAAO,MAAM,sCAAsC,2yRAuMlD,CAAA;AAED,eAAO,MAAM,0CAA0C,o7SAuMtD,CAAA;AAED,eAAO,MAAM,mCAAmC,08LAsI/C,CAAA;AAED,eAAO,MAAM,qCAAqC,8iVAuOjD,CAAA;AAED,eAAO,MAAM,mCAAmC,o6QAwK/C,CAAA;AAED,eAAO,MAAM,6CAA6C,q8IAiEzD,CAAA;AAED,eAAO,MAAM,0DAA0D,o4FAkDtE,CAAA;AAED,eAAO,MAAM,UAAU,EAAE,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAsBzD,CAAA"}

package/dist/views/CalendarView.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CalendarView.d.ts","sourceRoot":"","sources":["../../src/views/CalendarView.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA4D,MAAM,OAAO,CAAA;AA2QhF,wBAAgB,YAAY,sBA22B3B"}
+{"version":3,"file":"CalendarView.d.ts","sourceRoot":"","sources":["../../src/views/CalendarView.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA4D,MAAM,OAAO,CAAA;AA2QhF,wBAAgB,YAAY,sBA65B3B"}

package/package.json

@@ -1,9 +1,10 @@
 {
   "name": "@fayz-ai/plugin-agenda",
   "fayz": {
-    "status": "beta"
+    "status": "beta",
+    "dependencies": []
   },
-  "version": "0.10.2",
+  "version": "0.12.0",
   "description": "Fayz SDK — plugin-agenda plugin",
   "type": "module",
   "sideEffects": [
@@ -41,10 +42,10 @@
     "@tanstack/react-table": "^8.20.0",
     "@fullcalendar/resource-timegrid": "^6.1.0",
     "@fullcalendar/list": "^6.1.0",
-    "@fayz-ai/core": "^0.14.0",
-    "@fayz-ai/ui": "^0.14.0",
-    "@fayz-ai/admin": "^0.14.0",
-    "@fayz-ai/plugin-financial": "^0.10.0"
+    "@fayz-ai/core": "^0.16.0",
+    "@fayz-ai/ui": "^0.16.0",
+    "@fayz-ai/admin": "^0.16.0",
+    "@fayz-ai/plugin-financial": "^0.12.0"
   },
   "devDependencies": {
     "@types/react": "^18.3.0",