@elevasis/core 0.12.0 → 0.13.0

package/src/auth/multi-tenancy/credentials/server/kek-loader.ts

@@ -1,18 +1,16 @@
 import { getSupabaseClient } from '../../../../supabase/server/client'
-import { setKek, CURRENT_KEY_ID, LEGACY_KEY_ID } from './encryption'
+import { setKek, CURRENT_KEY_ID } from './encryption'
 
 let loaded = false
 
 /**
  * Loads the platform credential KEK from Supabase Vault and registers it under
- * `CURRENT_KEY_ID` ('platform-v1'). During the migration window, also registers
- * the legacy `SECRETS_ENCRYPTION_KEY` env var under `LEGACY_KEY_ID` so existing
- * ciphertext rows (no `keyId` field) can still be decrypted.
+ * `CURRENT_KEY_ID` ('platform-v1').
  *
  * Idempotent: subsequent calls are no-ops.
  *
  * Fails fast on missing / malformed Vault KEK so misconfigured deploys do not
- * silently fall through to env-only encryption.
+ * silently start without a usable encryption key.
  */
 export async function loadCredentialKEKs(): Promise<void> {
   if (loaded) return
@@ -35,13 +33,5 @@ export async function loadCredentialKEKs(): Promise<void> {
   }
   setKek(CURRENT_KEY_ID, vaultKek)
 
-  const legacyHex = process.env.SECRETS_ENCRYPTION_KEY
-  if (legacyHex) {
-    const legacyKey = Buffer.from(legacyHex, 'hex')
-    if (legacyKey.length === 32) {
-      setKek(LEGACY_KEY_ID, legacyKey)
-    }
-  }
-
   loaded = true
 }

package/src/auth/multi-tenancy/permissions.ts

@@ -8,7 +8,7 @@
  *
  * The DB table `org_rol_permissions` mirrors this constant. Reconciliation
  * runs at API boot (insert-or-update only — never auto-delete; see the
- * deletion runbook in the auth-role-system-redesign doc).
+ * deletion runbook in the auth-role-system doc -- review/auth-role-system/).
  *
  * Adding a permission:
  *   1. Add an entry below.
@@ -29,7 +29,8 @@ export const PERMISSIONS = {
   SECRETS_MANAGE: 'secrets.manage',
   OPERATIONS_READ: 'operations.read',
   OPERATIONS_MANAGE: 'operations.manage',
-  WORK_MANAGE: 'work.manage'
+  ACQUISITION_MANAGE: 'acquisition.manage',
+  PROJECTS_MANAGE: 'projects.manage'
 } as const
 
 export type PermissionKey = (typeof PERMISSIONS)[keyof typeof PERMISSIONS]
@@ -87,9 +88,15 @@ export const PERMISSION_CATALOG: readonly PermissionDescriptor[] = [
     isOrgGrantable: true
   },
   {
-    key: 'work.manage',
-    description: 'Create and edit business-domain records (acq_*, prj_*)',
-    isOrgGrantable: true
+    key: 'acquisition.manage',
+    description:
+      'Create, update, and delete acquisition records (acq_companies, acq_contacts, acq_deals, acq_lists*, acq_content*, acquisition storage files)',
+    isOrgGrantable: false
+  },
+  {
+    key: 'projects.manage',
+    description: 'Create, update, and delete project records (prj_projects, prj_milestones, prj_tasks, prj_notes)',
+    isOrgGrantable: false
   }
 ] as const
 

package/src/business/acquisition/activity-events.ts

@@ -0,0 +1,142 @@
+import { z } from 'zod'
+
+// ---------------------------------------------------------------------------
+// Individual event member schemas
+// ---------------------------------------------------------------------------
+
+const StageChangeEventSchema = z.object({
+  type: z.literal('stage_change'),
+  timestamp: z.string().datetime(),
+  stageBefore: z.string(),
+  stageAfter: z.string(),
+  reason: z.string().optional()
+})
+
+const StateChangeEventSchema = z.object({
+  type: z.literal('state_change'),
+  timestamp: z.string().datetime(),
+  stateBefore: z.string().nullable(),
+  stateAfter: z.string().nullable(),
+  reason: z.string().optional()
+})
+
+const ActionTakenEventSchema = z.object({
+  type: z.literal('action_taken'),
+  timestamp: z.string().datetime(),
+  actionKey: z.string(),
+  payload: z.record(z.string(), z.unknown()).optional()
+})
+
+const ApprovalCreatedEventSchema = z.object({
+  type: z.literal('approval_created'),
+  timestamp: z.string().datetime(),
+  commandId: z.string(),
+  dealStageBefore: z.string().optional(),
+  dealStageAfter: z.string().optional()
+})
+
+const ApprovalResolvedEventSchema = z.object({
+  type: z.literal('approval_resolved'),
+  timestamp: z.string().datetime(),
+  commandId: z.string(),
+  resolution: z.enum(['superseded']),
+  originResourceType: z.string().optional()
+})
+
+const ApprovalStaleEventSchema = z.object({
+  type: z.literal('approval_stale'),
+  timestamp: z.string().datetime(),
+  commandId: z.string(),
+  dealStageBefore: z.string().optional(),
+  dealStageAfter: z.string().optional()
+})
+
+const TaskCreatedEventSchema = z.object({
+  type: z.literal('task_created'),
+  timestamp: z.string().datetime(),
+  taskId: z.string()
+})
+
+const DealCreatedEventSchema = z.object({
+  type: z.literal('deal_created'),
+  timestamp: z.string().datetime()
+})
+
+const ReplyReceivedEventSchema = z.object({
+  type: z.literal('reply_received'),
+  timestamp: z.string().datetime(),
+  messageId: z.string().optional(),
+  source: z.string().optional()
+})
+
+const ReplySentToLeadEventSchema = z.object({
+  type: z.literal('reply_sent_to_lead'),
+  timestamp: z.string().datetime(),
+  messageId: z.string().optional(),
+  source: z.string().optional()
+})
+
+const BookingNudgeSentEventSchema = z.object({
+  type: z.literal('booking_nudge_sent'),
+  timestamp: z.string().datetime(),
+  followupDay: z.number()
+})
+
+const ReminderSentEventSchema = z.object({
+  type: z.literal('reminder_sent'),
+  timestamp: z.string().datetime(),
+  followupDay: z.number().optional()
+})
+
+const BookingCancelledEventSchema = z.object({
+  type: z.literal('booking_cancelled'),
+  timestamp: z.string().datetime(),
+  reason: z.string().optional()
+})
+
+const DiscoverySubmittedEventSchema = z.object({
+  type: z.literal('discovery_submitted'),
+  timestamp: z.string().datetime()
+})
+
+const MovedToNurturingEventSchema = z.object({
+  type: z.literal('moved_to_nurturing'),
+  timestamp: z.string().datetime()
+})
+
+const NoShowEventSchema = z.object({
+  type: z.literal('no_show'),
+  timestamp: z.string().datetime()
+})
+
+const FollowupEmailSentEventSchema = z.object({
+  type: z.literal('followup_email_sent'),
+  timestamp: z.string().datetime(),
+  followupDay: z.number().optional()
+})
+
+// ---------------------------------------------------------------------------
+// Union
+// ---------------------------------------------------------------------------
+
+export const ActivityEventSchema = z.discriminatedUnion('type', [
+  StageChangeEventSchema,
+  StateChangeEventSchema,
+  ActionTakenEventSchema,
+  ApprovalCreatedEventSchema,
+  ApprovalResolvedEventSchema,
+  ApprovalStaleEventSchema,
+  TaskCreatedEventSchema,
+  DealCreatedEventSchema,
+  ReplyReceivedEventSchema,
+  ReplySentToLeadEventSchema,
+  BookingNudgeSentEventSchema,
+  ReminderSentEventSchema,
+  BookingCancelledEventSchema,
+  DiscoverySubmittedEventSchema,
+  MovedToNurturingEventSchema,
+  NoShowEventSchema,
+  FollowupEmailSentEventSchema
+])
+
+export type ActivityEvent = z.infer<typeof ActivityEventSchema>