@elevasis/core 0.35.1 → 0.37.0

package/dist/test-utils/index.js

@@ -2011,7 +2011,7 @@ var RLSTestContext = class {
     if (roleErr || !roleDef) {
       throw new Error(`Failed to look up system role '${slug}': ${roleErr?.message ?? "not found"}`);
     }
-    const { error: assignErr } = await this.adminClient.from("org_rol_assignments").insert({ membership_id: membershipId, role_id: roleDef.id });
+    const { error: assignErr } = await this.adminClient.from("org_rol_assignments").upsert({ membership_id: membershipId, role_id: roleDef.id }, { onConflict: "membership_id,role_id" });
     if (assignErr) {
       throw new Error(`Failed to assign system role '${slug}' to membership: ${assignErr.message}`);
     }
@@ -19817,6 +19817,7 @@ var ORGANIZATION_MODEL_ICON_TOKENS = [
   "view",
   "launch",
   "message",
+  "message-plus",
   "escalate",
   "promote",
   "submit",
@@ -20001,9 +20002,22 @@ var SidebarNavigationSchema = z.object({
   primary: SidebarSectionSchema,
   bottom: SidebarSectionSchema
 }).default({ primary: {}, bottom: {} });
+var TopbarActionNodeSchema = z.object({
+  id: ModelIdSchema,
+  label: LabelSchema,
+  tooltip: DescriptionSchema.optional(),
+  icon: IconNameSchema.optional(),
+  order: z.number().int().optional(),
+  enabled: z.boolean().default(true),
+  devOnly: z.boolean().optional(),
+  requiresAdmin: z.boolean().optional(),
+  targets: SidebarSurfaceTargetsSchema.optional()
+});
+var TopbarSectionSchema = z.record(z.string(), TopbarActionNodeSchema).default({});
 var OrganizationModelNavigationSchema = z.object({
-  sidebar: SidebarNavigationSchema
-}).default({ sidebar: { primary: {}, bottom: {} } });
+  sidebar: SidebarNavigationSchema,
+  topbar: TopbarSectionSchema
+}).default({ sidebar: { primary: {}, bottom: {} }, topbar: {} });
 z.object({
   id: ModelIdSchema,
   label: LabelSchema,
@@ -21608,7 +21622,8 @@ var DEFAULT_ORGANIZATION_MODEL_NAVIGATION = {
   sidebar: {
     primary: {},
     bottom: {}
-  }
+  },
+  topbar: {}
 };
 var DEFAULT_ORGANIZATION_MODEL = {
   version: 1,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elevasis/core",
-  "version": "0.35.1",
+  "version": "0.37.0",
   "license": "MIT",
   "description": "Minimal shared constants across Elevasis monorepo",
   "sideEffects": false,

package/src/_gen/__tests__/__snapshots__/contracts.md.snap

@@ -135,6 +135,18 @@ export type OrganizationModelSidebarSurfaceNode = Extract<OrganizationModelSideb
 export type OrganizationModelSidebarGroupNode = Extract<OrganizationModelSidebarNode, { type: 'group' }>
 ```
 
+### `OrganizationModelTopbarActionNode`
+
+```typescript
+export type OrganizationModelTopbarActionNode = z.infer<typeof TopbarActionNodeSchema>
+```
+
+### `OrganizationModelTopbarSection`
+
+```typescript
+export type OrganizationModelTopbarSection = z.infer<typeof TopbarSectionSchema>
+```
+
 ### `OrganizationModelTechStackEntry`
 
 ```typescript
@@ -845,6 +857,57 @@ export interface ShellRuntime {
 }
 ```
 
+### `ResolvedTopbarAction`
+
+```typescript
+/**
+ * A resolved topbar action — the OM node after gating/filtering, with icon resolved
+ * from the semantic icon registry. Passed to `TopbarActionModule.render`.
+ */
+export interface ResolvedTopbarAction {
+  id: string
+  label: string
+  tooltip?: string
+  icon: TablerIconComponent
+  order: number
+}
+```
+
+### `TopbarActionModule`
+
+```typescript
+/**
+ * A topbar action module — binds a registry key to UI behavior (a render callback).
+ * The key must match `navigation.topbar[id]`. The OM supplies data + visibility;
+ * the module supplies behavior.
+ */
+export interface TopbarActionModule {
+  /** Stable key that matches the `id` of a `navigation.topbar` node. */
+  key: string
+  /** Render the topbar action. Receives the resolved OM node (icon pre-resolved). */
+  render: (ctx: { node: ResolvedTopbarAction }) => ReactNode
+}
+```
+
+### `ResolvedTopbarActionEntry`
+
+```typescript
+/** A joined entry emitted by `getTopbarActions`: resolved OM node + module behavior. */
+export interface ResolvedTopbarActionEntry {
+  node: ResolvedTopbarAction
+  render: TopbarActionModule['render']
+}
+```
+
+### `TopbarActionsProjectionOptions`
+
+```typescript
+export interface TopbarActionsProjectionOptions {
+  isPlatformAdmin?: boolean
+  isDev?: boolean
+}
+```
+
 ### `OrganizationGraphSystemBridge`
 
 ```typescript
@@ -868,6 +931,8 @@ export interface OrganizationGraphContextValue {
 ```typescript
 export interface ElevasisSystemsProviderProps {
   systems?: SystemModule[]
+  /** Registered topbar action modules. OM node presence controls visibility; module supplies behavior. */
+  topbarActions?: TopbarActionModule[]
   organizationModel?: ElevasisOrganizationModel
   timeRange?: TimeRange
   operationsApiUrl?: string
@@ -886,6 +951,8 @@ export interface ElevasisSystemsContextValue {
   shellModel: ResolvedShellModel
   shellRuntime: ShellRuntime
   getSidebarLinks: (options?: ShellSidebarProjectionOptions) => ShellSidebarLinkGroup[]
+  /** Returns the list of topbar actions visible to the current user, in order. */
+  getTopbarActions: (options?: TopbarActionsProjectionOptions) => ResolvedTopbarActionEntry[]
   enabledResolvedSystems: ResolvedSystemModule[]
   resolvedSystems: ResolvedSystemModule[]
   organizationGraph: OrganizationGraphContextValue

package/src/auth/multi-tenancy/invitations/api-schemas.ts

@@ -59,11 +59,25 @@ export const SendInvitationSchema = z
  * Security:
  * - Token validated (non-empty string)
  */
-export const AcceptInvitationSchema = z
-  .object({
-    invitation_token: z.string().min(1, 'Invitation token is required')
-  })
-  .strict()
+export const AcceptInvitationSchema = z
+  .object({
+    invitation_token: z.string().min(1, 'Invitation token is required')
+  })
+  .strict()
+
+/**
+ * Public invitation router query
+ * GET /api/invite
+ *
+ * Security:
+ * - Token validated as present only; service layer performs WorkOS lookup
+ * - Router redirects with only the token needed by tenant AuthKit login
+ */
+export const InviteRouterQuerySchema = z
+  .object({
+    invitation_token: z.string().min(1, 'Invitation token is required')
+  })
+  .strict()
 
 // ============================================================================
 // Query Parameters
@@ -98,7 +112,8 @@ export const ListInvitationsQuerySchema = z
 // ============================================================================
 
 // Export inferred types for use in route handlers
-export type SendInvitationInput = z.infer<typeof SendInvitationSchema>
-export type AcceptInvitationInput = z.infer<typeof AcceptInvitationSchema>
-export type ListInvitationsQuery = z.infer<typeof ListInvitationsQuerySchema>
-export type InvitationIdParam = z.infer<typeof InvitationIdParamSchema>
+export type SendInvitationInput = z.infer<typeof SendInvitationSchema>
+export type AcceptInvitationInput = z.infer<typeof AcceptInvitationSchema>
+export type InviteRouterQuery = z.infer<typeof InviteRouterQuerySchema>
+export type ListInvitationsQuery = z.infer<typeof ListInvitationsQuerySchema>
+export type InvitationIdParam = z.infer<typeof InvitationIdParamSchema>

package/src/auth/multi-tenancy/invitations/index.ts

@@ -27,12 +27,14 @@ export { transformSupabaseToInvitation } from './supabase'
 
 // Validation schemas
 export {
-  SendInvitationSchema,
-  AcceptInvitationSchema,
-  ListInvitationsQuerySchema,
-  InvitationIdParamSchema,
-  type SendInvitationInput,
-  type AcceptInvitationInput,
-  type ListInvitationsQuery,
-  type InvitationIdParam
-} from './api-schemas'
+  SendInvitationSchema,
+  AcceptInvitationSchema,
+  InviteRouterQuerySchema,
+  ListInvitationsQuerySchema,
+  InvitationIdParamSchema,
+  type SendInvitationInput,
+  type AcceptInvitationInput,
+  type InviteRouterQuery,
+  type ListInvitationsQuery,
+  type InvitationIdParam
+} from './api-schemas'

package/src/auth/multi-tenancy/organizations/__tests__/api-schemas.test.ts

@@ -1,5 +1,10 @@
 import { describe, expect, it } from 'vitest'
-import { CreateOrganizationSchema, ListOrganizationsQuerySchema, UpdateOrganizationSchema } from '../api-schemas'
+import {
+  CreateOrganizationSchema,
+  ListOrganizationsQuerySchema,
+  UpdateOrganizationAuthConfigSchema,
+  UpdateOrganizationSchema
+} from '../api-schemas'
 
 // ---------------------------------------------------------------------------
 // CreateOrganizationSchema
@@ -87,7 +92,7 @@ describe('CreateOrganizationSchema', () => {
 // UpdateOrganizationSchema
 // ---------------------------------------------------------------------------
 
-describe('UpdateOrganizationSchema', () => {
+describe('UpdateOrganizationSchema', () => {
   it('rejects an empty object (at least one field required)', () => {
     // UpdateOrganizationSchema is CreateOrganizationSchema.partial().strict().refine(...)
     // The .refine() enforces the documented "at least one field" convention
@@ -135,7 +140,38 @@ describe('UpdateOrganizationSchema', () => {
   it('rejects unknown top-level fields (.strict() mode)', () => {
     expect(UpdateOrganizationSchema.safeParse({ name: 'Valid Name', unknownField: 'bad' }).success).toBe(false)
   })
-})
+})
+
+// ---------------------------------------------------------------------------
+// UpdateOrganizationAuthConfigSchema
+// ---------------------------------------------------------------------------
+
+describe('UpdateOrganizationAuthConfigSchema', () => {
+  it('accepts an HTTPS app origin', () => {
+    expect(UpdateOrganizationAuthConfigSchema.safeParse({ appOrigin: 'https://app.example.com' }).success).toBe(true)
+  })
+
+  it('rejects app origins with paths, query strings, or hashes', () => {
+    expect(UpdateOrganizationAuthConfigSchema.safeParse({ appOrigin: 'https://app.example.com/login' }).success).toBe(
+      false
+    )
+    expect(UpdateOrganizationAuthConfigSchema.safeParse({ appOrigin: 'https://app.example.com?x=1' }).success).toBe(
+      false
+    )
+    expect(UpdateOrganizationAuthConfigSchema.safeParse({ appOrigin: 'https://app.example.com#hash' }).success).toBe(
+      false
+    )
+  })
+
+  it('rejects unknown config fields', () => {
+    expect(
+      UpdateOrganizationAuthConfigSchema.safeParse({
+        appOrigin: 'https://app.example.com',
+        other: true
+      }).success
+    ).toBe(false)
+  })
+})
 
 // ---------------------------------------------------------------------------
 // ListOrganizationsQuerySchema

package/src/auth/multi-tenancy/organizations/api-schemas.ts

@@ -101,11 +101,38 @@ export const CreateOrganizationSchema = z
  * - At least one field required (matches documented Update schema convention,
  *   see .claude/rules/core-package.md → "api-schemas.ts Pattern")
  */
-export const UpdateOrganizationSchema = CreateOrganizationSchema.partial()
-  .strict()
-  .refine((data) => Object.keys(data).length > 0, {
-    message: 'At least one field (name, domainData, or metadata) must be provided'
-  })
+export const UpdateOrganizationSchema = CreateOrganizationSchema.partial()
+  .strict()
+  .refine((data) => Object.keys(data).length > 0, {
+    message: 'At least one field (name, domainData, or metadata) must be provided'
+  })
+
+/**
+ * Update organization auth config
+ * PATCH /organizations/:id/config/auth
+ *
+ * Security:
+ * - Narrow config surface: only appOrigin is accepted
+ * - App origin is an origin URL, not a route URL
+ * - Strict mode prevents accidental writes to unrelated config keys
+ */
+export const UpdateOrganizationAuthConfigSchema = z
+  .object({
+    appOrigin: z
+      .string()
+      .trim()
+      .url('App origin must be a valid URL')
+      .max(2048, 'App origin must be at most 2048 characters')
+      .refine((value) => {
+        try {
+          const url = new URL(value)
+          return url.pathname === '/' && url.search === '' && url.hash === ''
+        } catch {
+          return false
+        }
+      }, 'App origin must not include a path, query string, or hash')
+  })
+  .strict()
 
 // ============================================================================
 // Query Parameters
@@ -131,6 +158,7 @@ export const ListOrganizationsQuerySchema = z.object({
 
 // Export inferred types for use in route handlers
 export type CreateOrganizationInput = z.infer<typeof CreateOrganizationSchema>
-export type UpdateOrganizationInput = z.infer<typeof UpdateOrganizationSchema>
-export type ListOrganizationsQuery = z.infer<typeof ListOrganizationsQuerySchema>
-export type OrganizationIdParam = z.infer<typeof OrganizationIdParamSchema>
+export type UpdateOrganizationInput = z.infer<typeof UpdateOrganizationSchema>
+export type UpdateOrganizationAuthConfigInput = z.infer<typeof UpdateOrganizationAuthConfigSchema>
+export type ListOrganizationsQuery = z.infer<typeof ListOrganizationsQuerySchema>
+export type OrganizationIdParam = z.infer<typeof OrganizationIdParamSchema>

package/src/auth/multi-tenancy/organizations/index.ts

@@ -8,16 +8,18 @@ export type { Organization, OrganizationSummary } from './organization'
 
 // Validation schemas
 export {
-  CreateOrganizationSchema,
-  UpdateOrganizationSchema,
-  ListOrganizationsQuerySchema,
-  OrganizationIdParamSchema,
-  OrganizationNameSchema,
-  OrganizationDomainSchema,
-  type CreateOrganizationInput,
-  type UpdateOrganizationInput,
-  type ListOrganizationsQuery,
-  type OrganizationIdParam
-} from './api-schemas'
+  CreateOrganizationSchema,
+  UpdateOrganizationSchema,
+  UpdateOrganizationAuthConfigSchema,
+  ListOrganizationsQuerySchema,
+  OrganizationIdParamSchema,
+  OrganizationNameSchema,
+  OrganizationDomainSchema,
+  type CreateOrganizationInput,
+  type UpdateOrganizationInput,
+  type UpdateOrganizationAuthConfigInput,
+  type ListOrganizationsQuery,
+  type OrganizationIdParam
+} from './api-schemas'
 
 // Note: WorkOS types and transforms available via @repo/core/server

package/src/business/acquisition/build-templates.test.ts

@@ -170,6 +170,40 @@ describe('createBuildPlanSnapshotFromTemplate', () => {
       ]
     })
   })
+
+  it('normalizes stage-key dependencies to step ids for snapshots', () => {
+    const snapshot = createBuildPlanSnapshotFromTemplate({
+      id: 'stage-key-dependency',
+      label: 'Stage Key Dependency',
+      steps: [
+        {
+          id: 'source-companies',
+          label: 'Companies found',
+          primaryEntity: 'company',
+          outputs: ['company'],
+          stageKey: 'populated',
+          dependencyMode: 'per-record-eligibility',
+          actionKey: 'lead-gen.company.source',
+          defaultBatchSize: 100,
+          maxBatchSize: 250
+        },
+        {
+          id: 'qualify-companies',
+          label: 'Companies qualified',
+          primaryEntity: 'company',
+          outputs: ['company'],
+          stageKey: 'qualified',
+          dependsOn: ['populated'],
+          dependencyMode: 'per-record-eligibility',
+          actionKey: 'lead-gen.company.qualify',
+          defaultBatchSize: 50,
+          maxBatchSize: 100
+        }
+      ]
+    })
+
+    expect(snapshot.steps[1]?.dependsOn).toEqual(['source-companies'])
+  })
 })
 
 describe('createBuildPlanSnapshotFromTemplateId', () => {

package/src/business/acquisition/build-templates.ts

@@ -30,6 +30,9 @@ export function isProspectingBuildTemplateId(
 }
 
 export function createBuildPlanSnapshotFromTemplate(template: ProspectingBuildTemplate): BuildPlanSnapshot {
+  const stepIdByStageKey = new Map(template.steps.map((step) => [step.stageKey, step.id]))
+  const stepIds = new Set(template.steps.map((step) => step.id))
+
   return {
     templateId: template.id,
     templateLabel: template.label,
@@ -50,7 +53,11 @@ export function createBuildPlanSnapshotFromTemplate(template: ProspectingBuildTe
 
       if (step.description) snapshotStep.description = step.description
       if (step.recordEntity) snapshotStep.recordEntity = step.recordEntity
-      if (step.dependsOn?.length) snapshotStep.dependsOn = [...step.dependsOn]
+      if (step.dependsOn?.length) {
+        snapshotStep.dependsOn = step.dependsOn.map((dependency) =>
+          stepIds.has(dependency) ? dependency : (stepIdByStageKey.get(dependency) ?? dependency)
+        )
+      }
       if (step.credentialRequirements?.length) {
         snapshotStep.credentialRequirements = step.credentialRequirements.map((requirement: CredentialRequirement) => ({
           ...requirement