@fleetbase/fleetops-engine 0.6.68 → 0.6.69

package/server/src/Models/Contact.php

@@ -5,6 +5,7 @@ namespace Fleetbase\FleetOps\Models;
 use Fleetbase\Casts\Json;
 use Fleetbase\FleetOps\Exceptions\CustomerUserConflictException;
 use Fleetbase\FleetOps\Exceptions\UserAlreadyExistsException;
+use Fleetbase\FleetOps\Support\ProfileAccountManager;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\Models\CompanyUser;
 use Fleetbase\Models\Model;
@@ -157,9 +158,13 @@ class Contact extends Model
         return $this->belongsTo(User::class, 'user_uuid');
     }
 
+    /**
+     * The contact's login account: a managed `contact`/`customer` account, or a
+     * team member's account linked by email or phone.
+     */
     public function user(): BelongsTo|Builder
     {
-        return $this->belongsTo(User::class, 'user_uuid')->where('type', $this->type);
+        return $this->belongsTo(User::class, 'user_uuid');
     }
 
     public function photo(): BelongsTo
@@ -316,74 +321,16 @@ class Contact extends Model
      */
     public static function createUserFromContact(Contact $contact, bool $sendInvite = false, bool $update = false): User
     {
-        // Check if user already exist with email or phone number
-        $existingUser = null;
-        if ($contact->email || $contact->phone) {
-            $existingUser = User::where(function ($query) use ($contact) {
-                $query->where('company_uuid', $contact->company_uuid)
-                    ->orWhereHas('companyUsers', function ($query) use ($contact) {
-                        $query->where('company_uuid', $contact->company_uuid);
-                    });
-            })
-                ->where(function ($query) use ($contact) {
-                    if ($contact->email) {
-                        $query->where('email', $contact->email);
-                    }
-
-                    if ($contact->phone) {
-                        $method = $contact->email ? 'orWhere' : 'where';
-                        $query->{$method}('phone', Utils::formatPhoneNumber($contact->phone));
-                    }
-                })
-                ->whereNull('deleted_at')
-                ->first();
-        }
-
-        if ($existingUser) {
-            if ($contact->isCustomer()) {
-                $contact->assertCustomerUserCanBeAssigned($existingUser);
-            }
-
-            // Check if existing user belongs to another contact
-            $existingUserContact = Contact::where(['user_uuid' => $existingUser->uuid, 'company_uuid' => $contact->company_uuid])->whereHas('user')->first();
-            if ($existingUserContact) {
-                throw new UserAlreadyExistsException('User already exists, try to assigning the user to this contact.', $existingUser);
-            }
-            // Assign the user to this contact instead
-            $contact->setAttribute('user_uuid', $existingUser->uuid);
-            if ($update) {
-                $contact->update(['user_uuid' => $existingUser->uuid]);
-            }
-            $contact->setRelation('user', $existingUser);
-
-            return $existingUser;
-        }
-
-        // Load company
         $contact->loadMissing('company');
 
-        // Create the user record
-        $user = User::create([
-            'company_uuid' => $contact->company_uuid,
-            'name'         => $contact->name,
-            'email'        => $contact->email,
-            'phone'        => $contact->phone ? Utils::formatPhoneNumber($contact->phone) : null,
-            'username'     => Str::slug($contact->name . '_' . Str::random(4), '_'),
-            'password'     => Str::random(),
-            'timezone'     => $contact->company->timezone ?? date_default_timezone_get(),
-            'status'       => 'pending',
-        ]);
-
-        // Set user type
-        $user->setType($contact->type);
-
-        // Assign to company without triggering core organization invitations.
-        static::assignUserToContactCompany($contact, $user);
-
-        // Assign customer role
-        if ($contact->isCustomer()) {
-            $user->assignSingleRole('Fleet-Ops Customer');
-        }
+        $user = ProfileAccountManager::resolveForProfile(
+            $contact->company_uuid,
+            $contact->isCustomer() ? 'customer' : 'contact',
+            $contact->name,
+            $contact->email,
+            $contact->phone,
+            ['timezone' => $contact->company->timezone ?? null]
+        );
 
         // Set user to contact
         $contact->setAttribute('user_uuid', $user->uuid);
@@ -412,6 +359,13 @@ class Contact extends Model
 
         $this->assertCustomerUserCanBeAssigned($user);
 
+        // A team member's account keeps its own organization role
+        if (ProfileAccountManager::isStaffAccount($user)) {
+            $this->setRelation('user', $user);
+
+            return $user;
+        }
+
         $this->loadMissing('company');
         if ($this->company) {
             $companyUser = CompanyUser::firstOrCreate(
@@ -511,7 +465,8 @@ class Contact extends Model
         // Get the company user instance
         $companyUser = $user->getCompanyUser($this->company);
 
-        if ($companyUser) {
+        // A team member's account keeps its own organization role
+        if ($companyUser && ProfileAccountManager::isManagedAccount($user)) {
             $companyUser->assignSingleRole($this->isCustomer() ? 'Fleet-Ops Customer' : 'Fleet-Ops Contact');
         }
 
@@ -546,6 +501,11 @@ class Contact extends Model
             return;
         }
 
+        // A team member of the organization can hold a customer profile
+        if (ProfileAccountManager::isStaffAccount($user) && ProfileAccountManager::isCompanyMember($user, $this->company_uuid)) {
+            return;
+        }
+
         throw new CustomerUserConflictException(static::customerUserConflictMessage($user), $user);
     }
 
@@ -553,6 +513,10 @@ class Contact extends Model
     {
         $field = $user?->email ? 'email' : ($user?->phone ? 'phone number' : 'user account');
 
+        if (ProfileAccountManager::isManagedAccount($user)) {
+            return 'This ' . $field . ' is already used by a ' . $user->type . ' and cannot be used for a customer account.';
+        }
+
         return 'This ' . $field . ' belongs to an existing staff user and cannot be used for a customer account.';
     }
 
@@ -591,32 +555,31 @@ class Contact extends Model
         return User::where('uuid', $this->user_uuid)->first();
     }
 
+    /**
+     * Push the contact's changed proxy fields (name, email, phone, timezone) to
+     * its login account. A team member's account only takes the name.
+     *
+     * @throws \Fleetbase\FleetOps\Exceptions\ProfileIdentityConflictException
+     */
     public function syncWithUser(): bool
     {
-        $updates = [];
-
-        if ($this->isDirty('name')) {
-            $updates['name'] = $this->name;
-        }
-
-        if ($this->isDirty('email')) {
-            $updates['email'] = $this->email;
+        // A new contact's account was just resolved from these values
+        if (!$this->exists) {
+            return false;
         }
 
-        if ($this->isDirty('phone')) {
-            $updates['phone'] = $this->phone;
-        }
-
-        if ($this->isDirty('timezone')) {
-            $updates['timezone'] = $this->timezone;
+        $updates = [];
+        foreach (['name', 'email', 'phone', 'timezone'] as $field) {
+            if ($this->isDirty($field)) {
+                $updates[$field] = $this->{$field};
+            }
         }
 
-        $user = $this->getUser();
-        if ($user) {
-            return $user->update($updates);
+        if (empty($updates)) {
+            return false;
         }
 
-        return false;
+        return ProfileAccountManager::syncProxyFields($this->getUser(), $updates);
     }
 
     /**
@@ -638,12 +601,14 @@ class Contact extends Model
      */
     public function deleteUser(): ?bool
     {
-        $this->loadMissing('user');
-        if ($this->user && $this->user->type === $this->type) {
-            return $this->user->delete();
+        $user = $this->getUser();
+        if (!ProfileAccountManager::isManagedAccount($user)) {
+            return false;
         }
 
-        return false;
+        ProfileAccountManager::releaseForProfile($user, $this->company_uuid);
+
+        return $user->trashed();
     }
 
     public function getUser(): ?User

package/server/src/Models/Sensor.php

@@ -75,7 +75,6 @@ class Sensor extends Model
      */
     protected $filterParams = [
         'type',
-        'sensor_type',
         'status',
         'device_uuid',
         'serial_number',
@@ -214,7 +213,7 @@ class Sensor extends Model
     public function getSlugOptions(): SlugOptions
     {
         return SlugOptions::create()
-            ->generateSlugsFrom(['name', 'sensor_type'])
+            ->generateSlugsFrom(['name', 'type'])
             ->saveSlugsTo('slug')
             ->doNotGenerateSlugsOnUpdate();
     }
@@ -232,7 +231,6 @@ class Sensor extends Model
                 'sensorable_uuid',
                 'sensorable_type',
                 'type',
-                'sensor_type',
                 'internal_id',
                 'name',
                 'unit',
@@ -396,7 +394,7 @@ class Sensor extends Model
      */
     public function scopeByType($query, string $type)
     {
-        return $query->where('sensor_type', $type);
+        return $query->where('type', $type);
     }
 
     /**
@@ -493,7 +491,7 @@ class Sensor extends Model
                     'message'      => $this->generateThresholdAlertMessage($value, $thresholdStatus),
                     'context'      => [
                         'sensor_name'      => $this->name,
-                        'sensor_type'      => $this->sensor_type,
+                        'sensor_type'      => $this->type,
                         'value'            => $value,
                         'unit'             => $this->unit,
                         'threshold_status' => $thresholdStatus,

package/server/src/Observers/ContactObserver.php

@@ -3,7 +3,6 @@
 namespace Fleetbase\FleetOps\Observers;
 
 use Fleetbase\FleetOps\Models\Contact;
-use Fleetbase\Models\User;
 
 class ContactObserver
 {
@@ -42,17 +41,8 @@ class ContactObserver
             $contact->normalizeCustomerUser();
         }
 
-        // Validate email is available to user
-        if (!empty($contact->email) && $contact->wasChanged('email') && $this->isEmailUnavailable($contact)) {
-            throw new \Exception('Email attempting to update for ' . $contact->type . ' is not available.');
-        }
-
-        // Validate phone is available to user
-        if (!empty($contact->phone) && $contact->wasChanged('phone') && $this->isPhoneUnavailable($contact)) {
-            throw new \Exception('Phone attempting to update for ' . $contact->type . ' is not available.');
-        }
-
-        // Sync updates from contact to user
+        // Sync updates from contact to its login account. This throws when the
+        // new email or phone is already used by another account.
         $contact->syncWithUser();
     }
 
@@ -66,14 +56,4 @@ class ContactObserver
         // Delete the assosciated user account
         $contact->deleteUser();
     }
-
-    private function isEmailUnavailable(Contact $contact)
-    {
-        return User::where('email', $contact->email)->whereNot('uuid', $contact->user_uuid)->exists() || Contact::where(['email' => $contact->email, 'company_uuid' => $contact->company_uuid])->whereNot('uuid', $contact->uuid)->exists();
-    }
-
-    private function isPhoneUnavailable(Contact $contact)
-    {
-        return User::where('phone', $contact->phone)->whereNot('uuid', $contact->user_uuid)->exists() || Contact::where(['phone' => $contact->phone, 'company_uuid' => $contact->company_uuid])->whereNot('uuid', $contact->uuid)->exists();
-    }
 }

package/server/src/Observers/DriverObserver.php

@@ -5,6 +5,7 @@ namespace Fleetbase\FleetOps\Observers;
 use Fleetbase\FleetOps\Models\Driver;
 use Fleetbase\FleetOps\Models\Order;
 use Fleetbase\FleetOps\Support\LiveCacheService;
+use Fleetbase\FleetOps\Support\ProfileAccountManager;
 use Fleetbase\LaravelMysqlSpatial\Types\Point;
 use Fleetbase\Models\User;
 
@@ -64,11 +65,9 @@ class DriverObserver
         // Unassign them from any order they are assigned to
         $this->unassignOrders($driver);
 
-        // If the driver had a user account with the role driver and type user delete it
-        $user = $this->findDriverUser($driver);
-        if ($user && $user->hasRole('Driver')) {
-            $user->delete();
-        }
+        // Delete the driver's managed login account, which frees its email and
+        // phone. A team member's account linked to the driver is left alone.
+        ProfileAccountManager::releaseForProfile($this->findDriverUser($driver), $driver->company_uuid);
 
         $this->invalidateLiveCache();
     }
@@ -85,6 +84,6 @@ class DriverObserver
 
     protected function findDriverUser(Driver $driver): ?User
     {
-        return User::where(['uuid' => $driver->user_uuid, 'type' => 'user'])->first();
+        return $driver->user_uuid ? User::where('uuid', $driver->user_uuid)->first() : null;
     }
 }

package/server/src/Providers/FleetOpsServiceProvider.php

@@ -274,6 +274,12 @@ class FleetOpsServiceProvider extends CoreServiceProvider
             });
         }
 
+        if (Utils::classExists(\Fleetbase\Ai\Support\Commands\AiCommandRegistry::class)) {
+            $this->callAfterResolving(\Fleetbase\Ai\Support\Commands\AiCommandRegistry::class, function ($commands) {
+                $commands->registerMany(\Fleetbase\FleetOps\Support\Ai\FleetOpsAiConsoleCommands::all());
+            });
+        }
+
         $this->callAfterResolving(\Fleetbase\Ai\Support\AiCapabilityRegistry::class, function (\Fleetbase\Ai\Support\AiCapabilityRegistry $registry) {
             $registry->register(new \Fleetbase\FleetOps\Support\Ai\Capabilities\SearchResourcesCapability());
             $registry->register(new \Fleetbase\FleetOps\Support\Ai\Capabilities\OperationalQueryCapability());
@@ -284,6 +290,15 @@ class FleetOpsServiceProvider extends CoreServiceProvider
             $registry->register(new \Fleetbase\FleetOps\Support\Ai\Capabilities\CreateOrderPreviewCapability());
             $registry->register(new \Fleetbase\FleetOps\Support\Ai\Capabilities\OptimizeOrderRouteCapability());
             $registry->register(new \Fleetbase\FleetOps\Support\Ai\Capabilities\ImportOrdersPreviewCapability());
+
+            // Tool-calling versions share their capability keys, so they replace the keyword-driven ones when
+            // the installed AI extension supports tools and leave older AI extensions unaffected.
+            if (interface_exists(\Fleetbase\Ai\Contracts\AIToolCapabilityInterface::class)) {
+                $registry->register(new \Fleetbase\FleetOps\Support\Ai\Tools\SearchResourcesTool());
+                $registry->register(new \Fleetbase\FleetOps\Support\Ai\Tools\CreateOrderTool());
+                $registry->register(new \Fleetbase\FleetOps\Support\Ai\Tools\OptimizeOrderRouteTool());
+                $registry->register(new \Fleetbase\FleetOps\Support\Ai\Tools\ImportOrdersTool());
+            }
         });
     }
 }

package/server/src/Support/Ai/Capabilities/AbstractFleetOpsAICapability.php

@@ -11,6 +11,17 @@ use Illuminate\Support\Str;
 
 abstract class AbstractFleetOpsAICapability extends AbstractAICapability implements AIContextCapabilityInterface
 {
+    /**
+     * Words that never identify a record and must not be used as search terms.
+     */
+    protected const SEARCH_STOPWORDS = [
+        'the', 'and', 'for', 'with', 'from', 'this', 'that', 'what', 'where', 'when', 'which', 'who', 'how', 'many', 'much',
+        'can', 'could', 'would', 'should', 'please', 'help', 'want', 'need', 'show', 'find', 'open', 'look', 'tell', 'about',
+        'status', 'order', 'orders', 'vehicle', 'vehicles', 'driver', 'drivers', 'device', 'devices', 'sensor', 'sensors',
+        'telematic', 'telematics', 'maintenance', 'maintenances', 'work', 'fleet', 'fleets', 'ops', 'create', 'new', 'all',
+        'today', 'yesterday', 'tomorrow', 'week', 'month', 'fleetbase', 'import', 'template', 'download', 'dummy', 'test',
+    ];
+
     public function module(): string
     {
         return 'fleet-ops';
@@ -50,6 +61,18 @@ abstract class AbstractFleetOpsAICapability extends AbstractAICapability impleme
         return Auth::can($permission);
     }
 
+    /**
+     * Applies the current user's IAM directives (record-level scoping) for a permission to a query.
+     */
+    protected function scopeToPermission($query, string $permission)
+    {
+        if ($query instanceof Builder && Builder::hasGlobalMacro('applyDirectivesForPermissions')) {
+            return $query->applyDirectivesForPermissions($permission);
+        }
+
+        return $query;
+    }
+
     protected function canAll(array $permissions): bool
     {
         foreach ($permissions as $permission) {
@@ -61,18 +84,52 @@ abstract class AbstractFleetOpsAICapability extends AbstractAICapability impleme
         return true;
     }
 
+    /**
+     * Extracts record-reference-like search terms from a prompt.
+     *
+     * Only terms that plausibly identify a record are kept: quoted phrases, tokens containing a digit
+     * (public ids, plates, tracking numbers), emails and other delimited identifiers, and capitalized
+     * names that are not the first word. Ordinary words are never used as LIKE terms, and an empty
+     * array is returned when the prompt does not reference a specific record.
+     */
     protected function searchTerms(string $prompt): array
     {
-        preg_match_all('/[A-Z]{2,}[-_][A-Z0-9-_]+|[A-Za-z0-9][A-Za-z0-9-_]{2,}/', (string) $prompt, $matches);
+        $prompt = trim($prompt);
+        $terms  = [];
 
-        $terms = collect($matches[0] ?? [])
-            ->reject(fn ($term) => in_array(Str::lower($term), ['find', 'show', 'open', 'order', 'orders', 'vehicle', 'vehicles', 'driver', 'drivers', 'work', 'status', 'about', 'fleet', 'ops'], true))
-            ->unique()
+        preg_match_all('/"([^"]{2,64})"|\'([^\']{2,64})\'/u', $prompt, $quoted);
+        foreach (array_merge($quoted[1] ?? [], $quoted[2] ?? []) as $phrase) {
+            if (trim($phrase) !== '') {
+                $terms[] = trim($phrase);
+            }
+        }
+
+        preg_match_all('/[\p{L}\p{N}][\p{L}\p{N}@._\-]*[\p{L}\p{N}]/u', $prompt, $matches, PREG_OFFSET_CAPTURE);
+        foreach ($matches[0] ?? [] as [$token, $offset]) {
+            if ($this->isReferenceTerm($token, $offset === 0)) {
+                $terms[] = $token;
+            }
+        }
+
+        return collect($terms)
+            ->unique(fn ($term) => Str::lower($term))
             ->take(6)
             ->values()
             ->all();
+    }
+
+    protected function isReferenceTerm(string $token, bool $isFirstWord = false): bool
+    {
+        if (mb_strlen($token) < 3 || in_array(Str::lower($token), static::SEARCH_STOPWORDS, true)) {
+            return false;
+        }
+
+        // Public ids, plates, tracking numbers, emails, and upper-case codes such as ORDER-ABC.
+        if (preg_match('/\p{N}|[@_]/u', $token) || preg_match('/^[\p{Lu}\p{N}]+(?:-[\p{Lu}\p{N}]+)+$/u', $token)) {
+            return true;
+        }
 
-        return empty($terms) ? [trim((string) $prompt)] : $terms;
+        return !$isFirstWord && preg_match('/^\p{Lu}\p{Ll}+$/u', $token) === 1;
     }
 
     protected function whereLikeAny(Builder $builder, array $columns, array $terms): void

package/server/src/Support/Ai/Capabilities/AssetStatusCapability.php

@@ -28,7 +28,7 @@ class AssetStatusCapability extends AbstractFleetOpsAICapability
 
     public function permissions(): array
     {
-        return ['fleet-ops see vehicle', 'fleet-ops see device', 'fleet-ops see sensor', 'fleet-ops see telematic'];
+        return ['fleet-ops see driver', 'fleet-ops see vehicle', 'fleet-ops see device', 'fleet-ops see sensor', 'fleet-ops see telematic'];
     }
 
     public function resolve(AiTask $task): array
@@ -92,27 +92,46 @@ class AssetStatusCapability extends AbstractFleetOpsAICapability
 
     protected function totalForModel(string $modelClass): int
     {
-        return $modelClass::where('company_uuid', session('company'))->count();
+        return $this->scopedQuery($modelClass)->count();
     }
 
     protected function onlineCountForModel(string $modelClass): int
     {
-        return $modelClass::where('company_uuid', session('company'))->where('online', true)->count();
+        return $this->scopedQuery($modelClass)->where('online', true)->count();
     }
 
     protected function offlineCountForModel(string $modelClass): int
     {
-        return $modelClass::where('company_uuid', session('company'))->where(function ($query) {
+        return $this->scopedQuery($modelClass)->where(function ($query) {
             $query->where('online', false)->orWhereNull('online');
         })->count();
     }
 
     protected function countsByStatusForModel(string $modelClass): array
     {
-        return $modelClass::where('company_uuid', session('company'))
+        return $this->scopedQuery($modelClass)
             ->selectRaw('status, count(*) as aggregate')
             ->groupBy('status')
             ->pluck('aggregate', 'status')
             ->all();
     }
+
+    /**
+     * Company-scoped query with the user's IAM directives for listing the resource applied.
+     */
+    protected function scopedQuery(string $modelClass)
+    {
+        $permission = match ($modelClass) {
+            Driver::class    => 'fleet-ops list driver',
+            Vehicle::class   => 'fleet-ops list vehicle',
+            Device::class    => 'fleet-ops list device',
+            Sensor::class    => 'fleet-ops list sensor',
+            Telematic::class => 'fleet-ops list telematic',
+            default          => null,
+        };
+
+        $query = $modelClass::where('company_uuid', session('company'));
+
+        return $permission ? $this->scopeToPermission($query, $permission) : $query;
+    }
 }

package/server/src/Support/Ai/Capabilities/CreateOrderPreviewCapability.php

@@ -222,8 +222,12 @@ class CreateOrderPreviewCapability extends AbstractFleetOpsAICapability implemen
 
     protected function buildDraft(AiTask $task, array $input = []): array
     {
-        $existing = (array) data_get($task->metadata, 'action_previews.0.draft', []);
-        $draft    = array_replace_recursive($this->draftFromPrompt((string) $task->prompt), $existing, (array) data_get($input, 'draft', $input));
+        // A tool call supplies structured fields, so the prompt is not re-parsed. A refresh edits the
+        // preview it was opened from, which the AI service passes as existing_draft.
+        $fromTool = data_get($input, 'source') === 'tool';
+        $existing = (array) (data_get($input, 'existing_draft') ?? ($fromTool ? [] : data_get($task->metadata, 'action_previews.0.draft', [])));
+        $changes  = (array) data_get($input, 'draft', Arr::except($input, ['source', 'existing_draft']));
+        $draft    = array_replace_recursive($this->draftFromPrompt($fromTool ? '' : (string) $task->prompt), $existing, $changes);
 
         $draft['dispatched'] = filter_var(data_get($draft, 'dispatched', false), FILTER_VALIDATE_BOOLEAN);
         $draft['payload']    = (array) data_get($draft, 'payload', []);

package/server/src/Support/Ai/Capabilities/OrderInsightsCapability.php

@@ -34,17 +34,20 @@ class OrderInsightsCapability extends AbstractFleetOpsAICapability
             return ['authorized' => false, 'message' => 'Current user cannot access Fleet-Ops orders.'];
         }
 
-        $prompt = $this->prompt($task);
-        $window = $this->dateWindow($prompt);
-        $amount = $this->amountThreshold($prompt);
-        $query  = $this->orderQuery(session('company'));
+        $prompt   = $this->prompt($task);
+        $window   = $this->dateWindow($prompt);
+        $amount   = $this->amountThreshold($prompt);
+        $currency = $this->currency();
+        $minor    = $amount !== null ? $this->toMinorUnits($amount, $currency) : null;
+        $query    = $this->orderQuery(session('company'));
 
         if ($window) {
             $query->whereBetween('created_at', [$window['start'], $window['end']]);
         }
 
-        if ($amount !== null) {
-            $query->whereHas('transaction', fn ($transaction) => $transaction->where('amount', '>', $amount));
+        if ($minor !== null) {
+            // Transaction amounts are stored in the currency's minor unit (e.g. cents).
+            $query->whereHas('transaction', fn ($transaction) => $transaction->where('amount', '>', $minor));
         }
 
         $total = (clone $query)->count();
@@ -59,6 +62,7 @@ class OrderInsightsCapability extends AbstractFleetOpsAICapability
                 'end'      => $window['end']->toIso8601String(),
             ] : null,
             'amount_threshold'  => $amount,
+            'amount_currency'   => $amount !== null ? $currency : null,
             'count'             => $total,
             'counts_by_status'  => (clone $query)
                 ->selectRaw('status, count(*) as aggregate')
@@ -83,6 +87,35 @@ class OrderInsightsCapability extends AbstractFleetOpsAICapability
         return null;
     }
 
+    /**
+     * Converts a major-unit amount (e.g. 500.00) to the minor units transactions are stored in,
+     * honoring the currency's ISO-4217 exponent (JPY has none, BHD has three).
+     */
+    protected function toMinorUnits(float $amount, string $currency): int
+    {
+        $exponent = 2;
+
+        try {
+            if (class_exists(\Money\Currencies\ISOCurrencies::class)) {
+                $exponent = (new \Money\Currencies\ISOCurrencies())->subunitFor(new \Money\Currency(strtoupper($currency)));
+            }
+        } catch (\Throwable) {
+            $exponent = 2;
+        }
+
+        return (int) round($amount * (10 ** $exponent));
+    }
+
+    /**
+     * @codeCoverageIgnore
+     */
+    protected function currency(): string
+    {
+        $company = function_exists('session') ? \Fleetbase\Models\Company::where('uuid', session('company'))->first(['uuid', 'currency']) : null;
+
+        return strtoupper((string) ($company?->currency ?: 'USD'));
+    }
+
     protected function dateWindow(string $prompt): ?array
     {
         return $this->relativeDateResolver()->resolveWindow($prompt);
@@ -90,7 +123,7 @@ class OrderInsightsCapability extends AbstractFleetOpsAICapability
 
     protected function orderQuery(?string $companyUuid): mixed
     {
-        return Order::where('company_uuid', $companyUuid);
+        return $this->scopeToPermission(Order::where('company_uuid', $companyUuid), 'fleet-ops list order');
     }
 
     protected function relativeDateResolver(): AiRelativeDateResolver