autopilot-core-sandbox 0.0.1

package/dist/dist/migrations/20260731011418_google_calendar_sync_rls.sql

@@ -0,0 +1,26 @@
+-- The event map and task queue are worker bookkeeping, accessed only by
+-- service-role server routes (same posture as qb_sync_task and the
+-- connection tables). Clients never touch them.
+alter table "public"."google_calendar_event_map" enable row level security;
+alter table "public"."google_calendar_sync_task" enable row level security;
+
+revoke all on table "public"."google_calendar_event_map" from public;
+revoke all on table "public"."google_calendar_event_map" from "anon";
+revoke all on table "public"."google_calendar_event_map" from "authenticated";
+
+revoke all on table "public"."google_calendar_sync_task" from public;
+revoke all on table "public"."google_calendar_sync_task" from "anon";
+revoke all on table "public"."google_calendar_sync_task" from "authenticated";
+
+grant all on table "public"."google_calendar_event_map" to "service_role";
+grant all on table "public"."google_calendar_sync_task" to "service_role";
+
+revoke all on function "public"."enqueue_gcal_sync_tasks"(jsonb) from public;
+revoke all on function "public"."enqueue_gcal_sync_tasks"(jsonb) from "anon";
+revoke all on function "public"."enqueue_gcal_sync_tasks"(jsonb) from "authenticated";
+grant execute on function "public"."enqueue_gcal_sync_tasks"(jsonb) to "service_role";
+
+revoke all on function "public"."claim_gcal_sync_tasks"(integer) from public;
+revoke all on function "public"."claim_gcal_sync_tasks"(integer) from "anon";
+revoke all on function "public"."claim_gcal_sync_tasks"(integer) from "authenticated";
+grant execute on function "public"."claim_gcal_sync_tasks"(integer) to "service_role";

package/dist/dist/migrations/20260731011419_event_outbound_triggers.sql

@@ -0,0 +1,28 @@
+-- Extend the outbox to the event (calendar block) table so the Google
+-- Calendar sync can react to event changes like it does to job/estimate
+-- changes. event.* rows flow harmlessly through the webhook fan-out: no
+-- webhook subscription can name event.*, so the worker finds no subscribers
+-- and just stamps them processed.
+--
+-- event has no is_deleted column — deletes are hard deletes, so
+-- event.deleted fires from AFTER DELETE and carries the to_jsonb(OLD)
+-- snapshot, exactly like the other parents handled by enqueue_parent_event
+-- (reused unchanged; it derives everything from TG_TABLE_NAME).
+
+alter table "public"."outbound_event"
+    drop constraint "outbound_event_entity_type_check";
+alter table "public"."outbound_event"
+    add constraint "outbound_event_entity_type_check"
+    check ("entity_type" in ('client', 'job', 'invoice', 'estimate', 'event'));
+
+alter table "public"."outbound_event"
+    drop constraint "outbound_event_event_type_check";
+alter table "public"."outbound_event"
+    add constraint "outbound_event_event_type_check"
+    check ("event_type" ~ '^(client|job|invoice|estimate|event)\.(created|updated|deleted)$');
+
+create or replace trigger "outbound_event_event_cd" after insert or delete on "public"."event"
+    for each row execute function "public"."enqueue_parent_event"();
+create or replace trigger "outbound_event_event_u" after update on "public"."event"
+    for each row when (old.* is distinct from new.*)
+    execute function "public"."enqueue_parent_event"();

package/dist/dist/migrations/20260731011420_add_google_calendar_addon_key.sql

@@ -0,0 +1,24 @@
+-- New purchasable add-on: per-user Google Calendar sync. Mirrors the
+-- google_calendar entry added to ADDON_KEYS in src/server-safe/
+-- entitlements.ts — the two lists must stay in sync. Included with Scale
+-- like every add-on (Scale resolves to FULL_ENTITLEMENTS and has no
+-- billing_addon rows).
+alter table "public"."billing_addon"
+    drop constraint "billing_addon_addon_key_check";
+alter table "public"."billing_addon"
+    add constraint "billing_addon_addon_key_check"
+    check ("addon_key" in (
+        'ai_voice_assistant',
+        'dumpster_asset_tracking',
+        'marketing_tools',
+        'open_api',
+        'quickbooks',
+        'gps_tracking',
+        'client_portal',
+        'google_reserve',
+        'employee_permissions',
+        'google_ads',
+        'facebook_ads',
+        'bing_ads',
+        'google_calendar'
+    ));

package/dist/dist/migrations/20260731011421_gcal_task_retention.sql

@@ -0,0 +1,109 @@
+-- Extend cleanup_webhook_outbox (20260721190308) to also purge terminal
+-- google_calendar_sync_task rows past the event retention window, keeping
+-- the whole outbox family on the one nightly sweep. Same signature and
+-- behavior as before, plus a fourth result column.
+
+-- cleanup scans "old + terminal", matching the other outbox cleanup indexes
+create index if not exists "google_calendar_sync_task_cleanup_idx"
+    on "public"."google_calendar_sync_task" ("created_at")
+    where "status" in ('done', 'skipped', 'dead');
+
+drop function if exists "public"."cleanup_webhook_outbox"(integer, integer, integer);
+
+create or replace function "public"."cleanup_webhook_outbox"(
+    "event_retention_days" integer,
+    "delivery_retention_days" integer,
+    "batch_size" integer
+)
+returns table (
+    "deliveries_deleted" integer,
+    "events_deleted" integer,
+    "qb_tasks_deleted" integer,
+    "gcal_tasks_deleted" integer
+)
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+declare
+  -- floor of 7 days: a miscalled 0 must never purge fresh history
+  event_cutoff timestamptz :=
+    now() - make_interval(days => greatest(event_retention_days, 7));
+  delivery_cutoff timestamptz :=
+    now() - make_interval(days => greatest(delivery_retention_days, 7));
+  -- floor of 1: a caller-supplied 0 would otherwise LIMIT 0 into a silent
+  -- no-op, and a negative value is a runtime error
+  capped_batch integer := least(greatest(batch_size, 1), 5000);
+  del_count integer;
+  evt_count integer;
+  qb_count integer;
+  gcal_count integer;
+begin
+  -- Deleting an event cascades its deliveries regardless of delivery_cutoff,
+  -- so the event window must never be the shorter one.
+  if greatest(event_retention_days, 7) < greatest(delivery_retention_days, 7) then
+    raise exception 'event_retention_days (%) must be >= delivery_retention_days (%)',
+      event_retention_days, delivery_retention_days;
+  end if;
+
+  -- Terminal deliveries first, so the outbound_event cascade below touches
+  -- almost nothing and each statement's row count stays bounded.
+  delete from webhook_delivery
+  where id in (
+    select id from webhook_delivery
+    where status in ('delivered', 'skipped', 'dead')
+      and created_at < delivery_cutoff
+    order by created_at
+    limit capped_batch
+  );
+  get diagnostics del_count = row_count;
+
+  delete from outbound_event
+  where id in (
+    select id from outbound_event
+    where processed_at is not null
+      and created_at < event_cutoff
+      -- belt-and-suspenders: never cascade away a live delivery (retries
+      -- terminate ~1.6 days after creation, so this should match nothing)
+      and not exists (
+        select 1 from webhook_delivery d
+        where d.event_id = outbound_event.id
+          and d.status in ('pending', 'delivering')
+      )
+    order by created_at
+    limit capped_batch
+  );
+  get diagnostics evt_count = row_count;
+
+  -- Terminal QB sync tasks share the event window; pending/processing rows
+  -- are never touched.
+  delete from qb_sync_task
+  where id in (
+    select id from qb_sync_task
+    where status in ('done', 'skipped', 'dead')
+      and created_at < event_cutoff
+    order by created_at
+    limit capped_batch
+  );
+  get diagnostics qb_count = row_count;
+
+  -- Terminal Google Calendar sync tasks, same window; pending/processing
+  -- rows are never touched (tasks are self-contained, no FK to events).
+  delete from google_calendar_sync_task
+  where id in (
+    select id from google_calendar_sync_task
+    where status in ('done', 'skipped', 'dead')
+      and created_at < event_cutoff
+    order by created_at
+    limit capped_batch
+  );
+  get diagnostics gcal_count = row_count;
+
+  return query select del_count, evt_count, qb_count, gcal_count;
+end;
+$$;
+
+revoke all on function "public"."cleanup_webhook_outbox"(integer, integer, integer) from public;
+revoke all on function "public"."cleanup_webhook_outbox"(integer, integer, integer) from "anon";
+revoke all on function "public"."cleanup_webhook_outbox"(integer, integer, integer) from "authenticated";
+grant execute on function "public"."cleanup_webhook_outbox"(integer, integer, integer) to "service_role";

package/dist/dist/migrations/20260731234245_create_estimate_proposal.sql

@@ -0,0 +1,157 @@
+-- Good/Better/Best proposals for estimates.
+--
+-- A proposal presents up to three item packages ("options") plus optional
+-- add-ons to the end customer, who picks one package and any add-ons on the
+-- public estimate page. Option items and add-ons mirror estimate_item's
+-- columns exactly (denormalized snapshots, no FK back to the price book)
+-- because approval copies the winning selection into estimate_item
+-- column-for-column (see approve_estimate_proposal), after which every
+-- downstream consumer (PDF, totals, job conversion, invoicing) works
+-- unchanged. estimate_item rows are untouched until that approval.
+--
+-- Good/Better/Best labels are derived from position among surviving options
+-- (1st/2nd/3rd; a single option renders unlabeled), so there is no label
+-- column.
+--
+-- Parent references are composite (child_fk, company_id) foreign keys onto
+-- (id, company_id) so a row can never point at another tenant's parent:
+-- company-scoped RLS alone would accept a proposal whose estimate_id belongs
+-- to a different company, and the service-role approval function follows
+-- that reference to replace estimate items. The composite keys make such a
+-- row unrepresentable. (selected_option_id stays a plain FK because its
+-- on delete set null must not null company_id; approval validates that the
+-- option belongs to the proposal.)
+
+-- Backing unique key for the composite references below; (id) is already
+-- the primary key so this holds for every existing row.
+alter table only "public"."estimate"
+    add constraint "estimate_id_company_id_key" unique ("id", "company_id");
+
+create table if not exists "public"."estimate_proposal" (
+    "id" "uuid" default "gen_random_uuid"() not null,
+    "created_at" timestamp with time zone default "now"() not null,
+    "company_id" "uuid" not null,
+    "estimate_id" "uuid" not null,
+    "status" "text" default 'Unsent' not null,
+    -- Set at approval time only; which package the customer chose.
+    "selected_option_id" "uuid",
+    -- Free-form notes typed by the end customer, distinct from the staff
+    -- notes on estimate.notes.
+    "customer_notes" "text",
+    "sent_at" timestamp with time zone,
+    "opened_at" timestamp with time zone,
+    "responded_at" timestamp with time zone,
+    constraint "estimate_proposal_pkey" primary key ("id"),
+    constraint "estimate_proposal_estimate_id_key" unique ("estimate_id"),
+    constraint "estimate_proposal_id_company_id_key" unique ("id", "company_id"),
+    constraint "estimate_proposal_status_check" check ("status" in (
+        'Unsent', 'Sent', 'Opened', 'Approved', 'Declined'
+    ))
+);
+
+alter table "public"."estimate_proposal" owner to "postgres";
+
+alter table only "public"."estimate_proposal"
+    add constraint "estimate_proposal_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete cascade;
+
+alter table only "public"."estimate_proposal"
+    add constraint "estimate_proposal_estimate_id_fkey"
+    foreign key ("estimate_id", "company_id")
+    references "public"."estimate"("id", "company_id") on delete cascade;
+
+create table if not exists "public"."estimate_proposal_option" (
+    "id" "uuid" default "gen_random_uuid"() not null,
+    "created_at" timestamp with time zone default "now"() not null,
+    "company_id" "uuid" not null,
+    "proposal_id" "uuid" not null,
+    "sort_order" integer default 0 not null,
+    constraint "estimate_proposal_option_pkey" primary key ("id"),
+    constraint "estimate_proposal_option_id_company_id_key" unique ("id", "company_id")
+);
+
+alter table "public"."estimate_proposal_option" owner to "postgres";
+
+alter table only "public"."estimate_proposal_option"
+    add constraint "estimate_proposal_option_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete cascade;
+
+alter table only "public"."estimate_proposal_option"
+    add constraint "estimate_proposal_option_proposal_id_fkey"
+    foreign key ("proposal_id", "company_id")
+    references "public"."estimate_proposal"("id", "company_id") on delete cascade;
+
+-- selected_option_id FK added after estimate_proposal_option exists.
+alter table only "public"."estimate_proposal"
+    add constraint "estimate_proposal_selected_option_id_fkey"
+    foreign key ("selected_option_id") references "public"."estimate_proposal_option"("id") on delete set null;
+
+create table if not exists "public"."estimate_proposal_option_item" (
+    "id" "uuid" default "gen_random_uuid"() not null,
+    "created_at" timestamp with time zone default "now"() not null,
+    "company_id" "uuid" not null,
+    "option_id" "uuid" not null,
+    "item_name" "text" not null,
+    "item_price" numeric not null,
+    "item_cost" numeric not null,
+    "quantity" numeric not null,
+    "taxable" boolean not null,
+    "description" "text",
+    "payment_upfront" boolean,
+    "sort_order" integer default 0 not null,
+    constraint "estimate_proposal_option_item_pkey" primary key ("id")
+);
+
+alter table "public"."estimate_proposal_option_item" owner to "postgres";
+
+alter table only "public"."estimate_proposal_option_item"
+    add constraint "estimate_proposal_option_item_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete cascade;
+
+alter table only "public"."estimate_proposal_option_item"
+    add constraint "estimate_proposal_option_item_option_id_fkey"
+    foreign key ("option_id", "company_id")
+    references "public"."estimate_proposal_option"("id", "company_id") on delete cascade;
+
+create table if not exists "public"."estimate_proposal_addon" (
+    "id" "uuid" default "gen_random_uuid"() not null,
+    "created_at" timestamp with time zone default "now"() not null,
+    "company_id" "uuid" not null,
+    "proposal_id" "uuid" not null,
+    "item_name" "text" not null,
+    "item_price" numeric not null,
+    "item_cost" numeric not null,
+    "quantity" numeric default 1 not null,
+    "taxable" boolean not null,
+    "description" "text",
+    -- Whether the end customer checked this add-on; finalized at approval.
+    "is_selected" boolean default false not null,
+    "sort_order" integer default 0 not null,
+    constraint "estimate_proposal_addon_pkey" primary key ("id")
+);
+
+alter table "public"."estimate_proposal_addon" owner to "postgres";
+
+alter table only "public"."estimate_proposal_addon"
+    add constraint "estimate_proposal_addon_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete cascade;
+
+alter table only "public"."estimate_proposal_addon"
+    add constraint "estimate_proposal_addon_proposal_id_fkey"
+    foreign key ("proposal_id", "company_id")
+    references "public"."estimate_proposal"("id", "company_id") on delete cascade;
+
+create index "estimate_proposal_company_id_idx"
+    on "public"."estimate_proposal" ("company_id");
+create index "estimate_proposal_option_company_id_idx"
+    on "public"."estimate_proposal_option" ("company_id");
+create index "estimate_proposal_option_proposal_id_idx"
+    on "public"."estimate_proposal_option" ("proposal_id");
+create index "estimate_proposal_option_item_company_id_idx"
+    on "public"."estimate_proposal_option_item" ("company_id");
+create index "estimate_proposal_option_item_option_id_idx"
+    on "public"."estimate_proposal_option_item" ("option_id");
+create index "estimate_proposal_addon_company_id_idx"
+    on "public"."estimate_proposal_addon" ("company_id");
+create index "estimate_proposal_addon_proposal_id_idx"
+    on "public"."estimate_proposal_addon" ("proposal_id");

package/dist/dist/migrations/20260731234247_estimate_proposal_rls.sql

@@ -0,0 +1,46 @@
+-- RLS for the estimate proposal tables: the standard house policy — any
+-- authenticated staff member of the owning company can CRUD. End customers
+-- never touch these tables directly; the public estimate page reads and
+-- responds through service-role API routes, same as the rest of the
+-- customer-facing estimate flow.
+--
+-- Affected tables: estimate_proposal, estimate_proposal_option,
+-- estimate_proposal_option_item, estimate_proposal_addon.
+
+alter table "public"."estimate_proposal" enable row level security;
+alter table "public"."estimate_proposal_option" enable row level security;
+alter table "public"."estimate_proposal_option_item" enable row level security;
+alter table "public"."estimate_proposal_addon" enable row level security;
+
+grant all on table "public"."estimate_proposal" to "authenticated";
+grant all on table "public"."estimate_proposal" to "service_role";
+grant all on table "public"."estimate_proposal_option" to "authenticated";
+grant all on table "public"."estimate_proposal_option" to "service_role";
+grant all on table "public"."estimate_proposal_option_item" to "authenticated";
+grant all on table "public"."estimate_proposal_option_item" to "service_role";
+grant all on table "public"."estimate_proposal_addon" to "authenticated";
+grant all on table "public"."estimate_proposal_addon" to "service_role";
+
+create policy "Anyone with matching company_id can CRUD"
+on "public"."estimate_proposal"
+to "authenticated"
+using (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"))
+with check (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"));
+
+create policy "Anyone with matching company_id can CRUD"
+on "public"."estimate_proposal_option"
+to "authenticated"
+using (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"))
+with check (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"));
+
+create policy "Anyone with matching company_id can CRUD"
+on "public"."estimate_proposal_option_item"
+to "authenticated"
+using (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"))
+with check (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"));
+
+create policy "Anyone with matching company_id can CRUD"
+on "public"."estimate_proposal_addon"
+to "authenticated"
+using (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"))
+with check (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"));

package/dist/dist/migrations/20260731234248_add_proposal_estimate_settings.sql

@@ -0,0 +1,17 @@
+-- Company-level proposal configuration on the existing settings_estimate row.
+--
+-- proposals_enabled follows the default-on opt-out idiom (see
+-- settings_client_portal.enable_booking): the feature is on for every
+-- entitled company until they switch it off. Entitlement gates turning it
+-- ON in the settings routes; turning it OFF is never blocked.
+--
+-- proposal_video_url is only ever rendered through extractYouTubeVideoId in
+-- src/server-safe/proposals.ts (a non-YouTube URL renders nothing), so a
+-- plain text column is safe.
+
+alter table "public"."settings_estimate"
+    add column "proposals_enabled" boolean default true not null,
+    add column "proposal_show_video" boolean default false not null,
+    add column "proposal_video_url" "text",
+    -- Generic paragraph shown under the video on every proposal.
+    add column "proposal_description" "text";

package/dist/dist/migrations/20260731234249_add_estimate_proposals_addon_key.sql

@@ -0,0 +1,25 @@
+-- New purchasable add-on: Good/Better/Best estimate proposals. Mirrors the
+-- estimate_proposals entry added to ADDON_KEYS in src/server-safe/
+-- entitlements.ts — the two lists must stay in sync. Included with Scale
+-- like every add-on (Scale resolves to FULL_ENTITLEMENTS and has no
+-- billing_addon rows).
+alter table "public"."billing_addon"
+    drop constraint "billing_addon_addon_key_check";
+alter table "public"."billing_addon"
+    add constraint "billing_addon_addon_key_check"
+    check ("addon_key" in (
+        'ai_voice_assistant',
+        'dumpster_asset_tracking',
+        'marketing_tools',
+        'open_api',
+        'quickbooks',
+        'gps_tracking',
+        'client_portal',
+        'google_reserve',
+        'employee_permissions',
+        'google_ads',
+        'facebook_ads',
+        'bing_ads',
+        'google_calendar',
+        'estimate_proposals'
+    ));

package/dist/dist/migrations/20260731234250_approve_estimate_proposal_function.sql

@@ -0,0 +1,133 @@
+-- Transactional proposal approval.
+--
+-- Approving a proposal must atomically (1) record the customer's choice,
+-- (2) replace the estimate's line items with the chosen package plus any
+-- selected add-ons, and (3) mark the estimate Approved. Done as separate
+-- PostgREST calls, a failure between steps would leave an Approved proposal
+-- whose estimate still shows the pre-proposal items — so it is one function,
+-- one transaction.
+--
+-- The row lock plus the status precondition also resolves the concurrent
+-- staff-edit race: once this commits, the proposal is Approved and the
+-- staff save route refuses further edits; if staff saved first, the items
+-- copied here are re-read inside the same transaction and therefore current.
+--
+-- security definer: the sole caller is the web server's service-role client
+-- (the public estimate page has no authenticated user). The revoke/grant
+-- statements live in this file rather than a companion rls migration
+-- because they are inseparable from the function's security posture
+-- (service_role-only, like charge_marketing_usage).
+
+create or replace function "public"."approve_estimate_proposal"(
+    "p_proposal_id" uuid,
+    "p_option_id" uuid,
+    "p_addon_ids" uuid[],
+    "p_customer_notes" text
+) returns void
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+    v_proposal "public"."estimate_proposal"%rowtype;
+begin
+    select * into v_proposal
+    from "public"."estimate_proposal"
+    where "id" = p_proposal_id
+    for update;
+
+    if not found then
+        raise exception 'proposal not found'
+            using errcode = 'P0002';
+    end if;
+
+    if v_proposal."status" not in ('Sent', 'Opened', 'Declined') then
+        raise exception 'proposal is not in an approvable status: %',
+            v_proposal."status"
+            using errcode = 'P0003';
+    end if;
+
+    if not exists (
+        select 1 from "public"."estimate_proposal_option"
+        where "id" = p_option_id and "proposal_id" = p_proposal_id
+    ) then
+        raise exception 'option does not belong to proposal'
+            using errcode = 'P0004';
+    end if;
+
+    -- Tenant-consistency belt on top of the composite FKs: this function is
+    -- security definer and rewrites estimate_item, so never follow a
+    -- reference whose estimate does not belong to the proposal's company.
+    if not exists (
+        select 1 from "public"."estimate"
+        where "id" = v_proposal."estimate_id"
+          and "company_id" = v_proposal."company_id"
+    ) then
+        raise exception 'estimate does not belong to proposal company'
+            using errcode = 'P0005';
+    end if;
+
+    update "public"."estimate_proposal"
+    set "status" = 'Approved',
+        "selected_option_id" = p_option_id,
+        "customer_notes" = p_customer_notes,
+        "responded_at" = now()
+    where "id" = p_proposal_id;
+
+    update "public"."estimate_proposal_addon"
+    set "is_selected" = ("id" = any(coalesce(p_addon_ids, '{}')))
+    where "proposal_id" = p_proposal_id;
+
+    delete from "public"."estimate_item"
+    where "estimate_id" = v_proposal."estimate_id"
+      and "company_id" = v_proposal."company_id";
+
+    insert into "public"."estimate_item" (
+        "estimate_id", "company_id", "item_name", "item_price", "item_cost",
+        "quantity", "taxable", "description", "payment_upfront"
+    )
+    select
+        v_proposal."estimate_id", v_proposal."company_id", oi."item_name",
+        oi."item_price", oi."item_cost", oi."quantity", oi."taxable",
+        oi."description", oi."payment_upfront"
+    from "public"."estimate_proposal_option_item" oi
+    where oi."option_id" = p_option_id
+    order by oi."sort_order", oi."created_at";
+
+    insert into "public"."estimate_item" (
+        "estimate_id", "company_id", "item_name", "item_price", "item_cost",
+        "quantity", "taxable", "description", "payment_upfront"
+    )
+    select
+        v_proposal."estimate_id", v_proposal."company_id", a."item_name",
+        a."item_price", a."item_cost", a."quantity", a."taxable",
+        a."description", null
+    from "public"."estimate_proposal_addon" a
+    where a."proposal_id" = p_proposal_id
+      and a."id" = any(coalesce(p_addon_ids, '{}'))
+    order by a."sort_order", a."created_at";
+
+    update "public"."estimate"
+    set "status" = 'Approved'
+    where "id" = v_proposal."estimate_id"
+      and "company_id" = v_proposal."company_id";
+end;
+$$;
+
+alter function "public"."approve_estimate_proposal"(uuid, uuid, uuid[], text)
+    owner to "postgres";
+
+-- security definer + service_role-only: the public page's server routes are
+-- the sole caller; no authenticated/anon path exists.
+revoke all on function "public"."approve_estimate_proposal"(
+    uuid, uuid, uuid[], text
+) from public;
+revoke all on function "public"."approve_estimate_proposal"(
+    uuid, uuid, uuid[], text
+) from "anon";
+revoke all on function "public"."approve_estimate_proposal"(
+    uuid, uuid, uuid[], text
+) from "authenticated";
+grant execute on function "public"."approve_estimate_proposal"(
+    uuid, uuid, uuid[], text
+) to "service_role";