@fayz-ai/plugin-agenda 0.2.0 → 0.3.0

package/dist/index.js

@@ -1,3 +1,5 @@
+import { createMockAgendaProvider } from './chunk-DRZF6CV2.js';
+export { createMockAgendaProvider } from './chunk-DRZF6CV2.js';
 import { setAgendaTenantId, getAgendaTenantId } from './chunk-3LJKZQK4.js';
 import React12, { useState, useEffect, useRef, useMemo, useCallback } from 'react';
 import { getSupabaseClientOptional, registerTranslations, createSafeDataProvider, usePluginRuntimeOptional, useTranslation, getActiveTenantId, getCurrentLocale, formatCurrency } from '@fayz-ai/core';
@@ -3873,10 +3875,10 @@ function createSupabaseAgendaProvider() {
     },
     async getConfirmationsPending(daysAhead = 2) {
       const { pub } = getClients();
-      const now2 = (/* @__PURE__ */ new Date()).toISOString();
+      const now = (/* @__PURE__ */ new Date()).toISOString();
       const cutoff = /* @__PURE__ */ new Date();
       cutoff.setDate(cutoff.getDate() + daysAhead);
-      const { data, error } = await pub.from("v_bookings").select("*").eq("status", "scheduled").gte("starts_at", now2).lte("starts_at", cutoff.toISOString()).order("starts_at");
+      const { data, error } = await pub.from("v_bookings").select("*").eq("status", "scheduled").gte("starts_at", now).lte("starts_at", cutoff.toISOString()).order("starts_at");
       if (error) throw error;
       return (data ?? []).map(mapBooking);
     },
@@ -3901,423 +3903,6 @@ function createSupabaseAgendaProvider() {
     }
   };
 }
-
-// src/data/mock.ts
-var nextId = 1;
-function uid() {
-  return `mock-${nextId++}`;
-}
-function now() {
-  return (/* @__PURE__ */ new Date()).toISOString();
-}
-function addMinutes2(date, minutes) {
-  const d = new Date(date);
-  d.setMinutes(d.getMinutes() + minutes);
-  return d.toISOString();
-}
-function timeOverlaps(aStart, aEnd, bStart, bEnd) {
-  return aStart < bEnd && aEnd > bStart;
-}
-var SAMPLE_PROFESSIONALS = [
-  { id: "prof-1", name: "Ana Silva", avatarUrl: null, locationId: "loc-1", locationName: "Main Branch", isActive: true },
-  { id: "prof-2", name: "Carlos Santos", avatarUrl: null, locationId: "loc-1", locationName: "Main Branch", isActive: true },
-  { id: "prof-3", name: "Maria Oliveira", avatarUrl: null, locationId: "loc-1", locationName: "Main Branch", isActive: true }
-];
-function createSampleBookings() {
-  const today = /* @__PURE__ */ new Date();
-  const year = today.getFullYear();
-  const month = today.getMonth();
-  const day = today.getDate();
-  function dt(hour, minute = 0) {
-    return new Date(year, month, day, hour, minute).toISOString();
-  }
-  return [
-    {
-      id: "bk-1",
-      tenantId: "mock",
-      kind: "appointment",
-      startsAt: dt(9, 0),
-      endsAt: dt(10, 30),
-      status: "confirmed",
-      notes: null,
-      orderId: "ord-1",
-      locationId: "loc-1",
-      metadata: {},
-      clientId: "cl-1",
-      clientName: "Sarah Johnson",
-      clientPhone: "(11) 99999-1111",
-      clientEmail: "sarah@email.com",
-      clientAvatarUrl: null,
-      professionalId: "prof-1",
-      professionalName: "Ana Silva",
-      professionalAvatarUrl: null,
-      locationName: "Main Branch",
-      orderTotal: 250,
-      orderStatus: "draft",
-      services: [{ id: "bi-1", serviceId: "svc-1", name: "Balayage", durationMinutes: 90, price: 250, assigneeId: "prof-1" }],
-      totalDurationMinutes: 90,
-      createdAt: now(),
-      updatedAt: now()
-    },
-    {
-      id: "bk-2",
-      tenantId: "mock",
-      kind: "appointment",
-      startsAt: dt(10, 0),
-      endsAt: dt(11, 0),
-      status: "scheduled",
-      notes: null,
-      orderId: "ord-2",
-      locationId: "loc-1",
-      metadata: {},
-      clientId: "cl-2",
-      clientName: "Emily Carter",
-      clientPhone: "(11) 99999-2222",
-      clientEmail: "emily@email.com",
-      clientAvatarUrl: null,
-      professionalId: "prof-2",
-      professionalName: "Carlos Santos",
-      professionalAvatarUrl: null,
-      locationName: "Main Branch",
-      orderTotal: 80,
-      orderStatus: "draft",
-      services: [{ id: "bi-2", serviceId: "svc-2", name: "Haircut", durationMinutes: 60, price: 80, assigneeId: "prof-2" }],
-      totalDurationMinutes: 60,
-      createdAt: now(),
-      updatedAt: now()
-    },
-    {
-      id: "bk-3",
-      tenantId: "mock",
-      kind: "appointment",
-      startsAt: dt(14, 0),
-      endsAt: dt(15, 0),
-      status: "confirmed",
-      notes: "First visit",
-      orderId: "ord-3",
-      locationId: "loc-1",
-      metadata: {},
-      clientId: "cl-3",
-      clientName: "Rachel Kim",
-      clientPhone: "(11) 99999-3333",
-      clientEmail: null,
-      clientAvatarUrl: null,
-      professionalId: "prof-3",
-      professionalName: "Maria Oliveira",
-      professionalAvatarUrl: null,
-      locationName: "Main Branch",
-      orderTotal: 120,
-      orderStatus: "draft",
-      services: [{ id: "bi-3", serviceId: "svc-3", name: "Facial Treatment", durationMinutes: 60, price: 120, assigneeId: "prof-3" }],
-      totalDurationMinutes: 60,
-      createdAt: now(),
-      updatedAt: now()
-    },
-    {
-      id: "bk-4",
-      tenantId: "mock",
-      kind: "appointment",
-      startsAt: dt(11, 0),
-      endsAt: dt(12, 0),
-      status: "scheduled",
-      notes: null,
-      orderId: "ord-4",
-      locationId: "loc-1",
-      metadata: {},
-      clientId: "cl-4",
-      clientName: "Jessica Lima",
-      clientPhone: "(11) 99999-4444",
-      clientEmail: null,
-      clientAvatarUrl: null,
-      professionalId: "prof-1",
-      professionalName: "Ana Silva",
-      professionalAvatarUrl: null,
-      locationName: "Main Branch",
-      orderTotal: 60,
-      orderStatus: "draft",
-      services: [{ id: "bi-4", serviceId: "svc-4", name: "Manicure", durationMinutes: 60, price: 60, assigneeId: "prof-1" }],
-      totalDurationMinutes: 60,
-      createdAt: now(),
-      updatedAt: now()
-    },
-    {
-      id: "bk-5",
-      tenantId: "mock",
-      kind: "appointment",
-      startsAt: dt(15, 30),
-      endsAt: dt(17, 0),
-      status: "confirmed",
-      notes: null,
-      orderId: "ord-5",
-      locationId: "loc-1",
-      metadata: {},
-      clientId: "cl-5",
-      clientName: "Amanda Wright",
-      clientPhone: "(11) 99999-5555",
-      clientEmail: "amanda@email.com",
-      clientAvatarUrl: null,
-      professionalId: "prof-2",
-      professionalName: "Carlos Santos",
-      professionalAvatarUrl: null,
-      locationName: "Main Branch",
-      orderTotal: 350,
-      orderStatus: "draft",
-      services: [
-        { id: "bi-5", serviceId: "svc-1", name: "Highlights", durationMinutes: 60, price: 200, assigneeId: "prof-2" },
-        { id: "bi-6", serviceId: "svc-2", name: "Haircut", durationMinutes: 30, price: 150, assigneeId: "prof-2" }
-      ],
-      totalDurationMinutes: 90,
-      createdAt: now(),
-      updatedAt: now()
-    }
-  ];
-}
-function createSampleSchedules() {
-  const schedules = [];
-  for (const prof of SAMPLE_PROFESSIONALS) {
-    for (let day = 1; day <= 5; day++) {
-      schedules.push({
-        id: uid(),
-        tenantId: "mock",
-        kind: "working_hours",
-        assigneeId: prof.id,
-        locationId: prof.locationId,
-        dayOfWeek: day,
-        specificDate: null,
-        startsAt: "08:00",
-        endsAt: "12:00",
-        isActive: true,
-        metadata: {}
-      });
-      schedules.push({
-        id: uid(),
-        tenantId: "mock",
-        kind: "working_hours",
-        assigneeId: prof.id,
-        locationId: prof.locationId,
-        dayOfWeek: day,
-        specificDate: null,
-        startsAt: "13:00",
-        endsAt: "18:00",
-        isActive: true,
-        metadata: {}
-      });
-    }
-    schedules.push({
-      id: uid(),
-      tenantId: "mock",
-      kind: "working_hours",
-      assigneeId: prof.id,
-      locationId: prof.locationId,
-      dayOfWeek: 6,
-      specificDate: null,
-      startsAt: "08:00",
-      endsAt: "14:00",
-      isActive: true,
-      metadata: {}
-    });
-  }
-  return schedules;
-}
-function createMockAgendaProvider(options) {
-  const seed = options?.seed;
-  const bookings = seed?.bookings ? [...seed.bookings] : createSampleBookings();
-  const schedules = seed?.schedules ? [...seed.schedules] : createSampleSchedules();
-  const professionals = seed?.professionals ? [...seed.professionals] : [...SAMPLE_PROFESSIONALS];
-  return {
-    async getLocations() {
-      return [];
-    },
-    async getBookings(query) {
-      return bookings.filter((b) => {
-        if (query.kind && b.kind !== query.kind) return false;
-        if (query.statuses?.length && !query.statuses.includes(b.status)) return false;
-        if (query.professionalIds?.length && !query.professionalIds.includes(b.professionalId ?? "")) return false;
-        if (query.locationId && b.locationId !== query.locationId) return false;
-        if (query.dateRange) {
-          if (b.startsAt > query.dateRange.end || (b.endsAt ?? b.startsAt) < query.dateRange.start) return false;
-        }
-        return true;
-      });
-    },
-    async getBookingById(id) {
-      return bookings.find((b) => b.id === id) ?? null;
-    },
-    async createBooking(input) {
-      const totalDuration = input.services.reduce((sum, s) => sum + s.durationMinutes, 0);
-      const totalPrice = input.services.reduce((sum, s) => sum + s.price, 0);
-      const booking = {
-        id: uid(),
-        tenantId: "mock",
-        kind: input.kind ?? "appointment",
-        startsAt: input.startsAt,
-        endsAt: addMinutes2(input.startsAt, totalDuration || 30),
-        status: "scheduled",
-        notes: input.notes ?? null,
-        orderId: input.services.length > 0 ? uid() : null,
-        locationId: input.locationId ?? null,
-        metadata: {},
-        clientId: input.clientId,
-        clientName: input.title?.trim() || "New Client",
-        clientPhone: null,
-        clientEmail: null,
-        clientAvatarUrl: null,
-        professionalId: input.professionalId,
-        professionalName: professionals.find((p) => p.id === input.professionalId)?.name ?? "Unknown",
-        professionalAvatarUrl: null,
-        locationName: null,
-        orderTotal: totalPrice,
-        orderStatus: "draft",
-        services: input.services.map((s) => ({
-          id: uid(),
-          serviceId: s.serviceId,
-          name: s.name,
-          durationMinutes: s.durationMinutes,
-          price: s.price,
-          assigneeId: s.assigneeId ?? input.professionalId
-        })),
-        totalDurationMinutes: totalDuration,
-        createdAt: now(),
-        updatedAt: now()
-      };
-      bookings.push(booking);
-      return booking;
-    },
-    async updateBooking(id, data) {
-      const idx = bookings.findIndex((b) => b.id === id);
-      if (idx === -1) throw new Error("Booking not found");
-      const existing = bookings[idx];
-      const serviceUpdates = {};
-      if (data.services) {
-        serviceUpdates.services = data.services.map((s) => ({
-          id: uid(),
-          serviceId: s.serviceId,
-          name: s.name,
-          durationMinutes: s.durationMinutes,
-          price: s.price,
-          assigneeId: s.assigneeId ?? existing.professionalId ?? ""
-        }));
-        serviceUpdates.totalDurationMinutes = data.services.reduce((sum, s) => sum + s.durationMinutes, 0);
-        serviceUpdates.orderTotal = data.services.reduce((sum, s) => sum + s.price, 0);
-      }
-      const updated = {
-        ...existing,
-        ...data.startsAt && { startsAt: data.startsAt },
-        ...data.endsAt && { endsAt: data.endsAt },
-        ...data.title !== void 0 && { clientName: data.title },
-        ...data.status && { status: data.status },
-        ...data.notes !== void 0 && { notes: data.notes ?? null },
-        ...data.professionalId && { professionalId: data.professionalId },
-        ...data.clientId && { clientId: data.clientId },
-        ...data.locationId && { locationId: data.locationId },
-        ...serviceUpdates,
-        updatedAt: now()
-      };
-      bookings[idx] = updated;
-      return updated;
-    },
-    async deleteBooking(id) {
-      const idx = bookings.findIndex((b) => b.id === id);
-      if (idx !== -1) bookings.splice(idx, 1);
-    },
-    async updateBookingStatus(id, status) {
-      const idx = bookings.findIndex((b) => b.id === id);
-      if (idx === -1) throw new Error("Booking not found");
-      bookings[idx] = { ...bookings[idx], status, updatedAt: now() };
-      return bookings[idx];
-    },
-    async checkConflict(params) {
-      return bookings.some((b) => {
-        if (params.excludeBookingId && b.id === params.excludeBookingId) return false;
-        if (b.professionalId !== params.assigneeId) return false;
-        if (b.status === "cancelled" || b.status === "no_show") return false;
-        return timeOverlaps(b.startsAt, b.endsAt ?? b.startsAt, params.startsAt, params.endsAt);
-      });
-    },
-    async getAvailableSlots(params) {
-      const date = new Date(params.date);
-      const dayOfWeek = date.getDay();
-      const interval = params.slotInterval ?? 30;
-      const daySchedules = schedules.filter(
-        (s) => s.assigneeId === params.assigneeId && s.isActive && (s.dayOfWeek === dayOfWeek || s.specificDate === params.date)
-      );
-      const slots = [];
-      for (const sched of daySchedules) {
-        const [startH, startM] = sched.startsAt.split(":").map(Number);
-        const [endH, endM] = sched.endsAt.split(":").map(Number);
-        const schedStart = new Date(date);
-        schedStart.setHours(startH, startM, 0, 0);
-        const schedEnd = new Date(date);
-        schedEnd.setHours(endH, endM, 0, 0);
-        let slotStart = new Date(schedStart);
-        while (true) {
-          const slotEnd = new Date(slotStart.getTime() + params.durationMinutes * 6e4);
-          if (slotEnd > schedEnd) break;
-          const startIso = slotStart.toISOString();
-          const endIso = slotEnd.toISOString();
-          const hasConflict = bookings.some((b) => {
-            if (b.professionalId !== params.assigneeId) return false;
-            if (b.status === "cancelled" || b.status === "no_show") return false;
-            return timeOverlaps(b.startsAt, b.endsAt ?? b.startsAt, startIso, endIso);
-          });
-          if (!hasConflict) {
-            slots.push({ start: startIso, end: endIso });
-          }
-          slotStart = new Date(slotStart.getTime() + interval * 6e4);
-        }
-      }
-      return slots;
-    },
-    async getSchedules(professionalId) {
-      if (professionalId) return schedules.filter((s) => s.assigneeId === professionalId);
-      return [...schedules];
-    },
-    async saveSchedule(input) {
-      const schedule = {
-        id: uid(),
-        tenantId: "mock",
-        kind: "working_hours",
-        assigneeId: input.assigneeId,
-        locationId: input.locationId ?? null,
-        dayOfWeek: input.dayOfWeek ?? null,
-        specificDate: input.specificDate ?? null,
-        startsAt: input.startsAt,
-        endsAt: input.endsAt,
-        isActive: input.isActive !== false,
-        metadata: input.metadata ?? {}
-      };
-      schedules.push(schedule);
-      return schedule;
-    },
-    async deleteSchedule(id) {
-      const idx = schedules.findIndex((s) => s.id === id);
-      if (idx !== -1) schedules.splice(idx, 1);
-    },
-    async getProfessionals() {
-      return [...professionals];
-    },
-    async getConfirmationsPending(daysAhead = 2) {
-      const cutoff = /* @__PURE__ */ new Date();
-      cutoff.setDate(cutoff.getDate() + daysAhead);
-      return bookings.filter(
-        (b) => b.status === "scheduled" && new Date(b.startsAt) <= cutoff && new Date(b.startsAt) >= /* @__PURE__ */ new Date()
-      );
-    },
-    async sendConfirmation(bookingId, channel) {
-      const booking = bookings.find((b) => b.id === bookingId);
-      if (!booking) throw new Error("Booking not found");
-      const confirmations = booking.metadata.confirmations ?? [];
-      confirmations.push({ channel, sentAt: now(), status: "sent" });
-      booking.metadata = { ...booking.metadata, confirmations };
-    },
-    async completeBooking(bookingId) {
-      const idx = bookings.findIndex((b) => b.id === bookingId);
-      if (idx === -1) throw new Error("Booking not found");
-      bookings[idx] = { ...bookings[idx], status: "completed", updatedAt: now() };
-      return { booking: bookings[idx], orderId: bookings[idx].orderId ?? "" };
-    }
-  };
-}
 function getCurrentBookingQuery(state, dateRange = state.dateRange) {
   return {
     dateRange,
@@ -5066,6 +4651,287 @@ var agendaLocales = {
   en,
   "pt-BR": ptBR
 };
+
+// src/migrations/index.ts
+var MIGRATION_001_PUBLIC_BOOKING = `-- ============================================================================
+-- plugin-agenda 001: booking read model + public (anon) booking surface
+--
+-- Ships the objects the agenda providers reference but the spine (packages/db
+-- migrations 001\u2013008) does not define:
+--   \xA71  order_items columns the admin provider writes (duration/assignee)
+--   \xA72  public.v_bookings        \u2014 admin read model (authenticated, RLS applies)
+--   \xA73  public.v_public_services \u2014 anon-readable service catalog
+--   \xA74  public.get_available_slots      \u2014 anon RPC (mirrors the mock algorithm)
+--   \xA75  public.create_public_booking    \u2014 anon RPC (validated, race-safe write)
+--
+-- Anon-access design: public booking pages run with the publishable key and no
+-- session, so the canonical tenant RLS yields nothing. Anon access is granted
+-- ONLY via the column-whitelisted view (\xA73) and SECURITY DEFINER RPCs (\xA74, \xA75)
+-- with tight input validation and hardcoded statuses.
+-- ============================================================================
+
+-- \xA71 \u2014 columns the agenda provider writes but 004_archetypes lacks
+ALTER TABLE saas_core.order_items
+  ADD COLUMN IF NOT EXISTS duration_minutes integer,
+  ADD COLUMN IF NOT EXISTS assignee_id uuid REFERENCES saas_core.persons(id) ON DELETE SET NULL;
+
+-- Upsert key for public customers (per tenant, by normalized phone)
+CREATE UNIQUE INDEX IF NOT EXISTS persons_tenant_customer_phone
+  ON saas_core.persons(tenant_id, phone)
+  WHERE kind = 'customer' AND phone IS NOT NULL;
+
+-- Slot-conflict scan
+CREATE INDEX IF NOT EXISTS bookings_assignee_time
+  ON saas_core.bookings(assignee_id, starts_at, ends_at)
+  WHERE status NOT IN ('cancelled', 'no_show');
+
+-- \xA72 \u2014 admin read model (security_invoker \u2192 underlying RLS applies; anon sees 0 rows)
+CREATE OR REPLACE VIEW public.v_bookings
+WITH (security_invoker = true) AS
+SELECT
+  b.id, b.tenant_id, b.kind, b.starts_at, b.ends_at, b.status, b.notes,
+  b.order_id, b.location_id, b.metadata, b.created_at, b.updated_at,
+  b.party_id                              AS client_id,
+  COALESCE(pc.name, b.metadata->>'title') AS client_name,
+  pc.phone                                AS client_phone,
+  pc.email                                AS client_email,
+  pc.avatar_url                           AS client_avatar_url,
+  b.assignee_id                           AS professional_id,
+  ps.name                                 AS professional_name,
+  ps.avatar_url                           AS professional_avatar_url,
+  l.name                                  AS location_name,
+  o.total                                 AS order_total,
+  o.status                                AS order_status,
+  (EXTRACT(EPOCH FROM (COALESCE(b.ends_at, b.starts_at) - b.starts_at))::int / 60)
+                                          AS total_duration_minutes
+FROM saas_core.bookings b
+LEFT JOIN saas_core.persons   pc ON pc.id = b.party_id
+LEFT JOIN saas_core.persons   ps ON ps.id = b.assignee_id
+LEFT JOIN saas_core.locations l  ON l.id  = b.location_id
+LEFT JOIN saas_core.orders    o  ON o.id  = b.order_id;
+
+GRANT SELECT ON public.v_bookings TO authenticated, service_role;
+REVOKE SELECT ON public.v_bookings FROM anon;
+
+-- \xA73 \u2014 anon-readable public catalog (owner-rights view = deliberate, whitelisted)
+CREATE OR REPLACE VIEW public.v_public_services AS
+SELECT
+  s.id, s.tenant_id, s.name, s.description, s.price, s.currency,
+  COALESCE(s.duration_minutes, 30)                AS duration_minutes,
+  s.image_url,
+  COALESCE((s.metadata->>'sort_order')::int, 0)   AS sort_order
+FROM saas_core.services s
+WHERE s.is_active AND s.status = 'active';
+
+GRANT SELECT ON public.v_public_services TO anon, authenticated, service_role;
+
+-- \xA74 \u2014 availability RPC (mirrors plugin-agenda/src/data/mock.ts getAvailableSlots)
+CREATE OR REPLACE FUNCTION public.get_available_slots(
+  p_tenant_id uuid,
+  p_date date,
+  p_duration_minutes integer,
+  p_assignee_id uuid DEFAULT NULL,
+  p_slot_interval integer DEFAULT 30
+) RETURNS TABLE (slot_start timestamptz, slot_end timestamptz)
+LANGUAGE plpgsql STABLE SECURITY DEFINER
+SET search_path = saas_core, public
+AS $$
+DECLARE
+  v_tz text;
+BEGIN
+  -- tight validation: this function is anon-callable
+  IF p_duration_minutes IS NULL OR p_duration_minutes NOT BETWEEN 5 AND 480 THEN
+    RAISE EXCEPTION 'invalid duration';
+  END IF;
+  IF p_slot_interval IS NULL OR p_slot_interval NOT BETWEEN 5 AND 240 THEN
+    RAISE EXCEPTION 'invalid interval';
+  END IF;
+  IF p_date IS NULL OR p_date < current_date OR p_date > current_date + 90 THEN
+    RETURN;
+  END IF;
+
+  SELECT COALESCE(t.settings->>'timezone', 'America/Sao_Paulo') INTO v_tz
+  FROM tenants t WHERE t.id = p_tenant_id;
+  IF v_tz IS NULL THEN RETURN; END IF;  -- unknown tenant \u2192 empty, not an error
+
+  RETURN QUERY
+  WITH day_schedules AS (
+    SELECT sc.assignee_id, sc.starts_at AS win_start, sc.ends_at AS win_end
+    FROM schedules sc
+    WHERE sc.tenant_id = p_tenant_id
+      AND sc.kind = 'working_hours'
+      AND sc.is_active
+      AND (p_assignee_id IS NULL OR sc.assignee_id = p_assignee_id)
+      AND (
+        sc.specific_date = p_date
+        OR (sc.specific_date IS NULL AND sc.day_of_week = EXTRACT(dow FROM p_date)::smallint)
+      )
+  ),
+  candidate AS (
+    SELECT
+      ds.assignee_id,
+      gs                                              AS s_start,
+      gs + make_interval(mins => p_duration_minutes)  AS s_end
+    FROM day_schedules ds
+    CROSS JOIN LATERAL generate_series(
+      (p_date + ds.win_start) AT TIME ZONE v_tz,
+      ((p_date + ds.win_end) AT TIME ZONE v_tz) - make_interval(mins => p_duration_minutes),
+      make_interval(mins => p_slot_interval)
+    ) AS gs
+  )
+  SELECT DISTINCT c.s_start, c.s_end
+  FROM candidate c
+  WHERE NOT EXISTS (
+    SELECT 1 FROM bookings b
+    WHERE b.tenant_id = p_tenant_id
+      AND b.assignee_id = c.assignee_id
+      AND b.status NOT IN ('cancelled', 'no_show')
+      AND b.starts_at < c.s_end
+      AND COALESCE(b.ends_at, b.starts_at) > c.s_start
+  )
+  ORDER BY 1;
+END;
+$$;
+
+REVOKE ALL ON FUNCTION public.get_available_slots(uuid, date, integer, uuid, integer) FROM public;
+GRANT EXECUTE ON FUNCTION public.get_available_slots(uuid, date, integer, uuid, integer)
+  TO anon, authenticated, service_role;
+
+-- \xA75 \u2014 public booking write RPC (validated, race-safe, hardcoded statuses)
+CREATE OR REPLACE FUNCTION public.create_public_booking(
+  p_tenant_id uuid,
+  p_service_id uuid,
+  p_starts_at timestamptz,
+  p_name text,
+  p_phone text,
+  p_email text DEFAULT NULL,
+  p_notes text DEFAULT NULL
+) RETURNS TABLE (booking_id uuid, starts_at timestamptz, ends_at timestamptz)
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = saas_core, public
+AS $$
+DECLARE
+  v_service record;
+  v_person_id uuid;
+  v_assignee uuid;
+  v_ends timestamptz;
+  v_order uuid;
+  v_booking uuid;
+  v_phone text;
+  v_tz text;
+  v_notes text;
+BEGIN
+  -- validation: anon-callable, everything tight
+  IF p_name IS NULL OR length(trim(p_name)) NOT BETWEEN 2 AND 120 THEN
+    RAISE EXCEPTION 'invalid name';
+  END IF;
+  v_phone := regexp_replace(COALESCE(p_phone, ''), '\\D', '', 'g');
+  IF length(v_phone) NOT BETWEEN 8 AND 15 THEN
+    RAISE EXCEPTION 'invalid phone';
+  END IF;
+  IF p_email IS NOT NULL AND (length(p_email) > 254 OR p_email !~ '^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$') THEN
+    RAISE EXCEPTION 'invalid email';
+  END IF;
+  v_notes := left(p_notes, 500);
+  IF p_starts_at IS NULL OR p_starts_at <= now() OR p_starts_at > now() + interval '90 days' THEN
+    RAISE EXCEPTION 'invalid start';
+  END IF;
+
+  SELECT s.id, s.name, s.price, COALESCE(s.duration_minutes, 30) AS duration_minutes
+    INTO v_service
+  FROM services s
+  WHERE s.id = p_service_id AND s.tenant_id = p_tenant_id
+    AND s.is_active AND s.status = 'active';
+  IF NOT FOUND THEN RAISE EXCEPTION 'unknown service'; END IF;
+
+  v_ends := p_starts_at + make_interval(mins => v_service.duration_minutes);
+  SELECT COALESCE(t.settings->>'timezone', 'America/Sao_Paulo') INTO v_tz
+  FROM tenants t WHERE t.id = p_tenant_id;
+  IF v_tz IS NULL THEN RAISE EXCEPTION 'unknown tenant'; END IF;
+
+  -- pick the assignee whose working hours cover the slot
+  SELECT sc.assignee_id INTO v_assignee
+  FROM schedules sc
+  WHERE sc.tenant_id = p_tenant_id
+    AND sc.kind = 'working_hours'
+    AND sc.is_active
+    AND (
+      sc.specific_date = (p_starts_at AT TIME ZONE v_tz)::date
+      OR (sc.specific_date IS NULL
+          AND sc.day_of_week = EXTRACT(dow FROM p_starts_at AT TIME ZONE v_tz)::smallint)
+    )
+    AND (p_starts_at AT TIME ZONE v_tz)::time >= sc.starts_at
+    AND (v_ends AT TIME ZONE v_tz)::time <= sc.ends_at
+  ORDER BY sc.assignee_id
+  LIMIT 1;
+  IF v_assignee IS NULL THEN RAISE EXCEPTION 'slot outside working hours'; END IF;
+
+  -- serialize per (tenant, assignee) to kill the double-book race
+  PERFORM pg_advisory_xact_lock(hashtextextended(p_tenant_id::text || v_assignee::text, 0));
+
+  IF EXISTS (
+    SELECT 1 FROM bookings b
+    WHERE b.tenant_id = p_tenant_id
+      AND b.assignee_id = v_assignee
+      AND b.status NOT IN ('cancelled', 'no_show')
+      AND b.starts_at < v_ends
+      AND COALESCE(b.ends_at, b.starts_at) > p_starts_at
+  ) THEN
+    RAISE EXCEPTION 'slot no longer available';
+  END IF;
+
+  -- anti-spam: cap open future public bookings per phone per tenant
+  IF (
+    SELECT count(*) FROM bookings b
+    JOIN persons p ON p.id = b.party_id
+    WHERE b.tenant_id = p_tenant_id
+      AND p.phone = v_phone
+      AND b.starts_at > now()
+      AND b.status = 'scheduled'
+  ) >= 3 THEN
+    RAISE EXCEPTION 'too many open bookings for this phone';
+  END IF;
+
+  -- upsert the customer by (tenant, phone) \u2014 matches persons_tenant_customer_phone
+  INSERT INTO persons (tenant_id, kind, name, phone, email, metadata)
+  VALUES (p_tenant_id, 'customer', trim(p_name), v_phone, p_email,
+          jsonb_build_object('source', 'public_booking'))
+  ON CONFLICT (tenant_id, phone) WHERE kind = 'customer' AND phone IS NOT NULL
+  DO UPDATE SET
+    name = EXCLUDED.name,
+    email = COALESCE(EXCLUDED.email, persons.email),
+    updated_at = now()
+  RETURNING id INTO v_person_id;
+
+  -- order + booking + order_item (statuses hardcoded \u2014 caller cannot set)
+  INSERT INTO orders (tenant_id, kind, status, party_id, assignee_id, subtotal, total, notes, metadata)
+  VALUES (p_tenant_id, 'appointment', 'scheduled', v_person_id, v_assignee,
+          v_service.price, v_service.price, v_notes,
+          jsonb_build_object('source', 'public_booking',
+                             'serviceNames', v_service.name,
+                             'contactName', trim(p_name)))
+  RETURNING id INTO v_order;
+
+  INSERT INTO bookings (tenant_id, kind, party_id, assignee_id, order_id,
+                        starts_at, ends_at, status, notes, metadata)
+  VALUES (p_tenant_id, 'appointment', v_person_id, v_assignee, v_order,
+          p_starts_at, v_ends, 'scheduled', v_notes,
+          jsonb_build_object('source', 'public_booking', 'serviceNames', v_service.name))
+  RETURNING id INTO v_booking;
+
+  INSERT INTO order_items (order_id, service_id, name, quantity, unit_price, total,
+                           sort_order, duration_minutes, assignee_id)
+  VALUES (v_order, v_service.id, v_service.name, 1, v_service.price, v_service.price,
+          0, v_service.duration_minutes, v_assignee);
+
+  RETURN QUERY SELECT v_booking, p_starts_at, v_ends;
+END;
+$$;
+
+REVOKE ALL ON FUNCTION public.create_public_booking(uuid, uuid, timestamptz, text, text, text, text) FROM public;
+GRANT EXECUTE ON FUNCTION public.create_public_booking(uuid, uuid, timestamptz, text, text, text, text)
+  TO anon, authenticated, service_role;
+`;
 function computeCommissionAmount(total, ratePercent) {
   const base = Number(total) || 0;
   const rate = Number(ratePercent) || 0;
@@ -5508,6 +5374,9 @@ function createAgendaPlugin(options) {
     version: "1.0.0",
     scope: options?.scope ?? "universal",
     verticalId: options?.verticalId,
+    // Booking/scheduling is business-ops (clinic, salon, services) — targets
+    // the saas/admin Panel world, not the ecommerce storefront.
+    scaffolds: ["saas"],
     defaultEnabled: true,
     dependencies: [],
     declaredFeatures: [
@@ -5622,10 +5491,18 @@ function createAgendaPlugin(options) {
         permission: { feature: "appointments", action: "read" }
       }
     ],
+    migrations: [
+      {
+        id: "agenda-001-public-booking",
+        version: "0.3.0",
+        sql: MIGRATION_001_PUBLIC_BOOKING,
+        description: "Booking read model (v_bookings) + anon public booking surface (v_public_services, get_available_slots, create_public_booking) + order_items duration/assignee columns"
+      }
+    ],
     locales: agendaLocales
   };
 }
 
-export { bookingToEvent2 as bookingToEvent, computeCommissionAmount, createAgendaPlugin, createFinancialBridge, createGoogleCalendarPlugin, createGoogleCalendarProvider, createMockAgendaProvider, eventToBookingPatch, googleCalendarConnector };
+export { bookingToEvent2 as bookingToEvent, computeCommissionAmount, createAgendaPlugin, createFinancialBridge, createGoogleCalendarPlugin, createGoogleCalendarProvider, eventToBookingPatch, googleCalendarConnector };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map