create-bw-app 0.13.3 → 0.14.0

package/template/modules/projects/app/api/projects/[id]/route.ts

@@ -0,0 +1,2 @@
+export const dynamic = "force-dynamic";
+export { projectDashboardGet as GET, projectPatch as PATCH, projectDelete as DELETE } from "../_handlers";

package/template/modules/projects/app/api/projects/[id]/tasks/[itemId]/route.ts

@@ -0,0 +1,2 @@
+export const dynamic = "force-dynamic";
+export { projectTaskPatch as PATCH, projectTaskDelete as DELETE } from "../../../_handlers";

package/template/modules/projects/app/api/projects/[id]/tasks/route.ts

@@ -0,0 +1,2 @@
+export const dynamic = "force-dynamic";
+export { projectTasksPost as POST } from "../../_handlers";

package/template/modules/projects/app/api/projects/_handlers.ts

@@ -0,0 +1,86 @@
+import {
+  handleProjectsActivityGetRequest,
+  handleProjectsAssignableProfilesGetRequest,
+  handleProjectsDashboardGetRequest,
+  handleProjectsDeleteRequest,
+  handleProjectsGetRequest,
+  handleProjectsLinksDeleteRequest,
+  handleProjectsLinksPatchRequest,
+  handleProjectsLinksPostRequest,
+  handleProjectsMembersPutRequest,
+  handleProjectsMilestonesDeleteRequest,
+  handleProjectsMilestonesPatchRequest,
+  handleProjectsMilestonesPostRequest,
+  handleProjectsOrganizationsGetRequest,
+  handleProjectsOrganizationsPostRequest,
+  handleProjectsPatchRequest,
+  handleProjectsPostRequest,
+  handleProjectsStatsGetRequest,
+  handleProjectsTasksDeleteRequest,
+  handleProjectsTasksPatchRequest,
+  handleProjectsTasksPostRequest,
+} from "@brightweblabs/module-projects";
+
+type IdRouteContext = { params: Promise<{ id: string }> };
+type ItemRouteContext = { params: Promise<{ id: string; itemId: string }> };
+
+export function projectsGet(request: Request) {
+  return handleProjectsGetRequest(request);
+}
+export function projectsPost(request: Request) {
+  return handleProjectsPostRequest(request);
+}
+export function projectsStatsGet(request: Request) {
+  return handleProjectsStatsGetRequest(request);
+}
+export function projectsOrganizationsGet(request: Request) {
+  return handleProjectsOrganizationsGetRequest(request);
+}
+export function projectsOrganizationsPost(request: Request) {
+  return handleProjectsOrganizationsPostRequest(request);
+}
+export function projectDashboardGet(request: Request, context: IdRouteContext) {
+  return handleProjectsDashboardGetRequest(request, context);
+}
+export function projectPatch(request: Request, context: IdRouteContext) {
+  return handleProjectsPatchRequest(request, context);
+}
+export function projectDelete(request: Request, context: IdRouteContext) {
+  return handleProjectsDeleteRequest(request, context);
+}
+export function projectActivityGet(request: Request, context: IdRouteContext) {
+  return handleProjectsActivityGetRequest(request, context);
+}
+export function projectMembersGet(request: Request, context: IdRouteContext) {
+  return handleProjectsAssignableProfilesGetRequest(request, context);
+}
+export function projectMembersPut(request: Request, context: IdRouteContext) {
+  return handleProjectsMembersPutRequest(request, context);
+}
+export function projectLinksPost(request: Request, context: IdRouteContext) {
+  return handleProjectsLinksPostRequest(request, context);
+}
+export function projectLinkPatch(request: Request, context: ItemRouteContext) {
+  return handleProjectsLinksPatchRequest(request, context);
+}
+export function projectLinkDelete(request: Request, context: ItemRouteContext) {
+  return handleProjectsLinksDeleteRequest(request, context);
+}
+export function projectMilestonesPost(request: Request, context: IdRouteContext) {
+  return handleProjectsMilestonesPostRequest(request, context);
+}
+export function projectMilestonePatch(request: Request, context: ItemRouteContext) {
+  return handleProjectsMilestonesPatchRequest(request, context);
+}
+export function projectMilestoneDelete(request: Request, context: ItemRouteContext) {
+  return handleProjectsMilestonesDeleteRequest(request, context);
+}
+export function projectTasksPost(request: Request, context: IdRouteContext) {
+  return handleProjectsTasksPostRequest(request, context);
+}
+export function projectTaskPatch(request: Request, context: ItemRouteContext) {
+  return handleProjectsTasksPatchRequest(request, context);
+}
+export function projectTaskDelete(request: Request, context: ItemRouteContext) {
+  return handleProjectsTasksDeleteRequest(request, context);
+}

package/template/modules/projects/app/api/projects/organizations/route.ts

@@ -0,0 +1,2 @@
+export const dynamic = "force-dynamic";
+export { projectsOrganizationsGet as GET, projectsOrganizationsPost as POST } from "../_handlers";

package/template/modules/projects/app/api/projects/route.ts

@@ -0,0 +1,2 @@
+export const dynamic = "force-dynamic";
+export { projectsGet as GET, projectsPost as POST } from "./_handlers";

package/template/modules/projects/app/api/projects/stats/route.ts

@@ -0,0 +1,2 @@
+export const dynamic = "force-dynamic";
+export { projectsStatsGet as GET } from "../_handlers";

package/template/supabase/README.md

@@ -10,6 +10,7 @@ This directory is the scaffold-owned home for the Brightweb shared database modu
 - `modules/core`: always-on platform foundations
 - `modules/admin`: RBAC and privileged governance behavior
 - `modules/crm`: organizations, CRM contacts, and invitation flows
+- `modules/marketing`: consent, campaigns, segments, analytics, and workflows
 - `modules/projects`: project and work-management data
 - `clients/<client-slug>`: true client-only schema deltas plus the client stack plan
 - `clients/<client-slug>`: client stack metadata and client-only migrations for this project
@@ -40,6 +41,7 @@ Create a new shared module migration:
 pnpm db:new core profile_notification_cursor
 pnpm db:new admin role_change_guard
 pnpm db:new crm organization_invite_expiry
+pnpm db:new marketing campaign_delivery_guard
 pnpm db:new projects task_due_date_index
 ```
 
@@ -58,5 +60,6 @@ Projects created from the published scaffold should use the Supabase files in th
 - `supabase/modules/core/README.md`
 - `supabase/modules/admin/README.md`
 - `supabase/modules/crm/README.md`
+- `supabase/modules/marketing/README.md`
 - `supabase/modules/projects/README.md`
 - `supabase/clients/README.md`

package/template/supabase/module-registry.json

@@ -24,6 +24,12 @@
       "dependsOn": ["core", "admin", "orgs"],
       "description": "CRM contacts, status tracking, and organization integration."
     },
+    "marketing": {
+      "label": "Marketing",
+      "path": "supabase/modules/marketing/migrations",
+      "dependsOn": ["core", "admin", "orgs", "crm"],
+      "description": "Consent-first marketing topics, subscriptions, campaigns, segments, analytics, and workflows."
+    },
     "projects": {
       "label": "Projects",
       "path": "supabase/modules/projects/migrations",

package/template/supabase/modules/marketing/README.md

@@ -0,0 +1,12 @@
+# Marketing Migrations
+
+`marketing` owns consent, campaign delivery, segmentation, analytics, and workflow automation data.
+
+## Dependency
+
+Depends on:
+
+- `core`
+- `admin`
+- `orgs`
+- `crm`

package/template/supabase/modules/marketing/migrations/20260725120000_marketing_v1.sql

@@ -0,0 +1,118 @@
+-- Brightweb Marketing v1: consent, contact preferences, and suppression.
+
+CREATE TABLE IF NOT EXISTS public.marketing_topics (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  slug text NOT NULL UNIQUE,
+  label text NOT NULL,
+  description text,
+  is_active boolean NOT NULL DEFAULT true,
+  position integer NOT NULL DEFAULT 0,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now()
+);
+
+INSERT INTO public.marketing_topics (slug, label, description, position)
+VALUES
+  ('newsletter', 'Newsletter', 'News, stories, and practical updates from BrightWeb.', 0),
+  ('product-updates', 'Product updates & events', 'Product announcements, releases, and events.', 10)
+ON CONFLICT (slug) DO NOTHING;
+
+CREATE TABLE IF NOT EXISTS public.marketing_subscriptions (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  contact_id uuid NOT NULL REFERENCES public.crm_contacts(id) ON DELETE CASCADE,
+  topic_id uuid NOT NULL REFERENCES public.marketing_topics(id) ON DELETE CASCADE,
+  status text NOT NULL DEFAULT 'subscribed',
+  consent_source text,
+  consent_at timestamptz,
+  unsubscribed_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT marketing_subscriptions_status_check
+    CHECK (status IN ('subscribed', 'unsubscribed')),
+  CONSTRAINT marketing_subscriptions_contact_topic_unique
+    UNIQUE (contact_id, topic_id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_marketing_subscriptions_contact_id
+  ON public.marketing_subscriptions (contact_id);
+
+CREATE INDEX IF NOT EXISTS idx_marketing_subscriptions_topic_id
+  ON public.marketing_subscriptions (topic_id);
+
+CREATE TABLE IF NOT EXISTS public.marketing_contact_settings (
+  contact_id uuid PRIMARY KEY REFERENCES public.crm_contacts(id) ON DELETE CASCADE,
+  unsubscribe_token uuid NOT NULL DEFAULT gen_random_uuid() UNIQUE,
+  preferred_language text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS public.marketing_suppressions (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  email text NOT NULL UNIQUE,
+  reason text NOT NULL,
+  source text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT marketing_suppressions_email_lowercase_check
+    CHECK (email = lower(trim(email))),
+  CONSTRAINT marketing_suppressions_reason_check
+    CHECK (reason IN ('bounced', 'complained', 'unsubscribed_all', 'manual'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_marketing_suppressions_email
+  ON public.marketing_suppressions (email);
+
+CREATE OR REPLACE FUNCTION public.set_marketing_updated_at()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+BEGIN
+  NEW.updated_at := now();
+  RETURN NEW;
+END;
+$$;
+
+DROP TRIGGER IF EXISTS set_marketing_topics_updated_at ON public.marketing_topics;
+CREATE TRIGGER set_marketing_topics_updated_at
+BEFORE UPDATE ON public.marketing_topics
+FOR EACH ROW
+EXECUTE FUNCTION public.set_marketing_updated_at();
+
+DROP TRIGGER IF EXISTS set_marketing_subscriptions_updated_at ON public.marketing_subscriptions;
+CREATE TRIGGER set_marketing_subscriptions_updated_at
+BEFORE UPDATE ON public.marketing_subscriptions
+FOR EACH ROW
+EXECUTE FUNCTION public.set_marketing_updated_at();
+
+DROP TRIGGER IF EXISTS set_marketing_contact_settings_updated_at ON public.marketing_contact_settings;
+CREATE TRIGGER set_marketing_contact_settings_updated_at
+BEFORE UPDATE ON public.marketing_contact_settings
+FOR EACH ROW
+EXECUTE FUNCTION public.set_marketing_updated_at();
+
+ALTER TABLE public.marketing_topics ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.marketing_subscriptions ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.marketing_contact_settings ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.marketing_suppressions ENABLE ROW LEVEL SECURITY;
+
+DROP POLICY IF EXISTS "Service role manages marketing topics" ON public.marketing_topics;
+CREATE POLICY "Service role manages marketing topics"
+  ON public.marketing_topics FOR ALL TO service_role
+  USING (true) WITH CHECK (true);
+
+DROP POLICY IF EXISTS "Service role manages marketing subscriptions" ON public.marketing_subscriptions;
+CREATE POLICY "Service role manages marketing subscriptions"
+  ON public.marketing_subscriptions FOR ALL TO service_role
+  USING (true) WITH CHECK (true);
+
+DROP POLICY IF EXISTS "Service role manages marketing contact settings" ON public.marketing_contact_settings;
+CREATE POLICY "Service role manages marketing contact settings"
+  ON public.marketing_contact_settings FOR ALL TO service_role
+  USING (true) WITH CHECK (true);
+
+DROP POLICY IF EXISTS "Service role manages marketing suppressions" ON public.marketing_suppressions;
+CREATE POLICY "Service role manages marketing suppressions"
+  ON public.marketing_suppressions FOR ALL TO service_role
+  USING (true) WITH CHECK (true);

package/template/supabase/modules/marketing/migrations/20260725130000_marketing_campaigns.sql

@@ -0,0 +1,133 @@
+create table if not exists public.marketing_campaigns (
+  id uuid primary key default gen_random_uuid(),
+  name text not null,
+  subject text not null,
+  preheader text,
+  from_name text,
+  from_email text,
+  topic_id uuid not null references public.marketing_topics(id),
+  body_html text,
+  body_text text,
+  body_json jsonb,
+  status text not null default 'draft'
+    check (status in ('draft', 'scheduled', 'sending', 'sent', 'canceled', 'failed')),
+  scheduled_at timestamptz,
+  sent_at timestamptz,
+  batch_size integer not null default 100 check (batch_size > 0),
+  rate_per_minute integer check (rate_per_minute is null or rate_per_minute > 0),
+  total_recipients integer not null default 0,
+  sent_count integer not null default 0,
+  failed_count integer not null default 0,
+  created_by_profile_id uuid references public.profiles(id),
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now()
+);
+
+create table if not exists public.marketing_campaign_recipients (
+  id uuid primary key default gen_random_uuid(),
+  campaign_id uuid not null references public.marketing_campaigns(id) on delete cascade,
+  contact_id uuid references public.crm_contacts(id) on delete set null,
+  email text not null,
+  status text not null default 'queued'
+    check (status in ('queued', 'sending', 'sent', 'failed', 'suppressed', 'skipped')),
+  attempt_count integer not null default 0,
+  next_attempt_at timestamptz,
+  provider_message_id text,
+  error text,
+  sent_at timestamptz,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  unique (campaign_id, contact_id)
+);
+
+create index if not exists marketing_campaign_recipients_campaign_status_idx
+  on public.marketing_campaign_recipients (campaign_id, status);
+create index if not exists marketing_campaign_recipients_worker_claim_idx
+  on public.marketing_campaign_recipients (status, next_attempt_at);
+create index if not exists marketing_campaign_recipients_provider_message_idx
+  on public.marketing_campaign_recipients (provider_message_id)
+  where provider_message_id is not null;
+
+create table if not exists public.marketing_message_events (
+  id uuid primary key default gen_random_uuid(),
+  campaign_id uuid references public.marketing_campaigns(id) on delete set null,
+  recipient_id uuid references public.marketing_campaign_recipients(id) on delete set null,
+  contact_id uuid,
+  provider text not null default 'resend',
+  event_type text not null,
+  provider_event_id text,
+  payload jsonb,
+  occurred_at timestamptz not null default now(),
+  created_at timestamptz not null default now()
+);
+
+create unique index if not exists marketing_message_events_provider_event_unique_idx
+  on public.marketing_message_events (provider, provider_event_id)
+  where provider_event_id is not null;
+
+alter table public.marketing_campaigns enable row level security;
+alter table public.marketing_campaign_recipients enable row level security;
+alter table public.marketing_message_events enable row level security;
+
+drop policy if exists "service role manages marketing campaigns" on public.marketing_campaigns;
+create policy "service role manages marketing campaigns"
+  on public.marketing_campaigns for all
+  using (auth.role() = 'service_role')
+  with check (auth.role() = 'service_role');
+
+drop policy if exists "service role manages marketing campaign recipients"
+  on public.marketing_campaign_recipients;
+create policy "service role manages marketing campaign recipients"
+  on public.marketing_campaign_recipients for all
+  using (auth.role() = 'service_role')
+  with check (auth.role() = 'service_role');
+
+drop policy if exists "service role manages marketing message events"
+  on public.marketing_message_events;
+create policy "service role manages marketing message events"
+  on public.marketing_message_events for all
+  using (auth.role() = 'service_role')
+  with check (auth.role() = 'service_role');
+
+drop trigger if exists marketing_campaigns_set_updated_at on public.marketing_campaigns;
+create trigger marketing_campaigns_set_updated_at
+  before update on public.marketing_campaigns
+  for each row execute function public.set_marketing_updated_at();
+
+drop trigger if exists marketing_campaign_recipients_set_updated_at
+  on public.marketing_campaign_recipients;
+create trigger marketing_campaign_recipients_set_updated_at
+  before update on public.marketing_campaign_recipients
+  for each row execute function public.set_marketing_updated_at();
+
+create or replace function public.claim_marketing_campaign_recipients(
+  target_campaign_id uuid,
+  claim_limit integer,
+  claim_time timestamptz default now()
+)
+returns setof public.marketing_campaign_recipients
+language sql
+security definer
+set search_path = public
+as $$
+  update public.marketing_campaign_recipients
+  set status = 'sending',
+      attempt_count = attempt_count + 1,
+      updated_at = claim_time
+  where id in (
+    select id
+    from public.marketing_campaign_recipients
+    where campaign_id = target_campaign_id
+      and status = 'queued'
+      and (next_attempt_at is null or next_attempt_at <= claim_time)
+    order by created_at, id
+    for update skip locked
+    limit greatest(1, least(claim_limit, 1000))
+  )
+  returning *;
+$$;
+
+revoke all on function public.claim_marketing_campaign_recipients(uuid, integer, timestamptz)
+  from public, anon, authenticated;
+grant execute on function public.claim_marketing_campaign_recipients(uuid, integer, timestamptz)
+  to service_role;

package/template/supabase/modules/marketing/migrations/20260726120000_marketing_segments.sql

@@ -0,0 +1,41 @@
+-- Saved CRM audience filters for consent-first marketing campaigns.
+create table if not exists public.marketing_segments (
+  id uuid primary key default gen_random_uuid(),
+  name text not null,
+  description text,
+  rule_json jsonb not null default '{}'::jsonb,
+  created_by_profile_id uuid references public.profiles(id) on delete set null,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now()
+);
+
+alter table public.marketing_campaigns
+  add column if not exists segment_id uuid
+  references public.marketing_segments(id) on delete set null;
+
+create index if not exists marketing_segments_created_at_idx
+  on public.marketing_segments (created_at desc);
+
+create index if not exists marketing_campaigns_segment_id_idx
+  on public.marketing_campaigns (segment_id)
+  where segment_id is not null;
+
+create index if not exists marketing_message_events_engagement_idx
+  on public.marketing_message_events (event_type, occurred_at desc, contact_id)
+  where contact_id is not null;
+
+drop trigger if exists set_marketing_segments_updated_at on public.marketing_segments;
+create trigger set_marketing_segments_updated_at
+  before update on public.marketing_segments
+  for each row execute function public.set_marketing_updated_at();
+
+alter table public.marketing_segments enable row level security;
+
+drop policy if exists "Service role manages marketing segments"
+  on public.marketing_segments;
+create policy "Service role manages marketing segments"
+  on public.marketing_segments for all to service_role
+  using (true) with check (true);
+
+revoke all on table public.marketing_segments from anon, authenticated;
+grant all on table public.marketing_segments to service_role;

package/template/supabase/modules/marketing/migrations/20260726150000_marketing_workflows.sql

@@ -0,0 +1,174 @@
+create table if not exists public.marketing_workflows (
+  id uuid primary key default gen_random_uuid(),
+  name text not null,
+  description text,
+  trigger_type text not null
+    check (trigger_type in (
+      'contact_subscribed',
+      'crm_status_changed',
+      'project_status_changed',
+      'form_submitted'
+    )),
+  trigger_config jsonb not null default '{}'::jsonb,
+  status text not null default 'draft'
+    check (status in ('draft', 'active', 'paused')),
+  created_by_profile_id uuid references public.profiles(id),
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now()
+);
+
+create table if not exists public.marketing_workflow_nodes (
+  id uuid primary key default gen_random_uuid(),
+  workflow_id uuid not null
+    references public.marketing_workflows(id) on delete cascade,
+  position integer not null,
+  node_type text not null
+    check (node_type in ('send_email', 'wait', 'add_tag')),
+  config jsonb not null default '{}'::jsonb,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  unique (workflow_id, position)
+);
+
+create index if not exists marketing_workflow_nodes_workflow_position_idx
+  on public.marketing_workflow_nodes (workflow_id, position);
+
+create table if not exists public.marketing_workflow_runs (
+  id uuid primary key default gen_random_uuid(),
+  workflow_id uuid not null
+    references public.marketing_workflows(id) on delete cascade,
+  contact_id uuid references public.crm_contacts(id) on delete cascade,
+  status text not null default 'active'
+    check (status in ('active', 'completed', 'failed', 'canceled')),
+  current_position integer not null default 0,
+  next_run_at timestamptz,
+  context jsonb,
+  started_at timestamptz not null default now(),
+  completed_at timestamptz,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  unique (workflow_id, contact_id)
+);
+
+create index if not exists marketing_workflow_runs_due_idx
+  on public.marketing_workflow_runs (status, next_run_at);
+
+create table if not exists public.marketing_workflow_step_runs (
+  id uuid primary key default gen_random_uuid(),
+  run_id uuid not null
+    references public.marketing_workflow_runs(id) on delete cascade,
+  node_id uuid references public.marketing_workflow_nodes(id) on delete set null,
+  status text not null check (status in ('done', 'failed', 'skipped')),
+  error text,
+  executed_at timestamptz not null default now()
+);
+
+create table if not exists public.marketing_contact_tags (
+  id uuid primary key default gen_random_uuid(),
+  contact_id uuid not null references public.crm_contacts(id) on delete cascade,
+  tag text not null,
+  created_at timestamptz not null default now(),
+  unique (contact_id, tag)
+);
+
+create table if not exists public.marketing_worker_cursors (
+  key text primary key,
+  cursor timestamptz
+);
+
+alter table public.marketing_workflows enable row level security;
+alter table public.marketing_workflow_nodes enable row level security;
+alter table public.marketing_workflow_runs enable row level security;
+alter table public.marketing_workflow_step_runs enable row level security;
+alter table public.marketing_contact_tags enable row level security;
+alter table public.marketing_worker_cursors enable row level security;
+
+drop policy if exists "service role manages marketing workflows"
+  on public.marketing_workflows;
+create policy "service role manages marketing workflows"
+  on public.marketing_workflows for all
+  using (auth.role() = 'service_role')
+  with check (auth.role() = 'service_role');
+
+drop policy if exists "service role manages marketing workflow nodes"
+  on public.marketing_workflow_nodes;
+create policy "service role manages marketing workflow nodes"
+  on public.marketing_workflow_nodes for all
+  using (auth.role() = 'service_role')
+  with check (auth.role() = 'service_role');
+
+drop policy if exists "service role manages marketing workflow runs"
+  on public.marketing_workflow_runs;
+create policy "service role manages marketing workflow runs"
+  on public.marketing_workflow_runs for all
+  using (auth.role() = 'service_role')
+  with check (auth.role() = 'service_role');
+
+drop policy if exists "service role manages marketing workflow step runs"
+  on public.marketing_workflow_step_runs;
+create policy "service role manages marketing workflow step runs"
+  on public.marketing_workflow_step_runs for all
+  using (auth.role() = 'service_role')
+  with check (auth.role() = 'service_role');
+
+drop policy if exists "service role manages marketing contact tags"
+  on public.marketing_contact_tags;
+create policy "service role manages marketing contact tags"
+  on public.marketing_contact_tags for all
+  using (auth.role() = 'service_role')
+  with check (auth.role() = 'service_role');
+
+drop policy if exists "service role manages marketing worker cursors"
+  on public.marketing_worker_cursors;
+create policy "service role manages marketing worker cursors"
+  on public.marketing_worker_cursors for all
+  using (auth.role() = 'service_role')
+  with check (auth.role() = 'service_role');
+
+drop trigger if exists marketing_workflows_set_updated_at
+  on public.marketing_workflows;
+create trigger marketing_workflows_set_updated_at
+  before update on public.marketing_workflows
+  for each row execute function public.set_marketing_updated_at();
+
+drop trigger if exists marketing_workflow_nodes_set_updated_at
+  on public.marketing_workflow_nodes;
+create trigger marketing_workflow_nodes_set_updated_at
+  before update on public.marketing_workflow_nodes
+  for each row execute function public.set_marketing_updated_at();
+
+drop trigger if exists marketing_workflow_runs_set_updated_at
+  on public.marketing_workflow_runs;
+create trigger marketing_workflow_runs_set_updated_at
+  before update on public.marketing_workflow_runs
+  for each row execute function public.set_marketing_updated_at();
+
+create or replace function public.claim_marketing_workflow_runs(
+  claim_limit integer,
+  claim_time timestamptz default now()
+)
+returns setof public.marketing_workflow_runs
+language sql
+security definer
+set search_path = public
+as $$
+  update public.marketing_workflow_runs
+  set next_run_at = claim_time + interval '5 minutes',
+      updated_at = claim_time
+  where id in (
+    select id
+    from public.marketing_workflow_runs
+    where status = 'active'
+      and next_run_at is not null
+      and next_run_at <= claim_time
+    order by next_run_at, created_at, id
+    for update skip locked
+    limit greatest(1, least(claim_limit, 100))
+  )
+  returning *;
+$$;
+
+revoke all on function public.claim_marketing_workflow_runs(integer, timestamptz)
+  from public, anon, authenticated;
+grant execute on function public.claim_marketing_workflow_runs(integer, timestamptz)
+  to service_role;