@fayz-ai/plugin-agenda 0.8.1 → 0.8.4

package/src/integrations/google-calendar/migrations/003_plg_rename.sql

@@ -0,0 +1,273 @@
+-- ---------------------------------------------------------------------------
+-- 003_plg_rename.sql — standardize the Google Calendar connector objects onto
+-- the platform `plg_<plugin>_` prefix (DATA-MODEL.md Ring 1).
+--
+--   calendar_integrations → plg_calendar_integrations
+--   calendar_channels     → plg_calendar_channels
+--   calendar_sync_log     → plg_calendar_sync_log
+--
+-- Legacy-pool remediation ONLY: 001/002 now create the prefixed names directly,
+-- so fresh installs never reach a rename branch. Fully idempotent and guarded —
+-- every RENAME fires only when the old object exists and the new one does not,
+-- so re-running (or running on an already-prefixed pool) is a no-op.
+--
+-- A table RENAME preserves its data, RLS state, policies, grants, indexes,
+-- constraints and triggers (they follow the table), so §1 only renames the
+-- table + the explicitly-named indexes. §2 then re-points the SECURITY DEFINER
+-- gcal_* functions whose bodies hard-code the old table names.
+-- ---------------------------------------------------------------------------
+
+-- ===========================================================================
+-- §1 — Guarded table + index renames.
+-- ===========================================================================
+DO $$
+BEGIN
+  IF to_regclass('public.calendar_integrations') IS NOT NULL
+     AND to_regclass('public.plg_calendar_integrations') IS NULL THEN
+    ALTER TABLE public.calendar_integrations RENAME TO plg_calendar_integrations;
+  END IF;
+
+  IF to_regclass('public.calendar_channels') IS NOT NULL
+     AND to_regclass('public.plg_calendar_channels') IS NULL THEN
+    ALTER TABLE public.calendar_channels RENAME TO plg_calendar_channels;
+  END IF;
+
+  IF to_regclass('public.calendar_sync_log') IS NOT NULL
+     AND to_regclass('public.plg_calendar_sync_log') IS NULL THEN
+    ALTER TABLE public.calendar_sync_log RENAME TO plg_calendar_sync_log;
+  END IF;
+
+  -- Named indexes do not follow a table rename automatically.
+  IF to_regclass('public.idx_calendar_integrations_tenant') IS NOT NULL
+     AND to_regclass('public.idx_plg_calendar_integrations_tenant') IS NULL THEN
+    ALTER INDEX public.idx_calendar_integrations_tenant RENAME TO idx_plg_calendar_integrations_tenant;
+  END IF;
+
+  IF to_regclass('public.idx_calendar_channels_tenant') IS NOT NULL
+     AND to_regclass('public.idx_plg_calendar_channels_tenant') IS NULL THEN
+    ALTER INDEX public.idx_calendar_channels_tenant RENAME TO idx_plg_calendar_channels_tenant;
+  END IF;
+
+  IF to_regclass('public.idx_calendar_channels_integration') IS NOT NULL
+     AND to_regclass('public.idx_plg_calendar_channels_integration') IS NULL THEN
+    ALTER INDEX public.idx_calendar_channels_integration RENAME TO idx_plg_calendar_channels_integration;
+  END IF;
+END $$;
+
+-- ===========================================================================
+-- §2 — Re-point the inbound SECURITY DEFINER writers at the prefixed names.
+-- These bodies are byte-identical to 002_smart_sync.sql except the calendar_*
+-- table references, which now read plg_calendar_*. gcal_apply_event_patch and
+-- gcal_stamp_outbound only touch public.appointments (unaffected by the rename)
+-- and are re-asserted here for completeness so all four writers stay in step.
+-- ===========================================================================
+
+CREATE OR REPLACE FUNCTION public.gcal_import_event(
+  p_tenant_id   uuid,
+  p_channel_id  uuid,
+  p_event_id    text,
+  p_etag        text,
+  p_summary     text,
+  p_starts_at   timestamptz,
+  p_ends_at     timestamptz,
+  p_all_day     boolean,
+  p_description text DEFAULT NULL
+) RETURNS uuid
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_ch          record;
+  v_kind        text;
+  v_assignee    uuid;
+  v_location    uuid;
+  v_ends        timestamptz;
+  v_meta        jsonb;
+  v_existing    uuid;
+  v_appt        uuid;
+BEGIN
+  IF p_tenant_id IS NULL OR p_event_id IS NULL OR p_starts_at IS NULL THEN
+    RAISE EXCEPTION 'gcal_import_event: tenant, event id and start are required';
+  END IF;
+
+  PERFORM set_config('app.booking_origin', 'google', true);
+
+  SELECT c.import_mode, c.target_kind, c.target_id
+    INTO v_ch
+  FROM plg_calendar_channels c
+  WHERE c.id = p_channel_id AND c.tenant_id = p_tenant_id;
+  IF NOT FOUND THEN RAISE EXCEPTION 'gcal_import_event: unknown channel for tenant'; END IF;
+
+  v_kind     := CASE WHEN v_ch.import_mode = 'appointment' THEN 'appointment' ELSE 'block' END;
+  v_assignee := CASE WHEN v_ch.target_kind = 'assignee' THEN v_ch.target_id ELSE NULL END;
+  v_location := CASE WHEN v_ch.target_kind = 'location' THEN v_ch.target_id ELSE NULL END;
+
+  v_ends := COALESCE(
+    p_ends_at,
+    CASE WHEN COALESCE(p_all_day, false) THEN p_starts_at + interval '1 day' ELSE p_starts_at END
+  );
+
+  v_meta := jsonb_build_object(
+    'syncOrigin', 'google',
+    'googleCalendarEventId', p_event_id,
+    'gcalEtag', p_etag,
+    'gcalChannelId', p_channel_id::text,
+    'allDay', COALESCE(p_all_day, false),
+    'title', p_summary,
+    'source', 'google_import'
+  );
+
+  SELECT b.id INTO v_existing
+  FROM appointments b
+  WHERE b.tenant_id = p_tenant_id
+    AND b.metadata->>'googleCalendarEventId' = p_event_id
+  LIMIT 1;
+
+  IF v_existing IS NOT NULL THEN
+    UPDATE appointments b
+    SET kind        = v_kind,
+        assignee_id = v_assignee,
+        location_id = v_location,
+        starts_at   = p_starts_at,
+        ends_at     = v_ends,
+        status      = 'scheduled',
+        notes       = COALESCE(p_description, p_summary),
+        metadata    = COALESCE(b.metadata, '{}'::jsonb) || v_meta,
+        updated_at  = now()
+    WHERE b.id = v_existing
+    RETURNING b.id INTO v_appt;
+  ELSE
+    INSERT INTO appointments (tenant_id, kind, assignee_id, location_id,
+                              starts_at, ends_at, status, notes, metadata)
+    VALUES (p_tenant_id, v_kind, v_assignee, v_location,
+            p_starts_at, v_ends, 'scheduled', COALESCE(p_description, p_summary), v_meta)
+    RETURNING id INTO v_appt;
+  END IF;
+
+  RETURN v_appt;
+END $$;
+
+CREATE OR REPLACE FUNCTION public.gcal_apply_event_patch(
+  p_tenant_id uuid,
+  p_event_id  text,
+  p_etag      text,
+  p_starts_at timestamptz,
+  p_ends_at   timestamptz,
+  p_summary   text,
+  p_cancelled boolean
+) RETURNS uuid
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_appt      uuid;
+  v_curr_etag text;
+BEGIN
+  IF p_tenant_id IS NULL OR p_event_id IS NULL THEN
+    RAISE EXCEPTION 'gcal_apply_event_patch: tenant and event id are required';
+  END IF;
+
+  PERFORM set_config('app.booking_origin', 'google', true);
+
+  SELECT b.id, b.metadata->>'gcalEtag'
+    INTO v_appt, v_curr_etag
+  FROM appointments b
+  WHERE b.tenant_id = p_tenant_id
+    AND b.metadata->>'googleCalendarEventId' = p_event_id
+  LIMIT 1;
+
+  IF v_appt IS NULL THEN RETURN NULL; END IF;
+  IF p_etag IS NOT NULL AND p_etag = v_curr_etag THEN
+    RETURN NULL;
+  END IF;
+
+  IF COALESCE(p_cancelled, false) THEN
+    UPDATE appointments b
+    SET status     = 'cancelled',
+        metadata   = COALESCE(b.metadata, '{}'::jsonb)
+                     || jsonb_build_object('syncOrigin', 'google', 'gcalEtag', p_etag),
+        updated_at = now()
+    WHERE b.id = v_appt;
+  ELSE
+    UPDATE appointments b
+    SET starts_at  = COALESCE(p_starts_at, b.starts_at),
+        ends_at    = COALESCE(p_ends_at, b.ends_at),
+        notes      = COALESCE(p_summary, b.notes),
+        metadata   = COALESCE(b.metadata, '{}'::jsonb)
+                     || jsonb_build_object('syncOrigin', 'google',
+                                           'gcalEtag', p_etag,
+                                           'title', COALESCE(p_summary, b.metadata->>'title')),
+        updated_at = now()
+    WHERE b.id = v_appt;
+  END IF;
+
+  RETURN v_appt;
+END $$;
+
+CREATE OR REPLACE FUNCTION public.gcal_stamp_outbound(
+  p_tenant_id   uuid,
+  p_booking_id  uuid,
+  p_event_id    text,
+  p_etag        text DEFAULT NULL,
+  p_calendar_id text DEFAULT NULL
+) RETURNS uuid
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_id uuid;
+BEGIN
+  IF p_tenant_id IS NULL OR p_booking_id IS NULL OR p_event_id IS NULL THEN
+    RAISE EXCEPTION 'gcal_stamp_outbound: tenant, booking and event id are required';
+  END IF;
+
+  PERFORM set_config('app.booking_origin', 'google', true);
+
+  UPDATE appointments b
+  SET metadata   = COALESCE(b.metadata, '{}'::jsonb)
+                   || jsonb_build_object('googleCalendarEventId', p_event_id,
+                                         'gcalEtag', p_etag,
+                                         'gcalSyncedAt', now())
+                   || CASE WHEN p_calendar_id IS NULL THEN '{}'::jsonb
+                           ELSE jsonb_build_object('gcalCalendarId', p_calendar_id) END,
+      updated_at = now()
+  WHERE b.id = p_booking_id AND b.tenant_id = p_tenant_id
+  RETURNING b.id INTO v_id;
+  RETURN v_id;
+END $$;
+
+CREATE OR REPLACE FUNCTION public.gcal_unlink_channel(
+  p_channel_id uuid
+) RETURNS uuid
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_id uuid;
+BEGIN
+  UPDATE plg_calendar_channels c
+  SET sync_token         = NULL,
+      channel_id         = NULL,
+      resource_id        = NULL,
+      channel_expires_at = NULL,
+      updated_at         = now()
+  WHERE c.id = p_channel_id
+  RETURNING c.id INTO v_id;
+  RETURN v_id;
+END $$;
+
+-- Re-assert the service_role-only lock (idempotent; matches 002 §4).
+DO $$
+DECLARE fn text;
+BEGIN
+  FOR fn IN SELECT unnest(ARRAY[
+    'public.gcal_import_event(uuid, uuid, text, text, text, timestamptz, timestamptz, boolean, text)',
+    'public.gcal_apply_event_patch(uuid, text, text, timestamptz, timestamptz, text, boolean)',
+    'public.gcal_stamp_outbound(uuid, uuid, text, text, text)',
+    'public.gcal_unlink_channel(uuid)'
+  ])
+  LOOP
+    EXECUTE format('REVOKE ALL ON FUNCTION %s FROM public, anon, authenticated', fn);
+    EXECUTE format('GRANT EXECUTE ON FUNCTION %s TO service_role', fn);
+  END LOOP;
+END $$;

package/src/integrations/google-calendar/types.ts

@@ -23,9 +23,120 @@ export interface CalendarSyncLogEntry {
 /** Minimal Google Calendar event shape we read/write (subset of the API). */
 export interface GCalEvent {
   id: string
+  etag?: string
   summary?: string
   description?: string
+  /** Timed events carry dateTime; all-day events carry only `date` (YYYY-MM-DD). */
   start: { dateTime?: string; date?: string; timeZone?: string }
   end: { dateTime?: string; date?: string; timeZone?: string }
   status?: string
+  /** Set on instances expanded from a recurring series (singleEvents=true). */
+  recurringEventId?: string
+}
+
+// ---------------------------------------------------------------------------
+// Smart-sync: multi-calendar channels + wizard preview shapes
+// ---------------------------------------------------------------------------
+
+/** How a channel maps a Google calendar onto the agenda (de-para direction). */
+export type ChannelDirection = 'inbound' | 'outbound' | 'bidirectional' | 'off'
+
+/**
+ * What the channel targets on the Fayz side. `null` (target_kind) means the
+ * whole agenda; otherwise imports/exports scope to one assignee/service/location.
+ */
+export type ChannelTargetKind = 'assignee' | 'service' | 'location' | null
+
+/** How inbound events materialize as appointments. */
+export type ChannelImportMode = 'block' | 'appointment'
+
+/**
+ * A per-calendar sync channel (row of public.plg_calendar_channels). One Google
+ * calendar ↔ one agenda target, with its own direction + incremental cursor.
+ */
+export interface CalendarChannel {
+  id: string
+  integrationId: string
+  tenantId: string
+  googleCalendarId: string
+  summary: string | null
+  color: string | null
+  direction: ChannelDirection
+  targetKind: ChannelTargetKind
+  targetId: string | null
+  importMode: ChannelImportMode
+  syncToken: string | null
+  channelId: string | null
+  resourceId: string | null
+  channelExpiresAt: string | null
+  isActive: boolean
+  createdAt: string
+  updatedAt: string
+}
+
+/** A future Google event not yet linked to an appointment — shown in the import wizard. */
+export interface ExternalEventPreview {
+  eventId: string
+  etag: string
+  summary: string
+  startsAt: string
+  endsAt: string
+  allDay: boolean
+  calendarId: string
+  channelId: string
+  recurring?: boolean
+}
+
+/** One entry from the Google calendarList (for the de-para picker). */
+export interface GoogleCalendarListEntry {
+  id: string
+  summary: string
+  backgroundColor?: string
+  primary?: boolean
+}
+
+/** Result of an import_events run (per-item outcome tally). */
+export interface ImportEventsResult {
+  imported: number
+  skipped: number
+  errors: { eventId: string; error: string }[]
+}
+
+/**
+ * Raw shape of a public.appointments row as the edge function / RPCs see it
+ * (snake_case DB columns). Kept here so the pure mapping helpers can be shared
+ * between the SDK client and the Deno edge function without a DB roundtrip type.
+ */
+export interface AppointmentRow {
+  id: string
+  tenant_id: string
+  kind?: string | null
+  assignee_id?: string | null
+  location_id?: string | null
+  starts_at: string
+  ends_at?: string | null
+  status?: string | null
+  notes?: string | null
+  metadata?: Record<string, any> | null
+}
+
+/** Raw shape of a public.plg_calendar_channels row (snake_case DB columns). */
+export interface CalendarChannelRow {
+  id: string
+  integration_id: string
+  tenant_id: string
+  google_calendar_id: string
+  summary?: string | null
+  color?: string | null
+  direction: ChannelDirection
+  target_kind?: ChannelTargetKind
+  target_id?: string | null
+  import_mode?: ChannelImportMode
+  sync_token?: string | null
+  channel_id?: string | null
+  resource_id?: string | null
+  channel_expires_at?: string | null
+  is_active?: boolean | null
+  created_at?: string
+  updated_at?: string
 }

package/src/locales/en.ts

@@ -29,6 +29,7 @@ export const en: Record<string, string> = {
   "agenda.appointment.searchService": "Search service to add...",
   "agenda.appointment.selectLocation": "Select location...",
   "agenda.appointment.selectProfessional": "Select professional...",
+  "agenda.appointment.selectClientHint": "Select the client from the list or use New client to enable saving.",
   "agenda.appointment.services": "Services",
   "agenda.appointment.status": "Status",
   "agenda.appointment.to": "to",

package/src/locales/pt-BR.ts

@@ -29,6 +29,7 @@ export const ptBR: Record<string, string> = {
   "agenda.appointment.searchService": "Buscar serviço para adicionar...",
   "agenda.appointment.selectLocation": "Selecionar local...",
   "agenda.appointment.selectProfessional": "Selecionar profissional...",
+  "agenda.appointment.selectClientHint": "Selecione o cliente na lista ou use Novo cliente para habilitar o salvamento.",
   "agenda.appointment.services": "Serviços",
   "agenda.appointment.status": "Status",
   "agenda.appointment.to": "até",

package/src/migrations/001_public_booking.sql

@@ -44,7 +44,10 @@ CREATE INDEX IF NOT EXISTS appointments_assignee_time
   WHERE status NOT IN ('cancelled', 'no_show');
 
 -- §2 — admin read model (security_invoker → underlying RLS applies; anon sees 0 rows)
-CREATE OR REPLACE VIEW public.v_appointments
+-- DROP first: 013 widens this view and CREATE OR REPLACE cannot narrow a live
+-- view on replay ("cannot drop columns from view"). 013 replays right after.
+DROP VIEW IF EXISTS public.v_appointments;
+CREATE VIEW public.v_appointments
 WITH (security_invoker = true) AS
 SELECT
   b.id, b.tenant_id, b.kind, b.starts_at, b.ends_at, b.status, b.notes,
@@ -72,7 +75,9 @@ GRANT SELECT ON public.v_appointments TO authenticated, service_role;
 REVOKE SELECT ON public.v_appointments FROM anon;
 
 -- §3 — anon-readable public catalog (owner-rights view = deliberate, whitelisted)
-CREATE OR REPLACE VIEW public.v_public_services AS
+-- DROP first: 010 widens this view (curation columns) — same replay rule as §2.
+DROP VIEW IF EXISTS public.v_public_services;
+CREATE VIEW public.v_public_services AS
 SELECT
   s.id, s.tenant_id, s.name, s.description, s.price, s.currency,
   COALESCE(s.duration_minutes, 30)                AS duration_minutes,

package/src/migrations/003_public_client_kind.sql

@@ -0,0 +1,175 @@
+-- ---------------------------------------------------------------------------
+-- Public booking — tenant-configurable client kind
+-- ---------------------------------------------------------------------------
+-- 001 hardcoded kind='customer' for people created by create_public_booking.
+-- Verticals whose client archetype uses another kind (school → 'student',
+-- clinic → whatever the app registers) ended up with people invisible to the
+-- app's own pages/lookups and with entity links resolving to unregistered
+-- routes (#/customers/:id → not found).
+--
+-- The client kind now comes from TENANT SETTINGS (admin-controlled — never
+-- from the anon caller):   tenants.settings.booking.client_kind
+-- Default remains 'customer', so existing pools/tenants are unaffected until
+-- they opt in:
+--   UPDATE tenants SET settings = jsonb_set(COALESCE(settings,'{}'::jsonb),
+--     '{booking,client_kind}', '"student"') WHERE id = '<tenant>';
+--
+-- The upsert no longer relies on the kind-specific partial unique index
+-- (people_tenant_customer_phone) — a per-(tenant, phone) advisory lock
+-- serializes concurrent first-bookings for any kind. The 001 index stays in
+-- place (harmless, still guards direct customer writes).
+--
+-- Idempotent: CREATE OR REPLACE, same signature as 001.
+-- ---------------------------------------------------------------------------
+CREATE OR REPLACE FUNCTION public.create_public_booking(
+  p_tenant_id uuid,
+  p_service_id uuid,
+  p_starts_at timestamptz,
+  p_name text,
+  p_phone text,
+  p_email text DEFAULT NULL,
+  p_notes text DEFAULT NULL
+) RETURNS TABLE (booking_id uuid, starts_at timestamptz, ends_at timestamptz)
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_service record;
+  v_person_id uuid;
+  v_assignee uuid;
+  v_ends timestamptz;
+  v_order uuid;
+  v_booking uuid;
+  v_phone text;
+  v_tz text;
+  v_notes text;
+  v_client_kind text;
+BEGIN
+  -- validation: anon-callable, everything tight
+  IF p_name IS NULL OR length(trim(p_name)) NOT BETWEEN 2 AND 120 THEN
+    RAISE EXCEPTION 'invalid name';
+  END IF;
+  v_phone := regexp_replace(COALESCE(p_phone, ''), '\D', '', 'g');
+  IF length(v_phone) NOT BETWEEN 8 AND 15 THEN
+    RAISE EXCEPTION 'invalid phone';
+  END IF;
+  IF p_email IS NOT NULL AND (length(p_email) > 254 OR p_email !~ '^[^@\s]+@[^@\s]+\.[^@\s]+$') THEN
+    RAISE EXCEPTION 'invalid email';
+  END IF;
+  v_notes := left(p_notes, 500);
+  IF p_starts_at IS NULL OR p_starts_at <= now() OR p_starts_at > now() + interval '90 days' THEN
+    RAISE EXCEPTION 'invalid start';
+  END IF;
+
+  SELECT s.id, s.name, s.price, COALESCE(s.duration_minutes, 30) AS duration_minutes
+    INTO v_service
+  FROM services s
+  WHERE s.id = p_service_id AND s.tenant_id = p_tenant_id
+    AND s.is_active AND s.status = 'active';
+  IF NOT FOUND THEN RAISE EXCEPTION 'unknown service'; END IF;
+
+  v_ends := p_starts_at + make_interval(mins => v_service.duration_minutes);
+
+  -- tenant config: timezone + client kind (admin-set; sanitized, never caller input)
+  SELECT COALESCE(t.settings->>'timezone', 'America/Sao_Paulo'),
+         COALESCE(NULLIF(trim(t.settings->'booking'->>'client_kind'), ''), 'customer')
+    INTO v_tz, v_client_kind
+  FROM tenants t WHERE t.id = p_tenant_id;
+  IF v_tz IS NULL THEN RAISE EXCEPTION 'unknown tenant'; END IF;
+  IF v_client_kind !~ '^[a-z_]{2,32}$' THEN v_client_kind := 'customer'; END IF;
+
+  -- pick the assignee whose working hours cover the slot
+  SELECT sc.assignee_id INTO v_assignee
+  FROM schedules sc
+  WHERE sc.tenant_id = p_tenant_id
+    AND sc.kind = 'working_hours'
+    AND sc.is_active
+    AND (
+      sc.specific_date = (p_starts_at AT TIME ZONE v_tz)::date
+      OR (sc.specific_date IS NULL
+          AND sc.day_of_week = EXTRACT(dow FROM p_starts_at AT TIME ZONE v_tz)::smallint)
+    )
+    AND (p_starts_at AT TIME ZONE v_tz)::time >= sc.starts_at
+    AND (v_ends AT TIME ZONE v_tz)::time <= sc.ends_at
+  ORDER BY sc.assignee_id
+  LIMIT 1;
+  IF v_assignee IS NULL THEN RAISE EXCEPTION 'slot outside working hours'; END IF;
+
+  -- serialize per (tenant, assignee) to kill the double-book race
+  PERFORM pg_advisory_xact_lock(hashtextextended(p_tenant_id::text || v_assignee::text, 0));
+
+  IF EXISTS (
+    SELECT 1 FROM appointments b
+    WHERE b.tenant_id = p_tenant_id
+      AND b.assignee_id = v_assignee
+      AND b.status NOT IN ('cancelled', 'no_show')
+      AND b.starts_at < v_ends
+      AND COALESCE(b.ends_at, b.starts_at) > p_starts_at
+  ) THEN
+    RAISE EXCEPTION 'slot no longer available';
+  END IF;
+
+  -- anti-spam: cap open future public bookings per phone per tenant
+  IF (
+    SELECT count(*) FROM appointments b
+    JOIN people p ON p.id = b.party_id
+    WHERE b.tenant_id = p_tenant_id
+      AND p.phone = v_phone
+      AND b.starts_at > now()
+      AND b.status = 'scheduled'
+  ) >= 3 THEN
+    RAISE EXCEPTION 'too many open bookings for this phone';
+  END IF;
+
+  -- upsert the client by (tenant, kind, phone). Kind is tenant-configured, so
+  -- the 001 customer-only partial index can't arbitrate — a per-(tenant,
+  -- phone) advisory lock serializes concurrent first-bookings instead.
+  PERFORM pg_advisory_xact_lock(hashtextextended(p_tenant_id::text || ':' || v_phone, 1));
+
+  SELECT p.id INTO v_person_id
+  FROM people p
+  WHERE p.tenant_id = p_tenant_id AND p.kind = v_client_kind AND p.phone = v_phone
+  ORDER BY p.created_at
+  LIMIT 1;
+
+  IF v_person_id IS NOT NULL THEN
+    UPDATE people SET
+      name = trim(p_name),
+      email = COALESCE(p_email, people.email),
+      updated_at = now()
+    WHERE id = v_person_id;
+  ELSE
+    INSERT INTO people (tenant_id, kind, name, phone, email, metadata)
+    VALUES (p_tenant_id, v_client_kind, trim(p_name), v_phone, p_email,
+            jsonb_build_object('source', 'public_booking'))
+    RETURNING id INTO v_person_id;
+  END IF;
+
+  -- order + booking + order_item (statuses hardcoded — caller cannot set)
+  INSERT INTO orders (tenant_id, kind, status, party_id, assignee_id, subtotal, total, notes, metadata)
+  VALUES (p_tenant_id, 'appointment', 'scheduled', v_person_id, v_assignee,
+          v_service.price, v_service.price, v_notes,
+          jsonb_build_object('source', 'public_booking',
+                             'serviceNames', v_service.name,
+                             'contactName', trim(p_name)))
+  RETURNING id INTO v_order;
+
+  INSERT INTO appointments (tenant_id, kind, party_id, assignee_id, order_id,
+                        starts_at, ends_at, status, notes, metadata)
+  VALUES (p_tenant_id, 'appointment', v_person_id, v_assignee, v_order,
+          p_starts_at, v_ends, 'scheduled', v_notes,
+          jsonb_build_object('source', 'public_booking', 'serviceNames', v_service.name))
+  RETURNING id INTO v_booking;
+
+  INSERT INTO order_items (order_id, service_id, name, quantity, unit_price, total,
+                           sort_order, duration_minutes, assignee_id)
+  VALUES (v_order, v_service.id, v_service.name, 1, v_service.price, v_service.price,
+          0, v_service.duration_minutes, v_assignee);
+
+  RETURN QUERY SELECT v_booking, p_starts_at, v_ends;
+END;
+$$;
+
+REVOKE ALL ON FUNCTION public.create_public_booking(uuid, uuid, timestamptz, text, text, text, text) FROM public;
+GRANT EXECUTE ON FUNCTION public.create_public_booking(uuid, uuid, timestamptz, text, text, text, text)
+  TO anon, authenticated, service_role;