autopilot-core-sandbox 0.0.1

package/dist/dist/migrations/20260807014708_contract_rls.sql

@@ -0,0 +1,74 @@
+-- RLS for the contracts tables.
+--
+-- Affected tables: contract_template, contract, contract_counter,
+-- contract_signature, item_contract_requirement, settings_contract.
+--
+-- contract_template, contract, item_contract_requirement, settings_contract:
+-- the standard house policy — any authenticated staff member of the owning
+-- company can CRUD. End customers never touch these tables directly; the
+-- public signing page and the booking form go through service-role API
+-- routes, so there are deliberately NO anon policies or grants here.
+--
+-- contract_counter: staff CRUD like job_counter, because the numbering
+-- triggers on contract run with the invoking staff member's privileges and
+-- must be able to upsert the company's counter row.
+--
+-- contract_signature: staff can READ the audit record but never write it —
+-- rows are inserted only by the service-role sign_contract() function, so
+-- the signing audit trail is immutable even to the company that owns it.
+
+alter table "public"."contract_template" enable row level security;
+alter table "public"."contract" enable row level security;
+alter table "public"."contract_counter" enable row level security;
+alter table "public"."contract_signature" enable row level security;
+alter table "public"."item_contract_requirement" enable row level security;
+alter table "public"."settings_contract" enable row level security;
+
+grant all on table "public"."contract_template" to "authenticated";
+grant all on table "public"."contract_template" to "service_role";
+grant all on table "public"."contract" to "authenticated";
+grant all on table "public"."contract" to "service_role";
+grant all on table "public"."contract_counter" to "authenticated";
+grant all on table "public"."contract_counter" to "service_role";
+grant select on table "public"."contract_signature" to "authenticated";
+grant all on table "public"."contract_signature" to "service_role";
+grant all on table "public"."item_contract_requirement" to "authenticated";
+grant all on table "public"."item_contract_requirement" to "service_role";
+grant all on table "public"."settings_contract" to "authenticated";
+grant all on table "public"."settings_contract" to "service_role";
+
+create policy "Anyone with matching company_id can CRUD"
+on "public"."contract_template"
+to "authenticated"
+using (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"))
+with check (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"));
+
+create policy "Anyone with matching company_id can CRUD"
+on "public"."contract"
+to "authenticated"
+using (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"))
+with check (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"));
+
+create policy "Anyone with matching company_id can CRUD"
+on "public"."contract_counter"
+to "authenticated"
+using (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"))
+with check (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"));
+
+create policy "Anyone with matching company_id can read"
+on "public"."contract_signature"
+for select
+to "authenticated"
+using (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"));
+
+create policy "Anyone with matching company_id can CRUD"
+on "public"."item_contract_requirement"
+to "authenticated"
+using (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"))
+with check (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"));
+
+create policy "Anyone with matching company_id can CRUD"
+on "public"."settings_contract"
+to "authenticated"
+using (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"))
+with check (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"));

package/dist/dist/migrations/20260807014709_sign_contract_function.sql

@@ -0,0 +1,92 @@
+-- Transactional contract signing.
+--
+-- Signing must atomically (1) verify the contract is still signable,
+-- (2) write the immutable contract_signature audit row — including a hash
+-- of the body text as it stands inside this transaction — and (3) flip the
+-- contract to Signed. Done as separate PostgREST calls, a failure between
+-- steps could leave a Signed contract with no audit row (or vice versa), so
+-- it is one function, one transaction.
+--
+-- The row lock plus the status precondition resolves the double-submit
+-- race: a second concurrent sign call blocks on the lock, then fails the
+-- precondition because the first call already moved the row to Signed.
+--
+-- security definer + service_role-only: the sole caller is
+-- /api/customer-sign-contract, which authenticates the customer by the
+-- contract's hashed link token before calling (the public signing page has
+-- no authenticated user). The caller uploads the signature PNG first and
+-- passes its storage path; a failed function call leaves an orphaned PNG at
+-- worst, never a signed contract without its audit row.
+
+create or replace function "public"."sign_contract"(
+    "p_contract_id" uuid,
+    "p_signer_name" text,
+    "p_signer_ip" text,
+    "p_signer_user_agent" text,
+    "p_signature_storage_path" text
+) returns void
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+    v_contract "public"."contract"%rowtype;
+begin
+    select * into v_contract
+    from "public"."contract"
+    where "id" = p_contract_id
+    for update;
+
+    if not found then
+        raise exception 'contract not found'
+            using errcode = 'P0002';
+    end if;
+
+    if v_contract."status" not in ('Sent', 'Opened') then
+        raise exception 'contract is not in a signable status: %',
+            v_contract."status"
+            using errcode = 'P0003';
+    end if;
+
+    if p_signer_name is null or btrim(p_signer_name) = '' then
+        raise exception 'signer name is required'
+            using errcode = 'P0004';
+    end if;
+
+    insert into "public"."contract_signature" (
+        "company_id", "contract_id", "signer_name", "signer_ip",
+        "signer_user_agent", "body_sha256", "signature_storage_path"
+    ) values (
+        v_contract."company_id",
+        v_contract."id",
+        btrim(p_signer_name),
+        p_signer_ip,
+        p_signer_user_agent,
+        encode(sha256(convert_to(v_contract."body", 'UTF8')), 'hex'),
+        p_signature_storage_path
+    );
+
+    update "public"."contract"
+    set "status" = 'Signed',
+        "signed_at" = now()
+    where "id" = v_contract."id";
+end;
+$$;
+
+alter function "public"."sign_contract"(uuid, text, text, text, text)
+    owner to "postgres";
+
+-- security definer + service_role-only: the public signing route is the
+-- sole caller; no authenticated/anon path exists.
+revoke all on function "public"."sign_contract"(
+    uuid, text, text, text, text
+) from public;
+revoke all on function "public"."sign_contract"(
+    uuid, text, text, text, text
+) from "anon";
+revoke all on function "public"."sign_contract"(
+    uuid, text, text, text, text
+) from "authenticated";
+grant execute on function "public"."sign_contract"(
+    uuid, text, text, text, text
+) to "service_role";

package/dist/dist/migrations/20260807014710_create_settings_rental.sql

@@ -0,0 +1,34 @@
+-- Company-level rentals/assets settings. One row per company, created
+-- lazily. Unlike settings_contract (default-on opt-out), this is
+-- DEFAULT-OFF OPT-IN: an absent row means rentals disabled, owner modal
+-- unanswered, no industry chosen. The one-time owner modal (C2) is the
+-- activation moment that first writes the row. The dumpster_asset_tracking
+-- entitlement gates the feature; rentals_enabled additionally hides the
+-- schedule-card Type dropdown and the rest of the rentals UI when off.
+--
+-- The online-booking availability-enforcement toggle from the spec is
+-- deliberately NOT here — its column lands on the anon-readable
+-- settings_booking (the public booking page reads that table directly)
+-- when online booking for rentals is built.
+
+create table if not exists "public"."settings_rental" (
+    "company_id" "uuid" not null,
+    "created_at" timestamp with time zone default "now"() not null,
+    "updated_at" timestamp with time zone,
+    "rentals_enabled" boolean default false not null,
+    -- Null until the company picks one. Selects which preset task list the
+    -- settings task manager offers. Mirrored by RENTAL_INDUSTRIES in
+    -- src/server-safe/rentals.ts — the two lists must stay in sync.
+    "industry_preset" "text",
+    "owner_modal_answered" boolean default false not null,
+    constraint "settings_rental_pkey" primary key ("company_id"),
+    constraint "settings_rental_industry_preset_check" check (
+        "industry_preset" in ('dumpster', 'equipment', 'portable_toilet', 'other')
+    )
+);
+
+alter table "public"."settings_rental" owner to "postgres";
+
+alter table only "public"."settings_rental"
+    add constraint "settings_rental_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete cascade;

package/dist/dist/migrations/20260807014711_create_saved_location.sql

@@ -0,0 +1,56 @@
+-- Company-defined named places (lots, dumps, other) shown on maps and in
+-- the task-completion dropdowns. Deliberately NOT the existing "address"
+-- table: that table is client-owned and every consumer assumes its rows
+-- are customer addresses. Lots and landfills aren't always postal
+-- addresses and nothing ever bills or mails to them, so the address here
+-- is ONE freeform display string plus coordinates — never postal-split.
+--
+-- icon is a curated semantic key each platform maps to its own icon
+-- system (web FontAwesome, mobile ThemeIcon); mirrored by
+-- SAVED_LOCATION_ICONS in src/server-safe/rentals.ts. icon_color is a
+-- free-text hex color.
+--
+-- location_type determines which completion-flow dropdowns offer the
+-- location (lots, dumps/landfills, other); mirrored by
+-- SAVED_LOCATION_TYPES in src/server-safe/rentals.ts.
+--
+-- is_archived removes a location from pickers/maps without breaking
+-- assets currently located there; hard delete is additionally blocked by
+-- asset's ON DELETE RESTRICT while any asset points at the row.
+
+create table if not exists "public"."saved_location" (
+    "id" "uuid" default "gen_random_uuid"() not null,
+    "created_at" timestamp with time zone default "now"() not null,
+    "updated_at" timestamp with time zone,
+    "company_id" "uuid" not null,
+    "label" "text" not null,
+    "address" "text" not null,
+    -- Nullable: geocoding may not have resolved; map pins skip null
+    -- coords (same shape as the address table's nullable latitude).
+    "latitude" numeric,
+    "longitude" numeric,
+    "icon" "text" not null,
+    "icon_color" "text" not null,
+    "location_type" "text" not null,
+    "is_archived" boolean default false not null,
+    constraint "saved_location_pkey" primary key ("id"),
+    -- Backing key for asset's composite tenant-consistent FK, same
+    -- rationale as contract's (id, company_id) unique keys.
+    constraint "saved_location_id_company_id_key" unique ("id", "company_id"),
+    constraint "saved_location_icon_check" check ("icon" in (
+        'park', 'wrench', 'gear', 'house', 'factory',
+        'warehouse', 'truck', 'flag'
+    )),
+    constraint "saved_location_location_type_check" check (
+        "location_type" in ('lot', 'dump', 'other')
+    )
+);
+
+alter table "public"."saved_location" owner to "postgres";
+
+alter table only "public"."saved_location"
+    add constraint "saved_location_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete cascade;
+
+create index "saved_location_company_id_idx"
+    on "public"."saved_location" ("company_id");

package/dist/dist/migrations/20260807014712_create_rental_task_option.sql

@@ -0,0 +1,52 @@
+-- The company's schedule-card Type-dropdown vocabulary: one row per
+-- SELECTED preset task plus one row per custom task. Exactly one of
+-- preset_key / label is set — preset rows carry a fixed machine key whose
+-- display label lives in PRESET_TASK_LABELS in core; custom rows carry
+-- only their user-typed label ("just a label", no behavior).
+--
+-- job_schedule.task_type (existing dead text column; stays text, no FK)
+-- will store the machine key for preset tasks and this row's uuid AS TEXT
+-- for custom tasks. Consequences:
+--   * preset rows may be hard-deleted on deselect — history resolves
+--     preset labels from the const map, never from these rows;
+--   * custom rows are ARCHIVED, never deleted, or historical schedules
+--     could no longer display their label.
+
+create table if not exists "public"."rental_task_option" (
+    "id" "uuid" default "gen_random_uuid"() not null,
+    "created_at" timestamp with time zone default "now"() not null,
+    "updated_at" timestamp with time zone,
+    "company_id" "uuid" not null,
+    -- Mirrored by PRESET_TASK_KEYS in src/server-safe/rentals.ts — the
+    -- two lists must stay in sync.
+    "preset_key" "text",
+    "label" "text",
+    "sort_order" integer default 0 not null,
+    -- Custom rows only; preset rows are deleted on deselect.
+    "is_archived" boolean default false not null,
+    constraint "rental_task_option_pkey" primary key ("id"),
+    constraint "rental_task_option_exactly_one_kind_check" check (
+        num_nonnulls("preset_key", "label") = 1
+    ),
+    constraint "rental_task_option_preset_key_check" check (
+        "preset_key" is null or "preset_key" in (
+            'drop_off', 'pick_up', 'swap', 'live_load', 'relocate',
+            'dump_and_return', 'take_to_dump', 'take_to_lot',
+            'take_to_other', 'repair', 'service'
+        )
+    )
+);
+
+alter table "public"."rental_task_option" owner to "postgres";
+
+alter table only "public"."rental_task_option"
+    add constraint "rental_task_option_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete cascade;
+
+-- A preset can be selected at most once per company.
+create unique index "rental_task_option_company_id_preset_key_key"
+    on "public"."rental_task_option" ("company_id", "preset_key")
+    where "preset_key" is not null;
+
+create index "rental_task_option_company_id_idx"
+    on "public"."rental_task_option" ("company_id");

package/dist/dist/migrations/20260807014713_create_asset.sql

@@ -0,0 +1,90 @@
+-- Rental assets (dumpsters first; generic rental/assets naming
+-- elsewhere). Identity is a mandatory user-specified label. TS types call
+-- this RentalAsset — core already exports an unrelated image-picker type
+-- named Asset.
+--
+-- Polymorphic current location, ENFORCED by asset_location_shape_check:
+--   'unknown'   -> all location columns null (never placed / unknown)
+--   'saved'     -> saved_location_id set, freeform columns null
+--   'freeform'  -> freeform address set (e.g. a customer address after a
+--                  drop-off), saved_location_id null
+--   'temporary' -> same columns as freeform, but a one-off ephemeral spot
+--                  (take-to-dump/other flows); deliberately NO row
+--                  anywhere else, overwritten on the asset's next move
+-- Exactly one reader (getAssetLocation) and one writer (moveAsset via
+-- buildAssetLocationColumns) exist in core; no call site on web or mobile
+-- ever touches the raw location columns.
+--
+-- size is nullable: entered as a number of yards for dumpsters, but
+-- generic assets (equipment, toilets) may have no meaningful numeric
+-- size; per-industry requiredness is a UI concern.
+--
+-- fullness transitions are the completion flows' job (C3); every asset
+-- stays 'unknown' until those ship. Mirrored by ASSET_FULLNESSES in
+-- src/server-safe/rentals.ts.
+--
+-- is_archived, not delete: schedule history (job_schedule.asset_id) will
+-- reference assets once tasks ship. The job_schedule FK's ON DELETE SET
+-- NULL is only a backstop for out-of-band hard deletes.
+
+create table if not exists "public"."asset" (
+    "id" "uuid" default "gen_random_uuid"() not null,
+    "created_at" timestamp with time zone default "now"() not null,
+    "updated_at" timestamp with time zone,
+    "company_id" "uuid" not null,
+    "label" "text" not null,
+    "size" numeric,
+    "fullness" "text" default 'unknown' not null,
+    -- Mirrored by ASSET_LOCATION_KINDS in src/server-safe/rentals.ts.
+    "location_kind" "text" default 'unknown' not null,
+    "saved_location_id" "uuid",
+    "location_address" "text",
+    "location_latitude" numeric,
+    "location_longitude" numeric,
+    "is_archived" boolean default false not null,
+    constraint "asset_pkey" primary key ("id"),
+    -- Backing key for job_schedule's composite asset FKs.
+    constraint "asset_id_company_id_key" unique ("id", "company_id"),
+    constraint "asset_fullness_check" check (
+        "fullness" in ('unknown', 'empty', 'full')
+    ),
+    constraint "asset_location_kind_check" check (
+        "location_kind" in ('unknown', 'saved', 'freeform', 'temporary')
+    ),
+    constraint "asset_location_shape_check" check (
+        ("location_kind" = 'unknown'
+            and "saved_location_id" is null
+            and "location_address" is null
+            and "location_latitude" is null
+            and "location_longitude" is null)
+        or ("location_kind" = 'saved'
+            and "saved_location_id" is not null
+            and "location_address" is null
+            and "location_latitude" is null
+            and "location_longitude" is null)
+        or ("location_kind" in ('freeform', 'temporary')
+            and "saved_location_id" is null
+            and "location_address" is not null)
+    )
+);
+
+alter table "public"."asset" owner to "postgres";
+
+alter table only "public"."asset"
+    add constraint "asset_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete cascade;
+
+-- Composite tenant-consistent FK. RESTRICT, not SET NULL: nulling
+-- saved_location_id would both silently strand the asset's location and
+-- violate asset_location_shape_check (kind 'saved' with a null id), so
+-- deleting an occupied location fails loudly instead — the UI flow is to
+-- archive the location, or move the assets first.
+alter table only "public"."asset"
+    add constraint "asset_saved_location_id_fkey"
+    foreign key ("saved_location_id", "company_id")
+    references "public"."saved_location"("id", "company_id")
+    on delete restrict;
+
+create index "asset_company_id_idx" on "public"."asset" ("company_id");
+create index "asset_saved_location_id_idx"
+    on "public"."asset" ("saved_location_id");

package/dist/dist/migrations/20260807014714_add_job_schedule_asset_fkeys.sql

@@ -0,0 +1,39 @@
+-- Wire job_schedule's baseline-era asset columns to the new asset table.
+--
+-- asset_id / secondary_asset_id are dead columns from the pre-migration
+-- baseline dump: written as null by all five web call sites, never read,
+-- no FK, no target table until now. Defensive null-out first so any
+-- conceivable baseline-era garbage can't fail FK validation; expected to
+-- update 0 rows in production.
+
+update "public"."job_schedule"
+    set "asset_id" = null where "asset_id" is not null;
+update "public"."job_schedule"
+    set "secondary_asset_id" = null where "secondary_asset_id" is not null;
+
+-- Semantics frozen in the rentals data-model contract: for a Swap task,
+-- asset_id is the DROP-OFF (swapped-in) asset and secondary_asset_id is
+-- the PICK-UP (swapped-out) asset; every single-asset task uses asset_id
+-- only and leaves secondary_asset_id null.
+--
+-- Composite (fk, company_id) FKs so a schedule can never point at another
+-- tenant's asset, with the PG15 column-list ON DELETE SET NULL form so a
+-- hard-deleted asset nulls only the pointer, never company_id. Archival
+-- is the product path for assets; this is a backstop.
+
+alter table only "public"."job_schedule"
+    add constraint "job_schedule_asset_id_fkey"
+    foreign key ("asset_id", "company_id")
+    references "public"."asset"("id", "company_id")
+    on delete set null ("asset_id");
+
+alter table only "public"."job_schedule"
+    add constraint "job_schedule_secondary_asset_id_fkey"
+    foreign key ("secondary_asset_id", "company_id")
+    references "public"."asset"("id", "company_id")
+    on delete set null ("secondary_asset_id");
+
+create index "job_schedule_asset_id_idx"
+    on "public"."job_schedule" ("asset_id");
+create index "job_schedule_secondary_asset_id_idx"
+    on "public"."job_schedule" ("secondary_asset_id");

package/dist/dist/migrations/20260807014715_rental_rls.sql

@@ -0,0 +1,48 @@
+-- RLS for the rentals foundation tables.
+--
+-- Affected tables: settings_rental, saved_location, rental_task_option,
+-- asset.
+--
+-- All four use the standard house policy (contracts template): any
+-- authenticated staff member of the owning company can CRUD. End
+-- customers never touch these tables directly — online booking's
+-- availability counts will go through a service-role web API route — so
+-- there are deliberately NO anon policies or grants here.
+
+alter table "public"."settings_rental" enable row level security;
+alter table "public"."saved_location" enable row level security;
+alter table "public"."rental_task_option" enable row level security;
+alter table "public"."asset" enable row level security;
+
+grant all on table "public"."settings_rental" to "authenticated";
+grant all on table "public"."settings_rental" to "service_role";
+grant all on table "public"."saved_location" to "authenticated";
+grant all on table "public"."saved_location" to "service_role";
+grant all on table "public"."rental_task_option" to "authenticated";
+grant all on table "public"."rental_task_option" to "service_role";
+grant all on table "public"."asset" to "authenticated";
+grant all on table "public"."asset" to "service_role";
+
+create policy "Anyone with matching company_id can CRUD"
+on "public"."settings_rental"
+to "authenticated"
+using (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"))
+with check (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"));
+
+create policy "Anyone with matching company_id can CRUD"
+on "public"."saved_location"
+to "authenticated"
+using (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"))
+with check (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"));
+
+create policy "Anyone with matching company_id can CRUD"
+on "public"."rental_task_option"
+to "authenticated"
+using (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"))
+with check (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"));
+
+create policy "Anyone with matching company_id can CRUD"
+on "public"."asset"
+to "authenticated"
+using (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"))
+with check (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"));

package/dist/dist/migrations/20260807014716_add_job_schedule_any_time.sql

@@ -0,0 +1,7 @@
+-- C2 (task creation & display): any-time flag for task-typed schedules.
+-- start_time/end_time stay NOT NULL — when any_time is true the client still
+-- writes a real all-day range (00:00–23:59 of the selected date) so lagging
+-- mobile clients render sanely. Default false keeps every existing row and
+-- every normal-job write unchanged.
+alter table job_schedule
+  add column any_time boolean not null default false;

package/dist/dist/migrations/20260807014717_add_job_schedule_target_location.sql

@@ -0,0 +1,48 @@
+-- C3 (task completion): destination for the take-to task family
+-- (take_to_dump / take_to_lot / take_to_other). Two shapes, mutually
+-- exclusive, both-null allowed (destination not chosen yet — the completion
+-- flow asks for it at latest before completing):
+--   saved    -> target_saved_location_id set, freeform columns all null
+--   freeform -> target_address set (one-off spot); lat/lng nullable because
+--               geocoding is best-effort (saved_location precedent)
+-- Exactly one reader (getTaskTarget) and one writer (buildTaskTargetColumns)
+-- exist in src/server-safe/rentals.ts — no call site touches the raw columns,
+-- same rule as the asset location columns.
+
+alter table "public"."job_schedule"
+    add column "target_saved_location_id" "uuid",
+    add column "target_address" "text",
+    add column "target_latitude" numeric,
+    add column "target_longitude" numeric;
+
+alter table "public"."job_schedule"
+    add constraint "job_schedule_target_location_shape_check" check (
+        (
+            "target_saved_location_id" is null
+            and "target_address" is null
+            and "target_latitude" is null
+            and "target_longitude" is null
+        )
+        or (
+            "target_saved_location_id" is not null
+            and "target_address" is null
+            and "target_latitude" is null
+            and "target_longitude" is null
+        )
+        or (
+            "target_saved_location_id" is null
+            and "target_address" is not null
+        )
+    );
+
+-- Composite tenant-consistent FK, ON DELETE RESTRICT like
+-- asset_saved_location_id_fkey: SET NULL would silently strand a task's
+-- destination. Product-flow deletes are archive-first anyway (C1 semantics).
+alter table only "public"."job_schedule"
+    add constraint "job_schedule_target_saved_location_id_fkey"
+    foreign key ("target_saved_location_id", "company_id")
+    references "public"."saved_location"("id", "company_id")
+    on delete restrict;
+
+create index "job_schedule_target_saved_location_id_idx"
+    on "public"."job_schedule" ("target_saved_location_id");

package/dist/dist/migrations/20260807014718_job_schedule_completion_guard.sql

@@ -0,0 +1,53 @@
+-- C3 (task completion): old-client guard. A task-typed schedule must have its
+-- asset selected before it can be completed — the completion flow writes the
+-- asset's fullness/location, and a null asset would silently skip the state
+-- machine. Fires ONLY on the transition INTO 'Completed':
+--   * re-saving an already-Completed row -> old.status = 'Completed', skip
+--   * un-completing (Completed -> anything) -> new.status <> 'Completed', skip
+--   * Canceled                              -> new.status <> 'Completed', skip
+--   * normal jobs (task_type null)          -> skip
+-- Triggers fire for service_role too (unlike RLS), so this also covers the
+-- API v1 routes and bulk import. Recurring this_and_future fan-out never hits
+-- task rows (tasks cannot recur), so the guard cannot abort those batches.
+-- The raise text surfaces RAW in lagging C2-era clients' error toasts, so it
+-- is worded as an instruction.
+
+create or replace function "public"."prevent_task_completion_without_asset"()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+    if new."status" <> 'Completed' or new."task_type" is null then
+        return new;
+    end if;
+    if TG_OP = 'UPDATE' and old."status" = 'Completed' then
+        return new;
+    end if;
+
+    if new."asset_id" is null then
+        raise exception 'Select the asset before completing this task.'
+            using errcode = '23514',
+                constraint = 'job_schedule_completion_requires_asset';
+    end if;
+
+    if new."task_type" = 'swap' and new."secondary_asset_id" is null then
+        raise exception 'Select both assets before completing this swap task.'
+            using errcode = '23514',
+                constraint = 'job_schedule_completion_requires_asset';
+    end if;
+
+    return new;
+end;
+$$;
+
+alter function "public"."prevent_task_completion_without_asset"() owner to "postgres";
+
+-- Column list applies to UPDATE only (INSERT always fires): a row cannot
+-- transition into Completed without status in the SET list, and the existing
+-- outbound-event triggers on job_schedule are AFTER, so ordering is clean.
+create or replace trigger "job_schedule_completion_guard"
+    before insert or update of "status" on "public"."job_schedule"
+    for each row
+    execute function "public"."prevent_task_completion_without_asset"();

package/dist/dist/migrations/20260807014719_add_job_schedule_list_sort_key.sql

@@ -0,0 +1,7 @@
+-- C4 (schedule views): manual ordering key for the schedule List View.
+-- Meaningful only for any-time tasks (task_type non-null and any_time true);
+-- null means the default position 0 (top of day). Timed rows order by
+-- start_time and ignore this. The key is day-relative, so date moves never
+-- rewrite it. Reordering writes only this column — never start_time/end_time.
+alter table job_schedule
+  add column list_sort_key numeric null;

package/dist/dist/migrations/20260807014720_add_item_duration.sql

@@ -0,0 +1,11 @@
+-- C5 (online booking for rentals): rental duration on pricebook/booking items.
+-- Non-null duration is THE rental marker — an item with a duration IS a
+-- rental; null keeps it a normal service. Value is the rental length in
+-- whole days: pick-up date = drop-off date + duration (duration 1 => pick-up
+-- the next day). The CHECK forbids 0/negatives — no same-day rentals.
+-- No RLS change needed: item's "If is_booking, public can read" policy makes
+-- the column anon-readable on booking items, which is exactly what the public
+-- booking page needs.
+alter table item
+  add column duration integer null
+  constraint item_duration_check check (duration > 0);

package/dist/dist/migrations/20260807014721_add_settings_booking_enforce_rental_availability.sql

@@ -0,0 +1,9 @@
+-- C5 (online booking for rentals): availability-enforcement toggle.
+-- Lives on the anon-readable settings_booking (NOT settings_rental) because
+-- the public booking page reads this table directly — reserved by the
+-- comment in 20260807014710_create_settings_rental.sql. Default false =
+-- spec's "infinite availability": rental days never block. When true, the
+-- booking form (and customer-create-job's server re-check) limit rental
+-- bookings by the company's real non-archived asset count.
+alter table settings_booking
+  add column enforce_rental_availability boolean not null default false;

package/dist/dist/migrations/20260807014722_add_job_unsigned_rental_agreement.sql

@@ -0,0 +1,10 @@
+-- C5 (online booking for rentals): "Rental agreement not signed" warning
+-- flag, mirroring unpaid_upfront's boolean|null shape (null/false = no
+-- warning). Denormalized on the job because mobile cannot cheaply resolve
+-- item_contract_requirement per render. Set when a rental (duration) item
+-- with contract requirements lands on a job with no Signed contract —
+-- server-side for booking-created jobs, at item-add for manual jobs.
+-- Cleared automatically by /api/customer-sign-contract when the job's last
+-- outstanding contract is signed, or manually dismissed like unpaid_upfront.
+alter table job
+  add column unsigned_rental_agreement boolean null;