autopilot-core-sandbox 0.0.1

package/dist/dist/migrations/20260816160254_create_settings_automation.sql

@@ -0,0 +1,36 @@
+-- Company-level settings for the automations engine. One row per company,
+-- lazily created by the Automations settings page (web + mobile) with these
+-- defaults on first visit; the engine treats a missing row as the defaults.
+--
+-- Quiet hours apply to AUTOMATION client SMS only (email and team push are
+-- unaffected, as are all pre-existing send surfaces: job/estimate reminders,
+-- status notifications, sequences, blasts). Sends that come due inside the
+-- window are HELD, not dropped: the engine reschedules them to the window's
+-- end and re-runs every gate (revalidation, conditions, suppression, A2P)
+-- when they finally go out.
+--
+-- ON by default (product decision, Ryan 2026-08-16): a brand-new automation
+-- surface should not be able to text customers at 3am out of the box.
+-- Automations are themselves opt-in (a user must create/enable a rule), so
+-- the default changes no existing behavior.
+
+create table if not exists "public"."settings_automation" (
+    "id" uuid default gen_random_uuid() not null,
+    "created_at" timestamp with time zone default now() not null,
+    "company_id" uuid not null,
+    "quiet_hours_enabled" boolean default true not null,
+    -- local wall-clock in company.time_zone; the window may wrap midnight
+    -- (21:00 -> 08:00). start = end means no window (never inside).
+    "quiet_hours_start" time default '21:00' not null,
+    "quiet_hours_end" time default '08:00' not null
+);
+
+alter table only "public"."settings_automation"
+    add constraint "settings_automation_pkey" primary key ("id");
+
+alter table only "public"."settings_automation"
+    add constraint "settings_automation_company_id_key" unique ("company_id");
+
+alter table only "public"."settings_automation"
+    add constraint "settings_automation_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete cascade;

package/dist/dist/migrations/20260816160255_settings_automation_rls.sql

@@ -0,0 +1,18 @@
+-- RLS for settings_automation.
+--
+-- Affected tables: settings_automation.
+--
+-- Standard house policy: any authenticated staff member of the owning
+-- company can CRUD (quiet hours are edited on the Automations settings
+-- page). No anon policies or grants.
+
+alter table "public"."settings_automation" enable row level security;
+
+grant all on table "public"."settings_automation" to "authenticated";
+grant all on table "public"."settings_automation" to "service_role";
+
+create policy "Anyone with matching company_id can CRUD"
+on "public"."settings_automation"
+to "authenticated"
+using (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"))
+with check (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"));

package/dist/dist/migrations/20260816160256_create_automation_event.sql

@@ -0,0 +1,71 @@
+-- Transition facts for the automations engine, captured by dedicated AFTER
+-- triggers (automation_event_triggers migration).
+--
+-- Deliberately SEPARATE from outbound_event: that outbox carries no
+-- prev-state (snapshot only on *.deleted) and its fan-out coalesces
+-- *.updated per entity per batch — both fatal for transition-based triggers
+-- ("status became Completed" needs old/new, and Pending Confirmation → Open
+-- → In Progress inside one batch must not collapse). Widening outbound_event
+-- would change the contract every webhook subscriber depends on, so the
+-- automations engine gets its own narrow event stream: triggers fire only on
+-- the ~10 specific transitions rules can subscribe to, with exactly the
+-- payload the engine needs.
+--
+-- Consumed at-least-once by /api/automations-cron Phase A (rows are marked
+-- processed_at only AFTER runs are enqueued; a crash between the two
+-- re-processes into automation_run's unique (rule_id, dedupe_key) claim and
+-- converges). Processed rows are purged by cleanup_webhook_outbox.
+
+create table if not exists "public"."automation_event" (
+    "id" uuid default gen_random_uuid() not null,
+    "created_at" timestamp with time zone default now() not null,
+    "company_id" uuid not null,
+    -- keep in sync with AUTOMATION_EVENT_TYPES in
+    -- autopilot-core src/server-safe/automations.ts
+    "event_type" text not null,
+    -- entity refs: deliberately NO foreign keys — events must survive entity
+    -- deletion (job_deleted / booking_declined are delete-derived) and the
+    -- engine tolerates dangling ids via revalidation.
+    "job_id" uuid,
+    "schedule_id" uuid,
+    "client_id" uuid,
+    "estimate_id" uuid,
+    -- old_status / new_status / task_type / start_time / any_time as
+    -- relevant; to_jsonb(OLD) snapshot for delete-derived events
+    "payload" jsonb default '{}'::jsonb not null,
+    "processed_at" timestamp with time zone
+);
+
+alter table only "public"."automation_event"
+    add constraint "automation_event_pkey" primary key ("id");
+
+alter table only "public"."automation_event"
+    add constraint "automation_event_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete cascade;
+
+alter table only "public"."automation_event"
+    add constraint "automation_event_event_type_check"
+    check ("event_type" in (
+        'job_created', 'job_deleted', 'job_status_changed',
+        'rental_task_completed',
+        'booking_request_received', 'booking_confirmed', 'booking_declined',
+        'estimate_sent', 'estimate_approved', 'estimate_declined',
+        'lead_created'));
+
+create index if not exists "automation_event_unprocessed_idx"
+    on "public"."automation_event" ("created_at")
+    where "processed_at" is null;
+
+create index if not exists "automation_event_company_idx"
+    on "public"."automation_event" ("company_id", "created_at");
+
+-- Phase A resolves booking_declined (web path: schedule rows deleted with
+-- the job already gone) against the same job's job_deleted snapshot event
+create index if not exists "automation_event_job_idx"
+    on "public"."automation_event" ("job_id", "event_type")
+    where "job_id" is not null;
+
+-- retention scan support ("old + processed")
+create index if not exists "automation_event_cleanup_idx"
+    on "public"."automation_event" ("created_at")
+    where "processed_at" is not null;

package/dist/dist/migrations/20260816160257_automation_event_rls.sql

@@ -0,0 +1,12 @@
+-- RLS for automation_event.
+--
+-- Affected tables: automation_event.
+--
+-- Engine-internal: rows are written by SECURITY DEFINER triggers and read
+-- only by the service-role cron in autopilot-web. RLS is enabled with NO
+-- policies and NO authenticated/anon grants, so nothing outside the engine
+-- can touch it (outbound_event precedent).
+
+alter table "public"."automation_event" enable row level security;
+
+grant all on table "public"."automation_event" to "service_role";

package/dist/dist/migrations/20260816160258_create_automation_run.sql

@@ -0,0 +1,129 @@
+-- automation_run is three things in one row, generalizing reminder_dispatch:
+--   1. The exactly-once claim: unique (rule_id, dedupe_key). Enqueue is a
+--      supabase-js upsert with ignoreDuplicates against this FULL unique
+--      constraint (reminder_dispatch precedent — no partial-index RPC
+--      needed). Whatever storm of duplicate events or overlapping cron
+--      ticks occurs, one row wins.
+--   2. The work queue: pending rows past next_attempt_at are claimed by
+--      claim_automation_runs (FOR UPDATE SKIP LOCKED, qb_sync_task
+--      precedent) and executed by /api/automations-cron Phase C.
+--   3. The user-visible run history: entity/recipient/rendered_body are
+--      denormalized at enqueue/send time so history survives entity
+--      deletion. Entity refs have NO FKs for the same reason; only rule_id
+--      cascades (per-rule history dies with its rule, which matches the
+--      product surface).
+--
+-- Dedupe key shapes live in buildDedupeKey in autopilot-core
+-- src/server-safe/automations.ts — the catalog there and this table's
+-- semantics MUST stay in sync. Keys are job/estimate/client-scoped (never
+-- schedule-row-scoped: edits delete-and-recreate job_schedule rows with
+-- fresh uuids, the lesson baked into reminder_dispatch).
+
+create table if not exists "public"."automation_run" (
+    "id" uuid default gen_random_uuid() not null,
+    "created_at" timestamp with time zone default now() not null,
+    "company_id" uuid not null,
+    "rule_id" uuid not null,
+    -- informational: the event that enqueued this run. NO FK — events are
+    -- purged after their retention window and a dangling pointer is fine.
+    "event_id" uuid,
+    "dedupe_key" text not null,
+    -- pending:    waiting for next_attempt_at (includes quiet-hours holds)
+    -- processing: claimed by an executor pass
+    -- sent:       handed to the provider (Twilio/SMTP2GO/FCM)
+    -- skipped:    intentionally not sent; see skip_reason
+    -- failed:     deterministic pre-network failure; terminal
+    -- dead:       stuck 'processing' swept here; NEVER retried — after a
+    --             network call we cannot know whether delivery happened,
+    --             and a duplicate text is worse than a missed one
+    --             (claimReminderDispatch doctrine)
+    "status" text default 'pending' not null,
+    "due_at" timestamp with time zone default now() not null,
+    "next_attempt_at" timestamp with time zone default now() not null,
+    -- 'quiet_hours' while a pending row is deferred past due_at
+    "held_reason" text,
+    "attempt_count" integer default 0 not null,
+    "last_attempt_at" timestamp with time zone,
+    -- ---- history / audit (denormalized) ----
+    "action_type" text not null,
+    "job_id" uuid,
+    "estimate_id" uuid,
+    "client_id" uuid,
+    -- phone / email / comma-joined user ids, filled at send time
+    "recipient" text,
+    -- exact content sent (the template may be edited later)
+    "rendered_body" text,
+    -- keep in sync with AUTOMATION_SKIP_REASONS in automations.ts:
+    -- a2p_not_approved | opted_out | do_not_sms | condition_not_met |
+    -- stale_reschedule | trigger_no_longer_true | rule_disabled |
+    -- missing_phone | missing_from_number | missing_email | email_suppressed |
+    -- entity_deleted |
+    -- no_recipients | not_entitled | missed_window
+    "skip_reason" text,
+    "last_error" text,
+    "sent_at" timestamp with time zone
+);
+
+alter table only "public"."automation_run"
+    add constraint "automation_run_pkey" primary key ("id");
+
+alter table only "public"."automation_run"
+    add constraint "automation_run_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete cascade;
+
+alter table only "public"."automation_run"
+    add constraint "automation_run_rule_id_fkey"
+    foreign key ("rule_id") references "public"."automation_rule"("id") on delete cascade;
+
+alter table only "public"."automation_run"
+    add constraint "automation_run_status_check"
+    check ("status" in ('pending', 'processing', 'sent', 'skipped', 'failed', 'dead'));
+
+-- THE exactly-once claim
+alter table only "public"."automation_run"
+    add constraint "automation_run_rule_dedupe_key" unique ("rule_id", "dedupe_key");
+
+create index if not exists "automation_run_due_idx"
+    on "public"."automation_run" ("next_attempt_at")
+    where "status" = 'pending';
+
+-- run-history UI: newest first per rule
+create index if not exists "automation_run_rule_history_idx"
+    on "public"."automation_run" ("rule_id", "created_at" desc);
+
+-- FK support for the company cascade
+create index if not exists "automation_run_company_idx"
+    on "public"."automation_run" ("company_id", "created_at" desc);
+
+-- retention scan support ("old + terminal")
+create index if not exists "automation_run_cleanup_idx"
+    on "public"."automation_run" ("created_at")
+    where "status" in ('sent', 'skipped', 'failed', 'dead');
+
+-- Atomic claim, mirroring claim_qb_sync_tasks (SKIP LOCKED is not
+-- expressible through supabase-js; overlapping cron runs must never
+-- double-send).
+create or replace function "public"."claim_automation_runs"("batch_size" integer)
+returns setof "public"."automation_run"
+language "sql"
+security definer
+set search_path = 'public'
+as $$
+  update automation_run set
+    status = 'processing',
+    attempt_count = attempt_count + 1,
+    last_attempt_at = now()
+  where id in (
+    select id from automation_run
+    where status = 'pending' and next_attempt_at <= now()
+    order by next_attempt_at
+    limit least(batch_size, 500)
+    for update skip locked
+  )
+  returning *;
+$$;
+
+revoke all on function "public"."claim_automation_runs"(integer) from public;
+revoke all on function "public"."claim_automation_runs"(integer) from "anon";
+revoke all on function "public"."claim_automation_runs"(integer) from "authenticated";
+grant execute on function "public"."claim_automation_runs"(integer) to "service_role";

package/dist/dist/migrations/20260816160259_automation_run_rls.sql

@@ -0,0 +1,19 @@
+-- RLS for automation_run.
+--
+-- Affected tables: automation_run.
+--
+-- Read-only for company staff: the per-rule run-history UI (web drawer,
+-- mobile screen) selects directly. All writes go through the service-role
+-- engine — authenticated gets SELECT only, so the claim/queue state machine
+-- cannot be corrupted from clients. No anon access.
+
+alter table "public"."automation_run" enable row level security;
+
+grant select on table "public"."automation_run" to "authenticated";
+grant all on table "public"."automation_run" to "service_role";
+
+create policy "Anyone with matching company_id can read"
+on "public"."automation_run"
+for select
+to "authenticated"
+using (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"));

package/dist/dist/migrations/20260816160300_add_client_created_via.sql

@@ -0,0 +1,25 @@
+-- Provenance marker for client rows, consumed by the lead_created automation
+-- trigger's WHEN clause: rows created with created_via = 'import' NEVER fire
+-- lead automations (locked decision — a CSV import of 500 old contacts must
+-- not mass-text the moment someone imports it).
+--
+-- A column rather than a session GUC because the import paths (web
+-- clients/imports/importUtils.ts, fake-data seeding, onboarding preload)
+-- insert from browser-side supabase-js, which cannot wrap a transaction to
+-- set_config. One stamped field per insert path is the whole integration.
+--
+-- Free text; documented values so far:
+--   'import'  — CSV imports, seed/preload/backfill paths. Suppresses
+--               lead_created automation capture.
+--   null      — organic app paths (contact form, manual entry, softphone,
+--               public API). Fires normally.
+
+alter table "public"."client"
+    add column if not exists "created_via" text;
+
+-- Same provenance marker for job rows, consumed by the job_created automation
+-- trigger's WHEN clause (see 20260816160303): a bulk CSV import of historical
+-- jobs must not fire a job_created automation per imported row. Same
+-- documented values as client.created_via ('import' suppresses, null fires).
+alter table "public"."job"
+    add column if not exists "created_via" text;

package/dist/dist/migrations/20260816160301_add_estimate_sent_at.sql

@@ -0,0 +1,39 @@
+-- Anchor timestamp for the estimate_pending automation trigger ("sent but
+-- still pending after N days"). estimate has no such column today — only
+-- created_at, which is wrong for estimates drafted long before sending.
+--
+-- Maintained by BEFORE triggers on the transition into 'Sent' (insert and
+-- update variants per house style). Set once and kept even if status later
+-- changes — it records when the estimate was FIRST sent; the engine's
+-- scanner filters on status = 'Sent' anyway, and revalidation at send time
+-- kills follow-ups for estimates that got approved/declined meanwhile.
+--
+-- Deliberately NO backfill: null sent_at = ineligible for estimate_pending,
+-- so a company activating a "pending after 3 days" rule can never blast its
+-- historical backlog of already-Sent estimates. Only estimates sent after
+-- this migration applies are candidates.
+
+alter table "public"."estimate"
+    add column if not exists "sent_at" timestamp with time zone;
+
+create or replace function "public"."set_estimate_sent_at"()
+returns trigger
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+begin
+    if NEW.status = 'Sent' and NEW.sent_at is null then
+        NEW.sent_at := now();
+    end if;
+    return NEW;
+end;
+$$;
+
+create or replace trigger "estimate_set_sent_at_u" before update on "public"."estimate"
+    for each row when (old.status is distinct from new.status and new.status = 'Sent')
+    execute function "public"."set_estimate_sent_at"();
+
+create or replace trigger "estimate_set_sent_at_i" before insert on "public"."estimate"
+    for each row when (new.status = 'Sent')
+    execute function "public"."set_estimate_sent_at"();

package/dist/dist/migrations/20260816160302_add_message_automation_ref.sql

@@ -0,0 +1,10 @@
+-- Links a message-thread row to the automation_run that produced it, so
+-- thread UIs (web + mobile) can render an "Automated" label distinctly from
+-- other system:true rows, and support can trace any automated text back to
+-- the exact rule/run that sent it.
+--
+-- Nullable, deliberately NO foreign key: run history has a retention window
+-- and the thread must keep rendering after the run row is purged.
+
+alter table "public"."message"
+    add column if not exists "automation_run_id" uuid;

package/dist/dist/migrations/20260816160303_automation_event_triggers.sql

@@ -0,0 +1,236 @@
+-- Event capture for the automations engine. Detection happens at the DB
+-- layer because the app layer has no chokepoint: job status writes are
+-- scattered across debounced autosave loops on web and mobile plus the
+-- public API and booking routes; estimate Sent transitions exist in three
+-- drifted copies (one of which can fire twice); booking decline produces
+-- different write shapes per platform. These triggers see all of it.
+--
+-- security definer is required: writes normally run as `authenticated`,
+-- which deliberately has no grants on automation_event.
+--
+-- Volume note: unlike the outbound_event outbox, these fire only on the
+-- specific transitions rules can subscribe to (WHEN clauses below), and
+-- events are captured unconditionally — Phase A discards events matching no
+-- enabled rule; retention purges everything processed. That keeps the
+-- trigger bodies free of per-write rule lookups.
+--
+-- Duplicate-shaped facts are expected and collapsed downstream by
+-- automation_run's unique (rule_id, dedupe_key) claim:
+--   * mobile "Finish Job" completes N schedule rows one-by-one
+--   * a 3-unit rental booking inserts 3 drop_off + 3 pick_up rows
+--   * mobile decline writes Canceled then hard-deletes ~1.5s later
+--     (both paths emit booking_declined; one key wins)
+
+-- ============================================================
+-- job: created / deleted
+-- ============================================================
+
+create or replace function "public"."capture_automation_job_insert"()
+returns trigger
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+begin
+    insert into automation_event (company_id, event_type, job_id, client_id)
+    values (NEW.company_id, 'job_created', NEW.id, NEW.client_id);
+    return null;
+end;
+$$;
+
+-- created_via = 'import' rows (bulk CSV import of historical jobs) must never
+-- fire job_created automations, mirroring the lead_created suppression below.
+create or replace trigger "automation_job_created" after insert on "public"."job"
+    for each row when (coalesce(new.created_via, '') <> 'import')
+    execute function "public"."capture_automation_job_insert"();
+
+-- Deletes are hard deletes app-wide, so the to_jsonb(OLD) snapshot is the
+-- only payload available afterward. Used two ways: booking_declined
+-- resolution (web decline deletes the job outright) and template context
+-- for delete-derived sends.
+create or replace function "public"."capture_automation_job_delete"()
+returns trigger
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+begin
+    insert into automation_event (company_id, event_type, job_id, client_id, payload)
+    values (OLD.company_id, 'job_deleted', OLD.id, OLD.client_id, to_jsonb(OLD));
+    return null;
+end;
+$$;
+
+create or replace trigger "automation_job_deleted" after delete on "public"."job"
+    for each row execute function "public"."capture_automation_job_delete"();
+
+-- ============================================================
+-- job_schedule: the real status chokepoint
+-- ============================================================
+
+-- job.status is legacy (only the public API writes it); every in-app status
+-- change lands on job_schedule.status. One status transition can imply up
+-- to three facts: the generic status change, a booking transition, and a
+-- rental task completion.
+create or replace function "public"."capture_automation_schedule_status"()
+returns trigger
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+declare
+    v_client uuid;
+begin
+    select client_id into v_client from job where id = NEW.job_id;
+
+    insert into automation_event (company_id, event_type, job_id, schedule_id, client_id, payload)
+    values (NEW.company_id, 'job_status_changed', NEW.job_id, NEW.id, v_client,
+            jsonb_build_object(
+                'old_status', OLD.status,
+                'new_status', NEW.status,
+                'task_type', NEW.task_type,
+                'start_time', NEW.start_time,
+                'any_time', NEW.any_time));
+
+    if OLD.status = 'Pending Confirmation' and NEW.status = 'Open' then
+        insert into automation_event (company_id, event_type, job_id, schedule_id, client_id)
+        values (NEW.company_id, 'booking_confirmed', NEW.job_id, NEW.id, v_client);
+    end if;
+
+    -- mobile decline path (web decline never writes Canceled — it surfaces
+    -- through the schedule-delete trigger below)
+    if OLD.status = 'Pending Confirmation' and NEW.status = 'Canceled' then
+        insert into automation_event (company_id, event_type, job_id, schedule_id, client_id)
+        values (NEW.company_id, 'booking_declined', NEW.job_id, NEW.id, v_client);
+    end if;
+
+    if NEW.status = 'Completed' and NEW.task_type is not null then
+        insert into automation_event (company_id, event_type, job_id, schedule_id, client_id, payload)
+        values (NEW.company_id, 'rental_task_completed', NEW.job_id, NEW.id, v_client,
+                jsonb_build_object('task_type', NEW.task_type, 'start_time', NEW.start_time));
+    end if;
+
+    return null;
+end;
+$$;
+
+create or replace trigger "automation_schedule_status_u" after update on "public"."job_schedule"
+    for each row when (old.status is distinct from new.status)
+    execute function "public"."capture_automation_schedule_status"();
+
+-- Booking request received: online booking stamps 'Pending Confirmation' on
+-- every inserted schedule row (per-unit rentals insert many for one job;
+-- the bookreq:{job_id} dedupe key collapses them).
+create or replace function "public"."capture_automation_booking_received"()
+returns trigger
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+declare
+    v_client uuid;
+begin
+    select client_id into v_client from job where id = NEW.job_id;
+    insert into automation_event (company_id, event_type, job_id, schedule_id, client_id)
+    values (NEW.company_id, 'booking_request_received', NEW.job_id, NEW.id, v_client);
+    return null;
+end;
+$$;
+
+create or replace trigger "automation_booking_received" after insert on "public"."job_schedule"
+    for each row when (new.status = 'Pending Confirmation')
+    execute function "public"."capture_automation_booking_received"();
+
+-- Web decline path: the job is hard-deleted while its rows still read
+-- Pending Confirmation. Cascade ordering deletes the parent job row BEFORE
+-- this fires, so "parent job still live" distinguishes a real decline from
+-- schedule churn: in-app edits delete-and-recreate job_schedule rows (and
+-- remove-day deletes one), and none of those are declines, so a surviving
+-- parent job suppresses the event. Only the decline's job hard-delete (or a
+-- soft-deleted job) reaches the insert. client_id stays null; Phase A
+-- resolves it from the same job's job_deleted snapshot event (written in
+-- the same transaction, so it always exists by fan-out time).
+create or replace function "public"."capture_automation_booking_declined_delete"()
+returns trigger
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+begin
+    if exists (
+        select 1 from job
+        where id = OLD.job_id and coalesce(is_deleted, false) = false
+    ) then
+        return null;  -- schedule edit churn: parent job still live, not a decline
+    end if;
+    insert into automation_event (company_id, event_type, job_id, schedule_id, payload)
+    values (OLD.company_id, 'booking_declined', OLD.job_id, OLD.id, to_jsonb(OLD));
+    return null;
+end;
+$$;
+
+create or replace trigger "automation_booking_declined_d" after delete on "public"."job_schedule"
+    for each row when (old.status = 'Pending Confirmation')
+    execute function "public"."capture_automation_booking_declined_delete"();
+
+-- ============================================================
+-- estimate: document-status lifecycle
+-- ============================================================
+
+-- WHEN (old IS DISTINCT FROM new) absorbs mobile EstimateEntry's known
+-- double-Sent write (the second write is a same-value no-op); the run
+-- dedupe key est*:{estimate_id} is the backstop.
+create or replace function "public"."capture_automation_estimate_status"()
+returns trigger
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+begin
+    if NEW.status = 'Sent' then
+        insert into automation_event (company_id, event_type, estimate_id, client_id)
+        values (NEW.company_id, 'estimate_sent', NEW.id, NEW.client_id);
+    elsif NEW.status = 'Approved' then
+        insert into automation_event (company_id, event_type, estimate_id, client_id)
+        values (NEW.company_id, 'estimate_approved', NEW.id, NEW.client_id);
+    elsif NEW.status = 'Declined' then
+        insert into automation_event (company_id, event_type, estimate_id, client_id)
+        values (NEW.company_id, 'estimate_declined', NEW.id, NEW.client_id);
+    end if;
+    return null;
+end;
+$$;
+
+create or replace trigger "automation_estimate_status_u" after update on "public"."estimate"
+    for each row when (old.status is distinct from new.status)
+    execute function "public"."capture_automation_estimate_status"();
+
+create or replace trigger "automation_estimate_status_i" after insert on "public"."estimate"
+    for each row when (new.status in ('Sent', 'Approved', 'Declined'))
+    execute function "public"."capture_automation_estimate_status"();
+
+-- ============================================================
+-- client: lead created
+-- ============================================================
+
+-- Imports and backfills never fire lead automations (locked decision):
+-- suppressed right here in the WHEN clause via client.created_via, the one
+-- chokepoint that covers browser-side supabase-js imports, seeds, and any
+-- future backfill that remembers to stamp the column.
+create or replace function "public"."capture_automation_lead_created"()
+returns trigger
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+begin
+    insert into automation_event (company_id, event_type, client_id)
+    values (NEW.company_id, 'lead_created', NEW.id);
+    return null;
+end;
+$$;
+
+create or replace trigger "automation_lead_created" after insert on "public"."client"
+    for each row when (new.client_or_lead = 'lead'
+                       and coalesce(new.created_via, '') <> 'import')
+    execute function "public"."capture_automation_lead_created"();