@amalgm/channels 0.1.1 → 0.1.3

package/supabase/migrations/20260903000000_bidirectional_email.sql

@@ -0,0 +1,630 @@
+-- Bidirectional email: provider events are admitted once, one external thread
+-- owns one local Chat session, and only its DPoP-bound computer can claim work.
+
+CREATE TABLE IF NOT EXISTS amalgm_channel_threads (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id uuid NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
+  channel text NOT NULL CHECK (channel = 'email'),
+  session_id text NOT NULL CHECK (length(session_id) BETWEEN 1 AND 200),
+  computer_id uuid REFERENCES user_computers(id) ON DELETE RESTRICT,
+  subject text NOT NULL CHECK (length(subject) BETWEEN 1 AND 500),
+  last_message_id text,
+  message_references text[] NOT NULL DEFAULT '{}',
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE (user_id, channel, session_id)
+);
+
+ALTER TABLE amalgm_channel_threads ENABLE ROW LEVEL SECURITY;
+REVOKE ALL ON amalgm_channel_threads FROM anon, authenticated;
+GRANT SELECT, INSERT, UPDATE ON amalgm_channel_threads TO service_role;
+
+ALTER TABLE amalgm_channel_deliveries
+  DROP CONSTRAINT IF EXISTS amalgm_channel_deliveries_status_check;
+ALTER TABLE amalgm_channel_deliveries
+  ADD CONSTRAINT amalgm_channel_deliveries_status_check
+    CHECK (status IN ('pending', 'sending', 'sent', 'delivered', 'failed')),
+  ADD COLUMN IF NOT EXISTS thread_id uuid REFERENCES amalgm_channel_threads(id) ON DELETE RESTRICT,
+  ADD COLUMN IF NOT EXISTS session_id text,
+  ADD COLUMN IF NOT EXISTS computer_id uuid REFERENCES user_computers(id) ON DELETE RESTRICT,
+  ADD COLUMN IF NOT EXISTS rfc_message_id text,
+  ADD COLUMN IF NOT EXISTS available_at timestamptz NOT NULL DEFAULT now();
+
+CREATE UNIQUE INDEX IF NOT EXISTS amalgm_channel_deliveries_rfc_message
+  ON amalgm_channel_deliveries(user_id, rfc_message_id)
+  WHERE rfc_message_id IS NOT NULL;
+CREATE INDEX IF NOT EXISTS amalgm_channel_deliveries_provider_message
+  ON amalgm_channel_deliveries(user_id, provider_id)
+  WHERE provider_id IS NOT NULL;
+
+CREATE TABLE IF NOT EXISTS amalgm_channel_inbound (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  provider_event_id text NOT NULL UNIQUE,
+  provider_email_id text NOT NULL UNIQUE,
+  provider_message_id text NOT NULL,
+  user_id uuid REFERENCES auth.users(id) ON DELETE CASCADE,
+  channel text NOT NULL DEFAULT 'email' CHECK (channel = 'email'),
+  thread_id uuid REFERENCES amalgm_channel_threads(id) ON DELETE RESTRICT,
+  session_id text,
+  target_computer_id uuid REFERENCES user_computers(id) ON DELETE RESTRICT,
+  starts_session boolean NOT NULL DEFAULT false,
+  sender_email text NOT NULL,
+  subject text NOT NULL CHECK (length(subject) BETWEEN 1 AND 500),
+  message text,
+  message_references text[] NOT NULL DEFAULT '{}',
+  status text NOT NULL CHECK (status IN ('pending', 'claimed', 'accepted', 'rejected')),
+  attempts integer NOT NULL DEFAULT 0 CHECK (attempts >= 0),
+  available_at timestamptz NOT NULL DEFAULT now(),
+  lease_token uuid,
+  lease_expires_at timestamptz,
+  error text,
+  notice_provider_id text,
+  received_at timestamptz NOT NULL,
+  accepted_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CHECK (
+    (status = 'claimed' AND lease_token IS NOT NULL AND lease_expires_at IS NOT NULL AND message IS NOT NULL)
+    OR (status = 'pending' AND lease_token IS NULL AND lease_expires_at IS NULL AND message IS NOT NULL)
+    OR (status IN ('accepted', 'rejected') AND lease_token IS NULL AND lease_expires_at IS NULL AND message IS NULL)
+  )
+);
+
+CREATE INDEX IF NOT EXISTS amalgm_channel_inbound_machine_work
+  ON amalgm_channel_inbound(target_computer_id, status, available_at, received_at, id)
+  WHERE status IN ('pending', 'claimed');
+CREATE INDEX IF NOT EXISTS amalgm_channel_inbound_thread_message
+  ON amalgm_channel_inbound(user_id, provider_message_id)
+  WHERE user_id IS NOT NULL;
+
+ALTER TABLE amalgm_channel_inbound ENABLE ROW LEVEL SECURITY;
+REVOKE ALL ON amalgm_channel_inbound FROM anon, authenticated;
+GRANT SELECT, INSERT, UPDATE ON amalgm_channel_inbound TO service_role;
+
+CREATE TABLE IF NOT EXISTS amalgm_channel_provider_events (
+  provider_event_id text PRIMARY KEY,
+  provider_email_id text NOT NULL,
+  event_type text NOT NULL,
+  occurred_at timestamptz NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+
+ALTER TABLE amalgm_channel_provider_events ENABLE ROW LEVEL SECURITY;
+REVOKE ALL ON amalgm_channel_provider_events FROM anon, authenticated;
+GRANT SELECT, INSERT ON amalgm_channel_provider_events TO service_role;
+
+CREATE OR REPLACE FUNCTION amalgm_channel_reference_tail(p_values text[])
+RETURNS text[]
+LANGUAGE sql
+IMMUTABLE
+SET search_path = public
+AS $$
+  SELECT COALESCE(array_agg(value ORDER BY last_ordinal), '{}')
+  FROM (
+    SELECT value, max(ordinal) AS last_ordinal
+    FROM unnest(COALESCE(p_values, '{}')) WITH ORDINALITY AS refs(value, ordinal)
+    WHERE value IS NOT NULL AND value <> ''
+    GROUP BY value
+    ORDER BY max(ordinal) DESC
+    LIMIT 50
+  ) recent;
+$$;
+
+CREATE OR REPLACE FUNCTION amalgm_channel_delivery_json(p_row amalgm_channel_deliveries)
+RETURNS jsonb
+LANGUAGE sql
+IMMUTABLE
+SET search_path = public
+AS $$
+  SELECT jsonb_strip_nulls(jsonb_build_object(
+    'id', p_row.id,
+    'channel', p_row.channel,
+    'title', p_row.title,
+    'message', p_row.message,
+    'idempotency_key', p_row.idempotency_key,
+    'status', p_row.status,
+    'attempts', p_row.attempts,
+    'created_at', p_row.created_at,
+    'updated_at', p_row.updated_at,
+    'delivered_at', p_row.delivered_at,
+    'provider_id', p_row.provider_id,
+    'thread_id', p_row.thread_id,
+    'session_id', p_row.session_id,
+    'error', p_row.error
+  ));
+$$;
+
+DROP FUNCTION IF EXISTS enqueue_amalgm_channel_delivery(uuid, jsonb);
+CREATE OR REPLACE FUNCTION enqueue_amalgm_channel_delivery(
+  p_user_id uuid,
+  p_computer_id uuid,
+  p_delivery jsonb,
+  p_session_id text
+) RETURNS jsonb
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public, auth
+AS $$
+DECLARE
+  v_row public.amalgm_channel_deliveries;
+  v_thread public.amalgm_channel_threads;
+  v_channel text := CASE WHEN p_delivery->>'channel' = 'auto' THEN 'email' ELSE p_delivery->>'channel' END;
+  v_computer_id uuid := p_computer_id;
+  v_session_id text := NULLIF(btrim(p_session_id), '');
+  v_delivery_id uuid := gen_random_uuid();
+BEGIN
+  IF v_channel <> 'email' THEN RAISE EXCEPTION 'unsupported channel' USING ERRCODE = '22023'; END IF;
+
+  SELECT * INTO v_row
+  FROM public.amalgm_channel_deliveries
+  WHERE user_id = p_user_id AND idempotency_key = p_delivery->>'idempotencyKey';
+  IF FOUND THEN
+    IF v_row.channel <> v_channel
+      OR v_row.title IS DISTINCT FROM NULLIF(p_delivery->>'title', '')
+      OR v_row.message <> p_delivery->>'message'
+      OR (v_session_id IS NOT NULL AND v_row.session_id IS DISTINCT FROM v_session_id)
+    THEN
+      RAISE EXCEPTION 'idempotency key already names another delivery' USING ERRCODE = '23505';
+    END IF;
+    RETURN public.amalgm_channel_delivery_json(v_row);
+  END IF;
+
+  IF v_session_id IS NOT NULL THEN
+    SELECT * INTO v_thread FROM public.amalgm_channel_threads
+    WHERE user_id = p_user_id AND channel = v_channel AND session_id = v_session_id;
+  END IF;
+
+  IF NOT FOUND THEN
+    IF v_computer_id IS NOT NULL AND NOT EXISTS (
+      SELECT 1 FROM public.user_computers WHERE id = v_computer_id AND user_id = p_user_id
+    ) THEN
+      RAISE EXCEPTION 'computer does not belong to user' USING ERRCODE = '22023';
+    END IF;
+    IF v_computer_id IS NULL THEN
+      SELECT COALESCE(up.last_used_computer_id, up.default_computer_id) INTO v_computer_id
+      FROM public.user_preferences up WHERE up.user_id = p_user_id;
+    END IF;
+    IF v_computer_id IS NULL THEN
+      SELECT id INTO v_computer_id FROM public.user_computers
+      WHERE user_id = p_user_id ORDER BY last_seen_at DESC NULLS LAST, updated_at DESC LIMIT 1;
+    END IF;
+    IF v_computer_id IS NULL THEN RAISE EXCEPTION 'user has no computer' USING ERRCODE = '22023'; END IF;
+    v_session_id := COALESCE(v_session_id, gen_random_uuid()::text);
+    INSERT INTO public.amalgm_channel_threads(user_id, channel, session_id, computer_id, subject)
+    VALUES (p_user_id, v_channel, v_session_id, v_computer_id, p_delivery->>'title')
+    ON CONFLICT (user_id, channel, session_id) DO UPDATE
+      SET session_id = EXCLUDED.session_id
+    RETURNING * INTO v_thread;
+  END IF;
+
+  INSERT INTO public.amalgm_channel_deliveries(
+    id, user_id, channel, title, message, idempotency_key,
+    thread_id, session_id, computer_id, rfc_message_id
+  ) VALUES (
+    v_delivery_id, p_user_id, v_channel, NULLIF(p_delivery->>'title', ''),
+    p_delivery->>'message', p_delivery->>'idempotencyKey',
+    v_thread.id, v_thread.session_id, v_thread.computer_id,
+    '<' || v_delivery_id::text || '@amalgm.ai>'
+  )
+  ON CONFLICT (user_id, idempotency_key) DO NOTHING
+  RETURNING * INTO v_row;
+  IF NOT FOUND THEN
+    SELECT * INTO v_row FROM public.amalgm_channel_deliveries
+    WHERE user_id = p_user_id AND idempotency_key = p_delivery->>'idempotencyKey';
+    IF v_row.channel <> v_channel
+      OR v_row.title IS DISTINCT FROM NULLIF(p_delivery->>'title', '')
+      OR v_row.message <> p_delivery->>'message'
+      OR v_row.session_id IS DISTINCT FROM v_thread.session_id
+    THEN
+      RAISE EXCEPTION 'idempotency key already names another delivery' USING ERRCODE = '23505';
+    END IF;
+  END IF;
+  RETURN public.amalgm_channel_delivery_json(v_row);
+END;
+$$;
+
+DROP FUNCTION IF EXISTS claim_amalgm_channel_deliveries(integer, integer);
+CREATE OR REPLACE FUNCTION claim_amalgm_channel_deliveries(
+  p_limit integer,
+  p_lease_seconds integer
+) RETURNS TABLE (
+  id uuid, user_id uuid, channel text, title text, message text,
+  idempotency_key text, lease_token uuid, attempts integer,
+  thread_id uuid, session_id text, thread_subject text, rfc_message_id text,
+  reply_to_message_id text, "references" text[]
+)
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+  WITH candidates AS (
+    SELECT d.id
+    FROM public.amalgm_channel_deliveries d
+    WHERE d.attempts < 5
+      AND (
+        (d.status = 'pending' AND d.available_at <= now())
+        OR (d.status = 'sending' AND d.lease_expires_at <= now())
+      )
+    ORDER BY d.available_at, d.created_at, d.id
+    FOR UPDATE SKIP LOCKED
+    LIMIT LEAST(GREATEST(p_limit, 1), 100)
+  ), claimed AS (
+    UPDATE public.amalgm_channel_deliveries d SET
+      status = 'sending', attempts = d.attempts + 1,
+      lease_token = gen_random_uuid(),
+      lease_expires_at = now() + make_interval(secs => LEAST(GREATEST(p_lease_seconds, 10), 600)),
+      updated_at = now()
+    FROM candidates WHERE d.id = candidates.id
+    RETURNING d.*
+  )
+  SELECT c.id, c.user_id, c.channel, c.title, c.message,
+    c.idempotency_key, c.lease_token, c.attempts,
+    t.id, t.session_id, t.subject, c.rfc_message_id,
+    t.last_message_id, t.message_references
+  FROM claimed c JOIN public.amalgm_channel_threads t ON t.id = c.thread_id;
+$$;
+
+DROP FUNCTION IF EXISTS complete_amalgm_channel_delivery(uuid, uuid, text, timestamptz);
+CREATE OR REPLACE FUNCTION mark_amalgm_channel_delivery_sent(
+  p_delivery_id uuid,
+  p_lease_token uuid,
+  p_provider_id text,
+  p_now timestamptz
+) RETURNS boolean
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+BEGIN
+  UPDATE public.amalgm_channel_deliveries SET
+    status = 'sent', provider_id = left(p_provider_id, 500), error = NULL,
+    lease_token = NULL, lease_expires_at = NULL, updated_at = p_now
+  WHERE id = p_delivery_id AND status = 'sending' AND lease_token = p_lease_token;
+  RETURN FOUND;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION fail_amalgm_channel_delivery(
+  p_delivery_id uuid,
+  p_lease_token uuid,
+  p_error text,
+  p_now timestamptz
+) RETURNS boolean
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+BEGIN
+  UPDATE public.amalgm_channel_deliveries SET
+    status = CASE WHEN attempts >= 5 THEN 'failed' ELSE 'pending' END,
+    available_at = p_now + make_interval(secs => LEAST(300, 5 * (2 ^ LEAST(attempts, 6))::integer)),
+    error = left(p_error, 500), lease_token = NULL, lease_expires_at = NULL,
+    updated_at = p_now
+  WHERE id = p_delivery_id AND status = 'sending' AND lease_token = p_lease_token;
+  RETURN FOUND;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION next_amalgm_channel_delivery_at()
+RETURNS timestamptz
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+  SELECT min(ready_at) FROM (
+    SELECT available_at AS ready_at FROM public.amalgm_channel_deliveries
+    WHERE status = 'pending' AND attempts < 5
+    UNION ALL
+    SELECT lease_expires_at FROM public.amalgm_channel_deliveries
+    WHERE status = 'sending' AND attempts < 5
+  ) work;
+$$;
+
+CREATE OR REPLACE FUNCTION admit_amalgm_channel_email(p_email jsonb)
+RETURNS jsonb
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public, auth
+AS $$
+DECLARE
+  v_existing public.amalgm_channel_inbound;
+  v_user_id uuid;
+  v_thread public.amalgm_channel_threads;
+  v_message public.amalgm_channel_inbound;
+  v_computer_id uuid;
+  v_computer_name text;
+  v_online boolean := false;
+  v_starts_session boolean := false;
+  v_reply_id text;
+BEGIN
+  SELECT * INTO v_existing FROM public.amalgm_channel_inbound
+  WHERE provider_email_id = p_email->>'providerEmailId'
+     OR provider_event_id = p_email->>'providerEventId'
+  LIMIT 1;
+  IF FOUND THEN
+    IF v_existing.status = 'rejected' THEN
+      RETURN jsonb_build_object(
+        'kind', CASE WHEN v_existing.user_id IS NULL THEN 'unknown_sender' ELSE 'no_computer' END,
+        'record_id', v_existing.id, 'sender_email', v_existing.sender_email,
+        'subject', v_existing.subject, 'provider_message_id', v_existing.provider_message_id,
+        'references', v_existing.message_references
+      );
+    END IF;
+    RETURN jsonb_build_object(
+      'kind', 'accepted', 'user_id', v_existing.user_id, 'message_id', v_existing.id,
+      'thread_id', v_existing.thread_id, 'session_id', v_existing.session_id,
+      'target_computer_id', v_existing.target_computer_id,
+      'target_computer_name', COALESCE((SELECT name FROM public.user_computers WHERE id = v_existing.target_computer_id), 'Your computer'),
+      'target_online', EXISTS(SELECT 1 FROM public.user_computers WHERE id = v_existing.target_computer_id AND status = 'online'),
+      'sender_email', v_existing.sender_email, 'subject', v_existing.subject,
+      'provider_message_id', v_existing.provider_message_id, 'references', v_existing.message_references
+    );
+  END IF;
+
+  SELECT id INTO v_user_id FROM auth.users
+  WHERE lower(email) = lower(p_email->>'senderEmail') LIMIT 1;
+  IF v_user_id IS NULL THEN
+    INSERT INTO public.amalgm_channel_inbound(
+      provider_event_id, provider_email_id, provider_message_id,
+      sender_email, subject, message, message_references, status, received_at
+    ) VALUES (
+      p_email->>'providerEventId', p_email->>'providerEmailId', p_email->>'providerMessageId',
+      p_email->>'senderEmail', p_email->>'subject', NULL,
+      COALESCE(ARRAY(SELECT jsonb_array_elements_text(p_email->'replyMessageIds')), '{}'),
+      'rejected', (p_email->>'receivedAt')::timestamptz
+    ) RETURNING * INTO v_message;
+    RETURN jsonb_build_object(
+      'kind', 'unknown_sender', 'record_id', v_message.id,
+      'sender_email', v_message.sender_email, 'subject', v_message.subject,
+      'provider_message_id', v_message.provider_message_id, 'references', v_message.message_references
+    );
+  END IF;
+
+  -- A signed reply address narrows a real reply; copying that address into a
+  -- fresh composition does not turn the new root into the old thread.
+  IF p_email ? 'threadHintId'
+    AND jsonb_array_length(COALESCE(p_email->'replyMessageIds', '[]'::jsonb)) > 0
+  THEN
+    SELECT * INTO v_thread FROM public.amalgm_channel_threads
+    WHERE id = (p_email->>'threadHintId')::uuid AND user_id = v_user_id AND channel = 'email';
+  END IF;
+  IF v_thread.id IS NULL THEN
+    FOR v_reply_id IN SELECT jsonb_array_elements_text(COALESCE(p_email->'replyMessageIds', '[]'::jsonb)) LOOP
+      SELECT t.* INTO v_thread
+      FROM public.amalgm_channel_threads t
+      WHERE t.user_id = v_user_id AND t.channel = 'email' AND (
+        EXISTS(SELECT 1 FROM public.amalgm_channel_deliveries d
+          WHERE d.thread_id = t.id AND (d.rfc_message_id = v_reply_id OR d.provider_id = v_reply_id))
+        OR EXISTS(SELECT 1 FROM public.amalgm_channel_inbound i
+          WHERE i.thread_id = t.id AND i.provider_message_id = v_reply_id)
+      ) LIMIT 1;
+      EXIT WHEN v_thread.id IS NOT NULL;
+    END LOOP;
+  END IF;
+
+  IF v_thread.id IS NULL THEN
+    SELECT COALESCE(up.last_used_computer_id, up.default_computer_id) INTO v_computer_id
+    FROM public.user_preferences up WHERE up.user_id = v_user_id;
+    IF v_computer_id IS NULL THEN
+      SELECT id INTO v_computer_id FROM public.user_computers
+      WHERE user_id = v_user_id ORDER BY last_seen_at DESC NULLS LAST, updated_at DESC LIMIT 1;
+    END IF;
+    IF v_computer_id IS NULL THEN
+      INSERT INTO public.amalgm_channel_inbound(
+        provider_event_id, provider_email_id, provider_message_id, user_id,
+        sender_email, subject, message, message_references, status, received_at
+      ) VALUES (
+        p_email->>'providerEventId', p_email->>'providerEmailId', p_email->>'providerMessageId', v_user_id,
+        p_email->>'senderEmail', p_email->>'subject', NULL,
+        COALESCE(ARRAY(SELECT jsonb_array_elements_text(p_email->'replyMessageIds')), '{}'),
+        'rejected', (p_email->>'receivedAt')::timestamptz
+      ) RETURNING * INTO v_message;
+      RETURN jsonb_build_object(
+        'kind', 'no_computer', 'record_id', v_message.id,
+        'sender_email', v_message.sender_email, 'subject', v_message.subject,
+        'provider_message_id', v_message.provider_message_id, 'references', v_message.message_references
+      );
+    END IF;
+    INSERT INTO public.amalgm_channel_threads(user_id, channel, session_id, computer_id, subject)
+    VALUES (v_user_id, 'email', gen_random_uuid()::text, v_computer_id, p_email->>'subject')
+    RETURNING * INTO v_thread;
+    v_starts_session := true;
+  END IF;
+
+  v_computer_id := v_thread.computer_id;
+  SELECT name, status = 'online' INTO v_computer_name, v_online
+  FROM public.user_computers WHERE id = v_computer_id AND user_id = v_user_id;
+
+  INSERT INTO public.amalgm_channel_inbound(
+    provider_event_id, provider_email_id, provider_message_id, user_id,
+    thread_id, session_id, target_computer_id, starts_session,
+    sender_email, subject, message, message_references, status, received_at
+  ) VALUES (
+    p_email->>'providerEventId', p_email->>'providerEmailId', p_email->>'providerMessageId', v_user_id,
+    v_thread.id, v_thread.session_id, v_computer_id, v_starts_session,
+    p_email->>'senderEmail', p_email->>'subject', p_email->>'message',
+    COALESCE(ARRAY(SELECT jsonb_array_elements_text(p_email->'replyMessageIds')), '{}'),
+    'pending', (p_email->>'receivedAt')::timestamptz
+  ) RETURNING * INTO v_message;
+
+  UPDATE public.amalgm_channel_threads SET
+    last_message_id = v_message.provider_message_id,
+    message_references = public.amalgm_channel_reference_tail(
+      message_references || v_message.message_references || ARRAY[v_message.provider_message_id]
+    ),
+    updated_at = now()
+  WHERE id = v_thread.id;
+
+  RETURN jsonb_build_object(
+    'kind', 'accepted', 'user_id', v_user_id, 'message_id', v_message.id,
+    'thread_id', v_thread.id, 'session_id', v_thread.session_id,
+    'target_computer_id', v_computer_id, 'target_computer_name', COALESCE(v_computer_name, 'Your computer'),
+    'target_online', COALESCE(v_online, false), 'sender_email', v_message.sender_email,
+    'subject', v_message.subject, 'provider_message_id', v_message.provider_message_id,
+    'references', v_message.message_references
+  );
+EXCEPTION WHEN unique_violation THEN
+  SELECT * INTO v_existing FROM public.amalgm_channel_inbound
+  WHERE provider_email_id = p_email->>'providerEmailId' OR provider_event_id = p_email->>'providerEventId' LIMIT 1;
+  RETURN jsonb_build_object('kind', 'duplicate', 'record_id', v_existing.id);
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION claim_amalgm_channel_inbound(
+  p_user_id uuid,
+  p_computer_id uuid,
+  p_limit integer,
+  p_lease_seconds integer
+) RETURNS SETOF amalgm_channel_inbound
+LANGUAGE sql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+  WITH candidates AS (
+    SELECT i.id
+    FROM public.amalgm_channel_inbound i
+    WHERE i.user_id = p_user_id AND i.target_computer_id = p_computer_id
+      AND i.available_at <= now()
+      AND (i.status = 'pending' OR (i.status = 'claimed' AND i.lease_expires_at <= now()))
+      AND NOT EXISTS (
+        SELECT 1 FROM public.amalgm_channel_inbound earlier
+        WHERE earlier.thread_id = i.thread_id AND earlier.id <> i.id
+          AND earlier.status IN ('pending', 'claimed')
+          AND (earlier.received_at, earlier.id) < (i.received_at, i.id)
+      )
+    ORDER BY i.received_at, i.id
+    FOR UPDATE SKIP LOCKED
+    LIMIT LEAST(GREATEST(p_limit, 1), 10)
+  )
+  UPDATE public.amalgm_channel_inbound i SET
+    status = 'claimed', attempts = i.attempts + 1,
+    lease_token = gen_random_uuid(),
+    lease_expires_at = now() + make_interval(secs => LEAST(GREATEST(p_lease_seconds, 30), 900)),
+    updated_at = now()
+  FROM candidates WHERE i.id = candidates.id
+  RETURNING i.*;
+$$;
+
+CREATE OR REPLACE FUNCTION accept_amalgm_channel_inbound(
+  p_user_id uuid, p_computer_id uuid, p_message_id uuid,
+  p_lease_token uuid, p_now timestamptz
+) RETURNS boolean
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = public
+AS $$
+BEGIN
+  UPDATE public.amalgm_channel_inbound SET
+    status = 'accepted', message = NULL, accepted_at = p_now,
+    lease_token = NULL, lease_expires_at = NULL, error = NULL, updated_at = p_now
+  WHERE id = p_message_id AND user_id = p_user_id AND target_computer_id = p_computer_id
+    AND status = 'claimed' AND lease_token = p_lease_token;
+  RETURN FOUND;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION release_amalgm_channel_inbound(
+  p_user_id uuid, p_computer_id uuid, p_message_id uuid,
+  p_lease_token uuid, p_error text, p_now timestamptz
+) RETURNS boolean
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = public
+AS $$
+BEGIN
+  UPDATE public.amalgm_channel_inbound SET
+    status = 'pending', available_at = p_now + make_interval(secs => LEAST(60, (2 ^ LEAST(attempts, 5))::integer)),
+    lease_token = NULL, lease_expires_at = NULL, error = left(p_error, 500), updated_at = p_now
+  WHERE id = p_message_id AND user_id = p_user_id AND target_computer_id = p_computer_id
+    AND status = 'claimed' AND lease_token = p_lease_token;
+  RETURN FOUND;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION record_amalgm_channel_inbound_notice(
+  p_message_id uuid, p_provider_id text, p_now timestamptz
+) RETURNS boolean
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = public
+AS $$
+BEGIN
+  UPDATE public.amalgm_channel_inbound SET
+    notice_provider_id = COALESCE(notice_provider_id, left(p_provider_id, 500)), updated_at = p_now
+  WHERE id = p_message_id;
+  RETURN FOUND;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION apply_amalgm_channel_provider_event(p_event jsonb)
+RETURNS boolean
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = public
+AS $$
+DECLARE
+  v_delivery public.amalgm_channel_deliveries;
+  v_type text := p_event->>'type';
+  v_message_id text := NULLIF(p_event->>'providerMessageId', '');
+BEGIN
+  INSERT INTO public.amalgm_channel_provider_events(provider_event_id, provider_email_id, event_type, occurred_at)
+  VALUES (p_event->>'providerEventId', p_event->>'providerEmailId', v_type, (p_event->>'occurredAt')::timestamptz)
+  ON CONFLICT DO NOTHING;
+  IF NOT FOUND THEN RETURN false; END IF;
+
+  SELECT * INTO v_delivery FROM public.amalgm_channel_deliveries
+  WHERE provider_id = p_event->>'providerEmailId' LIMIT 1 FOR UPDATE;
+  IF NOT FOUND THEN RETURN true; END IF;
+
+  UPDATE public.amalgm_channel_deliveries SET
+    status = CASE
+      WHEN status = 'delivered' THEN status
+      WHEN v_type = 'delivered' THEN 'delivered'
+      WHEN v_type = 'failed' THEN 'failed'
+      ELSE 'sent'
+    END,
+    delivered_at = CASE WHEN v_type = 'delivered' THEN (p_event->>'occurredAt')::timestamptz ELSE delivered_at END,
+    rfc_message_id = COALESCE(v_message_id, rfc_message_id),
+    error = CASE WHEN v_type = 'failed' THEN left(p_event->>'error', 500) ELSE NULL END,
+    updated_at = (p_event->>'occurredAt')::timestamptz
+  WHERE id = v_delivery.id;
+
+  IF v_message_id IS NOT NULL THEN
+    UPDATE public.amalgm_channel_threads SET
+      last_message_id = v_message_id,
+      message_references = public.amalgm_channel_reference_tail(message_references || ARRAY[v_message_id]),
+      updated_at = now()
+    WHERE id = v_delivery.thread_id;
+  END IF;
+  RETURN true;
+END;
+$$;
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_publication WHERE pubname = 'supabase_realtime')
+    AND NOT EXISTS (
+      SELECT 1 FROM pg_publication_tables
+      WHERE pubname = 'supabase_realtime' AND schemaname = 'public' AND tablename = 'amalgm_channel_inbound'
+    )
+  THEN
+    ALTER PUBLICATION supabase_realtime ADD TABLE amalgm_channel_inbound;
+  END IF;
+END $$;
+
+REVOKE ALL ON FUNCTION enqueue_amalgm_channel_delivery(uuid, uuid, jsonb, text) FROM PUBLIC;
+REVOKE ALL ON FUNCTION amalgm_channel_reference_tail(text[]) FROM PUBLIC;
+REVOKE ALL ON FUNCTION claim_amalgm_channel_deliveries(integer, integer) FROM PUBLIC;
+REVOKE ALL ON FUNCTION mark_amalgm_channel_delivery_sent(uuid, uuid, text, timestamptz) FROM PUBLIC;
+REVOKE ALL ON FUNCTION fail_amalgm_channel_delivery(uuid, uuid, text, timestamptz) FROM PUBLIC;
+REVOKE ALL ON FUNCTION next_amalgm_channel_delivery_at() FROM PUBLIC;
+REVOKE ALL ON FUNCTION admit_amalgm_channel_email(jsonb) FROM PUBLIC;
+REVOKE ALL ON FUNCTION claim_amalgm_channel_inbound(uuid, uuid, integer, integer) FROM PUBLIC;
+REVOKE ALL ON FUNCTION accept_amalgm_channel_inbound(uuid, uuid, uuid, uuid, timestamptz) FROM PUBLIC;
+REVOKE ALL ON FUNCTION release_amalgm_channel_inbound(uuid, uuid, uuid, uuid, text, timestamptz) FROM PUBLIC;
+REVOKE ALL ON FUNCTION record_amalgm_channel_inbound_notice(uuid, text, timestamptz) FROM PUBLIC;
+REVOKE ALL ON FUNCTION apply_amalgm_channel_provider_event(jsonb) FROM PUBLIC;
+
+GRANT EXECUTE ON FUNCTION enqueue_amalgm_channel_delivery(uuid, uuid, jsonb, text) TO service_role;
+GRANT EXECUTE ON FUNCTION claim_amalgm_channel_deliveries(integer, integer) TO service_role;
+GRANT EXECUTE ON FUNCTION mark_amalgm_channel_delivery_sent(uuid, uuid, text, timestamptz) TO service_role;
+GRANT EXECUTE ON FUNCTION fail_amalgm_channel_delivery(uuid, uuid, text, timestamptz) TO service_role;
+GRANT EXECUTE ON FUNCTION next_amalgm_channel_delivery_at() TO service_role;
+GRANT EXECUTE ON FUNCTION admit_amalgm_channel_email(jsonb) TO service_role;
+GRANT EXECUTE ON FUNCTION claim_amalgm_channel_inbound(uuid, uuid, integer, integer) TO service_role;
+GRANT EXECUTE ON FUNCTION accept_amalgm_channel_inbound(uuid, uuid, uuid, uuid, timestamptz) TO service_role;
+GRANT EXECUTE ON FUNCTION release_amalgm_channel_inbound(uuid, uuid, uuid, uuid, text, timestamptz) TO service_role;
+GRANT EXECUTE ON FUNCTION record_amalgm_channel_inbound_notice(uuid, text, timestamptz) TO service_role;
+GRANT EXECUTE ON FUNCTION apply_amalgm_channel_provider_event(jsonb) TO service_role;