autopilot-core-sandbox 0.0.1

package/dist/dist/migrations/20260716194421_add_employee_location_tracking_rls.sql

@@ -0,0 +1,154 @@
+alter table "public"."employee_location" enable row level security;
+
+grant select, insert, update, delete on table "public"."employee_location" to authenticated;
+grant all on table "public"."employee_location" to service_role;
+
+create policy "Employee locations selectable by self or owners/admins"
+on "public"."employee_location"
+for select
+to authenticated
+using (
+  (
+    nullif(
+      trim(both '"' from ("public"."get_my_claim"('autopilot_company_id'::text))::text),
+      ''::text
+    )
+  )::uuid = "company_id"
+  and exists (
+    select 1
+    from "public"."user" as "tracked_user"
+    where "tracked_user"."id" = "employee_location"."user_id"
+      and "tracked_user"."company_id" = "employee_location"."company_id"
+      and "tracked_user"."is_current_employee" = true
+      and "tracked_user"."subcontractor" = false
+      and "tracked_user"."location_tracking_enabled" = true
+  )
+  and exists (
+    select 1
+    from "public"."time_card" as "active_shift"
+    where "active_shift"."user_id" = "employee_location"."user_id"
+      and "active_shift"."company_id" = "employee_location"."company_id"
+      and "active_shift"."clock_out" is null
+  )
+  and (
+    "auth"."uid"() = "user_id"
+    or coalesce(
+      ("public"."get_my_claim"('autopilot_role'::text))::text,
+      ''::text
+    ) in ('"owner"'::text, '"admin"'::text)
+  )
+);
+
+create policy "Employees can insert their own current location"
+on "public"."employee_location"
+for insert
+to authenticated
+with check (
+  "auth"."uid"() = "user_id"
+  and (
+    nullif(
+      trim(both '"' from ("public"."get_my_claim"('autopilot_company_id'::text))::text),
+      ''::text
+    )
+  )::uuid = "company_id"
+  and exists (
+    select 1
+    from "public"."user" as "tracked_user"
+    where "tracked_user"."id" = "employee_location"."user_id"
+      and "tracked_user"."company_id" = "employee_location"."company_id"
+      and "tracked_user"."is_current_employee" = true
+      and "tracked_user"."subcontractor" = false
+      and "tracked_user"."location_tracking_enabled" = true
+  )
+  and exists (
+    select 1
+    from "public"."time_card" as "active_shift"
+    where "active_shift"."user_id" = "employee_location"."user_id"
+      and "active_shift"."company_id" = "employee_location"."company_id"
+      and "active_shift"."clock_out" is null
+  )
+);
+
+create policy "Employees can update their own current location"
+on "public"."employee_location"
+for update
+to authenticated
+using (
+  "auth"."uid"() = "user_id"
+  and (
+    nullif(
+      trim(both '"' from ("public"."get_my_claim"('autopilot_company_id'::text))::text),
+      ''::text
+    )
+  )::uuid = "company_id"
+  and exists (
+    select 1
+    from "public"."user" as "tracked_user"
+    where "tracked_user"."id" = "employee_location"."user_id"
+      and "tracked_user"."company_id" = "employee_location"."company_id"
+      and "tracked_user"."is_current_employee" = true
+      and "tracked_user"."subcontractor" = false
+      and "tracked_user"."location_tracking_enabled" = true
+  )
+  and exists (
+    select 1
+    from "public"."time_card" as "active_shift"
+    where "active_shift"."user_id" = "employee_location"."user_id"
+      and "active_shift"."company_id" = "employee_location"."company_id"
+      and "active_shift"."clock_out" is null
+  )
+)
+with check (
+  "auth"."uid"() = "user_id"
+  and (
+    nullif(
+      trim(both '"' from ("public"."get_my_claim"('autopilot_company_id'::text))::text),
+      ''::text
+    )
+  )::uuid = "company_id"
+  and exists (
+    select 1
+    from "public"."user" as "tracked_user"
+    where "tracked_user"."id" = "employee_location"."user_id"
+      and "tracked_user"."company_id" = "employee_location"."company_id"
+      and "tracked_user"."is_current_employee" = true
+      and "tracked_user"."subcontractor" = false
+      and "tracked_user"."location_tracking_enabled" = true
+  )
+  and exists (
+    select 1
+    from "public"."time_card" as "active_shift"
+    where "active_shift"."user_id" = "employee_location"."user_id"
+      and "active_shift"."company_id" = "employee_location"."company_id"
+      and "active_shift"."clock_out" is null
+  )
+);
+
+create policy "Employee locations deletable by self or owners/admins"
+on "public"."employee_location"
+for delete
+to authenticated
+using (
+  (
+    nullif(
+      trim(both '"' from ("public"."get_my_claim"('autopilot_company_id'::text))::text),
+      ''::text
+    )
+  )::uuid = "company_id"
+  and exists (
+    select 1
+    from "public"."user" as "tracked_user"
+    where "tracked_user"."id" = "employee_location"."user_id"
+      and "tracked_user"."company_id" = "employee_location"."company_id"
+      and "tracked_user"."is_current_employee" = true
+      and "tracked_user"."subcontractor" = false
+      and "tracked_user"."location_tracking_enabled" = true
+  )
+  and (
+    "auth"."uid"() = "user_id"
+    or coalesce(
+      ("public"."get_my_claim"('autopilot_role'::text))::text,
+      ''::text
+    ) in ('"owner"'::text, '"admin"'::text)
+  )
+);

package/dist/dist/migrations/20260716194422_get_client_map_last_completed_jobs.sql

@@ -0,0 +1,28 @@
+create or replace function public.get_client_map_last_completed_jobs(
+  company_id_param uuid
+)
+returns table (
+  client_id uuid,
+  last_completed_at timestamptz
+)
+language sql
+stable
+security invoker
+set search_path = ''
+as $$
+  select
+    job.client_id,
+    max(schedule.end_time) as last_completed_at
+  from public.job as job
+  inner join public.job_schedule as schedule
+    on schedule.job_id = job.id
+  where job.company_id = company_id_param
+    and schedule.company_id = company_id_param
+    and job.is_deleted is not true
+    and schedule.status = 'Completed'::public.job_status_enum
+    and schedule.end_time <= now()
+  group by job.client_id;
+$$;
+
+comment on function public.get_client_map_last_completed_jobs(uuid) is
+  'Returns each client''s most recent completed job schedule for the map.';

package/dist/dist/migrations/20260717144535_add_blast_email_invalid_skipped_count.sql

@@ -0,0 +1,2 @@
+alter table "public"."blast_email"
+  add column if not exists "invalid_skipped_count" integer;

package/dist/dist/migrations/20260717162900_create_blast_email_chunk.sql

@@ -0,0 +1,36 @@
+create table if not exists "public"."blast_email_chunk" (
+    "id" uuid default gen_random_uuid() not null,
+    "created_at" timestamp with time zone default now() not null,
+    "blast_email_id" uuid not null,
+    "company_id" uuid not null,
+    "qstash_message_id" text not null,
+    "status" text not null,
+    -- per-chunk delivery outcomes; blast_email totals are derived by
+    -- aggregating these, so concurrent chunk workers never lose updates
+    "successful_count" integer,
+    "failed_count" integer,
+    -- when the worker claimed this chunk; a chunk 'processing' for longer
+    -- than the worker's max runtime belongs to a hard-killed worker and is
+    -- reaped as failed so the blast can still complete
+    "claimed_at" timestamp with time zone,
+    "recipient_count" integer
+);
+
+alter table only "public"."blast_email_chunk"
+    add constraint "blast_email_chunk_pkey" primary key ("id");
+
+alter table only "public"."blast_email_chunk"
+    add constraint "blast_email_chunk_blast_email_id_fkey"
+    foreign key ("blast_email_id") references "public"."blast_email"("id") on delete cascade;
+
+alter table only "public"."blast_email_chunk"
+    add constraint "blast_email_chunk_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete cascade;
+
+-- The worker cancels remaining chunks by blast_email_id on abort, and claims
+-- each chunk by qstash_message_id on every invocation.
+create index if not exists "blast_email_chunk_blast_email_id_idx"
+    on "public"."blast_email_chunk" ("blast_email_id");
+
+create index if not exists "blast_email_chunk_qstash_message_id_idx"
+    on "public"."blast_email_chunk" ("qstash_message_id");

package/dist/dist/migrations/20260717162901_add_blast_email_chunk_rls.sql

@@ -0,0 +1,5 @@
+alter table "public"."blast_email_chunk" enable row level security;
+
+create policy "Read-only for matching companyId" on "public"."blast_email_chunk"
+    for select to "authenticated"
+    using (((NULLIF(TRIM(BOTH '"' FROM ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"));

package/dist/dist/migrations/20260717162902_add_blast_email_chunk_progress_columns.sql

@@ -0,0 +1,3 @@
+alter table "public"."blast_email"
+    add column if not exists "total_chunks" integer,
+    add column if not exists "processed_chunks" integer;

package/dist/dist/migrations/20260717162903_add_blast_email_bounce_tracking_columns.sql

@@ -0,0 +1,4 @@
+alter table "public"."blast_email"
+    add column if not exists "send_started_at" timestamp with time zone,
+    add column if not exists "bounce_count" integer,
+    add column if not exists "aborted_reason" text;

package/dist/dist/migrations/20260717162904_create_email_hard_bounced.sql

@@ -0,0 +1,23 @@
+create table if not exists "public"."email_hard_bounced" (
+    "id" uuid default gen_random_uuid() not null,
+    "created_at" timestamp with time zone default now() not null,
+    "recipient_email" text not null,
+    "company_id" uuid
+);
+
+alter table only "public"."email_hard_bounced"
+    add constraint "email_hard_bounced_pkey" primary key ("id");
+
+alter table only "public"."email_hard_bounced"
+    add constraint "email_hard_bounced_recipient_email_key" unique ("recipient_email");
+
+-- Suppression lookups compare lowercased addresses; enforce the invariant at
+-- the database so a mixed-case insert can't silently bypass the unique
+-- constraint and the send-time filter.
+alter table only "public"."email_hard_bounced"
+    add constraint "email_hard_bounced_recipient_email_lower_check"
+    check (recipient_email = lower(recipient_email));
+
+alter table only "public"."email_hard_bounced"
+    add constraint "email_hard_bounced_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete set null;

package/dist/dist/migrations/20260717162905_add_email_hard_bounced_rls.sql

@@ -0,0 +1,5 @@
+alter table "public"."email_hard_bounced" enable row level security;
+
+create policy "Read-only for matching companyId" on "public"."email_hard_bounced"
+    for select to "authenticated"
+    using (((NULLIF(TRIM(BOTH '"' FROM ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"));

package/dist/dist/migrations/20260717164837_add_sequence_contact_sent_at.sql

@@ -0,0 +1,19 @@
+-- The sequences cron fetches sequence_contact rows whose when_to_send matches
+-- the current minute and sends them with no send-time claim: two invocations
+-- landing in the same minute (overlapping runs, a manual trigger next to the
+-- schedule) would each send the full batch. Blasts and reminders already claim
+-- before sending; this brings sequences in line.
+--
+-- sent_at is the claim marker. The cron atomically sets it (update ... where
+-- sent_at is null, returning claimed ids) and only sends the rows it won.
+-- Null = not yet sent; non-null = claimed by a send attempt. A claim is never
+-- released even if the send then fails - after any network call we can't know
+-- whether the message was delivered, so releasing could double-text (same
+-- fail-closed semantics as reminder_dispatch). Rows are kept after they
+-- execute, so sent_at also serves as sent history going forward.
+--
+-- No backfill: already-executed rows keep sent_at null, which is safe because
+-- the cron only ever matches when_to_send against the current minute, so past
+-- rows can never fire again.
+alter table public.sequence_contact
+  add column sent_at timestamp with time zone;

package/dist/dist/migrations/20260717170920_add_sequence_contact_claim_index.sql

@@ -0,0 +1,12 @@
+-- Support the sequences cron's due-row lookup (when_to_send = <minute> and
+-- sent_at is null). sequence_contact rows are kept forever as history, and
+-- the only existing indexes are the id primary key and the #62 unique
+-- constraint, which leads on client_id and can't serve a when_to_send
+-- lookup - so every cron tick would seq-scan an ever-growing table.
+--
+-- Partial on sent_at is null so the index only ever holds unsent rows:
+-- claimed rows drop out automatically, keeping the hot set at roughly the
+-- currently scheduled future sends regardless of how much history piles up.
+create index sequence_contact_unsent_when_to_send_idx
+  on public.sequence_contact (when_to_send)
+  where sent_at is null;

package/dist/dist/migrations/20260719215139_create_outbound_event.sql

@@ -0,0 +1,59 @@
+-- Outbound event log ("outbox") for integration webhooks.
+-- AFTER triggers on client/job/invoice/estimate (and their child tables)
+-- append rows here; a worker in autopilot-web fans them out to
+-- webhook_subscription targets. The event log is deliberately separate from
+-- delivery bookkeeping (webhook_delivery) so additional consumers (e.g. a
+-- future QuickBooks sync rewrite) can read the same events.
+--
+-- Payloads are composed at delivery time by re-reading the entity, so events
+-- carry no snapshot except for *.deleted events, whose rows no longer exist
+-- by the time the worker runs.
+
+create table if not exists "public"."outbound_event" (
+    "id" uuid default gen_random_uuid() not null,
+    "created_at" timestamp with time zone default now() not null,
+    "company_id" uuid not null,
+    "entity_type" text not null,
+    "entity_id" uuid not null,
+    "event_type" text not null,
+    -- the physical operation that fired the trigger (INSERT/UPDATE/DELETE);
+    -- differs from event_type when a child-table write emits a parent
+    -- .updated event
+    "op" text not null,
+    -- table whose trigger emitted the event, e.g. 'job_item' for a
+    -- line-item change that surfaces as job.updated
+    "source_table" text not null,
+    -- to_jsonb(OLD) for *.deleted events only; null otherwise
+    "snapshot" jsonb,
+    -- set once the fan-out pass has created webhook_delivery rows (or
+    -- determined there are no subscribers)
+    "processed_at" timestamp with time zone
+);
+
+alter table only "public"."outbound_event"
+    add constraint "outbound_event_pkey" primary key ("id");
+
+alter table only "public"."outbound_event"
+    add constraint "outbound_event_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete cascade;
+
+alter table only "public"."outbound_event"
+    add constraint "outbound_event_entity_type_check"
+    check ("entity_type" in ('client', 'job', 'invoice', 'estimate'));
+
+alter table only "public"."outbound_event"
+    add constraint "outbound_event_event_type_check"
+    check ("event_type" ~ '^(client|job|invoice|estimate)\.(created|updated|deleted)$');
+
+alter table only "public"."outbound_event"
+    add constraint "outbound_event_op_check"
+    check ("op" in ('INSERT', 'UPDATE', 'DELETE'));
+
+-- fan-out pass reads oldest-first among unprocessed
+create index if not exists "outbound_event_unprocessed_idx"
+    on "public"."outbound_event" ("created_at")
+    where "processed_at" is null;
+
+-- entity history lookups (debugging, future consumers)
+create index if not exists "outbound_event_entity_idx"
+    on "public"."outbound_event" ("company_id", "entity_type", "entity_id", "created_at");

package/dist/dist/migrations/20260719215140_create_outbound_event_rls.sql

@@ -0,0 +1,16 @@
+-- RLS: outbound_event is service-role only.
+--
+-- DELIBERATE DEVIATION from the house grant-all + company_id-policy pattern:
+-- this is internal pipeline state (including to_jsonb snapshots of deleted
+-- rows) with no product surface; browser/mobile clients never read or write
+-- it. All access goes through autopilot-web server routes via the service
+-- role. RLS is enabled with no policies, and the default-privilege grants to
+-- anon/authenticated are revoked so an accidentally-added permissive policy
+-- still can't expose it.
+
+alter table "public"."outbound_event" enable row level security;
+
+revoke all on table "public"."outbound_event" from "anon";
+revoke all on table "public"."outbound_event" from "authenticated";
+
+grant all on table "public"."outbound_event" to "service_role";

package/dist/dist/migrations/20260719215141_create_webhook_delivery.sql

@@ -0,0 +1,99 @@
+-- Per-subscription webhook delivery bookkeeping. The fan-out pass in
+-- autopilot-web creates one row per (outbound_event x matching
+-- webhook_subscription); the delivery pass claims due rows via
+-- claim_webhook_deliveries, POSTs to the target, and records the outcome.
+-- Retry state is just next_attempt_at in the future, so retries need no
+-- external scheduler.
+
+create table if not exists "public"."webhook_delivery" (
+    "id" uuid default gen_random_uuid() not null,
+    "created_at" timestamp with time zone default now() not null,
+    "event_id" uuid not null,
+    "subscription_id" uuid not null,
+    "company_id" uuid not null,
+    -- the event_type string the SUBSCRIBER registered with; may be a legacy
+    -- alias ('new_client') rather than the canonical name ('client.created'),
+    -- which tells the worker to send the legacy payload shape
+    "event_type" text not null,
+    "status" text default 'pending' not null,
+    "attempt_count" integer default 0 not null,
+    "next_attempt_at" timestamp with time zone default now() not null,
+    "last_attempt_at" timestamp with time zone,
+    "last_response_status" integer,
+    "last_error" text
+);
+
+alter table only "public"."webhook_delivery"
+    add constraint "webhook_delivery_pkey" primary key ("id");
+
+-- one delivery per (event, subscription): overlapping fan-out runs (the cron
+-- fires every minute but a run may take several) both select the same
+-- unprocessed events; this constraint + ON CONFLICT DO NOTHING on the insert
+-- collapses their duplicate rows at the DB level
+alter table only "public"."webhook_delivery"
+    add constraint "webhook_delivery_event_subscription_key" unique ("event_id", "subscription_id");
+
+alter table only "public"."webhook_delivery"
+    add constraint "webhook_delivery_event_id_fkey"
+    foreign key ("event_id") references "public"."outbound_event"("id") on delete cascade;
+
+alter table only "public"."webhook_delivery"
+    add constraint "webhook_delivery_subscription_id_fkey"
+    foreign key ("subscription_id") references "public"."webhook_subscription"("id") on delete cascade;
+
+alter table only "public"."webhook_delivery"
+    add constraint "webhook_delivery_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete cascade;
+
+-- pending: waiting for next_attempt_at
+-- delivering: claimed by a worker run (stuck rows are swept back to pending)
+-- delivered: target returned 2xx
+-- skipped: superseded (entity gone, or subscription deactivated mid-flight)
+-- dead: exhausted all retry attempts; kept for inspection
+alter table only "public"."webhook_delivery"
+    add constraint "webhook_delivery_status_check"
+    check ("status" in ('pending', 'delivering', 'delivered', 'skipped', 'dead'));
+
+-- delivery pass claims due rows
+create index if not exists "webhook_delivery_due_idx"
+    on "public"."webhook_delivery" ("next_attempt_at")
+    where "status" = 'pending';
+
+-- per-subscription history (consecutive-failure deactivation, debugging)
+create index if not exists "webhook_delivery_sub_idx"
+    on "public"."webhook_delivery" ("subscription_id", "created_at");
+
+-- FK support: company deletion cascades through this table, which will be
+-- one of the largest in the system — without this it seq-scans
+create index if not exists "webhook_delivery_company_idx"
+    on "public"."webhook_delivery" ("company_id");
+
+-- Atomically claim up to batch_size due deliveries. FOR UPDATE SKIP LOCKED
+-- isn't expressible through supabase-js, and claiming must be atomic so
+-- overlapping cron runs never double-send.
+create or replace function "public"."claim_webhook_deliveries"("batch_size" integer)
+returns setof "public"."webhook_delivery"
+language "sql"
+security definer
+set search_path = 'public'
+as $$
+  update webhook_delivery set
+    status = 'delivering',
+    attempt_count = attempt_count + 1,
+    last_attempt_at = now()
+  where id in (
+    select id from webhook_delivery
+    where status = 'pending' and next_attempt_at <= now()
+    order by next_attempt_at
+    -- server-side cap: an accidental huge batch_size must not lock an
+    -- unbounded number of rows in one transaction
+    limit least(batch_size, 1000)
+    for update skip locked
+  )
+  returning *;
+$$;
+
+revoke all on function "public"."claim_webhook_deliveries"(integer) from public;
+revoke all on function "public"."claim_webhook_deliveries"(integer) from "anon";
+revoke all on function "public"."claim_webhook_deliveries"(integer) from "authenticated";
+grant execute on function "public"."claim_webhook_deliveries"(integer) to "service_role";

package/dist/dist/migrations/20260719215142_create_webhook_delivery_rls.sql

@@ -0,0 +1,11 @@
+-- RLS: webhook_delivery is service-role only.
+-- Same deliberate deviation (and rationale) as outbound_event_rls: internal
+-- pipeline state with no product surface; all access via server routes using
+-- the service role.
+
+alter table "public"."webhook_delivery" enable row level security;
+
+revoke all on table "public"."webhook_delivery" from "anon";
+revoke all on table "public"."webhook_delivery" from "authenticated";
+
+grant all on table "public"."webhook_delivery" to "service_role";