@elevasis/core 0.32.0 → 0.33.0

package/dist/auth/index.d.ts

@@ -123,6 +123,7 @@ declare const PERMISSIONS: {
     readonly SECRETS_MANAGE: "secrets.manage";
     readonly OPERATIONS_READ: "operations.read";
     readonly OPERATIONS_MANAGE: "operations.manage";
+    readonly SALES_LEAD_GEN_MANAGE: "sales.lead-gen.manage";
     readonly ACQUISITION_MANAGE: "acquisition.manage";
     readonly PROJECTS_MANAGE: "projects.manage";
     readonly CLIENTS_MANAGE: "clients.manage";
@@ -5262,6 +5263,10 @@ declare const AccessKeys: {
         readonly systemPath: "permission.operations";
         readonly action: "manage";
     };
+    readonly leadGenManage: {
+        readonly systemPath: "sales.lead-gen";
+        readonly action: "manage";
+    };
     readonly acquisitionManage: {
         readonly systemPath: "permission.acquisition";
         readonly action: "manage";

package/dist/auth/index.js

@@ -35,6 +35,7 @@ var PERMISSIONS = {
   SECRETS_MANAGE: "secrets.manage",
   OPERATIONS_READ: "operations.read",
   OPERATIONS_MANAGE: "operations.manage",
+  SALES_LEAD_GEN_MANAGE: "sales.lead-gen.manage",
   ACQUISITION_MANAGE: "acquisition.manage",
   PROJECTS_MANAGE: "projects.manage",
   CLIENTS_MANAGE: "clients.manage"
@@ -80,6 +81,11 @@ var PERMISSION_CATALOG = [
     description: "Run and modify executions, sessions, schedules, queue",
     isOrgGrantable: true
   },
+  {
+    key: "sales.lead-gen.manage",
+    description: "Operate Lead Gen lists and list-builder workflows",
+    isOrgGrantable: true
+  },
   {
     key: "acquisition.manage",
     description: "Create, update, and delete acquisition records (acq_companies, acq_contacts, acq_deals, acq_lists*, acq_content*, acquisition storage files)",
@@ -421,6 +427,7 @@ var AccessKeys = {
   secretsManage: { systemPath: "permission.secrets", action: "manage" },
   operationsRead: { systemPath: "permission.operations", action: DEFAULT_ACCESS_ACTION },
   operationsManage: { systemPath: "permission.operations", action: "manage" },
+  leadGenManage: { systemPath: "sales.lead-gen", action: "manage" },
   acquisitionManage: { systemPath: "permission.acquisition", action: "manage" },
   projectsManage: { systemPath: "permission.projects", action: "manage" },
   clientsManage: { systemPath: "permission.clients", action: "manage" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elevasis/core",
-  "version": "0.32.0",
+  "version": "0.33.0",
   "license": "MIT",
   "description": "Minimal shared constants across Elevasis monorepo",
   "sideEffects": false,

package/src/auth/__tests__/access-keys.test.ts

@@ -23,6 +23,12 @@ const model = {
           label: 'CRM',
           lifecycle: 'active',
           order: 10
+        },
+        'lead-gen': {
+          id: 'lead-gen',
+          label: 'Lead Gen',
+          lifecycle: 'active',
+          order: 20
         }
       }
     },
@@ -53,6 +59,7 @@ describe('access keys', () => {
     expect(keys).toContainEqual({ systemPath: 'sales', action: 'view' })
     expect(keys).toContainEqual({ systemPath: 'sales.crm', action: 'view' })
     expect(keys).toContainEqual({ systemPath: 'sales.crm', action: 'manage' })
+    expect(keys).toContainEqual(AccessKeys.leadGenManage)
     expect(keys).toContainEqual({ systemPath: 'operations', action: 'manage' })
   })
 
@@ -78,4 +85,13 @@ describe('access keys', () => {
       rolePermission: 'members.manage'
     })
   })
+
+  it('maps the Lead Gen manage AccessKey to the OM System permission', () => {
+    const catalog = deriveAccessKeyCatalog(model)
+
+    expect(findAccessCatalogEntry(catalog, AccessKeys.leadGenManage)).toMatchObject({
+      source: 'om-system',
+      rolePermission: 'sales.lead-gen.manage'
+    })
+  })
 })

package/src/auth/__tests__/access-model.test.ts

@@ -17,6 +17,12 @@ const organizationModel = {
           label: 'CRM',
           lifecycle: 'active',
           order: 10
+        },
+        'lead-gen': {
+          id: 'lead-gen',
+          label: 'Lead Gen',
+          lifecycle: 'active',
+          order: 20
         }
       }
     },
@@ -179,6 +185,31 @@ describe('checkAccess', () => {
     })
   })
 
+  it('allows Lead Gen manage only with the explicit OM System permission', () => {
+    expect(
+      checkAccess(
+        AccessKeys.leadGenManage,
+        context({
+          membership: {
+            id: 'membership-1',
+            organizationId: 'org-1',
+            effectivePermissions: ['sales.lead-gen.manage']
+          }
+        })
+      )
+    ).toEqual({
+      allowed: true,
+      restrictedBy: null,
+      reason: 'allowed'
+    })
+
+    expect(checkAccess(AccessKeys.leadGenManage, context())).toEqual({
+      allowed: false,
+      restrictedBy: 'role-permission',
+      reason: 'role-permission-denied'
+    })
+  })
+
   it('requires explicit role permissions for permission-only access keys', () => {
     expect(
       checkAccess(

package/src/auth/access-keys.ts

@@ -54,6 +54,7 @@ export const AccessKeys = {
   secretsManage: { systemPath: 'permission.secrets', action: 'manage' },
   operationsRead: { systemPath: 'permission.operations', action: DEFAULT_ACCESS_ACTION },
   operationsManage: { systemPath: 'permission.operations', action: 'manage' },
+  leadGenManage: { systemPath: 'sales.lead-gen', action: 'manage' },
   acquisitionManage: { systemPath: 'permission.acquisition', action: 'manage' },
   projectsManage: { systemPath: 'permission.projects', action: 'manage' },
   clientsManage: { systemPath: 'permission.clients', action: 'manage' },

package/src/auth/multi-tenancy/permissions.ts

@@ -32,12 +32,13 @@ export const PERMISSIONS = {
   MEMBERS_MANAGE: 'members.manage',
   ROLES_MANAGE: 'roles.manage',
   SECRETS_MANAGE: 'secrets.manage',
-  OPERATIONS_READ: 'operations.read',
-  OPERATIONS_MANAGE: 'operations.manage',
-  ACQUISITION_MANAGE: 'acquisition.manage',
-  PROJECTS_MANAGE: 'projects.manage',
-  CLIENTS_MANAGE: 'clients.manage'
-} as const
+  OPERATIONS_READ: 'operations.read',
+  OPERATIONS_MANAGE: 'operations.manage',
+  SALES_LEAD_GEN_MANAGE: 'sales.lead-gen.manage',
+  ACQUISITION_MANAGE: 'acquisition.manage',
+  PROJECTS_MANAGE: 'projects.manage',
+  CLIENTS_MANAGE: 'clients.manage'
+} as const
 
 export type PermissionKey = (typeof PERMISSIONS)[keyof typeof PERMISSIONS]
 
@@ -89,13 +90,18 @@ export const PERMISSION_CATALOG: readonly PermissionDescriptor[] = [
     description: 'View executions, sessions, schedules, and command queue',
     isOrgGrantable: true
   },
-  {
-    key: 'operations.manage',
-    description: 'Run and modify executions, sessions, schedules, queue',
-    isOrgGrantable: true
-  },
-  {
-    key: 'acquisition.manage',
+  {
+    key: 'operations.manage',
+    description: 'Run and modify executions, sessions, schedules, queue',
+    isOrgGrantable: true
+  },
+  {
+    key: 'sales.lead-gen.manage',
+    description: 'Operate Lead Gen lists and list-builder workflows',
+    isOrgGrantable: true
+  },
+  {
+    key: 'acquisition.manage',
     description:
       'Create, update, and delete acquisition records (acq_companies, acq_contacts, acq_deals, acq_lists*, acq_content*, acquisition storage files)',
     isOrgGrantable: false

package/src/organization-model/__tests__/define-domain-record.test.ts

@@ -216,45 +216,42 @@ describe.each([
     idField: 'id' as const,
     invalidOverride: { kind: 'invalid-kind' }
   }
-])(
-  'define$domain — $domain',
-  ({ domain: _domain, defineSingle, defineMultiple, valid, schema, idField, invalidOverride }) => {
-    it('defineX — validates and returns a parsed entry', () => {
-      const result = defineSingle(valid as never)
-      expect(result).toHaveProperty(idField)
-      expect((result as Record<string, unknown>)[idField]).toBe((valid as Record<string, unknown>)[idField])
-    })
+])('define$domain — $domain', ({ domain: _domain, defineSingle, defineMultiple, valid, idField, invalidOverride }) => {
+  it('defineX — validates and returns a parsed entry', () => {
+    const result = defineSingle(valid as never)
+    expect(result).toHaveProperty(idField)
+    expect((result as Record<string, unknown>)[idField]).toBe((valid as Record<string, unknown>)[idField])
+  })
 
-    it('defineX — throws ZodError on invalid input', () => {
-      const bad = { ...valid, ...invalidOverride } as never
-      expect(() => defineSingle(bad)).toThrow(z.ZodError)
-    })
+  it('defineX — throws ZodError on invalid input', () => {
+    const bad = { ...valid, ...invalidOverride } as never
+    expect(() => defineSingle(bad)).toThrow(z.ZodError)
+  })
 
-    it('defineXs — produces an id-keyed map', () => {
-      const result = defineMultiple([valid] as never[])
-      const id = (valid as Record<string, unknown>)[idField] as string
-      expect(result).toHaveProperty(id)
-      expect((result[id] as Record<string, unknown>)[idField]).toBe(id)
-    })
+  it('defineXs — produces an id-keyed map', () => {
+    const result = defineMultiple([valid] as never[])
+    const id = (valid as Record<string, unknown>)[idField] as string
+    expect(result).toHaveProperty(id)
+    expect((result[id] as Record<string, unknown>)[idField]).toBe(id)
+  })
 
-    it('defineXs — throws ZodError on invalid input', () => {
-      const bad = { ...valid, ...invalidOverride } as never
-      expect(() => defineMultiple([bad] as never[])).toThrow(z.ZodError)
-    })
+  it('defineXs — throws ZodError on invalid input', () => {
+    const bad = { ...valid, ...invalidOverride } as never
+    expect(() => defineMultiple([bad] as never[])).toThrow(z.ZodError)
+  })
 
-    it('defineXs — returns empty map for empty array', () => {
-      const result = defineMultiple([] as never[])
-      expect(result).toEqual({})
-    })
+  it('defineXs — returns empty map for empty array', () => {
+    const result = defineMultiple([] as never[])
+    expect(result).toEqual({})
+  })
 
-    it('defineXs — validates through schema (no bypass)', () => {
-      // Confirm that defineMultiple uses schema.parse, not a pass-through.
-      // Missing required fields should throw even if the object looks similar.
-      const missingRequired = { [idField]: (valid as Record<string, unknown>)[idField] } as never
-      expect(() => defineMultiple([missingRequired] as never[])).toThrow(z.ZodError)
-    })
-  }
-)
+  it('defineXs — validates through schema (no bypass)', () => {
+    // Confirm that defineMultiple uses schema.parse, not a pass-through.
+    // Missing required fields should throw even if the object looks similar.
+    const missingRequired = { [idField]: (valid as Record<string, unknown>)[idField] } as never
+    expect(() => defineMultiple([missingRequired] as never[])).toThrow(z.ZodError)
+  })
+})
 
 // ---------------------------------------------------------------------------
 // Topology — existing helpers (defineTopology, defineTopologyRelationship)