autopilot-core-sandbox 0.0.1

package/dist/dist/migrations/20260807014723_add_item_size.sql

@@ -0,0 +1,12 @@
+-- Size in yards on pricebook/booking items, mirroring asset.size: the soft
+-- asset-size mismatch warning on the schedule cards compares a selected
+-- asset's size against the sizes of the job's rental (duration) items,
+-- resolved by item_name. Null = no size configured — the item never
+-- contributes to the warning. The CHECK forbids 0/negatives
+-- (item_duration_check's sibling): zero or negative yardage is always a
+-- data error, and both UIs coerce empty/invalid input to null.
+-- No RLS change needed: item's "If is_booking, public can read" policy
+-- already covers new columns.
+alter table item
+  add column "size" numeric null
+  constraint item_size_check check ("size" > 0);

package/dist/dist/migrations/20260809193533_add_booking_path_button_labels.sql

@@ -0,0 +1,11 @@
+-- Labels for the rentals-vs-services chooser on the public booking page.
+-- When a company's booking catalog offers both rentals (duration items) and
+-- services, the Items step opens with two buttons; these columns are their
+-- text. NOT NULL with defaults (enforce_rental_availability's sibling):
+-- every row reads ready-to-render strings and no consumer branches on null.
+-- Both settings UIs normalize cleared fields back to these defaults at save.
+-- No RLS change needed: settings_booking's public-read policy and grants are
+-- table-level, so new columns are automatically anon-readable.
+alter table settings_booking
+  add column rental_button_label text not null default 'Dumpster Rental',
+  add column service_button_label text not null default 'Junk Removal';

package/dist/dist/migrations/20260809231721_add_route_distance_cache.sql

@@ -0,0 +1,37 @@
+-- Global driving-distance cache for rental route optimization.
+--
+-- One row per DIRECTED coordinate pair, fetched from the Google Routes API
+-- (computeRouteMatrix) by the web server's distance layer. Keyed by lat/lng
+-- rounded to 4 decimal places (~11 m) — rounding happens in the application
+-- layer at both write and lookup time, so re-geocoding jitter still hits the
+-- cache. Coordinate pairs, not address strings: address formatting drifts,
+-- coordinates don't.
+--
+-- Deliberately global (no company_id): the driving distance between two
+-- points has no tenant dimension, and sharing rows across companies
+-- multiplies the hit rate. Lot/landfill pairs are static, so they are
+-- fetched once ever. Directed because road networks are asymmetric; the
+-- read layer may use the reversed pair as an estimate but never stores a
+-- reversed row.
+--
+-- No TTL logic yet; fetched_at supports a future refresh policy.
+
+create table "public"."route_distance_cache" (
+    "id" uuid not null default gen_random_uuid(),
+    "created_at" timestamp with time zone not null default now(),
+    "origin_lat" numeric(8, 4) not null,
+    "origin_lng" numeric(9, 4) not null,
+    "dest_lat" numeric(8, 4) not null,
+    "dest_lng" numeric(9, 4) not null,
+    "distance_meters" integer not null,
+    "duration_seconds" integer not null,
+    "provider" text not null default 'google_routes',
+    "fetched_at" timestamp with time zone not null default now()
+);
+
+alter table "public"."route_distance_cache"
+    add constraint "route_distance_cache_pkey" primary key ("id");
+
+create unique index "route_distance_cache_pair_idx"
+    on "public"."route_distance_cache"
+    ("origin_lat", "origin_lng", "dest_lat", "dest_lng");

package/dist/dist/migrations/20260809231722_route_distance_cache_rls.sql

@@ -0,0 +1,15 @@
+-- RLS + grants for route_distance_cache.
+--
+-- Affected table: route_distance_cache (created in the preceding
+-- add_route_distance_cache migration).
+--
+-- The cache is server infrastructure: only the web server's distance layer
+-- (service role) reads or writes it. Clients never touch it, so RLS is
+-- enabled with NO policies and table grants are revoked from anon and
+-- authenticated — service_role bypasses RLS and keeps its grant.
+
+alter table "public"."route_distance_cache" enable row level security;
+
+revoke all on table "public"."route_distance_cache" from "anon";
+revoke all on table "public"."route_distance_cache" from "authenticated";
+grant all on table "public"."route_distance_cache" to "service_role";

package/dist/dist/migrations/20260809231723_apply_rental_route_plan_function.sql

@@ -0,0 +1,275 @@
+-- Transactional write-back for an approved rental route plan.
+--
+-- Approving a plan must atomically (1) verify every planned schedule row is
+-- still in the state it had when the plan was computed, (2) apply the new
+-- list_sort_key / asset_id values, (3) replace each planned row's job_user
+-- assignments, and (4) insert the optimizer-created take_to_dump /
+-- take_to_lot rows with their assignments. Done as separate PostgREST
+-- calls, a failure mid-way could leave a half-applied plan (reassigned
+-- drivers with stale ordering, or landfill legs without their haul), so it
+-- is one function, one transaction.
+--
+-- The row locks plus the status precondition resolve the approve-vs-edit
+-- race: any concurrent status change either commits first (this call then
+-- fails the precondition, errcode P0010, surfaced to the dispatcher as
+-- "plan is stale — re-run") or blocks on the lock until the plan is fully
+-- applied.
+--
+-- The function is a dumb applier: every column value (including the
+-- target_* location shape) is computed in TypeScript by the web server via
+-- the canonical single-writer helpers, preserving the single-writer rule.
+-- It enforces only tenancy, staleness, and the invariants of
+-- optimizer-created rows (take_to_dump/take_to_lot only, asset required,
+-- status Open, any_time true).
+--
+-- security definer + service_role-only: the sole caller is
+-- /api/rental-routes/apply, which authenticates the dispatcher and checks
+-- the create_jobs permission before calling.
+--
+-- Payload shapes:
+--   p_expected:     [{"schedule_id": uuid, "status": text,
+--                     "asset_id": uuid | null,
+--                     "secondary_asset_id": uuid | null,
+--                     "list_sort_key": numeric | null,
+--                     "user_ids": [uuid]  (current assignees, sorted)}]
+--   p_task_updates: [{"schedule_id": uuid, "list_sort_key": numeric,
+--                     "asset_id": uuid (key optional; absent = leave as-is)}]
+--   p_assignments:  [{"schedule_id": uuid, "user_ids": [uuid]}]
+--   p_new_tasks:    [{"id": uuid, "job_id": uuid, "task_type": text,
+--                     "start_time": timestamptz, "end_time": timestamptz,
+--                     "list_sort_key": numeric, "asset_id": uuid,
+--                     "target_saved_location_id": uuid | null,
+--                     "target_address": text | null,
+--                     "target_latitude": numeric | null,
+--                     "target_longitude": numeric | null,
+--                     "user_ids": [uuid]}]
+
+create or replace function "public"."apply_rental_route_plan"(
+    "p_company_id" uuid,
+    "p_expected" jsonb,
+    "p_task_updates" jsonb,
+    "p_assignments" jsonb,
+    "p_new_tasks" jsonb
+) returns void
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+    v_item jsonb;
+    v_sched "public"."job_schedule"%rowtype;
+    v_expected_ids uuid[] := '{}';
+    v_schedule_id uuid;
+    v_new_id uuid;
+    v_job_id uuid;
+    v_current_users uuid[];
+    v_expected_users uuid[];
+begin
+    if p_company_id is null then
+        raise exception 'company id is required'
+            using errcode = 'P0011';
+    end if;
+
+    -- 1. Lock every planned row; verify tenancy and that its optimized
+    --    state — status, assets, ordering, assignees — is unchanged since
+    --    the plan was computed. Status alone is not enough: a dispatcher
+    --    can re-assign an asset or a driver without touching status, and a
+    --    stale plan must not overwrite that edit.
+    for v_item in
+        select * from jsonb_array_elements(coalesce(p_expected, '[]'::jsonb))
+    loop
+        v_schedule_id := (v_item->>'schedule_id')::uuid;
+
+        select * into v_sched
+        from "public"."job_schedule"
+        where "id" = v_schedule_id
+        for update;
+
+        if not found or v_sched."company_id" is distinct from p_company_id then
+            raise exception 'route plan references an unknown schedule row'
+                using errcode = 'P0011';
+        end if;
+
+        select coalesce(array_agg("user_id" order by "user_id"), '{}')
+        into v_current_users
+        from "public"."job_user"
+        where "job_schedule_id" = v_schedule_id;
+
+        select coalesce(array_agg(u.value::uuid order by u.value::uuid), '{}')
+        into v_expected_users
+        from jsonb_array_elements_text(
+            coalesce(v_item->'user_ids', '[]'::jsonb)) u;
+
+        if v_sched."status"::text is distinct from (v_item->>'status')
+            or v_sched."asset_id" is distinct from
+                (v_item->>'asset_id')::uuid
+            or v_sched."secondary_asset_id" is distinct from
+                (v_item->>'secondary_asset_id')::uuid
+            or v_sched."list_sort_key" is distinct from
+                (v_item->>'list_sort_key')::numeric
+            or v_current_users is distinct from v_expected_users
+        then
+            raise exception 'route plan is stale'
+                using errcode = 'P0010';
+        end if;
+
+        v_expected_ids := v_expected_ids || v_schedule_id;
+    end loop;
+
+    -- 2. Ordering / asset assignment updates. Every touched row must have
+    --    been locked and company-checked above.
+    for v_item in
+        select * from jsonb_array_elements(coalesce(p_task_updates, '[]'::jsonb))
+    loop
+        v_schedule_id := (v_item->>'schedule_id')::uuid;
+
+        if not (v_schedule_id = any (v_expected_ids)) then
+            raise exception 'task update outside the locked plan rows'
+                using errcode = 'P0011';
+        end if;
+
+        update "public"."job_schedule"
+        set "list_sort_key" = (v_item->>'list_sort_key')::numeric,
+            "asset_id" = case
+                when v_item ? 'asset_id' then (v_item->>'asset_id')::uuid
+                else "asset_id"
+            end
+        where "id" = v_schedule_id;
+    end loop;
+
+    -- 3. Full replacement of each planned row's assignments. job_id is read
+    --    from the schedule row itself, never from the payload, and every
+    --    assignee must belong to the company — user and company foreign
+    --    keys on job_user are enforced independently, so without this
+    --    check a crafted payload could create a cross-tenant assignment.
+    for v_item in
+        select * from jsonb_array_elements(coalesce(p_assignments, '[]'::jsonb))
+    loop
+        v_schedule_id := (v_item->>'schedule_id')::uuid;
+
+        if not (v_schedule_id = any (v_expected_ids)) then
+            raise exception 'assignment outside the locked plan rows'
+                using errcode = 'P0011';
+        end if;
+
+        perform 1
+        from jsonb_array_elements_text(
+            coalesce(v_item->'user_ids', '[]'::jsonb)) u
+        where not exists (
+            select 1 from "public"."user_role" ur
+            where ur."user_id" = u.value::uuid
+              and ur."company_id" = p_company_id
+        );
+        if found then
+            raise exception 'assignee outside the company'
+                using errcode = 'P0011';
+        end if;
+
+        delete from "public"."job_user"
+        where "job_schedule_id" = v_schedule_id;
+
+        insert into "public"."job_user"
+            ("company_id", "job_id", "job_schedule_id", "user_id")
+        select p_company_id, js."job_id", v_schedule_id, u.value::uuid
+        from "public"."job_schedule" js
+        cross join jsonb_array_elements_text(
+            coalesce(v_item->'user_ids', '[]'::jsonb)) u
+        where js."id" = v_schedule_id;
+    end loop;
+
+    -- 4. Optimizer-created landfill / lot legs.
+    for v_item in
+        select * from jsonb_array_elements(coalesce(p_new_tasks, '[]'::jsonb))
+    loop
+        if (v_item->>'task_type') not in ('take_to_dump', 'take_to_lot') then
+            raise exception
+                'optimizer may only create take_to_dump or take_to_lot tasks'
+                using errcode = 'P0012';
+        end if;
+
+        if (v_item->>'asset_id') is null then
+            raise exception 'optimizer-created tasks require an asset'
+                using errcode = 'P0012';
+        end if;
+
+        v_job_id := (v_item->>'job_id')::uuid;
+
+        perform 1 from "public"."job"
+        where "id" = v_job_id and "company_id" = p_company_id;
+
+        if not found then
+            raise exception 'new task references a job outside the company'
+                using errcode = 'P0011';
+        end if;
+
+        perform 1
+        from jsonb_array_elements_text(
+            coalesce(v_item->'user_ids', '[]'::jsonb)) u
+        where not exists (
+            select 1 from "public"."user_role" ur
+            where ur."user_id" = u.value::uuid
+              and ur."company_id" = p_company_id
+        );
+        if found then
+            raise exception 'assignee outside the company'
+                using errcode = 'P0011';
+        end if;
+
+        v_new_id := coalesce((v_item->>'id')::uuid, gen_random_uuid());
+
+        -- on conflict do nothing keeps a retried approval (committed but
+        -- the response was lost) from raising a primary-key violation on
+        -- the client-generated id; the job_user insert is skipped for the
+        -- already-existing row so assignees never duplicate.
+        insert into "public"."job_schedule" (
+            "id", "company_id", "job_id", "task_type", "status", "any_time",
+            "start_time", "end_time", "list_sort_key", "asset_id",
+            "target_saved_location_id", "target_address",
+            "target_latitude", "target_longitude"
+        ) values (
+            v_new_id,
+            p_company_id,
+            v_job_id,
+            v_item->>'task_type',
+            'Open'::"public"."job_status_enum",
+            true,
+            (v_item->>'start_time')::timestamptz,
+            (v_item->>'end_time')::timestamptz,
+            (v_item->>'list_sort_key')::numeric,
+            (v_item->>'asset_id')::uuid,
+            (v_item->>'target_saved_location_id')::uuid,
+            v_item->>'target_address',
+            (v_item->>'target_latitude')::numeric,
+            (v_item->>'target_longitude')::numeric
+        )
+        on conflict ("id") do nothing;
+
+        if found then
+            insert into "public"."job_user"
+                ("company_id", "job_id", "job_schedule_id", "user_id")
+            select p_company_id, v_job_id, v_new_id, u.value::uuid
+            from jsonb_array_elements_text(
+                coalesce(v_item->'user_ids', '[]'::jsonb)) u;
+        end if;
+    end loop;
+end;
+$$;
+
+alter function "public"."apply_rental_route_plan"(
+    uuid, jsonb, jsonb, jsonb, jsonb
+) owner to "postgres";
+
+-- security definer + service_role-only: /api/rental-routes/apply is the
+-- sole caller; no authenticated/anon path exists.
+revoke all on function "public"."apply_rental_route_plan"(
+    uuid, jsonb, jsonb, jsonb, jsonb
+) from public;
+revoke all on function "public"."apply_rental_route_plan"(
+    uuid, jsonb, jsonb, jsonb, jsonb
+) from "anon";
+revoke all on function "public"."apply_rental_route_plan"(
+    uuid, jsonb, jsonb, jsonb, jsonb
+) from "authenticated";
+grant execute on function "public"."apply_rental_route_plan"(
+    uuid, jsonb, jsonb, jsonb, jsonb
+) to "service_role";

package/dist/dist/migrations/20260810171550_add_settings_job_default_job_types.sql

@@ -0,0 +1,9 @@
+-- Default job type applied automatically from a job's task composition
+-- (job_schedule.task_type: null = normal task, non-null = rental task).
+-- normal = all tasks normal, rental = all tasks rental, mixed = both.
+-- Null means "no default configured" — the automation leaves job.type alone.
+-- ON DELETE SET NULL so deleting a job_type self-heals the setting.
+alter table public.settings_job
+  add column default_job_type_normal_id uuid references public.job_type(id) on delete set null,
+  add column default_job_type_rental_id uuid references public.job_type(id) on delete set null,
+  add column default_job_type_mixed_id uuid references public.job_type(id) on delete set null;

package/dist/dist/migrations/20260810212430_backfill_rental_task_option_sort_order.sql

@@ -0,0 +1,61 @@
+-- Display order for the Jobs Type dropdown and the settings preset list
+-- now lives in rental_task_option.sort_order (fetchTaskOptions orders by
+-- sort_order, then created_at). The app writes it going forward
+-- (RentalsProvider: presets get their index in the company's industry
+-- order, customs get 100); this backfills rows created before those
+-- writes existed, mirroring presetSortOrder in server-safe/rentals.ts:
+--   - custom tasks (label is not null) -> 100
+--   - presets -> index in the company's settings_rental.industry_preset
+--     offered list; 'other'/no settings row -> canonical PRESET_TASK_KEYS
+--     order; a preset not in the applicable list -> 99 (stranded)
+-- Idempotent: recomputes the same values on rerun. Non-destructive.
+update "public"."rental_task_option" as "o"
+set "sort_order" = case
+  when "o"."label" is not null then 100
+  else case coalesce(
+      (select "s"."industry_preset"
+         from "public"."settings_rental" as "s"
+        where "s"."company_id" = "o"."company_id"),
+      'other')
+    when 'dumpster' then case "o"."preset_key"
+      when 'drop_off' then 0
+      when 'pick_up' then 1
+      when 'swap' then 2
+      when 'live_load' then 3
+      when 'relocate' then 4
+      when 'dump_and_return' then 5
+      when 'take_to_dump' then 6
+      when 'take_to_lot' then 7
+      when 'take_to_other' then 8
+      else 99 end
+    when 'equipment' then case "o"."preset_key"
+      when 'drop_off' then 0
+      when 'pick_up' then 1
+      when 'repair' then 2
+      when 'swap' then 3
+      when 'take_to_lot' then 4
+      when 'take_to_other' then 5
+      else 99 end
+    when 'portable_toilet' then case "o"."preset_key"
+      when 'drop_off' then 0
+      when 'pick_up' then 1
+      when 'service' then 2
+      when 'relocate' then 3
+      when 'take_to_lot' then 4
+      when 'take_to_other' then 5
+      else 99 end
+    else case "o"."preset_key"
+      when 'drop_off' then 0
+      when 'pick_up' then 1
+      when 'swap' then 2
+      when 'live_load' then 3
+      when 'relocate' then 4
+      when 'dump_and_return' then 5
+      when 'take_to_dump' then 6
+      when 'repair' then 7
+      when 'service' then 8
+      when 'take_to_lot' then 9
+      when 'take_to_other' then 10
+      else 99 end
+  end
+end;

package/dist/dist/migrations/20260811224317_add_settings_user_dnd_hint_dismissed.sql

@@ -0,0 +1,9 @@
+alter table "public"."settings_user"
+add column "map_dnd_hint_dismissed" boolean not null default false,
+add column "schedule_dnd_hint_dismissed" boolean not null default false;
+
+comment on column "public"."settings_user"."map_dnd_hint_dismissed"
+is 'Tracks whether this user has dismissed the one-time drag-and-drop hint on the web map sidebar.';
+
+comment on column "public"."settings_user"."schedule_dnd_hint_dismissed"
+is 'Tracks whether this user has dismissed the one-time drag-and-drop hint on the mobile schedule List View.';

package/dist/dist/migrations/20260813174503_repair_user_role_email_drift.sql

@@ -0,0 +1,59 @@
+-- One-time data repair: email drift between user_role / staging_new_employee
+-- and "user". Root cause: the change-user-auth-email route updated user.email
+-- with the caller's session client, but user_role writes are owner-only under
+-- RLS, so the user_role.email sync silently no-oped for non-owners; a later
+-- reinvite then staged lower(user.email), which no user_role row matched by
+-- email and fetchEmployees threw for the whole company.
+--
+-- Data backfill only — no schema or policy changes. Safe to apply
+-- independently of any web/mobile deploy.
+
+-- 1) Where user_role is linked to a user, the user row's email is
+--    authoritative.
+UPDATE public.user_role ur
+SET email = lower(trim(u.email))
+FROM public."user" u
+WHERE ur.user_id = u.id
+  AND ur.email IS DISTINCT FROM lower(trim(u.email));
+
+-- 2) Backfill user_role.user_id where the signup-time backfill was lost
+--    (create-employee swallows that error), but only when the
+--    (company, normalized email) match is unambiguous on BOTH sides: exactly
+--    one user carries the email, and this is the only user_role row carrying
+--    it. Without the role-side check, several unlinked user_role rows sharing
+--    one email would all be linked to the same user, and readers that join
+--    roles by user_id resolve the duplicates arbitrarily. (A row already
+--    linked to the user also trips the role-side check — step 1 has just set
+--    its email to lower(trim(user.email)) — so this can't add a second row
+--    to an already-linked user either.)
+UPDATE public.user_role ur
+SET user_id = u.id
+FROM public."user" u
+WHERE ur.user_id IS NULL
+  AND ur.company_id = u.company_id
+  AND lower(trim(ur.email)) = lower(trim(u.email))
+  AND NOT EXISTS (
+    SELECT 1
+    FROM public."user" u2
+    WHERE u2.company_id = ur.company_id
+      AND lower(trim(u2.email)) = lower(trim(ur.email))
+      AND u2.id <> u.id
+  )
+  AND NOT EXISTS (
+    SELECT 1
+    FROM public.user_role ur2
+    WHERE ur2.company_id = ur.company_id
+      AND lower(trim(ur2.email)) = lower(trim(ur.email))
+      AND ur2.id <> ur.id
+  );
+
+-- 3) Normalize remaining casing/whitespace. New staging rows are already
+--    lowercased on insert; this catches legacy rows. "user".email is left
+--    untouched (user-visible casing; readers are case-insensitive).
+UPDATE public.user_role
+SET email = lower(trim(email))
+WHERE email <> lower(trim(email));
+
+UPDATE public.staging_new_employee
+SET email = lower(trim(email))
+WHERE email <> lower(trim(email));

package/dist/dist/migrations/20260813174504_sync_user_role_email_trigger.sql

@@ -0,0 +1,30 @@
+-- Keep user_role.email in sync whenever user.email changes, so email drift
+-- between the two tables can't be recreated by any write path (app routes,
+-- core updateProfile, manual edits).
+--
+-- SECURITY DEFINER is required: "user" writes are owner-or-self under RLS but
+-- user_role writes are owner-only, so a non-owner updating their own
+-- user.email would otherwise have this trigger's user_role write blocked.
+-- Rows with user_id IS NULL are unreachable here by design — they are
+-- backfilled by the repair migration and by the change-user-auth-email route.
+
+CREATE OR REPLACE FUNCTION public.sync_user_role_email()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+BEGIN
+  IF NEW.email IS DISTINCT FROM OLD.email THEN
+    UPDATE public.user_role
+    SET email = lower(trim(NEW.email))
+    WHERE user_id = NEW.id;
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+CREATE TRIGGER trg_sync_user_role_email
+AFTER UPDATE OF email ON public."user"
+FOR EACH ROW
+EXECUTE FUNCTION public.sync_user_role_email();

package/dist/dist/migrations/20260813175210_add_event_list_sort_key.sql

@@ -0,0 +1,5 @@
+alter table "public"."event"
+add column "list_sort_key" numeric null;
+
+comment on column "public"."event"."list_sort_key"
+is 'Manual position of an all-day (no-time) event in the schedule list ordering, sharing the day axis with job_schedule.list_sort_key. NULL = never manually placed (all-day events default to their 00:01 sentinel position). Timed events ignore it and anchor at their start time.';

package/dist/dist/migrations/20260814172222_add_client_auto_bill_on_completion.sql

@@ -0,0 +1,6 @@
+-- Additive and backward-compatible: existing rows default to false (no auto-billing).
+alter table public.client
+  add column if not exists auto_bill_on_completion boolean not null default false;
+
+comment on column public.client.auto_bill_on_completion is
+  'Bill this client automatically when their job is marked Completed (the transition that makes every schedule day Completed). Charges the client''s default Stripe card (invoice_settings.default_payment_method on the connected account) after an in-app confirmation of the job items and total. Only effective when cards are on file; card truth lives in Stripe, not here.';

package/dist/dist/migrations/20260816160252_create_automation_rule.sql

@@ -0,0 +1,99 @@
+-- Automation rules: user-authored "trigger + timing + action + conditions"
+-- records (Automations settings page, web + mobile). The engine lives in
+-- autopilot-web (/api/automations-cron): Phase A fans automation_event rows
+-- out against enabled rules, Phase B scans date-anchored triggers live, and
+-- Phase C executes claimed automation_run rows.
+--
+-- Column vs jsonb split: trigger_type / action_type / is_enabled are real
+-- columns because the engine filters and indexes on them and the CHECKs give
+-- DB-level integrity. Per-type parameters (trigger_config, action_config)
+-- and the flat AND condition list are jsonb: heterogeneous across types,
+-- interpreted only in TS, and evolvable without migrations. The TS
+-- validators in autopilot-core src/server-safe/automations.ts are the schema
+-- authority for the jsonb shapes.
+
+create table if not exists "public"."automation_rule" (
+    "id" uuid default gen_random_uuid() not null,
+    "created_at" timestamp with time zone default now() not null,
+    "company_id" uuid not null,
+    "created_by" uuid,
+    "name" text not null,
+    "is_enabled" boolean default true not null,
+    -- keep in sync with AUTOMATION_TRIGGER_TYPES in
+    -- autopilot-core src/server-safe/automations.ts
+    "trigger_type" text not null,
+    -- shape depends on trigger_type; see TriggerConfig in automations.ts.
+    -- Timing lives here too (direction / offset_value / offset_unit /
+    -- send_at) because valid timing modes depend on the trigger.
+    "trigger_config" jsonb default '{}'::jsonb not null,
+    -- flat AND list: [{"field":"job_type"|"client_tag"|"job_source",
+    --                  "op":"is"|"is_not","value":"<name string>"}]
+    "conditions" jsonb default '[]'::jsonb not null,
+    -- keep in sync with AUTOMATION_ACTION_TYPES in automations.ts
+    "action_type" text not null,
+    -- shape depends on action_type; see ActionConfig in automations.ts
+    "action_config" jsonb default '{}'::jsonb not null,
+    "message_template" text default '' not null,
+    -- messages actually sent (not attempts); incremented by the engine via
+    -- increment_automation_rule_counters
+    "times_triggered" integer default 0 not null,
+    -- informational: which preset prefilled this rule, for adoption analytics
+    "preset_key" text
+);
+
+alter table only "public"."automation_rule"
+    add constraint "automation_rule_pkey" primary key ("id");
+
+alter table only "public"."automation_rule"
+    add constraint "automation_rule_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete cascade;
+
+alter table only "public"."automation_rule"
+    add constraint "automation_rule_created_by_fkey"
+    foreign key ("created_by") references "public"."user"("id") on delete set null;
+
+alter table only "public"."automation_rule"
+    add constraint "automation_rule_trigger_type_check"
+    check ("trigger_type" in (
+        'job_created', 'job_status_changed', 'schedule_time_relative',
+        'rental_date_relative', 'rental_task_completed',
+        'estimate_sent', 'estimate_approved', 'estimate_declined',
+        'estimate_pending',
+        'lead_created',
+        'booking_request_received', 'booking_confirmed', 'booking_declined'));
+
+alter table only "public"."automation_rule"
+    add constraint "automation_rule_action_type_check"
+    check ("action_type" in ('sms_client', 'email_client', 'notify_team'));
+
+create index if not exists "automation_rule_company_idx"
+    on "public"."automation_rule" ("company_id");
+
+-- Phase B scans enabled anchor-type rules across all companies each tick
+create index if not exists "automation_rule_enabled_type_idx"
+    on "public"."automation_rule" ("trigger_type")
+    where "is_enabled";
+
+-- Batched counter bump for sent runs. An RPC because supabase-js cannot
+-- express `set x = x + n`. Duplicate ids in the array count multiple times
+-- (one increment per sent run).
+create or replace function "public"."increment_automation_rule_counters"("rule_ids" uuid[])
+returns void
+language "sql"
+security definer
+set search_path = 'public'
+as $$
+  update automation_rule r
+     set times_triggered = times_triggered + counts.n
+    from (
+      select id, count(*)::integer as n
+      from unnest(rule_ids) as id
+      group by id
+    ) as counts
+   where r.id = counts.id;
+$$;
+
+revoke all on function "public"."increment_automation_rule_counters"(uuid[]) from public;
+revoke all on function "public"."increment_automation_rule_counters"(uuid[]) from "anon";
+revoke all on function "public"."increment_automation_rule_counters"(uuid[]) from "authenticated";
+grant execute on function "public"."increment_automation_rule_counters"(uuid[]) to "service_role";

package/dist/dist/migrations/20260816160253_automation_rule_rls.sql

@@ -0,0 +1,19 @@
+-- RLS for automation_rule.
+--
+-- Affected tables: automation_rule.
+--
+-- Standard house policy: any authenticated staff member of the owning
+-- company can CRUD (rules are managed from the Automations settings page on
+-- web and mobile; the page itself is gated by manage_company_settings). End
+-- customers never touch this table — no anon policies or grants.
+
+alter table "public"."automation_rule" enable row level security;
+
+grant all on table "public"."automation_rule" to "authenticated";
+grant all on table "public"."automation_rule" to "service_role";
+
+create policy "Anyone with matching company_id can CRUD"
+on "public"."automation_rule"
+to "authenticated"
+using (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"))
+with check (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"));