autopilot-core-sandbox 0.0.1

package/dist/dist/migrations/20260719215148_api_aggregate_create_functions.sql

@@ -0,0 +1,479 @@
+-- Atomic aggregate creates for the public API (/api/v1 in autopilot-web).
+-- supabase-js has no transactions, so each multi-table create is one SQL
+-- function: either the whole aggregate lands or nothing does — which also
+-- means the outbox triggers (same transaction) emit zero events on failure
+-- instead of a created/deleted pair.
+--
+-- These functions are deliberately dumb: shape validation lives in the web
+-- service layer (zod); here we only insert, plus cross-tenant guards on
+-- every referenced id (a payload must not be able to attach company A's
+-- records to company B by smuggling foreign uuids). Number assignment
+-- (job/invoice/estimate counters) happens in the existing BEFORE triggers.
+--
+-- security definer + service_role-only execute: called exclusively via
+-- supabaseAdmin from autopilot-web, with company_id injected server-side
+-- from the authenticated credential — never from the caller's payload.
+
+-- ============================================================
+-- helpers
+-- ============================================================
+
+-- raises unless the referenced row exists and belongs to the company;
+-- soft no-op when p_id is null (optional references)
+create or replace function "public"."api_assert_company_ref"(
+    "p_table" text,
+    "p_id" uuid,
+    "p_company_id" uuid
+)
+returns void
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+declare
+    v_ok boolean;
+begin
+    if p_id is null then
+        return;
+    end if;
+    -- p_table comes from the api_create_* bodies below, never caller input
+    execute format('select exists (select 1 from public.%I where id = $1 and company_id = $2)', p_table)
+        into v_ok using p_id, p_company_id;
+    if not v_ok then
+        raise exception '% % not found for company', p_table, p_id
+            using errcode = 'P0002';
+    end if;
+end;
+$$;
+
+revoke all on function "public"."api_assert_company_ref"(text, uuid, uuid) from public;
+revoke all on function "public"."api_assert_company_ref"(text, uuid, uuid) from "anon";
+revoke all on function "public"."api_assert_company_ref"(text, uuid, uuid) from "authenticated";
+grant execute on function "public"."api_assert_company_ref"(text, uuid, uuid) to "service_role";
+
+-- assignments must go to current employees; former/hidden employees aren't
+-- offered by /v1/users, so accepting their ids here would be incoherent
+create or replace function "public"."api_assert_active_user"(
+    "p_id" uuid,
+    "p_company_id" uuid
+)
+returns void
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+begin
+    if not exists (
+        select 1 from "user" u
+        where u.id = p_id
+          and u.company_id = p_company_id
+          and u.is_current_employee
+    ) then
+        raise exception 'user % not found for company or not a current employee', p_id
+            using errcode = 'P0002';
+    end if;
+end;
+$$;
+
+revoke all on function "public"."api_assert_active_user"(uuid, uuid) from public;
+revoke all on function "public"."api_assert_active_user"(uuid, uuid) from "anon";
+revoke all on function "public"."api_assert_active_user"(uuid, uuid) from "authenticated";
+grant execute on function "public"."api_assert_active_user"(uuid, uuid) to "service_role";
+
+-- resolves the company's default tax rate, mirroring the in-app create
+-- paths (JobsProvider/InvoicesProvider fetch is_default when none is given)
+create or replace function "public"."api_default_tax_rate_id"("p_company_id" uuid)
+returns uuid
+language "sql"
+security definer
+set search_path = 'public'
+as $$
+    select id from tax_rate
+    where company_id = p_company_id and is_default and is_enabled
+    limit 1;
+$$;
+
+revoke all on function "public"."api_default_tax_rate_id"(uuid) from public;
+revoke all on function "public"."api_default_tax_rate_id"(uuid) from "anon";
+revoke all on function "public"."api_default_tax_rate_id"(uuid) from "authenticated";
+grant execute on function "public"."api_default_tax_rate_id"(uuid) to "service_role";
+
+-- ============================================================
+-- api_create_client
+-- p: { company_id, email?, first_name?, last_name?, client_company_name?,
+--      client_notes?, client_or_lead?, primary_phone_number?, source_id?,
+--      is_do_not_service?, is_do_not_sms?, is_do_not_marketing_sms?,
+--      addresses?: [{ address, address2?, city, state, zip_code, is_primary?,
+--                     latitude?, longitude? }],
+--      tag_ids?: [uuid] }
+-- ============================================================
+
+create or replace function "public"."api_create_client"("p" jsonb)
+returns uuid
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+declare
+    v_company_id uuid := (p ->> 'company_id')::uuid;
+    v_client_id uuid;
+    v_addresses jsonb := coalesce(p -> 'addresses', '[]'::jsonb);
+    v_primary_count integer;
+    a jsonb;
+    v_idx integer := 0;
+    v_tag_id uuid;
+begin
+    perform api_assert_company_ref('job_source', (p ->> 'source_id')::uuid, v_company_id);
+
+    insert into client (
+        company_id, email, first_name, last_name, client_company_name,
+        client_notes, client_or_lead, primary_phone_number, source_id,
+        is_do_not_service, is_do_not_sms, is_do_not_marketing_sms
+    ) values (
+        v_company_id,
+        p ->> 'email',
+        p ->> 'first_name',
+        p ->> 'last_name',
+        p ->> 'client_company_name',
+        p ->> 'client_notes',
+        coalesce((p ->> 'client_or_lead')::client_or_lead_enum, 'client'),
+        p ->> 'primary_phone_number',
+        (p ->> 'source_id')::uuid,
+        coalesce((p ->> 'is_do_not_service')::boolean, false),
+        coalesce((p ->> 'is_do_not_sms')::boolean, false),
+        coalesce((p ->> 'is_do_not_marketing_sms')::boolean, false)
+    ) returning id into v_client_id;
+
+    -- exactly one primary address: error on several; when NONE is marked
+    -- true (absent or explicit false alike), the first becomes primary —
+    -- a client with addresses but no primary is an app-level anomaly
+    select count(*) into v_primary_count
+        from jsonb_array_elements(v_addresses) as t(addr)
+        where (addr ->> 'is_primary')::boolean;
+    if v_primary_count > 1 then
+        raise exception 'at most one address may be primary' using errcode = '23514';
+    end if;
+
+    for a in select * from jsonb_array_elements(v_addresses) loop
+        insert into address (
+            company_id, client_id, address, address2, city, state, zip_code,
+            is_primary, latitude, longitude
+        ) values (
+            v_company_id,
+            v_client_id,
+            a ->> 'address',
+            a ->> 'address2',
+            a ->> 'city',
+            a ->> 'state',
+            a ->> 'zip_code',
+            coalesce((a ->> 'is_primary')::boolean, false)
+                or (v_primary_count = 0 and v_idx = 0),
+            (a ->> 'latitude')::double precision,
+            (a ->> 'longitude')::double precision
+        );
+        v_idx := v_idx + 1;
+    end loop;
+
+    for v_tag_id in select value::uuid from jsonb_array_elements_text(coalesce(p -> 'tag_ids', '[]'::jsonb)) loop
+        perform api_assert_company_ref('client_tag', v_tag_id, v_company_id);
+        insert into client_tag_link (company_id, client_id, client_tag_id)
+        values (v_company_id, v_client_id, v_tag_id);
+    end loop;
+
+    return v_client_id;
+end;
+$$;
+
+-- ============================================================
+-- api_create_job
+-- p: { company_id, client_id, status?, start_date?, end_date?, notes?,
+--      address_id?, job_source?, type?, tags?, tax_rate_id?, estimate_id?,
+--      unpaid_upfront?,
+--      items?: [{ item_name, item_price, item_cost?, quantity?, taxable?,
+--                 description?, payment_upfront? }],
+--      schedules?: [{ start_time, end_time, status?, assignee_user_ids?: [uuid] }],
+--      discounts?: [{ discount_name?, discount_amount, discount_type }] }
+-- ============================================================
+
+create or replace function "public"."api_create_job"("p" jsonb)
+returns uuid
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+declare
+    v_company_id uuid := (p ->> 'company_id')::uuid;
+    v_job_id uuid;
+    v_schedule_id uuid;
+    v_status job_status_enum := coalesce((p ->> 'status')::job_status_enum, 'Open');
+    it jsonb;
+    sc jsonb;
+    di jsonb;
+    v_user_id uuid;
+begin
+    perform api_assert_company_ref('client', (p ->> 'client_id')::uuid, v_company_id);
+    perform api_assert_company_ref('address', (p ->> 'address_id')::uuid, v_company_id);
+    perform api_assert_company_ref('tax_rate', (p ->> 'tax_rate_id')::uuid, v_company_id);
+    perform api_assert_company_ref('estimate', (p ->> 'estimate_id')::uuid, v_company_id);
+
+    insert into job (
+        company_id, client_id, status, start_date, end_date, notes,
+        address_id, job_source, type, tags, tax_rate_id, estimate_id,
+        unpaid_upfront
+    ) values (
+        v_company_id,
+        (p ->> 'client_id')::uuid,
+        v_status,
+        (p ->> 'start_date')::timestamptz,
+        (p ->> 'end_date')::timestamptz,
+        p ->> 'notes',
+        (p ->> 'address_id')::uuid,
+        coalesce(p ->> 'job_source', ''),
+        -- deliberately NOT the column default ('Junk Removal'): job types
+        -- are per-company (job_type table), so inventing one that may not
+        -- exist in the company's picker is worse than null
+        p ->> 'type',
+        p ->> 'tags',
+        -- absent tax_rate_id falls back to the company default, matching
+        -- the in-app createJob path
+        coalesce((p ->> 'tax_rate_id')::uuid, api_default_tax_rate_id(v_company_id)),
+        (p ->> 'estimate_id')::uuid,
+        (p ->> 'unpaid_upfront')::boolean
+    ) returning id into v_job_id;
+
+    for it in select * from jsonb_array_elements(coalesce(p -> 'items', '[]'::jsonb)) loop
+        insert into job_item (
+            company_id, job_id, item_name, item_price, item_cost, quantity,
+            taxable, description, payment_upfront
+        ) values (
+            v_company_id,
+            v_job_id,
+            it ->> 'item_name',
+            (it ->> 'item_price')::numeric,
+            coalesce((it ->> 'item_cost')::numeric, 0),
+            coalesce((it ->> 'quantity')::numeric, 1),
+            coalesce((it ->> 'taxable')::boolean, true),
+            it ->> 'description',
+            (it ->> 'payment_upfront')::boolean
+        );
+    end loop;
+
+    for sc in select * from jsonb_array_elements(coalesce(p -> 'schedules', '[]'::jsonb)) loop
+        insert into job_schedule (company_id, job_id, start_time, end_time, status)
+        values (
+            v_company_id,
+            v_job_id,
+            (sc ->> 'start_time')::timestamptz,
+            (sc ->> 'end_time')::timestamptz,
+            coalesce((sc ->> 'status')::job_status_enum, v_status)
+        ) returning id into v_schedule_id;
+
+        for v_user_id in select value::uuid from jsonb_array_elements_text(coalesce(sc -> 'assignee_user_ids', '[]'::jsonb)) loop
+            perform api_assert_active_user(v_user_id, v_company_id);
+            insert into job_user (company_id, job_id, job_schedule_id, user_id)
+            values (v_company_id, v_job_id, v_schedule_id, v_user_id);
+        end loop;
+    end loop;
+
+    for di in select * from jsonb_array_elements(coalesce(p -> 'discounts', '[]'::jsonb)) loop
+        insert into job_discount (company_id, job_id, discount_name, discount_amount, discount_type)
+        values (
+            v_company_id,
+            v_job_id,
+            coalesce(di ->> 'discount_name', ''),
+            (di ->> 'discount_amount')::double precision,
+            (di ->> 'discount_type')::discount_type_enum
+        );
+    end loop;
+
+    return v_job_id;
+end;
+$$;
+
+-- ============================================================
+-- api_create_invoice
+-- p: { company_id, client_id, status?, job_id?, address_id?, due_date?,
+--      start_date?, end_date?, notes?, tax_rate_id?,
+--      items?: [...same shape as job items...],
+--      discounts?: [...same shape as job discounts...] }
+-- Items/discounts are attached to the invoice only (invoice_id set, job_id
+-- null) — linking a job's existing items onto an invoice is an update-path
+-- concern, not a create-path one.
+-- ============================================================
+
+create or replace function "public"."api_create_invoice"("p" jsonb)
+returns uuid
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+declare
+    v_company_id uuid := (p ->> 'company_id')::uuid;
+    v_invoice_id uuid;
+    it jsonb;
+    di jsonb;
+begin
+    perform api_assert_company_ref('client', (p ->> 'client_id')::uuid, v_company_id);
+    perform api_assert_company_ref('job', (p ->> 'job_id')::uuid, v_company_id);
+    perform api_assert_company_ref('address', (p ->> 'address_id')::uuid, v_company_id);
+    perform api_assert_company_ref('tax_rate', (p ->> 'tax_rate_id')::uuid, v_company_id);
+
+    insert into invoice (
+        company_id, client_id, status, job_id, address_id, due_date,
+        start_date, end_date, notes, tax_rate_id
+    ) values (
+        v_company_id,
+        (p ->> 'client_id')::uuid,
+        coalesce((p ->> 'status')::invoice_status_enum, 'Unsent'),
+        (p ->> 'job_id')::uuid,
+        (p ->> 'address_id')::uuid,
+        coalesce((p ->> 'due_date')::timestamptz, now()),
+        (p ->> 'start_date')::timestamptz,
+        (p ->> 'end_date')::timestamptz,
+        coalesce(p ->> 'notes', ''),
+        -- standalone invoices fall back to the company default tax rate,
+        -- matching in-app createInvoice; job-linked invoices take exactly
+        -- what was passed (the app copies the job's rate in that path)
+        case
+            when (p ->> 'job_id') is null
+                then coalesce((p ->> 'tax_rate_id')::uuid, api_default_tax_rate_id(v_company_id))
+            else (p ->> 'tax_rate_id')::uuid
+        end
+    ) returning id into v_invoice_id;
+
+    for it in select * from jsonb_array_elements(coalesce(p -> 'items', '[]'::jsonb)) loop
+        insert into job_item (
+            company_id, invoice_id, item_name, item_price, item_cost,
+            quantity, taxable, description, payment_upfront
+        ) values (
+            v_company_id,
+            v_invoice_id,
+            it ->> 'item_name',
+            (it ->> 'item_price')::numeric,
+            coalesce((it ->> 'item_cost')::numeric, 0),
+            coalesce((it ->> 'quantity')::numeric, 1),
+            coalesce((it ->> 'taxable')::boolean, true),
+            it ->> 'description',
+            (it ->> 'payment_upfront')::boolean
+        );
+    end loop;
+
+    for di in select * from jsonb_array_elements(coalesce(p -> 'discounts', '[]'::jsonb)) loop
+        insert into job_discount (company_id, invoice_id, discount_name, discount_amount, discount_type)
+        values (
+            v_company_id,
+            v_invoice_id,
+            coalesce(di ->> 'discount_name', ''),
+            (di ->> 'discount_amount')::double precision,
+            (di ->> 'discount_type')::discount_type_enum
+        );
+    end loop;
+
+    return v_invoice_id;
+end;
+$$;
+
+-- ============================================================
+-- api_create_estimate
+-- p: { company_id, client_id, status?, notes?, address_id?, tax_rate_id?,
+--      show_on_schedule?, schedule_start?, schedule_end?, schedule_status?,
+--      items?: [{ item_name, item_price, item_cost?, quantity?, taxable?,
+--                 description?, payment_upfront? }],
+--      discounts?: [{ discount_name?, discount_amount, discount_type }],
+--      assignee_user_ids?: [uuid] }
+-- ============================================================
+
+create or replace function "public"."api_create_estimate"("p" jsonb)
+returns uuid
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+declare
+    v_company_id uuid := (p ->> 'company_id')::uuid;
+    v_estimate_id uuid;
+    it jsonb;
+    di jsonb;
+    v_user_id uuid;
+begin
+    perform api_assert_company_ref('client', (p ->> 'client_id')::uuid, v_company_id);
+    perform api_assert_company_ref('address', (p ->> 'address_id')::uuid, v_company_id);
+    perform api_assert_company_ref('tax_rate', (p ->> 'tax_rate_id')::uuid, v_company_id);
+
+    insert into estimate (
+        company_id, client_id, status, notes, address_id, tax_rate_id,
+        show_on_schedule, schedule_start, schedule_end, schedule_status
+    ) values (
+        v_company_id,
+        (p ->> 'client_id')::uuid,
+        coalesce((p ->> 'status')::estimate_status_enum, 'Unsent'),
+        p ->> 'notes',
+        (p ->> 'address_id')::uuid,
+        (p ->> 'tax_rate_id')::uuid,
+        coalesce((p ->> 'show_on_schedule')::boolean, false),
+        (p ->> 'schedule_start')::timestamptz,
+        (p ->> 'schedule_end')::timestamptz,
+        (p ->> 'schedule_status')::job_status_enum
+    ) returning id into v_estimate_id;
+
+    for it in select * from jsonb_array_elements(coalesce(p -> 'items', '[]'::jsonb)) loop
+        insert into estimate_item (
+            company_id, estimate_id, item_name, item_price, item_cost,
+            quantity, taxable, description, payment_upfront
+        ) values (
+            v_company_id,
+            v_estimate_id,
+            it ->> 'item_name',
+            (it ->> 'item_price')::numeric,
+            coalesce((it ->> 'item_cost')::numeric, 0),
+            coalesce((it ->> 'quantity')::numeric, 1),
+            coalesce((it ->> 'taxable')::boolean, true),
+            it ->> 'description',
+            (it ->> 'payment_upfront')::boolean
+        );
+    end loop;
+
+    for di in select * from jsonb_array_elements(coalesce(p -> 'discounts', '[]'::jsonb)) loop
+        insert into estimate_discount (company_id, estimate_id, discount_name, discount_amount, discount_type)
+        values (
+            v_company_id,
+            v_estimate_id,
+            coalesce(di ->> 'discount_name', ''),
+            (di ->> 'discount_amount')::double precision,
+            (di ->> 'discount_type')::discount_type_enum
+        );
+    end loop;
+
+    for v_user_id in select value::uuid from jsonb_array_elements_text(coalesce(p -> 'assignee_user_ids', '[]'::jsonb)) loop
+        perform api_assert_active_user(v_user_id, v_company_id);
+        insert into estimate_user (company_id, estimate_id, user_id)
+        values (v_company_id, v_estimate_id, v_user_id);
+    end loop;
+
+    return v_estimate_id;
+end;
+$$;
+
+-- ============================================================
+-- grants: service_role only
+-- ============================================================
+
+revoke all on function "public"."api_create_client"(jsonb) from public;
+revoke all on function "public"."api_create_client"(jsonb) from "anon";
+revoke all on function "public"."api_create_client"(jsonb) from "authenticated";
+grant execute on function "public"."api_create_client"(jsonb) to "service_role";
+
+revoke all on function "public"."api_create_job"(jsonb) from public;
+revoke all on function "public"."api_create_job"(jsonb) from "anon";
+revoke all on function "public"."api_create_job"(jsonb) from "authenticated";
+grant execute on function "public"."api_create_job"(jsonb) to "service_role";
+
+revoke all on function "public"."api_create_invoice"(jsonb) from public;
+revoke all on function "public"."api_create_invoice"(jsonb) from "anon";
+revoke all on function "public"."api_create_invoice"(jsonb) from "authenticated";
+grant execute on function "public"."api_create_invoice"(jsonb) to "service_role";
+
+revoke all on function "public"."api_create_estimate"(jsonb) from public;
+revoke all on function "public"."api_create_estimate"(jsonb) from "anon";
+revoke all on function "public"."api_create_estimate"(jsonb) from "authenticated";
+grant execute on function "public"."api_create_estimate"(jsonb) to "service_role";

package/dist/dist/migrations/20260721174837_webhook_subscription_generic_endpoints.sql

@@ -0,0 +1,41 @@
+-- webhook_subscription: support user-managed (non-Zapier) webhook endpoints.
+--
+-- A user-facing "webhook endpoint" is one target URL subscribed to N event
+-- types, stored as N webhook_subscription rows sharing an endpoint_id and a
+-- single signing secret. The delivery worker matches per-row on
+-- (company_id, event_type, is_active) and never reads the grouping, so
+-- fan-out/delivery/backoff/deactivation are unchanged.
+--
+-- source default 'zapier' doubles as the backfill: the Zapier subscribe route
+-- was the only creation path before this, and that route keeps inserting
+-- without code changes. User-managed paths write source = 'user' explicitly.
+-- Zapier rows keep endpoint_id null and stay managed exclusively from Zapier.
+
+alter table "public"."webhook_subscription"
+    add column if not exists "source" text default 'zapier' not null,
+    add column if not exists "endpoint_id" uuid,
+    add column if not exists "label" text;
+
+alter table "public"."webhook_subscription"
+    add constraint "webhook_subscription_source_check"
+    check ("source" in ('zapier', 'user'));
+
+-- A user row without an endpoint_id would still be delivered by the worker but
+-- be invisible to the management UI (which filters on both columns) — an
+-- active webhook the customer can't see or delete. Enforce the pairing here.
+alter table "public"."webhook_subscription"
+    add constraint "webhook_subscription_source_endpoint_check"
+    check (
+        ("source" = 'zapier' and "endpoint_id" is null) or
+        ("source" = 'user' and "endpoint_id" is not null)
+    );
+
+-- one row per (endpoint, event type)
+create unique index if not exists "webhook_subscription_endpoint_event_key"
+    on "public"."webhook_subscription" ("endpoint_id", "event_type")
+    where "endpoint_id" is not null;
+
+-- management API / settings UI listing
+create index if not exists "webhook_subscription_endpoint_idx"
+    on "public"."webhook_subscription" ("company_id", "endpoint_id")
+    where "endpoint_id" is not null;

package/dist/dist/migrations/20260721185631_webhook_outbox_retention.sql

@@ -0,0 +1,87 @@
+-- Retention support for the webhook outbox. A nightly cron in autopilot-web
+-- (/api/webhook-retention-cron) calls cleanup_webhook_outbox to purge
+-- terminal webhook_delivery rows and processed outbound_event rows past
+-- their retention windows (30 days for deliveries, 90 days for events).
+--
+-- The delivery window must stay UNIFORM across all terminal statuses
+-- ('delivered', 'skipped', 'dead'): the outbox worker's
+-- deactivate-persistently-dead check counts dead rows created after the most
+-- recent delivered row, and purging statuses on different schedules could
+-- pull pre-success dead rows into that count.
+
+-- Cleanup scans "old + terminal"; the existing partial index on
+-- outbound_event covers only the opposite (unprocessed) predicate.
+create index if not exists "outbound_event_cleanup_idx"
+    on "public"."outbound_event" ("created_at")
+    where "processed_at" is not null;
+
+create index if not exists "webhook_delivery_cleanup_idx"
+    on "public"."webhook_delivery" ("created_at")
+    where "status" in ('delivered', 'skipped', 'dead');
+
+create or replace function "public"."cleanup_webhook_outbox"(
+    "event_retention_days" integer,
+    "delivery_retention_days" integer,
+    "batch_size" integer
+)
+returns table ("deliveries_deleted" integer, "events_deleted" integer)
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+declare
+  -- floor of 7 days: a miscalled 0 must never purge fresh history
+  event_cutoff timestamptz :=
+    now() - make_interval(days => greatest(event_retention_days, 7));
+  delivery_cutoff timestamptz :=
+    now() - make_interval(days => greatest(delivery_retention_days, 7));
+  -- floor of 1: a caller-supplied 0 would otherwise LIMIT 0 into a silent
+  -- no-op, and a negative value is a runtime error
+  capped_batch integer := least(greatest(batch_size, 1), 5000);
+  del_count integer;
+  evt_count integer;
+begin
+  -- Deleting an event cascades its deliveries regardless of delivery_cutoff,
+  -- so the event window must never be the shorter one.
+  if greatest(event_retention_days, 7) < greatest(delivery_retention_days, 7) then
+    raise exception 'event_retention_days (%) must be >= delivery_retention_days (%)',
+      event_retention_days, delivery_retention_days;
+  end if;
+
+  -- Terminal deliveries first, so the outbound_event cascade below touches
+  -- almost nothing and each statement's row count stays bounded.
+  delete from webhook_delivery
+  where id in (
+    select id from webhook_delivery
+    where status in ('delivered', 'skipped', 'dead')
+      and created_at < delivery_cutoff
+    order by created_at
+    limit capped_batch
+  );
+  get diagnostics del_count = row_count;
+
+  delete from outbound_event
+  where id in (
+    select id from outbound_event
+    where processed_at is not null
+      and created_at < event_cutoff
+      -- belt-and-suspenders: never cascade away a live delivery (retries
+      -- terminate ~1.6 days after creation, so this should match nothing)
+      and not exists (
+        select 1 from webhook_delivery d
+        where d.event_id = outbound_event.id
+          and d.status in ('pending', 'delivering')
+      )
+    order by created_at
+    limit capped_batch
+  );
+  get diagnostics evt_count = row_count;
+
+  return query select del_count, evt_count;
+end;
+$$;
+
+revoke all on function "public"."cleanup_webhook_outbox"(integer, integer, integer) from public;
+revoke all on function "public"."cleanup_webhook_outbox"(integer, integer, integer) from "anon";
+revoke all on function "public"."cleanup_webhook_outbox"(integer, integer, integer) from "authenticated";
+grant execute on function "public"."cleanup_webhook_outbox"(integer, integer, integer) to "service_role";