autopilot-core-sandbox 0.0.1

package/dist/dist/migrations/20260721190304_create_qb_sync_task.sql

@@ -0,0 +1,120 @@
+-- Per-entity QuickBooks sync bookkeeping. The fan-out pass in autopilot-web
+-- (webhook-outbox-cron) converts client.*/invoice.* outbound_events into at
+-- most one PENDING task per entity for companies with QB sync enabled;
+-- /api/qb-sync-cron claims due tasks via claim_qb_sync_tasks and reconciles
+-- current Supabase state into QuickBooks. Tasks are self-contained (no FK to
+-- outbound_event) so the outbox retention purge never has to consider QB
+-- state.
+
+create table if not exists "public"."qb_sync_task" (
+    "id" uuid default gen_random_uuid() not null,
+    "created_at" timestamp with time zone default now() not null,
+    "company_id" uuid not null,
+    "entity_type" text not null,
+    "entity_id" uuid not null,
+    -- informational: newest event that (re)enqueued this task. Deliberately
+    -- NO foreign key — outbound_event rows are purged after 90 days and a
+    -- dangling debug pointer is fine.
+    "trigger_event_id" uuid,
+    "status" text default 'pending' not null,
+    "attempt_count" integer default 0 not null,
+    "next_attempt_at" timestamp with time zone default now() not null,
+    "last_attempt_at" timestamp with time zone,
+    "last_error" text
+);
+
+alter table only "public"."qb_sync_task"
+    add constraint "qb_sync_task_pkey" primary key ("id");
+
+alter table only "public"."qb_sync_task"
+    add constraint "qb_sync_task_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete cascade;
+
+alter table only "public"."qb_sync_task"
+    add constraint "qb_sync_task_entity_type_check"
+    check ("entity_type" in ('client', 'invoice'));
+
+-- pending:    waiting for next_attempt_at
+-- processing: claimed by a worker run (stuck rows swept back to pending)
+-- done:       reconciled into QB
+-- skipped:    QB sync disabled for the company at process time
+-- dead:       exhausted retries; kept for inspection
+alter table only "public"."qb_sync_task"
+    add constraint "qb_sync_task_status_check"
+    check ("status" in ('pending', 'processing', 'done', 'skipped', 'dead'));
+
+-- At most ONE pending task per entity: any burst of events while a task is
+-- pending collapses into it (the consumer re-reads state at process time, so
+-- intermediate events are pure duplicates). A task already claimed
+-- ('processing') does NOT block a new pending task — a write that lands
+-- mid-flight must trigger another sync afterwards.
+create unique index if not exists "qb_sync_task_pending_entity_key"
+    on "public"."qb_sync_task" ("company_id", "entity_type", "entity_id")
+    where "status" = 'pending';
+
+create index if not exists "qb_sync_task_due_idx"
+    on "public"."qb_sync_task" ("next_attempt_at")
+    where "status" = 'pending';
+
+-- FK support for the company cascade + failure-surfacing queries
+create index if not exists "qb_sync_task_company_idx"
+    on "public"."qb_sync_task" ("company_id", "created_at");
+
+-- Fan-out enqueue. An RPC because ON CONFLICT against a partial unique index
+-- needs the WHERE clause in the arbiter, which supabase-js upsert cannot
+-- express. tasks: [{company_id, entity_type, entity_id, trigger_event_id}]
+create or replace function "public"."enqueue_qb_sync_tasks"("tasks" jsonb)
+returns integer
+language "sql"
+security definer
+set search_path = 'public'
+as $$
+  with ins as (
+    insert into qb_sync_task (company_id, entity_type, entity_id, trigger_event_id)
+    select distinct
+      (t ->> 'company_id')::uuid,
+      t ->> 'entity_type',
+      (t ->> 'entity_id')::uuid,
+      (t ->> 'trigger_event_id')::uuid
+    from jsonb_array_elements(tasks) as t
+    on conflict ("company_id", "entity_type", "entity_id")
+      where "status" = 'pending'
+      do nothing
+    returning 1
+  )
+  select count(*)::integer from ins;
+$$;
+
+-- Atomic claim, mirroring claim_webhook_deliveries (SKIP LOCKED is not
+-- expressible through supabase-js; overlapping cron runs must never
+-- double-sync). Ordered client-tasks-first within the batch so a client and
+-- its invoice claimed together are processed parent-first.
+create or replace function "public"."claim_qb_sync_tasks"("batch_size" integer)
+returns setof "public"."qb_sync_task"
+language "sql"
+security definer
+set search_path = 'public'
+as $$
+  update qb_sync_task set
+    status = 'processing',
+    attempt_count = attempt_count + 1,
+    last_attempt_at = now()
+  where id in (
+    select id from qb_sync_task
+    where status = 'pending' and next_attempt_at <= now()
+    order by next_attempt_at, (entity_type = 'client') desc
+    limit least(batch_size, 1000)
+    for update skip locked
+  )
+  returning *;
+$$;
+
+revoke all on function "public"."enqueue_qb_sync_tasks"(jsonb) from public;
+revoke all on function "public"."enqueue_qb_sync_tasks"(jsonb) from "anon";
+revoke all on function "public"."enqueue_qb_sync_tasks"(jsonb) from "authenticated";
+grant execute on function "public"."enqueue_qb_sync_tasks"(jsonb) to "service_role";
+
+revoke all on function "public"."claim_qb_sync_tasks"(integer) from public;
+revoke all on function "public"."claim_qb_sync_tasks"(integer) from "anon";
+revoke all on function "public"."claim_qb_sync_tasks"(integer) from "authenticated";
+grant execute on function "public"."claim_qb_sync_tasks"(integer) to "service_role";

package/dist/dist/migrations/20260721190306_qb_sync_task_rls.sql

@@ -0,0 +1,8 @@
+-- RLS: qb_sync_task is service-role only.
+-- Same deliberate deviation (and rationale) as webhook_delivery's RLS:
+-- internal pipeline state with no product surface, so no company-scoped
+-- policies — anon/authenticated get no access at all.
+alter table "public"."qb_sync_task" enable row level security;
+revoke all on table "public"."qb_sync_task" from "anon";
+revoke all on table "public"."qb_sync_task" from "authenticated";
+grant all on table "public"."qb_sync_task" to "service_role";

package/dist/dist/migrations/20260721190307_qb_mapping_orphan_fks.sql

@@ -0,0 +1,29 @@
+-- The async QB consumer processes <entity>.deleted minutes after the row
+-- (and, today, its qb_to_* mapping — ON DELETE CASCADE) is gone, leaving no
+-- way to find the QB-side object to deactivate/delete. Switch client/invoice
+-- mappings to ON DELETE SET NULL so deletes leave an orphan row carrying the
+-- QB id; the consumer's orphan-reconcile pass deactivates/deletes in QB and
+-- then removes the orphan row.
+-- qb_to_payment.payment_id already works exactly this way (see cud-payment's
+-- toDelete pass) — this completes the pattern.
+-- (qb_to_payment.invoice_id keeps its CASCADE: orphan-invoice cleanup
+-- discovers linked QB payments from QB's Invoice.LinkedTxn, since our
+-- mapping rows are gone by design.)
+
+alter table "public"."qb_to_client" alter column "client_id" drop not null;
+alter table only "public"."qb_to_client" drop constraint "qb_to_client_client_id_fkey";
+alter table only "public"."qb_to_client"
+    add constraint "qb_to_client_client_id_fkey"
+    foreign key ("client_id") references "public"."client"("id") on delete set null;
+
+alter table "public"."qb_to_invoice" alter column "invoice_id" drop not null;
+alter table only "public"."qb_to_invoice" drop constraint "qb_to_invoice_invoice_id_fkey";
+alter table only "public"."qb_to_invoice"
+    add constraint "qb_to_invoice_invoice_id_fkey"
+    foreign key ("invoice_id") references "public"."invoice"("id") on delete set null;
+
+-- consumer orphan scans
+create index if not exists "qb_to_client_orphan_idx"
+    on "public"."qb_to_client" ("company_id") where "client_id" is null;
+create index if not exists "qb_to_invoice_orphan_idx"
+    on "public"."qb_to_invoice" ("company_id") where "invoice_id" is null;

package/dist/dist/migrations/20260721190308_qb_task_retention.sql

@@ -0,0 +1,90 @@
+-- Extend cleanup_webhook_outbox (20260721185631) to also purge terminal
+-- qb_sync_task rows past the event retention window. Same signature and
+-- behavior as before, plus a third result column.
+
+-- cleanup scans "old + terminal", matching the other outbox cleanup indexes
+create index if not exists "qb_sync_task_cleanup_idx"
+    on "public"."qb_sync_task" ("created_at")
+    where "status" in ('done', 'skipped', 'dead');
+
+drop function if exists "public"."cleanup_webhook_outbox"(integer, integer, integer);
+
+create or replace function "public"."cleanup_webhook_outbox"(
+    "event_retention_days" integer,
+    "delivery_retention_days" integer,
+    "batch_size" integer
+)
+returns table ("deliveries_deleted" integer, "events_deleted" integer, "qb_tasks_deleted" integer)
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+declare
+  -- floor of 7 days: a miscalled 0 must never purge fresh history
+  event_cutoff timestamptz :=
+    now() - make_interval(days => greatest(event_retention_days, 7));
+  delivery_cutoff timestamptz :=
+    now() - make_interval(days => greatest(delivery_retention_days, 7));
+  -- floor of 1: a caller-supplied 0 would otherwise LIMIT 0 into a silent
+  -- no-op, and a negative value is a runtime error
+  capped_batch integer := least(greatest(batch_size, 1), 5000);
+  del_count integer;
+  evt_count integer;
+  qb_count integer;
+begin
+  -- Deleting an event cascades its deliveries regardless of delivery_cutoff,
+  -- so the event window must never be the shorter one.
+  if greatest(event_retention_days, 7) < greatest(delivery_retention_days, 7) then
+    raise exception 'event_retention_days (%) must be >= delivery_retention_days (%)',
+      event_retention_days, delivery_retention_days;
+  end if;
+
+  -- Terminal deliveries first, so the outbound_event cascade below touches
+  -- almost nothing and each statement's row count stays bounded.
+  delete from webhook_delivery
+  where id in (
+    select id from webhook_delivery
+    where status in ('delivered', 'skipped', 'dead')
+      and created_at < delivery_cutoff
+    order by created_at
+    limit capped_batch
+  );
+  get diagnostics del_count = row_count;
+
+  delete from outbound_event
+  where id in (
+    select id from outbound_event
+    where processed_at is not null
+      and created_at < event_cutoff
+      -- belt-and-suspenders: never cascade away a live delivery (retries
+      -- terminate ~1.6 days after creation, so this should match nothing)
+      and not exists (
+        select 1 from webhook_delivery d
+        where d.event_id = outbound_event.id
+          and d.status in ('pending', 'delivering')
+      )
+    order by created_at
+    limit capped_batch
+  );
+  get diagnostics evt_count = row_count;
+
+  -- Terminal QB sync tasks share the event window; pending/processing rows
+  -- are never touched.
+  delete from qb_sync_task
+  where id in (
+    select id from qb_sync_task
+    where status in ('done', 'skipped', 'dead')
+      and created_at < event_cutoff
+    order by created_at
+    limit capped_batch
+  );
+  get diagnostics qb_count = row_count;
+
+  return query select del_count, evt_count, qb_count;
+end;
+$$;
+
+revoke all on function "public"."cleanup_webhook_outbox"(integer, integer, integer) from public;
+revoke all on function "public"."cleanup_webhook_outbox"(integer, integer, integer) from "anon";
+revoke all on function "public"."cleanup_webhook_outbox"(integer, integer, integer) from "authenticated";
+grant execute on function "public"."cleanup_webhook_outbox"(integer, integer, integer) to "service_role";

package/dist/dist/migrations/20260721234401_create_permission_role.sql

@@ -0,0 +1,83 @@
+-- Company-configurable permission roles. Each company gets seeded 'admin' and
+-- 'technician' rows (system_key non-null, editable but not deletable) and can
+-- create any number of custom roles. Owner is NOT a row: role_id 1 users keep
+-- permission_role_id NULL and resolve to all-permissions in app code.
+--
+-- One boolean column per permission (not JSONB) so the generated types carry
+-- real booleans; column DEFAULTs are the restrictive new-company Technician
+-- values, which also makes future ADD COLUMN migrations fail-closed.
+--
+-- claim_tier drives user_role.role_id on assignment (2 = admin-tier JWT claim,
+-- 3 = technician-tier). RLS policies keep reading the existing autopilot_role
+-- claim untouched; the only permission whose client-side writes require the
+-- admin claim is manage_company_settings, so the roles editor/API forces
+-- claim_tier = 2 whenever that toggle is on.
+
+create table if not exists "public"."permission_role" (
+    "id" uuid default gen_random_uuid() not null,
+    "created_at" timestamp with time zone default now() not null,
+    "company_id" uuid not null,
+    "name" text not null,
+    -- 'admin' / 'technician' for the per-company seeded rows; null = custom
+    "system_key" text,
+    "claim_tier" smallint default 3 not null,
+
+    -- list visibility (off = entity reachable only through assigned jobs)
+    "view_invoices_list" boolean default false not null,
+    "view_estimates_list" boolean default false not null,
+    "view_clients_list" boolean default false not null,
+
+    -- phone screen: master toggle + sub-toggles (sub-toggles only meaningful
+    -- when phone_access is on; dial-out stays available by default)
+    "phone_access" boolean default false not null,
+    "phone_view_recent_calls" boolean default false not null,
+    "phone_view_voicemail" boolean default false not null,
+    "phone_dial_out" boolean default true not null,
+
+    -- off = chats scoped to clients with an open job assigned to the user
+    "view_all_chats" boolean default false not null,
+    "map_view_employee_locations" boolean default false not null,
+    "view_analytics" boolean default false not null,
+
+    "create_jobs" boolean default true not null,
+    "create_invoices" boolean default true not null,
+    "create_clients" boolean default true not null,
+    "create_estimates" boolean default true not null,
+    "create_leads" boolean default true not null,
+
+    "delete_jobs" boolean default false not null,
+    "delete_invoices" boolean default false not null,
+    "delete_clients" boolean default false not null,
+    "delete_estimates" boolean default false not null,
+    "delete_leads" boolean default false not null,
+
+    "web_access" boolean default false not null,
+    "edit_time_cards" boolean default false not null,
+    "manage_roles" boolean default false not null,
+    "manage_company_settings" boolean default false not null
+);
+
+alter table only "public"."permission_role"
+    add constraint "permission_role_pkey" primary key ("id");
+
+alter table only "public"."permission_role"
+    add constraint "permission_role_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete cascade;
+
+alter table only "public"."permission_role"
+    add constraint "permission_role_system_key_check"
+    check ("system_key" in ('admin', 'technician'));
+
+alter table only "public"."permission_role"
+    add constraint "permission_role_claim_tier_check"
+    check ("claim_tier" in (2, 3));
+
+alter table only "public"."permission_role"
+    add constraint "permission_role_company_name_key"
+    unique ("company_id", "name");
+
+-- at most one seeded admin + one seeded technician per company; NULLs are
+-- distinct so custom roles are unconstrained
+alter table only "public"."permission_role"
+    add constraint "permission_role_company_system_key_key"
+    unique ("company_id", "system_key");

package/dist/dist/migrations/20260721234402_permission_role_rls.sql

@@ -0,0 +1,22 @@
+-- RLS for permission_role (affected table: permission_role).
+--
+-- Read-only for clients: every authenticated user must be able to read the
+-- roles of their own company (both apps resolve the current user's permission
+-- set from the joined row, and the roles UIs list them). All writes go through
+-- autopilot-web API routes using the service role and are permission-checked
+-- there ('manage_roles') — so there are deliberately NO insert/update/delete
+-- policies; RLS default-deny blocks client writes.
+
+alter table "public"."permission_role" enable row level security;
+
+-- no anon grant: no anonymous use case
+grant all on table "public"."permission_role" to "authenticated";
+grant all on table "public"."permission_role" to "service_role";
+
+create policy "Anyone with matching company_id can view"
+on "public"."permission_role"
+for select
+to "authenticated"
+using (
+    ((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id")
+);

package/dist/dist/migrations/20260721234403_user_role_add_permission_role_id.sql

@@ -0,0 +1,12 @@
+-- Link each user_role row to its configurable permission role.
+-- NULL = owner (role_id 1): owners are all-permissions in code and never
+-- reference a permission_role row. The plain (NO ACTION) FK doubles as the
+-- "can't delete a role that's still assigned" guard — the delete API surfaces
+-- the violation as a friendly error.
+
+alter table "public"."user_role"
+    add column "permission_role_id" uuid;
+
+alter table only "public"."user_role"
+    add constraint "user_role_permission_role_id_fkey"
+    foreign key ("permission_role_id") references "public"."permission_role"("id");

package/dist/dist/migrations/20260721234404_seed_permission_roles.sql

@@ -0,0 +1,100 @@
+-- Seed permission roles.
+--
+-- Two different Technician value sets, on purpose:
+--   * NEW companies (trigger): restrictive defaults — the permission_role
+--     column DEFAULTs (lists/phone/chats/analytics/map/web off, create on,
+--     delete off).
+--   * EXISTING companies (one-shot INSERTs below): grandfathered values that
+--     reproduce today's effective technician access, so shipping this feature
+--     changes nothing for current customers until they edit the role:
+--     lists visible, full phone screen (mobile shows it today; web techs gain
+--     it — deliberate, decided 2026-07-21), all chats, web login allowed,
+--     time-card editing allowed; map employee locations, analytics, deletes,
+--     and settings/roles management stay off (all hidden/blocked today).
+-- Admin rows are identical in both paths: everything on, claim_tier 2.
+
+-- Trigger first, then the one-shot seed with ON CONFLICT: a company inserted
+-- while this migration runs gets rows from exactly one path.
+create or replace function "public"."seed_permission_roles_for_company"()
+returns trigger
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+begin
+    insert into permission_role (
+        company_id, name, system_key, claim_tier,
+        view_invoices_list, view_estimates_list, view_clients_list,
+        phone_access, phone_view_recent_calls, phone_view_voicemail, phone_dial_out,
+        view_all_chats, map_view_employee_locations, view_analytics,
+        create_jobs, create_invoices, create_clients, create_estimates, create_leads,
+        delete_jobs, delete_invoices, delete_clients, delete_estimates, delete_leads,
+        web_access, edit_time_cards, manage_roles, manage_company_settings
+    ) values (
+        new.id, 'Admin', 'admin', 2,
+        true, true, true,
+        true, true, true, true,
+        true, true, true,
+        true, true, true, true, true,
+        true, true, true, true, true,
+        true, true, true, true
+    )
+    on conflict ("company_id", "system_key") do nothing;
+
+    -- restrictive Technician: column defaults
+    insert into permission_role (company_id, name, system_key, claim_tier)
+    values (new.id, 'Technician', 'technician', 3)
+    on conflict ("company_id", "system_key") do nothing;
+
+    return new;
+end;
+$$;
+
+create trigger "seed_permission_roles_trigger"
+after insert on "public"."company"
+for each row execute function "public"."seed_permission_roles_for_company"();
+
+-- One-shot seed for existing companies: Admin (all on)
+insert into "public"."permission_role" (
+    company_id, name, system_key, claim_tier,
+    view_invoices_list, view_estimates_list, view_clients_list,
+    phone_access, phone_view_recent_calls, phone_view_voicemail, phone_dial_out,
+    view_all_chats, map_view_employee_locations, view_analytics,
+    create_jobs, create_invoices, create_clients, create_estimates, create_leads,
+    delete_jobs, delete_invoices, delete_clients, delete_estimates, delete_leads,
+    web_access, edit_time_cards, manage_roles, manage_company_settings
+)
+select
+    c.id, 'Admin', 'admin', 2,
+    true, true, true,
+    true, true, true, true,
+    true, true, true,
+    true, true, true, true, true,
+    true, true, true, true, true,
+    true, true, true, true
+from "public"."company" c
+on conflict ("company_id", "system_key") do nothing;
+
+-- One-shot seed for existing companies: grandfathered Technician
+insert into "public"."permission_role" (
+    company_id, name, system_key, claim_tier,
+    view_invoices_list, view_estimates_list, view_clients_list,
+    phone_access, phone_view_recent_calls, phone_view_voicemail, phone_dial_out,
+    view_all_chats, map_view_employee_locations, view_analytics,
+    create_jobs, create_invoices, create_clients, create_estimates, create_leads,
+    delete_jobs, delete_invoices, delete_clients, delete_estimates, delete_leads,
+    web_access, edit_time_cards, manage_roles, manage_company_settings
+)
+select
+    c.id, 'Technician', 'technician', 3,
+    true, true, true,          -- lists visible today
+    true, true, true, true,    -- full phone screen (mobile parity)
+    true,                      -- all chats visible today
+    false, false,              -- map employee locations / analytics hidden today
+    true, true, true, true, true,      -- creation allowed today
+    false, false, false, false, false, -- deletes blocked today
+    true,                      -- web login not blocked today
+    true,                      -- time-card editing ungated today
+    false, false               -- roles / company settings management: admin-only
+from "public"."company" c
+on conflict ("company_id", "system_key") do nothing;

package/dist/dist/migrations/20260721234405_backfill_user_role_permission_role_id.sql

@@ -0,0 +1,20 @@
+-- Backfill user_role.permission_role_id from the seeded per-company rows.
+-- role_id 2 (admin) -> seeded Admin; role_id 3 (technician) and 9
+-- (subcontractor) -> seeded Technician; role_id 1 (owner) stays NULL —
+-- owners resolve to all-permissions in code and never reference a row.
+
+update "public"."user_role" ur
+set "permission_role_id" = pr."id"
+from "public"."permission_role" pr
+where pr."company_id" = ur."company_id"
+  and pr."system_key" = 'admin'
+  and ur."role_id" = 2
+  and ur."permission_role_id" is null;
+
+update "public"."user_role" ur
+set "permission_role_id" = pr."id"
+from "public"."permission_role" pr
+where pr."company_id" = ur."company_id"
+  and pr."system_key" = 'technician'
+  and ur."role_id" in (3, 9)
+  and ur."permission_role_id" is null;

package/dist/dist/migrations/20260722193800_permission_role_add_manage_employees.sql

@@ -0,0 +1,56 @@
+-- manage_employees: create / edit / delete employees and subcontractors.
+--
+-- Column DEFAULT false = fail-closed everywhere it isn't explicitly granted:
+-- every existing row (Technician, custom roles) and new-company Technician
+-- seeds stay off. Only Admin rows get true — the trigger below for new
+-- companies, the one-shot UPDATE for existing ones. Custom admin-tier roles
+-- deliberately lose employee access until the toggle is enabled for them.
+
+alter table "public"."permission_role"
+    add column if not exists "manage_employees" boolean default false not null;
+
+-- Replace the seed function so new companies' Admin row includes the new
+-- column explicitly (Technician keeps relying on column defaults).
+-- create or replace is safe: seed_permission_roles_trigger binds by name.
+create or replace function "public"."seed_permission_roles_for_company"()
+returns trigger
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+begin
+    insert into permission_role (
+        company_id, name, system_key, claim_tier,
+        view_invoices_list, view_estimates_list, view_clients_list,
+        phone_access, phone_view_recent_calls, phone_view_voicemail, phone_dial_out,
+        view_all_chats, map_view_employee_locations, view_analytics,
+        create_jobs, create_invoices, create_clients, create_estimates, create_leads,
+        delete_jobs, delete_invoices, delete_clients, delete_estimates, delete_leads,
+        web_access, edit_time_cards, manage_roles, manage_company_settings,
+        manage_employees
+    ) values (
+        new.id, 'Admin', 'admin', 2,
+        true, true, true,
+        true, true, true, true,
+        true, true, true,
+        true, true, true, true, true,
+        true, true, true, true, true,
+        true, true, true, true,
+        true
+    )
+    on conflict ("company_id", "system_key") do nothing;
+
+    -- restrictive Technician: column defaults (manage_employees false)
+    insert into permission_role (company_id, name, system_key, claim_tier)
+    values (new.id, 'Technician', 'technician', 3)
+    on conflict ("company_id", "system_key") do nothing;
+
+    return new;
+end;
+$$;
+
+-- One-shot backfill: ONLY seeded Admin rows. Custom roles and Technician
+-- stay false (fail closed) until a manage_roles holder turns it on.
+update "public"."permission_role"
+set "manage_employees" = true
+where "system_key" = 'admin';

package/dist/dist/migrations/20260723025606_staging_new_employee_company_read_rls.sql

@@ -0,0 +1,10 @@
+-- staging_new_employee gains the same company-wide read policy that user and
+-- user_role already have ("Read-only for matching companyId"). Employee lists
+-- read staging_new_employee client-side (core fetchEmployees, mobile resend
+-- invite), but the existing policies only cover own-row, the admin claim, and
+-- the owner claim — so technician-claim users holding the manage_employees
+-- permission see no pending/reinvited employees. Read-only widening: all
+-- staging writes remain owner-claim or service-role paths.
+CREATE POLICY "Read-only for matching companyId" ON "public"."staging_new_employee"
+  FOR SELECT TO "authenticated"
+  USING (((NULLIF(TRIM(BOTH '"'::"text" FROM ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"));