@fayz-ai/plugin-agenda 0.3.0 → 0.8.1

package/src/migrations/001_public_booking.sql

@@ -2,36 +2,49 @@
 -- plugin-agenda 001: booking read model + public (anon) booking surface
 --
 -- Ships the objects the agenda providers reference but the spine (packages/db
--- migrations 001–008) does not define:
+-- migrations 001–010) does not define:
+--   §0  converted-pool cleanup — drop the pre-rename v_bookings view / indexes
 --   §1  order_items columns the admin provider writes (duration/assignee)
---   §2  public.v_bookings        — admin read model (authenticated, RLS applies)
+--   §2  public.v_appointments    — admin read model (authenticated, RLS applies)
 --   §3  public.v_public_services — anon-readable service catalog
 --   §4  public.get_available_slots      — anon RPC (mirrors the mock algorithm)
 --   §5  public.create_public_booking    — anon RPC (validated, race-safe write)
 --
+-- Core v1 lives directly in PUBLIC (no separate core schema): people (was
+-- persons), appointments (was bookings). This migration is written against public
+-- names and is idempotent + safe on both fresh and converted pools.
+--
 -- Anon-access design: public booking pages run with the publishable key and no
 -- session, so the canonical tenant RLS yields nothing. Anon access is granted
 -- ONLY via the column-whitelisted view (§3) and SECURITY DEFINER RPCs (§4, §5)
 -- with tight input validation and hardcoded statuses.
 -- ============================================================================
 
+-- §0 — converted-pool cleanup. The pre-industry-pool shape shipped a v_bookings
+-- view and persons_/bookings_-named indexes; drop them so this file re-emits the
+-- canonical v_appointments view + people_/appointments_ indexes without leaving
+-- duplicates. All guarded with IF EXISTS → no-ops on a fresh pool.
+DROP VIEW IF EXISTS public.v_bookings;
+DROP INDEX IF EXISTS public.persons_tenant_customer_phone;
+DROP INDEX IF EXISTS public.bookings_assignee_time;
+
 -- §1 — columns the agenda provider writes but 004_archetypes lacks
-ALTER TABLE saas_core.order_items
+ALTER TABLE public.order_items
   ADD COLUMN IF NOT EXISTS duration_minutes integer,
-  ADD COLUMN IF NOT EXISTS assignee_id uuid REFERENCES saas_core.persons(id) ON DELETE SET NULL;
+  ADD COLUMN IF NOT EXISTS assignee_id uuid REFERENCES public.people(id) ON DELETE SET NULL;
 
 -- Upsert key for public customers (per tenant, by normalized phone)
-CREATE UNIQUE INDEX IF NOT EXISTS persons_tenant_customer_phone
-  ON saas_core.persons(tenant_id, phone)
+CREATE UNIQUE INDEX IF NOT EXISTS people_tenant_customer_phone
+  ON public.people(tenant_id, phone)
   WHERE kind = 'customer' AND phone IS NOT NULL;
 
 -- Slot-conflict scan
-CREATE INDEX IF NOT EXISTS bookings_assignee_time
-  ON saas_core.bookings(assignee_id, starts_at, ends_at)
+CREATE INDEX IF NOT EXISTS appointments_assignee_time
+  ON public.appointments(assignee_id, starts_at, ends_at)
   WHERE status NOT IN ('cancelled', 'no_show');
 
 -- §2 — admin read model (security_invoker → underlying RLS applies; anon sees 0 rows)
-CREATE OR REPLACE VIEW public.v_bookings
+CREATE OR REPLACE VIEW public.v_appointments
 WITH (security_invoker = true) AS
 SELECT
   b.id, b.tenant_id, b.kind, b.starts_at, b.ends_at, b.status, b.notes,
@@ -49,14 +62,14 @@ SELECT
   o.status                                AS order_status,
   (EXTRACT(EPOCH FROM (COALESCE(b.ends_at, b.starts_at) - b.starts_at))::int / 60)
                                           AS total_duration_minutes
-FROM saas_core.bookings b
-LEFT JOIN saas_core.persons   pc ON pc.id = b.party_id
-LEFT JOIN saas_core.persons   ps ON ps.id = b.assignee_id
-LEFT JOIN saas_core.locations l  ON l.id  = b.location_id
-LEFT JOIN saas_core.orders    o  ON o.id  = b.order_id;
+FROM public.appointments b
+LEFT JOIN public.people    pc ON pc.id = b.party_id
+LEFT JOIN public.people    ps ON ps.id = b.assignee_id
+LEFT JOIN public.locations l  ON l.id  = b.location_id
+LEFT JOIN public.orders    o  ON o.id  = b.order_id;
 
-GRANT SELECT ON public.v_bookings TO authenticated, service_role;
-REVOKE SELECT ON public.v_bookings FROM anon;
+GRANT SELECT ON public.v_appointments TO authenticated, service_role;
+REVOKE SELECT ON public.v_appointments FROM anon;
 
 -- §3 — anon-readable public catalog (owner-rights view = deliberate, whitelisted)
 CREATE OR REPLACE VIEW public.v_public_services AS
@@ -65,7 +78,7 @@ SELECT
   COALESCE(s.duration_minutes, 30)                AS duration_minutes,
   s.image_url,
   COALESCE((s.metadata->>'sort_order')::int, 0)   AS sort_order
-FROM saas_core.services s
+FROM public.services s
 WHERE s.is_active AND s.status = 'active';
 
 GRANT SELECT ON public.v_public_services TO anon, authenticated, service_role;
@@ -79,7 +92,7 @@ CREATE OR REPLACE FUNCTION public.get_available_slots(
   p_slot_interval integer DEFAULT 30
 ) RETURNS TABLE (slot_start timestamptz, slot_end timestamptz)
 LANGUAGE plpgsql STABLE SECURITY DEFINER
-SET search_path = saas_core, public
+SET search_path = public
 AS $$
 DECLARE
   v_tz text;
@@ -127,7 +140,7 @@ BEGIN
   SELECT DISTINCT c.s_start, c.s_end
   FROM candidate c
   WHERE NOT EXISTS (
-    SELECT 1 FROM bookings b
+    SELECT 1 FROM appointments b
     WHERE b.tenant_id = p_tenant_id
       AND b.assignee_id = c.assignee_id
       AND b.status NOT IN ('cancelled', 'no_show')
@@ -153,7 +166,7 @@ CREATE OR REPLACE FUNCTION public.create_public_booking(
   p_notes text DEFAULT NULL
 ) RETURNS TABLE (booking_id uuid, starts_at timestamptz, ends_at timestamptz)
 LANGUAGE plpgsql SECURITY DEFINER
-SET search_path = saas_core, public
+SET search_path = public
 AS $$
 DECLARE
   v_service record;
@@ -215,7 +228,7 @@ BEGIN
   PERFORM pg_advisory_xact_lock(hashtextextended(p_tenant_id::text || v_assignee::text, 0));
 
   IF EXISTS (
-    SELECT 1 FROM bookings b
+    SELECT 1 FROM appointments b
     WHERE b.tenant_id = p_tenant_id
       AND b.assignee_id = v_assignee
       AND b.status NOT IN ('cancelled', 'no_show')
@@ -227,8 +240,8 @@ BEGIN
 
   -- anti-spam: cap open future public bookings per phone per tenant
   IF (
-    SELECT count(*) FROM bookings b
-    JOIN persons p ON p.id = b.party_id
+    SELECT count(*) FROM appointments b
+    JOIN people p ON p.id = b.party_id
     WHERE b.tenant_id = p_tenant_id
       AND p.phone = v_phone
       AND b.starts_at > now()
@@ -237,14 +250,14 @@ BEGIN
     RAISE EXCEPTION 'too many open bookings for this phone';
   END IF;
 
-  -- upsert the customer by (tenant, phone) — matches persons_tenant_customer_phone
-  INSERT INTO persons (tenant_id, kind, name, phone, email, metadata)
+  -- upsert the customer by (tenant, phone) — matches people_tenant_customer_phone
+  INSERT INTO people (tenant_id, kind, name, phone, email, metadata)
   VALUES (p_tenant_id, 'customer', trim(p_name), v_phone, p_email,
           jsonb_build_object('source', 'public_booking'))
   ON CONFLICT (tenant_id, phone) WHERE kind = 'customer' AND phone IS NOT NULL
   DO UPDATE SET
     name = EXCLUDED.name,
-    email = COALESCE(EXCLUDED.email, persons.email),
+    email = COALESCE(EXCLUDED.email, people.email),
     updated_at = now()
   RETURNING id INTO v_person_id;
 
@@ -257,7 +270,7 @@ BEGIN
                              'contactName', trim(p_name)))
   RETURNING id INTO v_order;
 
-  INSERT INTO bookings (tenant_id, kind, party_id, assignee_id, order_id,
+  INSERT INTO appointments (tenant_id, kind, party_id, assignee_id, order_id,
                         starts_at, ends_at, status, notes, metadata)
   VALUES (p_tenant_id, 'appointment', v_person_id, v_assignee, v_order,
           p_starts_at, v_ends, 'scheduled', v_notes,

package/src/migrations/002_v_bookings_compat.sql

@@ -0,0 +1,14 @@
+-- Where 000b preserved the legacy beauty view, re-create v_bookings as a
+-- thin alias over it so live pre-M5 clients that SELECT v_bookings by name
+-- keep their full legacy column set. Dropped for good once the beauty app
+-- ships on v_appointments (M5 follow-up).
+
+DO $compat$
+BEGIN
+  IF to_regclass('public.v_bookings_legacy_beauty') IS NOT NULL
+     AND to_regclass('public.v_bookings') IS NULL THEN
+    EXECUTE 'CREATE VIEW public.v_bookings WITH (security_invoker = true) AS SELECT * FROM public.v_bookings_legacy_beauty';
+    EXECUTE 'GRANT SELECT ON public.v_bookings TO authenticated, service_role';
+    EXECUTE 'REVOKE SELECT ON public.v_bookings FROM anon';
+  END IF;
+END $compat$;

package/src/migrations/index.ts

@@ -1,40 +1,122 @@
-// AUTO-GENERATED from 001_public_booking.sql — regenerate with scripts/embed-migrations.mjs
-// (kept in sync so the manifest can declare migrations as data, plugin-tasks pattern)
+// AUTO-GENERATED from 000b_v_bookings_rename.sql, 000c_dedupe_customer_phones.sql, 001_public_booking.sql, 002_v_bookings_compat.sql — regenerate with scripts/embed-migrations.mjs
+// SQL files are the source of truth; this inline copy lets the manifest declare
+// migrations as data. Do not edit by hand — run the embed script instead.
+
+export const MIGRATION_000B_V_BOOKINGS_RENAME = `-- Salon-only unblock: the pre-pools beauty deployment built rep_* report
+-- views on top of its (wider) v_bookings view, so 001's cleanup DROP cannot
+-- run there. Renaming keeps the dependents attached (they track the OID) and
+-- frees the name for 001; 002_v_bookings_compat re-creates v_bookings as a
+-- thin alias for live pre-M5 clients. No-op on fresh pools and on pools whose
+-- v_bookings has no dependents (001's DROP handles those).
+
+DO $rename$
+BEGIN
+  IF to_regclass('public.v_bookings') IS NOT NULL
+     AND to_regclass('public.v_bookings_legacy_beauty') IS NULL
+     AND EXISTS (
+       SELECT 1 FROM pg_depend d
+       JOIN pg_rewrite rw ON rw.oid = d.objid
+       JOIN pg_class dep ON dep.oid = rw.ev_class
+       JOIN pg_class ref ON ref.oid = d.refobjid
+       WHERE ref.relname = 'v_bookings' AND dep.relname <> 'v_bookings'
+     ) THEN
+    EXECUTE 'ALTER VIEW public.v_bookings RENAME TO v_bookings_legacy_beauty';
+  END IF;
+END $rename$;
+`
+
+export const MIGRATION_000C_DEDUPE_CUSTOMER_PHONES = `-- 001 needs the customer-phone upsert key UNIQUE(tenant_id, phone). Converted
+-- pools can carry duplicates (found live on salon: 9 dogfood test records all
+-- sharing the founder's phone). Non-destructive dedupe: per (tenant_id, phone)
+-- customer group keep the row with most appointments (tie: oldest), NULL the
+-- phone on the rest and stash the original in metadata->'dedupedPhone'.
+-- Idempotent: reruns find no groups > 1.
+
+DO $dedupe$
+DECLARE
+  r record;
+BEGIN
+  IF to_regclass('public.people') IS NULL THEN
+    RETURN;
+  END IF;
+
+  FOR r IN
+    SELECT p.id, p.phone
+    FROM public.people p
+    JOIN LATERAL (
+      SELECT count(*) AS appts
+      FROM public.appointments a WHERE a.party_id = p.id
+    ) ac ON true
+    WHERE p.kind = 'customer' AND p.phone IS NOT NULL
+      AND p.id NOT IN (
+        SELECT DISTINCT ON (p2.tenant_id, p2.phone) p2.id
+        FROM public.people p2
+        WHERE p2.kind = 'customer' AND p2.phone IS NOT NULL
+        ORDER BY p2.tenant_id, p2.phone,
+          (SELECT count(*) FROM public.appointments a2 WHERE a2.party_id = p2.id) DESC,
+          p2.created_at ASC
+      )
+      AND (p.tenant_id, p.phone) IN (
+        SELECT tenant_id, phone FROM public.people
+        WHERE kind = 'customer' AND phone IS NOT NULL
+        GROUP BY tenant_id, phone HAVING count(*) > 1
+      )
+  LOOP
+    UPDATE public.people
+    SET metadata = COALESCE(metadata, '{}'::jsonb) || jsonb_build_object('dedupedPhone', r.phone),
+        phone = NULL
+    WHERE id = r.id;
+  END LOOP;
+END $dedupe$;
+`
 
 export const MIGRATION_001_PUBLIC_BOOKING = `-- ============================================================================
 -- plugin-agenda 001: booking read model + public (anon) booking surface
 --
 -- Ships the objects the agenda providers reference but the spine (packages/db
--- migrations 001–008) does not define:
+-- migrations 001–010) does not define:
+--   §0  converted-pool cleanup — drop the pre-rename v_bookings view / indexes
 --   §1  order_items columns the admin provider writes (duration/assignee)
---   §2  public.v_bookings        — admin read model (authenticated, RLS applies)
+--   §2  public.v_appointments    — admin read model (authenticated, RLS applies)
 --   §3  public.v_public_services — anon-readable service catalog
 --   §4  public.get_available_slots      — anon RPC (mirrors the mock algorithm)
 --   §5  public.create_public_booking    — anon RPC (validated, race-safe write)
 --
+-- Core v1 lives directly in PUBLIC (no separate core schema): people (was
+-- persons), appointments (was bookings). This migration is written against public
+-- names and is idempotent + safe on both fresh and converted pools.
+--
 -- Anon-access design: public booking pages run with the publishable key and no
 -- session, so the canonical tenant RLS yields nothing. Anon access is granted
 -- ONLY via the column-whitelisted view (§3) and SECURITY DEFINER RPCs (§4, §5)
 -- with tight input validation and hardcoded statuses.
 -- ============================================================================
 
+-- §0 — converted-pool cleanup. The pre-industry-pool shape shipped a v_bookings
+-- view and persons_/bookings_-named indexes; drop them so this file re-emits the
+-- canonical v_appointments view + people_/appointments_ indexes without leaving
+-- duplicates. All guarded with IF EXISTS → no-ops on a fresh pool.
+DROP VIEW IF EXISTS public.v_bookings;
+DROP INDEX IF EXISTS public.persons_tenant_customer_phone;
+DROP INDEX IF EXISTS public.bookings_assignee_time;
+
 -- §1 — columns the agenda provider writes but 004_archetypes lacks
-ALTER TABLE saas_core.order_items
+ALTER TABLE public.order_items
   ADD COLUMN IF NOT EXISTS duration_minutes integer,
-  ADD COLUMN IF NOT EXISTS assignee_id uuid REFERENCES saas_core.persons(id) ON DELETE SET NULL;
+  ADD COLUMN IF NOT EXISTS assignee_id uuid REFERENCES public.people(id) ON DELETE SET NULL;
 
 -- Upsert key for public customers (per tenant, by normalized phone)
-CREATE UNIQUE INDEX IF NOT EXISTS persons_tenant_customer_phone
-  ON saas_core.persons(tenant_id, phone)
+CREATE UNIQUE INDEX IF NOT EXISTS people_tenant_customer_phone
+  ON public.people(tenant_id, phone)
   WHERE kind = 'customer' AND phone IS NOT NULL;
 
 -- Slot-conflict scan
-CREATE INDEX IF NOT EXISTS bookings_assignee_time
-  ON saas_core.bookings(assignee_id, starts_at, ends_at)
+CREATE INDEX IF NOT EXISTS appointments_assignee_time
+  ON public.appointments(assignee_id, starts_at, ends_at)
   WHERE status NOT IN ('cancelled', 'no_show');
 
 -- §2 — admin read model (security_invoker → underlying RLS applies; anon sees 0 rows)
-CREATE OR REPLACE VIEW public.v_bookings
+CREATE OR REPLACE VIEW public.v_appointments
 WITH (security_invoker = true) AS
 SELECT
   b.id, b.tenant_id, b.kind, b.starts_at, b.ends_at, b.status, b.notes,
@@ -52,14 +134,14 @@ SELECT
   o.status                                AS order_status,
   (EXTRACT(EPOCH FROM (COALESCE(b.ends_at, b.starts_at) - b.starts_at))::int / 60)
                                           AS total_duration_minutes
-FROM saas_core.bookings b
-LEFT JOIN saas_core.persons   pc ON pc.id = b.party_id
-LEFT JOIN saas_core.persons   ps ON ps.id = b.assignee_id
-LEFT JOIN saas_core.locations l  ON l.id  = b.location_id
-LEFT JOIN saas_core.orders    o  ON o.id  = b.order_id;
+FROM public.appointments b
+LEFT JOIN public.people    pc ON pc.id = b.party_id
+LEFT JOIN public.people    ps ON ps.id = b.assignee_id
+LEFT JOIN public.locations l  ON l.id  = b.location_id
+LEFT JOIN public.orders    o  ON o.id  = b.order_id;
 
-GRANT SELECT ON public.v_bookings TO authenticated, service_role;
-REVOKE SELECT ON public.v_bookings FROM anon;
+GRANT SELECT ON public.v_appointments TO authenticated, service_role;
+REVOKE SELECT ON public.v_appointments FROM anon;
 
 -- §3 — anon-readable public catalog (owner-rights view = deliberate, whitelisted)
 CREATE OR REPLACE VIEW public.v_public_services AS
@@ -68,7 +150,7 @@ SELECT
   COALESCE(s.duration_minutes, 30)                AS duration_minutes,
   s.image_url,
   COALESCE((s.metadata->>'sort_order')::int, 0)   AS sort_order
-FROM saas_core.services s
+FROM public.services s
 WHERE s.is_active AND s.status = 'active';
 
 GRANT SELECT ON public.v_public_services TO anon, authenticated, service_role;
@@ -82,7 +164,7 @@ CREATE OR REPLACE FUNCTION public.get_available_slots(
   p_slot_interval integer DEFAULT 30
 ) RETURNS TABLE (slot_start timestamptz, slot_end timestamptz)
 LANGUAGE plpgsql STABLE SECURITY DEFINER
-SET search_path = saas_core, public
+SET search_path = public
 AS $$
 DECLARE
   v_tz text;
@@ -130,7 +212,7 @@ BEGIN
   SELECT DISTINCT c.s_start, c.s_end
   FROM candidate c
   WHERE NOT EXISTS (
-    SELECT 1 FROM bookings b
+    SELECT 1 FROM appointments b
     WHERE b.tenant_id = p_tenant_id
       AND b.assignee_id = c.assignee_id
       AND b.status NOT IN ('cancelled', 'no_show')
@@ -156,7 +238,7 @@ CREATE OR REPLACE FUNCTION public.create_public_booking(
   p_notes text DEFAULT NULL
 ) RETURNS TABLE (booking_id uuid, starts_at timestamptz, ends_at timestamptz)
 LANGUAGE plpgsql SECURITY DEFINER
-SET search_path = saas_core, public
+SET search_path = public
 AS $$
 DECLARE
   v_service record;
@@ -218,7 +300,7 @@ BEGIN
   PERFORM pg_advisory_xact_lock(hashtextextended(p_tenant_id::text || v_assignee::text, 0));
 
   IF EXISTS (
-    SELECT 1 FROM bookings b
+    SELECT 1 FROM appointments b
     WHERE b.tenant_id = p_tenant_id
       AND b.assignee_id = v_assignee
       AND b.status NOT IN ('cancelled', 'no_show')
@@ -230,8 +312,8 @@ BEGIN
 
   -- anti-spam: cap open future public bookings per phone per tenant
   IF (
-    SELECT count(*) FROM bookings b
-    JOIN persons p ON p.id = b.party_id
+    SELECT count(*) FROM appointments b
+    JOIN people p ON p.id = b.party_id
     WHERE b.tenant_id = p_tenant_id
       AND p.phone = v_phone
       AND b.starts_at > now()
@@ -240,14 +322,14 @@ BEGIN
     RAISE EXCEPTION 'too many open bookings for this phone';
   END IF;
 
-  -- upsert the customer by (tenant, phone) — matches persons_tenant_customer_phone
-  INSERT INTO persons (tenant_id, kind, name, phone, email, metadata)
+  -- upsert the customer by (tenant, phone) — matches people_tenant_customer_phone
+  INSERT INTO people (tenant_id, kind, name, phone, email, metadata)
   VALUES (p_tenant_id, 'customer', trim(p_name), v_phone, p_email,
           jsonb_build_object('source', 'public_booking'))
   ON CONFLICT (tenant_id, phone) WHERE kind = 'customer' AND phone IS NOT NULL
   DO UPDATE SET
     name = EXCLUDED.name,
-    email = COALESCE(EXCLUDED.email, persons.email),
+    email = COALESCE(EXCLUDED.email, people.email),
     updated_at = now()
   RETURNING id INTO v_person_id;
 
@@ -260,7 +342,7 @@ BEGIN
                              'contactName', trim(p_name)))
   RETURNING id INTO v_order;
 
-  INSERT INTO bookings (tenant_id, kind, party_id, assignee_id, order_id,
+  INSERT INTO appointments (tenant_id, kind, party_id, assignee_id, order_id,
                         starts_at, ends_at, status, notes, metadata)
   VALUES (p_tenant_id, 'appointment', v_person_id, v_assignee, v_order,
           p_starts_at, v_ends, 'scheduled', v_notes,
@@ -280,3 +362,26 @@ REVOKE ALL ON FUNCTION public.create_public_booking(uuid, uuid, timestamptz, tex
 GRANT EXECUTE ON FUNCTION public.create_public_booking(uuid, uuid, timestamptz, text, text, text, text)
   TO anon, authenticated, service_role;
 `
+
+export const MIGRATION_002_V_BOOKINGS_COMPAT = `-- Where 000b preserved the legacy beauty view, re-create v_bookings as a
+-- thin alias over it so live pre-M5 clients that SELECT v_bookings by name
+-- keep their full legacy column set. Dropped for good once the beauty app
+-- ships on v_appointments (M5 follow-up).
+
+DO $compat$
+BEGIN
+  IF to_regclass('public.v_bookings_legacy_beauty') IS NOT NULL
+     AND to_regclass('public.v_bookings') IS NULL THEN
+    EXECUTE 'CREATE VIEW public.v_bookings WITH (security_invoker = true) AS SELECT * FROM public.v_bookings_legacy_beauty';
+    EXECUTE 'GRANT SELECT ON public.v_bookings TO authenticated, service_role';
+    EXECUTE 'REVOKE SELECT ON public.v_bookings FROM anon';
+  END IF;
+END $compat$;
+`
+
+export const MIGRATIONS: Array<{ id: string; sql: string }> = [
+  { id: "000b_v_bookings_rename", sql: MIGRATION_000B_V_BOOKINGS_RENAME },
+  { id: "000c_dedupe_customer_phones", sql: MIGRATION_000C_DEDUPE_CUSTOMER_PHONES },
+  { id: "001_public_booking", sql: MIGRATION_001_PUBLIC_BOOKING },
+  { id: "002_v_bookings_compat", sql: MIGRATION_002_V_BOOKINGS_COMPAT },
+]

package/src/public/createPublicBookingPlugin.ts

@@ -1,7 +1,6 @@
 import { createElement, type FC, type ReactNode } from 'react'
 import { CalendarCheck, ShieldCheck, Video } from 'lucide-react'
 import type { PluginManifest, PluginScope, VerticalId, PaymentProvider } from '@fayz-ai/core'
-import { createSafeDataProvider } from '@fayz-ai/core'
 import type { Professional, Schedule } from '../types'
 import type { MockAgendaSeed } from '../data/mock'
 import { createMockPublicBookingProvider, type PublicBookingDataProvider } from './data'
@@ -202,24 +201,28 @@ export function createPublicBookingPlugin(options: PublicBookingOptions): Public
     bookings: [],
   }
 
-  const provider =
-    options.dataProvider ??
-    createSafeDataProvider<PublicBookingDataProvider>(
-      () => {
-        if (!options.tenantId) {
-          throw new Error(
-            '[plugin-agenda/public] `tenantId` is required when a Supabase client is configured (setGlobalSupabaseClient).',
-          )
-        }
-        return createSupabasePublicBookingProvider({ tenantId: options.tenantId })
-      },
-      () =>
-        createMockPublicBookingProvider({
-          seed: mockSeed,
-          services: staticServices ?? [],
-          professionalId: mockProfessionalId,
-        }),
-    )
+  // Resolution: explicit dataProvider → Supabase whenever a tenantId is
+  // declared (the app's global client if registered, else Fayz Cloud — the
+  // shared hosted backend) → seeded mock. The mock fallback is LOUD on
+  // purpose: the old silent fallback hid missing-env bugs as empty catalogs.
+  let provider: PublicBookingDataProvider
+  if (options.dataProvider) {
+    provider = options.dataProvider
+  } else if (options.tenantId) {
+    provider = createSupabasePublicBookingProvider({ tenantId: options.tenantId })
+  } else {
+    if (typeof console !== 'undefined') {
+      console.warn(
+        '[plugin-agenda/public] no `tenantId` and no `dataProvider` — falling back to the seeded MOCK provider. ' +
+          'Pass `tenantId` to book against Fayz Cloud, or inject a dataProvider.',
+      )
+    }
+    provider = createMockPublicBookingProvider({
+      seed: mockSeed,
+      services: staticServices ?? [],
+      professionalId: mockProfessionalId,
+    })
+  }
 
   const base: Omit<PublicBookingContextValue, 'services' | 'servicesLoading'> = {
     provider,
@@ -250,7 +253,7 @@ export function createPublicBookingPlugin(options: PublicBookingOptions): Public
     id: 'booking',
     name: 'Agendamento',
     icon: 'CalendarCheck',
-    version: '0.3.0',
+    version: '0.4.0',
     scope: options.scope ?? 'universal',
     verticalId: options.verticalId,
     scaffolds: ['website', 'landing_page'],

package/src/public/data.supabase.ts

@@ -11,7 +11,7 @@
 // Shipped by plugins/plugin-agenda/src/migrations/001_public_booking.sql.
 // ---------------------------------------------------------------------------
 
-import { getSupabaseClientOptional } from '@fayz-ai/core'
+import { getFayzCloudClient, getSupabaseClientOptional } from '@fayz-ai/core'
 import type { TimeSlot } from '../types'
 import type { PublicService } from './types'
 import type { PublicBookingDataProvider } from './data'
@@ -26,10 +26,10 @@ interface SupabaseLikeClient {
   rpc(fn: string, args: Record<string, unknown>): PromiseLike<{ data: unknown; error: { message: string } | null }>
 }
 
+// App-registered client (BYO backend) wins; otherwise Fayz Cloud — the shared
+// hosted project every tenantId-only app books against by default.
 function getClient(): SupabaseLikeClient {
-  const client = getSupabaseClientOptional() as SupabaseLikeClient | null
-  if (!client) throw new Error('[plugin-agenda/public] Supabase client not initialized')
-  return client
+  return (getSupabaseClientOptional() ?? getFayzCloudClient()) as SupabaseLikeClient
 }
 
 /** Digits-only phone (RPC normalizes again server-side; keep the dial code). */

package/src/registries.ts

@@ -2,7 +2,7 @@ import type { PluginRegistryDef } from '@fayz-ai/core'
 import type { EntityDef } from '@fayz-ai/core'
 
 // ---------------------------------------------------------------------------
-// Holidays (saas_core.holidays — tenant-scoped)
+// Holidays (public.holidays — tenant-scoped)
 // ---------------------------------------------------------------------------
 
 const holidayEntity: EntityDef = {
@@ -21,7 +21,6 @@ const holidayEntity: EntityDef = {
   ],
   data: {
     table: 'holidays',
-    schema: 'saas_core',
     tenantScoped: true,
   },
 }

package/src/types.ts

@@ -1,6 +1,6 @@
 // ---------------------------------------------------------------------------
 // Agenda Plugin — Pure TypeScript types
-// Zero dependencies. Maps to saas_core archetype tables.
+// Zero dependencies. Maps to public archetype tables.
 // ---------------------------------------------------------------------------
 
 // ============================================================
@@ -46,7 +46,7 @@ export interface BookingTypeConfig {
 // CORE ENTITIES
 // ============================================================
 
-/** A booking service line item (from saas_core.booking_items) */
+/** A booking service line item (from public.appointment_items) */
 export interface BookingService {
   id: string
   serviceId: string | null
@@ -56,7 +56,7 @@ export interface BookingService {
   assigneeId: string | null
 }
 
-/** Calendar booking — the main entity rendered on the calendar (from v_bookings view on orders) */
+/** Calendar booking — the main entity rendered on the calendar (from v_appointments view on orders) */
 export interface CalendarBooking {
   id: string
   tenantId: string
@@ -113,7 +113,7 @@ export interface Professional {
   isActive: boolean
 }
 
-/** Working hours schedule (from saas_core.schedules) */
+/** Working hours schedule (from public.schedules) */
 export interface Schedule {
   id: string
   tenantId: string