autopilot-core-sandbox 0.0.1

package/dist/dist/migrations/20260819170204_create_email_spam_complaint.sql

@@ -0,0 +1,23 @@
+create table if not exists "public"."email_spam_complaint" (
+    "id" uuid default gen_random_uuid() not null,
+    "created_at" timestamp with time zone default now() not null,
+    "recipient_email" text not null,
+    "company_id" uuid
+);
+
+alter table only "public"."email_spam_complaint"
+    add constraint "email_spam_complaint_pkey" primary key ("id");
+
+alter table only "public"."email_spam_complaint"
+    add constraint "email_spam_complaint_recipient_email_key" unique ("recipient_email");
+
+-- Suppression lookups compare lowercased addresses; enforce the invariant at
+-- the database so a mixed-case insert can't silently bypass the unique
+-- constraint and the send-time filter.
+alter table only "public"."email_spam_complaint"
+    add constraint "email_spam_complaint_recipient_email_lower_check"
+    check (recipient_email = lower(recipient_email));
+
+alter table only "public"."email_spam_complaint"
+    add constraint "email_spam_complaint_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete set null;

package/dist/dist/migrations/20260819170205_add_email_spam_complaint_rls.sql

@@ -0,0 +1,5 @@
+alter table "public"."email_spam_complaint" enable row level security;
+
+create policy "Read-only for matching companyId" on "public"."email_spam_complaint"
+    for select to "authenticated"
+    using (((NULLIF(TRIM(BOTH '"' FROM ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"));

package/dist/dist/migrations/20260819170206_email_unsubscribed_upsert_constraints.sql

@@ -0,0 +1,14 @@
+-- email_unsubscribed has no unique constraint, so writers cannot upsert and
+-- the same recipient can be recorded any number of times. The table is empty
+-- in production (the insert path has been broken since launch), so tightening
+-- retroactively is safe: no dedupe or case cleanup is needed first.
+
+alter table only "public"."email_unsubscribed"
+    add constraint "email_unsubscribed_recipient_email_lower_check"
+    check (recipient_email = lower(recipient_email));
+
+-- NULLS NOT DISTINCT so rows whose sender could not be parsed to a company
+-- (company_id null) still dedupe on webhook retries.
+alter table only "public"."email_unsubscribed"
+    add constraint "email_unsubscribed_company_recipient_key"
+    unique nulls not distinct ("company_id", "recipient_email");

package/dist/dist/migrations/20260819180151_get_suppressed_emails_function.sql

@@ -0,0 +1,23 @@
+-- Single-round-trip suppression lookup for the email send paths. Callers pass
+-- the full candidate recipient list (already lowercased); returns the subset
+-- that is globally suppressed. Replaces client-side chunked `in` filters,
+-- which overflow PostgREST URL limits on large sequence/blast groups.
+create or replace function "public"."get_suppressed_emails"("emails" "text"[])
+returns table ("recipient_email" "text")
+language "sql" stable
+as $$
+    select recipient_email from public.email_hard_bounced
+        where recipient_email = any(emails)
+    union
+    select recipient_email from public.email_spam_complaint
+        where recipient_email = any(emails)
+$$;
+
+alter function "public"."get_suppressed_emails"("text"[]) owner to "postgres";
+
+-- service_role-only: the sole callers are server routes/crons via
+-- supabaseAdmin; no authenticated/anon path exists.
+revoke all on function "public"."get_suppressed_emails"("text"[]) from public;
+revoke all on function "public"."get_suppressed_emails"("text"[]) from "anon";
+revoke all on function "public"."get_suppressed_emails"("text"[]) from "authenticated";
+grant execute on function "public"."get_suppressed_emails"("text"[]) to "service_role";

package/dist/dist/migrations/20260819191143_is_deleted_backfill_guard.sql

@@ -0,0 +1,29 @@
+-- Invariant check before the legacy is_deleted flag is retired from the
+-- trash functions (next migration).
+--
+-- Nothing ever wrote is_deleted before the trash RPCs, and the RPCs always
+-- stamp deleted_at in the same statement, so a row with is_deleted = true
+-- and deleted_at null violates the trash invariant. Expected match count:
+-- zero. If this ever raises, a human triages the rows (restore, hard-delete,
+-- or stamp them into a deletion-ledger entry) — silently stamping deleted_at
+-- here would manufacture zombie rows hidden from every list yet absent from
+-- Recently Deleted and never auto-purged.
+
+do $$
+declare
+    v_table text;
+    v_count bigint;
+begin
+    foreach v_table in array array['client', 'job', 'job_recurring', 'estimate', 'invoice'] loop
+        execute format(
+            'select count(*) from %I where is_deleted = true and deleted_at is null',
+            v_table
+        ) into v_count;
+        if v_count > 0 then
+            raise exception
+                'legacy soft-deleted rows found in %: % row(s) have is_deleted = true with deleted_at null; triage before dropping is_deleted',
+                v_table, v_count;
+        end if;
+    end loop;
+end;
+$$;

package/dist/dist/migrations/20260819191144_trash_functions_no_dual_write.sql

@@ -0,0 +1,319 @@
+-- Stop the trash RPCs' legacy is_deleted dual-write. trash_delete_entity
+-- and trash_restore are restated verbatim from
+-- 20260817221709_trash_functions.sql with only the is_deleted assignments
+-- removed; deleted_at/deletion_id are the sole deletion markers.
+-- trash_assert_company, trash_purge, the batch functions, and all grants
+-- are unchanged and not restated.
+--
+-- NOTE for future readers (including AI agents): after this migration the
+-- is_deleted columns on client/job/job_recurring/estimate/invoice — and the
+-- misnamed timestamptz address.is_deleted — are DEAD. Always false/NULL,
+-- zero readers, zero writers, in any repo. They were added long ago and
+-- never used; they are deliberately left in the schema because dropping
+-- them requires app-deploy sequencing that isn't worth scheduling. Do not
+-- filter on them, write them, or build anything against them; deleted_at
+-- is the only deletion signal. Dropping them stays safe any time after a
+-- release in which no deployed bundle names the column.
+
+-- MARK: trash_delete_entity
+create or replace function "public"."trash_delete_entity"(
+    "p_entity_type" text,
+    "p_entity_id" uuid,
+    "p_mode" text default null
+) returns uuid
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+declare
+    v_now timestamptz := now();
+    v_company uuid;
+    v_deleted timestamptz;
+    v_deletion_id uuid;
+    v_display jsonb;
+    v_client_name text;
+    v_amount numeric;
+    v_recurring uuid;
+    v_cutoff timestamptz;
+    v_sibling_ids uuid[] := '{}';
+begin
+    if p_entity_type not in ('client', 'job', 'estimate', 'invoice', 'event', 'payment', 'item', 'category') then
+        raise exception 'unknown entity type %', p_entity_type;
+    end if;
+    if p_mode is not null and (p_mode <> 'this_and_future' or p_entity_type <> 'job') then
+        raise exception 'invalid mode % for %', p_mode, p_entity_type;
+    end if;
+
+    -- lock the root row and read company/liveness in one per-type branch
+    case p_entity_type
+        when 'client' then
+            select company_id, deleted_at into v_company, v_deleted
+                from client where id = p_entity_id for update;
+        when 'job' then
+            select company_id, deleted_at, job_recurring_id into v_company, v_deleted, v_recurring
+                from job where id = p_entity_id for update;
+        when 'estimate' then
+            select company_id, deleted_at into v_company, v_deleted
+                from estimate where id = p_entity_id for update;
+        when 'invoice' then
+            select company_id, deleted_at into v_company, v_deleted
+                from invoice where id = p_entity_id for update;
+        when 'event' then
+            select company_id, deleted_at into v_company, v_deleted
+                from event where id = p_entity_id for update;
+        when 'payment' then
+            select company_id, deleted_at into v_company, v_deleted
+                from payment where id = p_entity_id for update;
+        when 'item' then
+            select company_id, deleted_at into v_company, v_deleted
+                from item where id = p_entity_id for update;
+        when 'category' then
+            select company_id, deleted_at into v_company, v_deleted
+                from category where id = p_entity_id for update;
+    end case;
+
+    if v_company is null then
+        raise exception '% not found', p_entity_type;
+    end if;
+    perform trash_assert_company(v_company);
+
+    if v_deleted is not null then
+        -- already trashed: idempotent success when it has its own entry;
+        -- otherwise it is a fan-out member of another deletion
+        select id into v_deletion_id from deletion
+            where entity_type = p_entity_type and entity_id = p_entity_id;
+        if v_deletion_id is not null then
+            return v_deletion_id;
+        end if;
+        raise exception '% is already deleted as part of another deletion', p_entity_type;
+    end if;
+
+    -- ---- display snapshot (read while everything is still live) ----
+    case p_entity_type
+        when 'client' then
+            select coalesce(nullif(trim(concat(coalesce(first_name, ''), ' ', coalesce(last_name, ''))), ''), client_company_name, '')
+                into v_client_name from client where id = p_entity_id;
+            v_display := jsonb_build_object('name', v_client_name);
+        when 'job' then
+            select coalesce(nullif(trim(concat(coalesce(c.first_name, ''), ' ', coalesce(c.last_name, ''))), ''), c.client_company_name, '')
+                into v_client_name
+                from job j join client c on c.id = j.client_id where j.id = p_entity_id;
+            select jsonb_build_object(
+                    'job_number', j.job_number,
+                    'client_name', v_client_name,
+                    'start_date', (select min(js.start_time) from job_schedule js where js.job_id = j.id))
+                into v_display from job j where j.id = p_entity_id;
+        when 'estimate' then
+            select coalesce(nullif(trim(concat(coalesce(c.first_name, ''), ' ', coalesce(c.last_name, ''))), ''), c.client_company_name, '')
+                into v_client_name
+                from estimate e join client c on c.id = e.client_id where e.id = p_entity_id;
+            v_amount := coalesce((select sum(item_price * quantity) from estimate_item where estimate_id = p_entity_id), 0);
+            v_amount := v_amount - coalesce((select sum(case when discount_type = 'percentage'
+                        then v_amount * discount_amount / 100.0 else discount_amount end)
+                    from estimate_discount where estimate_id = p_entity_id), 0);
+            select jsonb_build_object(
+                    'estimate_number', e.estimate_number,
+                    'client_name', v_client_name,
+                    'amount', round(v_amount, 2))
+                into v_display from estimate e where e.id = p_entity_id;
+        when 'invoice' then
+            select coalesce(nullif(trim(concat(coalesce(c.first_name, ''), ' ', coalesce(c.last_name, ''))), ''), c.client_company_name, '')
+                into v_client_name
+                from invoice i join client c on c.id = i.client_id where i.id = p_entity_id;
+            v_amount := coalesce((select sum(item_price * quantity) from job_item where invoice_id = p_entity_id), 0);
+            v_amount := v_amount - coalesce((select sum(case when discount_type = 'percentage'
+                        then v_amount * discount_amount / 100.0 else discount_amount end)
+                    from job_discount where invoice_id = p_entity_id), 0);
+            select jsonb_build_object(
+                    'invoice_number', i.invoice_number,
+                    'client_name', v_client_name,
+                    'amount', round(v_amount, 2),
+                    'status', i.status)
+                into v_display from invoice i where i.id = p_entity_id;
+        when 'event' then
+            select jsonb_build_object('title', title, 'start_date', start_date)
+                into v_display from event where id = p_entity_id;
+        when 'payment' then
+            select jsonb_build_object(
+                    'amount_base', p.amount_base,
+                    'amount_tip', p.amount_tip,
+                    'payment_date', p.payment_date,
+                    'payment_type', p.payment_type,
+                    'invoice_number', (select invoice_number from invoice where id = p.invoice_id),
+                    'client_name', (select coalesce(nullif(trim(concat(coalesce(c.first_name, ''), ' ', coalesce(c.last_name, ''))), ''), c.client_company_name, '')
+                        from client c where c.id = coalesce(
+                            (select client_id from invoice where id = p.invoice_id),
+                            (select client_id from job where id = p.job_id))))
+                into v_display from payment p where p.id = p_entity_id;
+        when 'item' then
+            select jsonb_build_object('name', item_name, 'price', item_price)
+                into v_display from item where id = p_entity_id;
+        when 'category' then
+            select jsonb_build_object('name', name)
+                into v_display from category where id = p_entity_id;
+    end case;
+
+    -- this_and_future: siblings in the series with any visit strictly after
+    -- this job's earliest visit (SQL port of getFutureSchedules in
+    -- src/server-safe/helpers.ts). A schedule-less job (shouldn't exist)
+    -- degrades to a single-occurrence delete rather than failing.
+    if p_mode = 'this_and_future' and v_recurring is not null then
+        select min(start_time) into v_cutoff from job_schedule where job_id = p_entity_id;
+        if v_cutoff is not null then
+            select coalesce(array_agg(distinct j.id), '{}') into v_sibling_ids
+                from job j
+                join job_schedule js on js.job_id = j.id
+                where j.job_recurring_id = v_recurring
+                  and j.id <> p_entity_id
+                  and j.deleted_at is null
+                  and js.start_time > v_cutoff;
+        end if;
+        v_display := v_display || jsonb_build_object('occurrence_count', 1 + coalesce(array_length(v_sibling_ids, 1), 0));
+    end if;
+
+    -- deleted_by via an existence check: reinvite email-drift can leave an
+    -- auth uid with no public.user row, and attribution must never block a
+    -- delete. null for service_role (public API) callers.
+    insert into deletion (company_id, entity_type, entity_id, deleted_at, deleted_by, mode, display)
+        values (v_company, p_entity_type, p_entity_id, v_now,
+                (select id from "user" where id = auth.uid()),
+                case when p_mode = 'this_and_future' and v_recurring is not null then p_mode end,
+                v_display)
+        returning id into v_deletion_id;
+
+    -- ---- stamping ----
+    case p_entity_type
+        when 'client' then
+            update client set deleted_at = v_now, deletion_id = v_deletion_id
+                where id = p_entity_id;
+            update job set deleted_at = v_now, deletion_id = v_deletion_id
+                where client_id = p_entity_id and deleted_at is null;
+            update job_recurring set deleted_at = v_now, deletion_id = v_deletion_id
+                where client_id = p_entity_id and deleted_at is null;
+            update estimate set deleted_at = v_now, deletion_id = v_deletion_id
+                where client_id = p_entity_id and deleted_at is null;
+            update invoice set deleted_at = v_now, deletion_id = v_deletion_id
+                where client_id = p_entity_id and deleted_at is null;
+            update payment set deleted_at = v_now, deletion_id = v_deletion_id
+                where deleted_at is null
+                  and (job_id in (select id from job where deletion_id = v_deletion_id)
+                       or invoice_id in (select id from invoice where deletion_id = v_deletion_id));
+        when 'job' then
+            update job set deleted_at = v_now, deletion_id = v_deletion_id
+                where (id = p_entity_id or id = any(v_sibling_ids)) and deleted_at is null;
+            if p_mode = 'this_and_future' and v_recurring is not null then
+                update job_recurring set deleted_at = v_now, deletion_id = v_deletion_id
+                    where id = v_recurring and deleted_at is null;
+            end if;
+            update invoice set deleted_at = v_now, deletion_id = v_deletion_id
+                where deleted_at is null
+                  and job_id in (select id from job where deletion_id = v_deletion_id);
+            update payment set deleted_at = v_now, deletion_id = v_deletion_id
+                where deleted_at is null
+                  and (job_id in (select id from job where deletion_id = v_deletion_id)
+                       or invoice_id in (select id from invoice where deletion_id = v_deletion_id));
+        when 'estimate' then
+            update estimate set deleted_at = v_now, deletion_id = v_deletion_id
+                where id = p_entity_id;
+        when 'invoice' then
+            update invoice set deleted_at = v_now, deletion_id = v_deletion_id
+                where id = p_entity_id;
+            update payment set deleted_at = v_now, deletion_id = v_deletion_id
+                where invoice_id = p_entity_id and deleted_at is null;
+        when 'event' then
+            update event set deleted_at = v_now, deletion_id = v_deletion_id
+                where id = p_entity_id;
+        when 'payment' then
+            update payment set deleted_at = v_now, deletion_id = v_deletion_id
+                where id = p_entity_id;
+        when 'item' then
+            update item set deleted_at = v_now, deletion_id = v_deletion_id
+                where id = p_entity_id;
+        when 'category' then
+            -- items are NOT stamped and item.category_id stays set: hard
+            -- delete was SET NULL (items survive), so trashing must not
+            -- hide items, and the intact pointer makes restore exact.
+            -- Category list queries filter deleted_at, so trashed
+            -- categories render as "Uncategorized" naturally.
+            update category set deleted_at = v_now, deletion_id = v_deletion_id
+                where id = p_entity_id;
+    end case;
+
+    return v_deletion_id;
+end;
+$$;
+
+-- MARK: trash_restore
+create or replace function "public"."trash_restore"("p_deletion_id" uuid)
+returns void
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+declare
+    v_entry record;
+    v_parent_type text;
+    v_parent_id uuid;
+begin
+    select * into v_entry from deletion where id = p_deletion_id for update;
+    if v_entry.id is null then
+        raise exception 'trash entry not found';
+    end if;
+    perform trash_assert_company(v_entry.company_id);
+
+    -- Block restoring into a trashed parent: the row would be invisible
+    -- (hidden by the parent's deleted_at) yet no longer restorable. UIs
+    -- parse this errcode + message to offer "restore the parent too".
+    case v_entry.entity_type
+        when 'job' then
+            select 'client', c.id into v_parent_type, v_parent_id
+                from job j join client c on c.id = j.client_id
+                where j.id = v_entry.entity_id and c.deleted_at is not null;
+        when 'estimate' then
+            select 'client', c.id into v_parent_type, v_parent_id
+                from estimate e join client c on c.id = e.client_id
+                where e.id = v_entry.entity_id and c.deleted_at is not null;
+        when 'invoice' then
+            select 'client', c.id into v_parent_type, v_parent_id
+                from invoice i join client c on c.id = i.client_id
+                where i.id = v_entry.entity_id and c.deleted_at is not null;
+        when 'payment' then
+            select 'invoice', i.id into v_parent_type, v_parent_id
+                from payment p join invoice i on i.id = p.invoice_id
+                where p.id = v_entry.entity_id and i.deleted_at is not null;
+            if v_parent_type is null then
+                select 'job', j.id into v_parent_type, v_parent_id
+                    from payment p join job j on j.id = p.job_id
+                    where p.id = v_entry.entity_id and j.deleted_at is not null;
+            end if;
+        else
+            null;  -- client, event, item, category: no trashable parent
+    end case;
+
+    if v_parent_type is not null then
+        raise exception 'restore blocked: % % is in the trash', v_parent_type, v_parent_id
+            using errcode = '23514';
+    end if;
+
+    update client set deleted_at = null, deletion_id = null
+        where deletion_id = p_deletion_id;
+    update job set deleted_at = null, deletion_id = null
+        where deletion_id = p_deletion_id;
+    update job_recurring set deleted_at = null, deletion_id = null
+        where deletion_id = p_deletion_id;
+    update estimate set deleted_at = null, deletion_id = null
+        where deletion_id = p_deletion_id;
+    update invoice set deleted_at = null, deletion_id = null
+        where deletion_id = p_deletion_id;
+    update event set deleted_at = null, deletion_id = null
+        where deletion_id = p_deletion_id;
+    update payment set deleted_at = null, deletion_id = null
+        where deletion_id = p_deletion_id;
+    update item set deleted_at = null, deletion_id = null
+        where deletion_id = p_deletion_id;
+    update category set deleted_at = null, deletion_id = null
+        where deletion_id = p_deletion_id;
+
+    delete from deletion where id = p_deletion_id;
+end;
+$$;

package/dist/dist/migrations/20260819191145_client_map_jobs_deleted_at.sql

@@ -0,0 +1,33 @@
+-- Swap the last job-reading SQL function off the legacy is_deleted flag
+-- (dead column; see the note in 20260819191144). Body restated from
+-- 20260716194422_get_client_map_last_completed_jobs.sql with
+-- `job.is_deleted is not true` replaced by `job.deleted_at is null`.
+
+create or replace function public.get_client_map_last_completed_jobs(
+  company_id_param uuid
+)
+returns table (
+  client_id uuid,
+  last_completed_at timestamptz
+)
+language sql
+stable
+security invoker
+set search_path = ''
+as $$
+  select
+    job.client_id,
+    max(schedule.end_time) as last_completed_at
+  from public.job as job
+  inner join public.job_schedule as schedule
+    on schedule.job_id = job.id
+  where job.company_id = company_id_param
+    and schedule.company_id = company_id_param
+    and job.deleted_at is null
+    and schedule.status = 'Completed'::public.job_status_enum
+    and schedule.end_time <= now()
+  group by job.client_id;
+$$;
+
+comment on function public.get_client_map_last_completed_jobs(uuid) is
+  'Returns each client''s most recent completed job schedule for the map.';

package/dist/dist/migrations/20260819191147_booking_declined_deleted_at.sql

@@ -0,0 +1,28 @@
+-- Drop the redundant legacy is_deleted term from the decline-on-schedule-
+-- delete capture (dead column; see the note in 20260819191144). Body
+-- restated from 20260817221711_automation_soft_delete_events.sql; deleted_at
+-- alone carries the liveness semantics (the trash RPCs stamped both flags
+-- together, so the coalesce(is_deleted, ...) term never changed the result).
+
+create or replace function "public"."capture_automation_booking_declined_delete"()
+returns trigger
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+begin
+    if current_setting('autopilot.trash_purging', true) = 'true' then
+        return null;  -- purge of a trashed job: booking_declined already fired at soft-delete time
+    end if;
+    if exists (
+        select 1 from job
+        where id = OLD.job_id
+          and deleted_at is null
+    ) then
+        return null;  -- schedule edit churn: parent job still live, not a decline
+    end if;
+    insert into automation_event (company_id, event_type, job_id, schedule_id, payload)
+    values (OLD.company_id, 'booking_declined', OLD.job_id, OLD.id, to_jsonb(OLD));
+    return null;
+end;
+$$;