@fayz-ai/plugin-agenda 0.8.3 → 0.9.0-next.0

package/src/migrations/014_agent_rpc_update_appointment.sql

@@ -0,0 +1,199 @@
+-- ============================================================================
+-- plugin-agenda 014: agent_agenda_update_appointment — remarcar / reatribuir /
+-- cancelar um agendamento existente.
+--
+-- Lacuna que isso fecha: o agente sabia CRIAR e não sabia MEXER. Pedido real
+-- ("remarca esse paciente pra 16:30") caía no updateRecord genérico, que bate
+-- em v_appointments — uma view — e devolve read_only; o modelo então "resolvia"
+-- abrindo um agendamento NOVO, deixando o antigo de pé. Duplicar a agenda de um
+-- salão é pior do que não fazer nada.
+--
+-- Mesma cadeia de guardas do 008 (agent_guard → janela de trabalho com exceções
+-- → lock advisory → checagem de conflito → auditoria), com três diferenças:
+--   • ação 'edit', sem cota (remarcar não consome bookings_month);
+--   • o próprio agendamento é excluído da checagem de conflito consigo mesmo;
+--   • cancelar não precisa de horário livre — só o guard.
+-- Requer 007 (agenda_working_windows). Idempotente.
+-- ============================================================================
+
+CREATE OR REPLACE FUNCTION public.agent_agenda_update_appointment(
+  p_tenant_id uuid,
+  p_actor_user_id uuid,
+  p_payload jsonb
+) RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_denial jsonb;
+  v_id uuid;
+  v_tz text;
+  v_row record;
+  v_starts_raw text;
+  v_starts timestamptz;
+  v_ends timestamptz;
+  v_duration int;
+  v_professional uuid;
+  v_status text;
+  v_notes text;
+  v_wants_move boolean;
+  v_wants_status boolean;
+BEGIN
+  SELECT COALESCE(t.settings->>'timezone', 'America/Sao_Paulo') INTO v_tz
+  FROM tenants t WHERE t.id = p_tenant_id;
+  IF v_tz IS NULL THEN
+    RETURN jsonb_build_object('ok', false, 'error', 'unknown tenant');
+  END IF;
+
+  -- ── payload ──────────────────────────────────────────────────────────────
+  BEGIN
+    v_id           := (p_payload->>'appointment_id')::uuid;
+    v_professional := (p_payload->>'professional_id')::uuid;
+    v_starts_raw   := p_payload->>'starts_at';
+  EXCEPTION WHEN OTHERS THEN
+    RETURN jsonb_build_object('ok', false, 'error', 'invalid payload: ' || SQLERRM);
+  END;
+  v_status := nullif(trim(lower(p_payload->>'status')), '');
+  v_notes  := left(p_payload->>'notes', 500);
+  v_wants_move   := v_starts_raw IS NOT NULL OR v_professional IS NOT NULL;
+  v_wants_status := v_status IS NOT NULL;
+
+  IF v_id IS NULL THEN
+    RETURN jsonb_build_object('ok', false, 'error',
+      'appointment_id is required — search the agenda first and reuse the id of the appointment to change');
+  END IF;
+  IF NOT v_wants_move AND NOT v_wants_status AND v_notes IS NULL THEN
+    RETURN jsonb_build_object('ok', false, 'error',
+      'nothing to change: send starts_at, professional_id, status or notes');
+  END IF;
+  IF v_status IS NOT NULL
+     AND v_status NOT IN ('scheduled', 'confirmed', 'in_progress', 'completed', 'cancelled', 'no_show') THEN
+    RETURN jsonb_build_object('ok', false, 'error',
+      'status must be one of scheduled, confirmed, in_progress, completed, cancelled, no_show');
+  END IF;
+
+  -- ── the appointment must exist, in THIS tenant ───────────────────────────
+  SELECT b.id, b.starts_at, b.ends_at, b.assignee_id, b.status, b.party_id, b.order_id
+    INTO v_row
+  FROM appointments b
+  WHERE b.id = v_id AND b.tenant_id = p_tenant_id;
+  IF NOT FOUND THEN
+    RETURN jsonb_build_object('ok', false, 'error', 'unknown appointment for this tenant');
+  END IF;
+
+  -- ── authorization: role → plan. No cap: editing frees nothing and buys
+  --    nothing, so charging bookings_month for a reschedule would be wrong.
+  v_denial := agent_guard(p_tenant_id, p_actor_user_id, 'appointments', 'edit');
+  IF v_denial IS NOT NULL THEN
+    RETURN jsonb_build_object('ok', false, 'denial', v_denial);
+  END IF;
+
+  -- Duration is preserved across a move — a 60-minute appointment stays 60.
+  v_duration := GREATEST(
+    COALESCE(EXTRACT(EPOCH FROM (v_row.ends_at - v_row.starts_at)) / 60, 30)::int, 5);
+  v_professional := COALESCE(v_professional, v_row.assignee_id);
+
+  IF v_wants_move THEN
+    IF v_starts_raw IS NOT NULL THEN
+      BEGIN
+        IF v_starts_raw ~ '(Z|[+-][0-9]{2}:?[0-9]{2})$' THEN
+          v_starts := v_starts_raw::timestamptz;               -- explicit offset
+        ELSE
+          v_starts := (v_starts_raw::timestamp) AT TIME ZONE v_tz;  -- tenant-local
+        END IF;
+      EXCEPTION WHEN OTHERS THEN
+        RETURN jsonb_build_object('ok', false, 'error', 'invalid starts_at: ' || SQLERRM);
+      END;
+    ELSE
+      v_starts := v_row.starts_at;
+    END IF;
+    v_ends := v_starts + make_interval(mins => v_duration);
+
+    IF v_starts > now() + interval '365 days' THEN
+      RETURN jsonb_build_object('ok', false, 'error', 'starts_at must be within the next year');
+    END IF;
+
+    -- Working window (exception-aware, 007) for the target professional.
+    IF NOT EXISTS (
+      SELECT 1
+      FROM agenda_working_windows(
+             p_tenant_id, (v_starts AT TIME ZONE v_tz)::date, v_professional) w
+      WHERE w.assignee_id = v_professional
+        AND (v_starts AT TIME ZONE v_tz)::time >= w.win_start
+        AND (v_ends   AT TIME ZONE v_tz)::time <= w.win_end
+    ) THEN
+      RETURN jsonb_build_object('ok', false, 'error',
+        'that slot is outside the professional''s working hours. Suggest a different time. Times are tenant-local, tz ' || v_tz);
+    END IF;
+
+    PERFORM pg_advisory_xact_lock(hashtextextended(p_tenant_id::text || v_professional::text, 0));
+    IF EXISTS (
+      SELECT 1 FROM appointments b
+      WHERE b.tenant_id = p_tenant_id
+        AND b.assignee_id = v_professional
+        AND b.id <> v_id                     -- never conflicts with itself
+        AND b.status NOT IN ('cancelled', 'no_show')
+        AND b.starts_at < v_ends
+        AND COALESCE(b.ends_at, b.starts_at) > v_starts
+    ) THEN
+      RETURN jsonb_build_object('ok', false, 'error',
+        'that slot is already taken. Suggest a different time.');
+    END IF;
+  END IF;
+
+  -- ── write + audit ────────────────────────────────────────────────────────
+  UPDATE appointments b SET
+    starts_at   = COALESCE(v_starts, b.starts_at),
+    ends_at     = COALESCE(v_ends, b.ends_at),
+    assignee_id = v_professional,
+    status      = COALESCE(v_status, b.status),
+    notes       = COALESCE(v_notes, b.notes),
+    metadata    = COALESCE(b.metadata, '{}'::jsonb) || jsonb_build_object('lastAgentEdit', now()),
+    updated_at  = now()
+  WHERE b.id = v_id AND b.tenant_id = p_tenant_id;
+
+  -- The order mirrors the appointment's assignee/status so the financial side
+  -- does not drift from the calendar.
+  IF v_row.order_id IS NOT NULL THEN
+    UPDATE orders o SET
+      assignee_id = v_professional,
+      status      = CASE WHEN v_status = 'cancelled' THEN 'cancelled' ELSE o.status END,
+      updated_at  = now()
+    WHERE o.id = v_row.order_id AND o.tenant_id = p_tenant_id;
+  END IF;
+
+  INSERT INTO audit_logs (tenant_id, user_id, action, entity_type, entity_id, metadata)
+  VALUES (p_tenant_id, p_actor_user_id, 'agent.updateAppointment', 'appointment', v_id::text,
+          jsonb_build_object('payload', p_payload,
+                             'previous', jsonb_build_object(
+                               'starts_at', v_row.starts_at,
+                               'ends_at', v_row.ends_at,
+                               'assignee_id', v_row.assignee_id,
+                               'status', v_row.status)));
+
+  SELECT a.id, a.starts_at, a.ends_at, a.status, a.client_name, a.professional_name
+    INTO v_row
+  FROM v_appointments a WHERE a.id = v_id;
+
+  RETURN jsonb_build_object(
+    'ok', true,
+    'id', v_id,
+    'record', jsonb_build_object(
+      'ref', jsonb_build_object('id', v_id, 'resource', 'appointments',
+                                'archetype', 'schedule:appointment'),
+      'starts_at', v_row.starts_at,
+      'ends_at', v_row.ends_at,
+      'starts_at_local', to_char(v_row.starts_at AT TIME ZONE v_tz, 'YYYY-MM-DD (Dy) HH24:MI') || ' ' || v_tz,
+      'ends_at_local', to_char(v_row.ends_at AT TIME ZONE v_tz, 'HH24:MI'),
+      'client_name', v_row.client_name,
+      'professional_name', v_row.professional_name,
+      'status', v_row.status
+    )
+  );
+END;
+$$;
+
+REVOKE ALL ON FUNCTION public.agent_agenda_update_appointment(uuid, uuid, jsonb) FROM public;
+REVOKE EXECUTE ON FUNCTION public.agent_agenda_update_appointment(uuid, uuid, jsonb) FROM anon;
+GRANT EXECUTE ON FUNCTION public.agent_agenda_update_appointment(uuid, uuid, jsonb)
+  TO authenticated, service_role;

package/src/migrations/index.ts

@@ -1,4 +1,4 @@
-// AUTO-GENERATED from 000b_v_bookings_rename.sql, 000c_dedupe_customer_phones.sql, 001_public_booking.sql, 002_v_bookings_compat.sql, 003_public_client_kind.sql, 004_public_booking_assignee.sql, 005_agent_rpcs.sql, 006_agent_rpc_localtime.sql, 007_schedule_exception_precedence.sql, 008_agent_rpc_exception_precedence.sql, 009_public_booking_location.sql, 010_public_service_curation.sql, 011_default_assignee.sql, 012_drop_legacy_booking_overload.sql, 013_normalize_v_appointments.sql — regenerate with scripts/embed-migrations.mjs
+// AUTO-GENERATED from 000b_v_bookings_rename.sql, 000c_dedupe_customer_phones.sql, 001_public_booking.sql, 002_v_bookings_compat.sql, 003_public_client_kind.sql, 004_public_booking_assignee.sql, 005_agent_rpcs.sql, 006_agent_rpc_localtime.sql, 007_schedule_exception_precedence.sql, 008_agent_rpc_exception_precedence.sql, 009_public_booking_location.sql, 010_public_service_curation.sql, 011_default_assignee.sql, 012_drop_legacy_booking_overload.sql, 013_normalize_v_appointments.sql, 014_agent_rpc_update_appointment.sql — regenerate with scripts/embed-migrations.mjs
 // SQL files are the source of truth; this inline copy lets the manifest declare
 // migrations as data. Do not edit by hand — run the embed script instead.
 
@@ -116,7 +116,10 @@ CREATE INDEX IF NOT EXISTS appointments_assignee_time
   WHERE status NOT IN ('cancelled', 'no_show');
 
 -- §2 — admin read model (security_invoker → underlying RLS applies; anon sees 0 rows)
-CREATE OR REPLACE VIEW public.v_appointments
+-- DROP first: 013 widens this view and CREATE OR REPLACE cannot narrow a live
+-- view on replay ("cannot drop columns from view"). 013 replays right after.
+DROP VIEW IF EXISTS public.v_appointments;
+CREATE VIEW public.v_appointments
 WITH (security_invoker = true) AS
 SELECT
   b.id, b.tenant_id, b.kind, b.starts_at, b.ends_at, b.status, b.notes,
@@ -144,7 +147,9 @@ GRANT SELECT ON public.v_appointments TO authenticated, service_role;
 REVOKE SELECT ON public.v_appointments FROM anon;
 
 -- §3 — anon-readable public catalog (owner-rights view = deliberate, whitelisted)
-CREATE OR REPLACE VIEW public.v_public_services AS
+-- DROP first: 010 widens this view (curation columns) — same replay rule as §2.
+DROP VIEW IF EXISTS public.v_public_services;
+CREATE VIEW public.v_public_services AS
 SELECT
   s.id, s.tenant_id, s.name, s.description, s.price, s.currency,
   COALESCE(s.duration_minutes, 30)                AS duration_minutes,
@@ -2042,41 +2047,79 @@ SELECT tenant_id,
     updated_at
    FROM v_appointments b;
 
-CREATE OR REPLACE VIEW public.rep_confirmation_queue AS
-SELECT b.tenant_id,
-    b.id AS booking_id,
-    (b.starts_at)::date AS date,
-    b.starts_at,
-    b.client_id,
-    b.client_name,
-    b.professional_id,
-    b.professional_name,
-    COALESCE(((b.services -> 0) ->> 'name'::text), ((b.services -> 0) ->> 'serviceName'::text)) AS service_name,
-    COALESCE(a.confirmation_status, 'pending'::text) AS confirmation_status,
-    a.confirmation_channel,
-    a.confirmation_sent_at,
-    a.confirmed_at,
-    b.created_at,
-    b.updated_at
-   FROM (v_appointments b
-     LEFT JOIN legacy_pre_pools.appointments a ON ((a.booking_id = b.id)))
-  WHERE ((b.status <> ALL (ARRAY['cancelled'::text, 'no_show'::text])) AND (b.starts_at >= (now() - '1 day'::interval)));
-
-CREATE OR REPLACE VIEW public.rep_new_clients AS
-SELECT c.tenant_id,
-    c.id AS client_id,
-    (c.created_at)::date AS date,
-    c.name AS client_name,
-    c.origin,
-    first_booking.service_name AS first_service,
-    c.created_at,
-    c.updated_at
-   FROM (v_clients c
-     LEFT JOIN LATERAL ( SELECT COALESCE(((b.services -> 0) ->> 'name'::text), ((b.services -> 0) ->> 'serviceName'::text)) AS service_name
-           FROM v_appointments b
-          WHERE (b.client_id = c.id)
-          ORDER BY b.starts_at
-         LIMIT 1) first_booking ON (true));
+-- legacy_pre_pools only exists on pools migrated from the pre-pool era; fresh
+-- pools get the same shape with confirmation columns defaulting to pending/NULL.
+DO $$
+BEGIN
+  IF to_regclass('legacy_pre_pools.appointments') IS NOT NULL THEN
+    EXECUTE $v$
+      CREATE OR REPLACE VIEW public.rep_confirmation_queue AS
+      SELECT b.tenant_id,
+          b.id AS booking_id,
+          (b.starts_at)::date AS date,
+          b.starts_at,
+          b.client_id,
+          b.client_name,
+          b.professional_id,
+          b.professional_name,
+          COALESCE(((b.services -> 0) ->> 'name'::text), ((b.services -> 0) ->> 'serviceName'::text)) AS service_name,
+          COALESCE(a.confirmation_status, 'pending'::text) AS confirmation_status,
+          a.confirmation_channel,
+          a.confirmation_sent_at,
+          a.confirmed_at,
+          b.created_at,
+          b.updated_at
+         FROM (v_appointments b
+           LEFT JOIN legacy_pre_pools.appointments a ON ((a.booking_id = b.id)))
+        WHERE ((b.status <> ALL (ARRAY['cancelled'::text, 'no_show'::text])) AND (b.starts_at >= (now() - '1 day'::interval)))
+    $v$;
+  ELSE
+    EXECUTE $v$
+      CREATE OR REPLACE VIEW public.rep_confirmation_queue AS
+      SELECT b.tenant_id,
+          b.id AS booking_id,
+          (b.starts_at)::date AS date,
+          b.starts_at,
+          b.client_id,
+          b.client_name,
+          b.professional_id,
+          b.professional_name,
+          COALESCE(((b.services -> 0) ->> 'name'::text), ((b.services -> 0) ->> 'serviceName'::text)) AS service_name,
+          'pending'::text AS confirmation_status,
+          NULL::text AS confirmation_channel,
+          NULL::timestamptz AS confirmation_sent_at,
+          NULL::timestamptz AS confirmed_at,
+          b.created_at,
+          b.updated_at
+         FROM v_appointments b
+        WHERE ((b.status <> ALL (ARRAY['cancelled'::text, 'no_show'::text])) AND (b.starts_at >= (now() - '1 day'::interval)))
+    $v$;
+  END IF;
+END $$;
+
+-- v_clients (beauty Ring-2 extension) may not exist on non-salon pools — the
+-- report only makes sense where it does.
+DO $$
+BEGIN
+  IF to_regclass('public.v_clients') IS NULL THEN RETURN; END IF;
+  EXECUTE $v$
+    CREATE OR REPLACE VIEW public.rep_new_clients AS
+    SELECT c.tenant_id,
+        c.id AS client_id,
+        (c.created_at)::date AS date,
+        c.name AS client_name,
+        c.origin,
+        first_booking.service_name AS first_service,
+        c.created_at,
+        c.updated_at
+       FROM (v_clients c
+         LEFT JOIN LATERAL ( SELECT COALESCE(((b.services -> 0) ->> 'name'::text), ((b.services -> 0) ->> 'serviceName'::text)) AS service_name
+               FROM v_appointments b
+              WHERE (b.client_id = c.id)
+              ORDER BY b.starts_at
+             LIMIT 1) first_booking ON (true))
+  $v$;
+END $$;
 
 CREATE OR REPLACE VIEW public.rep_revenue_by_professional AS
 SELECT tenant_id,
@@ -2113,6 +2156,207 @@ DROP VIEW IF EXISTS public.v_bookings;
 DROP VIEW IF EXISTS public.v_bookings_legacy_beauty;
 `
 
+export const MIGRATION_014_AGENT_RPC_UPDATE_APPOINTMENT = `-- ============================================================================
+-- plugin-agenda 014: agent_agenda_update_appointment — remarcar / reatribuir /
+-- cancelar um agendamento existente.
+--
+-- Lacuna que isso fecha: o agente sabia CRIAR e não sabia MEXER. Pedido real
+-- ("remarca esse paciente pra 16:30") caía no updateRecord genérico, que bate
+-- em v_appointments — uma view — e devolve read_only; o modelo então "resolvia"
+-- abrindo um agendamento NOVO, deixando o antigo de pé. Duplicar a agenda de um
+-- salão é pior do que não fazer nada.
+--
+-- Mesma cadeia de guardas do 008 (agent_guard → janela de trabalho com exceções
+-- → lock advisory → checagem de conflito → auditoria), com três diferenças:
+--   • ação 'edit', sem cota (remarcar não consome bookings_month);
+--   • o próprio agendamento é excluído da checagem de conflito consigo mesmo;
+--   • cancelar não precisa de horário livre — só o guard.
+-- Requer 007 (agenda_working_windows). Idempotente.
+-- ============================================================================
+
+CREATE OR REPLACE FUNCTION public.agent_agenda_update_appointment(
+  p_tenant_id uuid,
+  p_actor_user_id uuid,
+  p_payload jsonb
+) RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_denial jsonb;
+  v_id uuid;
+  v_tz text;
+  v_row record;
+  v_starts_raw text;
+  v_starts timestamptz;
+  v_ends timestamptz;
+  v_duration int;
+  v_professional uuid;
+  v_status text;
+  v_notes text;
+  v_wants_move boolean;
+  v_wants_status boolean;
+BEGIN
+  SELECT COALESCE(t.settings->>'timezone', 'America/Sao_Paulo') INTO v_tz
+  FROM tenants t WHERE t.id = p_tenant_id;
+  IF v_tz IS NULL THEN
+    RETURN jsonb_build_object('ok', false, 'error', 'unknown tenant');
+  END IF;
+
+  -- ── payload ──────────────────────────────────────────────────────────────
+  BEGIN
+    v_id           := (p_payload->>'appointment_id')::uuid;
+    v_professional := (p_payload->>'professional_id')::uuid;
+    v_starts_raw   := p_payload->>'starts_at';
+  EXCEPTION WHEN OTHERS THEN
+    RETURN jsonb_build_object('ok', false, 'error', 'invalid payload: ' || SQLERRM);
+  END;
+  v_status := nullif(trim(lower(p_payload->>'status')), '');
+  v_notes  := left(p_payload->>'notes', 500);
+  v_wants_move   := v_starts_raw IS NOT NULL OR v_professional IS NOT NULL;
+  v_wants_status := v_status IS NOT NULL;
+
+  IF v_id IS NULL THEN
+    RETURN jsonb_build_object('ok', false, 'error',
+      'appointment_id is required — search the agenda first and reuse the id of the appointment to change');
+  END IF;
+  IF NOT v_wants_move AND NOT v_wants_status AND v_notes IS NULL THEN
+    RETURN jsonb_build_object('ok', false, 'error',
+      'nothing to change: send starts_at, professional_id, status or notes');
+  END IF;
+  IF v_status IS NOT NULL
+     AND v_status NOT IN ('scheduled', 'confirmed', 'in_progress', 'completed', 'cancelled', 'no_show') THEN
+    RETURN jsonb_build_object('ok', false, 'error',
+      'status must be one of scheduled, confirmed, in_progress, completed, cancelled, no_show');
+  END IF;
+
+  -- ── the appointment must exist, in THIS tenant ───────────────────────────
+  SELECT b.id, b.starts_at, b.ends_at, b.assignee_id, b.status, b.party_id, b.order_id
+    INTO v_row
+  FROM appointments b
+  WHERE b.id = v_id AND b.tenant_id = p_tenant_id;
+  IF NOT FOUND THEN
+    RETURN jsonb_build_object('ok', false, 'error', 'unknown appointment for this tenant');
+  END IF;
+
+  -- ── authorization: role → plan. No cap: editing frees nothing and buys
+  --    nothing, so charging bookings_month for a reschedule would be wrong.
+  v_denial := agent_guard(p_tenant_id, p_actor_user_id, 'appointments', 'edit');
+  IF v_denial IS NOT NULL THEN
+    RETURN jsonb_build_object('ok', false, 'denial', v_denial);
+  END IF;
+
+  -- Duration is preserved across a move — a 60-minute appointment stays 60.
+  v_duration := GREATEST(
+    COALESCE(EXTRACT(EPOCH FROM (v_row.ends_at - v_row.starts_at)) / 60, 30)::int, 5);
+  v_professional := COALESCE(v_professional, v_row.assignee_id);
+
+  IF v_wants_move THEN
+    IF v_starts_raw IS NOT NULL THEN
+      BEGIN
+        IF v_starts_raw ~ '(Z|[+-][0-9]{2}:?[0-9]{2})$' THEN
+          v_starts := v_starts_raw::timestamptz;               -- explicit offset
+        ELSE
+          v_starts := (v_starts_raw::timestamp) AT TIME ZONE v_tz;  -- tenant-local
+        END IF;
+      EXCEPTION WHEN OTHERS THEN
+        RETURN jsonb_build_object('ok', false, 'error', 'invalid starts_at: ' || SQLERRM);
+      END;
+    ELSE
+      v_starts := v_row.starts_at;
+    END IF;
+    v_ends := v_starts + make_interval(mins => v_duration);
+
+    IF v_starts > now() + interval '365 days' THEN
+      RETURN jsonb_build_object('ok', false, 'error', 'starts_at must be within the next year');
+    END IF;
+
+    -- Working window (exception-aware, 007) for the target professional.
+    IF NOT EXISTS (
+      SELECT 1
+      FROM agenda_working_windows(
+             p_tenant_id, (v_starts AT TIME ZONE v_tz)::date, v_professional) w
+      WHERE w.assignee_id = v_professional
+        AND (v_starts AT TIME ZONE v_tz)::time >= w.win_start
+        AND (v_ends   AT TIME ZONE v_tz)::time <= w.win_end
+    ) THEN
+      RETURN jsonb_build_object('ok', false, 'error',
+        'that slot is outside the professional''s working hours. Suggest a different time. Times are tenant-local, tz ' || v_tz);
+    END IF;
+
+    PERFORM pg_advisory_xact_lock(hashtextextended(p_tenant_id::text || v_professional::text, 0));
+    IF EXISTS (
+      SELECT 1 FROM appointments b
+      WHERE b.tenant_id = p_tenant_id
+        AND b.assignee_id = v_professional
+        AND b.id <> v_id                     -- never conflicts with itself
+        AND b.status NOT IN ('cancelled', 'no_show')
+        AND b.starts_at < v_ends
+        AND COALESCE(b.ends_at, b.starts_at) > v_starts
+    ) THEN
+      RETURN jsonb_build_object('ok', false, 'error',
+        'that slot is already taken. Suggest a different time.');
+    END IF;
+  END IF;
+
+  -- ── write + audit ────────────────────────────────────────────────────────
+  UPDATE appointments b SET
+    starts_at   = COALESCE(v_starts, b.starts_at),
+    ends_at     = COALESCE(v_ends, b.ends_at),
+    assignee_id = v_professional,
+    status      = COALESCE(v_status, b.status),
+    notes       = COALESCE(v_notes, b.notes),
+    metadata    = COALESCE(b.metadata, '{}'::jsonb) || jsonb_build_object('lastAgentEdit', now()),
+    updated_at  = now()
+  WHERE b.id = v_id AND b.tenant_id = p_tenant_id;
+
+  -- The order mirrors the appointment's assignee/status so the financial side
+  -- does not drift from the calendar.
+  IF v_row.order_id IS NOT NULL THEN
+    UPDATE orders o SET
+      assignee_id = v_professional,
+      status      = CASE WHEN v_status = 'cancelled' THEN 'cancelled' ELSE o.status END,
+      updated_at  = now()
+    WHERE o.id = v_row.order_id AND o.tenant_id = p_tenant_id;
+  END IF;
+
+  INSERT INTO audit_logs (tenant_id, user_id, action, entity_type, entity_id, metadata)
+  VALUES (p_tenant_id, p_actor_user_id, 'agent.updateAppointment', 'appointment', v_id::text,
+          jsonb_build_object('payload', p_payload,
+                             'previous', jsonb_build_object(
+                               'starts_at', v_row.starts_at,
+                               'ends_at', v_row.ends_at,
+                               'assignee_id', v_row.assignee_id,
+                               'status', v_row.status)));
+
+  SELECT a.id, a.starts_at, a.ends_at, a.status, a.client_name, a.professional_name
+    INTO v_row
+  FROM v_appointments a WHERE a.id = v_id;
+
+  RETURN jsonb_build_object(
+    'ok', true,
+    'id', v_id,
+    'record', jsonb_build_object(
+      'ref', jsonb_build_object('id', v_id, 'resource', 'appointments',
+                                'archetype', 'schedule:appointment'),
+      'starts_at', v_row.starts_at,
+      'ends_at', v_row.ends_at,
+      'starts_at_local', to_char(v_row.starts_at AT TIME ZONE v_tz, 'YYYY-MM-DD (Dy) HH24:MI') || ' ' || v_tz,
+      'ends_at_local', to_char(v_row.ends_at AT TIME ZONE v_tz, 'HH24:MI'),
+      'client_name', v_row.client_name,
+      'professional_name', v_row.professional_name,
+      'status', v_row.status
+    )
+  );
+END;
+$$;
+
+REVOKE ALL ON FUNCTION public.agent_agenda_update_appointment(uuid, uuid, jsonb) FROM public;
+REVOKE EXECUTE ON FUNCTION public.agent_agenda_update_appointment(uuid, uuid, jsonb) FROM anon;
+GRANT EXECUTE ON FUNCTION public.agent_agenda_update_appointment(uuid, uuid, jsonb)
+  TO authenticated, service_role;
+`
+
 export const MIGRATIONS: Array<{ id: string; sql: string }> = [
   { id: "000b_v_bookings_rename", sql: MIGRATION_000B_V_BOOKINGS_RENAME },
   { id: "000c_dedupe_customer_phones", sql: MIGRATION_000C_DEDUPE_CUSTOMER_PHONES },
@@ -2129,4 +2373,5 @@ export const MIGRATIONS: Array<{ id: string; sql: string }> = [
   { id: "011_default_assignee", sql: MIGRATION_011_DEFAULT_ASSIGNEE },
   { id: "012_drop_legacy_booking_overload", sql: MIGRATION_012_DROP_LEGACY_BOOKING_OVERLOAD },
   { id: "013_normalize_v_appointments", sql: MIGRATION_013_NORMALIZE_V_APPOINTMENTS },
+  { id: "014_agent_rpc_update_appointment", sql: MIGRATION_014_AGENT_RPC_UPDATE_APPOINTMENT },
 ]

package/src/public/data.supabase.ts

@@ -11,7 +11,7 @@
 // Shipped by plugins/plugin-agenda/src/migrations/001_public_booking.sql.
 // ---------------------------------------------------------------------------
 
-import { getFayzCloudClient, getSupabaseClientOptional } from '@fayz-ai/core'
+import { getSupabaseClientOptional } from '@fayz-ai/core'
 import type { TimeSlot } from '../types'
 import type { PublicService } from './types'
 import type { PublicBookingDataProvider } from './data'
@@ -26,10 +26,10 @@ interface SupabaseLikeClient {
   rpc(fn: string, args: Record<string, unknown>): PromiseLike<{ data: unknown; error: { message: string } | null }>
 }
 
-// App-registered client (BYO backend) wins; otherwise Fayz Cloud — the shared
-// hosted project every tenantId-only app books against by default.
 function getClient(): SupabaseLikeClient {
-  return (getSupabaseClientOptional() ?? getFayzCloudClient()) as SupabaseLikeClient
+  const client = getSupabaseClientOptional()
+  if (!client) throw new Error('No Supabase client registered — call setGlobalSupabaseClient() at app startup.')
+  return client as SupabaseLikeClient
 }
 
 /** Digits-only phone (RPC normalizes again server-side; keep the dial code). */

package/src/store.ts

@@ -1,4 +1,5 @@
 import { createStore, type StoreApi } from 'zustand/vanilla'
+import { emitDataChanged } from '@fayz-ai/core'
 import { dedup } from '@fayz-ai/saas'
 import { toast } from '@fayz-ai/ui'
 import { getScheduleBlockConfig, setScheduleBlockConfig } from '@fayz-ai/saas'
@@ -181,6 +182,7 @@ export function createAgendaStore(provider: AgendaDataProvider, financialBridge?
           const bookings = await provider.getBookings(getCurrentBookingQuery(state))
           set({ bookings })
         }
+        emitDataChanged({ table: 'appointments', op: 'create', id: booking.id, source: 'ui' })
         toast.success('Appointment created')
         return booking
       } catch (err: any) {
@@ -197,6 +199,7 @@ export function createAgendaStore(provider: AgendaDataProvider, financialBridge?
           const bookings = await provider.getBookings(getCurrentBookingQuery(state))
           set({ bookings })
         }
+        emitDataChanged({ table: 'appointments', op: 'update', id, source: 'ui' })
         toast.success('Appointment updated')
         return booking
       } catch (err: any) {
@@ -213,6 +216,7 @@ export function createAgendaStore(provider: AgendaDataProvider, financialBridge?
           const bookings = await provider.getBookings(getCurrentBookingQuery(state))
           set({ bookings })
         }
+        emitDataChanged({ table: 'appointments', op: 'delete', id, source: 'ui' })
         toast.success('Appointment deleted')
       } catch (err: any) {
         toast.error('Failed to delete appointment', { description: err?.message })
@@ -232,6 +236,7 @@ export function createAgendaStore(provider: AgendaDataProvider, financialBridge?
           const bookings = await provider.getBookings(getCurrentBookingQuery(state))
           set({ bookings })
         }
+        emitDataChanged({ table: 'appointments', op: 'update', id, source: 'ui' })
         toast.success('Status updated')
       } catch (err: any) {
         // Rollback on failure