@fayz-ai/plugin-agenda 0.27.10 → 0.27.12

package/dist/migrations/integrations-google-calendar.js

@@ -0,0 +1,1992 @@
+// src/integrations/google-calendar/migrations/index.ts
+var MIGRATION_001_GOOGLE_CALENDAR = `-- ---------------------------------------------------------------------------
+-- Google Calendar integration (bidirectional) \u2014 connection + audit + triggers
+-- ---------------------------------------------------------------------------
+-- Outbound (Fayz booking \u2192 Google event) fires from a trigger on public.appointments
+-- via pg_net to the google-calendar-sync edge function (push_event). Inbound
+-- (Google \u2192 booking) runs on a pg_cron schedule (pull_events) and/or a Google
+-- watch-channel webhook. The booking\u2194event link is stored on
+-- public.appointments.metadata.googleCalendarEventId (no schema change there).
+
+-- Plugin-owned tables carry the platform \`plg_<plugin>_\` prefix (DATA-MODEL.md
+-- Ring 1). Legacy pools provisioned under the old \`calendar_*\` names are migrated
+-- by 003_plg_rename.sql; fresh installs are born with the prefixed names here.
+CREATE TABLE IF NOT EXISTS public.plg_calendar_integrations (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  provider text NOT NULL DEFAULT 'google',
+  oauth_refresh_token text,
+  oauth_access_token text,
+  token_expires_at timestamptz,
+  calendar_id text NOT NULL DEFAULT 'primary',
+  -- Incremental pull cursor + Google watch channel bookkeeping.
+  sync_token text,
+  channel_id text,
+  channel_resource_id text,
+  channel_expires_at timestamptz,
+  active boolean NOT NULL DEFAULT true,
+  last_sync_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE (tenant_id, provider)
+);
+ALTER TABLE public.plg_calendar_integrations ENABLE ROW LEVEL SECURITY;
+CREATE INDEX IF NOT EXISTS idx_plg_calendar_integrations_tenant ON public.plg_calendar_integrations(tenant_id);
+
+CREATE TABLE IF NOT EXISTS public.plg_calendar_sync_log (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  direction text NOT NULL,                 -- inbound | outbound
+  trigger text,                            -- on-write | scheduled | webhook | manual
+  status text NOT NULL DEFAULT 'success',  -- success | partial | error
+  fetched integer NOT NULL DEFAULT 0,
+  written integer NOT NULL DEFAULT 0,
+  error text,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+ALTER TABLE public.plg_calendar_sync_log ENABLE ROW LEVEL SECURITY;
+
+-- RLS: tenant isolation.
+DO $$
+DECLARE t text;
+BEGIN
+  FOR t IN SELECT unnest(ARRAY['plg_calendar_integrations','plg_calendar_sync_log'])
+  LOOP
+    EXECUTE format('GRANT SELECT, INSERT, UPDATE, DELETE ON public.%I TO authenticated', t);
+    IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname='public' AND tablename=t AND policyname=t||'_rls') THEN
+      EXECUTE format('CREATE POLICY %I ON public.%I FOR ALL TO authenticated USING (tenant_id IN (SELECT public.user_tenant_ids())) WITH CHECK (tenant_id IN (SELECT public.user_tenant_ids()))', t||'_rls', t);
+    END IF;
+  END LOOP;
+END $$;
+
+-- ---------------------------------------------------------------------------
+-- Outbound trigger: booking change \u2192 edge function (push_event).
+-- Requires pg_net + a configured function URL. Set once per project:
+--   ALTER DATABASE postgres SET app.gcal_sync_url = 'https://<ref>.functions.supabase.co/google-calendar-sync';
+--   ALTER DATABASE postgres SET app.gcal_service_key = '<service-role-key>';
+-- Safe to skip in environments without pg_net \u2014 outbound also works via the
+-- client-side withGoogleCalendarSync() decorator.
+-- ---------------------------------------------------------------------------
+CREATE OR REPLACE FUNCTION public.fn_gcal_push_booking() RETURNS trigger
+LANGUAGE plpgsql SECURITY DEFINER AS $$
+DECLARE
+  url text := current_setting('app.gcal_sync_url', true);
+  key text := current_setting('app.gcal_service_key', true);
+  rec record := COALESCE(NEW, OLD);
+  op  text := lower(TG_OP);
+BEGIN
+  IF url IS NULL OR url = '' THEN RETURN COALESCE(NEW, OLD); END IF;
+  PERFORM net.http_post(
+    url := url,
+    headers := jsonb_build_object('Content-Type', 'application/json', 'Authorization', 'Bearer ' || COALESCE(key, '')),
+    body := jsonb_build_object('action', 'push_event', 'op', op, 'bookingId', rec.id, 'tenantId', rec.tenant_id)
+  );
+  RETURN COALESCE(NEW, OLD);
+END $$;
+
+DROP TRIGGER IF EXISTS trg_gcal_push ON public.appointments;
+CREATE TRIGGER trg_gcal_push
+  AFTER INSERT OR UPDATE OR DELETE ON public.appointments
+  FOR EACH ROW EXECUTE FUNCTION public.fn_gcal_push_booking();
+
+-- Inbound schedule (optional): pull external changes every 10 minutes.
+--   SELECT cron.schedule('gcal-pull', '*/10 * * * *', $$
+--     SELECT net.http_post(
+--       url := current_setting('app.gcal_sync_url'),
+--       headers := jsonb_build_object('Content-Type','application/json','Authorization','Bearer '||current_setting('app.gcal_service_key')),
+--       body := jsonb_build_object('action','pull_events'));
+--   $$);
+`;
+var MIGRATION_002_SMART_SYNC = `-- ---------------------------------------------------------------------------
+-- Google Calendar SMART SYNC \u2014 multi-calendar de-para + loop-safe two-way sync
+-- ---------------------------------------------------------------------------
+-- Builds on 001_google_calendar.sql. Where 001 modelled a single calendar per
+-- tenant (plg_calendar_integrations, one outbound trigger, a pull template), 002
+-- makes the sync vertical-agnostic and bidirectional-safe:
+--
+--   \xA71  public.plg_calendar_channels \u2014 de-para: one Google calendar \u2192 one sync
+--                                       target (whole tenant / assignee / service
+--                                       / location), per direction + import mode
+--   \xA72  fn_gcal_push_booking (REPLACE)\u2014 loop-prevention guard + correlation id
+--   \xA73  plg_calendar_sync_log         \u2014 correlation_id + channel_id_ref columns
+--   \xA74  inbound write functions       \u2014 the ONLY path Google\u2192booking writes take
+--                                       (gcal_import_event / gcal_apply_event_patch
+--                                        / gcal_unlink_channel), SECURITY DEFINER,
+--                                       service_role-only
+--   \xA75  get_available_slots (REPLACE) \u2014 tenant-wide imported blocks now also
+--                                       remove slots for every professional
+--   \xA76  pg_cron template              \u2014 per-channel pull
+--
+-- Idempotent / re-runnable: IF NOT EXISTS, CREATE OR REPLACE, DROP \u2026 IF EXISTS.
+-- Written against the canonical public names (appointments uses starts_at/ends_at,
+-- metadata jsonb, party_id/assignee_id \u2014 see packages/db 004_archetypes.sql).
+-- ---------------------------------------------------------------------------
+
+-- ===========================================================================
+-- \xA71 \u2014 plg_calendar_channels: multi-calendar de-para (vertical-agnostic)
+--   target_kind NULL  \u2192 whole tenant agenda (agency-os): every professional
+--   target_kind 'assignee' \u2192 calendar maps to one professional (school: teacher)
+--   target_kind 'service' | 'location' \u2192 clinic-style mapping
+--   import_mode 'block'       \u2192 inbound events become opaque busy blocks
+--   import_mode 'appointment' \u2192 inbound events become real appointments
+-- ===========================================================================
+CREATE TABLE IF NOT EXISTS public.plg_calendar_channels (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  integration_id uuid NOT NULL REFERENCES public.plg_calendar_integrations(id) ON DELETE CASCADE,
+  tenant_id uuid NOT NULL,
+  google_calendar_id text NOT NULL,
+  summary text,
+  color text,
+  direction text NOT NULL DEFAULT 'bidirectional'
+    CHECK (direction IN ('inbound','outbound','bidirectional','off')),
+  target_kind text CHECK (target_kind IN ('assignee','service','location')),
+  target_id uuid,
+  import_mode text NOT NULL DEFAULT 'block'
+    CHECK (import_mode IN ('block','appointment')),
+  sync_token text,
+  channel_id text,
+  resource_id text,
+  channel_expires_at timestamptz,
+  is_active boolean NOT NULL DEFAULT true,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE (integration_id, google_calendar_id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_plg_calendar_channels_tenant      ON public.plg_calendar_channels(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_plg_calendar_channels_integration ON public.plg_calendar_channels(integration_id);
+
+ALTER TABLE public.plg_calendar_channels ENABLE ROW LEVEL SECURITY;
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.plg_calendar_channels TO authenticated;
+-- service_role bypasses RLS, but this table is born after 004's blanket grant,
+-- so grant it explicitly (the inbound functions run as definer/service_role).
+GRANT ALL ON public.plg_calendar_channels TO service_role;
+
+DROP TRIGGER IF EXISTS plg_calendar_channels_updated_at ON public.plg_calendar_channels;
+CREATE TRIGGER plg_calendar_channels_updated_at BEFORE UPDATE ON public.plg_calendar_channels
+  FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
+
+-- RLS: tenant isolation (padr\xE3o 001) + explicit service_role FOR ALL policy
+-- (matches the vigente service_role policy pattern from 001_core payment_events).
+DROP POLICY IF EXISTS plg_calendar_channels_rls ON public.plg_calendar_channels;
+CREATE POLICY plg_calendar_channels_rls ON public.plg_calendar_channels
+  FOR ALL TO authenticated
+  USING (tenant_id IN (SELECT public.user_tenant_ids()))
+  WITH CHECK (tenant_id IN (SELECT public.user_tenant_ids()));
+
+DROP POLICY IF EXISTS plg_calendar_channels_service ON public.plg_calendar_channels;
+CREATE POLICY plg_calendar_channels_service ON public.plg_calendar_channels
+  FOR ALL TO service_role USING (true) WITH CHECK (true);
+
+-- ===========================================================================
+-- \xA72 \u2014 Outbound trigger with loop-prevention + correlation id.
+-- CREATE OR REPLACE of 001's fn_gcal_push_booking. Same pg_net \u2192 edge function
+-- payload (app.gcal_sync_url / app.gcal_service_key), but now:
+--   * SKIP the push when the write itself came from the Google sync, detected by
+--     the TRANSACTION-LOCAL GUC app.booking_origin = 'google' \u2014 set by every \xA74
+--     writer via set_config(..., true) and gone when the transaction ends.
+--     This is what stops the Google\u2192booking\u2192Google\u2192\u2026 echo loop.
+--     Deliberately NOT a persistent metadata check: a sticky marker
+--     (metadata.syncOrigin) would permanently mute pushes for imported events,
+--     so a later admin edit would never reach Google. metadata.syncOrigin is
+--     kept by \xA74 as provenance only \u2014 this trigger does not read it.
+--   * carry a correlation_id so both directions can be stitched in the sync log
+--     (from GUC app.booking_correlation_id, else a fresh uuid \u2014 design ported
+--      from PR #7).
+-- ===========================================================================
+CREATE OR REPLACE FUNCTION public.fn_gcal_push_booking() RETURNS trigger
+LANGUAGE plpgsql SECURITY DEFINER AS $$
+DECLARE
+  url  text := current_setting('app.gcal_sync_url', true);
+  key  text := current_setting('app.gcal_service_key', true);
+  rec  record := COALESCE(NEW, OLD);
+  op   text := lower(TG_OP);
+  corr text := NULLIF(current_setting('app.booking_correlation_id', true), '');
+BEGIN
+  -- Loop guard: never bounce a Google-originated write back to Google.
+  -- Transaction-local GUC only (see \xA72 header for why not persistent metadata).
+  IF current_setting('app.booking_origin', true) = 'google' THEN
+    RETURN COALESCE(NEW, OLD);
+  END IF;
+
+  IF url IS NULL OR url = '' THEN RETURN COALESCE(NEW, OLD); END IF;
+
+  PERFORM net.http_post(
+    url := url,
+    headers := jsonb_build_object('Content-Type', 'application/json',
+                                  'Authorization', 'Bearer ' || COALESCE(key, '')),
+    body := jsonb_build_object(
+      'action', 'push_event',
+      'op', op,
+      'bookingId', rec.id,
+      'tenantId', rec.tenant_id,
+      'correlationId', COALESCE(corr, gen_random_uuid()::text)
+    )
+  );
+  RETURN COALESCE(NEW, OLD);
+END $$;
+
+-- Re-assert the trigger (idempotent; unchanged from 001).
+DROP TRIGGER IF EXISTS trg_gcal_push ON public.appointments;
+CREATE TRIGGER trg_gcal_push
+  AFTER INSERT OR UPDATE OR DELETE ON public.appointments
+  FOR EACH ROW EXECUTE FUNCTION public.fn_gcal_push_booking();
+
+-- ===========================================================================
+-- \xA73 \u2014 sync log: correlate the two directions + reference the source channel.
+-- ===========================================================================
+ALTER TABLE public.plg_calendar_sync_log
+  ADD COLUMN IF NOT EXISTS correlation_id uuid;
+ALTER TABLE public.plg_calendar_sync_log
+  ADD COLUMN IF NOT EXISTS channel_id_ref uuid
+    REFERENCES public.plg_calendar_channels(id) ON DELETE SET NULL;
+-- Unlinked future events seen during a pull (import-wizard candidates), so the
+-- log can show "N eventos aguardando import" without re-hitting Google.
+ALTER TABLE public.plg_calendar_sync_log
+  ADD COLUMN IF NOT EXISTS discovered integer;
+
+-- ===========================================================================
+-- \xA74 \u2014 Inbound write path (Google \u2192 booking). THE single entry point used by
+-- the edge function (scheduled pull, webhook, and the import wizard). All three
+-- functions are SECURITY DEFINER with SET search_path = public and are granted
+-- to service_role ONLY (anon/authenticated explicitly revoked) \u2014 they bypass the
+-- tenant RLS on purpose and must never be reachable from the anon/authenticated
+-- PostgREST surface. Every writer sets the TRANSACTION-LOCAL GUC
+-- app.booking_origin='google' (set_config ..., true) so \xA72's trigger suppresses
+-- the echo for THIS write only; metadata.syncOrigin is provenance, not a guard.
+-- ===========================================================================
+
+-- gcal_import_event: create (or idempotently update) a booking from a Google
+-- event, honouring the channel's import_mode + target mapping.
+--   kind        = 'block' | 'appointment'      (from channel.import_mode)
+--   assignee_id = channel.target_id when target_kind='assignee', else NULL
+--                 (NULL = tenant-wide \u2192 blocks every professional, see \xA75)
+--   location_id = channel.target_id when target_kind='location', else NULL
+--   status      = 'scheduled'
+-- No order is created \u2014 an external import is not a sale. Idempotent on
+-- (tenant_id, metadata.googleCalendarEventId): update in place if seen before.
+CREATE OR REPLACE FUNCTION public.gcal_import_event(
+  p_tenant_id   uuid,
+  p_channel_id  uuid,
+  p_event_id    text,
+  p_etag        text,
+  p_summary     text,
+  p_starts_at   timestamptz,
+  p_ends_at     timestamptz,
+  p_all_day     boolean,
+  p_description text DEFAULT NULL
+) RETURNS uuid
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_ch          record;
+  v_kind        text;
+  v_assignee    uuid;
+  v_location    uuid;
+  v_ends        timestamptz;
+  v_meta        jsonb;
+  v_existing    uuid;
+  v_appt        uuid;
+BEGIN
+  IF p_tenant_id IS NULL OR p_event_id IS NULL OR p_starts_at IS NULL THEN
+    RAISE EXCEPTION 'gcal_import_event: tenant, event id and start are required';
+  END IF;
+
+  -- Transaction-local: \xA72's trigger skips the echo for this write only.
+  PERFORM set_config('app.booking_origin', 'google', true);
+
+  -- Resolve the channel mapping (must belong to the same tenant).
+  SELECT c.import_mode, c.target_kind, c.target_id
+    INTO v_ch
+  FROM plg_calendar_channels c
+  WHERE c.id = p_channel_id AND c.tenant_id = p_tenant_id;
+  IF NOT FOUND THEN RAISE EXCEPTION 'gcal_import_event: unknown channel for tenant'; END IF;
+
+  v_kind     := CASE WHEN v_ch.import_mode = 'appointment' THEN 'appointment' ELSE 'block' END;
+  v_assignee := CASE WHEN v_ch.target_kind = 'assignee' THEN v_ch.target_id ELSE NULL END;
+  v_location := CASE WHEN v_ch.target_kind = 'location' THEN v_ch.target_id ELSE NULL END;
+
+  -- All-day events without an explicit end block the whole day so \xA75 excludes it.
+  v_ends := COALESCE(
+    p_ends_at,
+    CASE WHEN COALESCE(p_all_day, false) THEN p_starts_at + interval '1 day' ELSE p_starts_at END
+  );
+
+  v_meta := jsonb_build_object(
+    'syncOrigin', 'google',
+    'googleCalendarEventId', p_event_id,
+    'gcalEtag', p_etag,
+    'gcalChannelId', p_channel_id::text,
+    'allDay', COALESCE(p_all_day, false),
+    'title', p_summary,
+    'source', 'google_import'
+  );
+
+  -- Idempotency: has this event already been imported for the tenant?
+  SELECT b.id INTO v_existing
+  FROM appointments b
+  WHERE b.tenant_id = p_tenant_id
+    AND b.metadata->>'googleCalendarEventId' = p_event_id
+  LIMIT 1;
+
+  IF v_existing IS NOT NULL THEN
+    UPDATE appointments b
+    SET kind        = v_kind,
+        assignee_id = v_assignee,
+        location_id = v_location,
+        starts_at   = p_starts_at,
+        ends_at     = v_ends,
+        status      = 'scheduled',
+        notes       = COALESCE(p_description, p_summary),
+        metadata    = COALESCE(b.metadata, '{}'::jsonb) || v_meta,
+        updated_at  = now()
+    WHERE b.id = v_existing
+    RETURNING b.id INTO v_appt;
+  ELSE
+    INSERT INTO appointments (tenant_id, kind, assignee_id, location_id,
+                              starts_at, ends_at, status, notes, metadata)
+    VALUES (p_tenant_id, v_kind, v_assignee, v_location,
+            p_starts_at, v_ends, 'scheduled', COALESCE(p_description, p_summary), v_meta)
+    RETURNING id INTO v_appt;
+  END IF;
+
+  RETURN v_appt;
+END $$;
+
+-- gcal_apply_event_patch: apply an inbound reschedule/cancel to an already-linked
+-- booking. Located by metadata.googleCalendarEventId. Echo suppression: if the
+-- stored gcalEtag already equals the incoming etag, this is our own write coming
+-- back \u2014 skip and return NULL. Every real write re-stamps syncOrigin='google'.
+CREATE OR REPLACE FUNCTION public.gcal_apply_event_patch(
+  p_tenant_id uuid,
+  p_event_id  text,
+  p_etag      text,
+  p_starts_at timestamptz,
+  p_ends_at   timestamptz,
+  p_summary   text,
+  p_cancelled boolean
+) RETURNS uuid
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_appt      uuid;
+  v_curr_etag text;
+BEGIN
+  IF p_tenant_id IS NULL OR p_event_id IS NULL THEN
+    RAISE EXCEPTION 'gcal_apply_event_patch: tenant and event id are required';
+  END IF;
+
+  -- Transaction-local: \xA72's trigger skips the echo for this write only.
+  PERFORM set_config('app.booking_origin', 'google', true);
+
+  SELECT b.id, b.metadata->>'gcalEtag'
+    INTO v_appt, v_curr_etag
+  FROM appointments b
+  WHERE b.tenant_id = p_tenant_id
+    AND b.metadata->>'googleCalendarEventId' = p_event_id
+  LIMIT 1;
+
+  IF v_appt IS NULL THEN RETURN NULL; END IF;                 -- not linked here
+  IF p_etag IS NOT NULL AND p_etag = v_curr_etag THEN
+    RETURN NULL;                                              -- echo: nothing changed
+  END IF;
+
+  IF COALESCE(p_cancelled, false) THEN
+    UPDATE appointments b
+    SET status     = 'cancelled',
+        metadata   = COALESCE(b.metadata, '{}'::jsonb)
+                     || jsonb_build_object('syncOrigin', 'google', 'gcalEtag', p_etag),
+        updated_at = now()
+    WHERE b.id = v_appt;
+  ELSE
+    UPDATE appointments b
+    SET starts_at  = COALESCE(p_starts_at, b.starts_at),
+        ends_at    = COALESCE(p_ends_at, b.ends_at),
+        notes      = COALESCE(p_summary, b.notes),
+        metadata   = COALESCE(b.metadata, '{}'::jsonb)
+                     || jsonb_build_object('syncOrigin', 'google',
+                                           'gcalEtag', p_etag,
+                                           'title', COALESCE(p_summary, b.metadata->>'title')),
+        updated_at = now()
+    WHERE b.id = v_appt;
+  END IF;
+
+  RETURN v_appt;
+END $$;
+
+-- gcal_stamp_outbound: after the edge function creates the Google event for an
+-- outbound push, it stamps the fresh event id/etag back onto the appointment.
+-- Bookkeeping only \u2014 must not re-fire \xA72's trigger, hence the GUC. Does NOT set
+-- metadata.syncOrigin (the booking's provenance is still the app/site).
+CREATE OR REPLACE FUNCTION public.gcal_stamp_outbound(
+  p_tenant_id   uuid,
+  p_booking_id  uuid,
+  p_event_id    text,
+  p_etag        text DEFAULT NULL,
+  p_calendar_id text DEFAULT NULL
+) RETURNS uuid
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_id uuid;
+BEGIN
+  IF p_tenant_id IS NULL OR p_booking_id IS NULL OR p_event_id IS NULL THEN
+    RAISE EXCEPTION 'gcal_stamp_outbound: tenant, booking and event id are required';
+  END IF;
+
+  -- Transaction-local: \xA72's trigger skips the echo for this write only.
+  PERFORM set_config('app.booking_origin', 'google', true);
+
+  UPDATE appointments b
+  SET metadata   = COALESCE(b.metadata, '{}'::jsonb)
+                   || jsonb_build_object('googleCalendarEventId', p_event_id,
+                                         'gcalEtag', p_etag,
+                                         'gcalSyncedAt', now())
+                   || CASE WHEN p_calendar_id IS NULL THEN '{}'::jsonb
+                           ELSE jsonb_build_object('gcalCalendarId', p_calendar_id) END,
+      updated_at = now()
+  WHERE b.id = p_booking_id AND b.tenant_id = p_tenant_id
+  RETURNING b.id INTO v_id;
+  RETURN v_id;
+END $$;
+
+-- gcal_unlink_channel: forget the incremental cursor + Google watch bookkeeping
+-- for a channel (used on disconnect / re-watch). Leaves the mapping row in place.
+CREATE OR REPLACE FUNCTION public.gcal_unlink_channel(
+  p_channel_id uuid
+) RETURNS uuid
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_id uuid;
+BEGIN
+  UPDATE plg_calendar_channels c
+  SET sync_token         = NULL,
+      channel_id         = NULL,
+      resource_id        = NULL,
+      channel_expires_at = NULL,
+      updated_at         = now()
+  WHERE c.id = p_channel_id
+  RETURNING c.id INTO v_id;
+  RETURN v_id;
+END $$;
+
+-- Lock the inbound writers to service_role only.
+DO $$
+DECLARE fn text;
+BEGIN
+  FOR fn IN SELECT unnest(ARRAY[
+    'public.gcal_import_event(uuid, uuid, text, text, text, timestamptz, timestamptz, boolean, text)',
+    'public.gcal_apply_event_patch(uuid, text, text, timestamptz, timestamptz, text, boolean)',
+    'public.gcal_stamp_outbound(uuid, uuid, text, text, text)',
+    'public.gcal_unlink_channel(uuid)'
+  ])
+  LOOP
+    EXECUTE format('REVOKE ALL ON FUNCTION %s FROM public, anon, authenticated', fn);
+    EXECUTE format('GRANT EXECUTE ON FUNCTION %s TO service_role', fn);
+  END LOOP;
+END $$;
+
+-- ===========================================================================
+-- \xA75 \u2014 get_available_slots: imported Google blocks must remove availability.
+-- CREATE OR REPLACE keeping the EXACT signature (anon + admin both call it, and
+-- it is graded on the same shape as plugin-agenda/src/migrations/001_public_booking.sql).
+--
+-- Conceptual diff vs 001 \u2014 ONE condition in the overlap NOT EXISTS:
+--   before:  AND b.assignee_id = c.assignee_id
+--   after:   AND (b.assignee_id = c.assignee_id
+--                 OR (b.assignee_id IS NULL AND b.kind = 'block'))
+-- Rationale: a tenant-wide BLOCK imported from Google (target_kind NULL \u2192
+-- assignee_id IS NULL, kind 'block', see \xA74) must busy-out the slot for EVERY
+-- professional. Restricted to kind='block' so an unassigned admin appointment
+-- keeps the 001 behaviour (blocks nobody). Per-assignee rows keep matching on
+-- assignee_id.
+-- Everything else is byte-identical to 001: the status filter already covers
+-- "any non-cancelled kind" (no_show also excluded), and the p_assignee_id-NULL
+-- fan-out across staff via day_schedules is preserved untouched.
+-- ===========================================================================
+CREATE OR REPLACE FUNCTION public.get_available_slots(
+  p_tenant_id uuid,
+  p_date date,
+  p_duration_minutes integer,
+  p_assignee_id uuid DEFAULT NULL,
+  p_slot_interval integer DEFAULT 30
+) RETURNS TABLE (slot_start timestamptz, slot_end timestamptz)
+LANGUAGE plpgsql STABLE SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_tz text;
+BEGIN
+  -- tight validation: this function is anon-callable
+  IF p_duration_minutes IS NULL OR p_duration_minutes NOT BETWEEN 5 AND 480 THEN
+    RAISE EXCEPTION 'invalid duration';
+  END IF;
+  IF p_slot_interval IS NULL OR p_slot_interval NOT BETWEEN 5 AND 240 THEN
+    RAISE EXCEPTION 'invalid interval';
+  END IF;
+  IF p_date IS NULL OR p_date < current_date OR p_date > current_date + 90 THEN
+    RETURN;
+  END IF;
+
+  SELECT COALESCE(t.settings->>'timezone', 'America/Sao_Paulo') INTO v_tz
+  FROM tenants t WHERE t.id = p_tenant_id;
+  IF v_tz IS NULL THEN RETURN; END IF;  -- unknown tenant \u2192 empty, not an error
+
+  RETURN QUERY
+  WITH day_schedules AS (
+    SELECT sc.assignee_id, sc.starts_at AS win_start, sc.ends_at AS win_end
+    FROM schedules sc
+    WHERE sc.tenant_id = p_tenant_id
+      AND sc.kind = 'working_hours'
+      AND sc.is_active
+      AND (p_assignee_id IS NULL OR sc.assignee_id = p_assignee_id)
+      AND (
+        sc.specific_date = p_date
+        OR (sc.specific_date IS NULL AND sc.day_of_week = EXTRACT(dow FROM p_date)::smallint)
+      )
+  ),
+  candidate AS (
+    SELECT
+      ds.assignee_id,
+      gs                                              AS s_start,
+      gs + make_interval(mins => p_duration_minutes)  AS s_end
+    FROM day_schedules ds
+    CROSS JOIN LATERAL generate_series(
+      (p_date + ds.win_start) AT TIME ZONE v_tz,
+      ((p_date + ds.win_end) AT TIME ZONE v_tz) - make_interval(mins => p_duration_minutes),
+      make_interval(mins => p_slot_interval)
+    ) AS gs
+  )
+  SELECT DISTINCT c.s_start, c.s_end
+  FROM candidate c
+  WHERE NOT EXISTS (
+    SELECT 1 FROM appointments b
+    WHERE b.tenant_id = p_tenant_id
+      -- SMART SYNC: match this professional's own bookings OR any tenant-wide
+      -- BLOCK (assignee_id IS NULL AND kind='block', e.g. imported from Google
+      -- with a whole-tenant channel) \u2014 the latter busies the slot for every
+      -- professional. Assignee-less rows of other kinds (an unassigned admin
+      -- appointment) keep the 001 behaviour and do not block anyone.
+      AND (b.assignee_id = c.assignee_id
+           OR (b.assignee_id IS NULL AND b.kind = 'block'))
+      AND b.status NOT IN ('cancelled', 'no_show')
+      AND b.starts_at < c.s_end
+      AND COALESCE(b.ends_at, b.starts_at) > c.s_start
+  )
+  ORDER BY 1;
+END;
+$$;
+
+REVOKE ALL ON FUNCTION public.get_available_slots(uuid, date, integer, uuid, integer) FROM public;
+GRANT EXECUTE ON FUNCTION public.get_available_slots(uuid, date, integer, uuid, integer)
+  TO anon, authenticated, service_role;
+
+-- ===========================================================================
+-- \xA76 \u2014 Inbound schedule (optional) \u2014 per-channel incremental pull.
+-- Supersedes the single-calendar template in 001. Enable once per project after
+-- setting app.gcal_sync_url / app.gcal_service_key (see 001 header). The edge
+-- function fans out over active channels, using each channel's sync_token cursor:
+--
+--   SELECT cron.schedule('gcal-pull', '*/10 * * * *', $CRON$
+--     SELECT net.http_post(
+--       url := current_setting('app.gcal_sync_url'),
+--       headers := jsonb_build_object(
+--         'Content-Type','application/json',
+--         'Authorization','Bearer '||current_setting('app.gcal_service_key')),
+--       body := jsonb_build_object('action','pull_events'))
+--   $CRON$);
+--
+-- Or drive one row per channel from SQL (tighter scoping / per-channel cadence):
+--
+--   SELECT cron.schedule('gcal-pull-'||ch.id::text, '*/10 * * * *', format($CRON$
+--     SELECT net.http_post(
+--       url := current_setting('app.gcal_sync_url'),
+--       headers := jsonb_build_object(
+--         'Content-Type','application/json',
+--         'Authorization','Bearer '||current_setting('app.gcal_service_key')),
+--       body := jsonb_build_object('action','pull_events','channelId',%L))
+--   $CRON$, ch.id))
+--   FROM public.plg_calendar_channels ch
+--   WHERE ch.is_active AND ch.direction IN ('inbound','bidirectional');
+-- ===========================================================================
+`;
+var MIGRATION_003_PLG_RENAME = `-- ---------------------------------------------------------------------------
+-- 003_plg_rename.sql \u2014 standardize the Google Calendar connector objects onto
+-- the platform \`plg_<plugin>_\` prefix (DATA-MODEL.md Ring 1).
+--
+--   calendar_integrations \u2192 plg_calendar_integrations
+--   calendar_channels     \u2192 plg_calendar_channels
+--   calendar_sync_log     \u2192 plg_calendar_sync_log
+--
+-- Legacy-pool remediation ONLY: 001/002 now create the prefixed names directly,
+-- so fresh installs never reach a rename branch. Fully idempotent and guarded \u2014
+-- every RENAME fires only when the old object exists and the new one does not,
+-- so re-running (or running on an already-prefixed pool) is a no-op.
+--
+-- A table RENAME preserves its data, RLS state, policies, grants, indexes,
+-- constraints and triggers (they follow the table), so \xA71 only renames the
+-- table + the explicitly-named indexes. \xA72 then re-points the SECURITY DEFINER
+-- gcal_* functions whose bodies hard-code the old table names.
+-- ---------------------------------------------------------------------------
+
+-- ===========================================================================
+-- \xA71 \u2014 Guarded table + index renames.
+-- ===========================================================================
+DO $$
+BEGIN
+  IF to_regclass('public.calendar_integrations') IS NOT NULL
+     AND to_regclass('public.plg_calendar_integrations') IS NULL THEN
+    ALTER TABLE public.calendar_integrations RENAME TO plg_calendar_integrations;
+  END IF;
+
+  IF to_regclass('public.calendar_channels') IS NOT NULL
+     AND to_regclass('public.plg_calendar_channels') IS NULL THEN
+    ALTER TABLE public.calendar_channels RENAME TO plg_calendar_channels;
+  END IF;
+
+  IF to_regclass('public.calendar_sync_log') IS NOT NULL
+     AND to_regclass('public.plg_calendar_sync_log') IS NULL THEN
+    ALTER TABLE public.calendar_sync_log RENAME TO plg_calendar_sync_log;
+  END IF;
+
+  -- Named indexes do not follow a table rename automatically.
+  IF to_regclass('public.idx_calendar_integrations_tenant') IS NOT NULL
+     AND to_regclass('public.idx_plg_calendar_integrations_tenant') IS NULL THEN
+    ALTER INDEX public.idx_calendar_integrations_tenant RENAME TO idx_plg_calendar_integrations_tenant;
+  END IF;
+
+  IF to_regclass('public.idx_calendar_channels_tenant') IS NOT NULL
+     AND to_regclass('public.idx_plg_calendar_channels_tenant') IS NULL THEN
+    ALTER INDEX public.idx_calendar_channels_tenant RENAME TO idx_plg_calendar_channels_tenant;
+  END IF;
+
+  IF to_regclass('public.idx_calendar_channels_integration') IS NOT NULL
+     AND to_regclass('public.idx_plg_calendar_channels_integration') IS NULL THEN
+    ALTER INDEX public.idx_calendar_channels_integration RENAME TO idx_plg_calendar_channels_integration;
+  END IF;
+END $$;
+
+-- ===========================================================================
+-- \xA72 \u2014 Re-point the inbound SECURITY DEFINER writers at the prefixed names.
+-- These bodies are byte-identical to 002_smart_sync.sql except the calendar_*
+-- table references, which now read plg_calendar_*. gcal_apply_event_patch and
+-- gcal_stamp_outbound only touch public.appointments (unaffected by the rename)
+-- and are re-asserted here for completeness so all four writers stay in step.
+-- ===========================================================================
+
+CREATE OR REPLACE FUNCTION public.gcal_import_event(
+  p_tenant_id   uuid,
+  p_channel_id  uuid,
+  p_event_id    text,
+  p_etag        text,
+  p_summary     text,
+  p_starts_at   timestamptz,
+  p_ends_at     timestamptz,
+  p_all_day     boolean,
+  p_description text DEFAULT NULL
+) RETURNS uuid
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_ch          record;
+  v_kind        text;
+  v_assignee    uuid;
+  v_location    uuid;
+  v_ends        timestamptz;
+  v_meta        jsonb;
+  v_existing    uuid;
+  v_appt        uuid;
+BEGIN
+  IF p_tenant_id IS NULL OR p_event_id IS NULL OR p_starts_at IS NULL THEN
+    RAISE EXCEPTION 'gcal_import_event: tenant, event id and start are required';
+  END IF;
+
+  PERFORM set_config('app.booking_origin', 'google', true);
+
+  SELECT c.import_mode, c.target_kind, c.target_id
+    INTO v_ch
+  FROM plg_calendar_channels c
+  WHERE c.id = p_channel_id AND c.tenant_id = p_tenant_id;
+  IF NOT FOUND THEN RAISE EXCEPTION 'gcal_import_event: unknown channel for tenant'; END IF;
+
+  v_kind     := CASE WHEN v_ch.import_mode = 'appointment' THEN 'appointment' ELSE 'block' END;
+  v_assignee := CASE WHEN v_ch.target_kind = 'assignee' THEN v_ch.target_id ELSE NULL END;
+  v_location := CASE WHEN v_ch.target_kind = 'location' THEN v_ch.target_id ELSE NULL END;
+
+  v_ends := COALESCE(
+    p_ends_at,
+    CASE WHEN COALESCE(p_all_day, false) THEN p_starts_at + interval '1 day' ELSE p_starts_at END
+  );
+
+  v_meta := jsonb_build_object(
+    'syncOrigin', 'google',
+    'googleCalendarEventId', p_event_id,
+    'gcalEtag', p_etag,
+    'gcalChannelId', p_channel_id::text,
+    'allDay', COALESCE(p_all_day, false),
+    'title', p_summary,
+    'source', 'google_import'
+  );
+
+  SELECT b.id INTO v_existing
+  FROM appointments b
+  WHERE b.tenant_id = p_tenant_id
+    AND b.metadata->>'googleCalendarEventId' = p_event_id
+  LIMIT 1;
+
+  IF v_existing IS NOT NULL THEN
+    UPDATE appointments b
+    SET kind        = v_kind,
+        assignee_id = v_assignee,
+        location_id = v_location,
+        starts_at   = p_starts_at,
+        ends_at     = v_ends,
+        status      = 'scheduled',
+        notes       = COALESCE(p_description, p_summary),
+        metadata    = COALESCE(b.metadata, '{}'::jsonb) || v_meta,
+        updated_at  = now()
+    WHERE b.id = v_existing
+    RETURNING b.id INTO v_appt;
+  ELSE
+    INSERT INTO appointments (tenant_id, kind, assignee_id, location_id,
+                              starts_at, ends_at, status, notes, metadata)
+    VALUES (p_tenant_id, v_kind, v_assignee, v_location,
+            p_starts_at, v_ends, 'scheduled', COALESCE(p_description, p_summary), v_meta)
+    RETURNING id INTO v_appt;
+  END IF;
+
+  RETURN v_appt;
+END $$;
+
+CREATE OR REPLACE FUNCTION public.gcal_apply_event_patch(
+  p_tenant_id uuid,
+  p_event_id  text,
+  p_etag      text,
+  p_starts_at timestamptz,
+  p_ends_at   timestamptz,
+  p_summary   text,
+  p_cancelled boolean
+) RETURNS uuid
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_appt      uuid;
+  v_curr_etag text;
+BEGIN
+  IF p_tenant_id IS NULL OR p_event_id IS NULL THEN
+    RAISE EXCEPTION 'gcal_apply_event_patch: tenant and event id are required';
+  END IF;
+
+  PERFORM set_config('app.booking_origin', 'google', true);
+
+  SELECT b.id, b.metadata->>'gcalEtag'
+    INTO v_appt, v_curr_etag
+  FROM appointments b
+  WHERE b.tenant_id = p_tenant_id
+    AND b.metadata->>'googleCalendarEventId' = p_event_id
+  LIMIT 1;
+
+  IF v_appt IS NULL THEN RETURN NULL; END IF;
+  IF p_etag IS NOT NULL AND p_etag = v_curr_etag THEN
+    RETURN NULL;
+  END IF;
+
+  IF COALESCE(p_cancelled, false) THEN
+    UPDATE appointments b
+    SET status     = 'cancelled',
+        metadata   = COALESCE(b.metadata, '{}'::jsonb)
+                     || jsonb_build_object('syncOrigin', 'google', 'gcalEtag', p_etag),
+        updated_at = now()
+    WHERE b.id = v_appt;
+  ELSE
+    UPDATE appointments b
+    SET starts_at  = COALESCE(p_starts_at, b.starts_at),
+        ends_at    = COALESCE(p_ends_at, b.ends_at),
+        notes      = COALESCE(p_summary, b.notes),
+        metadata   = COALESCE(b.metadata, '{}'::jsonb)
+                     || jsonb_build_object('syncOrigin', 'google',
+                                           'gcalEtag', p_etag,
+                                           'title', COALESCE(p_summary, b.metadata->>'title')),
+        updated_at = now()
+    WHERE b.id = v_appt;
+  END IF;
+
+  RETURN v_appt;
+END $$;
+
+CREATE OR REPLACE FUNCTION public.gcal_stamp_outbound(
+  p_tenant_id   uuid,
+  p_booking_id  uuid,
+  p_event_id    text,
+  p_etag        text DEFAULT NULL,
+  p_calendar_id text DEFAULT NULL
+) RETURNS uuid
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_id uuid;
+BEGIN
+  IF p_tenant_id IS NULL OR p_booking_id IS NULL OR p_event_id IS NULL THEN
+    RAISE EXCEPTION 'gcal_stamp_outbound: tenant, booking and event id are required';
+  END IF;
+
+  PERFORM set_config('app.booking_origin', 'google', true);
+
+  UPDATE appointments b
+  SET metadata   = COALESCE(b.metadata, '{}'::jsonb)
+                   || jsonb_build_object('googleCalendarEventId', p_event_id,
+                                         'gcalEtag', p_etag,
+                                         'gcalSyncedAt', now())
+                   || CASE WHEN p_calendar_id IS NULL THEN '{}'::jsonb
+                           ELSE jsonb_build_object('gcalCalendarId', p_calendar_id) END,
+      updated_at = now()
+  WHERE b.id = p_booking_id AND b.tenant_id = p_tenant_id
+  RETURNING b.id INTO v_id;
+  RETURN v_id;
+END $$;
+
+CREATE OR REPLACE FUNCTION public.gcal_unlink_channel(
+  p_channel_id uuid
+) RETURNS uuid
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_id uuid;
+BEGIN
+  UPDATE plg_calendar_channels c
+  SET sync_token         = NULL,
+      channel_id         = NULL,
+      resource_id        = NULL,
+      channel_expires_at = NULL,
+      updated_at         = now()
+  WHERE c.id = p_channel_id
+  RETURNING c.id INTO v_id;
+  RETURN v_id;
+END $$;
+
+-- Re-assert the service_role-only lock (idempotent; matches 002 \xA74).
+DO $$
+DECLARE fn text;
+BEGIN
+  FOR fn IN SELECT unnest(ARRAY[
+    'public.gcal_import_event(uuid, uuid, text, text, text, timestamptz, timestamptz, boolean, text)',
+    'public.gcal_apply_event_patch(uuid, text, text, timestamptz, timestamptz, text, boolean)',
+    'public.gcal_stamp_outbound(uuid, uuid, text, text, text)',
+    'public.gcal_unlink_channel(uuid)'
+  ])
+  LOOP
+    EXECUTE format('REVOKE ALL ON FUNCTION %s FROM public, anon, authenticated', fn);
+    EXECUTE format('GRANT EXECUTE ON FUNCTION %s TO service_role', fn);
+  END LOOP;
+END $$;
+`;
+var MIGRATION_004_DROP_OAUTH_TOKENS = `-- ============================================================================
+-- Google Calendar 004: the credential leaves the tenant database, and the
+-- outbound trigger stops being able to break a booking write.
+--
+--   \xA71  credential  drop oauth_refresh_token + oauth_access_token
+--   \xA72  outbound    anti-loop, safe no-op, delete context, correlation id
+--   \xA73  realtime    publish public.appointments so the calendar repaints
+--
+-- Additive and idempotent: no table is created, no policy is rewritten, and the
+-- tenant RLS from 001 already covers everything touched here.
+-- ============================================================================
+
+-- \xA71 \u2500\u2500 credential \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- THE EXPOSURE THIS CLOSES: 001 stored \`oauth_refresh_token text\` and
+-- \`oauth_access_token text\` on public.plg_calendar_integrations. That table is
+-- read from the browser with the publishable key under tenant RLS \u2014 and the
+-- connector read it with \`select('*')\` \u2014 so a Google refresh token was readable
+-- by ANY authenticated member of the tenant, reception included. A refresh token
+-- is not a session: it is durable access to the owner's entire calendar, mail-
+-- adjacent metadata and every calendar shared with them. And a pool is one
+-- Supabase project serving N tenants, so anything running there with
+-- service_role read every clinic's Google grant at once.
+--
+-- This is the third connector to make the same move, and the worst of the three.
+-- RankLayer had nothing to replace its key with (it pushes IN and authenticates
+-- against the platform); PlugBank's credential is meant to move to the platform
+-- (FAY-1360 \u2014 as of 2026-08-12 its api_token is still a plaintext pool column).
+-- Google Calendar is PlugBank's case: the grant still has to exist, it just must
+-- not exist HERE. The destination is the platform's ConnectorConnection store
+-- (encrypted; exists, unused), with the sync function redeeming per call \u2014 that
+-- is FAY-1359, and it has NOT happened.
+--
+-- \u26A0 REPO AHEAD OF POOL (verified 2026-08-12, FAY-1379): this file has NOT been
+-- applied to the live salon pool. plg_calendar_integrations there still carries
+-- both token columns with a real clinic's grant, and the DEPLOYED
+-- google-calendar-sync (v16) still reads and writes them. Applying this drop
+-- before FAY-1359's ordered rollout (function reads both homes \u2192 data migrated
+-- \u2192 function reads only the new home \u2192 drop) severs the clinic's sync. Do not
+-- \`db apply\` this to a pool outside that sequence.
+--
+-- \`token_expires_at\` deliberately stays. It is a timestamp, not a credential,
+-- and it is the only non-secret signal that a grant exists \u2014 which is what the
+-- browser needs in order to draw a connected/disconnected badge without ever
+-- being handed the thing it is reporting on. See ../credentials.ts.
+--
+-- ROTATE any token a pool already stored. Nothing is live on this connector yet,
+-- but DROP COLUMN is a catalog change: the old values stay in the heap until the
+-- next table rewrite, so a grant that ever reached a pool must be revoked at
+-- Google rather than assumed gone.
+
+DO $$
+BEGIN
+  IF to_regclass('public.plg_calendar_integrations') IS NOT NULL THEN
+    ALTER TABLE public.plg_calendar_integrations DROP COLUMN IF EXISTS oauth_refresh_token;
+    ALTER TABLE public.plg_calendar_integrations DROP COLUMN IF EXISTS oauth_access_token;
+  END IF;
+  -- Pools converted before 003 renamed the tables carry the legacy name.
+  IF to_regclass('public.calendar_integrations') IS NOT NULL THEN
+    ALTER TABLE public.calendar_integrations DROP COLUMN IF EXISTS oauth_refresh_token;
+    ALTER TABLE public.calendar_integrations DROP COLUMN IF EXISTS oauth_access_token;
+  END IF;
+END $$;
+
+-- \xA72 \u2500\u2500 outbound trigger \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- Three defects in 001's fn_gcal_push_booking, in order of how badly they hurt:
+--
+-- 1. NO ANTI-LOOP. An inbound Google event is written to public.appointments by
+--    the sync function, which fires this trigger, which pushes the same change
+--    back to Google, which changes the event, which the next pull reads as new.
+--    The symptom a customer reports is an appointment that will not stop moving.
+--    The sync function sets \`app.booking_origin = 'google'\` for the duration of
+--    its transaction; a write carrying that marker is never echoed back.
+--
+-- 2. A MISSING PREREQUISITE COULD BREAK THE BOOKING. 001 returned early on an
+--    empty URL but not on an empty key, so a half-configured pool sent an
+--    unauthenticated pg_net request; and any error raised in here aborts the
+--    INSERT that fired it. An integration that is not set up must degrade to
+--    "Google is not updated", never to "the appointment could not be saved".
+--    Every exit path below returns the row.
+--
+-- 3. A DELETE ARRIVED WITH NOTHING TO DELETE. AFTER DELETE can still read OLD,
+--    but pg_net delivers asynchronously \u2014 by the time the function runs, the row
+--    is gone and it cannot look up which Google event to remove. The linked ids
+--    now travel in the payload.
+--
+-- The early returns are not enough on their own: on a pool where the settings
+-- are present but pg_net is not installed, the PERFORM itself raises \`schema
+-- "net" does not exist\` and takes the INSERT down with it. So the delivery is
+-- wrapped too. Swallowing a delivery error is safe here because pg_net only
+-- ENQUEUES \u2014 anything it could tell us is already visible as "nothing has
+-- synced" in plg_calendar_sync_log and in the connector's derived health.
+--
+-- The Supabase service-role key still reaches this trigger through the
+-- \`app.gcal_service_key\` database setting that 001 introduced. That is a lesser
+-- exposure than the one closed in \xA71 (a GUC is not reachable through PostgREST,
+-- so no browser can read it) but it is still a pool-wide credential in the
+-- database, and it is NOT fixed here. FAY-1372 shipped the RLS half (a
+-- tenant-scoped claim narrows user_tenant_ids); nothing mints such a token for
+-- this trigger yet, and the function still runs on service_role (FAY-1378).
+-- Left as a named debt rather than moved to a third hiding place.
+
+CREATE OR REPLACE FUNCTION public.fn_gcal_push_booking() RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public, extensions, net
+AS $$
+DECLARE
+  url  text := current_setting('app.gcal_sync_url', true);
+  key  text := current_setting('app.gcal_service_key', true);
+  rec  record := COALESCE(NEW, OLD);
+  op   text := lower(TG_OP);
+  corr text := NULLIF(current_setting('app.booking_correlation_id', true), '');
+BEGIN
+  -- (1) Inbound Google writes mark themselves. Never echo them back.
+  IF current_setting('app.booking_origin', true) = 'google' THEN
+    RETURN COALESCE(NEW, OLD);
+  END IF;
+
+  -- (2) Not configured is not an error. Diagnostics report the connector as
+  -- incomplete; the appointment is saved either way.
+  IF NULLIF(url, '') IS NULL OR NULLIF(key, '') IS NULL THEN
+    RETURN COALESCE(NEW, OLD);
+  END IF;
+
+  BEGIN
+    PERFORM net.http_post(
+      url := url,
+      headers := jsonb_build_object(
+        'Content-Type', 'application/json',
+        'Authorization', 'Bearer ' || key
+      ),
+      body := jsonb_build_object(
+        'action', 'push_event',
+        'op', op,
+        'bookingId', rec.id,
+        'tenantId', rec.tenant_id,
+        -- (3) Carried so a delete can still be honoured after the row is gone.
+        'googleEventId', rec.metadata->>'googleCalendarEventId',
+        'calendarId', rec.metadata->>'gcalCalendarId',
+        'correlationId', COALESCE(corr, gen_random_uuid()::text)
+      )
+    );
+  EXCEPTION WHEN OTHERS THEN
+    -- Missing pg_net, a bad URL, a full queue: the appointment is still saved.
+    RAISE WARNING 'gcal push skipped for booking %: %', rec.id, SQLERRM;
+  END;
+
+  RETURN COALESCE(NEW, OLD);
+END $$;
+
+-- \xA73 \u2500\u2500 realtime \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- The calendar screen subscribes to public.appointments so a booking written by
+-- the sync function repaints the grid the manager is looking at, instead of
+-- waiting for them to reload the tab. Additive and guarded: a pool without the
+-- supabase_realtime publication is left alone, and re-running adds nothing.
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_publication WHERE pubname = 'supabase_realtime')
+     AND NOT EXISTS (
+       SELECT 1 FROM pg_publication_tables
+       WHERE pubname = 'supabase_realtime' AND schemaname = 'public' AND tablename = 'appointments'
+     )
+  THEN
+    ALTER PUBLICATION supabase_realtime ADD TABLE public.appointments;
+  END IF;
+END $$;
+`;
+var MIGRATION_005_OUTBOUND_VAULT_DELIVERY = `-- ============================================================================
+-- Google Calendar 005: the outbound credential moves to Vault, and stops being
+-- the service-role key. The Authorization header stays.
+--
+--   \xA71  trigger  fn_gcal_push_booking reads Vault, falls back to the old GUCs
+--   \xA72  cleanup  clear app.gcal_service_key ONLY where Vault already covers it
+--
+-- Additive and idempotent: a CREATE OR REPLACE plus a guarded, conditional
+-- catalog cleanup.
+--
+-- WRITTEN AGAINST THE DEPLOYED POOL, NOT AGAINST THIS FOLDER. The repo and
+-- cluster-salon-br-01 (gphxclpkbtbucoqclbco) had drifted: \`004\` here still reads
+-- \`app.gcal_service_key\`, while the pool has been on Vault since 2026-07-28 and
+-- the deployed function is four features ahead of \`functions/\`. Everything below
+-- was checked against the live database and the live function source, because
+-- the previous attempt at this file was derived from the repo alone and would
+-- have broken a real clinic. See FAY-1379 for the drift itself.
+-- ============================================================================
+
+-- \xA71 \u2500\u2500 the credential \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- THE EXPOSURE THIS CLOSES, precisely: \`001\` told operators to run
+--   ALTER DATABASE postgres SET app.gcal_service_key = '<service-role-key>';
+-- and every version of this trigger in the repo since (\`001\`, \`002 \xA72\`,
+-- \`004 \xA72\`) reads it back with current_setting(). A pool is ONE Supabase project
+-- serving N tenants and service_role bypasses RLS by definition, so that setting
+-- is unrestricted read/write over every tenant in the cluster, in plain text in
+-- pg_db_role_setting and in every pg_dump taken since.
+--
+-- It is closed by making the credential BOTH narrow and encrypted, not by
+-- removing it: the header is the only thing authorising the push. The deployed
+-- function checks it (\`isServiceRequest\` compares the bearer against
+-- GCAL_OUTBOUND_SECRET, then against the service-role key) and \`push_event\` is a
+-- service action with no user path, so a request with no Authorization header is
+-- rejected with \`400 Unknown action: push_event\`. Because pg_net is
+-- fire-and-forget that rejection is INVISIBLE \u2014 the clinic would simply stop
+-- appearing in Google Calendar. Removing the header is therefore not a security
+-- improvement, it is a silent outage. It was tried and reverted.
+--
+-- So: \`gcal_outbound_secret\` in Vault. Encrypted at rest, outside pg_dump's
+-- plaintext, readable only by a definer function like this one, and \u2014 the part
+-- that matters \u2014 it authorises exactly one thing, calling this connector's edge
+-- function. Losing it does not hand anyone another tenant's data. This is the
+-- shape the pool has been running since 2026-07-28; \`005\` is the repo catching
+-- up, so a pool provisioned fresh from this folder is born with it instead of
+-- being told to paste a service-role key into a database setting.
+--
+-- THE FALLBACK IS DELIBERATE. A pool that followed \`001\` and has no Vault secret
+-- keeps working off the old GUCs, loudly. The alternative \u2014 read Vault only \u2014
+-- silently disarms the push on exactly the pools that did what the docs told
+-- them to, which is the failure this file exists to avoid.
+--
+-- WHAT THIS DOES NOT FIX: the edge function still builds its Supabase client
+-- with SUPABASE_SERVICE_ROLE_KEY, so the FUNCTION still reads every tenant in
+-- the pool. That is not reachable from SQL and does not close here: it closes
+-- when the platform mints a short-lived tenant-scoped token (FAY-1353) that
+-- packages/db/migrations/028_tenant_scoped_token.sql already teaches every
+-- policy to honour through user_tenant_ids(). See docs/platform/DECISIONS.md,
+-- 2026-08-11 \u2014 "a connector's privilege comes from its token".
+--
+-- ROTATE the service-role key of any pool that ever ran \`001\`'s setup line: it
+-- was plain text at rest and in every backup taken since, so \xA72 clearing it is
+-- not the same as it never having been there.
+
+CREATE OR REPLACE FUNCTION public.fn_gcal_push_booking() RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public, extensions, net, vault
+AS $$
+DECLARE
+  url      text;
+  key      text;
+  legacy   boolean := false;
+  rec      record := COALESCE(NEW, OLD);
+  op       text := lower(TG_OP);
+  corr     text := NULLIF(current_setting('app.booking_correlation_id', true), '');
+BEGIN
+  -- Unchanged from 004: inbound Google writes mark themselves, and a write
+  -- carrying that marker is never echoed back.
+  IF current_setting('app.booking_origin', true) = 'google' THEN
+    RETURN COALESCE(NEW, OLD);
+  END IF;
+
+  -- Vault first. Wrapped because a pool without the vault extension must
+  -- degrade to the fallback, not abort the booking write.
+  BEGIN
+    SELECT decrypted_secret INTO url
+      FROM vault.decrypted_secrets WHERE name = 'gcal_sync_url'
+      ORDER BY created_at DESC LIMIT 1;
+    SELECT decrypted_secret INTO key
+      FROM vault.decrypted_secrets WHERE name = 'gcal_outbound_secret'
+      ORDER BY created_at DESC LIMIT 1;
+  EXCEPTION WHEN OTHERS THEN
+    url := NULL;
+    key := NULL;
+  END;
+
+  -- Legacy pools provisioned per 001's header keep working, and say so.
+  IF NULLIF(url, '') IS NULL OR NULLIF(key, '') IS NULL THEN
+    url := COALESCE(NULLIF(url, ''), current_setting('app.gcal_sync_url', true));
+    key := COALESCE(NULLIF(key, ''), current_setting('app.gcal_service_key', true));
+    legacy := NULLIF(key, '') IS NOT NULL;
+  END IF;
+
+  -- Not configured is not an error: an unconfigured pool degrades to "Google is
+  -- not updated", never to "the appointment could not be saved".
+  IF NULLIF(url, '') IS NULL OR NULLIF(key, '') IS NULL THEN
+    RETURN COALESCE(NEW, OLD);
+  END IF;
+
+  IF legacy THEN
+    RAISE WARNING 'gcal outbound is still using app.gcal_service_key; move it to the vault secret gcal_outbound_secret and rotate the service-role key';
+  END IF;
+
+  BEGIN
+    PERFORM net.http_post(
+      url := url,
+      headers := jsonb_build_object(
+        'Content-Type', 'application/json',
+        -- REQUIRED. The deployed function authorises push_event on this header
+        -- alone; without it every push 400s, silently, forever.
+        'Authorization', 'Bearer ' || key
+      ),
+      body := jsonb_build_object(
+        'action', 'push_event',
+        'op', op,
+        'bookingId', rec.id,
+        'tenantId', rec.tenant_id,
+        -- Carried so a delete can still be honoured after the row is gone.
+        'googleEventId', rec.metadata->>'googleCalendarEventId',
+        'calendarId', rec.metadata->>'gcalCalendarId',
+        'correlationId', COALESCE(corr, gen_random_uuid()::text)
+      )
+    );
+  EXCEPTION WHEN OTHERS THEN
+    -- Missing pg_net, a bad URL, a full queue: the appointment is still saved.
+    -- The deployed trigger lacks this wrapper; 004 added it here after a pool
+    -- with the settings present but the extension missing took an INSERT down.
+    RAISE WARNING 'gcal push skipped for booking %: %', rec.id, SQLERRM;
+  END;
+
+  RETURN COALESCE(NEW, OLD);
+END $$;
+
+-- \xA72 \u2500\u2500 cleanup \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- Redefining the function stops the key being PREFERRED; it does not stop it
+-- being STORED. Settings live in pg_db_role_setting per (database, role), so the
+-- sweep is driven off the catalog rather than off the one ALTER DATABASE form
+-- \`001\` happened to show.
+--
+-- CONDITIONAL ON PURPOSE: the setting is cleared only where Vault already
+-- supplies \`gcal_outbound_secret\`, i.e. only where \xA71 provably never needs the
+-- fallback. Anywhere else it is left in place and reported, because clearing it
+-- there would disarm the push with no error anyone can see. On the live pool
+-- this loop finds nothing \u2014 the setting is not present on any role or database \u2014
+-- and that is the expected result, not a failure.
+DO $$
+DECLARE
+  r          record;
+  has_vault  boolean := false;
+BEGIN
+  BEGIN
+    SELECT EXISTS (
+      SELECT 1 FROM vault.decrypted_secrets
+      WHERE name = 'gcal_outbound_secret' AND NULLIF(decrypted_secret, '') IS NOT NULL
+    ) INTO has_vault;
+  EXCEPTION WHEN OTHERS THEN
+    has_vault := false;
+  END;
+
+  FOR r IN
+    SELECT d.datname, a.rolname
+    FROM pg_db_role_setting s
+    LEFT JOIN pg_database d ON d.oid = s.setdatabase
+    LEFT JOIN pg_roles    a ON a.oid = s.setrole
+    WHERE EXISTS (
+      SELECT 1 FROM unnest(s.setconfig) AS c WHERE c LIKE 'app.gcal_service_key=%'
+    )
+  LOOP
+    IF NOT has_vault THEN
+      RAISE WARNING 'app.gcal_service_key is still set (database %, role %) and is the ONLY outbound credential \u2014 create the vault secret gcal_outbound_secret first, then re-run this migration',
+        r.datname, r.rolname;
+      CONTINUE;
+    END IF;
+    BEGIN
+      IF r.rolname IS NULL THEN
+        EXECUTE format('ALTER DATABASE %I RESET app.gcal_service_key', r.datname);
+      ELSIF r.datname IS NULL THEN
+        EXECUTE format('ALTER ROLE %I RESET app.gcal_service_key', r.rolname);
+      ELSE
+        EXECUTE format('ALTER ROLE %I IN DATABASE %I RESET app.gcal_service_key', r.rolname, r.datname);
+      END IF;
+    EXCEPTION WHEN OTHERS THEN
+      RAISE WARNING 'could not clear app.gcal_service_key (database %, role %): % \u2014 clear it by hand, and rotate the key either way',
+        r.datname, r.rolname, SQLERRM;
+    END;
+  END LOOP;
+END $$;
+`;
+var MIGRATION_006_WEBHOOK_DELIVERIES_OUTBOX = `-- ---------------------------------------------------------------------------
+-- Google Calendar WEBHOOK INTAKE \u2014 delivery ledger + automation outbox
+-- ---------------------------------------------------------------------------
+-- RECONSTRUCTED FROM THE LIVE SCHEMA on 2026-08-12 (FAY-1379). These objects
+-- existed in pool gphxclpkbtbucoqclbco and in NO migration in any repo: they
+-- were applied by hand alongside the google-calendar-webhook deployment. A pool
+-- provisioned from this repo could not run that function \u2014 the SELECT of
+-- plg_calendar_channels.webhook_token_hash failed before any gate ran, and both
+-- INSERT targets were missing. This file closes that hole.
+--
+-- Written to be applied to a pool that ALREADY has them: every statement is
+-- IF NOT EXISTS / DROP-then-CREATE, and re-running it must be a no-op.
+--
+--   \xA71  plg_calendar_channels          \u2014 the three webhook columns
+--   \xA72  plg_calendar_webhook_deliveries \u2014 one row per Google notification
+--   \xA73  plg_calendar_automation_outbox  \u2014 domain events for the automations lane
+--
+-- Read by: functions/google-calendar-webhook/index.ts (\xA71 gate, \xA72 idempotency,
+-- \xA73 emit) and functions/google-calendar-sync/index.ts (\xA71 watch bookkeeping,
+-- \xA73 emit on inbound import/patch).
+-- ---------------------------------------------------------------------------
+
+-- ===========================================================================
+-- \xA71 \u2014 Watch-channel authentication state on plg_calendar_channels.
+-- Added by ALTER in the pool (they sit after created_at/updated_at), so they
+-- are added the same way here rather than folded into 002's CREATE TABLE \u2014
+-- 002 has already run everywhere and its checksum must not move.
+--
+-- webhook_token_hash: SHA-256 of the token handed to Google at watch_start. The
+--   token itself is never stored, so a dump of this table does not let anyone
+--   forge a notification. The webhook re-hashes what arrives and compares in
+--   constant time.
+-- last_webhook_message_number: high-water mark of Google's monotonic per-channel
+--   counter \u2014 the replay guard. bigint because it outgrows int4.
+-- ===========================================================================
+ALTER TABLE public.plg_calendar_channels
+  ADD COLUMN IF NOT EXISTS webhook_token_hash text;
+ALTER TABLE public.plg_calendar_channels
+  ADD COLUMN IF NOT EXISTS last_webhook_message_number bigint;
+ALTER TABLE public.plg_calendar_channels
+  ADD COLUMN IF NOT EXISTS last_webhook_at timestamptz;
+
+-- ===========================================================================
+-- \xA72 \u2014 plg_calendar_webhook_deliveries: one row per accepted notification.
+--
+-- The row IS the idempotency mechanism, not a log of one: the webhook inserts
+-- before doing any work and reads 23505 as "already handled", returning 204.
+-- Hence two unique keys, both present in the pool and both reproduced \u2014
+-- (channel_ref, message_number) is the constraint the FK cascade protects, and
+-- (google_channel_id, message_number) catches a replay arriving after the
+-- channel row was recreated with the same Google channel id.
+-- ===========================================================================
+CREATE TABLE IF NOT EXISTS public.plg_calendar_webhook_deliveries (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL,
+  channel_ref uuid NOT NULL REFERENCES public.plg_calendar_channels(id) ON DELETE CASCADE,
+  google_channel_id text NOT NULL,
+  resource_id text,
+  message_number bigint NOT NULL,
+  resource_state text,
+  status text NOT NULL DEFAULT 'pending'
+    CHECK (status IN ('pending','processing','processed','failed','ignored')),
+  error text,
+  received_at timestamptz NOT NULL DEFAULT now(),
+  processed_at timestamptz,
+  created_at timestamptz DEFAULT now(),
+  UNIQUE (channel_ref, message_number)
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_plg_calendar_webhook_delivery_message
+  ON public.plg_calendar_webhook_deliveries (google_channel_id, message_number);
+
+CREATE INDEX IF NOT EXISTS idx_plg_calendar_webhook_deliveries_tenant_created
+  ON public.plg_calendar_webhook_deliveries (tenant_id, created_at DESC);
+
+-- Two partial indexes over the same predicate on different sort columns. Both
+-- are in the pool (evidence of two overlapping hand-applied scripts) and both
+-- are reproduced so this file matches the live schema exactly; consolidating
+-- them is a separate change with its own reasoning.
+CREATE INDEX IF NOT EXISTS idx_plg_calendar_webhook_pending
+  ON public.plg_calendar_webhook_deliveries (status, received_at)
+  WHERE status IN ('pending','failed');
+CREATE INDEX IF NOT EXISTS idx_plg_calendar_webhook_deliveries_pending
+  ON public.plg_calendar_webhook_deliveries (status, created_at)
+  WHERE status IN ('pending','failed');
+
+ALTER TABLE public.plg_calendar_webhook_deliveries ENABLE ROW LEVEL SECURITY;
+
+-- Read-only for the app. Every write comes from the webhook function running as
+-- service_role, which bypasses RLS \u2014 there is no authenticated INSERT/UPDATE
+-- grant, so a browser cannot forge or retire a delivery.
+GRANT SELECT ON public.plg_calendar_webhook_deliveries TO authenticated;
+GRANT ALL ON public.plg_calendar_webhook_deliveries TO service_role;
+
+DROP POLICY IF EXISTS plg_calendar_webhook_deliveries_read ON public.plg_calendar_webhook_deliveries;
+CREATE POLICY plg_calendar_webhook_deliveries_read ON public.plg_calendar_webhook_deliveries
+  FOR SELECT TO authenticated
+  USING (tenant_id IN (SELECT public.user_tenant_ids()));
+
+-- ===========================================================================
+-- \xA73 \u2014 plg_calendar_automation_outbox: calendar facts, for the automations lane.
+--
+-- Transactional outbox: the sync/webhook functions record WHAT happened and
+-- return; a consumer drains it. idempotency_key is unique per tenant so a
+-- replayed Google delivery or a re-run pull upserts onto the same row instead
+-- of firing an automation twice \u2014 that key is what the functions pass as
+-- onConflict, so it is load-bearing and not merely a hygiene constraint.
+-- ===========================================================================
+CREATE TABLE IF NOT EXISTS public.plg_calendar_automation_outbox (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL,
+  source text NOT NULL DEFAULT 'google_calendar',
+  event_type text NOT NULL,
+  aggregate_type text NOT NULL,
+  aggregate_id text,
+  idempotency_key text NOT NULL,
+  payload jsonb NOT NULL DEFAULT '{}'::jsonb,
+  status text NOT NULL DEFAULT 'pending'
+    CHECK (status IN ('pending','processing','processed','failed','ignored')),
+  attempts integer NOT NULL DEFAULT 0,
+  last_error text,
+  occurred_at timestamptz NOT NULL DEFAULT now(),
+  -- available_at is the retry clock: a failed row is re-eligible once it passes.
+  available_at timestamptz NOT NULL DEFAULT now(),
+  processed_at timestamptz,
+  error text,
+  created_at timestamptz DEFAULT now(),
+  UNIQUE (tenant_id, idempotency_key)
+);
+
+-- Redundant with the UNIQUE constraint's own index, and present in the pool for
+-- the same overlapping-scripts reason as \xA72. Reproduced, not tidied.
+CREATE UNIQUE INDEX IF NOT EXISTS uq_plg_calendar_automation_outbox_idempotency
+  ON public.plg_calendar_automation_outbox (tenant_id, idempotency_key);
+
+CREATE INDEX IF NOT EXISTS idx_plg_calendar_automation_pending
+  ON public.plg_calendar_automation_outbox (status, available_at)
+  WHERE status IN ('pending','failed');
+CREATE INDEX IF NOT EXISTS idx_plg_calendar_automation_outbox_pending
+  ON public.plg_calendar_automation_outbox (status, available_at, created_at)
+  WHERE status IN ('pending','failed');
+
+ALTER TABLE public.plg_calendar_automation_outbox ENABLE ROW LEVEL SECURITY;
+
+GRANT SELECT ON public.plg_calendar_automation_outbox TO authenticated;
+GRANT ALL ON public.plg_calendar_automation_outbox TO service_role;
+
+DROP POLICY IF EXISTS plg_calendar_automation_outbox_read ON public.plg_calendar_automation_outbox;
+CREATE POLICY plg_calendar_automation_outbox_read ON public.plg_calendar_automation_outbox
+  FOR SELECT TO authenticated
+  USING (tenant_id IN (SELECT public.user_tenant_ids()));
+`;
+var MIGRATION_007_CREDENTIAL_FREE_INSTALL = `-- ---------------------------------------------------------------------------
+-- Google Calendar \u2014 a credential-free install, from zero
+-- ---------------------------------------------------------------------------
+-- FAY-1359/1360. On 2026-08-12 the five plg_calendar_* tables were DROPPED from
+-- the beauty pool (gphxclpkbtbucoqclbco) together with both edge functions,
+-- because plg_calendar_integrations held the tenant's Google refresh token in an
+-- open column. A pool is one database for N clinics, so that column was one
+-- backup, one dump or one service_role key away from being every clinic's
+-- calendar.
+--
+-- This file is what a pool runs to have the connector back. It is deliberately
+-- SELF-CONTAINED rather than "001 through 006 again":
+--
+--   * 001 CREATEs the credential columns and 004 drops them. A pool restored by
+--     replaying the chain therefore holds a refresh-token column for the length
+--     of that replay, and holds it forever if the replay stops early \u2014 which is
+--     exactly what a half-applied ledger does. There is no ordering of those
+--     files in which the column never exists; there is this file, in which it
+--     never exists.
+--   * The beauty pool's ledger and its schema had already parted company (it
+--     recorded shop/0006b while tables up to 0043 were applied by hand). A
+--     recovery that depends on the ledger being right is not a recovery.
+--
+-- Re-runnable, and a near no-op on a pool that ran 001\u2013006: every statement is
+-- IF NOT EXISTS / DROP-then-CREATE, and \xA75 drops the credential columns if it
+-- finds them rather than assuming 004 ran.
+--
+--   \xA71  plg_calendar_integrations      \u2014 per-tenant sync state. NO credential.
+--   \xA72  plg_calendar_channels          \u2014 the de-para, incl. the webhook columns
+--   \xA73  plg_calendar_sync_log          \u2014 run history
+--   \xA74  plg_calendar_webhook_deliveries + plg_calendar_automation_outbox
+--   \xA75  the gate: this schema must not be able to hold a Google grant
+--
+-- WHAT OWNS WHAT, after this file (FAY-1388):
+--   the PLATFORM owns the credential \u2014 which Google account, authorized by
+--     whom, and the refresh token, in the vault, reachable only by redemption;
+--   plg_connections owns "is this connector on for this tenant", written by the
+--     app when consent comes back;
+--   these tables own the SYNC STATE \u2014 which calendars map to what, how far the
+--     cursor got, what Google last told us. Nothing here is a secret, and
+--     nothing here can be traded for access to anyone's calendar.
+-- ---------------------------------------------------------------------------
+
+-- ===========================================================================
+-- \xA71 \u2014 plg_calendar_integrations: one row per tenant, sync state only.
+--
+-- Same shape as 001 MINUS oauth_refresh_token, oauth_access_token and
+-- token_expires_at. There is no column here to put a token in, which is the
+-- property this migration exists to establish \u2014 see \xA75, which enforces it.
+--
+-- No FK to plg_connections on purpose. That table is the connector framework's
+-- and this one is the calendar's; a FK would make the connector's row a
+-- prerequisite for reading a cursor, and the two planes are meant to be able to
+-- fail independently.
+-- ===========================================================================
+CREATE TABLE IF NOT EXISTS public.plg_calendar_integrations (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  provider text NOT NULL DEFAULT 'google',
+  calendar_id text NOT NULL DEFAULT 'primary',
+  -- Incremental pull cursor + legacy single-calendar watch bookkeeping.
+  sync_token text,
+  channel_id text,
+  channel_resource_id text,
+  channel_expires_at timestamptz,
+  active boolean NOT NULL DEFAULT true,
+  last_sync_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE (tenant_id, provider)
+);
+ALTER TABLE public.plg_calendar_integrations ENABLE ROW LEVEL SECURITY;
+CREATE INDEX IF NOT EXISTS idx_plg_calendar_integrations_tenant
+  ON public.plg_calendar_integrations(tenant_id);
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.plg_calendar_integrations TO authenticated;
+GRANT ALL ON public.plg_calendar_integrations TO service_role;
+
+-- ===========================================================================
+-- \xA72 \u2014 plg_calendar_channels: the de-para, with 006's webhook columns folded in.
+-- ===========================================================================
+CREATE TABLE IF NOT EXISTS public.plg_calendar_channels (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  integration_id uuid NOT NULL REFERENCES public.plg_calendar_integrations(id) ON DELETE CASCADE,
+  tenant_id uuid NOT NULL,
+  google_calendar_id text NOT NULL,
+  summary text,
+  color text,
+  direction text NOT NULL DEFAULT 'bidirectional'
+    CHECK (direction IN ('inbound','outbound','bidirectional','off')),
+  target_kind text CHECK (target_kind IN ('assignee','service','location')),
+  target_id uuid,
+  import_mode text NOT NULL DEFAULT 'block'
+    CHECK (import_mode IN ('block','appointment')),
+  sync_token text,
+  channel_id text,
+  resource_id text,
+  channel_expires_at timestamptz,
+  is_active boolean NOT NULL DEFAULT true,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE (integration_id, google_calendar_id)
+);
+
+-- The webhook's authentication state. \`webhook_token_hash\` is a SHA-256 of the
+-- token handed to Google \u2014 the token itself is never stored, so reading this
+-- table does not let anyone forge a notification. Added by ALTER as well as in
+-- the CREATE above, for the pool that already has the table from 002.
+ALTER TABLE public.plg_calendar_channels
+  ADD COLUMN IF NOT EXISTS webhook_token_hash text;
+ALTER TABLE public.plg_calendar_channels
+  ADD COLUMN IF NOT EXISTS last_webhook_message_number bigint;
+ALTER TABLE public.plg_calendar_channels
+  ADD COLUMN IF NOT EXISTS last_webhook_at timestamptz;
+
+CREATE INDEX IF NOT EXISTS idx_plg_calendar_channels_tenant
+  ON public.plg_calendar_channels(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_plg_calendar_channels_integration
+  ON public.plg_calendar_channels(integration_id);
+
+ALTER TABLE public.plg_calendar_channels ENABLE ROW LEVEL SECURITY;
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.plg_calendar_channels TO authenticated;
+GRANT ALL ON public.plg_calendar_channels TO service_role;
+
+DROP TRIGGER IF EXISTS plg_calendar_channels_updated_at ON public.plg_calendar_channels;
+CREATE TRIGGER plg_calendar_channels_updated_at BEFORE UPDATE ON public.plg_calendar_channels
+  FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
+
+-- ===========================================================================
+-- \xA73 \u2014 plg_calendar_sync_log: what already happened, per run.
+-- ===========================================================================
+CREATE TABLE IF NOT EXISTS public.plg_calendar_sync_log (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  direction text NOT NULL,                 -- inbound | outbound
+  trigger text,                            -- on-write | scheduled | webhook | manual
+  status text NOT NULL DEFAULT 'success',  -- success | partial | error
+  fetched integer NOT NULL DEFAULT 0,
+  written integer NOT NULL DEFAULT 0,
+  error text,
+  correlation_id uuid,
+  channel_id_ref uuid,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+ALTER TABLE public.plg_calendar_sync_log ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.plg_calendar_sync_log ADD COLUMN IF NOT EXISTS correlation_id uuid;
+ALTER TABLE public.plg_calendar_sync_log ADD COLUMN IF NOT EXISTS channel_id_ref uuid;
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.plg_calendar_sync_log TO authenticated;
+GRANT ALL ON public.plg_calendar_sync_log TO service_role;
+
+-- RLS: tenant isolation for the three tables the app reads and writes.
+DO $$
+DECLARE t text;
+BEGIN
+  FOR t IN SELECT unnest(ARRAY[
+    'plg_calendar_integrations',
+    'plg_calendar_channels',
+    'plg_calendar_sync_log'
+  ])
+  LOOP
+    IF NOT EXISTS (
+      SELECT 1 FROM pg_policies WHERE schemaname='public' AND tablename=t AND policyname=t||'_rls'
+    ) THEN
+      EXECUTE format(
+        'CREATE POLICY %I ON public.%I FOR ALL TO authenticated '
+        'USING (tenant_id IN (SELECT public.user_tenant_ids())) '
+        'WITH CHECK (tenant_id IN (SELECT public.user_tenant_ids()))',
+        t||'_rls', t);
+    END IF;
+    IF NOT EXISTS (
+      SELECT 1 FROM pg_policies WHERE schemaname='public' AND tablename=t AND policyname=t||'_service'
+    ) THEN
+      EXECUTE format(
+        'CREATE POLICY %I ON public.%I FOR ALL TO service_role USING (true) WITH CHECK (true)',
+        t||'_service', t);
+    END IF;
+  END LOOP;
+END $$;
+
+-- ===========================================================================
+-- \xA74 \u2014 Webhook intake: the delivery ledger and the automation outbox.
+--
+-- The delivery row IS the idempotency mechanism: the webhook inserts before
+-- doing any work and reads a 23505 as "already handled". Google retries hard,
+-- so this is what stops one notification becoming two appointments.
+-- ===========================================================================
+CREATE TABLE IF NOT EXISTS public.plg_calendar_webhook_deliveries (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL,
+  channel_ref uuid NOT NULL REFERENCES public.plg_calendar_channels(id) ON DELETE CASCADE,
+  google_channel_id text NOT NULL,
+  resource_id text,
+  message_number bigint NOT NULL,
+  resource_state text,
+  status text NOT NULL DEFAULT 'pending'
+    CHECK (status IN ('pending','processing','processed','failed','ignored')),
+  error text,
+  received_at timestamptz NOT NULL DEFAULT now(),
+  processed_at timestamptz,
+  created_at timestamptz DEFAULT now(),
+  UNIQUE (channel_ref, message_number)
+);
+
+-- Catches a replay that arrives after the channel row was recreated with the
+-- same Google channel id \u2014 the FK-scoped constraint above cannot see that.
+CREATE UNIQUE INDEX IF NOT EXISTS uq_plg_calendar_webhook_delivery_message
+  ON public.plg_calendar_webhook_deliveries (google_channel_id, message_number);
+CREATE INDEX IF NOT EXISTS idx_plg_calendar_webhook_deliveries_tenant_created
+  ON public.plg_calendar_webhook_deliveries (tenant_id, created_at DESC);
+CREATE INDEX IF NOT EXISTS idx_plg_calendar_webhook_deliveries_pending
+  ON public.plg_calendar_webhook_deliveries (status, created_at)
+  WHERE status IN ('pending','failed');
+
+ALTER TABLE public.plg_calendar_webhook_deliveries ENABLE ROW LEVEL SECURITY;
+-- Read-only for the app: every write comes from the webhook function as
+-- service_role, so a browser cannot forge or retire a delivery.
+GRANT SELECT ON public.plg_calendar_webhook_deliveries TO authenticated;
+GRANT ALL ON public.plg_calendar_webhook_deliveries TO service_role;
+
+DROP POLICY IF EXISTS plg_calendar_webhook_deliveries_read ON public.plg_calendar_webhook_deliveries;
+CREATE POLICY plg_calendar_webhook_deliveries_read ON public.plg_calendar_webhook_deliveries
+  FOR SELECT TO authenticated
+  USING (tenant_id IN (SELECT public.user_tenant_ids()));
+
+CREATE TABLE IF NOT EXISTS public.plg_calendar_automation_outbox (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL,
+  source text NOT NULL DEFAULT 'google_calendar',
+  event_type text NOT NULL,
+  aggregate_type text NOT NULL,
+  aggregate_id text,
+  idempotency_key text NOT NULL,
+  payload jsonb NOT NULL DEFAULT '{}'::jsonb,
+  status text NOT NULL DEFAULT 'pending'
+    CHECK (status IN ('pending','processing','processed','failed','ignored')),
+  attempts integer NOT NULL DEFAULT 0,
+  last_error text,
+  occurred_at timestamptz NOT NULL DEFAULT now(),
+  -- available_at is the retry clock: a failed row is re-eligible once it passes.
+  available_at timestamptz NOT NULL DEFAULT now(),
+  processed_at timestamptz,
+  error text,
+  created_at timestamptz DEFAULT now(),
+  UNIQUE (tenant_id, idempotency_key)
+);
+
+CREATE INDEX IF NOT EXISTS idx_plg_calendar_automation_outbox_pending
+  ON public.plg_calendar_automation_outbox (status, available_at, created_at)
+  WHERE status IN ('pending','failed');
+
+ALTER TABLE public.plg_calendar_automation_outbox ENABLE ROW LEVEL SECURITY;
+GRANT SELECT ON public.plg_calendar_automation_outbox TO authenticated;
+GRANT ALL ON public.plg_calendar_automation_outbox TO service_role;
+
+DROP POLICY IF EXISTS plg_calendar_automation_outbox_read ON public.plg_calendar_automation_outbox;
+CREATE POLICY plg_calendar_automation_outbox_read ON public.plg_calendar_automation_outbox
+  FOR SELECT TO authenticated
+  USING (tenant_id IN (SELECT public.user_tenant_ids()));
+
+-- ===========================================================================
+-- \xA75 \u2014 The gate.
+--
+-- Everything above is a CREATE, and a CREATE says nothing about a pool that
+-- already has the old shape. This block is the part that actually removes the
+-- hole: it drops the three credential columns wherever it finds them \u2014 the
+-- pool 004 never reached, the pool restored from an old backup, the pool
+-- someone re-provisioned from 001 \u2014 and then refuses to finish if any survived.
+--
+-- The RAISE matters more than the DROP. A migration that silently tolerated a
+-- token column is how this schema kept one for months.
+-- ===========================================================================
+DO $$
+DECLARE
+  leftover text;
+BEGIN
+  ALTER TABLE IF EXISTS public.plg_calendar_integrations DROP COLUMN IF EXISTS oauth_refresh_token;
+  ALTER TABLE IF EXISTS public.plg_calendar_integrations DROP COLUMN IF EXISTS oauth_access_token;
+  ALTER TABLE IF EXISTS public.plg_calendar_integrations DROP COLUMN IF EXISTS token_expires_at;
+
+  SELECT string_agg(table_name || '.' || column_name, ', ')
+    INTO leftover
+    FROM information_schema.columns
+   WHERE table_schema = 'public'
+     AND table_name LIKE 'plg_calendar%'
+     AND (
+       column_name LIKE '%refresh_token%'
+       OR column_name LIKE '%access_token%'
+       OR column_name IN ('oauth_token', 'client_secret', 'api_key')
+     );
+
+  IF leftover IS NOT NULL THEN
+    RAISE EXCEPTION
+      'Google Calendar schema still holds credential columns: %. The grant belongs in the platform vault (FAY-1359); redeem it at run time instead.',
+      leftover;
+  END IF;
+END $$;
+
+-- Dropping the columns does not erase what was in them: Postgres leaves the old
+-- values in the heap until the next table rewrite. Any grant that ever reached a
+-- pool must be REVOKED AT GOOGLE, not assumed gone \u2014 which is also why every
+-- tenant re-consents after this file runs.
+`;
+var MIGRATION_008_THE_OUTBOUND_HALF = `-- ---------------------------------------------------------------------------
+-- Google Calendar \u2014 the outbound half that 007 does not install
+-- ---------------------------------------------------------------------------
+-- 007 is the credential-free install: it creates the five plg_calendar_* tables
+-- from zero, with no column a Google grant could ever sit in. What it does NOT
+-- create is the trigger on public.appointments that pushes a booking OUT to
+-- Google, because that trigger never lived in those tables.
+--
+-- Only 001 and 002 create \`trg_gcal_push\`, and 001 is the file whose credential
+-- columns 007 exists to prevent. So there is no ordering of the existing files
+-- that gives a fresh pool the outbound direction without also giving it, for a
+-- while, a plaintext refresh-token column.
+--
+-- The result on a pool installed by 007 alone: Google \u2192 Fayz works, Fayz \u2192
+-- Google is silent. Not an error, not a warning \u2014 appointments simply never
+-- reach the calendar. Discovered on cluster-squash-test after 007 came up green
+-- and the tables were correct.
+--
+-- This file is the missing half, and nothing else:
+--
+--   \xA71  public.fn_gcal_push_booking  \u2014 verbatim the definition 005 settled on:
+--       vault first (\`gcal_sync_url\` + \`gcal_outbound_secret\`), the legacy GUC
+--       only as a fallback that WARNs, and a no-op when neither is configured.
+--       Reproduced rather than referenced because 005 cannot run here: it
+--       replaces a function 001 created, and 001 is the file we are avoiding.
+--   \xA72  trg_gcal_push on public.appointments \u2014 the shape 002 re-asserts.
+--
+-- A pool that already ran 001\u2192006 gets an identical function and an identical
+-- trigger, which is why this is safe to apply anywhere: every statement is
+-- CREATE OR REPLACE / DROP-then-CREATE.
+--
+-- WITHOUT THE VAULT SECRETS THIS IS INERT ON PURPOSE. The function reads
+-- \`gcal_sync_url\` and \`gcal_outbound_secret\` from the vault and returns without
+-- pushing when they are absent, so installing the trigger before the secrets
+-- exist cannot break an INSERT into appointments \u2014 the most load-bearing table
+-- the agenda has.
+--
+-- Idempotent and replay-safe.
+-- ---------------------------------------------------------------------------
+
+-- ===========================================================================
+-- \xA71 \u2014 the push, as 005 defined it
+-- ===========================================================================
+CREATE OR REPLACE FUNCTION public.fn_gcal_push_booking() RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public, extensions, net, vault
+AS $$
+DECLARE
+  url      text;
+  key      text;
+  legacy   boolean := false;
+  rec      record := COALESCE(NEW, OLD);
+  op       text := lower(TG_OP);
+  corr     text := NULLIF(current_setting('app.booking_correlation_id', true), '');
+BEGIN
+  -- Unchanged from 004: inbound Google writes mark themselves, and a write
+  -- carrying that marker is never echoed back.
+  IF current_setting('app.booking_origin', true) = 'google' THEN
+    RETURN COALESCE(NEW, OLD);
+  END IF;
+
+  -- Vault first. Wrapped because a pool without the vault extension must
+  -- degrade to the fallback, not abort the booking write.
+  BEGIN
+    SELECT decrypted_secret INTO url
+      FROM vault.decrypted_secrets WHERE name = 'gcal_sync_url'
+      ORDER BY created_at DESC LIMIT 1;
+    SELECT decrypted_secret INTO key
+      FROM vault.decrypted_secrets WHERE name = 'gcal_outbound_secret'
+      ORDER BY created_at DESC LIMIT 1;
+  EXCEPTION WHEN OTHERS THEN
+    url := NULL;
+    key := NULL;
+  END;
+
+  -- Legacy pools provisioned per 001's header keep working, and say so.
+  IF NULLIF(url, '') IS NULL OR NULLIF(key, '') IS NULL THEN
+    url := COALESCE(NULLIF(url, ''), current_setting('app.gcal_sync_url', true));
+    key := COALESCE(NULLIF(key, ''), current_setting('app.gcal_service_key', true));
+    legacy := NULLIF(key, '') IS NOT NULL;
+  END IF;
+
+  -- Not configured is not an error: an unconfigured pool degrades to "Google is
+  -- not updated", never to "the appointment could not be saved".
+  IF NULLIF(url, '') IS NULL OR NULLIF(key, '') IS NULL THEN
+    RETURN COALESCE(NEW, OLD);
+  END IF;
+
+  IF legacy THEN
+    RAISE WARNING 'gcal outbound is still using app.gcal_service_key; move it to the vault secret gcal_outbound_secret and rotate the service-role key';
+  END IF;
+
+  -- Does THIS tenant have a calendar at all?
+  --
+  -- Added here, not inherited from 005. The vault secrets are per POOL and the
+  -- integration is per TENANT, so without this every appointment write in the
+  -- pool posted to the sync function \u2014 including for tenants that never
+  -- connected Google. On the cluster this was installed against that is 354.989
+  -- appointments across several tenants, all of them paying for an HTTP round
+  -- trip whose only possible answer is "no integration".
+  --
+  -- The function would have answered correctly; the cost is the asking. Indexed
+  -- by tenant (idx_plg_calendar_integrations_tenant), so the guard is a lookup,
+  -- not a scan.
+  --
+  -- A tenant who DISCONNECTS stops pushing from that moment, which means a
+  -- booking deleted afterwards leaves its Google event behind. That is the right
+  -- trade: the alternative is pushing on behalf of someone who revoked us.
+  IF NOT EXISTS (
+    SELECT 1 FROM public.plg_calendar_integrations i
+     WHERE i.tenant_id = rec.tenant_id AND i.active
+  ) THEN
+    RETURN COALESCE(NEW, OLD);
+  END IF;
+
+  BEGIN
+    PERFORM net.http_post(
+      url := url,
+      headers := jsonb_build_object(
+        'Content-Type', 'application/json',
+        -- REQUIRED. The deployed function authorises push_event on this header
+        -- alone; without it every push 400s, silently, forever.
+        'Authorization', 'Bearer ' || key
+      ),
+      body := jsonb_build_object(
+        'action', 'push_event',
+        'op', op,
+        'bookingId', rec.id,
+        'tenantId', rec.tenant_id,
+        -- Carried so a delete can still be honoured after the row is gone.
+        'googleEventId', rec.metadata->>'googleCalendarEventId',
+        'calendarId', rec.metadata->>'gcalCalendarId',
+        'correlationId', COALESCE(corr, gen_random_uuid()::text)
+      )
+    );
+  EXCEPTION WHEN OTHERS THEN
+    -- Missing pg_net, a bad URL, a full queue: the appointment is still saved.
+    -- The deployed trigger lacks this wrapper; 004 added it here after a pool
+    -- with the settings present but the extension missing took an INSERT down.
+    RAISE WARNING 'gcal push skipped for booking %: %', rec.id, SQLERRM;
+  END;
+
+  RETURN COALESCE(NEW, OLD);
+END $$;
+
+-- \xA72 \u2500\u2500 cleanup \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- Redefining the function stops the key being PREFERRED; it does not stop it
+-- being STORED. Settings live in pg_db_role_setting per (database, role), so the
+-- sweep is driven off the catalog rather than off the one ALTER DATABASE form
+-- \`001\` happened to show.
+--
+-- CONDITIONAL ON PURPOSE: the setting is cleared only where Vault already
+-- supplies \`gcal_outbound_secret\`, i.e. only where \xA71 provably never needs the
+-- fallback. Anywhere else it is left in place and reported, because clearing it
+-- there would disarm the push with no error anyone can see. On the live pool
+-- this loop finds nothing \u2014 the setting is not present on any role or database \u2014
+-- and that is the expected result, not a failure.
+DO $$
+DECLARE
+  r          record;
+  has_vault  boolean := false;
+BEGIN
+  BEGIN
+    SELECT EXISTS (
+      SELECT 1 FROM vault.decrypted_secrets
+      WHERE name = 'gcal_outbound_secret' AND NULLIF(decrypted_secret, '') IS NOT NULL
+    ) INTO has_vault;
+  EXCEPTION WHEN OTHERS THEN
+    has_vault := false;
+  END;
+
+  FOR r IN
+    SELECT d.datname, a.rolname
+    FROM pg_db_role_setting s
+    LEFT JOIN pg_database d ON d.oid = s.setdatabase
+    LEFT JOIN pg_roles    a ON a.oid = s.setrole
+    WHERE EXISTS (
+      SELECT 1 FROM unnest(s.setconfig) AS c WHERE c LIKE 'app.gcal_service_key=%'
+    )
+  LOOP
+    IF NOT has_vault THEN
+      RAISE WARNING 'app.gcal_service_key is still set (database %, role %) and is the ONLY outbound credential \u2014 create the vault secret gcal_outbound_secret first, then re-run this migration',
+        r.datname, r.rolname;
+      CONTINUE;
+    END IF;
+    BEGIN
+      IF r.rolname IS NULL THEN
+        EXECUTE format('ALTER DATABASE %I RESET app.gcal_service_key', r.datname);
+      ELSIF r.datname IS NULL THEN
+        EXECUTE format('ALTER ROLE %I RESET app.gcal_service_key', r.rolname);
+      ELSE
+        EXECUTE format('ALTER ROLE %I IN DATABASE %I RESET app.gcal_service_key', r.rolname, r.datname);
+      END IF;
+    EXCEPTION WHEN OTHERS THEN
+      RAISE WARNING 'could not clear app.gcal_service_key (database %, role %): % \u2014 clear it by hand, and rotate the key either way',
+        r.datname, r.rolname, SQLERRM;
+    END;
+  END LOOP;
+END $$;
+
+-- ===========================================================================
+-- \xA72 \u2014 the trigger 007 left out
+--
+-- AFTER INSERT OR UPDATE OR DELETE: a booking that is moved or cancelled has to
+-- reach Google too, and a trigger that only fired on INSERT would leave the
+-- calendar showing an appointment the CRM no longer has.
+-- ===========================================================================
+DROP TRIGGER IF EXISTS trg_gcal_push ON public.appointments;
+CREATE TRIGGER trg_gcal_push
+  AFTER INSERT OR UPDATE OR DELETE ON public.appointments
+  FOR EACH ROW EXECUTE FUNCTION public.fn_gcal_push_booking();
+
+COMMENT ON FUNCTION public.fn_gcal_push_booking() IS
+  'Pushes a booking to Google Calendar over pg_net, authorised by the vault secret gcal_outbound_secret. Inert while the vault secrets are absent (008).';
+`;
+var MIGRATION_009_THE_SERVICE_RUNS_THE_SYNC = `-- ============================================================================
+-- google-calendar 009_the_service_runs_the_sync \u2014 the Google Calendar data
+-- plane moves to the integration service (ADR 0003 phase 2, wave 3).
+--
+-- User actions run AS the verified caller and machine actions (a booking push,
+-- a webhook pull, watch renewal) AS the store's owner, both under RLS: the
+-- integrations, channels and sync log already admit a member. What only a
+-- machine writes gets the service role, table by table, with an explicit
+-- policy: the webhook delivery log and the automation outbox. And the four
+-- server-only RPCs the sync calls (002/003: service_role only) get EXECUTE for
+-- the service role, where they exist on the cluster.
+--
+-- Guarded: the role is an operator step, and a cluster may not have the RPCs.
+-- Replay-safe.
+-- ============================================================================
+
+DO $$
+DECLARE
+  t text;
+  f text;
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'fayz_integration') THEN
+    RETURN;
+  END IF;
+
+  FOREACH t IN ARRAY ARRAY['plg_calendar_webhook_deliveries', 'plg_calendar_automation_outbox'] LOOP
+    IF to_regclass('public.' || t) IS NULL THEN CONTINUE; END IF;
+    EXECUTE format('GRANT SELECT, INSERT, UPDATE ON public.%I TO fayz_integration', t);
+    EXECUTE format('DROP POLICY IF EXISTS %I ON public.%I', t || '_service', t);
+    EXECUTE format('CREATE POLICY %I ON public.%I FOR ALL TO fayz_integration USING (true) WITH CHECK (true)', t || '_service', t);
+  END LOOP;
+
+  -- The webhook resolves a channel by its Google channel id before it knows the
+  -- tenant: a read of the channels table, and nothing else on it.
+  IF to_regclass('public.plg_calendar_channels') IS NOT NULL THEN
+    GRANT SELECT ON public.plg_calendar_channels TO fayz_integration;
+    DROP POLICY IF EXISTS plg_calendar_channels_service_read ON public.plg_calendar_channels;
+    CREATE POLICY plg_calendar_channels_service_read ON public.plg_calendar_channels FOR SELECT TO fayz_integration USING (true);
+  END IF;
+
+  FOREACH f IN ARRAY ARRAY[
+    'public.gcal_import_event(uuid, uuid, text, text, text, timestamptz, timestamptz, boolean, text)',
+    'public.gcal_apply_event_patch(uuid, text, text, timestamptz, timestamptz, text, boolean)',
+    'public.gcal_stamp_outbound(uuid, uuid, text, text, text)',
+    'public.gcal_unlink_channel(uuid)'
+  ] LOOP
+    IF to_regprocedure(f) IS NOT NULL THEN
+      EXECUTE format('GRANT EXECUTE ON FUNCTION %s TO fayz_integration', f);
+    END IF;
+  END LOOP;
+END $$;
+`;
+var MIGRATIONS = [
+  { id: "001_google_calendar", sql: MIGRATION_001_GOOGLE_CALENDAR },
+  { id: "002_smart_sync", sql: MIGRATION_002_SMART_SYNC },
+  { id: "003_plg_rename", sql: MIGRATION_003_PLG_RENAME },
+  { id: "004_drop_oauth_tokens", sql: MIGRATION_004_DROP_OAUTH_TOKENS },
+  { id: "005_outbound_vault_delivery", sql: MIGRATION_005_OUTBOUND_VAULT_DELIVERY },
+  { id: "006_webhook_deliveries_outbox", sql: MIGRATION_006_WEBHOOK_DELIVERIES_OUTBOX },
+  { id: "007_credential_free_install", sql: MIGRATION_007_CREDENTIAL_FREE_INSTALL },
+  { id: "008_the_outbound_half", sql: MIGRATION_008_THE_OUTBOUND_HALF },
+  { id: "009_the_service_runs_the_sync", sql: MIGRATION_009_THE_SERVICE_RUNS_THE_SYNC }
+];
+
+export { MIGRATIONS, MIGRATION_001_GOOGLE_CALENDAR, MIGRATION_002_SMART_SYNC, MIGRATION_003_PLG_RENAME, MIGRATION_004_DROP_OAUTH_TOKENS, MIGRATION_005_OUTBOUND_VAULT_DELIVERY, MIGRATION_006_WEBHOOK_DELIVERIES_OUTBOX, MIGRATION_007_CREDENTIAL_FREE_INSTALL, MIGRATION_008_THE_OUTBOUND_HALF, MIGRATION_009_THE_SERVICE_RUNS_THE_SYNC };
+//# sourceMappingURL=integrations-google-calendar.js.map
+//# sourceMappingURL=integrations-google-calendar.js.map