@fayz-ai/plugin-agenda 0.9.0 → 0.10.0

package/dist/index.js

@@ -1,8 +1,8 @@
-import { createMockAgendaProvider, createSupabasePublicBookingProvider } from './chunk-Q2PAWBPR.js';
-export { createMockAgendaProvider } from './chunk-Q2PAWBPR.js';
+import { createMockAgendaProvider, createSupabasePublicBookingProvider } from './chunk-ISLJXP7O.js';
+export { createMockAgendaProvider } from './chunk-ISLJXP7O.js';
 import React13, { useState, useEffect, useCallback, useMemo, useRef } from 'react';
-import { getSupabaseClientOptional, getActiveTenantId, registerTranslations, createSafeDataProvider, emitDataChanged, usePluginRuntimeOptional, useTranslation, getCurrentLocale, useDataChanged, formatCurrency } from '@fayz-ai/core';
-import { createPluginContext, setScheduleBlockConfig, getScheduleBlockConfig, PluginSettingsPanel, dedup, useTenantPluginSettings, SettingsGroup, ToggleRow, SelectRow, usePluginPrefs, PersonLink, useLimitGuard, CrudFormPage, CrudDetailPage, ContactPicker, invalidateLimit } from '@fayz-ai/saas';
+import { connectionStatus, createConnectionStore, getSupabaseClientOptional, getActiveTenantId, registerTranslations, registerMessageDefaults, createSafeDataProvider, connectorRuntimeToken, CONNECTOR_RUNTIME_TOKEN_HEADER, emitDataChanged, usePluginRuntimeOptional, useTranslation, emitDomainEvent, getCurrentLocale, useDataChanged, formatCurrency } from '@fayz-ai/core';
+import { createPluginContext, fayzConnectorOAuth, setScheduleBlockConfig, getScheduleBlockConfig, PluginSettingsPanel, dedup, useTenantPluginSettings, SettingsGroup, ToggleRow, SelectRow, usePluginPrefs, PersonLink, useLimitGuard, CrudFormPage, CrudDetailPage, ContactPicker, invalidateLimit } from '@fayz-ai/admin';
 import FullCalendar from '@fullcalendar/react';
 import dayGridPlugin from '@fullcalendar/daygrid';
 import timeGridPlugin from '@fullcalendar/timegrid';
@@ -10,12 +10,172 @@ import resourceTimeGridPlugin from '@fullcalendar/resource-timegrid';
 import interactionPlugin from '@fullcalendar/interaction';
 import listPlugin from '@fullcalendar/list';
 import ptBrLocale from '@fullcalendar/core/locales/pt-br';
-import { CalendarCog, CalendarPlus, RefreshCw, History, CheckCircle2, AlertCircle, Loader2, X, Plus, ChevronDown, ChevronLeft, ChevronRight, Settings, Pencil, Trash2, Clock, User, MapPin, FileText, AlertTriangle, Check, DollarSign, HandCoins, Ban, CheckSquare, Calendar, Briefcase, CircleDot, FileCheck, ArrowRightLeft, CreditCard, QrCode, Banknote, ExternalLink } from 'lucide-react';
-import { jsx, jsxs, Fragment } from 'react/jsx-runtime';
+import { Loader2, AlertCircle, RefreshCw, CalendarPlus, X, CheckCircle2, Plus, ChevronDown, ChevronLeft, ChevronRight, Settings, Pencil, Trash2, Clock, User, MapPin, FileText, AlertTriangle, Check, DollarSign, HandCoins, Ban, CheckSquare, Calendar, Briefcase, CircleDot, FileCheck, ArrowRightLeft, CreditCard, QrCode, Banknote, ExternalLink } from 'lucide-react';
+import { jsxs, jsx, Fragment } from 'react/jsx-runtime';
 import { createPortal } from 'react-dom';
-import { Button, toast, Checkbox, Badge, Select, SelectTrigger, SelectValue, SelectContent, SelectItem, ConfirmDialog, Modal, ModalContent, ModalTitle, SearchCombobox, cn, TooltipProvider, Tooltip, TooltipTrigger, TooltipContent } from '@fayz-ai/ui';
+import { toast, Button, Checkbox, Badge, Select, SelectTrigger, SelectValue, SelectContent, SelectItem, ConfirmDialog, Modal, ModalContent, ModalTitle, SearchCombobox, cn, TooltipProvider, Tooltip, TooltipTrigger, TooltipContent } from '@fayz-ai/ui';
 import { createStore } from 'zustand/vanilla';
 
+// src/lib/message-events.ts
+var BOOKING_FIELDS = [
+  { name: "customer_name", label: "Cliente", type: "string", example: "Maria Silva" },
+  { name: "service_name", label: "Servi\xE7o", type: "string", example: "Corte + Escova" },
+  { name: "professional_name", label: "Profissional", type: "string", example: "Camila Duarte" },
+  { name: "booking_date", label: "Data", type: "date", example: "12/08/2026" },
+  { name: "booking_time", label: "Hor\xE1rio", type: "string", example: "14:30" },
+  { name: "location_name", label: "Local", type: "string", example: "Unidade Centro" },
+  { name: "business_name", label: "Seu neg\xF3cio", type: "string", example: "Seu Neg\xF3cio" }
+];
+function buildAgendaDomainEvents() {
+  return [
+    {
+      name: "agenda.booking_created",
+      title: "Agendamento criado",
+      icon: "CalendarPlus",
+      audit: true,
+      description: "Um hor\xE1rio foi marcado",
+      trigger: "Quando o agendamento \xE9 criado (recep\xE7\xE3o, site ou app)",
+      fields: BOOKING_FIELDS
+    },
+    {
+      name: "agenda.booking_reminder",
+      title: "Lembrete de hor\xE1rio",
+      icon: "BellRing",
+      audit: false,
+      description: "V\xE9spera do atendimento",
+      trigger: "No dia anterior ao hor\xE1rio marcado",
+      fields: BOOKING_FIELDS
+    },
+    {
+      name: "agenda.booking_rescheduled",
+      title: "Hor\xE1rio remarcado",
+      icon: "CalendarClock",
+      audit: true,
+      description: "O atendimento mudou de dia ou de hora",
+      trigger: "Quando a data ou o hor\xE1rio do agendamento muda",
+      fields: BOOKING_FIELDS
+    },
+    {
+      name: "agenda.booking_cancelled",
+      title: "Agendamento cancelado",
+      icon: "CalendarX",
+      audit: true,
+      description: "O hor\xE1rio foi desmarcado",
+      trigger: "Quando o agendamento \xE9 cancelado",
+      fields: BOOKING_FIELDS
+    },
+    {
+      name: "agenda.booking_completed",
+      title: "Atendimento conclu\xEDdo",
+      icon: "CalendarCheck",
+      audit: true,
+      description: "O atendimento aconteceu",
+      trigger: "Quando o agendamento \xE9 marcado como conclu\xEDdo",
+      fields: BOOKING_FIELDS
+    },
+    {
+      name: "agenda.booking_no_show",
+      title: "Cliente n\xE3o compareceu",
+      icon: "UserX",
+      audit: true,
+      description: "O hor\xE1rio foi perdido",
+      trigger: "Quando o agendamento \xE9 marcado como falta",
+      fields: BOOKING_FIELDS
+    }
+  ];
+}
+function buildAgendaMessageDefaults() {
+  return [
+    {
+      eventKey: "agenda.booking_created",
+      kind: "transactional",
+      // WhatsApp na frente em toda a agenda: confirmação de horário é lida no
+      // celular, e no Brasil é lá que a cliente responde.
+      channels: ["whatsapp", "email"],
+      defaults: {
+        whatsapp: {
+          body: "Oi {{customer_name}}! Seu hor\xE1rio est\xE1 marcado \u2705\n\n*{{service_name}}*\n{{booking_date}} \xE0s {{booking_time}}\ncom {{professional_name}}\n\nQualquer coisa \xE9 s\xF3 chamar aqui. \u2014 {{business_name}}"
+        },
+        email: {
+          subject: "Hor\xE1rio confirmado \u2014 {{booking_date}} \xE0s {{booking_time}}",
+          body: "Ol\xE1 {{customer_name}},\n\nSeu hor\xE1rio est\xE1 confirmado:\n\n{{service_name}}\n{{booking_date}} \xE0s {{booking_time}}\ncom {{professional_name}}\n{{location_name}}\n\nAt\xE9 l\xE1!\n{{business_name}}"
+        }
+      },
+      // Confirmar por e-mail é o mínimo que se espera de quem acabou de marcar
+      // um horário — nasce ligado. O WhatsApp custa por mensagem e exige número
+      // aprovado; ligá-lo sozinho gastaria o dinheiro de alguém sem ser pedido.
+      defaultEnabled: { email: true }
+    },
+    {
+      eventKey: "agenda.booking_reminder",
+      kind: "transactional",
+      channels: ["whatsapp", "email"],
+      defaults: {
+        whatsapp: {
+          body: "Oi {{customer_name}}! Passando para lembrar do seu hor\xE1rio amanh\xE3 \u{1F487}\n\n*{{service_name}}*\n{{booking_date}} \xE0s {{booking_time}}\ncom {{professional_name}}\n\nConsegue vir? Se precisar remarcar, me avisa por aqui. \u2014 {{business_name}}"
+        },
+        email: {
+          subject: "Lembrete: seu hor\xE1rio \xE9 amanh\xE3, {{booking_time}}",
+          body: "Ol\xE1 {{customer_name}},\n\nSeu hor\xE1rio \xE9 amanh\xE3:\n\n{{service_name}}\n{{booking_date}} \xE0s {{booking_time}}\ncom {{professional_name}}\n{{location_name}}\n\nSe precisar remarcar, \xE9 s\xF3 responder este e-mail.\n\n{{business_name}}"
+        }
+      },
+      defaultEnabled: { email: true }
+    },
+    {
+      eventKey: "agenda.booking_rescheduled",
+      kind: "transactional",
+      channels: ["whatsapp", "email"],
+      defaults: {
+        whatsapp: {
+          body: "Oi {{customer_name}}! Seu hor\xE1rio foi remarcado \u{1F5D3}\n\n*{{service_name}}*\nAgora: {{booking_date}} \xE0s {{booking_time}}\ncom {{professional_name}}\n\n\u2014 {{business_name}}"
+        },
+        email: {
+          subject: "Seu hor\xE1rio mudou para {{booking_date}}, {{booking_time}}",
+          body: "Ol\xE1 {{customer_name}},\n\nSeu hor\xE1rio foi remarcado:\n\n{{service_name}}\n{{booking_date}} \xE0s {{booking_time}}\ncom {{professional_name}}\n\n{{business_name}}"
+        }
+      },
+      defaultEnabled: { email: true }
+    },
+    {
+      eventKey: "agenda.booking_cancelled",
+      kind: "transactional",
+      channels: ["whatsapp", "email"],
+      defaults: {
+        whatsapp: {
+          body: "Oi {{customer_name}}, seu hor\xE1rio de {{booking_date}} \xE0s {{booking_time}} foi cancelado.\n\nQuer que eu veja outra data para voc\xEA? \u2014 {{business_name}}"
+        },
+        email: {
+          subject: "Hor\xE1rio de {{booking_date}} cancelado",
+          body: "Ol\xE1 {{customer_name}},\n\nSeu hor\xE1rio de {{booking_date}} \xE0s {{booking_time}} foi cancelado.\n\nSe quiser remarcar, \xE9 s\xF3 responder este e-mail.\n\n{{business_name}}"
+        }
+      },
+      defaultEnabled: { email: true }
+    },
+    {
+      eventKey: "agenda.booking_completed",
+      kind: "marketing",
+      // Pedir opinião é iniciativa do negócio, não resposta a um ato da
+      // pessoa — e é por isso que nasce desligado.
+      channels: ["whatsapp"],
+      defaults: {
+        whatsapp: {
+          body: "Oi {{customer_name}}! Foi \xF3timo te atender hoje \u{1F49B}\n\nComo foi a experi\xEAncia com {{professional_name}}? Sua opini\xE3o ajuda demais.\n\n\u2014 {{business_name}}"
+        }
+      }
+    },
+    {
+      eventKey: "agenda.booking_no_show",
+      kind: "transactional",
+      channels: ["whatsapp"],
+      defaults: {
+        whatsapp: {
+          body: "Oi {{customer_name}}, senti sua falta no hor\xE1rio de {{booking_date}} \u{1F614}\n\nAconteceu alguma coisa? Se quiser, j\xE1 deixo outro hor\xE1rio separado para voc\xEA. \u2014 {{business_name}}"
+        }
+      }
+    }
+  ];
+}
+
 // src/config.ts
 var DEFAULT_LABELS = {
   pageTitle: "Agenda",
@@ -140,7 +300,7 @@ var useAgendaConfig = ctx.useConfig;
 var useAgendaProvider = ctx.useProvider;
 var useAgendaStore = ctx.useStore;
 
-// src/calendar-styles.ts
+// src/styles/calendar-styles.ts
 var STYLE_ID = "saas-agenda-calendar-styles";
 var css = (
   /* css */
@@ -1557,8 +1717,7 @@ function AppointmentModal({ open, mode, bookingId, prefill, initialTab, external
                   clearable: !isPaidBooking,
                   variant: "inline",
                   placeholder: t2("agenda.appointment.searchClient"),
-                  createLabel: t2("agenda.appointment.newClient"),
-                  hint: /* @__PURE__ */ jsx("p", { className: "text-[11px] text-warning", children: t2("agenda.appointment.selectClientHint") })
+                  createLabel: t2("agenda.appointment.newClient")
                 }
               ) })
             ] }),
@@ -2261,12 +2420,17 @@ function AgendaMobileList({ bookings, statusColors, currencyCode, onSelect }) {
     }) })
   ] }, g.key)) });
 }
-function bookingToEvent(booking, statusColors) {
+
+// src/lib/calendar-events.ts
+function bookingToEvent(booking, statusColors, visibleResourceIds = []) {
   const color = statusColors[booking.status] ?? "#6b7280";
-  const serviceNames = booking.services?.map((s) => s.name).join(", ") ?? "";
+  const serviceNames = booking.services?.map((service) => service.name).join(", ") ?? "";
   return {
     id: booking.id,
-    resourceId: booking.professionalId ?? void 0,
+    // A tenant-wide block (an imported whole-agenda Google event, for example)
+    // has no assignee. Availability treats it as busy for every professional, so
+    // resource views must render it in every visible lane instead of dropping it.
+    ...booking.professionalId ? { resourceId: booking.professionalId } : visibleResourceIds.length > 0 ? { resourceIds: visibleResourceIds } : {},
     title: booking.clientName ?? "Unknown",
     start: booking.startsAt,
     end: booking.endsAt ?? void 0,
@@ -2395,6 +2559,8 @@ var PLAIN_VIEW_OPTIONS = [
   { key: "listMonth", labelKey: "agenda.calendar.viewList" }
 ];
 var MOBILE_LIST_VIEW = "__mobileList__";
+var AGENDA_POLL_INTERVAL_MS = 3e4;
+var AGENDA_REALTIME_DEBOUNCE_MS = 300;
 function viewForNoResources(view) {
   return view.startsWith("resource") ? "dayGridMonth" : view;
 }
@@ -2417,6 +2583,7 @@ function useIsMobile() {
 function CalendarView() {
   injectCalendarStyles();
   const config = useAgendaConfig();
+  const provider2 = useAgendaProvider();
   const t2 = useTranslation();
   const currentLocale = getCurrentLocale();
   const fcLocale = currentLocale === "pt-BR" ? ptBrLocale : void 0;
@@ -2515,9 +2682,9 @@ function CalendarView() {
     end.setDate(end.getDate() + 91);
     fetchBookings({ start: start.toISOString(), end: end.toISOString() });
   }, [isMobile, fetchBookings]);
-  useDataChanged({}, () => {
+  const refreshVisibleBookings = useCallback(() => {
     if (visibleRange) {
-      fetchBookings(visibleRange);
+      void fetchBookings(visibleRange);
       return;
     }
     const start = /* @__PURE__ */ new Date();
@@ -2525,8 +2692,38 @@ function CalendarView() {
     start.setDate(start.getDate() - 1);
     const end = new Date(start);
     end.setDate(end.getDate() + 91);
-    fetchBookings({ start: start.toISOString(), end: end.toISOString() });
+    void fetchBookings({ start: start.toISOString(), end: end.toISOString() });
   }, [visibleRange, fetchBookings]);
+  useDataChanged({}, refreshVisibleBookings, [refreshVisibleBookings]);
+  useEffect(() => {
+    if (typeof window === "undefined" || typeof document === "undefined") return;
+    let refreshTimer;
+    let unsubscribe;
+    const scheduleRefresh = (delay = 0) => {
+      if (document.visibilityState === "hidden") return;
+      if (refreshTimer) clearTimeout(refreshTimer);
+      refreshTimer = setTimeout(refreshVisibleBookings, delay);
+    };
+    try {
+      unsubscribe = provider2.subscribeToBookingChanges?.(() => scheduleRefresh(AGENDA_REALTIME_DEBOUNCE_MS));
+    } catch (error) {
+      console.warn("[agenda] Realtime unavailable; using the polling fallback.", error);
+    }
+    const pollTimer = window.setInterval(() => scheduleRefresh(), AGENDA_POLL_INTERVAL_MS);
+    const onVisibilityChange = () => {
+      if (document.visibilityState === "visible") scheduleRefresh();
+    };
+    const onFocus = () => scheduleRefresh();
+    document.addEventListener("visibilitychange", onVisibilityChange);
+    window.addEventListener("focus", onFocus);
+    return () => {
+      if (refreshTimer) clearTimeout(refreshTimer);
+      window.clearInterval(pollTimer);
+      document.removeEventListener("visibilitychange", onVisibilityChange);
+      window.removeEventListener("focus", onFocus);
+      unsubscribe?.();
+    };
+  }, [provider2, refreshVisibleBookings]);
   const resources = useMemo(() => {
     const filtered = selectedProfIds.length > 0 ? professionals.filter((p) => selectedProfIds.includes(p.id)) : professionals;
     return filtered.map((p) => ({
@@ -2535,7 +2732,11 @@ function CalendarView() {
       extendedProps: { avatarUrl: p.avatarUrl, locationName: p.locationName }
     }));
   }, [professionals, selectedProfIds]);
-  const bookingEvents = useMemo(() => bookings.map((b) => bookingToEvent(b, statusColors)), [bookings, statusColors]);
+  const visibleResourceIds = useMemo(() => resources.map((resource) => resource.id), [resources]);
+  const bookingEvents = useMemo(
+    () => bookings.map((b) => bookingToEvent(b, statusColors, visibleResourceIds)),
+    [bookings, statusColors, visibleResourceIds]
+  );
   const allLocations = useMemo(() => {
     const map = /* @__PURE__ */ new Map();
     for (const loc of config.locations) map.set(loc.id, loc.name);
@@ -3305,9 +3506,19 @@ async function getCanonicalBookingById(core, id) {
   const [booking] = await hydrateCanonicalBookings(core, [data]);
   return booking ?? null;
 }
+var bookingChangesChannelSequence = 0;
 function createSupabaseAgendaProvider(providerOptions) {
   const professionalKind = providerOptions?.professionalKind ?? "staff";
   return {
+    subscribeToBookingChanges(onChange) {
+      const { core } = getClients();
+      const tenantId = getTenantId() ?? "active";
+      const channelName = `agenda:appointments:${tenantId}:${++bookingChangesChannelSequence}`;
+      const channel = core.channel(channelName).on("postgres_changes", { event: "*", schema: "public", table: "appointments" }, onChange).subscribe();
+      return () => {
+        void core.removeChannel(channel);
+      };
+    },
     // v_appointments is in public schema (PostgREST default)
     async getBookings(query) {
       const { core, pub } = getClients();
@@ -3620,6 +3831,33 @@ function createSupabaseAgendaProvider(providerOptions) {
     }
   };
 }
+var STATUS_EVENT = {
+  cancelled: "agenda.booking_cancelled",
+  completed: "agenda.booking_completed",
+  no_show: "agenda.booking_no_show"
+};
+function bookingStatusEventKey(status) {
+  return STATUS_EVENT[status];
+}
+function bookingPayload(booking) {
+  const starts = new Date(booking.startsAt);
+  return {
+    customer_name: booking.clientName ?? "",
+    service_name: (booking.services ?? []).map((s) => s.name).join(" + "),
+    professional_name: booking.professionalName ?? "",
+    booking_date: starts.toLocaleDateString("pt-BR"),
+    booking_time: starts.toLocaleTimeString("pt-BR", { hour: "2-digit", minute: "2-digit" }),
+    location_name: booking.locationName ?? ""
+  };
+}
+function emitBookingEvent(key, booking) {
+  emitDomainEvent(key, bookingPayload(booking), {
+    tenantId: booking.tenantId || getAgendaTenantId() || getActiveTenantId() || null,
+    subject: { type: "booking", id: booking.id }
+  });
+}
+
+// src/store.ts
 function getCurrentBookingQuery(state, dateRange = state.dateRange) {
   return {
     dateRange,
@@ -3705,6 +3943,7 @@ function createAgendaStore(provider2, financialBridge) {
     async createBooking(input) {
       try {
         const booking = await provider2.createBooking(input);
+        emitBookingEvent("agenda.booking_created", booking);
         const state = get();
         if (state.dateRange.start && state.dateRange.end) {
           const bookings = await provider2.getBookings(getCurrentBookingQuery(state));
@@ -3720,7 +3959,14 @@ function createAgendaStore(provider2, financialBridge) {
     },
     async updateBooking(id, data) {
       try {
+        const prev = get().bookings.find((b) => b.id === id);
         const booking = await provider2.updateBooking(id, data);
+        const statusKey = prev && booking.status !== prev.status ? bookingStatusEventKey(booking.status) : void 0;
+        if (statusKey) {
+          emitBookingEvent(statusKey, booking);
+        } else if (prev && new Date(booking.startsAt).getTime() !== new Date(prev.startsAt).getTime()) {
+          emitBookingEvent("agenda.booking_rescheduled", booking);
+        }
         const state = get();
         if (state.dateRange.start && state.dateRange.end) {
           const bookings = await provider2.getBookings(getCurrentBookingQuery(state));
@@ -3751,9 +3997,12 @@ function createAgendaStore(provider2, financialBridge) {
     },
     async updateBookingStatus(id, status) {
       const prev = get().bookings;
+      const prevStatus = prev.find((b) => b.id === id)?.status;
       set({ bookings: prev.map((b) => b.id === id ? { ...b, status } : b) });
       try {
-        await provider2.updateBookingStatus(id, status);
+        const updated = await provider2.updateBookingStatus(id, status);
+        const key = prevStatus !== status ? bookingStatusEventKey(status) : void 0;
+        if (key) emitBookingEvent(key, updated);
         const state = get();
         if (state.dateRange.start && state.dateRange.end) {
           const bookings = await provider2.getBookings(getCurrentBookingQuery(state));
@@ -3783,11 +4032,12 @@ function createAgendaStore(provider2, financialBridge) {
             throw new Error("Time conflict");
           }
         }
-        await provider2.updateBooking(id, {
+        const updated = await provider2.updateBooking(id, {
           startsAt: newStart,
           endsAt: newEnd,
           ...newProfessionalId && { professionalId: newProfessionalId }
         });
+        emitBookingEvent("agenda.booking_rescheduled", updated);
         const state = get();
         if (state.dateRange.start && state.dateRange.end) {
           const bookings = await provider2.getBookings(getCurrentBookingQuery(state));
@@ -3827,7 +4077,7 @@ function createAgendaStore(provider2, financialBridge) {
   }));
 }
 
-// src/registries.ts
+// src/data/registries.ts
 var holidayEntity = {
   name: "Holiday",
   namePlural: "Holidays",
@@ -3960,7 +4210,6 @@ var en = {
   "agenda.appointment.searchService": "Search service to add...",
   "agenda.appointment.selectLocation": "Select location...",
   "agenda.appointment.selectProfessional": "Select professional...",
-  "agenda.appointment.selectClientHint": "Select the client from the list or use New client to enable saving.",
   "agenda.appointment.services": "Services",
   "agenda.appointment.status": "Status",
   "agenda.appointment.to": "to",
@@ -4181,7 +4430,6 @@ var ptBR = {
   "agenda.appointment.searchService": "Buscar servi\xE7o para adicionar...",
   "agenda.appointment.selectLocation": "Selecionar local...",
   "agenda.appointment.selectProfessional": "Selecionar profissional...",
-  "agenda.appointment.selectClientHint": "Selecione o cliente na lista ou use Novo cliente para habilitar o salvamento.",
   "agenda.appointment.services": "Servi\xE7os",
   "agenda.appointment.status": "Status",
   "agenda.appointment.to": "at\xE9",
@@ -4935,12 +5183,20 @@ function channelRowToChannel(r) {
   };
 }
 
+// src/integrations/google-calendar/credentials.ts
+var CONNECTION_COLUMNS = "id, provider, calendar_id, active, last_sync_at";
+function isIntegrationActive(row) {
+  return !!row && row.active !== false;
+}
+function disconnectPatch() {
+  return { active: false, updated_at: (/* @__PURE__ */ new Date()).toISOString() };
+}
+
 // src/integrations/google-calendar/data/tables.ts
 var GCAL_TABLES = {
   integrations: "plg_calendar_integrations",
   channels: "plg_calendar_channels",
-  syncLog: "plg_calendar_sync_log"
-};
+  syncLog: "plg_calendar_sync_log"};
 
 // src/integrations/google-calendar/data/supabase.ts
 var FUNCTION = "google-calendar-sync";
@@ -4949,37 +5205,57 @@ function sb() {
   if (!supabase) throw new Error("Supabase not initialized");
   return supabase;
 }
+async function invoke(body) {
+  const tenantId = getActiveTenantId();
+  const runtimeToken = await connectorRuntimeToken({ tenantId });
+  const { data, error } = await sb().functions.invoke(FUNCTION, {
+    body: { ...body, tenantId },
+    headers: { [CONNECTOR_RUNTIME_TOKEN_HEADER]: runtimeToken }
+  });
+  if (error) throw new Error(error.message);
+  return data;
+}
 function createGoogleCalendarProvider() {
   return {
     async getIntegration() {
-      const { data } = await sb().from(GCAL_TABLES.integrations).select("*").eq("provider", "google").limit(1).maybeSingle();
+      const { data } = await sb().from(GCAL_TABLES.integrations).select(CONNECTION_COLUMNS).eq("provider", "google").limit(1).maybeSingle();
       if (!data) return null;
       return {
         id: data.id,
         provider: data.provider,
         calendarId: data.calendar_id ?? "primary",
-        active: data.active ?? true,
-        connected: !!data.oauth_refresh_token,
+        active: isIntegrationActive(data),
+        // The sync state row existing is not the same as the clinic having
+        // authorized Google — `plg_connections` owns that answer now, and the
+        // connector asks it through the connection store.
+        connected: isIntegrationActive(data),
         lastSyncAt: data.last_sync_at ?? void 0
       };
     },
-    async getConnectUrl(redirectTo) {
-      const { data, error } = await sb().functions.invoke(FUNCTION, {
-        body: { action: "oauth_start", tenantId: getActiveTenantId(), redirectTo: redirectTo ?? window.location.href }
-      });
+    async ensureIntegration() {
+      const { error } = await sb().from(GCAL_TABLES.integrations).upsert(
+        {
+          tenant_id: getActiveTenantId(),
+          provider: "google",
+          active: true,
+          updated_at: (/* @__PURE__ */ new Date()).toISOString()
+        },
+        { onConflict: "tenant_id,provider" }
+      );
       if (error) throw new Error(error.message);
-      return data.url;
     },
     async setCalendar(calendarId) {
       await sb().from(GCAL_TABLES.integrations).update({ calendar_id: calendarId, updated_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("provider", "google");
     },
     async disconnect() {
-      await sb().from(GCAL_TABLES.integrations).update({ active: false, oauth_refresh_token: null, oauth_access_token: null }).eq("provider", "google");
+      await invoke({ action: "disconnect" });
+      await sb().from(GCAL_TABLES.integrations).update(disconnectPatch()).eq("provider", "google");
     },
     async syncNow() {
-      const { data, error } = await sb().functions.invoke(FUNCTION, { body: { action: "pull_events", tenantId: getActiveTenantId(), trigger: "manual" } });
-      if (error) throw new Error(error.message);
-      return data;
+      return invoke({
+        action: "pull_events",
+        trigger: "manual"
+      });
     },
     async getSyncLog() {
       const { data } = await sb().from(GCAL_TABLES.syncLog).select("*").order("created_at", { ascending: false }).limit(20);
@@ -4995,9 +5271,8 @@ function createGoogleCalendarProvider() {
       }));
     },
     async listGoogleCalendars() {
-      const { data, error } = await sb().functions.invoke(FUNCTION, { body: { action: "list_calendars", tenantId: getActiveTenantId() } });
-      if (error) throw new Error(error.message);
-      return data.calendars ?? [];
+      const result = await invoke({ action: "list_calendars" });
+      return result.calendars ?? [];
     },
     async listChannels() {
       const { data } = await sb().from(GCAL_TABLES.channels).select("*").order("created_at", { ascending: true });
@@ -5032,21 +5307,86 @@ function createGoogleCalendarProvider() {
       if (error) throw new Error(error.message);
     },
     async listExternalEvents(params) {
-      const { data, error } = await sb().functions.invoke(FUNCTION, {
-        body: { action: "list_external_events", tenantId: getActiveTenantId(), channelId: params?.channelId, timeMin: params?.timeMin }
+      const result = await invoke({
+        action: "list_external_events",
+        channelId: params?.channelId,
+        timeMin: params?.timeMin
       });
-      if (error) throw new Error(error.message);
-      return data.events ?? [];
+      return result.events ?? [];
     },
     async importEvents(items) {
-      const { data, error } = await sb().functions.invoke(FUNCTION, {
-        body: { action: "import_events", tenantId: getActiveTenantId(), items }
-      });
-      if (error) throw new Error(error.message);
-      return data;
+      return invoke({ action: "import_events", items });
+    }
+  };
+}
+
+// src/integrations/google-calendar/health.ts
+function deriveGoogleCalendarHealth(input) {
+  const now = input.now ?? Date.now();
+  const staleAfterMs = input.staleAfterMs ?? 45 * 6e4;
+  const renewBeforeMs = input.renewBeforeMs ?? 24 * 60 * 6e4;
+  const issues = [];
+  const latest = input.logs[0];
+  if (latest && latest.status !== "success" && latest.status !== "skipped") {
+    issues.push({ code: "sync_error", detail: latest.error });
+  }
+  if (!input.lastSyncAt) {
+    issues.push({ code: "sync_missing" });
+  } else {
+    const lastSyncMs = new Date(input.lastSyncAt).getTime();
+    if (!Number.isFinite(lastSyncMs) || lastSyncMs < now - staleAfterMs) {
+      issues.push({ code: "sync_stale", detail: input.lastSyncAt });
+    }
+  }
+  const inbound = input.channels.filter(
+    (channel) => channel.isActive && (channel.direction === "inbound" || channel.direction === "bidirectional")
+  );
+  if (inbound.length === 0) issues.push({ code: "inbound_channel_missing" });
+  for (const channel of inbound) {
+    if (!channel.channelId || !channel.resourceId || !channel.channelExpiresAt) {
+      issues.push({ code: "watch_missing", detail: channel.summary ?? channel.googleCalendarId });
+      continue;
+    }
+    const expiresAt = new Date(channel.channelExpiresAt).getTime();
+    if (!Number.isFinite(expiresAt) || expiresAt <= now + renewBeforeMs) {
+      issues.push({ code: "watch_expiring", detail: channel.summary ?? channel.googleCalendarId });
     }
+  }
+  const localTimeZone2 = input.localTimeZone;
+  const mismatchedTimeZones = [...new Set(input.calendarTimeZones ?? [])].filter(Boolean).filter((timeZone) => localTimeZone2 && timeZone !== localTimeZone2);
+  if (mismatchedTimeZones.length > 0) {
+    issues.push({ code: "timezone_mismatch", detail: mismatchedTimeZones.join(", ") });
+  }
+  return {
+    status: issues.some((issue) => issue.code === "sync_error") ? "error" : issues.length > 0 ? "attention" : "healthy",
+    issues
   };
 }
+
+// src/integrations/google-calendar/panel-data.ts
+function localTimeZone() {
+  return typeof Intl !== "undefined" ? Intl.DateTimeFormat().resolvedOptions().timeZone : void 0;
+}
+function googleCalendarHealthOf(input) {
+  if (!input.integration?.connected) return { status: "disconnected", issues: [] };
+  return deriveGoogleCalendarHealth({
+    lastSyncAt: input.integration.lastSyncAt,
+    logs: input.logs,
+    channels: input.channels,
+    localTimeZone: localTimeZone()
+  });
+}
+async function readGoogleCalendarPanel(provider2) {
+  const integration = await provider2.getIntegration().catch(() => null);
+  if (!integration?.connected) {
+    return { integration, logs: [], channels: [], health: { status: "disconnected", issues: [] } };
+  }
+  const [logs, channels] = await Promise.all([
+    provider2.getSyncLog().catch(() => []),
+    provider2.listChannels().catch(() => [])
+  ]);
+  return { integration, logs, channels, health: googleCalendarHealthOf({ integration, logs, channels }) };
+}
 function CalendarColorDot({
   color,
   className = ""
@@ -5477,123 +5817,93 @@ function ImportEventsWizard({
   ] });
 }
 var provider = createGoogleCalendarProvider();
+var GOOGLE_CALENDAR_CONNECTOR_ID = "google-calendar";
+var googleCalendarConnectionStore = () => createConnectionStore(GOOGLE_CALENDAR_CONNECTOR_ID, {
+  settingsKeys: ["calendarId"]
+});
+var HEALTH_LABELS = {
+  sync_error: "a \xFAltima sincroniza\xE7\xE3o falhou",
+  sync_missing: "nenhuma sincroniza\xE7\xE3o foi feita ainda",
+  sync_stale: "sem sincronizar h\xE1 mais de uma hora",
+  inbound_channel_missing: "nenhuma agenda do Google est\xE1 marcada para importar",
+  watch_missing: "o aviso autom\xE1tico do Google n\xE3o est\xE1 ativo",
+  watch_expiring: "o aviso autom\xE1tico do Google est\xE1 prestes a expirar",
+  timezone_mismatch: "o fuso hor\xE1rio do Google \xE9 diferente do seu"
+};
+function issueLine(issue) {
+  const label = HEALTH_LABELS[issue.code];
+  return issue.detail ? `${label} (${issue.detail})` : label;
+}
+function healthDetail(health) {
+  if (health.status === "disconnected") return void 0;
+  if (health.status === "healthy") return "Sincronizando normalmente";
+  return issueLine(health.issues[0]);
+}
+async function readHealth() {
+  return (await readGoogleCalendarPanel(provider)).health;
+}
 function inboundChannels(channels) {
   return channels.filter(
     (c) => c.isActive && (c.direction === "inbound" || c.direction === "bidirectional")
   );
 }
-function GoogleCalendarExtraPanel() {
+var TRIGGERS = ["on-write", "scheduled", "manual", "webhook"];
+function toSyncRun(entry) {
+  return {
+    connectionId: "",
+    connectorId: "google-calendar",
+    direction: entry.direction === "inbound" ? "inbound" : "outbound",
+    triggerKind: TRIGGERS.includes(entry.trigger) ? entry.trigger : "manual",
+    status: entry.status === "success" || entry.status === "partial" || entry.status === "running" ? entry.status : "error",
+    id: entry.id,
+    fetched: entry.fetched,
+    written: entry.written,
+    error: entry.error ?? null,
+    startedAt: entry.createdAt
+  };
+}
+function GoogleCalendarMapping() {
   const [connected, setConnected] = useState(false);
-  const [lastSyncAt, setLastSyncAt] = useState();
-  const [syncing, setSyncing] = useState(false);
-  const [log, setLog] = useState([]);
   const [loaded, setLoaded] = useState(false);
+  useEffect(() => {
+    let cancelled = false;
+    void provider.getIntegration().then((i) => {
+      if (!cancelled) setConnected(!!i?.connected);
+    }).catch(() => {
+    }).finally(() => {
+      if (!cancelled) setLoaded(true);
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, []);
+  if (!loaded || !connected) return null;
+  return /* @__PURE__ */ jsxs("div", { className: "space-y-2", children: [
+    /* @__PURE__ */ jsx("p", { className: "text-xs leading-relaxed text-muted-foreground", children: "Diga o que cada agenda do Google sincroniza \u2014 um profissional, um servi\xE7o, um local, ou a sua agenda inteira. Cada mudan\xE7a \xE9 salva na hora." }),
+    /* @__PURE__ */ jsx(ChannelMappingList, { provider })
+  ] });
+}
+function GoogleCalendarImport({ onClose, onRan }) {
   const [channels, setChannels] = useState([]);
-  const [showMapping, setShowMapping] = useState(false);
-  const [showWizard, setShowWizard] = useState(false);
-  async function load() {
-    const integ = await provider.getIntegration();
-    setConnected(!!integ?.connected);
-    if (integ) {
-      setLastSyncAt(integ.lastSyncAt);
-      void provider.getSyncLog().then(setLog);
-      void provider.listChannels().then((ch) => {
-        setChannels(ch);
-        if (ch.length > 0) setShowMapping(true);
-      });
-    }
-    setLoaded(true);
-  }
   useEffect(() => {
-    void load();
+    let cancelled = false;
+    void provider.listChannels().then((ch) => {
+      if (!cancelled) setChannels(ch);
+    }).catch(() => {
+    });
+    return () => {
+      cancelled = true;
+    };
   }, []);
-  if (!loaded) return null;
-  if (!connected) {
-    return /* @__PURE__ */ jsx("p", { className: "text-xs text-muted-foreground border-t pt-4", children: "Connect a Google account above to map your calendars and import events." });
-  }
-  async function handleSyncNow() {
-    setSyncing(true);
-    try {
-      const r = await provider.syncNow();
-      toast.success(`Synced \u2014 ${r.written} updated`);
-      void provider.getSyncLog().then(setLog);
-      void provider.getIntegration().then((i) => setLastSyncAt(i?.lastSyncAt));
-    } catch (e) {
-      toast.error(e?.message ?? "Sync failed");
-    } finally {
-      setSyncing(false);
+  return /* @__PURE__ */ jsx(
+    ImportEventsWizard,
+    {
+      provider,
+      channels: inboundChannels(channels),
+      onClose,
+      onImported: () => onRan?.()
     }
-  }
-  const canImport = inboundChannels(channels).length > 0;
-  return /* @__PURE__ */ jsxs("div", { className: "space-y-5 border-t pt-4", children: [
-    /* @__PURE__ */ jsxs("section", { className: "space-y-2", children: [
-      /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-2", children: [
-        /* @__PURE__ */ jsx(CalendarCog, { className: "h-4 w-4 text-muted-foreground" }),
-        /* @__PURE__ */ jsx("h4", { className: "text-sm font-semibold", children: "Calendars" })
-      ] }),
-      showMapping ? /* @__PURE__ */ jsx(ChannelMappingList, { provider, onChannelsChange: setChannels }) : /* @__PURE__ */ jsxs("div", { className: "rounded-md border border-dashed px-4 py-5 text-center space-y-2", children: [
-        /* @__PURE__ */ jsx("p", { className: "text-sm text-muted-foreground", children: "Map each Google calendar to what it syncs \u2014 a professional, service, location, or your whole agenda." }),
-        /* @__PURE__ */ jsxs(Button, { variant: "outline", size: "sm", onClick: () => setShowMapping(true), children: [
-          /* @__PURE__ */ jsx(CalendarCog, { className: "h-3.5 w-3.5" }),
-          " Configure calendars"
-        ] })
-      ] })
-    ] }),
-    showMapping && /* @__PURE__ */ jsx("section", { className: "space-y-2", children: showWizard ? /* @__PURE__ */ jsx(
-      ImportEventsWizard,
-      {
-        provider,
-        channels: inboundChannels(channels),
-        onClose: () => setShowWizard(false),
-        onImported: () => {
-          void provider.getSyncLog().then(setLog);
-          void provider.getIntegration().then((i) => setLastSyncAt(i?.lastSyncAt));
-        }
-      }
-    ) : /* @__PURE__ */ jsxs(
-      Button,
-      {
-        variant: "outline",
-        size: "sm",
-        disabled: !canImport,
-        title: canImport ? void 0 : "Enable an importing calendar first",
-        onClick: () => setShowWizard(true),
-        children: [
-          /* @__PURE__ */ jsx(CalendarPlus, { className: "h-3.5 w-3.5" }),
-          " Import future events"
-        ]
-      }
-    ) }),
-    /* @__PURE__ */ jsxs("section", { className: "space-y-2", children: [
-      /* @__PURE__ */ jsxs("div", { className: "flex flex-wrap items-center gap-3", children: [
-        /* @__PURE__ */ jsxs(Button, { variant: "outline", size: "sm", onClick: handleSyncNow, disabled: syncing, children: [
-          /* @__PURE__ */ jsx(RefreshCw, { className: `h-3.5 w-3.5 ${syncing ? "animate-spin" : ""}` }),
-          " Sync now"
-        ] }),
-        lastSyncAt && /* @__PURE__ */ jsxs("span", { className: "text-[11px] text-muted-foreground", children: [
-          "Last sync: ",
-          new Date(lastSyncAt).toLocaleString()
-        ] })
-      ] }),
-      log.length > 0 && /* @__PURE__ */ jsxs("div", { className: "space-y-2", children: [
-        /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-2", children: [
-          /* @__PURE__ */ jsx(History, { className: "h-4 w-4 text-muted-foreground" }),
-          /* @__PURE__ */ jsx("h4", { className: "text-sm font-semibold", children: "History" })
-        ] }),
-        /* @__PURE__ */ jsx("div", { className: "rounded-md border divide-y text-sm", children: log.map((r) => /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-3 px-3 py-2", children: [
-          /* @__PURE__ */ jsx("span", { className: "text-muted-foreground text-xs", children: new Date(r.createdAt).toLocaleString() }),
-          /* @__PURE__ */ jsx("span", { className: "text-[10px] uppercase tracking-wide px-1 py-px rounded bg-muted text-muted-foreground", children: r.direction }),
-          /* @__PURE__ */ jsxs("span", { className: "ml-auto text-xs", children: [
-            r.written,
-            " written / ",
-            r.fetched,
-            " fetched"
-          ] }),
-          r.status === "success" ? /* @__PURE__ */ jsx(CheckCircle2, { className: "h-3.5 w-3.5 text-success" }) : /* @__PURE__ */ jsx(AlertCircle, { className: "h-3.5 w-3.5 text-warning" })
-        ] }, r.id)) })
-      ] })
-    ] })
-  ] });
+  );
 }
 var googleCalendarConnectorDef = {
   id: "google-calendar",
@@ -5603,50 +5913,2061 @@ var googleCalendarConnectorDef = {
   icon: "Calendar",
   authKind: "oauth",
   category: "scheduling",
+  // `direction` is who reaches for whom: this app reaches Google (consent, push,
+  // pull). The data being BIDIRECTIONAL is a property of the entity, and is
+  // declared where the type allows it — see ./connector.ts, capability
+  // `booking: 'bidirectional'`.
   direction: "outbound",
   // Sync only, and deliberately: the agenda has to exist inside the app — to be
   // listed, filtered, reported on, and read when Google is unreachable. An
   // agentic plane would answer questions but leave the calendar screen empty.
   planes: ["sync"],
-  entities: ["booking"],
   docsUrl: "https://support.google.com/calendar",
+  // What it needs, grounded in what the data plane actually does. `booking` is
+  // read AND written: the pull path lands external events through the
+  // `gcal_import_event` / `gcal_apply_event_patch` RPCs (migrations/002 §
+  // "import"), which INSERT and UPDATE public.appointments, and the push path
+  // reads the appointment plus its items to compose the Google event.
+  //
+  // Marked sensitive because of what leaves the tenant, not because of the row
+  // count: the event title is "<serviços> — <nome do cliente>" and the
+  // description carries the appointment notes (./mapping.ts). Someone
+  // authorizing this is sending client names and visit notes to Google, and that
+  // is the fact the consent view exists to put in front of them.
+  permissions: [
+    {
+      kind: "data",
+      resource: "booking",
+      actions: ["read", "write"],
+      reason: "Ler os agendamentos para criar os eventos no Google, e gravar aqui os eventos que voc\xEA criar por l\xE1. Nome do cliente, servi\xE7os e observa\xE7\xF5es v\xE3o no evento.",
+      sensitive: true
+    },
+    // The three facts that change what Google should show, and only those.
+    // `booking_completed`/`booking_no_show` are left out because Google has no
+    // notion of either and the event does not move; `booking_reminder` likewise.
+    {
+      kind: "event",
+      resource: "agenda.booking_created",
+      actions: ["listen"],
+      reason: "Saber que um hor\xE1rio foi marcado, para criar o evento no Google Calendar."
+    },
+    {
+      kind: "event",
+      resource: "agenda.booking_rescheduled",
+      actions: ["listen"],
+      reason: "Saber que um hor\xE1rio mudou, para mover o evento no Google Calendar."
+    },
+    {
+      kind: "event",
+      resource: "agenda.booking_cancelled",
+      actions: ["listen"],
+      reason: "Saber que um agendamento foi cancelado, para apagar o evento do Google Calendar."
+    }
+  ],
+  // Keys copied from ../../lib/message-events.ts, which is where the agenda
+  // declares them.
+  //
+  // `agenda.booking_completed` and `agenda.booking_no_show` are left out on
+  // purpose: Google has no notion of either, and the event does not move, so
+  // waking the connector for them is a round-trip that changes nothing.
+  // `agenda.booking_reminder` is left out for the same reason — a reminder is
+  // not a change to the calendar.
+  //
+  // Deletion is missing because the agenda declares no `booking_deleted` fact;
+  // a hard delete is delivered by the trigger in migrations/004, not by an
+  // event. That asymmetry is real and is written down in ./GOOGLE-CALENDAR.md.
+  subscribesTo: [
+    "agenda.booking_created",
+    "agenda.booking_rescheduled",
+    "agenda.booking_cancelled"
+  ],
+  // These are not preferences someone chose — they are what the integration IS,
+  // so they appear only while the connection is live and disconnecting is the
+  // way out. Today the trigger in migrations/004 delivers them; when the Fayz
+  // ingress lands it takes over the same three, which is what makes that swap a
+  // configuration change instead of a rewrite.
+  managedAutomations: [
+    { eventKey: "agenda.booking_created", label: "Criar o evento no Google Calendar quando um hor\xE1rio \xE9 agendado aqui" },
+    { eventKey: "agenda.booking_rescheduled", label: "Mover o evento no Google Calendar quando o hor\xE1rio \xE9 remarcado" },
+    { eventKey: "agenda.booking_cancelled", label: "Apagar o evento do Google Calendar quando o agendamento \xE9 cancelado" }
+  ],
+  // The two moments that DO exist in code, as opposed to the three above, which
+  // are delivered by the trigger in migrations/004 rather than by an ingress.
+  // Both are sync moments and both reach `booking`, which is what `touches`
+  // says — the connector cannot name a resource it did not ask for.
+  invokedAt: [
+    {
+      key: "agenda.booking.push",
+      label: "Um hor\xE1rio \xE9 criado, remarcado ou cancelado aqui, e o evento \xE9 atualizado no Google",
+      plane: "sync",
+      trigger: "on-write",
+      touches: ["booking"]
+    },
+    {
+      key: "agenda.calendar.pull",
+      label: "O Google avisa que algo mudou por l\xE1, e os eventos s\xE3o trazidos para c\xE1",
+      plane: "sync",
+      trigger: "webhook",
+      touches: ["booking"]
+    }
+  ],
+  /**
+   * The LIST row, from the connection the hub already batched — one request for
+   * N connectors, and no calendar read at all.
+   */
+  ...connectionStatus(
+    GOOGLE_CALENDAR_CONNECTOR_ID,
+    (connection) => connection?.active ? { connected: true, plane: "sync" } : { connected: false },
+    { store: googleCalendarConnectionStore }
+  ),
+  /**
+   * The DETAIL screen, where health is worth a round-trip.
+   *
+   * Two questions, in order, and they are not the same one: `plg_connections`
+   * says whether the clinic authorized Google, and ./health.ts says whether the
+   * sync is actually working. Asking only the second is what let a connection
+   * read as "conectado" off a token timestamp; asking only the first would
+   * report a healthy connector that has not synced since Tuesday.
+   */
   async getStatus() {
-    const integ = await provider.getIntegration();
-    return { connected: !!integ?.connected };
+    try {
+      const connection = await googleCalendarConnectionStore().get();
+      if (!connection?.active) return { connected: false };
+      const health = await readHealth();
+      return {
+        connected: true,
+        plane: "sync",
+        detail: healthDetail(health),
+        issues: health.issues.map(issueLine)
+      };
+    } catch {
+      return { connected: false };
+    }
   },
-  startOAuth: (redirectTo) => provider.getConnectUrl(redirectTo),
-  disconnect: () => provider.disconnect(),
-  ExtraPanel: GoogleCalendarExtraPanel
-};
-
-// src/integrations/google-calendar/connector.ts
-var googleCalendarConnector = {
-  id: "google-calendar",
-  provider: "google",
-  pluginId: "agenda",
-  authKind: "oauth",
-  capabilities: [
+  // Consent runs on the platform: it holds the Google client pair, takes the
+  // callback and puts the grant in the vault. This pool used to do all three.
+  startOAuth: fayzConnectorOAuth(GOOGLE_CALENDAR_CONNECTOR_ID),
+  /**
+   * The other half of the consent. The platform stores the grant; the pool
+   * stores "is it on?", and with nobody writing the second the connector would
+   * answer "não conectado" to a clinic that had just authorized Google.
+   *
+   * Called with no values — the credential is not ours to see.
+   */
+  saveConnection: async () => {
+    await provider.ensureIntegration();
+    await googleCalendarConnectionStore().save({ active: true });
+  },
+  /**
+   * Three things end a connection, and only the first is this pool's:
+   *   the row flips inactive          (here)
+   *   the watches are stopped at Google and the cursors cleared (the function)
+   *   the grant is revoked            (the platform — it holds the token)
+   *
+   * The function call is best-effort on purpose: a clinic that already revoked
+   * us at Google gets a 409 from it, and refusing to disconnect over that would
+   * leave the connector on with no way to turn it off.
+   */
+  disconnect: async () => {
+    try {
+      await provider.disconnect();
+    } catch {
+    }
+    await googleCalendarConnectionStore().disconnect();
+  },
+  // Disconnecting stops the traffic; it does not undo it. Said here because the
+  // question is only ever asked next to the button.
+  disconnectNote: "Desconectar para a sincroniza\xE7\xE3o nos dois sentidos. Os agendamentos j\xE1 importados continuam aqui, e os eventos j\xE1 criados continuam no Google.",
+  async listRuns(options) {
+    try {
+      const log = await provider.getSyncLog();
+      const runs = log.map(toSyncRun);
+      return options?.limit ? runs.slice(0, options.limit) : runs;
+    } catch {
+      return [];
+    }
+  },
+  // Declared, not drawn — the same seam Bling uses. Behaviour unchanged.
+  syncActions: [
     {
-      entity: "booking",
-      direction: "bidirectional",
-      triggers: ["on-write", "scheduled", "webhook"]
+      key: "sync_now",
+      label: "Sincronizar agora",
+      direction: "inbound",
+      run: async () => {
+        const result = await provider.syncNow();
+        return `Sincronizado \u2014 ${result.written} atualizados`;
+      }
+    },
+    {
+      key: "import_events",
+      label: "Importar eventos futuros",
+      direction: "inbound",
+      // Hidden rather than disabled: nothing to bring in, and a greyed control
+      // reads as something the reader failed to do.
+      available: async () => {
+        try {
+          return inboundChannels(await provider.listChannels()).length > 0;
+        } catch {
+          return false;
+        }
+      },
+      Component: GoogleCalendarImport,
+      run: async () => {
+      }
     }
-  ]
+  ],
+  ExtraPanel: GoogleCalendarMapping
 };
 
-// src/integrations/google-calendar/index.ts
-function createGoogleCalendarPlugin() {
-  return {
-    id: "google-calendar",
-    name: "Google Calendar",
-    icon: "Calendar",
-    version: "0.1.0",
-    scope: "addon",
-    defaultEnabled: true,
-    dependencies: ["agenda"],
-    navigation: [],
-    routes: [],
-    connectors: [googleCalendarConnectorDef]
+// src/integrations/google-calendar/migrations/index.ts
+var MIGRATION_001_GOOGLE_CALENDAR = `-- ---------------------------------------------------------------------------
+-- Google Calendar integration (bidirectional) \u2014 connection + audit + triggers
+-- ---------------------------------------------------------------------------
+-- Outbound (Fayz booking \u2192 Google event) fires from a trigger on public.appointments
+-- via pg_net to the google-calendar-sync edge function (push_event). Inbound
+-- (Google \u2192 booking) runs on a pg_cron schedule (pull_events) and/or a Google
+-- watch-channel webhook. The booking\u2194event link is stored on
+-- public.appointments.metadata.googleCalendarEventId (no schema change there).
+
+-- Plugin-owned tables carry the platform \`plg_<plugin>_\` prefix (DATA-MODEL.md
+-- Ring 1). Legacy pools provisioned under the old \`calendar_*\` names are migrated
+-- by 003_plg_rename.sql; fresh installs are born with the prefixed names here.
+CREATE TABLE IF NOT EXISTS public.plg_calendar_integrations (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  provider text NOT NULL DEFAULT 'google',
+  oauth_refresh_token text,
+  oauth_access_token text,
+  token_expires_at timestamptz,
+  calendar_id text NOT NULL DEFAULT 'primary',
+  -- Incremental pull cursor + Google watch channel bookkeeping.
+  sync_token text,
+  channel_id text,
+  channel_resource_id text,
+  channel_expires_at timestamptz,
+  active boolean NOT NULL DEFAULT true,
+  last_sync_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE (tenant_id, provider)
+);
+ALTER TABLE public.plg_calendar_integrations ENABLE ROW LEVEL SECURITY;
+CREATE INDEX IF NOT EXISTS idx_plg_calendar_integrations_tenant ON public.plg_calendar_integrations(tenant_id);
+
+CREATE TABLE IF NOT EXISTS public.plg_calendar_sync_log (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  direction text NOT NULL,                 -- inbound | outbound
+  trigger text,                            -- on-write | scheduled | webhook | manual
+  status text NOT NULL DEFAULT 'success',  -- success | partial | error
+  fetched integer NOT NULL DEFAULT 0,
+  written integer NOT NULL DEFAULT 0,
+  error text,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+ALTER TABLE public.plg_calendar_sync_log ENABLE ROW LEVEL SECURITY;
+
+-- RLS: tenant isolation.
+DO $$
+DECLARE t text;
+BEGIN
+  FOR t IN SELECT unnest(ARRAY['plg_calendar_integrations','plg_calendar_sync_log'])
+  LOOP
+    EXECUTE format('GRANT SELECT, INSERT, UPDATE, DELETE ON public.%I TO authenticated', t);
+    IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname='public' AND tablename=t AND policyname=t||'_rls') THEN
+      EXECUTE format('CREATE POLICY %I ON public.%I FOR ALL TO authenticated USING (tenant_id IN (SELECT public.user_tenant_ids())) WITH CHECK (tenant_id IN (SELECT public.user_tenant_ids()))', t||'_rls', t);
+    END IF;
+  END LOOP;
+END $$;
+
+-- ---------------------------------------------------------------------------
+-- Outbound trigger: booking change \u2192 edge function (push_event).
+-- Requires pg_net + a configured function URL. Set once per project:
+--   ALTER DATABASE postgres SET app.gcal_sync_url = 'https://<ref>.functions.supabase.co/google-calendar-sync';
+--   ALTER DATABASE postgres SET app.gcal_service_key = '<service-role-key>';
+-- Safe to skip in environments without pg_net \u2014 outbound also works via the
+-- client-side withGoogleCalendarSync() decorator.
+-- ---------------------------------------------------------------------------
+CREATE OR REPLACE FUNCTION public.fn_gcal_push_booking() RETURNS trigger
+LANGUAGE plpgsql SECURITY DEFINER AS $$
+DECLARE
+  url text := current_setting('app.gcal_sync_url', true);
+  key text := current_setting('app.gcal_service_key', true);
+  rec record := COALESCE(NEW, OLD);
+  op  text := lower(TG_OP);
+BEGIN
+  IF url IS NULL OR url = '' THEN RETURN COALESCE(NEW, OLD); END IF;
+  PERFORM net.http_post(
+    url := url,
+    headers := jsonb_build_object('Content-Type', 'application/json', 'Authorization', 'Bearer ' || COALESCE(key, '')),
+    body := jsonb_build_object('action', 'push_event', 'op', op, 'bookingId', rec.id, 'tenantId', rec.tenant_id)
+  );
+  RETURN COALESCE(NEW, OLD);
+END $$;
+
+DROP TRIGGER IF EXISTS trg_gcal_push ON public.appointments;
+CREATE TRIGGER trg_gcal_push
+  AFTER INSERT OR UPDATE OR DELETE ON public.appointments
+  FOR EACH ROW EXECUTE FUNCTION public.fn_gcal_push_booking();
+
+-- Inbound schedule (optional): pull external changes every 10 minutes.
+--   SELECT cron.schedule('gcal-pull', '*/10 * * * *', $$
+--     SELECT net.http_post(
+--       url := current_setting('app.gcal_sync_url'),
+--       headers := jsonb_build_object('Content-Type','application/json','Authorization','Bearer '||current_setting('app.gcal_service_key')),
+--       body := jsonb_build_object('action','pull_events'));
+--   $$);
+`;
+var MIGRATION_002_SMART_SYNC = `-- ---------------------------------------------------------------------------
+-- Google Calendar SMART SYNC \u2014 multi-calendar de-para + loop-safe two-way sync
+-- ---------------------------------------------------------------------------
+-- Builds on 001_google_calendar.sql. Where 001 modelled a single calendar per
+-- tenant (plg_calendar_integrations, one outbound trigger, a pull template), 002
+-- makes the sync vertical-agnostic and bidirectional-safe:
+--
+--   \xA71  public.plg_calendar_channels \u2014 de-para: one Google calendar \u2192 one sync
+--                                       target (whole tenant / assignee / service
+--                                       / location), per direction + import mode
+--   \xA72  fn_gcal_push_booking (REPLACE)\u2014 loop-prevention guard + correlation id
+--   \xA73  plg_calendar_sync_log         \u2014 correlation_id + channel_id_ref columns
+--   \xA74  inbound write functions       \u2014 the ONLY path Google\u2192booking writes take
+--                                       (gcal_import_event / gcal_apply_event_patch
+--                                        / gcal_unlink_channel), SECURITY DEFINER,
+--                                       service_role-only
+--   \xA75  get_available_slots (REPLACE) \u2014 tenant-wide imported blocks now also
+--                                       remove slots for every professional
+--   \xA76  pg_cron template              \u2014 per-channel pull
+--
+-- Idempotent / re-runnable: IF NOT EXISTS, CREATE OR REPLACE, DROP \u2026 IF EXISTS.
+-- Written against the canonical public names (appointments uses starts_at/ends_at,
+-- metadata jsonb, party_id/assignee_id \u2014 see packages/db 004_archetypes.sql).
+-- ---------------------------------------------------------------------------
+
+-- ===========================================================================
+-- \xA71 \u2014 plg_calendar_channels: multi-calendar de-para (vertical-agnostic)
+--   target_kind NULL  \u2192 whole tenant agenda (agency-os): every professional
+--   target_kind 'assignee' \u2192 calendar maps to one professional (school: teacher)
+--   target_kind 'service' | 'location' \u2192 clinic-style mapping
+--   import_mode 'block'       \u2192 inbound events become opaque busy blocks
+--   import_mode 'appointment' \u2192 inbound events become real appointments
+-- ===========================================================================
+CREATE TABLE IF NOT EXISTS public.plg_calendar_channels (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  integration_id uuid NOT NULL REFERENCES public.plg_calendar_integrations(id) ON DELETE CASCADE,
+  tenant_id uuid NOT NULL,
+  google_calendar_id text NOT NULL,
+  summary text,
+  color text,
+  direction text NOT NULL DEFAULT 'bidirectional'
+    CHECK (direction IN ('inbound','outbound','bidirectional','off')),
+  target_kind text CHECK (target_kind IN ('assignee','service','location')),
+  target_id uuid,
+  import_mode text NOT NULL DEFAULT 'block'
+    CHECK (import_mode IN ('block','appointment')),
+  sync_token text,
+  channel_id text,
+  resource_id text,
+  channel_expires_at timestamptz,
+  is_active boolean NOT NULL DEFAULT true,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE (integration_id, google_calendar_id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_plg_calendar_channels_tenant      ON public.plg_calendar_channels(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_plg_calendar_channels_integration ON public.plg_calendar_channels(integration_id);
+
+ALTER TABLE public.plg_calendar_channels ENABLE ROW LEVEL SECURITY;
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.plg_calendar_channels TO authenticated;
+-- service_role bypasses RLS, but this table is born after 004's blanket grant,
+-- so grant it explicitly (the inbound functions run as definer/service_role).
+GRANT ALL ON public.plg_calendar_channels TO service_role;
+
+DROP TRIGGER IF EXISTS plg_calendar_channels_updated_at ON public.plg_calendar_channels;
+CREATE TRIGGER plg_calendar_channels_updated_at BEFORE UPDATE ON public.plg_calendar_channels
+  FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
+
+-- RLS: tenant isolation (padr\xE3o 001) + explicit service_role FOR ALL policy
+-- (matches the vigente service_role policy pattern from 001_core payment_events).
+DROP POLICY IF EXISTS plg_calendar_channels_rls ON public.plg_calendar_channels;
+CREATE POLICY plg_calendar_channels_rls ON public.plg_calendar_channels
+  FOR ALL TO authenticated
+  USING (tenant_id IN (SELECT public.user_tenant_ids()))
+  WITH CHECK (tenant_id IN (SELECT public.user_tenant_ids()));
+
+DROP POLICY IF EXISTS plg_calendar_channels_service ON public.plg_calendar_channels;
+CREATE POLICY plg_calendar_channels_service ON public.plg_calendar_channels
+  FOR ALL TO service_role USING (true) WITH CHECK (true);
+
+-- ===========================================================================
+-- \xA72 \u2014 Outbound trigger with loop-prevention + correlation id.
+-- CREATE OR REPLACE of 001's fn_gcal_push_booking. Same pg_net \u2192 edge function
+-- payload (app.gcal_sync_url / app.gcal_service_key), but now:
+--   * SKIP the push when the write itself came from the Google sync, detected by
+--     the TRANSACTION-LOCAL GUC app.booking_origin = 'google' \u2014 set by every \xA74
+--     writer via set_config(..., true) and gone when the transaction ends.
+--     This is what stops the Google\u2192booking\u2192Google\u2192\u2026 echo loop.
+--     Deliberately NOT a persistent metadata check: a sticky marker
+--     (metadata.syncOrigin) would permanently mute pushes for imported events,
+--     so a later admin edit would never reach Google. metadata.syncOrigin is
+--     kept by \xA74 as provenance only \u2014 this trigger does not read it.
+--   * carry a correlation_id so both directions can be stitched in the sync log
+--     (from GUC app.booking_correlation_id, else a fresh uuid \u2014 design ported
+--      from PR #7).
+-- ===========================================================================
+CREATE OR REPLACE FUNCTION public.fn_gcal_push_booking() RETURNS trigger
+LANGUAGE plpgsql SECURITY DEFINER AS $$
+DECLARE
+  url  text := current_setting('app.gcal_sync_url', true);
+  key  text := current_setting('app.gcal_service_key', true);
+  rec  record := COALESCE(NEW, OLD);
+  op   text := lower(TG_OP);
+  corr text := NULLIF(current_setting('app.booking_correlation_id', true), '');
+BEGIN
+  -- Loop guard: never bounce a Google-originated write back to Google.
+  -- Transaction-local GUC only (see \xA72 header for why not persistent metadata).
+  IF current_setting('app.booking_origin', true) = 'google' THEN
+    RETURN COALESCE(NEW, OLD);
+  END IF;
+
+  IF url IS NULL OR url = '' THEN RETURN COALESCE(NEW, OLD); END IF;
+
+  PERFORM net.http_post(
+    url := url,
+    headers := jsonb_build_object('Content-Type', 'application/json',
+                                  'Authorization', 'Bearer ' || COALESCE(key, '')),
+    body := jsonb_build_object(
+      'action', 'push_event',
+      'op', op,
+      'bookingId', rec.id,
+      'tenantId', rec.tenant_id,
+      'correlationId', COALESCE(corr, gen_random_uuid()::text)
+    )
+  );
+  RETURN COALESCE(NEW, OLD);
+END $$;
+
+-- Re-assert the trigger (idempotent; unchanged from 001).
+DROP TRIGGER IF EXISTS trg_gcal_push ON public.appointments;
+CREATE TRIGGER trg_gcal_push
+  AFTER INSERT OR UPDATE OR DELETE ON public.appointments
+  FOR EACH ROW EXECUTE FUNCTION public.fn_gcal_push_booking();
+
+-- ===========================================================================
+-- \xA73 \u2014 sync log: correlate the two directions + reference the source channel.
+-- ===========================================================================
+ALTER TABLE public.plg_calendar_sync_log
+  ADD COLUMN IF NOT EXISTS correlation_id uuid;
+ALTER TABLE public.plg_calendar_sync_log
+  ADD COLUMN IF NOT EXISTS channel_id_ref uuid
+    REFERENCES public.plg_calendar_channels(id) ON DELETE SET NULL;
+-- Unlinked future events seen during a pull (import-wizard candidates), so the
+-- log can show "N eventos aguardando import" without re-hitting Google.
+ALTER TABLE public.plg_calendar_sync_log
+  ADD COLUMN IF NOT EXISTS discovered integer;
+
+-- ===========================================================================
+-- \xA74 \u2014 Inbound write path (Google \u2192 booking). THE single entry point used by
+-- the edge function (scheduled pull, webhook, and the import wizard). All three
+-- functions are SECURITY DEFINER with SET search_path = public and are granted
+-- to service_role ONLY (anon/authenticated explicitly revoked) \u2014 they bypass the
+-- tenant RLS on purpose and must never be reachable from the anon/authenticated
+-- PostgREST surface. Every writer sets the TRANSACTION-LOCAL GUC
+-- app.booking_origin='google' (set_config ..., true) so \xA72's trigger suppresses
+-- the echo for THIS write only; metadata.syncOrigin is provenance, not a guard.
+-- ===========================================================================
+
+-- gcal_import_event: create (or idempotently update) a booking from a Google
+-- event, honouring the channel's import_mode + target mapping.
+--   kind        = 'block' | 'appointment'      (from channel.import_mode)
+--   assignee_id = channel.target_id when target_kind='assignee', else NULL
+--                 (NULL = tenant-wide \u2192 blocks every professional, see \xA75)
+--   location_id = channel.target_id when target_kind='location', else NULL
+--   status      = 'scheduled'
+-- No order is created \u2014 an external import is not a sale. Idempotent on
+-- (tenant_id, metadata.googleCalendarEventId): update in place if seen before.
+CREATE OR REPLACE FUNCTION public.gcal_import_event(
+  p_tenant_id   uuid,
+  p_channel_id  uuid,
+  p_event_id    text,
+  p_etag        text,
+  p_summary     text,
+  p_starts_at   timestamptz,
+  p_ends_at     timestamptz,
+  p_all_day     boolean,
+  p_description text DEFAULT NULL
+) RETURNS uuid
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_ch          record;
+  v_kind        text;
+  v_assignee    uuid;
+  v_location    uuid;
+  v_ends        timestamptz;
+  v_meta        jsonb;
+  v_existing    uuid;
+  v_appt        uuid;
+BEGIN
+  IF p_tenant_id IS NULL OR p_event_id IS NULL OR p_starts_at IS NULL THEN
+    RAISE EXCEPTION 'gcal_import_event: tenant, event id and start are required';
+  END IF;
+
+  -- Transaction-local: \xA72's trigger skips the echo for this write only.
+  PERFORM set_config('app.booking_origin', 'google', true);
+
+  -- Resolve the channel mapping (must belong to the same tenant).
+  SELECT c.import_mode, c.target_kind, c.target_id
+    INTO v_ch
+  FROM plg_calendar_channels c
+  WHERE c.id = p_channel_id AND c.tenant_id = p_tenant_id;
+  IF NOT FOUND THEN RAISE EXCEPTION 'gcal_import_event: unknown channel for tenant'; END IF;
+
+  v_kind     := CASE WHEN v_ch.import_mode = 'appointment' THEN 'appointment' ELSE 'block' END;
+  v_assignee := CASE WHEN v_ch.target_kind = 'assignee' THEN v_ch.target_id ELSE NULL END;
+  v_location := CASE WHEN v_ch.target_kind = 'location' THEN v_ch.target_id ELSE NULL END;
+
+  -- All-day events without an explicit end block the whole day so \xA75 excludes it.
+  v_ends := COALESCE(
+    p_ends_at,
+    CASE WHEN COALESCE(p_all_day, false) THEN p_starts_at + interval '1 day' ELSE p_starts_at END
+  );
+
+  v_meta := jsonb_build_object(
+    'syncOrigin', 'google',
+    'googleCalendarEventId', p_event_id,
+    'gcalEtag', p_etag,
+    'gcalChannelId', p_channel_id::text,
+    'allDay', COALESCE(p_all_day, false),
+    'title', p_summary,
+    'source', 'google_import'
+  );
+
+  -- Idempotency: has this event already been imported for the tenant?
+  SELECT b.id INTO v_existing
+  FROM appointments b
+  WHERE b.tenant_id = p_tenant_id
+    AND b.metadata->>'googleCalendarEventId' = p_event_id
+  LIMIT 1;
+
+  IF v_existing IS NOT NULL THEN
+    UPDATE appointments b
+    SET kind        = v_kind,
+        assignee_id = v_assignee,
+        location_id = v_location,
+        starts_at   = p_starts_at,
+        ends_at     = v_ends,
+        status      = 'scheduled',
+        notes       = COALESCE(p_description, p_summary),
+        metadata    = COALESCE(b.metadata, '{}'::jsonb) || v_meta,
+        updated_at  = now()
+    WHERE b.id = v_existing
+    RETURNING b.id INTO v_appt;
+  ELSE
+    INSERT INTO appointments (tenant_id, kind, assignee_id, location_id,
+                              starts_at, ends_at, status, notes, metadata)
+    VALUES (p_tenant_id, v_kind, v_assignee, v_location,
+            p_starts_at, v_ends, 'scheduled', COALESCE(p_description, p_summary), v_meta)
+    RETURNING id INTO v_appt;
+  END IF;
+
+  RETURN v_appt;
+END $$;
+
+-- gcal_apply_event_patch: apply an inbound reschedule/cancel to an already-linked
+-- booking. Located by metadata.googleCalendarEventId. Echo suppression: if the
+-- stored gcalEtag already equals the incoming etag, this is our own write coming
+-- back \u2014 skip and return NULL. Every real write re-stamps syncOrigin='google'.
+CREATE OR REPLACE FUNCTION public.gcal_apply_event_patch(
+  p_tenant_id uuid,
+  p_event_id  text,
+  p_etag      text,
+  p_starts_at timestamptz,
+  p_ends_at   timestamptz,
+  p_summary   text,
+  p_cancelled boolean
+) RETURNS uuid
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_appt      uuid;
+  v_curr_etag text;
+BEGIN
+  IF p_tenant_id IS NULL OR p_event_id IS NULL THEN
+    RAISE EXCEPTION 'gcal_apply_event_patch: tenant and event id are required';
+  END IF;
+
+  -- Transaction-local: \xA72's trigger skips the echo for this write only.
+  PERFORM set_config('app.booking_origin', 'google', true);
+
+  SELECT b.id, b.metadata->>'gcalEtag'
+    INTO v_appt, v_curr_etag
+  FROM appointments b
+  WHERE b.tenant_id = p_tenant_id
+    AND b.metadata->>'googleCalendarEventId' = p_event_id
+  LIMIT 1;
+
+  IF v_appt IS NULL THEN RETURN NULL; END IF;                 -- not linked here
+  IF p_etag IS NOT NULL AND p_etag = v_curr_etag THEN
+    RETURN NULL;                                              -- echo: nothing changed
+  END IF;
+
+  IF COALESCE(p_cancelled, false) THEN
+    UPDATE appointments b
+    SET status     = 'cancelled',
+        metadata   = COALESCE(b.metadata, '{}'::jsonb)
+                     || jsonb_build_object('syncOrigin', 'google', 'gcalEtag', p_etag),
+        updated_at = now()
+    WHERE b.id = v_appt;
+  ELSE
+    UPDATE appointments b
+    SET starts_at  = COALESCE(p_starts_at, b.starts_at),
+        ends_at    = COALESCE(p_ends_at, b.ends_at),
+        notes      = COALESCE(p_summary, b.notes),
+        metadata   = COALESCE(b.metadata, '{}'::jsonb)
+                     || jsonb_build_object('syncOrigin', 'google',
+                                           'gcalEtag', p_etag,
+                                           'title', COALESCE(p_summary, b.metadata->>'title')),
+        updated_at = now()
+    WHERE b.id = v_appt;
+  END IF;
+
+  RETURN v_appt;
+END $$;
+
+-- gcal_stamp_outbound: after the edge function creates the Google event for an
+-- outbound push, it stamps the fresh event id/etag back onto the appointment.
+-- Bookkeeping only \u2014 must not re-fire \xA72's trigger, hence the GUC. Does NOT set
+-- metadata.syncOrigin (the booking's provenance is still the app/site).
+CREATE OR REPLACE FUNCTION public.gcal_stamp_outbound(
+  p_tenant_id   uuid,
+  p_booking_id  uuid,
+  p_event_id    text,
+  p_etag        text DEFAULT NULL,
+  p_calendar_id text DEFAULT NULL
+) RETURNS uuid
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_id uuid;
+BEGIN
+  IF p_tenant_id IS NULL OR p_booking_id IS NULL OR p_event_id IS NULL THEN
+    RAISE EXCEPTION 'gcal_stamp_outbound: tenant, booking and event id are required';
+  END IF;
+
+  -- Transaction-local: \xA72's trigger skips the echo for this write only.
+  PERFORM set_config('app.booking_origin', 'google', true);
+
+  UPDATE appointments b
+  SET metadata   = COALESCE(b.metadata, '{}'::jsonb)
+                   || jsonb_build_object('googleCalendarEventId', p_event_id,
+                                         'gcalEtag', p_etag,
+                                         'gcalSyncedAt', now())
+                   || CASE WHEN p_calendar_id IS NULL THEN '{}'::jsonb
+                           ELSE jsonb_build_object('gcalCalendarId', p_calendar_id) END,
+      updated_at = now()
+  WHERE b.id = p_booking_id AND b.tenant_id = p_tenant_id
+  RETURNING b.id INTO v_id;
+  RETURN v_id;
+END $$;
+
+-- gcal_unlink_channel: forget the incremental cursor + Google watch bookkeeping
+-- for a channel (used on disconnect / re-watch). Leaves the mapping row in place.
+CREATE OR REPLACE FUNCTION public.gcal_unlink_channel(
+  p_channel_id uuid
+) RETURNS uuid
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_id uuid;
+BEGIN
+  UPDATE plg_calendar_channels c
+  SET sync_token         = NULL,
+      channel_id         = NULL,
+      resource_id        = NULL,
+      channel_expires_at = NULL,
+      updated_at         = now()
+  WHERE c.id = p_channel_id
+  RETURNING c.id INTO v_id;
+  RETURN v_id;
+END $$;
+
+-- Lock the inbound writers to service_role only.
+DO $$
+DECLARE fn text;
+BEGIN
+  FOR fn IN SELECT unnest(ARRAY[
+    'public.gcal_import_event(uuid, uuid, text, text, text, timestamptz, timestamptz, boolean, text)',
+    'public.gcal_apply_event_patch(uuid, text, text, timestamptz, timestamptz, text, boolean)',
+    'public.gcal_stamp_outbound(uuid, uuid, text, text, text)',
+    'public.gcal_unlink_channel(uuid)'
+  ])
+  LOOP
+    EXECUTE format('REVOKE ALL ON FUNCTION %s FROM public, anon, authenticated', fn);
+    EXECUTE format('GRANT EXECUTE ON FUNCTION %s TO service_role', fn);
+  END LOOP;
+END $$;
+
+-- ===========================================================================
+-- \xA75 \u2014 get_available_slots: imported Google blocks must remove availability.
+-- CREATE OR REPLACE keeping the EXACT signature (anon + admin both call it, and
+-- it is graded on the same shape as plugin-agenda/src/migrations/001_public_booking.sql).
+--
+-- Conceptual diff vs 001 \u2014 ONE condition in the overlap NOT EXISTS:
+--   before:  AND b.assignee_id = c.assignee_id
+--   after:   AND (b.assignee_id = c.assignee_id
+--                 OR (b.assignee_id IS NULL AND b.kind = 'block'))
+-- Rationale: a tenant-wide BLOCK imported from Google (target_kind NULL \u2192
+-- assignee_id IS NULL, kind 'block', see \xA74) must busy-out the slot for EVERY
+-- professional. Restricted to kind='block' so an unassigned admin appointment
+-- keeps the 001 behaviour (blocks nobody). Per-assignee rows keep matching on
+-- assignee_id.
+-- Everything else is byte-identical to 001: the status filter already covers
+-- "any non-cancelled kind" (no_show also excluded), and the p_assignee_id-NULL
+-- fan-out across staff via day_schedules is preserved untouched.
+-- ===========================================================================
+CREATE OR REPLACE FUNCTION public.get_available_slots(
+  p_tenant_id uuid,
+  p_date date,
+  p_duration_minutes integer,
+  p_assignee_id uuid DEFAULT NULL,
+  p_slot_interval integer DEFAULT 30
+) RETURNS TABLE (slot_start timestamptz, slot_end timestamptz)
+LANGUAGE plpgsql STABLE SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_tz text;
+BEGIN
+  -- tight validation: this function is anon-callable
+  IF p_duration_minutes IS NULL OR p_duration_minutes NOT BETWEEN 5 AND 480 THEN
+    RAISE EXCEPTION 'invalid duration';
+  END IF;
+  IF p_slot_interval IS NULL OR p_slot_interval NOT BETWEEN 5 AND 240 THEN
+    RAISE EXCEPTION 'invalid interval';
+  END IF;
+  IF p_date IS NULL OR p_date < current_date OR p_date > current_date + 90 THEN
+    RETURN;
+  END IF;
+
+  SELECT COALESCE(t.settings->>'timezone', 'America/Sao_Paulo') INTO v_tz
+  FROM tenants t WHERE t.id = p_tenant_id;
+  IF v_tz IS NULL THEN RETURN; END IF;  -- unknown tenant \u2192 empty, not an error
+
+  RETURN QUERY
+  WITH day_schedules AS (
+    SELECT sc.assignee_id, sc.starts_at AS win_start, sc.ends_at AS win_end
+    FROM schedules sc
+    WHERE sc.tenant_id = p_tenant_id
+      AND sc.kind = 'working_hours'
+      AND sc.is_active
+      AND (p_assignee_id IS NULL OR sc.assignee_id = p_assignee_id)
+      AND (
+        sc.specific_date = p_date
+        OR (sc.specific_date IS NULL AND sc.day_of_week = EXTRACT(dow FROM p_date)::smallint)
+      )
+  ),
+  candidate AS (
+    SELECT
+      ds.assignee_id,
+      gs                                              AS s_start,
+      gs + make_interval(mins => p_duration_minutes)  AS s_end
+    FROM day_schedules ds
+    CROSS JOIN LATERAL generate_series(
+      (p_date + ds.win_start) AT TIME ZONE v_tz,
+      ((p_date + ds.win_end) AT TIME ZONE v_tz) - make_interval(mins => p_duration_minutes),
+      make_interval(mins => p_slot_interval)
+    ) AS gs
+  )
+  SELECT DISTINCT c.s_start, c.s_end
+  FROM candidate c
+  WHERE NOT EXISTS (
+    SELECT 1 FROM appointments b
+    WHERE b.tenant_id = p_tenant_id
+      -- SMART SYNC: match this professional's own bookings OR any tenant-wide
+      -- BLOCK (assignee_id IS NULL AND kind='block', e.g. imported from Google
+      -- with a whole-tenant channel) \u2014 the latter busies the slot for every
+      -- professional. Assignee-less rows of other kinds (an unassigned admin
+      -- appointment) keep the 001 behaviour and do not block anyone.
+      AND (b.assignee_id = c.assignee_id
+           OR (b.assignee_id IS NULL AND b.kind = 'block'))
+      AND b.status NOT IN ('cancelled', 'no_show')
+      AND b.starts_at < c.s_end
+      AND COALESCE(b.ends_at, b.starts_at) > c.s_start
+  )
+  ORDER BY 1;
+END;
+$$;
+
+REVOKE ALL ON FUNCTION public.get_available_slots(uuid, date, integer, uuid, integer) FROM public;
+GRANT EXECUTE ON FUNCTION public.get_available_slots(uuid, date, integer, uuid, integer)
+  TO anon, authenticated, service_role;
+
+-- ===========================================================================
+-- \xA76 \u2014 Inbound schedule (optional) \u2014 per-channel incremental pull.
+-- Supersedes the single-calendar template in 001. Enable once per project after
+-- setting app.gcal_sync_url / app.gcal_service_key (see 001 header). The edge
+-- function fans out over active channels, using each channel's sync_token cursor:
+--
+--   SELECT cron.schedule('gcal-pull', '*/10 * * * *', $CRON$
+--     SELECT net.http_post(
+--       url := current_setting('app.gcal_sync_url'),
+--       headers := jsonb_build_object(
+--         'Content-Type','application/json',
+--         'Authorization','Bearer '||current_setting('app.gcal_service_key')),
+--       body := jsonb_build_object('action','pull_events'))
+--   $CRON$);
+--
+-- Or drive one row per channel from SQL (tighter scoping / per-channel cadence):
+--
+--   SELECT cron.schedule('gcal-pull-'||ch.id::text, '*/10 * * * *', format($CRON$
+--     SELECT net.http_post(
+--       url := current_setting('app.gcal_sync_url'),
+--       headers := jsonb_build_object(
+--         'Content-Type','application/json',
+--         'Authorization','Bearer '||current_setting('app.gcal_service_key')),
+--       body := jsonb_build_object('action','pull_events','channelId',%L))
+--   $CRON$, ch.id))
+--   FROM public.plg_calendar_channels ch
+--   WHERE ch.is_active AND ch.direction IN ('inbound','bidirectional');
+-- ===========================================================================
+`;
+var MIGRATION_003_PLG_RENAME = `-- ---------------------------------------------------------------------------
+-- 003_plg_rename.sql \u2014 standardize the Google Calendar connector objects onto
+-- the platform \`plg_<plugin>_\` prefix (DATA-MODEL.md Ring 1).
+--
+--   calendar_integrations \u2192 plg_calendar_integrations
+--   calendar_channels     \u2192 plg_calendar_channels
+--   calendar_sync_log     \u2192 plg_calendar_sync_log
+--
+-- Legacy-pool remediation ONLY: 001/002 now create the prefixed names directly,
+-- so fresh installs never reach a rename branch. Fully idempotent and guarded \u2014
+-- every RENAME fires only when the old object exists and the new one does not,
+-- so re-running (or running on an already-prefixed pool) is a no-op.
+--
+-- A table RENAME preserves its data, RLS state, policies, grants, indexes,
+-- constraints and triggers (they follow the table), so \xA71 only renames the
+-- table + the explicitly-named indexes. \xA72 then re-points the SECURITY DEFINER
+-- gcal_* functions whose bodies hard-code the old table names.
+-- ---------------------------------------------------------------------------
+
+-- ===========================================================================
+-- \xA71 \u2014 Guarded table + index renames.
+-- ===========================================================================
+DO $$
+BEGIN
+  IF to_regclass('public.calendar_integrations') IS NOT NULL
+     AND to_regclass('public.plg_calendar_integrations') IS NULL THEN
+    ALTER TABLE public.calendar_integrations RENAME TO plg_calendar_integrations;
+  END IF;
+
+  IF to_regclass('public.calendar_channels') IS NOT NULL
+     AND to_regclass('public.plg_calendar_channels') IS NULL THEN
+    ALTER TABLE public.calendar_channels RENAME TO plg_calendar_channels;
+  END IF;
+
+  IF to_regclass('public.calendar_sync_log') IS NOT NULL
+     AND to_regclass('public.plg_calendar_sync_log') IS NULL THEN
+    ALTER TABLE public.calendar_sync_log RENAME TO plg_calendar_sync_log;
+  END IF;
+
+  -- Named indexes do not follow a table rename automatically.
+  IF to_regclass('public.idx_calendar_integrations_tenant') IS NOT NULL
+     AND to_regclass('public.idx_plg_calendar_integrations_tenant') IS NULL THEN
+    ALTER INDEX public.idx_calendar_integrations_tenant RENAME TO idx_plg_calendar_integrations_tenant;
+  END IF;
+
+  IF to_regclass('public.idx_calendar_channels_tenant') IS NOT NULL
+     AND to_regclass('public.idx_plg_calendar_channels_tenant') IS NULL THEN
+    ALTER INDEX public.idx_calendar_channels_tenant RENAME TO idx_plg_calendar_channels_tenant;
+  END IF;
+
+  IF to_regclass('public.idx_calendar_channels_integration') IS NOT NULL
+     AND to_regclass('public.idx_plg_calendar_channels_integration') IS NULL THEN
+    ALTER INDEX public.idx_calendar_channels_integration RENAME TO idx_plg_calendar_channels_integration;
+  END IF;
+END $$;
+
+-- ===========================================================================
+-- \xA72 \u2014 Re-point the inbound SECURITY DEFINER writers at the prefixed names.
+-- These bodies are byte-identical to 002_smart_sync.sql except the calendar_*
+-- table references, which now read plg_calendar_*. gcal_apply_event_patch and
+-- gcal_stamp_outbound only touch public.appointments (unaffected by the rename)
+-- and are re-asserted here for completeness so all four writers stay in step.
+-- ===========================================================================
+
+CREATE OR REPLACE FUNCTION public.gcal_import_event(
+  p_tenant_id   uuid,
+  p_channel_id  uuid,
+  p_event_id    text,
+  p_etag        text,
+  p_summary     text,
+  p_starts_at   timestamptz,
+  p_ends_at     timestamptz,
+  p_all_day     boolean,
+  p_description text DEFAULT NULL
+) RETURNS uuid
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_ch          record;
+  v_kind        text;
+  v_assignee    uuid;
+  v_location    uuid;
+  v_ends        timestamptz;
+  v_meta        jsonb;
+  v_existing    uuid;
+  v_appt        uuid;
+BEGIN
+  IF p_tenant_id IS NULL OR p_event_id IS NULL OR p_starts_at IS NULL THEN
+    RAISE EXCEPTION 'gcal_import_event: tenant, event id and start are required';
+  END IF;
+
+  PERFORM set_config('app.booking_origin', 'google', true);
+
+  SELECT c.import_mode, c.target_kind, c.target_id
+    INTO v_ch
+  FROM plg_calendar_channels c
+  WHERE c.id = p_channel_id AND c.tenant_id = p_tenant_id;
+  IF NOT FOUND THEN RAISE EXCEPTION 'gcal_import_event: unknown channel for tenant'; END IF;
+
+  v_kind     := CASE WHEN v_ch.import_mode = 'appointment' THEN 'appointment' ELSE 'block' END;
+  v_assignee := CASE WHEN v_ch.target_kind = 'assignee' THEN v_ch.target_id ELSE NULL END;
+  v_location := CASE WHEN v_ch.target_kind = 'location' THEN v_ch.target_id ELSE NULL END;
+
+  v_ends := COALESCE(
+    p_ends_at,
+    CASE WHEN COALESCE(p_all_day, false) THEN p_starts_at + interval '1 day' ELSE p_starts_at END
+  );
+
+  v_meta := jsonb_build_object(
+    'syncOrigin', 'google',
+    'googleCalendarEventId', p_event_id,
+    'gcalEtag', p_etag,
+    'gcalChannelId', p_channel_id::text,
+    'allDay', COALESCE(p_all_day, false),
+    'title', p_summary,
+    'source', 'google_import'
+  );
+
+  SELECT b.id INTO v_existing
+  FROM appointments b
+  WHERE b.tenant_id = p_tenant_id
+    AND b.metadata->>'googleCalendarEventId' = p_event_id
+  LIMIT 1;
+
+  IF v_existing IS NOT NULL THEN
+    UPDATE appointments b
+    SET kind        = v_kind,
+        assignee_id = v_assignee,
+        location_id = v_location,
+        starts_at   = p_starts_at,
+        ends_at     = v_ends,
+        status      = 'scheduled',
+        notes       = COALESCE(p_description, p_summary),
+        metadata    = COALESCE(b.metadata, '{}'::jsonb) || v_meta,
+        updated_at  = now()
+    WHERE b.id = v_existing
+    RETURNING b.id INTO v_appt;
+  ELSE
+    INSERT INTO appointments (tenant_id, kind, assignee_id, location_id,
+                              starts_at, ends_at, status, notes, metadata)
+    VALUES (p_tenant_id, v_kind, v_assignee, v_location,
+            p_starts_at, v_ends, 'scheduled', COALESCE(p_description, p_summary), v_meta)
+    RETURNING id INTO v_appt;
+  END IF;
+
+  RETURN v_appt;
+END $$;
+
+CREATE OR REPLACE FUNCTION public.gcal_apply_event_patch(
+  p_tenant_id uuid,
+  p_event_id  text,
+  p_etag      text,
+  p_starts_at timestamptz,
+  p_ends_at   timestamptz,
+  p_summary   text,
+  p_cancelled boolean
+) RETURNS uuid
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_appt      uuid;
+  v_curr_etag text;
+BEGIN
+  IF p_tenant_id IS NULL OR p_event_id IS NULL THEN
+    RAISE EXCEPTION 'gcal_apply_event_patch: tenant and event id are required';
+  END IF;
+
+  PERFORM set_config('app.booking_origin', 'google', true);
+
+  SELECT b.id, b.metadata->>'gcalEtag'
+    INTO v_appt, v_curr_etag
+  FROM appointments b
+  WHERE b.tenant_id = p_tenant_id
+    AND b.metadata->>'googleCalendarEventId' = p_event_id
+  LIMIT 1;
+
+  IF v_appt IS NULL THEN RETURN NULL; END IF;
+  IF p_etag IS NOT NULL AND p_etag = v_curr_etag THEN
+    RETURN NULL;
+  END IF;
+
+  IF COALESCE(p_cancelled, false) THEN
+    UPDATE appointments b
+    SET status     = 'cancelled',
+        metadata   = COALESCE(b.metadata, '{}'::jsonb)
+                     || jsonb_build_object('syncOrigin', 'google', 'gcalEtag', p_etag),
+        updated_at = now()
+    WHERE b.id = v_appt;
+  ELSE
+    UPDATE appointments b
+    SET starts_at  = COALESCE(p_starts_at, b.starts_at),
+        ends_at    = COALESCE(p_ends_at, b.ends_at),
+        notes      = COALESCE(p_summary, b.notes),
+        metadata   = COALESCE(b.metadata, '{}'::jsonb)
+                     || jsonb_build_object('syncOrigin', 'google',
+                                           'gcalEtag', p_etag,
+                                           'title', COALESCE(p_summary, b.metadata->>'title')),
+        updated_at = now()
+    WHERE b.id = v_appt;
+  END IF;
+
+  RETURN v_appt;
+END $$;
+
+CREATE OR REPLACE FUNCTION public.gcal_stamp_outbound(
+  p_tenant_id   uuid,
+  p_booking_id  uuid,
+  p_event_id    text,
+  p_etag        text DEFAULT NULL,
+  p_calendar_id text DEFAULT NULL
+) RETURNS uuid
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_id uuid;
+BEGIN
+  IF p_tenant_id IS NULL OR p_booking_id IS NULL OR p_event_id IS NULL THEN
+    RAISE EXCEPTION 'gcal_stamp_outbound: tenant, booking and event id are required';
+  END IF;
+
+  PERFORM set_config('app.booking_origin', 'google', true);
+
+  UPDATE appointments b
+  SET metadata   = COALESCE(b.metadata, '{}'::jsonb)
+                   || jsonb_build_object('googleCalendarEventId', p_event_id,
+                                         'gcalEtag', p_etag,
+                                         'gcalSyncedAt', now())
+                   || CASE WHEN p_calendar_id IS NULL THEN '{}'::jsonb
+                           ELSE jsonb_build_object('gcalCalendarId', p_calendar_id) END,
+      updated_at = now()
+  WHERE b.id = p_booking_id AND b.tenant_id = p_tenant_id
+  RETURNING b.id INTO v_id;
+  RETURN v_id;
+END $$;
+
+CREATE OR REPLACE FUNCTION public.gcal_unlink_channel(
+  p_channel_id uuid
+) RETURNS uuid
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_id uuid;
+BEGIN
+  UPDATE plg_calendar_channels c
+  SET sync_token         = NULL,
+      channel_id         = NULL,
+      resource_id        = NULL,
+      channel_expires_at = NULL,
+      updated_at         = now()
+  WHERE c.id = p_channel_id
+  RETURNING c.id INTO v_id;
+  RETURN v_id;
+END $$;
+
+-- Re-assert the service_role-only lock (idempotent; matches 002 \xA74).
+DO $$
+DECLARE fn text;
+BEGIN
+  FOR fn IN SELECT unnest(ARRAY[
+    'public.gcal_import_event(uuid, uuid, text, text, text, timestamptz, timestamptz, boolean, text)',
+    'public.gcal_apply_event_patch(uuid, text, text, timestamptz, timestamptz, text, boolean)',
+    'public.gcal_stamp_outbound(uuid, uuid, text, text, text)',
+    'public.gcal_unlink_channel(uuid)'
+  ])
+  LOOP
+    EXECUTE format('REVOKE ALL ON FUNCTION %s FROM public, anon, authenticated', fn);
+    EXECUTE format('GRANT EXECUTE ON FUNCTION %s TO service_role', fn);
+  END LOOP;
+END $$;
+`;
+var MIGRATION_004_DROP_OAUTH_TOKENS = `-- ============================================================================
+-- Google Calendar 004: the credential leaves the tenant database, and the
+-- outbound trigger stops being able to break a booking write.
+--
+--   \xA71  credential  drop oauth_refresh_token + oauth_access_token
+--   \xA72  outbound    anti-loop, safe no-op, delete context, correlation id
+--   \xA73  realtime    publish public.appointments so the calendar repaints
+--
+-- Additive and idempotent: no table is created, no policy is rewritten, and the
+-- tenant RLS from 001 already covers everything touched here.
+-- ============================================================================
+
+-- \xA71 \u2500\u2500 credential \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- THE EXPOSURE THIS CLOSES: 001 stored \`oauth_refresh_token text\` and
+-- \`oauth_access_token text\` on public.plg_calendar_integrations. That table is
+-- read from the browser with the publishable key under tenant RLS \u2014 and the
+-- connector read it with \`select('*')\` \u2014 so a Google refresh token was readable
+-- by ANY authenticated member of the tenant, reception included. A refresh token
+-- is not a session: it is durable access to the owner's entire calendar, mail-
+-- adjacent metadata and every calendar shared with them. And a pool is one
+-- Supabase project serving N tenants, so anything running there with
+-- service_role read every clinic's Google grant at once.
+--
+-- This is the third connector to make the same move, and the worst of the three.
+-- RankLayer had nothing to replace its key with (it pushes IN and authenticates
+-- against the platform); PlugBank's credential is meant to move to the platform
+-- (FAY-1360 \u2014 as of 2026-08-12 its api_token is still a plaintext pool column).
+-- Google Calendar is PlugBank's case: the grant still has to exist, it just must
+-- not exist HERE. The destination is the platform's ConnectorConnection store
+-- (encrypted; exists, unused), with the sync function redeeming per call \u2014 that
+-- is FAY-1359, and it has NOT happened.
+--
+-- \u26A0 REPO AHEAD OF POOL (verified 2026-08-12, FAY-1379): this file has NOT been
+-- applied to the live salon pool. plg_calendar_integrations there still carries
+-- both token columns with a real clinic's grant, and the DEPLOYED
+-- google-calendar-sync (v16) still reads and writes them. Applying this drop
+-- before FAY-1359's ordered rollout (function reads both homes \u2192 data migrated
+-- \u2192 function reads only the new home \u2192 drop) severs the clinic's sync. Do not
+-- \`db apply\` this to a pool outside that sequence.
+--
+-- \`token_expires_at\` deliberately stays. It is a timestamp, not a credential,
+-- and it is the only non-secret signal that a grant exists \u2014 which is what the
+-- browser needs in order to draw a connected/disconnected badge without ever
+-- being handed the thing it is reporting on. See ../credentials.ts.
+--
+-- ROTATE any token a pool already stored. Nothing is live on this connector yet,
+-- but DROP COLUMN is a catalog change: the old values stay in the heap until the
+-- next table rewrite, so a grant that ever reached a pool must be revoked at
+-- Google rather than assumed gone.
+
+DO $$
+BEGIN
+  IF to_regclass('public.plg_calendar_integrations') IS NOT NULL THEN
+    ALTER TABLE public.plg_calendar_integrations DROP COLUMN IF EXISTS oauth_refresh_token;
+    ALTER TABLE public.plg_calendar_integrations DROP COLUMN IF EXISTS oauth_access_token;
+  END IF;
+  -- Pools converted before 003 renamed the tables carry the legacy name.
+  IF to_regclass('public.calendar_integrations') IS NOT NULL THEN
+    ALTER TABLE public.calendar_integrations DROP COLUMN IF EXISTS oauth_refresh_token;
+    ALTER TABLE public.calendar_integrations DROP COLUMN IF EXISTS oauth_access_token;
+  END IF;
+END $$;
+
+-- \xA72 \u2500\u2500 outbound trigger \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- Three defects in 001's fn_gcal_push_booking, in order of how badly they hurt:
+--
+-- 1. NO ANTI-LOOP. An inbound Google event is written to public.appointments by
+--    the sync function, which fires this trigger, which pushes the same change
+--    back to Google, which changes the event, which the next pull reads as new.
+--    The symptom a customer reports is an appointment that will not stop moving.
+--    The sync function sets \`app.booking_origin = 'google'\` for the duration of
+--    its transaction; a write carrying that marker is never echoed back.
+--
+-- 2. A MISSING PREREQUISITE COULD BREAK THE BOOKING. 001 returned early on an
+--    empty URL but not on an empty key, so a half-configured pool sent an
+--    unauthenticated pg_net request; and any error raised in here aborts the
+--    INSERT that fired it. An integration that is not set up must degrade to
+--    "Google is not updated", never to "the appointment could not be saved".
+--    Every exit path below returns the row.
+--
+-- 3. A DELETE ARRIVED WITH NOTHING TO DELETE. AFTER DELETE can still read OLD,
+--    but pg_net delivers asynchronously \u2014 by the time the function runs, the row
+--    is gone and it cannot look up which Google event to remove. The linked ids
+--    now travel in the payload.
+--
+-- The early returns are not enough on their own: on a pool where the settings
+-- are present but pg_net is not installed, the PERFORM itself raises \`schema
+-- "net" does not exist\` and takes the INSERT down with it. So the delivery is
+-- wrapped too. Swallowing a delivery error is safe here because pg_net only
+-- ENQUEUES \u2014 anything it could tell us is already visible as "nothing has
+-- synced" in plg_calendar_sync_log and in the connector's derived health.
+--
+-- The Supabase service-role key still reaches this trigger through the
+-- \`app.gcal_service_key\` database setting that 001 introduced. That is a lesser
+-- exposure than the one closed in \xA71 (a GUC is not reachable through PostgREST,
+-- so no browser can read it) but it is still a pool-wide credential in the
+-- database, and it is NOT fixed here. FAY-1372 shipped the RLS half (a
+-- tenant-scoped claim narrows user_tenant_ids); nothing mints such a token for
+-- this trigger yet, and the function still runs on service_role (FAY-1378).
+-- Left as a named debt rather than moved to a third hiding place.
+
+CREATE OR REPLACE FUNCTION public.fn_gcal_push_booking() RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public, extensions, net
+AS $$
+DECLARE
+  url  text := current_setting('app.gcal_sync_url', true);
+  key  text := current_setting('app.gcal_service_key', true);
+  rec  record := COALESCE(NEW, OLD);
+  op   text := lower(TG_OP);
+  corr text := NULLIF(current_setting('app.booking_correlation_id', true), '');
+BEGIN
+  -- (1) Inbound Google writes mark themselves. Never echo them back.
+  IF current_setting('app.booking_origin', true) = 'google' THEN
+    RETURN COALESCE(NEW, OLD);
+  END IF;
+
+  -- (2) Not configured is not an error. Diagnostics report the connector as
+  -- incomplete; the appointment is saved either way.
+  IF NULLIF(url, '') IS NULL OR NULLIF(key, '') IS NULL THEN
+    RETURN COALESCE(NEW, OLD);
+  END IF;
+
+  BEGIN
+    PERFORM net.http_post(
+      url := url,
+      headers := jsonb_build_object(
+        'Content-Type', 'application/json',
+        'Authorization', 'Bearer ' || key
+      ),
+      body := jsonb_build_object(
+        'action', 'push_event',
+        'op', op,
+        'bookingId', rec.id,
+        'tenantId', rec.tenant_id,
+        -- (3) Carried so a delete can still be honoured after the row is gone.
+        'googleEventId', rec.metadata->>'googleCalendarEventId',
+        'calendarId', rec.metadata->>'gcalCalendarId',
+        'correlationId', COALESCE(corr, gen_random_uuid()::text)
+      )
+    );
+  EXCEPTION WHEN OTHERS THEN
+    -- Missing pg_net, a bad URL, a full queue: the appointment is still saved.
+    RAISE WARNING 'gcal push skipped for booking %: %', rec.id, SQLERRM;
+  END;
+
+  RETURN COALESCE(NEW, OLD);
+END $$;
+
+-- \xA73 \u2500\u2500 realtime \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- The calendar screen subscribes to public.appointments so a booking written by
+-- the sync function repaints the grid the manager is looking at, instead of
+-- waiting for them to reload the tab. Additive and guarded: a pool without the
+-- supabase_realtime publication is left alone, and re-running adds nothing.
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_publication WHERE pubname = 'supabase_realtime')
+     AND NOT EXISTS (
+       SELECT 1 FROM pg_publication_tables
+       WHERE pubname = 'supabase_realtime' AND schemaname = 'public' AND tablename = 'appointments'
+     )
+  THEN
+    ALTER PUBLICATION supabase_realtime ADD TABLE public.appointments;
+  END IF;
+END $$;
+`;
+var MIGRATION_005_OUTBOUND_VAULT_DELIVERY = `-- ============================================================================
+-- Google Calendar 005: the outbound credential moves to Vault, and stops being
+-- the service-role key. The Authorization header stays.
+--
+--   \xA71  trigger  fn_gcal_push_booking reads Vault, falls back to the old GUCs
+--   \xA72  cleanup  clear app.gcal_service_key ONLY where Vault already covers it
+--
+-- Additive and idempotent: a CREATE OR REPLACE plus a guarded, conditional
+-- catalog cleanup.
+--
+-- WRITTEN AGAINST THE DEPLOYED POOL, NOT AGAINST THIS FOLDER. The repo and
+-- cluster-salon-br-01 (gphxclpkbtbucoqclbco) had drifted: \`004\` here still reads
+-- \`app.gcal_service_key\`, while the pool has been on Vault since 2026-07-28 and
+-- the deployed function is four features ahead of \`functions/\`. Everything below
+-- was checked against the live database and the live function source, because
+-- the previous attempt at this file was derived from the repo alone and would
+-- have broken a real clinic. See FAY-1379 for the drift itself.
+-- ============================================================================
+
+-- \xA71 \u2500\u2500 the credential \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- THE EXPOSURE THIS CLOSES, precisely: \`001\` told operators to run
+--   ALTER DATABASE postgres SET app.gcal_service_key = '<service-role-key>';
+-- and every version of this trigger in the repo since (\`001\`, \`002 \xA72\`,
+-- \`004 \xA72\`) reads it back with current_setting(). A pool is ONE Supabase project
+-- serving N tenants and service_role bypasses RLS by definition, so that setting
+-- is unrestricted read/write over every tenant in the cluster, in plain text in
+-- pg_db_role_setting and in every pg_dump taken since.
+--
+-- It is closed by making the credential BOTH narrow and encrypted, not by
+-- removing it: the header is the only thing authorising the push. The deployed
+-- function checks it (\`isServiceRequest\` compares the bearer against
+-- GCAL_OUTBOUND_SECRET, then against the service-role key) and \`push_event\` is a
+-- service action with no user path, so a request with no Authorization header is
+-- rejected with \`400 Unknown action: push_event\`. Because pg_net is
+-- fire-and-forget that rejection is INVISIBLE \u2014 the clinic would simply stop
+-- appearing in Google Calendar. Removing the header is therefore not a security
+-- improvement, it is a silent outage. It was tried and reverted.
+--
+-- So: \`gcal_outbound_secret\` in Vault. Encrypted at rest, outside pg_dump's
+-- plaintext, readable only by a definer function like this one, and \u2014 the part
+-- that matters \u2014 it authorises exactly one thing, calling this connector's edge
+-- function. Losing it does not hand anyone another tenant's data. This is the
+-- shape the pool has been running since 2026-07-28; \`005\` is the repo catching
+-- up, so a pool provisioned fresh from this folder is born with it instead of
+-- being told to paste a service-role key into a database setting.
+--
+-- THE FALLBACK IS DELIBERATE. A pool that followed \`001\` and has no Vault secret
+-- keeps working off the old GUCs, loudly. The alternative \u2014 read Vault only \u2014
+-- silently disarms the push on exactly the pools that did what the docs told
+-- them to, which is the failure this file exists to avoid.
+--
+-- WHAT THIS DOES NOT FIX: the edge function still builds its Supabase client
+-- with SUPABASE_SERVICE_ROLE_KEY, so the FUNCTION still reads every tenant in
+-- the pool. That is not reachable from SQL and does not close here: it closes
+-- when the platform mints a short-lived tenant-scoped token (FAY-1353) that
+-- packages/db/migrations/028_tenant_scoped_token.sql already teaches every
+-- policy to honour through user_tenant_ids(). See docs/platform/DECISIONS.md,
+-- 2026-08-11 \u2014 "a connector's privilege comes from its token".
+--
+-- ROTATE the service-role key of any pool that ever ran \`001\`'s setup line: it
+-- was plain text at rest and in every backup taken since, so \xA72 clearing it is
+-- not the same as it never having been there.
+
+CREATE OR REPLACE FUNCTION public.fn_gcal_push_booking() RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public, extensions, net, vault
+AS $$
+DECLARE
+  url      text;
+  key      text;
+  legacy   boolean := false;
+  rec      record := COALESCE(NEW, OLD);
+  op       text := lower(TG_OP);
+  corr     text := NULLIF(current_setting('app.booking_correlation_id', true), '');
+BEGIN
+  -- Unchanged from 004: inbound Google writes mark themselves, and a write
+  -- carrying that marker is never echoed back.
+  IF current_setting('app.booking_origin', true) = 'google' THEN
+    RETURN COALESCE(NEW, OLD);
+  END IF;
+
+  -- Vault first. Wrapped because a pool without the vault extension must
+  -- degrade to the fallback, not abort the booking write.
+  BEGIN
+    SELECT decrypted_secret INTO url
+      FROM vault.decrypted_secrets WHERE name = 'gcal_sync_url'
+      ORDER BY created_at DESC LIMIT 1;
+    SELECT decrypted_secret INTO key
+      FROM vault.decrypted_secrets WHERE name = 'gcal_outbound_secret'
+      ORDER BY created_at DESC LIMIT 1;
+  EXCEPTION WHEN OTHERS THEN
+    url := NULL;
+    key := NULL;
+  END;
+
+  -- Legacy pools provisioned per 001's header keep working, and say so.
+  IF NULLIF(url, '') IS NULL OR NULLIF(key, '') IS NULL THEN
+    url := COALESCE(NULLIF(url, ''), current_setting('app.gcal_sync_url', true));
+    key := COALESCE(NULLIF(key, ''), current_setting('app.gcal_service_key', true));
+    legacy := NULLIF(key, '') IS NOT NULL;
+  END IF;
+
+  -- Not configured is not an error: an unconfigured pool degrades to "Google is
+  -- not updated", never to "the appointment could not be saved".
+  IF NULLIF(url, '') IS NULL OR NULLIF(key, '') IS NULL THEN
+    RETURN COALESCE(NEW, OLD);
+  END IF;
+
+  IF legacy THEN
+    RAISE WARNING 'gcal outbound is still using app.gcal_service_key; move it to the vault secret gcal_outbound_secret and rotate the service-role key';
+  END IF;
+
+  BEGIN
+    PERFORM net.http_post(
+      url := url,
+      headers := jsonb_build_object(
+        'Content-Type', 'application/json',
+        -- REQUIRED. The deployed function authorises push_event on this header
+        -- alone; without it every push 400s, silently, forever.
+        'Authorization', 'Bearer ' || key
+      ),
+      body := jsonb_build_object(
+        'action', 'push_event',
+        'op', op,
+        'bookingId', rec.id,
+        'tenantId', rec.tenant_id,
+        -- Carried so a delete can still be honoured after the row is gone.
+        'googleEventId', rec.metadata->>'googleCalendarEventId',
+        'calendarId', rec.metadata->>'gcalCalendarId',
+        'correlationId', COALESCE(corr, gen_random_uuid()::text)
+      )
+    );
+  EXCEPTION WHEN OTHERS THEN
+    -- Missing pg_net, a bad URL, a full queue: the appointment is still saved.
+    -- The deployed trigger lacks this wrapper; 004 added it here after a pool
+    -- with the settings present but the extension missing took an INSERT down.
+    RAISE WARNING 'gcal push skipped for booking %: %', rec.id, SQLERRM;
+  END;
+
+  RETURN COALESCE(NEW, OLD);
+END $$;
+
+-- \xA72 \u2500\u2500 cleanup \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+-- Redefining the function stops the key being PREFERRED; it does not stop it
+-- being STORED. Settings live in pg_db_role_setting per (database, role), so the
+-- sweep is driven off the catalog rather than off the one ALTER DATABASE form
+-- \`001\` happened to show.
+--
+-- CONDITIONAL ON PURPOSE: the setting is cleared only where Vault already
+-- supplies \`gcal_outbound_secret\`, i.e. only where \xA71 provably never needs the
+-- fallback. Anywhere else it is left in place and reported, because clearing it
+-- there would disarm the push with no error anyone can see. On the live pool
+-- this loop finds nothing \u2014 the setting is not present on any role or database \u2014
+-- and that is the expected result, not a failure.
+DO $$
+DECLARE
+  r          record;
+  has_vault  boolean := false;
+BEGIN
+  BEGIN
+    SELECT EXISTS (
+      SELECT 1 FROM vault.decrypted_secrets
+      WHERE name = 'gcal_outbound_secret' AND NULLIF(decrypted_secret, '') IS NOT NULL
+    ) INTO has_vault;
+  EXCEPTION WHEN OTHERS THEN
+    has_vault := false;
+  END;
+
+  FOR r IN
+    SELECT d.datname, a.rolname
+    FROM pg_db_role_setting s
+    LEFT JOIN pg_database d ON d.oid = s.setdatabase
+    LEFT JOIN pg_roles    a ON a.oid = s.setrole
+    WHERE EXISTS (
+      SELECT 1 FROM unnest(s.setconfig) AS c WHERE c LIKE 'app.gcal_service_key=%'
+    )
+  LOOP
+    IF NOT has_vault THEN
+      RAISE WARNING 'app.gcal_service_key is still set (database %, role %) and is the ONLY outbound credential \u2014 create the vault secret gcal_outbound_secret first, then re-run this migration',
+        r.datname, r.rolname;
+      CONTINUE;
+    END IF;
+    BEGIN
+      IF r.rolname IS NULL THEN
+        EXECUTE format('ALTER DATABASE %I RESET app.gcal_service_key', r.datname);
+      ELSIF r.datname IS NULL THEN
+        EXECUTE format('ALTER ROLE %I RESET app.gcal_service_key', r.rolname);
+      ELSE
+        EXECUTE format('ALTER ROLE %I IN DATABASE %I RESET app.gcal_service_key', r.rolname, r.datname);
+      END IF;
+    EXCEPTION WHEN OTHERS THEN
+      RAISE WARNING 'could not clear app.gcal_service_key (database %, role %): % \u2014 clear it by hand, and rotate the key either way',
+        r.datname, r.rolname, SQLERRM;
+    END;
+  END LOOP;
+END $$;
+`;
+var MIGRATION_006_WEBHOOK_DELIVERIES_OUTBOX = `-- ---------------------------------------------------------------------------
+-- Google Calendar WEBHOOK INTAKE \u2014 delivery ledger + automation outbox
+-- ---------------------------------------------------------------------------
+-- RECONSTRUCTED FROM THE LIVE SCHEMA on 2026-08-12 (FAY-1379). These objects
+-- existed in pool gphxclpkbtbucoqclbco and in NO migration in any repo: they
+-- were applied by hand alongside the google-calendar-webhook deployment. A pool
+-- provisioned from this repo could not run that function \u2014 the SELECT of
+-- plg_calendar_channels.webhook_token_hash failed before any gate ran, and both
+-- INSERT targets were missing. This file closes that hole.
+--
+-- Written to be applied to a pool that ALREADY has them: every statement is
+-- IF NOT EXISTS / DROP-then-CREATE, and re-running it must be a no-op.
+--
+--   \xA71  plg_calendar_channels          \u2014 the three webhook columns
+--   \xA72  plg_calendar_webhook_deliveries \u2014 one row per Google notification
+--   \xA73  plg_calendar_automation_outbox  \u2014 domain events for the automations lane
+--
+-- Read by: functions/google-calendar-webhook/index.ts (\xA71 gate, \xA72 idempotency,
+-- \xA73 emit) and functions/google-calendar-sync/index.ts (\xA71 watch bookkeeping,
+-- \xA73 emit on inbound import/patch).
+-- ---------------------------------------------------------------------------
+
+-- ===========================================================================
+-- \xA71 \u2014 Watch-channel authentication state on plg_calendar_channels.
+-- Added by ALTER in the pool (they sit after created_at/updated_at), so they
+-- are added the same way here rather than folded into 002's CREATE TABLE \u2014
+-- 002 has already run everywhere and its checksum must not move.
+--
+-- webhook_token_hash: SHA-256 of the token handed to Google at watch_start. The
+--   token itself is never stored, so a dump of this table does not let anyone
+--   forge a notification. The webhook re-hashes what arrives and compares in
+--   constant time.
+-- last_webhook_message_number: high-water mark of Google's monotonic per-channel
+--   counter \u2014 the replay guard. bigint because it outgrows int4.
+-- ===========================================================================
+ALTER TABLE public.plg_calendar_channels
+  ADD COLUMN IF NOT EXISTS webhook_token_hash text;
+ALTER TABLE public.plg_calendar_channels
+  ADD COLUMN IF NOT EXISTS last_webhook_message_number bigint;
+ALTER TABLE public.plg_calendar_channels
+  ADD COLUMN IF NOT EXISTS last_webhook_at timestamptz;
+
+-- ===========================================================================
+-- \xA72 \u2014 plg_calendar_webhook_deliveries: one row per accepted notification.
+--
+-- The row IS the idempotency mechanism, not a log of one: the webhook inserts
+-- before doing any work and reads 23505 as "already handled", returning 204.
+-- Hence two unique keys, both present in the pool and both reproduced \u2014
+-- (channel_ref, message_number) is the constraint the FK cascade protects, and
+-- (google_channel_id, message_number) catches a replay arriving after the
+-- channel row was recreated with the same Google channel id.
+-- ===========================================================================
+CREATE TABLE IF NOT EXISTS public.plg_calendar_webhook_deliveries (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL,
+  channel_ref uuid NOT NULL REFERENCES public.plg_calendar_channels(id) ON DELETE CASCADE,
+  google_channel_id text NOT NULL,
+  resource_id text,
+  message_number bigint NOT NULL,
+  resource_state text,
+  status text NOT NULL DEFAULT 'pending'
+    CHECK (status IN ('pending','processing','processed','failed','ignored')),
+  error text,
+  received_at timestamptz NOT NULL DEFAULT now(),
+  processed_at timestamptz,
+  created_at timestamptz DEFAULT now(),
+  UNIQUE (channel_ref, message_number)
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_plg_calendar_webhook_delivery_message
+  ON public.plg_calendar_webhook_deliveries (google_channel_id, message_number);
+
+CREATE INDEX IF NOT EXISTS idx_plg_calendar_webhook_deliveries_tenant_created
+  ON public.plg_calendar_webhook_deliveries (tenant_id, created_at DESC);
+
+-- Two partial indexes over the same predicate on different sort columns. Both
+-- are in the pool (evidence of two overlapping hand-applied scripts) and both
+-- are reproduced so this file matches the live schema exactly; consolidating
+-- them is a separate change with its own reasoning.
+CREATE INDEX IF NOT EXISTS idx_plg_calendar_webhook_pending
+  ON public.plg_calendar_webhook_deliveries (status, received_at)
+  WHERE status IN ('pending','failed');
+CREATE INDEX IF NOT EXISTS idx_plg_calendar_webhook_deliveries_pending
+  ON public.plg_calendar_webhook_deliveries (status, created_at)
+  WHERE status IN ('pending','failed');
+
+ALTER TABLE public.plg_calendar_webhook_deliveries ENABLE ROW LEVEL SECURITY;
+
+-- Read-only for the app. Every write comes from the webhook function running as
+-- service_role, which bypasses RLS \u2014 there is no authenticated INSERT/UPDATE
+-- grant, so a browser cannot forge or retire a delivery.
+GRANT SELECT ON public.plg_calendar_webhook_deliveries TO authenticated;
+GRANT ALL ON public.plg_calendar_webhook_deliveries TO service_role;
+
+DROP POLICY IF EXISTS plg_calendar_webhook_deliveries_read ON public.plg_calendar_webhook_deliveries;
+CREATE POLICY plg_calendar_webhook_deliveries_read ON public.plg_calendar_webhook_deliveries
+  FOR SELECT TO authenticated
+  USING (tenant_id IN (SELECT public.user_tenant_ids()));
+
+-- ===========================================================================
+-- \xA73 \u2014 plg_calendar_automation_outbox: calendar facts, for the automations lane.
+--
+-- Transactional outbox: the sync/webhook functions record WHAT happened and
+-- return; a consumer drains it. idempotency_key is unique per tenant so a
+-- replayed Google delivery or a re-run pull upserts onto the same row instead
+-- of firing an automation twice \u2014 that key is what the functions pass as
+-- onConflict, so it is load-bearing and not merely a hygiene constraint.
+-- ===========================================================================
+CREATE TABLE IF NOT EXISTS public.plg_calendar_automation_outbox (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL,
+  source text NOT NULL DEFAULT 'google_calendar',
+  event_type text NOT NULL,
+  aggregate_type text NOT NULL,
+  aggregate_id text,
+  idempotency_key text NOT NULL,
+  payload jsonb NOT NULL DEFAULT '{}'::jsonb,
+  status text NOT NULL DEFAULT 'pending'
+    CHECK (status IN ('pending','processing','processed','failed','ignored')),
+  attempts integer NOT NULL DEFAULT 0,
+  last_error text,
+  occurred_at timestamptz NOT NULL DEFAULT now(),
+  -- available_at is the retry clock: a failed row is re-eligible once it passes.
+  available_at timestamptz NOT NULL DEFAULT now(),
+  processed_at timestamptz,
+  error text,
+  created_at timestamptz DEFAULT now(),
+  UNIQUE (tenant_id, idempotency_key)
+);
+
+-- Redundant with the UNIQUE constraint's own index, and present in the pool for
+-- the same overlapping-scripts reason as \xA72. Reproduced, not tidied.
+CREATE UNIQUE INDEX IF NOT EXISTS uq_plg_calendar_automation_outbox_idempotency
+  ON public.plg_calendar_automation_outbox (tenant_id, idempotency_key);
+
+CREATE INDEX IF NOT EXISTS idx_plg_calendar_automation_pending
+  ON public.plg_calendar_automation_outbox (status, available_at)
+  WHERE status IN ('pending','failed');
+CREATE INDEX IF NOT EXISTS idx_plg_calendar_automation_outbox_pending
+  ON public.plg_calendar_automation_outbox (status, available_at, created_at)
+  WHERE status IN ('pending','failed');
+
+ALTER TABLE public.plg_calendar_automation_outbox ENABLE ROW LEVEL SECURITY;
+
+GRANT SELECT ON public.plg_calendar_automation_outbox TO authenticated;
+GRANT ALL ON public.plg_calendar_automation_outbox TO service_role;
+
+DROP POLICY IF EXISTS plg_calendar_automation_outbox_read ON public.plg_calendar_automation_outbox;
+CREATE POLICY plg_calendar_automation_outbox_read ON public.plg_calendar_automation_outbox
+  FOR SELECT TO authenticated
+  USING (tenant_id IN (SELECT public.user_tenant_ids()));
+`;
+var MIGRATION_007_CREDENTIAL_FREE_INSTALL = `-- ---------------------------------------------------------------------------
+-- Google Calendar \u2014 a credential-free install, from zero
+-- ---------------------------------------------------------------------------
+-- FAY-1359/1360. On 2026-08-12 the five plg_calendar_* tables were DROPPED from
+-- the beauty pool (gphxclpkbtbucoqclbco) together with both edge functions,
+-- because plg_calendar_integrations held the tenant's Google refresh token in an
+-- open column. A pool is one database for N clinics, so that column was one
+-- backup, one dump or one service_role key away from being every clinic's
+-- calendar.
+--
+-- This file is what a pool runs to have the connector back. It is deliberately
+-- SELF-CONTAINED rather than "001 through 006 again":
+--
+--   * 001 CREATEs the credential columns and 004 drops them. A pool restored by
+--     replaying the chain therefore holds a refresh-token column for the length
+--     of that replay, and holds it forever if the replay stops early \u2014 which is
+--     exactly what a half-applied ledger does. There is no ordering of those
+--     files in which the column never exists; there is this file, in which it
+--     never exists.
+--   * The beauty pool's ledger and its schema had already parted company (it
+--     recorded shop/0006b while tables up to 0043 were applied by hand). A
+--     recovery that depends on the ledger being right is not a recovery.
+--
+-- Re-runnable, and a near no-op on a pool that ran 001\u2013006: every statement is
+-- IF NOT EXISTS / DROP-then-CREATE, and \xA75 drops the credential columns if it
+-- finds them rather than assuming 004 ran.
+--
+--   \xA71  plg_calendar_integrations      \u2014 per-tenant sync state. NO credential.
+--   \xA72  plg_calendar_channels          \u2014 the de-para, incl. the webhook columns
+--   \xA73  plg_calendar_sync_log          \u2014 run history
+--   \xA74  plg_calendar_webhook_deliveries + plg_calendar_automation_outbox
+--   \xA75  the gate: this schema must not be able to hold a Google grant
+--
+-- WHAT OWNS WHAT, after this file (FAY-1388):
+--   the PLATFORM owns the credential \u2014 which Google account, authorized by
+--     whom, and the refresh token, in the vault, reachable only by redemption;
+--   plg_connections owns "is this connector on for this tenant", written by the
+--     app when consent comes back;
+--   these tables own the SYNC STATE \u2014 which calendars map to what, how far the
+--     cursor got, what Google last told us. Nothing here is a secret, and
+--     nothing here can be traded for access to anyone's calendar.
+-- ---------------------------------------------------------------------------
+
+-- ===========================================================================
+-- \xA71 \u2014 plg_calendar_integrations: one row per tenant, sync state only.
+--
+-- Same shape as 001 MINUS oauth_refresh_token, oauth_access_token and
+-- token_expires_at. There is no column here to put a token in, which is the
+-- property this migration exists to establish \u2014 see \xA75, which enforces it.
+--
+-- No FK to plg_connections on purpose. That table is the connector framework's
+-- and this one is the calendar's; a FK would make the connector's row a
+-- prerequisite for reading a cursor, and the two planes are meant to be able to
+-- fail independently.
+-- ===========================================================================
+CREATE TABLE IF NOT EXISTS public.plg_calendar_integrations (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  provider text NOT NULL DEFAULT 'google',
+  calendar_id text NOT NULL DEFAULT 'primary',
+  -- Incremental pull cursor + legacy single-calendar watch bookkeeping.
+  sync_token text,
+  channel_id text,
+  channel_resource_id text,
+  channel_expires_at timestamptz,
+  active boolean NOT NULL DEFAULT true,
+  last_sync_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE (tenant_id, provider)
+);
+ALTER TABLE public.plg_calendar_integrations ENABLE ROW LEVEL SECURITY;
+CREATE INDEX IF NOT EXISTS idx_plg_calendar_integrations_tenant
+  ON public.plg_calendar_integrations(tenant_id);
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.plg_calendar_integrations TO authenticated;
+GRANT ALL ON public.plg_calendar_integrations TO service_role;
+
+-- ===========================================================================
+-- \xA72 \u2014 plg_calendar_channels: the de-para, with 006's webhook columns folded in.
+-- ===========================================================================
+CREATE TABLE IF NOT EXISTS public.plg_calendar_channels (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  integration_id uuid NOT NULL REFERENCES public.plg_calendar_integrations(id) ON DELETE CASCADE,
+  tenant_id uuid NOT NULL,
+  google_calendar_id text NOT NULL,
+  summary text,
+  color text,
+  direction text NOT NULL DEFAULT 'bidirectional'
+    CHECK (direction IN ('inbound','outbound','bidirectional','off')),
+  target_kind text CHECK (target_kind IN ('assignee','service','location')),
+  target_id uuid,
+  import_mode text NOT NULL DEFAULT 'block'
+    CHECK (import_mode IN ('block','appointment')),
+  sync_token text,
+  channel_id text,
+  resource_id text,
+  channel_expires_at timestamptz,
+  is_active boolean NOT NULL DEFAULT true,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE (integration_id, google_calendar_id)
+);
+
+-- The webhook's authentication state. \`webhook_token_hash\` is a SHA-256 of the
+-- token handed to Google \u2014 the token itself is never stored, so reading this
+-- table does not let anyone forge a notification. Added by ALTER as well as in
+-- the CREATE above, for the pool that already has the table from 002.
+ALTER TABLE public.plg_calendar_channels
+  ADD COLUMN IF NOT EXISTS webhook_token_hash text;
+ALTER TABLE public.plg_calendar_channels
+  ADD COLUMN IF NOT EXISTS last_webhook_message_number bigint;
+ALTER TABLE public.plg_calendar_channels
+  ADD COLUMN IF NOT EXISTS last_webhook_at timestamptz;
+
+CREATE INDEX IF NOT EXISTS idx_plg_calendar_channels_tenant
+  ON public.plg_calendar_channels(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_plg_calendar_channels_integration
+  ON public.plg_calendar_channels(integration_id);
+
+ALTER TABLE public.plg_calendar_channels ENABLE ROW LEVEL SECURITY;
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.plg_calendar_channels TO authenticated;
+GRANT ALL ON public.plg_calendar_channels TO service_role;
+
+DROP TRIGGER IF EXISTS plg_calendar_channels_updated_at ON public.plg_calendar_channels;
+CREATE TRIGGER plg_calendar_channels_updated_at BEFORE UPDATE ON public.plg_calendar_channels
+  FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
+
+-- ===========================================================================
+-- \xA73 \u2014 plg_calendar_sync_log: what already happened, per run.
+-- ===========================================================================
+CREATE TABLE IF NOT EXISTS public.plg_calendar_sync_log (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  direction text NOT NULL,                 -- inbound | outbound
+  trigger text,                            -- on-write | scheduled | webhook | manual
+  status text NOT NULL DEFAULT 'success',  -- success | partial | error
+  fetched integer NOT NULL DEFAULT 0,
+  written integer NOT NULL DEFAULT 0,
+  error text,
+  correlation_id uuid,
+  channel_id_ref uuid,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+ALTER TABLE public.plg_calendar_sync_log ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.plg_calendar_sync_log ADD COLUMN IF NOT EXISTS correlation_id uuid;
+ALTER TABLE public.plg_calendar_sync_log ADD COLUMN IF NOT EXISTS channel_id_ref uuid;
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.plg_calendar_sync_log TO authenticated;
+GRANT ALL ON public.plg_calendar_sync_log TO service_role;
+
+-- RLS: tenant isolation for the three tables the app reads and writes.
+DO $$
+DECLARE t text;
+BEGIN
+  FOR t IN SELECT unnest(ARRAY[
+    'plg_calendar_integrations',
+    'plg_calendar_channels',
+    'plg_calendar_sync_log'
+  ])
+  LOOP
+    IF NOT EXISTS (
+      SELECT 1 FROM pg_policies WHERE schemaname='public' AND tablename=t AND policyname=t||'_rls'
+    ) THEN
+      EXECUTE format(
+        'CREATE POLICY %I ON public.%I FOR ALL TO authenticated '
+        'USING (tenant_id IN (SELECT public.user_tenant_ids())) '
+        'WITH CHECK (tenant_id IN (SELECT public.user_tenant_ids()))',
+        t||'_rls', t);
+    END IF;
+    IF NOT EXISTS (
+      SELECT 1 FROM pg_policies WHERE schemaname='public' AND tablename=t AND policyname=t||'_service'
+    ) THEN
+      EXECUTE format(
+        'CREATE POLICY %I ON public.%I FOR ALL TO service_role USING (true) WITH CHECK (true)',
+        t||'_service', t);
+    END IF;
+  END LOOP;
+END $$;
+
+-- ===========================================================================
+-- \xA74 \u2014 Webhook intake: the delivery ledger and the automation outbox.
+--
+-- The delivery row IS the idempotency mechanism: the webhook inserts before
+-- doing any work and reads a 23505 as "already handled". Google retries hard,
+-- so this is what stops one notification becoming two appointments.
+-- ===========================================================================
+CREATE TABLE IF NOT EXISTS public.plg_calendar_webhook_deliveries (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL,
+  channel_ref uuid NOT NULL REFERENCES public.plg_calendar_channels(id) ON DELETE CASCADE,
+  google_channel_id text NOT NULL,
+  resource_id text,
+  message_number bigint NOT NULL,
+  resource_state text,
+  status text NOT NULL DEFAULT 'pending'
+    CHECK (status IN ('pending','processing','processed','failed','ignored')),
+  error text,
+  received_at timestamptz NOT NULL DEFAULT now(),
+  processed_at timestamptz,
+  created_at timestamptz DEFAULT now(),
+  UNIQUE (channel_ref, message_number)
+);
+
+-- Catches a replay that arrives after the channel row was recreated with the
+-- same Google channel id \u2014 the FK-scoped constraint above cannot see that.
+CREATE UNIQUE INDEX IF NOT EXISTS uq_plg_calendar_webhook_delivery_message
+  ON public.plg_calendar_webhook_deliveries (google_channel_id, message_number);
+CREATE INDEX IF NOT EXISTS idx_plg_calendar_webhook_deliveries_tenant_created
+  ON public.plg_calendar_webhook_deliveries (tenant_id, created_at DESC);
+CREATE INDEX IF NOT EXISTS idx_plg_calendar_webhook_deliveries_pending
+  ON public.plg_calendar_webhook_deliveries (status, created_at)
+  WHERE status IN ('pending','failed');
+
+ALTER TABLE public.plg_calendar_webhook_deliveries ENABLE ROW LEVEL SECURITY;
+-- Read-only for the app: every write comes from the webhook function as
+-- service_role, so a browser cannot forge or retire a delivery.
+GRANT SELECT ON public.plg_calendar_webhook_deliveries TO authenticated;
+GRANT ALL ON public.plg_calendar_webhook_deliveries TO service_role;
+
+DROP POLICY IF EXISTS plg_calendar_webhook_deliveries_read ON public.plg_calendar_webhook_deliveries;
+CREATE POLICY plg_calendar_webhook_deliveries_read ON public.plg_calendar_webhook_deliveries
+  FOR SELECT TO authenticated
+  USING (tenant_id IN (SELECT public.user_tenant_ids()));
+
+CREATE TABLE IF NOT EXISTS public.plg_calendar_automation_outbox (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL,
+  source text NOT NULL DEFAULT 'google_calendar',
+  event_type text NOT NULL,
+  aggregate_type text NOT NULL,
+  aggregate_id text,
+  idempotency_key text NOT NULL,
+  payload jsonb NOT NULL DEFAULT '{}'::jsonb,
+  status text NOT NULL DEFAULT 'pending'
+    CHECK (status IN ('pending','processing','processed','failed','ignored')),
+  attempts integer NOT NULL DEFAULT 0,
+  last_error text,
+  occurred_at timestamptz NOT NULL DEFAULT now(),
+  -- available_at is the retry clock: a failed row is re-eligible once it passes.
+  available_at timestamptz NOT NULL DEFAULT now(),
+  processed_at timestamptz,
+  error text,
+  created_at timestamptz DEFAULT now(),
+  UNIQUE (tenant_id, idempotency_key)
+);
+
+CREATE INDEX IF NOT EXISTS idx_plg_calendar_automation_outbox_pending
+  ON public.plg_calendar_automation_outbox (status, available_at, created_at)
+  WHERE status IN ('pending','failed');
+
+ALTER TABLE public.plg_calendar_automation_outbox ENABLE ROW LEVEL SECURITY;
+GRANT SELECT ON public.plg_calendar_automation_outbox TO authenticated;
+GRANT ALL ON public.plg_calendar_automation_outbox TO service_role;
+
+DROP POLICY IF EXISTS plg_calendar_automation_outbox_read ON public.plg_calendar_automation_outbox;
+CREATE POLICY plg_calendar_automation_outbox_read ON public.plg_calendar_automation_outbox
+  FOR SELECT TO authenticated
+  USING (tenant_id IN (SELECT public.user_tenant_ids()));
+
+-- ===========================================================================
+-- \xA75 \u2014 The gate.
+--
+-- Everything above is a CREATE, and a CREATE says nothing about a pool that
+-- already has the old shape. This block is the part that actually removes the
+-- hole: it drops the three credential columns wherever it finds them \u2014 the
+-- pool 004 never reached, the pool restored from an old backup, the pool
+-- someone re-provisioned from 001 \u2014 and then refuses to finish if any survived.
+--
+-- The RAISE matters more than the DROP. A migration that silently tolerated a
+-- token column is how this schema kept one for months.
+-- ===========================================================================
+DO $$
+DECLARE
+  leftover text;
+BEGIN
+  ALTER TABLE IF EXISTS public.plg_calendar_integrations DROP COLUMN IF EXISTS oauth_refresh_token;
+  ALTER TABLE IF EXISTS public.plg_calendar_integrations DROP COLUMN IF EXISTS oauth_access_token;
+  ALTER TABLE IF EXISTS public.plg_calendar_integrations DROP COLUMN IF EXISTS token_expires_at;
+
+  SELECT string_agg(table_name || '.' || column_name, ', ')
+    INTO leftover
+    FROM information_schema.columns
+   WHERE table_schema = 'public'
+     AND table_name LIKE 'plg_calendar%'
+     AND (
+       column_name LIKE '%refresh_token%'
+       OR column_name LIKE '%access_token%'
+       OR column_name IN ('oauth_token', 'client_secret', 'api_key')
+     );
+
+  IF leftover IS NOT NULL THEN
+    RAISE EXCEPTION
+      'Google Calendar schema still holds credential columns: %. The grant belongs in the platform vault (FAY-1359); redeem it at run time instead.',
+      leftover;
+  END IF;
+END $$;
+
+-- Dropping the columns does not erase what was in them: Postgres leaves the old
+-- values in the heap until the next table rewrite. Any grant that ever reached a
+-- pool must be REVOKED AT GOOGLE, not assumed gone \u2014 which is also why every
+-- tenant re-consents after this file runs.
+`;
+
+// src/integrations/google-calendar/connector.ts
+var googleCalendarConnector = {
+  id: "google-calendar",
+  provider: "google",
+  pluginId: "agenda",
+  authKind: "oauth",
+  capabilities: [
+    {
+      entity: "booking",
+      direction: "bidirectional",
+      triggers: ["on-write", "scheduled", "webhook"]
+    }
+  ]
+};
+
+// src/integrations/google-calendar/index.ts
+function createGoogleCalendarPlugin() {
+  return {
+    id: "google-calendar",
+    name: "Google Calendar",
+    icon: "Calendar",
+    version: "0.1.0",
+    scope: "addon",
+    defaultEnabled: true,
+    dependencies: ["agenda"],
+    navigation: [],
+    routes: [],
+    connectors: [googleCalendarConnectorDef],
+    functions: [
+      {
+        slug: "google-calendar-sync",
+        // Not reached through the Fayz ingress: it is called from the browser
+        // (calendar list, sync now, import), from the appointments trigger and
+        // from the webhook function. Consent is NOT in that list any more — it
+        // moved to the platform (FAY-1359/1360), which is also why this function
+        // no longer answers GET.
+        ingress: "none",
+        // FALSE, and here it is a decision rather than a gap: two of its callers
+        // cannot present a JWT — the DB trigger sends a Vault secret as bearer
+        // and pg_cron/the webhook send the service-role key. The gateway would
+        // reject both before a line of the function runs. Authorization lives one
+        // level in: `isServiceRequest` for the service actions, a Supabase user
+        // plus tenant membership for the rest, and `tenantId` is required on both.
+        verifyJwt: false,
+        // NAMES only — and no Google client pair among them any more. The client
+        // secret and the tenant's grant are both the platform's; this function
+        // redeems a short-lived access token per call with the three names below.
+        // SUPABASE_SERVICE_ROLE_KEY is listed because the function reads it
+        // TODAY — it is the pool-wide privilege the 2026-08-11 ADR is written
+        // to remove, and hiding it from the manifest would hide the debt.
+        secrets: [
+          "FAYZ_API_URL",
+          "FAYZ_PROJECT_ID",
+          "CONNECTOR_REDEMPTION_SECRET",
+          "GCAL_OUTBOUND_SECRET",
+          "SUPABASE_URL",
+          "SUPABASE_SERVICE_ROLE_KEY"
+        ],
+        // The RPCs the function's credential should be allowed to call once it
+        // stops holding service_role. Both already exist (002/003) and are
+        // already how the inbound writes are applied; what is missing is the
+        // credential that can call these and nothing else.
+        grants: ["gcal_import_event", "gcal_apply_event_patch"]
+      },
+      {
+        // Declared for the first time (FAY-1379). It had been ACTIVE in the live
+        // pool since 2026-05 with no source in any repo — the manifest could not
+        // name what nobody could read.
+        slug: "google-calendar-webhook",
+        // Google POSTs here directly; there is no ingress to put in front of it.
+        ingress: "none",
+        // FALSE, and here it is a correct decision rather than a gap: Google
+        // sends no Authorization header at all. The credential is the per-channel
+        // token, checked against a stored SHA-256 in constant time, with the
+        // resource id and a monotonic message number as the replay guard.
+        verifyJwt: false,
+        // NAMES only. GCAL_OUTBOUND_SECRET is the shared secret this function
+        // presents when it asks google-calendar-sync to pull — the same secret
+        // the DB trigger uses. SUPABASE_SERVICE_ROLE_KEY is listed because the
+        // function reads it TODAY, same declared debt as the sync function.
+        secrets: [
+          "SUPABASE_URL",
+          "SUPABASE_SERVICE_ROLE_KEY",
+          "GCAL_OUTBOUND_SECRET",
+          "GCAL_SYNC_FUNCTION_URL",
+          "GCAL_WEBHOOK_AUTO_PULL"
+        ],
+        // It calls no RPC: it writes the delivery row and the outbox, and
+        // delegates every appointment write to google-calendar-sync.
+        grants: []
+      }
+    ],
+    // Declared for the first time. Without this the connector's SQL was
+    // reachable only by whoever remembered the folder — which is how a table
+    // holding plaintext OAuth tokens shipped with nothing to gate it.
+    migrations: [
+      {
+        id: "google-calendar-001_google_calendar",
+        version: "0.1.0",
+        sql: MIGRATION_001_GOOGLE_CALENDAR,
+        description: "plg_calendar_integrations + plg_calendar_sync_log with tenant RLS, and the outbound appointments trigger"
+      },
+      {
+        id: "google-calendar-002_smart_sync",
+        version: "0.1.0",
+        sql: MIGRATION_002_SMART_SYNC,
+        description: "plg_calendar_channels (per-calendar de-para) + gcal_import_event / gcal_apply_event_patch"
+      },
+      {
+        id: "google-calendar-003_plg_rename",
+        version: "0.1.0",
+        sql: MIGRATION_003_PLG_RENAME,
+        description: "Rename legacy calendar_* tables to the plg_calendar_* prefix and repoint the RPCs"
+      },
+      {
+        id: "google-calendar-004_drop_oauth_tokens",
+        version: "0.9.1",
+        sql: MIGRATION_004_DROP_OAUTH_TOKENS,
+        description: "Drop plg_calendar_integrations.oauth_refresh_token/oauth_access_token (destination: the Fayz platform credential store \u2014 only inside FAY-1359 ordered rollout), give the outbound trigger an anti-loop guard and a safe no-op, and publish appointments for realtime"
+      },
+      {
+        id: "google-calendar-005_outbound_vault_delivery",
+        version: "0.9.2",
+        sql: MIGRATION_005_OUTBOUND_VAULT_DELIVERY,
+        description: "Take the outbound credential from the vault secret gcal_outbound_secret instead of the service-role key in app.gcal_service_key, keeping the Authorization header the sync function authorises on, and falling back to the old setting so a legacy pool is never silently disarmed"
+      },
+      {
+        id: "google-calendar-006_webhook_deliveries_outbox",
+        version: "0.9.2",
+        sql: MIGRATION_006_WEBHOOK_DELIVERIES_OUTBOX,
+        description: "Reconstructed from the live pool (FAY-1379): the webhook columns on plg_calendar_channels plus plg_calendar_webhook_deliveries and plg_calendar_automation_outbox with RLS. Both deployed functions write these and no migration created them, so a fresh pool could not run the webhook at all"
+      },
+      {
+        id: "google-calendar-007_credential_free_install",
+        version: "0.9.3",
+        sql: MIGRATION_007_CREDENTIAL_FREE_INSTALL,
+        description: "Install the whole connector schema in its post-FAY-1359 shape, from zero, with no credential column at any point \u2014 the five tables the beauty pool had dropped, plus a gate that drops a token column wherever it is still found and refuses to finish if one survives"
+      }
+    ]
   };
 }
 
@@ -5654,6 +7975,7 @@ function createGoogleCalendarPlugin() {
 function createAgendaPlugin(options) {
   const config = resolveConfig(options);
   registerTranslations(agendaLocales);
+  registerMessageDefaults(buildAgendaMessageDefaults());
   const provider2 = options?.dataProvider ?? createSafeDataProvider(
     () => createSupabaseAgendaProvider({ professionalKind: config.professionalKind }),
     () => createMockAgendaProvider()
@@ -5688,6 +8010,8 @@ function createAgendaPlugin(options) {
     scaffolds: ["saas"],
     defaultEnabled: true,
     dependencies: [],
+    // Os FATOS da agenda — só expostos enquanto o módulo está ATIVO.
+    events: buildAgendaDomainEvents(),
     declaredFeatures: [
       { id: "appointments", label: config.labels.pageTitle, group: config.labels.pageTitle },
       { id: "agenda.schedules", label: "Schedule Management", group: config.labels.pageTitle }
@@ -5889,10 +8213,14 @@ function createAgendaPlugin(options) {
         description: "Booking read model (v_appointments) + anon public booking surface (v_public_services, get_available_slots, create_public_booking) + order_items duration/assignee columns"
       }
     ],
+    // Google Calendar is the connector this module's addon already ships;
+    // Calendly and WhatsApp are the two the Fayz plugin page has been
+    // promising since the catalogue was written.
+    integrations: ["google-calendar", "calendly", "whatsapp"],
     locales: agendaLocales
   };
 }
 
-export { bookingToEvent2 as bookingToEvent, computeCommissionAmount, createAgendaPlugin, createFinancialBridge, createGoogleCalendarPlugin, createGoogleCalendarProvider, eventToBookingPatch, googleCalendarConnector };
+export { bookingToEvent2 as bookingToEvent, buildAgendaDomainEvents, buildAgendaMessageDefaults, computeCommissionAmount, createAgendaPlugin, createFinancialBridge, createGoogleCalendarPlugin, createGoogleCalendarProvider, eventToBookingPatch, googleCalendarConnector };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map