autopilot-core-sandbox 0.0.1

package/dist/dist/migrations/20260820222756_add_settings_job_hide_task_timer.sql

@@ -0,0 +1,2 @@
+alter table public.settings_job
+  add column hide_task_timer boolean not null default false;

package/dist/dist/migrations/20260824234151_add_blast_chunk_recipients.sql

@@ -0,0 +1,13 @@
+-- Persist each chunk's recipient list at queue time. Recipient lists previously
+-- lived only inside the QStash message payloads, which makes pause/resume
+-- impossible: once a queued chunk is cancelled there is no record of who it was
+-- going to reach. The resume path republishes chunks whose status is
+-- 'cancelled' from this column. Minimal projection only (what the workers
+-- actually use), not full client rows:
+--   blast_email_chunk: [{ email, first_name, last_name }]
+--   blast_sms_chunk:   [{ id, first_name, last_name, primary_phone_number }]
+-- Nullable: chunks queued before this feature deployed have no recipients and
+-- can be paused/cancelled but not resumed.
+alter table "public"."blast_email_chunk" add column "recipients" jsonb;
+
+alter table "public"."blast_sms_chunk" add column "recipients" jsonb;

package/dist/dist/migrations/20260824234152_add_blast_pause_cancel_columns.sql

@@ -0,0 +1,10 @@
+-- Lifecycle bookkeeping for user-initiated pause/cancel of blasts.
+-- paused_at: when the blast was paused (display + debugging; cleared on
+-- resume/cancel).
+alter table "public"."blast_email" add column "paused_at" timestamp with time zone;
+
+alter table "public"."blast_sms" add column "paused_at" timestamp with time zone;
+
+-- Parity with blast_email.aborted_reason: records why an SMS blast was stopped
+-- ('cancelled_by_user', entitlement-loss reasons, etc.).
+alter table "public"."blast_sms" add column "aborted_reason" text;

package/dist/dist/migrations/20260825014725_get_job_ids_in_range.sql

@@ -0,0 +1,42 @@
+-- Compute "job IDs whose earliest schedule falls in a date range" in the
+-- database instead of downloading every schedule row of every candidate job
+-- to the client. Replaces the paged-seed + chunked-.in() logic in core's
+-- DashboardProvider.loadJobIdsInRange and web's fetchJobIdsInRangeAllStatuses
+-- fork (p_include_canceled toggles between the two variants).
+--
+-- Callers must page the result via .order/.range: PostgREST's max_rows cap
+-- applies to set-returning function responses as well.
+
+create or replace function "public"."get_job_ids_in_range"(
+  "p_company_id" uuid,
+  "p_date_from" timestamp with time zone,
+  "p_date_to" timestamp with time zone,
+  "p_include_canceled" boolean default false
+)
+returns table ("job_id" uuid)
+as $$
+  with candidates as (
+    select distinct js.job_id
+    from public.job_schedule js
+    where js.company_id = p_company_id
+      and js.start_time >= p_date_from
+      and js.start_time <= p_date_to
+      and (p_include_canceled or js.status <> 'Canceled')
+  )
+  select js.job_id
+  from public.job_schedule js
+  join candidates c on c.job_id = js.job_id
+  where js.company_id = p_company_id
+    and (p_include_canceled or js.status <> 'Canceled')
+  group by js.job_id
+  having min(js.start_time) >= p_date_from
+     and min(js.start_time) <= p_date_to
+  order by js.job_id
+$$ language sql stable security invoker
+set search_path = "public", "pg_temp";
+
+-- idx_job_schedule_company_active_start is partial (status <> 'Canceled') and
+-- only serves the exclude-canceled variant; this unfiltered companion serves
+-- the all-statuses candidate scan.
+create index if not exists idx_job_schedule_company_start
+  on public.job_schedule (company_id, start_time, job_id);

package/dist/dist/migrations/20260825194452_add_failed_job_status.sql

@@ -0,0 +1,15 @@
+-- Rentals rework R1: new 'Failed' status for rental tasks — the task could
+-- not be completed for some reason (vs. Canceled = the customer or company
+-- called it off). Route re-optimization plans around Failed rows.
+--
+-- job_status_enum is shared by job.status, job_schedule.status and
+-- estimate.schedule_status. The product rule is that ONLY task-typed
+-- job_schedule rows (task_type is not null) ever carry 'Failed'; clients
+-- enforce this by offering it only in those dropdowns. A stray job-level
+-- 'Failed' would be wrong data but not corruption, so no DB constraint.
+--
+-- This ALTER must be the ONLY statement in this migration: Postgres allows
+-- ADD VALUE inside a transaction but forbids USING the new value in the
+-- same transaction, and each migration file runs as one transaction.
+
+alter type "public"."job_status_enum" add value 'Failed';

package/dist/dist/migrations/20260825194457_remove_take_to_rental_task_options.sql

@@ -0,0 +1,24 @@
+-- Rentals rework R1: the take-to family (take_to_dump / take_to_lot /
+-- take_to_other) leaves the task vocabulary. Hauls to landfills/lots are
+-- route-optimizer legs (persisted route plans, R2), never job_schedule
+-- tasks, so they can no longer be selected as task types.
+--
+-- DESTRUCTIVE: deletes take_to rows from rental_task_option. The rentals
+-- feature has never been live (dark behind entitlement + rentals_enabled),
+-- so only internal/QA companies can have such rows.
+
+delete from "public"."rental_task_option"
+    where "preset_key" in ('take_to_dump', 'take_to_lot', 'take_to_other');
+
+-- Mirrored by PRESET_TASK_KEYS in src/server-safe/rentals.ts — the two
+-- lists must stay in sync.
+alter table "public"."rental_task_option"
+    drop constraint "rental_task_option_preset_key_check";
+
+alter table "public"."rental_task_option"
+    add constraint "rental_task_option_preset_key_check" check (
+        "preset_key" is null or "preset_key" in (
+            'drop_off', 'pick_up', 'swap', 'live_load', 'relocate',
+            'dump_and_return', 'repair', 'service'
+        )
+    );

package/dist/dist/migrations/20260825194458_remove_take_to_job_schedules.sql

@@ -0,0 +1,12 @@
+-- Rentals rework R1: delete existing take-to task rows. task_type is
+-- unconstrained text (no FK/CHECK by design), so this is pure data
+-- cleanup; job_user rows cascade via job_user_job_schedule_id_fkey
+-- (ON DELETE CASCADE).
+--
+-- DESTRUCTIVE: deletes job_schedule rows. The rentals feature has never
+-- been live, so only internal/QA companies can have take_to rows (created
+-- by the C3 completion spawn flow or an approved route plan — both flows
+-- are removed in this same release).
+
+delete from "public"."job_schedule"
+    where "task_type" in ('take_to_dump', 'take_to_lot', 'take_to_other');

package/dist/dist/migrations/20260825194459_rework_apply_rental_route_plan_no_take_to.sql

@@ -0,0 +1,168 @@
+-- Rentals rework R1: apply_rental_route_plan loses its take_to row
+-- creation (phase 4). take-to legs are no longer job_schedule tasks; R2
+-- replaces this function wholesale with the persisted-route-plan version.
+-- This interim rework exists so the function stops referencing the
+-- target_* columns BEFORE the next migration drops them, and so a stale
+-- deployed web bundle that still sends p_new_tasks fails loudly instead of
+-- recreating take_to rows.
+--
+-- Phases 1–3 (lock+verify, list_sort_key/asset updates, job_user
+-- replacement) are byte-identical to the previous version.
+
+create or replace function "public"."apply_rental_route_plan"(
+    "p_company_id" uuid,
+    "p_expected" jsonb,
+    "p_task_updates" jsonb,
+    "p_assignments" jsonb,
+    "p_new_tasks" jsonb
+) returns void
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+    v_item jsonb;
+    v_sched "public"."job_schedule"%rowtype;
+    v_expected_ids uuid[] := '{}';
+    v_schedule_id uuid;
+    v_current_users uuid[];
+    v_expected_users uuid[];
+begin
+    if p_company_id is null then
+        raise exception 'company id is required'
+            using errcode = 'P0011';
+    end if;
+
+    if jsonb_array_length(coalesce(p_new_tasks, '[]'::jsonb)) > 0 then
+        raise exception
+            'optimizer task creation is disabled pending route-plan rework'
+            using errcode = 'P0012';
+    end if;
+
+    -- 1. Lock every planned row; verify tenancy and that its optimized
+    --    state — status, assets, ordering, assignees — is unchanged since
+    --    the plan was computed. Status alone is not enough: a dispatcher
+    --    can re-assign an asset or a driver without touching status, and a
+    --    stale plan must not overwrite that edit.
+    for v_item in
+        select * from jsonb_array_elements(coalesce(p_expected, '[]'::jsonb))
+    loop
+        v_schedule_id := (v_item->>'schedule_id')::uuid;
+
+        select * into v_sched
+        from "public"."job_schedule"
+        where "id" = v_schedule_id
+        for update;
+
+        if not found or v_sched."company_id" is distinct from p_company_id then
+            raise exception 'route plan references an unknown schedule row'
+                using errcode = 'P0011';
+        end if;
+
+        select coalesce(array_agg("user_id" order by "user_id"), '{}')
+        into v_current_users
+        from "public"."job_user"
+        where "job_schedule_id" = v_schedule_id;
+
+        select coalesce(array_agg(u.value::uuid order by u.value::uuid), '{}')
+        into v_expected_users
+        from jsonb_array_elements_text(
+            coalesce(v_item->'user_ids', '[]'::jsonb)) u;
+
+        if v_sched."status"::text is distinct from (v_item->>'status')
+            or v_sched."asset_id" is distinct from
+                (v_item->>'asset_id')::uuid
+            or v_sched."secondary_asset_id" is distinct from
+                (v_item->>'secondary_asset_id')::uuid
+            or v_sched."list_sort_key" is distinct from
+                (v_item->>'list_sort_key')::numeric
+            or v_current_users is distinct from v_expected_users
+        then
+            raise exception 'route plan is stale'
+                using errcode = 'P0010';
+        end if;
+
+        v_expected_ids := v_expected_ids || v_schedule_id;
+    end loop;
+
+    -- 2. Ordering / asset assignment updates. Every touched row must have
+    --    been locked and company-checked above.
+    for v_item in
+        select * from jsonb_array_elements(coalesce(p_task_updates, '[]'::jsonb))
+    loop
+        v_schedule_id := (v_item->>'schedule_id')::uuid;
+
+        if not (v_schedule_id = any (v_expected_ids)) then
+            raise exception 'task update outside the locked plan rows'
+                using errcode = 'P0011';
+        end if;
+
+        update "public"."job_schedule"
+        set "list_sort_key" = (v_item->>'list_sort_key')::numeric,
+            "asset_id" = case
+                when v_item ? 'asset_id' then (v_item->>'asset_id')::uuid
+                else "asset_id"
+            end
+        where "id" = v_schedule_id;
+    end loop;
+
+    -- 3. Full replacement of each planned row's assignments. job_id is read
+    --    from the schedule row itself, never from the payload, and every
+    --    assignee must belong to the company — user and company foreign
+    --    keys on job_user are enforced independently, so without this
+    --    check a crafted payload could create a cross-tenant assignment.
+    for v_item in
+        select * from jsonb_array_elements(coalesce(p_assignments, '[]'::jsonb))
+    loop
+        v_schedule_id := (v_item->>'schedule_id')::uuid;
+
+        if not (v_schedule_id = any (v_expected_ids)) then
+            raise exception 'assignment outside the locked plan rows'
+                using errcode = 'P0011';
+        end if;
+
+        perform 1
+        from jsonb_array_elements_text(
+            coalesce(v_item->'user_ids', '[]'::jsonb)) u
+        where not exists (
+            select 1 from "public"."user_role" ur
+            where ur."user_id" = u.value::uuid
+              and ur."company_id" = p_company_id
+        );
+        if found then
+            raise exception 'assignee outside the company'
+                using errcode = 'P0011';
+        end if;
+
+        delete from "public"."job_user"
+        where "job_schedule_id" = v_schedule_id;
+
+        insert into "public"."job_user"
+            ("company_id", "job_id", "job_schedule_id", "user_id")
+        select p_company_id, js."job_id", v_schedule_id, u.value::uuid
+        from "public"."job_schedule" js
+        cross join jsonb_array_elements_text(
+            coalesce(v_item->'user_ids', '[]'::jsonb)) u
+        where js."id" = v_schedule_id;
+    end loop;
+end;
+$$;
+
+alter function "public"."apply_rental_route_plan"(
+    uuid, jsonb, jsonb, jsonb, jsonb
+) owner to "postgres";
+
+-- security definer + service_role-only: /api/rental-routes/apply is the
+-- sole caller; no authenticated/anon path exists.
+revoke all on function "public"."apply_rental_route_plan"(
+    uuid, jsonb, jsonb, jsonb, jsonb
+) from public;
+revoke all on function "public"."apply_rental_route_plan"(
+    uuid, jsonb, jsonb, jsonb, jsonb
+) from "anon";
+revoke all on function "public"."apply_rental_route_plan"(
+    uuid, jsonb, jsonb, jsonb, jsonb
+) from "authenticated";
+grant execute on function "public"."apply_rental_route_plan"(
+    uuid, jsonb, jsonb, jsonb, jsonb
+) to "service_role";

package/dist/dist/migrations/20260825194500_drop_job_schedule_target_location.sql

@@ -0,0 +1,24 @@
+-- Rentals rework R1: the take-to task family is gone (previous two
+-- migrations), so its destination columns go too. Route-plan legs (R2)
+-- carry their own destination data on route_plan_stop.
+--
+-- DESTRUCTIVE: drops four columns. Verified no deployed select string
+-- names them (mobile fetches job_schedule(*); web's explicit-column embeds
+-- name only status/time/task_type fields; the rentalRouting engine reads
+-- them from wildcard selects in TS only, so post-drop it sees undefined,
+-- not a 400). The only DB-side reader was apply_rental_route_plan,
+-- reworked in the previous migration.
+
+alter table "public"."job_schedule"
+    drop constraint "job_schedule_target_location_shape_check";
+
+alter table "public"."job_schedule"
+    drop constraint "job_schedule_target_saved_location_id_fkey";
+
+drop index "public"."job_schedule_target_saved_location_id_idx";
+
+alter table "public"."job_schedule"
+    drop column "target_saved_location_id",
+    drop column "target_address",
+    drop column "target_latitude",
+    drop column "target_longitude";

package/dist/dist/migrations/20260825194501_add_job_schedule_size.sql

@@ -0,0 +1,17 @@
+-- Rentals rework R1: rental tasks carry a SIZE instead of a pre-selected
+-- asset. The exact unit isn't known until the driver loads the truck, so
+-- the schedule card offers Type + Size; asset_id is recorded at execution
+-- time (completion picker / driver mode).
+--
+-- Written by the schedule cards (web + mobile), online booking
+-- (customer-create-job, from item.size) and ModalDuplicateJob. Read by the
+-- route optimizer (replaces item-heuristic size inference, R2) and the
+-- completion asset picker's default filter. Swap rows carry ONE size — the
+-- delivered (swapped-in) asset's.
+--
+-- CHECK mirrors item_size_check (20260807014723): zero/negative yardage is
+-- always a data error; both UIs coerce empty input to null.
+
+alter table "public"."job_schedule"
+    add column "size" numeric
+    constraint "job_schedule_size_check" check ("size" > 0);

package/dist/dist/migrations/20260825233001_add_job_schedule_id_company_id_key.sql

@@ -0,0 +1,11 @@
+-- Rentals rework R2: backing key for tenant-consistent composite FKs from
+-- route_plan_stop (job_schedule_id / source_job_schedule_id + company_id).
+-- id is already the primary key, so this adds no new uniqueness semantics —
+-- it only gives composite FKs a target, matching the asset /
+-- saved_location pattern.
+--
+-- ADD CONSTRAINT takes a brief ACCESS EXCLUSIVE lock on job_schedule —
+-- apply off-peak.
+
+alter table only "public"."job_schedule"
+    add constraint "job_schedule_id_company_id_key" unique ("id", "company_id");

package/dist/dist/migrations/20260825233002_create_route_plan.sql

@@ -0,0 +1,52 @@
+-- Rentals rework R2: persisted route plans. One active plan per company
+-- per day (unique (company_id, date)); re-optimizing the same day bumps
+-- `run` in place instead of inserting a second plan. Superseded runs'
+-- stops survive as history rows in route_plan_stop (next migration);
+-- plans themselves are kept forever (Ryan's decision — volume is one row
+-- per company-day, and the history is the dispatch audit trail).
+--
+-- structural_fingerprint is the shared core helper's hash over the day's
+-- rental task rows AS PLANNED (computed at optimize time over the
+-- post-apply state). Clients recompute it over the current day and a
+-- mismatch means the plan is stale — completing tasks as planned does NOT
+-- flip it; Failed/Canceled/add/remove/reorder/reassign/size changes do.
+--
+-- Plan creation/replacement goes only through the service-role
+-- apply_rental_route_plan RPC — for atomicity with the schedule writes,
+-- not security; staff read (and R3 driver-mode stop writes) are direct
+-- RLS-scoped queries.
+
+create table if not exists "public"."route_plan" (
+    "id" "uuid" default "gen_random_uuid"() not null,
+    "created_at" timestamp with time zone default "now"() not null,
+    "updated_at" timestamp with time zone,
+    "company_id" "uuid" not null,
+    -- YYYY-MM-DD company-calendar day the plan covers.
+    "date" "date" not null,
+    -- Bumped on every re-optimize apply; optimistic-concurrency token for
+    -- the preview -> approve flow.
+    "run" integer default 1 not null,
+    "structural_fingerprint" "text" not null,
+    "created_by" "uuid",
+    "total_miles" numeric default 0 not null,
+    "warnings" "jsonb" default '[]'::"jsonb" not null,
+    "unroutable" "jsonb" default '[]'::"jsonb" not null,
+    "distance_stats" "jsonb" default '{}'::"jsonb" not null,
+    constraint "route_plan_pkey" primary key ("id"),
+    constraint "route_plan_company_id_date_key" unique ("company_id", "date"),
+    -- Backing key for route_plan_stop's tenant-consistent composite FK.
+    constraint "route_plan_id_company_id_key" unique ("id", "company_id"),
+    constraint "route_plan_run_check" check ("run" > 0)
+);
+
+alter table "public"."route_plan" owner to "postgres";
+
+alter table only "public"."route_plan"
+    add constraint "route_plan_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete cascade;
+
+alter table only "public"."route_plan"
+    add constraint "route_plan_created_by_fkey"
+    foreign key ("created_by") references "public"."user"("id") on delete set null;
+
+create index "route_plan_company_id_idx" on "public"."route_plan" ("company_id");

package/dist/dist/migrations/20260825233003_create_route_plan_stop.sql

@@ -0,0 +1,159 @@
+-- Rentals rework R2: the stops of a persisted route plan, ordered per
+-- driver by (run, sort_key). Two kinds, enforced by
+-- route_plan_stop_shape_check:
+--
+--   'task'    -> job_schedule_id set; the task's status/assets stay on the
+--                job_schedule row (never duplicated here), so the implied-
+--                only columns (implied_kind, status, completed_at/by) are
+--                null.
+--   'implied' -> an optimizer-created leg with no job_schedule row:
+--                haul_to_landfill, return_empty_to_lot, store_full_at_lot,
+--                load_empty_at_lot, or collect_full_at_lot (mirrored by
+--                the persisted subset of
+--                ImpliedLegKind in src/server-safe/routeOptimization.ts;
+--                'reposition' — an empty-bed drive — is display-only and
+--                never persisted). Carries its own status
+--                pending|completed|failed, completed in R3's driver mode
+--                via RentalsProvider.completeRoutePlanStop.
+--
+-- id is CLIENT-generated (by the optimizer engine) and inserted with
+-- on-conflict-do-nothing so a retried approval never duplicates rows.
+-- Re-optimizing deletes only re-plannable stops (pending implied stops,
+-- and task stops whose schedule isn't Completed/Failed) and inserts the
+-- new run's stops; terminal stops from earlier runs remain as history.
+--
+-- suggested_asset_id is the optimizer's suggestion (dumpsters are fungible
+-- within a size); asset_id is the unit actually moved, recorded at
+-- execution time only. label/address/lat/lng are denormalized so history
+-- stays renderable after a saved_location is deleted (its FK is SET NULL).
+
+create table if not exists "public"."route_plan_stop" (
+    "id" "uuid" not null,
+    "created_at" timestamp with time zone default "now"() not null,
+    "company_id" "uuid" not null,
+    "route_plan_id" "uuid" not null,
+    "run" integer not null,
+    "sort_key" numeric not null,
+    "driver_user_id" "uuid" not null,
+    "kind" "text" not null,
+    "job_schedule_id" "uuid",
+    "implied_kind" "text",
+    "status" "text",
+    "completed_at" timestamp with time zone,
+    "completed_by" "uuid",
+    "suggested_asset_id" "uuid",
+    "asset_id" "uuid",
+    "size" numeric,
+    "saved_location_id" "uuid",
+    "label" "text" not null,
+    "address" "text" not null,
+    "latitude" numeric not null,
+    "longitude" numeric not null,
+    "source_job_schedule_id" "uuid",
+    "leg_miles_from_prev" numeric default 0 not null,
+    constraint "route_plan_stop_pkey" primary key ("id"),
+    constraint "route_plan_stop_kind_check" check (
+        "kind" in ('task', 'implied')
+    ),
+    constraint "route_plan_stop_implied_kind_check" check (
+        "implied_kind" in (
+            'haul_to_landfill',
+            'return_empty_to_lot',
+            'store_full_at_lot',
+            'load_empty_at_lot',
+            'collect_full_at_lot'
+        )
+    ),
+    constraint "route_plan_stop_status_check" check (
+        "status" in ('pending', 'completed', 'failed')
+    ),
+    constraint "route_plan_stop_size_check" check ("size" > 0),
+    constraint "route_plan_stop_run_check" check ("run" > 0),
+    constraint "route_plan_stop_shape_check" check (
+        ("kind" = 'task'
+            and "job_schedule_id" is not null
+            and "implied_kind" is null
+            and "status" is null
+            and "completed_at" is null
+            and "completed_by" is null)
+        or ("kind" = 'implied'
+            and "job_schedule_id" is null
+            and "implied_kind" is not null
+            and "status" is not null)
+    )
+);
+
+alter table "public"."route_plan_stop" owner to "postgres";
+
+alter table only "public"."route_plan_stop"
+    add constraint "route_plan_stop_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete cascade;
+
+-- Tenant-consistent composite FKs (house pattern). The plan FK cascades:
+-- a deleted plan takes its stops with it. A deleted task row takes its
+-- stop rows with it (the stop is meaningless without the task's status).
+-- Asset / location / source-task FKs SET NULL only their own column
+-- (PG15 column-list form) so history rows survive out-of-band deletes.
+alter table only "public"."route_plan_stop"
+    add constraint "route_plan_stop_route_plan_id_fkey"
+    foreign key ("route_plan_id", "company_id")
+    references "public"."route_plan"("id", "company_id")
+    on delete cascade;
+
+alter table only "public"."route_plan_stop"
+    add constraint "route_plan_stop_job_schedule_id_fkey"
+    foreign key ("job_schedule_id", "company_id")
+    references "public"."job_schedule"("id", "company_id")
+    on delete cascade;
+
+alter table only "public"."route_plan_stop"
+    add constraint "route_plan_stop_source_job_schedule_id_fkey"
+    foreign key ("source_job_schedule_id", "company_id")
+    references "public"."job_schedule"("id", "company_id")
+    on delete set null ("source_job_schedule_id");
+
+alter table only "public"."route_plan_stop"
+    add constraint "route_plan_stop_suggested_asset_id_fkey"
+    foreign key ("suggested_asset_id", "company_id")
+    references "public"."asset"("id", "company_id")
+    on delete set null ("suggested_asset_id");
+
+alter table only "public"."route_plan_stop"
+    add constraint "route_plan_stop_asset_id_fkey"
+    foreign key ("asset_id", "company_id")
+    references "public"."asset"("id", "company_id")
+    on delete set null ("asset_id");
+
+alter table only "public"."route_plan_stop"
+    add constraint "route_plan_stop_saved_location_id_fkey"
+    foreign key ("saved_location_id", "company_id")
+    references "public"."saved_location"("id", "company_id")
+    on delete set null ("saved_location_id");
+
+alter table only "public"."route_plan_stop"
+    add constraint "route_plan_stop_driver_user_id_fkey"
+    foreign key ("driver_user_id") references "public"."user"("id")
+    on delete cascade;
+
+alter table only "public"."route_plan_stop"
+    add constraint "route_plan_stop_completed_by_fkey"
+    foreign key ("completed_by") references "public"."user"("id")
+    on delete set null;
+
+create index "route_plan_stop_company_id_idx"
+    on "public"."route_plan_stop" ("company_id");
+-- The read path: a plan's stops ordered for display.
+create index "route_plan_stop_plan_run_sort_idx"
+    on "public"."route_plan_stop" ("route_plan_id", "run", "sort_key");
+create index "route_plan_stop_job_schedule_id_idx"
+    on "public"."route_plan_stop" ("job_schedule_id");
+create index "route_plan_stop_source_job_schedule_id_idx"
+    on "public"."route_plan_stop" ("source_job_schedule_id");
+create index "route_plan_stop_driver_user_id_idx"
+    on "public"."route_plan_stop" ("driver_user_id");
+create index "route_plan_stop_suggested_asset_id_idx"
+    on "public"."route_plan_stop" ("suggested_asset_id");
+create index "route_plan_stop_asset_id_idx"
+    on "public"."route_plan_stop" ("asset_id");
+create index "route_plan_stop_saved_location_id_idx"
+    on "public"."route_plan_stop" ("saved_location_id");

package/dist/dist/migrations/20260825233004_route_plan_rls.sql

@@ -0,0 +1,32 @@
+-- RLS for the persisted route-plan tables.
+--
+-- Affected tables: route_plan, route_plan_stop.
+--
+-- Standard house policy (contracts template): any authenticated staff
+-- member of the owning company can CRUD. Staff need direct reads (web map
+-- panel, R3 driver mode) and direct stop-row writes (driver mode completes
+-- implied stops via RentalsProvider.completeRoutePlanStop). Plan
+-- creation/replacement still goes only through the service-role
+-- apply_rental_route_plan RPC — that's an atomicity choice, not a
+-- security boundary. End customers never touch these tables — NO anon
+-- policies or grants.
+
+alter table "public"."route_plan" enable row level security;
+alter table "public"."route_plan_stop" enable row level security;
+
+grant all on table "public"."route_plan" to "authenticated";
+grant all on table "public"."route_plan" to "service_role";
+grant all on table "public"."route_plan_stop" to "authenticated";
+grant all on table "public"."route_plan_stop" to "service_role";
+
+create policy "Anyone with matching company_id can CRUD"
+on "public"."route_plan"
+to "authenticated"
+using (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"))
+with check (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"));
+
+create policy "Anyone with matching company_id can CRUD"
+on "public"."route_plan_stop"
+to "authenticated"
+using (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"))
+with check (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"));