autopilot-core-sandbox 0.0.1

package/dist/dist/migrations/20260711185956_phone_call_table.sql

@@ -0,0 +1,99 @@
+create table if not exists "public"."phone_call" (
+    "id" "uuid" default "gen_random_uuid"() not null,
+    "created_at" timestamp with time zone default "now"() not null,
+    "updated_at" timestamp with time zone default "now"() not null,
+    "company_id" "uuid" not null,
+    "phone_number_id" "uuid",
+    "call_sid" "text",
+    "parent_call_sid" "text",
+    "recording_sid" "text" not null,
+    "recording_url" "text",
+    "recording_content_type" "text",
+    "recording_duration_seconds" integer,
+    "call_duration_seconds" integer,
+    "direction" "text" not null default 'unknown'::"text",
+    "from_number" "text",
+    "to_number" "text",
+    "contact_number" "text",
+    "contact_name" "text",
+    "phone_number_label" "text",
+    "call_started_at" timestamp with time zone,
+    "call_ended_at" timestamp with time zone,
+    "recording_started_at" timestamp with time zone,
+    "recording_completed_at" timestamp with time zone,
+    "ai_status" "text" not null default 'pending'::"text",
+    "ai_started_at" timestamp with time zone,
+    "ai_completed_at" timestamp with time zone,
+    "ai_attempts" integer not null default 0,
+    "ai_error" "text",
+    "ai_error_code" "text",
+    "transcript_text" "text",
+    "transcript_segments" "jsonb" not null default '[]'::"jsonb",
+    "summary" "text",
+    "summary_json" "jsonb" not null default '{}'::"jsonb",
+    "transcription_model" "text",
+    "summary_model" "text",
+    "openai_transcription_response_id" "text",
+    "openai_summary_response_id" "text",
+    "metadata" "jsonb" not null default '{}'::"jsonb",
+    constraint "phone_call_pkey" primary key ("id"),
+    constraint "phone_call_recording_sid_key" unique ("recording_sid"),
+    constraint "phone_call_ai_status_check" check (
+        "ai_status" in ('pending', 'processing', 'completed', 'failed')
+    ),
+    constraint "phone_call_direction_check" check (
+        "direction" in ('incoming', 'outgoing', 'unknown')
+    )
+);
+
+alter table "public"."phone_call" owner to "postgres";
+
+alter table only "public"."phone_call"
+    add constraint "phone_call_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete cascade;
+
+alter table only "public"."phone_call"
+    add constraint "phone_call_phone_number_id_fkey"
+    foreign key ("phone_number_id") references "public"."phone_number"("id") on delete set null;
+
+create index if not exists "phone_call_company_id_created_at_idx"
+    on "public"."phone_call" using "btree" ("company_id", "created_at" desc);
+
+create index if not exists "phone_call_company_id_call_started_at_idx"
+    on "public"."phone_call" using "btree" ("company_id", "call_started_at" desc);
+
+-- Supports the on delete set null cascade from phone_number: without this,
+-- deleting a phone number seq-scans phone_call to find referencing rows.
+create index if not exists "phone_call_phone_number_id_idx"
+    on "public"."phone_call" using "btree" ("phone_number_id");
+
+create index if not exists "phone_call_call_sid_idx"
+    on "public"."phone_call" using "btree" ("call_sid");
+
+create index if not exists "phone_call_parent_call_sid_idx"
+    on "public"."phone_call" using "btree" ("parent_call_sid");
+
+-- Partial index: nearly every row ends up 'completed', so a full ai_status
+-- index degrades into a scan of terminal rows. Indexing only the active
+-- statuses keeps worker polls (WHERE ai_status = 'pending' ORDER BY
+-- created_at) fast no matter how many completed calls accumulate.
+create index if not exists "phone_call_ai_active_created_at_idx"
+    on "public"."phone_call" using "btree" ("created_at")
+    where "ai_status" in ('pending', 'processing');
+
+create or replace function "public"."set_phone_call_updated_at"()
+returns "trigger"
+language "plpgsql"
+as $$
+begin
+    new."updated_at" = "now"();
+    return new;
+end;
+$$;
+
+alter function "public"."set_phone_call_updated_at"() owner to "postgres";
+
+create or replace trigger "set_phone_call_updated_at_trigger"
+before update on "public"."phone_call"
+for each row
+execute function "public"."set_phone_call_updated_at"();

package/dist/dist/migrations/20260711185957_phone_call_rls.sql

@@ -0,0 +1,25 @@
+alter table "public"."phone_call" enable row level security;
+
+create policy "Anyone with matching company_id can CRUD"
+on "public"."phone_call"
+to "authenticated"
+using (
+    (
+        nullif(
+            trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"),
+            ''::"text"
+        )
+    )::"uuid" = "company_id"
+)
+with check (
+    (
+        nullif(
+            trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"),
+            ''::"text"
+        )
+    )::"uuid" = "company_id"
+);
+
+grant all on table "public"."phone_call" to "anon";
+grant all on table "public"."phone_call" to "authenticated";
+grant all on table "public"."phone_call" to "service_role";

package/dist/dist/migrations/20260712014705_ai_voice_assistant_settings.sql

@@ -0,0 +1,71 @@
+create table if not exists "public"."settings_ai_voice_assistant" (
+    "id" "uuid" default "gen_random_uuid"() not null,
+    "created_at" timestamp with time zone default "now"() not null,
+    "updated_at" timestamp with time zone default "now"() not null,
+    "company_id" "uuid" not null,
+    "enabled" boolean not null default false,
+    "assistant_name" "text" not null default 'AI Assistant'::"text",
+    "instructions" "text" not null default ''::"text",
+    "use_default_instructions" boolean not null default true,
+    "vapi_assistant_id" "text",
+    "vapi_phone_number_id" "text",
+    "vapi_sip_uri" "text",
+    -- false = after-hours detection follows the company hours on settings_booking;
+    -- true = the company has configured assistant-specific hours below
+    "use_custom_hours" boolean not null default false,
+    "mon_is_open" boolean not null default true,
+    "mon_open_time" smallint not null default 480,
+    "mon_close_time" smallint not null default 1020,
+    "tue_is_open" boolean not null default true,
+    "tue_open_time" smallint not null default 480,
+    "tue_close_time" smallint not null default 1020,
+    "wed_is_open" boolean not null default true,
+    "wed_open_time" smallint not null default 480,
+    "wed_close_time" smallint not null default 1020,
+    "thu_is_open" boolean not null default true,
+    "thu_open_time" smallint not null default 480,
+    "thu_close_time" smallint not null default 1020,
+    "fri_is_open" boolean not null default true,
+    "fri_open_time" smallint not null default 480,
+    "fri_close_time" smallint not null default 1020,
+    "sat_is_open" boolean not null default false,
+    "sat_open_time" smallint not null default 480,
+    "sat_close_time" smallint not null default 1020,
+    "sun_is_open" boolean not null default false,
+    "sun_open_time" smallint not null default 480,
+    "sun_close_time" smallint not null default 1020,
+    constraint "settings_ai_voice_assistant_pkey" primary key ("id"),
+    constraint "settings_ai_voice_assistant_company_id_key" unique ("company_id")
+);
+
+alter table "public"."settings_ai_voice_assistant" owner to "postgres";
+
+alter table only "public"."settings_ai_voice_assistant"
+    add constraint "settings_ai_voice_assistant_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete cascade;
+
+create index if not exists "settings_ai_voice_assistant_vapi_assistant_id_idx"
+    on "public"."settings_ai_voice_assistant" using "btree" ("vapi_assistant_id");
+
+create or replace function "public"."set_settings_ai_voice_assistant_updated_at"()
+returns "trigger"
+language "plpgsql"
+as $$
+begin
+    new."updated_at" = "now"();
+    return new;
+end;
+$$;
+
+alter function "public"."set_settings_ai_voice_assistant_updated_at"() owner to "postgres";
+
+create or replace trigger "set_settings_ai_voice_assistant_updated_at_trigger"
+before update on "public"."settings_ai_voice_assistant"
+for each row
+execute function "public"."set_settings_ai_voice_assistant_updated_at"();
+
+alter table "public"."phone_number"
+    add column if not exists "ai_missed_calls_enabled" boolean not null default false;
+
+alter table "public"."phone_number"
+    add column if not exists "ai_after_hours_enabled" boolean not null default false;

package/dist/dist/migrations/20260712014706_ai_voice_assistant_settings_rls.sql

@@ -0,0 +1,14 @@
+-- settings_ai_voice_assistant is accessed exclusively through server-side
+-- (service-role) routes; no app code reads or writes it with an authenticated
+-- client. Exposing the row to authenticated users would leak vapi_sip_uri /
+-- vapi_assistant_id (live telephony routing ids) to every user in the company
+-- and let any of them update or delete it directly, bypassing the settings
+-- API. Lock it to service-role only, the same pattern as
+-- ai_assistant_prompt_template.
+
+alter table "public"."settings_ai_voice_assistant" enable row level security;
+
+revoke all on table "public"."settings_ai_voice_assistant" from "authenticated";
+revoke all on table "public"."settings_ai_voice_assistant" from "anon";
+
+grant all on table "public"."settings_ai_voice_assistant" to "service_role";

package/dist/dist/migrations/20260712014707_ai_prompt_templates.sql

@@ -0,0 +1,28 @@
+create table if not exists "public"."ai_assistant_prompt_template" (
+    "id" "uuid" default "gen_random_uuid"() not null,
+    "created_at" timestamp with time zone default "now"() not null,
+    "updated_at" timestamp with time zone default "now"() not null,
+    "industry" "text" not null,
+    "instructions" "text" not null,
+    constraint "ai_assistant_prompt_template_pkey" primary key ("id"),
+    constraint "ai_assistant_prompt_template_industry_key" unique ("industry")
+);
+
+alter table "public"."ai_assistant_prompt_template" owner to "postgres";
+
+create or replace function "public"."set_ai_assistant_prompt_template_updated_at"()
+returns "trigger"
+language "plpgsql"
+as $$
+begin
+    new."updated_at" = "now"();
+    return new;
+end;
+$$;
+
+alter function "public"."set_ai_assistant_prompt_template_updated_at"() owner to "postgres";
+
+create or replace trigger "set_ai_assistant_prompt_template_updated_at_trigger"
+before update on "public"."ai_assistant_prompt_template"
+for each row
+execute function "public"."set_ai_assistant_prompt_template_updated_at"();

package/dist/dist/migrations/20260712014708_ai_prompt_templates_rls.sql

@@ -0,0 +1,5 @@
+-- Server-only table: RLS enabled with NO authenticated/anon policies.
+-- Customers read the template text through the settings API, never directly.
+alter table "public"."ai_assistant_prompt_template" enable row level security;
+
+grant all on table "public"."ai_assistant_prompt_template" to "service_role";

package/dist/dist/migrations/20260712014709_ai_prompt_templates_seed.sql

@@ -0,0 +1,77 @@
+-- Data migration: seed the master AI assistant prompts per industry.
+-- Idempotent; existing rows (already edited by admin) are never overwritten.
+
+insert into "public"."ai_assistant_prompt_template" ("industry", "instructions")
+values
+(
+    'junk_removal',
+    $prompt$You are a friendly, professional phone assistant for a junk removal company. The team can't take this call right now, so you are answering on their behalf. Your job is to take great care of the caller and collect everything the team needs to follow up fast with an exact quote.
+
+What to collect, naturally over the conversation:
+- What items or junk they need removed, and roughly how much (a single item, a few pieces of furniture, a garage full, a whole house cleanout).
+- The pickup address, or at least the city or zip code.
+- When they'd like it picked up, and whether they're flexible on timing.
+- Their name and the best phone number for a callback.
+- Anything that affects the job: stairs, elevators, very heavy items, or hard-to-reach areas.
+
+How to talk:
+- Keep every response short and warm - one or two sentences, then one question. Never ask multiple questions at once.
+- If they ask about price, explain that most jobs are priced by how much space the items take up in the truck, and the team will review the details and call back with an exact quote, usually the same business day. Never make up prices, availability, or arrival times.
+- If they only want a callback, that's fine - get their name and number and reassure them.
+- If they're frustrated or it's urgent, apologize, take their details, and promise the team will call back as soon as possible.
+- End by repeating back their name, number, and what needs to be removed, then thank them for calling.$prompt$
+),
+(
+    'dumpster_rental',
+    $prompt$You are a friendly, professional phone assistant for a dumpster rental company. The team can't take this call right now, so you are answering on their behalf. Your job is to take great care of the caller and collect everything the team needs to confirm a rental quickly.
+
+What to collect, naturally over the conversation:
+- What the project is (home cleanout, renovation, roofing, new construction, yard debris).
+- What size they have in mind. If they're not sure, help briefly: a 10 yard works for small cleanouts, a 20 yard is the most popular for renovations and larger cleanouts, and 30 or 40 yard containers suit construction jobs. The team will confirm the right fit.
+- The delivery address, and where the dumpster would sit (driveway or street - if it's the street, mention the team will check whether a permit is needed).
+- When they need it delivered and roughly how long they'll keep it.
+- What's going in it. Household junk and construction debris are usually fine; hazardous materials, paint, chemicals, tires, and batteries are not allowed.
+- Their name and the best phone number for a callback.
+
+How to talk:
+- Keep every response short and warm - one or two sentences, then one question. Never ask multiple questions at once.
+- Never make up prices, exact availability, weight limits, or permit rules - the team will confirm details and call back with an exact quote, usually the same business day.
+- If they only want a callback, get their name and number and reassure them.
+- End by repeating back their name, number, delivery address, and the size and dates discussed, then thank them for calling.$prompt$
+),
+(
+    'junk_removal_dumpster_rental',
+    $prompt$You are a friendly, professional phone assistant for a company that offers both junk removal and dumpster rentals. The team can't take this call right now, so you are answering on their behalf. Your job is to take great care of the caller, figure out which service fits, and collect everything the team needs to follow up fast.
+
+Start by understanding what they need. If it's unclear, ask whether they'd like the crew to haul everything away for them (full-service junk removal), or a dumpster delivered that they fill themselves over a few days. Full-service is best when they don't want to lift a finger; a dumpster is best for ongoing projects.
+
+For junk removal, collect: what items and roughly how much (single item, a few pieces, a garage full, whole house), the pickup address or zip, preferred timing, and anything tricky like stairs or heavy items.
+
+For a dumpster, collect: the project type, the size they have in mind (10 yard for small cleanouts, 20 yard most popular, 30 to 40 for construction - the team confirms the fit), the delivery address and whether it sits on the driveway or street, delivery date and rental length, and what's going in it (no hazardous materials, paint, chemicals, tires, or batteries).
+
+Always get their name and the best callback number.
+
+How to talk:
+- Keep every response short and warm - one or two sentences, then one question. Never ask multiple questions at once.
+- Never make up prices or availability - the team will review and call back with an exact quote, usually the same business day.
+- End by repeating back their name, number, and what they need, then thank them for calling.$prompt$
+),
+(
+    'other',
+    $prompt$You are a friendly, professional phone assistant for a home services company. The team can't take this call right now, so you are answering on their behalf. Your job is to take great care of the caller and collect everything the team needs to follow up quickly.
+
+What to collect, naturally over the conversation:
+- What service they need and a short description of the job.
+- The service address, or at least the city or zip code.
+- When they'd like it done, and whether they're flexible on timing.
+- Their name and the best phone number for a callback.
+- Anything urgent or unusual the team should know about.
+
+How to talk:
+- Keep every response short and warm - one or two sentences, then one question. Never ask multiple questions at once.
+- Never make up prices, availability, or appointment times. If they ask, explain the team will review the details and call back with an answer, usually the same business day.
+- If it sounds like an emergency or a safety issue, take their information right away, tell them the team will be notified immediately, and keep the call brief.
+- If they only want a callback, get their name and number and reassure them.
+- End by repeating back their name, number, and what they need, then thank them for calling.$prompt$
+)
+on conflict ("industry") do nothing;

package/dist/dist/migrations/20260715011550_reminder_dispatch_table.sql

@@ -0,0 +1,47 @@
+-- Idempotency claims for the customer reminder crons (autopilot-web's
+-- send-job-reminder / send-estimate-reminder). The crons fire every minute but
+-- Vercel's scheduler drifts, so the routes match companies against a tolerance
+-- window instead of an exact minute; several ticks can therefore consider the
+-- same reminder on the same day. Before sending, a run claims the reminder by
+-- inserting a row here - the unique constraint makes the claim atomic, so a
+-- reminder is sent at most once per day no matter how many ticks overlap.
+-- A row means "a cron run claimed this reminder for this date", claimed just
+-- before the SMS is handed to Twilio.
+
+create table if not exists "public"."reminder_dispatch" (
+    "id" "uuid" default "gen_random_uuid"() not null,
+    "created_at" timestamp with time zone default "now"() not null,
+    "company_id" "uuid" not null,
+    "reminder_type" "text" not null,
+    "target_id" "uuid" not null,
+    "reminder_date" "date" not null,
+    constraint "reminder_dispatch_pkey" primary key ("id"),
+    constraint "reminder_dispatch_type_target_date_key" unique ("reminder_type", "target_id", "reminder_date"),
+    constraint "reminder_dispatch_reminder_type_check" check (
+        "reminder_type" in ('job', 'estimate')
+    )
+);
+
+alter table "public"."reminder_dispatch" owner to "postgres";
+
+alter table only "public"."reminder_dispatch"
+    add constraint "reminder_dispatch_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete cascade;
+
+-- target_id is job.id for reminder_type 'job' and estimate.id for
+-- 'estimate'. Jobs are claimed by job rather than by job_schedule row:
+-- editing a job deletes and re-creates its schedule rows with fresh uuids,
+-- so a schedule-keyed claim would not block a re-send when a job is edited
+-- inside the due window after its reminder already went out. Deliberately
+-- no foreign key: the referenced table depends on reminder_type, and claims
+-- must survive job/estimate deletion so the send history stays auditable.
+
+-- reminder_date is the scheduled fire date in the company's timezone (the day
+-- the reminder was due, not necessarily the day the claiming tick ran - a
+-- 23:58 reminder may be claimed shortly after midnight).
+
+-- the unique constraint doubles as the lookup index for claim conflicts;
+-- company-scoped index for observability queries ("what went out for company
+-- X on date D")
+create index "reminder_dispatch_company_id_reminder_date_idx"
+    on "public"."reminder_dispatch" ("company_id", "reminder_date");

package/dist/dist/migrations/20260715011551_reminder_dispatch_rls.sql

@@ -0,0 +1,22 @@
+-- RLS for reminder_dispatch.
+-- Same strict shape as sms_opt_out: rows are operational send-dedup state
+-- written exclusively by autopilot-web's cron routes via supabaseAdmin
+-- (service_role). Businesses must never write here - inserting a row would
+-- suppress a customer's reminder, deleting one could cause a duplicate text.
+-- authenticated users get read-only, company-scoped access (for any future
+-- "was the reminder sent?" UI surfacing).
+
+alter table "public"."reminder_dispatch" enable row level security;
+
+-- no anon grant: this table has no anonymous use case, so unauthenticated
+-- callers are stopped at the grant layer as well as by RLS default-deny
+grant select on table "public"."reminder_dispatch" to "authenticated";
+grant all on table "public"."reminder_dispatch" to "service_role";
+
+create policy "Anyone with matching company_id can read"
+on "public"."reminder_dispatch"
+for select
+to "authenticated"
+using (
+    ((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id")
+);

package/dist/dist/migrations/20260715192923_dedup_sequence_contact_add_unique_constraint.sql

@@ -0,0 +1,27 @@
+-- Sequences were double-texting clients: duplicate sequence_contact rows for
+-- the same (client, action, when_to_send) caused the sequences cron to send
+-- the identical message twice in the same minute. Duplicates were created by
+-- racing enrollments (stale tag diffs from the UI, re-running an active
+-- sequence) because nothing enforced uniqueness at the database level.
+--
+-- Step 1 (destructive): delete duplicate rows, keeping one row per
+-- (client_id, sequence_action_id, when_to_send) group. Future-dated
+-- duplicates would each fire a text when due, so removing them is the point.
+delete from public.sequence_contact a
+using public.sequence_contact b
+where a.client_id = b.client_id
+  and a.sequence_action_id = b.sequence_action_id
+  and a.when_to_send = b.when_to_send
+  and a.id > b.id;
+
+-- Step 2: enforce uniqueness going forward. when_to_send is part of the key
+-- on purpose: sent rows are kept as history and a client may legitimately
+-- re-enroll later (tag removed then re-added), which schedules new rows at
+-- new timestamps. Racing duplicate enrollments always converge to identical
+-- timestamps (enrollment time is minute-truncated and sending windows snap
+-- to the window start), so this key blocks exactly the duplicate case.
+-- Insert paths in autopilot-web rely on this constraint for
+-- ON CONFLICT DO NOTHING upserts.
+alter table public.sequence_contact
+  add constraint sequence_contact_client_action_when_key
+  unique (client_id, sequence_action_id, when_to_send);

package/dist/dist/migrations/20260716194420_add_employee_location_tracking.sql

@@ -0,0 +1,146 @@
+alter table "public"."user"
+  add column if not exists "location_tracking_enabled" boolean not null default false;
+
+alter table "public"."staging_new_employee"
+  add column if not exists "location_tracking_enabled" boolean not null default false;
+
+update "public"."user"
+set "location_tracking_enabled" = true
+where "is_current_employee" = true
+  and "subcontractor" = false;
+
+update "public"."staging_new_employee"
+set "location_tracking_enabled" = true
+where "subcontractor" = false;
+
+create table if not exists "public"."employee_location" (
+  "user_id" uuid primary key references "public"."user"("id") on delete cascade,
+  "company_id" uuid not null references "public"."company"("id") on delete cascade,
+  "latitude" double precision not null,
+  "longitude" double precision not null,
+  "accuracy_m" double precision,
+  "heading" double precision,
+  "speed_mps" double precision,
+  "device_recorded_at" timestamp with time zone not null,
+  "created_at" timestamp with time zone not null default now(),
+  "updated_at" timestamp with time zone not null default now(),
+  constraint "employee_location_latitude_check"
+    check ("latitude" >= -90 and "latitude" <= 90),
+  constraint "employee_location_longitude_check"
+    check ("longitude" >= -180 and "longitude" <= 180)
+);
+
+create index if not exists "employee_location_company_id_idx"
+  on "public"."employee_location" ("company_id");
+
+create index if not exists "employee_location_updated_at_idx"
+  on "public"."employee_location" ("updated_at" desc);
+
+create index if not exists "time_card_active_user_company_idx"
+  on "public"."time_card" ("user_id", "company_id")
+  where "clock_out" is null;
+
+create or replace function "public"."touch_employee_location_updated_at"()
+returns trigger
+language plpgsql
+as $$
+begin
+  new."updated_at" = now();
+  return new;
+end;
+$$;
+
+drop trigger if exists "touch_employee_location_updated_at"
+  on "public"."employee_location";
+
+create trigger "touch_employee_location_updated_at"
+before update on "public"."employee_location"
+for each row
+execute function "public"."touch_employee_location_updated_at"();
+
+create or replace function "public"."delete_employee_location_when_tracking_disabled"()
+returns trigger
+language plpgsql
+security definer
+set search_path = public
+as $$
+begin
+  if new."location_tracking_enabled" = false
+    or new."is_current_employee" = false
+    or new."subcontractor" = true then
+    delete from "public"."employee_location"
+    where "user_id" = new."id";
+  end if;
+
+  return new;
+end;
+$$;
+
+drop trigger if exists "delete_employee_location_when_tracking_disabled"
+  on "public"."user";
+
+create trigger "delete_employee_location_when_tracking_disabled"
+after update of "location_tracking_enabled", "is_current_employee", "subcontractor"
+on "public"."user"
+for each row
+execute function "public"."delete_employee_location_when_tracking_disabled"();
+
+create or replace function "public"."delete_employee_location_when_clocked_out"()
+returns trigger
+language plpgsql
+security definer
+set search_path = public
+as $$
+begin
+  -- only remove the snapshot when no open shift remains, matching the RLS
+  -- policies (this is an AFTER trigger, so the closed/deleted row is already
+  -- out of the open-shift set)
+  if tg_op = 'UPDATE' then
+    if old."clock_out" is null and new."clock_out" is not null
+      and not exists (
+        select 1
+        from "public"."time_card" as "remaining_shift"
+        where "remaining_shift"."user_id" = new."user_id"
+          and "remaining_shift"."company_id" = new."company_id"
+          and "remaining_shift"."clock_out" is null
+      ) then
+      delete from "public"."employee_location"
+      where "user_id" = new."user_id"
+        and "company_id" = new."company_id";
+    end if;
+
+    return new;
+  end if;
+
+  if tg_op = 'DELETE' then
+    if old."clock_out" is null
+      and not exists (
+        select 1
+        from "public"."time_card" as "remaining_shift"
+        where "remaining_shift"."user_id" = old."user_id"
+          and "remaining_shift"."company_id" = old."company_id"
+          and "remaining_shift"."clock_out" is null
+      ) then
+      delete from "public"."employee_location"
+      where "user_id" = old."user_id"
+        and "company_id" = old."company_id";
+    end if;
+
+    return old;
+  end if;
+
+  return null;
+end;
+$$;
+
+drop trigger if exists "delete_employee_location_when_clocked_out"
+  on "public"."time_card";
+
+create trigger "delete_employee_location_when_clocked_out"
+after update of "clock_out" or delete
+on "public"."time_card"
+for each row
+execute function "public"."delete_employee_location_when_clocked_out"();
+
+alter publication "supabase_realtime"
+  add table only "public"."employee_location";