@fayz-ai/plugin-agenda 0.2.1 → 0.8.0

package/src/data/supabase.ts

@@ -28,7 +28,8 @@ function snakeToCamel(obj: Record<string, unknown>): Record<string, unknown> {
 function getClients() {
   const supabase = getSupabaseClientOptional() as any
   if (!supabase) throw new Error('Supabase not initialized')
-  return { core: supabase.schema('saas_core'), pub: supabase }
+  // Core v1 lives in PUBLIC — a single client serves both core and view reads.
+  return { core: supabase, pub: supabase }
 }
 
 function mapBooking(row: Record<string, unknown>): CalendarBooking {
@@ -97,7 +98,7 @@ async function hydrateCanonicalBookings(core: any, bookings: any[]): Promise<Cal
     { data: items, error: itemsError },
   ] = await Promise.all([
     personIds.length
-      ? core.from('persons').select('id, name, phone, email, avatar_url').in('id', personIds)
+      ? core.from('people').select('id, name, phone, email, avatar_url').in('id', personIds)
       : Promise.resolve({ data: [], error: null }),
     locationIds.length
       ? core.from('locations').select('id, name').in('id', locationIds)
@@ -170,7 +171,7 @@ async function hydrateCanonicalBookings(core: any, bookings: any[]): Promise<Cal
 }
 
 async function getCanonicalBookings(core: any, query: BookingQuery): Promise<CalendarBooking[]> {
-  let q = core.from('bookings')
+  let q = core.from('appointments')
     .select('id, tenant_id, kind, starts_at, ends_at, status, notes, order_id, location_id, metadata, party_id, assignee_id, created_at, updated_at')
     .gte('starts_at', query.dateRange.start)
     .lte('starts_at', query.dateRange.end)
@@ -187,11 +188,11 @@ async function getCanonicalBookings(core: any, query: BookingQuery): Promise<Cal
 
 async function getCanonicalBookingById(core: any, id: string): Promise<CalendarBooking | null> {
   const columns = 'id, tenant_id, kind, starts_at, ends_at, status, notes, order_id, location_id, metadata, party_id, assignee_id, created_at, updated_at'
-  let { data, error } = await core.from('bookings').select(columns).eq('id', id).maybeSingle()
+  let { data, error } = await core.from('appointments').select(columns).eq('id', id).maybeSingle()
   if (error) throw error
 
   if (!data) {
-    const fallback = await core.from('bookings').select(columns).eq('order_id', id).maybeSingle()
+    const fallback = await core.from('appointments').select(columns).eq('order_id', id).maybeSingle()
     if (fallback.error) throw fallback.error
     data = fallback.data
   }
@@ -207,10 +208,10 @@ async function getCanonicalBookingById(core: any, id: string): Promise<CalendarB
 
 export function createSupabaseAgendaProvider(): AgendaDataProvider {
   return {
-    // v_bookings is in public schema (PostgREST default)
+    // v_appointments is in public schema (PostgREST default)
     async getBookings(query: BookingQuery): Promise<CalendarBooking[]> {
       const { core, pub } = getClients()
-      let q = pub.from('v_bookings').select('*')
+      let q = pub.from('v_appointments').select('*')
         .gte('starts_at', query.dateRange.start)
         .lte('starts_at', query.dateRange.end)
 
@@ -230,7 +231,7 @@ export function createSupabaseAgendaProvider(): AgendaDataProvider {
 
     async getBookingById(id: string): Promise<CalendarBooking | null> {
       const { core, pub } = getClients()
-      const { data, error } = await pub.from('v_bookings').select('*').eq('id', id).maybeSingle()
+      const { data, error } = await pub.from('v_appointments').select('*').eq('id', id).maybeSingle()
       if (error) throw error
       if (data) return mapBooking(data as Record<string, unknown>)
       return getCanonicalBookingById(core, id)
@@ -250,7 +251,7 @@ export function createSupabaseAgendaProvider(): AgendaDataProvider {
       // Resolve client name for metadata (used by financial detail view)
       let contactName: string | undefined
       if (input.clientId) {
-        const { data: person } = await core.from('persons').select('name').eq('id', input.clientId).single()
+        const { data: person } = await core.from('people').select('name').eq('id', input.clientId).single()
         contactName = person?.name as string | undefined
       }
 
@@ -277,7 +278,7 @@ export function createSupabaseAgendaProvider(): AgendaDataProvider {
       }).select('id').single()
       if (orderErr) throw orderErr
 
-      const { data: booking, error: bookingErr } = await core.from('bookings').insert({
+      const { data: booking, error: bookingErr } = await core.from('appointments').insert({
         tenant_id: tenantId,
         kind: input.kind ?? 'appointment',
         party_id: input.clientId || null,
@@ -321,7 +322,7 @@ export function createSupabaseAgendaProvider(): AgendaDataProvider {
 
     async updateBooking(id: string, data: UpdateBookingInput): Promise<CalendarBooking> {
       const { core } = getClients()
-      const { data: existing, error: existingErr } = await core.from('bookings')
+      const { data: existing, error: existingErr } = await core.from('appointments')
         .select('id, order_id, starts_at, assignee_id, metadata')
         .eq('id', id)
         .single()
@@ -357,7 +358,7 @@ export function createSupabaseAgendaProvider(): AgendaDataProvider {
 
       const effectiveAssigneeId = data.professionalId ?? (existing?.assignee_id as string | null | undefined) ?? null
 
-      const { error } = await core.from('bookings').update(updates).eq('id', id)
+      const { error } = await core.from('appointments').update(updates).eq('id', id)
       if (error) throw error
 
       // S4: services are updated only in order_items below (booking_items deprecated).
@@ -405,7 +406,7 @@ export function createSupabaseAgendaProvider(): AgendaDataProvider {
 
     async deleteBooking(id: string): Promise<void> {
       const { core, pub } = getClients()
-      const { data: booking, error: bookingErr } = await core.from('bookings')
+      const { data: booking, error: bookingErr } = await core.from('appointments')
         .select('order_id')
         .eq('id', id)
         .single()
@@ -413,22 +414,22 @@ export function createSupabaseAgendaProvider(): AgendaDataProvider {
 
       const orderId = booking?.order_id as string | null | undefined
       const { count, error: movementErr } = orderId
-        ? await pub.from('financial_movements').select('id', { count: 'exact', head: true }).eq('invoice_id', orderId)
+        ? await pub.from('plg_financial_movements').select('id', { count: 'exact', head: true }).eq('invoice_id', orderId)
         : { count: 0, error: null }
       if (movementErr) throw movementErr
 
       if (orderId && (count ?? 0) > 0) {
         // Cancel movements + order (don't delete financial records)
-        await pub.from('financial_movements').update({ status: 'cancelled' }).eq('invoice_id', orderId)
+        await pub.from('plg_financial_movements').update({ status: 'cancelled' }).eq('invoice_id', orderId)
         await core.from('orders').update({ status: 'cancelled' }).eq('id', orderId)
-        const { error } = await core.from('bookings').update({ status: 'cancelled' }).eq('id', id)
+        const { error } = await core.from('appointments').update({ status: 'cancelled' }).eq('id', id)
         if (error) throw error
       } else {
         // Safe to delete — remove any movements first (FK constraint)
         if (orderId) {
-          await pub.from('financial_movements').delete().eq('invoice_id', orderId)
+          await pub.from('plg_financial_movements').delete().eq('invoice_id', orderId)
         }
-        const { error } = await core.from('bookings').delete().eq('id', id)
+        const { error } = await core.from('appointments').delete().eq('id', id)
         if (error) throw error
         if (orderId) {
           const { error: orderErr } = await core.from('orders').delete().eq('id', orderId)
@@ -443,7 +444,7 @@ export function createSupabaseAgendaProvider(): AgendaDataProvider {
 
     async checkConflict(params: ConflictCheckParams): Promise<boolean> {
       const { core } = getClients()
-      let q = core.from('bookings').select('id', { count: 'exact', head: true })
+      let q = core.from('appointments').select('id', { count: 'exact', head: true })
         .eq('assignee_id', params.assigneeId)
         .eq('kind', 'appointment')
         .not('status', 'in', '("cancelled","no_show")')
@@ -513,7 +514,7 @@ export function createSupabaseAgendaProvider(): AgendaDataProvider {
 
     async getProfessionals(): Promise<Professional[]> {
       const { core } = getClients()
-      const { data, error } = await core.from('persons')
+      const { data, error } = await core.from('people')
         .select('id, name, avatar_url, is_active')
         .eq('kind', 'staff')
         .eq('is_active', true)
@@ -541,7 +542,7 @@ export function createSupabaseAgendaProvider(): AgendaDataProvider {
       const cutoff = new Date()
       cutoff.setDate(cutoff.getDate() + daysAhead)
 
-      const { data, error } = await pub.from('v_bookings').select('*')
+      const { data, error } = await pub.from('v_appointments').select('*')
         .eq('status', 'scheduled')
         .gte('starts_at', now)
         .lte('starts_at', cutoff.toISOString())
@@ -552,22 +553,22 @@ export function createSupabaseAgendaProvider(): AgendaDataProvider {
 
     async sendConfirmation(bookingId: string, channel: string): Promise<void> {
       const { core } = getClients()
-      const { data: booking } = await core.from('bookings').select('metadata').eq('id', bookingId).single()
+      const { data: booking } = await core.from('appointments').select('metadata').eq('id', bookingId).single()
       const metadata = (booking?.metadata ?? {}) as Record<string, unknown>
       const confirmations = (metadata.confirmations as any[] ?? [])
       confirmations.push({ channel, sentAt: new Date().toISOString(), status: 'sent' })
-      await core.from('bookings').update({ metadata: { ...metadata, confirmations } }).eq('id', bookingId)
+      await core.from('appointments').update({ metadata: { ...metadata, confirmations } }).eq('id', bookingId)
     },
 
     async completeBooking(bookingId: string): Promise<{ booking: CalendarBooking; orderId: string }> {
       const { core } = getClients()
-      const { data: existing, error: existingErr } = await core.from('bookings')
+      const { data: existing, error: existingErr } = await core.from('appointments')
         .select('order_id')
         .eq('id', bookingId)
         .single()
       if (existingErr) throw existingErr
 
-      const { error } = await core.from('bookings')
+      const { error } = await core.from('appointments')
         .update({ status: 'completed' })
         .eq('id', bookingId)
       if (error) throw error

package/src/index.ts

@@ -11,6 +11,7 @@ import { createAgendaStore } from './store'
 import { agendaRegistries } from './registries'
 import { AgendaGeneralSettings } from './components/AgendaGeneralSettings'
 import { agendaLocales } from './locales'
+import { MIGRATION_001_PUBLIC_BOOKING } from './migrations'
 import { setScheduleBlockConfig, getScheduleBlockConfig, PluginSettingsPanel } from '@fayz-ai/saas'
 
 // ---------------------------------------------------------------------------
@@ -179,6 +180,16 @@ export function createAgendaPlugin(options?: AgendaPluginOptions): PluginManifes
         permission: { feature: 'appointments', action: 'read' as const },
       },
     ],
+    migrations: [
+      {
+        id: 'agenda-001-public-booking',
+        version: '0.3.0',
+        sql: MIGRATION_001_PUBLIC_BOOKING,
+        description:
+          'Booking read model (v_appointments) + anon public booking surface (v_public_services, get_available_slots, create_public_booking) + order_items duration/assignee columns',
+      },
+    ],
+
     locales: agendaLocales,
   }
 }

package/src/integrations/google-calendar/index.ts

@@ -5,7 +5,7 @@
 // Google) is automatic via a DB trigger; inbound (Google → booking) via pg_cron
 // or a Google watch webhook. The data plane is the google-calendar-sync edge
 // function (see ./functions/google-calendar-sync). The booking↔event link lives
-// on saas_core.bookings.metadata.googleCalendarEventId.
+// on public.appointments.metadata.googleCalendarEventId.
 //
 // Graduation path: extract to its own `@fayz-ai/plugin-google-calendar` package.
 import type { PluginManifest } from '@fayz-ai/core'

package/src/integrations/google-calendar/migrations/001_google_calendar.sql

@@ -1,15 +1,15 @@
 -- ---------------------------------------------------------------------------
 -- Google Calendar integration (bidirectional) — connection + audit + triggers
 -- ---------------------------------------------------------------------------
--- Outbound (Fayz booking → Google event) fires from a trigger on saas_core.bookings
+-- Outbound (Fayz booking → Google event) fires from a trigger on public.appointments
 -- via pg_net to the google-calendar-sync edge function (push_event). Inbound
 -- (Google → booking) runs on a pg_cron schedule (pull_events) and/or a Google
 -- watch-channel webhook. The booking↔event link is stored on
--- saas_core.bookings.metadata.googleCalendarEventId (no schema change there).
+-- public.appointments.metadata.googleCalendarEventId (no schema change there).
 
 CREATE TABLE IF NOT EXISTS public.calendar_integrations (
   id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  tenant_id uuid NOT NULL REFERENCES saas_core.tenants(id) ON DELETE CASCADE,
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
   provider text NOT NULL DEFAULT 'google',
   oauth_refresh_token text,
   oauth_access_token text,
@@ -31,7 +31,7 @@ CREATE INDEX IF NOT EXISTS idx_calendar_integrations_tenant ON public.calendar_i
 
 CREATE TABLE IF NOT EXISTS public.calendar_sync_log (
   id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  tenant_id uuid NOT NULL REFERENCES saas_core.tenants(id) ON DELETE CASCADE,
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
   direction text NOT NULL,                 -- inbound | outbound
   trigger text,                            -- on-write | scheduled | webhook | manual
   status text NOT NULL DEFAULT 'success',  -- success | partial | error
@@ -80,9 +80,9 @@ BEGIN
   RETURN COALESCE(NEW, OLD);
 END $$;
 
-DROP TRIGGER IF EXISTS trg_gcal_push ON saas_core.bookings;
+DROP TRIGGER IF EXISTS trg_gcal_push ON public.appointments;
 CREATE TRIGGER trg_gcal_push
-  AFTER INSERT OR UPDATE OR DELETE ON saas_core.bookings
+  AFTER INSERT OR UPDATE OR DELETE ON public.appointments
   FOR EACH ROW EXECUTE FUNCTION public.fn_gcal_push_booking();
 
 -- Inbound schedule (optional): pull external changes every 10 minutes.

package/src/migrations/000b_v_bookings_rename.sql

@@ -0,0 +1,21 @@
+-- Salon-only unblock: the pre-pools beauty deployment built rep_* report
+-- views on top of its (wider) v_bookings view, so 001's cleanup DROP cannot
+-- run there. Renaming keeps the dependents attached (they track the OID) and
+-- frees the name for 001; 002_v_bookings_compat re-creates v_bookings as a
+-- thin alias for live pre-M5 clients. No-op on fresh pools and on pools whose
+-- v_bookings has no dependents (001's DROP handles those).
+
+DO $rename$
+BEGIN
+  IF to_regclass('public.v_bookings') IS NOT NULL
+     AND to_regclass('public.v_bookings_legacy_beauty') IS NULL
+     AND EXISTS (
+       SELECT 1 FROM pg_depend d
+       JOIN pg_rewrite rw ON rw.oid = d.objid
+       JOIN pg_class dep ON dep.oid = rw.ev_class
+       JOIN pg_class ref ON ref.oid = d.refobjid
+       WHERE ref.relname = 'v_bookings' AND dep.relname <> 'v_bookings'
+     ) THEN
+    EXECUTE 'ALTER VIEW public.v_bookings RENAME TO v_bookings_legacy_beauty';
+  END IF;
+END $rename$;

package/src/migrations/000c_dedupe_customer_phones.sql

@@ -0,0 +1,43 @@
+-- 001 needs the customer-phone upsert key UNIQUE(tenant_id, phone). Converted
+-- pools can carry duplicates (found live on salon: 9 dogfood test records all
+-- sharing the founder's phone). Non-destructive dedupe: per (tenant_id, phone)
+-- customer group keep the row with most appointments (tie: oldest), NULL the
+-- phone on the rest and stash the original in metadata->'dedupedPhone'.
+-- Idempotent: reruns find no groups > 1.
+
+DO $dedupe$
+DECLARE
+  r record;
+BEGIN
+  IF to_regclass('public.people') IS NULL THEN
+    RETURN;
+  END IF;
+
+  FOR r IN
+    SELECT p.id, p.phone
+    FROM public.people p
+    JOIN LATERAL (
+      SELECT count(*) AS appts
+      FROM public.appointments a WHERE a.party_id = p.id
+    ) ac ON true
+    WHERE p.kind = 'customer' AND p.phone IS NOT NULL
+      AND p.id NOT IN (
+        SELECT DISTINCT ON (p2.tenant_id, p2.phone) p2.id
+        FROM public.people p2
+        WHERE p2.kind = 'customer' AND p2.phone IS NOT NULL
+        ORDER BY p2.tenant_id, p2.phone,
+          (SELECT count(*) FROM public.appointments a2 WHERE a2.party_id = p2.id) DESC,
+          p2.created_at ASC
+      )
+      AND (p.tenant_id, p.phone) IN (
+        SELECT tenant_id, phone FROM public.people
+        WHERE kind = 'customer' AND phone IS NOT NULL
+        GROUP BY tenant_id, phone HAVING count(*) > 1
+      )
+  LOOP
+    UPDATE public.people
+    SET metadata = COALESCE(metadata, '{}'::jsonb) || jsonb_build_object('dedupedPhone', r.phone),
+        phone = NULL
+    WHERE id = r.id;
+  END LOOP;
+END $dedupe$;

package/src/migrations/001_public_booking.sql

@@ -0,0 +1,291 @@
+-- ============================================================================
+-- plugin-agenda 001: booking read model + public (anon) booking surface
+--
+-- Ships the objects the agenda providers reference but the spine (packages/db
+-- migrations 001–010) does not define:
+--   §0  converted-pool cleanup — drop the pre-rename v_bookings view / indexes
+--   §1  order_items columns the admin provider writes (duration/assignee)
+--   §2  public.v_appointments    — admin read model (authenticated, RLS applies)
+--   §3  public.v_public_services — anon-readable service catalog
+--   §4  public.get_available_slots      — anon RPC (mirrors the mock algorithm)
+--   §5  public.create_public_booking    — anon RPC (validated, race-safe write)
+--
+-- Core v1 lives directly in PUBLIC (no separate core schema): people (was
+-- persons), appointments (was bookings). This migration is written against public
+-- names and is idempotent + safe on both fresh and converted pools.
+--
+-- Anon-access design: public booking pages run with the publishable key and no
+-- session, so the canonical tenant RLS yields nothing. Anon access is granted
+-- ONLY via the column-whitelisted view (§3) and SECURITY DEFINER RPCs (§4, §5)
+-- with tight input validation and hardcoded statuses.
+-- ============================================================================
+
+-- §0 — converted-pool cleanup. The pre-industry-pool shape shipped a v_bookings
+-- view and persons_/bookings_-named indexes; drop them so this file re-emits the
+-- canonical v_appointments view + people_/appointments_ indexes without leaving
+-- duplicates. All guarded with IF EXISTS → no-ops on a fresh pool.
+DROP VIEW IF EXISTS public.v_bookings;
+DROP INDEX IF EXISTS public.persons_tenant_customer_phone;
+DROP INDEX IF EXISTS public.bookings_assignee_time;
+
+-- §1 — columns the agenda provider writes but 004_archetypes lacks
+ALTER TABLE public.order_items
+  ADD COLUMN IF NOT EXISTS duration_minutes integer,
+  ADD COLUMN IF NOT EXISTS assignee_id uuid REFERENCES public.people(id) ON DELETE SET NULL;
+
+-- Upsert key for public customers (per tenant, by normalized phone)
+CREATE UNIQUE INDEX IF NOT EXISTS people_tenant_customer_phone
+  ON public.people(tenant_id, phone)
+  WHERE kind = 'customer' AND phone IS NOT NULL;
+
+-- Slot-conflict scan
+CREATE INDEX IF NOT EXISTS appointments_assignee_time
+  ON public.appointments(assignee_id, starts_at, ends_at)
+  WHERE status NOT IN ('cancelled', 'no_show');
+
+-- §2 — admin read model (security_invoker → underlying RLS applies; anon sees 0 rows)
+CREATE OR REPLACE VIEW public.v_appointments
+WITH (security_invoker = true) AS
+SELECT
+  b.id, b.tenant_id, b.kind, b.starts_at, b.ends_at, b.status, b.notes,
+  b.order_id, b.location_id, b.metadata, b.created_at, b.updated_at,
+  b.party_id                              AS client_id,
+  COALESCE(pc.name, b.metadata->>'title') AS client_name,
+  pc.phone                                AS client_phone,
+  pc.email                                AS client_email,
+  pc.avatar_url                           AS client_avatar_url,
+  b.assignee_id                           AS professional_id,
+  ps.name                                 AS professional_name,
+  ps.avatar_url                           AS professional_avatar_url,
+  l.name                                  AS location_name,
+  o.total                                 AS order_total,
+  o.status                                AS order_status,
+  (EXTRACT(EPOCH FROM (COALESCE(b.ends_at, b.starts_at) - b.starts_at))::int / 60)
+                                          AS total_duration_minutes
+FROM public.appointments b
+LEFT JOIN public.people    pc ON pc.id = b.party_id
+LEFT JOIN public.people    ps ON ps.id = b.assignee_id
+LEFT JOIN public.locations l  ON l.id  = b.location_id
+LEFT JOIN public.orders    o  ON o.id  = b.order_id;
+
+GRANT SELECT ON public.v_appointments TO authenticated, service_role;
+REVOKE SELECT ON public.v_appointments FROM anon;
+
+-- §3 — anon-readable public catalog (owner-rights view = deliberate, whitelisted)
+CREATE OR REPLACE VIEW public.v_public_services AS
+SELECT
+  s.id, s.tenant_id, s.name, s.description, s.price, s.currency,
+  COALESCE(s.duration_minutes, 30)                AS duration_minutes,
+  s.image_url,
+  COALESCE((s.metadata->>'sort_order')::int, 0)   AS sort_order
+FROM public.services s
+WHERE s.is_active AND s.status = 'active';
+
+GRANT SELECT ON public.v_public_services TO anon, authenticated, service_role;
+
+-- §4 — availability RPC (mirrors plugin-agenda/src/data/mock.ts getAvailableSlots)
+CREATE OR REPLACE FUNCTION public.get_available_slots(
+  p_tenant_id uuid,
+  p_date date,
+  p_duration_minutes integer,
+  p_assignee_id uuid DEFAULT NULL,
+  p_slot_interval integer DEFAULT 30
+) RETURNS TABLE (slot_start timestamptz, slot_end timestamptz)
+LANGUAGE plpgsql STABLE SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_tz text;
+BEGIN
+  -- tight validation: this function is anon-callable
+  IF p_duration_minutes IS NULL OR p_duration_minutes NOT BETWEEN 5 AND 480 THEN
+    RAISE EXCEPTION 'invalid duration';
+  END IF;
+  IF p_slot_interval IS NULL OR p_slot_interval NOT BETWEEN 5 AND 240 THEN
+    RAISE EXCEPTION 'invalid interval';
+  END IF;
+  IF p_date IS NULL OR p_date < current_date OR p_date > current_date + 90 THEN
+    RETURN;
+  END IF;
+
+  SELECT COALESCE(t.settings->>'timezone', 'America/Sao_Paulo') INTO v_tz
+  FROM tenants t WHERE t.id = p_tenant_id;
+  IF v_tz IS NULL THEN RETURN; END IF;  -- unknown tenant → empty, not an error
+
+  RETURN QUERY
+  WITH day_schedules AS (
+    SELECT sc.assignee_id, sc.starts_at AS win_start, sc.ends_at AS win_end
+    FROM schedules sc
+    WHERE sc.tenant_id = p_tenant_id
+      AND sc.kind = 'working_hours'
+      AND sc.is_active
+      AND (p_assignee_id IS NULL OR sc.assignee_id = p_assignee_id)
+      AND (
+        sc.specific_date = p_date
+        OR (sc.specific_date IS NULL AND sc.day_of_week = EXTRACT(dow FROM p_date)::smallint)
+      )
+  ),
+  candidate AS (
+    SELECT
+      ds.assignee_id,
+      gs                                              AS s_start,
+      gs + make_interval(mins => p_duration_minutes)  AS s_end
+    FROM day_schedules ds
+    CROSS JOIN LATERAL generate_series(
+      (p_date + ds.win_start) AT TIME ZONE v_tz,
+      ((p_date + ds.win_end) AT TIME ZONE v_tz) - make_interval(mins => p_duration_minutes),
+      make_interval(mins => p_slot_interval)
+    ) AS gs
+  )
+  SELECT DISTINCT c.s_start, c.s_end
+  FROM candidate c
+  WHERE NOT EXISTS (
+    SELECT 1 FROM appointments b
+    WHERE b.tenant_id = p_tenant_id
+      AND b.assignee_id = c.assignee_id
+      AND b.status NOT IN ('cancelled', 'no_show')
+      AND b.starts_at < c.s_end
+      AND COALESCE(b.ends_at, b.starts_at) > c.s_start
+  )
+  ORDER BY 1;
+END;
+$$;
+
+REVOKE ALL ON FUNCTION public.get_available_slots(uuid, date, integer, uuid, integer) FROM public;
+GRANT EXECUTE ON FUNCTION public.get_available_slots(uuid, date, integer, uuid, integer)
+  TO anon, authenticated, service_role;
+
+-- §5 — public booking write RPC (validated, race-safe, hardcoded statuses)
+CREATE OR REPLACE FUNCTION public.create_public_booking(
+  p_tenant_id uuid,
+  p_service_id uuid,
+  p_starts_at timestamptz,
+  p_name text,
+  p_phone text,
+  p_email text DEFAULT NULL,
+  p_notes text DEFAULT NULL
+) RETURNS TABLE (booking_id uuid, starts_at timestamptz, ends_at timestamptz)
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_service record;
+  v_person_id uuid;
+  v_assignee uuid;
+  v_ends timestamptz;
+  v_order uuid;
+  v_booking uuid;
+  v_phone text;
+  v_tz text;
+  v_notes text;
+BEGIN
+  -- validation: anon-callable, everything tight
+  IF p_name IS NULL OR length(trim(p_name)) NOT BETWEEN 2 AND 120 THEN
+    RAISE EXCEPTION 'invalid name';
+  END IF;
+  v_phone := regexp_replace(COALESCE(p_phone, ''), '\D', '', 'g');
+  IF length(v_phone) NOT BETWEEN 8 AND 15 THEN
+    RAISE EXCEPTION 'invalid phone';
+  END IF;
+  IF p_email IS NOT NULL AND (length(p_email) > 254 OR p_email !~ '^[^@\s]+@[^@\s]+\.[^@\s]+$') THEN
+    RAISE EXCEPTION 'invalid email';
+  END IF;
+  v_notes := left(p_notes, 500);
+  IF p_starts_at IS NULL OR p_starts_at <= now() OR p_starts_at > now() + interval '90 days' THEN
+    RAISE EXCEPTION 'invalid start';
+  END IF;
+
+  SELECT s.id, s.name, s.price, COALESCE(s.duration_minutes, 30) AS duration_minutes
+    INTO v_service
+  FROM services s
+  WHERE s.id = p_service_id AND s.tenant_id = p_tenant_id
+    AND s.is_active AND s.status = 'active';
+  IF NOT FOUND THEN RAISE EXCEPTION 'unknown service'; END IF;
+
+  v_ends := p_starts_at + make_interval(mins => v_service.duration_minutes);
+  SELECT COALESCE(t.settings->>'timezone', 'America/Sao_Paulo') INTO v_tz
+  FROM tenants t WHERE t.id = p_tenant_id;
+  IF v_tz IS NULL THEN RAISE EXCEPTION 'unknown tenant'; END IF;
+
+  -- pick the assignee whose working hours cover the slot
+  SELECT sc.assignee_id INTO v_assignee
+  FROM schedules sc
+  WHERE sc.tenant_id = p_tenant_id
+    AND sc.kind = 'working_hours'
+    AND sc.is_active
+    AND (
+      sc.specific_date = (p_starts_at AT TIME ZONE v_tz)::date
+      OR (sc.specific_date IS NULL
+          AND sc.day_of_week = EXTRACT(dow FROM p_starts_at AT TIME ZONE v_tz)::smallint)
+    )
+    AND (p_starts_at AT TIME ZONE v_tz)::time >= sc.starts_at
+    AND (v_ends AT TIME ZONE v_tz)::time <= sc.ends_at
+  ORDER BY sc.assignee_id
+  LIMIT 1;
+  IF v_assignee IS NULL THEN RAISE EXCEPTION 'slot outside working hours'; END IF;
+
+  -- serialize per (tenant, assignee) to kill the double-book race
+  PERFORM pg_advisory_xact_lock(hashtextextended(p_tenant_id::text || v_assignee::text, 0));
+
+  IF EXISTS (
+    SELECT 1 FROM appointments b
+    WHERE b.tenant_id = p_tenant_id
+      AND b.assignee_id = v_assignee
+      AND b.status NOT IN ('cancelled', 'no_show')
+      AND b.starts_at < v_ends
+      AND COALESCE(b.ends_at, b.starts_at) > p_starts_at
+  ) THEN
+    RAISE EXCEPTION 'slot no longer available';
+  END IF;
+
+  -- anti-spam: cap open future public bookings per phone per tenant
+  IF (
+    SELECT count(*) FROM appointments b
+    JOIN people p ON p.id = b.party_id
+    WHERE b.tenant_id = p_tenant_id
+      AND p.phone = v_phone
+      AND b.starts_at > now()
+      AND b.status = 'scheduled'
+  ) >= 3 THEN
+    RAISE EXCEPTION 'too many open bookings for this phone';
+  END IF;
+
+  -- upsert the customer by (tenant, phone) — matches people_tenant_customer_phone
+  INSERT INTO people (tenant_id, kind, name, phone, email, metadata)
+  VALUES (p_tenant_id, 'customer', trim(p_name), v_phone, p_email,
+          jsonb_build_object('source', 'public_booking'))
+  ON CONFLICT (tenant_id, phone) WHERE kind = 'customer' AND phone IS NOT NULL
+  DO UPDATE SET
+    name = EXCLUDED.name,
+    email = COALESCE(EXCLUDED.email, people.email),
+    updated_at = now()
+  RETURNING id INTO v_person_id;
+
+  -- order + booking + order_item (statuses hardcoded — caller cannot set)
+  INSERT INTO orders (tenant_id, kind, status, party_id, assignee_id, subtotal, total, notes, metadata)
+  VALUES (p_tenant_id, 'appointment', 'scheduled', v_person_id, v_assignee,
+          v_service.price, v_service.price, v_notes,
+          jsonb_build_object('source', 'public_booking',
+                             'serviceNames', v_service.name,
+                             'contactName', trim(p_name)))
+  RETURNING id INTO v_order;
+
+  INSERT INTO appointments (tenant_id, kind, party_id, assignee_id, order_id,
+                        starts_at, ends_at, status, notes, metadata)
+  VALUES (p_tenant_id, 'appointment', v_person_id, v_assignee, v_order,
+          p_starts_at, v_ends, 'scheduled', v_notes,
+          jsonb_build_object('source', 'public_booking', 'serviceNames', v_service.name))
+  RETURNING id INTO v_booking;
+
+  INSERT INTO order_items (order_id, service_id, name, quantity, unit_price, total,
+                           sort_order, duration_minutes, assignee_id)
+  VALUES (v_order, v_service.id, v_service.name, 1, v_service.price, v_service.price,
+          0, v_service.duration_minutes, v_assignee);
+
+  RETURN QUERY SELECT v_booking, p_starts_at, v_ends;
+END;
+$$;
+
+REVOKE ALL ON FUNCTION public.create_public_booking(uuid, uuid, timestamptz, text, text, text, text) FROM public;
+GRANT EXECUTE ON FUNCTION public.create_public_booking(uuid, uuid, timestamptz, text, text, text, text)
+  TO anon, authenticated, service_role;

package/src/migrations/002_v_bookings_compat.sql

@@ -0,0 +1,14 @@
+-- Where 000b preserved the legacy beauty view, re-create v_bookings as a
+-- thin alias over it so live pre-M5 clients that SELECT v_bookings by name
+-- keep their full legacy column set. Dropped for good once the beauty app
+-- ships on v_appointments (M5 follow-up).
+
+DO $compat$
+BEGIN
+  IF to_regclass('public.v_bookings_legacy_beauty') IS NOT NULL
+     AND to_regclass('public.v_bookings') IS NULL THEN
+    EXECUTE 'CREATE VIEW public.v_bookings WITH (security_invoker = true) AS SELECT * FROM public.v_bookings_legacy_beauty';
+    EXECUTE 'GRANT SELECT ON public.v_bookings TO authenticated, service_role';
+    EXECUTE 'REVOKE SELECT ON public.v_bookings FROM anon';
+  END IF;
+END $compat$;