autopilot-core-sandbox 0.0.1

package/dist/dist/migrations/20260726010001_bing_ads_integration_rls.sql

@@ -0,0 +1,227 @@
+-- Bing Ads settings and cached spend are accessed only by authenticated
+-- server routes using the service role, matching the Facebook Ads and Google
+-- LSA integrations' posture. The browser gets no direct table access; the
+-- encrypted refresh token in particular must never be readable client-side.
+alter table "public"."bing_ads_connection" enable row level security;
+alter table "public"."settings_bing_ads" enable row level security;
+alter table "public"."bing_ads_daily_spend" enable row level security;
+
+revoke all on table "public"."bing_ads_connection" from public;
+revoke all on table "public"."bing_ads_connection" from "anon";
+revoke all on table "public"."bing_ads_connection" from "authenticated";
+
+revoke all on table "public"."settings_bing_ads" from public;
+revoke all on table "public"."settings_bing_ads" from "anon";
+revoke all on table "public"."settings_bing_ads" from "authenticated";
+
+revoke all on table "public"."bing_ads_daily_spend" from public;
+revoke all on table "public"."bing_ads_daily_spend" from "anon";
+revoke all on table "public"."bing_ads_daily_spend" from "authenticated";
+
+grant all on table "public"."bing_ads_connection" to "service_role";
+grant all on table "public"."settings_bing_ads" to "service_role";
+grant all on table "public"."bing_ads_daily_spend" to "service_role";
+
+revoke all on function "public"."set_bing_ads_selected_account"(
+    "uuid",
+    "text",
+    "text",
+    "text",
+    "text",
+    "text",
+    "text",
+    "text"
+) from public;
+revoke all on function "public"."set_bing_ads_selected_account"(
+    "uuid",
+    "text",
+    "text",
+    "text",
+    "text",
+    "text",
+    "text",
+    "text"
+) from "anon";
+revoke all on function "public"."set_bing_ads_selected_account"(
+    "uuid",
+    "text",
+    "text",
+    "text",
+    "text",
+    "text",
+    "text",
+    "text"
+) from "authenticated";
+grant execute on function "public"."set_bing_ads_selected_account"(
+    "uuid",
+    "text",
+    "text",
+    "text",
+    "text",
+    "text",
+    "text",
+    "text"
+) to "service_role";
+
+revoke all on function "public"."clear_bing_ads_selected_account"(
+    "uuid"
+) from public;
+revoke all on function "public"."clear_bing_ads_selected_account"(
+    "uuid"
+) from "anon";
+revoke all on function "public"."clear_bing_ads_selected_account"(
+    "uuid"
+) from "authenticated";
+grant execute on function "public"."clear_bing_ads_selected_account"(
+    "uuid"
+) to "service_role";
+
+revoke all on function "public"."upsert_bing_ads_daily_spend"(
+    "uuid",
+    "uuid",
+    "text",
+    "text",
+    jsonb
+) from public;
+revoke all on function "public"."upsert_bing_ads_daily_spend"(
+    "uuid",
+    "uuid",
+    "text",
+    "text",
+    jsonb
+) from "anon";
+revoke all on function "public"."upsert_bing_ads_daily_spend"(
+    "uuid",
+    "uuid",
+    "text",
+    "text",
+    jsonb
+) from "authenticated";
+grant execute on function "public"."upsert_bing_ads_daily_spend"(
+    "uuid",
+    "uuid",
+    "text",
+    "text",
+    jsonb
+) to "service_role";
+
+revoke all on function "public"."set_bing_ads_source"(
+    "uuid",
+    "uuid"
+) from public;
+revoke all on function "public"."set_bing_ads_source"(
+    "uuid",
+    "uuid"
+) from "anon";
+revoke all on function "public"."set_bing_ads_source"(
+    "uuid",
+    "uuid"
+) from "authenticated";
+grant execute on function "public"."set_bing_ads_source"(
+    "uuid",
+    "uuid"
+) to "service_role";
+
+revoke all on function "public"."clear_bing_ads_source"(
+    "uuid"
+) from public;
+revoke all on function "public"."clear_bing_ads_source"(
+    "uuid"
+) from "anon";
+revoke all on function "public"."clear_bing_ads_source"(
+    "uuid"
+) from "authenticated";
+grant execute on function "public"."clear_bing_ads_source"(
+    "uuid"
+) to "service_role";
+
+revoke all on function "public"."get_bing_ads_report"(
+    "uuid",
+    date,
+    date
+) from public;
+revoke all on function "public"."get_bing_ads_report"(
+    "uuid",
+    date,
+    date
+) from "anon";
+revoke all on function "public"."get_bing_ads_report"(
+    "uuid",
+    date,
+    date
+) from "authenticated";
+grant execute on function "public"."get_bing_ads_report"(
+    "uuid",
+    date,
+    date
+) to "service_role";
+
+revoke all on function "public"."get_bing_ads_job_sales_breakdown"(
+    "uuid",
+    date,
+    date,
+    integer,
+    integer
+) from public;
+revoke all on function "public"."get_bing_ads_job_sales_breakdown"(
+    "uuid",
+    date,
+    date,
+    integer,
+    integer
+) from "anon";
+revoke all on function "public"."get_bing_ads_job_sales_breakdown"(
+    "uuid",
+    date,
+    date,
+    integer,
+    integer
+) from "authenticated";
+grant execute on function "public"."get_bing_ads_job_sales_breakdown"(
+    "uuid",
+    date,
+    date,
+    integer,
+    integer
+) to "service_role";
+
+revoke all on function "public"."append_bing_ads_source_name_on_rename"()
+from public;
+revoke all on function "public"."append_bing_ads_source_name_on_rename"()
+from "anon";
+revoke all on function "public"."append_bing_ads_source_name_on_rename"()
+from "authenticated";
+revoke all on function "public"."append_bing_ads_source_name_on_rename"()
+from "service_role";
+
+revoke all on function "public"."prevent_bing_ads_source_name_collision"()
+from public;
+revoke all on function "public"."prevent_bing_ads_source_name_collision"()
+from "anon";
+revoke all on function "public"."prevent_bing_ads_source_name_collision"()
+from "authenticated";
+revoke all on function "public"."prevent_bing_ads_source_name_collision"()
+from "service_role";
+
+revoke all on function "public"."prevent_bing_ads_duplicate_ads_source_assignment"()
+from public;
+revoke all on function "public"."prevent_bing_ads_duplicate_ads_source_assignment"()
+from "anon";
+revoke all on function "public"."prevent_bing_ads_duplicate_ads_source_assignment"()
+from "authenticated";
+revoke all on function "public"."prevent_bing_ads_duplicate_ads_source_assignment"()
+from "service_role";
+
+revoke all on function "public"."prevent_other_ads_source_conflicts_with_bing_ads"()
+from public;
+revoke all on function "public"."prevent_other_ads_source_conflicts_with_bing_ads"()
+from "anon";
+revoke all on function "public"."prevent_other_ads_source_conflicts_with_bing_ads"()
+from "authenticated";
+revoke all on function "public"."prevent_other_ads_source_conflicts_with_bing_ads"()
+from "service_role";
+
+revoke all on function "public"."set_bing_ads_updated_at"() from public;
+revoke all on function "public"."set_bing_ads_updated_at"() from "anon";
+revoke all on function "public"."set_bing_ads_updated_at"() from "authenticated";
+grant execute on function "public"."set_bing_ads_updated_at"() to "service_role";

package/dist/dist/migrations/20260726220000_add_document_theme_settings.sql

@@ -0,0 +1,11 @@
+-- Adds PDF document theme selection for estimates and invoices.
+-- Additive and backward-compatible: existing rows default to 'classic',
+-- which renders the exact same PDF design as before this feature.
+alter table public.settings_company
+  add column if not exists estimate_theme text not null default 'classic',
+  add column if not exists invoice_theme text not null default 'classic';
+
+comment on column public.settings_company.estimate_theme is
+  'PDF theme for estimates: classic | modern | minimal | bold | executive';
+comment on column public.settings_company.invoice_theme is
+  'PDF theme for invoices: classic | modern | minimal | bold | executive';

package/dist/dist/migrations/20260726220001_update_document_theme_comments.sql

@@ -0,0 +1,7 @@
+-- Documentation-only: the previous comments hard-coded the theme list, which
+-- went stale as themes were added (aurora, blueprint, heritage, studio,
+-- breeze). Point at the app registry instead so they never drift again.
+comment on column public.settings_company.estimate_theme is
+  'PDF theme id for estimates; valid values live in autopilot-web src/app/components/pdf-components/themes/themeIds.ts (unknown values render as classic)';
+comment on column public.settings_company.invoice_theme is
+  'PDF theme id for invoices; valid values live in autopilot-web src/app/components/pdf-components/themes/themeIds.ts (unknown values render as classic)';

package/dist/dist/migrations/20260727210319_evolve_tier_for_pricing.sql

@@ -0,0 +1,68 @@
+-- Pricing tiers (Run / Grow / Scale).
+--
+-- Adds a stable machine key to the existing tier catalog and seeds the three
+-- public plans. Rows already in the live table (the legacy basic/standard/...
+-- catalog that billing.tier_id points at, including the DEFAULT 2 row) are
+-- left untouched with key NULL: the entitlement resolver in
+-- src/server-safe/entitlements.ts treats a NULL/unknown key as a legacy
+-- (grandfathered) company and applies LEGACY_ENTITLEMENTS. Nothing is written
+-- to any billing row here, so applying this migration changes no company's
+-- access.
+--
+-- Code must reference tiers by key, never by id: identity ids differ between
+-- environments, and the legacy rows have no key on purpose.
+--
+-- The legacy includes_* boolean columns and the *_limit columns are read by
+-- no code (the feature matrix lives in entitlements.ts); the seeded values
+-- below are conservative placeholders. users_included / phone_numbers_included
+-- ARE read (seat and phone-line allowances).
+
+alter table "public"."tier" add column if not exists "key" text;
+
+do $$
+begin
+    alter table "public"."tier" add constraint "tier_key_check"
+        check ("key" is null or "key" in ('run', 'grow', 'scale'));
+exception
+    when duplicate_object then null;
+end $$;
+
+create unique index if not exists "tier_key_unique"
+    on "public"."tier" ("key")
+    where "key" is not null;
+
+-- The existing tier rows were inserted with explicit ids (id is GENERATED BY
+-- DEFAULT AS IDENTITY), so tier_id_seq never advanced past them and the seed
+-- insert below would collide on tier_pkey. Resync the sequence to the table
+-- before inserting.
+select setval(
+    pg_get_serial_sequence('public.tier', 'id'),
+    coalesce((select max("id") from "public"."tier"), 0) + 1,
+    false
+);
+
+insert into "public"."tier" (
+    "name", "key", "users_included", "users_limit",
+    "phone_numbers_included", "phone_numbers_limit",
+    "includes_call_forwarding", "includes_voip", "includes_marketing_tools",
+    "includes_google_ads", "includes_zapier", "includes_quickbooks"
+)
+select
+    t."name", t."key", t."users_included", t."users_limit",
+    t."phone_numbers_included", t."phone_numbers_limit",
+    t."includes_call_forwarding", t."includes_voip", t."includes_marketing_tools",
+    t."includes_google_ads", t."includes_zapier", t."includes_quickbooks"
+from (
+    values
+        ('Run',   'run',   1, 50, 0, 0,  false, false, false, false, false, false),
+        ('Grow',  'grow',  3, 50, 1, 25, true,  true,  false, false, false, false),
+        ('Scale', 'scale', 7, 50, 1, 25, true,  true,  true,  true,  true,  true)
+) as t (
+    "name", "key", "users_included", "users_limit",
+    "phone_numbers_included", "phone_numbers_limit",
+    "includes_call_forwarding", "includes_voip", "includes_marketing_tools",
+    "includes_google_ads", "includes_zapier", "includes_quickbooks"
+)
+where not exists (
+    select 1 from "public"."tier" existing where existing."key" = t."key"
+);

package/dist/dist/migrations/20260727210320_create_billing_addon.sql

@@ -0,0 +1,85 @@
+-- Purchased add-ons for the Run/Grow pricing tiers (Scale includes all
+-- add-ons, so Scale companies have no rows here).
+--
+-- One row per (company, add-on). This is a purchase record, not a settings
+-- toggle: rows are written only by the web server (service_role) from the
+-- Stripe purchase routes and the stripe-webhook reconciler, which stores the
+-- Stripe subscription item id so removal and webhook diffing can target the
+-- exact line item. A keyed table (rather than boolean columns on billing)
+-- keeps the 1:1 billing row narrow and makes adding a future add-on a
+-- one-line CHECK change.
+--
+-- addon_key values mirror ADDON_KEYS in src/server-safe/entitlements.ts;
+-- the two lists must stay in sync.
+
+create table if not exists "public"."billing_addon" (
+    "id" uuid default gen_random_uuid() not null,
+    "created_at" timestamp with time zone default "now"() not null,
+    "updated_at" timestamp with time zone default "now"() not null,
+    "company_id" uuid not null,
+    "addon_key" text not null,
+    -- 'canceled' rows are kept (not deleted) so the purchase history and the
+    -- Stripe item linkage survive removal; the resolver only honors 'active'.
+    "status" text default 'active' not null,
+    "stripe_subscription_item_id" text
+);
+
+alter table "public"."billing_addon" owner to "postgres";
+
+alter table only "public"."billing_addon"
+    add constraint "billing_addon_pkey" primary key ("id");
+
+alter table only "public"."billing_addon"
+    add constraint "billing_addon_company_id_addon_key_key" unique ("company_id", "addon_key");
+
+alter table only "public"."billing_addon"
+    add constraint "billing_addon_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete cascade;
+
+do $$
+begin
+    alter table "public"."billing_addon" add constraint "billing_addon_addon_key_check"
+        check ("addon_key" in (
+            'ai_voice_assistant',
+            'dumpster_asset_tracking',
+            'marketing_tools',
+            'open_api',
+            'quickbooks',
+            'gps_tracking',
+            'client_portal',
+            'google_reserve',
+            'employee_permissions',
+            'google_ads',
+            'facebook_ads',
+            'bing_ads'
+        ));
+exception
+    when duplicate_object then null;
+end $$;
+
+do $$
+begin
+    alter table "public"."billing_addon" add constraint "billing_addon_status_check"
+        check ("status" in ('active', 'canceled'));
+exception
+    when duplicate_object then null;
+end $$;
+
+create index if not exists "billing_addon_company_id_idx"
+    on "public"."billing_addon" ("company_id");
+
+create or replace function "public"."set_billing_addon_updated_at"()
+returns "trigger"
+language "plpgsql"
+as $$
+begin
+    new."updated_at" = "now"();
+    return new;
+end;
+$$;
+
+alter function "public"."set_billing_addon_updated_at"() owner to "postgres";
+
+create or replace trigger "set_billing_addon_updated_at_trigger"
+before update on "public"."billing_addon"
+for each row execute function "public"."set_billing_addon_updated_at"();

package/dist/dist/migrations/20260727210321_create_billing_addon_rls.sql

@@ -0,0 +1,21 @@
+-- RLS for billing_addon.
+--
+-- Mirrors the billing table's posture: companies can READ their own add-on
+-- rows (web client and mobile read entitlements directly), but all writes go
+-- through the web server's service_role client (Stripe purchase routes and
+-- the stripe-webhook reconciler). No insert/update/delete policies for
+-- authenticated on purpose - default-deny covers writes.
+
+alter table "public"."billing_addon" enable row level security;
+
+-- no anon grant: no anonymous use case
+grant all on table "public"."billing_addon" to "authenticated";
+grant all on table "public"."billing_addon" to "service_role";
+
+create policy "Read-only for matching companyId"
+on "public"."billing_addon"
+for select
+to "authenticated"
+using (
+    ((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id")
+);

package/dist/dist/migrations/20260728213930_create_usage_metering.sql

@@ -0,0 +1,189 @@
+-- Usage metering for the Run/Grow/Scale overage billing.
+--
+-- Two tables:
+--
+--   usage_event  - append-only ledger written at capture time for the evented
+--                  meters (organic SMS/MMS segments and the wallet-charged
+--                  marketing sends). AI voice minutes are derived from
+--                  phone_call and VoIP minutes are pulled from Twilio at
+--                  sweep time, so neither writes events here.
+--   usage_charge - one row per charge or monthly statement line: Stripe
+--                  pending invoice items created by the monthly sweep
+--                  (organic overage), wallet deductions/refunds made by the
+--                  marketing send paths, and zero/skipped statement rows so
+--                  the table doubles as the per-period usage statement the
+--                  billing UI reads.
+--
+-- meter values mirror METER_KEYS in src/server-safe/entitlements.ts; the
+-- lists must stay in sync. Quantities are integers in the meter's native
+-- unit (segments, messages, emails, minutes).
+
+create table if not exists "public"."usage_event" (
+    "id" bigint generated always as identity not null,
+    "company_id" uuid not null,
+    "meter" text not null,
+    -- Negative quantities are adjustments (e.g. releasing quota for the
+    -- unsent remainder of an aborted email blast).
+    "quantity" integer not null,
+    "occurred_at" timestamp with time zone default "now"() not null,
+    -- Code path that produced the event ('send-sms', 'inbound', 'blast', ...).
+    "source" text not null,
+    -- External id for retry dedupe and audit joins: Twilio message sid,
+    -- blast chunk charge key, etc. Nullable because not every path has one.
+    "ref" text
+);
+
+alter table "public"."usage_event" owner to "postgres";
+
+alter table only "public"."usage_event"
+    add constraint "usage_event_pkey" primary key ("id");
+
+alter table only "public"."usage_event"
+    add constraint "usage_event_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete cascade;
+
+do $$
+begin
+    alter table "public"."usage_event" add constraint "usage_event_meter_check"
+        check ("meter" in (
+            'sms_segments',
+            'mms_messages',
+            'marketing_sms_segments',
+            'marketing_emails'
+        ));
+exception
+    when duplicate_object then null;
+end $$;
+
+do $$
+begin
+    alter table "public"."usage_event" add constraint "usage_event_quantity_check"
+        check ("quantity" <> 0);
+exception
+    when duplicate_object then null;
+end $$;
+
+-- Month-to-date aggregation per company per meter.
+create index if not exists "usage_event_company_meter_time_idx"
+    on "public"."usage_event" ("company_id", "meter", "occurred_at");
+
+-- Dedupe for retried writers (Twilio webhook redeliveries, QStash retries):
+-- the same external ref never records twice on the same meter. Scoped by
+-- company so equal refs from independent tenants can never suppress each
+-- other's events.
+create unique index if not exists "usage_event_company_meter_ref_uniq"
+    on "public"."usage_event" ("company_id", "meter", "ref") where "ref" is not null;
+
+create table if not exists "public"."usage_charge" (
+    "id" bigint generated always as identity not null,
+    "company_id" uuid not null,
+    -- [period_start, period_end) - end exclusive. Calendar months (UTC) for
+    -- sweep rows; wallet rows use the month the charge landed in.
+    "period_start" date not null,
+    "period_end" date not null,
+    "meter" text not null,
+    -- 'invoice_item'     - organic overage charged via a Stripe pending
+    --                      invoice item (monthly sweep)
+    -- 'wallet_deduction' - marketing overage prepaid from billing.balance
+    -- 'wallet_refund'    - reversal of a wallet_deduction (aborted blast)
+    -- 'statement'        - informational rollup row, nothing charged here
+    "kind" text not null,
+    "quantity_total" numeric default 0 not null,
+    "quantity_included" numeric default 0 not null,
+    "quantity_charged" numeric default 0 not null,
+    -- USD per unit at charge time (rates live in code and can change).
+    "unit_rate" numeric default 0 not null,
+    "amount_cents" integer default 0 not null,
+    "status" text not null,
+    "stripe_invoice_item_id" text,
+    -- The double-charge guard: writers upsert on this key, so retries of the
+    -- same logical charge collapse into one row.
+    "idempotency_key" text not null,
+    "metadata" jsonb default '{}'::jsonb not null,
+    "created_at" timestamp with time zone default "now"() not null
+);
+
+alter table "public"."usage_charge" owner to "postgres";
+
+alter table only "public"."usage_charge"
+    add constraint "usage_charge_pkey" primary key ("id");
+
+alter table only "public"."usage_charge"
+    add constraint "usage_charge_idempotency_key_key" unique ("idempotency_key");
+
+alter table only "public"."usage_charge"
+    add constraint "usage_charge_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete cascade;
+
+do $$
+begin
+    alter table "public"."usage_charge" add constraint "usage_charge_meter_check"
+        check ("meter" in (
+            'sms_segments',
+            'mms_messages',
+            'voip_minutes',
+            'ai_voice_minutes',
+            'marketing_sms_segments',
+            'marketing_emails'
+        ));
+exception
+    when duplicate_object then null;
+end $$;
+
+do $$
+begin
+    alter table "public"."usage_charge" add constraint "usage_charge_kind_check"
+        check ("kind" in (
+            'invoice_item',
+            'wallet_deduction',
+            'wallet_refund',
+            'statement'
+        ));
+exception
+    when duplicate_object then null;
+end $$;
+
+do $$
+begin
+    alter table "public"."usage_charge" add constraint "usage_charge_status_check"
+        check ("status" in (
+            'pending',
+            'charged',
+            'zero',
+            'dry_run',
+            'skipped_trial',
+            'skipped_no_customer',
+            'skipped_no_subscription',
+            'failed'
+        ));
+exception
+    when duplicate_object then null;
+end $$;
+
+-- Statement reads: a company's charges for a period.
+create index if not exists "usage_charge_company_period_idx"
+    on "public"."usage_charge" ("company_id", "period_start", "meter");
+
+-- Sum a company's usage for one meter over [input_since, input_until).
+-- PostgREST exposes no aggregate queries, so quota math (marketing charging,
+-- the monthly sweep, the usage panel) goes through this. security invoker:
+-- service_role sees everything, authenticated is bounded by the SELECT
+-- policy to its own company's rows.
+create or replace function "public"."sum_usage_events"(
+    "input_company_id" uuid,
+    "input_meter" text,
+    "input_since" timestamp with time zone,
+    "input_until" timestamp with time zone default null
+) returns bigint
+language sql
+stable
+as $$
+    select coalesce(sum("quantity"), 0)::bigint
+    from "public"."usage_event"
+    where "company_id" = "input_company_id"
+      and "meter" = "input_meter"
+      and "occurred_at" >= "input_since"
+      and ("input_until" is null or "occurred_at" < "input_until");
+$$;
+
+alter function "public"."sum_usage_events"(uuid, text, timestamp with time zone, timestamp with time zone) owner to "postgres";

package/dist/dist/migrations/20260728213931_create_usage_metering_rls.sql

@@ -0,0 +1,32 @@
+-- RLS for usage_event and usage_charge.
+--
+-- Mirrors the billing_addon posture: companies can READ their own usage rows
+-- (the billing page's usage panel reads both tables from the client), but all
+-- writes go through the web server's service_role client (capture helpers,
+-- marketing charging, and the monthly sweep). No insert/update/delete
+-- policies for authenticated on purpose - default-deny covers writes.
+
+alter table "public"."usage_event" enable row level security;
+alter table "public"."usage_charge" enable row level security;
+
+-- no anon grant: no anonymous use case
+grant all on table "public"."usage_event" to "authenticated";
+grant all on table "public"."usage_event" to "service_role";
+grant all on table "public"."usage_charge" to "authenticated";
+grant all on table "public"."usage_charge" to "service_role";
+
+create policy "Read-only for matching companyId"
+on "public"."usage_event"
+for select
+to "authenticated"
+using (
+    ((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id")
+);
+
+create policy "Read-only for matching companyId"
+on "public"."usage_charge"
+for select
+to "authenticated"
+using (
+    ((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id")
+);