@fayz-ai/plugin-agenda 0.12.2 → 0.13.0

package/dist/index.js

@@ -1,8 +1,8 @@
-import { createMockAgendaProvider, createSupabasePublicBookingProvider } from './chunk-ISLJXP7O.js';
-export { createMockAgendaProvider } from './chunk-ISLJXP7O.js';
-import React13, { useState, useEffect, useCallback, useMemo, useRef } from 'react';
-import { connectionStatus, createConnectionStore, getSupabaseClientOptional, getActiveTenantId, registerTranslations, registerMessageDefaults, createSafeDataProvider, connectorRuntimeToken, CONNECTOR_RUNTIME_TOKEN_HEADER, emitDataChanged, usePluginRuntimeOptional, useTranslation, emitDomainEvent, getCurrentLocale, useDataChanged, formatCurrency } from '@fayz-ai/core';
-import { createPluginContext, fayzConnectorOAuth, setScheduleBlockConfig, getScheduleBlockConfig, PluginSettingsPanel, dedup, useTenantPluginSettings, SettingsGroup, ToggleRow, SelectRow, usePluginPrefs, PersonLink, PageActions, useLimitGuard, useLookupCreate, RightRailPage, CrudFormPage, CrudDetailPage, ContactPicker, invalidateLimit } from '@fayz-ai/admin';
+import { createMockAgendaProvider, createSupabasePublicBookingProvider } from './chunk-PDYBAVXU.js';
+export { createMockAgendaProvider } from './chunk-PDYBAVXU.js';
+import React11, { useState, useEffect, useCallback, useMemo, useRef, useLayoutEffect } from 'react';
+import { connectionStatus, createConnectionStore, getSupabaseClientOptional, getActiveTenantId, registerTranslations, registerMessageDefaults, createSafeDataProvider, connectorRuntimeToken, CONNECTOR_RUNTIME_TOKEN_HEADER, getActiveUnitId, emitDataChanged, usePluginRuntimeOptional, useTranslation, emitDomainEvent, getCurrentLocale, useActiveUnitId, useDataChanged, formatCurrency } from '@fayz-ai/core';
+import { createPluginContext, fayzConnectorOAuth, setScheduleBlockConfig, getScheduleBlockConfig, PluginSettingsPanel, dedup, useTenantPluginSettings, SettingsGroup, ToggleRow, SelectRow, usePermissionOptional, PersonLink, usePluginPrefs, PageActions, PaymentStatusBadge as PaymentStatusBadge$1, RightRailPage, useLimitGuard, useLookupCreate, CrudFormPage, CrudDetailPage, ContactPicker, invalidateLimit } from '@fayz-ai/admin';
 import FullCalendar from '@fullcalendar/react';
 import dayGridPlugin from '@fullcalendar/daygrid';
 import timeGridPlugin from '@fullcalendar/timegrid';
@@ -10,10 +10,11 @@ import resourceTimeGridPlugin from '@fullcalendar/resource-timegrid';
 import interactionPlugin from '@fullcalendar/interaction';
 import listPlugin from '@fullcalendar/list';
 import ptBrLocale from '@fullcalendar/core/locales/pt-br';
-import { Loader2, AlertCircle, RefreshCw, CalendarPlus, X, CheckCircle2, Plus, ChevronDown, Settings, ChevronLeft, ChevronRight, Pencil, Trash2, Clock, User, MapPin, FileText, AlertTriangle, Check, DollarSign, HandCoins, Ban, CheckSquare, Calendar, Briefcase, CircleDot, FileCheck, ArrowRightLeft, CreditCard, QrCode, Banknote, ExternalLink } from 'lucide-react';
+import { Loader2, AlertCircle, RefreshCw, CalendarPlus, X, CheckCircle2, Search, LogIn, User, Clock, CalendarDays, Plus, Settings, ChevronLeft, ChevronRight, CircleAlert, CircleDollarSign, Ban, CheckSquare, Calendar, DollarSign, AlertTriangle, MapPin, Briefcase, CircleDot, FileText, Check, HandCoins, Pencil, Trash2, FileCheck, ArrowRightLeft, CreditCard, QrCode, Banknote, ExternalLink } from 'lucide-react';
+import { toast, Button, Checkbox, Badge, Select, SelectTrigger, SelectValue, SelectContent, SelectItem, SubpageHeader, FilterSection, MiniCalendar, PageHeaderActions, ConfirmDialog, FilterCheckRow, SearchCombobox, cn, TooltipProvider, Tooltip, TooltipTrigger, TooltipContent } from '@fayz-ai/ui';
 import { jsxs, jsx, Fragment } from 'react/jsx-runtime';
 import { createPortal } from 'react-dom';
-import { toast, Button, Checkbox, Badge, Select, SelectTrigger, SelectValue, SelectContent, SelectItem, PageHeaderActions, ConfirmDialog, SearchCombobox, cn, TooltipProvider, Tooltip, TooltipTrigger, TooltipContent } from '@fayz-ai/ui';
+import { ClientAccountModal } from '@fayz-ai/plugin-financial';
 import { createStore } from 'zustand/vanilla';
 
 // src/lib/message-events.ts
@@ -221,11 +222,24 @@ var DEFAULT_CURRENCY = { code: "BRL", locale: "pt-BR", symbol: "R$" };
 var DEFAULT_STATUSES = [
   { value: "scheduled", label: "Scheduled", color: "#6366f1" },
   { value: "confirmed", label: "Confirmed", color: "#3b82f6" },
+  { value: "waiting", label: "Waiting", color: "#f97316", availableWhen: "today_only" },
   { value: "in_progress", label: "In Progress", color: "#f59e0b", availableWhen: "today_only" },
   { value: "completed", label: "Completed", color: "#10b981", availableWhen: "today_or_past" },
   { value: "cancelled", label: "Cancelled", color: "#ef4444" },
   { value: "no_show", label: "No Show", color: "#6b7280", availableWhen: "today_or_past" }
 ];
+function withCheckinStatus(statuses, checkin) {
+  if (!checkin || statuses.some((s) => s.value === "waiting")) return statuses;
+  const at = statuses.findIndex((s) => s.value === "in_progress");
+  const waiting = {
+    value: "waiting",
+    label: "Waiting",
+    color: "#f97316",
+    availableWhen: "today_only"
+  };
+  if (at < 0) return [...statuses, waiting];
+  return [...statuses.slice(0, at), waiting, ...statuses.slice(at)];
+}
 var DEFAULT_BOOKING_TYPES = [
   {
     id: "appointment",
@@ -294,7 +308,11 @@ function resolveConfig(options) {
     bookingKind: options?.bookingKind ?? "appointment",
     orderKind: options?.orderKind ?? "service_order",
     scheduleKind: options?.scheduleKind ?? "working_hours",
-    statuses: options?.statuses ?? DEFAULT_STATUSES,
+    // Check-in WRITES `waiting`, so enabling check-in has to declare it. An app
+    // that passes its own `statuses` (most do) would otherwise be missing the
+    // one status the feature produces — the calendar cannot colour or select it,
+    // and the checked-in client drops out of the very queue meant to track them.
+    statuses: withCheckinStatus(options?.statuses ?? DEFAULT_STATUSES, options?.checkin),
     bookingTypes,
     businessHours: options?.businessHours ?? { startTime: "07:00", endTime: "21:00" },
     slotDuration: options?.slotDuration ?? 30,
@@ -616,75 +634,62 @@ function useAgendaSettings() {
     setEndTime: (v) => prefs.set("endTime", v)
   };
 }
-var DAY_LABELS = {
-  en: ["S", "M", "T", "W", "T", "F", "S"],
-  "pt-BR": ["D", "S", "T", "Q", "Q", "S", "S"]
-};
-function isSameDay(a, b) {
-  return a.getFullYear() === b.getFullYear() && a.getMonth() === b.getMonth() && a.getDate() === b.getDate();
-}
-function isToday(d) {
-  return isSameDay(d, /* @__PURE__ */ new Date());
-}
-function toDateLocale(locale) {
-  if (locale === "pt-BR") return "pt-BR";
-  return "en-US";
-}
-function MiniCalendar({ selectedDate, onDateSelect, onMonthChange }) {
-  const locale = getCurrentLocale();
-  const [viewMonth, setViewMonth] = React13.useState(() => new Date(selectedDate.getFullYear(), selectedDate.getMonth(), 1));
-  const monthLabel = viewMonth.toLocaleDateString(toDateLocale(locale), { month: "long", year: "numeric" });
-  const dayLabels = DAY_LABELS[locale] ?? DAY_LABELS.en;
-  const weeks = useMemo(() => {
-    const year = viewMonth.getFullYear();
-    const month = viewMonth.getMonth();
-    const firstDay = new Date(year, month, 1);
-    const startOffset = firstDay.getDay();
-    const daysInMonth = new Date(year, month + 1, 0).getDate();
-    const cells = [];
-    for (let i = 0; i < startOffset; i++) cells.push(null);
-    for (let d = 1; d <= daysInMonth; d++) cells.push(new Date(year, month, d));
-    while (cells.length % 7 !== 0) cells.push(null);
-    const rows = [];
-    for (let i = 0; i < cells.length; i += 7) rows.push(cells.slice(i, i + 7));
-    return rows;
-  }, [viewMonth]);
-  function prevMonth() {
-    const d = new Date(viewMonth.getFullYear(), viewMonth.getMonth() - 1, 1);
-    setViewMonth(d);
-    onMonthChange?.(d);
-  }
-  function nextMonth() {
-    const d = new Date(viewMonth.getFullYear(), viewMonth.getMonth() + 1, 1);
-    setViewMonth(d);
-    onMonthChange?.(d);
-  }
-  function handleClick(date) {
-    onDateSelect(date);
-  }
-  return /* @__PURE__ */ jsxs("div", { className: "select-none", children: [
-    /* @__PURE__ */ jsxs("div", { className: "flex items-center justify-between mb-2", children: [
-      /* @__PURE__ */ jsx("span", { className: "text-sm font-medium capitalize", children: monthLabel }),
-      /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-0.5", children: [
-        /* @__PURE__ */ jsx("button", { onClick: prevMonth, className: "flex h-6 w-6 items-center justify-center rounded-full hover:bg-muted transition-colors", children: /* @__PURE__ */ jsx(ChevronLeft, { className: "h-3.5 w-3.5" }) }),
-        /* @__PURE__ */ jsx("button", { onClick: nextMonth, className: "flex h-6 w-6 items-center justify-center rounded-full hover:bg-muted transition-colors", children: /* @__PURE__ */ jsx(ChevronRight, { className: "h-3.5 w-3.5" }) })
-      ] })
+function StatusFilterList({
+  statuses,
+  selected,
+  onToggle
+}) {
+  return /* @__PURE__ */ jsx(Fragment, { children: statuses.map((st) => /* @__PURE__ */ jsx(
+    FilterCheckRow,
+    {
+      option: { value: st.value, label: st.label, color: st.color },
+      checked: selected.length === 0 || selected.includes(st.value),
+      onToggle: () => onToggle(st.value)
+    },
+    st.value
+  )) });
+}
+function ProfessionalFilterList({
+  names,
+  selected,
+  onToggle,
+  search,
+  onSearchChange,
+  searchPlaceholder,
+  maxRows = 40,
+  footer
+}) {
+  const searchable = onSearchChange !== void 0 && (names.length > maxRows || Boolean(search));
+  const term = (search ?? "").trim().toLowerCase();
+  const matches = term ? names.filter((n) => n.label.toLowerCase().includes(term)) : names;
+  const shown = matches.slice(0, maxRows);
+  const hidden = matches.length - shown.length;
+  return /* @__PURE__ */ jsxs(Fragment, { children: [
+    searchable && /* @__PURE__ */ jsx(
+      "input",
+      {
+        type: "search",
+        value: search ?? "",
+        onChange: (e) => onSearchChange?.(e.target.value),
+        placeholder: searchPlaceholder,
+        className: "mb-1.5 w-full rounded-md border border-border bg-background px-2 py-1 text-xs outline-none focus:border-primary"
+      }
+    ),
+    shown.map((item) => /* @__PURE__ */ jsx(
+      FilterCheckRow,
+      {
+        option: { value: item.id, label: item.label },
+        checked: selected.length === 0 || selected.includes(item.id),
+        onToggle: () => onToggle(item.id)
+      },
+      item.id
+    )),
+    matches.length === 0 && /* @__PURE__ */ jsx("p", { className: "px-1 py-1 text-xs text-muted-foreground", children: "\u2014" }),
+    hidden > 0 && /* @__PURE__ */ jsxs("p", { className: "px-1 py-1 text-[11px] text-muted-foreground", children: [
+      "+",
+      hidden
     ] }),
-    /* @__PURE__ */ jsx("div", { className: "grid grid-cols-7 mb-0.5", children: dayLabels.map((label, i) => /* @__PURE__ */ jsx("div", { className: "flex h-6 w-6 items-center justify-center text-[10px] font-medium text-muted-foreground mx-auto", children: label }, i)) }),
-    weeks.map((week, wi) => /* @__PURE__ */ jsx("div", { className: "grid grid-cols-7", children: week.map((date, di) => {
-      if (!date) return /* @__PURE__ */ jsx("div", { className: "h-6 w-6 mx-auto" }, di);
-      const selected = isSameDay(date, selectedDate);
-      const today = isToday(date);
-      return /* @__PURE__ */ jsx(
-        "button",
-        {
-          onClick: () => handleClick(date),
-          className: `flex h-6 w-6 items-center justify-center rounded-full text-[11px] mx-auto transition-colors ${selected ? "bg-primary text-primary-foreground" : today ? "bg-primary/10 text-primary font-semibold" : "hover:bg-muted text-foreground"}`,
-          children: date.getDate()
-        },
-        di
-      );
-    }) }, wi))
+    footer
   ] });
 }
 var TYPE_ICONS = {
@@ -1351,6 +1356,11 @@ function AppointmentModal({ open, mode, bookingId, prefill, initialTab, external
       return "09:00";
     });
   }, [open, requestKey]);
+  useEffect(() => {
+    if (!open || locationId) return;
+    const opts = storeLocations.length > 0 ? storeLocations : config.locations;
+    if (opts.length === 1) setLocationId(opts[0].id);
+  }, [open, locationId, storeLocations, config.locations]);
   useEffect(() => {
     if (!open || mode !== "edit" || !bookingId) return;
     setLoading(true);
@@ -2635,6 +2645,22 @@ function CalendarSkeleton({ profCount = 2 }) {
     ] }, h)) })
   ] });
 }
+var MIN_COLUMN_PX = 48;
+var MIN_SHELL_HEIGHT = 360;
+function abbreviateName(full) {
+  const parts = full.trim().split(/\s+/).filter(Boolean);
+  if (parts.length === 0) return full;
+  const particles = /* @__PURE__ */ new Set(["de", "da", "do", "das", "dos", "e", "del", "di", "du", "van", "von"]);
+  const cap = (w) => w.charAt(0).toUpperCase() + w.slice(1).toLowerCase();
+  const first = cap(parts[0]);
+  if (parts.length === 1) return first;
+  const surnames = parts.slice(1).filter((w) => !particles.has(w.toLowerCase()));
+  const last = surnames.length > 0 ? surnames[surnames.length - 1] : parts[parts.length - 1];
+  return `${first} ${last.charAt(0).toUpperCase()}.`;
+}
+var MAX_DEFAULT_AGENDAS = 6;
+var MAX_SELECTED_AGENDAS = 10;
+var MAX_PICKER_ROWS = 40;
 var RESOURCE_VIEW_OPTIONS = [
   { key: "resourceTimeGridDay", labelKey: "agenda.calendar.viewDay" },
   { key: "resourceTimeGridWeek", labelKey: "agenda.calendar.viewWeek" },
@@ -2686,6 +2712,7 @@ function CalendarView() {
   const bookingsLoading = useAgendaStore((s) => s.bookingsLoading);
   const professionals = useAgendaStore((s) => s.professionals);
   const professionalsLoading = useAgendaStore((s) => s.professionalsLoading);
+  const professionalsTruncated = useAgendaStore((s) => s.professionalsTruncated);
   const currentView = useAgendaStore((s) => s.currentView);
   const selectedProfIds = useAgendaStore((s) => s.selectedProfessionalIds);
   const selectedStatuses = useAgendaStore((s) => s.selectedStatuses);
@@ -2704,6 +2731,26 @@ function CalendarView() {
   const isMobile = useIsMobile();
   const resourceCapable = professionals.length > 0;
   const viewOptions = resourceCapable ? RESOURCE_VIEW_OPTIONS : PLAIN_VIEW_OPTIONS;
+  const shellRef = useRef(null);
+  const [shellHeight, setShellHeight] = useState(void 0);
+  useLayoutEffect(() => {
+    const measure = () => {
+      const el = shellRef.current;
+      if (!el) return;
+      const top = el.getBoundingClientRect().top;
+      const parent = el.parentElement;
+      const pad = parent ? parseFloat(getComputedStyle(parent).paddingBottom) || 0 : 0;
+      setShellHeight(Math.max(MIN_SHELL_HEIGHT, window.innerHeight - top - pad));
+    };
+    measure();
+    window.addEventListener("resize", measure);
+    const ro = new ResizeObserver(measure);
+    if (document.body) ro.observe(document.body);
+    return () => {
+      window.removeEventListener("resize", measure);
+      ro.disconnect();
+    };
+  }, []);
   const [mobileView, setMobileView] = useState(MOBILE_LIST_VIEW);
   const mobileViewOptions = useMemo(
     () => [
@@ -2731,8 +2778,6 @@ function CalendarView() {
   const [scheduleConfirm, setScheduleConfirm] = useState(null);
   const [calendarTitle, setCalendarTitle] = useState("");
   const [selectedDate, setSelectedDate] = useState(/* @__PURE__ */ new Date());
-  const [profSectionOpen, setProfSectionOpen] = useState(true);
-  const [statusSectionOpen, setStatusSectionOpen] = useState(false);
   const [visibleRange, setVisibleRange] = useState(null);
   useEffect(() => () => closeModal(), [closeModal]);
   const openModal = useCallback((...args) => {
@@ -2748,11 +2793,33 @@ function CalendarView() {
     for (const s of config.statuses) map[s.value] = s.color;
     return map;
   }, [config.statuses]);
+  const activeUnitId = useActiveUnitId();
   useEffect(() => {
     fetchProfessionals();
     fetchSchedules();
     if (config.modules.locationSelection) fetchLocations();
-  }, []);
+  }, [activeUnitId]);
+  const seededDefault = useRef(false);
+  useEffect(() => {
+    if (seededDefault.current) return;
+    if (professionals.length === 0) return;
+    seededDefault.current = true;
+    if (selectedProfIds.length > 0) return;
+    if (professionals.length <= MAX_DEFAULT_AGENDAS) return;
+    setFilters({ professionalIds: professionals.slice(0, MAX_DEFAULT_AGENDAS).map((p) => p.id) });
+  }, [professionals]);
+  useEffect(() => {
+    seededDefault.current = false;
+  }, [activeUnitId]);
+  const [profSearch, setProfSearch] = useState("");
+  useEffect(() => {
+    if (!professionalsTruncated) return;
+    const term = profSearch.trim();
+    const timer = setTimeout(() => {
+      void fetchProfessionals(term ? { search: term } : void 0);
+    }, 250);
+    return () => clearTimeout(timer);
+  }, [profSearch, professionalsTruncated]);
   useEffect(() => {
     const api = calendarRef.current?.getApi();
     if (!api) return;
@@ -2813,15 +2880,19 @@ function CalendarView() {
       unsubscribe?.();
     };
   }, [provider2, refreshVisibleBookings]);
-  const resources = useMemo(() => {
-    const filtered = selectedProfIds.length > 0 ? professionals.filter((p) => selectedProfIds.includes(p.id)) : professionals;
-    return filtered.map((p) => ({
-      id: p.id,
-      title: p.name,
-      extendedProps: { avatarUrl: p.avatarUrl, locationName: p.locationName }
-    }));
-  }, [professionals, selectedProfIds]);
+  const drawnProfessionals = useMemo(() => selectedProfIds.length > 0 ? professionals.filter((p) => selectedProfIds.includes(p.id)) : professionals.slice(0, MAX_SELECTED_AGENDAS), [professionals, selectedProfIds]);
+  const resources = useMemo(() => drawnProfessionals.map((p) => ({
+    id: p.id,
+    title: p.name,
+    extendedProps: { avatarUrl: p.avatarUrl, locationName: p.locationName }
+  })), [drawnProfessionals]);
   const visibleResourceIds = useMemo(() => resources.map((resource) => resource.id), [resources]);
+  const gridMinWidth = useMemo(() => {
+    if (!currentView.startsWith("resource")) return void 0;
+    const daysInView = currentView.endsWith("Day") ? 1 : 7;
+    const columns = Math.max(1, resources.length) * daysInView;
+    return columns * MIN_COLUMN_PX + 64;
+  }, [currentView, resources.length]);
   const bookingEvents = useMemo(
     () => bookings.map((b) => bookingToEvent(b, statusColors, visibleResourceIds)),
     [bookings, statusColors, visibleResourceIds]
@@ -2837,8 +2908,8 @@ function CalendarView() {
     return allLocations;
   }, [config.modules.locationSelection, allLocations]);
   const availabilityEvents = useMemo(
-    () => generateAvailabilityEvents(schedules, professionals, visibleRange, effectiveBusinessHours, locationMap),
-    [schedules, professionals, visibleRange, effectiveBusinessHours, locationMap]
+    () => generateAvailabilityEvents(schedules, drawnProfessionals, visibleRange, effectiveBusinessHours, locationMap),
+    [schedules, drawnProfessionals, visibleRange, effectiveBusinessHours, locationMap]
   );
   const events = useMemo(() => [...bookingEvents, ...availabilityEvents], [bookingEvents, availabilityEvents]);
   const storedView = prefs.get("calendarView");
@@ -2994,8 +3065,15 @@ function CalendarView() {
     calendarRef.current?.getApi().gotoDate(date);
   }
   function toggleProfessional(id) {
-    const next = selectedProfIds.includes(id) ? selectedProfIds.filter((p) => p !== id) : [...selectedProfIds, id];
-    setFilters({ professionalIds: next });
+    if (selectedProfIds.includes(id)) {
+      setFilters({ professionalIds: selectedProfIds.filter((p) => p !== id) });
+      return;
+    }
+    if (selectedProfIds.length >= MAX_SELECTED_AGENDAS) {
+      toast.error(t2("agenda.sidebar.tooManyAgendas", { max: String(MAX_SELECTED_AGENDAS) }));
+      return;
+    }
+    setFilters({ professionalIds: [...selectedProfIds, id] });
   }
   function toggleStatus(value) {
     const next = selectedStatuses.includes(value) ? selectedStatuses.filter((s) => s !== value) : [...selectedStatuses, value];
@@ -3129,14 +3207,14 @@ function CalendarView() {
   const resourceLabelContent = useCallback((arg) => {
     const { id, title, extendedProps } = arg.resource;
     const initials = title.split(" ").map((n) => n[0]).join("").slice(0, 2);
-    return /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-2 px-2 py-1.5", children: [
+    return /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-2 px-2 py-1.5", title, children: [
       /* @__PURE__ */ jsx("div", { className: "flex h-6 w-6 shrink-0 items-center justify-center rounded-full bg-primary/10 text-[10px] font-bold text-primary", children: initials }),
       /* @__PURE__ */ jsxs("div", { className: "min-w-0", children: [
         /* @__PURE__ */ jsx(
           PersonLink,
           {
             personId: id,
-            name: title,
+            name: abbreviateName(title),
             size: "sm",
             tab: "schedule",
             profileHref: `#/registry/staff/${id}/schedule`
@@ -3163,7 +3241,7 @@ function CalendarView() {
       timeRange && /* @__PURE__ */ jsx("p", { className: "text-[9px] opacity-50", children: timeRange })
     ] });
   }, []);
-  return /* @__PURE__ */ jsxs("div", { className: "flex h-[calc(100vh-7.5rem)]", children: [
+  return /* @__PURE__ */ jsxs("div", { ref: shellRef, className: "flex", style: { height: shellHeight ?? void 0 }, children: [
     /* @__PURE__ */ jsxs("div", { className: "hidden md:flex w-[220px] shrink-0 flex-col overflow-y-auto py-4 px-3 mr-4", children: [
       /* @__PURE__ */ jsxs(
         "button",
@@ -3179,54 +3257,29 @@ function CalendarView() {
       /* @__PURE__ */ jsx(MiniCalendar, { selectedDate, onDateSelect: handleMiniDateSelect }),
       config.capabilities.professional && /* @__PURE__ */ jsxs(Fragment, { children: [
         /* @__PURE__ */ jsx("div", { className: "h-px bg-border my-4" }),
-        /* @__PURE__ */ jsxs(
-          "button",
+        /* @__PURE__ */ jsx(FilterSection, { title: t2("agenda.sidebar.agendas"), children: /* @__PURE__ */ jsx(
+          ProfessionalFilterList,
           {
-            onClick: () => setProfSectionOpen((p) => !p),
-            className: "flex items-center justify-between w-full text-xs font-medium text-muted-foreground hover:text-foreground py-1 transition-colors",
-            children: [
-              /* @__PURE__ */ jsx("span", { children: "Agendas" }),
-              /* @__PURE__ */ jsx(ChevronDown, { className: `h-3.5 w-3.5 transition-transform ${profSectionOpen ? "" : "-rotate-90"}` })
-            ]
+            names: professionals.map((p) => ({ id: p.id, label: p.name })),
+            selected: selectedProfIds,
+            onToggle: toggleProfessional,
+            search: profSearch,
+            onSearchChange: setProfSearch,
+            searchPlaceholder: t2("agenda.sidebar.searchAgendas"),
+            maxRows: MAX_PICKER_ROWS
           }
-        ),
-        profSectionOpen && /* @__PURE__ */ jsx("div", { className: "mt-1.5 space-y-0.5", children: professionals.map((prof) => {
-          const active = selectedProfIds.length === 0 || selectedProfIds.includes(prof.id);
-          return /* @__PURE__ */ jsxs("label", { className: "flex items-center gap-2.5 rounded px-1 py-1 cursor-pointer hover:bg-muted/50 transition-colors", children: [
-            /* @__PURE__ */ jsx("span", { className: `flex h-4 w-4 shrink-0 items-center justify-center rounded-sm border-2 transition-colors ${active ? "border-primary bg-primary" : "border-muted-foreground/30"}`, children: active && /* @__PURE__ */ jsx("svg", { className: "h-2.5 w-2.5 text-primary-foreground", viewBox: "0 0 12 12", fill: "none", children: /* @__PURE__ */ jsx("path", { d: "M2 6l3 3 5-5", stroke: "currentColor", strokeWidth: "2", strokeLinecap: "round", strokeLinejoin: "round" }) }) }),
-            /* @__PURE__ */ jsx("span", { className: `text-xs truncate ${active ? "text-foreground" : "text-muted-foreground"}`, children: prof.name }),
-            /* @__PURE__ */ jsx("input", { type: "checkbox", className: "sr-only", checked: active, onChange: () => toggleProfessional(prof.id) })
-          ] }, prof.id);
-        }) })
+        ) })
       ] }),
       config.capabilities.status && /* @__PURE__ */ jsxs(Fragment, { children: [
         /* @__PURE__ */ jsx("div", { className: "h-px bg-border my-4" }),
-        /* @__PURE__ */ jsxs(
-          "button",
+        /* @__PURE__ */ jsx(FilterSection, { title: t2("agenda.sidebar.status"), children: /* @__PURE__ */ jsx(
+          StatusFilterList,
           {
-            onClick: () => setStatusSectionOpen((p) => !p),
-            className: "flex items-center justify-between w-full text-xs font-medium text-muted-foreground hover:text-foreground py-1 transition-colors",
-            children: [
-              /* @__PURE__ */ jsx("span", { children: "Status" }),
-              /* @__PURE__ */ jsx(ChevronDown, { className: `h-3.5 w-3.5 transition-transform ${statusSectionOpen ? "" : "-rotate-90"}` })
-            ]
+            statuses: config.statuses,
+            selected: selectedStatuses,
+            onToggle: toggleStatus
           }
-        ),
-        statusSectionOpen && /* @__PURE__ */ jsx("div", { className: "mt-1.5 space-y-0.5", children: config.statuses.map((st) => {
-          const active = selectedStatuses.length === 0 || selectedStatuses.includes(st.value);
-          return /* @__PURE__ */ jsxs("label", { className: "flex items-center gap-2.5 rounded px-1 py-1 cursor-pointer hover:bg-muted/50 transition-colors", children: [
-            /* @__PURE__ */ jsx(
-              "span",
-              {
-                className: "flex h-4 w-4 shrink-0 items-center justify-center rounded-sm border-2 transition-colors",
-                style: { borderColor: active ? st.color : st.color + "40", backgroundColor: active ? st.color : "transparent" },
-                children: active && /* @__PURE__ */ jsx("svg", { className: "h-2.5 w-2.5 text-white", viewBox: "0 0 12 12", fill: "none", children: /* @__PURE__ */ jsx("path", { d: "M2 6l3 3 5-5", stroke: "currentColor", strokeWidth: "2", strokeLinecap: "round", strokeLinejoin: "round" }) })
-              }
-            ),
-            /* @__PURE__ */ jsx("span", { className: `text-xs ${active ? "text-foreground" : "text-muted-foreground"}`, children: st.label }),
-            /* @__PURE__ */ jsx("input", { type: "checkbox", className: "sr-only", checked: active, onChange: () => toggleStatus(st.value) })
-          ] }, st.value);
-        }) })
+        ) })
       ] })
     ] }),
     isMobile && /* @__PURE__ */ jsx(PageHeaderActions, { children: /* @__PURE__ */ jsx(
@@ -3256,7 +3309,7 @@ function CalendarView() {
         ]
       }
     ) }),
-    /* @__PURE__ */ jsxs("div", { className: "flex-1 flex flex-col min-w-0 overflow-hidden", children: [
+    /* @__PURE__ */ jsxs("div", { className: "flex-1 flex flex-col min-w-0 min-h-0 overflow-hidden", children: [
       /* @__PURE__ */ jsxs("div", { className: "shrink-0 border-b", children: [
         /* @__PURE__ */ jsxs("div", { className: `${mobileGridActive ? "flex" : "hidden"} md:flex h-12 items-center justify-between pl-4 pr-4`, children: [
           /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-3 min-w-0", children: [
@@ -3325,7 +3378,7 @@ function CalendarView() {
             onCreate: () => openModal("create")
           }
         )
-      ) : professionalsLoading && professionals.length === 0 ? /* @__PURE__ */ jsx(CalendarSkeleton, { profCount: 2 }) : /* @__PURE__ */ jsx("div", { ref: wrapperRef, className: "flex-1 overflow-hidden agenda-calendar", children: /* @__PURE__ */ jsx(
+      ) : professionalsLoading && professionals.length === 0 ? /* @__PURE__ */ jsx(CalendarSkeleton, { profCount: 2 }) : /* @__PURE__ */ jsx("div", { ref: wrapperRef, className: "min-h-0 min-w-0 flex-1 overflow-x-auto overflow-y-hidden agenda-calendar", children: /* @__PURE__ */ jsx("div", { className: "h-full", style: gridMinWidth ? { minWidth: gridMinWidth } : void 0, children: /* @__PURE__ */ jsx(
         FullCalendar,
         {
           ref: calendarRef,
@@ -3362,7 +3415,7 @@ function CalendarView() {
           eventTimeFormat: { hour: "2-digit", minute: "2-digit", hour12: false },
           slotLabelFormat: { hour: "2-digit", minute: "2-digit", hour12: false }
         }
-      ) })
+      ) }) })
     ] }),
     selectedBooking && popoverAnchor && popoverVisible && /* @__PURE__ */ jsx(
       AppointmentPopover,
@@ -3464,12 +3517,409 @@ function getAgendaTenantId() {
 function AgendaPage({ config, provider: provider2, store }) {
   const runtime = usePluginRuntimeOptional();
   const tenantId = runtime?.context.tenant?.id;
-  React13.useEffect(() => {
+  React11.useEffect(() => {
     setAgendaTenantId(tenantId);
     return () => setAgendaTenantId(void 0);
   }, [tenantId]);
   return /* @__PURE__ */ jsx(AgendaContextProvider, { config, provider: provider2, store, children: /* @__PURE__ */ jsx(CalendarView, {}) });
 }
+var brl = (n) => n.toLocaleString("pt-BR", { style: "currency", currency: "BRL" });
+function CheckinDialog({
+  booking,
+  statusLabel,
+  requirements = [],
+  onReceive,
+  onConfirm,
+  onClose,
+  formatCurrency: formatCurrency2 = brl
+}) {
+  const [busy, setBusy] = React11.useState(false);
+  const blocking = requirements.filter((r) => r.blocking);
+  const paid = booking.paymentStatus === "paid";
+  const hasBill = !!booking.paymentStatus && booking.paymentStatus !== "none";
+  const when = new Date(booking.startsAt).toLocaleString("pt-BR", {
+    weekday: "long",
+    day: "2-digit",
+    month: "2-digit",
+    hour: "2-digit",
+    minute: "2-digit"
+  });
+  return /* @__PURE__ */ jsx(
+    RightRailPage,
+    {
+      title: `Check-in \u2014 ${booking.clientName ?? "Sem cliente"}`,
+      open: true,
+      onClose,
+      width: "max-w-md",
+      children: /* @__PURE__ */ jsxs("div", { className: "space-y-3 px-4 py-3", children: [
+        /* @__PURE__ */ jsxs("p", { className: "truncate text-xs text-muted-foreground", children: [
+          when,
+          booking.professionalName ? ` \xB7 ${booking.professionalName}` : ""
+        ] }),
+        /* @__PURE__ */ jsxs("section", { className: "rounded-xl border px-3 py-2", children: [
+          /* @__PURE__ */ jsx("p", { className: "text-[10px] font-medium uppercase text-muted-foreground", children: "Agendamento" }),
+          /* @__PURE__ */ jsxs("div", { className: "mt-1 flex flex-wrap items-center gap-2 text-xs", children: [
+            /* @__PURE__ */ jsxs("span", { className: "inline-flex items-center gap-1", children: [
+              /* @__PURE__ */ jsx(Clock, { className: "h-3 w-3" }),
+              new Date(booking.startsAt).toLocaleTimeString("pt-BR", { hour: "2-digit", minute: "2-digit" })
+            ] }),
+            /* @__PURE__ */ jsx("span", { className: "rounded-full bg-muted px-2 py-0.5 font-medium", children: statusLabel }),
+            booking.services?.length ? /* @__PURE__ */ jsx("span", { className: "text-muted-foreground", children: booking.services.map((s) => s.name).join(", ") }) : /* @__PURE__ */ jsx("span", { className: "text-muted-foreground", children: "Servi\xE7o n\xE3o informado" })
+          ] })
+        ] }),
+        /* @__PURE__ */ jsxs("section", { className: "rounded-xl border px-3 py-2", children: [
+          /* @__PURE__ */ jsx("p", { className: "text-[10px] font-medium uppercase text-muted-foreground", children: "Cadastro do cliente" }),
+          requirements.length === 0 ? /* @__PURE__ */ jsxs("p", { className: "mt-1 inline-flex items-center gap-1.5 text-xs text-success", children: [
+            /* @__PURE__ */ jsx(CheckCircle2, { className: "h-3.5 w-3.5" }),
+            " Dados obrigat\xF3rios completos"
+          ] }) : /* @__PURE__ */ jsx("ul", { className: "mt-1 space-y-1", children: requirements.map((r) => /* @__PURE__ */ jsxs("li", { className: "flex items-start gap-1.5 text-xs", children: [
+            /* @__PURE__ */ jsx(CircleAlert, { className: `mt-0.5 h-3.5 w-3.5 shrink-0 ${r.blocking ? "text-destructive" : "text-warning"}` }),
+            /* @__PURE__ */ jsxs("span", { children: [
+              /* @__PURE__ */ jsx("span", { className: "font-medium", children: r.label }),
+              /* @__PURE__ */ jsxs("span", { className: "text-muted-foreground", children: [
+                " \u2014 ",
+                r.detail
+              ] })
+            ] })
+          ] }, r.label)) })
+        ] }),
+        /* @__PURE__ */ jsxs("section", { className: "rounded-xl border px-3 py-2", children: [
+          /* @__PURE__ */ jsx("p", { className: "text-[10px] font-medium uppercase text-muted-foreground", children: "Pagamento" }),
+          /* @__PURE__ */ jsxs("div", { className: "mt-1 flex items-center justify-between gap-2", children: [
+            /* @__PURE__ */ jsx("p", { className: "text-xs text-muted-foreground", children: paid ? "Este atendimento j\xE1 est\xE1 pago." : hasBill ? `Em aberto${booking.orderTotal ? ` \xB7 ${formatCurrency2(booking.orderTotal)}` : ""}.` : "Nenhuma fatura vinculada a este agendamento." }),
+            onReceive && !paid && /* @__PURE__ */ jsxs(
+              "button",
+              {
+                onClick: () => onReceive(booking),
+                className: "inline-flex shrink-0 items-center gap-1.5 rounded-button border border-input px-3 py-1.5 text-xs font-medium hover:bg-muted",
+                children: [
+                  /* @__PURE__ */ jsx(CircleDollarSign, { className: "h-3.5 w-3.5" }),
+                  " Receber"
+                ]
+              }
+            )
+          ] })
+        ] }),
+        /* @__PURE__ */ jsxs("div", { className: "flex items-center justify-between gap-2 border-t pt-3", children: [
+          /* @__PURE__ */ jsx("p", { className: "text-[11px] text-muted-foreground", children: blocking.length ? `Falta ${blocking.map((r) => r.label).join(", ")}.` : "" }),
+          /* @__PURE__ */ jsxs(
+            "button",
+            {
+              disabled: busy || blocking.length > 0,
+              onClick: async () => {
+                setBusy(true);
+                try {
+                  await onConfirm(booking);
+                } finally {
+                  setBusy(false);
+                }
+              },
+              className: "inline-flex shrink-0 items-center gap-1.5 rounded-button bg-primary border border-primary px-4 py-1.5 text-xs font-medium text-primary-foreground hover:bg-primary/90 disabled:opacity-50",
+              children: [
+                /* @__PURE__ */ jsx(User, { className: "h-3.5 w-3.5" }),
+                " ",
+                busy ? "Concluindo\u2026" : "Concluir check-in"
+              ]
+            }
+          )
+        ] })
+      ] })
+    }
+  );
+}
+function PaymentStatusBadge(props) {
+  const t2 = useTranslation();
+  const labels = React11.useMemo(() => ({
+    none: t2("agenda.payment.title"),
+    pending: t2("agenda.payment.pending"),
+    partial: t2("agenda.payment.partial"),
+    paid: t2("agenda.payment.paid"),
+    overdue: t2("agenda.payment.overdue"),
+    cancelled: t2("agenda.payment.cancelled")
+  }), [t2]);
+  return /* @__PURE__ */ jsx(PaymentStatusBadge$1, { ...props, labels });
+}
+var CHECKIN_STATUSES = ["scheduled", "confirmed", "waiting", "in_progress"];
+var STATUS_TONE = {
+  scheduled: "bg-muted text-muted-foreground",
+  confirmed: "bg-primary/10 text-primary",
+  waiting: "bg-warning/15 text-warning-foreground",
+  in_progress: "bg-success/15 text-success"
+};
+var PAYMENT_TEXT = {
+  paid: { label: "Pago", tone: "text-success" },
+  partial: { label: "Parcial", tone: "text-warning" },
+  pending: { label: "Em aberto", tone: "text-destructive" },
+  overdue: { label: "Vencido", tone: "text-destructive" }
+};
+function todayRange() {
+  const start = /* @__PURE__ */ new Date();
+  start.setHours(0, 0, 0, 0);
+  const end = /* @__PURE__ */ new Date();
+  end.setHours(23, 59, 59, 999);
+  return { start: start.toISOString(), end: end.toISOString() };
+}
+function waitedFor(iso) {
+  const min = Math.floor((Date.now() - new Date(iso).getTime()) / 6e4);
+  if (min < 1) return "agora mesmo";
+  if (min < 60) return `h\xE1 ${min} min`;
+  const h = Math.floor(min / 60);
+  return `h\xE1 ${h}h${min % 60 ? ` ${min % 60}min` : ""}`;
+}
+function hourOf(iso) {
+  return new Date(iso).toLocaleTimeString("pt-BR", { hour: "2-digit", minute: "2-digit" });
+}
+function CheckinView({ onReceive, onOpenBooking }) {
+  const config = useAgendaConfig();
+  const statusLabel = (v) => config.statuses.find((x) => x.value === v)?.label ?? v;
+  const checkinStatuses = React11.useMemo(
+    () => CHECKIN_STATUSES.map((v) => config.statuses.find((x) => x.value === v)).filter((x) => !!x),
+    [config.statuses]
+  );
+  const bookings = useAgendaStore((s) => s.bookings);
+  const loading = useAgendaStore((s) => s.bookingsLoading);
+  const fetchBookings = useAgendaStore((s) => s.fetchBookings);
+  const updateBookingStatus = useAgendaStore((s) => s.updateBookingStatus);
+  const [term, setTerm] = React11.useState("");
+  const [busyId, setBusyId] = React11.useState(null);
+  const [panel, setPanel] = React11.useState(null);
+  const reviewing = panel?.kind === "review" ? panel.booking : null;
+  const editing = panel?.kind === "edit" ? panel.booking : null;
+  const charging = panel?.kind === "charge" ? panel.booking : null;
+  const setReviewing = (b) => setPanel(b ? { kind: "review", booking: b } : null);
+  const setEditing = (b) => setPanel(b ? { kind: "edit", booking: b } : null);
+  const setCharging = (b) => setPanel(b ? { kind: "charge", booking: b } : null);
+  const can = usePermissionOptional();
+  const canReceive = can("financial", "create") || can("financial.receivables", "create");
+  React11.useEffect(() => {
+    void fetchBookings(todayRange(), [...CHECKIN_STATUSES]);
+  }, [fetchBookings]);
+  const [shownStatuses, setShownStatuses] = React11.useState([]);
+  const [shownPros, setShownPros] = React11.useState([]);
+  const prosToday = React11.useMemo(() => {
+    const seen = /* @__PURE__ */ new Map();
+    for (const b of bookings) if (b.professionalName) seen.set(b.professionalName, b.professionalName);
+    return [...seen.keys()].sort();
+  }, [bookings]);
+  const cards = React11.useMemo(() => {
+    const q = term.trim().toLowerCase();
+    return bookings.filter((b) => !shownStatuses.length || shownStatuses.includes(b.status)).filter((b) => !shownPros.length || b.professionalName && shownPros.includes(b.professionalName)).filter((b) => !q || (b.clientName ?? "").toLowerCase().includes(q) || (b.professionalName ?? "").toLowerCase().includes(q)).sort((a, b) => a.startsAt.localeCompare(b.startsAt));
+  }, [bookings, term, shownStatuses, shownPros]);
+  const waiting = cards.filter((b) => b.status === "waiting").length;
+  function requirementsFor(b) {
+    const out = [];
+    if (!b.clientName) out.push({ label: "Cliente", detail: "o agendamento n\xE3o nomeia ningu\xE9m", blocking: true });
+    if (!b.professionalName) out.push({ label: "Profissional", detail: "ningu\xE9m para executar" });
+    if (!b.services?.length) out.push({ label: "Servi\xE7o", detail: "nada a executar nem a cobrar" });
+    return out;
+  }
+  const money = (n) => n.toLocaleString("pt-BR", { style: "currency", currency: "BRL" });
+  async function loadPaymentLines(orderId) {
+    const detail = await config.financialBridge?.getPaymentDetail(orderId);
+    return (detail?.movements ?? []).filter((m) => m.paymentDate).map((m) => ({
+      label: [m.paymentMethodTypeName, m.cardBrand, m.cardInstallments && m.cardInstallments > 1 ? `${m.cardInstallments}x` : null].filter(Boolean).join(" \xB7 ") || "Pagamento",
+      date: m.paymentDate ?? null,
+      amount: m.paidAmount
+    }));
+  }
+  async function confirmCheckin(b) {
+    setBusyId(b.id);
+    try {
+      await updateBookingStatus(b.id, "waiting");
+      await fetchBookings(todayRange(), [...CHECKIN_STATUSES]);
+      setReviewing(null);
+    } finally {
+      setBusyId(null);
+    }
+  }
+  return /* @__PURE__ */ jsxs("div", { className: "space-y-4", children: [
+    /* @__PURE__ */ jsx(
+      SubpageHeader,
+      {
+        title: "Check-in",
+        subtitle: `Quem chega hoje${waiting ? ` \xB7 ${waiting} aguardando` : ""}`
+      }
+    ),
+    /* @__PURE__ */ jsxs("div", { className: "grid gap-4 lg:grid-cols-[248px_1fr]", children: [
+      /* @__PURE__ */ jsxs("aside", { className: "space-y-6 lg:sticky lg:top-4 lg:self-start", children: [
+        /* @__PURE__ */ jsxs("div", { className: "relative", children: [
+          /* @__PURE__ */ jsx(Search, { className: "absolute left-2.5 top-1/2 h-4 w-4 -translate-y-1/2 text-muted-foreground", "aria-hidden": true }),
+          /* @__PURE__ */ jsx(
+            "input",
+            {
+              value: term,
+              onChange: (e) => setTerm(e.target.value),
+              placeholder: "Buscar cliente ou profissional",
+              className: "w-full rounded-input border border-input bg-card py-2 pl-8 pr-3 text-sm placeholder:text-muted-foreground focus:outline-none focus:ring-2 focus:ring-ring"
+            }
+          )
+        ] }),
+        /* @__PURE__ */ jsx("div", { children: /* @__PURE__ */ jsxs(FilterSection, { title: "Agendas", children: [
+          loading && prosToday.length === 0 && [0, 1, 2].map((i) => /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-2.5 px-1 py-1", children: [
+            /* @__PURE__ */ jsx("div", { className: "h-4 w-4 animate-pulse rounded-sm bg-muted" }),
+            /* @__PURE__ */ jsx("div", { className: "h-3.5 w-24 animate-pulse rounded bg-muted/70" })
+          ] }, i)),
+          /* @__PURE__ */ jsx(
+            ProfessionalFilterList,
+            {
+              names: prosToday.map((name) => ({ id: name, label: name })),
+              selected: shownPros,
+              onToggle: (name) => setShownPros((cur) => cur.includes(name) ? cur.filter((x) => x !== name) : [...cur, name])
+            }
+          )
+        ] }) }),
+        /* @__PURE__ */ jsx("div", { children: /* @__PURE__ */ jsx(FilterSection, { title: "Status", children: /* @__PURE__ */ jsx(
+          StatusFilterList,
+          {
+            statuses: checkinStatuses,
+            selected: shownStatuses,
+            onToggle: (value) => setShownStatuses((cur) => cur.includes(value) ? cur.filter((x) => x !== value) : [...cur, value])
+          }
+        ) }) }),
+        /* @__PURE__ */ jsxs("p", { className: "px-2 text-xs tabular-nums text-muted-foreground", children: [
+          cards.length,
+          " de ",
+          bookings.length
+        ] })
+      ] }),
+      /* @__PURE__ */ jsx("div", { className: "min-w-0 space-y-2", children: loading && cards.length === 0 ? (
+        /* Esqueleto com a FORMA da linha: a fila não salta quando os dados
+           chegam, e a recepção já sabe onde olhar antes de haver o que ler. */
+        /* @__PURE__ */ jsx("ul", { className: "space-y-2", "aria-busy": "true", "aria-label": "Carregando a fila de hoje", children: [0, 1, 2, 3].map((i) => /* @__PURE__ */ jsxs("li", { className: "flex items-center gap-3 rounded-2xl border border-border bg-card px-4 py-3", children: [
+          /* @__PURE__ */ jsx("div", { className: "h-4 w-12 animate-pulse rounded bg-muted" }),
+          /* @__PURE__ */ jsxs("div", { className: "min-w-0 flex-1 space-y-1.5", children: [
+            /* @__PURE__ */ jsx("div", { className: "h-3.5 w-40 animate-pulse rounded bg-muted" }),
+            /* @__PURE__ */ jsx("div", { className: "h-3 w-24 animate-pulse rounded bg-muted/70" })
+          ] }),
+          /* @__PURE__ */ jsx("div", { className: "h-4 w-16 animate-pulse rounded bg-muted" }),
+          /* @__PURE__ */ jsx("div", { className: "h-6 w-20 animate-pulse rounded-full bg-muted" }),
+          /* @__PURE__ */ jsx("div", { className: "h-7 w-24 animate-pulse rounded-button bg-muted" })
+        ] }, i)) })
+      ) : cards.length === 0 ? /* @__PURE__ */ jsxs("div", { className: "rounded-2xl border-2 border-dashed border-muted px-6 py-12 text-center", children: [
+        /* @__PURE__ */ jsx("div", { className: "mx-auto mb-3 flex h-12 w-12 items-center justify-center rounded-xl bg-muted text-muted-foreground", children: /* @__PURE__ */ jsx(LogIn, { className: "h-6 w-6" }) }),
+        /* @__PURE__ */ jsx("p", { className: "text-sm font-medium", children: "Ningu\xE9m na fila" }),
+        /* @__PURE__ */ jsx("p", { className: "mt-1 text-xs text-muted-foreground", children: term ? "Nenhum atendimento de hoje casa com a busca." : "N\xE3o h\xE1 atendimentos para hoje." })
+      ] }) : /* @__PURE__ */ jsx("ul", { className: "space-y-2", children: cards.map((b) => {
+        b.paymentStatus ? PAYMENT_TEXT[b.paymentStatus] : void 0;
+        const arrived = b.status === "waiting" || b.status === "in_progress";
+        return /* @__PURE__ */ jsxs(
+          "li",
+          {
+            className: "flex flex-wrap items-center gap-3 rounded-2xl border border-border bg-card px-4 py-3",
+            children: [
+              /* @__PURE__ */ jsxs("div", { className: "flex w-16 shrink-0 flex-col items-start gap-1", children: [
+                /* @__PURE__ */ jsx("span", { className: "text-sm font-semibold tabular-nums", children: hourOf(b.startsAt) }),
+                /* @__PURE__ */ jsx("span", { className: `rounded-full px-1.5 py-0.5 text-[10px] font-medium ${STATUS_TONE[b.status] ?? ""}`, children: statusLabel(b.status) })
+              ] }),
+              /* @__PURE__ */ jsxs("div", { className: "min-w-0 flex-1", children: [
+                /* @__PURE__ */ jsx("p", { className: "truncate text-sm font-medium", children: b.clientId ? /* @__PURE__ */ jsx(PersonLink, { personId: b.clientId, name: b.clientName ?? "Sem cliente", kind: "customer" }) : b.clientName ?? "Sem cliente" }),
+                /* @__PURE__ */ jsxs("p", { className: "flex items-center gap-1 truncate text-xs text-muted-foreground", children: [
+                  /* @__PURE__ */ jsx(User, { className: "h-3 w-3", "aria-hidden": true }),
+                  b.professionalName ?? "Sem profissional",
+                  arrived && b.checkedInAt && /* @__PURE__ */ jsxs("span", { className: "ml-1 inline-flex items-center gap-0.5 text-warning", children: [
+                    /* @__PURE__ */ jsx(Clock, { className: "h-3 w-3", "aria-hidden": true }),
+                    waitedFor(b.checkedInAt)
+                  ] })
+                ] })
+              ] }),
+              b.orderTotal != null && b.orderTotal > 0 && /* @__PURE__ */ jsx(
+                PaymentStatusBadge,
+                {
+                  status: b.paymentStatus ?? "none",
+                  totalAmount: b.orderTotal,
+                  formatCurrency: money,
+                  compact: true,
+                  onLoadDetails: b.orderId ? () => loadPaymentLines(b.orderId) : void 0,
+                  onReceive: canReceive ? () => setCharging(b) : void 0,
+                  onOpenDetails: () => setCharging(b)
+                }
+              ),
+              /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-2", children: [
+                /* @__PURE__ */ jsx(
+                  "button",
+                  {
+                    type: "button",
+                    onClick: () => onOpenBooking ? onOpenBooking(b) : setEditing(b),
+                    title: "Abrir agendamento",
+                    "aria-label": "Abrir agendamento",
+                    className: "inline-flex items-center justify-center rounded-button border border-input p-1.5 hover:bg-muted",
+                    children: /* @__PURE__ */ jsx(CalendarDays, { className: "h-3.5 w-3.5", "aria-hidden": true })
+                  }
+                ),
+                /* @__PURE__ */ jsxs(
+                  "button",
+                  {
+                    type: "button",
+                    disabled: arrived || busyId === b.id,
+                    onClick: () => setReviewing(b),
+                    className: "inline-flex items-center gap-1.5 rounded-button bg-foreground px-3 py-1.5 text-xs font-semibold text-background disabled:opacity-40",
+                    children: [
+                      arrived ? /* @__PURE__ */ jsx(CheckCircle2, { className: "h-3.5 w-3.5", "aria-hidden": true }) : /* @__PURE__ */ jsx(LogIn, { className: "h-3.5 w-3.5", "aria-hidden": true }),
+                      arrived ? "Chegou" : "Check-in"
+                    ]
+                  }
+                )
+              ] })
+            ]
+          },
+          b.id
+        );
+      }) }) })
+    ] }),
+    reviewing && /* @__PURE__ */ jsx(
+      CheckinDialog,
+      {
+        booking: reviewing,
+        statusLabel: statusLabel(reviewing.status),
+        requirements: requirementsFor(reviewing),
+        onReceive: canReceive ? (b) => {
+          setReviewing(null);
+          setCharging(b);
+        } : void 0,
+        onConfirm: confirmCheckin,
+        onClose: () => setReviewing(null)
+      }
+    ),
+    editing && /* @__PURE__ */ jsx(
+      AppointmentModal,
+      {
+        open: true,
+        mode: "edit",
+        bookingId: editing.id,
+        onClose: () => {
+          setEditing(null);
+          void fetchBookings(todayRange(), [...CHECKIN_STATUSES]);
+        }
+      }
+    ),
+    charging?.clientId && /* @__PURE__ */ jsx(
+      ClientAccountModal,
+      {
+        personId: charging.clientId,
+        orderId: charging.orderId,
+        clientName: charging.clientName,
+        onGenerate: async () => {
+          if (onReceive) await onReceive(charging);
+          await fetchBookings(todayRange(), [...CHECKIN_STATUSES]);
+        },
+        onClose: () => {
+          setCharging(null);
+          void fetchBookings(todayRange(), [...CHECKIN_STATUSES]);
+        }
+      }
+    )
+  ] });
+}
+function CheckinPage({ config, provider: provider2, store, onReceive, onOpenBooking }) {
+  const runtime = usePluginRuntimeOptional();
+  const tenantId = runtime?.context.tenant?.id;
+  React11.useEffect(() => {
+    setAgendaTenantId(tenantId);
+    return () => setAgendaTenantId(void 0);
+  }, [tenantId]);
+  return /* @__PURE__ */ jsx(AgendaContextProvider, { config, provider: provider2, store, children: /* @__PURE__ */ jsx(CheckinView, { onReceive, onOpenBooking }) });
+}
+var PEOPLE_UNITS_VIEW = "v_bookable_people";
 function getTenantId() {
   return getAgendaTenantId() ?? getActiveTenantId();
 }
@@ -3541,9 +3991,12 @@ async function hydrateCanonicalBookings(core, bookings) {
     { data: items, error: itemsError }
   ] = await Promise.all([
     personIds.length ? core.from("people").select("id, name, phone, email, avatar_url").in("id", personIds) : Promise.resolve({ data: [], error: null }),
-    locationIds.length ? core.from("locations").select("id, name").in("id", locationIds) : Promise.resolve({ data: [], error: null }),
-    orderIds.length ? core.from("orders").select("id, total, status").in("id", orderIds) : Promise.resolve({ data: [], error: null }),
-    orderIds.length ? core.from("order_items").select("id, order_id, service_id, name, duration_minutes, unit_price, assignee_id, sort_order").in("order_id", orderIds) : Promise.resolve({ data: [], error: null })
+    locationIds.length ? core.from("v_units").select("id, name").in("id", locationIds) : Promise.resolve({ data: [], error: null }),
+    // The core's read model, not the table: public.orders belongs to the core,
+    // and v_orders is what it publishes (spine 184). It also carries the DERIVED
+    // fulfilment state, which the table never had.
+    orderIds.length ? core.from("v_orders").select("id, total, status, fulfillment_status").in("id", orderIds) : Promise.resolve({ data: [], error: null }),
+    orderIds.length ? core.from("items").select("id, order_id, product_id, name, duration_minutes, unit_price, assignee_id, sort_order").in("order_id", orderIds) : Promise.resolve({ data: [], error: null })
   ]);
   if (personsError) throw personsError;
   if (locationsError) throw locationsError;
@@ -3560,7 +4013,7 @@ async function hydrateCanonicalBookings(core, bookings) {
     const order = booking.order_id ? ordersById.get(booking.order_id) : null;
     const bookingItems = ((booking.order_id ? itemsByOrderId.get(booking.order_id) : null) ?? []).sort((a, b) => (a.sort_order ?? 0) - (b.sort_order ?? 0)).map((item) => ({
       id: item.id,
-      serviceId: item.service_id,
+      serviceId: item.product_id,
       name: item.name,
       durationMinutes: item.duration_minutes,
       price: item.unit_price,
@@ -3594,13 +4047,14 @@ async function hydrateCanonicalBookings(core, bookings) {
       orderStatus: order?.status ?? null,
       services: bookingItems.length ? bookingItems : null,
       totalDurationMinutes: itemDuration || getDurationMinutes(booking.starts_at, booking.ends_at),
+      checkedInAt: booking.checked_in_at ?? null,
       createdAt: booking.created_at,
       updatedAt: booking.updated_at
     };
   });
 }
 async function getCanonicalBookings(core, query) {
-  let q = core.from("appointments").select("id, tenant_id, kind, starts_at, ends_at, status, notes, order_id, location_id, metadata, party_id, assignee_id, created_at, updated_at").gte("starts_at", query.dateRange.start).lte("starts_at", query.dateRange.end);
+  let q = core.from("appointments").select("id, tenant_id, kind, starts_at, ends_at, status, notes, order_id, location_id, metadata, party_id, assignee_id, checked_in_at, created_at, updated_at").gte("starts_at", query.dateRange.start).lte("starts_at", query.dateRange.end);
   if (query.kind) q = q.eq("kind", query.kind);
   if (query.statuses?.length) q = q.in("status", query.statuses);
   if (query.professionalIds?.length) q = q.in("assignee_id", query.professionalIds);
@@ -3610,7 +4064,7 @@ async function getCanonicalBookings(core, query) {
   return hydrateCanonicalBookings(core, data ?? []);
 }
 async function getCanonicalBookingById(core, id) {
-  const columns = "id, tenant_id, kind, starts_at, ends_at, status, notes, order_id, location_id, metadata, party_id, assignee_id, created_at, updated_at";
+  const columns = "id, tenant_id, kind, starts_at, ends_at, status, notes, order_id, location_id, metadata, party_id, assignee_id, checked_in_at, created_at, updated_at";
   let { data, error } = await core.from("appointments").select(columns).eq("id", id).maybeSingle();
   if (error) throw error;
   if (!data) {
@@ -3657,11 +4111,11 @@ function createSupabaseAgendaProvider(providerOptions) {
       if (data) {
         const booking = mapBooking(data);
         if (booking.orderId) {
-          const { data: items } = await core.from("order_items").select("id, service_id, name, duration_minutes, unit_price, assignee_id, sort_order").eq("order_id", booking.orderId).order("sort_order", { ascending: true });
+          const { data: items } = await core.from("items").select("id, service_id, name, duration_minutes, unit_price, assignee_id, sort_order").eq("order_id", booking.orderId).order("sort_order", { ascending: true });
           if (items && items.length) {
             const services = items.map((item) => ({
               id: item.id,
-              serviceId: item.service_id,
+              serviceId: item.product_id,
               name: item.name,
               durationMinutes: item.duration_minutes,
               price: item.unit_price,
@@ -3682,7 +4136,7 @@ function createSupabaseAgendaProvider(providerOptions) {
       if (!tenantId) throw new Error("No active tenant");
       const hasServices = input.services.length > 0;
       const totalDuration = input.services.reduce((sum, s) => sum + s.durationMinutes, 0);
-      const totalPrice = input.services.reduce((sum, s) => sum + s.price, 0);
+      input.services.reduce((sum, s) => sum + s.price, 0);
       const endsAt = addMinutes(input.startsAt, totalDuration || 30);
       const serviceNames = input.services.map((s) => s.name).join(", ");
       let contactName;
@@ -3691,58 +4145,33 @@ function createSupabaseAgendaProvider(providerOptions) {
         contactName = person?.name;
       }
       const eventTitle = input.title?.trim() || void 0;
-      const { data: order, error: orderErr } = await core.from("orders").insert({
-        tenant_id: tenantId,
-        kind: input.kind ?? "appointment",
-        status: "scheduled",
-        party_id: input.clientId || null,
-        assignee_id: input.professionalId || null,
-        location_id: input.locationId ?? null,
-        subtotal: totalPrice,
-        total: totalPrice,
-        notes: input.notes ?? null,
-        metadata: {
-          source: "agenda",
-          ...serviceNames ? { serviceNames, itemsSummary: serviceNames } : {},
-          ...contactName ? { contactName } : {},
-          ...eventTitle ? { title: eventTitle } : {}
-        }
-      }).select("id").single();
-      if (orderErr) throw orderErr;
-      const { data: booking, error: bookingErr } = await core.from("appointments").insert({
-        tenant_id: tenantId,
-        kind: input.kind ?? "appointment",
-        party_id: input.clientId || null,
-        assignee_id: input.professionalId || null,
-        location_id: input.locationId ?? null,
-        order_id: order.id,
-        starts_at: input.startsAt,
-        ends_at: endsAt,
-        status: "scheduled",
-        notes: input.notes ?? null,
-        metadata: {
-          source: "agenda",
-          ...serviceNames ? { serviceNames, itemsSummary: serviceNames } : {},
-          ...contactName ? { contactName } : {},
-          ...eventTitle ? { title: eventTitle } : {}
-        }
-      }).select("id").single();
-      if (bookingErr) throw bookingErr;
-      if (hasServices) {
-        const orderItems = input.services.map((s, i) => ({
-          order_id: order.id,
+      const metadata = {
+        source: "agenda",
+        ...serviceNames ? { serviceNames, itemsSummary: serviceNames } : {},
+        ...contactName ? { contactName } : {},
+        ...eventTitle ? { title: eventTitle } : {}
+      };
+      const { data: created, error: rpcErr } = await core.rpc("agenda_booking_create", {
+        p_starts_at: input.startsAt,
+        p_ends_at: endsAt,
+        p_lines: hasServices ? input.services.map((s, i) => ({
           service_id: s.serviceId,
           name: s.name,
           quantity: 1,
           unit_price: s.price,
-          total: s.price,
           sort_order: i,
           duration_minutes: s.durationMinutes,
           assignee_id: s.assigneeId || input.professionalId || null
-        }));
-        const { error: oiErr } = await core.from("order_items").insert(orderItems);
-        if (oiErr) throw oiErr;
-      }
+        })) : [],
+        p_party_id: input.clientId || null,
+        p_assignee_id: input.professionalId || null,
+        p_location_id: input.locationId ?? null,
+        p_kind: input.kind ?? "appointment",
+        p_notes: input.notes ?? null,
+        p_metadata: metadata
+      });
+      if (rpcErr) throw rpcErr;
+      const booking = { id: created.appointment_id };
       const createdBooking = await this.getBookingById(booking.id);
       if (!createdBooking) throw new Error("Created booking did not resolve from agenda read model");
       return createdBooking;
@@ -3793,7 +4222,7 @@ function createSupabaseAgendaProvider(providerOptions) {
           if (orderErr) throw orderErr;
         }
         if (data.services) {
-          await core.from("order_items").delete().eq("order_id", orderId);
+          await core.from("items").delete().eq("order_id", orderId);
           if (data.services.length > 0) {
             const items = data.services.map((svc, idx) => ({
               order_id: orderId,
@@ -3806,7 +4235,7 @@ function createSupabaseAgendaProvider(providerOptions) {
               duration_minutes: svc.durationMinutes,
               assignee_id: svc.assigneeId ?? effectiveAssigneeId
             }));
-            const { error: itemErr } = await core.from("order_items").insert(items);
+            const { error: itemErr } = await core.from("items").insert(items);
             if (itemErr) throw itemErr;
           }
         }
@@ -3898,12 +4327,22 @@ function createSupabaseAgendaProvider(providerOptions) {
       const { error } = await core.from("schedules").delete().eq("id", id);
       if (error) throw error;
     },
-    async getProfessionals() {
+    async getProfessionals(query) {
       const { core } = getClients();
-      const base = () => core.from("people").select("id, name, avatar_url, is_active").eq("kind", professionalKind).eq("is_active", true);
+      const unitId = query?.unitId ?? getActiveUnitId();
+      const base = () => {
+        let qb = core.from(PEOPLE_UNITS_VIEW).select("id, name, avatar_url, is_active, unit_ids").eq("kind", professionalKind).eq("is_active", true);
+        if (unitId) qb = qb.or(`unit_ids.is.null,unit_ids.cs.{${unitId}}`);
+        if (query?.search) qb = qb.ilike("name", `%${query.search}%`);
+        if (query?.limit) qb = qb.limit(query.limit);
+        return qb;
+      };
       let { data, error } = await base().eq("is_bookable", true).order("name");
-      if (error && error.code === "42703") {
-        ({ data, error } = await base().order("name"));
+      if (error && (error.code === "42703" || error.code === "42P01")) {
+        let qb = core.from("people").select("id, name, avatar_url, is_active").eq("kind", professionalKind).eq("is_active", true);
+        if (query?.search) qb = qb.ilike("name", `%${query.search}%`);
+        if (query?.limit) qb = qb.limit(query.limit);
+        ({ data, error } = await qb.order("name"));
       }
       if (error) throw error;
       return (data ?? []).map((p) => ({
@@ -3917,9 +4356,12 @@ function createSupabaseAgendaProvider(providerOptions) {
     },
     async getLocations() {
       const { core } = getClients();
-      const { data, error } = await core.from("locations").select("id, name").eq("is_active", true).order("name");
+      const unitId = getActiveUnitId();
+      let qb = core.from("v_units").select("id, name, kind").eq("is_active", true);
+      if (unitId) qb = qb.eq("id", unitId);
+      const { data, error } = await qb.order("name");
       if (error) throw error;
-      return (data ?? []).map((l) => ({ id: l.id, name: l.name }));
+      return (data ?? []).filter((l) => l.kind !== "region").map((l) => ({ id: l.id, name: l.name }));
     },
     async getConfirmationsPending(daysAhead = 2) {
       const { pub } = getClients();
@@ -3984,6 +4426,7 @@ function emitBookingEvent(key, booking) {
 }
 
 // src/store.ts
+var PROFESSIONAL_LIMIT = 200;
 function getCurrentBookingQuery(state, dateRange = state.dateRange) {
   return {
     dateRange,
@@ -4001,6 +4444,7 @@ function createAgendaStore(provider2, financialBridge) {
     selectedDate: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10),
     professionals: [],
     professionalsLoading: false,
+    professionalsTruncated: false,
     selectedProfessionalIds: [],
     selectedLocationId: null,
     selectedStatuses: ["scheduled", "confirmed", "in_progress", "completed"],
@@ -4010,21 +4454,21 @@ function createAgendaStore(provider2, financialBridge) {
     pendingConfirmations: [],
     confirmationsLoading: false,
     appointmentModal: { open: false, mode: "create" },
-    async fetchBookings(range) {
-      const key = `agenda:bookings:${range.start}:${range.end}`;
+    async fetchBookings(range, statuses) {
+      const key = `agenda:bookings:${range.start}:${range.end}:${statuses?.join(",") ?? ""}`;
       return dedup(key, async () => {
         set({ bookingsLoading: true, dateRange: range });
         const state = get();
-        const query = getCurrentBookingQuery(state, range);
+        const query = statuses?.length ? { ...getCurrentBookingQuery(state, range), statuses } : getCurrentBookingQuery(state, range);
         let bookings = await provider2.getBookings(query);
         if (financialBridge) {
           const orderIds = bookings.map((b) => b.orderId).filter((id) => !!id);
           if (orderIds.length > 0) {
             try {
-              const statuses = await financialBridge.resolvePaymentStatuses(orderIds);
+              const statuses2 = await financialBridge.resolvePaymentStatuses(orderIds);
               bookings = bookings.map((b) => {
                 if (!b.orderId) return b;
-                const summary = statuses.get(b.orderId);
+                const summary = statuses2.get(b.orderId);
                 return summary ? { ...b, paymentStatus: summary.status } : b;
               });
             } catch {
@@ -4034,11 +4478,17 @@ function createAgendaStore(provider2, financialBridge) {
         set({ bookings, bookingsLoading: false });
       });
     },
-    async fetchProfessionals() {
-      return dedup("agenda:professionals", async () => {
+    async fetchProfessionals(query) {
+      const limit = query?.limit ?? PROFESSIONAL_LIMIT;
+      const effective = { ...query, limit };
+      return dedup("agenda:professionals:" + JSON.stringify(effective), async () => {
         set({ professionalsLoading: true });
-        const professionals = await provider2.getProfessionals();
-        set({ professionals, professionalsLoading: false });
+        const professionals = await provider2.getProfessionals(effective);
+        set({
+          professionals,
+          professionalsTruncated: professionals.length >= limit,
+          professionalsLoading: false
+        });
       });
     },
     async fetchLocations() {
@@ -4461,6 +4911,8 @@ var en = {
   "agenda.settings.workingHours": "Working Hours",
   "agenda.settings.workingHoursDesc": "Working hours and availability",
   "agenda.sidebar.agendas": "Agendas",
+  "agenda.sidebar.searchAgendas": "Find an agenda",
+  "agenda.sidebar.tooManyAgendas": "Up to {max} agendas at a time \u2014 uncheck one to add another.",
   "agenda.sidebar.allLocations": "All locations",
   "agenda.sidebar.create": "Create",
   "agenda.sidebar.location": "Location",
@@ -4683,6 +5135,8 @@ var ptBR = {
   "agenda.settings.workingHours": "Hor\xE1rio de Funcionamento",
   "agenda.settings.workingHoursDesc": "Hor\xE1rios e disponibilidade",
   "agenda.sidebar.agendas": "Agendas",
+  "agenda.sidebar.searchAgendas": "Buscar agenda",
+  "agenda.sidebar.tooManyAgendas": "At\xE9 {max} agendas por vez \u2014 desmarque uma para incluir outra.",
   "agenda.sidebar.allLocations": "Todos os locais",
   "agenda.sidebar.create": "Criar",
   "agenda.sidebar.location": "Local",
@@ -4756,199 +5210,659 @@ var agendaLocales = {
 };
 
 // src/migrations/index.ts
-var MIGRATION_001_PUBLIC_BOOKING = `-- ============================================================================
--- plugin-agenda 001: booking read model + public (anon) booking surface
+var MIGRATION_000_BASELINE = `-- ============================================================================
+-- plugins/plugin-agenda/src/migrations/000_baseline.sql \u2014 what installing this provisions, as one file.
 --
--- Ships the objects the agenda providers reference but the spine (packages/db
--- migrations 001\u2013010) does not define:
---   \xA70  converted-pool cleanup \u2014 drop the pre-rename v_bookings view / indexes
---   \xA71  order_items columns the admin provider writes (duration/assignee)
---   \xA72  public.v_appointments    \u2014 admin read model (authenticated, RLS applies)
---   \xA73  public.v_public_services \u2014 anon-readable service catalog
---   \xA74  public.get_available_slots      \u2014 anon RPC (mirrors the mock algorithm)
---   \xA75  public.create_public_booking    \u2014 anon RPC (validated, race-safe write)
+-- GENERATED by scripts/emit-unit-baselines.mjs (#338). Do not edit by hand:
+-- change the schema, regenerate, and let scripts/check-chain-equivalence.mjs
+-- prove the result still matches.
 --
--- Core v1 lives directly in PUBLIC (no separate core schema): people (was
--- persons), appointments (was bookings). This migration is written against public
--- names and is idempotent + safe on both fresh and converted pools.
+-- This replaced 23 migration files. They are kept, unapplied, in
+-- migrations.archive/ \u2014 a year of decisions is worth reading even when it is no
+-- longer worth replaying.
 --
--- Anon-access design: public booking pages run with the publishable key and no
--- session, so the canonical tenant RLS yields nothing. Anon access is granted
--- ONLY via the column-whitelisted view (\xA73) and SECURITY DEFINER RPCs (\xA74, \xA75)
--- with tight input validation and hardcoded statuses.
+-- Object order is fixed rather than dependency-sorted: schemas, types,
+-- sequences, tables, defaults, functions, constraints, views, indexes, foreign
+-- keys, triggers, row security, policies, grants. Dependencies BETWEEN units
+-- are carried by the order packages/db/chain.json declares.
 -- ============================================================================
 
--- \xA70 \u2014 converted-pool cleanup. The pre-industry-pool shape shipped a v_bookings
--- view and persons_/bookings_-named indexes; drop them so this file re-emits the
--- canonical v_appointments view + people_/appointments_ indexes without leaving
--- duplicates. All guarded with IF EXISTS \u2192 no-ops on a fresh pool.
-DROP VIEW IF EXISTS public.v_bookings;
-DROP INDEX IF EXISTS public.persons_tenant_customer_phone;
-DROP INDEX IF EXISTS public.bookings_assignee_time;
-
--- \xA71 \u2014 columns the agenda provider writes but 004_archetypes lacks
-ALTER TABLE public.order_items
-  ADD COLUMN IF NOT EXISTS duration_minutes integer,
-  ADD COLUMN IF NOT EXISTS assignee_id uuid REFERENCES public.people(id) ON DELETE SET NULL;
-
--- Lookup key for public customers (per tenant, by normalized phone).
--- NOT UNIQUE. It was, and spine/110 says why it cannot be: \`kind\` became a
--- derived column, so an imported 'client' turns into a 'customer' and a
--- placeholder phone shared by eight real people lands under one key. The upsert
--- that used to lean on it takes a per-(tenant, phone) advisory lock instead
--- (003, 009) \u2014 the index is here for the lookup that lock guards.
-DROP INDEX IF EXISTS public.people_tenant_customer_phone;
-CREATE INDEX IF NOT EXISTS people_tenant_customer_phone
-  ON public.people(tenant_id, phone)
-  WHERE kind = 'customer' AND phone IS NOT NULL;
-
--- Slot-conflict scan
-CREATE INDEX IF NOT EXISTS appointments_assignee_time
-  ON public.appointments(assignee_id, starts_at, ends_at)
-  WHERE status NOT IN ('cancelled', 'no_show');
-
--- \xA72 \u2014 admin read model (security_invoker \u2192 underlying RLS applies; anon sees 0 rows)
--- DROP first: 013 widens this view and CREATE OR REPLACE cannot narrow a live
--- view on replay ("cannot drop columns from view"). 013 replays right after.
--- 013 builds on this one, so the drop needs its dependents out and back (143).
-SELECT app.detach_view_dependents('public.v_appointments');
-DROP VIEW IF EXISTS public.v_appointments;
-CREATE VIEW public.v_appointments
-WITH (security_invoker = true) AS
-SELECT
-  b.id, b.tenant_id, b.kind, b.starts_at, b.ends_at, b.status, b.notes,
-  b.order_id, b.location_id, b.metadata, b.created_at, b.updated_at,
-  b.party_id                              AS client_id,
-  COALESCE(pc.name, b.metadata->>'title') AS client_name,
-  pc.phone                                AS client_phone,
-  pc.email                                AS client_email,
-  pc.avatar_url                           AS client_avatar_url,
-  b.assignee_id                           AS professional_id,
-  ps.name                                 AS professional_name,
-  ps.avatar_url                           AS professional_avatar_url,
-  l.name                                  AS location_name,
-  o.total                                 AS order_total,
-  o.status                                AS order_status,
-  (EXTRACT(EPOCH FROM (COALESCE(b.ends_at, b.starts_at) - b.starts_at))::int / 60)
-                                          AS total_duration_minutes
-FROM public.appointments b
-LEFT JOIN public.people    pc ON pc.id = b.party_id
-LEFT JOIN public.people    ps ON ps.id = b.assignee_id
-LEFT JOIN public.locations l  ON l.id  = b.location_id
-LEFT JOIN public.orders    o  ON o.id  = b.order_id;
-
-GRANT SELECT ON public.v_appointments TO authenticated, service_role;
-REVOKE SELECT ON public.v_appointments FROM anon;
-
--- \xA73 \u2014 anon-readable public catalog (owner-rights view = deliberate, whitelisted)
--- DROP first: 010 widens this view (curation columns) \u2014 same replay rule as \xA72.
-DROP VIEW IF EXISTS public.v_public_services;
-CREATE VIEW public.v_public_services AS
-SELECT
-  s.id, s.tenant_id, s.name, s.description, s.price, s.currency,
-  COALESCE(s.duration_minutes, 30)                AS duration_minutes,
-  s.image_url,
-  COALESCE((s.metadata->>'sort_order')::int, 0)   AS sort_order
-FROM public.services s
-WHERE s.is_active AND s.status = 'active';
+-- A LANGUAGE sql function binds its body at CREATE time, and 570 functions
+-- sorted by name are not sorted by who calls whom. This is what lets them load
+-- in any order; every body is still compiled on first call, so a genuinely
+-- broken reference surfaces then rather than never. Session-scoped.
+SET check_function_bodies = false;
+
+
+
+-- \u2500\u2500 default privileges: reset \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- Cleared BEFORE anything is created, so every object below gets the ACL the
+-- dump describes rather than the image's defaults on top of it. Restored at
+-- the end of this file.
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON SEQUENCES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON FUNCTIONS FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public REVOKE ALL ON TABLES FROM anon, authenticated, service_role, fayz_connector$stmt$;
+END $dp$;
+
+
+-- \u2500\u2500 function \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE FUNCTION public.agenda_assert_service_is_public(p_tenant_id uuid, p_service_id uuid) RETURNS void
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO ''
+    AS $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM app.resource_grants g
+              WHERE g.tenant_id = p_tenant_id
+                AND g.resource_type = 'catalog.product'
+                AND g.resource_id = p_service_id
+                AND g.relation = 'available_in') THEN
+    RAISE EXCEPTION 'este servi\xE7o n\xE3o est\xE1 dispon\xEDvel para agendamento online'
+      USING ERRCODE = '42501',
+            HINT = 'The service is released to specific units; the public booking path is tenant-wide and cannot honour a unit release (#201).';
+  END IF;
+END $$;
+
+CREATE FUNCTION public.agenda_booking_cancel(p_appointment_id uuid, p_hard boolean DEFAULT false) RETURNS jsonb
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO ''
+    AS $_$
+DECLARE
+  v_tenant uuid := app.current_tenant_id();
+  v_appt   public.appointments%ROWTYPE;
+  v_money  integer := 0;
+BEGIN
+  SELECT * INTO v_appt FROM public.appointments a WHERE a.id = p_appointment_id AND a.tenant_id = v_tenant;
+  IF v_appt.id IS NULL THEN
+    RAISE EXCEPTION 'agenda_booking_cancel: appointment % not found', p_appointment_id USING ERRCODE = 'P0002';
+  END IF;
+  IF NOT (select app.has_permission('agenda.delete', v_appt.unit_id)) THEN
+    RAISE EXCEPTION 'agenda_booking_cancel: agenda.delete is required' USING ERRCODE = '42501';
+  END IF;
 
-GRANT SELECT ON public.v_public_services TO anon, authenticated, service_role;
+  -- Money that exists is never deleted. A booking that raised a T\xEDtulo is
+  -- CANCELLED, both sides, in one transaction.
+  IF v_appt.order_id IS NOT NULL AND to_regclass('public.plg_financial_invoices') IS NOT NULL THEN
+    EXECUTE 'SELECT count(*)::int FROM public.plg_financial_invoices WHERE order_id = $1 AND cancelled_at IS NULL'
+      INTO v_money USING v_appt.order_id;
+  END IF;
 
--- \xA74 \u2014 availability RPC (mirrors plugin-agenda/src/data/mock.ts getAvailableSlots)
-CREATE OR REPLACE FUNCTION public.get_available_slots(
-  p_tenant_id uuid,
-  p_date date,
-  p_duration_minutes integer,
-  p_assignee_id uuid DEFAULT NULL,
-  p_slot_interval integer DEFAULT 30
-) RETURNS TABLE (slot_start timestamptz, slot_end timestamptz)
-LANGUAGE plpgsql STABLE SECURITY DEFINER
-SET search_path = public
-AS $$
+  IF v_money > 0 OR NOT p_hard THEN
+    UPDATE public.appointments SET status = 'cancelled' WHERE id = p_appointment_id;
+    IF v_appt.order_id IS NOT NULL THEN
+      UPDATE public.orders SET status = 'cancelled' WHERE id = v_appt.order_id AND status <> 'completed';
+    END IF;
+    RETURN jsonb_build_object('cancelled', true, 'deleted', false, 'order_id', v_appt.order_id);
+  END IF;
+
+  DELETE FROM public.appointments WHERE id = p_appointment_id;
+  IF v_appt.order_id IS NOT NULL THEN
+    DELETE FROM public.orders WHERE id = v_appt.order_id;
+  END IF;
+  RETURN jsonb_build_object('cancelled', true, 'deleted', true, 'order_id', v_appt.order_id);
+END $_$;
+
+CREATE FUNCTION public.agenda_booking_create(p_starts_at timestamp with time zone, p_ends_at timestamp with time zone DEFAULT NULL::timestamp with time zone, p_lines jsonb DEFAULT '[]'::jsonb, p_party_id uuid DEFAULT NULL::uuid, p_assignee_id uuid DEFAULT NULL::uuid, p_unit_id uuid DEFAULT NULL::uuid, p_location_id uuid DEFAULT NULL::uuid, p_kind text DEFAULT 'appointment'::text, p_notes text DEFAULT NULL::text, p_metadata jsonb DEFAULT '{}'::jsonb, p_idempotency_key text DEFAULT NULL::text) RETURNS jsonb
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO ''
+    AS $$
 DECLARE
-  v_tz text;
+  v_tenant  uuid := app.current_tenant_id();
+  v_order   uuid;
+  v_booking uuid;
+  v_ends    timestamptz;
+  v_minutes integer;
+  v_line    jsonb;
 BEGIN
-  -- tight validation: this function is anon-callable
-  IF p_duration_minutes IS NULL OR p_duration_minutes NOT BETWEEN 5 AND 480 THEN
-    RAISE EXCEPTION 'invalid duration';
+  IF v_tenant IS NULL THEN
+    RAISE EXCEPTION 'agenda_booking_create: no active tenant' USING ERRCODE = '42501';
   END IF;
-  IF p_slot_interval IS NULL OR p_slot_interval NOT BETWEEN 5 AND 240 THEN
-    RAISE EXCEPTION 'invalid interval';
+  IF NOT (select app.has_permission('agenda.create', p_unit_id)) THEN
+    RAISE EXCEPTION 'agenda_booking_create: agenda.create is required' USING ERRCODE = '42501';
   END IF;
-  IF p_date IS NULL OR p_date < current_date OR p_date > current_date + 90 THEN
-    RETURN;
+
+  IF p_idempotency_key IS NOT NULL THEN
+    SELECT a.id, a.order_id INTO v_booking, v_order FROM public.appointments a
+     WHERE a.tenant_id = v_tenant AND a.metadata ->> 'idempotencyKey' = p_idempotency_key
+     LIMIT 1;
+    IF v_booking IS NOT NULL THEN
+      RETURN jsonb_build_object('appointment_id', v_booking, 'order_id', v_order, 'replayed', true);
+    END IF;
   END IF;
 
-  SELECT COALESCE(t.settings->>'timezone', 'America/Sao_Paulo') INTO v_tz
-  FROM tenants t WHERE t.id = p_tenant_id;
-  IF v_tz IS NULL THEN RETURN; END IF;  -- unknown tenant \u2192 empty, not an error
+  SELECT coalesce(sum(coalesce((l ->> 'duration_minutes')::integer, 0)), 0)
+    INTO v_minutes FROM jsonb_array_elements(coalesce(p_lines, '[]'::jsonb)) l;
+  v_ends := coalesce(p_ends_at, p_starts_at + (greatest(v_minutes, 30) || ' minutes')::interval);
+
+  -- The core's door, not a direct write. One statement, and the lines come with
+  -- it: there is no window in which the Venda exists without them.
+  v_order := public.order_create(
+    p_kind        => p_kind,
+    p_lines       => coalesce(p_lines, '[]'::jsonb),
+    p_party_id    => p_party_id,
+    p_unit_id     => p_unit_id,
+    p_status      => 'scheduled',
+    p_assignee_id => p_assignee_id,
+    p_notes       => p_notes,
+    p_metadata    => coalesce(p_metadata, '{}'::jsonb) || jsonb_build_object('source', 'agenda'),
+    p_idempotency_key => p_idempotency_key);
+
+  INSERT INTO public.appointments (tenant_id, unit_id, kind, party_id, assignee_id, location_id,
+                                   order_id, starts_at, ends_at, status, notes, metadata)
+  VALUES (v_tenant, p_unit_id, p_kind, p_party_id, p_assignee_id, p_location_id,
+          v_order, p_starts_at, v_ends, 'scheduled', p_notes,
+          coalesce(p_metadata, '{}'::jsonb) || jsonb_build_object('source', 'agenda')
+            || CASE WHEN p_idempotency_key IS NULL THEN '{}'::jsonb
+                    ELSE jsonb_build_object('idempotencyKey', p_idempotency_key) END)
+  RETURNING id INTO v_booking;
 
-  RETURN QUERY
-  WITH day_schedules AS (
-    SELECT sc.assignee_id, sc.starts_at AS win_start, sc.ends_at AS win_end
-    FROM schedules sc
-    WHERE sc.tenant_id = p_tenant_id
-      AND sc.kind = 'working_hours'
-      AND sc.is_active
-      AND (p_assignee_id IS NULL OR sc.assignee_id = p_assignee_id)
-      AND (
-        sc.specific_date = p_date
-        OR (sc.specific_date IS NULL AND sc.day_of_week = EXTRACT(dow FROM p_date)::smallint)
-      )
-  ),
-  candidate AS (
-    SELECT
-      ds.assignee_id,
-      gs                                              AS s_start,
-      gs + make_interval(mins => p_duration_minutes)  AS s_end
-    FROM day_schedules ds
-    CROSS JOIN LATERAL generate_series(
-      (p_date + ds.win_start) AT TIME ZONE v_tz,
-      ((p_date + ds.win_end) AT TIME ZONE v_tz) - make_interval(mins => p_duration_minutes),
-      make_interval(mins => p_slot_interval)
-    ) AS gs
+  -- The agenda's own per-line columns (001 added them to the line table): who
+  -- performs it and how long it takes.
+  FOR v_line IN SELECT * FROM jsonb_array_elements(coalesce(p_lines, '[]'::jsonb)) LOOP
+    UPDATE public.items oi
+       SET duration_minutes = nullif(v_line ->> 'duration_minutes', '')::integer,
+           assignee_id      = coalesce(nullif(v_line ->> 'assignee_id', '')::uuid, p_assignee_id)
+     WHERE oi.order_id = v_order
+       AND oi.product_id IS NOT DISTINCT FROM nullif(v_line ->> 'service_id', '')::uuid
+       AND oi.name = coalesce(nullif(btrim(coalesce(v_line ->> 'name', '')), ''), 'Item');
+  END LOOP;
+
+  RETURN jsonb_build_object('appointment_id', v_booking, 'order_id', v_order, 'replayed', false);
+END $$;
+
+CREATE FUNCTION public.agenda_booking_invoice(p_appointment_id uuid, p_installments integer DEFAULT 1, p_due_date date DEFAULT NULL::date) RETURNS jsonb
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO ''
+    AS $$
+DECLARE
+  v_tenant uuid := app.current_tenant_id();
+  v_order  uuid;
+BEGIN
+  SELECT a.order_id INTO v_order FROM public.appointments a
+   WHERE a.id = p_appointment_id AND a.tenant_id = v_tenant;
+  IF v_order IS NULL THEN
+    RAISE EXCEPTION 'agenda_booking_invoice: appointment % has no Venda to bill', p_appointment_id
+      USING ERRCODE = 'P0002',
+            HINT = 'A booking created through agenda_booking_create always carries one; v_appointments_sem_order lists the rest.';
+  END IF;
+
+  IF to_regprocedure('public.fn_invoice_from_order(uuid, date, text, integer, text)') IS NULL THEN
+    RAISE EXCEPTION 'agenda_booking_invoice: the financial plugin is not installed' USING ERRCODE = '0A000';
+  END IF;
+
+  PERFORM public.fn_invoice_from_order(v_order, p_due_date, 'invoiced', greatest(coalesce(p_installments, 1), 1), 'credit');
+  RETURN jsonb_build_object('order_id', v_order, 'appointment_id', p_appointment_id);
+END $$;
+
+CREATE FUNCTION public.agenda_booking_update(p_appointment_id uuid, p_starts_at timestamp with time zone DEFAULT NULL::timestamp with time zone, p_ends_at timestamp with time zone DEFAULT NULL::timestamp with time zone, p_status text DEFAULT NULL::text, p_party_id uuid DEFAULT NULL::uuid, p_assignee_id uuid DEFAULT NULL::uuid, p_location_id uuid DEFAULT NULL::uuid, p_notes text DEFAULT NULL::text, p_metadata jsonb DEFAULT NULL::jsonb, p_lines jsonb DEFAULT NULL::jsonb) RETURNS jsonb
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO ''
+    AS $$
+DECLARE
+  v_tenant uuid := app.current_tenant_id();
+  v_appt   public.appointments%ROWTYPE;
+  v_line   jsonb;
+  v_n      integer := 0;
+  v_sub    numeric := 0;
+  v_qty    numeric;
+  v_price  numeric;
+BEGIN
+  SELECT * INTO v_appt FROM public.appointments a WHERE a.id = p_appointment_id AND a.tenant_id = v_tenant;
+  IF v_appt.id IS NULL THEN
+    RAISE EXCEPTION 'agenda_booking_update: appointment % not found', p_appointment_id USING ERRCODE = 'P0002';
+  END IF;
+  IF NOT (select app.has_permission('agenda.edit', v_appt.unit_id)) THEN
+    RAISE EXCEPTION 'agenda_booking_update: agenda.edit is required' USING ERRCODE = '42501';
+  END IF;
+
+  UPDATE public.appointments SET
+    starts_at   = coalesce(p_starts_at, starts_at),
+    ends_at     = coalesce(p_ends_at, ends_at),
+    status      = coalesce(p_status, status),
+    party_id    = coalesce(p_party_id, party_id),
+    assignee_id = coalesce(p_assignee_id, assignee_id),
+    location_id = coalesce(p_location_id, location_id),
+    notes       = coalesce(p_notes, notes),
+    metadata    = coalesce(metadata, '{}'::jsonb) || coalesce(p_metadata, '{}'::jsonb)
+  WHERE id = p_appointment_id;
+
+  IF v_appt.order_id IS NOT NULL THEN
+    UPDATE public.orders SET
+      party_id    = coalesce(p_party_id, party_id),
+      assignee_id = coalesce(p_assignee_id, assignee_id),
+      location_id = coalesce(p_location_id, location_id),
+      notes       = coalesce(p_notes, notes)
+    WHERE id = v_appt.order_id;
+
+    IF p_lines IS NOT NULL THEN
+      -- Replacing the lines and the header total in the SAME statement pair is
+      -- the point: a total that disagrees with its lines is what two browser
+      -- calls left behind whenever the second one did not land.
+      DELETE FROM public.items WHERE order_id = v_appt.order_id;
+      FOR v_line IN SELECT * FROM jsonb_array_elements(p_lines) LOOP
+        v_n := v_n + 1;
+        v_qty   := coalesce((v_line ->> 'quantity')::numeric, 1);
+        v_price := round(coalesce((v_line ->> 'unit_price')::numeric, 0), 2);
+        INSERT INTO public.items (order_id, product_id, name, quantity, unit_price, total,
+                                        sort_order, duration_minutes, assignee_id)
+        VALUES (v_appt.order_id, nullif(v_line ->> 'service_id', '')::uuid,
+                coalesce(nullif(btrim(coalesce(v_line ->> 'name', '')), ''), 'Item'),
+                v_qty, v_price, round(v_qty * v_price, 2),
+                coalesce((v_line ->> 'sort_order')::integer, v_n - 1),
+                nullif(v_line ->> 'duration_minutes', '')::integer,
+                coalesce(nullif(v_line ->> 'assignee_id', '')::uuid, p_assignee_id, v_appt.assignee_id));
+        v_sub := v_sub + round(v_qty * v_price, 2);
+      END LOOP;
+      UPDATE public.orders SET subtotal = v_sub, total = v_sub WHERE id = v_appt.order_id;
+    END IF;
+  END IF;
+
+  RETURN jsonb_build_object('appointment_id', p_appointment_id, 'order_id', v_appt.order_id);
+END $$;
+
+CREATE FUNCTION public.agenda_working_windows(p_tenant_id uuid, p_date date, p_assignee_id uuid DEFAULT NULL::uuid) RETURNS TABLE(assignee_id uuid, win_start time without time zone, win_end time without time zone)
+    LANGUAGE sql STABLE
+    SET search_path TO 'public'
+    AS $$
+  WITH exc AS (
+    -- Every specific-date row for the date, ACTIVE OR NOT: the inactive day-off
+    -- sentinel must still suppress the weekly rows below.
+    SELECT sc.assignee_id, sc.starts_at, sc.ends_at, sc.is_active
+    FROM schedules sc
+    WHERE sc.tenant_id = p_tenant_id
+      AND sc.kind = 'working_hours'
+      AND sc.specific_date = p_date
+      AND (p_assignee_id IS NULL OR sc.assignee_id = p_assignee_id)
   )
-  SELECT DISTINCT c.s_start, c.s_end
-  FROM candidate c
-  WHERE NOT EXISTS (
+  SELECT e.assignee_id, e.starts_at, e.ends_at
+  FROM exc e
+  WHERE e.is_active
+  UNION ALL
+  SELECT sc.assignee_id, sc.starts_at, sc.ends_at
+  FROM schedules sc
+  WHERE sc.tenant_id = p_tenant_id
+    AND sc.kind = 'working_hours'
+    AND sc.is_active
+    AND sc.specific_date IS NULL
+    AND sc.day_of_week = EXTRACT(dow FROM p_date)::smallint
+    AND (p_assignee_id IS NULL OR sc.assignee_id = p_assignee_id)
+    AND NOT EXISTS (SELECT 1 FROM exc e WHERE e.assignee_id = sc.assignee_id)
+$$;
+
+CREATE FUNCTION public.agent_agenda_create_appointment(p_tenant_id uuid, p_actor_user_id uuid, p_payload jsonb) RETURNS jsonb
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO 'public'
+    AS $_$
+DECLARE
+  v_denial jsonb;
+  v_used int;
+  v_client_id uuid;
+  v_service_id uuid;
+  v_professional uuid;
+  v_starts timestamptz;
+  v_starts_raw text;
+  v_notes text;
+  v_service record;
+  v_client record;
+  v_ends timestamptz;
+  v_tz text;
+  v_order uuid;
+  v_booking uuid;
+BEGIN
+  SELECT COALESCE(t.settings->>'timezone', 'America/Sao_Paulo') INTO v_tz
+  FROM tenants t WHERE t.id = p_tenant_id;
+  IF v_tz IS NULL THEN
+    RETURN jsonb_build_object('ok', false, 'error', 'unknown tenant');
+  END IF;
+
+  -- \u2500\u2500 payload \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  BEGIN
+    v_client_id    := (p_payload->>'client_id')::uuid;
+    v_service_id   := (p_payload->>'service_id')::uuid;
+    v_professional := (p_payload->>'professional_id')::uuid;
+    v_starts_raw   := p_payload->>'starts_at';
+    IF v_starts_raw ~ '(Z|[+-][0-9]{2}:?[0-9]{2})$' THEN
+      v_starts := v_starts_raw::timestamptz;              -- explicit offset
+    ELSE
+      v_starts := (v_starts_raw::timestamp) AT TIME ZONE v_tz;  -- tenant-local
+    END IF;
+  EXCEPTION WHEN OTHERS THEN
+    RETURN jsonb_build_object('ok', false, 'error', 'invalid payload: ' || SQLERRM);
+  END;
+  v_notes := left(p_payload->>'notes', 500);
+  IF v_client_id IS NULL OR v_service_id IS NULL OR v_starts IS NULL THEN
+    RETURN jsonb_build_object('ok', false, 'error', 'client_id, service_id and starts_at are required');
+  END IF;
+  IF v_starts <= now() OR v_starts > now() + interval '365 days' THEN
+    RETURN jsonb_build_object('ok', false, 'error', 'starts_at must be in the future (max 1 year)');
+  END IF;
+
+  -- \u2500\u2500 authorization: role \u2192 plan \u2192 bookings_month cap \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  SELECT count(*) INTO v_used FROM appointments b
+  WHERE b.tenant_id = p_tenant_id
+    AND b.created_at >= date_trunc('month', now());
+  v_denial := agent_guard(p_tenant_id, p_actor_user_id,
+                          'appointments', 'create', 'bookings_month', v_used, 1);
+  IF v_denial IS NOT NULL THEN
+    RETURN jsonb_build_object('ok', false, 'denial', v_denial);
+  END IF;
+
+  -- \u2500\u2500 invariants \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  SELECT p.id, p.name INTO v_client
+  FROM people p
+  WHERE p.id = v_client_id AND p.tenant_id = p_tenant_id;
+  IF NOT FOUND THEN
+    RETURN jsonb_build_object('ok', false, 'error', 'unknown client for this tenant');
+  END IF;
+
+  SELECT s.id, s.name, s.price, COALESCE(s.duration_minutes, 30) AS duration_minutes
+    INTO v_service
+  FROM services s
+  WHERE s.id = v_service_id AND s.tenant_id = p_tenant_id
+    AND s.is_active AND s.status = 'active';
+  IF NOT FOUND THEN
+    RETURN jsonb_build_object('ok', false, 'error', 'unknown or inactive service');
+  END IF;
+
+  v_ends := v_starts + make_interval(mins => v_service.duration_minutes);
+
+  -- exception-aware windows (007); still prefer a professional who is FREE at
+  -- the slot when the user did not name one
+  SELECT w.assignee_id INTO v_professional
+  FROM agenda_working_windows(
+         p_tenant_id, (v_starts AT TIME ZONE v_tz)::date, v_professional) w
+  WHERE (v_starts AT TIME ZONE v_tz)::time >= w.win_start
+    AND (v_ends AT TIME ZONE v_tz)::time <= w.win_end
+    AND NOT EXISTS (
+      SELECT 1 FROM appointments b
+      WHERE b.tenant_id = p_tenant_id
+        AND b.assignee_id = w.assignee_id
+        AND b.status NOT IN ('cancelled', 'no_show')
+        AND b.starts_at < v_ends
+        AND COALESCE(b.ends_at, b.starts_at) > v_starts
+    )
+  ORDER BY w.assignee_id
+  LIMIT 1;
+  IF v_professional IS NULL THEN
+    RETURN jsonb_build_object('ok', false, 'error',
+      'no professional is available at that slot (outside working hours or already booked). Suggest a different time. Times are tenant-local, tz ' || v_tz);
+  END IF;
+
+  PERFORM pg_advisory_xact_lock(hashtextextended(p_tenant_id::text || v_professional::text, 0));
+  IF EXISTS (
     SELECT 1 FROM appointments b
     WHERE b.tenant_id = p_tenant_id
-      AND b.assignee_id = c.assignee_id
+      AND b.assignee_id = v_professional
       AND b.status NOT IN ('cancelled', 'no_show')
-      AND b.starts_at < c.s_end
-      AND COALESCE(b.ends_at, b.starts_at) > c.s_start
-  )
-  ORDER BY 1;
+      AND b.starts_at < v_ends
+      AND COALESCE(b.ends_at, b.starts_at) > v_starts
+  ) THEN
+    RETURN jsonb_build_object('ok', false, 'error', 'slot no longer available');
+  END IF;
+
+  -- \u2500\u2500 write + audit \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  INSERT INTO orders (tenant_id, kind, status, party_id, assignee_id, subtotal, total, notes, metadata)
+  VALUES (p_tenant_id, 'appointment', 'scheduled', v_client_id, v_professional,
+          v_service.price, v_service.price, v_notes,
+          jsonb_build_object('source', 'agent', 'serviceNames', v_service.name))
+  RETURNING id INTO v_order;
+
+  INSERT INTO appointments (tenant_id, kind, party_id, assignee_id, order_id,
+                            starts_at, ends_at, status, notes, metadata)
+  VALUES (p_tenant_id, 'appointment', v_client_id, v_professional, v_order,
+          v_starts, v_ends, 'scheduled', v_notes,
+          jsonb_build_object('source', 'agent', 'serviceNames', v_service.name))
+  RETURNING id INTO v_booking;
+
+  INSERT INTO items (order_id, service_id, name, quantity, unit_price, total,
+                           sort_order, duration_minutes, assignee_id)
+  VALUES (v_order, v_service.id, v_service.name, 1, v_service.price, v_service.price,
+          0, v_service.duration_minutes, v_professional);
+
+  INSERT INTO audit_logs (tenant_id, user_id, action, entity_type, entity_id, metadata)
+  VALUES (p_tenant_id, p_actor_user_id, 'agent.createAppointment', 'appointment', v_booking::text,
+          jsonb_build_object('payload', p_payload, 'order_id', v_order));
+
+  RETURN jsonb_build_object(
+    'ok', true,
+    'id', v_booking,
+    'record', jsonb_build_object(
+      'ref', jsonb_build_object('id', v_booking, 'resource', 'appointments',
+                                'archetype', 'schedule:appointment'),
+      'starts_at', v_starts,
+      'ends_at', v_ends,
+      'starts_at_local', to_char(v_starts AT TIME ZONE v_tz, 'YYYY-MM-DD (Dy) HH24:MI') || ' ' || v_tz,
+      'ends_at_local', to_char(v_ends AT TIME ZONE v_tz, 'HH24:MI'),
+      'client_name', v_client.name,
+      'service_name', v_service.name,
+      'price', v_service.price,
+      'status', 'scheduled'
+    )
+  );
 END;
-$$;
+$_$;
 
-REVOKE ALL ON FUNCTION public.get_available_slots(uuid, date, integer, uuid, integer) FROM public;
-GRANT EXECUTE ON FUNCTION public.get_available_slots(uuid, date, integer, uuid, integer)
-  TO anon, authenticated, service_role;
+CREATE FUNCTION public.agent_agenda_update_appointment(p_tenant_id uuid, p_actor_user_id uuid, p_payload jsonb) RETURNS jsonb
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO 'public'
+    AS $_$
+DECLARE
+  v_denial jsonb;
+  v_id uuid;
+  v_tz text;
+  v_row record;
+  v_starts_raw text;
+  v_starts timestamptz;
+  v_ends timestamptz;
+  v_duration int;
+  v_professional uuid;
+  v_status text;
+  v_notes text;
+  v_wants_move boolean;
+  v_wants_status boolean;
+BEGIN
+  SELECT COALESCE(t.settings->>'timezone', 'America/Sao_Paulo') INTO v_tz
+  FROM tenants t WHERE t.id = p_tenant_id;
+  IF v_tz IS NULL THEN
+    RETURN jsonb_build_object('ok', false, 'error', 'unknown tenant');
+  END IF;
 
--- \xA75 \u2014 public booking write RPC (validated, race-safe, hardcoded statuses)
-CREATE OR REPLACE FUNCTION public.create_public_booking(
-  p_tenant_id uuid,
-  p_service_id uuid,
-  p_starts_at timestamptz,
-  p_name text,
-  p_phone text,
-  p_email text DEFAULT NULL,
-  p_notes text DEFAULT NULL
-) RETURNS TABLE (booking_id uuid, starts_at timestamptz, ends_at timestamptz)
-LANGUAGE plpgsql SECURITY DEFINER
-SET search_path = public
-AS $$
+  -- \u2500\u2500 payload \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  BEGIN
+    v_id           := (p_payload->>'appointment_id')::uuid;
+    v_professional := (p_payload->>'professional_id')::uuid;
+    v_starts_raw   := p_payload->>'starts_at';
+  EXCEPTION WHEN OTHERS THEN
+    RETURN jsonb_build_object('ok', false, 'error', 'invalid payload: ' || SQLERRM);
+  END;
+  v_status := nullif(trim(lower(p_payload->>'status')), '');
+  v_notes  := left(p_payload->>'notes', 500);
+  v_wants_move   := v_starts_raw IS NOT NULL OR v_professional IS NOT NULL;
+  v_wants_status := v_status IS NOT NULL;
+
+  IF v_id IS NULL THEN
+    RETURN jsonb_build_object('ok', false, 'error',
+      'appointment_id is required \u2014 search the agenda first and reuse the id of the appointment to change');
+  END IF;
+  IF NOT v_wants_move AND NOT v_wants_status AND v_notes IS NULL THEN
+    RETURN jsonb_build_object('ok', false, 'error',
+      'nothing to change: send starts_at, professional_id, status or notes');
+  END IF;
+  IF v_status IS NOT NULL
+     AND v_status NOT IN ('scheduled', 'confirmed', 'in_progress', 'completed', 'cancelled', 'no_show') THEN
+    RETURN jsonb_build_object('ok', false, 'error',
+      'status must be one of scheduled, confirmed, in_progress, completed, cancelled, no_show');
+  END IF;
+
+  -- \u2500\u2500 the appointment must exist, in THIS tenant \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  SELECT b.id, b.starts_at, b.ends_at, b.assignee_id, b.status, b.party_id, b.order_id
+    INTO v_row
+  FROM appointments b
+  WHERE b.id = v_id AND b.tenant_id = p_tenant_id;
+  IF NOT FOUND THEN
+    RETURN jsonb_build_object('ok', false, 'error', 'unknown appointment for this tenant');
+  END IF;
+
+  -- \u2500\u2500 authorization: role \u2192 plan. No cap: editing frees nothing and buys
+  --    nothing, so charging bookings_month for a reschedule would be wrong.
+  v_denial := agent_guard(p_tenant_id, p_actor_user_id, 'appointments', 'edit');
+  IF v_denial IS NOT NULL THEN
+    RETURN jsonb_build_object('ok', false, 'denial', v_denial);
+  END IF;
+
+  -- Duration is preserved across a move \u2014 a 60-minute appointment stays 60.
+  v_duration := GREATEST(
+    COALESCE(EXTRACT(EPOCH FROM (v_row.ends_at - v_row.starts_at)) / 60, 30)::int, 5);
+  v_professional := COALESCE(v_professional, v_row.assignee_id);
+
+  IF v_wants_move THEN
+    IF v_starts_raw IS NOT NULL THEN
+      BEGIN
+        IF v_starts_raw ~ '(Z|[+-][0-9]{2}:?[0-9]{2})$' THEN
+          v_starts := v_starts_raw::timestamptz;               -- explicit offset
+        ELSE
+          v_starts := (v_starts_raw::timestamp) AT TIME ZONE v_tz;  -- tenant-local
+        END IF;
+      EXCEPTION WHEN OTHERS THEN
+        RETURN jsonb_build_object('ok', false, 'error', 'invalid starts_at: ' || SQLERRM);
+      END;
+    ELSE
+      v_starts := v_row.starts_at;
+    END IF;
+    v_ends := v_starts + make_interval(mins => v_duration);
+
+    IF v_starts > now() + interval '365 days' THEN
+      RETURN jsonb_build_object('ok', false, 'error', 'starts_at must be within the next year');
+    END IF;
+
+    -- Working window (exception-aware, 007) for the target professional.
+    IF NOT EXISTS (
+      SELECT 1
+      FROM agenda_working_windows(
+             p_tenant_id, (v_starts AT TIME ZONE v_tz)::date, v_professional) w
+      WHERE w.assignee_id = v_professional
+        AND (v_starts AT TIME ZONE v_tz)::time >= w.win_start
+        AND (v_ends   AT TIME ZONE v_tz)::time <= w.win_end
+    ) THEN
+      RETURN jsonb_build_object('ok', false, 'error',
+        'that slot is outside the professional''s working hours. Suggest a different time. Times are tenant-local, tz ' || v_tz);
+    END IF;
+
+    PERFORM pg_advisory_xact_lock(hashtextextended(p_tenant_id::text || v_professional::text, 0));
+    IF EXISTS (
+      SELECT 1 FROM appointments b
+      WHERE b.tenant_id = p_tenant_id
+        AND b.assignee_id = v_professional
+        AND b.id <> v_id                     -- never conflicts with itself
+        AND b.status NOT IN ('cancelled', 'no_show')
+        AND b.starts_at < v_ends
+        AND COALESCE(b.ends_at, b.starts_at) > v_starts
+    ) THEN
+      RETURN jsonb_build_object('ok', false, 'error',
+        'that slot is already taken. Suggest a different time.');
+    END IF;
+  END IF;
+
+  -- \u2500\u2500 write + audit \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  UPDATE appointments b SET
+    starts_at   = COALESCE(v_starts, b.starts_at),
+    ends_at     = COALESCE(v_ends, b.ends_at),
+    assignee_id = v_professional,
+    status      = COALESCE(v_status, b.status),
+    notes       = COALESCE(v_notes, b.notes),
+    metadata    = COALESCE(b.metadata, '{}'::jsonb) || jsonb_build_object('lastAgentEdit', now()),
+    updated_at  = now()
+  WHERE b.id = v_id AND b.tenant_id = p_tenant_id;
+
+  -- The order mirrors the appointment's assignee/status so the financial side
+  -- does not drift from the calendar.
+  IF v_row.order_id IS NOT NULL THEN
+    UPDATE orders o SET
+      assignee_id = v_professional,
+      status      = CASE WHEN v_status = 'cancelled' THEN 'cancelled' ELSE o.status END,
+      updated_at  = now()
+    WHERE o.id = v_row.order_id AND o.tenant_id = p_tenant_id;
+  END IF;
+
+  INSERT INTO audit_logs (tenant_id, user_id, action, entity_type, entity_id, metadata)
+  VALUES (p_tenant_id, p_actor_user_id, 'agent.updateAppointment', 'appointment', v_id::text,
+          jsonb_build_object('payload', p_payload,
+                             'previous', jsonb_build_object(
+                               'starts_at', v_row.starts_at,
+                               'ends_at', v_row.ends_at,
+                               'assignee_id', v_row.assignee_id,
+                               'status', v_row.status)));
+
+  SELECT a.id, a.starts_at, a.ends_at, a.status, a.client_name, a.professional_name
+    INTO v_row
+  FROM v_appointments a WHERE a.id = v_id;
+
+  RETURN jsonb_build_object(
+    'ok', true,
+    'id', v_id,
+    'record', jsonb_build_object(
+      'ref', jsonb_build_object('id', v_id, 'resource', 'appointments',
+                                'archetype', 'schedule:appointment'),
+      'starts_at', v_row.starts_at,
+      'ends_at', v_row.ends_at,
+      'starts_at_local', to_char(v_row.starts_at AT TIME ZONE v_tz, 'YYYY-MM-DD (Dy) HH24:MI') || ' ' || v_tz,
+      'ends_at_local', to_char(v_row.ends_at AT TIME ZONE v_tz, 'HH24:MI'),
+      'client_name', v_row.client_name,
+      'professional_name', v_row.professional_name,
+      'status', v_row.status
+    )
+  );
+END;
+$_$;
+
+CREATE FUNCTION public.create_public_booking(p_tenant_id uuid, p_service_id uuid, p_starts_at timestamp with time zone, p_name text, p_phone text, p_email text DEFAULT NULL::text, p_notes text DEFAULT NULL::text, p_assignee_id uuid DEFAULT NULL::uuid) RETURNS TABLE(booking_id uuid, starts_at timestamp with time zone, ends_at timestamp with time zone)
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO 'public'
+    AS $_$
 DECLARE
   v_service record;
   v_person_id uuid;
   v_assignee uuid;
+  v_requested uuid;
   v_ends timestamptz;
   v_order uuid;
   v_booking uuid;
   v_phone text;
   v_tz text;
   v_notes text;
+  v_client_kind text;
 BEGIN
   -- validation: anon-callable, everything tight
   IF p_name IS NULL OR length(trim(p_name)) NOT BETWEEN 2 AND 120 THEN
@@ -4972,26 +5886,44 @@ BEGIN
   WHERE s.id = p_service_id AND s.tenant_id = p_tenant_id
     AND s.is_active AND s.status = 'active';
   IF NOT FOUND THEN RAISE EXCEPTION 'unknown service'; END IF;
+  -- \u2026and it must be a PUBLIC service, not merely an existing one. A service
+  -- released to particular units is not a tenant-wide offering, and this path has
+  -- no unit to honour the release in; without this an id from a cached page still
+  -- booked what the catalog no longer lists (#201).
+  PERFORM public.agenda_assert_service_is_public(p_tenant_id, p_service_id);
 
   v_ends := p_starts_at + make_interval(mins => v_service.duration_minutes);
-  SELECT COALESCE(t.settings->>'timezone', 'America/Sao_Paulo') INTO v_tz
+
+  -- tenant config: timezone + client kind (admin-set; sanitized, never caller input)
+  SELECT COALESCE(t.settings->>'timezone', 'America/Sao_Paulo'),
+         COALESCE(NULLIF(trim(t.settings->'booking'->>'client_kind'), ''), 'customer')
+    INTO v_tz, v_client_kind
   FROM tenants t WHERE t.id = p_tenant_id;
   IF v_tz IS NULL THEN RAISE EXCEPTION 'unknown tenant'; END IF;
+  IF v_client_kind !~ '^[a-z_]{2,32}$' THEN v_client_kind := 'customer'; END IF;
+
+  -- resolve the professional, in order of trust:
+  --   1. the id the caller sent (the one the visitor actually saw)
+  --   2. the tenant's configured default (settings->>'defaultAssigneeId')
+  --   3. whoever's working hours cover the slot
+  --
+  -- Step 2 is why this migration exists. Older published clients call this with
+  -- 7 named args, leaving p_assignee_id NULL, and step 3 then resolved to
+  -- "lowest assignee UUID" \u2014 an arbitrary instructor who had nothing to do with
+  -- the name the site displayed on the confirmation screen. The default gives
+  -- those clients a correct answer without waiting for a redeploy.
+  v_requested := COALESCE(
+    p_assignee_id,
+    (SELECT NULLIF(t.settings ->> 'defaultAssigneeId', '')::uuid
+       FROM tenants t WHERE t.id = p_tenant_id)
+  );
 
-  -- pick the assignee whose working hours cover the slot
-  SELECT sc.assignee_id INTO v_assignee
-  FROM schedules sc
-  WHERE sc.tenant_id = p_tenant_id
-    AND sc.kind = 'working_hours'
-    AND sc.is_active
-    AND (
-      sc.specific_date = (p_starts_at AT TIME ZONE v_tz)::date
-      OR (sc.specific_date IS NULL
-          AND sc.day_of_week = EXTRACT(dow FROM p_starts_at AT TIME ZONE v_tz)::smallint)
-    )
-    AND (p_starts_at AT TIME ZONE v_tz)::time >= sc.starts_at
-    AND (v_ends AT TIME ZONE v_tz)::time <= sc.ends_at
-  ORDER BY sc.assignee_id
+  SELECT w.assignee_id INTO v_assignee
+  FROM agenda_working_windows(
+         p_tenant_id, (p_starts_at AT TIME ZONE v_tz)::date, v_requested) w
+  WHERE (p_starts_at AT TIME ZONE v_tz)::time >= w.win_start
+    AND (v_ends AT TIME ZONE v_tz)::time <= w.win_end
+  ORDER BY w.assignee_id
   LIMIT 1;
   IF v_assignee IS NULL THEN RAISE EXCEPTION 'slot outside working hours'; END IF;
 
@@ -5021,19 +5953,16 @@ BEGIN
     RAISE EXCEPTION 'too many open bookings for this phone';
   END IF;
 
-  -- Upsert the customer by (tenant, phone). NOT ON CONFLICT: the partial unique
-  -- index this used to infer is gone (spine/110 \u2014 a placeholder phone is shared
-  -- by real, distinct people). 003 already settled the replacement: take a
-  -- per-(tenant, phone) advisory lock so two first-bookings serialise, then look
-  -- before inserting. Oldest match wins, so a returning caller keeps the record
-  -- that carries their history.
+  -- upsert the client by (tenant, kind, phone), serialized by advisory lock
+  -- (kind is tenant-configured, so the customer-only partial index can't
+  -- arbitrate)
   PERFORM pg_advisory_xact_lock(hashtextextended(p_tenant_id::text || ':' || v_phone, 1));
 
   SELECT p.id INTO v_person_id
-    FROM people p
-   WHERE p.tenant_id = p_tenant_id AND p.kind = 'customer' AND p.phone = v_phone
-   ORDER BY p.created_at
-   LIMIT 1;
+  FROM people p
+  WHERE p.tenant_id = p_tenant_id AND p.kind = v_client_kind AND p.phone = v_phone
+  ORDER BY p.created_at
+  LIMIT 1;
 
   IF v_person_id IS NOT NULL THEN
     UPDATE people SET
@@ -5043,7 +5972,7 @@ BEGIN
     WHERE id = v_person_id;
   ELSE
     INSERT INTO people (tenant_id, kind, name, phone, email, metadata)
-    VALUES (p_tenant_id, 'customer', trim(p_name), v_phone, p_email,
+    VALUES (p_tenant_id, v_client_kind, trim(p_name), v_phone, p_email,
             jsonb_build_object('source', 'public_booking'))
     RETURNING id INTO v_person_id;
   END IF;
@@ -5064,39 +5993,955 @@ BEGIN
           jsonb_build_object('source', 'public_booking', 'serviceNames', v_service.name))
   RETURNING id INTO v_booking;
 
-  INSERT INTO order_items (order_id, service_id, name, quantity, unit_price, total,
+  INSERT INTO items (order_id, service_id, name, quantity, unit_price, total,
                            sort_order, duration_minutes, assignee_id)
   VALUES (v_order, v_service.id, v_service.name, 1, v_service.price, v_service.price,
           0, v_service.duration_minutes, v_assignee);
 
   RETURN QUERY SELECT v_booking, p_starts_at, v_ends;
 END;
+$_$;
+
+CREATE FUNCTION public.get_available_slots(p_tenant_id uuid, p_date date, p_duration_minutes integer, p_assignee_id uuid DEFAULT NULL::uuid, p_slot_interval integer DEFAULT 30) RETURNS TABLE(slot_start timestamp with time zone, slot_end timestamp with time zone)
+    LANGUAGE plpgsql STABLE SECURITY DEFINER
+    SET search_path TO 'public'
+    AS $$
+DECLARE
+  v_tz text;
+BEGIN
+  -- tight validation: this function is anon-callable
+  IF p_duration_minutes IS NULL OR p_duration_minutes NOT BETWEEN 5 AND 480 THEN
+    RAISE EXCEPTION 'invalid duration';
+  END IF;
+  IF p_slot_interval IS NULL OR p_slot_interval NOT BETWEEN 5 AND 240 THEN
+    RAISE EXCEPTION 'invalid interval';
+  END IF;
+  IF p_date IS NULL OR p_date < current_date OR p_date > current_date + 90 THEN
+    RETURN;
+  END IF;
+
+  SELECT COALESCE(t.settings->>'timezone', 'America/Sao_Paulo') INTO v_tz
+  FROM tenants t WHERE t.id = p_tenant_id;
+  IF v_tz IS NULL THEN RETURN; END IF;  -- unknown tenant \u2192 empty, not an error
+
+  RETURN QUERY
+  WITH day_schedules AS (
+    SELECT w.assignee_id, w.win_start, w.win_end
+    FROM agenda_working_windows(p_tenant_id, p_date, p_assignee_id) w
+  ),
+  candidate AS (
+    SELECT
+      ds.assignee_id,
+      gs                                              AS s_start,
+      gs + make_interval(mins => p_duration_minutes)  AS s_end
+    FROM day_schedules ds
+    CROSS JOIN LATERAL generate_series(
+      (p_date + ds.win_start) AT TIME ZONE v_tz,
+      ((p_date + ds.win_end) AT TIME ZONE v_tz) - make_interval(mins => p_duration_minutes),
+      make_interval(mins => p_slot_interval)
+    ) AS gs
+  )
+  SELECT DISTINCT c.s_start, c.s_end
+  FROM candidate c
+  WHERE NOT EXISTS (
+    SELECT 1 FROM appointments b
+    WHERE b.tenant_id = p_tenant_id
+      -- SMART SYNC (gcal 002): this professional's own bookings OR any
+      -- tenant-wide BLOCK (assignee_id IS NULL AND kind='block') busy the slot.
+      AND (b.assignee_id = c.assignee_id
+           OR (b.assignee_id IS NULL AND b.kind = 'block'))
+      AND b.status NOT IN ('cancelled', 'no_show')
+      AND b.starts_at < c.s_end
+      AND COALESCE(b.ends_at, b.starts_at) > c.s_start
+  )
+  ORDER BY 1;
+END;
 $$;
 
-REVOKE ALL ON FUNCTION public.create_public_booking(uuid, uuid, timestamptz, text, text, text, text) FROM public;
-GRANT EXECUTE ON FUNCTION public.create_public_booking(uuid, uuid, timestamptz, text, text, text, text)
-  TO anon, authenticated, service_role;
+CREATE FUNCTION public.plg_booking_apply_channel_reply(p_booking_id uuid, p_action text, p_expect_tenant_id uuid DEFAULT NULL::uuid) RETURNS jsonb
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO 'public'
+    AS $$
+DECLARE
+  v_action  text := nullif(trim(lower(p_action)), '');
+  v_target  text;
+  v_row     record;
+  v_tz      text;
+  v_starts  timestamptz;
+  v_event   text;
+  v_payload jsonb;
+BEGIN
+  IF v_action IS NULL OR v_action NOT IN ('confirm', 'cancel') THEN
+    RETURN jsonb_build_object('result', 'not_allowed', 'reason', 'unknown_action');
+  END IF;
+  IF p_booking_id IS NULL THEN
+    RETURN jsonb_build_object('result', 'not_found', 'reason', 'no_booking_id');
+  END IF;
+
+  v_target := CASE WHEN v_action = 'confirm' THEN 'confirmed' ELSE 'cancelled' END;
+
+  -- FOR UPDATE, because two deliveries of the same tap race each other and the
+  -- loser must read the state the winner wrote, not the state both started from.
+  SELECT b.id, b.tenant_id, b.status, b.starts_at
+    INTO v_row
+    FROM public.appointments b
+   WHERE b.id = p_booking_id
+     FOR UPDATE;
+  IF NOT FOUND THEN
+    RETURN jsonb_build_object('result', 'not_found', 'booking_id', p_booking_id);
+  END IF;
+
+  IF p_expect_tenant_id IS NOT NULL AND v_row.tenant_id <> p_expect_tenant_id THEN
+    RETURN jsonb_build_object('result', 'not_found', 'booking_id', p_booking_id);
+  END IF;
+
+  -- Already there. The answer is the outcome, not an error: the customer sees
+  -- "confirmado" either way, and a webhook that 500s on a duplicate is a
+  -- webhook Tyxter retries eight times over a day and a half.
+  IF v_row.status = v_target THEN
+    RETURN jsonb_build_object(
+      'result', v_target, 'changed', false,
+      'booking_id', v_row.id, 'tenant_id', v_row.tenant_id, 'status', v_row.status);
+  END IF;
+
+  -- Confirming is only meaningful from the two states that mean "not settled
+  -- yet". 'pending' is the table's own DEFAULT and 'scheduled' is what every
+  -- write path sets, so both are live appointments awaiting the customer.
+  -- Confirming a completed or cancelled one would rewrite history.
+  IF v_action = 'confirm' AND v_row.status NOT IN ('pending', 'scheduled') THEN
+    RETURN jsonb_build_object(
+      'result', 'not_allowed', 'changed', false,
+      'booking_id', v_row.id, 'tenant_id', v_row.tenant_id, 'status', v_row.status);
+  END IF;
+
+  -- Cancelling is allowed from anything that has not already ENDED. A confirmed
+  -- appointment can still be cancelled \u2014 that is the ordinary case \u2014 but one
+  -- already cancelled or already completed cannot.
+  IF v_action = 'cancel' AND v_row.status IN ('cancelled', 'completed') THEN
+    RETURN jsonb_build_object(
+      'result', 'not_allowed', 'changed', false,
+      'booking_id', v_row.id, 'tenant_id', v_row.tenant_id, 'status', v_row.status);
+  END IF;
+
+  UPDATE public.appointments
+     SET status = v_target, updated_at = now()
+   WHERE id = v_row.id;
+
+  -- \u2500\u2500 the fact \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  -- Emitted HERE and not by the caller. The write happened in the database, so
+  -- the browser emitter never sees it (packages/db/migrations/027 is the whole
+  -- argument), and a webhook that updated the row and then failed to post the
+  -- event would leave a confirmed appointment nobody was told about.
+  --
+  -- The payload is BOOKING_FIELDS from plugin-agenda's message-events.ts, field
+  -- for field, so an automation reacting to a WhatsApp confirmation renders the
+  -- same message as one reacting to a confirmation made in the app.
+  SELECT COALESCE(t.settings->>'timezone', 'America/Sao_Paulo') INTO v_tz
+    FROM public.tenants t WHERE t.id = v_row.tenant_id;
+  v_tz := COALESCE(v_tz, 'America/Sao_Paulo');
+  v_starts := v_row.starts_at;
+
+  SELECT jsonb_build_object(
+      'customer_name',     COALESCE(a.client_name, ''),
+      'service_name',      COALESCE((
+        SELECT string_agg(s->>'name', ' + ')
+          FROM jsonb_array_elements(COALESCE(a.services::jsonb, '[]'::jsonb)) AS s), ''),
+      'professional_name', COALESCE(a.professional_name, ''),
+      'booking_date',      to_char(v_starts AT TIME ZONE v_tz, 'DD/MM/YYYY'),
+      'booking_time',      to_char(v_starts AT TIME ZONE v_tz, 'HH24:MI'),
+      'location_name',     COALESCE(a.location_name, ''),
+      'customer_phone',    COALESCE(a.client_phone, ''),
+      'source',            'channel_reply')
+    INTO v_payload
+    FROM public.v_appointments a
+   WHERE a.id = v_row.id;
+
+  v_event := CASE WHEN v_action = 'confirm'
+                  THEN 'agenda.booking_confirmed'
+                  ELSE 'agenda.booking_cancelled' END;
+
+  PERFORM public.plg_emit_event(
+    v_event,
+    COALESCE(v_payload, '{}'::jsonb),
+    'booking',
+    v_row.id::text,
+    v_row.tenant_id,
+    NULL);
+
+  RETURN jsonb_build_object(
+    'result', v_target, 'changed', true, 'event_key', v_event,
+    'booking_id', v_row.id, 'tenant_id', v_row.tenant_id,
+    'status', v_target, 'previous_status', v_row.status);
+END;
+$$;
+
+
+-- \u2500\u2500 view \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+CREATE VIEW public.v_appointments WITH (security_invoker='true') AS
+ SELECT b.id,
+    b.tenant_id,
+    b.kind,
+    b.starts_at,
+    b.ends_at,
+    b.status,
+    b.notes,
+    b.order_id,
+    b.location_id,
+    b.metadata,
+    b.created_at,
+    b.updated_at,
+    b.party_id AS client_id,
+    COALESCE(pc.name, (b.metadata ->> 'title'::text)) AS client_name,
+    pc.phone AS client_phone,
+    pc.email AS client_email,
+    pc.avatar_url AS client_avatar_url,
+    b.assignee_id AS professional_id,
+    ps.name AS professional_name,
+    ps.avatar_url AS professional_avatar_url,
+    l.name AS location_name,
+    o.total AS order_total,
+    o.status AS order_status,
+    ((EXTRACT(epoch FROM (COALESCE(b.ends_at, b.starts_at) - b.starts_at)))::integer / 60) AS total_duration_minutes,
+    o.reference_number,
+    o.status AS stage,
+    (o.metadata ->> 'direction'::text) AS direction,
+    ( SELECT json_agg(json_build_object('id', oi.id, 'serviceId', oi.product_id, 'name', oi.name, 'durationMinutes', oi.duration_minutes, 'price', oi.unit_price, 'assigneeId', oi.assignee_id) ORDER BY oi.sort_order) AS json_agg
+           FROM public.items oi
+          WHERE (oi.order_id = b.order_id)) AS services,
+    inv.status AS payment_status,
+    inv.paid AS order_paid,
+    inv.balance AS order_balance
+   FROM (((((public.appointments b
+     LEFT JOIN public.people pc ON ((pc.id = b.party_id)))
+     LEFT JOIN public.people ps ON ((ps.id = b.assignee_id)))
+     LEFT JOIN public.locations l ON ((l.id = b.location_id)))
+     LEFT JOIN public.orders o ON ((o.id = b.order_id)))
+     LEFT JOIN public.v_invoice_balances inv ON ((inv.invoice_id = b.order_id)));
+
+CREATE VIEW public.rep_appointments_by_period WITH (security_invoker='true') AS
+ SELECT tenant_id,
+    id AS booking_id,
+    (starts_at)::date AS date,
+    starts_at,
+    client_id,
+    client_name,
+    professional_id,
+    professional_name,
+    COALESCE(((services -> 0) ->> 'name'::text), ((services -> 0) ->> 'serviceName'::text)) AS service_name,
+    status,
+    order_total AS revenue,
+    created_at,
+    updated_at
+   FROM public.v_appointments b;
+
+CREATE VIEW public.plg_agenda_rep_bookings WITH (security_invoker='true') AS
+ SELECT tenant_id,
+    booking_id,
+    date,
+    starts_at,
+    client_id,
+    client_name,
+    professional_id,
+    professional_name,
+    service_name,
+    status,
+    revenue AS booked_revenue,
+        CASE
+            WHEN (status = ANY (ARRAY['cancelled'::text, 'no_show'::text])) THEN (0)::numeric
+            ELSE COALESCE(revenue, (0)::numeric)
+        END AS effective_revenue,
+        CASE
+            WHEN (status = ANY (ARRAY['cancelled'::text, 'no_show'::text])) THEN COALESCE(revenue, (0)::numeric)
+            ELSE (0)::numeric
+        END AS lost_revenue,
+        CASE
+            WHEN (status = 'completed'::text) THEN 1
+            ELSE 0
+        END AS is_completed,
+        CASE
+            WHEN (status = 'cancelled'::text) THEN 1
+            ELSE 0
+        END AS is_cancelled,
+        CASE
+            WHEN (status = 'no_show'::text) THEN 1
+            ELSE 0
+        END AS is_no_show,
+    created_at,
+    updated_at
+   FROM public.rep_appointments_by_period b;
+
+CREATE VIEW public.rep_confirmation_queue WITH (security_invoker='true') AS
+ SELECT tenant_id,
+    id AS booking_id,
+    (starts_at)::date AS date,
+    starts_at,
+    client_id,
+    client_name,
+    professional_id,
+    professional_name,
+    COALESCE(((services -> 0) ->> 'name'::text), ((services -> 0) ->> 'serviceName'::text)) AS service_name,
+    'pending'::text AS confirmation_status,
+    NULL::text AS confirmation_channel,
+    NULL::timestamp with time zone AS confirmation_sent_at,
+    NULL::timestamp with time zone AS confirmed_at,
+    created_at,
+    updated_at
+   FROM public.v_appointments b
+  WHERE ((status <> ALL (ARRAY['cancelled'::text, 'no_show'::text])) AND (starts_at >= (now() - '1 day'::interval)));
+
+CREATE VIEW public.rep_revenue_by_professional WITH (security_invoker='true') AS
+ SELECT tenant_id,
+    (starts_at)::date AS date,
+    professional_id,
+    COALESCE(professional_name, 'Sem profissional'::text) AS professional_name,
+    (count(*))::integer AS appointment_count,
+    (COALESCE(sum(NULLIF(order_total, (0)::numeric)), (0)::numeric))::numeric(14,2) AS total_revenue,
+    (COALESCE(avg(NULLIF(order_total, (0)::numeric)), (0)::numeric))::numeric(14,2) AS avg_ticket,
+    (0)::numeric(14,2) AS commission,
+    max(updated_at) AS updated_at
+   FROM public.v_appointments b
+  WHERE (status <> ALL (ARRAY['cancelled'::text, 'no_show'::text]))
+  GROUP BY tenant_id, ((starts_at)::date), professional_id, COALESCE(professional_name, 'Sem profissional'::text);
+
+CREATE VIEW public.rep_revenue_by_service WITH (security_invoker='true') AS
+ SELECT b.tenant_id,
+    (b.starts_at)::date AS date,
+    NULLIF((service_item.value ->> 'serviceId'::text), ''::text) AS service_id,
+    COALESCE((service_item.value ->> 'name'::text), (service_item.value ->> 'serviceName'::text), 'Sem servico'::text) AS service_name,
+    (count(DISTINCT b.id))::integer AS quantity,
+    (COALESCE(sum((NULLIF((service_item.value ->> 'price'::text), ''::text))::numeric), (0)::numeric))::numeric(14,2) AS total_revenue,
+    (COALESCE(avg((NULLIF((service_item.value ->> 'price'::text), ''::text))::numeric), (0)::numeric))::numeric(14,2) AS avg_ticket,
+    max(b.updated_at) AS updated_at
+   FROM (public.v_appointments b
+     CROSS JOIN LATERAL jsonb_array_elements(COALESCE((b.services)::jsonb, '[]'::jsonb)) service_item(value))
+  WHERE (b.status <> ALL (ARRAY['cancelled'::text, 'no_show'::text]))
+  GROUP BY b.tenant_id, ((b.starts_at)::date), NULLIF((service_item.value ->> 'serviceId'::text), ''::text), COALESCE((service_item.value ->> 'name'::text), (service_item.value ->> 'serviceName'::text), 'Sem servico'::text);
+
+CREATE VIEW public.v_appointments_sem_order WITH (security_invoker='true') AS
+ SELECT id AS appointment_id,
+    tenant_id,
+    unit_id,
+    kind,
+    status,
+    party_id,
+    assignee_id,
+    starts_at
+   FROM public.appointments a
+  WHERE ((order_id IS NULL) AND (status = ANY (ARRAY['completed'::text, 'invoiced'::text, 'paid'::text])));
+
+CREATE VIEW public.v_public_services AS
+ SELECT id,
+    tenant_id,
+    name,
+    description,
+    price,
+    currency,
+    COALESCE(duration_minutes, 30) AS duration_minutes,
+    image_url,
+    COALESCE(((metadata ->> 'sort_order'::text))::integer, 0) AS sort_order
+   FROM public.products s
+  WHERE ((kind = 'service'::text) AND is_active AND (status = 'active'::text) AND COALESCE(((metadata ->> 'bookableOnline'::text))::boolean, true) AND (NOT (EXISTS ( SELECT 1
+           FROM app.resource_grants g
+          WHERE ((g.tenant_id = s.tenant_id) AND (g.resource_type = 'catalog.product'::text) AND (g.resource_id = s.id) AND (g.relation = 'available_in'::text))))));
+
+
+-- \u2500\u2500 acl \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
 
-SELECT app.reattach_view_dependents();
+REVOKE ALL ON FUNCTION public.agenda_assert_service_is_public(p_tenant_id uuid, p_service_id uuid) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.agenda_assert_service_is_public(p_tenant_id uuid, p_service_id uuid) TO service_role;
+
+REVOKE ALL ON FUNCTION public.agenda_booking_cancel(p_appointment_id uuid, p_hard boolean) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.agenda_booking_cancel(p_appointment_id uuid, p_hard boolean) TO authenticated;
+GRANT ALL ON FUNCTION public.agenda_booking_cancel(p_appointment_id uuid, p_hard boolean) TO service_role;
+
+REVOKE ALL ON FUNCTION public.agenda_booking_create(p_starts_at timestamp with time zone, p_ends_at timestamp with time zone, p_lines jsonb, p_party_id uuid, p_assignee_id uuid, p_unit_id uuid, p_location_id uuid, p_kind text, p_notes text, p_metadata jsonb, p_idempotency_key text) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.agenda_booking_create(p_starts_at timestamp with time zone, p_ends_at timestamp with time zone, p_lines jsonb, p_party_id uuid, p_assignee_id uuid, p_unit_id uuid, p_location_id uuid, p_kind text, p_notes text, p_metadata jsonb, p_idempotency_key text) TO authenticated;
+GRANT ALL ON FUNCTION public.agenda_booking_create(p_starts_at timestamp with time zone, p_ends_at timestamp with time zone, p_lines jsonb, p_party_id uuid, p_assignee_id uuid, p_unit_id uuid, p_location_id uuid, p_kind text, p_notes text, p_metadata jsonb, p_idempotency_key text) TO service_role;
+
+REVOKE ALL ON FUNCTION public.agenda_booking_invoice(p_appointment_id uuid, p_installments integer, p_due_date date) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.agenda_booking_invoice(p_appointment_id uuid, p_installments integer, p_due_date date) TO authenticated;
+GRANT ALL ON FUNCTION public.agenda_booking_invoice(p_appointment_id uuid, p_installments integer, p_due_date date) TO service_role;
+
+REVOKE ALL ON FUNCTION public.agenda_booking_update(p_appointment_id uuid, p_starts_at timestamp with time zone, p_ends_at timestamp with time zone, p_status text, p_party_id uuid, p_assignee_id uuid, p_location_id uuid, p_notes text, p_metadata jsonb, p_lines jsonb) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.agenda_booking_update(p_appointment_id uuid, p_starts_at timestamp with time zone, p_ends_at timestamp with time zone, p_status text, p_party_id uuid, p_assignee_id uuid, p_location_id uuid, p_notes text, p_metadata jsonb, p_lines jsonb) TO authenticated;
+GRANT ALL ON FUNCTION public.agenda_booking_update(p_appointment_id uuid, p_starts_at timestamp with time zone, p_ends_at timestamp with time zone, p_status text, p_party_id uuid, p_assignee_id uuid, p_location_id uuid, p_notes text, p_metadata jsonb, p_lines jsonb) TO service_role;
+
+REVOKE ALL ON FUNCTION public.agenda_working_windows(p_tenant_id uuid, p_date date, p_assignee_id uuid) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.agenda_working_windows(p_tenant_id uuid, p_date date, p_assignee_id uuid) TO authenticated;
+GRANT ALL ON FUNCTION public.agenda_working_windows(p_tenant_id uuid, p_date date, p_assignee_id uuid) TO service_role;
+
+REVOKE ALL ON FUNCTION public.agent_agenda_create_appointment(p_tenant_id uuid, p_actor_user_id uuid, p_payload jsonb) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.agent_agenda_create_appointment(p_tenant_id uuid, p_actor_user_id uuid, p_payload jsonb) TO authenticated;
+GRANT ALL ON FUNCTION public.agent_agenda_create_appointment(p_tenant_id uuid, p_actor_user_id uuid, p_payload jsonb) TO service_role;
+
+REVOKE ALL ON FUNCTION public.agent_agenda_update_appointment(p_tenant_id uuid, p_actor_user_id uuid, p_payload jsonb) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.agent_agenda_update_appointment(p_tenant_id uuid, p_actor_user_id uuid, p_payload jsonb) TO authenticated;
+GRANT ALL ON FUNCTION public.agent_agenda_update_appointment(p_tenant_id uuid, p_actor_user_id uuid, p_payload jsonb) TO service_role;
+
+REVOKE ALL ON FUNCTION public.create_public_booking(p_tenant_id uuid, p_service_id uuid, p_starts_at timestamp with time zone, p_name text, p_phone text, p_email text, p_notes text, p_assignee_id uuid) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.create_public_booking(p_tenant_id uuid, p_service_id uuid, p_starts_at timestamp with time zone, p_name text, p_phone text, p_email text, p_notes text, p_assignee_id uuid) TO authenticated;
+GRANT ALL ON FUNCTION public.create_public_booking(p_tenant_id uuid, p_service_id uuid, p_starts_at timestamp with time zone, p_name text, p_phone text, p_email text, p_notes text, p_assignee_id uuid) TO service_role;
+GRANT ALL ON FUNCTION public.create_public_booking(p_tenant_id uuid, p_service_id uuid, p_starts_at timestamp with time zone, p_name text, p_phone text, p_email text, p_notes text, p_assignee_id uuid) TO anon;
+
+REVOKE ALL ON FUNCTION public.get_available_slots(p_tenant_id uuid, p_date date, p_duration_minutes integer, p_assignee_id uuid, p_slot_interval integer) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.get_available_slots(p_tenant_id uuid, p_date date, p_duration_minutes integer, p_assignee_id uuid, p_slot_interval integer) TO authenticated;
+GRANT ALL ON FUNCTION public.get_available_slots(p_tenant_id uuid, p_date date, p_duration_minutes integer, p_assignee_id uuid, p_slot_interval integer) TO service_role;
+GRANT ALL ON FUNCTION public.get_available_slots(p_tenant_id uuid, p_date date, p_duration_minutes integer, p_assignee_id uuid, p_slot_interval integer) TO anon;
+
+REVOKE ALL ON FUNCTION public.plg_booking_apply_channel_reply(p_booking_id uuid, p_action text, p_expect_tenant_id uuid) FROM PUBLIC;
+GRANT ALL ON FUNCTION public.plg_booking_apply_channel_reply(p_booking_id uuid, p_action text, p_expect_tenant_id uuid) TO service_role;
+
+GRANT MAINTAIN ON TABLE public.v_appointments TO anon;
+GRANT ALL ON TABLE public.v_appointments TO authenticated;
+GRANT ALL ON TABLE public.v_appointments TO service_role;
+
+GRANT MAINTAIN ON TABLE public.rep_appointments_by_period TO anon;
+GRANT ALL ON TABLE public.rep_appointments_by_period TO authenticated;
+GRANT ALL ON TABLE public.rep_appointments_by_period TO service_role;
+
+GRANT MAINTAIN ON TABLE public.plg_agenda_rep_bookings TO anon;
+GRANT ALL ON TABLE public.plg_agenda_rep_bookings TO authenticated;
+GRANT ALL ON TABLE public.plg_agenda_rep_bookings TO service_role;
+
+GRANT MAINTAIN ON TABLE public.rep_confirmation_queue TO anon;
+GRANT ALL ON TABLE public.rep_confirmation_queue TO authenticated;
+GRANT ALL ON TABLE public.rep_confirmation_queue TO service_role;
+
+GRANT MAINTAIN ON TABLE public.rep_revenue_by_professional TO anon;
+GRANT ALL ON TABLE public.rep_revenue_by_professional TO authenticated;
+GRANT ALL ON TABLE public.rep_revenue_by_professional TO service_role;
+
+GRANT MAINTAIN ON TABLE public.rep_revenue_by_service TO anon;
+GRANT ALL ON TABLE public.rep_revenue_by_service TO authenticated;
+GRANT ALL ON TABLE public.rep_revenue_by_service TO service_role;
+
+GRANT MAINTAIN ON TABLE public.v_appointments_sem_order TO anon;
+GRANT ALL ON TABLE public.v_appointments_sem_order TO authenticated;
+GRANT ALL ON TABLE public.v_appointments_sem_order TO service_role;
+
+GRANT SELECT,MAINTAIN ON TABLE public.v_public_services TO anon;
+GRANT ALL ON TABLE public.v_public_services TO authenticated;
+GRANT ALL ON TABLE public.v_public_services TO service_role;
+
+
+-- \u2500\u2500 comment \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+COMMENT ON FUNCTION public.agenda_booking_create(p_starts_at timestamp with time zone, p_ends_at timestamp with time zone, p_lines jsonb, p_party_id uuid, p_assignee_id uuid, p_unit_id uuid, p_location_id uuid, p_kind text, p_notes text, p_metadata jsonb, p_idempotency_key text) IS 'A booking, its Venda and its lines in one transaction (PRD 06). Replaces the three browser calls createBooking used to make \u2014 closing the tab between them is what left an order nobody could find.';
+
+COMMENT ON FUNCTION public.agenda_booking_invoice(p_appointment_id uuid, p_installments integer, p_due_date date) IS 'Bill a booking in one call (PRD 06). The bridge used to read the order in the browser and then call the invoice RPC; here the lookup and the promotion are one transaction.';
+
+COMMENT ON VIEW public.v_appointments_sem_order IS 'Appointments that reached a billable state with no Venda behind them (PRD 06). An unbilled appointment is legitimate; a COMPLETED one with nothing commercial attached is the 72% hole the V1 has, arriving early enough to stop.';
+
+COMMENT ON VIEW public.v_public_services IS 'Anonymous booking catalog. Owner-rights on purpose (anon has no tenant claim), so the release rule is written into the body: only services with no available_in tuple are public \u2014 see #201.';
+
+
+-- \u2500\u2500 default privileges: restore \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- Put back, so the NEXT thing installed inherits what the chain had.
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON FUNCTIONS TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT MAINTAIN ON TABLES TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT MAINTAIN ON TABLES TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO postgres$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO anon$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO anon$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO authenticated$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin IN SCHEMA public GRANT ALL ON TABLES TO service_role$stmt$;
+END $dp$;
+
+DO $dp$ BEGIN
+  EXECUTE $stmt$--
+-- PostgreSQL database dump complete
+--$stmt$;
+EXCEPTION WHEN insufficient_privilege OR undefined_object THEN
+  RAISE NOTICE 'baseline: not ours to set \u2014 %', $stmt$--
+-- PostgreSQL database dump complete
+--$stmt$;
+END $dp$;
+`;
+var MIGRATION_001_THE_CONNECTOR_DEFINERS_KEEP_A_PINNED_PATH = `-- ---------------------------------------------------------------------------
+-- 001_the_connector_definers_keep_a_pinned_path \u2014 the half of 019 the squash
+-- could not photograph (#283, #338).
+--
+-- 019 pinned \`search_path\` on every SECURITY DEFINER function this plugin owns,
+-- including \`fn_gcal_push_booking\`, which the GOOGLE CALENDAR CONNECTOR creates.
+-- Connector SQL is its own ledger source: it is not in chain.json, so it is not
+-- in the schema \`emit-baseline\` photographs, so 000_baseline.sql cannot carry
+-- the pin the way it carries the other 40.
+--
+-- Without this file a fresh install applies the connector's own 001-005, which
+-- create the function unpinned, and nothing ever pins it again \u2014 a definer
+-- function resolving names the caller's way, which is the exact shape #283
+-- exists to close. So 019's loop stays a migration.
+--
+-- Idempotent by construction: it pins only what is unpinned, and skips the
+-- function entirely on an install without the connector.
+-- ---------------------------------------------------------------------------
+
+DO $pin$
+DECLARE
+  v_fn     record;
+  v_pinned integer := 0;
+BEGIN
+  FOR v_fn IN
+    SELECT p.oid, p.proname, pg_get_function_identity_arguments(p.oid) AS args
+      FROM pg_proc p
+      JOIN pg_namespace n ON n.oid = p.pronamespace
+     WHERE n.nspname = 'public'
+       AND p.prosecdef
+       AND p.proname = ANY (ARRAY['create_public_booking', 'fn_gcal_push_booking'])
+       AND NOT EXISTS (
+         SELECT 1 FROM unnest(coalesce(p.proconfig, ARRAY[]::text[])) AS cfg
+          WHERE cfg LIKE 'search\\_path=%'
+       )
+  LOOP
+    -- \`public, pg_catalog\`, not '': these bodies read public objects by bare
+    -- name and were written that way. What closes the hole is that the path is
+    -- FIXED rather than inherited \u2014 the booking path is called by an anonymous
+    -- shopper, and that caller's path should count for nothing.
+    EXECUTE format('ALTER FUNCTION public.%I(%s) SET search_path = public, pg_catalog',
+                   v_fn.proname, v_fn.args);
+    v_pinned := v_pinned + 1;
+  END LOOP;
+  IF v_pinned > 0 THEN
+    RAISE NOTICE 'plugin-agenda: pinned search_path on % connector definer function(s)', v_pinned;
+  END IF;
+END $pin$;
+`;
+var MIGRATION_002_THE_APPOINTMENT_NAMES_THE_UNIT = `-- ============================================================================
+-- 002_the_appointment_names_the_unit \u2014 v_appointments leaves the locations
+-- projection (#214 / #352).
+--
+-- The view LEFT JOINed public.locations, a compat projection of app.units. A
+-- view is a HARD dependency, so this join is what made the projection
+-- undroppable by the spine \u2014 which runs first and cannot remove a name a
+-- plugin applied later still selects.
+--
+-- The view is already security_invoker and app.units already grants SELECT to
+-- authenticated under its own RLS, so nothing about who sees which appointment
+-- changes: the same policy decides, one relation earlier.
+-- ============================================================================
+
+CREATE OR REPLACE VIEW public.v_appointments WITH (security_invoker='true') AS
+ SELECT b.id,
+    b.tenant_id,
+    b.kind,
+    b.starts_at,
+    b.ends_at,
+    b.status,
+    b.notes,
+    b.order_id,
+    b.location_id,
+    b.metadata,
+    b.created_at,
+    b.updated_at,
+    b.party_id AS client_id,
+    COALESCE(pc.name, (b.metadata ->> 'title'::text)) AS client_name,
+    pc.phone AS client_phone,
+    pc.email AS client_email,
+    pc.avatar_url AS client_avatar_url,
+    b.assignee_id AS professional_id,
+    ps.name AS professional_name,
+    ps.avatar_url AS professional_avatar_url,
+    l.name AS location_name,
+    o.total AS order_total,
+    o.status AS order_status,
+    ((EXTRACT(epoch FROM (COALESCE(b.ends_at, b.starts_at) - b.starts_at)))::integer / 60) AS total_duration_minutes,
+    o.reference_number,
+    o.status AS stage,
+    (o.metadata ->> 'direction'::text) AS direction,
+    ( SELECT json_agg(json_build_object('id', oi.id, 'serviceId', oi.product_id, 'name', oi.name, 'durationMinutes', oi.duration_minutes, 'price', oi.unit_price, 'assigneeId', oi.assignee_id) ORDER BY oi.sort_order) AS json_agg
+           FROM public.items oi
+          WHERE (oi.order_id = b.order_id)) AS services,
+    inv.status AS payment_status,
+    inv.paid AS order_paid,
+    inv.balance AS order_balance
+   FROM (((((public.appointments b
+     LEFT JOIN public.people pc ON ((pc.id = b.party_id)))
+     LEFT JOIN public.people ps ON ((ps.id = b.assignee_id)))
+     LEFT JOIN app.units l ON ((l.id = b.location_id)))
+     LEFT JOIN public.orders o ON ((o.id = b.order_id)))
+     LEFT JOIN public.v_invoice_balances inv ON ((inv.invoice_id = b.order_id)));`;
+var MIGRATION_003_THE_CLIENT_ARRIVES_BEFORE_BEING_SERVED = `-- 003_the_client_arrives_before_being_served.sql
+--
+-- Falta um estado entre "confirmado" e "em atendimento": AGUARDANDO.
+--
+-- \xC9 o estado que o check-in produz \u2014 a cliente chegou, est\xE1 na recep\xE7\xE3o, ainda
+-- n\xE3o sentou na cadeira. Hoje o ciclo do \`appointment\` vai de \`confirmed\`
+-- direto para \`in_progress\`, e quem recebe \xE9 obrigado a escolher entre mentir
+-- (dizer que j\xE1 est\xE1 em atendimento) ou n\xE3o registrar nada. As duas respostas
+-- apagam a informa\xE7\xE3o que a recep\xE7\xE3o mais usa: quem j\xE1 est\xE1 aqui.
+--
+-- No V1 esse estado existe e \xE9 o padr\xE3o da tela de check-in, ao lado de
+-- \`scheduled\`, \`confirmed\` e \`in_progress\`. Port\xE1-lo \xE9 o que permite a tela
+-- fazer sentido \u2014 sem ele, "fazer check-in" n\xE3o teria o que gravar.
+--
+-- Entra em \`appointment\` e em \`service_order\`: s\xE3o a mesma coisa com nomes
+-- diferentes, e uma ordem de servi\xE7o tamb\xE9m tem algu\xE9m esperando.
+
+UPDATE public.order_kinds
+   SET statuses = (
+         SELECT array_agg(DISTINCT s ORDER BY s)
+           FROM unnest(coalesce(statuses, ARRAY[]::text[]) || ARRAY['waiting']) AS s
+       ),
+       updated_at = now()
+ WHERE kind IN ('appointment', 'service_order')
+   AND NOT ('waiting' = ANY (coalesce(statuses, ARRAY[]::text[])));
+`;
+var MIGRATION_004_THE_APPOINTMENT_CARRIES_ITS_UNIT = `-- 004_the_appointment_carries_its_unit.sql
+--
+-- Um agendamento criado PELA TELA nasce com \`unit_id\` NULO: o formul\xE1rio coleta
+-- o local e o provider nunca envia a unidade. E \`location_id\` j\xE1 \xC9 uma unidade \u2014
+-- aponta para o mesmo \`app.units\`.
+--
+-- O efeito n\xE3o \xE9 cosm\xE9tico. O escopo por unidade \xE9 o que faz a recep\xE7\xE3o de uma
+-- filial ver a fila DELA; uma linha sem unidade n\xE3o \xE9 filtrada por unidade
+-- nenhuma, ent\xE3o ela aparece para TODAS. Num tenant de franquia \u2014 e a rede
+-- sint\xE9tica tem seis unidades \u2014 isso \xE9 atendimento de uma filial vis\xEDvel na
+-- recep\xE7\xE3o da outra.
+--
+-- Apareceu numa jornada real: duas clientes no mesmo dia, uma marcada pela tela
+-- (sem unidade) e outra com unidade; a recep\xE7\xE3o de Norte \u2014 Centro via a primeira
+-- e n\xE3o a segunda. O filtro estava certo. O dado \xE9 que chegava incompleto.
+--
+-- POR QUE GATILHO, E N\xC3O S\xD3 O CAMPO NO PROVIDER. O provider \xE9 um escritor entre
+-- v\xE1rios: o agente cria agendamento, a importa\xE7\xE3o cria, o totem cria. Corrigir
+-- s\xF3 a tela deixaria os outros escrevendo linha sem unidade \u2014 e o furo \xE9 de
+-- VISIBILIDADE, que n\xE3o se conserta pela metade.
+CREATE OR REPLACE FUNCTION public.trg_agenda_stamp_unit()
+  RETURNS trigger
+  LANGUAGE plpgsql
+AS $$
+BEGIN
+  IF NEW.unit_id IS NULL AND NEW.location_id IS NOT NULL THEN
+    NEW.unit_id := NEW.location_id;
+  END IF;
+  RETURN NEW;
+END $$;
+
+COMMENT ON FUNCTION public.trg_agenda_stamp_unit() IS
+  'Carimba a unidade do agendamento a partir do local, que \xE9 a mesma app.units. Sem ela a linha escapa do escopo por unidade e aparece para todas as filiais (004).';
+
+DROP TRIGGER IF EXISTS appointments_stamp_unit ON public.appointments;
+CREATE TRIGGER appointments_stamp_unit
+  BEFORE INSERT OR UPDATE OF location_id, unit_id ON public.appointments
+  FOR EACH ROW
+  EXECUTE FUNCTION public.trg_agenda_stamp_unit();
+
+-- \u2500\u2500 e os que j\xE1 nasceram sem \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+UPDATE public.appointments
+   SET unit_id = location_id
+ WHERE unit_id IS NULL AND location_id IS NOT NULL;
+`;
+var MIGRATION_005_THE_QUEUE_KNOWS_HOW_LONG_SHE_WAITED = `-- 005_the_queue_knows_how_long_she_waited.sql
+--
+-- A fila mostra QUEM chegou e n\xE3o H\xC1 QUANTO TEMPO. Quem est\xE1 esperando h\xE1
+-- quarenta minutos e quem acabou de entrar aparecem iguais, e \xE9 justamente essa
+-- diferen\xE7a que decide quem a recep\xE7\xE3o chama primeiro.
+--
+-- O V1 mede por \`checked_in_at\`, e o coment\xE1rio dele explica por que n\xE3o serve
+-- \`updated_at\`: qualquer edi\xE7\xE3o no agendamento o reescreve, ent\xE3o trocar uma
+-- observa\xE7\xE3o \xE0s 14h faria a cliente que chegou \xE0s 13h parecer rec\xE9m-chegada. Um
+-- rel\xF3gio que qualquer coisa reinicia n\xE3o \xE9 rel\xF3gio.
+--
+-- O carimbo \xE9 do BANCO, e n\xE3o da tela: quem faz check-in pode ser a recep\xE7\xE3o
+-- pelo navegador, o totem, ou o pr\xF3prio agente. Tr\xEAs escritores, um s\xF3 instante
+-- verdadeiro \u2014 e o rel\xF3gio do servidor \xE9 o \xFAnico que os tr\xEAs compartilham.
+ALTER TABLE public.appointments
+  ADD COLUMN IF NOT EXISTS checked_in_at timestamptz;
+
+COMMENT ON COLUMN public.appointments.checked_in_at IS
+  'Quando a pessoa CHEGOU. N\xE3o use updated_at para isso: qualquer edi\xE7\xE3o o reescreve e o tempo de espera mente (005).';
+
+-- \u2500\u2500 e o carimbo acontece na transi\xE7\xE3o, n\xE3o no cliente \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+CREATE OR REPLACE FUNCTION public.trg_agenda_stamp_checkin()
+  RETURNS trigger
+  LANGUAGE plpgsql
+AS $$
+BEGIN
+  -- S\xF3 na ENTRADA em waiting: reentrar no estado (uma corre\xE7\xE3o de status, um
+  -- salvamento qualquer) n\xE3o pode reiniciar a espera de quem j\xE1 est\xE1 sentada.
+  IF NEW.status = 'waiting' AND (TG_OP = 'INSERT' OR OLD.status IS DISTINCT FROM 'waiting')
+     AND NEW.checked_in_at IS NULL THEN
+    NEW.checked_in_at := now();
+  END IF;
+  RETURN NEW;
+END $$;
+
+COMMENT ON FUNCTION public.trg_agenda_stamp_checkin() IS
+  'Carimba a chegada ao ENTRAR em waiting, uma vez. Reentrar no estado n\xE3o reinicia a espera (005).';
+
+DROP TRIGGER IF EXISTS appointments_stamp_checkin ON public.appointments;
+CREATE TRIGGER appointments_stamp_checkin
+  BEFORE INSERT OR UPDATE OF status ON public.appointments
+  FOR EACH ROW
+  EXECUTE FUNCTION public.trg_agenda_stamp_checkin();
+
+-- Quem j\xE1 est\xE1 esperando desde antes deste arquivo herda o \xFAltimo instante
+-- conhecido \u2014 impreciso, e ainda assim melhor que um travess\xE3o.
+UPDATE public.appointments
+   SET checked_in_at = updated_at
+ WHERE status = 'waiting' AND checked_in_at IS NULL;
+`;
+var MIGRATION_006_THE_AGENDA_STOPS_PRICING_EVERY_INVOICE = `-- ---------------------------------------------------------------------------
+-- 006_the_agenda_stops_pricing_every_invoice.sql \u2014 ler DOIS agendamentos deixa
+-- de custar a apura\xE7\xE3o de 8.134 faturas.
+--
+-- O SINTOMA: \`GET /rest/v1/v_appointments?...\` devolvendo 500 com
+-- \`57014: canceling statement due to statement timeout\`, de forma reprodut\xEDvel,
+-- ao abrir a agenda depois que existe agendamento na semana. Enquanto a semana
+-- estava vazia a mesma consulta respondia em 12ms \u2014 o que escondeu o problema e
+-- fez ele parecer intermitente.
+--
+-- \u2500\u2500 A medi\xE7\xE3o \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- EXPLAIN ANALYZE da consulta exata, com 2 agendamentos na janela:
+--
+--     Nested Loop Left Join            actual time=17137..21252  rows=2
+--       Join Filter: (o_1.id = b.order_id)
+--       Rows Removed by Join Filter: 16268          \u2190 dezesseis mil
+--       ->  Nested Loop  ...           actual time=5619..10590  rows=8134 loops=2
+--     Execution Time: 21272 ms
+--
+-- \`v_invoice_balances\` foi calculada POR INTEIRO \u2014 as 8.134 faturas do tenant \u2014
+-- e DUAS VEZES, uma por agendamento. S\xF3 depois o \`Join Filter\` jogou fora
+-- 16.268 das 16.270 linhas para ficar com as 2 que interessavam.
+--
+-- \u2500\u2500 Por que o filtro n\xE3o desceu \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- A view fazia:
+--
+--     LEFT JOIN v_invoice_balances inv ON inv.invoice_id = b.order_id
+--
+-- Isso \xE9 um JOIN entre duas rela\xE7\xF5es, n\xE3o um filtro constante. O planejador n\xE3o
+-- tem por onde empurrar \`b.order_id\` para dentro de um agregado do outro lado:
+-- ele precisa produzir o lado direito inteiro para ent\xE3o casar as chaves. E o
+-- lado direito \xE9 um \`GROUP BY order_id\` sobre a \xE1rvore financeira inteira
+-- (faturas \u2192 parcelas \u2192 aloca\xE7\xF5es \u2192 movimentos), cada n\xEDvel pagando a RLS por
+-- linha. 8.134 linhas \xD7 ~0,45ms de pol\xEDtica \xD7 tr\xEAs n\xEDveis \xE9 o or\xE7amento todo.
+--
+-- \u2500\u2500 A corre\xE7\xE3o \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- \`LEFT JOIN LATERAL\`. A correla\xE7\xE3o deixa de ser uma condi\xE7\xE3o de join e vira um
+-- PAR\xC2METRO da subconsulta: \`WHERE vb.invoice_id = b.order_id\` \xE9 avaliado com
+-- \`b.order_id\` j\xE1 conhecido, e \`invoice_id\` \xE9 exatamente a chave de agrupamento
+-- de \`v_invoice_balances\` (\`GROUP BY t.order_id\`, depois \`o.id = tb.order_id\`).
+-- Um qual sobre a chave de agrupamento desce por baixo do agregado, e o que
+-- era uma varredura de 8.134 faturas vira uma sondagem de \xEDndice de UMA.
+--
+-- Nada muda no que a view devolve: mesmas colunas, mesma ordem, mesmos tipos \u2014
+-- \`LEFT JOIN LATERAL \u2026 ON true\` tem exatamente a sem\xE2ntica do LEFT JOIN que
+-- substitui, inclusive o NULL quando n\xE3o h\xE1 fatura.
+--
+-- \u2500\u2500 O que esta migration N\xC3O conserta \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- O multiplicador continua sendo a RLS por linha (~0,45ms por linha por
+-- tabela). Aqui ele deixa de doer porque o n\xFAmero de linhas cai de 8.134 para
+-- 1, n\xE3o porque ficou barato. Qualquer outra leitura que varra as tabelas
+-- financeiras inteiras vai reencontr\xE1-lo \u2014 ver 016 e 019 para a forma de tirar
+-- pergunta constante de dentro do la\xE7o.
+--
+-- MORA NA CORRENTE DA AGENDA, e n\xE3o na do n\xFAcleo, porque redefine
+-- \`v_appointments\` \u2014 view da agenda \u2014 lendo \`v_invoice_balances\`, view do
+-- financeiro. A corrente \xE9 n\xFAcleo \u2192 financeiro \u2192 \u2026 \u2192 agenda, ent\xE3o este \xE9 o
+-- \xFAnico degrau em que as duas j\xE1 existem. Nascida como 021 no n\xFAcleo, ela
+-- falhava no \`apply\` com "relation v_invoice_balances does not exist", e o
+-- db-from-zero foi quem disse isso em voz alta.
+-- ---------------------------------------------------------------------------
+
+-- \`WITH (security_invoker = true)\` expl\xEDcito: \`CREATE OR REPLACE VIEW\` N\xC3O
+-- herda as op\xE7\xF5es da view que substitui, e sem isto ela volta a rodar com os
+-- direitos do dono \u2014 as pol\xEDticas de quem l\xEA deixam de valer. \xC9 o que a
+-- asser\xE7\xE3o N16 da postura grada, e foi ela que pegou.
+CREATE OR REPLACE VIEW public.v_appointments WITH (security_invoker = true) AS
+ SELECT b.id,
+    b.tenant_id,
+    b.kind,
+    b.starts_at,
+    b.ends_at,
+    b.status,
+    b.notes,
+    b.order_id,
+    b.location_id,
+    b.metadata,
+    b.created_at,
+    b.updated_at,
+    b.party_id AS client_id,
+    COALESCE(pc.name, b.metadata ->> 'title'::text) AS client_name,
+    pc.phone AS client_phone,
+    pc.email AS client_email,
+    pc.avatar_url AS client_avatar_url,
+    b.assignee_id AS professional_id,
+    ps.name AS professional_name,
+    ps.avatar_url AS professional_avatar_url,
+    l.name AS location_name,
+    o.total AS order_total,
+    o.status AS order_status,
+    EXTRACT(epoch FROM COALESCE(b.ends_at, b.starts_at) - b.starts_at)::integer / 60 AS total_duration_minutes,
+    o.reference_number,
+    o.status AS stage,
+    o.metadata ->> 'direction'::text AS direction,
+    ( SELECT json_agg(json_build_object('id', oi.id, 'serviceId', oi.product_id, 'name', oi.name, 'durationMinutes', oi.duration_minutes, 'price', oi.unit_price, 'assigneeId', oi.assignee_id) ORDER BY oi.sort_order) AS json_agg
+           FROM items oi
+          WHERE oi.order_id = b.order_id) AS services,
+    inv.status AS payment_status,
+    inv.paid AS order_paid,
+    inv.balance AS order_balance
+   FROM appointments b
+     LEFT JOIN people pc ON pc.id = b.party_id
+     LEFT JOIN people ps ON ps.id = b.assignee_id
+     LEFT JOIN app.units l ON l.id = b.location_id
+     LEFT JOIN orders o ON o.id = b.order_id
+     -- LATERAL e n\xE3o JOIN: assim \`b.order_id\` \xE9 PAR\xC2METRO da subconsulta e o
+     -- filtro desce por baixo do \`GROUP BY order_id\` de v_invoice_balances.
+     -- Como JOIN, o agregado inteiro (8.134 faturas) era produzido por
+     -- agendamento e descartado depois \u2014 21s para devolver 2 linhas.
+     LEFT JOIN LATERAL (
+       SELECT vb.status, vb.paid, vb.balance
+         FROM v_invoice_balances vb
+        WHERE vb.invoice_id = b.order_id
+        LIMIT 1
+     ) inv ON true;
 `;
+var MIGRATIONS = [
+  { id: "000_baseline", sql: MIGRATION_000_BASELINE },
+  { id: "001_the_connector_definers_keep_a_pinned_path", sql: MIGRATION_001_THE_CONNECTOR_DEFINERS_KEEP_A_PINNED_PATH },
+  { id: "002_the_appointment_names_the_unit", sql: MIGRATION_002_THE_APPOINTMENT_NAMES_THE_UNIT },
+  { id: "003_the_client_arrives_before_being_served", sql: MIGRATION_003_THE_CLIENT_ARRIVES_BEFORE_BEING_SERVED },
+  { id: "004_the_appointment_carries_its_unit", sql: MIGRATION_004_THE_APPOINTMENT_CARRIES_ITS_UNIT },
+  { id: "005_the_queue_knows_how_long_she_waited", sql: MIGRATION_005_THE_QUEUE_KNOWS_HOW_LONG_SHE_WAITED },
+  { id: "006_the_agenda_stops_pricing_every_invoice", sql: MIGRATION_006_THE_AGENDA_STOPS_PRICING_EVERY_INVOICE }
+];
 function computeCommissionAmount(total, ratePercent) {
   const base = Number(total) || 0;
   const rate = Number(ratePercent) || 0;
   if (base <= 0 || rate <= 0) return 0;
   return Math.round(base * (rate / 100) * 100) / 100;
 }
-function computeStatus(movements) {
-  if (movements.length === 0) return "none";
-  const allPaid = movements.every((m) => m.status === "paid");
-  if (allPaid) return "paid";
-  const allCancelled = movements.every((m) => m.status === "cancelled");
-  if (allCancelled) return "cancelled";
-  const anyOverdue = movements.some((m) => m.status === "overdue");
-  if (anyOverdue) return "overdue";
-  const anyPaid = movements.some((m) => m.status === "paid" || m.status === "partial");
-  if (anyPaid) return "partial";
-  return "pending";
-}
 function createFinancialBridge(provider2) {
   return {
     async resolvePaymentStatuses(orderIds) {
@@ -5105,26 +6950,14 @@ function createFinancialBridge(provider2) {
       const supabase = getSupabaseClientOptional();
       if (!supabase) return result;
       try {
-        const [{ data: orders }, { data: movements }] = await Promise.all([
-          supabase.from("orders").select("id, kind, status, total, reference_number, metadata").in("id", orderIds),
-          supabase.from("plg_financial_movements").select("invoice_id, status, paid_amount").in("invoice_id", orderIds)
-        ]);
-        const movementsByOrderId = /* @__PURE__ */ new Map();
-        for (const movement of movements ?? []) {
-          const invoiceId = movement.invoice_id;
-          if (!invoiceId) continue;
-          movementsByOrderId.set(invoiceId, [...movementsByOrderId.get(invoiceId) ?? [], movement]);
-        }
-        for (const order of orders ?? []) {
-          const orderMovements = movementsByOrderId.get(order.id) ?? [];
-          const meta = order.metadata ?? {};
-          const paidAmount = orderMovements.length > 0 ? orderMovements.reduce((sum, movement) => sum + (Number(movement.paid_amount) || 0), 0) : Number(meta.paidAmount) || 0;
-          result.set(order.id, {
-            invoiceId: order.id,
-            referenceNumber: order.reference_number,
-            status: orderMovements.length > 0 ? computeStatus(orderMovements) : mapInvoiceStatus(order.status),
-            totalAmount: Number(order.total) || 0,
-            paidAmount
+        const { data: rows } = await supabase.from("v_order_payment_status").select("order_id, order_status, reference_number, total_amount, paid_amount, status").in("order_id", orderIds);
+        for (const row of rows ?? []) {
+          result.set(row.order_id, {
+            invoiceId: row.order_id,
+            referenceNumber: row.reference_number,
+            status: row.status === "none" ? mapInvoiceStatus(row.order_status) : row.status,
+            totalAmount: Number(row.total_amount) || 0,
+            paidAmount: Number(row.paid_amount) || 0
           });
         }
       } catch {
@@ -5134,13 +6967,12 @@ function createFinancialBridge(provider2) {
     async getPaymentDetail(orderId) {
       const supabase = getSupabaseClientOptional();
       if (!supabase) return null;
-      const [orderRes, movRes] = await Promise.all([
-        supabase.from("orders").select("id, status, total, reference_number, metadata").eq("id", orderId).single(),
+      const [headRes, movRes] = await Promise.all([
+        supabase.from("v_order_payment_status").select("order_id, order_status, reference_number, total_amount, paid_amount, status").eq("order_id", orderId).single(),
         supabase.from("plg_financial_movements").select("*").eq("invoice_id", orderId).order("due_date")
       ]);
-      const order = orderRes.data;
+      const order = headRes.data;
       if (!order) return null;
-      const meta = order.metadata ?? {};
       const typeIds = [...new Set((movRes.data ?? []).map((m) => m.payment_method_type_id).filter(Boolean))];
       let typeNames = {};
       if (typeIds.length > 0) {
@@ -5160,11 +6992,11 @@ function createFinancialBridge(provider2) {
         cardInstallments: m.card_installments ? Number(m.card_installments) : void 0
       }));
       return {
-        invoiceId: order.id,
+        invoiceId: order.order_id,
         referenceNumber: order.reference_number,
-        status: movements.length > 0 ? computeStatus(movements) : mapInvoiceStatus(order.status),
-        totalAmount: Number(order.total) || 0,
-        paidAmount: Number(meta.paidAmount) || 0,
+        status: order.status === "none" ? mapInvoiceStatus(order.order_status) : order.status,
+        totalAmount: Number(order.total_amount) || 0,
+        paidAmount: Number(order.paid_amount) || 0,
         movements
       };
     },
@@ -5196,11 +7028,11 @@ function createFinancialBridge(provider2) {
     async createCommissionMovement(orderId, options) {
       const supabase = getSupabaseClientOptional();
       if (!supabase) return null;
-      const { data: order } = await supabase.from("orders").select("id, tenant_id, assignee_id, total").eq("id", orderId).single();
-      if (!order || !order.assignee_id) return null;
-      const { data: staff } = await supabase.from("v_professional_rates").select("commission_rate").eq("id", order.assignee_id).single();
+      const { data: order } = await supabase.from("v_appointments").select("order_id, tenant_id, professional_id, order_total").eq("order_id", orderId).limit(1).maybeSingle();
+      if (!order || !order.professional_id) return null;
+      const { data: staff } = await supabase.from("v_professional_rates").select("commission_rate").eq("id", order.professional_id).single();
       const rate = Number(staff?.commission_rate) || 0;
-      const base = Number(order.total) || 0;
+      const base = Number(order.order_total) || 0;
       const amount = computeCommissionAmount(base, rate);
       if (amount <= 0) return null;
       const { data: existing } = await supabase.from("plg_financial_movements").select("id").eq("invoice_id", orderId).eq("movement_kind", "commission").limit(1);
@@ -5219,7 +7051,7 @@ function createFinancialBridge(provider2) {
         metadata: {
           source: "agenda",
           kind: "commission",
-          professionalId: order.assignee_id,
+          professionalId: order.professional_id,
           commissionRate: rate,
           baseAmount: base
         }
@@ -5382,7 +7214,7 @@ function createGoogleCalendarProvider() {
         calendarId: data.calendar_id ?? "primary",
         active: isIntegrationActive(data),
         // The sync state row existing is not the same as the clinic having
-        // authorized Google — `plg_connections` owns that answer now, and the
+        // authorized Google — `connections` owns that answer now, and the
         // connector asks it through the connection store.
         connected: isIntegrationActive(data),
         lastSyncAt: data.last_sync_at ?? void 0
@@ -6179,7 +8011,7 @@ var googleCalendarConnectorDef = {
   /**
    * The DETAIL screen, where health is worth a round-trip.
    *
-   * Two questions, in order, and they are not the same one: `plg_connections`
+   * Two questions, in order, and they are not the same one: `connections`
    * says whether the clinic authorized Google, and ./health.ts says whether the
    * sync is actually working. Asking only the second is what let a connection
    * read as "conectado" off a token timestamp; asking only the first would
@@ -8153,7 +9985,7 @@ function createAgendaPlugin(options) {
       return locations;
     } : void 0
   });
-  const PageComponent = () => React13.createElement(AgendaPage, { config, provider: provider2, store });
+  const PageComponent = () => React11.createElement(AgendaPage, { config, provider: provider2, store });
   return {
     id: "agenda",
     defaultAgentRole: "frontdesk",
@@ -8179,7 +10011,7 @@ function createAgendaPlugin(options) {
     // Os FATOS da agenda — só expostos enquanto o módulo está ATIVO.
     events: buildAgendaDomainEvents(),
     declaredFeatures: [
-      { id: "appointments", label: config.labels.pageTitle, group: config.labels.pageTitle },
+      { id: "agenda", label: config.labels.pageTitle, group: config.labels.pageTitle },
       { id: "agenda.schedules", label: "Schedule Management", group: config.labels.pageTitle }
     ],
     // Recurring monthly quota — counts appointment rows created this month.
@@ -8195,7 +10027,7 @@ function createAgendaPlugin(options) {
           name: "Appointment",
           namePlural: "Appointments",
           icon: "Calendar",
-          permission: { feature: "appointments", action: "read" },
+          permission: { feature: "agenda", action: "read" },
           // Keys are the PROVIDER's output shape (camelCase) — what filters/
           // dateField/groupBy match against, not the raw DB columns.
           fields: [
@@ -8230,6 +10062,16 @@ function createAgendaPlugin(options) {
         audits: true
       }
     ],
+    // GATED ON `agenda.*`, NOT `appointments.*`.
+    //
+    // Both exist in the permission catalog for the same capability, and the two
+    // never aliased: RLS on public.appointments/schedules is keyed on `agenda.*`
+    // (migration 043) and 37 roles hold `agenda.read`, while only the 13 owner
+    // roles — which got everything — hold `appointments.read`. So the UI was
+    // hiding from a receptionist exactly what the database would have let her
+    // read: no Agenda, no Check-in, and "acesso restrito" on a screen built for
+    // her. app.v1_permission_map records this divergence and maps V1's
+    // `checkin_dashboard` to `agenda.read`.
     navigation: [
       {
         section: options?.navSection ?? "main",
@@ -8237,17 +10079,45 @@ function createAgendaPlugin(options) {
         label: config.labels.pageTitle,
         route: "/agenda",
         icon: "Calendar",
-        permission: { feature: "appointments", action: "read" }
-      }
+        permission: { feature: "agenda", action: "read" }
+      },
+      // AO LADO da Agenda, e não dentro dela: a recepção abre esta tela e fica
+      // nela a manhã inteira. A rota é `/checkin` e não `/agenda/checkin` de
+      // propósito — a casca agrupa num menu suspenso tudo que compartilha o
+      // prefixo da rota, e sob `/agenda` o check-in virava um item escondido
+      // atrás de um clique na Agenda, que é o oposto de entrada dedicada.
+      ...options?.checkin ? [{
+        section: options?.navSection ?? "main",
+        position: (options?.navPosition ?? 2) + 0.5,
+        label: "Check-in",
+        route: "/checkin",
+        icon: "LogIn",
+        permission: { feature: "agenda", action: "read" }
+      }] : []
     ],
     routes: [
       {
         path: "/agenda",
         component: PageComponent,
-        permission: { feature: "appointments", action: "read" },
+        permission: { feature: "agenda", action: "read" },
         // Matches the ref agent_agenda_create_appointment returns.
         entityRoutes: ["schedule:appointment"]
-      }
+      },
+      ...options?.checkin ? [{
+        path: "/checkin",
+        component: (() => React11.createElement(CheckinPage, {
+          config,
+          provider: provider2,
+          store,
+          onReceive: options?.onCheckinReceive ? (b) => options.onCheckinReceive({ id: b.id, orderId: b.orderId, clientName: b.clientName }) : void 0
+          // `onOpenBooking` fica de FORA de propósito: sem ele a fila abre o
+          // formulário nela mesma. Mandar para /agenda tirava a recepção da
+          // tela em que ela está trabalhando para corrigir um horário, e a
+          // volta ficava por conta dela. O host ainda pode passar o seu
+          // quando quiser outro destino.
+        })),
+        permission: { feature: "agenda", action: "read" }
+      }] : []
     ],
     widgets: [],
     aiTools: [
@@ -8270,7 +10140,7 @@ function createAgendaPlugin(options) {
           { label: "Show me tomorrow's appointments" },
           { label: "Who has the most bookings this week?" }
         ],
-        permission: { feature: "appointments", action: "read" }
+        permission: { feature: "agenda", action: "read" }
       },
       {
         id: "agenda.create-appointment",
@@ -8295,7 +10165,7 @@ function createAgendaPlugin(options) {
         suggestions: [
           { label: "Book a haircut for Sarah tomorrow at 10am" }
         ],
-        permission: { feature: "appointments", action: "create" }
+        permission: { feature: "agenda", action: "create" }
       },
       {
         id: "agenda.update-appointment",
@@ -8324,7 +10194,7 @@ function createAgendaPlugin(options) {
           { label: "Remarca o Gustavo para 16:30" },
           { label: "Cancela o atendimento das 10h" }
         ],
-        permission: { feature: "appointments", action: "edit" }
+        permission: { feature: "agenda", action: "edit" }
       },
       {
         id: "agenda.check-availability",
@@ -8346,7 +10216,7 @@ function createAgendaPlugin(options) {
           { label: "When is Ana available tomorrow?" },
           { label: "Find a 90-minute slot for Carlos this week" }
         ],
-        permission: { feature: "appointments", action: "read" }
+        permission: { feature: "agenda", action: "read" }
       }
     ],
     registries,
@@ -8357,9 +10227,9 @@ function createAgendaPlugin(options) {
         icon: "Calendar",
         // Standard layout: General | Integrations (Google Calendar addon) | Properties.
         component: (() => {
-          const AgendaSettingsTab = () => React13.createElement(PluginSettingsPanel, {
+          const AgendaSettingsTab = () => React11.createElement(PluginSettingsPanel, {
             title: "Agenda",
-            generalSettings: React13.createElement(AgendaGeneralSettings),
+            generalSettings: React11.createElement(AgendaGeneralSettings),
             registries,
             hostPluginId: "agenda",
             routeBase: "/settings/agenda"
@@ -8368,17 +10238,18 @@ function createAgendaPlugin(options) {
           return AgendaSettingsTab;
         })(),
         order: 5,
-        permission: { feature: "appointments", action: "read" }
-      }
-    ],
-    migrations: [
-      {
-        id: "agenda-001-public-booking",
-        version: "0.3.0",
-        sql: MIGRATION_001_PUBLIC_BOOKING,
-        description: "Booking read model (v_appointments) + anon public booking surface (v_public_services, get_available_slots, create_public_booking) + order_items duration/assignee columns"
+        permission: { feature: "agenda", action: "read" }
       }
     ],
+    // Every file, not just the first. The manifest declared one of twenty-one
+    // until Phase 2 put this plugin in the canonical chain — a plugin whose SQL
+    // is outside its manifest is a plugin whose tables are a coincidence.
+    migrations: MIGRATIONS.map((m) => ({
+      id: `agenda-${m.id}`,
+      version: "1.0.0",
+      sql: m.sql,
+      description: m.id
+    })),
     // Google Calendar is the connector this module's addon already ships;
     // Calendly and WhatsApp are the two the Fayz plugin page has been
     // promising since the catalogue was written.