@elevasis/core 0.1.0

package/src/projects/api-schemas.ts

@@ -0,0 +1,265 @@
+import { z } from 'zod'
+import { UuidSchema } from '../platform/utils/validation'
+
+/**
+ * Project Management API Schemas
+ *
+ * Request/response validation for /api/external/projects surface.
+ * Used by both the API (external-routes.ts) and the CLI (packages/cli).
+ *
+ * Table mapping:
+ *   prj_projects   -> ProjectSchemas
+ *   prj_milestones -> MilestoneSchemas
+ *   prj_tasks      -> TaskSchemas
+ *   prj_notes      -> NoteSchemas
+ */
+
+// ---------------------------------------------------------------------------
+// Enum literals (must match DB CHECK constraints exactly)
+// ---------------------------------------------------------------------------
+
+export const ProjectKindSchema = z.enum(['client_engagement', 'internal', 'research', 'other'])
+export const ProjectStatusSchema = z.enum(['active', 'on_track', 'at_risk', 'blocked', 'completed', 'paused'])
+export const MilestoneStatusSchema = z.enum(['upcoming', 'in_progress', 'completed', 'overdue', 'blocked'])
+export const TaskStatusSchema = z.enum([
+  'planned',
+  'in_progress',
+  'blocked',
+  'completed',
+  'cancelled',
+  'submitted',
+  'approved',
+  'rejected',
+  'revision_requested'
+])
+export const TaskTypeSchema = z.enum([
+  'documentation',
+  'code',
+  'report',
+  'design',
+  'refactor',
+  'feature',
+  'bug',
+  'research',
+  'other'
+])
+export const NoteTypeSchema = z.enum(['call_note', 'status_update', 'issue', 'blocker'])
+
+// ---------------------------------------------------------------------------
+// Checklist item shape (JSONB array stored on prj_tasks)
+// ---------------------------------------------------------------------------
+
+export const ChecklistItemSchema = z.object({
+  id: z.string(),
+  label: z.string(),
+  completed: z.boolean()
+})
+
+export const ChecklistSchema = z.array(ChecklistItemSchema)
+
+// ---------------------------------------------------------------------------
+// resume_context shape (JSONB on prj_tasks, merged on PATCH .../resume-context)
+// ---------------------------------------------------------------------------
+
+export const ResumeContextSchema = z.record(z.string(), z.unknown())
+
+// ---------------------------------------------------------------------------
+// Projects
+// ---------------------------------------------------------------------------
+
+export const CreateProjectRequestSchema = z
+  .object({
+    name: z.string().trim().min(1).max(255),
+    kind: ProjectKindSchema,
+    status: ProjectStatusSchema.optional(),
+    description: z.string().nullable().optional(),
+    deal_id: UuidSchema.nullable().optional(),
+    client_company_id: UuidSchema.nullable().optional(),
+    start_date: z.string().nullable().optional(),
+    target_end_date: z.string().nullable().optional(),
+    contract_value: z.number().nullable().optional(),
+    metadata: z.record(z.string(), z.unknown()).nullable().optional()
+  })
+  .strict()
+
+export const UpdateProjectRequestSchema = z
+  .object({
+    name: z.string().trim().min(1).max(255).optional(),
+    kind: ProjectKindSchema.optional(),
+    status: ProjectStatusSchema.optional(),
+    description: z.string().nullable().optional(),
+    deal_id: UuidSchema.nullable().optional(),
+    client_company_id: UuidSchema.nullable().optional(),
+    start_date: z.string().nullable().optional(),
+    target_end_date: z.string().nullable().optional(),
+    actual_end_date: z.string().nullable().optional(),
+    contract_value: z.number().nullable().optional(),
+    metadata: z.record(z.string(), z.unknown()).nullable().optional()
+  })
+  .strict()
+  .refine((data) => Object.keys(data).length > 0, { message: 'At least one field must be provided' })
+
+export const GetProjectsQuerySchema = z
+  .object({
+    kind: ProjectKindSchema.optional()
+  })
+  .strict()
+
+export const ProjectIdParamsSchema = z.object({ id: UuidSchema })
+
+// ---------------------------------------------------------------------------
+// Milestones
+// ---------------------------------------------------------------------------
+
+export const CreateMilestoneRequestSchema = z
+  .object({
+    name: z.string().trim().min(1).max(255),
+    status: MilestoneStatusSchema.optional(),
+    description: z.string().nullable().optional(),
+    due_date: z.string().nullable().optional(),
+    sequence: z.number().int().min(0).optional(),
+    metadata: z.record(z.string(), z.unknown()).nullable().optional()
+  })
+  .strict()
+
+export const UpdateMilestoneRequestSchema = z
+  .object({
+    name: z.string().trim().min(1).max(255).optional(),
+    status: MilestoneStatusSchema.optional(),
+    description: z.string().nullable().optional(),
+    due_date: z.string().nullable().optional(),
+    completed_at: z.string().nullable().optional(),
+    sequence: z.number().int().min(0).optional(),
+    metadata: z.record(z.string(), z.unknown()).nullable().optional()
+  })
+  .strict()
+  .refine((data) => Object.keys(data).length > 0, { message: 'At least one field must be provided' })
+
+export const ProjectIdPathParamsSchema = z.object({ projectId: UuidSchema })
+export const MilestoneIdParamsSchema = z.object({ id: UuidSchema })
+
+// ---------------------------------------------------------------------------
+// Tasks
+// ---------------------------------------------------------------------------
+
+export const CreateTaskRequestSchema = z
+  .object({
+    project_id: UuidSchema,
+    name: z.string().trim().min(1).max(255),
+    type: TaskTypeSchema.optional(),
+    status: TaskStatusSchema.optional(),
+    description: z.string().nullable().optional(),
+    milestone_id: UuidSchema.nullable().optional(),
+    parent_task_id: UuidSchema.nullable().optional(),
+    due_date: z.string().nullable().optional(),
+    checklist: ChecklistSchema.optional(),
+    resume_context: ResumeContextSchema.nullable().optional(),
+    metadata: z.record(z.string(), z.unknown()).nullable().optional()
+  })
+  .strict()
+
+export const UpdateTaskRequestSchema = z
+  .object({
+    name: z.string().trim().min(1).max(255).optional(),
+    type: TaskTypeSchema.optional(),
+    status: TaskStatusSchema.optional(),
+    description: z.string().nullable().optional(),
+    milestone_id: UuidSchema.nullable().optional(),
+    parent_task_id: UuidSchema.nullable().optional(),
+    due_date: z.string().nullable().optional(),
+    completed_at: z.string().nullable().optional(),
+    checklist: ChecklistSchema.optional(),
+    resume_context: ResumeContextSchema.nullable().optional(),
+    file_url: z.string().nullable().optional(),
+    metadata: z.record(z.string(), z.unknown()).nullable().optional()
+  })
+  .strict()
+  .refine((data) => Object.keys(data).length > 0, { message: 'At least one field must be provided' })
+
+export const MergeResumeContextRequestSchema = z
+  .record(z.string(), z.unknown())
+  .refine((data) => Object.keys(data).length > 0, { message: 'At least one field must be provided' })
+
+export const GetTasksQuerySchema = z
+  .object({
+    status: TaskStatusSchema.optional(),
+    milestone_id: UuidSchema.optional(),
+    parent_task_id: UuidSchema.optional()
+  })
+  .strict()
+
+export const TaskIdParamsSchema = z.object({ id: UuidSchema })
+
+// ---------------------------------------------------------------------------
+// Notes
+// ---------------------------------------------------------------------------
+
+export const CreateNoteRequestSchema = z
+  .object({
+    project_id: UuidSchema,
+    content: z.string().trim().min(1),
+    type: NoteTypeSchema.optional(),
+    summary: z.string().nullable().optional(),
+    task_id: UuidSchema.nullable().optional(),
+    milestone_id: UuidSchema.nullable().optional(),
+    occurred_at: z.string().optional(),
+    metadata: z.record(z.string(), z.unknown()).nullable().optional()
+  })
+  .strict()
+
+export const UpdateNoteRequestSchema = z
+  .object({
+    content: z.string().trim().min(1).optional(),
+    type: NoteTypeSchema.optional(),
+    summary: z.string().nullable().optional(),
+    task_id: UuidSchema.nullable().optional(),
+    milestone_id: UuidSchema.nullable().optional(),
+    occurred_at: z.string().optional(),
+    metadata: z.record(z.string(), z.unknown()).nullable().optional()
+  })
+  .strict()
+  .refine((data) => Object.keys(data).length > 0, { message: 'At least one field must be provided' })
+
+export const NoteIdParamsSchema = z.object({ id: UuidSchema })
+
+// ---------------------------------------------------------------------------
+// Bundled export (mirrors CredentialSchemas pattern)
+// ---------------------------------------------------------------------------
+
+export const ProjectSchemas = {
+  // Projects
+  CreateProjectRequest: CreateProjectRequestSchema,
+  UpdateProjectRequest: UpdateProjectRequestSchema,
+  GetProjectsQuery: GetProjectsQuerySchema,
+  ProjectIdParams: ProjectIdParamsSchema,
+
+  // Milestones
+  CreateMilestoneRequest: CreateMilestoneRequestSchema,
+  UpdateMilestoneRequest: UpdateMilestoneRequestSchema,
+  ProjectIdPathParams: ProjectIdPathParamsSchema,
+  MilestoneIdParams: MilestoneIdParamsSchema,
+
+  // Tasks
+  CreateTaskRequest: CreateTaskRequestSchema,
+  UpdateTaskRequest: UpdateTaskRequestSchema,
+  MergeResumeContextRequest: MergeResumeContextRequestSchema,
+  GetTasksQuery: GetTasksQuerySchema,
+  TaskIdParams: TaskIdParamsSchema,
+
+  // Notes
+  CreateNoteRequest: CreateNoteRequestSchema,
+  UpdateNoteRequest: UpdateNoteRequestSchema,
+  NoteIdParams: NoteIdParamsSchema
+}
+
+// ---------------------------------------------------------------------------
+// Inferred types
+// ---------------------------------------------------------------------------
+
+export type ProjectKind = z.infer<typeof ProjectKindSchema>
+export type ProjectStatus = z.infer<typeof ProjectStatusSchema>
+export type MilestoneStatus = z.infer<typeof MilestoneStatusSchema>
+export type TaskStatus = z.infer<typeof TaskStatusSchema>
+export type TaskType = z.infer<typeof TaskTypeSchema>
+export type NoteType = z.infer<typeof NoteTypeSchema>
+export type ChecklistItem = z.infer<typeof ChecklistItemSchema>

package/src/published.ts

@@ -0,0 +1 @@
+export * from './organization-model/published'

package/src/server.ts

@@ -0,0 +1,273 @@
+/**
+ * Server-only exports for @repo/core
+ *
+ * WARNING: DO NOT import in browser/frontend code
+ * This module uses Node.js APIs (crypto, process.env) and server-side libraries
+ *
+ * For browser-safe imports, use '@repo/core' instead
+ */
+
+// Credential management (uses Node.js crypto)
+export { encryptCredential, decryptCredential } from './auth/multi-tenancy/credentials/server/encryption'
+
+export {
+  prepareCredentialForInsert,
+  decryptCredentialValue,
+  transformToMetadata,
+  type CreateCredentialParams,
+  type CredentialMetadata
+} from './auth/multi-tenancy/credentials/server/service'
+
+// Session management (uses Supabase service client)
+export { SessionManager } from './operations/sessions/server/manager'
+export { Session } from './operations/sessions/server/session'
+export type {
+  SessionTurnResult,
+  CreateSessionParams,
+  ListSessionsFilters,
+  SessionRow,
+  SessionInsert
+} from './operations/sessions/types'
+
+// Multi-tenancy WorkOS types and transforms (server-only)
+export * from './auth/multi-tenancy/organizations/server'
+export * from './auth/multi-tenancy/users/server'
+export * from './auth/multi-tenancy/memberships/server'
+export * from './auth/multi-tenancy/invitations/server'
+
+// Note: Browser-safe and Supabase types are re-exported from /server subdirectories
+// No additional re-exports needed here to avoid conflicts
+
+// Supabase client (service role with process.env credentials - lazy initialization)
+export { getSupabaseClient, supabaseClient } from './supabase/server/client'
+export type { SupabaseClient, Database, Tables, TablesInsert, TablesUpdate, Json } from './supabase'
+
+// OAuth credentials and token refresh (uses process.env for client credentials)
+export { getOAuthCredentials } from './integrations/oauth/server/credentials'
+export { refreshOAuthTokenIfExpired, forceRefreshOAuthToken } from './integrations/oauth/server/refresh'
+
+// Integration adapters (uses Node.js SDKs - googleapis, @slack/web-api)
+export { GmailAdapter } from './execution/engine/tools/integration/server/adapters/gmail/gmail-adapter'
+export { AttioAdapter } from './execution/engine/tools/integration/server/adapters/attio'
+export { GoogleSheetsAdapter } from './execution/engine/tools/integration/server/adapters/google-sheets'
+export { ApifyAdapter } from './execution/engine/tools/integration/server/adapters/apify'
+export { InstantlyAdapter } from './execution/engine/tools/integration/server/adapters/instantly'
+export { ResendAdapter } from './execution/engine/tools/integration/server/adapters/resend'
+export { AnymailfinderAdapter } from './execution/engine/tools/integration/server/adapters/anymailfinder'
+export { TombaAdapter } from './execution/engine/tools/integration/server/adapters/tomba'
+export { MillionVerifierAdapter } from './execution/engine/tools/integration/server/adapters/millionverifier'
+export { StripeAdapter } from './execution/engine/tools/integration/server/adapters/stripe'
+export { SignatureApiAdapter } from './execution/engine/tools/integration/server/adapters/signature-api'
+export { DropboxAdapter } from './execution/engine/tools/integration/server/adapters/dropbox'
+
+// Integration Tool Factories (server-only - uses adapters above)
+export {
+  createGmailSendEmailTool,
+  createGmailSendEmailToolNamed
+} from './execution/engine/tools/integration/server/adapters/gmail/gmail-tools'
+export {
+  createAttioCreateRecordTool,
+  createAttioUpdateRecordTool,
+  createAttioListRecordsTool,
+  createAttioGetRecordTool,
+  createAttioDeleteRecordTool,
+  createAttioToolNamed,
+  // Schema operations
+  createAttioListObjectsTool,
+  createAttioListAttributesTool,
+  createAttioCreateAttributeTool,
+  createAttioUpdateAttributeTool,
+  // Note operations
+  createAttioCreateNoteTool
+} from './execution/engine/tools/integration/server/adapters/attio'
+export {
+  // Core methods
+  createGoogleSheetsReadTool,
+  createGoogleSheetsWriteTool,
+  createGoogleSheetsAppendTool,
+  createGoogleSheetsClearTool,
+  createGoogleSheetsMetadataTool,
+  createGoogleSheetsBatchUpdateTool,
+  // Workflow-friendly methods
+  createGoogleSheetsGetHeadersTool,
+  createGoogleSheetsGetLastRowTool,
+  createGoogleSheetsFindRowTool,
+  createGoogleSheetsUpdateRowTool,
+  createGoogleSheetsUpsertRowTool,
+  createGoogleSheetsFilterRowsTool,
+  createGoogleSheetsDeleteRowTool
+} from './execution/engine/tools/integration/server/adapters/google-sheets'
+export { createApifyRunActorTool } from './execution/engine/tools/integration/server/adapters/apify'
+export {
+  createInstantlySendReplyTool,
+  createInstantlyRemoveFromSubsequenceTool,
+  createInstantlyGetEmailsTool,
+  createInstantlyUpdateInterestStatusTool,
+  createInstantlyAddToCampaignTool
+} from './execution/engine/tools/integration/server/adapters/instantly'
+export {
+  createResendSendEmailTool,
+  createResendGetEmailTool,
+  createResendSendEmailToolNamed
+} from './execution/engine/tools/integration/server/adapters/resend'
+export {
+  createAnymailfinderFindCompanyEmailTool,
+  createAnymailfinderFindPersonEmailTool,
+  createAnymailfinderFindDecisionMakerEmailTool,
+  createAnymailfinderVerifyEmailTool
+} from './execution/engine/tools/integration/server/adapters/anymailfinder'
+export {
+  createTombaEmailFinderTool,
+  createTombaDomainSearchTool,
+  createTombaEmailVerifierTool
+} from './execution/engine/tools/integration/server/adapters/tomba'
+export {
+  createMillionVerifierVerifyEmailTool,
+  createMillionVerifierCheckCreditsTool
+} from './execution/engine/tools/integration/server/adapters/millionverifier'
+export {
+  createDropboxUploadTool,
+  createDropboxCreateFolderTool
+} from './execution/engine/tools/integration/server/adapters/dropbox'
+export {
+  createStripeCreatePaymentLinkTool,
+  createStripeGetPaymentLinkTool,
+  createStripeUpdatePaymentLinkTool,
+  createStripeListPaymentLinksTool,
+  createStripeCheckoutSessionTool,
+  createStripeAutoPaymentLinkTool
+} from './execution/engine/tools/integration/server/adapters/stripe'
+
+// Resend fetch functions (low-level API for platform email service)
+export { sendEmail as sendResendEmail } from './execution/engine/tools/integration/server/adapters/resend/fetch/send-email/index'
+export type {
+  ResendCredentials,
+  SendEmailParams as ResendSendEmailParams,
+  SendEmailResult as ResendSendEmailResult
+} from './execution/engine/tools/integration/server/adapters/resend/fetch/utils/types'
+
+// Resend email configuration (high-level sender config for workflows)
+export type { ResendEmailConfig } from './execution/engine/tools/integration/server/adapters/resend/types'
+
+// SignatureAPI types (for eSignature envelope operations)
+export type {
+  SignatureApiCredentials,
+  CreateEnvelopeParams,
+  CreateEnvelopeResult,
+  VoidEnvelopeParams,
+  VoidEnvelopeResult,
+  DownloadDocumentParams,
+  DownloadDocumentResult,
+  EnvelopeDocument,
+  Recipient,
+  SigningPlace
+} from './execution/engine/tools/integration/server/adapters/signature-api'
+
+// Execution validators (uses process.env for environment detection)
+export { detectEnvironment, canExecuteResource, type Environment } from './execution/core/server/environment'
+
+// HMAC token utilities (uses Node.js crypto - server-only)
+export { generateHmacToken, verifyHmacToken, generateBrochureUrl } from './platform/utils/server/hmac'
+export {
+  generateUnsubscribeToken,
+  verifyUnsubscribeToken,
+  generateUnsubscribeUrl,
+  generateUnsubscribeHeaders
+} from './platform/utils/server/unsubscribe'
+
+// Better Stack error logging (uses @sentry/node - server-only)
+export {
+  bslogExternalServiceError,
+  bslogExecutionFailure,
+  isSystemError
+} from './platform/utils/server/betterstack-logger'
+
+// LLM Adapters (uses betterstack-logger - server-only)
+export { OpenAIAdapter, isOpenAIModel, type OpenAIAdapterConfig } from './execution/engine/llm/adapters/server/openai'
+export {
+  OpenRouterAdapter,
+  isOpenRouterModel,
+  type OpenRouterAdapterConfig
+} from './execution/engine/llm/adapters/server/openrouter'
+export { createLLMAdapter } from './execution/engine/llm/adapters/server/adapter-factory'
+
+// Browser-safe adapters (also exported from server for convenience)
+export { UniversalLLMAdapter } from './execution/engine/llm/adapters/universal-adapter'
+export { MockAdapter, isMockModel } from './execution/engine/llm/adapters/mock-adapter'
+export { configureCircuitBreakerAlerts } from './execution/engine/llm/adapters/circuit-breaker'
+
+// LLM Tool factory (uses server-only adapters)
+export { createLLMCallTool, type LLMCallToolConfig } from './execution/engine/tools/llm/server'
+
+// Workflow step helper (uses server-only adapters)
+export { llmCall, type LLMCallOptions } from './execution/engine/workflow/helpers/server'
+
+// Resource invocation tool factory (uses runtime service registry)
+export { createResourceInvocationTool } from './execution/engine/tools/platform/resource-invocation'
+export type { ResourceDefinition } from './execution/engine/tools/platform/resource-invocation'
+
+// Resilience utilities (timeout, circuit breaker, infrastructure errors)
+export {
+  // Existing
+  withTimeout,
+  SERVICE_TIMEOUTS,
+  createCircuitBreaker,
+  CircuitState,
+  ServiceTimeoutError,
+  ServiceUnavailableError,
+  isInfrastructureError,
+  type CircuitBreaker,
+  type CircuitBreakerConfig,
+  // Rate limiting
+  InMemoryRateLimiter,
+  createRateLimiter,
+  // Retry logic
+  withRetry,
+  calculateRetryDelay,
+  sleep,
+  DEFAULT_RETRY_POLICY,
+  // HTTP error mapping
+  createHttpError,
+  mapHttpStatusToErrorType,
+  type RateLimiter,
+  type RetryPolicy,
+  type HttpErrorContext,
+  type ErrorParser
+} from './platform/resilience'
+
+// Acquisition Platform Tools (lead database)
+export {
+  // List tools
+  createAcqListCreateTool,
+  createAcqListUpdateTool,
+  createAcqListDeleteTool,
+  createAcqListListTool,
+  // Company tools
+  createAcqCompanyCreateTool,
+  createAcqCompanyUpdateTool,
+  createAcqCompanyUpsertTool,
+  createAcqCompanyGetTool,
+  createAcqCompanyListTool,
+  createAcqCompanyDeleteTool,
+  // Contact tools
+  createAcqContactCreateTool,
+  createAcqContactUpdateTool,
+  createAcqContactUpsertTool,
+  createAcqContactGetTool,
+  createAcqContactListTool,
+  createAcqContactDeleteTool,
+  createAcqContactBulkImportTool
+} from './execution/engine/tools/platform/acquisition'
+
+// PDF Tool (server-only - uses React-PDF renderToBuffer)
+export {
+  createPdfRenderTool,
+  type PdfRenderInput,
+  type PdfRenderOutput,
+  type PdfToolConfig,
+  PdfRenderInputSchema,
+  PdfRenderOutputSchema
+} from './execution/engine/tools/platform/pdf'
+
+// PDF Document types (for constructing documents programmatically)
+export type { PDFDocument, ContentBlock, Page as PDFPage } from './business/pdf/types'

package/src/supabase/__tests__/helpers.test.ts

@@ -0,0 +1,51 @@
+import { describe, it, expect } from 'vitest'
+import { sanitizePostgrestValue } from '../helpers'
+
+describe('sanitizePostgrestValue', () => {
+  it('passes through normal search strings unchanged', () => {
+    expect(sanitizePostgrestValue('hello')).toBe('hello')
+    expect(sanitizePostgrestValue('John Doe')).toBe('John Doe')
+    expect(sanitizePostgrestValue('test@example.com')).toBe('test@example.com')
+  })
+
+  it('strips commas that would split .or() conditions', () => {
+    expect(sanitizePostgrestValue('foo,bar')).toBe('foobar')
+    expect(sanitizePostgrestValue('a,b,c')).toBe('abc')
+  })
+
+  it('strips parentheses that would create logical grouping', () => {
+    expect(sanitizePostgrestValue('foo(bar)')).toBe('foobar')
+    expect(sanitizePostgrestValue('(test)')).toBe('test')
+  })
+
+  it('strips all special chars together', () => {
+    expect(sanitizePostgrestValue('test,name.eq.admin()')).toBe('testname.eq.admin')
+  })
+
+  it('preserves dots (safe in ilike values)', () => {
+    expect(sanitizePostgrestValue('example.com')).toBe('example.com')
+    expect(sanitizePostgrestValue('v1.2.3')).toBe('v1.2.3')
+  })
+
+  it('preserves percent and underscore (SQL wildcards used intentionally)', () => {
+    expect(sanitizePostgrestValue('100%')).toBe('100%')
+    expect(sanitizePostgrestValue('test_value')).toBe('test_value')
+  })
+
+  it('handles empty string', () => {
+    expect(sanitizePostgrestValue('')).toBe('')
+  })
+
+  it('prevents the specific attack vector: injecting extra filter conditions', () => {
+    // Without sanitization, this would produce:
+    //   name.ilike.%test,name.eq.secret%,domain.ilike.%test,name.eq.secret%
+    // PostgREST would parse "name.eq.secret%" as an additional filter condition
+    const malicious = 'test,name.eq.secret'
+    const sanitized = sanitizePostgrestValue(malicious)
+    const filter = `name.ilike.%${sanitized}%,domain.ilike.%${sanitized}%`
+
+    // Should produce exactly 2 conditions (one comma separator)
+    const topLevelCommas = filter.split(',').length - 1
+    expect(topLevelCommas).toBe(1)
+  })
+})