autopilot-core-sandbox 0.0.1

package/dist/dist/migrations/20260801010609_save_estimate_proposal_function.sql

@@ -0,0 +1,154 @@
+-- Transactional proposal save (replace-children).
+--
+-- The builder always persists its full state. Done as separate PostgREST
+-- calls (delete options/add-ons, then re-insert), a failure between the
+-- delete and the inserts left the stored proposal empty or partially
+-- rebuilt — losing previously saved packages if the user walked away
+-- instead of retrying. One function, one transaction: a failed save leaves
+-- the previous proposal intact.
+--
+-- security invoker: called by authenticated staff sessions (mobile calls it
+-- directly, web's /api/proposals calls it after its entitlement check), so
+-- every read and write inside runs under the caller's RLS. p_company_id is
+-- belt only — an authenticated caller cannot see or write another tenant's
+-- rows regardless, and the composite FKs (see create_estimate_proposal)
+-- make cross-tenant references unrepresentable.
+
+create or replace function "public"."save_estimate_proposal"(
+    "p_company_id" uuid,
+    "p_estimate_id" uuid,
+    "p_options" jsonb,
+    "p_addons" jsonb
+) returns uuid
+language plpgsql
+security invoker
+set search_path = public
+as $$
+declare
+    v_estimate_status text;
+    v_proposal_id uuid;
+    v_proposal_status text;
+    v_option jsonb;
+    v_option_id uuid;
+    v_option_index integer := 0;
+    v_item jsonb;
+    v_item_index integer;
+    v_addon jsonb;
+    v_addon_index integer := 0;
+begin
+    if p_options is null
+        or jsonb_typeof(p_options) <> 'array'
+        or jsonb_array_length(p_options) < 1
+        or jsonb_array_length(p_options) > 3 then
+        raise exception 'a proposal needs 1-3 options'
+            using errcode = 'P0006';
+    end if;
+
+    select "status" into v_estimate_status
+    from "public"."estimate"
+    where "id" = p_estimate_id and "company_id" = p_company_id
+    for update;
+    if not found then
+        raise exception 'estimate not found'
+            using errcode = 'P0002';
+    end if;
+
+    select "id", "status" into v_proposal_id, v_proposal_status
+    from "public"."estimate_proposal"
+    where "estimate_id" = p_estimate_id
+    for update;
+
+    if v_proposal_id is not null then
+        if v_proposal_status = 'Approved' then
+            raise exception 'proposal is approved and can no longer be edited'
+                using errcode = 'P0003';
+        end if;
+        delete from "public"."estimate_proposal_option"
+        where "proposal_id" = v_proposal_id;
+        delete from "public"."estimate_proposal_addon"
+        where "proposal_id" = v_proposal_id;
+    else
+        if v_estimate_status = 'Approved' then
+            raise exception 'estimate is already approved'
+                using errcode = 'P0007';
+        end if;
+        insert into "public"."estimate_proposal" ("company_id", "estimate_id")
+        values (p_company_id, p_estimate_id)
+        returning "id" into v_proposal_id;
+    end if;
+
+    for v_option in select * from jsonb_array_elements(p_options) loop
+        insert into "public"."estimate_proposal_option"
+            ("company_id", "proposal_id", "sort_order")
+        values (p_company_id, v_proposal_id, v_option_index)
+        returning "id" into v_option_id;
+
+        v_item_index := 0;
+        for v_item in
+            select * from jsonb_array_elements(coalesce(v_option->'items', '[]'::jsonb))
+        loop
+            insert into "public"."estimate_proposal_option_item" (
+                "company_id", "option_id", "item_name", "item_price",
+                "item_cost", "quantity", "taxable", "description",
+                "payment_upfront", "sort_order"
+            ) values (
+                p_company_id,
+                v_option_id,
+                v_item->>'item_name',
+                (v_item->>'item_price')::numeric,
+                coalesce((v_item->>'item_cost')::numeric, 0),
+                (v_item->>'quantity')::numeric,
+                coalesce((v_item->>'taxable')::boolean, false),
+                v_item->>'description',
+                (v_item->>'payment_upfront')::boolean,
+                v_item_index
+            );
+            v_item_index := v_item_index + 1;
+        end loop;
+
+        v_option_index := v_option_index + 1;
+    end loop;
+
+    for v_addon in
+        select * from jsonb_array_elements(coalesce(p_addons, '[]'::jsonb))
+    loop
+        insert into "public"."estimate_proposal_addon" (
+            "company_id", "proposal_id", "item_name", "item_price",
+            "item_cost", "quantity", "taxable", "description",
+            "is_selected", "sort_order"
+        ) values (
+            p_company_id,
+            v_proposal_id,
+            v_addon->>'item_name',
+            (v_addon->>'item_price')::numeric,
+            coalesce((v_addon->>'item_cost')::numeric, 0),
+            coalesce((v_addon->>'quantity')::numeric, 1),
+            coalesce((v_addon->>'taxable')::boolean, false),
+            v_addon->>'description',
+            coalesce((v_addon->>'is_selected')::boolean, false),
+            v_addon_index
+        );
+        v_addon_index := v_addon_index + 1;
+    end loop;
+
+    return v_proposal_id;
+end;
+$$;
+
+alter function "public"."save_estimate_proposal"(uuid, uuid, jsonb, jsonb)
+    owner to "postgres";
+
+-- Authenticated staff and the web server's admin client may call it; anon
+-- (the public estimate page) never saves proposals.
+revoke all on function "public"."save_estimate_proposal"(
+    uuid, uuid, jsonb, jsonb
+) from public;
+revoke all on function "public"."save_estimate_proposal"(
+    uuid, uuid, jsonb, jsonb
+) from "anon";
+grant execute on function "public"."save_estimate_proposal"(
+    uuid, uuid, jsonb, jsonb
+) to "authenticated";
+grant execute on function "public"."save_estimate_proposal"(
+    uuid, uuid, jsonb, jsonb
+) to "service_role";

package/dist/dist/migrations/20260801173554_add_hide_autopilot_branding_setting.sql

@@ -0,0 +1,6 @@
+-- Additive and backward-compatible: existing rows default to false (branding shows).
+alter table public.settings_company
+  add column if not exists hide_autopilot_branding boolean not null default false;
+
+comment on column public.settings_company.hide_autopilot_branding is
+  'Hide "Powered by Autopilot" branding on customer-facing documents, forms, and emails. Only effective when the plan includes the hide_autopilot_branding entitlement (Grow and Scale); enforcement is serve-time, so a downgrade restores branding without rewriting this value.';

package/dist/dist/migrations/20260806230917_add_client_billing_address_columns.sql

@@ -0,0 +1,9 @@
+alter table "public"."client"
+  add column "billing_address" text,
+  add column "billing_address2" text,
+  add column "billing_city" text,
+  add column "billing_state" text,
+  add column "billing_zip_code" text;
+
+comment on column "public"."client"."billing_address" is
+  'Billing street address. Rows in the address table are the client''s service addresses; these columns are the single billing address, populated only when it differs from the service address (null = same as service address). No lat/lng by design.';

package/dist/dist/migrations/20260806230944_api_create_client_billing_address.sql

@@ -0,0 +1,93 @@
+-- api_create_client: accept the client billing address columns.
+-- Same body as 20260719215148, with billing_address/billing_address2/
+-- billing_city/billing_state/billing_zip_code added to the client insert.
+-- Null billing columns mean "same as the service address" — the function
+-- stores them only when the payload provides them.
+
+create or replace function "public"."api_create_client"("p" jsonb)
+returns uuid
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+declare
+    v_company_id uuid := (p ->> 'company_id')::uuid;
+    v_client_id uuid;
+    v_addresses jsonb := coalesce(p -> 'addresses', '[]'::jsonb);
+    v_primary_count integer;
+    a jsonb;
+    v_idx integer := 0;
+    v_tag_id uuid;
+begin
+    perform api_assert_company_ref('job_source', (p ->> 'source_id')::uuid, v_company_id);
+
+    insert into client (
+        company_id, email, first_name, last_name, client_company_name,
+        client_notes, client_or_lead, primary_phone_number, source_id,
+        is_do_not_service, is_do_not_sms, is_do_not_marketing_sms,
+        billing_address, billing_address2, billing_city, billing_state,
+        billing_zip_code
+    ) values (
+        v_company_id,
+        p ->> 'email',
+        p ->> 'first_name',
+        p ->> 'last_name',
+        p ->> 'client_company_name',
+        p ->> 'client_notes',
+        coalesce((p ->> 'client_or_lead')::client_or_lead_enum, 'client'),
+        p ->> 'primary_phone_number',
+        (p ->> 'source_id')::uuid,
+        coalesce((p ->> 'is_do_not_service')::boolean, false),
+        coalesce((p ->> 'is_do_not_sms')::boolean, false),
+        coalesce((p ->> 'is_do_not_marketing_sms')::boolean, false),
+        p ->> 'billing_address',
+        p ->> 'billing_address2',
+        p ->> 'billing_city',
+        p ->> 'billing_state',
+        p ->> 'billing_zip_code'
+    ) returning id into v_client_id;
+
+    -- exactly one primary address: error on several; when NONE is marked
+    -- true (absent or explicit false alike), the first becomes primary —
+    -- a client with addresses but no primary is an app-level anomaly
+    select count(*) into v_primary_count
+        from jsonb_array_elements(v_addresses) as t(addr)
+        where (addr ->> 'is_primary')::boolean;
+    if v_primary_count > 1 then
+        raise exception 'at most one address may be primary' using errcode = '23514';
+    end if;
+
+    for a in select * from jsonb_array_elements(v_addresses) loop
+        insert into address (
+            company_id, client_id, address, address2, city, state, zip_code,
+            is_primary, latitude, longitude
+        ) values (
+            v_company_id,
+            v_client_id,
+            a ->> 'address',
+            a ->> 'address2',
+            a ->> 'city',
+            a ->> 'state',
+            a ->> 'zip_code',
+            coalesce((a ->> 'is_primary')::boolean, false)
+                or (v_primary_count = 0 and v_idx = 0),
+            (a ->> 'latitude')::double precision,
+            (a ->> 'longitude')::double precision
+        );
+        v_idx := v_idx + 1;
+    end loop;
+
+    for v_tag_id in select value::uuid from jsonb_array_elements_text(coalesce(p -> 'tag_ids', '[]'::jsonb)) loop
+        perform api_assert_company_ref('client_tag', v_tag_id, v_company_id);
+        insert into client_tag_link (company_id, client_id, client_tag_id)
+        values (v_company_id, v_client_id, v_tag_id);
+    end loop;
+
+    return v_client_id;
+end;
+$$;
+
+revoke all on function "public"."api_create_client"(jsonb) from public;
+revoke all on function "public"."api_create_client"(jsonb) from "anon";
+revoke all on function "public"."api_create_client"(jsonb) from "authenticated";
+grant execute on function "public"."api_create_client"(jsonb) to "service_role";

package/dist/dist/migrations/20260807014702_create_parent_id_company_id_keys.sql

@@ -0,0 +1,20 @@
+-- Backing unique keys for composite tenant-consistent foreign keys.
+--
+-- The contract table (next migration) references job, invoice, client, and
+-- item via composite (fk, company_id) foreign keys so a contract can never
+-- point at another tenant's parent — the same rationale as
+-- estimate_id_company_id_key in 20260731234245_create_estimate_proposal.sql,
+-- which already covers estimate. (id) is already the primary key on each of
+-- these tables, so the composite uniqueness holds for every existing row.
+
+alter table only "public"."job"
+    add constraint "job_id_company_id_key" unique ("id", "company_id");
+
+alter table only "public"."invoice"
+    add constraint "invoice_id_company_id_key" unique ("id", "company_id");
+
+alter table only "public"."client"
+    add constraint "client_id_company_id_key" unique ("id", "company_id");
+
+alter table only "public"."item"
+    add constraint "item_id_company_id_key" unique ("id", "company_id");

package/dist/dist/migrations/20260807014703_create_contract_template.sql

@@ -0,0 +1,30 @@
+-- The "contracts book": reusable contract templates a company maintains in
+-- Contract Settings. Attaching a contract to a job/invoice/estimate/client
+-- snapshots the template's title/body onto the contract instance (next
+-- migration), so editing a template never mutates contracts already created
+-- from it.
+--
+-- is_archived removes a template from the book without breaking the
+-- provenance link from instances that were created from it.
+
+create table if not exists "public"."contract_template" (
+    "id" "uuid" default "gen_random_uuid"() not null,
+    "created_at" timestamp with time zone default "now"() not null,
+    "updated_at" timestamp with time zone,
+    "company_id" "uuid" not null,
+    "name" "text" not null,
+    -- Plain text, rendered with pre-wrap; never interpreted as HTML.
+    "body" "text" default '' not null,
+    "is_archived" boolean default false not null,
+    constraint "contract_template_pkey" primary key ("id"),
+    constraint "contract_template_id_company_id_key" unique ("id", "company_id")
+);
+
+alter table "public"."contract_template" owner to "postgres";
+
+alter table only "public"."contract_template"
+    add constraint "contract_template_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete cascade;
+
+create index "contract_template_company_id_idx"
+    on "public"."contract_template" ("company_id");

package/dist/dist/migrations/20260807014704_create_contract.sql

@@ -0,0 +1,233 @@
+-- Contract instances: an actual contract attached to exactly one of a job,
+-- invoice, estimate, or client (a "lead" is a client row with
+-- client_or_lead = 'lead', so lead contracts use client_id).
+--
+-- title/body are denormalized snapshots taken when the contract is created
+-- from a template (or typed for a one-off), so later template edits never
+-- change an existing contract — same rationale as the estimate proposal
+-- option-item snapshots. template_id is provenance only; its composite FK
+-- uses the PG15 column-list ON DELETE SET NULL form so deleting a template
+-- nulls only template_id, never company_id (the trap that forced
+-- selected_option_id in the proposals migration to stay single-column).
+--
+-- Parent references are composite (fk, company_id) foreign keys onto
+-- (id, company_id) so a contract can never point at another tenant's parent
+-- (backing unique keys added in 20260807014702).
+--
+-- access_token_nonce backs the public signing link: the link token is
+-- HMAC-SHA256(AUTOPILOT_API_KEY, contract id + nonce), computed and verified
+-- only on the web server (see autopilot-web's contractSignToken.ts, same
+-- model as bookingBillingToken.ts). The DB never holds the token itself, so
+-- a database dump alone cannot forge signing links, while the server can
+-- always rebuild the link for "Copy link"/re-send. Rotating the nonce
+-- revokes every previously issued link.
+
+create table if not exists "public"."contract" (
+    "id" "uuid" default "gen_random_uuid"() not null,
+    "created_at" timestamp with time zone default "now"() not null,
+    "updated_at" timestamp with time zone,
+    "company_id" "uuid" not null,
+    -- Set by set_contract_number() below; user-editable like job/invoice/
+    -- estimate numbers, guarded by update_contract_number().
+    "contract_number" integer not null,
+    "template_id" "uuid",
+    "job_id" "uuid",
+    "invoice_id" "uuid",
+    "estimate_id" "uuid",
+    "client_id" "uuid",
+    "title" "text" not null,
+    -- Plain text, rendered with pre-wrap; never interpreted as HTML.
+    "body" "text" not null,
+    "status" "text" default 'Unsent' not null,
+    "access_token_nonce" "uuid",
+    "sent_at" timestamp with time zone,
+    "signed_at" timestamp with time zone,
+    constraint "contract_pkey" primary key ("id"),
+    constraint "contract_id_company_id_key" unique ("id", "company_id"),
+    constraint "contract_company_id_contract_number_key" unique ("company_id", "contract_number"),
+    constraint "contract_status_check" check ("status" in (
+        'Unsent', 'Sent', 'Opened', 'Signed', 'Voided'
+    )),
+    constraint "contract_exactly_one_parent_check" check (
+        num_nonnulls("job_id", "invoice_id", "estimate_id", "client_id") = 1
+    )
+);
+
+alter table "public"."contract" owner to "postgres";
+
+alter table only "public"."contract"
+    add constraint "contract_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete cascade;
+
+alter table only "public"."contract"
+    add constraint "contract_template_id_fkey"
+    foreign key ("template_id", "company_id")
+    references "public"."contract_template"("id", "company_id")
+    on delete set null ("template_id");
+
+alter table only "public"."contract"
+    add constraint "contract_job_id_fkey"
+    foreign key ("job_id", "company_id")
+    references "public"."job"("id", "company_id") on delete cascade;
+
+alter table only "public"."contract"
+    add constraint "contract_invoice_id_fkey"
+    foreign key ("invoice_id", "company_id")
+    references "public"."invoice"("id", "company_id") on delete cascade;
+
+alter table only "public"."contract"
+    add constraint "contract_estimate_id_fkey"
+    foreign key ("estimate_id", "company_id")
+    references "public"."estimate"("id", "company_id") on delete cascade;
+
+alter table only "public"."contract"
+    add constraint "contract_client_id_fkey"
+    foreign key ("client_id", "company_id")
+    references "public"."client"("id", "company_id") on delete cascade;
+
+create index "contract_company_id_idx" on "public"."contract" ("company_id");
+create index "contract_template_id_idx" on "public"."contract" ("template_id");
+create index "contract_job_id_idx" on "public"."contract" ("job_id");
+create index "contract_invoice_id_idx" on "public"."contract" ("invoice_id");
+create index "contract_estimate_id_idx" on "public"."contract" ("estimate_id");
+create index "contract_client_id_idx" on "public"."contract" ("client_id");
+-- Contract Settings renders a newest-first history of every contract.
+create index "contract_company_id_created_at_idx"
+    on "public"."contract" ("company_id", "created_at" desc);
+
+-- Per-company numbering, same model as job/invoice/estimate numbers but with
+-- a unique company_id + upsert increment instead of the PERFORM ... FOR
+-- UPDATE idiom in set_job_number(): that idiom locks nothing when the
+-- counter row doesn't exist yet, so the first two concurrent inserts for a
+-- company can race to the same number. The upsert takes a real row lock in
+-- both cases.
+
+create table if not exists "public"."contract_counter" (
+    "id" "uuid" default "gen_random_uuid"() not null,
+    "created_at" timestamp with time zone default "now"() not null,
+    "company_id" "uuid" not null,
+    "next_contract_number" integer not null,
+    constraint "contract_counter_pkey" primary key ("id"),
+    constraint "contract_counter_company_id_key" unique ("company_id")
+);
+
+alter table "public"."contract_counter" owner to "postgres";
+
+alter table only "public"."contract_counter"
+    add constraint "contract_counter_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete cascade;
+
+create or replace function "public"."set_contract_number"() returns "trigger"
+    language "plpgsql"
+    as $$
+declare
+  next_number integer;
+begin
+  -- Row is locked by the upsert whether it existed or not; the returned
+  -- value is the counter AFTER increment, so the assigned number is one
+  -- less.
+  insert into contract_counter (company_id, next_contract_number)
+  values (new.company_id, 2)
+  on conflict (company_id)
+  do update set next_contract_number = contract_counter.next_contract_number + 1
+  returning next_contract_number into next_number;
+
+  new.contract_number := next_number - 1;
+
+  return new;
+end;
+$$;
+
+alter function "public"."set_contract_number"() owner to "postgres";
+
+-- Guard for manual number edits, mirroring update_job_number(): reject
+-- duplicates within the company and keep the counter above the high-water
+-- mark so future automatic numbers never collide.
+create or replace function "public"."update_contract_number"() returns "trigger"
+    language "plpgsql"
+    as $$
+declare
+  next_number integer;
+begin
+  perform * from contract_counter
+  where company_id = new.company_id for update;
+
+  if exists (
+    select 1 from contract
+    where company_id = new.company_id
+    and contract_number = new.contract_number
+  ) then
+    raise exception 'Contract number % already exists', new.contract_number;
+  end if;
+
+  select next_contract_number into next_number
+  from contract_counter
+  where company_id = new.company_id;
+
+  if new.contract_number >= next_number then
+    update contract_counter
+    set next_contract_number = new.contract_number + 1
+    where company_id = new.company_id;
+  end if;
+
+  return new;
+end;
+$$;
+
+alter function "public"."update_contract_number"() owner to "postgres";
+
+-- DB backstop for signing integrity, closing both direct-update bypasses of
+-- the sign_contract() workflow:
+--
+--  * Once Signed, a contract is frozen entirely — title, body, status, and
+--    signed_at. Without the status clause, staff could move a row out of
+--    Signed, edit the text, and restore the status, leaving the body
+--    diverged from the audited body_sha256; without the signed_at clause,
+--    the contract's timestamp could be rewritten to conflict with the
+--    audit row's.
+--  * Entering Signed requires the contract_signature audit row to already
+--    exist. sign_contract() inserts it in the same transaction before its
+--    status update, and staff have no insert grant on contract_signature,
+--    so a directly forged Signed status (with no audit evidence) is
+--    unrepresentable.
+create or replace function "public"."enforce_contract_signing_integrity"() returns "trigger"
+    language "plpgsql"
+    as $$
+begin
+  if old.status = 'Signed' then
+    if new.status is distinct from old.status
+      or new.body is distinct from old.body
+      or new.title is distinct from old.title
+      or new.signed_at is distinct from old.signed_at
+    then
+      raise exception 'signed contracts cannot be modified'
+        using errcode = 'P0010';
+    end if;
+  elsif new.status = 'Signed' then
+    if not exists (
+      select 1 from "public"."contract_signature"
+      where "contract_id" = new.id
+    ) then
+      raise exception 'contracts can only be signed through sign_contract()'
+        using errcode = 'P0011';
+    end if;
+  end if;
+
+  return new;
+end;
+$$;
+
+alter function "public"."enforce_contract_signing_integrity"() owner to "postgres";
+
+create or replace trigger "set_contract_number_trigger"
+    before insert on "public"."contract"
+    for each row execute function "public"."set_contract_number"();
+
+create or replace trigger "update_contract_number_trigger"
+    before update of "contract_number" on "public"."contract"
+    for each row when (("old"."contract_number" is distinct from "new"."contract_number"))
+    execute function "public"."update_contract_number"();
+
+create or replace trigger "enforce_contract_signing_integrity_trigger"
+    before update on "public"."contract"
+    for each row execute function "public"."enforce_contract_signing_integrity"();

package/dist/dist/migrations/20260807014705_create_contract_signature.sql

@@ -0,0 +1,39 @@
+-- Immutable audit record of a contract signing. One row per contract,
+-- written exclusively by the service-role sign_contract() function
+-- (20260807014709) in the same transaction that flips the contract to
+-- Signed — staff get no insert/update/delete grants at all (see the rls
+-- migration).
+--
+-- body_sha256 hashes contract.body as it stood inside the signing
+-- transaction, so the row proves exactly what text was agreed to even
+-- though the contract row itself is also frozen by trigger after signing.
+
+create table if not exists "public"."contract_signature" (
+    "id" "uuid" default "gen_random_uuid"() not null,
+    "company_id" "uuid" not null,
+    "contract_id" "uuid" not null,
+    "signed_at" timestamp with time zone default "now"() not null,
+    -- Name the customer typed on the signing page.
+    "signer_name" "text" not null,
+    "signer_ip" "text",
+    "signer_user_agent" "text",
+    "body_sha256" "text" not null,
+    -- Path of the drawn-signature PNG in the company storage bucket.
+    "signature_storage_path" "text" not null,
+    constraint "contract_signature_pkey" primary key ("id"),
+    constraint "contract_signature_contract_id_key" unique ("contract_id")
+);
+
+alter table "public"."contract_signature" owner to "postgres";
+
+alter table only "public"."contract_signature"
+    add constraint "contract_signature_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete cascade;
+
+alter table only "public"."contract_signature"
+    add constraint "contract_signature_contract_id_fkey"
+    foreign key ("contract_id", "company_id")
+    references "public"."contract"("id", "company_id") on delete cascade;
+
+create index "contract_signature_company_id_idx"
+    on "public"."contract_signature" ("company_id");

package/dist/dist/migrations/20260807014706_create_item_contract_requirement.sql

@@ -0,0 +1,38 @@
+-- Which contract templates a booking item requires. When the online booking
+-- form takes an upfront payment and the cart contains items with rows here,
+-- the customer must sign one contract per distinct required template before
+-- the payment step unlocks.
+--
+-- Composite (fk, company_id) foreign keys keep both sides of the join
+-- tenant-consistent (backing unique keys: item in 20260807014702,
+-- contract_template in 20260807014703).
+
+create table if not exists "public"."item_contract_requirement" (
+    "created_at" timestamp with time zone default "now"() not null,
+    "company_id" "uuid" not null,
+    "item_id" "uuid" not null,
+    "contract_template_id" "uuid" not null,
+    constraint "item_contract_requirement_pkey"
+        primary key ("item_id", "contract_template_id")
+);
+
+alter table "public"."item_contract_requirement" owner to "postgres";
+
+alter table only "public"."item_contract_requirement"
+    add constraint "item_contract_requirement_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete cascade;
+
+alter table only "public"."item_contract_requirement"
+    add constraint "item_contract_requirement_item_id_fkey"
+    foreign key ("item_id", "company_id")
+    references "public"."item"("id", "company_id") on delete cascade;
+
+alter table only "public"."item_contract_requirement"
+    add constraint "item_contract_requirement_contract_template_id_fkey"
+    foreign key ("contract_template_id", "company_id")
+    references "public"."contract_template"("id", "company_id") on delete cascade;
+
+create index "item_contract_requirement_company_id_idx"
+    on "public"."item_contract_requirement" ("company_id");
+create index "item_contract_requirement_contract_template_id_idx"
+    on "public"."item_contract_requirement" ("contract_template_id");

package/dist/dist/migrations/20260807014707_create_settings_contract.sql

@@ -0,0 +1,23 @@
+-- Company-level contracts settings. One row per company, created lazily on
+-- first save; an absent row means enabled (default-on opt-out idiom, same
+-- as settings_estimate.proposals_enabled — the dumpster_asset_tracking
+-- entitlement is what actually gates the feature, so is_enabled grants
+-- nothing by itself and turning it off is never blocked).
+--
+-- When is_enabled is false, contract cards are hidden on jobs, invoices,
+-- estimates, clients, and leads, and online booking skips required
+-- contracts.
+
+create table if not exists "public"."settings_contract" (
+    "company_id" "uuid" not null,
+    "created_at" timestamp with time zone default "now"() not null,
+    "updated_at" timestamp with time zone,
+    "is_enabled" boolean default true not null,
+    constraint "settings_contract_pkey" primary key ("company_id")
+);
+
+alter table "public"."settings_contract" owner to "postgres";
+
+alter table only "public"."settings_contract"
+    add constraint "settings_contract_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete cascade;