autopilot-core-sandbox 0.0.1

package/dist/dist/migrations/20260816160304_automation_retention.sql

@@ -0,0 +1,142 @@
+-- Extend cleanup_webhook_outbox (20260731011421) to also purge the
+-- automations engine's tables on the same nightly sweep. Same signature and
+-- behavior as before, plus two result columns.
+--
+-- Windows (hardcoded like the qb/gcal arms):
+--   * automation_event: processed rows older than 90 days (matches the
+--     outbox event window's spirit; unprocessed rows are never touched).
+--   * automation_run: terminal rows older than 400 days. Long on purpose —
+--     these rows ARE the user-visible per-rule run history. The window is a
+--     product decision; shorten it here if history this long proves
+--     unnecessary. Pending/processing rows are never touched.
+
+drop function if exists "public"."cleanup_webhook_outbox"(integer, integer, integer);
+
+create or replace function "public"."cleanup_webhook_outbox"(
+    "event_retention_days" integer,
+    "delivery_retention_days" integer,
+    "batch_size" integer
+)
+returns table (
+    "deliveries_deleted" integer,
+    "events_deleted" integer,
+    "qb_tasks_deleted" integer,
+    "gcal_tasks_deleted" integer,
+    "automation_events_deleted" integer,
+    "automation_runs_deleted" integer
+)
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+declare
+  -- floor of 7 days: a miscalled 0 must never purge fresh history
+  event_cutoff timestamptz :=
+    now() - make_interval(days => greatest(event_retention_days, 7));
+  delivery_cutoff timestamptz :=
+    now() - make_interval(days => greatest(delivery_retention_days, 7));
+  automation_event_cutoff timestamptz := now() - make_interval(days => 90);
+  automation_run_cutoff timestamptz := now() - make_interval(days => 400);
+  -- floor of 1: a caller-supplied 0 would otherwise LIMIT 0 into a silent
+  -- no-op, and a negative value is a runtime error
+  capped_batch integer := least(greatest(batch_size, 1), 5000);
+  del_count integer;
+  evt_count integer;
+  qb_count integer;
+  gcal_count integer;
+  auto_evt_count integer;
+  auto_run_count integer;
+begin
+  -- Deleting an event cascades its deliveries regardless of delivery_cutoff,
+  -- so the event window must never be the shorter one.
+  if greatest(event_retention_days, 7) < greatest(delivery_retention_days, 7) then
+    raise exception 'event_retention_days (%) must be >= delivery_retention_days (%)',
+      event_retention_days, delivery_retention_days;
+  end if;
+
+  -- Terminal deliveries first, so the outbound_event cascade below touches
+  -- almost nothing and each statement's row count stays bounded.
+  delete from webhook_delivery
+  where id in (
+    select id from webhook_delivery
+    where status in ('delivered', 'skipped', 'dead')
+      and created_at < delivery_cutoff
+    order by created_at
+    limit capped_batch
+  );
+  get diagnostics del_count = row_count;
+
+  delete from outbound_event
+  where id in (
+    select id from outbound_event
+    where processed_at is not null
+      and created_at < event_cutoff
+      -- belt-and-suspenders: never cascade away a live delivery (retries
+      -- terminate ~1.6 days after creation, so this should match nothing)
+      and not exists (
+        select 1 from webhook_delivery d
+        where d.event_id = outbound_event.id
+          and d.status in ('pending', 'delivering')
+      )
+    order by created_at
+    limit capped_batch
+  );
+  get diagnostics evt_count = row_count;
+
+  -- Terminal QB sync tasks share the event window; pending/processing rows
+  -- are never touched.
+  delete from qb_sync_task
+  where id in (
+    select id from qb_sync_task
+    where status in ('done', 'skipped', 'dead')
+      and created_at < event_cutoff
+    order by created_at
+    limit capped_batch
+  );
+  get diagnostics qb_count = row_count;
+
+  -- Terminal Google Calendar sync tasks, same window; pending/processing
+  -- rows are never touched (tasks are self-contained, no FK to events).
+  delete from google_calendar_sync_task
+  where id in (
+    select id from google_calendar_sync_task
+    where status in ('done', 'skipped', 'dead')
+      and created_at < event_cutoff
+    order by created_at
+    limit capped_batch
+  );
+  get diagnostics gcal_count = row_count;
+
+  -- Processed automation events; unprocessed rows are never touched (the
+  -- automations cron owns them).
+  delete from automation_event
+  where id in (
+    select id from automation_event
+    where processed_at is not null
+      and created_at < automation_event_cutoff
+    order by created_at
+    limit capped_batch
+  );
+  get diagnostics auto_evt_count = row_count;
+
+  -- Terminal automation runs (= the visible run history) past the long
+  -- window; pending/processing rows are never touched.
+  delete from automation_run
+  where id in (
+    select id from automation_run
+    where status in ('sent', 'skipped', 'failed', 'dead')
+      and created_at < automation_run_cutoff
+    order by created_at
+    limit capped_batch
+  );
+  get diagnostics auto_run_count = row_count;
+
+  return query select del_count, evt_count, qb_count, gcal_count,
+                      auto_evt_count, auto_run_count;
+end;
+$$;
+
+revoke all on function "public"."cleanup_webhook_outbox"(integer, integer, integer) from public;
+revoke all on function "public"."cleanup_webhook_outbox"(integer, integer, integer) from "anon";
+revoke all on function "public"."cleanup_webhook_outbox"(integer, integer, integer) from "authenticated";
+grant execute on function "public"."cleanup_webhook_outbox"(integer, integer, integer) to "service_role";

package/dist/dist/migrations/20260816202404_add_automation_center_addon_key.sql

@@ -0,0 +1,26 @@
+-- New purchasable add-on: Automation Center (the automations rules engine).
+-- Mirrors the automation_center entry added to ADDON_KEYS in src/server-safe/
+-- entitlements.ts; the two lists must stay in sync. Included with Scale like
+-- every add-on (Scale resolves to FULL_ENTITLEMENTS and has no billing_addon
+-- rows); purchasable on Grow for $99/mo.
+alter table "public"."billing_addon"
+    drop constraint "billing_addon_addon_key_check";
+alter table "public"."billing_addon"
+    add constraint "billing_addon_addon_key_check"
+    check ("addon_key" in (
+        'ai_voice_assistant',
+        'dumpster_asset_tracking',
+        'marketing_tools',
+        'open_api',
+        'quickbooks',
+        'gps_tracking',
+        'client_portal',
+        'google_reserve',
+        'employee_permissions',
+        'google_ads',
+        'facebook_ads',
+        'bing_ads',
+        'google_calendar',
+        'estimate_proposals',
+        'automation_center'
+    ));

package/dist/dist/migrations/20260816225501_widen_automation_rule_trigger_action_checks.sql

@@ -0,0 +1,25 @@
+-- Automations P1: three new trigger types (job_rescheduled,
+-- invoice_due_relative, lead_converted) and two new action types
+-- (apply_tag, webhook). Mirrors AUTOMATION_TRIGGER_TYPES and
+-- AUTOMATION_ACTION_TYPES in src/server-safe/automations.ts; the lists
+-- must stay in sync.
+alter table "public"."automation_rule"
+    drop constraint "automation_rule_trigger_type_check";
+alter table "public"."automation_rule"
+    add constraint "automation_rule_trigger_type_check"
+    check ("trigger_type" in (
+        'job_created', 'job_status_changed', 'job_rescheduled',
+        'schedule_time_relative',
+        'rental_date_relative', 'rental_task_completed',
+        'estimate_sent', 'estimate_approved', 'estimate_declined',
+        'estimate_pending',
+        'invoice_due_relative',
+        'lead_created', 'lead_converted',
+        'booking_request_received', 'booking_confirmed', 'booking_declined'));
+
+alter table "public"."automation_rule"
+    drop constraint "automation_rule_action_type_check";
+alter table "public"."automation_rule"
+    add constraint "automation_rule_action_type_check"
+    check ("action_type" in (
+        'sms_client', 'email_client', 'notify_team', 'apply_tag', 'webhook'));

package/dist/dist/migrations/20260816225502_widen_automation_event_type_check.sql

@@ -0,0 +1,18 @@
+-- Automations P1: two new captured event types. job_rescheduled and
+-- lead_converted get DB capture triggers in the following migrations;
+-- invoice_due_relative is timer-scanned (Phase B) and emits no events.
+-- Mirrors AUTOMATION_EVENT_TYPES in src/server-safe/automations.ts.
+--
+-- Safe to apply in any order relative to the web deploy: the engine's
+-- fan-out only fetches event types it knows, so rows with types from a
+-- newer schema wait unprocessed instead of being swallowed.
+alter table "public"."automation_event"
+    drop constraint "automation_event_event_type_check";
+alter table "public"."automation_event"
+    add constraint "automation_event_event_type_check"
+    check ("event_type" in (
+        'job_created', 'job_deleted', 'job_status_changed', 'job_rescheduled',
+        'rental_task_completed',
+        'booking_request_received', 'booking_confirmed', 'booking_declined',
+        'estimate_sent', 'estimate_approved', 'estimate_declined',
+        'lead_created', 'lead_converted'));

package/dist/dist/migrations/20260816225503_add_invoice_id_to_automation_tables.sql

@@ -0,0 +1,18 @@
+-- Automations P1: the invoice_due_relative trigger anchors runs to
+-- invoices, so both automation tables gain an invoice ref. Like the other
+-- entity refs: deliberately NO foreign key — runs must survive invoice
+-- deletion (revalidation tolerates dangling ids).
+alter table "public"."automation_event"
+    add column if not exists "invoice_id" uuid;
+
+alter table "public"."automation_run"
+    add column if not exists "invoice_id" uuid;
+
+-- mirrors automation_event_job_idx / automation_run history lookups
+create index if not exists "automation_event_invoice_idx"
+    on "public"."automation_event" ("invoice_id", "event_type")
+    where "invoice_id" is not null;
+
+create index if not exists "automation_run_invoice_idx"
+    on "public"."automation_run" ("invoice_id")
+    where "invoice_id" is not null;

package/dist/dist/migrations/20260816225504_add_job_rescheduled_capture_trigger.sql

@@ -0,0 +1,51 @@
+-- Automations P1: job_rescheduled capture.
+--
+-- Both platforms reschedule by UPDATEing job_schedule.start_time in place
+-- (core JobsProvider.updateJobSchedule is the shared write path; web edit
+-- forms and mobile drag both call it with the existing schedule id), so an
+-- AFTER UPDATE trigger sees every real reschedule. Adding or removing a
+-- day is an INSERT/DELETE and deliberately does not fire — that is a
+-- schedule shape change, not a reschedule of an existing visit.
+--
+-- Guards:
+--   * task_type IS NULL: job visits only. Rental drop_off/pick_up rows are
+--     served by rental_date_relative, which re-anchors on its own scan.
+--   * status: no reschedule notices for visits the customer never
+--     confirmed (Pending Confirmation), canceled ones, or completed ones.
+--
+-- A recurring "this and future" edit propagates one UPDATE per future row,
+-- so one user action emits N events; the resched:{job_id}:{edit-date}
+-- dedupe key collapses them into a single run per rule.
+create or replace function "public"."capture_automation_schedule_time"()
+returns trigger
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+declare
+    v_client uuid;
+begin
+    if NEW.task_type is not null then
+        return null;
+    end if;
+    if NEW.status in ('Pending Confirmation', 'Canceled', 'Completed') then
+        return null;
+    end if;
+
+    select client_id into v_client from job where id = NEW.job_id;
+
+    insert into automation_event (company_id, event_type, job_id, schedule_id, client_id, payload)
+    values (NEW.company_id, 'job_rescheduled', NEW.job_id, NEW.id, v_client,
+            jsonb_build_object(
+                'old_start_time', OLD.start_time,
+                'new_start_time', NEW.start_time,
+                'any_time', NEW.any_time,
+                'status', NEW.status));
+    return null;
+end;
+$$;
+
+create or replace trigger "automation_schedule_time_u" after update on "public"."job_schedule"
+    for each row when (old.start_time is distinct from new.start_time
+                       or old.any_time is distinct from new.any_time)
+    execute function "public"."capture_automation_schedule_time"();

package/dist/dist/migrations/20260816225505_add_lead_converted_capture_trigger.sql

@@ -0,0 +1,26 @@
+-- Automations P1: lead_converted capture.
+--
+-- Conversion is a plain UPDATE client_or_lead 'lead' -> 'client' issued
+-- from many call sites (web job/estimate/invoice create hooks, the client
+-- form, mobile promoteLeadToClient, the public API PATCH); the DB trigger
+-- is the one chokepoint that sees them all. Exact-transition WHEN clause
+-- mirrors the long-standing update_date_became_client_trigger.
+--
+-- No created_via guard needed: imports insert rows with their final
+-- client_or_lead value, so an imported client never makes this transition.
+create or replace function "public"."capture_automation_lead_converted"()
+returns trigger
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+begin
+    insert into automation_event (company_id, event_type, client_id)
+    values (NEW.company_id, 'lead_converted', NEW.id);
+    return null;
+end;
+$$;
+
+create or replace trigger "automation_lead_converted" after update on "public"."client"
+    for each row when (old.client_or_lead = 'lead' and new.client_or_lead = 'client')
+    execute function "public"."capture_automation_lead_converted"();

package/dist/dist/migrations/20260816225506_fix_booking_request_import_guard.sql

@@ -0,0 +1,27 @@
+-- Automations P1 (P0 review cut-list): booking_request_received used to
+-- fire for bulk-imported jobs whose schedule rows carry the Pending
+-- Confirmation status — job_schedule has no provenance marker, but the
+-- parent job does. Replaces the P0 capture function body (from
+-- 20260816160303) adding the parent-job created_via guard; the trigger
+-- itself (automation_booking_received) is unchanged.
+create or replace function "public"."capture_automation_booking_received"()
+returns trigger
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+declare
+    v_client uuid;
+begin
+    if exists (
+        select 1 from job
+        where id = NEW.job_id and coalesce(created_via, '') = 'import'
+    ) then
+        return null;  -- imported historical booking, not a live request
+    end if;
+    select client_id into v_client from job where id = NEW.job_id;
+    insert into automation_event (company_id, event_type, job_id, schedule_id, client_id)
+    values (NEW.company_id, 'booking_request_received', NEW.job_id, NEW.id, v_client);
+    return null;
+end;
+$$;

package/dist/dist/migrations/20260816225507_widen_outbound_event_for_automation.sql

@@ -0,0 +1,38 @@
+-- Automations P1: the webhook action delivers through the existing
+-- outbound_event outbox (one webhook sender in the product) as a new
+-- 'automation.rule_fired' event type.
+--
+-- Unlike entity events, automation events carry their payload verbatim
+-- (the engine renders it at enqueue time; composePayload forwards it
+-- instead of re-reading an entity) and target a single user-configured
+-- endpoint (endpoint_id) rather than fanning out to every subscription of
+-- the event type. entity_id holds the automation_run id for traceability.
+--
+-- Entity webhooks keep the open_api entitlement gate; automation
+-- deliveries gate on automation_center instead (split in deliverBatch).
+-- NOTE: the live constraints come from 20260731011419 (which added the
+-- 'event' calendar entity), NOT the original 20260719215139 - 'event' must
+-- survive this rewrite or every calendar-block write starts failing inside
+-- its outbox trigger.
+alter table "public"."outbound_event"
+    drop constraint "outbound_event_entity_type_check";
+alter table "public"."outbound_event"
+    add constraint "outbound_event_entity_type_check"
+    check ("entity_type" in ('client', 'job', 'invoice', 'estimate', 'event', 'automation'));
+
+alter table "public"."outbound_event"
+    drop constraint "outbound_event_event_type_check";
+alter table "public"."outbound_event"
+    add constraint "outbound_event_event_type_check"
+    check ("event_type" ~ '^(client|job|invoice|estimate|event)\.(created|updated|deleted)$'
+           or "event_type" = 'automation.rule_fired');
+
+-- verbatim delivery body for automation events; null for entity events
+alter table "public"."outbound_event"
+    add column if not exists "payload" jsonb;
+
+-- routing target for automation events: the webhook endpoint (group of
+-- webhook_subscription rows sharing endpoint_id) chosen in the rule's
+-- action_config. null for entity events, which fan out by subscription.
+alter table "public"."outbound_event"
+    add column if not exists "endpoint_id" uuid;

package/dist/dist/migrations/20260817002626_add_user_last_login_platform_columns.sql

@@ -0,0 +1,14 @@
+-- Track which platform(s) each user actually uses.
+-- Adds per-platform "last opened the app" timestamps to public.user:
+--   - last_login_ios_at / last_login_android_at are stamped by the web API's
+--     /api/record-mobile-version route (called once per mobile app session,
+--     platform taken from the x-platform-info request header).
+--   - last_login_web_at is stamped client-side once per web page load.
+-- The user's current platform is derived at read time as the most recent
+-- non-null timestamp; no separate platform column is stored.
+-- Writes are covered by the existing self-CRUD RLS policy on public.user,
+-- so no policy changes are needed.
+
+alter table "public"."user" add column if not exists "last_login_ios_at" timestamptz;
+alter table "public"."user" add column if not exists "last_login_android_at" timestamptz;
+alter table "public"."user" add column if not exists "last_login_web_at" timestamptz;

package/dist/dist/migrations/20260817221703_create_deletion.sql

@@ -0,0 +1,34 @@
+-- Soft-delete ledger: one row = one user-visible "Recently Deleted" entry =
+-- one restore/purge unit. Deleting an entity stamps the entity row (and its
+-- fan-out members, e.g. a client's jobs/invoices) with deleted_at plus this
+-- row's id; the trash settings page is a single paginated select on this
+-- table, so no 8-way union across entity tables is ever needed.
+--
+-- display is a delete-time snapshot of what the trash row shows (name,
+-- number, client, amount, date). It is display-grade only — immune to later
+-- edits of child rows and never used as an authoritative total.
+--
+-- Rows whose deletion_id points here but whose entity has no own deletion
+-- row (fan-out members) intentionally do not appear in the trash: they
+-- restore and purge with their root. unique(entity_type, entity_id)
+-- prevents double-trash races; restore removes the row, so a later
+-- re-deletion inserts cleanly.
+
+create table "public"."deletion" (
+    "id" uuid primary key default gen_random_uuid(),
+    "company_id" uuid not null references "public"."company"("id") on delete cascade,
+    "entity_type" text not null check ("entity_type" in
+        ('client', 'job', 'estimate', 'invoice', 'event', 'payment', 'item', 'category')),
+    "entity_id" uuid not null,
+    "deleted_at" timestamp with time zone not null default now(),
+    "deleted_by" uuid references "public"."user"("id") on delete set null,
+    -- 'this_and_future' when a recurring-series delete rooted at a job also
+    -- trashed the future occurrences and the series template; null otherwise
+    "mode" text check ("mode" in ('this_and_future')),
+    "display" jsonb not null default '{}'::jsonb,
+    unique ("entity_type", "entity_id")
+);
+
+-- powers the trash page: newest deletions first, per company
+create index "deletion_company_deleted_at_idx"
+    on "public"."deletion" ("company_id", "deleted_at" desc);

package/dist/dist/migrations/20260817221707_deletion_rls.sql

@@ -0,0 +1,21 @@
+-- RLS for the deletion ledger (see 20260817221703_create_deletion.sql).
+--
+-- Read-only for authenticated company members: the trash page selects rows
+-- directly via PostgREST. All writes go through the security-definer trash
+-- functions (20260817221709_trash_functions.sql), so authenticated gets no
+-- insert/update/delete — a client cannot forge a trash entry or vanish one
+-- without going through the fan-out logic. Mirrors the outbound_event RLS
+-- shape (definer-function writers, locked table).
+
+alter table "public"."deletion" enable row level security;
+
+grant select on table "public"."deletion" to "authenticated";
+grant all on table "public"."deletion" to "service_role";
+revoke all on table "public"."deletion" from "anon";
+revoke insert, update, delete on table "public"."deletion" from "authenticated";
+
+create policy "Company members can view their trash"
+on "public"."deletion"
+for select
+to "authenticated"
+using (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"));

package/dist/dist/migrations/20260817221708_add_soft_delete_columns.sql

@@ -0,0 +1,82 @@
+-- Soft-delete columns for the 9 trash-scoped tables. deleted_at is the
+-- per-row liveness flag (null = live) so list queries can filter without a
+-- join; deletion_id groups every row hidden by one delete into its ledger
+-- entry (20260817221703_create_deletion.sql) for atomic restore/purge.
+--
+-- ON DELETE SET NULL on deletion_id is a backstop only: the trash functions
+-- always clear members before removing the ledger row, but a company
+-- CASCADE delete (or out-of-band ledger surgery) must not be blocked by
+-- these references.
+--
+-- The legacy is_deleted booleans on client/estimate/invoice/job (nullable)
+-- and job_recurring (not null) become write-only dual-write targets of the
+-- trash functions: deployed readers (portal, softphone, automations,
+-- Google Calendar visibility, recurring-jobs-cron, mobile schedule fetches)
+-- already filter them, so keeping them in sync makes soft deletes correct
+-- on old deploys with zero coupling. New code filters only deleted_at.
+-- address.is_deleted (a misnamed vestigial timestamptz) is intentionally
+-- untouched: addresses are not a trash entity — they hide behind their
+-- client and are cleaned up by CASCADE at purge time.
+--
+-- Child tables (job_schedule, job_item, estimate_item, address, client_job,
+-- tags, messages, ...) are deliberately NOT stamped: they are hidden by
+-- their parent's deleted_at and come back for free on restore.
+--
+-- No index on deleted_at: "deleted_at is null" matches ~all rows and rides
+-- the existing company_id-leading indexes as a residual filter. The partial
+-- deletion_id indexes power restore/purge ("where deletion_id = $1") at
+-- near-zero size since live rows are excluded.
+
+alter table "public"."client"
+    add column "deleted_at" timestamp with time zone,
+    add column "deletion_id" uuid references "public"."deletion"("id") on delete set null;
+create index "client_deletion_id_idx" on "public"."client" ("deletion_id")
+    where "deletion_id" is not null;
+
+alter table "public"."job"
+    add column "deleted_at" timestamp with time zone,
+    add column "deletion_id" uuid references "public"."deletion"("id") on delete set null;
+create index "job_deletion_id_idx" on "public"."job" ("deletion_id")
+    where "deletion_id" is not null;
+
+alter table "public"."job_recurring"
+    add column "deleted_at" timestamp with time zone,
+    add column "deletion_id" uuid references "public"."deletion"("id") on delete set null;
+create index "job_recurring_deletion_id_idx" on "public"."job_recurring" ("deletion_id")
+    where "deletion_id" is not null;
+
+alter table "public"."estimate"
+    add column "deleted_at" timestamp with time zone,
+    add column "deletion_id" uuid references "public"."deletion"("id") on delete set null;
+create index "estimate_deletion_id_idx" on "public"."estimate" ("deletion_id")
+    where "deletion_id" is not null;
+
+alter table "public"."invoice"
+    add column "deleted_at" timestamp with time zone,
+    add column "deletion_id" uuid references "public"."deletion"("id") on delete set null;
+create index "invoice_deletion_id_idx" on "public"."invoice" ("deletion_id")
+    where "deletion_id" is not null;
+
+alter table "public"."event"
+    add column "deleted_at" timestamp with time zone,
+    add column "deletion_id" uuid references "public"."deletion"("id") on delete set null;
+create index "event_deletion_id_idx" on "public"."event" ("deletion_id")
+    where "deletion_id" is not null;
+
+alter table "public"."payment"
+    add column "deleted_at" timestamp with time zone,
+    add column "deletion_id" uuid references "public"."deletion"("id") on delete set null;
+create index "payment_deletion_id_idx" on "public"."payment" ("deletion_id")
+    where "deletion_id" is not null;
+
+alter table "public"."item"
+    add column "deleted_at" timestamp with time zone,
+    add column "deletion_id" uuid references "public"."deletion"("id") on delete set null;
+create index "item_deletion_id_idx" on "public"."item" ("deletion_id")
+    where "deletion_id" is not null;
+
+alter table "public"."category"
+    add column "deleted_at" timestamp with time zone,
+    add column "deletion_id" uuid references "public"."deletion"("id") on delete set null;
+create index "category_deletion_id_idx" on "public"."category" ("deletion_id")
+    where "deletion_id" is not null;