@profullstack/agenticjobs 0.11.0 → 0.14.0

package/migrations/0014_inbox_and_billing.sql

@@ -0,0 +1,138 @@
+-- The inbox, and the invoices that travel through it.
+--
+-- A board where the only way to reach somebody is a public comment box gets
+-- used as one: ugig.net's comments filled up with invoices, because an invoice
+-- has to go *somewhere* and that was the only somewhere. So there is no public
+-- commenting here at all. A conversation is private to the people in it, and
+-- an invoice is a message in that conversation with money attached.
+--
+-- Two things are in the schema rather than in a validator:
+--
+--   - A message is bounded. 4000 characters is a long letter; it is not room
+--     for a pasted document, which belongs on a resume or a listing.
+--   - An invoice has one payee and one amount, and its status moves forward.
+--     It is never edited after it is sent: a changed invoice is a new one.
+
+-- A conversation. The subject is the one line the list page shows.
+create table if not exists threads (
+  id              uuid primary key default gen_random_uuid(),
+  subject         text not null check (length(subject) between 1 and 140),
+  -- The listing this is about, when it is about one. Kept when the listing
+  -- is deleted: the conversation still happened.
+  job_id          uuid references jobs (id) on delete set null,
+  created_by      uuid not null references users (id) on delete cascade,
+  created_at      timestamptz not null default now(),
+  -- Denormalised so the inbox sorts without touching messages.
+  last_message_at timestamptz not null default now()
+);
+
+-- Who is in it. A person is in a conversation either as themselves or as a
+-- member of an employer; `org_id` says which, and is what the other side sees
+-- as the name. Every member of the employer is a participant, so a message to
+-- "Acme" reaches whoever at Acme is around.
+create table if not exists thread_participants (
+  thread_id    uuid not null references threads (id) on delete cascade,
+  user_id      uuid not null references users (id) on delete cascade,
+  org_id       uuid references organisations (id) on delete set null,
+  -- Unread is "a message newer than this". Null means never opened.
+  last_read_at timestamptz,
+  -- When this person was last emailed about this thread, so a burst of ten
+  -- messages is one email rather than ten.
+  notified_at  timestamptz,
+  primary key (thread_id, user_id)
+);
+
+create index if not exists thread_participants_user_idx on thread_participants (user_id);
+create index if not exists thread_participants_org_idx on thread_participants (org_id)
+  where org_id is not null;
+create index if not exists threads_job_idx on threads (job_id) where job_id is not null;
+
+-- An invoice. Its money is settled on CoinPay, to the payee's own wallet; the
+-- board never holds funds. The row here is the source of truth for *which*
+-- conversation it belongs to and *whether it has been paid*; the CoinPay
+-- payment is the source of truth for the chain-level facts, and is re-minted
+-- when a quote expires unpaid, so `coinpay_payment_id` changes over time and
+-- `status` does not move backwards.
+create table if not exists invoices (
+  id                  uuid primary key default gen_random_uuid(),
+  thread_id           uuid not null references threads (id) on delete cascade,
+  -- Who gets paid. Always a person: a payout goes to a wallet somebody
+  -- connected, and an employer does not have one.
+  payee_id            uuid not null references users (id) on delete cascade,
+  amount_usd          numeric(12, 2) not null check (amount_usd > 0),
+  -- The chain the payee chose to be paid on, in CoinPay's spelling:
+  -- BTC, ETH, SOL, USDC_POL and so on.
+  currency            text not null,
+  -- The payee's address for that chain, copied at send time. An invoice
+  -- settles to the wallet it was sent with, whatever is connected later.
+  wallet_address      text not null,
+  description         text not null default '' check (length(description) <= 1000),
+  status              text not null default 'sent'
+                      check (status in ('sent', 'paid', 'cancelled')),
+  coinpay_payment_id  text,
+  payment_address     text,
+  amount_crypto       text,
+  payment_expires_at  timestamptz,
+  paid_at             timestamptz,
+  paid_by             uuid references users (id) on delete set null,
+  tx_hash             text,
+  created_at          timestamptz not null default now(),
+  updated_at          timestamptz not null default now()
+);
+
+create index if not exists invoices_thread_idx on invoices (thread_id, created_at desc);
+create index if not exists invoices_payee_idx on invoices (payee_id, created_at desc);
+-- The webhook looks a payment up by CoinPay's id and nothing else.
+create unique index if not exists invoices_payment_key on invoices (coinpay_payment_id)
+  where coinpay_payment_id is not null;
+
+-- A message. `kind` says whether it is words or an invoice; an invoice message
+-- carries the invoice and its body is the description, so a thread reads
+-- top to bottom without joining.
+create table if not exists messages (
+  id          uuid primary key default gen_random_uuid(),
+  thread_id   uuid not null references threads (id) on delete cascade,
+  sender_id   uuid not null references users (id) on delete cascade,
+  kind        text not null default 'text' check (kind in ('text', 'invoice')),
+  body        text not null check (length(body) between 1 and 4000),
+  invoice_id  uuid references invoices (id) on delete set null,
+  created_at  timestamptz not null default now(),
+  constraint messages_invoice_kind check (
+    (kind = 'invoice' and invoice_id is not null) or (kind = 'text' and invoice_id is null)
+  )
+);
+
+create index if not exists messages_thread_idx on messages (thread_id, created_at);
+
+-- A CoinPay account somebody connected, so the board can read which wallets
+-- they can be paid to. The tokens are theirs, for their account: the board
+-- reads `userinfo` with them and nothing else.
+--
+-- One CoinPay account attaches to one person here, and the unique index is
+-- what says so. Without it the first account to connect a wallet would be the
+-- one every later profile quietly pays out to.
+create table if not exists coinpay_accounts (
+  user_id       uuid primary key references users (id) on delete cascade,
+  coinpay_sub   text not null unique,
+  email         text,
+  name          text,
+  access_token  text not null,
+  refresh_token text,
+  scope         text not null default '',
+  expires_at    timestamptz not null,
+  -- What userinfo last said: [{ address, chain, label }]. Refreshed on
+  -- connect and on request, never trusted to be more current than that.
+  wallets       jsonb not null default '[]'::jsonb,
+  connected_at  timestamptz not null default now(),
+  updated_at    timestamptz not null default now()
+);
+
+-- An authorization in flight. Server-side rather than in a cookie so the same
+-- flow works from a terminal, and so a state is single-use by deletion.
+create table if not exists coinpay_oauth_states (
+  state         text primary key,
+  user_id       uuid not null references users (id) on delete cascade,
+  code_verifier text not null,
+  redirect      text,
+  expires_at    timestamptz not null
+);

package/migrations/0015_pay_lines.sql

@@ -0,0 +1,38 @@
+-- What a listing pays, in full.
+--
+-- A salary range per year was the whole vocabulary, and it described one
+-- kind of work. The listings this board exists for pay per task, per pull
+-- request, per social post, a flat fee for a project, a share of revenue or
+-- a bounty, in dollars or in a coin, settled over whatever rail the two sides
+-- agree on. This is the same model ugig.net carries as budget_type,
+-- budget_unit and payment_coin, so a gig there and a job here describe pay
+-- the same way.
+--
+-- The lines are JSON rather than a child table because they are read and
+-- written as one value with the listing, never queried on their own: the
+-- salary_* columns stay as the flattened first time-based line, which is
+-- what the salary filter, the salary sort and the JobPosting structured
+-- data compare on. A price per task has no annual figure and does not belong
+-- in any of those.
+alter table jobs add column if not exists pay_lines jsonb not null default '[]'::jsonb;
+-- How it is settled: a coin such as SOL, or a rail such as "bank transfer".
+alter table jobs add column if not exists pay_method text;
+
+-- Every listing that already stated a range becomes one line, so the page
+-- and the API say the same thing before and after this migration.
+update jobs
+   set pay_lines = jsonb_build_array(jsonb_build_object(
+         'type', case salary_period
+                   when 'hour' then 'hourly'
+                   when 'day' then 'daily'
+                   when 'week' then 'weekly'
+                   when 'month' then 'monthly'
+                   else 'yearly'
+                 end,
+         'min', salary_min,
+         'max', salary_max,
+         'currency', upper(coalesce(salary_currency, 'USD')),
+         'unit', null))
+ where pay_lines = '[]'::jsonb
+   and salary_unpaid = false
+   and (salary_min is not null or salary_max is not null);

package/migrations/0016_recommendations.sql

@@ -0,0 +1,65 @@
+-- Recommendations: what somebody who worked with you says about you, shown
+-- on your page once you have agreed to it.
+--
+-- Not a rating. A star out of five from a stranger who paid you once is a
+-- number that says nothing and cannot be answered; it is the thing that
+-- makes a marketplace profile a scoreboard. A recommendation is a paragraph
+-- with a name on it, from an employer who hired you or a person you hired,
+-- and it goes on your page only when you approve it. You can reject one,
+-- and nothing is shown. That is LinkedIn's model, and it is the right one
+-- for a board where every profile is a person's own document.
+--
+-- Both directions, because the board is symmetric: an employer recommends a
+-- candidate, and a candidate recommends an employer. Each side is a person
+-- or an employer, the same way a message is.
+create table if not exists recommendations (
+  id              uuid primary key default gen_random_uuid(),
+  -- Who is saying it: a person as themselves, or an employer through a
+  -- member. Exactly one.
+  author_user_id  uuid references users (id) on delete cascade,
+  author_org_id   uuid references organisations (id) on delete cascade,
+  -- The person who typed it, kept even for an employer's, so "who wrote
+  -- this" has an answer after they leave the company.
+  written_by      uuid not null references users (id) on delete cascade,
+  -- Who it is about. Exactly one.
+  user_id         uuid references users (id) on delete cascade,
+  org_id          uuid references organisations (id) on delete cascade,
+  -- The words. Text, rendered as text.
+  body            text not null check (length(body) between 20 and 2000),
+  -- "Hired them for a three-month contract", "Worked with them at Acme".
+  relationship    text,
+  -- pending until the subject approves; approved is public; rejected is
+  -- kept so the author can see it was, and so it cannot be re-sent daily.
+  status          text not null default 'pending'
+                  check (status in ('pending', 'approved', 'rejected')),
+  created_at      timestamptz not null default now(),
+  updated_at      timestamptz not null default now(),
+  decided_at      timestamptz,
+  constraint recommendations_one_author check (
+    (author_user_id is null) <> (author_org_id is null)
+  ),
+  constraint recommendations_one_subject check ((user_id is null) <> (org_id is null)),
+  -- Nobody recommends themselves, and an employer does not recommend itself.
+  constraint recommendations_not_self check (
+    (author_user_id is null or user_id is null or author_user_id <> user_id)
+    and (author_org_id is null or org_id is null or author_org_id <> org_id)
+  )
+);
+
+-- One per author per subject. Writing it again replaces the words and goes
+-- back to pending for the subject to read again.
+create unique index if not exists recommendations_user_user_key
+  on recommendations (author_user_id, user_id) where author_user_id is not null and user_id is not null;
+create unique index if not exists recommendations_user_org_key
+  on recommendations (author_user_id, org_id) where author_user_id is not null and org_id is not null;
+create unique index if not exists recommendations_org_user_key
+  on recommendations (author_org_id, user_id) where author_org_id is not null and user_id is not null;
+create unique index if not exists recommendations_org_org_key
+  on recommendations (author_org_id, org_id) where author_org_id is not null and org_id is not null;
+
+-- A page reads "approved, newest first" for one subject.
+create index if not exists recommendations_user_idx on recommendations (user_id, status, decided_at desc)
+  where user_id is not null;
+create index if not exists recommendations_org_idx on recommendations (org_id, status, decided_at desc)
+  where org_id is not null;
+create index if not exists recommendations_written_idx on recommendations (written_by, created_at desc);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@profullstack/agenticjobs",
-  "version": "0.11.0",
+  "version": "0.14.0",
   "description": "An agent-friendly job board you self-host. It posts its own jobs, never scrapes anyone else's, and answers on every surface: web, API, MCP, CLI, TUI, desktop and PWA. Instances find each other through an open directory.",
   "license": "MIT",
   "type": "module",

package/web/public/app.css

@@ -185,6 +185,33 @@ main {
   }
 }
 
+/*
+ * The sidebar is a fixed 20rem track, and what goes in it is exactly the kind
+ * of text that cannot break on its own: an email address, a URL, the API line
+ * an agent is meant to copy, a skill tag. With no wrapping rule each one is a
+ * single word wider than the card, and it walks out over the card's border
+ * (the candidate page's contact block did). `anywhere` lets these break at
+ * any character; it inherits, so one rule on the aside covers every card.
+ *
+ * A code block in the sidebar wraps instead of scrolling. A 20rem scroller
+ * shows "GET https://example.com/api/v1/cand" and hides the part that
+ * matters; the wrapped line is still one line to copy. The page-wide
+ * `.code-block` rule keeps its `overflow-x: auto` for the docs, where lines
+ * are meant to stay lines.
+ */
+.grid-2 > aside {
+  overflow-wrap: anywhere;
+}
+
+.grid-2 > aside .code-block {
+  white-space: pre-wrap;
+}
+
+.grid-2 > aside .badge {
+  white-space: normal;
+  text-align: left;
+}
+
 .stack {
   display: flex;
   flex-direction: column;
@@ -723,6 +750,41 @@ a.badge-plain:hover .badge {
   font-weight: 600;
 }
 
+/* A body inside a card: a message, an update, a recommendation, an answer.
+   Same grammar as a listing, tighter spacing, and no heading taller than the
+   card's own title. The last block loses its bottom margin so the meta line
+   underneath sits where it did when the body was one paragraph. */
+.prose-compact {
+  max-width: none;
+}
+
+.prose-compact p,
+.prose-compact ul,
+.prose-compact ol,
+.prose-compact blockquote,
+.prose-compact pre,
+.prose-compact .table-wrap {
+  margin: 0 0 0.6rem;
+}
+
+.prose-compact > :last-child {
+  margin-bottom: 0;
+}
+
+.prose-compact h1,
+.prose-compact h2,
+.prose-compact h3,
+.prose-compact h4,
+.prose-compact h5,
+.prose-compact h6 {
+  font-size: 1.05em;
+  margin: 0.9rem 0 0.3rem;
+}
+
+.prose-compact hr {
+  margin: 0.9rem 0;
+}
+
 /* --- misc -------------------------------------------------------------- */
 
 .code-block {
@@ -857,8 +919,6 @@ a.badge-plain:hover .badge {
 
 .update-body {
   margin: 0;
-  /* Written in a textarea, so its line breaks are the ones the author made. */
-  white-space: pre-wrap;
   /* A pasted URL is one unbreakable word and would otherwise push the card
      wider than the viewport on a phone. */
   overflow-wrap: anywhere;
@@ -867,3 +927,133 @@ a.badge-plain:hover .badge {
 .update-link {
   overflow-wrap: anywhere;
 }
+
+/* --- inbox ------------------------------------------------------------- */
+
+.nav-count {
+  display: inline-block;
+  min-width: 1.3em;
+  padding: 0 0.35em;
+  border-radius: 999px;
+  background: var(--primary);
+  color: var(--primary-foreground);
+  font-size: 0.75em;
+  line-height: 1.6;
+  text-align: center;
+}
+
+.thread-list,
+.message-list {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+  display: flex;
+  flex-direction: column;
+  gap: 0.75rem;
+}
+
+.thread-subject {
+  margin: 0.35rem 0 0.2rem;
+  font-weight: 600;
+}
+
+.thread-preview {
+  margin: 0;
+  overflow-wrap: anywhere;
+}
+
+.message {
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  padding: 0.9rem 1rem;
+  background: var(--card);
+  max-width: 92%;
+  scroll-margin-top: 5rem;
+}
+
+/* Yours sit to the right, theirs to the left, so a long thread scans. */
+.message.mine {
+  align-self: flex-end;
+  background: color-mix(in oklab, var(--primary) 8%, var(--card));
+}
+
+.message-meta {
+  margin: 0 0 0.35rem;
+}
+
+.message-body {
+  margin: 0;
+  overflow-wrap: anywhere;
+}
+
+.invoice {
+  border: 1px dashed var(--border);
+  border-radius: calc(var(--radius) - 2px);
+  padding: 0.75rem 0.9rem;
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+  /* Addresses and transaction hashes are one word each. */
+  overflow-wrap: anywhere;
+}
+
+.invoice-amount {
+  font-size: 1.25rem;
+  font-weight: 700;
+}
+
+.invoice-description {
+  margin: 0;
+  overflow-wrap: anywhere;
+}
+
+.invoice-form > summary {
+  cursor: pointer;
+}
+
+.wallet-list code {
+  overflow-wrap: anywhere;
+}
+
+.table {
+  width: 100%;
+  border-collapse: collapse;
+  font-size: 0.9rem;
+}
+
+.table th,
+.table td {
+  text-align: left;
+  padding: 0.5rem 0.6rem;
+  border-bottom: 1px solid var(--border);
+  vertical-align: top;
+}
+
+.table th {
+  color: var(--muted-foreground);
+  font-weight: 500;
+}
+
+/* --- recommendations --------------------------------------------------- */
+
+.recommendations {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+  display: flex;
+  flex-direction: column;
+  gap: 0.9rem;
+}
+
+.recommendation {
+  padding-left: 0.9rem;
+  border-left: 3px solid color-mix(in oklab, var(--primary) 45%, var(--border));
+}
+
+.recommendation-body {
+  overflow-wrap: anywhere;
+}
+
+.recommendation-meta {
+  margin: 0.35rem 0 0;
+}

package/web/public/sw.js

@@ -13,7 +13,7 @@
  * drifted, which is the only version of this rule that survives contact.
  */
 
-const VERSION = '0313cc56';
+const VERSION = 'bb197f9b';
 const SHELL = `shell-${VERSION}`;
 const ASSETS = ['/assets/app.css', '/assets/tokens.css', '/assets/icon.svg'];