autopilot-core-sandbox 0.0.1

package/dist/dist/migrations/20260817221709_trash_functions.sql

@@ -0,0 +1,434 @@
+-- The three trash operations, shared by web, mobile, and the public API.
+-- security definer for two reasons (house precedent: sign_contract):
+--   1. Atomicity — a client delete stamps up to 6 tables plus the ledger;
+--      the old provider path was N sequential PostgREST statements that
+--      could strand state halfway.
+--   2. Ledger integrity — authenticated has no write grants on deletion
+--      (20260817221707_deletion_rls.sql), so trash entries can only be
+--      created/removed together with their fan-out.
+--
+-- Fan-out stamps ONLY rows whose deleted_at is null, which is the invariant
+-- that makes restore exact: restoring a deletion revives precisely the rows
+-- that delete hid, never rows the user had trashed earlier on their own.
+--
+-- Callers: authenticated (web/mobile via PostgREST rpc) must match the
+-- autopilot_company_id JWT claim against the entity's company; service_role
+-- (public API v1 routes, which run with the admin client and carry no
+-- company claim) is trusted to have scoped the entity itself, matching how
+-- those routes already guard every other table access.
+
+-- helper used by all three functions; not exposed via the API
+create or replace function "public"."trash_assert_company"(p_company uuid)
+returns void
+language "plpgsql"
+as $$
+declare
+    v_claim uuid := (nullif(trim(both '"' from ("public"."get_my_claim"('autopilot_company_id'))::text), ''))::uuid;
+begin
+    if auth.role() is distinct from 'service_role' then
+        if v_claim is null or v_claim is distinct from p_company then
+            raise exception 'company mismatch';
+        end if;
+    end if;
+end;
+$$;
+
+revoke all on function "public"."trash_assert_company"(uuid) from "anon";
+revoke all on function "public"."trash_assert_company"(uuid) from "authenticated";
+revoke all on function "public"."trash_assert_company"(uuid) from public;
+
+-- MARK: trash_delete_entity
+create or replace function "public"."trash_delete_entity"(
+    "p_entity_type" text,
+    "p_entity_id" uuid,
+    "p_mode" text default null
+) returns uuid
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+declare
+    v_now timestamptz := now();
+    v_company uuid;
+    v_deleted timestamptz;
+    v_deletion_id uuid;
+    v_display jsonb;
+    v_client_name text;
+    v_amount numeric;
+    v_recurring uuid;
+    v_cutoff timestamptz;
+    v_sibling_ids uuid[] := '{}';
+begin
+    if p_entity_type not in ('client', 'job', 'estimate', 'invoice', 'event', 'payment', 'item', 'category') then
+        raise exception 'unknown entity type %', p_entity_type;
+    end if;
+    if p_mode is not null and (p_mode <> 'this_and_future' or p_entity_type <> 'job') then
+        raise exception 'invalid mode % for %', p_mode, p_entity_type;
+    end if;
+
+    -- lock the root row and read company/liveness in one per-type branch
+    case p_entity_type
+        when 'client' then
+            select company_id, deleted_at into v_company, v_deleted
+                from client where id = p_entity_id for update;
+        when 'job' then
+            select company_id, deleted_at, job_recurring_id into v_company, v_deleted, v_recurring
+                from job where id = p_entity_id for update;
+        when 'estimate' then
+            select company_id, deleted_at into v_company, v_deleted
+                from estimate where id = p_entity_id for update;
+        when 'invoice' then
+            select company_id, deleted_at into v_company, v_deleted
+                from invoice where id = p_entity_id for update;
+        when 'event' then
+            select company_id, deleted_at into v_company, v_deleted
+                from event where id = p_entity_id for update;
+        when 'payment' then
+            select company_id, deleted_at into v_company, v_deleted
+                from payment where id = p_entity_id for update;
+        when 'item' then
+            select company_id, deleted_at into v_company, v_deleted
+                from item where id = p_entity_id for update;
+        when 'category' then
+            select company_id, deleted_at into v_company, v_deleted
+                from category where id = p_entity_id for update;
+    end case;
+
+    if v_company is null then
+        raise exception '% not found', p_entity_type;
+    end if;
+    perform trash_assert_company(v_company);
+
+    if v_deleted is not null then
+        -- already trashed: idempotent success when it has its own entry;
+        -- otherwise it is a fan-out member of another deletion
+        select id into v_deletion_id from deletion
+            where entity_type = p_entity_type and entity_id = p_entity_id;
+        if v_deletion_id is not null then
+            return v_deletion_id;
+        end if;
+        raise exception '% is already deleted as part of another deletion', p_entity_type;
+    end if;
+
+    -- ---- display snapshot (read while everything is still live) ----
+    case p_entity_type
+        when 'client' then
+            select coalesce(nullif(trim(concat(coalesce(first_name, ''), ' ', coalesce(last_name, ''))), ''), client_company_name, '')
+                into v_client_name from client where id = p_entity_id;
+            v_display := jsonb_build_object('name', v_client_name);
+        when 'job' then
+            select coalesce(nullif(trim(concat(coalesce(c.first_name, ''), ' ', coalesce(c.last_name, ''))), ''), c.client_company_name, '')
+                into v_client_name
+                from job j join client c on c.id = j.client_id where j.id = p_entity_id;
+            select jsonb_build_object(
+                    'job_number', j.job_number,
+                    'client_name', v_client_name,
+                    'start_date', (select min(js.start_time) from job_schedule js where js.job_id = j.id))
+                into v_display from job j where j.id = p_entity_id;
+        when 'estimate' then
+            select coalesce(nullif(trim(concat(coalesce(c.first_name, ''), ' ', coalesce(c.last_name, ''))), ''), c.client_company_name, '')
+                into v_client_name
+                from estimate e join client c on c.id = e.client_id where e.id = p_entity_id;
+            v_amount := coalesce((select sum(item_price * quantity) from estimate_item where estimate_id = p_entity_id), 0);
+            v_amount := v_amount - coalesce((select sum(case when discount_type = 'percentage'
+                        then v_amount * discount_amount / 100.0 else discount_amount end)
+                    from estimate_discount where estimate_id = p_entity_id), 0);
+            select jsonb_build_object(
+                    'estimate_number', e.estimate_number,
+                    'client_name', v_client_name,
+                    'amount', round(v_amount, 2))
+                into v_display from estimate e where e.id = p_entity_id;
+        when 'invoice' then
+            select coalesce(nullif(trim(concat(coalesce(c.first_name, ''), ' ', coalesce(c.last_name, ''))), ''), c.client_company_name, '')
+                into v_client_name
+                from invoice i join client c on c.id = i.client_id where i.id = p_entity_id;
+            v_amount := coalesce((select sum(item_price * quantity) from job_item where invoice_id = p_entity_id), 0);
+            v_amount := v_amount - coalesce((select sum(case when discount_type = 'percentage'
+                        then v_amount * discount_amount / 100.0 else discount_amount end)
+                    from job_discount where invoice_id = p_entity_id), 0);
+            select jsonb_build_object(
+                    'invoice_number', i.invoice_number,
+                    'client_name', v_client_name,
+                    'amount', round(v_amount, 2),
+                    'status', i.status)
+                into v_display from invoice i where i.id = p_entity_id;
+        when 'event' then
+            select jsonb_build_object('title', title, 'start_date', start_date)
+                into v_display from event where id = p_entity_id;
+        when 'payment' then
+            select jsonb_build_object(
+                    'amount_base', p.amount_base,
+                    'amount_tip', p.amount_tip,
+                    'payment_date', p.payment_date,
+                    'payment_type', p.payment_type,
+                    'invoice_number', (select invoice_number from invoice where id = p.invoice_id),
+                    'client_name', (select coalesce(nullif(trim(concat(coalesce(c.first_name, ''), ' ', coalesce(c.last_name, ''))), ''), c.client_company_name, '')
+                        from client c where c.id = coalesce(
+                            (select client_id from invoice where id = p.invoice_id),
+                            (select client_id from job where id = p.job_id))))
+                into v_display from payment p where p.id = p_entity_id;
+        when 'item' then
+            select jsonb_build_object('name', item_name, 'price', item_price)
+                into v_display from item where id = p_entity_id;
+        when 'category' then
+            select jsonb_build_object('name', name)
+                into v_display from category where id = p_entity_id;
+    end case;
+
+    -- this_and_future: siblings in the series with any visit strictly after
+    -- this job's earliest visit (SQL port of getFutureSchedules in
+    -- src/server-safe/helpers.ts). A schedule-less job (shouldn't exist)
+    -- degrades to a single-occurrence delete rather than failing.
+    if p_mode = 'this_and_future' and v_recurring is not null then
+        select min(start_time) into v_cutoff from job_schedule where job_id = p_entity_id;
+        if v_cutoff is not null then
+            select coalesce(array_agg(distinct j.id), '{}') into v_sibling_ids
+                from job j
+                join job_schedule js on js.job_id = j.id
+                where j.job_recurring_id = v_recurring
+                  and j.id <> p_entity_id
+                  and j.deleted_at is null
+                  and js.start_time > v_cutoff;
+        end if;
+        v_display := v_display || jsonb_build_object('occurrence_count', 1 + coalesce(array_length(v_sibling_ids, 1), 0));
+    end if;
+
+    -- deleted_by via an existence check: reinvite email-drift can leave an
+    -- auth uid with no public.user row, and attribution must never block a
+    -- delete. null for service_role (public API) callers.
+    insert into deletion (company_id, entity_type, entity_id, deleted_at, deleted_by, mode, display)
+        values (v_company, p_entity_type, p_entity_id, v_now,
+                (select id from "user" where id = auth.uid()),
+                case when p_mode = 'this_and_future' and v_recurring is not null then p_mode end,
+                v_display)
+        returning id into v_deletion_id;
+
+    -- ---- stamping ----
+    case p_entity_type
+        when 'client' then
+            update client set deleted_at = v_now, deletion_id = v_deletion_id, is_deleted = true
+                where id = p_entity_id;
+            update job set deleted_at = v_now, deletion_id = v_deletion_id, is_deleted = true
+                where client_id = p_entity_id and deleted_at is null;
+            update job_recurring set deleted_at = v_now, deletion_id = v_deletion_id, is_deleted = true
+                where client_id = p_entity_id and deleted_at is null;
+            update estimate set deleted_at = v_now, deletion_id = v_deletion_id, is_deleted = true
+                where client_id = p_entity_id and deleted_at is null;
+            update invoice set deleted_at = v_now, deletion_id = v_deletion_id, is_deleted = true
+                where client_id = p_entity_id and deleted_at is null;
+            update payment set deleted_at = v_now, deletion_id = v_deletion_id
+                where deleted_at is null
+                  and (job_id in (select id from job where deletion_id = v_deletion_id)
+                       or invoice_id in (select id from invoice where deletion_id = v_deletion_id));
+        when 'job' then
+            update job set deleted_at = v_now, deletion_id = v_deletion_id, is_deleted = true
+                where (id = p_entity_id or id = any(v_sibling_ids)) and deleted_at is null;
+            if p_mode = 'this_and_future' and v_recurring is not null then
+                update job_recurring set deleted_at = v_now, deletion_id = v_deletion_id, is_deleted = true
+                    where id = v_recurring and deleted_at is null;
+            end if;
+            update invoice set deleted_at = v_now, deletion_id = v_deletion_id, is_deleted = true
+                where deleted_at is null
+                  and job_id in (select id from job where deletion_id = v_deletion_id);
+            update payment set deleted_at = v_now, deletion_id = v_deletion_id
+                where deleted_at is null
+                  and (job_id in (select id from job where deletion_id = v_deletion_id)
+                       or invoice_id in (select id from invoice where deletion_id = v_deletion_id));
+        when 'estimate' then
+            update estimate set deleted_at = v_now, deletion_id = v_deletion_id, is_deleted = true
+                where id = p_entity_id;
+        when 'invoice' then
+            update invoice set deleted_at = v_now, deletion_id = v_deletion_id, is_deleted = true
+                where id = p_entity_id;
+            update payment set deleted_at = v_now, deletion_id = v_deletion_id
+                where invoice_id = p_entity_id and deleted_at is null;
+        when 'event' then
+            update event set deleted_at = v_now, deletion_id = v_deletion_id
+                where id = p_entity_id;
+        when 'payment' then
+            update payment set deleted_at = v_now, deletion_id = v_deletion_id
+                where id = p_entity_id;
+        when 'item' then
+            update item set deleted_at = v_now, deletion_id = v_deletion_id
+                where id = p_entity_id;
+        when 'category' then
+            -- items are NOT stamped and item.category_id stays set: hard
+            -- delete was SET NULL (items survive), so trashing must not
+            -- hide items, and the intact pointer makes restore exact.
+            -- Category list queries filter deleted_at, so trashed
+            -- categories render as "Uncategorized" naturally.
+            update category set deleted_at = v_now, deletion_id = v_deletion_id
+                where id = p_entity_id;
+    end case;
+
+    return v_deletion_id;
+end;
+$$;
+
+-- MARK: trash_restore
+create or replace function "public"."trash_restore"("p_deletion_id" uuid)
+returns void
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+declare
+    v_entry record;
+    v_parent_type text;
+    v_parent_id uuid;
+begin
+    select * into v_entry from deletion where id = p_deletion_id for update;
+    if v_entry.id is null then
+        raise exception 'trash entry not found';
+    end if;
+    perform trash_assert_company(v_entry.company_id);
+
+    -- Block restoring into a trashed parent: the row would be invisible
+    -- (hidden by the parent's deleted_at) yet no longer restorable. UIs
+    -- parse this errcode + message to offer "restore the parent too".
+    case v_entry.entity_type
+        when 'job' then
+            select 'client', c.id into v_parent_type, v_parent_id
+                from job j join client c on c.id = j.client_id
+                where j.id = v_entry.entity_id and c.deleted_at is not null;
+        when 'estimate' then
+            select 'client', c.id into v_parent_type, v_parent_id
+                from estimate e join client c on c.id = e.client_id
+                where e.id = v_entry.entity_id and c.deleted_at is not null;
+        when 'invoice' then
+            select 'client', c.id into v_parent_type, v_parent_id
+                from invoice i join client c on c.id = i.client_id
+                where i.id = v_entry.entity_id and c.deleted_at is not null;
+        when 'payment' then
+            select 'invoice', i.id into v_parent_type, v_parent_id
+                from payment p join invoice i on i.id = p.invoice_id
+                where p.id = v_entry.entity_id and i.deleted_at is not null;
+            if v_parent_type is null then
+                select 'job', j.id into v_parent_type, v_parent_id
+                    from payment p join job j on j.id = p.job_id
+                    where p.id = v_entry.entity_id and j.deleted_at is not null;
+            end if;
+        else
+            null;  -- client, event, item, category: no trashable parent
+    end case;
+
+    if v_parent_type is not null then
+        raise exception 'restore blocked: % % is in the trash', v_parent_type, v_parent_id
+            using errcode = '23514';
+    end if;
+
+    update client set deleted_at = null, deletion_id = null, is_deleted = false
+        where deletion_id = p_deletion_id;
+    update job set deleted_at = null, deletion_id = null, is_deleted = false
+        where deletion_id = p_deletion_id;
+    update job_recurring set deleted_at = null, deletion_id = null, is_deleted = false
+        where deletion_id = p_deletion_id;
+    update estimate set deleted_at = null, deletion_id = null, is_deleted = false
+        where deletion_id = p_deletion_id;
+    update invoice set deleted_at = null, deletion_id = null, is_deleted = false
+        where deletion_id = p_deletion_id;
+    update event set deleted_at = null, deletion_id = null
+        where deletion_id = p_deletion_id;
+    update payment set deleted_at = null, deletion_id = null
+        where deletion_id = p_deletion_id;
+    update item set deleted_at = null, deletion_id = null
+        where deletion_id = p_deletion_id;
+    update category set deleted_at = null, deletion_id = null
+        where deletion_id = p_deletion_id;
+
+    delete from deletion where id = p_deletion_id;
+end;
+$$;
+
+-- MARK: trash_purge
+-- Permanently deletes every member of a trash entry. Existing CASCADEs
+-- clean the child tables (schedules, line items, addresses, messages, ...),
+-- exactly as a hard delete does today — including the pre-existing
+-- job_item.job_id/invoice_id ON DELETE SET NULL orphaning, deliberately
+-- carried forward unchanged. Returns the member (entity_type, entity_id)
+-- pairs so the caller can wipe the matching storage folders afterward
+-- (storage cleanup moved from delete-time to purge-time; an orphaned
+-- folder on a crashed caller is tolerated, matching sign_contract's
+-- orphaned-PNG stance).
+create or replace function "public"."trash_purge"("p_deletion_id" uuid)
+returns table ("entity_type" text, "entity_id" uuid)
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+declare
+    v_entry record;
+begin
+    select * into v_entry from deletion where id = p_deletion_id for update;
+    if v_entry.id is null then
+        raise exception 'trash entry not found';
+    end if;
+    perform trash_assert_company(v_entry.company_id);
+
+    -- Suppress delete-observing triggers that already fired their events at
+    -- soft-delete time (booking-decline capture on job_schedule cascades;
+    -- see 20260817221711_automation_soft_delete_events.sql). Transaction-
+    -- local, so it cannot leak past this purge.
+    perform set_config('autopilot.trash_purging', 'true', true);
+
+    return query
+        select 'client'::text, id from client where deletion_id = p_deletion_id
+        union all select 'job', id from job where deletion_id = p_deletion_id
+        union all select 'job_recurring', id from job_recurring where deletion_id = p_deletion_id
+        union all select 'estimate', id from estimate where deletion_id = p_deletion_id
+        union all select 'invoice', id from invoice where deletion_id = p_deletion_id
+        union all select 'event', id from event where deletion_id = p_deletion_id
+        union all select 'payment', id from payment where deletion_id = p_deletion_id
+        union all select 'item', id from item where deletion_id = p_deletion_id
+        union all select 'category', id from category where deletion_id = p_deletion_id;
+
+    -- FK-safe order: leaves before their parents
+    delete from payment where deletion_id = p_deletion_id;
+    delete from invoice where deletion_id = p_deletion_id;
+    delete from job where deletion_id = p_deletion_id;
+    delete from job_recurring where deletion_id = p_deletion_id;
+    delete from estimate where deletion_id = p_deletion_id;
+    -- event-only addresses (client_id is null) ride along, matching the old
+    -- delete-event-then-address cleanup; client addresses are never touched
+    -- (a purged client's addresses go via the client CASCADE below)
+    delete from address
+        where client_id is null
+          and id in (select address_id from event where deletion_id = p_deletion_id);
+    delete from event where deletion_id = p_deletion_id;
+    delete from item where deletion_id = p_deletion_id;
+    delete from category where deletion_id = p_deletion_id;
+    delete from client where deletion_id = p_deletion_id;
+
+    delete from deletion where id = p_deletion_id;
+
+    -- Ghost sweep: purging a client CASCADE-removes children that were
+    -- separately trashed earlier (they carry their own ledger entries, not
+    -- this one). Those entries now point at nothing — drop them so the
+    -- trash page never lists unrestorable ghosts.
+    delete from deletion d
+        where d.company_id = v_entry.company_id
+          and case d.entity_type
+              when 'client' then not exists (select 1 from client where id = d.entity_id)
+              when 'job' then not exists (select 1 from job where id = d.entity_id)
+              when 'estimate' then not exists (select 1 from estimate where id = d.entity_id)
+              when 'invoice' then not exists (select 1 from invoice where id = d.entity_id)
+              when 'event' then not exists (select 1 from event where id = d.entity_id)
+              when 'payment' then not exists (select 1 from payment where id = d.entity_id)
+              when 'item' then not exists (select 1 from item where id = d.entity_id)
+              when 'category' then not exists (select 1 from category where id = d.entity_id)
+          end;
+end;
+$$;
+
+revoke all on function "public"."trash_delete_entity"(text, uuid, text) from "anon";
+revoke all on function "public"."trash_restore"(uuid) from "anon";
+revoke all on function "public"."trash_purge"(uuid) from "anon";
+revoke all on function "public"."trash_delete_entity"(text, uuid, text) from public;
+revoke all on function "public"."trash_restore"(uuid) from public;
+revoke all on function "public"."trash_purge"(uuid) from public;
+grant execute on function "public"."trash_delete_entity"(text, uuid, text) to "authenticated";
+grant execute on function "public"."trash_restore"(uuid) to "authenticated";
+grant execute on function "public"."trash_purge"(uuid) to "authenticated";
+grant execute on function "public"."trash_delete_entity"(text, uuid, text) to "service_role";
+grant execute on function "public"."trash_restore"(uuid) to "service_role";
+grant execute on function "public"."trash_purge"(uuid) to "service_role";

package/dist/dist/migrations/20260817221710_outbound_event_soft_delete.sql

@@ -0,0 +1,55 @@
+-- Teach the outbox about soft deletion (see 20260817221708/09). Deletes
+-- stop being row deletions for the 5 parent entities, so the "<entity>
+-- .deleted fires from AFTER DELETE" contract from 20260719215143 moves to
+-- the deleted_at transition:
+--
+--   live -> trashed   emits <t>.deleted with to_jsonb(OLD) — the same
+--                     pre-delete snapshot external consumers (Zapier,
+--                     QuickBooks orphan-reconcile, Google Calendar sync)
+--                     got from hard deletes, so they need no changes.
+--   trashed -> live   (restore) emits <t>.created: the worker re-reads the
+--                     live row, and for a consumer that processed .deleted,
+--                     re-creation is the semantically correct signal. No
+--                     constraint change needed — the event_type check
+--                     already allows every <entity>.created.
+--   trashed -> trashed edits emit nothing (no spam for invisible rows).
+--   AFTER DELETE      still emits <t>.deleted, but only for live rows:
+--                     residual hard-delete paths (old app builds, direct
+--                     SQL) keep working, while purging a trashed row stays
+--                     silent — its .deleted already went out at soft-delete
+--                     time.
+--
+-- Triggers are unchanged; this only replaces the function body. All five
+-- attached tables (client, job, invoice, estimate, event) have deleted_at
+-- as of 20260817221708.
+
+create or replace function "public"."enqueue_parent_event"()
+returns trigger
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+begin
+    if TG_OP = 'INSERT' then
+        insert into outbound_event (company_id, entity_type, entity_id, event_type, op, source_table)
+        values (NEW.company_id, TG_TABLE_NAME, NEW.id, TG_TABLE_NAME || '.created', TG_OP, TG_TABLE_NAME);
+    elsif TG_OP = 'UPDATE' then
+        if OLD.deleted_at is null and NEW.deleted_at is not null then
+            insert into outbound_event (company_id, entity_type, entity_id, event_type, op, source_table, snapshot)
+            values (NEW.company_id, TG_TABLE_NAME, NEW.id, TG_TABLE_NAME || '.deleted', TG_OP, TG_TABLE_NAME, to_jsonb(OLD));
+        elsif OLD.deleted_at is not null and NEW.deleted_at is null then
+            insert into outbound_event (company_id, entity_type, entity_id, event_type, op, source_table)
+            values (NEW.company_id, TG_TABLE_NAME, NEW.id, TG_TABLE_NAME || '.created', TG_OP, TG_TABLE_NAME);
+        elsif NEW.deleted_at is null then
+            insert into outbound_event (company_id, entity_type, entity_id, event_type, op, source_table)
+            values (NEW.company_id, TG_TABLE_NAME, NEW.id, TG_TABLE_NAME || '.updated', TG_OP, TG_TABLE_NAME);
+        end if;
+    else
+        if OLD.deleted_at is null then
+            insert into outbound_event (company_id, entity_type, entity_id, event_type, op, source_table, snapshot)
+            values (OLD.company_id, TG_TABLE_NAME, OLD.id, TG_TABLE_NAME || '.deleted', TG_OP, TG_TABLE_NAME, to_jsonb(OLD));
+        end if;
+    end if;
+    return null;
+end;
+$$;

package/dist/dist/migrations/20260817221711_automation_soft_delete_events.sql

@@ -0,0 +1,77 @@
+-- Automation captures for soft deletion (companion to 20260817221710).
+--
+-- Three concerns:
+--   1. job_deleted must fire when a job is soft-deleted (deleted_at
+--      transition), since the row no longer disappears.
+--   2. The web booking-decline path used to hard-delete the job, whose
+--      CASCADE deleted its Pending Confirmation schedules and fired
+--      booking_declined from the schedule AFTER DELETE. Under soft delete
+--      the schedules survive untouched, so that trigger never fires — the
+--      soft-delete capture emits booking_declined for the job's pending
+--      schedules itself.
+--   3. Purge (trash_purge) must not re-fire either event: job_deleted and
+--      booking_declined already went out at soft-delete time. The job
+--      trigger is guarded by WHEN (old.deleted_at is null); the schedule
+--      cascade capture can't see its (already-deleted) parent job, so it
+--      checks the transaction-local flag trash_purge sets.
+
+create or replace function "public"."capture_automation_job_soft_delete"()
+returns trigger
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+begin
+    insert into automation_event (company_id, event_type, job_id, client_id, payload)
+    values (NEW.company_id, 'job_deleted', NEW.id, NEW.client_id, to_jsonb(OLD));
+
+    -- decline detection (concern 2): payload mirrors what the schedule
+    -- AFTER DELETE capture would have recorded
+    insert into automation_event (company_id, event_type, job_id, schedule_id, payload)
+    select NEW.company_id, 'booking_declined', NEW.id, js.id, to_jsonb(js)
+    from job_schedule js
+    where js.job_id = NEW.id and js.status = 'Pending Confirmation';
+
+    return null;
+end;
+$$;
+
+create or replace trigger "automation_job_soft_deleted" after update on "public"."job"
+    for each row when (old.deleted_at is null and new.deleted_at is not null)
+    execute function "public"."capture_automation_job_soft_delete"();
+
+-- hard-delete capture now fires only for live rows (concern 3);
+-- create or replace cannot change a WHEN clause, so drop + recreate
+drop trigger "automation_job_deleted" on "public"."job";
+create trigger "automation_job_deleted" after delete on "public"."job"
+    for each row when (old.deleted_at is null)
+    execute function "public"."capture_automation_job_delete"();
+
+-- Redefine the decline-on-schedule-delete capture (from
+-- 20260816160303_automation_event_triggers.sql): add the purge suppression
+-- and treat a soft-deleted parent job as deleted (it already was via
+-- coalesce(is_deleted...) thanks to dual-write; deleted_at is the
+-- authoritative check going forward).
+create or replace function "public"."capture_automation_booking_declined_delete"()
+returns trigger
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+begin
+    if current_setting('autopilot.trash_purging', true) = 'true' then
+        return null;  -- purge of a trashed job: booking_declined already fired at soft-delete time
+    end if;
+    if exists (
+        select 1 from job
+        where id = OLD.job_id
+          and coalesce(is_deleted, false) = false
+          and deleted_at is null
+    ) then
+        return null;  -- schedule edit churn: parent job still live, not a decline
+    end if;
+    insert into automation_event (company_id, event_type, job_id, schedule_id, payload)
+    values (OLD.company_id, 'booking_declined', OLD.job_id, OLD.id, to_jsonb(OLD));
+    return null;
+end;
+$$;

package/dist/dist/migrations/20260817221712_fix_estimate_address_cascade.sql

@@ -0,0 +1,14 @@
+-- estimate.address_id was the only address FK with ON DELETE CASCADE
+-- (job/invoice/event/job_recurring all use SET NULL), so deleting an
+-- address silently destroyed every estimate attached to it. Align it with
+-- the rest: the estimate survives and just loses the address pointer.
+-- Independent of the soft-delete work; shipped alongside because the trash
+-- feature makes the anomaly load-bearing (a purged client's address
+-- CASCADE must not take out estimates that were never in that trash entry
+-- — impossible in practice since a client's estimates are stamped with it,
+-- but the constraint was wrong regardless).
+
+alter table "public"."estimate" drop constraint "estimate_address_id_fkey";
+alter table "public"."estimate"
+    add constraint "estimate_address_id_fkey"
+    foreign key ("address_id") references "public"."address"("id") on delete set null;

package/dist/dist/migrations/20260817232630_trash_batch_function.sql

@@ -0,0 +1,67 @@
+-- Atomic bulk soft delete. The provider bulk deletes (deleteClients,
+-- deleteJobs, deleteInvoices, deleteEstimates) used to be a single
+-- .delete().in('id', ...) statement; looping trash_delete_entity from the
+-- client would instead commit an arbitrary prefix of the batch when a later
+-- call fails. One RPC = one transaction restores all-or-nothing semantics
+-- while still creating one ledger entry per entity, so each record remains
+-- individually restorable from the Recently Deleted page.
+--
+-- Company scoping, liveness checks, fan-out, and idempotency all come from
+-- trash_delete_entity (same-transaction function call); any raise rolls the
+-- whole batch back. p_mode is intentionally not exposed: recurring
+-- this_and_future deletes are single-job operations.
+
+create or replace function "public"."trash_delete_entities"(
+    "p_entity_type" text,
+    "p_entity_ids" uuid[]
+) returns uuid[]
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+declare
+    v_deletion_ids uuid[] := '{}';
+    v_entity_id uuid;
+begin
+    foreach v_entity_id in array p_entity_ids loop
+        v_deletion_ids := v_deletion_ids
+            || trash_delete_entity(p_entity_type, v_entity_id);
+    end loop;
+    return v_deletion_ids;
+end;
+$$;
+
+revoke all on function "public"."trash_delete_entities"(text, uuid[]) from "anon";
+revoke all on function "public"."trash_delete_entities"(text, uuid[]) from public;
+grant execute on function "public"."trash_delete_entities"(text, uuid[]) to "authenticated";
+grant execute on function "public"."trash_delete_entities"(text, uuid[]) to "service_role";
+
+-- Atomic multi-entry restore, the mirror image of trash_delete_entities.
+-- Exists for the "Restore both" flow: restoring a record whose parent is
+-- also trashed takes two ledger entries, and two sequential RPCs could
+-- leave the parent restored while the child stayed in the trash. One RPC =
+-- one transaction: either every entry restores or none do.
+--
+-- Order matters and is the caller's job: parents before children, because
+-- trash_restore's parent-liveness guard runs per entry (within this same
+-- transaction, so a just-restored parent satisfies its child's check).
+create or replace function "public"."trash_restore_entries"(
+    "p_deletion_ids" uuid[]
+) returns void
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+declare
+    v_deletion_id uuid;
+begin
+    foreach v_deletion_id in array p_deletion_ids loop
+        perform trash_restore(v_deletion_id);
+    end loop;
+end;
+$$;
+
+revoke all on function "public"."trash_restore_entries"(uuid[]) from "anon";
+revoke all on function "public"."trash_restore_entries"(uuid[]) from public;
+grant execute on function "public"."trash_restore_entries"(uuid[]) to "authenticated";
+grant execute on function "public"."trash_restore_entries"(uuid[]) to "service_role";