@classytic/crm 0.8.0 → 0.9.0

package/CHANGELOG.md

@@ -1,342 +1,363 @@
-# Changelog
-
-All notable changes to `@classytic/crm` are documented here.
-
-## [0.8.0] — 2026-07-11
-
-### Added — engagement-based lead scoring
-- **`ILeadEngagement` on the Lead** (`{ opens, clicks, replies, activities, lastEngagedAt? }`, nested default `{}` so old rows read as zeros). Behavioural counters, distinct from firmographic fields.
-- **`LeadRepository.recordEngagement(id, signal, ctx)`** where `signal ∈ 'open'|'click'|'reply'|'activity'` (`LeadEngagementSignal`). Atomic `$inc` on the matching counter + `lastEngagedAt` via `findOneAndUpdate`, then `recomputeScore`. Hosts feed it off `crm:message.received` (reply), `crm:activity.*` (activity), and email open/click tracking.
-- **`defaultLeadScorer` now weighs engagement** on top of firmographic fit: reply ×25 · click ×8 · open ×2 · activity ×5, capped at +80. `LeadInput` picks up `engagement`. Pure/deterministic — no wall-clock. Absent engagement scores as zero (score unchanged for pre-existing leads until a signal lands).
-
-## [0.7.0] — 2026-07-05
-
-### Added — org-wide email suppression list
-
-- **`Suppression` entity** (`crm.repositories.suppression`, model
-  `Suppression`): global per-org "never email this address again" list —
-  the gate hosts consult before EVERY outbound email. Unsubscribes on
-  `Subscription` stay per-campaign; suppression is org-wide.
-  - `suppress(email, { reason, source?, subjectKind?, subjectId?, metadata? }, ctx?)`
-    — idempotent `getOrCreate` on the unique `(organizationId, email)`
-    index (no check-then-save); emits `crm:suppression.added` only when
-    THIS call inserted the row.
-  - `isSuppressed(email, ctx?)` → boolean.
-  - `filterSuppressed(emails, ctx?)` → `Set<string>` of the suppressed
-    subset — ONE `$in` query for the campaign-fanout hot path.
-  - `unsuppress(email, ctx?)` — atomic delete; emits
-    `crm:suppression.removed` only when a row was actually removed.
-  - All verbs normalize emails (trim + lowercase; schema stores lowercase).
-- **`SUPPRESSION_REASONS`** (`'bounce' | 'complaint' | 'unsubscribe' |
-  'manual'`) — the first three `satisfies readonly EmailEventKind[]` (P6),
-  so a rename in `EMAIL_EVENT_KINDS` fails compilation here.
-- **Events** `crm:suppression.added` / `crm:suppression.removed` — Zod
-  catalog definitions included (no-drift invariant stays green);
-  `organizationId` rides event meta as usual.
-- **Validators** `suppressSchema` / `unsuppressSchema` /
-  `suppressionFilterSchema`.
-
-### Added — reply-detection exit verb
-
-- **`EnrollmentRepository.exitActiveOnReply(subjects, ctx?)`** — the ONE
-  method a host's `crm:message.received` subscriber calls: finds ACTIVE
-  enrollments for the given `{ subjectKind, subjectId }` list, batch-loads
-  their sequences in a single `$in` query, skips those with
-  `replyDetectionEnabled === false`, and exits the rest via `exit(id,
-  'reply')` (each exit emits `crm:enrollment.exited`). Lost CAS races
-  (concurrent pause/complete/exit) are skipped, not failed. Returns the
-  enrollments this call exited.
-- `EnrollmentRepositoryDeps` now carries `sequences: SequenceRepository`
-  (same cross-repo deps idiom as `OpportunityRepository.pipelines` /
-  `MessageRepository.conversations`) — wired automatically by
-  `createCrm()`; only hosts constructing `EnrollmentRepository` by hand
-  need to pass it.
-
-## [0.6.0] — 2026-07-02
-
-Breaking-in-behavior release (ships as MINOR per house convention):
-outbox-first, session-safe event dispatch — the previously deferred
-PACKAGE_RULES §P8/§P8.1 work.
-
-### Added — unit-of-work contract (P8.1, shared with refit/review/cart/invoice)
-
-- **`engine.withTransaction(ctx, body)`** — runs `body` inside a MongoDB
-  transaction with post-commit event discipline: events dispatched through
-  `txCtx` are queued under `ctx[PENDING_EVENTS]` and flushed to the
-  transport only AFTER commit; the queue resets on retry attempts; an abort
-  leaks nothing to in-process subscribers. Reuses the caller's session (and
-  queue) when `ctx.session` is already set. Standalone-Mongo dev boots opt
-  in via the existing `allowNonTransactional: true`.
-- **`PENDING_EVENTS`** (`Symbol.for('@classytic/crm:pendingEvents')`) +
-  **`flushPending(transport, queue, logger?)`** + **`runUnit`** exported
-  from the root for hosts composing their own outer transaction.
-- **`CrmConfig.outbox?: OutboxStore`** (from `@classytic/primitives/outbox`)
-  — when wired, every domain event is persisted via
-  `outbox.save(event, { session })` in the SAME session as the business
-  write; the host's relay publishes committed rows. Outbox save failures
-  PROPAGATE (P8: a swallowed save means the write persists while its event
-  vanishes).
-- **`CrmEventDispatcher`** — EventTransport-compatible wrapper repositories
-  route every event through (`engine.events` is now this wrapper; the host
-  `publish`/`subscribe` surface is unchanged).
-- **`UnmanagedSessionError`** (`code: 'UNMANAGED_SESSION'`) — a host-owned
-  `ctx.session` arriving with neither an outbox nor a `PENDING_EVENTS`
-  queue now throws instead of ghost-publishing mid-transaction.
-  **Behavioral break:** callers that previously threaded a bare session and
-  tolerated ghost events must switch to `engine.withTransaction` (or wire
-  an outbox / attach a queue).
-
-### Added — timezone-aware forecasting
-
-- **`ForecastOptions.timeZone`** — IANA zone for the default month bucket
-  (e.g. `'Asia/Dhaka'`). Without it, months cut at UTC boundaries: a deal
-  expected to close July 1, 02:00 Dhaka time (June 30, 20:00 UTC) files
-  under JUNE. Uses `civilDateOf` from `@classytic/primitives/timezone`.
-  Peer floor bumped: `@classytic/primitives >=0.9.0`.
-
-### Fixed — sequence/enrollment (completes the 0.6.0 WIP)
-
-- **Event catalog no-drift restored**: 10 missing Zod definitions added
-  (`crm:sequence.{created,active,paused,archived}`,
-  `crm:enrollment.{created,step_sent,paused,resumed,completed,exited}`) —
-  `crm:sequence.created` and `crm:enrollment.step_sent` are host-emitted
-  (create via `def.create()`), the rest publish in-repo.
-- **`EnrollmentRepository.setWorkflowRunId` / `advanceStep` no longer
-  bypass the repository**: both used raw `model.findOneAndUpdate` with a
-  manual tenant filter — escaping `multiTenantPlugin` scoping AND
-  `ctx.session` (a call inside `withTransaction` would commit outside the
-  transaction). `advanceStep` is now a `claim()` CAS on `currentStepIndex`
-  with `where: { status: 'active' }`; `setWorkflowRunId` goes through
-  `repo.update`.
-
-### Tests
-
-- 14 new: `tests/unit/dispatch.test.ts` (6 — outbox propagation/session
-  routing/guard/swallow), `tests/integration/unit-of-work.test.ts` (3 —
-  convert() on a replica set: zero mid-tx events, post-commit flush, abort
-  leaks nothing, bare-session guard), `tests/unit/forecast-timezone.test.ts`
-  (5 — the +06:00 month-boundary trap). 110/110 total.
-
-## [0.5.1] — 2026-06-14
-
-### Fixed — declaration bundle
-
-- **fix: declaration bundle exported mangled aliases; consumer named imports
-  now resolve.** The published `dist/index.d.ts` re-exported every public
-  symbol under a minified alias (`export { AccountRepository as A, CRM_EVENTS
-  as Rr, … }`), so downstream `import { AccountRepository, CRM_EVENTS } from
-  '@classytic/crm'` failed with TS2305 / TS2460. Root cause: the `./events`
-  entry re-exports a strict subset of the `index` barrel, which made
-  `rolldown-plugin-dts` alias every name on the superset (`index`) entry when
-  both were emitted in a single pass. Build now runs `index` and `events` as
-  two independent tsdown passes (array config) so each `.d.ts` exports real
-  names. `tsdown` bumped `^0.14.2` → `^0.21.10` to match sibling packages.
-  No runtime/API change.
-
-## [0.5.0] — 2026-06-14
-
-Stack upgrade + verified correctness fixes + PACKAGE_RULES compliance. No
-new features. Clean break — no deprecation aliases.
-
-### Changed — stack currency
-
-- Peers bumped: `@classytic/mongokit` `>=3.16.0`, `@classytic/repo-core`
-  `>=0.6.0`, `@classytic/primitives` `>=0.7.1`, `mongoose` `>=9.4.1`.
-  Clean-installed from npm and verified resolved (3.16.0 / 0.6.0 / 0.7.2).
-
-### Added — PACKAGE_RULES compliance
-
-- **Zod event catalog (rule 18).** New `crmEventDefinitions[]` (56 events,
-  one Zod schema each) exported from the package root and a new `./events`
-  subpath. Timestamps are `z.iso.datetime()`. A no-drift invariant test
-  asserts every `CRM_EVENTS` constant has a definition. Hosts wire these
-  into arc's `EventRegistry` for publish-time validation + OpenAPI.
-- **Model-collision policy (rule 21).** `createCrm()` now throws
-  `CrmModelCollisionError` when a model name is already registered; pass
-  `forceRecreate: true` (test/hot-reload) to delete + re-register.
-- **Index management (rule 35).** New `autoIndex` config flag (default
-  `true`) and `engine.syncIndexes()` for `autoIndex: false` production
-  boots.
-- **Capability boot gate.** `createCrm()` asserts the backend supports
-  `upsert` / `getOrCreate` / `duplicateKeyError` (and `transactions`,
-  unless `allowNonTransactional: true`) so misconfigured deployments fail
-  loud at boot instead of mid-convert.
-
-### Fixed — domain correctness
-
-- **Lead / Subscription / Campaign dedup are now race-safe.** Added
-  authoritative partial-unique indexes — lead `(organizationId, email)`,
-  campaign `(organizationId, name)`, subscription `(organizationId,
-  contactId, campaignId)` scoped to live statuses — and catch the
-  residual `E11000` via `isDuplicateKeyError`, re-throwing the same typed
-  domain error the pre-check emits. The prior check-then-save left a
-  TOCTOU window.
-- **Owner reassignment is now atomic.** `assign()` on lead / account /
-  contact / opportunity / conversation uses a single `findOneAndUpdate`
-  CAS (`{ ownerId: { $ne } }` guard, `returnDocument: 'before'`) — no
-  read-modify-write lost-update window, and the emitted `previousOwnerId`
-  is the true pre-image under concurrency.
-- **Cross-tenant leak in dashboard/feed reads closed.** `findRecentForFeed`,
-  `countCreatedSince`, `countOpen`, `sumWonSince`, `countOverduePlanned`
-  dropped raw `Model.find` / `countDocuments` with a manual
-  `if (ctx) organizationId` filter (which read ALL tenants when ctx was
-  absent) for the tenant-scoped `findAll` / `count` repository methods.
-
-### Build hygiene
-
-- Sourcemaps and declaration maps are no longer emitted (`sourceMap` /
-  `declarationMap` off in tsconfig; `sourcemap: false` in tsdown) — both
-  leak source.
-- Removed `@deprecated` markers from `ConvertResult` convenience id fields
-  (kept the fields; they were never deprecated, just mislabelled).
-- Dropped the stale pnpm lockfile/workspace and the bundled `.tgz`;
-  installs are npm-from-registry only.
-
-### Docs
-
-- Rewrote the README to the engine-factory API (`createCrm` + repository
-  domain verbs). The previous README documented the abandoned v0.1
-  port/adapter design (`AccountService`, `InMemory*Repository`,
-  `OutreachPort`) that no longer exists.
-
-### Tests
-
-- Added `tests/integration/invariants.test.ts` (tenant probe, lead +
-  subscription dedup races, atomic reassignment) and
-  `tests/unit/event-catalog.test.ts` (no-drift + round-trip). 87 → 96
-  tests.
-
-## [0.4.0] — 2026-05-22
-
-### Changed — Subscription model renamed to `EmailSubscription`
-
-**Breaking at the Mongo identity level.** The CRM's email opt-in resource
-now registers as Mongoose model `EmailSubscription` (was `Subscription`)
-and persists into the `email_subscriptions` collection (was
-`subscriptions`).
-
-**Why:** the previous name collided with `@classytic/revenue`'s
-`Subscription` model when both packages were loaded on the same
-Mongoose connection — `RevenueModelCollisionError` at boot. Renaming
-gives the two concepts distinct identities at the DB level and lets
-revenue + CRM coexist without the host having to split connections.
-
-**TypeScript surface is unchanged.** `ISubscriptionDocument`,
-`SubscriptionRepository`, `subscription.handlers.ts`,
-`CrmModels.Subscription`, etc. all keep their existing names — only
-the Mongoose model name string and the underlying collection name
-changed. Consumers that import from `@classytic/crm` need no source
-changes; the host only needs to migrate existing data (see below).
-
-### Migration
-
-For DBs with existing CRM subscription rows in the legacy `subscriptions`
-collection (distinguishable from revenue rows by `contactId` presence):
-
-```js
-// MongoDB shell — one-time migration
-db.subscriptions.aggregate([
-  { $match: { contactId: { $exists: true } } },
-  { $out: 'email_subscriptions' },
-]);
-// Then remove the migrated docs from the legacy collection:
-db.subscriptions.deleteMany({ contactId: { $exists: true } });
-```
-
-Hosts using only CRM (no revenue) can also run this — leftover rows in
-`subscriptions` won't cause boot errors because there's no collision
-without revenue.
-
-## [0.3.0] — 2026-05-17
-
-### Added — `EmailEvent` domain
-
-Closes the loop between outbound CRM sends and recipient engagement.
-Hosts can now record opens, clicks, bounces, complaints, and unsubscribes
-against a Contact / Subscription / Campaign tuple — and downstream
-services (drip-sequence "if opened" branches, lead scoring, suppression
-lists) consume the same events without polling the email transport.
-
-- **Entity & enum** — `EmailEvent` (append-only) plus the
-  `EmailEventKind` enum (`open` / `click` / `bounce` / `complaint` /
-  `unsubscribe`) split into `ENGAGEMENT_KINDS` and `SUPPRESSION_KINDS`
-  helper sets for classification at call sites.
-- **Port** — `EmailEventRepository` with filtered list, per-subject
-  timeline, per-campaign aggregates (`uniqueOpens`, `uniqueClicks`,
-  `bounces`, `complaints`, `unsubscribes`, `totalEvents`), and a
-  GDPR-style `deleteForSubject()` purge.
-- **Service** — `EmailEventService.recordOpen()` /
-  `.recordClick({ url })` / `.recordBounce()` / `.recordComplaint()` /
-  `.recordUnsubscribe()` + read-side `.listForSubject()`,
-  `.aggregateForCampaign()`, and `.hasEngaged(subjectId, campaignId,
-  kind)` for drip-condition checks.
-- **Events** — `crm:email_event.opened` / `.clicked` / `.bounced` /
-  `.complained` / `.unsubscribed` with Zod-validated payloads in
-  `event-catalog`, wired into `crmEventDefinitions[]`.
-- **In-memory adapter** — `InMemoryEmailEventRepository` (tests +
-  dev). Hosts implement against Mongo / Postgres / etc.
-
-### Added — re-exports from `@classytic/primitives@0.6.0`
-
-To eliminate duplicate type imports at consumer call sites:
-
-```ts
-import {
-  appendStatus,
-  StatusChangeEntry,
-  StatusHistory,
-  timeInStatus,
-  lastTransitionTo,
-} from '@classytic/crm';
-```
-
-These pass through from `@classytic/primitives/status-history`. The
-existing entity-specific `LeadStatusEntry` / `OpportunityStatusEntry` /
-etc. names are still exported for back-compat — they remain structurally
-compatible with `StatusChangeEntry<TStatus>`.
-
-### Changed
-
-- Peer dep `@classytic/primitives` bumped from `>=0.5.0` to `>=0.6.0`
-  to access the new `status-history` subpath and value-typed primitives.
-- Test harness `buildHarness()` now also exposes an
-  `emailEvents: EmailEventService` and `emailEventRepo` for integration
-  tests that exercise the engagement → drip path.
-
-### Dependencies
-
-- `@classytic/primitives@>=0.6.0` (peer, was `>=0.5.0`)
-- `zod@>=4.0.0` (peer, unchanged)
-
-## [0.1.0] — 2026-04-18
-
-Initial release.
-
-### Added
-
-- **Eight domain entities.** `Contact`, `Account`, `Lead`, `Opportunity`, `Pipeline` (+ nested `Stage`), `Activity`, `Note`, `LossReason`.
-- **Three state machines.** Lead (`new` → `contacted` → `qualified` → `converted`, + `disqualified` / `nurturing` branches), Opportunity (`open` → `won` / `lost` / `abandoned` with in-pipeline Stage movement), Activity (`planned` → `in_progress` → `completed` / `cancelled`). All transitions CAS-guarded with explicit `*_TRANSITIONS` maps and `canTransition*` guards.
-- **Six services.**
-  - `ContactService` — CRUD + tag filtering + email lookup.
-  - `AccountService` — CRUD + domain lookup.
-  - `PipelineService` — create, archive, stage helpers (`getStage`, `getFirstStage`, `getNextStage`).
-  - `OpportunityService` — create at first stage (or specified), `moveToStage` with advance/regress event disambiguation, `win` / `lose` (with `lostReasonId`) / `abandon`.
-  - `LeadService` — CRUD + full lifecycle (`markContacted`, `qualify`, `disqualify`, `nurture`) + `convert()` — the crown-jewel verb that atomically creates Contact + Account + Opportunity and transitions the lead to `converted`.
-  - `ActivityService` — polymorphic activities (`plan`, `start`, `complete`, `cancel`) + notes (`addNote`, `listNotesBySubject`).
-- **Pure calculators.**
-  - `defaultLeadScorer` + `composeScorers(...rules)` — host injects whatever rubric (firmographics, in-app signals, ML prediction, enrichment) via a `(lead: Lead) => number` function.
-  - `forecast(opportunities, options?)` — committed + weighted pipeline by bucket (default ISO month), with custom bucket function support. Currency-mismatch detection.
-  - `pipelineConversion(opportunities, stageIds)` — where do deals die? returns per-stage current count + won/lost counts + conversion rate.
-- **Nine repository ports** — one per entity (plus `EventTransport`, `IdGenerator`, `Clock`, optional `OutreachPort`). Full in-memory reference implementations shipped.
-- **Typed error hierarchy** rooted at `CrmError`: `NotFoundError`, `InvalidLeadTransitionError`, `InvalidOpportunityTransitionError`, `InvalidActivityTransitionError`, `StageNotInPipelineError`, `LeadAlreadyConvertedError`, `DuplicateLeadError`, `EmptyPipelineError`.
-- **Nineteen lifecycle events** (`CRM_EVENTS`): covering lead/account/contact/opportunity/pipeline/activity/note verbs, all following `crm:<resource>.<verb>` per PACKAGE_RULES rule 12.
-- **Optional `OutreachPort`** — one-method (`send`) + `NullOutreachPort` + `InMemoryOutreachPort` (recording). Host subscribes to `crm:activity.*` events and drives the port from their automation layer (keeps pacing / retry / bounce handling out of the core).
-- **Testing.** `vitest.config.ts` projects split `unit` + `integration` per [testing-infrastructure.md](../../testing-infrastructure.md). 48 tests (7 files) — all green in <1.5s.
-
-### Design choices
-
-- Pure-TS port-based pattern — consistent with `@classytic/manufacturing`, `@classytic/assets`, `@classytic/fleet`, `@classytic/carrier-*`.
-- Separate Lead + Opportunity models (erpnext style) rather than unified (odoo style) — cleaner semantics for pre-qualification vs in-pipeline data and enables distinct analytics.
-- Polymorphic Activity / Note via `subjectKind` + `subjectId` so hosts can extend without schema changes.
-- `LeadService.convert()` is atomic in intent and sequenced for auditability — it creates Account, then Contact, then Opportunity, then transitions the lead. If a downstream repo fails, the ones that succeeded persist (hosts using Mongoose sessions get atomicity at their layer).
-- Campaigns, appointment booking, competitors, contracts, team routing, RBAC, custom-field validation, email-thread parsing deferred to v0.2+ to keep the surface focused.
+# Changelog
+
+All notable changes to `@classytic/crm` are documented here.
+
+## [0.9.0] — unpublished (2026-07-15)
+
+### Changed — mongokit 3.22 adopted (peer floors: mongokit >=3.22.0, repo-core >=0.13.0, primitives >=0.11.0)
+
+- **Seven transition verbs ride `applyTransition`** (activity, campaign,
+  enrollment exit + generic, lead, sequence, subscription, opportunity):
+  machine pre-flight + CAS + accurate race diagnosis via the machines'
+  existing errorFactories. All `this as any` casts at those sites are gone
+  (native method).
+- **FIXED a real concurrency defect**: five sites built `statusHistory` by
+  read-modify-write (`[...(existing.statusHistory ?? []), entry]`) inside
+  the CAS patch — concurrent writers could drop history entries. Entries
+  now ride `$push` via the `push` arg, byte-identical shapes preserved.
+- **`EmailEvent` log fence enforced** — "append-only" was a doc comment;
+  `appendOnlyPlugin` now refuses every mutation path (405
+  `APPEND_ONLY_VIOLATION`), with `deleteMany` allowed for host-gated GDPR
+  erasure of a recipient's rows.
+- DELIBERATELY unchanged: `enrollment.advanceStep` (non-status
+  `currentStepIndex` CAS with null semantics) and opportunity's stage-move
+  claim — correct raw `claim` usage, not transition boilerplate.
+
+## [0.8.0] — 2026-07-11
+
+### Added — engagement-based lead scoring
+- **`ILeadEngagement` on the Lead** (`{ opens, clicks, replies, activities, lastEngagedAt? }`, nested default `{}` so old rows read as zeros). Behavioural counters, distinct from firmographic fields.
+- **`LeadRepository.recordEngagement(id, signal, ctx)`** where `signal ∈ 'open'|'click'|'reply'|'activity'` (`LeadEngagementSignal`). Atomic `$inc` on the matching counter + `lastEngagedAt` via `findOneAndUpdate`, then `recomputeScore`. Hosts feed it off `crm:message.received` (reply), `crm:activity.*` (activity), and email open/click tracking.
+- **`defaultLeadScorer` now weighs engagement** on top of firmographic fit: reply ×25 · click ×8 · open ×2 · activity ×5, capped at +80. `LeadInput` picks up `engagement`. Pure/deterministic — no wall-clock. Absent engagement scores as zero (score unchanged for pre-existing leads until a signal lands).
+
+## [0.7.0] — 2026-07-05
+
+### Added — org-wide email suppression list
+
+- **`Suppression` entity** (`crm.repositories.suppression`, model
+  `Suppression`): global per-org "never email this address again" list —
+  the gate hosts consult before EVERY outbound email. Unsubscribes on
+  `Subscription` stay per-campaign; suppression is org-wide.
+  - `suppress(email, { reason, source?, subjectKind?, subjectId?, metadata? }, ctx?)`
+    — idempotent `getOrCreate` on the unique `(organizationId, email)`
+    index (no check-then-save); emits `crm:suppression.added` only when
+    THIS call inserted the row.
+  - `isSuppressed(email, ctx?)` → boolean.
+  - `filterSuppressed(emails, ctx?)` → `Set<string>` of the suppressed
+    subset — ONE `$in` query for the campaign-fanout hot path.
+  - `unsuppress(email, ctx?)` — atomic delete; emits
+    `crm:suppression.removed` only when a row was actually removed.
+  - All verbs normalize emails (trim + lowercase; schema stores lowercase).
+- **`SUPPRESSION_REASONS`** (`'bounce' | 'complaint' | 'unsubscribe' |
+  'manual'`) — the first three `satisfies readonly EmailEventKind[]` (P6),
+  so a rename in `EMAIL_EVENT_KINDS` fails compilation here.
+- **Events** `crm:suppression.added` / `crm:suppression.removed` — Zod
+  catalog definitions included (no-drift invariant stays green);
+  `organizationId` rides event meta as usual.
+- **Validators** `suppressSchema` / `unsuppressSchema` /
+  `suppressionFilterSchema`.
+
+### Added — reply-detection exit verb
+
+- **`EnrollmentRepository.exitActiveOnReply(subjects, ctx?)`** — the ONE
+  method a host's `crm:message.received` subscriber calls: finds ACTIVE
+  enrollments for the given `{ subjectKind, subjectId }` list, batch-loads
+  their sequences in a single `$in` query, skips those with
+  `replyDetectionEnabled === false`, and exits the rest via `exit(id,
+  'reply')` (each exit emits `crm:enrollment.exited`). Lost CAS races
+  (concurrent pause/complete/exit) are skipped, not failed. Returns the
+  enrollments this call exited.
+- `EnrollmentRepositoryDeps` now carries `sequences: SequenceRepository`
+  (same cross-repo deps idiom as `OpportunityRepository.pipelines` /
+  `MessageRepository.conversations`) — wired automatically by
+  `createCrm()`; only hosts constructing `EnrollmentRepository` by hand
+  need to pass it.
+
+## [0.6.0] — 2026-07-02
+
+Breaking-in-behavior release (ships as MINOR per house convention):
+outbox-first, session-safe event dispatch — the previously deferred
+PACKAGE_RULES §P8/§P8.1 work.
+
+### Added — unit-of-work contract (P8.1, shared with refit/review/cart/invoice)
+
+- **`engine.withTransaction(ctx, body)`** — runs `body` inside a MongoDB
+  transaction with post-commit event discipline: events dispatched through
+  `txCtx` are queued under `ctx[PENDING_EVENTS]` and flushed to the
+  transport only AFTER commit; the queue resets on retry attempts; an abort
+  leaks nothing to in-process subscribers. Reuses the caller's session (and
+  queue) when `ctx.session` is already set. Standalone-Mongo dev boots opt
+  in via the existing `allowNonTransactional: true`.
+- **`PENDING_EVENTS`** (`Symbol.for('@classytic/crm:pendingEvents')`) +
+  **`flushPending(transport, queue, logger?)`** + **`runUnit`** exported
+  from the root for hosts composing their own outer transaction.
+- **`CrmConfig.outbox?: OutboxStore`** (from `@classytic/primitives/outbox`)
+  — when wired, every domain event is persisted via
+  `outbox.save(event, { session })` in the SAME session as the business
+  write; the host's relay publishes committed rows. Outbox save failures
+  PROPAGATE (P8: a swallowed save means the write persists while its event
+  vanishes).
+- **`CrmEventDispatcher`** — EventTransport-compatible wrapper repositories
+  route every event through (`engine.events` is now this wrapper; the host
+  `publish`/`subscribe` surface is unchanged).
+- **`UnmanagedSessionError`** (`code: 'UNMANAGED_SESSION'`) — a host-owned
+  `ctx.session` arriving with neither an outbox nor a `PENDING_EVENTS`
+  queue now throws instead of ghost-publishing mid-transaction.
+  **Behavioral break:** callers that previously threaded a bare session and
+  tolerated ghost events must switch to `engine.withTransaction` (or wire
+  an outbox / attach a queue).
+
+### Added — timezone-aware forecasting
+
+- **`ForecastOptions.timeZone`** — IANA zone for the default month bucket
+  (e.g. `'Asia/Dhaka'`). Without it, months cut at UTC boundaries: a deal
+  expected to close July 1, 02:00 Dhaka time (June 30, 20:00 UTC) files
+  under JUNE. Uses `civilDateOf` from `@classytic/primitives/timezone`.
+  Peer floor bumped: `@classytic/primitives >=0.9.0`.
+
+### Fixed — sequence/enrollment (completes the 0.6.0 WIP)
+
+- **Event catalog no-drift restored**: 10 missing Zod definitions added
+  (`crm:sequence.{created,active,paused,archived}`,
+  `crm:enrollment.{created,step_sent,paused,resumed,completed,exited}`) —
+  `crm:sequence.created` and `crm:enrollment.step_sent` are host-emitted
+  (create via `def.create()`), the rest publish in-repo.
+- **`EnrollmentRepository.setWorkflowRunId` / `advanceStep` no longer
+  bypass the repository**: both used raw `model.findOneAndUpdate` with a
+  manual tenant filter — escaping `multiTenantPlugin` scoping AND
+  `ctx.session` (a call inside `withTransaction` would commit outside the
+  transaction). `advanceStep` is now a `claim()` CAS on `currentStepIndex`
+  with `where: { status: 'active' }`; `setWorkflowRunId` goes through
+  `repo.update`.
+
+### Tests
+
+- 14 new: `tests/unit/dispatch.test.ts` (6 — outbox propagation/session
+  routing/guard/swallow), `tests/integration/unit-of-work.test.ts` (3 —
+  convert() on a replica set: zero mid-tx events, post-commit flush, abort
+  leaks nothing, bare-session guard), `tests/unit/forecast-timezone.test.ts`
+  (5 — the +06:00 month-boundary trap). 110/110 total.
+
+## [0.5.1] — 2026-06-14
+
+### Fixed — declaration bundle
+
+- **fix: declaration bundle exported mangled aliases; consumer named imports
+  now resolve.** The published `dist/index.d.ts` re-exported every public
+  symbol under a minified alias (`export { AccountRepository as A, CRM_EVENTS
+  as Rr, … }`), so downstream `import { AccountRepository, CRM_EVENTS } from
+  '@classytic/crm'` failed with TS2305 / TS2460. Root cause: the `./events`
+  entry re-exports a strict subset of the `index` barrel, which made
+  `rolldown-plugin-dts` alias every name on the superset (`index`) entry when
+  both were emitted in a single pass. Build now runs `index` and `events` as
+  two independent tsdown passes (array config) so each `.d.ts` exports real
+  names. `tsdown` bumped `^0.14.2` → `^0.21.10` to match sibling packages.
+  No runtime/API change.
+
+## [0.5.0] — 2026-06-14
+
+Stack upgrade + verified correctness fixes + PACKAGE_RULES compliance. No
+new features. Clean break — no deprecation aliases.
+
+### Changed — stack currency
+
+- Peers bumped: `@classytic/mongokit` `>=3.16.0`, `@classytic/repo-core`
+  `>=0.6.0`, `@classytic/primitives` `>=0.7.1`, `mongoose` `>=9.4.1`.
+  Clean-installed from npm and verified resolved (3.16.0 / 0.6.0 / 0.7.2).
+
+### Added — PACKAGE_RULES compliance
+
+- **Zod event catalog (rule 18).** New `crmEventDefinitions[]` (56 events,
+  one Zod schema each) exported from the package root and a new `./events`
+  subpath. Timestamps are `z.iso.datetime()`. A no-drift invariant test
+  asserts every `CRM_EVENTS` constant has a definition. Hosts wire these
+  into arc's `EventRegistry` for publish-time validation + OpenAPI.
+- **Model-collision policy (rule 21).** `createCrm()` now throws
+  `CrmModelCollisionError` when a model name is already registered; pass
+  `forceRecreate: true` (test/hot-reload) to delete + re-register.
+- **Index management (rule 35).** New `autoIndex` config flag (default
+  `true`) and `engine.syncIndexes()` for `autoIndex: false` production
+  boots.
+- **Capability boot gate.** `createCrm()` asserts the backend supports
+  `upsert` / `getOrCreate` / `duplicateKeyError` (and `transactions`,
+  unless `allowNonTransactional: true`) so misconfigured deployments fail
+  loud at boot instead of mid-convert.
+
+### Fixed — domain correctness
+
+- **Lead / Subscription / Campaign dedup are now race-safe.** Added
+  authoritative partial-unique indexes — lead `(organizationId, email)`,
+  campaign `(organizationId, name)`, subscription `(organizationId,
+  contactId, campaignId)` scoped to live statuses — and catch the
+  residual `E11000` via `isDuplicateKeyError`, re-throwing the same typed
+  domain error the pre-check emits. The prior check-then-save left a
+  TOCTOU window.
+- **Owner reassignment is now atomic.** `assign()` on lead / account /
+  contact / opportunity / conversation uses a single `findOneAndUpdate`
+  CAS (`{ ownerId: { $ne } }` guard, `returnDocument: 'before'`) — no
+  read-modify-write lost-update window, and the emitted `previousOwnerId`
+  is the true pre-image under concurrency.
+- **Cross-tenant leak in dashboard/feed reads closed.** `findRecentForFeed`,
+  `countCreatedSince`, `countOpen`, `sumWonSince`, `countOverduePlanned`
+  dropped raw `Model.find` / `countDocuments` with a manual
+  `if (ctx) organizationId` filter (which read ALL tenants when ctx was
+  absent) for the tenant-scoped `findAll` / `count` repository methods.
+
+### Build hygiene
+
+- Sourcemaps and declaration maps are no longer emitted (`sourceMap` /
+  `declarationMap` off in tsconfig; `sourcemap: false` in tsdown) — both
+  leak source.
+- Removed `@deprecated` markers from `ConvertResult` convenience id fields
+  (kept the fields; they were never deprecated, just mislabelled).
+- Dropped the stale pnpm lockfile/workspace and the bundled `.tgz`;
+  installs are npm-from-registry only.
+
+### Docs
+
+- Rewrote the README to the engine-factory API (`createCrm` + repository
+  domain verbs). The previous README documented the abandoned v0.1
+  port/adapter design (`AccountService`, `InMemory*Repository`,
+  `OutreachPort`) that no longer exists.
+
+### Tests
+
+- Added `tests/integration/invariants.test.ts` (tenant probe, lead +
+  subscription dedup races, atomic reassignment) and
+  `tests/unit/event-catalog.test.ts` (no-drift + round-trip). 87 → 96
+  tests.
+
+## [0.4.0] — 2026-05-22
+
+### Changed — Subscription model renamed to `EmailSubscription`
+
+**Breaking at the Mongo identity level.** The CRM's email opt-in resource
+now registers as Mongoose model `EmailSubscription` (was `Subscription`)
+and persists into the `email_subscriptions` collection (was
+`subscriptions`).
+
+**Why:** the previous name collided with `@classytic/revenue`'s
+`Subscription` model when both packages were loaded on the same
+Mongoose connection — `RevenueModelCollisionError` at boot. Renaming
+gives the two concepts distinct identities at the DB level and lets
+revenue + CRM coexist without the host having to split connections.
+
+**TypeScript surface is unchanged.** `ISubscriptionDocument`,
+`SubscriptionRepository`, `subscription.handlers.ts`,
+`CrmModels.Subscription`, etc. all keep their existing names — only
+the Mongoose model name string and the underlying collection name
+changed. Consumers that import from `@classytic/crm` need no source
+changes; the host only needs to migrate existing data (see below).
+
+### Migration
+
+For DBs with existing CRM subscription rows in the legacy `subscriptions`
+collection (distinguishable from revenue rows by `contactId` presence):
+
+```js
+// MongoDB shell — one-time migration
+db.subscriptions.aggregate([
+  { $match: { contactId: { $exists: true } } },
+  { $out: 'email_subscriptions' },
+]);
+// Then remove the migrated docs from the legacy collection:
+db.subscriptions.deleteMany({ contactId: { $exists: true } });
+```
+
+Hosts using only CRM (no revenue) can also run this — leftover rows in
+`subscriptions` won't cause boot errors because there's no collision
+without revenue.
+
+## [0.3.0] — 2026-05-17
+
+### Added — `EmailEvent` domain
+
+Closes the loop between outbound CRM sends and recipient engagement.
+Hosts can now record opens, clicks, bounces, complaints, and unsubscribes
+against a Contact / Subscription / Campaign tuple — and downstream
+services (drip-sequence "if opened" branches, lead scoring, suppression
+lists) consume the same events without polling the email transport.
+
+- **Entity & enum** — `EmailEvent` (append-only) plus the
+  `EmailEventKind` enum (`open` / `click` / `bounce` / `complaint` /
+  `unsubscribe`) split into `ENGAGEMENT_KINDS` and `SUPPRESSION_KINDS`
+  helper sets for classification at call sites.
+- **Port** — `EmailEventRepository` with filtered list, per-subject
+  timeline, per-campaign aggregates (`uniqueOpens`, `uniqueClicks`,
+  `bounces`, `complaints`, `unsubscribes`, `totalEvents`), and a
+  GDPR-style `deleteForSubject()` purge.
+- **Service** — `EmailEventService.recordOpen()` /
+  `.recordClick({ url })` / `.recordBounce()` / `.recordComplaint()` /
+  `.recordUnsubscribe()` + read-side `.listForSubject()`,
+  `.aggregateForCampaign()`, and `.hasEngaged(subjectId, campaignId,
+  kind)` for drip-condition checks.
+- **Events** — `crm:email_event.opened` / `.clicked` / `.bounced` /
+  `.complained` / `.unsubscribed` with Zod-validated payloads in
+  `event-catalog`, wired into `crmEventDefinitions[]`.
+- **In-memory adapter** — `InMemoryEmailEventRepository` (tests +
+  dev). Hosts implement against Mongo / Postgres / etc.
+
+### Added — re-exports from `@classytic/primitives@0.6.0`
+
+To eliminate duplicate type imports at consumer call sites:
+
+```ts
+import {
+  appendStatus,
+  StatusChangeEntry,
+  StatusHistory,
+  timeInStatus,
+  lastTransitionTo,
+} from '@classytic/crm';
+```
+
+These pass through from `@classytic/primitives/status-history`. The
+existing entity-specific `LeadStatusEntry` / `OpportunityStatusEntry` /
+etc. names are still exported for back-compat — they remain structurally
+compatible with `StatusChangeEntry<TStatus>`.
+
+### Changed
+
+- Peer dep `@classytic/primitives` bumped from `>=0.5.0` to `>=0.6.0`
+  to access the new `status-history` subpath and value-typed primitives.
+- Test harness `buildHarness()` now also exposes an
+  `emailEvents: EmailEventService` and `emailEventRepo` for integration
+  tests that exercise the engagement → drip path.
+
+### Dependencies
+
+- `@classytic/primitives@>=0.6.0` (peer, was `>=0.5.0`)
+- `zod@>=4.0.0` (peer, unchanged)
+
+## [0.1.0] — 2026-04-18
+
+Initial release.
+
+### Added
+
+- **Eight domain entities.** `Contact`, `Account`, `Lead`, `Opportunity`, `Pipeline` (+ nested `Stage`), `Activity`, `Note`, `LossReason`.
+- **Three state machines.** Lead (`new` → `contacted` → `qualified` → `converted`, + `disqualified` / `nurturing` branches), Opportunity (`open` → `won` / `lost` / `abandoned` with in-pipeline Stage movement), Activity (`planned` → `in_progress` → `completed` / `cancelled`). All transitions CAS-guarded with explicit `*_TRANSITIONS` maps and `canTransition*` guards.
+- **Six services.**
+  - `ContactService` — CRUD + tag filtering + email lookup.
+  - `AccountService` — CRUD + domain lookup.
+  - `PipelineService` — create, archive, stage helpers (`getStage`, `getFirstStage`, `getNextStage`).
+  - `OpportunityService` — create at first stage (or specified), `moveToStage` with advance/regress event disambiguation, `win` / `lose` (with `lostReasonId`) / `abandon`.
+  - `LeadService` — CRUD + full lifecycle (`markContacted`, `qualify`, `disqualify`, `nurture`) + `convert()` — the crown-jewel verb that atomically creates Contact + Account + Opportunity and transitions the lead to `converted`.
+  - `ActivityService` — polymorphic activities (`plan`, `start`, `complete`, `cancel`) + notes (`addNote`, `listNotesBySubject`).
+- **Pure calculators.**
+  - `defaultLeadScorer` + `composeScorers(...rules)` — host injects whatever rubric (firmographics, in-app signals, ML prediction, enrichment) via a `(lead: Lead) => number` function.
+  - `forecast(opportunities, options?)` — committed + weighted pipeline by bucket (default ISO month), with custom bucket function support. Currency-mismatch detection.
+  - `pipelineConversion(opportunities, stageIds)` — where do deals die? returns per-stage current count + won/lost counts + conversion rate.
+- **Nine repository ports** — one per entity (plus `EventTransport`, `IdGenerator`, `Clock`, optional `OutreachPort`). Full in-memory reference implementations shipped.
+- **Typed error hierarchy** rooted at `CrmError`: `NotFoundError`, `InvalidLeadTransitionError`, `InvalidOpportunityTransitionError`, `InvalidActivityTransitionError`, `StageNotInPipelineError`, `LeadAlreadyConvertedError`, `DuplicateLeadError`, `EmptyPipelineError`.
+- **Nineteen lifecycle events** (`CRM_EVENTS`): covering lead/account/contact/opportunity/pipeline/activity/note verbs, all following `crm:<resource>.<verb>` per PACKAGE_RULES rule 12.
+- **Optional `OutreachPort`** — one-method (`send`) + `NullOutreachPort` + `InMemoryOutreachPort` (recording). Host subscribes to `crm:activity.*` events and drives the port from their automation layer (keeps pacing / retry / bounce handling out of the core).
+- **Testing.** `vitest.config.ts` projects split `unit` + `integration` per [testing-infrastructure.md](../../testing-infrastructure.md). 48 tests (7 files) — all green in <1.5s.
+
+### Design choices
+
+- Pure-TS port-based pattern — consistent with `@classytic/manufacturing`, `@classytic/assets`, `@classytic/fleet`, `@classytic/carrier-*`.
+- Separate Lead + Opportunity models (erpnext style) rather than unified (odoo style) — cleaner semantics for pre-qualification vs in-pipeline data and enables distinct analytics.
+- Polymorphic Activity / Note via `subjectKind` + `subjectId` so hosts can extend without schema changes.
+- `LeadService.convert()` is atomic in intent and sequenced for auditability — it creates Account, then Contact, then Opportunity, then transitions the lead. If a downstream repo fails, the ones that succeeded persist (hosts using Mongoose sessions get atomicity at their layer).
+- Campaigns, appointment booking, competitors, contracts, team routing, RBAC, custom-field validation, email-thread parsing deferred to v0.2+ to keep the surface focused.

package/dist/index.js

@@ -1,8 +1,8 @@
 import { t as __exportAll } from "./chunk.js";
 import { Schema } from "mongoose";
-import { Repository, aggregateHelpersPlugin, isDuplicateKeyError, methodRegistryPlugin, multiTenantPlugin, withTransaction } from "@classytic/mongokit";
+import { Repository, aggregateHelpersPlugin, appendOnlyPlugin, isDuplicateKeyError, methodRegistryPlugin, multiTenantPlugin, withTransaction } from "@classytic/mongokit";
 import { createEvent as createEvent$1, matchEventPattern } from "@classytic/primitives/events";
-import { IllegalTransitionError, assertAndClaim, defineStateMachine } from "@classytic/primitives/state-machine";
+import { IllegalTransitionError, defineStateMachine } from "@classytic/primitives/state-machine";
 import { randomUUID } from "node:crypto";
 import { z } from "zod";
 import { civilDateOf } from "@classytic/primitives/timezone";
@@ -2293,6 +2293,19 @@ function composeScorers(...rules) {
 	return (lead) => rules.reduce((acc, r) => acc + r(lead), 0);
 }
 //#endregion
+//#region src/repositories/transition-support.ts
+/**
+* mongokit `applyTransition()` race-outcome detection — pure races /
+* vanished rows remap to each verb's historical error (typed transition
+* error built from a fresh read, or NotFound where that was the
+* contract); now-illegal races throw the machine's errorFactory error
+* with the on-disk status natively.
+*/
+function isTransitionRace(err) {
+	const code = err?.code;
+	return code === "TRANSITION_RACE_LOST" || code === "TRANSITION_TARGET_MISSING";
+}
+//#endregion
 //#region src/repositories/lead.repository.ts
 /** signal → engagement counter field. */
 const ENGAGEMENT_COUNTER = {
@@ -2461,19 +2474,19 @@ var LeadRepository = class extends Repository {
 			...extras.by !== void 0 ? { by: extras.by } : {},
 			...extras.note !== void 0 ? { note: extras.note } : {}
 		};
-		const updated = await assertAndClaim(LEAD_MACHINE, this, id, {
+		const updated = await this.applyTransition(id, LEAD_MACHINE, {
 			from: existing.status,
 			to: target,
-			patch: {
-				...extras.patch ?? {},
-				statusHistory: [...existing.statusHistory ?? [], entry]
-			},
-			options: ctx
-		});
-		if (!updated) throw new InvalidLeadTransitionError({
-			from: (await this.getById(id, ctx))?.status ?? existing.status,
-			to: target,
-			leadId: id
+			set: extras.patch ?? {},
+			push: { statusHistory: entry },
+			history: false
+		}, ctx).catch(async (err) => {
+			if (!isTransitionRace(err)) throw err;
+			throw new InvalidLeadTransitionError({
+				from: (await this.getById(id, ctx))?.status ?? existing.status,
+				to: target,
+				leadId: id
+			});
 		});
 		await this.events.dispatch(ctx, createEvent(CRM_EVENTS.LEAD_STATUS_CHANGED, {
 			leadId: id,
@@ -2719,7 +2732,6 @@ var OpportunityRepository = class extends Repository {
 	async _closeStatus(id, target, patch, extras, ctx) {
 		const existing = await this.getById(id, ctx);
 		if (!existing) throw new NotFoundError("Opportunity", id);
-		OPPORTUNITY_MACHINE.assertTransition(id, existing.status, target);
 		const entry = {
 			status: target,
 			stageId: existing.stageId,
@@ -2727,21 +2739,20 @@ var OpportunityRepository = class extends Repository {
 			...extras.by !== void 0 ? { by: extras.by } : {},
 			...extras.note !== void 0 ? { note: extras.note } : {}
 		};
-		const updated = await assertAndClaim(OPPORTUNITY_MACHINE, this, id, {
+		return await this.applyTransition(id, OPPORTUNITY_MACHINE, {
 			from: existing.status,
 			to: target,
-			patch: {
-				...patch,
-				statusHistory: [...existing.statusHistory ?? [], entry]
-			},
-			options: ctx
-		});
-		if (!updated) throw new InvalidOpportunityTransitionError({
-			from: (await this.getById(id, ctx))?.status ?? existing.status,
-			to: target,
-			opportunityId: id
+			set: patch,
+			push: { statusHistory: entry },
+			history: false
+		}, ctx).catch(async (err) => {
+			if (!isTransitionRace(err)) throw err;
+			throw new InvalidOpportunityTransitionError({
+				from: (await this.getById(id, ctx))?.status ?? existing.status,
+				to: target,
+				opportunityId: id
+			});
 		});
-		return updated;
 	}
 	/** Count opportunities with status `open`. Used by dashboard KPI tiles. */
 	async countOpen(ctx) {
@@ -3075,28 +3086,26 @@ var CampaignRepository = class extends Repository {
 	async _transition(id, target, extras, ctx, patch = {}) {
 		const existing = await this.getById(id, ctx);
 		if (!existing) throw new NotFoundError("Campaign", id);
-		CAMPAIGN_MACHINE.assertTransition(id, existing.status, target);
 		const entry = {
 			status: target,
 			occurredAt: /* @__PURE__ */ new Date(),
 			...extras.by !== void 0 ? { by: extras.by } : {},
 			...extras.note !== void 0 ? { note: extras.note } : {}
 		};
-		const updated = await assertAndClaim(CAMPAIGN_MACHINE, this, id, {
+		return await this.applyTransition(id, CAMPAIGN_MACHINE, {
 			from: existing.status,
 			to: target,
-			patch: {
-				...patch,
-				statusHistory: [...existing.statusHistory ?? [], entry]
-			},
-			options: ctx
-		});
-		if (!updated) throw new InvalidCampaignTransitionError({
-			from: (await this.getById(id, ctx))?.status ?? existing.status,
-			to: target,
-			campaignId: id
+			set: patch,
+			push: { statusHistory: entry },
+			history: false
+		}, ctx).catch(async (err) => {
+			if (!isTransitionRace(err)) throw err;
+			throw new InvalidCampaignTransitionError({
+				from: (await this.getById(id, ctx))?.status ?? existing.status,
+				to: target,
+				campaignId: id
+			});
 		});
-		return updated;
 	}
 };
 //#endregion
@@ -3237,28 +3246,26 @@ var SubscriptionRepository = class extends Repository {
 	async _transition(id, target, opts, ctx) {
 		const existing = await this.getById(id, ctx);
 		if (!existing) throw new NotFoundError("Subscription", id);
-		SUBSCRIPTION_MACHINE.assertTransition(id, existing.status, target);
 		const entry = {
 			status: target,
 			occurredAt: /* @__PURE__ */ new Date(),
 			...opts.by !== void 0 ? { by: opts.by } : {},
 			...opts.note !== void 0 ? { note: opts.note } : {}
 		};
-		const updated = await assertAndClaim(SUBSCRIPTION_MACHINE, this, id, {
+		return await this.applyTransition(id, SUBSCRIPTION_MACHINE, {
 			from: existing.status,
 			to: target,
-			patch: {
-				...opts.patch ?? {},
-				statusHistory: [...existing.statusHistory ?? [], entry]
-			},
-			options: ctx
-		});
-		if (!updated) throw new InvalidSubscriptionTransitionError({
-			from: (await this.getById(id, ctx))?.status ?? existing.status,
-			to: target,
-			subscriptionId: id
+			set: opts.patch ?? {},
+			push: { statusHistory: entry },
+			history: false
+		}, ctx).catch(async (err) => {
+			if (!isTransitionRace(err)) throw err;
+			throw new InvalidSubscriptionTransitionError({
+				from: (await this.getById(id, ctx))?.status ?? existing.status,
+				to: target,
+				subscriptionId: id
+			});
 		});
-		return updated;
 	}
 };
 //#endregion
@@ -3427,19 +3434,19 @@ var ActivityRepository = class extends Repository {
 	async _transition(id, target, patch, ctx) {
 		const existing = await this.getById(id, ctx);
 		if (!existing) throw new NotFoundError("Activity", id);
-		ACTIVITY_MACHINE.assertTransition(id, existing.status, target);
-		const updated = await assertAndClaim(ACTIVITY_MACHINE, this, id, {
+		return await this.applyTransition(id, ACTIVITY_MACHINE, {
 			from: existing.status,
 			to: target,
-			patch,
-			options: ctx
-		});
-		if (!updated) throw new InvalidActivityTransitionError({
-			from: (await this.getById(id, ctx))?.status ?? existing.status,
-			to: target,
-			activityId: id
+			set: patch,
+			history: false
+		}, ctx).catch(async (err) => {
+			if (!isTransitionRace(err)) throw err;
+			throw new InvalidActivityTransitionError({
+				from: (await this.getById(id, ctx))?.status ?? existing.status,
+				to: target,
+				activityId: id
+			});
 		});
-		return updated;
 	}
 	/** Count `planned` activities with `dueDate` before `asOf`. Dashboard KPI. */
 	async countOverduePlanned(asOf, ctx) {
@@ -3510,7 +3517,7 @@ const KIND_TO_EVENT = {
 var EmailEventRepository = class extends Repository {
 	events;
 	constructor(model, plugins, deps, pagination) {
-		super(model, plugins, pagination);
+		super(model, [...plugins, appendOnlyPlugin({ allow: ["deleteMany"] })], pagination);
 		this.events = deps.events;
 	}
 	async recordOpen(input, ctx) {
@@ -3735,24 +3742,24 @@ var SequenceRepository = class extends Repository {
 	async _transition(id, target, ctx) {
 		const existing = await this.getById(id, ctx);
 		if (!existing) throw new NotFoundError("Sequence", id);
-		SEQUENCE_MACHINE.assertTransition(id, existing.status, target);
 		const entry = {
 			status: target,
 			occurredAt: /* @__PURE__ */ new Date(),
 			...ctx?.actorId !== void 0 ? { by: String(ctx.actorId) } : {}
 		};
-		const updated = await assertAndClaim(SEQUENCE_MACHINE, this, id, {
+		return await this.applyTransition(id, SEQUENCE_MACHINE, {
 			from: existing.status,
 			to: target,
-			patch: { statusHistory: [...existing.statusHistory ?? [], entry] },
-			options: ctx
-		});
-		if (!updated) throw new InvalidSequenceTransitionError({
-			from: (await this.getById(id, ctx))?.status ?? existing.status,
-			to: target,
-			sequenceId: id
+			push: { statusHistory: entry },
+			history: false
+		}, ctx).catch(async (err) => {
+			if (!isTransitionRace(err)) throw err;
+			throw new InvalidSequenceTransitionError({
+				from: (await this.getById(id, ctx))?.status ?? existing.status,
+				to: target,
+				sequenceId: id
+			});
 		});
-		return updated;
 	}
 };
 //#endregion
@@ -3839,16 +3846,16 @@ var EnrollmentRepository = class extends Repository {
 			occurredAt: /* @__PURE__ */ new Date(),
 			...ctx?.actorId ? { by: String(ctx.actorId) } : {}
 		};
-		const updated = await assertAndClaim(ENROLLMENT_MACHINE, this, id, {
+		const updated = await this.applyTransition(id, ENROLLMENT_MACHINE, {
 			from,
 			to: "exited",
-			patch: {
-				exitReason,
-				statusHistory: [...existing.statusHistory ?? [], entry]
-			},
-			options: ctx
+			set: { exitReason },
+			push: { statusHistory: entry },
+			history: false
+		}, ctx).catch((err) => {
+			if (isTransitionRace(err)) throw new NotFoundError("Enrollment", id);
+			throw err;
 		});
-		if (!updated) throw new NotFoundError("Enrollment", id);
 		await this.events.dispatch(ctx, createEvent(CRM_EVENTS.ENROLLMENT_EXITED, {
 			enrollmentId: id,
 			exitReason
@@ -3907,27 +3914,25 @@ var EnrollmentRepository = class extends Repository {
 	async _transition(id, target, ctx, patch = {}) {
 		const existing = await this.getById(id, ctx);
 		if (!existing) throw new NotFoundError("Enrollment", id);
-		ENROLLMENT_MACHINE.assertTransition(id, existing.status, target);
 		const entry = {
 			status: target,
 			occurredAt: /* @__PURE__ */ new Date(),
 			...ctx?.actorId ? { by: String(ctx.actorId) } : {}
 		};
-		const updated = await assertAndClaim(ENROLLMENT_MACHINE, this, id, {
+		return await this.applyTransition(id, ENROLLMENT_MACHINE, {
 			from: existing.status,
 			to: target,
-			patch: {
-				...patch,
-				statusHistory: [...existing.statusHistory ?? [], entry]
-			},
-			options: ctx
-		});
-		if (!updated) throw new InvalidEnrollmentTransitionError({
-			from: (await this.getById(id, ctx))?.status ?? existing.status,
-			to: target,
-			enrollmentId: id
+			set: patch,
+			push: { statusHistory: entry },
+			history: false
+		}, ctx).catch(async (err) => {
+			if (!isTransitionRace(err)) throw err;
+			throw new InvalidEnrollmentTransitionError({
+				from: (await this.getById(id, ctx))?.status ?? existing.status,
+				to: target,
+				enrollmentId: id
+			});
 		});
-		return updated;
 	}
 };
 //#endregion

package/package.json

@@ -1,73 +1,73 @@
-{
-  "name": "@classytic/crm",
-  "version": "0.8.0",
-  "description": "Engine-factory CRM package — leads, accounts, contacts, opportunities, pipelines, campaigns, subscriptions, activities, notes, email engagement. PACKAGE_RULES compliant; built on Mongoose + mongokit + arc primitives.",
-  "author": "Classytic",
-  "license": "MIT",
-  "type": "module",
-  "sideEffects": false,
-  "engines": {
-    "node": ">=22"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "default": "./dist/index.js"
-    },
-    "./events": {
-      "types": "./dist/events.d.ts",
-      "default": "./dist/events.js"
-    },
-    "./package.json": "./package.json"
-  },
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "files": [
-    "dist",
-    "README.md",
-    "CHANGELOG.md",
-    "LICENSE"
-  ],
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/classytic/crm.git"
-  },
-  "bugs": {
-    "url": "https://github.com/classytic/crm/issues"
-  },
-  "homepage": "https://github.com/classytic/crm#readme",
-  "scripts": {
-    "build": "tsdown",
-    "typecheck": "tsc --noEmit",
-    "test": "vitest run --project unit --project integration",
-    "test:unit": "vitest run --project unit",
-    "test:integration": "vitest run --project integration",
-    "test:e2e": "vitest run --project e2e",
-    "test:all": "vitest run",
-    "test:watch": "vitest --project unit --project integration",
-    "push": "classytic-push"
-  },
-  "peerDependencies": {
-    "@classytic/mongokit": ">=3.18.0",
-    "@classytic/primitives": ">=0.9.1",
-    "@classytic/repo-core": ">=0.7.0",
-    "mongoose": ">=9.4.1",
-    "zod": ">=4.0.0"
-  },
-  "devDependencies": {
-    "@classytic/dev-tools": "^0.2.0",
-    "@classytic/mongokit": "^3.18.0",
-    "@classytic/primitives": "^0.9.0",
-    "@classytic/repo-core": "^0.7.0",
-    "@types/node": "^25.5.0",
-    "mongodb-memory-server": "^10.1.4",
-    "mongoose": "^9.4.1",
-    "tsdown": "^0.21.10",
-    "typescript": "^5.8.2",
-    "vitest": "^3.2.4",
-    "zod": "^4.3.6"
-  }
-}
+{
+  "name": "@classytic/crm",
+  "version": "0.9.0",
+  "description": "Engine-factory CRM package \u2014 leads, accounts, contacts, opportunities, pipelines, campaigns, subscriptions, activities, notes, email engagement. PACKAGE_RULES compliant; built on Mongoose + mongokit + arc primitives.",
+  "author": "Classytic",
+  "license": "MIT",
+  "type": "module",
+  "sideEffects": false,
+  "engines": {
+    "node": ">=22"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./events": {
+      "types": "./dist/events.d.ts",
+      "default": "./dist/events.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/classytic/crm.git"
+  },
+  "bugs": {
+    "url": "https://github.com/classytic/crm/issues"
+  },
+  "homepage": "https://github.com/classytic/crm#readme",
+  "scripts": {
+    "build": "tsdown",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run --project unit --project integration",
+    "test:unit": "vitest run --project unit",
+    "test:integration": "vitest run --project integration",
+    "test:e2e": "vitest run --project e2e",
+    "test:all": "vitest run",
+    "test:watch": "vitest --project unit --project integration",
+    "push": "classytic-push"
+  },
+  "peerDependencies": {
+    "@classytic/mongokit": ">=3.22.0",
+    "@classytic/primitives": ">=0.11.0",
+    "@classytic/repo-core": ">=0.13.0",
+    "mongoose": ">=9.4.1",
+    "zod": ">=4.0.0"
+  },
+  "devDependencies": {
+    "@classytic/dev-tools": "^0.2.0",
+    "@classytic/mongokit": "^3.22.0",
+    "@classytic/primitives": "^0.11.0",
+    "@classytic/repo-core": "^0.13.0",
+    "@types/node": "^25.5.0",
+    "mongodb-memory-server": "^10.1.4",
+    "mongoose": "^9.4.1",
+    "tsdown": "^0.21.10",
+    "typescript": "^5.8.2",
+    "vitest": "^3.2.4",
+    "zod": "^4.3.6"
+  }
+}